From secdir-bounces@ietf.org Mon Dec 1 05:28:28 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 565903A6CEA; Mon, 1 Dec 2008 05:28:28 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1DA2E3A6C80; Mon, 1 Dec 2008 05:28:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.503 X-Spam-Level: X-Spam-Status: No, score=-6.503 tagged_above=-999 required=5 tests=[AWL=0.096, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b987IDPqY1Od; Mon, 1 Dec 2008 05:28:25 -0800 (PST) Received: from mgw-mx09.nokia.com (smtp.nokia.com [192.100.105.134]) by core3.amsl.com (Postfix) with ESMTP id 796CF28C57B; Mon, 1 Dec 2008 05:17:36 -0800 (PST) Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-mx09.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id mB1DHIXM012984; Mon, 1 Dec 2008 07:17:31 -0600 Received: from esebh102.NOE.Nokia.com ([172.21.138.183]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 1 Dec 2008 15:16:13 +0200 Received: from vaebe104.NOE.Nokia.com ([10.160.244.59]) by esebh102.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 1 Dec 2008 15:16:13 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Mon, 1 Dec 2008 15:16:12 +0200 Message-ID: <1696498986EFEC4D9153717DA325CB720268A2F4@vaebe104.NOE.Nokia.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Pasi's AD Notes for November 2008 Thread-Index: AclTtvt7wAXKXavoQBadDbxjKscd6g== From: To: , X-OriginalArrivalTime: 01 Dec 2008 13:16:13.0659 (UTC) FILETIME=[FC2ADAB0:01C953B6] X-Nokia-AV: Clean Subject: [secdir] Pasi's AD Notes for November 2008 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi all, Here's again a short status update about what things are going on from my point-of-view. If you notice anything that doesn't look right, let me know -- miscommunication and mix-ups do happen. Best regards, Pasi MISC NOTES - December will be a very busy month for IESG; we're having three telechats with probably ~50 documents. Expect some delay in email, too... - IANA fixed the registries for RFC 4909 (needed for draft-jerichow-msec-mikey-genext-oma, currently in IETF Last Call). - Lars Eggert and I met with CERT-FI to discuss the TCP DoS vulnerabilities found by Outpost24. - I've continued tools development, and my first code fragment was deployed on datatracker.ietf.org during the IETF meeting week. More coming soon... WORKING GROUPS DKIM - draft-ietf-dkim-ssp: in IETF Last Call (ends 2008-12-09), on agenda of 2008-12-18 IESG telechat. - draft-ietf-dkim-overview: in Publication Requested, waiting for me to read it. - Waiting for WG to send list of RFC errata IDs the WG agrees on. EMU - draft-ietf-emu-gpsk: waiting for IANA to confirm that they're happy with version -17. - (not WG item) draft-arkko-eap-aka-kdf: was approved, now in RFC Editor Queue. IPSECME - I and Tim responded to an appeal by Hui Deng and Peny Yang. - (not wearing AD hat) I need to check that my comments got entered into the issue tracker, and reply to Paul about some of them. - (not wearing AD hat) Waiting for Russ to verify errata #1502 for RFC 4718 [since 2008-09-12] ISMS - All the WG documents went through WG Last Call; hoping to see revised IDs soon. KEYPROV - I sent a bunch of comments about DSKPP to the list; I'm hoping the WG decides soon how to simplify the protocol. PKIX - Note: I'm shepherding two PKIX drafts where Tim is a co-author - draft-ietf-pkix-ecc-subpubkeyinfo: in IETF Last Call (ends 2008-12-09), on agenda of 2008-12-18 IESG telechat. - draft-ietf-pkix-rfc4055-update: in Publication Requested, waiting for me to read it. SASL - Lots of emails that I need to read, but haven't done so yet... SYSLOG - draft-ietf-syslog-transport-tls: now in AUTH48 state - draft-ietf-syslog-sign: hoping to see a revised ID that would handle the easy comments from my AD evaluation TLS - draft-ietf-tls-des-idea: went through IETF Last Call, on agenda of 2009-01-08 IESG telechat. - draft-ietf-tls-ecdhe-psk: in Publication Requested, waiting for me to read it (in January) - draft-ietf-tls-psk-new-mac-aes-gcm: same as ecdhe-psk - (not WG item) draft-rescorla-tls-suiteb: was approved, now in RFC Editor Queue - Errata #1585: I filed an errata for TLS 1.2; waiting for Ekr to confirm that it's correct. OTHER DOCUMENTS - draft-ietf-pkix-cmp-transport-protocols: It seems some folks are interested in reviving this long-expired draft, so that current implementation behavior is documented somewhere. I've promised to read and comment if/when something is submitted. - draft-randall-3447bis: James Randall posted the -00 draft; I should read this and comment. - draft-ietf-mpls-mpls-and-gmpls-security-framework: I've promised to read this once there's a new version. - "Security roadmap for routing protocols": Gregory has sent the first draft-of-a-draft; Tim and I have promised to comment and contribute. - "Applicability guidance for security protocols": Tim and I have promised to write something that would help in determining which security mechanism (e.g. TLS, IPsec, SASL, GSS-API, ..) to use for a new higher-layer protocol. - draft-mattsson-srtp-store-and-forward: I've promised to read this and send comments, but haven't done so yet. DISCUSSES (active -- something happened within last month) - draft-ietf-dime-mip6-integrated: discussion ongoing [at 2008-11-28] - draft-ietf-enum-combined: waiting for the authors to reply to my comments [since 2008-11-28] - draft-ietf-mipshop-mstp-solution: I talked with Jari and the authors in Minneapolis, and I think we have a rough agreement about the next steps; waiting for authors to propose concrete text [since 2008-11-17] - draft-ietf-shim6-proto: Erik has sent proposed text; I need to read it [since 2008-11-20] - draft-ietf-simple-imdn: rough agreement on changes, waiting for authors to submit a revised ID [since 2008-11-17] - draft-ietf-sip-dtls-srtp-framework: waiting for authors to reply to my comments or submit a revised ID [since 2008-11-06] - draft-ietf-vrrp-unified-spec: waiting for authors to propose text [since 2008-11-28] - draft-kato-camellia-ctrccm: waiting for authors to reply to my comments or submit a revised ID [since 2008-11-06] - draft-kato-ipsec-camellia-modes: waiting for authors to reply to my comments or submit a revised ID [since 2008-11-06] DISCUSSES (stalled -- I haven't heard anything from the authors or document shepherd for over one month) - draft-ietf-sip-xcapevent: waiting for revised ID or RFC Editor Note to fix the ABNF/XML bugs [since 2008-10-24] - draft-ietf-sipping-policy-package: waiting for more information from Mary or Jon [since 2008-10-28] DISCUSSES (presumed dead -- I haven't heard anything from the authors or document shepherd for over three months) - draft-cain-post-inch-phishingextns: waiting for authors to reply to my comments or submit a revised ID [since 2008-08-28] - draft-ietf-bfd-base: waiting for authors to reply to my comments or submit a revised ID [since 2008-06-05] - draft-ietf-bfd-multihop: waiting for authors to reply to my comments or submit a revised ID [since 2008-06-05] - draft-ietf-bfd-v4v6-1hop: waiting for authors to reply to my comments or submit a revised ID [since 2008-06-05] --end-- _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 1 09:37:21 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 71D5D28C0D6; Mon, 1 Dec 2008 09:37:21 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C89FE3A6A48 for ; Mon, 1 Dec 2008 09:37:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.277 X-Spam-Level: X-Spam-Status: No, score=-104.277 tagged_above=-999 required=5 tests=[AWL=2.322, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rhOXXyiyxD4M for ; Mon, 1 Dec 2008 09:37:19 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 7F94F3A67FF for ; Mon, 1 Dec 2008 09:37:18 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB1HbC8j003861 for ; Mon, 1 Dec 2008 12:37:14 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB1HbAtG003853 for ; Mon, 1 Dec 2008 12:37:10 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB1Hb5Ww010966 for ; Mon, 1 Dec 2008 12:37:05 -0500 (EST) Received: from woodstock.binhost.com (woodstock.binhost.com [8.8.40.152]) by mit.edu (Spam Firewall) with SMTP id A3FF11296166 for ; Mon, 1 Dec 2008 12:36:43 -0500 (EST) Received: (qmail 26864 invoked by uid 0); 1 Dec 2008 17:36:38 -0000 Received: from unknown (HELO THINKPADR52.vigilsec.com) (96.255.143.189) by woodstock.binhost.com with SMTP; 1 Dec 2008 17:36:38 -0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 01 Dec 2008 12:36:38 -0500 To: secdir@mit.edu From: Russ Housley Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=====================_6944609==_" Message-Id: <20081201173643.A3FF11296166@mit.edu> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: [secdir] GENI Security Workshop X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --=====================_6944609==_ Content-Type: text/plain; charset="us-ascii"; format=flowed Please find the attached call for participation. Enjoy, Russ --=====================_6944609==_ Content-Type: application/octet-stream; name="cfp4.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="cfp4.pdf" JVBERi0xLjMNJeLjz9MNCjQgMCBvYmoNPDwvTGluZWFyaXplZCAxL0wgNjU1NDYvTyA2L0UgNjEy NjMvTiAxL1QgNjU0MjAvSCBbIDEwOTYgMjA4XT4+DWVuZG9iag0gICAgICAgICAgICAgICAgICAg DQp4cmVmDQo0IDQwDQowMDAwMDAwMDE2IDAwMDAwIG4NCjAwMDAwMDEzMDQgMDAwMDAgbg0KMDAw MDAwMTM2NCAwMDAwMCBuDQowMDAwMDAxNTQxIDAwMDAwIG4NCjAwMDAwMDE2NzMgMDAwMDAgbg0K MDAwMDAwMTgyMiAwMDAwMCBuDQowMDAwMDAxOTcxIDAwMDAwIG4NCjAwMDAwMDIxMzIgMDAwMDAg bg0KMDAwMDAwMjI4NyAwMDAwMCBuDQowMDAwMDAyMzIyIDAwMDAwIG4NCjAwMDAwMDM1MDggMDAw MDAgbg0KMDAwMDAwNDUzNCAwMDAwMCBuDQowMDAwMDA1NTA0IDAwMDAwIG4NCjAwMDAwMDY1NDIg MDAwMDAgbg0KMDAwMDAwNzYyNSAwMDAwMCBuDQowMDAwMDA3NzgyIDAwMDAwIG4NCjAwMDAwMDg3 ODYgMDAwMDAgbg0KMDAwMDAwOTk3MCAwMDAwMCBuDQowMDAwMDEwNzc2IDAwMDAwIG4NCjAwMDAw MTE2NjIgMDAwMDAgbg0KMDAwMDAyODYzNyAwMDAwMCBuDQowMDAwMDI4ODQ1IDAwMDAwIG4NCjAw MDAwMjkxMjcgMDAwMDAgbg0KMDAwMDAyOTgxMSAwMDAwMCBuDQowMDAwMDQwMjE2IDAwMDAwIG4N CjAwMDAwNDA0MjEgMDAwMDAgbg0KMDAwMDA0MDUyNyAwMDAwMCBuDQowMDAwMDQwOTU4IDAwMDAw IG4NCjAwMDAwNDQyODQgMDAwMDAgbg0KMDAwMDA0NDUwNSAwMDAwMCBuDQowMDAwMDQ0NTI3IDAw MDAwIG4NCjAwMDAwNDQ4MTkgMDAwMDAgbg0KMDAwMDA1MDU5MSAwMDAwMCBuDQowMDAwMDUwODA4 IDAwMDAwIG4NCjAwMDAwNTA4ODYgMDAwMDAgbg0KMDAwMDA1MTI3MSAwMDAwMCBuDQowMDAwMDYw NDI3IDAwMDAwIG4NCjAwMDAwNjA2MzcgMDAwMDAgbg0KMDAwMDA2MDc3OSAwMDAwMCBuDQowMDAw MDAxMDk2IDAwMDAwIG4NCnRyYWlsZXINCjw8L1NpemUgNDQvUHJldiA2NTQxMC9Sb290IDUgMCBS L0luZm8gMyAwIFIvSURbPDIzRDJCQjBDQzMyRjE2NDVGQzgxNzVBREIzMTY5MjFFPjw4M0Y4Mzc3 RkRCM0FGODRFOTAwOTQxODIzRTk0RjUxND5dPj4NCnN0YXJ0eHJlZg0KMA0KJSVFT0YNCiAgICAg ICAgICAgICAgICANCjQzIDAgb2JqDTw8L0xlbmd0aCAxMjcvRmlsdGVyL0ZsYXRlRGVjb2RlL0kg MTM5L1MgNDA+PnN0cmVhbQ0KeNpiYGBQZWBgaWEAgpe/GVABMxCzMHAcYGBgRRJVhWIGBjEGfkYz xh3MP9g/CCYoOrC19LDf4Lsgf8ApQODB1yZXZgG2gxxPWC8IOASdUj4Q3RDCbGS8gM2CgUHx6NyG xAYLpmt9O1gfsDdYHkCy8O9lIM0IxPcBAgwAm8kgKg0KZW5kc3RyZWFtDWVuZG9iag01IDAgb2Jq DTw8L01ldGFkYXRhIDIgMCBSL1BhZ2VzIDEgMCBSL1R5cGUvQ2F0YWxvZz4+DWVuZG9iag02IDAg b2JqDTw8L0Nyb3BCb3hbMCAwIDYxMiA3OTJdL1BhcmVudCAxIDAgUi9Db250ZW50c1sxMyAwIFIg MTQgMCBSIDE1IDAgUiAxNiAwIFIgMTcgMCBSIDE5IDAgUiAyMCAwIFIgMjEgMCBSXS9Sb3RhdGUg MC9NZWRpYUJveFswIDAgNjEyIDc5Ml0vUmVzb3VyY2VzIDcgMCBSL1R5cGUvUGFnZT4+DWVuZG9i ag03IDAgb2JqDTw8L0NvbG9yU3BhY2U8PC9DczEgMTIgMCBSPj4vRm9udDw8L0YzLjEgOCAwIFIv RjQuMSA5IDAgUi9GMS4xIDEwIDAgUi9GNS4xIDE4IDAgUi9GMi4xIDExIDAgUj4+L1Byb2NTZXRb L1BERi9UZXh0XT4+DWVuZG9iag04IDAgb2JqDTw8L1N1YnR5cGUvVHJ1ZVR5cGUvRm9udERlc2Ny aXB0b3IgMjQgMCBSL0xhc3RDaGFyIDk4L1dpZHRocyAyNSAwIFIvQmFzZUZvbnQvSEdGWExEK0Nh bWJyaWEvRmlyc3RDaGFyIDMzL1RvVW5pY29kZSAyNiAwIFIvVHlwZS9Gb250Pj4NZW5kb2JqDTkg MCBvYmoNPDwvU3VidHlwZS9UcnVlVHlwZS9Gb250RGVzY3JpcHRvciAyOCAwIFIvTGFzdENoYXIg NTQvV2lkdGhzIDI5IDAgUi9CYXNlRm9udC9YRVlVR0orQ2FsaWJyaS9GaXJzdENoYXIgMzMvVG9V bmljb2RlIDMwIDAgUi9UeXBlL0ZvbnQ+Pg1lbmRvYmoNMTAgMCBvYmoNPDwvU3VidHlwZS9UcnVl VHlwZS9Gb250RGVzY3JpcHRvciAzMiAwIFIvTGFzdENoYXIgMzMvV2lkdGhzIDMzIDAgUi9CYXNl Rm9udC9UU0tLVUgrQ2FtYnJpYS1Cb2xkSXRhbGljL0ZpcnN0Q2hhciAzMy9Ub1VuaWNvZGUgMzQg MCBSL1R5cGUvRm9udD4+DWVuZG9iag0xMSAwIG9iag08PC9TdWJ0eXBlL1RydWVUeXBlL0ZvbnRE ZXNjcmlwdG9yIDQwIDAgUi9MYXN0Q2hhciA2My9XaWR0aHMgNDEgMCBSL0Jhc2VGb250L1JKVk1M TStDYW1icmlhLUJvbGQvRmlyc3RDaGFyIDMzL1RvVW5pY29kZSA0MiAwIFIvVHlwZS9Gb250Pj4N ZW5kb2JqDTEyIDAgb2JqDVsvSUNDQmFzZWQgMjIgMCBSXQ1lbmRvYmoNMTMgMCBvYmoNPDwvTGVu Z3RoIDExMTUvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCkiJnFfbbiM3DH3XV8jOjmMnsay7 NNtu2m720nqTXgADfWj6FHQfCmyB3fw/UGpEKUNnPB4nCUJLFA8p8pAz/sr/4F+50vAn4L+LQcTI gw8iRP7tH/4n/49vbh4Vf3jksvt9fAADKbSV6Sdv1lUrebBaBPbwhb/dcZf1KHZf+OaDEoorvvvM l7MV3/3L3+8gAnUcWWsp2jY6ih8zfnzC1wX/r87D2vLlPIszEKaKVyAUXzYrllaLfOSc6O6XeTkn yvtVXl6A0NVHt2L7Jntn0cvliv/Nd9t89QlJNa0SUip7LLVmKLWHYZ3WLyrWaPVNBOJIaU+MMqE6 5YSO3DjRApjlXgTVtgFOG9FqdjoZC2AUzibAgZDYXkjzU0La6w82JSStwNC60aAgT2wkT6c1Kzsc jDJGRGsD960TKkqFwSiZ+6nILkdWKNbvK/DfsTzJ1FJKYt90TZXlYu/cOUroEtYZFEXXJ6jJUBcI cYnyCuUa9fWgSFCqB7HZh5K4oRBCozR70VtEcqj3/TY9nEUbolDO6b0sskNZxKKm8EpVpTCyjdK0 8MlJF6O28ClYpYJ3qYYR2OK5jyY7sMamwsNAdG3rZZtq/3lKR2jjRett5N4BlePhJq1TdHm1Fpsp va+9Fq41x6GfeH02e9Uszpt7qN1sfjHFidFWSA/tM93J5SRcI0/FnV+tZ2KzkZPggxPSJIpMhp80 bzWkwxiIGqZ49FOqeSbVWmhpJqEHLaQz4Sh8v6Kq0cauZ67xJsT75cI061n7+rtJWYJx5v3x25yY JHgoeciT11IhplXdERQUE6bb99D/LV++yeIaRKyP+R9wVniYFY4vY1b+mI82eQVzI+nQ4ie0WOQz Op8x+H6QZpRnBQfPvE0mtrrG3Zt0tMKG7AQNM05SsqR8hxMMAdDyfdo1z2w+ZHjE/ZhxO5+suEYL jL0hqHgTegMLIlTMnyEq/5S7kpESJbr8hdwPYSlQ55mVFerOs0s0wKho1TC4QAqzgKjaF+Wo7KJp Fwcrq4ZabnOQbyrAlEdKoqzqNcERwppyoc4H3rIE0JQgWYoDr1mUmDsM8oZsDt0SU7BPjJI1WrsF SRqtT0Xr+PqJtBrq0OCWEKtPhLr5qeg6sDsafiT1pavunSFWk37crDhGj3dkKDQkUoz711X36k8b 6SZzf4zVuLojKaWN9ERH1itJvXcHg0Oo3GlG8j0wzFhtwGbii44J8Nkr5CYf4CZ7xs2xKTE4L1/n zW3mK9rRSbglaT+hpyR8n5nWUr9lbIwXO4LSLX1zPDIGaQ0iKQydXnd5GFEOFArTyY/X/p1Q97pv wUo0ow+Swew/a3rWy/Sx0Xaw97GjXjBqMUtbMhKuc+YPsWFkQAyQ6TaD0bjxyDUNjZ65rV1f6Tfy XctaeMkPPnNwqHUoB9nkdxsHXwpcHEVkU95sbgnjB8kRc6roY5QOmMEBN1hpViptCY0iofXY2Kxd xeoU4P8LMABEynTyDQplbmRzdHJlYW0NZW5kb2JqDTE0IDAgb2JqDTw8L0xlbmd0aCA5NTYvRmls dGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCkiJrFdNc9MwEL3rV6iHFOcQoU9bnqFQGlpK0gAFc2o5 ZYYDMz3w/y9I1lr2Ov6QM20PO0ok7e7bt0+bakdvK/pI/1HOpOb+j9b/cSWlZEVhFTVWMWPp8YXe VFSLelswpHqhb+8UE1TQ6g99otn7Nd1Yml06U9LsIaxWwcAKtlw4o2m2dSan2dWa+AP4O+1MET/c hdWbcPVzFg4qdM3z2u8lzQVwxIYLbpwRurVwE8R6etFvWu3IDEjK5EwVUkyARBuQSA2Sj636Owe+ MpaZQkt8L2echw0O+uOIm1CLTF3Wftznx1lnec5KpXJwRqaSiJUGiD94MDnNPoL95K2g2edE/ErB uNZlOn7O9SOiBwSyD2UEssB3UNQHxMoLxzUdWQkf7pvv6gMHTDIg0PZ0RYBy8Qh4xA2wcUb1KW8j 1z1QrkZkCqiSU1MIZuUkRFAd0utDPdg6I41Y71k1ORIIbrKKQlmW574LpkIkgwQ6q8lJJ3CF7sGp Yja0UE8LHzessEJCNmntAIANY9vSiXQqf0AxNidzZwyNtBpUsrqspEfy/eB1sNynpa64dZqvdXrq iXImOCuLPF8EKSQ0zIXYYEkEVapk2kp9DkEx+XQikEYyoZVZlPCgkkn0auaOQabPoOZBw00PAX9N C1gL6RAyr155r1tGM55zkQbCt5AEoN5UHagOOW0cCq2e3vr01al01VsTe16ogpVaq4XBQltCz66Q 2kRhI1iCfMhQvyKcS43RcqZNuTDENH0lJ0NUjBVOfp8SLahWIGL/9Wk7Z4kIF5JZJc9LFpgAKEOy UKR9omJwwQplW0Kkzb/zU9GCgitpGTfCngcCpH1Axsa61S/RNjGQ3GuCWArGD8T5nx4DM96mnWdu FXrmgHZer7sDFlQTi7NCjI2EI12VwOfzWJCkspGuJoGbCj1TPd1q54AUnL1YaslUWp1P5sjOVBvT 6z4XDQSDEx+eWAbnDfwg75AkjwnbkKOuIGK3r6w1mIDvwpaRfEkgHn0V4pGO2+Z1biZErK7XQ9F0 ZxwSZXlwAMIz4A4l3CcISZMmv+se4YgrfhXCwoRbpu6e6IozN24cX8g806c6Dc1AI3TA5GyAxD9A MHO3QR+bjpmc7gc5v+psIT1CNddg8uCnGY8Ubch1De8QAvgX7JeZlGN5yMTja0smpB81miLNyBF5 6vfu2aS9D8iPM68P8eBkFfwS9/ugXq4QK8DvrzXt9DwuhkUH4D3Cj0Wvr+PWegV+ARM0oJMeOTfO qMmC0f8CDADql5FsDQplbmRzdHJlYW0NZW5kb2JqDTE1IDAgb2JqDTw8L0xlbmd0aCA5MDAvRmls dGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCkiJvFdLc9QwDL7rV2gPLcmhJnHsPJjpUigtQ0sZHrnR npjhwEwP/P8LTix7La+zcWCG3YPHL1n6JH1Sxju8GfEL/sZKSFVNP5z/fjZUqOtedD38eMa3I6p6 PkDD+IwvbxtRY43jT/yOxb7Eix6Lz3a4NkPrFx8LOz0v4WLA4syutmbQWOzMoLBo7HBuhmHpfmdv zPehuDND588oOyNp9ARJu7cD7dG93h2ZdaKTJIyOkBakmrR7NKO9x9KufpimUHwyQ+NfemOGuvKg PLA3nFEk7+10VvldUote4cZxqEitnoHKdSVhH+3ijj/IvXEzrTZ+1Sm5D66Ce8tt7hg+L6xaJO88 aTNJv7J6kZZ0g+NLswwnnxlhBzucX+gGieH3IwTcFbP7BGNWflSdkC2ezg+w+REhOVqlCSxSL4W2 R+KSJc81g/7BQcBQTgZPb5OnY8nnnwidNeGA6zjUgxKNrlpCI48teAiTMlF0KGPwIQndJiHGM5QW 0/jN9kME9YFgcmyUXSdUr9UmG+n5qxhU5jBIOCyZAZ6uQmkhsUEMI91wUb5jcpIePyQ05EYVJ7y6 tIRH8mYB4FLSsUYZcRMec9MCfQP3XJDfHKsjmTk+NvmsBi10nnO5Hxxr8qdgMWXqSqhKN/bBFf6Y HwTnjMi512zGKxvBHnMeLHBegoBWSApSJIWLJHWKZGAtAZUUvezqDMTAuYgM/6e8bxvR9q3eEhn/ Pe15DPCXIodSid4zod5LEFRadzGKNzc91ZBwtY7cHVxw1ETKUsDuOW9RnHFleYAlseJ8ZxWHRY1z GaJvRKdM/MF6IJwCgLkHNmQz159z8Z51QLzCZ9WGEBWIiDbqwdNNbJLMbybKaWKdL1NeWqlKc1xR PnubE40hSTvd40BAP2uebxrDA1o2B/8fEQH8ZY+DRz0O5PY4WZoPRmGpW9I8g8Kmkj7+WperRde1 aoPcXY7cKcdaLYbMr85XjNDiLzvqHua++aIMGxWKAjoZlO/gA5E3IRR9r0vb4bhPu3fTWGPxPic9 kaUnBBeOqkVWdZLS+HbQmxAjq+7Zg7zQU3ni+R99V4W9dYw/i1RIFa3FDi8vpmUrZF0Nm+w+2T95 /cMvjqTeWTw6G+cJlJcswujWSv3qeSvHcCVNF1LJbYZ/m3TTy61ZTvuldCW6qqnp4bz+i6CKOgcH 1QpjPyH+EWAAP0hRcg0KZW5kc3RyZWFtDWVuZG9iag0xNiAwIG9iag08PC9MZW5ndGggOTY4L0Zp bHRlci9GbGF0ZURlY29kZT4+c3RyZWFtDQpIiaRXy27bMBC871ewB9vyIawl0XogiJMmTdI6ddAW 6gNoeirQQ4Ec+v+XUuKK4tAUzaDJgZBJLnd3ZpbLbk+3nfgk/oqNLNSm/xPDv/1qN0JtlSwK8etZ XHdC5cMCHrpn8fqulLnIRfebfohssRZnjchWemhFdqOHSmQX5mtn5pYwV+pBiWyvh9puv1mTM9fA vjM9lCJ7ZeZi5/G+pwysffFOEi87aamN6bkHswTnOAgeGnANo+YNV8YYn17pYWu/eOXT2izlk271 kJe+8WEneU5dQdb5x+t+/xSpMq7yWTYa6ucOZj8POovDGt7o/VpCHtjccDJln80Z2vhP0e3FCb6p opClKpsI6whYJzTrzvuoNjacGCo7CFzpUKcNNxAi/3jJtt/w+LYfc5HdG7QAF/KgrOyalNB7qalC qkoHTXGp9UEH8a3NiYAWWdQxzouQAQ4L6bpDJS1hI69BtaRkjSyb57I2S2P++jiSkRy9KwAaNRFE +ADlgmtPrFgxsdBP5L7VOTkUvINQRozY30fI31fOlwsV+TsxqLFSHOAUlATHWGu3Tnoujj33isjC sMsrUZwkzlxh5hpIGf84YcryoFPyKDeyPn0R9epgTjDHRxc5G8FLB+F0i/gkoHAxHGfZLBIwlvmY ENmK5zmW1vFgBBngsdghLB/grJVJ1gFQvkyrWkXbStXWFpuEyjVTFLCCNEY6HtdtGkViGgfbNFvP xGw94/3vAOmxAqI3wfNH4+/BnIsC+dV6EYJ6nOSrfg+TK8tHt2gF07Lwo0u9kvJW5g0lii4kD1Y7 h/5guBYsT/zFUWEDMiEwlSnyrj1vTdpdNBRea+lbMAS8N7DB47rBvp/p8Mo5KS4BCtbgDouIe/HQ UWfmmsGrzYudjWPX+uIWOFgaubR6KcL+in2b+OnqzgWdokGFCRVr5fDHqaSksn1TS1WksT3muL0+ KdJ7utRHTmG5MuGTRziPYjvIDYqezdn7aXAqfnkwcsEHgtuSWeE8rN3qhzd8BfLEBsXmjWYbNAV8 Za3vQEQriHesh8EHUbBox28SSn8IhKlun2ugHKRFgsaD3SDmH0W9sEsS+V+2W1lV/89/Gzc5kLFT Y9e/SPMqLyvZbLfbF/nmwTBzI9LxfR/Gj78mern4hZtzlBWqgxWAspjaaDouxNg+sMuPiR1aXchK 5VV6Avvjuj8pdKlr2aYhcs6ywbz4giMHrTTBhS/s7yaJWBQR6fGJxeTkAZ8GWOL8V6cLKR4RDLKB 6PCxgJ0PshZBt6aHAGVPAfFPgAEAPxhu2Q0KZW5kc3RyZWFtDWVuZG9iag0xNyAwIG9iag08PC9M ZW5ndGggMTAxMi9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQ0KSImsVz1z2zAM3fkr6Fwdy4NZ iaQkarCbpk3a2nE/rl7aJFPuOvQuQ///UooEaT7ZjqlekwFHkQSBB+AB3q35zY5/4394KaQu+z/u /uNKmk4YrVquTCkUf3rm1zu7XZbS7Zds98Rl6y6R2D3z17dKVLziu1+8uNzM+e53//3p7FtdK8q2 6bhqW9Ex/5au3CkSqPyeF5M5X2heaCtaXhgrDC8aK2peKL+3nrN+j1bvrGh4MfUnaUV7dP3Sii6q br0y2nsorLYmbr6xoip58Zbk+15WvPjgL9lTj3x3FmRlWmGadpTjU7B1Co4/zP1Sg+eEEVmO9zfg 8tavrK8OHec6C1gZQC48RVfoKdJ65/cyUegsEE0jKp0HALkz809debGGPLi0/nd7UwsIPR2lzT04 OaZWuhXS1HKUwYjNBNJx6T+urMEm7l33yaTjxQ2EikK9ihAnCexSloWPFeXmCvymVXjjKhgQstyZ tbBC9dpZDiqy0aLqtCJU+HFUGKJy0xughuW5PJuP/VcXXRNy3bmFhYApT8jNwFXaU1bZQXAOA5BV zW0ttI4wZCRH8cNx5Fm9RrSNbkYl3RfvJTl7hUDOAnmwNOihpGPws7zWUgpdV/9UEhT0GAqkK3ZI V0jblNEKkgUJnvzf+JQ5Wnt4YQRn1Vook+cvUihyJnlBnI0pi5Csgfl0uJeWdeTzFDyEecg8Y6i6 MkZUjR7leyj0fSN179+CF0uo6S1U44ApqMRJTOCj84YFv7G5YQzOMAz31rBMhqFZYaAm0Ig7xE4C n0QYqXqGxsWiYWm1TiCLBi8HSZouIaucPSwq+pxZ77USNvw15cAxsmcDlpvksFxfUaqx49BpjTLJ KgdK390W+zyyTggPlfSi8qDQqnY3WLiBR0tSp+axy1qIXmWWRV2LqpQ1eZBXF9/7Fw86OQ4L0mcg 0uXRzFmGlIUiSyufFR/96iKWRVZzV1poZWqIDjvjG3LxYAC7S7/GYqUrLw4A5Hk7T0egvXaWtLrB RPzT68MZGHkx1ApNvYQrnrk4Zh26tcocFjopmq7Uo1LmExiDFkafWIJU8ImW2EXHjb5aW+rvjBxl cDqXDlN8E3jQhY3MH2dTzxnSll4GCe1/OeE4PUgtbKqxGBn9qskigx4fo80Y015qzdga8OSNtSzp rUcHKfy9hEot59Oo1/MDzYwDDiGldPGrF1PMry0UHYV0kSjfd/FTU9eJLshOdsE4s2aVm7QzdFV2 Pij/bzRXUpSqH34z1d4fZBxhNhxb2eEAgxHYQjwH6EDds5N1n8aFoj6DSKIBFmyWJMgMNukGGXA7 PzLkDCcwN6MOfpPsf4g9cv5XgAEAh4Ze1A0KZW5kc3RyZWFtDWVuZG9iag0xOCAwIG9iag08PC9T dWJ0eXBlL1RydWVUeXBlL0ZvbnREZXNjcmlwdG9yIDM2IDAgUi9MYXN0Q2hhciA0Ny9XaWR0aHMg MzcgMCBSL0Jhc2VGb250L1JaSE5VRCtDYW1icmlhLUl0YWxpYy9GaXJzdENoYXIgMzMvVG9Vbmlj b2RlIDM4IDAgUi9UeXBlL0ZvbnQ+Pg1lbmRvYmoNMTkgMCBvYmoNPDwvTGVuZ3RoIDkzNC9GaWx0 ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQ0KSImkV01v1DAQvc+vmCJtmz3U2ImTOIgW6NIC/RKFiEvL qaIHpB6A/y/hxONsxvU6LrQHa7OT+Xzvjbc/x9Meb/AXSlFqOfzh+D996iRWqhKVhvtHPOlRq9GA jv4RX55VQqHC/gFvsTBrPDRY7Nujw2LPHhqLN/ZQEot3a/yO/TkshFRKi65WJQXGVGDwgd8PMRQW H+xZY3Foj2pKYMWyumDJnQ4vWtOjNQxPyXRjj2ayeeveOGZu6FPrAlbOcnoP5r6pKwfuxca9wdO4 Wzsbbjp+CT7UZ3dcsfjn9mjDhCmpu8I9JacnNiulJyN65Yi5OxlStl9+cW7J9OvwtJ5sxyZBEJMS 4QjQLDufDzWZerbvOk82mgUmb/5F3yz6SDn3LtbYM/BeAxtfF59hNOZ2apCa2gDlHPZIJWqTx54E CGawG7OiOjiINmzcfC4r3kl3whSS9/uAtSeFF/qOsooi1IekwSxPAgL03RK3KTk/n2h9XHlOB8RX YbI0biqk8hWMJlFyGob3o2h1e8zNQiMgrxEZAgahyPggZ6wCrmAT8caHl745MEMAF7l8uJemE6bM g/sB04hUUrMNMp6B2i+oHpLqwTKK55JOR1RntXX2RKValk2czAFcPjoWxmWOniZhp9lkYNdkSqNF WZmK5pPcqeN8oLhZY/9zaeKlaYSuZZnwC0/m/ukfGEPSAYuMyZcOWJAOjEjHVR4RtCqFnLqSKf58 YZXuCEuFWef+jxXsLpClD9ka0Bohm7yq+X2LjhWj3Jm7H/CNx8f82j2MkprpI4T6yHeBYSAkB9QN rsgXLCkuYZcxCU1vanA+5wuJfFITuFbyXEKBgFlKFD3/PhyKDkToyL3Nr19hRzYz/kL8bnidSSnZ ilp2Jh9dQ37LCjbgtZGiyoNrCmgXHkMwAy91JbnrGbOGsAr/3Kd+INWVaNrGPCfxHK2A4hXNeR0b YnCTpqq/kSOuVxYpo1KVTFCOJxXe1jsWg2Xd2WQ7I1RjC9VGSmWz/P0DH8YVItMNKWslTKdr15C8 H4xbQZ+vZcPEt2KD5cgmzkZ3B/cSkCfSEgjvtNELRermsh0vJFYBpZ45XthZe1TnrpkohESBZ64Q bURrdkwSOLQn3mEO73ISUGUn6qbWlAYxTNqV3khn0d+npWfjtGc0ZLSGRNSqFqpWOl38/I6WyWv0 vL5iC8YDcuUg2LA3XjBA7yR5FNHwlORDafY6pK2GG1TSttJwnuNfAQYAsdZMcQ0KZW5kc3RyZWFt DWVuZG9iag0yMCAwIG9iag08PC9MZW5ndGggMTExMy9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVh bQ0KSImcV9tu1DAQffdXuIhls0g1vuTiAF1KS0EqlIu0EkIt8FDRByQegP+XsHeOs55skk1pH2bt eMaeMzPH4zupt/9/b+VvqZUtdfyjyW5kXaVs7RppS68aL25/ybONLM12GcTml3zy2ikjjdzcyWtZ HK3kcSmLt0G0snA0KoNoZHFJYrkS8RsmIdZB+G4EK+dB1LI4IWNYgm9NEFXcQcTRTUFLoQ9FLL0i fZhZsJ1yo6LwNIJtqL8IwmhZvIR8FaWRxRu2CpvQQTpLOAgf3axoeMVAekSjd/TtfRAuGif3buKe ZWcoucsh4YbgxE5DRI0zGFqwE0ETa2HgaGTyq9xciouN/DSRO21Mn0ZpKw9mjbieCzHPJkzCERuF SCOsrEkdk6fkASY5dBwOoD6WfhEAuQUgOmOmq8i04bf3BnjMq6I5eIjiIs667mSnLGxAybFKWueH jydzdlvm3sqqVU2tdTiQKpu2batG/Pkh72YRRaWVdqWdCLngLsb03vyUB5LIVlZpX93D7NEcszE3 TRuobdyizWLREKweoWghn0ZZUeIFZJ8R3BCWSEBjrSMTDykWjxNzbSef0ygtLSmWyfoxLVJUvNgr M7uL5gSM2ijT1g5ej2dgdT8crQ7A+xifA3YH7oen5OaS3EPmJm5yrPygkUjTM81EhDzpobkgTtjl flRMm6wZrfG9OGvvKl7Mqnhn6lBXsbJGsyzgIjguoH1+qpkBdq5Ulbbz41B8mRNfF8rOW3s4b3I/ Eif1LqrX5BDic0IdgGfX4FekPLoELMU9iHDjG7oLxNcyzud6wBMKyxxPClNwzitdSxMwrMv/IL+y MoGcdHWQUwaqAHmfUhuzBuWNs8PnNTmb0veUXUq9MvhGH7seYlYWRVrUjarmxfnz0GXab61E5tWS ZQC/fdcsgoPXbupfoIHtE1QfmDk/CEpOA6L4yC78HVJx5fNV3i/yo3KGgYu9KAw2dNBHND0nI5Ki hwAnLn6OVGe804FA/wINy4KDJcushPo79btvsQ9DrwEFKqhk3jHmERdpdMwAXzAFFOsRQ5F30Lgh 0OL26oenGDfai9R2qbhHhZi2Uk052dSKVCKDj4mpJ80eqIKeS3mlnWcH78M4RSdiiE7kPDp5sEIT AlYRs7oOa1TtdDsNmfif7s00jWr9vO5tC0ZsndFYHe9qO4ye7EqLqqfzTIyfwFirXOMmjrH/wAGS 3xnR7fqdPYLqV0F6OYIF80dPp9EVf14FyJ4rJnpvQt78HHxlybFXlhh9ZfE8LRkHYvKqpyeGLpTx 1y7gwiSSvGM3sc9uXH1+kyl6yO71rrmL/BHGeREknYicM8LYHTjaEYt0nntwWV0rO+dZdb1HTZtV 6qcy0HtrgBYPIQdkoF3v4OE8FUhn9IIeTNiJ+1FMXi2cS3nOLNioCWequslL5stwCzKYc7iDeBGv h4xO9RUoHxRh2pcrXjLwO42BdxDO9D7mkvwnwAAMA5erDQplbmRzdHJlYW0NZW5kb2JqDTIxIDAg b2JqDTw8L0xlbmd0aCA3MzYvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCkiJtJdLbxMxEIDv /hUmbcMGiOPn2htBCm0BKahClRZxSBCPShyQeuD/XxjvzO7GkOw6UWkPo/Vj7Pnm4Um95m9rfsd/ cym0lfGPN//dl/FBuBAqrspSaM3vH/hVza1qlqFg9QNfvDNCccXrn7x4MuP1rzG9leTKBuEPK9St wg0v/IzPK14IECUvFiBCJywKjXMGV17i4PmMzW1zo7mSvJAkl1G6XtJekYj+lC+8jpzYkD0qSBFC 8Iet4j0mFjGd5WBSwQinnR2DdQJ9U4rKZmgE/NttBAUgL5DJNRIiEenC3DeCa/AzusWz4hX6I+DG W/yagzDNRkI7zMA6EYyjGzO8sRRSeokL6vt9pF2HZIKom4VjZzkntLE2PWxQ+3mWH10QVusqXy9g n0SECB2gTRHhU8S7LRAeGw0gIFV5P+DvLjBZe3Dvn3hURY51eA8aVTR60adf2HE+y/Gs1lpoL93w 5djR4W1keVR8f4+2qM6WyDYGdgnCdQZ/xcnVjr2stTdNiBTfDSlf4saPeUFvvBbWOjMaMCdkvoYg CxkaN53PKYvJ2tskEN5AjY2BQLRI0NKwr2Acm/5KVF779N7/Lf+VAPRqFNLR+W+FK2OkZ+ud5NaV UKkyX+9mpKDQiezgiR76ABNfpObEkZcOTmT/FJT2pWjlTWYgVBW8hWqc4SnV4oiceIn4LpKKR2Xh dZsaTd/xAwenyYbrvlGxebVirMYb74QzSue4hB1ZK5SBdyujMAOXDV1+lYD5kJQOsvNzMrgGWr4r Mqu0CP/13NDsFTUkVIosvpQrLMrbGS56lKjT0kPUxY6gQfG4UTeicjdpG6PivZ8hF0ri52h5Qwva rRd9hbXd0rMeh8X2NnQbaXCatNQLcEi/ZJH5YkGrGoLzAzFzcq8qlSjLvLd82Vc1wPOpb6H6RJwm gUbh8R5sdt3KNe4Lyb6wL6xOS1kFP6u0j7XsoGkDKXvH/wgwAMm3mvcNCmVuZHN0cmVhbQ1lbmRv YmoNMjIgMCBvYmoNPDwvTGVuZ3RoIDc5Mi9GaWx0ZXIvRmxhdGVEZWNvZGUvTiAzL0FsdGVybmF0 ZS9EZXZpY2VSR0I+PnN0cmVhbQ0KeAGFlE1IFGEYx/+zjQSxBtGXCMXQwSRUJgtSAtP1K1O2ZdVM CWKdfXedHGenmd0tRSKE6Jh1jC5WRIeITuGhQ6c6RASZdYmgo0UQBV4itv87k7tjVL4wM795nv/7 fL3DAFWPUo5jRTRgys67yd6Ydnp0TNv8GlWoRhRcKcNzOhKJAZ+plc/1a/UtFGlZapSx1vs2fKt2 mRBQNCp3ZAM+LHk84OOSL+SdPDVnJBsTqTTZITe4Q8lO8i3y1myIx0OcFp4BVLVTkzMcl3EiO8gt RSMrYz4g63batMnvpT3tGVPUsN/INzkL2rjy/UDbHmDTi4ptzAMe3AN211Vs9TXAzhFg8VDF9j3p z0fZ9crLHGr2wynRGGv6UCp9rwM23wB+Xi+VftwulX7eYQ7W8dQyCm7R17Iw5SUQ1BvsZvzkGv2L g558VQuwwDmObAH6rwA3PwL7HwLbHwOJamCoFZHLbDe48uIi5wJ05pxp18xO5LVmXT+idfBohdZn G00NWsqyNN/laa7whFsU6SZMWQXO2V/beI8Ke3iQT/YXuSS87t+szKVTXZwlmtjWp7To6iY3kO9n zJ4+cj2v9xm3Zzhg5YCZ7xsKOHLKtuI8F6mJ1Njj8ZNkxldUJx+T85A85xUHZUzffi51IkGupT05 meuXml3c2z4zMcQzkqxYMxOd8d/8xi0kZd591Nx1LP+bZ22RZxiFBQETNu82NCTRixga4cBFDhl6 TCpMWqVf0GrCw+RflRYS5V0WFb1Y4Z4Vf895FLhbxj+FWBxzDeUImv5O/6Iv6wv6Xf3zfG2hvuKZ c8+axqtrXxlXZpbVyLhBjTK+rCmIb7DaDnotZGmd4hX05JX1jeHqMvZ8bdmjyRzianw11KUIZWrE OOPJrmX3RbLFN+HnW8v2r+lR+3z2SU0l17K6eGYp+nw2XA1r/7OrYNKyq/DkjZAuPGuh7lUPqn1q i9oKTT2mtqttahffjqoD5R3DnJWJC6zbZfUp9mBjmt7KSVdmi+Dfwi+G/6VeYQvXNDT5D024uYxp Cd8R3DZwh5T/w1+zAw3eDQplbmRzdHJlYW0NZW5kb2JqDTIzIDAgb2JqDTw8L0xlbmd0aCAxNjg4 OS9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoMSAyNTI2OD4+c3RyZWFtDQp4Ae28eWBbxbk3PHOO dsnaV8uLZFmSbdmWZHmTI9vHtuw4XhIncRLb2exECVkgCwkhAUIMxCQ4C4QSlkAhQJaWti9KQm9D FxooUKAJhUK5vXSBFGgpkBJ6uwUS+fvNkZSFS+/9/njf969X9jMzZ2bOOTPPNs/zzEiEEkLUZJTw JLT4mpE1UqdkF2p+CNi3eMN615lUiiOEDhCiuHnpmquuee1XiSpClL8iRNNy1dWblt76aPszhFjz CImOLlsykvis1vsgIdMewv21y1BhfM50I67fxHXxsmvWb9Q/bnsW1//EMzVXr1488smkzysJmS5B +/ZrRjauUUmMTbjeiWvXqpFrlrzpW7gc199m12uuXbLmbu0n23B9khD9h6ij+GMfDZGR3cjdpBU1 jSSCOdlIMQmQEhIkzaSeCCRMmkgM7VJSTgpJKZGQIpJHvMRMjIQjJlJAnERB7HiSh5QRHanA01Qk ShqIg+SSfOIj1UROKkkdqSUW4ichoicG4iI1pIooiZZMIi0kB3jUECsh0l24l0hnoU9AHCGR2FDO fPgfpssTZye+TsjE2Wx9asalMu4+QnL4RpLDnsJZJs5y7xL9xP7Le2Tvu5Tz6JO+UiBjwFCLWW9m GT6L0xnyNWJpdub6q7Pnvrr6v619lbxMfkBuE/v8kBwjjHbs823yXTJGngNvbRSvB8k0spXsR9qP miEyhcwiCwioTdaSA+Sg2IeQRWQYlAvjqgkYHc/UvkI+JP9Gz6MfuO1Ln6/hLdeS43jTg6QLz2si ezDbe8i3yCOkm9yOq0uft8Tiu9wIWUHWkcMkiXsTZJlY20tuIZ1kHsbWQWZjTKvw9iHyJHmKLCFH yAOo/yGZQR6WPUMU3HpGqYn/5Bom/pPswN33cuu5W7jd/ChZT24iD5Pfkb+Su8idqef+e+pdGti/ LN1F7scstoLbW8kQ38j38cMXafsvb8o0fA/4eha42QiqHAI9HiZ3US/ZR7aRzVRDvk5+SKuuwM7/ 9Lyvav8e2YlnX/n5CXkaeDsI+u4GxtaBLt/A6Puu7ARhLqEq8M0KMkS15HOy8Mvt/1uu14AXNoLj bsV7rsXMB8hScNd1yJcBrsu+g9bSJrIdVH+cVpD3Ud9KbiarqJuGyItkO7WTG9D/66i9h3yfhtB3 HXmKlpBzkKq5oibKPiiTQx9ALkV9gBoFoVbyKpNN/nPWgf8oqw/YFeMRWkxeIuSSPqAemgN++x55 Au9/jDxInZQnfyOnSYoGaR4oV0peB7wIvH2fPAv8fYIedvLvNK0f2WMvfr48FtyxQ7pE1BPo81/H Am7HmnBpLJCLw+QhyNdm8NBTkPVnyd3k35DvxNV+SNB95DvggUPgpVGM9eJHOgS9TKRXsVTEgZb8 JKOfcM2fYPUTr0+cYq3plJVSuy+Wfwlp/jXkuQ+64v99/h8G/i9igJOff0/6DjdFqpPSiY8lT8gl qbn0bxjAQUj815DeiL+rvnpA/AX+Q+mTE3+Wfj/VKjVIi1NrUzdhLft38h/k5+QF8h55g/ySvEL+ yIf4F/jT/F8kwxKZ9JT0MfJdSSW5ntz75adKVkmWSaZLDkiGJJVSPyQoj/RCr87BWjWM9XIl9BoR BhMLF8yfN3docGBW/4zenu6uKZ2TO+JtrS1Cc1NjbFJDtL6utqY6UhUOBSsrygNlpSV+n7fYU+R2 FRbk5zlzHXab1WI2GQ16nTZHo1YpFXKZVMJzlJRTe9LeNtC+IuloG05qPHGP3pXUTD3bG0wSo9Pt MbgiwcGKTK+kNJAkpu6kuW/gCBHqB5OywJe7TE3yXv1f3Li51+lqT0q8+Pd0jSSSJTMG3B79W86L 7YN4bDK3bcDtdiY5L/6noAn/XSOuRFLfh3o0iDVTkqRvgMHxid/Xo5LUuweRzhhIFmQvB9nT0lO5 bJBPQ/Wc+NIwp9Jx/RGNoy2eJOYjRPP7JLGwbmfrYS7EkiUBDESPkvg0EkxS81+S1JSkll5M6cpX sNverf8KHLQnVnjaE8uB0cTwJZyeTWPU7Rp3jc8YMEScbrc46O7kS9MHjqhVbZ62JSrMgogV5IhK jRo1qwBZ1hyhmiYqFjhNe8MRjihygD4jG247gxVJYccwCp448IYW06WW4xMndl7eRHBbuhNBN7FE xXcmZW1JeXoQruVJYSRJdriOlJ8Y33lcTxYNBzQJT2Jk3kCSH8GgjhDe276sP5nX3TeEKgwCMLzM xcgdFxNGPFf7Mtc4rlnfYaSeOG69sj6xbMkwYxM67ImjTdk2sM19wpk0Im9PGgLJHNyec8P7Tn68 3b7cxS7Hx7e5kvunD1ze6mZ9wAT2inLXeLsHb8PD2le0MooFL5JN5MYpCZE4wo4RV3J00QrgDP8j O7P87x7XJzV/d4M6oA/uZNLBEMwgMbyCTWUF7pQgc43vWCJOdac4NfCrq31FnAG7EdxPZuHuoYH2 ZZ524DPzQiAE9/PeL9/rdicdAXbj+Hg7G+JIAqNnmMG/IyAOI30BmXAGKMbTlhT6xYz0izTAG4WR +GCmKtMBLRLQISkMxwcH2aTSBEjKvduklR7XOHu83Js0B/Tu59F2oqK8e8ZAe5xxJ3pybQONZ+zO Myh3912spnb0GQ+eYUhiLTM93dPTXLCM4Yclw/1pAQbWMpRH10x/8amn7M5T6TfMG+jwdAyPj3d4 XB3jw+MjxydGF3lces/4EY1mfE37sEsUf4r67+9wJjt2Dib1w8tog0gh9npMjvd2zOhOmqbPZaTq cC0bQQ3+mz3ueqfbcLEPtMhXN2dkDtwPGWAyN67/BLPXQDs5XR1M1RyHhnAm9fVMZDGgWQOQicV4 RXtCTCArM/FwJ5MaftDbvnxmBllON14pMg/TgdMztXiI283kacdxgSzCRXJ0+kD62kUWOY8SIRgA HYdZy4lsi2UWaxnNtly8fdgDutm78X6RP/4Vf0O3X+TtcYPH6IoyxY7R4X9KInmiH3P8Z31SAYyJ pDe1DfBOjnVBiXPyrKQKYHmIJW0B8UaGE2jMcb3H9ZonqQ8kpW0DJ5yxQZfeAGVJ0acTHRmn6l/z vEyZHiVmfZLGktTK6gn0KrAHvW+rR+NFRnK1jw9nGPDyaaEr651YdlGU0oOH7LK5YfZ6D0TXmUaD wehhMzzJGD67MHg7mFyBJCKiugaTWrbeJbWfiAnG62wbcEETQXKniwVXu2sZI3bSNRwXVcKgk7Vn q49PvDscZypwADyILs4Mi4PR06i9khUryv//MvooGP2WnYPLGjAmoQwzcNXgtQzpbf0DGXET6SQK Ad41hU3lyvaLWMz2gWKDOLuTodyX7WDUXLso1WnZvdgZROjHbC4S4PKXiW1Z9mAjSXZg/U/rAHFk ycnitTh31tz5peYp2Waoj83OG9APC1nrEQ/dPv2IQLfPHBp4Gn6Va3v/wFGOcm3DrYNHitE28LQL NpBYy7FaVsm6uNgF6aZ42lFOIfZ3Pi0QMiq2SsQK8XrxcUrEunQn1FGy+DiXrtNn+3Gok6TrBLEO 6wmG2G5fBvU24AHRE0mhb+CmwWXjw4MM2cSaZkBwtqeJJDlP0xHKyTRJlWdJa1LtaWX1zay+OV0v Y/VyTyvYH8LhOg5RHx/2QPyhgAeIkw4yFmZcznldxycmoEFPQfO6kzLvPAAUrDIw6EpKvV3oN5nB MKonJ0cXj7BxMDbFvXLvlMWDScXFB6LLlKQST1BmnoAeHeI9WJ7ZTYvBrCMesYhqCMfoYHIwwF46 sJyNyOWCPdTpaUjKfOlBSn3sRcHBcaOnSlxOZN6kyrsNd+AdXaIiFGucuMTL2HqEf7kGI1/sQa/F wy5QQEIWzwQzSnzsX8XohpolWNUlPiyqABUEWWwkbFq8V52jSior8UD8s7K6Eg/Ev3wQSGGTF6+2 ZTrg3fqkGiPyXYbKzA3ADpqmsLHgfxsGz7o+yx4z/TiZ4dmYpCJGxVfJ0ZzM8U4ZgbGQvl+NGg/s vvTNeJbCy6rYM55P18rZzDWiQdt/fOKwZxMTkuynotyTJP0DjDGJEzakQAbHv1yRnAvFqfhybY5Y PT6uyPnqG9L4UuRczNlTXO3L4xV4FdCL2K7kdmk/oqjliHdWk27BawlWl5SWk/J8dbiyulxdWaku r5bU1JLSQChiNJm0dntlmCfNp6qC+G/+7VunqgxGaosG8dGf0p8yRPSnqvS/fTEcojXVTVxdE19T 7fMUaTm5p6a2NlJVwFnMuNDyFovN4qmhBreBAVcns5YV23xOXUuTK1TsUA7H7mjrWNyUpyuOlbt8 FrnxLnr+gowfOV9P/2i1estq/I5gJOrpnmEuriq4taAyP9JR6mtq7Khwl/tL8mSrHn009b5k3xdL Jf/4/NuYIOEQ9yWSP0mXIDZcRG4W4gqlu0iqVrmKtEUOe5HLXcRLtdLcwsJirc2kUBeZXSpetUfQ uaa5OAPvctmN1FzAG4yGQ3Fi1cqcUmORXUKaI0FbJGAgtojBGLUH4ZLl9p4JGIwkGg3BzIxEjFEk BqMtaohE9NtOnDjBIOyuaeKAFr/fLZfJLGarzeIGcupohBZwNgt183xeVdiu13lTlUW5+sbm1Kz6 mX766MO03+6trjh/jD72TFhlDxQXTQvfsqirpzBWrwyHlWuWSWZ+cXDqjEp1mMvjxhByIZsw5xWI SuUj4l1LVgmTrJbasrJavnaPUKbJL9tTEsqv4Cv25Av59FA836jx8b49GkGjPhTX8Iab3e6wtcxx czhcXxbYIg2ersJsThuiLCXNAZJr12OyxH6xiHLw4vzDoQibpaG6kvPXuKus8DZlMrklnXv4Knin lZynSCY3GKyRqlpc+nwez6amshyVzYeWR55d0Hb1rO07N739YPH9j1ZMu7rZd1PhlKHb9rRMvufW B8N6f2cXP9Le7LHkhONjy+eM9hcrS7+1Yfu3e7nPvrazfW6tTcJd+PzCKnnrLSMjNzdBvV8/cVZi BP1dZI2gN+u1lk6zzrjQuNrIG20EhosQQhUYpY8b5l7jJEqeK7Bpee0ewWYqkPGyPQWSAiqTcSpq OsAZjUWqm3ODpxl5T0MAovgnzSIyGAKIXf88eCEa0D+PBKJg8IhzBe8bxcnWRQwymaeIGKqNxZEq q8S42N61qP2qR+f13HP1jGWTXYsXvLAhlTq/jcr+be4+aX3q4zlXld+ROvOT51Mf7wouXZz6vcNB B+ist2hr0sR4GxF3yZugsxO7EQ2Cy1nAF+xxCk4Q1WnUag7FtaV86R4tb9rs9VbkbZGJAwcNzwQu J59IMf4ixZikcnIZONTjx6CbJDXVHCRZvrGyxKoCjYL033702aEZvV3C/N5XDkdLpvZvvXp2reO6 X94TbwxrrEVCOz/S0VwE+sx87LPD30xNzOkJlxTNl+TFVu54YsnPqHQjC0lSkUfLMPZKcsfTRDdx QuhWajp1qsJCm53jlHgTbxRQY7TtEVSVRSrwbJHnULzIztv3CEWVFYfilUpeuaeSNxzQGY12eoDj 7G7XgcLCkMq+xZ9hWpFzRWJlJi3yKZs9ChdeDIgiaw+CikH9ixmCSTxuA2NM0IpRz2NwVzXxdRFe FN40W0tci3SuotJ6f+r5t8qr3LoFC7RFweBbtC7cWF5kMy82nV+U4WfprNQvwl1VBeoLf3XEhNRo rDH3wo8Npa2T46lHr+BlppfTOFECJ2VkuzCTaPVal3a/NqmVKnmtkuMUSqWV1xkKDUHDk4YfG6RK g3WPQJTUwivLCpR7lKG8woLCQ/GCstJD8TIFr9hTxusOGLRaD0NOudK2xZNByxUYgRqLMISISuzC iwvmZ5CifxE1aR7mv4wSM9NXlyNEuchaWhELp379ahofuqJg5ataV21JKn4ZJuL95cYL7+bHJ6eG 4u35qY2xzjILNNjlMp3GA5PZ+yGzFeRGIbfE6/NC+/qokvf5NFy+NJ/P3yNQqUnHpLcU0qsj+j79 sP41PaRXr9FYeMsejcSi0Sj0BwwGrmKLyxV0bFakuT8q6jJDJC22GXltjoj6i0Bvi4hgOAmHvHL/ 5dJq+5I01zDVBR1nwaImqZ06pWX3vAsTZCeVHZn/7eWLnV1XTbvmwNze+1dvuNYUqqP3FBeb5FLL 1BIfnUtn/5K2fseSmzoztCSwM/Xps8+nPtp11crYUF+5NhzWFFa2YbM0ww9SCfihniwQQgEdr9sj BDy2wJ5QSKa08Hab/VBcYTN6w9V8UZXHU3Qo7uHJlvKcnAZd2ZZ8YOeYjvbmBwOiBo8w5Y15GWwR e3N68UrLwRkwvheLXJaibsOXyStOEat1dr6cRXKXTGv2+lPz68oNF95UWkorU3MzhKYHy/02NVdu KJlEH68v13/e0OCxGlXhsLaoYyZ9PDW/ranYrrmS6mG11d3annqYLpojFOnR1dMxIzN/rhDzzyXF glGqkCsOxeUWo8l4KG7CRDXieoQp2YMZgn3lwOkT4viGsuM7xMb3+b8cBXsveJNj+7NWUiKYJVJe ukeQGLQ67aG4jpdIrVtUwdMvVqXRmV76GAaxzPnFle8iV9D7m/fe7h7oyjf4G6n42vi2b6wvHShq XzYgSaSnKs48S2sm++1krlBPyvgywerjedIUJnsKQs6CCB8Kh7BYu+18WGsQ+MamRoxGaeab+Ha1 wep0e+WBLXXB0zaMK2Ob2LNGCqOzLZJ7imk4UbXV1uGPWSKMezk5Fe0PZouwOl7Uel+Nym8U+Jqn 9g17ynWayhL6lKuppTmVpFc3tMaKUpO9RTbHn0p95d6ar2KIT+ytQytDUX++s8QrCYflnsaO1O0X Pu1vK5SGw7zVaowU07lNJab/hkGyMiHRA08FpFPwE6VeyWl4pdJG1Fjv1LB99ghqh9VmPRS38Srl AYXCRbbo06J/BcUyWk7UcV6oeMmVKl5kefpNKgs0lLoLnOYl5vObswx0sNxr18xTWbyxuXNTq65Q X2GNydUKawI8hD1HGeOhWrJUmFTtEJTGTocj4lVr/Xyxt/hQPMdLwpHwoXiNzclHeIe92g5hra4u lJ2x2mp4o7E+1xnhC0cDjKRQ2LYIszoCESgukbxg+sss0ADUFYUeukJ0jXUe7C9C+K6sFg0zSt2y HCYIIqkWRsv1SpkhtX5d6i6sK2Ld17LTXUIX0lvpDGmxyKrnH8lIjra4Yzrdch+tiZ538582pk58 M3X3VwjV+QjPdv6Aj4nPIUiz4G20CcVpnS6x+fQ5VdVVh+J52mreMspLbLxCUevMq+Zdo+WXJg57 m801gjm/WJUWdWq12iI+DjpYnA7TwQYPheSx6Vr+C/PyDxWHc3OkCoXFW0mXVXhtms0X3qguNxnk UKRQXhcnG+XyY0P1jXTl3b9oF5gRE9aYXcKULx7hD83p8/emrnnp5FdMktlibM36CdYsPSzNcsFG zLwZq7NJmcfn7VFKcjbb7UWGzdLgn0DFP11mM4ZD0iIfJlJthJeEsZs5GdUbIaXGtN2l5bjdG1/Y 1bv9wuGj/3njzolUzrFvX3N/z+C+pUO3zPLrpx2mku++Q4XDX0/9/NcfpZ7Zz/0sdSp1YgfVHHub Ft7a/+Bv2NiYP1AvykyAtAvePBfv2iPk5WFBSutUUaMyW9HE224uLq4oFJVrlUG0+EVrUdSworPD VkpxwbjSBICpzzw8T5G/Jm3WM8tXTr+Z46wMp6ZkeensRx90bn1q8erG9Wu/NrVy+prWxVUXJnWU 2tRXrgfHvrfs0IpKycxJd6ydva4jHwYjJWsmzvJ7gd8QuV3QBZkdH6wIop6oJVZmCMRQYzXBBLe7 7KN2iZa32/PUxcWSvAoJL9kjVJhMjBImif3ANBu12UpcZ3S6UMkZubyKHAilFQRIAz8nOF80keHg ZJ0aQ9YuMEahNtABeThkKuAwU9EIqAT9mJdrzdoIzLuz2tJOL1BieNMcv3rWdZurN2y6bnvb8p/d 1rPnmsW2jgXdLVfFIlevGN01rfW6x0e+forWDSwN33Bd99KhWMPqW3vXHBzS56X+MrDIHxppm7yo v1pYtWvB8j1zS2uoUZSpVtD1JtDVRWYLFTqjAQujgdcV0hy+sNCgdBAH7wAP8twBXqsqtLcWHnC5 3Kot4EQ3mwZTKKcDVN/7l9NssnBgLxpAkcyKanLD6OFhBGclSlJjSHv1rZKGRdZAqK5ui0jhOrji JvXNwcbqgGkxrN4DsxPV1vMkQ1u53lbcFJMQY3Q5jodQMgRZeRvjDpNqIU8hcqPCZCqr4K0WKO6A hQ/v9/kiuVu06TFC/jE2ZrekmY+a4Z8wXgPeM44mljFRy8FhYXWZJRiGyhKzyedZdk9i03fWVqlM xWF6ADZJadfSno4Vk3PZunxnQ0BPf3XNtO6G6illtTcevoW7e2qdywbJZ1bIhdjI1inucOLuG7m1 6QVbVxwXbRPrxDn5MObgJTcjdjPxmgCE0x5LiKVGMYV3+ZoQVdJeVNJe1NFer9HCc0Y1HDWFEsaM KU+iJfYiuZL3FlssBYSjRqPCDNdOUeBXwCUxsPgBvEwWS2DppaUdi0A4FBA/FEq+kmdLeTqoYEI8 wXRxdefl1MN/J3XisdRvjQUFHjf9dlPYqH+Ztn6DSj8JRCbR8YJitz83dc+dktlfPC5pis8OO2CT a0IBz3Dj+Y8kq77Yw32xY1JjLSw4lSMw1PPFy2A90HABAg2fY/5WskSoIXK9HOuwXG5WKaiC8nSP oNAZwYdGo9KqMZs1vGaPmTceMJmsarVKfkAmsxNVkIVJRF8aGVOJLIBiSFvgFwMKGYscGgeLNAen zF1D3UVaXg7HzEIn0+VtLWVF9kXnE9x3Unv9FcUej2kRf/s8R83wktSesOSlHGf13DidE8KYOdIH HZLEeuTD2b4PnyZ04sOndHraA0J9KKhYiauk+ZISRPOFuFLXWaJW+3n/vcIa9ag6qT6hlhC1Xt2n vku9Xy3V8Gq1I0QrJZV85cOCxOotPhz3WlymkGm/KWmShJBwJmy4Cn5/eafEZMaVI8eSb6mAt8Zb 9A49r7/foTeZzYqCMar28VXspUqYAFVV1WVjClwx410B4x1ICqRX/1MikkgERgsiDWsD89ciBpNR U1gdM6ham/FlAqJtEwh4RS/G56upLvYybcWCL56aJigvBGUg2Mzw50XWEWMUNdzjujkPzO5Z34Rj Ue6S2Z1TF9pvGx4dbV28McapzP7y1J81P3ulsiMUX910p2Swa9LKjrsfyWlZtrF+xoxbq4LO5ltv Sx3oaqwutGrC9CVu2fJoq6N1aZWI/xDwf056H85nVpJhwVtOS6VYde4TpHrYKFZ9jifHw3v2CjnW XMfheC7Jo8rbfAyHOYw2Pl9IX1mZN2YSvViGFTDNJQSAd+zNzWmdDWTAHrJl5gjL3FPk88v90BWQ E/AQJp1W3UyXWeh8Scf8xZNWPjBz8bNbu27r7Gjnc2z+yF8mad3NU0Mbb1p7bbRvmpcvpFNaPde8 /fDjp9c5ixr1kubhnpoCo7Ja9cXrvXNjVabnn3/xp56uzkrIxnLMcwb4zE02CXEXDpJxSUpp4ahp sosY9UaXkVcWGikExIEgh6+006izw7m7T7BbCxFy2isU6vV6ldFlMnk4SLfqNqe4Lp3CnHMdSO04 +wp1nSE9lry3GK2vRRTS0XsG4blT89di+pZ08AlLkbhQ1SGqBTRkFiq+a4uhqjXccXWzvWF4cvv1 QjQydXBO5EcvrXll64wd/MHXW7oLho6PzdqVqK+Nt9Y3lpq+OHPPBzdBNTE5wvwkAdCxCNbtCqHS 8IRerzsc11si5qA9yAfZRIpKCwtBWzYXuexwXE4UVDVmNBfxHkZQxugeT305m1mGv/8LLTNsDK2P mep7P8CULtEPxofcU+dni0B2SjZGXjA3ll4xbMVLMmSUmQO1n8Q0uub5y2MHjq5/4cbWq6Nad31b cPT2VWvKG+obnNrLiHnD1LYSh7padUDS1lZy7uMDH6yx2FNHpi4Qys2nTpx4SeduCMEn48gy0Pge 0NgBKt8gtLpM1gK3gTfcK7jdaiuZ7HrH8amDIw69w+U460BgwmGVWHnrfVAVaoTp9gpqtNiMxG3U 35ab6zFulYuY+MwYfcsQBZXTK/JlJAaF1zL6YiWAz5mJNkMtXoYCRGXczPAAb9cxLw6Czo8KK0d7 X/3FyhdvWbJ7VpC/MF6zaWTGbS0rZWX98atuVD/R1hP4x2d7379JWP3N7cYNj85tbKezrr5jysEH mI6fBmL/UfoQdgmuEVwquUJ+OK6w6I0gtZX+OaAjLr3L5Trhes0lzeGxu3JCsBd5O10IKxfzxffm wzbj3AddAW7MjlDNiWN62quDB/NZ1ZuM5qINzJiV8W5z75lIFWPojHV/yeBAYBLKSoINhUgVdg6Y +oKtb4lwiz/NcZRWpK4q91lUm3wOmyFHomy8bmxoWt1iU6TSXeFz5nzKz7nweFvcY8HaJUYmufkR GA65kcprtg/71d+dFDb6hIU9y8HT2NpItfC/Bz2rSAuZSf5TmNPqnuH3qxRBRS2v2HuilupqC2uD tbyytjaom0FnCERPLdBLOn2hPqj/VD+hl3p4vT7YSfEInvxZqNI5OvnOvYIjL9jMN+8N6v0qTVFP MUNTKVBRXFzgbm3taXfpTbSnvaCgn1OWhCVlk7ZK9RAOqdQSIWRWD1sV1Dr06LFYZkW2lolMcioA /DELDosDthiiwVMBZimggIZTVfBzL1MOWY0o8g1jIqiJU7BggyhmNy3QFoV4+eVimB4Gq2i/RsQV QtSeooFbx9aQWjFlmtXmpqKksS0NtqiYxDXkovHvKeJ//7SysPjlp2fGevLb4mdX3B69+uT2JYev b+nvDdYK0zu7o0vG+zon00UXupYORzorLFWz6xcmHJHInV8buiWu9Xc27J3Oz5GrC1c2PX7E0lDv 9elbV3ct+NoMe3R+R/NVflNXVXRhY9ld82ZvmVlqSL22ebs/Phge2FB38/kzvlm1Q7NCQ7G8mjIH 01kUu2tEUgSd1UBWCjGe4ZgrQUJZQliiNwX4ktKSw3FjqcVFxTAjW5nq6w7H60mUasbs9hjxjIUy rBzKxNWuWISYj5oxVtPmWXoRKmCeORwCFjNlkXaRi9MG68W69NJEr5FMnTsYqZvdUmrW+SelNviL bDnOaZNLhP6A3FwaSK1n/C4qts9iWJKmNbtya3pXzkhtm9PsQeRMY3S1xalsbFdHXmdPIHVLvMHv gHOVjsu3Z1cspsNnAil/ksbBqg4yRyizSRySw3GHJavLddziNTzV8e/wnI5fiIzn6W2caYxTZUwT 5KJIq4KBwPOn9adJcP7a+Wcyujorx9jqQ4AqY6SzhVdEAt1yfKnfbcuR2MMVf2rUV0RSG6Xx5577 /AxG39pBnxKmBm2KGuWFmtltnhyma6WpdnqdOFYbIqFhtUKB2P/9giLPYj4ctz5hwWCFL49W4VIq dXa6lbONXaZ9Tr95mgmOqGDZgHPPNH+QXUjh/ojLZo0pHcu7NG563feONtw5WtTUUmaVmcvqPmoU x/vznd+4zjtgD0SHu7k/To377eoapchrzeC1GHhNYHsbxokPmSkHY1DMzcxZbURFWWWjy+aUWor5 UoFjX1bRwM/VOfLCfGWw8nDcGbTotIfjOl1T4+F4ExGo1mBxFEtJ2VhtBvO1jANZvE80gtgs0m5S xg7MPWWLpD0HkRUR+avDrgb7Z1E+0V2Qy1kcRdyFFP1YPxYNj+i6Zjk1w5VXu9wWR6yuMqhUeMvo k5XL6v5AXVXTQ6nRXIe6qOL6onyXs54Rcl2V3yDPsCdXIVcGIoGYA65NkQw7lUL126ntrc3QxrzB rMuvatpfkac5KxI5nJPnb6vlL+NQJrPAI/0N8GglIcEigdN3OA7NZDocNxMLjk6QsZwMKnLSxmAa ESIdvZfLW3YWXx7h5//NuyEfsoX8SZy9/b0wW60AwVQsQqd0IZGwS54lHLukLCEsUURkdmdk2gxp bU3t4Xhfbo1l4RMLFsw/HF+go8qSQIe0TdbGt92XI9MrK8ZijCOwErBcYAopFhswjenctO0dWN5M zNCI/EOsACi4Fw2TzjGczTpxzEB7kYvsxM6jsX4DEEOwAwsVBgLQ8aJZhQr4zsyxZ85z2oxKx9LA Gkao/LQHGQhATWF9tYoWM6IWF919UQQkopX8L+rS2waXicpqbay3s9mduNnePX+kvm2krVBl8lWk rmeKTGlyFlX6StqnF1+qU1ncRZX5pZ3dPlmO2etNbfS57RqmGT5q5IsksUavft7Cnk6/f/oNV6W2 9TS4bNg7yGi5WatbfXl6V09vdeprV7YMromXWdXejp7y1B3RWJHFxCyAK5SLKKegsSQIGsfI9UJj JSNBBVsJylkSYIkjL4az0RycEWopfaKkxH84XqIrN+pCzFwP6WvHFIqm8jLzWBFcfSbkyE88pTfQ niJQIU0NrA+MAGxhyBJApEca+e7MilCZRfJlqwSLbNZF5GmisBUE9p0kmF4SFCanN+T3d/T7RPWZ 1aYfNaq1XXPnV9fOaimzKMy+YBZVHddOKc03FPZ0hVI70kx/JToel3QLHkd179UzU9vam0Aq4Ee0 8/m3YBPlwGPrEgoJ7Nu9ArHKc/ncvXK9Va+mvdbbVC4NZENVoAUnfhc12tt4xruo5CGVzFRBeplJ IkY8M24IOxxwpRXBmV/79bqXRt/6zapXUttvu6FtwaTcljWdm27R/+3swfdXn/vToffX0s9f/W3L qj3Tvvbc3F9gmBjnlNQMiRp0LMFO2a1CmRK713A5nMRX6YN7vlfwWWtzI4URPnIf3BHbE7BysGzo im4LZ9Yy5HAyIUXhcAOx5/L14pIhKFGjY1wBszWQDsMjZ2cgmD+SiZiBrtk4YdZ89V4MQItyIfqc ICOTMDZhuCx82ier0acd0DVKWyCUWlZcYVdINDZ/xceNObqmzt7JJQePJH68tWtjlb1xZnzTDR/U T+9zF7zRInjtLBpjKe1o4Ic6G0tyjcoa5eOS5qhP/48/Hzy91kEXDi9rcb38PN3umTqlLI2jZcCR C7QsQNRtruArENmaOisVZRpsNt0naKzWYpMJhvtek96us+mtjjGFiBfmq4XDEf9turSvFjmNMw/N mXDNpehDdvI0zdGXuSVWW51NZF74b8wpyTpoEldqWShgU9bOv1Y4eGTdq9smXxvriCttFcWp9+wN U2tuuWP16rJJ0Um52tQMnHvxNrfSwcYplX//+NAHa/Ndjfovdk9qx5kE/vX5SycXvvYj+GZFDUH4 ZpTZNnwF5upHbKrA6rAjmmC3sAiN7wmvTocvxSn0Cs7MK6SjGrYaG/XWTgR0NFK9UqEo9VPjWEFG ngvYEsvi4Ai9nAqQAPNXYENjWW3uFe2GjL8iymjWPWH687+IMV2trVtwTXtDcK29Nlg8udVhjURS 11ym66x8W2+Z7A+14bK+jlDqsbntLhaGu0xnVatASMTd4HeqMLcw2SdYg7nNudNy+R/nUpKrz3VB LnN9+ZRxc6fR2hlE0IFKfZoNmts1nFdTo+HwNVY9Dvr0aYY1UqVUk19pwWb6XsFircTezN5Kfe5B h6OsiuJbmgr9WFFRRDGW9jhYWFw0nERtlvFKWbgOyFg4H/hgNgc7OYDg+PxrYUWlYw+iKZGNgsPm iDDfFAFaFp+9FDPnJoatsZ66voW+viVLVzfXLtrW1/9w9yLnivnF7bWukv4Vc1c1D35jbeuN87nT sfa87pbKWHWgvGtRfNrV8QKH+fV5M3WeWEVEqKnwdS5qm7FJyDEBT158s/Y5yTForjlC2KbnzS6T 4At2mgSNrtOkv89m5VQ6GdXwMrmgIjC3VH+W60xmpbJALlWP4YxPlJH9LRZyg2OapXu0uffCW4EA zEe2AcDOhVjcFnHDnPncNlG24bB6q5o8ZvVu2pb6kb68vryko6hi8pb4LTffw48rSpoXzv3HklTb yLqWPHdhbXvTA49zAYx3CmIqXnyDuBz7hUX5T+TlOQ/H8yzwuj1yXn6f4LGaymk5LB+qs465CsC3 6XChRlPJjSFiiZgKrIISZoSUMG3F1G6E7fmLO2dXiGkmmoLYvqiFxIA5s5AyG/8sriJOxJcOpE+h +cbi1gZfx2yvTGvy+Gk+TODaDxplupn39czd0JDjbeJ/mOKvu6GprKC7K0yvj6Y3/C/M6o1nIilD /Z133kpv6G/24lQv5mqa+LtEhbkWkmWCoAyZYFaFlFraI9ezQJ9CTGFooay0W/WmAp4SejguzcE+ t5ToTFpQqbWgwOWwK5VuF5iuUTxyh2MA2Mx4F9yZ3QBvZkFyivM+sHDYDgGO3JlM6V3uzM43QudY Zem3Kn2mHO3/OmnWV8ToBn9ZWX7qyQ2pz/LcfpAkrDa7nM5J/pSMfhBqcpaVY29A4Z4sXHByH/dG 8xTsW8w4MzDxhawcc/KS5wS9Vi8uHUgQyYNtyIy4fBTMLiQGlmjFdYUliJ2JPc5iBwE4MOtZahBT 8b5GHXYUzC6WGtKp2ctTCzHqVNhHEIMykhx7XpFUofMWm835Jo4aDCZsECny87GLAEYQ9w6+chch cvk+AoxBIIrhK4CoIwJIV+wpXI44cVOhIPX5jrO2QjDEjoZSjebrlO56O6k1VtTS+WBetyP1zjbu 4wt67g+dk/KZ+eX3MxxyvOz85/RPvvaCMhxYDMt1+Y3CBRfwZ4PO/inwV0cST5OyiX8ycyqALyII IRScZUQr8YSMFi9f5CmCFHjkqio+GAoiIBXSEa2zTIL9lZDSazRGvekp42gqgiMXt44u7pbbmNlL AxSe0GV+kCnjB7EqP86+MVZhPhBXZ8oiglVxilstuUXFdLJvWvTn74en+lOrZmpNe/YZTN6S1FF3 TV3Fa78sry630u3TLFau5aAz4rQVyMNhtTA5lTrV2qHDsl1t8TleecnqtTk9OAehKY7WUY4Wx2rz 4CJpqmyVeWy9psSc6hJlpBIy0qS2G6ydH6j/pubkAkpsu8Ulx0aCXC3A8FF/S5DkuYjeavGXsVNB MFJtOsVBudyKzWhXqTXNAFBnZy6iA16AaLYwzXYSSjwwHwpNyhbti1q6ThQNdkDkv8oNp6hbtnl2 XfugprioIBhpD6Q+dLp9fnpf0GfM0R59yWAKNqTlaMZN+6bmvFjqstWvH+Q+m9JQgFVNbXHnOhv8 KTV9t6QtP5CVp/S8p4MPZoIPzOTrghnnAVUcvipi5pS8S5nTyWs5uHzvCqUo50jVYovOrCUqvYpz 8Coph5ObewVOzVYztU55UCVh63shOEiSw8QsR5Wj4s0HiShyONDLci0P3hCtVETBgtCaAQQzxAia uAkFbckOdepxMg6ahi1xgQXzxYNx4k4UTv2IO1Hi7hQ/83yKK059VtVQbZ/D/f3Cb6m8utpX7KBF qd+F+Ybi/slUX3X+p3pPD7YQQWN76hPaht88yCEewSg7eiJHYPOSyXO4I2q1TsuW09Mv4qRRMJD7 CUK96bO07JBRtZ/WaEPL59VGKs3yDzviHevXtTeGenEouCttD39C1/Pb8FwDaRJ8enzny7DGMGpI Gs4apIaLL9I/qWvlMm/DV0Izb9OfRSwHLwwiOPKll5rY0e2lF1/8g5eufDX3yEcfYV4cvs1O6LV4 P49f1qgWCrkk4fW8i+/j7+KlOp6XJwUZ5aRPyhRK2ZMlkEZ97+lIFTuUeYYdQ8RbsXlRI77s2pde eonf9tFHF0Y+/DDNH9fg2XXAGU9sgopPjnL0SY6TSsTREzwBQ2ajrHvlQ3YHJVfTZ7kYNw/93YKR ozz3lEAozkxSiZSSkgbY8tnz23itu8bNxVIh+hp99kHMYx540YozB178rshUodSlUFiJLymUsE0c zs0braNWMNzdVonvyVLvKCHG3JtVKrBIkG3VsCX49FtpVsrYD+zU6assVItXpY/JZ4OnmWPyLP6K vU2IXPqYfEzlqAk3RHLLeqqmLTRuv/aR3o1fn6wrqIxOrgmZPS/R/UWlVdGpjV3zFjf2rqxdsOBA Q2XnTdNL21vbO2Y2dU+OOo4DCZRM5r9J5yGOoiVeQS/H/LVatdyl4MFlep2IubcubSydwuDEODDO s6V1JG3T5JTMGWwMV8o00vvcU12tS5dPjU3aNKcg3i7y8RA9yR/i+lgsUchhOH5GuAy9mU174JY/ dP4pvoee3IoxPZXq5d6TPgh/pEKwqaDE7hVUlGBr5F7iVBdYtkqlrkI2tAvspN3FeDbGxo7LGPRG nLewFCEkJP7hgLUNh75s1gj33hP/vrG2ZuOvnuiobQyECjwGY4Enr8wbmbQg1bv0dTqVFtA8Ov3N FTM02pLyafPuf3TidOqFRH+w1GIX5xLAuIa+NC5nely0QC3darGkx3XmS+MyYTsVX6vmYDrVINKW /sMZHr+P/XkC/3JY0geXvp46mvp96v3Uk1cMi066OCzw4h0TCdk94MVO7Lw/JyyZR6lkWisOeNzf KrRKJIM8N4it60FsRUvcIcM07TR+2l7BqNVGS8tx1P/+ciFUypcLBnNneehBoTTq5t0PRiXlFRVN 1QZTjwnL79Z582b39OTPRkijuqkzP3/YO1ad5uEMLxuj+tNRWMXiqfdg5gAtU5E4R535UgDzCHAu LbNzh57i6Ui2vCAAAhnI7DeI/J+1MavTkac6m7gHnd4+YAfOJdlT82mzuhiSYqzFqXkJ400OTjRz INLGHJxoCdYo5lrUSapy+u+b2rIg6O9deefMSSOBqcJqlXJ48qrYprPfeiP1k2+PpY7MvnO6XTg2 /HnqB/s2fkibfvRvNOfxrsT3NpX1RIt8Cmltk6e5dVLIWVlTNnP+JAM9RG9e33bTzOmH7l3b7nTW 6lLq8gbnunU/u/4HlG79Ueqxd59LfX6bPXfIkXeAVv/uO7T64y2Jo+9sPZQ6v8tS2VVjp63F1blC va1m1o13ts7qb9y4eRboeQv8uDOgJ4utsPNiiK3sw3kxBQ6471NI1DvN5gLtTj5NgSsEQFrE4fsD 7LgRYzfxsJjRIJ7Rx1mx8l+90XLdgZFfv/VBKrZpy6brYit72udH7XraT4eOU82T/an/lXoi9XBq L3cy9f3Uz2khrfgDzb9pxr7fMl15FPruVYwpF6tGgdEKJaSQKRXKB3DKGL9zpLValTL8JtK4Vpvn FLXGiziiEmE7UaT50gGxCNtKyp4nZgEQEBOqhEZkFu57Oe6mBb0X8lcvrLLlOV0b5pTTN+tkVNow yWtRc1OmSA1FTR18oMTb2tBLbcNPYEy3YEwvY0wlZLEQceXjQIndblXkW/lc64NCvkQpFfSmTmmJ ooQveUThcBiVUrnMtdNoLHOUKJX23Y7g6UiQBTuDn71VdYrlJMi0Cc77ixYQzhOKTAutzAKi8Nxw yASH/VmcvC7tquIcW/pLTGnlLJNzz4RjxRb9LMP5lwN3374+Ul9nDy3u/kHLpk1v9H//GUtFz7y1 zwzu1+RVBFO/CS3/zd7R1s7l84Pd61pfOxGNPP5gzeCcxFUbXxZ/AIKSe8EHv4Ru9pH7vkepRpqr z2f7FYLPkNep0+QjLPGQoMt/JP9JeOp8fr5B6oVxs0/wmgwQ/kdw9A27rviehNXAW202ty53h15P 3TsVihJuN70kv+ynGrqTOTOGBo7kmusHxU1D0vxq4KJiTWMBosqEV0SPIcpQEgyH6tJ+OzOX06TE VyKAnojcbRAPvYlmiafo3k0Fm4bHtnfeMD2+qL6P8xcVGDVTdReerb6h8frjiTVv7vlO3ZtLh/c/ smJHE1ZI7m61zfVhaorVOnJsw+0nEtC9HLkVPrAKtHbg5P8cobxAKpMZlEpENR4SlEqHz4GDRYJD YsDXlWBxSz0OuCk5uwKBoGenOT1V2LgIRWTFBduiIm1FfYQSwjZgTUuRjJPbLh+5KE/FdbQIxhz+ MgEqtjTzd+7789ddqv7HF659pC/x+gO/fmfNq1R/b2oiPLfPp5GpZKO3di9tdt4grQxvnSBJSax+ 8bGNt/70WqqnyqO09o9jigsrrWUutcZU3/rjl6rn3th5z0GskqtB8wnMMx/zbCYjQi2heoNkkscz iZ+0T/DYFJ59JSEF4pX7BIXJFuAD+2wS5y6/v05TsMtk0kh21tW1VO7E+Xemmr8qNMOsmsysmb9D bekFHZFH8bREnT97aILRDsLKTjJm6ZuJTWYutRxv59auX/PL3WMvr46NdHH/vvb1LXc9v/jqC8m8 psWdM9fWtVzbdfOYuqBl6ZQZ1zW2bpzWtaTZyb2eU/7N6687OjL4rfVzRmcW5cz//VWPzZv+wMpV j1DZpGU9FS2bZwxtjt1x/i8ta2eE2rYODe+YUjkVG/EcSQA3H4s8UElmCYFC8IDSmOUBP74AxXjA ZMTBrH1GidRDaY5ll8cTKt+Vc5Hb/wcO8NYw9r20/mDyRoOZk8hNTPizMi+6PTS689RmS4b+sQ1H NvziN4+lfvOTw7721maHUquoWzuze1lLwQ3+8E3/+UKa+kOPbpqc+l3q7LnU135m5PbmOPxWRW5Z xR0/WczIv/cA07NsnuQH3/3muYW62N+IU4EKQl7oWzV8MZemWnC68CFcK1lf8YP75PtSUUJsQ3+t vnDA+pn4pEyjmLVhj/QZyn596TyRSd4nmySj5HppN9ko2YdyN+A9XN9MNnH3A9aTfKkyXS+7nVwn vRbQQK6X7CCb+H+SNZJnSKs0SIbkC4lV0ksW8B+SPskICcGuXy5ZQ5bzfyTLuKvJNP6vpFmygghc lMzk3EQqgb3GlZNm2TfITMn1gGb0X0emSIbJMn4amcmvIQu47xKvZCXqFMQkqyL5/O+IDWUz/ziZ Tg8QO5dHpgCeQPka7hvkan6EzKMvkMnYIR3iteQpQEBuIXdIVpFbAEcz+b3IbwWsBjCNsgF/Z+kG +j7Xyp2E+/GmpF9yl+QV6QLpUVmD7AnZP+VD8vcVguIxZZHyJlUMXyV2qR/TmDXjOTdoOe2ANqnr 192t32owG5YZPjeuMf7OdK3pFbNgfsLSZfmFdar1eetZW8i2wLbBdo/tn/YSe6t9t/1tx3O5mtzZ uS86e5wn8qbmnRCp1EZO4Hu3CfxKIYcT4kH81hxRNuO3DnmxlWL7l3EFthxhoxP8pM9ATzzQNnLN omuXjzxNXDT1lNJOu1zH6efZwrls4Z/Zwj+yhb9nC2ezhU+zhT9nC2eyhU+yhY+zhT9kCx9kC+9n C+9lC7/PFk5nC+9mC29kC7/IFl7PFn6eLbyaLZzKFk5mC/uzhTuzhd3Zwni2sD1b2JYt3J4tzM0W hrKFwWxhIFvozxb6soWebKE7W+jKFmqzhVC2EMwWKrKF8mxBmS3IswWpMCFS7q9i+hcx/UxMz4rp p2J6Rkw/EdOPxPQDMX1fTN8T09Ni+jsxfVtMfyWmb4jpKTE9KaaviOnLYvqSmL4ops+L6XNiekJM fyymPxLTY2J6REyfFNODYnpATPeL6W4x3SWmO8V0h5iOi+kdYjomplvF9DakQlOXa1S82iKmN4vp ZjFdJKbTxbRPTDvFtFVMtSxd2NKJn66jZBRq5i7AfkAScALwGuBdwFmAggQl8EkA0wALAasBWwB3 Ah4BPAn4MUBFCiXV6F2N3tXoXY3e1ehdjd7sp0B/LvGQdwCfAniiQ1oIaAYsBDwi8Qge6dnf0+SF Exe4Exdeu/DuhbMXJOmMPzHx2sS7+PlPyZoWlcSLYZ9A+hrgXQDi+4JG8u4zZ5/hxETXYpC48WA3 0wncAHrrkL4L4PBaFbuWKJ6iOh/VtTglcvFahnQLZxP7PkQKuYdIENAMmAZYCJCRd5B+CpjgHhJm 8u+8a7XlvflLJDfeZHXeeJPj9V+gvOF6JNesQXL1aiQrV1mdK1dtuTZ3/XVmS95VK5AsXY5kyTKz c8myMRw8XGe9oc3h3gRwtIS5u8kDAI7kIS1nJe4Bbh/3INFwu7jd3J3Ix7kd3E78aKqTe4DsAGBK SB8B/ADwa4CEO4g+h0kO9wjufRT5Q7j3YZIz8SG3+6jZE30ahX2s0JLL3cptBokD+PXNm6BDA9zN 3A3QpwFucya/gZsj1l/PXSXmV3FzjkoDruPcmqNOV/RH3LVoZ/1XoV7C6uccC0eiypYWbi1xAJ5A OyrRZzmu3kbpQwDPbeU2AaMBbhQ5u38LcjaOGzP5Jm622L6RWwrtHeA2IGft12XydZl8aabfeuSs 37pMvpqbfVQeKG3pwzUlt7OUm88t4BYChdO5GdxM5FO5aYitaIiamwqYTlTcfDIJ5UGUNwCuw/WD uP4u8v9AruKW446VQOhiPAkeJr7ZPoNbhHw5iXGLAcOA+YDpgKmAOBcTsdbGGUCoACdkrptwzWbd yBmAtY4WC+op6UD6IoDjJqFdjvYocoalukx/N/rLGZYjR03WaIuVC2YaKjN5BXJGxvLMdSCTl+FG aWBySyuuKZEiPQjgMN0I6QYkcLUeIMGCrhdf3YKcPakZORt6Q6a+PpPXZvKaTO7K5NXI2X3hTB7K 1Jdm8hJOjymMt6zCNTZXkT7NVWHKNs7OOUAUNafhcpArOCWnEomjAHHUQL4No1WAOGoQRw3i2EAc BYhjA3EUaPfgDi+IkY8nFSLPxZPykHtAiHxALsAGUAMUJEZnYncIM0PkKp3PpvMYUeisTD4HOWt/ m74J3Ragv8rkH9B32Qzp6Uz+Lv1YvP4UOev/Cf0YuBaOI1OqIGwnqORoOJwpQGjgWT7100JXFD34 o+Xl0e/D8gYqjhYWeZ5mxWMn8H2SbGV+frYyL+9ipdOZrTTnZkqjalOmJChVKOF8+zGhbwdKFE9k pRYVKvFb0qSQVbEcIyNH+2aJIyPHPB42IvK9/IKo8KHTKQ7zj8Xe6OzjVCGY6G9/JQ1Meqv7LU5I qnOiz56QYg/phFD3iMkUFR4KhqIP7aOBB/dJA/v2SALffEASeOBuPiC8UB6O3r2HD2zfc/8eTrnY vvini3nX4hwdHn72qcmF3ujPjlOVkEfv30sDdQ/Te/dyAft9vrKo7T6q39ssRP9jL/0hflq2HOtF gIaOnpIEjtPg0ZMsqzh6ikdWzip/SHtol9in6+gWaeBpfBO8H3Kla3HQfky3H9//uZ1uF4mzDTkj 8h2ZfDu9U7xxN3JWf+exMWmguUVD9yOY/So9KTb+AjnEkL5OTx6VMcrKj1ZVRVn2JMaAc2O/KxDJ Khh+Y8+NvvwKH3jlJUlAeMldxLB47CWLTcxfBDbZ9YvWXJYLnh9XhKN904Gn6cD3B5jW++/h4r2y suipk+Cgk61xsf9Jv5/l3ztpy40+9xHFrJVH3xZfLEQ+8nqj73xEheed+dFjR6SBIyCMcKKxMXri SUngjSelgSc3Q12/bbRGX/gRde2m+t3sFMOxHbX14qN3+APiUKp24Nk7d0kDu8YlgTvGpYFx4PGv n/KBv3wqDXw2ygXO7pcEPgVqhE+qqqPCJ3gbe8z+6TPSefvkdF4fEx+n3g/Cv7Of7sedrN894H/k wpujwM8tW2jgZoxqM15xBvCrLXTLmLdw+xgNbANsxVtuA5SORcemjPFLx2jHGK0do74x6qyz2Gst lhqLsdqii1g0VfiVA4ssZOGDFlJpOfe5znUudI7z+bUlfl1ZQFse0BV5tMUeXUGh1lWoI1K9lIs1 atWx9bEHYrxOb9AoVWqNTK7Q4MvnGiwQGhmfKFxTRnVlVK3r1kFTTCJxfj3/LfJrnUxNEEvXTSKT lIP8XOUG/kHyoPIB3X8QzdNUTTVCmc5J83Ps8twci96WY5SYc4LnVp975Nz+cz8/99o5WfM54dyT 55Ln3j0nJcep+mjwXPD7VE2aqVqolHwROxf7R+xvsfJYWawk5osVx4pirlhBzBmzxywxY0wXU8Zk MT5GYn2Rfpo0dpPufvxSCUU+szUZCXQf510zklWB7qSyb+7AEUp3D6I2yW2HPPcnJduPc8iMbUNz B45TB2sew88iQQkku4fHdg0GAvnJBPtxu9H8wWQVK9yVP4jf66uannR6WrMnGa/I162/TrxGvm59 umVdYF26cKTE154sax9JlrcPxwPZWrGNrsMn3T9zVyCbp+8VUzwze3WxkK24lGeaWMY21hEqX88e tp69cP3lT133Ve9g/cW7ssmlK/GJ2Vllmkl2wunrTOv/eE/24dlcvI+yNGlPNoN22YZsfkTJiNg3 ozXJtc3rTibwk4sFfXOHk7meVvx+KK5q++bip/haMR6GSnyQr193HRIGrOIIwe/GHcGvuPUfkSGZ O3egZTFNkQT9HHAO8E/APwB/B5wFfAr4M+AM4BPAx4A/AD4AvA94D/B7wGnAu4A3AL8AvA74OeBV wCnAScB+wJ2A3YBxwHbANsDtgLmAIcAgYADQD+gD9AC6AV2AWkAIEARUAMoBSoAcIBWWJ/6a+Evi s8TZxKeJM4lPEh8lPki8n3gvcTrxu8TbiV8l3kicSpxMvJJ4OfFS4sXE84nnEicSP078KHEscSTx ZOJg4kBif2J3YldiZ2JHYjxxR2IssTVxW2I0sSVxc2JzYlFieqIv0ZloTWgTWXr8n80hef83Pv8f UeA6BA0KZW5kc3RyZWFtDWVuZG9iag0yNCAwIG9iag08PC9TdGVtViAwL0ZvbnROYW1lL0hHRlhM RCtDYW1icmlhL0ZvbnRGaWxlMiAyMyAwIFIvRmxhZ3MgNC9NYXhXaWR0aCAyOTE5L0Rlc2NlbnQg LTIyMi9Gb250QkJveFstMTQ3NSAtMjQ2MyAyODY3IDMxMTddL0FzY2VudCA5NTAvQ2FwSGVpZ2h0 IDY3MS9YSGVpZ2h0IDQ3MS9UeXBlL0ZvbnREZXNjcmlwdG9yL0l0YWxpY0FuZ2xlIDA+Pg1lbmRv YmoNMjUgMCBvYmoNWzIyMCA1NTQgMjY0IDMwNyA0ODggNTU4IDU1MiA0MTQgNTA0IDU1NCA1MDAg NTU0IDIwNSA1NTQgNTU0IDU1NCA2NjIgNTA0IDI3OCA0MzAgNTYzIDI3MSAzMDMgNTMxIDY0OCA0 OTYgNjIzIDU5MyA1NTIgNDg4IDYxMSA1NDcgNTc1IDgzMiAzMzggNjgxIDc3NCA1MjQgMzI0IDM4 MiAzODIgNDQxIDU1NSA0OTQgNTU2IDIwNSA1MzcgNDgzIDIyMSA0MjIgOTIxIDU0NyA0NTUgNjUz IDU2OCAyNjYgMzMyIDI2NCA2ODcgODE1IDg4NSA1NTQgNTM3IDYxMSA2MjkgNTM4XQ1lbmRvYmoN MjYgMCBvYmoNPDwvTGVuZ3RoIDYxNC9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQ0KeAFdlN1u m0AQhe95ir1MLyIvXhYnEkKKUkXyRX9Utw+AYbGQakCYXPjt+51xmla5OJYPszM73yzs5nn/eT8O q9t8X6b2kFbXD2O3pMv0urTJHdNpGLN867qhXd+cPWvPzZxtSD5cL2s678d+clWVObf5QcplXa7u 7qmbjumTnn1burQM48nd/Xo+2JPD6zz/Tuc0rs5nde261FPuSzN/bc7JbSz1ft8RH9brPVn/Vvy8 zsnRERn5raV26tJlbtq0NOMpZZX3dfXyUmdp7D6Eor9lHPu3pdu8riTvG19n1XaLRd6HXDZgEbaR LbDI+8JsxCLvS1tcYhE2afEOi7zfRdkHLMJuZR+xCPso22ARG9niI1byeVC05S8iWsp2WOQ9D7EJ i4ha5R6LsCLix4TVRmCZQChkYZVoQ5UDrBIIthjWYLw7tUFrJnLNwko/Wqw2AqwS1krBGoy37BWF VfI+CpBxmrBWCtaAqKxJBlglotYkrMF4ywdFYZXYyErBGoy32BEt4JWIahrUM1FZiwtYJaKdLKwS +NqIkZhYrBMkw0TUKsNa3HiPisIqsVizKmDlD5ZTxgJYGFEpwAIaiX2tFDSFEe10RuxmItf2haa4 EWmSERqJNlQ5QiTxbmjfCI3E+WrOjNPE6LQR8zORy2D5Hv6++Hn48CFwLJXESr3bEVAqYOkEC51E /xYFNCJ6UP8RWIkeNJkIt0SuNQx3NHaQicItEbVc2KOdJm8LUbglonqpSrglrE6T78yE1UacsAlY uvqPTh++Lqj3C6V9XRbuErvF7JrR9TGM6f2im6dZBUx/ACo/RCQNCmVuZHN0cmVhbQ1lbmRvYmoN MjcgMCBvYmoNPDwvTGVuZ3RoIDEwMzE5L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgxIDE5ODI0 Pj5zdHJlYW0NCngB1Xx5YFTV2f65986+ZPZkkkkyk0wWwiSELGSBkAzZIAkBQjKQAIGEhFX2fQfB Ne4bilq17orKZEAJapVata2tS63a1q3YzaVisVXrRvI9575zEK1f+/vj90e/Ic88z3nPMue85z3L HQJMYoyZ2R6msLF9K3vXsAH2CSyPA7V9mzYEDl1z9AvGeCGtafGaJSs/+6zVwpgOMKYsWbF18b17 2c8Zs41iLNm9dFFv/6lD2bczNqoKFcqWwmC9SPdLpDcgnbV05YYts943zkH6BqTnrVjd19vYPPU1 pPlnjl3Zu2VN8OHs/YzlZSEdWNW7ctFHrvWom1fP02vWLVoz8sFfTiDdj+bMsElq1xizMB0rQzqD JTI9szMnS2AuWB3It2FsMtMyDTMwE8qZmZF5mJW5URYv/S2MDV/D1ZnXDLacrYdP9rAL2GXsGvYk e4MtZPugDrDb2N3sPhZlP8a4f3Omxv8HMbxVu5JZlKPooYuxkS9HTg7fDQxpE86yXIOUSxP4xjJi H/noO7aPhq8ZsQ8P6ZzMpNa1yi+jtX9Ip0e+lGtQ0zpSxtPyhdA29ZM+1t8yfGj4nm8NYgZrY3PY XDaPdbMe1ovx97OlbBk8cw5bwVayVWpqFfKWQC9GagFK9aEU19+UWs3WsNVsHdvANrJN+LMGen08 xfPWqumNbDP+bGFb2Ta2ne1gO+Pvm1XLDuRsU61bkLOL7cbMnMv2qkowWfax89j5mLUL2UXsYszY /566+EypAXYJuxTzfDm7AtH//fqyb+Vcya5kV7GrEQ/XsuvYfnYD4uImdvN3rNer9hvZLexWxAyv cR0st6pqP7sea+xZ9jB7iB1ij6i+7IPXyCPCL4tVT6+BD3ZgzPvO6jF5c/MZb+2CN/i4B+Lj3gL/ 7T2rxqa4H7n39qEk985AfB54KzvjFjH6KzEy0t+Mk/uIj+GKb41T1PhPVj5i7qeb4S/hGe6z/bDd +C/Ws0ucrfezH2AF/hDv3Ktc3Q5N6lZVn22/5UzZ29S8O9id7C7MxT2MK8FkuRu2e9i9WNv3s4Ps Afz5Rp+tKPch9qA6c1E2yGLsMDuCmXyEHWVDqv3f5R3C3vHdOofjbcXOtHKMPcoeQ4Q8wY5jp3kK f4TlR7A9Gbc+rZai9FPsJ+xptRTPfQqx9VPsUM+xX7BfshfZM0i9oL7/DKmX2Mvs1+w3khXqV+x9 vJ8GWHhy/4L53fPmzunqjHS0z2ybMX1a69SW5qYpkxsb6utqJ4VrqidWTRhfWVFeNq5wTEH+qJzs rGCm3+t22G1Ws8lo0Ou0GkWWWH5DsLEnEM3piWpyglOmFPB0sBeG3rMMPdEATI3fLhMN8Hq9yPpW yTBKLv5OyTCVDJ8pKdkDVayqID/QEAxEn68PBoakOW2d0JfVB7sC0ZOqblW1JkdNWJHIyECNQIN3 aX0gKvUEGqKNm5YONPTUF+RLg2ZTXbBukakgnw2azJBmqOio4JpBaVS1pAp5VMP4QZkZrPxjo0p2 Q29/dEZbZ0O9LyOjS7WxOrWtqK4uqlfbCiyLos/sksBg/vGBS4fsbGFPyNIf7O+d1xlVelFpQGkY GLgw6ghF84L10bxtf/LCgYui+cH6hmgoiI61zDzzAVJUm20PBgY+Zeh88OSH6PVZlt64RZdt/5Tx TD7EM26KSr1CM/QNPcT4MjJ4Xy4ZCrOFSET3tHVSOsAW+mIsXBjqiso9POe4yPFEeM4ekXOmek8Q nm0INvTEfzYt9Ub3LAwU5GNm1Z/sqCYb+YGoktOzsG8p595FA8F6jBC+ZB2d0XA9RLg37syGwbGF KN/bg0Es425o64wWBtdE3cFa8jYMaCS7YVl7p1qFrA1Rd12U9fTFa0ULG1AXIdIwwCeGd5C3FWzr PMZKRk4MlgZ8h0tYKevi/Ygm1mFSchoGOvsXR/09vn7E5+JApy8jGu6C+7qCnYu6+CwF7dG8E/g4 vDCBai2M7TulRWEMO6rPNgQ6ZZ/SxWcLhkAj3oK1VciwR3WU5DNaWxXolHxMFMOnxEtw9a12kFCy 66agMhhV66b4MhDc6uvfdMlHA0A3ooYzfdKgE9pv+kSf8792jUrzDuUFGhbVn9XBbzWKhNrBeGvf 30+Z+yLuDHTBwKdzCh9DQb4MHUC2ISpjnKqJz6I3EGUzAp3BRcGuIGIoPKOTTw73tTq/Le3BlrY5 nepsx6Ok41spyq+gvCjLaOnoFAm5DjHYGFLnlU+rmp6sps8kp3wnu0lkBwYMwZb2Af7hwXiDLIAV hMnR5TT1XlLhLMVibcRGGWzsDQbsgcaB3qGRPQsHBsPhgTUNPUvHYxkMBJv6B4LtnVWYS3Xd7/Rt 4x/tZC1SS0dtQT72ntrBoHRR22BYuqh9TucxO+7JF3V0xmRJruup7RrMQl7nsQA2d9Uqcys38iIB nuAtzUTCoJb3HQsztkfN1agGNd03JDHVRoVgk1jfkEw2uygnw6YhW1i1deGFFeZdiinAPtwQ6OfT s6Nr6UBPF19cLBFTiR8pKgWrWVQOVg9Kss4SNQUX1UbNwVpur+H2GrLruF0frI1KiRKcM4Q9aaAn iH0KIdfJfFIXosPOo1/ODgyNjHR0ZjzvO9mVgSUxD5jTGTWGcA5os5tRbjJHD8yTo3v6enk/WARL na/Mpr4urAXRIIo0RY1owRhvASUa1To8HFGpD3ODCVTr70Eiuqcr2hXiH9q5jPcoELBH2ZTgeEw7 tanN4R9U2DXgDBbzwEbRqCn7Qk5G9I21d5LFhyQ+DBsuH5Hegp73BZHV1xPADGhYXztCnfZSE583 WBZhS9TkLFJh8sUzGR+Wkm22mqLGMWgQP1ybx6BB/Oi74BQ+eDV1YbwAPtseNaNHOWe5Ml4B3kFW E+8Lfi5E53nRH/Nm2obYzOAWbI280+pH6ZEdtWY39WLzp/pmWIIVojLaMmRzE2/jabLq+cgt8LuS 3TE0ck9wK98BxKsgP8gPBx6YzHcMgc26Br5riM4NFeQbvmu1quaBAYP1+yuQvwzWM8xbCTTgrMFH afGUuF55GU9UCp4wK1krm8bmPs6s0kw8Ro6XHn7YU19vKNA/IdUxmQWkDjxsSlJd2KaRrUdTUmqC R8fpLlMcTUNSwZEa/WWyzGpOv336hcLTb590VhaelArfeuftd+wfv+CoLCx555V3isZKjgyHCneC rNe7dcHMMfK43JyykpLianlcaU4wM0FWbaVl5dVKSXG6rKAkWaplnpaUl7+eo0w/rZN3BWtmlWjT U2xuq04rp3qdBVXZ9va52VVj0vSKXqdoDfpR5bWZLSsaMl/XO9I8iWlOg8GZluhJc+hPv6FN+PLv 2oSv6jQrvrpW0U2YV5Ol3GAyyBqdbijdmzx6QkbTLJvLrjG77I5Eg97psIyqn3f6Ak8qbyPV46G2 TrfChxJu1UzZAR/ms02DKblDI+8dtkut4FOHbXG2qvzZYYvK7x02c5YdYaPRFXAF8OieMiQZwtY9 OdLxHOmlHCknR5c8JFli1rZc0KCug9WcrOE+7V67Dm4tdFZWFhba3wnxV3HR2GzupIzMnHGO0rKS DHjJoxoc35HKDo3Jajh9TVJeXpK82GA1aLV4G9ZJMYPVqNEYoafJksFq0kx2+pwGf65mb67f4PS5 nT6HYXi50Z7qcqbY9cNFBoePj3vuyEeaLdoAq2G3h9NSU21eL8bttWPQXjtG7DVhuF47xurlY7Wy J3OlQG44tydXybXFvQRWvQT+8DDqgD/iXlLzUdM2JBcfKSyVSr1DkulIZmZlYfVjkglxa5LyYpXt 7iEpf7BwFvfO6VdOOijouskvr3R3P00KZoRePJB4iHnc6QimsnIH91kpAkt1lMOdoDkr1DSaLRqD RW+pmL9vzjn3b6pp2Hbfoqrt44ZfcTg0RotRusmc6DQ5x89b2F+0/8M7ZnXfd/LK5r2LGlJMmvmu NJchZ0zOtIEnVu84fl59Wpq0NTPLBSca7KnOYVdKTlqm19L9wKlrb/wy2psSzEvJpDga+VLq1Lrx Pc6MozVJ05MOJSks7iew6ieV4SewGk1qPvzEHpUdzDRy/KhHajXZZ2ojrKZGKgzR+IvGdqsRwheb gw+XR4jUaXBnJHsz3QajJyMpOcNtSMFotVq9xaB5XSh0i8f3yJeaXVoHm8jOP5xrs7njfVIZk60y +gQ+xedOTaNPbj7r6emmMWOKeWAUe1G22IuCxXaUKvaiSDEvYmfpFTNNY2y5muTMtuQID/aaGmdS JQbwSjzEHSUi2AtL4uHOZyoXCyU3mJjowdTRLsEXAB9ekpSuJJXk8BURH69ml9WTYi1PyQ0GPcNL A5NSZVk2uPxer99pyE+ZmZbrT3NI49PKiou8EhaBy5+cGHAaJrux4s1pxbnyicqdE6bsb/76H3or 95JVr7l/VKYpKc9/+melfT3dhdMPTpef0Fv4OrLoyW+TR04qfdoM1sTePcYmjbx3xGaXpk7iXoIT VIZbVIY/wOq+MGlIzg+HisMutzS1OOyQWrOKs4otPi+v6+PLymdHLR93oY+70PeoXITvu44f9qlR cfxwcpzdxI/YHNJUZhnzmJTLyrFscsJmR6BcKg+bLdJUx9DI8bCJq3JHuSOxCpvNw5N82rz2xCEp b1CrLizsNScdfL8JhbrtJ+3Yfl7h245YWmqGiLP4ItOoiwrTQNv6GF08rVP3JUxcfBHqlL66zT/s nrR69oQkMxabIaFkxtrmiu66rOKZy1YtnVkyYdlVHaHZrVUunUZWdGa9ubC+e3zZjNKU4vblq5a3 l0jnzL28rzgxkOnN9mN/12eOCqaXzygpnzahqKS6Y+30tt2zCmzJfpfZ4XU5U13G1GBa2tja7LJp VcUlE9vXIrYnjnypO4E1V8WWHM6pkoqHRj4P13GHZBdLhQYuRhVK2XbVki1lernIy5S8AS4KiqSC sVJBllQQlMpnjp4ZHGtWnGkznRF1/akxXIPFh5cU6hZ/shMUit2gIlROTlkZRW2JRMdekkQqMVGn 1+7T2FPz0v2h1ATN8Mfyl0pCSl4gIz/Vpgzfr5McOQF/lksvS0FJcitGd3Z6aobbqEh5spSm6FzB tPSgXdLmJDh4ZDoSlF99XSi05mBSSoJGMSSYv3paM95sM2g0Bpv5q2c1E0zQ2oSUJB7HMpuHOK5R nmMluJZEwwFbrb+2sFYxG5NKLYjCUh6UpTwUS+08SEuHpH+GE1huro1JFsZPAzY+vjOA3+OxrzIq cFYXxfgh2RB2O5KeYaX2UnnC8VKJYc8vHTNp9JDkC9teypQyMzVpH4xpnvimpVXDCsVpqG753Wvn dyMq1Rh8OjS/uzJ+MhZXFo2dj51Ph2sGdoJxnLED8g2hZFwpBWHcolG3RD2FZSI/GpQae6ovxZ8w 4aq2yevbCqo33LtsR2LRtMqJvU1FFgOWud5XO2txae9FHTl3XlbfX+vvmjFp9USvxaLTWSxzahqz GxdPmrqmObuxdMY4X1owzWBPtiWnpQTTXPmRXR1PJxXU5DW219ar++sc+Deg/JyNYxcPpmJHP87v D+AT3Fd8hz8CX7HvuVioR6VqRwHwB7wCLhbmsLUwQUpIftcfNlmn+LOGJPmIq1n5axHaPmK0TinK H5J0g8ZWXNdeCfGjMwT/xY/Np89cKb5xV3E6Vq6aDGZC0brmLlMCslafXNXSWdi7f9G4SWsPdIXa 6sd5jTrZabXlVkXGb96dEe6uqpxVE7LoTXrldkeyw5qcneYMbz+88fwnt02wp2R6E1xeZ64/Y1TG 0Ydm7+sMZYWCBlcaj7se+OVm/P1BDm6ml4T9NRMks6+SR1slv1lU8n2wksdXJQ++ysck/J0OKySv FfJIQz5YPTdVRiXVjtKFQ7IpbHJlNJorc32aBISZNuZtRuhqDie0aqfiBOL3LfUMor1NnESIqW8O 07NDqjgx6cxZo+TkfHPNqJbLlZv1jlQ3vzxOPjC379LZo4oXXrVg+r6w3u33JgecxrvrdtbXdJYn e0pnTcqYGG7MTcYBrNHgKN7cOqt13+DCDY+dN7mhTjaLs+d0Q/vsqoU7wvV7F010jq7DAcD91Q1/ HcA6DeGbnofCowvLaspWlymuADzmCsBPLldGPj838rm/8rkj89UVi2j44uH60J0hOQR3PYySoVJN PPzAapSpaVQD05LVcA9mZOT/dI/mSo18XCO9pJE0mtTCN3OavR/0JKxJkBOMH6SqIdZ99t1VdWfx WyEKN1zNQiG4VEJ4ZZwVWDgozg4/2ZNbprpUrxzITT4dS29c0xbubyq06M06RVb05rJZa8Or71k3 vmrtbX3Lr+spuFvZunnivOpMHPK5GS1bZo3xpHj0CclOq8tmMSd7XdXbhrZtOHZuQ/36mzpde68d M3VROfehxA6MfKncpl3LitnWIzWl0mgXDySMG3xK3aog1JsXN/Dl5hqSPg8npZt5SJq5T83cu2bV sWaeZ2JhZLH00cl2rLqjBc1ZjclT1RBDkDkrcZuns5RuON+KL4e6S+n0Z11v4rcZBx0YHuU2gzPA Y8jgHdM0tnpHPZLJ3oBLr3eRefKVTXO2T81INpj57m42yLbW+fVZnZHTlwiLtgIHL/IshtN/bmma uPjiXh5L5+Mu2qYtxF00g116tCY4Pbg6qCRyZ2CIYNUHatqlpk/w1Ya0utpUO7yQ+Ji8lqUyD3nK E68FVl0KJpd64KZHTP4wAs8/JFUfSbY3qf557WQovq3HVx+PlH+9ybr41oR7PI7QRKn6uw5w5U8Y H+I44wLlPH7H5Xd7aez40XmVwDdzvwNzX8quC1tqyqS8Iqko7JRasW2+pM49hLongz/gN101jXEW PSbnskxmiY/HEg8NsOomsDpgCw+HlMSCAsaHSmGRmGnWjmpKbXSIkMB1SyrEJoxT7GN+zyo+wd/5 yM8MPVf6noCIXxywT+slKTFR2WFwZab4gl6bbvi87/pE6jA4kzO9yZkeo9U2/Ki0ymrG5d+gUfRW o/T3Yeu/hsbXL0ubTFajgqVmtHjtw48OZzs8Z9YL9pxidm3Y5uQPey7+Fl86p3hUqCuFbz9nVsyZ FRRfWnCLL93M93NaQXxTpwWlriW47Wh8EfElFDYVNI9OzmoSq8hZWcOfieM30viDAl9HLBQ6K1r4 gf99S8nzn5aSzpmalJhm10+9vvU/LCXlPIMZPjKaDZsj07GSenhcyYyf72/DRy6Wy+4Np9bkSaOc Up5DyrFKORYpxyDl6KXR6o0tnUcK3ABWFxJYDTiwugur+XBvOt980wtNksnNH63c3GFuvs+7nQhL N/ea+1HZxJ8LjtpY6xpsbPg+QYrZmoO4CwxqsS1jT8aZH3eaOPx5lMVf4nlZXOX18RuTOP6Vt8ev f3Dd6rtWlVWuf2A9uPwhX/Xy6U3L6jN8NcunT1leH5D+vOrYBS21u46sAzeDdzTtXVhZumBva/Pe 3srS+XvhmwPD1yqvwjej8XS552E8tGaUmeJxAlaXD0+ryw9CDRgTX0dJnhAfcIgPOKQ+HYX4sEPc M/hVCFPZuAyNdizO9Udymn1N9umVkPGB8303CauMdhUKGH5ZxCmUoD5G5v7r+vLQvVx4Qe9IxDWx WlZeLem7ev6o+knhLLHIEC5uj8+pz5va2lawcGD2qIc8JbPCgWoc6/Xb6qq7ylOk9zc9vm+yPbM0 OFwt9l7N+4gaRUH8bB1dneeZet6hjQ3n9le58uqKhm/Ed+X9O87sUfI98FcJ6zuyZpyUY4s7Caz6 BkzO4oLv1TbuLCcLY5tm/HGSca+xFPgwO2wMNefYPIEmD7/wYOPhIcHvf+oZfbZD+G3me04hcopO vkfWGQ2GpLQsT/LYceODZ3lCXTjZk8ZXplkzstIsGkVSFiamO4xGo8E9Zmr56ajYar5ZOvvK6nNt isFkMibgWya+x7SNnJRfwJib2AthS2FLTcv0lt0th1q0Zz1Kq4GiprESwMcPY7xqGstDZcTGpCHp zbCfnqf5Se3jZ3b8cRrZPr6KfI9Kn/FlEzYhwSxh2LF9Hw/noL0ayyGLbBnzVrnpr44Zjh7HGodC j81v8Gfm5sT3aF2deWCOPy53h0KvxNcZsgrpQSV+61Hj7f/5cVl+oWT+3mljZzeMTTRp+ONwqGZW xej6Yl9ueEakLZybN3P7zKwp4/M8egU7tUlnzCxrKhwdzvOMCs+MtIdzpYSGFZjxpGR3lt+Fb/J8 AZ8zWJadUzrKnxmqnlU1rrcp3+L02C22RLsj2a5PTE50Bcem5o4bFcgcXdXB5yJj5G/ySs2DbDyb dySPOYIFPMzgKpXhU7A6F2B1J1MZTizgYWhJshacDE5Js55MmlKEu/agnjai53ngldBFu/j5p+kb TfouzqEe7fTIFr/7eNSHNRz6QYdbXYQ8La802AN5Y5Ia+8Npu2xO/sXmTnEHepc/rzlt75ZPTspK dRu0Rq1mblqmPcGoy25ZP01OCGS5Uhz618SXN6/pHSmurMCwqXuB0WTUJnj5uK/lzyLK4zjnrsaT SKlkzuURlMsjKNeA8eWqF75cfvbhK9svHqG15o8vQrDqFfDn6lbGBb9W8gLCcIoM0hdho6ugKdes TW7Ck5v2mwcSvkLjF6JvQupbF0bxQHLmScQhvukUX4PhUcSZ5klKc+ha96vHmd4d8OLCaEgqnDK2 ensDHklwf3Qaz9yWNkemVS25eKGcKY62059MX1CX3RmRNwoL908m9vEd8E8Wm3mM+UZOhcdhdOU+ Kc8nefm+nOOVchLKEuRco5TCF9X4FCm5AjwhWfI3JZtcTaYWzXTWwr/6w07EvzXB9yUSzqIQfjIU enYvd+H7Pimn9My3JS4eEomJbr1cskVXVJwScMi6HUa7MvykwZ6Vnp7pNmolSflc58gMpGY5dMMP 2x1aiztBqtQ4Tco8jzdBqxhs1tNj5NdcZi1m2qnuN/zMZkXXb7tsga3qU5Zs4LsQe2bGqp5veHg9 vjVai7SRl1Vf+HVC/S2nX2fMNO3rouFLjY/AK99+JWkS4KoX8bcF77EHtBY2V9aAR7MHlAfZZH06 m6i8yuYpC9kcTSnrUb5i3eAD0mvsfOUOdoBrTYWad0B+jh1QMlib/BDLgP1a5VbcPhl+G+h2KV16 VnbKDyl7NE7NU9pp2r/oLtJb9BcYAoaYMWz8rWkmHk+utWRZBtTeJeE3e7T4+ws9RmFnhWwRY0Ev fgdRo+ZK+I1DGoMOv3nIOhu6IpObQ3W9K5YtXLcsZlQCQ/J5R4xeqRlinxB7hThXiD1C7BZilxA7 hdghxHYhtgmxVYgtQmwWYpMQG4XYIMR6IdYKsUaI1UKsEmKlECuEOEeI5UIsE2KpEEuEWCzEIiH6 hegTYqEQvUL0CLFAiPlCdAsxT4i5QswRokuITiFmCzFLiIgQHUK0CzFTiDYhZggxXYhpQrQKMVWI FiGahWgSYooQk4VoFKJBiHoh6oSoFWKSEGEhaoSoFmKiEFVCTBBivBCVQlQIUS5EmRDjhCgVokSI YiGKhBgrRKEQY4QoECJfiJAQo4XIE2KUELlC5AiRLUSWEEEhMoXIECIghF+IdCHShEgVwidEihDJ QniFSBIiUQiPEG4hXEI4hXAIYRfCJkSCEFYhLEKYhTAJYRTCIIReCJ0QWiE0QihCyEJIQrC4kEaE GBbitBBfC/GVEF8K8YUQnwvxTyE+E+JTIT4R4h9C/F2Ij4U4JcTfhPhIiJNCfCjEX4X4QIj3hXhP iHeF+IsQfxbiT0L8UYg/CPGOECeE+L0QbwvxlhBvCvGGEK8L8TshfivEb4R4TYhXhXhFiF8L8bIQ vxLiJSFeFOIFIZ4X4pdC/EKI54T4uRA/E+KnQjwrxDNCPC3ET4R4SogfC3FciCeFeEKIHwnxuBCP CfGoEMeEGBLiqBCPCPGwEEeEOCxETIhBIaJCHBLiISEeFOIBIQ4Kcb8Q9wlxrxD3CHG3EHcJcacQ dwhxuxA/FOI2IW4V4hYhfiDEzULcJMSNQhwQ4gYhrhdivxDXCXGtENcIcbUQVwlxpRBXCHG5EJcJ cakQlwgxIMTFQlwkxIVCXCDE+UKcJ8Q+IfYKca4Qe4TYLcQuIXYKsUOI7UJsE2KrEFuE2CzEJiE2 CrFBiPVCrBNirRBrhFgtxCohVgqxQohzhFguxDIhlgqxRIjFQiwSol+IPiEWCtErRI8QC4SYL0S3 EPOEmCvEHCG6hOgUYrYQs4SICNEhRLsQM4WYIcR0IaYJMVWIFiGahWgSYooQk4VoFKJBiHoh6g7z 2zJuzbH0aj/uzLF0D2gvpc6NpY9Hag+ldhPtiqVbYNxJqR1E24m2EW2NpU1CkS2xtDrQZqJNRBsp bwOl1hOtI+PaWFotKqwhWk20ioqsJFpBdE4stQEllxMtI1pKtIRocSy1HkUWUaqfqI9oIVEvUQ/R AqL5VK+bUvOI5hLNIeoi6iSaTTSLKELUQdRONJOojWgG0XSiaUStRFOJWoiaY74mjKGJaErM14zU ZKLGmK8FqYaYbyqonqiOqJbyJlG9MFEN1asmmkhURSUnEI2n6pVEFUTlRGVE46ixUqISaqWYqIho LDVWSDSG6hUQ5ROFiEYT5RGNIsqlpnOIsqnNLKIgUSY1nUEUoHp+onSiNKJUIh9RSixlGpyVTOSN pUxHKokokYweIjcZXUROIgfl2YlsZEwgshJZKM9MZCIyUp6BSE+kiyXPwKdrY8ltIA2RQkaZUhIR U0kaIRpWi0inKfU10VdEX1LeF5T6nOifRJ8RfRrzduCvtD6JedtB/6DU34k+JjpFeX+j1EdEJ4k+ pLy/En1AxveJ3iN6l+gvVOTPlPoTpf5IqT8QvUN0gvJ+T/Q2Gd8iepPoDaLXqcjvKPVbot/EkmZj KK/FkmaBXiV6hYy/JnqZ6FdEL1GRF4leIOPzRL8k+gXRc1Tk50Q/I+NPiZ4leoboaaKfUMmnKPVj ouNET1LeE0Q/IuPjRI8RPUp0jGiISh6l1CNEDxMdITocS6zBoGOxxLmgQaIo0SGih4geJHqA6CDR /bFE7PrSfdTKvUT3UN7dRHcR3Ul0B9HtRD8kuo3oVmrsFmrlB0Q3U95NRDcSHSC6gSpcT6n9RNcR XUt511ArVxNdRXlXEl1BdDnRZUSXUslLKDVAdDHRRUQXEl0Q8/Ri7OfHPAtB5xHti3kWI7WX6NyY J4LUnpgHh420O+YpA+0i2knVd1C97UTbYp5+FNlK1bcQbSbaRLSRaAPRemp6HVVfS7Qm5ulDK6up sVVUciXRCqJziJYTLaN6S4mWUM8WU/VFRP1Uso9oIVEvUQ/RAqL5NOhu6tk8ork06DnUdBd9UCfR bOruLPqgCLXSQdRONJOoLeYOY2AzYm7u1ukxN1+w02LufaDWmLsANJWKtBA1x9y4SEhNlJpCNJmM jTH3LuQ1xNwXgupj7t2guph7D6g25mwETSIKE9UQVcecuBdIEylVFXN0ITWBaHzMwddRJVFFzDEZ qfKYoxNUFnPMAY2jvFKikpgjH8ZiKlkUc/CBjY05+IZUSDSGqhfQJ+QThaix0UR51NgoolyiHKLs mIN7KYsoSG1mUpsZ1FiAWvETpVO9NKJUIh9RClFyzN6NNr0x+3xQUsy+AJRI5CFyE7mInFTBQRXs ZLQRJRBZiSxU0kwlTWQ0EhmI9EQ6KqmlkhoyKkQykUTEwiO2hX6OYVuf/7St3/819FfAl8AXsH0O 2z+Bz4BPgU9g/wfwd+R9jPQp4G/AR8BJ2D8E/oq8D5B+H3gPeBf4S8IS/58Tlvr/BPwR+APwDmwn wL8H3gbeQvpN8BvA68DvgN9az/H/xlrkfw38qnWF/xVrjv/XwMvQv7KG/C8BLwIvIP952H5pXen/ BfRz0D+H/pl1uf+n1mX+Z61L/c9Yl/ifRt2foL2ngB8D4ZHjeH8SeAL4kWWt/3HLOv9jlvX+Ry0b /MeAIeAo7I8ADyPvCPIOwxYDBoEocMi81f+QeZv/QfMO/wPmnf6D5l3++4H7gHuBe4C7gbvMBf47 wXcAt6POD8G3mc/x3wp9C/QPgJuhb0JbN6KtA2jrBtiuB/YD1wHXAtcAV6PeVWjvStM0/xWm6f7L TUv8l5nu8l9qusd/vpLtP0+p8O+TKvx7I3si5x7cE9kd2RnZdXBnxLxTMu/07WzZuX3nwZ1v7Ay3 6kw7Itsi2w9ui2yNbI5sObg5sungxohmo3vjho3KJxulgxul+o3S2I2SzDbaNwY2KpYNkXWR9QfX Rdi6Gev2rIuu00yIrjuxTmbrJPyt/fHD63zpjfyvUXess9ob10ZWR9YcXB1ZtXhlZDm6taxiSWTp wSWRxRX9kUUH+yN9FQsjvRU9kQUV3ZH5B7sj8yrmROYenBPpquiMzEb5WRUdkcjBjkh7RVtk5sG2 yPSKaZFpsLdWtESmHmyJNFdMiTQdnBKZXNEYacCQWao9NZCq2HkHpqWiJ/hnVbVjfWHfCd8pn4b5 or7jPsVpS/GnyHm2ZKluerK0Onl38hXJis37olcOe/PyG21JLyb9PulvSRpXOClvTCNLtCcGEhX8 CtPxw4mtHXxshxNr6omLxqljbU0M5jTaPJLN4/fIDX6PxBwnHKcciudJ+4t22WaTbLYRmxy2obgt wZ8g87eRBCWcUFTeaLP6rTJ/G7EqiWErLLzzuZYZHY02s98sR2rM081y2FxT1xg2F4xtZIoUkPD/ RthBigFlj0gef6PyOEz8X/lI0pWDHe2hUMuQgc1siRpmzI1KF0Wz2/l7uG1OVHcR/rHUnLmdg5J0 eRf+XVpdR9TN/5Gfmj7/sstYWm1LNK29M6bcdltabVdLdA/X4bCqR7hmKNIVmr9+4/pQaMN8vM1f vyGk/iAlbeQpvJCBn/UbkOZ/QEjj13T+3YuKodyC9XipzSBB/O/q/VfnSf/Vvfs/0blBxv/p6qQR +TzWL+8D9gLnAnuA3cAuYCewA9gObAO2AluAzcAmYCOwAVgPrAXWAKuBVcBKYAVwDrAcWAYsBZYA i4FFQD+A/x5Exn8kIvcCPcACYD7QDcwD5gJzgC6gE5gNzAIiQAfQDswE2oAZwHRgGtAKTAVagGag CZgCTAYagQagHqgDaoFJQBioAaqBiUAVMAEYD1QCFUA5UAaMA0qBEqAYKALGAoXAGKAAyAdCwGgg DxgF5AI5QDaQBQSBTCADCAB+IB1IA1IBH5ACJANeIAlIBDyAG3ABTsAB2AEbkABYAQtgBkyAETAA ekAHaAHNpBG8K4AMSABj/RJs0jBwGvga+Ar4EvgC+Bz4J/AZ8CnwCfAP4O/Ax8Ap4G/AR8BJ4EPg r8AHwPvAe8C7wF+APwN/Av4I/AF4BzgB/B54G3gLeBN4A3gd+B3wW+A3wGvAq8ArwK+Bl4FfAS8B LwIvAM8DvwR+ATwH/Bz4GfBT4FngGeBp4CfAU8CPgePAk8ATwI+Ax4HHgEeBY8AQcBR4BHgYOAIc BmLAIBAFDgEPAQ8CDwAHgfuB+4B7gXuAu4G7gDuBO4DbgR8CtwG3ArcAPwBuBm4CbgQOADcA1wP7 geuAa4FrgKuBq4ArgSuAy4HLgEuBS4AB4GLgIuBC4ALgfNY/aY90HtQ+YC9wLrAH2A3sAnYCO4Dt wDZgK7AF2AxsAjYCG4D1wDpgLbAGWA2sAlYCK4BzgOXAMmApsARYDCwC+oE+YCHQC/QAC4D5QDcw D5gLzAG6gE5gNjALiAAdQDswE5gBTAemAVOBFqAZaAKmAJOBRqABqAfqWP//ic36v7eTXf+9Xfs/ 0TPvgvnsfwD6wzDnDQplbmRzdHJlYW0NZW5kb2JqDTI4IDAgb2JqDTw8L1N0ZW1WIDAvRm9udE5h bWUvWEVZVUdKK0NhbGlicmkvRm9udEZpbGUyIDI3IDAgUi9GbGFncyA0L01heFdpZHRoIDEyODgv RGVzY2VudCAtMjY5L0ZvbnRCQm94Wy00NzYgLTE5NCAxMjE0IDk1Ml0vQXNjZW50IDk1Mi9DYXBI ZWlnaHQgNjM4L1hIZWlnaHQgNDcxL1R5cGUvRm9udERlc2NyaXB0b3IvSXRhbGljQW5nbGUgMD4+ DWVuZG9iag0yOSAwIG9iag1bODkwIDUyNyAzNDkgNDU1IDM5MSA1MjUgNTI1IDIyNiA1MjUgNjMx IDQ4OCA2NDYgMjUyIDQ3OSA1MjUgNDU5IDQ5OCA0MjMgNTI1IDIyOSAzMzUgNDUzXQ1lbmRvYmoN MzAgMCBvYmoNPDwvTGVuZ3RoIDM2MS9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQ0KeAFdkstu gzAQRfd8hZftIsLgJCQSQqpSRWLRh0r7AcYeIqRiLEMW/H3vmDSVujiLw/UMHtvpqX6uXT+L9D2M pqFZdL2zgabxGgyJli69S7Jc2N7MN4vfzKB9kqK4WaaZhtp1oyjLRIj0AyXTHBbx8GTHlh7521uw FHp3EQ9fpyZ+aa7ef9NAbhYyqSphqUO7F+1f9UAijaWb2iLv52WDqr8Vn4sngR2hIlu3ZEZLk9eG gnYXSkopq/J8rhJy9l+U52tF292W5llVMlLuiiop8xwKpNx3rAoKpCxy1i0UIG1Zd1CAVLHuoQDp gbWAAqSS9QAFUuqoRyjAYuJUQ4GU27iNFgqgO04NFEDjYgsF0COnBAVolbF2UADdQhXOgsGAvEmF WRmk3FlhVgYaU8yq1nljilnVOi//SGFWBhPFzphVxXkLpDjr30PlY+fncb9Ocw0BNxnfULxkvrze 0f2Z+dFzg8gP42Czug0KZW5kc3RyZWFtDWVuZG9iag0zMSAwIG9iag08PC9MZW5ndGggMzI0Mi9G aWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoMSA1MTEyPj5zdHJlYW0NCngBjVh7cBtHGf/2JEuW9bRs 2bIvj1POclyfHbl2Hnaq2KplOXFEOrYjz5yS0EqRnMomSU3jlrY0rftIHS6BKdBXWh5hhuH9x7ow jMIjmKFMWyAMMFAoUAgMMzBMO2Q6bQgQan57ejTJpDOcbvd2f9/37X77PXbvRIyInLRAFurJHcrO US3dBOQ7KMHc3fNK9Hf9Etq/JJKUA3O3H7r3H1+5C+23iFxbbz9474H/jL38ByJvDxGzFqaz+X/Y 1/uJfBshs7kAwLvNdhH9g+i3FQ7N32O301n0H0e/9uAduSw9jB/5nkHfdih7z5y07N6N/mn0lcPZ Q9O/9nx7Av1l9LW5O6fnXu155bvov05kcQFj+InLRTYUopBAagzyENVMkY80syZrL9rly3K+1F65 sPJpopULAhb1O5OldoWv9LQdJZ9l28oFCVIrp8FRfzX9+r1awKJYBfl7orrOlaEPXgctQYfpS/T2 e1Lfk8BuZd30J3oJ0o+wFuZhVnpTMLMg62UdwvLl6wG6i35M/6Yv0yfpKBVgxDfpPDzxe/oGHa4w ofUgDeNHtIfqqiixDeX2N9/Fqq0XzNbvzXqedtFTGJ+gk7j+jjmudxn0qSpcGfM0PUangXLKY/bS tbP8LD9sZ6lWmod/HoJfztOP6HloPEWDFS62lXWyNbDFE/Dub+gk3fnOa8LHMf22W9+/b++etD6V mtz1vuTOsR3bR0fiwzfHhga3RW/aOtC/ZfOmjX29N/ZENnR3aZ03dKxvD7ep60LK2jWrV8mtLcHm pkBjg7/e5/W4Xc46R63dVmO1SIy6WJAH43pilrfEM9yljqg+hbtuubArwskvh9R6pS+S7i5z8RqN U0OSN47rSxTrT3Obdi3LLdwS9r0ZgvAuWUlwaxi3ujOb5x2Tekj1vSJX6WkMy1vjeigkcymMewwk 3DuzSp77xoGDYCJjnMZ1UYorf+4HSP2hNOpJna+pdNNitNJSrlDyDPJk+Ro1b2GGb8nVEh/h1LhE rj9zCgi2C/3wW5R3aFDEh5Y5GkU4a3yTswbOAruwpKunEGLn+69jg0R+Vk3kZ2DRfOZdm14oWTSk GIoxqdf3yaGQqXSSvzShLznr4mp8ug6rIBOgpTonEKcA4Ja5JeYaZGZDciW2LklU64b5/ELdhCiz PHYig4Y6AruB0vAupbiyfPJKEkGsxERgM1vMnJPb4txeUkKZ4bEspxPKUteycbLoo/0ZzZVX89l9 OrdkodQSWcKJQoqvSo7vAQQlUDIFRbh7xKyE85REQTHQF7wZ1OoIRK/G84XpjAgTllFHQHPE9cXQ ssz9eCZ4vcbdEHff9xfZYiSCM4roGsaiwk9P6FdSQ4IHQRDs7lKMhIrZMFhidlh4LFJ1mxmNY3nT ObETWYUv7J+FzXBnT1biP2T4uOtiCN6BfyApskMYWJR8ZlYsZRaSVjwU48S0udST5tIQr0pidkQU IYjopylI79ETBTUBe5YnhEEgbwlfKxsK8RZNCBpGQqiYzUN7YRncLZqpRqmDnJA1Bn3iPJYyH5Qy fYAZY9mRdBkqM4BihR94LDOSTotFlRzA7eHFmg2qYojh7WHeqPlCL4C23N2VnNQTIyI6wSnF9W1v BOU30E6OV2EWBI8ReUMYSVB2q8mJUhQUhH1ElUmVEhhWK3serGV+c9RzQflcaYZ9+qg6mjGMUVUZ NTJGtriysF9VfKqx5HIZc4mMYqY/A/6tEzIfPZnmvkyBbTU9JKbH4izh0ckkb5jYK1w1qhSyQHAP qaF+OVRf5cEucn1yOecQ/cgBkXOG73Ws3oXdSVZGxVZTxA4hc1+/SFkoNKUjJ3KYIpE3K+TKbgwu i6yxpMOJmd1lY8khTGkGj9gDJ8ooBgmFRD6dKMZoPzp8YUIv9RXaLz9PsYgGP2YEZblCCUwJykKF UhXPqPBbMIn5zfh4r/jG3l6NbaNe9SsDYmOHdrjH8nw5hTVe6ue1sJjp+oa4bpElwYKWJFtEq07D 8RDlzZopKGyCHdPwqcrPVO7TeE1cX5ajacVXj82SgWcHGEWk+n6mvszEPkqNPs6inDUJnLCvwnrY 95v7QawGkpIwMuUAvHJZYBXc+UI1lUrKI3fF2rB6n4rUlUtmqPerYoU/EQFfORjCoyKv4BLTUDvT 3CPOO+553aygrxzXFexEyNwJs6EklIJwNlcyI+aWkJYFvQIXV85nRsQWqCMGwSKXQxyBXjLt1aHY 3fX/BvoCAv2hk+nCVugU68QKlE2YVhg9ntLL6Wb6yUwCzDUmlnI1vWrFCg82NqRziPe0vhxEoLYG zawu5W6VGU5IYTVVB1w5mUmrhIfQhI/i/C/tAaZmfLvZN9cuyDuuIY9VyNg+jsr3gQ8H2fCSyo5P LMXY8d179DN46VWOp/TnJSbFM8PppTbQ9DMKXoFMVBKoAAWLIjqUZBjteanW5JfPxIgWTKrVBMx+ rsjIxEpMwBjlilIJ81X4JGDWEhYzMZwnUDERLGB701U4Pc9j4/r96YKRSQtjU1MpABHZ6iBxSR1c YpLNxevU6WHuVIcFPiTwoRJuE7hdHUb4IzmUIlLdyKhIf2zAOsksLUJYRLkUVoorK9hBz2HnDXFb eB8KNliHllZ4TXgn+LaLkgG8nS/kskIPEaaQtYfHcmleWx0QLGPcgREc5RHAMWrK4HgWQjkEa1Y1 m4CRHAtpntbEpPqM0EhR8D60Q93Kbe0lJWvaxUSRtOFXe83jxBbmdeFFSGCOneZGaCIyuphMnEe4 7S5onlPBlcso8ICVcrsRjNZ2cdcJvwGZxqlubcehilKHRDaJJJZlCTvdddyxAQPiFm3nBgyI256G UcTizd5imQFz+7gTGrVfYcqyAKwD0pjQBfcilBes3xfDTBRpUr2HM9Oi5lR2kLk7PJbFy0JJ3glE xXtfSRhj1YYFJMZ4oYTaxcpd5gttqrjyRfVekSSVq7tL5ZTSRWCSjHfIGKWNawG+Fxtn7bWo24QN o9Z9fYGSvWrd1SdGwSRW8RVlfawmRR3URT20kbKxhsZGzzqbzUNdmtbjCQZ7NsYiSIiY3EN9vj6p b7Wzg6hTa2jsbdSclr7u7s09fZFz/oGIv3ngXAS/AVFR5P3nWl9rFfi5+oHIaz+tH6jvQ+fGHrZp 46C0ZdCyaWO7us4j2dVNmzf39a6RAo3oeCyBQHNA3cTqQ/WiSFtsTZ1tze2y9+ZBpaetxZGJfiQ+ mhtc5W2LdintAbv/cXb5vzZL9nI/+2tTU7hz0/qWSN+AmpxsbOtd8/CaDav7Rm9oH9w22h3qWt+x ynb4c5975y/WZ/9zwPrPf38Ny8Ylvrnxr8BU99Gp27zRt8kpvnWJfjh+OFN9VqxkIYfgNS/I2Z99 Z4Co7vLly//9Rp1B89Sy8nSZKh5SzQidZT8wEfOfgfJcx2H326gGI/koQhkw3uzaiv8shCaM/OYT /yBQC1FqdzI5tUOLZw/tv3Mm2z18x8H82Hz24EyOYg/98XxT86pf/grVh+9vkj98f8vPf4H23R9C dWgO1cE7UH3gcJP8gcMP3tk6f1djYNXts6gOzKCaLjTK04VjH2xtOdJ0X7wldC+K/cXmF6W5swtn pUXO/vo3psWeZT2nYqf4qeVT1o9/QtJiTzBHLph7MWdRcm7vAA75r29fGx4oMlfstmeYtuUz7Kkn JS349A2dA/anm5+WfE8OxQZefZJ9/kn20INMO/pAjfbAo+vWHj/GtEWUR4/VaI+g1B5zbKG4vCUQ 3BwIbAr4Nwa8fQFXb8BxY8DWE7BEArQhUGR1sb74YKh9vadjvdfbyTourWiX/uW9+E/PW297hi5d uCQNvcU6NU+X5l2netpU75q1HmWtF184sYkaR92A11fvctQ5XTZ7rctirXERk1w2S36t05v0Sk78 TzRiOeCYtyw6vkpfcPzO63CS0+L03kQ3OdKWvY67LfPe5+g5xynvGcdvyXOGuZkn5vfKbLU7aG91 B3zNbr+10b32Zg9zC/+h9qFEUIZQPovyPeaOtdu6op3Rjmh7tC26LqpE10TlaDAaiPqj3qgjaota ohQd70sx7k9SMjXMGxieu4d5n5YsWpRJ3qsluWN8r77E2MfSQLl0HOdXiluPI0NT+DLas1cvshZB PoYNhDHiycyxj6Y1bTXPi9fAhdVp3isaj69O4822d4LL6rB27XVk3kSOzN91FeXIEf5Wgl9KzGT5 JXx6XcSXy6VEhl9URwTbEd6Z4F2JLO8A1l7CquKs0iKMjdHFBPNHtCPiRpsH+RDWWWGqPJccYsHj k8N4hdiX5Hm8yMvjezO8VR3GVyl6m8f34gVv+H/aEhMqDQplbmRzdHJlYW0NZW5kb2JqDTMyIDAg b2JqDTw8L1N0ZW1WIDAvRm9udE5hbWUvVFNLS1VIK0NhbWJyaWEtQm9sZEl0YWxpYy9Gb250Rmls ZTIgMzEgMCBSL0ZsYWdzIDY4L01heFdpZHRoIDEzNzMvRGVzY2VudCAtMjIyL0ZvbnRCQm94Wy0z NzcgLTIxOCAxMzE3IDk1MF0vQXNjZW50IDk1MC9DYXBIZWlnaHQgNjcxL1hIZWlnaHQgNDg4L1R5 cGUvRm9udERlc2NyaXB0b3IvSXRhbGljQW5nbGUgLTEyLjQ+Pg1lbmRvYmoNMzMgMCBvYmoNWzIy MF0NZW5kb2JqDTM0IDAgb2JqDTw8L0xlbmd0aCAyMjIvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJl YW0NCngBXZC9bsQgEIR7nmLLS3ECX42QootOcpEfxckDYFhbSPGC1rjw2weIc5FSbMHMfDCsvPZP PYUM8o2jGzDDFMgzrnFjhzDiHEh0F/DB5ePUNLfYJGSBh33NuPQ0RdBaAMj3gqyZdzg9+jjiQ9Ve 2SMHmuH0eR2aMmwpfeGClEEJY8DjVK57tunFLgiyoefeFz/k/Vyov8THnhBKo0J0P5Vc9Lgm65At zSi0UkbfbkYg+X/WAYzTkbx0RtdRyqqW/3UqWr94r+Q25tKm7aEVrQUC4X1VKab6YJtvfFdwQQ0K ZW5kc3RyZWFtDWVuZG9iag0zNSAwIG9iag08PC9MZW5ndGggNTY4OC9GaWx0ZXIvRmxhdGVEZWNv ZGUvTGVuZ3RoMSA4OTY4Pj5zdHJlYW0NCngBtVoLeBvVlT53rp7WayTrZUu2Rx7LdjyyJVt+xIls T2zJseM4sR2nSHESpNhOnJCEQMIjNCSGEJIqoUBLEmhoC+1Cujy6Y2ip0+3SQCltt4R2d7tdyn5d WD76Le3XlMCWtrsQec8dySZkKbvbsqO5M/eec+7rv+dxZ0ZAAMAE00AhMr4jswvWwp1I+Ram5vHr 9wjNrw81YP4CACds3rVlx943H7kOgPIA5iVbtu/dfK77wWcAbCsxxaYmMxO/ua+mB6D8CNZpnUKC NaN9FctnsVw1tWPPjW1prQXLr2NZ3n71eEZ8WHACVFRhuXJH5sZd1G3Zi+U+LAs7Mzsmr/5RP8pW TGG5Zte1k7vO/PArv8TyXTiG65FG8McOM+igFu8BsIEVtFCEdwPOyYhz48ACepQgoAGd9g7kgXYt 8CBp1yMfNB7MFw76rXx+7sLc5wHmcNb5a26E5bUnQIu5d+eldTcDTzvmLnCvAj/3wNxvwa5yYuya u3leKn/PIWr5w4A3ljSs2A0Pw93AZDfALliN97WYQpg++nj2o9l/hPs3cAYUlTcDj8JD8AU1/zg8 C1+7pEaqkF8No3AjrIMHcEybIY3Ua6B/QS4NKWjEH2BCRAvH0/AG/CUuy6/Iv86TLrkfxvwM9vZF WAmT0Kl9W/s23IMj+SIMwEHE4f3jRTX7EpeBLWpu//ssNbcFBvHehyNieN2Go1TgLmzzMFwHJ7B8 GK5FVH8OZ2E7fBZO4fi/DV+CW+AzcEr3lLpq/66dAQu3BFfTgKtwPXTnXso9O3dBTl65ccP6sXWp 5NrRkcGVAyv6+5b3xnu6l8ldnR2xpUvaF7e1tjRHmxoj4Yb6kFS3qLamOlglVgaEivIyv6+0xOtx u5zFDjtvs1rMpiKjQa/TaihHIES8ircnmdimlPSkFbMYF3lBMa+6MBhWwOELiHYhGk7VF6QUraRA 8YDiHErOgLw4peiky0VWKTTIvx3AyoM+IaFogniKKzITSu1IMiDyP/Ut8FPYrFLakwwEfAoXxLMf WXiuyAgTCj+EdGSolH4FhpIszc69thiJsDiQwutIUimfL6ZYa/mpXDLIM2gnZy8b5iqS5WfMJT1x BZwzYH5NARcTu7AY1yqm1Eo4EB5zamsQVojzbYUUK8Q1iFP6YBes2quLPwSDxMQ2MTGxFRGdSL+P 6YU8ogEhK2RHkvaoLxBQBz2gfH84OWMq6hF7JotwFqASYKbIhBQTI+Cy7Joh5k6iZjhzYskMBwYL wudgw02wtE2Rj6YxI8YRN+QUv8+ZnTt77FIWYLW8EKCYmiNqn4quR9HnByFsVeSMAkeFmdDZ7LFZ HjalJfOEOJFZn1RoBgc1AzSYmBpV/AND65CEg8CUnhLYcsfVC1s8ITElZLHMZNN4FeNY9YP0ianJ NFMTkhbjyDP2JA8HzvoUB94Til1SLFjdctPrPppNeLcKrJjNHhaUB4aTl3IDTAaVwFsfErIJEXvD xhLbutmKhReWTdXG/gl1ceSjGUGZ3rQNMcMzc2xe/wNZXjH/LoCrg+uDNZl1MIBZmkhvY1PZhjU1 eBOyRyfVqR5Tp4b6KiS2xVliFVH7YS3WXpdMTIkJxLPQIQKC9Wnw8rqBgFIisYrZbIINMTOBo2fI 4FkiqcPIF9AmfBLB8fQo8qh6g1F1DbBHORNPFUgFAeRocB0UOR1Ppdik8gug6IOHtQ2ikGXN64OK U+IDzyHvbH1oYCSZiDPtREmuJ9lx3us7j/mBoQUy8aJMNnyegcQ4a8SB4bwWTDF82CU9mjdgRK2w 8ihakFdbPef1ncv3sD7ZK/ams9leUejNprOZ2bnpTaLAi9kZszm7K5EWVPMnSP/mUZ/Seyyl8Okp skRdIdY9To4Ge0cGlOLhMbZUvcJUBil4domBxb6AfUEGvciHsws2h9qPNsBsLsv/GmdvRu/kE3qZ q5lFD+FT+MXMZHFAa5NoE+PYRWJCvaCtrMHGfcxqaCqY2LqmAJYvgF2qysN84HCBio0EAsyejs7K sAkLyvRwMl8WYJPvCZDDEq5jmnHOznNcaxlnep6zUD0t4rp5B7B/VT/+mH6jb1/Q7axddAjtzLHj 6PDsn1DOjuIc/7BYMSBi6tIX9ySpj2MimON8lOWKJAwPMcUjqRUZJugxs7wo/FhUeEnR9iTP+mIp gbejsyQo04eCTFP5H4s/IMyPgpNXSEwhbkYH9KuIHvp9z2JkLiiSkMimCwp46bRQlElPTC2YUn7w aLtsbjh7XkTT9eVhsDtENsMXmMLPB4ZgL7MrXBIVqBUpxcrinWL9tXrB8fp6kgJ6IrTcYTUjJIQp ttiKkI6rLiHlY/x58uzcq+k4c4FJ1EEU8RVUHBU9D+0HVbE+9L9V9GlU9FuOpaaW4JjkOpyB0ILd MtB7RpMFc1PXSTUC7KufTeWD/AUU52XQsaE5B5RI6Q+8qKilXtWq87a7IIyLMIqzWViASztTefPq wUai9GL8z/sAdWTKcrWszp2x+y5j98+z0X3c7LsJ5TCQdc+I5MjwjEyOrFmXPIObXuHIaPIJjnA9 6e7UTBXykmcE3JerVI5RGZGJCKwAAwRbe4IzqPK+MzLAtMrVqAS1PD5LQKXlhZBGYHyWy9P4eTkO aZo8TVZpGE9wiAnvFLq3pIiLPqHIQ8l9qalsOsXABndeAVGzxU5QOLFzhnA6s1IkTnYrJrGb0bsY vStP1zG6XuxG9UfjEGbR1LNpEc0fHXASfCTFVJhpORcUZufm0IOeQ88bUHTB9ZjQwRqllKBogytQ bjlLaSQvV6bHM2wcTE2xrj7YP55SDAsNoki/YsQWjIUWUKJXrYPhmVUaR2XNiGoWyWgc0yklJbFO k1vZiAQB90N94hJFV50fpLaadRROZR1ikxpOdEGlKHgYa2AfK1RHqFJ8WMTOWDzCU2/GkY+LKDWe FnAFNDC+BpVRU83OIrZuSJnEqK6pxqCKqQgNWWUCmxYNmixFirEBG8ST5U0N2CCe+hSCwiavlg4X BLBvXjHhiKovgbJQAdFBVj8bC56HcfBM9BnWzPAsjIg3KkRFVO1Kj2zFEuzP4GYhX9+EFBH3ffnK 2JYhyEisjefyVD2buVnd0I7Ozp0W9zIjmT/qQ6ICo0mmmODDPaQMqezlBGUMHafhcqpFJWezBsuH V8jjZbAs3LEV7EQDT+Pldu0oPouGIALNkJGLnU5rpU5nhZAkRaxeb6RZDqNByL4IRPkoFy0z1QLU ScXOJqdkotH6+tZINHzO0R52eNrPhfHXzi4Q3nCu9OeljH7O3h7++Yv2dnsUC40R0tLcybV10pbm arHSyunFltbWaFM553JiwUpdLo9LbCH2gJ0lrk3nrqvyVPtsyzqFSFWJMR37VE/veKffVhULCdUu veMu8t5FHc28t5j8m9sdrGupKQlH28WBEWdVU/mt5Q1l0d5F1Z0dvfWBUE2tX7fzwQdzr2s+9+5m ze//8zGcNh4c7Jt7U/NP2klwgAQb0R571iblEs3+4uL6wH7ZYqyiVXfLxmJwUdfdTBW9XaWD56XC LYKbSCzizM43+mT+fxBOkSY3Pm1xnEasrK5uaXZ0coQXK/W6+Z/L6Y42tbWyH03s+3pm2w9yuTuO feMT/Qf+6iWy6pXWyOJoe+MSqd5Xes2udcMTQ58I+7WT6efuOpW7OfeLT21/5uABsjT3xPrc9aTJ 4ZYaV67bfePRQ9vvv6+t5zOff+0QznV07i36L/Qc+CAKDxbmGq6wmMHk56ifmkwtiw7KxTgqqCyp pJXH5RLeYg7xIRo6KfPuIuPpeJELpz4/fTtEo3k8MOftikZIAQ1P9PBZPBCT8j+9sRRp81CdDkHx 6ANtNTodoobaQ6NNbtqKT7VMgTQqZK0IWGsb7V4v32ctalhmzL3WZUk/lt65N5Ta9+V05y6/Udc9 WLdy1fIlQntPRc9Ic7jNQY928xdTsWWuRUFt47uaY7c+fCL9zOO3rSrLzSyKiauW+7o2f+b06qkt /oH+noMpxG5w7gJ9Cd+p+PANwtkCdtXOg/KiRVHOb7XgGxugZsqZiQoTWC0hu4qbnQfcDsh2o6UP KktVVEvdxM0xILtUZULwpAUYEUcGL0LpifIMRbuDtDNYEUznx9V4qk1fQ1QMa9raotTDbBA100rF yjzi0aZOzbyJ/nK9TKjOHu02X1yiWDKPrN2xd+nWW+5cfchWpE0MNX9isCtSsnRZZMO1fSWNy3jN DSUby+oquWbjxbjm1j0Pn9z+snLNYrK9vsu/urd2cOcdJ5dNTXXccc9uwFh7xdybdC99AQT4YQHR ZXZ7hQEeEoSKCsNtMniImXoE/7RfQzXHZT9vlyuDfXbBxl/NH+Dv5DU2vMzxtJjyTqeFWk7KTnfB NMHL/wTfjVxTWnKuAC6UevlziCtSEc5oOBo+b2c+ySc3fKw9pEgDJ1bq0KWVc9Gm1jZPQXMdKsoe PfcK5wpLkw9utgU7wmOHVnRs/PbOu08Mfe7F64ZuaGjkXlgZr3ww97MjdStaKxIrOqbSj/3FVQSe TTvMr6n+Cm1Y04d6WAVL4a8LqC1ZGqzC1zgARSZaXNzReFDGXYOZ+oqIQX86boCqukAdrTsuB3iX s9nbTJtPyl63w3467vgIcy6oYR4uBKpg1MyqxT+/4VRe/6qZApIPt3IP/TAr32wwuxe1mN9dmrv4 IcbesaW1z/bfjF2zLzBUXl5hpc3Gd6e7Oi+3+ZKK3At98ofYPL5Hpbeiv/RDHfy0gHWnH8BtP1RV FXLfJhudZbTshGxzVji5MoqxU2OtoTXHZSsPshDsQ8X2X/BzJurXaEpoyUlZc5l6vq+ddge0ewu6 KV0SVzB8RhHxxv+njlJBKyprA8fCsuoDNAHmcZneBju1qgvQ6WjDiiNHRlZfO1A1eP/Ln9y7N/dM 7nnzyIb1J0ZydeuPTnTX2NoX9x7e8r3hjbXR1Cf7rnrnO1dtmnrkkVjv1iuH1rxHigMNbR2BjsTk o8zm8U0oPYP6G4I7C4jWa2srKSENNp/ZYi21WvlSaoPQ6bgNXGafocJADSflCt7rOR33QilhbvOD ASiq4nWpu/QwyEr/j23gS5Di+bjC6alIOhEVVT8XHKQ+7x3dHvpQ7vn9VlekfdH4zmXFY48TYjJq VA/5mHnjI8nMhHO0yOCSwuS9tmsa+jriRw8kc6s1NzTVV9vyvnFAc/O1V22V1+Xul5qLKyrtWtW2 r8ANSUQbxy8BXjhRQCfiJRrQWDkLBaqhFm5c3kWJjb5CORu9knJGSr2P4LbidNxtM5tOx83zFo0Y 8YO/YBp1zYbS82o8wXDCQgpiU/mnNpMierFtHgV9ATAVJC7SMNPQa9I56yLG3N+etBTZaxtNv12q jT/77LtPRcN8eaVD28h9aUnCUybwXIuR7b3WoP//Jvp/J1S+v/eyHfT7q1wHZQSBeo/L4DZV0Irj solf8Oxq1LzERnBCyPxI4ZSWbR5wZ6WqOcY6vZUjqp478krOkftOPWorFuvv+MbW3Z/tLqnK/jj3 ytj6TfcmR1NTp1L2r345Nrx1ePKzg8mT46nJe168ilTv3KqQjhu37/hq7lsslqFe78e5+OFrhZUr KXpINhoNBqeDKyb481AnPOLnqcUyO/eG7Hd6+sDIGzknNeqmdRi9ZB3v952O+21OdW+gKvk5SQ1b uIqSPRrFBV3YGNgJC2GluC946mNoNUWienUb4NGL1fmtORWLmf/FxSWfjvWar/x6ur8xssVQWVWz eVuLdezxe12O2oiJfvd3moP7Ta82tw4du74vt5p7dGOjv8JGW9DW5+bQfzoQkxD8qIDJMs9DqKyu IDwUwicM6+1lZQ3624MBk6mUQigd2hWaDmnMNLRIXkQpPS4v4m3uCjfnoG6Ho5SWHpcdlzjQ5xCV /G6cRXYsYDi3s01ofkfepEZ4Nc6jgoQ+1j5ShIGkhi23h23q1Rhf0xZ1M9eposZ8Kov4GPDvMQ2v Da8MlS+XM6vW3b8peV9feJV+7IrURLm8tGuVNHJy8qH9Ddw/rBsWe+qDHd3SspuGNh6US50vrR9L 9Uvxzlpp5Vjbmptk6UXUs/2IqVXzJJQv7EI7tT6Xj3vHRzAwFRcbXA633c0bjEa7mxpsdtwH2B2y EV2D0fUb2WEDtoUCoZxSH/WdlOklgP5kPhxdfG5B7dg+9LDqNpjC4TYANlzTGMEtwJ/dciQVLOyM 2opFfCRsi+oD+gCdDz/cl0ceWLdtyrHvuGlpIlxbnm0jHe7cs+nalmjDZGx2fHL7lq5VnD6qD3Zs 2vj7ydy+Lw11dC3vQz/KvpwCvIPf9ijYnyIcKNPEAV2qE4w2tqEDeyf6dPSNN95QZTeTZ7gYtx5l /bKVEo5Q8p+vcOQBfNGEj7Ebzkv4jMceXANtAc6XGwiQr5NnTmEfzH9B7fMVb15pi70DJgMSAL47 tDM9f0ftZ0+WJ1DOyGTVA+vpP5drBzA+fzF18XnjMOyBkrmTBS678ej/nybfwSfz/4B9mhYY1Ugw SG+AKzSNMEq/AiOaThjkJCxbYQ3thiuodW6O+w7sJ/eChrsDvx0C3Iq/P5ATnMy9TO/SLNF8Xytr H9ZFdC/rt+tv1bPvqGz8PH7D1MA+/NrMYT7Mvplyt5uXII1xCT4Rszvgt2oXwMi6vlVr41JPZsem a7dm6vv3ZLZvHQd5+JVX3R7/T/4RL5/c5/Z9cl/J3/095q+/AS87duFl+9V4uWqn23fVzgPXlu65 zunyb9mGl81b8TI55fRNTh3CTfpu9009JYG9mPDl8ZOnygPteJfd9wtiu/BTs7X9paeJoJgs7fJ3 Q43IOvvkk8XFqkjlBV9Z+7t3c1L8D0fuPvLWvXff+5Z29i1iHPeOf2+cCuMWGxN7cnlFUBVfdG9l sL3tC+TEcU7ynlxU1+45SfjjXXL7z46T87/iJPlXTk+7/H2nk3Uir5/BXj51SCtNH+CkWw4Qaf8B rfTeQU66/RCVXjpADhwKVhw5RKTDmG5DsYOYDIeMbdAjNxr5dl+by9vqcrW4HM0uW9RlbnIZG126 iIuGXdDgWiYRPTGAjWiJDqyodhrME9Q6K3QRgoli0gI+fOGKoBQuiR54TALmBbxHkBPBfATzMqZX sFYRscjbezoD1TXW2hqbrS5Sy9VJ1pBkqxStVaIN98BChQ20vJaz8Xazschk1ukNZqrR4h8OOLOO TlSUQ22FyTZg40z4gBGne+ij8M82nQlM1GRbCkuNKTpmvJ6eglPG+2w/A/MZYiU2dCs+Umbx6kst Lt5jcWicFtRhK4QxdWG6k1jlak0oVherjVXHqmKVMSFWHvPFvDFXzBGzxYwxXYzGIDYUHSWKYwAG RruVYoL3Nd1KVBqYpcKI0iQNKMahseQMIZ9OIVXhjuDb21FFcwTfT43id8F1Y8lZUsLYh/D1GWKh DKQP3ZGSpDJlgn0EmS5LKU0sc1dZCr/rNA0rPrFbuvzYrRJ277muwMiXpd1KXUIJJTJKbSKtVItx 5O7ec1ldki9fQoY9EpYYYU9BOt+c4lW6cG6X1ZdmjGySQyPd+NJ8/YAygZ+uyofG0kqp2I3fYbHU OjSGnzS6Af4LSFOHrQ0KZW5kc3RyZWFtDWVuZG9iag0zNiAwIG9iag08PC9TdGVtViAwL0ZvbnRO YW1lL1JaSE5VRCtDYW1icmlhLUl0YWxpYy9Gb250RmlsZTIgMzUgMCBSL0ZsYWdzIDY4L01heFdp ZHRoIDEyMjIvRGVzY2VudCAtMjIyL0ZvbnRCQm94Wy0zMzIgLTIyMCAxMTY0IDk1MF0vQXNjZW50 IDk1MC9DYXBIZWlnaHQgNjcxL1hIZWlnaHQgNDcxL1R5cGUvRm9udERlc2NyaXB0b3IvSXRhbGlj QW5nbGUgLTEyLjQ+Pg1lbmRvYmoNMzcgMCBvYmoNWzE5OSA0MzMgNTA3IDMxOSA1MzAgNTI2IDI3 MSA0MDcgNjIyIDM0NSA0NTcgMzgyIDIyMCA1MjEgNTI0XQ1lbmRvYmoNMzggMCBvYmoNPDwvTGVu Z3RoIDMxNS9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0cmVhbQ0KeAFdkctqwzAQRff+Ci3TRbDsvMEY QkrAiz6o2w+QpXEQ1LKQlYX/vneUNIUuzuLoaobRKD81z42zUeTvYdQtRdFbZwJN4zVoEh1drMuK Uhir493SmR6Uz3IUt/MUaWhcP4qqyoTIP1AyxTCLxdGMHT3x2VswFKy7iMXXqU0n7dX7bxrIRSGz uhaGerR7Uf5VDSTyVLpsDHIb5yWq/m58zp4EJkJFcRtJj4YmrzQF5S6UVVLW1flcZ+TMv6jY3Cq6 /n61LOqKkbKkOqvKEgqk3K5YV1AA7VnXUCClMqwbKEC6Z91CAbRg3UEB9MC6hwIpdyXrAQqkXKfO CgqQrjntoAC1G1YNBUjTVAYKMIbklKAAl1PnHgqgaIUV/L6Vt8G/9tiyvoaABaevTbvnnVpHj9/3 o+cGiR9hHZ56DQplbmRzdHJlYW0NZW5kb2JqDTM5IDAgb2JqDTw8L0xlbmd0aCA5MDcxL0ZpbHRl ci9GbGF0ZURlY29kZS9MZW5ndGgxIDE0NjQwPj5zdHJlYW0NCngBrXsJfFTV3eg5997Ztzv7JLNk JneWJDPJJJmELITkMpmEhAAmIWCGsEzIAAERQcCqFIgQBCKtisXG5bPaBVrrZ29aq9hXLVqKtk/e z1br0laLrf26WL/SzY+qTN7/nFkIiFvfm5lz7rln/+///7l3EEYIadAYYlH1yNXDm7EPXwU134c0 MHLdNu+Cv/WcQQjzCDGdazevu/r5V9K1CLGDCGnnrtt4w9rpr7/9FYQM9yJUum10zXD67N2BuxGq hf5o1ihUGNoUz8J9F9z7R6/edv3+R1TDcL8R7sc2XjMyfNsvDmyA+z/Dffzq4es3c3GmHaFYNdx7 Nw1fvWb7ilf+C+574T6w+do1m1/oPQB9Y9cjJHsM6jB8yUeL5Iis4UMlAAmDFFAvQyqATI100KZE HNIjFzIiB+KRBdlRMSqCvlrkRgZkQ05kQh5kRWbZBPRDsiXQK0xzxNVCOfdhz2TL02en/wOh6bOk muSZ/mw53y97le9EPDtn+iwDo6bvhx7Gi9svf6eEapI40rwTvY6eJQX0BaDRKFwn0S1oDkqhLbT2 w7J/fljDh9fjVjwLV2I/+go6iKuBDxzoEOkN9bW4DD1cGLkLbUfPo/vQveh2tBWNAgH+hs6gPdC+ Gm0q9CL7i8MXoWUUHNqA9bgK/QN4qb/Q70LhRfQcrGaC9ufRSnQ9WoTuRLvQr9BvoEsK/QnWKHxw hBRpPgH7uB9uPgfpUUhkF/ejm2mdhNKwOkIPomvRfNpWyORPIiWzDehzE9DlDHoJGrajJag13wE3 4wrsQV8HvL+JXkR3Mhz6FX4XnYA1zmI91DwKEJ/Br6NlrBx2eSc6i66Dff8q80rmNcILYjK9auWK 5UPLkoNLBvoXLuiZ3901rzPRHp8rtrXOaZnd3NTYMKu+LlZbUx2tqoyEK8rLQsGAXyj1eUs8bpez uMhht1ktZpORN+h1Wo1apVTIZRzLYBTBDsnRPtixQSpqT0laISHwXkm76OzCqIRMTp9g9Maiycpc L0kWlpC5R7L0Dk4hsTEpycOXdlkksQH+bz4YvNDp7ZC4APyE+cNpqax/0CfwLzkL7UmYVipuH/T5 nBITgF83NMFv/rA3LfG9UA8NtKZbQr2DJB2f/k0jVKJGXxLy/kHJk79NktmyoMzY5OMgUCcu2eYi PMFPaYvaExKyTCHtbyRkJd3ONiIJtUhlYdgIDyU6G4pK2PI3CZslbF0IIF28BBl2pvEyOOhIbxA6 0usBo+nUBZyezWLU553wTvQPGmNOn49uukd6tm9wSqNuF9rXqAEKRCvQlFoDNRpSAWTZPIW1rZgW GG1H8xSDlDpAn4lst4OkDZJ4SwoKQgLwBi3mCy3Hp08cmtmEYFi2E4JutITpmpK8XVJkN+FdL4nD ErrFOxU5MXHoOI9Wp8LatJAeXj4oscOwqSnEBjpGByRXT+8yqIJNQEqNegm5EzQjxPN2jHon4J70 TUEuJGDoxfXp0TUpwiY4JSSgTdU+uN93wimZ4NohGcOSDobrbnzTyU50ONZ7ye3ExH6vdH/f4MxW H+kDTOCojHgnOgRYDSbr2BAnFIsWyEa5sTtNiSPeMuyVxlZvAJzBb/hQnv99E7ykfccH1AH6wEgi HQTBJKVTGwgoG2AkBxfvxC1rKKiHKGjAr96ODQmSyEDgfrQERi8b7BgVOgCfuQUBITCeDVw61ueT isJk4MREB9nicBp2TzADv6Iw3Ub2BmTCGcawn3ZJHKAXNEBpACuKw4lkrirXAVo4oIMkphLJJAEq SwBJEdgvqxK8E2R6RUCyhHnfSWg7URnp6R/sSBDuhJ5M++Cctx3Ot6Hc01uoxg7oMxF9myCJtCwW evqyXDBK8EOy1EBWgAFrOcpD11x/Outph/N0doXlg51CZ2piolPwdk6kJoaPT4+tFry8MDGl1U5s 7kh5qfhjqP/eLU6p81BS4lOjuJlSiCwPwLGBzv4eydw3REjV6R0dhhr4tQm+RqfPWOgDWuTyzTmZ A+4HGSAyN8H/GaDXgnZyejuJqjkOGsIp8Y1EZGFDSwZBJkZgiY40zUBWFsPkTiI1bDLQsX5xDllO HyxJmYfowL5cLUzi8xF5uuW4iFbDjTTWN5i996LVzm8jMRoGOqZIy4l8i3UJaRnLtxSGpwSgm6MH 1qf88WH8Dbq9wNsTRsHkbSKKHXYHv+60dGIAYDzXKCkBY5T05vZB1smQLlBinCwpqcNgHloke5gO JDgBjTnBC97nBYkPS7L2wRPOlqSXN4KyxNCnCzoSTuWfF36MiR5FFl7CLRK2kXoEehWwB3rf3giN BUbydkykcgw4EyzoSnqnRwuilN08yC6BDaDnBRBdZxYNRpNAIHyOMHzeMAQ6iVwBSSii5iclPbF3 kv7PNIP9OtsHvaCJQHL7aMHb4R0lxJa8qQRVCUknac9XH58+k0oQFTgIPAhdnDkWB0bPovZiVqyM fFJGHwNGv+lQcrQZ9iRWAATeeliWIL19YDAnbpROVAhgrW4CysXtBSzm+4BiA3H2SdXFP3YAoxY7 qFRnZbfQGYgwANAUCDBzMdqWZw+yE6kT7H9WB9CdSfPoPYWdNHdd0tydbwb1sdN5I/QDQxafEvCB vikRH1i8bPBx8I69BwYGv81gpj0VT075oW3wcS/4QLSWIbWkknTxkhvUg2G2bzNK2t/5uAixAG3l aAW9HzmOEa3LdoI6jEaOM9k6Pt+PgTouWyfSOrAnsMUOxyiot0EBiJ6WxN7BzyZHJ1JJgmxkyzIg cLbQiiRGaJ3CjFwrqYU1cUkjxEl9G6lvy9bLSb1CiAP7g3B4j4OoT6QEEH9QwIPIiZOEhQmXMwHv 8elp0KCnQfP6JHlgOSRQsKpw0ivJAvOh3zySUlA9TxobGSb7IGwKYxWB7pGkpCxMCF26JRXMoMrN AD066Rgwz2TQCDDrsECLUA3CMZaUkmGy6OB6siOvF/yhLqFZkgezm5QFyULR5IRJqKXmRB6Q1IH9 MALWmE8VIa1xwi0sRuwR/BRa2PmIAL1GUl6gAIdGFgMzckHyUxO6Qc0asOpcEIwqJDUIMm1EBCw2 oNGpJVUVTAg/UtZUwYTwUyQBKQR4erc/1wHW5iUN7Cg4A5W5AYAdaOome4Hfftg86foUmabvOOoX rpcwxShdSgHNki7QPQzOQna8BmoE8Puyg2EuZYBUkTlOZmsVBHItdWgHjk8fE24gQpL/VEYECQ0M EsZETvAhRZScuLRCGgLFqby0VkerJyaUussPyOJLqStcySzejvWJSlgK0PskZDfLBlAZiqBqVIeG RbPFoi+Vy/UoEg5X6x2O6joxCnIhOqtRjI8xMbemDKGKsNlSawlr2Fhl5azqWPS0qSlqsjedjsK3 iWQouuJ08WvFpP60sSn62v8xNhljcFNTjevrWpmGVra+LiiU6hmFUD9rVqzWw1gtcKNnrVa7VajH Rp+RJKZBbqvw24NOw9xWb7W/SJVqOdjeOdLqMvhbIt6gVWG6Db9/Xs4Ov9+If2+zBSrqQ0XRWJPQ 02/x13r2eKrcsc7yYOuczkpfJFTmkm964IHMm9zd763l/ufdhwBs+DDT5yAeL5Uth/jch74BYtm+ ZFCMeREo9xIs88l4A3hxNpsgU/lUhhLMlhwWEcZOFmOVgVVYHazarlKpjyZUyBENG1HMaI852gBU CM+KF74dNppQUzV4nLWAhhggIcbvP3GCpBqnWPLvz5jEPoVcbrXYrb56wCeE0x6GlGdB0BcMBXws G8os8elNo5klgcaqYvwA1uD5Nk91+PwrdbV6PpPCo/fjY6vKeipWK+JxLrJgHnfle/f3tIVU8bi8 qqJkQfPLTIzgB6N102e5ubI1gJ8TWezQ4Eis11u7AH29TIphVSzjcslY2WHRxRl5aDAaDFjPGiwW Das5bDEz2CDyvFe50wGYWPgGYKf49IunUdvbYeTgTwKmmsJtBFmFu5pqIgfTZ8XIJ15FtJiR4+JZ Lr6rqU5ioxAEtmOMvClWO2tWQ8wolwulfqa+zuSP1dq4uQccowP3ffkLt3Yvb7Ac3PTo6ucz/9p5 B/Y8s+arslmZ17dclflp5qXMW5nf1qxOZn5a7LgTR//wKp77sA0QAWcISNYCZzouVIl25fjI56pk Kw+7RJfzaMLFGtys+7BBNPBHEwb5zlAo6t5lzSPkDRQNo2IHT7HQli8CHsSiD52DcNzlxiRxrYe1 WuTAIQq5AAzC1hvrqphQPbbFahtmkS9wCSBCwYweO/PwVXXd3XOf2LHhgUxzIGyVy6zhIH7A1L2p pzE01+df+/hNrU7ZkrrN95y+6d5zg1estZriant5WzW7MiqWFanj7/lZr6OiY9P1//nke59hsjwD uOBCgIsw1uQw0Y8EcAoFSeAEjyFYEowGfxDkVGwwGPaEWc9hMRx2K5Gj15FybHZAvcNqJciyilbL 0YSVlauUqqMJpRAMBJBDtNsrPWiXnqKuljITZKdrAYMgf44C8nLcZCQ9ssx1ikglf2oFQWvi/8eG cjL/ydZMBiwelgpsnh4+o1DFCIIxx4z0hsFy3l4unP+vPC3YZw76qsSFT41FYz7Nli3a0tqqsffq G0qtRlk8rnKUi9XsiiwlMk+vag9lWHeiNbOgrcMFsgt0YK6mPLkkRwer3XIRSgGPeo/baMJNRDIL KAREEiQZLu2d1XEAL+1wGYisoMMZzGntZe7zf8+DwOjKQxble0JLsNgM6ibLPquqW8sd6nhcU+Rv bszulYvCXt1oPLdXAbvcrqMJN4t0WMfqeF7BKg7zIm88muB1e/T6EsUu22Xlh+qU3B6dovMjprlI hGYOS2ICCVAGtGuMnSFDzNX+Crvi6ebOWEBz0Pb+vDyMsiUAV1lb9fsuf88N9ZmNcbWDCEmONADf CtAPLoCvGn0+B1+5RhsMcVZfFHurfT7v0YSPVVrNNqsNWD6kLC/VGhQ3lZfXGm5yFqAEAwK/LJmM hNeJxYE6sL6EXs6PmDFvny4dlYNUwMGQYLMaLTZbgUeDwVC9D0NFLGispxpE5irz2bWZTOtQWKU2 hGZlbibw68rr8RG82rehnNeorUI54EJn8sxpe+8oq75v2ct/yTzZ0yLogfCO8tYoO9zTFNTHz9/V fGrwL9j5vbnNHouWHOSCDt0wfVYWBFujBy4YymHJgUysCYyuWeFknYdFBafeabeXGHayBaSgtmJi O6i6J1jgLx1RMAy5LkmZFxmJzoeLhZHLMbEHrWAGGGIdmMcyv8i8eiu2ncBhHEl+9XeZ9O1HFm5s d7ftHrn9czwexFe+gduOZr6RefiJzF8f7md+kvlZ5tXFR5678RmsO5h5K2sLuPuA1h5Ugb6QgyPk 8rJesJAui8JSwVYctoDFOpqwsDKlQnk0oXDs8vsjJWiXrqDWLkhjTskTX8JBdRmB0vPR831ANc0c TQSX+gsF0+CrheNgYg1D9UQb5e0DVkNkf0EXMR3n37/uzNeHW5emr2tq2rS0M/huvMFnU+ZlOmcS vvv9fSfXcFuaPrt+dEcdk7ONiwAfNfBs4Sc5fDQ4iyOxWISNAW0j4FBFInqsr2VrD+tFve5oQs/W lDJ+jJmjCewsrmzaZfMLbbHKXYosfvif174IjkRTXhRm6P0soDP8LyoaFZ98uYKkfMykcHh2wbYC Au3EjQWbawWJsVMxCoZCVMEToWKpMqF+L3P1DN0477qvtdZ1hTq2r54/HGqrWNyU2d3cvUiorW9o 1pfN2jjSOzrHPrZr6cVG11fqWrKlZ/WhFeVq71X9B4aG1PHe+765QHQQUfPruXvPvxheONp64ACR K4wGps+yL4Bc1aDXsth/RBMIVNrhuEZsAQ/Ljop6i1JF4McVWSzE7ooWrpr4cdWGGvDjaiorWZY9 XGkucjjKfWM8X10+plDEkEgcW+rkU5/uDXBxP8qpM4H7C4x7YWni3H2ypcXKj3HusnMnzTbwcLLc G6qCGIPEFjY7tbIQ1FgJGbI0EkqDIeNrRdu3zF7ZVLV2aNGuZM2Nv59Mfnn0oHn2YHvTsrrKDWt2 fK792l/cuva1Ydz3me1lyfbWof6q0MCa63t2PJQ0OzKvX7EiUnZFY/OSvjpxx+2pHd8dtttwXRbf oM64XwK/l6LP5bg9aELA3qzeIBYrDMSOiQbWB48XjyaQyejUiXrnLrncL+QN8UvFp/mXIIzKejQ0 kEAxcA9PA1vDMx2nWPzh8xUk/wPDkll+zQZeEF8JVTLwPqhXgndU1DjkfS1itFRzkLvroNnm9JTG yruoMxJX2CvmVrO/c7WsqcSrMg8kxEqPSfW+M+eFEJgZ1AJxAs+ehVgyht7JQb1QU86W3yeKml4N s1mDNRrOYC2x7rayatbqdPIsPyk6+bLgsUQZwjE2iqJ8lLFwXJSN3snZENaUcd7xWKxeaRGtkX1K KvkvFp8mHt0b9hiNHwAfJOICR/gi5x96rNhC4Ce4mvPv70KEbeQm/viVkoEQ0aDBYH2dP5DVoKAN BNARwIXEtFL3j6WMSNmU+Zqh/54rl+6eC/FbsCJeVdU+S/fE8hs/szJ6w+1dcp3FXZY55LjnSKKl qr96r6y3q21z9x3fsK1asabcm7zi0fKIWyvetjtzY7xLsOrUcfwKt3G0dW5NfxWlRxXQY0g2CU+i ywpcGFLIjyUUKqzWlLF+g5/1H4FoxOZhHZ5J0WYrNu31+SrUzvHimTYIjGtTHrtGRKLbH1Gsej56 LuBCYm0vMzRprqtiQ/UBCJVbGcBMzu4oQthCpJdqSMDRlxg1RPTYvgO3LFvb/O1vr39+8r6988ew b0ly+fDSocjSRq6ta0Gj16KK68//EDe0CO+9+59/3N7UZMKdO7Y/9Z0fPV21JAa6bwh0338AX3rQ dTmu9PCaMY2ZNU+KGh5xnIt1HeFsvGiAuN7r2Js1MMBAMRDCfIyaDSVBAJ8jDGX94AQzGAVC2pnd k9hOuSKvjaw0BtWDqaDKiu1duPqxja++ufNPX+x7IH7K0NIYaI95Iqt7m9eBz5haPP33r/5lh93y 15VLA0N3bd/+wJW1IGsEpn8BTEXIi36Ug6rZa2a9k+JmMzaYS8xXmFeZORtrNqtZNWj0SVHNoyKs YYtY1sbajoisrQiZxouLS73mcXmB3H89VZtzprK+MNUg1OsA7qfnGQT86KdcKS9B2Vif4qZgo3OT JgMzcWSzk6+P4qcBYkShVK5gf7322T1/fOuG1+8YOrjaGzRb8Pmb8e49C26c9wTX1btwSPXoxmXT 7335rRsqeurb+hZf991vNnXhnrvuvPcO4AF47s4GZfeiAPpmDlu1ZlGl7TIbxgyAjknRgD2KYwmZ Z57oNAjQ7Vgi4HaXmEVTibNEri0Z57hQMK+bY6eMMR54A1hkhoKuzcsIcdZOUwnxfewaM1X1ByZI NoBLaiTqo4HYMTgYo5iQW60xK2ht6mAMRAP8jdGAQ8/yb728tP2AsdwXrjI+9RRfXpfRx/WlcxYw ox0Ko7vK/8jj+uca6prWr1qw8/xkT6sfXG4W+TMi5wY+Al2KrsDlOdwkRe+ikFoZVTawDZMiq1RG eYxqa6H/PLHWEJ3DzpkUozy/iDUsKlkUXcTa2UWi3tS1SOQdnWznpMPVbZG1u7WC6BYqMFPLViDZ vubmvrrxCspogLe/noKAhT95spg/Dd/8URD4EmHgswIis4qXsApofEe0Kc+N5BiN8OHc/7d9ig5X gTM/3dJJHFKAQrcQd5l6FbGCGquCKGJWAzEBcL5ELlTF2X0zdVvBAlAbIZRy7m9yrsALp0faaota Gs4dO3rDb+7ZcnzPvK65FcHQ3LpFve3bv7Q8tiiA159fMW9BR/e87vnz/P7Azv279jo6xYe62WVm jWs48fAjpso6j9e45+BVd/dZ6pfPa0qVehY1RfvbyyK3plbsGwip5Zkf7Npx7fYdN219/0FXPNzV MbCgtNqbtd/dYMTnyK4BKjvRYzlOaGIZlh0RDcwVDDMNp3jMD5hfQ4FTIYZnGJ5ljA8aDPpjCYOh iHNyxxJObGJM40ql25UXlpP8ybyQAF35hb8jRzArV2y5FkI2QsPqT7tCQWQuMx2Esr56lkgNDVbB wlg8HESz+KeZ/95QE9CpisKl2LyTlWtMpa6MQ3bNP//57gu6iq5V+Kc1LX6zIqE839Q4x1dsMylI QIpRM+CkGmyoHfXlMGK1Wo4lrMiOOYUcNIYcjet0RY48tHlQ2yhshkv75k9PSHMSOCIbaXNku9Qg 4ue0gVjG5ik16zlWZQ1WYOtO7FvVFdbF4wpzUahDZLVL+xp8FmUc3iKD/QHN5GdAfpPo5dz+RKVf Q+06mDacYEVOZMUjIscnH7zyyqXHElca7MU1dd2yBbGinp4FxxI9xnGPMjLe6Gls9AwlUcd4b9YW wLFaUzTKv1HL56LQ7Ll2Fuck3M56AlQis0dF0U+5cI6OHzMvGE/qw9voBXz3nBMFh96UyODKcqQu G8zSOg6shfzCOcYFZsA/0Q4dXjB/dcK65khf7/pECau1Bp0ZT2WpTlsaDRZHKr1mhYwXAhl/laCV aa3OgCvQ16DxV2Z81QGdzByqxqZd7CC7pDPYPXvlgorB8eWZOyILq9wWONTSVMxfhbXLtogu3lda UTc7871EV8RNzrcqulNYGx9qrCjWV/VHMztX9oQ18Thlu3vmw/NRdUKZoyV3BGjZhO7K0TJsZ5rY 4qLiYwlcZA09GAj4wSwZyoz6SggkjoiVfGxcLp/tKQuZxz2UbEY4CALXmJpwOBii4SuRubYYpReR N+/HzZlTiZcdTgPej0aygvp0eUJxRzLOKr9OrrO7/K5gf6M2EM24L+DSoG1dua6pH45WKCnimnD3 KqyZN9QcKtJGF0czu1fN/wCqbmMb2gLRZXuWZg5nUU9iD/CHuBjgzgBe3oVzI+riIZsKzo0mRRWv 3etwePm9XN4IZfGUg5fghkeXjCiYB+qzgMzKqHNf8FqpUifnRsRDkTOz7/j59fPHH7vqb+/c+JvM I6tS9fPCplUrEv1Bft1vv3XzybE50+88/Na1jOHFF2atvTX58s+XPkTjpkw/tw72LkB0/kSO8nVE u7CKY6LcaX3QbIYDsGOi2VBtryyG5wlHxGLeF2JDk6LP5t5bURGz2vwsGtdQuOzkQPwiyLKUJJJK 9W9WeKn9LPukq1yMhw+bMCnLazTKIlSjKbLim3PxwWmZ4eDj56iXAh4Mq7GEgti6w6BdeuQK6umv GyFe/pXLK5fM+g51Vqgvw141r6XCaVEmlLezi7upu1+MW4mz/8yJqiX1xI5RncgSOQqiH+aw2WjE GqTklYyKVXIiozFpSjWskePg4RRRjcEH/X7hWMJvsBU5io4lHEpRoSgLgnfsLuhCcA/yqv0CFhFY slxInnNIqj7dQpeYMnqKecmcOf0HRxjE9yMn0hfhGJ7pBGL4f+u67142p/27xoYqW32lWa6vqM2Y L0gZ28cuXaDL/Lm51VkTq6vLPLVqQRge812sgDDqg5hiGeAtmrcljyNh+g+PqfgutSCYhePTfxBr sjes3SyaIWqaNPMoCjFFNCJG4IBoMmJz2O2hkn0GQ1Von1xeg8QqwODlDohyaGsjTEnK5PgmTJ4R E7v5wXV9H72uGCkE6R81ce50iDhdMw6HrOSpS+mFsyE93IXqX3aMXtmzUOhb3TDcVTH61Ge7D10z bm+IV8UXubrWrbyutWXjF4e+9hOsHxpKzC1vrg87mruXNSwb79Ra/ih2OltmBWfFwqEl18zv274g EP0L5csA4JfhfgHPBydzfBkxqyAaN8OzUi1rMM8TeYNL1PJdLpeDhS+J0UwmeD3KoldacjHaKTjs 509C3EF5xcGfitIHp+RUKIs70fexcxaE+QOj80FYNuaIWX1WH2E3clTRwDKDt/UeuWPnHAgzZX/B 7sxvrbUBV6TGeX3PnAe+wkQ71GXtG/ve3ZmZs2VjTF3syMqiCHp5At5qr0S35mAOGStNCFUeSyAD q4y6HizWuD2swgfK7ghRZy7LuEYTZcYDBSUNTzsK/kZ04e/AwOUeehCN7f7I2XKQUlflkqFJM4Dm gdMHOCzMOov03m6VCQ35Qxyo50Ii3qctrQkG+pvkRn85vllmKotmzt6g0q44PH/D7kZwJc0+F3vm /M9TG9vcVYujeE/3vDKnNn4+saCzwqluV93GLk1ccdcNeFNjC7xHYFJQXjBPv8N1AF48aF0OLx6s N7JuQzGnsco8HvexhMegcDjsCoVbY/RyRBPF+FPwEgF9+hMjKLAT14kgwXK5oaBbZvYCz5gcO9nN 5uwbAvU+eLylwAImj4UZeTRSfNuXLJbqCN7nFkoiwcyzT2TOOUvLPeyZuMrvr16Y6cG7q7uFigZF vF1VXLF44PxC5l9XzC6RZ/3kdaB4t8G79yzSf5eVGPwtBmxQ9G143YO8ybEt83dclfkZtBP9TGwe EgKv1qwytPwTacD3gc+Pejel8tfpcxlRfgaidQz/sIC+9APjFHdnmuDPJOr3z2XS6gfpTLlGevHK EuhJ/EN4ytYwfY67E62TfQWluPUoxTwH11GUgthmhew2tIH7I5R7oM6JBmRuFOe6UAv3v1AVewIN cW1oiLkXtXLlyM+Mo27mM6hZUYK6uRchfR7an0Et7BTqZh9CfcyfUQDuRRhjxr9EgAN4Z38PNuGj TIQ5y3ayj3Jd3EOyOtk/5A8pgor/Vl6r/JVqmxpp5JrbNGe0p3Rp3dP6DQa54VG+mv++0W+EaINC 5UUH4N2cFPzDhEGgYdEaOL24H5cDdgn2MPyXhFzB9UdmhPrnL124YGG4ffjq1deuH66MX7MxDU2P Iy/2PKJy4Pne49idL7jyBXu+YMsXTPmCMV8w5Au6fEGdL6jyBWW+IM8XZPkCJ07T5d+j+bs0/xPN 36T5b2n+Bs1fp/krNH+B5qdp/hzNf0zzZ2l+iuYnaf40zU/Q/AmaT9H8WzQ/RPNbaD5B84M0v5nm +2g+TvO9NN9D85toPkbz3TTfRfOdNO+jeS/Nu2neRfJfn7HZXS/+HLIdn7U5d3y26Kc/g/J1Yuoz cLl6M2Qbr4Hsqk0251Wbdl9bvG27xepatwGyteshWzNqca4Z3beluGir7cb2It8NkBTP2J9hfv8H HN72HWx/EodeSj25+cmxJ7m77mbC4t141R349sNMmDy/4d9yuptUI46RZ0ZY74jO0EQqI/NKAk38 g2t2Nd03KZQ4vhisaPriJA53TeI7jzBh/kib2PTqEayRnNK4xM7VYQWWAdOEsTx35XJXmdg9gcK3 QDoIaWKfPHzTbhzeuUsW3jVeWnJgHw7vhzS+TxbeC8nZYHXMslrrraY6qyFm1dZaVTVWebWVjVpR lfU49opj7a2+YEhfFjIYKnDZuenwuX8Z3vkf/T/+qa9+p/occ/YcrgjrI2FDqaD3CwZPid5bYjDw Rq1KrdHKFUoty8m0CDNaOZsu0Rh6DIwGzUYJdq1qG7tf9U10VPVLg0qDwK8zzEazVUl2SHUdu81w D7pHdZfhcdUvkP5xOGkvFU0GJ3brHIpinZW360ycRVcyV499RKwg5yFFIbVB+hKkH2CfGJRHWipa ylqCLf6W0hZvi6fF2eJosbaYWgwtqhZ5C9uCWnpjA1gy9aCegbhkxnBdHJdi4Z7jrLdfqg33SKre ocEpjD+fhFqJOQBvoA5I3AF4uW4A/tuwbGjwOC4izfvAAcIYST2pfZ9LwmsxUpq8yD3mTkq1pHCb Ownvptf2SU4hHr70s3Ubrdm6bfvMlq3SPzqkcx3rh6Vz8NeJd+CfB+c6UtI7QmIr6bVVquiQIh3D UhlUBoXEzJFhfNFdeCuCBbJrkMvWreGt27aSkuSQ2gDei3uHw1MqAnhvfxxeBl7eI6XhlXxn71BK Khbi8P8SuJvVOwSvasenELw8PAWv8g5MySEbGhqc64a/R6WxG5ILkh2SDZIJkhGSAZIOkhqSCpIS khySDBInLky/l343/af0m+nfpt9Iv55+Jf1C+nT6ufSP08+mT6VPpp9On0g/kZ5Kfyt9KH1LeiJ9 MH1zel96PL03vSd9U3osvTu9K70z3ZfuTXenu9KXAvWJ7oFy/8YH/V8sFiaZDQplbmRzdHJlYW0N ZW5kb2JqDTQwIDAgb2JqDTw8L1N0ZW1WIDAvRm9udE5hbWUvUkpWTUxNK0NhbWJyaWEtQm9sZC9G b250RmlsZTIgMzkgMCBSL0ZsYWdzIDQvTWF4V2lkdGggMTM4MC9EZXNjZW50IC0yMjIvRm9udEJC b3hbLTM3OSAtMjE5IDEzMzMgOTUwXS9Bc2NlbnQgOTUwL0NhcEhlaWdodCA2NzEvWEhlaWdodCA0 ODgvVHlwZS9Gb250RGVzY3JpcHRvci9JdGFsaWNBbmdsZSAwPj4NZW5kb2JqDTQxIDAgb2JqDVs1 NzMgNjUyIDU1MSAyMjAgNTUxIDY5NSA2NjIgNjE0IDYzOSAzNTAgNjc5IDcwNSA1MzUgMzY1IDUz MSA1NjkgNDY5IDMxNCA2MDQgNDYxIDU5NyAyMzIgNTEzIDU5NyA1OTEgODkwIDQ1OSAzMjYgNTMx IDMwOCA1MjBdDWVuZG9iag00MiAwIG9iag08PC9MZW5ndGggNDE0L0ZpbHRlci9GbGF0ZURlY29k ZT4+c3RyZWFtDQp4AV2SQW7bMBBF9zoFl+kiEC3acgIIAoIEAbxIW9TJAWRxZAioKYGWF75930zd FMjiLZ6GQ/KLUz7vXnZpXFz5M0/9XhY3jClmOU+X3Is7yHFMxapyceyXm9m3/tTNRUnz/npe5LRL w+SapnCu/EXLeclXd/cUp4N8028/cpQ8pqO7+3je25f9ZZ5/y0nS4nzRti7KwHZv3fy9O4krrfV+ F6mPy/Werv8r3q+zOG5Ex+rvlfopynnuesldOkrReN82r69tISl+KYVbx2G4La1WbaN4vw5t0VQV CuhKNaCA9qprFLzvvOoGBaq1ao0COqhuUfB+U6k+oIBa7yMK6FqrHQr0PqoeUEBFtUcBtcURBe9r u6Sg4P3WqgMKVDf0Bv6FguqtAlkVVPMGsiqonhvIqqB6biCrws4aIZBVQTVCIKviPaejZFVIZDuT NVjerV2DrMHy1rYVWYPlraP2klVhZ+sla7C8tf7YQFaFqilZg+Wt9VECWRXuvLUn//e2+vo6pZ9T 1V9yZqBslG3WdIbGJJ/TPk+zzozxB3Px0j4NCmVuZHN0cmVhbQ1lbmRvYmoNMSAwIG9iag08PC9D b3VudCAxL1R5cGUvUGFnZXMvS2lkc1s2IDAgUl0+Pg1lbmRvYmoNMiAwIG9iag08PC9TdWJ0eXBl L1hNTC9MZW5ndGggMzc5Ni9UeXBlL01ldGFkYXRhPj5zdHJlYW0NCjw/eHBhY2tldCBiZWdpbj0i 77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkIj8+Cjx4OnhtcG1ldGEgeG1sbnM6eD0i YWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFkb2JlIFhNUCBDb3JlIDQuMC1jMzE2IDQ0LjI1Mzky MSwgU3VuIE9jdCAwMSAyMDA2IDE3OjE0OjM5Ij4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRw Oi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNj cmlwdGlvbiByZGY6YWJvdXQ9IiIKICAgICAgICAgICAgeG1sbnM6eGFwPSJodHRwOi8vbnMuYWRv YmUuY29tL3hhcC8xLjAvIj4KICAgICAgICAgPHhhcDpDcmVhdGVEYXRlPjIwMDgtMTEtMjRUMTQ6 NDQ6NDhaPC94YXA6Q3JlYXRlRGF0ZT4KICAgICAgICAgPHhhcDpDcmVhdG9yVG9vbD5NaWNyb3Nv ZnQgV29yZDwveGFwOkNyZWF0b3JUb29sPgogICAgICAgICA8eGFwOk1vZGlmeURhdGU+MjAwOC0x Mi0wMVQxMDo1MDo0Mi0wNTowMDwveGFwOk1vZGlmeURhdGU+CiAgICAgICAgIDx4YXA6TWV0YWRh dGFEYXRlPjIwMDgtMTItMDFUMTA6NTA6NDItMDU6MDA8L3hhcDpNZXRhZGF0YURhdGU+CiAgICAg IDwvcmRmOkRlc2NyaXB0aW9uPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgog ICAgICAgICAgICB4bWxuczpkYz0iaHR0cDovL3B1cmwub3JnL2RjL2VsZW1lbnRzLzEuMS8iPgog ICAgICAgICA8ZGM6Zm9ybWF0PmFwcGxpY2F0aW9uL3BkZjwvZGM6Zm9ybWF0PgogICAgICAgICA8 ZGM6ZGVzY3JpcHRpb24+CiAgICAgICAgICAgIDxyZGY6QWx0PgogICAgICAgICAgICAgICA8cmRm OmxpIHhtbDpsYW5nPSJ4LWRlZmF1bHQiLz4KICAgICAgICAgICAgPC9yZGY6QWx0PgogICAgICAg ICA8L2RjOmRlc2NyaXB0aW9uPgogICAgICAgICA8ZGM6Y3JlYXRvcj4KICAgICAgICAgICAgPHJk ZjpTZXE+CiAgICAgICAgICAgICAgIDxyZGY6bGk+TWF0dCBCaXNob3A8L3JkZjpsaT4KICAgICAg ICAgICAgPC9yZGY6U2VxPgogICAgICAgICA8L2RjOmNyZWF0b3I+CiAgICAgICAgIDxkYzp0aXRs ZT4KICAgICAgICAgICAgPHJkZjpBbHQ+CiAgICAgICAgICAgICAgIDxyZGY6bGkgeG1sOmxhbmc9 IngtZGVmYXVsdCI+Y2ZwPC9yZGY6bGk+CiAgICAgICAgICAgIDwvcmRmOkFsdD4KICAgICAgICAg PC9kYzp0aXRsZT4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgICAgIDxyZGY6RGVzY3JpcHRp b24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOnBkZj0iaHR0cDovL25zLmFkb2JlLmNv bS9wZGYvMS4zLyI+CiAgICAgICAgIDxwZGY6S2V5d29yZHMvPgogICAgICAgICA8cGRmOlByb2R1 Y2VyPk1hYyBPUyBYIDEwLjUuNSBRdWFydHogUERGQ29udGV4dDwvcGRmOlByb2R1Y2VyPgogICAg ICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIK ICAgICAgICAgICAgeG1sbnM6eGFwTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8i PgogICAgICAgICA8eGFwTU06RG9jdW1lbnRJRD51dWlkOmI4MjE5ZTdjLWQ4OGYtNDFkNi05NTYx LTEzZjBhYzIyMjBhYTwveGFwTU06RG9jdW1lbnRJRD4KICAgICAgICAgPHhhcE1NOkluc3RhbmNl SUQ+dXVpZDo4MWIzYzg3Yi05NDJlLTQxMTMtOTYwNy0wNjBhM2U0OGRjODc8L3hhcE1NOkluc3Rh bmNlSUQ+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRh PgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgCjw/ eHBhY2tldCBlbmQ9InciPz4NCmVuZHN0cmVhbQ1lbmRvYmoNMyAwIG9iag08PC9DcmVhdGlvbkRh dGUoRDoyMDA4MTEyNDE0NDQ0OFopL1N1YmplY3QoKS9BdXRob3IoTWF0dCBCaXNob3ApL0NyZWF0 b3IoTWljcm9zb2Z0IFdvcmQpL0FBUEw6S2V5d29yZHNbKCldL0tleXdvcmRzKCkvUHJvZHVjZXIo TWFjIE9TIFggMTAuNS41IFF1YXJ0eiBQREZDb250ZXh0KS9Nb2REYXRlKEQ6MjAwODEyMDExMDUw NDItMDUnMDAnKS9UaXRsZShjZnApPj4NZW5kb2JqDXhyZWYNCjAgNA0KMDAwMDAwMDAwMCA2NTUz NSBmDQowMDAwMDYxMjYzIDAwMDAwIG4NCjAwMDAwNjEzMTQgMDAwMDAgbg0KMDAwMDA2NTE4NyAw MDAwMCBuDQp0cmFpbGVyDQo8PC9TaXplIDQ+Pg0Kc3RhcnR4cmVmDQoxMTYNCiUlRU9GDQo= --=====================_6944609==_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir --=====================_6944609==_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --=====================_6944609==_-- From secdir-bounces@ietf.org Mon Dec 1 10:35:54 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 29D983A6951; Mon, 1 Dec 2008 10:35:54 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CD5E63A6B66; Mon, 1 Dec 2008 10:11:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.448 X-Spam-Level: X-Spam-Status: No, score=-6.448 tagged_above=-999 required=5 tests=[AWL=0.151, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A+nRm8OffEXc; Mon, 1 Dec 2008 10:11:14 -0800 (PST) Received: from mgw-mx03.nokia.com (smtp.nokia.com [192.100.122.230]) by core3.amsl.com (Postfix) with ESMTP id CF4F63A67FF; Mon, 1 Dec 2008 10:10:50 -0800 (PST) Received: from esebh106.NOE.Nokia.com (esebh106.ntc.nokia.com [172.21.138.213]) by mgw-mx03.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id mB1IAhMY029546; Mon, 1 Dec 2008 20:10:44 +0200 Received: from esebh102.NOE.Nokia.com ([172.21.138.183]) by esebh106.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 1 Dec 2008 20:10:42 +0200 Received: from mgw-int02.ntc.nokia.com ([172.21.143.97]) by esebh102.NOE.Nokia.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Mon, 1 Dec 2008 20:10:42 +0200 Received: from dadhcp-172019074159.americas.nokia.com (dadhcp-172019074159.americas.nokia.com [172.19.74.159]) by mgw-int02.ntc.nokia.com (Switch-3.2.5/Switch-3.2.5) with ESMTP id mB1IAdam029160; Mon, 1 Dec 2008 20:10:40 +0200 From: Bob Hinden To: Derek Atkins In-Reply-To: References: Message-Id: Mime-Version: 1.0 (Apple Message framework v929.2) Date: Mon, 1 Dec 2008 10:10:38 -0800 X-Mailer: Apple Mail (2.929.2) X-OriginalArrivalTime: 01 Dec 2008 18:10:42.0722 (UTC) FILETIME=[1FBFE820:01C953E0] X-Nokia-AV: Clean X-Mailman-Approved-At: Mon, 01 Dec 2008 10:35:53 -0800 Cc: 6man-chairs@tools.ietf.org, iesg@ietf.org, suresh.krishnan@ericsson.com, secdir@ietf.org Subject: Re: [secdir] sec-dir review of draft-ietf-6man-reserved-iids-01 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: bob.hinden@nokia.com List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Derek, On Nov 28, 2008, at 12:03 PM, ext Derek Atkins wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > While this document itself does not have any security issues (it's > just creating a registry with IANA) it brings up some interesting > points. First, what methods should IANA use to "authenticate and > authorize" entities to create or update changes to the registry? The document says: "future assignments from this registry are discouraged but in exceptional circumstances are to be made through Standards Action [RFC5226]." Only the IETF through a standard action can add entries. I suppose the IANA could use PGP to authenticate email from the IESG. > But > more importantly, what's to stop a rogue system from declaring itself > to use one of the reserved addresses? And what happens to the network > as a whole if a system does this? > Umm, the registry is to reserve them for a particular usage, not to prohibit their use. Nothing is to stop anyone from using them. The propose of the document and registry it creates is to reduce the chance of another standard from creating a new type of IID that conflicts with these. The general form of attack you are describing is one of creating addresses. It's not specific to these or any other type of interface IDs. Bob _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 1 13:54:33 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A4DBE28C134; Mon, 1 Dec 2008 13:54:33 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 535E128C11D; Mon, 1 Dec 2008 13:54:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.525 X-Spam-Level: X-Spam-Status: No, score=-2.525 tagged_above=-999 required=5 tests=[AWL=0.074, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nM5OBpDUdAcR; Mon, 1 Dec 2008 13:54:32 -0800 (PST) Received: from smtp.piuha.net (p130.piuha.net [IPv6:2001:14b8:400::130]) by core3.amsl.com (Postfix) with ESMTP id 78E7528C0E4; Mon, 1 Dec 2008 13:54:32 -0800 (PST) Received: from smtp.piuha.net (localhost [127.0.0.1]) by smtp.piuha.net (Postfix) with ESMTP id 5866E19876B; Mon, 1 Dec 2008 23:54:28 +0200 (EET) Received: from [127.0.0.1] (unknown [IPv6:2001:14b8:400::130]) by smtp.piuha.net (Postfix) with ESMTP id EAE91198639; Mon, 1 Dec 2008 23:54:27 +0200 (EET) Message-ID: <49345D00.7010006@piuha.net> Date: Mon, 01 Dec 2008 23:54:08 +0200 From: Jari Arkko User-Agent: Thunderbird 2.0.0.18 (X11/20081125) MIME-Version: 1.0 To: Derek Atkins References: In-Reply-To: X-Virus-Scanned: ClamAV using ClamSMTP Cc: 6man-chairs@tools.ietf.org, iesg@ietf.org, suresh.krishnan@ericsson.com, secdir@ietf.org Subject: Re: [secdir] sec-dir review of draft-ietf-6man-reserved-iids-01 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Thanks for your review, Derek. A couple of responses: > First, what methods should IANA use to "authenticate and > authorize" entities to create or update changes to the registry? This is standard IANA practice, just like with any other registry. They operate based on RFC 5226 and registry-specific RFCs, and if there's ever a problem (such as no rule for a particular registry), they contact the IESG. > But > more importantly, what's to stop a rogue system from declaring itself > to use one of the reserved addresses? And what happens to the network > as a whole if a system does this? > Good question. I think Bob already answered this. Jari _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 09:30:24 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 24BFE28C1AC; Tue, 2 Dec 2008 09:30:24 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C39FA28C199; Tue, 2 Dec 2008 09:30:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R9PbizuNnlav; Tue, 2 Dec 2008 09:30:22 -0800 (PST) Received: from jackfruit.srv.cs.cmu.edu (JACKFRUIT.SRV.CS.CMU.EDU [128.2.201.16]) by core3.amsl.com (Postfix) with ESMTP id CDF763A69F2; Tue, 2 Dec 2008 09:30:21 -0800 (PST) Received: from MINBAR.FAC.CS.CMU.EDU (MINBAR.FAC.CS.CMU.EDU [128.2.216.42]) (authenticated bits=0) by jackfruit.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id mB2HUDjG018330 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 2 Dec 2008 12:30:13 -0500 (EST) Date: Tue, 02 Dec 2008 12:30:13 -0500 From: Jeffrey Hutzelman To: Samuel Weiler , secdir@ietf.org Message-ID: <3F83E569A47C23246D97043F@minbar.fac.cs.cmu.edu> In-Reply-To: <200811260758.mAQ7wXhp017242@raisinbran.srv.cs.cmu.edu> References: <200811260758.mAQ7wXhp017242@raisinbran.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.201.16 Cc: iesg@ietf.org, dhc-chairs@tools.ietf.org, raj@cisco.com, ietf@ietf.org Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Wednesday, November 26, 2008 02:58:25 AM -0500 Samuel Weiler wrote: > The security considerations section cites rogue DHCP servers as attack > vectors, but doesn't do enough to encourage the use of DHCP Auth. In many deployments, DHCP is used by devices which have no prior configuration, or at least no prior association with the network operator. In such scenarios, DHCP auth is frequently impractical. Instead, network operators take other measures to insure that only replies from legitimate DHCP servers ever reach clients. For example, they may configure switches to monitor and filter DHCP traffic such that responses can only come from a small set of trusted ports. I'm somewhat surprised that the document does not mention this approach, as it is fairly common. I believe there may also be some confusion as to the meaning of option 66. This option has exactly the same semantics as the 'sname' field in the bootp packet, and is used in the event that field is overloaded to carry additional options. See RFC2132 sections 9.3, 9.4, 9.5, and the description of the option overload option starting at the bottom of page 23 of RFC2131. So, putting a name in option 66 has exactly the same effect as putting it in the 'sname' field, which is well-defined for BOOTP requests, but not so well defined for DHCP replies (in fact, so far as I've been able to tell, neither BOOTP nor DHCP has anything to say on the semantics of this field other than that it's a "server host name", and calling option 66 "TFTP server name" is really misleading, because sname didn't actually mean that(*). In any case, the comment in the present document's security considerations that use of a name rather than an address is "more secure" is flawed in several ways. First, the DHCP server operator has no control over what options an attacker sends; if an attacker prefers to send and address, he can do so. Secondly, if a name is used, the attacker need only send a name in a zone which he controls; there is no need to subvert any part of the DNS. I share Sam's confusion as to why a code point is needed here at all. What purpose does this option serve that is not served by the siaddr field? -- Jeff (*) In fact, I've seen at least one widespread client implementation that assumed that sname was the name of the server identified in the siaddr field, and updated /etc/hosts so that sname would resolve to siaddr. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 12:24:02 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 38CF928C125; Tue, 2 Dec 2008 12:24:02 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B649928C0CE; Tue, 2 Dec 2008 12:23:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ac-PJxXDpUow; Tue, 2 Dec 2008 12:23:58 -0800 (PST) Received: from rtp-iport-2.cisco.com (rtp-iport-2.cisco.com [64.102.122.149]) by core3.amsl.com (Postfix) with ESMTP id 2235C3A69BD; Tue, 2 Dec 2008 12:23:58 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.33,704,1220227200"; d="scan'208";a="29737102" Received: from rtp-dkim-2.cisco.com ([64.102.121.159]) by rtp-iport-2.cisco.com with ESMTP; 02 Dec 2008 20:23:53 +0000 Received: from rtp-core-1.cisco.com (rtp-core-1.cisco.com [64.102.124.12]) by rtp-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id mB2KNrVg006741; Tue, 2 Dec 2008 15:23:53 -0500 Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mB2KNrPG004619; Tue, 2 Dec 2008 20:23:53 GMT Received: from xfe-rtp-201.amer.cisco.com ([64.102.31.38]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 2 Dec 2008 15:23:53 -0500 Received: from [161.44.65.201] ([161.44.65.201]) by xfe-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 2 Dec 2008 15:23:52 -0500 Message-Id: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> From: Ralph Droms To: Samuel Weiler In-Reply-To: Mime-Version: 1.0 (Apple Message framework v929.2) Date: Tue, 2 Dec 2008 15:23:51 -0500 References: X-Mailer: Apple Mail (2.929.2) X-OriginalArrivalTime: 02 Dec 2008 20:23:52.0934 (UTC) FILETIME=[E4B34060:01C954BB] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=7465; t=1228249433; x=1229113433; c=relaxed/simple; s=rtpdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdroms@cisco.com; z=From:=20Ralph=20Droms=20 |Subject:=20Re=3A=20secdir=20review=20of=20draft-raj-dhc-tf tp-addr-option-04 |Sender:=20 |To:=20Samuel=20Weiler=20; bh=YPAgo5jMVnPXLUrfuMjPfkyzaT2QwV/AtJd+q79+dUY=; b=COhQSq23sB2XzvQIYczmDsBki2/QEaFs4FDC6HD6QA4veuta9pq5ypAN++ n0AuVvB71rz27/eayjIr2WaNjRkNr+ceGPI70kvqdtLe+oNk8sLouE2/Ip5/ yxWTJDzvec; Authentication-Results: rtp-dkim-2; header.From=rdroms@cisco.com; dkim=pass ( sig from cisco.com/rtpdkim2001 verified; ); Cc: Richard Johnson , IETF Discussion , secdir@ietf.org, dhc Chairs , IESG IESG Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="windows-1252"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Sam - I think most of the issues in your review of draft-raj-dhc-tftp- = addr-option-04 can be resolved by reviewing the purposes of RFC 3942 = and publishing Informational RFCs describing DHCP option codes. = Fundamentally, the reason to publish RFCs under the process described = in RFC 3942 is to document existing uses of option codes in the range = of option codes reclaimed for assignment to new DHCP options. The = concern is to avoid conflicts between new options and those = grandfathered ("hijacked") option codes. As such, these RFCs (usually = Informational) simply document the already established use of those = option codes, so there are only very minimal requirements for = demonstrating a need to record the use of the option code, and = mandating changes to the established use of the option code is out-of- = scope. In the opinion of the dhc WG, this I-D meets the requirements = of RFC 3942, which addresses your statement "It's not clear why a = distinct code point is needed here" and the suggestions to require = DHCP authentication, as well as the pointers to other, similar options = are out-of-scope. Responding to some of your specific points: >> At the very least, I suggest mandating the use of DHCP Auth and = >> removing the suggestion to use option 66 to enhance security. And, = >> in the absence of a more data about how widely used this option is, = >> I suggest not publishing this document at all. The consensus of the dhc WG, to which I concur, is to publish the = document as Informational. The text in the Security Considerations = section about option 66 might be removed. >> It's not clear why a distinct code point is needed here. The = >> document >> claims that the "TFTP server name" option (#66) must contain a domain >> name, but I'm pretty sure that real-world devices (e.g. the Cisco >> 7960) happily accept and use v4 address literals in option 66. >> Furthermore, there appear to be other DHCP options that could do the >> trick (e.g. #128, documented in the IANA registry as "TFTP Server IP >> address (for IP Phone software load)"). To reiterate, it's not so much a question of whether a new code point = is needed; rather, according to the procedures described in RFC 3942, = this document gives a description of an existing use of option code = 150. That option code is in use today and, to eliminate any chance of = conflict with a new option code in the future, it is entirely = appropriate to record the use of the option code in the IANA registry = and document its use. >> The document's write-up says is "it is believed that to some extent = >> this >> option is in use in some deployments of VoIP devices". That's not a >> very convincing argument that enough devices use this to justify >> invoking the RFC3942 procedure, given that other devices are making = >> do >> just fine with existing fields. Richard checked internally at Cisco and got the following response = from one of our colleagues: I would say that over 99% of Cisco Unified Communications Manager deployments use Option 150 with a small minority using Option 66. We do support Option 66, but it requires a DNS lookup if specified by name and does not allow for an array of addreses for the purposes of config server redundancy. Any third party phones that support registering with CUCM (e.g. Tandberg, Polycom, Sony, and others) also support using Option 150. Here's more information about uses of option 150 by Cisco customers = (current as of 8/19/08): =95 95,000+ Cisco Unified Communications customers (all using option 150) =95 400+ customers deploying more than 5,000 IP phones =95 18M+ IP Phones shipped Also, there are two key differences between the "VoIP Configuration = server address" option described in this document and other options: * This option can carry a list of addresses, rather than just a single = address. * Cisco's use of the option will ultimately move toward using other protocols such as HTTP instead of TFTP, which is why the name was changed from "TFTP server address" to "VoIP Configuration server = address". >> And if we do want to proceed with defining this option: shouldn't it >> also allow for v6 addresses? (The current doc only allows for v4.) As this document describes existing practice and does not define a new = option, there is no need to describe a version of the option for = DHCPv6 to carry IPv6 addresses. Cisco expects to use a vendor- = identifying vendor-specific option for the DHCPv6 version of this = option. - Ralph On Nov 26, 2008, at Nov 26, 2008,2:58 AM, Samuel Weiler wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > Summary: > > At the very least, I suggest mandating the use of DHCP Auth and = > removing the suggestion to use option 66 to enhance security. And, = > in the absence of a more data about how widely used this option is, = > I suggest not publishing this document at all. > > Details: > > In 2004 RFC3942 defined a procedure for vendors to lay claim to DHCP = > option code points that, while previously set aside for "site- = > specific" options, had been used by vendors. This document attempts = > to claim such a code point. > > It's not clear why a distinct code point is needed here. The document > claims that the "TFTP server name" option (#66) must contain a domain > name, but I'm pretty sure that real-world devices (e.g. the Cisco > 7960) happily accept and use v4 address literals in option 66. > Furthermore, there appear to be other DHCP options that could do the > trick (e.g. #128, documented in the IANA registry as "TFTP Server IP > address (for IP Phone software load)"). > > The document's write-up says "it is believed that to some extent this > option is in use in some deployments of VoIP devices". That's not a > very convincing argument that enough devices use this to justify > invoking the RFC3942 procedure, given that other devices are making do > just fine with existing fields. Do these devices ALSO check option > #66, such that continued use of #150 is really unnecessary? In the > four years since publication of RFC3942, have enough of these devices > been obsoleted (or updated to also use other DHCP option fields) that > this code point is no longer needed? > > And if we do want to proceed with defining this option: shouldn't it > also allow for v6 addresses? (The current doc only allows for v4.) > > The security considerations section cites rogue DHCP servers as attack > vectors, but doesn't do enough to encourage the use of DHCP Auth. > Furthermore, it suggests using the "TFTP server name" option, on the > basis that a client must do a DNS lookup to use the contents, thereby > giving an tiny extra layer of assurance. I'm pretty sure that > real-world devices happily accept v4 literals in option 66, making the > suggestion a poor one. > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 13:01:17 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C8F228C1C7; Tue, 2 Dec 2008 13:01:17 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A71B53A6B58; Tue, 2 Dec 2008 12:54:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.726 X-Spam-Level: X-Spam-Status: No, score=-2.726 tagged_above=-999 required=5 tests=[AWL=-0.127, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bci+BizSABL2; Tue, 2 Dec 2008 12:54:11 -0800 (PST) Received: from bs.jck.com (ns.jck.com [209.187.148.211]) by core3.amsl.com (Postfix) with ESMTP id A7F1F3A6778; Tue, 2 Dec 2008 12:54:11 -0800 (PST) Received: from [127.0.0.1] (helo=p3.JCK.COM) by bs.jck.com with esmtp (Exim 4.34) id 1L7cFr-0001bd-7w; Tue, 02 Dec 2008 15:53:59 -0500 Date: Tue, 02 Dec 2008 15:53:58 -0500 From: John C Klensin To: Ralph Droms , Samuel Weiler Message-ID: <56DEB14D23377D001B19EFE5@p3.int.jck.com> In-Reply-To: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> X-Mailer: Mulberry/4.0.8 (Win32) MIME-Version: 1.0 Content-Disposition: inline X-Mailman-Approved-At: Tue, 02 Dec 2008 13:01:16 -0800 Cc: dhc Chairs , Richard Johnson , IESG IESG , IETF Discussion , secdir@ietf.org Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Tuesday, 02 December, 2008 15:23 -0500 Ralph Droms wrote: > Sam - I think most of the issues in your review of > draft-raj-dhc-tftp-addr-option-04 can be resolved by reviewing > the purposes of RFC 3942 and publishing Informational RFCs > describing DHCP option codes. Fundamentally, the reason to > publish RFCs under the process described in RFC 3942 is to > document existing uses of option codes in the range of option > codes reclaimed for assignment to new DHCP options. The > concern is to avoid conflicts between new options and those > grandfathered ("hijacked") option codes. As such, these RFCs > (usually Informational) simply document the already >... > Responding to some of your specific points: > >>> At the very least, I suggest mandating the use of DHCP Auth >>> and removing the suggestion to use option 66 to enhance >>> security. And, in the absence of a more data about how >>> widely used this option is, I suggest not publishing this >>> document at all. > > The consensus of the dhc WG, to which I concur, is to publish > the document as Informational. The text in the Security > Considerations section about option 66 might be removed. >... > To reiterate, it's not so much a question of whether a new > code point is needed; rather, according to the procedures > described in RFC 3942, this document gives a description of an > existing use of option code 150. That option code is in use >... Ralph, It seems to me that there is a middle ground here. One can stick with Informational publication as the WG intends, but still modify the Security Considerations section, not only to remove the reference to option 66 (if there is consensus that is appropriate) but to add some explanation about why the use of this option without authentication might be problematic. Put differently, your objection to Sam's suggestion seems to hinge on "just describe the existing practice, don't try to change it in this document". Given RFC 3492, that is entirely reasonable. But, if there are relatively obvious difficulties with that practice, it seems to me that documenting them would be helpful (indeed that not doing so borders on irresponsible). john _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 15:03:47 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3426028C21E; Tue, 2 Dec 2008 15:03:47 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1741528C219; Tue, 2 Dec 2008 15:03:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7DNo4FQP2gqZ; Tue, 2 Dec 2008 15:03:45 -0800 (PST) Received: from jackfruit.srv.cs.cmu.edu (JACKFRUIT.SRV.CS.CMU.EDU [128.2.201.16]) by core3.amsl.com (Postfix) with ESMTP id 188F228C213; Tue, 2 Dec 2008 15:03:44 -0800 (PST) Received: from 99-205-118-9.pools.spcsdns.net (99-205-118-9.pools.spcsdns.net [99.205.118.9]) (authenticated bits=0) by jackfruit.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id mB2N3Vhg003060 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 2 Dec 2008 18:03:34 -0500 (EST) Date: Tue, 02 Dec 2008 18:03:30 -0500 From: Jeffrey Hutzelman To: John C Klensin , Ralph Droms , Samuel Weiler Message-ID: In-Reply-To: <200812022101.mB2L1Ftf002108@raisinbran.srv.cs.cmu.edu> References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <200812022101.mB2L1Ftf002108@raisinbran.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.201.16 Cc: Richard Johnson , IETF Discussion , secdir@ietf.org, dhc Chairs , IESG IESG Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Tuesday, December 02, 2008 03:53:58 PM -0500 John C Klensin wrote: > > > --On Tuesday, 02 December, 2008 15:23 -0500 Ralph Droms > wrote: > >> Sam - I think most of the issues in your review of >> draft-raj-dhc-tftp-addr-option-04 can be resolved by reviewing >> the purposes of RFC 3942 and publishing Informational RFCs >> describing DHCP option codes. Fundamentally, the reason to >> publish RFCs under the process described in RFC 3942 is to >> document existing uses of option codes in the range of option >> codes reclaimed for assignment to new DHCP options. The >> concern is to avoid conflicts between new options and those >> grandfathered ("hijacked") option codes. As such, these RFCs >> (usually Informational) simply document the already >> ... >> Responding to some of your specific points: >> >>>> At the very least, I suggest mandating the use of DHCP Auth >>>> and removing the suggestion to use option 66 to enhance >>>> security. And, in the absence of a more data about how >>>> widely used this option is, I suggest not publishing this >>>> document at all. >> >> The consensus of the dhc WG, to which I concur, is to publish >> the document as Informational. The text in the Security >> Considerations section about option 66 might be removed. >> ... >> To reiterate, it's not so much a question of whether a new >> code point is needed; rather, according to the procedures >> described in RFC 3942, this document gives a description of an >> existing use of option code 150. That option code is in use >> ... > > Ralph, > > It seems to me that there is a middle ground here. One can > stick with Informational publication as the WG intends, but > still modify the Security Considerations section, not only to > remove the reference to option 66 (if there is consensus that is > appropriate) but to add some explanation about why the use of > this option without authentication might be problematic. > > Put differently, your objection to Sam's suggestion seems to > hinge on "just describe the existing practice, don't try to > change it in this document". Given RFC 3492, that is entirely > reasonable. But, if there are relatively obvious difficulties > with that practice, it seems to me that documenting them would > be helpful (indeed that not doing so borders on irresponsible). I'm inclined to agree with John here. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 15:06:17 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9543228C222; Tue, 2 Dec 2008 15:06:17 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D057F28C21B; Tue, 2 Dec 2008 15:06:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xxECRhCRNWPT; Tue, 2 Dec 2008 15:06:15 -0800 (PST) Received: from dlpdemo.checkpoint.com (dlpdemo.checkpoint.com [194.29.32.54]) by core3.amsl.com (Postfix) with ESMTP id 552F928C214; Tue, 2 Dec 2008 15:06:14 -0800 (PST) Received: by dlpdemo.checkpoint.com (Postfix, from userid 105) id A9D6B29C002; Wed, 3 Dec 2008 01:06:09 +0200 (IST) Received: from michael.checkpoint.com (michael.checkpoint.com [194.29.32.68]) by dlpdemo.checkpoint.com (Postfix) with ESMTP id 6324D29C001; Wed, 3 Dec 2008 01:05:41 +0200 (IST) Received: from il-ex01.ad.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id mB2N5efE001170; Wed, 3 Dec 2008 01:05:40 +0200 (IST) Received: from il-ex01.ad.checkpoint.com ([194.29.32.26]) by il-ex01.ad.checkpoint.com ([194.29.32.26]) with mapi; Wed, 3 Dec 2008 01:05:40 +0200 From: Yaron Sheffer To: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-sip-session-policy-framework@tools.ietf.org" , Dean Willis , Keith Drage Date: Wed, 3 Dec 2008 01:05:39 +0200 Thread-Topic: secdir review of draft-ietf-sip-session-policy-framework-05 Thread-Index: AclU0n3Ut8ykSqcQRQ2IpwqFV/B7/w== Message-ID: <7F9A6D26EB51614FBF9F81C0DA4CFEC8D8BB94FD46@il-ex01.ad.checkpoint.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 Subject: [secdir] secdir review of draft-ietf-sip-session-policy-framework-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1204915448==" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --===============1204915448== Content-Language: en-US Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=SHA1; boundary="----=_NextPart_000_0341_01C954E3.417473B0" ------=_NextPart_000_0341_01C954E3.417473B0 Content-Type: multipart/alternative; boundary="----=_NextPart_001_0342_01C954E3.417473B0" ------=_NextPart_001_0342_01C954E3.417473B0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. General I have reviewed a policy framework document that (5 years in the making) presumably represents the consensus of the SIP community. But reviewing it from a security point of view is rather challenging. In an environment where a dozen entities (*) may be involved in setting up a single session, it is difficult to define a threat model, let alone define a security solution. And indeed I find the security aspects of this document to be less than satisfactory. (*) UA1, local network's discovery point (DHCP?), local network's Policy Server (PS), registrar proxy, service provider's PS, MVNO call proxy (why not?), MVNO PS, physical service provider's proxy, service provider's PS, destination provider's proxy, destination provider's PS, and UA2. That's 12 in all. The top security issues I have identified are: - By most common definitions of the term Policy, a Policy is a set of rules which must be obeyed; failing to obey them is a security failure. However the current document skirts the issue of policy enforcement almost completely, and any mention of such is as an optional component. When looking at this document from a service provider's point of view, enforcing the policy is definitely a security property. Of course most of this enforcement needs to happen on the media path. - A SIP User Agent can rarely be trusted (in a security sense) with anything, being deployed in the weakest part of the system - on the end device. However the document seems to assume (e.g. the Note in Sec. 4.4.2) that the UA will enforce the policy it receives from policy servers. The document also emphasizes that the UA MUST fully disclose its policy, although a malicious UA has good reasons to lie. - Policies may be obtained from the local network (which may be trusted to some extent) or from basically anybody on the SIP path to the peer UA. The document mentions, correctly, that a malicious policy can easily disable the UA. So it is completely unrealistic to trust policies received from remote policy servers, even if they "authenticate" (present a certificate someone sold them). - Policy is used for clearly security-sensitive tasks (disallowing sessions when you've run out of credit), but on the other hand, policy is optional - sessions can be started even if policy servers are unavailable. - TLS is used as a security fix-all, even though the UA has neither direct contact nor trust with any but the first proxy. So in reality hop-by-hop TLS will be used to obtain policy servers' URIs. Detailed Comments - Sec. 1: most of the discussion in the section is centered on proxies. This is a bit confusing because they are not the motivation for session-independent policies. - Sec. 3.1: I suggest to add as step (0): discovery of one or more policy servers. - Sec. 3.2.1: the conditions to resubscribe to a policy, and the restriction on retrying, mean that it's difficult to deploy a new policy in a network where previously there was none. Compare, e.g., with a retry every 24 hours. - Sec. 3.2.2: there are things it's reasonable to accept from the local domain's policy server, but not from a remote proxy. Is there any definition (or advice) on which policy elements are applicable where? - Sec. 4: the use of policy to block out-of-credit users from creating media streams is puzzling. Are they still allowed to issue INVITE requests? - Sec. 4.2, step #3: the Framework should clarify if policy changes can be trigerred by different session-related events, e.g. a new party joining a call. - Sec. 4.3.1: I don't understand how UA A can request a new policy from PS A (in the last 2 steps) after it has already committed to B regarding their actual parameters. What if PS A comes up with any surprises? - Sec. 4.4.1, step (6): discloses => disclose. - Sec. 4.4.1 (paragraph describing caching of local domain's PS): how does the UA identify its local domain's PS? We cannot simply assume the first PS the UA becomes aware of is local - maybe there is no local PS at all. - Sec. 4.4.2 (Policy-Id paragraph): is enforcement of the correct policy really dependent on retransmitted messages being routed over exactly the same path as the originals? Can't the UA influence this routing? - Sec. 4.5.1: allowing the UA to continue normal processing when the PS cannot be contacted means that the UA is also free to not contact the PS at all (and pretend that the requests were lost) or to ignore the returned policy (and pretend that the responses were lost). - Sec. 4.5.2: why should the PS believe a policy it receives from a UA? What's there to prevent the UA from lying? ------=_NextPart_001_0342_01C954E3.417473B0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being = processed by the IESG.  These comments were written primarily for the benefit of = the security area directors.  Document editors and WG chairs should treat these = comments just like any other last call comments.

