From nobody Mon Jun 1 18:05:22 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 535F23A0736; Mon, 1 Jun 2020 18:05:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5zCYH-rNk_DA; Mon, 1 Jun 2020 18:05:18 -0700 (PDT) Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A146A3A0658; Mon, 1 Jun 2020 18:05:17 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id x6so1585688wrm.13; Mon, 01 Jun 2020 18:05:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Emh7q+r9fhuKThk/6IyBM6MXDVr4qJmFjxu6S7Cl6Qw=; b=mAIV24PUuqaBst92sJizv+tiwVQaVnZ2xGS9qIE7xC7gGckURvY14JKSg3ETmCHHf0 FjqYVxMdgX19Jt7gwOliax40r+d1zWhay94z7Ebjs7vGteyO3Cy/8AjAClhbm6rGIjwg 29gyd0oOHvwAM7o0FTHpLsDSTLnPLLyKOpQD7deEK1g1tJUWXRuYKEKXSSCYYLLKF+UM oRNWYm+c6+wZ+id1U3hdNvkorudPpRUTPQePe6wbPQS1yFyHkBbfRUlml/YIZewmEEqz Ddst6ZpqNGD3V591iZpKhDmo65igqzCPJHCP0wEFpDuNDqdK4pjbywlWV1qlNdfcNQ4A R21Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Emh7q+r9fhuKThk/6IyBM6MXDVr4qJmFjxu6S7Cl6Qw=; b=Q5xqwk1ge9kXOU8frjMX4rEkF2RXJ6nl6mpnYWziK99hNd3Yh1fyqE1Ke9IeBethur N1mLPNF/3gltehoh9boCpehsQ1FOxqCw34qxYCdYEYYiaT8omAbzuHBcTHNCW/NMf/Oc 5vq2DeXwnyS3Pf13ZIexcLOwrnBRrRj4kT5S/H5jH3bs1OcEij0ct7BV+gXr0OV+xQNR VikLuNnPeOgF6UIrSgGnTS7GyhOCc/p7Tgfa9KLeiorYLg2Vfju9HA3e47ZUPuJUI5jK VK73lq25t81BCOa1Cqfk+cPYnJADgE1/B5jtuFKCuYyjHtDfK8n7p1IQnirBM/o050Kx Gd4w== X-Gm-Message-State: AOAM533kwyxeJc8p6EOhckxXvdc4qhAaC/qT7P/DgM0qJbOVT2V/06n1 TtDO3j195T/c4thLwKgDJFoPaio1hTz3AgjYDas= X-Google-Smtp-Source: ABdhPJwTlseqe//+XgIl1R0dhdiiV13maeJ7YvNvqvcRyuebCMEgITRzqtMcbqEQY3CfdI7+QW4YWfE29UZiHO0bQVA= X-Received: by 2002:adf:82d0:: with SMTP id 74mr22676583wrc.138.1591059916125; Mon, 01 Jun 2020 18:05:16 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rifaat Shekh-Yusef Date: Mon, 1 Jun 2020 21:05:05 -0400 Message-ID: To: Erik Kline Cc: Martin Thomson , Benjamin Kaduk , Barry Leiba , captive-portals , IETF SecDir , Tommy Pauly , d.thakore@cablelabs.com Content-Type: multipart/alternative; boundary="0000000000001dfb8d05a70f81de" Archived-At: Subject: Re: [secdir] [Captive-portals] Secdir last call review of draft-ietf-capport-rfc7710bis-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jun 2020 01:05:20 -0000 --0000000000001dfb8d05a70f81de Content-Type: text/plain; charset="UTF-8" On Sun, May 31, 2020 at 2:07 AM Erik Kline wrote: > On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef > wrote: > > > > Adding SecDir back to this thread. > > > > > > >Martin Thomson Tue, 19 May 2020 01:02 UTCShow > header > > > > > >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote: > > >> it provides the client of the API > > >> an opportunity to authenticate the server that is hosting the API. > > >> This authentication is aimed at *allowing a user to be reasonably > > >> confident that the entity providing the Captive Portal API has a > > >> valid certificate for the hostname in the URI* > > >[...] > > >> An end user should be able to validate that the name is example.com > and > > >> not any other form of the URI. > > >> It would be much more difficult for the end user to make sense and > > >> validate an IP address. > > > > > >I think that you missed the point of my comments. This validation, > performed by > > >a user, has no meaningful security value. The text you cite says that > the server > > >has a certificate for the name it chooses, which is not the same as > "has a certificate > > >for a name the client expects". The difference is important. > > > > > > > This is not the way I read these statements from section 4.1 titled > Server Authentication. > > > > Here is the use case I have in mind when I read this section: > > If I walk into an airport and I see an ad for a paid Internet service > from example.com, then as an > > end user it is reasonable to expect that I would have some ability to > make sense of the name > > presented to me and make sure it is from example.com if I choose to get > such a service. > > > > If this is not the case, then yo might want to make it clear that this > is not about Server Authentication > > as the title of the section and the text inside that section is > suggesting. > > If we changed the API document's section 4.1 title from "Server > Authentication" to "API Server Authentication", would that be more > clear? > > I reality, users should never see the API URL. The following is a quote from section 4.1 of the API document, which implies otherwise: "The hostname of the API SHOULD be displayed to the user in order to indicate the entity which is providing the API service." Regards, Rifaat > They'll just be > connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs. If anything > will only be one or both of the "user-portal-url" or "venue-info-url" > URLs that might be visible in the browser that's opened for the user's > interaction. > > -ek > > > Regards, > > Rifaat > > > > > > > > >In a typical web scenario, a person types a string in and (ignore the > case where there > > >is an extra hop via a search engine) that string determines what is > acceptable as a > > >server identity. The exposure to confusables is limited (under a set > of other assumptions, > > >HSTS, etc...). Here, the network has free reign to do as they choose > with homoglyphs and > > >other such nonsense. Any expectation you might have about this really > being a trustworthy > > >entity is meaningless in this context. > > > > > >There are protections against this, but they all lie firmly in the > anti-phishing domain. > > >Most of those rely on having a certificate though, so the requirement > for HTTPS is in > > >service of that, not in terms of ensuring that an untrained human can > make a security > > >critical decision based on poisoned information. > > > > On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef < > rifaat.s.ietf@gmail.com> wrote: > >> > >> Adding Ben. > >> > >> > >> On Sun, May 17, 2020 at 9:26 PM Martin Thomson > wrote: > >>> > >>> Adding more lists.. > >>> > >>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote: > >>> > > Here is a quote form the API document: > >>> > > "The hostname of the API SHOULD be displayed to the user in order > to indicate the entity which is providing the API service." > >>> > > > >>> > > This seems to suggest that the user is expected to inspect the > displayed name and make sure it is make sense in the context of whoever is > providing that service. > >>> > >>> I don't think that is the case. If this were a security mechanism, > then it would use "MUST". This is likely for the purpose of enabling some > sort of accountability. In other words, this is to offer maximal > information about what is going on. > >>> > >> Here is the sentence just before the above quote from the API document: > >> > >> it provides the client of the API > >> an opportunity to authenticate the server that is hosting the API. > >> This authentication is aimed at allowing a user to be reasonably > >> confident that the entity providing the Captive Portal API has a > >> valid certificate for the hostname in the URI > >> > >> > >> > >> > >>> > >>> > > Since this would be an easier attack compared to the interception > attack, and IP address is still permitted, then an attacker might force the > use of IP address to make it harder for the user to make sense of the > displayed name. > >>> > >>> I don't think that is materially different than getting a name with > confusable characters (or using the prefix hack, example.com..example, > in an attempt to confuse). > >> > >> > >> An end user should be able to validate that the name is example.com > and not any other form of the URI. > >> It would be much more difficult for the end user to make sense and > validate an IP address. > >> > >> Regards, > >> Rifaat > >> > > _______________________________________________ > > Captive-portals mailing list > > Captive-portals@ietf.org > > https://www.ietf.org/mailman/listinfo/captive-portals > --0000000000001dfb8d05a70f81de Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, May 31, 2020 at 2:07 AM Erik = Kline <ek.ietf@gmail.com> wr= ote:
On Wed, May= 20, 2020 at 4:37 AM Rifaat Shekh-Yusef
<rifaat.s.i= etf@gmail.com> wrote:
>
> Adding SecDir back to this thread.
>
>
> >Martin Thomson <mt@lowentropy.net> Tue, 19 May 2020 01:02 UTCShow header
> >
> >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote:
> >>=C2=A0 =C2=A0 it provides the client of the API
> >>=C2=A0 =C2=A0 an opportunity to authenticate the server that i= s hosting the API.
> >>=C2=A0 =C2=A0 This authentication is aimed at *allowing a user= to be reasonably
> >>=C2=A0 =C2=A0 confident that the entity providing the Captive = Portal API has a
> >>=C2=A0 =C2=A0 valid certificate for the hostname in the URI* > >[...]
> >> An end user should be able to validate that the name is example.com<= /a> and
> >> not any other form of the URI.
> >> It would be much more difficult for the end user to make sens= e and
> >> validate an IP address.
> >
> >I think that you missed the point of my comments.=C2=A0 This valid= ation, performed by
> >a user, has no meaningful security value.=C2=A0 The text you cite = says that the server
> >has a certificate for the name it chooses, which is not the same a= s "has a certificate
> >for a name the client expects".=C2=A0 The difference is impor= tant.
> >
>
> This is not the way I read these statements from section 4.1 titled Se= rver Authentication.
>
> Here is the use case I have in mind when I read this section:
> If I walk into an airport and I see an ad for a paid Internet service = from ex= ample.com, then as an
> end user it is reasonable to expect that I would have some ability to = make sense of the name
> presented to me and make sure it is from example.com if I choose to get s= uch a service.
>
> If this is not the case, then yo might want to make it clear that this= is not about Server Authentication
> as the title of the section and the text inside that section is sugges= ting.

If we changed the API document's section 4.1 title from "Server Authentication" to "API Server Authentication", would that b= e more
clear?

I reality, users should never see the API URL.=C2=A0

<= /div>
The following is a quote from section 4.1 of the API document, wh= ich implies otherwise:
"The hostname of the= API SHOULD be displayed to the user in order to indicate the entity which = is providing the API service."
=C2=A0
Regar= ds,
=C2=A0Rifaat


=C2= =A0
They'll jus= t be
connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs.= =C2=A0 If anything
will only be one or both of the "user-portal-url" or "venue-= info-url"
URLs that might be visible in the browser that's opened for the user= 9;s
interaction.

-ek

> Regards,
>=C2=A0 Rifaat
>
>
>
> >In a typical web scenario, a person types a string in and (ignore = the case where there
> >is an extra hop via a search engine) that string determines what i= s acceptable as a
> >server identity.=C2=A0 The exposure to confusables is limited (und= er a set of other assumptions,
> >HSTS, etc...).=C2=A0 Here, the network has free reign to do as the= y choose with homoglyphs and
> >other such nonsense.=C2=A0 Any expectation you might have about th= is really being a trustworthy
> >entity is meaningless in this context.
> >
> >There are protections against this, but they all lie firmly in the= anti-phishing domain.
> >Most of those rely on having a certificate though, so the requirem= ent for HTTPS is in
> >service of that, not in terms of ensuring that an untrained human = can make a security
> >critical decision based on poisoned information.
>
> On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com&g= t; wrote:
>>
>> Adding Ben.
>>
>>
>> On Sun, May 17, 2020 at 9:26 PM Martin Thomson <mt@lowentropy.net> wrote: >>>
>>> Adding more lists..
>>>
>>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote:
>>> > > Here is a quote form the API document:
>>> > > "The hostname of the API SHOULD be displayed to= the user in order to indicate the entity which is providing the API servic= e."
>>> > >
>>> > > This seems to suggest that the user is expected to i= nspect the displayed name and make sure it is make sense in the context of = whoever is providing that service.
>>>
>>> I don't think that is the case.=C2=A0 If this were a secur= ity mechanism, then it would use "MUST".=C2=A0 This is likely for= the purpose of enabling some sort of accountability.=C2=A0 In other words,= this is to offer maximal information about what is going on.
>>>
>> Here is the sentence just before the above quote from the API docu= ment:
>>
>>=C2=A0 =C2=A0 it provides the client of the API
>>=C2=A0 =C2=A0 an opportunity to authenticate the server that is hos= ting the API.
>>=C2=A0 =C2=A0 This authentication is aimed at allowing a user to be= reasonably
>>=C2=A0 =C2=A0 confident that the entity providing the Captive Porta= l API has a
>>=C2=A0 =C2=A0 valid certificate for the hostname in the URI
>>
>>
>>
>>
>>>
>>> > > Since this would be an easier attack compared to the= interception attack, and IP address is still permitted, then an attacker m= ight force the use of IP address to make it harder for the user to make sen= se of the displayed name.
>>>
>>> I don't think that is materially different than getting a = name with confusable characters (or using the prefix hack, example.com.<som= e-guid>.example, in an attempt to confuse).
>>
>>
>> An end user should be able to validate that the name is example.com a= nd not any other form of the URI.
>> It would be much more difficult for the end user to make sense and= validate an IP address.
>>
>> Regards,
>>=C2=A0 Rifaat
>>
> _______________________________________________
> Captive-portals mailing list
> Captive-= portals@ietf.org
> https://www.ietf.org/mailman/listinfo/cap= tive-portals
--0000000000001dfb8d05a70f81de-- From nobody Mon Jun 1 22:33:34 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3533B3A03FF; Mon, 1 Jun 2020 22:33:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bkcBR_miuHKL; Mon, 1 Jun 2020 22:33:20 -0700 (PDT) Received: from nwk-aaemail-lapp01.apple.com (nwk-aaemail-lapp01.apple.com [17.151.62.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4A2113A03F2; Mon, 1 Jun 2020 22:33:20 -0700 (PDT) Received: from pps.filterd (nwk-aaemail-lapp01.apple.com [127.0.0.1]) by nwk-aaemail-lapp01.apple.com (8.16.0.42/8.16.0.42) with SMTP id 0525Qer9025724; Mon, 1 Jun 2020 22:33:16 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=content-type : content-transfer-encoding : from : mime-version : subject : date : message-id : references : cc : in-reply-to : to; s=20180706; bh=p8CDesh7nVi23VXNk6kYfBjTX303JY5wKWJQrLfD2q0=; b=eKk0PICx1/WV/6KKqxtJ3bgRft1dLE8aWpMATLVxVfprCAq2OEKEQxmQjTVH+835UdMe RfxuGKwRs1u+SbW92WsHgIeTUxwd8T2RB4FLQxYiOcD4c8c1VwagWu0peMBnvCaEsLAV 6IhA8T+EpNT86gEuZyzGKSXdyhcVv62kkR51Rqn/drkuXg5FOOtnmZ0k3CEmZt8vbI2W bBy+WmzEiPFxhRWiWmKoGIsfb1lfdwwsZ8tfp+406AnXSxogG+8zciRhi54J4vH4EZmY 9bIeZ/hsscOyQG9LMPru0Jk2qPS+byk5EO8LWgH/UmvIb3FyohPC2pMgSiHhUEJiobTO lQ== Received: from rn-mailsvcp-mta-lapp02.rno.apple.com (rn-mailsvcp-mta-lapp02.rno.apple.com [10.225.203.150]) by nwk-aaemail-lapp01.apple.com with ESMTP id 31bpe0161d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 01 Jun 2020 22:33:16 -0700 Received: from rn-mailsvcp-mmp-lapp02.rno.apple.com (rn-mailsvcp-mmp-lapp02.rno.apple.com [17.179.253.15]) by rn-mailsvcp-mta-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPS id <0QBA005GFA3GCOF0@rn-mailsvcp-mta-lapp02.rno.apple.com>; Mon, 01 Jun 2020 22:33:16 -0700 (PDT) Received: from process_milters-daemon.rn-mailsvcp-mmp-lapp02.rno.apple.com by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) id <0QBA00K0097ONI00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Mon, 01 Jun 2020 22:33:16 -0700 (PDT) X-Va-A: X-Va-T-CD: 9a5974041421f7cdcfa0f26c89c75464 X-Va-E-CD: 8bcfc01e0976f0c3c7ebfdd9fc05e2e9 X-Va-R-CD: 085b768f9aac523a58ff11cb8fc0a25e X-Va-CD: 0 X-Va-ID: ed21acee-3005-4a22-ba97-5d8244c88b23 X-V-A: X-V-T-CD: 9a5974041421f7cdcfa0f26c89c75464 X-V-E-CD: 8bcfc01e0976f0c3c7ebfdd9fc05e2e9 X-V-R-CD: 085b768f9aac523a58ff11cb8fc0a25e X-V-CD: 0 X-V-ID: 39a584e0-2e95-481f-ba35-116ed38dc987 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687 definitions=2020-06-02_05:2020-06-01, 2020-06-02 signatures=0 Received: from [10.104.15.191] (unknown [10.104.15.191]) by rn-mailsvcp-mmp-lapp02.rno.apple.com (Oracle Communications Messaging Server 8.1.0.5.20200312 64bit (built Mar 12 2020)) with ESMTPSA id <0QBA00O4TA3F4W00@rn-mailsvcp-mmp-lapp02.rno.apple.com>; Mon, 01 Jun 2020 22:33:15 -0700 (PDT) Content-type: multipart/alternative; boundary=Apple-Mail-D425A370-4584-4E44-8495-E3F818EE8E19 Content-transfer-encoding: 7bit From: Tommy Pauly MIME-version: 1.0 (1.0) Date: Mon, 01 Jun 2020 22:33:14 -0700 Message-id: References: Cc: Erik Kline , Martin Thomson , Benjamin Kaduk , Barry Leiba , IETF SecDir , d.thakore@cablelabs.com In-reply-to: To: Rifaat Shekh-Yusef , captive-portals X-Mailer: iPhone Mail (18A288) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687 definitions=2020-06-02_05:2020-06-01, 2020-06-02 signatures=0 Archived-At: Subject: Re: [secdir] [Captive-portals] Secdir last call review of draft-ietf-capport-rfc7710bis-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Jun 2020 05:33:22 -0000 --Apple-Mail-D425A370-4584-4E44-8495-E3F818EE8E19 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Rifaat, Your comments make it clear that the recommendation to make the API server n= ame visible isn=E2=80=99t necessarily clear. I think it=E2=80=99s not a harm= ful thing to show, as a way to give troubleshooting information and transpar= ency to the user, but it is not a security-critical point. It seems appropriate to either explain the rationale more in depth, or remov= e that sentence entirely to avoid the misinterpretation. Do others in the CAPPORT group have thoughts on this sentence, and any backg= round on why we decided to go that way? Would there be any objections to rem= oving the sentence? Thanks, Tommy > On Jun 1, 2020, at 6:05 PM, Rifaat Shekh-Yusef w= rote: >=20 > =EF=BB=BF >=20 >=20 >> On Sun, May 31, 2020 at 2:07 AM Erik Kline wrote: >> On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef >> wrote: >> > >> > Adding SecDir back to this thread. >> > >> > >> > >Martin Thomson Tue, 19 May 2020 01:02 UTCShow head= er >> > > >> > >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote: >> > >> it provides the client of the API >> > >> an opportunity to authenticate the server that is hosting the API= . >> > >> This authentication is aimed at *allowing a user to be reasonably= >> > >> confident that the entity providing the Captive Portal API has a >> > >> valid certificate for the hostname in the URI* >> > >[...] >> > >> An end user should be able to validate that the name is example.com a= nd >> > >> not any other form of the URI. >> > >> It would be much more difficult for the end user to make sense and >> > >> validate an IP address. >> > > >> > >I think that you missed the point of my comments. This validation, pe= rformed by >> > >a user, has no meaningful security value. The text you cite says that= the server >> > >has a certificate for the name it chooses, which is not the same as "h= as a certificate >> > >for a name the client expects". The difference is important. >> > > >> > >> > This is not the way I read these statements from section 4.1 titled Ser= ver Authentication. >> > >> > Here is the use case I have in mind when I read this section: >> > If I walk into an airport and I see an ad for a paid Internet service f= rom example.com, then as an >> > end user it is reasonable to expect that I would have some ability to m= ake sense of the name >> > presented to me and make sure it is from example.com if I choose to get= such a service. >> > >> > If this is not the case, then yo might want to make it clear that this i= s not about Server Authentication >> > as the title of the section and the text inside that section is suggest= ing. >>=20 >> If we changed the API document's section 4.1 title from "Server >> Authentication" to "API Server Authentication", would that be more >> clear? >>=20 >> I reality, users should never see the API URL.=20 >=20 > The following is a quote from section 4.1 of the API document, which impli= es otherwise: > "The hostname of the API SHOULD be displayed to the user in order to indic= ate the entity which is providing the API service." > =20 > Regards, > Rifaat >=20 >=20 > =20 >> They'll just be >> connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs. If anything >> will only be one or both of the "user-portal-url" or "venue-info-url" >> URLs that might be visible in the browser that's opened for the user's >> interaction. >>=20 >> -ek >>=20 >> > Regards, >> > Rifaat >> > >> > >> > >> > >In a typical web scenario, a person types a string in and (ignore the c= ase where there >> > >is an extra hop via a search engine) that string determines what is ac= ceptable as a >> > >server identity. The exposure to confusables is limited (under a set o= f other assumptions, >> > >HSTS, etc...). Here, the network has free reign to do as they choose w= ith homoglyphs and >> > >other such nonsense. Any expectation you might have about this really= being a trustworthy >> > >entity is meaningless in this context. >> > > >> > >There are protections against this, but they all lie firmly in the ant= i-phishing domain. >> > >Most of those rely on having a certificate though, so the requirement f= or HTTPS is in >> > >service of that, not in terms of ensuring that an untrained human can m= ake a security >> > >critical decision based on poisoned information. >> > >> > On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef wrote: >> >> >> >> Adding Ben. >> >> >> >> >> >> On Sun, May 17, 2020 at 9:26 PM Martin Thomson wro= te: >> >>> >> >>> Adding more lists.. >> >>> >> >>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote: >> >>> > > Here is a quote form the API document: >> >>> > > "The hostname of the API SHOULD be displayed to the user in order= to indicate the entity which is providing the API service." >> >>> > > >> >>> > > This seems to suggest that the user is expected to inspect the di= splayed name and make sure it is make sense in the context of whoever is pro= viding that service. >> >>> >> >>> I don't think that is the case. If this were a security mechanism, t= hen it would use "MUST". This is likely for the purpose of enabling some so= rt of accountability. In other words, this is to offer maximal information a= bout what is going on. >> >>> >> >> Here is the sentence just before the above quote from the API document= : >> >> >> >> it provides the client of the API >> >> an opportunity to authenticate the server that is hosting the API. >> >> This authentication is aimed at allowing a user to be reasonably >> >> confident that the entity providing the Captive Portal API has a >> >> valid certificate for the hostname in the URI >> >> >> >> >> >> >> >> >> >>> >> >>> > > Since this would be an easier attack compared to the interception= attack, and IP address is still permitted, then an attacker might force the= use of IP address to make it harder for the user to make sense of the displ= ayed name. >> >>> >> >>> I don't think that is materially different than getting a name with c= onfusable characters (or using the prefix hack, example.com..exam= ple, in an attempt to confuse). >> >> >> >> >> >> An end user should be able to validate that the name is example.com an= d not any other form of the URI. >> >> It would be much more difficult for the end user to make sense and val= idate an IP address. >> >> >> >> Regards, >> >> Rifaat >> >> >> > _______________________________________________ >> > Captive-portals mailing list >> > Captive-portals@ietf.org >> > https://www.ietf.org/mailman/listinfo/captive-portals --Apple-Mail-D425A370-4584-4E44-8495-E3F818EE8E19 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Rifaat,

Your comments= make it clear that the recommendation to make the API server name visible i= sn=E2=80=99t necessarily clear. I think it=E2=80=99s not a harmful thing to s= how, as a way to give troubleshooting information and transparency to the us= er, but it is not a security-critical point.

It see= ms appropriate to either explain the rationale more in depth, or remove that= sentence entirely to avoid the misinterpretation.

= Do others in the CAPPORT group have thoughts on this sentence, and any backg= round on why we decided to go that way? Would there be any objections to rem= oving the sentence?

Thanks,
Tommy

On Jun 1, 2020, at 6:05 PM, Rifaa= t Shekh-Yusef <rifaat.s.ietf@gmail.com> wrote:

=EF=BB=BF


On Sun, May 31, 2020 at 2:07 AM Erik Kline <ek.ietf@gmail.com> wrote:
On Wed, May 20, 2020 at 4:37 AM Rifaa= t Shekh-Yusef
<rifaat.s.ie= tf@gmail.com> wrote:
>
> Adding SecDir back to this thread.
>
>
> >Martin Thomson <mt@lowentropy.net> Tue, 19 May 2020 01:02 UTCShow header
> >
> >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote:
> >>    it provides the client of the API
> >>    an opportunity to authenticate the server that is= hosting the API.
> >>    This authentication is aimed at *allowing a user t= o be reasonably
> >>    confident that the entity providing the Captive P= ortal API has a
> >>    valid certificate for the hostname in the URI* > >[...]
> >> An end user should be able to validate that the name is example.com and
> >> not any other form of the URI.
> >> It would be much more difficult for the end user to make sense= and
> >> validate an IP address.
> >
> >I think that you missed the point of my comments.  This valida= tion, performed by
> >a user, has no meaningful security value.  The text you cite s= ays that the server
> >has a certificate for the name it chooses, which is not the same as= "has a certificate
> >for a name the client expects".  The difference is important.<= br> > >
>
> This is not the way I read these statements from section 4.1 titled Ser= ver Authentication.
>
> Here is the use case I have in mind when I read this section:
> If I walk into an airport and I see an ad for a paid Internet service f= rom exam= ple.com, then as an
> end user it is reasonable to expect that I would have some ability to m= ake sense of the name
> presented to me and make sure it is from example.com if I choose to get suc= h a service.
>
> If this is not the case, then yo might want to make it clear that this i= s not about Server Authentication
> as the title of the section and the text inside that section is suggest= ing.

If we changed the API document's section 4.1 title from "Server
Authentication" to "API Server Authentication", would that be more
clear?

I reality, users should never see the API URL. 

The following is a quote from section 4.1 of the API document, whic= h implies otherwise:
"The hostname of the API SHOU= LD be displayed to the user in order to indicate the entity which is providi= ng the API service."
 
Regards,
 Rifaat


 
They'll just be
connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs.  If anything will only be one or both of the "user-portal-url" or "venue-info-url"
URLs that might be visible in the browser that's opened for the user's
interaction.

-ek

> Regards,
>  Rifaat
>
>
>
> >In a typical web scenario, a person types a string in and (ignore t= he case where there
> >is an extra hop via a search engine) that string determines what is= acceptable as a
> >server identity.  The exposure to confusables is limited (unde= r a set of other assumptions,
> >HSTS, etc...).  Here, the network has free reign to do as they= choose with homoglyphs and
> >other such nonsense.  Any expectation you might have about thi= s really being a trustworthy
> >entity is meaningless in this context.
> >
> >There are protections against this, but they all lie firmly in the a= nti-phishing domain.
> >Most of those rely on having a certificate though, so the requireme= nt for HTTPS is in
> >service of that, not in terms of ensuring that an untrained human c= an make a security
> >critical decision based on poisoned information.
>
> On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>= wrote:
>>
>> Adding Ben.
>>
>>
>> On Sun, May 17, 2020 at 9:26 PM Martin Thomson <mt@lowentropy.net> wrote:
>>>
>>> Adding more lists..
>>>
>>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote:
>>> > > Here is a quote form the API document:
>>> > > "The hostname of the API SHOULD be displayed to the u= ser in order to indicate the entity which is providing the API service."
= >>> > >
>>> > > This seems to suggest that the user is expected to in= spect the displayed name and make sure it is make sense in the context of wh= oever is providing that service.
>>>
>>> I don't think that is the case.  If this were a security m= echanism, then it would use "MUST".  This is likely for the purpose of e= nabling some sort of accountability.  In other words, this is to offer m= aximal information about what is going on.
>>>
>> Here is the sentence just before the above quote from the API docum= ent:
>>
>>    it provides the client of the API
>>    an opportunity to authenticate the server that is host= ing the API.
>>    This authentication is aimed at allowing a user to be r= easonably
>>    confident that the entity providing the Captive Portal= API has a
>>    valid certificate for the hostname in the URI
>>
>>
>>
>>
>>>
>>> > > Since this would be an easier attack compared to the i= nterception attack, and IP address is still permitted, then an attacker migh= t force the use of IP address to make it harder for the user to make sense o= f the displayed name.
>>>
>>> I don't think that is materially different than getting a name w= ith confusable characters (or using the prefix hack, example.com.<some-guid&g= t;.example, in an attempt to confuse).
>>
>>
>> An end user should be able to validate that the name is example.com and= not any other form of the URI.
>> It would be much more difficult for the end user to make sense and v= alidate an IP address.
>>
>> Regards,
>>  Rifaat
>>
> _______________________________________________
> Captive-portals mailing list
> Captive-p= ortals@ietf.org
> https://www.ietf.org/mailman/listinfo/captive= -portals
= --Apple-Mail-D425A370-4584-4E44-8495-E3F818EE8E19-- From nobody Wed Jun 3 09:51:53 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DBE93A0963; Wed, 3 Jun 2020 09:51:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VCZvD-DfiwtH; Wed, 3 Jun 2020 09:51:44 -0700 (PDT) Received: from NAM06-DM3-obe.outbound.protection.outlook.com (mail-eopbgr640108.outbound.protection.outlook.com [40.107.64.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 473F13A091C; Wed, 3 Jun 2020 09:51:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jvg1WbAkNi2+/TVyHDd7fVa0wzVBS4ub1sl6Rihsz5V0Sp0c+YEyOawf5+EXsJaBnoeW9hnnmwM9oGRnjwocIbueabgeqxvVUJA7ArnOXso9oztMQ2SF5C8TJOs8vkgWytZP5yBPsEpkzg9XxiJMbWog3mRZke2yQzN80er+NLA7RcmPG9gX+zDBu0kayinF9YzX6eN4lDIZOVjOrpsfwWL+mPR59cG7juPEnNQ4BBS9q8sDLVoHRZS+wcqGUHp3ygF5CBt45UEepeKGQqBTzA72PiT3AKovzXVSouhdqXYEbekSNm92HS17clKmmjkFnTSJowW7dF9+C0P10X+3Zg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Zk8MOzPUIALS04cQarCgPhWaUeVvkxuxcR+4qRTeGX0=; b=DJxjQHVkgbq9Lqws0mpTA0zFWlxt1BtzZlHWvrslhg+wfWyqgRYxCq/kizj2I48RL/w2WqWQy9y4o6zUNivb4YzjZ5wBSaDTyMMl9abakfRDscGfExuUnwtzXBpedF/Fr+R/EnLhQoKCCiIjmtDCfiMy9K2Uy0teFUCEo7uMvPM1tXwhedz+kUne4V0tE2/svL7uxU2v+miOfRU0UJloi/GmlL7P8DUO0XpG9iK/R5AcQF9M95bAxRHmyx/v/tuEJptIWrQBYo94XwuQsO607V3nqaHEG1OXCNgy8qLczqa0aJUWnQkCBsAEShwHOoXa7hLSG9xkM//8ydP9j3/vTw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Zk8MOzPUIALS04cQarCgPhWaUeVvkxuxcR+4qRTeGX0=; b=AGPIDwOoFjV52bbYJhgo7/Cl1dhxk8mIL+QSyRMzF1a7Rou7baSrw+jCTiaHPug471c7H28RmOhUnVkePM7xCNz+7+EGZPkLjM5/+UdGUHjoDch/BpYy7NfyoRh1z6naz61Y47HAhR1iw5dTo1EUJQLWzRp0af9ALkaJo8nocgQ= Received: from MN2PR00MB0688.namprd00.prod.outlook.com (2603:10b6:208:199::23) by BL0PR00MB0307.namprd00.prod.outlook.com (2603:10b6:207:1e::33) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3104.0; Wed, 3 Jun 2020 16:51:34 +0000 Received: from MN2PR00MB0688.namprd00.prod.outlook.com ([fe80::c1e4:c91b:f4de:f548]) by MN2PR00MB0688.namprd00.prod.outlook.com ([fe80::c1e4:c91b:f4de:f548%5]) with mapi id 15.20.3107.000; Wed, 3 Jun 2020 16:51:34 +0000 From: Mike Jones To: Linda Dunbar , "Matthew A. Miller" , "secdir@ietf.org" CC: "cose@ietf.org" , "draft-ietf-cose-webauthn-algorithms.all@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 Thread-Index: AQHWNIYAZ9wJpsSs30mTfNXJra/es6jHJQSg Date: Wed, 3 Jun 2020 16:51:34 +0000 Message-ID: References: <159053708200.16306.10159573848968846851@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=efc2d60a-0ed4-43b6-8f8a-000013c750c0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-06-03T16:50:06Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: futurewei.com; dkim=none (message not signed) header.d=none;futurewei.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 8368a755-352a-46cc-8ca1-08d807de600c x-ms-traffictypediagnostic: BL0PR00MB0307: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-forefront-prvs: 04238CD941 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: aF4Jlsx6NScYqaiFYiaqum7yW39WcmlLUExDLGYIRgjyyrqwofo0Ehtc2Svk30vxbpHBMqwbz4wzAog95+8bPKP8fvZSvPzkYU9y3/QvcsE518SKvo4ab6r48wmzyr/EmBNraFUU7zUsM29VjY8QdlEEubiw9f4W2fh12B+FT1+zA+teuxIFYaLF+3F//atCHhrzYEK1QEzkQx/nlFipRzIeypjV/EBS+KSWOMESejUQICQm7HD03TKm3opFhD72UMyCJROBYT7bgxgoTxIQ3uL9aFRrUiyN2sfkkCT4XIzKYd8cmuaSpUuvT6itPRm7K1g01qlqf1vcPKpyg/Z+o8FQoFDYMWV1uVnBvjk3GwcHpXC6A7p/YQ/UVwAmMdwTLdHfLlLLWM3b+jq6UtUVng== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR00MB0688.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(39860400002)(136003)(346002)(396003)(376002)(366004)(2906002)(33656002)(966005)(66446008)(66556008)(76116006)(86362001)(64756008)(8936002)(10290500003)(478600001)(66946007)(8676002)(316002)(66476007)(83380400001)(110136005)(54906003)(9686003)(82950400001)(82960400001)(7696005)(52536014)(5660300002)(55016002)(186003)(71200400001)(4326008)(8990500004)(53546011)(26005)(6506007); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: JahTPlw/n9e+uPfBVeFnEKjFtajEs6MQ8Z1M/2JGh67oRW8MrjTNhgqO3R2tl4xZHoXqNQmnjbPfAHhGcBeI8AXpYTCePsVSvc+vyazU+vq81BwOrBWf3qyhPKDBw2k0zT0tLf9MppCEBJIutMl+T39oj5Y2ChfAP76sKGzWB2KIa4g8dkEL9YYpkLH1mEZc9adaRz9N+EOHmT7VzGszKa6S1Xq0Yxyso4wjjD9l+GHMlAFEVYC0zCJ6bMKVOtDs3bR4AHFvyF3Y8i9fR53IbrBtDMvGAeT8a7oYNj+lWlsfgIi5TgNxpVT8sknrzJpdjSz630qS0y53yd4+UqYS/ZwvwaRnqQGkNrGChvPI/1IjPbWTFDUioVAowsE5muypt0jBc3hf6UXxu2jnHiYHBkF610YbtTiFxXP/viHDS2MSPo60uphB2vFGE4mfrCxD1HJ50qfPwM2UITlNXfw5ABzv0rXLX2rngU9bG3TTYDI= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 8368a755-352a-46cc-8ca1-08d807de600c X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jun 2020 16:51:34.6851 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: tC5yx/qMigw/yPCbXEI6MMrQ2voeMIPBnVZw+TE6HRCSTq+uP6hqT/UiMJ+7Iyl5axgOmKXIdrY6D8H33ZFlFg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0307 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jun 2020 16:51:46 -0000 VGhhbmtzIGFnYWluIGZvciB5b3VyIHJldmlldywgTGluZGEuICBodHRwczovL3Rvb2xzLmlldGYu b3JnL2h0bWwvZHJhZnQtaWV0Zi1jb3NlLXdlYmF1dGhuLWFsZ29yaXRobXMtMDcjc2VjdGlvbi01 LjIgYWRkcyB0aGUgcmVxdWVzdGVkIGNsYXJpZmljYXRpb24gdGhhdCBTSEEtMjU2LCBTSEEtMzg0 LCBhbmQgU0hBLTUxMiBhcmUgdGhlIFNIQS0yIGhhc2ggZnVuY3Rpb25zLg0KDQoJCQkJLS0gTWlr ZQ0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogTGluZGEgRHVuYmFyIDxsaW5k YS5kdW5iYXJAZnV0dXJld2VpLmNvbT4gDQpTZW50OiBXZWRuZXNkYXksIE1heSAyNywgMjAyMCA1 OjIyIFBNDQpUbzogTWF0dGhldyBBLiBNaWxsZXIgPGxpbnV4d29sZitpZXRmQG91dGVyLXBsYW5l cy5uZXQ+OyBzZWNkaXJAaWV0Zi5vcmcNCkNjOiBjb3NlQGlldGYub3JnOyBkcmFmdC1pZXRmLWNv c2Utd2ViYXV0aG4tYWxnb3JpdGhtcy5hbGxAaWV0Zi5vcmc7IGxhc3QtY2FsbEBpZXRmLm9yZw0K U3ViamVjdDogW0VYVEVSTkFMXSBSRTogU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YgZHJhZnQt aWV0Zi1jb3NlLXdlYmF1dGhuLWFsZ29yaXRobXMtMDYNCg0KTWF0dGhldywgDQoNClRoYXQgaXMg d2hhdCBJIHdhcyB0aGlua2luZy4gQ2FuIHlvdSBhZGQgYSBzZW50ZW5jZSBpbiBTZWN0aW9uIDUu MiB0byBzYXkgdGhhdCB0aGlzIGlzIGZvciB0aGUgY29sbGVjdGlvbiBvZiBTSEEtMjU2LCBTSEEt Mzg0LCBTSEEtNTEyIGFsZ29yaXRobXM/IA0KT3RoZXJ3aXNlLCB0aGUgdHdvIHNlY3Rpb25zIG9m IHRoZSBkb2N1bWVudCBkb24ndCAgbWF0Y2guIA0KDQpUaGFuayB5b3UNCkxpbmRhIER1bmJhcg0K DQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogTWF0dGhldyBBLiBNaWxsZXIgPGxp bnV4d29sZitpZXRmQG91dGVyLXBsYW5lcy5uZXQ+DQpTZW50OiBXZWRuZXNkYXksIE1heSAyNywg MjAyMCA0OjU1IFBNDQpUbzogTGluZGEgRHVuYmFyIDxsaW5kYS5kdW5iYXJAZnV0dXJld2VpLmNv bT47IHNlY2RpckBpZXRmLm9yZw0KQ2M6IGNvc2VAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtY29zZS13 ZWJhdXRobi1hbGdvcml0aG1zLmFsbEBpZXRmLm9yZzsgbGFzdC1jYWxsQGlldGYub3JnDQpTdWJq ZWN0OiBSZTogU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1jb3NlLXdlYmF1 dGhuLWFsZ29yaXRobXMtMDYNCg0KSGVsbG8gTGluZGEsDQoNClRoYW5rcyBmb3IgdGhlIHJldmll dy4gIFNwZWFraW5nIG9uIHRoZSBhdXRob3IncyBiZWhhbGYsIFNIQS0yIGlzIGRlZmluZWQgYXMg dGhlIGNvbGxlY3Rpb24gb2YgaGFzaCBhbGdvcml0aG1zLCBpbmNsdWRpbmcgYWxsIG9mIHRob3Nl IGNpdGVkIChTSEEtMjU2LCBTSEEtMzg0LCBTSEEtNTEyKS4gIERvIHlvdSBiZWxpZXZlIGl0IGlz IGNyaXRpY2FsIHRvIGNhbGwgdGhpcyBvdXQgZXhwbGljaXRseT8NCg0KDQotIG0mbQ0KDQpNYXR0 aGV3IEEuIE1pbGxlcg0KT24gMjAvMDUvMjYgMTc6NTEsIExpbmRhIER1bmJhciB2aWEgRGF0YXRy YWNrZXIgd3JvdGU6DQo+IFJldmlld2VyOiBMaW5kYSBEdW5iYXINCj4gUmV2aWV3IHJlc3VsdDog Tm90IFJlYWR5DQo+IA0KPiBJIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9m IHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdzIA0KPiBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcg YWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUgDQo+IElFU0cuICBUaGVz ZSBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUg c2VjdXJpdHkgYXJlYSBkaXJlY3RvcnMuDQo+ICBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFp cnMgc2hvdWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSANCj4gYW55IG90aGVyICBs YXN0IGNhbGwgY29tbWVudHMuDQo+IA0KPiBUaGlzIGRvY3VtZW50IGlzIHRvIGxpc3QgZG93biB0 aGUgQ09TRSZKT1NFIEFsZ29yaXRobXMgdG8gYmUgDQo+IHJlZ2lzdGVyZWQgdG8gSUFOQS4gQnV0 IGl0IHNlZW1zIHRoZSBkZXNjcmlwdGlvbiBpcyBub3QgY29tcGxldGUuIEluIA0KPiB0aGUgU2Vj dGlvbiAyOiBhbW9uZyB0aGUNCj4gNCBhbGdvcml0aG1zIGxpc3RlZCB1bmRlciBSU0FTU0EtUEtD UzEtdjFfNSwgdGhyZWUgYXJlIE5PVCANCj4gcmVjb21tZW5kZWQsIG9uZSBpcyBkZXByZWNhdGVk LiBVbmRlciB0aGUgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbiANCj4gKFNlY3Rpb24gNSksIFNlY3Rp b24gNS4yIGRlc2NyaWJlcyB3aHkgU0hBLTIgaXMgIk5vdCBSZWNvbW1lbmRlZCIsIA0KPiBTZWN0 aW9uIDUuMyBkZXNjcmliZXMgd2h5IFNIQS0xIGlzICJEZXByZWNhdGVkIi4gIFdoYXQgYWJvdXQg dGhlIA0KPiBkZXNjcmlwdGlvbiBvbiB3aHkgU0hBLTUxMiwgIFNIQS0zODQsIGFuZCBTSEEtMjU2 IGFyZSBub3QgcmVjb21tZW5kZWQ/ICBJcyB0aGUgbWlzc2luZyBkZXNjcmlwdGlvbiBpbnRlbmRl ZD8NCj4gDQo+IEJlc3QgUmVnYXJkcywNCj4gDQo+IExpbmRhIER1bmJhcg0KPiANCj4gDQo+IA0K From nobody Wed Jun 3 12:49:12 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5D763A0EE1; Wed, 3 Jun 2020 12:49:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.09 X-Spam-Level: X-Spam-Status: No, score=-2.09 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=futurewei.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y9-6Idoai1B2; Wed, 3 Jun 2020 12:48:59 -0700 (PDT) Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2102.outbound.protection.outlook.com [40.107.92.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F30FE3A0EE0; Wed, 3 Jun 2020 12:48:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=QxWpiNrTLDLbtUrmA4ye5eGe6lCwGxl035MNnhOMIQjgeOoyKGkYQZsixd9u4CIyyzjTh+bpP+6NVaCMDqHt3qYt673DwYFl/veicRpJc7aVteVS1syFg4FEy4rdy2iPkreSLitdpIY85LUqrhW4ochKGgRPC3S+SdiABjBDOpOCLxO1/ftoXY68EN+nYx3BN58wDiqJxA322JcRSwIl+bjm7O0C/4OAIxKtSkKrSL01ln4V8LOer4ASFwOuNj2rcNJGT8p4nDKvQIZ/IepYdJo8GuVNdBeQUlbHpOCnUdQoUzbjf+Zt7qAyS2S6NMIRsykK7Siis0gWkJY5c/7MMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pkvndGe5dNzAFO4eDi1s75MdfMwfNOsye2WOzNLnKXs=; b=csVkpiXYZ8+tqm5q1VhQeYxgWBKLd+yY4AaolBIIKzzH6jTIZIPShxJGFyl19PkO6HoiESUYeaADvHdejGBzITtcnwCCgTkL4U+vtmZsJm09irDDfpL+wQQM0UZtrU3aefngNzfXa/yaoemOZLnhlHMOw/GG3LhrPOF9W5Ab9e7LXrlU8+zAT9iJxelTRYpWIS5njD4GzhuAnSah0OwvwPOTuw1l6kZEPfteiirnyXBW5e1vp8+zTDZI8RgW2VSrbBY2izikD6Bd9shi9G4Ot9QMN0FFeoQ+kSgI7YyEHpcvlDf1ym/P9RFKhcarQ6XsyFi4oaqJr6AIYGhf5Bw2sQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=futurewei.com; dmarc=pass action=none header.from=futurewei.com; dkim=pass header.d=futurewei.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Futurewei.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pkvndGe5dNzAFO4eDi1s75MdfMwfNOsye2WOzNLnKXs=; b=lIRRvmJRsiyMRwVm+d7L7b03jXXzA+erJDhs5nggahSFCt0inzqXPlBck0dHqYq/a+WBcMdbPhUGuZ6B3GdtTTGyThOPeTHK1UUB2gmgbL22XhPtbIE7VSG7ax8toU8iHT71biJw+GYKnNlzLXmvI3i3/cXk3m6pEJTURIqKdD8= Received: from DM6PR13MB2330.namprd13.prod.outlook.com (2603:10b6:5:cc::16) by DM6PR13MB2874.namprd13.prod.outlook.com (2603:10b6:5:144::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3066.12; Wed, 3 Jun 2020 19:48:56 +0000 Received: from DM6PR13MB2330.namprd13.prod.outlook.com ([fe80::95a6:b46f:dc31:3fdd]) by DM6PR13MB2330.namprd13.prod.outlook.com ([fe80::95a6:b46f:dc31:3fdd%7]) with mapi id 15.20.3045.024; Wed, 3 Jun 2020 19:48:56 +0000 From: Linda Dunbar To: Mike Jones , "Matthew A. Miller" , "secdir@ietf.org" CC: "cose@ietf.org" , "draft-ietf-cose-webauthn-algorithms.all@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 Thread-Index: AQHWNHF88QTcU9SYR0Gbkbt6ssDowai8okawgAqDUQCAADFioA== Date: Wed, 3 Jun 2020 19:48:56 +0000 Message-ID: References: <159053708200.16306.10159573848968846851@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=efc2d60a-0ed4-43b6-8f8a-000013c750c0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-06-03T16:50:06Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: microsoft.com; dkim=none (message not signed) header.d=none;microsoft.com; dmarc=none action=none header.from=futurewei.com; x-originating-ip: [72.180.73.64] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 01afa5be-88d5-4943-b2c8-08d807f726e8 x-ms-traffictypediagnostic: DM6PR13MB2874: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:7219; x-forefront-prvs: 04238CD941 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: bRhi0Bbd/N+/DXK/elaq2duyZMSKsiWtDda8vg960Pn95TfVoqmBqwkUMx4bXl0NM5tvoXUdw63QrZcgJ+yzN4338CL89b8lo1L0wYT9TKrYBlMI2BG3uLsMxjjtVLai6hVVoaz4OE9FBK5W8Tetn8W+5WbGddY1Tn709uRWvN0VM7ts7L0B+Iu9UXEVoyIfUx5Up+gsaxHTqTDBmSvTi9KNSMmUVz5JUZaRILmv2qMd5aZWY7/LFcKRmVMoSCEcHyJyF8CJw/9qUDer/n7vz7oQU6id7jfPCPx75xMURmbcfQRil5QBCpbQUeQfxqZODgMusyRb94RdQ7h0KJgGsxlfjImrpwG9iKGwH4DYfF1yLoIDNkHvEThjuJzEPU8I3jf9Rk5/9+X4hWHMsR2DTw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR13MB2330.namprd13.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(396003)(376002)(346002)(366004)(136003)(39850400004)(55016002)(2906002)(9686003)(8676002)(86362001)(64756008)(966005)(71200400001)(83380400001)(45080400002)(7696005)(66476007)(66446008)(44832011)(66946007)(66556008)(5660300002)(8936002)(316002)(6506007)(478600001)(33656002)(54906003)(110136005)(26005)(53546011)(186003)(52536014)(76116006)(4326008); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: WER4U6aAKRAOsTNPApORATawod+jbsKBR6Z4NDc4cyuva4s3xmgfMTDKK7qhclUHfnfMBTHmJKYdoi+SWdMIX91IWR0J64RcjHumnfPCGRqP8vkfrjMMJFTXAtqb2VxSVqHiO5TJn6sm9jm+0nh/k8bDaeYUP/obw0CQkOWoPjmpAgoKQ7VCBQ+cqdqNAI2YYNHR4WLwm8V/p+quHdjV6FCOHvqLfDYzuz6pVMtnD1m5FtuitMVuq+RjjiRsC/q2lpfBZpCk7TII8RwXh4CGBTGpFll+qR626WpysxGftEHljyI3wcP/XcC2Wn7DHf3fzKf9nPfVm7j4/id6A22rlCvpB7aEawNt7mZJ70edzfB8brQoV3hewWlYg/2QJ6+HoPcSwuxj7rNyzEEd85MGAgWfoC8WGPSDhrwpgFNjn/hlMK0kEYdmYgZ0ctoMQLtmlGNqAqldLyqVfDSrWNaYgL0ioUjKfpsmL1kBhpmoA8c= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: Futurewei.com X-MS-Exchange-CrossTenant-Network-Message-Id: 01afa5be-88d5-4943-b2c8-08d807f726e8 X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Jun 2020 19:48:56.3276 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 0fee8ff2-a3b2-4018-9c75-3a1d5591fedc X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: vrTTdsVEMucKhZoPj5tWGjfrKjCe8z/SH11fC/sEYSSYhHOJ/TpFQep4xkaz5yHsbggG0i9751WnzoV/88Ue2g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR13MB2874 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jun 2020 19:49:01 -0000 TWlrZSwNCg0KVGhhbmsgeW91IGZvciB0aGUgY2hhbmdlLg0KDQpMaW5kYQ0KDQotLS0tLU9yaWdp bmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogTWlrZSBKb25lcyA8TWljaGFlbC5Kb25lc0BtaWNyb3Nv ZnQuY29tPiANClNlbnQ6IFdlZG5lc2RheSwgSnVuZSAzLCAyMDIwIDExOjUyIEFNDQpUbzogTGlu ZGEgRHVuYmFyIDxsaW5kYS5kdW5iYXJAZnV0dXJld2VpLmNvbT47IE1hdHRoZXcgQS4gTWlsbGVy IDxsaW51eHdvbGYraWV0ZkBvdXRlci1wbGFuZXMubmV0Pjsgc2VjZGlyQGlldGYub3JnDQpDYzog Y29zZUBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1jb3NlLXdlYmF1dGhuLWFsZ29yaXRobXMuYWxsQGll dGYub3JnOyBsYXN0LWNhbGxAaWV0Zi5vcmcNClN1YmplY3Q6IFJFOiBTZWNkaXIgbGFzdCBjYWxs IHJldmlldyBvZiBkcmFmdC1pZXRmLWNvc2Utd2ViYXV0aG4tYWxnb3JpdGhtcy0wNg0KDQpUaGFu a3MgYWdhaW4gZm9yIHlvdXIgcmV2aWV3LCBMaW5kYS4gIGh0dHBzOi8vbmFtMTEuc2FmZWxpbmtz LnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnRvb2xzLmlldGYub3Jn JTJGaHRtbCUyRmRyYWZ0LWlldGYtY29zZS13ZWJhdXRobi1hbGdvcml0aG1zLTA3JTIzc2VjdGlv bi01LjImYW1wO2RhdGE9MDIlN0MwMSU3Q2xpbmRhLmR1bmJhciU0MGZ1dHVyZXdlaS5jb20lN0M0 MDI1ZDM4ODg0YWU0ZDFhOWE1YjA4ZDgwN2RlNjU2MiU3QzBmZWU4ZmYyYTNiMjQwMTg5Yzc1M2Ex ZDU1OTFmZWRjJTdDMSU3QzElN0M2MzcyNjc5OTkwNDg2MzUzMjgmYW1wO3NkYXRhPW9Hc2Fmazgw ZkFGeGdmTWZ4M3dVUHdsclZleGpHeVZ2c0hEWmZyS2RweW8lM0QmYW1wO3Jlc2VydmVkPTAgYWRk cyB0aGUgcmVxdWVzdGVkIGNsYXJpZmljYXRpb24gdGhhdCBTSEEtMjU2LCBTSEEtMzg0LCBhbmQg U0hBLTUxMiBhcmUgdGhlIFNIQS0yIGhhc2ggZnVuY3Rpb25zLg0KDQoJCQkJLS0gTWlrZQ0KDQot LS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogTGluZGEgRHVuYmFyIDxsaW5kYS5kdW5i YXJAZnV0dXJld2VpLmNvbT4NClNlbnQ6IFdlZG5lc2RheSwgTWF5IDI3LCAyMDIwIDU6MjIgUE0N ClRvOiBNYXR0aGV3IEEuIE1pbGxlciA8bGludXh3b2xmK2lldGZAb3V0ZXItcGxhbmVzLm5ldD47 IHNlY2RpckBpZXRmLm9yZw0KQ2M6IGNvc2VAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtY29zZS13ZWJh dXRobi1hbGdvcml0aG1zLmFsbEBpZXRmLm9yZzsgbGFzdC1jYWxsQGlldGYub3JnDQpTdWJqZWN0 OiBbRVhURVJOQUxdIFJFOiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLWNv c2Utd2ViYXV0aG4tYWxnb3JpdGhtcy0wNg0KDQpNYXR0aGV3LCANCg0KVGhhdCBpcyB3aGF0IEkg d2FzIHRoaW5raW5nLiBDYW4geW91IGFkZCBhIHNlbnRlbmNlIGluIFNlY3Rpb24gNS4yIHRvIHNh eSB0aGF0IHRoaXMgaXMgZm9yIHRoZSBjb2xsZWN0aW9uIG9mIFNIQS0yNTYsIFNIQS0zODQsIFNI QS01MTIgYWxnb3JpdGhtcz8gDQpPdGhlcndpc2UsIHRoZSB0d28gc2VjdGlvbnMgb2YgdGhlIGRv Y3VtZW50IGRvbid0ICBtYXRjaC4gDQoNClRoYW5rIHlvdQ0KTGluZGEgRHVuYmFyDQoNCi0tLS0t T3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBNYXR0aGV3IEEuIE1pbGxlciA8bGludXh3b2xm K2lldGZAb3V0ZXItcGxhbmVzLm5ldD4NClNlbnQ6IFdlZG5lc2RheSwgTWF5IDI3LCAyMDIwIDQ6 NTUgUE0NClRvOiBMaW5kYSBEdW5iYXIgPGxpbmRhLmR1bmJhckBmdXR1cmV3ZWkuY29tPjsgc2Vj ZGlyQGlldGYub3JnDQpDYzogY29zZUBpZXRmLm9yZzsgZHJhZnQtaWV0Zi1jb3NlLXdlYmF1dGhu LWFsZ29yaXRobXMuYWxsQGlldGYub3JnOyBsYXN0LWNhbGxAaWV0Zi5vcmcNClN1YmplY3Q6IFJl OiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLWNvc2Utd2ViYXV0aG4tYWxn b3JpdGhtcy0wNg0KDQpIZWxsbyBMaW5kYSwNCg0KVGhhbmtzIGZvciB0aGUgcmV2aWV3LiAgU3Bl YWtpbmcgb24gdGhlIGF1dGhvcidzIGJlaGFsZiwgU0hBLTIgaXMgZGVmaW5lZCBhcyB0aGUgY29s bGVjdGlvbiBvZiBoYXNoIGFsZ29yaXRobXMsIGluY2x1ZGluZyBhbGwgb2YgdGhvc2UgY2l0ZWQg KFNIQS0yNTYsIFNIQS0zODQsIFNIQS01MTIpLiAgRG8geW91IGJlbGlldmUgaXQgaXMgY3JpdGlj YWwgdG8gY2FsbCB0aGlzIG91dCBleHBsaWNpdGx5Pw0KDQoNCi0gbSZtDQoNCk1hdHRoZXcgQS4g TWlsbGVyDQpPbiAyMC8wNS8yNiAxNzo1MSwgTGluZGEgRHVuYmFyIHZpYSBEYXRhdHJhY2tlciB3 cm90ZToNCj4gUmV2aWV3ZXI6IExpbmRhIER1bmJhcg0KPiBSZXZpZXcgcmVzdWx0OiBOb3QgUmVh ZHkNCj4gDQo+IEkgaGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNl Y3VyaXR5IGRpcmVjdG9yYXRlJ3MgDQo+IG9uZ29pbmcgZWZmb3J0IHRvIHJldmlldyBhbGwgSUVU RiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSANCj4gSUVTRy4gIFRoZXNlIGNvbW1l bnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5lZml0IG9mIHRoZSBzZWN1cml0 eSBhcmVhIGRpcmVjdG9ycy4NCj4gIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91 bGQgdHJlYXQgdGhlc2UgY29tbWVudHMganVzdCBsaWtlIA0KPiBhbnkgb3RoZXIgIGxhc3QgY2Fs bCBjb21tZW50cy4NCj4gDQo+IFRoaXMgZG9jdW1lbnQgaXMgdG8gbGlzdCBkb3duIHRoZSBDT1NF JkpPU0UgQWxnb3JpdGhtcyB0byBiZSANCj4gcmVnaXN0ZXJlZCB0byBJQU5BLiBCdXQgaXQgc2Vl bXMgdGhlIGRlc2NyaXB0aW9uIGlzIG5vdCBjb21wbGV0ZS4gSW4gDQo+IHRoZSBTZWN0aW9uIDI6 IGFtb25nIHRoZQ0KPiA0IGFsZ29yaXRobXMgbGlzdGVkIHVuZGVyIFJTQVNTQS1QS0NTMS12MV81 LCB0aHJlZSBhcmUgTk9UIA0KPiByZWNvbW1lbmRlZCwgb25lIGlzIGRlcHJlY2F0ZWQuIFVuZGVy IHRoZSBTZWN1cml0eSBDb25zaWRlcmF0aW9uIA0KPiAoU2VjdGlvbiA1KSwgU2VjdGlvbiA1LjIg ZGVzY3JpYmVzIHdoeSBTSEEtMiBpcyAiTm90IFJlY29tbWVuZGVkIiwgDQo+IFNlY3Rpb24gNS4z IGRlc2NyaWJlcyB3aHkgU0hBLTEgaXMgIkRlcHJlY2F0ZWQiLiAgV2hhdCBhYm91dCB0aGUgDQo+ IGRlc2NyaXB0aW9uIG9uIHdoeSBTSEEtNTEyLCAgU0hBLTM4NCwgYW5kIFNIQS0yNTYgYXJlIG5v dCByZWNvbW1lbmRlZD8gIElzIHRoZSBtaXNzaW5nIGRlc2NyaXB0aW9uIGludGVuZGVkPw0KPiAN Cj4gQmVzdCBSZWdhcmRzLA0KPiANCj4gTGluZGEgRHVuYmFyDQo+IA0KPiANCj4gDQo= From nobody Thu Jun 4 05:20:35 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 960B83A0C0B for ; Thu, 4 Jun 2020 05:20:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.1.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <159127323113.2358.7025012427892910047@ietfa.amsl.com> Date: Thu, 04 Jun 2020 05:20:31 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 04 Jun 2020 12:20:34 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-06-11 Reviewer LC end Draft Derek Atkins 2020-05-29 draft-ietf-cose-rfc8152bis-struct-10 Sean Turner 2020-05-19 draft-ietf-dhc-mac-assign-07 Brian Weis 2020-05-26 draft-ietf-cose-hash-algs-04 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-08 Last calls: Reviewer LC end Draft Derek Atkins 2020-05-29 draft-ietf-cose-rfc8152bis-struct-10 John Bradley 2020-02-28 draft-ietf-regext-data-escrow-10 Shaun Cooley 2020-05-29 draft-ietf-ospf-te-link-attr-reuse-12 Alan DeKok 2020-05-29 draft-ietf-isis-te-app-13 Donald Eastlake R2019-11-14 draft-ietf-hip-dex-20 Donald Eastlake 2020-02-27 draft-ietf-6tisch-msf-16 Shawn Emery 2020-06-15 draft-ietf-dots-signal-filter-control-04 Stephen Farrell 2020-06-15 draft-ietf-pim-igmp-mld-snooping-yang-12 Daniel Franke 2020-06-15 draft-ietf-ntp-mode-6-cmds-08 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-08 Daniel Gillmor 2020-06-12 draft-ietf-pce-stateful-pce-lsp-scheduling-13 Phillip Hallam-Baker 2020-06-11 draft-ietf-dots-use-cases-23 Dan Harkins None draft-ietf-rtgwg-policy-model-03 Russ Mundy 2020-01-02 draft-ietf-dprive-bcp-op-09 Magnus Nystrom 2019-04-10 draft-ietf-avtcore-multiplex-guidelines-11 Vincent Roca 2020-04-23 draft-ietf-detnet-ip-over-mpls-06 Stefan Santesson 2020-05-04 draft-ietf-httpbis-header-structure-19 Melinda Shore 2020-05-13 draft-ietf-secevent-http-poll-09 Tina Tsou 2020-05-08 draft-ietf-httpbis-client-hints-14 Sean Turner 2020-05-06 draft-ietf-opsawg-sdi-02 Sean Turner 2020-05-19 draft-ietf-dhc-mac-assign-07 Samuel Weiler 2020-06-11 draft-ietf-trill-multilevel-single-nickname-09 Brian Weis 2020-05-26 draft-ietf-cose-hash-algs-04 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-08 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-08 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Early review requests: Reviewer Due Draft Steve Hanna 2020-06-30 draft-ietf-emu-eap-noob-01 Next in the reviewer rotation: Russ Housley Christian Huitema Leif Johansson Charlie Kaufman Scott Kelly Tero Kivinen Watson Ladd Chris Lonvick Aanchal Malhotra David Mandelberg From nobody Fri Jun 5 15:14:25 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10F023A0EB2; Fri, 5 Jun 2020 15:14:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hEN8-h7x38FW; Fri, 5 Jun 2020 15:14:16 -0700 (PDT) Received: from mail-ej1-x62c.google.com (mail-ej1-x62c.google.com [IPv6:2a00:1450:4864:20::62c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F7FD3A0EB0; Fri, 5 Jun 2020 15:14:16 -0700 (PDT) Received: by mail-ej1-x62c.google.com with SMTP id y13so11740214eju.2; Fri, 05 Jun 2020 15:14:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=J+1bgpTWM6+yQOrJ8lQZWCKA2bSDkNLr5BlpmpjK2kM=; b=ayo7FGq2ddFtX5qQmTrrq3Sn1olLpLzUTdCJtXFTUUqZEALY72sg2hYVkPz3JPo1qo kyzCNqdmJeIIvbwaag2E5rVS4GSW5i7DKG7xZJ6ilcwsW1aSGT4XbdmcTXbWbzo9oX7M 2Ku4bZlLv0RPCQ9W/dPpnimCQpgGEarewhjhusL7/ZsJwg63p7YhZqDZhmE3BwYHhePW tixQc6yD1pqHhednGbimkAi0W/bl4Fl0iuTqKHLQyGKfm7aaEG5U007FZBvXmS5V+de2 vUBCQEZrw6AUTP/59CgmghHqE5tgnuDiJXEl1pciUF0f/26G230Wb8m/TyDujf5tqKMD 8P4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=J+1bgpTWM6+yQOrJ8lQZWCKA2bSDkNLr5BlpmpjK2kM=; b=m119Bh8I7OpkewvPiwGjmR6ErFSv2BEPsuqrlma4dGn7aVT4EiAIXY78rHnEf1J++j E6JhCddPpUtxWMqptOWu4D+p+4rUzCtlWj1b6lfFFKHlGSpwImA1RzRWGwkNBjqfEBUE xLb5gMv8CJENEcMNFwf6OUK6Ay6Y9x7zoXVt3GgBbNIy4jgQWlm9JrN5HbUj1u6WkMb8 86u9qHYJQ/pkpU8AUWWt6fn61dECrq4gQUXtR/ZYF5e6YwVHIfRc8UUwufmxMfuNpCnH tzgJCDpTDdeg3wIgVPkbsIlPs0WO2l6+L755ulHqJV+t8gbU/nXe640NswVvLUkx8CqV gcPA== X-Gm-Message-State: AOAM532c9N9hVv/C5An339Izes+b6SnjqmAASAxoT/VS4Ri1BdRycD12 FSBvXc/SZbArlMJEhmoFznWbmHCUcF8YCFNIIMGwEBUBdX0= X-Google-Smtp-Source: ABdhPJwIDKUmkCbqNkDtH5nfkzT/PwFuUR4e5DeGdlzhU+nFS/L0yxlhrbBAxVqRou3ZPiK9KsMXxDj7RN5XQTbifUY= X-Received: by 2002:a17:907:33ce:: with SMTP id zk14mr10600373ejb.2.1591395254614; Fri, 05 Jun 2020 15:14:14 -0700 (PDT) MIME-Version: 1.0 From: Shawn Emery Date: Fri, 5 Jun 2020 16:14:02 -0600 Message-ID: To: secdir Cc: draft-ietf-dots-signal-filter-control.all@ietf.org, last-call@ietf.org, Shawn Emery Content-Type: multipart/alternative; boundary="000000000000d93f0805a75d94b6" Archived-At: Subject: [secdir] Review of draft-ietf-dots-signal-filter-control-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 Jun 2020 22:14:18 -0000 --000000000000d93f0805a75d94b6 Content-Type: text/plain; charset="UTF-8" Reviewer: Shawn M. Emery Review result: Ready with nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This draft specifies a filter control through the Distributed Denial-of-Service Open Threat Signaling (DOTS) signal channel rather than through the data channel, given that an active DDoS attack would essentially disable the data channel. The assumption is that the filter rules would have been constructed and distributed during idle time, before the attack. The security considerations section does exist and the defers to the base RFCs, 8782 and 8783, for confidentiality and integrity requirements. The draft continues that the filtering rules should be constructed before any attack through the data channel. The section finishes with an attack by using the control filter to make a DDoS worse and recommends mitigation through operators monitoring and countering malicious behavior. They describe this as only a variation of the attacks outlined in 8782 and 8783, though I wonder if a new attack vector is introduced through an attacker enabling a filter that filters monitoring agents? However this would have had to have been configured through the data channel priori, no? General comments: Thank you for the examples, this makes the concepts behind the draft more clear. Editorial comments: ietf-dots-signal-channel and ietf-dots-data-channel are now RFCs. Shawn. -- --000000000000d93f0805a75d94b6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Reviewer: Shawn M. Emery
Review result: Ready with nits

I have reviewed this documen= t as part of the security directorate's
ongoing effort to review all= IETF documents being processed by the IESG.
These comments were written= primarily for the benefit of the security
area directors. Document edit= ors and WG chairs should treat these
comments just like any other last c= all comments.

This draft specifies a filter control through the Dist= ributed Denial-of-Service Open Threat
Signaling (DOTS) signal channel = rather than through the data channel, given that an=C2=A0active
= DDoS attack would essentially disable the data channel.=C2=A0 The assumptio= n is that the filter
rules would have been constructed and distr= ibuted during idle time, before the attack.

The security considerations section does exist and th= e=C2=A0defers=C2=A0to=C2=A0the base
RFCs, 8782 and 8783, for conf= identiality=C2=A0and integrity requirements.=C2=A0 The draft
cont= inues that the filtering rules should be constructed before any attack thro= ugh
the data channel.=C2=A0 The section finishes with an attack b= y using the control filter to
make a DDoS worse and recommends mi= tigation through operators monitoring
and countering malicious be= havior.=C2=A0 They describe this as only a variation of the
attac= ks outlined in 8782 and 8783, though I wonder if a new attack vector is
introduced through an attacker enabling a filter that filters monito= ring agents?
However this would have had to have been configured = through the data channel
priori, no?

Gen= eral comments:

Thank you for the examples, this makes th= e concepts behind the draft more clear.

Editorial comments:

ietf-dots-signal-channel and ietf-dots-data-cha= nnel are now RFCs.

Shawn.
--
--000000000000d93f0805a75d94b6-- From nobody Sat Jun 6 13:03:01 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC17C3A0B34; Sat, 6 Jun 2020 13:02:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f3-9dh_jJenI; Sat, 6 Jun 2020 13:02:51 -0700 (PDT) Received: from mail-wr1-x441.google.com (mail-wr1-x441.google.com [IPv6:2a00:1450:4864:20::441]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 751C33A0B33; Sat, 6 Jun 2020 13:02:51 -0700 (PDT) Received: by mail-wr1-x441.google.com with SMTP id q11so13290026wrp.3; Sat, 06 Jun 2020 13:02:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=i0/QX8zEGSkF9xVmA2SbBfV3kt2QUAgPmxIf3tpog0k=; b=OaPB3a3vbtCv/fuEbuHrpHze6boMHyqQavE7qemOPGP0PfOtSpsBTch4JNKsQVvSkP 9ocb70Vvzl1jT1MYdlhFaMQsSnNYkrmTuniJQjdAEA2ljnQdGKBKjiAtZRtfhwA68A+x 1SRbFE73FsR1h6w5JMlRuxyx2ICvvNe5hf5oWjcTgvzc9jJgorGxoIv9ZLLMm2zkWKqz E8rxr44irImtI9Ifzc8xP3BLTRWsUiEA+L91xuDVeiakrwiFmeiDzaSeQgBHkI1iMVBl FEBN92UfRVIsG7zQIJEQE2Ja6TxR7uaUU/dkInJLpv4zTsRd3QYuszaamlnZ9orqF5Yy ofPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=i0/QX8zEGSkF9xVmA2SbBfV3kt2QUAgPmxIf3tpog0k=; b=HXavsXhu21ArqSEUFA/dUve3r4XfeC/n1KE8vMovOYtcwuTSmKTTsWdWglzWxJwQtE bzXZh6IxdFBn4GkXZ7NNBNk5fazj2J2kmEu12hA0GURheiN19r8skRetGwwHVjfPy9hs 0pTestmtlZAiRimO7rQVjLS6TxnGQUpmRdr+SBWdDTcYz0zwRai6YTho+aMr2QR8cerZ L7pqPrTC4v1Nqi7DpSZ8qcjNOmGTo1PgO+XohPMa9MQzJuBqTnNaav0sF3WW9I9OhQzC OckA+51GkwEinXdbPfgzPVwFbSr75U846eB43AuAAHDCB5yWvjL2DO12cr6eglmwiHpt aqFQ== X-Gm-Message-State: AOAM532eJAkpUKXObcRB2X40jlUxfk0Eo9EFr4N+wYktZpInYDPQ/rpe 2OGCqhs/6vT/CN59ln0TRW58pOzTFfE2BeEHPY4= X-Google-Smtp-Source: ABdhPJzgbGDyA63UAYBMG3s4LHBSA68e2wuPi6EsKsUP1cnLFPmUw06F/zS1ema/pqJaUY8ThRNLfrFs7+Ss21d+riw= X-Received: by 2002:adf:fd48:: with SMTP id h8mr16814974wrs.226.1591473769955; Sat, 06 Jun 2020 13:02:49 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rifaat Shekh-Yusef Date: Sat, 6 Jun 2020 16:02:39 -0400 Message-ID: To: Tommy Pauly Cc: captive-portals , Erik Kline , Martin Thomson , Benjamin Kaduk , Barry Leiba , IETF SecDir , d.thakore@cablelabs.com Content-Type: multipart/alternative; boundary="000000000000ba44c605a76fdca5" Archived-At: Subject: Re: [secdir] [Captive-portals] Secdir last call review of draft-ietf-capport-rfc7710bis-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 06 Jun 2020 20:02:54 -0000 --000000000000ba44c605a76fdca5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Tommy, You will probably need to do more than just dropping this specific sentence, because the text just before this sentence talks about the client authenticating the server and allowing the user to be confident of the server and its identity. Regards, Rifaat On Tue, Jun 2, 2020 at 1:33 AM Tommy Pauly wrote: > Hi Rifaat, > > Your comments make it clear that the recommendation to make the API serve= r > name visible isn=E2=80=99t necessarily clear. I think it=E2=80=99s not a = harmful thing to > show, as a way to give troubleshooting information and transparency to th= e > user, but it is not a security-critical point. > > It seems appropriate to either explain the rationale more in depth, or > remove that sentence entirely to avoid the misinterpretation. > > Do others in the CAPPORT group have thoughts on this sentence, and any > background on why we decided to go that way? Would there be any objection= s > to removing the sentence? > > Thanks, > Tommy > > On Jun 1, 2020, at 6:05 PM, Rifaat Shekh-Yusef > wrote: > > =EF=BB=BF > > > On Sun, May 31, 2020 at 2:07 AM Erik Kline wrote: > >> On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef >> wrote: >> > >> > Adding SecDir back to this thread. >> > >> > >> > >Martin Thomson Tue, 19 May 2020 01:02 UTCShow >> header >> > > >> > >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote: >> > >> it provides the client of the API >> > >> an opportunity to authenticate the server that is hosting the AP= I. >> > >> This authentication is aimed at *allowing a user to be reasonabl= y >> > >> confident that the entity providing the Captive Portal API has a >> > >> valid certificate for the hostname in the URI* >> > >[...] >> > >> An end user should be able to validate that the name is example.com >> and >> > >> not any other form of the URI. >> > >> It would be much more difficult for the end user to make sense and >> > >> validate an IP address. >> > > >> > >I think that you missed the point of my comments. This validation, >> performed by >> > >a user, has no meaningful security value. The text you cite says tha= t >> the server >> > >has a certificate for the name it chooses, which is not the same as >> "has a certificate >> > >for a name the client expects". The difference is important. >> > > >> > >> > This is not the way I read these statements from section 4.1 titled >> Server Authentication. >> > >> > Here is the use case I have in mind when I read this section: >> > If I walk into an airport and I see an ad for a paid Internet service >> from example.com, then as an >> > end user it is reasonable to expect that I would have some ability to >> make sense of the name >> > presented to me and make sure it is from example.com if I choose to >> get such a service. >> > >> > If this is not the case, then yo might want to make it clear that this >> is not about Server Authentication >> > as the title of the section and the text inside that section is >> suggesting. >> >> If we changed the API document's section 4.1 title from "Server >> Authentication" to "API Server Authentication", would that be more >> clear? >> >> I reality, users should never see the API URL. > > > The following is a quote from section 4.1 of the API document, which > implies otherwise: > "The hostname of the API SHOULD be displayed to the user in order to > indicate the entity which is providing the API service." > > Regards, > Rifaat > > > > >> They'll just be >> connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs. If anything >> will only be one or both of the "user-portal-url" or "venue-info-url" >> URLs that might be visible in the browser that's opened for the user's >> interaction. >> >> -ek >> >> > Regards, >> > Rifaat >> > >> > >> > >> > >In a typical web scenario, a person types a string in and (ignore the >> case where there >> > >is an extra hop via a search engine) that string determines what is >> acceptable as a >> > >server identity. The exposure to confusables is limited (under a set >> of other assumptions, >> > >HSTS, etc...). Here, the network has free reign to do as they choose >> with homoglyphs and >> > >other such nonsense. Any expectation you might have about this reall= y >> being a trustworthy >> > >entity is meaningless in this context. >> > > >> > >There are protections against this, but they all lie firmly in the >> anti-phishing domain. >> > >Most of those rely on having a certificate though, so the requirement >> for HTTPS is in >> > >service of that, not in terms of ensuring that an untrained human can >> make a security >> > >critical decision based on poisoned information. >> > >> > On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef < >> rifaat.s.ietf@gmail.com> wrote: >> >> >> >> Adding Ben. >> >> >> >> >> >> On Sun, May 17, 2020 at 9:26 PM Martin Thomson >> wrote: >> >>> >> >>> Adding more lists.. >> >>> >> >>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote: >> >>> > > Here is a quote form the API document: >> >>> > > "The hostname of the API SHOULD be displayed to the user in orde= r >> to indicate the entity which is providing the API service." >> >>> > > >> >>> > > This seems to suggest that the user is expected to inspect the >> displayed name and make sure it is make sense in the context of whoever = is >> providing that service. >> >>> >> >>> I don't think that is the case. If this were a security mechanism, >> then it would use "MUST". This is likely for the purpose of enabling so= me >> sort of accountability. In other words, this is to offer maximal >> information about what is going on. >> >>> >> >> Here is the sentence just before the above quote from the API documen= t: >> >> >> >> it provides the client of the API >> >> an opportunity to authenticate the server that is hosting the API. >> >> This authentication is aimed at allowing a user to be reasonably >> >> confident that the entity providing the Captive Portal API has a >> >> valid certificate for the hostname in the URI >> >> >> >> >> >> >> >> >> >>> >> >>> > > Since this would be an easier attack compared to the interceptio= n >> attack, and IP address is still permitted, then an attacker might force = the >> use of IP address to make it harder for the user to make sense of the >> displayed name. >> >>> >> >>> I don't think that is materially different than getting a name with >> confusable characters (or using the prefix hack, example.com.= .example, >> in an attempt to confuse). >> >> >> >> >> >> An end user should be able to validate that the name is example.com >> and not any other form of the URI. >> >> It would be much more difficult for the end user to make sense and >> validate an IP address. >> >> >> >> Regards, >> >> Rifaat >> >> >> > _______________________________________________ >> > Captive-portals mailing list >> > Captive-portals@ietf.org >> > https://www.ietf.org/mailman/listinfo/captive-portals >> > --000000000000ba44c605a76fdca5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Tommy,

You will probably need to do = more than just dropping=C2=A0this specific=C2=A0sentence, because the text = just before this sentence=C2=A0talks about=C2=A0the client authenticating t= he server and allowing the user to be confident of the server and its ident= ity.

Regards,
=C2=A0Rifaat

On Tue, Jun 2, 2020 at 1:33 AM Tommy Pauly <tpauly@apple.com> wrote:
Hi Rifaat,

Your comments make it clear that the recommendation to make the API s= erver name visible isn=E2=80=99t necessarily clear. I think it=E2=80=99s no= t a harmful thing to show, as a way to give troubleshooting information and= transparency to the user, but it is not a security-critical point.

It seems appropriate to either explain the rationale more= in depth, or remove that sentence entirely to avoid the misinterpretation.=

Do others in the CAPPORT group have thoughts on t= his sentence, and any background on why we decided to go that way? Would th= ere be any objections to removing the sentence?

Th= anks,
Tommy

On = Jun 1, 2020, at 6:05 PM, Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com> wrote:
=EF=BB= =BF


On Sun, May 31, 2020 at 2:07 AM Er= ik Kline <ek.ietf= @gmail.com> wrote:
On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef
<rifaat.s.i= etf@gmail.com> wrote:
>
> Adding SecDir back to this thread.
>
>
> >Martin Thomson <mt@lowentropy.net> Tue, 19 May 2020 01:02 UTCShow header
> >
> >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote:
> >>=C2=A0 =C2=A0 it provides the client of the API
> >>=C2=A0 =C2=A0 an opportunity to authenticate the server that i= s hosting the API.
> >>=C2=A0 =C2=A0 This authentication is aimed at *allowing a user= to be reasonably
> >>=C2=A0 =C2=A0 confident that the entity providing the Captive = Portal API has a
> >>=C2=A0 =C2=A0 valid certificate for the hostname in the URI* > >[...]
> >> An end user should be able to validate that the name is example.com<= /a> and
> >> not any other form of the URI.
> >> It would be much more difficult for the end user to make sens= e and
> >> validate an IP address.
> >
> >I think that you missed the point of my comments.=C2=A0 This valid= ation, performed by
> >a user, has no meaningful security value.=C2=A0 The text you cite = says that the server
> >has a certificate for the name it chooses, which is not the same a= s "has a certificate
> >for a name the client expects".=C2=A0 The difference is impor= tant.
> >
>
> This is not the way I read these statements from section 4.1 titled Se= rver Authentication.
>
> Here is the use case I have in mind when I read this section:
> If I walk into an airport and I see an ad for a paid Internet service = from ex= ample.com, then as an
> end user it is reasonable to expect that I would have some ability to = make sense of the name
> presented to me and make sure it is from example.com if I choose to get s= uch a service.
>
> If this is not the case, then yo might want to make it clear that this= is not about Server Authentication
> as the title of the section and the text inside that section is sugges= ting.

If we changed the API document's section 4.1 title from "Server Authentication" to "API Server Authentication", would that b= e more
clear?

I reality, users should never see the API URL.=C2=A0

<= /div>
The following is a quote from section 4.1 of the API document, wh= ich implies otherwise:
"The hostname of the= API SHOULD be displayed to the user in order to indicate the entity which = is providing the API service."
=C2=A0
Regar= ds,
=C2=A0Rifaat


=C2= =A0
They'll jus= t be
connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs.= =C2=A0 If anything
will only be one or both of the "user-portal-url" or "venue-= info-url"
URLs that might be visible in the browser that's opened for the user= 9;s
interaction.

-ek

> Regards,
>=C2=A0 Rifaat
>
>
>
> >In a typical web scenario, a person types a string in and (ignore = the case where there
> >is an extra hop via a search engine) that string determines what i= s acceptable as a
> >server identity.=C2=A0 The exposure to confusables is limited (und= er a set of other assumptions,
> >HSTS, etc...).=C2=A0 Here, the network has free reign to do as the= y choose with homoglyphs and
> >other such nonsense.=C2=A0 Any expectation you might have about th= is really being a trustworthy
> >entity is meaningless in this context.
> >
> >There are protections against this, but they all lie firmly in the= anti-phishing domain.
> >Most of those rely on having a certificate though, so the requirem= ent for HTTPS is in
> >service of that, not in terms of ensuring that an untrained human = can make a security
> >critical decision based on poisoned information.
>
> On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com&g= t; wrote:
>>
>> Adding Ben.
>>
>>
>> On Sun, May 17, 2020 at 9:26 PM Martin Thomson <mt@lowentropy.net> wrote: >>>
>>> Adding more lists..
>>>
>>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote:
>>> > > Here is a quote form the API document:
>>> > > "The hostname of the API SHOULD be displayed to= the user in order to indicate the entity which is providing the API servic= e."
>>> > >
>>> > > This seems to suggest that the user is expected to i= nspect the displayed name and make sure it is make sense in the context of = whoever is providing that service.
>>>
>>> I don't think that is the case.=C2=A0 If this were a secur= ity mechanism, then it would use "MUST".=C2=A0 This is likely for= the purpose of enabling some sort of accountability.=C2=A0 In other words,= this is to offer maximal information about what is going on.
>>>
>> Here is the sentence just before the above quote from the API docu= ment:
>>
>>=C2=A0 =C2=A0 it provides the client of the API
>>=C2=A0 =C2=A0 an opportunity to authenticate the server that is hos= ting the API.
>>=C2=A0 =C2=A0 This authentication is aimed at allowing a user to be= reasonably
>>=C2=A0 =C2=A0 confident that the entity providing the Captive Porta= l API has a
>>=C2=A0 =C2=A0 valid certificate for the hostname in the URI
>>
>>
>>
>>
>>>
>>> > > Since this would be an easier attack compared to the= interception attack, and IP address is still permitted, then an attacker m= ight force the use of IP address to make it harder for the user to make sen= se of the displayed name.
>>>
>>> I don't think that is materially different than getting a = name with confusable characters (or using the prefix hack, example.com.<som= e-guid>.example, in an attempt to confuse).
>>
>>
>> An end user should be able to validate that the name is example.com a= nd not any other form of the URI.
>> It would be much more difficult for the end user to make sense and= validate an IP address.
>>
>> Regards,
>>=C2=A0 Rifaat
>>
> _______________________________________________
> Captive-portals mailing list
> Captive-= portals@ietf.org
> https://www.ietf.org/mailman/listinfo/cap= tive-portals
--000000000000ba44c605a76fdca5-- From nobody Sat Jun 6 17:05:41 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 31E263A07BB; Sat, 6 Jun 2020 17:05:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VGT7YdxZfQzf; Sat, 6 Jun 2020 17:05:35 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFB8C3A07B6; Sat, 6 Jun 2020 17:05:34 -0700 (PDT) Received: from mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05705SYm023376 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sat, 6 Jun 2020 20:05:31 -0400 Date: Sat, 6 Jun 2020 17:05:28 -0700 From: Benjamin Kaduk To: Shawn Emery Cc: secdir , draft-ietf-dots-signal-filter-control.all@ietf.org, last-call@ietf.org, Shawn Emery Message-ID: <20200607000528.GR58497@mit.edu> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Review of draft-ietf-dots-signal-filter-control-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jun 2020 00:05:36 -0000 Hi Shawn, Thanks for the review. I believe you're correct that any filter that filters monitoring agents would have to have been confiugred previously over the data channel, yes. -Ben On Fri, Jun 05, 2020 at 04:14:02PM -0600, Shawn Emery wrote: > Reviewer: Shawn M. Emery > Review result: Ready with nits > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG. > These comments were written primarily for the benefit of the security > area directors. Document editors and WG chairs should treat these > comments just like any other last call comments. > > This draft specifies a filter control through the Distributed > Denial-of-Service Open Threat > Signaling (DOTS) signal channel rather than through the data channel, given > that an active > DDoS attack would essentially disable the data channel. The assumption is > that the filter > rules would have been constructed and distributed during idle time, before > the attack. > > The security considerations section does exist and the defers to the base > RFCs, 8782 and 8783, for confidentiality and integrity requirements. The > draft > continues that the filtering rules should be constructed before any attack > through > the data channel. The section finishes with an attack by using the control > filter to > make a DDoS worse and recommends mitigation through operators monitoring > and countering malicious behavior. They describe this as only a variation > of the > attacks outlined in 8782 and 8783, though I wonder if a new attack vector is > introduced through an attacker enabling a filter that filters monitoring > agents? > However this would have had to have been configured through the data channel > priori, no? > > General comments: > > Thank you for the examples, this makes the concepts behind the draft more > clear. > > Editorial comments: > > ietf-dots-signal-channel and ietf-dots-data-channel are now RFCs. > > Shawn. > -- From nobody Sun Jun 7 17:21:46 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0D323A081D; Sun, 7 Jun 2020 17:21:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GYEwWsD73HjX; Sun, 7 Jun 2020 17:21:36 -0700 (PDT) Received: from mail-oi1-x22e.google.com (mail-oi1-x22e.google.com [IPv6:2607:f8b0:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AAE213A081B; Sun, 7 Jun 2020 17:21:36 -0700 (PDT) Received: by mail-oi1-x22e.google.com with SMTP id b8so13793062oic.1; Sun, 07 Jun 2020 17:21:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=ul/pKUBYhT3ElTPxUa5XW2WJhFhZtzsIbR3LM5yH9OI=; b=LB3NactwP6tG1/h8zKbB7A+otgqobDexC5mLqEFEqBgKKOviCUyuFP9lqEzaGyqUfU KBASiGYWwheeHqO36dIB1c/HXgSc/xkFjifCUhAT+OWqC38lWyX33WtLaM3iYG3nt6qW 9drB0PSvzJ75a4qy3a8AoLWPPKas7FoQEdJ7warrHmfr2Ola4wiG/ynK22zy/9Mu/aXf dgxZJUz+brIprHpobh004iA3UEmB+cEzC6M3wGQjTblSpVrLgf11oRTVXhOL9Nxqn5LU fCL7M15U1+ouwZcIuArg2HmNvt7H7OY8pLtReeecb86oKdzuCtj40JaDGqBroyd9XCxx lxqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=ul/pKUBYhT3ElTPxUa5XW2WJhFhZtzsIbR3LM5yH9OI=; b=PrO1C8AE6tZn0ZgH7+Q3ETuvPBNMCZ9Yq7Sj1j/fV79JZeAm6VVL8jkujbYEibAyOQ sON6vDI4GHbYXC7+rEYpXXwgW3luDZuXX76I9HLjF0BZOzwJr4xCHHSQ5FMUvpDCGxcm clYxsW7FUEhe33bRRRrmC9RBi5O5WjazDZw/gPF9OdfDggtC9cLo/zwxWtctdBCnx3qy 9vCk9iRKVbVCQoF014/8Z+4cJ9HlDyYvkmygfYMBDe1oV8XoMg8yMdl0qobrCup0tFIZ lrW7NO88ajUJ9aoLONnOaKcrj0MpguTxKJVVCnUVUQNXz+ZluTIE7J01A9DDvXg20goc KS7Q== X-Gm-Message-State: AOAM5319IeCEb4Ecvc7UPnQ54BK29IzTGCiQSmfZxSidj7rJzRkwjCx5 Uso4n3y9N4TqTw5nBteIuxr8WwOC3EQFjMmVaiI= X-Google-Smtp-Source: ABdhPJwE2YaUIavpw8BYoJlRcKAX3d9nCXr/C050J5Q7bdqnHZh5xIu511k0gxhXFaYs8MtPzeyQ4OM36nRNGtbvz5g= X-Received: by 2002:aca:da55:: with SMTP id r82mr9284999oig.100.1591575695944; Sun, 07 Jun 2020 17:21:35 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Erik Kline Date: Sun, 7 Jun 2020 17:21:25 -0700 Message-ID: To: Rifaat Shekh-Yusef Cc: Tommy Pauly , captive-portals , Martin Thomson , Benjamin Kaduk , Barry Leiba , IETF SecDir , d.thakore@cablelabs.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] [Captive-portals] Secdir last call review of draft-ietf-capport-rfc7710bis-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jun 2020 00:21:39 -0000 I think there are two separate things here. [1] The use of HTTPS allows the client to authenticate the API and interactive URLs the same way a browser would be confident it's talking to amazon.com, for example. I think in this sense, the text is correct. [2] There is, however, no way to know whether bobshouseofportals.example.com is the authoritative captive portal service for the MyCoffeeShop ESSID. We should have this explicitly stated somewhere. I couldn't quickly find such a section, but perhaps I should add some text about this to the 7710bis Security Considerations or thereabouts. On Sat, Jun 6, 2020 at 1:02 PM Rifaat Shekh-Yusef wrote: > > Hi Tommy, > > You will probably need to do more than just dropping this specific senten= ce, because the text just before this sentence talks about the client authe= nticating the server and allowing the user to be confident of the server an= d its identity. > > Regards, > Rifaat > > > On Tue, Jun 2, 2020 at 1:33 AM Tommy Pauly wrote: >> >> Hi Rifaat, >> >> Your comments make it clear that the recommendation to make the API serv= er name visible isn=E2=80=99t necessarily clear. I think it=E2=80=99s not a= harmful thing to show, as a way to give troubleshooting information and tr= ansparency to the user, but it is not a security-critical point. >> >> It seems appropriate to either explain the rationale more in depth, or r= emove that sentence entirely to avoid the misinterpretation. >> >> Do others in the CAPPORT group have thoughts on this sentence, and any b= ackground on why we decided to go that way? Would there be any objections t= o removing the sentence? >> >> Thanks, >> Tommy >> >> On Jun 1, 2020, at 6:05 PM, Rifaat Shekh-Yusef = wrote: >> >> =EF=BB=BF >> >> >> On Sun, May 31, 2020 at 2:07 AM Erik Kline wrote: >>> >>> On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef >>> wrote: >>> > >>> > Adding SecDir back to this thread. >>> > >>> > >>> > >Martin Thomson Tue, 19 May 2020 01:02 UTCShow he= ader >>> > > >>> > >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote: >>> > >> it provides the client of the API >>> > >> an opportunity to authenticate the server that is hosting the A= PI. >>> > >> This authentication is aimed at *allowing a user to be reasonab= ly >>> > >> confident that the entity providing the Captive Portal API has = a >>> > >> valid certificate for the hostname in the URI* >>> > >[...] >>> > >> An end user should be able to validate that the name is example.co= m and >>> > >> not any other form of the URI. >>> > >> It would be much more difficult for the end user to make sense and >>> > >> validate an IP address. >>> > > >>> > >I think that you missed the point of my comments. This validation, = performed by >>> > >a user, has no meaningful security value. The text you cite says th= at the server >>> > >has a certificate for the name it chooses, which is not the same as = "has a certificate >>> > >for a name the client expects". The difference is important. >>> > > >>> > >>> > This is not the way I read these statements from section 4.1 titled S= erver Authentication. >>> > >>> > Here is the use case I have in mind when I read this section: >>> > If I walk into an airport and I see an ad for a paid Internet service= from example.com, then as an >>> > end user it is reasonable to expect that I would have some ability to= make sense of the name >>> > presented to me and make sure it is from example.com if I choose to g= et such a service. >>> > >>> > If this is not the case, then yo might want to make it clear that thi= s is not about Server Authentication >>> > as the title of the section and the text inside that section is sugge= sting. >>> >>> If we changed the API document's section 4.1 title from "Server >>> Authentication" to "API Server Authentication", would that be more >>> clear? >>> >>> I reality, users should never see the API URL. >> >> >> The following is a quote from section 4.1 of the API document, which imp= lies otherwise: >> "The hostname of the API SHOULD be displayed to the user in order to ind= icate the entity which is providing the API service." >> >> Regards, >> Rifaat >> >> >> >>> >>> They'll just be >>> connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs. If anything >>> will only be one or both of the "user-portal-url" or "venue-info-url" >>> URLs that might be visible in the browser that's opened for the user's >>> interaction. >>> >>> -ek >>> >>> > Regards, >>> > Rifaat >>> > >>> > >>> > >>> > >In a typical web scenario, a person types a string in and (ignore th= e case where there >>> > >is an extra hop via a search engine) that string determines what is = acceptable as a >>> > >server identity. The exposure to confusables is limited (under a se= t of other assumptions, >>> > >HSTS, etc...). Here, the network has free reign to do as they choos= e with homoglyphs and >>> > >other such nonsense. Any expectation you might have about this real= ly being a trustworthy >>> > >entity is meaningless in this context. >>> > > >>> > >There are protections against this, but they all lie firmly in the a= nti-phishing domain. >>> > >Most of those rely on having a certificate though, so the requiremen= t for HTTPS is in >>> > >service of that, not in terms of ensuring that an untrained human ca= n make a security >>> > >critical decision based on poisoned information. >>> > >>> > On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef wrote: >>> >> >>> >> Adding Ben. >>> >> >>> >> >>> >> On Sun, May 17, 2020 at 9:26 PM Martin Thomson w= rote: >>> >>> >>> >>> Adding more lists.. >>> >>> >>> >>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote: >>> >>> > > Here is a quote form the API document: >>> >>> > > "The hostname of the API SHOULD be displayed to the user in ord= er to indicate the entity which is providing the API service." >>> >>> > > >>> >>> > > This seems to suggest that the user is expected to inspect the = displayed name and make sure it is make sense in the context of whoever is = providing that service. >>> >>> >>> >>> I don't think that is the case. If this were a security mechanism,= then it would use "MUST". This is likely for the purpose of enabling some= sort of accountability. In other words, this is to offer maximal informat= ion about what is going on. >>> >>> >>> >> Here is the sentence just before the above quote from the API docume= nt: >>> >> >>> >> it provides the client of the API >>> >> an opportunity to authenticate the server that is hosting the API= . >>> >> This authentication is aimed at allowing a user to be reasonably >>> >> confident that the entity providing the Captive Portal API has a >>> >> valid certificate for the hostname in the URI >>> >> >>> >> >>> >> >>> >> >>> >>> >>> >>> > > Since this would be an easier attack compared to the intercepti= on attack, and IP address is still permitted, then an attacker might force = the use of IP address to make it harder for the user to make sense of the d= isplayed name. >>> >>> >>> >>> I don't think that is materially different than getting a name with= confusable characters (or using the prefix hack, example.com..e= xample, in an attempt to confuse). >>> >> >>> >> >>> >> An end user should be able to validate that the name is example.com = and not any other form of the URI. >>> >> It would be much more difficult for the end user to make sense and v= alidate an IP address. >>> >> >>> >> Regards, >>> >> Rifaat >>> >> >>> > _______________________________________________ >>> > Captive-portals mailing list >>> > Captive-portals@ietf.org >>> > https://www.ietf.org/mailman/listinfo/captive-portals From nobody Sun Jun 7 22:48:06 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D65D23A0845; Sun, 7 Jun 2020 22:48:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=orange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zy7B9lQficiy; Sun, 7 Jun 2020 22:48:00 -0700 (PDT) Received: from relais-inet.orange.com (relais-inet.orange.com [80.12.66.40]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68B4B3A0841; Sun, 7 Jun 2020 22:48:00 -0700 (PDT) Received: from opfedar07.francetelecom.fr (unknown [xx.xx.xx.9]) by opfedar27.francetelecom.fr (ESMTP service) with ESMTP id 49gMjV4hZjz2xJP; Mon, 8 Jun 2020 07:47:58 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.com; s=ORANGE001; t=1591595278; bh=olMewL3mF18VtVMg9zxVgRRCE2Uvf4RcjDkHI/6eKaI=; h=From:To:Subject:Date:Message-ID:Content-Type: Content-Transfer-Encoding:MIME-Version; b=xX5ABpPbnlCogFA+LUdplAO4Dj7ZfcGNcEfVzf/cXxbnPG4weDabU6I55ZC8xptty qwAZi+gVxv9QUuClZYgSKv655U/s+9Z+28kGAKPjEH8on1GP976feT4CWX/wTAmNlJ 3+L5bPJd9V9MTNHJtZzhlqRs1gHz/QHPM7JVuW/e3aZRc0KIA4aGTgwmWIsxaRYyn/ ceREuk6tNMmP7/8JHh3+3n/ZX5lNTQtAeWNJjv2AEAfxjJxN52PCIoeKH2/9MUfrCC I9ZxC3t/5skDL6bSgwxWtA26FdFjf4DS7/aXPRRfetnLkDhd4u6gBHY9MIFQ0tFk3O XqCkxz83cchzg== Received: from Exchangemail-eme6.itn.ftgroup (unknown [xx.xx.13.92]) by opfedar07.francetelecom.fr (ESMTP service) with ESMTP id 49gMjV3Dwqz5vMv; Mon, 8 Jun 2020 07:47:58 +0200 (CEST) From: To: Benjamin Kaduk , Shawn Emery CC: secdir , "draft-ietf-dots-signal-filter-control.all@ietf.org" , "last-call@ietf.org" , Shawn Emery Thread-Topic: Review of draft-ietf-dots-signal-filter-control-04 Thread-Index: AQHWPF9gitgGThlzD0SLD0GELty+HajONQfA Date: Mon, 8 Jun 2020 05:47:57 +0000 Message-ID: <787AE7BB302AE849A7480A190F8B9330314D972E@OPEXCAUBMA2.corporate.adroot.infra.ftgroup> References: <20200607000528.GR58497@mit.edu> In-Reply-To: <20200607000528.GR58497@mit.edu> Accept-Language: fr-FR, en-US Content-Language: fr-FR X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.114.13.247] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] Review of draft-ietf-dots-signal-filter-control-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jun 2020 05:48:02 -0000 Hi Shawn, Thank you for the review.=20 Please see inline. Cheers, Med > -----Message d'origine----- > De=A0: Benjamin Kaduk [mailto:kaduk@mit.edu] > Envoy=E9=A0: dimanche 7 juin 2020 02:05 > =C0=A0: Shawn Emery > Cc=A0: secdir; draft-ietf-dots-signal-filter-control.all@ietf.org; last- > call@ietf.org; Shawn Emery > Objet=A0: Re: Review of draft-ietf-dots-signal-filter-control-04 >=20 > Hi Shawn, >=20 > Thanks for the review. > I believe you're correct that any filter that filters monitoring > agents > would have to have been confiugred previously over the data channel, > yes. >=20 > -Ben >=20 > On Fri, Jun 05, 2020 at 04:14:02PM -0600, Shawn Emery wrote: > > Reviewer: Shawn M. Emery > > Review result: Ready with nits > > > > I have reviewed this document as part of the security directorate's > > ongoing effort to review all IETF documents being processed by the > IESG. > > These comments were written primarily for the benefit of the > security > > area directors. Document editors and WG chairs should treat these > > comments just like any other last call comments. > > > > This draft specifies a filter control through the Distributed > > Denial-of-Service Open Threat > > Signaling (DOTS) signal channel rather than through the data > channel, given > > that an active > > DDoS attack would essentially disable the data channel. The > assumption is > > that the filter > > rules would have been constructed and distributed during idle time, > before > > the attack. > > > > The security considerations section does exist and the defers to the > base > > RFCs, 8782 and 8783, for confidentiality and integrity requirements. > The > > draft > > continues that the filtering rules should be constructed before any > attack > > through > > the data channel. The section finishes with an attack by using the > control > > filter to > > make a DDoS worse and recommends mitigation through operators > monitoring > > and countering malicious behavior. They describe this as only a > variation > > of the > > attacks outlined in 8782 and 8783, though I wonder if a new attack > vector is > > introduced through an attacker enabling a filter that filters > monitoring > > agents? > > However this would have had to have been configured through the data > channel > > priori, no? [Med] I confirm. =20 > > > > General comments: > > > > Thank you for the examples, this makes the concepts behind the draft > more > > clear. > > > > Editorial comments: > > > > ietf-dots-signal-channel and ietf-dots-data-channel are now RFCs. > > [Med] Fixed in our local copy. Thanks.=20 > > Shawn. > > -- From nobody Mon Jun 8 15:57:56 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5B723A08AD; Mon, 8 Jun 2020 15:57:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0MiB4Y6-G_95; Mon, 8 Jun 2020 15:57:52 -0700 (PDT) Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com [IPv6:2a00:1450:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DA3E43A0895; Mon, 8 Jun 2020 15:57:51 -0700 (PDT) Received: by mail-wm1-x331.google.com with SMTP id l17so1069698wmj.0; Mon, 08 Jun 2020 15:57:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=/Xlo56ZZAuQCaWTs+wDXHYaZ1tjOg9NtZSVeLVHDA5s=; b=YAJAMxkq/RNbn51D6BsjZ/jH5psdd6aT2ZBaqdso+UjpmmFRMhIJCmz1KEg07VDAbb yq8SiofL28CfPeLBHWBvzHE8tvioBnfjKp7Hr9MIvYPJMS5ZYQmqavfh52/5flqt8OaU Cj/AVVI16uxJlJSglJ+fYllBZSbsxXcstIfg0/F9ucPPYTctN6VbnUNz3veOl5qtffKV au0cWoWmd6bGBWi7/0ZFlRSdE0NU1FC9tm20diGVKNpxZp9nqEFxn1Ka9E/kRH4tFA9J RSyUjCso/XGdiD5waqxUdi5TmPVSWI6XbCOwOfJ89zePM5HwEgoXZJv6eLcKcckuPmVH gp2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=/Xlo56ZZAuQCaWTs+wDXHYaZ1tjOg9NtZSVeLVHDA5s=; b=IJNLPsl3OF2SJ4Pt2NWKtW5laJfgtFSg74RPxAQBb6WrUaxBCdwU2SlVTy9R5/K1Vq 8d9Ngkrgpk3JLqdypFqk598aOm8LYRj1LrXvHJb42o3s0hkO6eiXqqHEUcA2MnYZBlhR 28RPT0wHxkJtnk9VwSOv0rJwAAxxbOlNzOYr0aSG+k38nho+EqS4/OiMw1Gb86sr/ieF zPWikW27yNZ2aG2SkIbl3C/DwGTOUYnw4/kCtHMSGkynpJwqM90KIwz6nFQdKm3VARqa msQQktYwtSkU/osyFQy+YYWb/ALRIRQ4BMoIIzbSTPPfukFKvdF2vQ4RqOhtu9Mh6Ct9 aVQg== X-Gm-Message-State: AOAM531TSttrYUsYp6di4QJa6S6j1KvLrl8X/3uiY9JbYDzIR3I/PMIZ Ix1kxn3WyG1AK2hYdj1lt/QyXKaK2NBDXXOiyJc= X-Google-Smtp-Source: ABdhPJwgwIbViZKrEVw9o2NzLJVPsIowaFPqn7AA7GyyxwmExminRzi9rq6DGnbVE6jCG0DWZY+2BQcm4vCv8ry87D8= X-Received: by 2002:a1c:1b17:: with SMTP id b23mr892786wmb.3.1591657070345; Mon, 08 Jun 2020 15:57:50 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Rifaat Shekh-Yusef Date: Mon, 8 Jun 2020 18:57:39 -0400 Message-ID: To: Erik Kline Cc: Tommy Pauly , captive-portals , Martin Thomson , Benjamin Kaduk , Barry Leiba , IETF SecDir , d.thakore@cablelabs.com Content-Type: multipart/alternative; boundary="000000000000483fe505a79a8a03" Archived-At: Subject: Re: [secdir] [Captive-portals] Secdir last call review of draft-ietf-capport-rfc7710bis-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 08 Jun 2020 22:57:55 -0000 --000000000000483fe505a79a8a03 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Jun 7, 2020 at 8:21 PM Erik Kline wrote: > I think there are two separate things here. > > [1] The use of HTTPS allows the client to authenticate the API and > interactive URLs the same way a browser would be confident it's > talking to amazon.com, for example. > > I think in this sense, the text is correct. > > The client would not be able to validate the server identity without the help of the end user, because an attacker could inject DHCP messages to force the client to contact an attacker controlled server. The text explicitly states that the end user is expected to be involved, but some of the replies I received in this thread indicate otherwise. When you say "the text is correct", do you include the user involvement? > [2] There is, however, no way to know whether > bobshouseofportals.example.com is the authoritative captive portal > service for the MyCoffeeShop ESSID. > > Assuming that the client was able to validate the API server's identity i= n the previous step, would the client not be able to obtain all the needed information to validate the web portal server? Regards, Rifaat > We should have this explicitly stated somewhere. I couldn't quickly > find such a section, but perhaps I should add some text about this to > the 7710bis Security Considerations or thereabouts. > > On Sat, Jun 6, 2020 at 1:02 PM Rifaat Shekh-Yusef > wrote: > > > > Hi Tommy, > > > > You will probably need to do more than just dropping this specific > sentence, because the text just before this sentence talks about the clie= nt > authenticating the server and allowing the user to be confident of the > server and its identity. > > > > Regards, > > Rifaat > > > > > > On Tue, Jun 2, 2020 at 1:33 AM Tommy Pauly wrote: > >> > >> Hi Rifaat, > >> > >> Your comments make it clear that the recommendation to make the API > server name visible isn=E2=80=99t necessarily clear. I think it=E2=80=99s= not a harmful > thing to show, as a way to give troubleshooting information and > transparency to the user, but it is not a security-critical point. > >> > >> It seems appropriate to either explain the rationale more in depth, or > remove that sentence entirely to avoid the misinterpretation. > >> > >> Do others in the CAPPORT group have thoughts on this sentence, and any > background on why we decided to go that way? Would there be any objection= s > to removing the sentence? > >> > >> Thanks, > >> Tommy > >> > >> On Jun 1, 2020, at 6:05 PM, Rifaat Shekh-Yusef > wrote: > >> > >> =EF=BB=BF > >> > >> > >> On Sun, May 31, 2020 at 2:07 AM Erik Kline wrote: > >>> > >>> On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef > >>> wrote: > >>> > > >>> > Adding SecDir back to this thread. > >>> > > >>> > > >>> > >Martin Thomson Tue, 19 May 2020 01:02 UTCShow > header > >>> > > > >>> > >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wrote: > >>> > >> it provides the client of the API > >>> > >> an opportunity to authenticate the server that is hosting the > API. > >>> > >> This authentication is aimed at *allowing a user to be > reasonably > >>> > >> confident that the entity providing the Captive Portal API ha= s > a > >>> > >> valid certificate for the hostname in the URI* > >>> > >[...] > >>> > >> An end user should be able to validate that the name is > example.com and > >>> > >> not any other form of the URI. > >>> > >> It would be much more difficult for the end user to make sense a= nd > >>> > >> validate an IP address. > >>> > > > >>> > >I think that you missed the point of my comments. This validation= , > performed by > >>> > >a user, has no meaningful security value. The text you cite says > that the server > >>> > >has a certificate for the name it chooses, which is not the same a= s > "has a certificate > >>> > >for a name the client expects". The difference is important. > >>> > > > >>> > > >>> > This is not the way I read these statements from section 4.1 titled > Server Authentication. > >>> > > >>> > Here is the use case I have in mind when I read this section: > >>> > If I walk into an airport and I see an ad for a paid Internet > service from example.com, then as an > >>> > end user it is reasonable to expect that I would have some ability > to make sense of the name > >>> > presented to me and make sure it is from example.com if I choose to > get such a service. > >>> > > >>> > If this is not the case, then yo might want to make it clear that > this is not about Server Authentication > >>> > as the title of the section and the text inside that section is > suggesting. > >>> > >>> If we changed the API document's section 4.1 title from "Server > >>> Authentication" to "API Server Authentication", would that be more > >>> clear? > >>> > >>> I reality, users should never see the API URL. > >> > >> > >> The following is a quote from section 4.1 of the API document, which > implies otherwise: > >> "The hostname of the API SHOULD be displayed to the user in order to > indicate the entity which is providing the API service." > >> > >> Regards, > >> Rifaat > >> > >> > >> > >>> > >>> They'll just be > >>> connecting to "Cool Cafe" or "Awesome Bookshop" ESSIDs. If anything > >>> will only be one or both of the "user-portal-url" or "venue-info-url" > >>> URLs that might be visible in the browser that's opened for the user'= s > >>> interaction. > >>> > >>> -ek > >>> > >>> > Regards, > >>> > Rifaat > >>> > > >>> > > >>> > > >>> > >In a typical web scenario, a person types a string in and (ignore > the case where there > >>> > >is an extra hop via a search engine) that string determines what i= s > acceptable as a > >>> > >server identity. The exposure to confusables is limited (under a > set of other assumptions, > >>> > >HSTS, etc...). Here, the network has free reign to do as they > choose with homoglyphs and > >>> > >other such nonsense. Any expectation you might have about this > really being a trustworthy > >>> > >entity is meaningless in this context. > >>> > > > >>> > >There are protections against this, but they all lie firmly in the > anti-phishing domain. > >>> > >Most of those rely on having a certificate though, so the > requirement for HTTPS is in > >>> > >service of that, not in terms of ensuring that an untrained human > can make a security > >>> > >critical decision based on poisoned information. > >>> > > >>> > On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef < > rifaat.s.ietf@gmail.com> wrote: > >>> >> > >>> >> Adding Ben. > >>> >> > >>> >> > >>> >> On Sun, May 17, 2020 at 9:26 PM Martin Thomson > wrote: > >>> >>> > >>> >>> Adding more lists.. > >>> >>> > >>> >>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yusef wrote: > >>> >>> > > Here is a quote form the API document: > >>> >>> > > "The hostname of the API SHOULD be displayed to the user in > order to indicate the entity which is providing the API service." > >>> >>> > > > >>> >>> > > This seems to suggest that the user is expected to inspect th= e > displayed name and make sure it is make sense in the context of whoever i= s > providing that service. > >>> >>> > >>> >>> I don't think that is the case. If this were a security > mechanism, then it would use "MUST". This is likely for the purpose of > enabling some sort of accountability. In other words, this is to offer > maximal information about what is going on. > >>> >>> > >>> >> Here is the sentence just before the above quote from the API > document: > >>> >> > >>> >> it provides the client of the API > >>> >> an opportunity to authenticate the server that is hosting the > API. > >>> >> This authentication is aimed at allowing a user to be reasonabl= y > >>> >> confident that the entity providing the Captive Portal API has = a > >>> >> valid certificate for the hostname in the URI > >>> >> > >>> >> > >>> >> > >>> >> > >>> >>> > >>> >>> > > Since this would be an easier attack compared to the > interception attack, and IP address is still permitted, then an attacker > might force the use of IP address to make it harder for the user to make > sense of the displayed name. > >>> >>> > >>> >>> I don't think that is materially different than getting a name > with confusable characters (or using the prefix hack, example.com..example, > in an attempt to confuse). > >>> >> > >>> >> > >>> >> An end user should be able to validate that the name is example.co= m > and not any other form of the URI. > >>> >> It would be much more difficult for the end user to make sense and > validate an IP address. > >>> >> > >>> >> Regards, > >>> >> Rifaat > >>> >> > >>> > _______________________________________________ > >>> > Captive-portals mailing list > >>> > Captive-portals@ietf.org > >>> > https://www.ietf.org/mailman/listinfo/captive-portals > --000000000000483fe505a79a8a03 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Jun 7, 2020 at 8:21 PM Erik K= line <ek.ietf@gmail.com> wro= te:
I think ther= e are two separate things here.

[1] The use of HTTPS allows the client to authenticate the API and
interactive URLs the same way a browser would be confident it's
talking to amazon.com, for example.

I think in this sense, the text is correct.

The client would not be able to validate the=C2=A0ser= ver identity without the help of the end user, because an attacker could in= ject DHCP messages to force the client to contact=C2=A0an attacker controll= ed server.
The text explicitly states that the end user is expect= ed to be involved, but some of the replies I received in this thread indica= te otherwise.
When you say "the text is correct", do yo= u include the user involvement?

=C2=A0
[2] There is, however, no way to know whether
bobshouseofportals.example.com is the authoritative captive= portal
service for the MyCoffeeShop ESSID.

Assuming that the client was able to validate the API= server's=C2=A0identity in the=C2=A0previous step, would the=C2=A0clien= t not be able to obtain all the needed information to validate the web port= al server?

Regards,
=C2=A0Rifaat

=C2=A0
We should have this explicitly stated somewhere.=C2=A0 I couldn't quick= ly
find such a section, but perhaps I should add some text about this to
the 7710bis Security Considerations or thereabouts.