 

General

 

I have reviewed a policy framework document that (5 = years in the making) presumably represents the consensus of the SIP community. = But reviewing it from a security point of view is rather challenging. In an environment where a dozen entities (*) may be involved in setting up a = single session, it is difficult to define a threat model, let alone define a = security solution. And indeed I find the security aspects of this document to be = less than satisfactory.

 

(*) UA1, local network's discovery point (DHCP?), = local network's Policy Server (PS), registrar proxy, service provider's PS, = MVNO call proxy (why not?), MVNO PS, physical service provider's proxy, service = provider's PS, destination provider's proxy, destination provider's PS, and UA2. = That's 12 in all.

 

The top security issues I have identified = are:

 

- By most common definitions of the term Policy, a = Policy is a set of rules which must be obeyed; failing to obey them is a security = failure. However the current document skirts the issue of policy enforcement = almost completely, and any mention of such is as an optional component. When = looking at this document from a service provider's point of view, enforcing the = policy is definitely a security property. Of course most of this enforcement = needs to happen on the media path.

 

- A SIP User Agent can rarely be trusted (in a = security sense) with anything, being deployed in the weakest part of the system - = on the end device. However the document seems to assume (e.g. the Note in Sec. = 4.4.2) that the UA will enforce the policy it receives from policy servers. The = document also emphasizes that the UA MUST fully disclose its policy, although a = malicious UA has good reasons to lie.

 

- Policies may be obtained from the local network = (which may be trusted to some extent) or from basically anybody on the SIP path to = the peer UA. The document mentions, correctly, that a malicious policy can = easily disable the UA. So it is completely unrealistic to trust policies = received from remote policy servers, even if they "authenticate" (present a certificate someone sold them).

 

- Policy is used for clearly security-sensitive tasks = (disallowing sessions when you've run out of credit), but on the other hand, policy = is optional - sessions can be started even if policy servers are = unavailable.

 

- TLS is used as a security fix-all, even though the = UA has neither direct contact nor trust with any but the first proxy. So in = reality hop-by-hop TLS will be used to obtain policy servers' = URIs.

 

Detailed Comments

 

- Sec. 1: most of the discussion in the section is = centered on proxies. This is a bit confusing because they are not the motivation = for session-independent policies.

 

- Sec. 3.1: I suggest to add as step (0): discovery = of one or more policy servers.

 

- Sec. 3.2.1: the conditions to resubscribe to a = policy, and the restriction on retrying, mean that it's difficult to deploy a new = policy in a network where previously there was none. Compare, e.g., with a retry = every 24 hours.

 

- Sec. 3.2.2: there are things it's reasonable to = accept from the local domain's policy server, but not from a remote proxy. Is = there any definition (or advice) on which policy elements are applicable = where?

 

- Sec. 4: the use of policy to block out-of-credit = users from creating media streams is puzzling. Are they still allowed to issue = INVITE requests?

 

- Sec. 4.2, step #3: the Framework should clarify if = policy changes can be trigerred by different session-related events, e.g. a new = party joining a call.

 

- Sec. 4.3.1: I don't understand how UA A can request = a new policy from PS A (in the last 2 steps) after it has already committed to = B regarding their actual parameters. What if PS A comes up with any = surprises?

 

- Sec. 4.4.1, step (6): discloses =3D> = disclose.

 

- Sec. 4.4.1 (paragraph describing caching of local = domain's PS): how does the UA identify its local domain's PS? We cannot simply = assume the first PS the UA becomes aware of is local - maybe there is no local = PS at all.

 

- Sec. 4.4.2 (Policy-Id paragraph): is enforcement of = the correct policy really dependent on retransmitted messages being routed = over exactly the same path as the originals? Can't the UA influence this = routing?

 

- Sec. 4.5.1: allowing the UA to continue normal = processing when the PS cannot be contacted means that the UA is also free to not = contact the PS at all (and pretend that the requests were lost) or to ignore the returned policy (and pretend that the responses were = lost).

 

- Sec. 4.5.2: why should the PS believe a policy it = receives from a UA? What's there to prevent the UA from = lying?