On Sat, Jun 6, 2020 at 1:02 PM Rifaat Shekh-Yusef
<rifaat.s.i= etf@gmail.com> wrote:
>
> Hi Tommy,
>
> You will probably need to do more than just dropping this specific sen= tence, because the text just before this sentence talks about the client au= thenticating the server and allowing the user to be confident of the server= and its identity.
>
> Regards,
>=C2=A0 Rifaat
>
>
> On Tue, Jun 2, 2020 at 1:33 AM Tommy Pauly <tpauly@apple.com> wrote:
>>
>> Hi Rifaat,
>>
>> Your comments make it clear that the recommendation to make the AP= I server name visible isn=E2=80=99t necessarily clear. I think it=E2=80=99s= not a harmful thing to show, as a way to give troubleshooting information = and transparency to the user, but it is not a security-critical point.
>>
>> It seems appropriate to either explain the rationale more in depth= , or remove that sentence entirely to avoid the misinterpretation.
>>
>> Do others in the CAPPORT group have thoughts on this sentence, and= any background on why we decided to go that way? Would there be any object= ions to removing the sentence?
>>
>> Thanks,
>> Tommy
>>
>> On Jun 1, 2020, at 6:05 PM, Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com&g= t; wrote:
>>
>> =EF=BB=BF
>>
>>
>> On Sun, May 31, 2020 at 2:07 AM Erik Kline <ek.ietf@gmail.com> wrote:
>>>
>>> On Wed, May 20, 2020 at 4:37 AM Rifaat Shekh-Yusef
>>> <rifaat.s.ietf@gmail.com> wrote:
>>> >
>>> > Adding SecDir back to this thread.
>>> >
>>> >
>>> > >Martin Thomson <mt@lowentropy.net> Tue, 19 May 2020 01:02 UTCSh= ow header
>>> > >
>>> > >On Tue, May 19, 2020, at 07:08, Rifaat Shekh-Yusef wr= ote:
>>> > >>=C2=A0 =C2=A0 it provides the client of the API >>> > >>=C2=A0 =C2=A0 an opportunity to authenticate the = server that is hosting the API.
>>> > >>=C2=A0 =C2=A0 This authentication is aimed at *al= lowing a user to be reasonably
>>> > >>=C2=A0 =C2=A0 confident that the entity providing= the Captive Portal API has a
>>> > >>=C2=A0 =C2=A0 valid certificate for the hostname = in the URI*
>>> > >[...]
>>> > >> An end user should be able to validate that the = name is example.com and
>>> > >> not any other form of the URI.
>>> > >> It would be much more difficult for the end user= to make sense and
>>> > >> validate an IP address.
>>> > >
>>> > >I think that you missed the point of my comments.=C2= =A0 This validation, performed by
>>> > >a user, has no meaningful security value.=C2=A0 The t= ext you cite says that the server
>>> > >has a certificate for the name it chooses, which is n= ot the same as "has a certificate
>>> > >for a name the client expects".=C2=A0 The differ= ence is important.
>>> > >
>>> >
>>> > This is not the way I read these statements from section = 4.1 titled Server Authentication.
>>> >
>>> > Here is the use case I have in mind when I read this sect= ion:
>>> > If I walk into an airport and I see an ad for a paid Inte= rnet service from example.com, then as an
>>> > end user it is reasonable to expect that I would have som= e ability to make sense of the name
>>> > presented to me and make sure it is from example.com if I ch= oose to get such a service.
>>> >
>>> > If this is not the case, then yo might want to make it cl= ear that this is not about Server Authentication
>>> > as the title of the section and the text inside that sect= ion is suggesting.
>>>
>>> If we changed the API document's section 4.1 title from &q= uot;Server
>>> Authentication" to "API Server Authentication",= would that be more
>>> clear?
>>>
>>> I reality, users should never see the API URL.
>>
>>
>> The following is a quote from section 4.1 of the API document, whi= ch implies otherwise:
>> "The hostname of the API SHOULD be displayed to the user in o= rder to indicate the entity which is providing the API service."
>>
>> Regards,
>>=C2=A0 Rifaat
>>
>>
>>
>>>
>>> They'll just be
>>> connecting to "Cool Cafe" or "Awesome Bookshop&= quot; ESSIDs.=C2=A0 If anything
>>> will only be one or both of the "user-portal-url" or= "venue-info-url"
>>> URLs that might be visible in the browser that's opened fo= r the user's
>>> interaction.
>>>
>>> -ek
>>>
>>> > Regards,
>>> >=C2=A0 Rifaat
>>> >
>>> >
>>> >
>>> > >In a typical web scenario, a person types a string in= and (ignore the case where there
>>> > >is an extra hop via a search engine) that string dete= rmines what is acceptable as a
>>> > >server identity.=C2=A0 The exposure to confusables is= limited (under a set of other assumptions,
>>> > >HSTS, etc...).=C2=A0 Here, the network has free reign= to do as they choose with homoglyphs and
>>> > >other such nonsense.=C2=A0 Any expectation you might = have about this really being a trustworthy
>>> > >entity is meaningless in this context.
>>> > >
>>> > >There are protections against this, but they all lie = firmly in the anti-phishing domain.
>>> > >Most of those rely on having a certificate though, so= the requirement for HTTPS is in
>>> > >service of that, not in terms of ensuring that an unt= rained human can make a security
>>> > >critical decision based on poisoned information.
>>> >
>>> > On Mon, May 18, 2020 at 5:08 PM Rifaat Shekh-Yusef <rifaat.s.ietf@gm= ail.com> wrote:
>>> >>
>>> >> Adding Ben.
>>> >>
>>> >>
>>> >> On Sun, May 17, 2020 at 9:26 PM Martin Thomson <mt@lowentropy.net&= gt; wrote:
>>> >>>
>>> >>> Adding more lists..
>>> >>>
>>> >>> On Sun, May 17, 2020, at 02:50, Rifaat Shekh-Yuse= f wrote:
>>> >>> > > Here is a quote form the API document:<= br> >>> >>> > > "The hostname of the API SHOULD be= displayed to the user in order to indicate the entity which is providing t= he API service."
>>> >>> > >
>>> >>> > > This seems to suggest that the user is = expected to inspect the displayed name and make sure it is make sense in th= e context of whoever is providing that service.
>>> >>>
>>> >>> I don't think that is the case.=C2=A0 If this= were a security mechanism, then it would use "MUST".=C2=A0 This = is likely for the purpose of enabling some sort of accountability.=C2=A0 In= other words, this is to offer maximal information about what is going on.<= br> >>> >>>
>>> >> Here is the sentence just before the above quote from= the API document:
>>> >>
>>> >>=C2=A0 =C2=A0 it provides the client of the API
>>> >>=C2=A0 =C2=A0 an opportunity to authenticate the serve= r that is hosting the API.
>>> >>=C2=A0 =C2=A0 This authentication is aimed at allowing= a user to be reasonably
>>> >>=C2=A0 =C2=A0 confident that the entity providing the = Captive Portal API has a
>>> >>=C2=A0 =C2=A0 valid certificate for the hostname in th= e URI
>>> >>
>>> >>
>>> >>
>>> >>
>>> >>>
>>> >>> > > Since this would be an easier attack co= mpared to the interception attack, and IP address is still permitted, then = an attacker might force the use of IP address to make it harder for the use= r to make sense of the displayed name.
>>> >>>
>>> >>> I don't think that is materially different th= an getting a name with confusable characters (or using the prefix hack, example.co= m.<some-guid>.example, in an attempt to confuse).
>>> >>
>>> >>
>>> >> An end user should be able to validate that the name = is exam= ple.com and not any other form of the URI.
>>> >> It would be much more difficult for the end user to m= ake sense and validate an IP address.
>>> >>
>>> >> Regards,
>>> >>=C2=A0 Rifaat
>>> >>
>>> > _______________________________________________
>>> > Captive-portals mailing list
>>> > Captive-portals@ietf.org
>>> > https://www.ietf.org/mailman/= listinfo/captive-portals
--000000000000483fe505a79a8a03-- From nobody Mon Jun 8 17:14:13 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 468B73A0801; Mon, 8 Jun 2020 17:14:07 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Sean Turner via Datatracker To: Cc: dhcwg@ietf.org, last-call@ietf.org, draft-ietf-dhc-mac-assign.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.3.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159166164723.4538.11036627051900835905@ietfa.amsl.com> Reply-To: Sean Turner Date: Mon, 08 Jun 2020 17:14:07 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-dhc-mac-assign-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jun 2020 00:14:07 -0000 Reviewer: Sean Turner Review result: Has Nits Hi! I reviewed this draft, the directorate reviews, and the IESG discuss/comments (and skimmed draft-ietf-dhc-slap-quadrant). This draft is about using DHCP to avoid collisions in certain environments where randomized MAC addresses are used, e.g., huuuuge virtualization deployments. 1. It is interesting to note that the actual probability of collisions is not included in the draft. (ah I guess Ben noted this too) 2. I'd echo Barry's comment about adding something about what the consequences of multiple devices using the same MAC address. 3. Is it worth adding at least an informative reference to some DoS mitigation techniques? From nobody Mon Jun 8 17:17:45 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F8903A0809; Mon, 8 Jun 2020 17:17:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.101 X-Spam-Level: X-Spam-Status: No, score=-2.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZYf2Gtb9qoVA; Mon, 8 Jun 2020 17:17:34 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650120.outbound.protection.outlook.com [40.107.65.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC5B83A0807; Mon, 8 Jun 2020 17:17:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=UhFP75jR3u7qcmPHaNTUYfXwfFkDXbzvQS+iz/S9JDkdv4OoSdHRDQp58D++egYnsq8S62G2IUrSo03cNCNRv1c24I/4+tpMLa/jQKiZ2LQ2aqFBw2hZG8dDKlQ3n2Pr4AnH0aSNWcnJjiWrCVKfsAkkD5Xi0mN6kNgKqSEaOtAT1a7gJKfreLVCw9fAdH5SYRykMD8SkBXxs8wY6aUK66Epd50MYP1yx6vDmz7u27ebONOtgdbObAK++Y4/Aid/d3DoQZriOttJNuwUyRIlUPdSh3zjHj9nLi9ecj7/4k0rCB+7aAesEcgTE4XPfbXAV1N9dumxKBzeZluNahC0HQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CUCoGObbV9qx98GqQvLqnEC1WfL/Ljw6Nwa6QaLeo7o=; b=gTJXrCmmaQfFEP/uyC7kmFd6SwhB8cayrBDE0TLPGiPppwHpRn3+ugZ3OlMZo8HxweBysuAW8Yg5ThMggokvsF5qDu+8EL1AkF56Wg2yBznXJ3C2+hIsK6IRkDNXcYMUXDnJZxSrqdt5lwjA7Yd3LlsbPWNSoHUFQ3oZNCeKiJZqm6fyrjwhRW2hCH8+sbyhfpvw7+qxHQaazVJDMxFjIC7Ja30VU8d4LjyYJNzeSVeJyKqyNbse9dSSuFWoAX+Si6Qfpow8s1wyMGIPMzkOE88JkY67/LOlb7p6YrHKEo21soASN9x1I6azyvyc9IG1+Gpv73CG8ORmvtSc7ZboiQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=CUCoGObbV9qx98GqQvLqnEC1WfL/Ljw6Nwa6QaLeo7o=; b=SNGLP8oBcTyvkSX28SWUG+KLVhIgYRau8KlvNBue0QORbbTFcPGscVggtTL3YOCodR+w+GSC/Oj/DF7Av7m6fnOxYqXGrrgu8NVw8rNP7kzkrUkRy2JNgz/EPe/UZK67g3L/SzGYZshr3efVhOYah1PC/uMlab93+jepfzAcfTk= Received: from MN2PR00MB0686.namprd00.prod.outlook.com (2603:10b6:208:15f::13) by MN2PR00MB0558.namprd00.prod.outlook.com (2603:10b6:208:fd::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3114.0; Tue, 9 Jun 2020 00:17:28 +0000 Received: from MN2PR00MB0686.namprd00.prod.outlook.com ([fe80::b816:9dfb:f80d:3b9f]) by MN2PR00MB0686.namprd00.prod.outlook.com ([fe80::b816:9dfb:f80d:3b9f%8]) with mapi id 15.20.3114.000; Tue, 9 Jun 2020 00:17:28 +0000 From: Mike Jones To: Valery Smyslov , "secdir@ietf.org" CC: "last-call@ietf.org" , "draft-ietf-secevent-http-push.all@ietf.org" , "id-event@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-secevent-http-push-10 Thread-Index: AdY981rMjMYzrf79SkyZJEfuKyvEOA== Date: Tue, 9 Jun 2020 00:17:28 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ActionId=0a67fbe7-4946-4b44-a5c1-0000c7f1db91; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=true; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=Internal; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-06-08T23:52:51Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; authentication-results: smyslov.net; dkim=none (message not signed) header.d=none;smyslov.net; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [50.47.87.252] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 1ceff2dc-9b77-4200-3adf-08d80c0a7ea8 x-ms-traffictypediagnostic: MN2PR00MB0558: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-forefront-prvs: 042957ACD7 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: G7bZxwLZAYAB49qW31ktdxPxLO6Qz5D3pm221B/SkYfbXpe2hxFTGbaomtQvS3vjNTCzo8jgTux0A2dzj0hcn4lGtXg+BU0Ox8in31/9WGiCr2+GpehdHB+hIcuBUtJOOZqVwCHqJW7sW4hp3QOVOYix8/mqvPTf0BSYV7mEyKl8rhvVf7MXAOQVeTJKkw68zlEgmhYBE+ss3MuUZIaGemQDS8KeoEqJ2oCuyeih6dUPHnSZkFiqFIkO39WR4nvuMMnC6Nl0WmZWEyOmm+nCTlXrlSmSyrLJLMMRmlyZKpb0GaAtu3byTsaD/o39B4v0u0W/d4RGnMbuL5wKV2FUW/2y8oA+uxwqk6ymzqSZN8HwD8kdI+uBteEOVPd8LRC5XIpvm0JxqWODPqIUsvEerQ== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR00MB0686.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(136003)(366004)(376002)(396003)(39860400002)(4326008)(55016002)(26005)(186003)(86362001)(82960400001)(82950400001)(2906002)(9686003)(966005)(53546011)(8990500004)(7696005)(71200400001)(6506007)(66556008)(64756008)(10290500003)(66946007)(478600001)(110136005)(54906003)(5660300002)(316002)(33656002)(66446008)(52536014)(66476007)(76116006)(8676002)(83380400001)(8936002); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: rYiQgX0wQ5zUlFLvAPx96u+16Iz976QBrb5P6WxLo4yln9BfLccQX3Qxq5P3eP7j+xu6fKglV4nTPMgEQOY/gugfd8/LwwS/6pso32LS02EWyisV/2ME+izWZ24FzPSaBCPBboshFlOuaRO6M0KOX6Mzw5KPsjADE6D/sabtXU8Wp8M4bmgmxoltcBeLr0dWRszQ3eh5bHYJS270XOsy1ouyDVfDdk7zHUKKicLK4Ym1UdRkthKq0xdRRXs3+ha0MLNzcvCszLJ7gY0T2h0q3l4LTJiu515yRFrxgvNdwtat5EPmlG84hY4H/hgdhfQNG3mT2Q3OL8EZXYcscFW7+4ph5IiB23QMXxp1iPUv4iMZmCFmsnrgQ5Z8bQBZzqH+FZZI8Vt4Y+wiVESIj5CFd3nfG05MkfYlkfTN6Wo9w34uOB++u670otBScZ+8qxhODRporfxzoM2nfgoRH2DCAYn2f4v6L8NgZgI5HYi7BuI= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1ceff2dc-9b77-4200-3adf-08d80c0a7ea8 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jun 2020 00:17:28.5223 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 1yJptO9e31rFl1dYG7MmhCHAjiaTjP+JGKN3RUDMduG9xfMet0acLef1lvnLDzWH7VpjJqw+dr6yCoe9MoLx6g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR00MB0558 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-secevent-http-push-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jun 2020 00:17:36 -0000 VGhhbmtzIGZvciB5b3VyIHVzZWZ1bCByZXZpZXcsIFZhbGVyeS4gIEkndmUgYXR0ZW1wdGVkIHRv IGFkZHJlc3MgeW91ciBjb21tZW50cyBpbiBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJh ZnQtaWV0Zi1zZWNldmVudC1odHRwLXB1c2gtMTEuICBSZXBsaWVzIGFyZSBpbmxpbmUsIHByZWZp eGVkIGJ5ICJNaWtlPiIuDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBWYWxl cnkgU215c2xvdiB2aWEgRGF0YXRyYWNrZXIgPG5vcmVwbHlAaWV0Zi5vcmc+IA0KU2VudDogU2F0 dXJkYXksIE1heSAyLCAyMDIwIDExOjM5IFBNDQpUbzogc2VjZGlyQGlldGYub3JnDQpDYzogbGFz dC1jYWxsQGlldGYub3JnOyBkcmFmdC1pZXRmLXNlY2V2ZW50LWh0dHAtcHVzaC5hbGxAaWV0Zi5v cmc7IGlkLWV2ZW50QGlldGYub3JnDQpTdWJqZWN0OiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBv ZiBkcmFmdC1pZXRmLXNlY2V2ZW50LWh0dHAtcHVzaC0xMA0KDQpSZXZpZXdlcjogVmFsZXJ5IFNt eXNsb3YNClJldmlldyByZXN1bHQ6IEhhcyBJc3N1ZXMNCg0KSSBoYXZlIHJldmlld2VkIHRoaXMg ZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUncyBvbmdvaW5nIGVm Zm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nlc3NlZCBieSB0aGUg SUVTRy4gIFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiBwcmltYXJpbHkgZm9yIHRoZSBiZW5l Zml0IG9mIHRoZSBzZWN1cml0eSBhcmVhIGRpcmVjdG9ycy4gIERvY3VtZW50IGVkaXRvcnMgYW5k IFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2UgY29tbWVudHMganVzdCBsaWtlIGFueSBvdGhl ciBsYXN0IGNhbGwgY29tbWVudHMuDQoNClRoZSBkb2N1bWVudCBkZWZpbmVzIHB1c2gtYmFzZWQg U2VjdXJpdHkgRXZlbnQgVG9rZW5zIChTRVQpIGRlbGl2ZXJ5IHVzaW5nIEhUVFAgdHJhbnNwb3J0 Lg0KDQpJIHRoaW5rIHRoZSBkb2N1bWVudCBoYXMgZmV3IGlzc3VlcyB0aGF0IGFyZSBlYXN5IHRv IGZpeC4NCg0KTWFqb3IgaXNzdWU6DQoNCjEuIFNlY3Rpb24gNS4xOg0KDQogICBJbiBzY2VuYXJp b3Mgd2hlcmUgSFRUUCBhdXRob3JpemF0aW9uIG9yIFRMUyBtdXR1YWwgYXV0aGVudGljYXRpb24N CiAgIGFyZSBub3QgdXNlZCBvciBhcmUgY29uc2lkZXJlZCB3ZWFrLCBKV1Mgc2lnbmVkIFNFVHMg U0hPVUxEIGJlIHVzZWQNCiAgIChzZWUgW1JGQzc1MTVdIGFuZCBTZWN0aW9uIDUgb2YgW1JGQzg0 MTddKS4NCg0KSSB0aGluayB0aGlzICJTSE9VTEQiIGlzIGluY29uc2lzdGVudCB3aXRoIFJGQzg0 MTcsIHdoaWNoIHN0YXRlczoNCg0KICAgVW5sZXNzIGludGVncml0eSBvZiB0aGUgSldUIGlzIGVu c3VyZWQgYnkgb3RoZXIgbWVhbnMsIGl0IE1VU1QgYmUNCiAgIHNpZ25lZCB1c2luZyBKV1MgW1JG Qzc1MTVdIGJ5IGFuIGlzc3VlciB0aGF0IGlzIHRydXN0ZWQgdG8gZG8gc28gZm9yDQogICB0aGUg dXNlIGNhc2Ugc28gdGhhdCB0aGUgU0VUIGNhbiBiZSBhdXRoZW50aWNhdGVkIGFuZCB2YWxpZGF0 ZWQgYnkNCiAgIHRoZSBTRVQgcmVjaXBpZW50Lg0KDQpJZiB5b3UgYmVsaWV2ZSB0aGF0IHRoZXJl IGFyZSB2YWxpZCB1c2UtY2FzZXMgd2hlbiB1bnNpZ25lZCBTRVRzIGNhbiBiZSB0cmFuc2ZlcnJl ZCBvdmVyIHVuYXV0aGVudGljYXRlZCB0cmFuc3BvcnQgKHZpb2xhdGluZyBNVVNUIGZyb20gUkZD ODQxNyksIHRoZW4gcGxlYXNlIGRlc2NyaWJlIHRoZW0uDQoNCk1pa2U+IEluIGh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1pZXRmLXNlY2V2ZW50LWh0dHAtcHVzaC0xMSNzZWN0aW9u LTUuMSwgSSByZW1vdmVkIHRoZSBvZGQgc3RhcnQgb2YgdGhlIHNlbnRlbmNlIHRoYXQgeW91IGNh bGxlZCBvdXQsIGxlYXZpbmcgb25seSBhbiBhY3Rpb25hYmxlIHN0YXRlbWVudCB0aGF0IGlzIGNv bnNpc3RlbnQgd2l0aCBSRkMgODQxNy4NCg0KMi4gU2VjdGlvbiA2Lg0KDQpJIHRoaW5rIHRoYXQg UHJpdmFjeSBDb25zaWRlcmF0aW9ucyBsYWNrIGRpc2N1c3Npb24gb2YNCndoYXQgaW5mb3JtYXRp b24gYW4gYXR0YWNrZXIgY2FuIGxlYXJuIGJ5IGFuYWx5emluZyBIVFRQIHJlc3BvbnNlcw0KaWYg dGhlIEhUVFAgY29ubmVjdGlvbiBpcyBub3QgcHJvdGVjdGVkIGJ5IFRMUy4gSW4gdGhpcyBjYXNl DQpldmVuIGlmIHRoZSBTRVQgaXRzZWxmIGlzIGVuY3J5cHRlZCwgdGhlIGF0dGFja2VyIGlzIGFi bGUgdG8gZ2V0IA0Kc29tZSB1c2VmdWwgaW5mb3JtYXRpb24gaWYgaXQgY2FuIHJlYWQgSFRUUCBy ZXNwb25zZXMgKGUuZy4gaWYgaXQgaXMgb24gdGhlIHBhdGgpLg0KSW4gcGFydGljdWxhciwgaXQg Y2FuIGxlYXJuIHdoZXRoZXIgdGhlIFNFVCBpcyBhY2NlcHRlZCBvciBub3QNCmFuZCB0aGUgcmVh c29uIGZvciBpdHMgcmVqZWN0aW9uLg0KDQpNaWtlPiBJIGFkZGVkIGEgbmV3IHBhcmFncmFwaCBh dCB0aGUgZW5kIG9mIHRoZSBQcml2YWN5IENvbnNpZGVyYXRpb25zIHNlY3Rpb24gaHR0cHM6Ly90 b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWlldGYtc2VjZXZlbnQtaHR0cC1wdXNoLTExI3NlY3Rp b24tNiB0byBhZGQgdGhpcyBpbmZvcm1hdGlvbi4NCg0KTWlub3IgaXNzdWVzOg0KDQoxLiBTZWN0 aW9uIDUuMToNCg0KICAgVGhpcyBbdXNpbmcgSldTXSBlbmFibGVzIHRoZSBTRVQNCiAgIFJlY2lw aWVudCB0byB2YWxpZGF0ZSB0aGF0IHRoZSBTRVQgVHJhbnNtaXR0ZXIgaXMgYXV0aG9yaXplZCB0 bw0KICAgZGVsaXZlciB0aGUgU0VULg0KDQpJIHRoaW5rIHRoaXMgc2VudGVuY2UgaXMgZm9ybWFs bHkgd3JvbmcsIGJlY2F1c2UgU0VUIHNpZ25hdHVyZSBhbGxvd3MgdG8gaWRlbnRpZnkNClNFVCBJ c3N1ZXIsIGJ1dCBub3QgU0VUIFRyYW5zbWl0dGVyLiBGcm9tIG15IHJlYWRpbmcgb2YgdGhlIGRy YWZ0IA0KdGhleSBjYW4gYmUgZGlmZmVyZW50IGVudGl0aWVzLiBUaGUgU0VUIFRyYW5zbWl0dGVy IGluIHRoaXMgY2FzZSByZW1haW5zIG1vc3RseSBhbm9ueW1vdXMuDQoNCk1pa2U+IFRoYW5rcyAt IGNvcnJlY3RlZC4NCg0KMi4gU2VjdGlvbiA1LjI6DQoNCiAgIEFzIHN0YXRlZCBpbiBTZWN0aW9u IDIuNy4xIG9mIFtSRkM3MjMwXSwgYW4gSFRUUCByZXF1ZXN0b3IgTVVTVCBOT1QNCiAgIGdlbmVy YXRlIHRoZSAidXNlcmluZm8iIChpLmUuLCB1c2VybmFtZSBhbmQgcGFzc3dvcmQpIGNvbXBvbmVu dCAoYW5kDQogICBpdHMgIkAiIGRlbGltaXRlcikgd2hlbiBhbiAiaHR0cCIgVVJJIHJlZmVyZW5j ZSBpcyBnZW5lcmF0ZWQgd2l0aCBhDQogICBtZXNzYWdlLCBhcyB0aGV5IGFyZSBub3cgZGlzYWxs b3dlZCBpbiBIVFRQLg0KDQpUaGlzIHJlcXVpcmVtZW50IGlzIGFscmVhZHkgaW4gUkZDNzIzMCwg c28gaXMgdGhlcmUgYW55IG5lZWQgdG8gcmVwZWF0IGl0Pw0KSXMgaXQgcmVsYXRlZCB0byBzZWN1 cml0eSBvciB0byBpbnRlcm9wZXJhYmlsaXR5PyBJbiB0aGUgbGF0dGVyIGNhc2UgDQppdCdzIGJl dHRlciB0byBtZW50aW9uIHRoaXMgcmVxdWlyZW1lbnQgaW4gU2VjdGlvbiAyLjEuIEluIHRoZSBm b3JtZXIgY2FzZSBhIGZldyB3b3JkcyANCmV4cGxhaW5pbmcgc2VjdXJpdHkgaW1wbGljYXRpb25z IG9mIHRoaXMgcmVxdWlyZW1lbnQgd291bGQgaGVscC4NCg0KTWlrZT4gSSBkZWxldGVkIHRoaXMg cmVkdW5kYW50IHN0YXRlbWVudC4NCg0KMy4gU2VjdGlvbiA1LjQ6DQoNCiAgIFRoaXMgbWF5IGJl DQogICBtaXRpZ2F0ZWQgYnkgYXV0aGVudGljYXRpbmcgU0VUIFRyYW5zbWl0dGVycyB3aXRoIGEg bWVjaGFuaXNtIHdpdGgNCiAgIGxvdyBydW50aW1lIG92ZXJoZWFkLCBzdWNoIGFzIG11dHVhbCBU TFMuDQoNCkkgZG9uJ3QgdGhpbmsgdGhhdCBUTFMgY2FuIGJlIGF0dHJpYnV0ZWQgYXMgImEgbWVj aGFuaXNtIHdpdGggDQpsb3cgcnVudGltZSBvdmVyaGVhZCIgd2hlbiB5b3UgdGFsayBhYm91dCBE b1MgcHJvdGVjdGlvbi4NClRMUyBpdHNlbGYgbWF5IGJlIGEgdGFyZ2V0IGZvciBEb1MgYXR0YWNr cywgYmVjYXVzZSANCnNlcnZlciBoYXZlIHRvIGRvIHF1aXRlIGEgbG90IG9mIGNvbXB1dGF0aW9u cyBiZWZvcmUgDQpjbGllbnQgcHJlc2VudHMgaXRzIGF1dGhlbnRpY2F0aW9uIGluZm9ybWF0aW9u LCB3aGljaCBtYXkgYmUgYm9ndXMuDQpTbywgaXQgaGFzIGV4YWN0bHkgdGhlIHNhbWUgcHJvYmxl bSB5b3UgZGVzY3JpYmVkIGVhcmxpZXIgaW4gdGhpcyBwYXJhLg0KDQpNaWtlPiBJIGRlbGV0ZWQg dGhlICJsb3cgcnVudGltZSBvdmVyaGVhZCIgY2xhdXNlLg0KDQo0LiBTZWN0aW9uIDYuDQoNCiAg IEluIHNvbWUgY2FzZXMsIHN1YmplY3QgaWRlbnRpZmllcnMgdGhlbXNlbHZlcyBtYXkgYmUgY29u c2lkZXJlZA0KICAgc2Vuc2l0aXZlIGluZm9ybWF0aW9uLCBzdWNoIHRoYXQgdGhlaXIgaW5jbHVz aW9uIHdpdGhpbiBhIFNFVCBtYXkgYmUNCiAgIGNvbnNpZGVyZWQgYSB2aW9sYXRpb24gb2YgcHJp dmFjeS4gIFNFVCBUcmFuc21pdHRlcnMgc2hvdWxkIGNvbnNpZGVyDQogICB0aGUgcmFtaWZpY2F0 aW9ucyBvZiBzaGFyaW5nIGEgcGFydGljdWxhciBzdWJqZWN0IGlkZW50aWZpZXIgd2l0aCBhDQog ICBTRVQgUmVjaXBpZW50IChlLmcuLCB3aGV0aGVyIGRvaW5nIHNvIGNvdWxkIGVuYWJsZSBjb3Jy ZWxhdGlvbiBhbmQvb3INCiAgIGRlLWFub255bWl6YXRpb24gb2YgZGF0YSkgYW5kIGNob29zZSBh cHByb3ByaWF0ZSBzdWJqZWN0IGlkZW50aWZpZXJzDQogICBmb3IgdGhlaXIgdXNlIGNhc2VzLg0K DQpJbiBteSB1bmRlcnN0YW5kaW5nIG9mIHRoZSBkcmFmdCBTRVQgVHJhbnNtaXR0ZXJzIG1heSBi ZSBkaWZmZXJlbnQNCmVudGl0aWVzIGZyb20gU0VUIElzc3VlcnMuIEkgdGhpbmsgaXQgaXMgU0VU IElzc3VlcnMgd2hvIHByZXBhcmUgU0VUcywNCm5vdCBTRVQgVHJhbnNtaXR0ZXJzLiBJbiBnZW5l cmFsIFNFVCBUcmFuc21pdHRlcnMgZG9uJ3Qga25vdyANCndoYXQncyBpbnNpZGUgdGhlIFNFVCAo aWYgSldFIGlzIHVzZWQpIGFuZCBjYW5ub3QgbW9kaWZ5IGl0IChpZiBKV1MgaXMgdXNlZCkuDQoN Ck1pa2U+IEdvb2QgY2F0Y2guICBJIGNoYW5nZWQgIlNFVCBUcmFuc21pdHRlcnMiIHRvICJTRVQg SXNzdWVycyIuDQoNCjUuIChub3QgcmVsYXRlZCB0byBzZWN1cml0eSkgU2VjdGlvbiAyLjQ6DQoN CiAgIEltcGxlbWVudGF0aW9ucyBTSE9VTEQgZXhwZWN0IHRoYXQgb3RoZXIgRXJyb3IgQ29kZXMg TUFZIGFsc28gYmUNCiAgIHJlY2VpdmVkLCBhcyB0aGUgc2V0IG9mIEVycm9yIENvZGVzIGlzIGV4 dGVuc2libGUgdmlhIHRoZSBJQU5BDQogICAiU2VjdXJpdHkgRXZlbnQgVG9rZW4gRGVsaXZlcnkg RXJyb3IgQ29kZXMiIHJlZ2lzdHJ5IGVzdGFibGlzaGVkIGluDQogICBTZWN0aW9uIDcuMS4NCg0K SSB0aGluayB0aGF0IHRoZSBub3JtYXRpdmUgIk1BWSBpcyB1c2VkIGltcHJvcGVybHkgaGVyZSBh bmQgc2hvdWxkIGJlICJtYXkiIGluc3RlYWQuDQpJIGFsc28gdGhpbmsgdGhhdCBzb21lIHdvcmRz IG9mIHdoYXQgaW1wbGVtZW50YXRpb25zIHNob3VsZCBkbyB3aXRoIA0KdW5rbm93biBlcnJvciBj b2RlcyB3b3VsZCBoZWxwLg0KDQpNaWtlPiBUaGFua3MgLSBjb3JyZWN0ZWQuDQoNCk5pdHM6DQox LiBUYWJsZSAxIGlzIGRpZmZpY3VsdCB0byByZWFkIGR1ZSB0byB1bnVzdWFsIHRleHQgZm9ybWF0 dGluZyB3aXRoaW4gdGhlIGNlbGxzLg0KDQpNaWtlPiBJJ2xsIHdvcmsgb24gdGhpcyB3aXRoIHRo ZSBSRkMgZWRpdG9yLCBzaG91bGQgaXQgcmVtYWluIGRpZmZpY3VsdCB0byByZWFkIHdoZW4gdXNp bmcgeG1sMnJmYyB2MyBvdXRwdXQuDQoNCgkJCQlUaGFua3MgYWdhaW4sDQoJCQkJLS0gTWlrZQ0K DQoNCg== From nobody Tue Jun 9 07:11:23 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 05A1C3A0416; Tue, 9 Jun 2020 07:11:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yp4CSj6SF55L; Tue, 9 Jun 2020 07:11:19 -0700 (PDT) Received: from taper.sei.cmu.edu (taper.sei.cmu.edu [147.72.252.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A36EA3A0859; Tue, 9 Jun 2020 07:11:14 -0700 (PDT) Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by taper.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 059EB9Zp010380; Tue, 9 Jun 2020 10:11:09 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 taper.sei.cmu.edu 059EB9Zp010380 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1591711870; bh=lVSjHtK7vhJLUX5EgBWgKyRsdnHQS3FsMir52eHwX3c=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=RnOGX3UKyvaQo5ZTD+GrRjREzkknJxgdrMDXcnRnYxmqJG5YWs74ncUJakiCVQhov h4eVBSxCssG+9lMi44REewjn5RTy4A8dWdgS5q5ruyZllD2TSeoqETaNt/MunxEITv 3PRP/prKX9jLZs2UjHKpYN6loQH5uldC9yiKnFDs= Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 059EB72p017901; Tue, 9 Jun 2020 10:11:07 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by CASCADE.ad.sei.cmu.edu (10.64.28.248) with Microsoft SMTP Server (TLS) id 14.3.487.0; Tue, 9 Jun 2020 10:11:07 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MORRIS.ad.sei.cmu.edu (147.72.252.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Tue, 9 Jun 2020 10:11:06 -0400 Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.1979.003; Tue, 9 Jun 2020 10:11:06 -0400 From: Roman Danyliw To: Linda Dunbar , Mike Jones , "Matthew A. Miller" , "secdir@ietf.org" CC: "draft-ietf-cose-webauthn-algorithms.all@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 Thread-Index: AQHWNIYC1aJIGWNR90qAzoGEozBkOqjHaHwAgAAxjgCACMwQwA== Date: Tue, 9 Jun 2020 14:11:06 +0000 Message-ID: <07bf4fd695654e66a1084ab2c15b409a@cert.org> References: <159053708200.16306.10159573848968846851@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.202.211] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jun 2020 14:11:22 -0000 Hi Linda, thank you for this review. =20 Hi Mike, thank you for incorporating the feedback in -07. I entered a No Objection ballot. Regards, Roman > -----Original Message----- > From: COSE On Behalf Of Linda Dunbar > Sent: Wednesday, June 3, 2020 3:49 PM > To: Mike Jones ; Matthew A. Miller > ; secdir@ietf.org > Cc: draft-ietf-cose-webauthn-algorithms.all@ietf.org; last-call@ietf.org; > cose@ietf.org > Subject: Re: [COSE] Secdir last call review of draft-ietf-cose-webauthn- > algorithms-06 >=20 > Mike, >=20 > Thank you for the change. >=20 > Linda >=20 > -----Original Message----- > From: Mike Jones > Sent: Wednesday, June 3, 2020 11:52 AM > To: Linda Dunbar ; Matthew A. Miller > ; secdir@ietf.org > Cc: cose@ietf.org; draft-ietf-cose-webauthn-algorithms.all@ietf.org; last= - > call@ietf.org > Subject: RE: Secdir last call review of draft-ietf-cose-webauthn-algorith= ms-06 >=20 > Thanks again for your review, Linda. > https://nam11.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Ftools= .ie > tf.org%2Fhtml%2Fdraft-ietf-cose-webauthn-algorithms-07%23section- > 5.2&data=3D02%7C01%7Clinda.dunbar%40futurewei.com%7C4025d38884a > e4d1a9a5b08d807de6562%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C > 1%7C637267999048635328&sdata=3DoGsafk80fAFxgfMfx3wUPwlrVexjGyV > vsHDZfrKdpyo%3D&reserved=3D0 adds the requested clarification that SH= A- > 256, SHA-384, and SHA-512 are the SHA-2 hash functions. >=20 > -- Mike >=20 > -----Original Message----- > From: Linda Dunbar > Sent: Wednesday, May 27, 2020 5:22 PM > To: Matthew A. Miller ; secdir@ietf.org > Cc: cose@ietf.org; draft-ietf-cose-webauthn-algorithms.all@ietf.org; last= - > call@ietf.org > Subject: [EXTERNAL] RE: Secdir last call review of draft-ietf-cose-webaut= hn- > algorithms-06 >=20 > Matthew, >=20 > That is what I was thinking. Can you add a sentence in Section 5.2 to say= that > this is for the collection of SHA-256, SHA-384, SHA-512 algorithms? > Otherwise, the two sections of the document don't match. >=20 > Thank you > Linda Dunbar >=20 > -----Original Message----- > From: Matthew A. Miller > Sent: Wednesday, May 27, 2020 4:55 PM > To: Linda Dunbar ; secdir@ietf.org > Cc: cose@ietf.org; draft-ietf-cose-webauthn-algorithms.all@ietf.org; last= - > call@ietf.org > Subject: Re: Secdir last call review of draft-ietf-cose-webauthn-algorith= ms-06 >=20 > Hello Linda, >=20 > Thanks for the review. Speaking on the author's behalf, SHA-2 is defined= as the > collection of hash algorithms, including all of those cited (SHA-256, SHA= -384, > SHA-512). Do you believe it is critical to call this out explicitly? >=20 >=20 > - m&m >=20 > Matthew A. Miller > On 20/05/26 17:51, Linda Dunbar via Datatracker wrote: > > Reviewer: Linda Dunbar > > Review result: Not Ready > > > > I have reviewed this document as part of the security directorate's > > ongoing effort to review all IETF documents being processed by the > > IESG. These comments were written primarily for the benefit of the sec= urity > area directors. > > Document editors and WG chairs should treat these comments just like > > any other last call comments. > > > > This document is to list down the COSE&JOSE Algorithms to be > > registered to IANA. But it seems the description is not complete. In > > the Section 2: among the > > 4 algorithms listed under RSASSA-PKCS1-v1_5, three are NOT > > recommended, one is deprecated. Under the Security Consideration > > (Section 5), Section 5.2 describes why SHA-2 is "Not Recommended", > > Section 5.3 describes why SHA-1 is "Deprecated". What about the > > description on why SHA-512, SHA-384, and SHA-256 are not recommended? > Is the missing description intended? > > > > Best Regards, > > > > Linda Dunbar > > > > > > > _______________________________________________ > COSE mailing list > COSE@ietf.org > https://www.ietf.org/mailman/listinfo/cose From nobody Tue Jun 9 10:37:09 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5072A3A0ACE; Tue, 9 Jun 2020 10:37:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jwch6uiV4v2V; Tue, 9 Jun 2020 10:37:05 -0700 (PDT) Received: from veto.sei.cmu.edu (veto.sei.cmu.edu [147.72.252.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4368C3A0988; Tue, 9 Jun 2020 10:37:05 -0700 (PDT) Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by veto.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 059Haqt9022512; Tue, 9 Jun 2020 13:36:52 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu 059Haqt9022512 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1591724212; bh=NTYim7DEuWDJJAnrcERFzk/bLJPtag4dLZ14mqDNtWA=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=ZJf4rKHzner0BfGqAXMLS52YOPWpe4wq7nybx8WKoe3SP1IhR9ajeZBiP4juBuPte YwVXGJgwpp/ggxeeLcbJ9IhZjlax+zt8kOPfGS7AiPZ8uTxwqbb92ktWy84GOJk25v RufsiULTclyW5H244wraiNJ7V9tdWBgMxv/6B+g0= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 059HapZk009196; Tue, 9 Jun 2020 13:36:51 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by CASSINA.ad.sei.cmu.edu (10.64.28.249) with Microsoft SMTP Server (TLS) id 14.3.487.0; Tue, 9 Jun 2020 13:36:51 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MORRIS.ad.sei.cmu.edu (147.72.252.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Tue, 9 Jun 2020 13:36:51 -0400 Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.1979.003; Tue, 9 Jun 2020 13:36:51 -0400 From: Roman Danyliw To: "Nancy Cam-Winget (ncamwing)" , Jim Schaad , "secdir@ietf.org" CC: "cose@ietf.org" , "draft-ietf-cose-rfc8152bis-algs.all@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-cose-rfc8152bis-algs-08 Thread-Index: AQHWNeFt5VhUvxstA0OWoBPYMGiOqajQnTHA Date: Tue, 9 Jun 2020 17:36:51 +0000 Message-ID: <835a6903f5204feab56d4f76901bb0e1@cert.org> References: <159052818935.17307.5095159295288146706@ietfa.amsl.com> <041f01d635dd$ad489cf0$07d9d6d0$@augustcellars.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.202.211] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-cose-rfc8152bis-algs-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Jun 2020 17:37:07 -0000 SGkgTmFuY3ksIHRoYW5rIHlvdSBmb3IgdGhpcyByZXZpZXcuICANCg0KSGkgSmltLCB0aGFuayB5 b3UgZm9yIGluY29ycG9yYXRpbmcgdGhlIGZlZWRiYWNrIGluIC0wOQ0KDQpJIGVudGVyZWQgYSBO byBPYmplY3Rpb24gYmFsbG90Lg0KDQpSZWdhcmRzLA0KUm9tYW4NCg0KPiAtLS0tLU9yaWdpbmFs IE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBOYW5jeSBDYW0tV2luZ2V0IChuY2Ftd2luZykgPG5jYW13 aW5nQGNpc2NvLmNvbT4NCj4gU2VudDogRnJpZGF5LCBNYXkgMjksIDIwMjAgMTo0OSBQTQ0KPiBU bzogSmltIFNjaGFhZCA8aWV0ZkBhdWd1c3RjZWxsYXJzLmNvbT47IHNlY2RpckBpZXRmLm9yZw0K PiBDYzogY29zZUBpZXRmLm9yZzsgbGFzdC1jYWxsQGlldGYub3JnOyBkcmFmdC1pZXRmLWNvc2Ut cmZjODE1MmJpcy0NCj4gYWxncy5hbGxAaWV0Zi5vcmcNCj4gU3ViamVjdDogUmU6IFNlY2RpciBs YXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0LWlldGYtY29zZS1yZmM4MTUyYmlzLWFsZ3MtMDgNCj4g DQo+IEhpIEppbSwNCj4gVGhhbmtzIGZvciBhZGRyZXNzaW5nIHRoZSBjb21tZW50cyEgIEFuc3dl cnMgYmVsb3c6DQo+IA0KPiDvu79PbiA1LzI5LzIwLCAxMDoyMiBBTSwgIkppbSBTY2hhYWQiIDxp ZXRmQGF1Z3VzdGNlbGxhcnMuY29tPiB3cm90ZToNCj4gDQo+ICAgICBIaSBOYW5jeSwNCj4gDQo+ ICAgICBDb21tZW50cyBpbmxpbmUuDQo+IA0KPiAgICAgSmltDQo+IA0KPiANCj4gICAgIC0tLS0t T3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+ICAgICBGcm9tOiBOYW5jeSBDYW0tV2luZ2V0IHZpYSBE YXRhdHJhY2tlciA8bm9yZXBseUBpZXRmLm9yZz4NCj4gICAgIFNlbnQ6IFR1ZXNkYXksIE1heSAy NiwgMjAyMCAyOjIzIFBNDQo+ICAgICBUbzogc2VjZGlyQGlldGYub3JnDQo+ICAgICBDYzogY29z ZUBpZXRmLm9yZzsgbGFzdC1jYWxsQGlldGYub3JnOyBkcmFmdC1pZXRmLWNvc2UtcmZjODE1MmJp cy0NCj4gYWxncy5hbGxAaWV0Zi5vcmcNCj4gICAgIFN1YmplY3Q6IFNlY2RpciBsYXN0IGNhbGwg cmV2aWV3IG9mIGRyYWZ0LWlldGYtY29zZS1yZmM4MTUyYmlzLWFsZ3MtMDgNCj4gDQo+ICAgICBS ZXZpZXdlcjogTmFuY3kgQ2FtLVdpbmdldA0KPiAgICAgUmV2aWV3IHJlc3VsdDogSGFzIE5pdHMN Cj4gDQo+ICAgICBJT1RESVIgcmV2aWV3IG9mIGRyYWZ0LWlldGYtY29zZS1yZmM4MTUyYmlzLWFs Z3MtMDgNCj4gDQo+ICAgICBSZXZpZXdlcjogTmFuY3kgQ2FtLVdpbmdldA0KPiANCj4gICAgIEkg aGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVj dG9yYXRlJ3PDiiBvbmdvaW5nDQo+IGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRz IGJlaW5nIHByb2Nlc3NlZCBieSB0aGXDiiBJRVNHLsOKw4pUaGVzZQ0KPiBjb21tZW50cyB3ZXJl IHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGXDiiBzZWN1cml0eSBhcmVh DQo+IGRpcmVjdG9ycy7DisOKRG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0 cmVhdMOKIHRoZXNlIGNvbW1lbnRzDQo+IGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNv bW1lbnRzLg0KPiANCj4gICAgIFRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIGFuIGluaXRpYWwgc2V0 IG9mIGNyeXB0b2dyYXBoaWMgYWxnb3JpdGhtcyB1c2VkIHRvDQo+IHByb3RlY3QgQ0JPUiwgSSBi ZWxpZXZlIHRoaXMgZG9jdW1lbnQgaXMgYWxtb3N0IHJlYWR5LCBiYXJyaW5nIHNvbWUgZWRpdG9y aWFsDQo+IG5pdHMgKEkgb25seSBtYWRlIGEgZmV3IGJlbG93KS4gIEluIGdlbmVyYWwsIHRoZSBk ZXNjcmlwdGlvbiBvZiB0aGUgImluaXRpYWwiDQo+ICAgICBzZXQgb2YgYWxnb3JpdGhtcyB1c2Vk IGluIENPU0UgbWFrZSBzZW5zZSBhbmQgaXQgaXMgZ29vZCB0byBzZWUgZWFjaCBzZWN0aW9uDQo+ IGNhcnJ5IHRoZWlyIG93biBzZWN1cml0eSBzZWN0aW9uIGZvciBiZXR0ZXIgbWFwcGluZyBvZiB0 aGUgY29uc2lkZXJhdGlvbnMgYmFzZWQNCj4gb24gdGhlIHNlY3VyaXR5IGFsZ29yaXRobSBhcHBs aWVkLiAgQXMgYSByZWFkZXIgKGxpa2UgbXlzZWxmKSB3aG8gaXMgbm90IGZ1bGx5DQo+IHZlcnNh bnQgdG8gdGhlIG51YW5jZXMgb2YgQ0JPUiBpdCB3YXMgYSBsaXR0bGUgaGFyZCB0byBmb2xsb3cg YXMgdGhlIHN0cnVjdHVyZXMNCj4gYW5kIHRheG9ub215IGlzIGRlc2NyaWJlZCBpbiB0aGUgY29t cGFuaW9uIGRyYWZ0IChkcmFmdC1pZXRmLWNvc2UtcmZjODE1MmJpcy0NCj4gc3RydWN0KS4gQXMg YSB3aG9sZSwgSSB0aGluayB0aGUgZG9jdW1lbnQgaXMgY2xvc2UgdG8gcmVhZHksIEkgb25seSBu b3RlZCBhIGZldw0KPiB0ZWNobmljYWwgYW5kIGVkaXRvcmlhbCBuaXRzIGZvciB0aGUgZWFybGll ciBzZWN0aW9ucyBiZWxvdzoNCj4gDQo+ICAgICBTZWN0aW9uIDIuMToNCj4gICAgIC0gV2hhdCBm aWVsZCBkb2VzIHRoZSBFQ0RTQSBhbGdvcml0aG0gdmFsdWUgbWFwIHRvPyBJIHByZXN1bWUgaXQg aXMgdGhlICdhbGcnDQo+ICAgICBmaWVsZCAoaWYgcHJlc2VudCk/IEJ1dCBzaG91bGQgYmUgbWFk ZSBleHBsaWNpdC4gLSBJdCBzZWVtcyB0aGF0IHRoZSAic2hvdWxkIg0KPiAgICAgaW4gdGhlIDR0 aCBwYXJhZ3JhcGggaXMgbm9ybWF0aXZlIChlLmcuIFNIT1VMRCkgYXMgaXQgaXMgbmVlZGVkIGZv cg0KPiBpbnRlcm9wZXJhYmlsaXR5LCBhbmQgcGVyaGFwcyBldmVuIGEgTVVTVCBhcyBJJ20gbm90 IHNlZWluZyBuZWdvdGlhdGlvbiBvcg0KPiBzZWxlY3Rpb24gb2YgY3VydmUgY2hvaWNlLiAgU28s IGlmIGl0IGlzIHRvIGJlIGltcGxpY2l0LCB0aGVuIGEgTVVTVCB3b3VsZCBiZSBtb3JlDQo+IGFw cHJvcHJpYXRlLg0KPiAgICAgW0pMU10gSSBoYXZlIGFkZGVkIHRleHQgdG8gc2VjdGlvbiAxLjMg KHRlcm1pbm9sb2d5KSB0byBkZXNjcmliZSB0aGUgY29udGVudHMNCj4gb2YgdGhlIHRhYmxlcyB0 byBtYWtlIHdoYXQgdGhlIHZhbHVlIGlzIGNsZWFyZXIuDQo+IFtOQ1ddIFRoYW5rcywgdGhhdCB3 aWxsIGhlbHAuDQo+IA0KPiAgICAgW0pMU10gVGhlcmUgaXMgbm8gbmVlZCB0byBuZWdvdGlhdGUg dGhlIGN1cnZlIGFzIHRoaXMgaXMgaW1wbGljaXQgZnJvbSB0aGUgc2l6ZQ0KPiBvZiB0aGUgc2ln bmF0dXJlLiAgVGhhdCBpcyBQLTI1NiBpcyBnb2luZyB0byBlbmQgdXAgd2l0aCB0d28gMjU2LWJp dCB2YWx1ZXMgYXMNCj4gdGhlIHNpZ25hdHVyZS4gIE9uZSBpbXBsaWNhdGlvbiBpcyB0aGF0IG9u bHkgYSBzaW5nbGUgY3VydmUgb2YgYW55IGdpdmVuIGxlbmd0aA0KPiBjYW4gYmUgYXNzaWduZWQg dG8gRUNEU0EsIHRodXMgdGhlIGVmZm9ydCB0byB1c2UgdGhlIEVkMjU1MTkgY3VydmUgd2l0aCBF Q0RTQQ0KPiByZXF1aXJlcyBhIGRpZmZlcmVudCBpZGVudGlmaWVyIHNvIHRoYXQgdGhlcmUgaXMg bm8gY29uZnVzaW9uIG9uIHdoYXQgY3VydmUgaXMNCj4gYmVpbmcgdXNlZC4gIFRoaXMgbWVhbnMg dGhhdCB0aGUgbGVuZ3RoIG9mIHRoZSBoYXNoIGFsZ29yaXRobSBpcyBub3QgcGFydCBvZiB0aGlz DQo+IHNlbGVjdGlvbiBwcm9jZXNzLiAgSXQgaXMgdGhlcmVmb3JlIHBvc3NpYmxlIHRvIHVzZSBT SEEtMjU2IHdpdGggUC01MjEgYW5kIFNIQS0NCj4gNTEyIHdpdGggUC0yNTYgKHRoZSBoYXNoIHZh bHVlIGlzIHRydW5jYXRlZCBpbiB0aGlzIGNhc2UpLiAgVGhlIG9ubHkgaXNzdWUgaXMgdGhhdA0K PiBpZiBhIHBpZWNlIG9mIGhhcmR3YXJlIHN1cHBvcnRzIHRoZSBQLTI1NiBjdXJ2ZSB0aGVuIGl0 IG1pZ2h0IG9ubHkgc3VwcG9ydCBTSEEtDQo+IDI1NiBhbmQgdGh1cyB3b3VsZCBub3QgYmUgYWJs ZSB0byB2YWxpZGF0ZSBhIHNpZ25hdHVyZSB0aGF0IHVzZXMgU0hBLTUxMi4NCj4gVGhlcmUgaXMg bm8gc3BlY2lhbCBzZWN1cml0eSBpc3N1ZSBoZXJlLCB0aGlzIGlzIGp1c3QgYSByZWNvbW1lbmRh dGlvbiBmb3IgbWFraW5nDQo+IHRoaW5ncyBtb3JlIGxpa2VseSB0byBzdWNjZWVkLiBUaGlzIGlz IHRoZSByZWFzb24gdGhhdCBpdCBpcyBub3QgYSAnU0hPVUxEJyBvcg0KPiAnTVVTVCcgYnV0IGlz IGFuICdzdWdnZXN0ZWQnLiAgRG9lcyB0aGlzIGJvdGggbWFrZSB0aGluZ3MgY2xlYXJlciBhbmQg cmVkdWNlDQo+IHRoZSBmZWVsaW5nIG9uIHlvdSBwYXJ0IHRoYXQgYSBzdHJvbmdlciBzdGF0ZW1l bnQgaXMgbmVlZGVkPw0KPiBbTkNXXSBBZ3JlZSB0aGF0IHRoZXJlIGlzIG5vIHNlY3VyaXR5IGlz c3VlLCBpdCB3YXMgbW9yZSBvZiBicmVha2luZw0KPiBpbnRlcm9wZXJhYmlsaXR5LiAgSSBkb24n dCBmZWVsIHN0cm9uZ2x5IGVpdGhlciB3YXksIGl0IHdhcyBieSB0aGUgd2F5IGl0IHJlYWRzLi4u LmlmDQo+IHlvdSB3YW50IHRvIGVuc3VyZSBpbnRlcm9wZXJhYmlsaXR5IHRoZSBpdCBzZWVtcyB0 aGF0IHN0cm9uZ2VyIGxhbmd1YWdlIHdvdWxkDQo+IGJlIG5lZWRlZCAoYnV0IHRoYXTigJlzIG15 IHBlcnNvbmFsIGJpYXMpLg0KPiANCj4gICAgIFNlY3Rpb24gMi4yOg0KPiAgICAgLSBUaGUgcmF0 aW9uYWxlVGhlcmUgbWF5IGJlIHNvbWUgY29ybmVyIGNhc2UgaW4gd2hpY2ggdGhlcmUgbWF5IGJl IGEgdmVyeQ0KPiBsYXJnZQ0KPiAgICAgKDJLPykgc3RydWN0dXJlIHRvIGJlIHByb3RlY3RlZC4g IEl0IHdvdWxkIGJlIGJldHRlciB0byBxdWFudGlmeSAiZXh0cmVtZWx5DQo+IGxhcmdlIiBvciBw ZXJoYXBzIGFub3RoZXIvYWRkaXRpb25hbCByYXRpb25hbGUgZm9yIHRoZSBuZWVkIHRvIE9OTFkg ZG8gUHVyZQ0KPiBlZERTQSBpcyB0aGUgaW50ZW50IGZvciBjb25zdHJhaW5lZCBkZXZpY2VzIG5v dCBoYXZlIGVub3VnaCBtZW1vcnkgdG8NCj4gY29tcHV0ZSB0aGUgYmxvY2sgdXBkYXRlcy4NCj4g DQo+ICAgICBbSkxTXSBJIGRvbid0IGtub3cgdGhhdCBJIHdvdWxkIGNvbnNpZGVyIGEgMksgbWVz c2FnZSB0byBiZSB2ZXJ5IGxhcmdlLCBJDQo+IHdvdWxkIGV4cGVjdCBhIGZpcm13YXJlIHVwZGF0 ZSB0byBiZSBhdCBsZWFzdCB0aGF0IGxhcmdlLiAgVGhlIGlzc3VlIGlzIHRoYXQNCj4gRWREU0Eg bmVlZHMgdG8gZG8gdHdvIHBhc3NlcyBvdmVyIHRoZSBtZXNzYWdlLCB0aGlzIG1lYW5zIHRoYXQg dGhlIGVudGlyZQ0KPiBtZXNzYWdlIG5lZWRzIHRvIGJlIGhlbGQgaW4gbWVtb3J5LiAgVGhhdCB3 b3VsZCBiZSBsaW1pdGF0aW9uIG9uIHdoYXQgSQ0KPiB3b3VsZCBjb25zaWRlciB0byBiZSAiZXh0 cmVtZWx5IGxhcmdlIi4gIFRoZSBwcmVzdW1wdGlvbiBpcyB0aGF0IG9uZSBpcyBub3QNCj4gZ29p bmcgdG8gdHJ5IGFuZCBjcmVhdGUgYW5kIHN0cmVhbSB0aGUgb2JqZWN0IG91dCBhcyB0aGlzIHdv dWxkIGFsc28gcmVxdWlyZSBhDQo+IHN0cmVhbWluZyBwcm9jZXNzaW5nIG9uIHRoZSByZWNpcGll bnQuICBJZiBzdHJlYW1pbmcgaXMgcmVtb3ZlZCBmcm9tIHRoZQ0KPiBlcXVhdGlvbiB0aGVuIHRo ZXJlIGlzIG5vIGJlbmVmaXQgbm90IHRvIHVzZSBQdXJlIEVkRFNBLiAgIFRoaXMgbWVhbnMgdGhh dCBvbmVzDQo+IGlkZWEgb2YgbGFyZ2UgaXMgZ29pbmcgdG8gYmUgdmVyeSBkZXZpY2Ugc3BlY2lm aWMuICBJIHdpbGwgbm90IGJlIHN1cnByaXNlZCBpZiBzb21lDQo+IGZpcm13YXJlIHBhY2thZ2Vz IGRvIGluZGlyZWN0IHNpZ25pbmcsIGJ1dCB0aGUgbWFuaWZlc3QgZGVzY3JpcHRpb24gaXMgc3Rp bGwgZ29pbmcNCj4gdG8gbmVlZCB0byBmaXQgaW4gbWVtb3J5Lg0KPiBbTkNXXSAyS2J5dGVzIGNh biBzZWVtIHZlcnkgbGFyZ2UgdG8gc29tZSBJb1QgZGV2aWNlcyBfXy4gIEJ1dCB5b3VyIHBvaW50 IGlzDQo+IHdlbGwgdGFrZW4uLi5zb3JyeSBpZiBJIHdhcyB0b28gbml0LXBpY2t5Li4uLmFzIGZv ciBndWlkYW5jZSBJIHBlcnNvbmFsbHkgcHJlZmVyIHRvDQo+IGhhdmUgcXVhbnRpZmljYXRpb24g KHJhbmdlcykuDQo+IA0KPiAgICAgU2VjdGlvbiA0LjEuMToNCj4gICAgIC0gR0NNJ3MgbGltaXRh dGlvbiBmb3Igb25lIGVuY3J5cHRpb24gc3RyaW5nIGlzIDJeMzktMjU2IGUuZy4gbm90ICJhIHNp bmdsZQ0KPiBrZXkiLi4uLnNvIHN1ZmZpY2llbnRseSBsYXJnZSBmb3IgQ09TRSEgIEhvd2V2ZXIs IGl0IGRvZXMgbWVhbiB0aGF0IHRoZSBub25jZQ0KPiBNVVNUIGJlIHVuaXF1ZSBmb3IgZXZlcnkg ZW5jcnlwdGVkIG1lc3NhZ2UgKGUuZy4gdGhlIGJ1bGxldCBiZWZvcmUgdGhpcyBvbmUgaXMNCj4g Y29ycmVjdCkuICBJIHRoaW5rIHRoZSBsaW1pdCBmb3Igb25lIGtleSB1c2luZyBHQ00gaXMgYmFz ZWQgb24gdGhlIHNpemUgb2YgdGhlDQo+IG5vbmNlIGFzIGl0IG11c3QgYmUgdW5pcXVlLg0KPiAg ICAgW0pMU10gWW91IGFyZSBnb2luZyB0byBtYWtlIG1lIGxvb2sgdGhpcyB1cCBhZ2Fpbi4gIEhv d2V2ZXIgSSB0aGluayB0aGF0IHRoaXMNCj4gbGltaXQgbWF5IGVuZCB1cCBiZWluZyBzbWFsbGVy IHdpdGggbW9yZSBtb2Rlcm4gYW5hbHlzaXMgc28gZ29pbmcgYmFjayBhbmQNCj4gcmUtLWNoZWNr aW5nIHRoaXMgaXMgZ29pbmcgdG8gYmUgd29ydGh3aGlsZS4gIEl0IGp1c3Qgd2lsbCB0YWtlIGEg ZmV3IGRheXMuDQo+IFtOQ1ddIE5vIHdvcnJpZXMsIGFzIGFuIGVhcmx5IGFkb3B0ZXIgb2YgR0NN LCBJIGRvIHJlY2FsbCB0aGF0IG51bWJlciBiZWluZw0KPiBmb3IgYSBwYWNrZXQuLi4uDQo+IA0K PiAgICAgU2VjdGlvbiA0LjI6DQo+ICAgICAtICdrJyBpcyB0aGUga2V5IHNpemUgaW4gYml0cyAo SSBwcmVzdW1lKSwgd291bGQgYmUgZ29vZCB0byBkZXNjcmliZSB0aGF0IGJlZm9yZQ0KPiB0aGUg dGFibGUuDQo+ICAgICBbSkxTXSBJIGNoYW5nZWQgdGhlIHRpdGxlIG9mIHRoZSBjb2x1bW4gdG8g J0tleSBMZW5ndGgnDQo+IFtOQ1ddIFRoYW5rcy4NCj4gDQo+ICAgICBFZGl0b3JpYWwgbml0czoN Cj4gICAgIFNlY3Rpb24gMS41DQo+ICAgICAtIFRoZSBzZWNvbmQgc2VudGVuY2UgaXMgaGFyZCB0 byBwYXJzZS4gIElzIGl0IHRoYXQgdGhlIGludGVybWVkaWF0ZSB2YWx1ZXMNCj4gdXNlZCBmb3Ig ZGVidWdnaW5nIGFyZSByZXByZXNlbnRlZCBpbiBib3RoIGEgaGV4IGFzIHdlbGwgYXMgYSBDQk9S IGRpYWdub3N0aWMNCj4gbm90YXRpb24gZm9ybWF0Ij8gLSBUaGlyZCBzZW50ZW5jZSwgaXMgaXQg dGhhdCBzb21lIGV4YW1wbGVzIHdlcmUgZGVzaWduZWQgdG8NCj4gZmFpbCAoZS5nLiB0aGV5IGFy ZSAiZmFpbHVyZSB0ZXN0IGJhc2VzIik/DQo+ICAgICBbSkxTXSAgSSBoYXZlIHVwZGF0ZWQgdGhp cyBzZWN0aW9uLiAgSSB0aGluayB0aGF0IHRoaXMgc2hvdWxkIHNvbHZlIHlvdXIgaXNzdWVzLg0K PiAgICAgICAgICAgICA8dD4NCj4gICAgICAgICAgICAgICBBIEdpdEh1YiBwcm9qZWN0IGhhcyBi ZWVuIGNyZWF0ZWQgYXQgJmx0O2h0dHBzOi8vZ2l0aHViLmNvbS9jb3NlLQ0KPiB3Zy9FeGFtcGxl cyZndDsgdGhhdCBjb250YWlucyBhIHNldCBvZiB0ZXN0aW5nIGV4YW1wbGVzIGFzIHdlbGwuDQo+ ICAgICAgICAgICAgICAgRWFjaCBleGFtcGxlIGlzIGZvdW5kIGluIGEgSlNPTiBmaWxlIHRoYXQg Y29udGFpbnMgdGhlIGlucHV0cyB1c2VkIHRvDQo+IGNyZWF0ZSB0aGUgZXhhbXBsZSwgc29tZSBv ZiB0aGUgaW50ZXJtZWRpYXRlIHZhbHVlcyB0aGF0IGNhbiBiZSB1c2VkIGZvcg0KPiBkZWJ1Z2dp bmcsIGFuZCB0aGUgb3V0cHV0IG9mIHRoZSBleGFtcGxlLg0KPiAgICAgICAgICAgICAgIFRoZSBy ZXN1bHRzIGFyZSBlbmNvZGVkIHVzaW5nIGJvdGggaGV4YWRlY2ltYWwgYW5kIENCT1IgZGlhZ25v c3RpYw0KPiBub3RhdGlvbiBmb3JtYXQuDQo+ICAgICAgICAgICAgIDwvdD4NCj4gICAgICAgICAg ICAgPHQ+DQo+ICAgICAgICAgICAgICAgU29tZSBvZiB0aGUgZXhhbXBsZXMgYXJlIGRlc2lnbmVk IHRvIHRlc3QgZmFpbHVyZSBjYXNlOyB0aGVzZSBhcmUNCj4gY2xlYXJseSBtYXJrZWQgYXMgc3Vj aCBpbiB0aGUgSlNPTiBmaWxlLg0KPiAgICAgICAgICAgICAgIElmIGVycm9ycyBpbiB0aGUgZXhh bXBsZXMgaW4gdGhpcyBkb2N1bWVudCBhcmUgZm91bmQsIHRoZSBleGFtcGxlcyBvbg0KPiBHaXRI dWIgd2lsbCBiZSB1cGRhdGVkLCBhbmQgYSBub3RlIHRvIHRoYXQgZWZmZWN0IHdpbGwgYmUgcGxh Y2VkIGluIHRoZSBKU09OIGZpbGUuDQo+ICAgICAgICAgICAgIDwvdD4NCj4gICAgIFtOQ1ddIFRo YW5rIHlvdSwgSSBjYW4gcGFyc2UgdGhpcyBiZXR0ZXIuDQo+IA0KPiAgICAgU2VjdGlvbiAyLjI6 DQo+ICAgICAtIFRoZSByYXRpb25hbGUgZm9yIHdoeSBQdXJlIEVkRFNBIGlzIHVzZWQgb25seSAo dnMuIEhhc2hFZERTQSkgbWF5IGxlYXZlDQo+IG1vcmUgcm9vbSBmb3IgcXVlc3Rpb25zOyBhcyB0 aGVyZSBtYXkgYmUgc29tZSBjb3JuZXIgY2FzZSBpbiB3aGljaCB0aGVyZSBtYXkNCj4gYmUgYSB2 ZXJ5IGxhcmdlICgySz8pIHN0cnVjdHVyZSB0byBiZSBwcm90ZWN0ZWQuICBGb3IgdGhvc2UgdGhh dCBhcmUgaW4gdGhlDQo+IGhlYWx0aGNhcmUgc2VjdG9yIChvZiBJb1QpLCBJIGNvdWxkIHNlZSBw b3RlbnRpYWwgZm9yIGxhcmdlIGJsb2NrcyBhbmQgbWF5IHdvbmRlcg0KPiB3aGF0IHF1YWxpZmll cyBhcyAiZXh0cmVtZWx5IGxhcmdlIi4gIFJGQyA4MDMyIHNwZWFrcyB0byBIYXNoRWREU0EgYXMN Cj4gcHJvdmlkaW5nIGJldHRlciBjb2xsaXNpb24gcmVzaWxpZW5jZS4uLnNvIGFtIGluY2xpbmVk IHRvIHN1Z2dlc3QgdG8gZWl0aGVyIHJlbW92ZQ0KPiB0aGlzIHJhdGlvbmFsZSBvciBiZSBtb3Jl IGNvbXBsZXRlIGluIGp1c3RpZmljYXRpb24uDQo+ICAgICBbSkxTXSBTZWUgYWJvdmUuDQo+IFtO Q1ddIE9LDQo+IA0KPiAgICAgU2VjdGlvbiAzLjENCj4gICAgIC0gM3JkIHBhcmFncmFwaDogIlNv bWUgcmVjaXBpZW50IGFsZ29yaXRobXMgY2FycnkgdGhlIGtleSB3aGlsZSBvdGhlcnMgZGVyaXZl DQo+IGEga2V5IGZyb20gc2VjcmV0IGRhdGEiLi4uLkkgdGhpbmsgeW91IG1lYW4gIlNvbWUgYWxn b3JpdGhtcyBhcmUgdXNlZCB0bw0KPiB0cmFuc21pdCBhIGtleSwgZS5nLiBrZXkgd3JhcHBpbmcu IiAgIkNhcnJ5IHRoZSBrZXkiLCBpbiB0aGlzIHNlbnRlbmNlIGxlYWRzIG1lDQo+IHRvIGltcGx5 IGl0J3MgdGhlIHNhbWUga2V5IGJlaW5nIHVzZWQgaW4gdGhlIEhNQUMuDQo+ICAgICBbSkxTXSAg VGhpcyBpcyB0aGUgc2FtZSBrZXkgdGhhdCBpcyBiZWluZyB1c2VkIGluIHRoZSBITUFDIGFsZ29y aXRobS4gIEkgaGF2ZQ0KPiBjaGFuZ2VkICJjYXJyeSIgdG8gInRyYW5zcG9ydCIgYmVjYXVzZSBJ IHRoaW5rIHRoYXQgaXMgZ29pbmcgdG8gYmUgY2xlYXJlci4NCj4gW05DV10gWWVzLCBpbmRlZWQs IHRoYXQgbWFrZXMgaXQgYmV0dGVyLg0KPiANCj4gDQo+IA0KPiANCg0K From nobody Wed Jun 10 14:44:19 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E9683A154B; Wed, 10 Jun 2020 14:44:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ihtfp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ndzv2oFEiQqi; Wed, 10 Jun 2020 14:44:12 -0700 (PDT) Received: from mail2.ihtfp.org (MAIL2.IHTFP.ORG [204.107.200.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3F373A154D; Wed, 10 Jun 2020 14:44:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id 246AEE2040; Wed, 10 Jun 2020 17:44:10 -0400 (EDT) Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 02166-10; Wed, 10 Jun 2020 17:44:08 -0400 (EDT) Received: from securerf.ihtfp.org (IHTFP-DHCP-158.IHTFP.ORG [192.168.248.158]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mocana.ihtfp.org", Issuer "IHTFP Consulting Certification Authority" (not verified)) by mail2.ihtfp.org (Postfix) with ESMTPS id CAF06E203F; Wed, 10 Jun 2020 17:44:08 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ihtfp.com; s=default; t=1591825448; bh=joPEqoQgftydQwBZw/8rSd9PEK7LSL7gBIWV+nO3SzY=; h=From:To:Cc:Subject:Date; b=LNHCVKWZTb9T2HY6Nio5D43wyXY8hXSmXwvw4EdBrXdfAexn+euqOWQso1X0h1iRI /HZemtD+w0nmRs9ustjn/XcUjHs+NeZWnD1SB/6WmWRuWPtXbefB8o/8JeI8MnOVVG ynPJvyAY4bprSjUtlvls91B7sfIJu16lqtYAJVgo= Received: (from warlord@localhost) by securerf.ihtfp.org (8.15.2/8.15.2/Submit) id 05ALi7YB029459; Wed, 10 Jun 2020 17:44:07 -0400 From: Derek Atkins To: iesg@ietf.org, secdir@ietf.org Cc: cose-chairs@ietf.org, ietf@augustcellars.com Date: Wed, 10 Jun 2020 17:44:07 -0400 Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Virus-Scanned: Maia Mailguard 1.0.2a Archived-At: Subject: [secdir] sec-dir review of draft-ietf-cose-rfc8152bis-struct-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Jun 2020 21:44:14 -0000 Hi, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written with the intent of improving security requirements and considerations in IETF drafts. Comments not addressed in last call may be included in AD reviews during the IESG review. Document editors and WG chairs should treat these comments just like any other last call comments. Summary: * Ready to publish Details: * Just as a point of information, if I recall correctly I was also present when this topic was first discussed ;) -derek -- Derek Atkins 617-623-3745 derek@ihtfp.com www.ihtfp.com Computer and Internet Security Consultant From nobody Thu Jun 11 05:08:06 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E1B53A00B2 for ; Thu, 11 Jun 2020 05:08:05 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.3.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <159187728534.6365.6628750447053381926@ietfa.amsl.com> Date: Thu, 11 Jun 2020 05:08:05 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Jun 2020 12:08:05 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-06-11 Reviewer LC end Draft Shaun Cooley 2020-05-29 draft-ietf-ospf-te-link-attr-reuse-14 Alan DeKok 2020-05-29 draft-ietf-isis-te-app-14 Brian Weis 2020-05-26 draft-ietf-cose-hash-algs-04 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-08 Last calls: Reviewer LC end Draft John Bradley 2020-02-28 draft-ietf-regext-data-escrow-10 Shaun Cooley 2020-05-29 draft-ietf-ospf-te-link-attr-reuse-14 Alan DeKok 2020-05-29 draft-ietf-isis-te-app-14 Donald Eastlake R2019-11-14 draft-ietf-hip-dex-20 Donald Eastlake 2020-02-27 draft-ietf-6tisch-msf-16 Stephen Farrell 2020-06-15 draft-ietf-pim-igmp-mld-snooping-yang-12 Daniel Franke 2020-06-15 draft-ietf-ntp-mode-6-cmds-08 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-08 Daniel Gillmor 2020-06-12 draft-ietf-pce-stateful-pce-lsp-scheduling-14 Phillip Hallam-Baker 2020-06-11 draft-ietf-dots-use-cases-23 Dan Harkins None draft-ietf-rtgwg-policy-model-03 Russ Mundy 2020-01-02 draft-ietf-dprive-bcp-op-09 Magnus Nystrom 2019-04-10 draft-ietf-avtcore-multiplex-guidelines-11 Vincent Roca 2020-04-23 draft-ietf-detnet-ip-over-mpls-06 Stefan Santesson 2020-05-04 draft-ietf-httpbis-header-structure-19 Melinda Shore 2020-05-13 draft-ietf-secevent-http-poll-10 Tina Tsou 2020-05-08 draft-ietf-httpbis-client-hints-14 Sean Turner 2020-05-06 draft-ietf-opsawg-sdi-02 Samuel Weiler 2020-06-11 draft-ietf-trill-multilevel-single-nickname-10 Brian Weis 2020-05-26 draft-ietf-cose-hash-algs-04 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-09 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-08 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Early review requests: Reviewer Due Draft Steve Hanna 2020-06-30 draft-ietf-emu-eap-noob-01 Next in the reviewer rotation: Russ Housley Christian Huitema Leif Johansson Charlie Kaufman Scott Kelly Tero Kivinen Watson Ladd Chris Lonvick Aanchal Malhotra David Mandelberg From nobody Fri Jun 12 15:47:44 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 499A93A0E46 for ; Fri, 12 Jun 2020 15:47:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vqc8sXoUq_vv for ; Fri, 12 Jun 2020 15:47:41 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC3E63A0885 for ; Fri, 12 Jun 2020 15:47:41 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05CMlbOW012630 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 12 Jun 2020 18:47:39 -0400 Date: Fri, 12 Jun 2020 15:47:36 -0700 From: Benjamin Kaduk To: Sean Turner Cc: secdir@ietf.org Message-ID: <20200612224736.GS11992@kduck.mit.edu> References: <159166164723.4538.11036627051900835905@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <159166164723.4538.11036627051900835905@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-dhc-mac-assign-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 12 Jun 2020 22:47:43 -0000 Thanks, Sean -- we appreciate having the extra eyes on the doc. (As you saw, I put a Discuss position in for an aspect that was unclear and to avoid recommending that people do things that could lead to using conflicting addresses.) -Ben On Mon, Jun 08, 2020 at 05:14:07PM -0700, Sean Turner via Datatracker wrote: > Reviewer: Sean Turner > Review result: Has Nits > > Hi! I reviewed this draft, the directorate reviews, and the IESG > discuss/comments (and skimmed draft-ietf-dhc-slap-quadrant). > > This draft is about using DHCP to avoid collisions in certain environments > where randomized MAC addresses are used, e.g., huuuuge virtualization > deployments. > > 1. It is interesting to note that the actual probability of collisions is not > included in the draft. (ah I guess Ben noted this too) 2. I'd echo Barry's > comment about adding something about what the consequences of multiple devices > using the same MAC address. 3. Is it worth adding at least an informative > reference to some DoS mitigation techniques? > > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Sat Jun 13 08:18:11 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 358723A0933; Sat, 13 Jun 2020 08:18:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Daniel Franke via Datatracker To: Cc: ntp@ietf.org, last-call@ietf.org, draft-ietf-ntp-mode-6-cmds.all@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.3.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159206148916.27533.2080482554461273224@ietfa.amsl.com> Reply-To: Daniel Franke Date: Sat, 13 Jun 2020 08:18:09 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jun 2020 15:18:09 -0000 Reviewer: Daniel Franke Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written with the intent of improving security requirements and considerations in IETF drafts. Comments not addressed in last call may be included in AD reviews during the IESG review. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes a historic protocol whose design falls far short of modern IETF standards. Its myriad issues are well-described in the Security Considerations section. There has been some debate as to whether the appropriate status for this document is Historic or Informational. I believe the currently-intended Historic status is more appropriate. The argument I have heard repeatedly in favor of Informational status is that it is not appropriate to classify a protocol as Historic until a better alternative exists with a published specification. I believe that better alternative exists, which is to have no standard at all. It's perfectly fine for NTP monitoring and management protocols to be vendor-specific. In virtually all legitimate uses ("legitimate" so as to exclude RDoS attacks), both sides of the protocol run on systems managed by the same organization and the need for vendor-specific tools is not a practical issue. Lack of standardization is the already the status quo, since there are many widely-used NTP implementations out there but only the Network Time Foundation implementation and its derivatives (such as NTPsec) support this protocol. I know of nobody who has ever been inconvenienced by this; standardization is a solution in search of a problem. From nobody Sat Jun 13 11:15:27 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E07513A0E40 for ; Sat, 13 Jun 2020 11:15:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XFvX4dzs0JzZ for ; Sat, 13 Jun 2020 11:15:24 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 992673A0E39 for ; Sat, 13 Jun 2020 11:15:24 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id c14so12059020qka.11 for ; Sat, 13 Jun 2020 11:15:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to; bh=NH3MVpLLf3x6th1xNum2cE36ozt7/jLEs/b/RpgBZqM=; b=dycBA0B4dhOtclTYTajUsNRru39IMEBLLKRyDafMG9J3xxcMHisqqukNiGHN/xdWzx WUo1Rm+TKaXTm2TtOI7tAYxPoRCSw4LjKMqZYCvP+t/WpWEW8yDLJxVdsJJYbr5J4ih2 9xCRA3Lo7kb4hBo3ghFKM1RCN80YQmmTEBk+vqaWkjFOOs8tH0jAGBVGYLRXopBtEklU ljFmFq6dg6BGdJDLqz0y9JuxyFsjS5rghrBQugmucRawLkR26MUFE9iVbt46Shuub6M/ +OwWA6X7PybU+lW+/3reamuEF2dv5xx0f9gtGHRlOc8roIl8Md8nks03094EBm9kSqPW 0CsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=NH3MVpLLf3x6th1xNum2cE36ozt7/jLEs/b/RpgBZqM=; b=VbbKGy581/mSXL5u6uts/e+lAKqshh4m2Nt/BsYiCKm7afqK96Nk7Y0oINp52kevWe Va8OT99fNCjsEp8aXJtDNY4dUfQAorsZwDH9gT5HYYkFnj1GT+DI6gYAF+bbNsDkHuQh bEhAFVJJSUFGTTpUX7tfEcOsCcc4jM0w27wQtXtFEgQ20ni1fVe/SMhDsMQboClhsVkd mePMGJh4fXhDOB4jspewH3aC0t0T0VMetd54LGzgA2jlIlD0pIkj/yHQJtPGVohOFIbz dqBZujcvIzMY4X/4y+hsqx+mPyyClCDoXLYUM2YpNSPZcqL/eH5I8Ywsan4MPsOgl1GO H5eA== X-Gm-Message-State: AOAM530bC9k/XaQxzOinAc6k3otucmImyLsmqKkw9OKlb02YZlfdEBVq f1pO1YobP5J1ZDsBEhOk9DUL1g== X-Google-Smtp-Source: ABdhPJxNK81lLzRzBSeCNcYJiAtiVbGTlGTHfdZGPf7kd5WqMN1eMyRAdORXh6smPVs/YgjgNBXw1A== X-Received: by 2002:a05:620a:8cd:: with SMTP id z13mr8630706qkz.198.1592072123570; Sat, 13 Jun 2020 11:15:23 -0700 (PDT) Received: from LakeHartwell.local ([2601:154:c001:f99e:7c90:3d3e:34c5:9457]) by smtp.gmail.com with ESMTPSA id d13sm7206194qkc.121.2020.06.13.11.15.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 13 Jun 2020 11:15:22 -0700 (PDT) To: Daniel Franke , secdir@ietf.org Cc: ntp@ietf.org, last-call@ietf.org, draft-ietf-ntp-mode-6-cmds.all@ietf.org References: <159206148916.27533.2080482554461273224@ietfa.amsl.com> From: Brian Haberman Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: <4251f262-22f7-3b7d-41d4-e0c3ef1da1b8@innovationslab.net> Date: Sat, 13 Jun 2020 14:15:21 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <159206148916.27533.2080482554461273224@ietfa.amsl.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="aPtcZpmDiwweFM4VBRzCoCseLJU0qk1np" Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 13 Jun 2020 18:15:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --aPtcZpmDiwweFM4VBRzCoCseLJU0qk1np Content-Type: multipart/mixed; boundary="Y5BQ89AV1DpGcCYBjlWPxTOlC7oXjetAD" --Y5BQ89AV1DpGcCYBjlWPxTOlC7oXjetAD Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Thanks for the review, Daniel. A quick follow-up below for those of you playing along at home... On 6/13/20 11:18 AM, Daniel Franke via Datatracker wrote: > Reviewer: Daniel Franke > Review result: Ready >=20 > I have reviewed this document as part of the security directorate's ong= oing > effort to review all IETF documents being processed by the IESG. These= > comments were written with the intent of improving security requirement= s and > considerations in IETF drafts. Comments not addressed in last call may= be > included in AD reviews during the IESG review. Document editors and WG= chairs > should treat these comments just like any other last call comments. >=20 > This document describes a historic protocol whose design falls far shor= t of > modern IETF standards. Its myriad issues are well-described in the Secu= rity > Considerations section. >=20 > There has been some debate as to whether the appropriate status for thi= s > document is Historic or Informational. I believe the currently-intended= > Historic status is more appropriate. The argument I have heard repeated= ly in > favor of Informational status is that it is not appropriate to classify= a > protocol as Historic until a better alternative exists with a published= > specification. I believe that better alternative exists, which is to ha= ve no > standard at all. It's perfectly fine for NTP monitoring and management > protocols to be vendor-specific. In virtually all legitimate uses ("leg= itimate" > so as to exclude RDoS attacks), both sides of the protocol run on syste= ms > managed by the same organization and the need for vendor-specific tools= is not > a practical issue. Lack of standardization is the already the status qu= o, since > there are many widely-used NTP implementations out there but only the N= etwork > Time Foundation implementation and its derivatives (such as NTPsec) sup= port > this protocol. I know of nobody who has ever been inconvenienced by thi= s; > standardization is a solution in search of a problem. >=20 >=20 Interestingly enough, RFC 1305 actually says this... "Ordinarily, these functions can be implemented using a network-management protocol such as SNMP and suitable extensions to the MIB database. However, in those cases where such facilities are not available, these functions can be implemented using special NTP control messages described herein." SNMP exists and the NTP WG published RFC 5907 to cover the MIB support needed by NTP. I believe that also counts as a better alternative. Regards, Brian --Y5BQ89AV1DpGcCYBjlWPxTOlC7oXjetAD-- --aPtcZpmDiwweFM4VBRzCoCseLJU0qk1np Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAl7lF7kACgkQaNY8nFPR i2GK5BAAm35HUghIRRIpDSNxvI9YVrIcenVtTxKbv6lAokZAfPk00RQysMGObaBU 7yN6z45P8UaSLHeCXpK1ZADVPNQDtlzoNCbIPz+U/xKuGQBMpSqzR7HR87F3yXoI UZQ5HqIk4bsMfYJbSLucWC+xxaC7yRPIL4fq84bF66hMnWvgwnjhXZuJXv4Uk88m CHZt8HzuFgS8W3Eh4FMF3MyyvtffpZgkIJYW3dJRi+/R9Dr5hm9Vv/zD0dsW/C0D 3Npzz1RwLpAMvUpu4U4LQBRfHS23fIK8baYYRClPBOciIzlNPk34UB/VieSMi7CN 4R2oml7igzDeqB+Prl8sOxemAV+wOl6rUWbRbwrmvnFY6Mo5AngDGTgV42eHma+L eHU3ecVVi5kBZDnoeZzUamVzLKugUiLz8qefkkpdC6aZiMg/BPEmzKkGIx9JLXqP IP4vz1XWLZFR1BpLh77lAboeFHrbHyrngXDj+0p60lZ4Gzn7uik60EouRCwc0+0I uaDeZp4KK7u/akYBy8JmG0jLf+W3cj+h5ZeeVLJT80dxDi6YuQVp9KI5qqwvwj0Y NdB62Pe96CnfH66Lz1x8k62bzh8SGnKFjFtk9WCBOBxOZN9JFvKJPsRWS2rJYe3P D9U8lpBgQWrLioSNuSQ7T5J1FCpgN3YFp44kYN+dOm3Qujj6psQ= =JrZc -----END PGP SIGNATURE----- --aPtcZpmDiwweFM4VBRzCoCseLJU0qk1np-- From nobody Sat Jun 13 17:26:11 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 03FF03A0850; Sat, 13 Jun 2020 17:26:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g-9kAvNDnhSi; Sat, 13 Jun 2020 17:26:02 -0700 (PDT) Received: from chessie.everett.org (chessie.everett.org [66.220.13.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 513023A084F; Sat, 13 Jun 2020 17:26:02 -0700 (PDT) Received: from [10.208.75.157] (075-139-194-196.res.spectrum.com [75.139.194.196]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by chessie.everett.org (Postfix) with ESMTPSA id 49kwHF5td5zL7c; Sun, 14 Jun 2020 00:26:01 +0000 (UTC) To: Brian Haberman , Daniel Franke , secdir@ietf.org Cc: draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org References: <159206148916.27533.2080482554461273224@ietfa.amsl.com> <4251f262-22f7-3b7d-41d4-e0c3ef1da1b8@innovationslab.net> From: Harlan Stenn Autocrypt: addr=stenn@nwtime.org; keydata= mQGNBFI2xmQBDACrPayw18eU4pIwCvKh7k0iMkAV9cvzs49kBppM+xoH+KKj4QWmkKELD39H ngQnT3RkKsTLlwxyLqPdUmeQNAY2M5fsOK+OF6EvwLPK9hbmE3Wx2moX+sbEUxJ2VzFhKSKb OPZALXwk1XxL0qBedz0xHYcDwaSAZZkEFXURv2pDIdrmnoUnq2gdC8GpoFJiXoUaCLSYzzaY ac4Njw7Mue8IqfzRQb70aMjXl/qmsmfmEVAyGXywDdc/ler4XSgiuYOV7Kf69bj9PFZZSMdJ MWgEyZH6lJ0TU5ccR2zp5ZRmWzQQkxJMyH2th7q0Nmz3aX4A0K4yE0Ba9/5Dr7ctpF15BrMF aEo4s5lwI6tUnkgMWo265mMzCz4mAPV/ac0w0OXQg7r9E2r0+dRapnzUlG43D0JLDqDr9uRR L6IrRQqoCWUC75lfmPYQYSlaTJaK68r3lXd0z1cXJUgVtEL5H3/Z71R2B20twcQVAnw2iIH6 L5vdrsIjHrMmkqRVbs9nNyEAEQEAAbQ5SGFybGFuIFN0ZW5uIChOZXR3b3JrIFRpbWUgRm91 bmRhdGlvbikgPHN0ZW5uQG53dGltZS5vcmc+iQG5BBMBAgAjBQJSNsblAhsvBwsJCAcDAgEG FQgCCQoLBBYCAwECHgECF4AACgkQyIwAt1pH+kBlzgv/QOg70vdj8wU/z97UPdlbxtN4THAB gfSX4N0VPKT5fjX1tFhuXZQAOv7wedR3Trh7TGteyg33TBAFf9A42mXZKi1IxAiQG118Hd8I 51rXwnugURIYQaIyQI+vbchRbwVyz+mVLTI/h6FdbsVzT4UFmir+ZMkb/XeZPu0HItk4OZHE 6hk+TuTiCnlqlCPLq371fXV54VOb91WZYD8EQFtK02QHGHsQqWvapdphiDVpYehmsPyiTESq NMKLVtjtyPkQ6S7QF3slSg+2q3j8lyxEA78Yl0MSFNU8B/BtKgzWP2itBOfi+rtUKg+jOY1V /s2uVk2kq2QmHJ/s5k5ldy3qVvoTpxvwBe0+EoBocTHYt+xxp0mTM6YY1xLiQpLznzluqg9z qtejX1gZOF4mgLiBIrhXzed3zsAazhTp5rNb1kn0brZFh6JC5Wk941eilnA4LqX8AWo0lmwo eb+mpwZK/5lNdage/anpVqft9wJ/8EcvST9TLUO4fPrmT3d/0LpWuQGNBFI2xmQBDADXLsBk I7CSa5UXlrNVFJQHER1VxRBKqjWWCh/8Qv9v3p3NrIc2UnhoZ1uWQ2voBGty5Xfy9k4afV5k WwDyRDUIb7PX+Tj4HjVVr7qvnOVe/0KzZpNq0Azd0ggFbsM+8mydktHIwJykW0NUsGwPRYuD OA0Lro0ohb5IiCt3sSQi1X1hYjo7O1Vmn8Gy/XYOnhnMux+5zDPO2yTkCNX5PocYi9IJJy6p Mq1yQV4Y2Dl8KtQzvtq55vCUxx6n0MMzFViGwNW6F4ge9ItO4tDScsgowDrHa208ehwOpv/i wjf93lCClQ6vaKmOBX872K/tdY/hwhxPPjgl1bcrOwMRYVemOPPehwnXH5bwclk1hvDQdkJQ 5pJOkE4VCryTF/iDAt4g2QnHocUwt3b6/ChUUWmj2GZ22OR12rbnCtLedwp0DpViKPUCQHBO vpgXdzE/L9zWar9fqM0EREMgfWbsJc9028qluCcFLIN1gYsq4cC+YGAcOu7HOI5orBBV4m9j XfsAEQEAAYkDPgQYAQIACQUCUjbGZAIbLgGpCRDIjAC3Wkf6QMDdIAQZAQIABgUCUjbGZAAK CRDfCQ/G52/8P/uWDACe7OEM+VETDRqjQgAwzX+RjCVPvtgrqc1SExS0fV7i1mUUxr/B8io3 Y1cRHFoFKmedxf8prHZq316Md5u4egjFdTT6ZqEqkK0hvv+i0pRpCa5EX9VIStcJStomZp8F cY34grA+EOWITaLQ4qNZUP7rf2e7gq1ubQTj7uLr6HZZvMZ5em+IvrOWEuWDI6yOiI6px04w RDfkoR2h6kgdw4V0PT4NjK9WYYKrVCf1bjLlVImNBEcXfvlUTrIYO8y6ptvoUsBQky5pQRvP 99Pn42WfyLy50aII6+vyudD4T0yLjXAz4KteUttxtIte64m/F9/7GEIZAxTUcLyOq/7bP4le h39jBckwc62iYzeK/VkU/bMMh2D68Z3QylMnhhcW27BcgQHPKsHhmFa2SNytYcuQiSdf9+pj 4i32ETz1nJAvYAAqgTF/0PL+8ZNQoEpe/n9woMKrlZrqD4EgFmhQ3bNVhlaXz1nuTZDrwPt1 yMxBuUNbCF4jFnaruwrSiGTRoIfUZQwAjQglahrV4/mcjfnvbNoseHX0PKd9q+wjg7MIjWqr f2CI8Fa6MdanqwYphz43I2yXANKFZuMWsWqyQYlvGuPUlUUcAL3stp24RkzDB1Q+JS0IZJST T2JSu0aTfUdWVNqr2UI19eX+zxbOTckSi3Ng14ezG8ZX194ZH10b8JzntQOwmA20pd5JDhug zQfASER+CZDiPPcQ4mvC4y7rMrfV6XGQbDynC3ekDxo8SC5SvjaczXMwXg6SZ8iFtEWmEwW9 r7zPjjIPDrX8w5LXBgxArM5o/HbERpc2EdAvMh1D7LC0SvmoE7fBKxsicVBe4h6vXjEZ+LLr /wuZiBld9OnxAUIpwptbBspO6WKTQYvgFH2OeDG27hiE5P4Xs4WSp5j9ez8OVB1iZnA2nCQ+ tNTjO8c+C/P92vPLx5+bpGRXTXMNaLh34PS3ZsYoUDkKZNhczRZUWJ7nynSbeeyF+QW7SLwA qY7O7dyk9LFTsfJqRQJ7tWnIAjJPCwmSgQ8Kl0UJ Message-ID: Date: Sat, 13 Jun 2020 17:26:00 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <4251f262-22f7-3b7d-41d4-e0c3ef1da1b8@innovationslab.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 00:26:04 -0000 On 6/13/2020 11:15 AM, Brian Haberman wrote: > Thanks for the review, Daniel. A quick follow-up below for those of you > playing along at home... > > On 6/13/20 11:18 AM, Daniel Franke via Datatracker wrote: >> Reviewer: Daniel Franke >> Review result: Ready >> >> I have reviewed this document as part of the security directorate's ongoing >> effort to review all IETF documents being processed by the IESG. These >> comments were written with the intent of improving security requirements and >> considerations in IETF drafts. Comments not addressed in last call may be >> included in AD reviews during the IESG review. Document editors and WG chairs >> should treat these comments just like any other last call comments. >> >> This document describes a historic protocol whose design falls far short of >> modern IETF standards. Its myriad issues are well-described in the Security >> Considerations section. >> >> There has been some debate as to whether the appropriate status for this >> document is Historic or Informational. I believe the currently-intended >> Historic status is more appropriate. The argument I have heard repeatedly in >> favor of Informational status is that it is not appropriate to classify a >> protocol as Historic until a better alternative exists with a published >> specification. I believe that better alternative exists, which is to have no >> standard at all. It's perfectly fine for NTP monitoring and management >> protocols to be vendor-specific. In virtually all legitimate uses ("legitimate" >> so as to exclude RDoS attacks), both sides of the protocol run on systems >> managed by the same organization and the need for vendor-specific tools is not >> a practical issue. Lack of standardization is the already the status quo, since >> there are many widely-used NTP implementations out there but only the Network >> Time Foundation implementation and its derivatives (such as NTPsec) support >> this protocol. I know of nobody who has ever been inconvenienced by this; >> standardization is a solution in search of a problem. >> >> > > Interestingly enough, RFC 1305 actually says this... > > "Ordinarily, these functions can be implemented using a > network-management protocol such as SNMP and suitable extensions to the > MIB database. However, in those cases where such facilities are not > available, these functions can be implemented using special NTP control > messages described herein." Why is RFC 1305 even being brought up in this situation? NTPv3 was updated to NTPv4. During that update, mode 6 and mode 7 were inadvertently not included. RFC 5905 was developed, as was 5906 and 5907. But mode 6 is still in active use and deserves a proper, updated specification. > SNMP exists and the NTP WG published RFC 5907 to cover the MIB support > needed by NTP. I believe that also counts as a better alternative. Unbelievable. TTBOMK, the only implementation of 5907 is the one in the reference implementation, and in the 12 years it has been out there we have had NO reports of it being used. Furthermore, it was implemented USING MODE 6 PACKETS! The only known SNMP interface to ntpd, ntpsnmpd has not seen significant updates since 2010. The mode 6 interface to ntpd, ntpq, remains in continuous development and evolution. Please identify any other implementations of 5907. If you find any, how significant are they? Are they proprietary 5907 implementations? What implementations to they work on? Please show how SNMP is a better way to monitor and control NTP than ntpq. Please show me a working deployment of SNMP controlling NTP, and then please compare the number and quality of these deployments with those that do the same with ntpq. > Regards, > Brian > > > _______________________________________________ > ntp mailing list > ntp@ietf.org > https://www.ietf.org/mailman/listinfo/ntp > -- Harlan Stenn http://networktimefoundation.org - be a member! From nobody Sat Jun 13 21:10:43 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F1C463A0A12; Sat, 13 Jun 2020 21:10:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.198 X-Spam-Level: X-Spam-Status: No, score=-0.198 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XchjckqD7PU1; Sat, 13 Jun 2020 21:10:33 -0700 (PDT) Received: from mail-qk1-x742.google.com (mail-qk1-x742.google.com [IPv6:2607:f8b0:4864:20::742]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7519D3A0A07; Sat, 13 Jun 2020 21:10:33 -0700 (PDT) Received: by mail-qk1-x742.google.com with SMTP id b27so12745965qka.4; Sat, 13 Jun 2020 21:10:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=content-transfer-encoding:mime-version:subject:from:in-reply-to :date:cc:message-id:references:to; bh=ImSCK+XmR6blbevtYu+d7XAdpWuw2iXIlF2norLnF3k=; b=aA3CwgYobvr3rzQe4jfNhEpHZ3Wz9qWCav4fpblVbXtQJdF4xr4SQAAqn41cwJSM8p AzYp9dQfpLIicKgt8DCrxjTg1Gy6pxbp50ThiDrNNgBpRvaEYtYkKICEiqgbKg3pobn/ WMegyl+RtI46qywwLyTbmjjYyz3SAevS9uj4jAgeC8LNX3u/ro/12YK5v/D1f3I5oN5B BLhWeOYIJtC119VEJRE/bMFDd6+aFy7dQ0fsor8oRaDsj7KTkzaIziU6ca7PLLC3lSyx l153Z4NPkxbxEtsljoZfJttMOxRQ4AwKtIaL3t51C6XbZyDuNslUe+vSu9iK5bo9Ptyh FUng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:content-transfer-encoding:mime-version:subject :from:in-reply-to:date:cc:message-id:references:to; bh=ImSCK+XmR6blbevtYu+d7XAdpWuw2iXIlF2norLnF3k=; b=QKeMbrIGXQ7ZPSY3S0qwM4qqrzVmOnHBvixWjYKWt9oFjSHBY84EFolMZB9R4bDvfy /yXFDSScupm9MQpmlsfJQOnjjr7fBz2Bg00OuKmKy6ItfvRRjY4xIvKvMLcLgNE7Ofme eYBWn3nCNsQQsjPmkPDx/LBEoXSdexnhJF6LgAupFXQilHVXOabzSIIndFIuOvxA7MDG dIjhtxaHxl3jMBQ3qKJOU36m1K52ow1KXENWlHfQN0GS/mTKEoDKfgSsX1Gath1+w2DH S2vrjopheTQM9EyfX9iruVyOd3iTZ8sBf4R3j1e6AgLWC5auxDn3i2KK9RqBPC7ZhimA Chtg== X-Gm-Message-State: AOAM533z284Ai5oGjMD0Y+BIHaRo5cQ3BtGYrBGY611TbRzsdG6nQ8Xk M402r/OmNUjhtYb0nvBVE6xBJw== X-Google-Smtp-Source: ABdhPJzxjRRMONGzEDDRY6YcIR1+8dyLbZaLyfjUPXWXlIpPO+8dDwmb1Uxv/llO6lbpWJU8RjPPCg== X-Received: by 2002:a37:9f89:: with SMTP id i131mr9501231qke.243.1592107829826; Sat, 13 Jun 2020 21:10:29 -0700 (PDT) Received: from [192.168.1.150] (d-173-44-72-18.va.cpe.atlanticbb.net. [173.44.72.18]) by smtp.gmail.com with ESMTPSA id u16sm8430175qkm.107.2020.06.13.21.10.28 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sat, 13 Jun 2020 21:10:28 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (1.0) From: Karen O'Donoghue In-Reply-To: Date: Sun, 14 Jun 2020 00:10:27 -0400 Cc: Brian Haberman , Daniel Franke , secdir@ietf.org, draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org Message-Id: <13D6D5C7-090A-4C68-8F0B-EA6DE18FB1E9@gmail.com> References: To: Harlan Stenn X-Mailer: iPad Mail (17E262) Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 04:10:35 -0000 Folks, All of this was discussed during the development of this document. There was= strong working group consensus to not publish as Standards Track. As descri= bed, there were concerns about the solution. The working group has gone back= and forth between historic and informational. =20 Regards, Karen=20 > On Jun 13, 2020, at 8:27 PM, Harlan Stenn wrote: >=20 > =EF=BB=BFOn 6/13/2020 11:15 AM, Brian Haberman wrote: >> Thanks for the review, Daniel. A quick follow-up below for those of you >> playing along at home... >>=20 >>> On 6/13/20 11:18 AM, Daniel Franke via Datatracker wrote: >>> Reviewer: Daniel Franke >>> Review result: Ready >>>=20 >>> I have reviewed this document as part of the security directorate's ongo= ing >>> effort to review all IETF documents being processed by the IESG. These >>> comments were written with the intent of improving security requirements= and >>> considerations in IETF drafts. Comments not addressed in last call may b= e >>> included in AD reviews during the IESG review. Document editors and WG c= hairs >>> should treat these comments just like any other last call comments. >>>=20 >>> This document describes a historic protocol whose design falls far short= of >>> modern IETF standards. Its myriad issues are well-described in the Secur= ity >>> Considerations section. >>>=20 >>> There has been some debate as to whether the appropriate status for this= >>> document is Historic or Informational. I believe the currently-intended >>> Historic status is more appropriate. The argument I have heard repeatedl= y in >>> favor of Informational status is that it is not appropriate to classify a= >>> protocol as Historic until a better alternative exists with a published >>> specification. I believe that better alternative exists, which is to hav= e no >>> standard at all. It's perfectly fine for NTP monitoring and management >>> protocols to be vendor-specific. In virtually all legitimate uses ("legi= timate" >>> so as to exclude RDoS attacks), both sides of the protocol run on system= s >>> managed by the same organization and the need for vendor-specific tools i= s not >>> a practical issue. Lack of standardization is the already the status quo= , since >>> there are many widely-used NTP implementations out there but only the Ne= twork >>> Time Foundation implementation and its derivatives (such as NTPsec) supp= ort >>> this protocol. I know of nobody who has ever been inconvenienced by this= ; >>> standardization is a solution in search of a problem. >>>=20 >>>=20 >>=20 >> Interestingly enough, RFC 1305 actually says this... >>=20 >> "Ordinarily, these functions can be implemented using a >> network-management protocol such as SNMP and suitable extensions to the >> MIB database. However, in those cases where such facilities are not >> available, these functions can be implemented using special NTP control >> messages described herein." >=20 > Why is RFC 1305 even being brought up in this situation? >=20 > NTPv3 was updated to NTPv4. >=20 > During that update, mode 6 and mode 7 were inadvertently not included. >=20 > RFC 5905 was developed, as was 5906 and 5907. But mode 6 is still in > active use and deserves a proper, updated specification. >=20 >> SNMP exists and the NTP WG published RFC 5907 to cover the MIB support >> needed by NTP. I believe that also counts as a better alternative. >=20 > Unbelievable. >=20 > TTBOMK, the only implementation of 5907 is the one in the reference > implementation, and in the 12 years it has been out there we have had NO > reports of it being used. Furthermore, it was implemented USING MODE 6 > PACKETS! >=20 > The only known SNMP interface to ntpd, ntpsnmpd has not seen significant > updates since 2010. >=20 > The mode 6 interface to ntpd, ntpq, remains in continuous development > and evolution. >=20 > Please identify any other implementations of 5907. If you find any, how > significant are they? Are they proprietary 5907 implementations? What > implementations to they work on? >=20 > Please show how SNMP is a better way to monitor and control NTP than ntpq.