------=_NextPart_001_0342_01C954E3.417473B0-- ------=_NextPart_000_0341_01C954E3.417473B0 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPTTCCBDIw ggMaoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0 ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0 ZWQxITAfBgNVBAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0wNDAxMDEwMDAwMDBaFw0y ODEyMzEyMzU5NTlaMHsxCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIx EDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSEwHwYDVQQDDBhB QUEgQ2VydGlmaWNhdGUgU2VydmljZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+ QJ30buHqdoccTUVEjr5GyIMGncEq/hgfjuQC+vOrXVCKFjELmgbQxXAizUktVGPMtm5oRgtT6stM JMC8ck7q8RWu9FSaEgrDerIzYOLaiVXzIljz3tzP74OGooyUT59o8piQRoQnx3a/48w1LIteB2Rl gsBIsKiR+WGfdiBQqJHHZrXreGIDVvCKGhPqMaMeoJn9OPb2JzJYbwf1a7j7FCuvt6rM1mNfc4za BZmoOKjLF3g2UazpnvR4Oo3PD9lC4pgMqy+fDgHe75+ZSfEt36x0TRuYtUfF5SnR+ZAYx2KcvoPH Jns+iiXHwN2d5jVoECCdj9je0sOEnA1e6C/JAgMBAAGjgcAwgb0wHQYDVR0OBBYEFKARCiM+lvEH 7OKvKe+CpX/QMKS0MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MHsGA1UdHwR0MHIw OKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3Js MDagNKAyhjBodHRwOi8vY3JsLmNvbW9kby5uZXQvQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmww DQYJKoZIhvcNAQEFBQADggEBAAhW/ALwm+j/pPrWe8ZEgM5PxMX2AFjMpra8FEloBHbo5u5d7AIP YNaNUBhPJk4B4+awpe6/vHRUQb/9/BK4x09a9IlgBX9gtwVK8/bxwr/EuXSGti19a8zS80bdL8bg asPDNAMsfZbdWsIOpwqZwQWLqwwv81w6z2w3VQmH3lNAbFjv/LarZW4E9hvcPOBaFcae2fFZSDAh ZQNs7Okhc+ybA6HgN62gFRiP+roCzqcsqRATLNTlCCarIpdg+JBedNSimlO98qlo4KJuwtdssaMP nr/raOdW8q7y4ys4OgmBtWuF174t7T8at7Jj4vViLILUagBBUPE5g5+V6TaWmG4wggTdMIIDxaAD AgECAhBxkvvmGV+sTRKFdHE0ohinMA0GCSqGSIb3DQEBBQUAMHsxCzAJBgNVBAYTAkdCMRswGQYD VQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9k byBDQSBMaW1pdGVkMSEwHwYDVQQDDBhBQUEgQ2VydGlmaWNhdGUgU2VydmljZXMwHhcNMDQwMTAx MDAwMDAwWhcNMjgxMjMxMjM1OTU5WjCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYD VQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYD VQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xp ZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC ggEBALI5haTyfatBO2JGN67NwWB1vDll+UoaR6K5zEjMapjVTTUZuaRC5c5J4oovHnzSMQfHTrSD ZJ0uKdWiZMSFvYVRNXmkTmiQexx6pJKoF/KYFfKTzMmkMpW7DE8wvZigC4vlbhuiRvp4vKJvq1le pS/Pytptqi/rrKGzaqq3Lmc1i3nhHmmI4uZGzaCl6r4LznY6eg6b6vzaJ1s9cx8i5khhxkzzabGo Lhu21DEgLLyCio6kDqXXiUP8FlqvHXHXEVnauocNr/rz4cLwpMVnjNbWVDreCqS6A3ezZcj9HtN0 YqoYymiTHqGFfvVHZcv4TVcodNI0/zC27vZiMBSMLOsCAwEAAaOCAScwggEjMB8GA1UdIwQYMBaA FKARCiM+lvEH7OKvKe+CpX/QMKS0MB0GA1UdDgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTAOBgNV HQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwEQYDVR0gBAowCDAGBgRVHSAAMHsGA1UdHwR0MHIwOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2Rv Y2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDagNKAyhjBodHRwOi8vY3JsLmNvbW9k by5uZXQvQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwEQYJYIZIAYb4QgEBBAQDAgEGMA0GCSqG SIb3DQEBBQUAA4IBAQCdlcs8uH6lCcQevwvCx3aOOTyUxhCqTwzJ4KuEXYlU4GU7820cfDcsJVRf liH8N4SRnRXcFE+Bz1Qda2xFYMct+ZdRTPlmyjyggoymyPDi6dRK+ew/VsnddozDggFPbADzHhph dARHA6nGQFeRvGUixSdnT1fbZFrZjR+6hi/0Bq6cae3p9M8pF9jgSp8aIC+XTFG7RgfEijdOIOMJ MWjHnsSLneh+EbwyaBCWEZhE2CpRYE2I63Q630MGMsg5Vow6EVLTQaRDA/Tt7zMn2zngFE4mydj1 OeKJuJNdtykmQeqzm66D/Hd1yujKtf7iZUpjPkTE0MNeh3OpmByvfxV/MIIGMjCCBRqgAwIBAgIR AIDKyDfd56zXUq4aqXlC1iYwDQYJKoZIhvcNAQEFBQAwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQI EwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0 d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNF UkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwwHhcNMDgwOTEwMDAwMDAwWhcN MDkwOTEwMjM1OTU5WjCB3jE1MDMGA1UECxMsQ29tb2RvIFRydXN0IE5ldHdvcmsgLSBQRVJTT05B IE5PVCBWQUxJREFURUQxRjBEBgNVBAsTPVRlcm1zIGFuZCBDb25kaXRpb25zIG9mIHVzZTogaHR0 cDovL3d3dy5jb21vZG8ubmV0L3JlcG9zaXRvcnkxHzAdBgNVBAsTFihjKTIwMDMgQ29tb2RvIExp bWl0ZWQxFjAUBgNVBAMTDVlhcm9uIFNoZWZmZXIxJDAiBgkqhkiG9w0BCQEWFXlhcm9uZkBjaGVj a3BvaW50LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALqGr14AEP/lS7OgXTYs 8LjmDZYg3KegpdGXufAXa93NbmAAQ1EmqkVBw8vC/EcYCM+D9uUWeK0uC7BpmCalFDh28AMMIUKI W0VGvDF+kE8zjnch/j7whoWvOvj6yFxYZNe9zfUlZZ7xBc+LEPzqsd4oLbK7a7WkvZAuUHfH0oiH k2miEZkXZF/mhpGp/LplLeA8b51fvQhv8UqIzwRghVTLDCAnIhVk/w+WMmRhcHptYZDa0gOhjyza a/4kG1oHw44Ae9cZpws8TXL+JOrUdmJG6uFY3wB0YvPw9b/u0WeY7Snq0bDF58vDNw0jaQsfIoxx EE+MscA9JbuaPaXIFdkCAwEAAaOCAhcwggITMB8GA1UdIwQYMBaAFImCZ33EnSZwAEu0UEh83j2u BG59MB0GA1UdDgQWBBSNbKhiJVIDkhy5HRA+njy+oWiKMDAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0T AQH/BAIwADAgBgNVHSUEGTAXBggrBgEFBQcDBAYLKwYBBAGyMQEDBQIwEQYJYIZIAYb4QgEBBAQD AgUgMEYGA1UdIAQ/MD0wOwYMKwYBBAGyMQECAQEBMCswKQYIKwYBBQUHAgEWHWh0dHBzOi8vc2Vj dXJlLmNvbW9kby5uZXQvQ1BTMIGlBgNVHR8EgZ0wgZowTKBKoEiGRmh0dHA6Ly9jcmwuY29tb2Rv Y2EuY29tL1VUTi1VU0VSRmlyc3QtQ2xpZW50QXV0aGVudGljYXRpb25hbmRFbWFpbC5jcmwwSqBI oEaGRGh0dHA6Ly9jcmwuY29tb2RvLm5ldC9VVE4tVVNFUkZpcnN0LUNsaWVudEF1dGhlbnRpY2F0 aW9uYW5kRW1haWwuY3JsMGwGCCsGAQUFBwEBBGAwXjA2BggrBgEFBQcwAoYqaHR0cDovL2NydC5j b21vZG9jYS5jb20vVVROQUFBQ2xpZW50Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5j b21vZG9jYS5jb20wIAYDVR0RBBkwF4EVeWFyb25mQGNoZWNrcG9pbnQuY29tMA0GCSqGSIb3DQEB BQUAA4IBAQBemghknp7tCcWJ+Pzvopk4bHBaaYF/NJtkrSLXJdOb8p286uOS+7po0DIE+zh9iIyV MTq5GFkleVzIVQHWOIOfCMnxbYh6tgrJUZKdDHMJG2vhz2i2dFOJzWnMnosWmKsDDMpmtLMH1mn+ 31lQkp+rgUAkuFUruAPrG6ms5BVaO/Ta+yBGdEJ0ecLOKuA3zmKnmy8beceXpm4OdkBGWWdLvBGu P/+v8n8KwVf2zzNTaZeEy+139MH9GTrVTiHnOsgdkvvsTu7cAl3mhRxR+o60XU0fQdk3jtbPrzeF uK5fTY6yKlW2e/rlJg3hAr3FkIpszNRgnu+BUDYFg9VnYjjYMYIEaDCCBGQCAQEwgcQwga4xCzAJ BgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoT FVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29t MTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwC EQCAysg33ees11KuGql5QtYmMAkGBSsOAwIaBQCgggJ4MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0B BwEwHAYJKoZIhvcNAQkFMQ8XDTA4MTIwMjIzMDUzOFowIwYJKoZIhvcNAQkEMRYEFOFQPzDXy9Q6 +xZt5lpTkrsr5x1OMGcGCSqGSIb3DQEJDzFaMFgwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCA MA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMAcGBSsOAwIaMAoGCCqGSIb3 DQIFMIHVBgkrBgEEAYI3EAQxgccwgcQwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUG A1UEBxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8G A1UECxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNs aWVudCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwCEQCAysg33ees11KuGql5QtYmMIHXBgsqhkiG 9w0BCRACCzGBx6CBxDCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYDVQQHEw5TYWx0 IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYDVQQLExhodHRw Oi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xpZW50IEF1dGhl bnRpY2F0aW9uIGFuZCBFbWFpbAIRAIDKyDfd56zXUq4aqXlC1iYwDQYJKoZIhvcNAQEBBQAEggEA EqYkaNFOsyb2eJyjbNVx//UeKjR/DWex97BMW+Pw1m9tmpQuH1OngMTNI5fLQ2KH5hYBU2EXdVJQ eYve20pqmboMZzJcnrWHZAUrDomIJQiHFpFswtg1eHgQvVPmZr9+U/9UpY69yzeDBYvvSctv/AeU N639Le9ldQGYEC/JpHgzBcVs36TNu/o7WeU4qtiUXxfkAoNnZUZjrzuj4fgWDf+cQ5nAhU7A9357 +mKIGDzj4Q862RNCVg/d+/Ps88W+Wk+Fxt4aSLW6MUbV/ruLiGlk0e/sp4Xd2qpboL2bo2+JSojq rvM0daHWEy5g+E5Pn2ApxlAaNM36P/Z9h8aA/wAAAAAAAA== ------=_NextPart_000_0341_01C954E3.417473B0-- --===============1204915448== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --===============1204915448==-- From secdir-bounces@ietf.org Tue Dec 2 20:41:42 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E2D723A69B6; Tue, 2 Dec 2008 20:41:42 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C272B3A69B6; Tue, 2 Dec 2008 20:41:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oraxwlOyxgHZ; Tue, 2 Dec 2008 20:41:41 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 0C46A3A699A; Tue, 2 Dec 2008 20:41:40 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.2) with ESMTP id mB34fPB0019057; Tue, 2 Dec 2008 23:41:25 -0500 (EST) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.2/Submit) with ESMTP id mB34fPE7019053; Tue, 2 Dec 2008 23:41:25 -0500 (EST) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Tue, 2 Dec 2008 23:41:25 -0500 (EST) From: Samuel Weiler To: Jeffrey Hutzelman In-Reply-To: Message-ID: References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <200812022101.mB2L1Ftf002108@raisinbran.srv.cs.cmu.edu> User-Agent: Alpine 1.10 (BSF 962 2008-03-14) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Tue, 02 Dec 2008 23:41:26 -0500 (EST) Cc: Richard Johnson , IETF Discussion , secdir@ietf.org, Ralph Droms , dhc Chairs , IESG IESG , John C Klensin Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Tue, 2 Dec 2008, Jeffrey Hutzelman wrote: >> It seems to me that there is a middle ground here. One can >> stick with Informational publication as the WG intends, but >> still modify the Security Considerations section, not only to >> remove the reference to option 66 (if there is consensus that is >> appropriate) but to add some explanation about why the use of >> this option without authentication might be problematic. ... > I'm inclined to agree with John here. Likewise. And thank you for providing the clarification on how widely this option is used. Given that date, I withdraw the suggestion that the doc not be published. -- Sam _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 20:55:35 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2D6D73A6967; Tue, 2 Dec 2008 20:55:35 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2906D3A6967; Tue, 2 Dec 2008 20:55:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CiI+xEqRaOel; Tue, 2 Dec 2008 20:55:33 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 5684F3A68DB; Tue, 2 Dec 2008 20:55:33 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.2) with ESMTP id mB34tLxV020261; Tue, 2 Dec 2008 23:55:21 -0500 (EST) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.2/Submit) with ESMTP id mB34tL2s020257; Tue, 2 Dec 2008 23:55:21 -0500 (EST) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Tue, 2 Dec 2008 23:55:21 -0500 (EST) From: Samuel Weiler To: Russ Housley In-Reply-To: <20081126175039.66E1128C0CE@core3.amsl.com> Message-ID: References: <20081126175039.66E1128C0CE@core3.amsl.com> User-Agent: Alpine 1.10 (BSF 962 2008-03-14) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Tue, 02 Dec 2008 23:55:21 -0500 (EST) Cc: Harald Tveit Alvestrand , ietf@ietf.org, secdir@ietf.org Subject: Re: [secdir] secdir review of draft-housley-iesg-rfc3932bis-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Wed, 26 Nov 2008, Russ Housley wrote: > 2. Independent submission informational RFC ... > Today, the IESG asks the RFC Editor to hold the rejected alternative > until the standards-track document is in the RFC Editor queue, and > the informational document will be published with a note indicating > that a standards-track alternative is available in RFC xxxx. That > is the point of the response you are questioning. Having jumped through some very slow hoops several years ago to get some IANA assignments in a 'Specification Required' registry, I worry about the substantive effects of delaying publication for this (or any) reason, when delaying publication might cause codepoint assignments to also be delayed. That said, the registration policy for that particular registry has since changed, and I'm not sure what other registries might be affected. (RFC4020 provides for early allocation in Standards Action registries, but not Specification Required registries.) I'm content to see this document be published as-is, but I'd welcome thoughts on how to avoid blocking IANA assignments as a side effect of publication delay. -- Sam _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 2 21:57:27 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 73C513A695B; Tue, 2 Dec 2008 21:57:27 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 29D553A695B; Tue, 2 Dec 2008 21:57:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JxoAB-XVXNmH; Tue, 2 Dec 2008 21:57:26 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 48C513A6830; Tue, 2 Dec 2008 21:57:26 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.2) with ESMTP id mB35vJbY030142; Wed, 3 Dec 2008 00:57:19 -0500 (EST) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.2/Submit) with ESMTP id mB35vJ7V030138; Wed, 3 Dec 2008 00:57:19 -0500 (EST) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Wed, 3 Dec 2008 00:57:19 -0500 (EST) From: Samuel Weiler To: Harald Tveit Alvestrand In-Reply-To: <49361A7D.3090702@alvestrand.no> Message-ID: References: <20081126175039.66E1128C0CE@core3.amsl.com> <49361A7D.3090702@alvestrand.no> User-Agent: Alpine 1.10 (BSF 962 2008-03-14) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Wed, 03 Dec 2008 00:57:19 -0500 (EST) Cc: ietf@ietf.org, secdir@ietf.org Subject: Re: [secdir] secdir review of draft-housley-iesg-rfc3932bis-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Wed, 3 Dec 2008, Harald Tveit Alvestrand wrote: > I thought the solution in the DLV case was useful, albeit not terribly so - > publish a "specification" that didn't really specify anything, but got the > codepoint, and then follow up with the real specification as an ind-sub when > that was appropriate. FWIW, both 4431 and 5074 were AD-sponsored ("IETF Stream"). We had previously attempted to publish 4431 as an independent submission, with poor results. > Don't know if this particular delay mechanism was involved there, though. It was not. There were a number of delays, primarily in the RFC Editor's slow review of the independent submission, but the IETF didn't have any competing technology in the pipeline, so this mechanism was never invoked. Which makes this a poor example of how to proceed in the case of competing technologies. -- Sam _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 00:20:49 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F13DC3A67F0; Wed, 3 Dec 2008 00:20:48 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 548403A69CD; Tue, 2 Dec 2008 14:35:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mv7XvT3oVxc5; Tue, 2 Dec 2008 14:35:32 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 5E2EA3A69AD; Tue, 2 Dec 2008 14:35:32 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.33,704,1220227200"; d="scan'208";a="205304672" Received: from sj-dkim-1.cisco.com ([171.71.179.21]) by sj-iport-6.cisco.com with ESMTP; 02 Dec 2008 22:35:09 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id mB2MZ639006374; Tue, 2 Dec 2008 14:35:06 -0800 Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mB2MZ65s020602; Tue, 2 Dec 2008 22:35:06 GMT Received: from xfe-sjc-211.amer.cisco.com ([171.70.151.174]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 2 Dec 2008 14:35:06 -0800 Received: from stealth-10-32-254-179.cisco.com ([10.32.254.179]) by xfe-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 2 Dec 2008 14:35:05 -0800 References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <56DEB14D23377D001B19EFE5@p3.int.jck.com> Message-Id: From: Richard Johnson To: John C Klensin In-Reply-To: <56DEB14D23377D001B19EFE5@p3.int.jck.com> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Tue, 2 Dec 2008 14:35:04 -0800 X-Mailer: Apple Mail (2.929.2) X-OriginalArrivalTime: 02 Dec 2008 22:35:05.0309 (UTC) FILETIME=[390058D0:01C954CE] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=4548; t=1228257306; x=1229121306; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=raj@cisco.com; z=From:=20Richard=20Johnson=20 |Subject:=20Re=3A=20secdir=20review=20of=20draft-raj-dhc-tf tp-addr-option-04 |Sender:=20; bh=EKO5EpYMqD3gYX+ZT0XGWWkc0eE2rU+WJ6rFnqGvdG0=; b=awECls7GdYGqWUjQ7gHCUg8zmwWstunJymY2tHWVU4OpY1FnrFT0c8/Uwl 7W7iTWAHxoDcRCe+Wq32cI9Z9R+GKlvdmGySwi4Z21uQN0Qpwx7uiIYjSn5P M8Aao+zbcoavd9jTRgcYNQqq7O9H8eNxdXu/D9Ik7W6j0nlHl+fN4=; Authentication-Results: sj-dkim-1; header.From=raj@cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; ); X-Mailman-Approved-At: Wed, 03 Dec 2008 00:20:48 -0800 Cc: IETF Discussion , secdir@ietf.org, Ralph Droms , dhc Chairs , Samuel Weiler , IESG IESG Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Ok, maybe I'm not understanding what's being suggested or maybe I'm simply reading the existing text in a different way. Here's the contents of the draft's "Security Considerations" section: > A rogue DHCP Server could use this option in order to coerce a > Client > into downloading configuration from an alternate Configuration > Server > and thus gain control of the device's configuration. This is more > easily done with the VoIP Configuration Server Address option > than it > was with the "TFTP Server Name" option, because in the latter case > the attack would need to control DNS responses as well as inserting > the rogue DHCP option information. If this is a concern, then > either > DHCP Authentication may be used, or the "TFTP Server Name" option > may > be used instead. > > Message authentication in DHCP for intradomain use where the out- > of- > band exchange of a shared secret is feasible is defined in > [RFC3118]. > Potential exposures to attack are discussed in section 7 of the > DHCP > protocol specification in [RFC2131]. > > Other out-of-band methods of verifying the validity of the VoIP > Configuration Server Address, such as certificates of trust, > could be > used to mitigate some security concerns. So, it only mentions option 66 ("TFTP Server Name" option) by comparison and in order to point out the relative levels of security involved. It has no "suggestion to use option 66". The text already has an "explanation about why the use of this option without authentication might be problematic". As a matter of fact, it seems rather explicit on the matter. I don't see why we would want to add "mandating the use of DHCP Auth", since that would go far beyond "describe the existing practice, don't try to change it in this document". In short, I the current text seems to already address all of the points made except for mandating DHCP Auth, which is not in agreement with the spirit of RFC3942, since it would change the way in which the option is used. /raj On Dec 2, 2008, at 12:53 PM, John C Klensin wrote: > > > --On Tuesday, 02 December, 2008 15:23 -0500 Ralph Droms > wrote: > >> Sam - I think most of the issues in your review of >> draft-raj-dhc-tftp-addr-option-04 can be resolved by reviewing >> the purposes of RFC 3942 and publishing Informational RFCs >> describing DHCP option codes. Fundamentally, the reason to >> publish RFCs under the process described in RFC 3942 is to >> document existing uses of option codes in the range of option >> codes reclaimed for assignment to new DHCP options. The >> concern is to avoid conflicts between new options and those >> grandfathered ("hijacked") option codes. As such, these RFCs >> (usually Informational) simply document the already >> ... >> Responding to some of your specific points: >> >>>> At the very least, I suggest mandating the use of DHCP Auth >>>> and removing the suggestion to use option 66 to enhance >>>> security. And, in the absence of a more data about how >>>> widely used this option is, I suggest not publishing this >>>> document at all. >> >> The consensus of the dhc WG, to which I concur, is to publish >> the document as Informational. The text in the Security >> Considerations section about option 66 might be removed. >> ... >> To reiterate, it's not so much a question of whether a new >> code point is needed; rather, according to the procedures >> described in RFC 3942, this document gives a description of an >> existing use of option code 150. That option code is in use >> ... > > Ralph, > > It seems to me that there is a middle ground here. One can > stick with Informational publication as the WG intends, but > still modify the Security Considerations section, not only to > remove the reference to option 66 (if there is consensus that is > appropriate) but to add some explanation about why the use of > this option without authentication might be problematic. > > Put differently, your objection to Sam's suggestion seems to > hinge on "just describe the existing practice, don't try to > change it in this document". Given RFC 3492, that is entirely > reasonable. But, if there are relatively obvious difficulties > with that practice, it seems to me that documenting them would > be helpful (indeed that not doing so borders on irresponsible). > > john > > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 00:20:49 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1166F3A6B2D; Wed, 3 Dec 2008 00:20:49 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AE13E28C207; Tue, 2 Dec 2008 14:52:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rUfshfzueNtV; Tue, 2 Dec 2008 14:52:57 -0800 (PST) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 9013828C1FF; Tue, 2 Dec 2008 14:52:57 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.33,704,1220227200"; d="scan'208";a="112619716" Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-1.cisco.com with ESMTP; 02 Dec 2008 22:52:53 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id mB2MqrLl031215; Tue, 2 Dec 2008 14:52:53 -0800 Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mB2MqriI005669; Tue, 2 Dec 2008 22:52:53 GMT Received: from xfe-sjc-211.amer.cisco.com ([171.70.151.174]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 2 Dec 2008 14:52:53 -0800 Received: from stealth-10-32-254-179.cisco.com ([10.32.254.179]) by xfe-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 2 Dec 2008 14:52:52 -0800 References: <200811260758.mAQ7wXhp017242@raisinbran.srv.cs.cmu.edu> <3F83E569A47C23246D97043F@minbar.fac.cs.cmu.edu> Message-Id: From: Richard Johnson To: Jeffrey Hutzelman In-Reply-To: <3F83E569A47C23246D97043F@minbar.fac.cs.cmu.edu> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Tue, 2 Dec 2008 14:52:51 -0800 X-Mailer: Apple Mail (2.929.2) X-OriginalArrivalTime: 02 Dec 2008 22:52:52.0707 (UTC) FILETIME=[B5385B30:01C954D0] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=4716; t=1228258373; x=1229122373; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=raj@cisco.com; z=From:=20Richard=20Johnson=20 |Subject:=20Re=3A=20[secdir]=20secdir=20review=20of=20draft -raj-dhc-tftp-addr-option-04 |Sender:=20; bh=4GDZzYvPgjMBLrwF1jeSzGPOJSyFUXyycDuIzfPXaYw=; b=qL4KvJeCu/OdkbNvkShiBhMWAnGY5J1vs6EFK0fZL7DCoitQcIfKyZH4u2 kdhNm00Wh3LFgWcc3igFuxusT3zkwGNiWOK1P4CcP0gyhs3U+xnnjiY7Tb2l e/bRJ4aDNm; Authentication-Results: sj-dkim-2; header.From=raj@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); X-Mailman-Approved-At: Wed, 03 Dec 2008 00:20:48 -0800 Cc: iesg@ietf.org, dhc-chairs@tools.ietf.org, Samuel Weiler , ietf@ietf.org, secdir@ietf.org Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org inline... On Dec 2, 2008, at 9:30 AM, Jeffrey Hutzelman wrote: > --On Wednesday, November 26, 2008 02:58:25 AM -0500 Samuel Weiler > wrote: > >> The security considerations section cites rogue DHCP servers as >> attack >> vectors, but doesn't do enough to encourage the use of DHCP Auth. > > In many deployments, DHCP is used by devices which have no prior > configuration, or at least no prior association with the network > operator. In such scenarios, DHCP auth is frequently impractical. > Instead, network operators take other measures to insure that only > replies from legitimate DHCP servers ever reach clients. For > example, they may configure switches to monitor and filter DHCP > traffic such that responses can only come from a small set of > trusted ports. I'm somewhat surprised that the document does not > mention this approach, as it is fairly common. Yes, in some cases this could be done. Since this applies to ALL DHCP options, it seems a little strange to point it out for this one as though it's a special case. I guess as long as the text makes it clear that this doesn't apply only to this one option, then it would make sense to add it. Do you have suggested text? > > > I believe there may also be some confusion as to the meaning of > option 66. This option has exactly the same semantics as the 'sname' > field in the bootp packet, and is used in the event that field is > overloaded to carry additional options. See RFC2132 sections 9.3, > 9.4, 9.5, and the description of the option overload option starting > at the bottom of page 23 of RFC2131. So, putting a name in option > 66 has exactly the same effect as putting it in the 'sname' field, > which is well-defined for BOOTP requests, but not so well defined > for DHCP replies (in fact, so far as I've been able to tell, neither > BOOTP nor DHCP has anything to say on the semantics of this field > other than that it's a "server host name", and calling option 66 > "TFTP server name" is really misleading, because sname didn't > actually mean that(*). Option 66 is called "TFTP server name" in the document because that's the name of the option. Quoting RFC2132: 9.4 TFTP server name This option is used to identify a TFTP server when the 'sname' field in the DHCP header has been used for DHCP options. The code for this option is 66, and its minimum length is 1. Code Len TFTP server +-----+-----+-----+-----+-----+--- | 66 | n | c1 | c2 | c3 | ... +-----+-----+-----+-----+-----+--- > > > In any case, the comment in the present document's security > considerations that use of a name rather than an address is "more > secure" is flawed in several ways. First, the DHCP server operator > has no control over what options an attacker sends; if an attacker > prefers to send and address, he can do so. Secondly, if a name is > used, the attacker need only send a name in a zone which he > controls; there is no need to subvert any part of the DNS. Yep, valid point. Do you have suggested replacement text? > I share Sam's confusion as to why a code point is needed here at > all. What purpose does this option serve that is not served by the > siaddr field? The document is following the instructions outlined in RFC3942: 2. Vendors that currently use one or more of the reclassified options have 6 months following this RFC's publication date to notify the DHC WG and IANA that they are using particular options numbers and agree to document that usage in an RFC. IANA will move these options from the "Unavailable" to "Tentatively Assigned" state. ... 4. For those options in the "Tentatively Assigned" state, vendors have 18 months following this RFC's publication date to submit an Internet-Draft documenting the option. The documented usage MUST be consistent with the existing usage. When the option usage is published as an RFC, IANA will move the option to the "Assigned" state. Finally, since RFC3942 specifically says the documentation of the usage "MUST be consistent with the existing usage", it would actually be violating RFC3942 if we were to add a mandate that the "DHCP Auth" option be used. /raj > > > -- Jeff > > > > (*) In fact, I've seen at least one widespread client implementation > that assumed that sname was the name of the server identified in the > siaddr field, and updated /etc/hosts so that sname would resolve to > siaddr. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 00:20:49 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2324328C0DB; Wed, 3 Dec 2008 00:20:49 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 184443A69FA; Tue, 2 Dec 2008 21:35:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.509 X-Spam-Level: X-Spam-Status: No, score=-2.509 tagged_above=-999 required=5 tests=[AWL=0.090, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FxfUpDznkzFK; Tue, 2 Dec 2008 21:34:59 -0800 (PST) Received: from eikenes.alvestrand.no (eikenes.alvestrand.no [158.38.152.233]) by core3.amsl.com (Postfix) with ESMTP id 135503A6A39; Tue, 2 Dec 2008 21:34:59 -0800 (PST) Received: from localhost (localhost [127.0.0.1]) by eikenes.alvestrand.no (Postfix) with ESMTP id 5078D39E538; Wed, 3 Dec 2008 06:34:13 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at eikenes.alvestrand.no Received: from eikenes.alvestrand.no ([127.0.0.1]) by localhost (eikenes.alvestrand.no [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7MWxYvkuOhvW; Wed, 3 Dec 2008 06:34:13 +0100 (CET) Received: from [192.168.1.54] (162.80-203-220.nextgentel.com [80.203.220.162]) by eikenes.alvestrand.no (Postfix) with ESMTPS id C55F939E3FF; Wed, 3 Dec 2008 06:34:12 +0100 (CET) Message-ID: <49361A7D.3090702@alvestrand.no> Date: Wed, 03 Dec 2008 06:34:53 +0100 From: Harald Tveit Alvestrand User-Agent: Thunderbird 2.0.0.17 (X11/20080925) MIME-Version: 1.0 To: Samuel Weiler References: <20081126175039.66E1128C0CE@core3.amsl.com> In-Reply-To: X-Mailman-Approved-At: Wed, 03 Dec 2008 00:20:48 -0800 Cc: ietf@ietf.org, secdir@ietf.org Subject: Re: [secdir] secdir review of draft-housley-iesg-rfc3932bis-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Samuel Weiler skrev: > On Wed, 26 Nov 2008, Russ Housley wrote: > >> 2. Independent submission informational RFC > ... >> Today, the IESG asks the RFC Editor to hold the rejected alternative >> until the standards-track document is in the RFC Editor queue, and >> the informational document will be published with a note indicating >> that a standards-track alternative is available in RFC xxxx. That is >> the point of the response you are questioning. > > Having jumped through some very slow hoops several years ago to get > some IANA assignments in a 'Specification Required' registry, I worry > about the substantive effects of delaying publication for this (or > any) reason, when delaying publication might cause codepoint > assignments to also be delayed. That said, the registration policy > for that particular registry has since changed, and I'm not sure what > other registries might be affected. (RFC4020 provides for early > allocation in Standards Action registries, but not Specification > Required registries.) > > I'm content to see this document be published as-is, but I'd welcome > thoughts on how to avoid blocking IANA assignments as a side effect of > publication delay. I thought the solution in the DLV case was useful, albeit not terribly so - publish a "specification" that didn't really specify anything, but got the codepoint, and then follow up with the real specification as an ind-sub when that was appropriate. Don't know if this particular delay mechanism was involved there, though. Harald _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 02:40:16 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8F46F28C0F7; Wed, 3 Dec 2008 02:40:16 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 348A23A6B62; Wed, 3 Dec 2008 02:40:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.521 X-Spam-Level: X-Spam-Status: No, score=-2.521 tagged_above=-999 required=5 tests=[AWL=0.078, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SPBn26SmtMMR; Wed, 3 Dec 2008 02:40:14 -0800 (PST) Received: from smtp.piuha.net (p130.piuha.net [IPv6:2001:14b8:400::130]) by core3.amsl.com (Postfix) with ESMTP id 60A103A6A74; Wed, 3 Dec 2008 02:40:14 -0800 (PST) Received: from smtp.piuha.net (localhost [127.0.0.1]) by smtp.piuha.net (Postfix) with ESMTP id D0BF0198782; Wed, 3 Dec 2008 12:40:09 +0200 (EET) Received: from [127.0.0.1] (unknown [IPv6:2001:14b8:400::130]) by smtp.piuha.net (Postfix) with ESMTP id 90B10198661; Wed, 3 Dec 2008 12:40:09 +0200 (EET) Message-ID: <493661F5.10705@piuha.net> Date: Wed, 03 Dec 2008 12:39:49 +0200 From: Jari Arkko User-Agent: Thunderbird 2.0.0.18 (X11/20081125) MIME-Version: 1.0 To: John C Klensin References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <56DEB14D23377D001B19EFE5@p3.int.jck.com> In-Reply-To: <56DEB14D23377D001B19EFE5@p3.int.jck.com> X-Virus-Scanned: ClamAV using ClamSMTP Cc: Richard Johnson , IETF Discussion , secdir@ietf.org, draft-raj-dhc-tftp-addr-option@tools.ietf.org, Ralph Droms , dhc Chairs , Samuel Weiler , IESG IESG Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I think John's advice is solid. We really need to document the properties of our specifications, including being very clear about the shortcomings and recommended workarounds. Truth in advertising. (However, I'd would avoid making mandatory-to-implement changes that do not match with codebase for a legacy option document such as this is.) I'm expecting a draft revision. Jari _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 03:16:04 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5082528C0F8; Wed, 3 Dec 2008 03:16:04 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C00F23A6BB0; Wed, 3 Dec 2008 03:16:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.659 X-Spam-Level: X-Spam-Status: No, score=-5.659 tagged_above=-999 required=5 tests=[AWL=0.940, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8CiXY8bXJ-Sc; Wed, 3 Dec 2008 03:16:00 -0800 (PST) Received: from rtp-iport-1.cisco.com (rtp-iport-1.cisco.com [64.102.122.148]) by core3.amsl.com (Postfix) with ESMTP id 549133A6B5A; Wed, 3 Dec 2008 03:16:00 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.33,708,1220227200"; d="scan'208";a="29832248" Received: from rtp-dkim-2.cisco.com ([64.102.121.159]) by rtp-iport-1.cisco.com with ESMTP; 03 Dec 2008 11:15:56 +0000 Received: from rtp-core-1.cisco.com (rtp-core-1.cisco.com [64.102.124.12]) by rtp-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id mB3BFtTP023167; Wed, 3 Dec 2008 06:15:55 -0500 Received: from xbh-rtp-211.amer.cisco.com (xbh-rtp-211.cisco.com [64.102.31.102]) by rtp-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mB3BFtQk013188; Wed, 3 Dec 2008 11:15:55 GMT Received: from xfe-rtp-201.amer.cisco.com ([64.102.31.38]) by xbh-rtp-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 3 Dec 2008 06:15:55 -0500 Received: from bxb-rdroms-8717.cisco.com ([10.98.10.88]) by xfe-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 3 Dec 2008 06:15:54 -0500 Message-Id: From: Ralph Droms To: John C Klensin In-Reply-To: <56DEB14D23377D001B19EFE5@p3.int.jck.com> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Wed, 3 Dec 2008 06:15:45 -0500 References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <56DEB14D23377D001B19EFE5@p3.int.jck.com> X-Mailer: Apple Mail (2.929.2) X-OriginalArrivalTime: 03 Dec 2008 11:15:55.0295 (UTC) FILETIME=[82836AF0:01C95538] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3063; t=1228302955; x=1229166955; c=relaxed/simple; s=rtpdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdroms@cisco.com; z=From:=20Ralph=20Droms=20 |Subject:=20Re=3A=20secdir=20review=20of=20draft-raj-dhc-tf tp-addr-option-04 |Sender:=20 |To:=20John=20C=20Klensin=20; bh=5xDkCriG10X0T1fzqt/tuszisKteGnNnXV3dG0BaDcY=; b=RVWKXRJ+kNT2Nfvrs9maC3u+hRBU15kTvzdiZrgRcroqj4or3ujqN2/nWE BWqz0h0YVrHJriJVslnr5qvrXUp4ZBt2aea++H5Zs+ByI5yXM5kmhTIlOPAB bYT1XWjK1z; Authentication-Results: rtp-dkim-2; header.From=rdroms@cisco.com; dkim=pass ( sig from cisco.com/rtpdkim2001 verified; ); Cc: Richard Johnson , IETF Discussion , secdir@ietf.org, Ralph Droms , dhc Chairs , Samuel Weiler , IESG IESG Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org John - guess I wasn't clear in my reply. I think it would be fine to include text suggesting the use of DHCP authentication. Mandating authentication would be, in my opinion, out of scope. To be clear, I don't see that there are, in practice, problems with the current deployment practice. RFC 3118 was published several years ago, but deployment practice today uses other methods to mitigate the risk of DHCP server spoofing attacks. Similar words about recommending the use of RFC 3118 authentication have been included in other RFCs, but RFC 3118 remains undeployed (and, in fact, mostly unimplemented). - Ralph On Dec 2, 2008, at Dec 2, 2008,3:53 PM, John C Klensin wrote: > > > --On Tuesday, 02 December, 2008 15:23 -0500 Ralph Droms > wrote: > >> Sam - I think most of the issues in your review of >> draft-raj-dhc-tftp-addr-option-04 can be resolved by reviewing >> the purposes of RFC 3942 and publishing Informational RFCs >> describing DHCP option codes. Fundamentally, the reason to >> publish RFCs under the process described in RFC 3942 is to >> document existing uses of option codes in the range of option >> codes reclaimed for assignment to new DHCP options. The >> concern is to avoid conflicts between new options and those >> grandfathered ("hijacked") option codes. As such, these RFCs >> (usually Informational) simply document the already >> ... >> Responding to some of your specific points: >> >>>> At the very least, I suggest mandating the use of DHCP Auth >>>> and removing the suggestion to use option 66 to enhance >>>> security. And, in the absence of a more data about how >>>> widely used this option is, I suggest not publishing this >>>> document at all. >> >> The consensus of the dhc WG, to which I concur, is to publish >> the document as Informational. The text in the Security >> Considerations section about option 66 might be removed. >> ... >> To reiterate, it's not so much a question of whether a new >> code point is needed; rather, according to the procedures >> described in RFC 3942, this document gives a description of an >> existing use of option code 150. That option code is in use >> ... > > Ralph, > > It seems to me that there is a middle ground here. One can > stick with Informational publication as the WG intends, but > still modify the Security Considerations section, not only to > remove the reference to option 66 (if there is consensus that is > appropriate) but to add some explanation about why the use of > this option without authentication might be problematic. > > Put differently, your objection to Sam's suggestion seems to > hinge on "just describe the existing practice, don't try to > change it in this document". Given RFC 3492, that is entirely > reasonable. But, if there are relatively obvious difficulties > with that practice, it seems to me that documenting them would > be helpful (indeed that not doing so borders on irresponsible). > > john > > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 03:29:23 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C24C93A6BD2; Wed, 3 Dec 2008 03:29:23 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B8453A6BC1; Wed, 3 Dec 2008 03:29:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.793 X-Spam-Level: X-Spam-Status: No, score=-5.793 tagged_above=-999 required=5 tests=[AWL=0.806, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eS5ZK8S1LCZH; Wed, 3 Dec 2008 03:29:21 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 63D363A67D8; Wed, 3 Dec 2008 03:29:21 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.33,708,1220227200"; d="scan'208";a="205713712" Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-6.cisco.com with ESMTP; 03 Dec 2008 11:29:17 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id mB3BTGEQ015425; Wed, 3 Dec 2008 03:29:16 -0800 Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mB3BTBWd029869; Wed, 3 Dec 2008 11:29:16 GMT Received: from xfe-rtp-202.amer.cisco.com ([64.102.31.21]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 3 Dec 2008 06:29:12 -0500 Received: from bxb-rdroms-8717.cisco.com ([10.98.10.88]) by xfe-rtp-202.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 3 Dec 2008 06:29:11 -0500 Message-Id: From: Ralph Droms To: Jari Arkko In-Reply-To: <493661F5.10705@piuha.net> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Wed, 3 Dec 2008 06:29:05 -0500 References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <56DEB14D23377D001B19EFE5@p3.int.jck.com> <493661F5.10705@piuha.net> X-Mailer: Apple Mail (2.929.2) X-OriginalArrivalTime: 03 Dec 2008 11:29:12.0240 (UTC) FILETIME=[5D879300:01C9553A] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3059; t=1228303756; x=1229167756; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=rdroms@cisco.com; z=From:=20Ralph=20Droms=20 |Subject:=20Re=3A=20secdir=20review=20of=20draft-raj-dhc-tf tp-addr-option-04 |Sender:=20; bh=OJ4Zet+4kFENL0h4JQfQ1pFv2oAmqcZ+1j1YwZgaljw=; b=BLzgguHyperXmjzMYbab8BUNlPoXoSIsdxefC4ITa59pRFqiOwPbKvePIS 0P8L8liTkAz/C+t8yBhwhI4Z8ThfShFJzeFbmUAbltLnSqaRXLWaFaUAozlD Us3IRnWSuZ; Authentication-Results: sj-dkim-3; header.From=rdroms@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); Cc: Richard Johnson , IETF Discussion , secdir@ietf.org, draft-raj-dhc-tftp-addr-option@tools.ietf.org, Ralph Droms , dhc Chairs , Samuel Weiler , IESG IESG , John C Klensin Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Jari - I agree that mentioning security issues, pointing to the Security Considerations in RFC 2131 and citing RFC 3118, is appropriate. Responding to Richard... On Dec 2, 2008, at Dec 2, 2008,5:35 PM, Richard Johnson wrote: > Ok, maybe I'm not understanding what's being suggested or maybe I'm > simply reading the existing text in a different way. Here's the > contents of the draft's "Security Considerations" section: > >> A rogue DHCP Server could use this option in order to coerce a >> Client >> into downloading configuration from an alternate Configuration >> Server >> and thus gain control of the device's configuration. This is more >> easily done with the VoIP Configuration Server Address option >> than it >> was with the "TFTP Server Name" option, because in the latter case >> the attack would need to control DNS responses as well as inserting >> the rogue DHCP option information. If this is a concern, then >> either >> DHCP Authentication may be used, or the "TFTP Server Name" option >> may >> be used instead. >> >> Message authentication in DHCP for intradomain use where the out- >> of- >> band exchange of a shared secret is feasible is defined in >> [RFC3118]. >> Potential exposures to attack are discussed in section 7 of the >> DHCP >> protocol specification in [RFC2131]. >> >> Other out-of-band methods of verifying the validity of the VoIP >> Configuration Server Address, such as certificates of trust, >> could be >> used to mitigate some security concerns. > > So, it only mentions option 66 ("TFTP Server Name" option) by > comparison and in order to point out the relative levels of security > involved. It has no "suggestion to use option 66". > > The text already has an "explanation about why the use of this > option without authentication might be problematic". As a matter of > fact, it seems rather explicit on the matter. I suggest we elide the first paragraph Richard quoted, and leave the remainder unchanged ... except for fixing what appears to be a typo in the first sentence of the second paragraph: s/is feasible is/is feasible as/ Jeff Hutzelman mentioned other common techniques for mitigating the risk from DHCP server spoofing attacks, which have not, to date, been mentioned in any other DHCP RFCs. If there is serious interest in a review of DHCP security practices, the dhc WG could return to its work on a DHCP threat analysis and BCP for threat mitigation. On Dec 3, 2008, at Dec 3, 2008,5:39 AM, Jari Arkko wrote: > I think John's advice is solid. We really need to document the > properties of our specifications, including being very clear about > the shortcomings and recommended workarounds. Truth in advertising. > (However, I'd would avoid making mandatory-to-implement changes that > do not match with codebase for a legacy option document such as this > is.) > > I'm expecting a draft revision. > > Jari > - Ralph _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 06:57:54 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E2EC03A68C5; Wed, 3 Dec 2008 06:57:54 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7AC9F3A689C for ; Wed, 3 Dec 2008 06:57:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.774 X-Spam-Level: X-Spam-Status: No, score=-6.774 tagged_above=-999 required=5 tests=[AWL=-0.175, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d1MEXJEbcAUt for ; Wed, 3 Dec 2008 06:57:52 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id 7AF263A68C5 for ; Wed, 3 Dec 2008 06:57:52 -0800 (PST) Received: from [192.168.15.166] (bethany.ncsl.nist.gov [129.6.52.15]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id mB3Evgc3020519; Wed, 3 Dec 2008 09:57:42 -0500 Mime-Version: 1.0 (Apple Message framework v753.1) Message-Id: <6A70E9ED-F0BF-40F7-955B-C44B04917D73@nist.gov> From: Tim Polk Date: Wed, 3 Dec 2008 09:57:59 -0500 To: secdir@ietf.org X-Mailer: Apple Mail (2.753.1) X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: tim.polk@nist.gov Subject: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Folks, After delaying for weeks, I am finally getting into my reviews of nfsv4.1 and the supporting documents for this Thursday's telechat. I have encountered one particularly troubling aspect: the mandatory to implement security mechanisms seem to be rather weak, and some aspects are unspecified. The mandatory security mechanisms are Kerberos, LIPKEY and SPKM-3. REPCSEC_GSS can be used to negotiate other mechanisms, but my immediate concern is the mandatory to implements. draft-ietf-nfsv4-minorversion1 provides no information about the algorithms to be used, so I fell back to RFC 3530 (NFSv4) to try to sort this out. Kerberos is certainly well-specified for an acceptable range of algorithms, but as I understand RFC 3530, the krb5, krb5i and krb5p pseudo flavors rely on DES and MD5 for security services. (Perhaps I am misreading this, and the implication is that DES and MD5 are the mandatory to implement algorithms, but that still would be unacceptable in my mind.) The LIPKEY and SPKM-3 mechanisms are only defined with respect to a small number of algorithms, and most of them are weak. The mandatory to implement for LIPKEY seems to be MD5 and Cast5 (a.k.a., CAST-128) if I understand RFC 3530 correctly. SPKM-3 (and by extension, LIPKEY) is specified for DES and CAST5 as encryption algorithms and MD5-RSA, DES-MAC, DSA-SHA1, HMAC-MD5, and SHA1-RSA are the only integrity algorithms. There are also no restrictions or guidance with respect to key sizes for DSA or RSA. Some of this could probably be handled in the security considerations (e.g., RSA and DSA key sizes), but some of the issues strike me as fundamental. As I have interpreted the text, there is no mandatory to implement security mechanism in nfsv4.1 that provides a reasonable level of cryptographic security. Am I missing something? Any feedback would be appreciated! Thanks, Tim Polk _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 09:19:01 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 351A03A68B4; Wed, 3 Dec 2008 09:19:01 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 172C73A6B53 for ; Wed, 3 Dec 2008 09:19:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2vAArBYD97lJ for ; Wed, 3 Dec 2008 09:18:59 -0800 (PST) Received: from jackfruit.srv.cs.cmu.edu (JACKFRUIT.SRV.CS.CMU.EDU [128.2.201.16]) by core3.amsl.com (Postfix) with ESMTP id 17CA83A67E2 for ; Wed, 3 Dec 2008 09:18:58 -0800 (PST) Received: from 99-205-118-9.pools.spcsdns.net (ATLANTIS-HOME.PC.CS.CMU.EDU [128.2.184.185]) (authenticated bits=0) by jackfruit.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id mB3HIpb4003929 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 3 Dec 2008 12:18:52 -0500 (EST) Date: Wed, 03 Dec 2008 12:18:51 -0500 From: Jeffrey Hutzelman To: Tim Polk , secdir@ietf.org Message-ID: In-Reply-To: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> References: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.201.16 Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Wednesday, December 03, 2008 09:57:59 AM -0500 Tim Polk wrote: > The mandatory security mechanisms are Kerberos, LIPKEY and SPKM-3. > REPCSEC_GSS can be used to negotiate other mechanisms, but my > immediate concern is the mandatory to implements. > Kerberos is certainly well-specified for an acceptable range of > algorithms, > but as I understand RFC 3530, the krb5, krb5i and krb5p pseudo flavors > rely on DES and MD5 for security services. (Perhaps I am misreading > this, and the implication is that DES and MD5 are the mandatory to > implement algorithms, but that still would be unacceptable in my mind.) In this case, it matters which references you follow. RFC3530 (nfsv4) refers to RFC1964 (krb5-GSS), which refers to RFC1510 (krb5). In that version of krb5, the mandatory-to-implement enctype was DES-CBC-MD5. In nfsv4-minorversion1, the krb5-gss reference is to RFC4121, which refers in turn to RFC4120 (krb5), in which the mandatory-to-implement enctype is AES256-CTS-HMAC-SHA1-96, which should be plenty strong enough. > The LIPKEY and SPKM-3 mechanisms are only defined with respect to a > small number of algorithms, and most of them are weak. The mandatory > to implement for LIPKEY seems to be MD5 and Cast5 (a.k.a., CAST-128) > if I understand RFC 3530 correctly. SPKM-3 (and by extension, LIPKEY) > is specified for DES and CAST5 as encryption algorithms and MD5-RSA, > DES-MAC, DSA-SHA1, HMAC-MD5, and SHA1-RSA are the only integrity > algorithms. There are also no restrictions or guidance with respect to > key > sizes for DSA or RSA. I don't know the current thinking on this among people working on NFSv4, but I believe that draft-zhu-pku2u-09.txt intends to be a successor to SPKM-3 in this space. Unfortunately, while I think it's nearly ready for last call (and I should have a writeup to you shortly, if I still think so after a final review), it's lagging a bit behind NFSv4.1 in that respect. -- Jeff _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 10:05:28 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 78A593A68B4; Wed, 3 Dec 2008 10:05:28 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7D1493A68B4 for ; Wed, 3 Dec 2008 10:05:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.831 X-Spam-Level: X-Spam-Status: No, score=-5.831 tagged_above=-999 required=5 tests=[AWL=0.215, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PVEmLEdrx7p6 for ; Wed, 3 Dec 2008 10:05:25 -0800 (PST) Received: from sca-ea-mail-3.sun.com (sca-ea-mail-3.Sun.COM [192.18.43.21]) by core3.amsl.com (Postfix) with ESMTP id 8F71F3A683F for ; Wed, 3 Dec 2008 10:05:25 -0800 (PST) Received: from dm-central-02.central.sun.com ([129.147.62.5]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mB3I5LXN029094 for ; Wed, 3 Dec 2008 18:05:21 GMT Received: from binky.Central.Sun.COM (binky.Central.Sun.COM [129.153.128.104]) by dm-central-02.central.sun.com (8.13.8+Sun/8.13.8/ENSMAIL, v2.2) with ESMTP id mB3I5KKI016285 for ; Wed, 3 Dec 2008 11:05:21 -0700 (MST) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3) with ESMTP id mB3HnL0Y024684; Wed, 3 Dec 2008 11:49:24 -0600 (CST) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.3+Sun/8.14.3/Submit) id mB3HnDjE024683; Wed, 3 Dec 2008 11:49:13 -0600 (CST) X-Authentication-Warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f Date: Wed, 3 Dec 2008 11:49:13 -0600 From: Nicolas Williams To: Jeffrey Hutzelman Message-ID: <20081203174912.GH22970@Sun.COM> References: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> Mime-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.7i Cc: Tim Polk , secdir@ietf.org Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Wed, Dec 03, 2008 at 12:18:51PM -0500, Jeffrey Hutzelman wrote: > --On Wednesday, December 03, 2008 09:57:59 AM -0500 Tim Polk > wrote: > > >The LIPKEY and SPKM-3 mechanisms are only defined with respect to a > >small number of algorithms, and most of them are weak. The > >mandatory to implement for LIPKEY seems to be MD5 and Cast5 (a.k.a., > >CAST-128) if I understand RFC 3530 correctly. SPKM-3 (and by > >extension, LIPKEY) is specified for DES and CAST5 as encryption > >algorithms and MD5-RSA, DES-MAC, DSA-SHA1, HMAC-MD5, and SHA1-RSA are > >the only integrity algorithms. There are also no restrictions or > >guidance with respect to key sizes for DSA or RSA. Worse, LIPKEY and SPKM-3 implementations are hard to find, impossible to find in real-world deployments, and, as Jeff says: > I don't know the current thinking on this among people working on NFSv4, > but I believe that draft-zhu-pku2u-09.txt intends to be a successor to > SPKM-3 in this space. Unfortunately, while I think it's nearly ready for > last call (and I should have a writeup to you shortly, if I still think so > after a final review), it's lagging a bit behind NFSv4.1 in that respect. PKU2U will replace SPKM-3. PKU2U makes LIPKEY-based-on-PKU2U much more likely to be deployed. Which means that the dependency of LIPKEY, though very shaky *now*, is likely to be a good one down the line. Today the only GSS-API mechanism in use in real-world NFSv4 deployments of NFSv4 is Kerberos V, in its RFC4121 form (meaning with support for AES). Nico -- _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 10:11:17 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4DBEC3A6925; Wed, 3 Dec 2008 10:11:17 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED68F3A68B4 for ; Wed, 3 Dec 2008 10:11:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[AWL=2.000, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FwvBbbUadXxw for ; Wed, 3 Dec 2008 10:11:14 -0800 (PST) Received: from mail-out3.apple.com (mail-out3.apple.com [17.254.13.22]) by core3.amsl.com (Postfix) with ESMTP id 5EEE03A68D3 for ; Wed, 3 Dec 2008 10:10:58 -0800 (PST) Received: from relay11.apple.com (relay11.apple.com [17.128.113.48]) by mail-out3.apple.com (Postfix) with ESMTP id 626EC473A0C7; Wed, 3 Dec 2008 10:10:54 -0800 (PST) Received: from relay11.apple.com (unknown [127.0.0.1]) by relay11.apple.com (Symantec Brightmail Gateway) with ESMTP id 4903E28081; Wed, 3 Dec 2008 10:10:54 -0800 (PST) X-AuditID: 11807130-ad31dbb000000eb5-a1-4936cbae6646 Received: from hummel.apple.com (hummel.apple.com [17.202.43.223]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by relay11.apple.com (Apple SCV relay) with ESMTP id 2E8192807E; Wed, 3 Dec 2008 10:10:54 -0800 (PST) Message-Id: From: =?ISO-8859-1?Q?Love_H=F6rnquist_=C5strand?= To: Tim Polk In-Reply-To: <6A70E9ED-F0BF-40F7-955B-C44B04917D73@nist.gov> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Wed, 3 Dec 2008 10:10:53 -0800 References: <6A70E9ED-F0BF-40F7-955B-C44B04917D73@nist.gov> X-Mailer: Apple Mail (2.929.2) X-Brightmail-Tracker: AAAAAA== Cc: "secdir@ietf.org" Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org 3 dec 2008 kl. 06.57 skrev Tim Polk: > The LIPKEY and SPKM-3 LIPKEY and SPKM-3 is close to impossible to implement in a interopable way and is way underspecified. Just forget about them. Love _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 10:23:37 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E58DA3A6B7B; Wed, 3 Dec 2008 10:23:37 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 600D93A6B64 for ; Wed, 3 Dec 2008 10:23:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.687 X-Spam-Level: X-Spam-Status: No, score=-6.687 tagged_above=-999 required=5 tests=[AWL=-0.087, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W8+StZqdKxZh for ; Wed, 3 Dec 2008 10:23:35 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id 6031B3A6B79 for ; Wed, 3 Dec 2008 10:23:35 -0800 (PST) Received: from [192.168.15.166] (bethany.ncsl.nist.gov [129.6.52.15]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id mB3INOh3002336; Wed, 3 Dec 2008 13:23:25 -0500 In-Reply-To: References: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> Mime-Version: 1.0 (Apple Message framework v753.1) Message-Id: <666E6308-77E3-40A6-8BCB-4BB47F9A210F@nist.gov> From: Tim Polk Date: Wed, 3 Dec 2008 13:23:40 -0500 To: Jeffrey Hutzelman X-Mailer: Apple Mail (2.753.1) X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: tim.polk@nist.gov Cc: secdir@ietf.org Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Jeff, Thanks for the clarifications! Since 3530 explicitly called out DES and MD5, and nfsv4-minorversion1 did not explicitly call out anything, I failed to note the all-important reference update! That is *exactly* what I was looking for - at least one mandatory to implement mechanism that had reasonable cryptographic security. The weakness of SPKM-3 and LIPKEY is less of a concern as a result, but probably needs to be sorted in the future. At least we don't need to block this document see the referenced Kerberos suite is acceptable. I suspect the security considerations will need to be expanded to address this topic, though. Thanks, Tim On Dec 3, 2008, at 12:18 PM, Jeffrey Hutzelman wrote: > --On Wednesday, December 03, 2008 09:57:59 AM -0500 Tim Polk > wrote: > >> The mandatory security mechanisms are Kerberos, LIPKEY and SPKM-3. >> REPCSEC_GSS can be used to negotiate other mechanisms, but my >> immediate concern is the mandatory to implements. > >> Kerberos is certainly well-specified for an acceptable range of >> algorithms, >> but as I understand RFC 3530, the krb5, krb5i and krb5p pseudo >> flavors >> rely on DES and MD5 for security services. (Perhaps I am misreading >> this, and the implication is that DES and MD5 are the mandatory to >> implement algorithms, but that still would be unacceptable in my >> mind.) > > In this case, it matters which references you follow. > RFC3530 (nfsv4) refers to RFC1964 (krb5-GSS), which refers to > RFC1510 (krb5). In that version of krb5, the mandatory-to- > implement enctype was DES-CBC-MD5. > > In nfsv4-minorversion1, the krb5-gss reference is to RFC4121, which > refers in turn to RFC4120 (krb5), in which the mandatory-to- > implement enctype is AES256-CTS-HMAC-SHA1-96, which should be > plenty strong enough. > >> The LIPKEY and SPKM-3 mechanisms are only defined with respect to a >> small number of algorithms, and most of them are weak. The >> mandatory >> to implement for LIPKEY seems to be MD5 and Cast5 (a.k.a., CAST-128) >> if I understand RFC 3530 correctly. SPKM-3 (and by extension, >> LIPKEY) >> is specified for DES and CAST5 as encryption algorithms and MD5-RSA, >> DES-MAC, DSA-SHA1, HMAC-MD5, and SHA1-RSA are the only integrity >> algorithms. There are also no restrictions or guidance with >> respect to >> key >> sizes for DSA or RSA. > > I don't know the current thinking on this among people working on > NFSv4, but I believe that draft-zhu-pku2u-09.txt intends to be a > successor to SPKM-3 in this space. Unfortunately, while I think > it's nearly ready for last call (and I should have a writeup to you > shortly, if I still think so after a final review), it's lagging a > bit behind NFSv4.1 in that respect. > > -- Jeff _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 10:31:57 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F6DE3A67E4; Wed, 3 Dec 2008 10:31:57 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D3AF3A67E4 for ; Wed, 3 Dec 2008 10:31:56 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o3x84BdC3523 for ; Wed, 3 Dec 2008 10:31:55 -0800 (PST) Received: from balder-227.proper.com (properopus-pt.tunnel.tserv3.fmt2.ipv6.he.net [IPv6:2001:470:1f04:392::2]) by core3.amsl.com (Postfix) with ESMTP id 0A1EE3A67E2 for ; Wed, 3 Dec 2008 10:31:54 -0800 (PST) Received: from [10.20.30.158] (sn81.proper.com [75.101.18.81]) (authenticated bits=0) by balder-227.proper.com (8.14.2/8.14.2) with ESMTP id mB3IVlJS081852 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 3 Dec 2008 11:31:48 -0700 (MST) (envelope-from phoffman@imc.org) Mime-Version: 1.0 Message-Id: In-Reply-To: <666E6308-77E3-40A6-8BCB-4BB47F9A210F@nist.gov> References: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> <666E6308-77E3-40A6-8BCB-4BB47F9A210F@nist.gov> Date: Wed, 3 Dec 2008 10:31:46 -0800 To: Tim Polk From: Paul Hoffman Cc: secdir@ietf.org Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org At 1:23 PM -0500 12/3/08, Tim Polk wrote: >Since 3530 explicitly called out DES and MD5, and nfsv4-minorversion1 did not >explicitly call out anything, I failed to note the all-important reference update! ...which means that implementers might miss it as well. Maybe an explicit mention of the dereferenced mandatory-to-implement crypto in the base spec would be a good thing. >The weakness of SPKM-3 and LIPKEY is less of a concern as a result, but >probably needs to be sorted in the future. Why not now? You just had two implementers say that it was bad; why even let implementers have to consider it? _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 10:57:25 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E6733A68AB; Wed, 3 Dec 2008 10:57:25 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 800513A68AB for ; Wed, 3 Dec 2008 10:57:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.677 X-Spam-Level: X-Spam-Status: No, score=-6.677 tagged_above=-999 required=5 tests=[AWL=-0.078, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XWFHEnPfnlcA for ; Wed, 3 Dec 2008 10:57:23 -0800 (PST) Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by core3.amsl.com (Postfix) with ESMTP id 90DE33A67E2 for ; Wed, 3 Dec 2008 10:57:23 -0800 (PST) Received: from [192.168.15.166] (bethany.ncsl.nist.gov [129.6.52.15]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id mB3IvD3A015594; Wed, 3 Dec 2008 13:57:13 -0500 In-Reply-To: References: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> <666E6308-77E3-40A6-8BCB-4BB47F9A210F@nist.gov> Mime-Version: 1.0 (Apple Message framework v753.1) Message-Id: From: Tim Polk Date: Wed, 3 Dec 2008 13:57:30 -0500 To: Paul Hoffman X-Mailer: Apple Mail (2.753.1) X-NIST-MailScanner: Found to be clean X-NIST-MailScanner-From: tim.polk@nist.gov Cc: secdir@ietf.org Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi Paul, On Dec 3, 2008, at 1:31 PM, Paul Hoffman wrote: > At 1:23 PM -0500 12/3/08, Tim Polk wrote: >> Since 3530 explicitly called out DES and MD5, and nfsv4- >> minorversion1 did not >> explicitly call out anything, I failed to note the all-important >> reference update! > > ...which means that implementers might miss it as well. Maybe an > explicit mention of the dereferenced mandatory-to-implement crypto > in the base spec would be a good thing. Yes, I will suggest it, but I probably don't need to consider it blocking... > >> The weakness of SPKM-3 and LIPKEY is less of a concern as a >> result, but >> probably needs to be sorted in the future. > > Why not now? You just had two implementers say that it was bad; why > even let implementers have to consider it? What I meant was having a strong mandatory to implement mechanism (the 4121 solution) makes this pair of weak mandatory to implement mechanisms less of a concern. If the implementations don't actually support these mechanisms, and they are under specified to boot, then that is a different sort of problem. It sounds like LIPKEY and SPKM-3 should either be specified as optional or removed entirely. Thanks, Tim _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 3 11:39:20 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 957663A68CC; Wed, 3 Dec 2008 11:39:20 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 969A33A68CC for ; Wed, 3 Dec 2008 11:39:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7wYjDSlXna2N for ; Wed, 3 Dec 2008 11:39:19 -0800 (PST) Received: from jackfruit.srv.cs.cmu.edu (JACKFRUIT.SRV.CS.CMU.EDU [128.2.201.16]) by core3.amsl.com (Postfix) with ESMTP id C91C63A67ED for ; Wed, 3 Dec 2008 11:39:18 -0800 (PST) Received: from MINBAR.FAC.CS.CMU.EDU (MINBAR.FAC.CS.CMU.EDU [128.2.216.42]) (authenticated bits=0) by jackfruit.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id mB3JdCDh010344 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 3 Dec 2008 14:39:12 -0500 (EST) Date: Wed, 03 Dec 2008 14:39:12 -0500 From: Jeffrey Hutzelman To: Tim Polk , Paul Hoffman Message-ID: In-Reply-To: <200812031857.mB3IvOVx022542@toasties.srv.cs.cmu.edu> References: <200812031457.mB3EvrJZ023672@grapenut.srv.cs.cmu.edu> <666E6308-77E3-40A6-8BCB-4BB47F9A210F@nist.gov> <200812031857.mB3IvOVx022542@toasties.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.201.16 Cc: secdir@ietf.org Subject: Re: [secdir] Question about NFSv4/NFSv4.1 crypto support X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Wednesday, December 03, 2008 01:57:30 PM -0500 Tim Polk wrote: > Hi Paul, > > On Dec 3, 2008, at 1:31 PM, Paul Hoffman wrote: > >> At 1:23 PM -0500 12/3/08, Tim Polk wrote: >>> Since 3530 explicitly called out DES and MD5, and nfsv4- >>> minorversion1 did not >>> explicitly call out anything, I failed to note the all-important >>> reference update! >> >> ...which means that implementers might miss it as well. Maybe an >> explicit mention of the dereferenced mandatory-to-implement crypto >> in the base spec would be a good thing. > > Yes, I will suggest it, but I probably don't need to consider it > blocking... I agree. The truth is that implementors don't actually have to do anything here; they don't even really have much control over what enctype gets used. Unless your implementation is an embedded box where you get to choose what Kerberos libraries you get, which admittedly will be a common case for NFSv4 implementations. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 4 00:08:00 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 88F833A68F3; Thu, 4 Dec 2008 00:08:00 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 170233A68F3 for ; Thu, 4 Dec 2008 00:07:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.081 X-Spam-Level: X-Spam-Status: No, score=-2.081 tagged_above=-999 required=5 tests=[AWL=0.518, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OzZIVGngzI8N for ; Thu, 4 Dec 2008 00:07:59 -0800 (PST) Received: from mail.gmx.net (mail.gmx.net [213.165.64.20]) by core3.amsl.com (Postfix) with SMTP id 7F67B3A68E7 for ; Thu, 4 Dec 2008 00:07:58 -0800 (PST) Received: (qmail invoked by alias); 04 Dec 2008 08:01:12 -0000 Received: from a91-154-105-43.elisa-laajakaista.fi (EHLO 4FIL42860) [91.154.105.43] by mail.gmx.net (mp060) with SMTP; 04 Dec 2008 09:01:12 +0100 X-Authenticated: #29516787 X-Provags-ID: V01U2FsdGVkX1/wMBNbx6DwsElcDxq9LB00iULVhKsNwdA+cjpGaw ppamW8Nsg0miOF From: "Hannes Tschofenig" To: Date: Thu, 4 Dec 2008 10:04:16 +0200 Message-ID: <012d01c955e6$e81689c0$3258a20a@nsnintra.net> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 Thread-Index: AclV5ub2iYQ7L9ESSIKrZPcVEhv+Jg== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Y-GMX-Trusted: 0 X-FuHaFi: 0.58 Cc: iesg@ietf.org, shepler@storspeed.com, fridella_stephen@emc.com, black_david@emc.com, jglasgow@aya.yale.edu Subject: [secdir] sec-dir review of draft-ietf-nfsv4-pnfs-block-10.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I have to say that I am not an NFS expert and the size of NFS related documents is scary. Anyway, draft-ietf-nfsv4-pnfs-block-10.txt provides an optimization to NFSv4.1 to "to allow clients to directly access file data on the storage used by the NFSv4 server.". draft-ietf-nfsv4-minorversion1-26.txt already introduces the concept (in Section 12) and this document illustrates how to use it for block/volume layouts. As such, draft-ietf-nfsv4-pnfs-block-10.txt builds heavily on draft-ietf-nfsv4-minorversion1-26.txt and therefore a lot of the transport and security related features are inherited. Figure 1 of draft-ietf-nfsv4-pnfs-block-10.txt illustrates the architecture quite nicely and the authors of the document do a good job of describing the consequences with regard to security. In short, when clients access the storage systems directly then the security properties are not only dependent on the usage of NFSv4.1 anymore but also on the storage protocol used between clients and the storage system. The used storage protocol may or may not provide the desired security capabilities. This includes communcation security as well as access control. This may sound dramatic. However, it is a matter of deployment and the administrator of the system needs to make a decision about what is acceptable. Consequently, in certain setups clients have to be trusted to a high degree and communication security between the clients and the storage system may need to rely on physical security. As such, I don't have problem with the chosen approach also given that the concept is already introduced the main NFSv4.1 specification (a separate security consideration section is also available in Section 12.9 of draft-ietf-nfsv4-minorversion1-26.txt). A few minor comments / questions: * Figure 1 in draft-ietf-nfsv4-minorversion1-26.txt also includes a description of the communication between the clients and the storage device and between the storage devices and the servers. This description is missing in Figure 1 of draft-ietf-nfsv4-pnfs-block-10.txt. Very likely a copy-and-paste error. * In Section 2.2.1 volume identification is described and it is noted that content-based identification would be necessary. I am not quite sure what that means. I suspect that you are talking about using an opaque string as identification rather than something like a IP address and port. Right? * Typo in last paragraph of page 20: s/SEQUEUNCE/SEQUENCE/ Ciao Hannes _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 4 02:07:16 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B65253A68C2; Thu, 4 Dec 2008 02:07:16 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C371F3A6893; Thu, 4 Dec 2008 02:07:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.249 X-Spam-Level: X-Spam-Status: No, score=-3.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gAQ2Y0HCExCl; Thu, 4 Dec 2008 02:07:13 -0800 (PST) Received: from leela.webpack.hosteurope.de (leela.webpack.hosteurope.de [217.115.142.65]) by core3.amsl.com (Postfix) with ESMTP id 4EA383A6832; Thu, 4 Dec 2008 02:07:13 -0800 (PST) Received: from [58.32.235.98] (helo=[10.5.5.14]); authenticated by leela.webpack.hosteurope.de running ExIM using esmtpa id 1L8B6s-0002Uz-D6; Thu, 04 Dec 2008 11:07:02 +0100 Message-ID: <49379DC2.8000609@gondrom.org> Date: Thu, 04 Dec 2008 10:07:14 +0100 From: Tobias Gondrom User-Agent: Thunderbird 2.0.0.18 (X11/20081112) MIME-Version: 1.0 To: secdir@ietf.org, erosen@cisco.com, iesg@ietf.org, aboers@cisco.com X-bounce-key: webpack.hosteurope.de; tobias.gondrom@gondrom.org; 1228385229; ffa43c66; Cc: rcallon@juniper.net, venaas@uninett.no, mmcbride@cisco.com, dward@cisco.com Subject: [secdir] sec-dir review of draft-ietf-pim-rpf-vector-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The draft security consideration refers to the sec considerations of the underlying PIM-SM Specification (RFC4601). This is ok, as it is build on top and as far as I can see no new further security problems (in addition to the existing ones for PIM-SM) have been introduced by the use of the RPF vector TLV. (However I did not re-review the PIM-SM Specification RFC (RFC4601) and its sec consideration section for its correctness. One other remark: Before publication you MUST re-check idnits for the document as several of the references need update, most importantly the normative reference to ID draft-ietf-pim-join-attributes can be updated to use the correct RFC 5384 (otherwise it would have had to be changed to informative. Best regards, Tobias _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 4 08:01:46 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D3B2C28C10B; Thu, 4 Dec 2008 08:01:46 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 40AFD28C0EE; Thu, 4 Dec 2008 08:01:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.426 X-Spam-Level: X-Spam-Status: No, score=-2.426 tagged_above=-999 required=5 tests=[AWL=-0.054, BAYES_00=-2.599, SARE_SUB_OBFU_Q1=0.227] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3eYkoGgF7l-V; Thu, 4 Dec 2008 08:01:44 -0800 (PST) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by core3.amsl.com (Postfix) with ESMTP id 08C6628C0E4; Thu, 4 Dec 2008 08:01:43 -0800 (PST) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.13.5/8.13.5) with ESMTP id mB4G1QLs028289; Thu, 4 Dec 2008 10:01:26 -0600 Received: from nemo.columbia.ads.sparta.com (nemo.columbia.sparta.com [157.185.80.75]) by Beta5.sparta.com (8.12.11/8.13.1) with ESMTP id mB4G1PuW009916; Thu, 4 Dec 2008 10:01:25 -0600 Received: from SANDYM-LT.columbia.ads.sparta.com ([157.185.81.132]) by nemo.columbia.ads.sparta.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.3959); Thu, 4 Dec 2008 11:01:25 -0500 Date: Thu, 4 Dec 2008 11:01:24 -0500 (Eastern Standard Time) From: Sandra Murphy To: secdir@ietf.org, iesg@ietf.org, roll-chairs@tools.ietf.org, mischa.dohler@cttc.es, thomas.watteyne@ieee.org, tim.winter@ekasystems.com, Dominique.Barthel@orange-ftgroup.com, christian.jacquenet@orange-ftgroup.com Message-ID: X-X-Sender: sandy@nemo.columbia.sparta.com MIME-Version: 1.0 X-OriginalArrivalTime: 04 Dec 2008 16:01:25.0053 (UTC) FILETIME=[8F0ECED0:01C95629] Subject: [secdir] secdir review of draft-ietf-roll-urban-routing-reqs-02 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The document covers the requirements for routing in low power and lossy networks in urban environments. It covers the basics of that territory, defining terms and limitations of the networks being considered, and the requirements that produces for routing in that setting. The security considerations section covers the services that one would expect to see covered. Unfortunately, I was continually confused as to whether the discussion of security requirements was focused on the security of the routing or the security of the data that was being routed. The following text from the security considerations section is an example: A secure communication in a wireless network encompasses three main elements, i.e. confidentiality (encryption of data), integrity (correctness of data), and authentication (legitimacy of data). Authentication can e.g. be violated if external sources insert incorrect data packets; integrity can e.g. be violated if nodes start to break down and hence commence measuring and relaying data incorrectly. Nonetheless, some sensor readings as well as the actuator control signals need to be confidential. There are concerns in routing protocols about the authenticity and integrity of the contents of the routing protocol messages - the *control* data, not the sensor and actuator data. A need for confidentiality of the routing protocol message content is not as generally accepted, and this paragraph seems to be considering the confidentiality of the data traffic, not the control traffic. Later the focus returns to the security of the routing protocol itself: The U-LLN MUST be protected against attempts to inject false or modified packets. For example, an attacker SHOULD be prevented from manipulating or disabling the routing function by compromising routing update messages. Moreover, it SHOULD NOT be possible to coerce the network into routing packets which have been modified in transit. To this end the routing protocol(s) MUST support message integrity. The impact on availability of the forwarding service is typically a concern for routing protocols and is not mentioned here. Can routing produce a data traffic forwarding path that loops? Can the routing protocol be subverted to the point that routing protocol messages are consuming the available resources? Etc. Mechanisms MUST be in place to deny any rogue node which attempts to take advantage of self-configuration and self- organization procedures. Such attacks may attempt, for example, to cause denial of service, drain the energy of power constrained devices, or to hijack the routing mechanism. A node MUST authenticate itself to a trusted node that is already associated with the U-LLN before any self-configuration or self-organization is allowed to proceed. This seems to be addressing the possibility of a legitimate node behaving badly. But the requirement that a node must authenticate itself only prevents bad behavior from outsiders, not insiders. Further comment - self-organization and self-configuration had previously referred to configuration or organization of a network, not a single node. Does this mean that a node must authenticate before it can participate in the network self-organization? And of course the chicken-and-egg problem - before the network has self-organized, how can the nodes reach a trusted node. Must *every* node authenticate before self-organization can proceed? Or does self-organization spread outwards incrementally from the trusted node? With low computation power and scarce energy resources, U-LLNs nodes may not be able to resist any attack from high-power malicious nodes (e.g. laptops and strong radios). However, the amount of damage generated to the whole network SHOULD be commensurate with the number of nodes physically compromised. For example, an intruder taking control over a single node SHOULD not have total access to, or be able to completely deny service to the whole network. If a taken-over node does not have access to the whole network, how could it have had access to the whole network before being taken over? Subverted nodes generally are assumed to retain all their abilities, which is why they are such a problem. This seems to be requiring that no one node ever has access to the whole network. In the rest of the document: Routers are introduced, including the special category of LBR - Some routers provide access to wider infrastructures, such as the Internet, and are named Low power and lossy network Border Routers (LBRs) in that context. However, in the remainder of the document, the text refers to LBRs everywhere in places where it sounds like they are referring to routers. Are all routers LBRs? Do the discussions of LBRs not apply to interior routers? There are references to "node" forwarding traffic in some places. Are all such nodes routers, or do sensors and actuators sometimes forward traffic? E.g., A node must be able to send its own alerts toward an LBR while continuing to forward traffic on behalf of other devices who are also experiencing an alert condition. In the following text: Routing within urban sensor networks SHOULD require the U-LLN nodes to dynamically compute, select and install different paths towards a same destination, depending on the nature of the traffic. From this perspective, such nodes SHOULD inspect the contents of traffic payload for making routing and forwarding decisions: for example, the analysis of traffic payload should encourage the enforcement of forwarding policies based upon aggregation capabilities for the sake of efficiency. If data needs to be confidential, as mentioned in the security considerations section, then the data would have to be protected hop by hop, with each router/node decrypting and re-encrypting as it forwarded the data, if the router/node is to inspect the contents. Is this intended? _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 4 14:37:01 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 43A6B3A693C; Thu, 4 Dec 2008 14:37:01 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 43EFB3A693C for ; Thu, 4 Dec 2008 14:36:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.524 X-Spam-Level: X-Spam-Status: No, score=-104.524 tagged_above=-999 required=5 tests=[AWL=2.075, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H2NF8+-mV2zC for ; Thu, 4 Dec 2008 14:36:58 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id ED1AD3A691F for ; Thu, 4 Dec 2008 14:36:57 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB4MapdP014629 for ; Thu, 4 Dec 2008 17:36:53 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB4ManxF014626 for ; Thu, 4 Dec 2008 17:36:49 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB4MZq87017895 for ; Thu, 4 Dec 2008 17:36:44 -0500 (EST) Received: from woodstock.binhost.com (woodstock.binhost.com [8.8.40.152]) by mit.edu (Spam Firewall) with SMTP id 3B5B312931C3 for ; Thu, 4 Dec 2008 17:35:31 -0500 (EST) Received: (qmail 15865 invoked by uid 0); 4 Dec 2008 22:35:23 -0000 Received: from unknown (HELO THINKPADR52.vigilsec.com) (96.255.143.189) by woodstock.binhost.com with SMTP; 4 Dec 2008 22:35:23 -0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Thu, 04 Dec 2008 17:35:21 -0500 To: secdir@mit.edu From: Russ Housley In-Reply-To: <7.1.0.9.2.20081201123535.09f37158@vigilsec.com> References: <7.1.0.9.2.20081201123535.09f37158@vigilsec.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=====================_31699593==_" Message-Id: <20081204223531.3B5B312931C3@mit.edu> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: Re: [secdir] GENI Security Workshop X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --=====================_31699593==_ Content-Type: text/plain; charset="us-ascii"; format=flowed In case you were interested, the dates for this workshop have moved out a week. See attached. Russ --=====================_31699593==_ Content-Type: application/octet-stream; name="cfp5.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="cfp5.pdf" JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHdnWuz3MZxhr/vr1hKlHRokavFbbGIHdvHIiXfkog0FScW lZsq/pAqpcrR/6/K24NnBmgssNurMFWpkKwCAcz09L17egazf9m/3v9lX9X6d6jq47Hed+f+cD7v +1O6/Ne/7/+4/8/9Z5//UO2/+2F/TH9/+E59joe6Pdqf8WG56+t939aH8+677/e/ervvxvdc3n6/ /+yL6lDtq/3bP+8fnjzbv/2P/au3QqK6Dbk+1odhOHce/jl17MZLgi9KRvjfpBFetPuHD57t7fKh Lk25PNVdtX/46NnOHn48NvlkbMK7dw/jLf15+e7Z2PYnutRljHS3e1h0WbRllE+f7b/dv/3tSHqA qU3fHI7HqvWkX7K2yaTPWbstq+54E+KqsLYhSvrNWfojTdpWgDuxrJrmcG7bfn8aukOdFas6jiLP 1yT6NtOP6KXYSfZ2NeFXx/1DEi1yr3Q1kczbmZDtPgnSOpjw0wMTu3tjIjcQn0qF7Pqc+xd2Vc8C 4sCLpA0G4jN7MB/kyIMKUDU9Gp5n7Fued1xPc03alkvbnw9V19X38DChn+3zeGiOw/nYDDL87tid z3Wr//VtVfWnbieP0Ov5aX86NxLRvtWdnMjxMHTDcDoOe/mRP4+OYn/Ve9TN6TCc2vP+1J0EYVuH ipE/PH9xEDczntssqE/1oRua26An9fzgyYdPP/r46SfvYubUVOJI37U3kZ9GePfMVOI28k3dHo6n trsDtJQzALc53gv33TN5rwDktjk0XXMPxs+fvHv24oVsJQC97w7HxvT5hp5MrJ4FmytKIj43hrRC 2HCKqN+Hx+rFoT7KTm9jXff14dg18mQ3wE9Yf/Dks6fHqn7+pHnaVt3pk4+qp8+f9OchMlyjUH46 3SZmGi3EI/n4k9jUZw/fVsmyuSQ/XCDKD/+VPNWwf/jpePmZLucSM//avJgcZSuv1+0f5Mzs5c/H puaodWceT++EmoXwX+hiPT7SVVDNbapNNb40133aZTA0+aUeKnI+MDJPH61pgWredBo/gbF3Oxvx V9Zfzp3+dPzcniptAGW6vNRTYQWur0aoacRdxpgOIA6NAIUMmoCpRYK+wPxCSAnvzLjMjowkQ36p PhN1gPWA0si7jCrvLBYKfzqAlRcZyMExKLUcSv3uZxF8o2PCYpfBwBua/HpkA2rEuCAKp8CJDk+F k1QDyqCFd9AJTN7xcAWlogsMBA+yDgiZKZvb9i1mN0qzi1u5YTeeNk8wGNcicVKN34zCm/OyiPK3 eidmgD/AYDAPfzPKkHe/G4HBDAhmWH+XkhzBpkdCu2g743qgyJDhERBo/17jyqzo8Eo4yS4Zl4cw hn485A4kwBDKeHcaFcLLF6YBBc+TSeLpo3CSNc09WDGcbHgiJqIDTVMdzs15QBP2332/0yTphiYw PnR72mBicpIFqfMobdSbfjAYnvCOhxD6N2M/GIU9FPVIroHxrqEEMJoAjIeIAtBIywsN+dBd/WZ8 3V2ZdZ6O1aEWQ23WeYOhierdw9+O5DI8rGB4mHY1eBTeJyWFQq9e0AtsOtBkw6OloAPTgckdUOBM 9j7oA0BfiqYcgXbZ+d2tCCBaRJ+8O8iABe8wcNjlEV3lKKGCfjL3mXg3iwop/e0049sU8s7nHeZA budj8sjd+WTzlhW1WUC8kclAD8IomkHqkmTKOx85ESa+BTaiNTDcCXr34AVNU/ozBBpN/1Wgj3KG 8ml0UMuIGOqj0r7+3NzFtVV9gUFwjSbg+ygVTu52nlPwztsTeu0DN+QCZXTlxTPSA7Kzdeer93iX gIxHu1Su2o7yjeofTV9XV3i0z7q6uyiDXYHbaoKtypqHq9nbcSzDHXdvv7vq9x4qWads4rhXw1tE tOfD0DQnBmMedMOrIqIrqWmIf1bqatvB07k+9Mg/WebfSWWUqnu7uScfSga69HqTJy3ZDcaH/qBj /k4alxJPjBAt8u7SCkVTluPBwMZiNskKoMxr+mQ2EeM1Z9e3pTC7ztFSOAUnn6rpYWSk83CoTv3Q 3zMeVF+37+SyLs3SMlv68xIwnmuwKz1MDiFCi+bcKmj1MmfjXSxOoEfoyiQlU1G0wutRyUCS4vCO ee8iF/UODK2CTohPel9mUR4LvYtQXXeDqD7K0Qc1JhZv61N1aK1yGAUr08aKveYvjWoXIkp6OZwt em2JUo5599kX8+KFVyvpv0UmsTsyXqP1ilM73EUt43nXRa0ARfK1ElQnRzDaoBfgG02yVCAdBlWl o9KJCd38zukojxCLIsxBkDDai4JDz3M52Ml75vTowlWZqMTPiKiqSqrRtlKNOzDFFLFTjB5Mufxs DAXcIVzCxZQHhjCUcNpOUfEOBAsSae6/kSylyAdjF74GZQpPk4rP8eo3UR8htO7kZ5v7dIYRfBKM x0A8qm6ERtf6Rd+Yj0h8XvP3m07iSuJDATOCgS0iHLvq/GMkDcn4BC6o2ydjwi9Jh7BQ9f5cq8C5 zYfL+dFXco9TOeq17ioVb7bs0qIhOkmpDoSxJGoxOALEyB36yh16WvQsqXR2C74/YLDEmxJLkHwE fSOyNMGG1UD3TYAOkvCfajLEgQcXmmSU1T8iI3OsytPbmF8FG6QBy8C0JBUp/8B6feClCVDod+HJ TKZloPn0Ddn4Ye/xL1pgFWx6rPoXr33bqw67SeuSX/zxWjevL8ORHIcR88KhotKeC0mFSsEU7qFQ qBf0wkQeIhEGpp+vtt3U7zRr+qJkNWa9KHaCvsvGyyA+xvEQalbtAt7+Ur5nU3yAKW5qvnIBxXM9 22UFy9YCUhcmGDUhrTifgjY0x6NMORgfMn4nUuUePFKPI4e94GA0LsB3ANjLEZjXAuzyyxHmFvci 1Fd9pal2r6TiDh54o4WypbrO56yeavDd1rkSMGjpl3FWyaWKBAsxFob9g9gkreYdVS/eIU460MRH iIU9z5vuHnz1Kjdd9VF+wr/U9RRmVhnLQ/g7H365MFqUJPEeufjuZJwQiv+gCZZWmM5yUQKGxuld RKssLGl5WNs/QkVV0PCygFBwowk0QehRtqF5P3e8y/4W49DEZzZRyGulK/lsqaoC7qosPasK31Na AFZQgy4xf/MtUR4YngecK+Hu4ZaLs3C71KXk0hmxuJi0QOGZikox4D3J1krYA8qqfmaZwDa4kO5K WXZBfu4Cc0AVbXgjoa4kYKk2RBP6oRTXElAf/BkIL+HlDJ+nWZvLdRJK0+gzO7m2ZNVV2iOzuvhQ SsSlIGcbwyRuWAwaXoggDNm8m8fzkpx9PAYWz1i4BhT6IS5gisIZaZvLNdppdqga7eIaCYwlqAy/ miMVMSXdK2JKqYLHkDvvThDM5MeMk514oOkJwOiQFRFkeAr1PnemY2q5y3U9DMFjCEe9N0o7ALWR Bdyg0Bd3sh1AFLL3nsOb3pzEkikxhFePazC9p/hcjLKtLqI0IvxWE9ih1obcbe2+nDpCvhcGbEcI PlDgWv0OiCw9eJLZl0RUJA033ly6kRIFaEI/0NhyIxGeWEzU8nSwBOYHnJCJjKQtX8O50kbBO8aL WfzOdopvrb9rF6726GqBNg27FvlnHm2nvd+q7MLe6waf8hBvTnOD3+UEIGDwsJWWjF4Ubx4/CJ9w HmugO/14B2Zebym1wFY6eHvjITC9Y/Ed8typOIi0pMzwWeFXMcUKGCONv9wbx1CwBCr8+FDPQ4D9 dIwfDMu7wsrkloFJB+5WbZjKyFysZSmPEbB2H3x9DGSEzC5w8lwHGYBCLmD8Q7i16nFzVuYRRoYa N2KmcgitliPO9008wd+rS5Fayg8I2+geRHlNhFOemUvQKdAGiZG7UbgfTpC0Zv2XHt9LxssSzQVt UINOUhc/J4BqmojqiAzqoz4nqOohLokHhfDbu0rqY3+oT9rlG5ZweCGl1bbn4LZb9oChAd7wUGt2 /Pm5KcqFkmRdlyZYzgQYn3Okd7tbW1KB4I3Gq2mx8vl+qovwEBOt7U8eOn2IEGYYRJFBwbc3Lkug FoFC0gSsF8mGpwy+zdW0LJbMU7ZSqCgSShML8S5CdaMgXFf62uIOqq857aI7aZepp9pj7c23uOJx 4zWST/wtOSnQYDr8eTlye6rkRqhuZW7d0cw4LuvXGuja2oSNe2ujT9vUh/7YVOO4a06vpDxlnwp8 gkG4qxzEURnYteqlUUD0CB76cIDm8A5z83Zb3qWIwUD0m5xBhPcWxk7NoQ2GMaS9in7hyXyTx7J6 N5/wbeFtfoqB2GvoddWrHJwBGJh5HtLh52POA0exeu/OFj4gO08PPPXc5X0NSPvCyxkVWTHoj34g PTqiEZjxqjX7h2AMUQDD0r8SieMCXkT4TaNPRPXlCyqwZgGXYV8frqTvN7yyr8oEpGjpZ3rgDWfg RWy5Y5RKmTggSC5AWhXHhpMblzboCF7eJHn3SqSr4OCVCyKTKyiLQDwE2P0m2Wmqmb+du7HPK8Kz qRDplT/AMygpJddUT/b6TBNvpJDu5Ysi85AqHd09V72Sezy95jMQZuTjEKBx0+ihUsBZTfmtqbM+ DgJMknuJ7HR8ojayZppkHwExjOHNAQqpUNF/A+/53o6XGilv/p7cR+rIh8kXO+XgGzNeBoZhfhoM GixwoeGZGvCH7z7cePbPHe6uuDjvo0Aj+z+gMgYcA51VVsHqCyuMeDULaY12AwXTbJBa8AEEQDXP Sb2QM3XIFdlBK2Lxpb4UnUqpEQbIgCNkVdo/pM92NUdLxI3OenfDOeQVk/yRyyvplzzY5JBMr5ME SulsKRY2wM8t4EIsBgXQRGzPP+wInsBUmjDeF8Js2s5eDG+e4NDBj07LL8fuAPMyKG4/JSZIC1EC EyhkD2g473hIk6K8CTOPEqB5+EQoiS+rhoFhgifTOEB7JeMOJADGBdMBszJswmw1UQWlGyFjcpDf 7vIRB9uFQzO3Wt+m31oFoWb4tbgiDwfOUADq3M0dTFkkhQ9Jc7dWndAvxBBb3E06AV/oCBgfzzyv ge07sMATT3np7t1r0ZeEmWcJGgJmq4rptacguFgG3lRMeO9VEZjlYcoxvQ8pAyXpetbxDtDLERIw j7VXAMSBjnjF8azLbhpEAYO/8Bj6iJQ9+RyNKbTBZ16Ch1Qm4rXNOqpTdIvXatYKMyGK9WnuoB8t QXV454UA2rQU9qYCpOSwBpdBd1Qc4mkC9z1osGbnEgPBdQbyDxmBd+veaJcDCq0Yma7IAmq8IXgF ozbtpe/xv4YcLelOxsodmF0D7fGEwYyXV+XUP6JJzWCfCvU6msP0KTZX80wDX09uoSyFX5qw/uGZ zR0dAO1tjCa8K9aUAhKcpAmq6vU352BggXSx//SwTPogQqEqwruu7g79oKNPZry7mjrF67laFOyD q4LrM2coKVlNrtubfa6bRsm14NNqSP17s/AykUFMjEW/t2piUx/UkguecdWKEF6ZDCZnz0M/RJH9 PG8szicphHfBdMCUgQmitAR7D1qnr8T2hWur3Lm1mr4+gSzJipmUDs1Kp2Dpo7q6TwdhjJdF6ePh I2lw8Ou7uh8Ox/4kfbtDPSAW8uAVBlKEkqKl54e3YN6t2E4RNO8wcoa9rWoRQ2tOWhLTl2N3EQ4B PnuD8OwSiFRQ51XA9/e+vWRT89kFbhw+oFZ5JHowEkj5adxcV3f5sBP03zMe2DhEEN2wlJAaK59Q IFjz/qVWva9ItT0JyBmMirtJ1Qfe5TSIjomTpc6JQLxlQi2uAzCLjTHFkyTPlsfwqQ4MmnLKiLJV Z33jehwSR2I7lHI9FwI9L8Ce8ggYQSBKwR3yR5wwxuskWshap2faqlwyXybeR1jQHPVdVjdUphQB Fjz8MbL82Ry1INBr7S0GVBtB+OQLMhEtHCwJ5HznVza2+wTetL1c9ymOl5czAuZhkVcKRt6HoBi0 RIG5QxXoQEsoZyLPQLzz8w8e+iZey8qwK1Mj9MrTAIJwGsK4rGLmkfe4XHiGiB6aW9IBdXVwGSnb IXSjKS/H0gCIs0PFswZUc3/YgAVyoc3cX+3yepIPDo8acKo50W81YhT7T0oMhnBx1f7xiN6LZBtP I5WF1AuGjzOztOsd6XkBAxTiCWbZoqCCHnAvD5yvaArBrQASN6YqczC1tjWkatAxlKP81yLTMpES irf3YJhG6Qs+bUHd3IReThCUB0rk27FidnKj6ksmFJXKD6OETWAStBGq1THuTETVcZd7+KZWoDNw OhXOwBkflY9L4hFrqIwnx1oONFEQcMyi4LWNqNosIkeOyAZJrW6Z9x2K9RS8xQY05lFDjJ/UGjEc RPYPI4UaL0JabZPPRke43hLO/Bts7zJBBushs/IP6YALgBXeMKEaO+POQyEOYZ/SkGS8/ziKEqBg 4TmTzQTrgaXzNruHiW3GS08hNAmpCEsbfcx+ShZ0h7Z86UTpMSw0pQoirMk0cYtCQRP9xZMIwq2O nKyGczbQmHrDS58pot14Zb61Bv0JJyzP7JmWXBA3JNGBi99tL4lEKOt0ups2ld2l3GKaIQgnvTMH FxD07L32WYF23uuUuTXPN8vy7QBm+Q38fw6J8BmsYLBnjZ9j807u/kVTCuvlHLH57l1gQg1FAKSV 1QtDYBc8TacszziVMb2WF80ZVz73BG+kDmnw3fx/RMJ2PG17UhVtZHFAd2M5c61Fuf58ViKeRBeA K9F5/cVPFetNvhqb8HmLlwAs56HnThZLell2J8AzmIxYs1hQIJgNUn787Ep9U+DQA/G8lFopfoIc TRi/qGrKwEHcpyZ0oCVOi4ezikWR/G57naptTzrO9qjZQ9C4dpLQ1XVTJAVWnkWZm0nJS/oJ4RDg p8CAgVP4Sa/kT2KlLkudlIFcP0qv7GjLmHphbsk9+QPfVFiZWYN4oDYI+ZCI3IGZl3BoA8O8V81K /ZV0a9zsZOO/1t1yR2DJsQHns2I4jhkwFOggW/jvF7W93YA4/RiIO3jyZjQCVJvI5JtkmugBauDk B3QC2+XPve8SWIpYXuFWHQ3jQyK0wUQ4BBlcUhp+LmHEKwrQAMOdF63eFVu+8rGKabhK+tFdi9dU E8QRSkQMXu3+ZGqnIjqkjsIpDPC8guMwIMsR7HiKrGELaNFkVcYMvMpOiAM0Il610MKGpBq32VAo jDhBUGSMl6M1gBSbMqGw2FuKGlPVNaIUjfax9p2F9qhqWDp5eyZqNe1GX9nH4SpwQLK3MUjGD/iS Ni0nks2nzUJcmo0uwhHwkiMt+3cYOYuQNo9iuqZ+F9Y289z4Y/asIRAUmO7eETES/Rho9ABlUxG0 TooYkaSZtz6sPV2Z+8+nl1+MtHktAx0erpI/feUVQaqqWn2Y16jQEUXNDjW8rV76/QXNprrGwb26 OCn1+nIkGSKR1YZhp1kghpW1gh4oHdxBulf827SPlJHv828zNm/OfmqrnZw7zcE22eznQJamrZYG rISjKeMqqaDv7Wu3TPdotZGoyO/LRGnjc7mLyachQksc5uMoQS48hJ14SDCnqOzFsn06zjTB8gaR gJYDhXEENIF/YIiueGMnvQUn77twWt7Z+XwYOhlPA0V0wfyAFlC1wrNSA/RaYDNhGOXRh6XF55YK 4JQ5gpv3jVAIvX4Gi7Sg1xO64XDmix8e2BspgmZIIFj4m/AEMygCNMko4tG8fcbKzc9761rL30fV FLYZ+mPLtDpc034xZkVEC4gS0ZbaRkjQ/hft49AmjnHA2BTbW/jFhE6KaLsk+NQuxy5YC/cRSXad qcv+4a16Wt7nvQwhhYfIDQDK9yJk2qpmr0+T4mTGNquoSK8TEhVnwuxThbjEL/ulqur6L/9Ugz7Z s68mwwNIITA6WM0Fd/SBCWf/8M1Yt/1Gd/KiOWteXmUHtqsfVwTLsVDkkJqUIghNGBLo2DKWhu9A HWgyaZS+G9EKwSInW1elhbaQDqEmeSMYSxcHUSKHkH5pSlduefnu3fgWcuEUaCtQTTt2TRw6wqfW 8ej6qr/WT3BpkUYLKr1+gU0lzujvObW1vhHSz9V4qdq+mdO0b+baLvSHL2UxwX0zrf1Q2KADV+9R IR/8EZ23QCIDIkeeQsvUyztzHnoo9CtSC+3U6Oy3pOxbzpGWNf+oELY4rfbCY+RzOwxTkJry7Yg7 UQyt9VllF/waAnPALCEcptzQfFrB3aAvTaUj1NeLB1b43AK1Z6hlNElBVu8ifFHKfdBJnR3cWRPP ZfiaOCDnf2n7oIULQC8THWV2hrYxk6eDX0ta+IoL5TMveKEnEZL1OfWhrfWd7agQIvnWT5fEIks9 6FeqtNoZ1rM7A4ulLDraV17hDkVGgx9l5Jr3cvl/EFjQlYWSFNfkYuQLRc4pgvzIgJJ/5XI3ikFC 0A+syanUOmDc4ol+KbKSLUTjSafFw74bFJHmwvxfiifm/KwqFNygix/CuHBkywnEfFOO91hYM7q2 6kLx3YwwFSCsjk0/oKCqQMFtgJJ3yyUszA9diHmq1dCZ8CjnzIBVdudzp1a+hMVHe+f8rSzPJsh8 FoCGetThA2kazIEeOuS0O3Gg1PPpSFP6w7nVh5f8UPam9P2VsNSmC7p6yfMQ3pNRcEfL5MfL8o7f cDCRGnHOdhhBaweY36OwIIOMwJe7on/3RMW20ylQmiWAxfuMijlhhy2JV6WKjGLDVShQywjndNS2 zn/Vwl6Yc7GwZs4jlDbdGc7k987VWacGxqD/H5kkTZIw/BWLO/1A7F4nIMmZD/absjaxGLp+GQg2 C33VSdnIqVI2oh8BXSkeLOo7KnnuAsVU1erTz17cAsoP98hlBYDq0wH97Fu1hekiT4xrV9Nqx+Qa 7SPE+f62Xn5KodxSS0s886cklgHboqfZD+V9RRIzfV3Sw12qUFgftrKZz5Bb/oku6shDM0rdmY+z pubWlGVm6GVimkrJjJXbCsKkG9vL79J4lblP8m+J6u3qjU6iGo/MjPFRtWLVi7Uh7Rbc+YoBnpJE ndIb3jsHHGq4+CJ65DBIjKEnoYo2+DI6Jhdd4hbOL4/BLfHLD8UdIwk2XNYpfoFiTD3oR6xqy9M2 lexy9rlVPInIt9HGQB3iExdDbF9No9/1ONf1bbWZizeHGniHeF5KqWVCiGd1e/E/mf7LDnzhh7wG YfOOXBHx+nIDQ9APIdNBUCZ2jlISz1JxRgeuKpBNOfUumlNb2USfMWUb2PYocyZJo8wPoPVZsXm6 9QmH3ML0XSxdoW8ygom+bXfQDkrL63vM1nZc3vbV7aAAoJ+Ujuuh4uuiqAYPvh71JaV4toyU8qgk 76JEkD4Z5/7aEZuWUNQ6cipYikHfUKZpKJMad95HlYwvOe9JHtYBYrJc2d8HpclOSomCh48iXyGF kVhb1MOIdKuTNPlkEfMOev30YVnbSTSx1ch7WDDkAtlkknhWHBuUYcFMTLIvzlefg3ouMAZwsptJ PXb5Z67RF9rQw08eaIKAUakyUs7XTWw89JIFNJQyAjxhfobn80tFvuVzyXf6DSaQgF/4Kgbiof++ GzYxZ1u4D6+zHmjCoigbLRkJtAHKw8dRETd4MN/jDDD4CpfpzruJ6ogem8XaYcjB+kHQl6YKAsLI Wvc/8aWVSirdUT8tFcY1LS7cdqaVNssebUo654GVaoZg6f/dMxm1xon8YmWlHyw6NVYvn492dWVB CnKbCMmwGq7/aPc80U5VMqsMmPooByb3tfqB7sx/6mKblpQmSF0jWlTpi+Omb0Djruj8z+N4GFtW Fu+i0KRis6mkjtbjI7BuvBAdvKPytoMb4VtIzBJggBbzzUOBi7djPx53BCuG5SF6z0Mwm4zURgA0 SDAsmPl+wKQDwDye3heB/K8lTs2X6A5917oDM3s9UEt+p3g22ni+Qu5CkLThAlK4WxAGWg453hmC sX+ItFLH6auuOaql7OUjyRsJVnkyXhRsSpMcnSKKb6Z3ttr9ms5fTj+8+Dw3uINSWsKbFM/LUQfy OLO45tOIVWXNPOUlny5462AkuAcWibUlg/b6AoYkLAQ0HpJ/AAWYc3EVq/LC91tSvOp7mCIlIp/a fiKvP/dIaXtOPp83gJNPqfAXEEhdGwLhKxhy5zsAkw7IWoI0Im6d4trUmnietaBwVdX26VdBqfpI cLG4obWD9U2Io/LO40Y6aU35MhEiF2iMI/JhlG+MMrWxJf2pqRm6mqhlRGaV5tn9oF9XrjaRW9Sj NMEh3V9VNexcAgkN32pXwaBi6zh8QGVi8/xKH2Uo8GeygHvPstCjqIumGvpJ4OGoosL7JkL2pBmP 7CnJJsAcyWZeSCgJv3cmfjshzsQLM0cULNCbHk2TlZWSOy2JSDRBGeguOzHN5M6HFzxbdp4em5fq OC+1pDuaYPnzGF9ORPQ+DQxxB54lqwUXPx2+jn2i7Ar2oZ2SuT+4wUsGBm+PlKfCS0v9JhMM1Pgs vOqg2OhBl8gPaXJBGqtbrTzj8d+IyGsPMZcm9Pu9/JommKgU77y2r0oRYHCKDhyk8Y0US/l31nba cIEkIoyPU+CU+i9/942W9LugepJJYriWrzUr1Lkb2lxVVj3Cpbq6r7V6on2Yo+TWEqOF+w7+ZIFW 5TUrax3cq7vIY+V1I1llySvnOsyDIGHOxzcioimORGdJjGIf6w4mSD00bZKjkQGk5QdTC1uGyOsP +WqimcLnYYQEeF0mQW3XHe0U1fPZUh6j6r2x3wpeOl+si4MVrbEcRAXw9QWyhZ4olOQld+9WMAtj rnj8L/B2ru3lV0K3XHSIs7ZRsBEHEsLbsW9a35HTuc2CSuviduZLHOyHMbDatNxoZhKHK64G0G3l E2yPVRiu5GbeV/NP/JA5TNmETQgkL5tjGvtvpcHpeOChl2JvKkxZUS3ffs6D8JikzhYKURizL3uK Ui1ddmgvZK0KSN1rgeIqcvO9kDHvVMsHb4O8NJB/NVpU24EW5lyENOil5EJMKeTOqyqPAiM/5LmX 9wGzqKiUO2I1jX4svbVd2bf0pUzBYpwxv62f1YjufMIdkyL4ORp8+YXcbV4bVu0LptEUxwFjLvgT 4URVN4eht+R5jrfNAPqr1caZPxktP1Rs1IpZ09daaZ4PtlJsnKDHzF8VU/3guhQ9Cvd9mb827tRS JgZeC2y3zD9HhnyVQofkpgpPV2vV9BbJd2pwsu0bXCwgxUUJn5qseU80GZeKCn9rKiyfitKipmSm 9MDuUW8u3tKThZclfXwJI61OzpTDRjipY3XGD03fMyflCwYV8vUnuPL4J9wkvIBdZOLcMf/7Wk01 0+PhKit9ZSuHE2BbAljpCxzmIT75zvVVz/6sn/nq9XR7v5H2KulnjdvCi6s2kragpLny7ZhvmpoZ vAF0Htqkq1QlUR2YB0f8JPLfxB+pM9qVOhTNo5/nzo8NQ/oJpqa6S1HCgeisEKddwkHl85ty/iD6 p9I8bGBZE4Zh3K/UUnEJnqKJxCX6cbdk2LgT9L64XVmpp5fXy8SNgn8PMy7Tpgw0kEVLm8YlK6Vo tqdLeQnUfjqyLhlRv0vZil7aepZcIE3NaUq9eGjzNt3RkYeko2WalRYAaBKcdDXa6qctWn2h605m vf5vLLY8lgplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKODY1MAplbmRvYmoKMiAwIG9iago8PCAv VHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBS IC9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCj4+CmVuZG9iago2IDAgb2JqCjw8IC9Qcm9jU2V0IFsg L1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL0YxLjEg OSAwIFIKL0YyLjEgMTEgMCBSIC9GNS4xIDE3IDAgUiAvRjMuMSAxMyAwIFIgL0Y0LjEgMTUgMCBS ID4+ID4+CmVuZG9iagoxOCAwIG9iago8PCAvTGVuZ3RoIDE5IDAgUiAvTiAzIC9BbHRlcm5hdGUg L0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGFlE1IFGEYx/+zjQSx BtGXCMXQwSRUJgtSAtP1K1O2ZdVMCWKdfXedHGenmd0tRSKE6Jh1jC5WRIeITuGhQ6c6RASZdYmg o0UQBV4itv87k7tjVL4wM795nv/7fL3DAFWPUo5jRTRgys67yd6Ydnp0TNv8GlWoRhRcKcNzOhKJ AZ+plc/1a/UtFGlZapSx1vs2fKt2mRBQNCp3ZAM+LHk84OOSL+SdPDVnJBsTqTTZITe4Q8lO8i3y 1myIx0OcFp4BVLVTkzMcl3EiO8gtRSMrYz4g63batMnvpT3tGVPUsN/INzkL2rjy/UDbHmDTi4pt zAMe3AN211Vs9TXAzhFg8VDF9j3pz0fZ9crLHGr2wynRGGv6UCp9rwM23wB+Xi+VftwulX7eYQ7W 8dQyCm7R17Iw5SUQ1BvsZvzkGv2Lg558VQuwwDmObAH6rwA3PwL7HwLbHwOJamCoFZHLbDe48uIi 5wJ05pxp18xO5LVmXT+idfBohdZnG00NWsqyNN/laa7whFsU6SZMWQXO2V/beI8Ke3iQT/YXuSS8 7t+szKVTXZwlmtjWp7To6iY3kO9nzJ4+cj2v9xm3Zzhg5YCZ7xsKOHLKtuI8F6mJ1Njj8ZNkxldU Jx+T85A85xUHZUzffi51IkGupT05meuXml3c2z4zMcQzkqxYMxOd8d/8xi0kZd591Nx1LP+bZ22R ZxiFBQETNu82NCTRixga4cBFDhl6TCpMWqVf0GrCw+RflRYS5V0WFb1Y4Z4Vf895FLhbxj+FWBxz DeUImv5O/6Iv6wv6Xf3zfG2hvuKZc8+axqtrXxlXZpbVyLhBjTK+rCmIb7DaDnotZGmd4hX05JX1 jeHqMvZ8bdmjyRzianw11KUIZWrEOOPJrmX3RbLFN+HnW8v2r+lR+3z2SU0l17K6eGYp+nw2XA1r /7OrYNKyq/DkjZAuPGuh7lUPqn1qi9oKTT2mtqttahffjqoD5R3DnJWJC6zbZfUp9mBjmt7KSVdm i+Dfwi+G/6VeYQvXNDT5D024uYxpCd8R3DZwh5T/w1+zAw3eCmVuZHN0cmVhbQplbmRvYmoKMTkg MCBvYmoKNzkyCmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDE4IDAgUiBdCmVuZG9iagozIDAg b2JqCjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXSAvQ291bnQgMSAvS2lk cyBbIDIgMCBSIF0gPj4KZW5kb2JqCjIwIDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAz IDAgUiA+PgplbmRvYmoKMjEgMCBvYmoKPDwgL0xlbmd0aCAyMiAwIFIgL0xlbmd0aDEgNTExMiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGNWHtwG8UZ//YkS5b19EO27MvjlLMc47Mj Y+dhB8VWLMvBUcPYjtM5xQGkSA6ymwRDDAXKw7QEp5e0Q1sgBEobZjp9/7FOmY7SaYM7pQO0TYcy lCkF2rTTTjsdGDIMhBQC7m9PD5JMmOnpdm/3933f7rffY/dOxIjISXNkoc7MvvQMVdI1QH6OEsjc PqtEXuuR0H6ZSFL2zNy07863f3gb2u8SuTbetPfOPR8Ov/AXIm8nEbPmJtPZt5cH7ibyrYXM+hwA 7ybbOfT3ot+c2zd7h91Op9B/CP3KvTdn0vRF/Mj3GPq2fek7ZqRF93b0j6Ov7E/vm3xp2ZNZ9BfR 12ZunZx5tfOVX6D/JpHFBYzhJy4X2VCIggKpMMhDVLGDfKSZNVm70C5eljOF9tLZpSeJls4KWNQf jxXaJb7C03YP+Sybls5KkFo6Do7qS+lX7lUCFsUqyM+I6gpXim65AlqA9tP36b1PpX4qgd3AOuhv 9Dykv8QamYdZ6R3BzAKsi7UKyxeve+k2+i19QD+gb9A9lIMR36Ez8MTr9DTtLzGhdR8N4Ee0k6rK KLE1xfZPP8HKrWfN1utmPUvb6FGMT9BJXP/BHFe6DPpmGS6NeZwepONAOWUxe+HaWnwWH7ZTVCnN wj/3wy9n6Dd0AhrvoL4SF9vI2tgK2OJhePdPdIRu/fgN4eOofuMN1++a2JnUd4yPbftMYuvwtVuG BmMDm6P9fZsi12zs7dmwft3a7q6rO8NrOtq1tqtaV7eEmtVVQWXliuXL5KbGQEO9v662ptrn9bhd zipHpd1WYbVIjNpZgAdienyaN8ZS3KUOqj6Fu647uy3MqUYOqtVKdzjZUeTiFRqn2gSvG9EXKNqT 5DbtcpbruCXkeycI4W2yEufWEG51azrLW8f0oOp7RS7TkxiWN8X0YFDmUgj3MEi4t6aVLPeNAAfB RIY5jeii5Jf+3gOQeoJJ1GM6X1HqJsVohaVcpORJ5MniZWpexwzfgqsxNsipboFcf+fkF2xne+C3 CG/VoIgPLXM0CnNW9w5ntZz5t2FJl04hxM70XMEG8ey0Gs9OwaLZ1Cc2PVuwaFAxFGNMr+6Wg0FT 6QR/flRfcFbF1NhkFVZBJkALVU4gTgHALTMLzNXHzIbkim9ckKjSDfPVCHXjokzz6OEUGuog7AZK 7SeU/NLikYtJBLECE4HNbDFzTm6LcXtBCWWKR9OcDisL7YvGkbyPdqc0V1bNpnfp3JKGUgtkCcVz 43xZYmQnICiBksopwt2DZiWcp8RzioG+4E2hVgcheimezU2mRJiwlDoImiOmzwcXZV6DZ5xXa9wN cfdd/5AtRjwwpYiuYcwr/PiofjE1KHgQBIGOdsWIq5gNg8WnB4THwmW3mdE4nDWdEz2cVvjc7mnY DHf6SCn+g4aPu84F4R34B5IiO4SBRcmmpsVSpiFpxUMxDk+aSz1iLg3xqsSnB0URgoh+2gHpnXo8 p8Zhz+KEMAjkLaHLZYNB3qgJQcOICxXTWWgvLIO7UTPVKHSQE7LGoE+MR8fNB42bPsCM0fRgsggV GUCxwg88mhpMJsWiCg7g9tB8xRpVMcTw9hCv03zBZ0Fb7GhPjOnxQRGd4JRi+qa3AvJbaCdGyjAL gMcIvyWMJCjb1cRoIQpywj6iSo0XEhhWK3oerEV+c9TTAfl0YYZd+pA6lDKMIVUZMlJGOr80t1tV fKqx4HIZM/GUYqY/A/6zwzIfOpLkvlSObTQ9JKbH4iyhobEErx2dEK4aUnJpILj71WCPHKwu82AX uTK5mHOIfuSAyDnD9yZW78LuJCtDYqvJY4eQua9HpCwU2qEjJzKYIp41K+TKdgwui6yxJEPxqe1F Y8lBTGkGj9gDR4soBgkGRT4dzkdpNzp8blQv9BXaLZ+gaFiDH1OCslii+HcIylyJUhZPqfBbIIH5 zfj4tPjG3l6ObaNarVF6xcYO7XAPZ/niONZ4vodXwmKm62tjukWWBAtakmwRrSoNx0OEN2imoLAJ dkzDpyovqtyn8YqYvihHkoqvGpslA8+1YBSR6ntRfYGJfZTqfJxFOKsXOGFfhfWw7zf0gFgOJCVu pIoBePGywCq4s7lyKhWUR+6KtWH1PhWpKxfMUF2jihX+TgR86WAIDYm8gktMQ21Nco8477jnTbOC vnJMV7ATIXNHzYYSV3LC2VxJDZpbQlIW9BKcXzqTGhRboI4YBItcDHEEesG0l4ZiR/v/G+hzCPT7 jyRzG6FTtA0rUNZhWmH02LheTDfTT2YSYK5hsZRL6WUrlniwsSGdg7yz6YUAArUpYGZ1IXfLzHDC OFZTdsDFk5m0UngITfgQzv/CHmBqxreYfXPtgnztZeThEhnbxz3yXeDDQTawoLJDowtRdmj7Tv0k XnqVQ+P6CYlJsdRAcqEZNP2kglcgE5UEKkDBoogOJRhGOyFVmvzyySjRnEm1moDZz+QZmViBCRij TF4qYL4SnwTMWsCiJobzBCrGAzlsb7oKp2d5dES/O5kzUklhbKovBCAiW+0jLql9C0yyuXiVOjnA neqAwPsF3l/AbQK3qwMIfySHkkeqGykV6Y8NWCeZJUUIiyiXQkp+aQk76GnsvEFuC+1CwQbr0JIK rwhtBd8WUVKAt/C5TFroIcIUsvbQcCbJK8sDgmWYOzCCozgCOIZMGRzPQiiDYE2rZhMwkmMuyZOa mFSfEhopCt6HrlU3cltLQcmKFjFROGnUqF3mcWIL8arQPCQwx1ZzIzQRGV1MJs4j3HYXNM+o4Mqk FHjASpntCEZri7irhN+ATOJUt7bgUEWpQiKbRBLLsoSc7iruWIMBcYu2cw0GxG1Pwihi8WZvvsiA uX3cCY1aLjJlUQDWAWlY6IJ7HsoL1l+KYUbzNKbewZlpUXMqO8jcHRpO42WhIO8EouK9ryCMsSpD AhJjPFtA7WLlLvOFdjy/9D31TpEkpaujXeU0rovAJBnvkFFKGpcDfAIbZ+XlqNuEDaPSfWWBgr0q 3eUnRsEkVvEVZX2wYpxaqZ06aS2lo7V1dZ5VNpuH2jWt0xMIdK6NhpEQUbmTun3dUvdyZytRm1Zb 11WnOS3dHR3rO7vDp2t6wzUNvafD+PWKisLXn256o0ngp6t7w2/8vrq3uhudqzvZurV90oY+y7q1 Leoqj2RX161f3921QvLXoeOx+P0NfnUdqw5WiyJtsNW3NTe0yN7NfUpnc6MjFflybCjTt8zbHGlX Wvz2mofYhY9slvSFHvav+vpQ27rVjeHuXjUxVtfcteKLK9Ys7x66qqVv01BHsH116zLb/qee+vgf 1sc/3GN9/4MfY9m4xDc3/hW44Z+vTNzojbxHTvGtS/TriZv85WfJShZyCF7zgpz98Y97iaouXLjw 0dNVBs1S49LRIlU8pIpBOsV+ZSLmPwPFuQ7B7jdSBUbyUZhSYNzs2oj/LIQmjGrMJ/5BoEairZ8d Sm7WtVh63+5bp9IdAzfvzQ7PpvdOZSh6/1/P1Dcse/mPqL5wd738hbsb//AS2rd/HtW+GVR7b0b1 uf318uf233dr0+xtdf5lN02j2jOFajJXJ0/mDt7S1Hig/q5YY/BOFPtzDc9JM6fmTknznP3r30yL Ps46j0WP8WOLx6xf+7qkRR9mjkwg81zGomTc3l4c8j/ZsjLUm2eu6I2PMW3Dt9ijj0ha4OhVbb32 ow1HJd8j/dHeVx9h33mE3X8f0+65t0K794FVKw8dZNo8ygMHK7QvoVQedGygmLzBH1jv96/z16z1 e7v9ri6/42q/rdNvCftpjT/PqqLdsb5gy2pP62qvt421nl/Szv/Xe+59z7vvefrPnz0v9b/L2jRP u+ZdpXqaVe+KlR5lpRdfONHRCkdVr9dX7XJUOV02e6XLYq1wEZNcNkt2pdOb8EpO/E80aNnjmLXM O35E33W85nU4yWlxeq+haxxJy4Tjdsus9wl6wnHMe9LxZ/KcZG7midZ4ZbbcHbA3uf2+BneNtc69 crOHuYX/UPtQwij9KN9GeYa5oy229khbpDXSEmmOrIookRURORKI+CM1EW/EEbFFLBGKjHSPM16T oMT4AK9leG4f4N1aIm9RxniXluCOkQl9gbGvJoFy6RDOr3FuPYQMHceX0c4JPc8aBfkgNhDGiCdS B7+S1LTlPCteA+eWJ3mXaDy0PIk3265RLqsD2uXXgVkTOTB72yWUAwf4u3F+Pj6V5ufx6XUOXy7n 4yl+Th0UbAd4W5y3x9O8FVhLASuLs1KLMDZGFxPMHtAOiBttHuD9WGeJqfRccIgFj4wN4BViV4Jn 8SIvj0ykeJM6gK9S9NaPTOAFb+B/hhsUKQplbmRzdHJlYW0KZW5kb2JqCjIyIDAgb2JqCjMyNDQK ZW5kb2JqCjIzIDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvQXNjZW50IDk1MCAvQ2Fw SGVpZ2h0IDY3MSAvRGVzY2VudCAtMjIyIC9GbGFncyA2OAovRm9udEJCb3ggWy0zNzcgLTIxOCAx MzE3IDk1MF0gL0ZvbnROYW1lIC9KVkZZQVgrQ2FtYnJpYS1Cb2xkSXRhbGljIC9JdGFsaWNBbmds ZQotMTIuMzk5OTkgL1N0ZW1WIDAgL01heFdpZHRoIDEzNzMgL1hIZWlnaHQgNDg4IC9Gb250Rmls ZTIgMjEgMCBSID4+CmVuZG9iagoyNCAwIG9iagpbIDIyMCBdCmVuZG9iagoyNSAwIG9iago8PCAv TGVuZ3RoIDI2IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdkL1uxCAQhHue YstLcQJfjZCii05ykR/FyQNgWFtI8YLWuPDbB4hzkVJswcx8MKy89k89hQzyjaMbMMMUyDOucWOH MOIcSHQX8MHl49Q0t9gkZIGHfc249DRF0FoAyPeCrJl3OD36OOJD1V7ZIwea4fR5HZoybCl94YKU QQljwONUrnu26cUuCLKh594XP+T9XKi/xMeeEEqjQnQ/lVz0uCbrkC3NKLRSRt9uRiD5f9YBjNOR vHRG11HKqpb/dSpav3iv5Dbm0qbtoRWtBQLhfVUppvpgm298V3BBCmVuZHN0cmVhbQplbmRvYmoK MjYgMCBvYmoKMjIyCmVuZG9iago5IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVl VHlwZSAvQmFzZUZvbnQgL0pWRllBWCtDYW1icmlhLUJvbGRJdGFsaWMgL0ZvbnREZXNjcmlwdG9y CjIzIDAgUiAvV2lkdGhzIDI0IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hhciAzMyAvVG9Vbmlj b2RlIDI1IDAgUiA+PgplbmRvYmoKMjcgMCBvYmoKPDwgL0xlbmd0aCAyOCAwIFIgL0xlbmd0aDEg MTQ4OTYgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBrXsJfFTV3eg5997ZMpOZO/tk tszkzpLMTDJJJiELQ3KZTDYCmIQAGcIygQECooKAVRGIEBQirYrF4vJZ7QJf1dobaxX7Pi22FG2f vJ+t1qWtFq39ulhbuvlRgcn7nzMzISAu7XvJnHPPfs5////PnUEYIaRGo4hF1auuGt6IW/FGaPkv SItWXbfFM/evPacQwiaEmI41G9de9dLrmVqE2KUIaWav3XDDmpnlP7gFId2DCAkbRlYPZ/4yZuUQ imlg/owRaNC1Kn4E9STUfSNXbbn+9tWqm6A+AvWxDdesGr4jcs+1UP8j1JNXDV+/kWtj2hCqq4a6 5+rhq1avX/zGb6DeC3X/xmtXb3y5dy+MrbseIdlT0Ibhn/xpkBzNgacXeQASBimgXYZUAFkRKoY+ JeKQDrmQAZUgPTIjG3IgO4zVIDfikRU5kRGVIgvSIoBUNg5PJFsIPWGaI64Wyvk/9lSuPHl68j8Q mjxNmkme7c+VC+NyT/l2xLOzJk8zMGvyQRihv7j/8jUlNJMEqERoO3oLvUAK6ItoFBHMHUK3oVko jTbR1o/L/vFxHR/fjlvwDFyJfeiraB+uxl5sQ/vJaGivxeXosamZO9BW9BJ6AN2P7kSb0QgQ4a/o FNoF/SvR1VOjyPkS8I/QEgoO7cBaXIX+DvzUPzXuQuEV9CLsZoD+l9BydD2aj+5GO9Av0TswJI3+ AHtM/eEIKdJ8HM7xIFQ+D+lJSOQUD6JbaJuEMrA7Qg+jaymH0O5cJn8WKZktQJ+bgS6n0KvQuhUt RC2FIbgZh7Ab/Sfg/V30Crqb4dAv8YfoGOxxGmuh5UmA+BR+Cy1h5XDKu9FpdB2c+5fZ17NvEl4Q U5kVy5ctHVqSGlw40D9vbs+c7q7OjmRbYrbY2jIrPrO5qbFhRn1drLamOlpVGQmHKsqDAb9PKPN6 St0up8NeYrNazCajQc/rtMUadZFKqZDLOJbBKIJtkq1tsH29VNKWljRCUuA9kmb+6XlRCRkcXkHv iUVTlflRkiwsIWOPZOodnEBiY0qShy8dMl9i/fxfvTB5nsPTLnF++AhzhjNSef+gV+BfdUz1p2BZ yd426PU6JMYPn27ogs+cYU9G4nuhHTpoS7eEegdJOjr5TiM0okZvCvL+QcldqKbIajlQph3yaRCo Y5cccz4e5yc0JW1JCZkmkOYdCZnJsNONSEJxqTwMB+GhRFdDUQmb/ipho4TN8wCki7cg0041XgYH 7Zn1QntmHWA0k76A09M5jHo9457x/kF9zOH10kP3SC/0DU6oi9qEttVFAAWiDWiiSA0tatIAZNk4 gTUtmBYYTXvzBIOUxYA+AzluO0nrJfG2NBSEJOANeowXeo5OHts/vQvBtNwgBMNoCdM9JXmbpMgd wrNOEocldJtnInJsfP9RHq1MhzUZITO8dFBih+FQE4j1t48MSM6e3iXQBIeAlB7xEHInaUaI52kf 8YxDnYxNQy4kYerF7ZmR1WnCJjgtJKFP1TZ4q/eYQzLAs13Sh6VimF5847sOdrzdts5DquPjt3qk B/sGp/d6yRhgAltlxDPeLsBusFj7+gShWHSKbJQbuzOUOOJtwx5pdOV6wBl8hvcX+N87zkuaD7xA HaAPzCTSQRBMUia9noCyHmZy8PCM37aagrqfggb86mlfnySJTATuRwth9pLB9hGhHfCZ3xAQAvNZ /6VzvV6pJEwmjo+3kyMOZ+D0BDPwKQnTY+QqIBOOMIbztEniAH2gAUoD2FEcTqbyTfkB0MMBHSQx nUylCFA5AkgK/62yKsEzTpZX+CVTmPceh75jlZGe/sH2JOFOGMm0Dc563+Z4H8o9vVPN2AZjxqPv EySRngVCT1+OC0YIfkiWHsgJMGAtT3kYmh9PVz1pc5zM7bB0sEPoSI+PdwiejvH0+PDRydGVgocX xic0mvGN7WkPFX8M7d+9zSF17E9JfHoEN1MKke0BONbf0d8jGfuGCKk6PCPD0AKfVsHb6PDqp8aA Frl8d17mgPtBBojMjfN/BOg1oJ0cng6iao6ChnBIfCMRWTjQwkGQiVWwRXuGZiArC2BxB5EaNuVv X7cgjyyHF7akzEN0YF++FRbxeok83XZURCuhIo32DebqHrTS8TgSo2GgY5r0HCv0mBeSntFCz9T0 tAB0s/XA/pQ/Po6/QbdP8fa4XjB4mohih9PBpzsjHRsAGM80SkrAGCW9sW2QdTBkCJQYB0tKRWEw D3HJGqYTCU5AY47zguclQeLDkqxt8JgjnvLwelCWGMZ0wUDCqfxLwo8w0aPIxEs4LmELaUegVwF7 oPetjdA5xUie9vF0ngGngwVDyejMyJQo5Q4PsktgA+h5AUTXkUOD3iAQCF8kDF8wDP4OIldAEoqo OSlJS+ydpP0jzeC8jrZBD2gikNw+WvC0e0YIsSVPOklVQspB+gvNRydPpZNEBQ4CD8IQR57FgdFz qL2YFSsjn5XRR4HRb96fGmmGM4khgMBTD9sSpLcNDObFjdKJCgHs1U1Aubh/CouFMaDYQJy9UrX9 RzZgVLuNSnVOdqcGAxEGAJopAkzfjPYV2IOcROoA+5/TAfRkUietU9hJd9cl3d2FblAf2x03wjgw ZIkJAe/tmxDx3gVLBp8G79izd2DwcQYzbelEasIHfYNPe8AHoq0MaSWNZIiHVFAPhtUeZ5R0vONp EaFR2svRBlpfdRQj2pYbBG0YrTrK5Nr4wjgG2rhcm0jbwJ7AEdttI6DeBgUgekYSewdvSo2Mp1ME 2ciSY0DgbKEFSYzQMoEZuUYqElYnJLWQIO2tpL011y4n7QohAewPwuE5CqI+nhZA/EEBDyIHThEW JlzO+D1HJydBg54EzeuV5P6lkEDBqsIpjyTzz4FxnSSloblTGl01TM5B2BTmKvzdq1KScmpBGNIt qWAFVX4FGNFB54B5JpNWAbMOC7QIzSAcoykpFSabDq4jJ/J4wB/qEpoleSB3SFmAbBRNjRuEWmpO 5H6pyH8rzIA95lBFSFscUIXNiD2Cj0IDJ18lwKhVaQ9QgEOrFgAzcgHyKSJ0g5bVYNW5ABhVSEUg yLQTEbBYv7q4SFJVwYLwIWV1FSwIH0UKkEKAp7Vb8wNgb15Sw4kC01CZnwDYga5uchb43AqHJ0Of I8v0HUX9wvUSphilWymgWyr2dw+Ds5Cbr4YWAfy+3GRYS+knTWSN47lWBYFcQx3agaOTR4QbiJAU /iojgoQGBgljIgf4kCJKjV/aIA2B4lRe2lpMm8fHlcWXn5DDl7J46klW8bSvS1bCVoDeZyG7RTaA ylEEVaM6NCwaTSZtmVyuRZFwuFprs1XXiVGQC9FRjWJ8jIm51OUIhcJGU60prGZjlZUzqmPRk4am qMHadDIK/00kQ9FlJ+1v2kn7SX1T9M3/o2/Sx6BSU43r61qYhha2vi4glGkZhVA/Y0as1s2YTVDR smaz1SzUY71XTxLTILeEfNaAQze7xVPtK1Gl4/vaOla1OHW+eMQTMCsMd+Bz5+Xs8LlG/FuLxR+q D5ZEY01CT7/JV+ve5a5yxToqAi2zOiq9kWC5U371Qw9l3+XuPbuG+58PHwWw4Y+ZPAPxeJlsKUTr XvQNEMu2hYNizINAuZdimVfG68CLs1gEmcqr0pVitvSAiDB2sBirdKzCbGOLrCpV0eGkCtmiYT2K 6a0xWyuACuGZfd77Yb0BNVWDx1kLaIgBEmL8rceOkVTjEEv//RVT2KuQy80mq9lbD/iEcNrNkPIM CPoCQb+XZYPZhV6tYSS70N9YZccPYTWeY3FXh8+/Xler5bNpPPIgPrKivCe0UpFIcJG5ndzisw/2 tAZViYS8KlQ6t/k1Jkbwg9HaydPcbNlqwM+xHHZocCTWa81dgL5eJs2wKpZxOmWs7IDo5PQ8dOh1 OqxldSaTmlUfMBkZrBN53qPcbgNMzHsbsGM/+cpJ1Pp+GNn444CppnArQdZUraaayMHkaTHymXcR TUZku3iVi2s11SmsFwLAdoyeN8RqZ8xoiOnlcqHMx9TXGXyxWgs3e69tZOCBr3zx9u6lDaZ9Vz+5 8qXsP7ffhd3Pr/6abEb2rU1XZn+SfTX7XvbXNStT2Z/YbXfj6O/ewLMfswAi4A4ByeJwp+NElWhH no+8zkq28oBTdDoOJ52szsW6DuhEHX84qZNvDwajrh3mAkLeRtEwstt4ioXWQhHwIJZ87BqE4y43 J4Vr3azZJAcOUcgFYBC2Xl9XxQTrsSVW2zCD/AOXACIUzMiRU49dWdfdPfuZbesfyjb7w2a5zBwO 4IcM3Vf3NAZne31rnr65xSFbWLfxvpM3339m8Io1ZkOiyFrRWs0uj4rlJUWJsz7WYwu1X339N589 +zkmxzOACy4IuAhjdR4T/UgAp1CQBE5w6wKlgWjgewFOxQYCYXeYdR8Qw2GXEtl6bWnbRhu028xm giyzaDYdTppZuUqpOpxUCgG/H9lEq7XSjXZoKepqKTNBdrIWMAjyZ5tCXp6b9GREjrlOEKnkTywj aE3+/zhQXuY/254pv8nNUoEt0MOrF6oYQdDnmZFWGCznrRXC+f8u0IJ9fp+3Spz33Gg05lVv2qQp q60aPVvfUGbWyxIJla1CrGaX5SiR/f6KtmCWdSVbsnNb250gu0AH5irKkwvzdDBbTRehFPCodbv0 BtxEJHMKhYBIgiTdpaNzOg7gpQMuA5EZdDiDOY213HX+bwUQmOKKoEl5VogH7EZQNzn2WVHdUmEr SiTUJb7mxtxZuSic1YXG8mcVsNPlPJx0sagYF7PFPK9gFQd4kdcfTvLFu7TaUsUOy2Xlh+qU/Bkd ouMTlrlIhKZPS2ECCVAGtGuMnSZDzFW+kFXx/eaOmF+9z3KuswCjbCHAVd5afc7p67mhPrshUWQj QpInDcC3DPSDE+CrRl/Iw1eh1gSCnNkbxZ5qr9dzOOlllWajxWwBlg8qK8o0OsXNFRW1upsdU1CC AYFPjkx6wuvE4kAbWF9CL8cnrFiwT5fOykMq4EBQsJj1JotlikcDgWC9F0NDLKCvpxpE5iz3WjXZ bMtQWFWkC87I3kLgL66oxwfxSu/6Cl5dZBYqABfFBves1rOH2aIHlrz25+yzPXFBC4S3VbRE2eGe poA2cf6e5hODf8aO785udps05CIXdOj6ydOyANgaLXDBUB5LNmRgDWB0jQoH6zggKrii7VZrqW47 O4UU1GontoOqe4IF/tIZU4YhPyQl8yA90fnwMDFyOSb2oAXMAEOsA/NU9ufZN27HlmM4jCOpr/0m m7nz4LwNba7Wnavu/DyPB/Hit3Hr4ew3so89k/3LY/3Mj7M/zb6x4OCLNz6Pi/dl38vZAu4BoLUb hdAX83AEnR7WAxbSaVKYQmzogAks1uGkiZUpFcrDSYVth88XKUU7iqfU2gVpzCt54kvYqC4jULo/ eb2PqKbps4ngUn9hyjR4a+E6mFjDYD3RRgX7gIsgsr+gi5j28+euO/Wfwy2LMtc1NV29qCPwYaLB a1EWZDpvEr7zX3uOr+Y2Nd20bmRbHZO3jfMBHzXwbuHHeXw0OOyRWCzCxoC2EXCoIhEt1taytQe0 orb4cFLL1pQxPoyZw0nssFc27bD4hNZY5Q5FDj/8z2pfAUeiqSAK0/R+DtBp/hcVjdBn325KUj5l Ubg8u2BbAYFW4saCzTWDxFipGAWCQargiVCxVJlQv5e5appu7Lzu6y11XcH2rSvnDAdbQwuasjub u+cLtfUNzdryGRtW9Y7Mso7uWHSx0fWWORdu6lm5f1lFkefK/r1DQ0WJ3gcemSvaiKj5tNz9518J zxtp2buXyBVGA5On2ZdBrmrQmznsP6H2+yutcF0jxsHDsqKS3pJ0CfhxJSYTsbuiiasmfly1rgb8 uJrKSpZlD1QaS2y2Cu8oz1dXjCoUMSQSx5Y6+dSnextc3E9y6gzg/gLjXtiaOHefbWux8lOcu9za KaMFPJwc9warIMYgsYXFSq0sBDVmQoYcjYSyQFD/ZsnWTTOXN1WtGZq/I1Vz428Ppb4yss84c7Ct aUld5frV2z7fdu3Pb1/z5jDu+9zW8lRby1B/VXBg9fU92x5NGW3Zt65YFim/orF5YV+duO3O9Lbv DFstuC6Hb1Bn3C+A38vQ5/PcHjAgYG9WqxPtCh2xY6KO9cIrxsNJZNA7ikWtY4dc7hMKhvhV+0n+ VQijch4NDSRQDNzDk8DW8E7HIdo/fr0pyf/ItFSOX3OBF8RXQpUMvA/qleBtoRqbvC8uRsvU+7h7 9hktDndZrKKLOiMJhTU0u5r9jTO+uhKvyD6UFCvdBtU5R94LycHsmPyn4gmAWUDb8jCXy1V21qrw 8qzNZj2ctLE6j8AadFp4C8Ub9B4ealZW5XdZgY1i/IlavZUESAUTZ40R62YlARUB2HzZxQDWi8al cC4CqveaIZ7EAosFTDxfr5lGS0YcM8oXa02xGH7IX1vuzu770zvZv3+YfdlSFvIw9rpa1zdx6Tt/ YLNVy7x1NVwioayYs/jsUfaRcwu5dL/oAUUH0VH9xvPd7Llz9A0qg+IQH/HsaYihY+iDPOTz1BVs xQOiqO5VMxvVWK3mdOZS804zW8SaHQ6e5Q+JDr48cCRZjnCMjaIoH2VMHBdlo3dzFoTV5ZxnLBar V5pEc2SPkmq8V+wniSf7tjVG4ybgAxJpQgBwUdADI5ZtInQnKJv1759ChGPkF/70nVL+ILEcgUB9 nc+fsxygBQXQjSB9xKWgbi9LBZCKJ/N1Xf99ixftnA1xayCUqKpqm1H8zNIbP7c8esOdXfJik6s8 u99238FkvKq/erest6t1Y/dd37CsWLa6wpO64smKiEsj3rEze2OiSzAXFyXw69yGkZbZNf1VwIgM qgJ6DMkOwTv48inpCyrkR5IKFS5Sl7M+nY/1HYQozOJmbe5DosViN+z2ekNFjjF7zrYQNKMoOBVN BewSPrS1/pBi1f3JawFHEi/jMlNTxroqNljvB45uYQAzeXurCGIT0VrUMgCOvswUwU0Gtm7D8SVr mh9/fN1Lhx7YPWcUexemlg4vGoosauRau+Y2ekyqhPb8D3BDXDj74Td/v7WpyYA7tm197ts//H7V whjo/CHQ+f8BfOlG1+W50s2rR9VG1nhIVPOI45ys8yBn4UUd3Gd4bLtzhhVgj4HyKcTmuRAaFM+L VAY/usA0RoFQfvrwFLZSrihoYTONvbVgIqmSZnvnrXxqwxvvbv/Dl/oeSpzQxRv9bTF3ZGVv81rw ldMLJv/2tT9vs5r+snyRf+ierVsfWlwLtCUw/RNgKoHvV/wwD1Wzx8h6DokbjVhnLDVeYVxh5Cys 0VjEFoElOyQW8agEq9kSlrWwloMiaylBhjG7vcxjHJNPkfsvJ2rzTmQuBqCak3pbwP30HoeAH/0X dypIUO6Og+JmyjfJL5ryT8eRxUr+vRQ/DRAbC2VyBfurNS/s+v17N7x119C+lZ6A0YTP34J37pp7 Y+czXFfvvCHVkxuWTJ79yns3hHrqW/sWXPedR5q6cM89d99/F/AAfN+ADcjuR370SB5btUZRpeky 6kZ1gI5Dog67FUeSMnen6NAJMOxI0u9ylRpFQ6mjVK4pHeO4YKBgk2In9DEeeANYZJphqi3ICHFS T1IJ8X7qHtNN1EcWSDWAK64n6qOB2G+4EKSYkJvNMTNYK+pYDUT9/I1Rv03L8u+9tqhtr77CG67S P/ccX1GX1Sa0ZbPmMiPtCr2ryvfE09oXG+qa1q2Yu/38oZ4WH4QaLPJlRc4FfAS6FF2BK/K4SYme +cEiZVTZwDYcElmlMspjVFsL4zvFWl10FjvrkBjl+fmsbn7p/Oh8MF7zRa2ha77I2zrYjkM2Z7dJ 1ubSCKJLCGGmlg0h2Z7m5r66sRBlNMDbX05AoMYfP27nT8J/4QoMfKgw8NkUInOKl7AKaHxbtKnA jcQ6Ej6c/f92TtHmnOLMf23rFA4qQKGbSJhAvanYlBqrguhpRgMxAXCvRh5UxVm903XblAWgNkIo 41yPcE7/yydXtdaWxBvOHDl8wzv3bTq6q7NrdigQnF03v7dt65eXxub78brzyzrntnd3ds/p9Pn8 22/dsdvWIT7azS4xqp3DyceeMFTWuT36XfuuvLfPVL+0syld5p7fFO1vK4/cnl62ZyBYJM9+b8e2 a7duu3nzuYediXBX+8DcsmoP8VsY1A3ZLNk1QGUHeirPCU0sw7KrRB1zBcNMwu0l8z3mV1DgVIjh GYZnGf3DOp32SFKnK+Ec3JGkAxsYw5hS6XIWhOU4f7wgJEBXft5vyNXT8mWbroVQldCw+l/dYUpk LrMchPDeepZIDQ3SwcKY3BxE8fgn2T+tr/EXq0rCZdi4nZWrDWXOrE12zT/+8eHLxaGuFfgnNXGf UZFUnm9qnOW1WwwKEohj1Aw4qQYbakV9eYyYzaYjSTOyYk4hB40hR2PFxSW2ArQFUFspbLpLxxZu jUh3Cjgid8PAkeNSg4hf1PhjWYu7zKjlWJU5EMLm7di7oitcnEgojCXBdpHVLOpr8JqUCfj2HJwP aCY/BfKbQq/lzycqfWpq18G04SQrciIrHhQ5PvXw4sWLjiQX66z2mrpu2dxYSU/P3CPJHv2YWxkZ a3Q3NrqHUqh9rDdnC+A6sSka5d+u5fPRd+4+P4dzcs2Q8wSoROauyKL/4sZ5On7KumA8aexioQ+I WfJOFFz2UyKDC8+RtlwQT9s4sBbyC/c3F5gB/1gzdGDunJVJ8+qDfb3rkqWsxhxwZN2VZcWasmjA Hqn0GBUyXvBnfVWCRqYxO/xOf1+D2leZ9Vb7i2XGYDU27GAH2YUdge6Zy+eGBseWZu+KzKtymeAy Tx2aswJrlmwSnby3LFQ3M/vdZFfERe71Qt1prEkMNYbs2qr+aHb78p6wOpGgbHffHHgvXJRU5mnJ HQRaNqF78rQMW5km1l5iP5LEJebgw36/D8ySrlyvrYQA6qBYycfG5PKZ7vKgccxNyaaHCzDis+UI FKNhO5G51hilF5E3z6etmVeJcJ/20ek00P9kJCuoT1cgFHcw66jyFcuLrU6fM9DfqPFHs64LuNRp WpavbeqHKyVKioQ63L0CqzuHmoMlmuiCaHbnijkfQdUdbEOrP7pk16LsgRzqie4Cf4iLAe504OVd uC+jLh6yqOC+7JCo4jW7bTYPv5srGKEcnvLwEtzw6JIZU+aB+iwgszLq3E95rVSpk/sy4qHImZl3 /ez6OWNPXfnXD258J/vEinR9Z9iwYlmyP8Cv/fW3bjk+Omvyg8feu5bRvfLyjDW3p1772aJHydnj 2X5uLZxdgFuJZ/KUryPahVUcEeUO88NGI1z8HRGNumprpR3eoxwU7bw3yAYPiV6La3coFDNbfCwa U1O4rORFwEWQ5ShJJJXq3zxvEHjLP+suF+Ph4xZMyQoajbII1WiKnPjmXXxwWqY5+PhF6qWAB8Oq TcEANm/TaRYdvIJ6+mtXES9/8dLKhTO+TZ0V6suwV3bGQw6TMqm8k13QTd19O24hzv7zx6oW1oNK zOlElshRAP0gj81GPVYjJa9kVKySExm1QV2mZvUcBy/liGoMPOzzCUeSPp2lxFZyJGlTigpFeQC8 Y9eULgT3oKDaL2ARgSXLX0XkHZKqf22jS0wZocyla+b1H1zdEN+P3MRfhGOI6P0x/L+Lu+9dMqvt O/qGKkt9pVGuDdVmjRekjO1jF80tzv6xucVRE6uryz63Ym4YXm9erIAw6oOYYgngLVqwJU8jYfJ3 T6n4riJBMApHJ38n1uQqrNUoGiFqOmTkURRiimhEjMDF2KGIxWa1Bkv36HRVwT1yeQ0SqwCDl7sY y6OtlTAlKZNrqzB5N07s5kf39X7yvmJkKkj/pIXzt2LE6Zp2KWYmb5vKLtyJaaEWrH/NNrK4Z57Q t7JhuCs08txN3fuvGbM2JKoS851da5df1xLf8KWhr/8Ya4eGkrMrmuvDtubuJQ1Lxjo0pt+LHY74 jMCMWDi48Jo5fVvn+qN/pnzpB/wy3M/hveihPF9GjCqIxo3wjljD6oydIq9zihq+y+m0sfBPYjSD Ab4WZtIqTfkY7QTcCvHHIe6gvGLjT0TpC2NyG5bDnej91DWnhPkjswtBWC7miJm9Zi9hN3JV0cAy g3f0Hrxr+ywIM2V/xq7sr821fmekxnF9z6yHvspE24vK2zb0fbg9O2vThliR3ZaTRRH08jh7Ct4E 356HOaivNCBUeSSJdKwy6nzYrna5WYUXlN1Bos6cpjG1OsqM+aeUNLzlyakscssz7zdg4PIve4gG c33ianlIqatyydSUEUBzw+0DXJPlnEVat5plQkPhEgfauaCI92jKagL+/ia53leBb5EZyqPZ0zeo NMsOzFm/sxFcSaPXyZ46/7P0hlZX1YIo3tXdWe7QJM4n53aEHEVtqjvYRckr7rkBX90Yh+9PGBSU F4yTH3DtgBc3WpvHixtr9axLZ+fUZpnb7TqSdOsUcFuoULjUeg9HNBG9GSShD4pefCNoutxU0C3T R4FnnLv4M164F2ThXpBeCjLyaMR+x5dNpuoI3uMSSiOB7AvPZM84yirc7KmEyuernpftwTuru4VQ gyLRprKHFgycn8f884qZpfKcn7wWFO8W+M0Bi7TfYSUGf4shN0fvw9dcyDdYtmT/hquyP4V+op+J zUOP292dK3TxfyA1+D7w98OhtebCc/JMVoQb1PthLMQZtJvOU9ybbYIf0hSdO5PNFD1MV8p30odX lkTP4h/A28WGyTPc3Wit7Ksoza1DaeZFeI6gNMQ2y2R3oPXc76HcA20ONCBzoYRiAjm4LhTn/heq Yo+hIa4VDTH3oxauAvmYMdTNfA41K0pRN/cKpC9A//Mozk6gbvZR1Mf8EfmhLsIcI/4FAjzA7xV2 YQM+zESY02wH+yTXxT0qq5P9Xf6oIqD4inK98k+qQdXpopvUuzQazdLiRPEpbYv2v3W7+Fr+UX2j /kH9kxQyL9oL30tKwy9sGARaFq2GG4wHcQVgmGAQw69syBPcf/hVDZrf39PZlwy3DV+18tp1w5WJ azZkoOtp5MHuJ1Q2PMdzFLsKBWehYC0ULIWCoVDQFwq6QqG4UCgqFFSFgrJQkBcKskKBEyfp9mdp /iHN/0Dzd2n+a5q/TfO3aP46zV+m+Umav0jzH9H8BZqfoPlxmn+f5sdo/gzNJ2j+LZrvp/ltNB+n +T6a30LzPTQfo/lumu+i+c00H6X5TprvoPl2mvfRvJfm3TTvIvmvTlmszld+Btm2myyObTeV/OSn UL5OTH8OHldthGzDNZBdebXFceXVO6+1b9lqMjvXrodszTrIVo+YHKtH9myyl2y23NhW4r0BkuJ5 6/PMb3+Hw1u+ja3P4uCr6Wc3Pjv6LHfPvUxYvBevuAvfeYAJk3dX/HsOV5NqlW3V86tYz6piXRNp jHSW+pv4h1fvaHrgkFBq+1Ig1PSlQzjcdQjffZAJ8wdbxaY3DmK15JDGJHZ2MVZgGTBNGMvzTy7/ lInd4yh8G6R9kMb3yMM378Th7Ttk4R1jZaV79+DwrZDG9sjCuyE5Gsy2GWZzvdlQZ9bFzJpas6rG LK82s1EzqjIfxR5xtK3FGwhqy4M6XQiXn5kMn/mn7oP/0f79H9rqD6rPMKfP4FBYGwnrygStT9C5 S7WeUp2O12tURWqNXKHUsJxMgzCjkbOZUrWuR8eo0UyUZNeotrC3qh5Bh1W/0KnUCHw73Uw0U5Vi h1TXsVt096H7VPfonlb9HGmfhtv2MtGgc2BXsU1hLzbz1mIDZyouna3FXiJWkPOQopBaIX0Z0vew VwzII/FQvDweiPviZXFP3B13xG1xc9wQ18VVcXmcjaN4b2wAS4Ye1DOQkIwYngsSUizcc5T19Eu1 4R5J1Ts0OIHxF1LQKjF74du3AxK3F75YOAC/61gyNHgUl5DuPeAEYYyknvSez6fgK0FShnyJfdSV kmpJ4Q5XCr6XX9snOYRE+NK/zVtoy+YtW6f3bJb+3i6daV83LJ2Bn418AL+6ONOelj4QkpvJqM1S qF2KtA9L5dAYEJLTZ4bxRbXwZgQb5PYgj82bw5u3bCYlySa1ArwXjw6HJ1QE8N7+BHwRemmPlIGf Izh6h9KSXUjAb2ugNqN3CL6mnphA8MXpCfga88CEHLKhocHZLvhpWAa7IDkhWSFZIBkg6SHpIBVD KoKkgqSEJIckg8SJ8zJnMx9m/pB5N/PrzNuZtzKvZ17OnMy8mPlR5oXMiczxzPczxzLPZCYy38rs z9yWGc/sy9yS2ZMZy+zO7MrcnBnN7MzsyGzP9GV6M92ZrsylQH2mOlDu3/hD/xfcOVd0CmVuZHN0 cmVhbQplbmRvYmoKMjggMCBvYmoKOTI0OAplbmRvYmoKMjkgMCBvYmoKPDwgL1R5cGUgL0ZvbnRE ZXNjcmlwdG9yIC9Bc2NlbnQgOTUwIC9DYXBIZWlnaHQgNjcxIC9EZXNjZW50IC0yMjIgL0ZsYWdz IDQKL0ZvbnRCQm94IFstMzc5IC0yMTkgMTMzMyA5NTBdIC9Gb250TmFtZSAvTlJLR1FEK0NhbWJy aWEtQm9sZCAvSXRhbGljQW5nbGUKMCAvU3RlbVYgMCAvTWF4V2lkdGggMTM4MCAvWEhlaWdodCA0 ODggL0ZvbnRGaWxlMiAyNyAwIFIgPj4KZW5kb2JqCjMwIDAgb2JqClsgNTczIDY1MiA1NTEgMjIw IDU1MSA2OTUgNjYyIDYxNCA2MzkgMzUwIDY3OSA3MDUgNTM1IDM2NSA1MzEgNTY5IDQ2OSAzMTQK NjA0IDQ2MSA1OTcgMjMyIDUxMyA1OTcgNTkxIDg5MCA0NTkgMzI2IDUzMSAzMDggOTYxIDUyMCBd CmVuZG9iagozMSAwIG9iago8PCAvTGVuZ3RoIDMyIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAFdkk+L2zAQR+/+FDpuD4sVK3G6YAxly0IO/UPTfgBHGgdDIxvFOeTb983sdgs9 vMPTaCT97KmfD58PeVpd/b3M8SirG6ecilznW4niTnKecrVpXJri+ma2Fi/DUtU0H+/XVS6HPM6u 6yrn6h+0XNdydw+f0nySD7r2rSQpUz67h1/PR1s53pblt1wkr85Xfe+SjBz3ZVi+DhdxtbU+HhL1 ab0/0vVvx8/7Io4X0bF5fVKck1yXIUoZ8lmqzvu+e3npK8npv1JoXjtO49vWZtN3ivfb0Fdd06CA blQDCmhU3aLg/eBVdyhQbVVbFNBRdY+C97tG9SMKqPU+oYButTqgQO+T6gkFVFQjCqhtTih439oj BQXv91YdUaC6ozfwLRRUXxXIqqCaN5BVQfXeQFYF1XsDWRVO1giBrAqqEQJZFe+5HSWrQiI7mazB 8u7tGWQNlre1o8gaLG+btJesCidbL1mD5W31wwayKlRNyRosb6s/JZBV4d49uiWrQgSUCfj7q3UY dGjfhyzeSmG+bLJt9HSkpizvw7/Mix5g/AE2ztVLCmVuZHN0cmVhbQplbmRvYmoKMzIgMCBvYmoK NDIwCmVuZG9iagoxMSAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jh c2VGb250IC9OUktHUUQrQ2FtYnJpYS1Cb2xkIC9Gb250RGVzY3JpcHRvcgoyOSAwIFIgL1dpZHRo cyAzMCAwIFIgL0ZpcnN0Q2hhciAzMyAvTGFzdENoYXIgNjQgL1RvVW5pY29kZSAzMSAwIFIgPj4K ZW5kb2JqCjMzIDAgb2JqCjw8IC9MZW5ndGggMzQgMCBSIC9MZW5ndGgxIDg5NjggL0ZpbHRlciAv RmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBtVoLeBPXlT4zV0/rNZL1siXbI49lG49syZYfGGR7sCVj Ywy2MY2EDZGwDeZZXiEhIeCEEKiAJrQBkpK2SbuELknacdKmpttNgaZpuw3Z7m63S7NfSzZf+m3a r7Qk27TdEuQ9dyQ7hKXZ3TY7mjtz7znnvv57HndmBAwAGGACCIRGNqW2wHJ4CCnfxFQ/snMHX/9m Xw3mrwKw/Jotazft+s2ZOwAIB2Cct3bjrjUX2588D2BZjCkyPpYa/fVX3M8CFB/EOo3jSDCn1K9j +RyWy8Y37birKak2YflNLEsbPz6SEp7i7QAlZVgu3ZS6awtxmnZhuQvL/ObUprHNl1p+huVxLFds 2Ta25ewPvvQLLD+MY9iJNAZ/9DCCBirx7gMLmEENeXjX4Zz0ODcWTKBFCQZUoFEfQR6olwMHonoY +aByYT53kG9m89NXpz8LMI2zzl4zAzSvPg5qzF2bkdbcCxxpmb7Kvg7c9BPTvwWrwonQa+beGans PYOoZQ8d3mhS0WI7PAVHgcquhC2wFO/LMQUwffhx4cPZf4L7t3AWZIU3CU/DKfickn8WLsBXb6iR yOWXwiDcBSvgCRzTGkgidSt0z8olIQG1+ANMiGjueBHegr/GZfkl828zpBvuBzA/ib19HhbDGLSq 31G/A4/gSD4PPbAPcXj/eFXJXmJTsFbJ7XmfpeTWQi/eu3BEFK8HcJQyPIxtHoA74DiWD8A2RPWn cA42wqfhJI7/W/AFuA8+BSc1Lyir9h/qSTCx83A1dbgKO6E9cylzYfqqFL991crhoRWJ+PLBgd7F PYu6uxZ2RjvaF0htrS2R+fOa5zY1NtSH62pDwZrqgFg1p7Ki3F8mlPr4kuIir6ewwO1yOuz5Nitn MZuMhjy9TqtRqwjLQIBxy+6OeGy9XNCRlI1CVOB42bjkam9QBpvHJ1j5cDBRnZOS1aIM+T2yvS8+ CdLchKwRbxZZIhM/944PK/d6+Jis8uMpLEqNypUDcZ/A/dgzy09gs3JhR9zn88isH89uZOG5KMWP ylwf0pGhULpl6IvTNDX9xlwkwlxfAq8Dcbl4ppigrWWncsMgz6KdnLtpmEuYNDdpLOiIymCfBOMb Mjio2NW5uFYRuVLEgXCYU1qDoMzY35GZfJlx9OKUPtgFrfb63FtgEBtdL8RG1yGio8n3Mb2aRdTH p/n0QNwa9vh8yqB75O/1xycNeR1Cx1gezgIUAkzmGZBioARcli2TjLGVUTKsMTZvkgWdCeGz0eHG aFovS4eSmBGiiBty8t/nTE2fO3wjC7BaVghQTMkxSp+ypkPWZgfBr5OllAyH+MnAufThKQ5WJ0Xj qDCaGo7LJIWDmgTij40Pyt6evhVIwkFgSo7zdLmjyoUuHh8b59NYprJJvApRrPpB+uj4WJKqCZMU osjTd8QP+M55ZBveY7JVlE1Y3XT3mx6SjrnX8bSYTh/g5Sf64zdyfVQGlcBdHeDTMQF7w8Zi69vp igVnl03Rxu5RZXGkQylenli9HjHDM3V4Rv99aU42/s6Hq4PrgzWpdVCAaRpNrqdTWY81VXjj04fG lKkeVqaG+srH1kdpohVR+2E51l4Rj40LMcQz1yECgvWJ/+a6Pp9cINKK6XSMDjE1iqOnyOBZICrD yBbQJjwig+PpkKVB5QaDyhpgj1IqmsiRcgLIUeE6yFIymkjQSWUXQNb6D6hrBD5Nm9f6ZbvI+V5C 3rnqQM9APBal2omSbEe85YrbcwXzPX2zZMaNMungFQoS5SwTevqzWjBO8aGX5GDWgBG13MqjaE5e afWi23Mx28NwvFPoTKbTnQLfmU6mU1PTE6sFnhPSk0ZjekssySvmzyD9G4c8cufhhMwlx5l5ygrR 7nFyxN850CPn9w/Rperkx1NIwbNN8M31+KyzMuhFbs3O2RxqP9oAtbk09yucvRG9k4fvpK5mCj2E R+bmUpPFAS2Po02MYBexUeWCtrIMG/dQqyEJf2zdshxYHh92qSgP9YH9OSo24vNRezo0JcFqLMgT /fFsmYfVnudACoq4jknKOTfDcSynnIkZzmz1pIDr5u7B/hX9+FP6jb59VrfTVsHGN1PHjqPDs3tU PjeIc/zDXFmHiClLn98RJx6WimCO9RCayxMxPERkl6hUpJigx0xzAv9DQeZEWd0RP+eJJHjOis6S QZkuFKSayv1Q+D5D/SjYOZmJyIyT0gH9KqKHft81F5mzisTH0smcAt44LRSl0qPjs6aUHTzaLp0b zp4T0HQ9WRisNoHO8BWq8DOBwd9J7QqXRAFqUUI203gnm3+lXHC8no44j54ILbdfyfAxfpwutswn o4pLSHgof4Y8Nf16MkpdYBx1EEU8ORVHRc9C+0FVrA78bxV9AhX9vsOJ8Xk4JqkKZ8A3YLcU9I7B eM7clHVSjAD76qZT+SB/FsUZGXRsaM4+OVT4fTcqaqFbseqs7c4K4yIM4mxmF+DGzhTejHrQkcid GP+zPkAZmbxQKStzp+yum9jdM2x0H/d67kY5DGTtkwJzsH9SYg4uWxE/i5te/uBg/DmWYTuS7YnJ MuTFz/K4L1eoLKVSIhXhaQF6GGztOVanyHvOSgATClelEJTyyBQDCi0rhDQGRqbYLI2bkWORpsrS JIWG8QSHGHOPo3uLC7joo7LUF9+dGE8nExRscGYVEDVbaAWZFVonGVZjlPOEsXbZILRTehult2Xp GkrXCu2o/mgc/BSaejopoPmjA46Dh0lQFaZazvr5qelp9KAX0fP6ZI1/GBM6WL2Y4GW1fxHKLaQp ieSF8sRIio6DqinW1fq7RxKybrZBFOmW9diCPtcCSnQqdTA800ojqKwpQckiGY1jIiEnRNppfB0d Ec/jfqhLmCdryrODVJfTjoKJtE2oU8KJxi/n+Q9gDexjkeIIFYoHi9gZjUd4ao048hEBpUaSPK6A CkaWoTKqyumZR9cNKWMY1VXlGFQx5aEhK0yg0yJ+gylP1tdgg3jSvKEGG8RTm0BQ6OSV0oGcAPbN yQYcUfkNUOYqIDrI6qZjwfMADp6KnqfN9E/BgHCXzCiIKl1pkS2b/N0p3Cxk6xuQIuC+L1sZ29L5 KYm28VKWqqUzNyob2sGp6dPCLmokM0d1QJBhME4VEzy4h5Qgkb6ZIA+h49TdTDUp5HRaZ7p1hSxe OtPsHVvBTlTwIl4eVA/is2gAQlAPKSnfbjeXajRmCIhiyOx2h+qlIBqE5AlBmAuz4SJDJUCVmG+v s4sGEq6ubgyFgxdtzUGbq/liEH/N9ALBlRcLf1pI6RetzcGfvmpttoaxUBtiGupb2aZW0lBfLpSa Wa3Q0NgYritmHXYsmInD4XIIDYzVZ6WJbdI4q8pc5R7LglY+VFagT0Y+0dE50uq1lEUCfLlDa3uY ee+6hqTem8v8u9Ppr2qoKAiGm4WeAXtZXfH9xTVF4c455a0tndW+QEWlV7P5ySczb6o+c22N6vd/ fAanjQcLu6d/o/oX9RjYQIRVaI8dy+NSgWpPfn61b49k0peRsqOSPh8cxHGUqqK7rbD3ipi7hXAT iUWc2ZVaj8T9D8IJps6JT1ssqxJKy8sb6m2tLMMJpVrNzM9hd4brmhrpj8R2fy21/vuZzJHDX/9Y 996vXGKWXG4MzQ03184Tqz2FW7es6B/t+1jQqx5LvvTwycy9mZ9/YuP5fXuZ+ZnnhjM7mTqbU6xd vGL7XYf2b3z8saaOT332jf0418Hpt8nPyEXwQBiezM01WGIygsHLEi8xGBrm7JPycVRQWlBKSo9J BZzJGOACJHBC4px5+tPRPAdOfWb6VgiHs3hgzt0WDjE5NFzhA+fwQEyK//zGEkyTi2g0CIpL62uq 0GgQNdQeEq5zkkZ8qqUKpFIga0TAGptI+7D0mDmvZoE+80abKflMcvOuQGL3F5OtW7x6TXtv1eIl C+fxzR0lHQP1wSYbOdTOXU9EFjjm+NW111SH73/qePL8sw8sKcpMzokISxZ62tZ86vTS8bXenu6O fQnErnf6KrmE71Q8+AbhXA67cvs+ac6cMOs1m/CNDRAjYY2MAhOYTQGrgpuVA9wOSFa9qQtKCxVU C52Mk6VAtinKhOCJszAijhRehNIV5iiKVhvTTGFFMO0fVeOJJm0Fo2BY0dQUJi5qg6iZZiKUZhEP 17WqZkz0F8MSQzTWcLvx+jzZlDqzfNOu+evue2jpfkueOtZX/7HetlDB/AWhldu6CmoXcKo7C1YV VZWy9frrUdX9O546sfE1eetcZmN1m3dpZ2Xv5iMnFoyPtxx5ZDtgrL1t+jdkF3kFePhBDtEFVmuJ Dk7xfEmJ7gEJXIyRuHjvhFdFVMckL2eVSv1dVt7CfZzbyz3EqSx4meZIPuHsdhMxnZDszpxpgpv7 Eb4b2VpYcDEHLhS6uYuIK1IRznAwHLxipT7JI9V8pD0kmBpWKNWgSytmw3WNTa6c5toUlF1a9jLr CIpjT66x+FuCQ/sXtaz61uajx/s+8+odfXfW1LKvLI6WPpn5ycGqRY0lsUUt48ln/moDAxeSNuMb ir9CG1Z1oR6WwXz4mxxq8+b7y/A1DkCegeTnt9Tuk3DXYCSePEanPR3VQVmVr4pUHZN8nMNe764n 9Sckt9NmPR21fYg559QwCxcClTNqatXCX95wIqt/5VQBmVtbuYvcysrX6IzOOQ3Ga/Mz129h7C1r G7ss/83YVbt9fcXFJWZSr7820dZ6s80XlGRe6ZJuYfP4HpXcj/7SC1Xw4xzWrV4Ap3V/WVnA+YCk txeRouOSxV5iZ4sIxk6VuYJUHJPMHEi8vwsV23vVyxqIV6UqIAUnJNVN6vm+dlpt0OzO6aZ4Q1zB 8BlGxGv/nzpK+M2orDUsDcuKD1D5qMeleutvVSsuQKMhNYsOHhxYuq2nrPfx1+7ZtStzPvOycWDl 8PGBTNXwodH2Ckvz3M4Da7/bv6oynLina8O7396wevzMmUjnutv7lr3H5Ptqmlp8LbGxp6nN45tQ chb1NwAP5RCtVleWEoapsXiMJnOh2cwVEgsETkct4DB6dCU6ojshlXBu1+moGwoZ6jY/GIDCCl43 uksXhazw/9gGvgTJn4krrJYITCuioujnrIPUZr2j00VOZV7eY3aEmueMbF6QP/Qswxj0KsVDPmNc dSaeGrUP5ukcYpB5r2lrTVdL9NDeeGap6s666nJL1jf2qO7dtmGdtCLzuFifX1JqVSu2fRtuSELq KH4JcMPxHDohN6MClZk1ESAqYmJHpC2EsZDLhLWQ2wmrJ8R9BrcVp6NOi9FwOmqcsWjEiOv9OdWo rSsLryjxBMMJDSmITemf20yC0QpNMyhoc4ApILGhmsmaToPGXhXSZ/7uhCnPWllr+O18dfTChWsv hINccalNXct+YV7MVcRzbIOe7r2Wof//Bvp/O5S+v/ey7PN6yxz7JASBuI9J4DSUkJJjkoGb9exK 1LzBRnBCyPxQ4YSabh5wZ6WoOcY6rZllFD23ZZWcZR47+bQlX6g+8vV12z/dXlCW/mHm8tDw6kfj g4nxkwnrl78Y6V/XP/bp3viJkcTYI69uYMo3r5OZlrs2bvpy5ps0lqFe78G5eOGruZUryDsl6fU6 nd3G5jP4cxE7nPFyxGSamn5L8tpdXaDn9Kyd6DUTGoxekobzek5HvRa7sjdQlPyiqIQtXEXRGg7j gs5uDKwMDWGFuC944SNoNcGEtco2wKUVyrNbcyLkU/+Li8t8MtJpvP1rye7a0FpdaVnFmvUN5qFn H3XYKkMG8p3fqfbtMbxe39h3eGdXZin79Kpab4mFNKCtT0+j/7QhJgH4+xwmC1ynUFkdfjgVwCcM 84NFRTXaB/0+g6GQQCAZ2BKYCKiMJDBHmkMIOSbN4SzOEidrI06brZAUHpNsNzjQlxCV7G6cRnYs YDi30k1odkdep0R4Jc6jggQ+0j4SDAVJCVtOF93UKzG+oinspK5TQY36VBrxMeA/YuhfHlwcKF4o pZaseHx1/LGu4BLt0G2J0WJpftsSceDE2Kk9New/regXOqr9Le3igrv7Vu2TCu2XhocS3WK0tVJc PNS07G5JfBX1bA9ialY9D8Wzu9BWtcfhYd/1MBiY8vN1DpvT6uR0er3VSXQWK+4DrDZJj65B7/i1 ZLMA3UIBX0yIh3hOSOQGQH80E46uvzSrdnQfekBxG1ThcBsAK7fWhnAL8Be3HEr4czujpnwBHwmb wlqf1kdmwg/7xYEnVqwft+0+ZpgfC1YWp5uYFmfmQrKyIVwzFpkaGdu4tm0Jqw1r/S2rV/1+LLP7 C30tbQu70I/SL6cA7+K3PQLWFxgW5AnGBm2KEwzXNqEDezf8Yvitt95SZNcw59kIO4yyXslMGJYh zB8vs8wT+KIJH2NXXhHxGY8+uPqafKwn0+NjvsacP4l9UP8FVQeXV9xuibwLBh0SAL4ztNYxc0ft p0+Wx1FOT2WVA+tpP5NpBtC/fD1x/WV9P+yAgukTOS69cej/X2S+jU/m/wm7VQ0wqBKhl9wJt6lq YZB8CQZUrdDLilg2wzLSDrcR8/Q0+23YwzwKKvYIfjsEuB9/f2COsxL7GnlYNU/1PbWkfkoT0rym 3ai9X0u/o9Lxc/gNUwW78Wszi/kg/WbKPmichzTKZfCJmN4Bv1XjnLq6F962bKnYkdq0etu6VHX3 jtTGdSMg9V9+3eny/uif8XLPbqfnnt0F//CPmN95J142bcHLxo/jZcNmp2fD5r3bCnfcYXd4167H y5p1eBkbt3vGxvfjJn278+6OAt8uTPjy+PmTxb5mvEvOx3mhmf+x0dx86UWGlw2mZuk7gVpknXv+ +fx8RaT0qqeo+dpRVoz+4eDRg28/evTRt9VTbzP6EffId0cIP2KyULHnF5b4FfE5j5b6m5s+xxw/ xoruE3Oqml0nGO5Ym9T8k2PMlV+yovRLu6tZ+p7dTjuRhiexl0/sV4sTe1nxvr2MuGevWnxvHys+ uJ+Il/Yye/f7Sw7uZ8QDmB5AsX2YdPv1TdAh1eq5Zk+Tw93ocDQ4bPUOS9hhrHPoax2akIMEHVDj WCAyWkYHFkbNaMCMaqfCPINaZ4Y2hsFEMKkBH75wRVAKl0QLHCYe8zzeQ8gJYT6EeQnTZayVx5ik jR2tvvIKc2WFxVIVqmSrRHNAtJQK5jLBgntgvsQCak7NWjirUZ9nMGq0OiNRqfEPB6xRQ0ZLiqGy xGDpsbAGfMCIkh3kafhXi8YABmKwzIf5+gQZ0u8kJ+Gk/jHLT8B4ljEzFnQrHqbI5NYWmhycy2RT 2U2ow2YIYmrD9BBjlspVgUhVpDJSHimLlEb4SHHEE3FHHBFbxBLRRzQREoFIX3iQkW090DPYLucz eF/WLofFninCD8h1Yo+s7xuKTzLMJxNIldmD+PZ2UFYdxPdTg/hdcMVQfIopoOz9+PoMsZB7kvuP JESxSB6lH0EmihJyHc08XJTA7zp1/bJHaBdvPrYrhO077sgxsmVxu1wVkwOxlFwZS8rlQhS523fc VJfJlm8gww4RS5SwIyedbU52y204t5vqi5N6Osm+gXZ8aT7cI4/ip6vivqGkXCi043dYLDX2DeEn jXaA/wIbBYauCmVuZHN0cmVhbQplbmRvYmoKMzQgMCBvYmoKNTY4NwplbmRvYmoKMzUgMCBvYmoK PDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgOTUwIC9DYXBIZWlnaHQgNjcxIC9EZXNj ZW50IC0yMjIgL0ZsYWdzIDY4Ci9Gb250QkJveCBbLTMzMiAtMjIwIDExNjQgOTUwXSAvRm9udE5h bWUgL0hJR1dTTytDYW1icmlhLUl0YWxpYyAvSXRhbGljQW5nbGUKLTEyLjM5OTk5IC9TdGVtViAw IC9NYXhXaWR0aCAxMjIyIC9YSGVpZ2h0IDQ3MSAvRm9udEZpbGUyIDMzIDAgUiA+PgplbmRvYmoK MzYgMCBvYmoKWyAxOTkgNDMzIDUwNyAzMTkgNTMwIDUyNiAyNzEgNDA3IDYyMiAzNDUgNDU3IDM4 MiAyMjAgNTIxIDUyNCBdCmVuZG9iagozNyAwIG9iago8PCAvTGVuZ3RoIDM4IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdkctqwzAQRff+Ci3TRbDsvMEYQkrAiz6o2w+QpXEQ 1LKQlYX/vneUNIUuzuLoaobRKD81z42zUeTvYdQtRdFbZwJN4zVoEh1drMuKUhir493SmR6Uz3IU t/MUaWhcP4qqyoTIP1AyxTCLxdGMHT3x2VswFKy7iMXXqU0n7dX7bxrIRSGzuhaGerR7Uf5VDSTy VLpsDHIb5yWq/m58zp4EJkJFcRtJj4YmrzQF5S6UVVLW1flcZ+TMv6jY3Cq6/n61LOqKkbKkOqvK Egqk3K5YV1AA7VnXUCClMqwbKEC6Z91CAbRg3UEB9MC6hwIpdyXrAQqkXKfOCgqQrjntoAC1G1YN BUjTVAYKMIbklKAAl1PnHgqgaIUV/L6Vt8G/9tiyvoaABaevTbvnnVpHj9/3o+cGiR9hHZ56CmVu ZHN0cmVhbQplbmRvYmoKMzggMCBvYmoKMzE1CmVuZG9iagoxNyAwIG9iago8PCAvVHlwZSAvRm9u dCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9ISUdXU08rQ2FtYnJpYS1JdGFsaWMgL0Zv bnREZXNjcmlwdG9yCjM1IDAgUiAvV2lkdGhzIDM2IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hh ciA0NyAvVG9Vbmljb2RlIDM3IDAgUiA+PgplbmRvYmoKMzkgMCBvYmoKPDwgL0xlbmd0aCA0MCAw IFIgL0xlbmd0aDEgMjUwOTIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7bx5YFTV 3Td+zr139snsaybLTCYzk2SSzEwmO5PkJpmEkAUCBEjCFsiAwYVFFkFFohLBgChWqqJVqiwtbV8H tE+xi6VWrVqxbvXpYxelamtVKvbphsLw+5w7MyzWp+/vj9/v/eud5Hv2e+853+18z/ecewklhGjI OOFJePSaJatlecJOlPwQsHd0wzr3qVSKI4QOEqK8afnqK6555VeJKkJUvyJE23rF1ZuW18x94WuE 2PIIqX9lbNmSxKe9dhkh0z/G9bVjKDA9bb6BkBnFyBePXbNuo8Fjvw75LtxTe/Wq0SUfzvvnm4T0 D6B++zVLNq5WC6Zm5H+DvHvlkmuW/dE6vAH5syy/+tplq+/WfbyNkJl4nuEDlFH8sZ+WyMkuxB7S hpIoRmQnxSRISkiItJAGIpIIaUKdjJSTQlJKBFJE8oiPWIiJcMRMCoiLKIkDd/GSMqInFbiTmjSS KcRJckk+8ZNqoiCVpI7UEisJkDAxECNxkxrSTKqIitSTVqIjMZIDPGqJjRDZHbieyOagXVDqIRHs SGd+/A/T6fOnzwN7509ny1OzLqZx9RGSwzeRHHYXznr+NPcOMZzfd2mL7HUXYx5t0jklIgYCy7aR zSzCbzQdIV4tpeZm8l8ePf3lxf+29GXyAvkBuVVq80PyOPl2pvW3yXfJBHkavLVRKhkiM8hWsg/h AEqGyTQyhywiK1C3huwnBzJXLSUjoF0EuWZgdDJT+iL5gPwHPYt2D2RKLkZfwVOuJcfwpAdIN+7X THZjtPeQb5GHSQ+5DbmLP/Aefu9wS8iVZC05RJK4NkHGpNI+cjPpIgvQt04yF31aiacPk8fIE2QZ OULuR/kPySzykPwpouTWMUqd/2+u8fx/kx24+qvcOu5mbhc/TtaRG8lD5Hfkr+Qucmfq6X9PPem5 /z64i9yHUWwFt7eRYb6J7+dHLtD2319JyPeAr58ANxtBlYOgy0PkLuoje8k2splqydfID2nVZdj5 393vy+q/R3bi3pf/fkqeBN4OgL67gLG1oMs30Pv+yxtBmEuoGnxzJRmmOvIZWfzF+v9P8qvBCxvB cbfgOddi5INkObhrPeIxwPrsM2gtbSbbQfVHaQV5D+Vt5CayknpomDxHtlMHuR7tv4bSe8j3aRht 15InaAk5A6maL2mi7I0yMfQB5FLSByhREmojLzPZ5D9jDfgPs/qA5RiP0GLyPCEX9QH10hzw2/fI YTz/EfIAdVGe/I2cJCkaonmgXCl5FfAc8PZ98hPg72O0cJD/pGn9yG574ffFvuCKHbJlkp5Am3/t C7j9jkv7Ark4RB6EfG0GDz0BWf8JuZv8B+KdyO2DBN1LvgMeOAheGkdfL/xkw9DMRHYFCyUc6MhP M/oJef44Kz//6vkTrDYdslRq14X0LyHNv4Y890NX/N/f/8XA/0EMcIqz78re5qbJ9DJ6/iPhsEJI zad/QwcOQOK/gvAG/F3x5R3iz/EfyB47/2fZ91NtMqOsOLUmdSPmsv8k/0V+QZ4l75LXyS/Ji+SP fJh/lj/J/0UYEeSyE7JHyHeFSnId+eoX7yqsFMaEmcJ+YViolAUgQXmkD3p1HuaqEbKUXAW9RsSh xOJFCxfMHx4anDMwq6+3p3ta19TOeHtbq9jS3BSb0thQX1dbUx2tioRDlRXlwbLSkoDfV+wt8rgL C/LzXLlOh91mtZhNRoNel6PVqFVKhVwm8Bwl5dSRdLQPdlyZdLaPJLXeuNfgTmqnn+4LJYnJ5fEa 3dHQUEWmVVIWTBJzT9LSP3iEiPVDSXnwi02mJ3mf4S8eXNzncnckBR/+vd1LEsmSWYMer+FN14X6 Idw2mds+6PG4kpwP/9NQhf/uJe5E0tCPclRIJdOSpH+QwbHzv69HIan3DCGcNZgsyGaH2N3SQ7mk k09C9Rz/Qjen00nDEa2zPZ4kliNE+/sksbJmp+thLsSSJUF0xICUdDcSSlLLX5LUnKTWPgzp8kew y96p/xIcdCSu9HYkVgCjiZGLOD2dxqjHPemenDVojLo8HqnTPcnnZw4e0ajbve3L1BgFkQrIEbUG JRpWALKsPkK1zVRKcNqOxiMcUeYAfSbW3Q4GVybFHSNIeOPAG2rMF2uOnT++89IqgsvSjQiaSSkq PTMpb08q0p1wr0iKS5Jkh/tI+fHJnccMZOlIUJvwJpYsGEzyS9CpI4T3dYwNJPN6+odRhE4ARsbc jNxxKWDEc3eMuSeRZ21HEHrjuPTy8sTYshHGJnTEG0edqn1wm+e4K2lC3JE0BpM5uDzn+vdc/GSH Y4WbZScnt7mT+2YOXlrrYW3ABI6KcvdkhxdPw806rmxjFAtdIJvEjdMSEnHEHUvcyfGlVwJn+F+y M8v/nklDUvt3D6gD+uBKJh0MwQwSI1eyoVyJKwVE7skdy6Sh7pSGBn51d1wZZ8AuBPeTObh6eLBj zNsBfGYeCITget73xWs9nqQzyC6cnOxgXVySQO8ZZvDvDErdSGcgE64gRX/ak+KAFJEBiQZ4orgk PpQpyjRAjQA6JMWR+NAQG1SaAEmFb5us0uueZLdX+JKWoMHzDOqOV5T3zBrsiDPuREuufbDplMN1 Cume/gvF1IE2k6FTDEmsZra3Z2aaC8YYflgwMpAWYGAtQ3k0zbSX7nrC4TqRfsKCwU5v58jkZKfX 3Tk5Mrnk2PnxpV63wTt5RKudXN0x4pbEn6L8+ztcyc6dQ0nDyBhtlCjEHo/B8b7OWT1J88z5jFSd 7rElKMF/i9dT7/IYL7SBFvny6ozMgfshA0zmJg0fY/RaaCeXu5OpmmPQEK6koZ6JLDo0ZxAyMYpH dCSkALIyGzd3Manhh3wdK2ZnkOXy4JES8zAdODNTipt4PEyedhwTyVJkkuMzB9N5N1nqOkrEUBB0 HGE1x7M11jmsZjxbc+HyES/o5ujB8yX++J/4G7r9Am9PGr0mdwNT7Ogd/qclkscHMMZ/1ieVwJhE enP7IO/iWBOkOBfPUuogpodY0h6ULmQ4gcacNHjdr3iThmBS1j543BUbchuMUJYUbbrQkHGq4RXv C5TpUWIxJGksSW2snECvAnvQ+/Z6VF5gJHfH5EiGAS8dFpqy1omxC6KU7jxkl40Nozd4IbquNBqM Ji8b4UuM4bMTg6+TyRVIIiGqeyipY/NdUvexFKC/rvZBNzQRJHemlHB3uMcYsZPukbikEoZcrD5b fOz8OyNxpgIHwYNo4sqwOBg9jdrLWbGi/P8to4+D0W/eOTTWiD6JZRiBuwaPZUhvHxjMiJtEJ0kI 8KxpbCiX11/AYrYNFBvE2ZMM577gAKPmOiSpTsvuhcYgwgBGc4EAlz5MqsuyB+tJshPzf1oHSD1L TpXy0thZddcXqqdlq6E+NruuRztMZG1HvHT7zCMi3T57ePBJrKvc2wcGj3KUax9pGzpSjLrBJ92w gaRSjpWyQtbEzTKkh+JuRzml1N71pEjIuFQrSAVSfvQYJVJZuhHKKBk9xqXLDNl2HMqEdJkolWE+ QRc7HGNQb4NeED2RFPsHbxwamxwZYsgmtjQDgrO9zSTJeZuPUE6uTaq9y9qSGm8bK29h5S3pcjkr V3jbwP4QDvcxiPrkiBfiDwU8SFx0iLEw43LO5z52/jw06AloXk9S7lsAgIJVBYfcSZmvG+2mMhhB 8dTk+OgS1g/GprhW4Zs2OpRUXrghmkxLqnAHVeYOaNEpXYPpmV00CmZd4pWSKIZwjA8lh4LsoYMr WI/cbthDXd7GpNyf7qTMzx4UGpo0eauk6UTuS6p923AFntEtKUKpxIUsHsbmI/wrtOj5qBetRkfc oIBARmeDGQU/+1czuqFkGWZ1wY9JFaCGIEuVhA2L92ly1ElVJW6If5bWVOKG+FcMASls8FJuW6YB nm1IatAj/yWozFwA7KBqGusL/reh86zpT9htZh4js7wbk1TCqPQoBaqTOb5pS2AspK/XoMQLuy99 Me6l9LEido9n0qUKNnKtZNAOHDt/yLuJCUn2V1HuTZKBQcaYxAUbUiRDk18sSM6H4lR+sTRHKp6c VOZ8+QVpfClzLsTsLu6OFfEKPArofQrBbbIB+FHL4fOsJj2izxqqLiktJ+X5mkhldbmmslJTXi3U 1JLSYDhqMpt1DkdlhCctJ6pC+G/57Zsnqowmam8I4Wc4YThhjBpOVBl++1wkTGuqm7m6Zr6m2u8t 0nEKb01tbbSqgLNakNHxVqvd6q2hRo+RAVcnt5UV2/0ufWuzO1zsVI3Ebm/vHG3O0xfHyt1+q8J0 Fz17Ts4vOVtP/2iz+cpqAs5QtMHbM8tSXFVwS0FlfrSz1N/c1FnhKQ+U5MlXfv3rqfeEvZ8vF/7x 2bcxQMLB90uEP8mWwT9cRG4S40qVp0imUbuLdEVOR5HbU8TLdLLcwsJind2s1BRZ3GpevVvUu2e4 OSPvdjtM1FLAG03Gg3Fi08ldMlORQyAt0ZA9GjQSe9RoanCEsCTL7TsVNJpIQ0MYZmY0ampAYDTZ G4zRqGHb8ePHGUQ8Nc0c0BIIeBRyudVis1s9QE4djdICzm6lHp7Pq4o4DHpfqrIo19DUkppTPztA v/4QHXD4qivOPk4feSqidgSLi2ZEbl7a3VsYq1dFIqrVY8Lszw9Mn1WpiXB53ARcLmQTxnwlvFL5 8HrXkpXiFJu1tqyslq/dLZZp88t2l4TzK/iK3fliPj0Yzzdp/bx/t1bUag7GtbzxJo8nYitz3hSJ 1JcFt8hCJ6swmpPGBhaSliDJdRgwWOK4kEQ6dGH8kXCUjdJYXckFajxVNqw25XKFNR17+SqsTis5 b5FcYTTaolW1yPr9Xu+m5rIctd2Pmod/sqj96jnbd25664Hi+75eMePqFv+NhdOGb93dOvWeWx6I GAJd3fySjhavNScSn1gxb3ygWFX6rQ3bv93HffqVnR3za+0Cd+6zcysVbTcvWXJTM9T7dedPCybQ 301WiwaLQWftsuhNi02rTLzJTmC4iGEUgVH6uRHuFU5Q8VyBXcfrdot2c4Gcl+8uEAqoXM6pqXk/ ZzIVqW/KDZ1k5D0JAWjAP2mRkMEQQByGZ8ALDUHDMwggCkavNFbwvkkabF3UKJd7i4ix2lQcrbIJ plFH99KOK76+oPeeq2eNTXWPLnp2Qyp1dhuV/8f8vbL61Efzrii/PXXqp8+kProjtHw09Xunkw7S OW/StqSZ8TY87sIboLMLuxGNottVwBfsdokuENVl0mkPxnWlfOluHW/e7PNV5G2RSx0HDU8FLyWf RDH+AsWYpHIKOTjUG0Cnm4Waag6SrNhYWWJTg0Yh+h8/+vTgrL5ucWHfi4caSqYPbL16bq1z/S/v iTdFtLYisYNf0tlSBPrMfuTTQ99MnZ/XGykpWijkxa7acXjZz6lsI3NJUolHy9D3SnL7k0R//rjY o9J26dWFhXYHx6nwJN4kosRk3y2qK4vU4Nki78F4kYN37BaLKisOxitVvGp3JW/crzeZHHQ/xzk8 7v2FhWG1Y0sgw7QS50rEygxa4lM2eiTOPReURNYRAhVDhucyBBO8HiNjTNCKUc9r9FQ183VRXhLe NFsL7qV6d1FpfSD1zJvlVR79okW6olDoTVoXaSovsltGzWeXZvhZNif1WqS7qkBz7q/OmJgajzXl nvuxsbRtajz19ct4menlNE5UwEkZ2S7OJjqDzq3bp0vqZCpep+I4pUpl4/XGQmPI+Jjxx0aZymjb LRIVtfKqsgLVblU4r7Cg8GC8oKz0YLxMySt3l/H6/UadzsuQU66yb/Fm0HIZRqDGogwhkhI799yi hRmkGJ5DSZqH+S+ixML01aUIUS21lVbEIqlfv5zGh74oVPmyzl1bkopfgon4QLnp3Dv58amp4XhH fmpjrKvMCg12qUyn8cBk9j7IbAW5Qcwt8fl90L5+quL9fi2XL8vn83eLVGbWM+kthfTqiaHfMGJ4 xQDpNWi1Vt66WytYtVqlYb/RyFVscbtDzs3KNPc3SLrMGE2LbUZeW6KS/iLQ2xIiGE4iYZ8icKm0 2r8gzTVMdUHHWTGpCbXTp7XuWnDuPNlJ5UcWfnvFqKv7ihnX7J/fd9+qDdeaw3X0nuJis0JmnV7i p/Pp3F/Stu9Yc1OnhpcFd6Y++ckzqQ/vuOKq2HB/uS4S0RZWtmOzNMMPMgH8UE8WieGgntfvFoNe e3B3OCxXWXmH3XEwrrSbfJFqvqjK6y06GPfyZEt5Tk6jvmxLPrDzuJ725YeCkgaPMuWNcRntUUdL evJKy8EpML4Pk1yWoh7jF8krDRGzdXa8nFW4S66z+AKphXXlxnNvqKyllan5GULTA+UBu4YrN5ZM oY/Wlxs+a2z02kzqSERX1DmbPppa2N5c7NBeTvWIxuZp60g9RJfOE4sMaOrtnJUZP1eI8eeSYtEk UyqUB+MKq8lsOhg3Y6BaaT7CkByhDMG+tOP0sNS/4Wz/DrL+ffY/9oI9F7zJsf1ZGykRLYKMl+0W BaNOrzsY1/OCzLZFHTr5XFUanempj2EQ01xAmvkucAW9r2XPbZ7B7nxjoIlKj41v+8a60sGijrFB IZEeqjTyLK2Z7HeQ+WI9KePLRJuf50lzhOwuCLsKonw4EsZk7XHwEZ1R5Juam9AblYVv5js0RpvL 41MEt9SFTtrRr4xt4sgaKYzO9mjuCabhJNVWW4c/Zokw7uUUVLI/mC3CynhJ6305Kr9R4G+Z3j/i LddrK0voE+7m1pZUkl7d2BYrSk31Fdmdfyr1l/tqvowhPna0DV8Vbgjku0p8QiSi8DZ1pm4798lA e6EsEuFtNlO0mM5vLjH/GwbJyoRgAJ4KSJcYICqDitPyKpWdaDDfaWD77BY1TpvddjBu59Wq/Uql m2wxpEX/MopltJyk43xQ8cLlKl5iefpNKg82lnoKXJZllrObswx0oNzn0C5QW32x+fNTKy9TXxGt 2d0GawI8hD1HOeOhWrJcnFLtFFWmLqcz6tPoAnyxr/hgPMdHItHIwXiN3cVHeaej2gFhra4ulJ+y 2Wt4k6k+1xXlC8eDjKRQ2PYoszqCUSguibxg+kss0CDUFYUeukx0TXVe7C9C+C4vlgwzSj3yHCYI EqkWN5QbVHJjat3a1F2YV6Syr2SHu4wuprfQWbJiiVXPPpyRHF1x50y65V5a03DWw3/SlDr+zdTd XyJUZ6M82/kDPs5/BkGag9VGu1ic1umC3W/IqaquOhjP01Xz1nFesPNKZa0rr5p3j5dfHDjsbTbW KMb8XFVa1KnNZo/6OehgaThMBxu9FJLHhmv9F+blHyyO5ObIlEqrr5KOVfjs2s3nXq8uNxsVUKRQ XhcG28Dlx4brm+hVd7/WITIjJqK1uMVpnz/MH5zXH+hLXfP8S18ySGaLsTnrp5izDLA0y0U7sfAW zM5mVR6ft1sl5Gx2OIqMm2WhP4GKf7rEZoyEZUV+DKTahFUS+m7h5NRggpSa0naXjuN2bXz2jr7t 5w4d/e8bdp5P5Tz+7Wvu6x3au3z45jkBw4xDVPju21Q89LXUL379YeqpfdzPUydSx3dQ7eNv0cJb Bh7AkRtOsrXqJZkJkg7Rl+fm3bvFvDxMSGmdKmlUZiuaeftNxcUVhZJyrTJKFr9kLUoaVlrssJlS mjAuNwFg6rMVnrcoUJM265nlq6DfzHFVRlLTsrx0+sP3u7Y+Mbqqad2ar0yvnLm6bbTq3JTOUrvm 8vng8e+NHbyyUpg95fY1c9d25sNgpGT1+dP8HuA3TG4T9SFmx4cqQignGsHGDIEYSmxmmOAOt2Pc Ieh4hyNPU1ws5FUIvLBbrDCbGSXMgmP/DDu120vcp/T6cMkphaKK7A+nFQRIg3VOaKFkImOBk13U GLN2gakBagMNEEfC5gIOI5WMgErQj61ybVkbga3ubPb0ohcoMb5hiV89Z/3m6g2b1m9vX/HzW3t3 XzNq71zU03pFLHr1leN3zGhb/+iSr52gdYPLI9ev71k+HGtcdUvf6gPDhrzUXwaXBsJL2qcuHagW V96xaMXu+aU11CTJVBvs/xtBVzeZK1boTUZMjEZeX0hz+MJCo8pJnLwTPMhz+3mdutDRVrjf7fao t4ATPWwYTKGcDFJD319OssFiAXvBAIpmZlSzB0YPDyM4K1FCjTG9qm8TGpfaguG6ui0SheuwFDdr bgo1VQfNo7B6989NVNvOkgxtFQZ7cXNMIKaGFTgeQskwZOUt9DtCqsU8pcSNSrO5rIK3WaG4g1Y+ ss/vj+Zu0aX7CPlH35jdkmY+asH6hPEa8J5ZaGIak7QcFiysLDMFw1BZZjH7vWP3JDZ9Z02V2lwc ofthk5R2L+/tvHJqLpuX72wMGuivrpnR01g9raz2hkM3c3dPr3PbIfnMCjkXW7J1mieSuPsGbk16 wtYXxyXbxHb+jGIEY/CRm+C7Of+KCITTXmuYhSYpxOryFbFBRftQSPtQRvt8JivPmTRYqClVMGbM eYKOOIoUKt5XbLUWEI6aTEoLlnbKgoASSxIj8x9glcl8CSy8OLVjEoiEg9KPQslX8mwqTzsVzPAn mC/M7ryCevnvpI4/kvqtqaDA66Hfbo6YDC/Qtm9Q2cfB6BQ6WVDsCeSm7rlTmPv5o0JzfG7ECZtc Gw56R5rOfiis/Hw39/mOKU21sODUzuBw7+cvgPVAw0VwNHyG8dvIMrGGKAwKzMMKhUWtpErK092i Um8CH5pMKpvWYtHy2t0W3rTfbLZpNGrFfrncQdQh5iaR1tKImEpkDhRj2gK/4FDIWOTQOJikOSzK PDXUU6TjFViYWelUuqK9tazIsfRsgvtOak+gotjrNS/lb1vgrBlZltodEZ7PcVXPj9N5YfSZI/3Q IUnMR36c7vvgSULPf/CE3kB7QagPRDVLcZU0XyiBN1+Mq/RdJRpNgA98VVytGdckNcc1AtEYNP2a uzT7NDItr9E4w7RSqOQrHxIFm6/4UNxndZvD5n3mpFkII+DM2HAVA4HyLsFsQc6ZY823VmC1xlsN TgNvuM9pMFssyoIJqvHzVeyhKpgAVVXVZRNK5JjxroTxDiQF07P/CQlJJAqjBZ6GNcGFa+CDyagp zI4ZVK3JrGWCkm0TDPqkVYzfX1Nd7GPaijlfvDXNUF5wykCwmeHPS6wj+ShquEf18+6f27uuGcei PCVzu6Yvdtw6Mj7eNroxxqktgfLUn7U/f7GyMxxf1XynMNQ95arOux/OaR3bWD9r1i1VIVfLLbem 9nc3VRfatBH6PDe2oqHN2ba8SsJ/GPg/I7sXZzQryYjoK6elMsw694oyA2wUmyHHm+PlvXvEHFuu 81A8l+RR1a1+hsMcRhu/P2yorMybMEurWIYVMM1FBIB3HC0taZ0NZMAesmfGCMvcW+QPKALQFZAT 8BAGnVbdTJdZ6UKhc+HolKvunz36k63dt3Z1dvA59kD0L1N0npbp4Y03rrm2oX+Gjy+k09q817z1 0KMn17qKmgxCy0hvTYFJVa3+/NW++bEq8zPPPPczb3dXJWRjBcY5C3zmIZvEuBsHybgkpbRw3DzV TUwGk9vEqwpNFALihJPDX9pl0juwuLtXdNgK4XLaIxYaDAa1yW02ezlIt/pWlzQvncCYc50IHTj9 CnWdIT2mvDcZra+FF9LZdwruuRML12D41rTzCVORNFHVwasFNGQmKr57i7GqLdJ5dYujcWRqx3Vi Q3T60Lzoj55f/eLWWTv4A6+29hQMH5uYc0eivjbeVt9Uav781D3v3wjVxOQI4xOCoGMRrNsrxUrj YYNBfyhusEYtIUeID7GBFJUWFoK2bCwK+aG4giipesJkKeK9jKCM0b3e+nI2sgx//wstM2wMrY+R Gvrex5Au0g/Gh8JbF2CTQHZIdkZeMDemXsltxQsZMsotwdqPY1p9y8IVsf1H1z17Q9vVDTpPfXto /LaVq8sb6xtdukuIef309hKnplq9X2hvLznz0f73V1sdqSPTF4nllhPHjz+v9zSGsSbjyBhofA9o 7ASVrxfb3GZbgcfIG78qejwaG5nqftv5iZMjToPT7TzthGPCaRNsvO1eqAoN3HR7RA1q7CbiMRlu zc31mrYqJEx8amp409gAKqdn5EtIDAqvYfTFTIA1Z8bbDLV4CQrglfEwwwO8XcdWcRB0fly8arzv 5deueu7mZbvmhPhzkzWblsy6tfUqedlA/IobNIfbe4P/+HTPezeKq7653bTh6/ObOuicq2+fduB+ puNngNh/lD2IXYJrRLdaoVQciiutBhNIbaN/DuqJ2+B2u4+7X3HLcnjsrhwXHUW+LjfcysV88Vfz YZtxngPuIDfhgKvm+OMG2qfHCubTqjcYzSUbmDEr492WvlPRKsbQGev+osEBxySUlYANhWgVdg6Y +oKtb41yo5/kOEsrUleU+63qTX6n3ZgjqJrWTwzPqBs1Rys9FX5Xzif8vHOPtse9VsxdkmeSWxiF 4ZAbrbxm+0hA890pEZNfXNy7AjyNrY1UK/970LOKtJLZ5L/FeW2eWYGAWhlS1vLKPcdrqb62sDZU y6tqa0P6WXSWSAzUCr2kNxQaQoZPDOcNMi9vMIS6KG7Bkz+LVXpnF9+1R3TmhVr4lj0hQ0CtLeot ZmgqBSqKiws8bW29HW6DmfZ2FBQMcKqSiFA2ZavMAOGQyaxRQub0sllBo0eLXqt1TnRrmcQkJ4LA H7PgMDlgi6EhdCLILAUkUHGiCuvcS5RDViNKfMOYCGriBCzYEJLZTQvUNUC8AgrJTQ+DVbJfo9IM IWlPycCtY3NIrRQyzWr3UEnS2JYGm1TM0hxywfj3FvG/f1JVWPzCk7Njvfnt8dNX3tZw9Uvblx26 rnWgL1QrzuzqaVg22d81lS491718JNpVYa2aW7844YxG7/zK8M1xXaCrcc9Mfp5CU3hV86NHrI31 Pr+hbVX3oq/McjQs7Gy5ImDurmpY3FR214K5W2aXGlOvbN4eiA9FBjfU3XT2lH9O7fCc8HAsr6bM yXQWxe4aEYqgsxrJVWKMZzjmShBQFhAWGMxBvqS05FDcVGp1U8nNyGam+rpD8XrSQLUTDkeMeCfC GVYOZ/xql01CbI2aMVbT5ll6EipgK3MsCJjPlHnaJS5OG6wXytJTE71GmD5/KFo3t7XUog9MSW0I FNlzXDOmlogDQYWlNJhax/hdUmyfxjAlzWhx59b0XTUrtW1eixeeM63J3R6n8ok7OvO6eoOpm+ON AScWV2m/fEd2xmI6fDaQ8idZHKzqJPPEMrvgFA7FndasLtdzo6t5quff5jk9vxgRz9NbOfMEp86Y JoglkVaHgsFnThpOktDCNQtPZXR1Vo6x1QcHVcZIZxOvhAS65djygMeeIzgiFX9qMlREUxtl8aef /uwUet/WSZ8Qp4fsyhrVuZq57d4cpmtlqQ66XuqrHZ7QiEaphO//PlGZZ7UcitsOW9FZ8Yu9VbpV Kr2DbuXsE5don5NvnGSCIylY1uHcUy3vZydSLH+kabPGnPblXew3Xf+9o413jhc1t5bZ5Jayug+b pP7+Yuc31vsGHcGGkR7uj9PjAYemRiXxWgt4LQZeE9nehun8B8yUgzEoxRa2WG1CQVllk9vuklmL +VKRYy+saLHO1TvzInxlqPJQ3BWy6nWH4np9c9OheDMRqc5odRbLSNlEbQbztYwDmb9PMoLYKNLL pIwdmHvCHk2vHCRWhOevDrsa7J95+aTlgkLB/CjSLqS0jg1g0vBKS9csp2a48mq3x+qM1VWGVEpf GX2scqzuD9RdNTOcGs91aooqrivKd7vqGSHXVgWMigx7chUKVTAajDmxtCmSY6dSrH4rtb2tBdqY N1r0+VXN+yrytKclIkdy8gLttfwlHMpkFnikvwEebSQsWgUs+g7FoZnMh+IWYsXRCTKRk0FFTtoY TCNCoqPvUnnLjuKLPfzs3zwb8iFfzL+Es7e/F+dqlCCYmnnoVG4EAsvyLOBYlrKAsEAZlTtc0Rmz ZLU1tYfi/bk11sWHFy1aeCi+SE9VJcFOWbu8nW+/N0duUFVMxBhHYCZgscgUUiw2aJ7Qe2j727C8 mZihEvEHmAGQ8CwdIV0TOJt1/HEj7UMssRM7j8baDUIMwQ7MVRgMQsdLZhUKsHZmC3u2eE6bUWlf GljDBJWfXkEGg1BTmF9tksUMr8WF5b4kAoJkJf8PZeltg0tEZZUu1tfV4knc5OhZuKS+fUl7odrs r0hdxxSZyuwqqvSXdMwsvlimtnqKKvNLu3r88hyLz5fa6Pc4tEwzfNjEFwmxJp9hweLerkBg5vVX pLb1Nrrt2DvIaLk5q9r8eQZ3b1916iuX1wytjpfZNL7O3vLU7Q2xIquZWQCXKRdJTkFjIQQax8h1 YlMlI0EFmwnKWRBkgTMvhrPRHBYj1Fp6uKQkcCheoi836cPMXA8baieUyubyMstEEZb6TMgRH3/C YKS9RaBCmhqYHxgB2MSQJYBEjzTyPZkZoTKL5EtmCebZrIsq0kRhMwjsOyGUnhKUZpcvHAh0Dvgl 9ZnVph82aXTd8xdW185pLbMqLf5QFlWd104rzTcW9naHUzvSTH85Oh4VekSvs7rv6tmpbR3NIBXw I9n5/JuwiXKwYusWCwns2z0isSly+dw9CoPNoKF9tlvVbi1kQ12gAyd+FyW6W3nGuyjkIZXMVEF4 iUkieTwzyxB2OOByK4KzvPLrtc+Pv/mblS+mtt96ffuiKbmtq7s23Wz42+kD760686eD762hn738 29aVu2d85en5r6Gb6Oe01CxBAzqWYKfsFrFMhd1rLDlcxF/px/J8j+i31eZGC6N89F4sR+yHYeVg 2tAX3RrJzGWIsciEFEUijcSRy9dLU4aoQomecQXM1mDaDY+YnYFg65GMxwx0zfoJs+ar74IDWpIL ac0JMjIJYwPGkoVPr8lqDOkF6GqVPRhOjRVXOJSC1h6o+KgpR9/c1Te15MCRxI+3dm+scjTNjm+6 /v36mf2egtdbRZ+DeWOspZ2N/HBXU0muSVWjelRoafAb/vHnAyfXOOnikbFW9wvP0O3e6dPK0jga A47coGUBvG7zRX+BxNbUVaks02Kz6V5Ra7MVm80w3PeYDQ693WBzTiglvLC1WiQSDdyqT6/Voidx 5qEl46656H3IDp6mOfqSZYnNXmeXmBfrN7YoyS7QBHdqLBy0q2oXXiseOLL25W1Tr411xlX2iuLU u47G6TU3375qVdmUhim5utQsnHvxtbTRoaZplX//6OD7a/LdTYbPd03pwJkE/tWFy6cWvvIjrM2K GkNYm1Fm2/AVGGsAvqkCm9MBb4LDyjw0/sM+vR4vxSkNSs7CK2XjWjYbmwy2Ljh0tDKDSqksDVDT REFGngvYFMv84HC9nAiSIFuvwIbGtNrSJ9kNmfWKJKPZ5QnTn/8ixnSVrm7RNR2NoTWO2lDx1Dan LRpNXXOJrrPx7X1l8j/URsr6O8OpR+Z3uJkb7hKdVa0GIeF3w7pTjbFFyF7RFsptyZ2Ry/84l5Jc Q64bcpnrz6eMm7tMtq4QnA5U5tdu0N6m5XzaGi2H11gNOOjTrx3RylQybX6lFZvpe0SrrRJ7M3sq DbkHnM6yKoq3NJWGiaKiqHIiveJgbnHJcJK0WWZVytx1QMbihcAHsznYyQE4xxdeCysq7XuQTIms Fxw2R5StTeGgZf7Ziz5z7vyILdZb17/Y379s+aqW2qXb+gce6lnqunJhcUetu2TgyvkrW4a+sabt hoXcyVhHXk9rZaw6WN69ND7j6niB0/Lqgtl6b6wiKtZU+LuWts/aJOaYgScf3qx9WngcmmueGLEb eIvbLPpDXWZRq+8yG+612zi1Xk61vFwhqgnMLfWfFXqzRaUqUMg0Ezjj08DI/iZzuWFhmqV7Q0vf uTeDQZiPbAOAnQuxeqzShjlbc9sl2caC1VfV7LVodtH21I8M5fXlJZ1FFVO3xG++6R5+UlnSsnj+ P5al2pesbc3zFNZ2NN//KBdEf6fBp+LDG8Tl2C8syj+cl+c6FM+zYtXtVfCKe0WvzVxOy2H5UL1t wl0Avk27C7XaSm4CHkv4VGAVlDAjpIRpK6Z2o2zPX9o5u0xMM94U+PYlLSQ5zJmFlNn4Z34VaSD+ tCN9Gs03Fbc1+jvn+uQ6szdA82EC177fJNfPvrd3/obGHF8z/8MUv/765rKCnu4Iva4hveF/bk5f PONJGR7ouvMWev1Aiw+nejFW8/m/C2qMtZCMiaIqbIZZFVbpaK/CwBx9SimEoYW0ymEzmAt4Suih uCwH+9wyojfrQKW2ggK306FSedxguibpyB2OAWAz4x1wZ3YDvIU5ySnO+8DCYTsEOHJnNqd3uTM7 33CdY5al36r0m3N0/+sli6EiRjcEysryU49tSH2a5wmAJBGNxe1yTQmk5PT9cLOrrBx7A0rPVPGc i/uoryFPyd5ixpmB85/LyzEmH3laNOgM0tSBAJ482IbMiMtHwuJGYGSBTppXWADfmdTiNHYQgAOL gYVGKZSua9JjR8HiZqExHVp8PLUSk16NfQTJKSPkOPKKZEq9r9hiyTdz1Gg0Y4NImZ+PXQQwgrR3 8KW7CNFL9xFgDAJRDF9BeB3hQLpsT+FSxEmbCgWpz3actheCIXY0lmq1X6P0jreSOlNFLV0I5vU4 U29v4z46Z+D+0DUln5lfgQDDIcfLz35G/+TvKCjDgcWIQp/fJJ5zA3926OyfAX91JPEkKTv/T2ZO BfEighhGwlVGdII3bLL6+CJvEaTAq1BX8aFwCA6psJ7oXGUC9lfCKp/J1OBLDxlHU+EcubB1dGG3 3M7MXhqkWAldsg4yZ9ZBrCiAs2+MVdgaiKszZxHBijjlLdbcomI61T+j4RfvRaYHUitn68y79xrN vpLUUU9NXcUrvyyvLrfR7TOsNq71gCvqshcoIhGNODWVOtHWqce0XW31O1983uazu7w4B6Etbqij HC2O1eZhiaStslfiIwiMnyypbklGKiEjzRqH0db1vuZvGk4hIsW2W9wKbCQoNCIMH823RCHPTQw2 a6CMnQqCkWrXKw8oFDZsRrtLbWkGgDo7dQEdWAVIZgvTbC9BiQcXQqHJ2KR9QUvXSaLBDoj8q9xw yrqxzXPrOoa0xUUFoWhHMPWBy+MP0HtDflOO7ujzRnOoMS1Hs27cOz3nuVK3vX7dEPfptMYCzGoa qyfX1RhIaeg7Je35waw8pcc9E3wwG3xgIV8TLTgPqObwqoiFU/FuVU4Xr+Ow5HtHLEU6R6aRavQW HVEb1JyTV8s4nNzcI3IaNptp9KoDaoHN74XgICGHiVmOOkfNWw4QSeRwoJfFOh68IVmp8IKFoDWD cGZIHjRpEwrakh3qNOBkHDQNm+KCixZKB+OknSic+pF2oqTdKX722RRXnPq0qrHaMY/7+7nfUkV1 tb/YSYtSv4vwjcUDU6mh6uzPDN5ebCGCxo7Ux7Qd3zzIIV7RJD96PEdk45IrcrgjGo1ex6bTk8/h pFEomPsxXL3ps7TskFF1gNbowisW1EYrLYoPOuOd69Z2NIX7cCi4O20Pf0zX8dtwXyNpFv0GvPNl XG0cNyaNp40y44UHGR7Tt3GZp+GV0MzTDKfhy8EDQ3COfOGhZnZ0e/mFB//g+csfzT384YcYF4e3 2Qm9Fs/n8XWNarGQSxLewLv5fv4uXqbneUVSlFNO9phcqZI/VgJpNPSdjFaxQ5mn2DFEPBWbFzXS w659/vnn+W0ffnhuyQcfpPnjGty7DjjjiV1U88lxjj7GcTJB6j3BHdBl1su6Fz9gV1ByNf0JF+MW oL1HNHGU554QCcWZSSrIKClphC2fPb+Nx3pqPFwsFaav0J88gHEsAC/acObAh2+LTBdL3UqljfiT YgnbxOE8vMk2bgPD3W0T/I+V+sYJMeXepFaDRUJsq4ZNwSffTLNSxn5gp05fZq5aPCp9TD7rPM0c k2f+V+xtQuTSx+RjamdNpDGaW9ZbNWOxafu1D/dt/NpUfUFlw9SasMX7PN1XVFrVML2pe8FoU99V tYsW7W+s7LpxZmlHW0fn7OaeqQ3OY0ACJVP5b9IF8KPoiE80KDB+nU6jcCt5cJlBL2HuzYsbSyfQ OckPjPNsaR1J27U5JfOGmiKVcq3sXs90d9vyFdNjUzbNK4h3SHzcnJrFfwf350m+qOUp5yLUzWep Es1tOgHitrTgvtiq5r9zrvJr3Buye//5A0UH+jZMX+IPcv241inmMPo8JV5CmsyGP+jCHzz7BN9L X9qKa55I9XHvyh7AWqZCtKuhAL8qqinBtspXiUtTYN0qk7kL2bDOsVN6F3zheD47amM0mHBWw1oE d5L0h8PZdhwYs9ui3LuH/3Njbc3GXx3urG0Khgu8RlOBN6/MF52yKNW3/FU6nRbQPDrzjStnaXUl 5TMW3Pf18ydTzyYGQqVWh4SHIPo1/IV+udL9ogUa2VarNd2vU1/olxlbsXglm4PZVQMvXfoP538C fvbnDf6P3ZI9sPzV1NHU71PvpR67rFt0yoVugY9vP5+Q3wM+7sKu/dPisgWUCjPacDjkvjaxTRCG eG4I295D2MYWPGHjDN0MfsYe0aTTNZSW4zWB+8rFcClfLhotXeXhB8TSBg/veaBBKK+oaK42mnvN mLq3Llgwt7c3fy7cIdXNXfn5I76J6jT/Z+TA1GA42QCLWjoxH8ocvmXqFWewMy8UsNUEzrRldv3Q UjpZyaYmOE8gP5m9Ckl2svZpddprVWeX9q/TWw/ssLqQPXGfNsmLIWWmWpy4Fxhfc1iAs8VH2hDE AlzA/MaWJXVCVc7AvdNbF4UCfVfdOXvKkuB0cZVaNTJ1ZWzT6W+9nvrptydSR+beOdMhPj7yWeoH ezd+QJt/9B8059HuxPc2lfU2FPmVstpmb0vblLCrsqZs9sIpRnqQ3rSu/cbZMw9+dU2Hy1WrT2nK G11r1/78uh9QuvVHqUfeeTr12a2O3GFn3n5a/bvv0OqPtiSOvr31YOrsHdbK7hoHbSuuzhXr7TVz brizbc5A08bNc0DPm7EGPAV6Mr8MO2sGv8xenDVT4nD8XqWg2WmxFOh28mkKXCYAsiIO7x6wo0qM 3aSDZiajdL4f58zKf/V66/r9S3795vup2KYtm9bHrurtWNjgMNABOnyMah8bSP2v1OHUQ6k93Eup 76d+QQtpxR9o/o2z9v6W6dmj0JUvo0+5mHEKTDYoMKVcpVTdjxPK+EaSzmZTyfFFpUmdLs8laZzn cLwlynaxSMvFw2VRtg2VPYvMnCcgJtQQjcqt3PdyPM2L+s7lr1pcZc9zuTfMK6dv1MmprHGKz6rh pk2TGYuaO/lgia+tsY/aRw6jTzejTy+gTyVkVIy683EYxeGwKfNtfK7tATFfUMlEg7lLVqIs4Use VjqdJpVMIXfvNJnKnCUqlWOXM3QyGmKO0tCnb1adYDEJMW2CdwUk6wlnESWmhUZnzlSs+nBABS8K MB97XXqZizNw6Reg0opdruCeisSKrYY5xrMvBO++bV20vs4RHu35QeumTa8PfP8pa0XvgjVPDe3T 5lWEUr8Jr/jNnvG2rhULQz1r21453hB99IGaoXmJKza+IH08gpK7wAcvYnxhMi7Gc7Q+v9/H+/aK fsHm31sS1udSI58LghRU2Ap4ZwH8BWahgqcVDwiCVun3l4Xxba1c5c6yslzTTo+nyrUr/WqLNHFd ENz0AlhaQKbHC8FkMyabOLOOLwzeLL3mlZk3rAV8xtGVsSaZqe1lh05YDIo+vO7FRWsOD8dvWNq0 ZrBm2St75v5s9kbv2tFbJpKHh7c9ObxhzaINeULjU3W1nbfOn3PzSKVKUzOwvmfdE2MB9xtji3bt uHvvoHJwcu6qjctXYOZYBTycBx7y8cZAC1ki1hJqMApTvN4p/JS9oteu9AIdSvj/9opKsz3IB/fa BdcdgUCdtuAOs1kr7Kyra63cifPkbNRf5uq4ZLBs/UDt6YHCkyedPqgLZA8hMBMNDMxOBrIxs8Fm fH2ZrI7jHdyadat/uWvihVWxJd3cf655dctdz4xefS6Z1zzaNXtNXeu13TdNaApal0+btb6pbeOM 7mUtLu7VnPJvXrf+6JKhb62bNz67KGfh7694ZMHM+69a+TCVTxnrrWjdPGt4c+z2s39pXTMr3L51 eGTHtMrp2NjmSAK4+Qi4ceLMzRwxWCiTy1UmFTxFD4oqVQAvFPFUdJpNOOi01yTIvJTmWO/wesPl d+Rc0OAXX3LCRrPE8VnCwxEGvq9hr8tc1MkYvMlo4QSFmQlEVg6kZQRt2Hlis1U98OjiNQ/3xzYc 2fDabx5J/eanh/wdbS1OlU5Zt2Z2z1hrwfWByI3//awQqx99fOPw1zdNTf0udfpM6is/N3F7cpwB mzK3rOL2n45Wz7+ha89+pnvYOEmN+jXzYn3sb8SlRAEhz86/wnohlqVacVrvQeRVrK30w3WKvakG QuzDf60+t9/2qXSnTKUUtWPP8SnKvmZ0lsiF98gmYZxcJ+shG4W9SPcA3kX+JrKJuw+wjuTLVOly +W1kvexaQCO5TthBNvH/JKuFp0ibLESGFYuJTegji/gPSL+whIRhJ68QVpMV/B/JGHc1mcH/lbQI VxKRayCzOQ+RCbBhuHLSIv8GmS1cB2hB+7VkmjBCxvgZZDa/mizivkt8wlUoUxKzvIrk878jdqQt /KNkJt1PHFwemQY4jPQ13DfI1fwSsoA+C7vwY9KMXcdhXkeeAAQVVnK7sJLcDDiaie9CvAqQAEY2 4O803UDf49q4l2DOvyEMCHcJL8oWyY7KG+WH5f9UDCveU4rKR1RFqhvVMbya69Y8orVoJ3Ou13G6 QV1SP6C/27DVaDGOGT8zrTb9znyt+UWLaDls7ba+Zptue8Z22h62L7JvsN9j/6ejxNHpGHF82/FP 5zu5Zbnrct9zjbn+njcmUamdHMd7rAl8+Y/DiesQvt1GVC34diAv1VJspzKuwBYebF7S3T80taMr 2L7kmqXXrljyJHHT1BMqB+12H6OfZRNnsol/ZhP/yCb+nk2cziY+ySb+nE2cyiY+ziY+yib+kE28 n028l028m038Pps4mU28k028nk28lk28mk38Ipt4OZs4kU28lE3syybuzCZ2ZROT2cT2bGJbNnFb NjE/mxjOJoayicFsYiCb6M8merOJnmyiO5uozSbC2UQom6jIJsqzCVU2ocgmZOJ5iXJ/lcK/SOGn UnhaCj+RwlNS+LEUfiiF70vhe1L4rhSelMLfSeFbUvgrKXxdCk9I4UtS+KIUviCFz0vhc1L4jBQ+ LYXHpfDHUvgjKXxcCo9I4WNSeEAK90vhPincJYV3SOFOKdwhhZNSeLsUTkjhVim8FaHY3O0el3Jb pPAmKdwshUulcKYU9kthlxS2SaGOhYtbu/ApOErGoWbuAuwDJAHHAa8A3gGcBihJSICdDpgBWAxY BdgCuBPwMOAxwI8BalIoVKN1NVpXo3U1WlejdTVas89r/kLwkrcBnwB4okdYCGgBLAY8LHhFr+z0 72ny3PFz3PFzr5x759zpc0I64o+ff+X8O/icprC6VS340O3jCF8BvAOAv1zUCu88dfopTgr0rUbB gxt7mE7gBtFaj/AdAIfHqlleUD5B9X6qb3UJCikvR7iFs0ttHySF3IMkBGgBzAAsBsjJ2wg/AZzn HhRn82+/Y7PnvfFLBDfcaHPdcKPz1deQ3nAdgmtWI7h6FYKrVtpcV63ccm3uuvUWa94VVyJYvgLB sjGLa9nYBA7yrbVd3+70bAI4WyPc3eR+AEfyEJazFHc/t5d7gGi5O7hd3J2IJ7kd3E58hNTF3U92 ADAkhA8DfgD4NUDgDqDNIZLDPYxrv474QVz7EMk5/wG366jF2/AkEntZojWXu4XbDBIH8TXLG6FD g9xN3PXQp0Fucya+npsnlV/HXSHFV3DzjsqC7mPc6qMud8OPuGtRz9qvRLnAyuc9Hok2qFpbuTXE CTiMehSizQrk3kLqAwDPbeU2AaNBbhwxu34LYtaPGzLxJm6uVL+RWw7tHeQ2IGb16zPx2ky8PNNu HWLWbm0mXsXNPaoIlrb2I0/JbSzkFnKLuMVA4UxuFjcb8XRuBvwNWqLhpgNmEjW3kExBegjpDYD1 yD+A/HcR/xdiNbcCV1wFhI7iTlh14U3xWdxSxCtIjBsFjAAWAmYCpgPiXEzCWjtnBKGCnJjJNyPP Rt3EGYG1zlYryinpRPgcgOOmoF6B+gbEDEt1mfYetFcwLEePmm0NrTYulKmozMQViBkZyzP5YCYu w4Wy4NTWNuQpkSE8AOAw3CjpASSQWwcQMKEbpEe3ImZ3akHMut6YKa/PxLWZuCYTuzNxNWJ2XSQT hzPlpZm4hDNgCJOtK5HHZiXCJ7kqDNnOOTgniKLhtFwOYiWn4tQScZQgjgbIt6O3ShBHA+JoQBw7 iKMEcewgjhL1XlzhAzHycadCxLm4Ux5iLwiRD8gF2AEagJLE6GzstmBk8Oak47l0ASMKnZOJ5yFm 9W/RN6DbgvRXmfh9+g4bIT2Zid+hH0n5TxCz9h/Tj4Br8RgilRrCdpwKRyORTAJCgz26J35W6G5A C/5oeXnD92F5AxVHC4u8T7Lk48fxfka2MD8/W5iXd6HQ5coWWnIzqXGNOZMSVWqkcF78cbF/B1IU d2SpVjUK8W1mUsiKWIyekaP9c6Sekce9XtYj8r38ggbxA5dL6uYfi30Nc49RpWimv/2VLDjlzZ43 OTGpyWn4yXEZ9mSOi3UPm80N4oOhcMODe2nwgb2y4N7dQvCb9wvB++/mg+Kz5ZGGu3fzwe2779vN qUYdoz8b5d2jOXrc/PQTUwt9DT8/RtViHr1vDw3WPUS/uocLOu71lzXY76WGPS1iw3/toT/Ep1rL MV8EafjoCSF4jIaOvsSiiqMneETlrPCHtJd2S226j26RBZ/Em9UDkCt9q5MOYLgDeJ/mNrpdIs42 xIzIt2fi7fRO6cJdiFn5nY9PyIItrVq6D87hl+lLUuVriCGG9FX60lE5o6ziaFVVA4seQx9wDut3 BRJZReNvHLkNL7zIB198XgiKz3uKGBYff95ql+LngE2Wf86Wy2LR++OKSEP/TOBpJvD9Pob13rvI vFtW1nDiJXDQS21xqf1LgQCLv/eSPbfh6Q8pRq06+pb0YDH6oc/X8PaHVHzGld/w+BFZ8AgIIx5v amo4/pgQfP0xWfCxzVDXb5lsDc/+iLp3UcMudirg8R219dKtdwSCUleqduDeO++QBe+YFIK3T8qC k8DjXz/hg3/5RBb8dJwLnt4nBD8BasSPq6obxI/xNHabfTNnpeOOqem4PibdTrMPhH97H92HK1m7 e8D/iMU3xoGfm7fQ4E3o1WY84hTgV1volglf4fYJGtwG2Iqn3AoonWiYmDbBL5+gnRO0doL6J6ir zuqotVprrKZqqz5q1VbhqwFWedjKh6yk0nrmM737TPgM5w/oSgL6sqCuPKgv8uqKvfqCQp27UE9k BhkXa9JpYuti98d4vcGoVak1WrlCqcXL3FpMEFo5nyhcXUb1ZVSj79FDU0whcX4d/y3ya71cQ+Bf 1k8hU1RD/HzVBv4B8oDqfv1/Ee2TVEO1YpneRfNzHIrcHKvBnmMSLDmhM6vOPHxm35lfnHnljLzl jHjmsTPJM++ckZFjVHM0dCb0faohLVQjVgqfx87E/hH7W6w8VhYrifljxbGimDtWEHPFHDFrzBTT x1QxeYyPkVh/dIAmTT2kZwBf/qCIZ7clo8GeY7x7VrIq2JNU9c8fPELpriGUJrntkOeBpLD9GIfI 1D48f/AYdbLqCXxmCEog2TMyccdQMJifTLCPxY3nDyWrWOKu/CF8/65qZtLlbcueDLwsXrtuvZRH vHZdumZtcG06caTE35Es61iSLO8YiQezpVIdXYtfun3mqmA2Tl8rhbhnNnchkS24GGeqWMQ2quE+ Xsduto49cN2ld137Zc9g7aWrssHFnHTH7Kgy1SQ74HQ+U/u/vSZ782wsXUdZmHQkW0C7bEU2PqJi ROyf1Zbk2hf0JBP4hGFB//yRZK63Dd/jRK62fz4+bdeG/jBU4od43dr1CBiwgiME32E7gq+iDRyR I5g/f7B1lKZIgn4GOAP4J+AfgL8DTgM+AfwZcArwMeAjwB8A7wPeA7wL+D3gJOAdwOuA1wCvAn4B eBlwAvASYB/gTsAuwCRgO2Ab4DbAfMAwYAgwCBgA9AN6AT2AbkAtIAwIASoA5QAVQAGQiSsSf038 JfFp4nTik8SpxMeJDxPvJ95LvJs4mfhd4q3ErxKvJ04kXkq8mHgh8XziucQziacTxxM/Tvwo8Xji SOKxxIHE/sS+xK7EHYmdiR2JycTtiYnE1sStifHElsRNic2JpYmZif5EV6ItoUtk6fH/bwzJ+z/x +38AxOIJJAplbmRzdHJlYW0KZW5kb2JqCjQwIDAgb2JqCjE2NzczCmVuZG9iago0MSAwIG9iago8 PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0FzY2VudCA5NTAgL0NhcEhlaWdodCA2NzEgL0Rlc2Nl bnQgLTIyMiAvRmxhZ3MgNAovRm9udEJCb3ggWy0xNDc1IC0yNDYzIDI4NjcgMzExN10gL0ZvbnRO YW1lIC9KUFlHRUgrQ2FtYnJpYSAvSXRhbGljQW5nbGUgMAovU3RlbVYgMCAvTWF4V2lkdGggMjkx OSAvWEhlaWdodCA0NzEgL0ZvbnRGaWxlMiAzOSAwIFIgPj4KZW5kb2JqCjQyIDAgb2JqClsgMjIw IDI2NCAzMDcgNDg4IDU1OCA1NTIgNDE0IDUwNCA1NTQgNTAwIDU1NCAyMDUgNTU0IDU1NCA2NjIg NTA0IDI3OCA0MzAKNTYzIDI3MSAzMDMgNTMxIDY0OCA0OTYgNjIzIDU5MyA1NTIgNDg4IDYxMSA1 NDcgNTc1IDgzMiAzMzggNjgxIDc3NCA1MjQgMzI0CjM4MiAzODIgNDQxIDU1NSA0OTQgNTU2IDIw NSA1MzcgNDgzIDIyMSA0MjIgOTIxIDU0NyA0NTUgNjUzIDU2OCAyNjYgMzMyIDU1NAoyNjQgNjg3 IDQ5MCA1NTQgODE1IDg4NSA1MzcgNjExIDYyOSA1MzggXQplbmRvYmoKNDMgMCBvYmoKPDwgL0xl bmd0aCA0NCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBXZTNbptAFIX3PMUs 00XkwczgREJIUapIXvRHdfsAGAYLqQaEycJv3+9cp2mVxWf5cOf+nBmYzfP+834cVrf5vkztIa2u H8ZuSZfpdWmTO6bTMGb51nVDu74pe9aemznbkHy4XtZ03o/95Koqc27zg5TLulzd3VM3HdMnPfu2 dGkZxpO7+/V8sCeH13n+nc5pXJ3P6tp1qafcl2b+2pyT21jq/b4jPqzXe7L+rfh5nZNjIjLy20jt 1KXL3LRpacZTyirv6+rlpc7S2H0IRX/LOPZvS7d5XQnvG19n1XaLBO+LRrJAgvfBZECC92WuaEQC MkmWSPB+FyV3SEBuJR+QgHyUfEQCjSzaIIXPC0WP/AWiJlskeM8v0Q4JRG3mhASkVe6RwMyBxSwx 6FtK4lUwsxbT3CCqRnQzyDWJ1+LmV30LvApyrRReC/Nb9oriVXgfZb/Aq0BaKbwyHjJo69hdg6gN idfC/JYPiuJV0MhK4bUwv2GnKF4FUW1dgVdBZS0O+BVEO0m8CgyqUcCvYLGODJcGUVVmwwxyj5J4 FSzWXgW8MgCSc0RijufIUgZ5QQyklcJNMEc7nVHAjSDX+uIm3BxpJ5nFYAyrjJsAvAzqG3EjOF/t c8SNYOvUKOJGkKuNZbMNpN5YdrfiOIhSUN/D3xc/Lz58CBF3gvktEaPU1wyaP2JWMIN1wXc075wa UbwLumj+iG+BWRsY39G88z4QxbdgsQ4o4l0grRG+4+009cqV+BZEddZ8dgZSfTl/g61g5v/c6cPX BfV+obSvy8JdYreYXTO6PoYxvV908zSrgPEHQhNEqwplbmRzdHJlYW0KZW5kb2JqCjQ0IDAgb2Jq CjYxNQplbmRvYmoKMTMgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9C YXNlRm9udCAvSlBZR0VIK0NhbWJyaWEgL0ZvbnREZXNjcmlwdG9yCjQxIDAgUiAvV2lkdGhzIDQy IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hhciA5OCAvVG9Vbmljb2RlIDQzIDAgUiA+PgplbmRv YmoKNDUgMCBvYmoKPDwgL0xlbmd0aCA0NiAwIFIgL0xlbmd0aDEgMTk4MjQgL0ZpbHRlciAvRmxh dGVEZWNvZGUgPj4Kc3RyZWFtCngB1Xx5YFTV2f65986+ZPZkkkkyk0wWwiSELGSBkAzZIAkBQjKQ AIGEhFX2fQfBNe4bilq1bqi4TAaUoFapVdvautSqbd2K3VwqFlu1biTfc+47B9H6tb8/fn/0G/LM 85z3LHPOe96z3CHAJMaYme1hChvbt7J3DRtgn8DyOFDbt2lD4KFrjn7BGC+kNS1es2TlZ5+1WhjT AcaUJSu2Lr5nL/s5Y7ZRjCW7ly7q7T/1TBLyRlWhQtlSGKwX6X6J9Aaks5au3LBl1vvGOUjfgPS8 Fav7ehubp76GNP/MsSt7t6wJPpy9n7G8LKQDq3pXLnrfu3gn0vU8vWbdojUjH/zlBNL9aM4Mm6R2 jTEL07EypDNYItMzO3OyBOaC1YF8G8YmMy3TMAMzoZyZGZmHWZkbZfHS38LY8DVcnXnNYMvZevhk D7uAXcauYU+yN9hCtg/qALuN3c3uZVH2Y4z7N2dq/H8Qw1u1K5lFOYoeuhgb+XLk5PDdwJA24SzL NUi5NIFvLCP2kY++Y/to+JoR+/CQzslMal2r/DJa+4d0euRLuQY1rSNlPC1fCG1TP+lj/S3DDw0f /NYgZrA2NofNZfNYN+thvRh/P1vKlsEz57AVbCVbpaZWIW8J9GKkFqBUH0px/U2p1WwNW83WsQ1s I9uEP2ug18dTPG+tmt7INuPPFraVbWPb2Q62M/6+WbXsQM421boFObvYbszMuWyvqgSTZR87j52P WbuQXcQuxoz976mLz5QaYJewSzHPl7MrEP3fry/7Vs6V7Ep2Fbsa8XAtu47tZzcgLm5iN3/Her1q v5Hdwm5FzPAa18Fyq6r2s+uxxp5lD7MH2UPsEdWXffAaeUT4ZbHq6TXwwQ6Med9ZPSZvbj7jrV3w Bh/3QHzcW+C/vWfV2BT3I/fePpTk3hmIzwNvZWfcIkZ/JUZG+ptxch/xMVzxrXGKGv/JykfM/XQz /CU8w322H7Yb/8V6domz9X72A6zAH+Kde5Wr26FJ3arqs+23nCl7m5p3B7uT3YW5OMi4EkyWu2E7 yO7B2r6PHWL34883+mxFuQ+yB9SZi7JBFmOH2RHM5CPsKBtS7f8u7yHsHd+tczjeVuxMK8fYo+wx RMgT7Dh2mqfwR1h+BNuTcevTailKP8V+wp5WS/HcpxBbP8UO9Rz7Bfsle5E9g9QL6vvPkHqJvcx+ zX4jWaF+xd7H+2mAhSf3L5jfPW/unK7OSEf7zLYZ06e1Tm1pbpoyubGhvq52UrimemLVhPGVFeVl 4wrHFOSPysnOCmb6vW6H3WY1m4wGvU6rUWSJ5TcEG3sC0ZyeqCYnOGVKAU8He2HoPcvQEw3A1Pjt MtEAr9eLrG+VDKPk4u+UDFPJ8JmSkj1QxaoK8gMNwUD0+fpgYEia09YJfVl9sCsQPanqVlVrctSE FYmMDNQINHiX1geiUk+gIdq4aelAQ099Qb40aDbVBesWmQry2aDJDGmGio4KrhmURlVLqpBHNYwf lJnByj82qmQ39PZHZ7R1NtT7MjK6VBurU9uK6uqierWtwLIo+swuCQzmHx+4dMjOFvaELP3B/t55 nVGlF5UGlIaBgQujjlA0L1gfzdv2Jy8cuCiaH6xviIaC6FjLzDMfIEW12fZgYOBThs4HT36IXp9l 6Y1bdNn2TxnP5EM846ao1Cs0Q9/QQ4wvI4P35ZKhMFuIRHRPWyelA2yhL8bChaGuqNzDc46LHE+E 5+wROWeq9wTh2YZgQ0/8Z9NSb3TPwkBBPmZW/cmOarKRH4gqOT0L+5Zy7l00EKzHCOFL1tEZDddD hHvjzmwYHFuI8r09GMQy7oa2zmhhcE3UHawlb8OARrIblrV3qlXI2hB110VZT1+8VrSwAXURIg0D fGJ4B3lbwbbOY6xk5MRgacB3uISVsi7ej2hiHSYlp2Ggs39x1N/j60d8Lg50+jKi4S64ryvYuaiL z1LQHs07gY/DCxOo1sLYvlNaFMawo/psQ6BT9ildfLZgCDTiLVhbhQx7VEdJPqO1VYFOycdEMXxK vARX32oHCSW7bgoqg1G1boovA8Gtvv5Nl3w0AHQjajjTJw06of2mT/Q5/2vXqDTvUF6gYVH9WR38 VqNIqB2Mt/b9/ZS5L+LOQBcMfDqn8DEU5MvQAWQbojLGqZr4LHoDUTYj0BlcFOwKIobCMzr55HBf q/Pb0h5saZvTqc52PEo6vpWi/ArKi7KMlo5OkZDrEIONIXVe+bSq6clq+kxyyneym0R2YMAQbGkf 4B8ejDfIAlhBmBxdTlPvJRXOUizWRmyUwcbeYMAeaBzoHRrZs3BgMBweWNPQs3Q8lsFAsKl/INje WYW5VNf9Tt82/tFO1iK1dNQW5GPvqR0MShe1DYali9rndB6z4558UUdnTJbkup7arsEs5HUeC2Bz V60yt3IjLxLgCd7STCQMannfsTBje9RcjWpQ031DElNtVAg2ifUNyWSzi3IybBqyhVVbF15YYd6l mALsww2Bfj49O7qWDvR08cXFEjGV+JGiUrCaReVg9aAk6yxRU3BRbdQcrOX2Gm6vIbuO2/XB2qiU KME5Q9iTBnqC2KcQcp3MJ3UhOuw8+uXswNDISEdnxvO+k10ZWBLzgDmdUWMI54A2uxnlJnP0wDw5 uqevl/eDRbDU+cps6uvCWhANokhT1IgWjPEWUKJRrcPDEZX6MDeYQLX+HiSie7qiXSH+oZ3LeI8C AXuUTQmOx7RTm9oc/kGFXQPOYDEPbBSNmrIv5GRE31h7J1l8SOLDsOHyEekt6HlfEFl9PQHMgIb1 tSPUaS818XmDZRG2RE3OIhUmXzyT8WEp2WarKWocgwbxw7V5DBrEj74LTuGDV1MXxgvgs+1RM3qU c5Yr4xXgHWQ18b7g50J0nhf9MW+mbYjNDG7B1sg7rX6UHtlRa3ZTLzZ/qm+GJVghKqMtQzY38Tae Jquej9wCvyvZHUMjB4Nb+Q4gXgX5QX448MBkvmMIbNY18F1DdG6oIN/wXatVNQ8MGKzfX4H8ZbCe Yd5KoAFnDT5Ki6fE9crLeKJS8IRZyVrZNDb3cWaVZuIxcrz08MOe+npDgf4JqY7JLCB14GFTkurC No1sPZqSUhM8Ok53meJoGpIKjtToL5NlVnP67dMvFJ5++6SzsvCkVPjWO2+/Y//4BUdlYck7r7xT NFZyZDhUuBNkvd6tC2aOkcfl5pSVlBRXy+NKc4KZCbJqKy0rr1ZKitNlBSXJUi3ztKS8/PUcZfpp nbwrWDOrRJueYnNbdVo51essqMq2t8/NrhqTplf0OkVr0I8qr81sWdGQ+brekeZJTHMaDM60RE+a Q3/6DW3Cl3/XJnxVp1nx1bWKbsK8mizlBpNB1uh0Q+ne5NETMppm2Vx2jdlldyQa9E6HZVT9vNMX eFJ5G6keD7V1uhU+lHCrZsoO+DCfbRpMyR0aee+wXWoFnzpsi7NV5c8OW1R+77CZs+wIG42ugCuA R/eUIckQtu7JkY7nSC/lSDk5uuQhyRKztuWCBnUdrOZkDfdp99p1cGuhs7KysND+Toi/iovGZnMn ZWTmjHOUlpVkwEse1eD4jlR2aExWw+lrkvLykuTFBqtBq8XbsE6KGaxGjcYIPU2WDFaTZrLT5zT4 czV7c/0Gp8/t9DkMw8uN9lSXM8WuHy4yOHx83HNHPtJs0QZYDbs9nJaaavN6MW6vHYP22jFirwnD 9doxVi8fq5U9mSsFcsO5PblKri3uJbDqJfCHh1EH/BH3kpqPmrYhufhIYalU6h2STEcyMysLqx+T TIhbk5QXq2x3D0n5g4WzuHdOv3LSQUHXTX55pbv7aVIwI/TigcRDzONORzCVlTu4z0oRWKqjHO4E zVmhptFs0RgsekvF/H1zzrlvU03DtnsXVW0fN/yKw6ExWozSTeZEp8k5ft7C/qL9H94xq/vek1c2 713UkGLSzHeluQw5Y3KmDTyxesfx8+rT0qStmVkuONFgT3UOu1Jy0jK9lu77T11745fR3pRgXkom xdHIl1Kn1o3vcWYcrUmanvRQksLifgKrflIZfgKr0aTmw0/sUdnBTCPHj3qkVpN9pjbCamqkwhCN v2hstxohfLE5+HB5hEidBndGsjfTbTB6MpKSM9yGFIxWq9VbDJrXhUK3eHyPfKnZpXWwiez8w7k2 mzveJ5Ux2SqjT+BTfO7UNPrk5rOenm4aM6aYB0axF2WLvShYbEepYi+KFPMidpZeMdM0xparSc5s S47wYK+pcSZVYgCvxEPcUSKCvbAkHu58pnKxUHKDiYkeTB3tEnwB8OElSelKUkkOXxHx8Wp2WT0p 1vKU3GDQM7w0MClVlmWDy+/1+p2G/JSZabn+NIc0Pq2suMgrYRG4/MmJAadhshsr3pxWnCufqNw5 Ycr+5q//obdyL1n1mvtGZZqS8vynf1ba19NdOP3QdPkJvYWvI4ue/DZ55KTSp81gTezdY2zSyHtH bHZp6iTuJThBZbhFZfgDrO4Lk4bk/HCoOOxyS1OLww6pNas4q9ji8/K6Pr6sfHbU8nEX+rgLfY/K Rfi+6/hhnxoVxw8nx9lN/IjNIU1lljGPSbmsHMsmJ2x2BMql8rDZIk11DI0cD5u4KneUOxKrsNk8 PMmnzWtPHJLyBrXqwsJec9LB95tQqNt+0o7t5xW+7YilpWaIOIsvMo26qDANtK2P0cXTOnVfwsTF F6FO6avb/MPuSatnT0gyY7EZEkpmrG2u6K7LKp65bNXSmSUTll3VEZrdWuXSaWRFZ9abC+u7x5fN KE0pbl++anl7iXTO3Mv7ihMDmd5sP/Z3feaoYHr5jJLyaROKSqo71k5v2z2rwJbsd5kdXpcz1WVM Daalja3NLptWVVwysX0tYnviyJe6E1hzVWzJ4ZwqqXho5PNwHXdIdrFUaOBiVKGUbVct2VKml4u8 TMkb4KKgSCoYKxVkSQVBqXzm6JnBsWbFmTbTGVHXnxrDNVh8eEmhbvEnO0Gh2A0qQuXklJVR1JZI dOwlSaQSE3V67T6NPTUv3R9KTdAMfyx/qSSk5AUy8lNtyvB9OsmRE/BnufSyFJQkt2J0Z6enZriN ipQnS2mKzhVMSw/aJW1OgoNHpiNB+dXXhUJrDiWlJGgUQ4L5q6c14802g0ZjsJm/elYzwQStTUhJ 4nEss3mI4xrlOVaCa0k0HLDV+msLaxWzManUgigs5UFZykOx1M6DtHRI+mc4geXm2phkYfw0YOPj OwP4PR77KqMCZ3VRjB+SDWG3I+kZVmovlSccL5UY9vzSMZNGD0m+sO2lTCkzU5P2wZjmiW9aWjWs UJyG6pbfvXZ+N6JSjcGnQ/O7K+MnY3Fl0dj52Pl0uGZgJxjHGTsg3xBKxpVSEMYtGnVL1FNYJvKj Qamxp/pS/AkTrmqbvL6toHrDPct2JBZNq5zY21RkMWCZ6321sxaX9l7UkXPnZfX9tf6uGZNWT/Ra LDqdxTKnpjG7cfGkqWuasxtLZ4zzpQXTDPZkW3JaSjDNlR/Z1fF0UkFNXmN7bb26v86BfwPKz9k4 dvFgKnb04/z+AD7BfcV3+CPwFfuei4V6VKp2FAB/wCvgYmEOWwsTpITkd/1hk3WKP2tIko+4mpW/ FqHtI0brlKL8IUk3aGzFde2VED86Q/Bf/Nh8+syV4ht3Fadj5arJYCYUrWvuMiUga/XJVS2dhb37 F42btPZAV6itfpzXqJOdVltuVWT85t0Z4e6qylk1IYvepFdudyQ7rMnZac7w9sMbz39y2wR7SqY3 weV15vozRmUcfXD2vs5QVihocKXxuOuBX27G3x/k4GZ6SdhfM0Ey+yp5tFXym0Ul3wcreXxV8uCr fEzC3+mwQvJaIY805IPVc1NlVFLtKF04JJvCJldGo7ky16dJQJhpY95mhK7mcEKrdipOIH7fUs8g 2tvESYSY+uYwPTukihOTzpw1Sk7ON9eMarlcuVnvSHXzy+PkA3P7Lp09qnjhVQum7wvr3X5vcsBp vLtuZ31NZ3myp3TWpIyJ4cbcZBzAGg2O4s2ts1r3DS7c8Nh5kxvqZLM4e043tM+uWrgjXL930UTn 6DocANxf3fDXAazTEL7peTA8urCspmx1meIKwGOuAPzkcmXk83Mjn/srnzsyX12xiIYvHq4P3RmS Q3DXwygZKtXEww+sRpmaRjUwLVkN92BGRv5P92iu1MjHNdJLGkmjSS18M6fZ+0FPwpoEOcH4Qaoa Yt1n311Vdxa/FaJww9UsFIJLJYRXxlmBhYPi7PCTPbllqkv1yoHc5NOx9MY1beH+pkKL3qxTZEVv Lpu1Nrz64LrxVWtv61t+XU/B3crWzRPnVWfikM/NaNkya4wnxaNPSHZaXTaLOdnrqt42tG3DsXMb 6tff1Onae+2YqYvKuQ8ldmDkS+U27VpWzLYeqSmVRrt4IGHc4FPqVgWh3ry4gS8315D0eTgp3cxD 0sx9aubeNauONfM8Ewsji6WPTrZj1R0taM5qTJ6qhhiCzFmJ2zydpXTD+VZ8OdRdSqc/63oTv804 6MDwKLcZnAEeQwbvmKax1TvqkUz2Blx6vYvMk69smrN9akaywcx3d7NBtrXOr8/qjJy+RFi0FTh4 kWcxnP5zS9PExRf38lg6H3fRNm0h7qIZ7NKjNcHpwdVBJZE7A0MEqz5Q0y41fYKvNqTV1aba4YXE x+S1LJV5yFOeeC2w6lIwudQDNz1i8ocReP4hqfpIsr1J9c9rJ0PxbT2++nik/OtN1sW3JtzjcYQm StXfdYArf8L4EMcZFyjn8Tsuv9tLY8ePzqsEvpn7HZj7UnZd2FJTJuUVSUVhp9SKbfMlde4h1D0Z /AG/6appjLPoMTmXZTJLfDyWeGiAVTeB1QFbeDikJBYUMD5UCovETLN2VFNqo0OEBK5bUiE2YZxi H/N7VvEJ/s5HfmboudL3BET84oB9Wi9JiYnKDoMrM8UX9Np0w+d91ydSh8GZnOlNzvQYrbbhR6VV VjMu/waNorcapb8PW/81NL5+WdpkshoVLDWjxWsffnQ42+E5s16w5xSza8M2J3/Yc/G3+NI5xaNC XSl8+zmzYs6soPjSglt86Wa+n9MK4ps6LSh1LcFtR+OLiC+hsKmgeXRyVpNYRc7KGv5MHL+Rxh8U +DpiodBZ0cIP/O9bSp7/tJR0ztSkxDS7fur1rf9hKSnnGczwkdFs2ByZjpXUw+NKZvx8fxs+crFc dk84tSZPGuWU8hxSjlXKsUg5BilHL41Wb2zpPFLgBrC6kMBqwIHVXVjNh3vT+eabXmiSTG7+aOXm DnPzfd7tRFi6udfcj8om/lxw1MZa12Bjw/cJUszWHMRdYFCLbRl7Ms78uNPE4c+jLP4Sz8viKq+P 35jE8a+8PX79A+tW37WqrHL9/evB5Q/6qpdPb1pWn+GrWT59yvL6gPTnVccuaKnddWQduBm8o2nv wsrSBXtbm/f2VpbO3wvfHBi+VnkVvhmNp8s9D+OhNaPMFI8TsLp8eFpdfhBqwJj4OkryhPiAQ3zA IfXpKMSHHeKewa9CmMrGZWi0Y3GuP5LT7GuyT6+EjA+c77tJWGW0q1DA8MsiTqEE9TEy91/Xl4fu 5cILekcironVsvJqSd/V80fVTwpniUWGcHF7fE593tTWtoKFA7NHPegpmRUOVONYr99WV91VniK9 v+nxfZPtmaXB4Wqx92reR9QoCuJn6+jqPM/U8x7a2HBuf5Urr65o+EZ8V96/48weJR+Ev0pY35E1 46QcW9xJYNU3YHIWF3yvtnFnOVkY2zTjj5OMe42lwIfZYWOoOcfmCTR5+IUHGw8PCX7/U8/osx3C bzPfcwqRU3TyQVlnNBiS0rI8yWPHjQ+e5Ql14WRPGl+ZZs3ISrNoFElZmJjuMBqNBveYqeWno2Kr +Wbp7Curz7UpBpPJmIBvmfge0zZyUn4BY25iL4QthS01LdNbdrc81KI961FaDRQ1jZUAPn4Y41XT WB4qIzYmDUlvhv30PM1Pah8/s+OP08j28VXke1T6jC+bsAkJZgnDju37eDgH7dVYHrLIljFvlZv+ 6pjh6HGscSj02PwGf2ZuTnyP1tWZB+b443J3KPRKfJ0hq5AeVOK3HjXe/p8fl+UXSubvnTZ2dsPY RJOGPw6HamZVjK4v9uWGZ0Tawrl5M7fPzJoyPs+jV7BTm3TGzLKmwtHhPM+o8MxIezhXSmhYgRlP SnZn+V34Js8X8DmDZdk5paP8maHqWVXjepvyLU6P3WJLtDuS7frE5ERXcGxq7rhRgczRVR18LjJG /iav1DzAxrN5R/KYI1jAwwyuUhk+BatzAVZ3MpXhxAIehpYka8HJ4JQ068mkKUW4aw/qaSN6ngde CV20i59/mr7RpO/iHOrRTo9s8buPR31Yw6EfdLjVRcjT8kqDPZA3JqmxP5y2y+bkX2zuFHegd/nz mtP2bvnkpKxUt0Fr1GrmpmXaE4y67Jb10+SEQJYrxaF/TXx585rekeLKCgybuhcYTUZtgpeP+1r+ LKI8jnPuajyJlErmXB5BuTyCcg0YX6564cvlZx++sv3iEVpr/vgiBKteAX+ubmVc8GslLyAMp8gg fRE2ugqacs3a5CY8uWm/eSDhKzR+IfompL51YRQPJGeeRBzim07xNRgeRZxpnqQ0h651v3qc6d0B Ly6MhqTCKWOrtzfgkQT3R6fxzG1pc2Ra1ZKLF8qZ4mg7/cn0BXXZnRF5o7Bw/2RiH98B/2SxmceY b+RUeBxGV+6T8nySl+/LOV4pJ6EsQc41Sil8UY1PkZIrwBOSJX9TssnVZGrRTGct/Ks/7ET8WxN8 XyLhLArhJ0OhZ/dyF77vk3JKz3xb4uIhkZjo1sslW3RFxSkBh6zbYbQrw08a7Fnp6Zluo1aSlM91 jsxAapZDN/yw3aG1uBOkSo3TpMzzeBO0isFmPT1Gfs1l1mKmnep+w89sNqF38OACW9WnLNnAdyH2 zNwluPAIHl6Pb43WImnkZdUXfp1Qf8vp1xkzTfu6aPhS4yPwyrdfSZoEuOpF/G3Be+x+rYXNlTXg 0ex+5QE2WZ/OJiqvsnnKQjZHU8p6lK9YN/iA9Bo7X7mDHeBaU6HmHZCfYweUDNYmP8gyYL9WuRW3 T4bfBrpdSpeelZ3yg8oejVPzlHaa9i+6i/QW/QWGgCFmDBt/a5qJx5NrLVmWAbV3SfjNHi3+/kKP UdhZIVvEWNCL30HUqLkSfuOQxqDDbx6yafUdc+o7QnW9K5YtXLcsZlQCQ/J5R4xeqRlinxB7hThX iD1C7BZilxA7hdghxHYhtgmxVYgtQmwWYpMQG4XYIMR6IdYKsUaI1UKsEmKlECuEOEeI5UIsE2Kp EEuEWCzEIiH6hegTYqEQvUL0CLFAiPlCdAsxT4i5QswRokuITiFmCzFLiIgQHUK0CzFTiDYhZggx XYhpQrQKMVWIFiGahWgSYooQk4VoFKJBiHoh6oSoFWKSEGEhaoSoFmKiEFVCTBBivBCVQlQIUS5E mRDjhCgVokSIYiGKhBgrRKEQY4QoECJfiJAQo4XIE2KUELlC5AiRLUSWEEEhMoXIECIghF+IdCHS hEgVwidEihDJQniFSBIiUQiPEG4hXEI4hXAIYRfCJkSCEFYhLEKYhTAJYRTCIIReCJ0QWiE0QihC yEJIQrC4kEaEGBbitBBfC/GVEF8K8YUQnwvxTyE+E+JTIT4R4h9C/F2Ij4U4JcTfhPhIiJNCfCjE X4X4QIj3hXhPiHeF+IsQfxbiT0L8UYg/CPGOECeE+L0QbwvxlhBvCvGGEK8L8TshfivEb4R4TYhX hXhFiF8L8bIQvxLiJSFeFOIFIZ4X4pdC/EKI54T4uRA/E+KnQjwrxDNCPC3ET4R4SogfC3FciCeF eEKIHwnxuBCPCfGoEMeEGBLiqBCPCPGwEEeEOCxETIhBIaJCPCTEg0I8IMT9QhwS4j4h7hXiHiEO CnG3EHcJcacQdwhxuxA/FOI2IW4V4hYhfiDEzULcJMSNQhwQ4gYhrhdivxDXCXGtENcIcbUQVwlx pRBXCHG5EJcJcakQlwgxIMTFQlwkxIVCXCDE+UKcJ8Q+IfYKca4Qe4TYLcQuIXYKsUOI7UJsE2Kr EFuE2CzEJiE2CrFBiPVCrBNirRBrhFgtxCohVgqxQohzhFguxDIhlgqxRIjFQiwSol+IPiEWCtEr RI8QC4SYL0S3EPOEmCvEHCG6hOgUYrYQs4SICNEhRLsQM4WYIcR0IaYJMVWIFiGahWgSYooQk4Vo FKJBiHoh6g7z2zJuzbH0aj/uzLF0D2gvpc6NpY9Hag+ldhPtiqVbYNxJqR1E24m2EW2NpU1CkS2x tDrQZqJNRBspbwOl1hOtI+PaWFotKqwhWk20ioqsJFpBdE4stQEllxMtI1pKtIRocSy1HkUWUaqf qI9oIVEvUQ/RAqL5VK+bUvOI5hLNIeoi6iSaTTSLKELUQdRONJOojWgG0XSiaUStRFOJWoiaY74m jKGJaErM14zUZKLGmK8FqYaYbyqonqiOqJbyJlG9MFEN1asmmkhURSUnEI2n6pVEFUTlRGVE46ix UqISaqWYqIhoLDVWSDSG6hUQ5ROFiEYT5RGNIsqlpnOIsqnNLKIgUSY1nUEUoHp+onSiNKJUIh9R SixlGpyVTOSNpUxHKokokYweIjcZXUROIgfl2YlsZEwgshJZKM9MZCIyUp6BSE+kiyXPwKdrY8lt IA2RQkaZUhIRU0kaIRpWi0inKfU10VdEX1LeF5T6nOifRJ8RfRrzduCvtD6JedtB/6DU34k+JjpF eX+j1EdEJ4k+pLy/En1AxveJ3iN6l+gvVOTPlPoTpf5IqT8QvUN0gvJ+T/Q2Gd8iepPoDaLXqcjv KPVbot/EkmZjKK/FkmaBXiV6hYy/JnqZ6FdEL1GRF4leIOPzRL8k+gXRc1Tk50Q/I+NPiZ4leobo aaKfUMmnKPVjouNET1LeE0Q/IuPjRI8RPUp0jGiISh6l1CNEDxMdITocS6zBoGOxxLmgQaIo0UNE DxI9QHQ/0SGi+2KJ2PWle6mVe4gOUt7dRHcR3Ul0B9HtRD8kuo3oVmrsFmrlB0Q3U95NRDcSHSC6 gSpcT6n9RNcRXUt511ArVxNdRXlXEl1BdDnRZUSXUslLKDVAdDHRRUQXEl0Q8/Ri7OfHPAtB5xHt i3kWI7WX6NyYJ4LUnpgHh420O+YpA+0i2knVd1C97UTbYp5+FNlK1bcQbSbaRLSRaAPRemp6HVVf S7Qm5ulDK6upsVVUciXRCqJziJYTLaN6S4mWUM8WU/VFRP1Uso9oIVEvUQ/RAqL5NOhu6tk8ork0 6DnUdBd9UCfRbOruLPqgCLXSQdRONJOoLeYOY2AzYm7u1ukxN1+w02LufaDWmLsANJWKtBA1x9y4 SEhNlJpCNJmMjTH3LuQ1xNwXgupj7t2guph7D6g25mwETSIKE9UQVcecuBdIEylVFXN0ITWBaHzM wddRJVFFzDEZqfKYoxNUFnPMAY2jvFKikpgjH8ZiKlkUc/CBjY05+IZUSDSGqhfQJ+QThaix0UR5 1NgoolyiHKLsmIN7KYsoSG1mUpsZ1FiAWvETpVO9NKJUIh9RClFyzN6NNr0x+3xQUsy+AJRI5CFy E7mInFTBQRXsZLQRJRBZiSxU0kwlTWQ0EhmI9EQ6KqmlkhoyKkQykUTEwiO2hX6OYVuf/7St3/81 9FfAl8AXsH0O2z+Bz4BPgU9g/wfwd+R9jPQp4G/AR8BJ2D8E/oq8D5B+H3gPeBf4S8IS/58Tlvr/ BPwR+APwDmwnwL8H3gbeQvpN8BvA68DvgN9az/H/xlrkfw38qnWF/xVrjv/XwMvQv7KG/C8BLwIv IP952H5pXen/BfRz0D+H/pl1uf+n1mX+Z61L/c9Yl/ifRt2foL2ngB8D4ZHjeH8SeAL4kWWt/3HL Ov9jlvX+Ry0b/MeAIeAo7I8ADyPvCPIOwxYDBoEo8JB5q/9B8zb/A+Yd/vvNO/2HzLv89wH3AvcA B4G7gbvMBf47wXcAt6POD8G3mc/x3wp9C/QPgJuhb0JbN6KtA2jrBtiuB/YD1wHXAtcAV6PeVWjv StM0/xWm6f7LTUv8l5nu8l9qOug/X8n2n6dU+PdJFf69kT2Rcw/tieyO7IzsOrQzYt4pmXf6drbs 3L7z0M43doZbdaYdkW2R7Ye2RbZGNke2HNoc2XRoY0Sz0b1xw0blk43SoY1S/UZp7EZJZhvtGwMb FcuGyLrI+kPrImzdjHV71kXXaSZE151YJ7N1Ev7W/vjhdb70Rv7XqDvWWe2NayOrI2sOrY6sWrwy shzdWlaxJLL00JLI4or+yKJD/ZG+ioWR3oqeyIKK7sj8Q92ReRVzInMPzYl0VXRGZqP8rIqOSORQ R6S9oi0y81BbZHrFtMg02FsrWiJTD7VEmiumRJoOTYlMrmiMNGDILNWeGkhV7LwD01LRE/yzqtqx vrDvhO+UT8N8Ud9xn+K0pfhT5DxbslQ3PVlanbw7+YpkxeZ90SuHvXn5jbakF5N+n/S3JI0rnJQ3 ppEl2hMDiQp+hen44cTWDj62w4k19cRF49SxtiYGcxptHsnm8XvkBr9HYo4TjlMOxfOk/UW7bLNJ NtuITQ7bUNyW4E+Q+dtIghJOKCpvtFn9Vpm/jViVxLAVFt75XMuMjkab2W+WIzXm6WY5bK6pawyb C8Y2MkUKSPh/I+wgxYCyRySPv1F5HCb+r3wk6crBjvZQqGXIwGa2RA0z5kali6LZ7fw93DYnqrsI /1hqztzOQUm6vAv/Lq2uI+rm/8hPTZ9/2WUsrbYlmtbeGVNuuy2ttqsluofrcFjVI1wzFOkKzV+/ cX0otGE+3uav3xBSf5CSNvIUXsjAz/oNSPM/IKTxazr/7kXFUG7BerzUZpAg/nf1/qvzpP/q3v2f 6Nwg4/90ddKIfB7rl/cBe4FzgT3AbmAXsBPYAWwHtgFbgS3AZmATsBHYAKwH1gJrgNXAKmAlsAI4 B1gOLAOWAkuAxcAioB/Afw8i4z8SkXuBHmABMB/oBuYBc4E5QBfQCcwGZgERoANoB2YCbcAMYDow DWgFpgItQDPQBEwBJgONQANQD9QBtcAkIAzUANXARKAKmACMByqBCqAcKAPGAaVACVAMFAFjgUJg DFAA5AMhYDSQB4wCcoEcIBvIAoJAJpABBAA/kA6kAamAD0gBkgEvkAQkAh7ADbgAJ+AA7IANSACs gAUwAybACBgAPaADtIBm0gjeFUAGJICxfgk2aRg4DXwNfAV8CXwBfA78E/gM+BT4BPgH8HfgY+AU 8DfgI+Ak8CHwV+AD4H3gPeBd4C/An4E/AX8E/gC8A5wAfg+8DbwFvAm8AbwO/A74LfAb4DXgVeAV 4NfAy8CvgJeAF4EXgOeBXwK/AJ4Dfg78DPgp8CzwDPA08BPgKeDHwHHgSeAJ4EfA48BjwKPAMWAI OAo8AjwMHAEOAzFgEIgCDwEPAg8A9wOHgPuAe4F7gIPA3cBdwJ3AHcDtwA+B24BbgVuAHwA3AzcB NwIHgBuA64H9wHXAtcA1wNXAVcCVwBXA5cBlwKXAJcAAcDFwEXAhcAFwPuuftEc6D2ofsBc4F9gD 7AZ2ATuBHcB2YBuwFdgCbAY2ARuBDcB6YB2wFlgDrAZWASuBFcA5wHJgGbAUWAIsBhYB/UAfsBDo BXqABcB8oBuYB8wF5gBdQCcwG5gFRIAOoB2YCcwApgPTgKlAC9AMNAFTgMlAI9AA1AN1rP//xGb9 39vJrv/erv2f6Jl3wXz2PzrML+gKZW5kc3RyZWFtCmVuZG9iago0NiAwIG9iagoxMDMxOAplbmRv YmoKNDcgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgOTUyIC9DYXBIZWln aHQgNjM4IC9EZXNjZW50IC0yNjkgL0ZsYWdzIDQKL0ZvbnRCQm94IFstNDc2IC0xOTQgMTIxNCA5 NTJdIC9Gb250TmFtZSAvTkRUWkRUK0NhbGlicmkgL0l0YWxpY0FuZ2xlIDAgL1N0ZW1WCjAgL01h eFdpZHRoIDEyODggL1hIZWlnaHQgNDcxIC9Gb250RmlsZTIgNDUgMCBSID4+CmVuZG9iago0OCAw IG9iagpbIDg5MCA1MjcgMzQ5IDQ1NSAzOTEgNTI1IDUyNSAyMjYgNTI1IDYzMSA0ODggNjQ2IDI1 MiA0NzkgNTI1IDQ1OSA0OTggNDIzCjUyNSAyMjkgMzM1IDQ1MyBdCmVuZG9iago0OSAwIG9iago8 PCAvTGVuZ3RoIDUwIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdkstugzAQ Rfd8hZftIsLgJCQSQqpSRWLRh0r7AcYeIqRiLEMW/H3vmDSVujiLw/UMHtvpqX6uXT+L9D2MpqFZ dL2zgabxGgyJli69S7Jc2N7MN4vfzKB9kqK4WaaZhtp1oyjLRIj0AyXTHBbx8GTHlh7521uwFHp3 EQ9fpyZ+aa7ef9NAbhYyqSphqUO7F+1f9UAijaWb2iLv52WDqr8Vn4sngR2hIlu3ZEZLk9eGgnYX Skopq/J8rhJy9l+U52tF292W5llVMlLuiiop8xwKpNx3rAoKpCxy1i0UIG1Zd1CAVLHuoQDpgbWA AqSS9QAFUuqoRyjAYuJUQ4GU27iNFgqgO04NFEDjYgsF0COnBAVolbF2UADdQhXOgsGAvEmFWRmk 3FlhVgYaU8yq1nljilnVOi//SGFWBhPFzphVxXkLpDjr30PlY+fncb9Ocw0BNxnfULxkvrze0f2Z +dFzg8gP42CzugplbmRzdHJlYW0KZW5kb2JqCjUwIDAgb2JqCjM2MQplbmRvYmoKMTUgMCBvYmoK PDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvTkRUWkRUK0NhbGli cmkgL0ZvbnREZXNjcmlwdG9yCjQ3IDAgUiAvV2lkdGhzIDQ4IDAgUiAvRmlyc3RDaGFyIDMzIC9M YXN0Q2hhciA1NCAvVG9Vbmljb2RlIDQ5IDAgUiA+PgplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUg KE1pY3Jvc29mdCBXb3JkIC0gY2ZwLmRvYykgL0F1dGhvciAoTWF0dCBCaXNob3ApIC9DcmVhdG9y IChNaWNyb3NvZnQgV29yZCkKL1Byb2R1Y2VyIChNYWMgT1MgWCAxMC41LjUgUXVhcnR6IFBERkNv bnRleHQpIC9DcmVhdGlvbkRhdGUgKEQ6MjAwODEyMDIyMjI4MzdaMDAnMDAnKQovTW9kRGF0ZSAo RDoyMDA4MTIwMjIyMjgzN1owMCcwMCcpID4+CmVuZG9iagp4cmVmCjAgNTEKMDAwMDAwMDAwMCA2 NTUzNSBmIAowMDAwMDYwOTcyIDAwMDAwIG4gCjAwMDAwMDg3NjYgMDAwMDAgbiAKMDAwMDAwOTk3 MSAwMDAwMCBuIAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDg3NDYgMDAwMDAgbiAKMDAwMDAw ODg3MCAwMDAwMCBuIAowMDAwMDA5OTM1IDAwMDAwIG4gCjAwMDAwMDAwMDAgMDAwMDAgbiAKMDAw MDAxNDA0MiAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAwMjQ0NjQgMDAwMDAgbiAK MDAwMDAwMDAwMCAwMDAwMCBuIAowMDAwMDQ5NDMxIDAwMDAwIG4gCjAwMDAwMDAwMDAgMDAwMDAg biAKMDAwMDA2MDgxMCAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAwMzExNTcgMDAw MDAgbiAKMDAwMDAwOTAyMCAwMDAwMCBuIAowMDAwMDA5OTE1IDAwMDAwIG4gCjAwMDAwMTAwNTQg MDAwMDAgbiAKMDAwMDAxMDEwNCAwMDAwMCBuIAowMDAwMDEzNDM4IDAwMDAwIG4gCjAwMDAwMTM0 NTkgMDAwMDAgbiAKMDAwMDAxMzcwMCAwMDAwMCBuIAowMDAwMDEzNzI0IDAwMDAwIG4gCjAwMDAw MTQwMjIgMDAwMDAgbiAKMDAwMDAxNDIxNCAwMDAwMCBuIAowMDAwMDIzNTUzIDAwMDAwIG4gCjAw MDAwMjM1NzQgMDAwMDAgbiAKMDAwMDAyMzgwMCAwMDAwMCBuIAowMDAwMDIzOTQ4IDAwMDAwIG4g CjAwMDAwMjQ0NDQgMDAwMDAgbiAKMDAwMDAyNDYzMSAwMDAwMCBuIAowMDAwMDMwNDA4IDAwMDAw IG4gCjAwMDAwMzA0MjkgMDAwMDAgbiAKMDAwMDAzMDY2NiAwMDAwMCBuIAowMDAwMDMwNzQ2IDAw MDAwIG4gCjAwMDAwMzExMzcgMDAwMDAgbiAKMDAwMDAzMTMyNiAwMDAwMCBuIAowMDAwMDQ4MTkw IDAwMDAwIG4gCjAwMDAwNDgyMTIgMDAwMDAgbiAKMDAwMDA0ODQzNiAwMDAwMCBuIAowMDAwMDQ4 NzIwIDAwMDAwIG4gCjAwMDAwNDk0MTEgMDAwMDAgbiAKMDAwMDA0OTU5MyAwMDAwMCBuIAowMDAw MDYwMDAyIDAwMDAwIG4gCjAwMDAwNjAwMjQgMDAwMDAgbiAKMDAwMDA2MDI0NSAwMDAwMCBuIAow MDAwMDYwMzUzIDAwMDAwIG4gCjAwMDAwNjA3OTAgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSA1 MSAvUm9vdCAyMCAwIFIgL0luZm8gMSAwIFIgL0lEIFsgPDgxN2ZjZTkxMmI0NzY0NDY3ODI4MDUx NTk4ZTBjOTI5Pgo8ODE3ZmNlOTEyYjQ3NjQ0Njc4MjgwNTE1OThlMGM5Mjk+IF0gPj4Kc3RhcnR4 cmVmCjYxMTk2CiUlRU9GCg== --=====================_31699593==_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir --=====================_31699593==_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --=====================_31699593==_-- From secdir-bounces@ietf.org Fri Dec 5 18:17:05 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7417E3A6990; Fri, 5 Dec 2008 18:17:05 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 418B53A68E1; Fri, 5 Dec 2008 18:17:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.481 X-Spam-Level: X-Spam-Status: No, score=-6.481 tagged_above=-999 required=5 tests=[AWL=0.118, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9YZoF+y+NVst; Fri, 5 Dec 2008 18:17:03 -0800 (PST) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) by core3.amsl.com (Postfix) with ESMTP id 2D8823A68D6; Fri, 5 Dec 2008 18:17:02 -0800 (PST) Received: from hop04-l1d11-si03.isus.emc.com (HOP04-L1D11-SI03.isus.emc.com [10.254.111.23]) by mexforward.lss.emc.com (Switch-3.2.5/Switch-3.1.7) with ESMTP id mB62Gocp019321 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Fri, 5 Dec 2008 21:16:50 -0500 (EST) Received: from mailhub.lss.emc.com (sesha.lss.emc.com [10.254.144.12]) by hop04-l1d11-si03.isus.emc.com (Tablus Interceptor); Fri, 5 Dec 2008 21:02:14 -0500 Received: from corpussmtp3.corp.emc.com (corpussmtp3.corp.emc.com [10.254.64.53]) by mailhub.lss.emc.com (Switch-3.2.5/Switch-3.1.7) with ESMTP id mB62GWQp026206; Fri, 5 Dec 2008 21:16:33 -0500 (EST) From: Black_David@emc.com Received: from CORPUSMX80A.corp.emc.com ([10.254.89.201]) by corpussmtp3.corp.emc.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 5 Dec 2008 21:16:32 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Fri, 5 Dec 2008 21:16:33 -0500 Message-ID: <9FA859626025B64FBC2AF149D97C944A01074AA9@CORPUSMX80A.corp.emc.com> In-Reply-To: <012d01c955e6$e81689c0$3258a20a@nsnintra.net> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: sec-dir review of draft-ietf-nfsv4-pnfs-block-10.txt Thread-Index: AclV5ub2iYQ7L9ESSIKrZPcVEhv+JgBX5AmA References: <012d01c955e6$e81689c0$3258a20a@nsnintra.net> To: , X-OriginalArrivalTime: 06 Dec 2008 02:16:32.0420 (UTC) FILETIME=[A7F9D640:01C95748] X-RSA-Inspected: yes X-RSA-Classifications: X-RSA-Action: allow Cc: shepler@storspeed.com, fridella_stephen@emc.com, iesg@ietf.org, Black_David@emc.com, jglasgow@aya.yale.edu Subject: Re: [secdir] sec-dir review of draft-ietf-nfsv4-pnfs-block-10.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hannes, Thank you very much for this review. All 3 of your minor comments are reasonable and we'll do something about each of them in the -11. The answer to your question about content identification: > I suspect that you are talking about using an opaque string as > identification rather than something like a IP address and port. Right? That's correct, and multiple opaque strings that are intended to match different locations on the volume may be used. This is a long-standing identification technique for storage - for example, volume managers usually identify a volume by checking the volume label that is often stored at the start of a volume. I can offer to explain why address-based volume identification doesn't work well over a suitable alcoholic beverage at some point. In any case, we'll add some additional explanation of this method of identification in the -11 version. Thanks, --David ---------------------------------------------------- David L. Black, Distinguished Engineer EMC Corporation, 176 South St., Hopkinton, MA 01748 +1 (508) 293-7953 FAX: +1 (508) 293-7786 black_david@emc.com Mobile: +1 (978) 394-7754 ---------------------------------------------------- > -----Original Message----- > From: Hannes Tschofenig [mailto:Hannes.Tschofenig@gmx.net] > Sent: Thursday, December 04, 2008 3:04 AM > To: secdir@ietf.org > Cc: jglasgow@aya.yale.edu; fridella, stephen; Black, David; > iesg@ietf.org; shepler@storspeed.com; shepler@storspeed.com > Subject: sec-dir review of draft-ietf-nfsv4-pnfs-block-10.txt > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area > directors. Document editors and WG chairs should treat these comments just > like any other last call comments. > > I have to say that I am not an NFS expert and the size of NFS related > documents is scary. > > Anyway, draft-ietf-nfsv4-pnfs-block-10.txt provides an optimization to > NFSv4.1 to "to allow clients to directly access file data on the storage > used by the NFSv4 server.". draft-ietf-nfsv4-minorversion1-26.txt > already introduces the concept (in Section 12) and this document illustrates how to > use it for block/volume layouts. > > As such, draft-ietf-nfsv4-pnfs-block-10.txt builds heavily on > draft-ietf-nfsv4-minorversion1-26.txt and therefore a lot of the transport > and security related features are inherited. > > Figure 1 of draft-ietf-nfsv4-pnfs-block-10.txt illustrates the architecture > quite nicely and the authors of the document do a good job of describing the > consequences with regard to security. In short, when clients access the > storage systems directly then the security properties are not only dependent > on the usage of NFSv4.1 anymore but also on the storage protocol used > between clients and the storage system. The used storage protocol may or may > not provide the desired security capabilities. This includes communcation > security as well as access control. > > This may sound dramatic. However, it is a matter of deployment and the > administrator of the system needs to make a decision about what is > acceptable. Consequently, in certain setups clients have to be trusted to a > high degree and communication security between the clients and the storage > system may need to rely on physical security. > > As such, I don't have problem with the chosen approach also given that the > concept is already introduced the main NFSv4.1 specification (a separate > security consideration section is also available in Section 12.9 of > draft-ietf-nfsv4-minorversion1-26.txt). > > > A few minor comments / questions: > > * Figure 1 in draft-ietf-nfsv4-minorversion1-26.txt also includes a > description of the communication between the clients and the > storage device > and between the storage devices and the servers. This > description is missing > in Figure 1 of draft-ietf-nfsv4-pnfs-block-10.txt. Very likely a > copy-and-paste error. > > * In Section 2.2.1 volume identification is described and it > is noted that > content-based identification would be necessary. I am not > quite sure what > that means. I suspect that you are talking about using an > opaque string as > identification rather than something like a IP address and > port. Right? > > * Typo in last paragraph of page 20: s/SEQUEUNCE/SEQUENCE/ > > Ciao > Hannes > > > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sat Dec 6 11:08:55 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4C7603A68C8; Sat, 6 Dec 2008 11:08:55 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 28DE63A68C8 for ; Sat, 6 Dec 2008 11:08:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wylkdyLd0vsp for ; Sat, 6 Dec 2008 11:08:53 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 427CA3A67B3 for ; Sat, 6 Dec 2008 11:08:52 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.2) with ESMTP id mB6J8kPT040552 for ; Sat, 6 Dec 2008 14:08:46 -0500 (EST) (envelope-from weiler+secdir@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.2/Submit) with ESMTP id mB6J8kCa040548 for ; Sat, 6 Dec 2008 14:08:46 -0500 (EST) (envelope-from weiler+secdir@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Sat, 6 Dec 2008 14:08:46 -0500 (EST) From: Samuel Weiler X-X-Sender: weiler@fledge.watson.org To: secdir@ietf.org Message-ID: User-Agent: Alpine 1.10 (BSF 962 2008-03-14) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Sat, 06 Dec 2008 14:08:46 -0500 (EST) Subject: [secdir] Assignments for Dec 9/13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org There is another telechat this coming week. Glen Zorn is next in the rotation. Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview -- Sam For telechat this week (review by 2008-12-09) Alan DeKok T draft-ietf-mext-nemo-v4traversal-06 Shawn Emery T draft-ietf-nfsv4-rfc1831bis-10 Love Hornquist-Astrand T draft-ietf-tcpm-rfc4138bis-04 Marcus Leech T draft-housley-internet-draft-sig-file-06 Hilarie Orman TR draft-ietf-pce-path-key-05 Hilarie Orman T draft-ietf-avt-rtp-g719-04 Joe Salowey T draft-ietf-mpls-te-scaling-analysis-04 Carl Wallace T draft-ietf-isis-hmac-sha-07 Carl Wallace T draft-melnikov-imapext-filters-07 For telechat 2009-01-06 Larry Zhu T draft-arkko-arp-iana-rules-05 Last calls and special requests: Rob Austein draft-ietf-dime-qos-parameters-07 Pat Cain draft-ietf-geopriv-pdif-lo-profile-14 Ran Canetti draft-ietf-kitten-gssapi-channel-bindings-05 Phillip Hallam-Baker draft-ietf-radext-design-05 Steve Hanna R draft-kucherawy-sender-auth-header-18 Steve Hanna draft-ietf-radext-management-authorization-06 David Harrington draft-ietf-sip-saml-05 Paul Hoffman draft-ietf-smime-3851bis-08 Jeffrey Hutzelman draft-ietf-tcpm-tcp-uto-10 Scott Kelly draft-ietf-tsvwg-rsvp-proxy-approaches-06 Stephen Kent draft-ietf-tsvwg-rsvp-proxy-proto-07 Tero Kivinen R draft-ietf-softwire-encaps-safi-03 Julien Laganier draft-ietf-softwire-mesh-framework-05 Julien Laganier draft-ietf-softwire-encaps-ipsec-01 Julien Laganier R draft-ietf-softwire-v4nlri-v6nh-01 Catherine Meadows draft-ietf-speechsc-mrcpv2-17 Catherine Meadows draft-ietf-l2tpext-tdm-06 Alexey Melnikov draft-ietf-pce-pcep-xro-06 Sandy Murphy draft-ietf-mpls-mpls-and-gmpls-security-framework-04 Vidya Narayanan draft-ietf-sip-saml-05 Magnus Nystrom draft-freed-sieve-ihave-03 Eric Rescorla draft-wing-sipping-srtp-key-04 Eric Rescorla draft-ietf-dkim-ssp-07 Stefan Santesson draft-ietf-pkix-ecc-subpubkeyinfo-10 Susan Thomson draft-loreto-simple-im-srv-label-02 Hannes Tschofenig draft-ietf-trill-prob-05 Sean Turner draft-mammoliti-l2tp-accessline-avp-04 Sam Weiler draft-chown-v6ops-rogue-ra-02 Brian Weis draft-ietf-isis-wg-extlsp-04 Brian Weis draft-ietf-sieve-mime-loop-08 Nico Williams draft-ietf-v6ops-ra-guard-01 Nico Williams draft-ietf-smime-3850bis-08 Tom Yu draft-korhonen-mip4-service-06 Kurt Zeilenga draft-ietf-softwire-bgp-te-attribute-03 Larry Zhu draft-thaler-v6ops-teredo-extensions-02 Larry Zhu draft-ietf-softwire-hs-framework-l2tpv2-10 _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 7 11:18:48 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E0BB3A68F0; Sun, 7 Dec 2008 11:18:48 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A6AC53A67B4; Sun, 7 Dec 2008 11:18:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.528 X-Spam-Level: X-Spam-Status: No, score=-106.528 tagged_above=-999 required=5 tests=[AWL=0.071, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zAmTzMkUUuou; Sun, 7 Dec 2008 11:18:45 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 8238B3A68F0; Sun, 7 Dec 2008 11:18:45 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.33,730,1220227200"; d="scan'208";a="208312197" Received: from sj-dkim-1.cisco.com ([171.71.179.21]) by sj-iport-6.cisco.com with ESMTP; 07 Dec 2008 19:18:40 +0000 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id mB7JIeu6022028; Sun, 7 Dec 2008 11:18:40 -0800 Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-5.cisco.com (8.13.8/8.13.8) with ESMTP id mB7JHavP011747; Sun, 7 Dec 2008 19:18:37 GMT From: Cullen Jennings To: Ralph Droms (rdroms) In-Reply-To: Impp: xmpp:cullenfluffyjennings@jabber.org References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com><56DEB14D23377D001B19EFE5@p3.int.jck.com><493661F5.10705@piuha.net> Message-Id: Mime-Version: 1.0 (Apple Message framework v929.2) Date: Sun, 7 Dec 2008 12:18:37 -0700 X-Mailer: Apple Mail (2.929.2) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=6423; t=1228677520; x=1229541520; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fluffy@cisco.com; z=From:=20Cullen=20Jennings=20 |Subject:=20Re=3A=20secdir=20review=20of=20draft-raj-dhc-tf tp-addr-option-04 |Sender:=20; bh=G1ePE7ScBzvfIvXCXE8ifEZBmoxPB0qgWryu8CjkTK0=; b=VTIEFackpfgO1GB0f177hjIdO5Y4hqbVPplNu6+8ViyPy0GPjADpHgKxM7 U1rTaRwnzvH9UH0PC3UxRWMGV2Fq6fTQM/K2kwOcNxU9W96cniVl9eLV6sdS KVbqYCAtia/WKAt5+uoyWi6Raqn5J5bScMmnUKOceymNlBZ6U6C74=; Authentication-Results: sj-dkim-1; header.From=fluffy@cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; ); Cc: "Richard Johnson \(raj\)" , IETF Discussion , secdir@ietf.org, draft-raj-dhc-tftp-addr-option@tools.ietf.org, dhc Chairs , Samuel Weiler , Jari Arkko , IESG IESG , John C Klensin Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I find the claim that attacks are easier to do with "VoIP Configuration Server Address" than the "TFTP Server Name" to be pretty dubious. All the devices I am aware of that use either option also get the DNS server from DHCP. If I can attack the DHCP response, I can probably get a DNS server running on the network and point the device at the alternative DNS server. If one is more secure than the other, it's not by much. That said, I think this security discussion is going the wrong direction. What is common practice, and what I think this should suggest, is that DHCP can be spoofed in some cases. The correct thing to do is to secure the object that is retrieved via tftp. One do things such as make sure it is signed such that the phone can verify it contains authorized data from correct source and if it contains any private data, like SIP passwords, that it is encrypted. There are ways to mitigate DHCP spoofing but discussion of those is outside scope of this draft. Suggesting the Auth option is a total non starter in every case I am aware of where this is used because the important thing is for this scheme to work when a new phone arrives without the administrator having to take the phone out of the box and enter a credential on the phone - the operational expense of something like this is just too high. Multiple manufactures resolve this by including factory installed public/private key pairs and certificates that bind the serial number of the phone and making sure the serial number of the phone is on a bar code on the outside of the box. The admin can then barcode scan the box, associate it with a given user, print a label for that user, ship the phone to that user, and when the user boots it, provide user specific data for the phone as well as replace the manufacture certificates with ones where the manufacture is not in the trust chain. Similar things are done for residential voice where the user enters the serial number of the phone and their credit care on the service providers web site and the service provider never has to touch the phone. They can ship from distributors to end users with no intermediate provisioning steps. One of the uses of this is firmload upgrades and many vendors have existing methods to check that code is appropriately signed. Many phones from more vendors than just Cisco support variants of the above. The key things is that one can, and many do, implement secure systems even in environments where tftp is not secure. Cullen, in my IETF participant role PS. I am not aware of a single device that implements or uses this option that does not implement DNS. Certainly there are devices that I am not aware of but does anyone else have an example of one? A more relevant concern might be that you want the phones to get their configuration from a differnt server than the diskless sun workstations and a separate option makes this a bit easier. On Dec 3, 2008, at 4:29 AM, Ralph Droms (rdroms) wrote: > Jari - I agree that mentioning security issues, pointing to the > Security Considerations in RFC 2131 and citing RFC 3118, is > appropriate. > > Responding to Richard... > > On Dec 2, 2008, at Dec 2, 2008,5:35 PM, Richard Johnson wrote: > > > Ok, maybe I'm not understanding what's being suggested or maybe I'm > > simply reading the existing text in a different way. Here's the > > contents of the draft's "Security Considerations" section: > > > >> A rogue DHCP Server could use this option in order to coerce a > >> Client > >> into downloading configuration from an alternate Configuration > >> Server > >> and thus gain control of the device's configuration. This is > more > >> easily done with the VoIP Configuration Server Address option > >> than it > >> was with the "TFTP Server Name" option, because in the latter > case > >> the attack would need to control DNS responses as well as > inserting > >> the rogue DHCP option information. If this is a concern, then > >> either > >> DHCP Authentication may be used, or the "TFTP Server Name" option > >> may > >> be used instead. > >> > >> Message authentication in DHCP for intradomain use where the out- > >> of- > >> band exchange of a shared secret is feasible is defined in > >> [RFC3118]. > >> Potential exposures to attack are discussed in section 7 of the > >> DHCP > >> protocol specification in [RFC2131]. > >> > >> Other out-of-band methods of verifying the validity of the VoIP > >> Configuration Server Address, such as certificates of trust, > >> could be > >> used to mitigate some security concerns. > > > > So, it only mentions option 66 ("TFTP Server Name" option) by > > comparison and in order to point out the relative levels of security > > involved. It has no "suggestion to use option 66". > > > > The text already has an "explanation about why the use of this > > option without authentication might be problematic". As a matter of > > fact, it seems rather explicit on the matter. > > I suggest we elide the first paragraph Richard quoted, and leave the > remainder unchanged ... except for fixing what appears to be a typo in > the first sentence of the second paragraph: s/is feasible is/is > feasible as/ > > Jeff Hutzelman mentioned other common techniques for mitigating the > risk from DHCP server spoofing attacks, which have not, to date, been > mentioned in any other DHCP RFCs. If there is serious interest in a > review of DHCP security practices, the dhc WG could return to its work > on a DHCP threat analysis and BCP for threat mitigation. > > On Dec 3, 2008, at Dec 3, 2008,5:39 AM, Jari Arkko wrote: > > > I think John's advice is solid. We really need to document the > > properties of our specifications, including being very clear about > > the shortcomings and recommended workarounds. Truth in advertising. > > (However, I'd would avoid making mandatory-to-implement changes that > > do not match with codebase for a legacy option document such as this > > is.) > > > > I'm expecting a draft revision. > > > > Jari > > > > - Ralph > > > _______________________________________________ > Ietf mailing list > Ietf@ietf.org > https://www.ietf.org/mailman/listinfo/ietf _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 7 12:51:43 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 42EF33A69B6; Sun, 7 Dec 2008 12:51:43 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 32DF23A69A2; Sun, 7 Dec 2008 12:51:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.187 X-Spam-Level: X-Spam-Status: No, score=-5.187 tagged_above=-999 required=5 tests=[AWL=1.412, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EBLYz0EVYaEh; Sun, 7 Dec 2008 12:51:41 -0800 (PST) Received: from chokecherry.srv.cs.cmu.edu (CHOKECHERRY.SRV.CS.CMU.EDU [128.2.185.41]) by core3.amsl.com (Postfix) with ESMTP id 4D1D63A6906; Sun, 7 Dec 2008 12:51:41 -0800 (PST) Received: from atlantis-home.pc.cs.cmu.edu (ATLANTIS-HOME.PC.CS.CMU.EDU [128.2.184.185]) (authenticated bits=0) by chokecherry.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id mB7KpA2f025993 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 7 Dec 2008 15:51:11 -0500 (EST) Date: Sun, 07 Dec 2008 15:51:10 -0500 From: Jeffrey Hutzelman To: Cullen Jennings , Ralph Droms Message-ID: <6C080E9C41171ADC1116AA58@atlantis.pc.cs.cmu.edu> In-Reply-To: <200812071918.mB7JIkwI004440@grapenut.srv.cs.cmu.edu> References: <90AC45ED-BF49-46ED-A35A-14E1BF699959@cisco.com> <56DEB14D23377D001B19EFE5@p3.int.jck.com><493661F5.10705@piuha.net> <200812071918.mB7JIkwI004440@grapenut.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.185.41 Cc: "Richard Johnson \(raj\)" , IETF Discussion , secdir@ietf.org, draft-raj-dhc-tftp-addr-option@tools.ietf.org, dhc Chairs , Samuel Weiler , Jari Arkko , IESG IESG , John C Klensin Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Sunday, December 07, 2008 12:18:37 PM -0700 Cullen Jennings wrote: > > I find the claim that attacks are easier to do with "VoIP Configuration > Server Address" than the "TFTP Server Name" to be pretty dubious. Me too. > That said, I think this security discussion is going the wrong direction. > What is common practice, and what I think this should suggest, is that > DHCP can be spoofed in some cases. The correct thing to do is to secure > the object that is retrieved via tftp. I'm inclined to agree with this, in principle. In practice, that requires either preconfiguration, which sort of defeats the point of using DHCP, or a closed system like firmware updates signed by a device manufacturer, where not only the network but also the user and DHCP server operator are untrusted. If we're talking about an option which will only ever be used to tell phones where to download new firmware, then this is fine. If we're talking about an option which will be used by network operators to provide configuration to phones (in order to avoid manual configuration), or in general to provide a TFTP server address for whatever is the next step in the boot process, then "secure the object" sounds like good advice but IMHO is less practical than "configure your network to prevent DHCP spoofing". > There are ways to mitigate DHCP spoofing but > discussion of those is outside scope of this draft. I agree that discussion of how to mitigate DHCP spoofing is out of scope. However, I think recommending that operators do so is appropriate. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 7 17:41:21 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C1BD03A691C; Sun, 7 Dec 2008 17:41:21 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2F1A73A691C for ; Sun, 7 Dec 2008 17:41:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.099 X-Spam-Level: X-Spam-Status: No, score=-5.099 tagged_above=-999 required=5 tests=[AWL=1.500, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k6-H-tXpdlBb for ; Sun, 7 Dec 2008 17:41:19 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 45B4F3A686A for ; Sun, 7 Dec 2008 17:41:19 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB81fDts002106 for ; Sun, 7 Dec 2008 20:41:13 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB81f7la002095 for ; Sun, 7 Dec 2008 20:41:07 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB81f0iW023689 for ; Sun, 7 Dec 2008 20:41:01 -0500 (EST) Received: from out01.mta.xmission.com (out01.mta.xmission.com [166.70.13.231]) by mit.edu (Spam Firewall) with ESMTP id 2232A13F95BE for ; Sun, 7 Dec 2008 20:40:39 -0500 (EST) Received: from mx01.mta.xmission.com ([166.70.13.211]) by out01.mta.xmission.com with esmtp (Exim 4.62) (envelope-from ) id 1L9V74-0001KA-1m; Sun, 07 Dec 2008 18:40:42 -0700 Received: from 166-70-57-249.ip.xmission.com ([166.70.57.249] helo=localhost.localdomain) by mx01.mta.xmission.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1L9V6r-0001TW-99; Sun, 07 Dec 2008 18:40:34 -0700 Received: from localhost.localdomain (tobermory [127.0.0.1]) by localhost.localdomain (8.12.10/8.12.10) with ESMTP id mB81apij027171; Sun, 7 Dec 2008 18:36:56 -0700 Received: (from ho@localhost) by localhost.localdomain (8.12.10/8.12.10/Submit) id mB81aN6t027133; Sun, 7 Dec 2008 18:36:23 -0700 Date: Sun, 7 Dec 2008 18:36:23 -0700 Message-Id: <200812080136.mB81aN6t027133@localhost.localdomain> X-Authentication-Warning: localhost.localdomain: ho set sender to hilarie using -f From: "Hilarie Orman" To: secdir@mit.edu, iesg@ietf.org X-XM-SPF: eid=; ; ; mid=; ; ; hst=mx01.mta.xmission.com; ; ; ip=166.70.57.249; ; ; frm=hilarie@purplestreak.com; ; ; spf=none X-XM-DomainKey: sender_domain=alum.mit.edu; ; ; sender=ho@alum.mit.edu; ; ; status=no signature X-SA-Exim-Connect-IP: 166.70.57.249 X-SA-Exim-Mail-From: hilarie@purplestreak.com X-Spam-DCC: XMission; sa01 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;secdir@mit.edu, iesg@ietf.org X-Spam-Relay-Country: X-SA-Exim-Version: 4.2.1 (built Thu, 07 Dec 2006 04:40:56 +0000) X-SA-Exim-Scanned: Yes (on mx01.mta.xmission.com) X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list MIME-Version: 1.0 Cc: rcallon@juniper.net, adrian@olddog.co.uk, rbradfor@cisco.com, jpv@cisco.com, dward@cisco.com Subject: [secdir] Review of draft-ietf-pce-path-05 X-BeenThere: secdir@ietf.org Reply-To: Hilarie Orman List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org draft-ietf-pce-path-key-05.txt Preserving Topology Confidentiality in Inter-Domain Path Computation Using a Key-Based Mechanism I have re-reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other review comments. I still find it needlessly confusing to name the identifiers, which are for the purpose of preserving confidentiality, "keys". This makes the term "path key expansion" especially jarring to security folks. I recommend an editorial change somewhere in the beginning of the document that explicitly distinguishs path-keys from cryptographic keys. A risk that I pointed out in my review of -03, isn't mentioned in "security considerations": There is a possibility of inferring the mapping (encoding) if the opaque identifiers are not chosen randomly or are used for a long time. Passive observers, over time, might be able to guess what the idenifiers mean using information that they obtain independently about network topology and routing patterns. Hilarie _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 7 17:42:37 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D37773A69CA; Sun, 7 Dec 2008 17:42:37 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 725DB3A69CA for ; Sun, 7 Dec 2008 17:42:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.432 X-Spam-Level: X-Spam-Status: No, score=-5.432 tagged_above=-999 required=5 tests=[AWL=1.167, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hSnk2i+sLwAg for ; Sun, 7 Dec 2008 17:42:35 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 8B0FD3A6966 for ; Sun, 7 Dec 2008 17:42:35 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB81gUtb002278 for ; Sun, 7 Dec 2008 20:42:30 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB81gSN3002272 for ; Sun, 7 Dec 2008 20:42:28 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB81gMvt008817 for ; Sun, 7 Dec 2008 20:42:22 -0500 (EST) Received: from out02.mta.xmission.com (out02.mta.xmission.com [166.70.13.232]) by mit.edu (Spam Firewall) with ESMTP id 5A7F91160A45 for ; Sun, 7 Dec 2008 20:42:01 -0500 (EST) Received: from mx03.mta.xmission.com ([166.70.13.213]) by out02.mta.xmission.com with esmtp (Exim 4.62) (envelope-from ) id 1L9V98-0004wD-Uj; Sun, 07 Dec 2008 18:42:50 -0700 Received: from 166-70-57-249.ip.xmission.com ([166.70.57.249] helo=localhost.localdomain) by mx03.mta.xmission.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1L9V7T-0005JS-54; Sun, 07 Dec 2008 18:41:12 -0700 Received: from localhost.localdomain (tobermory [127.0.0.1]) by localhost.localdomain (8.12.10/8.12.10) with ESMTP id mB81cFij027283; Sun, 7 Dec 2008 18:38:20 -0700 Received: (from ho@localhost) by localhost.localdomain (8.12.10/8.12.10/Submit) id mB81bm2G027217; Sun, 7 Dec 2008 18:37:48 -0700 Date: Sun, 7 Dec 2008 18:37:48 -0700 Message-Id: <200812080137.mB81bm2G027217@localhost.localdomain> X-Authentication-Warning: localhost.localdomain: ho set sender to hilarie using -f From: "Hilarie Orman" To: secdir@mit.edu, iesg@ietf.org X-XM-SPF: eid=; ; ; mid=; ; ; hst=mx03.mta.xmission.com; ; ; ip=166.70.57.249; ; ; frm=hilarie@purplestreak.com; ; ; spf=none X-XM-DomainKey: sender_domain=alum.mit.edu; ; ; sender=ho@alum.mit.edu; ; ; status=no signature X-SA-Exim-Connect-IP: 166.70.57.249 X-SA-Exim-Mail-From: hilarie@purplestreak.com X-Spam-DCC: XMission; sa04 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;secdir@mit.edu, iesg@ietf.org X-Spam-Relay-Country: X-SA-Exim-Version: 4.2.1 (built Thu, 07 Dec 2006 04:40:56 +0000) X-SA-Exim-Scanned: Yes (on mx03.mta.xmission.com) X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list MIME-Version: 1.0 Cc: ingemar.s.johansson@ericsson.com, magnus.westerlund@ericsson.com, jon.peterson@neustar.biz, fluffy@cisco.com Subject: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org Reply-To: Hilarie Orman List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Review of draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other review comments. The security section discusses the implications of encrypting only data, not headers, or of turning encryption on and off in the data stream, or authenticating only headers, not data. Although I agree that these are security considerations, I have the feeling that they are only part of a larger story about RTP security, something that is a superset of SRTP. If the considerations cannot be mapped to more closely to an existing protocol, then they might be out of place in this specification. I'm uncertain what is intended by this statement in section 10.2: To authenticate the sender of the audio-stream, an external mechanism MUST be used. At first I thought that it meant that the sender of an audio-stream MUST be authenticated, but on second reading I think it means "if you want to authenticate the sender, you've got to use something not specified in this document." Clarification would help the reader. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 7 22:09:25 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0D9613A6A38; Sun, 7 Dec 2008 22:09:25 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BF1053A6A33 for ; Sun, 7 Dec 2008 22:09:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.494 X-Spam-Level: X-Spam-Status: No, score=-6.494 tagged_above=-999 required=5 tests=[AWL=0.105, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d0Suv-0sGLpQ for ; Sun, 7 Dec 2008 22:09:23 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id BC3303A6A32 for ; Sun, 7 Dec 2008 22:09:22 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB869Hwq010228 for ; Mon, 8 Dec 2008 01:09:17 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB868dUF010074 for ; Mon, 8 Dec 2008 01:08:40 -0500 Received: from mit.edu (M24-004-BARRACUDA-1.MIT.EDU [18.7.7.111]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB867f95009308 for ; Mon, 8 Dec 2008 01:08:33 -0500 (EST) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id DED81CAB333 for ; Mon, 8 Dec 2008 01:07:25 -0500 (EST) X-IronPort-AV: E=Sophos;i="4.33,734,1220227200"; d="scan'208";a="112389576" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-2.cisco.com with ESMTP; 08 Dec 2008 06:07:24 +0000 Received: from sj-core-4.cisco.com (sj-core-4.cisco.com [171.68.223.138]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id mB867Ohh026712; Sun, 7 Dec 2008 22:07:24 -0800 Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-4.cisco.com (8.13.8/8.13.8) with ESMTP id mB867OnK026155; Mon, 8 Dec 2008 06:07:24 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Sun, 7 Dec 2008 22:07:23 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Sun, 7 Dec 2008 22:07:02 -0800 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Secdir review of draft-ietf-mpls-te-scaling-analysis-04 Thread-Index: AclY+zBCxuLBF00oTseBLG3WifsUQQ== From: "Joseph Salowey (jsalowey)" To: , , , X-OriginalArrivalTime: 08 Dec 2008 06:07:23.0972 (UTC) FILETIME=[3CF87040:01C958FB] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=859; t=1228716444; x=1229580444; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20Secdir=20review=20of=20draft-ietf-mpls-te-scali ng-analysis-04 |Sender:=20; bh=37SDua587OyVgKl1zGQHnBhzQrOHMnLL6qOXeFBSQPE=; b=toELH6Wi9sD2CZ5B7hsoq9X9YCBqlcLpLKO8RkO74uouCSNkrfhu+4Ga5K ctNNAoXKXIy+A046g2//iu2QGhK4T4nKVz2M1xPhIcf9sBHpF7xDAV7ZOWvM yOUh0OCuNu; Authentication-Results: sj-dkim-4; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mB868dUF010074 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: [secdir] Secdir review of draft-ietf-mpls-te-scaling-analysis-04 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I did not find any security issues with the document. The security considerations section seems sufficient for this type of document. I would like to ask the authors if the security mechanisms that may be applied in this networks would affect the scaling of the networks. My assumption is that these mechanisms probably would have some effect on scalability, but it would be equal for the various approaches described in the document so there would be no affect on the analysis. Cheers, Joe _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 01:02:30 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CFE23A6A71; Mon, 8 Dec 2008 01:02:30 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2D07B3A6A3A for ; Mon, 8 Dec 2008 01:02:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.355 X-Spam-Level: X-Spam-Status: No, score=-6.355 tagged_above=-999 required=5 tests=[AWL=0.244, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id doItKxJz28dh for ; Mon, 8 Dec 2008 01:02:28 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 1F41A3A6A20 for ; Mon, 8 Dec 2008 01:02:27 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB892MIP003895 for ; Mon, 8 Dec 2008 04:02:22 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB892GOJ003890 for ; Mon, 8 Dec 2008 04:02:16 -0500 Received: from mit.edu (M24-004-BARRACUDA-1.MIT.EDU [18.7.7.111]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB89280W016280 for ; Mon, 8 Dec 2008 04:02:08 -0500 (EST) Received: from mailgw4.ericsson.se (mailgw4.ericsson.se [193.180.251.62]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 5CDF6CA2CF8 for ; Mon, 8 Dec 2008 04:01:50 -0500 (EST) Received: from mailgw4.ericsson.se (unknown [127.0.0.1]) by mailgw4.ericsson.se (Symantec Mail Security) with ESMTP id 9FB7721561; Mon, 8 Dec 2008 09:58:24 +0100 (CET) X-AuditID: c1b4fb3e-acf82bb00000537b-b2-493ce1a6f269 Received: from esealmw126.eemea.ericsson.se (unknown [153.88.254.123]) by mailgw4.ericsson.se (Symantec Mail Security) with ESMTP id B22D2214CB; Mon, 8 Dec 2008 09:58:15 +0100 (CET) Received: from esealmw128.eemea.ericsson.se ([153.88.254.172]) by esealmw126.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Mon, 8 Dec 2008 09:58:05 +0100 Received: from [147.214.183.72] ([147.214.183.72]) by esealmw128.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Mon, 8 Dec 2008 09:58:05 +0100 Message-ID: <493CE19D.3020107@ericsson.com> Date: Mon, 08 Dec 2008 09:58:05 +0100 From: Magnus Westerlund User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Hilarie Orman References: <200812080137.mB81bm2G027217@localhost.localdomain> In-Reply-To: <200812080137.mB81bm2G027217@localhost.localdomain> X-Enigmail-Version: 0.95.7 X-OriginalArrivalTime: 08 Dec 2008 08:58:05.0698 (UTC) FILETIME=[1583CE20:01C95913] X-Brightmail-Tracker: AAAAAA== X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: ingemar.s.johansson@ericsson.com, fluffy@cisco.com, secdir@mit.edu, iesg@ietf.org, jon.peterson@neustar.biz Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hilarie Orman skrev: > Review of draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 > = > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other review comments. > = > The security section discusses the implications of encrypting only > data, not headers, or of turning encryption on and off in the data > stream, or authenticating only headers, not data. Although I agree > that these are security considerations, I have the feeling that they > are only part of a larger story about RTP security, something that is > a superset of SRTP. If the considerations cannot be mapped to more > closely to an existing protocol, then they might be out of place in > this specification. The security for RTP has never been easy due to that it is a framework and used in very many different environments. It is true that there currently are no mechanism that doing security to partial payloads. But we do have SRTP that only encrypts the payload and not the RTP header. Due to that people use different security mechanism and may in worst case go as far as this text implies I think it is of some value of indicating what must be at least confidentiality protected. As a writer of many RTP payload formats and a few other RTP extensions I find it hard to determine what the right level is. Most RTP payload formats have nothing special to consider. The check list is basically: - does it contain scripts? - does it have non-uniform processing? If not, then confidentiality, integrity and source-authentication is the issues and the mechanism we do have works normally works on a payload level, RTP packet level or IP packet level. The AVT WG do have two documents that are related to this discussion. One document trying to explain why SRTP isn't a MUST: http://tools.ietf.org/wg/avt/draft-ietf-avt-srtp-not-mandatory/ The other is the HOW TO guide to write RTP payload formats: http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ Following the later this document goes further than what is recommended there. However, this text was basically published in a previous payload format RFC 4352. Comments on either of documents would be appreciated. But to conclude, I would leave the details in as they are relevant in the larger scope. But I think we should consider if the general recommendations for writing RTP payload formats are correctly scoped. > = > I'm uncertain what is intended by this statement in section 10.2: > = > To authenticate the sender of the audio-stream, an external mechanism > MUST be used. = > = > At first I thought that it meant that the sender of an audio-stream > MUST be authenticated, but on second reading I think it means "if you > want to authenticate the sender, you've got to use something not > specified in this document." Clarification would help the reader. > = Yes, that is the later. And I think removing the upper case MUST will reduced the confusion. But we can also change the sentence to: If authentication of the sender of the audio-stream is needed, an external mechanism must be used. Cullen, can we add an RFC-editor note for the second issue: Section 10.2: OLD: To authenticate the sender of the audio-stream, an external mechanism MUST be used. NEW: If authentication of the sender of the audio-stream is needed, an external mechanism must be used. Cheers Magnus Westerlund IETF Transport Area Director & TSVWG Chair ---------------------------------------------------------------------- Multimedia Technologies, Ericsson Research EAB/TVM ---------------------------------------------------------------------- Ericsson AB | Phone +46 10 7148287 F=E4r=F6gatan 6 | Mobile +46 73 0949079 SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com ---------------------------------------------------------------------- _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 01:12:14 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E23333A6A68; Mon, 8 Dec 2008 01:12:14 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 986863A68C9 for ; Sat, 6 Dec 2008 08:20:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.599 X-Spam-Level: X-Spam-Status: No, score=-8.599 tagged_above=-999 required=5 tests=[AWL=-2.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eD1xpJ3Vzcmz for ; Sat, 6 Dec 2008 08:20:03 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 8D4E93A67FC for ; Sat, 6 Dec 2008 08:20:03 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6GJux4010912 for ; Sat, 6 Dec 2008 11:19:56 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6GJq2h010897 for ; Sat, 6 Dec 2008 11:19:54 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB6GJi4e028873 for ; Sat, 6 Dec 2008 11:19:44 -0500 (EST) Received: from mail.ietf.org (mail.ietf.org [64.170.98.32]) by mit.edu (Spam Firewall) with ESMTP id 153BE114F15A for ; Sat, 6 Dec 2008 11:19:20 -0500 (EST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 016CC3A69AA; Sat, 6 Dec 2008 08:19:24 -0800 (PST) X-Original-To: new-work@core3.amsl.com Delivered-To: new-work@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 98F743A6843 for ; Thu, 4 Dec 2008 11:49:50 -0800 (PST) Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kjfcQhSBvgG3 for ; Thu, 4 Dec 2008 11:49:49 -0800 (PST) Received: from frink.w3.org (frink.w3.org [128.30.52.56]) by core3.amsl.com (Postfix) with ESMTP id C55EC3A689E for ; Thu, 4 Dec 2008 11:49:49 -0800 (PST) Received: from lists by frink.w3.org with local (Exim 4.63) (envelope-from ) id 1L8KCi-0000W6-St for public-new-work-dist@listhub.w3.org; Thu, 04 Dec 2008 19:49:40 +0000 Received: from bart.w3.org ([128.30.52.63]) by frink.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L8KCi-0000VV-1e for public-new-work@listhub.w3.org; Thu, 04 Dec 2008 19:49:40 +0000 Received: from homer.w3.org ([128.30.52.30]) by bart.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L8KCZ-00081f-Bq; Thu, 04 Dec 2008 14:49:39 -0500 Received: from [127.0.0.1] (homer.w3.org [128.30.52.30]) by homer.w3.org (Postfix) with ESMTP id DE6B34F32B; Thu, 4 Dec 2008 14:49:30 -0500 (EST) From: "Ian B. Jacobs" To: public-new-work@w3.org Organization: W3C Date: Thu, 04 Dec 2008 13:47:36 -0600 Message-Id: <1228420056.32042.52.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 X-W3C-Hub-Spam-Status: No, score=-4.4 X-W3C-Hub-Spam-Report: ALL_TRUSTED=-1.8, BAYES_00=-2.599 X-W3C-Scan-Sig: bart.w3.org 1L8KCZ-00081f-Bq 4cdff2d0fef99a6658b5193c7f1fd3f1 X-Original-To: public-new-work@w3.org Archived-At: Resent-From: public-new-work@w3.org X-Mailing-List: archive/latest/35 X-Loop: public-new-work@w3.org Resent-Sender: public-new-work-request@w3.org Precedence: list Resent-Message-Id: Resent-Date: Thu, 04 Dec 2008 19:49:40 +0000 X-Mailman-Approved-At: Sat, 06 Dec 2008 08:19:22 -0800 X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.9 X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from base64 to 8bit by pch.mit.edu id mB6GJq2h010897 X-BeenThere: secdir@mit.edu X-Mailman-Approved-At: Mon, 08 Dec 2008 01:12:13 -0800 Subject: [secdir] [New-work] Proposed W3C Charter: Mobile Web Initiative Test Suites Working Group (until 2008-12-31) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org CkhlbGxvLAoKVG9kYXkgVzNDIEFkdmlzb3J5IENvbW1pdHRlZSBSZXByZXNlbnRhdGl2ZXMgcmVj ZWl2ZWQgYSBQcm9wb3NhbAp0byByZXZpc2UgdGhlIE1vYmlsZSBXZWIgSW5pdGlhdGl2ZSBbMF0g KHNlZSB0aGUgVzNDIFByb2Nlc3MKRG9jdW1lbnQgZGVzY3JpcHRpb24gb2YgQWN0aXZpdHkgUHJv cG9zYWxzIFsxXSkuIFRoaXMgcHJvcG9zYWwKaW5jbHVkZXMgYSBkcmFmdCByZXZpc2VkIGNoYXJ0 ZXIgZm9yIHRoZSBNb2JpbGUgV2ViIEluaXRpYXRpdmUgClRlc3QgU3VpdGVzIFdvcmtpbmcgR3Jv dXA6CiAgaHR0cDovL3d3dy53My5vcmcvMjAwOC8xMS9td2ktdGVzdC1jaGFydGVyLmh0bWwKCkFz IHBhcnQgb2YgZW5zdXJpbmcgdGhhdCB0aGUgY29tbXVuaXR5IGlzIGF3YXJlIG9mIHByb3Bvc2Vk IHdvcmsKYXQgVzNDLCB0aGlzIGRyYWZ0IGNoYXJ0ZXIgaXMgcHVibGljIGR1cmluZyB0aGUgQWR2 aXNvcnkKQ29tbWl0dGVlIHJldmlldyBwZXJpb2QuCgpXM0MgaW52aXRlcyBwdWJsaWMgY29tbWVu dHMgdGhyb3VnaCAyMDA4LTEyLTMxIG9uIHRoZQpwcm9wb3NlZCBjaGFydGVyLiBQbGVhc2Ugc2Vu ZCBjb21tZW50cyB0bwpwdWJsaWMtbmV3LXdvcmtAdzMub3JnLCB3aGljaCBoYXMgYSBwdWJsaWMg YXJjaGl2ZToKICBodHRwOi8vbGlzdHMudzMub3JnL0FyY2hpdmVzL1B1YmxpYy9wdWJsaWMtbmV3 LXdvcmsvCgpPdGhlciB0aGFuIGNvbW1lbnRzIHNlbnQgaW4gZm9ybWFsIHJlc3BvbnNlcyBieSBX M0MgQWR2aXNvcnkKQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcywgVzNDIGNhbm5vdCBndWFyYW50 ZWUgYSByZXNwb25zZSB0bwpjb21tZW50cy4gSWYgeW91IHdvcmsgZm9yIGEgVzNDIE1lbWJlciBb Ml0sIHBsZWFzZSBjb29yZGluYXRlCnlvdXIgY29tbWVudHMgd2l0aCB5b3VyIEFkdmlzb3J5IENv bW1pdHRlZSBSZXByZXNlbnRhdGl2ZS4gRm9yCmV4YW1wbGUsIHlvdSBtYXkgd2lzaCB0byBtYWtl IHB1YmxpYyBjb21tZW50cyB2aWEgdGhpcyBsaXN0IGFuZApoYXZlIHlvdXIgQWR2aXNvcnkgQ29t bWl0dGVlIFJlcHJlc2VudGF0aXZlIHJlZmVyIHRvIGl0IGZyb20gaGlzCm9yIGhlciBmb3JtYWwg cmV2aWV3IGNvbW1lbnRzLgoKSWYgeW91IHNob3VsZCBoYXZlIGFueSBxdWVzdGlvbnMgb3IgbmVl ZCBmdXJ0aGVyIGluZm9ybWF0aW9uLCBwbGVhc2UKY29udGFjdCBEb21pbmlxdWUgSGF6YcOrbC1N YXNzaWV1eCwgY28tQ2hhaXIgPGRvbUB3My5vcmc+LgoKVGhhbmsgeW91LAoKSWFuIEphY29icywg SGVhZCBvZiBXM0MgQ29tbXVuaWNhdGlvbnMKClswXSBodHRwOi8vd3d3LnczLm9yZy9Nb2JpbGUv ClsxXQpodHRwOi8vd3d3LnczLm9yZy8yMDA1LzEwL1Byb2Nlc3MtMjAwNTEwMTQvYWN0aXZpdGll cyNBY3Rpdml0eUNyZWF0aW9uClsyXSBodHRwOi8vd3d3LnczLm9yZy9Db25zb3J0aXVtL01lbWJl ci9MaXN0Ci0tIApJYW4gSmFjb2JzIChpakB3My5vcmcpICAgaHR0cDovL3d3dy53My5vcmcvUGVv cGxlL0phY29icy8KVGVsOiAgICAgICAgICAgICAgICAgICAgICsxIDcxOCAyNjAtOTQ0NwoKCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5ldy13b3JrIG1h aWxpbmcgbGlzdApOZXctd29ya0BpZXRmLm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL25ldy13b3JrCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXwpzZWNkaXIgbWFpbGluZyBsaXN0CnNlY2RpckBtaXQuZWR1Cmh0dHBzOi8vbWFp bG1hbi5taXQuZWR1L21haWxtYW4vbGlzdGluZm8vc2VjZGlyCl9fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fCnNlY2RpciBtYWlsaW5nIGxpc3QKc2VjZGlyQGll dGYub3JnCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc2VjZGlyCg== From secdir-bounces@ietf.org Mon Dec 8 01:12:14 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EFD6B3A6A75; Mon, 8 Dec 2008 01:12:14 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6E2963A69AA for ; Sat, 6 Dec 2008 08:20:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.099 X-Spam-Level: X-Spam-Status: No, score=-8.099 tagged_above=-999 required=5 tests=[AWL=-1.500, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f+C148GcVG7s for ; Sat, 6 Dec 2008 08:20:06 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id EFB773A67FC for ; Sat, 6 Dec 2008 08:20:05 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6GJu1l010915 for ; Sat, 6 Dec 2008 11:19:56 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6GJq1C010898 for ; Sat, 6 Dec 2008 11:19:54 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB6GJhRJ028872 for ; Sat, 6 Dec 2008 11:19:44 -0500 (EST) Received: from mail.ietf.org (mail.ietf.org [64.170.98.32]) by mit.edu (Spam Firewall) with ESMTP id 28CAD128FF0C for ; Sat, 6 Dec 2008 11:19:20 -0500 (EST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1C533A67FC; Sat, 6 Dec 2008 08:19:23 -0800 (PST) X-Original-To: new-work@core3.amsl.com Delivered-To: new-work@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9F3DD3A67FD for ; Mon, 1 Dec 2008 15:06:49 -0800 (PST) Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uDBQkqaMHp5v for ; Mon, 1 Dec 2008 15:06:48 -0800 (PST) Received: from frink.w3.org (frink.w3.org [128.30.52.56]) by core3.amsl.com (Postfix) with ESMTP id CB0BF3A67AD for ; Mon, 1 Dec 2008 15:06:48 -0800 (PST) Received: from lists by frink.w3.org with local (Exim 4.63) (envelope-from ) id 1L7Hqh-0001VS-Vi for public-new-work-dist@listhub.w3.org; Mon, 01 Dec 2008 23:06:40 +0000 Received: from bart.w3.org ([128.30.52.63]) by frink.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L7Hqg-0001Ur-Cr for public-new-work@listhub.w3.org; Mon, 01 Dec 2008 23:06:38 +0000 Received: from homer.w3.org ([128.30.52.30]) by bart.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L7HqY-0001QN-43; Mon, 01 Dec 2008 18:06:38 -0500 Received: from [127.0.0.1] (homer.w3.org [128.30.52.30]) by homer.w3.org (Postfix) with ESMTP id C99684F13C; Mon, 1 Dec 2008 18:06:29 -0500 (EST) From: "Ian B. Jacobs" To: public-new-work@w3.org Organization: W3C Date: Mon, 01 Dec 2008 17:04:52 -0600 Message-Id: <1228172692.9857.44.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 X-W3C-Hub-Spam-Status: No, score=-4.4 X-W3C-Hub-Spam-Report: ALL_TRUSTED=-1.8, BAYES_00=-2.599 X-W3C-Scan-Sig: bart.w3.org 1L7HqY-0001QN-43 5c0892e3b359f82de53fc091799c86be X-Original-To: public-new-work@w3.org Archived-At: Resent-From: public-new-work@w3.org X-Mailing-List: archive/latest/33 X-Loop: public-new-work@w3.org Resent-Sender: public-new-work-request@w3.org Precedence: list Resent-Message-Id: Resent-Date: Mon, 01 Dec 2008 23:06:39 +0000 X-Mailman-Approved-At: Sat, 06 Dec 2008 08:19:22 -0800 X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.9 X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Approved-At: Mon, 08 Dec 2008 01:12:13 -0800 Subject: [secdir] [New-work] Proposed W3C Charter: RDF Data Access Working Group (until 2008-01-15) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hello, Today W3C Advisory Committee Representatives received a Proposal to revise the Semantic Web Activity [0] (see the W3C Process Document description of Activity Proposals [1]). This proposal includes a draft charter for the RDF Data Access Working Group: http://www.w3.org/2008/09/dawg-charter.html As part of ensuring that the community is aware of proposed work at W3C, this draft charter is public during the Advisory Committee review period. W3C invites public comments through 2008-01-15 on the proposed charter. Please send comments to public-new-work@w3.org, which has a public archive: http://lists.w3.org/Archives/Public/public-new-work/ Other than comments sent in formal responses by W3C Advisory Committee Representatives, W3C cannot guarantee a response to comments. If you work for a W3C Member [2], please coordinate your comments with your Advisory Committee Representative. For example, you may wish to make public comments via this list and have your Advisory Committee Representative refer to it from his or her formal review comments. If you should have any questions or need further information, please contact Ivan Herman, Semantic Web Activity Lead . Thank you, Ian Jacobs, Head of W3C Communications [0] http://www.w3.org/2001/sw/ [1] http://www.w3.org/2005/10/Process-20051014/activities#ActivityCreation [2] http://www.w3.org/Consortium/Member/List -- Ian Jacobs (ij@w3.org) http://www.w3.org/People/Jacobs/ Tel: +1 718 260-9447 _______________________________________________ New-work mailing list New-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 01:12:15 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 073D33A6A79; Mon, 8 Dec 2008 01:12:15 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BC3B03A697D for ; Sat, 6 Dec 2008 08:25:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.799 X-Spam-Level: X-Spam-Status: No, score=-7.799 tagged_above=-999 required=5 tests=[AWL=-1.200, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vMkgiiNNkRkT for ; Sat, 6 Dec 2008 08:25:38 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id AEBD93A6923 for ; Sat, 6 Dec 2008 08:25:38 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6GJuvu010922 for ; Sat, 6 Dec 2008 11:19:56 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6GJt1o010906 for ; Sat, 6 Dec 2008 11:19:55 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB6GJltw028946 for ; Sat, 6 Dec 2008 11:19:47 -0500 (EST) Received: from mail.ietf.org (mail.ietf.org [64.170.98.32]) by mit.edu (Spam Firewall) with ESMTP id 2794E13FFF91 for ; Sat, 6 Dec 2008 11:19:20 -0500 (EST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E68003A6923; Sat, 6 Dec 2008 08:19:23 -0800 (PST) X-Original-To: new-work@core3.amsl.com Delivered-To: new-work@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 21EEE28C11D for ; Mon, 1 Dec 2008 15:10:34 -0800 (PST) Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3y8oqazRwwkU for ; Mon, 1 Dec 2008 15:10:33 -0800 (PST) Received: from frink.w3.org (frink.w3.org [128.30.52.56]) by core3.amsl.com (Postfix) with ESMTP id 0C5943A69C7 for ; Mon, 1 Dec 2008 15:10:33 -0800 (PST) Received: from lists by frink.w3.org with local (Exim 4.63) (envelope-from ) id 1L7HuO-0002bz-UI for public-new-work-dist@listhub.w3.org; Mon, 01 Dec 2008 23:10:28 +0000 Received: from bart.w3.org ([128.30.52.63]) by frink.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L7HuN-0002bC-Vl for public-new-work@listhub.w3.org; Mon, 01 Dec 2008 23:10:28 +0000 Received: from homer.w3.org ([128.30.52.30]) by bart.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L7HuF-0001jf-N4; Mon, 01 Dec 2008 18:10:27 -0500 Received: from [127.0.0.1] (homer.w3.org [128.30.52.30]) by homer.w3.org (Postfix) with ESMTP id 793814EEE3; Mon, 1 Dec 2008 18:10:19 -0500 (EST) From: "Ian B. Jacobs" To: public-new-work@w3.org In-Reply-To: <1228172692.9857.44.camel@localhost> References: <1228172692.9857.44.camel@localhost> Organization: W3C Date: Mon, 01 Dec 2008 17:08:41 -0600 Message-Id: <1228172921.9857.50.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 X-W3C-Hub-Spam-Status: No, score=-4.4 X-W3C-Hub-Spam-Report: ALL_TRUSTED=-1.8, BAYES_00=-2.599 X-W3C-Scan-Sig: bart.w3.org 1L7HuF-0001jf-N4 ed4e47f63877a1edac48ba057c9d71cb X-Original-To: public-new-work@w3.org Archived-At: Resent-From: public-new-work@w3.org X-Mailing-List: archive/latest/34 X-Loop: public-new-work@w3.org Resent-Sender: public-new-work-request@w3.org Precedence: list Resent-Message-Id: Resent-Date: Mon, 01 Dec 2008 23:10:28 +0000 X-Mailman-Approved-At: Sat, 06 Dec 2008 08:19:22 -0800 X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.9 X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Approved-At: Mon, 08 Dec 2008 01:12:13 -0800 Subject: [secdir] [New-work] Correction: until 2009-01-15 [Was: Proposed W3C Charter: RDF Data Access Working Group (until 2008-01-15)] X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Mon, 2008-12-01 at 17:04 -0600, Ian B. Jacobs wrote: > Hello, > > Today W3C Advisory Committee Representatives received a Proposal > to revise the Semantic Web Activity [0] (see the W3C Process > Document description of Activity Proposals [1]). This proposal > includes a draft charter for the RDF Data Access Working Group: > http://www.w3.org/2008/09/dawg-charter.html > > As part of ensuring that the community is aware of proposed work > at W3C, this draft charter is public during the Advisory > Committee review period. > > W3C invites public comments through 2008-01-15 That's 2009-01-15. Sorry! _ Ian > on the > proposed charter. Please send comments to > public-new-work@w3.org, which has a public archive: > http://lists.w3.org/Archives/Public/public-new-work/ > > Other than comments sent in formal responses by W3C Advisory > Committee Representatives, W3C cannot guarantee a response to > comments. If you work for a W3C Member [2], please coordinate > your comments with your Advisory Committee Representative. For > example, you may wish to make public comments via this list and > have your Advisory Committee Representative refer to it from his > or her formal review comments. > > If you should have any questions or need further information, please > contact Ivan Herman, Semantic Web Activity Lead . > > Thank you, > > Ian Jacobs, Head of W3C Communications > > [0] http://www.w3.org/2001/sw/ > [1] > http://www.w3.org/2005/10/Process-20051014/activities#ActivityCreation > [2] http://www.w3.org/Consortium/Member/List > > -- Ian Jacobs (ij@w3.org) http://www.w3.org/People/Jacobs/ Tel: +1 718 260-9447 _______________________________________________ New-work mailing list New-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 01:12:15 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 11C843A6A7D; Mon, 8 Dec 2008 01:12:15 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B335E3A69C0 for ; Sat, 6 Dec 2008 14:46:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=2.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5AYbLmpccFBe for ; Sat, 6 Dec 2008 14:46:26 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id CB6D43A6958 for ; Sat, 6 Dec 2008 14:46:25 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6MkKIh003756 for ; Sat, 6 Dec 2008 17:46:20 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB6MkG5k003747 for ; Sat, 6 Dec 2008 17:46:16 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB6Mk9d7008021 for ; Sat, 6 Dec 2008 17:46:10 -0500 (EST) Received: from post.tau.ac.il (post1.tau.ac.il [132.66.3.220]) by mit.edu (Spam Firewall) with ESMTP id E7C37116C309 for ; Sat, 6 Dec 2008 17:45:48 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by post.tau.ac.il (Postfix) with ESMTP id AFA02BCC629; Sat, 6 Dec 2008 22:45:47 +0000 (UTC) Received: from post.tau.ac.il ([127.0.0.1]) by localhost (post1.tau.ac.il [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mpBDPordL64y; Sun, 7 Dec 2008 00:45:47 +0200 (IST) Received: from cs.tau.ac.il (anna.cs.tau.ac.il [132.67.192.229]) by post.tau.ac.il (Postfix) with ESMTP id 96026BCC627; Sun, 7 Dec 2008 00:45:47 +0200 (IST) Received: from localhost.localdomain (nova.cs.tau.ac.il [132.67.192.133]) by cs.tau.ac.il (Postfix) with ESMTP id 8B1AF16C762E; Sun, 7 Dec 2008 00:45:47 +0200 (IST) Received: by localhost.localdomain (Postfix, from userid 3106) id 4D8251587A10; Sun, 7 Dec 2008 00:45:47 +0200 (IST) Received: from localhost (localhost [127.0.0.1]) by localhost.localdomain (Postfix) with ESMTP id 49B8CCD39E6; Sun, 7 Dec 2008 00:45:47 +0200 (IST) Date: Sun, 7 Dec 2008 00:45:47 +0200 (IST) From: Ran Canetti X-X-Sender: canetti@nova.cs.tau.ac.il To: Ran Canetti In-Reply-To: Message-ID: References: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list X-Mailman-Approved-At: Mon, 08 Dec 2008 01:12:13 -0800 Cc: kitten@ietf.org, secdir@mit.edu Subject: [secdir] Security review of draft-ietf-kitten-gssapi-channel-bindings-05 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org *I have reviewed these documents as part of the security directorate's *ongoing effort to review all IETF documents being processed by the *IESG. These comments were written primarily for the benefit of the *security area directors. Document editors and WG chairs should treat *these comments just like any other last call comments. The document appears to be a straightforward spefication of interface format for channel binding information GSS API. I didnt see any security implications here. Best, Ran _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 01:29:59 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F3BE63A6A6E; Mon, 8 Dec 2008 01:29:58 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 53B5D3A6A6E for ; Mon, 8 Dec 2008 01:29:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[AWL=2.297, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c0f8Pd5QAwe5 for ; Mon, 8 Dec 2008 01:29:57 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 7011F3A69E9 for ; Mon, 8 Dec 2008 01:29:57 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB89Tqhx008256 for ; Mon, 8 Dec 2008 04:29:52 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB89Tkks008235 for ; Mon, 8 Dec 2008 04:29:46 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB89TdeE017887 for ; Mon, 8 Dec 2008 04:29:39 -0500 (EST) Received: from protext01.itu.ch (protext01.itu.ch [156.106.192.41]) by mit.edu (Spam Firewall) with ESMTP id D4FE01161DCC for ; Mon, 8 Dec 2008 04:29:18 -0500 (EST) Received: from protext01.itu.ch ([156.106.192.41]) by protext01.itu.ch with Microsoft SMTPSVC(5.0.2195.6713); Mon, 8 Dec 2008 10:29:16 +0100 Received: From mail6.itu.ch ([156.106.192.22]) by protext01.itu.ch (WebShield SMTP v4.5 MR3) id 1228728556117; Mon, 8 Dec 2008 10:29:16 +0100 Received: from your029b8cecfe ([156.106.216.154]) by mail6.itu.ch (8.14.3/8.14.3) with ESMTP id mB89SjiY488136; Mon, 8 Dec 2008 10:28:49 +0100 (MET) Message-ID: <60E51D5A0EA2411F8FFF26FA1CFDFA78@your029b8cecfe> From: "Adrian Farrel" To: "Hilarie Orman" , , References: <200812080136.mB81aN6t027133@localhost.localdomain> Date: Mon, 8 Dec 2008 09:28:39 -0000 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.5512 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (mail6.itu.ch [156.106.192.22]); Mon, 08 Dec 2008 10:29:15 +0100 (MET) X-OriginalArrivalTime: 08 Dec 2008 09:29:16.0679 (UTC) FILETIME=[70B4D970:01C95917] X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: rcallon@juniper.net, rbradfor@cisco.com, jpv@cisco.com, dward@cisco.com Subject: Re: [secdir] Review of draft-ietf-pce-path-05 X-BeenThere: secdir@ietf.org Reply-To: Adrian Farrel List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi Hilarie, We did see your comments previously, but since they were primarily for the security ADs, we did not respond at that time. > I still find it needlessly confusing to name the identifiers, which > are for the purpose of preserving confidentiality, "keys". This makes > the term "path key expansion" especially jarring to security folks. I > recommend an editorial change somewhere in the beginning of the > document that explicitly distinguishs path-keys from cryptographic > keys. We can add a sentence to make this clearer for people who might make this assumption. How about... Please note that the terms "path key" and "key" used in this document refer to an identifier allocated by a PCE to represent a segment of a computed path. The terms have no relation to the term "cryptographic key" used in some documents that describe security issues. > A risk that I pointed out in my review of -03, isn't mentioned in > "security considerations": There is a possibility of inferring the > mapping (encoding) if the opaque identifiers are not chosen randomly > or are used for a long time. Passive observers, over time, might be > able to guess what the idenifiers mean using information that they > obtain independently about network topology and routing patterns. We do not consider that there is any inference that can be drawn except that a passive observer might learn how to count! A reasonable implementation would simply allocate path keys as monotonic increasing index values. We could write some apple pie here, but honestly, it is hard to think of a way to write an implementation where the path key would have any semantic outside a lookup value. We already have text that allows an implementer to understand how to verify that the node requesting a path key expansion is the node expected to make such a request, so trawling for an expansion requires source address spoofing in a way that scales as badly as the number of nodes that might need to request expansions. (Such trawling would also require that PCEP security was not enabled.) Cheers, Adrian _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 05:06:38 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E79763A6A9D; Mon, 8 Dec 2008 05:06:38 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B2A963A6A9D for ; Mon, 8 Dec 2008 05:06:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.034 X-Spam-Level: X-Spam-Status: No, score=-4.034 tagged_above=-999 required=5 tests=[AWL=2.565, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U+T7qbHg9iuX for ; Mon, 8 Dec 2008 05:06:37 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 65BC53A68FC for ; Mon, 8 Dec 2008 05:06:35 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8D6TOd010518 for ; Mon, 8 Dec 2008 08:06:29 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8D6PPL010465 for ; Mon, 8 Dec 2008 08:06:25 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB8D6Kue024558 for ; Mon, 8 Dec 2008 08:06:20 -0500 (EST) Received: from scygmxsecs1.cygnacom.com (scygmxsecs1.cygnacom.com [65.242.48.253]) by mit.edu (Spam Firewall) with SMTP id 1C2B5140A2AE for ; Mon, 8 Dec 2008 08:05:59 -0500 (EST) Received: (qmail 24853 invoked from network); 8 Dec 2008 13:05:27 -0000 Received: from CWallace@cygnacom.com by scygmxsecs1.cygnacom.com with EntrustECS-Server-7.4; 08 Dec 2008 13:05:27 -0000 Received: from unknown (HELO scygexch1.cygnacom.com) (10.60.50.8) by scygmxsecs1.cygnacom.com with SMTP; 8 Dec 2008 13:05:27 -0000 Content-class: urn:content-classes:message MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft Exchange V6.5 Date: Mon, 8 Dec 2008 08:05:57 -0500 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Secdir review of draft-melnikov-imapext-filters-07 thread-index: AclZNbXD+94yY8PgQUqxPDIhmVTigw== From: "Carl Wallace" To: , X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mB8D6PPL010465 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: secdir@mit.edu, iesg@ietf.org Subject: [secdir] Secdir review of draft-melnikov-imapext-filters-07 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft defines how to store named search filters on an IMAP server. The draft is well written and the security considerations section looks good to me. A few minor comments: In section 2, "if both filter type with the same exist" should be "if both filter types with the same name exist". In the same sentence, "is going to use" should probably be "MUST use". In the example in section 3.1, "OR" is missing from the example where the value of the filter has been substituted into the command. Should the server check the syntax of the filter before storing? The fourth paragraph of section 3.2 gives the impression that any "non NIL value" may be stored. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 05:08:55 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 11C4C3A6A9D; Mon, 8 Dec 2008 05:08:55 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E1A13A6A9D for ; Mon, 8 Dec 2008 05:08:54 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.316 X-Spam-Level: X-Spam-Status: No, score=-5.316 tagged_above=-999 required=5 tests=[AWL=1.283, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3KG4mmPzHKlU for ; Mon, 8 Dec 2008 05:08:53 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 2C3663A6A9A for ; Mon, 8 Dec 2008 05:08:53 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8D6T5b010526 for ; Mon, 8 Dec 2008 08:06:29 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8D6PQW010466 for ; Mon, 8 Dec 2008 08:06:25 -0500 Received: from mit.edu (W92-130-BARRACUDA-1.MIT.EDU [18.7.21.220]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB8D6KJN010082 for ; Mon, 8 Dec 2008 08:06:20 -0500 (EST) Received: from scygmxsecs1.cygnacom.com (scygmxsecs1.cygnacom.com [65.242.48.253]) by mit.edu (Spam Firewall) with SMTP id 348DDCB772E for ; Mon, 8 Dec 2008 08:05:59 -0500 (EST) Received: (qmail 24842 invoked from network); 8 Dec 2008 13:05:24 -0000 Received: from CWallace@cygnacom.com by scygmxsecs1.cygnacom.com with EntrustECS-Server-7.4; 08 Dec 2008 13:05:24 -0000 Received: from unknown (HELO scygexch1.cygnacom.com) (10.60.50.8) by scygmxsecs1.cygnacom.com with SMTP; 8 Dec 2008 13:05:24 -0000 Content-class: urn:content-classes:message MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft Exchange V6.5 Date: Mon, 8 Dec 2008 08:05:55 -0500 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Secdir review of draft-ietf-isis-hmac-sha-07 thread-index: AclZNbRUlz6A5kSHR+6c43NN8ASikA== From: "Carl Wallace" To: , , , , X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mB8D6PQW010466 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: secdir@mit.edu, iesg@ietf.org Subject: [secdir] Secdir review of draft-ietf-isis-hmac-sha-07 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft defines a new authentication type for IS IS and describes how to use HMAC-SHAx with this authentication type. The draft is well written and the security considerations section looks good to me. A few minor comments: The definition of Authentication Key in section 2 states that the length of the key "depends upon the authentication algorithm". Section 3.3 describes how to prepare keys of various lengths, allowing the length of the key to vary independent of the algorithm. Given RFC5304, is MD5 allowed or disallowed with this authentication type? Seems like the doc should state one way or another. Section 3.3 items (2) and (3) might benefit from clarifying that Ko is padded with zeroes to be B bytes in length and that || means concatenate. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 09:21:25 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7D61C28C114; Mon, 8 Dec 2008 09:21:25 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2DBDD28B23E for ; Mon, 8 Dec 2008 09:21:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.523 X-Spam-Level: X-Spam-Status: No, score=-104.523 tagged_above=-999 required=5 tests=[AWL=2.076, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DPI-xg+IVR-t for ; Mon, 8 Dec 2008 09:21:23 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 3FA9728C11F for ; Mon, 8 Dec 2008 09:21:22 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8HLGd8011334 for ; Mon, 8 Dec 2008 12:21:16 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8HLDO7011313 for ; Mon, 8 Dec 2008 12:21:13 -0500 Received: from mit.edu (M24-004-BARRACUDA-1.MIT.EDU [18.7.7.111]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB8HL8ZU016960 for ; Mon, 8 Dec 2008 12:21:08 -0500 (EST) Received: from woodstock.binhost.com (woodstock.binhost.com [8.8.40.152]) by mit.edu (Spam Firewall) with SMTP id E2082C8B12E for ; Mon, 8 Dec 2008 12:20:51 -0500 (EST) Received: (qmail 8414 invoked by uid 0); 8 Dec 2008 17:20:47 -0000 Received: from unknown (HELO THINKPADR52.vigilsec.com) (96.255.143.189) by woodstock.binhost.com with SMTP; 8 Dec 2008 17:20:47 -0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 08 Dec 2008 12:20:48 -0500 To: Adrian Farrel , "Hilarie Orman" , , From: Russ Housley In-Reply-To: <60E51D5A0EA2411F8FFF26FA1CFDFA78@your029b8cecfe> References: <200812080136.mB81aN6t027133@localhost.localdomain> <60E51D5A0EA2411F8FFF26FA1CFDFA78@your029b8cecfe> Mime-Version: 1.0 Message-Id: <20081208172051.E2082C8B12E@mit.edu> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: rcallon@juniper.net, rbradfor@cisco.com, jpv@cisco.com, dward@cisco.com Subject: Re: [secdir] Review of draft-ietf-pce-path-05 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org >Please note that the terms "path key" and "key" used in this >document refer to an identifier allocated by a PCE to represent a >segment of a computed path. The terms have no relation to the term >"cryptographic key" used in some documents that describe security issues. s/issues/mechanisms/ _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 09:21:26 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 90E0628C122; Mon, 8 Dec 2008 09:21:26 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DC61928C120 for ; Mon, 8 Dec 2008 09:21:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.566 X-Spam-Level: X-Spam-Status: No, score=-104.566 tagged_above=-999 required=5 tests=[AWL=2.033, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uy1RFk53yAHP for ; Mon, 8 Dec 2008 09:21:25 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id A389828B23E for ; Mon, 8 Dec 2008 09:21:24 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8HLJEq011352 for ; Mon, 8 Dec 2008 12:21:19 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8HLI0M011349 for ; Mon, 8 Dec 2008 12:21:18 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB8HLCR0011053 for ; Mon, 8 Dec 2008 12:21:12 -0500 (EST) Received: from woodstock.binhost.com (woodstock.binhost.com [8.8.40.152]) by mit.edu (Spam Firewall) with SMTP id D77BC1402DA3 for ; Mon, 8 Dec 2008 12:20:51 -0500 (EST) Received: (qmail 8406 invoked by uid 0); 8 Dec 2008 17:20:47 -0000 Received: from unknown (HELO THINKPADR52.vigilsec.com) (96.255.143.189) by woodstock.binhost.com with SMTP; 8 Dec 2008 17:20:47 -0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Mon, 08 Dec 2008 12:18:25 -0500 To: Magnus Westerlund , Hilarie Orman From: Russ Housley In-Reply-To: <493CE19D.3020107@ericsson.com> References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> Mime-Version: 1.0 Message-Id: <20081208172051.D77BC1402DA3@mit.edu> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: ingemar.s.johansson@ericsson.com, fluffy@cisco.com, secdir@mit.edu, iesg@ietf.org, jon.peterson@neustar.biz Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I do not see this as a complete solution. I'd like to see a bit of discussion about where this mechanism is defined. Is there an example of a media stream format that includes authentication? Russ At 03:58 AM 12/8/2008, Magnus Westerlund wrote: >If authentication of the sender of the audio-stream is needed, an >external mechanism must be used. > >Cullen, can we add an RFC-editor note for the second issue: > >Section 10.2: >OLD: > To authenticate the sender of the audio-stream, an external mechanism > MUST be used. > >NEW: >If authentication of the sender of the audio-stream is needed, an >external mechanism must be used. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 11:02:19 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F176028C167; Mon, 8 Dec 2008 11:02:18 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C3E6128C155; Mon, 8 Dec 2008 11:02:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.046 X-Spam-Level: X-Spam-Status: No, score=-6.046 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sZ4Zm5oo1tQ1; Mon, 8 Dec 2008 11:02:17 -0800 (PST) Received: from brmea-mail-1.sun.com (brmea-mail-1.Sun.COM [192.18.98.31]) by core3.amsl.com (Postfix) with ESMTP id C6C3428C12D; Mon, 8 Dec 2008 11:02:16 -0800 (PST) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mB8J2Bcd011507; Mon, 8 Dec 2008 19:02:11 GMT Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0KBK00D01MGXJL00@mail-amer.sun.com> (original mail from Shawn.Emery@Sun.COM); Mon, 08 Dec 2008 12:02:11 -0700 (MST) Received: from shawn-emerys-computer.local ([129.150.36.101]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KBK00GVWNJHYI30@mail-amer.sun.com>; Mon, 08 Dec 2008 12:02:05 -0700 (MST) Date: Mon, 08 Dec 2008 11:57:28 -0700 From: "Shawn M. Emery" To: secdir@ietf.org Message-id: <493D6E18.7010701@sun.com> MIME-version: 1.0 User-Agent: Thunderbird 2.0.0.18 (Macintosh/20081105) Cc: nfsv4-chairs@tools.ietf.org, iesg@ietf.org, draft-ietf-nfsv4-rfc1831bis@tools.ietf.org Subject: [secdir] Review of draft-ietf-nfsv4-rfc1831bis-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft describes clarifications to the the Remote Procedure Call (RPC) Version 2 protocol. The draft does not specify any change of bits over-the-wire, but rather clarifies aspects for IANA registry, implementation, and authentication. The security consideration section does exist and discusses recommendations on which security flavors should be used according to the service in question. I think that this is sufficient for this particular draft and that the informative reference discusses the security implications for the respective security flavors. I'm not suggesting to address this here, not by any means, but verifiers could also be useful in some cases in reply messages that are not accepted by the server. This is useful when preventing a DoS attack on clients. It would be up to the GSS mechanism to determine how to do this if at all possible. Editorial comment(s): s/them in future/them in the future/ s/minimum, the/a minimum, the/ s/in future/in the future/ s/to used on/to be used on/ Shawn. -- _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 11:24:28 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2CD0428C15C; Mon, 8 Dec 2008 11:24:28 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD6D628C15C for ; Mon, 8 Dec 2008 11:24:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.299 X-Spam-Level: X-Spam-Status: No, score=-5.299 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EnY845JTwoSx for ; Mon, 8 Dec 2008 11:24:26 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id E566028C14E for ; Mon, 8 Dec 2008 11:24:25 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8JOI1m003179 for ; Mon, 8 Dec 2008 14:24:20 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8JOEGF003160 for ; Mon, 8 Dec 2008 14:24:14 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB8JO6bt002671 for ; Mon, 8 Dec 2008 14:24:07 -0500 (EST) X-ASG-Whitelist: Barracuda Reputation Received: from mail-out4.apple.com (mail-out4.apple.com [17.254.13.23]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id BCB9C112C726 for ; Mon, 8 Dec 2008 14:23:06 -0500 (EST) Received: from relay12.apple.com (relay12.apple.com [17.128.113.53]) by mail-out4.apple.com (Postfix) with ESMTP id D7BA749D3AC0 for ; Mon, 8 Dec 2008 11:23:05 -0800 (PST) Received: from relay12.apple.com (unknown [127.0.0.1]) by relay12.apple.com (Symantec Brightmail Gateway) with ESMTP id C3B0D464002 for ; Mon, 8 Dec 2008 11:23:05 -0800 (PST) X-AuditID: 11807135-a6857bb000000e1f-19-493d74197a8d Received: from gertie.apple.com (gertie.apple.com [17.151.62.15]) by relay12.apple.com (Apple SCV relay) with ESMTP id AE3C8420002 for ; Mon, 8 Dec 2008 11:23:05 -0800 (PST) Received: from nutcracker.apple.com (nutcracker.apple.com [17.202.45.101]) by ifon.apple.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0KBK001CXOIHZ100@ifon.apple.com> for secdir@mit.edu; Mon, 08 Dec 2008 11:23:05 -0800 (PST) Date: Mon, 08 Dec 2008 11:23:02 -0800 From: =?iso-8859-1?Q?Love_H=F6rnquist_=C5strand?= To: Security-Directorat Directorat Message-id: <4460B9AC-2DDF-44B5-9F2D-49F6C3564A4D@kth.se> MIME-version: 1.0 X-Mailer: Apple Mail (2.1037.1) X-Brightmail-Tracker: AAAAAA== X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: tcpm-chairs@tools.ietf.org Subject: [secdir] Review of draft-ietf-tcpm-rfc4138bis-04 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hello, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I think those security considerations that the document should have is mentioned in the Security Considerations section. Love _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 13:30:13 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2896A28C0F1; Mon, 8 Dec 2008 13:30:13 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 963533A6768 for ; Mon, 8 Dec 2008 08:02:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.793 X-Spam-Level: X-Spam-Status: No, score=-4.793 tagged_above=-999 required=5 tests=[AWL=1.806, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DoiovPSYh3M1 for ; Mon, 8 Dec 2008 08:02:39 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id B15523A657C for ; Mon, 8 Dec 2008 08:02:39 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8G2YSg024638 for ; Mon, 8 Dec 2008 11:02:34 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8G2SF3024624 for ; Mon, 8 Dec 2008 11:02:29 -0500 Received: from mit.edu (M24-004-BARRACUDA-3.MIT.EDU [18.7.7.114]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB8G2MD5029554 for ; Mon, 8 Dec 2008 11:02:22 -0500 (EST) Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id B04D4121A019 for ; Mon, 8 Dec 2008 11:02:01 -0500 (EST) Received: from ilexp03.ndc.lucent.com (h135-3-39-50.lucent.com [135.3.39.50]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id mB8G1dcT011599; Mon, 8 Dec 2008 10:01:46 -0600 (CST) Received: from inexp02.in.lucent.com ([135.254.223.66]) by ilexp03.ndc.lucent.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 8 Dec 2008 10:01:41 -0600 Received: from INEXC1U01.in.lucent.com ([135.254.223.27]) by inexp02.in.lucent.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 8 Dec 2008 21:31:38 +0530 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Mon, 8 Dec 2008 21:31:36 +0530 Message-ID: <6D26D1FE43A66F439F8109CDD42419650240B176@INEXC1U01.in.lucent.com> In-Reply-To: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Secdir review of draft-ietf-isis-hmac-sha-07 Thread-Index: AclZNbRUlz6A5kSHR+6c43NN8ASikAAFpkkg References: From: "Bhatia, Manav (Manav)" To: "Carl Wallace" , , , , X-OriginalArrivalTime: 08 Dec 2008 16:01:38.0386 (UTC) FILETIME=[40A84320:01C9594E] X-Scanned-By: MIMEDefang 2.42 X-Scanned-By: MIMEDefang 2.57 on 135.245.2.35 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mB8G2SF3024624 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list X-Mailman-Approved-At: Mon, 08 Dec 2008 13:30:11 -0800 Cc: secdir@mit.edu, iesg@ietf.org Subject: Re: [secdir] Secdir review of draft-ietf-isis-hmac-sha-07 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi Carl, Thanks for the review. > This draft defines a new authentication type for IS IS and > describes how > to use HMAC-SHAx with this authentication type. The draft is well > written and the security considerations section looks good to > me. A few > minor comments: > > The definition of Authentication Key in section 2 states that > the length > of the key "depends upon the authentication algorithm". Section 3.3 > describes how to prepare keys of various lengths, allowing > the length of > the key to vary independent of the algorithm. Following the terminology used in Sec 3.3, the key referred to in Sec 2 is Ko, while the key being mentioned in section 3.3 is K. Since Ko is the cryptographic key used with the hash function, it is *this* key that is associated with the Security Association. However, this is internal to the implementation and the user is unaware of this. The user enters the Key K, and Section 3.3 describes how the user entered key needs to be converted into the cryptographic key being used the crypto mathematics. > > Given RFC5304, is MD5 allowed or disallowed with this authentication > type? Seems like the doc should state one way or another. This mechanism described in this draft is used in addition to 5304. We do mention this in the Abstract. We can make it more explicit. > > Section 3.3 items (2) and (3) might benefit from clarifying that Ko is > padded with zeroes to be B bytes in length and that || means > concatenate. Ko is L octets long, where L is the length of the hash function being used. We do mention that if K is less than L, then Ko is set to K with zeroes appended to the end of K such that Ko is L octets long. Refer to (1) of Sec 3. Cheers, Manav _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 8 15:36:26 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EFD73A687B; Mon, 8 Dec 2008 15:36:26 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8CD873A687B for ; Mon, 8 Dec 2008 15:36:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[AWL=2.397, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LNl-KjoUDQMJ for ; Mon, 8 Dec 2008 15:36:24 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 908C53A686D for ; Mon, 8 Dec 2008 15:36:24 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8NaIRj021991 for ; Mon, 8 Dec 2008 18:36:18 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB8NaDfH021974 for ; Mon, 8 Dec 2008 18:36:13 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB8Na6IR017386 for ; Mon, 8 Dec 2008 18:36:07 -0500 (EST) Received: from QMTA03.westchester.pa.mail.comcast.net (qmta03.westchester.pa.mail.comcast.net [76.96.62.32]) by mit.edu (Spam Firewall) with ESMTP id 4355013D3F38 for ; Mon, 8 Dec 2008 18:35:45 -0500 (EST) Received: from OMTA11.westchester.pa.mail.comcast.net ([76.96.62.36]) by QMTA03.westchester.pa.mail.comcast.net with comcast id olsG1a00h0mv7h053nbiSC; Mon, 08 Dec 2008 23:35:42 +0000 Received: from Harrington73653 ([24.147.240.21]) by OMTA11.westchester.pa.mail.comcast.net with comcast id onbd1a00H0UQ6dC3XnbdVK; Mon, 08 Dec 2008 23:35:39 +0000 From: "David Harrington" To: , , Date: Mon, 8 Dec 2008 18:35:37 -0500 Message-ID: <031701c9598d$ad905d30$0600a8c0@china.huawei.com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Thread-Index: AclZjawOTRw47cOCRf65mYfqebLgog== X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: [secdir] secdir review of draft-ietf-sip-saml-05 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I am not knowledgeable in SIP or in SAML, so another reviewer has also reviewed this document. Executive Summary: I believe this was an early review request, not a review for last call or IESG telechat. The document appears to be in an early stage of maturity. I found some of the English difficult to parse. It could stand significant WG review. The hard-to-parse English will make it difficult for implementers to interpret the text the same way, and could cause implementations to not interoperate properly. The English MUST be cleaned up to enable getting the security right. Way way too many options and loose language; this really needs to be tightened up. Security Review: In section 4, the document states "In oder for any trait-based system to be practical, participating entities must agree on the attributes. And then it goes on to say we don't define attributes or explain how to discover what attributes are supported. Then why bring this up? I mention it in the security review portion for 2 reasons: 1) There are so many things this document raises and then does not discuss it took a while before I could determine what this document actually DID discuss. 2) Each of the things raised and not fully discussed seemed to be options, and this document describes a profile of options on options on options. There is a lot of text here that says this could happen, and this could happen and this could happen - how about some nice RFC2119 langauge describing what MUST/SHOULD/MAY happen so that implementers can interoperate? I get very concerned when I see so many options. I doubt anybody could ever tell whether security was achieved or not because there are so many optional pieces to consider. section 7.1.3 step 2 mentions cached credentials. The security Considerations do not discuss cached credentials. Security Considerations have a nunber of SHOULDs (or shoulds) but little discussion of when it is appropriate to not do so. In a number of cases I wondered why these were not MUSTs. For example, in countermeasures, "should be signed" - why not "MUST be signed"? The element attribute methd SHOULD be set to XXXX, but MAY be set to something else. Are we standardizing here? What is the reason it SHOULD be set to XXXXX, and under what circumastnaces woudl it be appropriate to not do so? "Note that any SIP message may be used to convey the SAML assertion even though SIP INVITE may be th emost approrpiate candidate." - are we standardizing, or writing something that allows any variation of implementation to claim compliance? 10.3 "The SAML assertion may contain several elements to prevent replay attacks. There is, however, a clear tradeoff between the replaying an assertion and re-using it over multiple SIP exchanges/sessions." - So are we standardizing some guidelines at least, to help guide implementers to develop something that will interoperate reasonably? Other comments: In the Introduction, it says various means of authorization exist, and it lists 3 types, then says the authors selected SAML (which was not one of the three). I found the terminology section confusing. It would be easier on readers if citations were of the form "Title" [RFCXXXX] rather than just [RFCXXXX]. To know what document RFCXXXX refers to requires looking up the document or looking in the references, which interrupts reading. Hope this helps, David Harrington dbharrington@comcast.net ietfdbh@comcast.net dharrington@huawei.com _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 9 01:13:06 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 23C583A6B09; Tue, 9 Dec 2008 01:13:06 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 08DC53A6B08 for ; Tue, 9 Dec 2008 01:13:05 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.354 X-Spam-Level: X-Spam-Status: No, score=-6.354 tagged_above=-999 required=5 tests=[AWL=0.245, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y-st-u9rJhHu for ; Tue, 9 Dec 2008 01:13:04 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id F22A73A6A7C for ; Tue, 9 Dec 2008 01:13:03 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB99Cvs9011509 for ; Tue, 9 Dec 2008 04:12:57 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB99Cql3011497 for ; Tue, 9 Dec 2008 04:12:52 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB99Cft5009472 for ; Tue, 9 Dec 2008 04:12:42 -0500 (EST) Received: from mailgw3.ericsson.se (mailgw3.ericsson.se [193.180.251.60]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id C08E71285133 for ; Tue, 9 Dec 2008 04:12:17 -0500 (EST) Received: from mailgw3.ericsson.se (unknown [127.0.0.1]) by mailgw3.ericsson.se (Symantec Mail Security) with ESMTP id 7A24154826A; Tue, 9 Dec 2008 10:11:52 +0100 (CET) X-AuditID: c1b4fb3c-aef60bb00000304c-cb-493e365882f2 Received: from esealmw126.eemea.ericsson.se (unknown [153.88.254.123]) by mailgw3.ericsson.se (Symantec Mail Security) with ESMTP id 6010A520003; Tue, 9 Dec 2008 10:11:52 +0100 (CET) Received: from esealmw128.eemea.ericsson.se ([153.88.254.172]) by esealmw126.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 9 Dec 2008 10:11:52 +0100 Received: from [147.214.183.72] ([147.214.183.72]) by esealmw128.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 9 Dec 2008 10:11:52 +0100 Message-ID: <493E3657.1020204@ericsson.com> Date: Tue, 09 Dec 2008 10:11:51 +0100 From: Magnus Westerlund User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Russ Housley References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> In-Reply-To: <20081208172732.8EAED500003@mailgw2.ericsson.se> X-Enigmail-Version: 0.95.7 X-OriginalArrivalTime: 09 Dec 2008 09:11:52.0166 (UTC) FILETIME=[2C8A9060:01C959DE] X-Brightmail-Tracker: AAAAAA== X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: fluffy@cisco.com, jon.peterson@neustar.biz, secdir@mit.edu, ingemar.s.johansson@ericsson.com, iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi, I will add both the AVT chairs and my co-author on draft-ietf-avt-srtp-not-mandatory into this thread. Because it does concern the greater discussion on how to do RTP payload format security consideration sections. Russ Housley skrev: > I do not see this as a complete solution. I'd like to see a bit of > discussion about where this mechanism is defined. Is there an example > of a media stream format that includes authentication? I would basically say go read http://tools.ietf.org/wg/avt/draft-ietf-avt-srtp-not-mandatory/ why this turns into a 200-500 word essay assignment. I can do this but the above document has been created to avoid having this happening. So SRTP provides authentication in the sense that you can determine if the sender is in the group or outside of it based on if it is keyed or not. If you needed true source authentication then to my knowledge we end up in IPsec or for point to point case TLS/DTLS with or without SRTP do also work. For RTP mixer and multi-point use cases there is no solution due to that the mixer repackages the material. So the possible trust models prevents true source authentication in this case. And to my knowledge there are no format that include authentication, there is one hach by ISMA that provides ADU level encryption in an attempt to do DRM. But they use RTP packet level authentication and I don't think anyone has suggested that you do it at a finer level. If the current text is read to mean that then I would definitely change it. Because I don't think the payload format is the right place to do authentication. >From my perspective we can resolve this in several ways: 1. Leave as it is and basically say go find a suitable solution. 2. Point to possible solutions in draft-ietf-avt-srtp-not-mandatory with an informative reference. 3. List explicitly what potential solutions there are without going into detail, simple provide a list and not comment on when or when they do work. I would also put a disclaimer saying that there might be additional solutions that also can meet the threat model one has. 4. Make the essay that tries to provide an overview of the IETF solutions that exist. The big issue is how far into different threat models one can go. If one starts discussing this it is soon a multi-page document in itself. 5. I actually uses the template text from http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ as that seems to work fine and not be raising objections. At least it went straight through for draft-ietf-avt-rtp-g711wb. The only thing don't covered by the template in my mind is the interleaving issue which is a very minor one. I do seem to get some security discussion every time I bring an RTP payload format onto the table. Maybe if I was better at following my own advice in draft-ietf-avt-rtp-howto I would get less issues. It would be good if we could get at least some current agreement about what the right level to discuss issues at are and what additional documentation that do needs to be published so that people doesn't have to repeat it all the time. Even if it needs to be repeated that we agree on some wording that we can put into the template in http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ Cheers Magnus Westerlund IETF Transport Area Director & TSVWG Chair ---------------------------------------------------------------------- Multimedia Technologies, Ericsson Research EAB/TVM ---------------------------------------------------------------------- Ericsson AB | Phone +46 10 7148287 F=E4r=F6gatan 6 | Mobile +46 73 0949079 SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com ---------------------------------------------------------------------- _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 9 04:52:06 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7DC943A69AD; Tue, 9 Dec 2008 04:52:06 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 482A828C13A for ; Tue, 9 Dec 2008 04:48:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.92 X-Spam-Level: X-Spam-Status: No, score=-5.92 tagged_above=-999 required=5 tests=[AWL=0.679, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ouMYUGWNatnC for ; Tue, 9 Dec 2008 04:48:58 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 0A58528C12C for ; Tue, 9 Dec 2008 04:48:57 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9CmqMO013546 for ; Tue, 9 Dec 2008 07:48:52 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9CmjIs013510 for ; Tue, 9 Dec 2008 07:48:45 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB9Cmaf2020137 for ; Tue, 9 Dec 2008 07:48:36 -0500 (EST) Received: from mailgw3.ericsson.se (mailgw3.ericsson.se [193.180.251.60]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 418341163083 for ; Tue, 9 Dec 2008 07:48:12 -0500 (EST) Received: from mailgw3.ericsson.se (unknown [127.0.0.1]) by mailgw3.ericsson.se (Symantec Mail Security) with ESMTP id C4F9B20AB0; Tue, 9 Dec 2008 13:48:10 +0100 (CET) X-AuditID: c1b4fb3c-aef60bb00000304c-b2-493e690acc0b Received: from esealmw128.eemea.ericsson.se (unknown [153.88.254.121]) by mailgw3.ericsson.se (Symantec Mail Security) with ESMTP id 950B7209F3; Tue, 9 Dec 2008 13:48:10 +0100 (CET) Received: from esealmw109.eemea.ericsson.se ([153.88.200.2]) by esealmw128.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 9 Dec 2008 13:48:10 +0100 x-mimeole: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 9 Dec 2008 13:48:09 +0100 Message-ID: <026F8EEDAD2C4342A993203088C1FC0508EF115B@esealmw109.eemea.ericsson.se> In-Reply-To: <493E3657.1020204@ericsson.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 Thread-Index: AclZ3jCs18H2StPTSIyWOH+Q2bfL7wAHAJaQ References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> From: "Ingemar Johansson S" To: "Magnus Westerlund" , "Russ Housley" X-OriginalArrivalTime: 09 Dec 2008 12:48:10.0759 (UTC) FILETIME=[6462B170:01C959FC] X-Brightmail-Tracker: AAAAAA== X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mB9CmjIs013510 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list X-Mailman-Approved-At: Tue, 09 Dec 2008 04:52:05 -0800 Cc: fluffy@cisco.com, jon.peterson@neustar.biz, secdir@mit.edu, Ingemar Johansson S , iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi I would spend my 99 cents on alternative 2 below. = This because I believe it is asking too much from the payload format author= to provide with a detailed analysis of threat models and countermeasures (= I would not be able to provide with this info). The drawback with requiring too much of this in each payload format spec is= also that people will in the end only copy-paste the text from older specs= with the risk that the information is stale or not applicable to the parti= cular codec or usecase. = One must also keep in mind that it is often not the same people who do the = codecs that do the security stuff. For that simple reason it would be bette= r to allow (or maybe require ?) the payload format author to reference to a= document that handles these issues. This would help the payload draft writ= ing to become more of an automated process and reduce the time lag from fir= st draft to an RFC. Regards Ingemar > -----Original Message----- > From: Magnus Westerlund = > Sent: den 9 december 2008 10:12 > To: Russ Housley > Cc: Hilarie Orman; Ingemar Johansson S; fluffy@cisco.com; = > secdir@mit.edu; iesg@ietf.org; jon.peterson@neustar.biz; = > csp@csperkins.org; avt-chairs@tools.ietf.org > Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload = > format for G.719 > = > Hi, > = > I will add both the AVT chairs and my co-author on = > draft-ietf-avt-srtp-not-mandatory into this thread. Because = > it does concern the greater discussion on how to do RTP = > payload format security consideration sections. > = > Russ Housley skrev: > > I do not see this as a complete solution. I'd like to see a bit of = > > discussion about where this mechanism is defined. Is there = > an example = > > of a media stream format that includes authentication? > = > I would basically say go read > http://tools.ietf.org/wg/avt/draft-ietf-avt-srtp-not-mandatory/ > why this turns into a 200-500 word essay assignment. I can do = > this but the above document has been created to avoid having = > this happening. > = > So SRTP provides authentication in the sense that you can = > determine if the sender is in the group or outside of it = > based on if it is keyed or not. If you needed true source = > authentication then to my knowledge we end up in IPsec or for = > point to point case TLS/DTLS with or without SRTP do also = > work. For RTP mixer and multi-point use cases there is no = > solution due to that the mixer repackages the material. So = > the possible trust models prevents true source authentication = > in this case. > = > And to my knowledge there are no format that include = > authentication, there is one hach by ISMA that provides ADU = > level encryption in an attempt to do DRM. But they use RTP = > packet level authentication and I don't think anyone has = > suggested that you do it at a finer level. If the current = > text is read to mean that then I would definitely change it. > Because I don't think the payload format is the right place = > to do authentication. > = > From my perspective we can resolve this in several ways: > = > 1. Leave as it is and basically say go find a suitable solution. > = > 2. Point to possible solutions in = > draft-ietf-avt-srtp-not-mandatory with an informative reference. > = > 3. List explicitly what potential solutions there are without = > going into detail, simple provide a list and not comment on = > when or when they do work. I would also put a disclaimer = > saying that there might be additional solutions that also can = > meet the threat model one has. > = > 4. Make the essay that tries to provide an overview of the = > IETF solutions that exist. The big issue is how far into = > different threat models one can go. If one starts discussing = > this it is soon a multi-page document in itself. > = > 5. I actually uses the template text from = > http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ > as that seems to work fine and not be raising objections. At = > least it went straight through for draft-ietf-avt-rtp-g711wb. = > The only thing don't covered by the template in my mind is = > the interleaving issue which is a very minor one. > = > I do seem to get some security discussion every time I bring = > an RTP payload format onto the table. Maybe if I was better = > at following my own advice in draft-ietf-avt-rtp-howto I = > would get less issues. It would be good if we could get at = > least some current agreement about what the right level to = > discuss issues at are and what additional documentation that = > do needs to be published so that people doesn't have to = > repeat it all the time. Even if it needs to be repeated that = > we agree on some wording that we can put into the template in = > http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ > = > Cheers > = > Magnus Westerlund > = > IETF Transport Area Director & TSVWG Chair > ---------------------------------------------------------------------- > Multimedia Technologies, Ericsson Research EAB/TVM > ---------------------------------------------------------------------- > Ericsson AB | Phone +46 10 7148287 > F=E4r=F6gatan 6 | Mobile +46 73 0949079 > SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com > ---------------------------------------------------------------------- > = _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 9 07:26:54 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7B09E3A6B2A; Tue, 9 Dec 2008 07:26:54 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F414D3A6B2A for ; Tue, 9 Dec 2008 07:26:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.607 X-Spam-Level: X-Spam-Status: No, score=-104.607 tagged_above=-999 required=5 tests=[AWL=1.992, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lo7NL5FB+lhq for ; Tue, 9 Dec 2008 07:26:53 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id E35093A68F1 for ; Tue, 9 Dec 2008 07:26:52 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9FQkHZ000859 for ; Tue, 9 Dec 2008 10:26:47 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9FQfE0000842 for ; Tue, 9 Dec 2008 10:26:41 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB9FQVqN020643 for ; Tue, 9 Dec 2008 10:26:32 -0500 (EST) Received: from woodstock.binhost.com (woodstock.binhost.com [8.8.40.152]) by mit.edu (Spam Firewall) with SMTP id 0B87D113643E for ; Tue, 9 Dec 2008 10:26:07 -0500 (EST) Received: (qmail 25118 invoked by uid 0); 9 Dec 2008 15:26:03 -0000 Received: from unknown (HELO THINKPADR52.vigilsec.com) (96.255.143.189) by woodstock.binhost.com with SMTP; 9 Dec 2008 15:26:03 -0000 X-Mailer: QUALCOMM Windows Eudora Version 7.1.0.9 Date: Tue, 09 Dec 2008 10:13:48 -0500 To: Magnus Westerlund From: Russ Housley In-Reply-To: <493E3657.1020204@ericsson.com> References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> Mime-Version: 1.0 Message-Id: <20081209152607.0B87D113643E@mit.edu> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: fluffy@cisco.com, jon.peterson@neustar.biz, secdir@mit.edu, ingemar.s.johansson@ericsson.com, iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I'm happy to see the draft-ietf-avt-srtp-not-mandatory coming = along. I do not want to hold this document to wait for it. I do not = know what others think, but either 3 or 5 would work for me. Russ At 04:11 AM 12/9/2008, Magnus Westerlund wrote: >Hi, > >I will add both the AVT chairs and my co-author on >draft-ietf-avt-srtp-not-mandatory into this thread. Because it does >concern the greater discussion on how to do RTP payload format security >consideration sections. > >Russ Housley skrev: > > I do not see this as a complete solution. I'd like to see a bit of > > discussion about where this mechanism is defined. Is there an example > > of a media stream format that includes authentication? > >I would basically say go read >http://tools.ietf.org/wg/avt/draft-ietf-avt-srtp-not-mandatory/ >why this turns into a 200-500 word essay assignment. I can do this but >the above document has been created to avoid having this happening. > >So SRTP provides authentication in the sense that you can determine if >the sender is in the group or outside of it based on if it is keyed or >not. If you needed true source authentication then to my knowledge we >end up in IPsec or for point to point case TLS/DTLS with or without SRTP > do also work. For RTP mixer and multi-point use cases there is no >solution due to that the mixer repackages the material. So the possible >trust models prevents true source authentication in this case. > >And to my knowledge there are no format that include authentication, >there is one hach by ISMA that provides ADU level encryption in an >attempt to do DRM. But they use RTP packet level authentication and I >don't think anyone has suggested that you do it at a finer level. If the >current text is read to mean that then I would definitely change it. >Because I don't think the payload format is the right place to do >authentication. > > From my perspective we can resolve this in several ways: > >1. Leave as it is and basically say go find a suitable solution. > >2. Point to possible solutions in draft-ietf-avt-srtp-not-mandatory with >an informative reference. > >3. List explicitly what potential solutions there are without going into >detail, simple provide a list and not comment on when or when they do >work. I would also put a disclaimer saying that there might be >additional solutions that also can meet the threat model one has. > >4. Make the essay that tries to provide an overview of the IETF >solutions that exist. The big issue is how far into different threat >models one can go. If one starts discussing this it is soon a multi-page >document in itself. > >5. I actually uses the template text from >http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ >as that seems to work fine and not be raising objections. At least it >went straight through for draft-ietf-avt-rtp-g711wb. The only thing >don't covered by the template in my mind is the interleaving issue which >is a very minor one. > >I do seem to get some security discussion every time I bring an RTP >payload format onto the table. Maybe if I was better at following my own >advice in draft-ietf-avt-rtp-howto I would get less issues. It would be >good if we could get at least some current agreement about what the >right level to discuss issues at are and what additional documentation >that do needs to be published so that people doesn't have to repeat it >all the time. Even if it needs to be repeated that we agree on some >wording that we can put into the template in >http://tools.ietf.org/wg/avt/draft-ietf-avt-rtp-howto/ > >Cheers > >Magnus Westerlund > >IETF Transport Area Director & TSVWG Chair >---------------------------------------------------------------------- >Multimedia Technologies, Ericsson Research EAB/TVM >---------------------------------------------------------------------- >Ericsson AB | Phone +46 10 7148287 >F=E4r=F6gatan 6 | Mobile +46 73 0949079 >SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com >---------------------------------------------------------------------- _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 9 11:04:21 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A6F383A6B4C; Tue, 9 Dec 2008 11:04:21 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B8F5A28C0FE for ; Tue, 9 Dec 2008 11:04:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.546 X-Spam-Level: X-Spam-Status: No, score=-4.546 tagged_above=-999 required=5 tests=[AWL=2.053, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZZGcdxA2EKN0 for ; Tue, 9 Dec 2008 11:04:19 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id B21CB3A6810 for ; Tue, 9 Dec 2008 11:04:19 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9J4EDO014453 for ; Tue, 9 Dec 2008 14:04:14 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9J4ATr014406 for ; Tue, 9 Dec 2008 14:04:10 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB9J44ed028919 for ; Tue, 9 Dec 2008 14:04:05 -0500 (EST) Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by mit.edu (Spam Firewall) with ESMTP id BBB941291C27 for ; Tue, 9 Dec 2008 14:03:43 -0500 (EST) Received: from [192.168.0.8] ((unknown) [62.3.217.253]) by rufus.isode.com (submission channel) via TCP with ESMTPA id ; Tue, 9 Dec 2008 19:03:41 +0000 X-SMTP-Protocol-Errors: NORDNS Message-ID: <493EC0FB.6060902@isode.com> Date: Tue, 09 Dec 2008 19:03:23 +0000 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 X-Accept-Language: en-us, en To: Carl Wallace References: In-Reply-To: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: secdir@mit.edu, iesg@ietf.org, curtis.king@isode.com Subject: Re: [secdir] Secdir review of draft-melnikov-imapext-filters-07 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi Carl, Thank you for the review. Carl Wallace wrote: >I have reviewed this document as part of the security directorate's >ongoing effort to review all IETF documents being processed by the IESG. >These comments were written primarily for the benefit of the security >area directors. Document editors and WG chairs should treat these >comments just like any other last call comments. > >This draft defines how to store named search filters on an IMAP server. >The draft is well written and the security considerations section looks >good to me. A few minor comments: > >In section 2, "if both filter type with the same exist" should be "if >both filter types with the same name exist". In the same sentence, "is >going to use" should probably be "MUST use". > > Changed, thanks. >In the example in section 3.1, "OR" is missing from the example where >the value of the filter has been substituted into the command. > Good point. Fixed. >Should the server check the syntax of the filter before storing? The >fourth paragraph of section 3.2 gives the impression that any "non NIL >value" may be stored. > Right. I've added: The server SHOULD verify that each search criterion stored in such server entry is a full and correct search criterion. Note that the following paragraph in Section 3.1 covers filter validation on use: Note the server SHOULD verify that each search criterion referenced by the FILTER search key is a full and correct search criterion. For example, the server should fail the SEARCH command if its SEARCH criterion references a filter containing "OR SMALLER" search criterion, because this value is lacking one parameter and thus is not a fully specified search criterion. So this will already catch invalid filters when they are referenced. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 9 11:17:51 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0F2AD3A6B24; Tue, 9 Dec 2008 11:17:51 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 357763A693E for ; Tue, 9 Dec 2008 11:17:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.537 X-Spam-Level: X-Spam-Status: No, score=-106.537 tagged_above=-999 required=5 tests=[AWL=0.062, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8mCEXVHLBbGo for ; Tue, 9 Dec 2008 11:17:48 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 6641B3A6B24 for ; Tue, 9 Dec 2008 11:17:48 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9JHgYw016497 for ; Tue, 9 Dec 2008 14:17:42 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9JHdWT016488 for ; Tue, 9 Dec 2008 14:17:39 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB9JHW3K018677 for ; Tue, 9 Dec 2008 14:17:32 -0500 (EST) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 908E31417C08 for ; Tue, 9 Dec 2008 14:17:11 -0500 (EST) X-IronPort-AV: E=Sophos;i="4.33,743,1220227200"; d="scan'208";a="115737802" Received: from sj-dkim-1.cisco.com ([171.71.179.21]) by sj-iport-1.cisco.com with ESMTP; 09 Dec 2008 19:17:10 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id mB9JHAuN025989; Tue, 9 Dec 2008 11:17:10 -0800 Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mB9JH8CF016323; Tue, 9 Dec 2008 19:17:09 GMT From: Cullen Jennings To: Russ Housley In-Reply-To: <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> Impp: xmpp:cullenfluffyjennings@jabber.org References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> Message-Id: <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Tue, 9 Dec 2008 12:17:03 -0700 X-Mailer: Apple Mail (2.929.2) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=165; t=1228850230; x=1229714230; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fluffy@cisco.com; z=From:=20Cullen=20Jennings=20 |Subject:=20Re=3A=20[secdir]=20draft-ietf-avt-rtp-g719-04,= 20RTP=20Payload=20format=20=20for=20G.719 |Sender:=20; bh=t3zzLh5S5fczD/7ZvX5D+YHe4N5Nj6XMpYoL0T97a4s=; b=cV/eFr81lDqvxWIPEORdloDndEUYv49B+tNtiBUBr9oo+Kz4y2IWULyQ9c x7dg3i0gOS6mUfoaqsRn0Ro3EzFcnmCw+nUHHcD2tv8HCN3IyoUycgxEEmXK kAsQkkIt9AwsJPh+al1sCLGKFtMON5s+NQDk+tGDwLHdrJD4zjmfo=; Authentication-Results: sj-dkim-1; header.From=fluffy@cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; ); X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: Magnus Westerlund , jon.peterson@neustar.biz, secdir@mit.edu, ingemar.s.johansson@ericsson.com, iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Dec 9, 2008, at 8:13 AM, Russ Housley wrote: > I do not know what others think, but either 3 or 5 would work for me. Both of theses would work for me. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 00:24:18 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 211593A6B7B; Wed, 10 Dec 2008 00:24:18 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CEFA73A6B08 for ; Tue, 9 Dec 2008 08:32:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.742 X-Spam-Level: X-Spam-Status: No, score=-7.742 tagged_above=-999 required=5 tests=[AWL=-1.143, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JS++IkMsCHSR for ; Tue, 9 Dec 2008 08:32:25 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id CDCDB3A69E0 for ; Tue, 9 Dec 2008 08:32:24 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9GWJt5013657 for ; Tue, 9 Dec 2008 11:32:19 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9GWG9S013647 for ; Tue, 9 Dec 2008 11:32:18 -0500 Received: from mit.edu (M24-004-BARRACUDA-3.MIT.EDU [18.7.7.114]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mB9GW6co000582 for ; Tue, 9 Dec 2008 11:32:06 -0500 (EST) Received: from mail.ietf.org (mail.ietf.org [64.170.98.32]) by mit.edu (Spam Firewall) with ESMTP id A24B1122BA1B for ; Tue, 9 Dec 2008 11:31:42 -0500 (EST) Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 026413A69E0; Tue, 9 Dec 2008 08:31:47 -0800 (PST) X-Original-To: new-work@core3.amsl.com Delivered-To: new-work@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F13E828C174 for ; Mon, 8 Dec 2008 11:47:55 -0800 (PST) Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P-mFDMhA-5NW for ; Mon, 8 Dec 2008 11:47:55 -0800 (PST) Received: from frink.w3.org (frink.w3.org [128.30.52.56]) by core3.amsl.com (Postfix) with ESMTP id 1C64C28C12D for ; Mon, 8 Dec 2008 11:47:54 -0800 (PST) Received: from lists by frink.w3.org with local (Exim 4.63) (envelope-from ) id 1L9m4z-00058H-Sq for public-new-work-dist@listhub.w3.org; Mon, 08 Dec 2008 19:47:41 +0000 Received: from bart.w3.org ([128.30.52.63]) by frink.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L9m4z-00057g-57 for public-new-work@listhub.w3.org; Mon, 08 Dec 2008 19:47:41 +0000 Received: from homer.w3.org ([128.30.52.30]) by bart.w3.org with esmtp (Exim 4.63) (envelope-from ) id 1L9m4q-0003AX-Tc; Mon, 08 Dec 2008 14:47:41 -0500 Received: from [127.0.0.1] (homer.w3.org [128.30.52.30]) by homer.w3.org (Postfix) with ESMTP id A81914EEE3; Mon, 8 Dec 2008 14:47:32 -0500 (EST) From: "Ian B. Jacobs" To: public-new-work@w3.org Organization: W3C Date: Mon, 08 Dec 2008 19:45:14 +0000 Message-Id: <1228765514.1639.97.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.22.3.1 X-W3C-Hub-Spam-Status: No, score=-4.4 X-W3C-Hub-Spam-Report: ALL_TRUSTED=-1.8, BAYES_00=-2.599 X-W3C-Scan-Sig: bart.w3.org 1L9m4q-0003AX-Tc 5afeab74c63df78f760325e880b62c3d X-Original-To: public-new-work@w3.org Archived-At: Resent-From: public-new-work@w3.org X-Mailing-List: archive/latest/36 X-Loop: public-new-work@w3.org Resent-Sender: public-new-work-request@w3.org Precedence: list Resent-Message-Id: Resent-Date: Mon, 08 Dec 2008 19:47:41 +0000 X-Mailman-Approved-At: Tue, 09 Dec 2008 08:31:45 -0800 X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.9 X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Approved-At: Wed, 10 Dec 2008 00:24:17 -0800 Subject: [secdir] [New-work] Proposed W3C Charter: Fonts Working Group (until 2009-01-14) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hello, Today W3C Advisory Committee Representatives received a Proposal for a new Fonts Activity [0] (see the W3C Process Document description of Activity Proposals [1]). This proposal includes a draft charter for the Fonts Working Group: http://www.w3.org/Fonts/Misc/charter-2008-v2 As part of ensuring that the community is aware of proposed work at W3C, this draft charter is public during the Advisory Committee review period. W3C invites public comments through 2009-01-14 on the proposed charter. Please send comments to public-new-work@w3.org, which has a public archive: http://lists.w3.org/Archives/Public/public-new-work/ Other than comments sent in formal responses by W3C Advisory Committee Representatives, W3C cannot guarantee a response to comments. If you work for a W3C Member [2], please coordinate your comments with your Advisory Committee Representative. For example, you may wish to make public comments via this list and have your Advisory Committee Representative refer to it from his or her formal review comments. If you should have any questions or need further information, please contact Bert Bos . Thank you, Ian Jacobs, Head of W3C Communications [0] http://www.w3.org/2008/09/fonts-activity-v2 [1] http://www.w3.org/2005/10/Process-20051014/activities#ActivityCreation [2] http://www.w3.org/Consortium/Member/List -- Ian Jacobs (ij@w3.org) http://www.w3.org/People/Jacobs/ Tel: +1 718 260-9447 _______________________________________________ New-work mailing list New-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 00:24:18 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3272F28C17E; Wed, 10 Dec 2008 00:24:18 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A1EF43A695F for ; Tue, 9 Dec 2008 12:07:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.384 X-Spam-Level: X-Spam-Status: No, score=-3.384 tagged_above=-999 required=5 tests=[AWL=3.215, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t0sei+0-bcFO for ; Tue, 9 Dec 2008 12:07:31 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id BE95B3A6889 for ; Tue, 9 Dec 2008 12:07:31 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9K7QlS023963 for ; Tue, 9 Dec 2008 15:07:26 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mB9K7Opw023957 for ; Tue, 9 Dec 2008 15:07:24 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mB9K7I5F013546 for ; Tue, 9 Dec 2008 15:07:18 -0500 (EST) Received: from fk-out-0910.google.com (fk-out-0910.google.com [209.85.128.189]) by mit.edu (Spam Firewall) with ESMTP id E484411393A9 for ; Tue, 9 Dec 2008 15:06:57 -0500 (EST) Received: by fk-out-0910.google.com with SMTP id z22so69788fkz.6 for ; Tue, 09 Dec 2008 12:06:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:from:to:cc:references :in-reply-to:subject:date:mime-version:content-type :content-transfer-encoding:x-mailer:thread-index:content-language :message-id; bh=APOogYzYMePmfh/9A2gTHxaLFHOqLOgVgtT+J33xUHQ=; b=VLpw3456PAkeE3jV+SndWHyKruMkFy7YidnjhjL3kgt0DZ4ETsBswfR3o7pDtkdDp7 h1l580aY61Uwn1X5FIVhG+lRmbMzhZH/X1izBByHX5N2x6VT3mzYQYk7mtoo2wLLUihh CE3Nn4PKPvE7pzLYLeHAEmFP6i82CrOhfLTmI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=from:to:cc:references:in-reply-to:subject:date:mime-version :content-type:content-transfer-encoding:x-mailer:thread-index :content-language:message-id; b=qPUTln4YprnFv8g4Tc/V+nvnza7RySno03egSpc7UDUzJ2aaHvqnbLac+BS2VgCkFM j6se+IkFkdRlNwdy2Nj48q8aN0nrWt0gBdAjzqJBrRmubm1+zvQrc9RsCemQHyNTEgjq F8LX4Cxiq9Gmooger5eJ+c31Tzi1RABshNMls= Received: by 10.103.117.8 with SMTP id u8mr208420mum.123.1228853216976; Tue, 09 Dec 2008 12:06:56 -0800 (PST) Received: from windows8d787f9 (bzq-79-179-158-180.red.bezeqint.net [79.179.158.180]) by mx.google.com with ESMTPS id j2sm409723mue.5.2008.12.09.12.06.43 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 09 Dec 2008 12:06:55 -0800 (PST) From: "Roni Even" To: "'Cullen Jennings'" , "'Russ Housley'" References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> In-Reply-To: <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> Date: Tue, 9 Dec 2008 22:06:11 +0200 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AclaMs/s2xk7UFmnSbiBbEw95s58CAABobAQ Content-Language: en-us Message-ID: <493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list X-Mailman-Approved-At: Wed, 10 Dec 2008 00:24:17 -0800 Cc: 'Magnus Westerlund' , jon.peterson@neustar.biz, secdir@mit.edu, ingemar.s.johansson@ericsson.com, iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi, Personally I prefer 5 since it make it easier to payload specification writers. You can have 3 as part of 5 if you put the information in draft-ietf-avt-rtp-howto Roni Even -----Original Message----- From: Cullen Jennings [mailto:fluffy@cisco.com] Sent: Tuesday, December 09, 2008 9:17 PM To: Russ Housley Cc: Magnus Westerlund; Hilarie Orman; ingemar.s.johansson@ericsson.com; secdir@mit.edu; iesg@ietf.org; jon.peterson@neustar.biz; csp@csperkins.org; avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 On Dec 9, 2008, at 8:13 AM, Russ Housley wrote: > I do not know what others think, but either 3 or 5 would work for me. Both of theses would work for me. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 05:42:49 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AC4313A6BA7; Wed, 10 Dec 2008 05:42:49 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 40BB53A6BA7 for ; Wed, 10 Dec 2008 05:42:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.363 X-Spam-Level: X-Spam-Status: No, score=-6.363 tagged_above=-999 required=5 tests=[AWL=0.236, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wAyNadQE2IAo for ; Wed, 10 Dec 2008 05:42:48 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 152E83A6BA3 for ; Wed, 10 Dec 2008 05:42:47 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBADgdLV023467 for ; Wed, 10 Dec 2008 08:42:39 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBADgTxj023411 for ; Wed, 10 Dec 2008 08:42:30 -0500 Received: from mit.edu (W92-130-BARRACUDA-1.MIT.EDU [18.7.21.220]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mBADgM4Q018038 for ; Wed, 10 Dec 2008 08:42:22 -0500 (EST) Received: from mailgw3.ericsson.se (mailgw3.ericsson.se [193.180.251.60]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 5A103CC2B24 for ; Wed, 10 Dec 2008 08:42:01 -0500 (EST) Received: from mailgw3.ericsson.se (unknown [127.0.0.1]) by mailgw3.ericsson.se (Symantec Mail Security) with ESMTP id 7776D20C5E; Wed, 10 Dec 2008 14:41:49 +0100 (CET) X-AuditID: c1b4fb3c-af761bb00000304c-cf-493fc71dc049 Received: from esealmw129.eemea.ericsson.se (unknown [153.88.254.124]) by mailgw3.ericsson.se (Symantec Mail Security) with ESMTP id 40495207FD; Wed, 10 Dec 2008 14:41:49 +0100 (CET) Received: from esealmw127.eemea.ericsson.se ([153.88.254.171]) by esealmw129.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 10 Dec 2008 14:41:48 +0100 Received: from [147.214.183.72] ([147.214.183.72]) by esealmw127.eemea.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 10 Dec 2008 14:41:48 +0100 Message-ID: <493FC71C.4070603@ericsson.com> Date: Wed, 10 Dec 2008 14:41:48 +0100 From: Magnus Westerlund User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Roni Even References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> <493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> In-Reply-To: <493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> X-Enigmail-Version: 0.95.7 X-OriginalArrivalTime: 10 Dec 2008 13:41:48.0668 (UTC) FILETIME=[0CD263C0:01C95ACD] X-Brightmail-Tracker: AAAAAA== X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: 'Cullen Jennings' , jon.peterson@neustar.biz, secdir@mit.edu, ingemar.s.johansson@ericsson.com, iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi, So lets go with 5 this results in the following RFC-editor note: Section 10: OLD: RTP packets using the payload format defined in this specification are subject to the general security considerations discussed in RTP [RFC3550] and any applicable profile such as AVP [RFC3551] or SAVP [RFC3711]. As this format transports encoded audio, the main security issues include confidentiality, integrity protection, and data origin authentication of the audio itself. The payload format itself does not have any built-in security mechanisms. Any suitable external mechanisms, such as SRTP [RFC3711], MAY be used. This payload format and the G.719 decoder do not exhibit any significant non-uniformity in the receiver-side computational complexity for packet processing, and thus are unlikely to pose a denial-of-service threat due to the receipt of pathological data. The payload format or the codec data does not contain any type of active content such as scripts. 10.1. Confidentiality In order to ensure confidentiality of the encoded audio, all audio data bits MUST be encrypted. There is less need to encrypt the payload header or the table of contents since they only carry information about the frame type. This information could also be useful to a third party, for example, for quality monitoring. However, as there currently don't exist any mechanism supporting differential protection, this behavior isn't expected to be supported and requirement of the audio data will be what governs the protection of the RTP payload. The use of interleaving in conjunction with encryption can have a negative impact on confidentiality, for a short period of time. Consider the following packets (in brackets) containing frame numbers as indicated: {10, 14, 18}, {13, 17, 21}, {16, 20, 24} (a popular continuous diagonal interleaving pattern). The originator wishes to deny some participants the ability to hear material starting at time 16. Simply changing the key on the packet with the timestamp at or after 16, and denying that new key to those participants, does not achieve this; frames 17, 18, and 21 have been supplied in prior packets under the prior key, and error concealment may make the audio intelligible at least as far as frame 18 or 19, and possibly further. 10.2. Authentication and Integrity To authenticate the sender of the audio-stream, an external mechanism MUST be used. It is RECOMMENDED that such a mechanism protects both the complete RTP header and the payload (audio and data bits). Data tampering by a man-in-the-middle attacker could replace audio content and also result in erroneous depacketization/decoding that could lower the audio quality. NEW: RTP packets using the payload format defined in this specification are subject to the security considerations discussed in the RTP specification [RFC3550] , and in any applicable RTP profile. The main security considerations for the RTP packet carrying the RTP payload format defined within this memo are confidentiality, integrity and source authenticity. Confidentiality is achieved by encryption of the RTP payload. Integrity of the RTP packets through suitable cryptographic integrity protection mechanism. Cryptographic system may also allow the authentication of the source of the payload. A suitable security mechanism for this RTP payload format should provide confidentiality, integrity protection and at least source authentication capable of determining if an RTP packet is from a member of the RTP session or not. Note that the appropriate mechanism to provide security to RTP and payloads following this memo may vary. It is dependent on the application, the transport, and the signalling protocol employed. Therefore a single mechanism is not sufficient, although if suitable the usage of SRTP [RFC3711] is recommended. Other mechanism that may be used are IPsec [RFC4301] and TLS [RFC5246] (RTP over TCP), but also other alternatives may exist. This RTP payload format and its media decoder do not exhibit any significant non-uniformity in the receiver-side computational complexity for packet processing, and thus are unlikely to pose a denial-of-service threat due to the receipt of pathological data. Nor does the RTP payload format contain any active content. My only question is if anyone thinks the second paragraph in 10.1 do need included in the new note? I think it is a minor issue that has very short temporal importance and are fine leaving it out. Cheers Magnus Westerlund IETF Transport Area Director & TSVWG Chair ---------------------------------------------------------------------- Multimedia Technologies, Ericsson Research EAB/TVM ---------------------------------------------------------------------- Ericsson AB | Phone +46 10 7148287 F=E4r=F6gatan 6 | Mobile +46 73 0949079 SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com ---------------------------------------------------------------------- _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 07:13:49 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A5D343A6BBE; Wed, 10 Dec 2008 07:13:49 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1D4E63A6BBE for ; Wed, 10 Dec 2008 07:13:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NmHVhO8U5tBr for ; Wed, 10 Dec 2008 07:13:47 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 471BB3A6BB9 for ; Wed, 10 Dec 2008 07:13:47 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBAFDdMi005492 for ; Wed, 10 Dec 2008 10:13:39 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBAFDW8D005483 for ; Wed, 10 Dec 2008 10:13:32 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBAFDSY6021545 for ; Wed, 10 Dec 2008 10:13:28 -0500 (EST) Received: from mexforward.lss.emc.com (mexforward.lss.emc.com [128.222.32.20]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 9F0731178AC3; Wed, 10 Dec 2008 10:13:07 -0500 (EST) Received: from hop04-l1d11-si04.isus.emc.com (HOP04-L1D11-SI04.isus.emc.com [10.254.111.24]) by mexforward.lss.emc.com (Switch-3.2.5/Switch-3.1.7) with ESMTP id mBAFCvlc002272 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 10 Dec 2008 10:12:58 -0500 (EST) Received: from mailhub.lss.emc.com (nirah.lss.emc.com [10.254.144.13]) by hop04-l1d11-si04.isus.emc.com (Tablus Interceptor); Wed, 10 Dec 2008 09:55:56 -0500 Received: from corpussmtp1.corp.emc.com (corpussmtp1.corp.emc.com [128.221.10.43]) by mailhub.lss.emc.com (Switch-3.2.5/Switch-3.1.7) with ESMTP id mBAFCi3W000110; Wed, 10 Dec 2008 10:12:45 -0500 (EST) Received: from CORPUSMX50B.corp.emc.com ([128.221.62.41]) by corpussmtp1.corp.emc.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 10 Dec 2008 10:12:44 -0500 Received: from W-JNISBETTEST-1 ([10.4.6.21]) by CORPUSMX50B.corp.emc.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 10 Dec 2008 10:12:43 -0500 Date: Wed, 10 Dec 2008 16:12:51 +0100 (W. Europe Standard Time) From: =?iso-8859-1?Q?Magnus_Nystr=F6m?= To: iesg@ietf.org, secdir@mit.edu, cyrus@daboo.name, Alexey Melnikov , ned.freed@mrochek.com In-Reply-To: Message-ID: References: MIME-Version: 1.0 X-OriginalArrivalTime: 10 Dec 2008 15:12:43.0515 (UTC) FILETIME=[C029FCB0:01C95AD9] X-RSA-Inspected: yes X-RSA-Classifications: X-RSA-Action: allow X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: secdir-secretary@mit.edu Subject: [secdir] Review of draft-freed-sieve-ihave-03 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Background ---------- This document describes an extension to Sieve email filtering. The extension will allow Sieve scripts to make use of other, optional Sieve extensions if present but not require their presence. Comments -------- The document is well written and the Security Considerations section seems adequate. I have no further comments on this document. -- Magnus _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 07:22:30 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E21413A6BAE; Wed, 10 Dec 2008 07:22:30 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 296463A6BAE for ; Wed, 10 Dec 2008 07:22:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.54 X-Spam-Level: X-Spam-Status: No, score=-106.54 tagged_above=-999 required=5 tests=[AWL=0.059, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eMX07o-zMSHF for ; Wed, 10 Dec 2008 07:22:28 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 5587A3A694E for ; Wed, 10 Dec 2008 07:22:28 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBAFMMIg007325 for ; Wed, 10 Dec 2008 10:22:22 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBAFMC52007308 for ; Wed, 10 Dec 2008 10:22:15 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBAFM5lr006583 for ; Wed, 10 Dec 2008 10:22:05 -0500 (EST) Received: from sj-iport-3.cisco.com (sj-iport-3.cisco.com [171.71.176.72]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id DBA5F12A4451 for ; Wed, 10 Dec 2008 10:21:44 -0500 (EST) X-IronPort-AV: E=Sophos;i="4.33,747,1220227200"; d="scan'208";a="122277062" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-3.cisco.com with ESMTP; 10 Dec 2008 15:21:43 +0000 Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id mBAFLhfL016445; Wed, 10 Dec 2008 07:21:43 -0800 Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-2.cisco.com (8.13.8/8.13.8) with ESMTP id mBAFLevH020808; Wed, 10 Dec 2008 15:21:41 GMT From: Cullen Jennings To: Magnus Westerlund In-Reply-To: <493FC71C.4070603@ericsson.com> Impp: xmpp:cullenfluffyjennings@jabber.org References: <200812080137.mB81bm2G027217@localhost.localdomain><493CE19D.3020107@ericsson.com><20081208172732.8EAED500003@mailgw2.ericsson.se><493E3657.1020204@ericsson.com><200812091526.mB9FQ7oG009911@sj-core-2.cisco.com><8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com><493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> <493FC71C.4070603@ericsson.com> Message-Id: <7DD4902E-DB80-408C-B8B6-6B3AA302C79D@cisco.com> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Wed, 10 Dec 2008 08:21:33 -0700 X-Mailer: Apple Mail (2.929.2) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=416; t=1228922503; x=1229786503; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fluffy@cisco.com; z=From:=20Cullen=20Jennings=20 |Subject:=20Re=3A=20[secdir]=20draft-ietf-avt-rtp-g719-04,= 20RTP=20Payload=20format=20=20for=20G.719 |Sender:=20; bh=gavLByj9wcppL3EtgeOEufU6NEmiPLrbVfpaVBLrSOg=; b=KfWUiumT8ZwjweWzhGG593ZvNpfEFlrdZ5jSetmraBkvXpi3JlWuPS+Eys ARPu34Wok/DwS/xHButrTwQbzAUlc3pd4k5fD5Ot0MTFRtWAF5L0YNM/eLRf VrSYWoOK8B; Authentication-Results: sj-dkim-4; header.From=fluffy@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: Roni Even , jon.peterson@neustar.biz, secdir@mit.edu, ingemar.s.johansson@ericsson.com, iesg@ietf.org, csp@csperkins.org, avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org On Dec 10, 2008, at 6:41 AM, Magnus Westerlund wrote: > My only question is if anyone thinks the second paragraph in 10.1 do > need included in the new note? I think it is a minor issue that has > very > short temporal importance and are fine leaving it out. I don't feel strongly but it seems like this is worth mentioning and let people figure out if it is an issues or not for their application. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 07:25:25 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 150893A6BB8; Wed, 10 Dec 2008 07:25:25 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B85B73A6BC2 for ; Wed, 10 Dec 2008 07:25:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.542 X-Spam-Level: X-Spam-Status: No, score=-106.542 tagged_above=-999 required=5 tests=[AWL=0.057, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KOimXCQjHKpo for ; Wed, 10 Dec 2008 07:25:18 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 135863A6BAE for ; Wed, 10 Dec 2008 07:25:14 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBAFP8NJ007948 for ; Wed, 10 Dec 2008 10:25:08 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBAFP51K007945 for ; Wed, 10 Dec 2008 10:25:05 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBAFOw3c011634 for ; Wed, 10 Dec 2008 10:24:58 -0500 (EST) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 361A812B1852 for ; Wed, 10 Dec 2008 10:24:37 -0500 (EST) X-IronPort-AV: E=Sophos;i="4.33,747,1220227200"; d="scan'208";a="113503886" Received: from sj-dkim-1.cisco.com ([171.71.179.21]) by sj-iport-2.cisco.com with ESMTP; 10 Dec 2008 15:24:36 +0000 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id mBAFOaAe001782; Wed, 10 Dec 2008 07:24:36 -0800 Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-5.cisco.com (8.13.8/8.13.8) with ESMTP id mBAFOXOg009314; Wed, 10 Dec 2008 15:24:34 GMT From: Cullen Jennings To: Magnus Westerlund In-Reply-To: <493FC71C.4070603@ericsson.com> Impp: xmpp:cullenfluffyjennings@jabber.org References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> <493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> <493FC71C.4070603@ericsson.com> Message-Id: <8733488E-E075-4B9C-9769-2575201AF38D@cisco.com> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Wed, 10 Dec 2008 08:24:25 -0700 X-Mailer: Apple Mail (2.929.2) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=5623; t=1228922676; x=1229786676; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fluffy@cisco.com; z=From:=20Cullen=20Jennings=20 |Subject:=20Re=3A=20[secdir]=20draft-ietf-avt-rtp-g719-04,= 20RTP=20Payload=20format=20=20for=20G.719 |Sender:=20; bh=dSmjcUGuLAAgr9UcwyrxfHAiE/q8VQraDlawRArNT9I=; b=BtUIjL5zv1L7GZFtEI1iZ+qlEeLod4Rm4TQHkL/m+f83u8lhUVaPlDsY0Z kNxEOfgZ/XayKfx3fc1Xki2HENGfZoANCIlh+cxUW0DmnQjcXETJcliQ1WcP 2jzTn3L3JXyJeu5M/2rP8iWVFLcjdjKRNd3DaWy6O1PnFtlszRqmc=; Authentication-Results: sj-dkim-1; header.From=fluffy@cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; ); X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mBAFP51K007945 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: Roni Even , secdir@mit.edu, "Ingemar Johansson S \(LU/EAB\)" , IESG IESG , Colin Perkins , avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I added an RFC Ed note with text below. If we decide to include the = second para of 10.1, let me know and I will add that too. On Dec 10, 2008, at 6:41 AM, Magnus Westerlund wrote: > Hi, > > So lets go with 5 this results in the following RFC-editor note: > > Section 10: > OLD: > > RTP packets using the payload format defined in this specification > are subject to the general security considerations discussed in RTP > [RFC3550] and any applicable profile such as AVP [RFC3551] or SAVP > [RFC3711]. As this format transports encoded audio, the main > security issues include confidentiality, integrity protection, and > data origin authentication of the audio itself. The payload format > itself does not have any built-in security mechanisms. Any suitable > external mechanisms, such as SRTP [RFC3711], MAY be used. > > This payload format and the G.719 decoder do not exhibit any > significant non-uniformity in the receiver-side computational > complexity for packet processing, and thus are unlikely to pose a > denial-of-service threat due to the receipt of pathological data. > The payload format or the codec data does not contain any type of > active content such as scripts. > > 10.1. Confidentiality > > > In order to ensure confidentiality of the encoded audio, all audio > data bits MUST be encrypted. There is less need to encrypt the > payload header or the table of contents since they only carry > information about the frame type. This information could also be > useful to a third party, for example, for quality monitoring. > However, as there currently don't exist any mechanism supporting > differential protection, this behavior isn't expected to be = > supported > and requirement of the audio data will be what governs the = > protection > of the RTP payload. > > The use of interleaving in conjunction with encryption can have a > negative impact on confidentiality, for a short period of time. > Consider the following packets (in brackets) containing frame = > numbers > as indicated: {10, 14, 18}, {13, 17, 21}, {16, 20, 24} (a popular > continuous diagonal interleaving pattern). The originator wishes to > deny some participants the ability to hear material starting at time > 16. Simply changing the key on the packet with the timestamp at or > after 16, and denying that new key to those participants, does not > achieve this; frames 17, 18, and 21 have been supplied in prior > packets under the prior key, and error concealment may make the = > audio > intelligible at least as far as frame 18 or 19, and possibly = > further. > > 10.2. Authentication and Integrity > > > To authenticate the sender of the audio-stream, an external = > mechanism > MUST be used. It is RECOMMENDED that such a mechanism protects both > the complete RTP header and the payload (audio and data bits). Data > tampering by a man-in-the-middle attacker could replace audio = > content > and also result in erroneous depacketization/decoding that could > lower the audio quality. > > > NEW: > > RTP packets using the payload format defined in this specification > are subject to the security considerations discussed in the RTP > specification [RFC3550] , and in any applicable RTP profile. The > main security considerations for the RTP packet carrying the RTP > payload format defined within this memo are confidentiality, > integrity and source authenticity. Confidentiality is achieved by > encryption of the RTP payload. Integrity of the RTP packets through > suitable cryptographic integrity protection mechanism. = > Cryptographic > system may also allow the authentication of the source of the > payload. A suitable security mechanism for this RTP payload format > should provide confidentiality, integrity protection and at least > source authentication capable of determining if an RTP packet is = > from > a member of the RTP session or not. > > Note that the appropriate mechanism to provide security to RTP and > payloads following this memo may vary. It is dependent on the > application, the transport, and the signalling protocol employed. > Therefore a single mechanism is not sufficient, although if suitable > the usage of SRTP [RFC3711] is recommended. Other mechanism that = > may > be used are IPsec [RFC4301] and TLS [RFC5246] (RTP over TCP), but > also other alternatives may exist. > > This RTP payload format and its media decoder do not exhibit any > significant non-uniformity in the receiver-side computational > complexity for packet processing, and thus are unlikely to pose a > denial-of-service threat due to the receipt of pathological data. > Nor does the RTP payload format contain any active content. > > > My only question is if anyone thinks the second paragraph in 10.1 do > need included in the new note? I think it is a minor issue that has = > very > short temporal importance and are fine leaving it out. > > Cheers > > Magnus Westerlund > > IETF Transport Area Director & TSVWG Chair > ---------------------------------------------------------------------- > Multimedia Technologies, Ericsson Research EAB/TVM > ---------------------------------------------------------------------- > Ericsson AB | Phone +46 10 7148287 > F=E4r=F6gatan 6 | Mobile +46 73 0949079 > SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com > ---------------------------------------------------------------------- _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 16:11:50 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 703B63A6C13; Wed, 10 Dec 2008 16:11:50 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 08B3B3A69F4 for ; Wed, 10 Dec 2008 16:11:49 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=2.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xEUWgqh-c06k for ; Wed, 10 Dec 2008 16:11:47 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id AD7B73A67C1 for ; Wed, 10 Dec 2008 16:11:47 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBB0BfiE005235 for ; Wed, 10 Dec 2008 19:11:41 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBB0BYBf005225 for ; Wed, 10 Dec 2008 19:11:34 -0500 Received: from mit.edu (M24-004-BARRACUDA-1.MIT.EDU [18.7.7.111]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBB0BTRx020298 for ; Wed, 10 Dec 2008 19:11:29 -0500 (EST) Received: from vms173007pub.verizon.net (vms173007pub.verizon.net [206.46.173.7]) by mit.edu (Spam Firewall) with ESMTP id 2986BC8574D for ; Wed, 10 Dec 2008 19:11:12 -0500 (EST) Received: from [192.168.1.3] ([71.191.34.86]) by vms173007.mailsrvcs.net (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPA id <0KBO00ID0R4GHQO0@vms173007.mailsrvcs.net> for secdir@mit.edu; Wed, 10 Dec 2008 18:10:02 -0600 (CST) Date: Wed, 10 Dec 2008 19:11:30 -0500 From: Tim Polk In-reply-to: <8733488E-E075-4B9C-9769-2575201AF38D@cisco.com> To: Cullen Jennings Message-id: <31B503ED-4151-406C-A1D9-2F185CDBACAF@nist.gov> MIME-version: 1.0 (Apple Message framework v753.1) X-Mailer: Apple Mail (2.753.1) References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> <493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> <493FC71C.4070603@ericsson.com> <8733488E-E075-4B9C-9769-2575201AF38D@cisco.com> X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mBB0BYBf005225 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: Roni Even , Magnus Westerlund , secdir@mit.edu, "Ingemar Johansson S \(LU/EAB\)" , IESG IESG , Colin Perkins , avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Sorry to be late to the party on this one, but it shouldn't be a = problem since I agree with everything so far... That is, I prefer this strategy (following the template in avt-rtp- = howto) and am happy with the text. I am only chiming in to say I think the text in the second paragraph of 10.1 = *is* important to a small number of applications, and suggest keeping that text in the RFC Editor Note. Tim On Dec 10, 2008, at 10:24 AM, Cullen Jennings wrote: > > I added an RFC Ed note with text below. If we decide to include the = > second para of 10.1, let me know and I will add that too. > > On Dec 10, 2008, at 6:41 AM, Magnus Westerlund wrote: > >> Hi, >> >> So lets go with 5 this results in the following RFC-editor note: >> >> Section 10: >> OLD: >> >> RTP packets using the payload format defined in this specification >> are subject to the general security considerations discussed in RTP >> [RFC3550] and any applicable profile such as AVP [RFC3551] or SAVP >> [RFC3711]. As this format transports encoded audio, the main >> security issues include confidentiality, integrity protection, and >> data origin authentication of the audio itself. The payload format >> itself does not have any built-in security mechanisms. Any = >> suitable >> external mechanisms, such as SRTP [RFC3711], MAY be used. >> >> This payload format and the G.719 decoder do not exhibit any >> significant non-uniformity in the receiver-side computational >> complexity for packet processing, and thus are unlikely to pose a >> denial-of-service threat due to the receipt of pathological data. >> The payload format or the codec data does not contain any type of >> active content such as scripts. >> >> 10.1. Confidentiality >> >> >> In order to ensure confidentiality of the encoded audio, all audio >> data bits MUST be encrypted. There is less need to encrypt the >> payload header or the table of contents since they only carry >> information about the frame type. This information could also be >> useful to a third party, for example, for quality monitoring. >> However, as there currently don't exist any mechanism supporting >> differential protection, this behavior isn't expected to be = >> supported >> and requirement of the audio data will be what governs the = >> protection >> of the RTP payload. >> >> The use of interleaving in conjunction with encryption can have a >> negative impact on confidentiality, for a short period of time. >> Consider the following packets (in brackets) containing frame = >> numbers >> as indicated: {10, 14, 18}, {13, 17, 21}, {16, 20, 24} (a popular >> continuous diagonal interleaving pattern). The originator = >> wishes to >> deny some participants the ability to hear material starting at = >> time >> 16. Simply changing the key on the packet with the timestamp at or >> after 16, and denying that new key to those participants, does not >> achieve this; frames 17, 18, and 21 have been supplied in prior >> packets under the prior key, and error concealment may make the = >> audio >> intelligible at least as far as frame 18 or 19, and possibly = >> further. >> >> 10.2. Authentication and Integrity >> >> >> To authenticate the sender of the audio-stream, an external = >> mechanism >> MUST be used. It is RECOMMENDED that such a mechanism protects = >> both >> the complete RTP header and the payload (audio and data bits). = >> Data >> tampering by a man-in-the-middle attacker could replace audio = >> content >> and also result in erroneous depacketization/decoding that could >> lower the audio quality. >> >> >> NEW: >> >> RTP packets using the payload format defined in this specification >> are subject to the security considerations discussed in the RTP >> specification [RFC3550] , and in any applicable RTP profile. The >> main security considerations for the RTP packet carrying the RTP >> payload format defined within this memo are confidentiality, >> integrity and source authenticity. Confidentiality is achieved by >> encryption of the RTP payload. Integrity of the RTP packets = >> through >> suitable cryptographic integrity protection mechanism. = >> Cryptographic >> system may also allow the authentication of the source of the >> payload. A suitable security mechanism for this RTP payload format >> should provide confidentiality, integrity protection and at least >> source authentication capable of determining if an RTP packet is = >> from >> a member of the RTP session or not. >> >> Note that the appropriate mechanism to provide security to RTP and >> payloads following this memo may vary. It is dependent on the >> application, the transport, and the signalling protocol employed. >> Therefore a single mechanism is not sufficient, although if = >> suitable >> the usage of SRTP [RFC3711] is recommended. Other mechanism = >> that may >> be used are IPsec [RFC4301] and TLS [RFC5246] (RTP over TCP), but >> also other alternatives may exist. >> >> This RTP payload format and its media decoder do not exhibit any >> significant non-uniformity in the receiver-side computational >> complexity for packet processing, and thus are unlikely to pose a >> denial-of-service threat due to the receipt of pathological data. >> Nor does the RTP payload format contain any active content. >> >> >> My only question is if anyone thinks the second paragraph in 10.1 do >> need included in the new note? I think it is a minor issue that = >> has very >> short temporal importance and are fine leaving it out. >> >> Cheers >> >> Magnus Westerlund >> >> IETF Transport Area Director & TSVWG Chair >> --------------------------------------------------------------------- = >> - >> Multimedia Technologies, Ericsson Research EAB/TVM >> --------------------------------------------------------------------- = >> - >> Ericsson AB | Phone +46 10 7148287 >> F=E4r=F6gatan 6 | Mobile +46 73 0949079 >> SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com >> --------------------------------------------------------------------- = >> - > _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 10 18:52:57 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE60C3A684B; Wed, 10 Dec 2008 18:52:57 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2AA9C3A684B for ; Wed, 10 Dec 2008 18:52:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.549 X-Spam-Level: X-Spam-Status: No, score=-106.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TY4g5Dil6uEl for ; Wed, 10 Dec 2008 18:52:56 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id D8A9A3A67B4 for ; Wed, 10 Dec 2008 18:52:55 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBB2qncx026843 for ; Wed, 10 Dec 2008 21:52:49 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBB2qidC026837 for ; Wed, 10 Dec 2008 21:52:44 -0500 Received: from mit.edu (W92-130-BARRACUDA-1.MIT.EDU [18.7.21.220]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBB2qcAX027350 for ; Wed, 10 Dec 2008 21:52:38 -0500 (EST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 94447CBD44B for ; Wed, 10 Dec 2008 21:52:17 -0500 (EST) X-IronPort-AV: E=Sophos;i="4.33,749,1220227200"; d="scan'208";a="210761539" Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-6.cisco.com with ESMTP; 11 Dec 2008 02:51:46 +0000 Received: from sj-core-2.cisco.com (sj-core-2.cisco.com [171.71.177.254]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id mBB2piuI020083; Wed, 10 Dec 2008 18:51:44 -0800 Received: from [192.168.4.177] (rcdn-fluffy-8711.cisco.com [10.99.9.18]) by sj-core-2.cisco.com (8.13.8/8.13.8) with ESMTP id mBB2pfiu006821; Thu, 11 Dec 2008 02:51:41 GMT From: Cullen Jennings To: Tim Polk , Magnus Westerlund In-Reply-To: <31B503ED-4151-406C-A1D9-2F185CDBACAF@nist.gov> Impp: xmpp:cullenfluffyjennings@jabber.org References: <200812080137.mB81bm2G027217@localhost.localdomain> <493CE19D.3020107@ericsson.com> <20081208172732.8EAED500003@mailgw2.ericsson.se> <493E3657.1020204@ericsson.com> <200812091526.mB9FQ7oG009911@sj-core-2.cisco.com> <8F7CB34E-C6C1-4A07-B34F-CCB0909036A7@cisco.com> <493ecfdf.02a1660a.74b2.ffffc782@mx.google.com> <493FC71C.4070603@ericsson.com> <8733488E-E075-4B9C-9769-2575201AF38D@cisco.com> <31B503ED-4151-406C-A1D9-2F185CDBACAF@nist.gov> Message-Id: <019B8266-3D32-4991-9B9E-D4A20E4B0D0D@cisco.com> Mime-Version: 1.0 (Apple Message framework v929.2) Date: Wed, 10 Dec 2008 19:51:35 -0700 X-Mailer: Apple Mail (2.929.2) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=6663; t=1228963904; x=1229827904; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fluffy@cisco.com; z=From:=20Cullen=20Jennings=20 |Subject:=20Re=3A=20[secdir]=20draft-ietf-avt-rtp-g719-04,= 20RTP=20Payload=20format=20=20for=20G.719 |Sender:=20; bh=T1ZI2aNQlCSSEJyOPmnWx80MrF+nL04MzqzJqefF/o0=; b=qv29gmYSRxKzzBdcvcLVdmQt4jWIssIF8HOSBtNXvbXcJtJxqFCiF+L1oF 665K1zQ9aJokLQf0yyfoyQ2SpHosn2vQXMoJS4mH3W36NFFG1uFSEpj+rsOO 6c3awn+wfu; Authentication-Results: sj-dkim-2; header.From=fluffy@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mBB2qidC026837 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: Roni Even , secdir@mit.edu, "Ingemar Johansson S \(LU/EAB\)" , IESG IESG , Colin Perkins , avt-chairs@tools.ietf.org Subject: Re: [secdir] draft-ietf-avt-rtp-g719-04, RTP Payload format for G.719 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I put the text into the RFC Ed Note. - Tim, Magnus, and others, have = a read of the note and make sure I did not mess it up. On Dec 10, 2008, at 5:11 PM, Tim Polk wrote: > Sorry to be late to the party on this one, but it shouldn't be a = > problem since I agree with everything so far... > > That is, I prefer this strategy (following the template in avt-rtp- = > howto) and am happy with the text. I am only > chiming in to say I think the text in the second paragraph of 10.1 = > *is* important to a small number of > applications, and suggest keeping that text in the RFC Editor Note. > > Tim > > On Dec 10, 2008, at 10:24 AM, Cullen Jennings wrote: > >> >> I added an RFC Ed note with text below. If we decide to include the = >> second para of 10.1, let me know and I will add that too. >> >> On Dec 10, 2008, at 6:41 AM, Magnus Westerlund wrote: >> >>> Hi, >>> >>> So lets go with 5 this results in the following RFC-editor note: >>> >>> Section 10: >>> OLD: >>> >>> RTP packets using the payload format defined in this specification >>> are subject to the general security considerations discussed in RTP >>> [RFC3550] and any applicable profile such as AVP [RFC3551] or SAVP >>> [RFC3711]. As this format transports encoded audio, the main >>> security issues include confidentiality, integrity protection, and >>> data origin authentication of the audio itself. The payload format >>> itself does not have any built-in security mechanisms. Any = >>> suitable >>> external mechanisms, such as SRTP [RFC3711], MAY be used. >>> >>> This payload format and the G.719 decoder do not exhibit any >>> significant non-uniformity in the receiver-side computational >>> complexity for packet processing, and thus are unlikely to pose a >>> denial-of-service threat due to the receipt of pathological data. >>> The payload format or the codec data does not contain any type of >>> active content such as scripts. >>> >>> 10.1. Confidentiality >>> >>> >>> In order to ensure confidentiality of the encoded audio, all audio >>> data bits MUST be encrypted. There is less need to encrypt the >>> payload header or the table of contents since they only carry >>> information about the frame type. This information could also be >>> useful to a third party, for example, for quality monitoring. >>> However, as there currently don't exist any mechanism supporting >>> differential protection, this behavior isn't expected to be = >>> supported >>> and requirement of the audio data will be what governs the = >>> protection >>> of the RTP payload. >>> >>> The use of interleaving in conjunction with encryption can have a >>> negative impact on confidentiality, for a short period of time. >>> Consider the following packets (in brackets) containing frame = >>> numbers >>> as indicated: {10, 14, 18}, {13, 17, 21}, {16, 20, 24} (a popular >>> continuous diagonal interleaving pattern). The originator wishes = >>> to >>> deny some participants the ability to hear material starting at = >>> time >>> 16. Simply changing the key on the packet with the timestamp at or >>> after 16, and denying that new key to those participants, does not >>> achieve this; frames 17, 18, and 21 have been supplied in prior >>> packets under the prior key, and error concealment may make the = >>> audio >>> intelligible at least as far as frame 18 or 19, and possibly = >>> further. >>> >>> 10.2. Authentication and Integrity >>> >>> >>> To authenticate the sender of the audio-stream, an external = >>> mechanism >>> MUST be used. It is RECOMMENDED that such a mechanism protects = >>> both >>> the complete RTP header and the payload (audio and data bits). = >>> Data >>> tampering by a man-in-the-middle attacker could replace audio = >>> content >>> and also result in erroneous depacketization/decoding that could >>> lower the audio quality. >>> >>> >>> NEW: >>> >>> RTP packets using the payload format defined in this specification >>> are subject to the security considerations discussed in the RTP >>> specification [RFC3550] , and in any applicable RTP profile. The >>> main security considerations for the RTP packet carrying the RTP >>> payload format defined within this memo are confidentiality, >>> integrity and source authenticity. Confidentiality is achieved by >>> encryption of the RTP payload. Integrity of the RTP packets = >>> through >>> suitable cryptographic integrity protection mechanism. = >>> Cryptographic >>> system may also allow the authentication of the source of the >>> payload. A suitable security mechanism for this RTP payload format >>> should provide confidentiality, integrity protection and at least >>> source authentication capable of determining if an RTP packet is = >>> from >>> a member of the RTP session or not. >>> >>> Note that the appropriate mechanism to provide security to RTP and >>> payloads following this memo may vary. It is dependent on the >>> application, the transport, and the signalling protocol employed. >>> Therefore a single mechanism is not sufficient, although if = >>> suitable >>> the usage of SRTP [RFC3711] is recommended. Other mechanism that = >>> may >>> be used are IPsec [RFC4301] and TLS [RFC5246] (RTP over TCP), but >>> also other alternatives may exist. >>> >>> This RTP payload format and its media decoder do not exhibit any >>> significant non-uniformity in the receiver-side computational >>> complexity for packet processing, and thus are unlikely to pose a >>> denial-of-service threat due to the receipt of pathological data. >>> Nor does the RTP payload format contain any active content. >>> >>> >>> My only question is if anyone thinks the second paragraph in 10.1 do >>> need included in the new note? I think it is a minor issue that = >>> has very >>> short temporal importance and are fine leaving it out. >>> >>> Cheers >>> >>> Magnus Westerlund >>> >>> IETF Transport Area Director & TSVWG Chair >>> ---------------------------------------------------------------------- >>> Multimedia Technologies, Ericsson Research EAB/TVM >>> ---------------------------------------------------------------------- >>> Ericsson AB | Phone +46 10 7148287 >>> F=E4r=F6gatan 6 | Mobile +46 73 0949079 >>> SE-164 80 Stockholm, Sweden| mailto: magnus.westerlund@ericsson.com >>> ---------------------------------------------------------------------- >> > _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 11 00:33:14 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 542923A6A29; Thu, 11 Dec 2008 00:33:14 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A82133A6A29 for ; Thu, 11 Dec 2008 00:33:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YltWLCLPW7ER for ; Thu, 11 Dec 2008 00:33:12 -0800 (PST) Received: from smtp-dub.microsoft.com (smtp-dub.microsoft.com [213.199.138.181]) by core3.amsl.com (Postfix) with ESMTP id 6CCDF3A69CA for ; Thu, 11 Dec 2008 00:33:12 -0800 (PST) Received: from DUB-EXHUB-C301.europe.corp.microsoft.com (65.53.213.91) by DUB-EXGWY-E802.partners.extranet.microsoft.com (10.251.129.2) with Microsoft SMTP Server (TLS) id 8.1.291.1; Thu, 11 Dec 2008 08:32:58 +0000 Received: from EA-EXMSG-C332.europe.corp.microsoft.com ([169.254.1.53]) by DUB-EXHUB-C301.europe.corp.microsoft.com ([65.53.213.91]) with mapi; Thu, 11 Dec 2008 08:32:55 +0000 From: Stefan Santesson To: "secdir-secretary@mit.edu" , "secdir@ietf.org" Date: Thu, 11 Dec 2008 08:32:32 +0000 Thread-Topic: [secdir] Assignments for Dec 9/13 - review of draft-ietf-pkix-ecc-subpubkeyinfo-10 Thread-Index: AclX2H8PDAHG8gNdQf23eIV4eyRd5ADkkM/Q Message-ID: <9F11911AED01D24BAA1C2355723C3D321AB5BBBE29@EA-EXMSG-C332.europe.corp.microsoft.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 Subject: Re: [secdir] Assignments for Dec 9/13 - review of draft-ietf-pkix-ecc-subpubkeyinfo-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Sam, You can clear me from draft-ietf-pkix-ecc-subpubkeyinfo-10. I'm the WG document shepherd for this draft and I have already provided my feedback to the AD and the editors. Stefan Santesson Senior Program Manager Windows Security, Standards > -----Original Message----- > From: secdir-bounces@ietf.org [mailto:secdir-bounces@ietf.org] On > Behalf Of Samuel Weiler > Sent: den 6 december 2008 20:09 > To: secdir@ietf.org > Subject: [secdir] Assignments for Dec 9/13 > > There is another telechat this coming week. > > Glen Zorn is next in the rotation. > > Review instructions and related resources are at: > http://tools.ietf.org/area/sec/trac/wiki/SecDirReview > > -- Sam > > > For telechat this week (review by 2008-12-09) > > Alan DeKok T draft-ietf-mext-nemo-v4traversal-06 > Shawn Emery T draft-ietf-nfsv4-rfc1831bis-10 > Love Hornquist-Astrand T draft-ietf-tcpm-rfc4138bis-04 > Marcus Leech T draft-housley-internet-draft-sig- > file-06 > Hilarie Orman TR draft-ietf-pce-path-key-05 > Hilarie Orman T draft-ietf-avt-rtp-g719-04 > Joe Salowey T draft-ietf-mpls-te-scaling-analysis- > 04 > Carl Wallace T draft-ietf-isis-hmac-sha-07 > Carl Wallace T draft-melnikov-imapext-filters-07 > > For telechat 2009-01-06 > > Larry Zhu T draft-arkko-arp-iana-rules-05 > > Last calls and special requests: > > Rob Austein draft-ietf-dime-qos-parameters-07 > Pat Cain draft-ietf-geopriv-pdif-lo-profile-14 > Ran Canetti draft-ietf-kitten-gssapi-channel- > bindings-05 > Phillip Hallam-Baker draft-ietf-radext-design-05 > Steve Hanna R draft-kucherawy-sender-auth-header-18 > Steve Hanna draft-ietf-radext-management- > authorization-06 > David Harrington draft-ietf-sip-saml-05 > Paul Hoffman draft-ietf-smime-3851bis-08 > Jeffrey Hutzelman draft-ietf-tcpm-tcp-uto-10 > Scott Kelly draft-ietf-tsvwg-rsvp-proxy- > approaches-06 > Stephen Kent draft-ietf-tsvwg-rsvp-proxy-proto-07 > Tero Kivinen R draft-ietf-softwire-encaps-safi-03 > Julien Laganier draft-ietf-softwire-mesh-framework-05 > Julien Laganier draft-ietf-softwire-encaps-ipsec-01 > Julien Laganier R draft-ietf-softwire-v4nlri-v6nh-01 > Catherine Meadows draft-ietf-speechsc-mrcpv2-17 > Catherine Meadows draft-ietf-l2tpext-tdm-06 > Alexey Melnikov draft-ietf-pce-pcep-xro-06 > Sandy Murphy draft-ietf-mpls-mpls-and-gmpls- > security-framework-04 > Vidya Narayanan draft-ietf-sip-saml-05 > Magnus Nystrom draft-freed-sieve-ihave-03 > Eric Rescorla draft-wing-sipping-srtp-key-04 > Eric Rescorla draft-ietf-dkim-ssp-07 > Stefan Santesson draft-ietf-pkix-ecc-subpubkeyinfo-10 > Susan Thomson draft-loreto-simple-im-srv-label-02 > Hannes Tschofenig draft-ietf-trill-prob-05 > Sean Turner draft-mammoliti-l2tp-accessline-avp- > 04 > Sam Weiler draft-chown-v6ops-rogue-ra-02 > Brian Weis draft-ietf-isis-wg-extlsp-04 > Brian Weis draft-ietf-sieve-mime-loop-08 > Nico Williams draft-ietf-v6ops-ra-guard-01 > Nico Williams draft-ietf-smime-3850bis-08 > Tom Yu draft-korhonen-mip4-service-06 > Kurt Zeilenga draft-ietf-softwire-bgp-te-attribute- > 03 > Larry Zhu draft-thaler-v6ops-teredo-extensions- > 02 > Larry Zhu draft-ietf-softwire-hs-framework- > l2tpv2-10 > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 11 07:21:28 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 55DBF3A68AA; Thu, 11 Dec 2008 07:21:28 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 11EF13A67D9; Thu, 11 Dec 2008 07:21:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.099 X-Spam-Level: X-Spam-Status: No, score=-3.099 tagged_above=-999 required=5 tests=[AWL=-0.500, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NJbVWVulrgH6; Thu, 11 Dec 2008 07:21:26 -0800 (PST) Received: from boole.openldap.org (boole.openldap.org [IPv6:2001:4f8:3:ba:2e0:18ff:fe02:efec]) by core3.amsl.com (Postfix) with ESMTP id C75043A689F; Thu, 11 Dec 2008 07:21:24 -0800 (PST) Received: from [192.168.1.101] (75-141-233-128.dhcp.nv.charter.com [75.141.233.128] (may be forged)) (authenticated bits=0) by boole.openldap.org (8.13.8/8.13.8) with ESMTP id mBBFL0tE026829 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Thu, 11 Dec 2008 15:21:05 GMT (envelope-from Kurt.Zeilenga@Isode.com) Message-Id: From: Kurt Zeilenga To: The IESG , dward@cisco.com, alain_durand@cable.comcast.com Mime-Version: 1.0 (Apple Message framework v929.2) Date: Thu, 11 Dec 2008 07:21:00 -0800 X-Mailer: Apple Mail (2.929.2) Cc: hbrahim@nortel.com, yakov@juniper.com, dwfedyk@nortel.com, softwires@ietf.org, secdir@ietf.org Subject: [secdir] secdir review of draft-ietf-softwire-bgp-te-attribute X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document (-03) as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This I-D defines a new BGP attribute to carry traffic engineering information. While it seems true that the introduction of this attribute doesn't change the underlying security issues of BGP, it might be appropriate to provide a reference to where BGP security considerations are discussed. That is, suggest adding: "BGP security considerations are discussed in RFC 4271". And something like "Traffic Engineering security considerations are discussed in RFC XXXX" would also be useful. Regards, Kurt _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Fri Dec 12 22:11:41 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A70F93A687D; Fri, 12 Dec 2008 22:11:41 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BFAB928C0E3 for ; Fri, 12 Dec 2008 22:11:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JkcWwJA9HVcX for ; Fri, 12 Dec 2008 22:11:39 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id C51563A67F6 for ; Fri, 12 Dec 2008 22:11:39 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.2) with ESMTP id mBD6BWd8026189 for ; Sat, 13 Dec 2008 01:11:32 -0500 (EST) (envelope-from weiler+secdir@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.2/Submit) with ESMTP id mBD6BWbk026185 for ; Sat, 13 Dec 2008 01:11:32 -0500 (EST) (envelope-from weiler+secdir@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Sat, 13 Dec 2008 01:11:32 -0500 (EST) From: Samuel Weiler X-X-Sender: weiler@fledge.watson.org To: secdir@ietf.org Message-ID: User-Agent: Alpine 1.10 (BSF 962 2008-03-14) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Sat, 13 Dec 2008 01:11:32 -0500 (EST) Subject: [secdir] assignments for Dec 16th/20th X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org There's ANOTHER telechat this coming week (yes, that's three weeks in a row). Plus eleven new last call assignments. Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Donald Eastlake is next in the rotation. -- Sam For telechat 2008-12-16 Alan DeKok T draft-ietf-mext-nemo-v4traversal-06 Steve Hanna TR draft-kucherawy-sender-auth-header-18 Paul Hoffman T draft-ietf-smime-3851bis-08 Jeffrey Hutzelman T draft-ietf-tcpm-tcp-uto-10 Stefan Santesson T draft-ietf-pkix-ecc-subpubkeyinfo-11 Nico Williams T draft-ietf-smime-3850bis-08 For telechat 2009-01-06 Larry Zhu T draft-arkko-arp-iana-rules-05 Last calls and special requests: Derek Atkins draft-ietf-avt-post-repair-rtcp-xr-04 Rob Austein draft-ietf-dime-qos-parameters-07 Rob Austein draft-ietf-idr-rfc3392bis-02 Richard Barnes draft-ietf-mmusic-file-transfer-mech-09 Uri Blumenthal draft-ietf-ospf-manet-mdr-03 Pat Cain draft-ietf-geopriv-pdif-lo-profile-14 Pat Cain draft-ietf-ospf-manet-mpr-03 Ran Canetti draft-ietf-ospf-manet-or-01 Charles Clancy draft-ietf-pce-dste-02 Dave Cridland draft-ietf-pce-of-05 Alan DeKok draft-ietf-roll-home-routing-reqs-06 Lakshminath Dondeti draft-ietf-speermint-terminology-17 Phillip Hallam-Baker draft-ietf-radext-design-05 Steve Hanna draft-ietf-radext-management-authorization-06 Scott Kelly draft-ietf-tsvwg-rsvp-proxy-approaches-06 Stephen Kent draft-ietf-tsvwg-rsvp-proxy-proto-07 Tero Kivinen R draft-ietf-softwire-encaps-safi-03 Julien Laganier draft-ietf-softwire-mesh-framework-05 Julien Laganier draft-ietf-softwire-encaps-ipsec-01 Julien Laganier R draft-ietf-softwire-v4nlri-v6nh-01 Catherine Meadows draft-ietf-speechsc-mrcpv2-17 Catherine Meadows draft-ietf-l2tpext-tdm-06 Alexey Melnikov draft-ietf-pce-pcep-xro-06 Sandy Murphy draft-ietf-mpls-mpls-and-gmpls-security-framework-04 Vidya Narayanan draft-ietf-sip-saml-05 Eric Rescorla draft-wing-sipping-srtp-key-04 Eric Rescorla draft-ietf-dkim-ssp-07 Susan Thomson draft-loreto-simple-im-srv-label-02 Hannes Tschofenig draft-ietf-trill-prob-05 Sean Turner draft-mammoliti-l2tp-accessline-avp-04 Sam Weiler draft-chown-v6ops-rogue-ra-02 Brian Weis draft-ietf-isis-wg-extlsp-04 Brian Weis draft-ietf-sieve-mime-loop-08 Nico Williams draft-ietf-v6ops-ra-guard-01 Tom Yu draft-korhonen-mip4-service-06 Larry Zhu draft-thaler-v6ops-teredo-extensions-02 Larry Zhu draft-ietf-softwire-hs-framework-l2tpv2-10 Glen Zorn draft-andreasen-sipping-rfc3603bis-07 _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 14 09:30:56 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B8BE3A6781; Sun, 14 Dec 2008 09:30:56 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E7BB3A69FE; Fri, 12 Dec 2008 15:25:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.345 X-Spam-Level: X-Spam-Status: No, score=-5.345 tagged_above=-999 required=5 tests=[AWL=0.702, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S9Rh0xn6NXFp; Fri, 12 Dec 2008 15:25:57 -0800 (PST) Received: from sca-ea-mail-4.sun.com (sca-ea-mail-4.Sun.COM [192.18.43.22]) by core3.amsl.com (Postfix) with ESMTP id AB3413A695E; Fri, 12 Dec 2008 15:25:57 -0800 (PST) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id mBCNPpea028531; Fri, 12 Dec 2008 23:25:51 GMT Received: from [10.7.250.168] (punchin-client-10-7-250-168.SFBay.Sun.COM [10.7.250.168]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id mBCNPmcP846681; Fri, 12 Dec 2008 15:25:49 -0800 (PST) Message-ID: <4942F2FC.40702@sun.com> Date: Fri, 12 Dec 2008 16:25:48 -0700 From: Robert Thurlow User-Agent: Thunderbird 2.0.0.16 (X11/20080811) MIME-Version: 1.0 To: "Shawn M. Emery" References: <493D6E18.7010701@sun.com> In-Reply-To: <493D6E18.7010701@sun.com> X-Mailman-Approved-At: Sun, 14 Dec 2008 09:30:54 -0800 Cc: nfsv4-chairs@tools.ietf.org, iesg@ietf.org, draft-ietf-nfsv4-rfc1831bis@tools.ietf.org, secdir@ietf.org Subject: Re: [secdir] Review of draft-ietf-nfsv4-rfc1831bis-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Shawn M. Emery wrote: > Editorial comment(s): > > s/them in future/them in the future/ > s/minimum, the/a minimum, the/ > s/in future/in the future/ > s/to used on/to be used on/ Hi Shawn, Thanks for the review, I have made the editorial changes as suggested and will put them in draft 11. Rob T _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 14 09:30:56 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19A1B3A67AE; Sun, 14 Dec 2008 09:30:56 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A2B63A6822; Sat, 13 Dec 2008 07:20:09 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.372 X-Spam-Level: X-Spam-Status: No, score=-2.372 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, SARE_SUB_OBFU_Q1=0.227] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PxZZeWGmrgkY; Sat, 13 Dec 2008 07:20:08 -0800 (PST) Received: from scorpius.cttc.es (scorpius.cttc.es [84.88.62.197]) by core3.amsl.com (Postfix) with ESMTP id 9745D3A696C; Sat, 13 Dec 2008 07:20:07 -0800 (PST) Received: from castor (postfix@castor.cttc.es [84.88.62.196]) by scorpius.cttc.es (8.13.8/8.13.5) with ESMTP id mBDFIGBt024624; Sat, 13 Dec 2008 16:18:16 +0100 Received: from [127.0.0.1] (248.Red-88-3-156.dynamicIP.rima-tde.net [88.3.156.248]) by castor (Postfix) with ESMTP id 1E20F2FC1C9; Sat, 13 Dec 2008 16:18:15 +0100 (CET) Message-ID: <4943D271.1050808@cttc.es> Date: Sat, 13 Dec 2008 16:19:13 +0100 From: Mischa Dohler User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Sandra Murphy References: In-Reply-To: X-Antivirus: avast! (VPS 081212-0, 12/12/2008), Outbound message X-Antivirus-Status: Clean X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (castor); Sat, 13 Dec 2008 16:18:16 +0100 (CET) X-Scanned-By: MIMEDefang 2.57 on 84.88.62.197 X-Mailman-Approved-At: Sun, 14 Dec 2008 09:30:54 -0800 Cc: thomas.watteyne@ieee.org, Dominique.Barthel@orange-ftgroup.com, secdir@ietf.org, tim.winter@ekasystems.com, iesg@ietf.org, christian.jacquenet@orange-ftgroup.com, roll-chairs@tools.ietf.org Subject: Re: [secdir] secdir review of draft-ietf-roll-urban-routing-reqs-02 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Dear Sandra, Many thanks for having taken your time to read and comment on the document. You can find my comments in-line. I would expect that my co-authors will also reply asap. (Tim, I think you need to have a look at this since it mainly relates to the part written by you. Thanks!) Thanks and kind regards, Mischa. _____________________________ Dr Mischa Dohler Senior Researcher CTTC, Barcelona Tel: +34 93 645 2900 Fax: +34 93 645 2901 Mob: +34 6 7909 4007 www.cttc.es/home/mdohler _____________________________ Sandra Murphy wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG. > These comments were written primarily for the benefit of the security > area directors. Document editors and WG chairs should treat these > comments just like any other last call comments. > > The document covers the requirements for routing in low power and lossy > networks in urban environments. It covers the basics of that territory, > defining terms and limitations of the networks being considered, and the > requirements that produces for routing in that setting. > > > The security considerations section covers the services that one would > expect to see covered. Unfortunately, I was continually confused as to > whether the discussion of security requirements was focused on the > security of the routing or the security of the data that was being routed. MISCHA: I am not sure I understand this confusion. We are ultimately interested in securing the data. If this involves securing the route, the establishment of the route, the maintenance of the route, among others, so be it. Generally, since we are dealing with routing specs in this document, we have tried to focus the security requirements on everything related to routing. However, in the introduction of the document, we have possibly alluded to more general security considerations too (which is maybe why you got confused). > > The following text from the security considerations section is an example: > > A secure communication in a wireless network encompasses three main > elements, i.e. confidentiality (encryption of data), integrity > (correctness of data), and authentication (legitimacy of data). > > Authentication can e.g. be violated if external sources insert > incorrect data packets; integrity can e.g. be violated if nodes start > to break down and hence commence measuring and relaying data > incorrectly. Nonetheless, some sensor readings as well as the > actuator control signals need to be confidential. > > There are concerns in routing protocols about the authenticity and > integrity of the contents of the routing protocol messages - the > *control* data, not the sensor and actuator data. A need for > confidentiality of the routing protocol message content is not as > generally accepted, and this paragraph seems to be considering the > confidentiality of the data traffic, not the control traffic. MISCHA: This section had been written by Tim Winters, so he will be of greater help to reply. > > Later the focus returns to the security of the routing protocol itself: > > The U-LLN MUST be protected against attempts to inject false or > modified packets. For example, an attacker SHOULD be prevented from > manipulating or disabling the routing function by compromising > routing update messages. Moreover, it SHOULD NOT be possible to > coerce the network into routing packets which have been modified in > transit. To this end the routing protocol(s) MUST support message > integrity. > > The impact on availability of the forwarding service is typically a > concern for routing protocols and is not mentioned here. Can routing > produce a data traffic forwarding path that loops? Can the routing > protocol be subverted to the point that routing protocol messages are > consuming the available resources? Etc. MISCHA: I am confused in how your text relates to our text cited above. Are you proposing additions or modifications, or is it just a list of loose comments? Tim, maybe you should add a paragraph covering these comments ... > > Mechanisms MUST be in place to deny any rogue node > which attempts to take advantage of self-configuration and self- > organization procedures. Such attacks may attempt, for example, to > cause denial of service, drain the energy of power constrained > devices, or to hijack the routing mechanism. A node MUST > authenticate itself to a trusted node that is already associated with > the U-LLN before any self-configuration or self-organization is > allowed to proceed. > > > This seems to be addressing the possibility of a legitimate node > behaving badly. But the requirement that a node must authenticate > itself only prevents bad behavior from outsiders, not insiders. MISCHA: In my understanding, this is what you can do with authentication. Other mechanisms are needed to cover the case you mentioned, even though it is a marginal scenario in my opinion. Further > comment - self-organization and self-configuration had previously > referred to configuration or organization of a network, not a single > node. Does this mean that a node must authenticate before it can > participate in the network self-organization? And of course the > chicken-and-egg problem - before the network has self-organized, how can > the nodes reach a trusted node. MISCHA: Yes, indeed, it is advantageous that a node authenticates first and then takes part in the organization process. Several authentication attempts are of course needed until each node reaches an authenticated node or is in its one-hop neighborhood, but this seems to be part of the game to facilitate a secure network. Must *every* node authenticate before > self-organization can proceed? Or does self-organization spread > outwards incrementally from the trusted node? > MISCHA: The former and the latter are not exclusive to me - I am not sure I understood correctly. > > With low computation power and scarce energy resources, U-LLNs nodes > may not be able to resist any attack from high-power malicious nodes > (e.g. laptops and strong radios). However, the amount of damage > generated to the whole network SHOULD be commensurate with the number > of nodes physically compromised. For example, an intruder taking > control over a single node SHOULD not have total access to, or be > able to completely deny service to the whole network. > > If a taken-over node does not have access to the whole network, how > could it have had access to the whole network before being taken over? > Subverted nodes generally are assumed to retain all their abilities, > which is why they are such a problem. This seems to be requiring that > no one node ever has access to the whole network. MISCHA: Good point! Tim, I think you should only leave the reference to "completely deny service to the whole network". > > > In the rest of the document: > > Routers are introduced, including the special category of LBR - > Some routers provide access to wider infrastructures, such as the > Internet, and are named Low power and lossy network Border Routers > (LBRs) in that context. > However, in the remainder of the document, the text refers to LBRs > everywhere in places where it sounds like they are referring to routers. > Are all routers LBRs? Do the discussions of LBRs not apply to interior > routers? > > There are references to "node" forwarding traffic in some places. Are > all such nodes routers, or do sensors and actuators sometimes forward > traffic? E.g., > > A > node must be able to send its own alerts toward an LBR while > continuing to forward traffic on behalf of other devices who are also > experiencing an alert condition. MISCHA: The abilities of above elements have been clearly defined in Sections 3.1.1.-3.1.3. Tim, please, check that we have not over-abused the term LBR. > > In the following text: > > Routing within urban sensor networks SHOULD require the U-LLN nodes > to dynamically compute, select and install different paths towards a > same destination, depending on the nature of the traffic. From this > perspective, such nodes SHOULD inspect the contents of traffic > payload for making routing and forwarding decisions: for example, the > analysis of traffic payload should encourage the enforcement of > forwarding policies based upon aggregation capabilities for the sake > of efficiency. > > If data needs to be confidential, as mentioned in the security > considerations section, then the data would have to be protected hop by > hop, with each router/node decrypting and re-encrypting as it forwarded > the data, if the router/node is to inspect the contents. Is this intended? MISCHA: There is indeed a problem here, as had also been highlighted by Phil when he mentioned that data aggregation breaks the end-to-end paradigm. I am not sure what to respond here. I guess, yes, one would need to decrypt/re-encrypt at each hop, even though other solutions keep popping into my mind. Christian? Tim? _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 14 09:30:56 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 258023A68AA; Sun, 14 Dec 2008 09:30:56 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D86FB3A6974 for ; Sat, 13 Dec 2008 13:37:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.486 X-Spam-Level: X-Spam-Status: No, score=-2.486 tagged_above=-999 required=5 tests=[AWL=-0.114, BAYES_00=-2.599, SARE_SUB_OBFU_Q1=0.227] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9atSlL5meQkj for ; Sat, 13 Dec 2008 13:37:40 -0800 (PST) Received: from smtp103.biz.mail.re2.yahoo.com (smtp103.biz.mail.re2.yahoo.com [68.142.229.217]) by core3.amsl.com (Postfix) with SMTP id 678293A68FA for ; Sat, 13 Dec 2008 13:37:40 -0800 (PST) Received: (qmail 4353 invoked from network); 13 Dec 2008 21:30:54 -0000 Received: from unknown (HELO zeke.ekasystems.com) (tim.winter@209.48.242.70 with plain) by smtp103.biz.mail.re2.yahoo.com with SMTP; 13 Dec 2008 21:30:53 -0000 X-YMail-OSG: i1T1YX0VM1khw3czhUDbfSVUT3hdun4yUej0QmkwXnpdHA2dyUXM96LkasSSs5Unp6H2Ih1hBW8rwehiA46V5gbgS3PtHSjbFi2x1UoB_KVQGqTYlsv01u9.r1zLqxs7q_jDhhPAeq5IDwiqG2lekO7apf.Xe5qrO.7lPyp5pKL3FzplZRwfZu1YGHM0BVN9EN8ovleCDkXoLjEkOmcRCqhDjw9YKL48MtRfqUogZG1DqK411YdB1WLzZ3g- X-Yahoo-Newman-Property: ymail-3 Message-ID: <49442984.2040108@ekasystems.com> Date: Sat, 13 Dec 2008 16:30:44 -0500 From: Tim Winter User-Agent: Thunderbird 2.0.0.18 (X11/20081105) MIME-Version: 1.0 To: Mischa Dohler , Sandra Murphy References: <4943D271.1050808@cttc.es> In-Reply-To: <4943D271.1050808@cttc.es> X-Mailman-Approved-At: Sun, 14 Dec 2008 09:30:54 -0800 Cc: thomas.watteyne@ieee.org, Dominique.Barthel@orange-ftgroup.com, secdir@ietf.org, iesg@ietf.org, christian.jacquenet@orange-ftgroup.com, roll-chairs@tools.ietf.org Subject: Re: [secdir] secdir review of draft-ietf-roll-urban-routing-reqs-02 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Sandra, reviewers, Please find my additional comments inline. Thanks, -Tim Mischa Dohler wrote: > Dear Sandra, > > Many thanks for having taken your time to read and comment on the > document. You can find my comments in-line. I would expect that my > co-authors will also reply asap. (Tim, I think you need to have a look > at this since it mainly relates to the part written by you. Thanks!) > > Thanks and kind regards, > Mischa. > > _____________________________ > > Dr Mischa Dohler > Senior Researcher > CTTC, Barcelona > > Tel: +34 93 645 2900 > Fax: +34 93 645 2901 > Mob: +34 6 7909 4007 > > www.cttc.es/home/mdohler > _____________________________ > > > > > Sandra Murphy wrote: >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the >> IESG. These comments were written primarily for the benefit of the >> security area directors. Document editors and WG chairs should treat >> these comments just like any other last call comments. >> >> The document covers the requirements for routing in low power and >> lossy networks in urban environments. It covers the basics of that >> territory, defining terms and limitations of the networks being >> considered, and the requirements that produces for routing in that >> setting. >> >> >> The security considerations section covers the services that one >> would expect to see covered. Unfortunately, I was continually >> confused as to whether the discussion of security requirements was >> focused on the security of the routing or the security of the data >> that was being routed. > > MISCHA: I am not sure I understand this confusion. We are ultimately > interested in securing the data. If this involves securing the route, > the establishment of the route, the maintenance of the route, among > others, so be it. Generally, since we are dealing with routing specs > in this document, we have tried to focus the security requirements on > everything related to routing. However, in the introduction of the > document, we have possibly alluded to more general security > considerations too (which is maybe why you got confused). > Tim: In covering the basics of the territory, the document does contain informative text that goes beyond the specifics of routing requirements. The intent is to provide a useful background to the routing solution designer with regard to the unique nature and challenges of the Urban LLN scenario. In this spirit the Security Considerations section does contain some general informative text, as cited below, which does refer explicitly to security of data traffic. However it is not the intent of such informative text to be interpreted as security requirements for the routing solution as such. Where we do intend to focus on specific considerations that have implications for security provided by the routing solution we have used the normative language "MUST", "SHOULD", ... So it is the intent that whenever such normative language is encountered within the Security Considerations section that the reader may interpret this directly as a routing protocol related security requirement. >> >> The following text from the security considerations section is an >> example: >> >> A secure communication in a wireless network encompasses three main >> elements, i.e. confidentiality (encryption of data), integrity >> (correctness of data), and authentication (legitimacy of data). >> >> Authentication can e.g. be violated if external sources insert >> incorrect data packets; integrity can e.g. be violated if nodes start >> to break down and hence commence measuring and relaying data >> incorrectly. Nonetheless, some sensor readings as well as the >> actuator control signals need to be confidential. >> >> There are concerns in routing protocols about the authenticity and >> integrity of the contents of the routing protocol messages - the >> *control* data, not the sensor and actuator data. A need for >> confidentiality of the routing protocol message content is not as >> generally accepted, and this paragraph seems to be considering the >> confidentiality of the data traffic, not the control traffic. > > MISCHA: This section had been written by Tim Winters, so he will be of > greater help to reply. Tim: Please refer above response. This text is intended as informative background. >> >> Later the focus returns to the security of the routing protocol itself: >> >> The U-LLN MUST be protected against attempts to inject false or >> modified packets. For example, an attacker SHOULD be prevented from >> manipulating or disabling the routing function by compromising >> routing update messages. Moreover, it SHOULD NOT be possible to >> coerce the network into routing packets which have been modified in >> transit. To this end the routing protocol(s) MUST support message >> integrity. >> >> The impact on availability of the forwarding service is typically a >> concern for routing protocols and is not mentioned here. Can routing >> produce a data traffic forwarding path that loops? Can the routing >> protocol be subverted to the point that routing protocol messages are >> consuming the available resources? Etc. > > MISCHA: I am confused in how your text relates to our text cited > above. Are you proposing additions or modifications, or is it just a > list of loose comments? Tim, maybe you should add a paragraph covering > these comments ... Tim: The above cited text is addressing the ability of an attacker to actively `hijack' the routing protocol. The paragraph following the cited paragraph does offer some consideration of denial of service attacks in general: Other important issues may arise in the context of Denial of Service (DoS) attacks, malicious address space allocations, advertisement of variable addresses, a wrong neighborhood, external attacks aimed at injecting dummy traffic to drain the network power, etc. Perhaps we could add to this following paragraph a sentence to clarify the requirement, e.g.: "The routing protocol(s) MUST support defense against DoS attacks and other attempts to cause the routing protocol(s) mechanisms to maliciously consume the limited resources of LLN nodes, e.g. by constructing forwarding loops or causing excessive routing protocol overhead traffic, etc." >> >> Mechanisms MUST be in place to deny any rogue node >> which attempts to take advantage of self-configuration and self- >> organization procedures. Such attacks may attempt, for example, to >> cause denial of service, drain the energy of power constrained >> devices, or to hijack the routing mechanism. A node MUST >> authenticate itself to a trusted node that is already associated with >> the U-LLN before any self-configuration or self-organization is >> allowed to proceed. >> >> >> This seems to be addressing the possibility of a legitimate node >> behaving badly. But the requirement that a node must authenticate >> itself only prevents bad behavior from outsiders, not insiders. > > MISCHA: In my understanding, this is what you can do with > authentication. Other mechanisms are needed to cover the case you > mentioned, even though it is a marginal scenario in my opinion. Tim: Yes, here we are explicitly concerned with outsiders, i.e. a node who is unable to authenticate to the network. With regard to poorly behaved inside nodes, we do have the previously mentioned discussion regarding Denial of Service attacks via manipulation of the routing protocol(s), and we do describe some considerations to be given nodes that may demonstrate egoistic conduct. > Further >> comment - self-organization and self-configuration had previously >> referred to configuration or organization of a network, not a single >> node. Does this mean that a node must authenticate before it can >> participate in the network self-organization? And of course the >> chicken-and-egg problem - before the network has self-organized, how >> can the nodes reach a trusted node. > > MISCHA: Yes, indeed, it is advantageous that a node authenticates > first and then takes part in the organization process. Several > authentication attempts are of course needed until each node reaches > an authenticated node or is in its one-hop neighborhood, but this > seems to be part of the game to facilitate a secure network. > > Must *every* node authenticate before >> self-organization can proceed? Or does self-organization spread >> outwards incrementally from the trusted node? >> > > MISCHA: The former and the latter are not exclusive to me - I am not > sure I understood correctly. > Tim: Perhaps it is instructive to think of the network as `growing' around a seed router. The processes of self-organization may be periodically (or continuously) invoked, e.g. as a normal procedure of the network to respond to changes in topology, appearance and removal of nodes, etc. The chicken-and-egg problem can be resolved then thusly: Consider that a trusted authenticated (to some entity with authority to manage the network) access router (LBR) is deployed. Subsequently nodes within range of the LBR may authenticate and engage in a process of autonomous self-configuration and self-organization, yielding a network segment that now includes the LBR and a handful of authenticated (i.e. trusted) nodes. The envelope of trust may now be extended to nodes that are able to directly communicate with the LBR. As the network grows the self-organization mechanisms can take into account the topology of the trusted nodes. It is not necessarily the case, e.g. that all nodes must first become known and authenticated before self organization can proceed. So as unauthenticated nodes encounter the boundary of a network that the wish to join, that network should already have established the degree of self-organization necessary to at least authenticate the new node, and subsequently allow the node to begin participation (and consume the resources of the network required) in self-configuration and self-organization processes. >> >> With low computation power and scarce energy resources, U-LLNs nodes >> may not be able to resist any attack from high-power malicious nodes >> (e.g. laptops and strong radios). However, the amount of damage >> generated to the whole network SHOULD be commensurate with the number >> of nodes physically compromised. For example, an intruder taking >> control over a single node SHOULD not have total access to, or be >> able to completely deny service to the whole network. >> >> If a taken-over node does not have access to the whole network, how >> could it have had access to the whole network before being taken >> over? Subverted nodes generally are assumed to retain all their >> abilities, which is why they are such a problem. This seems to be >> requiring that no one node ever has access to the whole network. > > MISCHA: Good point! Tim, I think you should only leave the reference > to "completely deny service to the whole network". > Tim: I do agree. The subverted node can be expected to have access... but should not be able to misbehave to a point where the network as a whole is in jeopardy. This observation is in the same spirit as the prior comments on Denial of Service and misbehaving insiders. The proposed revision would then read: "For example, an intruder taking control over a single node SHOULD not be able to completely deny service to the whole network." >> >> >> In the rest of the document: >> >> Routers are introduced, including the special category of LBR - >> Some routers provide access to wider infrastructures, such as the >> Internet, and are named Low power and lossy network Border Routers >> (LBRs) in that context. >> However, in the remainder of the document, the text refers to LBRs >> everywhere in places where it sounds like they are referring to >> routers. Are all routers LBRs? Do the discussions of LBRs not apply >> to interior routers? >> >> There are references to "node" forwarding traffic in some places. >> Are all such nodes routers, or do sensors and actuators sometimes >> forward traffic? E.g., >> >> A >> node must be able to send its own alerts toward an LBR while >> continuing to forward traffic on behalf of other devices who are also >> experiencing an alert condition. > > MISCHA: The abilities of above elements have been clearly defined in > Sections 3.1.1.-3.1.3. Tim, please, check that we have not over-abused > the term LBR. > Tim: To clarify, sensors and actuators are capable of forwarding traffic. LBR's are a special case of a router, as further described in the terminology I-D draft-ietf-roll-terminology-00. In the context of U-LLN applications, interior routers are somewhat anonymous while LBRs have some additional application significance. Many application traffic flows will source or sink at an LBR. Many U-LLN applications will interact with some other application co-located at or hosted beyond the LBR. As such, establishing how to forward traffic to the LBR from an interior node, or vice versa, becomes a common task for the routing protocol. Upon review, I find that the used of `LBR' is applied consistently in contexts where the document is discussing application specific traffic flows and related routing implications. In these contexts it is appropriate to explicitly refer to the LBR as opposed to an anonymous interior router. >> >> In the following text: >> >> Routing within urban sensor networks SHOULD require the U-LLN nodes >> to dynamically compute, select and install different paths towards a >> same destination, depending on the nature of the traffic. From this >> perspective, such nodes SHOULD inspect the contents of traffic >> payload for making routing and forwarding decisions: for example, the >> analysis of traffic payload should encourage the enforcement of >> forwarding policies based upon aggregation capabilities for the sake >> of efficiency. >> >> If data needs to be confidential, as mentioned in the security >> considerations section, then the data would have to be protected hop >> by hop, with each router/node decrypting and re-encrypting as it >> forwarded the data, if the router/node is to inspect the contents. >> Is this intended? > > MISCHA: There is indeed a problem here, as had also been highlighted > by Phil when he mentioned that data aggregation breaks the end-to-end > paradigm. I am not sure what to respond here. I guess, yes, one would > need to decrypt/re-encrypt at each hop, even though other solutions > keep popping into my mind. Christian? Tim? > > Tim: This is a correct observation- if data are kept confidential hop-by-hop then there is some implication as to how aggregation would have to be performed. This implication was similarly brought out in Brian Carpenter's Gen-ART LC review, and I will address it further in that response. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 14 09:30:56 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 304BC3A6927; Sun, 14 Dec 2008 09:30:56 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D6A183A68B2; Sun, 14 Dec 2008 01:21:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.627 X-Spam-Level: X-Spam-Status: No, score=-1.627 tagged_above=-999 required=5 tests=[AWL=-0.744, BAYES_05=-1.11, SARE_SUB_OBFU_Q1=0.227] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xqjH45KKYk26; Sun, 14 Dec 2008 01:21:15 -0800 (PST) Received: from scorpius.cttc.es (scorpius.cttc.es [84.88.62.197]) by core3.amsl.com (Postfix) with ESMTP id 432993A682E; Sun, 14 Dec 2008 01:21:13 -0800 (PST) Received: from leo (postfix@leo.cttc.es [84.88.62.208]) by scorpius.cttc.es (8.13.8/8.13.5) with ESMTP id mBE9JMbu009698; Sun, 14 Dec 2008 10:19:22 +0100 Received: from [127.0.0.1] (128.Red-88-7-111.staticIP.rima-tde.net [88.7.111.128]) by leo (Postfix) with ESMTP id A8D3F10C31E; Sun, 14 Dec 2008 10:19:20 +0100 (CET) Message-ID: <4944CFD2.6050900@cttc.es> Date: Sun, 14 Dec 2008 10:20:18 +0100 From: Mischa Dohler User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Tim Winter References: <4943D271.1050808@cttc.es> <49442984.2040108@ekasystems.com> In-Reply-To: <49442984.2040108@ekasystems.com> X-Antivirus: avast! (VPS 081213-0, 12/13/2008), Outbound message X-Antivirus-Status: Clean X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.0 (leo); Sun, 14 Dec 2008 10:19:21 +0100 (CET) X-Scanned-By: MIMEDefang 2.57 on 84.88.62.197 X-Mailman-Approved-At: Sun, 14 Dec 2008 09:30:54 -0800 Cc: thomas.watteyne@ieee.org, Dominique.Barthel@orange-ftgroup.com, secdir@ietf.org, iesg@ietf.org, christian.jacquenet@orange-ftgroup.com, roll-chairs@tools.ietf.org Subject: Re: [secdir] secdir review of draft-ietf-roll-urban-routing-reqs-02 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Sandra, we will also have a separate security document some when in Q1 2009 which shall cover more or less everything you alluded to below. Regards, Mischa. Tim Winter wrote: > Sandra, reviewers, > > Please find my additional comments inline. > > Thanks, > > -Tim > > > > Mischa Dohler wrote: >> Dear Sandra, >> >> Many thanks for having taken your time to read and comment on the >> document. You can find my comments in-line. I would expect that my >> co-authors will also reply asap. (Tim, I think you need to have a look >> at this since it mainly relates to the part written by you. Thanks!) >> >> Thanks and kind regards, >> Mischa. >> >> _____________________________ >> >> Dr Mischa Dohler >> Senior Researcher >> CTTC, Barcelona >> >> Tel: +34 93 645 2900 >> Fax: +34 93 645 2901 >> Mob: +34 6 7909 4007 >> >> www.cttc.es/home/mdohler >> _____________________________ >> >> >> >> >> Sandra Murphy wrote: >>> I have reviewed this document as part of the security directorate's >>> ongoing effort to review all IETF documents being processed by the >>> IESG. These comments were written primarily for the benefit of the >>> security area directors. Document editors and WG chairs should treat >>> these comments just like any other last call comments. >>> >>> The document covers the requirements for routing in low power and >>> lossy networks in urban environments. It covers the basics of that >>> territory, defining terms and limitations of the networks being >>> considered, and the requirements that produces for routing in that >>> setting. >>> >>> >>> The security considerations section covers the services that one >>> would expect to see covered. Unfortunately, I was continually >>> confused as to whether the discussion of security requirements was >>> focused on the security of the routing or the security of the data >>> that was being routed. >> MISCHA: I am not sure I understand this confusion. We are ultimately >> interested in securing the data. If this involves securing the route, >> the establishment of the route, the maintenance of the route, among >> others, so be it. Generally, since we are dealing with routing specs >> in this document, we have tried to focus the security requirements on >> everything related to routing. However, in the introduction of the >> document, we have possibly alluded to more general security >> considerations too (which is maybe why you got confused). >> > Tim: In covering the basics of the territory, the document does contain > informative text that goes beyond the specifics of routing > requirements. The intent is to provide a useful background to the > routing solution designer with regard to the unique nature and > challenges of the Urban LLN scenario. In this spirit the Security > Considerations section does contain some general informative text, as > cited below, which does refer explicitly to security of data traffic. > However it is not the intent of such informative text to be interpreted > as security requirements for the routing solution as such. Where we do > intend to focus on specific considerations that have implications for > security provided by the routing solution we have used the normative > language "MUST", "SHOULD", ... So it is the intent that whenever such > normative language is encountered within the Security Considerations > section that the reader may interpret this directly as a routing > protocol related security requirement. > > > >>> The following text from the security considerations section is an >>> example: >>> >>> A secure communication in a wireless network encompasses three main >>> elements, i.e. confidentiality (encryption of data), integrity >>> (correctness of data), and authentication (legitimacy of data). >>> >>> Authentication can e.g. be violated if external sources insert >>> incorrect data packets; integrity can e.g. be violated if nodes start >>> to break down and hence commence measuring and relaying data >>> incorrectly. Nonetheless, some sensor readings as well as the >>> actuator control signals need to be confidential. >>> >>> There are concerns in routing protocols about the authenticity and >>> integrity of the contents of the routing protocol messages - the >>> *control* data, not the sensor and actuator data. A need for >>> confidentiality of the routing protocol message content is not as >>> generally accepted, and this paragraph seems to be considering the >>> confidentiality of the data traffic, not the control traffic. >> MISCHA: This section had been written by Tim Winters, so he will be of >> greater help to reply. > Tim: Please refer above response. This text is intended as informative > background. > > > >>> Later the focus returns to the security of the routing protocol itself: >>> >>> The U-LLN MUST be protected against attempts to inject false or >>> modified packets. For example, an attacker SHOULD be prevented from >>> manipulating or disabling the routing function by compromising >>> routing update messages. Moreover, it SHOULD NOT be possible to >>> coerce the network into routing packets which have been modified in >>> transit. To this end the routing protocol(s) MUST support message >>> integrity. >>> >>> The impact on availability of the forwarding service is typically a >>> concern for routing protocols and is not mentioned here. Can routing >>> produce a data traffic forwarding path that loops? Can the routing >>> protocol be subverted to the point that routing protocol messages are >>> consuming the available resources? Etc. >> MISCHA: I am confused in how your text relates to our text cited >> above. Are you proposing additions or modifications, or is it just a >> list of loose comments? Tim, maybe you should add a paragraph covering >> these comments ... > Tim: The above cited text is addressing the ability of an attacker to > actively `hijack' the routing protocol. The paragraph following the > cited paragraph does offer some consideration of denial of service > attacks in general: > Other important issues may arise in the context of Denial of > Service (DoS) > attacks, malicious address space allocations, advertisement of > variable addresses, a wrong neighborhood, external attacks > aimed at > injecting dummy traffic to drain the network power, etc. > > Perhaps we could add to this following paragraph a sentence to clarify > the requirement, e.g.: > "The routing protocol(s) MUST support defense against DoS > attacks and other attempts to cause the routing protocol(s) mechanisms > to maliciously consume the limited resources of LLN nodes, e.g. by > constructing forwarding loops or causing excessive routing protocol > overhead traffic, etc." > > > >>> Mechanisms MUST be in place to deny any rogue node >>> which attempts to take advantage of self-configuration and self- >>> organization procedures. Such attacks may attempt, for example, to >>> cause denial of service, drain the energy of power constrained >>> devices, or to hijack the routing mechanism. A node MUST >>> authenticate itself to a trusted node that is already associated with >>> the U-LLN before any self-configuration or self-organization is >>> allowed to proceed. >>> >>> >>> This seems to be addressing the possibility of a legitimate node >>> behaving badly. But the requirement that a node must authenticate >>> itself only prevents bad behavior from outsiders, not insiders. >> MISCHA: In my understanding, this is what you can do with >> authentication. Other mechanisms are needed to cover the case you >> mentioned, even though it is a marginal scenario in my opinion. > Tim: Yes, here we are explicitly concerned with outsiders, i.e. a node > who is unable to authenticate to the network. With regard to poorly > behaved inside nodes, we do have the previously mentioned discussion > regarding Denial of Service attacks via manipulation of the routing > protocol(s), and we do describe some considerations to be given nodes > that may demonstrate egoistic conduct. > > > >> Further >>> comment - self-organization and self-configuration had previously >>> referred to configuration or organization of a network, not a single >>> node. Does this mean that a node must authenticate before it can >>> participate in the network self-organization? And of course the >>> chicken-and-egg problem - before the network has self-organized, how >>> can the nodes reach a trusted node. >> MISCHA: Yes, indeed, it is advantageous that a node authenticates >> first and then takes part in the organization process. Several >> authentication attempts are of course needed until each node reaches >> an authenticated node or is in its one-hop neighborhood, but this >> seems to be part of the game to facilitate a secure network. >> >> Must *every* node authenticate before >>> self-organization can proceed? Or does self-organization spread >>> outwards incrementally from the trusted node? >>> >> MISCHA: The former and the latter are not exclusive to me - I am not >> sure I understood correctly. >> > Tim: Perhaps it is instructive to think of the network as `growing' > around a seed router. The processes of self-organization may be > periodically (or continuously) invoked, e.g. as a normal procedure of > the network to respond to changes in topology, appearance and removal of > nodes, etc. The chicken-and-egg problem can be resolved then thusly: > Consider that a trusted authenticated (to some entity with authority to > manage the network) access router (LBR) is deployed. Subsequently nodes > within range of the LBR may authenticate and engage in a process of > autonomous self-configuration and self-organization, yielding a network > segment that now includes the LBR and a handful of authenticated (i.e. > trusted) nodes. The envelope of trust may now be extended to nodes that > are able to directly communicate with the LBR. As the network grows the > self-organization mechanisms can take into account the topology of the > trusted nodes. > It is not necessarily the case, e.g. that all nodes must first become > known and authenticated before self organization can proceed. So as > unauthenticated nodes encounter the boundary of a network that the wish > to join, that network should already have established the degree of > self-organization necessary to at least authenticate the new node, and > subsequently allow the node to begin participation (and consume the > resources of the network required) in self-configuration and > self-organization processes. > > > >>> With low computation power and scarce energy resources, U-LLNs nodes >>> may not be able to resist any attack from high-power malicious nodes >>> (e.g. laptops and strong radios). However, the amount of damage >>> generated to the whole network SHOULD be commensurate with the number >>> of nodes physically compromised. For example, an intruder taking >>> control over a single node SHOULD not have total access to, or be >>> able to completely deny service to the whole network. >>> >>> If a taken-over node does not have access to the whole network, how >>> could it have had access to the whole network before being taken >>> over? Subverted nodes generally are assumed to retain all their >>> abilities, which is why they are such a problem. This seems to be >>> requiring that no one node ever has access to the whole network. >> MISCHA: Good point! Tim, I think you should only leave the reference >> to "completely deny service to the whole network". >> > Tim: I do agree. The subverted node can be expected to have access... > but should not be able to misbehave to a point where the network as a > whole is in jeopardy. This observation is in the same spirit as the > prior comments on Denial of Service and misbehaving insiders. > > The proposed revision would then read: > "For example, an intruder taking control over a single node > SHOULD not be able to completely deny service to the whole network." > > > >>> >>> In the rest of the document: >>> >>> Routers are introduced, including the special category of LBR - >>> Some routers provide access to wider infrastructures, such as the >>> Internet, and are named Low power and lossy network Border Routers >>> (LBRs) in that context. >>> However, in the remainder of the document, the text refers to LBRs >>> everywhere in places where it sounds like they are referring to >>> routers. Are all routers LBRs? Do the discussions of LBRs not apply >>> to interior routers? >>> >>> There are references to "node" forwarding traffic in some places. >>> Are all such nodes routers, or do sensors and actuators sometimes >>> forward traffic? E.g., >>> >>> A >>> node must be able to send its own alerts toward an LBR while >>> continuing to forward traffic on behalf of other devices who are also >>> experiencing an alert condition. >> MISCHA: The abilities of above elements have been clearly defined in >> Sections 3.1.1.-3.1.3. Tim, please, check that we have not over-abused >> the term LBR. >> > Tim: To clarify, sensors and actuators are capable of forwarding > traffic. LBR's are a special case of a router, as further described in > the terminology I-D draft-ietf-roll-terminology-00. In the context of > U-LLN applications, interior routers are somewhat anonymous while LBRs > have some additional application significance. Many application traffic > flows will source or sink at an LBR. Many U-LLN applications will > interact with some other application co-located at or hosted beyond the > LBR. As such, establishing how to forward traffic to the LBR from an > interior node, or vice versa, becomes a common task for the routing > protocol. > Upon review, I find that the used of `LBR' is applied consistently in > contexts where the document is discussing application specific traffic > flows and related routing implications. In these contexts it is > appropriate to explicitly refer to the LBR as opposed to an anonymous > interior router. > > > >>> In the following text: >>> >>> Routing within urban sensor networks SHOULD require the U-LLN nodes >>> to dynamically compute, select and install different paths towards a >>> same destination, depending on the nature of the traffic. From this >>> perspective, such nodes SHOULD inspect the contents of traffic >>> payload for making routing and forwarding decisions: for example, the >>> analysis of traffic payload should encourage the enforcement of >>> forwarding policies based upon aggregation capabilities for the sake >>> of efficiency. >>> >>> If data needs to be confidential, as mentioned in the security >>> considerations section, then the data would have to be protected hop >>> by hop, with each router/node decrypting and re-encrypting as it >>> forwarded the data, if the router/node is to inspect the contents. >>> Is this intended? >> MISCHA: There is indeed a problem here, as had also been highlighted >> by Phil when he mentioned that data aggregation breaks the end-to-end >> paradigm. I am not sure what to respond here. I guess, yes, one would >> need to decrypt/re-encrypt at each hop, even though other solutions >> keep popping into my mind. Christian? Tim? >> >> > Tim: This is a correct observation- if data are kept confidential > hop-by-hop then there is some implication as to how aggregation would > have to be performed. This implication was similarly brought out in > Brian Carpenter's Gen-ART LC review, and I will address it further in > that response. > > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 14 13:40:18 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 920723A6903; Sun, 14 Dec 2008 13:40:18 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 378343A6903 for ; Sun, 14 Dec 2008 13:40:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.172 X-Spam-Level: X-Spam-Status: No, score=-2.172 tagged_above=-999 required=5 tests=[AWL=0.427, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id edUk0qzRSmve for ; Sun, 14 Dec 2008 13:40:16 -0800 (PST) Received: from smtp103.biz.mail.re2.yahoo.com (smtp103.biz.mail.re2.yahoo.com [68.142.229.217]) by core3.amsl.com (Postfix) with SMTP id 3CA703A67BD for ; Sun, 14 Dec 2008 13:40:16 -0800 (PST) Received: (qmail 60351 invoked from network); 14 Dec 2008 21:40:09 -0000 Received: from unknown (HELO Wylie) (turners@96.241.8.124 with login) by smtp103.biz.mail.re2.yahoo.com with SMTP; 14 Dec 2008 21:40:08 -0000 X-YMail-OSG: B1w539oVM1kL754RSeD.Pv8C1ZtezTZ_5wR9mvwJnMdK4h4dFQUZU9ov_Ocybr1w35vkO1WDOvSSndTWduy_0TBS8dIIIiA7_R6lR62Mw8._pFecliZfBw69TPAbYT4JYznO1Q5wQn4FtBHMCKRqfrcjnAMsKlwxdGnLBPWIygoLMq_hTyQoO2w77N7otg-- X-Yahoo-Newman-Property: ymail-3 From: "Turner, Sean P." To: , , , , , Date: Sun, 14 Dec 2008 16:39:51 -0500 Organization: IECA, Inc. Message-ID: <7F42B56DA3A0459FBAF8776D98AF4554@Wylie> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Thread-Index: AcleNH7DHivVSGHcSU2o1asFU5sU9Q== Cc: secdir-secretary@mit.edu Subject: [secdir] Review of draft-mammoliti-l2tp-accessline-avp-04.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes two L2TP AVP extensions to carry subscriber Access Line identification and characterization information that arrives at the Broadband Remote Access Server (BRAS) with LAC functionality. It also defines a mechanism to report connection speed changes, after the initial connection speeds are sent during session establishment. The document is well written and I believe it is ready proceed after addressing the following comment: The Security Considerations should indicate what would/could happen if the AVPs are used in a non-secure environment. The second paragraph in the security considerations says the AVPs are intended to be used in a secure environment and the 3rd paragraph says careful consideration should be given to potential vulnerabilities when implementing in the real world. I just think one point of the security considerations for non-security protocols is to say what bad things can happen if the AVPs/mechanisms are not secured. Other comments: Minor: Section 3 2nd para 1st line: Should the "must" be "MUST"? Nits: 1. Spell out first use of "LNS" and add definition to Section 2.2. 2. Spell out first use of "LAC" and add definition to Section 2.2. 3. Spell out first use of "LCCE" and add definition to Section 2.2. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sun Dec 14 16:45:00 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D29F3A6963; Sun, 14 Dec 2008 16:45:00 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C09573A6947; Sun, 14 Dec 2008 16:44:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5OsROFKIxZ-J; Sun, 14 Dec 2008 16:44:58 -0800 (PST) Received: from av-tac-sj.cisco.com (firestar.cisco.com [171.68.227.75]) by core3.amsl.com (Postfix) with ESMTP id E7F543A694D; Sun, 14 Dec 2008 16:44:57 -0800 (PST) X-TACSUNS: Virus Scanned Received: from rooster.cisco.com (localhost [127.0.0.1]) by av-tac-sj.cisco.com (8.11.7p3+Sun/8.11.7) with ESMTP id mBF0i1H13438; Sun, 14 Dec 2008 16:44:01 -0800 (PST) Received: from [10.116.85.228] (rtp-cpignata-8713.cisco.com [10.116.85.228]) by rooster.cisco.com (8.13.8+Sun/8.13.8) with ESMTP id mBF0hb7e011087; Sun, 14 Dec 2008 19:43:37 -0500 (EST) Message-ID: <4945A838.1030704@cisco.com> Date: Sun, 14 Dec 2008 19:43:36 -0500 From: Carlos Pignataro Organization: cisco Systems, Inc. User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.18) Gecko/20081105 Thunderbird/2.0.0.18 Mnenhy/0.7.5.0 MIME-Version: 1.0 To: "Turner, Sean P." References: <7F42B56DA3A0459FBAF8776D98AF4554@Wylie> In-Reply-To: <7F42B56DA3A0459FBAF8776D98AF4554@Wylie> X-Enigmail-Version: 0.95.7 X-Face: *3w8NvnQ|kS~V{&{U}$?G9U9EJQ8p9)O[1[1F'1i>XIc$5FR!hdAIf5}'Xu-3`^Z']h0J* ccB'fl/XJYR[+,Z+jj`4%06nd'y9[ln&ScJT5S+O18e^ Cc: secdir-secretary@mit.edu, howsoft@mindspring.com, secdir@ietf.org, jgibbons@juniper.net, iesg@ietf.org, parberg@redback.com Subject: Re: [secdir] Review of draft-mammoliti-l2tp-accessline-avp-04.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Sean, Many thanks for reading the draft and for providing this review feedback! Please see inline. On 12/14/2008 4:39 PM, Turner, Sean P. said the following: > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area > directors. Document editors and WG chairs should treat these comments just > like any other last call comments. > > This document describes two L2TP AVP extensions to carry subscriber Access > Line identification and characterization information that arrives at the > Broadband Remote Access Server (BRAS) with LAC functionality. It also > defines a mechanism to report connection speed changes, after the initial > connection speeds are sent during session establishment. > > The document is well written and I believe it is ready proceed after > addressing the following comment: Thanks. > > The Security Considerations should indicate what would/could happen if the > AVPs are used in a non-secure environment. The second paragraph in the > security considerations says the AVPs are intended to be used in a secure > environment and the 3rd paragraph says careful consideration should be given > to potential vulnerabilities when implementing in the real world. I just > think one point of the security considerations for non-security protocols is > to say what bad things can happen if the AVPs/mechanisms are not secured. OK, we'll address this by extending the third paragraph in the Security Considerations, to describe what could/would happen. This will also point to the Security Considerations of RFC2661 and RFC3931, since it seems your comment can be taken more generically as well. > > Other comments: > > Minor: Section 3 2nd para 1st line: Should the "must" be "MUST"? No, we discussed this one among the authors somewhat amply, and concluded that it was a "must" case. > > Nits: > 1. Spell out first use of "LNS" and add definition to Section 2.2. > 2. Spell out first use of "LAC" and add definition to Section 2.2. > 3. Spell out first use of "LCCE" and add definition to Section 2.2. OK. Will take care of these. > Thanks again, -- --Carlos Pignataro. Escalation RTP - cisco Systems _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 15 03:11:01 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9DB4B3A68D8; Mon, 15 Dec 2008 03:11:01 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6EF0B3A6844; Mon, 15 Dec 2008 03:11:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.894 X-Spam-Level: X-Spam-Status: No, score=-1.894 tagged_above=-999 required=5 tests=[AWL=0.705, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DHKSzSkjgIlI; Mon, 15 Dec 2008 03:10:59 -0800 (PST) Received: from liberty.deployingradius.com (liberty.deployingradius.com [88.191.76.128]) by core3.amsl.com (Postfix) with ESMTP id 880363A67B4; Mon, 15 Dec 2008 03:10:59 -0800 (PST) Received: from Thor.gnb.quiconnect.net (alexander.quiconnect.net [213.30.156.62]) by liberty.deployingradius.com (Postfix) with ESMTPSA id D59E31234281; Mon, 15 Dec 2008 12:10:50 +0100 (CET) Message-ID: <49463B38.1090604@deployingradius.com> Date: Mon, 15 Dec 2008 12:10:48 +0100 From: Alan DeKok User-Agent: Thunderbird 2.0.0.18 (Macintosh/20081105) MIME-Version: 1.0 To: secdir@ietf.org, IESG IESG , hesham@elevatemobile.com X-Enigmail-Version: 0.95.7 Subject: [secdir] SECDIR review of draft-ietf-mext-nemo-v4traversal-06.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document extends IPv6 mobility and NEMO specifications to include support for IPv4. Overall, the document is clear. My comments are as follows. The Home Agent Discovery in Section 3.1 explicitly depends on DNS. As there are well-known issues with DNS security, the document should have some discussion on the the (in)security of the DNS protocol. It should include possible ways that malicious DNS can be used to subvert this protocol. If that is not possible, it should describe why, or refer to other documents that explain why attacks on DNS cannot be leveraged to attack this protocol. There is a typo in the header of Section 5.1. "Tunelling" should be spelled "Tunneling". A similar typo is in the header of Section 5.1.1. "tunnelling" should be "Tunneling". The Security section contains a large amount of text that appears to be normative requirements on the behavior of the systems (6.2). If it is normative, I would suggest placing it in a separate section. If it is just examples, then I would also suggest placing it in a separate section. Alan DeKok. _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Mon Dec 15 21:25:40 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D79E23A68E3; Mon, 15 Dec 2008 21:25:40 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2A1C63A68E3; Mon, 15 Dec 2008 21:25:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GiSC7ssJ77M5; Mon, 15 Dec 2008 21:25:38 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 22A183A67F3; Mon, 15 Dec 2008 21:25:38 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.36,228,1228089600"; d="scan'208";a="213596356" Received: from sj-dkim-2.cisco.com ([171.71.179.186]) by sj-iport-6.cisco.com with ESMTP; 16 Dec 2008 05:25:31 +0000 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id mBG5PVSn032327; Mon, 15 Dec 2008 21:25:31 -0800 Received: from xbh-sjc-231.amer.cisco.com (xbh-sjc-231.cisco.com [128.107.191.100]) by sj-core-5.cisco.com (8.13.8/8.13.8) with ESMTP id mBG5PVwq011070; Tue, 16 Dec 2008 05:25:31 GMT Received: from xfe-sjc-212.amer.cisco.com ([171.70.151.187]) by xbh-sjc-231.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 15 Dec 2008 21:25:31 -0800 Received: from [10.32.244.211] ([10.32.244.211]) by xfe-sjc-212.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 15 Dec 2008 21:25:30 -0800 Mime-Version: 1.0 (Apple Message framework v753.1) Message-Id: <088C52A4-D65E-416C-B135-DE553AB7F0FA@cisco.com> From: Brian Weis Date: Mon, 15 Dec 2008 21:26:06 -0800 To: iesg@ietf.org, secdir@ietf.org X-Mailer: Apple Mail (2.753.1) X-OriginalArrivalTime: 16 Dec 2008 05:25:30.0792 (UTC) FILETIME=[B64D9A80:01C95F3E] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=923; t=1229405131; x=1230269131; c=relaxed/simple; s=sjdkim2002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=bew@cisco.com; z=From:=20Brian=20Weis=20 |Subject:=20Secdir=20review=20of=20draft-ietf-isis-wg-extls p-04 |Sender:=20; bh=eaSkQah+Ojbz9WwcOSgEu1HXNysn+Mll2Pnm9vC5K4I=; b=I/R3OOab7fqLl1EuVy2TExq7JepAFFTFCExCl4IXGshA9Lq/fQ2CQR9l+9 gky5/gd5lLpJGhZzRoUbe477N8Hmw7lLE5tbdaakfX0/Ots7IJqdletm5t0Q 75T5dXVPJQ; Authentication-Results: sj-dkim-2; header.From=bew@cisco.com; dkim=pass ( sig from cisco.com/sjdkim2002 verified; ); Cc: isis-chairs@tools.ietf.org, draft-ietf-isis-wg-extlsp@tools.ietf.org Subject: [secdir] Secdir review of draft-ietf-isis-wg-extlsp-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document defines an IS-IS extension which allows a system to exceed the current limit of LSP fragments that can be can be present in an LSP set (256). It defines a few new ISIS TLVs and describes how they are used. The security considerations section claims that it raises no new security issues for IS-IS, and I believe that it is accurate. Brian P.S. to authors: Draft -04 added a typo in Section 4.2.2: s/Virutal IS/Virtual IS/. -- Brian Weis Router/Switch Security Group, ARTG, Cisco Systems Telephone: +1 408 526 4796 Email: bew@cisco.com _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 16 06:37:53 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 587F33A6A6E; Tue, 16 Dec 2008 06:37:53 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 565413A6A65 for ; Tue, 16 Dec 2008 06:37:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.436 X-Spam-Level: X-Spam-Status: No, score=-4.436 tagged_above=-999 required=5 tests=[AWL=2.163, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cIxp8OHyKU91 for ; Tue, 16 Dec 2008 06:37:50 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 6DD103A6A0B for ; Tue, 16 Dec 2008 06:37:50 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBGEbh3w031603 for ; Tue, 16 Dec 2008 09:37:43 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBGEaKNQ031363 for ; Tue, 16 Dec 2008 09:36:20 -0500 Received: from mit.edu (W92-130-BARRACUDA-1.MIT.EDU [18.7.21.220]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mBGEaEHa021331 for ; Tue, 16 Dec 2008 09:36:14 -0500 (EST) Received: from mail-ew0-f20.google.com (mail-ew0-f20.google.com [209.85.219.20]) by mit.edu (Spam Firewall) with ESMTP id 3F5F5CCB419 for ; Tue, 16 Dec 2008 09:35:53 -0500 (EST) Received: by ewy13 with SMTP id 13so4419676ewy.6 for ; Tue, 16 Dec 2008 06:35:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:to:content-disposition:cc :subject:date:mime-version:content-type:content-transfer-encoding :message-id:from; bh=RJIGy4J2Jb+nT+ovY4fKKl+qiziqyLMJf372SVH63H4=; b=KhnkrapxtuH6fX9x0rF1rFu12dIdwRu3CEIdmsAZ9tYh7T0TvpxGAFllrcSjhNUE6w MOifPM7WPkoytV38sT3W4zfhXQdZ5Xs1RIprkWGdnhI95b0Pfoaa7vvtME6ZSeXT+a5V 00q7Gaz2lu43SpyZGazcXnYEJJnsMPUlL26Uw= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=to:content-disposition:cc:subject:date:mime-version:content-type :content-transfer-encoding:message-id:from; b=GWAf/26ZlDY8y2XIBABfedAYELc0ATrv96XO9rMzRiYs0JTpdm/wDNhO4uLv0Twvx/ Xz3N66QtmivXyuqMNThIEb/A19NiMhARDZP5PtKt+/Y4iCdaik/FfnsY4JNhjyVOHv6G +kY1u5sQ0qV0/Oig5hLUN3Lq6v2RDuyZRZTpo= Received: by 10.210.59.3 with SMTP id h3mr9329305eba.30.1229438152921; Tue, 16 Dec 2008 06:35:52 -0800 (PST) Received: from klee.local ([212.119.9.178]) by mx.google.com with ESMTPS id q9sm1377404gve.21.2008.12.16.06.35.51 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 16 Dec 2008 06:35:52 -0800 (PST) To: draft-ietf-softwire-v4nlri-v6nh@tools.ietf.org, softwire-chairs@tools.ietf.org, Tim Polk Content-Disposition: inline Date: Tue, 16 Dec 2008 15:36:16 +0100 MIME-Version: 1.0 Message-Id: <200812161536.17378.julien.laganier.IETF@googlemail.com> From: Julien Laganier X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mBGEaKNQ031363 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: secdir@mit.edu, iesg@ietf.org Subject: [secdir] SECDIR review of draft-ietf-softwire-v4nlri-v6nh-01 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's =A0 ongoing effort to review all IETF documents being processed by the =A0 IESG. These comments were written primarily for the benefit of the =A0 security area directors. Document editors and WG chairs should treat =A0 these comments just like any other last call comments. This draft specifies an extension to encode an IPv6 address in a BGP = network layer reachability information field when the address family = identifier is IPv4. I did not find any security issues with the draft. --julien _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 16 07:25:01 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E30C3A6A75; Tue, 16 Dec 2008 07:25:01 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7EAF13A69F6 for ; Tue, 16 Dec 2008 07:25:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.597 X-Spam-Level: X-Spam-Status: No, score=-8.597 tagged_above=-999 required=5 tests=[AWL=-1.998, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WTLXJ4+ow71I for ; Tue, 16 Dec 2008 07:24:59 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id A46E53A69CC for ; Tue, 16 Dec 2008 07:24:59 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBGFOqmm009682 for ; Tue, 16 Dec 2008 10:24:52 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBGFOph4009676 for ; Tue, 16 Dec 2008 10:24:51 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBGFOjmL016556 for ; Tue, 16 Dec 2008 10:24:45 -0500 (EST) X-ASG-Whitelist: Barracuda Reputation Received: from smtp-dub.microsoft.com (smtp-dub.microsoft.com [213.199.138.191]) (using TLSv1 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 7A6E01180009 for ; Tue, 16 Dec 2008 10:24:45 -0500 (EST) Received: from dub-exhub-c302.europe.corp.microsoft.com (65.53.213.92) by DUB-EXGWY-E801.partners.extranet.microsoft.com (10.251.129.1) with Microsoft SMTP Server (TLS) id 8.1.291.1; Tue, 16 Dec 2008 15:24:43 +0000 Received: from EA-EXMSG-C332.europe.corp.microsoft.com ([169.254.1.53]) by DUB-EXHUB-C302.europe.corp.microsoft.com ([65.53.213.92]) with mapi; Tue, 16 Dec 2008 15:24:43 +0000 From: Stefan Santesson To: "secdir@mit.edu" Date: Tue, 16 Dec 2008 15:24:46 +0000 Thread-Topic: Properties of a hash function Thread-Index: Aclfi+NsLPuJ/1YNTnmLbGfN1xoolgABIwPg Message-ID: <9F11911AED01D24BAA1C2355723C3D321AB5D9DE46@EA-EXMSG-C332.europe.corp.microsoft.com> References: <200812161536.17378.julien.laganier.IETF@googlemail.com> In-Reply-To: <200812161536.17378.julien.laganier.IETF@googlemail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mBGFOph4009676 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: [secdir] Properties of a hash function X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Just a thought where I'm interested what the rest of you lot think. The issue of using a hash function for its non cryptographic properties has been discussed since last IETF where Eric brought up the issue that we could benefit from a hash function that is designed to have no security properties. Another aspect brought up is that we in general are bad to specify what security properties we are relying on when invoking a hash value in a protocol. E.g. Is it just an identifier used for practical reasons or does it provide pre-image collision protection? However, if we are expecting protocol designers to define the security properties of hash they rely on, then a common language to express such properties would be most helpful. So I ask myself: Does one exist? If not, would it be worth the effort to create/provide one for the sake of documenting the purpose of hash usage in IETF protocols? Stefan Santesson Senior Program Manager Windows Security, Standards _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 16 07:35:36 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 19DE13A6A9C; Tue, 16 Dec 2008 07:35:36 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 76D5E3A6A8A for ; Tue, 16 Dec 2008 07:35:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.53 X-Spam-Level: X-Spam-Status: No, score=-2.53 tagged_above=-999 required=5 tests=[AWL=0.069, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DGaZ4BOrajkj for ; Tue, 16 Dec 2008 07:35:34 -0800 (PST) Received: from ey-out-2122.google.com (ey-out-2122.google.com [74.125.78.27]) by core3.amsl.com (Postfix) with ESMTP id 593453A6A99 for ; Tue, 16 Dec 2008 07:35:32 -0800 (PST) Received: by ey-out-2122.google.com with SMTP id 9so435348eyd.31 for ; Tue, 16 Dec 2008 07:35:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:to:content-disposition:cc :subject:date:mime-version:content-type:content-transfer-encoding :message-id:from; bh=ItgqcV0xgY+GpQIwMHDNl0cGY5CZPFjatrhBMRZoIq0=; b=N937qTt+mQVULY8o3QGbcRl7wkhmvlFKgvbXuSj686YldyDJbD4S8JTQP9dWN9pgm7 qF2pj6r+N0iALn9ZaFswtn10qQcliPtcdAIfGmziXcCrtaHKmyw1ID8MHGxbP/DQG1Se 36SOhuiImESaPUuN0wps1TSWzsxxgkBc2c24s= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=to:content-disposition:cc:subject:date:mime-version:content-type :content-transfer-encoding:message-id:from; b=pjNd6hatAOc1Z3TPgQromHcZJI0BTeq5s4C88hYPVQDxGBxKPAVxvDLvOs57AAsdhf vl/q/uzBdfq8GFlf0oEoVyHAZvlL2m7mf0Gn9s8QVu0wCO9Qr0PnSkwkuKGAxVsb/b2N kMbaPp5LV34kQtVIsS7W/bjwkddnMclMRZa2E= Received: by 10.210.51.10 with SMTP id y10mr9415348eby.16.1229441723265; Tue, 16 Dec 2008 07:35:23 -0800 (PST) Received: from klee.local ([212.119.9.178]) by mx.google.com with ESMTPS id t12sm1297178gvd.25.2008.12.16.07.35.20 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 16 Dec 2008 07:35:22 -0800 (PST) To: draft-ietf-softwire-mesh-framework@tools.ietf.org, softwire-chairs@tools.ietf.org, Tim Polk Content-Disposition: inline Date: Tue, 16 Dec 2008 16:35:44 +0100 MIME-Version: 1.0 Message-Id: <200812161635.45024.julien.laganier.IETF@googlemail.com> From: Julien Laganier Cc: iesg@ietf.org, secdir@ietf.org Subject: [secdir] SECDIR review of draft-ietf-softwire-mesh-framework-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's =A0 ongoing effort to review all IETF documents being processed by the =A0 IESG. These comments were written primarily for the benefit of the =A0 security area directors. Document editors and WG chairs should treat =A0 these comments just like any other last call comments. This draft describes a framework allowing a single version (4 or 6) IP = network to provide transite service for the other version of IP. The = framework describes a method by which 1) routing information, and 2) = packets for the other version of the protocol are passed from one edge = of the single protocol network to the other edge. As a framework document most of the protocol level security issues are = probably with the accompanying protocol specifications themselves. I = however have some comments on part of the "Security Considerations" = section. In section 14.1 "Problem Analysis": ----------------------------------- " Since the encapsulation headers determine the routing of packets traveling through softwires, they must appear "in the clear", i.e., they do not have any confidentiality requirement. " I'm not sure about the "i.e." and what follows... = On the contrary there seems to be a requirement that confidendiality = protection is not applied to the headers. Suggest removing "i.e." and = what follows. " In the Softwires mesh framework, for each tunnel receiving endpoint, there are one or more "valid" transmitting endpoints, where the valid transmitting endpoints are those which are authorized to tunnel packets to the receiving endpoint. If the encapsulation header has no guarantee of authentication or integrity, then it is possible to have spoofing attacks, in which unauthorized nodes send encapsulated packets to the receiving endpoint, giving the receiving endpoint the invalid impression the encapsulated packets have really traveled through the softwire. Replay attacks are also possible. The effect of such attacks is somewhat limited though. The receiving endpoint of a softwire decapsulates the payload and does further routing based on the IP destination address of the payload. Since the payload packets are traveling through the Internet, they have addresses from the globally unique address space (rather than, e.g., from a private address space of some sort). Therefore these attacks cannot cause payload packets to be delivered to an address other than the one intended. " I'm finding the use of the term "intended" in the last sentence = misleading. If an attacker is indeed spoofing an ingress softwire = endpoint and trying to inject arbitrary IP packets into the E-IP = network at the exit point of the softwire, what's the significance = ofthe "intended" destination address? If it's the one intended by the = attacker then it's kind of tautologic, and there's indeed a problem, = which seems acknowledged in the next paragraph: " However, attacks of this sort can result in policy violations. The authorized transmitting endpoint(s) of a softwire may be following a policy according to which only certain payload packets get sent through the softwire. If unauthorized nodes are able to encapsulate the payload packets so that they arrive at the receiving endpoint looking as if they arrived from authorized nodes, then the properly authorized policies have been side-stepped. " I suggest that the paragraph that contains the text on the "intended" = destination is simply completely removed since it does not seem to add = to the rest of the text. " Attacks of the sort we are considering can also be used in Denial of Service attacks on the receiving tunnel endpoints. However, such attacks cannot be prevented by use of cryptographic authentication/integrity techniques, as the need to do cryptography on spoofed packets only makes the Denial of Service problem worse. " It would be good to understand the sort of flooding attacks you are = considering here (e.g. flooding attacks on the link supporting the = softwire) so that the statement that integrity protection is of no used = can be assessed. In section 14.3 "Cryptographic Techniques" ------------------------------------------ " =A0 [...] If it is deemed necessary to use tunnels that are protected by IPsec, the tunnel type SHOULD be negotiated by the tunnel endpoints using the procedures specified in [ENCAPS-IPSEC]. That document allows the use of IPsec tunnel mode, but also allows one to treat the tunnel head and the tunnel tail as the endpoints of a Security Association, and to use IPsec transport mode. " The use of IPsec transport mode to protect tunnels is diminished = significantly compared to the protection afforded by IPsec tunnel mode = and thus it would be good to point that out in the above paragraph as = well as in the IPsec encapsulation document [ENCAPS-IPSEC]. For example = RFC 4301 includes the following paragraph: " [...] The access control functions that are an important part of IPsec are significantly limited in this context, as they cannot be applied to the end-to-end headers of the packets that traverse a transport mode SA used in this fashion. Thus, this way of using transport mode should be evaluated carefully before being employed in a specific context. " This is all for this document. Hope this is useful. --julien _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 16 08:07:24 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 275F83A6A26; Tue, 16 Dec 2008 08:07:24 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B6E0E3A696C for ; Tue, 16 Dec 2008 08:07:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.533 X-Spam-Level: X-Spam-Status: No, score=-2.533 tagged_above=-999 required=5 tests=[AWL=0.066, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QB0NUxksmrhf for ; Tue, 16 Dec 2008 08:07:22 -0800 (PST) Received: from mail-ew0-f17.google.com (mail-ew0-f17.google.com [209.85.219.17]) by core3.amsl.com (Postfix) with ESMTP id 31B073A67AC for ; Tue, 16 Dec 2008 08:07:21 -0800 (PST) Received: by ewy10 with SMTP id 10so3749099ewy.13 for ; Tue, 16 Dec 2008 08:07:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:received:received:to:content-disposition:cc :subject:date:mime-version:content-type:content-transfer-encoding :message-id:from; bh=s6JVlmemjKcyyksdkuDV56MJtSYHnRafQMyqgsNdnTo=; b=lJ7cXrwv433ERTiiPe4ugGBxiMw5XyxomW3aegTMICmF/NXAbewPCiSIaxqcXP5Iaw sdqwPo8kV+fWIQnQQetp7t5pVSt7xvKfeGLRtL/DBckM69J/m+Pvc24aHbPQuPe/skiJ FBaUZNBdHvtUVA40Jq84arbFWal9ADEj3PQcU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=to:content-disposition:cc:subject:date:mime-version:content-type :content-transfer-encoding:message-id:from; b=NK/wZRX/cycGHZEa2DWJ4uOAO/irrmTQ4fdasqR8y8V7ylHWdEjep7+NIyaV/VYcES FJb0ac/Nsiis+uveK4Ff0AINLAl/y/l7DKTVOIq/5zlbKzmdcvEFwTIn/TZugpqjtLfk qZK6H4Z4fKZfyxQvYuA7rhXeRJNXF4/mB7z7k= Received: by 10.210.54.17 with SMTP id c17mr6132326eba.14.1229443207213; Tue, 16 Dec 2008 08:00:07 -0800 (PST) Received: from klee.local ([212.119.9.178]) by mx.google.com with ESMTPS id q9sm1484685gve.21.2008.12.16.08.00.04 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 16 Dec 2008 08:00:06 -0800 (PST) To: draft-ietf-softwire-encaps-ipsec@tools.ietf.org, softwire-chairs@tools.ietf.org, Tim Polk Content-Disposition: inline Date: Tue, 16 Dec 2008 17:00:31 +0100 MIME-Version: 1.0 Message-Id: <200812161700.31641.julien.laganier.IETF@googlemail.com> From: Julien Laganier Cc: iesg@ietf.org, secdir@ietf.org Subject: [secdir] SECDIR review of draft-ietf-softwire-encaps-ipsec-01 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's =A0 ongoing effort to review all IETF documents being processed by the =A0 IESG. These comments were written primarily for the benefit of the =A0 security area directors. Document editors and WG chairs should treat =A0 these comments just like any other last call comments. I'm no BGP expert thus I'm simply copy/pasting the draft's Abstract = below to give people some background: The BGP Encapsulation Subsequence Address Family Identifiers (SAFI) provides a method for the dynamic exchange of encapsulation information, and the indication of encapsulation protocol types to be used for different next hops. Currently support for GRE and L2TPv3 tunnel types are defined. This document defines support for IPsec tunnel types. The document is short and thus I have few comments: In section 2. "IPsec Tunnel Encapsulation Types" ------------------------------------------------ " Per [ENCAPS-SAFI], tunnel type is indicated in the Tunnel Encapsulation attribute. This document defines the following tunnel type values: - AH in Tunnel-mode: Tunnel Type =3D 3 [RFC4302] - ESP in Tunnel-mode: Tunnel Type =3D 4 [RFC4303] - IP-in-IP Tunnel with IPsec Transport Mode: Tunnel Type =3D 5 [RFC4023] " I made the same comment for the softwire framework draft but I'm = repeating it here for completeness: The use of IPsec transport mode to = protect tunnels is diminished significantly compared to the protection = afforded by IPsec tunnel mode and thus it would be good to point that = out in the Security Considerations section of this document. For = example RFC 4301 includes the following paragraph: " [...] The access control functions that are an important part of IPsec are significantly limited in this context, as they cannot be applied to the end-to-end headers of the packets that traverse a transport mode SA used in this fashion. Thus, this way of using transport mode should be evaluated carefully before being employed in a specific context. " In section 3 "Use of IPsec" --------------------------- " If a R1 is a BGP speaker that receives an Encapsulation SAFI update from another BGP speaker, R2, then if R1 has any data packets for which R2 is the BGP next hop, R1 MUST initiate an IPsec SA of the specified "tunnel type", and all such data packets MUST be sent through that SA. Let R1 and R2 be two BGP speakers that may send data packets through R3, such that the data packets from R1 and from R2 may be received by R3 over the same interface. Then if R3 has sent an update containing an Encapsulation SAFI, and if this update specifies an IPsec tunnel type, and if this update is received by R2, and an Encapsulation-SAFI with an IPsec tunnel type, SHOULD also be received by R1. [..] " Maybe this is just me but I have read the last sentence above 5 or 6 = times and I have trouble to parse it. It seems to be some comas should = disappear. Would this rewording be appropriate: = "If R3 has sent an update containing an Encapsulation SAFI that = specifies an IPsec tunnel type to R2, then an update containing an = Encapsulation SAFI that specifies an IPsec tunnel SHOULD also be = received by R1" ? Nits: ----- In couple of places you're using a reference to a document as a = grammatical object while I understand a reference has a parenthetical = nature and thus can't play that role. E.g. "This document does not specify the use of the sub-TLV types = defined in [ENCAPS-SAFI] with these tunnel types." Should be reworded into something like "This document does not specify = the use of the sub-TLV types defined in the BGP Information SAFI and = BGP Tunnel Encapsulation Attribute specification [ENCAPS-SAFI] with = these tunnel types." This is all for this document. Hope this is useful. --julien _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 16 09:05:37 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F6C03A6A9A; Tue, 16 Dec 2008 09:05:37 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3EF223A6A9A for ; Tue, 16 Dec 2008 09:05:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[AWL=0.062, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n0MjoU4NyRYF for ; Tue, 16 Dec 2008 09:05:35 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 4C3123A696F for ; Tue, 16 Dec 2008 09:05:35 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBGH5PEQ029535 for ; Tue, 16 Dec 2008 12:05:28 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBGH5Hua029484 for ; Tue, 16 Dec 2008 12:05:17 -0500 Received: from mit.edu (M24-004-BARRACUDA-1.MIT.EDU [18.7.7.111]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBGH59ej003064 for ; Tue, 16 Dec 2008 12:05:09 -0500 (EST) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id 97EDFCDB3A5 for ; Tue, 16 Dec 2008 12:04:52 -0500 (EST) X-IronPort-AV: E=Sophos;i="4.36,231,1228089600"; d="scan'208";a="115870428" Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-2.cisco.com with ESMTP; 16 Dec 2008 17:04:51 +0000 Received: from sj-core-4.cisco.com (sj-core-4.cisco.com [171.68.223.138]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id mBGH4pq0029032; Tue, 16 Dec 2008 09:04:51 -0800 Received: from xbh-sjc-211.amer.cisco.com (xbh-sjc-211.cisco.com [171.70.151.144]) by sj-core-4.cisco.com (8.13.8/8.13.8) with ESMTP id mBGH4pcQ023639; Tue, 16 Dec 2008 17:04:51 GMT Received: from xmb-sjc-225.amer.cisco.com ([128.107.191.38]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 16 Dec 2008 09:04:49 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 16 Dec 2008 09:04:42 -0800 Message-ID: In-Reply-To: <9F11911AED01D24BAA1C2355723C3D321AB5D9DE46@EA-EXMSG-C332.europe.corp.microsoft.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [secdir] Properties of a hash function Thread-Index: Aclfi+NsLPuJ/1YNTnmLbGfN1xoolgABIwPgAAPhZcA= References: <200812161536.17378.julien.laganier.IETF@googlemail.com> <9F11911AED01D24BAA1C2355723C3D321AB5D9DE46@EA-EXMSG-C332.europe.corp.microsoft.com> From: "Joseph Salowey (jsalowey)" To: "Stefan Santesson" , X-OriginalArrivalTime: 16 Dec 2008 17:04:49.0583 (UTC) FILETIME=[67B103F0:01C95FA0] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1892; t=1229447091; x=1230311091; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=jsalowey@cisco.com; z=From:=20=22Joseph=20Salowey=20(jsalowey)=22=20 |Subject:=20RE=3A=20[secdir]=20=20Properties=20of=20a=20has h=20function |Sender:=20; bh=l3Nk4NQiPjweA+yJB6Uu1N4SOUJL2QBwM917hEuL6D8=; b=ZfHjjxFKdcxNnSIRXQ7PRi7J8m/9Dbo2Ftby8LBvx8xkMoNQ/pdLcSLuob wjAfCEqfZgLoUlpHneiImH13sU95ef+y3b8E1qrNfHxaFdW1wXmb5K4Luk/X Z3cs8JK94R; Authentication-Results: sj-dkim-3; header.From=jsalowey@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); X-Scanned-By: MIMEDefang 2.42 X-MIME-Autoconverted: from quoted-printable to 8bit by pch.mit.edu id mBGH5Hua029484 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: Re: [secdir] Properties of a hash function X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I don't know of any document that enumerates the properties and uses of a hash function (cryptographic or otherwise). I was thinking of asking a similar question because I think it would be useful. Cheers, Joe > -----Original Message----- > From: secdir-bounces@ietf.org > [mailto:secdir-bounces@ietf.org] On Behalf Of Stefan Santesson > Sent: Tuesday, December 16, 2008 7:25 AM > To: secdir@mit.edu > Subject: [secdir] Properties of a hash function > > Just a thought where I'm interested what the rest of you lot think. > > The issue of using a hash function for its non cryptographic > properties has been discussed since last IETF where Eric > brought up the issue that we could benefit from a hash > function that is designed to have no security properties. > > Another aspect brought up is that we in general are bad to > specify what security properties we are relying on when > invoking a hash value in a protocol. > E.g. Is it just an identifier used for practical reasons or > does it provide pre-image collision protection? > > However, if we are expecting protocol designers to define the > security properties of hash they rely on, then a common > language to express such properties would be most helpful. So > I ask myself: > > Does one exist? > If not, would it be worth the effort to create/provide one > for the sake of documenting the purpose of hash usage in IETF > protocols? > > > Stefan Santesson > Senior Program Manager > Windows Security, Standards > > > > _______________________________________________ > secdir mailing list > secdir@mit.edu > https://mailman.mit.edu/mailman/listinfo/secdir > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 16 18:29:59 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 056CE3A6A9C; Tue, 16 Dec 2008 18:29:59 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 35D193A6921 for ; Tue, 16 Dec 2008 18:29:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fWHD25e7i7fF for ; Tue, 16 Dec 2008 18:29:57 -0800 (PST) Received: from mx11.bbn.com (mx11.bbn.com [128.33.0.80]) by core3.amsl.com (Postfix) with ESMTP id 570B33A68F9 for ; Tue, 16 Dec 2008 18:29:56 -0800 (PST) Received: from dommiel.bbn.com ([192.1.122.15] helo=[10.84.130.126]) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1LCmAQ-0006we-FH; Tue, 16 Dec 2008 21:29:44 -0500 Mime-Version: 1.0 Message-Id: Date: Tue, 16 Dec 2008 21:29:48 -0500 To: secdir@core3.amsl.com From: Stephen Kent Content-Type: multipart/mixed; boundary="============_-982641504==_============" Cc: magnus.westerlund@ericsson.com, flefauch@cisco.com, allan.guillou@neufcegetel.fr, jmanner@cs.helsinki.fi, tim.polk@nist.gov, Pasi.Eronen@nokia.com, ashokn@cisco.com Subject: [secdir] Comments on draft-ietf-tsvwg-rsvp-proxy-proto-07.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --============_-982641504==_============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document defines extensions to RSVP to enable a router to act as an RSVP "Receiver Proxy," when a sender invokes the proxy through use of an RSVP Path message (so-called Path-triggered RSVP). (An RSVP Receiver Proxy is employed when the sender (reservation requestor) is more than one hop away from the first router that implements RSVP.). A companion document (ietf-tsvwg-rsvp-proxy-approaches) is cited as an informative reference, but given that this document makes extensive use of definitions from that document, I think it is more properly a normative reference. The use of a receiver proxy for RSVP reverses the usual roles in the RSVP protocol, and this suggests that there may be new security concerns, distinct form those usually addressed by RSVP. I expected he security considerations section address this possible issue, and about 40% of the text in that section is devoted to this topic, and it is appropriately addressed. On page 12 the authors note that certain error cases in multicast environments could result in transmission of a large number of PathErr messages to a sender by many receivers. This is cited as a possible "scalability issue," which I interpret as a euphemism for DDoS attacks. I also expected to see a mention of this in the security considerations section, but there was no further discussion of this DoS issue. Page 12 also notes that the mandated behavior described in "this section" (but presumably subsequent sections, i.e., 3.1.1-3.1.4) does not apply in the case of wildcard filtered reservations. That seems a bit ambiguous; does this mean that the routers SHOULD/MUST do nothing in the error cases described later, or that they MAY do anything that implementors please? I have attached copy of the document, with numerous proposed edits that I believe will improve readability. Steve --============_-982641504==_============ Content-Id: Content-Type: application/octet-stream; name="draft-ietf-tsvwg-rsvp-proxy-proto-07.pdf" Content-Disposition: attachment; filename="draft-ietf-tsvwg-rsvp-proxy-proto-07.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXN9zm8YWftdfcaZPzUzummVhgb41 qd0mc5vxTXTbh/Y+YLS2uJFAAeQf/32/RYAMqhSg0RpnJrZleXz2/PzOdw77hf5DX4hL Jol7grmea5MjBbN8coOA+bbjU6bod0ro4m3OKcrJKv/lEX7PYtzn0rJ2L+2/cxwW2IHr kucK5tjOLFrTmzk5ovzV6tN8TRdXnFnEaX5L39Mrmv+fLucQ6Ksizf6JSBDOszybSplm 05BJuMy3fH9SMtkes4JKTbC0xTkMbVmzeXTakPNPv/3+M435uGL0b0VX4TZaqm32agZ/ sAh/rp9TjPBT4fvMtgKHvN1hJ+Wn3GdCh+POT/cG0Bo56bXvkkJliSrKgBqgwBFR5SNT eNyT5LWlPSnfv84b6b7HfBG4MGpbpgEa/CkLb4sxHkxv4zxKjXpudchJua4VMMeT3jjX TRZqQXkRFtv8B/pUhMkizBY5zbMw+vwVm7xn9GuYJMps7qhOOy0LWMxDAR9ugcvHTZwp aP59mGzD7Ins12RbVrDXvAHvti3UHiEC8qzdOSrdDgjhvby7r/6bxPcqy+PiidJb+kWt 8jj5HBs4y77GtM9yMkWaAkMysJnliBFFpqvfId//yOhDmIVPYRImJi1Qn3ZKkSpRQoUt neGROkTjR95rvFrVp52UBTwHPUqFvYcA3SNK7fkyguDnbbxamUELaMMcLknuztpH/dvz orQmLVYi7fy/DWxn/6BF7HQDsyFdq5Qu8zg/7H0OoPeBhD2Nf+xtv2gAs4o/G82K1Wn7 OIWxuuRKFgTOy2RF+qC2t0YtUJ12UhZwfLT/7ggEecy3+7z+frt6Il4iTt+oBarTTsoC IgABUDMw0yCqpLCYlHYdl9PAsDZnXg2gRtXvj59+u6bLx0IleZwmOd2mGV2HxbIhUGZn Y6Bsy2a2lJzk7hR9HPDM/EnTfFUiVZV533t9nQHM4rs7laGNLzX7UUVKN190naWPT41S QevNenC9nULeh34WjstslI8hSjVW2TgoM6ehn/daPcAW1EU/nQS60CRVo83zuSiHNi0X AFlWok/AR7mjZxMWAO1odcaquG2015NiHsGQcukzP+BeV9KTqfPMEa4nPdIN3K5MA5yx yO8f7kyoL/CYE/gI5bahX1J9+5zdlmmA+rL8fmNAezaKihBINlPSni0Zt7q+N6Rub7pl 5EwjQxtJJnDAQk5Jey6ml/wwnQzwPaivSE04n+cz1z3M0S8auppt477omnSA+kBNF4/7 unu+yiE4xxT9IFBa6jvgH0q7jkKrwxgSy0Fisao+oM3aALfMxg72D8BeKVW/XQMUNIZI lQd49QBZdbWGIROGTXouUCzjnH5VaxPxwTH0d1GKsWjxXPBpNHquL5FnXCx86M2Nicjk eSCFgAUGT8SBnN88Ub69WcdFESd3Ozs3c/LzLxpwDKUDCQztVmeYAobG7McTyM+1TMP1 Ws7JX5MKoyWF22KJvjlTG4wPVVLkUHJYUJg8mSBygGgDC210fZY++jXV8rkyYDb2pIbr F34bbjarOApvVoo2IRiKgqDktFiinX53/ZGiVRivy9T1sIxhhaXSP8/xCYksfAgzZUL7 OCAXqKr1SaelfYtBtnEjzmV4rwxAJSAlYQmM6105WtgbpRJt+wfMlOhG0QKbKKs0V4vX iMGFjkNd4LpecqOidK1yE07ShGh1xkk5icvBa9Yk4mwAHNQhqsPs7/QeJxRGUZotwiTS byiW9ElFBThGktoYb95ekxcwE8qXwGseui63OuiklO/Y6LOCOj+2AO4BCTYA4I5ga5rF VVc4IL14jX+GOUQDLPRG63kX8ECPYElQb+u2BT6pxHPTS+C0uWMjm7VlGqDEEliggOm4 SrPPGrIt0mi7LnFFidMV1Vqmy+QuTpTK8C4joVQXu+p0kwol20VfNnJuOg/zz3SVZshV f37/7nJ+9eer1xQDyMEMYb4rI/rb2iJ3WbrdGCkd6Lm5CxrLrY5XqXyAQzGiD2mhSkz6 vKCfawLR5Nu2xCfD0hge1ev+eml3TB+1g54709M6fKJwlacabBRZfLOFhmvv2MdrmDex aiI+wZD5ApWuOmWf8DxzQhRuwKSlu7+25qfhDQiuwEIFGeMNuzzNnkfUmchYNKvS8gQ6 vLa8k9Chg0dlLGtaY3EnsNB1uuOivK6tJgxbI5iOwCcNe+aA5TWC6cg0oOA8QzCL8mmC fT68x4bXolwyCJFBH+P1dq27gTx+pHWaFEsjJbV+8qU+YZ80aapAOT5nrmwehxqgdd2N odnVdQkt8HazAGWCBhik1CqM9FeaPLnJ05XC63SDlrhkUva2McdYYRJRrmTWh52UATxk W6+m9we2w0W8VoBb7wpNQcVJ+DyHnAluNVQ6FitKwYcDxA3GYpsshr9QkdI23/cXBjCL DYDgeBjId+R/yRyInXRm60WVWqbhAKHOgTkC8Bb7QGBBDDiDqABgLfekAguP1gZuPaMa GFhrOCc8dKWTGHw0ist+RqF4lEkMdDv4ppy+0wgcgUfw6Dtw8Tn7zoALC0yzPIlhuX56 WB9xUmp3sRAmZI1xT4aVsSLnSLTqI6dZcxD8K/RcGjdE2wyhVZjssXg9OnKqQ/Qx9rkx W70pVMs0Ol9FiCOgB1C3CB7AhLCa9uu9x1Gj9V47i7o1DGyPavH7qNSYrwqPYRt0XC+x LIrNDxcXDw8PTO/csTS7u9BfXPB4YSAx7X21OkQfxRrz1dGKDW/AuIRRkettlIMGfPbt 73TY44EBejTmoLYPEgN3VUxoXcGx9YUY454re57fj/fiM50zvuW9HRzQyfVRkyrZpxAq gMbClYChY9VZolD6tAwX6QP9FGfPIeiZyCobYEg6WK0YLTTGhGkWq5yOFSO91KSLETqq bx/roqavB/iBsVDHWpztN9PCYeTA39WivPQMtizWKxOjWBvy+xY2OJ3qIH2CzJhyQXxh 0DKpPCoCwRoec8ieMMigud7nO55AT198NGJ+zLFwbXOH2jK3+o3u8uEQqNFZj+yzsskx gAp8uFtbpBNh0xVwlz/LtRJVXg5B2F/o3A5xAEC+lpRG6FbAN4WPp3raJzmp3CFxM0K5 zboA+jg0vfVIbRr7sMKTIHDqwc5EZJIec+s5yYFIu/vAZsPvA+uYrum3AIP3l5KVT4A3 F5btTef66G3qOckRmYjPht5Rdkwm+gLa5yvXpgn95EFzH9hRmXBv2mzQvWnHZeqhJ4cz 9FJTqlZC2KBNmyuyWpngpRaHhK1v0ZsW1SQ4RuJV8952pm6uN5YvLTwE1Nw705bppZ4f sEEg2U7dQ05EJozp9KOXZVt7INKL5EsbG4v+qMsxnt3th51xrIavMCbSH9WdU11Qsfvh /v8/rsM7Rfx/Bkij5naS+rRD095fpM7x0AplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoK MjU0OAplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9S ZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBbMCAwIDYxMiA3 OTJdCj4+CmVuZG9iago2IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9D b2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL0YxLjAgOCAwIFIKPj4g Pj4KZW5kb2JqCjkgMCBvYmoKPDwgL0xlbmd0aCAxMCAwIFIgL04gMyAvQWx0ZXJuYXRl IC9EZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBhZRNSBRh GMf/s40EsQbRlwjF0MEkVCYLUgLT9StTtmXVTAlinX13nRxnp5ndLUUihOiYdYwuVkSH iE7hoUOnOkQEmXWJoKNFEAVeIrb/O5O7Y1S+MDO/eZ7/+3y9wwBVj1KOY0U0YMrOu8ne mHZ6dEzb/BpVqEYUXCnDczoSiQGfqZXP9Wv1LRRpWWqUsdb7NnyrdpkQUDQqd2QDPix5 PODjki/knTw1ZyQbE6k02SE3uEPJTvIt8tZsiMdDnBaeAVS1U5MzHJdxIjvILUUjK2M+ IOt22rTJ76U97RlT1LDfyDc5C9q48v1A2x5g04uKbcwDHtwDdtdVbPU1wM4RYPFQxfY9 6c9H2fXKyxxq9sMp0Rhr+lAqfa8DNt8Afl4vlX7cLpV+3mEO1vHUMgpu0deyMOUlENQb 7Gb85Br9i4OefFULsMA5jmwB+q8ANz8C+x8C2x8DiWpgqBWRy2w3uPLiIucCdOacadfM TuS1Zl0/onXwaIXWZxtNDVrKsjTf5Wmu8IRbFOkmTFkFztlf23iPCnt4kE/2F7kkvO7f rMylU12cJZrY1qe06OomN5DvZ8yePnI9r/cZt2c4YOWAme8bCjhyyrbiPBepidTY4/GT ZMZXVCcfk/OQPOcVB2VM334udSJBrqU9OZnrl5pd3Ns+MzHEM5KsWDMTnfHf/MYtJGXe fdTcdSz/m2dtkWcYhQUBEzbvNjQk0YsYGuHARQ4ZekwqTFqlX9BqwsPkX5UWEuVdFhW9 WOGeFX/PeRS4W8Y/hVgccw3lCJr+Tv+iL+sL+l3983xtob7imXPPmsara18ZV2aW1ci4 QY0yvqwpiG+w2g56LWRpneIV9OSV9Y3h6jL2fG3Zo8kc4mp8NdSlCGVqxDjjya5l90Wy xTfh51vL9q/pUft89klNJdeyunhmKfp8NlwNa/+zq2DSsqvw5I2QLjxroe5VD6p9aova Ck09prarbWoX346qA+Udw5yViQus22X1KfZgY5reyklXZovg38Ivhv+lXmEL1zQ0+Q9N uLmMaQnfEdw2cIeU/8NfswMN3gplbmRzdHJlYW0KZW5kb2JqCjEwIDAgb2JqCjc5Mgpl bmRvYmoKNyAwIG9iagpbIC9JQ0NCYXNlZCA5IDAgUiBdCmVuZG9iagoxMiAwIG9iago8 PCAvTGVuZ3RoIDEzIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHN W01z3DYSvfNX9HFTNYuAAAiSxyTr1Ca1ByVWJbW1lQNFYSRuZsgxybGsf58HDsgxKWs0 HEcU7LJl66PqoT9edz80PtAv9IFCzTSFsWRRHAlSWjKeUJSmLBEqodrQ71TStz80IeUN 8e53k+PnOAuTUHN++NTxf0qxVKRRRHEkmRIqyLf0/TUp2f2o+3C9pW9/DBmnkK7X9A/6 hq7/T++uAehFSMHXQAK4mMeCOkwBZzwMcQKc4To/jfCnsjV1adoOaPftr4Y2gQfiMNYU j9GetOA/X9eCScwSmUZqimmGBf9VZ+uWDr9+ff/bFf1qclN8NDVd1dWnR3r3qTVlU1Tf BAiFGRa+IERFnLAo4kcLuxidcZqycUfpPvy83zyS4DxZALxMEiZ4enSFVwkmI5bwJHEJ djJkF0t6ETOeupwfZ3nwFTw0ibtgFjWGCZOWbg/ceCLupgi/u2naOstn8xDQBjOJ/MhD Y7Qjp07xzXHqV1mQp0zFOnYWHGGi621waXWZYCLe+fXMgsc5i1E553sVJNJRYlPcldmm KO8oz0q6MbRvzC21FW2zPw2Z8vZp+Qn+7votFGeKJ+AXd5xz+OWVy49QEUNFDAdMjl9O JA6CYNRitNVT253ufS5oNESE/iIM4ynOaXiOkL227SKbKSn6sVF4zml+EHjIi6ba17mx /zD1x6wtqrI5mDRA83ReN/Qku15uJyVqtY5lOsA/JxznsNAFbh5aXJ0KxpW8oJ9Exhcl Icl/uiK0lQ9V/af9RFXfoiFCwt/tszpDz2movTf0S/UepvuwL2rQwc0j5aZus6JcotvA YJByZF5/VK/MjxIlhVbz2QDmX2+qh4YR/V6095RX5UdT2pjONh0Vr+imwuet8W+zNqMG OQDPZF0muL61Wi/hAJxRqVCTdof1ygGxwojnuj1MhP04ZRnhJOfB/hndFQtQMuhDcomi rC/FisDogoVaW4R3Wd3aTB3Xa8TRf027svGC8TTDn21WPtryvUSIDDl6OKJXEaIjWxEv Y8g8a0xDD51Nv1R/qGgGWkTC7tsuX2s3V3beWMT8rkJpd1av7B9plqbqMoo8kN4KValj w5W1d1m1XewvYNgQ1TWWGNO1O8Q5hn3lbipMY6ZSdMc9pvm1J8922c3G2NLTRbatMX3M OgsvYFypFUZQHg0HOce4i/VVKsHIHrlJak6r6iapRQvLGOzJuvfK0TmM7HqM6ViZXxQ6 XXSubG/a1bi62kP6RD17xEB6n31EeWuGLy4RqFwwmUDv6s/kAnXGmcZK4+exEZwhOF8y tOiUhTKRU8wnY2Ox5JIpMr8XxGYmV9fgYALZmXpd1VsrVYw7IaqscHGfbdZUrUf1GIR3 fV80S4TM0BC5o3rFbZIzrcVlFTnb2KkFEfmFYdyOjZCMTNOivBTNPUZF+MJWl8bcbTHd OIcs4YBhaHGH9coBImRxPzTOHFq+KMH97TKSvYyTWmDoHkEdscdUeJ1TWSaMdo50fRyj RpBOkPAU4HwB7nOYwXmXj8M9lT+WQxOreSynzpxhOSu/7TKoEeu62rqE7tQIJLxN746A xzUOXPvv6sHgdm21SLq7Kylnda+yPcR1qrrkytdqFA3dFk2+b6wMj6HfWjuvtraDQNK8 puwZ6oQlKZRk7fDP73p2WQk9i26rfN+x/84qt9C4+pLdXbsuER0Q7wVm0OlRRnQ2lesX a4Y4xiDJL6zGu11dZfm9aVaHJDTuDhu3w1YDKo25PdzfrLO82BRt1hqq0Dod1HN6gPS4 hAOGauwO61N+RmnEEON6/hxt89PNKGPyg2JUNeh6hss0yBZtXdzdQZvr5PNu2t7ZfmgJ 6/ezQH9Sr6yfaMhzEXZ77JLOzFmgqztXtjBtTdNkd9DqJhXKtfxHDmp2Ji/WBb4TVLqs OBq5o3pl/jiGOgc16RLzW7L5fJZ9peWpofOLLgZr13rKhi0ANgxD3BbCoBOwXtSaCEwg sDPnvO0JJg51ZbjB9ANTBCfqfkIL/MCkBEtV6pfvpGI8Cnvy9sNOIkI/Ndw3+IHJrsjY hcoDy/qBiYP5sTDoEyaFpV/OB2XKCzuplIMzI698p5KQRdqvJUdMuCh8wxzjh++wS55C yPIqxiMMo1L7lXdKgzOHLtAP38mYQc3xy3ciAWfiUYJHPK6EffnQb8CMXDcVQOdIGp9L n3h3cY5COyylKfTAIulblSd7OG+yGqtwiRfFw6bQyE5vta4rU8mGyvLETIcVzWD++5SJ 67oNR05NHpzxZAYkAMbsO5VnMFEYzH0z8xwm+oCR/4VnPDLWDDvBXwzxsWoXzHrH8zym l58WSR2zyK+nRTLCFpDwq1GRKgVh9uzkxyAlVciw2HPg8HGEvxVhSimwIT28xvCDnIR9 kNf3KWM7vRlhhoolriN4guht+JJrFg77189gWpgvBTbEhOq7lGcx4d3jcnwp8GYsEolP 0qeI8cL0uBg6TbrRC4k5ndPXrPOLmLM07LuUOWr4fwz9mO1xE7SvV2RayjaQvu2vd592 WNpv6OesxEY/Hgmu7DvB9PDF49//u4J8TuKPJe4j+veD/WnnRsVfFw8otwplbmRzdHJl YW0KZW5kb2JqCjEzIDAgb2JqCjE5MzMKZW5kb2JqCjExIDAgb2JqCjw8IC9UeXBlIC9Q YWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAxNCAwIFIgL0NvbnRlbnRzIDEyIDAg UiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTQgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAv Rm9udCA8PCAvRjEuMCA4IDAgUgo+PiA+PgplbmRvYmoKMTYgMCBvYmoKPDwgL0xlbmd0 aCAxNyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBzVvbbttGEH3X V8xbGyDd7H1JoCjgOgrgonVcSW0fiiJgKNpmK4kOSbnR33eWIqlSFu2QRtYrAZZtScBc z5wdHn6CX+ETME00MCOIMoqD1ILQAFQYkoDLAPIE/oANvDkvGMQF0OpZxPg9SljANKX7 fx3+kpKEPFQKjBJEcjmJ1/DjAqSovlq/LNbw5h0jFBgsruFbeAWLv2G6QIOeNGnyHJPQ OEMNh8qmCSWUMfQAfVjEj1t4sSmTfJOUlaHVx7+atQFmwDCjwXStfTSC333dCAaGBCJU 8timARF8m0fXJewfs/nvVzBL4iS9T3K4yrPPO5h+LpNNkWabov5Q9fLTdrUDTmnwaoIV MiDwIypXBAHhNDw46VXpCkUCGgR16T5aDM7aiRtCw7qbuv0zeUaHH6VuMgh0WECEBbI9 6jxSn8cWLqKPqwSyazjPsNc3ZeGg1RlXJAyYAdMxe+JHdmlIpNHGq4qjlBgcTsMBHNGE EQDE8TxbbuMSgQZI39MB2HBloxvimKxdqsHmkYqF457qsx+kAwcOaNl1wIva1SEnVIoR g76aOozYWkEguEcgqEbSb0WyhHQDi9u0gLdZvF3jO9BXPwDKZQYab32aVxppjOBajupU jtFfJPk63WSr7GbXH+e+DsDva6cZqL31KgNGIv+uCQPS9YbrTp7iutgCAgNYkbT/sbLr LId5slkiY7vMyvQ6jaMKRXuaAIzTBOyd9Sr+WhHD2FgMEohBDihIy+z1M8w9VRb3aQRX UXk7zXP4JSmK6CY51ceMOi2T2kmv6kRpEoZyHFLacWUrZT+v1ndZkVZNiTx2Pp3PL95f QrRZwvd1hpZJEefpXZnlP7Rty7jTDNTeepUBGeA5Ro1jlU0G7Mw6zzoZmM5m72cf5lfT 81OVf5hdTDjNQO2tVxkQIR7bmqPkkMWMDT8+bA/YoYU8zZ7hLPB8mJdRmXyYJevsHsnb u1V0Aw7ijJyHcIk7Jl37VMf5MICfXDYdKqP7G3PK64/s94PXC0q05s/DStmtEzugPu5w HXWzXUV5u5bCNVQ3+vYv5pbX19561amcEdPQ+oGs0raphck+ulDRyl3LFh6GHxPgltbv nfUq/gzXwxZeBq+wESVt5c+TeJun5c4eb4sU2XzF4k9W+6kEcLd8rfbWqwxQSYSg4zBI YQYuzi4dEHvcgGhqBAM92t6zkTVi64a75TS1jz7ViQoV0UzoUZ2qsU7O4n822b+rZHlj l01f3KFN13KnbKHx1qsMBBpP4AqvXNpLkANZpcEMzJLrJE82cVKc4AJNnPtfuVO2oGpv vcqAMXi2DcZhJYCpzrWXWb7GIXWfPJIPJ8Q+xB2aAlX7VMd5AK/vKSLHZdI13wtar3RI OKoJRjWqLRPLKi82uKF8slBO5sBxBmpvvWpUTYkIRl4wOduWt1lefANny2WOq74RcMmd 8npVe+tVBhTDo21zsho4rKw8ZbVK4nIbraye4i7JkeHbzd95drfL05vbEqp1yJ5JnBpZ 3KnEQtXeepUByUkowwaF/EBGIQlVrKEwftiEqgUh2oW1HzZZGZsVTe2pnh82USQ/KF3y ySaJwj5K2wWaF3GSIcXpr7zKnQwYUdovuRVufYg27eLBj9yhXjRU7SHXD5uUIlxov/pO asTM9iDkR5yEIZq3rNsPm3iAmInCY49wXHKrbm6EFJ0wHYsIhygvnyNzlIwhZDZUpSu9 RJnYZKy4+sgmoJX48sv03pJy1JC3gpNOnF7KJhEK0k6WB2Haa9AnwzXoD8JUy+InXyCL RxBAxGyYSo9NwCZDdfF9NsEnPEs8IdUXRuM1y4ap9NqEWv3JIK1+v01P3z4gtCHKr9sH hAoQMP0iKkKGCJgNOvmhHBYSBSnNxfxuNb0UYArBUW7b6sL9ACdub7ppeEo3Ti8GmEyS oGbiDyx6GbykmrBWyttjk2O85CGuHGXDUnptcoqXHO9eUTzwaaHCDd5FdlBAHjfdi9wC xg0lIWtYypA1288JvIu28W2yzV9DUkK0wqWzfUw/36W49oSfos02yvF2pdf2jqVw/+bh 559XVgIp/nJwqaLV5jfeDq2K/wDPCeURCmVuZHN0cmVhbQplbmRvYmoKMTcgMCBvYmoK MTU2NQplbmRvYmoKMTUgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAv UmVzb3VyY2VzIDE4IDAgUiAvQ29udGVudHMgMTYgMCBSIC9NZWRpYUJveApbMCAwIDYx MiA3OTJdID4+CmVuZG9iagoxOCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQg XSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GMS4wIDggMCBS Cj4+ID4+CmVuZG9iagoyMCAwIG9iago8PCAvTGVuZ3RoIDIxIDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXVlz20iSfsevqHkaOcJGA1U453H7mOme3VhP W7HzYPcDRUEWtylSTYBSe3/9flk3AJICIBNmO6IFFHFUVh71VWZW4g/2L/YHi7MwY3Eu wjRPOUsyEUYFS8syLHhSsF3F/s027Lvv65gtaxbJf/US90VhXMRZFKkmd5YkYcnLNGV5 KsKEJ8Hygf3HNUuEvFX/uX5g3/0UhxGL2fUdu2Jv2PX/sh+v0aEXuxS8pkvoXB7lnMk+ BVEYxTEoAA3Xy9M9/HnTVLtN1ciOysvP1tsCHMjjPGN5u7cnR/DdeUewyMNClGnS7dOI Efxht7hrmPrv1w//8579Wi2r1VO1Y+932z+/sB//bKpNvdpuan2R/PPLfv2F8Sgq3gSQ kBEDP0FyRVGEPCodkRcluiINi6gotOieFIbZ1InnYVRqbWrrT/AKDe+wLhhldOIiFGTI lNU5IZ/dHsYhY9Dy3fZ2v2wghjNoeszjkMeQt3anW7ztdnMMb181kFEZJnmW64Fs9Yld PwRTzXenTyyS7B04o0RRmGNqGs9c2JK/7xe7Bax4dcv+tf3A7rY7Vm8fKrZ4fFyvlgti ec2eV809a1af7xtcVKOvf+xXu+qh2jQ1m8MCZWUYi0KwXFOqLdAJMQYvWlPpw+LLDJKL PoZJEmOOarEk6IpJq2tjRPc1s3xW8jBKxIRZHmJyA4lY3q+qJ8jJzRdIQF3tnlabz3S0 3e+WVc1WG1bhGrbZ3lZsu2HNfcWqze0c8oFJIM9EyQyJQ2aoM0MDkURhKiAKpk96hhoh s812DpFN0aMM2K/Tz5Mie+6xSxPgqrTTJUBrg0uDl3ApyR1h5xHIaIJqCWOXxozdbOoO WyR4loyXO6j746K5x8R/DRV+WECxf/7x+if2uNs22+V2LScJaHddWe3XBkFPF6uaEZSd Q/MNNs00tUM0fzYO5AlWehqajpFeMKB+rJaruxWsLUb/468/fc95lP4Glsg1wu0W9naz bTDsciaGrV00bLFe42osyB6q29WiqWYZfz3hZYrWixr+DLNCHE+b72gSq1m9f3zc7ho5 6G/Zzb5hKwxzXe8f8OMMw8t5FsYRDKEmZTzukYJxsyX4Bl2uYRexslxsbul0BgJEWoZZ BB3oUHBydplNP9MsLMtkmoXcmWX69k4O7e2iWbC79fa5JTRQ2H9sn4Gadm/pKvhoFrtZ xt2iD03jRSlmUmB9nOr1yhh3EwxjtXla7bYbtfZ4lkMKnXze7tcAphXb19Xdfs2arUSs N+uKDhVadbNVPYfk25lJU3tRHBAl3AHGRTGSA7RE1KL+6QrTzrpa1LCKkPubumqY1gep CgQjPr1hkP8NA6/UmkAZoVlYYCYnTe5lsSAKs4xPMz7gAJlza4N8rBsMcBbjzrH+6xhr rBT+cJYJ1fHxc9GnK/Sb5iKIBCAi4ZeZYCJH57MkwmKs3fmT09CZFzkcJjqJisT2aTxQ Xy4eFzBxoc/+M8UKeF6EaeqNoO7tyRGcbSKHwzA3K53LcLhmMcIViQmpeOC/F1LpeTIZ +7DaLCupKQ5aeNDNqj2cWnLO2yyeASvI8pI+aaQxi4HVkQFD7UUZ2CgJhYimGVgazuZ5 y5ovj0D6emBlRGZV1dIjLjlzt9ph6lsu6uotQDWwSbNqvtCKbSZ0DaXMcvJ7aVovafzT EjY3Ftl4swaUh5Di83b3O/5WtzVBON/ETZrhwjJKC8RuoYqCl0kcF+4oOOlnj2GoeZHG iP76FI3R6dXmaft75dMwxEzLWTrwosynaGCnaciKsCjj3NIwWVIwDZQlkGMK2SsQzIan ruc5e6mfckSzMkNvRJiXecoEkFqMlRiYkwm4Ojg98+7lqPcUIIOYfgZWdofCeRd7Jrob TJA+GHi4b6r7xfrOIF65AvTMdHO/n2WhAXrKKHPieVbWmkQHgSUcR9iVOJgIybk0SfKy LBhJWiEQqB/Gwp70mFcMyKVIiwwuHqjm6MQF1rIoQ7RxQj+hHEmWxmDN9H5+rjbVDs48 ObWz91hQMTif6sXnqqY551Yurpo9fH8UlZGpA2/JU4uITC1/r1eb3+fEAobWyWJ4JOdm wvjbnJs0z+HpAdaeICdIyKif7Jhj7v83Lbzu4EbDtNTcYyGjp/0FJiosyqRx+KAcbTKF Q8KFWTmgqb0oDiBUwpEYNYkDNKx1tdxC2g9jrRZeIL5sHz2lQdLCDFkyJhaUakova/Qx sRaTQ7/+LGcXH8qJvKdsAGl1ZvGHJ2VYJgC8aaYI0oM8Yu5uWVByiDcUz14wmr3nEBOT IdCh4CLW0WkawydlFtIj3YIa+SgnD0Z007eEn96oKWtXPWK2kuZziyCizC4hKzvH+Fs1 1bRelJomHOINXDxlmjKogBnEcEtJGAcgqtHgT1f1pzft+WwOBli4qom9KAaIJIwIsE1h wDEs8KuJFCk0MMMY8yQNkSkL3Knpuagx5in8MjbqdhmGj7K9Kbd4Ct8l4JO8paS53RY5 UPAZkQfpkQJPCMhTEH8WtmuPcqrJuSi2R4DgSFieMsRjHScTlgpuqTa9nx9/nqGjcOTk WQGtSdsdPalHZw5l0IpNZBz2pt2nEbDsh3BVNXczjF8c8TBOOCBku6/fcvziCIkI+F+3 TyPGr6mfnj/PMXwIoOUJec8uaPhMaLLTpxHDt6ufHucYPZgZeKGTixo9pOiININHt83R EaOHSe/POdKrYyye4pI88e2uflPdxR6gMkOGU6dPI4bPoQZK8LumVL7b7RI5ZlibLtb1 dgboYLOVDRWXBB0S7LqLoompErerermva/KWUuKKzFA3A/6W3SNfS2VSUD67Tl+Fown7 XdZrleo+UyjP+AUMsZfFABkBezU8XsIpgBwta2iDYZsFKZDQ2m3Zjy/BV2GieqfjYFgZ RSm0NSl9krxY3oup5fWXzfIeGWir/6uO55h/nSgZtoyWyF9NkEqWyHBZjo14Aht9ZgiT IQYX8gxrSDNSWiBH2DW9bQjOW28zEZjpNg/NYdkypAHkyKHt0HFyzjiYuDKEpyZ2ZcJj xDoKk2EviI2O5XGGmCcJ9YAA54SljI16JEUcppndGzmGc4x9uqrCz6/PLOqrKgmvDsCf VFUYRLXf15AxxCK+lbalY1aGMO6lflJvsjRjCHFirx0ZkDDncQpfndTFuChzYtUAjvas mZGZ4/FOu824MxRjOKrSL7esqhvkjK3q+7dyZ0dDuzukK38GXeTGfT+djmqxAzh6Vpmk 0vOiknvl1D0DCXYzdIeEmcwJpE8UUuicPUG0PYlmsSc5R7rRxIwqePtrMKm+Q2jAbS1t zQbwRs/AQZsLiuw8Sc4Qu3JwQjhDoJrqTJTwpWgv2XipOkef0jTkIpvkuWP/vTGZC7Ka gUHelP8rg+g7gGyIho6dU3BuDhEo8xDuqpwlmrQhInBmH5oA3oJqJ7ZP4x2l17vV58/Y Y3IrI28WZesCIsHXr2li9z+OGcfZVCnJEGeYnPPRKsJhxJaiZXIrPKV9mEaZb6uCne1Q zwyS7KYjTe0QSZ6NA0KqmTFmY9AKo408Xj5NO2rvIpw3M4yxjaYlmh49xiPoQbBbprDI 3XcyQi6hi8oSmoEEYRKFOyRcxvzCC6BvFFWaEnyTcTfsJ9ETyHIPDE5uHoNyqUQBjX0X KrZi43NwwPp3NLUXpaic6lRN26hMg7uZpSwMyldkUS7gkWh1tyXD3c0UYybtzsJsSH0d 4AhU1UFQs92lE5ah20GSy+5MPbD6WDCi+liMiHCSwMnf7ui3HDtT5afdoxFDp3c/gW1q rpa+c63p7YkYaLM9xthBcAY0ZKqQaIouSsNjlFSiheMUG1vd3VWo/fRUIWlrgQOYVJhb +HJdsYHdF3gTftf1YJwnHVOdSUGa1cZqai+KA8D3aQ7H0RQO6D21RtIx3+2tQE91or/s doqts1z3fTzwkYDHYZ+/1kwHV+BfxDTtoSBV7u6v8+yY0NumkjZdLWvY3fMxF2gW2FBR wNEoxQTOxcElb7BrSo+tzOq7piXK8n6xwUYBWdHrmeKKxIp9jd0CfUD0gIoX6zm01GRg akovSUmxXIT7ZWIemCpG4LkjVRLYZrt7kLsz2mFFo8u0m/DDHmWzZsk+NsEQQ+hFDX6e hdgUPc1CKklnn3fVosE0dbdYrtarBvtmsHtT7gWQdezUzkxslas2i90K2wTu1ByG5cKs kq8pvajRz/IwNTH2kXaHqnC8RYGHFcQYVkcpApkaI+Rzb/eHFzQvMNcKRdSQcR6zUpgQ lLP753WXxtt3s9mfynHeUrnG1RxVd62Lr93v1lTZXdOMmSonLLpsfFOkmMf5gbmyt4Gz 10NGxbK2z56HqbNigE8aBS5lcMyLVuz1TvubL3OYC1M7ydA5RIzHjP0EMXZjT6E8V3fX 4ZTe2PeAFGONWiosbp9QeRQ7Gc0OWj8wJEsabMwmRgkUXdP2bo7xN04zoWm9rPGPkQrX r+f7YvoKYKLD40dQOAXiUD0RHhDUWewE048EmDp6LBcX0ek96RxVO4RAiQyRSFouangF R5lfUy/5Muq3Ck7F6CfG4VRJEbtoHMjVnoV4KU1iQA6DIUOze4TlcJlXKtpvCnx2V8AH 8j164nmKECoHgZSLvMjjkglZWwaoNEcyTYrsK5fwQQ8dkPDRG8QBK2+Tk2sGa4LX4AYl NCqU3PqGPLc5ZIaM8TyHl+koAQf43BvrU3wm80RdREoxjJDhc4x8sSRLYsdneugAPvdk 7GU+c7hlsV8Y9S+0bo8foF5gg5J5Xm29+8M2NMMSJY9DlMPNLUnjke65eS67GGE39Dfh OWoSIa0TiZXTee7hpLZynMevbUJXnQ631gA9lCc71sEOQxTWKI3JoCQepVSq8JukUApY g8I441oE95YUhwgeBpaGRJoAQbMyF4K1enRi8uz2D+vyDZLdfV8+/CKIlaJYMO2APwQK lXARpOwwchhdg0AgonpFillV0TUZA04SrRjvphKM30a0sOkrnlqOX2UOKJ857apHCVQw ePVA1YqxpgI3tbPX35Xf87Z/ejPHMsoUQhWa4Mk8PiJ1vTnfmJDjYNQuYzkiuDyxuQct DR9k0s7RJwwYZRirCECrS12lHrPa78CTQUbHfLOKI++0sKW02xUWMUzf5KsnPMc8Gttx GmEK/7NiPy3gcq/2qMqMirWLNXzw9N+Pfz7isyadWPHLRcgmCGAMuUuoIFGbilElN35Z bPDtFnwG6i19CapUJLj/f3xPnpXktzlV3FAzWcVPmPGP+ChazH6Dct+q7659/wGG+0RV P/bh+9732N65D7IRTmU59Fd+io0jk47FEb469MA4zxOGnTdszT5I7rub6JtLB59B2or7 0gD3hWkUxXhOVhDSw3Yd26YeaPM2Tva+XgYxHCOJKlSHtGuBR3Zb1mihDQhIyqZKbCJB 6jDaUO8YrKDqbCiBjzsDuq79rDW7x6LmoxrPrqU8SmKGdTFohGcMNHJJIxqYbViDaNDv U5zlKBzcvsK/BV27l8NM3I1pSZYW8L3QXguiiKdYSjwcaFujDZtp8UU4e11ApcdgqrCV lZiQpNgkb1sKfLdJgKf0fHOVaeu1eE8y1/j3ob4WHk4j7e4ElSKB3LheQbSyBE8y1Mhz vB+3okIeDFeqWtZoQf3aIgPFqiWhb7JIOsxTTUtAlczku+k59irdNqTF3Yeu6TGhHphn mZFzfTJccP02LY6WwPKqf1W/ZSllj7Pn4fopkMEEqcIXjJTctc/XgI/46FqK6oP2GhGL HBodQewhqfosFsHSHR88sr/nJRis78NuQXq4fQt9HzGQfaAjMFUGLuXxmnFRItsKL5Xn sCzUD/0EfYZn4x71S14G9si1ud9jgX7oKzQ19g2WWvl+cwYaW+cnz4gZZOZO2lJyiTkZ geLFlMry4LeNkaXgkEz02wa0gFSnYUYuD9gGT1ONhDvd1Xogn2Vtg6bR1w1DN76AI+cF 6l/KkVWV4usncQEYGXNYXrCB4dN1KRdx2cUG1sqRyYVQoGIm7eekf+7UPRemKhV2OwgK pdKV+o/8whkUAlaTPhb6oakeqcT+P7Ft3K1FR71GT9vuNQnVKyBXmMLC2H2vX/aXM73B kYOh/C5Ov6Pcyr9BA97/l3ujS977xnAhxXYNDRfiNI+gpuPxAt2I+fEBn4yDmVAn42AC pnasJLGrNKAtrmlKemma5K5XaiIAgK3PhdpNDPjJZRN2G5VYAJsb6arOs6bhhBzlz1OQ kxJcAG3eKd4LUoF+IfeW3pwMm2qhW+ia9i3SRgVWe6zOJ1R+gb7I62EE2+bZAdtmtD5I CAbEcsbWOp+QfstVjrMWts3ch93Y+irTgicduA+by2KKTXsYIQGnoxgyYzFCgmo+mFOs CQtMg5tZ8elhdY0HE0yTtcj2yV6Lej9sWq9tUIt/n6YPUM09y4yexQl2hK3Vti0+NZpf bgawVx26jzDqeJwAsSJsquZnOvbwgfxNzeopoKrDBkAwmHP1L6XA7E74gVrdkfkd9aPl M+kK7IjsYAPgfv1uOloGChvQsY8N6FzN6uYJ+ow+jGN+wbFrpaMgpneb36l3BhsYaiw2 kJSqd9MYaExgWwN7RGpIvw/AAYTPnQxQCXA4T6Dgrs3owkRZkfKq8fEJyTgkKz2bAHl1 mmbshNFa6PEY/XcrAqvt3pMO6b8aG7DHjY0Zrx5+IIVG0ucB/NDx2sg1klwlDZrYaZMy vhuX9SZ2ghFfDz8cfc1Xww9D33AEPyQXiR94CtOv8QOmMJqkx+MHulHiBwHUqU9G4gc8 oMzyLKD4TpHgMQ9MN8kYlWxaU0S8yLEEQjwGr0zQWShQTkf2PjR1HzUNPoiSaOLIwJDw wT/Fe0Gp/FUSjlP0w1wsf3X34tRzLtAixhoJogPhVx83mCbPbJgmq+uA9HB9FJmzByIG mJHVifBwjSRs24AWf9UhohTfQYAd8FCDiODXiak4HEyr9HcIgKWM4peOGN3iW097lQcc bJu1SfbpXovqg48cbL96VznrZq/xZggzDj5yMCOIO7XXwwyyNeqmwcMNpslcA2FV/DMN UjCJoSOdC3DcqYU8ilNEBjTIYw80yHMJA3CEha5xKECDyaOkfsGxAg2y1ba53/OcxJNg BUcRuDZo4Mq9gP7LIw0a5LEHGuS5BAT2CfoMz9aggMNFpECDPQrkkf0dfdagwVJjQYOk VIIGeaRBg20FlsEo+b+PBQ2Au/iWN/QOCFD7nIyUoFdem9KzIVLisORRoTggJU55tCQ5 tbfC5amv7o7XMkbtXzIXakxa9JumjquB6gTEX9/TQOFXVJ42yffOBfB1kYJ5TQ+QfDWk MPQNR5BCdplIIeM0U8nABFee5wlIATdKpBDDC0BPwclIpACNLZA9AzOHAtMCjgOsulUT 7JpughCjRFJCLlce5nBLkFojUZs2F3gX9R41DSlg2zJN/vC1SaTgn+K9oFT+qmlFhWd7 sfzV3YvTo0ghwgJPmix/wtVtzmgwYa6zNoIDxhRRxp32w1kYkqX2LqGG06f+5cAAOT6U JJc2GmxwEJmRZ8cCBE6BJ6q1bG2cbfGmVNMmJ2c9FZs2Z4jt061p5roPIKPX5oy6vap3 Tes+OR6e3TNDZu1+YIfV2XAz0B4xJ64y97knjYcIkFyaminOpvwKgTz2IQL9piZ3+hqe gwjYoQCK9S84PnAEqKVbZdBRHee0OdGPOfAcywXVDzoyUzMdO4gQyKsUKDBPUGeZDH65 40NHBiJQn9cqKsENNQ4iEKUKAtCR6Ue71f/9PngxvtDyK3B46BPyent+BaU4a0++tG5Z QXH6ZxjuWg4IigcajDgdus9qkBWwAxrv67fS+K5G+yosRf6IxgcHDIQejJaS2LYOOsAn drDPH27HrxyI4Ait5O5T2eeCB+Y154MHQ98wGB7QKqagBGKKAeUUDMLESCWyM3wIDV75 UhUGbNUvlVEcLEbJhxPjo0iIacomd0aiiMgSYv+YsoT5IgvD0oGuVH9UMhA+WKFiMh/Z 1Q9v2DuA+yt8afBdwa7W+JPYMwSF3qX2DKVL35Xs6m/4I9gVvt3zG7v+xaX5DaCq65lS JCBr4QRVmDkAHyjy7VOFZUBUYAxoGJBreIDI2BB5ZT7spFITW/tTbJ9RKxX2F/ba44QA 3olkicapnEiwAQDxAlNCodVL5UubzIqgxQrkuBxkxXGyfFYEy1rJEpnUAaxok0VRSMML yvs8QKXjhd2PUR+shGv5QUuWIscXPzx+vF4z8GlX8sSYFcuBnp6ZH8fJeg0/2mS1GdBN //PivBQTHTDgk3qG6sORALhpDfgoScFWYCcs7c07B2wOTWIlKkL58vJ6/eVIYwcYN98A nF9ejpM1iSvalLbJGsUVhvfaWsy9bTb/D0l3eFUKZW5kc3RyZWFtCmVuZG9iagoyMSAw IG9iago2MjgxCmVuZG9iagoxOSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMg MCBSIC9SZXNvdXJjZXMgMjIgMCBSIC9Db250ZW50cyAyMCAwIFIgL01lZGlhQm94Clsw IDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjIyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAv VGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL0Y0LjAg MjYgMCBSCi9GMS4wIDggMCBSIC9GMi4wIDIzIDAgUiAvRjMuMSAyNSAwIFIgPj4gPj4K ZW5kb2JqCjI4IDAgb2JqCjw8IC9MZW5ndGggMjkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4Ac1cSVPcSBa+61fk+AQRIEu5aOk5ebAd7W4vNOCZmLB9EFWC UrcoYUkFzfz6+V5KKdVGUSpcsuwDKNHy3su3L/md/cG+M9ezPeb6wla+4kx6wnYCpsLQ DrgMWB6z/7Ape3lSuGxUMEf/L0Z4zrHdwPUcp1pqr6S0Qx4qxXwlbMmlNbph/7pgUuhH 6x8XN+zlW9d2mMsurtgBO2QXf7I3FwDoSZCs54AE4HzH50zDZDm247rAADhcjDZD+G5a xvk0LjWg+va9QRtgB3zX95i/CO1GCh7vl4KBbwciVHIZpg4UfJ1HVyWr/p2d//uUncWj OLmLc3aaZ38/sDd/l/G0SLJpUd+kf/w2Sx8Yd5zg0AKHdCD8DpwrgsDmTtgiOSjWFcoO nCCoWXcjM/QmTty3nbCWpkX5sZ4h4UtbZ3VSOm5gC1JkldbZwJ8rEDKWFCy6j6BfsitW TmLAUcT5XVSCKVlRRmVsM/Zrdh+DaY9YVLBRNr2Lp/TnKGXE030wqRfarggE82tMB8Wk TmhL3/O761cIe1QUs5u4AOWjcoX82JoyY5cx0bzMszSNx+zyob6t0iNHvVK/xnRY1Hds H5Z7J+oX2U3MplmZXCUjzfGQhctsVq4KAft6gPuiSyhmEpI4z7OcYeOK6DruYwsaLe1U 6A5pC7yQ244UOzgYEIACuoQlUzaKCq2CovFNUpBFNEyPvfgzHml1tKqhvh4yqK4+NsAP bM8XITPIDmoD4D0J7smdZCCbgqf1LpQZ7MCYdBFZgdpPiaZjWsjjqyyPj2inslmud+uI FbPpX1BIvZBf2KHjucyrUR0U+X0Jn792UhAiGP/aesq/BvsTrdc4hrC5FxOo/3E2gnmY lj2QmEtlwwEHiSt0agq36DwZLrDiNh5BlcKcxcavJQPWl5PQiOgCAoNwGj1P2b7r7qYi b/NsFI9ncMxYlKbZfTK9huiNJkuW69k8AglTAQJgsLDgoXTdAMFi/RvbGP62vLOAZxdZ iNIiq1z4dfFOYMPEw+lW2OMAQba0g5WQeBX8FhECn4DkQkrmIdwPQuUyLmw/CD26zROc O5zeefV0NA7t2DVBwOHBOq7CtytG6C5dlSe4GopbPzqXwUPf9rjrPwNWHSM8wFutTUoD tbVdAmEHAgskcyoLsUjh7uK/Da+ZjJAIbIcjPiWW8l1BrKSk9MMwYAEWPD/0CZcteGqF nc0ntkg6ecqzwxCc3TnDU1sgmP9xnBujcxWNkjSh0K9gxcN0NMmzafK/KiKsw4/qATjF 8IL7Uu+w/FK6HjPYDsoFkGCEUO0WhZxr6lcZITi0l3F5H8fTyi2Yj8bJFYtub9M6VgFj fZ8leUz+QfFs5f80u4nGvtbIDmoDRIgUiEnLdElyQgTg1BajuFFS+8vJNhlFb2dwp1Ge ZAVAvsvSO/IEInYalZMG+P1pWBd2QYYB7GcN/Db7v+cULWy2zT1yWncm6EWeXF8jvhkb gZtP0Np9yBX5JVDfDQ7b0LWvbKcnHNvz4BNWpqW7NX2kxvIsc8dd2zfRbhcfE6K+EFWx cVKMZkWxHLC0BpBlt3FeZ4agJRCt9cEQJtsJL4wQHRQ/uCjUyF2KSSD+LVmz6ajK8/Sm tiBejkJ47tWgb0POPastV1Kl0YEvszM5y0W1tVhXgif3ioJw8hWSMu0lQ+NJGGAHEU4H MvemxRwAJxyjxbrkNMC1WYI66Bh5L52opIxNifwGZYrvkBErJxkyl+SXPTA4ZIjQH9j9 JKacGTvrQ1s05qNGsubvDkhSEYdq0esi7x+nv4UKbQ/REvMWd2MQNkWFygbnejuFUEVy jWIYOWNI2SXTpEwQO+lSTQQn/XqWRlWURGlWxFkMQRPiqKh28Sv3vw9OMRGUQXYbTdiX iKrAQ8CMpMwuMWxVTP96cJ+UE6aLOjdxhJo6ciZtALumtMnogT4ob2TUYDkoyvs+sgfw 63eh/Hw8mqJGnC5EpVCOKGvq4vKsLJIxNCe0ZzGCV1WVm5NeAlfjT6ka00FRH8Bx9BTt RH1THvh6CIv/Fmolj6NxdEnZmweyTJrly5rUPfC5yXKqGqnupqgtebTOOdkm9EOgmrK/ 7KHxXpYgH4Zt8pCgDnasrzYBTNVqUGUM1hilf7KJafLQtYX2uX5ktLFNNbKDklHlIgg2 EWfH5JLxCWtNeZnG5B4iKbxo/+uGMDgQs0InzltHogfBbbLnqkZ1UOSX3A4l6jS7GChd XG0dNPQVXMaTKL0ipRihgjbtgbocJRooFsVUjck21N1zCMqRWxACgbyBqTt1deJ//3ED l44tHfgnS5Bu1M37ph4cOl0sX4KpQ9A1im7RTgRvqKq9LAdg1o9vUhZUKQy53xByGzbs zf8XEmka1/j/Gze3N5i4gozsUldzbRce2UnTKlmwz6TVkULUCcjX2agPteOgU1WgZ0nV eNT73YFJq+aTHmQcaebAR27AgFpro2GwAckN9aYPKAeusLchOsS7a22dBI/ZXzHSVBm1 e7348Pn84sVR9ZN9/KR/P3vzx+d3Z29e0/r5r6/ev29+qe7ogX2beqPBdUjqSmJWxHGa ukgHkQL9QdFPn9/XtKXfWqqffPrw4c3H1xXhP7z6L8hOZd8Xn04v3n36+Or9C9IhJVrD +tgA45MbZIe1AQ7iZmWEstsGmLhZpyaqxhrK8eYoUFDiDl3u47gY5cllpbO/nL094a4b fuulHAhVGIYoacqwwnBQVA9ceLLDGshANQqtuU1yfxAmgybKQtWkk4cBk6L+N8+YjGHA JD14WE3ucRgwCd3/ZjTLMGDiAcw9RhMH5IJITvOPpu15gUwrY0Y6utkpe9dpEAo9qzAK JlOwOJzFLm6sXccvkVddbPjUUG1siW0mQiVaVBS5tnrrhgGTCNEBa2znCkjVlKrVfUp1 hUx1Uxli2XZUVg+2NWO0DZmgBKAxjZP9CEzMtbpOzj4GE/uOPN4Tw7zC92xkHx7burlp XqvTNO/jMG1BJ8+31bAGjIXCbAw37GQtaAJI3RyZ+ht6FuiwCAc2OSok0gKmRXGRw3+W whSCY3axmRxd3rqfojAF2vKhCB6Tup8Dk4uJg9ojWNy5hsH71peOZ7vN0N0jMPWsL2ly gEvjpTwKE04/6E9fojsf+jIYUhDFfXR/tcNAy0L3U/Ql9xF1usZL6VLieh+ztxGmkeIZ 5sNjVPtTZD6bbPYe25FNX58Bvd7ibpkAnMBwix76gv0WTWdRjmMXjujkhRBZmoV/X04x 6MvUt17SLvWJDEuIdeeTDZMsX3AIicu+wUEbV+ecnJzD91gZAMOaGQA7P1k5/+S49aD0 EJKPZjHdrcpxqgTzELPglBGX3TDOfbQ3o+1LX6fsXM9YtU+TT/j4y7iPrkI8rJBww8tc JTGbZK6rlzVHtWxCwaIhsJDmcuCr0CBWGCBCB3QraynWKAik2wR+omZCS6jiCVSBzaMW rS2/LmUTjPt8qSi77PeuxRGBgeUqnBuD+mCI9IpGce4y1RhjfQ5n0IDurO6nG9r7AdVE E5g22KXBNxXAyGNqRiMjlCPwhdW1FGugMQ5hae6zqF0J2opjBRVwyVFKaFbQzQdq4NSD NWsrd829ad1zEj4t1X4IBvNFiLeUQLEBSmLECqdc4FUGnXoFIEjgH4TUW1iteXiVRCnb DzygbdakgnLQ6FQvt+YWNASYz8RjzU312hYr1vxzBkMCwbzL0K8FCoyl96IFvV7R7zLo PHrXHMrmnpFmPc7utxdU4dJAFVwJCCbJ1uJ1imucdqIwzdbcI1wBBnGxOQ7n+Dtd0Yko eB6AL1xvvDL3IhLV36Zv4V3I4+F7fmg1X/bheuk7NGzNFc1zIjLD0B2ypTj+AbIoIKCA ql2DGpp7o76i8X19P56nvzbXm67MvQZP+hY9a6jQfLmhkoatuaphba4X/motXIEBK+nd rIwh1S1vYRoWpkKymzl+/nk82Iqn4ec1mmVOzo1ktJJvYF+jWdbokSeeq2kzL4s1vaAo q7lMkkAF7Q5FgbsDLpjL0ZRH88Y4bkZx4YbLEXujW0nDOyGUCvFgldpoLtv3Yj7TA0PX HgrMGd1Z/9ABMg7QgK6m3MZ5Gd9OMP33O039U+FVZ82e9xkJjGEw8E39MWET+PSxf+zp Cy06IOVLV72EpMpfYFlOP7RfpEPPSB1iFBsGBqQPuA/AEJH61OyDI42UQMfmLpNC1YbC YiK9DO1vxu6hX4jw9Q9NC+iWihZf2MHrQ3YMI3SAScDjgB2k+CGbK2zGsWquxofWccgO fsGi0EmNb+zit7Y9cQu05jnK2vKQOZhC9HCQkZtHizjQCaAi8Y+OnFiDZXvo3Nox+/8D xm9aQwplbmRzdHJlYW0KZW5kb2JqCjI5IDAgb2JqCjMyNTQKZW5kb2JqCjI3IDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAzMCAwIFIgL0Nv bnRlbnRzIDI4IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMzAg MCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0Nz MSA3IDAgUiA+PiAvRm9udCA8PCAvRjQuMCAyNiAwIFIKL0YxLjAgOCAwIFIgL0YyLjAg MjMgMCBSIC9GMy4xIDI1IDAgUiA+PiA+PgplbmRvYmoKMzIgMCBvYmoKPDwgL0xlbmd0 aCAzMyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB1V1Lc9s4Er7z V2BvSVXMEOA7t93MTNXOPiobu3YPmRwUmba1JUseSY4n/36/BtAESMoySVu01lM1IUGK bDSA7q8faP4u/iV+FzILMyHzOEzzVIkki8OoEGlZhoVKCrGpxH/ESrz/uJVivhWR/m87 x++iUBYyiyLT5M6SJCxVmaYiT+MwUUkwvxV/uRBJrH9q/7m4Fe9/kWEkpLi4Em/EW3Hx X/HzBQh6kqTgOSSBuDzKldA0BVEYSYkeoA8X88MU/nW1qzaraqcJ1bcfjdoCI5DLPBN5 k9qDHDw7LgeLPCziMk3aNA3g4E+b2dVOmL/P5//+JD5X82rxvdqIT5v1Hz/Ez3/sqtV2 sV5t7U36n1/vlz+EiqLibYAZMoDxI2ZuXBShikrXyZOaunEaFlFR2Kl7cDJMtpxUHkal XU3N9RM8Y4W3hi4YJHRkEcYkyIzUOTA/2xSqUIiLanO7WK2X6+sfEyx0CdGbJJkSeYPo 4DTGNirDJM/yk5pvURTmUE3DxTdkycVNJa7Wy+X6YbG6FpDmPNJisRXf1pvN+qG6FFeb 9e0EokalxN0SStJ26ZRETVaqMEriEVoSbP7y1wlWTlaEeVZgnbRIPbhyjqwiCUHFmZJt mg6IINESkj+Fi2p3NQH/ZKRCmaiyTetr8k9GWVjif22aBvBvt/3+cD0F+2LIoQSr94Sm nwQ+SAHj2zQNYN9m+/1uCu6lSZgWRdKm9FUnH+RxnEIVt0Z0APfuCMVOwT7YB7JMO3Lm VdkH+6DMVPEM9s3uwMDZ/KbafhWz1SUp5fstFHJlzILv1XICtRynGPAM9iFPA6uWB0yD H2KxErubqj0Tgpe3tGt7pUXtwZkwlW2QYZrGKktGYbW7TbWtVjtxuZ7f3+Lgg8/NoIeT oGVC9PFbyCQKVUHrylJ+UpAsT+BLscbfaVhaWZaGuZQjLC2gxLUQ5APwh/VIvh9g2SzK Ywxrg97DRtaRoWKZk40KN1uLpgFiZj67m31bVuK3N+vNHlZijby8vCEnYZYS7LGs7LNC jsxKmRdYGAR7msM7gJWzh9mm+u3tB7G9v7tbb3baPISxqJ1UUEq79Xy9FLOtuKs2U+gg iJ8kkcDBA7g8mVRPAdLLZJxUJ+vw8y8flYrSr+2VfwT1WLtXMkt0n+k6GSOTAq6zlF0Z p6GyY4DgnP15Q7zjTqK3vLofgOWMeDq++1ZF8EbGMYxa248+431k8aSkhNdW5jVNw+EQ S/rN+h5OKxJCV2vyXV2/E+uV+FbdzJZXk4qlAdydbDXBIM8yNVosra/EDJDRxCPeEXw3 0n8Nbs92OibxcLOY34iH9f3yUqwwALMlAhPfqik4Xxsltpd95vVknFcSrjjLeMQEOaAW PBVQg8jAn53NsPO+/ahFBcUCvUjPMVQDHIhFScvSkN+Ho0eWFA5cjeVoLSg4rra4EtXq sq1pxe/BS4d8FVlMsgAIOxl2KsTyoiID7B/Lzt26y7nDwfIRkWkFUwAU1hPRqIfDBt6Q idiyg/uE0mL4huMCUdDHONeJlbcjaZh0RnxuF9er2RKqagJOOmdIY8AbwKpN6BAhOYKT dSZEJhHSTzjtwJOST7LSSMkHGB/kDEOE8p/rXQX9NNsJKCTYf9pIYV/Z/d12t6lmtwL6 jHXYJAqqhI1N3j/bzz7idAjvRywsx/soCeM4Gg0NmlkK72qGr9Y746C8XD+sumyvcfAU /IcNnOUEfG1fT4n/8BeEmBfZcOBr5r5ODgm7AuTFlVgdE2OKT4qLRQZnG5yTJnGpIdXa UcSpVlaaw+lfIo4zOJkKI2sdgOIcyoJTgKyxOMGKkRyv4D7YsXb4tSOZ21yexHkpAQ8S YjHT2Wf8h+CDEZJVAR+oDMiqRdMA3tVI9YBJCx02wUSoUQN35qQWfVYiIgFP4JgFhjU2 EwiiYHXtN2ifzd2wjBDGhdEdIdBTJlIWcBnZI3EwRVTBAEkzOJLxP6+HHjB60nwkCNRV CgPxebcHri9P9ADR9ixBsgL3YPS8KUIkNMHnlkKJF8iZTcKisyifolPzk1zGaQZ5AXen UHGYF2VG3cliOFwVPfPq6eTaFsrtEzdTiJslEckoO5jDZSn7U9oDOtjyP8So4PCUBPvT 1BtQs+i8KdnRCB1rwjiH2p2oAzF7RtqyO6jTqw91gGakonAHBajrkY4RLZBwyE8w0jGc maVyq3b4QH+rGh6fmlVBv2TqEbMz5mhKa3YOR1B7hq+zUPV6wTDFcD7AA6FHCbiSRidN kO9XFoIcT8hc05n1PRbko6/okYCfZpgUxcg8PtIf1nXf8scdwYGEtC+T+8Uk9xGnR8Y5 ErM9y7VcG8tGxjlGDYuWP+54k76OOpwQOz2dP5ad03jkVBbKiIScT+areuQU/P5FDv9K i6YDiLutm7ouOVE7lWopfLwNOHEGJ0ze4erhJIzJ7NgUCz3jGMbAsCfE5EGX3CPeofNJ AkeYN2VJlprt4XCF7Yzzd81pcpQEE6esmwQPV9aPbGd7ljZNVFgmwNQjrTH21NaOw33e 2oY/JHy2icZ45HGwEFMsqFS5SG33+mjeyVZmnIRRKk/L66VS+JNHZsCQ16u6vl/OTM6W +KwdIK+SJJHafvQZ7yMjLQdXRvOWkZZNkjDBeoRFaLFRisR3CkIdPwXFCbAB3J1sNdFS p32lIwUYglAzE/5oxkQoHYLS4+xF36M7iQRDvC/JCFvY/vWZ0ZPxHDlJJXavWp6fhCJL sLc7IqN0zDxwYIcCjJv1stpStFErt+a0sKGy8wmWXR1F564NBzpeGKKBdI6UbB6Tny9O RYvgE5kfOhF+nJzYo94E0msF0qXgvVkimeo74tdrpK5V4n61uFwg64oSrGZLcYWtmYhw /3mCCRNzxDQpTV9PSWYkhYR3vN7pfcDKa8ekYIxcg78rrEudK3g7Q1LVfEfCmdMB6ri0 3XWPXEIIbmL9O3vbJOyPIRVhmHBXT4r9OXYM5CMTBrQc9DUgthyDwYAhN4hyEptxcmm1 pY8E7Yjh7kn4bxMGkJOi+3pS/EcFkhI7aUeppx8VZrvH7UbiwJFkeb1xiGqnEOUnxc00 DVWcnRYASTKYUCMTBy70Nv6mM+LpuNYIw78ueYISDSPJfaTYwGy5XZvcIbNVUHS3u01g qmDHq07a4u6d1KyNdVoky4DTgEWqgNJCSaQxsLlt+BsV8SqGP7YR6n70Ge+pDH+maThv 2fC/WW+dpc+Ax8RdJlWoA5g7lQ2aKCrOxXtHHZx8MscCcBJ/BGAIPc5RmWmBbBIqksI4 5m6G7XLzxR1gPWqqQJpp/FOn/aJlCuYj70DC8yJsR/tM7Ml4jyCiokSMMUIDzJ/N5+vN 5Ww1r8TDYnejB8LMauvWwuBs76r54mqBccEAfPk8BcfZaYykH909y3I3tzrJEm1TxW4D bOAz2gE8OOWjh4ubbe0msaehVJBMl1Joz8yPk6ApLuOwQA6RJslLgOkjL9p6jl1CTtPp ZAJ61NFSPupIs+1IH3lwbEUHH2UcI21nNG8P6bkmGD5OZM6uoQEsnUrEwpCA1TXerQ0H lClDOFjRTSFpee8f97LPZJ6M83kWIvuPhdcA6a+BhfBxwl5NVw+NCeG0dN0U7EccWTuq YtvVk2I/kj1TduMPlNMYgHorfkcH1xmLLxdFlxCASiYibtDcUHftlJUhs7iVGNhnm1u9 QShO4QxTtb5r0ATUEoytU9uiSUSaqoNJqI6mpMS8qzH7idAkUXeKy720STLlfIPh5Xw7 bLKADkDQ1RTWFUDresOOTbFCFcW62Od+moQMhpYYfowmZD4+TRNSr6GN2Nx6jCaUPQ4G lT1+nKYefJKINp2UWzJGwqd0JSYPcGm64tAURVRJ7eA5DZqwjTll8+BwEuJU8lLlKA3u 6j612fQq8lLlyHSTNZ8OIJG2lvl7JX6Z3aPs3D22yVDwYNlE00dxLUsk5un6kU26h6Qe IlBKfz//cYcI6lb8OlvdzzaolP2OimWX5qL7/5dPs+tKZF+ngExcRJv7NhoyHUi4/4K6 8VJ8haq4NKXpP55DCnb2I6GN9yOdf+yUrD9zspz8GSIH3NHV6hV2hQkpUZznViiVJzhG OGopzvVkcL8irbT3IWQ644dpQD8MUzwGZeZBsTkzD+q/5UPmYa5UQBsYYEImRJRpQj6w bVqiCV2IcZU2hqAIB9GrJEqCUtW4xn2tpy3FDTYGfTG8bOvcR3uH/gB8okek7QLdP3eO V1N/9XXdf5yj1lF9v7neuP9GM1cCP0ja5pIWUOy0jynNsDFAwcS43dO2RBtKiaJWvrsv xUZZSChiFwJfMgZDbAvuQeFMXfx/T1v3Lm7Bk/b8DgmqwLTEZb4PGZTIq5Goke+oSlDo DcRzd4LUNuBjA/g4QlHS2NimJZpQSqXI0GnblJDxR/WY6ie7Fvv+gJ7EdzFNfVr839n+ BUQCP4u554jikXCUc4vfG9sWdO/qtsz11FPiof/SxBYkfKxCxjkmhDte4hil6FNsr9HX YrpBSsTtkgg+F3OWApK548C1uiO+rrCO6Jn0FEV1dfFg9waVpDgjOuhoHmgTWB9jycWl eak+hyDxnmDPyGLDffoKjptHgaR383UJmumZdC/3xr2ByDPvpiP8hkxx3X86ItnTvG7W 2GExibXn5kCKjz7Qk269Nl4LI+eKnq8883n+dGdGt2WPTMB8dSuNn+VWI89gr2XPOua5 372r20I0GOmCjHrDGwxPl19IZdKagnqRKjj/aUEXBOOkwn5X2u2Jgv+pimXZRvUk/7QE JEkclVj9+NMWkXfqnos9KiqSjOzzVN9p/9G1xVHIHc8j++d8V93dIDXobyinqiGO9r8+ 7zUJvIJpIvFW/TKw177sT0d6g+sOWPlepu8x45MPKhaf/uHe6EpfvjKCIOjwcghCYSMf 1jThiaEIIoEuhsBqQAjb1sAGtJNXmb2lDCGo2JuBFQ5qdB43EkNAsNWYgDCEf44+4hzB EddniEbqvMEc5rr7Pc4fxRDQAxGlwPgYgtt8GcJtvMqhrrFtCVvbvXWPXRKKRsKXBdzG v8N6t3dxC56053ewAhTqwIJ0vk9ASCCWKWNPsqHT+IoSGgwkClLb4Gtd2+RjCNvkpBM/ 2bXY9zcwBNPUucuTc3yPryts/xoYgrnnMARz2Ml3bvF7Y9s8DMF37fsdwdcRGELBbcQY go59DEHnVvtnSC6vMQTVma0xQh5bDEGt9m7vOhWiZAxBZcWbGCLOIosh6IgxBB37GILO jfbnJ9gzPJsxAr3HtdJRIKmNrxN1jCGU7Y3DENRTi19wxBiCW4FGWtcHYwjIqxLJrA0M wWvB150D5koDQzw+M/bNFV5EWKFGJjQwBD/LrUamymvZt45tH/3+2H6D9W0sgIVZUnbv QSwQ4FtrA7EASep6dwcKSXhYwDg9nPJ8Dhawr7FWvXvNy2GBnm9w3fl/wALkUng5LJAk o7EAvHcZvuvUwAK2rYEFdD0Mch04dwLqPSX46k7ztvbjRmIB+F1r3U5YwD/HIsJ5Ewsk Ggg5LNC6/1EswDvMfCzAbT4W4DZe+VC7KH5O+yRrEwAhrZRcEz4U4LbuXZ0WiDHXho9t pTFkrQ8F4GGhT/Q4GydCwX3yOTgpZlsaEpHv8sEAtzmtbh/uNRgKGmCAqerc5YEBvscH A5YLDTBg2eewAHPYyWlu8bGAbfOwAN+173cjsUAMpwtjATr2sQCdG+0OqOZhATLKGQuQ 0rX3oNUd8XWQqp9J/oQEW+GbWCCBmWD8CXTEWICOfSxA50bP8xPsGZ7Nup7e41oNFqA2 vk40Mxbg3jgsQD01WICOGAtwK1BF6/pgLAAXpQKkbmABXjC+7uw/VRoT//GJsW+quEXE U+zQ8gcw77P8uYd+b2wbGN9GAoiBoZAa3MtNrwAsMO8TpyOQAJwLmSQ4pz+86lQ0/NUv iQTsa46IBHq+oTcSIOFTlOBMCm0Tl8gZkjAxEYnJUJZH5rIs8xEbBWh2wc2DDajkPeVy OwKLnQIE5h/Dd+xmNw6SL+LNT2/FGXa2v8GHgs4K8QZhp7OkPoOH5iytz1DC+awUb/AR nLOYwqHBV3Hxq8uf69Erf0L5n/E9FGSHax3FAYAAGr1CD6NCfzJXV+je00n3VV+zC3tP PM1RDK8t6sABzLzoOGA9wWznpNsGjcZTNXoggsZAIAK1fyAe7ZY/ELSydWLD4VJzST0Q jW6Rf5BHgtIp9/TSGwldtv7gSEAY6aiuNxIx9jJFz1sREeXWcOHjYA+Nxx6JR7v1rJFo dKvJ+naA2Q/L/w9HpYhSCmVuZHN0cmVhbQplbmRvYmoKMzMgMCBvYmoKNDcxOAplbmRv YmoKMzEgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2Vz IDM0IDAgUiAvQ29udGVudHMgMzIgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+ CmVuZG9iagozNCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JT cGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GNC4wIDI2IDAgUgovRjEuMCA4 IDAgUiAvRjIuMCAyMyAwIFIgL0YzLjEgMjUgMCBSID4+ID4+CmVuZG9iagozNiAwIG9i ago8PCAvTGVuZ3RoIDM3IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0K eAHNXFtz27oRfuevQN+cGZshAAIkz1uby8w5vZw09rQPSR4YibLYypJDUnbcX99vQYIX SZZF+pimMxOJIAXuLva+C/xg/2Q/GNeuZjyQrgqUYL6WrhcyFUVuKPyQZQn7N1uzt+9y zmY588y/fIbfeS4Pufa8cqi58n03EpFSLFDS9YXvzG7YX66YL81Pq4+rG/b2I3c9xtnV gp2xN+zqP+zDFQB6EiTnOSABuMALBDMwOZ7rcQ4MgMPV7DiEv66LJFsnhQHUPP5i0IZY gYAHmgVdaI9S8OJlKRgGbigj5e/C1IOC77N4UbDy7/Plvz6xz8ksSe+SjH3KNj8f2Ief RbLO0806rx4yH79tVw9MeF74xgGH9CD8AM6VYegKL2qQnBTrSuWGXhhWrHuUGUYTJxG4 XlRJU1d+nGdI+M7SOb2UDg9dSYqs1DpH+HMXQukyZviyxYiLTcYuk/UcTPqPTZEu0llc gEN3lYDzx2tR4Udu5MuIBRVCk+JFL3L9QAeT4kXPcwOYrf6qHXrmapnmLE9mtLhsnizS dZKzpFFIxaZkjdtsM0vm2wx349Vqc5+ur/Ez4o8x1BNsdORpzoIK1SmxhI6E6/lygGUF +ddGtnal6infZIAjUJux4eCWGoBtFtBSeZLdGYXAFnG6AltAhRhWWsSzdJUWcZHkYzAG uXCRCJjFalKMAXdGCu0Pksv8YT1bZpt1+r+SzN8fWLFMKpFj35PiPknWpWi2VyNez8cg OyxyoKGidYXipMge+HC+K28Bvrp1dJ2nHF2IY3x7u6osHZj8xzbNkptkXeQsXbN8lqzj LN3Qxd1mdUcaMGaf4mI5BsVrRi+xO4XgL+wYS8FdX3uK6aEEv8rS6+skS+aGj0dQgrWb 2wW541HuOkd9PMrnuG9aQ6Y4H+C+gW+7AYU7Aim5hNPhR1j9DtxOh5bsGa7wABtXx99a aTeKfKt5pwGTHyJiUMO8tD/nbJ7ms22eQ1igi778Wi+xc1o0vsOap6QzuK9cT0GT6gr0 CSgdjuAgFJ6uYepvXN+7aVIsavq9XO6FByEMUSB3YT3Kji+stDkMNo8U34WpMZNP5oOK /O7+egTyCQ8htiQnoys5r0k+wTlSERz+ZhemHuTL8rvbMagH/RwGLeE9JWJ9YeYTcBu1 /yzhRRj682EM8imK88m8dRf6VZlP+67wkcLdgakH88G/zTbxGPRDUByqfeHtAetsmeTf ztl9Wiwp9NkF+gUyTxIElgF5tD0MXh//8Fk+jYwAnE059kngwz80UQoVGnqkkQcAC4Mn PYlMFGLDNrCvKTV1TWEHph6c2I1TdpxtihkhU7PluQnQTR4122xRM2E38QMi9TGiQxBe ByRtFd1P8dTGY1zP1VpYZ7wH3cG4s816kV4jvzRnyERu8wR+LGontwWloWJcXG9XcVbm QYjJ2U2S5/F1wuLcKI0RSiewFNojQwuLS3hOivaI0QObgeqZCynK6JxRJeBQ1ep7sozv 0k2GzN/v6/ayUJ6KfjAG4+vI5TKEi10iOinac1QzyVz3rrhWCtvyckuxVHH+CJQVnnCF RspdV2hUpO0hvlV585cRLLfwPdf3Qn8X2qOGZzQF6MGtkJ5VgJOASUVwxbnUg5iTQ+ST vIi/r9IcTlpj94wGxo3C6N9bmMCOgjY1pDxH4nQEBpa2ZmRRnZJuUKFGsg9heKkbpsES QYCkGWRoiL4SYIl0jlQ5KsUVR8w39+u8yJL4BhkruEOoDCUw4vdxNi9ZxlhydEGMwQxI ZQlkBJmqkJwUM8CICTQUTYoZtOfCrg4zXtRPACn/b7nMbbdshKWuM1yqQmFSS604fETr kE0jWa58gX6LyLJfDwMPP8XHUhtHkPoCUBkjp/xzkt9Z34V9PXv2mqP0r0K05MF/lSLy OQ8R/VbfUJU70pAn4BVKCResi2MfR/hA5qF3dX4fgQaVJxCwGTOLwGBmDl10iCB7oBAq hmhQ9N1wL8B/Ck4ip9BQCsrncLvhPfDI9TQSooSPllxFgiZdPN3KCMegb3dl7ePt0KIH w86TAt0Keen4tVIhvXNJxyjlHGdJ0F8p5EAtFqXWb7HkXgJ+tyKJyPd+mc6We2jUjHlg sQ3BnVY76zEUiCkFAPW1kZ1qsaEnQnTKBmMsdl1ctmSqGL/HYsdgsaZo9r2OQl6uYCaR 9IyCgNdr2x/oBK1VX9/UsNbFKecP71XGhORz7NC3vyd6gNf2FIupNoKnJEqgAo2cCuFa ECAi8lzlI80ehQxaKQolWn9P0x+PvuKE7mwlfdQ1uXW+e7AUDB793cPSVc7rnKFtjhIe h7xd2EbTE5WuZ6vtfJyGqNrRrZAcbDAeaYt/FuGFgjmuy/L9CY+IEtmoG9N5M79JEUqC +kgRFtlmdWwhzp/tg1gOfpy9pAI+Rl9WWE6K8qQ+qLF+SGxHLF+H+2XXk3HxykD/6xn6 EWYxMrOwS/l2NkMCdrFdsdgu0Ci0hzsjFVMVmpMiPcrYEbr4B5O+4u+vbxia+ygbSxE0 LYPJs7Z97e2tibfHIDiQ4oqcgwq7/pbu5tw0M1IyqFOYcp7cBjPAd5Tk7xKDdMHtb+1e QCv62HDkeQPrIySb0IrpZp7OQJcFekEpIwdR3OMO4p4iQQcjWIesFT0xBqvY+ojFc0rC 6UceUi9quF5s994i+CWit5KgaK0vNhn66kFudwRaC2rHRQKEWbwmReuQu0pPaxsPyjMo nNap+X4eye8QvLI5uxI3WvlSmVGv8cv15UGipNLYsVhBf8oqv3BrD0frBBeoQFuY+pu7 VpW9uz0O/gXJlfUx4hEESdZKqweJx6on0UbVSA2s3bQ8tI7uQu5utdrCf0DxxrSYfjRl d8ZH0VtR4KKCG5g9uITaKRw9GrkVagdSWwduGj6DrxFJ1bWaacAkzSJaWzoNmEQI5xub uSdUZ/MF7Ri3+1M6ZNrN9PVh8R2vuNfWUeTU4QbZEkB3Oyt6+J2hG9Z3YGKegepofrTu 4ffRgIAI4yCdXgsmGUmkQCsO3yNTua/f6b+vf49MVbYBaenmcAGzFbg+eKAmE5QAjIGN 7B+BiXGn71kDj8HEfqD48sTxB0jjoVHVhryPwoTzD5xe5x88DtMJdNKBq6bVnCUVuvaE ZadpFAMlbb6e2F57SdUm2/ja5abXUphSCrSH13vtO0r81ZSToINMrJ/SpdOrwcSRd5mW vvS0y+vd2ntUsmezjKovBdxf4Vsv5VGYRtWXKNNAX4ZTcsRFgL1f9Q7JaehLEXhuxK2X 0qcr/28J+xhvsclhm52zpMCpCigX0d+Hn7fYdpyz3+L1Ns5wBMw5nQITlTeb/798ojbn 4NsY0bA9HcZiO5grjhQLv+BAJM6+wfWZl2cuvbuEVd9r/cCYbf24fLfX+nHR+CamYBog X2sasgW2/jLsWfXZDRMi8BnWjLMVuzStCs2vyMs6OAlFEPihcuiHrsI04MTATIOrcqL6 qKijYFNtXcB8+AhzlU89whVU5RiKo9XYCs+hfwVHD1G9VAfwz2kIGUuNGlrnsd3pVmyJ LowvJTV3vchH8ePo6QAyXGisk0MYtq7xbsLY3DcUMNdEivJ5c7/7/NKQl8Mj5tRRoEKA ia25Bh109IQg4v7YCmM+DBmyAYS2eY7aJSH9wlGoIIchl3imHGFIFqCUTJb4wNj+U3YE Mx34ncAZWRQGEQx2fiwVTjmgN1qosAIRHG4LuqOqAZyjhXO/wgjawA6tMIQO/FDj8eop n+qEtI9H2ZlbI+X7HZqpfqqC6ZSR9u8q/BwCwc5lqdcAZSncQG5H2thUY87+U/sjM8N6 gt2fLpySoxEBciXAEM33Fb4Tv6E5wNyTXJK8RTh1wBO4R1fYbYSFr7879bdmrLmvIyxs 9UQIzsLEzRtk5OGK4KBvM8fEL+Y7ZE5G2rzUXEOV0JurGaorzA2xLu/ge/ebg0br1n3A THPSLBab5g1EhfLd9A1zUhxl8KdvpH2690sZO64oIXstHoDIwsGHeLfGKlkYyCuGXy3n W/7Z54z9kQM6AfzaSJqdq5FGy8GtkQNyLCscO/iUYyB92Z5G0CgBYVdQshBOojL6cKlH DudOKSF51I43HRwBSHrMaDLSqF4EKcafidVbl828UIahrpMqgTJPlh9l3IJzgzAfReaX RXK7xHkuf0UHtakgmOJBr9dUNrl5jY+aJxr18FZzCgP2fVcv+9MLvaFBB6R8y9Vb0NT/ Bdrw09+bN1J1l9RPGEFnkwr0yCJwxFM4TUKjDUgqiSbtIW0m5YKiyItACEbCJiKhJ8iq Vx+GFuj/KWnxhZ29f8Mu0At0hg2mFyE7W+HDr6+wGBeqvsLROhcRO8OGlgtpTm78xq5+ a+o8J6C1y1GnnO8GuyM5wrouWsSBXmhOcPSo2nQAy+aQyfvlBv0ZZWmK2gvL0tT/AaQ3 EH0KZW5kc3RyZWFtCmVuZG9iagozNyAwIG9iagozMzE3CmVuZG9iagozNSAwIG9iago8 PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMzggMCBSIC9Db250 ZW50cyAzNiAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjM4IDAg b2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEg NyAwIFIgPj4gL0ZvbnQgPDwgL0Y0LjAgMjYgMCBSCi9GMS4wIDggMCBSIC9GMi4wIDIz IDAgUiAvRjMuMSAyNSAwIFIgPj4gPj4KZW5kb2JqCjQwIDAgb2JqCjw8IC9MZW5ndGgg NDEgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdVdW3PbNhZ+56/A vjmZhCEuvHU2eWibzjZ7S2PP9iHtgyLTsTqy5Ehy0sz4x+8HEBeSkikRslBG7cQURFEH 54Zzw8En8gv5RGgWZ4TmPE7zlBGR8TgpSFqWccFEQVYV+ZUsyIsf1pRM1yRR/62n+F4S 04JmSVIPuXdCxCUr05TkKY8FE9H0hnx/QQRXX9V/Lm7Ii59onBBKLq7IGXlCLv4gry8A 0F6QomNAAnB5kjOiYIqSOKEUM8AcLqb9EP682FSrRbVRgKrbTwZtAQrkNM9I3oa2F4PP T4vBIo8LXqaiC9MADP64mlxtSP16d/6/t+RdNa1mn6sVebta/vmVvP5zUy3Ws+VirW9S f97czb8SliTFkwgcMgDxHpzLiyJmSekmOSrW5WlcJEWhWbeXGYKJE8vjpNTS1Jaf6AgJ 75AuGqR0aBFzqchqrdPDn1sQ3g+V7Sac0WHKMRWxyFJKSd4DZ9RL3Od4DYXUQ2fKBYFn rAvpEJ15bwT56dOn/Zf3AaSb5UWcpgnUqka9lu4eFiEdJpaor19tAkR7F60mqxy4jnKW xYwV/Ah4NQG2GDt6/FWfZwJyl2DVPwq7bbyexBjgWF+FoI4PDtGoNQpPtuS7laelFvoV QTAtn5SxyLN8uNFE7sk5IVvst8/o9NFW0PoJL0uSewO7W7RPwoIUNrcQGTsC2qerAKJC WRqXBc27cPauT08VYCcTFcqTOBclFM03QemsiItyG4MDFp2nqxqjA2xfDwGi0Iq0TLHc fwtoZYzGnMOP84c2DFoZrPZMSKPjm0ArjL68YMUR0N4T5dtJc2+H3o8eO9jAoQ3KMnNs 62vUbWvTx4c1LeMsaWB3OKzAbiC8WldY8+2oXOEESwAiVD4GyTad+wNgHqrU+XjecEpb JACkzsfzhnSAj+cCPtYvCRDTsX6JnuJwoQtEDOeXtInRa2wF80sGwBTKL8lKFieCewRz TTDi0L/3OkSpFrUAPGsWNTPDMSnfDIYiQhPCQ/keim59X9CgkJmWn3qofce2xj5tUKgD 71+qJCy7tlmjF6ZgSiJHxBU2144k1FYAWNHvMMe1E88bFKLOsjTOKfUJUUMy2ky2Pzyh IY0GZPCwZCIllmXkQUijfemy4XB6GFrWfGnDOSREHcTMgljUCT1/ON9ONtdDKe+BUZqw mApWdig/DKMhLFcbQfNH6avBouSDUBNB84czCItSxClSFAEcQfhQLAr3Ki0KcQSkYZwr akJ//qQPw6LIiwl2FOnDsChqEMoMS7k/PgOxKEuQFud8/FrUhlH9URqERRkszCI/ivRB WJSJJBbJUbopFIsiFilyZFH8KR9Gi0Ix1SHpDqC9zsWrAZa8x6JuKwmGwBTM4UkzRMSF 8c978RQMJlGgTij1CdiqWMDfA5i+WAXrDHLmDWwYiUDUK0tyTok/oO+q9ecAKKWUxlku 1eERKA0BJ7KJjHbBRIGrqQ7d7+6G4FCb+T4GnUGcM5HGSSqXa2+6h+JQhDook5aaN6RB DAtZnp2lcrn2hpMEYVFTReAPZxglSss8FuVRqikQizKkzNPsKNIHYVGGckWK+r825Uen RG1BRhvO8UW4mCjjUhylmkJxaFZipTyG8mEY1NT/dig/DguZlyifNaX046j7zOB1Zxkz noQzh/ZulqkTeC+3X7I2aHv05auQ5d9mWqNKqsICzU1OdRwbKTKKrIUwW6UaenyL+lt5 NEV+1Px7v0Lwgy1YNxMdFT8kqKbniRG9UagomJ8xcJXpxP84YCoypFJRtTp4P9+u6sTT VYKl3nDCHA7hstlUqj+kdeVnCHfdJCk7sPZyZI3Ew5L7HiFBmiDqhn9IB6YBi+Z0cjv5 MK+U8qzLuloV349ejmrzUwZkv9KXEAQ3mR8D6XBxvyf/WS4CgMoQ8ioS1Pt3QP0redN6 kENgeqeQdTJ5sZmnDkwD5AWmZAiCmgL+DqB/KUFNmqkD0wDkNZUNNA4stSYuUbp20h2N Bu4xmVxpjvSyjAh5mBJqlxs5rxaX2M3uXnW1vit7dp+oK+xAQXHWx7v5ZKU2TQRwguw+ QzPbUVEAcQSGlhI+FGhyL3h3L/d6LPG2rB/ROE84gxtz3pDasn7Hsy2b5EQawtkkGvJv wCZ5TBxrbEMdk9XyDh1HQugEsy3J8PW4dEISY2OEqfHvXXVDZbPTFGnNzERrxhGrSwVD tLj00Z1gtlfkprqcTcjVfPmlrUlPUsROdb7VAD0qhuMofpYNOmozYBwMhyJSzm1JxwAz j7x8+YqQdfXxplpsyPJKUZjcopiY3K6Wm2q6qS7Jh6/1ns1Vta5WnycbtOAJoXbgKZUs Jame3KiYQG5TlR2YxsQEKCos0QdpTDAJdAlLEv8MgTEu2jqH/HKC/iS2FsXAPNyy0ND+ NPt4hxZk9DtyfjedVuv11d0cNn5I2WHIXqM1T046kxmFthJlAvM4HZXwiIIiiW6bZw3R oIT8WpHlB0neimyuJ5tnZLbARUWmkzU+uSJrxwYNFfqMTJeLz1C7UKeTeQiFitoL1dfG THZMGhWJJJSC2YTGMAKojgJYr6bVJSRvTdAmTkqgJIYixLp2vGdrslhuZlczrGkgiySR I01QAujJjooA6OtYoqGXh3NNEKWw2o1U6w3C1LP1tTQpYkIuru/Wz4B4Urn+fRNQZ1V9 uputQIpaWkLgHwn+LEfFhOxhKec6Kvynacx4ZpbvYQJwKwmwmCptMyGtEvHosBCt3gU4 pI8nNVV8QoN+CDpPnWZBUUzBkGYxMA1n54vV7OPHSjKmUiudJpRt1R6CaY33bWZ0CJZD ebroUQXHwysmCq9j57LY0R8BMGwrvsxsRoVhriw5o5bHYcCxAp4Gev8Oj4QT8o/llwo9 XZWRZAyk5vJxNZnNsXi3raNaFN0KH4ArbCQcm8PVbEfFFUy2Uz79pnVMHFsp4b8hyMZK QWnRuOpv8oxWRmXOORE1qBp7g5a1rtdn2wKiT2dZohYuxYKOXlQIvBdb8fp9oGOhQJ9V 9LNWDRUZwVuGDU9qghlnLGHykVf7MwUeKydUOuMM9PNGjrZwtzE0sAqgD0tRL4HtLhM9 h1oZDCkDWy7QuXl7BrrIZgeNm5hW7XT7oCeAXsIIRWVpzORWMcRAwc01ieUTr04TwjQd HL1JbL2XlWmD/dvZcqW8lh2GyW9PyGwdQi2mEOEMVX/teQ1fl3bQd0uGTS95jt1hSlwg q4hwSRlNBYQV0iq7JxYiyRUl9wvrgz9xQLt6qD/ELbxC6A+zuayr2tFW3wNOm348As6u e7xjYYZHd35bTeFFTyfz+dfWOj4JEhdGPo0i5QOprukxqoUZpWep3IjsYxpNLm9ma9ng XkaGNqvlHEz9B0LwcgT/T/DWFQPo/N8zDL/Dbr3Xq6CpQKHnOSbc85LHNqzYWIj2b84j SG+t15OPFXQokiHIhFwuvyzWm1U1uSGb5ZfJ6nKtFK9RxRCCn+sYX8PzDqF9TQhPz3VU 6C9wrkdqcyKDLD0yWezytqFcrsgXROlmN7ewFa6Wc+QfpXAEQDUaq8ccTW8J3Fs1r+EW rA3uqrk1LZ0TVUdwszh3YB6+Oj/esmRPe+E52tWj+YGXanSu3zMIIqT0pprgHBBrI+2w iKQsN9azACzDgbUyQa9ZM9VRiWeWx6nJxA3UjjJSvsMUeEY+3O0IsEM5/ve2Wqk8sY6z h0C+MQt4PdFR4T5F4JnZjNcw1diK5p7uCCTb3oC3ge3VHSeO5kIF133ROjANQOCQaK5c hawNFoJlZeCCp8TMblQsK3eXutOEBmAcWXBjvtpY3mS9vruZLT6alGcA5Nqidq5nMnz9 VonZbugRNkkQPxtl5XmGXFUH/F5xDBX254LiLIDt/pSHWNqz+fwOlvVEFhYhmaKLJVjc NI9Q4LG3QFc6/AMPnrNNEjT8o5I3ztBvyRxLNY6aQY54GQx6Y7GNg/UodKbOhoxjHyzH zi5qu0y3YcL5UJHvMYZbDK56yPbGZK2tLet/mDAZmpHAhBMDZM8XFRnZAqk+7TEaftrj Fpp00BAlYu7ISXVAnD2O0qEpR7bYNdp9iMGjoSdQPgQT+YQ2EnsOxWQ5DqygFk89C293 W/W/KvLT5G56Xd0hu1ZtyGQOS1y+Xv95i0KLNXkzWdxNVjgt8Zk8MLGsP3T/vn8rIyDF 7wEWZ5tcM7P1VsU9YeT3ODuUkt/BD5d1WcMP52CJvozW+Q9bx5Y+dwRTR5Pk8PHUiaUM cyC0LBJyQxjLBa7TnMyx00cuXe5bkvV2PkQKAr6YRvKLcYrH0IKpp+BN/RzbkrkXaqgE +P0Fp1kkg/JoPlfgYXpIxenV0BzFgDgYSWa8UCiKTB4G4JZIn9B+bW6+5p40J9fIgr2v 0XjwxJCcxCwo2szFaSRn5t7idzFR9amaN94iMmBuVp+2br5WKJWkpDIjleK7OCERFR6Y RsGQicBct8YwEYRtUpyS6u6Tm8qYbKGBs91iCtJFjREUdaut62pfpr5Lj23ftTUSSbjM 0xEalYe4SBD0EM4dQykzUG6B4iVOEqWo2LagmxE8SuBc3KLEI8yYJBX2FOQFWm7bMSGD PXI69ul2REZnAYJ6lL5JD+E5+wbk75t7sNgqtMyjxliNPAeRJYSF24405mLG8CQ9OzOC J3VHporpGPlymChJ7cHR8VlKj+R9dz3HNc4gTZEpUp9xynNcIUQAhOAz9S5H30F3HblR d6U/Z4mQsqnGWYJGivLB9hdQdwT6SDjU1TRS4S51PSdoIoYz3fCj6j20R44r/QT9Ds+e 4j71Ca7bV5H6bf05ulOVgEPdYWdjf0HNVP22usJ3ZNjNjkqFUzTGJLKl1urXjRA9xwNJ AU2SM0i2G7O80hw7nFeafN/DGbt4xcqQ+V50kPg7+RQG9qYY67EdSsLK9c7vadwomTVy ZPA11wUFchYpQypRSjNOKoLeZ6gJkDUNSHGmjNOya0MoBSiT2lIHJyUkHy9l6zTe2ufK 3BhNoAHU0dp5qm7Uf9SZpVAQ+mjt8011e10tyD+R91BOmCoYPOpXBAIbqaD4UfVbODhO /9bfTvMDbjLA4wuavgC7i+/Qpf7tv90POo8SGH6ofCSAzYADpOVi/0g2A4rXpGRLA2Kg zZChFXGaCbfS3xA91LIH0HYqgwsoRas2GhAeZLkuANCGxdaj/IwGhrCCsQOgWppvlbJD B3o3VwaBMTfLTxvfxduHjAaphNE0rWU02LGG1rBjVtZxuDmKdtKG0SBzcBBbOKNOk9ix xvf0XVsjTaOBY/+BNAeaRgOck4TnTaMBO9BV0x+r8LgeaSpPM4ZnOaPBfNOqa/QSq5/u RmoQmkaDgap7j9Pw5o7G4mBR0DAaDPIaEBlCWIVuUd4wGsyYMxrMCJ5kjSRNUl+jAd3Y uTEa1HXDaFDv9XIvjUxjNKhT4K1RUIraaFCj+m6cEm8+p1kCYtTjNAePt4wG+IPaaJBX xmiQ102jQb6vDQLzBP0OzzZGg/wdNyqvIkRB3efy5HptNLBEz8YaDWqm2mABPrTRYEdh fmC0+flQowHgIHLDW0aD45UGS2lBO4RXWnz/MEft4hUnQ/p7TaPBcllDaGvx3yHqO8Tf GQ12ho0n7VAbGjdKZrXRYPG1bTRAmgsZK3xko4HLjVlMebffX6Cs8jRGw0O/8mhGw4E/ cLDRILVoUQLd0tGSPdcoYrU4YThD8RmEsSxzj2otbamlRODgvNKV0MMhkRED/UeZT/DB avPpPTn78Ql5jr3HZxX+FuRsjj/CvoP59jy17y6fRM9LcvYdBjk5Q2rgd3LxxuUP98+q aYGqcksFmbZAoY8ynAGlhlywQ8DpRhwC5kJrVtJiTQrcjpfMEeyYJDWTPNt5MpSDVu7h SaSr95hE4AU43+x9aoNXR9m8aUBaNIgeosGDs2oSgUzXNb7hBvSFNw0R2rNq0EB2aGzR oBtK3Fma+38Rn+9kCmVuZHN0cmVhbQplbmRvYmoKNDEgMCBvYmoKNDQ2MgplbmRvYmoK MzkgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDQy IDAgUiAvQ29udGVudHMgNDAgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVu ZG9iago0MiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFj ZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GNC4wIDI2IDAgUgovRjEuMCA4IDAg UiAvRjIuMCAyMyAwIFIgL0YzLjEgMjUgMCBSID4+ID4+CmVuZG9iago0NSAwIG9iago8 PCAvTGVuZ3RoIDQ2IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHV XVuP2zYWftev4L5NgkQRKepWNAG6aQtsdwtkO7NbLNI+uB7NjHc99tT25ALkx+93KF4k 29GYcsxRpkAj07J0eHh4zncuJP9k/2R/Mp7HOeNFGmdFJpjM0zgpWVZVcSlkyVY1+5Ut 2IvXa86ma5ao/9ZT/C6JecnzJGma3Ccp40pUWcaKLI2lkNH0lv31gslU/VT/c3HLXvzI 44RxdnHFztgTdvFf9sMFCHqQpOgYkkBckRSCKZqiJE44Rw/Qh4tpP4V/W2zq1aLeKELV 7SejtsQIFLzIWdGltpeDz0/LwbKIy7TK5DZNHhz8fjW52rDm75fzf79hv9TTevauXrE3 q+WHj+yHD5t6sZ4tF2t9k/rnp/v5RyaSpHwSQUI8GD9ActOyjEVSuU6OSnTTLC6TstSi 2ysMwaaTKOKk0rOpO3+iI2b41tBFXkqHl3FKiqzROj3yuUPhJ9+53aYzOkw5ZjKWecY5 K3rojHoH9zn+fCkdoDPJIKS52KbUR2d+MhP56dOnPZcBZrbIqlgWFWySZrue2T3iwbYF mDFvARnAdlGUcZYlUP4dAfFhOwlI8xdATFKRx0KU6RH0ajEJwd00l9AOiZMDfyBAnA3B V6AAKfmOHPSqhoaFJwMmzj52ZbOXpmC2KKEpnhf+I8o+sfMwkxtzO03SqmLFYGL1zA4h ghyegZS5OILap6unAeYKT5O4kKTdvwq25mVcVrw4gtpAbIUK4lUGBPA1sFUIHqcpXLvh 1IZhqwCQzyVZ+K+CrcCBRSnKI6j9xJS7Rwhwj42PvnT8IYU2qKrcia0/1vscevrytAKX 5kmLu/60gruB+Gq9Yy23o/KOE5gABK2GWP8AFsq5fYPpDIQ7nds3mNID3T5SBy4GZJ2A AGEe6wToLvpPukCDkVonoDsYvYA7mBPgQVMoJyCvRJzIdEB818QnDv33k45aKqMWQGaN UTM9HJPyzSGmiAPIAcp3H7utPo4O82TbYbgDcxRcZnGSwe4a0v1VwD7KddunEBEtEyca 3gPjSm7HM6IHUzADOG7jRFv0Pqoqs5OqK8C9NAVTZQVCxZDQPdmznci1mjGDJotXbD3P s7jgfEhsXc0MO7EPzPQpMYu8ko8WvnyW1uihTN/2dDhJRhIC1+T4unT6hHnfTDY3vhwd EJDmiYi5FBUbTikUTQhCTbhqOKGvmsntkWUcwlCRxVWJ+M9wOsPwE3GKDHUBR9AZSkTh XmVlKY+gNJCImtDf8KEPI6IAF1IcNfRhRBRlCVVOMK5jmUaoRUWCTHmajl+L2jDqcJYG EVEB7FYWRw19EBEVMollcpRuCqRFbY58+MiH0aJQTE1IeovQXtj+ygMjDzDqNm3vQ1Mw VyLLERGXxj/v5VMwmmSJ0qFsSMC2x/P+NoDnzYHdVVos113wjx2EmSe8KmJZkeoZzOtf 6vW7ANBdALpnORK4wykNo8xR7MJRPdIlE5Wwpoz0QeeSfRuCnSbD2KXTBxaFkVAhq7iS hIpGL6F5hUE+ZuTDCKiNCnYZOg6Vn1YovjLlov1FjsHMEGBkngtjGt1MfrAgvMcKKeIR WUOkaVBQ7pAqe25dNN2DQxICTRjmMJoGgCBnGQdzlQzOD6tVCCVpbU6X2N6pcmIGOuer S5OHWAZ2vrp0PirvrNHr0uTBu4DCZ8xJh9b+Cnof2dtK0BwS5XdeVQ9NKIqO2ut2fLyq LZpYoqjqXUrkvCoPmnxMxwCa7PIm1MbHhUl6dofO1o5H/subdkjSK66iA1Zc5RxpBWmW N7Vw6Y4120khKXP2cvePSrd2W182A08m7nRJWjf6uluHmDif0R9g4tzoJ6gkTxMDHHo1 XyiasgqVhTzNh+bhsUzjaYh6XfilWKKjVhkOJViR6v+/VwHiA3aNgRmOMYltVuZI4aKm t1kAOQ6xLRDFpzjFmGiCgRZY3jpgKu2pce1fYztADdl6QkRNBtIJDz9EVtYm5IdTausJ ncvV4THqVU5RscJNss5QPijOF4LH3KTBDKX+UrvN4y1DcCIWWwtvCB+VqsyTGAWYQ2oJ mwVF7LxeXGJ5s/trarVd0av6BqsOgPmu7+eTlSqUD2GikJTKUmi3TPdxVHzPOEIyBlj7 BC33LS84oeodTGdw1TuY0m21AIENq3o15V+B6v1iPIbqZavlPbaboCjYicOIKefYrSNj WZfR48CFUiA7UBkMNg6aUonCYazfb7CqR3CJYVxfsdv6cjZhV/Pl+26I8yQ1txwRCsEl yzTRo9LyqIJL03HlpDNaikYbr/gP7suXrxhb191BfRiWDoD+tnJ0OLXXt/Viw5ZXSg7Z HepI2d1quamnm/qS/fGxWa63qtf16t1kgw1ZQiASo4f0EIxKVFG7VWEHGi0Wo9BDEvsz JYnNW42EpgS+aDZk+jiI/OPs+h4bPIlvgJKtALIfJ7M5Nf86g6y+Xi7eQYAhmJN5OMSc xQI1NExWTSfHJKCy5CifGNfWQIhCx3lh46M+hpKxX29m85ptbmqoVOVCTZf380s2W1zB nWopJnal5eJqtbxV919NphtcTDYhdBZSsHmB6gXT11HJBPZxq7CBzwBbxthsw24ma7ZY bsBttUnXJZvQhHwHALNeT65rhr28MBYTNq1Xm8lswTaz2/oZDQFm6WRVB2E/ephgnTdt WUddHRX7M+iLNDc2w0/8p/MasYA/6kV9NdusIfYMG6Pdr2aLayXaStD1xLiuccOEzPft 3fEyD36ijh5WBZEPUUnOS7jf+or1Zurs8i7Z6Xg3LbaddHqm4NJWOQK2P6oqFIlkmF3Y dQCRzt1NCA2dLeo6dGpqmFQ7EMJyY9c/wdE16lieCpEISrNdnQSg2f0HuqzwCmTUH+7m s+ksxG6DKSK0zTTqjNyA8pzPjdy+FVwpqj8FxoNGKMkAuRGQktihqyoZ7Y5SyqQ43QjZ JB52t4ETYjMPfrMU2nF2NZsqhExzdDpZ1wSq99inmLGLmxnN5On8/rJew26tyb8PsG7Y jq7u6qiUZFrEyKIPs1EABgG8LZu+kF1aewG3T6XGAA8QirHZRWqLJg/xvQe0JvPuBHiy YZM7UjqNPM8nH3HHb2d1fB0fLaZGXfubFagI7EZLNr7D/kcyK4oamCaJUqMygaOjzErO qxBmRWBrgzIjtNlhhZdZ+eN+/ZGtZ9dwnH578sxoIdp697SVHClor4rCDeNgLbTHxnx2 BlkbQ5VhCtQ4E1PwvKiCmBhRQvyxkbJ/TIl1Z2T9rp7DuMDBgec7gqmJiE2ZYBkrFqm3 evhYU5OowcykDWlLwhUE+PIEe06fHvDZ1QtdTnjNTNK9AcyZXY02nFRrIbQ8UqoCngnp k8n6aFOhi916thd3eFXLXVhdghUgFW0g3sarAZUJbbNu9oRw9v7hZSeMva/nc4yQVvpQ JHAyG8DasvsBxs9ufyeF6swhw3diQNWaFQP5O9eTYb28X03rdRxgKiN9H2MzINK/baI7 wHTb4fYpRCT3q7Xz/yElxM6vgjYWpcncdU3CdgnxETQdUkLsaMI+FhktGFaGGPPXrNk6 pDb2HLkRsrpY+ccuEZVZwIebIBa2uVleNh3wWO2xA1h28TGZrSYA0x92sUv8pO6dnk09 vbO1yfroBRUsNRDwwPUqX7AHznh2e9CR422a98rMIdDwIU4rfhaImkq1uRnid4LWGkOS LY6gvh8QONqaPocs6bGrP4YP5nSyQNyQwb27ZJslm0xvZtBMOooeQLmnZj/LrS6cZjQN WLBAH4OmDjF5FOOcVikcNB3MaOmXQ4xzxxX/bAzpO10Xwma3d/OakrjB0rMZNEoO2KM7 eYjR3jtJKZ6y55iZHYVihvaARQ+I3yH8Pyhrz9h0PpndUmB9igD6fDZZTGv2npKM2Fvp 9NE5W7hp+uCvvhFVvFxO71VG/+d/nV+w9f3d3XJFSbBaG6gAHUkpTJ9mbKsf/tP+FPJR 4IQCbMExyANvjD2lHlHNaTGAwncnrsyy5ceppn9Ucy4v4sxUH3Tx3WNhzjRDNlbs0b9+ +E44fAeljHTmCFCe0NsOmC76a4nHBnnYbhN1VZxt9cBfP3wJkKfYSQXGKfZFKROAOw3y eIPyeFkVJ0R5Zs+DLV54QPb9KI98zhPrJKvm9VwbrJIOGUYDAQy6o9Givb4eB9zRqLnT tzwGC6VNOlc/epCH0kJ15EyqOzt4eE9hxSXHrju7W48egq57QF4HPn33H6CnAGjJLrVO m0756/NtiKeN1mUA4u0hQF3i/VX5KYQkFTgDyBz+5hWAR9FTG+KJTgjvRMuf7Lk1qaZ7 VBMORhFelYHN4xhfDjdjmIf9twUCdtc4bnLBcIrn++XqfyiqejdbLRfkOiF3YZsnl3AI Z+vNarJZAv1NPjKEyqmqcBlkdhkdrLo6KoFIsPnV0L31EZFqeaRGXXXnHH/GwHDnt7bu CsF5E7pKdT/HxHuBJfNC2izyKCYjVUPQFvpNPL1D0mP5gKLAqcVug/IOTY+VdxAFjiPi lk89yHGba/+oUfd+P72p71fPWI36nDnqyOjvhw93M1SZsZ8mi/vJCsfjPqMTcqvmS/f/ t29QqBti5sCSqwpC01V/PMOq30OkzMwJRoZQHRLalpOHj6be47+ogD9KHd8ir8LZ7/Be LptTs1+fw2XZKawlV1NneM5f76S7n1NKrzlcm9J8rACL1UHaAvALg10U7JYJUUhcZymb 4wBDWgLvfkVH5u59CHUZP8wi+mGc4TEVdg1BxW2lHoWW5mH2wO9e0lETzCvEXTIZUcS/ lMBet6YJSRTdNEcTAkY5lntRYkWWuKA2nC9YQKl17tt62pzdIN3ytuHnwT3Eod7I9qFH tNA5AkXtz3g1zgfD1pjtPldY16Fb6DdE3tZvbtg5cCANLqekXFYCa+ZUBIYeCRyKcLvb NEcTtibHYd72LtqAA2pKRCn4liUSa7B1C2LrqEZV+2Dsadu9y7TgSXt+h/dK0jpEQvNG BGcFCgdzeqMmKi3RVVVsrTsT2RYchw75KCs8wrbN0YY9j0o8wrZJygzQpn726aYFz9I0 0LPsXbrtkBb3O9dHosE8y3DQUmWGwpJuGlxvIKfNcO3cs9MwVaIn2PvDZhZpPSynRTQp yWheues5rlGYlKG4WX2X8rTAFY6hguTjO/WJEhjuOnKt7sp8j+MYMK5NO6dZjAe7N/A8 xSeig66mkYp9q+s5Al0k+Hip+gxlAjrME/QnPHuK+9Q3uO5eRVhO6r5PQDM9k+41vXFv IC4076YrPJNi8Kr/dEX6p/s95heUWL+qxLxrDT8iAtie4TZqNemZMFBK8CQt8z5SsqMJ 3LS30uYmoRHaVsue6Wum9M5d0U4LWNtqa3jS6b9parLW1MVMIOiZYtUYhyLmAlvIkBLA ob6ZSHm1nYyzKo/Ub4LqJ2Ut1KHs7qN7LNKgktSGwoVRkak4nv5HnamNI7qgQi+u2Nn5 pr67gUf2d7hgyv6rtSBer9FYw71G0mEQkuOt6mVUsdG87C8neoPrDlj5gmcvaL3JNxDM Nz+7N7oNavZAB8PwENAB4wvd1EAHgR2XB0EH/FBBB84zIJDmkydsAAVxKvMyojA4Fnw0 RKkmlSWgJugWOl0cVTsqVJ/R6a7UhmRCDtVjfklNWw8biBqAuAg1CFhDhRran/Fm6q76 XnWfPmOXXXO/+r71e3xuNBrHJoBdxECRbByXRn22usO2OeWhOq3uM/MbzAIBGWCfacE9 gCEZncm0p233LtOCJ+35HZBPTtsHtkEDwu80nRxmSJE0SVEiY0iP8KFpcVaW2bY2ZjD3 OX2tH24aotRQ0Nbzps3cxexduy3ud66HbWVo+Gchg+W7Vf22xXUHz9IjtnvXbstg3AAv 3+IGum7jBvrcWHyKTzjckHJoWvMN1uvpe9Dqruz3JbkKur2CJHVwg8Ri3QY30JXBDXRN Nt7gBvrcWPxUP0F/wrMNbsCuSeYefRXhptb3oI6eSbjB9Ma9gXraYAW6MrjBtEZQN93v vXGDLOBcyRJugZMfMxsGykrkZMXN2l3J2G1p+RFGxqI+DYCn+2iAFlowPTQaYL/m0LzB 8DjeGH7Ndd0b9aJBEFiJkhZYPteGEEgLZDsrNj0hBPJPmczMgl5n2wlzfEEI8bnXfDkI ceAbDoYQpLbKCk42gTes+C8ZEHBc0CY5WBSGNdCJyly36nYV+kr6q0j1gFL5DkbWLVaB X0Ic1/8oxmP3mwZOvWVn3z9hz7ETzhl2PXlesjOsX3gu7SfgueeZ/YTE1POKnX2DxpSd oTLsd3bxkys2PaBb7XrKaLo+qFvwP1ElTQ5su1sEYpMyUX+UPdzTS256efb+Zja92Vfh 60jGJKgE4F5rJHjBq6aGYPBIYK98GHqzNHIPjaceic9266iR6HTrC4zE/wE6jluzCmVu ZHN0cmVhbQplbmRvYmoKNDYgMCBvYmoKNDc5NAplbmRvYmoKNDMgMCBvYmoKPDwgL1R5 cGUgL1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291cmNlcyA0NyAwIFIgL0NvbnRlbnRz IDQ1IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKNDcgMCBvYmoK PDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAg UiA+PiAvRm9udCA8PCAvRjQuMCAyNiAwIFIKL0YxLjAgOCAwIFIgL0YyLjAgMjMgMCBS IC9GMy4xIDI1IDAgUiA+PiA+PgplbmRvYmoKNDkgMCBvYmoKPDwgL0xlbmd0aCA1MCAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBzVtdd9u4EX3Xr5jH5BwX SwAESPSxW+d09yStG6vdh80+0BRksUciHZKy43+/F/xyJFm2yFQ0k5NvJZkZzNy5czH4 Sv+mr8Q108QDyVSgBPlaMi8kZQwLhR9Sbuk3SumnnwtOcUFe9bWI8fc8xkOuPa/+radf +T4zwihFgZLMF/4s3tDf5uTL6q82P8w39NMHzjziNF/SO3pP8//R5RwGvWrS7EdMgnGB FwiqbJp5zOMcHsCHefyyhb+kpc1TW1aGVh8/m7UhTiDggaZg19oXI/iX80YwDFgojfL3 beoRwb/n0bKk+svn6/9e0Wcb2+Te5nSVZ98e6fJbadMiydKi+VD1w6/b9SMJzwvfz5Ah PQI/IHNlGDLhmScnJ5W6UrHQC8MmdV9MhtHKSQTMM0017dbP7AcqfO/oZr1Ah4dMOiCr UeeF/DywkOjaxiUSkCQTF5TldJcVRXKDBIyzzU2SWipX+PaQsV0UmL2KWXsenQKjQgGq OA8oaDyaVDJ6hvmBDiaVjJ7HAvSt/tguGWfu8NMFwOifWZkskziqEuE+iegqKleXeU6f bFFEt3YEHBLKRdeggzYuTenotRHM82XbQieBQxotUwrt9z969JjfknKFwk4K2thylS0u qip/rkN9+s/1nG5tavOotNRlxggZIbVhXIaSWk8nlRGBD57XNCbQwpZTzV7jVAj+pi4q eljtQupZaCD3NDP4jvRQi3H2jrA0bYCW2XqdPSTpLRpEukgcZBQUgZ8ik/46Rlo47m5E 0Do0qazQyvWvaeGEQgIYfxhOuB4xR//PbWHz+7o/2KKMbtZJsdrYtKRVVNAyStZ2QV/e gT64NLnL7X2SbYv14xj5gMahPZSibhydVEL4IciiGtCfm3mgCzbi+/0huLDfWJtSmeUp LbKH9Mv7EYItXNPhDpMbxyYVbGlAg1tqPptGl5Ye01oMqz7RVN9zfXlhMZtvwM8LlFxU UlJSHKVpViJNRkgEMA8mkA2kGwdPSYQzz+sSphijeWdTf2rUldsInVlCfjLeobnTyFvB WdCSy578xkGXawNPeDVCNLmvmKdcGxhqeYoGZtnt3pw7gJThVFUIIRFhk8L4nIff/exF GZEHIVhlgKqqnTilqC6q4O4JcyHDUAgkVPgHQ4iSPgsPJMTXzKyM8RSYIzfMQBbFbC4g fkLTZFJLroxw/+by9QghE/oKqugxjBuFWt6JxBPRflW8pJtHihbRXemoalIW36Vjip9/ 3aLWKUnHwMpukNnxpX+dn3KqrVYtQTwElDN3eIFGJXtM+RiwTUghOKoOTOCO5YTTO0ic 9r84QQ7XHLquP0R7bvhPbqNaniqzClNsnoNkxtnCsczsPlmAFyVgQRXcVNLqAhprce/E i3EOt0PxxtVTanYsrVJ7PkNXHMY+3AlEcZzliyiNLT04yWCdxdEaEuE6iR/HIZyY9pSG LNS6MqXwKqMYMlxPSRFUoUZ5Azh73/bguKEDOr0XdLLShsAmnTKcLVsByEFpJwF1Osb2 rihRp5uRCq5F09bTSWVEEICChsMKDpXmdJaMXNyXjxWoFbVAG43QpjhEzkBCKVKNE01g e/Tcm2xbIkGeiF9aaQNbNBpIjXBrBDekgsEaLWfPjf7t9sj18I/0Q0AZE7hBHlSduJC5 W2Psw91Mah8wG/4CAgMZIENPfEAfXObZhn7//OFniQu9PyAvWhf3WqJxWsEYwddoOIGn qHV0UsWpQVzDTsXvkdeAxiQt82yxjWu+0ZVqFK8SyKNI+iLZJOsor6hlklsnjl3gDJJ4 5Q6pzEaJfqOYq8bTSUVfcSgh7UjZZw3B8RCnOVOU0qerj9c0v6SP0Y1d0zVICeL7GbBz gJz40HybpvjUP2y0GDX6jaenRP/ckkjLTtXg6KMBjTC+d2sIe4ZOA7V9gQHYDEPtL+8S Zt9SVOhWa1Tjxil5eTZVwVkDpZ6Uz3G7B+5cqQoKwR1BVeg2evZC0acVlOPc2gnGfWEQ pqGpZ6nmjl/eOwIfdUQM/LJTOesrm02E5oZv+GTksLWGzTEQE4zTBAHvvDwlM5+dnYco I8rH7kSA4fh7ZSQ0ocQW2vmVESV96JV82Jy20/3crsYTvsz2lMAjJNZ52HPHsVNYW9MH n9YRm36IWAsFpaO75ZxG23A31W6nccgo/q87t3HRjN9O3nLHXDdit2NwvlPGdapUGuNT Y/0pp3xmFsMxVXAhgYaDIzrPk9tbzENQB59Zw2wUxDgqbAWWo4xK7eJl69QpgX4W/M5R Th50DCygDkrdaLFJsEMI5QgbIpia1m3vuaBt4SSkRtSoZI5nts7G6DzdnNo4OqXg+9hD 97yBd8bNxt6FGzqT9XoLaQ6LW5VIPkJcORiW0biFa31o4tqDYH1Ibp1eJJ9aWgN2s/// 2r7AjXEYHJo7ifbhGw9aEahy3T6mYVPIIcdPayEb10tMOx43pTjhRYlR07oZ8JViQuoW 06eRT74Gbev08mnYJAOGW+dp1Z0I0Y9xBz+lHBfu/VO7ArtzdAfPDJ7bUThCW/Ymk14P IbBrAchshZrdxxk038yGPr/as4m8yqoXVzm6F2G+J/DKDD2mOrpp2CSNZF1nOTCpfqU2 6/9K7SBMzaYAOvfTU7nqYUv3jK4LE0AAiNkOS0dsIj7r+3LumE30FRL0K4/5oAQw4bcs +KhNeM036/Wa77hNJ8RJB0xN64GhVCEAc1pERfrYWZrYyzHpJM92PXU3m94KMKUUeHXT vRzbAfG3Akwp3LPclqfsxunNbOLYoGsYwYFFb4OXeNfBuydJR2waGS+FCYCXLUs5atOo eIkdOOBlOKX5XgR4Zz6xVyIiwO40b1lKn9vZj5Y+RNt4Zbf5BVmsf6yxmeC+XH67wz14 Qb9G6TbK8aD5wr1pNvUfdt//foX3hcS9P0ZQJ7pLxtbbvlnxJzdnF4wKZW5kc3RyZWFt CmVuZG9iago1MCAwIG9iagoyMjAwCmVuZG9iago0OCAwIG9iago8PCAvVHlwZSAvUGFn ZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDUxIDAgUiAvQ29udGVudHMgNDkgMCBS IC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago1MSAwIG9iago8PCAvUHJv Y1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9GMS4wIDggMCBSCj4+ID4+CmVuZG9iago1MyAwIG9iago8PCAvTGVuZ3Ro IDU0IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHVXW1z20hy/o5f McnlEtmxYczgfeuyVXu+VVU22ZxvrctVyt4PNAVZvKJIHUmt7Sr/+Dw9rwDIhTiQOMLK VQYwBIc9PT39Pj3/YH9h/2C8iAvGyzTOy1ywrEjjpGJ5XceVyCq2adjf2Iq9er3lbL5l ify3neN7ScwrXiSJanJPWRbXos5zVuZpnIksmt+wP16wLJVf1ZeLG/bqnMcJ4+ziip2x Z+zi7+z7CwB0L0jRQ0ACcGVSCiZhipI44RwjwBgu5sMQ/udq12xWzU4CKl8/GbQVZqDk ZcHKLrSDGHx5WgxWZVyldZ71YfLA4J82s6sdU38/vf3fN+ynZt4sfmk27M1m/fkL+/7z rlltF+vVVr8kLz/cLb8wkSTVswgU4oH4EZSbVlUsktoNclKkm+ZxlVSVJt1BYgi2nEQZ J7VeTd31Ez1ghfemLvJiOryKU2JkiusM0OcehF9913Ybzug45phncVbknLNyAM5ocHJf 4s8X0hE8kwRCWog+pD4886tZyM+fPx++/RpgdYuyivM8AVvVqNere4BEWI+ICfXqrzsB 0b1Cq00qR8rRVBSxEFX6AHj1BOwRdvT4Uj8tMqy7BFL/Qdjt4vUkykAK+Zpl3NHBMRxV ofBkIt9Jng5bGGYEwbh8UsdZWZT+ShP7yt4ytkd+9ymdY7gVuH6S1jUrRwN7eGmfhAQ5 dO4sK8QDoH2+eR5grfA0icusxqr+TaC1qOKq5uUDoA2EVrAgXueQrb8FtArB4zSF0TQe 2jBoFVCRi4wk/G8CrdCwykpUD4D2K5OGFOlWB5hs9NiWfQpuUNeFI9uxGtQ+53p8WPM6 LpIWdv1hBXYD4dXanZpuJ2V3JhABcAeNkf778zzsbRoh+J1BNRpOEvwBIHUG1WhIPQwq 512xRkAAB4o1AvQQ/RddoMlwRkB3MgYt72BGgAdMoYyAohZxkqUjPKfG8j/2+lX7A6VQ C0CzRqiZEU6J+RZQFOEHyEYw32PRrd4L4X8parjbc2bG5M8bDik5jy5QrJvIwOmPe2NJ BhEr1k3Ug/dJOZldU136HYQpGCcr4YOFYnggLLXnEpZqwXFen56Hz8tpXRR5XHI+xmkt l6+v9iJhjbyielZ7+VVYo/tCaEGWAwhOBc+6cPq4rd/Mdte+GB2hufJExDwTNRsPaRjF 1XqrxgP6rVrcHuG7MQgVeVxXcP+MhzMIiXK4KXIE3B8AZygShXWVV1X2AEgDkajx/I2f +jAkihhUJh409WFIFPH+uoCQHI/PQCQqEoSg03T6XNR6UcejNAiJCuhuVfmgqQ9CoiJL 4ix5EG8KRaJwRWYlgijjZz4MFwVjUh7pHqCDavu3HjryCKHuzLGOjjyNyGiRF3CIZ8Y8 H8RTMPMmq5CTk4/x1w64DP4QwEHATVSs0EPw9xCEWSe8LuOsJtYzGtc/NdtfAtgYAiGg vCDWMxrSMMwcuS4cySNdMJFiavIz7zUu2R9CoNMEGLtw+hiXYShUZHVcZ6QVjZ73UBRq vIIdQH1mPgyBmuSxHkKnwfLTGrlXJg9zIqIRamRRCCMa3Uq+N9N6QApJGQrPGjxNo5xy x6Svc2ui6REcEw84cfa1k4yjsUrL+fvNJgSTtDKnC+zgUjkxAp3x1YXJgywDG19dOJ8U d1bodWHywF1A4jPipAPrcGq6D+2N8PI7q2oAJmQaR+0NMT5WVQ8mlsjYw+AeHWdVecDk Y8GMgMnuG0LSeVyamGd36mxCduS/b2gPJL2VCcnQbvOS3GpgNzY5kDjCCpnZN9TSTvak 2V4ISYozb+UUwEae+64gt1QKbNEFtsM7+uCdmPZdNKYL0wDv6ENITpoRgmsEAl2cowvs UyKQYy0IDkuzC5IH/vwNo/ZCOXJbi80T7sH5pKizYZbRuAtIezaA0QX2SREId2CRk/Og C9PkiM/6jbpwPinubAClC5MH7sIRn9OOu8A+JQKF8Qh1QfLAXxDGZ1POe2vkSVFnIyOj cReQ9mzMoQvskyLQOnsGYOpr7MG04wQb7dJEO1b21OOOFREKJgiJGAug0DlVPotUqsf/ sf9HGxtMawinhdnj0h2Kj2fXQIurst46fqpH3+BgTTgD8TF+Kh+CGBGss/ZSXhVIaMMG J1VnobOYrQ0XuPZDXiKngaI23rUflEcSm5hH/30bIHxmd+CagU6KIOCXESgXMimCKJIY +wBMSvs0iDTncJsb54cP+wmSHG132+Sj4UQATDkdOuzx0dO4bb7qeEjtbhsXkejsssOu /1Ps++fGFDSQjwqDh8AxN0aOgdSftfZxDA7blvYnQrGTnZqMJ8UqM4HYbW1Y5YAytSdJ 1XZ79rZZXaKsjvtTOxndljD5CfbkwtPz8W4528htpCFEFCyTPIUUyPUYJ4X3NIsTKs3i rx902AKYwr1sYYRu5VjvaDiDs97RkPbZAgi2g+MT8QXHejXkvwHW+2g4Butlm/UdypwR Bz5xlD3lHFXicpZ3ET0NHQz7CNJ0Wll9Oe3lp5pwEzCosLG+LtOU9WDyEFQgtW/ZTXO5 mLGr5fpTW+IT9zxBeSITRzEwT0rwIIW9RoW7Kcytqd2Yof5jkoxK34H7g7Ft8/GmWe3Y +krOMLtFFI/t1uxDw243610z3zWX7MMXVb9i02ybzS+zHWr/hVRCzBinRAtZncBOzs06 91hTStt7f/bhbsdW610LzYsV210vtmw+2zZsu1jNG+h9FuPsarZYNpfvnwVBfR4LJEwz M8xJob7iyJWdVoFFpBzERWmcvdPI7KMKsTVKA47Qk0Gj54uPdyjgmn4Da8TR4DlokJr/ tgCb0ObL/6x3i6vFXLIF9gtEhQlKBKgJgABAUSJ91ox1UnSaYxGlxbTERVZAZRrpW724 BkNaLxsSFpJR6Ylm4FkQGWBmiwC8yQQcUZdNDkVPuQcHvvoC8MFhlfW9u57t5HOL1wYY hq0k2BvHJDTrLC1jZHeNYx2fZlsp2JrtbvZhudheQ4NYbxg179abFbtcf1rFjF2QqLuZ fSFVQ0q+Rgm+9VUI7MPNzeFTRlhOjXRSjENU0DNR09vfwcGgMaBY861U6GbEuimZ+AXh /0Mzn91BscDiXa7ns6XUJ4iXr0ntaKzTKSj29UinhX3KMjRlJxxbuX9nC1MFcUDbf179 yjyA0GfLJZS73Z2Ul1v26brBHGACQuA9M2qdkGOcFNrhaBDVKG8qEb1TUeaz1aptqJ7K BWWy1jINuL8cgvIveR/45BKa/YvOMtTFlX7869sL9rFZNZvZrmGzEERidaruwKYhmFCL I6dNz2NYo1FXdutPs80lpJFVArBkz8EiO3xx22eMakZCzIApM5jp0U5pnaZ1Glu7t5Vg fQx7XK0vmxdsccVm4IA3CwpokFGrhdBspbwMN4vL2/UCPolP67vlJZQCklqBGCSc91Wa Mz3I0XhHAfO6xj6vHGsJdUOp171IAnIcBMeeT+AQDlYY2qJ1h00BtG8+TVFrKK0QZ8LJ H0gngplTM6qdW2VJST1e3R/CAHMcfTIILAWYkGXhz9tgQWquBWcR6RxWGWHvz66w1prP s5vbJcghwIKyJQjGj+f1d6/bQuVEsSPQAdWXKjHnCvEj+JxeUe+fteSJBT062Xa8NIeq VGDnhQHdn2ZwxIgF9Mh9g3urSu8VGTj2xqbfGEA1jv3l24FVLhebKdj1+i2t6ASFeeCf xWIWNXSFqnX39vUenC/dFhdZFbhEfoQ8mYeLNGNgGJzdMNwL3Gc1W6JuOwUx3bdoY8zB TmiY9MU4j9BNoruJc3QEv9WIjuiLeSQ7JcjAv3w7SXmCL6ohgdMBrhFDoggVDUINyTwl WeQPDSEVm9sxJAWZGRJUyMc/iMHm4KUlzo9AhRT/BQMmq47k6WmJxgMHe/uApnPRMvbC 6zS90fqvOkoYOnAA1ghO4GagKOPcxFCwlo4vZsDYj9/9H5tdXi4oKAI1/osRe1DW7TTc 3UIG9pTLT9eL+bVScQJIwNQo9aka6mjN5hTYz+HEFSNDKRRBWW8uF6vZZgHkK2Xx1zSP m2a7nX2EzrG9A+5n2xCIt2JRj3JSmKfqE+6oKkf4e7sl9zKYGLtstvPN4gOce3BqfHd7 C2/q4jP7I+l67346fy1Ekv8cB8Cw3dmR6tFMC8McB0iYeqEdZtffP+mT8t3T6b1qmKZQ ATJ38FYHptB7JUyGQg+mAULcwxr8yI1ltMZRIkPWZN73jq6brzdwFYEbk/W/Dm1UasRP ij4FSVMboxpA/AEOoAIo78+2758p4m1lCnunhgwpytHgHnmeoLgX/mNpZzAtOb7HzvpU RDEgX9NDr8HInrg5NAI2PAJTENWMYDSJHDBJ9hSj++AkfFY5TuZL5f5+5LsAryW5ZmHD FCmv6hO6HuwG5R4qPChzt1l8/Ain+qVRxbQHgoIhSGaSKgA5/xD2UykVIaRUagJOvXH1 2e/9p60eM8XGCk5RYk4glkEzmVPhIaT1ZihxWFfwIpW8KOuSyPgIL9IeFZmf6NuezhJ1 6jVcV5WOJbZW5TEeQ/LKni8+N5e+q3MEvLbOc9qGtzNBfb5x4qoMjrO1IRpYCn34zhdL pInC43Z+Dh693X1B8L4VK9m2XETufFdi69swoQZsCJcn/CmMj+Z6pzBKwAT52GM0DgUa ICYXq4/LhuZBJR7czHbz6xAKsnUq6jFpPA/QUV/YA3IZLVH8sk1CQXinJZPuADpLsw+y jzo9gllY5iZQY1JkNlg/DZgQQMpNkKy787jPIXzQpDUec8a4l9UhSpxT7k5O6KPpSXZD ixLuWW7xNLAe+lj774adz+BDaO6QW9HsENNHBJH+vv98uwCDZT/MVnezDQ7EfkFnYtfq Q/v/uzfwQjDOfw6w+m2ekRntaC47oHi8wxZhzn6GTnCpqONRXd8CY4BntszgmRUCF+ns 9XTv4ovK8Q1nsXTwctkNnlRHLTV+OC6XIxyHo6GLiOJyeQ3b6YaZNhmrk21LtKEmP46H d2202RrrgEIkKN1dIb3WtETknyvlFlfbxmybeWuoZW6/F6XwNNUVUEYwmF9EAWSEIbCh y0KF7ERObgAHu2mZsyxHkLcWFfrSby3RhmpfVQEzy7Rl5NuS4zG9t1o0DNSXesvBZVrQ k35rv8V9z42aYDB9GQw6qMxsGNgd3t14XJt5y82iaXHvzNk1VGPBPrF3irT7uu7BOAut L0QhCiIvAdpw90vc4yD2HNq3/CzlaYm7gqM+OohCPeHMgbm7j1yruzOfi4pCLqpdICxP HbtfQI0xPBEcdDePKMSg7pe41DjYFj8qP8P6AhymB/2EvhGDVp/gvnsX4bxr9zkdkUF9 Ui9mNO4XCAvqt+lOxrX1+GXQQ2Ki/TnyihHSGg6cwZo2pADywMixIQyRqFabXk6OZNyi O4JkoiGScQRyiGTcctIEiTiUW3SGSN3CNITsWgZYQbT/1n6LYwUWN5ieFm40vpABKGOH NIpcwLynhY0ALhcoAUDZC6jsA8dcT+pLTs+NPyOpwQDwJ61BrE3z6Posc5xSYDMIyly+ qS/y1HYcV6cLTLzdNbfXzYr9FzakSHtPBqtp0dl+Vdk/+3j/z2RQfvOM41flj+E4X/1j /3SiX3DDASJf8fwVVl32DbLw3/zoftHFE59YqObILzFCNZMiwyuerIQqviiFagZvglAP ezJ1IAqOxcwTOCpSkqlwNVUZaA8iWrdJt55sW6INrr6MPH3gmXTeDTWBwHIUYrBfpbZ+ d0vJyn3YOIXL8wQrA0MCDVOgu/1IKwqaP30qR0+PMg4tX8anvZcVVyPi4+TNdFwCI6FE 67YOoZvafEM3ucXO6zhPqqLFEDhq3cuNYOjcSH3TdkQLWJ57CzjNwFJpGLYv4AJR8bYG kaAERgIG4QajWzrs07xFLMhoEKbNMSXTe6tFwSD7UlKfpQauvbda7M280xYRGg9gxe6b GoMtqDSSHVfXDW1h0HsHBKvm78CXjPJwlNYAcoOsJ2mNTDCrNdB9W2ugZyXvaU+c0xrk bnj9Ce611kCt6u3O52Up+yTdA6kpPa1B6RAEB90ZrYHu21oDPSt5b3rQT+jbaA2obmPe 0XeRoDb7OaAzWoMZjdMaaKRKK6A7ozWYVigzvc+9tQaOQ93AlW+iFkXoFTSSStCT0pol e6JFfX/DAU7glr0lLrcIDdG2WnyW/X3sQuGkM37T1NcV5KF4lVMWOChJpLzu+1Ikyzte XYCjEyU1TH7vydQF/TPaFnY/83jqwpG/cLS6QMyzqqFBQ0zCaQqBxxFPLKn+CKfj9JA/ NCLRU6l+SHjFoT2wSM2GH/AG0rT0RWpOqLmhNKd37AypkC+RunW2xrVmZzf0mLprg+eK nSEL/2UdnUGVe5mzs29wwTvwN/3MLn5w6X33j0sroC7QJmEbDKiRLE5q2D+dYZnxqGEp nw7MWzssqIQE9z/jUrKz3+GSsbN/wQXg/x4XgP+v6rN/w6VgZ+/P1Ie0J5e+gpI41MG/ q5de4AIeZ76qu9U9dLvVX0Q/+OnoDGGF1m/GeEKvr3DBb+qL/oYGCxdfrD6IWmC3J6A4 nTl5gFraaE1oUBZwjiegVWNXD0MPKlFo1IMSatwGyfobCkcO9/pljTLz6e/RE6ZLtw7N aKp+Rc+HBiTr4BOx7KOp1DhHJY0mhu9xVFRLEmm8wJoxT0g5Q60IQUta4VOzoyF8EjVd /P3Q8gFDrkoUw7BsoYJ/h9cqWOtZopwEF0xC8AUUsYSeOTDTbb7wJ+CSKL5ROF3igqnW T5oP6KdLTBBYx/1c4VeH1bZLj6x+ncH5hapG8JJ0hkUGJshZ/lFQ8gD+wU603ajy9uQk tNId/h95DVSfCmVuZHN0cmVhbQplbmRvYmoKNTQgMCBvYmoKNTEyMQplbmRvYmoKNTIg MCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291cmNlcyA1NSAw IFIgL0NvbnRlbnRzIDUzIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRv YmoKNTUgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2Ug PDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjQuMCAyNiAwIFIKL0YxLjAgOCAwIFIg L0YyLjAgMjMgMCBSIC9GNS4xIDU3IDAgUiAvRjMuMSAyNSAwIFIgPj4gPj4KZW5kb2Jq CjU5IDAgb2JqCjw8IC9MZW5ndGggNjAgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+ CnN0cmVhbQp4AdVdbXPbOJL+rl+B20+ZqoRD8J1TW1eVy8R1M7dzk4u9N7WVmdqiZTrW rix5RTpO/v09DaBBkJQlkYoYXXZrLIAgiW6gG083Gs1/if8R/xIy8RIh09CL0zgQURJ6 fibiPPeyIMrEphS/iZX4/k0lxbwSvvpfNcd9viczmfi+rmpKUeTlQR7HIo1DLwqi2fxe /MeViEJ1q/lzdS++v5CeL6S4uhUvxHfi6h/i7RU6tLdLs2O6hM6lfhoI1aeZ7/lSggLQ cDXf3cOfVnW5WZW16qhqfrLeZhiBVKaJSNu93cnBV6flYJZ6WZjHUbdPAzj446a4rYX+ 9/7yf9+J9+W8XHwqN+LdZv35i3j7uS5X1WK9qkwj9efnx+UXEfh+9t0MM2QA40fM3DDL vMDPGyLPauqGsZf5WWam7s7JMJk4Bann50aa2vIzO0LCO0M3G6R0ZOaFpMi01tkxP3s9 FOJivRGXd8WmvJlAzKWfeDn+I9JWl2c7R/bEYi6l9JI0gwS0+7SDjaIz0G8/PywX80Ut fn9x+fb370RVf1mWGNGq3HwqahLvl6K+K7vSX5Wrm2pSGTcUnpWM+7kXpUk6fHkSWuQH 6McRy2gceVESSynS8f2koX9X1HdvN5vfX1SYH/X6qdjcVGpOVGUt1reC5kK5qcTR08HL /TgDjAFWCYM8kjLDkm9+iZ0gJohpJHKAmBapeBAjhtk+xFDfFcejhT4FDS17KEgzL45J vRgKRk90PCfPoeVjPDEDqou8rDd59vWT+BnSQ4C+vCQBwgxCL83yOCN6kjAI/IAeersf /3VWh0MgaQBIFcos7PKiGc29+K/eLD5+LLesDLOvj6DDIPEC9Lnb3Z0rw9Y1/5ChY0Qf Zp4fAF/QCGHqBxiYOMKPPBOZl8okzVNi/QEj1Jsd/IpDjAbf91LMtzEqsLXKQKEUtbgt FsvyxhPi6m5Rifvii7guRSGqx+uOrqmw7C9WH49WOftJDWFq5X5CWlSTOlown7HZjmF/ kgeeH4UjDCSgddLtVXHfWu1fisVKPN0t5ndiXlSlarMp74vFCty2mv5p/bi8EXfFp3KK AYA2iCKZCCb2rAaAVFWQRKPmPwZgsXGlAMyvi3ktitWN0DxerWs0UIbX8evr/sluNW9i 6DK8HqB5C8YLkOKfVuJ6Xd9pdE4r8GFGOOmtgV4MK6Wdjg/XwaeQ0hRILDCm4BBMAiEl KTQQfPO4LCtxU1bzzeK6vCFJvSznhNFF6Ems9cBiH95fvMHiHP8hbtebKYQzir0ghw2e aBrPSjaTGAuhHKccP5arcgMDCFrvdrl+Mmx/qNcAumD8+7L6BEws7suqKj7SCBXLai2K hwf4P47mex+eHQqEQzseLeKHTLqnu3L1rD19CELp955Aowb0BIJ1H6HP4bsEpJRC5p4P vJJTs1NjyzCJ4HDwY7xdz47RM/YQVrDGZbBGJKcyTEDpNwBrSQwXRh6NW6wcgdAGX1ck jJloRcI7WgyYe8/j0CCHeRLIVDBpo0fzFGo/AkTPY8bG57EUhTDsyFoY7FHHWkT+tt8W y5s5PABdDXECu0piqyOKkkAkptOHDO6pPW6B9AKJ5a7FxyHq9WKxxNYE3G2/XWx1t1nG zk4GloBXvSDCtgpTYRg7AOXBTqgFTDTCpw/rqlpcw2s4EeSAXyNJw7zb+zORLx/+Eriw xsgXGWQG7G/gaBP/XAF4aGPMqNx58VgB+emG1kWrzObHTTmFxg2T3JMhnB1JqCk9RCi3 OjtOoXEhnSkbY0OEEsrt6g7uIszgUvu7HzbreXkDpnYQd02OicrA7pu1EgCN+ur1BAte aCe/JvWsuC+xE0pqZczc/+3CKr4DrcQRfpMEnrEkg6JI2l3dqTpOvKKQGITAMN0+DVDG /T0bz2Xm7IBd+hEmt8QqIgPSw4aZZzUXfcD80Gc9vHOAp9JOcR574FUySj6gnsRBOomV kfK8iMfVAh6EKRRTjAmbQPiZyuGYQvm93Il7ovAS6yvirpoBOY9JkiWwEGEUj1Gi94/L msa7xgoFTIbNWzjh/nP9VCJs4yXBM/jSe20YyjGMm2KycORGbKg9J9URpymsZGyqjxkB tYvh7J4zNAPeL72PxwO0vm/lUM8Qduy8IME+Rpu+3WEgL5U4dgyRLY6P3vLB/XR61/IB UW9kjriPOE0QmAbAjEivAPFpCDtjJxA99DTbVwH2zPwQS1ebF+gsbxfv3WAUxc39QsmY mK9X9Wa95KGGVQcHYQFkeDPp9gjTMlqWtozrsxiLHVo0fIjHo23hb+DQimGMBIhqHCWq 8+WaNrjgtDX7Wmq/UVlYPfcuNcNOJKywWt+xLDYfJxldwEO1+8ikjh7dE5hbcQJZzUbu Pn7crB8faMuCLV5aq4ByMCaqZoJlKED4VObDe8iEDMcsWFgrvVWndk7rx82KtgKWakrx TtgEpNhYyA4p54FpYoSpJWyXD9KywrqTxXUx/ycJHzk/1La19om85O1qtSetxRcSPS+W xfViuai/TMF9dorEhtKzktIo8PIoH6ckscQ9lrSeVWsECpSrT4vNenUPNUjSerFZ36vh eIAUPJBP5FNJEq1GSAWFvZyE+WZHJzaEnhXzw8jzKQZvDJgsNxvablSY8mEDEI/Vp4B2 dBx/NALXpY7NqAUU6rzAnnsp5ssC4OR2gdDYCQOxY0PtWY1AEMMTMHLTCxO/fprAJEW0 hT5DEI/u7Vo8FV+qHyborN2X6XT2PNYaOh9DpzG0wJ1Hn2Bu5ASSxygBCUWLSANSBN2x HbznxlYZ2VhmP97+mu0MsLWR5nGLFsfH3rOYugH7YwJsyQREJNDMnmfaRcHuAFuJ/Yo0 QogwUzBaSR1iJ+3rJ/EzjeFkQMgvDnDh5JYOsKXIAMRAyCxPyfY6wPw1LBpy5EvibEqM I2RdVgwwf5slXq04RV2X9w/KNpqvN8DvtQbzQi1hsJCnMYWtsWQm6UmHmKMTrCnsI6AE LoyWKZzBkeRPEYgb4QSg74/ceMT2l/IO1ndkEhvYUd0pRF2aAyKIayJcsb6/Vz7lGtuQ DiKfAmXw6DKpo0f3BKZwlPvwRMS87AyQJOI9/mljBlLzeiXKz8X9A8X6KSyN/Ub8/09v CNEJ+YN4bR1Pb7TjaQre4zxAgnBzwXSeFe8z6cWJPWo3nPcXiDrHTu+fXmKGawPSqrcJ eGudkZGhw/B2AB0byCVFZD+scSazXsD/8EWZCQgj1uG44mmBMNwJLYEOLWcBw7A1jcAR uyc4gL9aREV1D84idqfG0djbxVw8FBuEzyOapzresc+ryY5YN3ZaMx1nJYMIbMyxj31O sDuKEZscJuNgd3BesLtNyxDYvaYj2yqIqGs+7Esm0HP+7wO1z89dSefJYoTyMR2j5+5X Bd+RSnlA+RMCL8ImlNTo+7Sn22zcRIcXA/SRXZ42OIRDQXi8BzWBirdHRMZ3H6JFoaSg wqJNtdGIk+OnPSNiAgc7PR++OB0yCVmhs3lAc83Hdtk3Mg+iBF6wkZvatPzpcM/qkRa+ hdkGQ/Dn4vaL4+7Vrkqana6T8mmaABRrHhhSR6uYU5gHoYpT5+VxgKgb6EFxtnQEEh7e 6nE+R3TH7eNyOYG44xgubdRLxAloEoaj0y8tq2abURP+MAElIZ2EDuMuIcOl/xTzI8iw uMILNMZDSFPkrysKFl6JX6//AefLNkumu1QIBQwgq5Owns1HQ+dZyWZAyZDGnc4j1q8V y+lUGPZlyC2CQ5x6l9JVgtdaT75vJdGZwmywB54iTedZsR5e0CCzW5PnIYqITIpTPq05 cLP6Cktf5xyUMAenyF+2bQ4oBEdLJu1pTyGLfAAuMoSe04QIcxwJZC+aY+Xszd4BOUR4 4z1SCAAPb8qjTR1GbztMGj6dNLrPHx8RRdSdLnTc4HaxUmqkOc2LFRRTa4rZwWG8hqqz mhwZUtURgh6zSF6+vbz86df/finevn//6/u/X757+0YdszcHa/SpajreK5BPitzcCIe1 Ijsp4w2VZ8V5RPkF0cgNzPaSR/JJsSIqNoECS0j13a6XOGOtohgo04c6027CwSZhvQaG oaHyrDifpF7MuzoDFWKH8b+8/hs04+0S7OWdGzeVE+Vw4vHgJaxYTRI9xdHgoSb2rPgf w2cQ8Io0DA1MsAjZFF/h+H6++/UvP735299/fH312mJZ7OBSrkeVY4IE9L1OdzAFXg0Q S+fLWDBFZzUbohxmGtsKu1P/TXWqKIwkDHRz6G6IhqCcIRRc8katdQuVRwQbjmahVIvj ny9VFJ9z0v/fp9DHAKZhhpwihrSzmgEhPMU2X+WZzACEjgAWjXMeAFZCuluZXX/56+WV sWbV6swzQhu6wEYI8Kge1qsbWrAnOvVqouBDQ+pZTQkJ+GBA6RD5g8misI9KeeY6TCmS 3HgQzEJsHOYXi8/TxHNip1HCBhahIu0QZp/4kGwIR0EeYFEYyWubdOECSRcmWJet06XV 4ZZ/oxseN2S9wGxxE2QNyrgbIuBM2pRxzoTdG8CHCeueNJ6AjTbStN3pITBsRw5bV88V 4s/aEpxifeMcTUzVIQI2ZHr0Nm73ezNsFnjKqBNE1hPdmrLd3MGT9QkGQsweud0HFod0 6RgpClIk3Le5xdp9AptmY7Pld/okfCXbO0Nzm6FLfWSotnzascnU1T1/KcVF8Ti/Kx9x TBi7TMUSKw79Q3boBRZ78XOxeiw2yOz+kpK75/qi/e+Hd0iBJmTwxxTCw8ZiYKgdLTw7 NnE/4DsHUvwBsbnRcbVvLqEoe9mJUcdh1Jdvep9YeNV8Y0F9syHFvpH6ukKAw1oizFJx L4IgBcxNQrEUlyqVbnMPZVHf+ghyf+G+eIb7vNj3JZ4jwzCl5+iyftjBMdMBjvHFaZ7M KPUwQqTpgVynctqquqVQSZZzlXAWFETocwCrM/IRUWXvRF3vaUtxh0DmD5qdXYfqsyTK MAI5MAPROQS2zojIVg3eT2RTm4Zw1CAY0N6l2nTumt0pXtMISwoZjzNAeuQPU4RhxQH1 vaolqiIwCWcFKd8utaKj69ACAbgWgwlAgFyDJkgKqmJxt9T1W3ENntS/L8mlF9FpdOqC fqNIMsrOHODwNHcqwQcfkNgEgSyGmJmtwYcyEHmQ5dALtm6JOsSfZwmS8PGdEXl+KTOY fTrXzGwf6Fncivt1SE1zX0Mj9cE8y3LQ9oqZbLvOFQ01eJIeiF6bXsVcTcBAPB0uowCc CeZVTIebSR7a5SXK+JZCjFzLtk0oSQQpC6aPZC66hAGj+2fIeaiumvLOkmlLrMC9AcZd 3Ys8aPS+YGbfTGGAqoXqmy3NhfLU2jIkMsyRSA2PsnXQQCk+HUNPTPOZLvH7cL+6yuVd JdM2ZDrpXXiy5YJ9s+WS6pstmb7acuvqrFUSNIikI3frYciznVZJjvx7IfLv3c9snRWx kdMPTzLCNGT6sVRa5dHoEzuNrXRbaXBq+nrBEtJrNevVgHe2zjLFYYBTpw+cEJFxgH1Z RFUjtTl+yAAn7SkhPH2GAcmYZRdjWnVKCt7PoUnwT+FOp2ifS7m0MSvZZZHGqqX5o75Q gbkN9UwfG7qsywekJBX/hagjZXOodBSDXmMwQvOaCI7TmML9NKSFK8y87N9O9IaGHLDy exl/j82U6AfEy777pXlj8y2lb4tNEkRpGL2nAEqCZEqqPAClEMsJpQi6mRZwQimZ9Jvy AJRCZ9NChHXhYxtIvQitnGdgHbRyrw7aEtYVFBJWO6CCBF0gDQqMDMMGa5u5d0Z13eeN wikz+qoWEEeM9TDWNDZFIBSQjHrLBKohhpj2qoFtj149h02IGEChEG+wysTWNdpEEU3t GiWAlC9eEgXIdWLhA4JxEaqNz5Zsqeu1cp607b4IyyCdb3bhCUYgikCiRSdAYCm+8oNH GaiVmBp0wSpUU5fgURYH2DqrwBP98EajJ7oHcIA7mp/rnNtUPykAmQGMaYPFualjCl3l yPxrOsVj0XTd1KhnMdh6thXe120zFqEkdHpQC5dCAbZMqMEgFFuncEQiCa0CO+oSfRGK 0LVBHYkpt692StwWsRrq3fQuYB+crNB4wr45hbdOtVB9syWz6iMPMvIsYZFwEIqtUzjC PlGVKP2/am9Qhy23r7ZL3JbpNAjFcsEiFMslhTpsyfTVlltXNUKx10YgFCxDsGMjF6Ek 324ONuLJ83mLZnF0BktGT2ds0yxb9Mie+wxvXFk0/IKi7AIV0vBZELaAShyEMu96VIYB FcorjeO4EBD1VcQGQZB5/vWAyrOv+WpA5dA3PANU0rMEKjLCR26MF0VGcKUMACjWjUI3 qqUb00UrGFMzAKCQHwHeQC+HY2SmDpjnypHAdfqkNdVhxaesQxGgdAzHAbLoZqpOfVsG PgQYtTm36z5vFEARMQ6+x0JGkNYYXhS3iDcjuERdVTxAEfieG9NV514UHXRCkMzqC6IE H5t0sImpcfSHqbEyD5CCcOygcZuAb/BJqG+pNDrG1jn3mVb9mgbPzCK4SFKKWKIeGLdJ RK4OwD7UgGby5UQZoGRASSsZmNiaBpjgWaaVA0xsncUO9ulOjelDgzCafvVb9Wua+zAv DNWNNgS/DActMjE8tvjClBta1JzDSHVaNFatvYNcdgd7TEiW1BoPyaE5Zn+D/RYN0DWN FGSEASCHhMINEGLsnjq/bS18HcAVret0hszgDexQwkolFwwjHRkjL7V+N/0yazfVYsGw K71qpVCCfYIp4dkGL0h6T1Pb/Jprb4nqk8ESlprmDUSpQgqKZu5Hu5auz8z1oZ4NcAwu S8ibnTM8P0CoU3f0/MAcU5LdmS9qfTdQ3rQ4QNIbBMC9Vc8x0mnrrLw+XwO4alsZXjh0 25oORoigCOAC60OE43wZ8M7i28s2OPJUEIFf00MiXw0iHPqG7RAB3pRz9GXItNloQVqg kRABN3Yggq4ZCxHoBGIYIJQZThEDGyC3ps6BCBEOpuYJnBlUZyBCq52BCE7dmL0Ws8yn 8Pk6EEEVaQHVEIEpNhDBXtUQgYvPQQSiJFMEN2utqXJUB7dqpBtdkkmWNLojQgyer76w 4OgArmvue7ampTuwfeRT5JSLEpDDLE/xIc4GJYQhMucizWXTc1Pj2vsRt3JRAtdZnRzx 050a3Qf1LOOboLN2ql+9Vo12t20clMC8cVcBAgfEQdxptnyYyVapc4WDE7iK2wAh6PHj CjxOVwx0XQAqYFkHEIYwkr+s+e1CBbqmF/9U76hwiQKtmt8GIGAjq6mz1zNkF2aokMGg bUOFDOmP9LvpF5Z1AouSfrtQgcp68ecnmBJ9sZqv4HdTS7/gE3SuU+8YKjA1DVQgSvW7 6RdDBa6dKS651wdDBfK0AWA5eyA8S9CrZn4NmCUNWuQ50JsUvQrHWOCbGrG3k6sRX+5O U8MC7S79XNdrtU9daJ649Bs29RwLJNb4jvtXBw3wPgNknnoDBJ9PUq85IWg48A3/v0BD rjZ91ebH8aABpndO6o4gxEDAEJClGsNQsAs8vB2mDsJrAQMlZYCBT+5tCxjgDsOnvqBp W+26zxvnUyC7hfwEjBhaZRBJJKvrhmiUKZhDt1fXnftRNqhh1g3JQJyih0R1hJOcxdfU NQoE8VemjjUBIrN9cARWHNcIfIETqfWgYrs1e8otwIC9Huxut6IxIni5gySjN4G5yq0A SIc8zE00hohMTQswcCsXMHBdo5j56U6N7kMLMHC/eq0cFc9tXMCgeNKCC8y3Bi4wbxul zjUuYDB1zuLArbbdN8i9QNqL12rs5ju/XcyQpblBARl2rRv3AjJvWkyA3wYzUK1GGK3r iIhhzJDjOxBtzJBTbIPCLvSLMQP9djEDlTUe4CeYEp7NmAGYntuYXzNJdfY6eseYgalp MANRyngFXxd0flMt0Efn+mDMAEeon4cJPDnNfNLS4y6ZA2ZKa94/Py+2zZSe3GO2NpLG z2pkmHvV1OyT+5nRDDvv0BzBoDgcsXVdRwN2tqSPiDI3akJtRhzpaUByYFj7/GWSk3ka zGtOCBoOfMPBoIGUFT4lS8Fr+MQXKWiJmYG4xURkWEBkrtOpDvyoNE1HhMFg+x7ZHSFZ jNbglKTtH/NH7QJho1NHkHwQL378TrzCjvgLnEJ/lYkXS/yJbAkhLK9iW0J27le5eIGs za9C8QLBy3+Iq5+b758dQJa7vTWbV6pj/u5MuOR9DWESdsiiuB0/w34t/tF5+y1UIiTN xMnorxJuOQLQdBk7clmQYkVvRiKMQ3ylpCsExMt9XbYjAbiJoABz3G22pY+nHolnyTpq JFpkDRoJpD3YNQy0LeHTYDvDcLxARBCzJLaf1p5+GJ4n65hhaJM1aBj2CwS5fkI6xuCM BAQi8Y8SiCiEhdckP/0GI/EsWUeNRIusrz0SWJ+TGGEXzkh8BZlAZA1ss2+3SETPknXU SLTIGjQSKsVUVzn9H1AvyHoKZW5kc3RyZWFtCmVuZG9iago2MCAwIG9iago2MzMzCmVu ZG9iago1OCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3Vy Y2VzIDYxIDAgUiAvQ29udGVudHMgNTkgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJd ID4+CmVuZG9iago2MSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29s b3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GNC4wIDI2IDAgUgovRjEu MCA4IDAgUiAvRjIuMCAyMyAwIFIgL0YzLjEgMjUgMCBSID4+ID4+CmVuZG9iago2MyAw IG9iago8PCAvTGVuZ3RoIDY0IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJl YW0KeAHVXW1z3MYN/s5fsXWbRu5YNHf57noykzjyjN0mVSUl/WB7OvQdZbG9I2XyZNn/ vg/2jeRJlo5UjmFlj3jkkUsAC2ABLAB9ZP9kHxmP3Ijx2HfDOBQsiHzXS1iYpm4igoTV OfsXK9nTFw1ni4Z58l+zwHOeyxMeeZ661J4FgZuKNAxZHPpuIAJnsWY/nLHAl4/qw9ma PX3JXY9xdnbODthjdvYfdnQGgO4FyXkISAAu9mLBJEyO53qcAwPgcLa4G8JX5Savy3wj AZW37w3aBDMQ8zhicR/aOyl4uF8KJrGb+GkYbMM0gII/1tn5hqmfk9Nfj9lJvsiLT3nN juvq8xd29HmTl01RlY2+SR5eX62+MOF5yWMHHDKA8CM4108SV3hpi+SsWNcP3cRLEs26 dzLDZOIkYtdLtTT15cfZRcITF3oGz4dx4ibQFwF+b0u3ixt4GKUQ1lSEQeoJaB7zCYoo TF1BsgI1xtOIBbEbR1BgGDBNfHyB8c73rFR44vqkOwcrFXD4BPqEKOQLcE48GtBl3izq 4nJT1RPAy73ITfHrAfB+xxZVXefNZVUui/ID21RscwFGyIpVvgRLNHn9KdsU1QRKRaSx GwkeW2y0UhmgOcsnrCgVCn3yO/culjfE6f712w8BWoQ10rDLaC14i3j3Fu8XpyTKXpjA 0sAnX6QB50nn0+mLG3bGYWtoSMMlhuEiTQzhx8znIVsz4Yf4hEXUg65YsVMp/e1jZK/c OgrJL551Q8fnAT3N1WBuyESUjB3OEVHaDhZjqEidDoQsSCPARfgFaTIavwDcSNRR+Dk0 GF0Yix+BYvCTg0Xb+I3hUMdjO1qYXuoGcRQrzQvG+ao5d2M5Yuw421wc1bXL2NlF0TD8 zz9eZSujK56fr6pr1iq+7yCDUomc5M0nPDeB6vChuSNPQHFrPEdL4les+540DrXuPc+N sXyPWvVqZfot2fsvmqZdUxBT8rKq2elFVufLCegsosAVAWk8jdMudN6zwS2lCuJuQLrB 4s59HsvR58tVsSg27O3B6dHbx6zZfFnl/fVjL3ZRh2t7HDILizVKhesF/jhbrbUbyubJ LXzLfvrl9AxqAtbFhmXseZOXS7g3HR0yATP7kPXUizgzqO7CzFM5DBF8Wx/iNkpp3GrS aRpv6uLDh7wuygkoTDZCFMA+NdhoCt+x/LAtbwgW6W3mqDb0JsDBh8cVxX66jcM8hDQO EDjSnm5nVb9X5cGfIrr+H6zslvwK1VnJaBS6MedjVaRcyL++sL86Z+ur1aa4XOVs28Rq yG27Wk2x5NtQT6SxndUMhHCA02CcliyrDXufs2y5LjYbOLsZLUXrYnlZwYdkZbXMaenC VfrIrone7ENe5nW2ye3UTKGBTLAt0tjOagYC+HtpOM64lQ7CBIaWjRNHo6Gta7bOmyb7 kDfwe66zeokjNKi2z2uWNewSJsxpvkC0pGS+yxGiq86n4A8ThjDYzYo//BQhPxP5HLKP gCXqzcnLF0J44Tv4OUfZ4gKBcOlRamFcVOUmg68JA/KGC0qCOwntteMZaTznRXvPjSJE jMaEW9fZZnEBZs9Yc5kvivNiwZQFKcMA+faehDTorXbMJiE9guAIYEW+wnJWlBccwXVN +IF2mbbJ2Dkc+7zL9CYUgFWpo4D6tn6TT0J5w/QKTU35AVY9eXvuBIrfh+YPAg4HpDch Pdv9RsBLwrXbnuVW0BjhOPq3W0guosArxVKkdPb3hOAFOWN3fbdgYp6EakeYvMD1fe8m 497Y9d2mGq13AqrhRbW+rJpCroHVOTs6OfnHyb9Pj49eTDDbwhMugsZw6HtoOL3p3nYw p3LowxS+MPcjrYznAVMSwYEJka9AiQcDF+czWD9bG9NyEVhIDsilddROPwWLYWyrkA+M bdqmmUJVmRhPqFGd0yoRxjG8l2Tc+txx38n2PK9WiMI3z0jMIPAIeY7SYFJ/3aPBOLZ4 khT7dAb+WdEUe0gC2TazErMIW3bJyFAqh1JFKICme0vatD1AJpq1i4vNBcvKL3A86Ikm Z3ldYyt6iowQvdKGGtlZMUXIYQgbe2ygnqPkmgUiAM0z9ugFRQJ4m4rg7E/IAkorQ+g0 1LDvQs8977RwpJ1gCzqwMI1YN75HtKWh3CVYCuWmrlbsZWZNg/2RE/kwFKqDzuqTc4DN Wqyu6vwRg1Wu2EBoNqBY697YwA88N/ShzrbgvtN82DMb+EHoCkTdLEwj2OC4wo7bFzvx OxJwxC6sDd8bAs5qYQiEmyJdYQQBSSuRtW1kSHMnlL7Ze+/uE0OBXRYUucIqIlcEqdGm WBas/aVR3UWNTWaS+0juCPk485fIn5VL9ilbXSFfqq7W2xZvPwuizUzqOkVTLMw6VTPU 2M5qBkQIf3Nk/J5mQNk5Zh/LhGh1iEpxuoze67kwsRXpqLyfJFZiBUCjOivyU2IY5U+P 8f+I/E2+UVlAfU2+l2w7jhCO4Fh1NNCakANWcNrrWSI1oTFs0zeoJdcguemyrhb5Eou9 zFKYVEn2UbtzkZ9MSXpwUpFVPppHslUjXX/locL1p8BmxlbVAilkSkRhDd7i30wVwofH yOGesVBjOicJDVBdguTMcSECklC1bVnVSO7N6gIVAovsCm5hZ6MTgZk2bt/3JKtyEhVp grQG2XlNgId4QjheReoVKntffcqVHykD31PFaFAGIOGfFU0T7obRvAo0EIhHmo+JfA8M EVDg++sxmglWEBv5NmgMXxxRX3RrJGladwH5pX7shShOUdMxK7ZFwV8a2gj+AMODFDF+ KixyNVa6TC130K4NWxUN5Z7APuVM6gj4CRvoCdpFkRNS5tcTMJD16amqkZCcFeFDBBz8 aLwJ0tmGuKYIacvT7NHzsx9+nIDAArvUSYxUvUAjswuB9xzIsemZBqbhNt5pnrNX3//8 PUUimgK7ulQrVDbWHdhfRK/l2AEEncpoDoIIfu3InR1SFY1KI/ruGfulRJwftkOdvUci YN9jYUcU3X90m7s7AUvbzECD7S4sPdkM+LKYbLzdRg6JDRdYfkagEs7tmFKd+/ICOCK9 MDQ5EgEU5JqaA5YZyqnHHqt1yu/zd6fgEeNcbWE1C9cWmdNwbVG6Pzb8Icuh+uECtrO7 Oyn1NaazklBBlYbjctdJRW6pQpmpO8jbnWICTOpuoJCdFf054mnJAzYfbtl27hhW+edF fonooLJ2Ycx2TN0pKE8l8sgORJ2sxHIXynOp5nfbyxuzFWWKFA1MWu/MQxcidyok+3Ss LtTOC2J7xa3ZCibGRE6mWVc7kcApWMKUkgQa1114Yip7xU9914aZBmaMkjZUknd9USBL uhPtUwqRKh1U3E/PAu2/IzBlJdidkvwa1VlRP0ErnvABGyGvStZUawT4MvLa4cGvsy9k i12iLjdHP5x1UcLLl2tU17C8LlYrlJdMkqluuB9uicR1VvSPI9QVP2CToZaZ0kRam6RO hdH552yN+qkn4PQJOBwYuEAiYOimItHRJB5gwsvNSjh8aPdD3TisgDKKW0yAgk2X2EJh FmuUH6EDg9kLGaEjVd6O/4z9XMklSO5EUercoyfsvyWyJ0Hvy7qo6uKGpE5BemMeaDRn JZ8himDFA3ZBdO0UacbWEFhkpa7BgyFAJVVQkbrNQZNBmaq6O1rSpiC/1Y8a11nRH9mA advSaoBCIdsAP7JalFYatbuNLXDSlcT7CB79nCO8hPMVtsZVtb71aSEStHE1Kf01rvOi P0fPLFOq0ZJ/lzprIr/ON4HC6UaSEEe6N5I0ws/gyDRJE+Q6+sFIqCmVPF+CM2gNJUbp +HUqYE5NCCnLfH/xXUENEDi25TUWu7DDvuPl8Oa9BPUlowlrwuUTcAGaR7gCRNwCtreQ bxfxDHF2tsqMBpU++b5ANyLTB66zkt9bZkTChJ/+bsOwaLnUcFMoNBP7MdjuwsFDZmCE arAdR31BXUwfsKWGlOT3xcZmUsmNCParyoUsclTKZ3X+bAIq28Rug9GsqIzuYYnegugX +P1ukoeOgdx29enD9HsVHVLfPxGYMPxMYILwhiYadgMk1ZHXGd6Rd0tp2morZ4cmwSJG RYjtNvIVmBh3hnYJ/hpM7COyYO5pXCxitCXklk6tYXSvIv97jsKPK1SYX9VPGLJIsxXM DfpBM64COZrsdVZeZTU62j6hprap+tL+fnOMTgyM++8mUDF2n9NgO1rF3NHm8Q3yPzh7 B45YqhbSv3HLR2y0YEPatlcUMaIUaJo2rLWiI0RMPRHR+VH1fERPxPZUjWX7X5t2tFje TRPa9lOzcMIERgBamqB7Jvo8QimhYePNaytcQ9URujy391EtJ6SB+m4iXchDx9vOFZQA ex76HOI5e5e+tsMVp/NchBdT7TiBoIeKALPvoZWjBSpK0H2AEjQt6OYKhgrQ1ztJIR7m GsYKUIAUJxH1xNJPBtS/g9Cxo3euSBDkUPYmBdX2PRh46w56v74Uc02CldO5pojXQmQn wsJtr3RwMdcwksbOXMFI21cW7AJNhQW7Zm8Ub28rulv7i5KA+RykR+UTsawAa/TPVzhH S+VQNvjU96CTKbgRzg/i+wLf0xn20ul5ELB3fueZvpcyJ3VjVPls6CFrMU0EeovqN6N0 RN0hYbNnCyZDmfZ8hV6paURQIXddPyH8BLVocsQ4deSZfR+ep2/t+V1n+l6LJ70Lz1oq 2DdbSkrY7JmG1Z73vnV6ZxCpC9ki9u5OtGg00LIY9Sem8o51l+0MK3bu03K8Cyt2xeoO xruNFa2ImuecnbRLK/5WjDpaItY4YqybeK90R22CJhTYa42Q+sqp6QMXqFOmjt6oyvEF pqm7DDvoMErLATetJLwUCgI/ymBAwyV9aselvqf4UwImQgEtTY0o1EHZmujmiPHIODjd 5JdUJva3vFRN+uWOJwmmHVf2sWhPb7xGr4DtawIqDQ043in796EbhH7ZH9o91d/0DS06 IOVTHj7F5kHwLIjY8U/tGym6Qvo2IcoQ6dHpEUaDcGMquhOBy0MRx2P8KDWfaD6D/Hy/ /TMJUDlEOn2QpECJmSLFG3aAJhiH3GMHiAIdpuxgTad+e0TP0cOEHZT0rXOAuTkM2QEq +g9xDxzDd+zsdVsoeT9emqMcuyJL2O5uBJJCP6X+FloGH4WWYqfQzDDQCgFizA6e4hDZ wxOcobTu4E84Ao1vcAAaEQ4BO/ijOsSPHUJYP6hv+TO+w2h/wQHf6YtvH6urXu+gv/Tp Vse8qT+aeRB7+/TiW9+RqEE1bE8BFNDAnSMJ3v0TIAiL3E3wlpE4wl3GIe9TXMkUKK48 DlAcJQREnLcHOIK4mmTf4gyQx+pLTQfExOgWPQ0pzjAN3wBHHIi3aI4e4dhOoBm1T8i/ qnskrfFmPR9ydMfMYH+uzT1mPE17fZP51vCJfJtjJsh8q6G/HUA9oJ5a84h6nXNgBn74 RO4U27ITSXFL27j1xkSirU9XdAzQffbUXK4nwCCiZ9mQ81vFp/qqJpQWLDNsX4jMQPom zfaSts6BHkDTVDNYnwX02XPFCQKHVng17x0CKHCbvlPjEYwUJWfQX9MJMQMRhz41zWZV Kkt/BraUF7Gb/XM6/wMjauAoCmVuZHN0cmVhbQplbmRvYmoKNjQgMCBvYmoKNDE5Nwpl bmRvYmoKNjIgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA0NCAwIFIgL1Jlc291 cmNlcyA2NSAwIFIgL0NvbnRlbnRzIDYzIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzky XSA+PgplbmRvYmoKNjUgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0Nv bG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjQuMCAyNiAwIFIKL0Yx LjAgOCAwIFIgL0YyLjAgMjMgMCBSIC9GNS4xIDU3IDAgUiAvRjMuMSAyNSAwIFIgPj4g Pj4KZW5kb2JqCjY3IDAgb2JqCjw8IC9MZW5ndGggNjggMCBSIC9GaWx0ZXIgL0ZsYXRl RGVjb2RlID4+CnN0cmVhbQp4Ac1dW2/cNhZ+16/gvjmLWhFJXQPsQ5smQLpt47XdLRZJ UCgzsj3FeMaVZnLZX7/foUhKI81FkmOtHMCRqBsPeS7fuZD+i/2L/cV46IaMR9INokAw P5SuF7MgSdxY+DHLM/Y7W7HnLwvOZgXz1L9ihuc8l8c89LyyqTrzfTcRSRCwKJCuL3xn ds9+uGa+VI/q/67v2fPX3PUYZ9c37Iw9Y9d/slfX6NDJLjmP6RI6F3mRYKpPjud6nIMC 0HA9O97DN6tNlq+yjeqouv3JehtjBiIehSza7e3RETx/2hGMIzeWSeA3+9RjBH/M05tN OdFPO34cHO37oXhEX5n6ubz69wW7zGbZ4lOWs4t8/eUre/Vlk62KxXpVlPeUv3/aLr8y 4XnxMwd83IO8AfIl49gVXlJNxaQETAZu7MWxFrCjLDua0IvI9RIt87tS7jxCDzWmzuml GnnsSlK3pW48IkWtHpYM93fG7vBT/lrih9GvEZQTh3biScBZtEOCM42Z9hLXj8JoUtzn eW4Ec9rf5GgF8/kug8Xb3GXs42JTsDTPXtA8g99gs7oZoQardrHiPIzdOOERi3T/p6Rl wkS4ni+NGZ8E74UQDClCf/A874j0P5hCJfTrBc39SjHAcv2ZrfM5jFFcMsP7Myv775+N YXui2A0jmTBD7aS4IvKBN7XpATw12M45he0qS/7Lb1fX7GPGimzDPn5t2v7NupoVlq7m zNy+GGPog8QNPZAXlmTqka/IPAlhb1frPJu3bYTzrT0Ai1B2uzoNMQ0DN+LcqI4ew1dx CTiD1HGRrSCKbjmgxGRPp4wx9zIAog117ycldkHoJolvFN80ZtmPAfmC4Ub3gDLm01TG mtpJcYUEy0YGdffxtCs5M+pVa2OSuYY3Bo1MrZ/S5TZj6xt1kuX5Oh9DISNkknghZ6Em dVrD77lhKIxQDlJzs/U8A3JU7u+cLUoIcpkVn17lOXt1efn28o+ri1cv2fuzdf4dXZ+l hQKqYwy+tYayJHRSgy+4GxkkOAyIKD5vm+rjwboBkTEbKwmH9rkKjdxmqyxPN9lcieFF urkjRvm82Nyttxt2l35arG4rfkrH4BITKtHUTYpJOMJ8/pBQZKUgtTB+x7QeVKqPKbkt VeLmLt2wz+vtck7jDw8ygyexWM2W2zmQ4IixqlBTO6kZ8HxXSu9ROlJDwYZZ0rqypiPR UizuF8s0x/Ss5osNRRBHmQDE4H0eslATO6UJCJLABWOEg11mSMLihi3A4mlBMmA0EEsB FJSdev/MZez6blEwyMYI4y2SyIWyiZBAKWnT493DAK9zjWd++f4/EFhrBJwncy9kmLhc xrLZ6UlA+SAO4bAh4Ng7ZVPpyW0Bo7TjtRG33GxzgMcc+hCpnYccLj9hyTxLi/VKg8kR OEaG0EKRFzBD6KQkNIrg28WPUpF5VmT5p5Q0HrtJF8ttnrkjjCtHyioJES8JNA2TGldI nED2VDP1NAQt9FwogeGRkYbPnK6+srUSMIVFXkCyiBGy+RizL+CcRTHNvqZqUrMfcDhn xkGYRuok8IWb+InhyB72CmpWwsi+Kb3vBhLSp0hbGIusHAKlad+sLpbpLGM3y/R2BIUg jb9uSJ0US0jf9QI+3MpRjMTCTosZEJJ0OpRUQDT7Vnlw34MGg1kOdM/1aPZgHBNAQOxg U4bS02WxVrF3MsR19tCkjcIlOsPRoGsaKloE8FhsqLXHWGssVPNIdLRMu+mj6GRPuCJE wCzQZExKACkJQkU3JcycxnR7gDAoKukPfZGjd0kp/4aAHCaaJvmPqw1iM39cZvdr2GD2 ehylK0TocgK3mpQpTbmPGjfPszHSSUy5nyi1atiwn4S/u3z9UvqR/MDm2c1ilcHqwpF5 IOSdLuFKUggO3qUqKIA3lLIVRXhv1vnnNJ9TcG6UmJwxw4bUSbFEzN0gtOVL/YbfRDzv s6JIbzOEw1cwrCRuNiDKlBCytCjWs4UKlVJ4dAyzhjB5kkD3+prC/ubaEoGo7ggAwyaR Gz2ehphGAnUQA0OHhj+ogmCBWOAMjMAAfCCSZWiWRJEQ0B61TVgZd43BMabUAzFqReuk 5BRVykkwMHJIQ1sHQh//zGYbkz1sCLGJHpIsoy5EBZJGGn6dXaSCbCJ1UsMfBK6Q4QBg AhxarO/B7ovNVoWEVNw2+/KQISZOwbclwm8KsyBasN7mM2XE5uzRDA8gFcSoaEc6TorE 5zxGTlofsaP17JJzFLQHzN8hupbWQ+HNcR/+frFC7P+/VSi3WSkSuygQRK48gMzFqJv3 3biVy2sTUJFCBFA3Ywop+arsHqhRxojqUuUhCA2lEJ6gl96crrAf4A7KALYyRDbLjNJg du0yFmYRAihERVSsSPYCgHfPDXw/QsSSUfVi7HsR0dKB5NZwm090WOeAWnN4ZQODpMXi FuCMNP5ynSI0RusgdGXnU3nugAKRn4Chdb8HTxWQ3L41I48aS6nyJwb/TsPYixjCh7Uw QzIQKvdU1Kf1ida42BUaKIEc2F2YQQrSzxfFbFsUpHmLB7QVxjbC+pnDNjR5tIY+LXHS QhJN4qQ4V9ASqGHVpwrVqVx9CnVFg764WcxMVn/PMhSKt67g3ekI+xhjb9JUfknnpIYe pk/EA2PXmsdRQ3EEca8fVGULSQTDIbOe9hhxM9jwsvIXqEXROamxR1AviEzV9XEcNNaC H5lINw60DakBtS6F4D98peBJul1uSo7YI3xlrPrXt9faXSP3fgwJRIWWHyKWpsnrwgUl 5OxWODDAbGO9gysECgd2R3zHarcWMClb2K1LDSDaa4kVABn8JhPQrXFBq06+1UN2xPNW aqLuPZZpr6bbOAY/mKoNQ2kXhhhNBCNwhj8kdA0PsazXWRWoFIC6xZqFxWyTflwCfCg1 TKVTED2WYtVbtvq0yNer+2wFmGKjJ6OOvqZ0UqMfRm5gAts11u+iAFGtCZhXLjpTrrrS gDlKOLO8YPM1gsYbtqWVD8WGIlgwm2MMN8yMjLHoVZakTWq0A6QMhbE3PUvd20Ba5cOV I/jUS/zgv4WoU2NSEzCpQfUTeDEGT08EV/gca191gUxPsboGutyLJVDkV7mHT1fjx1GY 6FMllyyJ0HPdI8OxfXhY5xtKKb29uH7z9tfvf2b3lD96tPS3I1t9Q3OaptJBP77C+/3Z PvyxJ+jUwB6Ybh1BrHVuJ4JoA3BSrQdBIM6NBEfQEY/q+NvTBaMkpa8TEZnp1UNRTe9J 1Y+CSAS4U4QAUKu3b5ngN197YDM8PaZvL37pMnvMgzalMKkOGdIkcVq1Vg8ZRjyMkjFC hlIKLFQ36/97mgzkiVBDfrO43WK1BcBQPbg0KGZoOJsYtYyNV0fO0dg44stugL1j2C5B uyLIzCYLTrnZC1Yq79ntpcsktjtaE0Z0VHUHgTpU9ZNlQzSaRDD0sPXM04ugrYjaHYte k2tS8xSL2Gct9NINJE3GQV2UiZAACJpdBwOEPZN70N2sJBSlEAjq1AV0tJi+FBTbHpjh OoDpyGehiT3pPdLa8kdb1Q7hVOxYoNaGGGIHT+8TJAIkB+sNC+GUNRdwB+ESLtczlL7Q hDC4K5sMgVOrLoeCrVNa6HDKSKAKyoPlQbJuL3UnM4m/YycI2/9mFrHrLLT7X6n746lQ U81Vdn8wu3TRBqc6qYZS4Vm1ssxnENiIYsBW05OC6ZD5a+G804IjYF5iinnujEOFtVoR JmsB9XZnFLkwHjUSLqQUHohFUao3SgmWieXv9H8natfscVfcdVqrcwG5Vnn4KlU7Hu7y UI5YbRzTY8oQlnq04J3mLET6haSMthzc0fpym0L7bMRgB4wSFV8XVNeCunxwJeqRspFW hhrjoykdrE26qr3To293LqRVfMK3Gd/+kvEUfcJa5sDkWXYBdiuAvQ9fH+hSQ/31CrGL CJtE2r1UdvsEBeIM3eGx0Sfluinn7bBlraYugqPO7TgdkfDmqP2csdfpdnaXbbGbAVZT pEuABfp59eVhQZHon9LVNs2xz993tNVfUl60v99dUM0n9z+Mgtz0FoBCUztYeI6Y4ncw Vpx9gNjMy+0/X17BuLbKqGrY4epla1vQ82pfULXLUAQ2VDuCCnj/2HU0jtg9EyLycYwF UUt2pcqTqqdoV729L6EIBx4MHHrQDfAaHgrayFSdlS+yu5Ye7bYqnsJi/FA4VL0kBZJG 97DtqkkVNKmmpSqxSiLYLj/AYqkQ3gG1AQvQQjP7KLU13rZkd4Ai78qxbDLxQeo4irZA GI+wXCxwiL7aOT5N9KrrmmKcw1fS96vru/ffqcHl8MI5wbwgRgwiRNiaqIkVza2mJe7C 4GI3UnsXLVOF4FOlF6KhYRw6VQtithhFrBZVi1nLu0xb+65Wi1N/DoVAHjlg1AXzRSw1 SiIvrHVKSiwpwZrFque6Be+iQrg4oakxdy1Vp6M4BNGmzafKNUWPeXutpeyDepe9S/er dRfe3byH+mDa9Dg41AfTpkew1is9FVXXdUOdmsY9YNpy/vY8RGwn2OduYgmJchDEVDJE 8lQdE0tjE80AdXWQL8QDuIxwRBuRecKckbdWHeNN6h60VkfmeozIlxITvCVGfSu9uPpC TPEk1Q86mjkqj4jlvBLPCJlgc1d8VJ1DidTeoM8oqob71BUc7x45nL5troMT1DvpXkNN 9QWitPw2HeEZymcq+umI9M7u9VK+jqtIyF01/T5cFngs95hBwxFGWgZyCd5keP4QU7Tu 2KMJKrG3zFUJoWHaqsV0ui6+pq111yl1UY5JnX49TEvtzREBAQWGSISx1yzjAqiZymex I2kgJE+aTggpPKXySPV6CaQdPwoO1k6r16IskmMRSBlCd6JA3an/U6FMbD6J99G+1Veb 7IE2Z/wn8s8V6Or1GW26q8/4CLoFPsdX1cewlEt/7G9P9IWKHAzlcx48x5j6LwKPXfxS fbHalvv/CxmQZ/UMZBC0AmAIZKAHS8jg+QnTZz0hg/CAwaI4hqILUGcNqwc8otugvnQb NBZiPhxmiBScG8HTJY0Dn8fDcpzd+5rvG4gaPGAYKCZIQoka6uf4NgfJ6roaAnWOG/X9 6nrteZwfQg1EDlbQCZBtja9tqxSIIlvdZzQBBgwFyAnH2nxj2CXGLVQVW3va2neZFmff c9AMboR+m5sYMhowMJI+p6GMwPaxcQy4aTtuWuqowbThXQR1FGqwbVZj27fXWqgDWBJg lHrZo+OnNbNgiap0YDVktid2qK0+ty01rGDbzF14k54201JN0Eyh1M5wgRSXMtOQn9jA BXVcgwvqXAEAEfjIQBu4IALanBHPAyTQMfqlj6o2ex3FFZiE8o6Q2LYOF7DlLskR5Eod abigjmtwQZ0rKAC4WL5Bn+HdGg4I+k7VSkeOajPXqc/0TsAFS42FC4pSBRHUkYYLttWx R3gW40WDTb5Od7ggPbhOKD+AJ2B5aQ+vYCy0eHXglTq/H+GMfbxiZcc8B2RrJcy0VVJo e2Xl0va9BhtMWwUSTEvtTXuVRTk2SlY1lrLj1QIOAvWhPrrYRg7NyEM/5CA97C0btww6 ubDfDjcc+Mg3Qw3d3t8ZMxATxgkwtw/3SlIAC7aS1p+EWKIjYYe9qAnXumykX2JArGGB MMMJNWANOoSe1v+pQce+GiV+esfOfnzGzrHHxhnKYs9jdob98s99ewYAdx7YMyTgzhN2 hq3Wz6X6+yQf2PVPVcalA1l1XnI6/ukUWChUcpDHWieLUKsX017gnkd1HHuorP6USrnY rNi32Mx2mgQggcf/TacCf/MFZt1UR+30sQy1DZ4JtjMTzoGZOEhUfSJ2/4YNcvMH/oaN mYhdomrzQDmePTRW84BUHRJQCkDr9Vy08Od/UVCaFwplbmRzdHJlYW0KZW5kb2JqCjY4 IDAgb2JqCjQ0MDAKZW5kb2JqCjY2IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQg NDQgMCBSIC9SZXNvdXJjZXMgNjkgMCBSIC9Db250ZW50cyA2NyAwIFIgL01lZGlhQm94 ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjY5IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BE RiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4gL0ZvbnQgPDwgL0Y0 LjAgMjYgMCBSCi9GMS4wIDggMCBSIC9GMi4wIDIzIDAgUiAvRjMuMSAyNSAwIFIgPj4g Pj4KZW5kb2JqCjcxIDAgb2JqCjw8IC9MZW5ndGggNzIgMCBSIC9GaWx0ZXIgL0ZsYXRl RGVjb2RlID4+CnN0cmVhbQp4AdVdW5fjtpF+56/A+mnmHFvm/eK3xHHOJrubtT2z6weP T46sZk8rVkttSe3x7K/frwBUASRFNcluceRxTpoogSAuVYUPVQXgV/Wd+lVF+SJXUZEs siKLVZoni7BUWVUtyjgt1b5WP6it+vLrQ6RWBxXq/w4rvBcuojLKw9CQXCpNF1VcZZkq smSRxmmwuld/fqvSRL9q/7y9V1/+NVqEKlJvb9Ur9Vq9/Zf65i0q9GSVgudUCZUrwiJW uk5BuAijCC1AG96uztfwb9tjvd/WR11Rnf1itS0xAkVU5Kpo1vZsD35x2R4si0WZVFna rtOIHvzLfnl7VObf92/+91v1fb2q17/Ve/Xtfvf7R/XN78d6e1jvtgebSf/5++Pmo4rD sHwdgENGdPwEzk3KchGHlWvkVbFuki3KsCwt655lhtnEKS4WYWWlqSk/wTMkvDV0wSil E5WLhBSZ0Tpn+LNTQ4XvHh43R7Xeqvr3h/pmfaxviLZ73K9qPMwg+3GIHk2SShWNdozR VJt6eajVcktVv3lcoQmH9fvtcrPevl8o9e+7DzVk7vNZxcm25arEKawWaZEX42cCqKX1 rTre1ZiHuhwRjJtOF1WYlZhoMZsmcZVGUemegrPTbBTGiyiNwSmNluD13jmtzfHL8SwN niI8EAgeONcAdb4B6Kk0zWNpwGT2KBeAK1BDWVEuSsCOdFF2QMJT9dTdmSSYdCGBeQ4I FFWLMC+qigYkT+I4jKnQ26cBiu2jMZgpiqNFHGHisWNpu+LMWKqWft1tT3HjeXDX6aSn wV2Uhou4zCKp6Xj52e3V/W48502pLEBtnlVAog0RGaNMlUYq+90j0J/abUns1cPyeKd2 WgVgqA/1/rflEbBlDo0KBs8Lmh2afDIeDAwRGeaGpFyEMYAHSUZaQM7CRZbioSpVuSgi yEhBLD9AMiaMoVtNhOGigJyPZzgo7OPd8qhudl11/eICUsWLPCwSEpDJ9d3ujurw+PCw 2x81w30Lhvvnm+PyWP/z+/p+9xum9NvN8r169+oDwZJbsOZxhzdWd3PwYF4toqRMpIEX VdttHswrsFyu58tPwIM5RjdMkwnLR/CgUSLPZsGnJrL+hbms4bgZQ0buoCvcWusO0R5P 1RO1KcoiqlReYUqJsSbH0jyGQQF2gstPuCKmrb4YMeOq5eEE/ntxhRJFEXR+maKfpjLf Z7vNjT+RNXkweNLi0gE058b2CdSKYa/yuGy1prl2FGwTGOvQUB4cUE/M/YyzAU4jLPjD JKS+9XkQiNzx4OWmtggDWiRh3uqLMfDks3evP9dTxCOWfBaStGaLOaYEQtxJJu0Yj14x pTWZ8mmUPQFLJDx1tUTpReCTZr7ghKWU4RPxWJhm+aeBTzmsikmcp5Pgk0YbH9abjVqu jo/LDUxyzlRy2MCksCcC20mcBWK9Xe3JHHEzBxcC7VdhHilu6pDpbS5LWV6ksIVb4x04 gNfowVN2ZwAH33zz9m59UPjfz/VqSTJP65GWwAs81AP2cz1H12cVUC9pddPMq+r5PMMi JZqG2R72u4flewDvG/X4cDiCl+/Vzx9hXFOtKRVYHGa1LVmG1rTSqA8KKH6Wrre61zbz qro+yxdVlU7TOY/bm3p/OJIdEz1Kf7hX1bFe7kE8aM5XyHOcg8ljLL6zjKZr26zx09y7 17DAvr17PJhJ+1BTG2nig4kbiqCFsl/OJZeIamxWffzE11OnCZOxLOzzFCCsyqYt7LWO 0+tl9KVaGo54S/xBHEPasS2o+o05BBMmvTQPgYps+8azy77WM2kXGY00MvMiun9pmDCC a9Z1PH8MWRlydQQYpTkYACucT2JXypMKDiN2Yo0B3+QIaCihxnIQy6pZF1YJzE0pbJ3N 9nhQo+PibrsDdlvgui6z2RXtiZHVkNcGBwQUHHBuXUjOgAiVLAmE5kmxyGBUV3ECK0BF mNja2FFmMMCS6H96YFxCBB7Hyo4+bkZ8vEAe72DEeX+Hj98C7t6p4/peOwUvrL7jtFpU Kcy+rZqfFc8LBwTE6E3AqkLqNH5hAaM6psM/KURVfNjtf1HLm/v1dg2UtTzu9nNoaKy/ q6LAgqHJEGe79eSC4YRs9M6IovUgAgkCaD6V1gvh5YIddXQgDLTetq5vDmRy/qWuH2iS xUJkhbiNNdCMdoVgibJVGMwb9eEOoPimXq1v4H6mFHKTtXqO4WVnSQ6tQ229KmgMdFDw atxT0kPWg1iDr+FyMos/LAJ7VfbLgbUIwScZYsRUPrnep61Tsli1vrVGYNAcTAKzSJpC Cm3DropHIgSCpVOC1SCjOqYK6vVvW6BiCOdxv9tssIytt7+t97vtfb09kjjCbwdzjvVN HBQiAtQv290HODrnEVE22dimXlX3h+kiIePwFBU5wH33uUaPZMRZwZ7wc60Oy9saCIzF exabmbC/bew1DQA894s8QkjGlAE4pU98odjpiciTBrsm385hSkigTgugDoTZmibabnd2 wQ5YF5+IjZjVkGkGzZ+waY+rakdjPEh6udlITAdZmQOEIhplCoc04KbDNMvDoT4cHFSB CWF9Dzvgb7XWmcvV3RqWPiCb9XEWdzujGG7rVUloAW8erdyn9P9hd0/RCxI/c1BYEHyo 1+/vgC3R6zf1+/3yRuNJHY65X9dbimaE/VUL7xzoIMcUUMCGk9mGXlXnw5sV0wJiSuf7 /b5oqpEJ/mC26PQbmDjALbOVvq6OhPWhlKiO69BsGbz+OS8QxlilkgXsjgB+/2M8wuQc +ma/J6n5vn7/uIFllOPuDzNIkJguMtugqxr4FAaAFNYnI0HXMfBJugizaNqU9o+dXhUi 1u3D3XpDC0S4Cm92q0c9dR0esA6/XcM1pcPh5hh9zPlFCb9gZltlR38EzgE0bqwJDYYj jXVho1siE2+z7tfBJXGGtclEz9r7ekt2GvCB8ZeQehDvJgw3K9o/gOW6N0eo2+V687iv yW+1nkNvSKhGZlt6VXqDYvxpg9aUmVfEUbsz//HfbxU5mXfoci2VhHwOSyAjLAhvKKgb intvFffebpg6LGaQXdkMldnWXtUIIBS5wqawSSMAk4hZ/cHqfKOXfb6W7A7LDvHqN+vb jxggGpa75W/reezTvB0ts629phFIsUE0DCcakLVyMWCEeNrHn5PcZgPwJ7vHuN7jZyLa qgiVeVCrx/0e5jOYanhGRYjCVv34/V+/xi6R7Cft45/FjGC9tq02XcUMlVJEZYlotyk6 0ngRlkAwt9gtolEMIsk2jzcauxB1g6AzeBS+mkERxrCAYLdDprhJVyWGZQRH6nXtCoXJ GhHLEw2nO9Xvgh5qQXrKDd2/TKUvJHAFKG7DkLH+QeuvVvDOEJfgU/VEbfIYKjYt4DbH dgcTIZ/57nJyM17GXQ74m4QJ9tu0umIEdiffH82ZjFsocFGD+dXyYfnzRqNJWL+NOpVc M4i02F9bbTurOS/sUE+wsy5LYM7hOo3XnDd7zFFbfzZFCMqTQSi9nup+MRF03qrr2f4b 6jkHI6gfzgVSkzjkBVaVnyReiA7IqKAkxg8PvHL4ByxZb2h5JXiBxOL2kYKqlw8Pm/WK RKMR4CvyA0fRHNIBvaMDqbmpQ5TgydEdqrCfxm9i8k+zbBEn+TTkj+4/fNyuEMWDOJOa dJEIS9DS3z1V18w57jyUKM1g0QG7ctXHQ89v8Vmxk5uAVx3faPmFdp9a6rtXByAluCxm iT3mBUqrZePVQE9vT1BNjlEQVZgkE30TYJSH5f64Xq0ftKEE8P5nrBlt/C5W6DpyF539 7rX1HFEMKpbsyw/kQjexDrOKqm3tVYkqIpyApSZrSg0VOoyvV1cUQY29r+Q439fHJYbH rM239S2FZO5u5+h79oymtp1X1fdxCR2O85umLL/A/TzliH60wenBy58XJRscsT9G13lI P14YjEV8NgXXaXw/GjCmdg8SEweb/OoObAsFgeNlMNGvtQ2BIkqhOz7OwrJA74BOips1 pKtnm9ljOkNs0hapNpc+darZhHkFppY0J79MOr2aymE+aLHvHndHCoq83e/uMV9/pT6j YC2YJM12/vr2Fhxi7EzL1Wp3D+A4z0YXsfzapl4Vk2A3dEwB4xP1Gvyf72v1HmHcD5hC bj5ul/frlUmr+/r+Z5j47tYPn2t0hWDVer8jb8nu8eA04oznkOE8IN3aqxoBnDuU0epr 4gjs618f13sdTIMR0HP8/fIXGPZ4yqGnwwOFE9M6iAyA9Ep90MKynENLyvrHNvWauj+p EtiCLP+PDBym5Y/xAa/Ud7s3n0EJ/fnxqPTGRWNoNWcIXdizGtMuEOIg2xbbvSMMSwdE ZG0abgNj6Bi5L+qc/e38MQZiE+4bjk78XnuzzaH/JMkTpkOIgBzDOWinDVUQxrsYfUyn Rijsz43Topxlo02MGJ8wyqYPL3Y8b99v6n+aVdaXMrtfbo0uxrcmS45fyJ4Yu16wwTtB kopO+IBJw7dnlQirC+c4VwlLZNizJjqzSaOYsWLtTcqbT8TSvtVPY+DFxFnFYEHbuCEa /MJLCph2Fzh3opA6jZ9A7ZJCWxBFKGTX8Ejl97TNTXYNj+nFuVYLSZEv4nRiBIBe4NLZ mAd3uILa7JbYQYw9S1ixzYAyYBiB5w5uRW7JFfBojN09SYL1IddpPI/e7R4MqENUC/qX tAOFsPAWbSRn6FtEc5pdPdyOIX07G+fm2PvKgRPjEdxy+1HV+z2doojuXWI1g414OmpI 2yQpEoEDuL7+09dQx/+qV8dZAoYA66oK568kpoFX1ecZDk6MGTYH4+f1CxioE9rV6w50 HgF/ob6uxE3ObRgy1m/1lNVyswzBS+dgOu0qx9hoN3miDy8gRwsdJDe3m7zVFSOGEx7y e5iCzCmiesFrJnfaC9rqrh429JcHQ3fDY2tDFGML0vR6L2/0pl6D0q1Ogp5HiPHK7Npw qmgOnc+He7UaNF7Wh/AkoyfB8CkCEumUIR/Dz3Y2apJGC5wmZ2br8VOKYHfM2TiIf0Mh 4talcovdiJhdEFFOU4w5/QvcZg/uJ//LdtaNoralQ/TNbPN5EiM+jE+cH7NVA3oc/za7 7XuYfMUx/X98kPMz5L+rMlEv7+DD/tCOSPRCo1ljmIo4pbs86T9GpLNA7tYen/dqT3UM MzJu0M5+etBndZdhRPkuflY3wGVUYdNhYnvIMuMIjd/xbNJmQo7+6HrzZ9CeKZk6I7LJ NRs1k/bEOMY6rM0d6jufAQRn0MD+MdmgTewuGlHOKPPCB0iX6hGXg/zo1E6zQ2eGoZUd vIlt6Hh+RRN7BboHknSEmmfMftXj7A3NERnPgy9XJwknSSKcszfd7G7WZpgvdfgCAr48 xCc8Q+E8H/0FnN34MQeTCHrS7byq+TXMcdGFbM8coWbN/Mqy2drmqr67SCyDvdMCx/rq Sl9TR8ZVAZOZxIRchVjhXgEYQ9jp36hS22MyBs+1FkRwaNF/Z68jEUmPC1x9JgeGdk6m DqbeW9aqkwp1rYbWCbYVmp6109UDY0/6mf6zVn9d4maA+nH/uapxkOYGGoj+ffP7A9yw B/X35fZxuccdW5/TNVuV+VH+/8dvycIUZT/NoYM4nDBGgC+1drLwnFnB/YjzMyL1E7jh xlzQ8vUbdOeZW3jUm687l9194W67I6u+KjDh6OOlYsROwMBfqHuFI+1TmMIStVFvdBC2 e4d48WQRNLx4Lwvw3iILgWfvEQ5OFjWbNGUNvnwnCnHoc5QGdF0IDgek4ixJ3yCiSRuQ YhzAj+0FdMEHGpCiylGIFSUMKs18rdI26g6bD340ndme13sbmOIsBVi9M6yUsYEsoBb6 BHwcTaYcrtGIvPFe0Tlar9ypN9g5RkMbkZhnJdZkOKdVNwnBXGh4h7QBCScC4qY9yUVn bED8Y3RYtoBzIUcWQ0EWNF7vdztB6+ZiCkrqvpfD4ZfSsRlUBVt+XpLDNsYlRlypHEfl 5yWGgGseCAV3FeJuxbKCQhAaug1b7OHixVlW/GaKTg7pbEspnSmB1IHK4lxcryEU955r I9XBliU9KLUi7qKhkKozwbUGJfXkOfES8V6sPgwXzoS+noCVcN8jiUIzvUEa19lluNVG 8iRRAn8dnWkdYk+QSWHA6P1g1UyfTdm81BV4N8a467Jw+RV9Lw7ky7SfQufQdZPUSmlX l6Q3ODezAtJAUUKD6ilweyeVWFSBSfH38L7+ldPnUjZvwu2kb6Fk6QX5svSSrpukbF0l 3fg1aKTUCgqElON5BQx5Frai+19CrGjUfSA0EbGJ7IeSrDCNYT+WSlEeTp8IG4t0izR4 lK5ekIZ0cgUdCvpOaNIpXgd4NLM/jBqZ0SIbuwWh7vEQxThAhmJE6Ho+nIEXtddsok5J t4cVNAn+aSTlJaVcuvAIXMnr6CLTOe0ffVsZeBvqme57fXOsH2h32H8gvtG5BUZ9xoID 95mUzndNI3xVfwxGGvuxf7vQF1xz0JVfRtmX8EanX2Wh+va/3Bfd9qtPC0ow18I7h+Gb jEwCQiZuVr4HI9kivZmapHkQPKH4qghm69TczsbopEUBEMG2uCRHBBPJJoMTnNcKjOjA SUD5mmVNwyY0cwJ9WWyCvtIEAStQ3DltuHW9AELRwibNV1A1o+NEmERx5FCxKZ1v54ET oTltgk+afE4JABbgGmNcnehUAAAPrBNtQut3TgJJtLPTnroIGNCHJDlYNix9SJLnuIMW He/aYCmYDkWL4twik8uHJEwTrZ1z6Y5i66DLYkjC9erk8uYEzuPPE7qBGzdJSJcJHuFu 9SrOA+I3hjvfNY9zdSk0n00BJdhe3gAlkvZAidAMdIASp+lfJ0i2fUzC6eavrZTFJBkG ht5lTEInnQGTRA6TZDT7E3SiBzu706MHQiipUQK/bVO2bAyo+ZW/dS7FeW2b9GdQfGoa DGAjwMf2mYVGNmUrKL3V/LWRQrVGww/0TkK3hGLVwkhXyxLE3CNY6bwsqzkZZIZ8ts7g 1vmNEZo9ll3m+xxhHgndZ+TjiCxOcKWbF61K7mhRfYMmeNwniUC5lI9rdhM8LZtfDkf0 fubFcMTQL/TgiOgqcUQe6fVT/II4ooQ7T0OTyTgCKzQUYq7PZSTRoQEjwExTFNqo4bAE HVZRwnvLNhLCEifenWDpCHC9oW+2uFctwkaVxrDhLB0l4radcQTKT7/iEMkZNGEvAGqg CaY5zRDkTGMwoHDMIKaAhGZ1NkbkEawLFBN8gsa5UJLNxRSUdOI9CnNCYIQPLBAsUeLe axRuDDBBzleAOKXGFH8uZpoPLJjG6hdl2dKZghtYTBV8fGBJnTxtQgOMcPN8/cid55Q9 d7DDB5aiy2K7TW8uD49wnqm4IqsSsIOZvPHooQn6RWMHXNvlgAQQIIbc0PFIDwHRhMI/ lqEuDNYRsiNpmwkbTwpgCf1FerCzMT1u3NRNSQ0B+GWTQKF28sfKwmbwH/hHGDStUYIr L6CAmqXneHqwH2/QvB/13I+wiHO234bpAXcn5bDUNOb+LkdALKw4DeAI1LHDJUJxotrN 45k4RaCdkEMQ7aVnLJquVkw5Lazcnm4upjix95UD940vGY7WtkBAZnPy6HWQw/MsEDmi PKsK+MNsTbsYcrCfuZwFghvy1Bf+UMihgLlJ2zatBQKbG6FExvhGjAWCNkVihaN9Ixhr SY7zjQS0j87YEGCURWgExLpD2ii6orWEzJM5LUc8H2pMu3UqPEGL6RehjE68OAEvYGsx TAlBgk+hfVrPEAH7qCwBwoVAJxxExj1ABFj1Gjkar6BuvdYHOpaEwo996wPTfFViaZ71 ISXTZZR42EDHH1II3AkaKw5MwxSlmMV+SYbSeI+skiHMkz5ggGEejqtUAAOu68ABqFWO oqyjxxIaCtXkQUFOE1uSm+W5ZKYEOX/fRwtM41z4vq1ll+LeAxSx7fPVIveeqxT3ulPz THHTA8qy49XN1aVMBQwwsjFgoEcPMFBSwwAIAQEGCx/0RmD7A0WPEWLQWzvJc+L/CBHR GN+6PgD/mrChRNyJWQSQqYFTZDmgTT6cRo1krheaRg9coE4U/DULGTht3CKcMhBDUpwX zbDwQpoq36Re0BXCA9fNp8mP4MORtoUgx6UQ8OiRQDqmmsZAjlkcA0H8RjEQS5Yr64RS 8MV9gFJwbfQFgtu9sSfZETsbTwWktaLh7+AEWBiCH7xjmEZaGBC17Q4RUA2cYKJO3MT6 DE9Fbj/z1Cw+3VMx9AuuOQ1PxXVaGEooyBfGCVEFv5A3a47yUuACiEUMrzrP96Qg2yRo NQqgoxu9PKSAY8oWCCIgP4VAhROvToEKaJH2VDA0QGCHpvhQgFrdRAtRRfd4tfKgHKGc wwsx7sII0UAfLzDNVw2W5s3ysXZz47YbsS/gDJWUohd8vMC0Ti6/pBPvhYSOsGfRxwuI vkuBENm+oOBAAmhLfLxgKQ3AwDQfMTDN6WRTuOda4Bq4mR8ftLXyXuujNEwM3Au+guT+ c4iB+93N/NzrvsLvzSVLTOAYO6pTEUOJCut529oZJO1hB6FpAFEi2BsAwvouSvAovY9O ML/a9NmUzQuPdANUYOlHoMK5LsBiHqiQlAUVkvZAhdA0juACTYK/ZoGCfL35azNl80or LbKQPhBkIX1k8A73qq3q6V9NNIX8NhpyKDLmxnQfqxdNkX86DmTIIVwJdeREmDnV0w+D 9IptI8pyssjt7kIO4FKMYHoScjSO4BgJOSKoWRx6YgM4LwY57GcuCDkGfuEPBTkq2KLZ KoHYonFWCROxmZLh3lgl4AMzWkdoI00TCD5eVBRJivMiEL8JFxum9w4NfgrYAUrMo4gQ gIE7g2ODaLgHmva+8rvg+1PvTgAdQQbNDesDrHfWPtEiQFohpMjBfQECYou8V0CgMgIp 44x9AoGTKZ1+7eMNpjm9EORMc3oBaAu3wjm4keGuAkzIDbghNHmNKQ5uMMWHKRBi7DaG 7ZKqYN0lWQlUhTBS0VUZtoiVsGE48wRTfLghNA9uCE10lS3cwQ2pgQc3hOa9ZuvZofhw Q1roK0fbfQ5tcA87tGEpuih2aPTm8tAG55mKNgDhaG0g0ZuS9tCG0DSeqLDqBdqw0Zs4 6Ea/z2iD0wZt9KQs2kCYtHGhwLJBxqiG/SKIQvgftd9DP9l5Wz978EKnNUKQEmwKZRus gJLw7KjuyWIJqaXFEtJCwRLcAwYfcIrKp8W0pM+lOljC2z/a2Ivp2KsCkkxRdc98cYa9 wM8crcxM0WEvX1hEzDu5UFKbBX3vCJfuVAbAuVUtIsG54fknRJ9b6AlL5mgtJwcpg4QO 7e8YL57n5IBuR+yXbIdqIIkXDI/gz1wOSQz9wh8KSUS0ErVQgtycU6AEWQsslIgQQ6Kt Bzo9DkaoBOtGBLmVsOAhwDcvtS/Y0mANtDRoTpz6g6BxwAjypYdw+xONtmfgsZGvXR7N 3uM3gESItwAooDhkwhHYAdKiEIyh4BkKDbVdoSnk6uC3dJ5GOfAw9/k6aGGhx0VWGJbi KQVLYZUAVQCbTRR7W0AyXImBc/HJRc65cDGopfVTAsnjv4dQuCqGNvZhBBzHMGrTF01Y hMoQGKI5iusdCMVb5wvNxxH8ptPPXDpTUJatgw8kmMa5UAebq0tx77k2+rqRe1BUve1j Udg27bdFj5RT6b1vEOON3/0RhQjPtpYK/ezhBp3WmAFPuPKHoysxABTIYH8pKDJSIwDa lyVP/DsRqEzKEUHEGqERUYR1hsEI9LQy87Om+hiBfjOzPpdgUyjUYoCIPuCo9BRoGv9O dbb4QFoj+EC3VM/++sniAqECgaCX/N9HujIgFTiSp2FVEBl4Hn9oQA1JbnNQO+0BAMtB HUn35nrm064M+xLbK+leSZyn8Z7uC7/dpnc6tgeS4xxO1JcGDDgpD5j50vsycISC/swF AcPAL/yxAANiCRgwRAiphdSOCYkwxgd6EXMjFFuKHTYmMRIs0HSLPaAB7SercDw8CrMk vcVMkzYK/J3SrlC6ggeChcpSeHAKppX3QGoXNQ0mJGRnQGtoWw8wgp8kFUvXJbm24jJU yax/de8i6eEC2ndCKkHvDqVmJBRr4NkYhOZpDKGJhkjh2kH0mRfLkGKe1HcJO3DAJO8t k6dDcPoCUx9agnUiqu2yZRSkl3o7MWgyzmmzlWsLU9xsirJsLg8ZCE3mcwyfKd2j2Dp4 M7zUq5urS3HvYUuiabNTgAF3HtS4XQNKB4siF4prjuY6PVycC9xqB5ApLs9UEwPEhzZJ mWmann2IQGkzueckCgIR8opiF+0vVWghAlGFJr8XsOcxRChIbmnHKUdPRkVhd1voJ4YI RPUhAqXN9M8l2BTKZghA33FUAxGIxr9T7RgicGscRKCWGghATwwRmIqzZlu/j4UIKSIN aRci7f/mnRRdVgH3GDkbwiq+NeoMY5xiFSdFlqF8z4OU5eSRa+VR+qTfoQNu3vmXTLdg ZLxusV3VQQwkPzF2bnYhw/O2YNDFXxmuj+nM5S+7BaP3My+2BWPoF3ogQ3yVWzDiCCdb WxtDDGsheGU8ZKAXNWSIIoqxNqmRmAFmcFwnU6YIWYTHA6JKtbI0hBRYGukY+IgL2N/p pHNwP6kdxM+VOMCgma1d3DTggBbR7I/VNYAIWRf8NL5NLabfuc0R7ffg/OZ39z7SFj0E 5PHz0QO1JkU8o48ehOahB6Gx4AcJalaUhbfjAgs42GogyQ4J0DkihsbvdSko6cR72JEK bICauxex5MhwohooaCodeZFgb0pZwr3Cqi8QijfjCs0DEEITBUUHd+nSmYKyTBU8HMAk zoMamDwdgv+SbZ7vvJXOE/QgHSyqXSh+W+xwOeOC5Dr13jQDA5hKtlzoZw896LTGAzF5 5AQ9QJ5l2wU9G/SgqTa3/7uetQ09JuuYjx5wfrfdfKGfLHrQzx560GmNDHBdtSnBpCKN Ytxz8ymIG7+jThY9SGsEPeiWavSgnyx6ECpKQi/5v49FDwkh+AihxB56EFHwps4xvOLD hzOccYpXWIa0giOV4MMHKctJ4yjxdwBCWuiVdEL8bd9geJxocX91IAROe4ebFSaVjtXh eRCC7gwoivzCCKLvKy8GIAZ+oAc/JNeJH3BAu+CHBGeuTcIPeFHjBzI5xCYxEj6wnYCO W4hok4UzOQjJmRwS2tYX63Ux2xz8XNbm4JGmuCaMkSGmc2WdzcEk0UvG5iCNNTYH71eN GvS7yNxnc6B2UKiGZ3Jgko8ZbC4n6fBj40YYCimwUQfU50UCB6MPGZjWzdWhQN85WoKF OLbYo96OBoiWp9oBwpgBmyUQQUpmCCgNOl4rsZSG7uRcPmZgmtNIXLqj2DrosuzxDwnX q5PL022cx8cNth8auMH2oFtKcr87lW573UcNlsR5gjMvjYIMiATDRA/EB37Spjt59iED /WYme/iSPciQICDZGhxwG3JuIQNRbW7vd9ppZw0OsPDRys4zOMRoGN6hetATQwZ69iED pQ0c4BJsihzR/AueHZWe4ODwfqfaMWTg1jjIQC01kICeGDIwFTs3Wr+PhgyIxtdLFG0V 06eiiQT5M+UILvGQZItLoCqMlKPfzDltTCChY+GxeZzYC3M5IeTqeJQxYv+EurB94rdf SK14hgSxtFBbHZjwvGgGUqklbXq57JZN/kwHjrwcULANeeoLPUiha2mg1U1Jq0vyeOPU AgSSYGmN0w2wOwo7DaKqKtpdT9aZp045NXtr4EevKApbOh7uRHrX/tGnbGAXszlA60f1 6i+v1RdYWrzCMdBflOrVBn9SSeEEry8ySd28Dr6o1KuvQEzUKxza+pN6+3d3j8WAZvnA U192N6BZFGyDKIJWs+jYshAHFtE/Ok3/RCvh5LfHhOFQ5hOHXLv60mYOwskvOgrYNYKD nDCH36s/v8WyefZR6GvVswah0apmr7dP9X33qnlWmutvaEe6Dtjr7yRLcMDQlJoJ1+PY