= >=20 > Please show me a working deployment of SNMP controlling NTP, and then > please compare the number and quality of these deployments with those > that do the same with ntpq. >=20 >> Regards, >> Brian >>=20 >>=20 >> _______________________________________________ >> ntp mailing list >> ntp@ietf.org >> https://www.ietf.org/mailman/listinfo/ntp >>=20 >=20 > --=20 > Harlan Stenn > http://networktimefoundation.org - be a member! >=20 > _______________________________________________ > ntp mailing list > ntp@ietf.org > https://www.ietf.org/mailman/listinfo/ntp From nobody Sat Jun 13 21:54:14 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 415253A0A4F; Sat, 13 Jun 2020 21:54:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qfjPJ7Sw06-t; Sat, 13 Jun 2020 21:54:02 -0700 (PDT) Received: from chessie.everett.org (chessie.everett.org [66.220.13.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62A3D3A0A4D; Sat, 13 Jun 2020 21:54:00 -0700 (PDT) Received: from [10.208.75.157] (075-139-194-196.res.spectrum.com [75.139.194.196]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by chessie.everett.org (Postfix) with ESMTPSA id 49l2DM4YLWzL7c; Sun, 14 Jun 2020 04:53:55 +0000 (UTC) To: Karen O'Donoghue Cc: Brian Haberman , Daniel Franke , secdir@ietf.org, draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org References: <13D6D5C7-090A-4C68-8F0B-EA6DE18FB1E9@gmail.com> From: Harlan Stenn Autocrypt: addr=stenn@nwtime.org; keydata= mQGNBFI2xmQBDACrPayw18eU4pIwCvKh7k0iMkAV9cvzs49kBppM+xoH+KKj4QWmkKELD39H ngQnT3RkKsTLlwxyLqPdUmeQNAY2M5fsOK+OF6EvwLPK9hbmE3Wx2moX+sbEUxJ2VzFhKSKb OPZALXwk1XxL0qBedz0xHYcDwaSAZZkEFXURv2pDIdrmnoUnq2gdC8GpoFJiXoUaCLSYzzaY ac4Njw7Mue8IqfzRQb70aMjXl/qmsmfmEVAyGXywDdc/ler4XSgiuYOV7Kf69bj9PFZZSMdJ MWgEyZH6lJ0TU5ccR2zp5ZRmWzQQkxJMyH2th7q0Nmz3aX4A0K4yE0Ba9/5Dr7ctpF15BrMF aEo4s5lwI6tUnkgMWo265mMzCz4mAPV/ac0w0OXQg7r9E2r0+dRapnzUlG43D0JLDqDr9uRR L6IrRQqoCWUC75lfmPYQYSlaTJaK68r3lXd0z1cXJUgVtEL5H3/Z71R2B20twcQVAnw2iIH6 L5vdrsIjHrMmkqRVbs9nNyEAEQEAAbQ5SGFybGFuIFN0ZW5uIChOZXR3b3JrIFRpbWUgRm91 bmRhdGlvbikgPHN0ZW5uQG53dGltZS5vcmc+iQG5BBMBAgAjBQJSNsblAhsvBwsJCAcDAgEG FQgCCQoLBBYCAwECHgECF4AACgkQyIwAt1pH+kBlzgv/QOg70vdj8wU/z97UPdlbxtN4THAB gfSX4N0VPKT5fjX1tFhuXZQAOv7wedR3Trh7TGteyg33TBAFf9A42mXZKi1IxAiQG118Hd8I 51rXwnugURIYQaIyQI+vbchRbwVyz+mVLTI/h6FdbsVzT4UFmir+ZMkb/XeZPu0HItk4OZHE 6hk+TuTiCnlqlCPLq371fXV54VOb91WZYD8EQFtK02QHGHsQqWvapdphiDVpYehmsPyiTESq NMKLVtjtyPkQ6S7QF3slSg+2q3j8lyxEA78Yl0MSFNU8B/BtKgzWP2itBOfi+rtUKg+jOY1V /s2uVk2kq2QmHJ/s5k5ldy3qVvoTpxvwBe0+EoBocTHYt+xxp0mTM6YY1xLiQpLznzluqg9z qtejX1gZOF4mgLiBIrhXzed3zsAazhTp5rNb1kn0brZFh6JC5Wk941eilnA4LqX8AWo0lmwo eb+mpwZK/5lNdage/anpVqft9wJ/8EcvST9TLUO4fPrmT3d/0LpWuQGNBFI2xmQBDADXLsBk I7CSa5UXlrNVFJQHER1VxRBKqjWWCh/8Qv9v3p3NrIc2UnhoZ1uWQ2voBGty5Xfy9k4afV5k WwDyRDUIb7PX+Tj4HjVVr7qvnOVe/0KzZpNq0Azd0ggFbsM+8mydktHIwJykW0NUsGwPRYuD OA0Lro0ohb5IiCt3sSQi1X1hYjo7O1Vmn8Gy/XYOnhnMux+5zDPO2yTkCNX5PocYi9IJJy6p Mq1yQV4Y2Dl8KtQzvtq55vCUxx6n0MMzFViGwNW6F4ge9ItO4tDScsgowDrHa208ehwOpv/i wjf93lCClQ6vaKmOBX872K/tdY/hwhxPPjgl1bcrOwMRYVemOPPehwnXH5bwclk1hvDQdkJQ 5pJOkE4VCryTF/iDAt4g2QnHocUwt3b6/ChUUWmj2GZ22OR12rbnCtLedwp0DpViKPUCQHBO vpgXdzE/L9zWar9fqM0EREMgfWbsJc9028qluCcFLIN1gYsq4cC+YGAcOu7HOI5orBBV4m9j XfsAEQEAAYkDPgQYAQIACQUCUjbGZAIbLgGpCRDIjAC3Wkf6QMDdIAQZAQIABgUCUjbGZAAK CRDfCQ/G52/8P/uWDACe7OEM+VETDRqjQgAwzX+RjCVPvtgrqc1SExS0fV7i1mUUxr/B8io3 Y1cRHFoFKmedxf8prHZq316Md5u4egjFdTT6ZqEqkK0hvv+i0pRpCa5EX9VIStcJStomZp8F cY34grA+EOWITaLQ4qNZUP7rf2e7gq1ubQTj7uLr6HZZvMZ5em+IvrOWEuWDI6yOiI6px04w RDfkoR2h6kgdw4V0PT4NjK9WYYKrVCf1bjLlVImNBEcXfvlUTrIYO8y6ptvoUsBQky5pQRvP 99Pn42WfyLy50aII6+vyudD4T0yLjXAz4KteUttxtIte64m/F9/7GEIZAxTUcLyOq/7bP4le h39jBckwc62iYzeK/VkU/bMMh2D68Z3QylMnhhcW27BcgQHPKsHhmFa2SNytYcuQiSdf9+pj 4i32ETz1nJAvYAAqgTF/0PL+8ZNQoEpe/n9woMKrlZrqD4EgFmhQ3bNVhlaXz1nuTZDrwPt1 yMxBuUNbCF4jFnaruwrSiGTRoIfUZQwAjQglahrV4/mcjfnvbNoseHX0PKd9q+wjg7MIjWqr f2CI8Fa6MdanqwYphz43I2yXANKFZuMWsWqyQYlvGuPUlUUcAL3stp24RkzDB1Q+JS0IZJST T2JSu0aTfUdWVNqr2UI19eX+zxbOTckSi3Ng14ezG8ZX194ZH10b8JzntQOwmA20pd5JDhug zQfASER+CZDiPPcQ4mvC4y7rMrfV6XGQbDynC3ekDxo8SC5SvjaczXMwXg6SZ8iFtEWmEwW9 r7zPjjIPDrX8w5LXBgxArM5o/HbERpc2EdAvMh1D7LC0SvmoE7fBKxsicVBe4h6vXjEZ+LLr /wuZiBld9OnxAUIpwptbBspO6WKTQYvgFH2OeDG27hiE5P4Xs4WSp5j9ez8OVB1iZnA2nCQ+ tNTjO8c+C/P92vPLx5+bpGRXTXMNaLh34PS3ZsYoUDkKZNhczRZUWJ7nynSbeeyF+QW7SLwA qY7O7dyk9LFTsfJqRQJ7tWnIAjJPCwmSgQ8Kl0UJ Message-ID: <08544d38-b025-8fa0-a0e8-d87f459421d7@nwtime.org> Date: Sat, 13 Jun 2020 21:53:55 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <13D6D5C7-090A-4C68-8F0B-EA6DE18FB1E9@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 04:54:04 -0000 The working group consensus is wrong, at least in this case. H On 6/13/2020 9:10 PM, Karen O'Donoghue wrote: > Folks, > > All of this was discussed during the development of this document. There was strong working group consensus to not publish as Standards Track. As described, there were concerns about the solution. The working group has gone back and forth between historic and informational. > > Regards, > Karen > >> On Jun 13, 2020, at 8:27 PM, Harlan Stenn wrote: >> >> On 6/13/2020 11:15 AM, Brian Haberman wrote: >>> Thanks for the review, Daniel. A quick follow-up below for those of you >>> playing along at home... >>> >>>> On 6/13/20 11:18 AM, Daniel Franke via Datatracker wrote: >>>> Reviewer: Daniel Franke >>>> Review result: Ready >>>> >>>> I have reviewed this document as part of the security directorate's ongoing >>>> effort to review all IETF documents being processed by the IESG. These >>>> comments were written with the intent of improving security requirements and >>>> considerations in IETF drafts. Comments not addressed in last call may be >>>> included in AD reviews during the IESG review. Document editors and WG chairs >>>> should treat these comments just like any other last call comments. >>>> >>>> This document describes a historic protocol whose design falls far short of >>>> modern IETF standards. Its myriad issues are well-described in the Security >>>> Considerations section. >>>> >>>> There has been some debate as to whether the appropriate status for this >>>> document is Historic or Informational. I believe the currently-intended >>>> Historic status is more appropriate. The argument I have heard repeatedly in >>>> favor of Informational status is that it is not appropriate to classify a >>>> protocol as Historic until a better alternative exists with a published >>>> specification. I believe that better alternative exists, which is to have no >>>> standard at all. It's perfectly fine for NTP monitoring and management >>>> protocols to be vendor-specific. In virtually all legitimate uses ("legitimate" >>>> so as to exclude RDoS attacks), both sides of the protocol run on systems >>>> managed by the same organization and the need for vendor-specific tools is not >>>> a practical issue. Lack of standardization is the already the status quo, since >>>> there are many widely-used NTP implementations out there but only the Network >>>> Time Foundation implementation and its derivatives (such as NTPsec) support >>>> this protocol. I know of nobody who has ever been inconvenienced by this; >>>> standardization is a solution in search of a problem. >>>> >>>> >>> >>> Interestingly enough, RFC 1305 actually says this... >>> >>> "Ordinarily, these functions can be implemented using a >>> network-management protocol such as SNMP and suitable extensions to the >>> MIB database. However, in those cases where such facilities are not >>> available, these functions can be implemented using special NTP control >>> messages described herein." >> >> Why is RFC 1305 even being brought up in this situation? >> >> NTPv3 was updated to NTPv4. >> >> During that update, mode 6 and mode 7 were inadvertently not included. >> >> RFC 5905 was developed, as was 5906 and 5907. But mode 6 is still in >> active use and deserves a proper, updated specification. >> >>> SNMP exists and the NTP WG published RFC 5907 to cover the MIB support >>> needed by NTP. I believe that also counts as a better alternative. >> >> Unbelievable. >> >> TTBOMK, the only implementation of 5907 is the one in the reference >> implementation, and in the 12 years it has been out there we have had NO >> reports of it being used. Furthermore, it was implemented USING MODE 6 >> PACKETS! >> >> The only known SNMP interface to ntpd, ntpsnmpd has not seen significant >> updates since 2010. >> >> The mode 6 interface to ntpd, ntpq, remains in continuous development >> and evolution. >> >> Please identify any other implementations of 5907. If you find any, how >> significant are they? Are they proprietary 5907 implementations? What >> implementations to they work on? >> >> Please show how SNMP is a better way to monitor and control NTP than ntpq. >> >> Please show me a working deployment of SNMP controlling NTP, and then >> please compare the number and quality of these deployments with those >> that do the same with ntpq. >> >>> Regards, >>> Brian >>> >>> >>> _______________________________________________ >>> ntp mailing list >>> ntp@ietf.org >>> https://www.ietf.org/mailman/listinfo/ntp >>> >> >> -- >> Harlan Stenn >> http://networktimefoundation.org - be a member! >> >> _______________________________________________ >> ntp mailing list >> ntp@ietf.org >> https://www.ietf.org/mailman/listinfo/ntp > -- Harlan Stenn http://networktimefoundation.org - be a member! From nobody Sat Jun 13 21:56:40 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 443493A0A51 for ; Sat, 13 Jun 2020 21:56:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.002 X-Spam-Level: X-Spam-Status: No, score=0.002 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mj1CZiciyUqs for ; Sat, 13 Jun 2020 21:56:38 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28EF23A0A4F for ; Sat, 13 Jun 2020 21:56:37 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E4uX6C024143 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 00:56:36 -0400 Date: Sat, 13 Jun 2020 21:56:33 -0700 From: Benjamin Kaduk To: =?utf-8?B?TWFsacWhYSBWdcSNaW5pxIc=?= Cc: secdir@ietf.org Message-ID: <20200614045633.GF11992@kduck.mit.edu> References: <159050117661.11337.1336987637854906717@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <159050117661.11337.1336987637854906717@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-emu-eap-session-id-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 04:56:39 -0000 Hi Mališa, Thanks for the review! I ended up putting a Discuss ballot on, for a (presumably) copy/paste error in one of the message names, and wanting a reference for PEAP (which may be challenging, as it seems to be a Microsoft proprietary protocol). It would be nice if some cryptographic review of the new Session-Id constructions was done, but I don't think either of us is the right person to do it, so we're limited to just asking the authors what has already been done. -Ben On Tue, May 26, 2020 at 06:52:56AM -0700, Mališa Vučinić via Datatracker wrote: > Reviewer: Mališa Vučinić > Review result: Has Nits > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area directors. > Document editors and WG chairs should treat these comments just like any other > last call comments. > > The document updates RFC5247 to specify EAP Session-ID definition in case fast > re-authentication is used with EAP-AKA and EAP-SIM. The Session-ID definition > is based on a server-generated nonce and a MAC. The document also specifies the > Session-ID definition for the PEAP method, following the definition of EAP-TLS. > > The document is clear and well written. Security considerations section is > clear and states no known security issues in the definitions used. A reference > to PEAP is missing. > > Nits: > Section 3: s/to not modify/do not modify > > From nobody Sat Jun 13 22:00:04 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E764E3A0A7E for ; Sat, 13 Jun 2020 22:00:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8LM9JXUOHboL for ; Sat, 13 Jun 2020 22:00:01 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 168F43A0A7D for ; Sat, 13 Jun 2020 22:00:00 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E4xsLS024876 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 00:59:56 -0400 Date: Sat, 13 Jun 2020 21:59:53 -0700 From: Benjamin Kaduk To: Linda Dunbar Cc: "secdir@ietf.org" Message-ID: <20200614045953.GG11992@kduck.mit.edu> References: <159053708200.16306.10159573848968846851@ietfa.amsl.com> <07bf4fd695654e66a1084ab2c15b409a@cert.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <07bf4fd695654e66a1084ab2c15b409a@cert.org> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 05:00:03 -0000 Yes, thanks Linda for the review. I put a Discuss ballot on for a couple fairly mundane/organizational questions, and requesting that some more of the security risks of the secp256k1 curve (that had been discussed in emails much earlier) made it into the document itself. -Ben On Tue, Jun 09, 2020 at 02:11:06PM +0000, Roman Danyliw wrote: > Hi Linda, thank you for this review. > > Hi Mike, thank you for incorporating the feedback in -07. > > I entered a No Objection ballot. > > Regards, > Roman > > > -----Original Message----- > > From: COSE On Behalf Of Linda Dunbar > > Sent: Wednesday, June 3, 2020 3:49 PM > > To: Mike Jones ; Matthew A. Miller > > ; secdir@ietf.org > > Cc: draft-ietf-cose-webauthn-algorithms.all@ietf.org; last-call@ietf.org; > > cose@ietf.org > > Subject: Re: [COSE] Secdir last call review of draft-ietf-cose-webauthn- > > algorithms-06 > > > > Mike, > > > > Thank you for the change. > > > > Linda > > > > -----Original Message----- > > From: Mike Jones > > Sent: Wednesday, June 3, 2020 11:52 AM > > To: Linda Dunbar ; Matthew A. Miller > > ; secdir@ietf.org > > Cc: cose@ietf.org; draft-ietf-cose-webauthn-algorithms.all@ietf.org; last- > > call@ietf.org > > Subject: RE: Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 > > > > Thanks again for your review, Linda. > > https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools.ie > > tf.org%2Fhtml%2Fdraft-ietf-cose-webauthn-algorithms-07%23section- > > 5.2&data=02%7C01%7Clinda.dunbar%40futurewei.com%7C4025d38884a > > e4d1a9a5b08d807de6562%7C0fee8ff2a3b240189c753a1d5591fedc%7C1%7C > > 1%7C637267999048635328&sdata=oGsafk80fAFxgfMfx3wUPwlrVexjGyV > > vsHDZfrKdpyo%3D&reserved=0 adds the requested clarification that SHA- > > 256, SHA-384, and SHA-512 are the SHA-2 hash functions. > > > > -- Mike > > > > -----Original Message----- > > From: Linda Dunbar > > Sent: Wednesday, May 27, 2020 5:22 PM > > To: Matthew A. Miller ; secdir@ietf.org > > Cc: cose@ietf.org; draft-ietf-cose-webauthn-algorithms.all@ietf.org; last- > > call@ietf.org > > Subject: [EXTERNAL] RE: Secdir last call review of draft-ietf-cose-webauthn- > > algorithms-06 > > > > Matthew, > > > > That is what I was thinking. Can you add a sentence in Section 5.2 to say that > > this is for the collection of SHA-256, SHA-384, SHA-512 algorithms? > > Otherwise, the two sections of the document don't match. > > > > Thank you > > Linda Dunbar > > > > -----Original Message----- > > From: Matthew A. Miller > > Sent: Wednesday, May 27, 2020 4:55 PM > > To: Linda Dunbar ; secdir@ietf.org > > Cc: cose@ietf.org; draft-ietf-cose-webauthn-algorithms.all@ietf.org; last- > > call@ietf.org > > Subject: Re: Secdir last call review of draft-ietf-cose-webauthn-algorithms-06 > > > > Hello Linda, > > > > Thanks for the review. Speaking on the author's behalf, SHA-2 is defined as the > > collection of hash algorithms, including all of those cited (SHA-256, SHA-384, > > SHA-512). Do you believe it is critical to call this out explicitly? > > > > > > - m&m > > > > Matthew A. Miller > > On 20/05/26 17:51, Linda Dunbar via Datatracker wrote: > > > Reviewer: Linda Dunbar > > > Review result: Not Ready > > > > > > I have reviewed this document as part of the security directorate's > > > ongoing effort to review all IETF documents being processed by the > > > IESG. These comments were written primarily for the benefit of the security > > area directors. > > > Document editors and WG chairs should treat these comments just like > > > any other last call comments. > > > > > > This document is to list down the COSE&JOSE Algorithms to be > > > registered to IANA. But it seems the description is not complete. In > > > the Section 2: among the > > > 4 algorithms listed under RSASSA-PKCS1-v1_5, three are NOT > > > recommended, one is deprecated. Under the Security Consideration > > > (Section 5), Section 5.2 describes why SHA-2 is "Not Recommended", > > > Section 5.3 describes why SHA-1 is "Deprecated". What about the > > > description on why SHA-512, SHA-384, and SHA-256 are not recommended? > > Is the missing description intended? > > > > > > Best Regards, > > > > > > Linda Dunbar > > > > > > > > > > > _______________________________________________ > > COSE mailing list > > COSE@ietf.org > > https://www.ietf.org/mailman/listinfo/cose From nobody Sat Jun 13 22:04:27 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD3FC3A0A85 for ; Sat, 13 Jun 2020 22:04:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bs5u_aIpY4af for ; Sat, 13 Jun 2020 22:04:24 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0E0523A0A84 for ; Sat, 13 Jun 2020 22:04:23 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E54DAT025943 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 01:04:15 -0400 Date: Sat, 13 Jun 2020 22:04:13 -0700 From: Benjamin Kaduk To: "Nancy Cam-Winget (ncamwing)" Cc: Jim Schaad , "secdir@ietf.org" Message-ID: <20200614050413.GH11992@kduck.mit.edu> References: <159052818935.17307.5095159295288146706@ietfa.amsl.com> <041f01d635dd$ad489cf0$07d9d6d0$@augustcellars.com> <835a6903f5204feab56d4f76901bb0e1@cert.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <835a6903f5204feab56d4f76901bb0e1@cert.org> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-cose-rfc8152bis-algs-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 05:04:26 -0000 Seconded, thanks Nancy and Jim for getting the right updates in place for the document. I entered a Discuss ballot only because I tried to follow the [MAC] reference and got something unexpected -- I want to make sure we've got the right thing there. Thanks, Ben On Tue, Jun 09, 2020 at 05:36:51PM +0000, Roman Danyliw wrote: > Hi Nancy, thank you for this review. > > Hi Jim, thank you for incorporating the feedback in -09 > > I entered a No Objection ballot. > > Regards, > Roman > > > -----Original Message----- > > From: Nancy Cam-Winget (ncamwing) > > Sent: Friday, May 29, 2020 1:49 PM > > To: Jim Schaad ; secdir@ietf.org > > Cc: cose@ietf.org; last-call@ietf.org; draft-ietf-cose-rfc8152bis- > > algs.all@ietf.org > > Subject: Re: Secdir last call review of draft-ietf-cose-rfc8152bis-algs-08 > > > > Hi Jim, > > Thanks for addressing the comments! Answers below: > > > > On 5/29/20, 10:22 AM, "Jim Schaad" wrote: > > > > Hi Nancy, > > > > Comments inline. > > > > Jim > > > > > > -----Original Message----- > > From: Nancy Cam-Winget via Datatracker > > Sent: Tuesday, May 26, 2020 2:23 PM > > To: secdir@ietf.org > > Cc: cose@ietf.org; last-call@ietf.org; draft-ietf-cose-rfc8152bis- > > algs.all@ietf.org > > Subject: Secdir last call review of draft-ietf-cose-rfc8152bis-algs-08 > > > > Reviewer: Nancy Cam-Winget > > Review result: Has Nits > > > > IOTDIR review of draft-ietf-cose-rfc8152bis-algs-08 > > > > Reviewer: Nancy Cam-Winget > > > > I have reviewed this document as part of the security directorate'sÊ ongoing > > effort to review all IETF documents being processed by theÊ IESG.ÊÊThese > > comments were written primarily for the benefit of theÊ security area > > directors.ÊÊDocument editors and WG chairs should treatÊ these comments > > just like any other last call comments. > > > > This document describes an initial set of cryptographic algorithms used to > > protect CBOR, I believe this document is almost ready, barring some editorial > > nits (I only made a few below). In general, the description of the "initial" > > set of algorithms used in COSE make sense and it is good to see each section > > carry their own security section for better mapping of the considerations based > > on the security algorithm applied. As a reader (like myself) who is not fully > > versant to the nuances of CBOR it was a little hard to follow as the structures > > and taxonomy is described in the companion draft (draft-ietf-cose-rfc8152bis- > > struct). As a whole, I think the document is close to ready, I only noted a few > > technical and editorial nits for the earlier sections below: > > > > Section 2.1: > > - What field does the ECDSA algorithm value map to? I presume it is the 'alg' > > field (if present)? But should be made explicit. - It seems that the "should" > > in the 4th paragraph is normative (e.g. SHOULD) as it is needed for > > interoperability, and perhaps even a MUST as I'm not seeing negotiation or > > selection of curve choice. So, if it is to be implicit, then a MUST would be more > > appropriate. > > [JLS] I have added text to section 1.3 (terminology) to describe the contents > > of the tables to make what the value is clearer. > > [NCW] Thanks, that will help. > > > > [JLS] There is no need to negotiate the curve as this is implicit from the size > > of the signature. That is P-256 is going to end up with two 256-bit values as > > the signature. One implication is that only a single curve of any given length > > can be assigned to ECDSA, thus the effort to use the Ed25519 curve with ECDSA > > requires a different identifier so that there is no confusion on what curve is > > being used. This means that the length of the hash algorithm is not part of this > > selection process. It is therefore possible to use SHA-256 with P-521 and SHA- > > 512 with P-256 (the hash value is truncated in this case). The only issue is that > > if a piece of hardware supports the P-256 curve then it might only support SHA- > > 256 and thus would not be able to validate a signature that uses SHA-512. > > There is no special security issue here, this is just a recommendation for making > > things more likely to succeed. This is the reason that it is not a 'SHOULD' or > > 'MUST' but is an 'suggested'. Does this both make things clearer and reduce > > the feeling on you part that a stronger statement is needed? > > [NCW] Agree that there is no security issue, it was more of breaking > > interoperability. I don't feel strongly either way, it was by the way it reads....if > > you want to ensure interoperability the it seems that stronger language would > > be needed (but that’s my personal bias). > > > > Section 2.2: > > - The rationaleThere may be some corner case in which there may be a very > > large > > (2K?) structure to be protected. It would be better to quantify "extremely > > large" or perhaps another/additional rationale for the need to ONLY do Pure > > edDSA is the intent for constrained devices not have enough memory to > > compute the block updates. > > > > [JLS] I don't know that I would consider a 2K message to be very large, I > > would expect a firmware update to be at least that large. The issue is that > > EdDSA needs to do two passes over the message, this means that the entire > > message needs to be held in memory. That would be limitation on what I > > would consider to be "extremely large". The presumption is that one is not > > going to try and create and stream the object out as this would also require a > > streaming processing on the recipient. If streaming is removed from the > > equation then there is no benefit not to use Pure EdDSA. This means that ones > > idea of large is going to be very device specific. I will not be surprised if some > > firmware packages do indirect signing, but the manifest description is still going > > to need to fit in memory. > > [NCW] 2Kbytes can seem very large to some IoT devices __. But your point is > > well taken...sorry if I was too nit-picky....as for guidance I personally prefer to > > have quantification (ranges). > > > > Section 4.1.1: > > - GCM's limitation for one encryption string is 2^39-256 e.g. not "a single > > key"....so sufficiently large for COSE! However, it does mean that the nonce > > MUST be unique for every encrypted message (e.g. the bullet before this one is > > correct). I think the limit for one key using GCM is based on the size of the > > nonce as it must be unique. > > [JLS] You are going to make me look this up again. However I think that this > > limit may end up being smaller with more modern analysis so going back and > > re--checking this is going to be worthwhile. It just will take a few days. > > [NCW] No worries, as an early adopter of GCM, I do recall that number being > > for a packet.... > > > > Section 4.2: > > - 'k' is the key size in bits (I presume), would be good to describe that before > > the table. > > [JLS] I changed the title of the column to 'Key Length' > > [NCW] Thanks. > > > > Editorial nits: > > Section 1.5 > > - The second sentence is hard to parse. Is it that the intermediate values > > used for debugging are represented in both a hex as well as a CBOR diagnostic > > notation format"? - Third sentence, is it that some examples were designed to > > fail (e.g. they are "failure test bases")? > > [JLS] I have updated this section. I think that this should solve your issues. > > > > A GitHub project has been created at <https://github.com/cose- > > wg/Examples> that contains a set of testing examples as well. > > Each example is found in a JSON file that contains the inputs used to > > create the example, some of the intermediate values that can be used for > > debugging, and the output of the example. > > The results are encoded using both hexadecimal and CBOR diagnostic > > notation format. > > > > > > Some of the examples are designed to test failure case; these are > > clearly marked as such in the JSON file. > > If errors in the examples in this document are found, the examples on > > GitHub will be updated, and a note to that effect will be placed in the JSON file. > > > > [NCW] Thank you, I can parse this better. > > > > Section 2.2: > > - The rationale for why Pure EdDSA is used only (vs. HashEdDSA) may leave > > more room for questions; as there may be some corner case in which there may > > be a very large (2K?) structure to be protected. For those that are in the > > healthcare sector (of IoT), I could see potential for large blocks and may wonder > > what qualifies as "extremely large". RFC 8032 speaks to HashEdDSA as > > providing better collision resilience...so am inclined to suggest to either remove > > this rationale or be more complete in justification. > > [JLS] See above. > > [NCW] OK > > > > Section 3.1 > > - 3rd paragraph: "Some recipient algorithms carry the key while others derive > > a key from secret data"....I think you mean "Some algorithms are used to > > transmit a key, e.g. key wrapping." "Carry the key", in this sentence leads me > > to imply it's the same key being used in the HMAC. > > [JLS] This is the same key that is being used in the HMAC algorithm. I have > > changed "carry" to "transport" because I think that is going to be clearer. > > [NCW] Yes, indeed, that makes it better. > > > > > > > > > From nobody Sat Jun 13 22:06:45 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4AE13A0A8E for ; Sat, 13 Jun 2020 22:06:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PtADjC6fjgKB for ; Sat, 13 Jun 2020 22:06:42 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DEC43A0A88 for ; Sat, 13 Jun 2020 22:06:42 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E56cbd026522 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 01:06:40 -0400 Date: Sat, 13 Jun 2020 22:06:38 -0700 From: Benjamin Kaduk To: Derek Atkins Cc: secdir@ietf.org Message-ID: <20200614050638.GI11992@kduck.mit.edu> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] sec-dir review of draft-ietf-cose-rfc8152bis-struct-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 05:06:44 -0000 Thanks Derek, we appreciate having the extra set of expert eyes. Roman put a Discuss in about making sure the data structure names we use are consistent/correct, and I had one that's being picky about the Internet Standard criteria and whether one feature qualifies for it. -Ben On Wed, Jun 10, 2020 at 05:44:07PM -0400, Derek Atkins wrote: > Hi, > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written with the intent of improving > security requirements and considerations in IETF drafts. Comments > not addressed in last call may be included in AD reviews during the > IESG review. Document editors and WG chairs should treat these > comments just like any other last call comments. > > Summary: > > * Ready to publish > > Details: > > * Just as a point of information, if I recall correctly I was also > present when this topic was first discussed ;) > > -derek > > -- > Derek Atkins 617-623-3745 > derek@ihtfp.com www.ihtfp.com > Computer and Internet Security Consultant > From nobody Sat Jun 13 22:09:37 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1E2AF3A0A8F for ; Sat, 13 Jun 2020 22:09:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.002 X-Spam-Level: X-Spam-Status: No, score=0.002 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Knfm8M8HztG for ; Sat, 13 Jun 2020 22:09:35 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1C6F73A0A8E for ; Sat, 13 Jun 2020 22:09:34 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E59TjL027136 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 01:09:32 -0400 Date: Sat, 13 Jun 2020 22:09:28 -0700 From: Benjamin Kaduk To: Carl Wallace , CARLOS JESUS BERNARDOS CANO Cc: secdir Message-ID: <20200614050928.GJ11992@kduck.mit.edu> References: <0269AE59-1EBB-4E40-BBD5-E65F0A07E45B@redhoundsoftware.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] secdir last call review of draft-ietf-dhc-slap-quadrant-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 05:09:36 -0000 Hi Carl, On Wed, May 27, 2020 at 08:19:48PM +0200, CARLOS JESUS BERNARDOS CANO wrote: > Hi Carl, > > Thanks a lot for your review and comments. Please see inline below. Seconded -- thanks for the review, and thanks Carlos for getting the updates in place so that the document was easier for me to review. (I entered a No Objection ballot with some mostly editorial suggestions.) -Ben From nobody Sat Jun 13 22:12:57 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B68463A0A99 for ; Sat, 13 Jun 2020 22:12:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 32n4cnu5WtNy for ; Sat, 13 Jun 2020 22:12:55 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 90FBE3A0A96 for ; Sat, 13 Jun 2020 22:12:55 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E5CpqW028034 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 01:12:53 -0400 Date: Sat, 13 Jun 2020 22:12:50 -0700 From: Benjamin Kaduk To: Rifaat Shekh-Yusef Cc: secdir@ietf.org Message-ID: <20200614051250.GK11992@kduck.mit.edu> References: <158833501993.21190.4904257765699741589@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <158833501993.21190.4904257765699741589@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-capport-rfc7710bis-04 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 05:12:57 -0000 Hi Rifaat, Thanks for the review and extended discussion with the authors/shepherd/AD. I made some comments continuing in a similar line of reasoning, seeking to clarify what is expected to be user-facing and how the chain of trust is established. (I also filed a Discuss point about an apparent internal inconsistency on whether the API URLs distributed by different mechanisms must be "identical" or merely "equivalent".) Thanks again, Ben On Fri, May 01, 2020 at 05:10:19AM -0700, Rifaat Shekh-Yusef via Datatracker wrote: > Reviewer: Rifaat Shekh-Yusef > Review result: Has Issues > > Since the use of IP address literal is not forbidden by this document, what if > an attacker with the ability to inject DHCP messages or RAs uses this option > to force the user to contact an IP address of his choosing? In this case, the use > of TLS and presenting the identity in the certificate might not be of much help. > > I think this case should be discussed in the security consideration section. > > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Sat Jun 13 22:16:05 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7FA43A0A9E for ; Sat, 13 Jun 2020 22:16:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.003 X-Spam-Level: X-Spam-Status: No, score=0.003 tagged_above=-999 required=5 tests=[RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9dUtulODOxQx for ; Sat, 13 Jun 2020 22:16:02 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A346A3A0A9D for ; Sat, 13 Jun 2020 22:16:01 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05E5FtKZ028711 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 14 Jun 2020 01:15:59 -0400 Date: Sat, 13 Jun 2020 22:15:55 -0700 From: Benjamin Kaduk To: Robert Sparks Cc: secdir@ietf.org Message-ID: <20200614051555.GL11992@kduck.mit.edu> References: <158825881446.11261.3022047238117789821@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <158825881446.11261.3022047238117789821@ietfa.amsl.com> User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-capport-api-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 05:16:04 -0000 Thanks for the review, Robert! I filed a No Objection ballot with some suggestions for how to improve the discussion of TLS usage/configuration, and a couple of pedantic errors in the HTTP and JSON usage. (Roman filed a Discuss ballot to try and clarify the API server vs. web-portal terminology/discussion, including which one is likely to get PII.) -Ben On Thu, Apr 30, 2020 at 08:00:14AM -0700, Robert Sparks via Datatracker wrote: > Reviewer: Robert Sparks > Review result: Ready > > I have reviewed this document as part of the security directorate's ongoing > effort to review all IETF documents being processed by the IESG. These comments > were written primarily for the benefit of the security area directors. Document > editors and WG chairs should treat these comments just like any other last call > comments. > > This document is ready for publication as Proposed Standard RFC. > > The document defines an HTTP json-based API for clients to use with a captive > portal API server. Discovery of the API server URL is defined in other capport > documents. Connection to the server uses TLS. Server authentication SHOULD use > OCSP stapling, and the network SHOULD provide permit connection to NTP servers > (or other time-sync mechanisms). The security considerations section calls out > the potential risk of look-alike characters being used in the server domain > name to mislead the user of the client of this API. > > > > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Sun Jun 14 06:41:02 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E46B33A07F4 for ; Sun, 14 Jun 2020 06:40:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.002 X-Spam-Level: X-Spam-Status: No, score=0.002 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4I-Q8vT7WOPU for ; Sun, 14 Jun 2020 06:40:55 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6180E3A07F2 for ; Sun, 14 Jun 2020 06:40:55 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id c185so13314390qke.7 for ; Sun, 14 Jun 2020 06:40:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to; bh=iM2WVBxpBjZr68A37E/xV/4d5fYsjOXhcE5xqBjYEB4=; b=IRu3UhLpfQvyEkHr5rhOL40D94xOBJpXI9wMAodCfnvkeQRphrGJnfd3jsU2H+KGKc UOtwAefo3yHwcqPN9c2LAmcD5m3uSRm5M38LWTIXfJoxqsyWS3aA0ymo5OCk/qhtiyFX fpLypTukVllDOgfBY/5gtzPhYo45TA+S/iOZ7sZuu+3RlLXehn5GbFUYkAMgNqZJl6XE my6FEaSkiYVW7o5IaD51W8w9Uw7SYyBxTeqsQzaRpNJYoG+Pab0mUW4/h/juqHvFxDMr mC1NerhS15HsetxfFRlgxrjS6yAmpUIABmVM+KsrvVXNIyN65MrTuNxBgi/xMB6b7O6z 89Mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=iM2WVBxpBjZr68A37E/xV/4d5fYsjOXhcE5xqBjYEB4=; b=qPa0eCC/vSF/RZAr0Hc8ZaMMcYU71vTPhjD8vEkbpCyVXjLePaUCg/ErEPj6dYyPYW tM2fcRdH4lbDepGsSS0pr/ZU/PNezwOboAeXccdHHVqaTglh3/2sUBevyj6UXs5q1dDs srZFDIkWRIKFSwitA/NpUcdBAq1DQpGaOTn33u1i7MISoUDcbyS0v/Pr/ZVqGcxjvHWY mUcprinkUwY+/CqOwPSuHuL36QuQt6GZg9HIfBZ4lDd+7klJrSc1jolaUDsF96Ppkxbf q5tMSTtKa14ib5Mbt5Lz7swF457r6++5fzNkpNKWIvqEsf98xnt7uJecRXw/o6gmPo7W EZ9Q== X-Gm-Message-State: AOAM531rJF34qiZvQcYLAP4/k48/DoEqTdm1JI2G/vCMrBTahBa7tlwc qmz8gDY8tMdNjKcqT/WqYjo/xw== X-Google-Smtp-Source: ABdhPJyWfOrYvNozJ+OboBWFYTu3ZWUjyZ/WWAYC0IwvYIBmGPkbBXvtD9mfTRojOaP28XbQPBxT2g== X-Received: by 2002:a05:620a:1525:: with SMTP id n5mr11069078qkk.328.1592142054378; Sun, 14 Jun 2020 06:40:54 -0700 (PDT) Received: from LakeHartwell.local ([2601:154:c001:f99e:7c90:3d3e:34c5:9457]) by smtp.gmail.com with ESMTPSA id p22sm9927122qtc.7.2020.06.14.06.40.53 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 14 Jun 2020 06:40:53 -0700 (PDT) To: Harlan Stenn , Karen O'Donoghue Cc: Daniel Franke , secdir@ietf.org, draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org References: <13D6D5C7-090A-4C68-8F0B-EA6DE18FB1E9@gmail.com> <08544d38-b025-8fa0-a0e8-d87f459421d7@nwtime.org> From: Brian Haberman Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: <5690c3fe-254e-c092-791e-bf31dab8fceb@innovationslab.net> Date: Sun, 14 Jun 2020 09:40:51 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <08544d38-b025-8fa0-a0e8-d87f459421d7@nwtime.org> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="8RGDtf4i1EcLNZITYOaZwtnN1L5zAoW4g" Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 13:40:57 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --8RGDtf4i1EcLNZITYOaZwtnN1L5zAoW4g Content-Type: multipart/mixed; boundary="eFpY5e7TQOFpJxF5E5lcU1x60cu46tlKc" --eFpY5e7TQOFpJxF5E5lcU1x60cu46tlKc Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable On 6/14/20 12:53 AM, Harlan Stenn wrote: > The working group consensus is wrong, at least in this case. >=20 That is for the shepherding AD and IESG to decide. --eFpY5e7TQOFpJxF5E5lcU1x60cu46tlKc-- --8RGDtf4i1EcLNZITYOaZwtnN1L5zAoW4g Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAl7mKOQACgkQaNY8nFPR i2F0MQ/+NovVtVpWN3C3x86NSN9Y4LJpXOw5dqwB3bzQ5w320Y4TKdljAYqDtQtW E1fJUrp2ZnZffiCqjDmXEcTdE+YfXfb8semEtDYz+CfoKRlTY/Ks3CELNpuKsfGM eSsRvXQr8xJvs13TW5VGyXeLcO9ZU4rrD3eiD5EOJ5APUTRimoyr+e2Ts7EzHBd5 I3yvU2UnQAOIuBCwIi0cUHNnSc086P50C9Lvk0SV64uV2ZEqcbW19d3CG0dmklLX 1Fi1BoUvDYcIuHCzgUahQys8QjKFxBSt7RsxERk3ihhJJ/P8TjjKg0mwZ5hn7CuN VI2MWWF/WEurVX1rvXD0PgYu/LeVaWUkdkcgadwSF8Fx//ACDcerzfeKfJAHIIc8 hRcKnMd+C21AwwN2HgbjwW9vTW87anvfEPZr7LxjHwNv/3BFk1D2FRY23DDuwWrI 81TuqOa/zSRfscQqMnuM3+QoTWcTaU+RCtPRjGdqmtwocRRmOh2m73+XJaBEyo/k t7mF/il+RYvOKpt+07/MoL6pvSKu1VLzRfmFC2Yram9jxksm1VJp+MHKIm3/s1or 7WSUNCg6kZSD1aml0bd0ytQfd2M77uAW6r0NfHDPakNnAzaL1CZCsPdNzKv45Unz /63V1BiWtPr2aww0sx1iJHRw7JEUVO+5WmG57mhzGhbEC4nmljc= =CRkB -----END PGP SIGNATURE----- --8RGDtf4i1EcLNZITYOaZwtnN1L5zAoW4g-- From nobody Sun Jun 14 12:20:58 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EA2D83A0AEA; Sun, 14 Jun 2020 12:10:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592161854; bh=lYT5taHAAj8wlizYG/Wqka3kd1uVUQpwQxxKcfsHcys=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=QP7YIIPXKljfIrnKQP+WPx5mTV1xqrNjpqAp6IBvj/cEYzNS+z+gWyH5+TSKAa6OM LdlQ08whRlhvtObz81VEBWdONwU3Xyj6ujE31k5z+us1CODMaleVlZCoxuAdiKLyFe 1d74hHBvon+Y17TOeak/2HdY2HKr5z9GHo/2oxAE= X-Mailbox-Line: From new-work-bounces@ietf.org Sun Jun 14 12:10:48 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E60173A0ABA; Sun, 14 Jun 2020 12:10:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592161841; bh=lYT5taHAAj8wlizYG/Wqka3kd1uVUQpwQxxKcfsHcys=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=KTPxr69oVJZE5p6XEkix2rVXKeXx05RJ+3/H8HNvUy0lqPrYJ+Zu3fUHRkC45eYTZ 2x4Lj66s9aj57KxuV7gvAPYwQaYfCzZSp+LtMiZ5wP6DB47uHYwedrENP9cuzVFm+S 9nLCGmXK+zH5Oeg90lCfF7wMUXnmnxpn+snxRegY= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DF41E3A0A5E for ; Sun, 14 Jun 2020 12:10:34 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.3.1 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <159216183489.14659.5320538705774003053@ietfa.amsl.com> Date: Sun, 14 Jun 2020 12:10:34 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Sun, 14 Jun 2020 12:20:56 -0700 Subject: [secdir] [new-work] WG Review: Automatic SIP trunking And Peering (asap) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 19:10:59 -0000 QSBuZXcgSUVURiBXRyBoYXMgYmVlbiBwcm9wb3NlZCBpbiB0aGUgQXBwbGljYXRpb25zIGFuZCBS ZWFsLVRpbWUgQXJlYS4gVGhlCklFU0cgaGFzIG5vdCBtYWRlIGFueSBkZXRlcm1pbmF0aW9uIHll dC4gVGhlIGZvbGxvd2luZyBkcmFmdCBjaGFydGVyIHdhcwpzdWJtaXR0ZWQsIGFuZCBpcyBwcm92 aWRlZCBmb3IgaW5mb3JtYXRpb25hbCBwdXJwb3NlcyBvbmx5LiBQbGVhc2Ugc2VuZCB5b3VyCmNv bW1lbnRzIHRvIHRoZSBJRVNHIG1haWxpbmcgbGlzdCAoaWVzZ0BpZXRmLm9yZykgYnkgMjAyMC0w Ni0yNC4KCkF1dG9tYXRpYyBTSVAgdHJ1bmtpbmcgQW5kIFBlZXJpbmcgKGFzYXApCi0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tCkN1cnJlbnQgc3RhdHVzOiBQcm9wb3NlZCBXRwoKQ2hhaXJzOgogIFRCRAoKQXNzaWdu ZWQgQXJlYSBEaXJlY3RvcjoKICBNdXJyYXkgS3VjaGVyYXd5IDxzdXBlcnVzZXJAZ21haWwuY29t PgoKQXBwbGljYXRpb25zIGFuZCBSZWFsLVRpbWUgQXJlYSBEaXJlY3RvcnM6CiAgQmFycnkgTGVp YmEgPGJhcnJ5bGVpYmFAY29tcHV0ZXIub3JnPgogIE11cnJheSBLdWNoZXJhd3kgPHN1cGVydXNl ckBnbWFpbC5jb20+CgpNYWlsaW5nIGxpc3Q6CiAgVEJECgpHcm91cCBwYWdlOiBodHRwczovL2Rh dGF0cmFja2VyLmlldGYub3JnL2dyb3VwL2FzYXAvCgpDaGFydGVyOiBodHRwczovL2RhdGF0cmFj a2VyLmlldGYub3JnL2RvYy9jaGFydGVyLWlldGYtYXNhcC8KClRoZSBkZXBsb3ltZW50IG9mIGEg U2Vzc2lvbiBJbml0aWF0aW9uIFByb3RvY29sIChTSVApLWJhc2VkIGluZnJhc3RydWN0dXJlIGlu CmVudGVycHJpc2UgYW5kIHNlcnZpY2UgcHJvdmlkZXIgY29tbXVuaWNhdGlvbiBuZXR3b3JrcyBo YXMgYmVlbiBncmFkdWFsbHkKaW5jcmVhc2luZyBvdmVyIHRoZSBsYXN0IGZldyB5ZWFycy4gQ29u c2VxdWVudGx5LCBkaXJlY3QgSVAgcGVlcmluZyBiZXR3ZWVuCmVudGVycHJpc2UgYW5kIHNlcnZp Y2UgcHJvdmlkZXIgbmV0d29ya3MgaXMgcmVwbGFjaW5nIHRyYWRpdGlvbmFsIG1ldGhvZHMgb2YK aW50ZXJjb25uZWN0aW9uIGJldHdlZW4gdGhlc2UgbmV0d29ya3MsIHN1Y2ggYXMgYW5hbG9nIGxp bmVzIGFuZAp0aW1lLWRpdmlzaW9uIG11bHRpcGxleGluZyAoVERNKS1iYXNlZCBkaWdpdGFsIGNp cmN1aXRzLgoKQ3VycmVudGx5IHB1Ymxpc2hlZCBzdGFuZGFyZHMgcHJvdmlkZSBhIHN0cm9uZyBm b3VuZGF0aW9uIG92ZXIgd2hpY2ggZGlyZWN0CklQIHBlZXJpbmcgY2FuIGJlIHJlYWxpemVkLiBI b3dldmVyLCBnaXZlbiB0aGUgc2hlZXIgbnVtYmVyIG9mIHRoZXNlCnN0YW5kYXJkcywgaXQgaXMg b2Z0ZW4gdW5jbGVhciB3aGljaCBiZWhhdmlvdXJhbCBzdWJzZXRzLCBleHRlbnNpb25zIHRvCmJh c2VsaW5lIHByb3RvY29scyBhbmQgb3BlcmF0aW5nIHByaW5jaXBsZXMgb3VnaHQgdG8gYmUgY29u ZmlndXJlZCBieSB0aGUKZW50ZXJwcmlzZSBuZXR3b3JrIGFkbWluaXN0cmF0b3IgdG8gZW5zdXJl IHN1Y2Nlc3NmdWwgSVAgcGVlcmluZyB3aXRoIGEgU0lQCnNlcnZpY2UgcHJvdmlkZXIgbmV0d29y ay4gVGhpcyBsYWNrIG9mIGNvbnRleHQgb2Z0ZW4gbGVhZHMgdG8KaW50ZXJvcGVyYWJpbGl0eSBp c3N1ZXMgYmV0d2VlbiBlbnRlcnByaXNlIGFuZCBzZXJ2aWNlIHByb3ZpZGVyIFNJUCBuZXR3b3Jr cy4KQXMgYSByZXN1bHQsIGEgc2lnbmlmaWNhbnQgYW1vdW50IG9mIHRpbWUgaXMgc3BlbnQgYnkg ZW50ZXJwcmlzZSBuZXR3b3JrCmFkbWluaXN0cmF0b3JzIGluIHRyb3VibGVzaG9vdGluZyB0aGVz ZSBpbnRlcm9wZXJhYmlsaXR5IGlzc3VlcyBpbmRpdmlkdWFsbHkKb3Igd2l0aCBlbnRlcnByaXNl IGVxdWlwbWVudCBtYW51ZmFjdHVyZXIgYW5kIHNlcnZpY2UgcHJvdmlkZXIgc3VwcG9ydCB0ZWFt cy4KQ29uc2VxdWVudGx5LCB0aGVyZSBpcyBhbiBpbmNyZWFzZSBpbiB0aGUgdGltZSB0YWtlbiB0 byBkZXBsb3kgU0lQIHRydW5raW5nCmJldHdlZW4gZW50ZXJwcmlzZSBhbmQgc2VydmljZSBwcm92 aWRlciBuZXR3b3Jrcy4KClRoZSBBU0FQIHdvcmtpbmcgZ3JvdXAgd2lsbCBkZWZpbmUgYSBkZXNj cmlwdGl2ZSBjYXBhYmlsaXR5IHNldCwgd2hpY2ggaXMKcG9wdWxhdGVkIGJ5IGEgU0lQIHNlcnZp Y2UgcHJvdmlkZXIsIGFuZCB3aGljaCwgd2hlbiBjb21tdW5pY2F0ZWQgdG8gYW4KZW50ZXJwcmlz ZSBuZXR3b3JrLCBlbmNhcHN1bGF0ZXMgc3VmZmljaWVudCBpbmZvcm1hdGlvbiB0byBzZXQgdXAg U0lQCnRydW5raW5nIHdpdGggdGhlIHNlcnZpY2UgcHJvdmlkZXIgbmV0d29yay4gSW4gYWRkaXRp b24gdG8gZGVmaW5pbmcgYQpkZXNjcmlwdGl2ZSBjYXBhYmlsaXR5IHNldCwgdGhlIEFTQVAgd29y a2luZyBncm91cCB3aWxsIGRlZmluZSBhIGRhdGEgbW9kZWwKZm9yIHRoZSBjYXBhYmlsaXR5IHNl dCwgYSBzZXJ2aWNlIGRpc2NvdmVyeSBtZWNoYW5pc20gYW5kIGEgdHJhbnNwb3J0Cm1lY2hhbmlz bSBmb3IgdGhlIGNhcGFiaWxpdHkgc2V0LiBUaGUgYWZvcmVtZW50aW9uZWQgZGVsaXZlcmFibGVz IG9mIHRoZSBBU0FQCndvcmtpbmcgZ3JvdXAgYXJlIGNvbGxlY3RpdmVseSByZWZlcnJlZCB0byBh cyDigJxTSVAgQXV0byBQZWVy4oCdLgoKVGhlIHNjb3BlIG9mIHRoZSBBU0FQIHdvcmtpbmcgZ3Jv dXAgaXM6CgoqIEEgY2FwYWJpbGl0eSBzZXQgdGhhdCBlbmNhcHN1bGF0ZXMgc3VmZmljaWVudCBp bmZvcm1hdGlvbiB0byBlbnN1cmUgc21vb3RoCklQIHBlZXJpbmcgYmV0d2VlbiBlbnRlcnByaXNl IGFuZCBzZXJ2aWNlIHByb3ZpZGVyIFNJUCBuZXR3b3Jrcy4KCiogQSBkYXRhIG1vZGVsIGZvciB0 aGUgY2FwYWJpbGl0eSBzZXQuCgoqIEFuIEhUVFBTLWJhc2VkIHRyYW5zcG9ydCBtZWNoYW5pc20g Zm9yIHRoZSBjYXBhYmlsaXR5IHNldC4KCiogQSBtZWNoYW5pc20gdG8gZGlzY292ZXIgdGhlIHNl cnZlcihzKSBpbiB0aGUgU0lQIHNlcnZpY2UgcHJvdmlkZXIgbmV0d29yawp0aGF0IGhvc3RzIHRo ZSBjYXBhYmlsaXR5IHNldC4KCiogQSBtZWNoYW5pc20gdG8gZXh0ZW5kIHRoZSBkYXRhIG1vZGVs IHRvIGFsbG93IHRoZSBlbmNvZGluZyBvZiBwcm9wcmlldGFyeQpwYXJhbWV0ZXJzLgoKVGhlIGZv bGxvd2luZyBhcmUgb3V0IG9mIHNjb3BlOgoKKiBFeHRlbnNpb25zIHRvIFNJUCB0aGF0IGVuYWJs ZSBhbiBlbnRlcnByaXNlIG5ldHdvcmsgdG8gc29saWNpdCBhbmQgb2J0YWluIGEKZGVzY3JpcHRp dmUgY2FwYWJpbGl0eSBzZXQgZnJvbSBhIFNJUCBzZXJ2aWNlIHByb3ZpZGVyLgoKKiBBIHdvcmtm bG93L21lY2hhbmlzbSB0aGF0IGFsbG93cyBzZXJ2aWNlIHByb3ZpZGVycyB0byBkaXJlY3RseSBj b25maWd1cmUKZGV2aWNlcyBpbiB0aGUgZW50ZXJwcmlzZSBuZXR3b3JrLgoKVGhlIGdyb3VwIHdp bGwgcHJvZHVjZToKCiogU3BlY2lmaWNhdGlvbiBmb3IgU0lQIEF1dG8gUGVlcgoKVGhpcyBncm91 cCB3aWxsIGNvLW9yZGluYXRlIHdpdGggdGhlIFNJUENPUkUgd29ya2luZyBncm91cCBhbmQgdGhl IFNJUENvbm5lY3QKZWZmb3J0cyBjYXJyaWVkIG91dCBieSB0aGUgU0lQIEZvcnVtLgoKTWlsZXN0 b25lczoKPERhdGUgVEJEPiBTZW5kIHByb3RvY29sIHNwZWNpZmljYXRpb24gdG8gSUVTRwoKCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCm5ldy13b3JrIG1h aWxpbmcgbGlzdApuZXctd29ya0BpZXRmLm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL25ldy13b3JrCg== From nobody Sun Jun 14 13:47:00 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3ECBC3A128A; Sun, 14 Jun 2020 13:46:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, T_SPF_HELO_TEMPERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WnXzzvNPCkL2; Sun, 14 Jun 2020 13:46:46 -0700 (PDT) Received: from chessie.everett.org (chessie.everett.org [66.220.13.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB8013A1230; Sun, 14 Jun 2020 13:46:46 -0700 (PDT) Received: from [10.208.75.157] (075-139-194-196.res.spectrum.com [75.139.194.196]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by chessie.everett.org (Postfix) with ESMTPSA id 49lRMp04sfzL7c; Sun, 14 Jun 2020 20:46:45 +0000 (UTC) To: Karen O'Donoghue Cc: Brian Haberman , Daniel Franke , secdir@ietf.org, draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org References: <13D6D5C7-090A-4C68-8F0B-EA6DE18FB1E9@gmail.com> From: Harlan Stenn Autocrypt: addr=stenn@nwtime.org; keydata= mQGNBFI2xmQBDACrPayw18eU4pIwCvKh7k0iMkAV9cvzs49kBppM+xoH+KKj4QWmkKELD39H ngQnT3RkKsTLlwxyLqPdUmeQNAY2M5fsOK+OF6EvwLPK9hbmE3Wx2moX+sbEUxJ2VzFhKSKb OPZALXwk1XxL0qBedz0xHYcDwaSAZZkEFXURv2pDIdrmnoUnq2gdC8GpoFJiXoUaCLSYzzaY ac4Njw7Mue8IqfzRQb70aMjXl/qmsmfmEVAyGXywDdc/ler4XSgiuYOV7Kf69bj9PFZZSMdJ MWgEyZH6lJ0TU5ccR2zp5ZRmWzQQkxJMyH2th7q0Nmz3aX4A0K4yE0Ba9/5Dr7ctpF15BrMF aEo4s5lwI6tUnkgMWo265mMzCz4mAPV/ac0w0OXQg7r9E2r0+dRapnzUlG43D0JLDqDr9uRR L6IrRQqoCWUC75lfmPYQYSlaTJaK68r3lXd0z1cXJUgVtEL5H3/Z71R2B20twcQVAnw2iIH6 L5vdrsIjHrMmkqRVbs9nNyEAEQEAAbQ5SGFybGFuIFN0ZW5uIChOZXR3b3JrIFRpbWUgRm91 bmRhdGlvbikgPHN0ZW5uQG53dGltZS5vcmc+iQG5BBMBAgAjBQJSNsblAhsvBwsJCAcDAgEG FQgCCQoLBBYCAwECHgECF4AACgkQyIwAt1pH+kBlzgv/QOg70vdj8wU/z97UPdlbxtN4THAB gfSX4N0VPKT5fjX1tFhuXZQAOv7wedR3Trh7TGteyg33TBAFf9A42mXZKi1IxAiQG118Hd8I 51rXwnugURIYQaIyQI+vbchRbwVyz+mVLTI/h6FdbsVzT4UFmir+ZMkb/XeZPu0HItk4OZHE 6hk+TuTiCnlqlCPLq371fXV54VOb91WZYD8EQFtK02QHGHsQqWvapdphiDVpYehmsPyiTESq NMKLVtjtyPkQ6S7QF3slSg+2q3j8lyxEA78Yl0MSFNU8B/BtKgzWP2itBOfi+rtUKg+jOY1V /s2uVk2kq2QmHJ/s5k5ldy3qVvoTpxvwBe0+EoBocTHYt+xxp0mTM6YY1xLiQpLznzluqg9z qtejX1gZOF4mgLiBIrhXzed3zsAazhTp5rNb1kn0brZFh6JC5Wk941eilnA4LqX8AWo0lmwo eb+mpwZK/5lNdage/anpVqft9wJ/8EcvST9TLUO4fPrmT3d/0LpWuQGNBFI2xmQBDADXLsBk I7CSa5UXlrNVFJQHER1VxRBKqjWWCh/8Qv9v3p3NrIc2UnhoZ1uWQ2voBGty5Xfy9k4afV5k WwDyRDUIb7PX+Tj4HjVVr7qvnOVe/0KzZpNq0Azd0ggFbsM+8mydktHIwJykW0NUsGwPRYuD OA0Lro0ohb5IiCt3sSQi1X1hYjo7O1Vmn8Gy/XYOnhnMux+5zDPO2yTkCNX5PocYi9IJJy6p Mq1yQV4Y2Dl8KtQzvtq55vCUxx6n0MMzFViGwNW6F4ge9ItO4tDScsgowDrHa208ehwOpv/i wjf93lCClQ6vaKmOBX872K/tdY/hwhxPPjgl1bcrOwMRYVemOPPehwnXH5bwclk1hvDQdkJQ 5pJOkE4VCryTF/iDAt4g2QnHocUwt3b6/ChUUWmj2GZ22OR12rbnCtLedwp0DpViKPUCQHBO vpgXdzE/L9zWar9fqM0EREMgfWbsJc9028qluCcFLIN1gYsq4cC+YGAcOu7HOI5orBBV4m9j XfsAEQEAAYkDPgQYAQIACQUCUjbGZAIbLgGpCRDIjAC3Wkf6QMDdIAQZAQIABgUCUjbGZAAK CRDfCQ/G52/8P/uWDACe7OEM+VETDRqjQgAwzX+RjCVPvtgrqc1SExS0fV7i1mUUxr/B8io3 Y1cRHFoFKmedxf8prHZq316Md5u4egjFdTT6ZqEqkK0hvv+i0pRpCa5EX9VIStcJStomZp8F cY34grA+EOWITaLQ4qNZUP7rf2e7gq1ubQTj7uLr6HZZvMZ5em+IvrOWEuWDI6yOiI6px04w RDfkoR2h6kgdw4V0PT4NjK9WYYKrVCf1bjLlVImNBEcXfvlUTrIYO8y6ptvoUsBQky5pQRvP 99Pn42WfyLy50aII6+vyudD4T0yLjXAz4KteUttxtIte64m/F9/7GEIZAxTUcLyOq/7bP4le h39jBckwc62iYzeK/VkU/bMMh2D68Z3QylMnhhcW27BcgQHPKsHhmFa2SNytYcuQiSdf9+pj 4i32ETz1nJAvYAAqgTF/0PL+8ZNQoEpe/n9woMKrlZrqD4EgFmhQ3bNVhlaXz1nuTZDrwPt1 yMxBuUNbCF4jFnaruwrSiGTRoIfUZQwAjQglahrV4/mcjfnvbNoseHX0PKd9q+wjg7MIjWqr f2CI8Fa6MdanqwYphz43I2yXANKFZuMWsWqyQYlvGuPUlUUcAL3stp24RkzDB1Q+JS0IZJST T2JSu0aTfUdWVNqr2UI19eX+zxbOTckSi3Ng14ezG8ZX194ZH10b8JzntQOwmA20pd5JDhug zQfASER+CZDiPPcQ4mvC4y7rMrfV6XGQbDynC3ekDxo8SC5SvjaczXMwXg6SZ8iFtEWmEwW9 r7zPjjIPDrX8w5LXBgxArM5o/HbERpc2EdAvMh1D7LC0SvmoE7fBKxsicVBe4h6vXjEZ+LLr /wuZiBld9OnxAUIpwptbBspO6WKTQYvgFH2OeDG27hiE5P4Xs4WSp5j9ez8OVB1iZnA2nCQ+ tNTjO8c+C/P92vPLx5+bpGRXTXMNaLh34PS3ZsYoUDkKZNhczRZUWJ7nynSbeeyF+QW7SLwA qY7O7dyk9LFTsfJqRQJ7tWnIAjJPCwmSgQ8Kl0UJ Message-ID: <5689163e-1113-ff97-b94c-2d8d3550cafb@nwtime.org> Date: Sun, 14 Jun 2020 13:46:45 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <13D6D5C7-090A-4C68-8F0B-EA6DE18FB1E9@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Jun 2020 20:46:52 -0000 On 6/13/2020 9:10 PM, Karen O'Donoghue wrote: > Folks, > > All of this was discussed during the development of this document. There was strong working group consensus to not publish as Standards Track. I recall discussion about this in the WG meetings I attended. Was the "final" decision made at the WG meeting I was unable to attend, the meeting where all of the other proposals I had in various stages of adoption were ... removed from consideration by the WG? > As described, there were concerns about the solution. I don't know what you mean by "the solution" - please clarify? I also don't know what these "concerns" are. Please clarify. > The working group has gone back and forth between historic and informational. It should be Standards track, and optional implementation. H -- > Regards, > Karen > >> On Jun 13, 2020, at 8:27 PM, Harlan Stenn wrote: >> >> On 6/13/2020 11:15 AM, Brian Haberman wrote: >>> Thanks for the review, Daniel. A quick follow-up below for those of you >>> playing along at home... >>> >>>> On 6/13/20 11:18 AM, Daniel Franke via Datatracker wrote: >>>> Reviewer: Daniel Franke >>>> Review result: Ready >>>> >>>> I have reviewed this document as part of the security directorate's ongoing >>>> effort to review all IETF documents being processed by the IESG. These >>>> comments were written with the intent of improving security requirements and >>>> considerations in IETF drafts. Comments not addressed in last call may be >>>> included in AD reviews during the IESG review. Document editors and WG chairs >>>> should treat these comments just like any other last call comments. >>>> >>>> This document describes a historic protocol whose design falls far short of >>>> modern IETF standards. Its myriad issues are well-described in the Security >>>> Considerations section. >>>> >>>> There has been some debate as to whether the appropriate status for this >>>> document is Historic or Informational. I believe the currently-intended >>>> Historic status is more appropriate. The argument I have heard repeatedly in >>>> favor of Informational status is that it is not appropriate to classify a >>>> protocol as Historic until a better alternative exists with a published >>>> specification. I believe that better alternative exists, which is to have no >>>> standard at all. It's perfectly fine for NTP monitoring and management >>>> protocols to be vendor-specific. In virtually all legitimate uses ("legitimate" >>>> so as to exclude RDoS attacks), both sides of the protocol run on systems >>>> managed by the same organization and the need for vendor-specific tools is not >>>> a practical issue. Lack of standardization is the already the status quo, since >>>> there are many widely-used NTP implementations out there but only the Network >>>> Time Foundation implementation and its derivatives (such as NTPsec) support >>>> this protocol. I know of nobody who has ever been inconvenienced by this; >>>> standardization is a solution in search of a problem. >>>> >>>> >>> >>> Interestingly enough, RFC 1305 actually says this... >>> >>> "Ordinarily, these functions can be implemented using a >>> network-management protocol such as SNMP and suitable extensions to the >>> MIB database. However, in those cases where such facilities are not >>> available, these functions can be implemented using special NTP control >>> messages described herein." >> >> Why is RFC 1305 even being brought up in this situation? >> >> NTPv3 was updated to NTPv4. >> >> During that update, mode 6 and mode 7 were inadvertently not included. >> >> RFC 5905 was developed, as was 5906 and 5907. But mode 6 is still in >> active use and deserves a proper, updated specification. >> >>> SNMP exists and the NTP WG published RFC 5907 to cover the MIB support >>> needed by NTP. I believe that also counts as a better alternative. >> >> Unbelievable. >> >> TTBOMK, the only implementation of 5907 is the one in the reference >> implementation, and in the 12 years it has been out there we have had NO >> reports of it being used. Furthermore, it was implemented USING MODE 6 >> PACKETS! >> >> The only known SNMP interface to ntpd, ntpsnmpd has not seen significant >> updates since 2010. >> >> The mode 6 interface to ntpd, ntpq, remains in continuous development >> and evolution. >> >> Please identify any other implementations of 5907. If you find any, how >> significant are they? Are they proprietary 5907 implementations? What >> implementations to they work on? >> >> Please show how SNMP is a better way to monitor and control NTP than ntpq. >> >> Please show me a working deployment of SNMP controlling NTP, and then >> please compare the number and quality of these deployments with those >> that do the same with ntpq. >> >>> Regards, >>> Brian >>> >>> >>> _______________________________________________ >>> ntp mailing list >>> ntp@ietf.org >>> https://www.ietf.org/mailman/listinfo/ntp >>> >> >> -- >> Harlan Stenn >> http://networktimefoundation.org - be a member! >> >> _______________________________________________ >> ntp mailing list >> ntp@ietf.org >> https://www.ietf.org/mailman/listinfo/ntp > -- Harlan Stenn http://networktimefoundation.org - be a member! From nobody Mon Jun 15 06:10:49 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF4C13A0D62 for ; Mon, 15 Jun 2020 06:10:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ihtfp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FAVraGh4GkSD for ; Mon, 15 Jun 2020 06:10:46 -0700 (PDT) Received: from mail2.ihtfp.org (MAIL2.IHTFP.ORG [204.107.200.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCAE33A0D5E for ; Mon, 15 Jun 2020 06:10:46 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id 695E1E2048; Mon, 15 Jun 2020 09:10:40 -0400 (EDT) Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 15280-05; Mon, 15 Jun 2020 09:10:39 -0400 (EDT) Received: from securerf.ihtfp.org (IHTFP-DHCP-158.IHTFP.ORG [192.168.248.158]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mocana.ihtfp.org", Issuer "IHTFP Consulting Certification Authority" (not verified)) by mail2.ihtfp.org (Postfix) with ESMTPS id 2E032E203F; Mon, 15 Jun 2020 09:10:39 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ihtfp.com; s=default; t=1592226639; bh=WdRp4ge8c4is5XT5quVb6Ji7NX2/UntZIzlczBCTDvA=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=ZgwrHcKbQKGwNzLV4xiLSYkDV+Aj+gT7PgSCE+k9WNdCHDAXw9XV2BB+JMTF79TQS D/t+liQVUSIKWe4R1WAmLW8dU6FT8hQ+5fi9c8JdNelhxloKaJrax53a/vZW1lNL0f 9oVg3j/KP13Bt8Yuwa94QIiAB0Hodq0ZBiC/m7Cg= Received: (from warlord@localhost) by securerf.ihtfp.org (8.15.2/8.15.2/Submit) id 05FDAcgq006726; Mon, 15 Jun 2020 09:10:38 -0400 From: Derek Atkins To: Benjamin Kaduk Cc: secdir@ietf.org References: <20200614050638.GI11992@kduck.mit.edu> Date: Mon, 15 Jun 2020 09:10:38 -0400 In-Reply-To: <20200614050638.GI11992@kduck.mit.edu> (Benjamin Kaduk's message of "Sat, 13 Jun 2020 22:06:38 -0700") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Virus-Scanned: Maia Mailguard 1.0.2a Archived-At: Subject: Re: [secdir] sec-dir review of draft-ietf-cose-rfc8152bis-struct-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jun 2020 13:10:48 -0000 Hi Ben, Benjamin Kaduk writes: > Thanks Derek, we appreciate having the extra set of expert eyes. > Roman put a Discuss in about making sure the data structure names we use > are consistent/correct, and I had one that's being picky about the Internet > Standard criteria and whether one feature qualifies for it. Yes, I saw your two discusses as well. When I was reviewing it I was focusing on the security considerations and not on all those consistency issues. > -Ben -derek -- Derek Atkins 617-623-3745 derek@ihtfp.com www.ihtfp.com Computer and Internet Security Consultant From nobody Mon Jun 15 08:29:52 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B476C3A0E5A for ; Mon, 15 Jun 2020 08:29:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9pSOrjYDf488 for ; Mon, 15 Jun 2020 08:29:49 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D04D3A0E7F for ; Mon, 15 Jun 2020 08:29:47 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id e16so12906318qtg.0 for ; Mon, 15 Jun 2020 08:29:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=to:cc:references:from:autocrypt:subject:message-id:date:user-agent :mime-version:in-reply-to; bh=teZAyoi+lGBRZw9VpGFAfNT6hIInii8q7T87C/jV5MU=; b=FaHq74bnRQZpCgU8hk+x1JQ7nHCctUtVGlyrNnjLt1krEBhUQLVyYlaHFNp8gXU/+k CrmpsU6olnzpgPU6MXF4n/jp1n/Y99dTZPWs6kCWCkUFv2shGLVd4JZSgI7fy1iZFs0w Dn3g3AjYLDCTx7xTjmAarR2fIVrYd/JPlHn78OtquFsQBSLaLbO+N9thD1YQDrUNAXUH rrKkqEuiCNcCYtxFQ2keqFhuxt7DDvVAwFBTU0OPNp2RTBezMjyJ7QW7FvqRDCwKXeRf DdX5eBp0XMtBgBLzmAK/jRxZV5TZslhtkKxzuwMv8iuY65Fa1WnY9/36zZUVw1e78NEn QaIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:to:cc:references:from:autocrypt:subject :message-id:date:user-agent:mime-version:in-reply-to; bh=teZAyoi+lGBRZw9VpGFAfNT6hIInii8q7T87C/jV5MU=; b=VIb6B38xFZ2co6a8MMy0bN609CZNqtH+cQmlY4xkvpOd6Ti7MOam3yk+JI98+2TX0V Qs4C2t3FlupTa85HSyTDjWJXlubtVnFDyRK2I6QjnWd8Hyp2qYqlC/0kxL5YxX9eBd4r 5zvuYQ1FfYkUQ0fB3humc7kSd9ZANRrzhnZV6ljtoWx4N/WxMZlA826yvIwDd7Q+9rAy 10uLODxK7YnSJ94DdDdoFzto9l8gAuAHTanUaiSClkUvAOm+8vDj0TjIwE4OIeCQez7E hQzJ1/D/S1LtWYzlqJcBcI0fzz5jjcml1CA6xyIe88d2OnGN793OxdwyYi8kmM33SNfN YmPg== X-Gm-Message-State: AOAM531Wi6o3KGYu7MpYf1w8pJkdrDbg2ahwCJBH23QvERc8n6ODW42f SpzWT3zS/JZ2L5XcFZpLytLJQA== X-Google-Smtp-Source: ABdhPJyQq308SbL+nOL2jz3KfWNo2qkCcDcy5ZddpM2cIO9vDm2IMEuZ9UDKLGJUSboY5Idl7/zB6w== X-Received: by 2002:ac8:3551:: with SMTP id z17mr16186914qtb.139.1592234985960; Mon, 15 Jun 2020 08:29:45 -0700 (PDT) Received: from clemson.local ([2601:154:c001:f99e:89bb:abe5:8ba6:8676]) by smtp.gmail.com with ESMTPSA id i40sm13319630qte.67.2020.06.15.08.29.44 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 Jun 2020 08:29:45 -0700 (PDT) To: Harlan Stenn , Daniel Franke , secdir@ietf.org Cc: draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org References: <159206148916.27533.2080482554461273224@ietfa.amsl.com> <4251f262-22f7-3b7d-41d4-e0c3ef1da1b8@innovationslab.net> From: Brian Haberman Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: <0b850187-0596-c9fd-6667-e571f7ef5ef7@innovationslab.net> Date: Mon, 15 Jun 2020 11:29:43 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="Yn8juVrN9MMyKxJlN289hwQ2PbVAPjoNk" Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jun 2020 15:29:51 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --Yn8juVrN9MMyKxJlN289hwQ2PbVAPjoNk Content-Type: multipart/mixed; boundary="djUhzMl15q3Fbaa8ad4fkzgqqVHhRelq1"; protected-headers="v1" From: Brian Haberman To: Harlan Stenn , Daniel Franke , secdir@ietf.org Cc: draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org Message-ID: <0b850187-0596-c9fd-6667-e571f7ef5ef7@innovationslab.net> Subject: Re: [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 References: <159206148916.27533.2080482554461273224@ietfa.amsl.com> <4251f262-22f7-3b7d-41d4-e0c3ef1da1b8@innovationslab.net> In-Reply-To: --djUhzMl15q3Fbaa8ad4fkzgqqVHhRelq1 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hi Harlan, On 6/13/20 8:26 PM, Harlan Stenn wrote: >> SNMP exists and the NTP WG published RFC 5907 to cover the MIB support= >> needed by NTP. I believe that also counts as a better alternative. >=20 > Unbelievable. >=20 > TTBOMK, the only implementation of 5907 is the one in the reference Interesting statement... After a cursory search, I found that Cisco implemented 5907 in 2012. > implementation, and in the 12 years it has been out there we have had N= O > reports of it being used. Furthermore, it was implemented USING MODE 6= > PACKETS! >=20 Not sure why you would implement SNMP support via an NTP auxiliary protocol, but that is your choice. > The only known SNMP interface to ntpd, ntpsnmpd has not seen significan= t > updates since 2010. >=20 > The mode 6 interface to ntpd, ntpq, remains in continuous development > and evolution. >=20 > Please identify any other implementations of 5907. If you find any, ho= w > significant are they? Are they proprietary 5907 implementations? What= > implementations to they work on? >=20 I would need someone from Cisco to verify, but it seems like their implementation is based on 5907. > Please show how SNMP is a better way to monitor and control NTP than nt= pq. >=20 > Please show me a working deployment of SNMP controlling NTP, and then > please compare the number and quality of these deployments with those > that do the same with ntpq. I am not going to dignify that demand with a response. The WG consensus is the WG consensus. Regards, Brian --djUhzMl15q3Fbaa8ad4fkzgqqVHhRelq1-- --Yn8juVrN9MMyKxJlN289hwQ2PbVAPjoNk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAl7nk+cACgkQaNY8nFPR i2G2zQ//RkKLnmakuZcVy0byi8vfDjymKGuMPynS2QHJH7U9bergQ1Ty3Gv1tR+C LoNP2vCoXc+FvQvkleuMICMIoAUiJucIb9aNgWdxp841wwc0l2hRdvG30KMplx2+ k+r32aIf4kMUEENOqvhaeRM4jj+nbcVBletJig7eSfzjUUh3/AVdWjClQMRgdi0Q tFjxTYdArCRsJ7OdTMZ7MFQ+lt+Wd7xK3gdyekSUY3Lyi+rCA+40vgIz7jMi02sr qgHXVa4Cx3zOl6vEjz8udyJ1zW0rWtsWFYs8vcaNoLriXTFymnfkAYavUTGcZy2P XNAJCYw7ApqM/DXrdMGbnl85Np//gdja0WY7IP78x82HChkR+D9XBULUMCMX8iE3 5M5pQIzcA2L6OrIvgGbAy/ka4l7Hlt8+HmBImGkdNxQ3Y2oxj9UGOb54CZmeAdyn z+O/p8jwZHGR4kt3n3jp4xsZD+G39JCtKIuFUtH+uRmkBFQWLfYM0CRyuX6N8f3b hbFA0+Zji8Z7151VTk5AyquPLfnsG0oi4Hk2PCKywMWyiK+6eImooLExHR5BWu0R ysNj0O0FNtFWsYB5nrhFmjIhnEi5GUy4C34rJPWN/CHmGviEJsnGngnzBzgACnKI mY2he5kmpvrotuJAQ5Ab3cLzr8atrNc8H0IBeOC8RqzyHKT6/ZY= =bwb1 -----END PGP SIGNATURE----- --Yn8juVrN9MMyKxJlN289hwQ2PbVAPjoNk-- From nobody Mon Jun 15 13:22:10 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E97253A0B21 for ; Mon, 15 Jun 2020 13:22:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3DJMom1RPqp5 for ; Mon, 15 Jun 2020 13:22:06 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF4AF3A0C86 for ; Mon, 15 Jun 2020 13:21:49 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 05FKLjps016128 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 15 Jun 2020 16:21:48 -0400 Date: Mon, 15 Jun 2020 13:21:45 -0700 From: Benjamin Kaduk To: Derek Atkins Cc: secdir@ietf.org Message-ID: <20200615202145.GJ11992@kduck.mit.edu> References: <20200614050638.GI11992@kduck.mit.edu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.1 (2019-06-15) Archived-At: Subject: Re: [secdir] sec-dir review of draft-ietf-cose-rfc8152bis-struct-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jun 2020 20:22:08 -0000 On Mon, Jun 15, 2020 at 09:10:38AM -0400, Derek Atkins wrote: > Hi Ben, > > Benjamin Kaduk writes: > > > Thanks Derek, we appreciate having the extra set of expert eyes. > > Roman put a Discuss in about making sure the data structure names we use > > are consistent/correct, and I had one that's being picky about the Internet > > Standard criteria and whether one feature qualifies for it. > > Yes, I saw your two discusses as well. > > When I was reviewing it I was focusing on the security considerations > and not on all those consistency issues. And it's entirely reasonable and within expecations to do so, to be clear. Thanks again! -Ben From nobody Mon Jun 15 13:33:21 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B10093A0EC3; Mon, 15 Jun 2020 08:10:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592233856; bh=kmVFfxLDVUrVMvtdsK5Mz1mbNMx1YhjEamriYtFwTEU=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=Fny0+IkVeHPkWmuxpUCPkVVymu7byt9CtwE2uJZCJUxYVFJ++gyVPl87LIqN+lq1d DamP1yRpDKkGZCh2QmBkKDu8rMuiQru29jQ4fnqVH7lUr8E6KWzG+0C6fMNg6Q5gu1 TKE8+T8v9RAUfAz5JzbfjKEC//OC3zng5TCTcW4M= X-Mailbox-Line: From new-work-bounces@ietf.org Mon Jun 15 08:10:50 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 715303A0EBA; Mon, 15 Jun 2020 08:10:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592233849; bh=kmVFfxLDVUrVMvtdsK5Mz1mbNMx1YhjEamriYtFwTEU=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=EwyK2vgpmKskh+gkgk4yhI6lES4g6MDtVKhNtd58BIimZEs7u1SbhM2OlhTvqpKLj zpF7HPJSuMFc+FfBE7ZGmeYMcoZ6MrNpoIYlpDJihngE5c3ma6x//Hm89kH7B1Q+Fw CEpKg8JQ7HCEGKE7HDnYvO+PlLAxty9zIn15DkIk= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32B113A0E69 for ; Mon, 15 Jun 2020 08:10:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.901 X-Spam-Level: X-Spam-Status: No, score=-0.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PCJJwPdm41je for ; Mon, 15 Jun 2020 08:10:44 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEB883A0E57 for ; Mon, 15 Jun 2020 08:10:34 -0700 (PDT) Received: from [42.100.4.210] (helo=[192.168.0.101]) by raoul.w3.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1jkqkm-0008Nu-4U for new-work@ietf.org; Mon, 15 Jun 2020 15:10:28 +0000 To: new-work@ietf.org From: xueyuan Message-ID: <73eb0024-1153-b7d4-75ad-00c13bdf6d9f@w3.org> Date: Mon, 15 Jun 2020 23:10:03 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Mon, 15 Jun 2020 13:33:21 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: WebTransport Working Group (until 2020-07-27) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Jun 2020 15:11:02 -0000 SGVsbG8sCgpUb2RheSBXM0MgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcyByZWNl aXZlZCBhIFByb3Bvc2FsCnRvIHJldmlldyBhIGRyYWZ0IGNoYXJ0ZXIgZm9yIHRoZSBXZWJUcmFu c3BvcnQgV29ya2luZyBHcm91cDoKIMKgIGh0dHBzOi8vd3d3LnczLm9yZy8yMDIwLzA2L3Byb3Bv c2VkLXdlYnRyYW5zcG9ydC1jaGFydGVyLmh0bWwKCkFzIHBhcnQgb2YgZW5zdXJpbmcgdGhhdCB0 aGUgY29tbXVuaXR5IGlzIGF3YXJlIG9mIHByb3Bvc2VkIHdvcmsKYXQgVzNDLCB0aGlzIGRyYWZ0 IGNoYXJ0ZXIgaXMgcHVibGljIGR1cmluZyB0aGUgQWR2aXNvcnkKQ29tbWl0dGVlIHJldmlldyBw ZXJpb2QuCgpXM0MgaW52aXRlcyBwdWJsaWMgY29tbWVudHMgdGhyb3VnaCAyMDIwLTA3LTI3IG9u IHRoZQpwcm9wb3NlZCBjaGFydGVyLiBQbGVhc2Ugc2VuZCBjb21tZW50cyB0bwpwdWJsaWMtbmV3 LXdvcmtAdzMub3JnLCB3aGljaCBoYXMgYSBwdWJsaWMgYXJjaGl2ZToKIMKgIGh0dHA6Ly9saXN0 cy53My5vcmcvQXJjaGl2ZXMvUHVibGljL3B1YmxpYy1uZXctd29yay8KCk90aGVyIHRoYW4gY29t bWVudHMgc2VudCBpbiBmb3JtYWwgcmVzcG9uc2VzIGJ5IFczQyBBZHZpc29yeQpDb21taXR0ZWUg UmVwcmVzZW50YXRpdmVzLCBXM0MgY2Fubm90IGd1YXJhbnRlZSBhIHJlc3BvbnNlIHRvCmNvbW1l bnRzLiBJZiB5b3Ugd29yayBmb3IgYSBXM0MgTWVtYmVyIFsxXSwgcGxlYXNlIGNvb3JkaW5hdGUK eW91ciBjb21tZW50cyB3aXRoIHlvdXIgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZl LiBGb3IKZXhhbXBsZSwgeW91IG1heSB3aXNoIHRvIG1ha2UgcHVibGljIGNvbW1lbnRzIHZpYSB0 aGlzIGxpc3QgYW5kCmhhdmUgeW91ciBBZHZpc29yeSBDb21taXR0ZWUgUmVwcmVzZW50YXRpdmUg cmVmZXIgdG8gaXQgZnJvbSBoaXMKb3IgaGVyIGZvcm1hbCByZXZpZXcgY29tbWVudHMuCgpJZiB5 b3Ugc2hvdWxkIGhhdmUgYW55IHF1ZXN0aW9ucyBvciBuZWVkIGZ1cnRoZXIgaW5mb3JtYXRpb24s IHBsZWFzZQpjb250YWN0IFdlbmR5IFNlbHR6ZXIsIFczQyBTdHJhdGVneSBMZWFkIDx3c2VsdHpl ckB3My5vcmc+LgoKVGhhbmsgeW91LAoKWHVleXVhbiBKaWEsIFczQyBNYXJrZXRpbmcgJiBDb21t dW5pY2F0aW9ucwoKWzFdIGh0dHA6Ly93d3cudzMub3JnL0NvbnNvcnRpdW0vTWVtYmVyL0xpc3QK CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpuZXctd29y ayBtYWlsaW5nIGxpc3QKbmV3LXdvcmtAaWV0Zi5vcmcKaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9uZXctd29yawo= From nobody Tue Jun 16 08:04:16 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A59C3A1563; Tue, 16 Jun 2020 06:40:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592314821; bh=44MmtqPejeyyfvTA6HRY1orl4oiHxdi0rafpeszKQ1w=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Cc; b=DBhwCoHcPGYvxCmrRORGDktmqD/oXGd7GOCuYBBi7bFr4jaSxfUkpwo0HtfQxbqhb SXwTXTyis/Q+CdFr8ocTNiDbs8egrjdkdF8YRStOzyfxBkwGMTzL0xuTPXu7Rsh1fz dj0zUw+pO11/kpL+72HoojDRmblyAjbgsZIkrPds= X-Mailbox-Line: From new-work-bounces@ietf.org Tue Jun 16 06:40:21 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C76973A155C; Tue, 16 Jun 2020 06:40:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592314820; bh=ihEXe93A4jprAeOh6toHEd5Z0dbFB+vtllIRj+snia8=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Cc; b=c3ZVjlO0FoRjhaqgAF9D/tXpBcj1eJnomsU5zInsMeN3mpbbwiHEorRzhTQ6xsSAt Ac/uBLI7BBiVCxmOIW5YwLOwIvU0vKc4C0Ca6XYKzkjdlZfDiUBBIO7aCtd1Q5RYDR eqiLkML7JgreYfHz+8v4vGqTk01wV2hjGykOpUhw= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A47103A14FC for ; Tue, 16 Jun 2020 06:40:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uyQRj7Rdvq9q for ; Tue, 16 Jun 2020 06:40:18 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F40393A155C for ; Tue, 16 Jun 2020 06:40:17 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id 205so19115946qkg.3 for ; Tue, 16 Jun 2020 06:40:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version:thread-index :content-language; bh=J2N5q3IL2pdiOP6Wm2XX2sl/vNBpsz2dT09q7kGrn/I=; b=EiOs6Q+xFbk5g2I3WcZxMDLGZLqMHyMLrHv/lUqlciHh8DHX/Yvsw2BlCpIt3Jaabg lTSHtQ3V1Ux1hFh1dq3/NeFB8JBI9gB44JJSRw1LzneRup3AhjFIEZVcLAeGAQkTIY6k pRGmtRoB1ENT5VSqs5X+UtbxUTXxVJfqjgKpXlnHDHnIHljlDHvXEElNoTVz5rg/dZkN qhRYXxJupVC7bDD31hKYw5mO1FJxFWFBpeghftY2cAaaFfIwldNKP6M0UuyQEJhSBNd7 qBEjJqdCUB4YnbAuIIf/IDR7MS475LQ4KlbJ40V+bTRSSVoQd5SYN9YXqe5DXAMR1zpV Y5rA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :thread-index:content-language; bh=J2N5q3IL2pdiOP6Wm2XX2sl/vNBpsz2dT09q7kGrn/I=; b=Zy8h1soEQUk0qk+00JscUUcfpiG8RqO/Us+R5nKe6iir3YUhqHsjAkAcgF7/S+ZSQc 2WrsmHixwAQ+Cc/7egodkuhBjCI+J2jQUCbgskGeCcDaeTMRadoZ0i1PZvhmiUsR5whw nqZc+VMtXqC654hyVyN+z4dgU9BqOkvFMu5YpxxVmOYxXmYMnw8JJmZiTLdEHjzFb8m9 K+A+58sNyb5+TxLzI66eC8KSQA64PiDsnRtmyvmeMj9tx8QgaQ33hYp2iFOX5zrqG7v/ M5ZkH+kDoq2UizMThxJgwJsE3dcq2riJ3YLYbyI+hal4ScQXn3QxKK26gMgs7p1kecbs IQ4A== X-Gm-Message-State: AOAM533a87ZNkilUSYypwY+b7/AaZb7MST3GGYeq6vMCso6srxcIZW4e /i0Ip4S0bvN5wk/LgxNZYiE= X-Google-Smtp-Source: ABdhPJx4okIpGJDDqirN33c0X2Jy/Txj7XSKHVpttRrzzkrqG1RR0l7eBdVKPVcHbDUIUVnygOVVng== X-Received: by 2002:a05:620a:127c:: with SMTP id b28mr18757735qkl.240.1592314817010; Tue, 16 Jun 2020 06:40:17 -0700 (PDT) Received: from DESKTOP6VF5FH7 ([152.208.106.92]) by smtp.gmail.com with ESMTPSA id i205sm1149210qke.14.2020.06.16.06.40.16 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Jun 2020 06:40:16 -0700 (PDT) From: To: Date: Tue, 16 Jun 2020 09:40:13 -0400 Message-ID: <0b6301d643e3$aaf46970$00dd3c50$@gmail.com> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AdZD4yFQ4+azcGKNRSKMRKnn2/Qz6Q== Content-Language: en-us Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Cc: "'Stanley, Dorothy'" , Paul Nikolich Content-Type: multipart/mixed; boundary="===============5018436229504514762==" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Tue, 16 Jun 2020 08:04:15 -0700 Subject: [secdir] [new-work] IEEE 802 PARs / ICAID Under Consideration - August 4 X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 Jun 2020 13:40:23 -0000 This is a multipart message in MIME format. --===============5018436229504514762== Content-Type: multipart/alternative; boundary="----=_NextPart_000_0B64_01D643C2.23E365B0" Content-Language: en-us This is a multipart message in MIME format. ------=_NextPart_000_0B64_01D643C2.23E365B0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit All, The following Project Authorization Requests (PARs) and ICAID will be considered at the IEEE 802 August 4, 2020 LMSC Executive Committee Teleconference - * 802.1ASdn Amendment: YANG Data Model, PAR and CSD * 802.3 Industry Connections - New Ethernet Applications, Endorsement Letter & ICAID * 802.11ax Amendment: High Efficiency WLAN, PAR Extension * 802.11ba Amendment: Low-power wake-up radio operation, PAR Extension * 802.11bf Wireless Local Area Sensing (SENS), PAR and CSD The PARs and ICAID can be found at http://www.ieee802.org/PARs.shtml along with the supporting IEEE 802 Criteria for Standards Development, or CSD, (which includes the 5 criteria, i.e. the explanations of how they fit the IEEE 802 criteria for initiating new work). Any comments on a proposed PAR / ICAID should be sent to the Working Group chair identified on the respective document to be received by 12 July 2020, AoE Regards, John D'Ambrosia Recording Secretary, IEEE 802 LMSC ------=_NextPart_000_0B64_01D643C2.23E365B0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