hxAYUnf3qYpNZnrVYPqgj+mHNKp5gwsC7wCOc3Cw5g2XSoXn+xtlAsKYx4NX71739XYM +zXdK3q2u6Vm52/HpEkPG/igZDBnYKcwoAqxd7O/TdXQ37Cr4UjAsUqm2d+sZHAGLB24 55hoXLOeOCFaOtw2y+p6T8nQccwnhJgHAErycFbHYPdBUQIyeaPwAqoeG1dS7E37dEqm t1lTZFlGodGsUapeLc+NAkVcY9ZABM9LqnoCcIhKRyjRJ1L1/c16zig0mzVqFHB50Nlh QMBaRC5ubxjMDPAc3KPPu5OT1D/BjJv1NutZwwAvO6IVLY4eNQy7LS6dODcQpE1b4/B8 pURzBAIoPh3y6W3Vc4ah2armVNBGPh90n8sFbzJnkUWWonE9tjfdPaViPBPT8c25AM1T Fbsw8hnUKsEXeiJ+Gvm0WnVuIm73/v3u7Ex8rrqNkweGrLkQsa8vGOqv7pOLk+NZCcXd WAvIUltV5jikonUU45DqCs/ACgqTI6/NT+CayTwzbInY36wposC4gQy0rlmnRMHBNe9w 6u/+Hz1pqewKZW5kc3RyZWFtCmVuZG9iago3MiAwIG9iago5Mzc1CmVuZG9iago3MCAw IG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDczIDAg UiAvQ29udGVudHMgNzEgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9i ago3MyAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8 PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GNC4wIDI2IDAgUgovRjEuMCA4IDAgUiAv RjIuMCAyMyAwIFIgL0YzLjEgMjUgMCBSID4+ID4+CmVuZG9iago3NSAwIG9iago8PCAv TGVuZ3RoIDc2IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHVXVmT IzeOfs9fwfVTO8It533M267HEzGzc3jdHTsPth/UqqwueVVSjaTqds2v3w8kQDIPSZmp klpuR7iUyItAAuBHEAT/pf5H/UtF+SxXUZHMsiKLVZons7BUWVXNyjgt1bZW/1Rr9e13 u0gtdirU/+0WuC+cRWWUh6EhuaM0nVVxlWWqyJJZGqfB4lH913uVJvpW/vP+UX37p2gW qki9v1dv1Nfq/a/q+/do0MkmBec0CY0rwiJWuk1BOAujCByAh/eL4y3883pfb9f1XjdU X36x1pb4AkVU5KpotvaoBN9eVoJlMSuTKkvbbRohwT9u5/d7Zf79+O5/f1A/1ot6+ane qh+2m99e1Pe/7ev1brlZ7/gi/ecvz6sXFYdh+XUADRkh+Amam5TlLA4rx+RNqW6Szcqw LFl1jyrD1cwpLmZhxdbUtJ/gDAtvfbpglNOJyllCjsx4nSP62WmhUhtlJDdWzQLPQc6q MCvhOuEfk7hKo6j0fh11nOSCkzyOVME8DFG/9312X87gv/FdsqKclfDD6azseM1T7URr 8hhsFOgfsqyKFDxnHGVVTuzkSRyHMT3z/rTDbn3OIX0I2p2ESVW1RXHkc6qWwj3UaN2y 666D1+7vojCfVfjfGW3dqblabfZqc6/q35a7/XL9US02d7War+/U2Y6v+6XR8YluHtXI OM1m6IicRnasKjjVb87V+vnxA5w8eOt+DAYfr6Gv1NY4ST2FzQp4c1KiKyhsEsazpKSu o2m7IxT2rn5abV7qO7V72e3rx50TV9CCGj3iOmhjSTkLY/QaZMaRNt4sTYuqKhVcQ1Um RX45K3ZIMKxmaZEX7NBGCGX3vFjUu93982r14qtPMAAoHpTJYewa4TNGaQy/02zxbfS2 YTgr4NjHg1cDqD5vtv9HnuV5fQd73D/UavG83dbrvfrpxz99B4ee/aIe4XVWarnWp+cf dvV6UZPpPgGifUFHlKBDyIuEvosvA1i2APiTjmhZ73wFaow0egxqdH9JTSyiMFV5Vc4q +KEonSVpnkZXcT9VPKuKAo6a5TMEOvSixCGikDGg+BbiuMg15HHOBQ6nqAqywQEQoSNt ecVhU7XOJQfvYZpMGNMZs9hv7uYvM6XeewbxoX6Yf1putmr3sHle3ak1OucPsJeH+foj PPQ9zuwfNrv6bJM4zWeSVbMcLhx6Zfic/GkPDPHPkj3Gqkmcp1Nd0vN6Be9OzgZ64pvn JP/eBTpkewaEB0eBToTBVYYYiMobDHn+pRMgaA8flofdywHB+/1TQLGVY+1Xx9sP8BNm pCTc/slKMsT+T7VTSxOxo7yMIFW4xGu6wiilyBXgeEsUrqvofMr20GGuEJV4Ubv9doPu 8nFjFbMNxAZ82IFBszgGPAuzMxq9X36a7xE9mdnWcjwteP0QX5xX6Hg7rR2PkoZom7hI 29tAq6IUMbxw5nobQNk00dHKS/c2RYqgJkdhbiPkkecZkEc0IeSRzGJ0fO9qDQj/vtkv 75cLrUTq03KuNOFF/Q0eev6xbqoV/PMF1AqBCjBSKOFoshc7YJhndXUZhvmE60zoeLyu X6JNKUZ3VTZtREB45x8/vP/zP/7+n39VjzXwjAE2wPw0PgDkceqAEcC23tVb42LU/Xy5 et5eBf1AalWICETOrN6USiQVYo0S/xwzmwDkeVffL9fAknqstdypXb0g963mSxr6nxvs 7nbRQ2M+UVXMUnhTlTe486DQyaHW3vWYU+d0uu1HA4bFrELEpBMMFaX9kzVmSOd0qp1a mkUCNJIUswxh06tioTiKMGdADpW/JctiBBbCwP/T8q7p/CnkOzKMekxOx6F5nIazNOzq Y78DDsx8oumtJoTNuu1s2g21JknQ19rvacLiiLDZKOPlxrw2Hivfc8K4aw5Ai8FWfY++ fknBH+P6zRcm025J7UC35Q9eBmJcN5JtamP/lzw2MzzEMjuwEQaYYMK6ARuvF6RIwllO IZLRE8/oKvYIO+iA3GZd+/3GO+4yklkEGPfn/U5tPvxKtE/1K3QhIsDDIZgE7qWKMQxg 5sZ7l+V6sXq+a2HLCe5lQFtpegD4rd3Yo8r3B20VwwxiArZMMjjiHCMZEeBkbNljENpA /YlJkZEdR8XlLC3RI32ZcVQcIWbI9nAj46gIiRc0sJw4dTxfrTaftZ0yPm5i6P2GQohA 13t1t9zCTJHY8PyEIEM9f1Q4iSDY2bBPvvERm5Uch5y5nQyPDnQME+zAhXJDxMwTBIym eEk4Sh66fHjRX2G7eUbOjvqsg4uQrgxb1GaBiY+d+vnNHB7z6Qlx3Dv6APfL7W5/1U/A 7N7SJ8iqbAbVyKd+gv12/qlerWie6W7zeW3V+/N8e6cDve20H5rixsdZX0Pw0gcIkzcl +DJH8CNDlh2ly40cTBJIcIK3XuV+u4FrgeZfQbh2rJExI+PRQCshzPhENupv1Hx3BS6S HB6oQCC2xcVRmNA7kXYB95gVBUJQGApNVBFgfoMO0fM8zJ+ekG6nPi/3D1pFOALkhSU8 ePnz19eQPeUpJRA9s3lT1omId0yjByP621CHHENOAnBT1AGpbqfxivEpDq40LPIaGiHR v4xZvSmVyCIM6QTCjnfYZHlAKOph89QMr1wkth7F2awqEQrKuNlDRHnhpOII48YirWDx k0X5oZEV1EjqeD0HHCHoE5fomlvtPOoFLi07mfFttWlEaA+Kp3QiNmJ8lGQFzOYr4qQp +NMDkBhT7XmK+Vlp+BBFvFoPmyKPJkWa3C25+STF3H40DRjCzaOXx1wN+vj5XiGd7gG5 po25HT33cA34Hcv0XsYc8ZcfobJ7GqeZUZ6XH4mQ5SRl7QZ73STD8aB0QknEVQxv2vg4 uF3y0TpJBu18EfoevrkN8V0cdA3sapxjHBzPGElghgXCyJaDyWbYE3vqxABOtVPLMwSU yZIYWbxI34+TWVFWmPizYXV66IDJ/SmBafj3DE1oy+LI1+ykjGA2lJYwjVg50BHSad+Z CEJual2jH2rrWa/r7PlmPXLDwgtkHUm8kD5NiAUKjXjh1QLoGfBLQundU8AuhseL+dP8 w8pk1H9emgAFfAl3fWq5RzhoOatnZ6Parqo3Z5AOh+ZiZPohNRtwqMHr8eDoN1rtWiHq IZ9X2um1DqbGK1bw2ak1SJ6HScIUswijzqvOdGEcHlMstimLUSibuoqX9eIBWVzLf9fQ b5vAQDKDcl90sksycoWBi/pXcR3WVvHNkiSnSUmXI3U9W6XekRYwTrTV3X6+f+bQBMIU K05KukoQIsJKxypHglfGTEz+bq83/rDx8Qy5DRXWQt4SPE2xUjgMJ85sDoOnmzUCVnri BMkyi/mOwCzZs1k+erbHFuM57JkRZZmlKQCCMHtLSpFWenQ62dqA/zEeQA+4q1f3h/rJ Oz0/dX4cWXodgnWcmG1/HQesMWU2R2WCb+DziwcJ5D6Zl+R6A53keBCw9XSfHbDWZcSx RIzo5haYykox4ZbmGFIWSIbOQiSpXgPRMlAUWbG+Oll1hidtQKsDwwcl9Hq+za7skaZO 9m09X01j2mNz4PRxaHXcF+kmU0qPz+2K7jEfB4CW0kIAZ133yAAWk8yL+TN85GecxZCJ 13I9EfzhxVzz6/pOXlQv7N6U7yxirCubPuFMy+LQNZFzRHRFB9N2y4/ruZ7/ZMf6ablb 0siDg+fSbf389fljjQE9l8xnAUtrTm9K+qg1UtGI8oaibWlGy4iBnKdgV2TM198goP+5 xgKSb7yQ24d6jXRfJGgtNo8wS4SxYLuLzY6WfF8Dv3CiljA3RAkunfskETRp02QlmOT3 UZomzDBC8R0/rSEJr7FiMU1zjM7sPG4jfNPph/vG96/X/dqhRYr0SNSeEFsc1xnRZCL6 lH89I6/pEakcXiRsUmD2tF+zU0fS7vEIZ6+XcWqfbTKFUIUBuSgSXabowTOSg7bGWGHa y/uXa9iqLHVucXYbWoKcwSrE0r4p3hGQ5dGsJTKS1rG3O8xN7PykVlqLnqRF8ssVZO3G FMzXEMfYG1C9hEXGVFPrplaaoZoN4LJMj8F5ytCrM5zoRKF1cR3fSRjz86xNQrHG0pyq mCQEmpw8d1HMabeSIM0jwmhfCac3pRAoTpEVsvZwVChUjxdsWtgHZB0sNutP9Qul6c39 RD1EAuyqr6vgU0S0IjClUmbulgSeVMmszLhLPB6GH+MU9KjU1dQbVd4KqAGQWUKrIy3Q ulb2t5QCi+Gh310PmYXsxEJO21WEYUgUY7ax2f4xOizr475Cgl5raeruq5+/1oj6ep20 FGUQfm5KbYsccyc2SnzES3fApu2hzdgFLhmLv9A/Y9FQTcUvljudqr5cowLGI8KGV0kb kMAfahVpvobI+sLZN4gZoUomZqelTeMB0fzu1/mCFgOsUXIHeej3TTO8SBKY7d6k2UNE Oca1TXANdgSS5FghKfMInmc7GdZF54bx9hqj6229mu9NMj8NsA22d9N+XOSlCTCQ3Yi0 2O1VkosF2jOrNyX9DBWWYunsxjhmiN/mmdfbLUrjWJTvJRO7ElNmnv0b9cN8//D9dkuD rmsgO+uxmdGbEj5qllSutuc4j/1jvfvU9B20gO54Wd8JdgrdNSUZk8mNpa8tuoEeW0em EQtD7sUCCxyxOOqr/Xz7sYYFf0XRUspTQw3EDUyZyi3Nr9HZ2OkI4fK21ASVT6TcwEgP Sf5w+fhY3y3hId26M1irt0xnXS8/PnwAzSzKMd8GYez5VQzUZP8nqWbypuSOzKfU1pQd 6Rs/IvS7xYTAv9Ev+aMrh6jQLTW7JAgcEzdrQCyk6F8l5iTD3oQ5vSnpU/5RMTEib6RP mEAnEaACNXyJLW3zI0KWNQXh9bJprInZwQvVGBFdIdIg8e+E2WORj/D9PJN0d42KT3bt fqu5NxGVTFBfrLytYTpqAke2JqHnqocEyt4/6JRsUw7mbrlbPO92NAbbPWH1Fo0U9FiX pnj5Z9N76KHbNTRYkmISZvaWnEaMKjZxOjFQTd6XhE2RMJm21WOJ5gJFqrmAej3rF4Yo /IFo3u8qK7llNCG83pT8MUCmeoR6nuA2QmdxgcKArkxa23MFU/ejaIXzVKgDekfLNdox b1yg6GPULycEZ75Mm3LUQJ4S4/9rrf40xwKT+hlz3/Ue6wthIfTv+9+eMDG4U3+Zr5/n KKwYf0M7OlTmpP3/Tz+gyhyGLdeY+LE7PcSG2cmm0zP5LGOrn1DBJlK/IDh6Z7ZP+e4d OoJjuwO8+66zrcpbt68KAQZVYKJJ76gSgwWFSWTkXoaRelRxXKQqQU3GlXqnx3/uRto+ ofc5sM4A92V03ywzz0nS0B2aZw1dbRLAwBDAMTXQ0xxl6R5Vh7RScFtpAs+MdGQqeRmj xVjwm6T4RcXT6cYApPazVuoByz9+MvJsp2oeYk+hAvMsC6g6O/iL0SBNUJawAgE5AD7L WGVABLmFrsAzLAFte9Aipq8bUapfVmJ4kCN0QhyF6Pbxmi5tBRoejI1d7HUBLTKHWyLG EdUOc6zGcRQshAmRjkDPt1cxrUPxn9RzH4pCY+uGCJK2d1LN5igs6Y3cKuQootBWlONZ zI9Q0IYUCRNlBUdlaSvQUMKlzFHbjO8EBfCV+DFPrwJLoLrUugn0KL7I0gZQAv++iFmk JsizRIC2UfZj2KYLRT+L2REannSastAqGKvPw80UJZJyKBf0gtWvcQzdirCFSoZq/Paa JEoKlWAFCGbEYpDpCLkZdD8a3jg+esTXpiEyXejd9C48K4Wg8L44sG/GFk3mCt1We4QU VppDsMcrLMnS3xlzdXIHnJA8sagCcyTvw/36rBwfO+JrLZ/0LjzZSsG+2UpJt80ecVvt ceNs0DiCLhvzPe6KYdZOt2iDD1p69Ojp85fTQWueorvwSNaIheYMfaBrYR7xrC7fK153 RzaSxYAGZPAVaturKEZZBFokBMeNdUJR5YMhqmltnSR57LCCc8A/PV/oHdrn0q4L2DpM KjChZ6K+y/wxGQVYgoZn0pZh7/b1E8rGqP9G5F+HP/UaqFGv4V7fvSZF2nRGFfvNxBjq qvHL/uNCb3DsQJTfRtm3ZHF/yBL1w9/cG10098uiDfTQ5Cgs2kCOxCS0QbkVjDbiEDXX 7fEIuEHLc5MKa8QS5A4UIXaSQ2CCuvcODX4P0/goGE1qS7tIwCETjRYzAoTwrdD7vlsn QI4APAG74HH4Wsbptylwb+Ab13ico2I5OgJ3l74Gzwnscw7jjhw1m6gmpQc7hOS5BiY5 qJBDLnmYYtmrAIy8ikztVw90WFrnKv9JPfeRFGho44MOAD0s/ac3CugoUA0ADsQDHUxp gA6h+aBDaNZf5fx056WxA4Vpg+fNLc27j6/qUHzUYeXgeUgrQYs6RO4WTojUqQUWQpnP dZowFXCkKKzhAw57TCCAAYelGViAkpwOcBA7PuCQY4YQfLZ1xIAD2yiYd9O7ADgQBWgB jsyMWgjcwBbtEXfi9tgDHJamYYF5YlEawGHfxyDCHptrpTXNI75W+IL16/OpSMECDisl A4ZErtzW/rMGcNhz4wFHTvaIxfAe3jhP+9QCNjFB+yzUELV27iQQkucWLupOWCa+9VmS KQtALBp4ohNFetCJDM1lRDsOnWCpDjRZgjWBgw0EUvTuc647PwOdyGsuh06GvsGx8ztA Jxn6T/Z5OhaShTo2QgOfwQERErkOiNDNWOtJEYwcmFCDVksbCVNQTBE7J1IBawqYR8Ar j6pLW4GGrpCiOrRtSpgBXRONACkNqPleeKq+e6fglDynThs8ogKT4LEubQUB4LTyuM+R AADsInetgr67DsVIct4/w8cqTPKdC5Occ8HypYJ2dfEoqKgcUUGIHlrnKg+rIOTauU/n hED0PlbBfg8ZtmXxsAotqowyH6swpYFVhOZjFaE5hMFP97CKtMHHKkLz7qM0HbS0Q2lg FeHR95YiQYdVWMiuazAEPz4in6t9jYdm+ClTsUpGhaw49qjxgBx7WMVeYxAFpAmswvAi 17GVSGIjGR83z7aOGKpQOX5GKXmKvkOHYQw8CnIMwjQ+oR/c3dNPD5XQoYYNcrM5oIJ8 TMdPogX0ovZJ21DGHhlzZaGHZVpDDzkCn43jo0eDoAcNpZw2YS8ZCs4+eqQxyuThDKsX p3Wnc4ULqgaigc47KCF5Vj7AO+BJbPnefQcpvldhmThjgsczYupGRuAssaDxaFyEyuUL 8sDmTF4gRG907MIkJBYDaNC3FSEiYmY6rR958NYH5yAPfs0FkcfANxxAHulNxkUKeFaN EHgWpsBWNfp4CvJAPUTpjCv0sPo5ljYWeVC8A3u2024ROeqZEPBok4AnMFUOtEGXYc4c aYiEOyjSCz7srYQ7urdOgB0qQkwEYQ3siSLhEUNRlrJSFb2eoInHeYWyD4Ymd6JJrWcd CZFQCJ2KGPm4Q2jOtcBT83XORwCWoSPwQEaCbbP0GrgemnebucoDHn33oQp+TCl9PvCI sAYpSjzcgTFsCkDoxUiY0sAdQvNxh9CcfzcP92CHtMDvBITmbjtIacAO4dB5SiiQEZ9D HSJh5/SZ0sAdB6/ykIdcMxV6FCaQQQFN3dXbYw96WJqGHgXq0FroQXZPyEWghxwbsHHg iKFHKTO3jD9KMnvUZ3XTMiUSljUu0k2zR9z922MPj1iahhr2ieZI3sfQxL6/ebZ5xNcK JxIlESFYpGJlpJGJPeKm2uPGWRMksecGIRWabPVUErWQaBG1HyU5TwEbYRJRro6a9iqg i5SIMjunoh2rdj6edxjhVHpciPegHmcECKsl45sh0/AN28ES+IgqQwmMwZhFz36enMuh PU1oaqgDJl45WnLoNa82l3OQkdYbfleYpUTs7BKYBWWmG702hV4k2nZ0xpVGITESLTA/ 7VAHHHOXBo+HISLmhs0mXIxYkHdChUNpozUDdshbdZ43KYkkiGLA/cwBFMCoFgVQhOol 4hqBb5pCczwerDF3OehzBK4gYwCz2Q20wiTfrxiS5x8wuZ9jXZoHTDBPnenqbD0050X4 Kv9JPfchhwMoshElQZ+FT6bjMjyjkwG7FZiNc2hFKD5asTQPrVia9fHydA+uSBv8nkBo 9r78IKUBV0Q2vp8UCTq8wnJ3/QBLnVogMfUD13SvmApVSmigHyWxxx5UsTQNVUoaf0uU hMzdhypybKDKgSOGKjQfzyilQsGeRpSkwvStxif0g/t7+umhEjrUsEJuNgc0yc90/CRa QC9qn7RNoydiACxcWexhmdboQo7wmRvHR48GYY9mlASr1lEkCObpVG6MMnlREtacicok sCPI+Tld7+Db/QDvgCex5Xe8g/+kPu9gZOKMKchZTB3Mkens7HI45BgYJkH6CJyIZB1f LEzCr+kgmxYgmJ4+kg98w+8KcmCwblNHCnQb8EejJmdstirdzJMzURkhP0iOR4ZHKK8T aSFmS8AC5a1pHNihwfUR3CihVgi8oyQyligTDXCjwlwOoUO6F3Cj794JEZIATFHCaVHa aZk2BeACjNM1jvWoxG5i3l36GjwnsM85DDdkPywfb1iacymBpVnfkCGHBPszo04zTcZS 6meGHBJYYJvQPO+ARvdy5GyUNK9D75VnIrMD8U96i6AMTPFCgVCml5NVAywRMxTPlVqa jzLkOuu6ab8h/XSh4FncBg9lWJpchX2K+Kouxd0HmZE8nFeEgFhkFmJYsVpAYSk+MwgH 0s5srvOwV/XdR5o3PlW1KmjOk7v0ihRd8kXojAYWFabBLbCAUYf42PqE/k2/AvuLInTe eWT+0BORFRKFELoPJUChjE+aAdK/TAeOJ4HqoQl9rJGAfQIf4dkMKABHc4MWmr8IFBCG 0G1iPCHMWDxBbGroQD8YRTRodDIwJ8cmkpI+ZyjL7eGGL6YeYjdQR6NWkLKzLlE1Z4Gi tB5lgJ1bE2Y+fbcgwvBNw9FaUQqyZEyB9cysnJfTkUGZywop+6agWT9kOD/jVF5zOcgw 9A2/L8iQYIqVZ1Ui1IuGjg7O5aAvSrkcAd2IjhGD9hwDDD4aARUo6pggSFaU8L203wsy TelxQtO7hmga+TbaFyYFCTsjUxV5IsG+QvRn9laitR83KTBBHCElCTwRYAg0h+4Y7yaO 9XktAToGvJHrzfnG9Zy0gZnE5sIWYidH3T9w7fyG0Hy/ITTxEgGmL7HtGE1mSFeOQGSp V3P30LpXdShw4o4GtkMqiOZDBWxrW2FbNlwlUAEDGgRnCDzwuhakpWqKDgbwEF5oeJbr l+VO18HL0z2KaYN+FqZyNQSSdnWucuNF2l5At91BBaRKGtkAS7o7WYCuUSJj1+kLxQcL TPPAglzVd980sBAliZ070b9Js8ED9ev62HT1tMLKAQba3EcAA35jwoPgAFHdLzmPbCl8 D0NPTR6p94YUtdQNYKBfCzOjgOVXpA+2P9fHptuXJ/ARni2AgN7jqPQriIgm56l1DBiQ kWW4cW8gKWjIoHlmzKB/a6xgfxmZDIo2NGY6kIUE4BemMHBPLdiMpqlKQ/MPK0afqjgr EhU75gCg0yMcgDcsEDfhjF0ovgNgyWijFeMTaXWjDjBnDJIaUQdUG0EVL6z3/qcryGeT M4ZNdGDJ46wqoktPdBx8zatFHYa+4QCEyG4yOSPK0B0LhMiKEKoyAULgRgMhsJODQr1K OhoJIZABSvs/lAFtdJBh6QkaxSS9pQWR4GMozxMhOL1tBDIztN9Bv5XQshW5ky5rPWwi fkBVG8IDWQanTfjBP0ZrIrCrzzPDOKYpDXO9Pu/dj+ND+CGlTXVinVZm3Yelee7D0sTq g5RwQ4SlzUKBYFBKUi/j76F1rxIKntRzH2bwMXFDo1K5TqXgNYwIw5GMablumiPsg08i TQ+E4PW3QvLQg5Csz7ZP9ijm/T54oEL9uk2dq5z3t9d44EH488GDlZ5FD1bC1rVbis8N fy+HHuxVffdNRA9U9pVjDboErI8e6Jzp9zNkQzv0gOCJRQ/4zeiBqHy1d55WoAt6oNy/ ZrghL2mhO4Ub6JegB/rtowc6NshAnsBHeLagA3qPoxr0QDQ5T60T9CDcOPRAnBr0QL8E PQg10JLxz48NOqRYb1+iEoqPHkRX0CynZWJpA3TFhw9HNKNPV8SIYMfGJ0BfnaWJn3DW KK3yKD12zLbt8IPl8Ph9LJuGHEReHfxABo1ywCOmLYYBCNoYJab8rmPZnefHIA6+5tUA xNA3/L4ARIGQoQAImi2YBCBwIzpOGqFjRQG2xqOjkQACDm6GSDt8MmU/YDkr+U5NghEz idwdIg8F5ihotS4GwiYEEc7KEuPkxnWtp01EEEhtJ0RAiVwmAuEdg0PiV59njnFM2Mlc r883rz+IIMANwgbg2TkQJvn+g0nO6NEs+HdKneT4Q4oEDUixsWzE0rpXdShwfY5GuV4U y/DhAwJEVeEnRKSUlEYrAFzLmdJwo3KVjyCE5py0PN2jmDY0IIS0q3OV5+7lGh9CsGwa EIIliDu52gcpFn0K592Z4AOI1jVQ2oM3jUIPNAloeu0iN0E46sHpt48e6NjggcLPgohQ rcSiB/xm9EBUvto7X+oxv6GXrbwHTL9J4oP+JeiBqD56oGODDOQJfKRjIO538xcmAL3z 1DpBD8KNQw/EqUEH9EvQg1ADLRn//Gj0gHUxBSo+eEmW1lp88DBCSzxQeUgpelTLGQ/f 5MzeKpczTGmOo4wy+1PuwsjE55/F1MUMMOES05Sd5Mrzpi1oB6GIoMhlpy3kNR1k8nqQ gRk59YbBkIHcVEmZRDlyTNIKifuI+M+QlpcrjOKyBJO9bdHrVTcUcaO1ODTVTnOWZimO HJFCIpKV4anYFRlxWxY8Qpd0If/Ra4BRTMdgtZ/Umz9+rd6iBW+wN/jbUr1Z4U9qj1C1 5G1mj1AD+22l3mDXrbeJeoOa67+o93/Bxva8IcMAtvwoFpVeGcIWcDPmDpDZ0GBL+DFs tbdy8aqtUGUS1zJM0RUlliZ6Ao+KqKr0lloSXxvaMitwKhdGi+ENOG4I3LRsssBVQ+DB IYEPYovWdInAdbKSaE5Lj6zAj7Dl7coQUKWbl2YpGCdwrCFFsicCmk7DuwLnlpm93Ido OGJBWGkrSVQNgZuWQeBmrdlYDW8KXDScdwibxhaEftxwrcCZLXY0iPGEJeycTB3bgPdw iTXYPOb6XCM+rL9BY8twdDviaqhsHfkc70MYV+PbpK8ig1wNkDKgjsSVe5o4XvMDckN3 8DGDXM0xtgIx6KFs2Q/BbLFBex+CNnro4dJ9CNQj734G54AoqxDTbw0HdL7Hz+AakVMt XW1PA8d/Bt0bDPX4h9nytWuoX5XP0GSLFqGKPZz8DLQVl7fDX7uHonQqrA7pcUvndLwZ HCaGtV/wMxxk66zP0GCrqf7tjre1EYt1PxmiAFiz3dD7bj8wVEGk482QCY+Z+y/X8Q5j y3c/QzreFlue3nf6gbb8Pz8sFw9HPRBNl1AJzVZHgDzoc1Q/xc7hmAPhAufB9T3QYbbO Uf0mW6M8kN3IfXdoI3drHCg1C9jf6RTO/SRYgwzc/OW80WG2zvokDbaGe6P/B7KWfEUK ZW5kc3RyZWFtCmVuZG9iago3NiAwIG9iago4Njc1CmVuZG9iago3NCAwIG9iago8PCAv VHlwZSAvUGFnZSAvUGFyZW50IDQ0IDAgUiAvUmVzb3VyY2VzIDc3IDAgUiAvQ29udGVu dHMgNzUgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago3NyAwIG9i ago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcg MCBSID4+IC9Gb250IDw8IC9GNC4wIDI2IDAgUgovRjEuMCA4IDAgUiAvRjIuMCAyMyAw IFIgL0YzLjEgMjUgMCBSID4+ID4+CmVuZG9iago4MCAwIG9iago8PCAvTGVuZ3RoIDgx IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXFtz27oRfuevQJ/q zDgIcSWZtzQnmUnatK7t0z4keWAk2tapLDmi7CT/vt+CAClKlizKxzSdmUiEeNldLD7s ld/Zv9l3Jiy3TCSKm8RIpq3iccpMlvFU6pQtCvZfNmOv3paCjUoWu3/lCNfFXKTCxnE1 1BxpzTOZGcMSo7iWOhpds7+dM63cpf7j/Jq9ei94zAQ7v2BH7AU7/4O9OwdBD5IUPYYk EJfEiWSOpijmsRDgADycj3ZT+GG2LBazYukIdac/GbUpZiARiWVJm9qdEnz5tBJME56q zOh1mjpI8LdFfrFk1d/p2X/WBRn9+ZooTMaVsbIm2qtiB6JP2GkxKiZ3xYKdLOY/f7F3 P5fFrJzMZ6VnxX18vJ3+YjKO0xcR9LiDehywvlSachlnzVQMaoEpw9M4Tf0C26myvS16 mfA482u+vcqjR+DQ2tRFnaBRpFwR3FbYuEMhNyhk7J/z5eTiF7suyjK/LNj8pljky6Jk ecnwlX0+ff9W6UR95e0lFj2IrGsc7QP20gBQhUhY4jkalDLGGdeJTQaljHHME+yu3Xcg AM2HGZsvxpjj5Zzlo6tJcVewspjRyIyUYjLKl4AmNr/AVJbF4q46vMgn01vsmpMZW14V vUKU53ZIWmEzyWOtDrABMAOjOeyAn0uSMETJbkjMsyUbz0e31/jyugfhSiEAsVhygZFB CRfGi5JWD2nJ2UTDDvVbEszWYPNFD9l8mO85q3apDlv6hn3Ks9ikMKbxaCUzLUS68m2n KU1GubJSMM/CPjP95j5DMOWAHGyBJkl5CsNc87QzmSDGSnBhE8mtgKfAEwkLyxIzVuGb pFtePGzAH7DNgGwVK6BmWxDNXD5ov88YbM6TgJYTsuaLclmMCRS/FZPZpUfQPuBRQpRJ Co08mJvxFojvAX5q87NNfHdLbx+dDN6mSnksYVWS7mkV01IyWidZlrIU9odNsoS0ag/l 21D78Ig9HFprDRk7h+0cAJNPv5+dQ99G09txwfJgx50W32+himz+7Y9itGRfjmiPyScz 0knaY6oN/q8l+3DSx/RiqdlEYaV5ZvfBnL4seWsszzIddpcOyx/Sx18+HmPVl19eeFOI neTLq2BIl2yyZJfFrLKmHy3qTdRHuCHg/07Ub+Chxe5uz6Uy9tdiEvcssQ3wDXSuUNei 01GjjWXWGC6SVFXAb0VWAb+UsXy6tSehjsbE9PTW1P8pcONkEd0T3KrhhjZKATdtFW7S LFUIzvQANxqol5ngKnRneUtM71EQqBBSSYIz3SWAhuUHY+r3G7gnCxdSIXzLWyuQ/Zhg OW4BxuO+fBdILYstbC7P6qAAUMXcWhhhneOXDv8qG2gtotXalR4New9vpxI8pAlZP54Z L+AOaL5FRXp0cBslqSZkUEoiBU+CCwbo6uLvQE1Oi/Lu/j2RM3Z+NSm3GC6kRz2oj0JQ 18IYZPCLiM1BSV4gdK8PSS9Uy9Nbfs7s87YKvudL9gOxPW84Oo+F7EIfBqzNRxeR6GMC QvzZem4HNQOx5oochAMBstqa4BauWobkUSO8i3DBmn21ZYN1dkW3pBnl36zJDLOegX2E +sQ5Hxh7iJskqqbpAKHm/H88520/xmt2D1JVCJVlclBCVZRuzSSid4draj4bU7SC5bN2 hP/h0MsBpp+yGRcKZv8awYMwR7FiEItS9gDNdIgbQHZ+0Zbkk+RKBDYsKTRy6xXRfok3 G/SDQSy3jtrmm/P7nhicJHTWWIDTGuXDUIHUIihjUJ1AZQbRMGhKEsQp0sN2oTfI5GEH KW+ny+OQ0yt+TsolOUx+079ZzEfFGDmd8phNLgAElWW/mN8irtmHDRBAwXhO99mu+ooS QVW5RGnKQaAwLpaIwmEKZqxYLOYLzMQUWTSKxSHnVhnH5RL5VgTqCn4Jk/jN+HpSUkUA e4vA3WI+7UP+wf8IvA5L/gggpQcm2BYFRUFJmqgWQV7zwwlmwOn1lxcuBLCq6QgYTKcu QFpHDfoQfvBAjK0YHZTwjUCEIHh/HQM0oaTAxaDvil8hBH3aR1akNjeNZ6H7/gjH9d1i gSTtuECMFwuW/CRoUNjmvX/lsj59KAqSoVoDiNY4GsYepSXPNNJ3h3hKJFcXJ1h3Ql0O A6B4Bm+1gPgRLQjCv4IP+60oZlivS8xNH/IPuQzjeR3UQlWax0YEu6WLFcju9afYt1/3 2IcVZvppCut7UvYh/dpG8JwOSvrSIE5wYCbJlXx4dKmyc02pVfR0IQJNJblIhRhP+6Dk SW4t1awOyQqPYYWjJvMghPuXq6rzxVQEdxQQqpxEqht5ulkONavGU7/PLD91IMhqLiRy woGm7hI9X0wuL1FyMW6nIGqv++mWTZ1NDcR7gXYB3Kr0tyqfY6O8RNElOV19gGgItq5R PwgTQqNJII4PzEbltdtEVhncJubLFI/ZbUmGZ4Ws7cLGu0lI/fQh+2DnBz73WYp9Obk6 i+HkIi1/iPn2qSodRuwAaYXp9LZcUgWxyyy8n1xSqajmPQi4zgQGZgYl4FQg6DWsSnak llCcU2c3hgECaBjKUKU4pJ1fo1RFKht2/mHISVtYnHVMcBg0qQQ1nXWkbBg0yRRWGzrP BmRJakntbaGCuCWmjf4MZ9IcZB4iik//dtaG1c11KCMG/gf3vV0bxs6vo0O76zZyl46q PWmKJZoI60rrlpyeiyaVKV5vkxtiqpoQo+5NiBti8lOHLramE9LNZ90lWU8dQACIGXyl LTQxEXVtjNxGE/uOMOADvZqoaONSB19pK01o1ow6NWtup2kPOdmEm2H1jyqD6lhZW13r Gv4sPa0KcYFsYC13SgsuQpVgW5ueCzCVQul403K3PnXPAphKUtd1sFPacno2wBSoefXW 3AZFz4OXseWibtjaQlPPeCmzBHgZrJStNPWKl2iQAF6mQ3KiZIKYZdMxsb7ongUvZRLz TAQrpUuG7B8Fe5/fjq6K28UxQxIjnyLTQX/vft5MkItnH/PZbb5AJ/gxNYNn1Y/1/59P qF1XJF97cK3rLp3A7cFacU8PQagi+oy3Nwj2FabPuHpBxNsz7Oq7ut3O3m68OOJlY5u4 N1EkSG27ok4JHphJEaeLY8GumZQJamfQBuCOp+zMlTs1V5O1tf1mMkH5Ci5GLCfDzZSO m8PqXvUrLnZxEMEShk7DLKFGOHqZBLzx682hKaPiOQWAoJYlpWCoYyjhSqObIFwYYWj9 XlN2hTamz5VQ143Je9kjR0nBuTSR0dhOKmG5AVYPTIlhviIBDCArg4FwCZ2Be9QDoO3K iZimWJBTYlJsoGjDcBzFYAt8b45NMYYb4/0V9XmRQYkOkIAYR8LcoFerGbF4mYFRhtH9 w1lhbGNk5U7hnNXrML0SrWCQdHMlOjiERcdlQ5UBG2Ab9wr8+BHQoPHKkjSj4uJqTONe GunoJLXUguKu1BiBUjp+/N2jlRGiAZ7i6knV0MY5GwPNRZEN/NHzw9OC9BqKoFtuJhq6 w0jDS0QauOWs+64j/ZPsx/4LFVWWlOKmkqdqbbWOoVgCL2AwaNWrz1FCQQdg3utYSvxO R1gJWNgyGrWPdx75c6027lpMlrsX9QpBy7KofjIqIqozHK310Yg5n4da3RztU4YsBzAC HU31GGAIqhzuWB2RK0e84nr3azjedeTPrfmkZ+HOtRTqJ9dScrTVR57W+rj1a9Q6Al3V 2t0NxljTjW5ZVAOgK4Ndr+jyI3UQU7mpX/uM3IM1gKNmBQd9blZ5WBnNSKB9FR/82D0o 8sB1Xjara9HLC3RVTafEl5GAeUIJ6AZAU6IMjZqu8WYMIxX65RBXX32XUo2sBPNxBkQh naqCBvVhc18oKfYTv49jN6MT/Yd7iwkWOYCaggZny+LmCoUWf8cbCZpw1KOeAsREx63A I92zFCfi6Vl/eZoHNMxAjq+EeYXQhH6NzefkU/NAeqEJYWGa0aaKCUjINRdw9BIqbEnR riiyLAnmSr3BO9HtDmlVs4nKcUSSQ2ybAaZI6NVH5ceihqMSxGd29NsL9hL1HEcFPlN2 NMWHro8wES9NfTTGUcaOXuND0duvoq/s/GOTVN6DqXVlcmqDbXpXAAobM8rPaXPbxlQ1 u+G9XNFRviLs/wM1qpeXCmVuZHN0cmVhbQplbmRvYmoKODEgMCBvYmoKMzA5MAplbmRv YmoKNzggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA3OSAwIFIgL1Jlc291cmNl cyA4MiAwIFIgL0NvbnRlbnRzIDgwIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+ PgplbmRvYmoKODIgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9y U3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjQuMCAyNiAwIFIKL0YxLjAg OCAwIFIgL0YyLjAgMjMgMCBSIC9GMy4xIDI1IDAgUiA+PiA+PgplbmRvYmoKODQgMCBv YmoKPDwgL0xlbmd0aCA4NSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFt CngB1V3rj9NIEv/uv6Lv24DA2N1+ogWJ5SHt3rHHwtytTsCHkHggq0wyJBkeEn/8/ard Dz+CEzuTxsxKi9Nx7Krqeld190f2J/vIwsRPWJgKP05jzqJE+EHG4jz3Mx5lbF2wv9iS 3Xu8Cdl0wwL532aK3wV+mIVJEJRD9lMU+TnP45ilsfAjHnnTS/brOYuE/Kn65/yS3XsW +gEL2fkFO2O32Pnf7Ok5ANoLkncMSAAuDVLOJExe4AdhCAyAw/m0G8LflttivSy2ElB5 +8mgzTADaZgmLK1D20nBu6elYJb6mcjjqAlTDwo+WU8utqz8e/nqvy/qlPT2zvsAVgyT yA+5yA3Uihd7QM1eFtNi/qlYsxfr1Zev7OmXbbHczFfLjUJF/vP79eIr40GQ3fLAxz3Y YwBSIst8HuR2KkYlYCL2syDLlIB1sqwzoeepH+RK5utS7h2hhxpT5/VSjWHmC1K3pW7s 4McWhN/qcrNfX1bh9A5T4XHkR0kchiztgNPrnNy7+OsL6QDNTmZLJLwJaR/N/k0L8u3b t7svvzmQbp5mfhwHUP6K9P1VFpG+/KtPwElUrOCJz3kmjoBXTUCLsb2b900EDIJIA/gm R1G3Ttf9IjiAsQW8gCgKLR8colFLEp7MMbGWp6YWuhWBMy0f5H6UJml/1459Y68Ya7Hf Ptd4wKRCtkUgcvgjg4HdLdonYcEQkUEUJfwIaG+vbzuQlVAEfhrlkOqfgqxJ5md5mB4B rSOyQgWFeQzb+jOQlfPQFwKh3XBo3ZCVw0VOIrLwPwVZ4WGlGc+OgPYbo3BPulY7lKx3 0/kHAW2Q54ll26EeVFtz3Tysce4nQYW6/WEFdXcar5uH1cSdim9HFXcGMAFIWg2x/u15 7s6JDTD8NqAaDCcZfgeQ2oBqMKQ9AiqbXXERW1U0Q8kt/aWtDBCdqDETqqiJ6A+sI5ax oUqdZTrzA85ClR4wuQpVkpz7QSQGZKF1fuLQf7+prCXudypgGsMxmYgE7iyyFdEAE3Eo udV9Lkht8kQarWHqoQwn63bltHmiBrw/VEloT1HDdEiOxZmSSJGEhWe4o3rWygnL+Tss 7VPNBqOg1ytrnSSxn4bhkKy1lIw6m+3PWUhYvV7FR+O+fBdWb1+lz4mbZWp8dTj75K1f TLYfnGRXgsTPQ8Srw0F1QlKTrhoO58NSuHvU7wbEAiGP/TxD/mc4nG7oiTxFjL6AI+B0 xqIIo0WMTOXYSapTf8PhdMOiSFRH/Kipd8OiaEvIExjJ4fR0xaI8DFEYH7/UmzTqcJI6 YVEO3y1Lj5p6JyzKo8CPgiz6GVgUGQceIYM+fOrdkFSnpBtwdoYSD3v4yAOMug3Haj7y OEqjSQwPLo905NtJJ2fhTZShKScekrDtiMZ/cdChEeqyWKJQGBJ59w2FBrBkiCxTKshv H0zql8Xmk4sQg6MGFCco4A4H1Y3mQbNLiO6ROpjohNVtpHuDS/aLg5k3FcY6nH2CSzfk jGIffa5hg5594HTGoUmOST5m5t1QVHePNWZ+HCpfIEpLdSPmSEwj3Mgk4do0Wkne2xBe WiEX4my6hpLBwO5K8+7Pvw0xOiZZNBjWP1bb+YUDLWm6hhpk7ZSVr6d1I0OTcxlMvnKq XZSKQ5PNqAPbSUBn/iXagVJd7OlloTvcyzpXnqROEprUS4nAIRW0E6/9sA7vUJqSlX66 XtfJdxL9Yz3JGqw1lmyWT/qQb0D5xGZUaiB1mJomgP0TKlUwD+z5twmVGpg/lHK6Uw4N /juFuWWkm5QbyHggn9dz1RvXDmIN1B9KPZMm+T5I7PzSq67D65MlqfKYXBooa4mdSwNt lqQTpHJpoNd/aWALJLVaESsJ7PpEuU7HrF00qxWTEMvuKPu1o+AKMunlil7f5Yrfg4l9 RJyzZwVlEmC5ggiUd1qxYnsZvzRiD9p/1IrZHn1QTjwVvrxBdWRJ6IAdOPsKrUNsmyt/ Ic7RlRuKZEwtAHGWoN6OBuzeq1XL6ceCpsF/Dx1k0sxqHI3oqBgiRW0pR+K+JH5Nk1f0 gdPly8iR+RyLrscFU+CjA3BIM9uONsrTdd7GyVA4HbVRmtaV4ZCazlsbw9RojIjlNMus 1YoWDfmQjLiT/FioC8Ya0v6qtUljaNhqXHMiEhvPSQM+KlUZh0ii6WC7T/pWLb1jr4rl DEvs7V9JUkqnn8wdMZsDxAr8/lxbrr2wTewSfqwigs/3/noxWcuFLy4MKYrMsYBdaKAy DqMVcT+Pcm20OuLellmtKS+orr3Ka0DG0izNiAfD6dxADIa0qbzAsDUan0h7mUyhpnF/ UXNEY2sgbozGMBBsvbrG9jGk1BAkn1KpCbQZ5TxmDUKPQxGIyA9oV4kxedRoxhTCtEb0 UU6Y14fsspjNJ+xisfpcdQLYn6fJDSNrwsOIxQroUfkAtIyTNi0a0+QGCOGwKU9/J489 ePCQsU3x/rJYbtnqQs4wu0LHNduu2LuCXa1X22K6LWbs3ddyeeu62BTrT5MttgZyavEV jmPihQibhwXB8KLqm7N311u2XG0rZJ4v2fbDfMOmk03BNvPltICTZSjOLibzRTF7c8sJ 6WOfo52KaTTHRfoAGYJ4VGIYZSG6e8yeUH10rOzOZewBo4u6hoWOvfn9YUKYzyRF0kfD 3N9RgUnYbCbvCzZdLbeT+XK+fM8mTBa1oSmKj9fFBhrl3d/QHi6YldRyztMmQqNwCJBt B7V1ertX3Ggixc9z6ORNGT7+9oI9ms2gFjYOKBvmqR9RflBjMSo1gF0cc2yMNSZrHMXQ myIZYo2pjIe9uR5AfjafxipgCr1RsUGUwLs1Oew+mvd7Ajb5AQKmsBgVZUXqoyo9LgHj Gdxd7Nnav1ykzNMDbaeUDXORhdNLt7DWVUI/qlnmVKId1RrcCB4Kz3Q2rb6bZbOa36d2 2ipT76/mm9J5FHBsHmzWKneomWZ/htQyz+bvr7Gnb3Sf1LuOodgzePQ0/BcZeJUflmw6 nzoLsvTehhpBxZsdCLZSmJ+QHiilq+6+niRBINA8lqTY77YB8Ci8PZEL30QmdcZtsYWk 1aDMv2TbPY0IhnFhGuEm6aRFz/6KZ6s1W6ymk4UMPsGqG7aiILWw9YByy+DlalbcYfML hAGb+eWc6gIUruIXDtxUwxIa1zHpV5Fi81CsjhtgsRgRe7Iscy+X89nVao5MzefV9WKG HME1kgQ0E++LZbGW6oKSOBPpP6IRkb05u1itXVBfb+KjMR0V9ZPUj3WWpsL8+xexMFZ8 mVxeLcDWjx891tz85tadXez//D+vzvVEFCYUdkr8EtFR0T6GpuYmT9PHojCkID9P1rON JHYZ+vqMnVcUjwPimkZboTAZYBtL9fj80f8Yooo5ZU4nC+yjroQWvOIAD6sf63iMw2RG OXxi7YD2TJAon/76CoqyYaeOpiugijOcDwGtIXgOnzQDcOqquwnQFNhEDbc+6mf7YXL8 MQxtDCwu3RhwZNwDASdLYzBYr2Cn7zzHeqgYbhs22EQlOmsVsPfBifAE0CCHJuQqTzjh nDbsRICACUkE5wGnZ17sr523IgDVPNtx1IfZ1KBBih7qrLTYS+T6V+vZfDlZz6EBpAE/ mkn3wy/QYJ4mrqZSwyMwYxxCLSKUp2g7JTRvRFGKZkOWod8zSfOU5uKAKWtxi37FAf3O Igqxu69ud7Yzdoj1/55bpdIGd9jmevqBTTZsVmym6/k7lMlQv3l0dYU87fwL+xXOmIvZ 1dGQQnWwnFJn3o6zcY6ivuDYrVwfANFTs79++ewxBDt+69djSpLxG9/2FTs/lds/CQXy qMgIZYf4TQcQ4zDaIfS4Sgz2MWvIhfz1oSgjyMti+2E1o5hFlTagIOcXKvPBbE7B5MJR GUXM40KoTEQj0ezv9c0QCh9vvvcrOnNYgajOR41DfljaASIVmv0/KzxyyLIOzPTLp4// /fz50z+ePH2CGGCyLaMu2mO7cVjRZLFZsflmc308Z7T9kEM9PvQlliVI7EWxG+39JmfS VnSqU/wmfCgJYYAWdvhR8GKxBgi7cuPwM+zW5MCJMieoaPr0lymlJdpEunFrIPSG5Q1g a3LVSoLuSucdMnFayo3HFKCsiT7jqsOUoQYbuHCYOAq+PDLllf4Yn8CNgBuJFM6oChQ8 xcmBdpPQJplqyw1dFSh4iiMBQkMn6+zuVbj/KlCIgDNbXK/vsGLLJgukWujv6ZerOaV8 f58srydrHP52h85/y8svzf9fv6BOkDB768Iy6/35NbaDHbUO0XyNAxtD9haCOSvPhHz8 CtLYygaQ3izzAuzV41YAedcufCTbwFJIhjwmksNoI37FIT6XjPM0wjX4Z4Hjeajz2/6K lnDufAglkvHD2KMf+jEeQ9teqQ/lc8xJlp1QYyFjmGGxVRhknojlmzmepseYGVtgLMMh gwjjKJ7LOEJxGqMcAcrDtfuaz1uwD4jyXpfUPBi/HOCg9SwHWth3IfaAY30E7wfW+h5J B4xAh1Z+Rfc0f+WhzgZC0wSHlAKJM8Qo2DtMIhZD8V22hxYYiuCCw1QS+nQXLeaDEuCe wPY+0M1YlaBGcAtyE7LbdsdY+y49gift+J3AmvAI/EIglG9k4DkcrcLpjRoonP2XC8RZ GhkP9r0cwYGfOKA0y6EWzNgCY3hslgBpfV8EOgW0bY15uh7xhIaBnqXv0mOHjNjfWRwJ Bv0sTUELlSKyBV0NWGzwpHIiWve0BqaSATn7fJh0kUJBg3lCAkWyZa8XuAa9YqQw5Hci FCmuaG1FAMKVn0DUqb327Ki90t+Tc0zPpKdExMF4sH0D8MAngoOupp4sIcnrBV6a49Qq vFR+hkKpPEF9orWKuE9+g+v6FR5W+V4AZnom3auxsW8gKpTvpis8k0pZEn+6Ih1U/76U r251Cbmz008yi+D20rNDWhIGcgmepHm+B5do4TEybsXecJsVQs20lZEd4qsRad3ltUZA WjumaFLF3wyVKTNCMebIgAq0lEAhhdAKaNjl0MoYF2HeTNwYjUc6OMgh7KRey30CzEf7 VCy2woFIOueQxvJO9Y/cKACnO0CD0kYBr7bFFcX0/0QbuXWCe71GWXH7mghSFUch3ipf hjO61Mv+caI3WHRAynthfA9cHt2PU/biuX2jXZr1g72HBNBp7yHOYojvAO8BP5TeQ0hn RfLyU0/3gewHbfzqUaQEVUD6Ug0hziyHoOLQYiKoxQjnAmI/21LtYXkH52RwKrc1HjbM dQixez/w4mjWkY5D7TMoRejK7yX6+Jygk1/fL7+v/B6flcOAnToaDgOQwaFhhLNVHXrM 6g6JtLxPizeIBW4Dr+sBBsFFyEfStmOsfVdrxKv+jlb/0lL1isuAZnnQPcXDlcfAcQG8 yYdQ7o8ewaOM9tRjeJSxzWbMaGv98MpACYF8lDLyXEPVustaAnNPxTpoynhVVajIZ2Ai tpIUNpCbkQo2eqxiHbp+R17rAKcBc2OcBrquOg30uTT3tBGHdRoShPbaKcC1chpotLy7 9j02LNdOQ0LTWXMaEqzYKJ0GutJOA11XnQb6XJp7/QT1Cc/WTgM6rPQ96srjNGa+B3Ta adDYWKeBMC0dBbrSToMe9aBs6t/3dRoQduGIex4hLrAMpYVoGKtUGV+zihWFjpFqDKEY CtxqRM38EjjLkAEKoYf4W0dBi8IOFVEVf0UZTE6FMopa6OKSQaYx8yTNaYjoseU+NAul /dwHSiMFKMy27Dr5GzfnPnz3NTfmPhz6hob7kJD7kN+HXW26D6S0shyxGgVa4GB4big5 4WDXBHVRgdUMkH9qCGW9ToRRExozipYRjmq/DaEFUVz9IwmP5amlK/WanT25xe5iqepZ gX8zdrbAP5H5BF/ubmw+zW55d3N2dh+Dgp0hp/WWnf9u9y04AK0qRx24XVsE9kSCAY5D DS1yYIMskH+UVt+BZaixPPv8YY4yrfTh6quSDchkwHhMrrOdCTgNeX7UTHCIe5ab1Sk7 YDzxTHwfrWNmoo5WnfTNUtOm4jn/Hy45Q4QKZW5kc3RyZWFtCmVuZG9iago4NSAwIG9i ago0NTEzCmVuZG9iago4MyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDc5IDAg UiAvUmVzb3VyY2VzIDg2IDAgUiAvQ29udGVudHMgODQgMCBSIC9NZWRpYUJveApbMCAw IDYxMiA3OTJdID4+CmVuZG9iago4NiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1Rl eHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GNC4wIDI2 IDAgUgovRjEuMCA4IDAgUiAvRjIuMCAyMyAwIFIgL0YzLjEgMjUgMCBSID4+ID4+CmVu ZG9iago4OCAwIG9iago8PCAvTGVuZ3RoIDg5IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29k ZSA+PgpzdHJlYW0KeAHVXVuT47axfuevwMnTumpN837Jm2Nv6jgntvfYWyeVcvKg1XB2 lGiksaTZ9ebXn68BNC6kqCE5EkdeV3nIFkiiAXT3h0aj8av4X/GriIuwEHGZhnmZJyIr 0jCqRF7XYZVkldg14m9iI776Zh+L5V5E8r/9Es9FYVzFRRQpkr3LsrBO6jwXZZ6GWZIF y3vxp3ciS+Wj+s+7e/HVn+MwErF4dyteiS/Eu3+JN+9QoSerFDynSqhcGZWJkHUKojCK Y3AAHt4tT9fwu82h2W2ag6yoLH6x2lbogTIuC1H6tT3Zgl9etgWrMqzSOs/adRrRgt/u FrcHof799PP/vRU/Nctm9bHZibe77W+fxZvfDs1mv9pu9rqQ/POXx/VnkURR9UWAETKi 4SeM3LSqwiSqLZNXNXTTPKyiqtJD9+RgmE2ckjKMai1NvvwEz5DwVtcFo5ROXIUpKTKl dU6Mz04NhdhsD6vb1XJxwCgUH1cLsRBvF4e7N7uduG/2+8WHJhTi3d1qL+4Xv63uV/9p 9uJw14jl3WKzlNeLwyzjFIo1i6EgNLNXNU6jOszKohyvYiHv1JheJ7jqNhhgHFpDB0aq jvIKlgxXaVJncVzZq+CkHYuzKEyqPBalxxEe7zUa7SH1abVeuxwMMW+ag8BY3FMciNMc 5HWY5kViOJg8TqoQgACCnpdVWMGwZ2HVMcNP1VO2Z1Fj1EZlWBQAGUkalhUI6JoiTZIo oXfePo0AOp38NCiJiyyMk7RuN8WJzhQtDbZrFmP7stNGAyqKFs6SMjUVHS9Hy7s56glE UBcJBoMnHWMglZT2fbO5AQRYbcRivRb71eFRat+9+MerJvwQPlubdkclqsia4KT0pDTK U8BYj8HTVu61bPkWMjwiPJ0RzNV0KudVkypTJ5AZIzwAsklcxLWVHnrpAOmZMChTKJIi el5nNx+bjVjdzjA007oMAZ2trE+GTH09FxyZEKVViBZSHZSV0JVRmGe4qCtRhWVclHV5 uQ6yc64oCkvo6vFaA9Z3v71vhITmu+0jpjt7cbMlcyz2jw8P291BCuwPhJE+i4fddtnc PO6a12IL8b0FVFK/PFtin9aRFqdrbifbtZ5Z7wQRMT1Q1EkYZemEKSZ6QKNM8aE5oPF3 24eH5uYfXwB0/vf2EwRo91rcorWX281ht12vmxvRbD6udtvNfbPBAy+vMtGedVTEwm+E l9KZVJsKIlnUQHIJZv2z6kwY8qIE4vDbIhg/cZuihYjlKMsJW72AFirgwkiTIpukhT7d NTBkhAY8VbQA8d+b7aeNOGyNQmorozmUT5aHSQ0nATOplc8IJLn/xxdisbnpmsLg3L64 1Aik7pGr0pRlBqirHRoYqDytCp7yxUFRqkGyOgjMxW+a/Wq3eL9uaGTcrzZyYi5t1cft +hEmbXsLYPlhs1ivNh9eyx9oZM0xVowOUKxeVesXOWBJPM1OtVx333/9d2AbOOqa35br xz2ceriGC0WDe0AI360yP1IoNLdX1QN5EUKRTNOSjBSgRzCiH/cSp632+8emt9XbrqxZ BUDzelXtnwGy1zlj5fGG+RLoMYXLhmYPoxcooBS/2/h4UClJ+NTInu5m6G64cMKkIPyn 2dDdbXX7k+ssjXi/PdxJ0+/bR3j/zr9WlWBaDSVYtit8cixceKklwWQb88bc1Gn8WFgu HqQ93OkVlj3BDdOm8KfDwracFD1jueOoGDI7097p1iA42aZzrVgUaQTfI9zBU+TLs3or +PsXywMgBVm6983dYn1LSGODu5ngBdyEcKACQTFXQ7TrpUcvIE+eR4Wp0/iW7oze18Lz vE5aBxgwbg1W1mNkSGvONm6TOCx5QjUSK2sUdrPFiAUUk7MoAtBkGOC2+QC4toGc75vd R7XyBUzd7A/QIKv9HXwMn1aHuxmMR4opilzVKhSvV9X8MdbksylxAzDLC60QKMRhhOqd 4ISC66mIyhT216/vSdV7YYUAZyzWY+G5btVpBCZoKwTyONKg5JZtRRLINdrHPWmNGWIG ijqMMXQNe1c1bKMsTNNomrWD2vAR2NMLcxOGLOGOFBIvisl1pfWjw93CuKnVmrxxUJOD 4Ha1gSLDItOBFu/3Dew2zPT94rOYZYigF8oIgE6zOHmIHPEE9jY5r0dg3QZjACDhRTyB eZ2HEPxCo4CTiuhZtpQX0MAmr+7Zq5PrfBnWtuoyTRHzpuqqu2eEghKq6seU+5Aue6ru VMMcnpq8Bt6ry1zgPsEUQYYyXHrlHLORBMOHQgKnNs9qA6/QDeageokI+vrXRyAMsX3/ L4giySX5Jnj1Yy8XOWZR3uRvrZOyzdv4YTqkmxmCsmRSd2Yp/D+uZFZ1lSL072JLuWad Kq8KTH0R3jJlJuSiRal67xZYqkLkHjyw7xEPZReo3n9mKz2HpkVkSZwDpjFzQzTthfFP GsdYuc9NlVR7j4HwGv7MYIxTXtvg9ru42maZGBBOnJeIOKmraWCGPSEcv3ezXWJlYHPA CreeFSmQ8BozpB3c2A/QSwCQm3kAAkI7S3hLEF6lWBxvgSgC8UMDTdoeJcH5nWYpr2q0 qjtea/Y4nXoxzZBRAjyeIC59klprflvtpUeHh4v063xcbXcYN1/D30PT5Mc1RgZDyeVi jwgICltUs+w5lBz7KXLN6hAl9yxsNUZIC6CuamL0A4VL9iOp8w0WE2CfT64t+VH0IGFQ o1dk9mT9PjafyTF4g+Xq/QGBg/dzjAs2NJqpycNiEpbJEXZdvVS8QZ7H8Oqye2xUDKIf 9L13Q23kXBHTxYdmdwtzgCVNmkZCJSwXj3ssNt81c/QqopDzFPqMeZzcreeTH4shsySs M0TwTsGQbUv11PJOxyo8NW3qtxZ2TqMZGG9w9583yztEXq3+I32mhpmgta5yRJgI3Ht7 qk4xQjHqVF3MCfIshqsJc+kyJhe7DGkv0jjHauHFpgsxfOFlhsWofHpXv28Onxq4mMlK /mQaSi9AXQCfxHA5ZgQUuc7je5e2J7lzHHjDD5i/yrX2WaTeIEJ/gI6HWEfGX0eQ2L6b iSl0TlnKAWaDx+abmKZZGOXxtIkppqFr3sCzg5dhtWskzF/CCY+JKany7e4evkDMS2k8 YgXvcbFmU05x6HPodIPgNKtXpdOTHP7CiVEp0mQSJhYLaTdlG++aD4/rBWZVCHm7vEM+ AQyqIizp55qRIY17YR8AAvVDoHVo0cmNe9i2Nedoe8li3m8Xk6QIYziq/WqeDt8d03Qt yzdkY18CA1SVcF+36nTCO9vehYVxp0JJ77c3zfo1wtwxLLFcoOdwM7SrnTH7/T9enV8C xJETlLYbTwFx7fmv2DRQrjQ7WlLA7uI9NhI40yD6xYQC7p+/u+fpIc27eHLN5RBtMNtk Ge7KGlubr8nLlmHjfxRNDJD5mmMPpXx5Ac4XCtow+JTrPR7rsQPQ3eTy9OLhDJbMbHNp 8XYVWiOjPRU04Z+iNZ6tck/NmE7viTVTP2Zg/IC5X324688DMQRwP1V9PeHLkI8gox2z M26UNb6x6e0Dwzp+vW8OeeJJVYu18fI0pI/ZNPGkijqTllHdxb7ZtgVmFVwGBb4+RVql 19sEh+1X9w9whbEXTG3BWFF2FKzoqiAL7F6TXvTHh/mcnxyGw5xek51H4Bi2gk0Mw/EQ k7hdoJFpNeK7Wz23smF7zxahrlpytiOfjKEwMcs+q2NWOVf7XqswRNy6dcfHORIEdaca ppTCICsxoYBbQwdRVLOkH0gwPKM4x8fVSBhvdMSyt3nONydIOHiX6zleX7gr/90an3+D m9HpfsvOpNMxlgqanL6MUkeqrhrBc+M7yQaltkIneWMlLV6Re6wfBz9b2bB97PdGpMjZ IePmKCcZMXpVOj3HNtC0mGZRdQCiu3CMgFa9+Hnh7RkxZFwmGMk0B+N10WINFwqvfj5u VLQETP8PKjUAL4TOOkR8ZmYSfyS4i3J4Tlzxh588i+ZI9ZBlBRy1E+NhKEJrga2y3iJ1 yzsDkCH315r+1UG2SwRez9q3mtGrEv8UOYzg1p2ke/WGDCnxGk5vFofHHfa8f0bWhxna NoHnKUoRcZRpPsYrge0DjAWGgo1x8IcPVgBmYMRscG8xMl4BnA9FmeVxbG4HLEUSzSmz rtXmIzas3wDq/0kHHKip1k9vvvnx++/f/PDtm2/JvfqRAhHgzJaLq25WxTka3xhozehV SWhCKUl124+ZiAAcvZUJKaWZk1uqacuATFPlTsaOJwgUMs8RdlfNspDICSszxexVtT/W 4RLK7jZl8B9rbjObaIdY9Ehua7EJQ6CTCnDo9DbGNmFkEcwE8gc6TI0ZVbSn7pbCiICT DCftTbjnmOhSXQsYpkymLcPsIC+R1BRTX9T24mn2zOIrN9R4u0JpN3sbqKerOxEN3a4m 7nX+x9OeDF5vnM7Bifqfo4PliigUm+lguRukiijj2OU7GKEhWeRIwvgO9mcJbldfaI0o 5V0B07u0O1NDnDBye14+nAFpXkMKZ27VfTy+GTL0eE5ufNbQIclLpbLLsHENezmmoSfE +rgja0ji1Y4S4dbo91CQOpKbF6fXVSEKGAWkDujWeKS/7JTaeyLZLcf5+Zw4Fq6TuaMd ZjFO7bnWOaDE8qfqTkt6tNJbUU6xTCb9g+dF7YJzHbh4aTAgA6b77YFJ7U0yYG6f8XrP jSe8XazWyJ1IISiL5XK7u6H80WpPMwH5P8y4mUBnqWvxNZd+geeEknW7DpTZFsVS7L8z K9jOSB+Sf6wzEdDJlf6ATYyHuy1N275D/qvH+/vF7jM2EmHDMSVXUG7VGcxGmiNACq5p oZm8ppkBfFZw504MOPrx7bvvfvzh67+yjHhOBzklU/iCO4KSsyxaXu7Xc3QAT82Y26vq gbIIE8C4SXMzs2PuYUdz3QOaV0/XVNRPN54GS3uXB0oG5WH7rGRuvIbWsguwR+7t9Wdj j6fOOJ9GECbpSavW4/Xv0KnR03Uy/qu0KMOcQ8FGKkiIHVmy77/+4duv3/3409/75fWI 5jyIT9vH9c28cqqYvSoxxaaqIpkYY3XHGYPhVd5+skKqw9x4hU9DjY4anUNisSQvs4qn ms+ranskXajtcSsnwo3b5wTAf9gyQVAnh8W/EQ1783GBZRfs0wXYl6Hyxppp1DBHqwNH 1zVy9KWaw+tqdWxx4uyHp+PO1WyptduqRwm2AP+QuHOrBNME6fjMgTJtxRxMPcaqVScR yVqd9E3ZOiEgEACKndvXUacYxyVob6/fc0ZAgvGHfXVaSZsvbBuzJ47J84HMaWS2lSLs ZjCZ2HvqJOJg7AFkfXUSv8Kf/MSZaAn2piUZLwn11gmHogWjDkXrr9PT7YSoRJj56pr0 QFLi+DmbnLg9wF/k7LgEwT51PMUf9ddG/HmBtdLmEQn8GwDmNaaH9O/Nbw+rOZZ7Yz6s hXnQfT3CqiFLxl8Wm0fMZkXymg5kqxUL5v+/vCXDFtf/nMOG8eSqxc/4cXLCK/oLziaM xT+hcG7U8Yff/AxZ6qwhgcYLCz9/0zkW8UurEWgDiihhoeSJiAmi+0ValeJe4GiCTMBz L9biZ5ljzT5Dmu3oK2jmhufyAM+FeRTFeA+lkja36l2DD5GKK3h646gK6LQbbPil9zFN noAjaWvQKpyjhFxUdA4NWMhQaRpdEW1RN88Srf2+tbjD6TS/qPZsa+9eHmv4MbD9oRbk 0ACfSQA+2zTUAbzrctweoMGN7T1L5drPBlQvanbq7JgcjXkFg18AdROLMdi675LWIGFJ EKc0mlKUMgdqK0EL5rREgoU3TUERHIcg99QcoXVLMQVv6j5X1LHa3ExVUF/ESQQU25pQ 2iNdqQJdUlQwM8xMYCg45xJhS1UNRWZoa9CQX7QqkLaVn8zQUhFlojZvZ0pg6kDv4lJc ryEU+5zlkeqg32Va0NSKu8JUnQmWG7xJdVenTIewlEMxEZ+GiyuyOBUQrhx7o6Ss+fdr kcY4CjFHRjZTJo3TUqSU9z9CdkN1hw6j54Olf3/yTpelpsCzCcawfFdWYHWkrpLAfJli dmUJWTdzh9Bn8vSY+zV2k9QF1crSoIxKnPxKbyzrQN3x9/C8/JXvT93psinzSd/Cm00r mC+bVpJ1M3e6rube+zXw7gR1IsntaZUMeTbDqqiR7x1HWYn7wNCMiE0cfniTFqYxw4+l 0igPq0/MMDbSbaTBoXT1gmGkUyroUNB2hmYaxWkAh6ZWU4jJPEEsB7aQ4CQdXMQJrQxC O9AJlFijjNurZ0adkqqPamgS0uIKqZtb894SazoYleyQRIpDKqn/yHP4MLahngmq/3xo HhBeI/4HvkfpoZNzwFGf0fDHfiajAI8sxjflx9KQqk8f+68LfcGyg6b8Ki6+gojWf0Ta 7Lff2y/ajPcvC1PqQuktxio1klJIPTgCsFCTE2CBpYaaIUUGgFFjS4S5H4FYaC2TlAS2 ceAcHmRVlW6k+yM0aEsEqaF7Ye3ocIIMB+YRDQJUYE7PzwIFdN83CbEEcF9gr5XAEdj4 P/Ho3AIXgWX6lRuBKEBcXJ5ubfkT2KSIkFWQMgo44MTQrDYBg6qcVQI4sRtnNMAkGRUA M4KsiXQOxhFap5R909HnoPpj6CI0sn0SqCQqIF0GnpD+w8GkFd6lsRZTUAejUQ3NgSeG ZjQ4vZTebnU6fVjWwdH9huY8p0t1KDDPlsZt46pHbkEDT7iVbd2ZIt/FcIv7zHDIpbrP SfN2K8ZjFALCEgVAGgizmHvCDRqjGJpEEthZQWgAS4WEWGqFcRLGKHzv/9q60xglxiyA 8Ukc0RAnQKS/GiCxBH0DdZJX2tbLaweTyHuJGswb9B3erfAF3oRrS7VXGn+YOmv8YTg0 +INbQGEKvqP3E1Yy96fuOvjDCSa0U0IXfyBRU1hRROT9sPGFEc2gvH/kOPLSP5osSjFl nHmOoR3RG1aKWW88If8sL1b6eykYYk4p3TaOnJn2WutjTQ1cIC1QRzSSHBiSJ2lcPw+G UIrjhDJrqZhViw8IjZwPhvBnLgdDhn6hBUNygiHZH/PqKmEI3BMRZEe6S2p4KEagD+Mu wXPsLomrRJjbEeBD+ggQiwSPR0DtjI29KZlhRZKppCUJI5lcKSptd5ohEhcULOjRiqp5 DiLXftUk2CEdM0ARtIFTeUnIU2MJ+Db4JQI3AAhYKG+VaD2CGRZiMg2UJ7GTnpEc28kT ii5x0IehOVrE0FjOgxyOXUANckxo5wUlkYVgY+XgCK1biil405HnYLwyzCJc8CGhHk59 t+CjQLJI2gDM7AQ5UxxlamikkLQaNjQLD/jtTMG7VBVcDKFJXEZwmQ7BfUizBwxoi3Hj 2RpxRxhIYZrc5UWXsmbAlDr2HPnpxgMPGO4K44ENPHUCm34y+AQEAC9iBCVJ34O+Kwl1 mms4M2QZUO0V/x5nuXwnlYhxnJwLLkCB70p9m66WyrBLqgsu6DcFF/gN+g7v1uAhpu9Y Kl0Fksa/YyqLeqgSzI0BFpJTCRvklQYUhkogCOfeE8jQv491YiAiFmtMJflBnXGhRWHi WHFB6omRcWyssAxBmJRKwHi1ksajk4UWexGGib/m0eNH0dD0LZ9EDr9VLF0RbTDgLopR jKlRZIOcBTl8dzRvlFiAfREKEqjQV2s8n+GS0F+5IBRQbDz1AcuMdEhcORKI5cz3XEgg ST27SF7FwQsnSLaMY5YzFwlokmfk4aAvYJjoyAcNBRDzkpR0VAFDiDUm6613TYMCcHI4 dh2KwidI5SWdEBYKwKfnPEIlvHeA0AsFdLZpDwowzdUFTGNdEOQU9VNCHTIFKY5lmkQf CjCtW4opeNOR5zAPhiJCzbmYTAeblaULBTjRKauxIGeKaz6Z5kIBplkljPmufDtT8C5V BdeqaxKXQZ1UmQ7BfUiz50EBbjwLBbiBrZpmisuLpjlQgEsde24iFIhLQsTaHOPahQL0 mzLuBEhpGULf4UhtY+rrTEOBGNTu70kRyXcSFEgoG7LjZwClovUWOTvEFUMBorpQgO6V Eec36Du8m009fcdS6SqIica/U+0YCjA3FgoQp8rU0xVDAaYCVLR+Hw0FgEvTKPWhAIuC azpHjBUPCvSPjGNjhWUI8Bb+D5wB4EEBfpeVRq6VQzkixjz2u6W6FHcGodsG3WNFi9ur CyGg7ZBIG6sZpyAEbRUZCSHgWkNa+o7tPbM7oecrZ1vUyId94PcFIVJEsGhnQhxLQzE+ +IIehN2khQf4otTNSE8CXpBkeV1j4ohcQrBkeBvTpCRJ2logLx+mLHRGDOQGG1lpfgX9 GUlUwY+C1HndNAyRYpqRgyVSrkAQ7i0+DHblr5J7ukVshi5MvzrP4lapNSk4Mpm9cSLg jOiiwkzIdSIwzUUOTLMCj6QVOLENoMs4EZAGqiKHhKsCmNYt1aF4rkgEV1a05dKFDnQk aZmTzwAdTmEfOXbcR4ToDDuK4ClQXcbFDZpklRK/2aGo78s36YgI+DZVnTqlHPXGZVzo oNvAgw669fAk+zW4ha1aZ4oLHTTNgQ5c6thzE6FDIkOi2HyXNJx42QKGHbEE0kOAJWgH OqQYRAwdcK2hA1FVae93xFrROwk64MCSFnRIMa9Q36Yrhg507UIHulewgN+g7/BuhgaI eeAy+irAN53fUTuGDsyNhQ7EqYIOdMXQgakAIa3fR0MHBIHDoV95XgSWF9dkjhgr3sjv HxnHxooVIh5jg+TfgfZc9yPyf0RLdOTf1xuqbdA9Vtq4vbrQAQJdUFTouaEDws4RpZ9f Gjv0feZ84GHgF35f6CFLaIYjHRByvjFlLYIelOiB/A/6ZiR6gOFV3oeMzqfGwtU9OxEw s9QkiBJ7HzBpLUosQJJ0ae+DLdV51zTkoDwHmCZhLcH4HtStVHjkeTDMKr+D/VV6Hcxt L3JA0BFWOohbqzmY5moOpll5jxF+X8aOSkA4RlyQl89RJkxzHtOlOhQPOCBcM6aISaoC r25g5RYncoOgcQPl8kaoCUWH6sUUprj6k2lSB2krbWhWK+mXOwRVAw86cK06pRz1xmVc 6KBbwYMOqvkc5MAtbLU6U1zkoGkOcuBSx56biBwyG5iJ3foqEEEHPMh7ZfOzGCJjnA4Z wh4YOeBaIwei6tLu7wjYZuRAfeE7HXJMJxRyoCtGDnTtIge6V1iB36DvKFEV/4JrS6Wr IEbyaPs76sTIgbmxyIE4V8iBrhg5MBVvav0+GjkgWolSHHrIgQXGtZjDh4o78PP+gXFs qBgh4uc8nwO/y0qjrpRDOCL+zKHLjaah4VurD9SPNUJV2vYfneQc8zVh9SFGtBod7XXh 5Qf9mQ7MOJ/9H/iF35f9z+H5Y/ufl+SNnOA9wIPW/qubifafMtrDMeCYf6ZY608J6HE0 mjJPyvrbQtr4I2RBvghiRFp47G4NbftzpBwjr4i8DRBaSLeksqTtZ0a17Te/KtvPt47t dzdlBBltZUpgsB3bb2iO7Tc0I+sZ2eQYUzCm4F0ZNnhgM4tj/A2NSyFmQ5fqUuxzAcXX x7RX2zH+lGo8Ih+xtf5ARZjPOsZfE6y1DBDAIMuQ+mHTr0nGhJs3OxT9fWvCbZ26pboU +5zl2GpAtJVuPVsp7gmjmE2bW27wLt1fXMr2IFNsmakbM+SZ37zgQOd/u14DulfWnNao re3HWhw6Xv9Sp9r2E9XQzO8FomPZ9iOTf8v2w4ulbT9dse2na9f2072y6/wGfScjb+21 f4UMUM7vVDu2/cyNtf3EqbL9dMW2n6kQxNbvY21/huiiCptXXdtvpMOOFfTn8LHiGv/O WLEj49hYMcafn3ONP9OMtNtanZJjlFLSbqcITHHfdERv6LZB9ziypdurixog0Eg9dHav AZ1+kUQ5Z0q/VABj72fOhhqGfqGFGq57HwWC0sluKa9BUZBzcwJqwIPSuuIoWPgw1d1I 2IA1THix60JaCOxFkLXSNLkrTNKgaOA5yJAkmjQeoiWJgC2VEdAumTsu1HnZNPAQIzAC jEHfYaoMFePd49vEr/xd8i/vyX2iysvfnedxrxEEkg742zozPJ8kCMJ0EQTTXATBNNYX sMwAMNiywgRsmaPQeTk369IGUKD8bCkYe3iVFDzT3oMMEaQpLTYY70GGfZ0RPDhW92mK p0e5lAshmGa1k365JegayFfphQey9rJWnVKOmuMyLoTQLeN6D7j5LILgFrbanSkugtA0 6z0wPXjsuYnegwIbdhlB0LWLIOheYQLsuHEQBLb8GYSAa40giKpKe7/DCcQIAq6rFoIo ZZgDhSzQFSMIunYRBN0rdMBv0HcqvIC2WsbYYM5l9FUgaexdoDoxgmBuLIIgThWCoCtG EEwFFmn9PhpBQH/EWeJ5D4wQuZZTS9qAoeINfB4+3YHRpZDssQuOh9gp8Ye0jxB/Bz+w krCizhRP/FXLoHMcUdOt1cUPCCRHoueO1wG72xyvw/iAhYx0OYWUHPE6nHEDRO9nzocf +hhpfeH3hR8qeJUYP5RIhToJP+BBiR8qbKHAFgC6GQkfoKSAB4AecOhKSifTw1grEsau JtH2Akq/QAlbc1rKkmH5UEXQn7j0yrXeNg0+VMisAzRQwhgRenBvwR+YVbkgDMcVFn/h vKv1I7KMfQNupW6T6KGFH3AcCUKFXPSgKK7yUBQr8Qjzq7Cu4WgFhAuW2LcIJeuU0rQB FA86YHWyTOSCsn0SRzIUcUZIAT1MEQsZDnfGPmzX+aApngrlUi52YJrVTPx2S9F18MAD 16tTytFxXMYFD7ptPPCgWxBPslNEtbFV7OreRQ5+iYBOzEHPdZ8YhRngkYWlJ1tdRbQf yV67mIF+Uyiggu/Yeh0q7LxlrwOuNWYgqi7t/g6DzpgBPvcWZkB2Ov1tumLMQNcuZqB7 hRL4DfpOxRVIzFBRNIF3FWD3kIw7UFTUiTEDc2MxA3GqMANdMWZgKt7U+n00ZgDsh6Vz kjZkLDuurRw/PvrGQ3d8WKCgRlBH0l25VpJ+RKoHSbr7piMaQrWFyzdT2usSWPqC4m0v Szx3h2SGAA10KMbbvfjTu+BiDgb9mQ4OaZnv6YkamJGnvtADEMqr3CGZRIkJakSKLjbs tN3FzUvXm20Jnok8oAclQIgRIUSZvuhuJEJAxBX2OURZQMcWYIMOqUlNkicZEAmaDRl7 sN1WHWWRRPCLEw3b8hFQ4xVrvWwaQAA7MmoRW4WUf8G9x5eJXXBqGI6xxkOIQpZXv9vn cd/rXwCjyK7kr1AwzdUcTGObHeDcOHgmYrtCgVz3WJ+kwGRXdzCNn7OlmII3dZ+jTOAI UvJWKFLAoihJnRWKlHJJwbixyguY4NhVJjkQgUnG0ps3OxT1fRchmDp1SlmEYMq4CEHz 5yEEbj2LELiFrUZnisMNHDiyvxz/Apc69tworEDaReIDjCpK9WavHawgf5PWHzLgxDVC mmnVX/+CBI3mytLs79JXoEpga6GPFXAsj45rlFcaK8hrByvIe4kDkAlOvUHdReSTUAgh oWtLpSsoDPd31FljBcONwQqSU4kV5JXGCoZKqkfHPerfx2IFHHOEFYrKX6FgWXCt5oix 4qHj/pFxbKywEEFC9Rg7Jf8oNUT+DY8OP0xD07dwAAlmVUDHnoxPHB+fAESLlQZokyOe gjNuj+TPPGWmnwEENCNPfWEwECD1U9XQ2ZQsqyzJSYMQSORPLAScNiXsSdnOUiHTYtEy d9tSW7tNwwspuHJRYIVe+ZwlAsMaAD2t/8gcFUgAA5c3slf9Il59+4X4Mo7FqwZ/K/Fq jT+ZuUP6rC9zc3fzRfBlLV79EcRUUPLZf4p3f7EnlA1gy/U9yTNdZNVOs4XZKcwNsjN5 bDE/iq32STNg5t2/Ll8zWuqAaRxTM3WGuUlKbdosx/YNzD69oZDmKXIYTGkzHgo5XBhI 5QTlTEPhWJtNHgrCGwpBz1AYxpZ7xM6pvM08FFpsYSUCiT/kPzqDyBvw7ZHxsdnZUxuO jBDaK35UItENwd/Exu77HTB0TTfIYzARjvpi3XCCK3Gcq/5M1aYXfK7G9II4cpKV9NtI tZhj9h4hZWBXLT6rE7D4V/CZMscGyaVF4RRXRzthkCh4XI3pg0+NPk4cAxlSc0QlYeMR IkK8blAq6TnWKU/g6y3NmfSesKoFhMn9MMw65b1sTdG0Rhg8tiijJaskOizqCJeYVikb /ApHPz3Kg52l0errDEw94RKHu8ZCBXRGgUXF1nrOGKiQE7QpKb7thaACUhH1sPWszvDY GtUZ+8+b5d1uu1ntcRjXdnOqS7KC3La+mnp+l2TYUIkgRA2bgyMj58Ly0c/Wc7rEZ2tU lyzppB9xt3h4QE7Xw/Zkl1D6LJnp5ZxSQq4HRHW8nJQgoq6HrWd1icfWqC5RnbGnY7De K6zdo7YyOJlxlgwml7ZDnj/DybAJv6Ao2ZdSW/1sPatDPLZGdQhO0tqcxFQphW0jK9R5 OwI55ckf+XLKqp+t53SEz5ZvvdsTitYpQ2ZCd+aa6almq2ZjYAbOFz+lOvvrOwFgkFkv CkyN/fpiTmFgUWempsCfhUWP++amXeH/B0iDbAIKZW5kc3RyZWFtCmVuZG9iago4OSAw IG9iago5NDAxCmVuZG9iago4NyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDc5 IDAgUiAvUmVzb3VyY2VzIDkwIDAgUiAvQ29udGVudHMgODggMCBSIC9NZWRpYUJveApb MCAwIDYxMiA3OTJdID4+CmVuZG9iago5MCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYg L1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GNC4w IDI2IDAgUgovRjEuMCA4IDAgUiAvRjIuMCAyMyAwIFIgL0YzLjEgMjUgMCBSID4+ID4+ CmVuZG9iago5MiAwIG9iago8PCAvTGVuZ3RoIDkzIDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAHVXVt348aRfsevwN7l7JjG/ZKzt8Sxd53dPceJ52webD9w JGrEDSUqJDXj+ff7VXVVXwBeAEjkaO3EAopAo6svVV9XVVf/Jf5D/Jc4rWZVnNb5rKzL LC6qfJY0cdm2syYrmniziP8UP8Rffb1N4+ttnPC/22u8l8zSJq2SxJDcXVHM2qwty7gu 81mRFdH1ffzbt3GR86vy5+19/NW36SyJ0/jtbXwVfxG//d/4m7eo0MkqRc+pEipXJ3UW c52iZJakKTgAD2+vj9fwu4fdYvOw2HFF+fGz1bZBD9RpXcV1WNujLfjleVuwqWdN3pZF t04jWvB3m/ntLjb//PGH//k+/uPierH8sNjE32/Wv3yKv/llt3jYLtcPW3mI//z+afUp zpKk+SLCCBnR8BNGbt40syxpHZOvaujm5axJmkaG7tHBcLHplNWzpJXZFM6f6BkzvNN1 0SihkzaznASZkTpHxme3hsUsjn9YXD9tlrtP8dcYhsubxWa+owF5gUlPArgqW0jNgIHo dfRz0s6Kuqpf1dhLklkNNTVelEOuvF3HkDVP0CS7u0W8hGx/T91O/YzRBl0wTLh3BipU YpuUDfQmrvKsLdK0gY6Rq/io1kyrZta0aR3XAV8oSFVUdEpFxfOHm3j+BI4edstrYWev yGxmaDjM27LGR6Gni1nT06p9VhxTxApVuK3AatXioijiBty3eZXSY1WeZUlGZd6eVui9 VjyNMbKixTfz1raWSGrXWicVery+5c6fb7fr6+V8t7hBPbaLzQee8tyWB1XOnvY7yETe zJIMYpuaqab2SmZlUdRt28QgpFXd1udrJ4vFqjabJUWejW+n+c39cktquSsEo5eHjhZl dKr7KoRgBVyWZ1UxSeBcrx92m/Uqvl9c380fltv77RsefQyEfoM5e3CsvRwwz4D0ywoq RjkZPxhYspgJ4jiJbxa3ywfMn+XDBbjIq3aW5k3e5WL8GNkzi/dIwTZL0WiYtW1WFm2S eVckBUltNxCCdTYr8qSI02KWF1WRYnI3bVPkLFjPIwTd5K4LLLSa8d0JTfjjH7/9OquL +meWeHSXJy3uLtCTFvJUU+t/P2eVvVfHHZg3vR4+rWxSiCVoOohwU88etDytmd8t4qft 4gYI8+3deruIHzfr3eJ6F/P0v19st/P3i2eDj9Oc5BVGZ51AAgQt/vJT5+sfaJp0sRBo ioV++LpnQfjSmRDYJFGjB9l40AB4liVWGkmSxvdxAyaAXlrQ5GIV/8AowxVAK4Yj5ZWz Em9XrkQmAORyuaOL0/qkMGgkkBBUR1Q5gean25HltUWm/Fmega+UNo1nKqAwjWbZdrSJ nLtaOc5d7UP2z2rWqaoSUCqdYNaBBLToP75bP4YgJzpZ64Ow77B9LM3SWZZCZUilRWwf nYRntu6kWTlrGyw+tE7jMc67i0hi2EBKqI1uPT9r2xXJLGvKtFunEUsRjDvWvtAKH2B0 iB/W+I9dyMl6ZBt/XKxW8Xx7Ac2cl+2swqrF8jRkjF7K6FRBcLcQPePHKCb7ZvG4mn9S /YtVDcPwzeKdoz28j+fv58uH7S6+Xm82T49kAuL+2T6u10C67y/RA2qKVG5fVQ8U0Gxt Oc30gmW3op5Q2MZ/OMOKMoVmqmoC6FLn8SCZsNmWkRvMA4GOiCZaiU4DtRTL9TpPqm61 P6uga2tACK8px0/AiyiJLAFsymEb0i6Xen7OtsswDJuEFOzkqUNKwkEVb/V9PX+IZX1x EcEEVF6k40bmxVRD3mJ9ow6JMe49qIbdWtWCqa5nBz6rYJI6jxdMLEY9m+U2Xmx383er 5fYOxpinLTQV1JaRthvxtV1ihFjwEHJ2dP7tHSFDDDQqS62ZNa9nOfzSWGt2zayE1QdY YiZYCJwlJk9mFRl5R/uXMQAB/+AGXQJrXAN43Mwfrhfxx+Xujg2Fj9TRD7v4Zn39dI+L 2QV6MoN7oCxJCwlbrwqEYBlVqzX2dfgeqxSe+0KjCzAC1XXTc0Z0fY/ofWeIu1lur5+2 28U23i7gHp8D9D9ibMyv70B6NmY6ZpaJjrqosqKcISwBK53JfO7W3fqPCUCJKADlWP2P u9hgvyUrAZSw1H/ycB4imE7Vk1ozy7GMqYANshzGC2M6BnBhB1patud0oEFIwwkFS2DY FkfGbNzx6P958SnGUN1tlu+eaIkEiPztcrPdvbmAZMohmaqaMF5Y/QvpGDJ3Fe3n0jEJ jLjkajA6ZjzLL2cZhxe2ausc9piwTiNGEXAXPPDWDeY5mLZ38w1wDIbZNhaMa4cb6Pfz h6f5avXpEorQ2c2Fz8mS4wXbHoZgDrND0MgM06CahDne3i23Mf5HnfBujvXt2pk7ljto oKfHx/VmR4+gwW/YTX673jzfPdQXj0MjJeCDnWUZHIAh4566PemPIbV62F75EtJdKok6 5jN4+Ms4w9+mLRsj3M8bHZGXmIDwSNoWmjxchzRFF4ETywUpNh+BwxeaI6Lx/Ai8bCoo eZhjpyDw5f3jakHomm2uUGj/sf5IY+UNofLt+n6BqKEPy836gZ5hDz7mhYIzTJBPl1B9 6v9WTid37jlkUQ1XKdmIprT+u8U1NfE8fve0uVk8xMtbI/wJMj4rKktH6BGfDNqCo+9K YUAadYQio7iO94sePo//Eo0LsO4LRhIZEkx2HJ+r4UuZML3gCcaT65DbzeIvTxjbiLk9 CNT3yATM6yiIEj/GBIF0ttHROCnrCmHkWDCXiJ9oMgW/55WPmYJfbajxvb2muOXd8n4B IeG3FDyG5/AZ5jSG2gxO5cnj8zcrCmCHYPuwWH16c4k6I16KLYWdOo8HrHtG3EEjjdqB aGDB+0769jPYgRAxBKcgrFBT5OA8hhkPWGvD4JdwFzwQpHHYPrm+RhgZQbAtxSovSEQG yzDBypfQROqjUm5flSaqIDWbfFpIgMTqWO2/+AXrXDKn9hqbAnmoRwgef4LjdgdT/CWa nkJ2cwSxCJevquVLuNwqtcyNNMIzmHrcUDwuW0Lh8fYhF1r3eo7e0eBdAAYgtl8oYn+9 uUS7k9EGzmdEDxkmJzf8EJkGKDUo+LBECEJdwyKQQ+KmFIpNsYfA2yQlB1i8CZYH6vs0 YLIW75KilWALGa9CYfNcP8oOC9g4BfRhIQrscf69Pjb4cDoDy4cP69UHjttDg3mbBkYi vtOtbV2ancoeVaUz1vHDXNQH1elhyGxdmlon0XVH62SwUqdOe6YCj8hIth2+eDBhCtXs BxKmWd2OidIDp1GD6K0yRkkJl2Ru8mJkMTaYMUoziHMTOIjLUUGD1PBpgr2ahq8oTUrs qxzPExXSOqbMHVVsNFdSA+ZIaoatByYO8hzw2EmjvJglZZpOFsvnWBMjuC4ne8gULPgW djnRd/tspDBLPM43sNPJZhZsUP243vw5/ni3gEyHLN1cBI2g1doEjqFSWH1VzU9LJ9pN O6X5CdQhtmL9gP9v4vs1GvW77ykGCEZTirrYfVzAUIE2Nxbsh8Xy/d279WYbb+ZLcuDN L7Ijwja/sPqqmh9GiZbWYVOaf35zsyTXEuABzCur1QIWFo7EMkZrAYNvjJec7XMaWsZB W7BeX19iYw3WGbLSFWZfUwcg6hsL4YkhCXMM4fj7OWIQZJPCGxdRsn6CQQHxCBjmD+sL IDbrvlWOpJVH2Oh28Z8f1h+dx+lh8cuOZjOtpy/Agd1f3uFgPGQ6g5rC3iaKY54mJ3d3 850OkRiX5E4i6xjpJbTtR9gyaPm83GH2fvcQ386vd29Yc6niwt64i2gqNVkot69qpjYp 9ufZHf4jxjUtpW47M5VcdggauoYegjUXwW0UVmLMlupwtcP/pyvaOozgjPOvu6ysLITb V9UD2MVX0UJ6irK6+fQwv19ek08ayxffwIrI5nOgXrtrAyFHXO0hTXnunSSIFKsLxJVo ncY3pR2nyx3hWPiBdqT9ofrhcdsyILM2oHm8gRq6VEi+aHllbUhz713wnkN6I21PW04M AjCt+9MX4Zg97ciYYDVAXHuV1HnKeYamVZjcsgvERnobqGkQAIuoCZaV/Me75fWdMZJT KoQLSDa1DVIKJWJt8vjYYxDpNfUp2yBcXBkWPQVyMCXwhYh/TUyDRXKJnANFSRFu1bR9 yRcYi9REOaVm0IqOl1VzSR6BNcoFKmw3s0yvMAEBsiewYPWQGa2UACAE5RuURqDuIvMG Ljo4OG03nG3evKghMctr7P6Hm+MesT2wBCK3x1jjH96blRHezE0hZHtD4q8JxdB7TUQ1 oUql5dgiyiwnDogZ2HDoUs11XQPw3l3VNHHKrOD6MzN6Y5hh9DNgc7Yphhuh4ZpQpSwz JyFUT0aeNqxbw2FRVDDSTQxc2S53Txwx9IYtRTYgCAgc043jGHlFtJ1jRbTHjHeJSaY7 /5XRyZPsHOAFezYqZCcR+Xu+5fCpsJTuYHdj1ka6FlJXab9Ri7SDKmKYwj+STgEhNVTD ElHkBeeJwzoe9xlCvC8ScehU6eTmIdf6/Hqz3sLkBK8vWRB4qhhsh40Pz0Vw/c4fGnFq XV3a+WageoFVJyNOkRqHMlwGbsLjmTd70qxffxcYdmLjA7bK5DniQbX+kyf/SwxUbk1v nIbbHs4c+YXYYTinug0xYhbPA7OV9bc8e3Se1lU5JjagQvuMyrM/6LnjcEBNJTpFh5tM l0Cu93ZA8fwY6BkOE9IiNhTyTwO/SP7tT7NGTuUB0RC9iXeaYQcjMuTCI1fsFAMSu+t4 EQuXE8s+50/ifYB91xOA+rdwTC1+mVMczGV23oivDwmnmNXJsuQcQCIjjS2tP0Y8w4C6 V+mQVRX7MZECDznbdhuOnoTL4x7pIeKfrpYP16snNmyj6y4hAaBmOS1HYfh8VU1Pu9ga 7ImaMvJ1dzJvgQ0V5QTL6TFFeXyHo6bmQeJOjxlvIJ0MoF52DL+eEW2P7vQDrwZtbuQK JrRW5oyssPcxymsS2TRI2hOFRgPEnP/tgZm9U2vclfYZD4K3P32BrCpPq5sByyKKtoRv 9255YddQyFygtbp7IPead/d09EGdYrUW+jND4oLPEq1cJBmSvyPdz5S5e7O8vUWYCUUn LzbPnrunda2do1LpIULw3E4PTZ81vSFV05sdL2aGAAXY9jxfqhkyQlUFNvlr5cdPagqX tsEw84dP/sLtEmpRd0R1OBg/c88ASXLshrNedU+TnFwxApI8zpcI8wfsuLlZkfuc1sTv 1k+0NYDCklzw0V6AQps6L2PA1fAX4XXIjNwrOM/R/A22yZL/Y4pou5t/wHa095sFhrfY zRmWb5fvEZKEHrnE3uNMF++wTjIrr6p5scsmK2x01+uYcVU9g/3Z9PjIGfcn8jfTNDtk quVxe+bNiK7HDSfjBTLZ0ozxGTpE9tHP79eXyVyHzQjszsmD2o8fGlNgVI6obITahru+ KA9zUl9g9Z+XyEqRTQyhun9a7ZZYxHdW/m9o/xcSHfhbjy6gU5HnHBMbJkPlafwg5KQg as4giGA2JCSk+Tp2ngOCf8ISxW5979R7/PA7UKeDSP6I70AzNeSw0bfuCJcRVkeAgR+/ s2BwYPNNqCrOdKiRzjyPO1U92nxnRtfUETncQ906jWi+382Wi93tBdovxaIkLbK2W9fP 2X5pgnyp+E+3TiPab7f98PH9JZpPDQyvaPilWB9xzuFOnUY032b7oZNY2jMLvZycSWF2 x+kz2AYYypnPOvhgssxLhEZ06jSi9Xif87HTbF6wBTXFaae2n7MFYdGbZRU213TqNKIF 38OH+ghMiBULjnlYbU0sMKeYo0l9ZjiLXFUIVvMYeFULmCKdIdnupMUC4jxWiPd9t1zx /uPbWCKAY25vH7AJFFrs7tY3vHdfnrwAkMsxO3hvVm44fVWNnyPphz2rbeRO8adHykZF ce8cu+ZnC+Oljm+E2l5koa7ZMnNh61U1NfJPwQyiJt6jAu1ithl4/huxzIxcp7/V6BA6 Ogm2Z0xDztLupUW+WXM6Bs2pf32RzQ3Y/5XCkh7nzNr4NdPDLfL/gx1Yl3bIbOe56s+V WMaKB7/Gr2N4ALemOLJskunuu1u4mYLWJIMIZTdaIqngG+ziBKyIv/nhe7hxKfMqzm7K f4ZvSjZ80nL1ot505HpnZl+TzMiAhjIypkyxnc5XUHZP7+9o9wbSquHQI0kyaHJ7QWyT kcomdDT5Q7/bGXiC/WGLi5xzoaNfWX1VzY+9aqU65RD0w64x82dQ8MwBWNwxqgD80b9H E4vZ8BbkFJg19pydsE5wjUZTj3Tu1ClOuFZD6wR4icwHAuGCdvpsdapgBtBYCE+1nQwf +K9F/O0cofiLJ+QcXNBsQIQP/fPNL48QXNv492QMhPcne0OHIrfmR/vfH79Hpij88PMl gKVupcwMs5OnzhE77484HjyNf8b4vDEnkL9wBD9ChUocWyoHi2U4B88dCzby1C68bM4U 41O27mM6oIaOGONbU5Y9Q/3Y3h0KUCkb4GIc/MKnCnIiT4TX92gr0LDgpw0DdPqgSfiJ 7JeYpBkoSH9V4mhRyhJpKLDtZSV2KlD5XdoASuS/R4xRAmSqg5YF60OOvJ9erZDTr0KI iqu6IaAk2pbUtHTAkDyzAgn53JsKTAupoCymzIuW7FHM97kk+5TUqfcUiu4+QzVQmrQL 0pM4mrSeVyltYVdzpfjcCC3qP9WnXMd3CEfM4o/xj2aEdy3Ie7da0DTLU0QA0Yl4fFxd 936F33Eud4nIb/tMnmJjSAmHDFzkhE7pDrKcjqdDGwb3R+/k2QqDmz6DYips8qJP6Tcj HCGGG1SQLpDpkbyDdLnC5pQWXYQAJbrN8sa9bG4oRYrQcUm0iD7U/VErziWiEMuWLd+y zR/XOzAa3B+9o86hQwWPppunuerGDMRg2wD73/s0mXODxtaeUbNnbKF0nTs6AnsUsOom nT41SF5481nnhT/vVYa4WX+YErxn2iaYY9peyGbI5lDioswgVCpcpDjqHjmMKCgK0oyO RMeZM6mPEyhejrRDqtglaSEt6IhDRjQ4oEpuXbnsHFSgAHFND5o/BlBBiKK4t7fx1Q+7 xSO5gv8TizFehbHDiiaoLfbEV0Qduq8UZJ3FubDYAnAff/UtWJRv/dV5PuCYQTt+lZZf oUHzX6dN/P1/uw+6PVWfVwvXGKQizFgL1zgmie+naGHsP5+V5qxQ7Gsz5VhaTxUf3lVD 0xtgd9YibweOQOH9NRWmd5+2Ag0HPBWkeLEBJoOTD9IpTfmEegxoeRfDf9+7pAbGqAAg 3aiEUbWM6xwnOpsTRzsETHbej+fxXWIWea/gCSojsmWsROTZSeVECHhKUjgWfBiiNCdW IuKdn3PiAc4TKANPqiBFYcYB8nto3mvmKQ+97HuPD9JEm1MVFIWkOB06RW54C41SUnpl haIUVAkFysYJTqX5OERpTsSbwiGnFTtoDXw9oLT+Uz1KgF+UQ19XSPM5bKQt7GouFC5K FcPBpzyO9RkHQ8bhjxp4TYAzq3t77+EPS2OoUCNZKal/c0NqCZMU9Q7uj97Jsw1FzdIE FwyCiUcYJI0UhMQN3E78BFfN3gkCsPceJrE0hhu2RHOn3xN4Yr8f/hreybMk2ZhP+hbQ ijaCBSu2jRic2Dupqr0Pfo2COwzkAWCF1KQ3AAEeabvrvTeYnzcA42sPv+jg6g3TvQPQ TU0dzE6osEB9hlDZI0KcsFCOfagC6Mwt409DoUF+d6EKZERbImGMD1WgdNLWhyoUXm+l 6jAQAdFMyKeHIgh1MH5w6v05WOXQZ14OrAz8gmOH0UpFaKX9Nf7zGtFKC03K0gUb7slm 0LTIOmnk0aiDyNlmQC+LzQAJfVoubL/R4DhSybCDHcl/gVRwJBIGICGVPg1SCGlK8qwE UgE8wYEkhFRg5UUqDDI4yLsY6fvenYJU0owzpTaU7smAsi4FqIgy8pc+66BgNRDbt+gZ KifyKEbo2YnlpAgYq3BKfABXlOYkS0QNwM85gYAzy1sc0+LhCdjlsajDomEPTd+LKn1K KTgQqf9eiZ5umprUln0Oh3zB6kEAyZhyorKFWq1hprHsWIqHV4RGBhiLDSxNpTzKMoUr AefBcA3gUnGqwNL6T/UoAV5RDn1Bqe1nK2Xb2GkCafUAsGhP9J7y9IU+MxWw4PQdXWMY VKD3HmCxzzAmaZPSM5i0yK5JaxJFLHpvEMuBO0EsyMZNEoKgqikZHQHrXOsQS5pQ/m6y m/CVqH++JuQglhO+ZxyBJORcgkEVLcCt1M38Kvfhr507QSi25vQdIBTlOrJfta3CsMPe SR3tffhrcIc2Gw1REmRYT3gW23GosyqwI4wYcyHkN7PfQy06wvqjkGa/XT6I1HCShEUp SRIPbGit7EzXuh+VJFZu+CX1JUmlbRPMPWmvHkghwVClODCrB1K6EaJWlg4DKQkW13TM lPEPOlPHC4MU+UwPC70cSBn4hQ5IUZNK/SpBSprAdS4ApW1J6QzGJtShhE0ivGeVdo20 CfZ+hBWF9+YDQMMOjPkBmYv8ipTvKBcaH1LGNMhGpGfIaQM3nSEGZwLpN2AVHPeGVb59 l2jd8sh4MdqKQtmFwGAMlc9mFCRQ6lDw/RSM0zPaFKBUSKnr3uJngnLiVXQIm5QNQsAb JHHwTCmW5kkUS1P5AYEAW3IN/4hS+AK1y32JQj8yrf+UUli09N6rC9hcgR59bEJLV7hk 8CEDTuAzgFepRpIZlYaRpfjgRJ/ywYnSrCxHmIwpXSkoS+rgoxOl6VOogzzVp7j3HI+e hLQtaNGJbWUr8S3F8YOypM/6T/UpU9FJmqR0koAgAFwTUsAwJ98K/8a4AVc4t1VtKJji OOfOIAq6Bpqg/F9EdVf295YSixl6Cu3kO23IfEkuHEIfdHVtDAx87aMP+o0xAkybpgRz l6BsQRMpXTsqXeFAAv931E6QhuXGIg3mlJEDX1kUhPYgKkqSK9Mm41EFuXuRoMO3e9gp M3Go+EB25FDRaYT5ZIYYgI2bbDrsdOLip2EigFn0MZJy3YcGmJbAf31k4JsvxntaSsBd 7CA6t6tFP3M+ZDD0Cx1kIOYLjNXXaL5I04KNA2S6wDwen2+QoAG9CCVIJ5ZgexP+4aJA GQkNUohzFAFoACWc1bD4kBI2NMh6oZEaxgGqcAuBhmUciZAUCqRqYMgInuqWNg0YYJUO VtIEFSmBCvxbfFnOfjEtgFs2XpiH6VfvXdx6SCCI7dBD0wIkoMfG+WJAaU4M0MbKushY yXFsRwnTSEHBvRAR4ghR0mmCeykqYXTBKYzk3Hfvwc6Po6RI5ysKgLm9ojzlTnwpxdea SvNRgNKc7tbSPYrUwdfmWq/+U32Kew+hAaZdnGSPKFqAGs+zm2gDO2WuFMcOioIvmk70 06dQUofinpkMAlK0vYIAuvZBAN2L+obd2oGAtKA4C/mlKAUEENXS7O/IvcZlEkzIMmT9 8CI3QMGKwYAAulIQYE4jciqa7o2C1xLkDmUrCKDvOKoBAUTT36l2CgJS4cZ9gTg1IICu FAQoNYIPNfx9rGmBTs3LkEUHM9sNn95Q4cCSoUMlAAGHB4YOHn+ouFkk7wUgQMty81EH sEfZM/uFQzfy8UlDQ8N3vBgl/JkZnSDeMxA8EwYgxAN7v3QrfmAgeMGIC3yCP3NGGDDw C/+/YEBOONh4MPjksCkWAnqRYQCdFobxw3c9CHD8GEOdABGdYwiMy7l/1dxmab5K1Ofc FICHFp4B8vsb/YcACZwDznuLLA0BD0LTp45RPLVYwBqBYNsg3JEOEGkTP9yxAF4nt4uy EyvBaZFISZ5OVJKVRLZkjyLfd6otsnXqP9WnuPccx04yoK2k9dzCWFvYCSylOG5i2zf6 lOtBpbhnnE4cE+tCc1pUUkPmLHftq8YMvxlll8FM41QjNnVY1YdrUY1ENU/7v+OUYKsa y05QY5wCSci36UpVI13762O6N2pPS5A7F9qITboS0mivIr5S1Uh1UtWo3DjVSJwa1UhX qhqVisP6Or+PVo05WfwayiVuh5GdNm7IYBgNHzKBbtRh1B8gfYpnddehFuhGLcubzh0x 4Ia7m86gCY8BP4bWV440P2sKYrXKEdoSnYQ4Wu/Y1AlrZMCepoK8YOu5xCG+fDhiKZ85 o3Ic+IUDyrF4nWvkGutiVY6UGH+ScsSLrBxtGCLl2N+3Rh6oIAuExjdIZuUZj5XkqUcl 2WlBYj2Ff8ppQgTvY8NAVmBquqeENojiv4eYgQw+cp6asvqkBJqp59Z2+SqddtQMlp5C 0ayWbLuS7QBKc/JIC7cCqpAaQB72aC6+yT7VeyZ4T1vBEw7afihLKyUdYWWWtrnPzKFn 9CUUZ7pzmmokwWHUYV2RkcJeY6w60zF+wx2t92A98VQj2fV11UjX8kxTiZL0f4fDgsuk Uozf2cX70zYkcVzzlagkukYvWsXFvxllqCXIHcpW1UffcVR3BXVLjumU6qSqUbmxX8DU gvJlQU1XqhpDqjEim9/HqsaigAWKw2p0AEU6jVArpeFCJtuYwWKHgo4NFGPGRo/gKUV9 pj/3nWnIVqc/z/05rKO+95RXkj4TvGfaxOdfmqm3yizgXudAPqtIcXQ4BiriNj1FOj5W jk60AD4TY3MUrDJfMFZOP3M+RTr0CwcUafYqFWnmuaHTpiK/1ng/NL1oVpmAt3LTW2Qe Do8jFzRAW4NDhiLKSY+QO1KhhsLp9ImCMUxIz5xMANhEwTrYhoDtaIX3TOctyLhJjmfa 2wtOCmNDh8ubDgIyt7BsY/FLvzLTZOhGlL8+TL967wb2ZeZTFs4RJOGMI3y9BamQfHkh JDfvEdZVBW7mIiG7L8S5P++F5mGFwxTvvRwRabAjNz5WyLGSLki0WwMznZNa+25mJPcX iqdfleaDBaU5cWxLtwJa6+BrfaU5tKAUvyRTd/89bZtAAUgLemhBGtnJciF43Gh39Z5R gu1QhxYGBexbmACLp3qYI772YALfMwTAledhxuy1Hma+lmfUw0w0jAuhOg9zpv5hC0Rg /RUPM18pTCCqgwkR/8bK3pZg7jwPcmY9zJ0rgRFcz5WBDJYbCxOYU4YJfKX1sH7l3u93 0cl9gEFofY7gEGNZsyNORwmPVNk6gozLZp45mDBhlNhBoaMEQNtMe5p0ErGmpCHT3lP3 OqGD6Wt489S9sttT9znWzXSqm9X2tP2IIuOfqe0p9M26ls+n7eUzZ9T2A7/Q0fYSdAad 9Bpdy1lauGXzs7U9n6unWpBmobeD/ri2h+YsSsRjOm0vFF+TY3zCjQkK4ruMukf+1gwb dryHOq9NVPcZcm9ZDQ6rAt06dc/HADp1j2A39zBko//uYXWPBRLe8gwDhuDNeUOwij5v EIrXZp5RgI5m5ihWf8YLzSl6fWoPxX8PTvA6QcQOVUCMAjl8WYg29xU9fFmIiHfxZDEl DWaKpxqVFih6fc4KWVu6o0gdfIWN6DVTr/5TfQrVQcS15doXfdKCTtGbJray2Nz6nHAn dX4Pb6FNCVBSWoCR6h1bJtD/bAXI6HqFlbwEkPG9UdJp7lkBMF2tFYCv5RlQ3ZVR7xGy UtvwdTh+sTvD9x2DQEZ1yHu+UrVKVKfezW+k0FGalGDUO5Wt6puuHdVd6e9UZ7ECwGnJ 3LhQdebUqHdqA60HXTuqu6LGDtS7dyQcrLxZC1tTE6p3hKRgjeCZxy85NKxON0NryuxG m+iMjGzVlQKgbWSAfcZR3HtxbhrBzYXIUjquZRz/O6McXj0U4BvP/TV/NCj0PEcYX00p AvYYz+2aP3r2Xn79zPlQwNAv/P9CARlSNajx/NkoAIFV3mJ4FAyAfKBtNz4OUJKn47Ho oATJARLA8mPWkCRSBAGJ0y1s4tI/YR+5WezDbIsPe+AAy3uwy/pfV/8JqU1v+d953giw FIOdM2E4CVHB2d2GzgLgHUPzBYfSVAZElEQfaS5IK1vNTfk7KBSnRzpJ8M0GlJ29pYJ8 VAAbC1IBefFlOawiHIvueBEKynLaUp8iKSRmefum09tauqNIHbgs1e5ar95THgLQZ3xU wDlMyNDtXtTGc5XSBnZVV4rPjtAAJmQXv+2sPmUkRiDxpbqZdh64a98EgCWyaP0MjWad 6FkGo50u8XFt/ANMNRjB/x0bONC3ho4TRzsYAd0j36YrcaJndO1jBLo3Wl9LkDuUrRiA vuOodAUI4P1OdVKMoNw4EwBxajAAXSlGUCqwSef3DkZAFhhFBu7K312fIzUT0nIF8WXI YM9TaOJQCUa+Dp/+wOhTaMqKHUAHFGNyieVUmj+xh89+Zy1Q9nriwBcZ0izoGTddtKn6 9gPM75rSAQ2GDgyYT+bnySFXsasF5sz7+LdvQ7+7hQ7PTwN08DMvtmtt6Bc60EFj0/PX aUDIoewFOsBnqOHkg5dCvG2NXuTFcIWTGORmpLsgRQ7nJKmaiJzNlL8eilpIsZKgq5Hd oEUcOru3YTmkBRIN1wYbtYLHOoVNQw4VDBWcGQBOWJiigR06FHwdHJtnLNsVFlreW/RM WM6R3Wo5XGtJixB7366gNB9DKE2nf4RDeOB9qClGXDEEvH0cQO1LBKX1n1IKStrzHmeV COLxchxHm+KkH3xQRRs2E3IwuwrAiLYXMsXXu0rzYYTSnJjS0pUSUVZ7kk4+GhCSPhPr Mz2C/5KwF2AIbTyHIbSBnYBXis+L0DwMoU/te2+UncFhiLzk7Zu81qdrH0PQvWh/6DuH IXJsNVEMgWvBEESVp73fi8JsfkO0AXJVYPYFdoaCDhLgb9OVYgi69jEE3Rt8oCXIHcpW DEHfcVSDIYimv1PtFEOQeiNugAxMCkPY7BCrAMs6SLhSDKFUoJHO76MxBKfCKTM/EM9O BV+BjhgrAYg4PDL2jRWdQziFwoiEAERoWTpp8dSY6e/BCJ3sXkn7pj/lGYNY8ttB26sP JGAESzII6ZcGEsjqho0x58YRB77ycjBi2Ac6KELdEK8URSBo06IIHGOGgUJ2g5EoAi8y isB+E4giczcSRtAOGcQNIagK9uqKsvMQtjE0tnUzDVKGDnksIQ2xeszwlyjQL5T+1L5J tG5p04AEEuRRch2sc6AqyQTh3+PbxDD/zg3A92SiMM/z7977uD9ogsDWffjRg3h+2s7P NB8+KE1nPTQ1mSHREErBln9UgbIB+/BBaf2nlIKS9ryH0ENkGAjxA45uKBqIfIcfACIZ wKDRkYw5ys29r28NxUcOhuIUvpbqUcy3A/OD1qf3lLdQ0md87CC8BdhBW85hB21dJ9eV 4vMiNA876FP73puIHYqK3IOqv82GdPVR0G8GDRQIeHHYocCGEMUOuBbsQFR52vu95Llj 6AjG72AHbB2Vb9OVYge6Jj2vmp3uDS7QEuQOZSs2oO84qsEORNPfqXZUJqIWITcUMugX iFODHehKsYNSsfe+8/to7IBMRRRYF2AHnQe+zhwxVgLscHhk7BsrDjvoGDs29zHTx8x9 Dzsohzr398sMaRt0j5tt2l597IAojRwGpBfHDgiGqJB59dzg4dBnXg49DPzCAfjQj2Ig sYWMUkhPBztoTYep0robaWyrGAu8GkvfuhtAwpmYyUnX1e8JxaBXcACgqzm3dMnpyiH4 je0HKwx61/wxGxKRyM/Yfn6Mr77+Iv4SIVNXa/xt46t7us3d3wXum/jqwfyKNNFflvHV r/Enj65whNLP8dvfu4M6B7DV9YgxW7Rl/Ahb2O2UtPkRroxFq6Rk0xESW4Orfzb1zfAH tZc/X+Guiq9+usJfcPEP5vbv8aeOr/7WEOWZfwFr0Uuwxj0Gf6v2EfNr7yh9MQ4xoBMC ABj29pjHG5J2R1d/F+a1dk2OMVrQkPJGEpZnZc1nAv8pfnBxJTwettfshNxfLzeSANCg yABI2I4YjCVTMx5L0uq/Qxti//OVDJoVbgt7J2NHfrvBbxhuPJJibyTJCVDPYOvYSILV BNFaaG5hSyQTbKVJgxlEkwjn9u7hEiNQrKV0bjZ3AT9qj/i1FaZ0hGmF0MFePzxnRlOq KGTSk36AI9qb014/UFp3jP5R/RDt7QcsJGgpMYAtf0bTBrEhgkr7IWSLEs9rP9D5yXu4 dP1wu94c7wfEwBQVptbL9gMSdMDsqWH4e2roy9Zz9MNBtp7VDwFbo/ph/vDp6HSAQ7HG asPvhucruBL7Rnh9xWLpc0yHg2w9qxsCtkZ1wy2d+oZzHFafjs4K2nadNT7ewPZSLIyr 3vaUIdNY8Qbt/MPGdNFfp7pjBOKIrnzE4euJrnw6zJh0SGTDKkX9HdMTgjhCvkJ5ZJAU Yw6Ruv8KlQawIXiiwR1gRW6IAiugvL8EuBLkoUDkb76ISE/ihHGCJX+DP7iTZ+Tub81v b/CHFGyLvyhHipPC+ZmoA3bCYqRulfmE/PlH3KGmKCxAcxzwxyD1ZNv2oMWxtrWDJi2B gVPN/r1HlPqNKw0gzfErVBlNLczZxo2oUeS3n76wbBFV3g+RYNg4qWkV/kSkZUsT1+aD 8iXXYlR0Yj4U9pR0Jro48joVh11SvWVQhB2uFZb6y4elwmaoRFf6kBYvTAoj+qt0rPDc 7Vin1A937LOwCsxBLRS5wYz7pIHfsTIkdS7YvvQnijTtl19EwQgdwogvjikCT8XaMfAL FVvB4Ym9Uz4j4fT3YLmAX6m5jAbpvr82Y0N+6zD5b/gRM931Txf8Hu6fQ2wdm3gwzLQl ohSVLQG/JyaeMPIb1BXCSe5kZMk4bjDGIUBE4gmv8ogMVHmv0wAqznTc/pZaK1IJKBNB ipUSpDxp13DO4ZFgfJxbgsHhTCF1GmRxoiGlQaR5hDlhxxKjvlgLZb02lbakNIvMIhl8 /GdQO8qH/8kM07Cz5A5f5O6VL4kIkxflmZCNTt38b1j1JCJK6i396ERf0I9D5vlzBFYB da9Lq3CW95W8VFhqGk72r818llkRTgDR8aJjQgUirRfKCmnujmQ3Mya60pljBw7rFSmo 6MyDM7VfCUMnNpLk2FE6sP1IfLz93z32Ito1XVYUQa1mMPzFscjhCSNDV5eKMOCSoowQ Gj8dzM8LGcKGMWYV0zBD2DG+rF4yceFiDIClRQWHjKujA0imo77yKwgAoBZ5U6kylIUa SjcZtTITVB5wsZHiXDcHDk32U4NiFKS3g4KCXBAZt8+idXC6C3fyR1sghI8iGWQOynzX R0VeSAHSZgG2i69kLrMStMsAU0CkkFEK6CF3wqE9IUrEULZIrcJqiBDTqoZ9d2ScRJ1l SKd1wOTojn2WFIdNj7Kq77FU9vs17DppJOkA6Z1vjE781vz5d73zdaF0edicYYuHZYry tO/5a4OwFJld2ik6haRuoYqReSVjbBRe8oaI1BRf4lppx0/pRh+djhbaOIswpYj+Qf0Y 6kxtJWHliB48KFqmjEDs/oGuws6KoOpHFz4HNSFtKMZmksBs+Xx7WQ4Nzc6Bz2UvO8zW lLGi5uOQrVH2sviomYy2WaYvbrXMkYccNvwjC+MzG48Ps/WsXgjYGtUL27v5ZnFzvCuw TQM5vAMDMvxaVfIsDynt0UEQvaCAfVP13F1xkK1ndUXA1qiuWN8e7wYKYKHwQgXoSMDw /F5AHDeSmRwW9ZM7IXQuHjIb0Qkre5ny+8CC8+Ou3MIKpcNMGXCuPqzoynhO+j7EHAEZ nDXRa22jBA5V7Jg5S5FvjqQZdIrjHsXquRDP58odz9Uxa5ZtbsPVBE/uAeHzf6Gjio0K ZW5kc3RyZWFtCmVuZG9iago5MyAwIG9iagoxMTc2NQplbmRvYmoKOTEgMCBvYmoKPDwg L1R5cGUgL1BhZ2UgL1BhcmVudCA3OSAwIFIgL1Jlc291cmNlcyA5NCAwIFIgL0NvbnRl bnRzIDkyIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKOTQgMCBv YmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3 IDAgUiA+PiAvRm9udCA8PCAvRjQuMCAyNiAwIFIKL0YxLjAgOCAwIFIgL0YyLjAgMjMg MCBSIC9GNS4xIDU3IDAgUiAvRjMuMSAyNSAwIFIgPj4gPj4KZW5kb2JqCjk2IDAgb2Jq Cjw8IC9MZW5ndGggOTcgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 Ac1dWZPbRpJ+x6+o9e6s27syBBRub+yDLVsx8sx4tFbH+EHWA5tEd3PMo4cgJfW/3y/r xMEDhW5C1MS4gSKOzKy8M6vwL/Z/7F8sTP2UhVnkJ1nCWZxGfpCzpCj8nMc525TsN7Zi L19VIZtWLBD/q6a4L/DDPEyDQA7Zszj2C14kCcuSyI957E2X7IdrFkfiVvXneslevg79 gIXs+pZdsW/Y9T/ZT9cA6CRI3lNAAnBZkHEmYPICPwhDYAAcrqfHIXyz2pabVbkVgIrL zwZtjhnIwixlWRPaoxT89rwUzDM/j4okbsPkQMEfN5PbLZP/fn3XpqP3/IwYJrGf5LmF WXGiA8z/eMt+Lafl/GO5YW8368+P7KfP23JVzderSqEi/vy8WzwyHgT5Nx742IE9BshX lOc+D4oOWkfZYzQBixI/D/JcCdhlwMQzPyiUzDel3HuCHmpNneekGsPcj0jdSt14hCM7 EDK2vS/ZZDabb8GFkwWbV9WuZLN5Nd1VVTljt+sN+6N8ZMvJanJXLsvVlk1u1h9LNl+J W6eTqhyDTbPcT7OoYJnC9aLsQFD4cZZm7nYA4v7pvoQJwizgv9PJit2U7M1bdr9+qIjE N+X2U1mu2K/voDxo0B+B2Bw6IcjTkGUKscsiduBncCgGEfv9m7alOOWyDPAP0tzP0hzK KgsaoB5VX2e2uOSQRSmnKW3AdERXsJY2+9Gfl9vbEegXBtwPYw5Zb8L6JekXBqlf4D9t mBzot60+frobg3wRZjgu4DFfEPlgyBNEBW2YHMi3qT4+jEE94+ZdEPWSwo+SlD+BelU5 3W3m28cxKFhkflyQo3w5FORQKTwVFm2o+rvbrHcP8ITmq7sPxj+q2OThYTGfTm7mC1CX rW9HMM/WZVcEviTznBbcD+JoQEwMX+jjZDNfj8CiJiYeDu2uIrcYzMCW5fZ+PauEp0zc IAbfvIXEsXI13Tw+kGfNJqvZGKzBU5/zPGIasYtiDZA94mk8yHOb7OAir7YQNUHO7Vq4 xC/gI08XuxnNw64qIX9MyCnNDWRzNWOzx9VkOZ/K4TFmQMfTqcL2omYgi5FDU+E0Um46 X+WdyldBNikIRFi43cxvdjQF/ghyGsaBz/MkZGkD8IYj2AlpBVz90mlPCbrTNPGzMNRB dwMmuM7e0IRkCyYWiFRAvxxpmsBLLWIlYbUJ7iQkO1Rj7DfIF0RGhpobnad6EHmqeUXi NXshQn4Ri27Kqtx8lMKIX1frMWQLflAagH81nhclWzGC5iIZFpcu1qs7JAWn69V2s14s kHe5eRS01vPwgkHq2Ag05nHiI1sMkVP4KBpbZdHhpXaguJlQNgOZpC4+IyAQIdQtgi4C bQH9IhWDNIInn+nsoUvFABpY8wKTMvn71a4iu3c/X20r/SMSdpv1UrBOVa5mNA0yT/cW kzIG9dMYCAYJ05helIgiMk5TPswBWZZVhQzo798weHM35f1kcUvuBqVPJaV9xq7vd5XU ka25Wu/u7rdsO4qShN8Rx2GKGZDYXtQM8BC5sa596uOAIDG63eyqrVWOYPCuE+I9dwUy 1NE30mcEfB96njmbF0LKQo5suAKpk/g/Sc/qEYRcVmBJraT3mnYiL/wPuIeDHKo+Bd4o gWlJUUR1IO9Y9ac0RPE0HlLghbpGLLhZP2zmk225eIRy+PP6U2nY1TsbPU2dUgPvbsBR n4S/MakQNglfb/1QwqaLKHaxKSezRzZBlQgKkU2kSI5hWExcpeakjxiOxicBrF4UDDQs 61m5UGWglkbzejQwdOKF0z0Voc4QpwruPrQ8t0rTGWINk3uWwOg0shKSc1egrVByDWFk 4GfUNZdjsG1a+GFECRkHUo/FtkmR+NASqTupod7aUWAFFfduLayIysSoK1TDgwkkV+st PCaKNasxJkC7QxrZPrw+2gTkKXIIyG84NxBhAuD2b9az3ZRigMnqkVXzu9X8FgkyKtHb gr7O/GNmoLu3DPX8cQiPQJIjGcESheRFET7LkChBjUIS/ovGhshpFFkUsaQJk0PAzdhy PZvfisQzxSNC8ISvTD+Ui1F6BgK0xURwSTUaFzXd0MIc7YWXMN26nzFJAx+GYVih5M2K 3U6mWxFrom9kgv9X8+1OOGmVbSnROfE9mngM1aszMRrVi2KJJEQuQIeizpkY6F1yLETw LyurbDOv/iAj+PdVycrPk+XDAk1SejImDN2en9abP5h0ptebMSbA2D6F7EVNQMz9Ii60 TDqpO/i8iznoj0yM1HVr7dLhl2q920xLOjAJaioETWZL9LZREKOyrKNOgEL2oiYgiv0g CYc5H5/mSCdSl7VDcmBAKxW6/qIgQrNXMhhY5D+t8BEjyIY7wTcycScLhVJHrndozMYA FOpijVpjOUrV1sipwvKi2IQniG11TclRUarks9Z5yFyXkEJI7qf7OdQj6U80lj7qYEKG Cg3yw80dRVBVF3SisL2oGaCMJnXwD4kSiMSa/F+jIoPQeL0kFtdTQWHbbnpPlb9y9XG+ Wa9Eky8s1+1ug7tHMVTGU1CoXhT54dkWaMYfRP75YgGKI3uGrDWE4avvV6vyM/veD0F2 0jgj8DYPQzTRhxlLFCJ9iHvmbA/HPCcpehQ1TO7ERX4SNP3H+kf26vuuJXr2KgAHi2Y5 as8aYkVFB7/lFXHAD5v1ZHZD3UA163mmPF+E9okkQtjTgvmLhrs6/omxJiwIBhbjvr+7 25R3Mif9i3Ssq6+oHIcG7/OvmQmxfqlIwQsahwuQqBB9d1mEBmUNk7tEjdbgzVFIiyKU VVqwHuXLc2skdM6FqFs3Qaq10JwsqY3V383jAoETMi1NUL0vSj10TaMZKmvD5KAdR+rv Nnr8kqiHMCdJniS7IrteNylnWvsaoZE6ypHVvSDyRfBrwqSrThyYT5SHJtP7svqwp6/x 2Z2JSHfJaCr2MSBjFSXiQjRdDgs3Xuvuo1rMgWpb9VBOt1j3Wm8g1KE2QvJ6MD6C/TYt YhrViyJ/HsI1NmteHZiYeg6Qt4CT+XD/iOL9ZIFlxKL8A0dZZDOQ/ZLJDorrSpRAKVP5 sCZHGo0gE1z0aZx4Tyc8YoXsRU1AxrHUdGAxn5LA5IfelFSW2yILDEIj54R02f+MwNnW C1RIKMK6cNFvJjWjm9hkQgZ8ZZhoBFQiXTlH/42Yj4viEexrUWBBpbuTDSF9splGOgI7 ESB0QgWJF3EY5rWjo53iaGXjEZb3io05CAF3/tjeT56+bcVwDExGmLYWqWFw1Pvdazrh cxUFWnETPDLH9iKxn3cy1KfgJHoiMRenWLEa4YBTkgA1DUxMGnGsOqMn3p7ehWRAEw9U qNzXo0UIB1Ena1EzFbuVNhaUJrcmotrd/BPmW5qI+/kdNXeTnhtDCRhDMcZs686pCJ38 UkhCsBjNZhLHGfoFGFZ2h2lWZDRfPaa1w0/6DT32u4kT9E9E6bC0434LhJzjNdLBqj3n wFKP290Krtp6lKw7JE9s6qBxvSgVH6dIUpgWEQexgoovb2+lwwsPDCvU0HhDRQ+IlPTH 5FJRcV7zkxsVyzGES2fdY4WquzFopjHPFXMaJdCcEneVD4T3bUv1JDGNMh+dy8M8gU5N mlXrhVhdR+t/pmvqIaDuYXjpepWj9cnEQo/5dpwmOlUeixW2FyWoPIeZxuZiQ8pjUvyg 7qAbX88XovirdmF5WEymcN3RMkdyW87uxPJSOtYyq3s6xpBV3f6M5ZsC28uaAdqvbdiy UtppaLIRC3hNIVgttYGRFQVhtaaJeqPPn9u3+UEukOpD53Onpk16UIIkGR1eSe/lu7D4 G2pNur5HWRepwo9zaouedAOR5890Wb7tTc693vo5VDcKo5y89SGKA2skqOVWdHmRu2ws PtF3O8aWWFx3XCIAFHi4m2/h6OlVbLIBptk1NYLA2VxoE43LsO5IdyOzPMy2HLHuyuwg RTTH9n8z2QmjzQraNFSz4BiNu5FxwhWufTTeWCIaFZGfIwITEnoZm+0hJEBQqLtxalq4 sy56zxp7oYBn6ykWT6FLf1bezldQxMisvaNwAb2Jkc+pE2ctNg3BdnxycxFYQrmtyEhh mVpBrVG9KI7IsMNJPLAbh5w3Ff3S4S/rLbrmQWOxspdRkQILKODzYULe//r6VRRn0QcV NMtrR9GHasUQ8kkC04uifpr5ie7ZqPH+yeI4YmJN5q7XcXzT4AHRGXagwn6YYJJoKLwq BkCD6Ja4AR2kEL1ax86ZQl2Tv28C3rCFbbXi4n228ox9dhkN9XZeTZCs93lS72HbSlfS KTg9h42iTZtbE84vSTrT5dYEyYF0N84bttVn2Ou3xTZXrS9NKL8o4bBANSe3qwmSA+HA c1ghU92TTaWKBbW7UgoF1taVFzv651RR4HByN9Ib2Ci83D12Zb26OKjIbU9Ro84RYtP1 E/B7AkpstQ7qY4sj0qLYUSJEB7ipatAjz5P+jtDGVmRZeHDmT1oaCmO+rroEenYjE6OL LcE25i1Qj8rNXr+5z5yJbaBQ2tOlCZoaNOVT4c/WJnKsaAzGqE1ECRL3XPvljmsCBpiD jgierqNQvkBseNuCtTE97Z2LXEzpEJj0apYWTEf0WhtCd4MwAE6zPX8Lzi9JO+iFNMgi KIbBvEc2AYumyzvaCBVRFnK7zU0F5WJZWSSzHWF05Rh+v67GaAQvyu+nnlO7Eb8Dw8Lx x3o7ynHILUTUPpmzGapdYvuqLeUk5a7zsNHkcMsAjAI0RMVy19rz531NT1ikUL0s8oc+ QgP3xC+o/6pJfZT4RaKBeuV1iCs2saUtat6gdWyy2Y7B7bqPNIoFau6e0Hy6W0ywT43Z P9+Y/PPtrYP12nJvrSbUR/XiXpN/hmx2FHF8hEB/BMLRJjczIbLfC6uWVtVyviV5pOj3 /DJoAhGFSh8RPLPJ5iYSGUzecfwds29jiw+O8ua5iadXKrRgcjAfo/g7HGEZ+nsSBDoN GfqitEOLOKetx1owOdCO/B3VycWqyRIrmsuP2GkKe5SLRBZFUmfbhcxqSgdZHk1Vok0P GfxhVR3RI0cOpKqjiq1ayZTyLM4+0I4PSDLM0fT74unbtXYjdeh13fJ5tNET22wr9mng 6pKyFVuYG6Pak1U60UYXBUojqK7V4yigdCy+QhMpFAabgz0BtjOcRFAsfkFSROwCiawI GjGwy3omem/TKMyLjB7aIy3SScicjmY5wp88oVxDkxYO2kCsl33ydJ4GFetNBV0MqKq8 flSZ7pX8PdMmSOft+YCgyYtQUoY22K3nReo9mwH2feIh1h7jioInWAHCIVPqiIEhhcVH M0sUguS0WWyIdaopFlCj+XO8BEuIbmRd9rSTfDL5BX//aISryhrEBmfe1tM6TgIVd/8e mc7GGukzVVzMaspoIMkRNn1PfWMrrEaGeX2US5xoZxGsAKnL27kWeesOG4lAHyXZV9oa SvLVO5KYIwsP3r3qfMbzW/sdT9IKLEPcI/bPxZIFzngSZWzJcBzQccIW7J1olbd30Vfw 9j6ElArd6Ccebk3VY/yEYT6DIQ+iG0NPPBSQxVAArtBw9AprlHieElzuKOFrB4SEQkmd ASXPHRqsRgBKRBkBmUEJfPj8X8c0n2nFEnR8vCvi7gIP3YWkxJ466xk+5mkznE1wjxqp M0dLNsOpYFKG06r/TqW1nR0eJ9QM9bfQ9Fz3sfBnJl6I5rE0gwS2YHIg3iihZgj/hIdt MI93NrmQruVb9irwY8ujIsfa/SbpoO11f2mH79otCBRp/lK3dX2M9UFf7nD9NERCIedY KH8Q1JMeUqPlB/shodkKG8ujC3lyg89uwJi/nuMzqDDjI+S7Ir1FqkZnsPE+Qz6Ro++D U4VRdsce1Yx7HYpzwARfJ9HdmMeFxgWkAUJj7B3PwJIX9hkgnsFTg9WXU+ciyH8t2esJ dgMrd8isl9hHeAGJoH8/fX5ATqNiP09Wuwk6n/kL+kB1IX80/33/Fl/IYDz8MIbwaL9X YztYePbEmdrzfY8vyofsA7zQmfxo/bN6wRxf8mP4KmYBJ40jfYTj0NllxI2JRzfCb8Rj 4HOqE+kxmg6qo7474l5sRxsn+LpFTJkjTh61GsHqVjmyYMiTRinyZnGKLcVS1BowhJVB Ge29YS5q3QbP9R5ZkfeSiG3dftC556gLESrUlEx40SnQFKcLQlP8KrDGKS/sxTit30uv p7CCJjKkAD/JkeTFF6SAKZ5ZQEyWZkxgJsYIM3zwPaM9bfR1tJM15B3IghB5ju/X6xEv TjI/Ex/2MWO4So3pq46NEFzy6V4Ms5AVCGoIBv3GOPLTHCxioQKSWJGqsWH45gudT/ES 9EwTWnIE9I+x/WuWp1inLK+J6ZMbAg/91NqIejc9x1wlx4Bka6R7jXi/vkrjTxCYMUk5 PEvDpKlr4dYjdVz0WOcqPEnjq6+ZCo7j7FO/gJTUZBSGKUkRBaR0TEKUYQKQBULHK+gq ziMs8sYR+uXiAJl5eRYR0e0xHeFJGLVj+vccu0rQM+kpOfEuHmzfkHNUIMS76QiZKLQ5 ewiUSSXgYy/ypeIciqP2BHVGO1bgOvELjvccefp3go6eSddqbOwbCHPRYi1wlnBI/M2o Z47wTilfx5MDkLsaD0CmyTwtzZiVnz28gqtceMXKdZczuiNWH1g5t7Jvn2UlsS37AK+H 7FsMa0/ad5+iTYMOZkxklwXHJxwLl2JsK4x2bHAnFCA22+dgKwxEYdFyaaz2IwUcFJB+ /BPJ3NopUUc+lzZDyMzuEFkirlR/xGfB8ZFXPPP6ll2925YP9OXAv6BzQ4QAoqb0tNfE 9BHmOMRbxcsin1Q3vezfzvQGiw5I+TJMXiK/n3wXBOzt3+wbbd7ky3oMHMJDJpE8hiGZ KuEx0I3CsuL7H/IxOHN0GTiaEGPsielRVSKPwX6ASo2J9L8Yg6Kh2kmBre6pdoL3khLk 2NABWzsjlNP30lj7ecN8B+hXJAZBmwwqlnJ69XO8m1AWvwsS0Dm8GH29+L12P86VA+G1 HAiBDi39rvkPhCENWRVirjJyD/H0sTgh9Woj+GS22AvTWvwoVGPdqzojUOx2LAARQzhp Ne8BhPYjpG2s9xAFyJcEmBLjP+gRPMtoST2GZxkdbMaMPjdPr41IGMSzlOWPNFydq/Ds 9jU1a6HpIPwYfZ2iYA0qRXcLuhqoY9O6BmwrJ2vPTeSyujgQnjDcIvmsHAiViDbmXZwL 048j9BtoBwLSjC3YpVNAx3gS3AMxao/M75l0SsQVxL11BwJtDOROgPvE0VQaaXFMxl45 EOJcmH6OTYTEE9QZnq0cBI6PeEj3wBwhnV3/HTDTM+FAGGzsGygFLxwEgbNyIMQxjQKs 1u+uDgSV5uizRUtYQsMRSlpqdlPLWR8uETZVeM0HmWIPl1jhUZxkxd4wlxVMzbS1ERex P6UuJE0a+OshWZQmBIR5p00cw31egw57ddBoYqZe5pwKUPigg84Ynctr0K9R8b59zbN5 DX3f0PIaUvIaiu/gPV+k15CKoP65vIaEh8L5GOA1YE0vvgvVcBrkUMMXoIUgARad1H2G AmkHYty6z9B+2kCXIaE4r+Yy1M+h6kLg23AZEpF6kC6G/N3ej/ODLkMAz0TorrrlVWNW eyDBrca0svB4gf6DICWLrXICiAB8UtmtgeOn9nIPZUFsZwUS1zwFjuRIGqA4a/IMHEVW sf29UXZmxNpWPEtdVfMUzJjR0ubptREFg7X4Fq7uVd0Rex+T9KgpQE0yKHcVQBqyWmWu CW2RscTvXFUzE/Y+V19B2GiP44uA8BylvabjWrJB/CatP33F0/oKWHRjfAU6pmvwJHUE B7r+O4q/KtmAFCkCxYavkCGGkO+mI2mjPU7HdV+BzqWV10+QZymerX0FOraj5kgnGwRM 2lfQ2FhfgTCXvgIdaV+hMar8GPm7q6/AoTPiSHQIaOaBKJHg7GGUmqegp7fDAoCxM7aH LTrX4D4jQYYN90i8NfOafdsCbkVYsfwBiVd4Ni5XxGjgbsZabgK+mIZud6zy6mQXnuYn cKjsrDBflLEGnLo9ni+7oF9zPj+h7xsO+An5ZfoJWRyY7AL1oTh2nsjsAm6EuRS9J7Kd ZZ+f0G7EowYj2ZLXyNObElstzjZjNQkyY1YesLdJGCDZqUeg4VDsLmj3DjPGzJi+6tiI vY/UEiol6BCs2080IiICq9tPUAJRTy1Tj10d5YjVJJ4Zq9tPfZ1WXKRm5dPtiIbB2kEL V/eq7oi9z2JttQPopShoTKihstFwZsTig2epsqi+Ck9qjdhrbL7epUpEcq0tGOWS7XHd kmbYHFda0gwenrWkVHXTUTWOVdRNo+rq2u+yFiPHi1jWA2xcj81g1LvpSEfddFy3pHQu baN+gjqDhGlLSu+xo3QEFV77naDTllRjYy0pYSotKR1pS6pHybY3f3e2pEiKYQEmR0LN spEWJ8symNb+LFNPNh1hEM1EdZYxxlTfhwSRdVo1s9VEWkFVGzmsCmpGWGN44j5JG0xP jTaKXgvVFE5YiPibhF3sHm0MK/L4xFBPTNvT3nVBoVvvzmZXD7zl2cLvQ2i0XnDAqhYd q0qqKy9QrY5R7gxS1E1CLErJ6NuTWJANSxWIzv3f2J6+ckp8oFSXBqgFiP+ZMzWb+GIM ekFQDFbd2h5Sc3Sh+iPcGXxnUdYv3rOrH79h3yJ5dlXib86uFvgTmzMUUL5NzBlWHX9b sKvvMBixKzS0fGDXP9t1GD3QqleBem4GEiMoRAs/VY/raFHVKMhBBfyjHqs9WIYayyt8 3A8flNvTD2ZApgwUqtnoeLAzgWojLHPbtZRkR/mwx0xE+MY6Eus6AbUHxjPPxGG0njIT TbScZoIWUY82DwlipjSNqLmxMQ811qFOwj3TYlmn2mLFGvYDHRFqbGkLxdCB+iiYb5pV wfPwNSqg2MMCC09a9DwKmdxqyazrOxdkCb5ICSXRgsxppsvpMc6k4LNAArCuIZ6uqzkW cCOJpr/7voeSZ9YQh9F6ioZootWUsHavrpSsLoNwkgNsIGMJDtVMnfxDAJOeDiI/VHlD yuss2Q/X++Cqk/sVDF0YsKs1/sLuLekUhk//VRYT27DRr8pUCuPoHTGOvdAS2yKR2faO GxrkkoIiOoaVzF8kfohiMTUswNzjI8kDqa3AQhP3CbDQnwUWcIALjshL0DE1fwKcZezq TwedjIN0HGCw6XOUKa1NOckeIKTxnNAGT87R798YUMkt+g85+p9y8L8bv30lz17CjwKm v1/JSxXiQJXuJwYif8xcK6ii3tUclA/wiEh0595rxiGg8T05PhIRUjlBNmnv0Wd1Cv47 AIez+V/4A9dTwa/I0Rz8E0gGFNUNisZNvFvzEMmHqkvrNPau/ix/S/AHPAbbSa8v8Aev UA/tXHLA131WNuQoMWF7Q5TLe1Px6mdXgR4iH1iRgbVtCNf7A6ZCC2jG/wVh8ecvktrq T5PamDuPpkKLhJqEv8qZ+Zt8QIw/doLGYewEHUBiGY8b5mgLI5Zqius4EFtRRGIoxMeV +okib0Cs50FpsbYQea7CUDfZxrYJI4K1zgfC2QzbGqdQIChp1vBo2mxj3YRS9q7kmp+n WTeY3WqKJX6HAUPCjZMw9APMg9mFMHxJ7Yy2mjiIaRlpnZT7MgN17axmXQGuWEGpZWWe 1SDYxSNTiNFn4IxT7kVCbR1ohG+hc4AzlN8D4Tu730MleHyeqSfLSsDAGfhaOBFPmaGm rH3tTtEh+j2iDfvRjuHAIGQo3Sg6CDDkxXLuyrkAjSyFL3XaXiVm/MsxdFmS0G4ZZNgb AniAY5Uu+7srfQ8p2SO6LEGneJHjK9M9ASNddvX2WQA7HtkkWLSD1fg9KWZESU18x010 1UoDWNXa3Yj2S9eL3U4pWcWcL8Cq5PUrllUI5BiFV6RcWe0kWc/WFa06h/ROv6JlGR4Q 6kB1tJqsK0N6Yzuu4Km5qYZBgKFmkSJj6wJYXWf9P1+yZK4KZW5kc3RyZWFtCmVuZG9i ago5NyAwIG9iago3NDgyCmVuZG9iago5NSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFy ZW50IDc5IDAgUiAvUmVzb3VyY2VzIDk4IDAgUiAvQ29udGVudHMgOTYgMCBSIC9NZWRp YUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago5OCAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8 IC9GNC4wIDI2IDAgUgovRjEuMCA4IDAgUiAvRjIuMCAyMyAwIFIgL0Y1LjEgNTcgMCBS IC9GMy4xIDI1IDAgUiA+PiA+PgplbmRvYmoKMTAwIDAgb2JqCjw8IC9MZW5ndGggMTAx IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNWttu20YQfedXzGMD pJO9X17bOECCIHBToX0I8qColMPEpmRScq2/75Ai5ZKyZC0NU2sDlm1IwOHZmbNnLrfw B9wCN2iAW4naagHKSGQOtPfohHJQpPA35PDm95LDrARWf5cz+hxD7rhhbPuvh7+UQi+8 1mC1RCVUMruB3yagZP3R5mVyA2/ecWTAYTKHX+AVTH7AxYQAPQkpeQ4kAmeZFVBjShgy zukJ6Bkms+MI3+ertMjTVQ20fvuLoXV0ApZbA7aL9iiDv74sg86ik16rPqYABt8W0/kK tl+f//zrEj6nszS7Swu4LBb3G7i4X6V5mS3ysnlT/fJhfb0BwZh7lVCEBBA/IHKlcyiY f3jIqEJXanTMuSZ0jwbDaOkkLDLfZFM3f5JnZHjv6JIg0eEOZSVkW9U5Ep97CAG+vA9N 7xpqEqSPxqE1js7PdqF2TrQPLiS9B9BXqb80gvcxBdD3FrN0NR+BP84EciV8H+s5+ePM oKcffUwB/K3Ku3+vxqBPMrTK0/UcT/hx0jZNFqSPKYC+orxbDmIP8iTA3HCtUDtHV0RE 7GmPUhvRxxTAXpnO1kW22gxgMAm0h9xbVD4uBgVJijDmOfJ3VSzWy5/pJsuvvsI/WTlb l2VawnS5vM5CWR3gcCVlkDWyL4ohDnc2/ZZdUwzAIljFhwDeea1OIiUdFYdnmIgBmB4q F+ZRWWPDywTyrHUkwDYUYL4oIF/kuwhITqsaelf4KWXXgzI14E8xryG2YgChfKdMgwn9 vgiW9SFAyQAZXV2KXaBHo/GlybOOyufqUuxiOiLr/Xz5FizoQ7ij2tAb4fo4z8qdF2hl 5ccGc0eBB58Wq2y+gZu0LKdXaYm7NKZWRXJCq2JAGgvSReaqq6hBfkoaj1bvMfKO1BqK qQY1dNRMybalczTqxuLJUAtHCqOi4skqkpOmfRBHrW4MmRbO21q9f3TJ0A7hXtrVHYTT mpZGUyXnVXN0XZ5IXs+DSZEmeN2kXSSYJBUd9vHez9l4otLWGBHX2QlOxvwQpG0TPAlv gu+FeNOXT07oyxtODWbVNsH3wqltzCehjflDmOCWypAnZgWGKZSSHeepHhYkQcOCw5ie nl+QH0TiysR0A2tnSDI1zWKqoUoc1ZK2ZACrij4mTMajoPFUXJgYSheXU9Gak2S2+hRJ PCmBXvm4zk4qZJrHlXdCk2a2ViWSs6umydXsMiYtYKRPNEGMCZOi+TpjrVWJ4+yUZ6SZ OqqzU46jNnFNPck6obGtV4nk7Ghtw9MIL6oY1xqFNHHlnTKkmXF5FSUt0uw1rrMTjjST 9n8i0nElqjIiqg6G4pwks7Uqe6XUWboFioZZ2j7e6TlXZS69xN3NskfTWapgEgFSzNap HMAEfNQqWFqDQrVO5SAmWpkbrwqWxqKOa4tPakeCGZdRkcqTYLbqFIcpkIojf7xF198v CumM93oqQetZUgqarO7Ws6Jo+UpR7b62PmUv684i4pIrdI0j2EN0Hr2kFSe+m7McwDSy XgraJRGqdSkHMY2ql9UATwsXU9NQWFrm3s1Z4tAmYRltzLUuJWRP5WMK76br2fd0XbyG dAXTa9wuDF/cL7OCdm4+TPP1tKCt4dfV4rD//zYx/f7lkka5IMTXMReK26cNjYr/ANPU DboKZW5kc3RyZWFtCmVuZG9iagoxMDEgMCBvYmoKMTI0MQplbmRvYmoKOTkgMCBvYmoK PDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA3OSAwIFIgL1Jlc291cmNlcyAxMDIgMCBSIC9D b250ZW50cyAxMDAgMCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagox MDIgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwg L0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjEuMCA4IDAgUgo+PiA+PgplbmRvYmoKMTA0 IDAgb2JqCjw8IC9MZW5ndGggMTA1IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+Pgpz dHJlYW0KeAHNW21v20YS/q5fMfCnFshtl/tGsjgckCbOocXh4IvVXoAiH2hqHfEgkwkp xfG/v2cpkhJpxBZZiN4EiJPIBmZm5/WZZ77Qf+gLBYYZCkLJdKgFKSMZj0jHMYuEiqi0 9F/K6ac3VUBpRbz+XaX4Oc6CKDCc7//r8C+lWCxirSnUkimhFukd/bIkJesfbb4s7+in dwHjFNDyln6gH2n5P7pcQqBnRVr8FZEgXMhDQbVMC854EEAD6LBMn5bw13xry9xua0Hr bz+btBFeIAxCQ2Ff2ict+LfzWjAKWSRjrYYyjbDg2zK53dL+1/vrP67ovU1t9tWWdFUW 3x7o8tvW5lVW5FXzTfWX33abB/pxAe8YYfQJXitNzAIZyU7Bxm1HKCg4j2ZwDxlFTPD4 0VM86R6zBZjULOJR1ASYHzKJkPG4ifl+lC/+Qh4aONliVGoMIiZdut3nxiecbCihZkS/ vv73a3qDQMlWtky2LmRm8LtAK6ajCH7XE37hxxvzmKnQhF75HecsRCEdX2yQ+a6zPLWv KKlolVXprqrsirKcrm3q3pskC5h4Rdt1hm8o0t2dzbeUbDbFfUXb+4Iuy7Io50ibKFZK BahVjbI+VXsTC8aVnFDt8QBvipWFLQu6sbRrrH+VbNewLN3Zqko+4eP7dbax9Of7d2+E 4PojFTmqVfXZptltZldz2D+MmAllTK2uXtkfziGFUZMCYLu2Weks79z+va2+Hht+6Pml /bLLSvde62Rb58c5bK9jZriIyDR6emX7UKH5buowevW20V081+jC9XefV8m2Nqado64E AVwYdcVMFtl+y6ptln8iZMEyg+S3RQlXsHCeLhk2Ab3LUTPdZ3M4iFGo8ly3mnnlH0az MAim5caLurw0Fk3yFf1zU9yg+jw4d0EjBB87bToa9FCnjJcBMp4SoSTTaHCKVc88HQVI AEGsg06m8Rnvrb3NctT4vWX/SDY7S9e7my7+FmczqECVjLQrIf4YVMQhMyIIO5nGG7Su 3xdwsE/IDeUD6yxZu+biWZhhgmtKgCgxNwc3OMU155rMjDYsjtW0YnyZpOs6uaK7WRe7 zQrWuXV5tOi3oK9csU5Wq6xuUvFp/W2lS83bYo6M287GrbZevYCKMIfqafNA12Ni/rve N5ipy7iuE7LN07iqd8jMgNaQmucwujBMCEAnplGwMfqh6XgWXTsWWxxHKuL0LJHa+Ulf ZC9mWSNjtA0tYDEGpETv1oWnm0K2gNcwkJQ2Wf08a2luNPAq+iRnxog2//nx0iJgYTsf jWzSL47D5Ey4OfpXYOPGEGrxkaA92w0BqjH1bFBjR0FoJgBMrloovw/r0fJuMXW9MJCJ eC3VaRsPw9HwS9742NGDPkqAj6xGSNevV3dZ5RBwB+5ty2JD75Jss8O+o8v+9d8+fPjw sXv9MzaG6LS15nj9Ri2fwlnHmsEFTNMY9lwSz/8i2yUdGcxUGANGb5eQuBkbtKjPF74J mzC35pOIZhrI6of9whAtKpCAvf38kAl7IYE956Q3FXRVbLL04ZR4Pv+KC0gcEy5j6kYn r+LZcIb1W4tH+PH2GsiUaevzyEZs7njuy+qH/ZRgsYrb2PFDJomeRgfTcvSsPZfuS+qH 9YRGg9OBCH7I5Agsji4xperer23TXrmmag9X1Fuf3maNzTBFC6UZtEBlbvTxKjtzVGbQ G3yqzAoUJc67gW4M2kC0HCxOKwdVDXdIc/BOhOJMcfQ8rTrNs49Qx61903phk1Bu76km 1xxwoBl8t6OkDJTwIj+omKOD09Pyw8Xfl7+8/cfP9Hte2rQAWSm5wcJ3yFxyy/aLR8v6 OQyPpCGA6sJ79kr6lDRUFDBtOi7QCI/GONQjOgDzrAP24NQE3sN+N996/4q61R7t91Nz 2L9dv7e6emX/UGCx2qIRI9vXPf1huNurSXjnQxwCuDPX2FpjSqlFP8Wc597tKceEBQrS yjS+z3jB3R4oCiqMdSe8BwbtxtDpBh3u9lx6OFAVzuefsl3ot6KfYs4xgOgERKejWzvm dgxwZ7x/It064sRDQ5tAarVlOQPAeAj3RvTGnCMqBTZeKYhah7XHPJuOQ9fWl9yPhkej KZDGr2ZdGQyOHbQ34oXhnLOO3aovqR8vKms6RBvafsgkIoyEuBCZMnajqT6hpT4sO2YA Rx2HDzweAmmu1sur1C7ceU1L5us9/6NFUp23J5GFRq3fFFh7ImqxvZGrLlRrqjLce9ic brJtRcVtTWPY9/d78hMItKCZJEBnVg01CtQStwert1/nd4juIKTV1CuH4ALnWi290w8K vowleGRNjjpyiFMYp7Nm+L6gXkQTKiN6txbD9GOZLUPQegBN7RP80YOessw+DVd1BCVy tcBN88gJX2vaYz3XzzG8tydfraY+Rbg0IdMtuHlk/FOi6QCJ3DzUZPg5NstdM9+X3I/w 0riSEF1u6sn0UlwRCVwh7i7lPAl5FYDH3OxgH4m051Qsxl/sPqLU1DzvKl2ccEQspQCC 0V3KDZ+u5Xksxl4Rf08m+gKg7JnDZincsXQ7YH3HTvVl82LUZfP3ZUICeE6mQLHIeJXB uGHB4frqey836/2345UL1Q0tfsgELqrDPOs5qu9ML9XcixCYZ3cc0pfppfKlCDmLg85O TyAIQ6v9y4JHt0vXdle+IuvOJLFPcL8uv32uj8Z+S/JdAvgLB5W44Y73H3Z//nmFUz8S 8uMcLUnLS261HRvQ/wcj2WC4CmVuZHN0cmVhbQplbmRvYmoKMTA1IDAgb2JqCjIwNTIK ZW5kb2JqCjEwMyAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDc5IDAgUiAvUmVz b3VyY2VzIDEwNiAwIFIgL0NvbnRlbnRzIDEwNCAwIFIgL01lZGlhQm94ClswIDAgNjEy IDc5Ml0gPj4KZW5kb2JqCjEwNiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQg XSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GMS4wIDggMCBS Cj4+ID4+CmVuZG9iagoxMDggMCBvYmoKPDwgL0xlbmd0aCAxMDkgMCBSIC9GaWx0ZXIg L0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac1aa2/bNhT9rl9xP65AxvJN8WOaJUCzYshS YwVWFIUs07YWWUooKY9/vytbchAlduZ0tekANhzbwOF9HB7ewxv4E26AaaKBGUGUURyk FoTGoKwlMZcxeAdfoID3JxWDtAK6/KtS/B0lLGaa0tW/Ht9JSSy3SoFRgkguo3QBH0Yg xfKn3ctoAe/PGKHAYDSFX+AdjP6B0xECehVS9COQEJyhhsMSU0QJZQxXgGsYpdsRfixq 5wtXL4Euv/7T0MaYAcOMBvMU7dYI/vpzIxgbEgur5BDTDhH8zSfTGlaPy89/XcClS112 6zxc+PL+AU7va1dUWVlU3ZeWL+dN/gCc0vhdhBWyQ+DfULkijgmn9nGRQZWuUCSmcdyV 7tZi2Fs7cUOo7brpaf9EP9Dhg9RFO5EOi4loiWzFOlvqc4hQE4Dj9Koo73I3mS1cUVd7 aHaGaVXIvmCeAI/CyC+1RBptgqo5SonB7Wl3Ckc+Gc2zCiZl2rTphbEr3DSr3QSmvlzA JKvSplox0F1Wz+Ek8WUOH+vG+ySfOEiKyT5YSFvCRIwV0a00JBbSlhMqxRs2UIz+cZEm 8HeymGaeDFsr+v+FCENlI6Xm0IPuArmFE2DIWvCpbOCD8zPnj+B44rOkgLPEe5e31QDn 5bwA3NiuHFz78jabuL1UiLJEUx4PFxYEZ2iUL4Jr+ab+9O42c3fL0M6abJIUqTuCrIDr xNdZ2uSJh7KAeu6gqZKZg3LavtlHU7Yq2XID/fKCakojUWh3ygB1eS9qo9dELfbkRVLP v3+uk9p9v3SL8rYlwzyZLVOwii78UdbZ9AEWrmpjfgTjErlxXHpf3nXUuY8E9NpMrxYb VPy1Ioaxt5Hi18uzEyGN+Iby4wvuMXlVYk0nxRX87op2C8rHSD8wLT20m9dtkjfJOHfY FddNTfYReSVR+yvQ3SqDirzSxFrZk00YBChjFMWqFyhhYBIWVXGv1MMQl1pQojUPK3ec EdPvXWEcaDTDcYDsRxZPMaFcid46RhkcsoAuj1n/bbKjqSRC0C51YWBSVhGMle4OfsO2 O0icVKxxY1A4OXtxBHYYTMYgZcZh5Q6PPByHiUHFSVOCp7B+kBBGPSmGlPkyPx2KC5Tk xEobVu6EJFSxsPqOK+TMXqoEwpntqaadNIfETxT5Cee9IWGS6IZQ2kuVMHInLUXOVEHl TsaMKN3PqAOJk+FEm7C0SmuyWRWWVpFKES50WH0nNXJmWFpFCkM0D0ur4PAHORPd2oB4 XPLWEt4EaeX+Rru7v8+OLZ0hjfPjRwt6aRit7em1IS0ZQ8rcKFV6Rzra1ZHehAlu0GF+ xSSXlKPxvh7eDWVmjwld8mgnl3wzptfjJKwguLOENOhBEkDG7JVKGAMMYTThslcqgWDS hqiXhcrQ79zFJB5U006OrFAxEmZYQkVIi4S5kZ0OcjAXkhHWj+ieaaeDEKYQHP3ftZm+ iZz2SpiCtzeVNuqUwxAmwxF5WHxJNWGPPu2mzO318hW3BvmyVylh8CVHW0m9vPseii+5 wat3azfpGREchJu4ocSydZweLcZn9+aGUfvk0C9v0rlr0EB3Nfpb6HO1j9P768y7Cs6T okk83vE6aq952dWH6+evF63Ny+W3fRhdvcXYr3ZXAfQvt+/YQQplbmRzdHJlYW0KZW5k b2JqCjEwOSAwIG9iagoxMjM4CmVuZG9iagoxMDcgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCA3OSAwIFIgL1Jlc291cmNlcyAxMTAgMCBSIC9Db250ZW50cyAxMDggMCBS IC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxMTAgMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAv Rm9udCA8PCAvRjEuMCA4IDAgUgo+PiA+PgplbmRvYmoKMTEzIDAgb2JqCjw8IC9MZW5n dGggMTE0IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXV1v2zgW ffevIPLUAh6OSJH62Ld+JN12kkW29naAbfugOkqirSO7kt008+v3UBZlU2kdUx7TaoHE TVvg8Ojyfpx7SX0j/ybfCAtoQFjoUxlKTkTgUy8iMo5pxEVEipT8SXLy+6uSkUlJvOp3 OcH/8yiLWOB5qx+t/yQEjXksJQmlTwUXg8kdeTkmwq/+a/1tfEd+P2PUI4yMr8kz8pyM /0dOxwD0JKTBPpAALvRCTipMA496jGEFWMN4sh3h23yRFnm6qIBW//xgaCM8gZCFAQlN tFsZ/O2wDEYhjfxYijYmCwZfF8n1gqx+vR99uCTv00mafU8LclnMfjyQ0x+LNC+zWV7W /6j69m45fSDc86LnA1iIBfEdLNePIsq9eL3IXpmuL2nkRVFtuluNwdl24iH14no3mftn sMcObz26gZXTYRH1lSNbeZ0t9tlGGFICk7xOizSfpKWDfc4Yo0EYwdwMzIN+PFovpiIM wl6Zm+fREJHJ3nuHlOHp/mtW3CULuJzWc4aBwf3v5s9btrlLQGRBRKOYhSSs8ffJrQQx p57wdUTshe0FiIA+D4T9c0bI+Pj+7BVnLP5MyMsiucrTYkhGdLWdB4d9zIIy7sdEw68f 8xYXRFpOckhO/kgfyP2suCrJ9awgyzIlWU6wpJIsZuRtfpVNkkXqIhZKgYgv24vph32E AollHQmRh+okTj3e7QA3Mws4gW/LrEjv0nxBztPv6bQ8GZKXry4JE0NFOVFmNCQXSTG5 JSyOQ+qEd6wnQIYarBbZK18RSBoy1i9fIQMax2IPX8E9WfuKNMfzp0Py39skvxmSc3x8 mRblDD8e4fM/0+KvGX6uPif5lfIqDnLSQCCf8bAR64X2yiBEhPxPdgjIxkYk75K7DCSf vE/L2bKYqPg8SosPiNWzXFUHi9lkNiWfnqmy4dNz4oJ2HlDOI58E9RLtnflvq5LMIrfo UNn6qArCQAWd7o/iA2xcEc0c5Lw+QrsQLGjj3e62D1vbNoIFeMRe0/WMjTrQmLMDCptS fE+4Z8t8ojZYMiWjeTrJrlVqgT8jCFbBD34Rvi6dL9K7LyjS3QXAmAYeorteXq8cnu/R IOA62vTDajmDC6ghWWZDVbIcilAFwOSrSpXPENzOs/wqnU5XwVBFugtKxsn0PsHfn1TS zaviYb6Y3RTJ/DabuHDHWpkJVovtlU0w6HWii6bYeI3qw4vl4hapaGsX4uEMER/zZVJU OpjnJOnwOPUjCGFBvbZe8e0hI/K9Xu1BGUsKroLOFavvxdUmRMWqstD3tMowz6nORY+0 7bDbRIDkU6+vT3YgowDViERbQvUXeh+t94RreoeVwFunloMdmiZdZCukaiwGvxp5/fDX 9faTTRMnKTCDghX6XtDg7GAQ/5lfQVZBoEvLMrlJyfhhnpIPyXSZ1tmQ2p9DF4EujKAJ I59vkd6LTEOGIWptCNbdd9wq0s2LbKqaOsypLqfh98qJBTHlaKPWlPbjMQceon8jCVvs dzxdlVH6aKIho3xxf7Wc3KZD8ho5JYSUG5VfKlHlTYIQp354ng3JGN9HRZZn35NS/fwD dbLPdB0q68X2yigkGkOBTuk7RbZqn6nU/Q0lo/tkOp3d17m7AycG3RStSjQ8ZL2QXcg9 cAObY8xBBjFSmc7kjk//sdmkhh5f1UJKpz8fXTrg1Zd1aazXsAuvrnrBUnAai1h7Mjuv UZnr6st4mecrKV6pEEpPOXR7DiFX8NAnegU1qxYrUA4PHg3zDJVU0kS2AyMHaBpGkEpa yPsRRXxBPcl0et4PTFyidNyjWeCL0FdayUYwO3mToseYTLO/VP64nC4yB56AozuHTgw8 bL2iXTzBoT0svJMIlYftzHIj9Z8nX1LIkvfZYnKb5TcrVfWg3Vsfeyn2AlQ7Fow6861q Rk9NhO2ZeH969ubi8nyEFsoou4HwC2rRaml6LuWjnosDU246GLJeZA9M2RcelT6yco3J nvgxpt2gqDvoB6wt17SSfnhcDyUjpvfsCdxICfDxNL/J8jRFnXBT9wEdmOZaWahX0QPT ZBhDEKoGl52ZHZ/CAaynLbXCgdBmKM2+E6VZC/t6ObtQ7MrtCgxBe16/uj0i9iAYyG6h QBXnwvdUCvMHWg3DFZEHlhHhSwGYEY28fsIW6bUauDh5ewknMEnm5XKKNiXcwCidLIts 8UAuk4fpLLmCXzgdYTzgxIl+oEux1qp64XRFxFDrNqPCFkybTlcVYMpczNJGuvALHPMX DI0HvZReuYWQQ6PtVwNKHduIZZcGVEg5RmPf5pAxjjIcq6tvvYJePWkpKfcDnb30Y3OL ADVsRxH+41sHCSnGncMgAlnChLqVvgMXp+p4k4/hgTYmC9/4mmbp4toBfwzddyZ43MZ6 TP6YhzFLfGljsuBvUX6/ryv53cftO4zEMczohAI6RI/Mj2FMT+KMXRuTBX1F+X3uwvig LMkI7qVP7CHZ8mWAw4mmQ7Fgb66OmLmgTzfNW1CPuncxMRgHkIlbmCzoS+YgMEEzr/zs gESOkkF4ljborCj0Q4pA0q0A28ivzxLVHF3WI3cXCboe+PwOpc6fqG5W/VHVwHtByZtl hgbe0l0Dr5nSFfVie5WU8QiSEo4m7ymGQmzGqdMXyrJXNn1QfZlhjr86HYSDKxV8+zK4 2n+obtVRaWOqfKCEv7/zCHcjMrXAbvVizjYgV2fN9z79c6WOIz/mcvtx+E7piA79Bm6D yvZRVJtkuDXZhZaj+r31hD5rJBkD0pZ40AbYJROugQ4srhJgTeA3gB6Vu/U+/rkZPhqK a3PXKQ+uyBtY3cPAmrDfH/L0qJ4wIFkYXpcsuIPhNRMsJtBjGl4zwGJCsuCuUw7cwfDW 6ZvxlI9KnpAU/VOU/wYkC/LWGbCDmMGxTyKJKVAT7lEZRN8JaW/YgmTBIATTT89wtPkr TjQ74NCXwKYO0lpwaJPC1F5F34yzS9xtDpoJDMjxSM9KbZzZeTJ4bBQQ+IgdfVNgZPnT 8yES2XqoNqqHag8qsqy9kbGUftxdISCgyVAfEO8HJj/2saXrqnHjie9yZt2tamsiPabP aURbE5KFz+mm2XaIeY1ma0I9JnuNZGtCsmDPWaaqFVsT6VHJ04KtCcmCPEeZKtN6rQn0 qNzpqs2EZMFdWbf2bdMEbNyB5W11jdRhgj0mfxzhiwdIVk1IFvzdFLPl/Gv6ACHRiV6L B15NfpqAt3LoKtVCpxSNcT06uRF4LVOtl+mtGj5TGi1OQyth9oyStYZ7Ah1xiqO7X7Kp GkmZXWPARtHvYEqtmf/TS+2TWOuHuEcDWv6+Yu1Furid1Zci4dSFA1qZ7uToJdgLtpfN jJKp2h7owGZTd7cQG/uwfeWUzT7soH42JY8fhFTqUbqNbbhL/rtR9DhXbU3cBpVtYc+V amtCsggLrlVbE+hRudOqrQnJgjtnubBWbU2kRyVPq7YmJAvyHOXCjWprAj0md41OYkKy 4M5hLtycKjLBHpW/JrX8Rfx4Mo3byIVty4kO8c6HHBZzSfrDII6xUFzyGbYgWVggbsd2 KtziSDzDBEIL8FYrtMli9hFufYnrGfhPZLwnzXAjh2kJt2fpl0Lf7vMz7fZv7+5zyC2R kkf1anpVMIgY4xG6vd8T7VYw3ISir5TuhyH6HCV3c821gQkp/qDr5fqtzUG8qq+xdZpg neJz9Q4BPS396CbW42BiuMZWq+5tllavIBjYv4LgEUv1zMVgh7ci4KYaTPfq2zUesaRf izCwfS3CrzCRb7hA4ok3NXA097jQI1W/xIRXNQysXtXwa0yoAJ/ChJNhkkd98k08xEsx enb/LQ89DGY3va4tYb1d+Z+nG/pVuiDJFOdA1K/TH3Nci1yub50bqrt64tVfNl8/XqqL krj87ECLaV7MoFdraxX/B3TAosIKZW5kc3RyZWFtCmVuZG9iagoxMTQgMCBvYmoKMjkz NgplbmRvYmoKMTExIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMTEyIDAgUiAv UmVzb3VyY2VzIDExNSAwIFIgL0NvbnRlbnRzIDExMyAwIFIgL01lZGlhQm94ClswIDAg NjEyIDc5Ml0gPj4KZW5kb2JqCjExNSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1Rl eHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GMS4wIDgg MCBSCj4+ID4+CmVuZG9iagoxMTcgMCBvYmoKPDwgL0xlbmd0aCAxMTggMCBSIC9GaWx0 ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac1b21LcRhB936/ot8QVMsx9NDwZHEhM xQ4GnDyk8qAsWlZmkfBKsuHv09rViJUIC5ItMVDl9Y2qMz19OX2m+zN8gM/ANNHAjCDK KA5SC0IDUNaSgMsAlhH8BQnsvskYTDOgq+9sij9HCQuYpnT9V/d/kpJYbpUCowSRXE6m 13BwDlKsfrT6OL+G3SNGKDA4n8GP8ArOP8HhOQJ6EtLkWyAhOEMNhxWmCSWUMTwBnuF8 uh3h2ySPlkmUr4Cu/vtgaAO8AcOMBtNEu9WCPw9rwcCQQFgl25g6WPCXZTjLYf11evbn CZxG0yj+Ei3hZJne3sHhbR4lWZwmryboCx1M3MNHOdpYsEDUx6mctMNxsuooq4/jYnEH nNKgvIXJsNhFEBBO7f1VeBVgQpGABkEVYFtddrSg54ZQW8V8M8on35CHWm6Ht15+PzM1 soCIMt2uc+MWt2sj3C/yebrMfoD9i4tllGVRNkJGYoISIy2m9AbuiR/XSy2RRhuvXI6i wbCGdq8zmE6OlmEyTeMMfo/gKCym86hY1pc8eV7ZaTnnyjWfcE6mJFFBgHmlAu9TXtGW EypFj8KNBn0TZ9MUzu6yPLpuhcvkSbrRx5KcEc4kONBeGbKsfFzLXp756zIqS/RFtAMS OdP+lygpIriI4DQtrsMkXiyiMYo314RRBbo6ilfmNRI5b1X+kCI7fjl5il+im56lN/M4 hP0kj2/SBcY/UC0ZrUO/4seT70/ZmQ5IYJkBvYbvlUW1IoaxfpG/SqVR24JPNT09Ooya H+smXC8qpFaaWCtdzPuBSQZIylS/CnkyT5NoD34SAiRYA1wAxx7Wlhc9MPsuG2WtkArp 6gBexYqwSCsd1e3S3mL6ObwO48UezBbRrCQdr6dl1STT9HoUqwaYNo0AXZ3AL6tSojX3 K3yQYhhXxf3oaTRD3UI6bWWj9j3QVto9DTrfcXF1FcK7MEmie647nCDEUPSSUnNogvaj odFUEiGo87d7EvHAkNBuXwE+JqWkksX5HaQz+G2z9CHXHYTtuubQ4a5itwPuaJHFyVW8 CXatBE6+tzjJtCSMCwstsF7URCwrBB1S9+LmJ+QPAgfpLdLith2HYIyMEW2wWXSYfUrY KtBIGRUK1qXy3LEMtgKock3syt++H6G3YUgkrcYGwp3hOXYdWPtl2HsbQXWNqbtdUWHH fvj/TTsCvcCGl3DUfOsTPMeqY8mTyuCVWwylPt56FCeLMLloR/wAHQ46gaZGMGjh9SNz aks4vkZVNvQEEyUi6ClZ1R2OCsBiZ4NmZ9yO8bxQawFKr/F7FSsKy452vLdjZq8anE+o VCHLfD3NyLzK7mQWj5HbrSGyDHRVncIry0pOrLQugjqQN2TvH0/f7uHHPM9v9nZ3v379 SprG3S12K6vvjmBnVDcJLxsRVZ3JKzsLSahijpv4kam4wobDL31Ilcy/fATvUxX3s3l6 Be/DZXgXJmGyWR2HboIcbq98jiLDwMfpXrZ8qccTVYH2yZASp2IorZWgbklS4IvJQRSW Aw8HLY1j0FcoB7oyZAfQKQbRaRo+YJdD9JMKlUuFgkwLrRf5UVqK7FL1y0XYkv+bLtPi cr4D7/bP8FGHmbVSDbR8FRruPddJHQ6+V5EUMKJ0PSfSwSlLupHEeXQBZ3mYt8cfho2k CrRXhjTYl5laLPQjXnCG0KqeOlbF0sOyhCfjPkK4V9ByBrLE79U9K0W40K6G+3HPUiNv rJULPzAJQzSvlYBuiWV/gWIK/FrgIENabLJG+DBsYqlAe+VwPEDSiBPAfQj4+6iYwZvo MsqjRdOOaMkB5hfccw6OXqxA+2XIcja630iIfDD9MYCyh2nP6ACjV/JNpI1wbj/ZdZGc WxNUzxmULKfRBYZxC9KWaG4DlBw+FGEMFwWcpHGSl785TjcG6Z5JvHrMgtQafgd7dhGb e9iznsmX+G7DAyfzdHykPUiLRXqZjDFPg1IZzsdiy9oEvP2BtotT9rlXygmT3LYxbfHK 9gPtAVaWcrizWOY7SGQtx1GSzfw4lDrhlEdnTa/yI5pVGTcz11HTHX/ASzbhNrJk+7q7 RHUPh6yjWlhB6v7Uj2kQpIXIoZ1+1zHRuB6gDBZyuaZjrxPkFNM1pSCzloDy9GBDD/Py as60dZTGjbfLTpcb/5Y8Lgy+aEon6TWvHL1w0ne5qoUJJYrnLzUIbYhy4tgDSOt9r0n3 fa8HkKo9C+SR90tnq+WLeiHtPjBUgN2AU24ewQRs0nUH7TFM8Bnz1xNrcUJa5Kg1IWy4 UzOBTDrtxT2O6Rl2kozgM79PZUEIjmsdbkVme+HvEnU9EsG9O/FyS9KvJlwwSYJKmmw6 +IvlJorz+fWuRhPTS+UmjgyIS9fNeoIJF/mU4z0PIL1IvuQG137rYftHMI2cL7mhxLLa TlvYdtvhN/andmCU1d16rrQJuhOpDRcEWwP8Ory9iXHFD47DpAiXuF+6U66Y2vU/1r/+ fRJeRjj+/s8IL+v16qk7XteC8R9Kg1uuCmVuZHN0cmVhbQplbmRvYmoKMTE4IDAgb2Jq CjE4ODUKZW5kb2JqCjExNiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDExMiAw IFIgL1Jlc291cmNlcyAxMTkgMCBSIC9Db250ZW50cyAxMTcgMCBSIC9NZWRpYUJveApb MCAwIDYxMiA3OTJdID4+CmVuZG9iagoxMTkgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERG IC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjEu MCA4IDAgUgo+PiA+PgplbmRvYmoKMTIxIDAgb2JqCjw8IC9MZW5ndGggMTIyIDAgUiAv RmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNWttu20YQfedXzGMDqJO9zN7y 1FzsNkEKuImaPAR9YBQmZiNRNUW19t93SJEydLNNBabWBizYloDDuZw5O2ev4A+4AmnR gnQajTMKyGoUHkwI6BV5KDP4CAU8fbmQMFmAaL4XE/6cQOmlFWL1p9vfiDCoYAw4o5EU JZMZvBgD6eaj7ct4Bk/PJQqQMP4KP8ETGP8NZ2MGdC+k5EcgMTgnnIIGUyJQSMlPwM8w ntyN8HVRZWWRVQ3Q5u2PhtZzBpx0Ftwm2jsj+PPjRtA79DoY2sbUI4KvyvRrBauvd+8/ XMC7bJLl/2YlXJTz6xs4u66yYpHPi0X7publzXJ6A0oI/yThCukR+CMqV3uPSoTbh4yq dLVBL7xvS/fOYhisnZRDEdpu2uyf5Ac6fCt1SS/SkR51TWQr1rmjPncQAvyWzdKigt/T af59gEaXTL1EVoHbAJ3EkVsRkJx1/amS+/bFZVpWOTzPyyqbwtvqC67DmTyMN7dq4CGD R5JBYZQH10KPqn2FQMdT9ahwUnUJ59P5vBzBeP4fM+bzEfxZ5FU2uYSXN59rCk3L7wMw pCKBJDwzZPs4MYXYBoWC9BHDnSv212X5LZ0XI3ifTap5CTqMAKTiySMHiKvk+Rosl273 DFHFlQWJVpaOKt3XxZc8XTf/40m8tWiym2ij4FLriJVwO7rjmJPWGnRSHjcnz2ZpPn3W jktsxuUvacP1mBcDJFsGhxSYhjafIo7BaY3FEKhrlzgKkDwLNdNNnzgw6cBKrVOPkeRO C7RWxZU7JdF17BsJeUg+olJ3jN7EBONZcuzRfkf0NdL/YdsGKwi1Fm3q4sBkgkErtW0P I9ttd5I4GW+Z+A1vc/auZU6DybH8qfk8Jkw2oOIFV1yYBGrfKdxIatxIpsz9/HQqLjCk MFCIK3ea+HQq4+o7ZZgzO6kSST3V++h6+xkTFwjmJ95BxoSJeEMvRCdV4sgdBcGcaaLK HXmJxnZ700ji5BRaF5dWqY2fYOLSKmQMKm3j6juyzJlxaRXSDq2KS6vwvoM5kx3EiHic VG1THoK0ciST/o7kzrGlNUmTB5ikJCVT5kGp0rmkSV+X9BAmuGLX8x7jloRiM3j/vool XYeJndukl3N7GNP9ZrIOGnmyxLQXZRJgxuyUShwLDO0s8pK+LfFIMFmHZr9Q2fHgmuXh UQ5RL5dQG8+EGZdQ0RSYMA+y00kO5pokym5Ft6OdTkKYWiv2JdcG7/ZOpSOnQQlTq/r2 zEGd0mEaljAloY+LL4VFeevPHcrcoBeCFDsJijqVEgdfKr6GUtvYe4TTqfhSOb4OdusW bafuJNyknMAg13HqcdPjbQbn6XJymS3ZUM8qSKe4unJ0dv1PXmYLeJMWy7Tke0ej+upR WP1z/fPTRfotA+X+GsAYXl9J6p62rwD6H9+aaxsKZW5kc3RyZWFtCmVuZG9iagoxMjIg MCBvYmoKMTA3MAplbmRvYmoKMTIwIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQg MTEyIDAgUiAvUmVzb3VyY2VzIDEyMyAwIFIgL0NvbnRlbnRzIDEyMSAwIFIgL01lZGlh Qm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjEyMyAwIG9iago8PCAvUHJvY1NldCBb IC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8 IC9GMS4wIDggMCBSCj4+ID4+CmVuZG9iagoxMjUgMCBvYmoKPDwgL0xlbmd0aCAxMjYg MCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ac1cXXebSBJ916+oM0/J OV7M98fMy8oyTphxJC3Cm/Vu9gEjZDMrgwIoif/93m5o9OGJbciYwTnHVmT5nK7qqtu3 blXzmf5Bn0kxJZMUS5MMy1BJNzVJtslwHMlWdZvymD5SSqeTQqGoIJn/KyL8nSwptmLK cvXW7n+6LjmqYxhkGZqkq/oouqezgHSN/2n9I7in0wtFkkmhYEVv6C0Fv5MbYEHPLmn0 I0vC4izZUomvaSRLsqLAAtgQRE+v0EvLOE/jki+Uf/zVVmtjByzFMsk6XO2THvzb63rQ tiRbcwz9eE0tPHieh6uSqi9/8c85+XEUJ1/inOZ59u2B3G9lnBZJlhb1h/iPX7frB1Jl 2X47QoS0cHyHyNVsW1JlZ2fkoEJXMyRbtu06dJ8Mht7SSbUk2amz6TB/Rj+Q4UdbN2oF OootaQzIKtR5Ij6PV3ixXa9pkm0e8uT2rqRFGZbxfZz2kfGK4UiaYapkHax+NIxNlh1J t0xrUIEny5KFM6o9jgNUeoBw7KeqqUhWq/NCd5H46c3kE9Z8F5PnBhcU5NuipE9vGCh+ eiv1gIuqJku2pe6sGRIumo4qybomjvRBpIyJI1xTTb1TeAZ3SUHLLNoy8CG8LrY3v8dR SWVGJYKAw1NxQuskwnkZFxSmSyBmUeZJVLLjs4eI0ExHUjRbI2HpoCLC0sE764MSNFVw vNFzHA/YEGVpGSZpvKQkpbPJnCz7hDs4/hbFm5JCbEdc0irLyzu2G3mcpCd8W8JteZfl /Tq/MnRQvjcNyVIUkY075z9LsOH8PGa+pxDnMFyb5HWoSwywQQKwfS/j3Ef8gdcdMj1Z tLD6xzQcg8zagEE51TAlx9EFnAwD4nQb1M/odgIfQhzDLwZsSYq0ug8Zhu3lIcuxHhAN hzXqXlMhszasDoAWEcxCF7XpJs++JEsgCMwI0x5itylbjpY+jDjRQG0tUSO0qbgBCD+N F+QtfqKbsMA5yOIkeO/SZDYNfO/sKpj5J/yNmf9uPPX+PQ682ZTeu6cLfMh35767cKfB oofg2e1Abe2g0APszTRVgR4tAho7MPOxAbSYz6aLme+e09k1mKd3QePp9ae3lfe9aeD6 UyDzYjYBQb2u3+VU1b9aBPjseb97UNk7qD1QFckSfLAlJWEh3/jYnb7zpq7re9N3FIwX v9HFzJ+4dO4tJpdj7wONLy/p49j3x9PAcxcn5P6LpUE/OQC1T1dMMitbB+V+BZKa3kX2 q1Pgw/zSc89PyDusHUfPipVdqAj8pyo6mfWi2x9E08nl1TmLEGAkTWcBXXofvADZG8xY 4ooAuQZ4jgOOoFcLl2YXvWbpoXXDOKtkXdI0uRtSVmmKdPwgziHf9ab00UNGsj3wphcs a12+A7737n2wYOjK9sOrwqsP94PmOjJjObWpQ8pS0G8JQW92qpp3oIdApg+uP3kPDByf eZdecM0cfeEFUyAhA0wa03zsB97k6nLs0/zKn88Wbh9CiibcL0wdlPttE6WbgTYP69cM Q3s0LAuVjy0ychAoYUD7UNH5ah+mrIe0XkPK2YZr1vTYxHn50Jwoo9crbnVDkg0oImLp gwo7U5agJAnFYBhbbCigzIKvtSxaAiHUluH/oM6lGW2yIuFVbR7fhj2gvCqjLaNpDhm1 He0pRL5M0ltelX8J18kyKR8oyyGhIGYpW6EUe+jBjkZlPLJjGDGiq5KjOx1gAJzyD5GA fNZ4KpijMyYt1vIXdiEs6Z43pW5iitZhcg91ocz62AHRETVqaweFHJoOWFPEgdWusGXY y8TGWlRP7jdr3u2r5Cdswbbgkc6EqTKO7tJsnd0+0DIuojy54fpwH/63bMm0WCbXtg7K /6oButzIku38Xx50OeBv5uiYjQDwRsfXuyS6YzAj2hy0TZdIiWKLt6sOSC/ur+myUZs6 KPezwR02JtJ6lgUAxOCkYR4vlNU7DN4gfDVZQ5/W6LzYkuFhhX5pVhIQMPwSJuvwZh3/ gsM1R6sMp2xSotLeoAvG44cBJt65C3tpxzSkvrZxUEECKuCgUdwtSMIlvI0cTJB7mxjf kJzxijW/GG5C5E7LZPXAP7KXmBI73xopv480bU6p2toh7YCOSTpZ7ii/ooXAcBEthShe bhHe9DVB4xEvNnVHuMJC1q30LyZN27igKEyRK30434RoYskGCUOH5XwZtZrRDSNXGc6c XR8YYb6sWsJOH1qBgpE7x0TRpjuVDYPyq61IhjmsYTTou+BKHdU7TNskyC6UNt7cp2VS 7B+OkHlfRejV+cYqJFZe73ALIhWts4LDwj2D6prL8imhRRyxdnqe4ChkgdtTxWbomBMF FtR7MaiYxWSzY3SUF8MCfg7TqIqRZvQGHgch4c5vWMkJIywMtYHS2zXoCyuXewXi2tBB Od8wMBFnduMhYYlJTAzfiCDPbqo5EbqN0ziHllbvB3M86rr7pGBjxGxIh+9DVcn1sQOC h+i1tYPaAd1EtdZIqS1ABuUCZ3dgIZs8YaDyIKSJG3BDUTnHOZcu4G32YgXXA0V7GNpW TUlVMYqm1wYOyumaJaEf2o1/MI6XrPYPole6HtEM9+udl5tE9dwOp51UZShUklWe3fMk 5IdS1gcOqig6DUM2MY9eOf8lAfHK1ycQn5KmsCDt7OE1phI5OUGdy/TkDFkY7obTX697 0Ay3iLW/xJ993UDAnCfqW9xT6iKC3JXl5ufT069fv0qAtZWU5benySbvdd5QGDAsp7Lb XGKA9kBtP7400Wafj2YhWl3r0BUMRdhCbd+boHk0V/pohbQbnU/SL0kJCldpGrjQhalp gNQmRB+OseebnHc9IG1AhmesA/oGn+LrpdshtF5h66BCQlZxP1AMVbfsiKFrVF2qwdT6 Brdq0qrJUb2kcLMBf+PHB34PzlY1P/bYRh8solExakOH5HzN0aRGxNiL/ZcMtNf6UNVD Ch8wWIsbd485xejPvgXaXGmqF1/7sw3t3Gu7NMtHtZXHn7dJzjtgO/LZR4gInffQogN4 pB+49dZBXm+u2oLXo7bt2AvgrZiihEoQ5kuIt/N1HKL5FS6XwMeCs7f90ex9lQEEpAeG byBqTEzvCSsHlZsWyg+9o8DOWMfjXHz6RnaHMGm6MNrhYp8M3VdmxM0l56M1tQAIULW/ C97GOdvh9eA/H9LEGI1Y8qDi0LQkQ3QZhnEVVzPQvFaF+H64JgDlqOsDAI54JMmcST55 vWcHlLqDeuGPue1ftyZFUsQNiUduqp6TMGr/nIRHbuL3oIpo9IJHN2iaiju/zS3q7wHF qO2zG763JvoMSvnM4yQ0lT2iQkiI3/ETf57EqNXzJL6/JlCt59akQO82B4UDsikpA7sO qzoWzsimSP9eNPX6JBB234uNRFaPCThY0qMKkh/RnaYzW9W4qoVnrjR3Jx8F+F+Cl6ol S47S+OmJ0/nYa5cxXYSY1om3+Qnhymy4BrVkX+63Deh7Qb+G6ZZJyeoJe76HU/2y+f6f eXgbk2r/tw+CKXR7Ye2QElo1VZwOtYJ8GBTHLt8XY/4P4Tj7BwplbmRzdHJlYW0KZW5k b2JqCjEyNiAwIG9iagoyNjU0CmVuZG9iagoxMjQgMCBvYmoKPDwgL1R5cGUgL1BhZ2Ug L1BhcmVudCAxMTIgMCBSIC9SZXNvdXJjZXMgMTI3IDAgUiAvQ29udGVudHMgMTI1IDAg UiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRvYmoKMTI3IDAgb2JqCjw8IC9Q cm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4g L0ZvbnQgPDwgL0YxLjAgOCAwIFIKPj4gPj4KZW5kb2JqCjMgMCBvYmoKPDwgL1R5cGUg L1BhZ2VzIC9QYXJlbnQgMTI4IDAgUiAvQ291bnQgOCAvS2lkcyBbIDIgMCBSIDExIDAg UiAxNSAwIFIgMTkgMCBSCjI3IDAgUiAzMSAwIFIgMzUgMCBSIDM5IDAgUiBdID4+CmVu ZG9iago0NCAwIG9iago8PCAvVHlwZSAvUGFnZXMgL1BhcmVudCAxMjggMCBSIC9Db3Vu dCA4IC9LaWRzIFsgNDMgMCBSIDQ4IDAgUiA1MiAwIFIgNTggMCBSCjYyIDAgUiA2NiAw IFIgNzAgMCBSIDc0IDAgUiBdID4+CmVuZG9iago3OSAwIG9iago8PCAvVHlwZSAvUGFn ZXMgL1BhcmVudCAxMjggMCBSIC9Db3VudCA4IC9LaWRzIFsgNzggMCBSIDgzIDAgUiA4 NyAwIFIgOTEgMCBSCjk1IDAgUiA5OSAwIFIgMTAzIDAgUiAxMDcgMCBSIF0gPj4KZW5k b2JqCjExMiAwIG9iago8PCAvVHlwZSAvUGFnZXMgL1BhcmVudCAxMjggMCBSIC9Db3Vu dCA0IC9LaWRzIFsgMTExIDAgUiAxMTYgMCBSIDEyMCAwIFIgMTI0IDAgUgpdID4+CmVu ZG9iagoxMjggMCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9NZWRpYUJveCBbMCAwIDYxMiA3 OTJdIC9Db3VudCAyOCAvS2lkcyBbIDMgMCBSIDQ0IDAgUiA3OSAwIFIKMTEyIDAgUiBd ID4+CmVuZG9iagoxMjkgMCBvYmoKPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDEyOCAw IFIgPj4KZW5kb2JqCjEzMCAwIG9iago8PCAvTGVuZ3RoIDEzMSAwIFIgL0xlbmd0aDEg OTUzMiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAG9Wgt4VNW1XuucM5NM 5nVmMpNMMoHMMASREwgkPBKSyoQkgEZreIgzYiSBBAPyVFQULRFM4Q5oSSFo/fpdbXu9 7W3142RScYJaUq9S22obra9brZdS23qv5cNnxZbM3H+fmYSA6OV+be/J7L323ms/1vrX Wvucs0+IichGnSRTeOW61o10K2ej5XmkgZW3bA7suS7+b0S8h8hUuWrj9etu9qhJIvMz RPaK69feturarmfbiXJPEWXVdLS3tn2wbmMFkX86xs/sQIPtpHw/6mtRH9+xbvOWym+a UqjvRX3q2g0rW62rLG+hPoB64brWLRtNUxxB1N9EPbC+dV37eHtIQ/006pM2brhpMz3K Xycqmoj67I03tm98qtZ3C+ptRNmvo43xJy4bmemHoAG6KtNiNF9wJn2mp0zKZ9r+bw0m yDT6yqJsslDOSJPVrFEBcH6OQiNtowrKZYJLlPqNkf/RyN8gSt6cegcWmYWSsNrfdAnT i/S3qgrsl0LSy1Pfx2T91Izy/NR3Pl80nk8f8HS28Qx6iavpY4Z9eQI9B3MKnYeQnkSL lX6emaOf/ou+S899/oyCw/86ms+1mLWfjtIG+mR0u1F+FLlIZ667zhS/oPQQbcxwv5Wm 8mTJLcfoCPVRD8Gzz7r6sfJ+6qbDbKH3uUTSaDc/ybn0Nr1IW2m39Lj8VUK0QcrPXm9h tl0YPXLxxfQJd1ItvUZX0jTqYz+30/PswBrvQtM36V3aTke4aASzzEhhX3EppDya9qh0 /R+QbwXWz9LKC5+ZJ7LMvs/rj8goQXzIaf4ZPdJ1JYN2CjEBfzPiwyhVp/nwh/XwgVlY o4jz4GvZLNMp+hPQfw1e0U976W7aIuxp9JuCfgFgqrLCEn0KVN+jH9EDw724FrNqhpe/ kvo+l9BFqD87vNIXU9MqgftwPGcT5HjxTMyZXsnEeTrCPxqeK/m+UTpEh+gvdIxO0i9Y pUPYmT/Buk/D3/bA6nsg4VZaQR8yJ0l+Gno14e8LLlORSWhy9rWV9kN7ES0bIMtb/AJW Ot+1H/54jo+bm/iVcyKJ6MeI44cw3+jrkdGVTHm/vIU+osvO4rwNfV6UHqfdiJvttN7g bVAeUvqxyqT0Xzi86NIFNdWzqypnzZwxvaJ82tSyKZNLtUkXT7xoQsn40LhgoHjsmCJ/ YYEvP8/ryXW7VKfDbrPmWLKzzCZFlphK2af76iINa/SCuhbdFqoPqQHd9uX3rijTye0P hlyBirLo5Ewv3aTplNuoe5oivRSujOpm7dwuX9blEvWDIAZf4Q806EoJfqHLWtv0iYsi wZD6qn+EH8W0emFdJBj061IJfpeChd9lrYE2XW1COxhGy6U6NUVESqSOV6KRKoNR5Isi +tjhalTMllZllJDYTVID54j5ZY6pvbaCunqdPL1kO66TV3R7r5J0qtEnahBERcmYjcp0 9nygc67O3iug0tlLiGHHKs+DQUPbmlBD22og2tZyBtP30ogGA7FAbFHEVeEPBg2hG/Xn FkZ6rTl1obr2HGhBRgP15ljRYhUNMMvGXrZdwkZBsjXM7pUo2w743ELcBpHW6OHdLSiE 6oEbOLlnOInUwJ7RLMKwdCdCN6PExpq6uU7PSgsRWK2HW3XaHegtHYjtSai0okWztYXa Wq+N6HIrhOoluaShY4le1Nh0DZogBFJLR0CYu97IhPECDR2BGOqibwvyUD2Gnt3e1tHe ItyEW0L14FnqIjuDA37dDdqguzTdjuH229/2y7EG3+qAqMZiOwP6Qwsjo7lB0QdO4Jtc Gog1hLAaJmtYM1dYrGzEbIY3XtpmGCe8uzWgd65YA8zwa90z7P/BmKrb/hyEdWAfjBTR IQAWqa1ljVBlDUYqIIHY7nZD1T2GavDXQMOaepHEQHg/XYXR10QaOkINwDOzIADBeLnk 3LHBoF6giYGxWIMQsbUN0gtk8CvQDDHSFcSEX2PIU6eHlxiElhg2wIrh1vpopinTARwF dtDDLfXRqFAqbQA9q2SnaUooEBPTZ5XoHk0NPgPewOTSxkWRhnrhnegp1UW+dMLnP4Fy Y9NIM/vQJ1Z2QoAkOItDjQvTXtAh8BFZy5J0AAO1jOXRNdPfmPUFn/8FjJ0XmtcSi80L BebFWmKtiVTnilBADcV6bbbYxoaWgBH5jPbDu/36vD1RXW3p4NkwsvC3eYsa9dyFy4R5 5gU6WtGC35xQsNIfdGHqdB/sHOdnZ+IMHg+/F3EWU/8EjW3YkfyBeWJ7SWBX8OtqpQhT SHJVBHGwEks0tBkZ4mMxJveLSJGjJQ2rF2cA8gexpOEwYt9bmGnFJMGgiKHdiTCtQEXv XBhJ1wO0wh+ncJkG27UIzsAwx3uV4HQOc0aGt4RgK18j1jd84vN8Gvv5iD/HXCF3oEps 5pAOv0vb9IEl0PFUpZ4NxAxz59ZFZL8kuqAk+WVRytFwS6jR8zVjoMAEu2RMDQUGQ7qq 6aa6yIC/JhpQXdggecQZMjMKN1UHQz9lsYmSR9W5Ruc8EVaETRUwYtPPrwRzZGCgIdaS 8b7R+qGr6N3WMRJHaS0QuEJJwKCGELf+NB4ud0io+rzw9uG7Qsk8EVSwjYHYZVHdIW52 uuNPRgbl/HWRALYhhO1CoxBoCHQIq+uBlnpjP4j6BX+4OZE61lIv9r8IHA1d/Bn/hpcD tkxMZGBoXBIZLi2K3Om/PTo5QYtLGxNkwZ2U+d5oglNdCaof04/3Inn5dWAvKQ0EGlbX Y0FUripFw6QgSktL4ZvC9SOhqLiTXNoWCwjnb4NaBgWjPRYtg78ujmC/JMShHo76R4rt 0ehszHO1mAdD0D0WxQxrMjOAGk1lQ+gUKW3ETjWhKYLNtrMejl4vQhjqDiCqBoTGQpHo iKSQ+M7VvozM10Dm6CTwl6Vnga92YopoLCbmXBwJwc1jMX8MemTqCaZzG8KZhgSJIVC8 IcGdTRgLEjKeDxpCwZBAPlqPpa4F7sO7VIKavxjh60bkxsjlkPY6A+GWvxPCrReC8IoL QnjliKRnIdwGmVcKhNvPj7AuTfgCjEdDGk5DGj4PpKvOgvT6L4a0Y0RQSLUa4nUYkK75 O0F6w4VAuvaCIF03IulZkK6HzOsEpBvOD+k/wmk3noXwpi9G+MYRuSHkTZD2RgPhzX8n hG++EIRvuSCEbx2R9CyEt0DmWwXCt/3/IXz7KISJ8NaDd2n84eQvi7AJL9YSlF2GzRgp W00QDSKJOsrymyiDKqAyqOlNOmwcEi3FIEU9TBLOtkRZUqdOC7qCrhJkjB6nw3Ln6U4T /ZXCSid6rSbibrz5ijUnh33KQZOTD5LbfNBklkzSQQ5nW/hg+VSNC33qFScG1AH1BM05 MefEtKkVmJWRVvPE5Ovi7TT5ujxO5FCDqTn1hqnFdIK8tD189TKZs2S+KostWcwul0uy O8c4JZvPnb8gT+ECM7c7uN3NW7J2ZUnUrXrZm9st5eZ0W+3d2YqV1B2m8DZxaqjSVBok xSJTfp5praSxTz26/Lrm5kKIpj5Dc4ZePYHUDOG4ubmZmps1EFwl5mCAXCoFy/O9eP2U UKwon2VqeS35anJ/cg1/g7d+cDL5/uP/nWTXh79+q7qFH+ANfAvvq3p/efK15MnkR8mX jRddSZwEmU7j3CObcmlNeMEKK29QuUnZqHQqexVlWRYvkXmZmSUzu81x89NmeZ2T7dYx VsmujlEli2LpptzcbpbtO0yWbRT2mjZIHrpB0jIAj6DLQi+osMlQoBlgpzUoqSh3u6Zf NIU17pfu5AivT96R/E7ypT98eLJl7uH4YdNzyX3J7yW/nrzhJbaz++V7WsXbuwR7/FHp wXmmg3x0Z3jhUpW7nHxvLke9vNPLEYWtkl/SpEZJycmfmGNfoFg91vFWWSa36pbsJvL6 OO+AnOe0unosqo2sPupyeHaYw4WODqnAvOqMAkODAzRnzonyciPBElCEljdrQh1c3Byc YYYJZqjuivJ84UITQuPMXhX2kNfe+PHR46nXHrmHL06+dsPt67a/fveWX77D45Ls4QW7 pKZPX5G1LS/1Jg+KIznotBQ6zVJWwi28dF94vMvOtfaF9hftv7W/bzd1KdyjPKxIhWY2 +9x5C+YrVyuSjOfEcCHc7jKZb89h231OFx9x/dIluVwOD92v4p00HHDmLlAd90t5np5s VXW62SK7d1htLjihFW4HVYXbweWGnlVPQDmoK7xOO+FyV5U1bzKcb5NGzdomGG9TiTkE w02Hv7ldQXewfBYH1dA4ZdavnkqeSD7NoZPvvzV09Viu7nliaDHHHkuUXMKV7EjxrORg 8vHk0Qb+pjhwZeF3/FvYT6aisIO8THIXIthEXSOxCdTTQdnPE83ap68IjIxxWXnAyE+P hHPyLCybc82SxZpIDYbbLLYF71hPWaVqpVF5Q3lXUTZb7rbst8gikxxe8ma7DuTIvgMm lZ3Z5HF02WU/ViU7O4lzZC957O3Vni5veJuXnd453iNe+SEv6xDOC3bRGK8hHCDadGPz JmP/0Ay3FsUhbCQATLhKxeCJijmDAyJoN20CbtfBSeDv3pkV5Xn5MysCBRx0TQ+Ny4Kz GKSfi7a/d8dD7gd+zZOTb2/v+kry7R07vqJc9st3bl//TvKHp/9LOvTvA0PzpUPP/Hho fgYDZb/hJ639lJV6PZwDzSWn2ynJTgGE1ZO/QJLdsqQqcJB3wmNQd8p2Q+8cyumySCrU dls6JBe1D3u6UIDKBgxX16CjtrwZGmjDgnvPSDux+/f7vp98/Y57tgsZD3/r9CnpyBM/ GbpixIefhWxWyqNrw7Md2exQ+J/s37BL7GWHkx25nGNn2WpjqxWHduwwuXrMqq2H8hw7 LJ4dcthnWS3ly6MCcHh/Tu8gy8U2KC5Tev8w8pJy13Qj7Dx50leTqeSLPI3NnMXTkr9I nkrtvOXmnV8twLlsFufw9OTzyVPJD5K/6OedfYODj/W9lPary1N/lE6aSrALXhkuz8mm nlxXj5TnMFlNPdlOu9OsWJ3ZSq6zq0UZUCTckZQA9si9OCbUlWNKtoJAGTqKm8mAelQ9 igBCSeze6gvTpoqIKeDQjIoZJd4Kb8jlwdYgnVzzpeS2rVt54rvvPjxhhrmYO6S5/f3j 3ugf+v3PHMLGIu343kM/XbjcWfMx+7OFlPTseje+emTo5ak3svIQQYx3GdFfXKBZTyZx HotD+qZPqu3HRjhpPr5bmdEk4UsJ/4VWm/qo2RyhftMV1KzotFR6gPqznka9FqmIlsqX 0OUYOBt/q/DdZArfLzmkSdIj0l/kpfI/p9fDl7B12LuuxP2WjRvaVpw0x+wViOy0Fu6M DGbs1BRZ2Liwrk67/OaVq9ta59/Yur6tffLcDWvbMFfmi1iqkkTts5cNTTKNoQk4CZ9P C7BiEy2kRXQ1UYI24dHgeqRmpMVa7Ti6UsrFusuRb0DahvQ1pAeR8EAiuUlFCiBNRdKR TJIbvDzyG7QgNcBvhm+2WKv+81heftHLryDbekeef+sdBS++hPIttyJbtxHZ2g3Iblif 51++fsP6betluoFvWL/txsLNN3u8RdevQbZqNbL2Do9/Q8e2jq91yNSutgfa9fZj7aaB dm7v6NpUWHBT3u11BcHbkCSpXzog9TxWXZxMSVqCpT6QMF7ZDuXkVL3Xk6XVOqRqaTZV U7EUkIrxVKRJE3gIyGipAWlM3OWqekoaIxVlGoriZVOr+sEpihcUZgpOFV2KRsYUxnNz DU5h3O4ApwAcMWseD8XNWk7tVH4VcfoKvwQLafxyhv4qQ1/M0MEMfYF/YvR7PkN/nqE/ A4WM/NMMfS5Dj/JP4opmrbXws7CXFa1+JCk1yM/EZ1ZBrldRKA5mCp78dKHP4qhyPsl3 UTGSxFr8gAysLo53C3JRX3e2gKykz5JTBRrqs9oMGkc9wf54T7A4wcF4dzGIL02UQ4D2 cxAXN9HqP7hzq7bvy9Z29Sha9z7W6F6+tydH6+6RtX09knZ/T3nxg/fx4IFjB947IB/o YS3cU+CvCvcA7IS0Pn6XSUtIa+NHTJowxoo+GLPzCWkBMWr+vgkXQT7QvDyDxm12wyDe eGBcppDvq+rHA403LkMzKT+ehzqGeuIWGxgePh03vOR0H8SEyqfjcN1+fovvi48Nov5W 3FNQVZvDT/MRwzo/ztABPoKBVDuJf0MqkkQB5FONUif/CHZ/gvHMDbsdztD+DH08Qw9l 6GMZGk/T1DFOxG0OyNDHvVjC+gT3QtlB1oetqg9bVY9nrKrHYdWneAdvJxcVIwK3ixme 5A5eTeWwdH58mxnmnRTvEmRifJcCMiF+tyDj++6CHod5HEQe14cOULogXjBWoISCz4AL BYcLHlAcVncEi4dOA8u/Ati/dsJrUgN9p7zeKoPiPi5sbjtlt1f9+WNZ+7gz2+jwYXmF 0eHD8eONDtYP8wqrpvaGe5t6cZ/FgF6Xryr89uSyKvVtFjPFC8caHWfGVVeVftCkHewy aervmn6393fyni446fGCgqrA8TnHHzx+8PiR48eOm+/chtavOJ1VX8ms2Tm72lizM7N2 56TSdN1vTN3XGUrL4un0+Ko6uyRtb5ei3YVZtmF+IZR/59ymqp1dOdoOsWBXSUlVuKu4 GBmCofY2SZYUyUQ2/oRP8aegH/HH/Gfs6cWS2L+L+ROag9SEJEtO/hhPDHbJgjFWUDOf krJBnVQjWZDMSDLVoG8Nf4T0IL7JfQtz7uP93AO6l7vxvxU2/gHoo3jqehj874J+G/x/ Af0BxjyM9G0xFmkf0l6kSnyxd0CWaq7hL2F8GU/laaClPJmngM4HvRTja8GvA70EfPFU Nx9ja5EuQapGKkMqDe+r8c/y+mZ6vTO87uleZ4XXVu61TPOap3rlMi9N8U64yDHxIuck zVGqOceFHONDzrHFjkCx06m6bJYcq82clW2TFZONWLKR7C4ulq+Uj8gpWSl2znE2OWU/ j7H7sgrtXjXf7lY89tKaSTUTaybUjK8ZVxOoGVvjr/HVeGvcNc4aS425Rq6hmqYK1t2N 1Lhkrp7LoIvn6hVaY0IOLNLLtUbd0rQsfXqJVl3ahXvBEl3ZlZBA3HXXLIvA08XhZpe/ H85PemNL1z1RfLmaq/MuPYTTPJAwThYDu3CuviTSK/FcfMHRZ+FEVfSKamP0NnHC3Tkm qpeLwt4xURzaz16o+0NztfNdN900urV34oQGfVJDq17a0FI/mvG/l42J+Dz9sICxBrLN 57LPWvxM5aabztuTMDwt72fYw2ucmUP0PXc5vMnWRfxRkTR8HtLDMA+kymAwCooEvya+ SSX49TT5jzT5dZq8kSZvCmKItLnXIox7yaK5jXo2vrBkNy3TC0OoPIfKTFRsobn/A9wE NCYKZW5kc3RyZWFtCmVuZG9iagoxMzEgMCBvYmoKNTUyNQplbmRvYmoKMTMyIDAgb2Jq Cjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvQXNjZW50IDk2NyAvQ2FwSGVpZ2h0IDcz MiAvRGVzY2VudCAtMjExIC9GbGFncyAzMgovRm9udEJCb3ggWy0xMDg2IC00NDAgMTcz NCAxMTY5XSAvRm9udE5hbWUgL1hRS1FDQytMdWNpZGFHcmFuZGUtQm9sZCAvSXRhbGlj QW5nbGUKMCAvU3RlbVYgMTUwIC9NYXhXaWR0aCAxNzUwIC9TdGVtSCAxMDAgL1hIZWln aHQgNTQyIC9Gb250RmlsZTIgMTMwIDAgUiA+PgplbmRvYmoKMTMzIDAgb2JqClsgMzMw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MjQ3IDAgMCAwIDAgMCAwIDAKMCA3MTIgNzkzIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNjYzCjU4NiAwIDAg MCAwIDAgMCAzMjUgOTcwIDY1NyA2MzkgMCAwIDAgMCA0MDUgXQplbmRvYmoKMjYgMCBv YmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvWFFL UUNDK0x1Y2lkYUdyYW5kZS1Cb2xkIC9Gb250RGVzY3JpcHRvcgoxMzIgMCBSIC9XaWR0 aHMgMTMzIDAgUiAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAxMTYgL0VuY29kaW5nIC9N YWNSb21hbkVuY29kaW5nCj4+CmVuZG9iagoxMzQgMCBvYmoKPDwgL0xlbmd0aCAxMzUg MCBSIC9MZW5ndGgxIDI2MTYwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 AdW9d4BVxfk3PnPOuf3u7XVv73X3lu0FuAtLL6ISqqsgxYIoSlEkBhtRRCwBG9iiSIQY RZpZJKhxwZhI1K+oIdFYsrEkm41fQ9Tocvb9zNy7CCZ5f79/X5eZM2dmztyZZ54+zzkS SgjRk2uJSErzl8xbqmpVdaPmFaTX5q9cHvzyxqU7CKH3EyLcsWjpBUvmOZdOIkTKon3D BZesWpT9uXIq7g8QcvbSCxfOW/D3N5b8kZCZrL3xQlQo/zq4F/cLcB+9cMnyqzaOK6Bt 5s0Yc+oll82fVzXhq18RMut3aN+xZN5VS9UX6f9OyOwbcR+8dN6ShR87L7sJ91vZ/dLL li1XNanvwH0P7n+99IqFS6+6+nA1IXNQp30AdRR/7D89URLWJ0i6eI3Aa1kmEoko0Koi aqIhWqJD3ypiIEZiImZiIVZiI3biIE7iIm6CsYmHeImP+EkAo4VImERIlMRInCRIkqRI mmRIltSQWpIjeVIgRVJH6kkDacSTTUjNSC2klbSRdjKMDCcjSIl0kJFkFOkko8kYMpaM I+PJBDKRTCKTyRRyBplKziRn4amzke4l+8ls8ityBKVtRCt4hHFkNbmG7MH9/eQJckjQ 0rvJm3QE/TnZSNfRF+gCuo73PoKnbWIOq9LTFyS10IcnnkTdOnITOUL/JB0jf8CvbiB/ EDeTVeIItKwiT9LZ4kis9XLJxu+3os+b2N0WsY3cTbX0AD1G/0DXk230JWDEE+JM8jnG WyfeL+7DLNdJbvK5WCcK+KW78RuP8zEwLurvFQX6CH2X9pN9xEkX0Sepnjwu3IvfvJJ+ TVag/zpaQ+4kd9IRZC45X3oYddeRmfzvM/zKvWQD/Q3WvQHpBXES+j+J1R6hHszjCNlD LycLRDW9jgwQmX4tGkQnG4s8iLXeRDaSe4Ub6Bh6p+Aj73EIbEBOpC+kR8p/uAkAbv34 zQ0kJPWzP4WBrBA8mAn6oHaD0qacTl8SaujP6UuA9ALBKWygS8iLeNZNF7CnRC363SlM EdeQDeLrgpscwP115Dq6WnpE2Coswp0eK7md3ivMxlN3C23Y5dVKm6QF/PgfajewlQrj FEcUwxQ+rPlu8X56u3g/OUiVxI3ravKgeLdyLWB2Jd0B6F3D4E8uB9QWSA9jppfh73Kk 1RhrJrmYfEYuJJeJanIu9gOzxaydgJSWQQpjXA5IhchqxeXkIFkmvE6W8XwjoLWKrAGs OJzWDGJO95LrSb6kUiokbCTJBk07hdj4BTtLZ84M/mpWqCb7ndugSRXcSaburFoV/Png 4NSZkkcxa6fCu1OMqXdKscgH/63xg5rsxKkzgz+no0Z3VoYdPbcTlWfPxC/gH6vGz43u rMECiUAWyXdLixRbQdUq4ixpJKKkaoUgkdwr77xSIKajrxx9JW81h8yxkDm0SCIDy0TP wJ/lu1WGrz6/QpniY9CZ4hJxhWI2qD9ChpcSQb/TbtArRLWFPFOt3h2NBD3VdovS7zAb NGqRKPWC5BD8UdPRvnf6nC1mi7MFPzTQ3lt0tuRpOJ4QG+ob22jR4aOigUZC/1Yj6t0O KeB0zHM4A5LDLd/kdooBh3Ou0+HHrbjEHaeX690ul1sv3x53n36HCVNBLS4RDvH5Rkt8 phJ5Rr3b8u30LJhbeVa9/3FOwmw2A5fzPKeLzaDyky6328V/Er9B75cvEwvSIfCCUMks aowveXb79cR6h5IqzXY/xu/qLbJl97Zg0TalSinYbQ6nn9ptyghWHBca6i1Nw2ld0SEW Rpk7W/IF9wyrKTCpuPjiGbNaz4+brNK99vWph+Svbrvhn1eP3G13uDvG3Uendm+ndXec N9fN5rD55BzqSmGN6HnJuNvv1rhFt9XtTGlSYsqacqof4jOy6gkm1X68r6vQNTSr+sam RktDfTxRS7EjmInTYbHbBBU2JRynmzsto1oLxerpNlNoImY1a9bwrrjJJj9oW5d6mGo2 XPvl90fudtjcHWPvlZ/s3i6/csf55zBhAGnyOr1f/Bq0NoasLE0ZPbyjva2hvrYmG48F /D6nw2Q0qFWU2KVwdbPUsXvsyI524leMZs01imGsq1RI8X6K0aynZNXZrbbRBXvKNmys 6Whv7zu9vWZnC9CKoRa7lLfylWJPkdUzgMc4ZAOUw1ulKMPdSPnKcrS8whzl6x5BY5Ur f8ap+BY9hYepWmWQ1DqVWxRNRvmTAypVlW6k3qBQGpSbNqqMKsmkLVVhkgfkv5jMKupW 6tVqvYKqPRbPFK9ZnH25IBltk/RGUa0XR/xeaVQpjJqcRqXXfvWVTqdW5zSsRvn7EWKV RrArJtmMgrCMBvRmPf6VYXk+WSRdLN0E2VoqhYwavSrg9v7GSV7R/8akejnoNNuMgJBD TZw2h8sYxBb3gtJaAJoWRnXHT7nN01DRwdAvZOY42GAG6bGND5n57tuFnXRxuCYbke9K hv018j2RmnyQXpQOhZPCC9lgMCmvi2ZRc2Uy6K+lK6PZbBQ4uEQ+KNbQSdAFakrVLotZ Jxm0xG0Qj7jZjVYSiVrltrtPEtwrmBh2KU+HU8YDMB/V0LZgG9ppE/1MXR34g9EiSfLf VC6DqFKPMZkE6gxb9RqFSXWix2gRxGqVRa/TKIBrm+kSqU7IQTsJlVAniZLqdfKayahW EUknmkxHezh2HGeEbg3Hh1G2YMZ7AINDNqfTJg5zVvutdInbcbHV4bBebPExHKaPDH4u Zuh0aD+2kkY8qnlDr/QQPZbBoNqXj5VBxgFJH1kyY9YlS2bOvGTrlAXnT516/vmY18eD t0uS4l5oS/6SSayyLSKLrIJVqyGSSWkrzwqEeLQnr+BIiX1oAkhAhBwiax0JjzetVAhL 3XGPP61QeIrRlE9t1ys66mNJr9qmYbz9yOB7UNUMmKOTXFKao+zWk27LQf2brjZdm6qe 1ism6iaqOmmnYo55TtU062Lz4qoF1i26LapNdJNiu267ahvdpujWdav20X2Kw/Sw4m3z 21W/s/7O+bH546pPrJ84oxqVXVQZvS4sGSvHhHsH+kz94OLgZpa6IriHIIYFs4mVzSZB WLTs2muXLb/22uUH3n33wIE//lFaI3/21b/kv1Pzv76ipm/m0vm0gdbT+fL98hH8beE4 TiUonV8r1NAdO0rRkAlAUohVBwPmHpc26LLYTcStCUhBpd3kCyqNXuoNm4529Rwd6GH0 zxDdAlTP9RUHsNX5MjIxcJZ5gN1chimTM6hto2Z6ZVWVIpAIB2lKZ9dZHQ/PyieTJ3Yk k/lZ26SCIER8rqhmqihG/N8c9iWj+C/pE19nfO0RzPNPgHcdWVuaH1VC/6jqXmOjNl8q 1uM7SPzu1fqrFavVPwyvkx5Sb1FsljZ77g484N5q3GrZodyh2qHeodgh/cz9WKxbvTf2 rOpZ5bOeA9IBhTeXrcvHITijCnU4pgqKWlU2GHOK9UCP54/29LFlYqEtgH+ub6DHdLir n626Jc+XNII2NhFw8UgYQkbFhAtbfAWVqNJIQ0NoZWd8j2ob6p73+Zro7KvnjVgWUVbF aqN+g7X0i/nb3pOfmFG7mr4sJUKhOISo35Wp6djt9dbTMXctXlufVVtHZYdHQ9bh49+6 v0d+9szalRkwddEoTg5EON/fN/ie+BXgUyD3lJYTnz3SnY/TeNbXbTd265VvZg/ai1KN reas6FmGOab50fmGi0xLo0sNq22r/atNm6Dabipsiv6odpPiTsNjtVsLW+nDhseqHo7u NOwmewq76J7andHn1CE7cQdVOYtqqUjFuamlKSFlcgfdglvjL5qO93T1dB3tArKawf+A rz19x3uAsRWY5csCoQwj4EVdsZHJP/w11DcxoJXheLIdtCgKK6776tC9f8sEzG+ec+Vd F8z2ZKedFbRPmbtyzrSnHd7Y+zff/+p8YWdw+9VPvbdijD+x6OZLZq02K0RFR5tWlPQX TjjvqgujnmGrfnHLRTDpBLILONSv0KPUTO4rzb+F7qcCDfq81XabKubKGk0ZSRcLkZ6c rqDpcR0Uk/Zm+3RhkbBS+KGwSdgm7BU0mWRzMReWskHBpheNSp83qBHtopKQBtqQTSoD WuIzJmkykA+uMVJjC4gFUqELYsF0uNjFZSaTD2XxWcaq/v7i0Xa5/XClMt9FzRpaoZcG YBm4JsDD+ZPTwaUqqIppDAAQk6oZaq9QmbBfXkuN+XAksVyucXt9CpFuM1iMSqMkLTKY 6yCjbF5BVKs8vmmREuiOHhG2nZgt1wVS0dDjQf/oZBba6Stug0CpSfA4TqgjfofGqE5F qx8PxKPRskx8AnxPkPphWV5ZOiOQChO/OMJzhuc8j+hxdRuBFm9buqdi6ZpUT/gtzZuZ xc5LrIvVq53ft25y32He6n7YrAn7UxFiV8WN0I6I7zL9Gr2gn+un/gxjLcCfLpAdZywV ngea+6JL7uli0svCpRdfsHQSVcqoBCJkNUygDglbunbk0rqnPpXllx//U9qre3POD3/y 4FWzf2bxu1N19Ot8vlgrt4kGl/Mfe577ak5HdWryj9d8/7HZ2Vb6eciXSMRSZT4vDnA+ HyXzSqODnrDerjlmxArfFrvt4W7PQfubMSlii0xzTBMWqxdLC4QFjtXq1dJyYbnjxuob bTeatkVMSpU/bCFBvcoScnljpuO9A72m3v6TTP2Lrn5LeW22Cl1gMYkh3hFhXJ7wNTEu I9Dbr180d/WaBfPWOBpvnPLgu2/95NDf6Lk0MG/4yim5Bw/Rtau3/Gjl1ff+6N4xY/qf 3PcX2kIVdBp9wJsoCVTjlwc5v3h1sF/swz6GsaqS3xlwSNVhvY6IJn1P9Vvi/shFurVk vX6zfrPuUbJdv5s8q+/WaZ2OatFaFfbodQrYNH51lV8910qtEbZxPRWRAJFf3rcebKKZ 6Yj5GLBUKPNGGhoSuSMYSle0AZWwQm2wmsfanKJI18mSGI2EQ5RqIQeEu3werc7mMpgM aqNWyuRqwlGtVprt9buxFYkQ85m8Ct4nV2RxjtxZWhZ1GZ/SUM3vxe60vdt/MP1mXutT BKp99sDV6qulFdoVwo2OGw3Xa68X1tvWm9ar10tbfFsymwKbUltcm6JbclvcmyKbYlsj W2M/zf3Uvd27LbgvuC+yL9bt7XZ318ajLr1FFYooVQm9yhNJEFWNNw8p3XMc3O54f4X7 cWl9vOu33Ab5dletp+ywdUj5Z3rHkHkCCUKXrb30srU3X7L4Zu0Niy644YYLLrg+NO/8 P/5sx4dzFy685E979354CZ158Y3XXnzhdWto//wfrFkw95pr5FX5jedveelXdyzelE89 tPix1/7nJ4seYjQrkJcrssEF39CS0plEI9qMjvAxwqjV261xdBvf1ByM6dQ6Sef0OKeF 5njmaBf4FoQWexZrl/uWh1Z7VmsZkG4xbFFvMWx37tA63EGi0ocCKktYyfG57/hAL9v3 PgYDoDMIldPq0G5zHYVwoQlu1mixcqEJswy0K05ovB5o/Oa2ns/kH8u/7xp25Rm1Dx5S 3LBo3lU/mD/vWuGc0Z1/+9m+v8qH5AF5u3yBN14SBY0PzrR3vs8Q/b6NWGNZZ4R3g+lj wZJJc1Q0HrW/If7DZVF69MQF5byP2YR8fnmmiJb18XC8ooB/R5sc0iqFIxW1Uk4M6ZcC 9O4XxAR+i8GzoxQb0rxjhlfF8FHvP8QjqLKXFXCl2x5VBTzumOnowNE+xuO5bdAHVe6j ijYOXek/aOPQI6ynzJJ+qnH5Xq0yQzOX1VaDWiOOBA8SM5jnpZfOmnnJ8ZBFrxGhon9s MlDqUlp0klYn7puyYP4ZZ8xnOnEn2SBNl86FzVwqZdU2l03w2aw6LYVrQkWd76re8Wfg 2xPGGy+2nmyplmJGZk4XnS3cdIUFC2ru0pyU5Ak6JL65fCrrzwnh3Ww8EjCEAwN/lpTn zFZLoscTNwQi8aywSn7Snqr2R7VGuoyK6WIxKQGcVbqwz5NiXj2BLKJrpUXihfB6ekiq 5DK8Yn9P9Qr5o9dhL5uuaosUc+u8fD/LtidgmbcOcXzOZU6/2yZe5w+F/ANrAqFQ4JSy 4E5EonEItjg9I45SLBaNMXqh8H9ukKadhJXWpRV89gqsnFT1rvMdf5ScR4QxxoW6ky3G WLXErHz4Nk6H1RCNOylsfCgasLlOaori5SditfGI3xjzih5JPXumVgLM6l3+SLxWWEWn AFa+sK5K3ihIyWIhJQnyBsEZ9Ven7BxW7w7eLR5RzITON5ysKI2rK/rEduJtzMXbU5S4 P5AaP8xVaSPtH+RS2g+sqRGSRqq2aWyKjKvN1Zqe6JqQnuOandbFTSRYJBmTtyWdVaUd qRGm4wPv9EH3LYKjlxW5d/pMh/t7TD2m/jfLggoNZUuSK21lI+QkSZVvHXbzEEtLfMsF HFZzLVwcygrlh86Z9oMNj/645iqztfrmhcf+8rueB37kMBaD5ogrNSE+/4Y9m5VOpdpk PGfx+JHmorjVtX6T/Fv5L/KL8gtxn6Mwil5LL6Bd9Ad/HpAv9PqrQnX2aqtpy6q7fibI HXQSpZd0TTyLGfPCoAyf6tvwiwjwg28qFScKcwQhKXZrSXfgT9reXMgnGnuSjryoMxjh xfIHgiF9trrGBOlWG6tRZbMF5v043tULEobBg20ullkJnH8dbvCfTowrwnbthLe2k/iR jPgz8BYRSNVJgkghJNYvr1KY+vr6TH0qdlH3zSJdNASbl6Mvk4rOijl60nRKhFQVlsWZ KIwpei+97+3bfzSskJlLfU0JE73J3JiM18ufTcrkOrrmydL0eSPzmfHyv0rpdLtVIIIl lEgFfImBnB/XQCoe6O8PxFkp4Wd4L5JpgNEywEgNb2MR/qMzUpqPVR95TN3hXjfpsUgp KWZL2UAms1IXKS5KXSSuElcpVqV+mLlFNHjDbqsUqC5mLam4SUtVEYuSVFXFA464VJV1 aIixOldnGgBOHe3jiMS9RVxKcIUh11+U2T8oC2VtLkMbhgrWoRWbKxpfmdjLEpPbVXf+ 8cDmjd2fvH7buu8v/+pluRSJZM8OhSZno2H6xtE/do665KLZZxWuunTDeZdedu7q2efO Ou+bfm5Zrg2kIrHHHjhjZTxx6yVz7s574doD/U8Z/JN0lvQCduqq0kx1Vl0jzDEvNq82 rzff7dlifjS/zbM7/6x9f/Srmq+yVcu9e7wCsWr0ovtQIKn/1NojflK7O7m3wMg97ozb l7uW29anttbsqdGYHEpSCGscVZl8gZn1PX1l0xKmPdMIDzOxaWnpynddPsRPHQ1MMMFK YlRTNvxPGphK7ksj0A2BGeIj2mg45peCqZE2lWS9Y97Tbx3b1XpVq+dcWyCTK03bce6X 8kE65suR66TrPI5o8/nbdbnQuV7jxPPkE7//vXwiFDKMSvn9TcmmehCUiVbRBUHGj88f HJBWACf0OEeaVWrVOPXdfrEnbSc9/t4qj9ojZdQZqU3dJv00vD3xrPpZSWv0u+ySwxIi yqponcdSH6wiRkexhm1+sbd4vI9pBuU97+srHu0zye2H8jE/8J3Zg8ySNlfoAP6C8oa3 iUUCvxlfbpxeGRzh/+LPH53IFewP1sRimXaLqb0mlsg8+O6/aPJ7Z058e7vtvA2i+M7f +o8JItvohF9cG0zGIvJz8t/X9k6fMlbiPB4nR1jXMHJraWqyNpcJRQN2k6aupbFVRaL9 gY8z/SRHP8vRXJ9P0+3+q6m3oOpp/AsZZvHaTVr4/dRSbbCQKHoLdpKgnyVoIu83ttgb qiR1brhpoAdLHWjv6brc1F/Ev7LJx0R/DvaezFLX5b1yLyMAbtVYzExfasnXVVZ8cunM ccgdZswSxDkB1EPs9n+p2Z+LxjKTS6WJNbF4jdgajjBKP9FHlb5oxOONRj3y14KNUX40 NIT/sUgq0VefzE6+XX6qoTFdM2H/xHR+dEQe/cjkbKplIBoHrM4BXzgHsGqG72ViQ66x mIxnvC5zpj/+cbGfNNLPGmljX9TcHfyrq9dAelQqkoi5I16XxaCWTDq4mBoShdpIwSuR WvpZLa1tihm9dp2pxfROT7GHQwmShUOJowbnCmVYnQ6qISCBRTBVY4g3CqfyhbJ/9T+D Sjg3kY5Hw7I1HE3kQiNGTMpEw+KKcCQSTvtPfEDV3mjQ5wlHvfJXG0LRSCwWiQVFziJS CVkGT2Ewqh5fjKflYrw43iePBmw6Bz+QNkov4gz17tKFE/Jz8nMcix2L89fkVztuzz+U fyj3aPBZx/76PY27g8ZQMZnIRC0uMzE3G2n3CDVV/725x5X5tNgT/cS/27W3zVHvaIzX xxuX1y1v2upTGTUmvVqoCeUUikRBkSJGvamhypNv47xjoJfrk8CassHFOEi/3AVk4xjF 0AnWcles4TSumaFmZm1AIgcrnMPJ7cwyRp3OaMStX/l91TG6s9odSlfpLS2/Xyofl/fR UV93rpugjXhzgXC63qlWxG6Ztfutvp6WVU/0B0NxbygU88p/dXns2nCeTqcQoXRRIFDt bF54cyFRsmrPmC6feOdP8nFIHUrOB25dDNwaQ1aVxoW7R39UFw2K5u6Mq3dUg1EkPe2q upr2Rqk+P2pYJiYlI0aNyyKZ9MFqkKBESsnmzoixJV9f75OaQ8RYb9fXm4pjcfRTfIWd epl6izIuJz0uTAGvSPB+J5pY1s9EDsOnio36LdsRytUUR3QVsjxZU3miLLDxRIheOaot nx77h1M50utTM40Ta+h7nS2Fmpkv1URj6UaXqT2bnvTqmdn68QU5tCEYSwW+ZVCBVDIo b6XnhCGVURsaWD0kn+nDDFYHASsDYBUmTaVA0NTtZNSmNKidZsmoC1YrieQTW0JGm67F GDG9AwbEjv0q64WLtq+Yj1UI59+5zNCCzOLdkzOZySd+nIvGs5M//HBibTxeI5wHxlIz 8cMNviSbGXyyIItYJBpNBQbYYS7mtgQycyPmliNnlup01mnpabUL0gtql6eX16py8ZjX 4lFmA9mP4VDuVvXa9+ZNWnMVtpAYq8yhWMGTh5lxvGegh6Mu2CRzdoNxHmbHFVCNuF7U RkMnZ8nNNQhFfqYAdclPgcDswsSIIMufT8xGEjVCTS4ayU647pe/O3fHtIjDF3WF1ZKk VDquP+eW70uWoTWcuO7Pv8nUWGOFv46JWC1ab1QbavKcMWfLU1jXOMCcrWsceaY0Rjc2 MzZVF2vIFDtDneFpoWlhTbIuNHacRMzFcABom3b1NmJPhqnCxbrG4R1jVbXEKzWPGwHx UNsaGmcE18uNZ9IBku9oT5fpi3a2PdAn+4tlbGS3ZZWyA6piIxmLnAVh1LErEgvxQGIl pCJaxvFa1KlM0oCqT9FnUhn6BpSGPpOib1a+QLr+b9wSSA+n/Cl6JyMDCvvOOgRpdl7K TusSKrqZYXibvAMOxlywVJqUjoTp9LY0Q/Ef6x2FLA4uE+Fort0gXzPjkZ9ahqN9btBn 1CxKjPjB2EuB68ngtyw1mASuX0TvwfihWCQRkm+xHJCf8yciMYPb8IvxK1ZoL+R41QL4 Xwb4J8nUUlqtUxKrGLN3e3vFhLVHFwvEw16HtUqymdASjpOCstVtihttKdM7fT3QNUzM hGEwZdyQCd/iYaiZ7MYMR2JFlDKREfq/UERIfM+fhpkYHliXi0Yzk665ZgLTN+iLIJGa SY8LNrpxYhYV8jORxH8gDgrdiUgvYA0dZHPpMkWHEQeK9o4ciXU0+BpiOCvqqC91+nBW 1NFZWkie8j0Ve4Q853sutguBPrGo39dBVaFhoUZd9zCptz7uEat6amxRP+mgCl/MVfL6 DOp2fZvXaB5RlS7FY4bW9sa2qmHD48bCiIbASPga+4q9x3t7TR+ZPupnVygdZRumzAGL hy1lIrOe9ENkhrZ/SMJSXfloJ6H7rlliHYIbaFC48G1DoXZrMJRqMnmdHdC+5Y9b08Wx GfthYzabzhpetpQx6BPI0g6Hz9SUDge31haqaJ9wRTQYCcV9A1f4kpC6Sahs55x4IY2h hBEDWxnmcMDe5ouHIkF4oikJDX4mrQNM26CjN8dDDaFFoYvapGRrfagtqPCqi2FLd9rb ayI9TerWYFvIMaoqMTKUyNXXKUa2Jeqq6r1mTUc7IiPae3uYL1bmcGkBKfZAN2PkyKCU Byk+xykNIVKgsyD+QjDZTH2zGGFV3DbflRt1eR5i4aQnFdmTYqPMtiidXjehsTYz/mvg U6rN6p7WVteStJ1bG3PTrxJjGwvpUX/PRyOZFr2nUHB6TvRV5ATju1BkQ4I9M7BZdES4 8EgGB8w+h65WvAv0IpAJ0EdugD7C/GDDSll9j2jp0ewW97qi1qgzY85UtVXVW+udbWbm 0LtRe6OgN1aRTnuVMs8OGo+fetBoIpFwWUcglB83crvdIt0gv/a3v8qv0tr+v9H8iT89 /sILj29/7gXhLLlf/jGdC35io13ywyf0lH74IaWDvR9ylzPmNhN0wPRINaj53NIw2k1w ROWCBd7r0PQY4+F4dI5qjrhYtVhcrVotqgNuh0lyWo0atRAPKvVEURXRJ4gxMtprdYLA oWJDdzTBZqoIORzRMd26+FYXTknZIQmzJ6ynqYpDajUzsTmrM9ODzz5w/wP3g32BtTnD UPuuGzMTeiF99R8DX//zKcki55evWLZ8YHUoythXJFzWCA8888x++VUGb/lrDu8M4unu KF1qbCZZfSzQ4/gs/LHbWuxRZnus+r3K3c3RumhTpiZTqK+rb2qraSu0qMfYRtnH+Mb4 p9vOtk/3TfcvtC/yLfKvsK/0rfTfqLuVrvVvppsid/u3Kn6q2k721XfTsNFExIZclVfT 2VCVFPPNOHNjZ2yg37Lv9RV23NbT/4XM2B6UvxhCXZh1yHYxkgYP56oeIFPm7qBdbCmn YDhlK1vMjEz68pOv0+bej2iT/D//dHuqFrdfPTK7JRaYYXRHrx7Z/HrDxO1aR83c2u6t h3oe29rTIxTp6D9QNb1Avlf+Uu6TnxQucjlzsYwvMGrkuHy1Z052PRX/+B6V5IH33pPh ihFAt0TaxXGhRH5SmsE2/px2tvWLalfWqmraabK9doQmAxwZYRohjKgm3aHenFPT02hq zNclPU5zSHLbatszamFES06dpCZteIRUReoUVcmqZrgbkn6bO9fBRC0sDCjGgAjiUwCp MrowSudCl6MLFw9lYm8BmedIO/JaFjWpMpj64Kph5A6zeAipxAr8KnrJqQZIOdwFvgnn tyIUWrVYCylLb3r11g23rHuzszWfbpV3hqPJ2lBrKzSVCN123z31oyZv+EF1yvpyqBmS 8/JCTik+3zZ5xFrJI1+ycMHCRQNXnJSgt3kT4bAvUrPpe8seCxqTXvmVQDwSG6eUaGRW fVkfu33wDakOMVKjyIulO1KtY9vWuX/YtrHtPvcm0/2FB2GXPBb+6ahtLd2j9rbtd+8J m9PJcE2MKLVim8vdKnUEaj6t131qgS+jo74n9klgd8feTseIScVzigtNC/wLGha0LLYu di73L29Y3rLaudq6wrTWtN56Y/uN/hsbbIsLqwvrC6KReFtd7rZwQdmUTNmVXlXKPmZ4 0xiVtxPEi2PismzmUUQtZacpTJi+IV5cltlMVDMjhnsQc+VYKeeQnlfPNZOyRVy2YgLl GK+KGcO8jJU4JCA5HamIJtIpsQoug2q9LnLPRdf9eP55m149eOIXTVdPFrzhbFgyJKMN PoMh9P0zVt1z+fKHn9z59evjbovURApNn1jyyekZx5hJV593xlyDzffwnfe95gv4HNWF 17WRxIS0vdh41bxJM002509ue/w3Ya67MLv5cuB4gVxWGuH1kAJ0Xo/dolESpdcl5r3d Vb01/p54oiaXDsZ9EYPFLHrsVVoNzpM9Bfu4yFgfFJpxPmN6bK4I9yNzOPbifKnC77gW M6TWgO0dHorAUhlUVg6vhnxjA6Q69yfi3KmhLH3EkLkiuIbEu2AOfSYEaiIRQStE4+LC eJTqhHg86Re08gebuc184lVuM2+WPxANE1OxaMBEJ8Rg6Mn7LEEajaQmUomxyCGjuYyD w3BWvAHrL5JrSpM77Z3uafZp7gX2Be7ltuX2K9yaanO2KBFnTy7tganXHVb15vbWpTPR RCSSCXsD1cz8ZTZCoLk6kajP6JtNxoxUryYd8CSelNtDYGBXfuiEY3VmPjAXLYQDsx+G lJRvxfAQBv2bXcdB1LAPHiWYPUeYmZaxuyLXTLr9hoYpDemR7+ajsWyr4djvD/1VsjCf EjPZTrxz2cL0sM4nnheaAiluHwVP7P7HP/7xW6anGAaPSwcBgyRgkJtmosmEKQlXk9mA BbtUvdG9qaAuZxcg18zBkCmp9kr28SbE2ejGSyns+dEurq51nVwSjHsQBDMRTMQELkUw snlINeE1Rl6Leu5jhrbC3csVGJwUfBr4E8sRaBVJyEMJwjlE6BTTEH+5tlQ2fynOjSeu zdWkWymcSel6vXxvIOptGZkSJDiTmaIWiwzcK14Y4ao9DNazJsYuRjAE1i0A9w9h3a1k fan4XJiOrZ5RLYTDNNmScYna7qK5V4r7go05g+CuTmeoupWENVpAwjDB3jgh18aWPrTy XPthbqnzVduIBuvTQIeoJlqU3OU4eL5miqiEVpQy+Euz1ZvUcLDDIio72LvAwytKrtPz 3eUjHJaZQdBwKwXxu/BZ8ITG6a/xuTUvnv9AbSbVTEc5wvG4/jbRbB3rdGmOPa9yuCfa EDqqTySCTtrZlMrUbAAgpgfNFs+JbaInGIn7E75waMAVsFncws4TU9wma1j8KBzyx/1x +GMY3KYDblcCbh3k89IMZWh8x5jQrI7poXXmm4z3me8x7jBvM3abnzH+vMOQ7CiETFI4 aK4CKrmVvaViTgz3tCTz2nzjCMeILGxrE3AqnC8USx36YTFH1hfTNsbEYSMR29RzFF74 t7hQhNrE/SAsY+TCcCtLCoAjMzHNpITEjFGGbXnMcQjbiqSImhJvZ71ZH3bmEebPsd5l TGTP5HEXZm0K4CM/82BZuazmBYhY2lU+ED+pVnuGLNMhfjV08jjkD6CnC+Im+kImFgkP xBLFrFX7pz6tPd+Yjg6EI6mc/AI9JwsZJx+vj2ZLqUEyUDM6j8OSL8LJdC09S7IIsELh 8QvH5edoB4KwErFIPCxPlTNiOBhKMIuEzpMf8ieSwUQIaExfxV5Nwl4hfh5vVFxXyihC V4SEZAj+/YBo6k45e6vgmwmZirW2+JTayeLYOu8U2+Q6o3assYHzchgcxz/i4o2rrRz6 ZeBbOADrAC4Tt/QBaIS9sc0w8kMkE2vh6M0gqK4YI9/Rcyv43TbE84YQ/mQFNYsj4enp kGMd6dyEO+Xd5nYYsTV/bksVOkKff5MC5MZXPzgpk2k3yU9wxw94nY9OEloY1XPzfQrd FUym/ZwHdsu/5Pi7DwdJfYBJjlxayo/LjXXOzk13Xp1TNNbSJFw/xl5nty/hKkSjiCAo 6PVayV0I5qxSQWt1ZuAEeh7nQ6bn32IHISYE3yGD1X64Xz7cX1bPQFdMLUPuwJ+zDAV2 etbFIouh0mMHhzEqrzA6FQ011TdwfTevtFdi3lmQHqXXaCmNJWKhKuRCe1u71XJiF31V rxgbCwsGGk2cuDXT6HILwyXLa1VOfTSUqElQWzRck3EUvAPb/kLFZakahMG/HgsUk67W mNjB1o/Y9A2ITX8E1ldrKah3GHXkf1WfO/7X2OsyqnUOExNnVhzPAHvO0CEqgYWqg+i4 GMcJyXEcCEFvV5yiX34bz5ShwrjHfdGwT/5HIJ0O0CpfOOp7/KugxxeJexV3euMheK9P n8PwUpjNQUUwg88xk29nIT3Ep2C1Siw2Aif7TDVmPhI+C0yCzeNUJsm9JBU/nLD2cX8k 5Kf6YDodlI/7cNDwOCIXvT54f7++zBuP+LwBQgf7ZZ/0nrwRJ4vmkpLi1SZBAuvBTyD0 ltpDDdJ73xjljStXMnvgpsGPpZvEPfCVNJAbSjOuVqxXIIrTfpfqp4qtKsThJHfY92qf Dew3V1X73A1VBQ3Rp90p8f33HdQxoPnaFPzK9378S9Mb6W8KGXOrZb9FLGRqG4rgjbUB N0mkpiqTEWsjUzyPwx/CbAHuN8/19Q5U/ObMJ8QNAbbyLri8uLnrYHaks6xOcX+R87tx ipUgVy49xM6mC+o277ps+ppj6rNeWHTXM/94p3Xl8EuXT3k+4Iu/+8TOPYWxCLx7wBtV 0v0W84UzO2euHffqhCnb1j74pNGkWnbptFys7azdT8ltfniSwkHApXOwX7oB0a468N5j Hd+DPl+Fd6+q8HaVgzyK6wFcd+OqRHsWb37pwRzwNg5iU7zAx/fxtliMErQoUTaSL3H/ Bu4G8TbJN+gxEW+bTQQizMF1Dq6Pgdc/hrjpvbjuxVVN4niLLIKokSx2MYgnakgU0peN r0dNEu+kYSfwtpmFfA89z0afs9DjTFKAD763FxGzLB4KEGXhAkMBj70yTnuGGji0Y2Vj nccFiMxIJXYbvA/xBDfSK1g3pKxRsDrh/g07d9+y/umnf9b8+MUvU738t8MX3V+0Op5J xGs77dZOnLTc6/es33Xb+j27b711j3DdmAny//7qkNw/YeJUj4s5kyQSRICxzY5VzwXu 1QD3smR16Zy13tuN90UeMm4x3GfZmn3WuD+yJ6vFawiUiGbpDN15ust0C7zLvWt0D+me 0m317vRr/c6vozrz+1L6y+gbNZ2WTsc0yzTH9vj25P74/qTaYCOFkGqaLZmYzs5Amble ObDpwUk4whq5Ps8w7rSjPX7gWwmTYBFTnCMg5BHhxvy4d2Mcrvh43JPw5tfNuv/FZzeO WtVoDXbEAgn5zcePye/R4O8m3SfOlUKB/MT9sVigcObZP//RXb+IxfTuhkTgjMeo47XX qJO9ZAS/DNa/GTgWBQ693TEdOGbEThqBYwqyAzjwKMoHUN6P8m6U1cADFzDEBFZcBSyQ MEoS+KWCbkDQUotyFXBNBVxzAdd8wDWCCKQcUgJRBjmkBEbWIWkwqg6JaXTs9D2DWfjh 4ma/YMHIbHQ7+mXwawnUz0DL94DnSbwdOZ1hWR+CKXvwhgHDsSGaBlEzT0gF9TiGQWUY xp2YePmHAdB5KjZVSDiCI4SK2yisFDfaze17LvrFIDX95oKtbQ0z6lKJI35PTSEbDw7s 3LXull1Pr9/wpN1/1sSzadWvXqXW8WPpGoTSAqW+uS8Uhb35wi07n9mwfg8kImC8CDCe jTcRvaCmX3RMIYsAz5VI23hykO1Y33b024d7FVbNqDWE3A7odZNrQb8U6XaM9T4fD6IG bV+i1xuAWCeenIa0DXJnO+h2O3ZnO57Yi/v9uN+P+/241/L3RV0YwQfoegF1PyCpAaxn ooZR83QSHcJSwA3/+OFi3wCLzGUgBZ76QZ/RsoQqRyBwiIJicXQQC3G+SW3q3VtWIDrf D/VqwZsXgeJp+NM3qCN3ofHEQmG9cfvqtfvoI3c8cE3c68s7C/VUdexdahkk+5rjN1x5 562YIGaL93alNkUA9vPtHXXY/Sjm6QG/C6H0PkrszZNuzNqIOkocVEDdIDCPAN+UqDOh jFdRAAMt7gn4Uw53LP7GidESuPpB8wnUJAAjLaJ1ihAQeJcB+jGQZ8ivyPQzHKzCXQRy BUSYY+072hZYFai3rULCZTUE4sP37Ws/4uZUJpU4cQXLd2xN1aSTD/72o6WLa6OWdYXL z6fnpzLZuLzt9igO1aLIhPkISYt27n202BBIus67tAXiIHGCvUSMXV4rXy6tFR8E3TSR v3XMA72moYsGQbNpnNUHySVIy1D+Pq5PID2K8gFc9wP3dqPMYjkyOFzK4SDCz/l4GPBp pAQ1DMLvAw8YniVR+z4JEwtlnP5LqF0SYgA6AetOYOk0XKfhegswZwfkxA7syn5c9+Oq weh5KK05jK7Bb/kB4Tr82u24fwpJQJoG+CeAwzHSDIWg73gXc+ciYLh8nt3X1wtNsB8Q H9oJ5geiQ5FjEMLszb5T5DIIt0zg3KoFgfMNqRi3woQbtm274fqf/ITmveHmX6+74qK6 iGepb9P3h22a++w/B/ZP3jjR47snmSyOtojqR65b8+ija9ZsPVFz64rshMnZfCBnvPmx VWNH/uu550+0tI6z2yKRZBCrX8D0f/DNFvJyxzjgWgIYpwcfY3ZoFBjF1sf0MYK6BPka rV+iNAh4hPEeN6LCgKdFwNuL+wg7FELZheeyqGWQawHM1OjXCBgymCnwRADyNYJddoET WtFrBt/PBNrOxv0c9GVvZ88irZC/YINwfZbDTIC233rUgMTQ9LjZ189kccUniup802l8 kYliBPKViX3IXUTN5eDd06vr+q2dYJH3evzjb598z89yxWwyKX+RC6VaIhcvvGBLpD0d yslfJBK5zg1l0euwym2dHQe2yW0IRoly4+LhFatvWSTPZVErTEQzXN8GGE9VzAWuJ8jV HWnkEcBLpEr4ARTEC9hGgJXVgM83WL8NpSCoOwpI4o1Q7IkJOMz0lyCgci7KJdRQvk8J 9AuiXxI0j5PnLv7eCoMMUgVA7ND8ODNDTosYtpYPDyrgwCt8ZernFoegTZSGJ2MdpUQ3 zMhYJDfwVTKZTtPCi6kM3riIeQLSgUuaczOnp+IDVSGcn4PYw8J1OFiIOKxsvZ/KK8TN fL1psrKDvcEf5zQawI7zVZ+k0ADWzmAQx/oZhWZAiV6sLYGVK7GyOPCpvGY9ShHUJjAS XrJA3JnpaEU2VkJHEIXF6QyLP32t/05k3766yNSw9cmOYYloqSNJjf5wy69vvvxiENYV vh99X141r5BMCgm24MUttbNmJhLf7F9zI+ipltHTTduEVxF8xxZN8RY4ke4FHbWTLzrG AJOz+PZAFhEhNYjEzYBPZIHTGbIZ7ZtxbsBOj6qRgoCEDTvcjnY32gmeTGI0HXh8FWBj I0nkQUDHBpprw2g64Eg9WtkT1XiiBrUIyMOTTPdpRkkN+mFaSALyUk+GMXOh2HsU8oBR CAgGIWwsdJuZp0yf5YjC/CUOkqVszhgT1zb8tZMMq0Fq5y14JRxX7q1iRjuiPpntCsdU Hn4PCuPq34LemJprLr8fWzZmETpsoEbKSRKGbtkJAkN2Z6i6O5HMTc6nphdTiec8fopA 52yaGuPJeVZd6vzinXT19EwMQUz/m00mEvLbdI18LJkvK8FMY3FYT9R9bgg7/f5wuF0r CIqG7Bp5ATus94c8CT2MbQquTiT21r+HzOoIAJKogmwdPEl5ZVpTo0WFJkaHEv4IKI1R 7lTQGkViNYjd7unpKr9BCAByTsQI7Tvm5neITIjsmFdIJegELK8Vx1a5E+ASICy7tKG8 BKZ0lckJv0F5vO/H0LfOoNUdF5NN2N27MKeNiJRmfHcUZujB3jNcOwPSzoBZD4M0reM0 A0oDt27F7hEEXiDKCOUvIfPSjPOg5zewmSJ4ZjTwE/sLfXQkUjtZiLQCSYnvaCSw3tHo Nw6/VQNZWA/c8OEpxnGGQWOxANcMgI2SeZHQaz7yc9A3SOahhw75KMSYKzEnD+rz4PMJ TgWsjllbU1nATC/O9k3sSN/U31tmWmX2BSFajidkoei5duZbYiejLMSOAZxxN+AzxOlp jJxh4DBqHorC/C7TH9JxIFq5WCjnQ8KBo694rG74hBmWYalwZE0m0NlWM9ETa0+H8+D7 sVynzTKmLpm8L2QXUue2jZnjSF869rorTcPT0ciqZFyo2TD/2qXyXPbWZ3Kkj26bMnFG Q/2JY0wWwL3sE64LJiMRZyybHjZ8RPvjB8omch6nXWX+sQb2Wxt5tWMCOIIBfECNHc5A t0BMNiCbxH6ay5IY+2nGbmaxF3aOC99g15lWzngAs3AdoFIb6tiuVWEcvBGLkRtwFYFF WtSVJXHZ0j0HvWegP9uhDNrKktgGSdyM/WKHcbMIizP4j8KYbcRQ+g/y+BRpDDeerxIT fIq/gas4p0vjSjBC3eeQxulcbu634jjX/m4pmm6FNF50P6RxdMy+xlQK0phBNhZyWDuH hHEi5E/D3XlSGKf9bAOw6tmwYZaJu4CdTjK6VE/eNyrft39pfMPVqerUTVRMpNNU03Rz FHPoDvMO62POx6r2m/db9zr3VpnEpH6BJmmZ7uLepbLQARuFHl0J+sVJHWUWf9m8JcKi zYcO33ffoR7hJ/I7n34iv0Ojn3xCY8tevOeeQ4fuufeXdPZb8mfU9NZb1Ch/BhgLZCR0 4hugEycB8z92zIDeG0VKQPf1QfeNIiWg+/pAPey7ODFQlRerMAFXmBamQt37qM0BTwLw dBN8B0bCizEivCcq1HyJ/Z8Iu3YieMAcXOfg+hjskG3Am7247sNVDXlUxJhmjKkGpzMC TowXMp6Xxa+GUWLaHpMuYfALG9qZlX0maWDxikz7HZLBTFUrH+nDhcLNrnJ0LEMWUO1/ p8wyjsAUg6cgnjgNugs+i8djOXlsMlU32modXZdKwkHS+dh5L1PDIHnp4l3ttHH9rt23 3LLzqUGC4MNgFDquZGBEZ7PPGzNG/uzIIXniGOGp9Tc/vXPdLTsZzKcA5rdzO6SevAPf 1A6s/adY/aOABLM4n0V5N8pKcF439gDvbAPiIjQTpq3VoPQ+7qOAtg/U9T4o70vITxHw VxEf4N8AnqtFYratFknAL1gwsoXzwDS0GeaNwh5hB+qxKwWM68Mdk+nMB8Y0HuYxSAPO MUCc8QErLFzAm/FOBnAAtEyA/wXirBEHiKf4BaiZGR3RihfhVCPjO/rwwM718E+tv/Up YdnwXYsPyYPU+Otzt47x+O9JxgujrMxHlZTH5GLJOH3p5iefXnfz07sGnqS3j5koH/ot NY4ZM89uQ4RA8JvPsQfRIPyBmD/iLCGHLwOvy5AbOnLApiQwzss5HWQtw1uslPliGM4y HB7C702AxFakPUgiahmeMiy1YX+MFTwt46YN2KlDXZbpxT0AEj9XrUTsQ/3hPr0y48rH TpPS30bOQncZYlfcJQ9bWCVIdBLTiE9ckUimMk92zssnkr0e73m/vXLWpU0h55LMlJ9d hLjrIZWYaYd2244rl49ribUMu+wqrH3X4KeSE2sv0TkddyEssggd0Yz9LWJPzfgeUBu5 Hph2PaByPWCyHnu9DrhyI3j5D9HnAbRv5DqAB1cv2YL2+9C+Ce13o/1uYOd9wJWfod+j 6PcoxnkU/bZzWq8C9PLAv1pgdRuwuhrJg+QFPqbhhagBZAuAfRgphJYssBMxLpACOoxt wfyY9HBxfqDD/jTjG0YxfAkpCayO0RL6v48nXNi14Wh7gyzF3oB3oKUDOmk9fqEKXIb5 LnQYV40x8R0hPq4du7mQPIRffQoJ4WroEwLt5FBLIOM6mBaLYFP2UjWUVsZ82anDQE9f Xxc0WeD/KYYhkL0JOF1XPCXIoqKZguvAxkZ+Wqg4c1GWY14Yx+H2+K5QLOUyVaW3zr/4 2guuaXrlrdd/MflhSTfcHw4FI/5swNZw1ZnnLlv54mvPH93TcuvFkaIZsSu7svHmsLmx Y/qYse233XTjjzKJYnFFQ64uYilkzi6NaJQUN2246RG72+lk+jqFz7JfOl/aD4g83NEK S7yKLEe6EWkT0lYkBXiBE5DyIxnAD3Lg8Vk8y7Sur9ESQF03auLcqwbSofiSCyBfQE0Q /JzJCqbjiiib8TTeasCfEfUUCe+DdcEcYK89l2U4P6HvaofBUPYSDQl28GvuhGCffqkA EP6hsueCBzCfNLgrscz4NNOVhZp0Wl78vQvmyH5votB2/gOjVzyUsJl3pOP137s8lsiG xQVh2Izyrq0XXpz0hQrORHTihMjcBQE6BcD3H2nIpIqzfsPgNG6wDzL7fqzq8Q6Gj4w7 isD8AnCHab3sy3HVqGF+njgkHgEmG8A3woCEFVy6GmuuAYbHULIBPkbg9re6ay3qCeDJ /EhML3WCGi3wbTKOy+RcDNKtCG6LwB6oQBVmy3jHEMzY+QvAyPCQA4yppRUv7Em4fOuB KGuoZafPqc10ycXLlmxZl4jE02/GA7UF+Njgh5i7btJjj9k7i4nUPREPvfwHy2+5kD4Q isSjodKJs4IxZvd0Tmh66mn6SyblvOycmpLU4LvSw4BXnPy4IwGeYITNGQONMi+jsoIZ fq43iKw7VqwEtCKAVgLPxwGJIODKjm5VgJQImDEerUUpAbsH/7glWYlPwaIh0JkBacFh +Wg8GscgJpTYMAFeF8d2jEYtBv/umS++qcNotcyDM/Q/hXQworx/JCxx6mqJF0fFqERD 7ZMb4y20IZksjLTI+9yFXCbnFrmkD+B4+8Qq4Sa8EhhgPq4TiaZQsBk/TQf7AJfXAZdW crRjBCS1CnvMdFtCLkKSsMYIcMaL1TI7vA0ci6Iv874GkOogp92AgRoQy2JZEuwaCTBr Qw8WyeFBb3Ze1Yrnyt8wrAMF63F/Eaj2AlA5RcmKkp6w2BAEh7AzPMT54C0rFuhzGDys ErtggUdoNJ9NFNc6/NUTD0pM46vGVc1+k8UhqPvKOYs84J9DA6xOj/oAlWbwFb+yuXMy GqECcBU7TcYjwtzrtMlkNGn6syYdS8SprjHuMJtrgq1PXKdLJqIp0zWPuTKj89F6qg8E osUPqhKJaNpAB+QYoj6KwrEQguYDCVdEUkgnHqd7ECNSkOcKM+EQ8+MUISicsLIqhmzw 7En4niEZRVfCpm0EvBqBJitwvRLy4CakdbBEbwL23Yg6Fg98F1a/HXV7cNUDsiFoCgT9 QoDsKEjNEN6/CeFLfKNAs2F8sW8URhgFKTgKNJ1EznqasFOI4EB7ADvITnhSxIUd7MCY BtQw/ZnttBFcsoC6IHqORK0ae6wDQi8B/1gMqbYE917kdtxJuJZwPxVpLpKIpCOdII8u xKqbPmKREeX3Iipv6Qxtbi0WPxqBJ6PxI+VQk9GcXkbix8OoLeAP/6FUDkVhtMSeGInE psaCVkYjlgK0hmTGRJEqbXWMvoAX5XiU70ansBiD77xKcZLihiJWqLMJGHE6TZaV9YoM baMJut5XbC40yH3+ZGObjXbKvzS01tSNO9JYaKpXv33E3tyYb6RSIFFs8sof0HO18XR+ 4isNxXy6eWBDLBwNJ/2xMF5tbghwwzgcfeONUCQRSQTwfuOb8o4Y2sPRUPwLhi8t0M83 AF9y5GBHEQALQpcOkoVIi/iuMh9aHgBgOmI3djCH3fZX9hh6JfaYWUB5gJJ9fTSHXuWv jKpBwzZwxQtwlbBvHl6CDYz9g7fMVN68kzF47H2LSuwW2w4GeDYeY3hsI9ipA+G1Adzh 3bhycAvfCfjJeOjtdyweKzwVp0O5DPbKPqgET2Z8PfxddblYInHsEflOzgGdzZwDGqkt Mbo+3vJlKpFtHiTQM7l2TUcIrzI5wHngMYGF/IAHgv4wOcDyJdCeHrBMUKFjPjw7BLpn AtIuAeqxkYW4X4XrKvCoVZCA61BehzLTP+9D+T6Uma65HeXy+ZwFELchWZEsKOHFFthA CXBWKzhlAnRjBZ0lAFkrdobZLQn0Yl7NbkBPgZ1wY/cUgJ0be4AydovtogJ0XoXeNuwl k0hKEkV/Pe4oSCMKqrTjagIlJrFbffhgQZFrgHjxAd+3gpII6QyB9BynIQyDLWFqD2Gs kkUa5TkdnPoa6pAfMlQ+9uJaTFkkqegG+jngG64feeLR5lZ3rdAuI2IyGh01TnCOGVtT s6F+OjxC22oStVlPvlZoq5sBm2hHKoEvGYxnjApv4qdktfCIMgestJRUCCChl+MrbvxL cCyIpM4cEVKrVilzXx7D+tg+kU0X/Pz984zt/6RmNRuBHLrUMn3oOtgnq6WPMRqDC+vP /sNVqZbRWXn31y9+/Uul/2RLuZ2QadIRfAnwCDDgCJ0pHRHUuN6PtBl1ryOdj/ISXHFP H8H1Y6QjKEu4svt9SLuQnkBCPXm1kl4u9+fPdqKO/cZIpHelI4Myrux3pyBhfF5/Dq6s H7s/iMR+cxxSC5IeKYQ0AQlz5Nc2XG9HYs8NQzIgCUjTkSYhYV58HVgLtOkj5CYkNv5c JDYGm88BpLVIC5C2IX2KdCHS/socWXk2Eps3myubE1sre57NLYV+fbiehcTm+RLgx6IO wvi7Gh6aftpK3xfywlLhfuGA0C+eJW6TGqVfKS5WfKicotyj6lTtU/Wpx6g3q9/R5DWH tTO17+jO1/1Wv0D/edWPDEnDSsOHxkdMkulJc6v5ZvPnltusw23Edq1dsP/AUe34zHm1 82tXu+ta193usPto9TSP0vOwN+v9zPeIv9q/KbAocDC4J3RhaF94aSQdeTz6ZGxk7Pfx RYlkspT8KPVI6udl/CDT6J3AwKtBXQJoh0VEEtUn2h+jrox1lgrOKBkvnTJy/FmTpmRG XbbiiosWXoEn+H+Ig1pZLn0nn4Z7ESP/f3/tmWkwPq6xB0HP/3+/9NwEe/LUbzyXIPQ6 wcH++9edz4av5XvQDmYgKmAWvp08Bx7oLnijScegcC3tAHcRaQk8RaTDiYx8GM9bmW+d tsA+Fmkzr2ni5UY8K9IG6NIiref1dby+CKtNpHleU8PzLI3iqqBpfpeCniDSJCxZkSZ4 mfmNRBrjraynSCN81CANAJsUNMjrWFmk/FwbL4V6YYkoqI/3Y2WReuBxF2k1L7v5Ey7q xFXBc5E6yAv8zsbbrPz3LfA2iHizyQTLUUHNvIWVRWrkZT3PdTzXUg12ScFzkarJP7Cz +Cwp8EakKvI/GEmBayfulLy/gudSpZ/E70SeCxyiFD4HEWgG+OG8RQaGKfiV9TnBvdOs TuRlkQyw3tDIAB3M71/4BrMCV3bHyiL5CtJGhJfhC9jJClxZy5fkeciQL8g/ceqg4C0i 8mtR909yHOMpeItI/tkxCNyXUMfXxNtEXhbxLWfmTf87H6+f/A1agYL08ztWFkkf+Qi2 kgJX9ot/JX/hPf7K71hZJJ9y3eMT+FRF8jEwVsQTf4a8UvAnRV4WSS+8HIAnrmycP/H8 Q4Zh5ANefh/tIr4OzVr/yPM/8Pz3kIgiOUZ+xyFyjNexskje5i1v8Zo3oSl3YPQ3+d1R nr9R3jNYK2wH2P6J5HXe8hrPX+X282/5KEd4+RVe/xvya7bX5Df8jpVF8jK+lm5D3cu8 jpVFaBaHeR3LRXKIYTq+Dg8qwve7f8lbXoSuhbtBtku/rKyftYgcU0W8F/4LcitGPchH Pch38xfweM9CHWsRkbPdPIBR46hjLSJytpesRoQPq7zu/VCQEU3O4fJzPtozPN/H17UX +1/ut5fX7h18DSOwGhGesF18Drt5y24+h13kaT4H1iKinc3habKTz4G1iLhjc9hZWRNr EXlZhNqRBNZ3spw8yff0Z3zkJ3j+U56z2DSRPM7LP+H5Np5vhd8OdMpzEV8OBZ2SH8N3 L5KH4ScDP8CVwZeVRXyHneHKA/hiPaMVlouw+e9DrYLnIr4vznrcxVs2QXNoRcsmPt5G xpHIj3j7neQOjtMsF+FTGo78NnglU+h9G6dKVhYBCzbaep7fwvN15Gb0VkBbZL/NyiKs ONbrhxyz13KcuJHcgDoFz0V4OFn7dZiLCLiC48Gf+APwdAWuO3DHyiJ0UUYZV/Fxr+RP rIS9yOa/kt+xsohvsrOxLuX5EkQPGdG+BOaSyMsifp21X0xk7L8IO/xC8DIFrozSWFmE lspsuEWQFYw2FzHuBp2YrWYBZAnrvYDvwnzYm3iRE6edbERWFsFz5nJv3TzYiSIvi4jU 6OKYz3IR8qc87hz+FCuLwB42wszK6DM5ZGdAK2andTN423T++9+r9Pger2NzEbHr7Nmz YD0zLnUWvzuTjzCVl6dwbJ/Mn5/E84mQoSL+jwTsufFYi4gTW1Yey3nCGM6zRvOaUZyL jayMPRKwF0EfbN9L2FcGnRJ/fkTlbgQfgbWIOBdmeTsfp43nrTxv4XkzYOzC880ckk2V X2B1LEKI4Vw9H6uO9y7yvMDzPH8iB2sN0dC8hstb3LM1ZHie5n1SsDVYrFcZx/HOEu4S nFbirFfH3eBEjAuySDzGx6IcVyN8hDDPQzznkpjvBouxY6cMClwZVvgARRF6TLnOy3t7 AO8kenj4HSuLsGjKv+DmdazMovbYfB0859IZmgjzRSp4Dt8EdpdRG8tFYLEBkl6BK6N/ VhaBZ+WVVfEx9IAaoyiWi4C9BmMreA5PFa9TVfqrOAzYs0xTK8+dRU6z6FQ2M5H3phxv CJew+Ajf2g008//wf+T/rbmzT4f/H62cE20KZW5kc3RyZWFtCmVuZG9iagoxMzUgMCBv YmoKMTgxODMKZW5kb2JqCjEzNiAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3Ig L0FzY2VudCA3NTQgL0NhcEhlaWdodCA1ODcgL0Rlc2NlbnQgLTI0NiAvRmxhZ3MgMzMK L0ZvbnRCQm94IFstNjU1IC00MDkgNzY0IDEwODldIC9Gb250TmFtZSAvTkJJUkxOK0Nv dXJpZXIgL0l0YWxpY0FuZ2xlIDAgL1N0ZW1WCjc2IC9NYXhXaWR0aCA4MjMgL1N0ZW1I IDY3IC9YSGVpZ2h0IDQ1NyAvRm9udEZpbGUyIDEzNCAwIFIgPj4KZW5kb2JqCjEzNyAw IG9iagpbIDYwMCAwIDYwMCAwIDAgMCAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwIDYwMCA2MDAgNjAwIDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYw MAo2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAKNjAwIDAgNjAwIDAgNjAwIDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMAo2 MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCAwIDYw MCBdCmVuZG9iago4IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlw ZSAvQmFzZUZvbnQgL05CSVJMTitDb3VyaWVyIC9Gb250RGVzY3JpcHRvcgoxMzYgMCBS IC9XaWR0aHMgMTM3IDAgUiAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAxMjQgL0VuY29k aW5nIC9NYWNSb21hbkVuY29kaW5nCj4+CmVuZG9iagoxMzggMCBvYmoKPDwgL0xlbmd0 aCAxMzkgMCBSIC9MZW5ndGgxIDE1NzMyIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4AYV7CWAURbp/VXX33EfPZDIzSYaZnkwyHBOuEAiBSDqQ4BFuCCZIJOFQLiUY QEWQ4AESUdBdUVxX8QZXdEgChqBrVFZXlJVdXDzWg3VZr7dR1seyKmTm/6uaCcI+/+9N z1f11dFdx3fUV191E0oIsZFmIhF93jUNjeR1ugI5bwO65q1aoW1r/NMqQuhmQgxDrmq8 +pqax/9ZTojxRUKUP1699MarPvyj5RtC7FsJiSxduKBh/vc5q9sIGXIW949YiAz3Nbbt hAwtQjpv4TUrbpj3obkR6RqkZy9dNq+h9mRDAul2pIdc03BDo7zNdh/SJ5DWrm24ZsFH /tnVhBTKPN24rGkFeY8tRzoP6SmN1y1onJY4+BXS6LMliTyKi/9sxED4MzVSnc4R2T8T MIxcJgrqG4mJmImFWHG3/WdqXpjlQNIpslQRui4s/tmUW+RmnFfmAZ6ZTnuVTpIFyFae JllylPgJSX4B+JLHiUXJL3k5j9nXuKMjDYTsJLvpIrKbvExepSdx1/NkP8b+e+IjFeQh sob8kmzE6GYhZxOZhktB/i9pVrKdDCaPYvSPksOoezm5mXQSL/UnvyLryO3SUdx1O+Yh l5STKWQZuYtOSK4ks8mn8q2kmEwg15JG2pysSd6dvDf5BHmS7Jd+n+zB3GWTebgOJ79R 3k9+RAbijvvIdvIpvde8l+hopRk1f02uIw9KdTJNXp38ET0Ik+vRB5lMJIdpF4vh6QvI F9RP10jj8JTHk/HkQdQKkDqykDxIOulwejELK7OTE5OHiRdt3ICnbietZB+uDvIS+ZDa lJPJJ5InSRYpIJdiPO3kD7RLSvSsT5Rh3hTMUn9SgpJl5LfkDXKERugrbJliUwoVXVmd fJd4yFBwzuXkadz5Of03uxnXOul1eXxyLHFgXu7hs01+R/5Ks+lgOpnOZP3ZMvawdB14 qAD3DiXzySLM9wN4+ic0RvcxG3tHelz+jXzG0CdxPOkARaLkV+TX5BVqx0g12kRvocfo 39g4Nof9in0m/VLeJf/J2IBRX0muIXeR35B/UzcdSafSK+hCuoZupPfQ7fQwPUK/ZOVs BlvCvpUWSsull+SxuKbLTfKtygblTsOXiZrEwcQfE/9OFiY3kKngh/Xo/X3kYYxsP3mH fIDrU/IZVaiVOnBpNEyr6U24bqZ30cfoTrqLtqOVI/Qz+hX9jv6LnmEEl4HlsDDLxRVh 17Hr2S/ZQ+wdXEfYP9gPkk/KlWLScKlUqpWWoVcbpa249kp/lbPld+Qk5rlQ2aY8ouxU fqO8qpw02Iy3mIjp7bOP9wzo+SRBEncktiVaE+3Jv0I6ssBTARIipeh9A67FoPc2cNzz 5Ci1Ye6y6QA6hk7AzMyhi+lyegNm8jb6IH1S9P05+iJm6T36LfpsZwHR50FsOBvLJuO6 ki1gy9lWdi9rZ8fYj5JRskpOKVMaIF0s1UkLpBXSjdI2KS69LX0sfSadls7iSsoWOSTn ylE5Jl8sz5FXyg/LX8hfKLOVt5S/GyyGawwbDB2GfxpHGMcYpxinGuuMW4z7jO+a6sGd r5G95IW0vIuIHpfWS5XSXnI3GyZnsT+wP4Cf55D50kQGTmU76R1sLW1necoNhtFsNJ1E TspRzPXr7BF2mo2WJtIqOp0sZkNTzzR45GeAlcqvkW75RYztD3jyDQYbvZl9a7CRVkpY CZTk76Qhckx6i3wofUqN8qPkL7KF+mg3e1qaAi54SR6j1JCw9BB5TlpO15K9rBLa9Yxp M/h4En0GemEGLaTfS0kisUngomLpb+RWsoS9T7ohx3eQ++l8+WpyNxlG15AvyFOQiv7K tYYBhkz6Jlskt7AM2k6YvAujK6F5VFI85DZaJz1o+JZ9QFaSd2QL+UR6Fr1/hz0nTZRP KtPoQkjAWrKBLE+uJzcqNfKf6NVEojNJvnwc2m2NVCiHEa+DVpkNnbYP0t0JPVAuTUSO H5wzAXxRDQ3xIK4HoCdkcNAiyPjl0GJ/IO2GGayDXK04KLQOIfJbiWlkVvIpsj15Nbk2 eS8ZCH2wMbkGT9xJ/k62kJ309sRNpJEEITmf0AnKePaOMj45kLWwD9h0tu1C+mK286mf fI3rOTKejFEOkBb5PTKdlCU3J/8M7u4HDbudzCWXkRMY5Tdo4RKpiwxLTGJ7kuOlRoz3 UzI1+XQyRC1kYXIpmUxeJE8aFdJgjOnjqmeU62VjLiodPapkZPHwomGFQ4cMHjSwIDag f7++0fy8SG5YCwX7BHKys/w+b6Ynw+1SnQ67zWoxm4wGRZYYJQWVkfH1WjxaH5ejkUsu GcjTkQZkNJyXUR/XkDX+wjpxjd/XgKILauqoedV/1NRTNfVzNamqlZLSgQVaZUSLH66I aB101tQa4HdVRGq1eLfAJwp8q8DtwMNh3KBV+hdWaHFar1XGx69a2FJZXzGwgO6xWsZF xi2wDCwgeyxWoFZgcV+kcQ/1jaECYb7KUXsYMdkxxHh2pKIynhXBrXiMlF/ZMD8+ZWpN ZUVOOFw7sCBOx82LzI2TyNi4MyaqkHGimbhhXNwomtEWxTEacqe2p6CrZXOHSubWx2zz I/MbZtfEpQY8ozLuiqHdirhv9Qn/T0k83D2uZuP5pTlSS6V/kcYrt7Rs1OI7ptacd29O mD+hthbPwL0sf3x9y3g0vRmUqpquoTV2e21NnN6OJjU+Ej6q1PgWRCp5Tv1iLW6OjI0s bFlcD9Jkt8TJtBvDrdnZ+v7kcZJdqbXMqImE42U5kdqGisAeD2mZdmNblq5lXVgysGCP 6kpN7B6HM43Y7OcjCzDpqTKBieocq5p2bmYp71Hk0rgOjpqnoSc1EYxpJA8WjCQt80aC APjVUtwVnw+KLIqbx9W3qKN4PoZI40q+GtFa/kXAAZHuf1yY05DOMeSr/yK8kPPJOVaL 04ZePB6LxQcM4CxiHAeaoo9jRHr4wIJVHSwSaVQ1RJg+MgVz21A7ajCmPxzmBL6zQydz kYg3T61JpTUyN6eV6INjtXFWz0u6eksyq3lJc2/JudvrI+DkdmGYZsZN0XN/p+rNqFw4 Kk69/0vxglR51fRI1dRZNVplS32aa6tmXJBKlfMJxbyhLI3FM8bVSDkMeRxjOZIoBVPO nnWuChI1tricj79BMPX8DqMJXClyqDY+rtZfkgprLeFwWmb+r5s6kif5XSL66bb0MOKj YumOprodH31B+oLu2VqkqhlQOaxqxqyWFssFZWC1VC8vTUfgeDKjJqyNi5NqSGY+/h3J rpEcanPiOqYMJTMgRSK7NiedvKBiTvqmWvw4dw4sGA+d2dIyPqKNb6lvaehINs+NaGqk ZT97lb3a0lgJbZdinI5k55058fGbazFjC+koiAcjY7kYj5tRkx65IAvnbpCJL+JQydxA VQgsXiMZ287oCYOxg23XM4gin5CIxSifoCTLZFBOMOlFLPxmmIGDiD+mni7tKZ2kniqd 2FNKyoCrZxEMHRJ2hV35CCiWvbOa1HVWV8gZosldhDNg8gtWohxFW9P3Eyn5SaunhHUk P9E1T8n9EmXSI9LzEpNWEYqNCkXX0L70JWFf0g66ay/WyrbVaLhUPdWtdqPNstKNyqBY 3Vr14NAhtC4Wy6TDKN21NVGTpfzjRzyBkerkF7JL6SIq6UOr9zA+D7olOygrnqDd7jN3 JL9sdzpZNUf0LLsdmIvYeA7x2mwIbTyPDI7FYocRHCZl3WXdQ4fk7DH8zyedwpMM/Emf t9vtAvlGz7JagbmIynOIarPxkOede+RPz2w3aFlqAOzayjTrb6EqvQA3wJk8rs+VDRvZ HdY7nG86FLPR6meVGRMyL8salzMjY3bm7KxpOUuMS6zzMpZmLsmqz7mRXW9YZV3t3Gh4 wLhNfdP/ITtmOGb9izP73MCbzHo4UjTETIlZNTPz1pCriYBFdQdyNWybGNkafONOTuO6 WDeC5TFMtxg6rVuObdFI/qOA2toM1T1iWKHX685UmSGS2zeaoXqHFY5wqdFIrtFQveTo jlWtK8YuPvrouzfes3/XmjW7dt285rI6dpTK9KJn57Qlkh8mEonXdj/wAv114v5vT2Kv sfibRRs4r3wKAp4B7SzkeV2TdLuraIm8jm1h203yszI1E4PCJLNCbYwesojeW/iYCNVw b0fyeLuqgnQdya91lyBoQBDUIQiKWdazOLl6aSLok21TdLuzSOmdiSEK1bA/Y0qWtZOW 0tvB9JPUE5gMzAs4gv+QSPF/ma+Euko4G5K6WDjiMhiMw0eMKB7GzrSXH51x/2eDV8g3 jVkTeu7iQ3P42ErBy0aMLUjfSPOS2aXa/RkZhmp7R/JUu8slkG90s6oCC3qUIGdRH68Q DPLSYMCBkiAYFGEHO6DbmMXn00KqizEt5HKXDH73MA8Pk8HdvKdlPDwIgy0nLQa8QZvb zUSDutnpApZq57hudWew6qCH5/Fnt+LRXFSsVlYN5B+6mMWfa43LCG+PtyYa00eMVkYb DigvGw4Y3zC9GTBeaqu1zXAssc13rHavztjkftH99+y/55zMtr1sfSGD5agBtY8aVA2/ xWbaCOY3ITaDWtlBi2oyGA4Fsj2BQLYpkA1tYcoOSPag2sGeaJvsoq4O6t/LR0DEdDgp s1mafEcx25zX6QG2Ht4ZlY7Uba69Zdj0LmPrmMw6WR4J0S17UswOvXI6xtWLUGhl3T11 J1xuTlkEGx2DYg6oGiRAZyECXAJGkjpad11tbX5mOFoMio8YMbwIrG8w9h3B5SLTA07A XzaeLWa+/Mcf/Hbn9ptueYjuz/j+j0dPX/L0q4/NDu7eXV46r+vmg3+/askvHmrJeOeD r3fXPPPiE3c08F0WJTOTn8te8EqM1qZJZ83y65yP/QFCObPGbEjQ/hGL3WlzBi2W/pnB gBzsH1D62yN2mz+LErcG5cOqNWOU05FXjw7mKu3wYH4Rd0lZmQqdCn7pfl193V2iHowV cgC76P0Uu9dead9glytdl7tW5UjTvEvVxZ753pX2Gz0b7C2eTTlP2i2KJkHodKvVZnfI Rop2KSeMjgEcwIakP7HT4e02W6bs72RPkCy2UO+LXiropt3dNEdbpjHNz3lZazY2RYV2 ilISVaMMPT71Ai+Jbh3o76AjW7OO0k46EktJl279SV8VdNB701SMdQs6cq11KlaX0lw9 ICQGpwqKpggKYYUSg7zS5bUZxV6utQTpjMXn0F4qcjIavQhJJDc6sz1035J1zz+2dtgE j9va1LFh8aLNnvbw18/dcGjJVfNv2Zr48tgrSXqrf/vG+C1rHvU8zG5YO++W227T9r5x dev8OQ8NCr50d1fiX5+DtgyeBiKrSid0nJ1G9RHuGttC24O2XbY3bcoEaYL9l7LkBp8T m0EyKharZCQ2CPwhSfZIkizZCbPZZaN0gB2AG4jRHbqFyDKqkEMWuYNd9YKiWPQ+oSJL rzYEwhcnVg3kG7FKWTposW436rmRImNzeLhxqxPLMebV7ikiTGUak5A+Lu4BcmIfpwPb 6+igm8Vc/wMaUCjDU1zFlKqfq9wWKINRcLrUVcKnuaRk46CYDLFxOp2YcBh6+4kd6767 BHruXd06rETKHVgiyX36lPJH1IIcqKN7bLq1xNY8pcSmR0tsuQHEA0t4hVgtTIvhdJhr WGbEJbko29ZzG/v1L15/vT0xnM55Utp39rInE49CsO/rWQLW4+t/WHkKenZmSnb2E4rx 2fkk0IDDEszMDLi59rQ6ZTkYsDsoMfqxZgirQCBCzvjaz+WEr4Fgo56DkA0uGv3dQv86 RViVfWOflj7bMp7OeM12zPaXHJM5w+8YkC2ZhyhDrJ3QZRLkQ82wZLozMg45nB5Hhsfh tENI9AzeEd2xw8EcDqeeSdOdesEp06NcgKDZdI13zzVHXaauU7eosgox8Qsx8VPiV/0M nU2JiX+r5n6RDidOeh+YamSrY+/PiUvoQnH5SWDqQECu98RA61wlg+ugGE5sNA2KKaAi EcpP6D26HBbXBYIDackIZ4Yl6D2S6THCGohWv5S5fekt7bs3X76536672Qc9L0y+7Z4u alpx16nf99BmteXOg4892Dq5zMv++Wxi1ezE6T++cU/rcYgGZGMiaJcJvdeHDKCT05ov 5KQhuN0kmtMvqNup3Y6FMUfJDXrsliAl+SomIWXHqUGfypd9n9B7PhAIeNqOO/zuYfV3 vbSs61YP1nFaDlySRSuMemZFVoU2yz1DWyLNN843LXbP11aYVgZuN20IHDO963UZNS4D fVNSYaiOCKXHs8KiwMgL+moRLcwLXLyXU+wM/cyhR+dwUkLxmXv7DKt2pO4me/ObVEFK lRIVVgtGcfIFbiuqWwssXNUFaYnuLfPN8S3zrfPJPpimhmqflzfq62B5bbGUqQZZ7Obr l9B7aa3H1y+QEDaroBkXIK7xaqkx2lcYaAYjX6bcfJmK5BKXWoyUl3p+0oYG6Uybv+DS JTPLq+ey8hevbu+5/shtf02c+PWmL3d/3FM8+e5J1z3x2E2rn5GnOxYPmThkzDcfzatP /PtPLd03w1W4hu56ZeerZz+ue6a24+EHnn8edKXwqBKsZ0/D19+oOw7aqYw/M8lm6DMu iUMYlc02e5MkMT4pk8VSLbFsp6nJ/F9kMqg/h0lliJbRdTAis6CMhOLHVqRueenEU92T 1NPcKuM7BL4tKXEJPYQZWF6XMTycaSCSwRgZ4XYXN0h7Nye6q0Y490u3/Pcm+cfdm+9L uBNnOv6ym35N33iI74imgwezwIM+EiFDGElxYbuN5AQHcT0Je4xVDxrkDgcNSr+g2x40 2/gyi03AKahKIDEnaCmUCZCUAcURUej0Y8U8KcxUgXB2BZJmYCkv08btrUzxxEzBwJlp Bk7tRs7bkoDGse4SmCXpnckLoiNiE8I7AoR35ITYoXBE5KXb52Ywmj2r5/KKvFnOXrxB HvKR/jS+XqFBW1ToxFRPxN6Iy1DxcC/t773Ue2n0c9tXQxTzELhz19I18grTcut1tpX2 1b47SQvdLG8wrbfeZttgv8v3tuv1DHcuZKU1oGXzSNMG82ighnX/uB7sr9lI0E9s6MaO QfSnngSbXjZTcwe7WldjTU5dg+XvpMSpOpmzg96zr9DfFJeohPLWvKbMXoNey9QzWebW oee2Nqcg/eAa2AlpM8FdUjeYD44vXGmZ4TYeLLzlZHltLY1GhxdxCTnPHiDIyfB4e60H g3S+8NDFjUs/f7nr6yXXbLwrcfqDDxKn75m7YcnC2zdddfUdoy7dOn39zt23rHtayun/ wOIdH36646r7+xccvOPFJKG0a8srdMbC226dM2/jbWeTE7dOfqr5lmd2cr3I1zTOk0Ho xedSu4cXrCEsA/kuLAKnBZH5aiAWeCAn9X6con6XIKlL7EJdfldBzNov6HSEHJMdksPh IVMoFcakXcXugvLVBmpVERQ/GKsrFGqkUEwMKM8ZUeV69OPfcaYTG+vzOvHT+qkPEAuo S3Dx/6fVC9v6j6bQ0k8N6UWjsid49cgV3ssjV0lLvddkXx1Znb02uDn7zuCD3l3ZL2Z/ 7f1cO61lXOR92LvbK43qP9/A+vK1NwJm8oc1g9YvONkxhy+0AT48enRKSim3806EOmkJ sUInuy5cWrcWcE3dzhW16xwvuXQXc21N615sk/kSylmJa95z62ev4iV1y2kdNsvCzBzD hhf15foWMQEzwUvOt85RKjYOmYKXGnd71zRMXztlBB1x4Jp9Z6nx9S3dN63+52PPfsje enLFDa271qx9lE5XV187Yd37jTb/zCXU9P6nVH0w8bfEd4kvEm3PvSwV/WrfwYc2c6XL cPJG6Aac8XIfz0jYEjh/NpqZoVSWSqlBtrBS2DaEaZiLR02PPoCNP6SC60/sCQTJhThk DB+WKQH2Hz58WKo9fPjs04cP445t8B9Ngw1rpQk9KOUWl5jMo/pahhtGWC62XC5tkN6T jKssH0gfWCQD126w8ll1P2Wz3KI8I39tUiwyHS4fkxmU5nHd7A4XSRoP4BVqs5W4eW4b 0qZ0LPO4T7gIcVeb28vzP9EvykKb+fkXmcxZWRdhs2XGeYNFkWRZUyweGMFmk0kzGjxG o8FiIQqTKTNacfxnkZgVXqoONkp3Yq+/Q4krXcpxRVYuM/E86xAj1YzNxrhRgkNsg26z anyCtLRfgQuacDCcFuYxPA0/Yn8jcjgC30JH8jvdwtUoqbON3sknla+/fJnuwezyGYYr q7SUe89K4csqLYWMcYcW32Ui9gu72WhSS02ltCrun14Vz4EHdj+Rk++PrE0JPk+cbLO5 +Hyd1H1ADKrDVWRSHWqRmWMW1a4WkVS7tdBoKSzGbWyXORfzVpBVInPIzSmB4+OTfV6g 3hJQ6hN4AUpMuZ4SWfeU8Gnemw80M2WFpx/IH0yXX1cXI9wYhFHuwmku/kbXtlfZ+9TY s53dkiQ9p08qnT392Xs9z519gH3+dYK/XUFxMkYMTvCNyk702uam5GndyifR5LDD94At B7YpQNCzb/R+HLO5ebHitElmOAhNZquDmMzMYjVwqljhZ0MISuzjtawqSPB5rx/o+156 nU3Ri6swvnBxD1xZV5d65EgX3+bHYNjzWSK9Tr6QUeMeO4MIJRHKIlREiJn5To/wGgzr NRZQA6c9c/CQWwOGaosIYRh+LzQybvheD3G2iMJ5pVncRU4RKDaJUIeVmEyUif0Zf5pA xEMOsJnEjbmaqduJaIiIhjDC1GMJX5BjpwaDx4RntDQ1GJi2vTSPpdggR19HmNPkYTkm eZVtg+33mErbpbZLnVJ/Od9e4KiRrpBX2W9wbLSbrEwxldhHOCazKgmmsWmifazD8gDb Lm0zbjPtlJ42GtzM6XAMURikjJmwvgxRTEBNtmnOaVSnjJlMZovVarc7HCqnU7272c3c nWwndiZDWxXN1EGH6hab2aLptnVWau3EIB3UihLWQa1wSkHcnI0qhY9n5guaUq80K5LS wXa2uUbX+mNZ0FKn6kr9cD13Z2epkKjS7HOJE3XED/sPAvbTla12d3MB27j24EaIFyI4 cqriVkhWEJL1ErElz8DjdIyw5DGs+rWQOhvK+gmpsye/3+Ow8Nz0JvbdfeESR0FYbGT3 FZc4CosFuncgctOb1VjtdcvrIBtc9w+DS9zrG1FMw66ICy+AuB7AafQVQ7xZ2LdS5UBi 5vOJGqXzzHf3XDLlV9LZH8fLb50ZLh8/o4m90MOwmXsgK3acL7fqBQtcSzysSq3yXKFe 4ZGtNqzjDuLzBxnFgaM7aoLWgQwJTzPY7ZSew1nIlK1lU/yz/XaN/h+aLCWFaUZLaTah 0E72KrSs0bO5exgsx3914ihgeR1PT0zb3VBm4jyA7zcw9kJfkGV6WDjsAs4dLdh/hB9m /e+duPTe2m8SbybuoDe9+HDdhKG3JTYpnQ73gn3XHEj09Dwr0c3rZt+aKV6QomQ2bJ// wvnBEJap950nzZObpBWynN93uFQSGCddapzQpzJUkTe+73Sp1ji7z+X9NmU4IhBQoQPy ehEcvaRyYGKmEGznUggqQ51DlaByCkHlFILKKQSVT+vjeaV+9mgey5P65o9wFkUq8isH z9JmRqrzl1oX25c4rvIs8N9oXW1f7Vyrrsxryt8gtVg32Vucd6m3592af699m3NbZjDt /B0YjrpzotnmaH8aJaR/tlsuHBrFS0mM2AfemLMph+Xke+0Dg33zab7ihTI8pQudogQH moNBrySMtBhs1jpAOqrDuu2Dxyt1YXubn+ewW5VwoE8wB4fxOIs30Py8XOQZsB0dmI0n suot4I5uvOEkDEGhaVWq0Sk41GykW6kBVlBczxjIm+RNo8eXmaOkP+3PPSYOB6sGckq3 8yf1zy7EmGjUDXexKAKC6QNbAvled/I62GRjGcgaOu8K7lg/VTfxBNgHFgc2cGCpibCo xMDgs4ud4MEpPiIX/rBGKFCsZ7CrOP+lfjibyCgOMljiKf7K6yvMdW6ve33GKPa7hkyP z4sNtHDLRnLzorNfsM/5/dplz0yfMnt0YunURVff/N0vH/9hg9Lp3L0r/mjJSPpBTfPq DWd+/Ubiv7fT99Rr77p8bFNF5dURX0Os+PEFy16Zv+jt9Y47715/xeRhw5b0G7131cp3 mlbgBUFuc1Ulv5SD8hiSibOn6bovRAKZ2ODVKXXmausCaYmyzLzAasLe5IRYFmBYntCn 8WWhT4CHfd0fKD96TmfLQ92jsoYGyt0Ts8sDU9046wngJcfshsANhhsyT7PTfhUv0Tnt Pt8Ub7230St5A86t6g44EVQ5J2Axkk72DHd5CQkQZIWHAZ4FGPv3ZQRkq0+HH+4jQRgg KacgkK+FBQOkSzf3HVAUh6slO8RNrvxoEY/18iB2XCEa8g5T84x63oCikLHMOBmWEhZF Vm30c/oaMRCEDr6QGXH8gtDLh2bMChYVC5Kn6FYXm9hzYpIKSmLjjh/XIDCRYrG0E6q0 Z3lp2grFagZ1gjqwOqgv7bOADU1cHmNYOC1oWHg2DNKVnQXf7P8q8S31fPRnvGd29ktL 6+3zNvd8yKbaRs7ctGYXnel7vB3eJAkvdfVLfJL4QdWe71xI79swbuFToB/Fe0dE4u9A emjDfhzGdbVl+riZdZyffhiq8+XheI+q0y6LrFG+rCKfyWVzeSQF29CAYvRYLbZ8sz5s RFHSTLvM1KvzifHq3E4x9xOhh4sMDNx/6C4+UWaZT5o5m9dDLiwhPnFmD6cX0t/DK4t2 zZb0MeNp2DhITvJycviKRhTFvSe9rNG7wxv3Jr2yl3ny+TlYl66iDycxHhx/HCHHcSrL 9XnaiP1R9/FOENE0MfGmicyb5ZV0rzgiY7wdvMyGxsmkzIunnKf3xfkXll9IYdq2TVNU HBiWwl3q4u4XfmAy7kbdYXAY8x0GWw61m5w5FAcasdh6Ag8yFaajkNNMLI5iG2TIdG1s v7lr1XNV7SuXTLmrFBbkd/fWPfFQzxz26Mabpt+9tudAmkafQ8a8dK2eoUiGDLZT7VD/ Jn2RcVI6nWHALuGkXmq1F92o0gfUI/7j/qRf1kweh8frBo2owWu32B02R55f0MUvaGQV 1LEK6sCWTFPHKqbImsunCLmnUtSxCuog/UOKOlZBHaRP61CfhmqrYAArTcK4mYS9eJee zSnlP+lnjf4d/ri/yy/7JTYs0yuIdRoHf+kdxM8SCLbUBQTCySYnjSCQLAjEm3D/J8En +cTWNEUbhFiXTwmi8Q3r+b9uGEvceizr/olqXoPLbDFZjNi+qVGXwZFDnRZ3mnoD1vPz YHAB98en9Kw3RUGhbF0bH1v5cf2jU1RL+4AllzQ9LUfvf76ycWLh2p4mtuHaa8rvfbsH L3ZzXbkxsUgOg45u+Drn6nfb1IHqRWqVKpdpcY2FtP62SJ/CzMI+Y/s0als10yjfqJzL fJfl1JqusM32zc5ZbFpiW6Re41uS06Ud9Xzs/zj7aPCE50TwuJbUvBE5psYyh8uj1PHy Zeos9e/W/+qTUK0uB1RlwMB5IACr25GVd8RCVYtuqbc0W2RNcIImTtn4qQnOB7DZs4i9 K9Kpnd75Vnrq9B85X+oRTg7LCpoxjA1z5xPSRbF27qBxepLKIVqGt3clKOKzeh8ueVRs WajwUlMYbMgR1j1qnIaQwhPDqwpBpGLNp25OZ5oVurjYT/myeY5+dcuvg9ez5xTWyt68 9CZe0FOcWsISXX4dWZ7ByZWSN49wPfR1wW11zoW18YlR9y6848jilZ/eNGvLINdTq274 zdMrmvYkFikvtUydujn5wOOJM3dOGNVzRnri8MG3/vzWofe4vsxLfscGKNvhK31/P96O 72qLRIugt7BWAGnGISS12S1UIl4V3kgLpl2yOtVckkvt7nwbTRpNlebKemMjdtxbjTIx asYd2Hp3GY8Y8T4KViYuEED4RAvkO2FWIIfvf0TO92L/jRyu3rDMcOEH3YCJrRLSX4ql 1tjJFhM/HbHnqvNVGbgYU9cN2VBPnOKHINx57CqBQTVsmPomX3hisXwf99NEh7siw4e5 isUZlPD2MTV7QuncpQW33da2d29GrF/w0UfUMQseY/M2U+PSxF2be34xsQBHfdDBRLId jt1xVJ3jLP2XKcfEuZ/87lr3zJ/ixCLsinFsjW8DeH3+Q2wck5hExqnkx+cTw9RR50pS 5YT4DMji79pykJtINeBTQClgJiAbwPMmAhoAeF+bVKPufmUm2WZ4hjyA+GHAbORXATb2 Aurwbx9G4LoW7zx3siPSb+VrlQmGkYa7je+bvjNrllLrn2wz7c86NjuvVMe68lz7RO98 6LSEN/MVSLeKt2QxQtmObyYkpPmI3OkxGPB+O7mkcvK0GeNi5dctalg6cYaogUrJvty3 9DM/H/IkPCED79RmEi84zi/e2s7Be9t9yCAyhAxDfy8hVXiDezq5fM8MZ3mu5CPfApIA iYQQDgZMBswBbAE8AjAQZzpnGeJ1gJcBJwEGoku+1nuH6R2I7hRR2+KlhSLZkErOrhPJ tstrU/HEqam44tJUtVGpakOLUtmDxqbivgWp2J1f2IyHt1nshV3lsOPIEQAjjQgpO4jj PIo3i3dImSQOYBK6KnJ0yd2WFy185GVJJhTvTlF8CRBKdkm01e4qLLewJPsWMxVi37Du VAnrbnO4Ch8pv4x9Rp4HvAyQ2Ge4/sr+Stax4yCMirAM8AjgZcA7gG8BBnYc16e4PmGf ECf7mAwGlAHmAB4BvAz4FmBkHyNU2UeczCLkeBmAsY8QquwvGNZfEDrZh8A+ZB8mu9jR 1uKSwv0CiQ1OI6H8NOLLSSNub2EH+1PrD/1DHexvbVostKN8CHuXxAHgLYQqQANMAdQD GgEGYMeAHSPNgK2AHYA4wIB7juGeY7jnEOBtwDHsMI8RHTAFYGJHWtFMB3unNTo2VO7F a/NvgOlC7DDjn72E2NvsdRG/xX4n4jcRB5F/iL3eGgyRcivKCe5REauIB6NcYa+05blD yXIXexmTFEI4GFAGmAyYA9gCMLCXWW7r/JAbDzlADkFjhFgr+UrET5HHTERfHNKj48Bj Gg+ioy4ChuAR7ZEo06PbtiPJg+jd9wLjQfS2zcB4EF29HhgPoktXAeNBdP5iYDyIzpoD jAfRyTOAIehgD7+Q1zdUPHkJ1cqd7HrM0vWYpesxS9cTGV9l4CI/wL0XYr9qHTAAM/ag Hus/INTcSZtfpM3TaPNjtHkBbb6ZNq+nzaW0+UraHKPNAdocpM06bT6Aw05KmqnefkGy RPfT5kO0eTdtbqLNUdqcT5vzaLNGi/UOFm69FIKFqFJEbeVcrli47aIxhU70MYwZDYOt wxD7lxG+A0iKlI5KWm6qclaQx7ltA8pS6UGjCpeVX8Jew42vgQyvkU8BMgj0GtjoNTzk NTzOibAMMAfQBfgWkAQYUDsX49giQifCwYAywBzAOsC3AIPozrfoCiPLEPIuPi86Nhhh GWAyT7HXcPHPXsIsrPfB61Ex9RJpS4A6g3RyMBlkxcTrhTp0u0x4Acq+79/27/9tJ+Zy M7ubbYEyDOFjk1S8pfWHPjj1f6A1eiBUnknvJ0EZXIcDjyjNRzySNIn0cBIw8fwiEmC/ QVzYGpiJ25yt0QIcjzj4XftCPwROhL4KdDCgXwYOhN7TOmTaGvozcn6zL/RuYFPozcEd JuS8GO2giDo1UXV/YGRo9yFRdT0KHmwN3cyjfaG1gYtDSwKiYEGq4MompHRnaFp0VugS PK8iMDekN+GZ+0JlgStDpalaw/k9+0JD0IVYCh2AzvYPiEYjQfHA6uIOulAvMG4z1mB/ OsJYaCwwho0hYx9jjtFjcptUk8NkM1lMJpPBJJvwro3Jw/d4Mb5GeQz41o4SAxga5wQC V6FhqFiguF6jJoYPKeIZUhWrmj4W7sKueaRqrhY/PT3SQS1TZ8WVyFgad1eRqhlj4yNj VR3G5LR4cawqbpxyRc0eSu+uRW6c3dFB8U5wB03yrNtz+Bv7eE+Fum6/K4fH/W6/q7aW +L2ryvxl7jGukvEVPxPUi8z6il7TD7H/ArxPfFvV9Jr4M31q44UcSfaprYr/gr/Svx+f WZ2srNhP/8mj2pr90hj6XeU0ni+NqaitreqgM0U9otF/oh44BhHqmYJE4/WIZgqm6j2Y qpeP+1Evj0eoZzaTfFEv32wW9WTK6+1pyqus2JOHAHV8GmkSdZp82vl1DuWjTj4C1PE2 k0OiziFvM68THyMeEwigShABqlB8uyWqBGi2qCJ6vkdUGZyusulclU2iJSnVG1GHB3iM /XhvHftx1DlvIv93dMFYuCbaRtfOm12JzyHqI5ULAPXxO1ct9Meb52rannm1vABfJUTr 585byOOGBfHayIKK+LxIhbZntLjvP4pn8+LRkYo9ZHbljJo9s/UFFa2j9dGVkYaK2raL pxQVX9DWpnNtFU35mbam8IfBW6ntuVjc9x9tFfPii3lbxbytYt7WxfrFoi0ieHxKzR4T GVsLJ7iI25jVAn6tzwnXjvWqjWME844O+2/O6YRBspNY8ZmCDR+22AGcrweWDyznRZAp XuTg37yki/w3jw7ndNKd6SIV2a7IWBJbsbJpJfFXLqpI/ZvwQ9aKlZwUqTDG8372hyqV +HylAl/ywtM/AN78Mnjz9xiNyK2vqEXeqN48q7USu5VU5iBkjuIVJelcRZ5XyvPM5nTF /8kLok/IFkcEzexAG9WD+MC5qVaKB6tmMKiCGbMwDfj2oRPmEl8kmmoxwCYao029T+Pj SJ/VxAiG3NQLK1amsfQ8rEjH4kZ+S1PvdPQ+KsZnifw//8NkKgplbmRzdHJlYW0KZW5k b2JqCjEzOSAwIG9iagoxMTA5OQplbmRvYmoKMTQwIDAgb2JqCjw8IC9UeXBlIC9Gb250 RGVzY3JpcHRvciAvQXNjZW50IDkwNSAvQ2FwSGVpZ2h0IDcyMyAvRGVzY2VudCAtMjEy IC9GbGFncyAzMgovRm9udEJCb3ggWy02NjUgLTMyNSAyMDI4IDEwMDZdIC9Gb250TmFt ZSAvSEVPUlRDK0FyaWFsTVQgL0l0YWxpY0FuZ2xlIDAgL1N0ZW1WCjAgL0xlYWRpbmcg MzMgL01heFdpZHRoIDIwMDAgL1hIZWlnaHQgNTI1IC9Gb250RmlsZTIgMTM4IDAgUiA+ PgplbmRvYmoKMTQxIDAgb2JqClsgMjc4IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAyNzggNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1NTYKNTU2IDI3OCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDY2NyAwIDgzMyAwIDAgNjY3IDAg MCA2NjcgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDU1NiAwIDAgNTU2 IDAgMCAwIDAgMCA1NTYgMCA1NTYgMCAwIDAgMjc4IF0KZW5kb2JqCjIzIDAgb2JqCjw8 IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL0hFT1JUQytB cmlhbE1UIC9Gb250RGVzY3JpcHRvcgoxNDAgMCBSIC9XaWR0aHMgMTQxIDAgUiAvRmly c3RDaGFyIDMyIC9MYXN0Q2hhciAxMTYgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5n Cj4+CmVuZG9iagoxNDIgMCBvYmoKPDwgL0xlbmd0aCAxNDMgMCBSIC9MZW5ndGgxIDIx MDYwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ae18eWBUVZrvOffe2qtS W2pLZbmVSqWSVJLaslWoJDdJJQTCEiBgwppAgQEFQUDFjShGMCiKSru20iNLjzPvUYD9 Gnu67bRjO+qIja3N63F6Wmi1m1ZRdHpDpfJ+51YVi+3r9/547/31KvV9Z73nnvNt5zvf vRVCCSE6Mkp4Elqxdng9d4J7BDU/BNyw4oZN4tl0miOE1hGivn3V+qvXnvhlMkKI5jlC 9O1XX7tl1e9eHCwixPYXQir3jqwcTp5bv/YhQtoexfUNI6iwvGhdjfIJlMtG1m66aeJG 0wjKf0D5pWuvWzGs/Sz/FCHSMZSTa4dvWq/53NJKSHshyuK64bUr3y66aQ3KcVZef/3K 9Q/mfbwd5cWEmM6gjuKPffRESdCPeEiIaEk+sZEStBiIkRQTNykgPuIiIskjZmIiFlKI fn6iIU7iIFZSTrykiJSBCgGMU0UUpJTYiYrUYqwg6KImlRidIwKpJhWkhhDFfbgHUczH WAH57kRwIJ/98D/M5CfPTX6bkMlzufr03Et5XH2YGPgWYmCjcLbJc9wpYprce3mP3HWX Uh59MiU1EgYCK3aQ21iCz4pMgnS9nFuQLX9z8uI3V//N2jfIq+SfyDa5zw/JUfKP2d7/ SL5HxsiLkJub5JpBMpvcRfYC96NmIZlG5pOlBJJANpB9ZH/2quVkiITxR0grKDqerX2N nCH/jX6Ffk9kay4lD+Eu15NjuNMTZDrGayW7sdqHyT+Qp0kvuRulS5+TcvYUNwzJ2EgO khSuTRJIHz4zyR2khyzG3LrJAsxpHe6+kBwiz5GV5DB5DPU/JHPJU8oXiJrbxDg1+Z9c 8+R/kp249lvcJu4Obhc/SjaRW8lT5NfkD+QBcn/6xb/NPfm+fxs9QB7FKu4iu8DThXwL 38cPXeTt376SkO+DXj8BbW4CVw6AL0+RB6iPPE62k9uonnyb/JBGrqDO/2q8b2r/PrkX Y1/5+WfyPOi2H/zdBYptBF++i9n3XdkJilpBtZCbNWQhzSNfkGVfb/8/Ul4PWbgJEncn 7nM9Vj5AVkG6NiMdAWzO3YM20FayA1x/htaQ91HfQW4n66iHhsjLZAd1kpvR/9uofZj8 gIbQdyN5jlaQ89CqRVjlX31gD6CXsj1Am5pQO3mD6Sb/BevKf5izB6zEZISWkVcIuWQP qJcaIG/fJ8/i/n9HnqBuypM/ktMkTYO0EJyrJG8CXgbdfkB+Avp9jB5O8t9pxvaxYS9+ vj4XXLFTsVK2E+jz13OBtN93+VygFwfJk9Cv2yBDz0HXf0IeJP8N6b0o7YUGPUL+C2Tg AGRpFHO9+FEsJFHQ4GqGZRrkkX/O2ieU+QlWP/nm5HHWmsEsl951Mf8LaPO/Q5/7YCv+ /+f/U+D/IQU41VfvKd7lpimMCjr5kfCsSkgvon/EBPZD4x8CvgV/V3/zhPgL/BnFoclP FD9IdyjMirL0hvSt2Mv+O/k38jPyU/IeeYv8grxGfseH+J/yp/nPhSFBqTiu+DvyPaGW 3Ei+9fVRhXXCiDBH2CcsFGoVfmhQIfaqueQq7FVDZDm5BnaNSIPJZUuXLF60cHBgfv/c mTN6p0/rmdqd6Oxol9paW+JTmmNNjQ31ddFIOBSsrakOVFVW+Mt9Zd5Sj1hSXFToLnA5 HXZbvtViNhnzDHqdVqNWKRUCz1FSTZ0pZ+dA15qUq3MopfcmvCYxpZ91bmYwRSxuj9cs RoODNdleKUUgRay9qfy+gcNEahpMKQNf7zIrxftMn3tw8Uy32JUSfPh6pw8nUxVzBzxe 00n3xfZBDJsq6BzweNwpzofvNDThO31YTKZMfahHg1wzLUX6Bhgcm/xNEypJk2cQeO5A qjhXHGSjZZZy2SSfh+mZ+No0Z9Fx02G9qzORIvmHif43KWJj3c41wV2IpyoCmIgJOXk0 EkzR/M9T1JqitplY0pW3YJedavoGGnQl13i7kqtB0eTQJZqey1DUI46L43MHzFG3xyNP ujf1ypyBwzptp7dzpRarIHIFOazVoUbHKsCW9YepvpXKGU7f1XyYI2oDyGdh0+1isCYl 7RxCxpsA3dBivdRybHLi3subCC7LdCLoJueofM+UsjOlykxCXJ2ShlNkp3i4emL83mMm snwooE96k8OLB1L8MCZ1mPC+rpH+VGFv30JUYRKAoRGRsTshI8Y8sWtEHEeZ9R0C9iZw 6ZX1yZGVQ0xM6JA3gTZN58B2z4Q7ZUHalTIHUgZcbrj5fTc/3uVcLbLi+Ph2MbV3zsDl rR7WB0LgrKkWx7u8uBsG61rTwTgWvMg2WRqnJWXmSDuHxdTo8jWgGb7D9+bk3zNuSun/ 5AF3wB9cybSDEZhBcmgNW8oaXCkgEcd3rpSXeq+8NMir2LUmwYBdCOkn83H1woGuEW8X 6Jm9IQiC63nf16/1eFKuALtwfLyLTXE4idkzyuDrCsjTyBSgE+4AxXw6U1K/nJB+mQe4 ozScGMxWZTugRQAfUtJQYnCQLSrDgJTKt11R6xXH2fAqXyo/YPK8hLaJmureuQNdCSad 6Ml1DrScdbrPIt/bd7GaOtFnPHiWEYm1zPP2zslIwQijD0ND/RkFBtWynEfXbH951ONO 9/HMHRYPdHu7h8bHu71i9/jQ+PCxydHlXtHkHT+s14+v7xoSZfWnqP/BTneq+97BlGlo hDbLHGK3x+J4X/fc3pR1ziLGqm5xZBg1+LZ5PU1uj/liH1iRb27O6hykHzrAdG7c9DFW r4d1covdzNQcg4Vwp0xNTGUxofkD0IkVuEVXUkbQlXkY3M20hh/0da2elyWW24NbysLD bOCcbC0G8XiYPu08JpHlKKRG5wxkyiJZ7j5CpGAAfBxiLRO5Ftt81jKaa7l4+ZAXfHP2 4v6yfPzP5Bu2/aJsj5u9FjHGDDtmh++0ZGqiH2v8S1NKDYrJrLd2DvBujnVBjnPzLKcN YHuIpxwB+UJGE1jMcZNXPOFNmQIpRefAhDs+KJrMMJYUfXrQkUmq6YT3VcrsKMk3pWg8 Re2snsCugnqw+44mNF4UJLFrfCgrgJcvC11Z7+TIRVXKTB66y9aG1Zu8UF13hgxmi5et 8HUm8LmNwdfN9AoskQk1fTCVx/a7VN7HMsJ83Z0DIiwRNHeOnBG7xBHG7JQ4lJBNwqCb teeqj02eGkowEzgAGUQXd1bEIegZ0l4pijXV/7uCPgpBv+PewZFmzEmqwgrEetyWEb2z fyCrbjKfZCXAvaaxpVzZfpGKuT4wbFBnTypU8KoTglrglLU6o7sXO4MJ/VjNRQZcfjO5 LScebCapbuz/GRsgzyw1VS7La2fNPV9rnpZrhvm4zX0z+mEj6zjspTvmHJbojnkLB57H uUrc0T9whKNc51DH4OEytA08L8IHkms5VssqWReRFUgvxWhHOLXc3/28RMio3CrIFXJ5 xTFK5LpMJ9RRsuIYl6kz5fpxqBMydZJch/0EU+xyjsC8DXjB9GRK6hu4dXBkfGiQEZvY MwIIyfa2khTnbT1MOaU+pfWu7EjpvB2svo3Vt2Xqlaxe5e2A+EM5xGNQ9fEhL9QfBniA uOkgE2Em5ZxPPDY5CQt6HJbXk1L6FgNgYDWBQTGl8E1Hv6kMhlA9NTW6YpjNg4kprlX5 pq0YTKkvDogu01IajKDJjoAe3fI12J7ZRSsgrMNeOYtqKMfoYGowwG46sJrNSBThD/V4 m1PK8swkFeXsRsHBcYs3Im8nSl9K69uOK3CP6bIhlGvcKOJmbD/CV6XHzFd40WvFkAgO CGTFPAijUM6+WsY31KzEri6UY1MFaKHIciNhy+J9OoM2panFgPiyvK4WA+KrGgRR2OLl 0vZsB9zblNJhRuWXkTJ7AaiDpmlsLvhux+RZ15+wYeYcI3O9N6WoTFH5Vio0pwy+acNw FjLX61Djhd+XuRhjqX2sio3xUqZWxVaulx3a/mOTB71bmJLkPjXV3hTpH2CCSdzwISUy OP71itQiGE7112sNcvX4uNrwzRdk6KU2XEzZKGLX6gRCmOxo/gLQ3Yp+xDSrEemsI72S zxasq6isJtVFunBtXbWutlZXXSfUN5DKQChqsVrznM7aME/ajkeC+Lb9x8njEbOFOmJB fEzHTcfNUdPxiOk/Xg6HaH1dK9fYytfXlXtL8ziVt76hIRop5mz5KOTxNpvD5q2nZo+Z AdeotFeVOcrdxvZWMVTm0gzF7+nsXtFaaCyLV4vlNpXlAfrVBSU//FUT/Z3d7quq97uC 0Zi3d25+WaT4zuLaomh3ZXlrS3eNp9pfUahc953vpN8XHv9ylfDnL/4RCyQc4rdE+L1i JaLCpeR2KaHWeEoVOq1YmlfqcpaKnlJekacoKCkpy3NY1brSfFHLa3dLRnG2yJl5UXRa aH4xb7aYDySIPU/pVlhKnQJpiwYd0YCZOKJmS8wZxJGsYObZgNlCYrEQ3Mxo1BIDMlsc MXM0ato+MTHBIOypb+VAFr/fo1Iqbfl2h80D4jTSKC3mHDbq4fnCSNhpMvrStaUFppa2 9PymeX76nadov9NXV/PVUfp3L4S1zkBZ6ezwHcunzyiJN2nCYc36EWHel/tnza3VhblC bozApG3BmqsQlaol9zxPjJMTUq9G32PUlpQ4nByn0WodvEVCjcWxW9LWlmp3V4RKvQcS pU7euVsqra05kKjV8Jrdtbx5n9FicdJ9HOf0iPtKSkJa51Z/8HQEy8sgts7TpO1sIECc QUaDbObCywGZHM4gCBQ0vRyAXJi9tYLXY45GsOQoCpzXa/ZEWvnGKC8TxlxXy/nrBXG5 USytbPKnXzpZHfEYly7NKw0GT9LGcEt1qSN/hfWr5a1VBq2jvFYxP/3z8PRIse7CH1xx KT0abym48GNzZcfURPo7YZO/Zzo/3NXmtRlYkDlDE4UAmjSRpVIoYOSNu6WA1xHYHQop NTbe6XAeSKgdFl+4ji+NeL2lBxJenmytNhiajVVbi+DgHDXSmUXBgLxutmawP2p2RJ1t GUHIESAc8kFgGGfBa0h4PmPtZevz2KADqK8rL/fXo8DZhAeUefk+f3pJY7X5wtsaW2Vt elF2iXR/td+h46rNFVPoM03Vpi+am712izYczivtnkefSS/pbC1z6sNXrDass3s6utJP 0eVXSaUmdPV2z82unyvB+gtImWRRqFXqAwmVzWK1HEhYsVB9MLskZ5AtTF7FN0ycPivP b2FufgfY/L74n84iJ4sm3LeY9Eh48mLScHpeo3EQnf5AQodnLLslncvusB9IOHitZp9a LZKtpuBpWcIyRM4KFtMuWdUwN4iNcKXYyGSlf0+VgeZKT7E7f2X+V7flJrm/2ufUL9ba fPFFi9LrriSW3ip29MjysXnyCwWPedaRTqmswlfuO5AQHOUmQ6QuciBRmFfH20Z5wcGr 1Q3uwjpeHK0OnnYwRXAwYYgyIYhGncGXIxnyUbvdES3n6utloc4w3UvBc/DPZvsroeCf LAsXGBRqtc1XS0dqfA79bRfeqqu2mlUQTgjEQ7m1xLii+MKmFnrNgz/vkkoh3GF9vihN +/Jp/sBVff6Z6bWvvP4N3GB2kNmEJpkPAdIl+QpFXtwtFRZaVVlZkCWhkq/cbeUdt5eV 1ZTIQhExQ9VzCi6LPDN4TNO/SUQiiC3lcd5Sfz3TcrZ2b6mK/r3BXRtOT8st4dyHH/Tc 9dyK61o2bXhoVu2c9R0rIhemdFc6dFfK8dHvjxxYUyvMm3LPhgUbu4sQx6Zk/eQ5fg9s eYjcLRmDpjxbT7AmiHqiE+xQUSmOGruVOE1O0TnqFPJ4p7NQV1YmFNYIvLBbqrFaC/nC 3VbBuW+2gzocFeJZozFUcValipB9oYzQMcHDmpfIiybOtpxhN8Omy+JnicGyoQPScMha zGGlsOnl/lqYdrbT2R2ybSuVLbzdkdn4QBLz2/mJa+dvvq3uhi2bd3Su/tdtM3avXeHo XtrbfnU8eu2a0ftmd2x+Zvjbx2njwKrwzZt7Vy2MN19358z1+xeaCtOfDyz3h4Y7py7v r5PW3bd09e5FlfXUIsttB/h6K/gqkgVSjdFihkKbeWMJNfAlJWaNi7h4126J8Nw+Pk9b 4uwo2SeKHu1Wp7PUw5YhK1qAmmZ+fpotFpsYyS00mrUEVg8WxMNY56RWqDdndvYOoXm5 PRBqbNwqc7gR27FVd3uwpS5gXQHrvG9Bss7+FcnyVmVylLXGBWKJrcYjIkoWTp4T3sG8 w6ROKlTL0qi2WqtqeLsNxiBg48N7y8ujBVvzMnOEjmFuzN5mhI/mq5QqJmuge2bnkI0p m2Q0wkzvZQZ2Zb613DvycHLLf9kQ0VrLwnQfbGnl9FUzutdMLTD7W+j9zQET/eXa2b3N ddOqGm45eAf34KxG0QHtYtbzQnz4rmmecPLBW7gNGZtqLEvINtWONfwCa/CQW6X5StFM ZypFbR6doWJZlZxVs6xazmokDdo0IjYSjdtqsYk8nmHzhMICK4qMTgXhCzRud6HLaPR6 FBVGE52hKAwel6XtOFgVjZI2eB1ZKsBEBwIU+y0+lG0jcCesVHa7MvuKCs+W2IZK36kN waf4kJYo9Rq+sYPuq4yEvenhbelD7ooQvISw2lntg0vx1Qm+wVpVUWyIN2KH0Zb3L/7y H4VFi2b6tdhBOdIH3Uvxx/HMPELOPE/o5Jnn2BTJsckzkpbluFpaJFTgJCwlNMaeCp3O z/u/Ja3XjepSugmdQHQmXZ/uAd1enULP63SuEK0VavnapyTB7is7mPDZRGvIuteasgoh IM6KYKXk91f3CNZ8lFwGW5GtxsZreJvJZeJNj7pM1vx8dfEY1ZXzEXZTDcgaidRVjalR Ypu1Gps1yBaAgUZynBkxCDd8NafppQ2BJRvasGVn1BuWO6vcG2R1J9EAujEC+/xKpbe0 vLy+rszHtNxbqoRD2woRs9ttkDW20fMZTZctHveM8arHFszY1IpHip6KBT2zljm3DY2O dqy4Kc5p8/3V6U/0//pabXcocV3r/cLg9CnXdD/4tKF95KamuXPvjATdbXduS++b3lJX YteH6SvcyOpYh6tjVQR6zpEQ6H9e8QjeYKglQ5KvmlYqYK0fkRQmi81sNxm8Bi/v3SMZ 7AWug4kCUkg128oZDQ2MN+XlIVNtbeGYVfbbGFVg3y4RgG2tbW0XiQFnzZFdY768fr/K Dx3j/fVw3LDojMljNsBGlwjdS1ZMueaxeSt+ctf0bT3dXbzB4Y9+PiXP0zYrdNOtG66P 9c328SV0Wod37TtPPXN6o7u0xSS0Dc2oL7Zo6rRfvjlzUTxifemll//FO72nFnZhNdY5 F3LmIVukhIiHsFyKUloyap0qEovJIlp4TYmFGi3UBSe2vLLHYnTCmXtEctpLlLxyj1Ri Mpm0FtFq9XKUerXb3LI9ZwpU4AJ2Bgkzc1nWY6s4yXh9PTx418yzBU7T8SUbsHwbc09l Ey4b+EZHHg8xyBp4fvpWc6Qj3H1tm7N5aGrXjVIsOmvwquiPXln/2l1zd/L732zvLV54 bGz+fcmmhkRHU0ul9cuzD39wqxVsBB+xPiEAPpaSBrJGqjU/azIZDyZMtmh+0Bnkg2wh pZUlJeAtW4tKeTChImqqHbPkl/JexlAm6F5vUzVbWVa+/4qXWTGGtcRKTTM/wJIu8Q9+ ncrb6GfGM7ckB2MvFgwrAusp1PNClo3K/EDDx3G9sW3J6vi+I5t+ekvHtbE8T1NncPTu deurm5ua3XmXMfPmWZ0VLl2ddp/Q2Vlx/qN9H6y3OdOHZy2VqvOPT0y8YvQ0h1rDoMEI ePwweOwCl2+WOkSrvdhj5s3fkjwenZ1MFd91feriiMvkEl3nXIKGd9kFO29/BKZCV8wX 75F0aHFYiMdi2lZQ4LXcpZIp8ZkldtIcA5czO9llLAaHNzD+YseD85I9qcGBuYwEcNM9 WD2W39DIy8xX8aPSNaMz3/j5NS/fsXLX/CB/Ybx+y/Dcbe3XKKv6E1ffonu2c0bgz5/t ef9W6bq/32G54TuLWrro/Gvvmbb/Mba/zQazf6d4EifstZKoValVBxNqm8kCVtvpJwEj EU2iKE6IJ0SFgUdkYkJylvp6xCKpqIwv+1YRfBrOs18McGNOIxqPmuhMYzAQ/SzyNuM5 s2WECSuT3baZZ6MRJtDMvIHRlzZqHht1PTzlVmgsTt3MfLEDeJRb8anBVVmTvrq63Kbd Uu5ymA2CpmXz2MLZjSus0VpPTbnb8Cl/1YVnOhNeG/YCvb1U6uKWRLHhFkRr1+4Y8uu+ NyVsKZeWzVgNmUZYIN3O/wb8jJB2Mo/8p3RVh2eu369VB9UNvHrPRAM1NpQ0BBt4TUND 0DiXzpWIidpgl4ymElPQ9Klp0qTw8iZTsIdiCJ58IkWMrh6+Z4/kKgy28W17gia/Vl86 o4yRqRKkKCsr9nR0zOgSTVY6o6u4uJ/TVISFqil3KUxQDoXChlcO5s9gu4LOiB4zbLb5 0buqZCE5HgD9mOeDzQHHc2wMATNO6cig4XgkIpM2sy9kBQhUleWGCRHMxHF4fkFkcwd+ tMVAdb8KO0I+Ngs/UyJ7VN4hZOspO4aNbA9pkDGzrA4PlTWNhQPYpmKV9xB5C2FOs7eU /83zmpKyV5+fF59R1Jk4t+bu2LWv71h58Mb2/pnBBmlOT29s5Xhfz1S6/ML0VUPRnhpb ZEHTsqQrGr3/oYV3JPL8Pc175vBXqXQl17Q+c9jW3OQrN3VcN33pQ3OdsSXdbVf7rdMj sWUtVQ8sXrB1XqU5feK2Hf7EYHjghsbbvzpbPr9h4fzQwnhhfZWL2SyKyBQRSmGzmsk1 UpxnNOYqgChDhCGTNcBXVFYcTFgqbSItUhTxRWxnamo8mGgiMaofczrjxDsWyopyKHuO vmITYuenrJPHtl64NfImVIzjMggqH6Ih0DK9sPFc9EZZXWZromuFWYsGo40L2ivzjf4p 6Rv8pQ6De/bUCqk/oMqvDKQ3MXmXDdtncWxJs9vEgvqZ18xNb7+qzYuTst4idiaocuy+ 7sKeGYH0HYlmvwuHEln6+a7cjsVs+DwQ5feKBETVRa6SqhyCSziYcNlyttzIrVjPUyP/ Ls8Z+WVIeJ5u46xjnDbrmiCVVVobDAReOm06TYJLNiw5m7XVOT1GmIyHP5dxbtnGKxOB bj22yu9xGARnuOb3LaaaaPomReLFF784i9l3dNPnpFlBh7pec6F+QacXoQ+OKNJddLM8 VwciH2GdWo3YzqOSutCWfzBhf9aGyUpfn61a1GiMTnoX5xi7zPqcfvs0UxzZwLIJF5xt +yC3kWZMD6Zshcyr/JfNm27+/pHm+0dLW9ur7Mr8qsYPW+T5/uze7272DTgDsaFe7nez En6nrl4jy1obZC0OWZNY7MoyeYa5cnAG5TSfHfJaUFFV2yI63ApbGV8pcXitk9PjfGh0 FYb52mDtwYQ7aDPmHUwYja0tBxOtRKJ5ZpurTEGqxhqylG9gEuiAtstOEFtF5niR9QML jiO0xyJ4UG0midFII6JW7Mvid4jbYJEqdsaXI3jy+Q8HQK+Xqf5FSc1K5bWix+aKN9YG NWpfFT1UO9L4WypG5oTSowUuXWnNjaVForuJMXJjxG9WZcWTq1FpAtFA3GWzFZcqEeWT 6t5J7+hogzXmzfnGokjr3ppC/TmZyWFDob+z4XIJZToLOtJfgY52EpJsAg5LBxOwTNaD iXxiw2MHMmbIksKQcQYzhJD56PumVXx9hl/8jXtDP5TL+Nfx3spvpAU6NRimdQLJRx+B FXmGOHYSogwRhtRRpdMdnT1X0VDfcDDRV1BvW/bs0qVLDiaWGqmmItCt6FR28p2PGJQm Tc1YnEkEdgKWSswgxeMD1jGjh3a+C8+bqRkakZ7BDoCMZ/kQ6RnDc82JoziOIZXFiT3L Zf0GoIYQBxbNCQRg42W3ChU4c7IzAzt0ZtyoTJwHopGVC2almJnC/mrPGKuvGyZB9pKv NFYX6zJhwksqTq/Li8/safMkb3f2Lhlu6hzuLNFay2vSNzJDprG6S2vLK7rmlF2q09o8 pbVFlT295UpDvs+Xvqnc49Qzy/BhC18qxFt8psXLZvT4/XNuvjq9fUaz6ECsMGvl5l/X UV5oEmfMrEs/dGXL4PpElV3n655Rnb4nFi+1WZkHcIVxkfUUPBaC4HGc3Ci11DIW1LCd oJqhAEOuwjjeK+JwGKG2ymcrKvwHExXGaosxxNz1kKlhTK1ura7KHys9NnmCKTnSiedM ZjqjFFzIcAP7g3xou4wBMj8y+4MHYVWZeDmCXq57OPk2RlWXdhD4d0IwsyWorW5fyO/v 7i+XzWfOmn7YosubvmhJXcP89iqbOr88mCNV9/XTKovMJTOmh9I7M0J/JTmeEXolr6tu 5rXz0tu7WsEq0Ef28/mT8IkMOLFNl0oI/Ns9ErGrCviCPSqT3aSjM+3btKIeuqEtzoMk fg81edt4Jruo5KGVzFUBvswlCYcUF312eBvKK70ILv/Ev298ZfTkr9a9lt6x7ebOpVMK 2tf3bLnD9Mdz+9+/7vzvD7y/gX7xxn+0r9s9+6EXF/0c08Q8p6XnCjrwsQKR8TulKo1S PnK4SXltOY7ne6Rye0NBtCTKRx/BccTxLLwcbBvG0m3h7F6GFIdMaFE43EycBXyTvGVI GtQYmVTAbQ1kIqVIEdGVzyPZSBP4mouv5dxX38XgqMxa+cwJNjINYwvGkYWXQzwN9abM AXS9xhEIpUfKapxqQe/w13zUYjC29sycWrH/cPLHd02/KeJsmZfYcvMHTXP6PMVvtUs+ J4tu2Cq7m/mFPS0VBRZNveYZoS1WbvrzJ/tPb3DRZUMj7eKrL9Ed3lnTqjI0GgGNRPCy GNGqRVJ5sSzW1F2rrtJX8VWPSHq7vcxqheO+x2pyGh0mu2tMLdOFndXC4ah/mzFzVoue jmHLYUItH7kvO6ZlNtCMRF92LLE7Gh2y9cD5jZ1Icwc0QUyPhAIOTcOS66X9hze+sX3q 9fHuhMZRU5Z+z9k8q/6Oe667rmpKbEpBXnounhn52jroYMu02j99dOCDDUVii+nLXVO6 Kuxa/s0lq6aWnPgRzmalzUGczSjzbfgarNVPVkrFdpcT0QSnjUVoyp/1GY14oVxtUnP5 vFoxqme7scVk70FAR68wadTqSj+1jBVn9bmYbbEsfozQy/EACbDzCnxobKttM2W/IXte kXU0dzxh9vOv1Bh2sXHp2q7m4AZnQ7BsaocL7nV67WW2zs53zqxS/rYhXNXXHUr/3aIu EQ/GLlfSOvxqA2tbinOnFmsLk8cle7CgrWB2Af/jAkoKTAUi9LKgvIgyae6x2HuCCDpQ Rbn+Bv3des6nr9dzPNGb9JK+Tz+kV2gU+qJaG7zcPZLNXovnBntqTQX7Xa6qCMUvHNSm sdLSqHosc+Jg4WTZcZKtWe5QAf6DGMuWgB7M51iSCSovuZ4d4HKcvhQ9hs8RZWdTBDZZ XPNSrJmbHLLHZzT2LSvvW7nquraG5dv7+p/qXe5es6Ssq0Gs6F+zaF3b4Hc3dNyyhDsd 7yrsba+N1wWqpy9PzL42UezKf3PxPKM3XhOV6mvKe5Z3zt0iGaygkw+/SnlROArLdZUU dpj4fNEqlQd7rJLe2GM1PeKwc1qjkup5pUrSErhb2k9URmu+RlOsUujGCoKnY4ztJ1nI DQfTHN9jbTMvnAwE4D6ywDl77mfz2OQHZOzM7ZB1GwdWX6TVm6/bRTvTPzJVN1VXdJfW TN2auOP2h/lxdUXbskV/XpnuHN7YXugpaehqfewZLoD5TkNMxYdf31STVVJp0bOFhe6D iUIbTt1eFa96RPLardW0Gp4PNdrHxGLIbSZcqNfXcmOIWCKmAq+ggjkhFcxaMbMblR/r MBG9FCTMuQGYfnbecqCZ+XnZB30sriIvpDwTgJ5GiyxlHc3l3Qt8yjyr10+L4AI3fNCi NM57ZMaiG5oNvlb+h2l+882tVcW908P0xljmAd+F+TMT2UjKwv6e+++kN/e3+fBGDNZq nfyToMVaS8iIJGlCVrhVIRZXVplYoE8tYzhayGucdpO1mAWZDyYUBrPdrSBGax641FFc LLqcGo1HhCPTIj+uxmM/PAQ4BenMPtiGQ4xdFgFmcll82coe6mSfW16ML/9DbbnVkPdf X8831cTpDf6qqqL0oRvSnxV6/GBJWJcvut1T/Gkl/SDU6q6qRkxd7ZkqXXBzH82MFarZ w1lKiia/VFZjTT7yomTKM8lbBxAiefANmRNXhEy+CGRmKE/eVxhC7EzucU4yMxrkmxg2 y1i+rsXoQq3IsDmD8308tRGLUesu5uWgjGBwFpYq1EZfWX5+kZWjZrMVD1bURUV+dRCC YGGP8BmAVMByCD7jEkZBqowjAgrBDwSh5BRRRwSQMocEmGtE5aPWywjHg3B8cfqLnecc JRCInc2Vev23Kb3vnVSepaaBLoHwelzpd7dzH10wcb/tmVLE3C+/n9GQ45VffUF/X95V XIWH/WGVsahFuiCCfg7Y7H8B/RpJ8nlSNfkX5k4F8BKfFELGXUXyBG/IYvPxpd5SaIFX pY3wwVAQAamQkeS5qwRLCDLks1hivsyS8VoHgiMXH7kEM2cj9j6DLBMUJ6HLzkHWjMGW q/yX3mzAWyDWHCEYHTj1nbaC0jI6tXx27Gfvh2f50+vm5Vl3P262+irSRzz1jTUnflFd V22nO2bb7Fz7fnfU7ShWhcM6aWo6fbyj24htu85W7nrtFbvP4fYKIEtZrJFytCzeUIgj kj7iqC1k+zUl+enpso7UQkdadU6zvecD3R91nEpCjqhMKlGFBwkqnQTHR/cPklAoEpPd 5q9ibwHASXUY1ftVKruJiGKlPSMAMGdnL5IDpwDZbWGW7XUY8cASGDQF27QvWulG+dGL /ESKScBl7OdUnLpx5LYFjV2D+rLS4mC0K5A+4/aU++kjwXKLIe/IK2ZrsDmjR3NvfXyW 4eVK0dG0aZD7bFpzMXY1nc1T4G72p3X0VEVnUSCnT5l1O9Mf0078hs5AvJJFeWTCIGkM PQalysAd1umMeRDh4OmXX46QYKDgY4Q/ZY8Kh3VsKn5anxdavbghWpuvOtOd6N60sasl NBMvmUxn9FwL1IhxeeKQtHxqlKOHOE4hyOMRBFQxFnupp/G1M2fOsHjgefwe6BG5vwq/ rWyU3DqiSo1qqVJzSJunoMoOdr1ecUipNOjlQdjEck8hYY8KzkbwCwY2picL9J9f455j X9yBfTLrvZb+hItzi3FHj2ThKM89JxFKbTwVFJRUNMPXzL2bg23VU+/h4ukQPUF/8gT8 3gms6SE8u+PZ7z2lAk6VkpQI1BCOVjSTt/gOzE6tUR6qgBE0zTz9OdxwZxsefF94A0Px Xt7KFvxQ+3D41VcU87/q5b/35UNsVhx+rUF4O55R+/Db0VlSpahW20l5SqpgDy84D2+x j9rz+LwH7UL5oUrfKCGWgtu1Wuz+QfaIgm09p09mHIXsvinfk4Uocd/Mq1W5oGH21SoW d8zj8Sw0+2pVXOuqDzdHC6pmRGYvs+y4/umZN317qrG4Nja1PpTvfYXuLa2MxGa1TF+8 omXmNQ1Ll+5rru25dU5lV0dX97zW3qkx1zEshCer+Zd4qvguZMkNP0CSCt1EsqttqkJq MOhUap3b7bKJdpfuKO86ag5+9uvTppPZByymk7kHLScjruORAudxMBPvPrDHJ2yft+U7 PFeUKH1DpyvrnxNr9JvTlotZ+h7/UtmMoraVa6Y1dN8y2DnnigJ9i8kAR6byR7lHIW15 +CVvo1SgdogqOymiRUVuu8Odl6dXqfWWo27+qD4zR0Zl00mGoc9vRzBlNjk5dsviVkwV PFeUaFSn886bF6v0Wsz0k0t5xSNsOsmRGQ310xe3ZSZ3qcTmRvGLOsK/ClmoICukqFhk sWicTru6yM4X2J+QigSNQjJZexQV6gq+4mm1y2XRKFRK8V6LpcpVodE4d7mCp6NBtvEE PzsZOc5SEmSPrvA+lWyB8K4JO0YEIR0sIAHPiZPfimFxqsaMq4j3LzIv4GWERKniXgjH y2ym+eavXg08ePemaFOjM7Si95/at2x5q/8HL9hqZize8MLgXn1hTTD9q9DqX+0Z7ehZ vSTYu7HjxEQs+swT9YNXJa++6VX5x0scfp9EBI9iMd4pKiVDmTfNguxNM6Naq1JoCxV4 2+IJvGykUBc40edAokBU80Y8nbunUPSoBYWizK0Kwv3FOzSfRX4BdzHzygEWg3fosmcj 7LqsCAvrw4rqPfUUgTn5FTIVom3yy1XQbITWvZQT8IrJhbe5affbmiOevBn6c/K7M2vS n9DtSkGb3iK/+rOvl9/41TPmQPiNfZk3Zejk+aW/n3LhIfDr4cnzAgebkIc3Igt5LqTX KzmEsgx4sPi0gafMZuXlmQw6ffD4TzHtKPsBVG/KMBevKxPF5JmmQVQyrzfjNqJQYHoV 0kVhKuo9pXl4GdLqEbgLP9jNudM9lWGP3bogn1+o8H3xdljYbDQW1iZogskNk2uy8HlP YJkx/kfiVjNpIj9dZ1lwMVWk25XLoJ34QT7rK39wnerxdIwQx8I/1F3YZ/9MHinbKCdh xIFfoOzXmV8RpfA42aK4nWzhHiVbhF7kryebhZ1kC/8Xsl54gXQogmSh8Dax82dInzBM Qvx2slpYD7vwOzLCXUtm838gbcIaInExMo/zEIWAeBlXTdqU3yXzhBsBbei/kUwThsgI P5vM49eTpdz3iE+4BnVqYlVGSBH/a+JAPp/uI3jNkKxVCuQ8911yLTeNTPDDZDGc19WA qcI6cgdgJuBhrOQG/J2jN9MvuAZunPuCX8z/VugQ9ikKFO8oZylfUEmqI+oKjVOzV/Mn 7Szt57qQvlR/xKA0PJqXl3crohIjxl+bekxnzOvNH1uclpAlabnT8l+tFusq63P5Zfn3 5p+QKRfGHiHgd+MKUNiE/wewEsRuw/8ewCsbmANF2JmlkA/IC1nY3T17Xnegc3jt8utX Dz9PRJp+TuOk08Vj9Itc5nwu85dc5s+5zJ9ymXO5zKe5zCe5zNlc5uNc5qNc5re5zAe5 zPu5zHu5zG9ymdO5zKlc5q1c5ue5zJu5zM9ymTdymeO5zOu5zN5c5v5cZlcuM57L7Mhl tucyd+cyi3KZhbnMYC4zkMv05zJ9ucyMXKY3l5meyzTkMqFcJpjL1OQy1bmMJpdR5TIK aVLm3B9k/LmMP5PxORl/KuOzMv5Yxh/K+AMZvy/j92R8Wsa/lvE7Mv6ljN+S8XEZvy7j 12T8qoxfkfHLMn5Jxi/KeELGP5bxj2R8VMaHZXxIxvtlvE/Ge2W8S8b3yfheGe+U8biM 75HxmIzvkvE2YKl1ujgql7bK+HYZ3ybj5TKeI+M+GffIuEPGeQwva+/Bz80pGYWJeACw F5ACTABOAE4BzgHUJCjgRAWYDVgGuA6wFXA/4GnAIcCPAVpSItShdx1616F3HXrXoXcd etfBgfuZ4CXvAj4F8MQIXAJoAywDPC14Ja/i3G9o6sLEBW7iwokLpy6cuyBkEn5i8sTk KfzLDmF9u1bwYdoTwCcApwCIK0h64dQL517gZGRsNwseDOxhNoEbQG8j8CkAh9tqWVlQ P0eN5dTY7hZUclkJvJVzyH2fJCXckyQIaAPMBiwDKMm7wJ8CJrknpXn8u6fsjsK3fwF0 y6129y23ut78OfI33Ai0dj3QtdcBXbPO7r5m3dbrCzZtzrcVXr0GaNVqoJUj+e6VI2N4 4WGj/eZOl2cLwNUe5h4kjwE4UghczXLcY9zj3BNEz93H7eLuRzrO7eTuxT9CcXOPkZ0A LAn4acA/Af4dIHD70ecgMXBP49rvIH0S1z5FDJNnuF1H8r2x55F5nGXaC7g7udvA4gD+ Y8atsKEB7nbuZtjTAHdbNr2Zu0quv5G7Wk6v5q46ogiIx7j1R9xi7Efc9Whn/dehXmD1 Vx0NR2Oa9nZuA3EBnkU7KtFnNUrvIHcGwHN3cVtA0QA3ipRdvxUpm8ct2XQLt0Buv4lb Besd4G5Ayto3Z9ON2XRVtt8mpKzfxmx6HbfgiCpQ2d6HMiV3M8wt4ZZyy0DCOdxcbh7S Wdxsrg+k1HGzAHOIlltCpiA/iPwNgM0oP4Hy95D+G1IttxpXXAOCrsBIK5EOYaTlSFeT OLcCMARYApgDmAVIcHGZap2cGYwKcFK23IoyW3ULZwbVutttqKekG/hlAMdNQbsK7TGk jEqN2f4e9FcxKkePWO2xdjsXzDbUZtMapIyN1dlyIJtW4UJFYGp7B8qUKID3AzgsN0p6 AUmUNgEEroMzybduR8pGakPKpt6crW/Kpg3ZtD6bitm0Dim7LpxNQ9n6ymxawZmwhPH2 dSgjqAv8PBfBkh2ck3OBKTpOzxmQqjkNp5WZowZzdCC+A7NVgzk6MEcH5jjAHDWY4wBz 1Gj34gofmFGEkUqQFmCkQqReMKIIUABwAHQANYnTeYhKYWV0VjZdQBczptD52fQqpKz9 Hfo2bFuA/jKbfkBPsRXS09n0FP1ILn+KlPX/mH4EWkvHkGi0ULYJKhwJh7MZKA1imc/9 S4kYQw/+SHV17AcU3hMlR0pKvc+z7NGJ4mJvrrKoKFdZWHix0u3OVeYXZHOjOms2J2m0 yOG9uqNS307kKEZkuXYtKgleeSphVSzFzMiRvvnyzMhRr5fNiHy/qDgmnXG75Wn+rswX W3CMqiUr/Y9fKgJTTvae5KSUzhD7yYQCsasJqfFpqzUmPRkMxZ58nAaeeFwReHy3EPj7 x4TAYw/yAemn1eHYg7v5wI7dj+7mNCucK/5lBS+uMBgx+Lnnppb4Yv96jGqlQvroHhpo fIp+aw8XcD5SXhVzPEJNe9qk2L/toT/Ev4Opxn4RoKEjx4XAMRo88jpLao4c55FUs8of 0hl0utxn+pGtisDzdBHth14Z2120H8vtR7zgbrpDZs52pIzJ92TTHfR++cJdSFn9/UfH FIG2dj3diyDFG/R1ufHnSKGG9E36+hEl46zqSCQSY8khzAHPq39dLLNVMv/KWRB79TU+ 8NorQkB6xVPKqHj0FZtDTl8GNVn5ZXsBSyXvj2vCsb45oNMc0PsDLOv991B4r6oqdvx1 SNDrHQm5/+t+P0u//7qjIPbihxSr1hx5R76xFP3Q54u9+yGVXnIXxY4eVgQOgzHSREtL bOKQEHjrkCJw6DaY63cs9thPf0TFXdS0iz09ObqzoUkeeqc/IE8lshNj33ufInDfuBC4 Z1wRGAcd//ApH/j8U0Xgs1EucG6vEPgUpJE+jtTFpI9xNzbM3jlzM2nX1EzaFJeH0+0F 49/dS/fiStbvYcg/UuntUdDnjq00cDtmdRtucRbwy61065ivZMcYDWwH3IW7bANUjsXG po3xq8Zo9xhtGKPlY9TdaHM22Gz1NkudzRi16SM2TdimDNn4oI3U2s5/YRTPh85z5f68 Cr+xKpBXHTCWevPKvMbikjyxxEgUJgUXb8nTxTfFH4vjjGvWa7Q6vRLBB15Q6LFB6JV8 smR9FTVWUZ2x1whLMYUk+E38P5B/Nyp1BIFI4xQyRTPIL9LcwD9BntA8Zvw3on+e6qhe qjK6aZHBqSow2EwOg0XINwTPX3f+6fN7z//s/Inzyrbz0vlD51PnT51XkGNUdyR4PvgD qiNtVCfVCl/Gz8f/HP9jvDpeFa+Il8fL4qVxMV4cd8edcVvcEjfGNXFlnI+TeF+0n6Ys vaS3vyNlpUjndaSigd5jvDg3FQn0pjR9iwYOU7prELUpbgf0uT8l7DjGIbF0Llw0cIy6 WPMYfsoII5DqHRq7bzAQKEol2Q/SR4sGUxGWeaBoEL+xj8xJub0d7O2Jv/ps3LRZrkO6 cVOmdWNgYyZzuKK8K1XVNZyq7hpKBHK1chvdiE+mf/aqQC7NXCtjjJkrXczkKi6l2SaW ZN6wJ5vYYJvYDTddPurGb7oHrmKPAi59LpXkEXOrynYguQVnytnW/+U1l4a/7DrKrk45 U23g3dc7HNYwJvbN7UhxnYt7U0n8m4TivkVDqQJvB/7nB0oNfYvw8/kOzIeREh+kmzZu BmLAKg4T/Nb7MH553X9YCbRo0UD7CpomSfoF4DzgL4A/A/4EOAf4FPAJ4CzgY8BHgN8C PgC8D3gP8BvAacApwFuAnwPeBPwM8AbgOOB1wF7A/YBdgHHADsB2wN2ARYCFgEHAAKAf 0AeYAegFTAc0AEKAIKAGUA3QAFQAhbQ6+Yfk58nPkueSnybPJj9Ofpj8IPl+8r3k6eSv k+8kf5l8K3k8+XryteSryVeSLydfSr6YnEj+OPmj5NHk4eSh5P7kvuTe5K7kfcl7kzuT 48l7kmPJu5LbkqPJrcnbk7cllyfnJPuSPcmOZF7y63z5v1OG5v2/+PwPg6lFzAplbmRz dHJlYW0KZW5kb2JqCjE0MyAwIG9iagoxMzc4MQplbmRvYmoKMTQ0IDAgb2JqCjw8IC9U eXBlIC9Gb250RGVzY3JpcHRvciAvQXNjZW50IDk1MCAvQ2FwSGVpZ2h0IDY3MSAvRGVz Y2VudCAtMjIyIC9GbGFncyA0Ci9Gb250QkJveCBbLTE0NzUgLTI0NjMgMjg2NyAzMTE3 XSAvRm9udE5hbWUgL1pGRk9TRitDYW1icmlhIC9JdGFsaWNBbmdsZSAwCi9TdGVtViAw IC9NYXhXaWR0aCAyOTE5IC9YSGVpZ2h0IDQ3MSAvRm9udEZpbGUyIDE0MiAwIFIgPj4K ZW5kb2JqCjE0NSAwIG9iagpbIDU5MyA1NTIgMjc4IDQzMCAyMjAgNDg4IDQ0MSA0MTQg NTMxIDU1OCA1MDQgODMyIDMzOCA1NDcgNDg4IDU1NSAzMDMgNTU2CjU1MiAyMDUgNDk2 IDI3MSA1MjQgNDk0IDIwNSA3NzQgNTQ3IDQ4MyA2NDggNDIyIDYwNCAyODYgMzI0IDUw NCAyNjYgNjgxIDU1NAo1NTQgNTU0IDU3NSA1NjggMzMyIDUzNyA2MjMgNjg3IDM3NSA3 NTIgMzc1IF0KZW5kb2JqCjE0NiAwIG9iago8PCAvTGVuZ3RoIDE0NyAwIFIgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBXZPNattAFEb3eopZpovgkWZsJyAEISXg RX+o2wfQz8gIaknI8sJv3/Ndpyl0cYyP79yr+caazevh82EcVrf5vkztMa2uH8ZuSZfp urTJNek0jFleuG5o13ez39pzPWcbmo+3y5rOh7GfXFlmzm1+0HJZl5t7eOmmJn3Sb9+W Li3DeHIPv16P9svxOs+/0zmNq/NZVbku9Yz7Us9f63NyG2t9PHTUh/X2SNe/FT9vc3Ls iI78vqV26tJlrtu01OMpZaX3Vfn2VmVp7P4rxf29o+nflxZ5VQrvt7HKyqJAg3T3JI0o eL8P0i0qfPEs3fEVWJxL9yigtvgJBXoLVZ9RoNpLaxTQJG1QYLFNblGg2qnaoUDVNplQ oGqTexTQLYsD4QWqxYFwAt1JCSgY5aVkFaj1kjVYXuZTJavgcJQokFUwqpWSVaCNlKwC 3UvJKrwnCEpWwYOsStZwz6ujC2QVVHXsgayC59quyBosb9DR8WFQVaJIVsGDNCqSVXgf dZKRrILJtpis8f7/1qqSVbBYeSNZhfccEUpWgWrPkawC1cFGsgp6tUmeZrArHWwkqyh8 bkrWaHmjToMPg17bM1mj5WUgVbIKem0xeaP+Y8/LlpWMN6jybvCK/32X9bbrVn7cova6 LFwgu7p2t3RnhjF93O55mjXA+AMQaAZzCmVuZHN0cmVhbQplbmRvYmoKMTQ3IDAgb2Jq CjUwOQplbmRvYmoKNTcgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVU eXBlIC9CYXNlRm9udCAvWkZGT1NGK0NhbWJyaWEgL0ZvbnREZXNjcmlwdG9yCjE0NCAw IFIgL1dpZHRocyAxNDUgMCBSIC9GaXJzdENoYXIgMzMgL0xhc3RDaGFyIDgwIC9Ub1Vu aWNvZGUgMTQ2IDAgUiA+PgplbmRvYmoKMTQ4IDAgb2JqCjw8IC9MZW5ndGggMTQ5IDAg UiAvTGVuZ3RoMSA4ODYwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Ab1Z C3hURZY+Vbfz7qQ7jw5JGpLbXALIDQSIjwRb6JB0FKLYQMBuUOiGDgQUEkl4I0Q0EBt8 gI7MNzqKO7N++xjlphPHziomoxM/2dUZZH3NOiv49tuVFWdV/FaX3r/uvR2TTMaP/XS3 uk/9dc6pOnXq1KkKXRAjIiu1k0Se1RtCLZRKV0LyMqhg9ZY2+dwnn/0O7Q+Ikn+9pmXt hs159gtEKQ8TZVasvWX7mkLL048T5Z1EH09TYyj8eVazRuSwg7+8CQLrUt4D/hrwE5o2 tG1LJjGh4xZUqbc0rw6RjA852sAnbwhta0nekaWC3wVe3hja0Njd/PZvwGM+Km1pbm2L uykM/rfgJ7ZsamyZ+N7V+eA/xSKOQcbwEcVKySAil5Akq1RIlPQSlSZqvY9ZWWZTgWjG 39brTxLtC5vjepvowltC9kNKKgYLsvwQI2LsADWTNX5l/FD8C+qjJsqLV8d/GsfqRyl7 47vpNJ2iE9RDT9BD9A7aA/Qc9dLf0/tov4jWE/QTWoWxv6SfUwfw7+gxeoA2QS5QSAb+ 3DKbPEx2ns7TEVZN84EjywOw8sBI4V/kP4oXjaJ7Jz6edtEuvpl/QJvx+Rks/oqODum5 Du2/plbaSQPsLK1iz9IarKcTmXIv98X/LekE5UvbKJ+aLUdFJgwrD5KftlNYejj+OfLE luIjGz8W/xy2hpfv69eMuROllw6ydNqNuM2g6+Hr3IRiOCKG57GG1VjLXnyOYDe68dmF eQ8N7ZlcK7iE36lkZGsij5IuNfrGP0b+btPbAyLeZsa+S1swg5umUjHZ4iXIm2vijfHt 8Z/HjyMbxO4/bmZFH7i/pUPsCDxYRTfSUv4yO6tzzeCX0nw2jmXSI7B9mTFjojZPlWTw IsdFSfhnMaNoni14aZS4uGP0wg6zMYjES/QCxXR/HqbDFKF2xKEN+b2MfPB9Fg620e9D PYeF59/1WUENyD0U5OBsrOcdw7JRJ72un/01Bvdn/omzPyA9b4wRUTQKrrhEeQU7aZyG TsRmM87fauzsef30iP0bwK49hlxL6JYOal/U91b0n00zhRfxWfHdiP3v6AZq5t1sMrsD 4zoTEw3BX0GayOQCeofNHqIb2vwheb8LZ2iAHhxqDuf9JmocJhnBjIzfCPUobNJZpiEO p+jXmG8nPuJmH1l6kd8DiNMOWkjVtB/7+A7ORxPOcBgRP8Vk7M+ruMVGKyHYPYldaZbW SOYuj9YNGSI+o5Sks4YwlZgFmT+Yu4muRu4muGE4O0mit1gO8uN+egs58QQ9jbtkrZAi i43yv9ujvbSRppgf8ngWzbvGfeWsqsorLr/s0oqZM6aXT5tapk65ZPKkiaUTlPEuuaR4 3FhnUWHBmHxHXm5Ott2WlWnNSE9LTUlOskicURkr0Apq/N71WmFNULMqtYpd1qwLzl1X rlGO06VkyxXlgalmLy1J1Si3Xsvz+bvIUxnQktWRXRZoUqn9Ty4Mvs4pezVLKb7K/FBY m7zI71LsbzgH9QGY1Ypq/C6XU+Ol+M6DCt/5ITms2X2QQ6FL5mnk8wuKxd+rhJAqXQHU i/xacYINCGvGUoY42YsT1T/CzQUsYu+yFtbUapTXRdb3NHKIbucqSSO3NlmFI3a0dGtU rrG8P2ksV2OO67Ck4VOIYWcqR4mBN7xe8YbXIaLh4HcxPWdE1CVH5Mgif3aF0+XSna7X Xlro78pIr1FqGtOxCtIF1JWeAUmGEGBbWrqYdTbTG9zqndXFKTUT4csR7noFrdc8B4Jo KLWIGzS532li8f6DQ1WEYUYnQje9xfQ5teQaLcVwQl6neUIaHZC7yvojB2N2WhVUrWEl HLrRr0khONVFUqm3qUEbW+9bBhGcAAWbZLHdtXolNk/2NskR8KJvELVSi6HD5eGmxqBI ExZUaqFLq/Hvd/U7tRygV8tWtUwMz9zxgVOKeAvWyYKNRPbL2tGF/qFal+iDJCiYWiZH vApmgzHv+rlix8oHt03PxnlhfXM8B0Ky1r5qPWKGb+hgIv9dEbtm/cqF3cH+YKQ4HSLA gsLB9WIp6zHSApAjBxr1pR7Ul4Z8lb3rawWJgch+WoLRy/zeJsWLeJoTIiAYL5WOHOty aYWqGBiJeIWLoTC8F5HBt1DV3TAYnAmnyuBPjeZp0IEa9D3AjJ5QbcAUmR2gsWAfNE+w NhAQizI2QEsp3Z80TZEjwnxKqZan2l2/ha5/aln9Ir+3VmQnevIa/1VnC5xn0a73DYpZ AfpEys+KIAnNYqV+oZEFTSI+ogo2GAcYUTN3Hl3N/rrVVwqcr2BsnVIXjETqFLkuEoyE YvH2VYpsVyJdVmukxRuU9ZPPIP+HA06t7mBAsweb2Cxsssi3ukX1Wu7C5WJ76uSmECT4 zlFclU5XNkwbfXBzjK42zxkyHnkvzlnE/ilWbMWN5JTrxPUSw63g1OyV4pjCkyV+nIPV mMIb1iucj8Uw7hQnRQqUetctNgPkdGFKPWHEvbfQlMKIyyXO0IGYh1aB0doX+g1eplXO KHnKVexdUGj6ExrHEqFpT2gGhwcV7FVBPebXc+Iv5TTu88F8jmQrOXKVuMzhHb7zwlp/ A9b4daWWiojp251b45ecXHRBizsl0UpX8SfBrY1R9YEiJrglI3ZFPqlodlVLqvH3O90B 2Z6NC5INJoNpUaSp/aRygolLlPLsGnNrLF8cK8KlijDi0h9TCeXgQNkbCZrZN3R96Cp6 h5sGz5GxChxcsUiEwa7g3DqNeGTnKGKpL4tsT/xVKK0Thwp7o0dsfkDLEn/stKxP9QqL c9b4ZVxDOLYL9YbslZvErmtysFa/DwJOoU+IY/EzwVpx//mRaOjiNPMbWY6wmWfCDEN9 gz/RWuS/zbkjMDVGi8vqY5SGv6SM3ROIsXhHjGrH9VIaSStXQN1QJsvedbWYEMySMgim uNBaWobcFKnvVwLiL8m8cEQWyR/GsnSEojESKEe+LvbjviScQ80TcA42GwOBWbBzg7CD IegeCcDCetMCUBeV/zc6+cvqcVNN9Plx2bbXItFrxRHGcvtxqvrFisVCAoOewuPb1hWY Pi+Dz4Ep0C83rCBX22EiEIkIm4v9CtI8EnFGsA6TjzEaKfCYghiJIVi4N8bafRgLUPR/ H3gVlyIiH6jFVDci7olbKkY3fX+EVwz6jZEr4e0KPcLBHynCoYuJ8KqLivDqQU+HRTgM n1eLCDeOHmGNT/yeGA8NqccIqWeUkK4ZFtK13x/SpkFH4dU6uNekh3T9jxTSmy8mpLdc VEg3DHo6LKQb4fMGEdLm0UP6f5G0LcMifOv3R3jToN9wshXebtIj3PYjRXjzxUR4y0VF eOugp8MivA0+bxUR3v7/F+EdQyJMhF89eOXDBy+aKZT3dDK3kKDyV157Ra9mTHdlu7JL UTH81vvWI7V/255E35DH0o6R+vthMkv+ctUXFStt7i+Z0/jNO7AxZ6lQCxycgXCfC0YU YMqzF3x4Fy0+v+V8TaZ4eRxeuPH2qQtlkoGiB6etoOvhKyM7TccvZEo6k1kB74WWUY6O eB2lXCKf92pvXUC9dvPqdeHQ1ZtCG8P6z3WOnijxSvE2Okox9TG6VY3RWtBNoMVqdRam ryM7iNMeXkuMz+FuzKfy2dwdZepnz/CrILwKTF4JHYfODuJsP+uMFpV4Yuyubnt+FVVn sU6ygzi7g3XAlsruNHEf64hytf0ZtgdmT7NdnjXs9Jn8MWNfex3Vzl35TtvOkp3lO6Wd uwpfPQXRlq2oNrSguqUZ1c0b850rN+65md+8cc+morbNeY6xa9ejWrMOVWNTnvPexqON JxulxqaOW4sKW/N31BS6toN4r7RImo+Z7celOvKBOHmkqmhGVlVvvF+qjGaZje40a5Wv OkOaSkyaLs1A1FX+Bf9PPNaq/P3oc1yN8T92PxfGWvnb3TNmVQmMKpOEFTTy8vTGH6IV VWZjyjSz4VLMxphCs5GVrTdORrPR4O18m3CvWuVt5ANxhPYmtG5CK4NfS07QzSAJXD24 euJ8FtI4n0p4JTAHOJPPEMHm000sBxZDPo3PiBaXyDFATn5VLzvP3o9Kanq1zL4gxj5j /yFG4XnPwE9N/HcTP2EfizCwj4AW4IdA9I//I3u/OwOuV4+DgNEW1PuEij3ADusG7zfx MLsP2aqyQ8AU4L1AMeE97D4sua8PLKMW1O1CwW6IHraoMbY4ekjA9dEjAi7v3iOpSLCq aE5BVXUam8BKdafsLFtHi+fKbxG+r31fc89HRUVVP3tIUh9+yKI+dCRdvR/2Dh1OVg/D 0k9APz3C1QePSOrRI+zRI8eO9B2RnpWukeaJxUnzoh1cFSlR023Prip5TsIhoDOili6T LkXU5OocqYKmgzwgH8giVUh5wglpponlUh56lveBxZlF9sggzs9Fjycjf96L9qWKKfi7 0TGT9RR4N4pciPEz0f3p0J/u7rNgqfzNbqVU5NebUQc2Df1PReFSdSZ/kQ+IePLneb+O vzHxoPD9Wb6FbxVL4VvNpfBbjaXwTWIpeu3hwYTRYDQ9Q7e+MjqmQG+siE64RG8s08dV 5/Hl+kBR2/h81Pl8Hk0EcUrjU6kQxOGeGs126OMu6c7MrkK2KSLbjvPxXBbbzV1cjlrU E7An4w4pRi0OV4mhZV+x3+sbeYY9havQxU6zp6ITXXKMnY4Wu6qqi9i/sj/qWfO2if9i 4h9MfIu9qRt4k72h93uDvYbs0vrAMvY6e00X/rMuXFedwU5hHb2iZqdM3au6DjOejOIS 6EV+/17kt9rHfkG/BPWApPgZ9ng014FtYHezg/qEB0yMAEVaL43uwzXBlkTbJUBDdF8S YFF0v4CF0U4Bvmin0C2Idgi4VmxUjFVG9wuYEe0TwvGGMMuTAeV/fWNRvxGd4v2e9C9F Yn7FznzFBJvW5Rhb5fkQKS+4accybVXw1NPj6wn2tPS09/T3nOw503OuJ63nWLjkk48t 6l2RFDVyIFk9CMKQp++ZPrPqnrsxJYbn3V2sVN19gKsHOlLVvbdb1NvFGuL93e3zrxP2 u9vn1Bh4aZWBk6fp81rbxylV7bu5ume3btVjvc07r+o2MLthSZiWO2G6EyvcD8G+jmT1 jjvT1TuBLR3tHbyvg1WnS4ulBsqSfNJC1Auk60UdlcIl1Uuka6XryCY5pbHSOLJKNsku ZQOtUqaUBZwEvIQyJRf0CrAYehk4idySC1QMcoJsICu5+RP8SX6MrPwx/lf8F8BH+KP8 KLAX+Axl8m7onwJq0EeBvRjTDcJDIX8C9BjoEdDtfC9l8d18D+pd/DZR6/5u5jv4TpwV O8/mObCbybO4Dcg45xJZ2QUWx19gK27ybHoIxEVf3PV2ehTUBzoNSsLNnUlzQHtAEpWw Czg3hRjrhE+5sOkAFsKPXJAdlAlKBjFyo6+bHWfPsT7M18WirBv4JDuGX+JWdgL4T5TJ XoB+ANgP/fPAExjzAqhfjAV1gZ4EbWAbGf6bkYXYKrYauIKtZEGdXxMdU1JSPZetoTmg PSCJbYd2J6y1YtRmYAtGbQJuh6VWUIuwCFoDCoFWgMrYVLKxiWwS6snsEspiU5iKuoAV QpLDclHnMQck+fjvoSyWxJJRcyahxhEWtedvkCoX4jbnFY6Cyx2Oyxw5lzpsFQ7rTEfa DEfydIdU7qBpjomTsiZPsk1Rs8pU23gla4JiKy7JkktsNnu2NS09w5qckmqVLElWRNpK kie3SCEptyRZGltSYptj22OTZImVSNdLfVJcsjjZuMyClKJMh31MZo4lL/M+JytzT3FP dk90T3CPd8vuYrfTXeB2uHPcNneaO9ktucntq2BaTj3VN8zVchlw8VytQq2PSfIibaZa r6X5lhtvBJBqvBM/khs0S2eMA3Jqli33x1iheELocPaKdWv1wY67A3gfnquxTk3Bb2aA B7/f5U68XjX4uzibi3dS7Qq8W4heAXWcFhbvSO3jAtpM0bhvXABPY7MWak5lrjqytApB a5sO3+m6Jk/0alO8Ia3MG6z9TqyqBAYOe7UL3lCMcWWYMtFxhLGEGNiKYrIxvssb4ztg hu8e3czguJi0wBuTrkVXySe6trWyQd0ojdY2CJlej9Tqk7dthiPDNBCgtCIMYqiIhw5D Kt3tVkNBQ9U0aCkhTeCQSYYs27QpRrWqrMbvDKh4CtYUJEligGlRAIuxXeL5OcZuM2C3 AXsMaDfgdgP2GnCHAXca0GHAPgP2G9BpwF0CzJXhXyVX6lLuNuAqA2YbMMcAjwHVBsw1 oMYA/Z08xr0GV2fA1QIQN6yttStNZL9v0dx6LRUPvam+5VqRAuYlMJeDsSpz6X8AnL95 xQplbmRzdHJlYW0KZW5kb2JqCjE0OSAwIG9iago0NzQ4CmVuZG9iagoxNTAgMCBvYmoK PDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgOTY3IC9DYXBIZWlnaHQgNzMy IC9EZXNjZW50IC0yMTEgL0ZsYWdzIDQKL0ZvbnRCQm94IFstMTA2NyAtNzM3IDE2NDEg MTE2Ml0gL0ZvbnROYW1lIC9QRUdFRlkrTHVjaWRhR3JhbmRlIC9JdGFsaWNBbmdsZQow IC9TdGVtViAxMDMgL01heFdpZHRoIDE2NDAgL1N0ZW1IIDc3IC9YSGVpZ2h0IDUzNiAv Rm9udEZpbGUyIDE0OCAwIFIgPj4KZW5kb2JqCjE1MSAwIG9iagpbIDAgXQplbmRvYmoK MTUyIDAgb2JqCjw8IC9MZW5ndGggMTUzIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+ PgpzdHJlYW0KeAFdkMFuwyAMhu88hY/doSLpGSFNnSrlsHZa1gcg4ERICyCHHPL2Myzt pCH5wP/7Mz+W5+6tCz6D/KBoe8ww+uAIl7iSRRhw8kG0J3De5v1WNTubJCTD/bZknLsw RlBKAMhPRpZMGxxeXRzwpWg3ckg+THC4n/uq9GtK3zhjyNAIrcHhyOPeTbqaGUFW9Ng5 9n3ejkz9dXxtCYETMdH+RrLR4ZKMRTJhQqGaRqvLRQsM7p+1A8O4d55arUo1fGr/wylo +eIzkl2JOE3dQw1aAviAz1WlmMqDtX4AbZpwEAplbmRzdHJlYW0KZW5kb2JqCjE1MyAw IG9iagoyMjMKZW5kb2JqCjI1IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9U cnVlVHlwZSAvQmFzZUZvbnQgL1BFR0VGWStMdWNpZGFHcmFuZGUgL0ZvbnREZXNjcmlw dG9yCjE1MCAwIFIgL1dpZHRocyAxNTEgMCBSIC9GaXJzdENoYXIgMzMgL0xhc3RDaGFy IDMzIC9Ub1VuaWNvZGUgMTUyIDAgUiA+PgplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUg KGRyYWZ0LWlldGYtdHN2d2ctcnN2cC1wcm94eS1wcm90by0wNykgL0F1dGhvciAoU3Rl cGhlbl9LZW50KSAvU3ViamVjdAooKSAvQUFQTDpLZXl3b3JkcyBbICgpIF0gL0tleXdv cmRzICgpIC9DcmVhdG9yIChNaWNyb3NvZnQgV29yZCkgL1Byb2R1Y2VyCihNYWMgT1Mg WCAxMC41LjYgUXVhcnR6IFBERkNvbnRleHQpIC9DcmVhdGlvbkRhdGUgKEQ6MjAwODEy MTcwMjIwMDZaMDAnMDAnKQovTW9kRGF0ZSAoRDoyMDA4MTIxNzAyMjAwNlowMCcwMCcp ID4+CmVuZG9iagp4cmVmCjAgMTU0CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDE5MTMz NCAwMDAwMCBuIAowMDAwMDAyNjY0IDAwMDAwIG4gCjAwMDAxMzI3MzYgMDAwMDAgbiAK MDAwMDAwMDAyMiAwMDAwMCBuIAowMDAwMDAyNjQ0IDAwMDAwIG4gCjAwMDAwMDI3Njgg MDAwMDAgbiAKMDAwMDAwMzc4MCAwMDAwMCBuIAowMDAwMTU4NTcwIDAwMDAwIG4gCjAw MDAwMDI4NjYgMDAwMDAgbiAKMDAwMDAwMzc2MCAwMDAwMCBuIAowMDAwMDA1ODQ1IDAw MDAwIG4gCjAwMDAwMDM4MTUgMDAwMDAgbiAKMDAwMDAwNTgyNCAwMDAwMCBuIAowMDAw MDA1OTUyIDAwMDAwIG4gCjAwMDAwMDc3MTMgMDAwMDAgbiAKMDAwMDAwNjA1MSAwMDAw MCBuIAowMDAwMDA3NjkyIDAwMDAwIG4gCjAwMDAwMDc4MjAgMDAwMDAgbiAKMDAwMDAx NDI5NyAwMDAwMCBuIAowMDAwMDA3OTE5IDAwMDAwIG4gCjAwMDAwMTQyNzYgMDAwMDAg biAKMDAwMDAxNDQwNCAwMDAwMCBuIAowMDAwMTcwNDMxIDAwMDAwIG4gCjAwMDAwMDAw MDAgMDAwMDAgbiAKMDAwMDE5MTE2NCAwMDAwMCBuIAowMDAwMTM5NDc5IDAwMDAwIG4g CjAwMDAwMTc4OTMgMDAwMDAgbiAKMDAwMDAxNDU0MiAwMDAwMCBuIAowMDAwMDE3ODcy IDAwMDAwIG4gCjAwMDAwMTgwMDAgMDAwMDAgbiAKMDAwMDAyMjk1MyAwMDAwMCBuIAow MDAwMDE4MTM4IDAwMDAwIG4gCjAwMDAwMjI5MzIgMDAwMDAgbiAKMDAwMDAyMzA2MCAw MDAwMCBuIAowMDAwMDI2NjEyIDAwMDAwIG4gCjAwMDAwMjMxOTggMDAwMDAgbiAKMDAw MDAyNjU5MSAwMDAwMCBuIAowMDAwMDI2NzE5IDAwMDAwIG4gCjAwMDAwMzE0MTYgMDAw MDAgbiAKMDAwMDAyNjg1NyAwMDAwMCBuIAowMDAwMDMxMzk1IDAwMDAwIG4gCjAwMDAw MzE1MjMgMDAwMDAgbiAKMDAwMDAzNjU1MiAwMDAwMCBuIAowMDAwMTMyODYwIDAwMDAw IG4gCjAwMDAwMzE2NjEgMDAwMDAgbiAKMDAwMDAzNjUzMSAwMDAwMCBuIAowMDAwMDM2 NjYwIDAwMDAwIG4gCjAwMDAwMzkwOTUgMDAwMDAgbiAKMDAwMDAzNjc5OCAwMDAwMCBu IAowMDAwMDM5MDc0IDAwMDAwIG4gCjAwMDAwMzkyMDMgMDAwMDAgbiAKMDAwMDA0NDUy MCAwMDAwMCBuIAowMDAwMDM5MzAyIDAwMDAwIG4gCjAwMDAwNDQ0OTkgMDAwMDAgbiAK MDAwMDA0NDYyOCAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAxODU1NTAg MDAwMDAgbiAKMDAwMDA1MTIwOSAwMDAwMCBuIAowMDAwMDQ0Nzc5IDAwMDAwIG4gCjAw MDAwNTExODggMDAwMDAgbiAKMDAwMDA1MTMxNyAwMDAwMCBuIAowMDAwMDU1NzQ5IDAw MDAwIG4gCjAwMDAwNTE0NTUgMDAwMDAgbiAKMDAwMDA1NTcyOCAwMDAwMCBuIAowMDAw MDU1ODU3IDAwMDAwIG4gCjAwMDAwNjA1MDUgMDAwMDAgbiAKMDAwMDA1NjAwOCAwMDAw MCBuIAowMDAwMDYwNDg0IDAwMDAwIG4gCjAwMDAwNjA2MTMgMDAwMDAgbiAKMDAwMDA3 MDIyMyAwMDAwMCBuIAowMDAwMDYwNzUxIDAwMDAwIG4gCjAwMDAwNzAyMDIgMDAwMDAg biAKMDAwMDA3MDMzMSAwMDAwMCBuIAowMDAwMDc5MjQxIDAwMDAwIG4gCjAwMDAwNzA0 NjkgMDAwMDAgbiAKMDAwMDA3OTIyMCAwMDAwMCBuIAowMDAwMDc5MzQ5IDAwMDAwIG4g CjAwMDAwODI2NzQgMDAwMDAgbiAKMDAwMDEzMjk4NiAwMDAwMCBuIAowMDAwMDc5NDg3 IDAwMDAwIG4gCjAwMDAwODI2NTMgMDAwMDAgbiAKMDAwMDA4Mjc4MiAwMDAwMCBuIAow MDAwMDg3NTMwIDAwMDAwIG4gCjAwMDAwODI5MjAgMDAwMDAgbiAKMDAwMDA4NzUwOSAw MDAwMCBuIAowMDAwMDg3NjM4IDAwMDAwIG4gCjAwMDAwOTcyNzQgMDAwMDAgbiAKMDAw MDA4Nzc3NiAwMDAwMCBuIAowMDAwMDk3MjUzIDAwMDAwIG4gCjAwMDAwOTczODIgMDAw MDAgbiAKMDAwMDEwOTM4MyAwMDAwMCBuIAowMDAwMDk3NTIwIDAwMDAwIG4gCjAwMDAx MDkzNjEgMDAwMDAgbiAKMDAwMDEwOTQ5MSAwMDAwMCBuIAowMDAwMTE3MjIxIDAwMDAw IG4gCjAwMDAxMDk2NDIgMDAwMDAgbiAKMDAwMDExNzIwMCAwMDAwMCBuIAowMDAwMTE3 MzI5IDAwMDAwIG4gCjAwMDAxMTg4MjEgMDAwMDAgbiAKMDAwMDExNzQ4MCAwMDAwMCBu IAowMDAwMTE4Nzk5IDAwMDAwIG4gCjAwMDAxMTg5MzEgMDAwMDAgbiAKMDAwMDEyMTE4 MyAwMDAwMCBuIAowMDAwMTE5MDMxIDAwMDAwIG4gCjAwMDAxMjExNjEgMDAwMDAgbiAK MDAwMDEyMTI5NCAwMDAwMCBuIAowMDAwMTIyNzMyIDAwMDAwIG4gCjAwMDAxMjEzOTQg MDAwMDAgbiAKMDAwMDEyMjcxMCAwMDAwMCBuIAowMDAwMTIyODQzIDAwMDAwIG4gCjAw MDAxMjU5NzkgMDAwMDAgbiAKMDAwMDEzMzExNCAwMDAwMCBuIAowMDAwMTIyOTQzIDAw MDAwIG4gCjAwMDAxMjU5NTcgMDAwMDAgbiAKMDAwMDEyNjA5MSAwMDAwMCBuIAowMDAw MTI4MTc2IDAwMDAwIG4gCjAwMDAxMjYxOTEgMDAwMDAgbiAKMDAwMDEyODE1NCAwMDAw MCBuIAowMDAwMTI4Mjg4IDAwMDAwIG4gCjAwMDAxMjk1NTggMDAwMDAgbiAKMDAwMDEy ODM4OCAwMDAwMCBuIAowMDAwMTI5NTM2IDAwMDAwIG4gCjAwMDAxMjk2NzAgMDAwMDAg biAKMDAwMDEzMjUyNCAwMDAwMCBuIAowMDAwMTI5NzcwIDAwMDAwIG4gCjAwMDAxMzI1 MDIgMDAwMDAgbiAKMDAwMDEzMjYzNiAwMDAwMCBuIAowMDAwMTMzMjE3IDAwMDAwIG4g CjAwMDAxMzMzMjUgMDAwMDAgbiAKMDAwMDEzMzM3OCAwMDAwMCBuIAowMDAwMTM4OTk1 IDAwMDAwIG4gCjAwMDAxMzkwMTcgMDAwMDAgbiAKMDAwMDEzOTI2NiAwMDAwMCBuIAow MDAwMTM5NjY0IDAwMDAwIG4gCjAwMDAxNTc5NDAgMDAwMDAgbiAKMDAwMDE1Nzk2MyAw MDAwMCBuIAowMDAwMTU4MTk3IDAwMDAwIG4gCjAwMDAxNTg3NDQgMDAwMDAgbiAKMDAw MDE2OTkzNiAwMDAwMCBuIAowMDAwMTY5OTU5IDAwMDAwIG4gCjAwMDAxNzAxOTYgMDAw MDAgbiAKMDAwMDE3MDYwNiAwMDAwMCBuIAowMDAwMTg0NDgwIDAwMDAwIG4gCjAwMDAx ODQ1MDMgMDAwMDAgbiAKMDAwMDE4NDcyOSAwMDAwMCBuIAowMDAwMTg0OTQyIDAwMDAw IG4gCjAwMDAxODU1MjkgMDAwMDAgbiAKMDAwMDE4NTcxNSAwMDAwMCBuIAowMDAwMTkw NTU1IDAwMDAwIG4gCjAwMDAxOTA1NzcgMDAwMDAgbiAKMDAwMDE5MDgxOSAwMDAwMCBu IAowMDAwMTkwODQyIDAwMDAwIG4gCjAwMDAxOTExNDMgMDAwMDAgbiAKdHJhaWxlcgo8 PCAvU2l6ZSAxNTQgL1Jvb3QgMTI5IDAgUiAvSW5mbyAxIDAgUiAvSUQgWyA8ZTNhZmNk MjRjNzc3ZjhmNzliNjgzMWRjNjMzMjUzOGU+CjxlM2FmY2QyNGM3NzdmOGY3OWI2ODMx ZGM2MzMyNTM4ZT4gXSA+PgpzdGFydHhyZWYKMTkxNjE4CiUlRU9GCg== --============_-982641504==_============ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --============_-982641504==_============-- From secdir-bounces@ietf.org Wed Dec 17 06:18:54 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 76E5E3A6AF3; Wed, 17 Dec 2008 06:18:54 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 336D33A6863; Wed, 17 Dec 2008 06:18:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.464 X-Spam-Level: X-Spam-Status: No, score=-10.464 tagged_above=-999 required=5 tests=[AWL=0.134, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4uAtgx-sF5Sx; Wed, 17 Dec 2008 06:18:46 -0800 (PST) Received: from smtp-dub.microsoft.com (smtp-dub.microsoft.com [213.199.138.181]) by core3.amsl.com (Postfix) with ESMTP id 183E43A6814; Wed, 17 Dec 2008 06:18:46 -0800 (PST) Received: from dub-exhub-c302.europe.corp.microsoft.com (65.53.213.92) by DUB-EXGWY-E802.partners.extranet.microsoft.com (10.251.129.2) with Microsoft SMTP Server (TLS) id 8.1.291.1; Wed, 17 Dec 2008 14:18:37 +0000 Received: from EA-EXMSG-C332.europe.corp.microsoft.com ([169.254.1.53]) by DUB-EXHUB-C302.europe.corp.microsoft.com ([65.53.213.92]) with mapi; Wed, 17 Dec 2008 14:18:38 +0000 From: Stefan Santesson To: "secdir@ietf.org" , "iesg@ietf.org" , "Pasi.Eronen@nokia.com" , "Turner, Sean P." , Kelvin Yiu , Russ Housley , "tim.polk@nist.gov" , Daniel Brown Date: Wed, 17 Dec 2008 14:18:40 +0000 Thread-Topic: Secdir review of draft-ietf-pkix-ecc-subpubkeyinfo-11.txt Thread-Index: AclgUlvMPlKjihP4R06qtI28gl8rEg== Message-ID: <9F11911AED01D24BAA1C2355723C3D321AB5D9E666@EA-EXMSG-C332.europe.corp.microsoft.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 Subject: [secdir] Secdir review of draft-ietf-pkix-ecc-subpubkeyinfo-11.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1302394070==" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --===============1302394070== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_9F11911AED01D24BAA1C2355723C3D321AB5D9E666EAEXMSGC332eu_" --_000_9F11911AED01D24BAA1C2355723C3D321AB5D9E666EAEXMSGC332eu_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I have reviewed the changes since rev 10 and I'm OK with these changes. I have not spotted any new security issues. Stefan Santesson Senior Program Manager Windows Security, Standards --_000_9F11911AED01D24BAA1C2355723C3D321AB5D9E666EAEXMSGC332eu_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I have reviewed the changes since r= ev 10 and I’m OK with these changes.