All,

The following Project Authorization Requests = (PARs) and ICAID will be considered at the IEEE 802 August 4, 2020 LMSC = Executive Committee Teleconference – =  

The = PARs and ICAID can be found at http://www.ieee802.org/PARs.sh= tml along with the supporting IEEE 802 Criteria for Standards = Development, or CSD, (which includes the 5 criteria, i.e. the = explanations of how they fit the IEEE 802 criteria for initiating new = work).

Any comments on a proposed PAR / ICAID should = be sent to the Working Group chair identified on the respective document = to be received by 12 July 2020, AoE

Regards,

John = D’Ambrosia

Recording Secretary, IEEE 802 LMSC =

 

------=_NextPart_000_0B64_01D643C2.23E365B0-- --===============5018436229504514762== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work --===============5018436229504514762==-- From nobody Thu Jun 18 09:50:08 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 82F8B3A0B22 for ; Thu, 18 Jun 2020 09:50:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.3.2 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <159249900604.30356.14972857180307064453@ietfa.amsl.com> Date: Thu, 18 Jun 2020 09:50:06 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2020 16:50:06 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-06-25 Reviewer LC end Draft Melinda Shore 2020-05-13 draft-ietf-secevent-http-poll-11 Valery Smyslov R2020-05-13 draft-ietf-secevent-http-push-12 Last calls: Reviewer LC end Draft John Bradley 2020-02-28 draft-ietf-regext-data-escrow-10 Shaun Cooley 2020-05-29 draft-ietf-ospf-te-link-attr-reuse-14 Alan DeKok 2020-05-29 draft-ietf-isis-te-app-17 Donald Eastlake R2019-11-14 draft-ietf-hip-dex-20 Donald Eastlake 2020-02-27 draft-ietf-6tisch-msf-16 Stephen Farrell 2020-06-15 draft-ietf-pim-igmp-mld-snooping-yang-13 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-08 Daniel Gillmor 2020-06-12 draft-ietf-pce-stateful-pce-lsp-scheduling-17 Phillip Hallam-Baker 2020-06-11 draft-ietf-dots-use-cases-23 Dan Harkins None draft-ietf-rtgwg-policy-model-03 Russ Housley 2020-07-02 draft-ietf-dhc-v6only-03 Christian Huitema 2020-06-25 draft-ietf-i2rs-yang-l2-network-topology-13 Russ Mundy 2020-01-02 draft-ietf-dprive-bcp-op-10 Magnus Nystrom 2019-04-10 draft-ietf-avtcore-multiplex-guidelines-12 Vincent Roca 2020-04-23 draft-ietf-detnet-ip-over-mpls-06 Stefan Santesson 2020-05-04 draft-ietf-httpbis-header-structure-19 Melinda Shore 2020-05-13 draft-ietf-secevent-http-poll-11 Valery Smyslov R2020-05-13 draft-ietf-secevent-http-push-12 Tina Tsou 2020-05-08 draft-ietf-httpbis-client-hints-14 Sean Turner 2020-05-06 draft-ietf-opsawg-sdi-02 Samuel Weiler 2020-06-11 draft-ietf-trill-multilevel-single-nickname-10 Brian Weis 2020-05-26 draft-ietf-cose-hash-algs-04 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-09 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-08 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Early review requests: Reviewer Due Draft Steve Hanna 2020-06-30 draft-ietf-emu-eap-noob-01 Next in the reviewer rotation: Leif Johansson Charlie Kaufman Scott Kelly Tero Kivinen Watson Ladd Chris Lonvick Aanchal Malhotra David Mandelberg Catherine Meadows Alexey Melnikov From nobody Thu Jun 18 13:40:22 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CBD83A0F65; Thu, 18 Jun 2020 13:40:13 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Russ Housley via Datatracker To: Cc: draft-ietf-dhc-v6only.all@ietf.org, dhcwg@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.3.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159251281326.28009.2445308597820373796@ietfa.amsl.com> Reply-To: Russ Housley Date: Thu, 18 Jun 2020 13:40:13 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-dhc-v6only-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2020 20:40:14 -0000 Reviewer: Russ Housley Review result: Has Nits I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Security Area Directors. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments. Document: draft-ietf-dhc-v6only-03 Reviewer: Russ Housley Review Date: 2020-06-18 IETF LC End Date: 2020-07-02 IESG Telechat date: unknown Summary: Has Nits Major Concerns: None. Minor Concerns: Section 3.4 includes: V6ONLY_WAIT The minimum time the client SHOULD stop the DHCPv4 configuration process for. MUST be no less than MIN_V6ONLY_WAIT seconds. Default: 1800 seconds The second sentence should include a subject; and "MUST NOT" seems like a better wording to me. I suggest: V6ONLY_WAIT The minimum time for which the client SHOULD stop the DHCPv4 configuration process. The value MUST NOT be less than MIN_V6ONLY_WAIT seconds. Default: 1800 seconds. Nits: Section 2: s/seems only natural/seems natural/ Section 3.3.1: s/for V6ONLY_WAIT second/for V6ONLY_WAIT seconds/ From nobody Thu Jun 18 15:15:42 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 079493A102D; Thu, 18 Jun 2020 15:15:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.848 X-Spam-Level: X-Spam-Status: No, score=-1.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zaYpFx61_mgD; Thu, 18 Jun 2020 15:15:31 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7457A3A1016; Thu, 18 Jun 2020 15:15:28 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id b27so7205275qka.4; Thu, 18 Jun 2020 15:15:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ydP8EBppLKyemDtUajSArNRsiZ7fHL1pluZkLGBiqJ0=; b=VufN9ITcygdBL/D296ZsU7ibpAdcw+eaOYIlUbEE2JzRHqj47zsvdM6W5rQ5m7+EgW zP+bgsGGL1vWRjeyCN/pTt1TXHn0726S16iNWV63Zre918rtr7dSLaHKyXS4hHVinjGP SMliZHgTCDArj6YGjuDgp/RG/dQC2uiyIZ+IFLXKoz5TbSiQHV8ay2zVUpTWN2sCG6RJ KtJvien9rgkkZEFN+K7Gtxo0+K+oTH88xz4wko6gDXPemTElqATJTdRosAYzWD9a2abu V3//LbcSPAD97Bd7OmZ0aju57joDpvvV/M93Z4DvK91pPYatTH2/0nuyN0DRZSGkbxoo ecFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ydP8EBppLKyemDtUajSArNRsiZ7fHL1pluZkLGBiqJ0=; b=Nfo/VnDckaShUMzeweJeAv9dJxijzNc1Hk2HeLrGD1Fjriz94oWHAavODCMlzaYyvR u6uxgScygdoaXVz+WMhUcrZot/blpAskQoDOvGr07ix+GDIf/phBIwEBTIkiWBrvMS/M 8JJqzSst7pH3/OqmE55/kjEkgPPkXRDlB6OR0KI7X2Oa1hrb8BMtbIW5Noi2wGFdnGgx 5yisUQWUq9dVJM0ZE6gRE1sbAtf0ETgy9iad7TijN5x6APzEZxTb0O11MvP+JSbdz+lm yxEIHGHVEZrzFnxWqrSBoTR/nkDRhVKZ+QN0oa8ozwzJt6sV+1tE5etlwfPkAAAdGjiI +0sg== X-Gm-Message-State: AOAM530qlN0EhAunNMyAPdE5DRxKbfi9/BIoV9qEcz0yOLoFvRXYHzCJ HBGNRDsygxSbfbhO0RtT2bjcCMPelMHNrDS2DJHwlA== X-Google-Smtp-Source: ABdhPJwdEPghoYkOozWTzL+FsiPkYGzyj5HAlQH7UgLqRP62pTNhhoZKWFyfn3zEp0xY5Vy193ZsfOHGuIN6dQ3R5dE= X-Received: by 2002:a37:61d6:: with SMTP id v205mr571267qkb.417.1592518527464; Thu, 18 Jun 2020 15:15:27 -0700 (PDT) MIME-Version: 1.0 References: <159251281326.28009.2445308597820373796@ietfa.amsl.com> In-Reply-To: <159251281326.28009.2445308597820373796@ietfa.amsl.com> From: Jen Linkova Date: Fri, 19 Jun 2020 08:15:16 +1000 Message-ID: To: Russ Housley Cc: secdir@ietf.org, draft-ietf-dhc-v6only.all@ietf.org, dhcwg@ietf.org, last-call@ietf.org Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [secdir] [dhcwg] Secdir last call review of draft-ietf-dhc-v6only-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2020 22:15:33 -0000 Hi Russ, Thanks a lot for reviewing the document. All your comments will be addressed in -04, which I plan to submit after the IETF LC ends. On Fri, Jun 19, 2020 at 6:40 AM Russ Housley via Datatracker wrote: > > Reviewer: Russ Housley > Review result: Has Nits > > I reviewed this document as part of the Security Directorate's ongoing > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the Security Area > Directors. Document authors, document editors, and WG chairs should > treat these comments just like any other IETF Last Call comments. > > Document: draft-ietf-dhc-v6only-03 > Reviewer: Russ Housley > Review Date: 2020-06-18 > IETF LC End Date: 2020-07-02 > IESG Telechat date: unknown > > Summary: Has Nits > > > Major Concerns: > > None. > > > Minor Concerns: > > Section 3.4 includes: > > V6ONLY_WAIT The minimum time the client SHOULD stop the DHCPv4 > configuration process for. MUST be no less than > MIN_V6ONLY_WAIT seconds. Default: 1800 seconds > > The second sentence should include a subject; and "MUST NOT" seems like > a better wording to me. I suggest: > > V6ONLY_WAIT The minimum time for which the client SHOULD stop > the DHCPv4 configuration process. The value MUST NOT > be less than MIN_V6ONLY_WAIT seconds. > Default: 1800 seconds. > > > Nits: > > Section 2: s/seems only natural/seems natural/ > > Section 3.3.1: s/for V6ONLY_WAIT second/for V6ONLY_WAIT seconds/ > > > > _______________________________________________ > dhcwg mailing list > dhcwg@ietf.org > https://www.ietf.org/mailman/listinfo/dhcwg -- SY, Jen Linkova aka Furry From nobody Fri Jun 19 06:10:51 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B5A0D3A09EB; Fri, 19 Jun 2020 06:10:50 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Valery Smyslov via Datatracker To: Cc: draft-ietf-secevent-http-push.all@ietf.org, last-call@ietf.org, id-event@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.3.2 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159257225069.31013.12380067855802786524@ietfa.amsl.com> Reply-To: Valery Smyslov Date: Fri, 19 Jun 2020 06:10:50 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-secevent-http-push-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jun 2020 13:10:51 -0000 Reviewer: Valery Smyslov Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is my second review of the draft, last time I reviewed -10 version. I looked over the diff between these versions and found that my concerns have been addressed. I'm also glad that using TLS is now mandatory. Thank you. From nobody Sat Jun 20 03:15:48 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2D983A1120; Sat, 20 Jun 2020 03:15:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8d07ApU8F0g3; Sat, 20 Jun 2020 03:15:30 -0700 (PDT) Received: from chessie.everett.org (chessie.everett.org [66.220.13.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9CBA3A1121; Sat, 20 Jun 2020 03:15:29 -0700 (PDT) Received: from [10.208.75.157] (075-139-194-196.res.spectrum.com [75.139.194.196]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by chessie.everett.org (Postfix) with ESMTPSA id 49ps4d1rhkzL7c; Sat, 20 Jun 2020 10:15:29 +0000 (UTC) To: Brian Haberman , Daniel Franke , secdir@ietf.org Cc: draft-ietf-ntp-mode-6-cmds.all@ietf.org, last-call@ietf.org, ntp@ietf.org References: <159206148916.27533.2080482554461273224@ietfa.amsl.com> <4251f262-22f7-3b7d-41d4-e0c3ef1da1b8@innovationslab.net> <0b850187-0596-c9fd-6667-e571f7ef5ef7@innovationslab.net> From: Harlan Stenn Autocrypt: addr=stenn@nwtime.org; keydata= mQGNBFI2xmQBDACrPayw18eU4pIwCvKh7k0iMkAV9cvzs49kBppM+xoH+KKj4QWmkKELD39H ngQnT3RkKsTLlwxyLqPdUmeQNAY2M5fsOK+OF6EvwLPK9hbmE3Wx2moX+sbEUxJ2VzFhKSKb OPZALXwk1XxL0qBedz0xHYcDwaSAZZkEFXURv2pDIdrmnoUnq2gdC8GpoFJiXoUaCLSYzzaY ac4Njw7Mue8IqfzRQb70aMjXl/qmsmfmEVAyGXywDdc/ler4XSgiuYOV7Kf69bj9PFZZSMdJ MWgEyZH6lJ0TU5ccR2zp5ZRmWzQQkxJMyH2th7q0Nmz3aX4A0K4yE0Ba9/5Dr7ctpF15BrMF aEo4s5lwI6tUnkgMWo265mMzCz4mAPV/ac0w0OXQg7r9E2r0+dRapnzUlG43D0JLDqDr9uRR L6IrRQqoCWUC75lfmPYQYSlaTJaK68r3lXd0z1cXJUgVtEL5H3/Z71R2B20twcQVAnw2iIH6 L5vdrsIjHrMmkqRVbs9nNyEAEQEAAbQ5SGFybGFuIFN0ZW5uIChOZXR3b3JrIFRpbWUgRm91 bmRhdGlvbikgPHN0ZW5uQG53dGltZS5vcmc+iQG5BBMBAgAjBQJSNsblAhsvBwsJCAcDAgEG FQgCCQoLBBYCAwECHgECF4AACgkQyIwAt1pH+kBlzgv/QOg70vdj8wU/z97UPdlbxtN4THAB gfSX4N0VPKT5fjX1tFhuXZQAOv7wedR3Trh7TGteyg33TBAFf9A42mXZKi1IxAiQG118Hd8I 51rXwnugURIYQaIyQI+vbchRbwVyz+mVLTI/h6FdbsVzT4UFmir+ZMkb/XeZPu0HItk4OZHE 6hk+TuTiCnlqlCPLq371fXV54VOb91WZYD8EQFtK02QHGHsQqWvapdphiDVpYehmsPyiTESq NMKLVtjtyPkQ6S7QF3slSg+2q3j8lyxEA78Yl0MSFNU8B/BtKgzWP2itBOfi+rtUKg+jOY1V /s2uVk2kq2QmHJ/s5k5ldy3qVvoTpxvwBe0+EoBocTHYt+xxp0mTM6YY1xLiQpLznzluqg9z qtejX1gZOF4mgLiBIrhXzed3zsAazhTp5rNb1kn0brZFh6JC5Wk941eilnA4LqX8AWo0lmwo eb+mpwZK/5lNdage/anpVqft9wJ/8EcvST9TLUO4fPrmT3d/0LpWuQGNBFI2xmQBDADXLsBk I7CSa5UXlrNVFJQHER1VxRBKqjWWCh/8Qv9v3p3NrIc2UnhoZ1uWQ2voBGty5Xfy9k4afV5k WwDyRDUIb7PX+Tj4HjVVr7qvnOVe/0KzZpNq0Azd0ggFbsM+8mydktHIwJykW0NUsGwPRYuD OA0Lro0ohb5IiCt3sSQi1X1hYjo7O1Vmn8Gy/XYOnhnMux+5zDPO2yTkCNX5PocYi9IJJy6p Mq1yQV4Y2Dl8KtQzvtq55vCUxx6n0MMzFViGwNW6F4ge9ItO4tDScsgowDrHa208ehwOpv/i wjf93lCClQ6vaKmOBX872K/tdY/hwhxPPjgl1bcrOwMRYVemOPPehwnXH5bwclk1hvDQdkJQ 5pJOkE4VCryTF/iDAt4g2QnHocUwt3b6/ChUUWmj2GZ22OR12rbnCtLedwp0DpViKPUCQHBO vpgXdzE/L9zWar9fqM0EREMgfWbsJc9028qluCcFLIN1gYsq4cC+YGAcOu7HOI5orBBV4m9j XfsAEQEAAYkDPgQYAQIACQUCUjbGZAIbLgGpCRDIjAC3Wkf6QMDdIAQZAQIABgUCUjbGZAAK CRDfCQ/G52/8P/uWDACe7OEM+VETDRqjQgAwzX+RjCVPvtgrqc1SExS0fV7i1mUUxr/B8io3 Y1cRHFoFKmedxf8prHZq316Md5u4egjFdTT6ZqEqkK0hvv+i0pRpCa5EX9VIStcJStomZp8F cY34grA+EOWITaLQ4qNZUP7rf2e7gq1ubQTj7uLr6HZZvMZ5em+IvrOWEuWDI6yOiI6px04w RDfkoR2h6kgdw4V0PT4NjK9WYYKrVCf1bjLlVImNBEcXfvlUTrIYO8y6ptvoUsBQky5pQRvP 99Pn42WfyLy50aII6+vyudD4T0yLjXAz4KteUttxtIte64m/F9/7GEIZAxTUcLyOq/7bP4le h39jBckwc62iYzeK/VkU/bMMh2D68Z3QylMnhhcW27BcgQHPKsHhmFa2SNytYcuQiSdf9+pj 4i32ETz1nJAvYAAqgTF/0PL+8ZNQoEpe/n9woMKrlZrqD4EgFmhQ3bNVhlaXz1nuTZDrwPt1 yMxBuUNbCF4jFnaruwrSiGTRoIfUZQwAjQglahrV4/mcjfnvbNoseHX0PKd9q+wjg7MIjWqr f2CI8Fa6MdanqwYphz43I2yXANKFZuMWsWqyQYlvGuPUlUUcAL3stp24RkzDB1Q+JS0IZJST T2JSu0aTfUdWVNqr2UI19eX+zxbOTckSi3Ng14ezG8ZX194ZH10b8JzntQOwmA20pd5JDhug zQfASER+CZDiPPcQ4mvC4y7rMrfV6XGQbDynC3ekDxo8SC5SvjaczXMwXg6SZ8iFtEWmEwW9 r7zPjjIPDrX8w5LXBgxArM5o/HbERpc2EdAvMh1D7LC0SvmoE7fBKxsicVBe4h6vXjEZ+LLr /wuZiBld9OnxAUIpwptbBspO6WKTQYvgFH2OeDG27hiE5P4Xs4WSp5j9ez8OVB1iZnA2nCQ+ tNTjO8c+C/P92vPLx5+bpGRXTXMNaLh34PS3ZsYoUDkKZNhczRZUWJ7nynSbeeyF+QW7SLwA qY7O7dyk9LFTsfJqRQJ7tWnIAjJPCwmSgQ8Kl0UJ Message-ID: <75f032e8-b899-3c96-c351-3cc9b49e165d@nwtime.org> Date: Sat, 20 Jun 2020 03:15:28 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <0b850187-0596-c9fd-6667-e571f7ef5ef7@innovationslab.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [secdir] [Ntp] Secdir last call review of draft-ietf-ntp-mode-6-cmds-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Jun 2020 10:15:34 -0000 Hi Brian, On 6/15/2020 8:29 AM, Brian Haberman wrote: > Hi Harlan, > > On 6/13/20 8:26 PM, Harlan Stenn wrote: > >>> SNMP exists and the NTP WG published RFC 5907 to cover the MIB support >>> needed by NTP. I believe that also counts as a better alternative. >> >> Unbelievable. >> >> TTBOMK, the only implementation of 5907 is the one in the reference > > Interesting statement... After a cursory search, I found that Cisco > implemented 5907 in 2012. That was about 7 years' after my stint at Cisco. Did they produce a general SNMP monitor for NTP, or did they just support monitoring the NTP instances in their gear via SNMP? I suspect the latter, and I would also bet they used at least our libntpq library and perhaps some of ntpsnmpd to make it all work. I was also "loose" in my question above. It doesn't surprise me that somebody used 5907 to monitor ntpd running in their gear. It would surprise me greatly to learn that somebody wrote an SNMP listener that talked with NTP instances. >> implementation, and in the 12 years it has been out there we have had NO >> reports of it being used. Furthermore, it was implemented USING MODE 6 >> PACKETS! > > Not sure why you would implement SNMP support via an NTP auxiliary > protocol, but that is your choice. Not what I was saying. I was saying that it would be a huge amount of trouble to add SNMP directly to an NTP instance and I haven't been able to come up with any good reason for even trying to do that. The easiest way to get SNMP support for NTP is to have your SNMP listener query NTP for the data, and the only intended standard way to do this is via mode 6. >> The only known SNMP interface to ntpd, ntpsnmpd has not seen significant >> updates since 2010. >> >> The mode 6 interface to ntpd, ntpq, remains in continuous development >> and evolution. >> >> Please identify any other implementations of 5907. If you find any, how >> significant are they? Are they proprietary 5907 implementations? What >> implementations to they work on? >> > > I would need someone from Cisco to verify, but it seems like their > implementation is based on 5907. Again, not what I was saying. It's fine and expected that 5907 be used for the SNMP mapping side of things, but without a mode 6 mapping to the data values and interfaces inside NTP, there's no standard way to connect SNMP with an NTP instance. I'm also not saying anybody is required to implement mode 6, or 5907. I *am* saying that there should be a Standard way to do it, with one or more reference implementations. Goes to demonstrably proving that the mechanism is complete and functional. >> Please show how SNMP is a better way to monitor and control NTP than ntpq. >> >> Please show me a working deployment of SNMP controlling NTP, and then >> please compare the number and quality of these deployments with those >> that do the same with ntpq. > > I am not going to dignify that demand with a response. The WG consensus > is the WG consensus. How did you interpret my request as a demand? Should I take offense from your "I am not going to dignify..." line? I could ask several questions about "WG consensus", but I really don't see the point. What is the point of a Standard if one cannot use it to implement interoperable behaviors? Are you saying the WG does not have a responsibility to promulgate a complete, functional Standard? I'm attempting to be very respectful here, Brian. I see you are making statements as the editor (and author) of the document. For decades I have been deeply involved in the design, implementation, deployment, and use of mode 6, and also the one who has been fielding questions about and involved in discussion about mode 6. You and those in the WG know my perspective on this. I believe some folks agree with me. Clearly some do not, and I think it's worth understanding "why". The working group has gone thru many changes in the past several years, and the WG will do what the WG will do. > Regards, > Brian > > > _______________________________________________ > ntp mailing list > ntp@ietf.org > https://www.ietf.org/mailman/listinfo/ntp > -- Harlan Stenn http://networktimefoundation.org - be a member! From nobody Sat Jun 20 18:04:47 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 908603A0CCE; Thu, 18 Jun 2020 04:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592481388; bh=I/1mPByziDmAc8AfGIPJavdT8lqe0GMHZNO7/jL/AA0=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ecMYLNN02Zw5mQ4PDaptm8pQsl073CQaOruNhAOTYSDWtpnbBqVNoiaqLdOuKyKXb nrvXx9UkIKRYlDlLQ0tGw7SM62VUCEyIAWLY/vluKvLlcgcrRSF4I35eLuhGclbZig qDq41H5MqBHS1lTXC04JE4Nem/DHN3sxQXOMkkpo= X-Mailbox-Line: From new-work-bounces@ietf.org Thu Jun 18 04:56:28 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E88043A0CDC; Thu, 18 Jun 2020 04:56:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592481388; bh=I/1mPByziDmAc8AfGIPJavdT8lqe0GMHZNO7/jL/AA0=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ecMYLNN02Zw5mQ4PDaptm8pQsl073CQaOruNhAOTYSDWtpnbBqVNoiaqLdOuKyKXb nrvXx9UkIKRYlDlLQ0tGw7SM62VUCEyIAWLY/vluKvLlcgcrRSF4I35eLuhGclbZig qDq41H5MqBHS1lTXC04JE4Nem/DHN3sxQXOMkkpo= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC9223A097F for ; Thu, 18 Jun 2020 04:56:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.901 X-Spam-Level: X-Spam-Status: No, score=-0.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fTRVF9RdgTKU for ; Thu, 18 Jun 2020 04:56:23 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0089A3A098D for ; Thu, 18 Jun 2020 04:56:22 -0700 (PDT) Received: from [42.100.7.136] (helo=[192.168.0.101]) by raoul.w3.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1jlt9Y-0005Kq-4D for new-work@ietf.org; Thu, 18 Jun 2020 11:56:20 +0000 To: new-work@ietf.org From: xueyuan Message-ID: <1f350722-44a0-aed9-27c5-dc8d071a5c76@w3.org> Date: Thu, 18 Jun 2020 19:56:15 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Sat, 20 Jun 2020 18:04:46 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: GPU for the Web Working Group (until 2020-07-31) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Jun 2020 11:56:31 -0000 SGVsbG8sCgpUb2RheSBXM0MgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcyByZWNl aXZlZCBhIFByb3Bvc2FsCnRvIHJldmlldyBhIGRyYWZ0IGNoYXJ0ZXIgZm9yIHRoZSBHUFUgZm9y IHRoZSBXZWIgV29ya2luZyBHcm91cDoKIMKgIGh0dHBzOi8vd3d3LnczLm9yZy8yMDIwLzA2L2dw dXdlYi1jaGFydGVyLmh0bWwKCkFzIHBhcnQgb2YgZW5zdXJpbmcgdGhhdCB0aGUgY29tbXVuaXR5 IGlzIGF3YXJlIG9mIHByb3Bvc2VkIHdvcmsKYXQgVzNDLCB0aGlzIGRyYWZ0IGNoYXJ0ZXIgaXMg cHVibGljIGR1cmluZyB0aGUgQWR2aXNvcnkKQ29tbWl0dGVlIHJldmlldyBwZXJpb2QuCgpXM0Mg aW52aXRlcyBwdWJsaWMgY29tbWVudHMgdGhyb3VnaCAyMDIwLTA3LTMxIG9uIHRoZQpwcm9wb3Nl ZCBjaGFydGVyLiBQbGVhc2Ugc2VuZCBjb21tZW50cyB0bwpwdWJsaWMtbmV3LXdvcmtAdzMub3Jn LCB3aGljaCBoYXMgYSBwdWJsaWMgYXJjaGl2ZToKIMKgIGh0dHA6Ly9saXN0cy53My5vcmcvQXJj aGl2ZXMvUHVibGljL3B1YmxpYy1uZXctd29yay8KCk90aGVyIHRoYW4gY29tbWVudHMgc2VudCBp biBmb3JtYWwgcmVzcG9uc2VzIGJ5IFczQyBBZHZpc29yeQpDb21taXR0ZWUgUmVwcmVzZW50YXRp dmVzLCBXM0MgY2Fubm90IGd1YXJhbnRlZSBhIHJlc3BvbnNlIHRvCmNvbW1lbnRzLiBJZiB5b3Ug d29yayBmb3IgYSBXM0MgTWVtYmVyIFsxXSwgcGxlYXNlIGNvb3JkaW5hdGUKeW91ciBjb21tZW50 cyB3aXRoIHlvdXIgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlLiBGb3IKZXhhbXBs ZSwgeW91IG1heSB3aXNoIHRvIG1ha2UgcHVibGljIGNvbW1lbnRzIHZpYSB0aGlzIGxpc3QgYW5k CmhhdmUgeW91ciBBZHZpc29yeSBDb21taXR0ZWUgUmVwcmVzZW50YXRpdmUgcmVmZXIgdG8gaXQg ZnJvbSBoaXMKb3IgaGVyIGZvcm1hbCByZXZpZXcgY29tbWVudHMuCgpJZiB5b3Ugc2hvdWxkIGhh dmUgYW55IHF1ZXN0aW9ucyBvciBuZWVkIGZ1cnRoZXIgaW5mb3JtYXRpb24sIHBsZWFzZQpjb250 YWN0IFdlbmR5IFNlbHR6ZXIsIFczQyBTdHJhdGVneSBMZWFkIDx3c2VsdHplckB3My5vcmc+LgoK VGhhbmsgeW91LAoKWHVleXVhbiBKaWEsIFczQyBNYXJrZXRpbmcgJiBDb21tdW5pY2F0aW9ucwoK WzFdIGh0dHA6Ly93d3cudzMub3JnL0NvbnNvcnRpdW0vTWVtYmVyL0xpc3QKCl9fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCm5ldy13b3JrIG1haWxpbmcgbGlz dApuZXctd29ya0BpZXRmLm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZv L25ldy13b3JrCg== From nobody Sat Jun 20 18:04:51 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A5683A0ACB; Fri, 19 Jun 2020 08:11:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592579490; bh=6ZosYT5PhwaCouWJfcAnUHftG/CT8xeCQeF0T901Y9Q=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=aEznMqUzw1QZbIBfVZcEnvvCHBpz9Dj9oa/4GBfyG3gXBkPVou6WPPjKlyRTF9Pbr JMxQ2yGOzebjHNFmcRxu+gzFtcC+GGaTl6E0eW3m3+wZzZxV7s/WrcYscvIyW2pqmS TpwoXmdkIvh1FBBB0O+RS98CyKS8Y/vN45aXgtGU= X-Mailbox-Line: From new-work-bounces@ietf.org Fri Jun 19 08:11:29 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A83A43A0ACD; Fri, 19 Jun 2020 08:11:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1592579489; bh=6ZosYT5PhwaCouWJfcAnUHftG/CT8xeCQeF0T901Y9Q=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ey3DLcDTokszGvAIBJGH1Gvw0sMq110wZsYwiTNBEXgpiLjAPZTiXNAvVmSYyiuI/ kiFc3P5SpqUnVLiegax7cgdA85+J/grFj55gG4Hw3Yc1F8VKbJVz2udvpTydulq6Ym 1dUojNiOAu/8GvKv0c6/YqUpI9s89NW9Mbq2YWSg= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 720663A0ACD for ; Fri, 19 Jun 2020 08:11:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.901 X-Spam-Level: X-Spam-Status: No, score=-0.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b0KOnN5vPR9b for ; Fri, 19 Jun 2020 08:11:26 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB9D33A0ACB for ; Fri, 19 Jun 2020 08:11:26 -0700 (PDT) Received: from [42.100.7.136] (helo=[192.168.0.101]) by raoul.w3.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1jmIfs-0006is-SX for new-work@ietf.org; Fri, 19 Jun 2020 15:11:25 +0000 To: new-work@ietf.org From: xueyuan Message-ID: Date: Fri, 19 Jun 2020 23:11:18 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Sat, 20 Jun 2020 18:04:46 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: EPUB 3 Working Group (until 2020-07-31) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Jun 2020 15:11:32 -0000 SGVsbG8sCgpUb2RheSBXM0MgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcyByZWNl aXZlZCBhIFByb3Bvc2FsCnRvIHJldmlldyBhIGRyYWZ0IGNoYXJ0ZXIgZm9yIHRoZSBFUFVCIDMg V29ya2luZyBHcm91cDoKIMKgIGh0dHBzOi8vd3d3LnczLm9yZy8yMDIwLzA2L3Byb3Bvc2VkLWVw dWItMy1jaGFydGVyLmh0bWwKCkFzIHBhcnQgb2YgZW5zdXJpbmcgdGhhdCB0aGUgY29tbXVuaXR5 IGlzIGF3YXJlIG9mIHByb3Bvc2VkIHdvcmsKYXQgVzNDLCB0aGlzIGRyYWZ0IGNoYXJ0ZXIgaXMg cHVibGljIGR1cmluZyB0aGUgQWR2aXNvcnkKQ29tbWl0dGVlIHJldmlldyBwZXJpb2QuCgpXM0Mg aW52aXRlcyBwdWJsaWMgY29tbWVudHMgdGhyb3VnaCAyMDIwLTA3LTMxIG9uIHRoZQpwcm9wb3Nl ZCBjaGFydGVyLiBQbGVhc2Ugc2VuZCBjb21tZW50cyB0bwpwdWJsaWMtbmV3LXdvcmtAdzMub3Jn LCB3aGljaCBoYXMgYSBwdWJsaWMgYXJjaGl2ZToKIMKgIGh0dHA6Ly9saXN0cy53My5vcmcvQXJj aGl2ZXMvUHVibGljL3B1YmxpYy1uZXctd29yay8KCk90aGVyIHRoYW4gY29tbWVudHMgc2VudCBp biBmb3JtYWwgcmVzcG9uc2VzIGJ5IFczQyBBZHZpc29yeQpDb21taXR0ZWUgUmVwcmVzZW50YXRp dmVzLCBXM0MgY2Fubm90IGd1YXJhbnRlZSBhIHJlc3BvbnNlIHRvCmNvbW1lbnRzLiBJZiB5b3Ug d29yayBmb3IgYSBXM0MgTWVtYmVyIFsxXSwgcGxlYXNlIGNvb3JkaW5hdGUKeW91ciBjb21tZW50 cyB3aXRoIHlvdXIgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlLiBGb3IKZXhhbXBs ZSwgeW91IG1heSB3aXNoIHRvIG1ha2UgcHVibGljIGNvbW1lbnRzIHZpYSB0aGlzIGxpc3QgYW5k CmhhdmUgeW91ciBBZHZpc29yeSBDb21taXR0ZWUgUmVwcmVzZW50YXRpdmUgcmVmZXIgdG8gaXQg ZnJvbSBoaXMKb3IgaGVyIGZvcm1hbCByZXZpZXcgY29tbWVudHMuCgpJZiB5b3Ugc2hvdWxkIGhh dmUgYW55IHF1ZXN0aW9ucyBvciBuZWVkIGZ1cnRoZXIgaW5mb3JtYXRpb24sIHBsZWFzZQpjb250 YWN0IEl2YW4gSGVybWFuLCBwcm9wb3NlZCBFUFVCIDMgV0cgU3RhZmYgQ29udGFjdCA8aXZhbkB3 My5vcmc+LgoKVGhhbmsgeW91LAoKWHVleXVhbiBKaWEsIFczQyBNYXJrZXRpbmcgJiBDb21tdW5p Y2F0aW9ucwoKWzFdIGh0dHA6Ly93d3cudzMub3JnL0NvbnNvcnRpdW0vTWVtYmVyL0xpc3QKCl9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCm5ldy13b3JrIG1h aWxpbmcgbGlzdApuZXctd29ya0BpZXRmLm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFu L2xpc3RpbmZvL25ldy13b3JrCg== From nobody Mon Jun 22 12:04:42 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA3F13A07ED; Mon, 22 Jun 2020 12:04:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tMxjRQrHh0js; Mon, 22 Jun 2020 12:04:35 -0700 (PDT) Received: from taper.sei.cmu.edu (taper.sei.cmu.edu [147.72.252.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F076A3A07DA; Mon, 22 Jun 2020 12:04:31 -0700 (PDT) Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by taper.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 05MJ4UQ7017713; Mon, 22 Jun 2020 15:04:30 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 taper.sei.cmu.edu 05MJ4UQ7017713 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1592852670; bh=/eSA4t9F4DOlMxNBvN9ATrwZB5qLWA/KQbx3IPyXvW0=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=HqHd2I8Czvg8A6+Lh1e+k3uroG3iCxe+QjdtpK3zbQV/c1YG8IboU4gG4TytOljGG 3MtTt3bI3Eq7HWWPPJLN6a1ofRvljMGkqQQVI5QXZDDy81vidIBXW14AhcoUEPFiXX wXArkU1onI2wV955I16LdU6mMnw6tshxdkGxVu88= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 05MJ4QeB012644; Mon, 22 Jun 2020 15:04:26 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by CASSINA.ad.sei.cmu.edu (10.64.28.249) with Microsoft SMTP Server (TLS) id 14.3.487.0; Mon, 22 Jun 2020 15:04:26 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MORRIS.ad.sei.cmu.edu (147.72.252.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Mon, 22 Jun 2020 15:04:26 -0400 Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.1979.003; Mon, 22 Jun 2020 15:04:26 -0400 From: Roman Danyliw To: Lou Berger , Tero Kivinen CC: "secdir@ietf.org" , "draft-ietf-detnet-ip.all@ietf.org" , "detnet@ietf.org" Thread-Topic: [Last-Call] [Detnet] Secdir last call review of draft-ietf-detnet-ip-05 Thread-Index: AQHV/FgU6yNXjiXHQkqdZIhnu7Wdo6jlljyQ Date: Mon, 22 Jun 2020 19:04:25 +0000 Message-ID: References: <158406212471.18347.14473548719649982992@ietfa.amsl.com> <57456b4d-79a4-191a-8e25-7a2d2157f5d8@labn.net> <24176.45003.478503.30942@fireball.acr.fi> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.202.179] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] [Last-Call] [Detnet] Secdir last call review of draft-ietf-detnet-ip-05 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Jun 2020 19:04:37 -0000 SGkgVGVybywgdGhhbmsgeW91IGZvciB0aGlzIHJldmlldy4gIA0KDQpIaSBMb3UsIHRoYW5rIHlv dSBmb3IgaW5jb3Jwb3JhdGluZyB0aGUgZmVlZGJhY2sgLTA2DQoNCkkgZm91bmQgYSBmZXcgcGxh Y2VzIHdoZXJlIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyB3b3VsZCBiZW5lZml0IGZyb20g cmVmaW5lbWVudCBzbyBJIGJhbGxvdGVkIHdpdGggYSBEaXNjdXNzLg0KDQpSZWdhcmRzLA0KUm9t YW4NCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBsYXN0LWNhbGwgPGxh c3QtY2FsbC1ib3VuY2VzQGlldGYub3JnPiBPbiBCZWhhbGYgT2YgTG91IEJlcmdlcg0KPiBTZW50 OiBUdWVzZGF5LCBNYXJjaCAxNywgMjAyMCA4OjMyIEFNDQo+IFRvOiBUZXJvIEtpdmluZW4gPGtp dmluZW5AaWtpLmZpPg0KPiBDYzogc2VjZGlyQGlldGYub3JnOyBkcmFmdC1pZXRmLWRldG5ldC1p cC5hbGxAaWV0Zi5vcmc7IGRldG5ldEBpZXRmLm9yZzsgbGFzdC0NCj4gY2FsbEBpZXRmLm9yZw0K PiBTdWJqZWN0OiBSZTogW0xhc3QtQ2FsbF0gW0RldG5ldF0gU2VjZGlyIGxhc3QgY2FsbCByZXZp ZXcgb2YgZHJhZnQtaWV0Zi1kZXRuZXQtaXAtMDUNCj4gDQo+IFRoYW5rcyBhZ2FpbiBUZXJvLg0K PiANCj4gSSd2ZSBtYWRlIHRoZSBjaGFuZ2VzIGluIGEgUFIgdG8gdGhlIGRvY3VtZW50IGdpdCBy ZXBvIGFuZCB0aGV5IHdpbGwgYmUgaW4gdGhlDQo+IHBvc3QgTEMgdXBkYXRlIHZlcnNpb24uDQo+ IA0KPiBMb3UNCj4gDQo+IE9uIDMvMTcvMjAgNzowOCBBTSwgVGVybyBLaXZpbmVuIHdyb3RlOg0K PiA+IExvdSBCZXJnZXIgd3JpdGVzOg0KPiA+Pj4gSW4gc2VjdGlvbiA1LjEuMi4yIGl0IHNheXMg dGhhdCBTUEkgZmllbGQgb2YgdGhlIEVTUCBhbmQgQUggaXMgdXNlZCwNCj4gPj4+IGJ1dCBpbiBj YXNlIHRoZSBJUHNlYyBpcyBjb25maWd1cmVkIHRvIHVzZSBVRFAgZW5jYXBzdWxhdGlvbg0KPiA+ Pj4gKHJmYzM5NDgsIGkuZS4sIFVEUCBkZXN0aW5hdGlvbiBwb3J0IGlzIDQ1MDApIHRoZXJlIGlz IGRpZmZlcmVudA0KPiA+Pj4gbG9jYXRpb24gZm9yIHRoZSBTUEkuIFNob3VsZCB0aGlzIGRvY3Vt ZW50IGFsc28gZGlnIFNQSSBvdXQgZnJvbSB0aGUNCj4gPj4+IFVEUCBlbmNhcHN1bGF0ZWQgRVNQ L0FIPw0KPiA+Pg0KPiA+PiBuby7CoCBJJ2xsIGFkZCBxdWFsaWZpY2F0aW9ucyB0aGF0IHRoaXMg YXBwbGllcyB3aGVuIHRoZSAiSVB2NA0KPiA+PiBQcm90b2NvbCBhbmQgSVB2NiBOZXh0IEhlYWRl ciBGaWVsZHMiIGFyZSBzZXQgdG8gQUggYW5kIEVTUC4gc3BlY2lmaWNhbGx5Og0KPiA+Pg0KPiA+ PiAgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIFRoZSBydWxlcyBkZWZpbmVkIGluIHRoaXMgc2Vj dGlvbiBvbmx5IGFwcGx5IHdoZW4gdGhlDQo+ID4+ICDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oCBJUHY0IFByb3RvY29sIG9yIElQdjYgTmV4dCBIZWFkZXIgRmllbGQgY29udGFpbnMgdGhlDQo+ ID4+IElBTkENCj4gPj4gIMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgIGRlZmluZWQgdmFsdWUg Zm9yIEFIIG9yIEVTUC4NCj4gPj4NCj4gPj4NCj4gPj4+IFRoZXJlIGlzIGFsc28NCj4gPj4+IHdy YXBwZWQgRVNQIChyZmM1ODQwKSB3aXRoIGJpdCBkaWZmZXJlbnQgZm9ybWF0LCBpLmUuLCBoYXZp bmcNCj4gPj4+IHdyYXBwZWQgRVNQIGhlYWRlciBiZWZvcmUgdGhlIG5vcm1hbCBFU1AgaGVhZGVy LiBTaG91bGQgdGhpcyBiZSBpbmNsdWRlZA0KPiBhbHNvPw0KPiA+Pg0KPiA+PiBUaGlzIHdhcyBu b3QgZGlzY3Vzc2VkIGluIHRoZSB3b3JraW5nIGdyb3VwIC0tIHNvIGEgcmVhbGx5IGdyZWF0DQo+ ID4+IHBvaW50IHRvIHJhaXNlIGluIHRoaXMgcmV2aWV3LsKgIFRoYW5rIHlvdSENCj4gPj4NCj4g Pj4gQXMgaXQgaGFzIGl0J3Mgb3duIHByb3RvY29sIG51bWJlciwgaXQgd291bGQgYmUgbm90IHRv byBoYXJkIHRvIGFkZC4NCj4gPj4gVGhhdCBzYWlkLCB0aGVyZSdzIG5vIHJlYXNvbiBpdCBjb3Vs ZG4ndCBiZSBhZGRlZCBsYXRlciBhbmQgbm8gb25lIGluDQo+ID4+IHRoZSB3b3JraW5nIGdyb3Vw IHJhaXNlZCBpdC7CoCBXaGF0IGRvIHlvdSB0aGluaywgaXMgaXQgaW1wb3J0YW50IHRvDQo+ID4+ IGFkZCBpdCBub3cuDQo+ID4NCj4gPiBJZiB5b3UgYXJlIG5vdCBjb25jZXJuZWQgVURQIGVuY2Fw c3VsYXRlZCBJUHNlYywgdGhlbiBJIHRoaW5rIHlvdSBjYW4NCj4gPiBpZ25vcmUgdGhlIFdyYXBw ZWQgRVNQIHRvby4gSSBoYXZlIG5vdCBzZWVuIHdyYXBwZWQgRVNQIGluIGFueSByZWFsDQo+ID4g dXNlLCBjb21wYXJlZCB0byB0aGUgVURQIGVuY2Fwc3VsYXRlZCBJUHNlYywgd2hpY2ggaXMgdmVy eSBjb21tb25seQ0KPiA+IHVzZWQuDQo+ID4NCj4gPiBXcmFwcGVkIEVTUCB3YXMgbWVhbmx5IG1l YW50IGZvciBlbnRlcnByaWNlIHVzZSBjYXNlcyB3aGVyZSB0aGV5IHdhbnQNCj4gPiBhdXRoZW50 aWNhdGlvbiBvbmx5LCBidXQgbm8gZW5jcnlwdGlvbiwgYXMgdGhleSBkbyB3YW50IHRvIGxvb2sg aW5zaWRlDQo+ID4gdGhlIHBhY2tldHMuDQo+ID4NCj4gPiBVRFAgZW5jYXBzdWxhdGVkIElQc2Vj IGlzIHVzZWQgd2hlbiB0aGVyZSBpcyBOQVRzIGluIHBsYXksIGkuZS4sIG1vc3QNCj4gPiBvZiB0 aGUgSVBzZWMgdHJhZmZpYyBmcm9tIHJvYWR3YXJyaW9ycywgaS5lLiBsYXB0b3BzIGluIGhvdGVs cyBldGMuDQo+ID4NCj4gDQo+IC0tDQo+IGxhc3QtY2FsbCBtYWlsaW5nIGxpc3QNCj4gbGFzdC1j YWxsQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vbGFz dC1jYWxsDQo= From nobody Tue Jun 23 06:20:09 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E9323A0E23; Tue, 23 Jun 2020 06:19:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.598 X-Spam-Level: X-Spam-Status: No, score=-9.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=mdQZYFQP; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=JZWL2Zfq Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1rVa-XuErWl1; Tue, 23 Jun 2020 06:19:45 -0700 (PDT) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 99D4B3A0FFD; Tue, 23 Jun 2020 06:19:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2932; q=dns/txt; s=iport; t=1592918375; x=1594127975; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=clS6Y1LmLJmi+rgyEy7rupgkFryYb4vH8stinEc6KEQ=; b=mdQZYFQP4UhR/2meCrq9lXLPv7/C6/3h6tDqcjIqlV17rOrfC85TWlAG RIHLfyboA4JeCoPNYDRceJB0Ze0sEDglYo1iv6hUFjRsHAlWDAxw45L83 M+NadTYhcxJBTrUx+xWFXHYyybZxk2cefsZAPHvLWcWn1yHtMB8PXMSP5 E=; IronPort-PHdr: =?us-ascii?q?9a23=3A24AyfhP1ExTOqYJ90kYl6mtXPHoupqn0MwgJ65?= =?us-ascii?q?Eul7NJdOG58o//OFDEvK813kHIUoTf8P9PzeHRtvOoVW8B5MOHt3YPONxJWg?= =?us-ascii?q?QegMob1wonHIaeCEL9IfKrCk5yHMlLWFJ/uX3uN09TFZXgZlLTpma/5ngZHR?= =?us-ascii?q?CsfQZwL/7+T4jVicn/3uuu+prVNgNPgjf1Yb57IBis6wvLscxDiop5IaF3wR?= =?us-ascii?q?zM8XY=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ABAgCRAPJe/5JdJa1mGwEBAQEBAQE?= =?us-ascii?q?BBQEBARIBAQEDAwEBAUCBSoFSUQdvWC8shCSDRgONHCWYVYJSA1ULAQEBDAE?= =?us-ascii?q?BGAsKAgQBAYRHAheBfAIkOBMCAwEBCwEBBQEBAQIBBgRthVsMhXIBAQEBAwE?= =?us-ascii?q?BEBERDAEBLAsBCwQCAQgRAwECAwImAgICJQsUAQgIAgQBDQUigwQBgksDLgE?= =?us-ascii?q?OrBQCgTmIYXaBMoMBAQEFhQsYgg4DBoEOKoJniXwagUE/gREnDBCCTT6CXAE?= =?us-ascii?q?BhHMzgi2SLJFoj1B8CoJalESEZwMdnnuRMZ5JAgQCBAUCDgEBBYFqIoFWcBU?= =?us-ascii?q?7KgGCPlAXAg2OHoNxhRSFQnQ3AgYBBwEBAwl8j2kBAQ?= X-IronPort-AV: E=Sophos;i="5.75,271,1589241600"; d="scan'208";a="501302692" Received: from rcdn-core-10.cisco.com ([173.37.93.146]) by alln-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 23 Jun 2020 13:19:34 +0000 Received: from XCH-RCD-002.cisco.com (xch-rcd-002.cisco.com [173.37.102.12]) by rcdn-core-10.cisco.com (8.15.2/8.15.2) with ESMTPS id 05NDJYlx011555 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 23 Jun 2020 13:19:34 GMT Received: from xhs-rtp-003.cisco.com (64.101.210.230) by XCH-RCD-002.cisco.com (173.37.102.12) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 23 Jun 2020 08:19:34 -0500 Received: from xhs-rtp-001.cisco.com (64.101.210.228) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 23 Jun 2020 09:19:32 -0400 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-001.cisco.com (64.101.210.228) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Tue, 23 Jun 2020 09:19:32 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=co7u4yiAiPV5+kQA1b72LiAJpT3aTKCxqFAWhbchH7meQwg+Z+7O3x6V/zn5yzLA/ZAxVTrVcJ7JTfMz7vI+cJtEYi1NhM2iMgF+NaXYNPYxas1wrOp5AJIei1uOWeGsx+Lub95XnCiRyoZuFABQW5czaAh00+ha/6X+P2XbxVIuQw3GTmfOCjC/Me/5PjJL8rTusP+g1a4MlMkgs6ZBBNotplWhs6aVmLphJlfKjemGkJrbVyYJyCKm/gBaZ9ptd70DKzxLqzgDcn/HKWLA1xk2v1UMKl0NAUQir0t61CvQxYVvpuRRaIDm96rnjiOm3EIIm2I252zTKSu3N+/PaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=clS6Y1LmLJmi+rgyEy7rupgkFryYb4vH8stinEc6KEQ=; b=QHGoAbAOeeDu+35m5MK7N/Bw4CZQ2BTPsgG9H9B6tLNiXseyVV6DcEjXE833r7QLXopxkFIxH3pueYGONXe9slbiKhLywm1qKpnZlym8is5VkhaPbhc/u94Wny39Le3Z1GFP0Ltafes1Bs1s4wfuQ87SQ8JrBAw2HqvWv5VfLEHIZAC1JpVPn13alSoePkHpog9FdE+fPtCz6smDUwIYiST6TiAFSEpg89Z22q9hRL1jUIPM7t81OENtdGtio5iHntMVnqwOHknTe+/VC5hkHFwALYpTiFpdme+Xdcw90mKtk220nkYGh94a+1kAwZrLnGz1KltH70BOkV8pQTE+Ng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=clS6Y1LmLJmi+rgyEy7rupgkFryYb4vH8stinEc6KEQ=; b=JZWL2ZfqRxycOwLrEW08CRQH3te6EgFTD4ssZSeUfQGiNuOWFJKlm4dRuaV+IzF0t+nwHFy8fY7X8HGdORoYSwopH6EkT7a8azNkVQ7Jr0aZOlr+g2Q8Wr69e/ZnqYu4K3A/3pNgqHWIHxkrcOzBjMH/Z3Zu2FS1Pk0OcW4WPQY= Received: from DM5PR11MB1753.namprd11.prod.outlook.com (2603:10b6:3:10d::13) by DM5PR11MB1340.namprd11.prod.outlook.com (2603:10b6:3:15::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3109.21; Tue, 23 Jun 2020 13:19:31 +0000 Received: from DM5PR11MB1753.namprd11.prod.outlook.com ([fe80::a14c:59b6:47b0:f630]) by DM5PR11MB1753.namprd11.prod.outlook.com ([fe80::a14c:59b6:47b0:f630%7]) with mapi id 15.20.3109.027; Tue, 23 Jun 2020 13:19:31 +0000 From: "Eric Vyncke (evyncke)" To: Russ Housley , "secdir@ietf.org" CC: "draft-ietf-dhc-v6only.all@ietf.org" , "dhcwg@ietf.org" , "last-call@ietf.org" Thread-Topic: [dhcwg] Secdir last call review of draft-ietf-dhc-v6only-03 Thread-Index: AQHWRbC0YR4g64oQDE+KVmrr7ViuYqjmWAGA Date: Tue, 23 Jun 2020 13:19:31 +0000 Message-ID: <7B6A100E-C60F-4914-8792-29819C8E4786@cisco.com> References: <159251281326.28009.2445308597820373796@ietfa.amsl.com> In-Reply-To: <159251281326.28009.2445308597820373796@ietfa.amsl.com> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.38.20061401 authentication-results: vigilsec.com; dkim=none (message not signed) header.d=none;vigilsec.com; dmarc=none action=none header.from=cisco.com; x-originating-ip: [2001:420:c0c1:36:7557:86e0:6ca6:aed] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cec69c45-f3ac-44b1-05be-08d8177810c1 x-ms-traffictypediagnostic: DM5PR11MB1340: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:2887; x-forefront-prvs: 04433051BF x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: /l7N7j+Ggsz/IqGTsu9Ts84rZK96I5y1P6NWcLI1pt4ixbAiWxYsD7RhYIuZ5v01idN+OLQsxwms1GWfD7Byg4JDYfVqz9Bd9dBcxpJyqhqH1T2IwSc5lVJz8iHJTLlvnRL8rfPKbvGPV6RFYAfvl2t/31GEJlpZ26xb2LXhtR+ZUL2EtKixEd/m9gqou3YWes8939n7fLQujEW9BHzHNcZ9+TPF1JcBmhScMZnq5dT1cLcowrZzBuOKf2FmHtoA/cxNQ/gBBJu+vLCgMbIuS+9kqM0vTH39rwYiOCcY2oiSihGGve800cCZH3+IXjI8Sd0ego1v6sT6KjyyxPadOKOOftGSUIC6bymYeirHFTbEo49rELNcDe2NENc9MncqUPA7xRtd2X5gaWEZ+0TAeg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM5PR11MB1753.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:(4636009)(346002)(136003)(376002)(396003)(39860400002)(366004)(110136005)(83380400001)(8676002)(6486002)(54906003)(53546011)(966005)(316002)(6512007)(186003)(2906002)(478600001)(5660300002)(71200400001)(66946007)(6506007)(76116006)(4326008)(91956017)(8936002)(36756003)(64756008)(66556008)(66476007)(2616005)(66446008)(86362001)(33656002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: QeKIez2nCplkDlrLMcF96owzz4bfgoCT+VjbbHAV8vbOAEGsRCN/ezPPCkOtzby/RH5m46HlpoWOQ1udVXLPJ6DvXGgFHZw246uksGoRr8Vduc9gqn4Yii2bpq3ph0yIMrmLlxFgJ7T+Xv97heHJDuFJJVV/8gdc43r3VWGrqOlHGa0qR43BICjf9JlEuvAXWIiP3glCIUTz5tuVTTu1vNs72xdyL8rvpHJWDgoUpzTByyJ2YYwmXRqMJeKYZjUFU+nPWN6Ym0/vfFbErXdCtD5iYv4mYwBqStvhzSWENLDz+b1MedePYSsHIgh7bPUQ0pLRuhcdBnjFBhOjprIaxHzL5UQb33FzRSbzcec/YgvsGny3A2DGRtOzVwVy0V1qsDUpRznufS5uH9jChGUtWKhmz/tvmOuUbwXVC9Pz4B9mk8HUOdtoa2MOPA6c8UK7KaR15c9CKXb/W3RZy8Z6W6ek4JOXLJravHjgb8M9btBJCvmSL1EsGyaqZ/N2q+zkLnWjys5Pb2vuqHIQZSDwcHlxeyjhttL2YaqCLCug1dY= x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cec69c45-f3ac-44b1-05be-08d8177810c1 X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jun 2020 13:19:31.6225 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: AkIZoqVOYN10YBlrfTMzDfsQVke+KBrFpdeC8bRMj06X/1CuAv2GQRm+VhmfqRpqHLIcQBthQULMo+froqvelg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR11MB1340 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.12, xch-rcd-002.cisco.com X-Outbound-Node: rcdn-core-10.cisco.com Archived-At: Subject: Re: [secdir] [dhcwg] Secdir last call review of draft-ietf-dhc-v6only-03 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jun 2020 13:19:55 -0000 VGhhbmsgeW91IFJ1c3MgZm9yIHlvdXIgcmV2aWV3IDotKQ0KDQrvu78tLS0tLU9yaWdpbmFsIE1l c3NhZ2UtLS0tLQ0KRnJvbTogZGhjd2cgPGRoY3dnLWJvdW5jZXNAaWV0Zi5vcmc+IG9uIGJlaGFs ZiBvZiBSdXNzIEhvdXNsZXkgdmlhIERhdGF0cmFja2VyIDxub3JlcGx5QGlldGYub3JnPg0KUmVw bHktVG86IFJ1c3MgSG91c2xleSA8aG91c2xleUB2aWdpbHNlYy5jb20+DQpEYXRlOiBUaHVyc2Rh eSwgMTggSnVuZSAyMDIwIGF0IDIyOjQwDQpUbzogInNlY2RpckBpZXRmLm9yZyIgPHNlY2RpckBp ZXRmLm9yZz4NCkNjOiAiZHJhZnQtaWV0Zi1kaGMtdjZvbmx5LmFsbEBpZXRmLm9yZyIgPGRyYWZ0 LWlldGYtZGhjLXY2b25seS5hbGxAaWV0Zi5vcmc+LCAiZGhjd2dAaWV0Zi5vcmciIDxkaGN3Z0Bp ZXRmLm9yZz4sICJsYXN0LWNhbGxAaWV0Zi5vcmciIDxsYXN0LWNhbGxAaWV0Zi5vcmc+DQpTdWJq ZWN0OiBbZGhjd2ddIFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0LWlldGYtZGhjLXY2 b25seS0wMw0KDQogICAgUmV2aWV3ZXI6IFJ1c3MgSG91c2xleQ0KICAgIFJldmlldyByZXN1bHQ6 IEhhcyBOaXRzDQoNCiAgICBJIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUg U2VjdXJpdHkgRGlyZWN0b3JhdGUncyBvbmdvaW5nDQogICAgZWZmb3J0IHRvIHJldmlldyBhbGwg SUVURiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLiAgVGhlc2UNCiAgICBj b21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUgU2Vj dXJpdHkgQXJlYQ0KICAgIERpcmVjdG9ycy4gIERvY3VtZW50IGF1dGhvcnMsIGRvY3VtZW50IGVk aXRvcnMsIGFuZCBXRyBjaGFpcnMgc2hvdWxkDQogICAgdHJlYXQgdGhlc2UgY29tbWVudHMganVz dCBsaWtlIGFueSBvdGhlciBJRVRGIExhc3QgQ2FsbCBjb21tZW50cy4NCg0KICAgIERvY3VtZW50 OiBkcmFmdC1pZXRmLWRoYy12Nm9ubHktMDMNCiAgICBSZXZpZXdlcjogUnVzcyBIb3VzbGV5DQog ICAgUmV2aWV3IERhdGU6IDIwMjAtMDYtMTgNCiAgICBJRVRGIExDIEVuZCBEYXRlOiAyMDIwLTA3 LTAyDQogICAgSUVTRyBUZWxlY2hhdCBkYXRlOiB1bmtub3duDQoNCiAgICBTdW1tYXJ5OiBIYXMg Tml0cw0KDQoNCiAgICBNYWpvciBDb25jZXJuczoNCg0KICAgIE5vbmUuDQoNCg0KICAgIE1pbm9y IENvbmNlcm5zOg0KDQogICAgU2VjdGlvbiAzLjQgaW5jbHVkZXM6DQoNCiAgICAgICAgVjZPTkxZ X1dBSVQgICAgIFRoZSBtaW5pbXVtIHRpbWUgdGhlIGNsaWVudCBTSE9VTEQgc3RvcCB0aGUgREhD UHY0DQogICAgICAgICAgICAgICAgICAgICAgICBjb25maWd1cmF0aW9uIHByb2Nlc3MgZm9yLiBN VVNUIGJlIG5vIGxlc3MgdGhhbg0KICAgICAgICAgICAgICAgICAgICAgICAgTUlOX1Y2T05MWV9X QUlUIHNlY29uZHMuIERlZmF1bHQ6IDE4MDAgc2Vjb25kcw0KDQogICAgVGhlIHNlY29uZCBzZW50 ZW5jZSBzaG91bGQgaW5jbHVkZSBhIHN1YmplY3Q7IGFuZCAiTVVTVCBOT1QiIHNlZW1zIGxpa2UN CiAgICBhIGJldHRlciB3b3JkaW5nIHRvIG1lLiAgSSBzdWdnZXN0Og0KDQogICAgICAgIFY2T05M WV9XQUlUICAgICBUaGUgbWluaW11bSB0aW1lIGZvciB3aGljaCB0aGUgY2xpZW50IFNIT1VMRCBz dG9wDQogICAgICAgICAgICAgICAgICAgICAgICB0aGUgREhDUHY0IGNvbmZpZ3VyYXRpb24gcHJv Y2Vzcy4gVGhlIHZhbHVlIE1VU1QgTk9UDQogICAgICAgICAgICAgICAgICAgICAgICBiZSBsZXNz IHRoYW4gTUlOX1Y2T05MWV9XQUlUIHNlY29uZHMuDQogICAgICAgICAgICAgICAgICAgICAgICBE ZWZhdWx0OiAxODAwIHNlY29uZHMuDQoNCg0KICAgIE5pdHM6DQoNCiAgICBTZWN0aW9uIDI6IHMv c2VlbXMgb25seSBuYXR1cmFsL3NlZW1zIG5hdHVyYWwvDQoNCiAgICBTZWN0aW9uIDMuMy4xOiBz L2ZvciBWNk9OTFlfV0FJVCBzZWNvbmQvZm9yIFY2T05MWV9XQUlUIHNlY29uZHMvDQoNCg0KDQog ICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCiAgICBk aGN3ZyBtYWlsaW5nIGxpc3QNCiAgICBkaGN3Z0BpZXRmLm9yZw0KICAgIGh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vZGhjd2cNCg0K From nobody Tue Jun 23 06:55:23 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 816213A0E1F; Tue, 23 Jun 2020 06:55:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cU4q6oUFZJ7W; Tue, 23 Jun 2020 06:55:16 -0700 (PDT) Received: from veto.sei.cmu.edu (veto.sei.cmu.edu [147.72.252.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAC233A0BF2; Tue, 23 Jun 2020 06:55:15 -0700 (PDT) Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by veto.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 05NDtEev001565; Tue, 23 Jun 2020 09:55:14 -0400 DKIM-Filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu 05NDtEev001565 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1592920514; bh=f9v0AVg1shAAX5mpgp2bmEof7gguzwVf3+MhNTqwrBc=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=qU7s39IeE3CxTV8X8hIvsNER13uqLN7hoCmZEd1vXBvUxIjJkg9DvUH3P6EEnFukX L1nOfJ2SnRIiVViwY4N3hgzzxQQ95hA9bEjuoSiviWYBWeCM2UKlnn4aOWCYfGmRU+ T+yFq9H1zZ6JfoZ6cmhQcROR3+tWw1k2qllkLVNs= Received: from CASSINA.ad.sei.cmu.edu (cassina.ad.sei.cmu.edu [10.64.28.249]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id 05NDtEqY013356; Tue, 23 Jun 2020 09:55:14 -0400 Received: from MURIEL.ad.sei.cmu.edu (147.72.252.47) by CASSINA.ad.sei.cmu.edu (10.64.28.249) with Microsoft SMTP Server (TLS) id 14.3.487.0; Tue, 23 Jun 2020 09:55:13 -0400 Received: from MORRIS.ad.sei.cmu.edu (147.72.252.46) by MURIEL.ad.sei.cmu.edu (147.72.252.47) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1979.3; Tue, 23 Jun 2020 09:55:13 -0400 Received: from MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb]) by MORRIS.ad.sei.cmu.edu ([fe80::555b:9498:552e:d1bb%13]) with mapi id 15.01.1979.003; Tue, 23 Jun 2020 09:55:13 -0400 From: Roman Danyliw To: Valery Smyslov , "secdir@ietf.org" , Mike Jones CC: "draft-ietf-secevent-http-push.all@ietf.org" , "id-event@ietf.org" Thread-Topic: [secdir] Secdir telechat review of draft-ietf-secevent-http-push-12 Thread-Index: AQHWRjsWw+Jh/YaAyECvBLbmOhoJSKjmPkaw Date: Tue, 23 Jun 2020 13:55:12 +0000 Message-ID: <62e0936425a144f2837306f6c9676f5d@cert.org> References: <159257225069.31013.12380067855802786524@ietfa.amsl.com> In-Reply-To: <159257225069.31013.12380067855802786524@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.64.202.179] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-secevent-http-push-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 23 Jun 2020 13:55:18 -0000 Hi Valery, thank you for the LC and follow-up telechat review. =20 Hi Mike, thank you for incorporating the feedback into -11. I have balloted with a COMMENT as I had a few items of feedback/questions o= n the security considerations. Regards, Roman > -----Original Message----- > From: secdir On Behalf Of Valery Smyslov via > Datatracker > Sent: Friday, June 19, 2020 9:11 AM > To: secdir@ietf.org > Cc: last-call@ietf.org; draft-ietf-secevent-http-push.all@ietf.org; id- > event@ietf.org > Subject: [secdir] Secdir telechat review of draft-ietf-secevent-http-push= -12 >=20 > Reviewer: Valery Smyslov > Review result: Ready >=20 > I have reviewed this document as part of the security directorate's ongoi= ng > effort to review all IETF documents being processed by the IESG. These > comments were written primarily for the benefit of the security area dire= ctors. > Document editors and WG chairs should treat these comments just like any > other last call comments. >=20 > This is my second review of the draft, last time I reviewed -10 version. >=20 > I looked over the diff between these versions and found that my concerns = have > been addressed. > I'm also glad that using TLS is now mandatory. Thank you. >=20 >=20 >=20 >=20 > _______________________________________________ > secdir mailing list > secdir@ietf.org > https://www.ietf.org/mailman/listinfo/secdir > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview From nobody Wed Jun 24 22:01:14 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2149B3A00C0; Wed, 24 Jun 2020 22:01:04 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Christian Huitema via Datatracker To: Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org, i2rs@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.4.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159306126401.5613.2130163467049929604@ietfa.amsl.com> Reply-To: Christian Huitema Date: Wed, 24 Jun 2020 22:01:04 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jun 2020 05:01:04 -0000 Reviewer: Christian Huitema Review result: Has Issues I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written with the intent of improving security requirements and considerations in IETF drafts. Comments not addressed in last call may be included in AD reviews during the IESG review. Document editors and WG chairs should treat these comments just like any other last call comments. This document describes a Yang model for representing Link Layer topologies. Representing such topologies is obviously useful for managing network. The security section is focused on securing the usage of this information for network management, but does not address potential privacy issues. The security considerations explain correctly how altering the link layer information could enable attacks against the network. The proposed remedy is access control, implemented using either SSH or TLS. This is fine, although the discussion of TLS authorisation is a bit short. By default, TLS verifies the identity of the server but not that of the client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD require authentication based on TLS client certificates. I assume that's the intent, but it might be useful to say so. On the other hand, the security considerations do not describe privacy issues, and I find that problematic. The proposed information model lists a number of sensitive data, such as for example the MAC addresses of devices. This information can be misused. For example, applications could assess device location fetching the MAC addresses of local gateways. Third parties could access link local information to gather identities of devices accessing a particular network. Such information is often protected by privacy API in the Operating System, but accessing the Yang module over the network might allow applications to bypass these controls. Client authentication alone does not necessarily protect against these privacy leaks. A classic configuration error would limit write access to authorized users, but to allow read-only access to most users. This kind of error would allow privacy leaks. Given the sensitive nature of MAC addresses and other identifiers, it is useful to warn against such errors. From nobody Thu Jun 25 06:04:27 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 41CA23A083A; Thu, 25 Jun 2020 06:04:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.948 X-Spam-Level: X-Spam-Status: No, score=0.948 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0QtuJkV3EHlR; Thu, 25 Jun 2020 06:04:20 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-100-static.hfc.comcastbusiness.net [50.245.122.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3097E3A0833; Thu, 25 Jun 2020 06:04:19 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.22.63; From: "Susan Hares" To: "'Christian Huitema'" , Cc: , , References: <159306126401.5613.2130163467049929604@ietfa.amsl.com> In-Reply-To: <159306126401.5613.2130163467049929604@ietfa.amsl.com> Date: Thu, 25 Jun 2020 09:04:15 -0400 Message-ID: <005401d64af1$2243a2c0$66cae840$@ndzh.com> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQGr16bjpP16h1NZBzVaEcIfqcfi36k+Liig Content-Language: en-us X-Antivirus: AVG (VPS 200624-2, 06/24/2020), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jun 2020 13:04:23 -0000 Christian: Thank you for catching the privacy issues. =20 I've got a few questions to help the authors scope this change:=20 1) Since this is common to all L2 Topologies, can you or the security = directorate recommend some text that might be appropriate?=20 If you have recommended text, has this text been reviewed by OPS-DIR = and Yang doctors?=20 2) Will it be a problem If we write privacy considerations on IEEE = specifications?=20 3) Do we need to consider the range of deployments of L2 (home, enterprise, public PBB service, national PBB service, Data = centers) Thank you, Sue=20 -----Original Message----- From: Christian Huitema via Datatracker [mailto:noreply@ietf.org]=20 Sent: Thursday, June 25, 2020 1:01 AM To: secdir@ietf.org Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; = i2rs@ietf.org; last-call@ietf.org Subject: Secdir last call review of = draft-ietf-i2rs-yang-l2-network-topology-13 Reviewer: Christian Huitema Review result: Has Issues I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written with the intent of improving security = requirements and considerations in IETF drafts. Comments not addressed = in last call may be included in AD reviews during the IESG review. = Document editors and WG chairs should treat these comments just like any = other last call comments. This document describes a Yang model for representing Link Layer = topologies. Representing such topologies is obviously useful for managing network. The security section is focused on securing the usage of this = information for network management, but does not address potential = privacy issues. The security considerations explain correctly how altering the link = layer information could enable attacks against the network. The proposed = remedy is access control, implemented using either SSH or TLS. This is = fine, although the discussion of TLS authorisation is a bit short. By = default, TLS verifies the identity of the server but not that of the = client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD = require authentication based on TLS client certificates. I assume that's = the intent, but it might be useful to say so. On the other hand, the security considerations do not describe privacy = issues, and I find that problematic. The proposed information model = lists a number of sensitive data, such as for example the MAC addresses = of devices. This information can be misused. For example, applications could assess = device location fetching the MAC addresses of local gateways. Third = parties could access link local information to gather identities of = devices accessing a particular network. Such information is often = protected by privacy API in the Operating System, but accessing the Yang = module over the network might allow applications to bypass these = controls. Client authentication alone does not necessarily protect against these = privacy leaks. A classic configuration error would limit write access to = authorized users, but to allow read-only access to most users. This kind = of error would allow privacy leaks. Given the sensitive nature of MAC = addresses and other identifiers, it is useful to warn against such = errors. From nobody Thu Jun 25 06:06:32 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 516FA3A083A for ; Thu, 25 Jun 2020 06:06:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.4.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <159309039131.2410.4209666026139108577@ietfa.amsl.com> Date: Thu, 25 Jun 2020 06:06:31 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jun 2020 13:06:31 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2020-06-25 Reviewer LC end Draft Melinda Shore 2020-05-13 draft-ietf-secevent-http-poll-12 For telechat 2020-07-09 Reviewer LC end Draft Stephen Farrell 2020-06-15 draft-ietf-pim-igmp-mld-snooping-yang-14 Daniel Gillmor 2020-06-12 draft-ietf-pce-stateful-pce-lsp-scheduling-17 Last calls: Reviewer LC end Draft John Bradley 2020-02-28 draft-ietf-regext-data-escrow-10 Shaun Cooley 2020-05-29 draft-ietf-ospf-te-link-attr-reuse-15 Alan DeKok 2020-05-29 draft-ietf-isis-te-app-18 Donald Eastlake R2019-11-14 draft-ietf-hip-dex-20 Donald Eastlake 2020-02-27 draft-ietf-6tisch-msf-16 Stephen Farrell 2020-06-15 draft-ietf-pim-igmp-mld-snooping-yang-14 Daniel Franke 2020-03-09 draft-ietf-regext-dnrd-objects-mapping-08 Daniel Gillmor 2020-06-12 draft-ietf-pce-stateful-pce-lsp-scheduling-17 Phillip Hallam-Baker 2020-06-11 draft-ietf-dots-use-cases-23 Dan Harkins None draft-ietf-rtgwg-policy-model-03 Leif Johansson 2020-07-08 draft-ietf-lsr-isis-invalid-tlv-02 Charlie Kaufman 2020-07-06 draft-ietf-ippm-stamp-option-tlv-06 Scott Kelly 2020-07-06 draft-ietf-pce-pcep-flowspec-09 Tero Kivinen 2020-07-06 draft-ietf-mpls-sfl-framework-08 Watson Ladd 2020-07-03 draft-ietf-ippm-route-08 Chris Lonvick 2020-07-03 draft-ietf-bess-evpn-inter-subnet-forwarding-09 Russ Mundy 2020-01-02 draft-ietf-dprive-bcp-op-10 Vincent Roca 2020-04-23 draft-ietf-detnet-ip-over-mpls-06 Stefan Santesson 2020-05-04 draft-ietf-httpbis-header-structure-19 Melinda Shore 2020-05-13 draft-ietf-secevent-http-poll-12 Tina Tsou 2020-05-08 draft-ietf-httpbis-client-hints-14 Samuel Weiler 2020-06-11 draft-ietf-trill-multilevel-single-nickname-10 Brian Weis 2020-05-26 draft-ietf-cose-hash-algs-04 Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth-09 Paul Wouters 2020-05-25 draft-ietf-capport-architecture-08 Dacheng Zhang 2020-03-12 draft-nottingham-how-did-that-get-into-the-repo-01 Dacheng Zhang 2019-11-05 draft-ietf-mpls-ri-rsvp-frr-07 Early review requests: Reviewer Due Draft Steve Hanna 2020-06-30 draft-ietf-emu-eap-noob-01 Next in the reviewer rotation: Aanchal Malhotra David Mandelberg Catherine Meadows Alexey Melnikov Daniel Migault Kathleen Moriarty Russ Mundy Sandra Murphy Yoav Nir Magnus Nystrom From nobody Thu Jun 25 06:18:08 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 339573A0997; Thu, 25 Jun 2020 06:17:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tw-ni7sVPPtz; Thu, 25 Jun 2020 06:17:53 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE3C83A0839; Thu, 25 Jun 2020 06:17:52 -0700 (PDT) Received: from lhreml717-chm.china.huawei.com (unknown [172.18.7.106]) by Forcepoint Email with ESMTP id 3DD2DAA6F058A746A43B; Thu, 25 Jun 2020 14:17:49 +0100 (IST) Received: from lhreml717-chm.china.huawei.com (10.201.108.68) by lhreml717-chm.china.huawei.com (10.201.108.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Thu, 25 Jun 2020 14:17:49 +0100 Received: from DGGEML403-HUB.china.huawei.com (10.3.17.33) by lhreml717-chm.china.huawei.com (10.201.108.68) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.1.1913.5 via Frontend Transport; Thu, 25 Jun 2020 14:17:48 +0100 Received: from DGGEML531-MBS.china.huawei.com ([169.254.5.107]) by DGGEML403-HUB.china.huawei.com ([fe80::74d9:c659:fbec:21fa%31]) with mapi id 14.03.0487.000; Thu, 25 Jun 2020 21:17:42 +0800 From: Qin Wu To: Christian Huitema , "secdir@ietf.org" CC: "draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org" , "i2rs@ietf.org" , "last-call@ietf.org" , "mohamed.boucadair@orange.com" , NETMOD Group Thread-Topic: Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 Thread-Index: AdZK7/ux7S4z7G2WR7mVKayBPsC8Mg== Date: Thu, 25 Jun 2020 13:17:41 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.164.123.57] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jun 2020 13:17:56 -0000 SGksIENocmlzdGlhbjoNClRoYW5rcyBmb3IgdmFsdWFibGUgY29tbWVudHMsIHBsZWFzZSBzZWUg cmVwbHkgaW5saW5lLg0KLS0tLS3pgq7ku7bljp/ku7YtLS0tLQ0K5Y+R5Lu25Lq6OiBDaHJpc3Rp YW4gSHVpdGVtYSB2aWEgRGF0YXRyYWNrZXIgW21haWx0bzpub3JlcGx5QGlldGYub3JnXSANCuWP kemAgeaXtumXtDogMjAyMOW5tDbmnIgyNeaXpSAxMzowMQ0K5pS25Lu25Lq6OiBzZWNkaXJAaWV0 Zi5vcmcNCuaKhOmAgTogZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5h bGxAaWV0Zi5vcmc7IGkycnNAaWV0Zi5vcmc7IGxhc3QtY2FsbEBpZXRmLm9yZw0K5Li76aKYOiBT ZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3Jr LXRvcG9sb2d5LTEzDQoNClJldmlld2VyOiBDaHJpc3RpYW4gSHVpdGVtYQ0KUmV2aWV3IHJlc3Vs dDogSGFzIElzc3Vlcw0KDQpJIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9m IHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0ZSdzIG9uZ29pbmcgZWZmb3J0IHRvIHJldmlldyBhbGwg SUVURiBkb2N1bWVudHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLiAgVGhlc2UgY29tbWVu dHMgd2VyZSB3cml0dGVuIHdpdGggdGhlIGludGVudCBvZiBpbXByb3Zpbmcgc2VjdXJpdHkgcmVx dWlyZW1lbnRzIGFuZCBjb25zaWRlcmF0aW9ucyBpbiBJRVRGIGRyYWZ0cy4gIENvbW1lbnRzIG5v dCBhZGRyZXNzZWQgaW4gbGFzdCBjYWxsIG1heSBiZSBpbmNsdWRlZCBpbiBBRCByZXZpZXdzIGR1 cmluZyB0aGUgSUVTRyByZXZpZXcuICBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hv dWxkIHRyZWF0IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNv bW1lbnRzLg0KDQpUaGlzIGRvY3VtZW50IGRlc2NyaWJlcyBhIFlhbmcgbW9kZWwgZm9yIHJlcHJl c2VudGluZyBMaW5rIExheWVyIHRvcG9sb2dpZXMuDQpSZXByZXNlbnRpbmcgc3VjaCB0b3BvbG9n aWVzIGlzIG9idmlvdXNseSB1c2VmdWwgZm9yIG1hbmFnaW5nIG5ldHdvcmsuDQpUaGUgc2VjdXJp dHkgc2VjdGlvbiBpcyBmb2N1c2VkIG9uIHNlY3VyaW5nIHRoZSB1c2FnZSBvZiB0aGlzIGluZm9y bWF0aW9uIGZvciBuZXR3b3JrIG1hbmFnZW1lbnQsIGJ1dCBkb2VzIG5vdCBhZGRyZXNzIHBvdGVu dGlhbCBwcml2YWN5IGlzc3Vlcy4NCltRaW5dOiBNeSB1bmRlcnN0YW5kaW5nIHByaXZhY3kgaXNz dWUgY2FuIGJlIGFkZHJlc3NlZCBieSB1c2luZyBOQUNNLiBOQUNNIHByb3ZpZGUgY2xpZW50IGF1 dGhvcml6YXRpb24gYW5kIHJlc3RyaWN0IHBhcnRpY3VsYXIgdXNlcnMgdG8gZ2V0IGFjY2VzcyB0 byBhIHByZWNvbmZpZ3VyZWQgc3Vic2V0IG9mIGFsbA0KICAgICBhdmFpbGFibGUgTkVUQ09ORiBv ciBSRVNUQ09ORiBwcm90b2NvbCBvcGVyYXRpb25zIGFuZCBjb250ZW50Lg0KDQpUaGUgc2VjdXJp dHkgY29uc2lkZXJhdGlvbnMgZXhwbGFpbiBjb3JyZWN0bHkgaG93IGFsdGVyaW5nIHRoZSBsaW5r IGxheWVyIGluZm9ybWF0aW9uIGNvdWxkIGVuYWJsZSBhdHRhY2tzIGFnYWluc3QgdGhlIG5ldHdv cmsuIFRoZSBwcm9wb3NlZCByZW1lZHkgaXMgYWNjZXNzIGNvbnRyb2wsIGltcGxlbWVudGVkIHVz aW5nIGVpdGhlciBTU0ggb3IgVExTLiBUaGlzIGlzIGZpbmUsIGFsdGhvdWdoIHRoZSBkaXNjdXNz aW9uIG9mIFRMUyBhdXRob3Jpc2F0aW9uIGlzIGEgYml0IHNob3J0LiBCeSBkZWZhdWx0LCBUTFMg dmVyaWZpZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBzZXJ2ZXIgYnV0IG5vdCB0aGF0IG9mIHRoZSBj bGllbnQuIFJGQzgwNDAgc2VjdGlvbiAyLjUgc3BlY2lmaWVzIHRoYXQgImEgUkVTVENPTkYgc2Vy dmVyIFNIT1VMRCByZXF1aXJlIGF1dGhlbnRpY2F0aW9uIGJhc2VkIG9uIFRMUyBjbGllbnQgY2Vy dGlmaWNhdGVzLiBJIGFzc3VtZSB0aGF0J3MgdGhlIGludGVudCwgYnV0IGl0IG1pZ2h0IGJlIHVz ZWZ1bCB0byBzYXkgc28uDQpbUWluXTogR29vZCBvYnNlcnZhdGlvbiBvbiBSRVNUQ09ORiAoUkZD ODA0MCksIFNpbWlsYXJseSwgTkVUQ09ORiAoUkZDNjI0MSkgc3RpcHVsYXRlcyB0aGF0ICJORVRD T05GIGNvbm5lY3Rpb25zIE1VU1QgYmUgYXV0aGVudGljYXRlZC4gIFRoZSB0cmFuc3BvcnQgcHJv dG9jb2wgaXMNCiAgIHJlc3BvbnNpYmxlIGZvciBhdXRoZW50aWNhdGlvbiBvZiB0aGUgc2VydmVy IHRvIHRoZSBjbGllbnQgYW5kIGF1dGhlbnRpY2F0aW9uIG9mIHRoZSBjbGllbnQgdG8gdGhlIHNl cnZlci4iIFRMUyBpcyBvbmUgZXhhbXBsZSBvZiBzdWNoIHRyYW5zcG9ydCBwcm90b2NvbC4gU28g aXQgaXMgdGhlIGpvYiBvZiBUcmFuc3BvcnQgcHJvdG9jb2wgdG8gcHJvdmlkZSBtdXR1YWwgYXV0 aGVudGljYXRpb24uIFBsZWFzZSByZWZlciB0byBzZWN0aW9uIDIuMiBvZiBSRkM2MjQxLiANCiAg IEkgYW0gbm90IHN1cmUgd2Ugc2hvdWxkIGVtcGhhc2l6ZSBtdXR1YWwgYXV0aGVudGljYXRpb24g dXNpbmcgdW5kZXJseWluZyB0cmFuc3BvcnQgcHJvdG9jb2wgaW4gdGhpcyBkb2N1bWVudCwgc2lu Y2UgYm90aCBSRVNUQ09ORiBhbmQgTkVUQ09ORiBoYXMgYWxyZWFkeSBjbGFyaWZpZWQgY2xpZW50 IGF1dGhlbnRpY2F0aW9uIGFuZCBzZXJ2ZXIgYXV0aGVudGljYXRpb24uDQogICBMZXQgbWUga25v dyBpZiB5b3UgdGhpbmsgSSBhbSB3cm9uZy4NCg0KT24gdGhlIG90aGVyIGhhbmQsIHRoZSBzZWN1 cml0eSBjb25zaWRlcmF0aW9ucyBkbyBub3QgZGVzY3JpYmUgcHJpdmFjeSBpc3N1ZXMsIGFuZCBJ IGZpbmQgdGhhdCBwcm9ibGVtYXRpYy4gVGhlIHByb3Bvc2VkIGluZm9ybWF0aW9uIG1vZGVsIGxp c3RzIGEgbnVtYmVyIG9mIHNlbnNpdGl2ZSBkYXRhLCBzdWNoIGFzIGZvciBleGFtcGxlIHRoZSBN QUMgYWRkcmVzc2VzIG9mIGRldmljZXMuDQpUaGlzIGluZm9ybWF0aW9uIGNhbiBiZSBtaXN1c2Vk LiBGb3IgZXhhbXBsZSwgYXBwbGljYXRpb25zIGNvdWxkIGFzc2VzcyBkZXZpY2UgbG9jYXRpb24g ZmV0Y2hpbmcgdGhlIE1BQyBhZGRyZXNzZXMgb2YgbG9jYWwgZ2F0ZXdheXMuIFRoaXJkIHBhcnRp ZXMgY291bGQgYWNjZXNzIGxpbmsgbG9jYWwgaW5mb3JtYXRpb24gdG8gZ2F0aGVyIGlkZW50aXRp ZXMgb2YgZGV2aWNlcyBhY2Nlc3NpbmcgYSBwYXJ0aWN1bGFyIG5ldHdvcmsuIFN1Y2ggaW5mb3Jt YXRpb24gaXMgb2Z0ZW4gcHJvdGVjdGVkIGJ5IHByaXZhY3kgQVBJIGluIHRoZSBPcGVyYXRpbmcg U3lzdGVtLCBidXQgYWNjZXNzaW5nIHRoZSBZYW5nIG1vZHVsZSBvdmVyIHRoZSBuZXR3b3JrIG1p Z2h0IGFsbG93IGFwcGxpY2F0aW9ucyB0byBieXBhc3MgdGhlc2UgY29udHJvbHMuDQpbUWluXTog SSB0aGluayB0aGlzIGlzIGEgdmFsaWQgcG9pbnQsIGluIG15IHRoaW5raW5nLCB3ZSBjb3VsZCBh ZGQgTUFDIGFkZHJlc3MgYXMgYW5vdGhlciBzZW5zaXRpdmUgZGF0YSBub2RlIGV4YW1wbGVzIHVu ZGVyIGwyLW5vZGUtYXR0cmlidXRlcyBhbmQgbDItdGVybWluYXRpb24tcG9pbnRzLWF0dHJpYnV0 ZXMuDQpQbGVhc2Ugbm90ZSB0aGF0IHdlIGZvbGxvdyBZQU5HIHNlY3VyaXR5IGd1aWRlbGluZSB0 ZW1wbGF0ZSBhcyBmb2xsb3dzOg0KaHR0cHM6Ly90cmFjLmlldGYub3JnL3RyYWMvb3BzL3dpa2kv eWFuZy1zZWN1cml0eS1ndWlkZWxpbmVzDQoNCg0KQ2xpZW50IGF1dGhlbnRpY2F0aW9uIGFsb25l IGRvZXMgbm90IG5lY2Vzc2FyaWx5IHByb3RlY3QgYWdhaW5zdCB0aGVzZSBwcml2YWN5IGxlYWtz LiBBIGNsYXNzaWMgY29uZmlndXJhdGlvbiBlcnJvciB3b3VsZCBsaW1pdCB3cml0ZSBhY2Nlc3Mg dG8gYXV0aG9yaXplZCB1c2VycywgYnV0IHRvIGFsbG93IHJlYWQtb25seSBhY2Nlc3MgdG8gbW9z dCB1c2Vycy4gVGhpcyBraW5kIG9mIGVycm9yIHdvdWxkIGFsbG93IHByaXZhY3kgbGVha3MuIEdp dmVuIHRoZSBzZW5zaXRpdmUgbmF0dXJlIG9mIE1BQyBhZGRyZXNzZXMgYW5kIG90aGVyIGlkZW50 aWZpZXJzLCBpdCBpcyB1c2VmdWwgdG8gd2FybiBhZ2FpbnN0IHN1Y2ggZXJyb3JzLg0KW1Fpbl06 SSBhZ3JlZSBjbGllbnQgYXV0aGVudGljYXRpb24gYWxvbmUgZG9lc24ndCBwcm90ZWN0IGFnYWlu c3QgdGhlIHByaXZhY3kgbGVhayBidXQgTkFDTSBkb2VzIHNpbmNlIGl0IHByb3ZpZGVzIGNsaWVu dCBhdXRob3JpemF0aW9uIGFuZCByZXN0cmljdCB2YXJpb3VzIGRpZmZlcmVudCB1c2UgdG8gZ2V0 IGFjY2VzcyB0byBvcGVyYXRpb24gYW5kIGNvbnRlbnRzLg0KSWYgSSBhbSB3cm9uZywgSSB3b3Vs ZCBsaWtlIHRvIHNvbGljaXQgb3BpbmlvbiBmcm9tIE5FVE1PRCBtYWlsaW5nIGxpc3QuDQoNCg0K DQo= From nobody Thu Jun 25 06:25:16 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B68EB3A09B3; Thu, 25 Jun 2020 06:25:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mFYQ9sGDOVTB; Thu, 25 Jun 2020 06:25:13 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4F663A09B1; Thu, 25 Jun 2020 06:25:12 -0700 (PDT) Received: from lhreml744-chm.china.huawei.com (unknown [172.18.7.107]) by Forcepoint Email with ESMTP id 9B088D57A5787527537E; Thu, 25 Jun 2020 14:25:10 +0100 (IST) Received: from lhreml744-chm.china.huawei.com (10.201.108.194) by lhreml744-chm.china.huawei.com (10.201.108.194) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Thu, 25 Jun 2020 14:25:10 +0100 Received: from DGGEML403-HUB.china.huawei.com (10.3.17.33) by lhreml744-chm.china.huawei.com (10.201.108.194) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.1.1913.5 via Frontend Transport; Thu, 25 Jun 2020 14:25:10 +0100 Received: from DGGEML531-MBS.china.huawei.com ([169.254.5.107]) by DGGEML403-HUB.china.huawei.com ([fe80::74d9:c659:fbec:21fa%31]) with mapi id 14.03.0487.000; Thu, 25 Jun 2020 21:25:05 +0800 From: Qin Wu To: Susan Hares , 'Christian Huitema' , "secdir@ietf.org" CC: "draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org" , "i2rs@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 Thread-Index: AdZK8zSFZwHzgS3vTuGAmW5dXOCk0w== Date: Thu, 25 Jun 2020 13:25:04 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.164.123.57] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jun 2020 13:25:15 -0000 U3VlIGFuZCBDaHJpc3RpYW46DQpJIGhhdmUgcmVzcG9uZGVkIHRvIENocmlzdGlhbiBvbiBwcml2 YWN5IGlzc3VlLCBteSBwcm9wb3NhbCBpcyB0byBhZGQgTUFDIGFkZHJlc3MgYXMgYW5vdGhlciBk YXRhIG5vZGUgdnVsbmVyYWJpbGl0eSBleGFtcGxlIGluIG91ciBvcmlnaW5hbCBzZWN1cml0eSBj b25zaWRlcmF0aW9uIHNlY3Rpb24uDQpCdXQgSWYgQ2hyaXN0aWFuIG9yIHNlY3VyaXR5IGRpcmVj dG9yYXRlIGhhcyByZWNvbW1lbmRpbmcgdGV4dCwgd2UgYXV0aG9ycyBhcmUgaGFwcHkgdG8gYWNj ZXB0IGl0Lg0KDQotUWluDQotLS0tLemCruS7tuWOn+S7ti0tLS0tDQrlj5Hku7bkuro6IFN1c2Fu IEhhcmVzIFttYWlsdG86c2hhcmVzQG5kemguY29tXSANCuWPkemAgeaXtumXtDogMjAyMOW5tDbm nIgyNeaXpSAyMTowNA0K5pS25Lu25Lq6OiAnQ2hyaXN0aWFuIEh1aXRlbWEnIDxodWl0ZW1hQGh1 aXRlbWEubmV0Pjsgc2VjZGlyQGlldGYub3JnDQrmioTpgIE6IGRyYWZ0LWlldGYtaTJycy15YW5n LWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3JnOyBpMnJzQGlldGYub3JnOyBsYXN0LWNh bGxAaWV0Zi5vcmcNCuS4u+mimDogUkU6IFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0 LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3ktMTMNCg0KQ2hyaXN0aWFuOg0KDQpU aGFuayB5b3UgZm9yIGNhdGNoaW5nIHRoZSBwcml2YWN5IGlzc3Vlcy4gICAgICANCg0KSSd2ZSBn b3QgYSBmZXcgcXVlc3Rpb25zIHRvIGhlbHAgdGhlIGF1dGhvcnMgc2NvcGUgdGhpcyBjaGFuZ2U6 IA0KDQoxKSBTaW5jZSB0aGlzIGlzIGNvbW1vbiB0byBhbGwgTDIgVG9wb2xvZ2llcywgY2FuIHlv dSBvciB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmVjb21tZW5kIHNvbWUgdGV4dCB0aGF0IG1p Z2h0IGJlIGFwcHJvcHJpYXRlPyANCiAgIElmIHlvdSBoYXZlIHJlY29tbWVuZGVkIHRleHQsIGhh cyB0aGlzIHRleHQgYmVlbiByZXZpZXdlZCBieSBPUFMtRElSIGFuZCBZYW5nIGRvY3RvcnM/IA0K DQoyKSBXaWxsIGl0IGJlIGEgcHJvYmxlbSBJZiB3ZSB3cml0ZSBwcml2YWN5IGNvbnNpZGVyYXRp b25zIG9uIElFRUUgc3BlY2lmaWNhdGlvbnM/IA0KMykgRG8gd2UgbmVlZCB0byBjb25zaWRlciB0 aGUgcmFuZ2Ugb2YgZGVwbG95bWVudHMgb2YgTDIgKGhvbWUsIGVudGVycHJpc2UsICBwdWJsaWMg UEJCIHNlcnZpY2UsIG5hdGlvbmFsIFBCQiBzZXJ2aWNlLCBEYXRhIGNlbnRlcnMpDQoNCg0KVGhh bmsgeW91LCAgU3VlIA0KDQoNCi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQpGcm9tOiBDaHJp c3RpYW4gSHVpdGVtYSB2aWEgRGF0YXRyYWNrZXIgW21haWx0bzpub3JlcGx5QGlldGYub3JnXQ0K U2VudDogVGh1cnNkYXksIEp1bmUgMjUsIDIwMjAgMTowMSBBTQ0KVG86IHNlY2RpckBpZXRmLm9y Zw0KQ2M6IGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYu b3JnOyBpMnJzQGlldGYub3JnOyBsYXN0LWNhbGxAaWV0Zi5vcmcNClN1YmplY3Q6IFNlY2RpciBs YXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xv Z3ktMTMNCg0KUmV2aWV3ZXI6IENocmlzdGlhbiBIdWl0ZW1hDQpSZXZpZXcgcmVzdWx0OiBIYXMg SXNzdWVzDQoNCkkgaGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNl Y3VyaXR5IGRpcmVjdG9yYXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRv Y3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuICBUaGVzZSBjb21tZW50cyB3ZXJl IHdyaXR0ZW4gd2l0aCB0aGUgaW50ZW50IG9mIGltcHJvdmluZyBzZWN1cml0eSByZXF1aXJlbWVu dHMgYW5kIGNvbnNpZGVyYXRpb25zIGluIElFVEYgZHJhZnRzLiAgQ29tbWVudHMgbm90IGFkZHJl c3NlZCBpbiBsYXN0IGNhbGwgbWF5IGJlIGluY2x1ZGVkIGluIEFEIHJldmlld3MgZHVyaW5nIHRo ZSBJRVNHIHJldmlldy4gIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJl YXQgdGhlc2UgY29tbWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMu DQoNClRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIGEgWWFuZyBtb2RlbCBmb3IgcmVwcmVzZW50aW5n IExpbmsgTGF5ZXIgdG9wb2xvZ2llcy4NClJlcHJlc2VudGluZyBzdWNoIHRvcG9sb2dpZXMgaXMg b2J2aW91c2x5IHVzZWZ1bCBmb3IgbWFuYWdpbmcgbmV0d29yay4NClRoZSBzZWN1cml0eSBzZWN0 aW9uIGlzIGZvY3VzZWQgb24gc2VjdXJpbmcgdGhlIHVzYWdlIG9mIHRoaXMgaW5mb3JtYXRpb24g Zm9yIG5ldHdvcmsgbWFuYWdlbWVudCwgYnV0IGRvZXMgbm90IGFkZHJlc3MgcG90ZW50aWFsIHBy aXZhY3kgaXNzdWVzLg0KDQpUaGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgZXhwbGFpbiBjb3Jy ZWN0bHkgaG93IGFsdGVyaW5nIHRoZSBsaW5rIGxheWVyIGluZm9ybWF0aW9uIGNvdWxkIGVuYWJs ZSBhdHRhY2tzIGFnYWluc3QgdGhlIG5ldHdvcmsuIFRoZSBwcm9wb3NlZCByZW1lZHkgaXMgYWNj ZXNzIGNvbnRyb2wsIGltcGxlbWVudGVkIHVzaW5nIGVpdGhlciBTU0ggb3IgVExTLiBUaGlzIGlz IGZpbmUsIGFsdGhvdWdoIHRoZSBkaXNjdXNzaW9uIG9mIFRMUyBhdXRob3Jpc2F0aW9uIGlzIGEg Yml0IHNob3J0LiBCeSBkZWZhdWx0LCBUTFMgdmVyaWZpZXMgdGhlIGlkZW50aXR5IG9mIHRoZSBz ZXJ2ZXIgYnV0IG5vdCB0aGF0IG9mIHRoZSBjbGllbnQuIFJGQzgwNDAgc2VjdGlvbiAyLjUgc3Bl Y2lmaWVzIHRoYXQgImEgUkVTVENPTkYgc2VydmVyIFNIT1VMRCByZXF1aXJlIGF1dGhlbnRpY2F0 aW9uIGJhc2VkIG9uIFRMUyBjbGllbnQgY2VydGlmaWNhdGVzLiBJIGFzc3VtZSB0aGF0J3MgdGhl IGludGVudCwgYnV0IGl0IG1pZ2h0IGJlIHVzZWZ1bCB0byBzYXkgc28uDQoNCk9uIHRoZSBvdGhl ciBoYW5kLCB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgZG8gbm90IGRlc2NyaWJlIHByaXZh Y3kgaXNzdWVzLCBhbmQgSSBmaW5kIHRoYXQgcHJvYmxlbWF0aWMuIFRoZSBwcm9wb3NlZCBpbmZv cm1hdGlvbiBtb2RlbCBsaXN0cyBhIG51bWJlciBvZiBzZW5zaXRpdmUgZGF0YSwgc3VjaCBhcyBm b3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZiBkZXZpY2VzLg0KVGhpcyBpbmZvcm1hdGlv biBjYW4gYmUgbWlzdXNlZC4gRm9yIGV4YW1wbGUsIGFwcGxpY2F0aW9ucyBjb3VsZCBhc3Nlc3Mg ZGV2aWNlIGxvY2F0aW9uIGZldGNoaW5nIHRoZSBNQUMgYWRkcmVzc2VzIG9mIGxvY2FsIGdhdGV3 YXlzLiBUaGlyZCBwYXJ0aWVzIGNvdWxkIGFjY2VzcyBsaW5rIGxvY2FsIGluZm9ybWF0aW9uIHRv IGdhdGhlciBpZGVudGl0aWVzIG9mIGRldmljZXMgYWNjZXNzaW5nIGEgcGFydGljdWxhciBuZXR3 b3JrLiBTdWNoIGluZm9ybWF0aW9uIGlzIG9mdGVuIHByb3RlY3RlZCBieSBwcml2YWN5IEFQSSBp biB0aGUgT3BlcmF0aW5nIFN5c3RlbSwgYnV0IGFjY2Vzc2luZyB0aGUgWWFuZyBtb2R1bGUgb3Zl ciB0aGUgbmV0d29yayBtaWdodCBhbGxvdyBhcHBsaWNhdGlvbnMgdG8gYnlwYXNzIHRoZXNlIGNv bnRyb2xzLg0KDQpDbGllbnQgYXV0aGVudGljYXRpb24gYWxvbmUgZG9lcyBub3QgbmVjZXNzYXJp bHkgcHJvdGVjdCBhZ2FpbnN0IHRoZXNlIHByaXZhY3kgbGVha3MuIEEgY2xhc3NpYyBjb25maWd1 cmF0aW9uIGVycm9yIHdvdWxkIGxpbWl0IHdyaXRlIGFjY2VzcyB0byBhdXRob3JpemVkIHVzZXJz LCBidXQgdG8gYWxsb3cgcmVhZC1vbmx5IGFjY2VzcyB0byBtb3N0IHVzZXJzLiBUaGlzIGtpbmQg b2YgZXJyb3Igd291bGQgYWxsb3cgcHJpdmFjeSBsZWFrcy4gR2l2ZW4gdGhlIHNlbnNpdGl2ZSBu YXR1cmUgb2YgTUFDIGFkZHJlc3NlcyBhbmQgb3RoZXIgaWRlbnRpZmllcnMsIGl0IGlzIHVzZWZ1 bCB0byB3YXJuIGFnYWluc3Qgc3VjaCBlcnJvcnMuDQoNCg0KDQoNCg0K From nobody Thu Jun 25 07:00:16 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CB0D13A0B7B; Thu, 25 Jun 2020 07:00:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.948 X-Spam-Level: X-Spam-Status: No, score=0.948 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uuv4k7cND1ia; Thu, 25 Jun 2020 07:00:13 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-100-static.hfc.comcastbusiness.net [50.245.122.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4A323A0B74; Thu, 25 Jun 2020 07:00:12 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.22.63; From: "Susan Hares" To: "'Qin Wu'" , "'Christian Huitema'" , Cc: , , References: In-Reply-To: Date: Thu, 25 Jun 2020 10:00:08 -0400 Message-ID: <002a01d64af8$f07320b0$d1596210$@ndzh.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQLWmtRw7iPyu8IsKX2i31zM5z+c8qbou2Eg Content-Language: en-us X-Antivirus: AVG (VPS 200624-2, 06/24/2020), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Jun 2020 14:00:15 -0000 Qin and Christian:=20 Thank you for your prompt attention to the privacy issue. =20 I'm sure Christian will respond in a bit - since he might be in PDT = time-zone.=20 Once you have a solution you both like, we should validate the privacy changes to the security considerations section with = the=20 Yang-doctors, OPS-ADs, and Security-ADs. =20 Martin's watching this thread so I'm sure he'll help us out as well.=20 Sue=20 -----Original Message----- From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu Sent: Thursday, June 25, 2020 9:25 AM To: Susan Hares; 'Christian Huitema'; secdir@ietf.org Cc: i2rs@ietf.org; = draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; = last-call@ietf.org Subject: Re: [i2rs] Secdir last call review of = draft-ietf-i2rs-yang-l2-network-topology-13 Sue and Christian: I have responded to Christian on privacy issue, my proposal is to add = MAC address as another data node vulnerability example in our original = security consideration section. But If Christian or security directorate has recommending text, we = authors are happy to accept it. -Qin -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- =E5=8F=91=E4=BB=B6=E4=BA=BA: Susan Hares [mailto:shares@ndzh.com]=20 =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: 2020=E5=B9=B46=E6=9C=8825=E6=97=A5 = 21:04 =E6=94=B6=E4=BB=B6=E4=BA=BA: 'Christian Huitema' ; = secdir@ietf.org =E6=8A=84=E9=80=81: = draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; i2rs@ietf.org; = last-call@ietf.org =E4=B8=BB=E9=A2=98: RE: Secdir last call review of = draft-ietf-i2rs-yang-l2-network-topology-13 Christian: Thank you for catching the privacy issues. =20 I've got a few questions to help the authors scope this change:=20 1) Since this is common to all L2 Topologies, can you or the security = directorate recommend some text that might be appropriate?=20 If you have recommended text, has this text been reviewed by OPS-DIR = and Yang doctors?=20 2) Will it be a problem If we write privacy considerations on IEEE = specifications?=20 3) Do we need to consider the range of deployments of L2 (home, = enterprise, public PBB service, national PBB service, Data centers) Thank you, Sue=20 -----Original Message----- From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] Sent: Thursday, June 25, 2020 1:01 AM To: secdir@ietf.org Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; = i2rs@ietf.org; last-call@ietf.org Subject: Secdir last call review of = draft-ietf-i2rs-yang-l2-network-topology-13 Reviewer: Christian Huitema Review result: Has Issues I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written with the intent of improving security = requirements and considerations in IETF drafts. Comments not addressed = in last call may be included in AD reviews during the IESG review. = Document editors and WG chairs should treat these comments just like any = other last call comments. This document describes a Yang model for representing Link Layer = topologies. Representing such topologies is obviously useful for managing network. The security section is focused on securing the usage of this = information for network management, but does not address potential = privacy issues. The security considerations explain correctly how altering the link = layer information could enable attacks against the network. The proposed = remedy is access control, implemented using either SSH or TLS. This is = fine, although the discussion of TLS authorisation is a bit short. By = default, TLS verifies the identity of the server but not that of the = client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD = require authentication based on TLS client certificates. I assume that's = the intent, but it might be useful to say so. On the other hand, the security considerations do not describe privacy = issues, and I find that problematic. The proposed information model = lists a number of sensitive data, such as for example the MAC addresses = of devices. This information can be misused. For example, applications could assess = device location fetching the MAC addresses of local gateways. Third = parties could access link local information to gather identities of = devices accessing a particular network. Such information is often = protected by privacy API in the Operating System, but accessing the Yang = module over the network might allow applications to bypass these = controls. Client authentication alone does not necessarily protect against these = privacy leaks. A classic configuration error would limit write access to = authorized users, but to allow read-only access to most users. This kind = of error would allow privacy leaks. Given the sensitive nature of MAC = addresses and other identifiers, it is useful to warn against such = errors. _______________________________________________ i2rs mailing list i2rs@ietf.org https://www.ietf.org/mailman/listinfo/i2rs From nobody Thu Jun 25 21:20:15 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA0033A1114 for ; Thu, 25 Jun 2020 21:20:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fWDGu0H4ZCp5 for ; Thu, 25 Jun 2020 21:20:12 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A9C03A1111 for ; Thu, 25 Jun 2020 21:20:11 -0700 (PDT) Received: from xse71.mail2web.com ([66.113.196.71] helo=xse.mail2web.com) by mx165.antispamcloud.com with esmtp (Exim 4.92) (envelope-from ) id 1jofbQ-0004Ae-PQ for secdir@ietf.org; Fri, 26 Jun 2020 06:04:42 +0200 Received: from xsmtp21.mail2web.com (unknown [10.100.68.60]) by xse.mail2web.com (Postfix) with ESMTPS id 49tNYs0G53z2FXY for ; Thu, 25 Jun 2020 21:04:33 -0700 (PDT) Received: from [10.5.2.13] (helo=xmail03.myhosting.com) by xsmtp21.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1jofbM-00023r-Tv for secdir@ietf.org; Thu, 25 Jun 2020 21:04:32 -0700 Received: (qmail 29315 invoked from network); 26 Jun 2020 04:04:32 -0000 Received: from unknown (HELO [192.168.1.107]) (Authenticated-user:_huitema@huitema.net@[172.58.43.153]) (envelope-sender ) by xmail03.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 26 Jun 2020 04:04:32 -0000 To: Susan Hares , 'Qin Wu' , secdir@ietf.org Cc: i2rs@ietf.org, draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org, last-call@ietf.org References: <002a01d64af8$f07320b0$d1596210$@ndzh.com> From: Christian Huitema Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mDMEXtavGxYJKwYBBAHaRw8BAQdA1ou9A5MHTP9N3jfsWzlDZ+jPnQkusmc7sfLmWVz1Rmu0 J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PoiWBBMWCAA+FiEEw3G4 Nwi4QEpAAXUUELAmqKBYtJQFAl7WrxsCGwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgEC F4AACgkQELAmqKBYtJQbMwD/ebj/qnSbthC/5kD5DxZ/Ip0CGJw5QBz/+fJp3R8iAlsBAMjK r2tmyWyJz0CUkVG24WaR5EAJDvgwDv8h22U6QVkAuDgEXtavGxIKKwYBBAGXVQEFAQEHQJoM 6MUAIqpoqdCIiACiEynZf7nlJg2Eu0pXIhbUGONdAwEIB4h+BBgWCAAmFiEEw3G4Nwi4QEpA AXUUELAmqKBYtJQFAl7WrxsCGwwFCQlmAYAACgkQELAmqKBYtJRm2wD7BzeK5gEXSmBcBf0j BYdSaJcXNzx4yPLbP4GnUMAyl2cBAJzcsR4RkwO4dCRqM9CHpVJCwHtbUDJaa55//E0kp+gH Message-ID: <15aa8236-ce09-d0b4-5f12-31f10b32387c@huitema.net> Date: Thu, 25 Jun 2020 21:04:32 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: <002a01d64af8$f07320b0$d1596210$@ndzh.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Originating-IP: 66.113.196.71 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.196.71/32 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.196.71/32@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0f6LF1GdvkEexklpcFpSF5apSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDcQkv3rfK9nOh84B6FNp+WsRX qYbtEQV1z/L435ZRxFQYwJ54lHI2rHK7CG3LkN9C+rYZvu7UEJiU3s27VgKHO7lwS3dBJTnTxDoD vBGGxph9w6EwXICYy0ePXtGEMhqrmPJpYjip2cUyffXokzWsYGU6UgOqKJ9sMwhVoOBGSAIboXtx P9OF0EfNs5TqNq2Yhy7LI0kfFnXdPP6btp4oBeJDeKRq5oPj2hFJhLx+qI3HlR3ootg7OlA3N5WN re/oppAGOX5cHTu1yz4pRT/9FGrxEaaKeSxe0Wrx6M4G5/WoLsdfEoJI0BNUQ4KpaNyNCwGqOUcw rXf55E8Tb8bmXq4yH8StrboPphDtmrtUkwkDMc9xayd+oZJo2heFY+g6kVWClPVvbW5lVyQanRxw 5rdY2rW50fd1ekaDpmIWc1Vmt3mnxMTQMQWbvBqEXskTQn6USYs98Imn+lZXe3dwYfgVB1xo6dCf BaU/iegBU8aUJfluQqfeAjECBQJTOQmp9M69+ApolWUXeuIyRFpSPqJiom+NXkC/Yflk67XQzp+H gbVpRK3T9+h2PwMALJBCxonDIYWSUUgite7wem8TErdCp3Zd9clP8wSiJZWbJCg35R5vCGCRun6Y x0PkyFKGt2KqQ5CDVKDkhVq/eZckqzXg724gFzhHYUe+7aKm0vXJ+XHwcdnHpXn1219D0aw2Ti+J 2sBvM/O0p+zizleC4lU8fDj1CnRx+r4b/1Q/PZ/pXnk7D3f/E2ZRQAxo6nrZvOnCUbNPgcPcQwzM gKHyQxUo+ql2ySTkvEFH/23XMww2BnTTFGX5/yI4Ky+1ZJcbGqc5H4PEZHeoI/d6LWFf332z7LMw LGdoi9FMQ5j9dQUvMi1YKAun15JQSJLyCT5k+MTObVKxHy/dols381l9r9ft9daDonlwd6LnuX+J u10= X-Report-Abuse-To: spam@quarantine11.antispamcloud.com Archived-At: Subject: Re: [secdir] [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 04:20:14 -0000 How about adding something like this: Privacy Considerations The Yang model for layer 2 topology exposes privacy sensitive information, for example the MAC addresses of devices. Unrestricted use of such information can lead to privacy violations. For example, listing MAC addresses in a network allows monitoring of devices and their movements. Location information can be derived from MAC addresses of network devices, bypassing protection of location information by the Operating System. Deployments should mitigate this privacy concerns by limiting access to the layer 2 topology information. Access to the information should be restricted to a minimal list of authorized agents, and should require proper authentication of these agents. -- Christian Huitema On 6/25/2020 7:00 AM, Susan Hares wrote: > Qin and Christian: > > Thank you for your prompt attention to the privacy issue. > I'm sure Christian will respond in a bit - since he might be in PDT time-zone. > > Once you have a solution you both like, we should > validate the privacy changes to the security considerations section with the > Yang-doctors, OPS-ADs, and Security-ADs. > > Martin's watching this thread so I'm sure he'll help us out as well. > > Sue > > -----Original Message----- > From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu > Sent: Thursday, June 25, 2020 9:25 AM > To: Susan Hares; 'Christian Huitema'; secdir@ietf.org > Cc: i2rs@ietf.org; draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; last-call@ietf.org > Subject: Re: [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 > > Sue and Christian: > I have responded to Christian on privacy issue, my proposal is to add MAC address as another data node vulnerability example in our original security consideration section. > But If Christian or security directorate has recommending text, we authors are happy to accept it. > > -Qin > -----邮件原件----- > 发件人: Susan Hares [mailto:shares@ndzh.com] > 发送时间: 2020年6月25日 21:04 > 收件人: 'Christian Huitema' ; secdir@ietf.org > 抄送: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; i2rs@ietf.org; last-call@ietf.org > 主题: RE: Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 > > Christian: > > Thank you for catching the privacy issues. > > I've got a few questions to help the authors scope this change: > > 1) Since this is common to all L2 Topologies, can you or the security directorate recommend some text that might be appropriate? > If you have recommended text, has this text been reviewed by OPS-DIR and Yang doctors? > > 2) Will it be a problem If we write privacy considerations on IEEE specifications? > 3) Do we need to consider the range of deployments of L2 (home, enterprise, public PBB service, national PBB service, Data centers) > > > Thank you, Sue > > > -----Original Message----- > From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] > Sent: Thursday, June 25, 2020 1:01 AM > To: secdir@ietf.org > Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; i2rs@ietf.org; last-call@ietf.org > Subject: Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 > > Reviewer: Christian Huitema > Review result: Has Issues > > I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written with the intent of improving security requirements and considerations in IETF drafts. Comments not addressed in last call may be included in AD reviews during the IESG review. Document editors and WG chairs should treat these comments just like any other last call comments. > > This document describes a Yang model for representing Link Layer topologies. > Representing such topologies is obviously useful for managing network. > The security section is focused on securing the usage of this information for network management, but does not address potential privacy issues. > > The security considerations explain correctly how altering the link layer information could enable attacks against the network. The proposed remedy is access control, implemented using either SSH or TLS. This is fine, although the discussion of TLS authorisation is a bit short. By default, TLS verifies the identity of the server but not that of the client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD require authentication based on TLS client certificates. I assume that's the intent, but it might be useful to say so. > > On the other hand, the security considerations do not describe privacy issues, and I find that problematic. The proposed information model lists a number of sensitive data, such as for example the MAC addresses of devices. > This information can be misused. For example, applications could assess device location fetching the MAC addresses of local gateways. Third parties could access link local information to gather identities of devices accessing a particular network. Such information is often protected by privacy API in the Operating System, but accessing the Yang module over the network might allow applications to bypass these controls. > > Client authentication alone does not necessarily protect against these privacy leaks. A classic configuration error would limit write access to authorized users, but to allow read-only access to most users. This kind of error would allow privacy leaks. Given the sensitive nature of MAC addresses and other identifiers, it is useful to warn against such errors. > > > > > > _______________________________________________ > i2rs mailing list > i2rs@ietf.org > https://www.ietf.org/mailman/listinfo/i2rs > From nobody Fri Jun 26 04:37:56 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C7F53A125D; Fri, 26 Jun 2020 04:37:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DMmrTiL0AJ8B; Fri, 26 Jun 2020 04:37:48 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6B2193A1259; Fri, 26 Jun 2020 04:37:47 -0700 (PDT) Received: from lhreml715-chm.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id 22CE7952682DFE730179; Fri, 26 Jun 2020 12:37:45 +0100 (IST) Received: from lhreml715-chm.china.huawei.com (10.201.108.66) by lhreml715-chm.china.huawei.com (10.201.108.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1913.5; Fri, 26 Jun 2020 12:37:44 +0100 Received: from DGGEML401-HUB.china.huawei.com (10.3.17.32) by lhreml715-chm.china.huawei.com (10.201.108.66) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.1.1913.5 via Frontend Transport; Fri, 26 Jun 2020 12:37:43 +0100 Received: from DGGEML531-MBS.china.huawei.com ([169.254.5.107]) by DGGEML401-HUB.china.huawei.com ([fe80::89ed:853e:30a9:2a79%31]) with mapi id 14.03.0487.000; Fri, 26 Jun 2020 19:37:42 +0800 From: Qin Wu To: Christian Huitema , Susan Hares , "secdir@ietf.org" CC: "i2rs@ietf.org" , "draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org" , "last-call@ietf.org" , NETMOD Group Thread-Topic: [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 Thread-Index: AdZLq4eKKDexa0UyTree7juoGQUnLA== Date: Fri, 26 Jun 2020 11:37:41 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.164.123.57] Content-Type: multipart/alternative; boundary="_000_B8F9A780D330094D99AF023C5877DABAAD7BCE5Ddggeml531mbschi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 11:37:51 -0000 --_000_B8F9A780D330094D99AF023C5877DABAAD7BCE5Ddggeml531mbschi_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGksIENocmlzdGlhbjoNCg0KMS4gICAgICAgTkFDTSBkZWZpbmVkIGluIFJGQzgzNDEgaGFzIGFs cmVhZHkgcHJvdmlkZWQgbWVjaGFuaXNtcyB0byByZXN0cmljdCBhY2Nlc3MgdG8gc2Vuc2l0aXZl IGluZm9ybWF0aW9uIHRvIGEgbWluaW1hbCBsaXN0IG9mIGF1dGhvcml6ZWQgY2xpZW50IG9yIGFn ZW50cyBhbmQgZGVhbCB3aXRoIHByaXZhY3kgaXNzdWUgaWYgbXkgdW5kZXJzdGFuZGluZyBpcyBj b3JyZWN0Lg0KDQoyLiAgICAgICBCb3RoIE5FVENPTkYgYW5kIFJFU1RDT05GIHdpbGwgcmVseSBv biB0cmFuc3BvcnQgcHJvdG9jb2wgc3VjaCBhcyBUTFMgdG8gcHJvdmlkZSBjbGllbnQgYXV0aGVu dGljYXRpb24gYW5kIHNlcnZlciBhdXRoZW50aWNhdGlvbiwgaS5lLiwgbXV0dWFsIGF1dGhlbnRp Y2F0aW9uLg0KDQozLiAgICAgICBUaGUgWUFORyBzZWN1cml0eSBndWlkZWxpbmUgZGVmaW5lZCBp biBodHRwczovL3RyYWMuaWV0Zi5vcmcvdHJhYy9vcHMvd2lraS95YW5nLXNlY3VyaXR5LWd1aWRl bGluZXMNCg0KUHJvdmlkZSBwZXJmZWN0IGJvaWxlcnBsYXRlIHRvIGFkZHJlc3MgYm90aCBzZWN1 cml0eSBjb25zaWRlcmF0aW9uIGFuZCBwcml2YWN5IGNvbnNpZGVyYXRpb24uDQoNCk15IG9yaWdp bmFsIHByb3Bvc2FsIEEgdG8gYWRkcmVzcyB5b3VyIGNvbW1lbnRzIGlzOg0KDQpPTEQgVEVYVDoN Cg0KIg0KDQogICBUaGVyZSBhcmUgYSBudW1iZXIgb2YgZGF0YSBub2RlcyBkZWZpbmVkIGluIHRo aXMgWUFORyBtb2R1bGUgdGhhdCBhcmUNCg0KICAgd3JpdGFibGUvY3JlYXRhYmxlL2RlbGV0YWJs ZSAoaS5lLiwgY29uZmlnIHRydWUsIHdoaWNoIGlzIHRoZQ0KDQogICBkZWZhdWx0KS4gIFRoZXNl IGRhdGEgbm9kZXMgbWF5IGJlIGNvbnNpZGVyZWQgc2Vuc2l0aXZlIG9yIHZ1bG5lcmFibGUNCg0K ICAgaW4gc29tZSBuZXR3b3JrIGVudmlyb25tZW50cy4gIFdyaXRlIG9wZXJhdGlvbnMgKGUuZy4s IGVkaXQtY29uZmlnKQ0KDQogICB0byB0aGVzZSBkYXRhIG5vZGVzIHdpdGhvdXQgcHJvcGVyIHBy b3RlY3Rpb24gY2FuIGhhdmUgYSBuZWdhdGl2ZQ0KDQogICBlZmZlY3Qgb24gbmV0d29yayBvcGVy YXRpb25zLiAgVGhlc2UgYXJlIHRoZSBzdWJ0cmVlcyBhbmQgZGF0YSBub2Rlcw0KDQogICBhbmQg dGhlaXIgc2Vuc2l0aXZpdHkvdnVsbmVyYWJpbGl0eSBpbiB0aGUgaWV0Zi1uZXR3b3JrIG1vZHVs ZToNCg0KDQoNCiAgIG8gIGwyLW5ldHdvcmstYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50 IGNvdWxkIGF0dGVtcHQgdG8NCg0KICAgICAgc2Fib3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24gb2Yg YW55IG9mIHRoZSBjb250YWluZWQgYXR0cmlidXRlcywNCg0KICAgICAgc3VjaCBhcyB0aGUgbmFt ZSBvciB0aGUgZmxhZyBkYXRhIG5vZGVzLg0KDQoNCg0KICAgbyAgbDItbm9kZS1hdHRyaWJ1dGVz OiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0byBzYWJvdGFnZQ0KDQogICAgICB0 aGUgY29uZmlndXJhdGlvbiBvZiBpbXBvcnRhbnQgbm9kZSBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRo ZSBuYW1lDQoNCiAgICAgIG9yIHRoZSBtYW5hZ2VtZW50LWFkZHJlc3MuDQoNCg0KDQogICBvICBs Mi1saW5rLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNh Ym90YWdlDQoNCiAgICAgIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBsaW5rIGF0dHJp YnV0ZXMsIHN1Y2ggYXMgdGhlIHJhdGUNCg0KICAgICAgb3IgdGhlIGRlbGF5IGRhdGEgbm9kZXMu DQoNCg0KDQogICBvICBsMi10ZXJtaW5hdGlvbi1wb2ludC1hdHRyaWJ1dGVzOiBBIG1hbGljaW91 cyBjbGllbnQgY291bGQgYXR0ZW1wdA0KDQogICAgICB0byBzYWJvdGFnZSB0aGUgY29uZmlndXJh dGlvbiBvZiBpbXBvcnRhbnQgdGVybWluYXRpb24gcG9pbnQNCg0KICAgICAgYXR0cmlidXRlcywg c3VjaCBhcyB0aGUgbWF4aW11bS1mcmFtZS1zaXplLg0KDQoiDQoNCk5FVyBURVhUOg0KDQoiDQoN CiAgIFRoZXJlIGFyZSBhIG51bWJlciBvZiBkYXRhIG5vZGVzIGRlZmluZWQgaW4gdGhpcyBZQU5H IG1vZHVsZSB0aGF0IGFyZQ0KDQogICB3cml0YWJsZS9jcmVhdGFibGUvZGVsZXRhYmxlIChpLmUu LCBjb25maWcgdHJ1ZSwgd2hpY2ggaXMgdGhlDQoNCiAgIGRlZmF1bHQpLiAgVGhlc2UgZGF0YSBu b2RlcyBtYXkgYmUgY29uc2lkZXJlZCBzZW5zaXRpdmUgb3IgdnVsbmVyYWJsZQ0KDQogICBpbiBz b21lIG5ldHdvcmsgZW52aXJvbm1lbnRzLiAgV3JpdGUgb3BlcmF0aW9ucyAoZS5nLiwgZWRpdC1j b25maWcpDQoNCiAgIHRvIHRoZXNlIGRhdGEgbm9kZXMgd2l0aG91dCBwcm9wZXIgcHJvdGVjdGlv biBjYW4gaGF2ZSBhIG5lZ2F0aXZlDQoNCiAgIGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMu ICBUaGVzZSBhcmUgdGhlIHN1YnRyZWVzIGFuZCBkYXRhIG5vZGVzDQoNCiAgIGFuZCB0aGVpciBz ZW5zaXRpdml0eS92dWxuZXJhYmlsaXR5IGluIHRoZSBpZXRmLW5ldHdvcmsgbW9kdWxlOg0KDQoN Cg0KICAgbyAgbDItbmV0d29yay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQg YXR0ZW1wdCB0bw0KDQogICAgICBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBhbnkgb2Yg dGhlIGNvbnRhaW5lZCBhdHRyaWJ1dGVzLA0KDQogICAgICBzdWNoIGFzIHRoZSBuYW1lIG9yIHRo ZSBmbGFnIGRhdGEgbm9kZXMuDQoNCg0KDQogICBvICBsMi1ub2RlLWF0dHJpYnV0ZXM6IEEgbWFs aWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlDQoNCiAgICAgIHRoZSBjb25m aWd1cmF0aW9uIG9mIGltcG9ydGFudCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG5hbWUN Cg0KICAgICAgLHRoZSBtYW5hZ2VtZW50LWFkZHJlc3Mgb3IgbWFjIGFkZHJlc3Mgb2YgdGhlIGRl dmljZXMuDQoNCg0KDQogICBvICBsMi1saW5rLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVu dCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlDQoNCiAgICAgIHRoZSBjb25maWd1cmF0aW9uIG9m IGltcG9ydGFudCBsaW5rIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIHJhdGUNCg0KICAgICAgb3Ig dGhlIGRlbGF5IGRhdGEgbm9kZXMuDQoNCg0KDQogIG8gIGwyLXRlcm1pbmF0aW9uLXBvaW50LWF0 dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0DQoNCiAgICAgIHRvIHNh Ym90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCB0ZXJtaW5hdGlvbiBwb2ludA0K DQogICAgICBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBtYXhpbXVtLWZyYW1lLXNpemUsIG1hYy1h ZGRyZXNzLg0KDQoiDQoNCg0KDQpXaXRoIHlvdXIgcHJvcG9zZWQgdGV4dCwgd2UgY291bGQgaGF2 ZSB0aGUgZm9sbG93aW5nIHByb3Bvc2FsIGNoYW5nZXMgKFByb3Bvc2FsIEIpOg0KDQpPTEQgVEVY VDoNCg0KIg0KDQo2LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMNCg0KDQoNCiAgIFRoZSBZQU5H IG1vZHVsZSBzcGVjaWZpZWQgaW4gdGhpcyBkb2N1bWVudCBkZWZpbmVzIGEgc2NoZW1hIGZvciBk YXRhDQoNCiAgIHRoYXQgaXMgZGVzaWduZWQgdG8gYmUgYWNjZXNzZWQgdmlhIG5ldHdvcmsgbWFu YWdlbWVudCBwcm90b2NvbHMgc3VjaA0KDQogICBhcyBORVRDT05GIFtSRkM2MjQxXSBvciBSRVNU Q09ORiBbUkZDODA0MF0uICBUaGUgbG93ZXN0IE5FVENPTkYgbGF5ZXINCg0KICAgaXMgdGhlIHNl Y3VyZSB0cmFuc3BvcnQgbGF5ZXIsIGFuZCB0aGUgbWFuZGF0b3J5LXRvLWltcGxlbWVudCBzZWN1 cmUNCg0KICAgdHJhbnNwb3J0IGlzIFNlY3VyZSBTaGVsbCAoU1NIKSBbUkZDNjI0Ml0uICBUaGUg bG93ZXN0IFJFU1RDT05GIGxheWVyDQoNCiAgIGlzIEhUVFBTLCBhbmQgdGhlIG1hbmRhdG9yeS10 by1pbXBsZW1lbnQgc2VjdXJlIHRyYW5zcG9ydCBpcyBUTFMNCg0KICAgW1JGQzg0NDZdLg0KDQoN Cg0KICAgVGhlIE5ldHdvcmsgQ29uZmlndXJhdGlvbiBBY2Nlc3MgQ29udHJvbCBNb2RlbCAoTkFD TSkgW1JGQzgzNDFdDQoNCiAgIHByb3ZpZGVzIHRoZSBtZWFucyB0byByZXN0cmljdCBhY2Nlc3Mg Zm9yIHBhcnRpY3VsYXIgTkVUQ09ORiBvcg0KDQoNCg0KICAgUkVTVENPTkYgdXNlcnMgdG8gYSBw cmVjb25maWd1cmVkIHN1YnNldCBvZiBhbGwgYXZhaWxhYmxlIE5FVENPTkYgb3INCg0KICAgUkVT VENPTkYgcHJvdG9jb2wgb3BlcmF0aW9ucyBhbmQgY29udGVudC4NCg0KDQoNCiAgIEluIGdlbmVy YWwsIExheWVyIDIgbmV0d29yayB0b3BvbG9naWVzIGFyZSBzeXN0ZW0tY29udHJvbGxlZCBhbmQN Cg0KICAgcHJvdmlkZSBlcGhlbWVyYWwgdG9wb2xvZ3kgaW5mb3JtYXRpb24uICBJbiBhbiBOTURB LWNvbXBsaWVudCBzZXJ2ZXIsDQoNCiAgIHRoZXkgYXJlIG9ubHkgcGFydCBvZiA8b3BlcmF0aW9u YWw+IHdoaWNoIHByb3ZpZGVzIHJlYWQtb25seSBhY2Nlc3MNCg0KICAgdG8gY2xpZW50cywgdGhl eSBhcmUgbGVzcyB2dWxuZXJhYmxlLiAgVGhhdCBzYWlkLCB0aGUgWUFORyBtb2R1bGUNCg0KICAg ZG9lcyBpbiBwcmluY2lwbGUgYWxsb3cgaW5mb3JtYXRpb24gdG8gYmUgY29uZmlndXJhYmxlLg0K DQoNCg0KICAgVGhlIExheWVyIDIgdG9wb2xvZ3kgbW9kdWxlIGRlZmluZSBpbmZvcm1hdGlvbiB0 aGF0IGNhbiBiZQ0KDQogICBjb25maWd1cmFibGUgaW4gY2VydGFpbiBpbnN0YW5jZXMsIGZvciBl eGFtcGxlIGluIHRoZSBjYXNlIG9mIHZpcnR1YWwNCg0KICAgdG9wb2xvZ2llcyB0aGF0IGNhbiBi ZSBjcmVhdGVkIGJ5IGNsaWVudCBhcHBsaWNhdGlvbnMuICBJbiBzdWNoDQoNCiAgIGNhc2VzLCBh IG1hbGljaW91cyBjbGllbnQgY291bGQgaW50cm9kdWNlIHRvcG9sb2dpZXMgdGhhdCBhcmUNCg0K ICAgdW5kZXNpcmVkLiAgU3BlY2lmaWNhbGx5LCBhIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0 ZW1wdCB0byByZW1vdmUNCg0KICAgb3IgYWRkIGEgbm9kZSwgYSBsaW5rLCBhIHRlcm1pbmF0aW9u IHBvaW50LCBieSBjcmVhdGluZyBvciBkZWxldGluZw0KDQogICBjb3JyZXNwb25kaW5nIGVsZW1l bnRzIGluIHRoZSBub2RlLCBsaW5rLCBhbmQgdGVybWluYXRpb24gcG9pbnQNCg0KICAgbGlzdHMs IHJlc3BlY3RpdmVseS4gIEluIHRoZSBjYXNlIG9mIGEgdG9wb2xvZ3kgdGhhdCBpcyBsZWFybmVk LCB0aGUNCg0KICAgc2VydmVyIHdpbGwgYXV0b21hdGljYWxseSBwcm9oaWJpdCBzdWNoIG1pc2Nv bmZpZ3VyYXRpb24gYXR0ZW1wdHMuDQoNCiAgIEluIHRoZSBjYXNlIG9mIGEgdG9wb2xvZ3kgdGhh dCBpcyBjb25maWd1cmVkLCBpLmUuIHdob3NlIG9yaWdpbiBpcw0KDQogICAiaW50ZW5kZWQiLCB0 aGUgdW5kZXNpcmVkIGNvbmZpZ3VyYXRpb24gY291bGQgYmVjb21lIGVmZmVjdGl2ZSBhbmQgYmUN Cg0KICAgcmVmbGVjdGVkIGluIHRoZSBvcGVyYXRpb25hbCBzdGF0ZSBkYXRhc3RvcmUsIGxlYWRp bmcgdG8gZGlzcnVwdGlvbg0KDQogICBvZiBzZXJ2aWNlcyBwcm92aWRlZCB2aWEgdGhpcyB0b3Bv bG9neSBtaWdodCBiZSBkaXNydXB0ZWQuICBGb3IgdGhvc2UNCg0KICAgcmVhc29ucywgaXQgaXMg aW1wb3J0YW50IHRoYXQgdGhlIE5FVENPTkYgYWNjZXNzIGNvbnRyb2wgbW9kZWwgaXMNCg0KICAg dmlnb3JvdXNseSBhcHBsaWVkIHRvIHByZXZlbnQgdG9wb2xvZ3kgbWlzY29uZmlndXJhdGlvbiBi eQ0KDQogICB1bmF1dGhvcml6ZWQgY2xpZW50cy4NCg0KDQoNCiAgIFRoZXJlIGFyZSBhIG51bWJl ciBvZiBkYXRhIG5vZGVzIGRlZmluZWQgaW4gdGhpcyBZQU5HIG1vZHVsZSB0aGF0IGFyZQ0KDQog ICB3cml0YWJsZS9jcmVhdGFibGUvZGVsZXRhYmxlIChpLmUuLCBjb25maWcgdHJ1ZSwgd2hpY2gg aXMgdGhlDQoNCiAgIGRlZmF1bHQpLiAgVGhlc2UgZGF0YSBub2RlcyBtYXkgYmUgY29uc2lkZXJl ZCBzZW5zaXRpdmUgb3IgdnVsbmVyYWJsZQ0KDQogICBpbiBzb21lIG5ldHdvcmsgZW52aXJvbm1l bnRzLiAgV3JpdGUgb3BlcmF0aW9ucyAoZS5nLiwgZWRpdC1jb25maWcpDQoNCiAgIHRvIHRoZXNl IGRhdGEgbm9kZXMgd2l0aG91dCBwcm9wZXIgcHJvdGVjdGlvbiBjYW4gaGF2ZSBhIG5lZ2F0aXZl DQoNCiAgIGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMuICBUaGVzZSBhcmUgdGhlIHN1YnRy ZWVzIGFuZCBkYXRhIG5vZGVzDQoNCiAgIGFuZCB0aGVpciBzZW5zaXRpdml0eS92dWxuZXJhYmls aXR5IGluIHRoZSBpZXRmLW5ldHdvcmsgbW9kdWxlOg0KDQoNCg0KICAgbyAgbDItbmV0d29yay1h dHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0bw0KDQogICAgICBz YWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBhbnkgb2YgdGhlIGNvbnRhaW5lZCBhdHRyaWJ1 dGVzLA0KDQogICAgICBzdWNoIGFzIHRoZSBuYW1lIG9yIHRoZSBmbGFnIGRhdGEgbm9kZXMuDQoN Cg0KDQogICBvICBsMi1ub2RlLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBh dHRlbXB0IHRvIHNhYm90YWdlDQoNCiAgICAgIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFu dCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG5hbWUNCg0KICAgICAgb3IgdGhlIG1hbmFn ZW1lbnQtYWRkcmVzcy4NCg0KDQoNCiAgIG8gIGwyLWxpbmstYXR0cmlidXRlczogQSBtYWxpY2lv dXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2UNCg0KICAgICAgdGhlIGNvbmZpZ3Vy YXRpb24gb2YgaW1wb3J0YW50IGxpbmsgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgcmF0ZQ0KDQog ICAgICBvciB0aGUgZGVsYXkgZGF0YSBub2Rlcy4NCg0KDQoNCiAgIG8gIGwyLXRlcm1pbmF0aW9u LXBvaW50LWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0DQoNCiAg ICAgIHRvIHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCB0ZXJtaW5hdGlv biBwb2ludA0KDQogICAgICBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBtYXhpbXVtLWZyYW1lLXNp emUuDQoNCiINCg0KTkVXIFRFWFQ6DQoNCiINCg0KNi4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25z DQoNCg0KDQogICBUaGUgWUFORyBtb2R1bGUgc3BlY2lmaWVkIGluIHRoaXMgZG9jdW1lbnQgZGVm aW5lcyBhIHNjaGVtYSBmb3IgZGF0YQ0KDQogICB0aGF0IGlzIGRlc2lnbmVkIHRvIGJlIGFjY2Vz c2VkIHZpYSBuZXR3b3JrIG1hbmFnZW1lbnQgcHJvdG9jb2xzIHN1Y2gNCg0KICAgYXMgTkVUQ09O RiBbUkZDNjI0MV0gb3IgUkVTVENPTkYgW1JGQzgwNDBdLiAgVGhlIGxvd2VzdCBORVRDT05GIGxh eWVyDQoNCiAgIGlzIHRoZSBzZWN1cmUgdHJhbnNwb3J0IGxheWVyLCBhbmQgdGhlIG1hbmRhdG9y eS10by1pbXBsZW1lbnQgc2VjdXJlDQoNCiAgIHRyYW5zcG9ydCBpcyBTZWN1cmUgU2hlbGwgKFNT SCkgW1JGQzYyNDJdLiAgVGhlIGxvd2VzdCBSRVNUQ09ORiBsYXllcg0KDQogICBpcyBIVFRQUywg YW5kIHRoZSBtYW5kYXRvcnktdG8taW1wbGVtZW50IHNlY3VyZSB0cmFuc3BvcnQgaXMgVExTDQoN CiAgIFtSRkM4NDQ2XS4NCg0KDQoNCiAgIFRoZSBOZXR3b3JrIENvbmZpZ3VyYXRpb24gQWNjZXNz IENvbnRyb2wgTW9kZWwgKE5BQ00pIFtSRkM4MzQxXQ0KDQogICBwcm92aWRlcyB0aGUgbWVhbnMg dG8gcmVzdHJpY3QgYWNjZXNzIGZvciBwYXJ0aWN1bGFyIE5FVENPTkYgb3INCg0KICAgUkVTVENP TkYgdXNlcnMgdG8gYSBwcmVjb25maWd1cmVkIHN1YnNldCBvZiBhbGwgYXZhaWxhYmxlIE5FVENP TkYgb3INCg0KICAgUkVTVENPTkYgcHJvdG9jb2wgb3BlcmF0aW9ucyBhbmQgY29udGVudC4NCg0K DQoNCiAgIEluIGdlbmVyYWwsIExheWVyIDIgbmV0d29yayB0b3BvbG9naWVzIGFyZSBzeXN0ZW0t Y29udHJvbGxlZCBhbmQNCg0KICAgcHJvdmlkZSBlcGhlbWVyYWwgdG9wb2xvZ3kgaW5mb3JtYXRp b24uICBJbiBhbiBOTURBLWNvbXBsaWVudCBzZXJ2ZXIsDQoNCiAgIHRoZXkgYXJlIG9ubHkgcGFy dCBvZiA8b3BlcmF0aW9uYWw+IHdoaWNoIHByb3ZpZGVzIHJlYWQtb25seSBhY2Nlc3MNCg0KICAg dG8gY2xpZW50cywgdGhleSBhcmUgbGVzcyB2dWxuZXJhYmxlLiAgVGhhdCBzYWlkLCB0aGUgWUFO RyBtb2R1bGUNCg0KICAgZG9lcyBpbiBwcmluY2lwbGUgYWxsb3cgaW5mb3JtYXRpb24gdG8gYmUg Y29uZmlndXJhYmxlLg0KDQoNCg0KICAgVGhlIExheWVyIDIgdG9wb2xvZ3kgbW9kdWxlIGRlZmlu ZSBpbmZvcm1hdGlvbiB0aGF0IGNhbiBiZQ0KDQogICBjb25maWd1cmFibGUgaW4gY2VydGFpbiBp bnN0YW5jZXMsIGZvciBleGFtcGxlIGluIHRoZSBjYXNlIG9mIHZpcnR1YWwNCg0KICAgdG9wb2xv Z2llcyB0aGF0IGNhbiBiZSBjcmVhdGVkIGJ5IGNsaWVudCBhcHBsaWNhdGlvbnMuICBJbiBzdWNo DQoNCiAgIGNhc2VzLCBhIG1hbGljaW91cyBjbGllbnQgY291bGQgaW50cm9kdWNlIHRvcG9sb2dp ZXMgdGhhdCBhcmUNCg0KICAgdW5kZXNpcmVkLiAgU3BlY2lmaWNhbGx5LCBhIG1hbGljaW91cyBj bGllbnQgY291bGQgYXR0ZW1wdCB0byByZW1vdmUNCg0KICAgb3IgYWRkIGEgbm9kZSwgYSBsaW5r LCBhIHRlcm1pbmF0aW9uIHBvaW50LCBieSBjcmVhdGluZyBvciBkZWxldGluZw0KDQogICBjb3Jy ZXNwb25kaW5nIGVsZW1lbnRzIGluIHRoZSBub2RlLCBsaW5rLCBhbmQgdGVybWluYXRpb24gcG9p bnQNCg0KICAgbGlzdHMsIHJlc3BlY3RpdmVseS4gIEluIHRoZSBjYXNlIG9mIGEgdG9wb2xvZ3kg dGhhdCBpcyBsZWFybmVkLCB0aGUNCg0KICAgc2VydmVyIHdpbGwgYXV0b21hdGljYWxseSBwcm9o aWJpdCBzdWNoIG1pc2NvbmZpZ3VyYXRpb24gYXR0ZW1wdHMuDQoNCiAgIEluIHRoZSBjYXNlIG9m IGEgdG9wb2xvZ3kgdGhhdCBpcyBjb25maWd1cmVkLCBpLmUuIHdob3NlIG9yaWdpbiBpcw0KDQog ICAiaW50ZW5kZWQiLCB0aGUgdW5kZXNpcmVkIGNvbmZpZ3VyYXRpb24gY291bGQgYmVjb21lIGVm ZmVjdGl2ZSBhbmQgYmUNCg0KICAgcmVmbGVjdGVkIGluIHRoZSBvcGVyYXRpb25hbCBzdGF0ZSBk YXRhc3RvcmUsIGxlYWRpbmcgdG8gZGlzcnVwdGlvbg0KDQogICBvZiBzZXJ2aWNlcyBwcm92aWRl ZCB2aWEgdGhpcyB0b3BvbG9neSBtaWdodCBiZSBkaXNydXB0ZWQuICBGb3IgdGhvc2UNCg0KICAg cmVhc29ucywgaXQgaXMgaW1wb3J0YW50IHRoYXQgdGhlIE5FVENPTkYgYWNjZXNzIGNvbnRyb2wg bW9kZWwgaXMNCg0KICAgdmlnb3JvdXNseSBhcHBsaWVkIHRvIHByZXZlbnQgdG9wb2xvZ3kgbWlz Y29uZmlndXJhdGlvbiBieQ0KDQogICB1bmF1dGhvcml6ZWQgY2xpZW50cy4NCg0KDQoNCiAgVGhl IFlBTkcgbW9kZWwgZm9yIGxheWVyIDIgdG9wb2xvZ3kgbWF5IGV4cG9zZSBzZW5zaXRpdmUgaW5m b3JtYXRpb24sDQoNCiAgZm9yIGV4YW1wbGUgdGhlIE1BQyBhZGRyZXNzZXMgb2YgZGV2aWNlcy4g VW5yZXN0cmljdGVkIHVzZSBvZiBzdWNoIGluZm9ybWF0aW9uDQoNCiAgIGNhbiBsZWFkIHRvIHBy aXZhY3kgdmlvbGF0aW9ucy4gRm9yIGV4YW1wbGUsIGxpc3RpbmcgTUFDIGFkZHJlc3NlcyBpbiBh IG5ldHdvcmsNCg0KICAgYWxsb3dzIG1vbml0b3Jpbmcgb2YgZGV2aWNlcyBhbmQgdGhlaXIgbW92 ZW1lbnRzLiBMb2NhdGlvbiBpbmZvcm1hdGlvbiBjYW4gYmUgZGVyaXZlZA0KDQogICBmcm9tIE1B QyBhZGRyZXNzZXMgb2YgbmV0d29yayBkZXZpY2VzLCBieXBhc3NpbmcgcHJvdGVjdGlvbiBvZiBs b2NhdGlvbiBpbmZvcm1hdGlvbiBieQ0KDQogICB0aGUgT3BlcmF0aW5nIFN5c3RlbS4gRGVwbG95 bWVudHMgc2hvdWxkIG1pdGlnYXRlIHRoaXMgcHJpdmFjeSBjb25jZXJucyBieSBsaW1pdGluZyBh Y2Nlc3MNCg0KICAgdG8gdGhlIGxheWVyIDIgdG9wb2xvZ3kgaW5mb3JtYXRpb24uIEFjY2VzcyB0 byB0aGUgaW5mb3JtYXRpb24gc2hvdWxkIGJlIHJlc3RyaWN0ZWQgdG8gYQ0KDQogICBtaW5pbWFs IGxpc3Qgb2YgYXV0aG9yaXplZCBjbGllbnRzLCBhbmQgc2hvdWxkIGFsc28gcmVxdWlyZSBwcm9w ZXIgYXV0aGVudGljYXRpb24gb2YgdGhlc2UgY2xpZW50cy4NCg0KDQoNCiAgIFRoZXJlIGFyZSBh IG51bWJlciBvZiBkYXRhIG5vZGVzIGRlZmluZWQgaW4gdGhpcyBZQU5HIG1vZHVsZSB0aGF0IGFy ZQ0KDQogICB3cml0YWJsZS9jcmVhdGFibGUvZGVsZXRhYmxlIChpLmUuLCBjb25maWcgdHJ1ZSwg d2hpY2ggaXMgdGhlDQoNCiAgIGRlZmF1bHQpLiAgVGhlc2UgZGF0YSBub2RlcyBtYXkgYmUgY29u c2lkZXJlZCBzZW5zaXRpdmUgb3IgdnVsbmVyYWJsZQ0KDQogICBpbiBzb21lIG5ldHdvcmsgZW52 aXJvbm1lbnRzLiAgV3JpdGUgb3BlcmF0aW9ucyAoZS5nLiwgZWRpdC1jb25maWcpDQoNCiAgIHRv IHRoZXNlIGRhdGEgbm9kZXMgd2l0aG91dCBwcm9wZXIgcHJvdGVjdGlvbiBjYW4gaGF2ZSBhIG5l Z2F0aXZlDQoNCiAgIGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMuICBUaGVzZSBhcmUgdGhl IHN1YnRyZWVzIGFuZCBkYXRhIG5vZGVzDQoNCiAgIGFuZCB0aGVpciBzZW5zaXRpdml0eS92dWxu ZXJhYmlsaXR5IGluIHRoZSBpZXRmLW5ldHdvcmsgbW9kdWxlOg0KDQoNCg0KICAgbyAgbDItbmV0 d29yay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0bw0KDQog ICAgICBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBhbnkgb2YgdGhlIGNvbnRhaW5lZCBh dHRyaWJ1dGVzLA0KDQogICAgICBzdWNoIGFzIHRoZSBuYW1lIG9yIHRoZSBmbGFnIGRhdGEgbm9k ZXMuDQoNCg0KDQogICBvICBsMi1ub2RlLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBj b3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlDQoNCiAgICAgIHRoZSBjb25maWd1cmF0aW9uIG9mIGlt cG9ydGFudCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG5hbWUNCg0KICAgICAgLHRoZSBt YW5hZ2VtZW50LWFkZHJlc3MsIG1hYy1hZGRyZXNzIG9mIHRoZSBkZXZpY2VzLg0KDQoNCg0KICAg byAgbDItbGluay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0 byBzYWJvdGFnZQ0KDQogICAgICB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBvcnRhbnQgbGluayBh dHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlDQoNCiAgICAgIG9yIHRoZSBkZWxheSBkYXRhIG5v ZGVzLg0KDQoNCg0KICAgbyAgbDItdGVybWluYXRpb24tcG9pbnQtYXR0cmlidXRlczogQSBtYWxp Y2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQNCg0KICAgICAgdG8gc2Fib3RhZ2UgdGhlIGNvbmZp Z3VyYXRpb24gb2YgaW1wb3J0YW50IHRlcm1pbmF0aW9uIHBvaW50DQoNCiAgICAgIGF0dHJpYnV0 ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUtc2l6ZSwgbWFjLWFkZHJlc3MuDQoNCiINCg0K VGhlIHF1ZXN0aW9uIGlzIGRvIHlvdSB0aGluayBwcm9wb3NhbCB3aXRoIHlhbmcgc2VjdXJpdHkg Ym9pbHRlcnBsYXRlIGhhcyBhbHJlYWR5IGFkZHJlc3NlZCB5b3VyIGNvbW1lbnRzDQoNCk9yIHlv dSB0aGluayB3ZSBzaG91bGQgZW1waGFzaXplIGhvdyBwcml2YWN5IGlzc3VlIGNhbiBiZSBhZGRy ZXNzZWQgYnkgTkFDTSBhbmQgY2xpZW50IGF1dGhlbnRpY2F0aW9uIGlzIG5lZWRlZD8NCg0KDQoN Ci1RaW4NCg0KLS0tLS3pgq7ku7bljp/ku7YtLS0tLQ0K5Y+R5Lu25Lq6OiBDaHJpc3RpYW4gSHVp dGVtYSBbbWFpbHRvOmh1aXRlbWFAaHVpdGVtYS5uZXRdDQrlj5HpgIHml7bpl7Q6IDIwMjDlubQ2 5pyIMjbml6UgMTI6MDUNCuaUtuS7tuS6ujogU3VzYW4gSGFyZXMgPHNoYXJlc0BuZHpoLmNvbT47 IFFpbiBXdSA8YmlsbC53dUBodWF3ZWkuY29tPjsgc2VjZGlyQGlldGYub3JnDQrmioTpgIE6IGky cnNAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxs QGlldGYub3JnOyBsYXN0LWNhbGxAaWV0Zi5vcmcNCuS4u+mimDogUmU6IFtMYXN0LUNhbGxdIFtp MnJzXSBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1u ZXR3b3JrLXRvcG9sb2d5LTEzDQoNCg0KDQpIb3cgYWJvdXQgYWRkaW5nIHNvbWV0aGluZyBsaWtl IHRoaXM6DQoNCg0KDQpQcml2YWN5IENvbnNpZGVyYXRpb25zDQoNCg0KDQpUaGUgWWFuZyBtb2Rl bCBmb3IgbGF5ZXIgMiB0b3BvbG9neSBleHBvc2VzIHByaXZhY3kgc2Vuc2l0aXZlIGluZm9ybWF0 aW9uLCBmb3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZiBkZXZpY2VzLiBVbnJlc3RyaWN0 ZWQgdXNlIG9mIHN1Y2ggaW5mb3JtYXRpb24gY2FuIGxlYWQgdG8gcHJpdmFjeSB2aW9sYXRpb25z LiBGb3IgZXhhbXBsZSwgbGlzdGluZyBNQUMgYWRkcmVzc2VzIGluIGEgbmV0d29yayBhbGxvd3Mg bW9uaXRvcmluZyBvZiBkZXZpY2VzIGFuZCB0aGVpciBtb3ZlbWVudHMuIExvY2F0aW9uIGluZm9y bWF0aW9uIGNhbiBiZSBkZXJpdmVkIGZyb20gTUFDIGFkZHJlc3NlcyBvZiBuZXR3b3JrIGRldmlj ZXMsIGJ5cGFzc2luZyBwcm90ZWN0aW9uIG9mIGxvY2F0aW9uIGluZm9ybWF0aW9uIGJ5IHRoZSBP cGVyYXRpbmcgU3lzdGVtLg0KDQoNCg0KRGVwbG95bWVudHMgc2hvdWxkIG1pdGlnYXRlIHRoaXMg cHJpdmFjeSBjb25jZXJucyBieSBsaW1pdGluZyBhY2Nlc3MgdG8gdGhlIGxheWVyIDIgdG9wb2xv Z3kgaW5mb3JtYXRpb24uIEFjY2VzcyB0byB0aGUgaW5mb3JtYXRpb24gc2hvdWxkIGJlIHJlc3Ry aWN0ZWQgdG8gYSBtaW5pbWFsIGxpc3Qgb2YgYXV0aG9yaXplZCBhZ2VudHMsIGFuZCBzaG91bGQg cmVxdWlyZSBwcm9wZXIgYXV0aGVudGljYXRpb24gb2YgdGhlc2UgYWdlbnRzLg0KDQoNCg0KLS0g Q2hyaXN0aWFuIEh1aXRlbWENCg0KDQoNCk9uIDYvMjUvMjAyMCA3OjAwIEFNLCBTdXNhbiBIYXJl cyB3cm90ZToNCg0KPiBRaW4gYW5kIENocmlzdGlhbjoNCg0KPg0KDQo+IFRoYW5rIHlvdSBmb3Ig eW91ciBwcm9tcHQgYXR0ZW50aW9uIHRvIHRoZSBwcml2YWN5IGlzc3VlLg0KDQo+IEknbSBzdXJl IENocmlzdGlhbiB3aWxsIHJlc3BvbmQgaW4gYSBiaXQgLSBzaW5jZSBoZSBtaWdodCBiZSBpbiBQ RFQgdGltZS16b25lLg0KDQo+DQoNCj4gT25jZSB5b3UgaGF2ZSBhIHNvbHV0aW9uIHlvdSBib3Ro IGxpa2UsIHdlIHNob3VsZCB2YWxpZGF0ZSB0aGUgcHJpdmFjeQ0KDQo+IGNoYW5nZXMgdG8gdGhl IHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIHNlY3Rpb24gd2l0aCB0aGUgWWFuZy1kb2N0b3JzLA0K DQo+IE9QUy1BRHMsIGFuZCBTZWN1cml0eS1BRHMuDQoNCj4NCg0KPiBNYXJ0aW4ncyB3YXRjaGlu ZyB0aGlzIHRocmVhZCBzbyBJJ20gc3VyZSBoZSdsbCBoZWxwIHVzIG91dCBhcyB3ZWxsLg0KDQo+ DQoNCj4gU3VlDQoNCj4NCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KDQo+IEZyb206 IGkycnMgW21haWx0bzppMnJzLWJvdW5jZXNAaWV0Zi5vcmddIE9uIEJlaGFsZiBPZiBRaW4gV3UN Cg0KPiBTZW50OiBUaHVyc2RheSwgSnVuZSAyNSwgMjAyMCA5OjI1IEFNDQoNCj4gVG86IFN1c2Fu IEhhcmVzOyAnQ2hyaXN0aWFuIEh1aXRlbWEnOyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2Rp ckBpZXRmLm9yZz4NCg0KPiBDYzogaTJyc0BpZXRmLm9yZzxtYWlsdG86aTJyc0BpZXRmLm9yZz47 DQoNCj4gZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5hbGxAaWV0Zi5v cmc8bWFpbHRvOmRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGll dGYub3JnPjsNCg0KPiBsYXN0LWNhbGxAaWV0Zi5vcmc8bWFpbHRvOmxhc3QtY2FsbEBpZXRmLm9y Zz4NCg0KPiBTdWJqZWN0OiBSZTogW2kycnNdIFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3IG9mDQoN Cj4gZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS0xMw0KDQo+DQoNCj4g U3VlIGFuZCBDaHJpc3RpYW46DQoNCj4gSSBoYXZlIHJlc3BvbmRlZCB0byBDaHJpc3RpYW4gb24g cHJpdmFjeSBpc3N1ZSwgbXkgcHJvcG9zYWwgaXMgdG8gYWRkIE1BQyBhZGRyZXNzIGFzIGFub3Ro ZXIgZGF0YSBub2RlIHZ1bG5lcmFiaWxpdHkgZXhhbXBsZSBpbiBvdXIgb3JpZ2luYWwgc2VjdXJp dHkgY29uc2lkZXJhdGlvbiBzZWN0aW9uLg0KDQo+IEJ1dCBJZiBDaHJpc3RpYW4gb3Igc2VjdXJp dHkgZGlyZWN0b3JhdGUgaGFzIHJlY29tbWVuZGluZyB0ZXh0LCB3ZSBhdXRob3JzIGFyZSBoYXBw eSB0byBhY2NlcHQgaXQuDQoNCj4NCg0KPiAtUWluDQoNCj4gLS0tLS3pgq7ku7bljp/ku7YtLS0t LQ0KDQo+IOWPkeS7tuS6ujogU3VzYW4gSGFyZXMgW21haWx0bzpzaGFyZXNAbmR6aC5jb21dDQoN Cj4g5Y+R6YCB5pe26Ze0OiAyMDIw5bm0NuaciDI15pelIDIxOjA0DQoNCj4g5pS25Lu25Lq6OiAn Q2hyaXN0aWFuIEh1aXRlbWEnIDxodWl0ZW1hQGh1aXRlbWEubmV0PG1haWx0bzpodWl0ZW1hQGh1 aXRlbWEubmV0Pj47IHNlY2RpckBpZXRmLm9yZzxtYWlsdG86c2VjZGlyQGlldGYub3JnPg0KDQo+ IOaKhOmAgTogZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5hbGxAaWV0 Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxs QGlldGYub3JnPjsNCg0KPiBpMnJzQGlldGYub3JnPG1haWx0bzppMnJzQGlldGYub3JnPjsgbGFz dC1jYWxsQGlldGYub3JnPG1haWx0bzpsYXN0LWNhbGxAaWV0Zi5vcmc+DQoNCj4g5Li76aKYOiBS RTogU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YNCg0KPiBkcmFmdC1pZXRmLWkycnMteWFuZy1s Mi1uZXR3b3JrLXRvcG9sb2d5LTEzDQoNCj4NCg0KPiBDaHJpc3RpYW46DQoNCj4NCg0KPiBUaGFu ayB5b3UgZm9yIGNhdGNoaW5nIHRoZSBwcml2YWN5IGlzc3Vlcy4NCg0KPg0KDQo+IEkndmUgZ290 IGEgZmV3IHF1ZXN0aW9ucyB0byBoZWxwIHRoZSBhdXRob3JzIHNjb3BlIHRoaXMgY2hhbmdlOg0K DQo+DQoNCj4gMSkgU2luY2UgdGhpcyBpcyBjb21tb24gdG8gYWxsIEwyIFRvcG9sb2dpZXMsIGNh biB5b3Ugb3IgdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlIHJlY29tbWVuZCBzb21lIHRleHQgdGhh dCBtaWdodCBiZSBhcHByb3ByaWF0ZT8NCg0KPiAgICBJZiB5b3UgaGF2ZSByZWNvbW1lbmRlZCB0 ZXh0LCBoYXMgdGhpcyB0ZXh0IGJlZW4gcmV2aWV3ZWQgYnkgT1BTLURJUiBhbmQgWWFuZyBkb2N0 b3JzPw0KDQo+DQoNCj4gMikgV2lsbCBpdCBiZSBhIHByb2JsZW0gSWYgd2Ugd3JpdGUgcHJpdmFj eSBjb25zaWRlcmF0aW9ucyBvbiBJRUVFIHNwZWNpZmljYXRpb25zPw0KDQo+IDMpIERvIHdlIG5l ZWQgdG8gY29uc2lkZXIgdGhlIHJhbmdlIG9mIGRlcGxveW1lbnRzIG9mIEwyIChob21lLA0KDQo+ IGVudGVycHJpc2UsICBwdWJsaWMgUEJCIHNlcnZpY2UsIG5hdGlvbmFsIFBCQiBzZXJ2aWNlLCBE YXRhIGNlbnRlcnMpDQoNCj4NCg0KPg0KDQo+IFRoYW5rIHlvdSwgIFN1ZQ0KDQo+DQoNCj4NCg0K PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KDQo+IEZyb206IENocmlzdGlhbiBIdWl0ZW1h IHZpYSBEYXRhdHJhY2tlciBbbWFpbHRvOm5vcmVwbHlAaWV0Zi5vcmddDQoNCj4gU2VudDogVGh1 cnNkYXksIEp1bmUgMjUsIDIwMjAgMTowMSBBTQ0KDQo+IFRvOiBzZWNkaXJAaWV0Zi5vcmc8bWFp bHRvOnNlY2RpckBpZXRmLm9yZz4NCg0KPiBDYzogZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0 d29yay10b3BvbG9neS5hbGxAaWV0Zi5vcmc8bWFpbHRvOmRyYWZ0LWlldGYtaTJycy15YW5nLWwy LW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3JnPjsNCg0KPiBpMnJzQGlldGYub3JnPG1haWx0 bzppMnJzQGlldGYub3JnPjsgbGFzdC1jYWxsQGlldGYub3JnPG1haWx0bzpsYXN0LWNhbGxAaWV0 Zi5vcmc+DQoNCj4gU3ViamVjdDogU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YNCg0KPiBkcmFm dC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LTEzDQoNCj4NCg0KPiBSZXZpZXdl cjogQ2hyaXN0aWFuIEh1aXRlbWENCg0KPiBSZXZpZXcgcmVzdWx0OiBIYXMgSXNzdWVzDQoNCj4N Cg0KPiBJIGhhdmUgcmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0 eSBkaXJlY3RvcmF0ZSdzIG9uZ29pbmcgZWZmb3J0IHRvIHJldmlldyBhbGwgSUVURiBkb2N1bWVu dHMgYmVpbmcgcHJvY2Vzc2VkIGJ5IHRoZSBJRVNHLiAgVGhlc2UgY29tbWVudHMgd2VyZSB3cml0 dGVuIHdpdGggdGhlIGludGVudCBvZiBpbXByb3Zpbmcgc2VjdXJpdHkgcmVxdWlyZW1lbnRzIGFu ZCBjb25zaWRlcmF0aW9ucyBpbiBJRVRGIGRyYWZ0cy4gIENvbW1lbnRzIG5vdCBhZGRyZXNzZWQg aW4gbGFzdCBjYWxsIG1heSBiZSBpbmNsdWRlZCBpbiBBRCByZXZpZXdzIGR1cmluZyB0aGUgSUVT RyByZXZpZXcuICBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0IHRo ZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLg0KDQo+ DQoNCj4gVGhpcyBkb2N1bWVudCBkZXNjcmliZXMgYSBZYW5nIG1vZGVsIGZvciByZXByZXNlbnRp bmcgTGluayBMYXllciB0b3BvbG9naWVzLg0KDQo+IFJlcHJlc2VudGluZyBzdWNoIHRvcG9sb2dp ZXMgaXMgb2J2aW91c2x5IHVzZWZ1bCBmb3IgbWFuYWdpbmcgbmV0d29yay4NCg0KPiBUaGUgc2Vj dXJpdHkgc2VjdGlvbiBpcyBmb2N1c2VkIG9uIHNlY3VyaW5nIHRoZSB1c2FnZSBvZiB0aGlzIGlu Zm9ybWF0aW9uIGZvciBuZXR3b3JrIG1hbmFnZW1lbnQsIGJ1dCBkb2VzIG5vdCBhZGRyZXNzIHBv dGVudGlhbCBwcml2YWN5IGlzc3Vlcy4NCg0KPg0KDQo+IFRoZSBzZWN1cml0eSBjb25zaWRlcmF0 aW9ucyBleHBsYWluIGNvcnJlY3RseSBob3cgYWx0ZXJpbmcgdGhlIGxpbmsgbGF5ZXIgaW5mb3Jt YXRpb24gY291bGQgZW5hYmxlIGF0dGFja3MgYWdhaW5zdCB0aGUgbmV0d29yay4gVGhlIHByb3Bv c2VkIHJlbWVkeSBpcyBhY2Nlc3MgY29udHJvbCwgaW1wbGVtZW50ZWQgdXNpbmcgZWl0aGVyIFNT SCBvciBUTFMuIFRoaXMgaXMgZmluZSwgYWx0aG91Z2ggdGhlIGRpc2N1c3Npb24gb2YgVExTIGF1 dGhvcmlzYXRpb24gaXMgYSBiaXQgc2hvcnQuIEJ5IGRlZmF1bHQsIFRMUyB2ZXJpZmllcyB0aGUg aWRlbnRpdHkgb2YgdGhlIHNlcnZlciBidXQgbm90IHRoYXQgb2YgdGhlIGNsaWVudC4gUkZDODA0 MCBzZWN0aW9uIDIuNSBzcGVjaWZpZXMgdGhhdCAiYSBSRVNUQ09ORiBzZXJ2ZXIgU0hPVUxEIHJl cXVpcmUgYXV0aGVudGljYXRpb24gYmFzZWQgb24gVExTIGNsaWVudCBjZXJ0aWZpY2F0ZXMuIEkg YXNzdW1lIHRoYXQncyB0aGUgaW50ZW50LCBidXQgaXQgbWlnaHQgYmUgdXNlZnVsIHRvIHNheSBz by4NCg0KPg0KDQo+IE9uIHRoZSBvdGhlciBoYW5kLCB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlv bnMgZG8gbm90IGRlc2NyaWJlIHByaXZhY3kgaXNzdWVzLCBhbmQgSSBmaW5kIHRoYXQgcHJvYmxl bWF0aWMuIFRoZSBwcm9wb3NlZCBpbmZvcm1hdGlvbiBtb2RlbCBsaXN0cyBhIG51bWJlciBvZiBz ZW5zaXRpdmUgZGF0YSwgc3VjaCBhcyBmb3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZiBk ZXZpY2VzLg0KDQo+IFRoaXMgaW5mb3JtYXRpb24gY2FuIGJlIG1pc3VzZWQuIEZvciBleGFtcGxl LCBhcHBsaWNhdGlvbnMgY291bGQgYXNzZXNzIGRldmljZSBsb2NhdGlvbiBmZXRjaGluZyB0aGUg TUFDIGFkZHJlc3NlcyBvZiBsb2NhbCBnYXRld2F5cy4gVGhpcmQgcGFydGllcyBjb3VsZCBhY2Nl c3MgbGluayBsb2NhbCBpbmZvcm1hdGlvbiB0byBnYXRoZXIgaWRlbnRpdGllcyBvZiBkZXZpY2Vz IGFjY2Vzc2luZyBhIHBhcnRpY3VsYXIgbmV0d29yay4gU3VjaCBpbmZvcm1hdGlvbiBpcyBvZnRl biBwcm90ZWN0ZWQgYnkgcHJpdmFjeSBBUEkgaW4gdGhlIE9wZXJhdGluZyBTeXN0ZW0sIGJ1dCBh Y2Nlc3NpbmcgdGhlIFlhbmcgbW9kdWxlIG92ZXIgdGhlIG5ldHdvcmsgbWlnaHQgYWxsb3cgYXBw bGljYXRpb25zIHRvIGJ5cGFzcyB0aGVzZSBjb250cm9scy4NCg0KPg0KDQo+IENsaWVudCBhdXRo ZW50aWNhdGlvbiBhbG9uZSBkb2VzIG5vdCBuZWNlc3NhcmlseSBwcm90ZWN0IGFnYWluc3QgdGhl c2UgcHJpdmFjeSBsZWFrcy4gQSBjbGFzc2ljIGNvbmZpZ3VyYXRpb24gZXJyb3Igd291bGQgbGlt aXQgd3JpdGUgYWNjZXNzIHRvIGF1dGhvcml6ZWQgdXNlcnMsIGJ1dCB0byBhbGxvdyByZWFkLW9u bHkgYWNjZXNzIHRvIG1vc3QgdXNlcnMuIFRoaXMga2luZCBvZiBlcnJvciB3b3VsZCBhbGxvdyBw cml2YWN5IGxlYWtzLiBHaXZlbiB0aGUgc2Vuc2l0aXZlIG5hdHVyZSBvZiBNQUMgYWRkcmVzc2Vz IGFuZCBvdGhlciBpZGVudGlmaWVycywgaXQgaXMgdXNlZnVsIHRvIHdhcm4gYWdhaW5zdCBzdWNo IGVycm9ycy4NCg0KPg0KDQo+DQoNCj4NCg0KPg0KDQo+DQoNCj4gX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18NCg0KPiBpMnJzIG1haWxpbmcgbGlzdA0KDQo+ IGkycnNAaWV0Zi5vcmc8bWFpbHRvOmkycnNAaWV0Zi5vcmc+DQoNCj4gaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pMnJzDQoNCj4NCg== --_000_B8F9A780D330094D99AF023C5877DABAAD7BCE5Ddggeml531mbschi_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 5a6L5L2TOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQOWui+S9kyI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0K cC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCgl0ZXh0LWFsaWduOmp1c3RpZnk7DQoJdGV4dC1qdXN0 aWZ5OmludGVyLWlkZW9ncmFwaDsNCglmb250LXNpemU6MTAuNXB0Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0 eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxl LXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGlu ZTt9DQpwLk1zb1BsYWluVGV4dCwgbGkuTXNvUGxhaW5UZXh0LCBkaXYuTXNvUGxhaW5UZXh0DQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoi57qv5paH5pysIENoYXIi Ow0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMC41 cHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5DaGFyDQoJe21z by1zdHlsZS1uYW1lOiLnuq/mlofmnKwgQ2hhciI7DQoJbXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0K CW1zby1zdHlsZS1saW5rOue6r+aWh+acrDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1z ZXJpZjt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglm b250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQovKiBQYWdlIERlZmluaXRpb25zICov DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcy LjBwdCA5MC4wcHQgNzIuMHB0IDkwLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29y ZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0 LWlkOjkzMzUwOTg4NzsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0 ZS1pZHM6LTEyMDI4MzExNTYgMTU2MDMwMjAxNiA2NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2 NzY5ODcxMyA2NzY5ODcxNSA2NzY5ODcwMyA2NzY5ODcxMyA2NzY5ODcxNTt9DQpAbGlzdCBsMDps ZXZlbDENCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjE4LjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30N CkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsN Cgltc28tbGV2ZWwtdGV4dDoiJTJcKSI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjQyLjBwdDsNCgl0ZXh0 LWluZGVudDotMjEuMHB0O30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZv cm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1sZWZ0OjYzLjBwdDsNCgl0ZXh0LWluZGVu dDotMjEuMHB0O30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsN Cgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6ODQuMHB0Ow0K CXRleHQtaW5kZW50Oi0yMS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1udW1i ZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10ZXh0OiIlNVwpIjsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFy Z2luLWxlZnQ6MTA1LjBwdDsNCgl0ZXh0LWluZGVudDotMjEuMHB0O30NCkBsaXN0IGwwOmxldmVs Ng0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1s ZWZ0OjEyNi4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTIxLjBwdDt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7 bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCW1hcmdpbi1sZWZ0OjE0Ny4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTIxLjBwdDt9DQpAbGlzdCBs MDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxl dmVsLXRleHQ6IiU4XCkiOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoxNjguMHB0Ow0KCXRleHQtaW5kZW50 Oi0yMS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJv bWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246cmlnaHQ7DQoJbWFyZ2luLWxlZnQ6MTg5LjBwdDsNCgl0ZXh0LWluZGVudDotMjEu MHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNt O30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRz IHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtp ZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFwZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1h cCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4NCjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRp Zl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9IlpILUNOIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0i Izk1NEY3MiIgc3R5bGU9InRleHQtanVzdGlmeS10cmltOnB1bmN0dWF0aW9uIj4NCjxkaXYgY2xh c3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+SGksIENocmlzdGlhbjo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MTguMHB0O3RleHQtaW5kZW50Oi0xOC4wcHQ7 bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFu Zz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjEuPHNwYW4gc3R5bGU9ImZv bnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBs YW5nPSJFTi1VUyI+TkFDTSBkZWZpbmVkIGluIFJGQzgzNDEgaGFzIGFscmVhZHkgcHJvdmlkZWQg bWVjaGFuaXNtcyB0byByZXN0cmljdCBhY2Nlc3MgdG8gc2Vuc2l0aXZlIGluZm9ybWF0aW9uIHRv IGEgbWluaW1hbCBsaXN0IG9mIGF1dGhvcml6ZWQgY2xpZW50IG9yIGFnZW50cyBhbmQgZGVhbCB3 aXRoIHByaXZhY3kgaXNzdWUgaWYgbXkgdW5kZXJzdGFuZGluZyBpcyBjb3JyZWN0LjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVm dDoxOC4wcHQ7dGV4dC1pbmRlbnQ6LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8 IVtpZiAhc3VwcG9ydExpc3RzXT48c3BhbiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1s aXN0Oklnbm9yZSI+Mi48c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9t YW4mcXVvdDsiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwv c3Bhbj48L3NwYW4+PCFbZW5kaWZdPjxzcGFuIGxhbmc9IkVOLVVTIj5Cb3RoIE5FVENPTkYgYW5k IFJFU1RDT05GIHdpbGwgcmVseSBvbiB0cmFuc3BvcnQgcHJvdG9jb2wgc3VjaCBhcyBUTFMgdG8g cHJvdmlkZSBjbGllbnQgYXV0aGVudGljYXRpb24gYW5kIHNlcnZlciBhdXRoZW50aWNhdGlvbiwg aS5lLiwgbXV0dWFsIGF1dGhlbnRpY2F0aW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJtYXJnaW4tbGVmdDoxOC4wcHQ7dGV4dC1pbmRlbnQ6 LTE4LjBwdDttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+DQo8IVtpZiAhc3VwcG9ydExpc3RzXT48 c3BhbiBsYW5nPSJFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9yZSI+My48c3BhbiBz dHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZd PjxzcGFuIGxhbmc9IkVOLVVTIj5UaGUgWUFORyBzZWN1cml0eSBndWlkZWxpbmUgZGVmaW5lZCBp biBodHRwczovL3RyYWMuaWV0Zi5vcmcvdHJhYy9vcHMvd2lraS95YW5nLXNlY3VyaXR5LWd1aWRl bGluZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHls ZT0idGV4dC1pbmRlbnQ6MjEuMHB0Ij48c3BhbiBsYW5nPSJFTi1VUyI+UHJvdmlkZSBwZXJmZWN0 IGJvaWxlcnBsYXRlIHRvIGFkZHJlc3MgYm90aCBzZWN1cml0eSBjb25zaWRlcmF0aW9uIGFuZCBw cml2YWN5IGNvbnNpZGVyYXRpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPk15IG9yaWdpbmFsIHByb3Bvc2FsIEEgdG8g YWRkcmVzcyB5b3VyIGNvbW1lbnRzIGlzOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5PTEQgVEVYVDo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+JnF1 b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBUaGVyZSBhcmUgYSBudW1iZXIgb2YgZGF0YSBub2Rl cyBkZWZpbmVkIGluIHRoaXMgWUFORyBtb2R1bGUgdGhhdCBhcmU8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7IHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVlLCB3aGlj aCBpcyB0aGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGRlZmF1bHQpLiZuYnNwOyBUaGVzZSBkYXRh IG5vZGVzIG1heSBiZSBjb25zaWRlcmVkIHNlbnNpdGl2ZSBvciB2dWxuZXJhYmxlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyBpbiBzb21lIG5ldHdvcmsgZW52aXJvbm1lbnRzLiZuYnNwOyBXcml0ZSBv cGVyYXRpb25zIChlLmcuLCBlZGl0LWNvbmZpZyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRvIHRo ZXNlIGRhdGEgbm9kZXMgd2l0aG91dCBwcm9wZXIgcHJvdGVjdGlvbiBjYW4gaGF2ZSBhIG5lZ2F0 aXZlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBlZmZlY3Qgb24gbmV0d29yayBvcGVyYXRpb25zLiZu YnNwOyBUaGVzZSBhcmUgdGhlIHN1YnRyZWVzIGFuZCBkYXRhIG5vZGVzPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OyZuYnNwOyBhbmQgdGhlaXIgc2Vuc2l0aXZpdHkvdnVsbmVyYWJpbGl0eSBpbiB0aGUgaWV0Zi1u ZXR3b3JrIG1vZHVsZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5i c3A7IGwyLW5ldHdvcmstYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVt cHQgdG88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHNhYm90YWdlIHRo ZSBjb25maWd1cmF0aW9uIG9mIGFueSBvZiB0aGUgY29udGFpbmVkIGF0dHJpYnV0ZXMsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBzdWNoIGFzIHRoZSBuYW1lIG9yIHRo ZSBmbGFnIGRhdGEgbm9kZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg byZuYnNwOyBsMi1ub2RlLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRl bXB0IHRvIHNhYm90YWdlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0 aGUgY29uZmlndXJhdGlvbiBvZiBpbXBvcnRhbnQgbm9kZSBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRo ZSBuYW1lPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvciB0aGUgbWFu YWdlbWVudC1hZGRyZXNzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG8m bmJzcDsgbDItbGluay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1w dCB0byBzYWJvdGFnZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdGhl IGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IGxpbmsgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUg cmF0ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgb3IgdGhlIGRlbGF5 IGRhdGEgbm9kZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNw OyBsMi10ZXJtaW5hdGlvbi1wb2ludC1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291 bGQgYXR0ZW1wdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdG8gc2Fi b3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IHRlcm1pbmF0aW9uIHBvaW50PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBhdHRyaWJ1dGVzLCBzdWNoIGFz IHRoZSBtYXhpbXVtLWZyYW1lLXNpemUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZxdW90OzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5ORVcgVEVY VDo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBUaGVyZSBhcmUgYSBudW1i ZXIgb2YgZGF0YSBub2RlcyBkZWZpbmVkIGluIHRoaXMgWUFORyBtb2R1bGUgdGhhdCBhcmU8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jm5ic3A7Jm5ic3A7IHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNv bmZpZyB0cnVlLCB3aGljaCBpcyB0aGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGRlZmF1bHQpLiZu YnNwOyBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBjb25zaWRlcmVkIHNlbnNpdGl2ZSBvciB2dWxu ZXJhYmxlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBpbiBzb21lIG5ldHdvcmsgZW52aXJvbm1lbnRz LiZuYnNwOyBXcml0ZSBvcGVyYXRpb25zIChlLmcuLCBlZGl0LWNvbmZpZyk8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7IHRvIHRoZXNlIGRhdGEgbm9kZXMgd2l0aG91dCBwcm9wZXIgcHJvdGVjdGlvbiBj YW4gaGF2ZSBhIG5lZ2F0aXZlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBlZmZlY3Qgb24gbmV0d29y ayBvcGVyYXRpb25zLiZuYnNwOyBUaGVzZSBhcmUgdGhlIHN1YnRyZWVzIGFuZCBkYXRhIG5vZGVz PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBhbmQgdGhlaXIgc2Vuc2l0aXZpdHkvdnVsbmVyYWJpbGl0 eSBpbiB0aGUgaWV0Zi1uZXR3b3JrIG1vZHVsZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOyZuYnNwOyBvJm5ic3A7IGwyLW5ldHdvcmstYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xp ZW50IGNvdWxkIGF0dGVtcHQgdG88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGFueSBvZiB0aGUgY29udGFpbmVkIGF0 dHJpYnV0ZXMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBzdWNoIGFz IHRoZSBuYW1lIG9yIHRoZSBmbGFnIGRhdGEgbm9kZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1ub2RlLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNs aWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBvcnRhbnQgbm9kZSBhdHRyaWJ1 dGVzLCBzdWNoIGFzIHRoZSBuYW1lPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyAsdGhlIG1hbmFnZW1lbnQtYWRkcmVzcyA8Yj5vciBtYWMgYWRkcmVzcyBvZiB0aGUgZGV2 aWNlczwvYj4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBs Mi1saW5rLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNh Ym90YWdlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGUgY29uZmln dXJhdGlvbiBvZiBpbXBvcnRhbnQgbGluayBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvciB0aGUgZGVsYXkgZGF0YSBu b2Rlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwO28mbmJzcDsgbDItdGVy bWluYXRpb24tcG9pbnQtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVt cHQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHRvIHNhYm90YWdlIHRo ZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCB0ZXJtaW5hdGlvbiBwb2ludDxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgbWF4 aW11bS1mcmFtZS1zaXplLA0KPGI+bWFjLWFkZHJlc3M8L2I+LjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mcXVvdDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPldpdGggeW91ciBwcm9wb3NlZCB0ZXh0LCB3ZSBjb3VsZCBo YXZlIHRoZSBmb2xsb3dpbmcgcHJvcG9zYWwgY2hhbmdlcyAoUHJvcG9zYWwgQik6PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi Pk9MRCBURVhUOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Ni4mbmJzcDsgU2VjdXJpdHkgQ29u c2lkZXJhdGlvbnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBUaGUgWUFO RyBtb2R1bGUgc3BlY2lmaWVkIGluIHRoaXMgZG9jdW1lbnQgZGVmaW5lcyBhIHNjaGVtYSBmb3Ig ZGF0YTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdGhhdCBpcyBkZXNpZ25lZCB0byBiZSBhY2Nlc3Nl ZCB2aWEgbmV0d29yayBtYW5hZ2VtZW50IHByb3RvY29scyBzdWNoPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyBhcyBORVRDT05GIFtSRkM2MjQxXSBvciBSRVNUQ09ORiBbUkZDODA0MF0uJm5ic3A7IFRo ZSBsb3dlc3QgTkVUQ09ORiBsYXllcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgaXMgdGhlIHNlY3Vy ZSB0cmFuc3BvcnQgbGF5ZXIsIGFuZCB0aGUgbWFuZGF0b3J5LXRvLWltcGxlbWVudCBzZWN1cmU8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRyYW5zcG9ydCBpcyBTZWN1cmUgU2hlbGwgKFNTSCkgW1JG QzYyNDJdLiZuYnNwOyBUaGUgbG93ZXN0IFJFU1RDT05GIGxheWVyPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyBpcyBIVFRQUywgYW5kIHRoZSBtYW5kYXRvcnktdG8taW1wbGVtZW50IHNlY3VyZSB0cmFu c3BvcnQgaXMgVExTPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBbUkZDODQ0Nl0uPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgVGhlIE5ldHdvcmsgQ29uZmlndXJhdGlvbiBBY2Nl c3MgQ29udHJvbCBNb2RlbCAoTkFDTSkgW1JGQzgzNDFdPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBw cm92aWRlcyB0aGUgbWVhbnMgdG8gcmVzdHJpY3QgYWNjZXNzIGZvciBwYXJ0aWN1bGFyIE5FVENP TkYgb3I8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBSRVNUQ09ORiB1c2Vy cyB0byBhIHByZWNvbmZpZ3VyZWQgc3Vic2V0IG9mIGFsbCBhdmFpbGFibGUgTkVUQ09ORiBvcjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDsmbmJzcDsgUkVTVENPTkYgcHJvdG9jb2wgb3BlcmF0aW9ucyBhbmQgY29u dGVudC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBJbiBnZW5lcmFsLCBM YXllciAyIG5ldHdvcmsgdG9wb2xvZ2llcyBhcmUgc3lzdGVtLWNvbnRyb2xsZWQgYW5kPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyBwcm92aWRlIGVwaGVtZXJhbCB0b3BvbG9neSBpbmZvcm1hdGlvbi4m bmJzcDsgSW4gYW4gTk1EQS1jb21wbGllbnQgc2VydmVyLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg dGhleSBhcmUgb25seSBwYXJ0IG9mICZsdDtvcGVyYXRpb25hbCZndDsgd2hpY2ggcHJvdmlkZXMg cmVhZC1vbmx5IGFjY2VzczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdG8gY2xpZW50cywgdGhleSBh cmUgbGVzcyB2dWxuZXJhYmxlLiZuYnNwOyBUaGF0IHNhaWQsIHRoZSBZQU5HIG1vZHVsZTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mbmJzcDsmbmJzcDsgZG9lcyBpbiBwcmluY2lwbGUgYWxsb3cgaW5mb3JtYXRpb24gdG8g YmUgY29uZmlndXJhYmxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFRo ZSBMYXllciAyIHRvcG9sb2d5IG1vZHVsZSBkZWZpbmUgaW5mb3JtYXRpb24gdGhhdCBjYW4gYmU8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGNvbmZpZ3VyYWJsZSBpbiBjZXJ0YWluIGluc3RhbmNlcywg Zm9yIGV4YW1wbGUgaW4gdGhlIGNhc2Ugb2YgdmlydHVhbDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg dG9wb2xvZ2llcyB0aGF0IGNhbiBiZSBjcmVhdGVkIGJ5IGNsaWVudCBhcHBsaWNhdGlvbnMuJm5i c3A7IEluIHN1Y2g8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGNhc2VzLCBhIG1hbGljaW91cyBjbGll bnQgY291bGQgaW50cm9kdWNlIHRvcG9sb2dpZXMgdGhhdCBhcmU8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7IHVuZGVzaXJlZC4mbmJzcDsgU3BlY2lmaWNhbGx5LCBhIG1hbGljaW91cyBjbGllbnQgY291 bGQgYXR0ZW1wdCB0byByZW1vdmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG9yIGFkZCBhIG5vZGUs IGEgbGluaywgYSB0ZXJtaW5hdGlvbiBwb2ludCwgYnkgY3JlYXRpbmcgb3IgZGVsZXRpbmc8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jm5ic3A7Jm5ic3A7IGNvcnJlc3BvbmRpbmcgZWxlbWVudHMgaW4gdGhlIG5vZGUsIGxp bmssIGFuZCB0ZXJtaW5hdGlvbiBwb2ludDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbGlzdHMsIHJl c3BlY3RpdmVseS4mbmJzcDsgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0aGF0IGlzIGxlYXJu ZWQsIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgc2VydmVyIHdpbGwgYXV0b21hdGljYWxseSBw cm9oaWJpdCBzdWNoIG1pc2NvbmZpZ3VyYXRpb24gYXR0ZW1wdHMuPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyBJbiB0aGUgY2FzZSBvZiBhIHRvcG9sb2d5IHRoYXQgaXMgY29uZmlndXJlZCwgaS5lLiB3 aG9zZSBvcmlnaW4gaXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7ICZxdW90O2ludGVuZGVkJnF1b3Q7 LCB0aGUgdW5kZXNpcmVkIGNvbmZpZ3VyYXRpb24gY291bGQgYmVjb21lIGVmZmVjdGl2ZSBhbmQg YmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHJlZmxlY3RlZCBpbiB0aGUgb3BlcmF0aW9uYWwgc3Rh dGUgZGF0YXN0b3JlLCBsZWFkaW5nIHRvIGRpc3J1cHRpb248bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7 IG9mIHNlcnZpY2VzIHByb3ZpZGVkIHZpYSB0aGlzIHRvcG9sb2d5IG1pZ2h0IGJlIGRpc3J1cHRl ZC4mbmJzcDsgRm9yIHRob3NlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyByZWFzb25zLCBpdCBpcyBp bXBvcnRhbnQgdGhhdCB0aGUgTkVUQ09ORiBhY2Nlc3MgY29udHJvbCBtb2RlbCBpczxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsmbmJzcDsgdmlnb3JvdXNseSBhcHBsaWVkIHRvIHByZXZlbnQgdG9wb2xvZ3kgbWlz Y29uZmlndXJhdGlvbiBieTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdW5hdXRob3JpemVkIGNsaWVu dHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgVGhlcmUgYXJlIGEgbnVt YmVyIG9mIGRhdGEgbm9kZXMgZGVmaW5lZCBpbiB0aGlzIFlBTkcgbW9kdWxlIHRoYXQgYXJlPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOyZuYnNwOyB3cml0YWJsZS9jcmVhdGFibGUvZGVsZXRhYmxlIChpLmUuLCBj b25maWcgdHJ1ZSwgd2hpY2ggaXMgdGhlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBkZWZhdWx0KS4m bmJzcDsgVGhlc2UgZGF0YSBub2RlcyBtYXkgYmUgY29uc2lkZXJlZCBzZW5zaXRpdmUgb3IgdnVs bmVyYWJsZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgaW4gc29tZSBuZXR3b3JrIGVudmlyb25tZW50 cy4mbmJzcDsgV3JpdGUgb3BlcmF0aW9ucyAoZS5nLiwgZWRpdC1jb25maWcpPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOyZuYnNwOyB0byB0aGVzZSBkYXRhIG5vZGVzIHdpdGhvdXQgcHJvcGVyIHByb3RlY3Rpb24g Y2FuIGhhdmUgYSBuZWdhdGl2ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgZWZmZWN0IG9uIG5ldHdv cmsgb3BlcmF0aW9ucy4mbmJzcDsgVGhlc2UgYXJlIHRoZSBzdWJ0cmVlcyBhbmQgZGF0YSBub2Rl czxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgYW5kIHRoZWlyIHNlbnNpdGl2aXR5L3Z1bG5lcmFiaWxp dHkgaW4gdGhlIGlldGYtbmV0d29yayBtb2R1bGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1uZXR3b3JrLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNs aWVudCBjb3VsZCBhdHRlbXB0IHRvPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOyBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBhbnkgb2YgdGhlIGNvbnRhaW5lZCBh dHRyaWJ1dGVzLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsgJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7c3VjaCBh cyB0aGUgbmFtZSBvciB0aGUgZmxhZyBkYXRhIG5vZGVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgbDItbm9kZS1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBj bGllbnQgY291bGQgYXR0ZW1wdCB0byBzYWJvdGFnZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IG5vZGUgYXR0cmli dXRlcywgc3VjaCBhcyB0aGUgbmFtZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsgb3IgdGhlIG1hbmFnZW1lbnQtYWRkcmVzcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLWxpbmstYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xp ZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBsaW5rIGF0dHJpYnV0 ZXMsIHN1Y2ggYXMgdGhlIHJhdGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IG9yIHRoZSBkZWxheSBkYXRhIG5vZGVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7IG8mbmJzcDsgbDItdGVybWluYXRpb24tcG9pbnQtYXR0cmlidXRlczogQSBtYWxp Y2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7IHRvIHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCB0ZXJt aW5hdGlvbiBwb2ludDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgYXR0 cmlidXRlcywgc3VjaCBhcyB0aGUgbWF4aW11bS1mcmFtZS1zaXplLjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mcXVvdDs8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+TkVXIFRFWFQ6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj42LiZuYnNwOyBTZWN1 cml0eSBDb25zaWRlcmF0aW9uczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7 IFRoZSBZQU5HIG1vZHVsZSBzcGVjaWZpZWQgaW4gdGhpcyBkb2N1bWVudCBkZWZpbmVzIGEgc2No ZW1hIGZvciBkYXRhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB0aGF0IGlzIGRlc2lnbmVkIHRvIGJl IGFjY2Vzc2VkIHZpYSBuZXR3b3JrIG1hbmFnZW1lbnQgcHJvdG9jb2xzIHN1Y2g8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IGFzIE5FVENPTkYgW1JGQzYyNDFdIG9yIFJFU1RDT05GIFtSRkM4MDQwXS4m bmJzcDsgVGhlIGxvd2VzdCBORVRDT05GIGxheWVyPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyAmbmJzcDtpcyB0 aGUgc2VjdXJlIHRyYW5zcG9ydCBsYXllciwgYW5kIHRoZSBtYW5kYXRvcnktdG8taW1wbGVtZW50 IHNlY3VyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdHJhbnNwb3J0IGlzIFNlY3VyZSBTaGVsbCAo U1NIKSBbUkZDNjI0Ml0uJm5ic3A7IFRoZSBsb3dlc3QgUkVTVENPTkYgbGF5ZXI8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IGlzIEhUVFBTLCBhbmQgdGhlIG1hbmRhdG9yeS10by1pbXBsZW1lbnQgc2Vj dXJlIHRyYW5zcG9ydCBpcyBUTFM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFtSRkM4NDQ2XS48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBUaGUgTmV0d29yayBDb25maWd1cmF0 aW9uIEFjY2VzcyBDb250cm9sIE1vZGVsIChOQUNNKSBbUkZDODM0MV08bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7 Jm5ic3A7IHByb3ZpZGVzIHRoZSBtZWFucyB0byByZXN0cmljdCBhY2Nlc3MgZm9yIHBhcnRpY3Vs YXIgTkVUQ09ORiBvcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgUkVTVENPTkYgdXNlcnMgdG8gYSBw cmVjb25maWd1cmVkIHN1YnNldCBvZiBhbGwgYXZhaWxhYmxlIE5FVENPTkYgb3I8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IFJFU1RDT05GIHByb3RvY29sIG9wZXJhdGlvbnMgYW5kIGNvbnRlbnQuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgSW4gZ2VuZXJhbCwgTGF5ZXIgMiBu ZXR3b3JrIHRvcG9sb2dpZXMgYXJlIHN5c3RlbS1jb250cm9sbGVkIGFuZDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDsmbmJzcDsgcHJvdmlkZSBlcGhlbWVyYWwgdG9wb2xvZ3kgaW5mb3JtYXRpb24uJm5ic3A7IElu IGFuIE5NREEtY29tcGxpZW50IHNlcnZlciw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRoZXkgYXJl IG9ubHkgcGFydCBvZiAmbHQ7b3BlcmF0aW9uYWwmZ3Q7IHdoaWNoIHByb3ZpZGVzIHJlYWQtb25s eSBhY2Nlc3M8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRvIGNsaWVudHMsIHRoZXkgYXJlIGxlc3Mg dnVsbmVyYWJsZS4mbmJzcDsgVGhhdCBzYWlkLCB0aGUgWUFORyBtb2R1bGU8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7IGRvZXMgaW4gcHJpbmNpcGxlIGFsbG93IGluZm9ybWF0aW9uIHRvIGJlIGNvbmZp Z3VyYWJsZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBUaGUgTGF5ZXIg MiB0b3BvbG9neSBtb2R1bGUgZGVmaW5lIGluZm9ybWF0aW9uIHRoYXQgY2FuIGJlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyBjb25maWd1cmFibGUgaW4gY2VydGFpbiBpbnN0YW5jZXMsIGZvciBleGFt cGxlIGluIHRoZSBjYXNlIG9mIHZpcnR1YWw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRvcG9sb2dp ZXMgdGhhdCBjYW4gYmUgY3JlYXRlZCBieSBjbGllbnQgYXBwbGljYXRpb25zLiZuYnNwOyBJbiBz dWNoPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBjYXNlcywgYSBtYWxpY2lvdXMgY2xpZW50IGNvdWxk IGludHJvZHVjZSB0b3BvbG9naWVzIHRoYXQgYXJlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB1bmRl c2lyZWQuJm5ic3A7IFNwZWNpZmljYWxseSwgYSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVt cHQgdG8gcmVtb3ZlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvciBhZGQgYSBub2RlLCBhIGxpbmss IGEgdGVybWluYXRpb24gcG9pbnQsIGJ5IGNyZWF0aW5nIG9yIGRlbGV0aW5nPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOyZuYnNwOyBjb3JyZXNwb25kaW5nIGVsZW1lbnRzIGluIHRoZSBub2RlLCBsaW5rLCBhbmQg dGVybWluYXRpb24gcG9pbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGxpc3RzLCByZXNwZWN0aXZl bHkuJm5ic3A7IEluIHRoZSBjYXNlIG9mIGEgdG9wb2xvZ3kgdGhhdCBpcyBsZWFybmVkLCB0aGU8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHNlcnZlciB3aWxsIGF1dG9tYXRpY2FsbHkgcHJvaGliaXQg c3VjaCBtaXNjb25maWd1cmF0aW9uIGF0dGVtcHRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgSW4g dGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0aGF0IGlzIGNvbmZpZ3VyZWQsIGkuZS4gd2hvc2Ugb3Jp Z2luIGlzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyAmcXVvdDtpbnRlbmRlZCZxdW90OywgdGhlIHVu ZGVzaXJlZCBjb25maWd1cmF0aW9uIGNvdWxkIGJlY29tZSBlZmZlY3RpdmUgYW5kIGJlPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyByZWZsZWN0ZWQgaW4gdGhlIG9wZXJhdGlvbmFsIHN0YXRlIGRhdGFz dG9yZSwgbGVhZGluZyB0byBkaXNydXB0aW9uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvZiBzZXJ2 aWNlcyBwcm92aWRlZCB2aWEgdGhpcyB0b3BvbG9neSBtaWdodCBiZSBkaXNydXB0ZWQuJm5ic3A7 IEZvciB0aG9zZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgcmVhc29ucywgaXQgaXMgaW1wb3J0YW50 IHRoYXQgdGhlIE5FVENPTkYgYWNjZXNzIGNvbnRyb2wgbW9kZWwgaXM8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7 Jm5ic3A7IHZpZ29yb3VzbHkgYXBwbGllZCB0byBwcmV2ZW50IHRvcG9sb2d5IG1pc2NvbmZpZ3Vy YXRpb24gYnk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHVuYXV0aG9yaXplZCBjbGllbnRzLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7IFRoZSBZQU5HIG1vZGVsIGZvciBsYXllciAy IHRvcG9sb2d5IG1heSBleHBvc2Ugc2Vuc2l0aXZlIGluZm9ybWF0aW9uLA0KPG86cD48L286cD48 L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxiPjxzcGFuIGxhbmc9IkVO LVVTIj4mbmJzcDsmbmJzcDtmb3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZiBkZXZpY2Vz LiBVbnJlc3RyaWN0ZWQgdXNlIG9mIHN1Y2ggaW5mb3JtYXRpb24NCjxvOnA+PC9vOnA+PC9zcGFu PjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Y2FuIGxlYWQgdG8gcHJpdmFjeSB2aW9sYXRpb25zLiBGb3IgZXhh bXBsZSwgbGlzdGluZyBNQUMgYWRkcmVzc2VzIGluIGEgbmV0d29yaw0KPG86cD48L286cD48L3Nw YW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsmbmJzcDsmbmJzcDthbGxvd3MgbW9uaXRvcmluZyBvZiBkZXZpY2VzIGFuZCB0aGVp ciBtb3ZlbWVudHMuIExvY2F0aW9uIGluZm9ybWF0aW9uIGNhbiBiZSBkZXJpdmVkPG86cD48L286 cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDsgJm5ic3A7ZnJvbSBNQUMgYWRkcmVzc2VzIG9mIG5ldHdvcmsgZGV2aWNl cywgYnlwYXNzaW5nIHByb3RlY3Rpb24gb2YgbG9jYXRpb24gaW5mb3JtYXRpb24gYnkNCjxvOnA+ PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7dGhlIE9wZXJhdGluZyBTeXN0ZW0uIERlcGxv eW1lbnRzIHNob3VsZCBtaXRpZ2F0ZSB0aGlzIHByaXZhY3kgY29uY2VybnMgYnkgbGltaXRpbmcg YWNjZXNzDQo8bzpwPjwvbzpwPjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwO3RvIHRoZSBsYXllciAy IHRvcG9sb2d5IGluZm9ybWF0aW9uLiBBY2Nlc3MgdG8gdGhlIGluZm9ybWF0aW9uIHNob3VsZCBi ZSByZXN0cmljdGVkIHRvIGENCjxvOnA+PC9vOnA+PC9zcGFuPjwvYj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7bWlu aW1hbCBsaXN0IG9mIGF1dGhvcml6ZWQgY2xpZW50cywgYW5kIHNob3VsZCBhbHNvIHJlcXVpcmUg cHJvcGVyIGF1dGhlbnRpY2F0aW9uIG9mIHRoZXNlIGNsaWVudHMuPG86cD48L286cD48L3NwYW4+ PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpw PiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFRoZXJlIGFyZSBhIG51bWJlciBvZiBkYXRhIG5vZGVz IGRlZmluZWQgaW4gdGhpcyBZQU5HIG1vZHVsZSB0aGF0IGFyZTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJz cDsgd3JpdGFibGUvY3JlYXRhYmxlL2RlbGV0YWJsZSAoaS5lLiwgY29uZmlnIHRydWUsIHdoaWNo IGlzIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgZGVmYXVsdCkuJm5ic3A7IFRoZXNlIGRhdGEg bm9kZXMgbWF5IGJlIGNvbnNpZGVyZWQgc2Vuc2l0aXZlIG9yIHZ1bG5lcmFibGU8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IGluIHNvbWUgbmV0d29yayBlbnZpcm9ubWVudHMuJm5ic3A7IFdyaXRlIG9w ZXJhdGlvbnMgKGUuZy4sIGVkaXQtY29uZmlnKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdG8gdGhl c2UgZGF0YSBub2RlcyB3aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEgbmVnYXRp dmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMuJm5i c3A7IFRoZXNlIGFyZSB0aGUgc3VidHJlZXMgYW5kIGRhdGEgbm9kZXM8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7 Jm5ic3A7IGFuZCB0aGVpciBzZW5zaXRpdml0eS92dWxuZXJhYmlsaXR5IGluIHRoZSBpZXRmLW5l