 

I have not spotted any new security= issues.

 

 

Stefan Santesson

Senior Program Manager=

Windows Security, Standards<= span lang=3DEN-US style=3D'color:#1F497D'>

 

--_000_9F11911AED01D24BAA1C2355723C3D321AB5D9E666EAEXMSGC332eu_-- --===============1302394070== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --===============1302394070==-- From secdir-bounces@ietf.org Wed Dec 17 12:03:06 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8DC243A6962; Wed, 17 Dec 2008 12:03:06 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 528D53A6962 for ; Wed, 17 Dec 2008 12:03:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.849 X-Spam-Level: X-Spam-Status: No, score=-5.849 tagged_above=-999 required=5 tests=[AWL=0.750, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NpAJElHolKrG for ; Wed, 17 Dec 2008 12:03:05 -0800 (PST) Received: from jackfruit.srv.cs.cmu.edu (JACKFRUIT.SRV.CS.CMU.EDU [128.2.201.16]) by core3.amsl.com (Postfix) with ESMTP id 84E2C3A68AA for ; Wed, 17 Dec 2008 12:03:05 -0800 (PST) Received: from MINBAR.FAC.CS.CMU.EDU (MINBAR.FAC.CS.CMU.EDU [128.2.216.42]) (authenticated bits=0) by jackfruit.srv.cs.cmu.edu (8.13.6/8.13.6) with ESMTP id mBHK2upW009602 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 17 Dec 2008 15:02:56 -0500 (EST) Date: Wed, 17 Dec 2008 15:02:56 -0500 From: Jeffrey Hutzelman To: secdir-secretary@mit.edu, secdir@ietf.org Message-ID: <80F61B57A815D13A0C1C9219@minbar.fac.cs.cmu.edu> In-Reply-To: <200812061908.mB6J8r2S023605@toasties.srv.cs.cmu.edu> References: <200812061908.mB6J8r2S023605@toasties.srv.cs.cmu.edu> X-Mailer: Mulberry/4.0.8 (Linux/x86) MIME-Version: 1.0 Content-Disposition: inline X-Scanned-By: mimedefang-cmuscs on 128.2.201.16 Subject: Re: [secdir] Assignments for Dec 9/13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --On Saturday, December 06, 2008 02:08:46 PM -0500 Samuel Weiler wrote: > Jeffrey Hutzelman draft-ietf-tcpm-tcp-uto-10 I looked at this, and didn't find any particular problems. This document describes a way for TCP peers to advise each other on their current user timeout values, which control how long transmitted data may remain unacknowledged before a connection is forcefully closed. Merely advertising this data does not in itself created any security considerations. However, acting on such advice may create a number of opportunities for denial-of-service attacks, which this document discusses extensively. -- Jeff _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 17 20:30:35 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DADB83A67DB; Wed, 17 Dec 2008 20:30:35 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C1E9A3A67DB; Wed, 17 Dec 2008 20:30:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.449 X-Spam-Level: X-Spam-Status: No, score=-2.449 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qtLbevR5HfIX; Wed, 17 Dec 2008 20:30:34 -0800 (PST) Received: from rn-out-0910.google.com (rn-out-0910.google.com [64.233.170.184]) by core3.amsl.com (Postfix) with ESMTP id D16703A65A5; Wed, 17 Dec 2008 20:30:33 -0800 (PST) Received: by rn-out-0910.google.com with SMTP id j77so185697rne.18 for ; Wed, 17 Dec 2008 20:30:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:mime-version:content-type:content-transfer-encoding :content-disposition; bh=ea+4+MKxSNfO7UdMSGPK1sBgqChDfXkhbLdE75UgrF8=; b=pMcwMQMG52AWWq5wkjdq3n9DtcrS8aTBuSDbseJu4SwASHspkU5mqXaz1pcb2Wwv1n fD1mj5YsqHl8ifuHBheZator1uulMx04BOmRoWr4sc4MnT/Flr6+W+Zi+RUsJOlkK9zL FmQH3IsOF4lmg1lLKgRNaU6srAxe1PNgtBHEc= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:mime-version:content-type :content-transfer-encoding:content-disposition; b=VDxnxFX67mWEHusDHGV18JHDS+jLgkWTiLKaK819Rsu4zdbGSVmni5OUHPsCDDV38V oXK3dC6uEid6S1aidHL0j2bW8QY/lHY1ZhXGAxGLPHZYGiOJROZTstxkaUyAt8Cu5XmP 69bP+m5ZSSIMSwtAf0XUyRTaDbgWBBeEfsgcw= Received: by 10.100.209.5 with SMTP id h5mr1172449ang.79.1229574624655; Wed, 17 Dec 2008 20:30:24 -0800 (PST) Received: by 10.100.41.1 with HTTP; Wed, 17 Dec 2008 20:30:24 -0800 (PST) Message-ID: <1028365c0812172030t33f51660yf0f527d18b8966f1@mail.gmail.com> Date: Wed, 17 Dec 2008 23:30:24 -0500 From: "Donald Eastlake" To: "The IESG" , "Spencer Dawkins" , "Eric Burger" MIME-Version: 1.0 Content-Disposition: inline Cc: tim.melanchuk@gmail.com, cboulton@avaya.com, cott.mcglashan@hp.com, secdir@ietf.org Subject: [secdir] draft-ietf-mediactrl-ivr-control-package-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is a length draft specifying an XML Media Control Channel Framework Package for Interactive Voice Response (IVR) dialog interaction. The Security Considerations Section is commensurately long but primarily lists threats. I really didn't thoroughly study the bulk of the draft but the threats described seemed reasonably comprehensive. For protection against these threats, the Security Considerations Section of the draft references the Security Consideration and other Sections of draft-ietf-mediactrl-sip-control-framework-08 (Media Control Channel Framework) as well as the Security Considerations of RFC 3023 (XML Media Types). These other document seem to provide adequate measures to protect against the threats mentioned in the document being reviewed. Presumably the secdir review of draft-ietf-mediactrl-sip-control-framework-08 will look more closely at its Security Considerations. Thanks, Donald ============================= Donald E. Eastlake 3rd +1-508-634-2066 (home) 155 Beaver Street Milford, MA 01757 USA d3e3e3@gmail.com _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 17 23:50:54 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4615B28C1F8; Wed, 17 Dec 2008 23:50:54 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E52E528C10C; Wed, 17 Dec 2008 20:53:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zIRAIlV9oYxY; Wed, 17 Dec 2008 20:53:45 -0800 (PST) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 85D0C28C11F; Wed, 17 Dec 2008 20:53:45 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.36,241,1228089600"; d="scan'208";a="215220703" Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-6.cisco.com with ESMTP; 18 Dec 2008 04:53:37 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id mBI4rce0018683; Wed, 17 Dec 2008 20:53:38 -0800 Received: from [10.21.93.52] (sjc-vpn5-1332.cisco.com [10.21.93.52]) by sj-core-1.cisco.com (8.13.8/8.13.8) with ESMTP id mBI4rbWC021534; Thu, 18 Dec 2008 04:53:38 GMT Message-ID: <4949D751.4000508@cisco.com> Date: Wed, 17 Dec 2008 20:53:37 -0800 From: Abhay Roy User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Stephen Farrell References: <492D7E49.40101@cs.tcd.ie> In-Reply-To: <492D7E49.40101@cs.tcd.ie> DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=7771; t=1229576018; x=1230440018; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=akr@cisco.com; z=From:=20Abhay=20Roy=20 |Subject:=20Re=3A=20secdir=20review=20of=20draft-ietf-ospf- lls |Sender:=20; bh=1kXn6V/fdMPRg7cUE1/KkmU/ssRDIttVPBvyDRPY0gY=; b=SFUTUB+sf9dBDcgvWalUglOs5nKVYS0BgzQZcc3CiBT2Lbnpob5lycDK5I /wtjY7G4qJRFNFYC5w5xhkzPS3bGx/+Q8sNiZMVIDySobwUp89h65XTzfqJv W59OXJA8yL; Authentication-Results: sj-dkim-3; header.From=akr@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); X-Mailman-Approved-At: Wed, 17 Dec 2008 23:50:52 -0800 Cc: secdir@ietf.org, ospf-chairs@ietf.org, draft-ietf-ospf-lls@tools.ietf.org, IESG Subject: Re: [secdir] secdir review of draft-ietf-ospf-lls X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi Stephen, Thanks for the very detailed review!. Please see inline: On 11/26/2008 8:50 AM, Stephen Farrell wrote: > Hi, > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > The draft [1] specifies a way to add new extension TLVs to/after OSPF > packets and includes a way to authenticate those. > > I have a few things here that I think need attention, but they > can probably mostly be easily handled with additional clarifying > text. My comments are attached. > > Stephen. > > [1] http://tools.ietf.org/html/draft-ietf-ospf-lls > > > > > #1: Section 2.2 describes the use of the checksum field, but never says what to > do if the checksum is wrong. Is just the LLS block igored or the entire OSPF > message? > #2: Section 2.2 doesn't say whether the checksum bits (presumably zero'd?) are > considered part of the LLS block when calculating the checksum. The behavior is the same as we do for standard OSPF packet, only difference being the scope is only the LLS block. I have added a clarifying text here (for the two points above): "The Checksum field contains the standard IP checksum for the entire contents of the LLS block. Before computing the checksum, the checksum field is set to 0. If the checksum is incorrect, LLS block MUST NOT be processed." > #3: I don't understand the reason for omitting the checksum if the > cryptographic authentication TLV is present. Since the spec doesn't say what to > put in the checksum field in that case, the absence of the checksum can't be > checked which'd lead the implementation to have to poke about looking for the > crypto. TLV before it knows what to do. That seems error prone. At the least, > more clarity as to the receiver actions is required. This is to keep things compatible with current OSPF standard. Please see the following quote from rfc2328 section D.4.3: (2) The checksum field in the standard OSPF header is not calculated, but is instead set to 0. I will add the explicit setting to 0 in the text: "Note that if the OSPF packet is cryptographically authenticated, the LLS data block MUST also be cryptographically authenticated. In this case, the regular LLS checksum is not calculated, but is instead set to 0." > #4: If the OSPF packet is not cryptographically authenticated, is it still ok > to include a cryptographic authentication TLV in the LLS? If so, what should I > do if the LLS crypto. fails to validate? Simplest might be to insist that > either both are protected or neither is, but I don't know if that matches the > requirements. It's not Ok as per this: "For the LLS block to be considered authentic, the Sequence Number in the CA-TLV MUST match the Sequence Number in the OSPFv2 packet header Authentication field. In the event of Sequence Number mismatch or Authentication failure, the whole LLS block MUST be ignored." > #5: Section 2.5 has no references and doesn't describe which algorithm is to be > used, now how keying is achieved. Questions arising include: a) rfc 2328 > defines three types of authentication in appendix D, including Null > authentication - that one says to ignore the authentication field and use the > checksum, which seems to conflict with what this draft says (if crypto TLV > present, ignore checksum); In case of Null authentication, checksum is the only protection in both main OSPF payload and LLS block. In case of Crypto Authentication, checksums are set to 0, and digest is the one used to verify both parts. So I think they are consistent. b) similarly, the "simple password" method from 2328 > also seems to require checking the checksum. (It might be as easy to just say > those two MUST NOT be used); If "simple password" is used it's just a way to deter a random miscofigured router from becoming part of OSPF routing domain. It's not exactly providing any protection, hence checksums are still necessary to protect both ospf payloads. c) I assume that the key lifecycle requirements > are the same as in 2328, appendix D.3 (if LLS is allowed to be authenticated > when the OSPFv2 packet is not, then this could be an issue). Right. > #6: Is it ok to use the same key & alg on the different inputs if the MD5 alg > from 2328 is re-used here with the same key and but different inputs? In that > case the OSPFv2 packet will contain MD5(OSPFv2-packet||key||pad||len) and the > LLS will contain MD5(LLS-data-block||key) where both the OSPFv2-packet and the > LLS-data-block contain the same sequence number. I don't have a specific > problem that I can call out with that but do wonder if its ok. Ought it be > looked at by some cryptgrapher? (If a HMAC option is available then using that > would probably be better, or if a diiferent key, e.g. one derived from the key > protecting the OSPFv2-packet, were used for the LLS that might also be better. > But those would change the bits on the wire so might not be an option anymore?) OSPFv2 packet MD5 is done with MD5(OSPFv2-packet) - note that it doesn't include the Authentication header. LLS block MD5 is done with MD5(LLS-data) - note that it doesn't include the CA-TLV. I know of implementation deployed with this algorithm for many years. > #7: Presumably it is not ok to include a cryptographic authentiation TLV in an > OSPFv3 packet? Might be worth a MUST NOT statement. Sure. Will add something to this effect. > #8: If the crypto TLV is not the last TLV, then are the subsequent TLVs > included in the "LLS data block" input to the crypto processing? I think the > definition of the "LLS data block" as input to crypto processing needs to be > clearer - maybe take D.4.3 from 2328 as an example if the same MD5 alg is to be > used. > #9: If there are specific reasons why the crypto TLV might not be the last one, > that'd be worth noting. > #10: The cryptographic TLV doesn't (I think) protect the overall length of the > LLS (if I'm right in #8 above that TLVs following the crypto TLV are not > protected). In that case a single LLS mixes authenticated and unauthenticated > TLVs, which could allow an attacker to replace those that follow the crypto > TLV, or mess with the overall length or do other bad things. I think some > statement is required as to what a receiver MUST do in such cases, but I don't > know enough to suggest any text. (Since the LLS can contain any extension, how > do we know its ok to mix authenticated and unauthenticated TLVs like that?) CA-TLV needs to be the last TLV (see Liem's email to Spencer). Conceptually it has similar semantics as to how a digest gets computed and attached at the end of a OSPF packet. > Nits/Typos: > > section 2.1 - "The L bit is only set in Hello and DD packets." Would that be > better as: "The L bit MUST NOT be set except in Hello and DD packets that > conain LLS." Might be more likely to be picked up by implementers? Sure, will go with your suggestion. > section 2.3 - "...unique for each type of TLVs" s/TLVs/TLV/ changed > section 2.3 - Seems odd to have a mixture of length fields that're sometimes in > 32-bit words and sometimes in bytes but I assume its too late to change that > now. > > section 4 - "...since OSPF router not..." s/router/routers/ changed > section 5 - "...as OSPFv2 protocol..." s/OSPFv2/the OSPFv2/ changed Regards, -Abhay _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 18 00:38:34 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3A6003A6902; Thu, 18 Dec 2008 00:38:34 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 620CA28C1FA; Thu, 18 Dec 2008 00:01:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.169 X-Spam-Level: X-Spam-Status: No, score=-7.169 tagged_above=-999 required=5 tests=[AWL=-0.571, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lTPb6jYnWbpD; Thu, 18 Dec 2008 00:01:17 -0800 (PST) Received: from rtp-iport-1.cisco.com (rtp-iport-1.cisco.com [64.102.122.148]) by core3.amsl.com (Postfix) with ESMTP id E99FF28C208; Thu, 18 Dec 2008 00:01:16 -0800 (PST) X-IronPort-AV: E=Sophos;i="4.36,242,1228089600"; d="scan'208,217";a="31446611" Received: from rtp-dkim-1.cisco.com ([64.102.121.158]) by rtp-iport-1.cisco.com with ESMTP; 18 Dec 2008 08:01:08 +0000 Received: from rtp-core-2.cisco.com (rtp-core-2.cisco.com [64.102.124.13]) by rtp-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id mBI818xc003848; Thu, 18 Dec 2008 03:01:08 -0500 Received: from xbh-rtp-201.amer.cisco.com (xbh-rtp-201.cisco.com [64.102.31.12]) by rtp-core-2.cisco.com (8.13.8/8.13.8) with ESMTP id mBI818Hx001045; Thu, 18 Dec 2008 08:01:08 GMT Received: from xmb-rtp-211.amer.cisco.com ([64.102.31.118]) by xbh-rtp-201.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 18 Dec 2008 03:01:08 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Thu, 18 Dec 2008 03:01:02 -0500 Message-ID: In-Reply-To: <1028365c0811210102l6d391147t7b89e558f770d005@mail.gmail.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: draft-ietf-mpls-ldp-igp-sync-03.txt Thread-Index: AclLt9m8EoN7Cy6gQcyu4FPp+UPbcQVLoS9Q References: <1028365c0811210102l6d391147t7b89e558f770d005@mail.gmail.com> From: "Luyuan Fang (lufang)" To: "Donald Eastlake" , , , "George Swallow (swallow)" , "Loa Andersson" , , X-OriginalArrivalTime: 18 Dec 2008 08:01:08.0720 (UTC) FILETIME=[C8F7D700:01C960E6] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=8100; t=1229587268; x=1230451268; c=relaxed/simple; s=rtpdkim1001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=lufang@cisco.com; z=From:=20=22Luyuan=20Fang=20(lufang)=22=20 |Subject:=20RE=3A=20draft-ietf-mpls-ldp-igp-sync-03.txt |Sender:=20 |To:=20=22Donald=20Eastlake=22=20,=20,=20,=0A=20=20=20=20=20=20=20=20 =22George=20Swallow=20(swallow)=22=20,=0A =20=20=20=20=20=20=20=20=22Loa=20Andersson=22=20, =20,=0A=20=20=20=20=20=20=20=20 ; bh=rwwsDfGK3etNxMAF+CtXvuggKzrsRBTAZRT4b4HjFHU=; b=h5qxCFF02LwoC65AK4jHeiKHOcMkPwIwBUQ98/6HWK8Dp7aobRX5AYeRZm RrsR9hwhhZOBVtYhrfSBhFJPHB+hJoMM3O96CTLTVZseap2yQg6IkkC4w+oK IrXkwKY/ED; Authentication-Results: rtp-dkim-1; header.From=lufang@cisco.com; dkim=pass ( sig from cisco.com/rtpdkim1001 verified; ); X-Mailman-Approved-At: Thu, 18 Dec 2008 00:38:33 -0800 Subject: Re: [secdir] draft-ietf-mpls-ldp-igp-sync-03.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1160361305==" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org This is a multi-part message in MIME format. --===============1160361305== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C960E6.C4F975D6" This is a multi-part message in MIME format. ------_=_NextPart_001_01C960E6.C4F975D6 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Donald, Thank you for your review and comments.=20 We have addressed all your comments (including clarify PE and adding BCP reference), as well as other IESG review comments in 04 draft which is just posted.=20 Thank you for your time and help, Luyuan=20 ________________________________ From: Donald Eastlake [mailto:d3e3e3@gmail.com]=20 Sent: 21 November 2008 04:02 To: iesg@ietf.org; secdir@ietf.org; George Swallow (swallow); Loa Andersson; mjork@nextpointnetworks.com; alia.atlas@bt.com; Luyuan Fang (lufang) Subject: draft-ietf-mpls-ldp-igp-sync-03.txt I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. Document editors and WG chairs should treat these comments just like any other last call comments. This document suggests ways to help where MPLS and MPLS label distribution (LDP) are intended to run over the links in a network as determined by an IP routing protocol but, for one reason or another, either transiently or permanently, IP routing is up on a link but MPLS is not functioning. This results in the possibility of MPLS frames following a path found by routing but getting black holed at the link where MPLS is not operational. The draft also suggests applicability of its suggestions to some types of tunnels. Security Considerations While, admittedly, this relatively short document is about some fairly simple things relating to MPLS LDP and IP routing, I felt a bit shortchanged by the Security Considerations section. It is my impression that this document, or at least the underlying protocols it refers to, assume a trusted "provider" world with a secure perimeter such that "customer" traffic from the uncontrolled outside world has been tamed / filtered / labeled as it enters this trusted world. The presence of such clues as "edge-to-edge" and "PE" which, while unexplained and unexpanded in this document, I assume to be "Provider Edge", lead to this conclusion. But it would be nice to say this and/or to give a reference to the Security Considerations section of RFC 5306, which tends to recommend being secure by only talking to nodes that won't say anything nasty to you. The possibilities of Denial of Service caused by the drafts recommendations are discussed and do not seem particularly serious except, as the draft says, in case of "operational error or implementation error" however, I think the reference to "current best security practice" without any reference or further explanation is a bit vague. Editorial=20 Section 5, page 5, first line: Insert "that" after "attack". Section 5, page 5, fifth line: Replace "here is to prevent the link to be used when" with "here prevents the use of the link when" I am bothered that no author lists a telephone number in the Author's Addresses section. Thanks,=20 Donald =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D Donald E. Eastlake 3rd +1-508-634-2066 (home) 155 Beaver Street Milford, MA 01757 USA d3e3e3@gmail.com ------_=_NextPart_001_01C960E6.C4F975D6 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Donald,

Thank you for your review = and comments.=20

We have addressed all your comments (including clarify PE and adding BCP = reference),=20 as well as other = IESG review=20 comments in 04 draft which is just posted.

Thank you for your time = and=20 help,

Luyuan =


From: Donald Eastlake = [mailto:d3e3e3@gmail.com]=20
Sent: 21 November 2008 04:02
To: iesg@ietf.org;=20 secdir@ietf.org; George Swallow (swallow); Loa Andersson;=20 mjork@nextpointnetworks.com; alia.atlas@bt.com; Luyuan Fang=20 (lufang)
Subject:=20 draft-ietf-mpls-ldp-igp-sync-03.txt

I have reviewed this document as part of the security=20 directorate's ongoing effort to review all IETF documents being = processed=20 by the IESG.  Document editors and WG chairs should treat = these=20 comments just like any other last call comments.

This document suggests ways to help where MPLS and MPLS label = distribution=20 (LDP) are intended to run over the links in a network as determined by = an IP=20 routing protocol but, for one reason or another, either transiently or=20 permanently, IP routing is up on a link but MPLS is not functioning. = This=20 results in the possibility of MPLS frames following a path found by = routing but=20 getting black holed at the link where MPLS is not operational. The draft = also=20 suggests applicability of its suggestions to some types of = tunnels.

Security Considerations
   While, admittedly, this relatively short document is = about=20 some fairly simple things relating to MPLS LDP and IP routing, I felt a = bit=20 shortchanged by the Security Considerations section.
   It is my impression that this document, or at least = the=20 underlying protocols it refers to, assume a trusted "provider" world = with a=20 secure perimeter such that "customer" traffic from the uncontrolled = outside=20 world has been tamed / filtered / labeled as it enters this trusted = world. The=20 presence of such clues as "edge-to-edge" and "PE" which, while = unexplained and=20 unexpanded in this document, I assume to be "Provider Edge", lead to = this=20 conclusion. But it would be nice to say this and/or to give a reference = to the=20 Security Considerations section of RFC 5306, which tends to recommend = being=20 secure by only talking to nodes that won't say anything nasty to = you.
   The possibilities of Denial of Service caused by the = drafts=20 recommendations are discussed and do not seem particularly serious = except, as=20 the draft says, in case of "operational error or implementation error" = however,=20 I think the reference to "current best security practice" without any = reference=20 or further explanation is a bit vague.

Editorial
   Section 5, page 5, first line: Insert "that" after=20 "attack".
   Section 5, page 5, fifth line: Replace "here is to = prevent the=20 link to be used when" with "here prevents the use of the link when"
I am bothered that no author lists a telephone number in the = Author's=20 Addresses section.

Thanks,
Donald
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D
Donald E. Eastlake 3rd  =20 +1-508-634-2066 (home)
155 Beaver Street
Milford, MA 01757 = USA
d3e3e3@gmail.com
------_=_NextPart_001_01C960E6.C4F975D6-- --===============1160361305== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --===============1160361305==-- From secdir-bounces@ietf.org Thu Dec 18 04:10:06 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5FA523A6933; Thu, 18 Dec 2008 04:10:06 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E7CD53A68A5; Thu, 18 Dec 2008 04:10:04 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.663 X-Spam-Level: X-Spam-Status: No, score=-4.663 tagged_above=-999 required=5 tests=[AWL=1.936, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YAfItFBa7E5j; Thu, 18 Dec 2008 04:10:01 -0800 (PST) Received: from IE1EHSOBE001.bigfish.com (outbound-dub.frontbridge.com [213.199.154.16]) by core3.amsl.com (Postfix) with ESMTP id 36AC33A6767; Thu, 18 Dec 2008 04:10:00 -0800 (PST) Received: from mail166-dub-R.bigfish.com (10.5.252.3) by IE1EHSOBE001.bigfish.com (10.5.252.21) with Microsoft SMTP Server id 8.1.291.1; Thu, 18 Dec 2008 12:09:51 +0000 Received: from mail166-dub (localhost.localdomain [127.0.0.1]) by mail166-dub-R.bigfish.com (Postfix) with ESMTP id 49D41106815A; Thu, 18 Dec 2008 12:09:51 +0000 (UTC) X-BigFish: VPS-67(zz1432R98dR936eQ1447R1805M1442J3117K617R9371Pzzzz1033ILz2dh6bh87il61h) X-Spam-TCS-SCL: 0:0 X-FB-DOMAIN-IP-MATCH: fail Received: by mail166-dub (MessageSwitch) id 1229602188299316_20637; Thu, 18 Dec 2008 12:09:48 +0000 (UCT) Received: from imx1.tcd.ie (wpad.iss.tcd.ie [134.226.17.160]) by mail166-dub.bigfish.com (Postfix) with ESMTP id 12CF6C7005D; Thu, 18 Dec 2008 12:09:48 +0000 (UTC) Received: from Vams.imx1 (imx1.tcd.ie [134.226.17.160]) by imx1.tcd.ie (Postfix) with SMTP id 0C2B2495A; Thu, 18 Dec 2008 12:09:48 +0000 (GMT) Received: from imx1.tcd.ie ([134.226.17.160]) by imx1 ([127.0.0.1]) with SMTP (gateway) id A01EFD005CA; Thu, 18 Dec 2008 12:09:48 +0000 Received: from [134.226.36.140] (unknown [134.226.36.140]) by imx1.tcd.ie (Postfix) with ESMTP id D8EA2495A; Thu, 18 Dec 2008 12:09:47 +0000 (GMT) Message-ID: <494A3DB5.30906@cs.tcd.ie> Date: Thu, 18 Dec 2008 12:10:29 +0000 From: Stephen Farrell User-Agent: Thunderbird 2.0.0.16 (X11/20080707) MIME-Version: 1.0 To: Abhay Roy References: <492D7E49.40101@cs.tcd.ie> <4949D751.4000508@cisco.com> In-Reply-To: <4949D751.4000508@cisco.com> X-Enigmail-Version: 0.95.7 X-AntiVirus-Status: MessageID = A11EFD005CA X-AntiVirus-Status: Host: imx1.tcd.ie X-AntiVirus-Status: Action Taken: X-AntiVirus-Status: NONE X-AntiVirus-Status: Checked by TCD Vexira. (version=1.60.2 VDF=10.98.1) Cc: secdir@ietf.org, ospf-chairs@ietf.org, draft-ietf-ospf-lls@tools.ietf.org, IESG Subject: Re: [secdir] secdir review of draft-ietf-ospf-lls X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hiya, Abhay Roy wrote: > Hi Stephen, > > Thanks for the very detailed review!. Please see inline: > > On 11/26/2008 8:50 AM, Stephen Farrell wrote: >> Hi, >> >> I have reviewed this document as part of the security directorate's >> ongoing effort to review all IETF documents being processed by the >> IESG. These comments were written primarily for the benefit of the >> security area directors. Document editors and WG chairs should treat >> these comments just like any other last call comments. >> >> The draft [1] specifies a way to add new extension TLVs to/after OSPF >> packets and includes a way to authenticate those. >> >> I have a few things here that I think need attention, but they >> can probably mostly be easily handled with additional clarifying >> text. My comments are attached. >> >> Stephen. >> >> [1] http://tools.ietf.org/html/draft-ietf-ospf-lls >> >> >> >> >> #1: Section 2.2 describes the use of the checksum field, but never >> says what to >> do if the checksum is wrong. Is just the LLS block igored or the >> entire OSPF >> message? >> #2: Section 2.2 doesn't say whether the checksum bits (presumably >> zero'd?) are >> considered part of the LLS block when calculating the checksum. > > The behavior is the same as we do for standard OSPF packet, only > difference being the scope is only the LLS block. I have added a > clarifying text here (for the two points above): > > "The Checksum field contains the standard IP checksum for > the entire contents of the LLS block. Before computing the > checksum, the checksum field is set to 0. If the checksum > is incorrect, LLS block MUST NOT be processed." Sorry to be dense, but does that mean that the entire message is ignored or only the LLS block? I don't really care, but think it ought be crystal clear. >> #3: I don't understand the reason for omitting the checksum if the >> cryptographic authentication TLV is present. Since the spec doesn't >> say what to >> put in the checksum field in that case, the absence of the checksum >> can't be >> checked which'd lead the implementation to have to poke about looking >> for the >> crypto. TLV before it knows what to do. That seems error prone. At the >> least, >> more clarity as to the receiver actions is required. > > This is to keep things compatible with current OSPF standard. Please see > the following quote from rfc2328 section D.4.3: > > (2) The checksum field in the standard OSPF header is not > calculated, but is instead set to 0. > > I will add the explicit setting to 0 in the text: > > "Note that if the OSPF packet is cryptographically > authenticated, the LLS data block MUST also be > cryptographically authenticated. In this case, the regular > LLS checksum is not calculated, but is instead set to 0." Fine. > >> #4: If the OSPF packet is not cryptographically authenticated, is it >> still ok >> to include a cryptographic authentication TLV in the LLS? If so, what >> should I >> do if the LLS crypto. fails to validate? Simplest might be to insist that >> either both are protected or neither is, but I don't know if that >> matches the >> requirements. > > It's not Ok as per this: > "For the LLS block to > be considered authentic, the Sequence Number in the CA-TLV MUST match > the Sequence Number in the OSPFv2 packet header Authentication field. > In the event of Sequence Number mismatch or Authentication failure, > the whole LLS block MUST be ignored." Again I'm a bit dense, so I'd find it clearer if that said: "...MUST match the Sequence Number in the OSPFv2 packet header Authentication field (which MUST be present)." >> #5: Section 2.5 has no references and doesn't describe which algorithm >> is to be >> used, now how keying is achieved. Questions arising include: a) rfc 2328 >> defines three types of authentication in appendix D, including Null >> authentication - that one says to ignore the authentication field and >> use the >> checksum, which seems to conflict with what this draft says (if crypto >> TLV >> present, ignore checksum); > > In case of Null authentication, checksum is the only protection in both > main OSPF payload and LLS block. In case of Crypto Authentication, > checksums are set to 0, and digest is the one used to verify both parts. > So I think they are consistent. Are you saying that Null authentication is allowed, and that in that case there is no checksum, but that that's ok? If so, that is not at all clear and seems quite odd - why add the Crypto Authentication TLV to the LLS block at all then? > b) similarly, the "simple password" method from 2328 >> also seems to require checking the checksum. (It might be as easy to >> just say >> those two MUST NOT be used); > > If "simple password" is used it's just a way to deter a random > miscofigured router from becoming part of OSPF routing domain. It's not > exactly providing any protection, hence checksums are still necessary to > protect both ospf payloads. But again, if simple password is allowed and the checksum is zero'd (because the Crypto Authentication TLV is in the LLS block) then something is broken. Also - why would you want to put the same "simple password" in clear twice in the same message - once in the OCSPv2 packet and once in the LLS? I think saying that the LLS Crypto Authentication TLV MUST use the MD5 based scheme makes most sense. > c) I assume that the key lifecycle requirements >> are the same as in 2328, appendix D.3 (if LLS is allowed to be >> authenticated >> when the OSPFv2 packet is not, then this could be an issue). > > Right. > >> #6: Is it ok to use the same key & alg on the different inputs if the >> MD5 alg >> from 2328 is re-used here with the same key and but different inputs? >> In that >> case the OSPFv2 packet will contain MD5(OSPFv2-packet||key||pad||len) >> and the >> LLS will contain MD5(LLS-data-block||key) where both the OSPFv2-packet >> and the >> LLS-data-block contain the same sequence number. I don't have a specific >> problem that I can call out with that but do wonder if its ok. Ought >> it be >> looked at by some cryptgrapher? (If a HMAC option is available then >> using that >> would probably be better, or if a diiferent key, e.g. one derived from >> the key >> protecting the OSPFv2-packet, were used for the LLS that might also be >> better. >> But those would change the bits on the wire so might not be an option >> anymore?) > > OSPFv2 packet MD5 is done with MD5(OSPFv2-packet) - note that it > doesn't include the Authentication header. > LLS block MD5 is done with MD5(LLS-data) - note that it doesn't include > the CA-TLV. > > I know of implementation deployed with this algorithm for many years. Sure. I didn't imagine that this'd change, but its not the construct that a crypto person'd choose (two related values being protected with the same key based on a fairly broken hash function), so all I wanted to say was that I think it might be good to get a cryptographer to look it over if you (or someone) can. Separately, it might also be good to develop a new authentication scheme not based on MD5 and (maybe) where a KDF is used to derive a new key for the LLS block from the one used to protect the OCSP packet. But of course, that'd be a bunch of work and I've no idea if it'd be worthwhile or not. > >> #7: Presumably it is not ok to include a cryptographic authentiation >> TLV in an >> OSPFv3 packet? Might be worth a MUST NOT statement. > > Sure. Will add something to this effect. > >> #8: If the crypto TLV is not the last TLV, then are the subsequent TLVs >> included in the "LLS data block" input to the crypto processing? I >> think the >> definition of the "LLS data block" as input to crypto processing needs >> to be >> clearer - maybe take D.4.3 from 2328 as an example if the same MD5 alg >> is to be >> used. >> #9: If there are specific reasons why the crypto TLV might not be the >> last one, >> that'd be worth noting. >> #10: The cryptographic TLV doesn't (I think) protect the overall >> length of the >> LLS (if I'm right in #8 above that TLVs following the crypto TLV are not >> protected). In that case a single LLS mixes authenticated and >> unauthenticated >> TLVs, which could allow an attacker to replace those that follow the >> crypto >> TLV, or mess with the overall length or do other bad things. I think some >> statement is required as to what a receiver MUST do in such cases, but >> I don't >> know enough to suggest any text. (Since the LLS can contain any >> extension, how >> do we know its ok to mix authenticated and unauthenticated TLVs like >> that?) > > CA-TLV needs to be the last TLV (see Liem's email to Spencer). I don't recall that email. If the draft said it MUST be the last TLV then that'd be fine, but the version I read said SHOULD. If the SHOULD remains then I believe the draft really has to say what to do if there are subsequent unauthenticated TLVs. Cheers, Stephen. > Conceptually it has similar semantics as to how a digest gets computed > and attached at the end of a OSPF packet. > >> Nits/Typos: >> >> section 2.1 - "The L bit is only set in Hello and DD packets." Would >> that be >> better as: "The L bit MUST NOT be set except in Hello and DD packets that >> conain LLS." Might be more likely to be picked up by implementers? > > Sure, will go with your suggestion. > >> section 2.3 - "...unique for each type of TLVs" s/TLVs/TLV/ > > changed > >> section 2.3 - Seems odd to have a mixture of length fields that're >> sometimes in >> 32-bit words and sometimes in bytes but I assume its too late to >> change that >> now. >> >> section 4 - "...since OSPF router not..." s/router/routers/ > > changed > >> section 5 - "...as OSPFv2 protocol..." s/OSPFv2/the OSPFv2/ > > changed > > Regards, > -Abhay > > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 18 08:43:47 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 141A13A6B53; Thu, 18 Dec 2008 08:43:47 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C5D683A6AF0; Thu, 18 Dec 2008 08:43:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.561 X-Spam-Level: X-Spam-Status: No, score=-2.561 tagged_above=-999 required=5 tests=[AWL=0.037, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aTFMHTFB6BZS; Thu, 18 Dec 2008 08:43:44 -0800 (PST) Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.247]) by core3.amsl.com (Postfix) with ESMTP id 34E3A3A69FD; Thu, 18 Dec 2008 08:43:44 -0800 (PST) Received: by an-out-0708.google.com with SMTP id c5so169280anc.4 for ; Thu, 18 Dec 2008 08:43:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type:references; bh=ZuVzl/lhL5vuq22wKIQrd2nWsEzE/2Wrjfa98SCf5gs=; b=KeGETS3EXqRX2HJ1QDb/VKLYzSKjdoH5Hv/FI7ZEgSoY+NNiADpAajkqwme5yvwcnJ FilW+vMACBkM13R//lmv4PSv79P6VZYujwc13Nz6RxAYp06DJ5kTW2x6i4ekBSY3KA4f aDrHnUw0jz1pNbQwMSu21Xdq3uZGbsU95dpgQ= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:references; b=hzD6Cxiii8w2mAkNUNmvh1AHOQy0bYjr40P5p8lZYh6oWk3no4DoQOkTrTvKTUTgtj uPevrp6AbNfp2vWukaWM9K7NCIA3HSegKQ8bhLKcmiWfrj1ct+frGcp2uYssDKC5sv4P sO5xRNDuTMSWQLlXzwRgk1doEUv1Q78Ta2EVA= Received: by 10.100.139.20 with SMTP id m20mr1536064and.147.1229618616258; Thu, 18 Dec 2008 08:43:36 -0800 (PST) Received: by 10.100.41.1 with HTTP; Thu, 18 Dec 2008 08:43:36 -0800 (PST) Message-ID: <1028365c0812180843u4c78b24eu8f8ec8569ca74504@mail.gmail.com> Date: Thu, 18 Dec 2008 11:43:36 -0500 From: "Donald Eastlake" To: iesg@ietf.org, "Luyuan Fang (lufang)" In-Reply-To: MIME-Version: 1.0 References: <1028365c0811210102l6d391147t7b89e558f770d005@mail.gmail.com> Cc: "George Swallow \(swallow\)" , alia.atlas@bt.com, Loa Andersson , mjork@nextpointnetworks.com, secdir@ietf.org Subject: Re: [secdir] draft-ietf-mpls-ldp-igp-sync-03.txt X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============1342052050==" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org --===============1342052050== Content-Type: multipart/alternative; boundary="----=_Part_16456_7962456.1229618616237" ------=_Part_16456_7962456.1229618616237 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Thanks. All of my security related comments have been addressed in -04. Donald On Thu, Dec 18, 2008 at 3:01 AM, Luyuan Fang (lufang) wrote: > Donald, > > Thank you for your review and comments. > > We have addressed all your comments (including clarify PE and adding BCP > reference), as well as other IESG review comments in 04 draft which is > just posted. > > Thank you for your time and help, > > Luyuan > > ------------------------------ > *From:* Donald Eastlake [mailto:d3e3e3@gmail.com] > *Sent:* 21 November 2008 04:02 > *To:* iesg@ietf.org; secdir@ietf.org; George Swallow (swallow); Loa > Andersson; mjork@nextpointnetworks.com; alia.atlas@bt.com; Luyuan Fang > (lufang) > *Subject:* draft-ietf-mpls-ldp-igp-sync-03.txt > > I have reviewed this document as part of the security > directorate's ongoing effort to review all IETF documents being processed by > the IESG. Document editors and WG chairs should treat these comments just > like any other last call comments. > > This document suggests ways to help where MPLS and MPLS label distribution > (LDP) are intended to run over the links in a network as determined by an IP > routing protocol but, for one reason or another, either transiently or > permanently, IP routing is up on a link but MPLS is not functioning. This > results in the possibility of MPLS frames following a path found by routing > but getting black holed at the link where MPLS is not operational. The draft > also suggests applicability of its suggestions to some types of tunnels. > > Security Considerations > While, admittedly, this relatively short document is about some fairly > simple things relating to MPLS LDP and IP routing, I felt a bit shortchanged > by the Security Considerations section. > It is my impression that this document, or at least the underlying > protocols it refers to, assume a trusted "provider" world with a secure > perimeter such that "customer" traffic from the uncontrolled outside world > has been tamed / filtered / labeled as it enters this trusted world. The > presence of such clues as "edge-to-edge" and "PE" which, while unexplained > and unexpanded in this document, I assume to be "Provider Edge", lead to > this conclusion. But it would be nice to say this and/or to give a reference > to the Security Considerations section of RFC 5306, which tends to recommend > being secure by only talking to nodes that won't say anything nasty to you. > The possibilities of Denial of Service caused by the drafts > recommendations are discussed and do not seem particularly serious except, > as the draft says, in case of "operational error or implementation error" > however, I think the reference to "current best security practice" without > any reference or further explanation is a bit vague. > > Editorial Section 5, page 5, first line: Insert "that" after "attack". > Section 5, page 5, fifth line: Replace "here is to prevent the link to > be used when" with "here prevents the use of the link when" > > I am bothered that no author lists a telephone number in the Author's > Addresses section. > > Thanks, Donald > ============================= > Donald E. Eastlake 3rd +1-508-634-2066 (home) > 155 Beaver Street > Milford, MA 01757 USA > d3e3e3@gmail.com > -- ============================= Donald E. Eastlake 3rd +1-508-634-2066 (home) 155 Beaver Street Milford, MA 01757 USA d3e3e3@gmail.com ------=_Part_16456_7962456.1229618616237 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Thanks. All of my security related comments have been addressed in -04.

Donald

On Thu, Dec 18, 2008 at 3:01 AM, Luyuan Fang (lufang) <lufang@cisco.com> wrote:

Donald,

Thank you for your review and comments.

We have addressed all your comments (including clarify PE and adding BCP reference), as well as other IESG review comments in 04 draft which is just posted.

Thank you for your time and help,

Luyuan


From: Donald Eastlake [mailto:d3e3e3@gmail.com]
Sent: 21 November 2008 04:02
To: iesg@ietf.org; secdir@ietf.org; George Swallow (swallow); Loa Andersson; mjork@nextpointnetworks.com; alia.atlas@bt.com; Luyuan Fang (lufang)
Subject: draft-ietf-mpls-ldp-igp-sync-03.txt

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document suggests ways to help where MPLS and MPLS label distribution (LDP) are intended to run over the links in a network as determined by an IP routing protocol but, for one reason or another, either transiently or permanently, IP routing is up on a link but MPLS is not functioning. This results in the possibility of MPLS frames following a path found by routing but getting black holed at the link where MPLS is not operational. The draft also suggests applicability of its suggestions to some types of tunnels.

Security Considerations
   While, admittedly, this relatively short document is about some fairly simple things relating to MPLS LDP and IP routing, I felt a bit shortchanged by the Security Considerations section.
   It is my impression that this document, or at least the underlying protocols it refers to, assume a trusted "provider" world with a secure perimeter such that "customer" traffic from the uncontrolled outside world has been tamed / filtered / labeled as it enters this trusted world. The presence of such clues as "edge-to-edge" and "PE" which, while unexplained and unexpanded in this document, I assume to be "Provider Edge", lead to this conclusion. But it would be nice to say this and/or to give a reference to the Security Considerations section of RFC 5306, which tends to recommend being secure by only talking to nodes that won't say anything nasty to you.
   The possibilities of Denial of Service caused by the drafts recommendations are discussed and do not seem particularly serious except, as the draft says, in case of "operational error or implementation error" however, I think the reference to "current best security practice" without any reference or further explanation is a bit vague.

Editorial
   Section 5, page 5, first line: Insert "that" after "attack".
   Section 5, page 5, fifth line: Replace "here is to prevent the link to be used when" with "here prevents the use of the link when"

I am bothered that no author lists a telephone number in the Author's Addresses section.

Thanks,
Donald
=============================
Donald E. Eastlake 3rd   +1-508-634-2066 (home)
155 Beaver Street
Milford, MA 01757 USA
d3e3e3@gmail.com



--
=============================
Donald E. Eastlake 3rd   +1-508-634-2066 (home)
155 Beaver Street
Milford, MA 01757 USA
d3e3e3@gmail.com
------=_Part_16456_7962456.1229618616237-- --===============1342052050== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir --===============1342052050==-- From secdir-bounces@ietf.org Thu Dec 18 15:45:33 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0C79D3A6A0F; Thu, 18 Dec 2008 15:45:33 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1808C3A69DF for ; Thu, 18 Dec 2008 15:45:31 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.461 X-Spam-Level: X-Spam-Status: No, score=-4.461 tagged_above=-999 required=5 tests=[AWL=2.138, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oqQ0wKLISTEx for ; Thu, 18 Dec 2008 15:45:30 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id E30313A6829 for ; Thu, 18 Dec 2008 15:45:29 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBINjKNn028883 for ; Thu, 18 Dec 2008 18:45:20 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBINjHrc028877 for ; Thu, 18 Dec 2008 18:45:17 -0500 Received: from mit.edu (M24-004-BARRACUDA-2.MIT.EDU [18.7.7.112]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBINjC2S004177 for ; Thu, 18 Dec 2008 18:45:12 -0500 (EST) Received: from mx11.bbn.com (mx11.bbn.com [128.33.0.80]) by mit.edu (Spam Firewall) with ESMTP id C3547141B053 for ; Thu, 18 Dec 2008 18:44:51 -0500 (EST) Received: from [128.89.253.129] (helo=Richard-Barnes-Laptop.local) by mx11.bbn.com with esmtp (Exim 4.60) (envelope-from ) id 1LDSXo-0004Dd-Fc; Thu, 18 Dec 2008 18:44:41 -0500 Message-ID: <494AE067.8080201@bbn.com> Date: Thu, 18 Dec 2008 18:44:39 -0500 From: Richard Barnes User-Agent: Thunderbird 2.0.0.18 (Macintosh/20081105) MIME-Version: 1.0 To: SECDIR , IETF Discussion , IESG , draft-ietf-mmusic-file-transfer-mech@tools.ietf.org X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: [secdir] SECDIR review of draft-ietf-mmusic-file-transfer-mech-09 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes an SDP syntax for signaling MSRP sessions that are to be used *only* for a specific file transfer. I highlight the word "only" because MSRP can already be used for file transfers, but the intent of an SDP peer to use a particular MSRP session to transfer a file cannot be signaled in SDP. This document adds syntax to SDP for that signaling. Given the fact that MSRP can already handle file transfers, I was expecting this document to address the security trade-offs associated with explicitly signaling these transfers. The current Security Considerations section focuses more on the traditional considerations around confidentiality and integrity of files transferred over this mechanism, without referencing the existing mechanisms in MSRP itself (RFC 4975). Overall, the document is well-written and comprehensible. However, there are a few ambiguities in the main text, and some significant repairs that need to be made to the Security Considerations. SECURITY COMMENTS: 1. The first paragraph of Section 10 is a non-sequitur: Lying about the attributes defined in this document has nothing to do with integrity-protection. The file sender can send a bad file that's still bit-for-bit perfect as it goes over the wire. What this section should recommend instead is that the file receiver MUST validate all available parts of the file-selector attribute (in addition to integrity protection). Similar text should be added to Section 8.2.2 and 8.3.2. This validation prevents the file sender from lying about what he's sending, and it prevents attackers that can't see the signaling from sending bad files to the file receiver. 2. The third paragraph of the Security Considerations (and parts of the first two) should be replaced by a reference to RFC 4975, which has a much more thorough discussion of integrity and confidentiality for MSRP. 3. There is no discussion of (1) authentication of file receivers or (2) authorization of file transfers. Given that this extension enables the "pull" pattern, this discussion is critical. For example, there's nothing in this document to recommend that my UA not blindly return any file that another UA asks for. I would recommend adding some text that file transfers MUST be authorized by the file sender's local policy, and that this authorization process MAY require that the file receiver be authenticated. The latter requirement will need some discussion of authentication, which can primarily be dealt with by referring to RFC 4975. OTHER COMMENTS: 1. The document discusses in detail when a change of file selector or file-transfer-id should trigger a new transmission. The document also seems to assume that a new transmission is only initiated after the first transmission is canceled. It's not clear (to me, anyway) whether this is in fact necessary, or whether a "new file transfer operation" (as in Figure 3) could be initiated without canceling the current operation. (Perhaps there's a port constraint here?) 2. In Section 8.2.1, why is "name" a MAY for inclusion in the file selector, while the others are MUSTs? 3. In Section 8.2.2, shouldn't it be "The file receiver ... MUST add at least one of the selectors defined..." (instead of SHOULD)? What would it mean for the recipient to send a blank file-selector? "Send me a file! Any file!"? _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 18 22:55:43 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 211343A693B; Thu, 18 Dec 2008 22:55:43 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 38A553A687A for ; Thu, 18 Dec 2008 17:51:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.881 X-Spam-Level: X-Spam-Status: No, score=-1.881 tagged_above=-999 required=5 tests=[AWL=0.717, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IWcYFsn-lGXX for ; Thu, 18 Dec 2008 17:51:53 -0800 (PST) Received: from mgw4.noc.ntt.com (mgw4.noc.ntt.com [210.160.15.15]) by core3.amsl.com (Postfix) with ESMTP id A908B3A68B4 for ; Thu, 18 Dec 2008 17:51:53 -0800 (PST) Received: from mop2.noc.ntt.com by mgw4.noc.ntt.com (NTT-Com MailSV) with ESMTP id mBJ1pdF6012904; Fri, 19 Dec 2008 10:51:39 +0900 (JST) Received: from mip1.noc.ntt.com (mvi2.noc.ntt.com) by mop2.noc.ntt.com (NTT-Com MailSV) with ESMTP id <0KC3001BLP63FH@ntt.com>; Fri, 19 Dec 2008 10:51:39 +0900 (JST) Date: Fri, 19 Dec 2008 10:51:39 +0900 From: "Yuji KAMITE" In-reply-to: <002101c94ef3$a5b23970$b3d80e0a@coe.ntt.com> To: "'Mark Townsley'" , "'Tim Polk'" Message-id: <00a101c9617c$5541e2b0$b3d80e0a@coe.ntt.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1933 X-Mailer: Microsoft Office Outlook 11 Thread-index: AclI7lo6i8ORuYAQQhS2oFMexGUuVgF/9WEwBKJxG7A= References: <002101c948d2$a6f73280$89fa320a@araoa.ntt.com> <25092678-15BA-42B6-B3CB-540C572A7859@nist.gov> <002101c94ef3$a5b23970$b3d80e0a@coe.ntt.com> X-Mailman-Approved-At: Thu, 18 Dec 2008 22:55:41 -0800 Cc: l2vpn-chairs@tools.ietf.org, draft-ietf-l2vpn-vpls-mcast-reqts@tools.ietf.org, secdir@ietf.org Subject: Re: [secdir] Status of draft-ietf-l2vpn-vpls-mcast-reqts? X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi Mark, Tim, Previously I sent you the proposed changes for the next -08 revision about security issues, but I haven't submitted it yet publicly. Could you tell me if I should post it right now to have your IESG review again, or I should wait for a while before submission. Best regards, Yuji > -----Original Message----- > From: Yuji KAMITE [mailto:y.kamite@ntt.com] > Sent: Tuesday, November 25, 2008 8:48 PM > To: 'Tim Polk' > Cc: secdir@ietf.org; shanna@juniper.net; 'Mark Townsley'; > draft-ietf-l2vpn-vpls-mcast-reqts@tools.ietf.org; > l2vpn-chairs@tools.ietf.org > Subject: RE: Status of draft-ietf-l2vpn-vpls-mcast-reqts? > > Hi Tim (CC: Sec-Dirs), > > > I will keep an eye out for the new text, and would be glad > to review > > it. > > For addressing your DISCUSSes and Sec-Dir comments about this > document, I am thinking about revising as attached. > > In your review you pointed out that the current document > lacks of thorough security analysis, so now I propose the > text to address it. > > I'd appreciate your recheck if it addresses the points you raised. > For detail, please see the attached text. I also send the > diff-file for your convenience. > > Best regards, > -Yuji > > ------------------------------ > Proposed changes summary: > - Modified Section 6.6. > - Create subsection 6.6.1 for security threat analysis : > - This is totally new text for addressing Sam's > DISCUSS and Sec-Dir comment below: > > https://datatracker.ietf.org/idtracker/draft-ietf-l2vpn-vpls-m > cast-reqts/comment/75905/ > > http://www.ietf.org/mail-archive/web/ietf/current/msg49004.html > > - Create subsection 6.6.2. for security requirements: > - Added a short paragraph to show highlighted > relationship to address the Tim's DISCUSS > > https://datatracker.ietf.org/idtracker/draft-ietf-l2vpn-vpls-m > cast-reqts/comment/78677/ > - Elaborated how each threat item is solved/mitigated > > - Modified Section 7. > - Added text as 3rd paragraph to reflect the proposed > changes in Section 6.6. > ------------------------------ > > > > -----Original Message----- > > From: Tim Polk [mailto:tim.polk@nist.gov] > > Sent: Tuesday, November 18, 2008 4:55 AM > > To: Yuji KAMITE > > Cc: 'Mark Townsley'; > > draft-ietf-l2vpn-vpls-mcast-reqts@tools.ietf.org; > > l2vpn-chairs@tools.ietf.org > > Subject: Re: Status of draft-ietf-l2vpn-vpls-mcast-reqts? > > > > Hi Yuji, > > > > I will keep an eye out for the new text, and would be glad > to review > > it. > > > > Thanks, > > > > Tim > > > > On Nov 17, 2008, at 10:36 AM, Yuji KAMITE wrote: > > > > > Mark, > > > > > > Regarding Tim's comment, > > > I've been writing up the security threat analysis recently, but > > > couldn't submit before the deadline. > > > I'd like to show the curent proposed text for security > very soon. > > > (Hopefully in this week.) I hope Tim will take a look at it. > > > > > > BTW, regarding Ron's comment, > > > I did the changes to address his comment already. > > > But not sure if he actually confirmed it. > > > > > > Regards, > > > Yuji > > > -----Original Message----- > > > From: Mark Townsley [mailto:townsley@cisco.com] > > > Sent: Monday, November 17, 2008 9:40 AM > > > To: draft-ietf-l2vpn-vpls-mcast-reqts@tools.ietf.org; > > > l2vpn-chairs@tools.ietf.org > > > Subject: Status of draft-ietf-l2vpn-vpls-mcast-reqts? > > > > > > > > > > > > My notes say: > > >> 2 issues mostly covered, remaining security threat > analysis issue > > >> taking more time. > > > I assume this means the comment from Ron can be argued > against, but > > > that the security issue is more problematic. > > > > > > The document hasn't moved since the last IETF. It seems stuck and > > > needs a little attention from someone. > > > > > > Authors, please try and sit down with Tim Polk this week > > and resolve > > > what needs to be done to move this document forward. If > you need my > > > help, please ask. > > > > > > Thanks, > > > > > > - Mark > > > > > > > > >> Discusses and Comments > > >> Ron Bonica: > > >> Discuss: > > >> [2007-12-20] Maybe I missed it, but the document doesn't seem to > > >> address MAC learning. > > >> > > >> Comment: > > >> [2007-12-20] You say " > > >> > > >> "Furthermore, in some cases, IP service providers might expect > > >> operational simplicity of VPLS. That is, they avoid direct and > > >> detailed knowledge of IP routing. In this case, the multicast > > >> delivery mechanism is expected to have not only efficiency > > but also > > >> simplicity. Generally speaking, there is a trade-off between > > >> efficiency and simplicity in terms of bandwidth usage and state > > >> maintenance, so the optimum trade-off will vary depending on the > > >> requirements of each IP service provider." > > >> > > >> The argument about "operational simplicity of VPLS" > > relative to layer > > >> 3 service is difficult to support, as instead of "direct > > and detailed > > >> knowledge of IP routting", one has to deal with direct and > > detailed > > >> knowledge of MAC addresses (including MAC address learning), and > > >> layer 2. > > >> > > >> Consider removing the entire paragraph > > >> > > >> > > >> Also, you say: > > >> > > >> "A solution SHOULD honor customer multicast domains." > > >> > > >> > > >> Perhaps replace with "A solution SHOULD NOT alter customer > > multicast > > >> domains' boundaries", as it is not clear what "honor .. > multicast > > >> domains" > > >> really means. Otherwise, clarify what "honor" means. > > >> > > >> Also, you say: > > >> > > >> "Multicast forwarding restoration time MUST NOT be greater > > than the > > >> restoration time of a customer's Layer-3 multicast > protocols. For > > >> example, if a customer uses PIM with default > configuration, hello > > >> hold timer is 105 seconds, and solutions are required to > detect a > > >> failure no later than this period." > > >> > > >> The above mixes *restoration* time at layer 3 with > > *detection* time > > >> at the VPLS infrastructure. Does not seems to be correct. > > >> > > >> > > >> Also, you say: > > >> > > >> Therefore, in addition to the L2VPN discovery requirements in > > >> [RFC4665], a multicast VPLS solution SHOULD provide a > method that > > >> dynamically allows multicast membership information to be > > discovered > > >> by PEs. Such membership information is, for example, a set of > > >> multicast addresses. What information is provided > dynamically is > > >> solution specific." > > >> > > >> > > >> This paragraph mixes several issues that should probably be > > >> unbundled. > > >> First of all, unless a solution supports (A), as defined in 3.2, > > >> there is little point in PEs' dynamically discovering multicast > > >> membership info. So, "SHOULD" be conditioned on supporting (A). > > >> > > >> Second in one scenario a PE discovers multicast membership > > info from > > >> only the sites connected to that PE, while in another > scenario in > > >> addition to the previous scenario the PE discovers multicast > > >> membership info from other PEs as well. The spec needs to > > spell out > > >> what exactly it means by "dynamically allow multicast membership > > >> information to be discovered by PEs". > > >> > > >> Tim Polk: > > >> Discuss: > > >> [2008-03-11] [This is a revised discuss, integrating Sam > Hartman's > > >> issues and my own into a single discuss to support AD > transition.] > > >> > > >> This discuss elaborates on issues raised in Steve > Hanna's security > > >> directorate review; that review also needs to be examined in its > > >> entirety. > > >> > > >> The following issue from the secdir review is blocking: > > >>> Unfortunately, the document does not contain a systematic > > security > > >>> analysis of the problem. The Security Considerations section > > >>> consists of two brief paragraphs. These paragraphs > refer to other > > >>> sections in the document where security requirements are > > listed and > > >>> to RFC 4665, which also lists security requirements. However, I > > >>> could not find any methodical threat analysis listing the > > possible > > >>> threats relevant to the system and stating which ones are > > protected > > >>> against and which are not. > > >> > > >>> Without a thorough threat analysis, I have little > confidence that > > >>> the authors have thought carefully about the possible > > threats to the > > >>> system. I would expect this to lead to large gaps in > the security > > >>> requirements and this seems to be borne out in practice. For > > >>> example, there is no discussion of threats due to compromise of > > >>> components within the service provider network. > > >> > > >>> Even more troublesome, I think that a single node at a > > customer site > > >>> (presumably untrusted) can mount dangerous attacks. For > > example, a > > >>> node that joins many multicast groups can cause a large > amount of > > >>> state to be maintained in the L2VPN. > > >> > > >> Please provide a threat analysis and please work to address or > > >> document the specific security concerns cited. > > >> > > >> Section 6.6 provides a list of mechanisms a VPLS solution SHOULD > > >> include. There is no apparent relationship between the > > requirements, > > >> and each is listed with a caveat regarding its application > > (e.g., "if > > >> examined"). The net effect is that list appears to be > > nearly empty > > >> under some circumstances: if multicast IP addresses are > > not used for > > >> forwarding, and neither Ethernet multicast control frames or IP > > >> multicast control packets are examined, only the first and last > > >> bullets would apply. > > >> > > >> First, are there implicit relationships that should be > > highlighted to > > >> clarify the overall effect? For example, if a VPLS > solution always > > >> examines either Ethernet multicast control frames or IP > multicast > > >> control packets, the net effect is very different. If such > > >> relationships exist they should be specifed. > > >> > > >> The SHOULD list is followed by several paragraphs with MAY > > >> requirements. Again, the net effect is that a VPLS > solution might > > >> provide none of these mechanisms. The security considerations > > >> section needs to elaborate on the consequences of a VPLS > solution > > >> that omits these security mechanisms. > > > > > > _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Thu Dec 18 23:16:21 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0027F28C0DD; Thu, 18 Dec 2008 23:16:21 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4EC403A6986 for ; Thu, 18 Dec 2008 23:16:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ju9GTZspW8-P for ; Thu, 18 Dec 2008 23:16:19 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 2F79F3A6985 for ; Thu, 18 Dec 2008 23:16:14 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.2) with ESMTP id mBJ7G5nE052992 for ; Fri, 19 Dec 2008 02:16:05 -0500 (EST) (envelope-from weiler+secdir@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.2/Submit) with ESMTP id mBJ7G5Am052989 for ; Fri, 19 Dec 2008 02:16:05 -0500 (EST) (envelope-from weiler+secdir@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Fri, 19 Dec 2008 02:16:05 -0500 (EST) From: Samuel Weiler X-X-Sender: weiler@fledge.watson.org To: secdir@ietf.org Message-ID: User-Agent: Alpine 1.10 (BSF 962 2008-03-14) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Fri, 19 Dec 2008 02:16:06 -0500 (EST) Subject: [secdir] Assignments for January 2nd X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org In recognition of the holidays, the due date for new assignments has been set to January 2nd. The next telchat is January 8th, and there are also telechats on January 15 and 29th. I'll try to hold off on new assignments over the next week or two, but you may see some additional docs move to the telechat agenda. With the extra telechat in January, many docs that have been languishing for a while may move forward -- this would be a good time to catch up on any overdue reviews. Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Phillip Hallam-Baker is next in the rotation. -- Sam For telechat 2009-01-02 Rob Austein T draft-ietf-idr-rfc3392bis-03 Paul Hoffman T draft-ietf-smime-3851bis-08 Eric Rescorla T draft-ietf-dkim-ssp-08 Sam Weiler TR draft-raj-dhc-tftp-addr-option-04 Nico Williams T draft-ietf-smime-3850bis-08 Tom Yu T draft-korhonen-mip4-service-06 Larry Zhu T draft-arkko-arp-iana-rules-05 Last calls and special requests: Derek Atkins draft-ietf-avt-post-repair-rtcp-xr-04 Rob Austein draft-ietf-dime-qos-parameters-08 Uri Blumenthal draft-ietf-ospf-manet-mdr-03 Pat Cain draft-ietf-geopriv-pdif-lo-profile-14 Pat Cain draft-ietf-ospf-manet-mpr-03 Ran Canetti draft-ietf-ospf-manet-or-01 Charles Clancy draft-ietf-pce-dste-02 Dave Cridland draft-ietf-pce-of-05 Alan DeKok draft-ietf-roll-home-routing-reqs-06 Lakshminath Dondeti draft-ietf-speermint-terminology-17 Shawn Emery draft-ietf-mediactrl-mixer-control-package-03 Stephen Farrell draft-melnikov-sieve-imapext-metadata-08 Tobias Gondrom draft-ietf-sieve-managesieve-05 Phillip Hallam-Baker draft-ietf-radext-design-05 Steve Hanna draft-ietf-radext-management-authorization-06 Scott Kelly draft-ietf-tsvwg-rsvp-proxy-approaches-06 Tero Kivinen R draft-ietf-softwire-encaps-safi-04 Catherine Meadows draft-ietf-speechsc-mrcpv2-17 Catherine Meadows draft-ietf-l2tpext-tdm-06 Alexey Melnikov draft-ietf-pce-pcep-xro-06 Sandy Murphy draft-ietf-mpls-mpls-and-gmpls-security-framework-04 Vidya Narayanan draft-ietf-sip-saml-05 Eric Rescorla draft-wing-sipping-srtp-key-04 Susan Thomson draft-loreto-simple-im-srv-label-02 Hannes Tschofenig draft-ietf-trill-prob-05 Sam Weiler draft-chown-v6ops-rogue-ra-02 Brian Weis draft-ietf-sieve-mime-loop-08 Nico Williams draft-ietf-v6ops-ra-guard-01 Larry Zhu draft-thaler-v6ops-teredo-extensions-02 Larry Zhu draft-ietf-softwire-hs-framework-l2tpv2-10 Glen Zorn draft-andreasen-sipping-rfc3603bis-07 _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Sat Dec 20 20:15:40 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 263C028C0D7; Sat, 20 Dec 2008 20:15:40 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B4B7D3A6A93; Fri, 19 Dec 2008 13:02:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.107 X-Spam-Level: X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_FR=0.35, J_CHICKENPOX_13=0.6, RCVD_IN_DNSWL_LOW=-1, SARE_MILLIONSOF=0.315, SARE_SUB_OBFU_Q1=0.227] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VL7Pafo+SDEz; Fri, 19 Dec 2008 13:02:09 -0800 (PST) Received: from p-mail1.rd.francetelecom.com (p-mail1.rd.francetelecom.com [195.101.245.15]) by core3.amsl.com (Postfix) with ESMTP id 5E84B3A6A92; Fri, 19 Dec 2008 13:02:02 -0800 (PST) Received: from ftrdmel3.rd.francetelecom.fr ([10.193.117.155]) by ftrdsmtp2.rd.francetelecom.fr with Microsoft SMTPSVC(6.0.3790.3959); Fri, 19 Dec 2008 22:01:08 +0100 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----_=_NextPart_001_01C9621C.E9A3EE39" Date: Fri, 19 Dec 2008 22:00:57 +0100 Message-ID: <941BA0BF46DB8F4983FF7C8AFE800BC20876594C@ftrdmel3> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: secdir review of draft-ietf-roll-urban-routing-reqs-02 thread-index: AclWKa1WsFNwTtlgSJyQFHbRzdk7mAL1twxA References: From: To: X-OriginalArrivalTime: 19 Dec 2008 21:01:08.0513 (UTC) FILETIME=[EA3B4910:01C9621C] X-Mailman-Approved-At: Sat, 20 Dec 2008 20:15:39 -0800 Cc: iesg@ietf.org, draft-ietf-roll-urban-routing-reqs@tools.ietf.org, secdir@ietf.org, dward@cisco.com, roll-chairs@tools.ietf.org Subject: Re: [secdir] secdir review of draft-ietf-roll-urban-routing-reqs-02 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C9621C.E9A3EE39 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello Sandra, On behalf of the authors of draft-ietf-roll-urban-routing-reqs-02.txt, = we would like to thank you again for your comments. Please find attached our response to them, along with the proposed new = text for the draft and a diff file highlighting the changes. Should you consider that the corrections do adequately answer your = concerns, please let us know and we'll move the new text to become the = working group next version of the document. If they don't answer your concerns, can you please let us know of your = remaining comments at your earliest convenience? With best regards Dominique=20 -----Message d'origine----- De : Sandra Murphy [mailto:sandy@sparta.com]=20 Envoy=E9 : jeudi 4 d=E9cembre 2008 17:01 =C0 : secdir@ietf.org; iesg@ietf.org; roll-chairs@tools.ietf.org; = mischa.dohler@cttc.es; thomas.watteyne@ieee.org; = tim.winter@ekasystems.com; BARTHEL Dominique RD-TECH-GRE; JACQUENET = Christian ROSI-ITNPS-NAD-TIP Objet : secdir review of draft-ietf-roll-urban-routing-reqs-02 I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written primarily for the benefit of the security = area directors. Document editors and WG chairs should treat these = comments just like any other last call comments. The document covers the requirements for routing in low power and lossy = networks in urban environments. It covers the basics of that territory, = defining terms and limitations of the networks being considered, and the = requirements that produces for routing in that setting. The security considerations section covers the services that one would = expect to see covered. Unfortunately, I was continually confused as to = whether the discussion of security requirements was focused on the = security of the routing or the security of the data that was being = routed. The following text from the security considerations section is an = example: A secure communication in a wireless network encompasses three main elements, i.e. confidentiality (encryption of data), integrity (correctness of data), and authentication (legitimacy of data). Authentication can e.g. be violated if external sources insert incorrect data packets; integrity can e.g. be violated if nodes = start to break down and hence commence measuring and relaying data incorrectly. Nonetheless, some sensor readings as well as the actuator control signals need to be confidential. There are concerns in routing protocols about the authenticity and = integrity of the contents of the routing protocol messages - the = *control* data, not the sensor and actuator data. A need for = confidentiality of the routing protocol message content is not as = generally accepted, and this paragraph seems to be considering the = confidentiality of the data traffic, not the control traffic. Later the focus returns to the security of the routing protocol itself: The U-LLN MUST be protected against attempts to inject false or modified packets. For example, an attacker SHOULD be prevented from manipulating or disabling the routing function by compromising routing update messages. Moreover, it SHOULD NOT be possible to coerce the network into routing packets which have been modified in transit. To this end the routing protocol(s) MUST support message integrity. The impact on availability of the forwarding service is typically a = concern for routing protocols and is not mentioned here. Can routing = produce a data traffic forwarding path that loops? Can the routing = protocol be subverted to the point that routing protocol messages are = consuming the available resources? Etc. Mechanisms MUST be in place to deny any rogue node which attempts to take advantage of self-configuration and self- organization procedures. Such attacks may attempt, for example, to cause denial of service, drain the energy of power constrained devices, or to hijack the routing mechanism. A node MUST authenticate itself to a trusted node that is already associated = with the U-LLN before any self-configuration or self-organization is allowed to proceed. This seems to be addressing the possibility of a legitimate node = behaving badly. But the requirement that a node must authenticate = itself only prevents bad behavior from outsiders, not insiders. Further = comment - self-organization and self-configuration had previously = referred to configuration or organization of a network, not a single = node. Does this mean that a node must authenticate before it can = participate in the network self-organization? And of course the = chicken-and-egg problem - before the network has self-organized, how can = the nodes reach a trusted node. Must *every* node authenticate before = self-organization can proceed? Or does self-organization spread = outwards incrementally from the trusted node? With low computation power and scarce energy resources, U-LLNs nodes may not be able to resist any attack from high-power malicious nodes (e.g. laptops and strong radios). However, the amount of damage generated to the whole network SHOULD be commensurate with the = number of nodes physically compromised. For example, an intruder taking control over a single node SHOULD not have total access to, or be able to completely deny service to the whole network. If a taken-over node does not have access to the whole network, how = could it have had access to the whole network before being taken over?=20 Subverted nodes generally are assumed to retain all their abilities, = which is why they are such a problem. This seems to be requiring that = no one node ever has access to the whole network. In the rest of the document: Routers are introduced, including the special category of LBR - Some routers provide access to wider infrastructures, such as the Internet, and are named Low power and lossy network Border Routers (LBRs) in that context. However, in the remainder of the document, the text refers to LBRs = everywhere in places where it sounds like they are referring to routers. = Are all routers LBRs? Do the discussions of LBRs not apply to interior = routers? There are references to "node" forwarding traffic in some places. Are = all such nodes routers, or do sensors and actuators sometimes forward = traffic?=20 E.g., A node must be able to send its own alerts toward an LBR while continuing to forward traffic on behalf of other devices who are = also experiencing an alert condition. In the following text: Routing within urban sensor networks SHOULD require the U-LLN nodes to dynamically compute, select and install different paths towards a same destination, depending on the nature of the traffic. From this perspective, such nodes SHOULD inspect the contents of traffic payload for making routing and forwarding decisions: for example, = the analysis of traffic payload should encourage the enforcement of forwarding policies based upon aggregation capabilities for the sake of efficiency. If data needs to be confidential, as mentioned in the security = considerations section, then the data would have to be protected hop by = hop, with each router/node decrypting and re-encrypting as it forwarded = the data, if the router/node is to inspect the contents. Is this = intended? ------_=_NextPart_001_01C9621C.E9A3EE39 Content-Type: text/plain; name="response to draft-ietf-roll-urban-routing-reqs-02-s murphy.txt" Content-Transfer-Encoding: base64 Content-Description: response to draft-ietf-roll-urban-routing-reqs-02-s murphy.txt Content-Disposition: attachment; filename="response to draft-ietf-roll-urban-routing-reqs-02-s murphy.txt" fERlOiBTYW5kcmEgTXVycGh5IFtzYW5keUBzcGFydGEuY29tXQ0KfEVudm956TogamV1ZGkgNCBk 6WNlbWJyZSAyMDA4IDE3OjAxDQp8wDogc2VjZGlyQGlldGYub3JnOyBpZXNnQGlldGYub3JnOyBy b2xsLWNoYWlyc0B0b29scy5pZXRmLm9yZzsNCnxtaXNjaGEuZG9obGVyQGN0dGMuZXM7IHRob21h cy53YXR0ZXluZUBpZWVlLm9yZzsNCnx0aW0ud2ludGVyQGVrYXN5c3RlbXMuY29tOyBCQVJUSEVM IERvbWluaXF1ZSBSRC1URUNILUdSRTsgSkFDUVVFTkVUDQp8Q2hyaXN0aWFuIFJPU0ktSVROUFMt TkFELVRJUA0KfE9iamV0OiBzZWNkaXIgcmV2aWV3IG9mIGRyYWZ0LWlldGYtcm9sbC11cmJhbi1y b3V0aW5nLXJlcXMtMDINCnwNCnwNCnxJIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBw YXJ0IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdzIG9uZ29pbmcgZWZmb3J0IHRvIHJldmll dyBhbGwgSUVURg0KfGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuIA0KfFRo ZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRo ZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4gIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHDQp8Y2hh aXJzIHNob3VsZCB0cmVhdCB0aGVzZSBjb21tZW50cyBqdXN0IGxpa2UgYW55IG90aGVyIGxhc3Qg Y2FsbCBjb21tZW50cy4NCnwNCnxUaGUgZG9jdW1lbnQgY292ZXJzIHRoZSByZXF1aXJlbWVudHMg Zm9yIHJvdXRpbmcgaW4gbG93IHBvd2VyIGFuZCBsb3NzeSBuZXR3b3JrcyBpbiB1cmJhbiBlbnZp cm9ubWVudHMuICBJdA0KfGNvdmVycyB0aGUgYmFzaWNzIG9mIHRoYXQgdGVycml0b3J5LCBkZWZp bmluZyB0ZXJtcyBhbmQgbGltaXRhdGlvbnMgb2YgdGhlIG5ldHdvcmtzIGJlaW5nIGNvbnNpZGVy ZWQsIGFuZCB0aGUNCnxyZXF1aXJlbWVudHMgdGhhdCBwcm9kdWNlcyBmb3Igcm91dGluZyBpbiB0 aGF0IHNldHRpbmcuDQp8DQp8DQp8VGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHNlY3Rpb24g Y292ZXJzIHRoZSBzZXJ2aWNlcyB0aGF0IG9uZSB3b3VsZCBleHBlY3QgdG8gc2VlIGNvdmVyZWQu IFVuZm9ydHVuYXRlbHksDQp8SSB3YXMgY29udGludWFsbHkgY29uZnVzZWQgYXMgdG8gd2hldGhl ciB0aGUgZGlzY3Vzc2lvbiBvZiBzZWN1cml0eSByZXF1aXJlbWVudHMgd2FzIGZvY3VzZWQgb24g dGhlIHNlY3VyaXR5DQp8b2YgdGhlIHJvdXRpbmcgb3IgdGhlIHNlY3VyaXR5IG9mIHRoZSBkYXRh IHRoYXQgd2FzIGJlaW5nIHJvdXRlZC4NCnwNCnxUaGUgZm9sbG93aW5nIHRleHQgZnJvbSB0aGUg c2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiBpcyBhbiBleGFtcGxlOg0KfA0KfCAgICBB IHNlY3VyZSBjb21tdW5pY2F0aW9uIGluIGEgd2lyZWxlc3MgbmV0d29yayBlbmNvbXBhc3NlcyB0 aHJlZSBtYWluDQp8ICAgIGVsZW1lbnRzLCBpLmUuIGNvbmZpZGVudGlhbGl0eSAoZW5jcnlwdGlv biBvZiBkYXRhKSwgaW50ZWdyaXR5DQp8ICAgIChjb3JyZWN0bmVzcyBvZiBkYXRhKSwgYW5kIGF1 dGhlbnRpY2F0aW9uIChsZWdpdGltYWN5IG9mIGRhdGEpLg0KfA0KfCAgICBBdXRoZW50aWNhdGlv biBjYW4gZS5nLiBiZSB2aW9sYXRlZCBpZiBleHRlcm5hbCBzb3VyY2VzIGluc2VydA0KfCAgICBp bmNvcnJlY3QgZGF0YSBwYWNrZXRzOyBpbnRlZ3JpdHkgY2FuIGUuZy4gYmUgdmlvbGF0ZWQgaWYg bm9kZXMgc3RhcnQNCnwgICAgdG8gYnJlYWsgZG93biBhbmQgaGVuY2UgY29tbWVuY2UgbWVhc3Vy aW5nIGFuZCByZWxheWluZyBkYXRhDQp8ICAgIGluY29ycmVjdGx5LiAgTm9uZXRoZWxlc3MsIHNv bWUgc2Vuc29yIHJlYWRpbmdzIGFzIHdlbGwgYXMgdGhlDQp8ICAgIGFjdHVhdG9yIGNvbnRyb2wg c2lnbmFscyBuZWVkIHRvIGJlIGNvbmZpZGVudGlhbC4NCg0KQW5hbHlzaXMNCldlIGFja25vd2xl ZGdlIHNlY3VyaXR5IHdhcyBhZGRyZXNzZWQgaW4gYSBicm9hZCB3YXkgaW4gdGhlIG9yaWdpbmFs IHRleHQsIHNvbWUgb2YgdGhlIGNvbmZ1c2lvbiBtYXkgaGF2ZSByZW1haW5lZCBldmVuIHNpbmNl IHdlIHJlZm9jdXNzZWQgdGhlIGxhdGVyIHZlcnNpb25zLiAgDQoNCkFjdGlvbiB0YWtlbg0Kd2Ug aGF2ZSByZXdvcmtlZCB0aGUgdGV4dCB0byBmb2N1cyBhbGwgc2VjdXJpdHkgY29uY2VybnMgb24g cm91dGluZyBzZWN1cml0eSBleGNsdXNpdmVseS4gVGhpcyByZWZsZWN0cyBpbiBzZXZlcmFsIHBh cmFncmFwaCwgcGxlYXNlIHNlZSB0aGUgZGlmZiBmaWxlIHRvIHNwb3QgdGhlbS4NCg0KDQp8DQp8 VGhlcmUgYXJlIGNvbmNlcm5zIGluIHJvdXRpbmcgcHJvdG9jb2xzIGFib3V0IHRoZSBhdXRoZW50 aWNpdHkgYW5kIGludGVncml0eSBvZiB0aGUgY29udGVudHMgb2YgdGhlIHJvdXRpbmcNCnxwcm90 b2NvbCBtZXNzYWdlcyAtIHRoZSAqY29udHJvbCogZGF0YSwgbm90IHRoZSBzZW5zb3IgYW5kIGFj dHVhdG9yIGRhdGEuICBBIG5lZWQgZm9yIGNvbmZpZGVudGlhbGl0eSBvZiB0aGUNCnxyb3V0aW5n IHByb3RvY29sIG1lc3NhZ2UgY29udGVudCBpcyBub3QgYXMgZ2VuZXJhbGx5IGFjY2VwdGVkLCBh bmQgdGhpcyBwYXJhZ3JhcGggc2VlbXMgdG8gYmUgY29uc2lkZXJpbmcgdGhlDQp8Y29uZmlkZW50 aWFsaXR5IG9mIHRoZSBkYXRhIHRyYWZmaWMsIG5vdCB0aGUgY29udHJvbCB0cmFmZmljLg0KDQpB bmFseXNpcw0KVGhlICJkYXRhIiB2cy4gImNvbnRyb2wiIHBhcnQgb2YgdGhpcyBjb21tZW50IGhh cyBiZWVuIGFkZHJlc3NlZCBhYm92ZS4NClJlZ2FyZGluZyBhdXRoZW50aWNpdHksIGludGVncml0 eSBhbmQgY29uZmlkZW50aWFsaXR5LCB3ZSBhY2tub3dsZWRnZSB0aGUgaW1wb3J0YW5jZSBvZiBh dXRoZW50aWNpdHkgYW5kIGludGVncml0eSBvZiByb3V0aW5nIG1lc3NhZ2VzLiBXZSB3b3VsZCBl dmVuIGxpa2UgdG8gZW5jb3VyYWdlIGNvbmZpZGVudGlhbGl0eSBvZiByb3V0aW5nIG1lc3NhZ2Vz Lg0KDQpBY3Rpb24gdGFrZW4NCk5ldyB0ZXh0IGlzIHByb3Bvc2VkIHRvIHJlYWQNCiAgIFRoZSBj aG9pY2Ugb2YgdGhlIHJvdXRpbmcgc2VjdXJpdHkgc29sdXRpb25zIHdpbGwgaGF2ZSBhbiBpbXBh Y3Qgb250bw0KICAgcm91dGluZyBwcm90b2NvbChzKS4gIFRvIHRoaXMgZW5kLCByb3V0aW5nIHBy b3RvY29sKHMpIHByb3Bvc2VkIGluDQogICB0aGUgY29udGV4dCBvZiBVLUxMTnMgTVVTVCBzdXBw b3J0IGF1dGhlbnRpY2F0aW9uIGFuZCBpbnRlZ3JpdHkNCiAgIG1lYXN1cmVzIGFuZCBTSE9VTEQg c3VwcG9ydCBjb25maWRlbnRpYWxpdHkgKHJvdXRpbmcgc2VjdXJpdHkpDQogICBtZWFzdXJlcy4N Cg0KDQoNCnwNCnxMYXRlciB0aGUgZm9jdXMgcmV0dXJucyB0byB0aGUgc2VjdXJpdHkgb2YgdGhl IHJvdXRpbmcgcHJvdG9jb2wgaXRzZWxmOg0KfA0KfCAgICBUaGUgVS1MTE4gTVVTVCBiZSBwcm90 ZWN0ZWQgYWdhaW5zdCBhdHRlbXB0cyB0byBpbmplY3QgZmFsc2Ugb3INCnwgICAgbW9kaWZpZWQg cGFja2V0cy4gIEZvciBleGFtcGxlLCBhbiBhdHRhY2tlciBTSE9VTEQgYmUgcHJldmVudGVkIGZy b20NCnwgICAgbWFuaXB1bGF0aW5nIG9yIGRpc2FibGluZyB0aGUgcm91dGluZyBmdW5jdGlvbiBi eSBjb21wcm9taXNpbmcNCnwgICAgcm91dGluZyB1cGRhdGUgbWVzc2FnZXMuICBNb3Jlb3Zlciwg aXQgU0hPVUxEIE5PVCBiZSBwb3NzaWJsZSB0bw0KfCAgICBjb2VyY2UgdGhlIG5ldHdvcmsgaW50 byByb3V0aW5nIHBhY2tldHMgd2hpY2ggaGF2ZSBiZWVuIG1vZGlmaWVkIGluDQp8ICAgIHRyYW5z aXQuICBUbyB0aGlzIGVuZCB0aGUgcm91dGluZyBwcm90b2NvbChzKSBNVVNUIHN1cHBvcnQgbWVz c2FnZQ0KfCAgICBpbnRlZ3JpdHkuDQp8DQp8VGhlIGltcGFjdCBvbiBhdmFpbGFiaWxpdHkgb2Yg dGhlIGZvcndhcmRpbmcgc2VydmljZSBpcyB0eXBpY2FsbHkgYSBjb25jZXJuIGZvciByb3V0aW5n IHByb3RvY29scyBhbmQgaXMgbm90DQp8bWVudGlvbmVkIGhlcmUuICBDYW4gcm91dGluZyBwcm9k dWNlIGEgZGF0YSB0cmFmZmljIGZvcndhcmRpbmcgcGF0aCB0aGF0IGxvb3BzPyAgQ2FuIHRoZSBy b3V0aW5nIHByb3RvY29sIGJlDQp8c3VidmVydGVkIHRvIHRoZSBwb2ludCB0aGF0IHJvdXRpbmcg cHJvdG9jb2wgbWVzc2FnZXMgYXJlIGNvbnN1bWluZyB0aGUgYXZhaWxhYmxlIHJlc291cmNlcz8g IEV0Yy4NCnwNCg0KQW5hbHlzaXMNCldlIGFncmVlIHRoYXQgdGhlIGV4YW1wbGVzIHlvdSBicmlu ZyB1cCBoaWdobGlnaHQgc29tZSBwb3RlbnRpYWwgdGhyZWF0cyB0byB0aGUgbmV0d29ya3Mgd2Ug YXJlIGNvbnNpZGVyaW5nLg0KDQpBY3Rpb24gdGFrZW4NCkFkZGVkIHRleHQgYWJvdXQgRG9TLCBm b3J3YXJkaW5nIGxvb3BzIGFuZCBwcm90b2NvbCBvdmVyaGVhZCBhdHRhY2tzLg0KDQoNCg0KfCAg ICAgICAgICAgICAgICAgICAgIE1lY2hhbmlzbXMgTVVTVCBiZSBpbiBwbGFjZSB0byBkZW55IGFu eSByb2d1ZSBub2RlDQp8ICAgIHdoaWNoIGF0dGVtcHRzIHRvIHRha2UgYWR2YW50YWdlIG9mIHNl bGYtY29uZmlndXJhdGlvbiBhbmQgc2VsZi0NCnwgICAgb3JnYW5pemF0aW9uIHByb2NlZHVyZXMu ICBTdWNoIGF0dGFja3MgbWF5IGF0dGVtcHQsIGZvciBleGFtcGxlLCB0bw0KfCAgICBjYXVzZSBk ZW5pYWwgb2Ygc2VydmljZSwgZHJhaW4gdGhlIGVuZXJneSBvZiBwb3dlciBjb25zdHJhaW5lZA0K fCAgICBkZXZpY2VzLCBvciB0byBoaWphY2sgdGhlIHJvdXRpbmcgbWVjaGFuaXNtLiAgQSBub2Rl IE1VU1QNCnwgICAgYXV0aGVudGljYXRlIGl0c2VsZiB0byBhIHRydXN0ZWQgbm9kZSB0aGF0IGlz IGFscmVhZHkgYXNzb2NpYXRlZCB3aXRoDQp8ICAgIHRoZSBVLUxMTiBiZWZvcmUgYW55IHNlbGYt Y29uZmlndXJhdGlvbiBvciBzZWxmLW9yZ2FuaXphdGlvbiBpcw0KfCAgICBhbGxvd2VkIHRvIHBy b2NlZWQuDQp8DQp8DQp8VGhpcyBzZWVtcyB0byBiZSBhZGRyZXNzaW5nIHRoZSBwb3NzaWJpbGl0 eSBvZiBhIGxlZ2l0aW1hdGUgbm9kZSBiZWhhdmluZyBiYWRseS4gIEJ1dCB0aGUgcmVxdWlyZW1l bnQgdGhhdCBhDQp8bm9kZSBtdXN0IGF1dGhlbnRpY2F0ZSBpdHNlbGYgb25seSBwcmV2ZW50cyBi YWQgYmVoYXZpb3IgZnJvbSBvdXRzaWRlcnMsIG5vdCBpbnNpZGVycy4NCg0KDQpBbmFseXNpcw0K QXV0aGVudGljYXRpb24gaXMgb25seSBvbmUgbWVhbiBieSB3aGljaCB0aGUgbmV0d29yayBwcm90 ZWN0IGFnYWluc3Qgb3V0c2lkZXJzLg0KV2UgYWdyZWUgd2l0aCB0aGUgY29tbWVudCB0aGF0IGF1 dGhlbnRpY2F0aW9uIGRvZXMgbm90IHByb3RlY3QgdGhlIG5ldHdvcmsgZnJvbSBpbnNpZGVyIG5v ZGVzIGJlaGF2aW5nIGJhZGx5Lg0KQXQgdGhpcyBzdGFnZSwgd2UncmUgb25seSBjYWxsaW5nIGZv ciBtZWNoYW5pc21zIHRvd2FyZHMgdGhhdCBwcm90ZWN0aW9uLCBub3QgZGVzY3JpYmluZyB3aGF0 IHRoZXNlIG1lY2hhbmlzbXMgY291bGQgYmUuDQoNCkFjdGlvbiB0YWtlbg0KVGhlIHByb3Bvc2Vk IG5ldyB0ZXh0IHJlYWRzDQogICAgICBNZWNoYW5pc21zIE1VU1QgYmUgaW4gcGxhY2UgdG8gZGVu eSBhbnkgbm9kZSB3aGljaCBhdHRlbXB0cyB0byB0YWtlDQogICAgICBtYWxpY2lvdXMgYWR2YW50 YWdlIG9mIHNlbGYtY29uZmlndXJhdGlvbiBhbmQgc2VsZi1vcmdhbml6YXRpb24NCiAgICAgIHBy b2NlZHVyZXMuDQoNCg0KfEZ1cnRoZXIgY29tbWVudCAtDQp8c2VsZi1vcmdhbml6YXRpb24gYW5k IHNlbGYtY29uZmlndXJhdGlvbiBoYWQgcHJldmlvdXNseSByZWZlcnJlZCB0byBjb25maWd1cmF0 aW9uIG9yIG9yZ2FuaXphdGlvbiBvZiBhDQp8bmV0d29yaywgbm90IGEgc2luZ2xlIG5vZGUuICBE b2VzIHRoaXMgbWVhbiB0aGF0IGEgbm9kZSBtdXN0IGF1dGhlbnRpY2F0ZSBiZWZvcmUgaXQgY2Fu IHBhcnRpY2lwYXRlIGluIHRoZQ0KfG5ldHdvcmsgc2VsZi1vcmdhbml6YXRpb24/ICBBbmQgb2Yg Y291cnNlIHRoZSBjaGlja2VuLWFuZC1lZ2cgcHJvYmxlbSAtIGJlZm9yZSB0aGUgbmV0d29yayBo YXMgc2VsZi1vcmdhbml6ZWQsDQp8aG93IGNhbiB0aGUgbm9kZXMgcmVhY2ggYSB0cnVzdGVkIG5v ZGUuICBNdXN0ICpldmVyeSogbm9kZSBhdXRoZW50aWNhdGUgYmVmb3JlIHNlbGYtb3JnYW5pemF0 aW9uIGNhbiBwcm9jZWVkPw0KfE9yIGRvZXMgc2VsZi1vcmdhbml6YXRpb24gc3ByZWFkIG91dHdh cmRzIGluY3JlbWVudGFsbHkgZnJvbSB0aGUgdHJ1c3RlZCBub2RlPw0KfA0KDQpBbmFseXNpcw0K WWVzLCB3ZSBkbyB0aGluayBhbmQgZGlkIHdyaXRlIHRoYXQsIG9uIGEgbG9jYWwgc2NhbGUsICJB IG5vZGUgTVVTVCBhdXRoZW50aWNhdGUgaXRzZWxmIHRvIGEgdHJ1c3RlZCBub2RlIHRoYXQgaXMg YWxyZWFkeSBhc3NvY2lhdGVkIHdpdGggdGhlIFUtTExOIGJlZm9yZS4uLiINCkhvd2V2ZXIsIGlu IHRoaXMgZG9jdW1lbnQsIGl0IHdhcyBub3Qgb3VyIGludGVudCB0byBzcGVjaWZ5IHRoYXQsIGF0 IHRoZSBuZXR3b3JrIHNjYWxlLCBhbGwgYXV0aGVudGljYXRpb24gbXVzdCBjb21wbGV0ZWx5IGhh dmUgdGFrZW4gcGxhY2UgYmVmb3JlIGFueSBvcmdhbml6YXRpb24gY2FuIHN0YXJ0Lg0KV2UgYWNr bm93bGVkZ2UgdGhlaXIgd2FzIHNvbWUgYW1iaWd1aXR5IGluIHRoZSB0ZXh0IGFuZCB3ZSBoYXZl IGNvcnJlY3RlZCBpdC4NCg0KQWN0aW9uIHRha2VuDQpQcm9wb3NlZCBuZXcgdGV4dCB0byByZWFk Og0KICAgICAgQSBub2RlIE1VU1QgYXV0aGVudGljYXRlIGl0c2VsZiB0byBhIHRydXN0ZWQgbm9k ZSB0aGF0IGlzIGFscmVhZHkgYXNzb2NpYXRlZA0KICAgICAgd2l0aCB0aGUgVS1MTE4gYmVmb3Jl IHRoZSBmb3JtZXIgY2FuIHRha2UgcGFydCBpbiBzZWxmLWNvbmZpZ3VyYXRpb24gb3Igc2VsZi1v cmdhbml6YXRpb24uDQoNCg0KfA0KfCAgICBXaXRoIGxvdyBjb21wdXRhdGlvbiBwb3dlciBhbmQg c2NhcmNlIGVuZXJneSByZXNvdXJjZXMsIFUtTExOcyBub2Rlcw0KfCAgICBtYXkgbm90IGJlIGFi bGUgdG8gcmVzaXN0IGFueSBhdHRhY2sgZnJvbSBoaWdoLXBvd2VyIG1hbGljaW91cyBub2Rlcw0K fCAgICAoZS5nLiBsYXB0b3BzIGFuZCBzdHJvbmcgcmFkaW9zKS4gIEhvd2V2ZXIsIHRoZSBhbW91 bnQgb2YgZGFtYWdlDQp8ICAgIGdlbmVyYXRlZCB0byB0aGUgd2hvbGUgbmV0d29yayBTSE9VTEQg YmUgY29tbWVuc3VyYXRlIHdpdGggdGhlIG51bWJlcg0KfCAgICBvZiBub2RlcyBwaHlzaWNhbGx5 IGNvbXByb21pc2VkLiAgRm9yIGV4YW1wbGUsIGFuIGludHJ1ZGVyIHRha2luZw0KfCAgICBjb250 cm9sIG92ZXIgYSBzaW5nbGUgbm9kZSBTSE9VTEQgbm90IGhhdmUgdG90YWwgYWNjZXNzIHRvLCBv ciBiZQ0KfCAgICBhYmxlIHRvIGNvbXBsZXRlbHkgZGVueSBzZXJ2aWNlIHRvIHRoZSB3aG9sZSBu ZXR3b3JrLg0KfA0KfElmIGEgdGFrZW4tb3ZlciBub2RlIGRvZXMgbm90IGhhdmUgYWNjZXNzIHRv IHRoZSB3aG9sZSBuZXR3b3JrLCBob3cgY291bGQgaXQgaGF2ZSBoYWQgYWNjZXNzIHRvIHRoZSB3 aG9sZQ0KfG5ldHdvcmsgYmVmb3JlIGJlaW5nIHRha2VuIG92ZXI/IA0KfFN1YnZlcnRlZCBub2Rl cyBnZW5lcmFsbHkgYXJlIGFzc3VtZWQgdG8gcmV0YWluIGFsbCB0aGVpciBhYmlsaXRpZXMsIHdo aWNoIGlzIHdoeSB0aGV5IGFyZSBzdWNoIGEgcHJvYmxlbS4NCnxUaGlzIHNlZW1zIHRvIGJlIHJl cXVpcmluZyB0aGF0IG5vIG9uZSBub2RlIGV2ZXIgaGFzIGFjY2VzcyB0byB0aGUgd2hvbGUgbmV0 d29yay4NCg0KQW5hbHlzaXMNCldlIGFja25vd2xlZGdlIHRoYXQgImhhdmUgYWNjZXNzIHRvIiB3 YXMgYW1iaWd1b3VzLg0KDQpBY3Rpb24gdGFrZW4NClByb3Bvc2VkIG5ldyB0ZXh0IHRvIHJlYWQ6 DQogICAgICBGb3IgZXhhbXBsZSwgYW4gaW50cnVkZXIgdGFraW5nIGNvbnRyb2wgb3ZlciBhIHNp bmdsZSBub2RlDQogICAgICBTSE9VTEQgTk9UIGJlIGFibGUgdG8gY29tcGxldGVseSBkZW55IHNl cnZpY2UgdG8gdGhlIHdob2xlIG5ldHdvcmsuDQoNCnwNCnxJbiB0aGUgcmVzdCBvZiB0aGUgZG9j dW1lbnQ6DQp8DQp8Um91dGVycyBhcmUgaW50cm9kdWNlZCwgaW5jbHVkaW5nIHRoZSBzcGVjaWFs IGNhdGVnb3J5IG9mIExCUiAtDQp8ICAgIFNvbWUgcm91dGVycyBwcm92aWRlIGFjY2VzcyB0byB3 aWRlciBpbmZyYXN0cnVjdHVyZXMsIHN1Y2ggYXMgdGhlDQp8ICAgIEludGVybmV0LCBhbmQgYXJl IG5hbWVkIExvdyBwb3dlciBhbmQgbG9zc3kgbmV0d29yayBCb3JkZXIgUm91dGVycw0KfCAgICAo TEJScykgaW4gdGhhdCBjb250ZXh0Lg0KfEhvd2V2ZXIsIGluIHRoZSByZW1haW5kZXIgb2YgdGhl IGRvY3VtZW50LCB0aGUgdGV4dCByZWZlcnMgdG8gTEJScyBldmVyeXdoZXJlIGluIHBsYWNlcyB3 aGVyZSBpdCBzb3VuZHMgbGlrZQ0KfHRoZXkgYXJlIHJlZmVycmluZyB0byByb3V0ZXJzLiANCnxB cmUgYWxsIHJvdXRlcnMgTEJScz8gIERvIHRoZSBkaXNjdXNzaW9ucyBvZiBMQlJzIG5vdCBhcHBs eSB0byBpbnRlcmlvciByb3V0ZXJzPw0KfA0KDQpBbmFseXNpcw0KTG9va2luZyBjYXJlZnVsbHkg YXQgdGhlIHdob2xlIGRvY3VtZW50LCB3ZSBiZWxlaXZlIGl0IHByb3Blcmx5IGV4cGxhaW5zIHRo YXQNCm5vdCBhbGwgcm91dGVycyBhcmUgTEJScywgYW5kIHNvIGRpc2N1c3Npb25zIGFib3V0IExC UnMgZ2VuZXJhbGx5IGRvIG5vdCBhcHBseQ0KdG8gaW50ZXJpb3Igcm91dGVyLiBUaGUgdXNlIG9m IHRoZSB0ZXJtIExCUiBsb29rcyBjb25zaXN0ZW50IHRvIHVzLg0KIA0KfFRoZXJlIGFyZSByZWZl cmVuY2VzIHRvICJub2RlIiBmb3J3YXJkaW5nIHRyYWZmaWMgaW4gc29tZSBwbGFjZXMuICBBcmUg YWxsIHN1Y2ggbm9kZXMgcm91dGVycywgb3IgZG8gc2Vuc29ycw0KfGFuZCBhY3R1YXRvcnMgc29t ZXRpbWVzIGZvcndhcmQgdHJhZmZpYz8gDQp8RS5nLiwNCnwNCnwgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEENCnwg ICAgbm9kZSBtdXN0IGJlIGFibGUgdG8gc2VuZCBpdHMgb3duIGFsZXJ0cyB0b3dhcmQgYW4gTEJS IHdoaWxlDQp8ICAgIGNvbnRpbnVpbmcgdG8gZm9yd2FyZCB0cmFmZmljIG9uIGJlaGFsZiBvZiBv dGhlciBkZXZpY2VzIHdobyBhcmUgYWxzbw0KfCAgICBleHBlcmllbmNpbmcgYW4gYWxlcnQgY29u ZGl0aW9uLg0KfA0KDQpBbmFseXNpcw0KSW4gMy4xLjEgYW5kIDMuMS4yLCBvdXIgZG9jdW1lbnQg c3BlY2lmaWVzIHRoYXQgc2Vuc29ycyBhbmQgYWN0dWF0b3JzIGFyZSBhbGwgY2FwYWJsZQ0Kb2Yg Zm9yd2FyZGluZyB0cmFmZmljLg0KDQoNCnxJbiB0aGUgZm9sbG93aW5nIHRleHQ6DQp8DQp8ICAg IFJvdXRpbmcgd2l0aGluIHVyYmFuIHNlbnNvciBuZXR3b3JrcyBTSE9VTEQgcmVxdWlyZSB0aGUg VS1MTE4gbm9kZXMNCnwgICAgdG8gZHluYW1pY2FsbHkgY29tcHV0ZSwgc2VsZWN0IGFuZCBpbnN0 YWxsIGRpZmZlcmVudCBwYXRocyB0b3dhcmRzIGENCnwgICAgc2FtZSBkZXN0aW5hdGlvbiwgZGVw ZW5kaW5nIG9uIHRoZSBuYXR1cmUgb2YgdGhlIHRyYWZmaWMuICBGcm9tIHRoaXMNCnwgICAgcGVy c3BlY3RpdmUsIHN1Y2ggbm9kZXMgU0hPVUxEIGluc3BlY3QgdGhlIGNvbnRlbnRzIG9mIHRyYWZm aWMNCnwgICAgcGF5bG9hZCBmb3IgbWFraW5nIHJvdXRpbmcgYW5kIGZvcndhcmRpbmcgZGVjaXNp b25zOiBmb3IgZXhhbXBsZSwgdGhlDQp8ICAgIGFuYWx5c2lzIG9mIHRyYWZmaWMgcGF5bG9hZCBz aG91bGQgZW5jb3VyYWdlIHRoZSBlbmZvcmNlbWVudCBvZg0KfCAgICBmb3J3YXJkaW5nIHBvbGlj aWVzIGJhc2VkIHVwb24gYWdncmVnYXRpb24gY2FwYWJpbGl0aWVzIGZvciB0aGUgc2FrZQ0KfCAg ICBvZiBlZmZpY2llbmN5Lg0KfA0KfElmIGRhdGEgbmVlZHMgdG8gYmUgY29uZmlkZW50aWFsLCBh cyBtZW50aW9uZWQgaW4gdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHNlY3Rpb24sIHRoZW4g dGhlIGRhdGEgd291bGQNCnxoYXZlIHRvIGJlIHByb3RlY3RlZCBob3AgYnkgaG9wLCB3aXRoIGVh Y2ggcm91dGVyL25vZGUgZGVjcnlwdGluZyBhbmQgcmUtZW5jcnlwdGluZyBhcyBpdCBmb3J3YXJk ZWQgdGhlIGRhdGEsDQp8aWYgdGhlIHJvdXRlci9ub2RlIGlzIHRvIGluc3BlY3QgdGhlIGNvbnRl bnRzLiAgSXMgdGhpcyBpbnRlbmRlZD8NCg0KDQpBbmFseXNpcw0KVGhpcyBwYXJhZ3JhcGggaGFz IGdlbmVyYXRlZCBxdWl0ZSBzb21lIGNvbW1lbnRzLg0KSXQgaXMgY2xlYXIgdGhhdA0KLSBUaGVy ZSBhcmUgZW5kIHRvIGVuZCBwcm92aXNpb25pbmcgaXNzdWVzIHRvIGRvaW5nIGRhdGEgYWdncmVn YXRpb24gYXQgaW50ZXJtZWRpYXRlIG5vZGVzDQotIFRoZXJlIGFyZSBsYXllciB2aW9sYXRpb24g aXNzdWVzIHRvIGRvaW5nIGRhdGEgYWdncmVnYXRpb24gYXQgYXQgaW50ZXJtZWRpYXRlIG5vZGVz DQotIFRoZXJlIGFyZSBzZWN1cml0eSBpc3N1ZXMgd2hlbiBkb2luZyBkYXRhIGFnZ3JlZ2F0aW9u IGF0IGludGVybWVkaWF0ZSBub2Rlcw0KDQpGdXJ0aGVyLCBpdCBzZWVtcyBjbGVhciB0aGF0IGRh dGEgYWdncmVnYXRpb24gZnVuY3Rpb25hbGl0eSBjYW4gb25seQ0Kb2NjdXIgcHJvcGVybHkgd2hl biB0aGVyZSBpcyBhIGNvbGxhYm9yYXRpb24gYmV0d2VlbiB0aGUgcm91dGluZw0KZnVuY3Rpb25h bGl0eSwgdGhlIGZvcndhcmRpbmcgZnVuY3Rpb25hbGl0eSwgYW5kIHRoZSBhcHBsaWNhdGlvbi4N ClRoZSByb3V0aW5nIGZ1bmN0aW9uIG11c3QgZmluZCBwYXRocyBjb250YWluaW5nIG5vZGVzIGNh cGFibGUgb2YNCmFnZ3JlZ2F0aW9uIChjb25zaWRlcmluZyB0aGUgYWR2YW50YWdlIG9mIGFnZ3Jl Z2F0aW9uIHZzLiBlLmcuIHN0cmV0Y2gpLA0KdGhlIGZvcndhcmRpbmcgZnVuY3Rpb24gbXVzdCBt YWtlIHRoZSB0cmFmZmljIGF2YWlsYWJsZSB0byBhbg0KYXBwbGljYXRpb24gd2lsbGluZyBhbmQg Y2FwYWJsZSB0byBhZ2dyZWdhdGUsIGFuZCB0aGUgYXBwbGljYXRpb24NCm11c3QgYmUgd2lsbGlu ZyBhbmQgY2FwYWJsZSB0byBhZ2dyZWdhdGUuDQoNClRoZXJlIGhhcyBiZWVuIHNvbWUgZGlzY3Vz c2lvbiBhcyB0byB3aGV0aGVyIG9yIG5vdCB0aGUgY2FwYWJpbGl0eQ0KdG8gZG8gYWdncmVnYXRp b24gaXMgd2FycmFudGVkLCBlc3BlY2lhbGx5IGdpdmVuIHRoZSBhYm92ZSB0cmFkZSBvZmZzLg0K V2UgZG8gYmVsaWV2ZSB0aGF0IGFnZ3JlZ2F0aW9uIGZ1bmN0aW9uYWxpdHkgaXMgdXNlZnVsLCBw YXJ0aWN1bGFybHkNCmluIHZlcnkgbGFyZ2UgVS1MTE4gbmV0d29ya3MgZXhwZXJpZW5jaW5nIGxh cmdlIHNjYWxlIGV2ZW50cywgZS5nLg0Kc2VuZGluZyBhbGFybXMgZHVyaW5nIGEgcG93ZXIgb3V0 YWdlLg0KDQpXZSBwcm9wb3NlIHRoYXQgdGhlIHNlY3VyaXR5IGltcGxpY2F0aW9ucyBhbmQgdGhl IGVuZCB0byBlbmQgaXNzdWVzIHRoZW4NCmJlY29tZSBtb3JlIG9mIGFuIGFwcGxpY2F0aW9uL2Fy Y2hpdGVjdHVyYWwgaXNzdWUtIGlmIHRoZSBvcmlnaW5hdGluZyBhcHBsaWNhdGlvbg0KaXMgb3Jp Z2luYXRpbmcgdHJhZmZpYyBjYXBhYmxlIG9mIGJlaW5nIGFnZ3JlZ2F0ZWQsIHRoZW4gdGhlcmUg bXVzdCBiZQ0Kc29tZSBhcHBsaWNhdGlvbiBwcm9jZWR1cmVzIGluIHBsYWNlIGFsb25nIGludGVy bWVkaWF0ZSBub2RlcyBjYXBhYmxlDQpvZiBwZXJmb3JtaW5nIHRoZSBhZ2dyZWdhdGlvbiBpbiBh IGNvbnRleHQgdGhhdCBtYWtlcyBzZW5zZSBlbmQtdG8tZW5kLg0KU2ltaWxhcmx5LCB0aGUgZmFj dCB0aGF0IHRoZSBvcmlnaW5hdGluZyBub2RlIHNlbnQgdGhlIHRyYWZmaWMgaW4gYSB3YXkNCnRo YXQgYWxsb3dzIGFnZ3JlZ2F0aW9uIGltcGxpZXMgdGhhdCBzb21lIGFwcGxpY2F0aW9uIGxldmVs IHNlY3VyaXR5DQphZ3JlZW1lbnQgKHNob3VsZCkgYmUgaW4gcGxhY2UuICBGb3IgZXhhbXBsZSwg c3VjaCBkYXRhIG1heSBiZQ0Kc2VudCB1c2luZyBhIG5ldHdvcmsgd2lkZSBgYWdncmVnYXRpb24g a2V5JyBvciBzdWNoLiAgTGF5ZXIgdmlvbGF0aW9ucw0KYXJlIHRoZW4gd2lsbGluZ2x5IGluY3Vy cmVkIGJ5IHRoZSBhcHBsaWNhdGlvbiwgZm9yIHRoZSBwcmVzdW1lZA0KYmVuZWZpdCBvZiBhZ2dy ZWdhdGlvbiBvbiB0aGUgbmV0d29yayBhcyBhIHdob2xlLg0KDQpTbyBzdHJpY3RseSBzcGVha2lu ZywgaW4gb3JkZXIgdG8gc3VwcG9ydCBkYXRhIGFnZ3JlZ2F0aW9uLCBpdCBpcyB0aGUNCnJvdXRp bmcgZnVuY2lvbmFsaXR5J3Mgam9iIHRvIGlkZW50aWZ5IHJvdXRlcyBjb250YWluaW5nIGludGVy bWVkaWF0ZQ0Kbm9kZXMgd2hpY2ggaGF2ZSBpZGVudGlmaWVkIHRoZW1zZWx2ZXMgYXMgY2FwYWJs ZSBvZiBzdXBwb3J0aW5nDQphZ2dyZWdhdGlvbi4NCg0KSXQgZG9lcyBub3QgbmVjZXNzYXJpbHkg Zm9sbG93IHRoYXQgdGhlIGRhdGEgYWdncmVnYXRpb24gbWVjaGFuaXNtDQpyZXF1aXJlcyBleHBs aWNpdGx5IGluc3BlY3RpbmcgdGhlIGNvbnRlbnRzIG9mIHRoZSB0cmFmZmljIHBheWxvYWQsDQpl LmcuIHBlcmhhcHMgc3BlY2lhbCBhbnljYXN0IGRlc3RpbmF0aW9ucyBjYW4gYmUgdXNlZCB0byBp ZGVudGlmeQ0KdHJhZmZpYyB0aGF0IGNhbiBiZSByZWNlaXZlZCBhbmQgYWdncmVnYXRlZCBieSBp bnRlcm1lZGlhdGUgbm9kZXMsDQpwZXJoYXBzIGFnZ3JlZ2F0aW9uLWNhcGFibGUgdHJhZmZpYyBm bG93cyBjYW4gaWRlbnRpZnkgdGhlbXNlbHZlcw0KdmlhLCBlLmcuIGZsb3cgbGFiZWwuICBBbmQg cGVyaGFwcyB0aGUgbmV4dCBoZWFkZXJzIGFyZSBpbnNwZWN0ZWQNCmFzIHdlbGwsIGUuZy4gbG9v a2luZyBmb3IgZGVzdGluYXRpb24gcG9ydHMsIGV0YywgYWx0aG91Z2ggdGhpcyBub3cNCmNsZWFy bHkgZ2V0cyBpbnRvIHRoZSByZWFsbSBvZiBwYXlsb2FkIGluc3BlY3Rpb24uIERpZmZzZXJ2IG1h eWJlDQphbm90aGVyIHBvc3NpYmlsaXR5Lg0KDQpTbywgdG8gYWRkcmVzcyB5b3VyIHF1ZXN0aW9u LCB5ZXMsIGl0IGlzIGludGVuZGVkIHRoYXQsIGlmIGFnZ3JlZ2F0aW9uIGlzIHBlcmZvcm1lZA0K aW4gdGhlIG5ldHdvcmssIGFuZCBpZiBkYXRhIG5lZWRzIHRvIGJlIGNvbmZpZGVudGlhbCwgYXMg bWVudGlvbmVkIGluIHRoZSBzZWN1cml0eQ0KY29uc2lkZXJhdGlvbnMgc2VjdGlvbiwgdGhlbiB0 aGUgZGF0YSB3b3VsZCBoYXZlIHRvIGJlIHByb3RlY3RlZCBob3AgYnkgaG9wLCB3aXRoDQplYWNo IHJvdXRlciBkZWNyeXB0aW5nIGFuZCByZS1lbmNyeXB0aW5nIGFzIGl0IGZvcndhcmRzIHRoZSBk YXRhLCBpZiB0aGUgcm91dGVyIGlzDQp0byBpbnNwZWN0IHRoZSBjb250ZW50cy4NCg0KQWN0aW9u IHRha2VuDQpUaGUgcHJvcG9zZWQgdGV4dCBub3cgcmVhZHM6DQogICBSb3V0aW5nIHdpdGhpbiB1 cmJhbiBzZW5zb3IgbmV0d29ya3MgU0hPVUxEIHJlcXVpcmUgdGhlIFUtTExOIG5vZGVzDQogICB0 byBkeW5hbWljYWxseSBjb21wdXRlLCBzZWxlY3QgYW5kIGluc3RhbGwgZGlmZmVyZW50IHBhdGhz IHRvd2FyZHMgYQ0KICAgc2FtZSBkZXN0aW5hdGlvbiwgZGVwZW5kaW5nIG9uIHRoZSBuYXR1cmUg b2YgdGhlIHRyYWZmaWMuICBTdWNoDQogICBmdW5jdGlvbmFsaXR5IGluIHN1cHBvcnQgb2YsIGZv ciBleGFtcGxlLCBkYXRhIGFnZ3JlZ2F0aW9uLCBtYXkgaW1wbHkNCiAgIGNvbGxhYm9yYXRpb24g YmV0d2VlbiB0aGUgcm91dGluZyBmdW5jdGlvbiwgdGhlIGZvcndhcmRpbmcgZnVuY3Rpb24sDQog ICBhbmQgdGhlIGFwcGxpY2F0aW9uLiAgRnJvbSB0aGlzIHBlcnNwZWN0aXZlLCBzdWNoIG5vZGVz IE1BWSwgZm9yDQogICBleGFtcGxlLCBpZGVudGlmeSBhbnljYXN0IGVuZHBvaW50cywgaWRlbnRp ZnkgdHJhZmZpYyBmbG93cywgb3INCiAgIGluc3BlY3QgdGhlIGNvbnRlbnRzIG9mIHRyYWZmaWMg cGF5bG9hZCB0byBpbmZvcm0gcm91dGluZyBhbmQNCiAgIGZvcndhcmRpbmcgZGVjaXNpb25zLg0K ------_=_NextPart_001_01C9621C.E9A3EE39 Content-Type: application/octet-stream; name="DIFF_draft-ietf-roll-urban-routing-reqs_02_03.pdf" Content-Transfer-Encoding: base64 Content-Description: DIFF_draft-ietf-roll-urban-routing-reqs_02_03.pdf Content-Disposition: attachment; filename="DIFF_draft-ietf-roll-urban-routing-reqs_02_03.pdf" JVBERi0xLjIKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nM1aW2/byBVGZjgMKQqSJVGSRVkM5SQO7bUl3i+7aQsUWBQo+tKFgT5Efdp2 e8HGwOb/P/TMhZxDWV5ns9KicZBI5gzP/fKdmZ+CaBMHEf9R/3//sfdTLy2iIMmq4KP4VNZJFPzY y/Mq63zmK37s/bv3t+ChJ14RfPcn9eHTv+Atsfys/vv+Y/DH+x6QSaq4yoP773vb76qg3hTB/Q89 STsOsjjZpEmQVMH9x17oOTYzl+zCWLHZdOqz6eLVYvbKnLEXAVtfvr6+/y+8L8rrOIkr/sK7tKg3 sDcK7v/RC9/0+29fXV31B4OhO7eN/u5hPnDolbN7WFn27mH3wPd/e9/7K/z81MvqAoSLMpCZf8wT LluegYjoo1jwy0VOoywtlcjwqMIS5/kmCcqihH9B5A/hC0INZr7kHDrX0SZPsjpKwj76VQZvy6tw 98lkg6Hz7J/reFPFsP5s5IzZxCUmvCKp6jouw6kzm8O3qCjjtCrD0fXf7/8MImyStAYe/9K7v/kQ ntuUmDahgnCa13m4GJvekj5P+CAzyabMk6IOL1arC0GuoWHPyVxIV0TAbuhTjw58zmqWFPD9lXNu L5kZeNRituc+L+5q5PQ9SsnaJvCWNM+iKDssMOdgdjm0TMLppRk8K4GeeCbcI24MHf8aQ8dRzH2z TItNVklbvx6alstlTNOsCJ03b+FzHCc1yDvF5P8D5CAw+GYIO9DQpqzLoNiAmbIs+PTP3g83R/LG OCs3aYGYDJ02SniOyKO4ztOWkP7+ufSSPXp5wglhpfAA4Hooywgcn5mmMFgWVeA1L7VWjiRvnW5A hZi+8+bq6p1m4LnYSrOqqsKL89W53rPYhd7uWnyPqroCtzt/cXP+mrt3Uic1CPL6q5vZrRDmDjwR nDy4g7irqijmqevDz1N9NsKyQgWAxYP3l8X7l1OWxKsiL8LZS8/R6rhd+5QEfhtsv+b1RVUV4Xjk 3HkmnRBXBmz9dGB/MaG8KPI03JievSXScHVUJuGKuGTLApmHkypNwptoLKh9sVjX746ZZtIs3tRJ UFTZpsikR8dbynbXwhGEssDDUUyhTAN7oX7C3iKHspwX6Sau65PkGVH1ijLbZDLJfKHmTpmaUsgJ lebxQ2gZtgEV2Ohr27Pdp8Ep0xMonucGpChITgkX+y7N0g00I3dJDCUDrNSmDe6rSZHXaZiau2vP dnQR7d++8J223tywAd3rKW5INoA6GBCbioV5BemrDi3b0clsFzIDBXfODGI6Osd49hw9hcW+v0aP VXvj76eexy5w3LCIs0RoUmpN2HPO25hWGwuL0CVK4SZzXfR1IHQpVmd1lfPnUns6NSxMkvloy9Ub VMOzBAodkM94wxtXNTfo6QIr5c3CwcA6bTVXSm7IfwiH/bPRuNXxxDXGI62hSX86m6GvpO+cUa1i eEzGLp1rDU/6xvkCbfCWxw44qb44hjojBbgVfaijG0O2FO6dRAAIQjqxUECdkYAJhhIIKFHKpV8f 15NLsFMOQQOwp8EMd2vJU5xGZegPdteBRekeguiyirp61RrLrl5rf+oQbztx9C+8AZ0wE5VCkwyh ZW5TRUPGo3iTvdYmKqN8IzlPOetpWopq04mCLzZaXkUbwG2yhXNUvorTIvSGQ9faQj/mEsTn0API QZE0UrS4qNMyDRn0FlLULIakF57nNzKv5lUabl3PCny8dYnSozGxlNrk1glBDxWRJOF2mhCtmjzn EiQVxE0agftUp0sOeRG1vf2J80Hrqi3JDwD83AWTDpIkCeC8sdGnxlg4Yg4d18QSKePYfT4AbIBO mBHH8lHpPj7cqyo+yUDa9gzPJK2+4XkqrAEJM8mLo4WBKDCPo2DiFcTRaod2kNg6HTR+KZKaYbmu fgQrUWDMLX/rMp/wpJxB31FxUKFKvowOiHhU/5tsyR1eR4ZsBVRkiGeKARklfhMzsoW45g038feC JY+5uGkuas2xlJfWHP0eyCHcdDLio6J6QkNSe4c0tMd6JrA8AJXkRE2AQrVanFOjeGhTwYWx+hbE 2T2447ExZGKoU9RxHY6nTKe/VxfBsaM8qQRuwVa0bD1TOXqMp1GxiSqsZ2+7ZeacY8ZW4bCI53Nl 9Tzer3hHQgp5yadLv5nJ04I7L1b1iMxmTFd+e0pH0/7u4YzaxrHtnGWZyK3Y0IZFJ2hqc2xTZ2XO gQMmeUu2fBjZoupS04TVEVePtPkpB3Yyb0Hj8JuM60CQlINNRHC8MgQezQUMTfbmWIwxnUXX/eml u3CndHH08g4ouITIj8u2+HX69LuLXH9xOtSPnwwhMsoE8/L6jc5B7IwOmfbTt1fvjp4E45QPgLAu qneagZGaOuYV5/LR+EBbqwMReGcmEUKDhepQlUQlCT60UJBizraDdpSgSkCnV6adQt8QdHTlnMEL LZsQUyDtw9NKzfHK81+iHmfDzC3R0/X6fLbatG3K11PHkowp6iCN52P40x1kdBcbneMYMQraPfDj GF83/iPJmtT6C0ab9ou/naMkPKLUMmjkIToN9VYENgIP91ee6zPdiUDvQU1rdz2gGOocYPaQZTxf t2MH4OFhdqVLtOyO9uHvow2/0KvEjEZKH2dZepDxwnOtOUJcS4VSZTvqoCY/8C6tYICHt7g/9a1L RDlgNp08GlM9kkd7SVnke8bpts6D4RwwJ5pmTB1A0K63Fb9rD6gwRGS7a5+5hDYnY0Lc3fUaI8o9 pHrQshRtaBD5I0moFRAtifTeRnHnFAli+SizWjbga5MNTcuTTldkRQ2LKEM0B/6hON+fPSAfQK5o kiUxCW+oDnIdAFmg7aKk0QEzig/J+dZqopBHC2guQBCoVaREJxCiNh5kdMDiNzym0FM1IBUMgzYg aonvay8bffNsXKzaVMi170IgI9ZwKdsOTFNNLtTQ9nl9bj37gFsKbqFhBVaVg0n9qdT0c14/oXSo uX31/r1hGFrNo+4odcRMMSZVArzvPn3/O2uOVLvwwOep6W1FVlEcjeglbTl+Psd8ti47Z9tCl+ps W8fT7cSby3m30OTYMqHrY6ZF1Hw84edR/1/69QXLOmeOJjRw24T4OeprJoWijD6RsVFS7sJhIo7S 8XjslBAMShzv/NI0aY+79Km6iE15rH7gtAu28hYJmOao8ZRNelLnfPqkmTw1OIvELBQr5Tc9VVdn kJj+3qn66LQ9uEBFaRxDCyTJX03Xu7DvzldjOY4AC+cQqNOxq9Ap74OTKG0CooNb9GZUZG7sr5jp eW+QUvlIg7VxcNEnC0FNFZRu4w+wCX1bG/0FwCKmS4Y7NOjYHblqflIWUZmFZwumiyoHXiqPVNxx D3E+nNpk9wBvYprzMzJeTfuLJqPdyvUyPO8khFdcCZEFSbGybyyM/qUx1HXm9lnV7U17D/EjF6jk tSDOxrDlY5mR8czorXIh2fn8DKzqalfbRSQEYRj9dbtACoiM+dnsWbW+a4Es/6Vqs2NjdsaPq5Bo De9CtD0urEYVurPu0LhZjcdrXQPAp8acb1EHpOG6h2m30/5cE0tn4Nh0YegsPHHpaKqXf8VcqhVr jEZK6/I2BXqkVCmLx/BsbCAZpqPDvK+JA/RBG/JFeZrAX1jNdA0bt47BY6X1C+Rb2C/fzYyzhaQs pekbl66RtQwDk+qxjLXhM8q1z/oGn1ftQm2sl+wMeyK8chciDo2F3XcdA1l3F05JH2ljL1y6HgnB M+679rh1GnmynrnjFX6FsViDIQ4z3XiTOOV7Wn8qbm5PcjQaV8mmkoOf102jxkvZ57dj6jhOTc5U 7Cz8IdlaS2uL2iQTXU9QPmHuXU8o0rICay+b0wOhaXTrQTrD8xcWnu3H0DUGgXPbWwxNT+TU6WIH y16gCwBfO10sq05LO2Cuc7NCH9EKZ2ignJZ/D5R192JSNvHMw3hpOaADk7SCTB1gyd+7BdKdfICF B56+KCL5ttlcdsBKiboFFKx3WmCJcdsWGsw6Z8z0kakxfFIXLQ4yT+zCMpm9fz3FxxjPw+hUoT8F VQOAZvIUTBXZrtKGhA1domX6vY+17VpF640CUzF7bnEvxqffGLgaxHUPi9GsEoHcAmWBZpltUenN 0q+2LIBwae6gNQMdi+KDecve8tkV585dY7VQ09rSlmGkPAmXFVJ3PQM57egwyxDDPjoAW1rEVSMX cbFIu4NEBF3HB0QAoKlzvbcxDFdUAMwP5Abl550DRZMMmYlP6uXVQlkYDGuO52q7By8YUOSXbHlY nrlHPZ2TIAoGzV0Hnk47PqSSDkZwyl+lw/mBZ2LEGBCq5pWtn00dw/PV6EHyNbf8IfM9F615Yr4B b2Mmc9nuAbKmK8wGXPFj1yFz3QH3QKlX0dLuha7rEsCG604K5drci2aUk/3rFtV2s81q8uQE5g+A h+kaT2C6d2Ra1xG+se8rFoqZZzwFoiEY2JxTgtC3AdZxAWRL51etsjhsFgaN6zQLnSfml6DVQh2E C8fuZgTXCizFjQxH05tbDPFueqBIbNeu/vfe5pndxfYg4NcydWZEw0ihJe3YT/GvnBMn0y7R7uhN UVCOO7Boey3m6aILSZOyLXN9bZPOaHvVoQdcW7sH+6BMPMh0V8J//gcEYUBNZW5kc3RyZWFtCmVu ZG9iago2IDAgb2JqCjM0NTQKZW5kb2JqCjE1IDAgb2JqCjw8L0xlbmd0aCAxNiAwIFIvRmlsdGVy IC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nO1c3W/byBGHl94NKQZUbNOWTdkMdbIdWnbF76+kLu6u DQoU93IHA32o+pT2WhQXAfH//9DZD5JLirKcxPJZSeIAkrnL3ZnfzszOzuz4g+NPA8enP+Lz3fve h16U+k4Y58579i0rQt/5rZckedz4Tnv81vtv7+/OvMeGcH75q/hy+x8YJeDfxce7986PNz2YJsyD PHFu3vW8X3KnmKbOza89PnfgxEE4jUInzJ2b9z3X0jVMhvh4+wQf7O/beP/o5dHBS3KAtxw8+m58 cfM/GM9PiiAMcjrgH6K0mMK7vnPzr557+vz52cvz8+eG0TcH2vbz2Xxg6Mq5PpufqNpsPpvT99/e 9H6Gnw+9uEiBOT8GnunXJKS8JTGwKH1lHT6e5ciPo0ywDE25zHGSTEMny8NpklKe/+Hqun4BKGV+ EKVun2AFe9i06bM4zeM4cbdV06S/hlEUp+7sArH+oQ8Uuo6lauaIPojirHBVp295Chqwt4OgyDPo P+L9Qz9zlT32chgmeeSaqqOKvlES+37sEmRjg3hIzJ4WQeHiYeP1i3/e/A24BmIKYOun3s2kxYGG B8hm1MZhGLp64SAHkxF9UgRxHLn7OjAJc9h0UeiLSRgXfuj28TYi/MUiT6Db7MJSFMReZczt60jx +ER5kbs7r3VLG/CZMx8GKKlbIKlvEUX1DNMiqqJy5jIAIA0r5hiWAhwxGjaUAcaEIeGHeRS6BgGK NIZfHAAJrtXvm6pnKSpmT5M8zPPUtT2kwUzYrtdgh1MTAAKJO7ZrQG3D26un3O8mf8ipgE5ZmoCO 1ENtqwSZgKS03BOguwQ2SpIkcoMUEb3GdebibYlNhjprzosiyNwmpNDZtkdSs4aUbUye2TUqejEJ ZtCxful1Nxs2No0SKkGsgiX4S8FOiyiLXMNGQ8OUpaa5PKWi1IQU9msdG7P5niLRW85AwS4n4OKD NERm81G9mkdoOFQ9FWkKGzMvgOYlK2J7lmnNLkxUgbzfkkXLULCGHWzYtR5zKfBTGDst3JM91ZaW ZYA9w4G5ZdWzVEfuInjh5Nt95KnDkaS8smDYSJFFedjNBkGxARJUTZvkMHIBj4cm8pSWegL8Nloq KEODQAcikRMdUanYajBgqSYmaNBNjbdnEWq8iGqDtlLc4DnYX3eH9Q8BltwPSpszadGeRlkOVM2A rtncsGbzJbbgpJIiqkzP0EhiAiR7YFeGVn/zIro6qVvf7PMnEkNbwUm9IrR9cvB9dDg52K1hoE+v fhgLDRHvSQ8lc9IarbK0IN+dlhaGCKKZu8tGCNOgHJc9ZOMWhZ+F5bhcrziVx8GLFwdbu4xQsb6M vfGPlba8YSJd/aq/CZKTw2BrzPgomdNVTd4dVLsb9FK4JdW3iKzNQrQ5ic0dTtVAJPoEiZ1KGFlL MqKw33hEhbcGku7IhE2mxzWw+un19at6Zv3PjdZm4186Re+EqT4H2E/zchPhrB5joBdkshuI68ZO cKgpBA8Mj1pFxhrtou9IPRa+l9bj/g1f8tu8JQsiEKjLlZ7JaQP8E0QcVcMm5puA0AJ9g9F4Wiux AP9ZA37qlaQq2pZMgtAjbgQiydlitq30W7jvmlRuC7edC47K1qKj8ruC8lYGRRd7CHWQz3aum47B saVhDdxKk1sz5joIbtgTOFskuXtg8r2vNsb6lyI/LahYGxwAgihjYLXgukKajYl9IQ4J+tPndUNw Pm3iPPYUw1I40nHq5zDc3cZyQxF6OHyzu/E9a+JLD27omxx/Ps6yaW3J8AnuVxu+sKPf3K1PAz1f DnpbsEVQiW1efKcHJ9lWiKXy/at0vTYAgUfB77KJ3wzOMs94B3osnSBThQOIaqrKqA3ehuLyuahS JFlcNygjtMHnRGjjIJ9moZMEKQ1N07h0XkWOoS2b0rY8nMbwMQ2KInSgYwF+mnP7796vkweKE8dh NM1jmQrgtCSDhu8TPyiSqJqp/v2+E4atCaN46ufyhKfyfA8V+k78ZApQLYa+LxvnA8n/5wFAFk3i 3dnZfNwOvtIxrhZjr5t8opMNRrgkHiTbjsu2c7yL+iYelaEXYSsaQe+tOlxPI1MLbsfTBuhpWo64 oIJONShsG464yAJmP9ZuOGoiHsdu1PMZ6zAbcR4Ls9Qh9e2jim1jT22Zhma8ele1rboXPE/jtMgi 94+0od9HFrE07rKIhirIR6OEXUqzWoNf3UuDF7yn2Zxmrpj3xF3WF8iyDR76ZuxFsQ9PJ6iPCQva t2zf5ujj9fkyp+iy7RR9byCiioDvV4zK25bgm4go0p55L+431Hh/JqjX3UHKt80YMbFoTpA+4Wm+ hGWkqb34dkj/dJCzBsjtTJ7IQi6LBq/0Bu1a+z/iSLl2LM6WaXG2ENHk2eX2Ce/pr/dTxbflHiSw uTtI4fkDEWCvIhKNLGN5meKiyqVu2t5xByotR+PK6NPNQtpRG+eEcXWhQa9lsulTjU0VcR3lKRjA dKiC90KsKsHJNPshd6Dry+UMXn4Ugz8AqXvSVapdsEmtq1SH2hATp/YruZGZmnhbdgYfdP2Wpo2y 9t6/gr0XhqmAgbSVmp19fayNxCMh3u1rLIdOn+eZKqbFnYzmlZLyXy0Zs1uCjX5zvg3Tnd9Vb+9Y 96y57oupwd2RZjmqx3cPYd++rjD39dKUQLaTt6OrloI0r7pkuMnhoqcD+UXl6+UNX+8KeQYBwZSM Kt151QEile8mDtxfl7V48EBUNE0d2J+mBbtl7MLy1JGoiDaF+TSHIUMagVpnHEoiYs1xKOCoaDA9 ux2vIxQVRT4NeC1GsMPm7a7x1phbHpq26RBz2Ja/HceF9QhX3t561bxE7T3T8LaJBrN5dQ9G3Ole kQrbUIQeBN/F+4jnjVcmaIgI7IZIurX8FWcWn6RN91kFDTXpr1omPQiodXoMk17R8DgWvZpudruW lGRYsLRNV26BKUi5pNc7+hY/AKb8NgPXkJbWsOvHX/5lhvWId70Ui/Lt++k0fgz5loh4FAGX5luX hOcZZWylhJ/u6FWQg8s4T54tF/EnKJift1Muy9LVm+bYUPb4PUgRNfmTPh4MCLJtJN872ABmv0D7 kWVirzg9b5qPMCuWb4+frlhpNo26CjkPNQWZtIzK4Be5RewzIbiPSOMALCJu/F77Me6PiFoWsQlN u1IspfJyl24w616w09N6yZKEsl6EcISM0pya5XWa4wrjRzLH9Xyz27VcZgjjFMwLl5o7SoI6ao9a tWxVCSG15B1VVgNEa+5YJ57AlEpWL6pg7REvJuSJTvEmkepIRQHFknJB2C5WHt7k/B0tmWoVodbV HDy7t7QIlTdLtR1l7UNRlhvWr71u3ic7aqcMDVuqhfYsmxcGl6W92pIqxfLWiMgTcQDJQtFtWZ4q I9pdsVhXd/Py3LL4rVnZVg/TWZLWIPEKlRVlZdLqVB+goaohSRAUqfyJLybLePGyW71+V9TR8Xsv JT2t0tBF7He6wVuk7IwWg6fqAMk1zJao3WOJCywXCvG6A7kkfXFdrc5U8L0putQr1OUifEs2jEMk lSIpo35ZrSOkUUiWoKcWLZ4Wq8u5/Rq7ZfSv8kXQd8iB7sNRtSRcKQddF/8Aalq56DSxllWNILMU 7VLpG6LN2FNt2+DXnzhDtURmRXZPiXzbjbIiX7hgkw1pdk1CT9mzFEld7tIeaWEEM53Qr8R4QaBC +P9JepjpA9X2DNtuMt0obO8AfInlaHJTVuZLa+thp09U9ncWVlpo+pcIpL3Ea+XDOc8DlKrlX4fg uSa5zFYuQJfEmmsJ0lKVYM0R5fVZ6mex27xs0yowl7nuVl7HKqu3aS13s2yYmg0TVq7Wizsq3geI wHFHFvshwY4kV7gsbi+L3xvbqODmqPaP6M//Aa1ikq5lbmRzdHJlYW0KZW5kb2JqCjE2IDAgb2Jq CjI5MTYKZW5kb2JqCjE5IDAgb2JqCjw8L0xlbmd0aCAyMCAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nLVZ3W/byBGHl1xmKQqUJZFmRMX0Ks7l6MQRv7/ukBbt3TVt0ZceDPSh7FOu 16K4CMj9/w+d5S65S5m2fOjVNmCRuzvf85uZ1Wca7xMas1/x/+On2edZVsY0zWv6qftUNWlMf5oV RZ2PPrMdP83+PfsbPcw6EvT7D+LDz/8CKgn/LP59/ER/fzcDNmmd1AW9+ziLvq9psy/p3Y8zzjuh eZLus5SmNb37NAt9y8TGFr/QL/GF6wbY3VxtLq6MC3xG8e7l9c3df4BeXDRJmtSM4LusbPZwNqZ3 P8zCV/P5F1evX89te+F4pj5vD55taa+t9nBJzPbQHtj57+5mf4Xfz7O8KUG5OAed2cciZboVOaio fOw2/HKVszjPKqEyLNWqxkWxT2lVp/uiZDr/PbQs6wasVMVJVobBAkVkSyL2Kk+Spq5CA+U2MRBF phaw10VdN3UTejiyu3dsZxnXSRFa3zzfrJYEaVt4l6ZFnYUbAzuOfFpjitQ1W2OWgTdZXjXwAuVB J0sVx2n47c0/7v4MGu7TrAEV/jK7e3MkrcpPHOoZ9o/E9GxGM82yvByxTJsmrtJpptOcqG9oOIoI k7coiuwes/bGJo7Xq1TkcZyf1nLZcUzBinWcTKp5iyKNYFPKbNXWwsAl8VCgOMo3uzNpDKET4hIZ JUG6Jd2Dt3w9jcGpQihLChqgyDaItlNORNgMgInhM/YdKxAIQhJInfRNtmnDNjyzOneXRZOFhC6c Low4OUlt0gKvlpxakjYgySUyKDGxg9vDbtpDl2vEn6qqLEJN2c+Dlu2xA+RZQzAQ1V7amgR8KW/q Yohuxbx8HbhB+HPLBFq/oyrjKg91oq0VGr7pnbQSMSNsLDBYGKnJpa19TQoKbo4M0t5w4fOybJIG TkrrWH+4vKdvWtdSRebyNsS6NSTfAuvI6B7zBDQKr01PLsLWIHjAzmdI07HxLBiS4DdWt7EDtqSH qOR/gSiA131VUtBz36QcpLr8K/0gQLah5u44/1SvMyOkeSMzjAuYJhVUgLJK6n1Ok6KuAA3LPbgn z+nP/5z9+OZXgtm0ZuGs6BBaA/yz4ldA6BfZwEg+P5Vfesyv2I9NVgRrcuvoq+Xg1vXcvbiQTytW ohzNvXC9NpTmKm+luX4dW+RpvW/GwnURFYMbMsisyyH3kibLj3KXyfIuqzIWEe8gleoOI34AGkNC srBELyEZPSQzLo/TBzKOp0SSQU7IrO/y7H7S+5xH2YAE4RaiDeuBjL+rAbiqpprkdm3uIj/QlCMq ql17noGCoAdi4QCfp6II6jcTSB2tAUetvqBssaHshyfdN7wjmgs/eoZ4/RZENKzAma89YDf+IyuC g0AbDhtpyWqKiSRs9AVGACqSD9bXJvJBVa2X+WuLmODnrR8J3ONibg1MVQRVbNUeoGYt5Jpr+YGK UMeSHoMmJHgxhvw3+xfy4e2rL98PiljfiDVuHbHWF2zLV7Gyp8Ig9v13byu5caAysfaEqn9ta9jE FNuBlP9K5E0e12UTvkFbZARDHAiPDuZXgsJvb4jT1/Y4rbN01A2odp7oDKDXgL4HO0peaPiB0nbs Bui/0IJlpqk5HfsyB/GqcGubXVOj0GTlE5grjHnr2UsjCp9v7qT1Wdobpq+KRsytYyMzQo9Fh0gZ bqv2YBPPZyf6mjbqPZ6bkWOPW60AOWrPCd3AlgAV3ihxLcsGEGOcyuKU6H6x0R58k3zozjwma+Qv hP8IYrFQZCn83e+auvD58v9XYiogUYCzi6wEROQ4TtwKY9zBW1zWIdE15/wCS7hzl1jiZ6XPXzqm Llef4XOsxLN5cb7ZdIfrpkmq/jBPwvPV6tysFdKry/MVlngA6zoUjFVHQLhp5SoEzHO00Xk5SQrw M2gyrie4/5Gmn+sbF81NXaGpN5dAaOW4Gpa4JRh1ybS61LH0+UJfzZ32oGsrLEN4rJhqAs1d6IpS 7lzZqOmr3J3X0gK/eqHuZsMizgf3jgDp+e250mG3N6y/HfS8GmcMDF2aQXxHQpdr3UYEUKCfLieL 3TnySCSymcPUEZvlCAAvx037qEP31Y0Gag99lp3GrFEdM3yPdMAKmuV51k3ImmFTFbjWyOBlkMet wxvtPgKGTpuv2qZDImSKUUSYwUMlEaVQYB/1d4+BQntAJgxmjrNTyhtUO0VyNu1IMVzraDyZGPUH IFTeHZdkU7XxYgG6ADg5j4Ktg4VPRdPwBJP6NtQCNo1KKqcrphg55YtxucwMFkwK334iEhYqBkfx 5XFo8plI8aPJB6G++i6nx6V5G16fyay5subEQA40farZw8FAnPO1gXzZlp4NjETeS1ZfjApVos78 nPQolJ9uAK7hPZWH2U/yfz/OyBe+ic0hhXlUilM8qfOsqMMLfg8QTJvseuQ0eY0gpCRqS25DZ2EE GsaeMoeLRojvGHLiuNExpVgi5SJMF1jk5dh+AoDXBlLz/BnaKXKhXqmBnnt6GFmi5ckZ4v3IyQFA BzaCPuzcaRuOb0/8SLN9jZ8SirlWfz1x7+w4qFg/iCS/B8JcX5OIg0vXB4Alqc3iQOvsJToWXYS+ s5OlcDmKpbGqt0LVSY5sUfaprGkzsWjSRHRTmFVsDsx8g+p9nXhIgTVoxShvPYVv1fZ4sd4FQ0xz 83m+5g+tnAvDDGsRjxrV9sZ+aKySaphYU4qqQyjReABykbsmQ4h8dRIAx+brPEAWo1xk91Y2XfRt Kr8WE8oMhSKwo9E9llpWA3YJKtc2FEF0DIqPQae7dTr4gTwNRQhCorvB4bO++0hJ5iGXZBVLLSgQ oIymXOswWoGGBph0LaRFA98/njTWOEWYHtjoLh16V4vbyadZp2OqIbpgt6UQdaqcCzbk83c9Mlhr mxKP6zO8y/70JGuwkeqlojZ0WggcwIv7cBes1i4PEk9OWzw6VSfppOux+mgWduQuO23IMV4ssOPY klcXdQ+bkGmgWpCFCwqkda3mNlGqwSvXOkteDrtd64W66lrJB2wieforsDPyS7WEgZ99J3iSnRu0 bA8j3c6REdnGTlZiYLD43UiCrrcBvCWlCFZ+oftLg/PtGL8pzH/iYorjwhH+TBqU1z9oEZHBglqJ jvulymqY35ApDeVarIeXXvvqoWo2laqY+u0BCiznWoGQZSojQ61CJiYBB2J+D+2gEjmBKoZquNPF ktcMS7rouCr4hnoxwmdrBynNiZoY05dp43CeKFmT7Lk+wP5kTZjs7WWhYEwpZjcC8g7w6LsMVUXq /xYP3+tMdDXsZk7u3mxtTRRNocH4GzzoBoLh6eiaZLpQ0/7CJsvTlA18WleVRJkTrcEjTCC6B6N2 uh6bFCYlRd3A3m6R6oGjAcbB4us/zopdNssxmv3+Fz3a2OdlbmRzdHJlYW0KZW5kb2JqCjIwIDAg b2JqCjI1MzIKZW5kb2JqCjIzIDAgb2JqCjw8L0xlbmd0aCAyNCAwIFIvRmlsdGVyIC9GbGF0ZURl Y29kZT4+CnN0cmVhbQp4nJ1a3Y/bxhFHltr1UjQoX8UzfauYps4f4BnxkaIoijTqFChQ1AjykuCA PpR9ctEWRSzA+f8fOvtB7ixFymlwBkxK5O58/GbmN7P6khb3u7SQf+b/T5+XX5b7ukjLqkk/q6tj WxbpL8vDoamca/nEL8v/LP+WnpZqifTnv5qLX/8Nq+z0tfnv0+f0zw9L2KZsds0hffi0zH9u0va+ Th/+tdR779JqV97vy7Rs0ofPy0wEPmUb+u3iOX16fZ3Q65sXN09fsKf0m5Rub1/ePfwX1isO7a7c NXLBd/u6vYd3i/Thn8vs1ePHr1+8efM4DFdR7C8ed6c4DLw3QXd6zv3u1J3k+395WP4Ef1+WVVuD ckUFOsvLQyl1O1SgIrpUD/z/Ku+Lan80KsNXDdb4cLgv02NT3h9qqfPfsyAI7sBKx2K3rzNGEhqy nMiPqt2ubY5ZTv3EY4L7XgIfHsqqLcrs6u4fDz8sS3ioKXbpw4/Lh7ejlV7K66KuiqZusxWjKfeJ 76l166aqDhm5Fekq0juBvIcm44l6vyxAd/CFvN6V7e6QfZcKpl4tm7bdHbPuV8Zjdb+v2uaQidUq 4rnwOPXlp4d9VcByizXP1+gtqQhPvATpRjdG4qZtMqF02slV22ZSp5x7W3V3PNaH7GbBY6Kl2Fd1 5hNvQdkj+cH+cDjs+8Xrdn/cZ8mgQrWD3bKUeIQpUfbVsc2EH+t9jgVYNwYxGe/uwl6jen9sQIOU +tyjTKJJyXomYEL8hDLpp7JtiyP4KZg0Y7urqj2SwTzNfSSx0DdlWRyzkHV3+t7Y8nd6hEfRtODc z6NQW1Mbj0QkBxvkFh3XEEgisfJdB2A0e/tHypAvFwJUQ/KdqeptVyBfFG01Iut2B06IAaRgesJI jKze3W2nhaY+CSwczP4avWkYebxHd100YH1wZgT4sSrmNF0Jn5PE4tFx1/M1Scg8ZKQxkcW7O2L9 lYuV6O764CqbfQlonFZCxLXwc62wkUKiSGLMiroJ/Vz6UoAGILD84nhom6bJktDEmPF7gpyQEpGE rF/JGNlb90aTSK9CYY1SFUU1K2cPCKGUNmkoIazmOYINJJoaohJr41Ec4zgr5WHi0ZQwa6TrQC8w krk7MeGHkWBz4AXH1Fows2ksPGG1vA4ccIgQtoXYMJsYXVzDxODsvA8fI4abrUCcFKEDslvM5QuJ fcGB0zN/DgD6PWyyNdnaxJaKLRKsx5mOOgy0wYEWhw64dBgoYwlQrSYoM4wAJvFV7KD4ZdfTQtvc 3hZ1MxKR+zV9RFCwC5zXXuZeKDztkKHEpSsqy5P96DqYRrZSi5GUemSIRIPCaUkhl4NrfHAm8rUD h9FqMUlNNTDSQ00mnhXEceoTyggWciKYc+ILxmmCgGSy7YzAE/uDdRKcy5ItZMk0QQmiz77KAbCA 6E5DEGlBVkQ8QqJGVMjsXZaHxuTyuQI4A1sTRKbAmHwwlssEv0nKunyipOjGHPc3TMDGISBEm9WA cMwkYhIBfKHOTmcqn7DutMXFZs1o2J3WNMQgcDc/K7HErzmjfqph2fOuACew71S5H5Dj01jn5p7w TAXntMzjtKcYmrfWjEynAaiYiO30Ua4Mi6NX6V1XdQuhZsJS+ziBVOvxlGAgOkWLkQ1h7ELunrH3 y3PQP5GlcoS/Z453rZBB+/LJs0GI95PM9vXVh6tXTuD1WWROpvMkY72j2RdkBY/RyGL1DAExkWkl Qe4LVxrutub3SppXuK811NYwoOkJjKS2APxJapvw7iT9N0IAE5uNImEGyR8DQ9sxixYMAxkEIMQb QNmnOmlcsxwKwAi2XavGwigwZkBoYZHSEGJhmooZOO72suqcG39FZf8yCOV0GgsyJlIRXSCbunHq hyk8YYMOlztMnIyCyuvj5D3EL4TEPJF3KdgYPuOSN/BnQ5cxfZ8wyGTJI1fd6SrAbw40fFJKxUht FZYi2gyx4N7a3smyL2mUQWZ1rItjBexxtaK6kTD2cgvJdKFFAWGrK2I9l0MyQfh2kevmy7MWDkRb CBaPaJvL9Fz/jrbUTYazpU89myEj/ohEM71GX8gUwPu0abxAuzseYb7j9HEufFPxJ2ggdZZ2m2Dl b58INshzswn7QqjMD9kqsivdQDVLxpqPsuO0LgjK5+RNRAm1sEnCzaaHmFJtw2jqsAjZCw8CAxzx t840QzMXd5phYNgjn89wDWtC2ejlIsEwXxNDwXRcutzZ9Tbkdw9ExO3Oii5ku9mb2FafY3vE1ee1 Y9+3YPtZ/mG+tCjuTpKS2GZXQ18TUiOZgZch9RE1GvaDEyA7QOjwVMjla0BvPJuulGLQrK8S5AuZ DjQulaJgpq/WJNUqcCdtObTDuEX7fn/TZV32jdVislQ5LRS8z/GQIEyccqNIgg6LF1NucWT94PgH 6JRCpvXBZVm/T9DLEd8oomRtOdMEuYwEwBVJHjQqGQMUvw8QMTWdBlhHMWxbA6Z3ej3aKeRRjDD/ 1RmC0sKl16jHm0nYz21kyTSRm7rktqEaCQmRCI1Q+WM4CNT2ptZc7LoTkeJ2CvlJweBjsIZwrdXE wOSj6wAjeW5wiEiDec+pLGwcsYaf6G8tP5FuRPREN/4OsjRHOt9HA37CKRf5yfP1DD05E3iU56YS jlPqTM2yWlwH/IpcBRt+q2HUcy+KWAyCIIP8YwqB0RNP/1YodG9mGh6IFV9vpTWIqB5XWghNZVxk Oae5ka3qBQOoyh8jXYwxetgNVU7F5ajGCX+GEwAh6Z8rSzXhs64L2r409uVa1kZ7+z64OOq3UkNt vM3JCmPKWwsPyWcrnrr1CcGTYKeFA/DO8N1UGJCrWHerizQPzzmQVW3PQwNrtVm+JmI1hu6su2J+ 0cbnDFlOl38nNzf8q69SvbVUFz02FpRFgkcSTltoQhRTYrk7QVp/9SBGNhkIJWeha0amKHeKHLpO Z1iOfShPPRjKP7Np/eII7bdkzWey/vtq9qVFHY+JRlwakjeuSl2m86T5WjEtlFrcpYDyJFv0rXOa o9zwjrIYAegiBWu77N1bQ44lZXwfjCg5hoT0OLn1rLndYgsrjZiWC2xLmJWRZY+EyZszkZfNCn6W +49Q8g9aRYNnOfAWwSiHXsDMNE0FcMwJoOoxZEA12noUf2cHV+9Hrta5Kumtb0SVxXc+OcpuDdVU MxqRI3L5qTndcSaEYpjqDGng/QwlfzUqlXQFlA/Y1bQ0j9c8SnAOTXkU9ZKY1sThtnOlGnnW7Ztq 01f0dPtsqIFhAMSPbh2+xvG4wP8qNUezKp2wGXHOOya7INzlzmUXZyIokoTmXLjTLDtXUJql7gQc QgtPyKg/U3BMfM8EnT1606nEPI07Cdf6eMrlEAO30Oc0TUNfHoziww/Q2VsQ4qMqMCu3gAXXmIBe GJjNjap+K8DmYTL0T2g3DYm5kfgwy9Z6l/DPHVOgUdDU8Tl1iDk6Xk4QI+CowJDbFennoCbAMJl0 cDbWambG2Od/DXmXbn14Y73ww6vAo/bW/a75GNi5ulKG4wydeP2xrq6uo7COBDN9+GQVC32gvtCI gZ3NEXZ7AF6QzQ028pAx4xNt9Msjnq92wX9QiBncbA67MOzOqBKexNrUoGcEyF9rcDmx4wOcruRU BbjgUBv6aU53R28dPJvDj0t5bR36MSMxDnSnQHhrGiZgczxEdIA6jiHBmDnpHM4iJxiMzhV9vNmI PGvHUBrt+5Wvz8NHA+xpD5hOdNxXjcY23Qm0wWcUnql7w8G8TmmTPxoyjpltyHKSuj8REsMQpR80 YHMwfYI41BxpaGZDxR66q1Li4XCPOVDe0PkpAVBXILa+5hjOJPms9L923fL2vJH6FqkvlzC/+vpp +T918+LkZW5kc3RyZWFtCmVuZG9iagoyNCAwIG9iagoyODk5CmVuZG9iagoyNyAwIG9iago8PC9M ZW5ndGggMjggMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJytWt1v28gRR5ba9VI0 yDiiwniVbKg4CSjHZ1IURZFGg6IFDjkUfbmDgT5UfUrRFsXFQO7/f+jsB8lZmYod9JAAoUju7nz+ 5jfDfE2L63VaqD/2389fpl+nm7pIy6pJv+irXVsW6a/T7bapnGv1xq/T/0z/lt5N9RbpL5/sxW// hl3W5tr+8/lL+ufbKRxTNutmm95+nua/NGl7Xae3/5qas9dptS6vN2VaNuntl2kmAp+yBX05eUWf z+eSzs9fnz9/zZ7TJyldvrlY3f4X9iu27bpcN2rDHzZ1ew1ri/T2n9Ps7enpu9fv35+GYRQn/uR0 f5eEgfc+2N+94v7+bn+n1v94O/0Z/nydVm0NyhUV6Kwut6XSbVuBiuhSv/D9Km+KarOzKsOjBmu8 3V6X6W6n1Qad/54FQbACK+2K9abOXs2I+bXb1dvMpwmR6nfZrqtqkwnWPS2KMpvx/d0sXqo7m2rX ZoxIGrJcv1Kt122zy3LqS48J7pMEbm7LqoV184CfkbMgnxER6c2btl3vsplgyQROUNttq6Ko4MWY Tlb/uP0LqHldVgUI/Nfp7eWByClJKVsaKdtiV2bCT/SvcttsQAX9almAPTPuL7jPPSwh8Qnb3w1K GBUGqc7MUWuwwDZ7xhcLwojv6Q3qul232kb6uE3VNtssohPClLu13CPC5jPhc5lqs1qDuGYVteCx 2K9iMkg5D2SYz9AxQsJ1UVdFU7fZa31WCW83xXrURh8dNXzqDzY5Z0oksAHRZ6rX6s2uAdX3K+F5 hC0Hy/40rtRbZ/f7+22bpm3afj9tPIjQbZNNuIe1YmR/F8aCBUMMdLtpk/ZGD1pytr87A6v4sYpC b1hwc0TId7+XkJxhMa1A3xSzD+FN2yD3BEY+CLv1ZpfRKKLMCyE2PJ5rL1TgnpEAzUVN/MOTrNbf ioEPjgFyEYmce7zWUVY3VbXN/sD9JMzVvWC4ic63URAxWnPJdRBVddHAbp0/IiFlt7wom02ZXYqE 00cZ4JqRKiR+vkSHv3gGycYXPBeeOa+u6na3gfMur188G3Lm5hH6/+joL+KJWMreqnrzLp96bVQu kwRFI4lJ7jEOhluamCmbRiU1RMwQIDdn4xH4wjdQtN4Uu8yb4ZzPhbQgsqnqjC70o7rdgKoiQJKN ROd9ISXxpYoO5AUFUsNp88CebiASb9ptMSPxAmFzzBfkiBMH/bhE+oUyFHGMBeU+QmJXfcoSwlCd oYvBUcHH9+iHR7GfPv6IHi2JYHLwwjwAoE4MFmO4Jt6EshNkG6Wbx1NyBLDFG57yTzr+EEwMmKAc 9ii3DMXU2HS/IktqS5VJLG9mTGg1UILJSPjBkGehhAiUclhy1of9rt2NesWt6NFsKSGbYlQBbbm0 rjARTlOxvwNTGSTabdumabIEoEn4uVHCmhOU8CaE+Miermu9GSMEaX1Clg9WdJAhhbyX2nbb7aZj DCqwKUPazwORe6HwzM2+VroaMRqCb2SX6fMgNya1j6EGAML1sdqrZeUBb2e1KoKj0RHrGmJcVpY9 tVmAAYfokKRWB6DgmIV+AsEhkRdszpcl5I7GkwGbPDo8oj5K3BMe0w577DYG47oEeUK9cbmVRBbS i7rJFpzEJhCrsl5vEadR8tu8NnAU8xMS42pgpTOWYkRYmmK87cbCPvvhEv3sAEHpJRA0a/AyRVnr P6NR/56GLqi/qyMOUTWEo5zXVUSG3OvrvDWUioruNZugUNc8mtMYx/dkxh2FUuFDZgyyuQoCv6Qs NbVqVLwFENpgCBcHEm1UGjPbqju45JwsoAxyl3uCNL6pPJasjhXBd2cf3KjYw7kng3svSczBOjyG ojYutQshMazGTQGGAJOurlHuI26X3xiEHApc0xiM6PgrCVHg44yAwx6sTAsag+EPo4J4uAQtkCss QTauOCdv8jjsaY2xPHgDcBJB0fdycGBfJ0YAHUeEMcokSiurb4eiFMXGhDNdBZB1VFPhkxgzlV5A vf+jmPv/IdPTi5e9R4L2KUl4mKKVF3luBdY7v6Q+1Ji4+3mDo/M7KDPkatwTUWOIR/DAd7+XztwH 6NX9YI47iAH8dRWnCrAQgsil9Ej6kGNcsh47CRv6XYuoc1ZX6GLdgtNHhTXIjLLQRkiy9EWqqewQ 1j8FxMt7Rx7hsS4cfDsabcHLBTAXbFYXIqB7IpBfCWI6mj+ZkrQGBVxlEkYjZGJAoA5XjY1dznwH W/sPYoQiKnJG4wRBhIvPyCEMKAbFAb4QcmYC0ZKMrkwhgysjHJScBKp33lHLDlr6ENRb8SOlxHO8 YCx4gHAu63ci6pVj/1AR5XjZLbdjCQshSFwXpSPh9MUx1cS07zHkTCQGdMcVGFiaUmABfaLpaG1Z Ga1lzgZX3CaeITFuSI2EZdqjkjGsHIrIfsWoSKALw9UV8xNfeCFDY6F5cEjn8dsgCmcPRlxO0xT6 /bzvLWzHz1TLPASAoTQEuWGMzxwoJ3rAtQGaG8hFVbinO+PuGZiPtq7rejU96AQwNd/pWdUkMK4P Oi/hL9EOgvHDZFAiqnbfDhb0Iidor+ixLm2YmaHwP+Bz+l4qsBA+xRTAJf39bja8MeeIGBBow8Q6 7qjLiETmxYTeJ2pItV/Rb0wG0axVU3KnhdCVrkuQvs+JIOM4iLlEuBkTk0hINiw5BjE9v0Uabt1S +FzhEELgS+EdsX67fX656jv/m4P+y4U9FStYCLe0ASkXtqH6BqN1Dr8OmcLalOr07EfMBwOG0Euo 0cZWpIREMV2m1ot2GfbZ5nwPTPkJbshFLCn6ORMSHcHTKLa5LB9BSBnCvsMmwqUVdhoLpCGCNlLB kJZ4UxWghmvqWbemH9t0xrXj1YHpG8Kix1cH7bLwlQdGHc2tfbSfX/hJKD3GRTyk1zy40j2KGtkh u7onKHaY61UWm4L2xdXT3vA3wX4FCzC2uuCD49nNWSAZCSp440pcO7bnvhlqrNCsAbcCqr3ocS14 e/Zh/9ufPiFhQHIHQrqPD3ZWLA+kOwIoC5ErrxzNsGOl4n7vZcPWATkAluFYnRo+DmMiah5johJD LbSjKwUEp/dL6T6jyoOjsl4wIuz2qsd9Yogn9vbpPrt4Mgh4E8yoN1j8XEbUw953MRtUBmsMHbjD 9YBPMa6S2oxbbIBD3ui+XLl5vC0XuUdZj73zAKOoBQwPf0hC0KlgC/APlzYn2v9IaCRYwj91+3X5 7CT9IvQ1D+wpmJEcA1LX6N6T3rp8uPEI0OS+mngNTsF8xn7riyIiDicprmoJl+5btgMa2L72kG00 cPxYsmTyAnfwx0aCTvui4hzREy2uO9Rb9gMt8/QACG2Zcagt/mioGpiD544naERjCn2FzquOqYxN Yt02bsMUPpiSqoc6faqaYy+ivoQYiC/hb3aVEx9MTI/wNLSpIWrDJhL5hBEgLdIdHzlDt4jkXOAJ giT7u9RlOdYIxm33yuPhdzJPPuhWwLTKDnZMHNqhjLGHM5OxNLgbDG8bHelOTzMKqKgMHTadaMNR 00J856GUnTvMJk5PeGW6ty7Sg51CV2eIL4f+rkNXLh14w15YkAkudMuom9XbtftViBmrf3S++2YG Odh9ybOSu5Sn2tXFTg89FdFNJeKQbpaHspt4WoHVxyqJiKETFQ4YqRsmL+x/e/h5+j+RDzUHZW5k c3RyZWFtCmVuZG9iagoyOCAwIG9iagoyNzQ4CmVuZG9iagozMSAwIG9iago8PC9MZW5ndGggMzIg MCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJytWtuO48YRhZvq3qa4ID0WZVotL03N 2gNqDQ9FiqLIhR0jF8NAkBcbA+TBypODJAi8Azj//5DqC9nVFDmzDoI14NGIQ9bl1KlT1fw1O9yX 2UH+M///+d3y1+WxOWRV3Wbv1E/nrjpkvyxPp7Z2fpZX/LL81/Kv2eNS3SL78Xvzw3/+CXcp9c/m fz+/y/7wsITHVG3ZnrKHn5fFj23W3TfZwz+W+tllVpfV/bHKqjZ7eLfMReBTtqWfLl7Rj9frlK43 n20+/ox9TD/I6O729f7h33C/w6krq7KVN/zq2HT38LeH7OHvy/zzly+/+Ozu7mUYRnHiL15eHpMw 8O6Cy+Mr7l8eL4/y7797WP4A/35d1l0Dzh1q8Fn+eKqkb6caXEQ/qgt+u8vHQ308G5fhqxZ7fDrd V9n5rNwGn3/Kv7z55iYI9uBYUx/apss/IlFMdxnxPfnbU1V3hyqnW/mhrA5gV/4BTUi6/9vDn5fV 4b5uD2X28Jflw5uf8kDdqDwfymOTf0p9jwm2k7+qy7Jrz7lH0V2otyJMfq66sq6P+QX+faD//nyA R4ooinkhPE79VBrSVm3b5Osgceyrz83hXPf2nQ9t1+a+tE/due268pzzVD+2OpzzmL8gsbLpWJ87 sEj5UcK19aGa9GMFhhBfG9odzlXO1Yey6Y5nsHovvGKlH3c8nU7HnIYe8sIYpi8WOM6XPb21Nrs5 eLWLwPU43tnYrYNV6CeMJOl1QPUtvBUNU+GbC5qmKzt4vPLvyikbou7QtLlgBNl82ROJWJSbdMUh CIl18rLf2ZhCItW11ak95pnww60ovJDp7J5asK3LF9xbqYuOddee8oiR4c83EaOXRyayjCTT1m5D v5A4EDH3uLb7DM9qqnyx4oW+b1015al3RJsCdvnomYzGMTxBXltCwPKNm6neJR1MJ1UpYQ0v1J0B Je2xAvtpwxPtockFZdPGp+FlX6haKDwdwqYG/J9zQLByZwiqxkBZQtBP+YlxyhCI9QcdMbH1CP5O emYdkX4Nl64Dkx3zpU+8BWUvdCbrw6GG3wCmpk3v67U8wp0AFegrSFdkgqkCvwkja/sIzCtdgNXx WDdQPeA0JPJ7VdkqlYcSeC6PViIlyKlM7JDd3C/iMCF93a4DkVHA6LTdilrSAd1wcRzTYnjgFKeJ BGorTVU26ubQghfroItomvLLPsYktuIEaK1YyQK1vPQ2gCS4rOM7tUlmClHnw7LLOkh3frFi1Dch shGS3AeJz7g/uNLUTQfE0rsiM54CHSVhrD3puYN4xXDBzbPU/ckW5X02YYZWNbVFBDonyzTADflE A4R1wTls9SRmIV8YsyM+hyIfWPvYtZMuWJ43cTUP71mboNw7hE59XC7CV1iyt/ldGnyzWdHIsgwT CafIS5/wy+MK2J2tKE0sQtyiOGkC1LHYTGMD8SKC7Yck4QJR3uuiAOAOHU21XRr3H4Puw9ef2ie9 DaBBIP8YxL3nekttHi1ojNuIW4tAq8UMnLeCx4Zyq6pyG37P4qiW4FkAHN3mQLScWs1XjBgyNiYt RDpYaVhLIKqMBbs8YuoAbgi1PDBZc+QB8Qlcv1MRrMu6NAVx5cvLFY9TfJdRn/u2B7dKw2UfskT3 GxX4BY/7SMjmMyBOApxiagDaoXEzJEEHHJKGAg7tYwtayHNKWvi7WdgAb5lK1FcfN2N1hROvu0+f d/RnqjWguDoFDHxKcHVvTThUdNKwwO3e6aYF8Lw1xGl693NNlPupJyTqemvXwd1GhgVqLWSWDru6 OsPjHIxftzxD9ghhboMwovJJ9yGh8+GXmEZxTMMoosxT/fKKklVtWE4+d+dJQns99HzV02boU91s HVjG1OAcgXElGjLOjsnAVtI9GVCckgkxazCMCcxhRMuAGLDPCu0ryna0c0wXuCIES7jSgzvLjEE3 7rnYdpY4mgmUsYVk8F0AkwD6/M2dDclbB6K/pwvSqI5ghEhKs7ne7opsl0TdFqSHGqdmna4ELU9g KC4kSeLWOnweWiQmbDw5aHEzOxgMuevZ4XSs4D+wUErgtPfb7WafYFvduEOhhbE3ojcPGCqG5uYM hyMXpsPVc+blUc2Fkz7Y4Ji4+zt7o6CDSEA8hO/ZaLwNIuGt0tkA9jqQOPYCh0KsEItMSm03YgZF pVIVk9b3vllmno6EDjYAh/hJPww3bV2f+vaiyrRgoN5AqSLDY+6/mKU1AcKWaHYwZAks6xNo3I2s tel429lONf1x/nUPVerf0dxOP70Swk68Xvs4BBMd7qn+NhI2MzODzKVnUeNIF0PgNiWO6SL0qE9B c6SoeaQk3g5XbCgoDuEjDd0cz62EmdOpzN/0pD5t6ETX0/Pks7HFHdCzEAFmNTlSOJ3CupFMwzUF TT1UUn+85CFig8/v7lr77Z/W71WlJoiYEfq9jXIIShZmOg8kdWAZv09S5cyn1+QvLnsuewWKgCMJ n5uRzZroGjTQ6YVplwoXshTMWsEIWnILfdt3CpCDmguJVjPmV+OJGSVPE+h1W9SWj4SWg7OZfQQY GCfofi6heCuB6pWI/vbyk2xoqJbRRmJSJzy/jQt9XofE0UpGm4kegWZ6SmcyIMzd1Kg6MJkeRQqZ c5MeU5VOWbhGhxESN06InxiozfLu2Yn66MdGcJqgk9uCRHqnpd030lVqTrykWgeXPaMiAdHsoQYK YnuhJJDp0bocpKVZv4vUde60MRhmnx2cRdLwFK/6HB0Ssste6KWaVpYp8VMNBEUMpnRGdhG/4Yz6 cmerVrnH+nCaidqXN5+7tfA6TWnB7e6mVUY6tPkRT4W9aj9sRb6WX0QREUyODsF+vC7RybPb7Oc0 t8sS773Ico2dWilJCYmLWLGKwgaqAI9naGxaP5tIn/SC+dycsBZVG92nxCj3vyX9rtIIJO7r2jIW PseXpip1gBfEGT4Eqn9yy+1k3w+d8/lgJKMNxuaW0cwS0nvIr0mGVYsrhooz44MW0Cl0pnf4UIgw xetgZ75FVpqvpUszcy2mLwZDgCgcWSOcHZtgc1IqE5Ah4psR2ZTdOsAUbfEws1PD/TJJtBnWf+Xy tBMZZT18pf7TlID0q9kMmHuDWE2JZQwYbBSNpRY9X8vjA33wg0hkRGUDT2oLXV+ftnd+92EmJKWi IRu95NOSx8pgXZXqXEPu6KBTZanNtiNcXzmYjIXnId+ncDZtMsacNhkP7Qpfw0N+l2I0ygMqeOYO SRLcgeXgScxmQpt/dWIwNH1VvhyXtlOQKnfbuQ3ODELnnqWOCjD4QfrFzjFcDyozthRcTkF9NzXZ AYx7TM7VE637PXfhNoGSRocZok9Dl74N1D4U98RBYaksO+Qx6JqeSZ2VGvUbgjcgoBSBm1DzU50A 7iH3Pc81gEzE/cq1R7vpUONmgE7RlOgwzcFMN9st4H4u8N8SGkkh8v2sygKAMEjL+5Yi2W55wSGi O1uKcsmCyM5KVBXC0dT0P41a7lA1M3iJyMwR5gzSgMxZU7l4turIxA61SlNuT/ealMYQDc85VsFD jxW5Myd4DnpBDMHkzLjRxFpLMTJyfoDJiMj6UzxNA5PIdFUFubk83gT9yd2kfeRWFGjo7jlcpZkR oEve4Dn08kjUkUi06ncaJrmgqrgx3hDRqM6fmq/eJ/nWMxlI45NFrYP4YiX8/kBiYpM5HCDqiUKX zDpwS0H5oJZSNubrIBLFC+LNHL3MjgRzw4s2xw3Nfcjkakq2dIemEeZ06gd6cxF/yb96M1wpyXE8 Z8+vSm143Q4mGOONGaB1A3NLWYwnBAXF0QsH/y/FuoXhdBXPLMJ6S5zzuvEuXrM3Yl+d1CGevyGP 6sgZ4wNDfmbtMuYAvd0No0SgJa3S/BmRQOZp5qy1nuhtzjGHvsfkucaXN1+4oHtDoPpiwVCKPyQi DUFe9K8haTPfKE3GZw/+3WatjuiMXOtf0sCFKNnZbT5jVfzUId7AGmRuIzVSkABBzp49BRn0MLba R7SIhR9DgetfzBEpR5h4QowClGu5htqh3oJPeAARwmmzNlr92OPPvLDDhjwFtos/ef7BQWWwYY2t bLnsTZkoUsWiFcjVV6ICm05uIzu1Trwe5SRvKzibq+KYLvbDTLYO+A2RTczRH86CG5G9qmcHY7SX hua9J4JHIaglZj8BvTvfJmJni3mim00mVfWw2RnCWxBzRK3AYjMs5bab4AmiHWdVb6IMinpNpHc7 o8Lp31shWMbM9YIMhgqGVbCxQuPAtVnIFytlFVj61wZciTUjFDDAr2ePucK55ECXplLc/bEW9TOi gfiJRdJGnTCaG26I4xOJQec4r0qOWlzxwqeLmCSANLVFk9+1Zd2OShZzQxqqF0O2YYzoW0Zv2tYJ G9yC9an7thxeGsNQrBu0KQHcMV2W1bELPUgcwQfwhfCnyEEtYy97+QKes4/C5xezQBq0iIq/FCOb YAHDGi45dzfhvGZgZOT4XBITke+80WSYG6sKKV1G+y27s9LiQtlu3gv+Yflf2wvKB2VuZHN0cmVh bQplbmRvYmoKMzIgMCBvYmoKMzM3OQplbmRvYmoKMzUgMCBvYmoKPDwvTGVuZ3RoIDM2IDAgUi9G aWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCniclVrdj9vGEUeWt/RSNMhcRZm9VU1TdhroHOT4 IYoiDbRoCwQJgr4kOKAPVZ9StEURC3D//4fOfpA7Q5E+G2fAkkjuzudvfjPLD3n5UOWl+rP///J+ 9WF1aMu8brr8vf506usy/3V1PHYN+azu+HX1n9Xf8stKL5H//L398L9/wyqV+Wz/++V9/pfHFWxT d1V3zB9/WRU/d3n/0OaP/1qZvau8qeqHQ53XXf74frWXYcD9Lf/dzUv+YrPJ+Obu1d2LV/4L/kXO d6/f3D/+F9Yrj31VV51a8NtD2z/As2X++M/V/qvnz3//6uuvn0dRnKTBzfPzJY1C7+vwfHkpgvPl fFHPf/e4+gn+PqyavgXlygZ0Vh+PtdLt2ICK6KO+4fNVPpTN4WRVhksd1vh4fKjzU1c/HFul89/3 YRjeg5VOZXVo9+eLaFmgfqj7su32GQsy7pvvfXmq9+ZL1faH02FfJFHmMf3L4Xg8HvZ8q6/WdXmy j2bqh6asu0O9vxHeWgRoManvruq+Ou5TuRsfvQ3Rhd8Gbk14Xi9YH5q+O+4LmTEt+6ks6/0mlPf/ ePwRbALXe1D6r6vHtxP9moj5O6deIc3iZoHzPTNblWD8fSKjoFizVCtQVX0H23Os/JoVz/RSXd9X p30U8wDJ5q0ZWjrzpMfQzTJI0VXZSpHI871IhKelO3Zd3/WDOU8lfNsb5a40UmZW4eWcEPDUbHU4 NC112PXN1oXqe3Pq97d6kxo07spq1oIvR71O7XEf+9zjBU/G9frsXbhmQWEkaOoWPJiteZRoffUe o5mVR3nsiVx8b83ctn3VD2Y2amdRHHPfMxI3ZdmQqEmkf75gwwZRDuv7TwbCEKnVAYRYi/NlnexG CVPhs8ITPJCJ9sahhn/7KBAQcB4K6G3CbzK0+dbn+XIIENtrTZSn8PPWV2P6qNvnvW7dlpHgvJF+ mjnXYjud99++daG9CfFO89qTwM+jxHPKGy/ZJWxwBrvhstVN22ZeeGSmuq4nZnI26aumOVyrpWWJ E4bEU9pl6pH62B0+IYbf8shmo0EBnscRJKgwCWzdTVM0Y4kJCWSBXBoo0bumLGbmiQEpA2QfqqPn yyDLhQdGfjJQRbDlfq6FU7LVTa+hji649RkgW1DssH8wePhMJZGOp9Fq00VkzqPAwxrgFVjAINV2 8x71WS5FMER303ZNc9yLAKHpjJNHiJoKAuG3Vnk9rGeVjiUYzA9QjM0KOGbTXVZIKGaAD+m81E4K HYebkHmFw0pThMq2Kbu23z8M4a4lFAEAOoCchoLmcOyUDiyPmS+9yGcGwuuuU5aRqdIDZ2oxwKEV lACi8dSSyKwl9QuA1XdQ3wqJZOQBRR8PX9uionC+14bdIcPG/Ib5BgEwVDlo24Q3a7hDZhiXhe/S oYmkKmbzWoggBTTxLDuw7pU+jQFjBmQ2HhiQsiKkkT/CqYYtuYNSwpBA1B5TsL3W8Xy/IG/Goc44 q6NIMwWO8JUvuY/KL0Qf3C2TZIcTjwWesHeZVPMBkcb0McVFDuatmwoCnKINCRnZcpEuRUzPbs+X 21B6KBkDhfjeKOO78Hwf4fBYM9mKBAdElBlLLdie5m9qJLXfIFAwL5q6AdRcMLrN3gkKuOKhRM+i IBmUMeVhFv2/uf2GpvOfgAcKG10mgb8Ea0Pq5sxAoC0Cbx1uzgpZFVD2NFHQDrZPbcKAeTfcf+aq FnutsMvwiaYtO814PYkM02iRcELNs1ODdjPsFMIX8SqS/dwRIoiu2TqTKWgx8hmJh6JqlyAxvoiG VvJNKDwni+HsVnDwvvCB69oCThifvvtZwG8WSVQCUiaYMW3n/RLzJIlcudb1iKQAJkdZzAqxFQWy ZcyFLYXXzEwm3IbkEMKYaLkGyqStzyXOHLHMCiIfkDhYwP2gFT4PVHS6VCAueUnWssE05OcfQyhM lGri0smLIvL9gbU3p7Y8NQMeG7wJOMYHn50vkYXEETsjb4EbSFATt5BAflKe348Mz9YSxPkU/uzG HL/zoDvC4CMyzxdqQ/Cv1qntj5DsEMIM028ZQ3cS+8J2XsdDU0Kee3xezBxwKXEYDzLbcmYgHrJv DaDIfYcYc4iC290UBTW1X8AKlmXStxhrqULACMbinKC5/3GKAEFk+1JLr/kiDctkjksVJLzzOMVZ 5yET1XadodYPpMRcvLF1S18cgMqFCrUbcPEgdVrfgWvjecVUdSd0Tdyy25DKSeQyW6PIo/00lsKp MNvJSTSDoGYi7YlWD0SYlx/iSwz0baA022vfmHVzU44wvk/qBY4PiVFl7PXUlU1IeRWe0IhcxdHA Yw0SE0z5M1CkVg8HrAE3C55Zs4GZKc/QHWnoj/zVlG9P8whbc60ILtaMLxJI4KAYcsvcMxkpZKCK JYdGUEiYBVYRbQHpBeyY4ElLlkMFNyhls9tbywDF1S4GxpogN7uOCokFRYP5rUwy57Ufwu1TxXKJ JBtP6QkFzVvupwOiarwkdD5jBQ9ww4xrVy4CaH2dbT9SQjAlHdoCN+2xGKfGPcYXC3MKQGhhhR3m FJOpCOmrdaEm6kDXt8Y0WA0R50HeFcbQkl4TOTsXFu8WsJ9BHBbIZGTQRyZQ6mrjyKM1TD4hj0Pv d910U4OjFN7KQo3/hmJlFFnEkskcE2ygKgpK1PBwdwYk+AKVcExJtdQpa0VBGOc0ra5mb9czMCjm C0alMyPtWRpTev4oYzv4NHTFmu5z55C0kumgkAb6rd0tBzUehQTl5O4EBB0pqaE/NmuN7TJVwSIy c4riVOJM2jzJsEGmVqhmYexoyJR3DHfYC0/xyBgqis8XX5pW3DpgHFsY9P/M2bnRbxOuR6jXnl8G emT0UaHr3LUku1BkPmEpQLzKDb1/VzUdQCXVawIKLu6skrhs2Rh8QtQx/JzLoBbSsTseWmpbz5VK Y9bZWjnfan5HCc4bqCseAuunWsq3IEWyG1N7OhzDY2RbqqYj0xuRYL5swQllMaYz4HXS6dysheVM 5nuRyCyD7oiRWU325NxSQn+QO4RCBNKcCUR2F5OCKGaHDYtxIAsL9iC1TWETzKYeJ3jgmdqe16qd cHcDPn9aaLDkII+mMPQMZeysdVSDPQNsbhrySJPYZ6PAd5AsKnXz3BQOa0hcm6GKWcwxlk/FdjvM Xcba6TPA6CS9H6cIt/P6fME9hvQBNuM5fTiezA5g6VCJZrrOlDGGjWijHMj8ujV35t+E00lPTsdC IrMGr/pDs9iWFUDDhhMeU9pcZ2bMP5MQNM1nmVqxKxLTTcwQoTcoP1wcmxvJMCMRz9iUdy5ntmqb hTq2ISFAg4vETxL5cjgSnOArPiJCmT21+ZRLTwZ1ix3Jx48c1aYJ9omcYFyu2lvrNusTx9tUBAov Q3KoVB05IO2M9CwLuv2LocOWligOz/BInYxVcq5RfzgWXmqTx5GnqmW0SwHgcCV5E6pa6Y4rSKhU ZM7GXsvcHk3NHVE4M9nZ0GwPgQNMIDPMTMLmVSNnmx5/bSZb1jXni1IG/eAL+h2IEG9xr49DkgAQ Okby2XD8PUz0Puns87M7HyCsIhgzQgPgpIceSI7y1LS2GXtTLNHfzAmeRhrfKT7BBD7MsawGyNkj S5lXCKWHqoVTt5vTsgyp4Wbm0+roM4Vck5CBbISaiVwGbZcnRaCVsWYK70LWRCKOSUFxWalR+CPv GJC3QAylmGrg4bHPOKg1El3NG2NpOjMrCIhnzIInaK5qzYyCnY7zQZShINpGAyPS9iTlwb2tYOJf jeHoAbRLQTqHY3kMXUvqzPKJJ88ZsiRUIekPLMWwuXEMqAcPeHo3bG9wyfFgu1bYX0+j6DnAMBoy 8r8LyRm+Y8xPcbv+cw7l7dbvSDb9hiVyh+1AfTI38iHz6IGOI3b/w3wcrK9mWCFUJgic0cSb0NbB YT/TALq3lUzRwWOV+WZZVyV0w1VRQrG8BBW0w5oUnrnw+o5OFHy5tScZxjFHc2g+v9khUAQG4yH0 lgK9+KKpoDm/sCG45oXzgh0pZE7labeC3l7QC5oZvHo3BNmC2MnOLTKESiJ7srdG77BYVdA7PPeL JyZkpk0CTBU6fFG934BEnr75Q15ZIoez6rRCAWUEfFdjxbGvy6bav3oSK/5ApFUYzFy0XRlWHzx+ 8gtIFmCndPEp/KDv/KjPQ5ebRef7jC1BR2gUA8mrw8em3vQ1pT57t5DUXxHToGGYYTTqZZjMw/xw 9pRgFhTVRHN2qP8JlnSWN3Lblz1/Wv0fhnuFOWVuZHN0cmVhbQplbmRvYmoKMzYgMCBvYmoKMzE5 MgplbmRvYmoKMzkgMCBvYmoKPDwvTGVuZ3RoIDQwIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4K c3RyZWFtCnicrVpbb9vIFcYONeOhFFDNig7jUcOl7G5ABVnzIooiC7QFCrRdLPqyCwN9qPqUoi2K jYH0/z/0zIWcM7zINlo4QCSRnDnX73znDL8k+X2R5PLP/P/p8/LL8lDnSVk1yWf16dSWefLz8nhs KuezvOPn5b+Wf0kel2qJ5Kc/mQ//+SesUujP5r9Pn5PfPyxhm7IpmmPy8GmZ/dQk7X2dPPxjqfcu kqoo7w9lUjbJw+dlKlY+ZVv6y8U7+ub6OqbXN9/cvPmGvaFfJXR3e7d/+Deslx/boiwaueB3h7q9 h2fz5OHvy/RXr159+83796+CYB1G/uLV+TEKVt771fnxHffPj+dH+fwfHpY/wt+XZdXWoFxegc7y 47GUuh0rUBF9VDe8XOVDXh1ORmW41GCNj8f7MjmdlNqg81/T1Wq1Byud8uJQp9++1t+Ksi2OaUZ9 j9FQ/nI4Ho+HlPtbyhLhcerLH4+NfGbLaCK/lYeqbY6ptyF6wVOel+k5/e6DXr5pm7SNf73y6EKw KNaLVnleDZ4QmRcIj7IYfqrqvAE5Xu//9vDDsoTvTV4kD39ePnwYyP2RJsTIUJZlSrfqWpmDFQfL b0O6UJuDhlV1SBOxQ1d9QqKxLmV5bA4pIzVhMUGCMxp4+oambYtTCsZBa0Uk5PCE9L2Sv4D7qryc lF9kVz5dhCQ6P5KE+J5U/gSb1mXqeOSe+yIMd1KE6tSm1yvur6x5B5oGXsCIle56FVsrSe0izkjm rbrFkHOVvCMhkenyuknPe+ItCPFteGw5CSNk24jUPCPY1QvubcBo8hcwRXPQARIjoVx/iDCm6CLN soDZr8+IC+LHxqNtm5/AKcITesFDVadc7VzU7eF0SEN+RcIdutej6Cpoq2OqzE/php8fN/peZbqM MkZC4emtjmXVguzGNeqBeC0yYgW/XnnccYXwoz5GDm0zqQs972PCar1HVRRtc0ohJHWwGIt/vxI+ EprcimQd4pA1mTEVLyC/RxjS31hH37vYaE93mUGSNWFCRdhksHA/Y0TodDHCgpJou02Q8Ih7O3RD RNAzOvVFbI3oihs5gZLRBPIGgg2hBk6cr3u/T0QZ+HZaiXgYPkYFDQgmwY1D6qaqQF4PIU/Et1u4 7ut4r+u2aFOwmc4Ik5UyI5Bg5z11vg9vB1F7QBmJ6+3WPJP4gATaCs6cqIYktgECAPKavL6EIkzA dhjkOmyVHkm4DwgYWziC5FbA3cc5eCm2i12viJf1T7+e1gK5SmL5yFXYwBMeYOT8GISCdVZQVhcZ pGgkLYd+NPmttVZb5nWVN3WbxtmGREGIA9FAuxJcoMDqtpvWpQoI21ldvl9xD6XnHNZJaLqoqBKf M1fVY1M2DZSSbZfF2l8CwRC5hWu6gkwHEOOSqAwsapWQgj1TBxPNCDRHi2vPDMVFto2DKDKoo2PX h4pD2VUXbzdz0KO1HOIkqkydN5VxRUiY1+vnwMZHEwgxkngmIKWKEQMv+X1ZOO93KKiuVy4/MOBs k0fMgFAijHgqhm4S4mlWgaF1vQ4h9Xtidqjyo8JshlM3ckHQwXdyuwYy4BQXkx9Ks05NfXMfjtMS S6K0s0RBggLGAGMFHT9deCpPEL/mjPqSAWn31VXdyiCjPgdK2CltCuxQaR3/Q6VnrHreq3K3s+xl TRd9bAKBBvv5NCIjsmAknTWXthAja8o8XEy9GPk+9qB0xn2gdFVjCC4xbMK3PJvJVu6SXih/VloH zwCFrcV1gHeXvnYIkXEsLsom3HXJ63MYUYoRd5XXmqJqIFfoDC4mQiapL4zIx0MJ/2B1sQVtkQc4 jo5BYbJ03FBJzWclfe2Fd3V9h+m8wRKkyEYSiGl5ZV+AqG+XGUosF6nFeR8iNzgcUkS/C2IcFE7I uOrVgu26eO8N7fG6Y0y6KkWB/moyOttloSrHZVXAmhJT4mmFFiQMUewIHNuOzMDyOI2MU6Z4XAyB LtwbjB+76HadcAclAqOB5Vjq5gFG0QCYtjZZVRVVAcLN5bPxQnGQfJtAo+Dksit0SAE3lKtQrLy0 y4yemTod4RU1pvwe7zXTQCX7Bz/bIYczUgUQ011DaABuro481T90uaQMhFEmM5Rb6xEH2QbBCA4M /JBU1t6mahLSBWh8NIheV+gMEgGsyZC1ZHPDM5zQuIP6/xRHWzz6MqSTz9lq0jbKaba46ARzwBoC Wa+pArkzwbTcjEDe+E57lHTYoA3PmLGwWk22CRxTIUdI4C+C+8jYg/bS4fdAhI2vtA4OCDl0JojJ NgitV2cI+7seuE710cVVWVdjqP+hTXBPXOGi6nuYMGZgEx7JxtIUdUMAvI3w0G1TjRX28gy57auL FsxNT5NsCDKmdlkDGjLucc0IJzp9F8VjEuqShJZwWnCnTKt50gxe2/ZbxjnoIqvfgBC5e1uybEIG qoEDggOjDqZDTjFW6XiB+CZ0bg4gswLsVZteSjUUTvk0sNcXiydR+A7j2OHmnJ7Tr7DJ3XCLg3XH xLTXaQY5DR7RBNNYDpoot8uNoY/GiT62hp2GmeEfo8mTGKys0eOiFEdyTDyPdKmFHI7tO8YCtbLH Zj01wgQ+3sUeSazENwseYX+qLidGyexU5bfzE4CpIdK0rwX2zN0v3qJFxn4CPIstDmSd04wZnOhy 4GsCOXGjoidiyP1TFhvDPHd4lDTdtIqqSdBySiIICSsgcJTVy3o4dHrrslesb5wB+wUswWXKMDLl a9SMGKOPh6mOWRwg0eE8l5Dnx8SAmskIDUia701iyBxmDihNSGMMKNZW3SQCo49geLYe+P6AL9Dt Ft3tguYMwJNEclE1qzA2Xf0xFLiqnh9FvLar/nYVQ2+akReHi1iLTHakGNbRgAhYiXFmN7XTzeZ+ wIhPxQGEvJvpOfruU8/BHHrw/KYDICdC9dZpQ+nCxx5RCGELtTqowZQDx5uEJvTsYsPDmYCTp0jc D4a1CuMccMNuLx1mY7ilqMaC8hsRbntJ8UiSQgDjoJs4g9hQG3gmCtH4amakcSsbIShUvRoNWKFN nXG7MuDKggFoHvGuIZ0YSr+byzWjs+06n2JqKAB08Z5RIxG+6AqdaUFdWOonbsqwqCya6oQ5lKb1 Zp6sdXDhD001prmD1kTTTCSTaRXMyGEzE1eSLbm1NBS7DpzHtTSjYQhmonKirh2ox0Xu/H1wFjk5 YbLb6BDD5QeiRJ6iTUscuZNtIUcpcoY7ak04jqqLfB1qRJC5/kSw6lEzRzOP1jQMEot2OG+c3u5C +RixaDcAhhwzcdi+pInI2ESuxF2CHcTYAZeOq3jCPadCEp+A3DOjbVELHr6443+Ca14a4Nuj5DEk Y06qRZ+wxAVOqr8nJI4hhkanGk+yUIg6GqxjFDUOBXBO4KfmaPc4P+0YG7UZNq6eooHGFsPRLi62 wM3s/TMzf0R21WiGJN1RnRbKYY0aijVhRvcseD8Tk9E5fBcAp13vL3P0ouft5z2jIsoM4zD+0KI8 ewrw9DsXCoMw5oxTFwdNII+NvbGvDZXqfI0kHrSzMzSybzcUEX7x8KwjwGZj1RdaB8iUQQ15T3jl wY4uk13AnI5t0wxfRsCvlegoHQfec47chd/TCdOtuQdQuCND0zKTRjhlNm5zPVjnf0qvGbwbngjp CXvf8isyKFfuR/YTqWditw+mm+ek0eU3amaIyWUGqMYx9j2j0fkGEIFQo0R3lJYxGiMq61QOEwu9 DWW9daZQI8/NmDjwKEpMbb7R1MWhRHd4ZXNcr1VUhM8tfsPZY98i968CoDxFeKARo1fewVIzdp1W qOMDqtpxHzJUDm5wcDiMynIPPbnvMVd/Dfo5rLHEmogr5+UA3DK5h/HGstn8UfX4LMUhPpC1CZWn bMq6pzo/VW6R6yyBgc90BtPNLfEBlkPnxM9pwIetI/b0pRpgKHnXkhtDrxmFKi2SmTj6qFC9CjrG oBV80chu+jjecYOkdkgl6GKzqxlWuGHqpAbl71TKoV8cQuTebLO5U32quJwcg3xARyW6TKr2zHkR 8MBAAzND10OmgUx3FjNnjs3wErLsGQOZ59FwSK0/PHOK4x26Oj6ARJiNlRgEIs5nP0jAqfbQwUzm Lo4gzZkyimM2bTz0SpsJJ4wyw0G3Z7PP6cfVa2IDjto3xrH9bf6sktwSKFQgs3m9Tpcyp0dyhVkz aPqpPl/vD5eyfj+tiw2qU3uyQfUbtxZ/BAiCrkEHpHzAvMD74/K/MVzMHWVuZHN0cmVhbQplbmRv YmoKNDAgMCBvYmoKMzE3MQplbmRvYmoKNDMgMCBvYmoKPDwvTGVuZ3RoIDQ0IDAgUi9GaWx0ZXIg L0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCniczVrrb9zGEUeWtxR5FEhJxxNxlMXwnMQ4ufbx/XJRoC1Q xAj6pYGAfsj1U9K0KGIByf//obMv7iyPJ7mpjBYy4Htxdx6/+c3szP6c5vsizdmf/P/7D8ufl1Wb p2Xdpx/4q24o8/SnZdP0tfGa/eKn5T+Xf00flnyJ9Nuv5Ytf/gGrFOK1/O/7D+kf75ewTdkXfZPe f7/Mvu3TYd+m9z8uxd5FWhflvirTsk/vPyx3sedS+4a+WNzS6/U6oevN55vrz+1r+llKty+/uLv/ F6yXN0NRFj1b8G3VDnt4Nk/vf1juvjw//+rzV6/OfT8II3dxfniIfM965R0ebh338HB4YM//6X75 F/j7eVkPLSiX16Aze9mUTLemBhXRS/6D/1zlKq+rTqoMX/VY46bZl2nXcbVB5+92nufdgZW6vKja 3e2KiHdd1za7MLYPD/yDcijqutrFbiS/zvNyFzktsRP+fdU0TbVLSZz4NkmJa7EPm77s+3aXBHEm FumHoeh29IavUZZ5t6s2h91h9xla1KURSdiPq3rom5238TIKBiV84zov+6rcLRxrdfe3+29A/X0J n6X3f17ev56oYhmqWNvAyeIw3PJl2r6uZ9Tz7cNd7GJ9bdDIEGbhhKGnP9k6JIyQbuSlxfRX27RD MeBtxI9cYi2ofcY1OBI7cb5W+pdlubvk3+VtnfftsHvh27Y0bg0+bnoscl22RbOzaRiyd2XTV7sN 9a0EiQv6eOOXGU0DmkjDFsXQm65JaEosJyUJUiWlcgGxnLWK3XktqIuNv/LdyBYbCaBoJ1d1u3vv 3fiWL1au6m5QOkhEcCX027W3ogsCyFO/XntpvEUIApc5wgHlMORduQMnZqt5OV0/PdwBiLVoDjdm 0Q5VVyEMsYUt4kpjMqmVrXKIVPgh9ROIDmwsi8qN+qHfpYAbh7oJ36fO83ri2cJFnsFuMEXwrZQm 1rwuDrjTtmIJDwHxaXTZYEtGRlrfwKYWzWgoHsp7gBD4xjk8uMiCme1YxHZiBBUnQdqtiGuEeAKh Fh/unNCxtuyRrs070JjLXcL7Pi9mY9akn9PCavwPyTvvonpzi1AJDtXmy+IABAkJYg8D5H7AjKZ2 acp6YI5ekSfphUJQx67zdWyBWwXbgSUGtbrAT4xdfEQ3Enwj7A3BAGtadw4YHjTIyI4rECbVtsnh gSNsFhwZda3YcSeKCslHDGOkUTsSoklh6Q37roB3wIO/e6XffPOlZ9Hpd0rnb37jfYQmPD7Hnf8X MJGAlTgRYZBQ/X2coIjEcR1nQKMpjWKLP9pUdQ7bcb9LgwBTbUc0VUM/qxHGRt72k0TruBlLRBPn IfjIMJUAEpJpI9cFfMCTJlgKBUJEWFBTOx7N19btALBNSEgyi0TzUAoI1Eh2GsuQb6oS/u2C2I5T tmCCRAT5QrpAngYY3gC3+PZobBk21somyYqGUaIJVDCkNOOtgU7l8xMSSv8nmq4YAN78oagOu6sx 3mTwI2BOQ2AS4m3V9ZMCBnv6ONHPeOhEHhqdxd2vQ5tlGhXZGuBG7jm2qZSTlRJPhFV3+aWZhxrl RpREXsDelg3sIVJ40zOJXz/qgbexxbClige+jIPJhlUXWkOkPicbM6FHBOo/C1N47TvZmWRO5TlZ BYngVnsxF1Hwqp1or7z3ML+fikjy0kksldakBobZdYmjylatD8SHzuYmqFKwI6yro4cThhG5RtbA 7Ca1D2JrhXQ1jeXSE+XByHdFpQntdOWgGE/oihWPXW5RJBBTXkvA7YskggKVgWGLvAV02xJQasJo ALwVjU5kMK0mJ32SrcZwkzF+eluZBWJLo4IFlQ8RiwsDW3/t2MYPBCExz9ltjHnlvceQ/FFBbfpp BRbQgDFcnrF4G73Bc1EAJa+NyDyhvp0RjGkdUBwU0xR7anNxLDguU+wTTiBwBMC1tUxUAunyeKE2 GYtCEdQjAAWKFFmpswTKtomlzhlSePPY4RKgu9XhjtorSiNEeI7LExOj67ux6nx/4pyl7cXOWY8z 0CPOAmakLjMY8taLpkIPm7n8lI2Epo9ZReZdBFhml1PaBSvgLzjyWoK02xqM3u2gTomRIqwrwXCO ilh+ZFeBOLr5vUesbJTkIyo0irjGWjno3ETc6G4skNcTrjDZjgctKuYke8wUcyiVjyQpE9mTTJ9N 0puoZ8YKYzxlLoD0CIpB8jJOITElyPHm0SLDLK3rI80n3gBIGR+AcyyPrtN9AU1/a89kVVYUhHAo Dkczr0eP8XC7fOdNgh7CkeCUCWzcyg/U+QLlJNNNgU1aB068iHyZfgCmOFhxH/QDyPw0Tl4f1e6s TBU7c7MftWTYcYLikkp2U7As00LPJlAwyP6CUegJ2jrVhHqyw4RBHm3dONUtJlEksRaLbxEt7NoT tfUo2rTQB+IXDSYpaOTc3JCx5yNgw/I/5naLLmI7StBT8QkMxQbngY5gfEWXMgevPSi3IEbHKBR7 0tNggBVk82buGDJpodjxzY2TKe1Z7ckk5V1R1hNu8mJoqrHNqd9/bLezNLudVVcC9aV1WQPj8B5v R9xb1oh9WxXdvq7Tt+DhnsPzh+V3O0qpNtclsdyrcG1dXIdXhx3VLBqKA6+IrA3ZbtfnV1Qz1voS 5Yczerk+p9oCi+Hi8LC9XigTnNHg4uqC6ji8iKLzRXTBNtZeOaOHhwshg1wnZKscdgqkPYowQwl3 fX194a3P+YJIB29xVS8W/BMReFe3CzqGxPmaXIVWRDWklDH0J2dUPqIOGOvz+uI8kI9JwWceG7Fp yHlhBVTzm7nyxXZ7HboTk7wxkPMMnfECsDK0aTUUsIXqjSNP7m2a4tQ8ZjXB78DsAUQ2kCgOpkkW mHa3tQ6F0qH4b3Somo4NJLQOigvH2QP8otyzX1T1vk6BufbFMKTtHrIjRMMvf1/++PqZ7Fn1hiDe KMInCfShgoA0nPfu7W81DfEw5NZ+W1XdfigfC3wUo5LSzmgYLKyr8FLEoMwzF9Zh515scOwvrGC7 Dq2rjf7V9FlRKlydX1xehi6OsOt1vdHYOKNS4GeEOB/+sKFV184MfyD7BCo3cUowuZu1ECERzdU7 on8ouB2loSDehjSOFNU9O9rLrtlXraGQPHmPh+2zsUfB94Unqj080RUtBEEDiPkkyC/bfYPl+tTg r4p92xt2uFrTsbAMLcA+tsIzadl1bDsDTmYvVtQibiTjriyZVcy4MwAIzmOVjCy7ZSPi2VFTgHcY NTU9+4/LHZHMSeR4Rkbt557RxJHFPq7kVBdJiFa2PaNViIu0qPoSuNVE1q8P17pnJcxxuMZuHG4T Bxe+p+JRHaVEPOJGzIr6YoDJIxROo5T1EWVbRc6xDBYg7IydTWe8sq/JTdEAAVdN3rA4q7phP42x X2+Jqt/PGQLBBjWTAho6mepACvPAUULOO9XAN6D4CDRzHhbtOTFFYuMsuaBsOJhsYxoqic/IxCh1 XnH+rZpnNErZy9J2OqC6QacTwpDggHu3OrAuJ9JVOQRm2nc5E+yT8GJRl3CaQiJ/Yl4s6o7nB2Si YOGGG6gjUX5+9kJS+AUqq1yitbv8yuyyv8HtCh6aRuR+4VvUpak8YEs8myfFL0LHOKy/GIcA/Dj3 1Ln73BlbyOwkaCL3sUGlecQTTZxJUcvm8a6v71rwSmEcUoxRKidlMjs81qCxIKuwvhiQFR2zSwes 3JZ8dKh7S2YX3kFDO5damMRkOFgaBY8Mm9hw0GjSGZ6Ys92jlw1OmTGgSeKMM0jZ0qZAY3D2k7Qz zqdFJ3t2AGDMNTmhs661Gt1wtsbTkblOyLz4OjmYsmD1I9aDosGYHeamGwDuVLUl1b0SyGWw7viY WPqIdcdZYXxixgGW0JznDUFsW+FW4/idZ8urOQIgmv7Zu4SEN1qTjZr+Te8GkGzlOrVPjgaVKrhv sUVldwqlXOfEfIO8DPjQ1fA+IgUpnrrYI6XDA2sTlxN1xgDEqZ1Nr+1pq8foxJtThYCNi+fFj8iN 6qCKw4Pth0ZH3ZRuZkS79vCUfUGMi1bjvIr3lLCER51f8hLw7jL+mZfUsh2W51VMyGyYGQTKxFKN ksHM8rxHp+aCavDEGOphhatexCbshoCTsPpyMme3KA3nZVysHMlrM6OjmzhjQaGuHMzF4RO3U2bb eEdIleOymaFk6rhO6qeneILA7nhIlLE7Swq673RXuBu6/4vpAfyodSI8YDZHPMTSAY1b/DeEtz6f 7hQ7bhb647lGgMZ7tTExx4Ex1HBENQaVx36x4SiimcAPNNLW3qAuF8qKfsNnlhAN+vF3J5rDI1+w BtzGOwUhM45nVBDYjnzEgjhgx5QGWRXlpGwVszEamjkBH7gnrqCYdzvVTTPNPXI/gRLJEHrhYyMp ytAAeOcFsZWt5PFBguIRzefl9AN2MQjpZFQZ+0dODyGf7mj2nEL9V07FUj+0HP2DzWkTxy5KpZss TiwdhHEUAeoT85z+SBKcF3Y6pYnDhM4Lr4c287KOU1/E55PBSgSlhXPD5qHyZ/DkkNdGOMPZj/pB MgpkhPrkoi8UOk5moGNSVJ0oAUfgKUB8ostuU+MaVeFjU+ajORaPzjiKA0s/sPbI5eHh8unK3UiM xy3FOAhC5BMxNDOuVwWgHlQdKtcJaWa6TCmBtJ4lSl0IF6STvC2sSqETNyQ5AY3pQ5A0BHnkWOry lbo1ad6+SlPflUrcjZ0BKD5nyvmIsBFpNB23Y41/T9/opLvWR1P2928jh9F3ZW5kc3RyZWFtCmVu ZG9iago0NCAwIG9iagozNTU3CmVuZG9iago0NyAwIG9iago8PC9MZW5ndGggNDggMCBSL0ZpbHRl ciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJy9WluP28YVRoYcmhQFSStRK4ubpamkTbWuLd5vTppL 2yBA0ZcGC/Qh6lPStCjiBZL//9AzN84Zilo7rlw4QFbScOZcvvOdy/DnOD1kccr+yf9//3ry86So 0zgv2/g1/6vp8jT+aVJVbWn8zVb8NPn35O/xw4RvEX/7jfzjl3/BLpn4W/7v+9fxH+8ncEzeZm0V 338/Sb5t4+5Qx/c/TsTZWVxm+aHI47yN719P9qHvUeeGfmjf0uv1OqLr7bPt9TPnmn4Q091HH9/d /wf2S6suy7OWbfiyqLsDPJvG9z9M9r+ZTn/77JNPprPZPNh49vT4sJn51if+8eHW9Y4Pxwf2/Nf3 k7/Bv58nZVeDcmkJOrM/q5zpVpWgIvqTL/j1KhdpWTRSZfipxRpX1SGPmzY/VDXT+bu97/t3YKUm zYp6X4eOGx7vAsK+K7Osa5u9F1ozh39RlE23pzd8fZ6ChHtrRcTTTZrme8sJb27cRK30O4eEAfs9 L8qurfaWGxP0sY7Yo1neZdX+Ckzvoa1GntQ/rv2IeBHZ3P3j/i9gAljUgY5/ndw/H6izCa1Q7pLn uTgwrcu0rTs4MQyIY7GvQIKyLPav1iDERkpYlPU+psc7N3CtHTNGmrcFO5pvKKVOaAwrwECuEL4q yrRqmVUcQm+UHdY+sRJuszxt9levuNgnst72pmzqau/QmcVQw81eVVWxnzvUogkNuCxlAcd00Sv/ xVdZcdwve+8c78Qu/Kjek8qKVP+22Xlh7CZhEOy45G3etjVTaD6ziJY8IgFJrHGJQ2+DJJ7TKHLh wB2CDp2D49xvMJrANuyZuiuaAhASzwLLnQdEW/iVPw+tFRM6r9qCK2mtQgupYbsBxoah8gxgYfy2 kwK3HffLuCbz0LHcxIWDlc3rEuANViK1m5BIe0GaUIh/Qx07dDbi1zJNz8SDr5WzKHsgOvtEmFiz 0KJOdNbiXNOsAFU/ow6KRAzL4/7lc2PThDobpVlZt2VZmYqYQkTEYVrzwOjSJt9vozlJXKWJ8KN0 vnCSDvzhE+N6fElfaD3WPrKTsDIBWV2PEEcJXbUm4DhFGCHCjRmRZOZAvAo90zZjsAzAs8KFPQQf g9MqrM+gRIUPl1qhTvxEPMBCIqCnDGSd5ckIwk7EZdt1WaMoVYCUO1KRFNZRQmhD49D12MNlBg9A DA30cRGtmnQVEQtJAQQ1qqZHLJs6T3rT52UHq08iIdzErudGFlDdRrgIpO8GEWcoc3wIgFAV40j/ zDy3nAljCOgQzxKMK40DrCyBLrccl9ohABnBwnIjaVWB8GiWrDSxaxsK5vc7cnV8uDKMFRPLoQw9 Vugh/ULITMjYjDBpZDje8GYSzJiJzsSzyqUcUSynsciX3Pvqij+Tw75tmqn01lz9/srHRn0xm8+p Y/k6LRgJ+iv3+LASBue7Ll0H+NyQ9ynDbjzMYYeA2mekHmQqws4fsMtYkSCoQqdk5ggwJicmHJ4K QSKFIY8EoXN8wHETxnTmWacuF6aPGJ0ztL25THCBrhzlRaEBqwQiX0PEYG6OfyTZDbFRYDH6jc4T TAA6n0nKq4G3NtJb435wh47L4b/9DXecMrAAixTzoAKJi+l6EUCb87ykzwFbzAD6g1ow3GwcAnne 5IYoWZEYx3AS4loOqHJcAcYp0urCpvbKlWEqjH4TJqz+Ci3hCpEFTC5FJR6zJtNe/2iGysdBRHsc gq4RAgv18KYAMwt7MAkgxh2koEXPpAgjNBgQdBhAnjtfHfDITSi4w4PvlUvrsu6AvFwvgUCJZBKr 6y7rkKlELMThDu39JoyNSx/Q/ilWLrsxY2sGkQg52/VQaJv18iwKwXL6WM1gTdeMRt4tTqnWyo30 ZkTUOoK+h7Yz8yI3HqqPJZzH6uNI06VcZRQysGsg61Vdn/X8ARl4VAuAqYXsZpDfGQIT+PZmYGID WEbSQnQgf96c0vdpkckZAEEDe19H1DgEWGkSyq4HkYphJKiWQ8iOQm5JlwDdCCSBom2Dkohyk7L+ aEp7py4IVRCL4sWths1bN0CsKo5jCvxBBLfwBsgoRTkAjnczJxJsIDust0gog+ZKGFE0V4NMaVhW dFt6BY901SIhn7MOyfTw421FBP46R8GRJRtYHeJnKo+vf1XlsWBiJ2FkabHX/sfeTn4lAQ00bBT1 T2PQNAYS7DkQ5OxAISO1H38BZMz5TqNavaD9oIEF5MwBIvNQ3LFSy8RVtIMyLcYWdEg5c8XcQ8aV TC0cPduA1CTAtchoZlQWGZYyxwemAH+8LLMyU8X4YyyDKpK0bk0ePnW3johodryDml5r3xfUghGM ogALqcmdBw8UeqChcE1NTl3zmJKqzznTcTDNtLvWvu1aKwh9BK3Qw+lt7rjUQf5k6VHhxazCuVCx giKKKiFcpIVb+5EL4NuNi5iEjrPrA1MWQ5ja3cjSJjcCARjbnbtgt7EsmvO8ZzhPumtUjD893S6v XGLd6PVbhwYB+riieFS2RRSsenNAdqRX/PnNpPz8LA1HmMmAuepQJSdhZammiFoUhqJ1FR1Pz6yy 8cS9gOZ2DkGZvd/Iv9BUmjQDTfJwxiBqDdUeEg+5z0gTyMk8ugNc6N64JNgghIsuWX+G5rUH37hH zwomwDMqmJDZ6K1lay/SCMa+0bfL1GCMC0IHdWcMfFHiuJBFhRubOm1KdW4/RXur1DKIOo4REXW9 Pq+G9B/2+UFOkG02SkWQMZKhyP/aB2IJ0lgSN6h4JqqpdwM11kyNMERsKveL+i1JyNzqMXpaH2gP cXNS743Y4Rs9rdA6oTXaVGYTtfjMyBiE8aLYhaxD8YhCtGP9wyxrs8f51UOmLhGy/+USIWtbdm1S VDmQhrhGeH46qRqQBCeER0hCzG81R4gIEhyBFGjb4sCOLssYnsgOdVwfgAfg4y//nPz4/N0vRSD5 AIRGLkVGeGnYVqBiUkeN/6mAu1kEferLsfFoEx3h0oiDX6teVUzIkqlclO0lNQdfnqr9Lox50vIM R46jxKSG44M5JmRjN3EtOS4UNgViCqhKRTwgEVerXk1bqyg67tmLWivPDs3Y5Zkuu3gZM+C6zyQM 1GhiIGle1Ic27pr8wHrlS4kK8ZG3I6KabZbRFDNPG13oSTJd+2O4xpkOfTnK75jpgogip6/UVEYu H1gpZaxTt/WhvJSJAKWHdCzqBfyG0zVJ72PXJm85G4N+EqVqlexzcaWwo8JcAtqDSwM6H7k0kMB3 I9NSeZezq+6iLpiSl7JVmx7G0LShySyWfHByx8KwfwMLInx58IgZR651ZCsWqxq6LpqWtVzskslC jDmIqbzNGxYEWV5c0AZ1ehilyw+oRXRIPeM9zECeOs8ZcOvqUEHhagp0wdt9KIsPLYc0l1C9dcDe uaigY6uK/iD9+W3Py83zGtiC6YKO/CxY3uIzL6AVC9HCOAVsrwoonnJGqSeC0s4Lg+E4hSSr0HOj GLdjsgiWEDxziXxS00FnR6AVdjDuxWD4JYRdy0R+CW1Ky/uqH4aA+YKKwkemi8FVWd86iw7XpFHj RgUy8caYIW4owcNrj+IU/MSjNvrR2Enpgws2k2bMIXmf37KuKN9HnVkW5SEFv+ftoZMZd9oTCz8U 86ekCVFaQifASBzRImzG6Csv0vZspr1kFGbtocn/v1HYH/nd/g/TNdl5i+2S6u5rcX29LrdUI2VB NZi3tjW3p9pclzEFBAV70whLNhjl42mz6lBxuynTKi4ZUAjiQRrv/ow5YQ9oEZRZWRyK+rGYZNEh B4VsxtZH/tiQrQ87nqxJTTyd8NyzUTMWYxusL4Rr/+jFA4rVrqxxSpueSD1CzKsifSasLg9sddew WqJqWay8l4gpqoYVqlgu/4SpjMAHq+7Qx/6tjZdFmjPOeNmPUk+cDHUWwcwrMITvIZXfx9+OYX7X zOx3UPIluDJjPMTH6kYhSEL1BoLobryNW7ubmXjNTa4ZTFylLx6bdD2WRM4PYFBisenMmGAZ9yeA 0x2Sh3jEOT6gdzO2Prv3mcVywChz4OmbC1zm310SyIryshraJlmTmk2N7No1mptU1F1ZDQ9UdXHI uu69gDnLuUxatP175v+saMBh+MBsTZaBtWGnvoTet2OqmrRHKdUo2k3Xy7W3vt7iZOEtg48WS3uO vgssqumQTP0F/6zAYFvb9ZT23Yu9LNfTdnvpjJJ3FeOIrH9/Vc5itCC+ceTFrV3wTr0/f+F5a/Z2 73oOxmLay5vELfFuBSPlfPrAzc/vwU/M//lGJWsdRJ/Tq/W0XEzn4EaqGWLr3drHB3urrPxChFrG nFIohjA2//DWvrQL2kogKuvHZWowr+a2Fx84QsvVn+Z6FnEGb6k1ENltu7dXPbNzkt2wt8mSMEDJ tp9KIhmLHA7JKzYrytNymOLeuQTMsoLF5WmvqNsNxlSs3dD5hY39XHXJwCn6+ACZQuopC7fQsphm 8sZLKGZUTW96OVKADM04BvODLKtg1fjk7DIgKlNejGkb7X16wwkLDoXUa2Rwo4S+cAaBekFlEI4s 9oqEyGcy5tZsYjuSRxhS2qx7f3lEjNe1gPv3nEYqVuZhexArkKzEw/oJHSGqJ/T4QK6XaqG8lHlC F9acalQvrOO+70bEuHdxvV1THau3i62xXpbsKRuZPJK6AihIruHwZbDmyUjO6cQHWcAtb2289Xw+ tbfbUV5FvZFPlvptsUDIJopy+wjbz/tEZ+6+9dY7G2XF9ZV+cnkbbFVF16JXogyF5muPgCSWMJWw 8fJ2IYQR7/TBiq3NJRLl6iPKTkUhQDUNTO2nJJja/Ai+h5ymLbY721tutQHeKrVQTWMy4Wuxmi++ /Cp1ezttyW63ni6RKIG1tKfyMSmk5PHy1rYQNoI5CAtOvqaa7vqaRUcm+/dfXUeKY2VuZHN0cmVh bQplbmRvYmoKNDggMCBvYmoKMzY3MwplbmRvYmoKNTEgMCBvYmoKPDwvTGVuZ3RoIDUyIDAgUi9G aWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnictVpLj+PGEcY21b2kOKB2RtQS0/LQ1G7icBxb fL/WhyABAhtBLjEGyCHKyY4TBN4B7P9/SPWD7GqRGm/sMXaB0YNsdn1V9dVX1fohyY9Fkot/+u83 79c/rKs2T8q6T97LV91Q5sn366bpa+u1uOL79X/Wf08e13KJ5Osv9Ysf/w2rFOq1/vPN++RPD2t4 TNkXfZM8fLPOvu6T4dgmD9+t1bOLpC7KY1UmZZ88vF+n3Pco29OPVnf09W4X093tx7evP2av6YuE Ht68vX/4L6yXN0NRFr1Y8POqHY5wb548fLtOf3N19duPP/nkKgg2YeStrk6PUeA7n/inxzvXOz2e HsX9f35Y/w3+/bCuhxaMy2uwWbxsSmFbU4OJ6KW8AJl8bPJiaKrJcvP+CQCqvK46DUBRJj22v2mO ZdL15bFpBQL/SCml94BZlxdVm766Wql3Xdc2KbldbdS7PC/Tl7S+C1/L78uhqOsqjcI3oROpD4a8 K9NXNzcr5ybcOeKzum2HYkhvdnr9fujTqx250bdUTZ3ndXq78shVeHNK5S1FMfRdGp4eD69D75VY 6VZ83lZdX3Tp7vr+nw9/AaOPfZ8XycNf1w+fnhkQOjerq+tXHjwEPmzKepA7v95dyVulMz48kiwg cxvIoimPwmFdcWx7BaVP3vBkExJhXd0N6c7nPrzO2zrv2yHd0oSI92VVD32TesRZUfZSfFLnZV+V 6cp1tugC6+bAcUPXOaCrq9tTekpfGHCvffFtUYB3mvRuS6TFnw/dseyGLvl8gu1bsVV1rQIN7aRq mqZKE37wjePjYLOhzFGPrqumT50tQd/z0/20N+1Vh/pmX67nEMYztYDy8LmlHoUlGVpAb2n0d1kN /ehva+tBLDJNLjXkbW9jFrn7PWHEU09u+7pu0g2jDs1oaIzZ+XvKkDnaiQjp072CoyzzbkRjfKwO MUYDRwE+2yIjkRs7zD3dgw+pJ8K5hlzvUhXNJTwGRXN33Sk/jka8wGEiN3xz8HjiZoD48gPfhs6W BqfHLQI8ochJ+jM3lje1Q9VVKY/jICHR3IfS6NM9QQ4N6Qrh5XrmuoCd7rl8X/bDACkrQzQ2F+/8 D/VsNFmJYI4CHHjjDnOAM/VopLOrqlthDs1crgHXd+988AT6RlwODwPKhQiM0MLiss2GcMa9TGRz AzWpLtLdMt5c4VgWFSCwImGIt4EgDinEjHnILWRFYi4NXe+lebchzJFgin3KRdq6HWAR7TSJNmQN 2rRHTo+he3qEQJMUpPn3jBXU/TrvXG/ZIni0py8rS/BwsoH0jQ0/MELZ6ZF77pdP48hIRr097Clg 5sJm6Ps+hS9aAosQQFg6uC/73mBZaig/AHGRemM26gwZkxwFO36eiQiTgoIil8LwjqJHORN8wkfE i4xzd35IM65cr6qjxaoyo3RIx4qO8h4c8tkfi+qU3vimhr4o7nBySej9saLYxAvM5jIyZRKw1aIJ M3rXeaM2Pqa2yiJGTLDcjk5WtKDjaeRKyQTy8pGpbpG7SWR8+pW/pSsC6Ju6aNuBKWG2+zlC447H rALYw4Oxjm4cNznbtFWPMu6oWlPWBXyQavovy6avZghnNBDlS63WVHUO4ZVtOcQbiUd7rpd3fjct JcQUDlO10XkpGuJ3PrJXLo6qrw4joCZGNww4DGdOQsS23DhR4dW1eVdfTHDKIg2BrJoWkdoB4XoA TzKCKWOW7tH3Z1LgQ2jXkBkIJMihxR1aFOybomk9XHB+POXjuf7BRGSBL1G00Jdl/gn0L9DQmSOq Ev6nwSbihpAUZBecg4LSeEQVzqXqK9884RDx9RibyNJLQQDJ6pHMcVuhJKbt/xooBrFVts+LkDBo qg9NVeQ5lCC6vGnXc50RcE3tC2wfb0jm7t0MKyDLBTo0beX3ZFm7JO6WKlxfteVUpFSkkozEMWeH OSlJtyUcVDJXETF6FRiTKzGhwV7An+zBShdo6iBvHIauuERHH51XXOVvXbEV+0kZq6ixbGEPJHZA 3YduvE20jG6HBtRqChSrYkxz6LnHrZCNAR9PuIN7TnhBtIKmtBhpq2WkzGybZOIEYIGdIecygjW5 xlf2HS0PDVqLitvaxs3YMrjn7vypOpTwCHd38KWzIsRDvjIKVV4xE5k98IAojitohQimgi35SbWM 1haKbVobB7tousC/uAC5FHMO6EnppZG+VbWTJI3gh2RmyAxLD4htmCtvn05hTWGyLVuoEJLu/eEL pDA2Wx5LZaE3fAvmTFH2xTvDWxhEFaA6hFSYn3liq1N1rPmyebqgjN0E42wVTkVkF7TaXA1CYmlv aGtcB29jA/LSyFpJrYwkVMWzjsALHWRvd5CnFMAWDLFo0ZVpxaVFtv55k5HNmAjaVVYF5iFh2IbF RIxpGEx9jP7MjilLn1k9fAbrc13BnhK55I2jGUpjUweEuTrGlLoyezPEsfP1GAVXJM4wBhEJ1Thk qsxgM/cw/Yzxo7vjcSKhV0MtzZjKCzlxVgQVNzPmtopntQ0ih1WV0GZyVK33YsoyOkvtTDtL7ez/ oNFLu0SMKhhk55Pr0+O1Pefak5VJtVgUyMiSI0itLPM2RjOiHk5V0UYczFv/99BbBCw2n3xAR/cs spyHMUX7mqv0yzMync24/Jvx0VMxzrMMZKJBS6ajRUFLE6+EOAyaznHj/jAiKv2DteNq62ZbFOnQ +4QReq98bZX2UFOLXvzdIiP1lqb8jGQBsydRIE1iF/SvmnZcmGrhnl+GgcoC3GvfTw2mndVyFMNs YtvQeGncpfvaudKK59t2toxwJ8Y+3XLnA/px9eClGmJrCh5FDGSjLHn6mTa12/p85TICGY3nC7O5 lh5EWv2sx51AoSPRwyEBURxfoCyNeYwAcb0MEIk1Y+n4tEkHhLnDguQSRW2oI8VXiPjgCWdcKNLK L6hOLs/ARFi4WKXvAzbOoXXqi1EwaCJrmGCNg23zwFtARxnuToD+AHQh75UWU9063V/aOiYnu7+V YxNG9ONHsoJU8GbT6Pk2BHVDkrXklwArG16ebYnVQzGKxpgQwNNEXvUQEdmE9KBiWGWJHcNvkW9a V7QbBNU3e7onb1/IxHFjP2+EFAe6i3LUHEkrcTFM3YKIl3+Q70SSI+p3HRMN9sGJPTV3xamCaKOs 3OMZo/EFytPdHw4GxHnj3F3pMAQiOhhS9s04I8bthRvHgZ4XiOxnpA5czQY6JkQzzXEjyh2ZpaMs lMEUgU8uCgc7rMEO0RFOjwTfie7YuGfnx5gUrSk6Lpt7nomqOs5fVDza8pEmCWFi+8q1+iQRDJBa qb3AbSpmhbMMkc1Km7zld+pMsRjPFItfcqbYgRENdHhl0R9zfaj4FpsjQ98wtbAu8HTHJs1TXZMO DV1E8AJWiVC5Mz+HFFPPZAP9mM5zFamCVXHcJKMslwB0eXOUWy/zPKnqChZL2iO0q3Wd/Piv9Xef /ixA5Gk1ePrY1/qI1dL8Kp/ieyNH3Wty7cuRTKTqiJpt6TGOP4Bp7DB1NDpirAoUcYebFH4HS0LG nh4nUpTWNo3Y1tAd26Sqyv65LC3kinNDB9B9DAqnpz2n2wO9b+Xm2b7t0s8DyEFAZOru9SDHH0Kw DhryhGeHOSYyzfTSSjBqiTfBUAyD2HpVdQP8eS4gug6evYDEW8sM37g24x6Wd3Ol2ro0NEMHKY5w JyL6R+Zxa4goayiWd64XEz0MNvZ3g4j1Zw2Dtj32/YL1oK9UICB9JZxjyu+GZy8Jlj5fofhFbP0U XCoPLLy0hkB4mWqk2CB2+AyZFoyo2r59PioomhY4bgEZBx/Tne5B/71EpTKiKzRNtBNjO85D9bWy YniWdkpA06rqhhA8P+kM+eFs6C/Txkak6RtBGZBJ8Oe5MKkFwE8ES3gwaW0p4RfQCUI6har2Tqc1 sf07lRh0oxryaX3AZQuKS4g1/zAn4BfHHwaQuq8keTxj8lQtUOICHlDvA+4oS4w2dxgNjZyWugRa e9QBoG5NmHP5VxG46piqec6WVZ8foUq2bTnLiuf5XZICoWjMr5IuDz+0UkRxPDsrflV9dmdSB8w7 YN9OAvX8eGiS6qx1Rw7VTTMCkOvVloayqy3FWcrjD5iBO8g2cA7BSW8Kh/KnlkrWWbjdzCF01A7n FZWy8aB58UDJXs8+BbvUAc4HUiOIJiZnQ65fT4p29bEr80qF0k9Fjx0s9kGyGKsBGVmdND89gojU I0gVMaK1SDbOpYhxvT8Q9HuIPeQq1qSUzRVpB9VUjGKel3XbWvcBsxRLaGQmBvqEcqrK6vcCmISP Sz8+u58GWdyzCaSFB0MLlhT9UM8YRPzQ9H900MA6ZW5kc3RyZWFtCmVuZG9iago1MiAwIG9iagoz MjUxCmVuZG9iago1NSAwIG9iago8PC9MZW5ndGggNTYgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+ PgpzdHJlYW0KeJy9W0tv68YVxp3R0KQlULJEmhF9zVA3bUqnvuL7lU0eQFGg6KaBgS6irtKmRZEI SP7/omce5JyRZPsmlQIvLMsk58x5fuebw5/ibJvHGf9Rv7/78fqn67LJ4qLq4h/Fp7YvsviH67ru KuMzv+KH6/9c/z3eX4tHxN/8WX34+d/wlFx+Vr+++zH++ukalim6vKvjp++u02+6uN828dP313Lt PK7yYlsWcdHFTz9eJ+HUYdYdezu5Z7e+HzF//fH69mPrlr2J2ebdJw9P/4XnZXWfF3nHH/i+bPot 3JvFT/+8Tn43m/3+408/nbnu3AucyWy3D9wp/XS629/bzm6/2/P7//R0/Tf4+em66hvYXFbBnvnH uuB7qyvYIvooLvjlWy6zqmzVluFfHd5xXW+LuG3Ftvmep9PpKBe3Sp3lfV2OC+m/P3S9wlyvhUfU fYeXfE/ximfYU5dt8QLfJtOQ0jC9Itb0IdtWed53bfL4VV7ukiX/pqzaPtk9EP45LzJQdTK3SEMc SgJxR9P0eZ/cWSzmfxZl1Xd1EoeOPXe9kHJr8u+bsu3yNmGWfE6RtUlgR+HuwRuuUA+iK/Lwj6e/ XL8vanC/9zmI22U5d5pvhf7h7jbLyyaxmCuezhft+6wtkqm4UegqH3SV/z+6yvN8W4MHNPm2qoQ5 7lwnpTZzRqPAJcJJmrIEcaus33IDNtuy7+CWn/91/f1nZzJcXhdb7uZamMs6Y163sCO93LfJDaHO 0vMpNxbcWHfJFbvxZ4xboKi7Mpn0i91+czvRdjjP1oumBp8xZJnuHjbalVIWz8EB7ejA3X4DHyn7 0pQtcedBSMloG7gg1x5SZu027/uLeEhVlFteBn4rD6mKbttjF0kcny5n/u2ZU5ZMwzUI3Cjj4zwQ kwjyyJ5EPFnVdV0mN9PzZ4KigTxkCLFgFmENscZl/alNUZY8zKFv8nspdZtlhc6o3H3nLIpsSIUE pWDK0B6KpuNZuy4q+JX3FU+Npgf9er1WmS4FWK8pI1YqJFKhA5l5Ooa6Q+iEWVfTcfe2Q5ksAGWl k7P8f5VlUDV4kaGR2GJWdGWRTFZ2uhL3dH0P0boKG4JqCKiIOLimsMC+s1XVkUqyHa2kmmfqqoAk GZccAZ1LPyXAmO6EfqgVOpFNtX5uDmQpAY3VTXmxcB+qkyEgly8v+rxO7hlyRrqyI20d4gTIFQ27 njKcxShLmae/6aPPp4vy8R4ZJ3Lnc2ZRdNsQl7Ka16ABrghe0AvQxYmCDh5EdnvLphttYKnTAv4W IOCv10+fHdy1dS3YgKUdkbwL47kKJVmlzD3xayKSunwh7EpR5JJojNZD34zDDVJZaNkRQf8NLWIq VIg9bvWE2IB8AD/HoYdEAIeHELAZRmLsTtzU9GULQccCKWJR5Vl3LCR5t4I0IrOQirHQ0WkGtMvs iNopen7KnMBN6bBtfxq56pFgrrJKwkhs5Uh+h1G147apEwaib0wVowQxmMH1RJKWPuhPFRZsYSdd csesSWgFwzMg0/WgSYdp6TF0vAs9Q/8qtwy7uBGSZk2VdU2f5Nw/Tu/CjrnTho7UWAMRWiNHUHGt TC/jQ1temsB20CZUJCk3ANVS8g6HhDKmvHhJHFuaX61j/PeRWI2dEgRc+iV7HBXw+en9SCgf6bv8 KbiYndrMjdAWwyCwIDqRZBFo0HBoz2NpyJFupK3hT8MACh4FDcRE6qypmh4ck92dlqcBdYUHhU0t LlxBfQUPxgabWEy5gZLGIfZuv9o9MGvFWMAF6oqu4z507jpfdKK0Vh2EnEA0YEBiOaE3Qhq4Ai6o M95GXRLul4A4akOUy4K5ElBq06H1vk0mS2d0uEfGkIXe3k806p/5ZOnRQHVtbcO7FLNvY+Jm5ROb mb/0HQCJQ6b4bP1H1n7x5VeZzYYAXpPNxp8tGSpCk5sJXYtVVWZbBAuPrvE1tt+eu/Mos4YXV2gn tkVn9Mtjsjl/RwGNHpgArxnascQ9Q3hSvShcnnOfLfviGYf81dinAR+sTkAf2/mCpFQ37iKpBG4c y0TZ51VVcnx0d2enJihqwHTw4LwUPdFFUFHXcTw7in7pLhnaP9gB0tSCzpkuAv7yfjKToZGXHVQN GRpt354IjcVyOYEGerk+txsrqNjkNf8lDUqZxorn75dKvFoSWKGNOBOOjJu8rUBlRX3YyZxpx4K9 QCJc2A2aYtuaCt7tF7ee4/lkfbtLGCpagjCRWdWji/m7yWw5oUt1kSqozoKsz06jlCU0sQdOsCIa c5w/kzW8G8MLGqhQpPE5m4geWuFNHyW2pqgGN2nzZstj5iK0SVmJHP9b+UpV9lsjOoYCCou+L7vq FxfP3X7i3C+ot97t10zDtaXPdOvgg5sx3a45Pl1DOzBB1XMpa7rKW7febu8tJ3NUcGeTtU9mzkSs odha/0Y7c5btHoa+p0PtmrEB6s8naylHURTJFZs8Bo9sKp1/aHNAuOWMOFwpMnDAOwHV+7NqMZsP X8pN3vr+RgikKiOOLh5E6uqBcehB/LX3bjLCVUM4ZQg2andQN0NYFRR5P1lIxTRZB9lzOVvc3HiO Rt1XZydAqwoyQwwZhLNQMnQJTced3qgK0/W8GL0HQJDzZvu4x74fOxTetkFnP+d4XrY7SqOqDZG8 QUS8O+0Ua2hp7gCKu5ZoDVADEEpGQQLCg5uYtduHjv3n8R5lz8PuFZroV9tm6H9tS3cUqmNzkMQh okDK9S7ZJW+0ZLZDLQb9LkEHDtCP2Fwy1Yq3TdZWBmWgfGfgDE53OqCZyA6INfZMTQXStAet6IKk K1BFFGOFHzApAzMoc7KN+ve5ZzZpFHXHAXE26CGhs7l4Xq+rXAFUUBc4BaK8eeauK35YeKHyXkIY 6PXBFpwaQbSF8C0ZFGUJQfMS7wR4nsRzxUwO5CvmzsIrMnrQ1AjtCx261ICOM4leNYo4M6leZCXv 9/RSvLMJmtChnLRD8WHQEr8wH6jrDu5SyQo6zaNO0TDMc4kD0lZKAteSFILMATeY+nwcOSwZDLJh w9ykyeZJBxgaOn96J7kmaXHFJ2JORXHzLyWqNHQjouvc+QF2Jpy/hoavV9gqeIZQkkU1OiSUENKC h/EYqfMcTBL3UD4udogp2yUt9sXbs46zKFhNnCUYsub5C3Xe83DC601F84PTtsESEoeAm2+e4wEF PEY38zpD+QMlHwDhm2W8LHLbRtqDDW5Vuev7vBHngy9E3Mr+AiLluTOfYx49HuqZTp1GIH6Ci59O 0SIqD8pe6MJaDrXTkIqr1AmuTXnywBIxtLNwjEMo0ifjkFpupCYVFC89SsFZaLoKqf5LnpGogAk9 i4TBBmWNMIpYaofqcap6T2yKc41pXARA9LkfZBeiDXr+4gylser4eaEY0wEgMJZlsHoMQrecganL iwV5BaWlbJAQF+6nMlFI9HLQycheCvZYdC8RLtBSQBMkGyPpXs6CamZzuegkzym8Y7OQjKT8y6Nn J2kkc1W1rc4dH1pvmXVBMkeRoFiwD4T4doTa+awRnHnb8yKTZ8XZjmirptUYxkB2ngfpEwW/Sh4y wAWMIIG2/cEBLiALPgGX54Lbu0g1BMEhIWv5L10N24IPbGB9rSe3N9qQK38WLKj39UKN+dRlldVd 8nihgR7TcKhsqLMEWUVfqFeopHCUZWbzVRhhkIfTOfcFXHCEizR9DascQNdfnfNfRYio/nHZeQOn H8IxJm5BjBXi8J0duzE6WuWnVPJATrnyOFGi+1d/aj5FH/EZzf/p9hawNnOtlOBTREPC0MGI2nWO tNtCtekAzxDB9qnrDLBwb4j38iCC2tMwiHBaaNQTcw0rBPxMNjA3YKKE40GVyLiWor9Sj4SWh2ED iaiYc4xWyokkDyyQCXood6rT+6AGaTP416h6PSMhitwJV3uLyQlZNQQ58fKY525vN8QArohvSMNI HZIr6VfEMriJV3CQ2YHx0Q/rLkzJq3gOhR63KRtmP9Shk+KXcS+vBxq4KZXlxB4wVbRiMQan6jmo NjzvqcebQ3pVt7/Jn/HRcecosPQehcSGYw7n0WiDx5y69lc5pKD8VU1uGe565Jwy4wvnfBjplJvT wt+fcswX9TB4mIy5NJyPXN6pEQnPjm1NwylqxswSZl4ShMVub4XOiPnlybBzegPG1BJPCUbLHGJe 8YMUH6EIwZ6mdC4NgMPIGANsXA+awVEjKiVf9JyulIwyR8qtnDKQLALqGQoOq0E7/Ozo9PTqrwZu ZVXqoyiD+VEcdA4LIuZCDveYKK2EVHbhAyI1/KmlvTRMK03VKMZCOuXZsZi0hJibPDbEzEy3AKdx qWPx3KUI8/M7NGEhc495MpCG5kwpYj+Eccd4fkDDQSqxRDg/80m4VyGWLjI8P5mJz8xEY9ApWgBD G5DJlpVaiGjmY8ktoh0dvAix4pNL4/7Xh3TOwXSWyF96b0cb6snNbn8z9cI5ZfMIYVmTbqXjAJVU ahjYLNKLfm4Us69AJDnGrPlNEyjGzHX0/ofYFKcOYTyOeB4JC//g6Wx8T+QYNJrrTFZM2cCo5Si9 Pl9PZL0Ah4yJE/H2WGZQddD0Elx33Bge8sx8oJGH9PSllG++2kSAbz0J9lS2Ht9EEI2l+tLQ93bg 5lQ9H9hlxdyFeKCQn1e5gfFqDg2vxBsNz51Cge09VM8a5W4SSiAxxKsSHo7FA35OKVu7zfmH7eSp ZtHyWSA5HmCE6ME8OGVU0dvqvDBNhyFGrjqKB9Q4A6rFhYV4C1+0Yuoor8SbGJc6lhq3c+mBPfni iV5u9/Dl2zMfEilqDVloakYcypsCKBotAuOeTQmPD3kSd8zHybYXhH4J87/cuH1QEkFA/tWJ8o8c FPQqiXk6QF+hxE9Pyx9nLgQ9VXYzN2Jz5fExW1FfXy11RqYyT68FQ3Bi4h0sGSG6ZG6FKbVNKB2m FovwLLSxedSJSm948RDuGQhu7pP/A77veSfgQuWkyJRG6bCd1HMD3DkE5A5yP0EKhdIU2k6EXtEY j/aeyb6nRSSQh6LAYvO5epdM1RV/apG5F260iP50eOsBiQEi8CEL5mBMI19mkfzLAxpoNit5HOoJ 3LXtaOWun2UKtBesYzsIVHMlgMvhcPjroWA2eOmKDWGIgcCJUv5hDhgxzxXjEsjjJrbnYfhklgD8 NgM4Djislsb5gFPZF8NVCQrhag5t3JvZxsY4lDjBKBC4w4dyVnzwhkWnXmV6hfwx3ik4alhNoMyD +vRbOoPOLjzMAOCHd5V51fJJAzkcS5b3E7r0HMEwMx3tCzo/+7hjlXP6WC+fTNErRvyAqOgaPrX5 AsEckzDigwbIUGaEHlJox+9BiTObgHOhgPXFu01qy9P+hL+MU0ajv3z+epujhByd4mRgF0Z2/uiT N5+gxu6tOb70DNszur4grFnqDq+BKNXE4ZWBkB2zjapcVXDUznAnweXRWtV80x/M8+T0ymETjwSQ Yfna6HiJ//wPr+oOLmVuZHN0cmVhbQplbmRvYmoKNTYgMCBvYmoKNDEwOAplbmRvYmoKNTkgMCBv YmoKPDwvTGVuZ3RoIDYwIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicxVpbb9vI FYaHIk2KgmRZpCnRkkKtHJlyZIqXGV7iOmiaBEGa7MMuDPQh7FPabVFsDCT//6FnhpcZyVIUZa3W NmCRHM6cy3fO+WaOvji+Fzg+/S3/f/rc/NKMYt8Jcep8Zp+SLPSd35uEpHjlMx3xe/Pfzb859002 hfPr2/LD13/BLEHxufz36bPzl7smLBOmQUqcu0/N5a+pk3mxc/dbs1g7cHAQelHohKlz97np2rom K+fysDGSz0xzLJuDJ4OzJ8qZfOTIk5+m87v/wHw+yYIwSOmE11GcefCu79z9o+letFpPn8xmrXa7 Y1hao5XfW21dmun5/UjV8vv8nr7/5q75C/x+aeIsBuV8DDrTjySkuhEMKgof2YD9VY58HCWlyvAo FTUmxAudJA09ElOdP7q6rs/BSokfRLE76qHiKkli4qoa/RyEWUDcgYU6Uo8+hEuMI/ccISuf28tj eg8HQZYmrnzO3o6zKInc94RdhKGfuO/s8Ri1FbiOcJK5pj7/+91fC2MElVrBH1ErpLgRtBqq46VM hY1wlhLX5OvBSDoUYy91Ij/xgixzYi/K4I7z9Z/N364eydBh5nvJmqnfy5ot9WxNMNnLtlqYP83S A9glihOPrEoxVZaFHwvTXMnL48Llvh+KhoJXC6wwU5EgPIiZcJA+MJOtWToXqW+rWiFvkEXYHdqG hRS9gpI6ZhJDKEZU0euADsxSGpFr2M7vFWRLxoS9SgiJXLvTUdBStSVkwT0S4gyW67L5QnBQ6gfO 3Yfm3dVH93bGI6HLJvVj7Kdx5l6hc6QgbYkKOR4Mvi2Gl5dHsuLYkhqzKMMxGJNsmmFF7ldX3pAF UgBwdS9uby+5bV6Lk18rtqUhhYVo5ifgTH3RNfWbD2gimLMhK9aY2TPNsiBxz2VFeNoeI+GqMHwJ ThBjLOBGknl49zVLXYIZmQK1Bz5Uugg/8Eqc4TChauO2qiAHaRK9S6IQ/tzcRTEyxly8G1O/HhIu hX77TLC+qVfGoWLoq8Yx9RMbsM5F1m8vL1P+fLenL1ac19fORfeRlHpnp/f6g9OuiqRzvu5AkQ1D uOzJDlp52pZoweB+HCgIjwWn72NmAIVmSXQuHMaghKlPARPXbUXWhPSov4ebq2GXf+3qRFaWbXHY zUuQVQDBtC3J1CIwmaD9Zn8/UOvRk10AyQ54QhxBVWYFXcBYXXxhUOrBIMi/MIpA2jhYBQgx1EJB HL0WgvIf4gcZiep1+PX3LheuL8fICF8uaPSR0Wrk9w3pdCAu/XjVrV4M/F4mCxaJuSs3GExCkkYu kRtFxg5xAEHslkArHsLQ8XhSPMUBDtwjJEGOOqaAx36YQlK4KarSdRiRKsenSZYw1rUGt9rLjwOo MPZSMGmYUpbI1LQU+5yFUxTh2B2UkV2oUgV2eVXGdf2sxj8rXGtBPZg9FcIhjFOPutIPAapBiiPv MNWXscEYSrBfMOAt1jwEXCvb1ot/dDutk+5pbdue0Tjt1vbrtcyzM341MgHW4kN0akhWZdteq9Ef cNv27Ffcto9juIhlD1F4PaOoFXKjGA8dRab0YyyA+nkFaqA9DNGsCP2vEA3Et0gSC6D1yMnnwBvq lUr0+RnVEccQ6RBsB4MfyWIvi/9P8BMWz+fmT5As9UbrkXNlWZb4UgCWi9ksXGci18AzvBg712EA lAOK0kMO+x1sQtWs9pgnqD3YBABzF5sQcnNBoU39FJjDqNemCJJE6kng/mnDVsYif1g8oBkjYBk9 VdPQRHh5J5m46VMtJUW1DZ1T94pi6DzKBAYwLkgbkMjM/UO1aqd0D6x08/gbuyClNYFgAlqsVyZm 7MH3wqQYva08ldVrdisoAIaFlROf1aYMUzZ1gOQQJSwauIoH5k9RknhJvGJSXpCYkaqKVJWVsiRV l4bUQQO+UX1QlMqNash2umLK/+iW9SoMY5JBObPP+a5DvsJmK5XriDakKmBTYdsir/xwKE5aptVq DAY1FJ8dy2pDK/NcHSayYtsXXJVFsTOq0lC9BE9EZNxTF982xyk9AjMk88y0cpcHabyP+K9PBoMG avHUcCwfLY7lF0NxbpltH7FPUjCOzLeKvollLs/ExI2WzDeW11JHeOqbgwFIWUX2NnnyeeOUuoPb 88WxvB9KtpilZ9uPzlEiKHEObG5hg7uVo5QkJA28dUxuy24ilyls8PxQ6Q3H7LwWQv9925hwgkIT EE4Cyh5CHx+MnoR+5MWpIMWBN3A+pV18tT9rp+bjsxHYZdG0Wi+zlYykmYd3kxHHViR5uVRrMKwX mnzeVg2rKi0E+z7euRna64TjZF2C4jTjSpXb4lnQEdw7UY267BcMZZWMtLr6O6Q4aGIgejpSHtF+ Bx25rnQszvX8NBDPRtjNBDg33p+iFKms4iilnJykFLkMtNgpo7jPZidBK/tsHEH2vNmt6dr2V/B+ Oce+7t9MSinfqCvgtqz1LTk3JqlgKclsp1OibiPwhfNABvfLx0xrwJkIAUhHCU3NLPpYFMV1f6S2 x6oZJYClqskGaDXhReM1T7uJT7xi5pRu7QISxWs58Yc3aFEci92ijfZ+t65AEYQ3I0Fundfpb4G7 swbu6eqxJKfgTG9CqIAp6+YEyUMu+uNak7g+9NmH6K/T8Hi19bXDsWWaGMwuduOf609Sek4U4ch/ RP1xzM829oky4UShzoVVpBW7ie6a+BBvtI6nhztjiELibep3vspdWiSqdgJIKfQHXpdDy3ZmN3e7 +up4U/egYtiGrAodC7ol1q8hMfaQUXkdSk9XP5V7RtGeKbaWEB5efzEMuGOf6FOh3+C1DWOyTyXs axICf9B+llByFsseKg7tmShlj5bVwAUyhNPLoaydq/l9W6mLVpwRSIXuapEsX6oAvDMVB0p+b2vq 23rWssCtNp5aiyOeESCM+mdnZwLkW8OjIR+srzrK1F/KZU0th3+Qi+pSDxj2VM3mz3cXuttbwc+D 2zdCOPKuEq2BD2TpdPjYrv70aToTrAWXb75RcXY0/27fPEtW8MlXIgA4RbXyeyQQF31ISQ/SLPRW hN1oE/EBbmSox4z3lGWatXvG0j4InGqTpT3mDKdEIFJidYkqBN7UXbuqpbeiFlA1OeYJpCBJtHX3 9McN9+zi8naL4V6qYB6N0yIQrquvnPosIHQRUkS+Cqbpi19vQMpYZQ21glck+tSyaF5k7+xjP0CW KqGl1FbQvG6K3qy1OVe1gSSE8rnStpUJ9x1FZbLDXkBQezI7nwOpgyhxX1Rib2tmnqjjZc/WeZXn Ka34UoieIUuVZOHO8y3q80mHo9Fw83KA6WUZ1GEYuid0bqQokEyEjrGFhCRt2IVTfIKxO0LLorCq NqtEcRZQz01jIbK7+tDWikPEMn0Hhup01KXObbn409Fm+WZhmMy4fDDVWEKGYaHzooVdJjqTVoMl MmTN3jzPomOXJf1biD5zbLZ9KVd7ojvMG9zUXWvNGz8vJWkpgKB068OzXr7IqAd7lrHg4ZYtSWii Ic7wt/n4oWP7o/68/jLRIHftfM69Ayn+aDEVUmPuTlgI1bDuH131p8JR7PTZ1dli81IXYrbW7Rhp bV7x3iO7/AIJzddDuwM+QpvnSS4TNlXl0UKmjUM9wOES7e81iVlY8FqDW7jgUD+rCAlfCOjKSplE yi+P/dL8L3GZmZdlbmRzdHJlYW0KZW5kb2JqCjYwIDAgb2JqCjI3NTUKZW5kb2JqCjYzIDAgb2Jq Cjw8L0xlbmd0aCA2NCAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nOVa32/byBGG liZDigZlWzLF0CJDRY6PYmSKu/y1zPVwcICgv+5a9GCgD2Wf0l6L4iIg/v8fOsulyCVNp5cL+9LC gU2Ju8udb76Z+WaZj14UYi9iP/Xf9x+mH6dxFnkkod6H6iovSOT9NE1TmnSu2Yifpv+c/tk7TKsl vB9+XV88/ANWwfy6/vP+g/f2fgqPIRTT1Lt/P93/QL0izLz7H6f82dhLMAlj4hHq3X+Y+rauycqV vDpxZPPy0pUvn794br5QTHniyeuXm+39v2C9KC0wwZQteBtnRQhzI+/+b1P/+vT01Yubm1PDmC2W 2slpeVgaunSjlwdH1cpDeWDz391P/wQ/H6dJkYFxUQI2s8uUMNvSBEwULqsBn29yHCVxXpsMt6ho cZqGxMvzymyw+S++rutbQCmPcJz5jurxT3mepf6pqklIgc+kwEkS+3qBlqokC9+82f71/newi5Ak Eaz33fQ+6K1oPrOFFXdrV0KeW816NPT65vrmG7Z2nBBCfH2FNMlQ1mxEnKZp7N8usiVfK4qIf67v DFVC1YQ4yXz9+t3N8MLlA1I8W5PkEw2+TDKaJKl/qZ9dsCEYTEl9PpxfX98Q+np4pXi3qW4QWIZG eNhiz1YXrRkvdEn12N2siPPYPz9pQE1IBk/7Hj2z3RoWtrmswIV/vpe94R1cyJ6qqYmB9NaUW1uR 5qh6ZlFEOfmko+KCDm47VGxtX61aL+KgBYJtVM8BQqXUD6KLJzxH4DrKkohmBfhtjmCPlduSvPAh CthIEgGl/d+qyHipt/uCsRoaXvQVuX79SqDDGVovbE3Y4Aot0cvhudyYz3dVg24FbkTBP+ctupU5 38uwdnmoeEeLAuf+8yupPCiyMTsOedp7q7miupLKzai993t7Dw/UkPRfddFrXeGcISRLi7jrldVC dvUmkFayoUhoIcRdKgTKV99cX+dPeOzdu2+uOwHsurLosR3K1PLwlMN/qdP2R1AFp33bgNp890WO Kx/U9dpWZoZiV3CnMYF//pm9nBuusYRn/z/HV17kP89V5aGFkaFIkoJlcq+FsUmBn+OuTxWg8sEu t4oq8hlAKQ+2Yq8/Zdz/pqd+dlABQBy2FuwGtSOOn3ZRvbfGSZX0wUcRg79YxMQgYkA5VSImNBYL vd3+Sp6tFcg0c0nIszvJhiILmqLdTZqyZRIaUg8Twv5kIcRvkngPf5/+GHzB3lICWA8IrHZnbGMY FzSHar16oztzpLfaxjKdsE3IjmK4EreuoJCCi+ubG9IOfnPeswjo5eGiyEa0Z1gtzlVXQH0p7w2G r96axu/XjHeNcvst2ktCHEkyv0+i3Jc6CHCQ3JZal/pC3SPNRa6wvq0txTnIlRR1L6my5vYgieOC mZFQDA3AWKAQHObZAC57WZNsVUNLgX08DdRI3K7SVhHqlLTl9VLvmoRe7tFMEkLddusH0YL6LpKE sVcyCBW9RQwAVZCqtXMv9S7GtiHNZaUPFYkZcUaGCmNI9gNQKYghJdpXBzJJacwsUBW91coCKXjS 7DMfx0kI3I8phN9Ye4dHhdCG/RL6d33ZBV/VwF+ezchaCQpKKH1EnaoScjc2VcRWxGVmipypy3o8 f6qstUFVC5MGIVIQ1gLHGc1GRIhG4VCy+3qz4zvBMWzF2rU0/1ovt7Zbw8dd2cXKuTOFTys8cQLr NnZw0KqGS707CAflw2Zi/WHjWHjCIYUYKfw7s33ur3adKYGZBubOnDi7HkqU5Iy146KUw5aG0gUO OigJd3YpnuxwYF6Izd5bUWEUVijklc3kbZtX3vQBsiaOGUxMR6DKDq+g1Lw9UuvRjKYMVYXHCeKd IySYzeSih1tOEpY7xsUti544rGj2yo4WBqwzJ+WDNTHNwIILzohq3mb3nWBViIOVKVh1Ye1Wpb+x zoSVNqVf+gIwp5sg2Ewcy9y1YXqpm39kdOpzKSMsGcVZzIwZC5MUODAUcl0unaUl+PCida81AdPi iyMeR0rFTptzJ9gRDIX5Z5bDCQi6IooS38FCBQLGPYblrYCcc7dxRAp1+BXvOgEc9pBLSTQ2l0AG 0MFc3uMSkOJMSCRsyJ0ZmNZEKFWn1pEVtXFd6GCRingmR7rqQbtwBVb5cOfshCVr9w1h2zizi1GC c5bPoRkdT+2RqkY8Bqllvd6mYSwmoDMzWN3BkM0tYGNxIuRpQSltmMmqUmg5EwgULgQJhUY6PFpe 2brRhRyXbgLHWsUQkoHw2DQOUrwzm+6kB0uMuQwfFZaogP1zXCxNQgvoCiXDrvRKFucUckeqyDOk SOvebjA0qCBLonzEFIApDbNhWYJEKnc6Ccl+hsSiq8mC82ayqx7lSB29StXyLdn5tSBIaiHD80Vm L9SlKq1FAaK0rnb3gIiQXeUrUZz0gMJFlDI2j6o9cU7DIZz6LqzlwtGFgj0Bl52NAhPtk5nKFuxT emOluS0JKcJrutJ6fLlF7WL7ha16XMvVyVaSewjRKB5dmeCMgmgYgIgBUctz3vHX/RoXGD09680W VXvdSFpYowATRLQMV5xSc4Fnu+5qEtrPNXkhl4e1EPRL5O4B4G1HHqs9iQvrMTkas1dGYwGU5mEx JEGk/9gCHK2vIqwTOOilVA+tk38NLofjZK7ueTOXYPiCxUo7te6EBZ4Y2rJDQ9eoZ3PaHRunLlCQ mJkyGTVJ4gTq0ZAyEZhfRBntAiPerBOT2Nk2QVINtjNbXdjldiGc0v+GvboTZixl5Ar2q5IArYJm CnKPbjqmtE6Y1uMrzs7tPm7shd3IqMV5mAwlKc9eIoFgNQuaFnKJZgh+cVO4TEFX7BzgKVqpbLB6 JWa37ppPEKch1rku1marbWJ7GMVFPHqfiauu7DFIx4a3Er3dPALt8R4tDYWzoU4jJ2p9TlLVRLg3 a06lKjEinkr187kqNNdBuOpQjge/K9Bqz49pWxr3UGJnC+xYKo5GRAlnzbloB6Yr2eA9Ng/AoRMp /qFzItU7kOoN/Kod2JNgmAkUCkkmHq2SF1l9gD10rKoehU1F+rq08EJlpaK4XKrufiG7DSdoL84Y 7Z8+l+y1xDu0Z0dYimrXIVid4nQheyRzAIsQkjY7VR0tg0Cc8Vcgj7CxXbCVvQQQQ+Aowyo3Dhys dgp9R6P0kOomYz75Uhdrfu9cF7nGQmqlVEcOdmGiTAVGY4fH4ImtLUnI4+esXOi0VlayWURDLrf9 M0u9jYLygDSk2AuhNgvVuk4wIjygsTzVdY/HgNw9V51i1kWwr6G6oOV5EZIoHjnzZmmYZ4PsEuoF K1CQb2eKyiKC6zb+mrSfRMvtugWgEY5IcYVWqicb+b2BJoJJsC4EWZ6FNEq9OCLReCUafqUM2AEI oHyoV+q+Eb5ZAlGVP07+j0nUObe9Uvg7xmMO+lTekbWWcs8XsJBwr053XCqC2GFtncz9kYAXc1BQ vXdgaZ4wag6Thv1/pX8DvVxhqmVuZHN0cmVhbQplbmRvYmoKNjQgMCBvYmoKMjU5NAplbmRvYmoK NjcgMCBvYmoKPDwvTGVuZ3RoIDY4IDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnic rVVLi9swEKZWJPwIMSGvrrdxtH0sSqGO3pZgT4VSKPTQxdBD3dO221I2gd3/f6jkOJtHQ3to8EEj jTQz36dv5HtMC4ap/9rxZhnfx0JTzKXBy8YqLaf4LlbKyD3b77iLf8af8SpuQuDr963x8MNFYWu7 HW6W+G0VuzTcMKNwdRMvrg22hcbVbbzOzbBkvBAcc4OrZUyyJILoHD7rTOF4NMrh6Gx2Np6hMXyC 4cXzF/Pql4tHlWWcGR/wjdC2cGcprr7F5GW3+2p2ednt9dLhJOp069Wkl4DLpF5Nw6he1St//l0V f3LffSytduCodJi9qbjHpqSDuGM2GzaQ2QYy+xdkQaUoW8jOZXYRK1VwXBpeKO0xfyFJkswdSyVl QpMBAGkzK0utyOzqqtPp+Lm2ohSkHwbgfO2mlJM+RA6UZ5i6aslVmKLtrD//Wn1Yw1XKZ5SyMJgJ l1liXQjrFvDD9/j29X/A0Lyg5giM6SBItjCejqeFn3IhpCZhpEMQ5H5BKKUEyaKLxsuVEc4LAhTk IJj4NVlqWkqSZgis9xhrWUkAbHMZa0g9R/56G7dkbmnfHYI82VKWARBEIIRRE11ry6zPf8CVlhQL r/hT8aRY4aL9ydMCphcorFcDkDf1uFyKjJI081U2dUsXWxkCUbK92rW7IVCWrv40HYaLzKPyUZSQ 1J0YJZsznJYEgkGAdhhMEUyRU1OGDrErUboWFVLQE+pEsuKY2lvoTV3W0pITMMjAVio421HGAuoW guSaKQKCxSCCQ1ivmk2KS0t3A0hr1CZCe/v1PNhRBgpkL0St0Biz5lFYDWUhTocBdkQfEOTuw0ES SnDXT6ciSLBCHGMIDMK8hcM5JznIokmGJo+9019vZtw6RtQwyPJgh81sMnG91OqIG+HpCXb4CKNz iHC26YdWOXvts39g28kNu9khN6IhRfBSn5AbztyNHOFm+xj6R+Zs7/X7+NeX8vBt5I3YGS19vv2y /c/iN3ynPE5lbmRzdHJlYW0KZW5kb2JqCjY4IDAgb2JqCjc1MQplbmRvYmoKNCAwIG9iago8PC9U eXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9S ZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9Gb250IDEzIDAgUgo+PgovQ29udGVudHMg NSAwIFIKPj4KZW5kb2JqCjE0IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3 OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4 dF0KL0ZvbnQgMTcgMCBSCj4+Ci9Db250ZW50cyAxNSAwIFIKPj4KZW5kb2JqCjE4IDAgb2JqCjw8 L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIK L1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgMjEgMCBSCj4+Ci9Db250ZW50 cyAxOSAwIFIKPj4KZW5kb2JqCjIyIDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYx MiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAv VGV4dF0KL0ZvbnQgMjUgMCBSCj4+Ci9Db250ZW50cyAyMyAwIFIKPj4KZW5kb2JqCjI2IDAgb2Jq Cjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAw IFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgMjkgMCBSCj4+Ci9Db250 ZW50cyAyNyAwIFIKPj4KZW5kb2JqCjMwIDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAw IDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BE RiAvVGV4dF0KL0ZvbnQgMzMgMCBSCj4+Ci9Db250ZW50cyAzMSAwIFIKPj4KZW5kb2JqCjM0IDAg b2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQg MyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgMzcgMCBSCj4+Ci9D b250ZW50cyAzNSAwIFIKPj4KZW5kb2JqCjM4IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBb MCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRb L1BERiAvVGV4dF0KL0ZvbnQgNDEgMCBSCj4+Ci9Db250ZW50cyAzOSAwIFIKPj4KZW5kb2JqCjQy IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJl bnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgNDUgMCBSCj4+ Ci9Db250ZW50cyA0MyAwIFIKPj4KZW5kb2JqCjQ2IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJv eCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NT ZXRbL1BERiAvVGV4dF0KL0ZvbnQgNDkgMCBSCj4+Ci9Db250ZW50cyA0NyAwIFIKPj4KZW5kb2Jq CjUwIDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9Q YXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgNTMgMCBS Cj4+Ci9Db250ZW50cyA1MSAwIFIKPj4KZW5kb2JqCjU0IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRp YUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1By b2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgNTcgMCBSCj4+Ci9Db250ZW50cyA1NSAwIFIKPj4KZW5k b2JqCjU4IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUg MC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgNjEg MCBSCj4+Ci9Db250ZW50cyA1OSAwIFIKPj4KZW5kb2JqCjYyIDAgb2JqCjw8L1R5cGUvUGFnZS9N ZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8 L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgNjUgMCBSCj4+Ci9Db250ZW50cyA2MyAwIFIKPj4K ZW5kb2JqCjY2IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3Rh dGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQg NjkgMCBSCj4+Ci9Db250ZW50cyA2NyAwIFIKPj4KZW5kb2JqCjMgMCBvYmoKPDwgL1R5cGUgL1Bh Z2VzIC9LaWRzIFsKNCAwIFIKMTQgMCBSCjE4IDAgUgoyMiAwIFIKMjYgMCBSCjMwIDAgUgozNCAw IFIKMzggMCBSCjQyIDAgUgo0NiAwIFIKNTAgMCBSCjU0IDAgUgo1OCAwIFIKNjIgMCBSCjY2IDAg UgpdIC9Db3VudCAxNQo+PgplbmRvYmoKMSAwIG9iago8PC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAz IDAgUgo+PgplbmRvYmoKMTMgMCBvYmoKPDwvUjgKOCAwIFIvUjEwCjEwIDAgUi9SMTIKMTIgMCBS Pj4KZW5kb2JqCjE3IDAgb2JqCjw8L1I4CjggMCBSL1IxMAoxMCAwIFIvUjEyCjEyIDAgUj4+CmVu ZG9iagoyMSAwIG9iago8PC9SOAo4IDAgUi9SMTAKMTAgMCBSL1IxMgoxMiAwIFI+PgplbmRvYmoK MjUgMCBvYmoKPDwvUjgKOCAwIFIvUjEwCjEwIDAgUj4+CmVuZG9iagoyOSAwIG9iago8PC9SOAo4 IDAgUi9SMTAKMTAgMCBSPj4KZW5kb2JqCjMzIDAgb2JqCjw8L1I4CjggMCBSL1IxMAoxMCAwIFI+ PgplbmRvYmoKMzcgMCBvYmoKPDwvUjgKOCAwIFIvUjEwCjEwIDAgUj4+CmVuZG9iago0MSAwIG9i ago8PC9SOAo4IDAgUi9SMTAKMTAgMCBSPj4KZW5kb2JqCjQ1IDAgb2JqCjw8L1I4CjggMCBSL1Ix MAoxMCAwIFIvUjEyCjEyIDAgUj4+CmVuZG9iago0OSAwIG9iago8PC9SOAo4IDAgUi9SMTAKMTAg MCBSL1IxMgoxMiAwIFI+PgplbmRvYmoKNTMgMCBvYmoKPDwvUjgKOCAwIFIvUjEwCjEwIDAgUi9S MTIKMTIgMCBSPj4KZW5kb2JqCjU3IDAgb2JqCjw8L1I4CjggMCBSL1IxMAoxMCAwIFIvUjEyCjEy IDAgUj4+CmVuZG9iago2MSAwIG9iago8PC9SOAo4IDAgUi9SMTAKMTAgMCBSL1IxMgoxMiAwIFI+ PgplbmRvYmoKNjUgMCBvYmoKPDwvUjgKOCAwIFIvUjEwCjEwIDAgUj4+CmVuZG9iago2OSAwIG9i ago8PC9SOAo4IDAgUi9SMTAKMTAgMCBSPj4KZW5kb2JqCjcwIDAgb2JqCjw8L1N1YnR5cGUvVHlw ZTFDL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNzEgMCBSPj5zdHJlYW0KeJxlV2lUE9m2rjIk VSqigqVE2yTXsVu7FW29grOCQ7e0AoICihEkjCFhhoSMkDAdxjCFMI9hFJBJEJxxnm1nu9Hu1nbq wb793inu4a71KrruvWu9/lerqs4++3zft7+9D45ZTcBwHLfbHRoREBfjIY3YLXVy/cJDFBxneb2I noPTn0yg57KSkWTsH2Mu7LnYpuTJU6o/sQ2xpddOhy+mwoFpGAvH2y48dJZGyqJDg0NiBZ96eez/ bOnSz//7ZoWTk5MgQPbvLwIXUUxosESwiHmIF4mlkREiSew6gTPzt1gcekQQLJZFhsQI/AMDRYGW Zfv8xaJwwfZQcWhkpDRe8KnzZ4KVDg4r1gl2x0WIoqWfC0IlQaGS0FiZwF8SKNgTIQr2F0T4B4os a10iQmOjZYJVDqGS/yz8eFoBc1x/iYA5scBVYDmy2D/6r18wDFtiO1dgQy60+sRuEv63yazZMxZY T5w3bT4xdYL99Cmz2Isozkzu4k8/W8Kbw8ewPZgLtgxzw7Zh7th2bCHmge3AVmCLsL3YTmwx5ol9 hXlhX2OrsH3Yaswb+wbbivlgzpgNNhXDsWnYdMwWs8NmYBQ2E5uF2WNcbDY2B1vKkIRZYfHYDXwd njbBakLShMcsL9ZFqwVWlWwHdi4nivOCkBIvSEcSTJw3MXXi3Umhkxonu0y+Yb3Eeq21l7W3tdT6 1pSZU8RT/rT5zKZuqu3UjVPPTftyWsg/FTZ0OjDRs8/iT0ahyyirjJ5H5ecUZRUD0lyo8OWjLAJ4 aJTeaaQChpgI71xFCeggYTtx4nhNSRsgh+rEX/GRiACuKrmP5adAE+Gbpy4BQySUEa+F57b4ieW7 dvAeE7psX1moxjOJa0O7ae/S7Ca8/iGLngcdqAPbgmM8AOmw6wkk/jh752mHURNUxM+PK5BWyKoB t6GmsvbctsE1vt4JwQF8H6F0B1hPopmPl0HW8e6ylg5eY11lY/MF0uafBKgcs6rEId5PV7xnjf2d vk2N+xDAUa1an0omwrZKYmueshTcIWk3AtwxGu/lk5XoAIGixrNREp3NRr6JnO9SjWqwlRxfQoAF ykRHPbNOXUlszJXXgt9JejEBc8cH2aUcBjatmV5pxptewNIXLJhDH6bQTIeliIfmvFoEbaHt2/+B PDhr+Rs0g6+SUqMXlqK5iH1ox+bAoLrueL70VNJtJpE3g5fv8CyxTtGzzXjjc5gwyoLvtBRcfIpd RsgyM0A6IINTigf49FUiNfuAPES7S85NIgqy8kEBIDsLtQF85ECIWiOLjwASEcsQG81DM+6vghPO dVUNtvN3ERC3AjqdWquRJURrJYB09HwCp0L20L0Hp4cO7uMzm6OIcujRSttcxO+PwrjnrEJ6LlWY ZQCFgGw3aA/yx0MIsF+jcdOTcphaQWzOUhWDKyRcQRwNq9P2AhJO+hlawYVw2rafluwVRnsJ+Q8J fbZXfIjKU86FSzZTzec6Bu4NbUIkYvludj7o0dHMs4jgFpS0QqIDpz+HjtSBTYclu4AHONwkOS/r 0rVlXCLhJU7KNW1TdGtEh1/1fuADDspEoQcDIl2AE4l4d1dD4s39CxDr5aFH8HOq+FF75yVwCdRJ jatIm7EAUJnYST/rTKy0/e09zYH4LLvy3yBOAWe1ahOjBsJODDs5kAR/tl0+d+1C50/gHXgR8cjz 7I5bCO9Acxk0azl25YnEY11hMthCvm+j7MQtxQU9z68lhZ7gPfLqWQ0QBtCkgDVrD3pL3NWrAHlE Xdj6H0Av0bZmvO45TGIYHac3UH6NEYWBTNTpS5EVWoBsr698PXK24UQ/HzFi3CtTuKQy8GpKCc+S lALQS9JvNMRW9D0FYtJU2pS4xDC1GIhBZFFCVXhT/DVwnUH99L1nl1vCdvJs4HOmhBe3Qn8z/sf3 LHiZ3kehqZDkjFS2dFWXaiUVvLKoEm05IGsrK2o7hA17vtkX6RfFjxKmBGeuI53Cv0M3OGCrRu1s KWCjiXDK0RSD+yS8AW0IG3oIVMKabjhsgfLte5hkgfIp9IX9VENGeWYDeATOFPXVXWztuASug15l V2TTkf5V5i8AafcOlXPsniYS91KKtMCZHN9GgDUp2k26j7W4PkdRCr4l6Xgru3eNBkMjnHP54IIl bj6ISFBmZccyEoEWDmFfz/2qc3C+qIvZ/9f3s+zi6NdwAyXl+CDscAyaD8hIji/wz9MZUnMyikE5 CQFcRnwHTCqjI1kLFbEcXUCaQqNUyaUpBxn8l8Fojjk/v5EH53DsnCAb1CjKV5D1nHQ4nz1u5th1 M/nqjUqwjRxniNmmVGz9oJY4upNjA98BE/ztF/yHUVYFPZsqzSnMKgFkfWGSkI9yCOCj0+1SMxDq TMSOHLkJnCdhHNHaN9yYX5iqLeaVKYv1RkDWmcrNbfFVof6SWBdf/s9MWe+LC1a5JXItypGch7ZV 0LEehh3LM9uab0u+h9seNppn2SENHUbbU8c2EglAkZNgiCuwjyyKzIsC5LItzg6ujaLrYfxEmUyu Tw2TqBJAAogvUfckkHb/0rjsjwwLmr3vkfDN/UcNvad4XS3lraALXD7YuyUHUfn2+7KjC0EZqGo7 2lhQmGnIzAGVGcbMfNAJuk0tjW1m01EwDJpSa5WtJNKNz6badE/0Q4B82aYKdt8UiNhfujf11xqM vcN8Jsk8+Iq6YD460NIgjyjjVYSU+IFAcq8kxG+P/7W3DKWnGTFd+n+EvqFjYBLFMEWo18kU6xiO Flo4yrNw9AnH7o+/cvTyvxwxmnLUfKhoi6Y25jL+fpeEEriQeArKFSVrSRuaq62hN9TgJy9Dp9ss eBPeoNLgJ2wNJyMjWZeZmQa4eqDN1uTFFcTlMnCu9/B23tt65NkB/kjY0YTyGCDmCsOl3qFiY00i L74+uVZ1nkxCDkaOoSg3u4QxydKMWr1Z35hWAciHV0duD8e07engI+yqtExRDxq53S3mgfPNoStr eR9b7Zwz+LejcDfjCivgW6p3oLn8GCCH64O38ZEvAXZoVe76j73Wq0hfAG6R8ADxp/+ZtW7+MXv8 ePA8kZoTqo5O2ZvEjUxhJxG5WTkgD5B9BSmH+ePhjF71ye4pzHqxiXDP15Yw621gC9NdrFvx28yW BYw1LGKcoSgzR8/TJeuTdVqR5+EDSWkanV4HUkF6VkZOBnkaneGsaT58Yair7lQbT1UcHy3XxgFu kKLxCh8e+51gQjIHufIef8OEdLZ0vuWebAXTlEqyjVmFgFv3oSAUBHDWarZbPEVrIr7KSymyMAMJ bxhPRcbGSqU1seam2pomc2ythHHN08oO+ptquLQHv/McKn9n0XvHHKl4TlqsRiMHWiDPlRcElQYV hIPDQCgPk4SIZf5gP1jXvxdaud0VnQqoFxWq8uJBDLnTx2/rStez0MaHF8tpRiHsGk5WZUmpCTDm kFap61J0p3QzTYv46fEf33leQ/Z3+PNG/PvBGfJsb9fl472JwUd5LeGlUWVujOAsrXmEpsrxO6Nw +yiLjhmmUjl+GqYfw7dopZy4nF6iBT4kUhNAmqpUaiLjxOoIQAaGt/fy4WO0SEmcSC9VAD8S5RHr T3h/23msrLGR19fHdiRyM4arOopPlnI/+Bz9Sy8ODe9Z0DCGUePpBPi7RuNoEfXxSsIpV2m0GGXB GQJyQI2sFk0g6zh6uJE9fomjRxvZdZw6iNdWQivANL4gZTW92YTTNxmqFUS7rkgH5EChj9FErkDR 9mtgrHwAAGDkgppiw6CBNCGhguhMK9FUeRkSDYn5Mgd0wP5TWJpWlFEEiriguqSgPZf5a6eCqM0o 0NZ4wznojX1JRIEynxFegbGkgen9OvuXSFMalKvPB1wDyCss62Zmn1/tK3pz8qqYLT4KBv9llFU5 xqLyOcVZJVnM9NJapGSGiygCeClVrqmMTDQmwjVXXQTOkvRrIi17v1yk3S7/MC+O0PZ1tp0/bv8R zn86y+4hvfs6JVeqUxWAjNWV9vPhfgKcSm1S1MV1HK50A+QXW3xdY6sSauuqq2pyM/MyDfyMwswC YCAbW2u6hxolXrzdBFr2jTzlsIi0exWXoAwNm+3aL7zU31N96hIvb39FfA9oZ45+tItEy5keLE5N jlfHKKXJ8YAMkbb38XMJcKGnA07pJz8WtaMJhy0zoZ+JIwYJZeJ+NAN6238PrZnBtKw1i2tCKxVE c0aRHiiBWh0XLU7Vq2WqBGWVvbRX1g6MoNRoaM5iUD6iKCSaQZmq5eBrtMAecZBTRIBWF5bOVcCF JkKqzjPmG0zGKv5jOPUlEuTqs/VAzwUyXVpYhiUTbSs9+Qp+axQm/MiCX4xtoFKz/RWRKQdVXInF LPKzcoEBkN2Fyf788TJC/CzsCbR/DyfA+XDqpteLd7sH+ybw9lkdG+w49Wh4A7JBrAO7nPYfqq23 jBhw3xX8GCyiXGHmFYbQHE01Dqf/RkVER4kl9dFNLQ31TS1RDRF85hNDt7J6bG4VDruZGt7JQbJ/ bWfftBSTsmHMtgGvewuNby1Sd6Q8gb88KMR9rwgRAE0ECG9DEwf3dgpPxoyAk6CvvOPoyNkuZkqD U0jo7wD/hmbx0qOo0ePMnCtCIqFg9Wrh/8JAGHIcsp7zP3CBw9DnLNjPxEY7HdhKoiSvODc3u8JQ nlsEyOpCRTjfcicIS4lNSlYkK9P9MxnhNZmI9VlJReAESb8jLFEe0LX3cPjyOYuWwrmUKi/IQ5V8 CHBRCgeuhy4/vTr2ADzi/rb24XzP/XFHgnjhoYpwuUt1qn33Lx2ttwA5et5jzQa/ZWtW8tF25M5W 07MtURmDe3nRFt59LLo7y+4W/AJ+T10AtRl1yZfjjnmA7eQaj6+3RCYY6oJ4ERVyg5zRtkIZH9IX d/vh44aeQf5gT8MIuAFOJg1KWhJqEkuElaTds1uD9Z1nZj/ddW65j1AeHsyLiFRExe0xpdn3fHu8 7Qogrx0XugYrgqOj+RERUsWOmA96rYaLrtIbGHoGmBuYmOm9C2l3IQfdGHdn74LtaN1DuO49gXZe pZCOA3XwLduSfCd9/jEOx5gO+hX9hILenDKQm51j6PrJPtmgiNemxjPwiDgIR1rm1pIJMripuekF rd06VQ8PEkGnvwGfkkt3b96QIDfURPDCa2OLmFqSKNXRosGY+6N3G08O8weOV58HD8DdxAGfYWG/ Ry2aVG1JV2mmrQbw9lcw9wWL9hjbTCGO1j1xqzfCNrohDkCzwarGL/t8uoRnYi4zvj7t+RvGfGZs fYoIYbxO5MpvhEsZi8LgigYSBaBj1PNhZzQdTQjcve1Lr9dw+ckCc5WJX13WUngUWLZLqabv3sNp r7El1DiH44YWl6f03awwngVcGMFBvuOv2Nc4MGRs3gdQzGM2ZttzD2DMLc8Hs+x+h300Qf16+mgv uEl+53xxMcLX7nT4ulLy53IewpzixGAHueTxDsjm2b2C1g+v/8G3+x08DB1CU16QsgXUt/vrgsFe 8utDh77e5D3yw9Wa3pFB3tBDauVI8AA4R44c77lys0+43UN6yEPES00HIC3dkjDU9tFWZrz5Z6h7 x7oQR0Er49nKm0P/eHAJTgNwDgmdlsOJiEKTVy5Cc5DN3bUQO9tb1nOaF4DWIJYAfR5FwgtwjAIJ acmaZGlMkCoYkJsO3IeTz5ddrG7gl1fVFzcB8ofjq9F6prpbNJAFsyALh5/Qwr+WP0JWf7WEhCp6 XxX0rOI0T3o2ubnA2vpZhfUUDPs/TKDO8gplbmRzdHJlYW0KZW5kb2JqCjcxIDAgb2JqCjQzMTIK ZW5kb2JqCjcyIDAgb2JqCjw8L1N1YnR5cGUvVHlwZTFDL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggNzMgMCBSPj5zdHJlYW0KeJyNeQlUFNe2drUt1a1GjbQldNAqYsQhDlGjcTbOCsEp0agRERUU ZG5m6AmaZjoM3UBPQDMPLYIIahTjEL1xnkBBjTFqBs01yU1Mcu/dlXd4//pPNahJ7nv/+tdhLVZ3 1anaZ59vf9+3T4uo/v0okUjktjQyThESpJg2dV1I7K7gJRsmvx8ZviNCuDSW9xDxI/vxI8VpeDP/ X7+vdRlF/fj7ocGVI73aXPnFw6B6KKx/leonEm0LXxoZlaQI2RMc6zltzpypnjtiPHdEeMZFRMXt DAuJCQ4K9EyIVIR67kzyXBISGxOrCNoR7ukdsWuKp+fisDBP58QYT0VQTJAiPiiQfLs0MmJ3SGBQ RGzIjrApfRF6Tpvq6YyRoqi14994fcBba1+dvNLFbYlo5NB+a6a5zvCYOYIeuGgKK3tzsFg6afGQ d0e5vyN5+73+w1/z9h3tOeGVqXPmMvJ5wwbNH7tg4RiviauXL501e9l0n3HcilUUNZkaTX1EraWW UXOoKdQb1FZqHbWcmku9RY2h1lMrqHnUVMqLep9aSU2jxlIfUKuo6dQ4agPlTb1Njac2Uj7UDGoC 9SH1HjWTepPaRPlS71ATqc3UamoJNYuaRG2h1lBLqdmUhBpADaQGU0MoMTWUElGvUsMoVyqYklHD KYZ6nRpBzafcKHdqISWn3qVeozwoJTWSWkf2iupP7aS+FvmLfu23qd9/iSv7e/XX97/ostLlDh1F fyMJlpyTrpSaB7AD6gaOGqgaNHRQ/Csur9gHTxt8cojPkKdDNUN/fnXNqz8Pq3Yd7VokGyWLkt0f Hjj878w25smIySMOurm5XXWPls+Tf/ra+x4ij/UeVR4/jpSPzBt5YGTryH+MmjlKP+ocO59t4qZz 5zwneAZ5/u11r9d3vP7l6DdHZ43+dPS/3tjB/zSE/wl18L6dIhh/F6ydYj4JtjB4OLbyvl9KDtvz 91drLDGZOoS0HI6iAxOz94aVZh7hLvb4rqF3pGSFxZo1NaYihAwcv5yuslqrOZgpOZRt3xuWmbKD dT4dpFfB0inK5X8RQxxvZPDcHt9MJAz5XrUuOtyWcZCD4XRref7+hiRjEOdHHwGpC+TSx7HUxZ8O StZHhpZntXEgp/dbChvqNYUhWdkIZXH4Az5avV+dG4nkmKO3xaHgqDLdQa4dW5inYPkXtriQ9+NN nXxBh8jBt4qhDA9jwMQXNOeWFKE6ebXaHM3iwXSoKiMisiz9iNGIUCGHR+Iq7AZVRiQM+aGywgaH yhBKvqej1drYyNL0QxysxL/Nw1NdXqcVGk1slEXn4CCWrrNZqh1JxgB9OkI6rnft1zpW33aFQV2Q cMdNdgwGdTCZKIsM6S6yrFirpsFajFAB9y19sCSvqV5dFKJPzyGTYbuk68bR81daAheweLtEjzLI kAar0qNCbVkHOKDoAySuWmVxWDrZm3QOoiXg4n1xymb/uO1+bJNE1mFJK0pkt9H+cShEYUttLCwS 1kZi0nTBvTuiTx6JeTt8xjyRHMmwhyvUaXEsQjk53Mb6j2ybkRR7vj4Ge2CPf3rBaBgI/braK1S2 hOjEmIRwLjh2lzoQSb18bvz4tPP6s3PtUR/u40qiTJpKJK2xWmq4F5D6mLeKvycbDlPxXjwHx0fk qFJRrDzepqpiYQS9z2p01CuLduvSUE4aB0NhEQzDi3RIl5uO5HtUuqgIq34fR26sKrFVVqnMkbkc XghJMBX2uOyzmmqrtZZYDg+lY5Sq+Di7qqnAiHINHJbgaVgM0ww5BlSA5I5SW5UAYeHGWK0mNsac 2pDjDLGTX3tNVMg/EsNZSGc84XxabUoRgdI8Ol6riY+2pjfn5yGUz6l61vWmXx6sTo8ieCcQH0U3 lxj21aUU74nT5iCumJ/9D9xcHGVNq0fyBmQtLq7/AZrdzT2z05Ew5DuT9JHhJRnNwsxqs6W6Xl0Y nJGBkJ5T8evyUR7KR/Jma2FdpdYSz82lI1GKLk0h7UWQ3wVY1ekKr9yFtId+j9xkXfDJCAuyIDO6 iD7NP9FyuLG6HZ1CnXuPLauVyvijtVVtp177edln+HUWJ9JxBJ+hZVlHuNIe32Q6IClnr3MFMh4G w5cMrILBkruH9r6/2j9yKifr8sJWBvzARfLvswnzFmyIw/1fwFgEok6wdIhhUwcDlVDiaCipQeXy /bFl21hso/1jtZHcbEm0RV29P7+yna0FlQTvx/sTEpRKFCOPKFceZOETurWiqIm7L6nTWmNDs+K3 sQqJAMkb8N110bFH8P1DMf8pxDHgMe4X/BZ+a+xYUowjn42Ft+Ctn5/BSBYX4QXM2OW3fvyxs+vZ s84lb05YvmysE9V3fTrgyi0Y0Ol69CFc6HaTOWA4RDI/Xrry3ZPL3tOm+aycNsP74nesTAldOJL5 O11ps1bVqp7XD39cYkszJrLjSI2ThFVmtXN1eC0ddHxj9SpSDu7jvDDDyRx41NOJMLTjQsOJNnaX RKZMLtCVsM/x7trKV+Azd91kHfykDmYZvEXDXGjt211ZQIutsGF/cv5ObiGd4WQ/aaAyey/BzAFj Ya7AO0NxMB4IwUZkIEPeRup7n9IQwuH+dGBC9t7IkvSWXkDKOmAWbnTB7yyTbFdmhhNcEf5U0q0E kY3J+Tte1t9PHeC4IYb5HQz/hgSsPRtKo3JyCELzkDCkNZbcGo7XSoT4yMcWa1E9KakYLUlIJocH 0HuSM8MUpanNdjNCRq68ZwSNc/gFynp9QSiSb6M3RuaEhNVmfsb1+EqyejktWEU4jQhCASEbMwdD 6DYiILUpxSF6LUJJQmCqO/zua6K2b8X8Vv4C41ex3exP0vsOHojd8BK8El7Br8L0y6fLDpzhWqrL S1GVtEJZEp+cEJcUygbF79TuIXeLZj0irDTl80fgcvXknm0Wzrw9I+YIkjqM1rrC7DZ0m2vOLglJ TE1PTmd7BQBevQXnby/vdH3WBRceuskC4d5NZqrv1W++uXz1yXeXfd6e6rN6Gie7jyfhzQxskhza dkHRgaQw/OljGAGjvH7Aw1dvjPXfzvWhZJFTCRQlz2m1p+B5BnYmpQusXsdBGO2wkIRqLAonPjtg 3BVgrotO8WliYKGSKb9/+ZOv0D10aXPxAinueo+B+/SFStQOoqn/xOPxxDfexJ547NMpMPHazdKm 65zDZitBFVK70pa43XcNGs+ORWs+zXgqfbHbj3kvMawV6HYXjZt6JqbE6hJRijy6PKmBhQt0LTIX 59YUwnh3ZMwlyiZ1pFoVwTnKgGw2A9MuOIGGI/wsi91YikrkDYm2QBY30QqkTc2J0WMPdydiswgL ZqEcaZRJXVNrMdXkoaJcq5BjZQcf1iE6+A388xsxnDnDjF72ECbBpBsPgfrnzVkkrZOWzRrNQRlo CeUQdh6GJ5P6FuFheBXZdBfsChNhMpDvYZXwuOwb3sKSVt5wBeoOtN93kwWD7whZU211dqXHL6iz /PSZ02ccd9A3Ulj1OvTDMxL3IPQhu9DpT6JsuqaCAkFUZcEEmn21tlfgbgvxKkYBzHdJSfhKZGV5 FeXI7gGzb3njqXjK0hV4BpmUiOJz4/Okf4JOh2vbIzhPaKWLX0JMBKkOhfq58IfRdVZLda3SFJae 7uSSAkk+Eob0MKlhwWRwi+nENL2K85PIfjy2fWP1ag88fMxEPAqPeDoNhndcqG0/xMl+xOdhCvPN pauEsHzeftvXZ+q09y49cbJLJ5y6CcO7XCHo86XERlzkN3UyeAacgoV0rc1aXa2yRHH4XVoWlWNC xcWvdTr2dX/cpEE1bHWZrfLAnpJleILPR3iANleTq+EWOCku1qqu52QX7+NTs2mFiny2aeo5uOVc ivN5vbw/4QokEG84+i5kPRBDdwfjBRMe0TDz/iViCwbOvYxncjjeKax7y7OPcc09vr50jFYb2yuT OqdM1qhMYZwX78s8pn85vfvddzcFeXHT6N7nh52HOeT5Q+/C8EudHeLvRvDj6CqL4CKHSpr0JZGh WUk72fnYCmEwXOJU4UzpDkNSnSPP3sY+kRzKtEcp0lV7s3PTkJLFw2EOWJfTKI3cly0NL1bX1Rfa GlmQSOo01ji2Z5yTScPKiIFt7PENo3ckEwNreW5gnyvdqnuusKrLTXYQjETq/CVXu8+2nUGtqDK8 Dkkrq6pqWvbUr1ngHbRwDfeAGC3CCEksFvdSgi11v6FYIL8mfG0mHaXSComtExLrMBc21GhMTjbA m+4AdxsOdhFKunaH/HeT3ecz6xjg/zfkBEv8DvqVbyHsN/DN6dgVD388HQZfbq8kwFknGRu2zSs6 qhBFsLGJSQmhB9S3nlyrP97COVpzP0ZniQvKRwVSWTAOhn8xX51fO2f22nXvzFx34cuHF849coYz 7Orev9Vf5UM7XJ0l7CY7AWfOMl6LHwhF3P3wl1+6nTW8aPZYTrZo4UZm8+ZQBUqWJpcn2ioOHUCX WdmJ0ydDz3gcP+Yot6vKVIkJSSiS3Lpnd/UOD9mJLSgwNVR9+pS7meDTTHh1OohgEHjDEiwFN0J2 47EUj8BLyAyEx9zGNPQPfclr4HEXmIu3ifM42cG8Q4DA0H8AQo3Ruo+FVyX1aZb46IykHZnCFRYz BAn2PyGB2C7iOl37kLDMaYxiLNr6fEIIpl44OG9G0nCNLpqgoooDPcGipZrsWlSWHqFUIVfay+B5 D9wuib69DRX3xV8fYMKsKdXm0qKSavas6oTuKFnekI6LD39Y1YqZfG5i3gcGdFradrDp6qkWzd6D rCPapKgi2ltctp/7TNKkLY2LTk1EKlaFAquWke0dvOqDuTNubgW5rVjAZHeLasv27aHLvD+oaY7m Emvz68ORNDpNFd2H1q7b/yQZGtANSd1iGPDX5qJOcM8OE+mZ/qOxaOttLNL6GgvCjpGmdIdwfy+Z FfeRmbOxWPW8sSCfnH3FYieHKGxpRABzevsKEozPVdhyTQTSO8SpimEDKR6fK5JjqCzlwIff49Hu ZYoiJamgM88dcEivA54Ab2pLNdZEi/xB5fHPUDc6Ed8ess+/bU3+bJKPnWSjtHGxltSGAgNCxVxD z7rI/9yo2X/24/y6/r/Rj4/u9X5vW8hUbqzANcobggDbr4mav4WvusW830Nme0KgNlBI+bRvYRxM ufsV0BeOh22p5syxuXGNSNpQbGmsQ1XIzp3LLCd+QpeSzhLHYhIcyyw8ALsTx+IDEjwElj/srrI3 crYiIqw2Um9kSMFD0uezGoqLaqp0pmQO76Fj0tMV8cXacsEckajSbkI7cdZz7oj5Ffx8Bm/4if4k syI4WqOKUhPsZrLjNkr8ErJCYyyp9dyXeFYv8jOQf25gWUTDR6djbiPi/a0Xa1psdhuqltpTypIC fTah+exM/enPOZgFH0nqbWanOL3gt7/DcFcoejaLqNlF+Ins0v/p3VT8hpPDnErwPb6GJ/TylwAj fuhL/pJNxbl8BbPLpDt8PN986lRGib+/XukjCFXyNT7umuire3DgCzFML2NOxB3TnCQFMeqbLqC+ W38W0yXcAtMi024HOiG/9OnRL04fSQirZCvD9HvakLSaSFkeykV5XPov2XVZ5mAkj0vTJ3L+9kDz LpJz12nz35xwxQ9GJHG3Ui+lNYWizfK1G7bNWL654eN4NqnF0LqTYEKnihRKIJMzYpe8YEtKA5LX o2JTvqOvndp+HRaSkiG+Qn1HDL5k+dtB7awEHenUpAGkU9tbkX2Y+5k+VC505IV7MzMRyuCIX3Bu LJI22Zy+rs8oT6S3x6Pg6NK0lirik0mHitWwUFKECsmQHi03OpoS83ZyXn+xJv+bMfk3fdBe0PgC yCTk1FurhU1z/bUbdN3CEcJyWMWAWoKcqZJW5ZiinOXoFJ8+P4qjJJg+s/7f549UHzrF7pXIgjXF unK2u7e2XzQ98I3Egewh7Bt0lCY1JsakreOuY39admyp7zbvd0Nav3Da5413+YxezNz6eUe3031c Z+ChpKkPNVV/UT74AP9G/1WSVLdA3H34Si1nbco9iW5JCYjc+SpmV3EfiDJfgqi3l2rnC/FxoZeC gbwrUwAyF/Ds8V38n6Vf/xeOXsT7gidtwLLcHfnKZqHxEq7n5RSiEi4DZubUaE0KJO+Z3+dtM/BM 9xwl2XskjSHPY2UdzSi/JPfIH/Sn5K6Y39jB4H7kyf3oI2UFjS93H594aSlA1OOLRS9MhbFI4Cs4 4cTR88YsuYIf2iGq5M+K75JlwQzMW8PN6iYkP4BMFlsjzATevc8CtD23AHii84Qqwp7eXlycSzKM X8cdWAYd/3FCNerlCdXzYoeBZAUsEYdgWMscPQReeLpCp9agJHmcNY00Bu7EQRJMaE2RXACNfcHv 5qUD+5rKavLlrYaaLNQsrVKbFSx2pyNVqYlKk7YyTXj9QBf4tXf7pzxvmI9xFT1ZsXRAYma40/I8 pkutJQ1CHCmd/FbSntyDmi7xY+H877wEj3o0B1xhdOfn8DYLh//aguqcB2iYcragEeX6Y0XFQi7x PgketGfdhI8Cqg/FsnFtqA21S6HSWWxGJP3YbnQ0J+Tu5Hpt3stiE/rOS/yOTtGZG2AkmzlICOJT Ce4XvHnK6oCmkyo2ozKnHJU66ToXlSBLZnGGWVuYgqShKJHkVSJBkXlptaozEWdVlwifjT1zHcZw cPWy5EgpQQOJOFUncASufYmGF5udxvPEukAucxUrisNNageSV5NerLAG+vH93BvNxXXVWnMih93o MI0+MqI0/bDJjHKt3Bzcvga2p+1LtUYgeSwBa3qsLw5xnwXtFmKjTEj+cVmhw6E2hAlTFRpNXLQl rZGD/pjve0sVspqM1X1AziIwqCQwqOSvMT1Z2EPygtuh5yW340n8cbq3rGc+l3hS1jkEdEIT202o aPblf3S4Xv8cym67yZr4qZcYQ7iLTBlfYNHaPe46CcaRbNjJKSCahoGE8ofhfkuDQxQlKfbWQ4dR B3v7QPCiHEQGt8sUZAgivO41dw3xlU0zr6z9x/XLdZ98ymaRPuhDyfZ5H7z9fmDTx2c/a/utpVmv bRLIQV/B6zpFRfwD8Xmh013VE2ANKYwn9VNP1yBThfUALOMD3PuEt8lKcquxxHF4Mh2izAiPsWkb uas0fqdnIZ7LL3Q5QzfazDW9hyzjnYYw0pZ+8OX5CQwjCrGNKMRkyZlTn6S3Bh5aIj82p8bfoCtW GjOJizvu5B6nRmQI+z8XJm/5dnEJrIf33HvPfaQtJaSKnTGMoRWpqQoFicFgRLlGDgfgrS6w9Y9S 0RvKvP8vbzrvz5bnxTHdYb5aDB+SoPvDKzAUv+ISRUcoVfExZalNRNM+LjU4qtRWRU42QtmkZ4R5 4AljDciQU4DkzWXm2kqVNYHDMjokJVURa9e2FOQLR07jxoz+1eVgOTESKaYQUl8ByfqIaJuuJY9c zePgLTwRT8fv9JpP+Z7E1LgYm7qCg9foJruppirRtjcjM4fkp7eXvSocid/ogpGd4O4EUQzUMjhG EmpLrmfP09UkpQ0q4+6sLOGMX/CfdPiFaX7BCbuiWNWh8Ap/FITC1dERUllHTXaGId5jER2t+ZP6 XZP80QZb+myw+U82uEoia2q215Tt8zhYH7FFj9SIlOBOocUkqiwNylPuZy85jeofQtku+by57diJ goDFAhTT7q7sgCs3YVCH67NuOP/QTbYZlvLDGEjrPST6q0fuyZL81Z1/S5cYisq4NhLLR02nYm54 gNvPv4IMmAnPsBsn27wCbYjZvU0qa4JJ+Boz1ffa4ydXrj5+cnnV9Cm+vlOd6azgU6+J8vjvxLAU hjEf8u4uHbTDZqquVxoJcU2nVWpNfJxVW5uXJ+xUd09KXkpeahmSH6TLkMFQUPIUHrv/C39rUBbq S4gK0TaUX5RXdoNXPi+iWqu5qlJtUQkPC1Xqo2JtqQ7uLr21x30SHNfbMwoSiE2j41GmPiNJ4Brt HZ9bMKYbNlx1/far0M/dZFnw9FcmSqFQRyLp1qBDpw7aG9vqOVksWdMOpiTRrCzUWJH8MG0zW+uq Us1aTkOHHylttjYXNctrDURFa6TVKpuaDad3oeKPorzxYJjrrjiQWIfqpfuqq5sPOfagKra0qrLG rjHHE7OWk8mFlkWZI5B08fsbVwaX7t4XwMmyVm4O9fN5bdrVlV+zstjT6Hj50VbnEc/mit/TK0Tg /4OYH8PfZGy6Im1saNjqIHb95MjxCPcjfw3jz01uXb0/rBpJzUXFtvKoQ5E3ubAvUu6irxD0q3tw 4EHlyYpGVPbH5/3tR0IdeDGjKkozV+9vvNTKnnvq+IncTv4iflr/NOhSaGMskmp1OlVi/a6GZVzj vNIFaCZ5m2J28Oz4LfHhpMEWnjcNbolgJUSKIRNGMr44N8d5DidHOoPelHlA7Z6fQwYqRkVGgwle g/3u+cZcA8qXGvUFqawnHYcyMjLihUfBiu9Fd/iN4h9hBcNPoC1ms4U7LbHoipRszwRardNpuE0S Eq/zRA+egF4Eb0G/W9BPDJvgCbOPLkcFxXmVJeDt7oRGnrRUmOtDK9N1KdmEnbK5EuydF1+QVo7k 4DPif5qQ3jtB958TyDvTYYkIdsAGMez4gtnSuvvcudaWU6eCWtavD9q9RQiK/G2o+N2fpJfm5WL4 QM3Ahd8n5BvziA+SlyfbkhJSVREqFp/7b6+s9Ox0pJcnlirtlaaSeoswPaWDN3aKnt2H1C/FcCaF gUH3YQDsgl1zYQAehAfNJU3dLrzrPh4Agzj+dv9b7TPxfDx/24ylS/2+hvkw//hXt/rU4SCJwXGX 9A98JfNdlUtP9FzJtvjs0F5BPeaUwf3xedu4BXwtXaGzaAjrZOtY7BUYr9dqUIo8yaquNBhycw3O XD+EXBFkAS2GVnjINNIVQt6qSmHN87yVpZG8rRLylvw8b2vy4grSKpx5Q3f5lBsifvQjMbiNgNt0 CTKb8yoNre4oP7eAIKFOZYuPV6sislgcQ184RwjG9bduBFL5L3PvYZG3T/SunaxSmZOGEqUhhuSa 5kJHqYWtchy2H0bSy0f9ls+ZsxIPx4O5Fd6Be1GINLxM3exM520+74Yrz91f/cBNFsAPhm+ZGzWN R9EN6ddLu0aPX/jB3iSb2r7v4Gl0iz33cYDv1pDdm3XcZp2yEO1BAXW2k2lSmeG89kDA+tdWbNoy f8GWk6RdSEhRJWz/yu83cPvqAYg5WQC6F3BuYWWvi/mym2dI4r+/JYYjI2C6M831KYWBGXrhIOHL w5JKZCwuqCyocM8rIo4wX2pLNalTjMkogVXwEhqVZBSl5m0pcs/IFVovLcrI1KnwTvyru06dqkWx 0hBJgim1lIXEOe/TCm1qTKQ53cEJP0jh1TSshofC78mbLsPki7D0bzDxoghE11uugPSamB/Jb2X0 KCNXj6Rea1ZPmn1q08XaWqO5lrMpzToLklaUl1eZ9SatjSOKD9N2fu6Jhy7AQ7AGpz/AQ2HUjU/q Gm2pZk18RCIKZEd/+BuB5ZpTP90727h1qvNIi8MR/eN1KZla0qIqGk6cb2m7aDSiHOfRS8pNOHAD PO6I4JWbkESw/YHQW0wn0rmvzFZTq7QSJUB0mCo9lsOZkrD8xBrH/qPoDvv5uTXz5q5fO/3dja0o hktUpiTv+nwPSED+5O8wBKSzH2NpyG6dcqfzjND7wu/DLxCefCiGNjyY+X34l5Jyq8VerhG8qzsd r1Ilcf/tK0myqSqFrqLcYim3q8k1ZwMApTchtkL07HuIeiAmmexiyoC98ehZeYf1ZBwx8Q3xhvfx GuIVvXAMXvQIUwSjoruPYCBI33k0bnNArH8wa8YjmNvHT1+6cnzjvPnbtqx576NPHzh1uIJ3dIl+ EQjhoomBxXyF0V5gRSZ5mcSeVpjE4jt0ItKkZidlbHfP6ZX3OJO2utpcsi+PhVwab+ixZ+tz9ChT nlakt7IH6F7rZibVY7RL/7D2DrL2Dr6U+e/hcySJam1SokVTzoEbXVlis3O/+0rsSls8S8x4okab mGQl14S13+CtV1x/+WLxPUi8t/gLN1ktbIcOxidyz0bkLcXUF+/CIBh4//a/O/ac8a5nZZsv72s6 ceW1HxbcxRIsWbB4PCurRe81+l0Jlco2p8AbzOX29hsdx7au9d7q773Kr/0KuZ6B25nOE0c7O0/4 r1jh5790ybYTV4XM8BshQUQy+UwMX/8+idEXagxKpETaTL0Oj8SL3DP12RkoXaq0ploMBbkFBSyM FAYeWZBZkGNAcovVVFKYbcg0OhdSAbE3obRT9NMDiPpezI/lFzKLPtq05r1tZ764d+zkxSsnP5zN mrAbk4zZVbO9ElaqN1chP2lUZcYZ2ABDYQzEwOIZQGFXTC18h9Ct9NGsn08drjrWwvZS/w//T/aH 6v7/kyLweTCb+HRoFvOj+DzGWodVMDI7Nys3G8lTkS4jIzUlwj2793crnUFXlNWnqWdI1pe4El3d RXrejW6ydeAPv/a+tY28IbDvDbLKVpzCrMOqnCwiu0R0043pxVn7NS9Et1AQXVcoEURXoFqD3pDG ju21Q4nSIcll/CYrSMoqSgsJ0DYhyfWBXYMo6v8C6BDIDwplbmRzdHJlYW0KZW5kb2JqCjczIDAg b2JqCjc5MzkKZW5kb2JqCjc0IDAgb2JqCjw8L1N1YnR5cGUvVHlwZTFDL0ZpbHRlci9GbGF0ZURl Y29kZS9MZW5ndGggNzUgMCBSPj5zdHJlYW0KeJydWAdYVNe2PuPAORM7DEcY0XOwYYu9xQqxRWNv gGKBoSMKUoc2yIAIbkA6Q5kBRRSQzoCxBGsS1GfitaaoSW7qNbGirOPd3O+9fQYENL537/e+M5Y5 s8vaa/3/v9baEsqkFyWRSAYt8g8J9PEInDJ5rU+wm/fCjRMW+vu5i7/YCtYSYUgvYah0D978SvZq velQ6s9/OvY7NITfZy7MMIPKAeA5kJJKJNsCNYv8A8IDfby8g22mzJ492cY1yMZ1t03I7oAQpZ9P kLeHu02Yf+BOG2W4zUKf4KDgQA/XXTbLd7tNtLH50M/PxjgxyCbQI8gjMNTDnbxd5L/b08fdY3ew j6vfxE4LbaZMtjHaaCNa+PZLiqIWT54wRvrenFEL2QFzx9oOM7GXWZmN5vta2iiGTplvbjHLrtfE IdzwDz6UTB80cPHs3n3mjRvPyBe8bzptcL9JtPWMRSNmjuw/laImUMOpLdQaajE1kRpBOVNrqSXU HGoSNZJaRy2lJlOjqPXUR9QUypbaQC2jRlMbqeXUNGoMtYn6mJpOjaUcqBXUDGoc5UitpGZS4ykn ahW1kJpFbaZWU4uoD6j3qN5UP6o/JaUGUBJqIGVGmVPelJyyoOZRlpQVtYBSUIMpa2oJiQ9lQpa7 Kdkg+aPXkl5PpWrpfZPhJodMh5nW0hZ0Lv2IsWMuyJbIDO8Ne6+ut0Xvw33G9Knua9/3Xr/Afg/6 2/f/+4DMgWYDwwY+MZtpVmr+gXm9fLC8Sv7EItDiARszaMGgZss1lnrLR1azrbysvrNqt/pvxRzF fsXtwezgNGvaerF1ifW/hswdcnYoN9RBeNxfeIzaBAooCQyEARD4UnpvkLCGNmRnVfMwjjGoi93c o8Ncuek4UKCamIaivIb6sHw3HnvQbqoodzd9dAPf1E65kG9qN+M344qXnoKSrLlPwFKY3cYWXzIF L7povWkErQyNUSqL1QYeRtOGYq2hWqXzTkpEKJHHk4R56pr9uTuQAq+gXcOi3ZRFZFwDjS3bqUSU iJKQwlsV7t0x29w42xCaq+TrYCp7A5Q3sNKUbI4dgRIWtUnKhAapkCE4spgxbuqtV1WnpiCUyk/C 7tPAPRWloFSkqNbrq42r4IFvDYMx+MdtY03tyGt1p8m+nZtqlXwIDduERW8vIh4eKNjbNuGl+TPo B7Ogr6W8TEgFioVZDFhsuTps1fagrX5cHSO/rtVkqrgPaGWYWumtC69OSRV3xXuZJCQ+Ms/wcC/i 0UYe+tGN+ryGmnCdZ1ISQkk8DGPkZdcN9c0X8z0Xc3hY1wwVmVEkzuj71gxiV8xzKG6VnIAhUmG9 MJ/dfmSr1hHJ8HibEXgwtm4dBTNhyJOWS2WqoiC3HSvQaH6648Vv75679PVlQ+iOUr4gIE9dimTV efp6/jvmdGyJR2Ckeo+G6wbQ3ldSqcALJexEXD4eytW1qnwfpLAzRrLbq9HdsQwnsRQjDL1oQxFB QvhrJGRA8w0cmOOjVx9HiuNIr82pugmBVhm4+d9OjRaoHjFpCMtz5e1oH6SKUnvKRFNbYewjGPDC /CEJziLgRwNnKb8FlwflohzytKBzqadrDBWHTqJm9LedJxaXyuRC05FD9c2Dnyy5hG04HELCZTxO Vcdx2ilGtCgRyXwINInzDbxcIGu3sjDgHnO1PGKHs1f0h7z81scYsTD2G+aXk9Gr122NnGCEyiPI fCS5L8ySQvwjFqIgpVCXWYiKFBUqnRuHDfRWTcImfhWjzAo1VBYUNXKHCSVxLE6NitSEoXDFzqKI eg4u0qey08/zNxlDbJHSMy7ULZFL9DHtjPhzSRUMgTwx6lchhAXrEc/wTDxz+Chsja1fiEGf2foM rDmsx4NZu42Xvvn6/MWvvzm7YcECh3ULjLBpndQG8S++Bcq8CqwhGGSW8jNwTzjG/hdhjFfZ1gIn giL52JFYga0ejwfzK5+WNFXyPox8ozo7Ts/deStAQiJTsi8zmMPvG3nFy8+I1OKc21ewK7aeu3Pn 9NkrV0472ttvdVjB9xAnDZhLHws7WeBxjumwFYwyjMiIEQHpdGNRQZ0hjLBvBcE9WEJiJwKqdISV KsJVLKW9IgjJ8lXlPEpGydxCPM0OpqWQ/6cgRUWBrsYQrvXisQXtZuTi6+B27/8jmIAfmEiFqbCd xavht7Da2GR/pDiADojEm0smRrmLqBBJnNIDFb4qlQ9BRQMPPC2KZ0OY1o0PAB0NO/Cr3NC8A4eR 4gxdkppexgtrGNHsFCSr6oAuUVmeLBztZlzgKE3MiSTaZtMmqQAbqbBF+IJ1Lt6es5X4fy6WERbb 4WVAY3OwJ4GSfnX2eFhJ4I6NH6FJ/OgN14GFQRe/enyzfNf6Aj7LLyeqHMkM2fmN/AGQmzaqtX4h MZqQGJHO2KHtl2cQ1zap1fw3kJGID7aU34PD09lVoKCr/E9FnUUysPjzEQwFi/F/Yuu1zsE7fPlq IklaTYaKs6fF2BAndhK+fdFuRpQ4ZVEMiZYbgUMu4cg9Q5hWya2Bm+ydU2evXj1FIu7suHLF1rN3 RBNingJ19+E/iFoNhAIYIIV5sJmFr+jmoowmoMc/xWPwzBGvITwDRvx+8WJZuH6P19a1aDg/BzlX R9yS3TUpvNpUcQPdQqd9claL5I8CE4EFU8kRGAaHiQfh/J/s3I3XyR4Dz311/975ZdgMm236aA4P x2ATC0sxA3I8ndCF+BR/hD+C3sS3U2E6MGAOH3UqX6+Xkofkq5u43h4i84KEyU7ORlnER30/W4MH YPP163B/jQYlx/JkGYr9jdYjHXluoyspzcf+frL5dwT9EMi2/7Tg1JqaBSkTUSzSkD+ySW8ppxFU IqxkXVnwzWh18fMIfD+d7chaos+VJGvldmQtf2ER3cEOWbXIDpE19rRKE6/mvRn5vRO+zofXEq+O G4ct8NA/x4LF2dP5x6p4rCA/YlPYyK50PnunK2JbHTs5CkFtQP0hAW/oKyV/PWBxkEMPih7uztXj IOhF97fhNEpHaShNdk1feuVImQYd544X6kub3Avn4Ekrt+FBGqQhfnOgu9YybvcEesE4MJEQdPaB VaLnYwQv9jr9dX3gli3uAQv4pfQDyGfx9v+AlvO6abnlyQMaZty7BmbQe84VPIPvSBi2T8HsOQly nx+eGl5IhTjhLts+8t+vLIzsrKJ6M4aYIlJFqVy5dTgMbH9kkBjHRJl3YURlrbbIwD1lDNFFnr4R 4Z7GRM7NJBaEOdFKbWhDvZbIPkiY6thsZQfiILZtNJiKQOxnKa+F420sTGUuXmoqq0BH0dGdDUjW UHa07pRH5fIFG7wXLyd5gVQasZnh3IhuLxbjWM8elVipUaONYBAR5QSS1kcQ3jb5uRFSgdBbFIBK YIhCN9+4eaqZRN9p0eKtTit4+UgIt2HhZ+ZtUM3tAFUgwU297w7dOhFU47Eltvh1Mlh+ekJbeoJH ccnxKF42caf/lE0+WSiM8w4L8dt+JuyFuKr9rcswvBNcI4wBeEIC8KSRBCDxPwwA2PZU3BE/0O9w u/pdbs8lbs970+0xD+DqPck3IIdNwErBPp09pT6V0ExIPvTWZw//WFqGzXT8NK3bftQoO3ZUf+6n Y0vQGa60oOAY/wVTqS4MUEXGRaq5bXk7MnYQuR74kcPk+Rd2gGkk/zLqJELbZHv2BDttUuaV+XJB h5KPuRKOqyNd+OWMT4bquK4wQ6vrDH76869IOnpqLC37SYVUEv2PGZCt/sx2vTLULYgD1470Oqmz rOwSj3ld4tFVO/V7KzXDcOb66cZTF7QeCzk8/N+P77CIfQLcC8kzooHzRSYGws8scPeZq2WqzZt8 ouz5Ityfhb54Za4qc28lUnxhZH+NSuexfx86kMDPBfO43H3a6EzF7dKGC+iW7PmSi/9hoSX2AG8e gD3JaFFuXFa0Ue5bfyel+JY2o96ni97a9EbGfK8zYzLYDOyfPigtOMoXZCenE2lOER8ZyLpQTfJx Y2gOKSQW0x2pjLjjgh3tuddvXyCSjV5zAwZ1ZNeyjuya+2Z2jSbZdW9ndo0l2rWrTQKjiVQ+hb+x J7EZjfaTJxGtTd5e5nPMtznsOsFVv2fnT1QFH9rj6rwDLeXXRR27yhN4jmW6tBOPBZpujNJv8wgN DUtC+1AMh+ltzJtKScTiK5hgTsqnvlgi9iKTQSPcYTfnaM5cSMu50pKg2+SoiZzPyVueYzmLR3dL xAUcO7yHRDzoIdpwlzYKiujj34XZf0iugw04wDApzMhim1UnEz4l9r///ZfQ9/H687jfEd62eEMa apY11B5vOVUd4l7E5QYdDCFCVZebX2sswvikfxxojMveiRQBKCZxb5CrTpm1nQRJMWk+lo75zBN6 7Sal/u6LCK2UbfMKXLt8R0nzHi68OuGYB5IpoyNdk8Q6jE/FTLIyP6YBKQ4hbVqOXtbhg5EEBiaE NWKenk7qSMEMMIungwndI77GVgGb064qgjrdO3JuFw3M3+pbyfrT8ci/5GZxnJ6Mi+iqfKkuPBWS /cI793sjxxOD976YIIbN/B/QFz4QQ+YtJBCW32WMPp/0VpNKmj957VKlm9OGyLobHIQxpKnsGtV1 DDyLwRafrnh5+cThUxWcJyP3Vmdr9Nz9vxIaO74QlnZgphT6TuuATKkImVwCmYNvQAbeb/+SFeZ0 GIYze6BlFuldxmqc5ym9spE/tys8YteWOtVzGHPzSxjS2SN3l/UweRA0kX5VLOJJiTJboJ7RqWNQ TPI+lKgI04eW15GeU6zUk7kEsE06k5TrhBTtH9BOKCkmaUsCtrUyFuEHZO75qroKnb4iDR1EqVzq Y9Nn7dRsY5fhURTZ+Lqab+vYlTTBd1jc1G30/Y7Br4/w2qJco0X3jTE3aoCYDYrg584LBkkNC6Og 5S+XCf/fO4chuEW7KzX8HFJ8gjJyC2s6IXzw9++Iu16CTArfwD/ZkRNN4SFzOCErmJtGK1U9exaj 0HfopIhYPTnLT/ThtKzD/FOm5cJ34wJiNWoUqNhVpG7gSLv0WowTEw6g/TxmYXp1zZHSovzaTEVZ em4mOi4zqHJdOUyRbWJ3hByMLY4XPRD1UhhIDLpNGKWE/tLbpDPD6QyeeXkxKdVnXr4N0zhI71kU NKhEuPd/i144k5ke4GE3P7D+Rw4ymXfR8W16RBHo9CcxfA5yqZAvxjClO2r38D56gsplztLI49fi uYSmtLotSOaiDnbkbRm0OTu6NKY56MLey+hHdKW4qr7GkHwKfU52JI8MSgyMWCa/GeM9r4ZLoRlC 2Ut4fY5XSYwBKZpQiTajugVarHqY++6ge+L4TbBaUx6nc0UKJYqN0Pg54dVW7hD/GgivyyUse6tr uoxbMrwPq5uQohGV5mVVdeBAmCeSJp7kMognHXj7vOE9quzvu6u44UImrd0rstK2+/ZKPNSjGW0v 7v78d/OzYAVbxLrujJAIBpKft17Eo/GQed5Ou3Vh1SdPnkaXuQtlfmuNFRPvnuGV6kPkeNjc9eMm X9n44vJlfc15Xu7uk5OnqbA+SRrwvPpqld47MUlUEfkZ3FvPegS4q4mEbwkorjzVeOR2ydH98RVG ChYJjuQQKcIjqbBIhE0//Bi/B49NtZ3Vmtj2jhKvE5Xeha9BTZRmrtYrNeaEWD80orRsbR2MFea+ joDYLxu1Aw+g3chxjeVf11Wc5JyQKBUiSG+G+4PZM5BmHEgnbYeiTl9Ya4TlCNo3MsJrV3ZUMb9h tWOLaXF2fnlNZKEvj3sb8eelC69LS0PJ6TyY4D6Ywe+RbJ28Hym8I1QdN3StdGVBYU15bH7oAeKC A/wX1y8vNWoSUoTERu3yKoioJH2A6KeGGpXeM3G/SLbXCXrqU/OTIP1V/JhYyiuFz+ETFkz8Px/n 5hm1y58LrfDP80SuyCciyAcZs6VMfv1IXNYebrl4q+HmXaAq76iBcayR+iQJ7YokJVJhdA0PUrpG RyQ+UueXZAwO2DHyyovFxypKtaE7OFzGqHPidCQR/GXUX8Y8oGsKjWN2dYzpuhtqJdJk/hvJVgFg Ld4NOZ1jy11OhlwhRcCQP/4gQFOMf4atnbdF+u/iYStzOC4rlJv8VnkqX/aOAvUOrc/O1BI8gdmN d18OdWBJvHiEs/AL+zNuyvZJU1chxWH6OMpIPVh3Wlho9UZrIoKkt3FzT11EHa+lI3D9KvCKrQzL I9XHThQarfFdg72swqGeILJOV1jbc063wafaFx70yEw8Lm5VidK12UaGYqdXVRLYTFoEwU74B7sH uezevPLDiZ6jEO5FPrW2tyd+uqppVymS5WVna/U7G7xv8O7fqr5FP6CnpT+c+eVY86FyVCDTxuZE G29iNr+qlkAFWEhhMd7MlqKm8k+v3P699imCXuTj+ezD3zdfdinfg2TRsXvVquPu1Yv5+nlFc9FM NGrPrC1T/J2Cd6FImTp7b55xuWlwTwJ2oJHCPhjOLsUZB8TCM0GB4tLjc/bXqq0OHkg9kIqyUVZ6 Wg7YQr1VanpyGhHH9H1pezmiUcFoX8K+EPGksACkkrvCJumfsIAVxtK5Obn5fAuTH5cZxbWPpWM0 mmh+NRORFZsr7gy/wj4JTIJeN6GXFBzhV7ac1qODWSnF+bDcqrPeLhDnfkxHxcdFGvsxPh8vTwk9 qNEjBXw86F0T4jsmxP11AtkzHlZKwBlcpOD8A+tgcG+53FB3/rxb3arVSncH0SjyWVf0yr1I0iq8 LwXvfSzUC68ydel5KE9RsVMXGBKt8o3icH27EBe+LwpFK/yOhx85lKevzOeMN3G9BHvoJfkMLCEY LKVwLpIF20eEBi7gMpaU27Z41DiiFq7Y5U/cF0bxyUI1e+3kQmyDh237cPmy7XdI0cyfvH2t45ZB SC+SQDb0lkK2oGXbJ09miG67uxnvbwzi/U1DvXh/M08IpY/H5fvHRicmRHC4n6+PJjIKBSv88sOP puWmHCzo9vYB0dX1/4erV/xvniPQEqa1SQQJDJYKSVXswbsd0xTHonS7vCIivDlsR8MYsPj6y7ov 0V0F9LK/jc2Wb4r0ceT8QuMikIvMpSC0sj6j6kgRl687klONZJ+V7V7nGuLqSqjkjDcG7FEHi0VI cUQdB610KUrJST4swiqiTVj9xBxeAYtNQG4pdxEGw0/stfLyJnRF9nDpNdK09ZmzxTGwQFVqqPkE XeNOlwQ4rdqpcYznfRPCU9EOpMzT1B2QydO+TKyMshu8xtd71VLnE8iX8w4N9tt8dysMgFHffwt9 eLkLuud9xq7ESNvlXwutdyXgCowUEvFyFsbRxbl5JSXq/FB+odB6iy7Wkm8xeaE8HkcHRUWH8/9a yYTnR5cYe6CH4NsGXkWSbwgU1sJAKbjBI/YomF268jznXlaVGl2UHfXLWoG3k4ZzJA7Ay34aCdZg /cOP0B96z/5lhNO2MC8/LgVPYlsMTefON2xfscJD6bjRpelLcfm4IiEOJJIWYaoUbIUENiXLFDxp vKg9PCkBkUcRlxmfxf1CF6KM9LQCmCqcsjrK6OIySPJ/RKtQTGxSuMbOCu0XuS7bo405WlpQqE/l ehw7Uzz298JdlhwuNCY6KEgbXczfam9dSIeqo4KCcsk34pCS/Dwd/2olo4vKCzIS4A/4+CXY/2Z+ B8xxHxgI68i/fcHcUn4D1sN11t7fbSNaKrP9eR4MhaE/f/3iK7cL9kc5ud/N8tozVwc/nP4NVmDF jPlTOPkNtKRq+21fmdyvADj2TF3txUt1Hs6b3b02bHSvPUN+T8A17EVD9eefGzw3Obh7rF7t3tBs tKEIvNrA96HkLtl/LWGhYCUsYFcrXRw2uX1y9Wqd4eyFJpdlRtcGYLMNK0funaPxzkMbZAEVsVdh OwwmvVsALJv2XLxKnjkT98e9709ubT5ZVFPBdUjI3W4V+ZF1aHBraWmsP39OSVTEzcOBA62Jg4G8 ayDv3OtWrRLf9Y8oFBy1QBcWF2Sk0NgphXneG/r2oaj/AaQgdHkKZW5kc3RyZWFtCmVuZG9iago3 NSAwIG9iago1OTk2CmVuZG9iago4IDAgb2JqCjw8L0Jhc2VGb250L1ZHQldFVitOaW1idXNSb21O bzlMLVJlZ3UvRm9udERlc2NyaXB0b3IgNyAwIFIvVHlwZS9Gb250Ci9GaXJzdENoYXIgMS9MYXN0 Q2hhciAzOC9XaWR0aHNbIDU1MiAwIDUwMCA0NDQgMjUwIDUwMCAwIDUwMCAyNzggMzMzIDM0NCAy NzggMCA1MDAgMjc4CjAgMCAwIDAgMzg5IDUwMCA1MDAgMjUwIDAgNTAwIDU1NiA1MDAgNzE4IDQ0 NCA1MDAgMjc4Cjg4MyA2MTEgNTU2IDYxMSA1MDAgNTAwIDI3OF0KL0VuY29kaW5nIDc2IDAgUi9T dWJ0eXBlL1R5cGUxPj4KZW5kb2JqCjc2IDAgb2JqCjw8L1R5cGUvRW5jb2RpbmcvQmFzZUVuY29k aW5nL1dpbkFuc2lFbmNvZGluZy9EaWZmZXJlbmNlc1sKMS9QL2EvZy9lL3NwYWNlL29uZS93L2Qv aS9mL3IvdC9oeXBoZW4vby9sL3UvYi9uL3Evcy96ZXJvL3R3by9wZXJpb2QveC90aHJlZS9GL25p bmUvRC9jL2VpZ2h0L2NvbG9uL00vRS9TL1QvaC9wL3NsYXNoL2ZvdXIvZml2ZS9zaXgvc2V2ZW5d Pj4KZW5kb2JqCjEwIDAgb2JqCjw8L0Jhc2VGb250L05KQ1dURCtDb3VyaWVyMTBQaXRjaEJULVJv bWFuL0ZvbnREZXNjcmlwdG9yIDkgMCBSL1R5cGUvRm9udAovRmlyc3RDaGFyIDEvTGFzdENoYXIg NzkvV2lkdGhzWyA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYw MiA2MDIgNjAyIDYwMgo2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAy IDYwMiA2MDIgNjAyIDYwMiA2MDIKNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIg NjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyCjYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2 MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMgo2MDIgNjAyIDYwMiA2MDIgNjAyIDYw MiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDJdCi9FbmNvZGluZyA3NyAw IFIvU3VidHlwZS9UeXBlMT4+CmVuZG9iago3NyAwIG9iago8PC9UeXBlL0VuY29kaW5nL0Jhc2VF bmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRGlmZmVyZW5jZXNbCjEvTi9lL3Qvdy9vL3Ivay9pL24v Zy9zcGFjZS9XL0cvdS9wL00vcGVyaW9kL0QvaC9sL2NvbW1hL0UvZC9JL2h5cGhlbi9hL2YvQy9U L3MvY29sb24vbS95L3gvQS90d28vdGhyZWUvemVyby9uaW5lL0wvYi9SL2ZvdXIvUy9CL0YvYy9h bXBlcnNhbmQvTy9laWdodC9VL3EvUC92L3NpeC9zZXZlbi9wYXJlbmxlZnQvcGFyZW5yaWdodC9x dW90ZWRibC9zbGFzaC9vbmUvcXVvdGVzaW5nbGUvai9RL0gvWS9icmFja2V0bGVmdC9icmFja2V0 cmlnaHQvZml2ZS9ncmF2ZS96L3NlbWljb2xvbi9WL2FzY2lpY2lyY3VtL0ovSy9hdC9aL1hdPj4K ZW5kb2JqCjEyIDAgb2JqCjw8L0Jhc2VGb250L1FTV0lOQStDb3VyaWVyMTBQaXRjaEJULUJvbGQv Rm9udERlc2NyaXB0b3IgMTEgMCBSL1R5cGUvRm9udAovRmlyc3RDaGFyIDEvTGFzdENoYXIgNjgv V2lkdGhzWyA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2 MDIgNjAyIDYwMgo2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYw MiA2MDIgNjAyIDYwMiA2MDIKNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAy IDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyCjYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIg NjAyIDYwMiA2MDIgNjAyIDYwMiA2MDIgNjAyIDYwMgo2MDIgNjAyIDYwMiA2MDIgNjAyXQovRW5j b2RpbmcgNzggMCBSL1N1YnR5cGUvVHlwZTE+PgplbmRvYmoKNzggMCBvYmoKPDwvVHlwZS9FbmNv ZGluZy9CYXNlRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0RpZmZlcmVuY2VzWwoxL0ovdS9uL2Uv c3BhY2UvdHdvL2NvbW1hL0QvYy9tL2Ivci9vbmUvbmluZS9kL2EvZi90L2h5cGhlbi9pL28vbC9n L3Evcy96ZXJvL3RocmVlL1QvaC9JL0UvRi9wL3Yvc2V2ZW4vZWlnaHQvQi9DL1AveS9OL3BhcmVu bGVmdC9wYXJlbnJpZ2h0L3BlcmlvZC9BL2ovcXVvdGVzaW5nbGUvTC9SL2NvbG9uL3NsYXNoL3cv YnJhY2tldGxlZnQvYnJhY2tldHJpZ2h0L1Mvay94L00vWS9XL0cvcXVvdGVkYmwvSC9PL1Uvei9z aXgvVl0+PgplbmRvYmoKNyAwIG9iago8PC9UeXBlL0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL1ZH QldFVitOaW1idXNSb21ObzlMLVJlZ3UvRm9udEJCb3hbLTkgLTIxOCA4NjMgNjg4XS9GbGFncyA0 Ci9Bc2NlbnQgNjg4Ci9DYXBIZWlnaHQgNjg4Ci9EZXNjZW50IC0yMTgKL0l0YWxpY0FuZ2xlIDAK L1N0ZW1WIDEyOQovTWlzc2luZ1dpZHRoIDEwMDAKL0NoYXJTZXQoL24vdHdvL2MvTS9vL2QvdGhy ZWUvcC9lL2ZvdXIvRC9xL2YvZml2ZS9QL0Uvci9nL3NpeC9GL3MvaC9zZXZlbi90L2kvZWlnaHQv Uy91L25pbmUvVC9jb2xvbi93L2wvYS94L2IvaHlwaGVuL3BlcmlvZC9zcGFjZS9zbGFzaC96ZXJv L29uZSkvRm9udEZpbGUzIDcwIDAgUj4+CmVuZG9iago5IDAgb2JqCjw8L1R5cGUvRm9udERlc2Ny aXB0b3IvRm9udE5hbWUvTkpDV1REK0NvdXJpZXIxMFBpdGNoQlQtUm9tYW4vRm9udEJCb3hbLTkg LTE5NiA2MTQgNjk5XS9GbGFncyA1Ci9Bc2NlbnQgNjk5Ci9DYXBIZWlnaHQgNjk5Ci9EZXNjZW50 IC0xOTYKL0l0YWxpY0FuZ2xlIDAKL1N0ZW1WIDkyCi9BdmdXaWR0aCA2MDIKL01heFdpZHRoIDYw MgovTWlzc2luZ1dpZHRoIDYwMgovQ2hhclNldCgvTC9BL3kvbi9jL1gvZm91ci9NL0Ivei9vL2Qv YXQvWS9maXZlL04vQy9hbXBlcnNhbmQvYnJhY2tldGxlZnQvcC9lL1ovc2l4L08vRC9xL2Yvc2V2 ZW4vUC9FL3BhcmVubGVmdC9icmFja2V0cmlnaHQvci9nL2VpZ2h0L1EvRi9wYXJlbnJpZ2h0L2Fz Y2lpY2lyY3VtL3MvaC9uaW5lL1IvRy90L2kvY29sb24vUy9ncmF2ZS9IL3Uvai9zZW1pY29sb24v VC9JL2NvbW1hL3Yvay9VL0ovaHlwaGVuL3F1b3RlZGJsL3cvbC9hL1YvSy9wZXJpb2Qvc3BhY2Uv eC9tL2IvVy9zbGFzaC96ZXJvL29uZS9xdW90ZXNpbmdsZS90d28vdGhyZWUpL0ZvbnRGaWxlMyA3 MiAwIFI+PgplbmRvYmoKMTEgMCBvYmoKPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9R U1dJTkErQ291cmllcjEwUGl0Y2hCVC1Cb2xkL0ZvbnRCQm94Wy0yNiAtMTk3IDYyOCA3MDJdL0Zs YWdzIDUKL0FzY2VudCA3MDIKL0NhcEhlaWdodCA3MDIKL0Rlc2NlbnQgLTE5NwovSXRhbGljQW5n bGUgMAovU3RlbVYgOTQKL0F2Z1dpZHRoIDYwMgovTWF4V2lkdGggNjAyCi9NaXNzaW5nV2lkdGgg NjAyCi9DaGFyU2V0KC9ML0EveS9uL2MvTS9CL3ovby9kL1kvTi9DL2JyYWNrZXRsZWZ0L3AvZS9z aXgvTy9EL3EvZi9zZXZlbi9QL0UvcGFyZW5sZWZ0L2JyYWNrZXRyaWdodC9yL2cvZWlnaHQvRi9w YXJlbnJpZ2h0L25pbmUvcy9oL1IvRy90L2kvY29sb24vUy9IL3Uvai9UL0kvY29tbWEvdi9rL1Uv Si9oeXBoZW4vcXVvdGVkYmwvdy9sL2EvVi9wZXJpb2Qvc3BhY2UveC9tL2IvVy9zbGFzaC96ZXJv L29uZS9xdW90ZXNpbmdsZS90d28vdGhyZWUpL0ZvbnRGaWxlMyA3NCAwIFI+PgplbmRvYmoKMiAw IG9iago8PC9Qcm9kdWNlcihFU1AgR2hvc3RzY3JpcHQgODE1LjAzKQovQ3JlYXRpb25EYXRlKEQ6 MjAwODEyMTkxNTMyMzApCi9Nb2REYXRlKEQ6MjAwODEyMTkxNTMyMzApPj5lbmRvYmoKeHJlZgow IDc5CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDA0ODcwMiAwMDAwMCBuIAowMDAwMDcxNTMyIDAw MDAwIG4gCjAwMDAwNDg1NDQgMDAwMDAgbiAKMDAwMDA0NjM4NiAwMDAwMCBuIAowMDAwMDAwMDE1 IDAwMDAwIG4gCjAwMDAwMDM1MzkgMDAwMDAgbiAKMDAwMDA3MDEyNSAwMDAwMCBuIAowMDAwMDY4 MDIxIDAwMDAwIG4gCjAwMDAwNzA0ODQgMDAwMDAgbiAKMDAwMDA2ODUyNCAwMDAwMCBuIAowMDAw MDcxMDM3IDAwMDAwIG4gCjAwMDAwNjkzNzYgMDAwMDAgbiAKMDAwMDA0ODc1MCAwMDAwMCBuIAow MDAwMDQ2NTI4IDAwMDAwIG4gCjAwMDAwMDM1NTkgMDAwMDAgbiAKMDAwMDAwNjU0NyAwMDAwMCBu IAowMDAwMDQ4ODAyIDAwMDAwIG4gCjAwMDAwNDY2NzIgMDAwMDAgbiAKMDAwMDAwNjU2OCAwMDAw MCBuIAowMDAwMDA5MTcyIDAwMDAwIG4gCjAwMDAwNDg4NTQgMDAwMDAgbiAKMDAwMDA0NjgxNiAw MDAwMCBuIAowMDAwMDA5MTkzIDAwMDAwIG4gCjAwMDAwMTIxNjQgMDAwMDAgbiAKMDAwMDA0ODkw NiAwMDAwMCBuIAowMDAwMDQ2OTYwIDAwMDAwIG4gCjAwMDAwMTIxODUgMDAwMDAgbiAKMDAwMDAx NTAwNSAwMDAwMCBuIAowMDAwMDQ4OTQ3IDAwMDAwIG4gCjAwMDAwNDcxMDQgMDAwMDAgbiAKMDAw MDAxNTAyNiAwMDAwMCBuIAowMDAwMDE4NDc3IDAwMDAwIG4gCjAwMDAwNDg5ODggMDAwMDAgbiAK MDAwMDA0NzI0OCAwMDAwMCBuIAowMDAwMDE4NDk4IDAwMDAwIG4gCjAwMDAwMjE3NjIgMDAwMDAg biAKMDAwMDA0OTAyOSAwMDAwMCBuIAowMDAwMDQ3MzkyIDAwMDAwIG4gCjAwMDAwMjE3ODMgMDAw MDAgbiAKMDAwMDAyNTAyNiAwMDAwMCBuIAowMDAwMDQ5MDcwIDAwMDAwIG4gCjAwMDAwNDc1MzYg MDAwMDAgbiAKMDAwMDAyNTA0NyAwMDAwMCBuIAowMDAwMDI4Njc2IDAwMDAwIG4gCjAwMDAwNDkx MTEgMDAwMDAgbiAKMDAwMDA0NzY4MCAwMDAwMCBuIAowMDAwMDI4Njk3IDAwMDAwIG4gCjAwMDAw MzI0NDIgMDAwMDAgbiAKMDAwMDA0OTE2MyAwMDAwMCBuIAowMDAwMDQ3ODI0IDAwMDAwIG4gCjAw MDAwMzI0NjMgMDAwMDAgbiAKMDAwMDAzNTc4NiAwMDAwMCBuIAowMDAwMDQ5MjE1IDAwMDAwIG4g CjAwMDAwNDc5NjggMDAwMDAgbiAKMDAwMDAzNTgwNyAwMDAwMCBuIAowMDAwMDM5OTg3IDAwMDAw IG4gCjAwMDAwNDkyNjcgMDAwMDAgbiAKMDAwMDA0ODExMiAwMDAwMCBuIAowMDAwMDQwMDA4IDAw MDAwIG4gCjAwMDAwNDI4MzUgMDAwMDAgbiAKMDAwMDA0OTMxOSAwMDAwMCBuIAowMDAwMDQ4MjU2 IDAwMDAwIG4gCjAwMDAwNDI4NTYgMDAwMDAgbiAKMDAwMDA0NTUyMiAwMDAwMCBuIAowMDAwMDQ5 MzcxIDAwMDAwIG4gCjAwMDAwNDg0MDAgMDAwMDAgbiAKMDAwMDA0NTU0MyAwMDAwMCBuIAowMDAw MDQ2MzY2IDAwMDAwIG4gCjAwMDAwNDk0MTIgMDAwMDAgbiAKMDAwMDA0OTQ1MyAwMDAwMCBuIAow MDAwMDUzODUxIDAwMDAwIG4gCjAwMDAwNTM4NzIgMDAwMDAgbiAKMDAwMDA2MTg5NyAwMDAwMCBu IAowMDAwMDYxOTE4IDAwMDAwIG4gCjAwMDAwNjgwMDAgMDAwMDAgbiAKMDAwMDA2ODMwOCAwMDAw MCBuIAowMDAwMDY4OTk2IDAwMDAwIG4gCjAwMDAwNjk4MDQgMDAwMDAgbiAKdHJhaWxlcgo8PCAv U2l6ZSA3OSAvUm9vdCAxIDAgUiAvSW5mbyAyIDAgUgovSUQgWyiPidtBMgxRRcRfrQGXA2gHKSiP idtBMgxRRcRfrQGXA2gHKV0KPj4Kc3RhcnR4cmVmCjcxNjQzCiUlRU9GCg== ------_=_NextPart_001_01C9621C.E9A3EE39 Content-Type: text/plain; name="draft-ietf-roll-urban-routing-reqs-03.txt" Content-Transfer-Encoding: base64 Content-Description: draft-ietf-roll-urban-routing-reqs-03.txt Content-Disposition: attachment; filename="draft-ietf-roll-urban-routing-reqs-03.txt" DQoNCg0KTmV0d29ya2luZyBXb3JraW5nIEdyb3VwICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIE0uIERvaGxlciwgRWQuDQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENUVEMNCkludGVuZGVkIHN0YXR1czog SW5mb3JtYXRpb25hbCAgICAgICAgICAgICAgICAgICAgICAgICAgVC4gV2F0dGV5bmUsIEVkLg0K RXhwaXJlczogSnVuZSAyMiwgMjAwOSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ0lUSS1M YWIsIElOUklBIEE0UkVTDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgVC4gV2ludGVyLCBFZC4NCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBFa2EgU3lzdGVtcw0KICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRC4gQmFy dGhlbCwgRWQuDQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBGcmFuY2UgVGVsZWNvbSBSJkQNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBEZWNlbWJlciAxOSwgMjAwOA0KDQoNCiAgICBVcmJh biBXU05zIFJvdXRpbmcgUmVxdWlyZW1lbnRzIGluIExvdyBQb3dlciBhbmQgTG9zc3kgTmV0d29y a3MNCiAgICAgICAgICAgICAgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJvdXRpbmctcmVxcy0w Mw0KDQpTdGF0dXMgb2YgdGhpcyBNZW1vDQoNCiAgIFRoaXMgSW50ZXJuZXQtRHJhZnQgaXMgc3Vi bWl0dGVkIHRvIElFVEYgaW4gZnVsbCBjb25mb3JtYW5jZSB3aXRoIHRoZQ0KICAgcHJvdmlzaW9u cyBvZiBCQ1AgNzggYW5kIEJDUCA3OS4NCg0KICAgSW50ZXJuZXQtRHJhZnRzIGFyZSB3b3JraW5n IGRvY3VtZW50cyBvZiB0aGUgSW50ZXJuZXQgRW5naW5lZXJpbmcNCiAgIFRhc2sgRm9yY2UgKElF VEYpLCBpdHMgYXJlYXMsIGFuZCBpdHMgd29ya2luZyBncm91cHMuICBOb3RlIHRoYXQNCiAgIG90 aGVyIGdyb3VwcyBtYXkgYWxzbyBkaXN0cmlidXRlIHdvcmtpbmcgZG9jdW1lbnRzIGFzIEludGVy bmV0LQ0KICAgRHJhZnRzLg0KDQogICBJbnRlcm5ldC1EcmFmdHMgYXJlIGRyYWZ0IGRvY3VtZW50 cyB2YWxpZCBmb3IgYSBtYXhpbXVtIG9mIHNpeCBtb250aHMNCiAgIGFuZCBtYXkgYmUgdXBkYXRl ZCwgcmVwbGFjZWQsIG9yIG9ic29sZXRlZCBieSBvdGhlciBkb2N1bWVudHMgYXQgYW55DQogICB0 aW1lLiAgSXQgaXMgaW5hcHByb3ByaWF0ZSB0byB1c2UgSW50ZXJuZXQtRHJhZnRzIGFzIHJlZmVy ZW5jZQ0KICAgbWF0ZXJpYWwgb3IgdG8gY2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndvcmsgaW4g cHJvZ3Jlc3MuIg0KDQogICBUaGUgbGlzdCBvZiBjdXJyZW50IEludGVybmV0LURyYWZ0cyBjYW4g YmUgYWNjZXNzZWQgYXQNCiAgIGh0dHA6Ly93d3cuaWV0Zi5vcmcvaWV0Zi8xaWQtYWJzdHJhY3Rz LnR4dC4NCg0KICAgVGhlIGxpc3Qgb2YgSW50ZXJuZXQtRHJhZnQgU2hhZG93IERpcmVjdG9yaWVz IGNhbiBiZSBhY2Nlc3NlZCBhdA0KICAgaHR0cDovL3d3dy5pZXRmLm9yZy9zaGFkb3cuaHRtbC4N Cg0KICAgVGhpcyBJbnRlcm5ldC1EcmFmdCB3aWxsIGV4cGlyZSBvbiBKdW5lIDIyLCAyMDA5Lg0K DQpDb3B5cmlnaHQgTm90aWNlDQoNCiAgIENvcHlyaWdodCAoYykgMjAwOCBJRVRGIFRydXN0IGFu ZCB0aGUgcGVyc29ucyBpZGVudGlmaWVkIGFzIHRoZQ0KICAgZG9jdW1lbnQgYXV0aG9ycy4gIEFs bCByaWdodHMgcmVzZXJ2ZWQuDQoNCiAgIFRoaXMgZG9jdW1lbnQgaXMgc3ViamVjdCB0byBCQ1Ag NzggYW5kIHRoZSBJRVRGIFRydXN0J3MgTGVnYWwNCiAgIFByb3Zpc2lvbnMgUmVsYXRpbmcgdG8g SUVURiBEb2N1bWVudHMNCiAgIChodHRwOi8vdHJ1c3RlZS5pZXRmLm9yZy9saWNlbnNlLWluZm8p IGluIGVmZmVjdCBvbiB0aGUgZGF0ZSBvZg0KICAgcHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVu dC4gIFBsZWFzZSByZXZpZXcgdGhlc2UgZG9jdW1lbnRzDQogICBjYXJlZnVsbHksIGFzIHRoZXkg ZGVzY3JpYmUgeW91ciByaWdodHMgYW5kIHJlc3RyaWN0aW9ucyB3aXRoIHJlc3BlY3QNCiAgIHRv IHRoaXMgZG9jdW1lbnQuDQoNCg0KDQpEb2hsZXIsIGV0IGFsLiAgICAgICAgICAgIEV4cGlyZXMg SnVuZSAyMiwgMjAwOSAgICAgICAgICAgICAgICAgW1BhZ2UgMV0NCgwNCkludGVybmV0LURyYWZ0 ICAgIGRyYWZ0LWlldGYtcm9sbC11cmJhbi1yb3V0aW5nLXJlcXMtMDMgICAgRGVjZW1iZXIgMjAw OA0KDQoNCkFic3RyYWN0DQoNCiAgIFRoZSBhcHBsaWNhdGlvbi1zcGVjaWZpYyByb3V0aW5nIHJl cXVpcmVtZW50cyBmb3IgVXJiYW4gTG93IFBvd2VyIGFuZA0KICAgTG9zc3kgTmV0d29ya3MgKFUt TExOcykgYXJlIHByZXNlbnRlZCBpbiB0aGlzIGRvY3VtZW50LiAgSW4gdGhlIG5lYXINCiAgIGZ1 dHVyZSwgc2Vuc2luZyBhbmQgYWN0dWF0aW5nIG5vZGVzIHdpbGwgYmUgcGxhY2VkIG91dGRvb3Jz IGluIHVyYmFuDQogICBlbnZpcm9ubWVudHMgc28gYXMgdG8gaW1wcm92ZSB0aGUgcGVvcGxlJ3Mg bGl2aW5nIGNvbmRpdGlvbnMgYXMgd2VsbA0KICAgYXMgdG8gbW9uaXRvciBjb21wbGlhbmNlIHdp dGggaW5jcmVhc2luZ2x5IHN0cmljdCBlbnZpcm9ubWVudGFsIGxhd3MuDQogICBUaGVzZSBmaWVs ZCBub2RlcyBhcmUgZXhwZWN0ZWQgdG8gbWVhc3VyZSBhbmQgcmVwb3J0IGEgd2lkZSBnYW11dCBv Zg0KICAgZGF0YSwgc3VjaCBhcyByZXF1aXJlZCBpbiBzbWFydCBtZXRlcmluZywgd2FzdGUgZGlz cG9zYWwsDQogICBtZXRlb3JvbG9naWNhbCwgcG9sbHV0aW9uIGFuZCBhbGxlcmd5IHJlcG9ydGlu ZyBhcHBsaWNhdGlvbnMuICBUaGUNCiAgIG1ham9yaXR5IG9mIHRoZXNlIG5vZGVzIGlzIGV4cGVj dGVkIHRvIGNvbW11bmljYXRlIHdpcmVsZXNzbHkgd2hpY2ggLQ0KICAgZ2l2ZW4gdGhlIGxpbWl0 ZWQgcmFkaW8gcmFuZ2UgYW5kIHRoZSBsYXJnZSBudW1iZXIgb2Ygbm9kZXMgLQ0KICAgcmVxdWly ZXMgdGhlIHVzZSBvZiBzdWl0YWJsZSByb3V0aW5nIHByb3RvY29scy4gIFRoZSBkZXNpZ24gb2Yg c3VjaA0KICAgcHJvdG9jb2xzIHdpbGwgYmUgbWFpbmx5IGltcGFjdGVkIGJ5IHRoZSBsaW1pdGVk IHJlc291cmNlcyBvZiB0aGUNCiAgIG5vZGVzIChtZW1vcnksIHByb2Nlc3NpbmcgcG93ZXIsIGJh dHRlcnksIGV0Yy4pIGFuZCB0aGUNCiAgIHBhcnRpY3VsYXJpdGllcyBvZiB0aGUgb3V0ZG9vciB1 cmJhbiBhcHBsaWNhdGlvbiBzY2VuYXJpb3MuICBBcyBzdWNoLA0KICAgZm9yIGEgd2lyZWxlc3Mg Um91dGluZyBPdmVyIExvdyBwb3dlciBhbmQgTG9zc3kgbmV0d29ya3MgKFJPTEwpDQogICBzb2x1 dGlvbiB0byBiZSB1c2VmdWwsIHRoZSBwcm90b2NvbChzKSBvdWdodCB0byBiZSBlbmVyZ3ktZWZm aWNpZW50LA0KICAgc2NhbGFibGUsIGFuZCBhdXRvbm9tb3VzLiAgVGhpcyBkb2N1bWVudHMgYWlt cyB0byBzcGVjaWZ5IGEgc2V0IG9mDQogICByZXF1aXJlbWVudHMgcmVmbGVjdGluZyB0aGVzZSBh bmQgZnVydGhlciBVLUxMTnMgdGFpbG9yZWQNCiAgIGNoYXJhY3RlcmlzdGljcy4NCg0KUmVxdWly ZW1lbnRzIExhbmd1YWdlDQoNCiAgIFRoZSBrZXkgd29yZHMgIk1VU1QiLCAiTVVTVCBOT1QiLCAi UkVRVUlSRUQiLCAiU0hBTEwiLCAiU0hBTEwgTk9UIiwNCiAgICJTSE9VTEQiLCAiU0hPVUxEIE5P VCIsICJSRUNPTU1FTkRFRCIsICJNQVkiLCBhbmQgIk9QVElPTkFMIiBpbiB0aGlzDQogICBkb2N1 bWVudCBhcmUgdG8gYmUgaW50ZXJwcmV0ZWQgYXMgZGVzY3JpYmVkIGluIFJGQyAyMTE5IFtSRkMy MTE5XS4NCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCkRv aGxlciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDIyLCAyMDA5ICAgICAgICAgICAg ICAgICBbUGFnZSAyXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFu LXJvdXRpbmctcmVxcy0wMyAgICBEZWNlbWJlciAyMDA4DQoNCg0KVGFibGUgb2YgQ29udGVudHMN Cg0KICAgMS4gIEludHJvZHVjdGlvbiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICA0DQogICAyLiAgVGVybWlub2xvZ3kgIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDQNCiAgIDMuICBPdmVydmlldyBvZiBV cmJhbiBMb3cgUG93ZXIgTG9zc3kgTmV0d29ya3MgLiAuIC4gLiAuIC4gLiAuIC4gLiAgNQ0KICAg ICAzLjEuICBDYW5vbmljYWwgTmV0d29yayBFbGVtZW50cyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuICA1DQogICAgICAgMy4xLjEuICBTZW5zb3JzICAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDUNCiAgICAgICAzLjEuMi4gIEFjdHVhdG9ycyAg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgNg0KICAgICAgIDMu MS4zLiAgUm91dGVycyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuICA2DQogICAgIDMuMi4gIFRvcG9sb2d5IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDcNCiAgICAgMy4zLiAgUmVzb3VyY2UgQ29uc3RyYWludHMg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgNw0KICAgICAzLjQuICBMaW5r IFJlbGlhYmlsaXR5IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA4 DQogICA0LiAgVXJiYW4gTExOIEFwcGxpY2F0aW9uIFNjZW5hcmlvcyAgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gIDgNCiAgICAgNC4xLiAgRGVwbG95bWVudCBvZiBOb2RlcyAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgOQ0KICAgICA0LjIuICBBc3NvY2lhdGlv biBhbmQgRGlzYXNzb2NpYXRpb24vRGlzYXBwZWFyYW5jZSBvZiBOb2RlcyAgLiAuICA5DQogICAg IDQuMy4gIFJlZ3VsYXIgTWVhc3VyZW1lbnQgUmVwb3J0aW5nICAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gMTANCiAgICAgNC40LiAgUXVlcmllZCBNZWFzdXJlbWVudCBSZXBvcnRpbmcgIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxMA0KICAgICA0LjUuICBBbGVydCBSZXBvcnRpbmcg IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDExDQogICA1LiAgVHJh ZmZpYyBQYXR0ZXJuICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gMTENCiAgIDYuICBSZXF1aXJlbWVudHMgb2YgVXJiYW4gTExOIEFwcGxpY2F0aW9ucyAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAxMw0KICAgICA2LjEuICBTY2FsYWJpbGl0eSAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIDEzDQogICAgIDYuMi4gIFBhcmFt ZXRlciBDb25zdHJhaW5lZCBSb3V0aW5nICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTMN CiAgICAgNi4zLiAgU3VwcG9ydCBvZiBBdXRvbm9tb3VzIGFuZCBBbGllbiBDb25maWd1cmF0aW9u ICAuIC4gLiAuIC4gLiAxNA0KICAgICA2LjQuICBTdXBwb3J0IG9mIEhpZ2hseSBEaXJlY3RlZCBJ bmZvcm1hdGlvbiBGbG93cyAuIC4gLiAuIC4gLiAuIDE1DQogICAgIDYuNS4gIFN1cHBvcnQgb2Yg TXVsdGljYXN0LCBBbnljYXN0LCBhbmQgSW1wbGVtZW50YXRpb24gb2YNCiAgICAgICAgICAgR3Jv dXBjYXN0ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAx NQ0KICAgICA2LjYuICBOZXR3b3JrIER5bmFtaWNpdHkgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIDE2DQogICAgIDYuNy4gIExhdGVuY3kgIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTYNCiAgIDcuICBTZWN1cml0eSBDb25z aWRlcmF0aW9ucyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxNw0KICAg OC4gIElBTkEgQ29uc2lkZXJhdGlvbnMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIDE4DQogICA5LiAgQWNrbm93bGVkZ2VtZW50cyAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gMTgNCiAgIDEwLiBSZWZlcmVuY2VzIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxOA0KICAgICAxMC4x LiBOb3JtYXRpdmUgUmVmZXJlbmNlcyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIDE4DQogICAgIDEwLjIuIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gMTkNCiAgIEF1dGhvcnMnIEFkZHJlc3NlcyAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAxOQ0KDQoNCg0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQpEb2hsZXIsIGV0IGFsLiAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAy MiwgMjAwOSAgICAgICAgICAgICAgICAgW1BhZ2UgM10NCgwNCkludGVybmV0LURyYWZ0ICAgIGRy YWZ0LWlldGYtcm9sbC11cmJhbi1yb3V0aW5nLXJlcXMtMDMgICAgRGVjZW1iZXIgMjAwOA0KDQoN CjEuICBJbnRyb2R1Y3Rpb24NCg0KICAgVGhpcyBkb2N1bWVudCBkZXRhaWxzIGFwcGxpY2F0aW9u LXNwZWNpZmljIHJvdXRpbmcgcmVxdWlyZW1lbnRzIGZvcg0KICAgVXJiYW4gTG93IFBvd2VyIGFu ZCBMb3NzeSBOZXR3b3JrcyAoVS1MTE5zKS4gIFUtTExOIHVzZSBjYXNlcyBhbmQNCiAgIGFzc29j aWF0ZWQgcm91dGluZyBwcm90b2NvbCByZXF1aXJlbWVudHMgd2lsbCBiZSBkZXNjcmliZWQuDQoN CiAgIFNlY3Rpb24gMiBkZWZpbmVzIHRlcm1pbm9sb2d5IHVzZWZ1bCBpbiBkZXNjcmliaW5nIFUt TExOcy4NCg0KICAgU2VjdGlvbiAzIHByb3ZpZGVzIGFuIG92ZXJ2aWV3IG9mIFUtTExOIGFwcGxp Y2F0aW9ucy4NCg0KICAgU2VjdGlvbiA0IGRlc2NyaWJlcyBhIGZldyB0eXBpY2FsIHVzZSBjYXNl cyBmb3IgVS1MTE4gYXBwbGljYXRpb25zDQogICBleGVtcGxpZnlpbmcgZGVwbG95bWVudCBwcm9i bGVtcyBhbmQgcmVsYXRlZCByb3V0aW5nIGlzc3Vlcy4NCg0KICAgU2VjdGlvbiA1IGRlc2NyaWJl cyB0cmFmZmljIGZsb3dzIHRoYXQgd2lsbCBiZSB0eXBpY2FsIGZvciBVLUxMTg0KICAgYXBwbGlj YXRpb25zLg0KDQogICBTZWN0aW9uIDYgZGlzY3Vzc2VzIHRoZSByb3V0aW5nIHJlcXVpcmVtZW50 cyBmb3IgbmV0d29ya3MgY29tcHJpc2luZw0KICAgc3VjaCBjb25zdHJhaW5lZCBkZXZpY2VzIGlu IGEgVS1MTE4gZW52aXJvbm1lbnQuICBUaGVzZSByZXF1aXJlbWVudHMNCiAgIG1heSBiZSBvdmVy bGFwcGluZyByZXF1aXJlbWVudHMgZGVyaXZlZCBmcm9tIG90aGVyIGFwcGxpY2F0aW9uLQ0KICAg c3BlY2lmaWMgcmVxdWlyZW1lbnRzIGRvY3VtZW50cyBbSS1ELmlldGYtcm9sbC1ob21lLXJvdXRp bmctcmVxc10NCiAgIFtJLUQuaWV0Zi1yb2xsLWluZHVzLXJvdXRpbmctcmVxc10NCiAgIFtJLUQu bWFydG9jY2ktcm9sbC1idWlsZGluZy1yb3V0aW5nLXJlcXNdLg0KDQogICBTZWN0aW9uIDcgcHJv dmlkZXMgYW4gb3ZlcnZpZXcgb2Ygcm91dGluZyBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBvZg0K ICAgVS1MTE4gaW1wbGVtZW50YXRpb25zLg0KDQoNCjIuICBUZXJtaW5vbG9neQ0KDQogICBUaGUg dGVybWlub2xvZ3kgdXNlZCBpbiB0aGlzIGRvY3VtZW50IGlzIGNvbnNpc3RlbnQgd2l0aCBhbmQN CiAgIGluY29ycG9yYXRlcyB0aGF0IGRlc2NyaWJlZCBpbiBgVGVybWlub2xvZ3kgaW4gTG93IHBv d2VyIEFuZCBMb3NzeQ0KICAgTmV0d29ya3MnIFtJLUQuaWV0Zi1yb2xsLXRlcm1pbm9sb2d5XS4g IFRoaXMgdGVybWlub2xvZ3kgaXMgZXh0ZW5kZWQNCiAgIGluIHRoaXMgZG9jdW1lbnQgYXMgZm9s bG93czoNCg0KICAgQW55Y2FzdDogIEFkZHJlc3NpbmcgYW5kIFJvdXRpbmcgc2NoZW1lIGZvciBm b3J3YXJkaW5nIHBhY2tldHMgdG8gYXQNCiAgICAgICAgIGxlYXN0IG9uZSBvZiB0aGUgIm5lYXJl c3QiIGludGVyZmFjZXMgZnJvbSBhIGdyb3VwLCBhcw0KICAgICAgICAgZGVzY3JpYmVkIGluIFJG QzQyOTEgW1JGQzQyOTFdIGFuZCBSRkMxNTQ2IFtSRkMxNTQ2XS4NCg0KICAgQXV0b25vbW91czog IFJlZmVycyB0byB0aGUgYWJpbGl0eSBvZiBhIHJvdXRpbmcgcHJvdG9jb2wgdG8NCiAgICAgICAg IGluZGVwZW5kZW50bHkgZnVuY3Rpb24gd2l0aG91dCByZXF1aXJpbmcgYW55IGV4dGVybmFsIGlu Zmx1ZW5jZQ0KICAgICAgICAgb3IgZ3VpZGFuY2UuICBJbmNsdWRlcyBzZWxmLWNvbmZpZ3VyYXRp b24gYW5kIHNlbGYtb3JnYW5pemF0aW9uDQogICAgICAgICBjYXBhYmlsaXRpZXMuDQoNCiAgIERv UyAgIERlbmlhbCBvZiBTZXJ2aWNlLCBhIGNsYXNzIG9mIGF0dGFjayB0aGF0IGF0dGVtcHRzIHRv IGNhdXNlDQogICAgICAgICByZXNvdXJjZSBleGhhdXN0aW9uIHRvIHRoZSBkZXRyaW1lbnQgb2Yg YSBub2RlIG9yIG5ldHdvcmsuDQoNCg0KDQoNCg0KDQpEb2hsZXIsIGV0IGFsLiAgICAgICAgICAg IEV4cGlyZXMgSnVuZSAyMiwgMjAwOSAgICAgICAgICAgICAgICAgW1BhZ2UgNF0NCgwNCkludGVy bmV0LURyYWZ0ICAgIGRyYWZ0LWlldGYtcm9sbC11cmJhbi1yb3V0aW5nLXJlcXMtMDMgICAgRGVj ZW1iZXIgMjAwOA0KDQoNCiAgIElTTSBiYW5kOiAgSW5kdXN0cmlhbCwgU2NpZW50aWZpYyBhbmQg TWVkaWNhbCBiYW5kLiAgVGhpcyBpcyBhIHJlZ2lvbg0KICAgICAgICAgb2YgcmFkaW8gc3BlY3Ry dW0gd2hlcmUgbG93IHBvd2VyIHVubGljZW5zZWQgZGV2aWNlcyBtYXkNCiAgICAgICAgIGdlbmVy YWxseSBiZSB1c2VkLCB3aXRoIHNwZWNpZmljIGd1aWRhbmNlIGZyb20gYW4gYXBwbGljYWJsZQ0K ICAgICAgICAgbG9jYWwgcmFkaW8gc3BlY3RydW0gYXV0aG9yaXR5Lg0KDQogICBVLUxMTjogIFVy YmFuIExvdyBQb3dlciBhbmQgTG9zc3kgbmV0d29yay4NCg0KICAgV0xBTjogV2lyZWxlc3MgTG9j YWwgQXJlYSBOZXR3b3JrLg0KDQoNCjMuICBPdmVydmlldyBvZiBVcmJhbiBMb3cgUG93ZXIgTG9z c3kgTmV0d29ya3MNCg0KMy4xLiAgQ2Fub25pY2FsIE5ldHdvcmsgRWxlbWVudHMNCg0KICAgQSBV LUxMTiBpcyB1bmRlcnN0b29kIHRvIGJlIGEgbmV0d29yayBjb21wb3NlZCBvZiB0aHJlZSBrZXkg ZWxlbWVudHMsDQogICBpLmUuDQoNCiAgIDEuICBzZW5zb3JzLA0KDQogICAyLiAgYWN0dWF0b3Jz LCBhbmQNCg0KICAgMy4gIHJvdXRlcnMuDQoNCiAgIHdoaWNoIGNvbW11bmljYXRlIHdpcmVsZXNz bHkuDQoNCjMuMS4xLiAgU2Vuc29ycw0KDQogICBTZW5zaW5nIG5vZGVzIG1lYXN1cmUgYSB3aWRl IGdhbXV0IG9mIHBoeXNpY2FsIGRhdGEsIGluY2x1ZGluZyBidXQNCiAgIG5vdCBsaW1pdGVkIHRv Og0KDQogICAxLiAgbXVuaWNpcGFsIGNvbnN1bXB0aW9uIGRhdGEsIHN1Y2ggYXMgc21hcnQtbWV0 ZXJpbmcgb2YgZ2FzLCB3YXRlciwNCiAgICAgICBlbGVjdHJpY2l0eSwgd2FzdGUsIGV0YzsNCg0K ICAgMi4gIG1ldGVvcm9sb2dpY2FsIGRhdGEsIHN1Y2ggYXMgdGVtcGVyYXR1cmUsIHByZXNzdXJl LCBodW1pZGl0eSwgVVYNCiAgICAgICBpbmRleCwgc3RyZW5ndGggYW5kIGRpcmVjdGlvbiBvZiB3 aW5kLCBldGM7DQoNCiAgIDMuICBwb2xsdXRpb24gZGF0YSwgc3VjaCBhcyBnYXNlcyAoU08yLCBO T3gsIENPLCBPem9uZSksIGhlYXZ5IG1ldGFscw0KICAgICAgIChlLmcuICBNZXJjdXJ5KSwgcEgs IHJhZGlvYWN0aXZpdHksIGV0YzsNCg0KICAgNC4gIGFtYmllbnQgZGF0YSwgc3VjaCBhcyBhbGxl cmdpYyBlbGVtZW50cyAocG9sbGVuLCBkdXN0KSwNCiAgICAgICBlbGVjdHJvbWFnbmV0aWMgcG9s bHV0aW9uLCBub2lzZSBsZXZlbHMsIGV0Yy4NCg0KICAgU2Vuc29yIG5vZGVzIGFyZSBjYXBhYmxl IG9mIGZvcndhcmRpbmcgZGF0YS4gIFNlbnNvciBub2RlcyBhcmUNCiAgIGdlbmVyYWxseSBub3Qg bW9iaWxlIGluIHRoZSBtYWpvcml0eSBvZiBuZWFyLWZ1dHVyZSByb2xsLW91dHMuICBJbg0KICAg bWFueSBhbnRpY2lwYXRlZCByb2xsLW91dHMsIHNlbnNvciBub2RlcyBtYXkgc3VmZmVyIGZyb20g bG9uZy10ZXJtDQogICByZXNvdXJjZSBjb25zdHJhaW50cy4NCg0KICAgQSBwcm9taW5lbnQgZXhh bXBsZSBpcyBhIFNtYXJ0IEdyaWQgYXBwbGljYXRpb24gd2hpY2ggY29uc2lzdHMgb2YgYQ0KDQoN Cg0KRG9obGVyLCBldCBhbC4gICAgICAgICAgICBFeHBpcmVzIEp1bmUgMjIsIDIwMDkgICAgICAg ICAgICAgICAgIFtQYWdlIDVdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICBkcmFmdC1pZXRmLXJvbGwt dXJiYW4tcm91dGluZy1yZXFzLTAzICAgIERlY2VtYmVyIDIwMDgNCg0KDQogICBjaXR5LXdpZGUg bmV0d29yayBvZiBzbWFydCBtZXRlcnMgYW5kIGRpc3RyaWJ1dGlvbiBtb25pdG9yaW5nDQogICBz ZW5zb3JzLiAgU21hcnQgbWV0ZXJzIGluIGFuIHVyYmFuIFNtYXJ0IEdyaWQgYXBwbGljYXRpb24g d2lsbA0KICAgaW5jbHVkZSBlbGVjdHJpYywgZ2FzLCBhbmQvb3Igd2F0ZXIgbWV0ZXJzIHR5cGlj YWxseSBhZG1pbmlzdGVyZWQgYnkNCiAgIG9uZSBvciBtdWx0aXBsZSB1dGlsaXR5IGNvbXBhbmll cy4gIFRoZXNlIG1ldGVycyB3aWxsIGJlIGNhcGFibGUgb2YNCiAgIGFkdmFuY2VkIHNlbnNpbmcg ZnVuY3Rpb25hbGl0aWVzIHN1Y2ggYXMgbWVhc3VyaW5nIHRoZSBxdWFsaXR5IG9mDQogICBlbGVj dHJpY2FsIHNlcnZpY2UgcHJvdmlkZWQgdG8gYSBjdXN0b21lciwgcHJvdmlkaW5nIGdyYW51bGFy DQogICBpbnRlcnZhbCBkYXRhLCBvciBhdXRvbWF0aW5nIHRoZSBkZXRlY3Rpb24gb2YgYWxhcm0g Y29uZGl0aW9ucy4gIEluDQogICBhZGRpdGlvbiB0aGV5IG1heSBiZSBjYXBhYmxlIG9mIGFkdmFu Y2VkIGludGVyYWN0aXZlIGZ1bmN0aW9uYWxpdGllcywNCiAgIHdoaWNoIG1heSBpbnZva2UgYW4g QWN0dWF0b3IgY29tcG9uZW50LCBzdWNoIGFzIHJlbW90ZSBzZXJ2aWNlDQogICBkaXNjb25uZWN0 IG9yIHJlbW90ZSBkZW1hbmQgcmVzZXQuICBNb3JlIGFkdmFuY2VkIHNjZW5hcmlvcyBpbmNsdWRl DQogICBkZW1hbmQgcmVzcG9uc2Ugc3lzdGVtcyBmb3IgbWFuYWdpbmcgcGVhayBsb2FkLCBhbmQg ZGlzdHJpYnV0aW9uDQogICBhdXRvbWF0aW9uIHN5c3RlbXMgdG8gbW9uaXRvciB0aGUgaW5mcmFz dHJ1Y3R1cmUgd2hpY2ggZGVsaXZlcnMNCiAgIGVuZXJneSB0aHJvdWdob3V0IHRoZSB1cmJhbiBl bnZpcm9ubWVudC4gIFNlbnNvciBub2RlcyBjYXBhYmxlIG9mDQogICBwcm92aWRpbmcgdGhpcyB0 eXBlIG9mIGZ1bmN0aW9uYWxpdHkgbWF5IHNvbWV0aW1lcyBiZSByZWZlcnJlZCB0byBhcw0KICAg QWR2YW5jZWQgTWV0ZXJpbmcgSW5mcmFzdHJ1Y3R1cmUgKEFNSSkuDQoNCjMuMS4yLiAgQWN0dWF0 b3JzDQoNCiAgIEFjdHVhdG9yIG5vZGVzIGNvbnRyb2wgdXJiYW4gZGV2aWNlcyB1cG9uIGJlaW5n IGluc3RydWN0ZWQgYnkNCiAgIHNpZ25hbGluZyB0cmFmZmljOyBleGFtcGxlcyBhcmUgc3RyZWV0 IG9yIHRyYWZmaWMgbGlnaHRzLiAgVGhlIGFtb3VudA0KICAgb2YgYWN0dWF0b3IgcG9pbnRzIGlz IHdlbGwgYmVsb3cgdGhlIG51bWJlciBvZiBzZW5zaW5nIG5vZGVzLiAgU29tZQ0KICAgc2Vuc2lu ZyBub2RlcyBtYXkgaW5jbHVkZSBhbiBhY3R1YXRvciBjb21wb25lbnQsIGUuZy4gYW4gZWxlY3Ry aWMNCiAgIG1ldGVyIG5vZGUgd2l0aCBpbnRlZ3JhdGVkIHN1cHBvcnQgZm9yIHJlbW90ZSBzZXJ2 aWNlIGRpc2Nvbm5lY3QuDQogICBBY3R1YXRvcnMgYXJlIGNhcGFibGUgb2YgZm9yd2FyZGluZyBk YXRhLiAgQWN0dWF0b3JzIGFyZSBub3QgbGlrZWx5DQogICB0byBiZSBtb2JpbGUgaW4gdGhlIG1h am9yaXR5IG9mIG5lYXItZnV0dXJlIHJvbGwtb3V0cy4gIEFjdHVhdG9yDQogICBub2RlcyBtYXkg YWxzbyBzdWZmZXIgZnJvbSBsb25nLXRlcm0gcmVzb3VyY2UgY29uc3RyYWludHMsIGUuZy4gaW4N CiAgIHRoZSBjYXNlIHdoZXJlIHRoZXkgYXJlIGJhdHRlcnkgcG93ZXJlZC4NCg0KMy4xLjMuICBS b3V0ZXJzDQoNCiAgIFJvdXRlcnMgZ2VuZXJhbGx5IGFjdCB0byBjbG9zZSBjb3ZlcmFnZSBhbmQg cm91dGluZyBnYXBzIHdpdGhpbiB0aGUNCiAgIGludGVyaW9yIG9mIHRoZSBVLUxMTjsgZXhhbXBs ZXMgb2YgdGhlaXIgdXNlIGFyZToNCg0KICAgMS4gIHByb2xvbmcgdGhlIFUtTExOJ3MgbGlmZXRp bWUsDQoNCiAgIDIuICBiYWxhbmNlIG5vZGVzJyBlbmVyZ3kgZGVwbGV0aW9uLA0KDQogICAzLiAg YnVpbGQgYWR2YW5jZWQgc2Vuc2luZyBpbmZyYXN0cnVjdHVyZXMuDQoNCiAgIFRoZXJlIGNhbiBi ZSBzZXZlcmFsIHJvdXRlcnMgc3VwcG9ydGluZyB0aGUgc2FtZSBVLUxMTjsgaG93ZXZlciwgdGhl DQogICBudW1iZXIgb2Ygcm91dGVycyBpcyB3ZWxsIGJlbG93IHRoZSBhbW91bnQgb2Ygc2Vuc2lu ZyBub2Rlcy4gIFRoZQ0KICAgcm91dGVycyBhcmUgZ2VuZXJhbGx5IG5vdCBtb2JpbGUsIGkuZS4g Zml4ZWQgdG8gYSByYW5kb20gb3IgcHJlLQ0KICAgcGxhbm5lZCBsb2NhdGlvbi4gIFJvdXRlcnMg bWF5IGJ1dCBnZW5lcmFsbHkgZG8gbm90IHN1ZmZlciBmcm9tIGFueQ0KICAgZm9ybSBvZiAobG9u Zy10ZXJtKSByZXNvdXJjZSBjb25zdHJhaW50LCBleGNlcHQgdGhhdCB0aGV5IG5lZWQgdG8gYmUN CiAgIHNtYWxsIGFuZCBzdWZmaWNpZW50bHkgY2hlYXAuICBSb3V0ZXJzIGRpZmZlciBmcm9tIGFj dHVhdG9yIGFuZA0KICAgc2Vuc2luZyBub2RlcyBpbiB0aGF0IHRoZXkgbmVpdGhlciBjb250cm9s IG5vciBzZW5zZS4NCg0KICAgU29tZSByb3V0ZXJzIHByb3ZpZGUgYWNjZXNzIHRvIHdpZGVyIGlu ZnJhc3RydWN0dXJlcywgc3VjaCBhcyB0aGUNCg0KDQoNCkRvaGxlciwgZXQgYWwuICAgICAgICAg ICAgRXhwaXJlcyBKdW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAgICBbUGFnZSA2XQ0KDA0KSW50 ZXJuZXQtRHJhZnQgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJvdXRpbmctcmVxcy0wMyAgICBE ZWNlbWJlciAyMDA4DQoNCg0KICAgSW50ZXJuZXQsIGFuZCBhcmUgbmFtZWQgTG93IHBvd2VyIGFu ZCBsb3NzeSBuZXR3b3JrIEJvcmRlciBSb3V0ZXJzDQogICAoTEJScykgaW4gdGhhdCBjb250ZXh0 LiAgTEJSIHJvdXRlcnMgYWxzbyBzZXJ2ZSBhcyBkYXRhIHNpbmtzIChlLmcuDQogICB0aGV5IGNv bGxlY3QgYW5kIHByb2Nlc3MgZGF0YSBmcm9tIHNlbnNvcnMpIGFuZCBzb3VyY2VzIChlLmcuIHRo ZXkNCiAgIGZvcndhcmQgaW5zdHJ1Y3Rpb25zIHRvIGFjdHVhdG9ycykuDQoNCjMuMi4gIFRvcG9s b2d5DQoNCiAgIFdoaWxzdCBtaWxsaW9ucyBvZiBzZW5zaW5nIG5vZGVzIG1heSB2ZXJ5IHdlbGwg YmUgZGVwbG95ZWQgaW4gYW4NCiAgIHVyYmFuIGFyZWEsIHRoZXkgYXJlIGxpa2VseSB0byBiZSBh c3NvY2lhdGVkIHdpdGggbW9yZSB0aGFuIG9uZQ0KICAgbmV0d29yay4gIFRoZXNlIG5ldHdvcmtz IG1heSBvciBtYXkgbm90IGNvbW11bmljYXRlIGJldHdlZW4gb25lDQogICBhbm90aGVyLiAgVGhl IG51bWJlciBvZiBzZW5zaW5nIG5vZGVzIGRlcGxveWVkIGluIHRoZSB1cmJhbg0KICAgZW52aXJv bm1lbnQgaW4gc3VwcG9ydCBvZiBzb21lIGFwcGxpY2F0aW9ucyBpcyBleHBlY3RlZCB0byBiZSBp biB0aGUNCiAgIG9yZGVyIG9mIDEwXjIgdG8gMTBeNzsgdGhpcyBpcyBzdGlsbCB2ZXJ5IGxhcmdl IGFuZCB1bnByZWNlZGVudGVkIGluDQogICBjdXJyZW50IHJvbGwtb3V0cy4NCg0KICAgRGVwbG95 bWVudCBvZiBub2RlcyBpcyBsaWtlbHkgdG8gaGFwcGVuIGluIGJhdGNoZXMsIGUuZy4gYm94ZXMg b2YNCiAgIGh1bmRyZWRzIHRvIHRob3VzYW5kcyBvZiBub2RlcyBhcnJpdmUgYW5kIGFyZSBkZXBs b3llZC4gIFRoZSBsb2NhdGlvbg0KICAgb2YgdGhlIG5vZGVzIGlzIHJhbmRvbSB3aXRoaW4gZ2l2 ZW4gdG9wb2xvZ2ljYWwgY29uc3RyYWludHMsIGUuZy4NCiAgIHBsYWNlbWVudCBhbG9uZyBhIHJv YWQsIHJpdmVyLCBvciBhdCBpbmRpdmlkdWFsIHJlc2lkZW5jZXMuDQoNCjMuMy4gIFJlc291cmNl IENvbnN0cmFpbnRzDQoNCiAgIFRoZSBub2RlcyBhcmUgaGlnaGx5IHJlc291cmNlIGNvbnN0cmFp bmVkLCBpLmUuIGNoZWFwIGhhcmR3YXJlLCBsb3cNCiAgIG1lbW9yeSBhbmQgbm8gaW5maW5pdGUg ZW5lcmd5IHNvdXJjZS4gIERpZmZlcmVudCBub2RlIHBvd2VyaW5nDQogICBtZWNoYW5pc21zIGFy ZSBhdmFpbGFibGUsIHN1Y2ggYXM6DQoNCiAgIDEuICBub24tcmVjaGFyZ2VhYmxlIGJhdHRlcnk7 DQoNCiAgIDIuICByZWNoYXJnZWFibGUgYmF0dGVyeSB3aXRoIHJlZ3VsYXIgcmVjaGFyZ2luZyAo ZS5nLiBzdW5saWdodCk7DQoNCiAgIDMuICByZWNoYXJnZWFibGUgYmF0dGVyeSB3aXRoIGlycmVn dWxhciByZWNoYXJnaW5nIChlLmcuDQogICAgICAgb3Bwb3J0dW5pc3RpYyBlbmVyZ3kgc2NhdmVu Z2luZyk7DQoNCiAgIDQuICBjYXBhY2l0aXZlL2luZHVjdGl2ZSBlbmVyZ3kgcHJvdmlzaW9uIChl LmcuIHBhc3NpdmUgUmFkaW8NCiAgICAgICBGcmVxdWVuY3kgSURlbnRpZmljYXRpb24gKFJGSUQp KTsNCg0KICAgNS4gIGFsd2F5cyBvbiAoZS5nLiBwb3dlcmVkIGVsZWN0cmljaXR5IG1ldGVyKS4N Cg0KICAgSW4gdGhlIGNhc2Ugb2YgYSBiYXR0ZXJ5IHBvd2VyZWQgc2Vuc2luZyBub2RlLCB0aGUg YmF0dGVyeSBzaGVsZiBsaWZlDQogICBpcyB1c3VhbGx5IGluIHRoZSBvcmRlciBvZiAxMCB0byAx NSB5ZWFycywgcmVuZGVyaW5nIG5ldHdvcmsgbGlmZXRpbWUNCiAgIG1heGltaXphdGlvbiB3aXRo IGJhdHRlcnkgcG93ZXJlZCBub2RlcyBiZXlvbmQgdGhpcyBsaWZlc3BhbiB1c2VsZXNzLg0KDQog ICBUaGUgcGh5c2ljYWwgYW5kIGVsZWN0cm9tYWduZXRpYyBkaXN0YW5jZXMgYmV0d2VlbiB0aGUg dGhyZWUga2V5DQogICBlbGVtZW50cywgaS5lLiBzZW5zb3JzLCBhY3R1YXRvcnMsIGFuZCByb3V0 ZXJzLCBjYW4gZ2VuZXJhbGx5IGJlIHZlcnkNCiAgIGxhcmdlLCBpLmUuIGZyb20gc2V2ZXJhbCBo dW5kcmVkcyBvZiBtZXRlcnMgdG8gb25lIGtpbG9tZXRlci4gIE5vdA0KICAgZXZlcnkgZmllbGQg bm9kZSBpcyBsaWtlbHkgdG8gcmVhY2ggdGhlIExCUiBpbiBhIHNpbmdsZSBob3AsIHRoZXJlYnkN CiAgIHJlcXVpcmluZyBzdWl0YWJsZSByb3V0aW5nIHByb3RvY29scyB3aGljaCBtYW5hZ2UgdGhl IGluZm9ybWF0aW9uDQogICBmbG93IGluIGFuIGVuZXJneS1lZmZpY2llbnQgbWFubmVyLg0KDQoN Cg0KRG9obGVyLCBldCBhbC4gICAgICAgICAgICBFeHBpcmVzIEp1bmUgMjIsIDIwMDkgICAgICAg ICAgICAgICAgIFtQYWdlIDddDQoMDQpJbnRlcm5ldC1EcmFmdCAgICBkcmFmdC1pZXRmLXJvbGwt dXJiYW4tcm91dGluZy1yZXFzLTAzICAgIERlY2VtYmVyIDIwMDgNCg0KDQozLjQuICBMaW5rIFJl bGlhYmlsaXR5DQoNCiAgIFRoZSBsaW5rcyBiZXR3ZWVuIHRoZSBuZXR3b3JrIGVsZW1lbnRzIGFy ZSB2b2xhdGlsZSBkdWUgdG8gdGhlDQogICBmb2xsb3dpbmcgc2V0IG9mIG5vbi1leGNsdXNpdmUg ZWZmZWN0czoNCg0KICAgMS4gIHBhY2tldCBlcnJvcnMgZHVlIHRvIHdpcmVsZXNzIGNoYW5uZWwg ZWZmZWN0czsNCg0KICAgMi4gIHBhY2tldCBlcnJvcnMgZHVlIHRvIE1BQyAoTWVkaXVtIEFjY2Vz cyBDb250cm9sKSAoZS5nLg0KICAgICAgIGNvbGxpc2lvbik7DQoNCiAgIDMuICBwYWNrZXQgZXJy b3JzIGR1ZSB0byBpbnRlcmZlcmVuY2UgZnJvbSBvdGhlciBzeXN0ZW1zOw0KDQogICA0LiAgbGlu ayB1bmF2YWlsYWJpbGl0eSBkdWUgdG8gbmV0d29yayBkeW5hbWljaXR5OyBldGMuDQoNCiAgIFRo ZSB3aXJlbGVzcyBjaGFubmVsIGNhdXNlcyB0aGUgcmVjZWl2ZWQgcG93ZXIgdG8gZHJvcCBiZWxv dyBhIGdpdmVuDQogICB0aHJlc2hvbGQgaW4gYSByYW5kb20gZmFzaGlvbiwgdGhlcmVieSBjYXVz aW5nIGRldGVjdGlvbiBlcnJvcnMgaW4NCiAgIHRoZSByZWNlaXZpbmcgbm9kZS4gIFRoZSB1bmRl cmx5aW5nIGVmZmVjdHMgYXJlIHBhdGggbG9zcywgc2hhZG93aW5nDQogICBhbmQgZmFkaW5nLg0K DQogICBTaW5jZSB0aGUgd2lyZWxlc3MgbWVkaXVtIGlzIGJyb2FkY2FzdCBpbiBuYXR1cmUsIG5v ZGVzIGluIHRoZWlyDQogICBjb21tdW5pY2F0aW9uIHJhZGlvcyByZXF1aXJlIHN1aXRhYmxlIG1l ZGl1bSBhY2Nlc3MgY29udHJvbCBwcm90b2NvbHMNCiAgIHdoaWNoIGFyZSBjYXBhYmxlIG9mIHJl c29sdmluZyBhbnkgYXJpc2luZyBjb250ZW50aW9uLiAgU29tZQ0KICAgYXZhaWxhYmxlIHByb3Rv Y29scyBtYXkgbm90IGJlIGFibGUgdG8gcHJldmVudCBwYWNrZXRzIG9mIG5laWdoYm9yaW5nDQog ICBub2RlcyBmcm9tIGNvbGxpZGluZywgcG9zc2libHkgbGVhZGluZyB0byBhIGhpZ2ggUGFja2V0 IEVycm9yIFJhdGUNCiAgIChQRVIpIGFuZCBjYXVzaW5nIGEgbGluayBvdXRhZ2UuDQoNCiAgIEZ1 cnRoZXJtb3JlLCB0aGUgb3V0ZG9vciBkZXBsb3ltZW50IG9mIFUtTExOcyBhbHNvIGhhcyBpbXBs aWNhdGlvbnMNCiAgIGZvciB0aGUgaW50ZXJmZXJlbmNlIHRlbXBlcmF0dXJlIGFuZCBoZW5jZSBs aW5rIHJlbGlhYmlsaXR5IGFuZCByYW5nZQ0KICAgaWYgSW5kdXN0cmlhbCwgU2NpZW50aWZpYyBh bmQgTWVkaWNhbCAoSVNNKSBiYW5kcyBhcmUgdG8gYmUgdXNlZC4NCiAgIEZvciBpbnN0YW5jZSwg aWYgdGhlIDIuNEdIeiBJU00gYmFuZCBpcyB1c2VkIHRvIGZhY2lsaXRhdGUNCiAgIGNvbW11bmlj YXRpb24gYmV0d2VlbiBVLUxMTiBub2RlcywgdGhlbiBoZWF2aWx5IGxvYWRlZCBXaXJlbGVzcyBM b2NhbA0KICAgQXJlYSBOZXR3b3JrIChXTEFOKSBob3Qtc3BvdHMgbWF5IGJlY29tZSBhIGRldHJp bWVudGFsIHBlcmZvcm1hbmNlDQogICBmYWN0b3IsIGxlYWRpbmcgdG8gaGlnaCBQRVIgYW5kIGpl b3BhcmRpemluZyB0aGUgZnVuY3Rpb25pbmcgb2YgdGhlDQogICBVLUxMTi4NCg0KICAgRmluYWxs eSwgbm9kZXMgYXBwZWFyaW5nIGFuZCBkaXNhcHBlYXJpbmcgY2F1c2VzIGR5bmFtaWNzIGluIHRo ZQ0KICAgbmV0d29yayB3aGljaCBjYW4geWllbGQgbGluayBvdXRhZ2VzIGFuZCBjaGFuZ2VzIG9m IHRvcG9sb2dpZXMuDQoNCg0KNC4gIFVyYmFuIExMTiBBcHBsaWNhdGlvbiBTY2VuYXJpb3MNCg0K ICAgVXJiYW4gYXBwbGljYXRpb25zIHJlcHJlc2VudCBhIHNwZWNpYWwgc2VnbWVudCBvZiBMTE5z IHdpdGggaXRzDQogICB1bmlxdWUgc2V0IG9mIHJlcXVpcmVtZW50cy4gIFRvIGZhY2lsaXRhdGUg dGhlIHJlcXVpcmVtZW50cw0KICAgZGlzY3Vzc2lvbiBpbiBTZWN0aW9uIDYsIHRoaXMgc2VjdGlv biBsaXN0cyBhIGZldyB0eXBpY2FsIGJ1dCBub3QNCiAgIGV4aGF1c3RpdmUgZGVwbG95bWVudCBw cm9ibGVtcyBhbmQgdXNhZ2UgY2FzZXMgb2YgVS1MTE4uDQoNCg0KDQoNCg0KDQpEb2hsZXIsIGV0 IGFsLiAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAyMiwgMjAwOSAgICAgICAgICAgICAgICAgW1Bh Z2UgOF0NCgwNCkludGVybmV0LURyYWZ0ICAgIGRyYWZ0LWlldGYtcm9sbC11cmJhbi1yb3V0aW5n LXJlcXMtMDMgICAgRGVjZW1iZXIgMjAwOA0KDQoNCjQuMS4gIERlcGxveW1lbnQgb2YgTm9kZXMN Cg0KICAgQ29udHJhcnkgdG8gb3RoZXIgTExOIGFwcGxpY2F0aW9ucywgZGVwbG95bWVudCBvZiBu b2RlcyBpcyBsaWtlbHkgdG8NCiAgIGhhcHBlbiBpbiBiYXRjaGVzIG91dCBvZiBhIGJveC4gIFR5 cGljYWxseSwgaHVuZHJlZHMgdG8gdGhvdXNhbmRzIG9mDQogICBub2RlcyBhcmUgYmVpbmcgc2hp cHBlZCBieSB0aGUgbWFudWZhY3R1cmVyIHdpdGggcHJlLXByb2dyYW1tZWQNCiAgIGZ1bmN0aW9u YWxpdGllcyB3aGljaCBhcmUgdGhlbiByb2xsZWQtb3V0IGJ5IGEgc2VydmljZSBwcm92aWRlciBv cg0KICAgc3ViY29udHJhY3RlZCBlbnRpdGllcy4gIFByaW9yIG9yIGFmdGVyIHJvbGwtb3V0LCB0 aGUgbmV0d29yayBuZWVkcw0KICAgdG8gYmUgcmFtcGVkLXVwLiAgVGhpcyBpbml0aWFsaXphdGlv biBwaGFzZSBtYXkgaW5jbHVkZSwgYW1vbmcNCiAgIG90aGVycywgYWxsb2NhdGlvbiBvZiBhZGRy ZXNzZXMsIChwb3NzaWJseSBoaWVyYXJjaGljYWwpIHJvbGVzIGluIHRoZQ0KICAgbmV0d29yaywg c3luY2hyb25pemF0aW9uLCBkZXRlcm1pbmF0aW9uIG9mIHNjaGVkdWxlcywgZXRjLg0KDQogICBJ ZiBpbml0aWFsaXphdGlvbiBpcyBwZXJmb3JtZWQgcHJpb3IgdG8gcm9sbC1vdXQsIGFsbCBub2Rl cyBhcmUNCiAgIGxpa2VseSB0byBiZSBpbiBvbmUgYW5vdGhlcidzIDEtaG9wIHJhZGlvIG5laWdo Ym9yaG9vZC4gIFByZS0NCiAgIHByb2dyYW1tZWQgTWVkaWEgQWNjZXNzIENvbnRyb2wgKE1BQykg YW5kIHJvdXRpbmcgcHJvdG9jb2xzIG1heSBoZW5jZQ0KICAgZmFpbCB0byBmdW5jdGlvbiBwcm9w ZXJseSwgdGhlcmVieSB3YXN0aW5nIGEgbGFyZ2UgYW1vdW50IG9mIGVuZXJneS4NCiAgIFdoaWxz dCB0aGUgbWFqb3IgYnVyZGVuIHdpbGwgYmUgb24gcmVzb2x2aW5nIE1BQyBjb25mbGljdHMsIGFu eQ0KICAgcHJvcG9zZWQgVS1MTE4gcm91dGluZyBwcm90b2NvbCBuZWVkcyB0byBjYXRlciBmb3Ig c3VjaCBhIGNhc2UuICBGb3INCiAgIGluc3RhbmNlLCAwLWNvbmZpZ3VyYXRpb24gYW5kIG5ldHdv cmsgYWRkcmVzcyBhbGxvY2F0aW9uIG5lZWRzIHRvIGJlDQogICBwcm9wZXJseSBzdXBwb3J0ZWQs IGV0Yy4NCg0KICAgQWZ0ZXIgcm9sbC1vdXQsIG5vZGVzIHdpbGwgaGF2ZSBhIGZpbml0ZSBzZXQg b2Ygb25lLWhvcCBuZWlnaGJvcnMsDQogICBsaWtlbHkgb2YgbG93IGNhcmRpbmFsaXR5IChpbiB0 aGUgb3JkZXIgb2YgNSB0byAxMCkuICBIb3dldmVyLCBzb21lDQogICBub2RlcyBtYXkgYmUgZGVw bG95ZWQgaW4gYXJlYXMgd2hlcmUgdGhlcmUgYXJlIGh1bmRyZWRzIG9mDQogICBuZWlnaGJvcmlu ZyBkZXZpY2VzLiAgSW4gdGhlIHJlc3VsdGluZyB0b3BvbG9neSB0aGVyZSBtYXkgYmUgcmVnaW9u cw0KICAgd2hlcmUgbWFueSAocmVkdW5kYW50KSBwYXRocyBhcmUgcG9zc2libGUgdGhyb3VnaCB0 aGUgbmV0d29yay4gIE90aGVyDQogICByZWdpb25zIG1heSBiZSBkZXBlbmRlbnQgb24gY3JpdGlj YWwgbGlua3MgdG8gYWNoaWV2ZSBjb25uZWN0aXZpdHkNCiAgIHdpdGggdGhlIHJlc3Qgb2YgdGhl IG5ldHdvcmsuICBBbnkgcHJvcG9zZWQgTExOIHJvdXRpbmcgcHJvdG9jb2wNCiAgIG91Z2h0IHRv IHN1cHBvcnQgdGhlIGF1dG9ub21vdXMgc2VsZi1vcmdhbml6YXRpb24gYW5kIHNlbGYtDQogICBj b25maWd1cmF0aW9uIG9mIHRoZSBuZXR3b3JrIGF0IGxvd2VzdCBwb3NzaWJsZSBlbmVyZ3kgY29z dCBbTHUyMDA3XSwNCiAgIHdoZXJlIGF1dG9ub215IGlzIHVuZGVyc3Rvb2QgdG8gYmUgdGhlIGFi aWxpdHkgb2YgdGhlIG5ldHdvcmsgdG8NCiAgIG9wZXJhdGUgd2l0aG91dCBleHRlcm5hbCBpbmZs dWVuY2UuICBUaGUgcmVzdWx0IG9mIHN1Y2ggb3JnYW5pemF0aW9uDQogICBzaG91bGQgYmUgdGhh dCBlYWNoIG5vZGUgb3Igc2V0IG9mIG5vZGVzIGlzIHVuaXF1ZWx5IGFkZHJlc3NhYmxlIHNvDQog ICBhcyB0byBmYWNpbGl0YXRlIHRoZSBzZXQgdXAgb2Ygc2NoZWR1bGVzLCBldGMuDQoNCiAgIFVu bGVzcyBleGNlcHRpb25hbGx5IG5lZWRlZCwgYnJvYWRjYXN0IGZvcndhcmRpbmcgc2NoZW1lcyBh cmUgbm90DQogICBhZHZpc2VkIGluIHVyYmFuIHNlbnNvciBuZXR3b3JraW5nIGVudmlyb25tZW50 cy4NCg0KNC4yLiAgQXNzb2NpYXRpb24gYW5kIERpc2Fzc29jaWF0aW9uL0Rpc2FwcGVhcmFuY2Ug b2YgTm9kZXMNCg0KICAgQWZ0ZXIgdGhlIGluaXRpYWxpemF0aW9uIHBoYXNlIGFuZCBwb3NzaWJs eSBzb21lIG9wZXJhdGlvbmFsIHRpbWUsDQogICBuZXcgbm9kZXMgbWF5IGJlIGluamVjdGVkIGlu dG8gdGhlIG5ldHdvcmsgYXMgd2VsbCBhcyBleGlzdGluZyBub2Rlcw0KICAgcmVtb3ZlZCBmcm9t IHRoZSBuZXR3b3JrLiAgVGhlIGZvcm1lciBtaWdodCBiZSBiZWNhdXNlIGEgcmVtb3ZlZCBub2Rl DQogICBpcyByZXBsYWNlZCBhcyBwYXJ0IG9mIG1haW50ZW5hbmNlLCBvciBuZXcgbm9kZXMgYXJl IGFkZGVkIGJlY2F1c2UNCiAgIG1vcmUgc2Vuc29ycyBmb3IgZGVuc2VyIHJlYWRpbmdzL2FjdHVh dGlvbnMgYXJlIG5lZWRlZCwgb3IgYmVjYXVzZQ0KICAgcm91dGluZyBwcm90b2NvbHMgcmVwb3J0 IGNvbm5lY3Rpdml0eSBwcm9ibGVtcy4gIFRoZSBsYXR0ZXIgbWlnaHQgYmUNCiAgIGJlY2F1c2Ug YSBub2RlJ3MgYmF0dGVyeSBpcyBkZXBsZXRlZCwgdGhlIG5vZGUgaXMgcmVtb3ZlZCBmb3INCiAg IG1haW50ZW5hbmNlLCB0aGUgbm9kZSBpcyBzdG9sZW4gb3IgYWNjaWRlbnRhbGx5IGRlc3Ryb3ll ZCwgZXRjLg0KDQoNCg0KDQpEb2hsZXIsIGV0IGFsLiAgICAgICAgICAgIEV4cGlyZXMgSnVuZSAy MiwgMjAwOSAgICAgICAgICAgICAgICAgW1BhZ2UgOV0NCgwNCkludGVybmV0LURyYWZ0ICAgIGRy YWZ0LWlldGYtcm9sbC11cmJhbi1yb3V0aW5nLXJlcXMtMDMgICAgRGVjZW1iZXIgMjAwOA0KDQoN CiAgIFRoZSBwcm90b2NvbChzKSBoZW5jZSBzaG91bGQgYmUgYWJsZSB0byBjb252ZXkgaW5mb3Jt YXRpb24gYWJvdXQNCiAgIG1hbGZ1bmN0aW9uaW5nIG5vZGVzIHdoaWNoIG1heSBhZmZlY3Qgb3Ig amVvcGFyZGl6ZSB0aGUgb3ZlcmFsbA0KICAgcm91dGluZyBlZmZpY2llbmN5LCBzbyB0aGF0IHNl bGYtb3JnYW5pemF0aW9uIGFuZCBzZWxmLWNvbmZpZ3VyYXRpb24NCiAgIGNhcGFiaWxpdGllcyBv ZiB0aGUgc2Vuc29yIG5ldHdvcmsgbWlnaHQgYmUgc29saWNpdGVkIHRvIGZhY2lsaXRhdGUNCiAg IHRoZSBhcHByb3ByaWF0ZSByZWNvbmZpZ3VyYXRpb24uICBUaGlzIGluZm9ybWF0aW9uIG1heSBl LmcuIGluY2x1ZGUNCiAgIGV4YWN0IG9yIHJlbGF0aXZlIGdlb2dyYXBoaWNhbCBwb3NpdGlvbiwg ZXRjLiAgVGhlIHJlY29uZmlndXJhdGlvbg0KICAgbWF5IGluY2x1ZGUgdGhlIGNoYW5nZSBvZiBo aWVyYXJjaGllcywgcm91dGluZyBwYXRocywgcGFja2V0DQogICBmb3J3YXJkaW5nIHNjaGVkdWxl cywgZXRjLiAgRnVydGhlcm1vcmUsIHRvIGluZm9ybSB0aGUgTEJSKHMpIG9mIHRoZQ0KICAgbm9k ZSdzIGFycml2YWwgYW5kIGFzc29jaWF0aW9uIHdpdGggdGhlIG5ldHdvcmsgYXMgd2VsbCBhcyBm cmVzaGx5DQogICBhc3NvY2lhdGVkIG5vZGVzIGFib3V0IHBhY2tldCBmb3J3YXJkaW5nIHNjaGVk dWxlcywgcm9sZXMsIGV0YywNCiAgIGFwcHJvcHJpYXRlIHVwZGF0aW5nIG1lY2hhbmlzbXMgc2hv dWxkIGJlIHN1cHBvcnRlZC4NCg0KNC4zLiAgUmVndWxhciBNZWFzdXJlbWVudCBSZXBvcnRpbmcN Cg0KICAgVGhlIG1ham9yaXR5IG9mIHNlbnNpbmcgbm9kZXMgd2lsbCBiZSBjb25maWd1cmVkIHRv IHJlcG9ydCB0aGVpcg0KICAgcmVhZGluZ3Mgb24gYSByZWd1bGFyIGJhc2lzLiAgVGhlIGZyZXF1 ZW5jeSBvZiBkYXRhIHNlbnNpbmcgYW5kDQogICByZXBvcnRpbmcgbWF5IGJlIGRpZmZlcmVudCBi dXQgaXMgZ2VuZXJhbGx5IGV4cGVjdGVkIHRvIGJlIGZhaXJseQ0KICAgbG93LCBpLmUuIGluIHRo ZSByYW5nZSBvZiBvbmNlIHBlciBob3VyLCBwZXIgZGF5LCBldGMuICBUaGUgcmF0aW8NCiAgIGJl dHdlZW4gZGF0YSBzZW5zaW5nIGFuZCByZXBvcnRpbmcgZnJlcXVlbmNpZXMgd2lsbCBkZXRlcm1p bmUgdGhlDQogICBtZW1vcnkgYW5kIGRhdGEgYWdncmVnYXRpb24gY2FwYWJpbGl0aWVzIG9mIHRo ZSBub2Rlcy4gIExhdGVuY3kgb2YgYW4NCiAgIGVuZC10by1lbmQgZGVsaXZlcnkgYW5kIGFja25v d2xlZGdlbWVudHMgb2YgYSBzdWNjZXNzZnVsIGRhdGENCiAgIGRlbGl2ZXJ5IG1heSBub3QgYmUg dml0YWwgYXMgc2Vuc2luZyBvdXRhZ2VzIGNhbiBiZSBvYnNlcnZlZCBhdCB0aGUNCiAgIExCUihz KSAtIHdoZW4sIGZvciBpbnN0YW5jZSwgdGhlcmUgaXMgbm8gcmVhZGluZyBhcnJpdmluZyBmcm9t IGENCiAgIGdpdmVuIHNlbnNvciBvciBjbHVzdGVyIG9mIHNlbnNvcnMgd2l0aGluIGEgZGF5LiAg SW4gdGhpcyBjYXNlLCBhDQogICBxdWVyeSBjYW4gYmUgbGF1bmNoZWQgdG8gY2hlY2sgdXBvbiB0 aGUgc3RhdGUgYW5kIGF2YWlsYWJpbGl0eSBvZiBhDQogICBzZW5zaW5nIG5vZGUgb3Igc2Vuc2lu ZyBjbHVzdGVyLg0KDQogICBUaGUgcHJvdG9jb2wocykgaGVuY2Ugc2hvdWxkIGJlIG9wdGltaXpl ZCB0byBzdXBwb3J0IGEgbGFyZ2UgbnVtYmVyDQogICBvZiBoaWdobHkgZGlyZWN0aW9uYWwgdW5p Y2FzdCBmbG93cyBmcm9tIHRoZSBzZW5zaW5nIG5vZGVzIG9yIHNlbnNpbmcNCiAgIGNsdXN0ZXJz IHRvd2FyZHMgYSBMQlIsIG9yIGhpZ2hseSBkaXJlY3RlZCBtdWx0aWNhc3Qgb3IgYW55Y2FzdCBm bG93cw0KICAgZnJvbSB0aGUgbm9kZXMgdG93YXJkcyBtdWx0aXBsZSBMQlJzLg0KDQogICBSb3V0 ZSBjb21wdXRhdGlvbiBhbmQgc2VsZWN0aW9uIG1heSBkZXBlbmQgb24gdGhlIHRyYW5zbWl0dGVk DQogICBpbmZvcm1hdGlvbiwgdGhlIGZyZXF1ZW5jeSBvZiByZXBvcnRpbmcsIHRoZSBhbW91bnQg b2YgZW5lcmd5DQogICByZW1haW5pbmcgaW4gdGhlIG5vZGVzLCB0aGUgcmVjaGFyZ2luZyBwYXR0 ZXJuIG9mIGVuZXJneS1zY2F2ZW5nZWQNCiAgIG5vZGVzLCBldGMuICBGb3IgaW5zdGFuY2UsIHRl bXBlcmF0dXJlIHJlYWRpbmdzIGNvdWxkIGJlIHJlcG9ydGVkDQogICBldmVyeSBob3VyIHZpYSBv bmUgc2V0IG9mIGJhdHRlcnkgcG93ZXJlZCBub2Rlcywgd2hlcmVhcyBhaXIgcXVhbGl0eQ0KICAg aW5kaWNhdG9ycyBhcmUgcmVwb3J0ZWQgb25seSBkdXJpbmcgZGF5dGltZSB2aWEgbm9kZXMgcG93 ZXJlZCBieQ0KICAgc29sYXIgZW5lcmd5LiAgTW9yZSBnZW5lcmFsbHksIGVudGlyZSByb3V0aW5n IGFyZWFzIG1heSBiZSBhdm9pZGVkDQogICAoZS5nLiBhdCBuaWdodCkgYnV0IGhlYXZpbHkgdXNl ZCBkdXJpbmcgdGhlIGRheSB3aGVuIG5vZGVzIGFyZQ0KICAgc2NhdmVuZ2luZyBmcm9tIHN1bmxp Z2h0Lg0KDQo0LjQuICBRdWVyaWVkIE1lYXN1cmVtZW50IFJlcG9ydGluZw0KDQogICBPY2Nhc2lv bmFsbHksIG5ldHdvcmsgZXh0ZXJuYWwgZGF0YSBxdWVyaWVzIGNhbiBiZSBsYXVuY2hlZCBieSBv bmUgb3INCiAgIHNldmVyYWwgTEJScy4gIEZvciBpbnN0YW5jZSwgaXQgaXMgZGVzaXJhYmxlIHRv IGtub3cgdGhlIGxldmVsIG9mDQogICBwb2xsdXRpb24gYXQgYSBzcGVjaWZpYyBwb2ludCBvciBh bG9uZyBhIGdpdmVuIHJvYWQgaW4gdGhlIHVyYmFuDQogICBlbnZpcm9ubWVudC4gIFRoZSBxdWVy aWVzJyByYXRlcyBvZiBvY2N1cnJlbmNlIGFyZSBub3QgcmVndWxhciBidXQNCg0KDQoNCkRvaGxl ciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAg IFtQYWdlIDEwXQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJv dXRpbmctcmVxcy0wMyAgICBEZWNlbWJlciAyMDA4DQoNCg0KICAgcmF0aGVyIHJhbmRvbSwgd2hl cmUgaGVhdnktdGFpbCBkaXN0cmlidXRpb25zIHNlZW0gYXBwcm9wcmlhdGUgdG8NCiAgIG1vZGVs IHRoZWlyIGJlaGF2aW9yLiAgUXVlcmllcyBkbyBub3QgbmVjZXNzYXJpbHkgbmVlZCB0byBiZSBy ZXBvcnRlZA0KICAgYmFjayB0byB0aGUgc2FtZSBMQlIgZnJvbSB3aGVyZSB0aGUgcXVlcnkgd2Fz IGxhdW5jaGVkLiAgUm91bmQtdHJpcA0KICAgdGltZXMsIGkuZS4gZnJvbSB0aGUgbGF1bmNoIG9m IGEgcXVlcnkgZnJvbSBhbiBMQlIgdG93YXJkcyB0aGUNCiAgIGRlbGl2ZXJ5IG9mIHRoZSBtZWFz dXJlZCBkYXRhIHRvIGFuIExCUiwgYXJlIG9mIGltcG9ydGFuY2UuICBIb3dldmVyLA0KICAgdGhl eSBhcmUgbm90IHZlcnkgc3RyaW5nZW50IHdoZXJlIGxhdGVuY2llcyBzaG91bGQgc2ltcGx5IGJl DQogICBzdWZmaWNpZW50bHkgc21hbGxlciB0aGFuIHR5cGljYWwgcmVwb3J0aW5nIGludGVydmFs czsgZm9yIGluc3RhbmNlLA0KICAgaW4gdGhlIG9yZGVyIG9mIHNlY29uZHMgb3IgbWludXRlLiAg VGhlIHJvdXRpbmcgcHJvdG9jb2wocykgc2hvdWxkDQogICBjb25zaWRlciB0aGUgc2VsZWN0aW9u IG9mIHBhdGhzIHdpdGggYXBwcm9wcmlhdGUgKGUuZy4gbGF0ZW5jeSkNCiAgIG1ldHJpY3MgdG8g c3VwcG9ydCBxdWVyaWVkIG1lYXN1cmVtZW50IHJlcG9ydGluZy4gIFRvIGZhY2lsaXRhdGUgdGhl DQogICBxdWVyeSBwcm9jZXNzLCBVLUxMTiBuZXR3b3JrIGRldmljZXMgc2hvdWxkIHN1cHBvcnQg dW5pY2FzdCBhbmQNCiAgIG11bHRpY2FzdCByb3V0aW5nIGNhcGFiaWxpdGllcy4NCg0KICAgVGhl IHNhbWUgYXBwcm9hY2ggaXMgYWxzbyBhcHBsaWNhYmxlIGZvciBzY2hlZHVsZSB1cGRhdGUsDQog ICBwcm92aXNpb25pbmcgb2YgcGF0Y2hlcyBhbmQgdXBncmFkZXMsIGV0Yy4gIEluIHRoaXMgY2Fz ZSwgaG93ZXZlciwNCiAgIHRoZSBwcm92aXNpb24gb2YgYWNrbm93bGVkZ2VtZW50cyBhbmQgdGhl IHN1cHBvcnQgb2YgdW5pY2FzdCwNCiAgIG11bHRpY2FzdCwgYW5kIGFueWNhc3QgYXJlIG9mIGlt cG9ydGFuY2UuDQoNCjQuNS4gIEFsZXJ0IFJlcG9ydGluZw0KDQogICBSYXJlbHksIHRoZSBzZW5z aW5nIG5vZGVzIHdpbGwgbWVhc3VyZSBhbiBldmVudCB3aGljaCBjbGFzc2lmaWVzIGFzDQogICBh bGFybSB3aGVyZSBzdWNoIGEgY2xhc3NpZmljYXRpb24gaXMgdHlwaWNhbGx5IGRvbmUgbG9jYWxs eSB3aXRoaW4NCiAgIGVhY2ggbm9kZSBieSBtZWFucyBvZiBhIHByZS1wcm9ncmFtbWVkIG9yIHBy aW9yIGRpZmZ1c2VkIHRocmVzaG9sZC4NCiAgIE5vdGUgdGhhdCBvbiBhcHByb2FjaGluZyB0aGUg YWxlcnQgdGhyZXNob2xkIGxldmVsLCBub2RlcyBtYXkgd2lzaCB0bw0KICAgY2hhbmdlIHRoZWly IHNlbnNpbmcgYW5kIHJlcG9ydGluZyBjeWNsZXMuICBBbiBhbGFybSBpcyBsaWtlbHkgYmVpbmcN CiAgIHJlZ2lzdGVyZWQgYnkgYSBwbHVyYWxpdHkgb2Ygc2Vuc2luZyBub2RlcyB3aGVyZSB0aGUg ZGVsaXZlcnkgb2YgYQ0KICAgc2luZ2xlIGFsZXJ0IG1lc3NhZ2Ugd2l0aCBpdHMgbG9jYXRpb24g b2Ygb3JpZ2luIHN1ZmZpY2VzIGluIG1vc3QsDQogICBidXQgbm90IGFsbCwgY2FzZXMuICBPbmUg ZXhhbXBsZSBvZiBhbGVydCByZXBvcnRpbmcgaXMgaWYgdGhlIGxldmVsDQogICBvZiB0b3hpYyBn YXNlcyByaXNlcyBhYm92ZSBhIHRocmVzaG9sZCwgdGhlcmV1cG9uIHRoZSBzZW5zaW5nIG5vZGVz DQogICBpbiB0aGUgdmljaW5pdHkgb2YgdGhpcyBldmVudCByZXBvcnQgdGhlIGRhbmdlci4gIEFu b3RoZXIgZXhhbXBsZSBvZg0KICAgYWxlcnQgcmVwb3J0aW5nIGlzIHdoZW4gYSByZWN5Y2xpbmcg Z2xhc3MgY29udGFpbmVyIC0gZXF1aXBwZWQgd2l0aCBhDQogICBzZW5zb3IgbWVhc3VyaW5nIGl0 cyBsZXZlbCBvZiBvY2N1cGFuY3kgLSByZXBvcnRzIHRoYXQgdGhlIGNvbnRhaW5lcg0KICAgaXMg ZnVsbCBhbmQgaGVuY2UgbmVlZHMgdG8gYmUgZW1wdGllZC4NCg0KICAgUm91dGVzIGNsZWFybHkg bmVlZCB0byBiZSB1bmljYXN0ICh0b3dhcmRzIG9uZSBMQlIpIG9yIG11bHRpY2FzdA0KICAgKHRv d2FyZHMgbXVsdGlwbGUgTEJScykuICBEZWxheXMgYW5kIGxhdGVuY2llcyBhcmUgaW1wb3J0YW50 Ow0KICAgaG93ZXZlciwgYWdhaW4sIGRlbGl2ZXJpZXMgd2l0aGluIHNlY29uZHMgc2hvdWxkIHN1 ZmZpY2UgaW4gbW9zdCBvZg0KICAgdGhlIGNhc2VzLg0KDQoNCjUuICBUcmFmZmljIFBhdHRlcm4N Cg0KICAgVW5saWtlIHRyYWRpdGlvbmFsIGFkIGhvYyBuZXR3b3JrcywgdGhlIGluZm9ybWF0aW9u IGZsb3cgaW4gVS1MTE5zIGlzDQogICBoaWdobHkgZGlyZWN0aW9uYWwuICBUaGVyZSBhcmUgdGhy ZWUgbWFpbiBmbG93cyB0byBiZSBkaXN0aW5ndWlzaGVkOg0KDQogICAxLiAgc2Vuc2VkIGluZm9y bWF0aW9uIGZyb20gdGhlIHNlbnNpbmcgbm9kZXMgdG93YXJkcyBvbmUgb3IgYSBzdWJzZXQNCiAg ICAgICBvZiB0aGUgTEJSKHMpOw0KDQoNCg0KDQpEb2hsZXIsIGV0IGFsLiAgICAgICAgICAgIEV4 cGlyZXMgSnVuZSAyMiwgMjAwOSAgICAgICAgICAgICAgICBbUGFnZSAxMV0NCgwNCkludGVybmV0 LURyYWZ0ICAgIGRyYWZ0LWlldGYtcm9sbC11cmJhbi1yb3V0aW5nLXJlcXMtMDMgICAgRGVjZW1i ZXIgMjAwOA0KDQoNCiAgIDIuICBxdWVyeSByZXF1ZXN0cyBmcm9tIHRoZSBMQlIocykgdG93YXJk cyB0aGUgc2Vuc2luZyBub2RlczsNCg0KICAgMy4gIGNvbnRyb2wgaW5mb3JtYXRpb24gZnJvbSB0 aGUgTEJSKHMpIHRvd2FyZHMgdGhlIGFjdHVhdG9ycy4NCg0KICAgU29tZSBvZiB0aGUgZmxvd3Mg bWF5IG5lZWQgdGhlIHJldmVyc2Ugcm91dGUgZm9yIGRlbGl2ZXJpbmcNCiAgIGFja25vd2xlZGdl bWVudHMuICBGaW5hbGx5LCBpbiB0aGUgZnV0dXJlLCBzb21lIGRpcmVjdCBpbmZvcm1hdGlvbg0K ICAgZmxvd3MgYmV0d2VlbiBmaWVsZCBkZXZpY2VzIHdpdGhvdXQgTEJScyBtYXkgYWxzbyBvY2N1 ci4NCg0KICAgU2Vuc2VkIGRhdGEgaXMgbGlrZWx5IHRvIGJlIGhpZ2hseSBjb3JyZWxhdGVkIGlu IHNwYWNlLCB0aW1lIGFuZA0KICAgb2JzZXJ2ZWQgZXZlbnRzOyBhbiBleGFtcGxlIG9mIHRoZSBs YXR0ZXIgaXMgd2hlbiB0ZW1wZXJhdHVyZQ0KICAgaW5jcmVhc2UgYW5kIGh1bWlkaXR5IGRlY3Jl YXNlIGFzIHRoZSBkYXkgY29tbWVuY2VzLiAgRGF0YSBtYXkgYmUNCiAgIHNlbnNlZCBhbmQgZGVs aXZlcmVkIGF0IGRpZmZlcmVudCByYXRlcyB3aXRoIGJvdGggcmF0ZXMgYmVpbmcNCiAgIHR5cGlj YWxseSBmYWlybHkgbG93LCBpLmUuIGluIHRoZSByYW5nZSBvZiBtaW51dGVzLCBob3VycywgZGF5 cywgZXRjLg0KICAgRGF0YSBtYXkgYmUgZGVsaXZlcmVkIHJlZ3VsYXJseSBhY2NvcmRpbmcgdG8g YSBzY2hlZHVsZSBvciBhIHJlZ3VsYXINCiAgIHF1ZXJ5OyBpdCBtYXkgYWxzbyBiZSBkZWxpdmVy ZWQgaXJyZWd1bGFybHkgYWZ0ZXIgYW4gZXh0ZXJuYWxseQ0KICAgdHJpZ2dlcmVkIHF1ZXJ5OyBp dCBtYXkgYWxzbyBiZSB0cmlnZ2VyZWQgYWZ0ZXIgYSBzdWRkZW4gbmV0d29yay0NCiAgIGludGVy bmFsIGV2ZW50IG9yIGFsZXJ0LiAgU2NoZWR1bGVzIG1heSBiZSBkcml2ZW4gYnksIGZvciBleGFt cGxlLCBhDQogICBzbWFydC1tZXRlcmluZyBhcHBsaWNhdGlvbiB3aGVyZSBkYXRhIGlzIGV4cGVj dGVkIHRvIGJlIGRlbGl2ZXJlZA0KICAgZXZlcnkgaG91ciwgb3IgYW4gZW52aXJvbm1lbnRhbCBt b25pdG9yaW5nIGFwcGxpY2F0aW9uIHdoZXJlIGENCiAgIGJhdHRlcnkgcG93ZXJlZCBub2RlIGlz IGV4cGVjdGVkIHRvIHJlcG9ydCBpdHMgc3RhdHVzIGF0IGEgc3BlY2lmaWMNCiAgIHRpbWUgb25j ZSBhIGRheS4gIERhdGEgZGVsaXZlcnkgbWF5IHRyaWdnZXIgYWNrbm93bGVkZ2VtZW50cyBvcg0K ICAgbWFpbnRlbmFuY2UgdHJhZmZpYyBpbiB0aGUgcmV2ZXJzZSBkaXJlY3Rpb24uICBUaGUgbmV0 d29yayBoZW5jZQ0KICAgbmVlZHMgdG8gYmUgYWJsZSB0byBhZGp1c3QgdG8gdGhlIHZhcnlpbmcg YWN0aXZpdHkgZHV0eSBjeWNsZXMsIGFzDQogICB3ZWxsIGFzIHRvIHBlcmlvZGljIGFuZCBzcG9y YWRpYyB0cmFmZmljLiAgQWxzbywgc2Vuc2VkIGRhdGEgb3VnaHQgdG8NCiAgIGJlIHNlY3VyZWQg YW5kIGxvY2F0YWJsZS4NCg0KICAgU29tZSBkYXRhIGRlbGl2ZXJ5IG1heSBoYXZlIHRpZ2h0IGxh dGVuY3kgcmVxdWlyZW1lbnRzLCBmb3IgZXhhbXBsZQ0KICAgaW4gYSBjYXNlIHN1Y2ggYXMgYSBs aXZlIG1ldGVyIHJlYWRpbmcgZm9yIGN1c3RvbWVyIHNlcnZpY2UgaW4gYQ0KICAgc21hcnQtbWV0 ZXJpbmcgYXBwbGljYXRpb24sIG9yIGluIGEgY2FzZSB3aGVyZSBhIHNlbnNvciByZWFkaW5nDQog ICByZXNwb25zZSBtdXN0IGFycml2ZSB3aXRoaW4gYSBjZXJ0YWluIHRpbWUgaW4gb3JkZXIgdG8g YmUgdXNlZnVsLg0KICAgVGhlIG5ldHdvcmsgc2hvdWxkIHRha2UgaW50byBjb25zaWRlcmF0aW9u IHRoYXQgZGlmZmVyZW50IGFwcGxpY2F0aW9uDQogICB0cmFmZmljIG1heSByZXF1aXJlIGRpZmZl cmVudCBwcmlvcml0aWVzIGluIHRoZSBzZWxlY3Rpb24gb2YgYSByb3V0ZQ0KICAgd2hlbiB0cmF2 ZXJzaW5nIHRoZSBuZXR3b3JrLCBhbmQgdGhhdCBzb21lIHRyYWZmaWMgbWF5IGJlIG1vcmUNCiAg IHNlbnNpdGl2ZSB0byBsYXRlbmN5Lg0KDQogICBBbiBVLUxMTiBzaG91bGQgc3VwcG9ydCBvY2Nh c2lvbmFsIGxhcmdlIHNjYWxlIHRyYWZmaWMgZmxvd3MgZnJvbQ0KICAgc2Vuc2luZyBub2RlcyB0 byBMQlJzLCBzdWNoIGFzIHN5c3RlbS13aWRlIGFsZXJ0cy4gIEluIHRoZSBleGFtcGxlIG9mDQog ICBhbiBBTUkgVS1MTE4gdGhpcyBjb3VsZCBiZSBpbiByZXNwb25zZSB0byBldmVudHMgc3VjaCBh cyBhIGNpdHkgd2lkZQ0KICAgcG93ZXIgb3V0YWdlLiAgSW4gdGhpcyBzY2VuYXJpbyBhbGwgcG93 ZXJlZCBkZXZpY2VzIGluIGEgbGFyZ2UNCiAgIHNlZ21lbnQgb2YgdGhlIG5ldHdvcmsgbWF5IGhh dmUgbG9zdCBwb3dlciBhbmQgYXJlIHJ1bm5pbmcgb2ZmIG9mIGENCiAgIHRlbXBvcmFyeSBgbGFz dCBnYXNwJyBzb3VyY2Ugc3VjaCBhcyBhIGNhcGFjaXRvciBvciBzbWFsbCBiYXR0ZXJ5LiAgQQ0K ICAgbm9kZSBtdXN0IGJlIGFibGUgdG8gc2VuZCBpdHMgb3duIGFsZXJ0cyB0b3dhcmQgYW4gTEJS IHdoaWxlDQogICBjb250aW51aW5nIHRvIGZvcndhcmQgdHJhZmZpYyBvbiBiZWhhbGYgb2Ygb3Ro ZXIgZGV2aWNlcyB3aG8gYXJlIGFsc28NCiAgIGV4cGVyaWVuY2luZyBhbiBhbGVydCBjb25kaXRp b24uICBUaGUgbmV0d29yayBuZWVkcyB0byBiZSBhYmxlIHRvDQogICBtYW5hZ2UgdGhpcyBzdWRk ZW4gbGFyZ2UgdHJhZmZpYyBmbG93LiAgSXQgbWF5IGJlIHVzZWZ1bCBmb3IgdGhlDQogICByb3V0 aW5nIGxheWVyIHRvIGNvbGxhYm9yYXRlIHdpdGggdGhlIGFwcGxpY2F0aW9uIGxheWVyIHRvIHBl cmZvcm0NCiAgIGRhdGEgYWdncmVnYXRpb24sIGluIG9yZGVyIHRvIHJlZHVjZSB0aGUgdG90YWwg dm9sdW1lIG9mIGEgbGFyZ2UNCiAgIHRyYWZmaWMgZmxvdywgYW5kIG1ha2UgbW9yZSBlZmZpY2ll bnQgdXNlIG9mIHRoZSBsaW1pdGVkIGVuZXJneQ0KDQoNCg0KRG9obGVyLCBldCBhbC4gICAgICAg ICAgICBFeHBpcmVzIEp1bmUgMjIsIDIwMDkgICAgICAgICAgICAgICAgW1BhZ2UgMTJdDQoMDQpJ bnRlcm5ldC1EcmFmdCAgICBkcmFmdC1pZXRmLXJvbGwtdXJiYW4tcm91dGluZy1yZXFzLTAzICAg IERlY2VtYmVyIDIwMDgNCg0KDQogICBhdmFpbGFibGUuDQoNCiAgIEFuIFUtTExOIG1heSBhbHNv IG5lZWQgdG8gc3VwcG9ydCBlZmZpY2llbnQgbGFyZ2Ugc2NhbGUgbWVzc2FnaW5nIHRvDQogICBn cm91cHMgb2YgYWN0dWF0b3JzLiAgRm9yIGV4YW1wbGUsIGFuIEFNSSBVLUxMTiBzdXBwb3J0aW5n IGEgY2l0eS0NCiAgIHdpZGUgZGVtYW5kIHJlc3BvbnNlIHN5c3RlbSB3aWxsIG5lZWQgdG8gZWZm aWNpZW50bHkgYnJvYWRjYXN0IGRlbWFuZA0KICAgcmVzcG9uc2UgY29udHJvbCBpbmZvcm1hdGlv biB0byBhIGxhcmdlIHN1YnNldCBvZiBhY3R1YXRvcnMgaW4gdGhlDQogICBzeXN0ZW0uDQoNCiAg IFNvbWUgc2NlbmFyaW9zIHdpbGwgcmVxdWlyZSBpbnRlcm5ldHdvcmtpbmcgYmV0d2VlbiB0aGUg VS1MTE4gYW5kDQogICBhbm90aGVyIG5ldHdvcmssIHN1Y2ggYXMgYSBob21lIG5ldHdvcmsuICBG b3IgZXhhbXBsZSwgYW4gQU1JDQogICBhcHBsaWNhdGlvbiB0aGF0IGltcGxlbWVudHMgYSBkZW1h bmQtcmVzcG9uc2Ugc3lzdGVtIG1heSBuZWVkIHRvDQogICBmb3J3YXJkIHRyYWZmaWMgZnJvbSBh IHV0aWxpdHksIGFjcm9zcyB0aGUgVS1MTE4sIGludG8gYSBob21lDQogICBhdXRvbWF0aW9uIG5l dHdvcmsuICBBIHR5cGljYWwgdXNlIGNhc2Ugd291bGQgYmUgdG8gaW5mb3JtIGEgY3VzdG9tZXIN CiAgIG9mIGluY2VudGl2ZXMgdG8gcmVkdWNlIGRlbWFuZCBkdXJpbmcgcGVha3MsIG9yIHRvIGF1 dG9tYXRpY2FsbHkNCiAgIGFkanVzdCB0aGUgdGhlcm1vc3RhdCBvZiBjdXN0b21lcnMgd2hvIGhh dmUgZW5yb2xsZWQgaW4gc3VjaCBhIGRlbWFuZA0KICAgbWFuYWdlbWVudCBwcm9ncmFtLiAgU3Vi c2VxdWVudCB0cmFmZmljIG1heSBiZSB0cmlnZ2VyZWQgdG8gZmxvdyBiYWNrDQogICB0aHJvdWdo IHRoZSBVLUxMTiB0byB0aGUgdXRpbGl0eS4NCg0KDQo2LiAgUmVxdWlyZW1lbnRzIG9mIFVyYmFu IExMTiBBcHBsaWNhdGlvbnMNCg0KICAgVXJiYW4gbG93IHBvd2VyIGFuZCBsb3NzeSBuZXR3b3Jr IGFwcGxpY2F0aW9ucyBoYXZlIGEgbnVtYmVyIG9mDQogICBzcGVjaWZpYyByZXF1aXJlbWVudHMg cmVsYXRlZCB0byB0aGUgc2V0IG9mIG9wZXJhdGluZyBjb25kaXRpb25zLCBhcw0KICAgZXhlbXBs aWZpZWQgaW4gdGhlIHByZXZpb3VzIHNlY3Rpb25zLg0KDQo2LjEuICBTY2FsYWJpbGl0eQ0KDQog ICBUaGUgbGFyZ2UgYW5kIGRpdmVyc2UgbWVhc3VyZW1lbnQgc3BhY2Ugb2YgVS1MTE4gbm9kZXMg LSBjb3VwbGVkIHdpdGgNCiAgIHRoZSB0eXBpY2FsbHkgbGFyZ2UgdXJiYW4gYXJlYXMgLSB3aWxs IHlpZWxkIGV4dHJlbWVseSBsYXJnZSBuZXR3b3JrDQogICBzaXplcy4gIEN1cnJlbnQgdXJiYW4g cm9sbC1vdXRzIGFyZSBjb21wb3NlZCBvZiBzb21ldGltZXMgbW9yZSB0aGFuDQogICBvbmUgaHVu ZHJlZCBub2RlczsgZnV0dXJlIHJvbGwtb3V0cywgaG93ZXZlciwgbWF5IGVhc2lseSByZWFjaA0K ICAgbnVtYmVycyBpbiB0aGUgdGVucyBvZiB0aG91c2FuZHMgdG8gbWlsbGlvbnMuICBPbmUgb2Yg dGhlIHV0bW9zdA0KICAgaW1wb3J0YW50IExMTiByb3V0aW5nIHByb3RvY29sIGRlc2lnbiBjcml0 ZXJpYSBpcyBoZW5jZSBzY2FsYWJpbGl0eS4NCg0KICAgVGhlIHJvdXRpbmcgcHJvdG9jb2wocykg TVVTVCBiZSBjYXBhYmxlIG9mIHN1cHBvcnRpbmcgdGhlDQogICBvcmdhbml6YXRpb24gb2YgYSBs YXJnZSBudW1iZXIgb2Ygc2Vuc2luZyBub2RlcyBpbnRvIHJlZ2lvbnMNCiAgIGNvbnRhaW5pbmcg b24gdGhlIG9yZGVyIG9mIDEwXjIgdG8gMTBeNCBzZW5zaW5nIG5vZGVzIGVhY2guDQoNCiAgIFRo ZSByb3V0aW5nIHByb3RvY29sKHMpIE1VU1QgYmUgc2NhbGFibGUgc28gYXMgdG8gYWNjb21tb2Rh dGUgYSB2ZXJ5DQogICBsYXJnZSBhbmQgaW5jcmVhc2luZyBudW1iZXIgb2Ygbm9kZXMgd2l0aG91 dCBkZXRlcmlvcmF0aW5nIHNlbGVjdGVkDQogICBwZXJmb3JtYW5jZSBwYXJhbWV0ZXJzIGJlbG93 IGNvbmZpZ3VyYWJsZSB0aHJlc2hvbGRzLiAgVGhlIHJvdXRpbmcNCiAgIHByb3RvY29scyhzKSBT SE9VTEQgc3VwcG9ydCB0aGUgb3JnYW5pemF0aW9uIG9mIGEgbGFyZ2UgbnVtYmVyIG9mDQogICBu b2RlcyBpbnRvIHJlZ2lvbnMgb2YgY29uZmlndXJhYmxlIHNpemUuDQoNCjYuMi4gIFBhcmFtZXRl ciBDb25zdHJhaW5lZCBSb3V0aW5nDQoNCiAgIEJhdHRlcmllcyBpbiBzb21lIG5vZGVzIG1heSBk ZXBsZXRlIHF1aWNrZXIgdGhhbiBpbiBvdGhlcnM7IHRoZQ0KICAgZXhpc3RlbmNlIG9mIG9uZSBu b2RlIGZvciB0aGUgbWFpbnRlbmFuY2Ugb2YgYSByb3V0aW5nIHBhdGggbWF5IG5vdA0KDQoNCg0K RG9obGVyLCBldCBhbC4gICAgICAgICAgICBFeHBpcmVzIEp1bmUgMjIsIDIwMDkgICAgICAgICAg ICAgICAgW1BhZ2UgMTNdDQoMDQpJbnRlcm5ldC1EcmFmdCAgICBkcmFmdC1pZXRmLXJvbGwtdXJi YW4tcm91dGluZy1yZXFzLTAzICAgIERlY2VtYmVyIDIwMDgNCg0KDQogICBiZSBhcyBpbXBvcnRh bnQgYXMgb2YgYW5vdGhlciBub2RlOyB0aGUgYmF0dGVyeSBzY2F2ZW5naW5nIG1ldGhvZHMNCiAg IG1heSByZWNoYXJnZSB0aGUgYmF0dGVyeSBhdCByZWd1bGFyIG9yIGlycmVndWxhciBpbnRlcnZh bHM7IHNvbWUNCiAgIG5vZGVzIG1heSBoYXZlIGEgY29uc3RhbnQgcG93ZXIgc291cmNlOyBzb21l IG5vZGVzIG1heSBoYXZlIGEgbGFyZ2VyDQogICBtZW1vcnkgYW5kIGFyZSBoZW5jZSBiZSBhYmxl IHRvIHN0b3JlIG1vcmUgbmVpZ2hib3Job29kIGluZm9ybWF0aW9uOw0KICAgc29tZSBub2RlcyBt YXkgaGF2ZSBhIHN0cm9uZ2VyIENQVSBhbmQgYXJlIGhlbmNlIGFibGUgdG8gcGVyZm9ybSBtb3Jl DQogICBzb3BoaXN0aWNhdGVkIGRhdGEgYWdncmVnYXRpb24gbWV0aG9kczsgZXRjLg0KDQogICBU byB0aGlzIGVuZCwgdGhlIHJvdXRpbmcgcHJvdG9jb2wocykgTVVTVCBzdXBwb3J0IHBhcmFtZXRl cg0KICAgY29uc3RyYWluZWQgcm91dGluZywgd2hlcmUgZXhhbXBsZXMgb2Ygc3VjaCBwYXJhbWV0 ZXJzIChDUFUsIG1lbW9yeQ0KICAgc2l6ZSwgYmF0dGVyeSBsZXZlbCwgZXRjLikgaGF2ZSBiZWVu IGdpdmVuIGluIHRoZSBwcmV2aW91cyBwYXJhZ3JhcGguDQoNCiAgIFJvdXRpbmcgd2l0aGluIHVy YmFuIHNlbnNvciBuZXR3b3JrcyBTSE9VTEQgcmVxdWlyZSB0aGUgVS1MTE4gbm9kZXMNCiAgIHRv IGR5bmFtaWNhbGx5IGNvbXB1dGUsIHNlbGVjdCBhbmQgaW5zdGFsbCBkaWZmZXJlbnQgcGF0aHMg dG93YXJkcyBhDQogICBzYW1lIGRlc3RpbmF0aW9uLCBkZXBlbmRpbmcgb24gdGhlIG5hdHVyZSBv ZiB0aGUgdHJhZmZpYy4gIFN1Y2gNCiAgIGZ1bmN0aW9uYWxpdHkgaW4gc3VwcG9ydCBvZiwgZm9y IGV4YW1wbGUsIGRhdGEgYWdncmVnYXRpb24sIG1heSBpbXBseQ0KICAgY29sbGFib3JhdGlvbiBi ZXR3ZWVuIHRoZSByb3V0aW5nIGZ1bmN0aW9uLCB0aGUgZm9yd2FyZGluZyBmdW5jdGlvbiwNCiAg IGFuZCB0aGUgYXBwbGljYXRpb24uICBGcm9tIHRoaXMgcGVyc3BlY3RpdmUsIHN1Y2ggbm9kZXMg TUFZLCBmb3INCiAgIGV4YW1wbGUsIGlkZW50aWZ5IGFueWNhc3QgZW5kcG9pbnRzLCBpZGVudGlm eSB0cmFmZmljIGZsb3dzLCBvcg0KICAgaW5zcGVjdCB0aGUgY29udGVudHMgb2YgdHJhZmZpYyBw YXlsb2FkIHRvIGluZm9ybSByb3V0aW5nIGFuZA0KICAgZm9yd2FyZGluZyBkZWNpc2lvbnMuDQoN CjYuMy4gIFN1cHBvcnQgb2YgQXV0b25vbW91cyBhbmQgQWxpZW4gQ29uZmlndXJhdGlvbg0KDQog ICBXaXRoIHRoZSBsYXJnZSBudW1iZXIgb2Ygbm9kZXMsIG1hbnVhbGx5IGNvbmZpZ3VyaW5nIGFu ZA0KICAgdHJvdWJsZXNob290aW5nIGVhY2ggbm9kZSBpcyBub3QgZWZmaWNpZW50LiAgVGhlIHNj YWxlIGFuZCB0aGUgbGFyZ2UNCiAgIG51bWJlciBvZiBwb3NzaWJsZSB0b3BvbG9naWVzIHRoYXQg bWF5IGJlIGVuY291bnRlcmVkIGluIHRoZSBVLUxMTg0KICAgZW5jb3VyYWdlcyB0aGUgZGV2ZWxv cG1lbnQgb2YgYXV0b21hdGVkIG1hbmFnZW1lbnQgY2FwYWJpbGl0aWVzIHRoYXQNCiAgIG1heSAo cGFydGx5KSByZWx5IHVwb24gc2VsZi1vcmdhbml6aW5nIHRlY2huaXF1ZXMuICBUaGUgbmV0d29y ayBpcw0KICAgZXhwZWN0ZWQgdG8gc2VsZi1vcmdhbml6ZSBhbmQgc2VsZi1jb25maWd1cmUgYWNj b3JkaW5nIHRvIHNvbWUgcHJpb3INCiAgIGRlZmluZWQgcnVsZXMgYW5kIHByb3RvY29scywgYXMg d2VsbCBhcyB0byBzdXBwb3J0IGV4dGVybmFsbHkNCiAgIHRyaWdnZXJlZCBjb25maWd1cmF0aW9u cyAoZm9yIGluc3RhbmNlIHRocm91Z2ggYSBjb21taXNzaW9uaW5nIHRvb2wNCiAgIHdoaWNoIG1h eSBmYWNpbGl0YXRlIHRoZSBvcmdhbml6YXRpb24gb2YgdGhlIG5ldHdvcmsgYXQgYSBtaW5pbXVt DQogICBlbmVyZ3kgY29zdCkuDQoNCiAgIFRvIHRoaXMgZW5kLCB0aGUgcm91dGluZyBwcm90b2Nv bChzKSBNVVNUIHByb3ZpZGUgYSBzZXQgb2YgZmVhdHVyZXMNCiAgIGluY2x1ZGluZyAwLWNvbmZp Z3VyYXRpb24gYXQgbmV0d29yayByYW1wLXVwLCAobmV0d29yay1pbnRlcm5hbCkNCiAgIHNlbGYt IG9yZ2FuaXphdGlvbiBhbmQgY29uZmlndXJhdGlvbiBkdWUgdG8gdG9wb2xvZ2ljYWwgY2hhbmdl cywgYW5kDQogICB0aGUgYWJpbGl0eSB0byBzdXBwb3J0IChuZXR3b3JrLWV4dGVybmFsKSBwYXRj aGVzIGFuZCBjb25maWd1cmF0aW9uDQogICB1cGRhdGVzLiAgRm9yIHRoZSBsYXR0ZXIsIHRoZSBw cm90b2NvbChzKSBNVVNUIHN1cHBvcnQgbXVsdGktIGFuZA0KICAgYW55LWNhc3QgYWRkcmVzc2lu Zy4gIFRoZSBwcm90b2NvbChzKSBTSE9VTEQgYWxzbyBzdXBwb3J0IHRoZQ0KICAgZm9ybWF0aW9u IGFuZCBpZGVudGlmaWNhdGlvbiBvZiBncm91cHMgb2YgZmllbGQgZGV2aWNlcyBpbiB0aGUNCiAg IG5ldHdvcmsuDQoNCiAgIFRoZSByb3V0aW5nIHByb3RvY29sKHMpIFNIT1VMRCBiZSBhYmxlIHRv IGR5bmFtaWNhbGx5IGFkYXB0LCBlLmcuDQogICB0aHJvdWdoIHRoZSBhcHBsaWNhdGlvbiBvZiBh cHByb3ByaWF0ZSByb3V0aW5nIG1ldHJpY3MsIHRvIGV2ZXItDQogICBjaGFuZ2luZyBjb25kaXRp b25zIG9mIGNvbW11bmljYXRpb24gKHBvc3NpYmxlIGRlZ3JhZGF0aW9uIG9mIFFvUywNCiAgIHZh cmlhYmxlIG5hdHVyZSBvZiB0aGUgdHJhZmZpYyAocmVhbCB0aW1lIHZzLiBub24gcmVhbCB0aW1l LCBzZW5zZWQNCiAgIGRhdGEgdnMuIGFsZXJ0cyksIG5vZGUgbW9iaWxpdHksIGEgY29tYmluYXRp b24gdGhlcmVvZiwgZXRjLikNCg0KDQoNCkRvaGxlciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJl cyBKdW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAgIFtQYWdlIDE0XQ0KDA0KSW50ZXJuZXQtRHJh ZnQgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJvdXRpbmctcmVxcy0wMyAgICBEZWNlbWJlciAy MDA4DQoNCg0KICAgVGhlIHJvdXRpbmcgcHJvdG9jb2wocykgU0hPVUxEIGJlIGFibGUgdG8gZHlu YW1pY2FsbHkgY29tcHV0ZSwgc2VsZWN0DQogICBhbmQgcG9zc2libHkgb3B0aW1pemUgdGhlICht dWx0aXBsZSkgcGF0aChzKSB0aGF0IHdpbGwgYmUgdXNlZCBieSB0aGUNCiAgIHBhcnRpY2lwYXRp bmcgZGV2aWNlcyB0byBmb3J3YXJkIHRoZSB0cmFmZmljIHRvd2FyZHMgdGhlIGFjdHVhdG9ycw0K ICAgYW5kL29yIGEgTEJSIGFjY29yZGluZyB0byB0aGUgc2VydmljZS1zcGVjaWZpYyBhbmQgdHJh ZmZpYy1zcGVjaWZpYw0KICAgUW9TLCB0cmFmZmljIGVuZ2luZWVyaW5nIGFuZCByb3V0aW5nIHNl Y3VyaXR5IHBvbGljaWVzIHRoYXQgd2lsbCBoYXZlDQogICB0byBiZSBlbmZvcmNlZCBhdCB0aGUg c2NhbGUgb2YgYSByb3V0aW5nIGRvbWFpbiAodGhhdCBpcywgYSBzZXQgb2YNCiAgIG5ldHdvcmtp bmcgZGV2aWNlcyBhZG1pbmlzdGVyZWQgYnkgYSBnbG9iYWxseSB1bmlxdWUgZW50aXR5KSwgb3Ig YQ0KICAgcmVnaW9uIG9mIHN1Y2ggZG9tYWluIChlLmcuIGEgbWV0cm9wb2xpdGFuIGFyZWEgY29t cG9zZWQgb2YgY2x1c3RlcnMNCiAgIG9mIHNlbnNvcnMpLg0KDQo2LjQuICBTdXBwb3J0IG9mIEhp Z2hseSBEaXJlY3RlZCBJbmZvcm1hdGlvbiBGbG93cw0KDQogICBUaGUgcmVwb3J0aW5nIG9mIHRo ZSBkYXRhIHJlYWRpbmdzIGJ5IGEgbGFyZ2UgYW1vdW50IG9mIHNwYXRpYWxseQ0KICAgZGlzcGVy c2VkIG5vZGVzIHRvd2FyZHMgYSBmZXcgTEJScyB3aWxsIGxlYWQgdG8gaGlnaGx5IGRpcmVjdGVk DQogICBpbmZvcm1hdGlvbiBmbG93cy4gIEZvciBpbnN0YW5jZSwgYSBzdWl0YWJsZSBhZGRyZXNz aW5nIHNjaGVtZSBjYW4gYmUNCiAgIGRldmlzZWQgd2hpY2ggZmFjaWxpdGF0ZXMgdGhlIGRhdGEg Zmxvdy4gIEFsc28sIGFzIG9uZSBnZXRzIGNsb3NlciB0bw0KICAgdGhlIExCUiwgdGhlIHRyYWZm aWMgY29uY2VudHJhdGlvbiBpbmNyZWFzZXMgd2hpY2ggbWF5IGxlYWQgdG8gaGlnaA0KICAgbG9h ZCBpbWJhbGFuY2VzIGluIG5vZGUgdXNhZ2UuDQoNCiAgIFRvIHRoaXMgZW5kLCB0aGUgcm91dGlu ZyBwcm90b2NvbChzKSBTSE9VTEQgc3VwcG9ydCBhbmQgdXRpbGl6ZSB0aGUNCiAgIGZhY3Qgb2Yg YSBsYXJnZSBudW1iZXIgb2YgaGlnaGx5IGRpcmVjdGVkIHRyYWZmaWMgZmxvd3MgdG8gZmFjaWxp dGF0ZQ0KICAgc2NhbGFiaWxpdHkgYW5kIHBhcmFtZXRlciBjb25zdHJhaW5lZCByb3V0aW5nLg0K DQogICBUaGUgcm91dGluZyBwcm90b2NvbCBNVVNUIGJlIGFibGUgdG8gYWNjb21tb2RhdGUgdHJh ZmZpYyBidXJzdHMgYnkNCiAgIGR5bmFtaWNhbGx5IGNvbXB1dGluZyBhbmQgc2VsZWN0aW5nIG11 bHRpcGxlIHBhdGhzIHRvd2FyZHMgdGhlIHNhbWUNCiAgIGRlc3RpbmF0aW9uLg0KDQo2LjUuICBT dXBwb3J0IG9mIE11bHRpY2FzdCwgQW55Y2FzdCwgYW5kIEltcGxlbWVudGF0aW9uIG9mIEdyb3Vw Y2FzdA0KDQogICBTb21lIHVyYmFuIHNlbnNpbmcgc3lzdGVtcyByZXF1aXJlIGxvdy1sZXZlbCBh ZGRyZXNzaW5nIG9mIGEgZ3JvdXAgb2YNCiAgIG5vZGVzIGluIHRoZSBzYW1lIHN1Ym5ldCwgb3Ig Zm9yIGEgbm9kZSByZXByZXNlbnRhdGl2ZSBvZiBhIGdyb3VwIG9mDQogICBub2Rlcywgd2l0aG91 dCBhbnkgcHJpb3IgY3JlYXRpb24gb2YgbXVsdGljYXN0IGdyb3Vwcywgc2ltcGx5DQogICBjYXJy eWluZyBhIGxpc3Qgb2YgcmVjaXBpZW50cyBpbiB0aGUgc3VibmV0DQogICBbSS1ELmlldGYtcm9s bC1ob21lLXJvdXRpbmctcmVxc10uDQoNCiAgIFJvdXRpbmcgcHJvdG9jb2xzIGFjdGl2YXRlZCBp biB1cmJhbiBzZW5zb3IgbmV0d29ya3MgTVVTVCBzdXBwb3J0DQogICB1bmljYXN0ICh0cmFmZmlj IGlzIHNlbnQgdG8gYSBzaW5nbGUgZmllbGQgZGV2aWNlKSwgbXVsdGljYXN0DQogICAodHJhZmZp YyBpcyBzZW50IHRvIGEgc2V0IG9mIGRldmljZXMgdGhhdCBhcmUgc3Vic2NyaWJlZCB0byB0aGUg c2FtZQ0KICAgbXVsdGljYXN0IGdyb3VwKSwgYW5kIGFueWNhc3QgKHdoZXJlIG11bHRpcGxlIGZp ZWxkIGRldmljZXMgYXJlDQogICBjb25maWd1cmVkIHRvIGFjY2VwdCB0cmFmZmljIHNlbnQgb24g YSBzaW5nbGUgSVAgYW55Y2FzdCBhZGRyZXNzKQ0KICAgdHJhbnNtaXNzaW9uIHNjaGVtZXMuDQoN CiAgIFdpdGggSVAgbXVsdGljYXN0LCBzaWduYWxpbmcgbWVjaGFuaXNtcyBhcmUgdXNlZCBieSBh IHJlY2VpdmVyIHRvDQogICBqb2luIGEgZ3JvdXAgYW5kIHRoZSBzZW5kZXIgZG9lcyBub3Qga25v dyB0aGUgcmVjZWl2ZXJzIG9mIHRoZSBncm91cC4NCiAgIEdyb3VwY2FzdCBhbGxvd3MgYSBzZW5k ZXIgdGhlIGFiaWxpdHkgdG8gYWRkcmVzcyBhIGdyb3VwIG9mIHJlY2VpdmVycw0KICAga25vd24g YnkgdGhlIHNlbmRlciBldmVuIGlmIHRoZSByZWNlaXZlcnMgZG8gbm90IGtub3cgdGhhdCB0aGV5 IGhhdmUNCiAgIGJlZW4gZ3JvdXBlZCBieSB0aGUgc2VuZGVyIChzaW5jZSByZXF1ZXN0aW5nIGVh Y2ggaW5kaXZpZHVhbCBub2RlIHRvDQogICBqb2luIGEgbXVsdGljYXN0IGdyb3VwIHdvdWxkIGJl IHZlcnkgZW5lcmd5LSBjb25zdW1pbmcpLiAgUm91dGluZw0KDQoNCg0KRG9obGVyLCBldCBhbC4g ICAgICAgICAgICBFeHBpcmVzIEp1bmUgMjIsIDIwMDkgICAgICAgICAgICAgICAgW1BhZ2UgMTVd DQoMDQpJbnRlcm5ldC1EcmFmdCAgICBkcmFmdC1pZXRmLXJvbGwtdXJiYW4tcm91dGluZy1yZXFz LTAzICAgIERlY2VtYmVyIDIwMDgNCg0KDQogICBwcm90b2NvbHMgYWN0aXZhdGVkIGluIHVyYmFu IHNlbnNvciBuZXR3b3JrcyBTSE9VTEQgYWNjb21tb2RhdGUgc3VjaA0KICAgImdyb3VwY2FzdCIg Zm9yd2FyZGluZyBzY2hlbWVzLg0KDQogICBUaGUgc3VwcG9ydCBvZiB1bmljYXN0LCBncm91cGNh c3QsIG11bHRpY2FzdCwgYW5kIGFueWNhc3QgYWxzbyBoYXMgYW4NCiAgIGltcGxpY2F0aW9uIG9u IHRoZSBhZGRyZXNzaW5nIHNjaGVtZSBidXQgaXMgYmV5b25kIHRoZSBzY29wZSBvZiB0aGlzDQog ICBkb2N1bWVudCB0aGF0IGZvY3VzZXMgb24gdGhlIHJvdXRpbmcgcmVxdWlyZW1lbnRzIGFzcGVj dHMuDQoNCiAgIFRoZSBuZXR3b3JrIFNIT1VMRCBzdXBwb3J0IGludGVybmV0d29ya2luZyB3aGVu IGlkZW50aWNhbCBwcm90b2NvbHMNCiAgIGFyZSB1c2VkLCB3aGlsZSBnaXZpbmcgYXR0ZW50aW9u IHRvIHJvdXRpbmcgc2VjdXJpdHkgaW1wbGljYXRpb25zIG9mDQogICBpbnRlcmZhY2luZywgZm9y IGV4YW1wbGUsIGEgaG9tZSBuZXR3b3JrIHdpdGggYSB1dGlsaXR5IFUtTExOLiAgVGhlDQogICBu ZXR3b3JrIG1heSBzdXBwb3J0IHRoZSBhYmlsaXR5IHRvIGludGVyYWN0IHdpdGggYW5vdGhlciBu ZXR3b3JrDQogICB1c2luZyBhIGRpZmZlcmVudCBwcm90b2NvbCwgZm9yIGV4YW1wbGUgYnkgc3Vw cG9ydGluZyByb3V0ZQ0KICAgcmVkaXN0cmlidXRpb24uDQoNCjYuNi4gIE5ldHdvcmsgRHluYW1p Y2l0eQ0KDQogICBBbHRob3VnaCBtb2JpbGl0eSBpcyBhc3N1bWVkIHRvIGJlIGxvdyBpbiB1cmJh biBMTE5zLCBuZXR3b3JrDQogICBkeW5hbWljaXR5IGR1ZSB0byBub2RlIGFzc29jaWF0aW9uLCBk aXNhc3NvY2lhdGlvbiBhbmQgZGlzYXBwZWFyYW5jZSwNCiAgIGFzIHdlbGwgYXMgbG9uZy10ZXJt IGxpbmsgcGVydHVyYmF0aW9ucyBpcyBub3QgbmVnbGlnaWJsZS4gIFRoaXMgaW4NCiAgIHR1cm4g aW1wYWN0cyByZW9yZ2FuaXphdGlvbiBhbmQgcmVjb25maWd1cmF0aW9uIGNvbnZlcmdlbmNlIGFz IHdlbGwNCiAgIGFzIHJvdXRpbmcgcHJvdG9jb2wgY29udmVyZ2VuY2UuDQoNCiAgIFRvIHRoaXMg ZW5kLCBsb2NhbCBuZXR3b3JrIGR5bmFtaWNzIFNIT1VMRCBOT1QgaW1wYWN0IHRoZSBlbnRpcmUN CiAgIG5ldHdvcmsgdG8gYmUgcmUtb3JnYW5pemVkIG9yIHJlLXJlY29uZmlndXJlZDsgaG93ZXZl ciwgdGhlIG5ldHdvcmsNCiAgIFNIT1VMRCBiZSBsb2NhbGx5IG9wdGltaXplZCB0byBjYXRlciBm b3IgdGhlIGVuY291bnRlcmVkIGNoYW5nZXMuDQogICBUaGUgcm91dGluZyBwcm90b2NvbChzKSBT SE9VTEQgc3VwcG9ydCBhcHByb3ByaWF0ZSBtZWNoYW5pc21zIGluDQogICBvcmRlciB0byBiZSBp bmZvcm1lZCBvZiB0aGUgYXNzb2NpYXRpb24sIGRpc2Fzc29jaWF0aW9uLCBhbmQNCiAgIGRpc2Fw cGVhcmFuY2Ugb2Ygbm9kZXMuICBUaGUgcm91dGluZyBwcm90b2NvbChzKSBTSE9VTEQgc3VwcG9y dA0KICAgYXBwcm9wcmlhdGUgdXBkYXRpbmcgbWVjaGFuaXNtcyBpbiBvcmRlciB0byBiZSBpbmZv cm1lZCBvZiBjaGFuZ2VzIGluDQogICBjb25uZWN0aXZpdHkuICBUaGUgcm91dGluZyBwcm90b2Nv bChzKSBTSE9VTEQgdXNlIHRoaXMgaW5mb3JtYXRpb24gdG8NCiAgIGluaXRpYXRlIHByb3RvY29s IHNwZWNpZmljIG1lY2hhbmlzbXMgZm9yIHJlb3JnYW5pemF0aW9uIGFuZA0KICAgcmVjb25maWd1 cmF0aW9uIGFzIG5lY2Vzc2FyeSB0byBtYWludGFpbiBvdmVyYWxsIHJvdXRpbmcgZWZmaWNpZW5j eS4NCiAgIENvbnZlcmdlbmNlIGFuZCByb3V0ZSBlc3RhYmxpc2htZW50IHRpbWVzIFNIT1VMRCBi ZSBzaWduaWZpY2FudGx5DQogICBsb3dlciB0aGFuIHRoZSBzbWFsbGVzdCByZXBvcnRpbmcgaW50 ZXJ2YWwuDQoNCiAgIERpZmZlcmVudGlhdGlvbiBTSE9VTEQgYmUgbWFkZSBiZXR3ZWVuIG5vZGUg ZGlzYXBwZWFyYW5jZSwgd2hlcmUgdGhlDQogICBub2RlIGRpc2FwcGVhcnMgd2l0aG91dCBwcmlv ciBub3RpZmljYXRpb24sIGFuZCB1c2VyIG9yIG5vZGUtDQogICBpbml0aWF0ZWQgZGlzYXNzb2Np YXRpb24gKCJwaGFzZWQtb3V0IiksIHdoZXJlIHRoZSBub2RlIGhhcyBlbm91Z2gNCiAgIHRpbWUg dG8gaW5mb3JtIHRoZSBuZXR3b3JrIGFib3V0IGl0cyBwZW5kaW5nIHJlbW92YWwuDQoNCjYuNy4g IExhdGVuY3kNCg0KICAgV2l0aCB0aGUgZXhjZXB0aW9uIG9mIGFsZXJ0IHJlcG9ydGluZyBzb2x1 dGlvbnMgYW5kIHRvIGEgY2VydGFpbg0KICAgZXh0ZW50IHF1ZXJpZWQgcmVwb3J0aW5nLCBVLUxM TnMgYXJlIGRlbGF5IHRvbGVyYW50IGFzIGxvbmcgYXMgdGhlDQogICBpbmZvcm1hdGlvbiBhcnJp dmVzIHdpdGhpbiBhIGZyYWN0aW9uIG9mIHRoZSBzbWFsbGVzdCByZXBvcnRpbmcNCiAgIGludGVy dmFsLCBlLmcuIGEgZmV3IHNlY29uZHMgaWYgcmVwb3J0aW5nIGlzIGRvbmUgZXZlcnkgNCBob3Vy cy4NCg0KICAgVGhlIHJvdXRpbmcgcHJvdG9jb2wocykgU0hPVUxEIGFsc28gc3VwcG9ydCB0aGUg YWJpbGl0eSB0byByb3V0ZQ0KDQoNCg0KRG9obGVyLCBldCBhbC4gICAgICAgICAgICBFeHBpcmVz IEp1bmUgMjIsIDIwMDkgICAgICAgICAgICAgICAgW1BhZ2UgMTZdDQoMDQpJbnRlcm5ldC1EcmFm dCAgICBkcmFmdC1pZXRmLXJvbGwtdXJiYW4tcm91dGluZy1yZXFzLTAzICAgIERlY2VtYmVyIDIw MDgNCg0KDQogICBhY2NvcmRpbmcgdG8gZGlmZmVyZW50IG1ldHJpY3MgKG9uZSBvZiB3aGljaCBj b3VsZCBlLmcuIGJlIGxhdGVuY3kpLg0KDQoNCjcuICBTZWN1cml0eSBDb25zaWRlcmF0aW9ucw0K DQogICBBcyBldmVyeSBuZXR3b3JrLCBVLUxMTnMgYXJlIGV4cG9zZWQgdG8gcm91dGluZyBzZWN1 cml0eSB0aHJlYXRzIHRoYXQNCiAgIG5lZWQgdG8gYmUgYWRkcmVzc2VkLiAgVGhlIHdpcmVsZXNz IGFuZCBkaXN0cmlidXRlZCBuYXR1cmUgb2YgdGhlc2UNCiAgIG5ldHdvcmtzIGluY3JlYXNlcyB0 aGUgc3BlY3RydW0gb2YgcG90ZW50aWFsIHJvdXRpbmcgc2VjdXJpdHkNCiAgIHRocmVhdHMuICBU aGlzIGlzIGZ1cnRoZXIgYW1wbGlmaWVkIGJ5IHRoZSByZXNvdXJjZSBjb25zdHJhaW50cyBvZg0K ICAgdGhlIG5vZGVzLCB0aGVyZWJ5IHByZXZlbnRpbmcgcmVzb3VyY2UgaW50ZW5zaXZlIHJvdXRp bmcgc2VjdXJpdHkNCiAgIGFwcHJvYWNoZXMgZnJvbSBiZWluZyBkZXBsb3llZC4gIEEgdmlhYmxl IHJvdXRpbmcgc2VjdXJpdHkgYXBwcm9hY2gNCiAgIFNIT1VMRCBiZSBzdWZmaWNpZW50bHkgbGln aHR3ZWlnaHQgdGhhdCBpdCBtYXkgYmUgaW1wbGVtZW50ZWQgYWNyb3NzDQogICBhbGwgbm9kZXMg aW4gYSBVLUxMTi4gIFRoZXNlIGlzc3VlcyByZXF1aXJlIHNwZWNpYWwgYXR0ZW50aW9uIGR1cmlu Zw0KICAgdGhlIGRlc2lnbiBwcm9jZXNzLCBzbyBhcyB0byBmYWNpbGl0YXRlIGEgY29tbWVyY2lh bGx5IGF0dHJhY3RpdmUNCiAgIGRlcGxveW1lbnQuDQoNCiAgIFRoZSBVLUxMTiBuZXR3b3JrIE1V U1QgZGVueSBhbGwgcm91dGluZyBzZXJ2aWNlcyB0byBhbnkgbm9kZSB3aG8gaGFzDQogICBub3Qg YmVlbiBhdXRoZW50aWNhdGVkIHRvIHRoZSBVLUxMTiBhbmQgYXV0aG9yaXplZCBmb3IgdGhlIHVz ZSBvZg0KICAgcm91dGluZyBzZXJ2aWNlcy4NCg0KICAgQW4gYXR0YWNrZXIgU0hPVUxEIGJlIHBy ZXZlbnRlZCBmcm9tIG1hbmlwdWxhdGluZyBvciBkaXNhYmxpbmcgdGhlDQogICByb3V0aW5nIGZ1 bmN0aW9uLCBmb3IgZXhhbXBsZSBieSBjb21wcm9taXNpbmcgcm91dGluZyBjb250cm9sDQogICBt ZXNzYWdlcy4gIFRvIHRoaXMgZW5kIHRoZSByb3V0aW5nIHByb3RvY29sKHMpIE1VU1Qgc3VwcG9y dCBtZXNzYWdlDQogICBpbnRlZ3JpdHkuDQoNCiAgIEZ1cnRoZXIgZXhhbXBsZSByb3V0aW5nIHNl Y3VyaXR5IGlzc3VlcyB3aGljaCBtYXkgYXJpc2UgYXJlIHRoZQ0KICAgYWJub3JtYWwgYmVoYXZp b3Igb2Ygbm9kZXMgd2hpY2ggZXhoaWJpdCBhbiBlZ29pc3RpYyBjb25kdWN0LCBzdWNoIGFzDQog ICBub3Qgb2JleWluZyBuZXR3b3JrIHJ1bGVzLCBvciBmb3J3YXJkaW5nIG5vIG9yIGZhbHNlIHBh Y2tldHMuICBPdGhlcg0KICAgaW1wb3J0YW50IGlzc3VlcyBtYXkgYXJpc2UgaW4gdGhlIGNvbnRl eHQgb2YgRGVuaWFsIG9mIFNlcnZpY2UgKERvUykNCiAgIGF0dGFja3MsIG1hbGljaW91cyBhZGRy ZXNzIHNwYWNlIGFsbG9jYXRpb25zLCBhZHZlcnRpc2VtZW50IG9mDQogICB2YXJpYWJsZSBhZGRy ZXNzZXMsIGEgd3JvbmcgbmVpZ2hib3Job29kLCBldGMuICBUaGUgcm91dGluZw0KICAgcHJvdG9j b2wocykgU0hPVUxEIHN1cHBvcnQgZGVmZW5zZSBhZ2FpbnN0IERvUyBhdHRhY2tzIGFuZCBvdGhl cg0KICAgYXR0ZW1wdHMgdG8gbWFsaWNpb3VzbHkgb3IgaW5hZHZlcnRlbnRseSBjYXVzZSB0aGUg cm91dGluZw0KICAgcHJvdG9jb2wocykgbWVjaGFuaXNtcyB0byBvdmVyIGNvbnN1bWUgdGhlIGxp bWl0ZWQgcmVzb3VyY2VzIG9mIExMTg0KICAgbm9kZXMsIGUuZy4gYnkgY29uc3RydWN0aW5nIGZv cndhcmRpbmcgbG9vcHMgb3IgY2F1c2luZyBleGNlc3NpdmUNCiAgIHJvdXRpbmcgcHJvdG9jb2wg b3ZlcmhlYWQgdHJhZmZpYywgZXRjLg0KDQogICBUaGUgcHJvcGVydGllcyBvZiBzZWxmLWNvbmZp Z3VyYXRpb24gYW5kIHNlbGYtb3JnYW5pemF0aW9uIHdoaWNoIGFyZQ0KICAgZGVzaXJhYmxlIGlu IGEgVS1MTE4gaW50cm9kdWNlIGFkZGl0aW9uYWwgcm91dGluZyBzZWN1cml0eQ0KICAgY29uc2lk ZXJhdGlvbnMuICBNZWNoYW5pc21zIE1VU1QgYmUgaW4gcGxhY2UgdG8gZGVueSBhbnkgbm9kZSB3 aGljaA0KICAgYXR0ZW1wdHMgdG8gdGFrZSBtYWxpY2lvdXMgYWR2YW50YWdlIG9mIHNlbGYtY29u ZmlndXJhdGlvbiBhbmQgc2VsZi0NCiAgIG9yZ2FuaXphdGlvbiBwcm9jZWR1cmVzLiAgU3VjaCBh dHRhY2tzIG1heSBhdHRlbXB0LCBmb3IgZXhhbXBsZSwgdG8NCiAgIGNhdXNlIERvUywgZHJhaW4g dGhlIGVuZXJneSBvZiBwb3dlciBjb25zdHJhaW5lZCBkZXZpY2VzLCBvciB0bw0KICAgaGlqYWNr IHRoZSByb3V0aW5nIG1lY2hhbmlzbS4gIEEgbm9kZSBNVVNUIGF1dGhlbnRpY2F0ZSBpdHNlbGYg dG8gYQ0KICAgdHJ1c3RlZCBub2RlIHRoYXQgaXMgYWxyZWFkeSBhc3NvY2lhdGVkIHdpdGggdGhl IFUtTExOIGJlZm9yZSB0aGUNCiAgIGZvcm1lciBjYW4gdGFrZSBwYXJ0IGluIHNlbGYtY29uZmln dXJhdGlvbiBvciBzZWxmLW9yZ2FuaXphdGlvbi4gIEENCiAgIG5vZGUgdGhhdCBoYXMgYWxyZWFk eSBhdXRoZW50aWNhdGVkIGFuZCBhc3NvY2lhdGVkIHdpdGggdGhlIFUtTExODQogICBNVVNUIGRl bnksIHRvIHRoZSBtYXhpbXVtIGV4dGVudCBwb3NzaWJsZSwgdGhlIGFsbG9jYXRpb24gb2YNCg0K DQoNCkRvaGxlciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDIyLCAyMDA5ICAgICAg ICAgICAgICAgIFtQYWdlIDE3XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgZHJhZnQtaWV0Zi1yb2xs LXVyYmFuLXJvdXRpbmctcmVxcy0wMyAgICBEZWNlbWJlciAyMDA4DQoNCg0KICAgcmVzb3VyY2Vz IHRvIGFueSB1bmF1dGhlbnRpY2F0ZWQgcGVlci4gIFRoZSByb3V0aW5nIHByb3RvY29sKHMpIE1V U1QNCiAgIGRlbnkgc2VydmljZSB0byBhbnkgbm9kZSB3aGljaCBoYXMgbm90IGNsZWFybHkgZXN0 YWJsaXNoZWQgdHJ1c3Qgd2l0aA0KICAgdGhlIFUtTExOLg0KDQogICBDb25zaWRlcmF0aW9uIFNI T1VMRCBiZSBnaXZlbiB0byBjYXNlcyB3aGVyZSB0aGUgVS1MTE4gbWF5IGludGVyZmFjZQ0KICAg d2l0aCBvdGhlciBuZXR3b3JrcyBzdWNoIGFzIGEgaG9tZSBuZXR3b3JrLiAgVGhlIFUtTExOIFNI T1VMRCBOT1QNCiAgIGludGVyZmFjZSB3aXRoIGFueSBleHRlcm5hbCBuZXR3b3JrIHdoaWNoIGhh cyBub3QgZXN0YWJsaXNoZWQgdHJ1c3QuDQogICBUaGUgVS1MTE4gU0hPVUxEIGJlIGNhcGFibGUg b2YgbGltaXRpbmcgdGhlIHJlc291cmNlcyBncmFudGVkIGluDQogICBzdXBwb3J0IG9mIGFuIGV4 dGVybmFsIG5ldHdvcmsgc28gYXMgbm90IHRvIGJlIHZ1bG5lcmFibGUgdG8gRG9TLg0KDQogICBX aXRoIGxvdyBjb21wdXRhdGlvbiBwb3dlciBhbmQgc2NhcmNlIGVuZXJneSByZXNvdXJjZXMsIFUt TExOcyBub2Rlcw0KICAgbWF5IG5vdCBiZSBhYmxlIHRvIHJlc2lzdCBhbnkgYXR0YWNrIGZyb20g aGlnaC1wb3dlciBtYWxpY2lvdXMgbm9kZXMNCiAgIChlLmcuIGxhcHRvcHMgYW5kIHN0cm9uZyBy YWRpb3MpLiAgSG93ZXZlciwgdGhlIGFtb3VudCBvZiBkYW1hZ2UNCiAgIGdlbmVyYXRlZCB0byB0 aGUgd2hvbGUgbmV0d29yayBTSE9VTEQgYmUgY29tbWVuc3VyYXRlIHdpdGggdGhlIG51bWJlcg0K ICAgb2Ygbm9kZXMgcGh5c2ljYWxseSBjb21wcm9taXNlZC4gIEZvciBleGFtcGxlLCBhbiBpbnRy dWRlciB0YWtpbmcNCiAgIGNvbnRyb2wgb3ZlciBhIHNpbmdsZSBub2RlIFNIT1VMRCBOT1QgYmUg YWJsZSB0byBjb21wbGV0ZWx5IGRlbnkNCiAgIHNlcnZpY2UgdG8gdGhlIHdob2xlIG5ldHdvcmsu DQoNCiAgIEluIGdlbmVyYWwsIHRoZSByb3V0aW5nIHByb3RvY29sKHMpIFNIT1VMRCBzdXBwb3J0 IHRoZSBpbXBsZW1lbnRhdGlvbg0KICAgb2Ygcm91dGluZyBzZWN1cml0eSBiZXN0IHByYWN0aWNl cyBhY3Jvc3MgdGhlIFUtTExOLiAgU3VjaCBhbg0KICAgaW1wbGVtZW50YXRpb24gb3VnaHQgdG8g aW5jbHVkZSBkZWZlbnNlIGFnYWluc3QsIGZvciBleGFtcGxlLA0KICAgZWF2ZXNkcm9wcGluZywg cmVwbGF5LCBtZXNzYWdlIGluc2VydGlvbiwgbW9kaWZpY2F0aW9uLCBhbmQgbWFuLWluLQ0KICAg dGhlLW1pZGRsZSBhdHRhY2tzLg0KDQogICBUaGUgY2hvaWNlIG9mIHRoZSByb3V0aW5nIHNlY3Vy aXR5IHNvbHV0aW9ucyB3aWxsIGhhdmUgYW4gaW1wYWN0IG9udG8NCiAgIHJvdXRpbmcgcHJvdG9j b2wocykuICBUbyB0aGlzIGVuZCwgcm91dGluZyBwcm90b2NvbChzKSBwcm9wb3NlZCBpbg0KICAg dGhlIGNvbnRleHQgb2YgVS1MTE5zIE1VU1Qgc3VwcG9ydCBhdXRoZW50aWNhdGlvbiBhbmQgaW50 ZWdyaXR5DQogICBtZWFzdXJlcyBhbmQgU0hPVUxEIHN1cHBvcnQgY29uZmlkZW50aWFsaXR5IChy b3V0aW5nIHNlY3VyaXR5KQ0KICAgbWVhc3VyZXMuDQoNCg0KOC4gIElBTkEgQ29uc2lkZXJhdGlv bnMNCg0KICAgVGhpcyBkb2N1bWVudCBtYWtlcyBubyByZXF1ZXN0IG9mIElBTkEuDQoNCg0KOS4g IEFja25vd2xlZGdlbWVudHMNCg0KICAgVGhlIGluLWRlcHRoIGZlZWRiYWNrIG9mIEpQIFZhc3Nl dXIsIEpvbmF0aGFuIEh1aSwgYW5kIElhaW4gQ2FsZGVyIGlzDQogICBncmVhdGx5IGFwcHJlY2lh dGVkLg0KDQoNCjEwLiAgUmVmZXJlbmNlcw0KDQoxMC4xLiAgTm9ybWF0aXZlIFJlZmVyZW5jZXMN Cg0KICAgW1JGQzIxMTldICBCcmFkbmVyLCBTLiwgIktleSB3b3JkcyBmb3IgdXNlIGluIFJGQ3Mg dG8gSW5kaWNhdGUNCiAgICAgICAgICAgICAgUmVxdWlyZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBS RkMgMjExOSwgTWFyY2ggMTk5Ny4NCg0KDQoNCkRvaGxlciwgZXQgYWwuICAgICAgICAgICAgRXhw aXJlcyBKdW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAgIFtQYWdlIDE4XQ0KDA0KSW50ZXJuZXQt RHJhZnQgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJvdXRpbmctcmVxcy0wMyAgICBEZWNlbWJl ciAyMDA4DQoNCg0KMTAuMi4gIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMNCg0KICAgW0ktRC5pZXRm LXJvbGwtaG9tZS1yb3V0aW5nLXJlcXNdDQogICAgICAgICAgICAgIEJyYW5kdCwgQS4sIEJ1cm9u LCBKLiwgYW5kIEcuIFBvcmN1LCAiSG9tZSBBdXRvbWF0aW9uDQogICAgICAgICAgICAgIFJvdXRp bmcgUmVxdWlyZW1lbnRzIGluIExvdyBQb3dlciBhbmQgTG9zc3kgTmV0d29ya3MiLA0KICAgICAg ICAgICAgICBkcmFmdC1pZXRmLXJvbGwtaG9tZS1yb3V0aW5nLXJlcXMtMDYgKHdvcmsgaW4gcHJv Z3Jlc3MpLA0KICAgICAgICAgICAgICBOb3ZlbWJlciAyMDA4Lg0KDQogICBbSS1ELmlldGYtcm9s bC1pbmR1cy1yb3V0aW5nLXJlcXNdDQogICAgICAgICAgICAgIE5ldHdvcmtzLCBELiwgVGh1YmVy dCwgUC4sIER3YXJzLCBTLiwgYW5kIFQuIFBoaW5uZXksDQogICAgICAgICAgICAgICJJbmR1c3Ry aWFsIFJvdXRpbmcgUmVxdWlyZW1lbnRzIGluIExvdyBQb3dlciBhbmQgTG9zc3kNCiAgICAgICAg ICAgICAgTmV0d29ya3MiLCBkcmFmdC1pZXRmLXJvbGwtaW5kdXMtcm91dGluZy1yZXFzLTAzICh3 b3JrIGluDQogICAgICAgICAgICAgIHByb2dyZXNzKSwgRGVjZW1iZXIgMjAwOC4NCg0KICAgW0kt RC5pZXRmLXJvbGwtdGVybWlub2xvZ3ldDQogICAgICAgICAgICAgIFZhc3NldXIsIEouLCAiVGVy bWlub2xvZ3kgaW4gTG93IHBvd2VyIEFuZCBMb3NzeQ0KICAgICAgICAgICAgICBOZXR3b3JrcyIs IGRyYWZ0LWlldGYtcm9sbC10ZXJtaW5vbG9neS0wMCAod29yayBpbg0KICAgICAgICAgICAgICBw cm9ncmVzcyksIE9jdG9iZXIgMjAwOC4NCg0KICAgW0ktRC5tYXJ0b2NjaS1yb2xsLWJ1aWxkaW5n LXJvdXRpbmctcmVxc10NCiAgICAgICAgICAgICAgTWFydG9jY2ksIEouLCBSaW91LCBOLiwgTWls LCBQLiwgYW5kIFcuIFZlcm1leWxlbiwNCiAgICAgICAgICAgICAgIkJ1aWxkaW5nIEF1dG9tYXRp b24gUm91dGluZyBSZXF1aXJlbWVudHMgaW4gTG93IFBvd2VyIGFuZA0KICAgICAgICAgICAgICBM b3NzeSBOZXR3b3JrcyIsDQogICAgICAgICAgICAgIGRyYWZ0LW1hcnRvY2NpLXJvbGwtYnVpbGRp bmctcm91dGluZy1yZXFzLTAxICh3b3JrIGluDQogICAgICAgICAgICAgIHByb2dyZXNzKSwgT2N0 b2JlciAyMDA4Lg0KDQogICBbTHUyMDA3XSAgIEouTC4gTHUsIEYuIFZhbG9pcywgRC4gQmFydGhl bCwgTS4gRG9obGVyLCAiRklTQ086IEEgRnVsbHkNCiAgICAgICAgICAgICAgSW50ZWdyYXRlZCBT Y2hlbWUgb2YgU2VsZi1Db25maWd1cmF0aW9uIGFuZCBTZWxmLQ0KICAgICAgICAgICAgICBPcmdh bml6YXRpb24gZm9yIFdTTiIsIElFRUUgV0NOQyAyMDA3LCBIb25nIEtvbmcsIENoaW5hLA0KICAg ICAgICAgICAgICAxMS0xNSBNYXJjaCAyMDA3LCBwcC4gMzM3MC0zMzc1Lg0KDQogICBbUkZDMTU0 Nl0gIFBhcnRyaWRnZSwgQy4sIE1lbmRleiwgVC4sIGFuZCBXLiBNaWxsaWtlbiwgIkhvc3QNCiAg ICAgICAgICAgICAgQW55Y2FzdGluZyBTZXJ2aWNlIiwgUkZDIDE1NDYsIE5vdmVtYmVyIDE5OTMu DQoNCiAgIFtSRkM0MjkxXSAgSGluZGVuLCBSLiBhbmQgUy4gRGVlcmluZywgIklQIFZlcnNpb24g NiBBZGRyZXNzaW5nDQogICAgICAgICAgICAgIEFyY2hpdGVjdHVyZSIsIFJGQyA0MjkxLCBGZWJy dWFyeSAyMDA2Lg0KDQoNCkF1dGhvcnMnIEFkZHJlc3Nlcw0KDQogICBNaXNjaGEgRG9obGVyIChl ZGl0b3IpDQogICBDVFRDDQogICBQYXJjIE1lZGl0ZXJyYW5pIGRlIGxhIFRlY25vbG9naWEsIEF2 LiBDYW5hbCBPbGltcGljIFMvTg0KICAgMDg4NjAgQ2FzdGVsbGRlZmVscywgQmFyY2Vsb25hDQog ICBTcGFpbg0KDQogICBFbWFpbDogbWlzY2hhLmRvaGxlckBjdHRjLmVzDQoNCg0KDQoNCkRvaGxl ciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJlcyBKdW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAg IFtQYWdlIDE5XQ0KDA0KSW50ZXJuZXQtRHJhZnQgICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJv dXRpbmctcmVxcy0wMyAgICBEZWNlbWJlciAyMDA4DQoNCg0KICAgVGhvbWFzIFdhdHRleW5lIChl ZGl0b3IpDQogICBDSVRJLUxhYiwgSU5TQS1MeW9uLCBJTlJJQSBBNFJFUw0KICAgMjEgYXZlbnVl IEplYW4gQ2FwZWxsZQ0KICAgNjk2MjEgTHlvbg0KICAgRnJhbmNlDQoNCiAgIEVtYWlsOiB0aG9t YXMud2F0dGV5bmVAaWVlZS5vcmcNCg0KDQogICBUaW0gV2ludGVyIChlZGl0b3IpDQogICBFa2Eg U3lzdGVtcw0KICAgMjAyMDEgQ2VudHVyeSBCbHZkLiBTdWl0ZSAyNTANCiAgIEdlcm1hbnRvd24s IE1EICAyMDg3NA0KICAgVVNBDQoNCiAgIEVtYWlsOiB0aW0ud2ludGVyQGVrYXN5c3RlbXMuY29t DQoNCg0KICAgRG9taW5pcXVlIEJhcnRoZWwgKGVkaXRvcikNCiAgIEZyYW5jZSBUZWxlY29tIFIm RA0KICAgMjggQ2hlbWluIGR1IFZpZXV4IENoZW5lDQogICAzODI0MyBNZXlsYW4gQ2VkZXgNCiAg IEZyYW5jZQ0KDQogICBFbWFpbDogRG9taW5pcXVlLkJhcnRoZWxAb3JhbmdlLWZ0Z3JvdXAuY29t DQoNCg0KICAgQ2hyaXN0aWFuIEphY3F1ZW5ldA0KICAgRnJhbmNlIFRlbGVjb20gUiZEDQogICA0 IHJ1ZSBkdSBDbG9zIENvdXJ0ZWwgQlAgOTEyMjYNCiAgIDM1NTEyIENlc3NvbiBTZXZpZ25lDQog ICBGcmFuY2UNCg0KICAgRW1haWw6IGNocmlzdGlhbi5qYWNxdWVuZXRAb3JhbmdlLWZ0Z3JvdXAu Y29tDQoNCg0KICAgR2l5eWFycHVyYW0gTWFkaHVzdWRhbg0KICAgRnJhbmNlIFRlbGVjb20gUiZE DQogICAyOCBDaGVtaW4gZHUgVmlldXggQ2hlbmUNCiAgIDM4MjQzIE1leWxhbiBDZWRleA0KICAg RnJhbmNlDQoNCiAgIEVtYWlsOiBnaXl5YXJwdXJhbS5tYWRodXN1ZGFuQG9yYW5nZS1mdGdyb3Vw LmNvbQ0KDQoNCg0KDQoNCg0KDQoNCkRvaGxlciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJlcyBK dW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAgIFtQYWdlIDIwXQ0KDA0KSW50ZXJuZXQtRHJhZnQg ICAgZHJhZnQtaWV0Zi1yb2xsLXVyYmFuLXJvdXRpbmctcmVxcy0wMyAgICBEZWNlbWJlciAyMDA4 DQoNCg0KICAgR2FicmllbCBDaGVnYXJheQ0KICAgRnJhbmNlIFRlbGVjb20gUiZEDQogICAyOCBD aGVtaW4gZHUgVmlldXggQ2hlbmUNCiAgIDM4MjQzIE1leWxhbiBDZWRleA0KICAgRnJhbmNlDQoN CiAgIEVtYWlsOiBnYWJyaWVsLmNoZWdhcmF5QG9yYW5nZS1mdGdyb3VwLmNvbQ0KDQoNCg0KDQoN Cg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0KDQoNCg0K DQoNCg0KDQoNCg0KDQoNCg0KDQoNCkRvaGxlciwgZXQgYWwuICAgICAgICAgICAgRXhwaXJlcyBK dW5lIDIyLCAyMDA5ICAgICAgICAgICAgICAgIFtQYWdlIDIxXQ0KDA0K ------_=_NextPart_001_01C9621C.E9A3EE39 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir ------_=_NextPart_001_01C9621C.E9A3EE39-- From secdir-bounces@ietf.org Tue Dec 23 18:16:22 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CAB283A67DD; Tue, 23 Dec 2008 18:16:22 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 801993A683A; Mon, 22 Dec 2008 16:25:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z3f9-KWealPW; Mon, 22 Dec 2008 16:25:10 -0800 (PST) Received: from ihemail2.lucent.com (ihemail2.lucent.com [135.245.0.35]) by core3.amsl.com (Postfix) with ESMTP id 0BAAC3A689F; Mon, 22 Dec 2008 16:25:09 -0800 (PST) Received: from ilexp03.ndc.lucent.com (h135-3-39-50.lucent.com [135.3.39.50]) by ihemail2.lucent.com (8.13.8/IER-o) with ESMTP id mBN0OtQW006299; Mon, 22 Dec 2008 18:24:56 -0600 (CST) Received: from ilexfe02.ndc.lucent.com ([135.3.39.31]) by ilexp03.ndc.lucent.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 22 Dec 2008 18:24:55 -0600 Received: from [127.0.0.1] ([135.3.63.246]) by ilexfe02.ndc.lucent.com over TLS secured channel with Microsoft SMTPSVC(6.0.3790.1830); Mon, 22 Dec 2008 18:24:54 -0600 Message-ID: <49502FCF.7080800@alcatel-lucent.com> Date: Mon, 22 Dec 2008 19:24:47 -0500 From: Volker Hilt User-Agent: Thunderbird 2.0.0.18 (Windows/20081105) MIME-Version: 1.0 To: Yaron Sheffer References: <7F9A6D26EB51614FBF9F81C0DA4CFEC8D8BB94FD46@il-ex01.ad.checkpoint.com> In-Reply-To: <7F9A6D26EB51614FBF9F81C0DA4CFEC8D8BB94FD46@il-ex01.ad.checkpoint.com> X-OriginalArrivalTime: 23 Dec 2008 00:24:54.0926 (UTC) FILETIME=[E0FB1AE0:01C96494] X-Scanned-By: MIMEDefang 2.57 on 135.245.2.35 X-Mailman-Approved-At: Tue, 23 Dec 2008 18:16:21 -0800 Cc: "draft-ietf-sip-session-policy-framework@tools.ietf.org" , Dean Willis , Keith Drage , "iesg@ietf.org" , "secdir@ietf.org" Subject: Re: [secdir] secdir review of draft-ietf-sip-session-policy-framework-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Yaron, > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > Thanks for the comments! My responses are inline. > > I have reviewed a policy framework document that (5 years in the making) > presumably represents the consensus of the SIP community. But reviewing > it from a security point of view is rather challenging. In an > environment where a dozen entities (*) may be involved in setting up a > single session, it is difficult to define a threat model, let alone > define a security solution. And indeed I find the security aspects of > this document to be less than satisfactory. > > (*) UA1, local network's discovery point (DHCP?), local network's Policy > Server (PS), registrar proxy, service provider's PS, MVNO call proxy > (why not?), MVNO PS, physical service provider's proxy, service > provider's PS, destination provider's proxy, destination provider's PS, > and UA2. That's 12 in all. > While it is possible that many entities have session policies, a more realistic case is one where there is a policy server in the local network of the UAC and possibly another one in the local network of the UAS. > > The top security issues I have identified are: > > - By most common definitions of the term Policy, a Policy is a set of > rules which must be obeyed; failing to obey them is a security failure. > However the current document skirts the issue of policy enforcement > almost completely, and any mention of such is as an optional component. > When looking at this document from a service provider's point of view, > enforcing the policy is definitely a security property. Of course most > of this enforcement needs to happen on the media path. > Yes, most enforcement needs to happen on the media path. And in fact, this is what is already happening. Enforcement mechanisms are used to enforce policies but currently they have no means of notifying the UAs about policies they are enforcing (apart from modifying SDP announcements). In other words, the policy enforcement mechanisms already exist but what is missing is a mechanism to signal the policies that are enforced to UAs. Without such signaling, UAs have no way of finding out what the correct behavior is to comply with all policies (apart from trial and error). This piece is provided by this draft. Section 4.1 discusses the overall architecture. > - A SIP User Agent can rarely be trusted (in a security sense) with > anything, being deployed in the weakest part of the system - on the end > device. However the document seems to assume (e.g. the Note in Sec. > 4.4.2) that the UA will enforce the policy it receives from policy > servers. No. Enforcement is done in the network. As mentioned above, enforcement mechanisms are outside of the scope of this document and usually operate on the media path. This draft enables the signaling of policies to the UA, which will allow the UA to comply with them (if it wishes to do so). A compliant UA will follow the policies or refrain from setting up a session. A non-compliant UA could ignore these policies but will then encounter the enforcement mechanisms. > The document also emphasizes that the UA MUST fully disclose > its policy, although a malicious UA has good reasons to lie. > Again, a malicious UA may lie or ignore policies. However, it will then run into the policy enforcement mechanisms of the network. However, by signaling policies, a compliant UA can avoid errors caused by enforcement mechanisms by setting up a compliant session in the first place. > - Policies may be obtained from the local network (which may be trusted > to some extent) or from basically anybody on the SIP path to the peer > UA. The document mentions, correctly, that a malicious policy can easily > disable the UA. So it is completely unrealistic to trust policies > received from remote policy servers, even if they "authenticate" > (present a certificate someone sold them). > Not sure I understand. If a policy comes from an entity the user trusts and this entity is authenticated, the user should be able to trust these policies. It is important to remember that only entities in the SIP signaling path can submit a session policy. If there is a completely untrusted entity in the path, this entity can choose to do whatever it wants with the SIP message. A much simpler way to disable a specific call than setting up a bad policy would be to simply route the message to a malicious UAS. Also, a session policy only affects the current session. A malicious policy server cannot generally "reconfigure" a UA. I therefore don't see how session policies would pose an increased security risk. > - Policy is used for clearly security-sensitive tasks (disallowing > sessions when you've run out of credit), but on the other hand, policy > is optional - sessions can be started even if policy servers are > unavailable. > No. Enforcement mechanisms will prevent this from happening. However, with session policies a UA will know why the call is not going trough instead of just getting silence from the other end. > - TLS is used as a security fix-all, even though the UA has neither > direct contact nor trust with any but the first proxy. So in reality > hop-by-hop TLS will be used to obtain policy servers' URIs. > The UA sets up a direct session with the policy server and can authenticate this server. > Detailed Comments > > - Sec. 1: most of the discussion in the section is centered on proxies. > This is a bit confusing because they are not the motivation for > session-independent policies. > This section is introducing the fundamental problem: there is no mechanism for an intermediary entity (i.e., the entity running a proxy) to signal session policies to the UA. Session independent policies provide this capability, even though they do not make direct use of a proxy. > - Sec. 3.1: I suggest to add as step (0): discovery of one or more > policy servers. > Indeed. Will add this step. > - Sec. 3.2.1: the conditions to resubscribe to a policy, and the > restriction on retrying, mean that it's difficult to deploy a new policy > in a network where previously there was none. Compare, e.g., with a > retry every 24 hours. > Good point. It would probably make sense ask a UA to retry at a very low rate, e.g., once every 24 or 48 hours. That way, a new policy server would be known to all UAs within 2 days. I'll add a statement to the draft. > - Sec. 3.2.2: there are things it's reasonable to accept from the local > domain's policy server, but not from a remote proxy. Is there any > definition (or advice) on which policy elements are applicable where? > The policy dataset drafts provide guidelines on how to merge policies from different servers. These rules can differ between elements and are well specified in dataset drafts. Based on all the discussions around this issue, I don't think we can draw a clear distinction on which elements can reasonably come from which domains. > - Sec. 4: the use of policy to block out-of-credit users from creating > media streams is puzzling. Are they still allowed to issue INVITE requests? > In this case, the policy server would return this policy only when the UA tries to establish a session to another user. The user may still be allowed, e.g., to access his voicemail or a IVR system to recharge the account. These sessions would through, i.e., they would be policed differently. Session specific policies only apply to a single session, they do not generally prohibit an action of the UA (e.g., the creation of INVITE messages). > - Sec. 4.2, step #3: the Framework should clarify if policy changes can > be trigerred by different session-related events, e.g. a new party > joining a call. > The events that can change a policy are at the discretion of the policy server administrator. A party joining a call is a possible event. However, in this case, the conference bridge would probably directly re-negotiate the session with users. > - Sec. 4.3.1: I don't understand how UA A can request a new policy from > PS A (in the last 2 steps) after it has already committed to B regarding > their actual parameters. What if PS A comes up with any surprises? > The last two steps are necessary if PS A needs to see the answer since has not yet seen it yet. Because the answer is based on the offer, there should be no surprises and no need to return surprise policies here. This step is needed, e.g., if the policy server wants to see or modify the IP addresses contained in the answer to include a media intermediary. Of course, PS A can always choose to terminate a session. > - Sec. 4.4.1, step (6): discloses => disclose. > Good catch. Thanks!! (I'm assuming this is 4.3.1 step (6)) > - Sec. 4.4.1 (paragraph describing caching of local domain's PS): how > does the UA identify its local domain's PS? We cannot simply assume the > first PS the UA becomes aware of is local - maybe there is no local PS > at all. > Good point. I'll add a clarification to the draft. Essentially it is a policy server provided by an outbound proxy that is in the path for all requests. > - Sec. 4.4.2 (Policy-Id paragraph): is enforcement of the correct policy > really dependent on retransmitted messages being routed over exactly the > same path as the originals? Can't the UA influence this routing? > A domain can have a load balancer that routes initial INVITE requests. Since a retransmission of an INVITE after a 488 is a new INVITE request, the first and second INVITE request could be forwarded to different proxies with different policy servers. To avoid that a request keeps bouncing between these proxies, a domain can use the token field to route subsequent requests to the same proxy. > - Sec. 4.5.1: allowing the UA to continue normal processing when the PS > cannot be contacted means that the UA is also free to not contact the PS > at all (and pretend that the requests were lost) or to ignore the > returned policy (and pretend that the responses were lost). > Yes. As mentioned above, if it deliberately ignores the policy server or policies, it will have to deal with an enforcement mechanism. Again, session policies help a UA to do the right thing - they do not enforce a policy. > - Sec. 4.5.2: why should the PS believe a policy it receives from a UA? > What's there to prevent the UA from lying? > See above. Thanks! Volker _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 30 06:00:47 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EAD393A6A57; Tue, 30 Dec 2008 06:00:47 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D8953A6A57; Tue, 30 Dec 2008 06:00:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.403 X-Spam-Level: X-Spam-Status: No, score=-6.403 tagged_above=-999 required=5 tests=[AWL=0.196, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kTXa9YOa3aio; Tue, 30 Dec 2008 06:00:44 -0800 (PST) Received: from mgw-mx09.nokia.com (smtp.nokia.com [192.100.105.134]) by core3.amsl.com (Postfix) with ESMTP id B51913A68B5; Tue, 30 Dec 2008 06:00:44 -0800 (PST) Received: from esebh105.NOE.Nokia.com (esebh105.ntc.nokia.com [172.21.138.211]) by mgw-mx09.nokia.com (Switch-3.2.6/Switch-3.2.6) with ESMTP id mBUDxTOE015474; Tue, 30 Dec 2008 08:00:32 -0600 Received: from vaebh102.NOE.Nokia.com ([10.160.244.23]) by esebh105.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 30 Dec 2008 16:00:29 +0200 Received: from vaebe104.NOE.Nokia.com ([10.160.244.59]) by vaebh102.NOE.Nokia.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 30 Dec 2008 16:00:28 +0200 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Date: Tue, 30 Dec 2008 16:00:23 +0200 Message-ID: <1696498986EFEC4D9153717DA325CB7202B43725@vaebe104.NOE.Nokia.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Pasi's AD Notes for December 2008 Thread-Index: AclqhvWTq5UlslgQQpCkE8JTXl8MHw== From: To: , X-OriginalArrivalTime: 30 Dec 2008 14:00:28.0980 (UTC) FILETIME=[F8D76F40:01C96A86] X-Nokia-AV: Clean Subject: [secdir] Pasi's AD Notes for December 2008 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Hi all, Here's again a short status update about what things are going on from my point-of-view. If you notice anything that doesn't look right, let me know -- miscommunication and mix-ups do happen. Best regards, Pasi MISC NOTES - After an extremely busy December, I'm somewhat behind in my emails. I won't mind being pinged again if I haven't replied in two weeks. - Security area WG chairs will have a virtual meeting on January 12 to discuss having "virtual interim meetings" to help WGs get more work done between the IETF meetings. - draft-eronen-enterprise-number-documentation: a new draft written together with David Harrington, related to syslog WG documents. - Processed a bunch of errata (18) for security area RFCs. - (not wearing AD hat): Errata #1623 (for RFC 4282): waiting for Dan Romascanu to mark this as "Rejected" with note explaining why WORKING GROUPS DKIM - draft-ietf-dkim-ssp: went through IETF Last Call; waiting for proposed text and a revised ID to clarify some parts. Tentatively placed on agenda of 2008-01-15 IESG telechat. - draft-ietf-dkim-overview: in Publication Requested, waiting for me to read it. - Waiting for WG to send list of RFC errata IDs the WG agrees on. EMU - draft-ietf-emu-gpsk: was approved by IESG, now in RFC Editor Queue - NIST requested comments about draft SP 800-120, "Recommendation for EAP Methods Used in Wireless Network Access Authentication" IPSECME - Lots of emails that I need to read, but haven't done so yet... - (not wearing AD hat) Waiting for Russ to verify errata #1502 for RFC 4718 [since 2008-09-12] ISMS - All the WG documents went through WG Last Call; hoping to see revised IDs soon. KEYPROV - Hoping the WG soon decides what "client side" authentication options are the most important for DSKPP. PKIX - Note: I'm shepherding two PKIX drafts where Tim is a co-author - draft-ietf-pkix-ecc-subpubkeyinfo: was approved by IESG, now in RFC Editor Queue - draft-ietf-pkix-rfc4055-update: will go to IETF Last Call first thing in January. SASL - Hoping the WG soon converges on SCRAM design SYSLOG - draft-ietf-syslog-transport-tls: now in AUTH48 state - draft-ietf-syslog-sign: in AD Evaluation, waiting for me to read version -24 [since 2008-12-11] TLS - IESG approved Eric Rescorla as the IANA expert for TLS registries. - draft-ietf-tls-des-idea: went through IETF Last Call, on agenda of 2009-01-08 IESG telechat. - draft-ietf-tls-ecdhe-psk: in Publication Requested, waiting for me to read it (in January) - draft-ietf-tls-psk-new-mac-aes-gcm: same as ecdhe-psk - Errata #1585: waiting for Ekr to confirm that this errata is correct [since 2008-11-06] - (not WG item) Two IPR disclosures related to draft-hajjeh-tls-identity- protection were filed (1036 and 1044) OTHER DOCUMENTS - draft-ietf-pkix-cmp-transport-protocols: It seems some folks are interested in reviving this long-expired draft, so that current implementation behavior is documented somewhere. I've promised to read and comment if/when something is submitted. - draft-randall-3447bis: James Randall posted the -00 draft; I should read this and comment. - draft-ietf-mpls-mpls-and-gmpls-security-framework: I've promised to read this. - "Security roadmap for routing protocols": Gregory has sent the first draft-of-a-draft; Tim and I have promised to comment and contribute. - "Applicability guidance for security protocols": Tim and I have promised to write something that would help in determining which security mechanism (e.g. TLS, IPsec, SASL, GSS-API, ..) to use for a new higher-layer protocol. - draft-mattsson-srtp-store-and-forward: I've promised to read this and send comments, but haven't done so yet. DISCUSSES (active -- something happened within last month) - draft-cheshire-dnsext-nbp: waiting for authors to reply to my comments [since 2008-12-03] - draft-housley-internet-draft-sig-file: I need to read version -07 and related emails [since 2008-12-24] - draft-ietf-calsify-rfc2445bis: waiting for authors to reply to my comment [since 2008-12-18] - draft-ietf-dime-mip6-integrated: I need to read the proposed text sent on 2008-12-30 and reply [since 2008-12-30] - draft-ietf-enum-combined: waiting for authors to propose text or a revised ID [since 2008-12-11] - draft-ietf-l1vpn-ospfv3-auto-discovery: text agreed, waiting for a revised ID or RFC Editor Note [since 2008-12-19] - draft-ietf-mext-nemo-v4traversal: some text agreed, waiting for authors to propose text for the remaining comments [since 2008-12-30] - draft-ietf-mip4-dsmipv4: some text agreed, waiting for authors to reply to my remaining comments [since 2008-12-19] - draft-ietf-mipshop-mstp-solution: discussion ongoing, I need to read and reply to the latest emails [since 2008-12-17] - draft-ietf-monami6-multiplecoa: some text agreed, waiting for authors to reply to my remaining comments [since 2008-12-05] - draft-ietf-nfsv4-rfc1831bis: waiting for authors to reply to my remaining comments or submit a revised ID [since 2008-12-15] - draft-ietf-nfsv4-rpc-netid: waiting for authors to reply to my comments or submit a revised ID [since 2008-12-16] - draft-ietf-ospf-lls: waiting for a revised ID or RFC Editor Notes to address my remaining comments [since 2008-12-18] - draft-ietf-roll-urban-routing-reqs: discussion ongoing, I need to read and reply to emails [since 2008-12-19] - draft-ietf-shim6-proto: discussion ongoing, waiting for authors to propose approach [since 2008-12-30] - draft-ietf-smime-sha2: text agreed, waiting for a revised ID or RFC Editor Note to fix the DER hex strings [since 2008-12-29] - draft-ietf-tcpm-tcp-uto: waiting for authors to reply to my comments or submit a revised ID [since 2008-12-16] - draft-igoe-secsh-aes-gcm: discussions ongoing, hoping to have more information in early January - draft-kato-camellia-ctrccm: authors have proposed text that would resolve my comments; waiting for a revised ID [since 2008-12-19] DISCUSSES (stalled -- I haven't heard anything from the authors or document shepherd for over one month) - draft-kato-ipsec-camellia-modes: waiting for authors to reply to my comments or submit a revised ID [since 2008-11-06] - draft-ietf-sip-dtls-srtp-framework: waiting for authors to reply to my comments or submit a revised ID [since 2008-11-06] - draft-ietf-sip-xcapevent: waiting for revised ID or RFC Editor Note to fix the ABNF/XML bugs [since 2008-10-24] - draft-ietf-sipping-policy-package: waiting for more information from Mary or Jon [since 2008-10-28] - draft-ietf-vrrp-unified-spec: waiting for authors to propose text [since 2008-11-07] DISCUSSES (presumed dead -- I haven't heard anything from the authors or document shepherd for over three months) - draft-cain-post-inch-phishingextns: waiting for authors to reply to my comments or submit a revised ID [since 2008-08-28] - draft-ietf-bfd-base: waiting for authors to reply to my comments or submit a revised ID [since 2008-06-05] - draft-ietf-bfd-multihop: waiting for authors to reply to my comments or submit a revised ID [since 2008-06-05] - draft-ietf-bfd-v4v6-1hop: waiting for authors to reply to my comments or submit a revised ID [since 2008-06-05] --end-- _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 30 09:02:25 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CFC613A6A64; Tue, 30 Dec 2008 09:02:25 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 242D63A6A5D; Tue, 30 Dec 2008 07:11:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.837 X-Spam-Level: X-Spam-Status: No, score=-1.837 tagged_above=-999 required=5 tests=[AWL=-1.652, BAYES_40=-0.185] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TU+4X-MvTICo; Tue, 30 Dec 2008 07:11:52 -0800 (PST) Received: from mailout12.yourhostingaccount.com (mailout12.yourhostingaccount.com [65.254.253.98]) by core3.amsl.com (Postfix) with ESMTP id 609983A6A59; Tue, 30 Dec 2008 07:11:52 -0800 (PST) Received: from mailscan05.yourhostingaccount.com ([10.1.15.5] helo=mailscan05.yourhostingaccount.com) by mailout12.yourhostingaccount.com with esmtp (Exim) id 1LHgFx-00030a-Lt; Tue, 30 Dec 2008 10:11:41 -0500 Received: from impout03.yourhostingaccount.com ([10.1.55.3] helo=impout03.yourhostingaccount.com) by mailscan05.yourhostingaccount.com with esmtp (Exim) id 1LHgFv-0004eX-Ng; Tue, 30 Dec 2008 10:11:39 -0500 Received: from authsmtp01.yourhostingaccount.com ([10.1.18.1]) by impout03.yourhostingaccount.com with NO UCE id xTBf1a00401P85W0000000; Tue, 30 Dec 2008 10:11:39 -0500 X-EN-OrigOutIP: 10.1.18.1 X-EN-IMPSID: xTBf1a00401P85W0000000 Received: from c-98-216-48-22.hsd1.ma.comcast.net ([98.216.48.22] helo=Familyroom) by authsmtp01.yourhostingaccount.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim) id 1LHgFv-0006Lm-4e; Tue, 30 Dec 2008 10:11:39 -0500 Received: from Familyroom by Familyroom (PGP Universal service); Tue, 30 Dec 2008 10:11:34 -0500 X-PGP-Universal: processed; by Familyroom on Tue, 30 Dec 2008 10:11:34 -0500 From: "Patrick Cain" To: , , , , , Date: Tue, 30 Dec 2008 10:11:12 -0500 Message-ID: <004401c96a90$e24753d0$a6d5fb70$@com> MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AclqEDMPvoleIj4KR8Own2ji8ZP+fg== Content-Language: en-us X-EN-UserInfo: 058f9b27fa04b0cf04458fb359a831ba:155e17fc3c7b3afdad05516cd0497062 X-EN-AuthUser: pcain@coopercain.com X-EN-OrigIP: 98.216.48.22 X-EN-OrigHost: c-98-216-48-22.hsd1.ma.comcast.net Cc: iesg@ietf.org Subject: [secdir] secdir review of draft-ietf-ospf-manet-mpr-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I am reviewing this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft specifies an extension to OSPFv3 adapted to MANETs and based on Mechanisms providing flooding reduction, topology reduction, and adjacency reductions. The document looks okay to me. There is a security considerations section and, although it does not identify Workarounds for the identified problems, it cites relevant topics. Pat Cain _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Tue Dec 30 15:52:43 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9AA9E3A687E; Tue, 30 Dec 2008 15:52:43 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ADBC63A67C0 for ; Tue, 30 Dec 2008 15:52:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=2.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tv-zy+mRnlx5 for ; Tue, 30 Dec 2008 15:52:37 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 5EE193A687E for ; Tue, 30 Dec 2008 15:52:37 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBUNqQtY011000 for ; Tue, 30 Dec 2008 18:52:26 -0500 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBUNqJlL010967 for ; Tue, 30 Dec 2008 18:52:19 -0500 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id mBUNqDkx022180 for ; Tue, 30 Dec 2008 18:52:14 -0500 (EST) Received: from cyteen.hactrn.net (cyteen.hactrn.net [66.92.66.68]) by mit.edu (Spam Firewall) with ESMTP id AED6311913D1 for ; Tue, 30 Dec 2008 18:51:52 -0500 (EST) Received: from thrintun.hactrn.net (thrintun.hactrn.net [IPv6:2002:425c:4242:0:219:d1ff:fe12:5d30]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 55F1B2846C; Tue, 30 Dec 2008 23:51:50 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 146B122808; Tue, 30 Dec 2008 18:51:50 -0500 (EST) Date: Tue, 30 Dec 2008 18:51:50 -0500 From: Rob Austein To: iesg@ietf.org, secdir@mit.edu MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Message-Id: <20081230235150.146B122808@thrintun.hactrn.net> X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Cc: jgs@juniper.net, idr-chairs@tools.ietf.org, rchandra@sonoasystems.com Subject: [secdir] Secdir review of draft-ietf-idr-rfc3392bis-03 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I have reviewed draft-ietf-idr-rfc3392bis-03 as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is a clarification of RFC 3392, which was itself a clarification of RFC 2842, so this mechanism has been around for a while. Appendix B of the draft accurately describes the changes, to wit: In addition to minor editorial changes and updated references, this document also clarifies the use of the Unsupported Optional Parameter NOTIFICATION message and clarifies behavior when the Capabilities parameter is included in the OPEN message multiple times. I have no security concerns with this document. _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 31 12:57:27 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4B3DA3A6846; Wed, 31 Dec 2008 12:57:27 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 119C23A6846 for ; Wed, 31 Dec 2008 12:57:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.248 X-Spam-Level: X-Spam-Status: No, score=-2.248 tagged_above=-999 required=5 tests=[AWL=0.351, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pNklCxzwtXUI for ; Wed, 31 Dec 2008 12:57:25 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 510B13A67AE for ; Wed, 31 Dec 2008 12:57:24 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.3) with ESMTP id mBVKvDvB020573; Wed, 31 Dec 2008 15:57:13 -0500 (EST) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.3/Submit) with ESMTP id mBVKvCFY020568; Wed, 31 Dec 2008 15:57:12 -0500 (EST) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Wed, 31 Dec 2008 15:57:12 -0500 (EST) From: Samuel Weiler To: Pasi.Eronen@nokia.com, Tim Polk In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Wed, 31 Dec 2008 15:57:13 -0500 (EST) Cc: secdir@ietf.org Subject: Re: [secdir] secdir review of draft-raj-dhc-tftp-addr-option-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Rechecking this doc before telechat: The discussion on the IETF list resolved some of my concerns, but there was also support for some of the concerns, with edits suggested by Ralph Droms and others. The last I saw, Jari was expecting a doc revision, but the doc has not been revised. I'm not clear on why he's pushing it to telechat as-is -- I think issues are still unresolved. -- Sam _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 31 13:06:36 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 770653A6846; Wed, 31 Dec 2008 13:06:36 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 10E743A6846 for ; Wed, 31 Dec 2008 13:06:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=2.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id celLIwnnihy8 for ; Wed, 31 Dec 2008 13:06:34 -0800 (PST) Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by core3.amsl.com (Postfix) with ESMTP id 1EFA63A67AE for ; Wed, 31 Dec 2008 13:06:33 -0800 (PST) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBVL6LK1008018 for ; Wed, 31 Dec 2008 16:06:23 -0500 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id mBVL6JEW008006 for ; Wed, 31 Dec 2008 16:06:19 -0500 Received: from mit.edu (W92-130-BARRACUDA-3.MIT.EDU [18.7.21.224]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id mBVL6CKA020898 for ; Wed, 31 Dec 2008 16:06:12 -0500 (EST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mit.edu (Spam Firewall) with ESMTP id D56DE12B2CD8 for ; Wed, 31 Dec 2008 16:05:48 -0500 (EST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.3) with ESMTP id mBVL5lVX021628 for ; Wed, 31 Dec 2008 16:05:48 -0500 (EST) (envelope-from weiler+secdir@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.3/Submit) with ESMTP id mBVL5lMs021625 for ; Wed, 31 Dec 2008 16:05:47 -0500 (EST) (envelope-from weiler+secdir@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Wed, 31 Dec 2008 16:05:47 -0500 (EST) From: Samuel Weiler X-X-Sender: weiler@fledge.watson.org To: secdir@mit.edu Message-ID: User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Wed, 31 Dec 2008 16:05:48 -0500 (EST) X-Scanned-By: MIMEDefang 2.42 X-BeenThere: secdir@mit.edu X-Mailman-Version: 2.1.6 Precedence: list Subject: [secdir] Assignments for January 6th X-BeenThere: secdir@ietf.org Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org Given the holiday and the relatively stable agenda for next week's telechat, I'm sending this week's assignments a little early. As a reminder, there is another telechat on the 15th. Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview Sam Hartman is next in the rotation. -- Sam For telechat 2009-01-06 David Harrington T draft-ietf-ippm-delay-var-as-01 Paul Hoffman T draft-ietf-smime-3851bis-08 Eric Rescorla T draft-ietf-dkim-ssp-08 Nico Williams T draft-ietf-smime-3850bis-08 Tom Yu T draft-korhonen-mip4-service-07 Larry Zhu T draft-arkko-arp-iana-rules-05 Last calls and special requests: Derek Atkins draft-ietf-avt-post-repair-rtcp-xr-04 Rob Austein draft-ietf-dime-qos-parameters-08 Uri Blumenthal draft-ietf-ospf-manet-mdr-04 Pat Cain draft-ietf-geopriv-pdif-lo-profile-14 Ran Canetti draft-ietf-ospf-manet-or-01 Charles Clancy draft-ietf-pce-dste-02 Dave Cridland draft-ietf-pce-of-06 Alan DeKok draft-ietf-roll-home-routing-reqs-06 Lakshminath Dondeti draft-ietf-speermint-terminology-17 Shawn Emery draft-ietf-mediactrl-mixer-control-package-03 Stephen Farrell draft-melnikov-sieve-imapext-metadata-08 Tobias Gondrom draft-ietf-sieve-managesieve-05 Phillip Hallam-Baker draft-ietf-radext-design-05 Phillip Hallam-Baker draft-atlas-icmp-unnumbered-06 Steve Hanna draft-ietf-radext-management-authorization-06 Steve Hanna draft-ietf-eai-downgrade-10 Scott Kelly draft-ietf-tsvwg-rsvp-proxy-approaches-06 Tero Kivinen R draft-ietf-softwire-encaps-safi-04 Catherine Meadows draft-ietf-speechsc-mrcpv2-17 Catherine Meadows draft-ietf-l2tpext-tdm-06 Sandy Murphy draft-ietf-mpls-mpls-and-gmpls-security-framework-04 Vidya Narayanan draft-ietf-sip-saml-05 Eric Rescorla draft-wing-sipping-srtp-key-04 Susan Thomson draft-loreto-simple-im-srv-label-02 Hannes Tschofenig draft-ietf-trill-prob-05 Sam Weiler draft-chown-v6ops-rogue-ra-02 Brian Weis draft-ietf-sieve-mime-loop-08 Nico Williams draft-ietf-v6ops-ra-guard-01 Larry Zhu draft-thaler-v6ops-teredo-extensions-02 Larry Zhu draft-ietf-softwire-hs-framework-l2tpv2-10 Glen Zorn draft-andreasen-sipping-rfc3603bis-07 _______________________________________________ secdir mailing list secdir@mit.edu https://mailman.mit.edu/mailman/listinfo/secdir _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir From secdir-bounces@ietf.org Wed Dec 31 13:09:11 2008 Return-Path: X-Original-To: secdir-archive@ietf.org Delivered-To: ietfarch-secdir-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 917DA3A6851; Wed, 31 Dec 2008 13:09:11 -0800 (PST) X-Original-To: secdir@core3.amsl.com Delivered-To: secdir@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F03E63A6851 for ; Wed, 31 Dec 2008 13:09:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.999 X-Spam-Level: X-Spam-Status: No, score=-2.999 tagged_above=-999 required=5 tests=[AWL=-0.400, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wnq7+byrc3KZ for ; Wed, 31 Dec 2008 13:09:10 -0800 (PST) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by core3.amsl.com (Postfix) with ESMTP id 1F97E3A6846 for ; Wed, 31 Dec 2008 13:09:10 -0800 (PST) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.3/8.14.3) with ESMTP id mBVL8xt8021983 for ; Wed, 31 Dec 2008 16:08:59 -0500 (EST) (envelope-from weiler+secdir@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.3/8.14.3/Submit) with ESMTP id mBVL8wN8021980 for ; Wed, 31 Dec 2008 16:08:58 -0500 (EST) (envelope-from weiler+secdir@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Wed, 31 Dec 2008 16:08:58 -0500 (EST) From: Samuel Weiler X-X-Sender: weiler@fledge.watson.org To: secdir@ietf.org Message-ID: User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0 (fledge.watson.org [127.0.0.1]); Wed, 31 Dec 2008 16:08:59 -0500 (EST) Subject: [secdir] Lost mail, December 17th-24th X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: secdir-secretary@mit.edu List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: secdir-bounces@ietf.org Errors-To: secdir-bounces@ietf.org I lost about 70 messages between December 17th and 24th. I went through the secdir archives for list mail that might have been lost, but if you sent something to secdir-secretary or weiler@watson.org in that time that I haven't answered, please resend it. -- Sam _______________________________________________ secdir mailing list secdir@ietf.org https://www.ietf.org/mailman/listinfo/secdir