dHdvcmsgbW9kdWxlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG8mbmJz cDsgbDItbmV0d29yay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1w dCB0bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgc2Fib3RhZ2UgdGhl IGNvbmZpZ3VyYXRpb24gb2YgYW55IG9mIHRoZSBjb250YWluZWQgYXR0cmlidXRlcyw8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhl IGZsYWcgZGF0YSBub2Rlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBv Jm5ic3A7IGwyLW5vZGUtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVt cHQgdG8gc2Fib3RhZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHRo ZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhl IG5hbWU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICx0aGUgbWFuYWdl bWVudC1hZGRyZXNzLCA8Yj5tYWMtYWRkcmVzcyBvZiB0aGUgZGV2aWNlczwvYj4uPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1saW5rLWF0dHJpYnV0ZXM6 IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBvcnRh bnQgbGluayBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyBvciB0aGUgZGVsYXkgZGF0YSBub2Rlcy48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLXRlcm1pbmF0aW9uLXBvaW50LWF0 dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0byBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBv ZiBpbXBvcnRhbnQgdGVybWluYXRpb24gcG9pbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7IGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUtc2l6ZSwN CjxiPm1hYy1hZGRyZXNzPC9iPi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBxdWVzdGlv biBpcyBkbyB5b3UgdGhpbmsgcHJvcG9zYWwgd2l0aCB5YW5nIHNlY3VyaXR5IGJvaWx0ZXJwbGF0 ZSBoYXMgYWxyZWFkeSBhZGRyZXNzZWQgeW91ciBjb21tZW50czxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5PciB5b3UgdGhp bmsgd2Ugc2hvdWxkIGVtcGhhc2l6ZSBob3cgcHJpdmFjeSBpc3N1ZSBjYW4gYmUgYWRkcmVzc2Vk IGJ5IE5BQ00gYW5kIGNsaWVudCBhdXRoZW50aWNhdGlvbiBpcyBuZWVkZWQ/PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4tUWluPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPi0tLS0tPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250 LWZhbWlseTrlrovkvZMiPumCruS7tuWOn+S7tjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+LS0t LS08YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5Y+R5Lu25Lq6 PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj46IENocmlzdGlhbiBIdWl0ZW1hIFttYWlsdG86aHVp dGVtYUBodWl0ZW1hLm5ldF0NCjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 5a6L5L2TIj7lj5HpgIHml7bpl7Q8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjogMjAyMDwvc3Bh bj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L5L2TIj7lubQ8L3NwYW4+PHNwYW4gbGFuZz0i RU4tVVMiPjY8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5pyIPC9zcGFu PjxzcGFuIGxhbmc9IkVOLVVTIj4yNjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L 5L2TIj7ml6U8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPg0KIDEyOjA1PGJyPg0KPC9zcGFuPjxz cGFuIHN0eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuaUtuS7tuS6ujwvc3Bhbj48c3BhbiBsYW5n PSJFTi1VUyI+OiBTdXNhbiBIYXJlcyAmbHQ7c2hhcmVzQG5kemguY29tJmd0OzsgUWluIFd1ICZs dDtiaWxsLnd1QGh1YXdlaS5jb20mZ3Q7OyBzZWNkaXJAaWV0Zi5vcmc8YnI+DQo8L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5oqE6YCBPC9zcGFuPjxzcGFuIGxhbmc9IkVO LVVTIj46IGkycnNAaWV0Zi5vcmc7IGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9w b2xvZ3kuYWxsQGlldGYub3JnOyBsYXN0LWNhbGxAaWV0Zi5vcmc8YnI+DQo8L3NwYW4+PHNwYW4g c3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5Li76aKYPC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVT Ij46IFJlOiBbTGFzdC1DYWxsXSBbaTJyc10gU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YgZHJh ZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS0xMzwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPkhv dyBhYm91dCBhZGRpbmcgc29tZXRoaW5nIGxpa2UgdGhpczo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPlByaXZhY3kgQ29uc2lkZXJhdGlvbnM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBZ YW5nIG1vZGVsIGZvciBsYXllciAyIHRvcG9sb2d5IGV4cG9zZXMgcHJpdmFjeSBzZW5zaXRpdmUg aW5mb3JtYXRpb24sIGZvciBleGFtcGxlIHRoZSBNQUMgYWRkcmVzc2VzIG9mIGRldmljZXMuIFVu cmVzdHJpY3RlZCB1c2Ugb2Ygc3VjaCBpbmZvcm1hdGlvbiBjYW4gbGVhZCB0byBwcml2YWN5IHZp b2xhdGlvbnMuIEZvciBleGFtcGxlLCBsaXN0aW5nIE1BQyBhZGRyZXNzZXMNCiBpbiBhIG5ldHdv cmsgYWxsb3dzIG1vbml0b3Jpbmcgb2YgZGV2aWNlcyBhbmQgdGhlaXIgbW92ZW1lbnRzLiBMb2Nh dGlvbiBpbmZvcm1hdGlvbiBjYW4gYmUgZGVyaXZlZCBmcm9tIE1BQyBhZGRyZXNzZXMgb2YgbmV0 d29yayBkZXZpY2VzLCBieXBhc3NpbmcgcHJvdGVjdGlvbiBvZiBsb2NhdGlvbiBpbmZvcm1hdGlv biBieSB0aGUgT3BlcmF0aW5nIFN5c3RlbS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPkRlcGxv eW1lbnRzIHNob3VsZCBtaXRpZ2F0ZSB0aGlzIHByaXZhY3kgY29uY2VybnMgYnkgbGltaXRpbmcg YWNjZXNzIHRvIHRoZSBsYXllciAyIHRvcG9sb2d5IGluZm9ybWF0aW9uLiBBY2Nlc3MgdG8gdGhl IGluZm9ybWF0aW9uIHNob3VsZCBiZSByZXN0cmljdGVkIHRvIGEgbWluaW1hbCBsaXN0IG9mIGF1 dGhvcml6ZWQgYWdlbnRzLCBhbmQgc2hvdWxkIHJlcXVpcmUgcHJvcGVyDQogYXV0aGVudGljYXRp b24gb2YgdGhlc2UgYWdlbnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+LS0gQ2hyaXN0aWFu IEh1aXRlbWE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPk9uIDYvMjUvMjAyMCA3OjAwIEFNLCBT dXNhbiBIYXJlcyB3cm90ZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBRaW4gYW5kIENocmlzdGlhbjogPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBUaGFuayB5b3UgZm9yIHlvdXIgcHJvbXB0IGF0 dGVudGlvbiB0byB0aGUgcHJpdmFjeSBpc3N1ZS4mbmJzcDsNCjxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IEknbSBz dXJlIENocmlzdGlhbiB3aWxsIHJlc3BvbmQgaW4gYSBiaXQgLSBzaW5jZSBoZSBtaWdodCBiZSBp biBQRFQgdGltZS16b25lLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBPbmNl IHlvdSBoYXZlIGEgc29sdXRpb24geW91IGJvdGggbGlrZSwgd2Ugc2hvdWxkIHZhbGlkYXRlIHRo ZSBwcml2YWN5DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBjaGFuZ2VzIHRvIHRoZSBzZWN1cml0eSBjb25zaWRl cmF0aW9ucyBzZWN0aW9uIHdpdGggdGhlIFlhbmctZG9jdG9ycywNCjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IE9Q Uy1BRHMsIGFuZCBTZWN1cml0eS1BRHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0 OyBNYXJ0aW4ncyB3YXRjaGluZyB0aGlzIHRocmVhZCBzbyBJJ20gc3VyZSBoZSdsbCBoZWxwIHVz IG91dCBhcyB3ZWxsLg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBTdWU8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0t PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZndDsgRnJvbTogaTJycyBbPGEgaHJlZj0ibWFpbHRvOmkycnMtYm91bmNlc0Bp ZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPm1haWx0bzppMnJzLWJvdW5jZXNAaWV0Zi5vcmc8L3NwYW4+PC9hPl0gT24gQmVoYWxmIE9m IFFpbiBXdTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFNlbnQ6IFRodXJzZGF5LCBKdW5lIDI1LCAyMDIwIDk6MjUg QU08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jmd0OyBUbzogU3VzYW4gSGFyZXM7ICdDaHJpc3RpYW4gSHVpdGVtYSc7DQo8 YSBocmVmPSJtYWlsdG86c2VjZGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+c2VjZGlyQGlldGYub3JnPC9zcGFuPjwvYT48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jmd0OyBDYzogPGEgaHJlZj0ibWFpbHRvOmkycnNAaWV0Zi5vcmciPjxzcGFuIHN0eWxl PSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5pMnJzQGlldGYub3JnPC9z cGFuPjwvYT47DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyA8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pMnJz LXlhbmctbDItbmV0d29yay10b3BvbG9neS5hbGxAaWV0Zi5vcmciPg0KPHNwYW4gc3R5bGU9ImNv bG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmRyYWZ0LWlldGYtaTJycy15YW5n LWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3JnPC9zcGFuPjwvYT47DQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jmd0OyA8YSBocmVmPSJtYWlsdG86bGFzdC1jYWxsQGlldGYub3JnIj4NCjxzcGFuIHN0eWxlPSJj b2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5sYXN0LWNhbGxAaWV0Zi5vcmc8 L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFN1YmplY3Q6IFJlOiBbaTJyc10gU2VjZGlyIGxhc3Qg Y2FsbCByZXZpZXcgb2YNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5l dHdvcmstdG9wb2xvZ3ktMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFN1ZSBh bmQgQ2hyaXN0aWFuOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IEkgaGF2ZSByZXNwb25kZWQgdG8gQ2hyaXN0aWFu IG9uIHByaXZhY3kgaXNzdWUsIG15IHByb3Bvc2FsIGlzIHRvIGFkZCBNQUMgYWRkcmVzcyBhcyBh bm90aGVyIGRhdGEgbm9kZSB2dWxuZXJhYmlsaXR5IGV4YW1wbGUgaW4gb3VyIG9yaWdpbmFsIHNl Y3VyaXR5IGNvbnNpZGVyYXRpb24gc2VjdGlvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBCdXQgSWYgQ2hyaXN0 aWFuIG9yIHNlY3VyaXR5IGRpcmVjdG9yYXRlIGhhcyByZWNvbW1lbmRpbmcgdGV4dCwgd2UgYXV0 aG9ycyBhcmUgaGFwcHkgdG8gYWNjZXB0IGl0LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZndDsgLVFpbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IC0tLS0tPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTrlrovkvZMiPumCruS7tuWOn+S7tjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+LS0tLS08 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jmd0OyA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5Y+R 5Lu25Lq6PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj46IFN1c2FuIEhhcmVzIFs8YSBocmVmPSJt YWlsdG86c2hhcmVzQG5kemguY29tIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0 LWRlY29yYXRpb246bm9uZSI+bWFpbHRvOnNoYXJlc0BuZHpoLmNvbTwvc3Bhbj48L2E+XTxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mZ3Q7IDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L5L2TIj7lj5HpgIHm l7bpl7Q8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjogMjAyMDwvc3Bhbj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk65a6L5L2TIj7lubQ8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjY8L3NwYW4+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5pyIPC9zcGFuPjxzcGFuIGxhbmc9IkVO LVVTIj4yNTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L5L2TIj7ml6U8L3NwYW4+ PHNwYW4gbGFuZz0iRU4tVVMiPg0KIDIxOjA0PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuaUtuS7tuS6ujwvc3Bhbj48c3BhbiBsYW5nPSJFTi1V UyI+OiAnQ2hyaXN0aWFuIEh1aXRlbWEnICZsdDs8YSBocmVmPSJtYWlsdG86aHVpdGVtYUBodWl0 ZW1hLm5ldCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPmh1aXRlbWFAaHVpdGVtYS5uZXQ8L3NwYW4+PC9hPiZndDs7DQo8YSBocmVmPSJtYWlsdG86 c2VjZGlyQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29y YXRpb246bm9uZSI+c2VjZGlyQGlldGYub3JnPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyA8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5oqE6YCBPC9zcGFuPjxzcGFuIGxh bmc9IkVOLVVTIj46DQo8YSBocmVmPSJtYWlsdG86ZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0 d29yay10b3BvbG9neS5hbGxAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0 O3RleHQtZGVjb3JhdGlvbjpub25lIj5kcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRv cG9sb2d5LmFsbEBpZXRmLm9yZzwvc3Bhbj48L2E+Ow0KPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgPGEgaHJlZj0i bWFpbHRvOmkycnNAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQt ZGVjb3JhdGlvbjpub25lIj5pMnJzQGlldGYub3JnPC9zcGFuPjwvYT47DQo8YSBocmVmPSJtYWls dG86bGFzdC1jYWxsQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0 LWRlY29yYXRpb246bm9uZSI+bGFzdC1jYWxsQGlldGYub3JnPC9zcGFuPjwvYT48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jmd0OyA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5Li76aKYPC9zcGFu PjxzcGFuIGxhbmc9IkVOLVVTIj46IFJFOiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZg0KPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZndDsgZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS0xMzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgQ2hyaXN0aWFuOjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7 PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZndDsgVGhhbmsgeW91IGZvciBjYXRjaGluZyB0aGUgcHJpdmFjeSBp c3N1ZXMuJm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mZ3Q7IEkndmUgZ290IGEgZmV3IHF1ZXN0aW9ucyB0byBoZWxwIHRoZSBhdXRo b3JzIHNjb3BlIHRoaXMgY2hhbmdlOg0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0 OyAxKSBTaW5jZSB0aGlzIGlzIGNvbW1vbiB0byBhbGwgTDIgVG9wb2xvZ2llcywgY2FuIHlvdSBv ciB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmVjb21tZW5kIHNvbWUgdGV4dCB0aGF0IG1pZ2h0 IGJlIGFwcHJvcHJpYXRlPw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgJm5ic3A7Jm5ic3A7Jm5ic3A7SWYgeW91 IGhhdmUgcmVjb21tZW5kZWQgdGV4dCwgaGFzIHRoaXMgdGV4dCBiZWVuIHJldmlld2VkIGJ5IE9Q Uy1ESVIgYW5kIFlhbmcgZG9jdG9ycz8NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZn dDsgMikgV2lsbCBpdCBiZSBhIHByb2JsZW0gSWYgd2Ugd3JpdGUgcHJpdmFjeSBjb25zaWRlcmF0 aW9ucyBvbiBJRUVFIHNwZWNpZmljYXRpb25zPw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgMykgRG8gd2UgbmVl ZCB0byBjb25zaWRlciB0aGUgcmFuZ2Ugb2YgZGVwbG95bWVudHMgb2YgTDIgKGhvbWUsDQo8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jmd0OyBlbnRlcnByaXNlLCZuYnNwOyBwdWJsaWMgUEJCIHNlcnZpY2UsIG5hdGlvbmFs IFBCQiBzZXJ2aWNlLCBEYXRhIGNlbnRlcnMpPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZuYnNwOzwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFRoYW5rIHlvdSwmbmJzcDsgU3VlPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZn dDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IC0tLS0tT3JpZ2luYWwg TWVzc2FnZS0tLS0tPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgRnJvbTogQ2hyaXN0aWFuIEh1aXRlbWEgdmlhIERh dGF0cmFja2VyIFs8YSBocmVmPSJtYWlsdG86bm9yZXBseUBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPm1haWx0bzpub3JlcGx5QGll dGYub3JnPC9zcGFuPjwvYT5dPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgU2VudDogVGh1cnNkYXksIEp1bmUgMjUs IDIwMjAgMTowMSBBTTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFRvOiA8YSBocmVmPSJtYWlsdG86c2VjZGlyQGll dGYub3JnIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpu b25lIj5zZWNkaXJAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IENjOiA8YSBocmVm PSJtYWlsdG86ZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5hbGxAaWV0 Zi5vcmciPg0KPHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5v bmUiPmRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3Jn PC9zcGFuPjwvYT47DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyA8YSBocmVmPSJtYWlsdG86aTJyc0BpZXRmLm9y ZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmky cnNAaWV0Zi5vcmc8L3NwYW4+PC9hPjsNCjxhIGhyZWY9Im1haWx0bzpsYXN0LWNhbGxAaWV0Zi5v cmciPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5s YXN0LWNhbGxAaWV0Zi5vcmc8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFN1YmplY3Q6IFNlY2Rp ciBsYXN0IGNhbGwgcmV2aWV3IG9mIDxvOnA+DQo8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgZHJhZnQtaWV0Zi1pMnJzLXlh bmctbDItbmV0d29yay10b3BvbG9neS0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZn dDsgUmV2aWV3ZXI6IENocmlzdGlhbiBIdWl0ZW1hPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgUmV2aWV3IHJlc3Vs dDogSGFzIElzc3VlczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgSSBoYXZlIHJl dmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUn cyBvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHByb2Nl c3NlZCBieSB0aGUgSUVTRy4mbmJzcDsgVGhlc2UgY29tbWVudHMgd2VyZSB3cml0dGVuIHdpdGgg dGhlIGludGVudCBvZiBpbXByb3Zpbmcgc2VjdXJpdHkgcmVxdWlyZW1lbnRzDQogYW5kIGNvbnNp ZGVyYXRpb25zIGluIElFVEYgZHJhZnRzLiZuYnNwOyBDb21tZW50cyBub3QgYWRkcmVzc2VkIGlu IGxhc3QgY2FsbCBtYXkgYmUgaW5jbHVkZWQgaW4gQUQgcmV2aWV3cyBkdXJpbmcgdGhlIElFU0cg cmV2aWV3LiZuYnNwOyBEb2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0 IHRoZXNlIGNvbW1lbnRzIGp1c3QgbGlrZSBhbnkgb3RoZXIgbGFzdCBjYWxsIGNvbW1lbnRzLjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgVGhpcyBkb2N1bWVudCBkZXNjcmliZXMg YSBZYW5nIG1vZGVsIGZvciByZXByZXNlbnRpbmcgTGluayBMYXllciB0b3BvbG9naWVzLjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mZ3Q7IFJlcHJlc2VudGluZyBzdWNoIHRvcG9sb2dpZXMgaXMgb2J2aW91c2x5IHVzZWZ1 bCBmb3IgbWFuYWdpbmcgbmV0d29yay48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBUaGUgc2VjdXJpdHkgc2VjdGlv biBpcyBmb2N1c2VkIG9uIHNlY3VyaW5nIHRoZSB1c2FnZSBvZiB0aGlzIGluZm9ybWF0aW9uIGZv ciBuZXR3b3JrIG1hbmFnZW1lbnQsIGJ1dCBkb2VzIG5vdCBhZGRyZXNzIHBvdGVudGlhbCBwcml2 YWN5IGlzc3Vlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFRoZSBzZWN1cml0 eSBjb25zaWRlcmF0aW9ucyBleHBsYWluIGNvcnJlY3RseSBob3cgYWx0ZXJpbmcgdGhlIGxpbmsg bGF5ZXIgaW5mb3JtYXRpb24gY291bGQgZW5hYmxlIGF0dGFja3MgYWdhaW5zdCB0aGUgbmV0d29y ay4gVGhlIHByb3Bvc2VkIHJlbWVkeSBpcyBhY2Nlc3MgY29udHJvbCwgaW1wbGVtZW50ZWQgdXNp bmcgZWl0aGVyIFNTSCBvciBUTFMuIFRoaXMgaXMNCiBmaW5lLCBhbHRob3VnaCB0aGUgZGlzY3Vz c2lvbiBvZiBUTFMgYXV0aG9yaXNhdGlvbiBpcyBhIGJpdCBzaG9ydC4gQnkgZGVmYXVsdCwgVExT IHZlcmlmaWVzIHRoZSBpZGVudGl0eSBvZiB0aGUgc2VydmVyIGJ1dCBub3QgdGhhdCBvZiB0aGUg Y2xpZW50LiBSRkM4MDQwIHNlY3Rpb24gMi41IHNwZWNpZmllcyB0aGF0ICZxdW90O2EgUkVTVENP TkYgc2VydmVyIFNIT1VMRCByZXF1aXJlIGF1dGhlbnRpY2F0aW9uIGJhc2VkIG9uIFRMUyBjbGll bnQgY2VydGlmaWNhdGVzLg0KIEkgYXNzdW1lIHRoYXQncyB0aGUgaW50ZW50LCBidXQgaXQgbWln aHQgYmUgdXNlZnVsIHRvIHNheSBzby48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+Jm5ic3A7PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7 IE9uIHRoZSBvdGhlciBoYW5kLCB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgZG8gbm90IGRl c2NyaWJlIHByaXZhY3kgaXNzdWVzLCBhbmQgSSBmaW5kIHRoYXQgcHJvYmxlbWF0aWMuIFRoZSBw cm9wb3NlZCBpbmZvcm1hdGlvbiBtb2RlbCBsaXN0cyBhIG51bWJlciBvZiBzZW5zaXRpdmUgZGF0 YSwgc3VjaCBhcyBmb3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZg0KIGRldmljZXMuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZndDsgVGhpcyBpbmZvcm1hdGlvbiBjYW4gYmUgbWlzdXNlZC4gRm9yIGV4YW1wbGUs IGFwcGxpY2F0aW9ucyBjb3VsZCBhc3Nlc3MgZGV2aWNlIGxvY2F0aW9uIGZldGNoaW5nIHRoZSBN QUMgYWRkcmVzc2VzIG9mIGxvY2FsIGdhdGV3YXlzLiBUaGlyZCBwYXJ0aWVzIGNvdWxkIGFjY2Vz cyBsaW5rIGxvY2FsIGluZm9ybWF0aW9uIHRvIGdhdGhlciBpZGVudGl0aWVzIG9mIGRldmljZXMN CiBhY2Nlc3NpbmcgYSBwYXJ0aWN1bGFyIG5ldHdvcmsuIFN1Y2ggaW5mb3JtYXRpb24gaXMgb2Z0 ZW4gcHJvdGVjdGVkIGJ5IHByaXZhY3kgQVBJIGluIHRoZSBPcGVyYXRpbmcgU3lzdGVtLCBidXQg YWNjZXNzaW5nIHRoZSBZYW5nIG1vZHVsZSBvdmVyIHRoZSBuZXR3b3JrIG1pZ2h0IGFsbG93IGFw cGxpY2F0aW9ucyB0byBieXBhc3MgdGhlc2UgY29udHJvbHMuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jmd0OyBDbGllbnQgYXV0aGVudGljYXRpb24gYWxvbmUgZG9lcyBub3QgbmVjZXNz YXJpbHkgcHJvdGVjdCBhZ2FpbnN0IHRoZXNlIHByaXZhY3kgbGVha3MuIEEgY2xhc3NpYyBjb25m aWd1cmF0aW9uIGVycm9yIHdvdWxkIGxpbWl0IHdyaXRlIGFjY2VzcyB0byBhdXRob3JpemVkIHVz ZXJzLCBidXQgdG8gYWxsb3cgcmVhZC1vbmx5IGFjY2VzcyB0byBtb3N0IHVzZXJzLiBUaGlzDQog a2luZCBvZiBlcnJvciB3b3VsZCBhbGxvdyBwcml2YWN5IGxlYWtzLiBHaXZlbiB0aGUgc2Vuc2l0 aXZlIG5hdHVyZSBvZiBNQUMgYWRkcmVzc2VzIGFuZCBvdGhlciBpZGVudGlmaWVycywgaXQgaXMg dXNlZnVsIHRvIHdhcm4gYWdhaW5zdCBzdWNoIGVycm9ycy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+Jm5i c3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDs8bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OzxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBpMnJzIG1haWxpbmcgbGlz dDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mZ3Q7IDxhIGhyZWY9Im1haWx0bzppMnJzQGlldGYub3JnIj48c3BhbiBzdHls ZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+aTJyc0BpZXRmLm9yZzwv c3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFp bG1hbi9saXN0aW5mby9pMnJzIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQt ZGVjb3JhdGlvbjpub25lIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2ky cnM8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_B8F9A780D330094D99AF023C5877DABAAD7BCE5Ddggeml531mbschi_-- From nobody Fri Jun 26 05:36:33 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3BED3A0CD7; Fri, 26 Jun 2020 05:36:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.948 X-Spam-Level: X-Spam-Status: No, score=0.948 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J0teuq54RUTS; Fri, 26 Jun 2020 05:36:30 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-100-static.hfc.comcastbusiness.net [50.245.122.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 212AA3A0958; Fri, 26 Jun 2020 05:36:29 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=166.170.22.63; From: "Susan Hares" To: "'Christian Huitema'" , "'Qin Wu'" , Cc: , , References: <002a01d64af8$f07320b0$d1596210$@ndzh.com> <15aa8236-ce09-d0b4-5f12-31f10b32387c@huitema.net> In-Reply-To: <15aa8236-ce09-d0b4-5f12-31f10b32387c@huitema.net> Date: Fri, 26 Jun 2020 08:36:23 -0400 Message-ID: <006001d64bb6$68303850$3890a8f0$@ndzh.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQLWmtRw7iPyu8IsKX2i31zM5z+c8gIWWk1AALLQ99Cm0+21kA== Content-Language: en-us X-Antivirus: AVG (VPS 200626-0, 06/26/2020), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 12:36:32 -0000 Qin and Christian:=20 This addition words for me.=20 Sue=20 -----Original Message----- From: Christian Huitema [mailto:huitema@huitema.net]=20 Sent: Friday, June 26, 2020 12:05 AM To: Susan Hares; 'Qin Wu'; secdir@ietf.org Cc: i2rs@ietf.org; = draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; = last-call@ietf.org Subject: Re: [Last-Call] [i2rs] Secdir last call review of = draft-ietf-i2rs-yang-l2-network-topology-13 How about adding something like this: Privacy Considerations The Yang model for layer 2 topology exposes privacy sensitive = information, for example the MAC addresses of devices. Unrestricted use = of such information can lead to privacy violations. For example, listing = MAC addresses in a network allows monitoring of devices and their = movements. Location information can be derived from MAC addresses of = network devices, bypassing protection of location information by the = Operating System. Deployments should mitigate this privacy concerns by limiting access to = the layer 2 topology information. Access to the information should be = restricted to a minimal list of authorized agents, and should require = proper authentication of these agents. -- Christian Huitema On 6/25/2020 7:00 AM, Susan Hares wrote: > Qin and Christian:=20 > > Thank you for your prompt attention to the privacy issue. =20 > I'm sure Christian will respond in a bit - since he might be in PDT = time-zone.=20 > > Once you have a solution you both like, we should validate the privacy = > changes to the security considerations section with the Yang-doctors,=20 > OPS-ADs, and Security-ADs. > > Martin's watching this thread so I'm sure he'll help us out as well.=20 > > Sue > > -----Original Message----- > From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu > Sent: Thursday, June 25, 2020 9:25 AM > To: Susan Hares; 'Christian Huitema'; secdir@ietf.org > Cc: i2rs@ietf.org;=20 > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;=20 > last-call@ietf.org > Subject: Re: [i2rs] Secdir last call review of=20 > draft-ietf-i2rs-yang-l2-network-topology-13 > > Sue and Christian: > I have responded to Christian on privacy issue, my proposal is to add = MAC address as another data node vulnerability example in our original = security consideration section. > But If Christian or security directorate has recommending text, we = authors are happy to accept it. > > -Qin > -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- > =E5=8F=91=E4=BB=B6=E4=BA=BA: Susan Hares [mailto:shares@ndzh.com] > =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: = 2020=E5=B9=B46=E6=9C=8825=E6=97=A5 21:04 > =E6=94=B6=E4=BB=B6=E4=BA=BA: 'Christian Huitema' = ; secdir@ietf.org > =E6=8A=84=E9=80=81: = draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;=20 > i2rs@ietf.org; last-call@ietf.org > =E4=B8=BB=E9=A2=98: RE: Secdir last call review of=20 > draft-ietf-i2rs-yang-l2-network-topology-13 > > Christian: > > Thank you for catching the privacy issues. =20 > > I've got a few questions to help the authors scope this change:=20 > > 1) Since this is common to all L2 Topologies, can you or the security = directorate recommend some text that might be appropriate?=20 > If you have recommended text, has this text been reviewed by = OPS-DIR and Yang doctors?=20 > > 2) Will it be a problem If we write privacy considerations on IEEE = specifications?=20 > 3) Do we need to consider the range of deployments of L2 (home,=20 > enterprise, public PBB service, national PBB service, Data centers) > > > Thank you, Sue > > > -----Original Message----- > From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] > Sent: Thursday, June 25, 2020 1:01 AM > To: secdir@ietf.org > Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;=20 > i2rs@ietf.org; last-call@ietf.org > Subject: Secdir last call review of=20 > draft-ietf-i2rs-yang-l2-network-topology-13 > > Reviewer: Christian Huitema > Review result: Has Issues > > I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written with the intent of improving security = requirements and considerations in IETF drafts. Comments not addressed = in last call may be included in AD reviews during the IESG review. = Document editors and WG chairs should treat these comments just like any = other last call comments. > > This document describes a Yang model for representing Link Layer = topologies. > Representing such topologies is obviously useful for managing network. > The security section is focused on securing the usage of this = information for network management, but does not address potential = privacy issues. > > The security considerations explain correctly how altering the link = layer information could enable attacks against the network. The proposed = remedy is access control, implemented using either SSH or TLS. This is = fine, although the discussion of TLS authorisation is a bit short. By = default, TLS verifies the identity of the server but not that of the = client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD = require authentication based on TLS client certificates. I assume that's = the intent, but it might be useful to say so. > > On the other hand, the security considerations do not describe privacy = issues, and I find that problematic. The proposed information model = lists a number of sensitive data, such as for example the MAC addresses = of devices. > This information can be misused. For example, applications could = assess device location fetching the MAC addresses of local gateways. = Third parties could access link local information to gather identities = of devices accessing a particular network. Such information is often = protected by privacy API in the Operating System, but accessing the Yang = module over the network might allow applications to bypass these = controls. > > Client authentication alone does not necessarily protect against these = privacy leaks. A classic configuration error would limit write access to = authorized users, but to allow read-only access to most users. This kind = of error would allow privacy leaks. Given the sensitive nature of MAC = addresses and other identifiers, it is useful to warn against such = errors. > > > > > > _______________________________________________ > i2rs mailing list > i2rs@ietf.org > https://www.ietf.org/mailman/listinfo/i2rs > From nobody Fri Jun 26 06:12:02 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B18723A09EC; Fri, 26 Jun 2020 06:11:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f5C5dSWqES8v; Fri, 26 Jun 2020 06:11:50 -0700 (PDT) Received: from atlas5.jacobs-university.de (atlas5.jacobs-university.de [212.201.44.20]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E27853A0990; Fri, 26 Jun 2020 06:11:48 -0700 (PDT) Received: from localhost (demetrius5.irc-it.jacobs-university.de [10.70.0.222]) by atlas5.jacobs-university.de (Postfix) with ESMTP id 04CCB6AB; Fri, 26 Jun 2020 15:11:47 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from atlas5.jacobs-university.de ([10.70.0.198]) by localhost (demetrius5.jacobs-university.de [10.70.0.222]) (amavisd-new, port 10032) with ESMTP id xSH3U3WTX85z; Fri, 26 Jun 2020 15:11:46 +0200 (CEST) Received: from hermes.jacobs-university.de (hermes.jacobs-university.de [212.201.44.23]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hermes.jacobs-university.de", Issuer "DFN-Verein Global Issuing CA" (verified OK)) by atlas5.jacobs-university.de (Postfix) with ESMTPS; Fri, 26 Jun 2020 15:11:46 +0200 (CEST) Received: from localhost (demetrius5.irc-it.jacobs-university.de [10.70.0.222]) by hermes.jacobs-university.de (Postfix) with ESMTP id A9EF4200E4; Fri, 26 Jun 2020 15:11:46 +0200 (CEST) X-Virus-Scanned: amavisd-new at jacobs-university.de Received: from hermes.jacobs-university.de ([212.201.44.23]) by localhost (demetrius5.jacobs-university.de [10.70.0.222]) (amavisd-new, port 10028) with ESMTP id d-0Zd_XrLdw5; Fri, 26 Jun 2020 15:11:46 +0200 (CEST) Received: from localhost (anna.jacobs.jacobs-university.de [10.50.218.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by hermes.jacobs-university.de (Postfix) with ESMTPS id 6B76F20154; Fri, 26 Jun 2020 15:11:45 +0200 (CEST) Date: Fri, 26 Jun 2020 15:11:45 +0200 From: Juergen Schoenwaelder To: Susan Hares Cc: 'Christian Huitema' , 'Qin Wu' , secdir@ietf.org, i2rs@ietf.org, draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org, last-call@ietf.org Message-ID: <20200626131145.habw34iy5orl4d3m@anna.jacobs.jacobs-university.de> Reply-To: Juergen Schoenwaelder Mail-Followup-To: Susan Hares , 'Christian Huitema' , 'Qin Wu' , secdir@ietf.org, i2rs@ietf.org, draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org, last-call@ietf.org References: <002a01d64af8$f07320b0$d1596210$@ndzh.com> <15aa8236-ce09-d0b4-5f12-31f10b32387c@huitema.net> <006001d64bb6$68303850$3890a8f0$@ndzh.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <006001d64bb6$68303850$3890a8f0$@ndzh.com> X-Clacks-Overhead: GNU Terry Pratchett Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] [i2rs] [Last-Call] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 13:11:53 -0000 But please s/agents/clients/ . /js On Fri, Jun 26, 2020 at 08:36:23AM -0400, Susan Hares wrote: > Qin and Christian:=20 >=20 > This addition words for me.=20 >=20 > Sue=20 >=20 > -----Original Message----- > From: Christian Huitema [mailto:huitema@huitema.net]=20 > Sent: Friday, June 26, 2020 12:05 AM > To: Susan Hares; 'Qin Wu'; secdir@ietf.org > Cc: i2rs@ietf.org; draft-ietf-i2rs-yang-l2-network-topology.all@ietf.or= g; last-call@ietf.org > Subject: Re: [Last-Call] [i2rs] Secdir last call review of draft-ietf-i= 2rs-yang-l2-network-topology-13 >=20 > How about adding something like this: >=20 > Privacy Considerations >=20 > The Yang model for layer 2 topology exposes privacy sensitive informati= on, for example the MAC addresses of devices. Unrestricted use of such in= formation can lead to privacy violations. For example, listing MAC addres= ses in a network allows monitoring of devices and their movements. Locati= on information can be derived from MAC addresses of network devices, bypa= ssing protection of location information by the Operating System. >=20 > Deployments should mitigate this privacy concerns by limiting access to= the layer 2 topology information. Access to the information should be re= stricted to a minimal list of authorized agents, and should require prope= r authentication of these agents. >=20 > -- Christian Huitema >=20 > On 6/25/2020 7:00 AM, Susan Hares wrote: > > Qin and Christian:=20 > > > > Thank you for your prompt attention to the privacy issue. =20 > > I'm sure Christian will respond in a bit - since he might be in PDT t= ime-zone.=20 > > > > Once you have a solution you both like, we should validate the privac= y=20 > > changes to the security considerations section with the Yang-doctors,= =20 > > OPS-ADs, and Security-ADs. > > > > Martin's watching this thread so I'm sure he'll help us out as well.=20 > > > > Sue > > > > -----Original Message----- > > From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu > > Sent: Thursday, June 25, 2020 9:25 AM > > To: Susan Hares; 'Christian Huitema'; secdir@ietf.org > > Cc: i2rs@ietf.org;=20 > > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;=20 > > last-call@ietf.org > > Subject: Re: [i2rs] Secdir last call review of=20 > > draft-ietf-i2rs-yang-l2-network-topology-13 > > > > Sue and Christian: > > I have responded to Christian on privacy issue, my proposal is to add= MAC address as another data node vulnerability example in our original s= ecurity consideration section. > > But If Christian or security directorate has recommending text, we au= thors are happy to accept it. > > > > -Qin > > -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- > > =E5=8F=91=E4=BB=B6=E4=BA=BA: Susan Hares [mailto:shares@ndzh.com] > > =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: 2020=E5=B9=B46=E6=9C=8825=E6=97= =A5 21:04 > > =E6=94=B6=E4=BB=B6=E4=BA=BA: 'Christian Huitema' ; secdir@ietf.org > > =E6=8A=84=E9=80=81: draft-ietf-i2rs-yang-l2-network-topology.all@ietf= .org;=20 > > i2rs@ietf.org; last-call@ietf.org > > =E4=B8=BB=E9=A2=98: RE: Secdir last call review of=20 > > draft-ietf-i2rs-yang-l2-network-topology-13 > > > > Christian: > > > > Thank you for catching the privacy issues. =20 > > > > I've got a few questions to help the authors scope this change:=20 > > > > 1) Since this is common to all L2 Topologies, can you or the security= directorate recommend some text that might be appropriate?=20 > > If you have recommended text, has this text been reviewed by OPS-D= IR and Yang doctors?=20 > > > > 2) Will it be a problem If we write privacy considerations on IEEE sp= ecifications?=20 > > 3) Do we need to consider the range of deployments of L2 (home,=20 > > enterprise, public PBB service, national PBB service, Data centers) > > > > > > Thank you, Sue > > > > > > -----Original Message----- > > From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] > > Sent: Thursday, June 25, 2020 1:01 AM > > To: secdir@ietf.org > > Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;=20 > > i2rs@ietf.org; last-call@ietf.org > > Subject: Secdir last call review of=20 > > draft-ietf-i2rs-yang-l2-network-topology-13 > > > > Reviewer: Christian Huitema > > Review result: Has Issues > > > > I have reviewed this document as part of the security directorate's o= ngoing effort to review all IETF documents being processed by the IESG. = These comments were written with the intent of improving security require= ments and considerations in IETF drafts. Comments not addressed in last = call may be included in AD reviews during the IESG review. Document edit= ors and WG chairs should treat these comments just like any other last ca= ll comments. > > > > This document describes a Yang model for representing Link Layer topo= logies. > > Representing such topologies is obviously useful for managing network= . > > The security section is focused on securing the usage of this informa= tion for network management, but does not address potential privacy issue= s. > > > > The security considerations explain correctly how altering the link l= ayer information could enable attacks against the network. The proposed r= emedy is access control, implemented using either SSH or TLS. This is fin= e, although the discussion of TLS authorisation is a bit short. By defaul= t, TLS verifies the identity of the server but not that of the client. RF= C8040 section 2.5 specifies that "a RESTCONF server SHOULD require authen= tication based on TLS client certificates. I assume that's the intent, bu= t it might be useful to say so. > > > > On the other hand, the security considerations do not describe privac= y issues, and I find that problematic. The proposed information model lis= ts a number of sensitive data, such as for example the MAC addresses of d= evices. > > This information can be misused. For example, applications could asse= ss device location fetching the MAC addresses of local gateways. Third pa= rties could access link local information to gather identities of devices= accessing a particular network. Such information is often protected by p= rivacy API in the Operating System, but accessing the Yang module over th= e network might allow applications to bypass these controls. > > > > Client authentication alone does not necessarily protect against thes= e privacy leaks. A classic configuration error would limit write access t= o authorized users, but to allow read-only access to most users. This kin= d of error would allow privacy leaks. Given the sensitive nature of MAC a= ddresses and other identifiers, it is useful to warn against such errors. > > > > > > > > > > > > _______________________________________________ > > i2rs mailing list > > i2rs@ietf.org > > https://www.ietf.org/mailman/listinfo/i2rs > > >=20 > _______________________________________________ > i2rs mailing list > i2rs@ietf.org > https://www.ietf.org/mailman/listinfo/i2rs --=20 Juergen Schoenwaelder Jacobs University Bremen gGmbH Phone: +49 421 200 3587 Campus Ring 1 | 28759 Bremen | Germany Fax: +49 421 200 3103 From nobody Fri Jun 26 07:03:33 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 738373A00AE; Fri, 26 Jun 2020 07:03:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.948 X-Spam-Level: X-Spam-Status: No, score=0.948 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DOS_OUTLOOK_TO_MX=2.845, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id isTKB1JcY2Ee; Fri, 26 Jun 2020 07:03:23 -0700 (PDT) Received: from hickoryhill-consulting.com (50-245-122-100-static.hfc.comcastbusiness.net [50.245.122.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BA0F63A005F; Fri, 26 Jun 2020 07:03:22 -0700 (PDT) X-Default-Received-SPF: pass (skip=loggedin (res=PASS)) x-ip-name=166.170.22.63; From: "Susan Hares" To: "'Juergen Schoenwaelder'" Cc: "'Christian Huitema'" , "'Qin Wu'" , , , , References: <002a01d64af8$f07320b0$d1596210$@ndzh.com> <15aa8236-ce09-d0b4-5f12-31f10b32387c@huitema.net> <006001d64bb6$68303850$3890a8f0$@ndzh.com> <20200626131145.habw34iy5orl4d3m@anna.jacobs.jacobs-university.de> In-Reply-To: <20200626131145.habw34iy5orl4d3m@anna.jacobs.jacobs-university.de> Date: Fri, 26 Jun 2020 10:03:17 -0400 Message-ID: <009001d64bc2$8b8cfde0$a2a6f9a0$@ndzh.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Outlook 14.0 Thread-Index: AQLWmtRw7iPyu8IsKX2i31zM5z+c8gIWWk1AALLQ99AC9T3OswJJw38FpqoN9RA= Content-Language: en-us X-Antivirus: AVG (VPS 200626-0, 06/26/2020), Outbound message X-Antivirus-Status: Not-Tested X-Authenticated-User: skh@ndzh.com Archived-At: Subject: Re: [secdir] [i2rs] [Last-Call] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 14:03:25 -0000 Juergen:=20 Good catch. Thanks.=20 sue -----Original Message----- From: Juergen Schoenwaelder = [mailto:j.schoenwaelder@jacobs-university.de]=20 Sent: Friday, June 26, 2020 9:12 AM To: Susan Hares Cc: 'Christian Huitema'; 'Qin Wu'; secdir@ietf.org; i2rs@ietf.org; = draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; = last-call@ietf.org Subject: Re: [i2rs] [Last-Call] Secdir last call review of = draft-ietf-i2rs-yang-l2-network-topology-13 But please s/agents/clients/ . /js On Fri, Jun 26, 2020 at 08:36:23AM -0400, Susan Hares wrote: > Qin and Christian:=20 >=20 > This addition words for me.=20 >=20 > Sue >=20 > -----Original Message----- > From: Christian Huitema [mailto:huitema@huitema.net] > Sent: Friday, June 26, 2020 12:05 AM > To: Susan Hares; 'Qin Wu'; secdir@ietf.org > Cc: i2rs@ietf.org;=20 > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;=20 > last-call@ietf.org > Subject: Re: [Last-Call] [i2rs] Secdir last call review of=20 > draft-ietf-i2rs-yang-l2-network-topology-13 >=20 > How about adding something like this: >=20 > Privacy Considerations >=20 > The Yang model for layer 2 topology exposes privacy sensitive = information, for example the MAC addresses of devices. Unrestricted use = of such information can lead to privacy violations. For example, listing = MAC addresses in a network allows monitoring of devices and their = movements. Location information can be derived from MAC addresses of = network devices, bypassing protection of location information by the = Operating System. >=20 > Deployments should mitigate this privacy concerns by limiting access = to the layer 2 topology information. Access to the information should be = restricted to a minimal list of authorized agents, and should require = proper authentication of these agents. >=20 > -- Christian Huitema >=20 > On 6/25/2020 7:00 AM, Susan Hares wrote: > > Qin and Christian:=20 > > > > Thank you for your prompt attention to the privacy issue. =20 > > I'm sure Christian will respond in a bit - since he might be in PDT = time-zone.=20 > > > > Once you have a solution you both like, we should validate the=20 > > privacy changes to the security considerations section with the=20 > > Yang-doctors, OPS-ADs, and Security-ADs. > > > > Martin's watching this thread so I'm sure he'll help us out as well. = > > > > Sue > > > > -----Original Message----- > > From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu > > Sent: Thursday, June 25, 2020 9:25 AM > > To: Susan Hares; 'Christian Huitema'; secdir@ietf.org > > Cc: i2rs@ietf.org; > > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; > > last-call@ietf.org > > Subject: Re: [i2rs] Secdir last call review of > > draft-ietf-i2rs-yang-l2-network-topology-13 > > > > Sue and Christian: > > I have responded to Christian on privacy issue, my proposal is to = add MAC address as another data node vulnerability example in our = original security consideration section. > > But If Christian or security directorate has recommending text, we = authors are happy to accept it. > > > > -Qin > > -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- > > =E5=8F=91=E4=BB=B6=E4=BA=BA: Susan Hares [mailto:shares@ndzh.com] > > =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: = 2020=E5=B9=B46=E6=9C=8825=E6=97=A5 21:04 > > =E6=94=B6=E4=BB=B6=E4=BA=BA: 'Christian Huitema' = ; secdir@ietf.org > > =E6=8A=84=E9=80=81: = draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; > > i2rs@ietf.org; last-call@ietf.org > > =E4=B8=BB=E9=A2=98: RE: Secdir last call review of > > draft-ietf-i2rs-yang-l2-network-topology-13 > > > > Christian: > > > > Thank you for catching the privacy issues. =20 > > > > I've got a few questions to help the authors scope this change:=20 > > > > 1) Since this is common to all L2 Topologies, can you or the = security directorate recommend some text that might be appropriate?=20 > > If you have recommended text, has this text been reviewed by = OPS-DIR and Yang doctors?=20 > > > > 2) Will it be a problem If we write privacy considerations on IEEE = specifications?=20 > > 3) Do we need to consider the range of deployments of L2 (home,=20 > > enterprise, public PBB service, national PBB service, Data centers) > > > > > > Thank you, Sue > > > > > > -----Original Message----- > > From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] > > Sent: Thursday, June 25, 2020 1:01 AM > > To: secdir@ietf.org > > Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; > > i2rs@ietf.org; last-call@ietf.org > > Subject: Secdir last call review of > > draft-ietf-i2rs-yang-l2-network-topology-13 > > > > Reviewer: Christian Huitema > > Review result: Has Issues > > > > I have reviewed this document as part of the security directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written with the intent of improving security = requirements and considerations in IETF drafts. Comments not addressed = in last call may be included in AD reviews during the IESG review. = Document editors and WG chairs should treat these comments just like any = other last call comments. > > > > This document describes a Yang model for representing Link Layer = topologies. > > Representing such topologies is obviously useful for managing = network From nobody Fri Jun 26 08:57:15 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C90643A089B for ; Fri, 26 Jun 2020 08:57:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kJPRF3yWQp5y for ; Fri, 26 Jun 2020 08:56:50 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 89A633A0845 for ; Fri, 26 Jun 2020 08:56:50 -0700 (PDT) Received: from xse425.mail2web.com ([66.113.197.171] helo=xse.mail2web.com) by mx166.antispamcloud.com with esmtp (Exim 4.92) (envelope-from ) id 1jopn7-000nPE-OY for secdir@ietf.org; Fri, 26 Jun 2020 16:57:28 +0200 Received: from xsmtp22.mail2web.com (unknown [10.100.68.61]) by xse.mail2web.com (Postfix) with ESMTPS id 49tg0W4pgWz1kMl for ; Fri, 26 Jun 2020 07:55:07 -0700 (PDT) Received: from [10.5.2.13] (helo=xmail03.myhosting.com) by xsmtp22.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1jopkx-0000pn-H2 for secdir@ietf.org; Fri, 26 Jun 2020 07:55:07 -0700 Received: (qmail 15894 invoked from network); 26 Jun 2020 14:55:07 -0000 Received: from unknown (HELO [192.168.1.107]) (Authenticated-user:_huitema@huitema.net@[172.58.43.153]) (envelope-sender ) by xmail03.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 26 Jun 2020 14:55:06 -0000 To: Qin Wu , Susan Hares , "secdir@ietf.org" Cc: "i2rs@ietf.org" , "draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org" , "last-call@ietf.org" , NETMOD Group References: From: Christian Huitema Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mDMEXtavGxYJKwYBBAHaRw8BAQdA1ou9A5MHTP9N3jfsWzlDZ+jPnQkusmc7sfLmWVz1Rmu0 J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PoiWBBMWCAA+FiEEw3G4 Nwi4QEpAAXUUELAmqKBYtJQFAl7WrxsCGwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgEC F4AACgkQELAmqKBYtJQbMwD/ebj/qnSbthC/5kD5DxZ/Ip0CGJw5QBz/+fJp3R8iAlsBAMjK r2tmyWyJz0CUkVG24WaR5EAJDvgwDv8h22U6QVkAuDgEXtavGxIKKwYBBAGXVQEFAQEHQJoM 6MUAIqpoqdCIiACiEynZf7nlJg2Eu0pXIhbUGONdAwEIB4h+BBgWCAAmFiEEw3G4Nwi4QEpA AXUUELAmqKBYtJQFAl7WrxsCGwwFCQlmAYAACgkQELAmqKBYtJRm2wD7BzeK5gEXSmBcBf0j BYdSaJcXNzx4yPLbP4GnUMAyl2cBAJzcsR4RkwO4dCRqM9CHpVJCwHtbUDJaa55//E0kp+gH Message-ID: <34bbf063-7973-b7aa-c407-0ac9c071a648@huitema.net> Date: Fri, 26 Jun 2020 07:55:05 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------D1256F2AD8D9EE12B56C05C7" Content-Language: en-US X-Originating-IP: 66.113.197.171 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.197.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.197.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0f6LF1GdvkEexklpcFpSF5apSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDcQkv3rfK9nOh84B6FNp+WsRX qYbtEQV1z/L435ZRxFTNk2Aq4CB1uIboA4Kt9mVxZfHZrMQ8Ke0Z8pjKFUegibQrHWZPpqYwb4n/ 5SxQwXAlwKhAEGVwhQsL2SvUkQClr78mGWw0jJjCZO5tGoeKZsxKTagmQ3xMyVZ07UERWzx6BTXs FxcSzhpFHKuVDd8Suy8lNDS0QWWkADhl7glCR9PbrhSmW22tW1yBxgRT8bmxZJSIFVPkVVALPRKr lHlM3kWCH4Q79vaQ+COHDJAgLHQOD0r6/AaHZiEtdTMtMlgTBUa5LSawQcdT80HH17nNg8oiq9mz mwrbQbTulSg7juWBOXp8nHKe0R+FkIqN7hkFZqA6TBkpoO/ktnXt0JlLIRFsicyJMEhQFtD8PLoi nuxTyssp4L0plUGigax8zy4LpVxP5YFZg5fgueXLf6LKHDJ71JSXKkUqfqsTqwEEUOidX4Ts4xdG +C13IyWeZaLEvcYUkOTUkAbSil5+2+oX4nuZrRf7bMi0WRR6pZ+nWUKyccnhCI7Z+Axb9iK+poxX 0SU68ek9wyYNR7nSKrZbQsAM8hGlAkv+YXlQiOyIRazNjLvclnGzlTC8ZgkR3laIWqvAxiBHuIuS y5fCAlEk/IshhXkNQo0J2t+/Bq8+iVACVO3tx78u0bG7If2TCVTVXBgwIGr26umyD/gWRYtGmqBm J5LhaWhCjk5k4tfJqTnzSXChKWk/itcbicJsIPcjnBEvkV2mIEMgGUnrK6lIfqb5R4VemuUI6bcE ARsm0De6PaZO6/JToEyx4tmc5OljkPSpPXAVjl2oMr8a1xm0wfXUFMjTH2DyD8i5kO5bZlYFvf25 LVONYbYifH5OzZCwIgD/xDehea09OpnwSuobZrrGExMR7eTbBjMGDKI3ijhhJn7Muv/NHXl0o++8 3wM= X-Report-Abuse-To: spam@quarantine11.antispamcloud.com Archived-At: Subject: Re: [secdir] [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 15:57:14 -0000 This is a multi-part message in MIME format. --------------D1256F2AD8D9EE12B56C05C7 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I like variant B better, although I would not single out the mac addresses in the "sabotage" warning. My main concern is that network administrators will naturally be very concerned about information that is writable/creatable/deletable, because they understand the impact on the management of their network. However, they are not so concerned with read-only access, because reading information does not directly affect the operation of the network. My whole point is telling them, "you are documenting your L2 topology, it contains sensitive information, make sure that reading it is protected, not just writing it". I agree that NETCONF and RESTCONF provide the right tools for protecting the information. My request is just to clearly tell network administrators to use these tools, do not leave read access wide open! -- Christian Huitema On 6/26/2020 4:37 AM, Qin Wu wrote: > > Hi, Christian: > > 1.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 NACM defined in RFC8341 has alre= ady provided mechanisms to > restrict access to sensitive information to a minimal list of > authorized client or agents and deal with privacy issue if my > understanding is correct. > > 2.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Both NETCONF and RESTCONF will r= ely on transport protocol > such as TLS to provide client authentication and server > authentication, i.e., mutual authentication. > > 3.=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 The YANG security guideline defi= ned in > https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines > > Provide perfect boilerplate to address both security consideration and > privacy consideration. > > My original proposal A to address your comments is: > > OLD TEXT: > > " > > =C2=A0=C2=A0 There are a number of data nodes defined in this YANG modu= le that are > > =C2=A0=C2=A0 writable/creatable/deletable (i.e., config true, which is = the > > =C2=A0=C2=A0 default).=C2=A0 These data nodes may be considered sensiti= ve or vulnerable > > =C2=A0=C2=A0 in some network environments.=C2=A0 Write operations (e.g.= , edit-config) > > =C2=A0=C2=A0 to these data nodes without proper protection can have a n= egative > > =C2=A0=C2=A0 effect on network operations.=C2=A0 These are the subtrees= and data nodes > > =C2=A0=C2=A0 and their sensitivity/vulnerability in the ietf-network mo= dule: > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-network-attributes: A malicious client could at= tempt to > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sabotage the configuration of any of the= contained attributes, > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 such as the name or the flag data nodes.= > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-node-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important node attr= ibutes, such as the name > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 or the management-address. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-link-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important link attr= ibutes, such as the rate > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 or the delay data nodes. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-termination-point-attributes: A malicious clien= t could attempt > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 to sabotage the configuration of importa= nt termination point > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 attributes, such as the maximum-frame-si= ze. > > " > > NEW TEXT: > > " > > =C2=A0=C2=A0 There are a number of data nodes defined in this YANG modu= le that are > > =C2=A0=C2=A0 writable/creatable/deletable (i.e., config true, which is = the > > =C2=A0=C2=A0 default).=C2=A0 These data nodes may be considered sensiti= ve or vulnerable > > =C2=A0=C2=A0 in some network environments.=C2=A0 Write operations (e.g.= , edit-config) > > =C2=A0=C2=A0 to these data nodes without proper protection can have a n= egative > > =C2=A0=C2=A0 effect on network operations.=C2=A0 These are the subtrees= and data nodes > > =C2=A0=C2=A0 and their sensitivity/vulnerability in the ietf-network mo= dule: > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-network-attributes: A malicious client could at= tempt to > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sabotage the configuration of any of the= contained attributes, > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 such as the name or the flag data nodes.= > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-node-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important node attr= ibutes, such as the name > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ,the management-address *or mac address = of the devices*. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-link-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important link attr= ibutes, such as the rate > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 or the delay data nodes. > > =C2=A0 > > =C2=A0=C2=A0o=C2=A0 l2-termination-point-attributes: A malicious client= could attempt > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 to sabotage the configuration of importa= nt termination point > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 attributes, such as the maximum-frame-si= ze, *mac-address*. > > " > > =C2=A0 > > With your proposed text, we could have the following proposal changes > (Proposal B): > > OLD TEXT: > > " > > 6.=C2=A0 Security Considerations > > =C2=A0 > > =C2=A0=C2=A0 The YANG module specified in this document defines a schem= a for data > > =C2=A0=C2=A0 that is designed to be accessed via network management pro= tocols such > > =C2=A0=C2=A0 as NETCONF [RFC6241] or RESTCONF [RFC8040].=C2=A0 The lowe= st NETCONF layer > > =C2=A0=C2=A0 is the secure transport layer, and the mandatory-to-implem= ent secure > > =C2=A0=C2=A0 transport is Secure Shell (SSH) [RFC6242].=C2=A0 The lowes= t RESTCONF layer > > =C2=A0=C2=A0 is HTTPS, and the mandatory-to-implement secure transport = is TLS > > =C2=A0=C2=A0 [RFC8446]. > > =C2=A0 > > =C2=A0=C2=A0 The Network Configuration Access Control Model (NACM) [RFC= 8341] > > =C2=A0=C2=A0 provides the means to restrict access for particular NETCO= NF or > > =C2=A0 > > =C2=A0=C2=A0 RESTCONF users to a preconfigured subset of all available = NETCONF or > > =C2=A0=C2=A0 RESTCONF protocol operations and content. > > =C2=A0 > > =C2=A0=C2=A0 In general, Layer 2 network topologies are system-controll= ed and > > =C2=A0=C2=A0 provide ephemeral topology information.=C2=A0 In an NMDA-c= omplient server, > > =C2=A0=C2=A0 they are only part of which provides read-on= ly access > > =C2=A0=C2=A0 to clients, they are less vulnerable.=C2=A0 That said, the= YANG module > > =C2=A0=C2=A0 does in principle allow information to be configurable. > > =C2=A0 > > =C2=A0=C2=A0 The Layer 2 topology module define information that can be= > > =C2=A0=C2=A0 configurable in certain instances, for example in the case= of virtual > > =C2=A0=C2=A0 topologies that can be created by client applications.=C2=A0= In such > > =C2=A0=C2=A0 cases, a malicious client could introduce topologies that = are > > =C2=A0=C2=A0 undesired.=C2=A0 Specifically, a malicious client could at= tempt to remove > > =C2=A0=C2=A0 or add a node, a link, a termination point, by creating or= deleting > > =C2=A0=C2=A0 corresponding elements in the node, link, and termination = point > > =C2=A0=C2=A0 lists, respectively.=C2=A0 In the case of a topology that = is learned, the > > =C2=A0=C2=A0 server will automatically prohibit such misconfiguration a= ttempts. > > =C2=A0=C2=A0 In the case of a topology that is configured, i.e. whose o= rigin is > > =C2=A0=C2=A0 "intended", the undesired configuration could become effec= tive and be > > =C2=A0=C2=A0 reflected in the operational state datastore, leading to d= isruption > > =C2=A0=C2=A0 of services provided via this topology might be disrupted.= =C2=A0 For those > > =C2=A0=C2=A0 reasons, it is important that the NETCONF access control m= odel is > > =C2=A0=C2=A0 vigorously applied to prevent topology misconfiguration by= > > =C2=A0=C2=A0 unauthorized clients. > > =C2=A0 > > =C2=A0=C2=A0 There are a number of data nodes defined in this YANG modu= le that are > > =C2=A0=C2=A0 writable/creatable/deletable (i.e., config true, which is = the > > =C2=A0=C2=A0 default).=C2=A0 These data nodes may be considered sensiti= ve or vulnerable > > =C2=A0=C2=A0 in some network environments.=C2=A0 Write operations (e.g.= , edit-config) > > =C2=A0=C2=A0 to these data nodes without proper protection can have a n= egative > > =C2=A0=C2=A0 effect on network operations.=C2=A0 These are the subtrees= and data nodes > > =C2=A0=C2=A0 and their sensitivity/vulnerability in the ietf-network mo= dule: > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-network-attributes: A malicious client could at= tempt to > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sabotage the configuration of any of the= contained attributes, > > =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0such as the name or the flag data nodes.= > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-node-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important node attr= ibutes, such as the name > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 or the management-address. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-link-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important link attr= ibutes, such as the rate > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 or the delay data nodes. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-termination-point-attributes: A malicious clien= t could attempt > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 to sabotage the configuration of importa= nt termination point > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 attributes, such as the maximum-frame-si= ze. > > " > > NEW TEXT: > > " > > 6.=C2=A0 Security Considerations > > =C2=A0 > > =C2=A0=C2=A0 The YANG module specified in this document defines a schem= a for data > > =C2=A0=C2=A0 that is designed to be accessed via network management pro= tocols such > > =C2=A0=C2=A0 as NETCONF [RFC6241] or RESTCONF [RFC8040].=C2=A0 The lowe= st NETCONF layer > > =C2=A0 =C2=A0is the secure transport layer, and the mandatory-to-implem= ent secure > > =C2=A0=C2=A0 transport is Secure Shell (SSH) [RFC6242].=C2=A0 The lowes= t RESTCONF layer > > =C2=A0=C2=A0 is HTTPS, and the mandatory-to-implement secure transport = is TLS > > =C2=A0=C2=A0 [RFC8446]. > > =C2=A0 > > =C2=A0=C2=A0 The Network Configuration Access Control Model (NACM) [RFC= 8341] > > =C2=A0=C2=A0 provides the means to restrict access for particular NETCO= NF or > > =C2=A0=C2=A0 RESTCONF users to a preconfigured subset of all available = NETCONF or > > =C2=A0=C2=A0 RESTCONF protocol operations and content. > > =C2=A0 > > =C2=A0=C2=A0 In general, Layer 2 network topologies are system-controll= ed and > > =C2=A0=C2=A0 provide ephemeral topology information.=C2=A0 In an NMDA-c= omplient server, > > =C2=A0=C2=A0 they are only part of which provides read-on= ly access > > =C2=A0=C2=A0 to clients, they are less vulnerable.=C2=A0 That said, the= YANG module > > =C2=A0=C2=A0 does in principle allow information to be configurable. > > =C2=A0 > > =C2=A0=C2=A0 The Layer 2 topology module define information that can be= > > =C2=A0=C2=A0 configurable in certain instances, for example in the case= of virtual > > =C2=A0=C2=A0 topologies that can be created by client applications.=C2=A0= In such > > =C2=A0=C2=A0 cases, a malicious client could introduce topologies that = are > > =C2=A0=C2=A0 undesired.=C2=A0 Specifically, a malicious client could at= tempt to remove > > =C2=A0=C2=A0 or add a node, a link, a termination point, by creating or= deleting > > =C2=A0=C2=A0 corresponding elements in the node, link, and termination = point > > =C2=A0=C2=A0 lists, respectively.=C2=A0 In the case of a topology that = is learned, the > > =C2=A0=C2=A0 server will automatically prohibit such misconfiguration a= ttempts. > > =C2=A0=C2=A0 In the case of a topology that is configured, i.e. whose o= rigin is > > =C2=A0=C2=A0 "intended", the undesired configuration could become effec= tive and be > > =C2=A0=C2=A0 reflected in the operational state datastore, leading to d= isruption > > =C2=A0=C2=A0 of services provided via this topology might be disrupted.= =C2=A0 For those > > =C2=A0=C2=A0 reasons, it is important that the NETCONF access control m= odel is > > =C2=A0=C2=A0 vigorously applied to prevent topology misconfiguration by= > > =C2=A0=C2=A0 unauthorized clients. > > =C2=A0 > > *=C2=A0 The YANG model for layer 2 topology may expose sensitive inform= ation, * > > *=C2=A0=C2=A0for example the MAC addresses of devices. Unrestricted use= of such > information * > > *=C2=A0=C2=A0=C2=A0can lead to privacy violations. For example, listing= MAC addresses > in a network * > > *=C2=A0=C2=A0=C2=A0allows monitoring of devices and their movements. Lo= cation > information can be derived* > > *=C2=A0 =C2=A0from MAC addresses of network devices, bypassing protecti= on of > location information by * > > *=C2=A0=C2=A0=C2=A0the Operating System. Deployments should mitigate th= is privacy > concerns by limiting access * > > *=C2=A0=C2=A0=C2=A0to the layer 2 topology information. Access to the i= nformation > should be restricted to a * > > *=C2=A0=C2=A0=C2=A0minimal list of authorized clients, and should also = require proper > authentication of these clients.* > > =C2=A0 > > =C2=A0=C2=A0 There are a number of data nodes defined in this YANG modu= le that are > > =C2=A0=C2=A0 writable/creatable/deletable (i.e., config true, which is = the > > =C2=A0=C2=A0 default).=C2=A0 These data nodes may be considered sensiti= ve or vulnerable > > =C2=A0=C2=A0 in some network environments.=C2=A0 Write operations (e.g.= , edit-config) > > =C2=A0=C2=A0 to these data nodes without proper protection can have a n= egative > > =C2=A0=C2=A0 effect on network operations.=C2=A0 These are the subtrees= and data nodes > > =C2=A0=C2=A0 and their sensitivity/vulnerability in the ietf-network mo= dule: > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-network-attributes: A malicious client could at= tempt to > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 sabotage the configuration of any of the= contained attributes, > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 such as the name or the flag data nodes.= > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-node-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important node attr= ibutes, such as the name > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 ,the management-address, *mac-address of= the devices*. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-link-attributes: A malicious client could attem= pt to sabotage > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 the configuration of important link attr= ibutes, such as the rate > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 or the delay data nodes. > > =C2=A0 > > =C2=A0=C2=A0 o=C2=A0 l2-termination-point-attributes: A malicious clien= t could attempt > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 to sabotage the configuration of importa= nt termination point > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 attributes, such as the maximum-frame-si= ze, *mac-address*. > > " > > The question is do you think proposal with yang security boilterplate > has already addressed your comments > > Or you think we should emphasize how privacy issue can be addressed by > NACM and client authentication is needed? > > =C2=A0 > > -Qin > > -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- > =E5=8F=91=E4=BB=B6=E4=BA=BA: Christian Huitema [mailto:huitema@huitema.= net] > =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: 2020=E5=B9=B46=E6=9C=8826=E6=97=A5= 12:05 > =E6=94=B6=E4=BB=B6=E4=BA=BA: Susan Hares ; Qin Wu ; > secdir@ietf.org > =E6=8A=84=E9=80=81: i2rs@ietf.org; > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; last-call@ietf.o= rg > =E4=B8=BB=E9=A2=98: Re: [Last-Call] [i2rs] Secdir last call review of > draft-ietf-i2rs-yang-l2-network-topology-13 > > =C2=A0 > > How about adding something like this: > > =C2=A0 > > Privacy Considerations > > =C2=A0 > > The Yang model for layer 2 topology exposes privacy sensitive > information, for example the MAC addresses of devices. Unrestricted > use of such information can lead to privacy violations. For example, > listing MAC addresses in a network allows monitoring of devices and > their movements. Location information can be derived from MAC > addresses of network devices, bypassing protection of location > information by the Operating System. > > =C2=A0 > > Deployments should mitigate this privacy concerns by limiting access > to the layer 2 topology information. Access to the information should > be restricted to a minimal list of authorized agents, and should > require proper authentication of these agents. > > =C2=A0 > > -- Christian Huitema > > =C2=A0 > > On 6/25/2020 7:00 AM, Susan Hares wrote: > > > Qin and Christian: > > >=C2=A0 > > > Thank you for your prompt attention to the privacy issue.=C2=A0 > > > I'm sure Christian will respond in a bit - since he might be in PDT t= ime-zone. > > >=C2=A0 > > > Once you have a solution you both like, we should validate the privac= y > > > changes to the security considerations section with the Yang-doctors,= > > > OPS-ADs, and Security-ADs. > > >=C2=A0 > > > Martin's watching this thread so I'm sure he'll help us out as well. > > >=C2=A0 > > > Sue > > >=C2=A0 > > > -----Original Message----- > > > From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu > > > Sent: Thursday, June 25, 2020 9:25 AM > > > To: Susan Hares; 'Christian Huitema'; secdir@ietf.org > > > Cc: i2rs@ietf.org ; > > > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org > ; > > > last-call@ietf.org > > > Subject: Re: [i2rs] Secdir last call review of > > > draft-ietf-i2rs-yang-l2-network-topology-13 > > >=C2=A0 > > > Sue and Christian: > > > I have responded to Christian on privacy issue, my proposal is to add= MAC address as > another data node vulnerability example in our original security > consideration section. > > > But If Christian or security directorate has recommending text, we au= thors are happy > to accept it. > > >=C2=A0 > > > -Qin > > > -----=E9=82=AE=E4=BB=B6=E5=8E=9F=E4=BB=B6----- > > > =E5=8F=91=E4=BB=B6=E4=BA=BA: Susan Hares [mailto:shares@ndzh.com] > > > =E5=8F=91=E9=80=81=E6=97=B6=E9=97=B4: 2020=E5=B9=B46=E6=9C=8825=E6=97= =A521:04 > > > =E6=94=B6=E4=BB=B6=E4=BA=BA: 'Christian Huitema' >; secdir@ietf.org = > > > =E6=8A=84=E9=80=81: draft-ietf-i2rs-yang-l2-network-topology.all@ietf= =2Eorg > ; > > > i2rs@ietf.org ; last-call@ietf.org > > > > =E4=B8=BB=E9=A2=98: RE: Secdir last call review of > > > draft-ietf-i2rs-yang-l2-network-topology-13 > > >=C2=A0 > > > Christian: > > >=C2=A0 > > > Thank you for catching the privacy issues.=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 > > >=C2=A0 > > > I've got a few questions to help the authors scope this change: > > >=C2=A0 > > > 1) Since this is common to all L2 Topologies, can you or the security= directorate > recommend some text that might be appropriate? > > > =C2=A0=C2=A0=C2=A0If you have recommended text, has this text been re= viewed by OPS-DIR and Yang > doctors? > > >=C2=A0 > > > 2) Will it be a problem If we write privacy considerations on IEEE sp= ecifications? > > > 3) Do we need to consider the range of deployments of L2 (home, > > > enterprise,=C2=A0 public PBB service, national PBB service, Data cent= ers) > > >=C2=A0 > > >=C2=A0 > > > Thank you,=C2=A0 Sue > > >=C2=A0 > > >=C2=A0 > > > -----Original Message----- > > > From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] > > > Sent: Thursday, June 25, 2020 1:01 AM > > > To: secdir@ietf.org > > > Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org > ; > > > i2rs@ietf.org ; last-call@ietf.org > > > > Subject: Secdir last call review of > > > draft-ietf-i2rs-yang-l2-network-topology-13 > > >=C2=A0 > > > Reviewer: Christian Huitema > > > Review result: Has Issues > > >=C2=A0 > > > I have reviewed this document as part of the security directorate's o= ngoing effort to > review all IETF documents being processed by the IESG.=C2=A0 These comm= ents > were written with the intent of improving security requirements and > considerations in IETF drafts.=C2=A0 Comments not addressed in last cal= l > may be included in AD reviews during the IESG review.=C2=A0 Document > editors and WG chairs should treat these comments just like any other > last call comments. > > >=C2=A0 > > > This document describes a Yang model for representing Link Layer topo= logies. > > > Representing such topologies is obviously useful for managing network= =2E > > > The security section is focused on securing the usage of this informa= tion for > network management, but does not address potential privacy issues. > > >=C2=A0 > > > The security considerations explain correctly how altering the link l= ayer > information could enable attacks against the network. The proposed > remedy is access control, implemented using either SSH or TLS. This is > fine, although the discussion of TLS authorisation is a bit short. By > default, TLS verifies the identity of the server but not that of the > client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD > require authentication based on TLS client certificates. I assume > that's the intent, but it might be useful to say so. > > >=C2=A0 > > > On the other hand, the security considerations do not describe privac= y issues, and > I find that problematic. The proposed information model lists a number > of sensitive data, such as for example the MAC addresses of devices. > > > This information can be misused. For example, applications could asse= ss device > location fetching the MAC addresses of local gateways. Third parties > could access link local information to gather identities of devices > accessing a particular network. Such information is often protected by > privacy API in the Operating System, but accessing the Yang module > over the network might allow applications to bypass these controls. > > >=C2=A0 > > > Client authentication alone does not necessarily protect against thes= e > privacy leaks. A classic configuration error would limit write access > to authorized users, but to allow read-only access to most users. This > kind of error would allow privacy leaks. Given the sensitive nature of > MAC addresses and other identifiers, it is useful to warn against such > errors. > > >=C2=A0 > > >=C2=A0 > > >=C2=A0 > > >=C2=A0 > > >=C2=A0 > > > _______________________________________________ > > > i2rs mailing list > > > i2rs@ietf.org > > > https://www.ietf.org/mailman/listinfo/i2rs > > >=C2=A0 > --------------D1256F2AD8D9EE12B56C05C7 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit

I like variant B better, although I would not single out the mac addresses in the "sabotage" warning.

My main concern is that network administrators will naturally be very concerned about information that is writable/creatable/deletable, because they understand the impact on the management of their network. However, they are not so concerned with read-only access, because reading information does not directly affect the operation of the network. My whole point is telling them, "you are documenting your L2 topology, it contains sensitive information, make sure that reading it is protected, not just writing it".

I agree that NETCONF and RESTCONF provide the right tools for protecting the information. My request is just to clearly tell network administrators to use these tools, do not leave read access wide open!

-- Christian Huitema

On 6/26/2020 4:37 AM, Qin Wu wrote:

Hi, Christian:

1.       NACM defined in RFC8341 has already provided mechanisms to restrict access to sensitive information to a minimal list of authorized client or agents and deal with privacy issue if my understanding is correct.

2.       Both NETCONF and RESTCONF will rely on transport protocol such as TLS to provide client authentication and server authentication, i.e., mutual authentication.

3.       The YANG security guideline defined in https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines

Provide perfect boilerplate to address both security consideration and privacy consideration.

My original proposal A to address your comments is:

OLD TEXT:

"

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      or the management-address.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size.

"

NEW TEXT:

"

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      ,the management-address or mac address of the devices.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

  o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size, mac-address.

"

 

With your proposed text, we could have the following proposal changes (Proposal B):

OLD TEXT:

"

6.  Security Considerations

 

   The YANG module specified in this document defines a schema for data

   that is designed to be accessed via network management protocols such

   as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer

   is the secure transport layer, and the mandatory-to-implement secure

   transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer

   is HTTPS, and the mandatory-to-implement secure transport is TLS

   [RFC8446].

 

   The Network Configuration Access Control Model (NACM) [RFC8341]

   provides the means to restrict access for particular NETCONF or

 

   RESTCONF users to a preconfigured subset of all available NETCONF or

   RESTCONF protocol operations and content.

 

   In general, Layer 2 network topologies are system-controlled and

   provide ephemeral topology information.  In an NMDA-complient server,

   they are only part of <operational> which provides read-only access

   to clients, they are less vulnerable.  That said, the YANG module

   does in principle allow information to be configurable.

 

   The Layer 2 topology module define information that can be

   configurable in certain instances, for example in the case of virtual

   topologies that can be created by client applications.  In such

   cases, a malicious client could introduce topologies that are

   undesired.  Specifically, a malicious client could attempt to remove

   or add a node, a link, a termination point, by creating or deleting

   corresponding elements in the node, link, and termination point

   lists, respectively.  In the case of a topology that is learned, the

   server will automatically prohibit such misconfiguration attempts.

   In the case of a topology that is configured, i.e. whose origin is

   "intended", the undesired configuration could become effective and be

   reflected in the operational state datastore, leading to disruption

   of services provided via this topology might be disrupted.  For those

   reasons, it is important that the NETCONF access control model is

   vigorously applied to prevent topology misconfiguration by

   unauthorized clients.

 

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      or the management-address.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size.

"

NEW TEXT:

"

6.  Security Considerations

 

   The YANG module specified in this document defines a schema for data

   that is designed to be accessed via network management protocols such

   as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer

   is the secure transport layer, and the mandatory-to-implement secure

   transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer

   is HTTPS, and the mandatory-to-implement secure transport is TLS

   [RFC8446].

 

   The Network Configuration Access Control Model (NACM) [RFC8341]

   provides the means to restrict access for particular NETCONF or

   RESTCONF users to a preconfigured subset of all available NETCONF or

   RESTCONF protocol operations and content.

 

   In general, Layer 2 network topologies are system-controlled and

   provide ephemeral topology information.  In an NMDA-complient server,

   they are only part of <operational> which provides read-only access

   to clients, they are less vulnerable.  That said, the YANG module

   does in principle allow information to be configurable.

 

   The Layer 2 topology module define information that can be

   configurable in certain instances, for example in the case of virtual

   topologies that can be created by client applications.  In such

   cases, a malicious client could introduce topologies that are

   undesired.  Specifically, a malicious client could attempt to remove

   or add a node, a link, a termination point, by creating or deleting

   corresponding elements in the node, link, and termination point

   lists, respectively.  In the case of a topology that is learned, the

   server will automatically prohibit such misconfiguration attempts.

   In the case of a topology that is configured, i.e. whose origin is

   "intended", the undesired configuration could become effective and be

   reflected in the operational state datastore, leading to disruption

   of services provided via this topology might be disrupted.  For those

   reasons, it is important that the NETCONF access control model is

   vigorously applied to prevent topology misconfiguration by

   unauthorized clients.

 

  The YANG model for layer 2 topology may expose sensitive information,

  for example the MAC addresses of devices. Unrestricted use of such information

   can lead to privacy violations. For example, listing MAC addresses in a network

   allows monitoring of devices and their movements. Location information can be derived

   from MAC addresses of network devices, bypassing protection of location information by

   the Operating System. Deployments should mitigate this privacy concerns by limiting access

   to the layer 2 topology information. Access to the information should be restricted to a

   minimal list of authorized clients, and should also require proper authentication of these clients.

 

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      ,the management-address, mac-address of the devices.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size, mac-address.

"

The question is do you think proposal with yang security boilterplate has already addressed your comments

Or you think we should emphasize how privacy issue can be addressed by NACM and client authentication is needed?

 

-Qin

-----邮件原件-----
发件人: Christian Huitema [mailto:huitema@huitema.net]
发送时间: 2020年6月26日 12:05
收件人: Susan Hares <shares@ndzh.com>; Qin Wu <bill.wu@huawei.com>; secdir@ietf.org
抄送: i2rs@ietf.org; draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; last-call@ietf.org
主题: Re: [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13

 

How about adding something like this:

 

Privacy Considerations

 

The Yang model for layer 2 topology exposes privacy sensitive information, for example the MAC addresses of devices. Unrestricted use of such information can lead to privacy violations. For example, listing MAC addresses in a network allows monitoring of devices and their movements. Location information can be derived from MAC addresses of network devices, bypassing protection of location information by the Operating System.

 

Deployments should mitigate this privacy concerns by limiting access to the layer 2 topology information. Access to the information should be restricted to a minimal list of authorized agents, and should require proper authentication of these agents.

 

-- Christian Huitema

 

On 6/25/2020 7:00 AM, Susan Hares wrote:

> Qin and Christian:

> 

> Thank you for your prompt attention to the privacy issue. 

> I'm sure Christian will respond in a bit - since he might be in PDT time-zone.

> 

> Once you have a solution you both like, we should validate the privacy

> changes to the security considerations section with the Yang-doctors,

> OPS-ADs, and Security-ADs.

> 

> Martin's watching this thread so I'm sure he'll help us out as well.

> 

> Sue

> 

> -----Original Message-----

> From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu

> Sent: Thursday, June 25, 2020 9:25 AM

> To: Susan Hares; 'Christian Huitema'; secdir@ietf.org

> Cc: i2rs@ietf.org;

> draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;

> last-call@ietf.org

> Subject: Re: [i2rs] Secdir last call review of

> draft-ietf-i2rs-yang-l2-network-topology-13

> 

> Sue and Christian:

> I have responded to Christian on privacy issue, my proposal is to add MAC address as another data node vulnerability example in our original security consideration section.

> But If Christian or security directorate has recommending text, we authors are happy to accept it.

> 

> -Qin

> -----邮件原件-----

> 发件人: Susan Hares [mailto:shares@ndzh.com]

> 发送时间: 2020年6月25日 21:04

> 收件人: 'Christian Huitema' <huitema@huitema.net>; secdir@ietf.org

> 抄送: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;

> i2rs@ietf.org; last-call@ietf.org

> 主题: RE: Secdir last call review of

> draft-ietf-i2rs-yang-l2-network-topology-13

> 

> Christian:

> 

> Thank you for catching the privacy issues.     

> 

> I've got a few questions to help the authors scope this change:

> 

> 1) Since this is common to all L2 Topologies, can you or the security directorate recommend some text that might be appropriate?

>    If you have recommended text, has this text been reviewed by OPS-DIR and Yang doctors?

> 

> 2) Will it be a problem If we write privacy considerations on IEEE specifications?

> 3) Do we need to consider the range of deployments of L2 (home,

> enterprise,  public PBB service, national PBB service, Data centers)

> 

> 

> Thank you,  Sue

> 

> 

> -----Original Message-----

> From: Christian Huitema via Datatracker [mailto:noreply@ietf.org]

> Sent: Thursday, June 25, 2020 1:01 AM

> To: secdir@ietf.org

> Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;

> i2rs@ietf.org; last-call@ietf.org

> Subject: Secdir last call review of

> draft-ietf-i2rs-yang-l2-network-topology-13

> 

> Reviewer: Christian Huitema

> Review result: Has Issues

> 

> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving security requirements and considerations in IETF drafts.  Comments not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments just like any other last call comments.

> 

> This document describes a Yang model for representing Link Layer topologies.

> Representing such topologies is obviously useful for managing network.

> The security section is focused on securing the usage of this information for network management, but does not address potential privacy issues.

> 

> The security considerations explain correctly how altering the link layer information could enable attacks against the network. The proposed remedy is access control, implemented using either SSH or TLS. This is fine, although the discussion of TLS authorisation is a bit short. By default, TLS verifies the identity of the server but not that of the client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD require authentication based on TLS client certificates. I assume that's the intent, but it might be useful to say so.

> 

> On the other hand, the security considerations do not describe privacy issues, and I find that problematic. The proposed information model lists a number of sensitive data, such as for example the MAC addresses of devices.

> This information can be misused. For example, applications could assess device location fetching the MAC addresses of local gateways. Third parties could access link local information to gather identities of devices accessing a particular network. Such information is often protected by privacy API in the Operating System, but accessing the Yang module over the network might allow applications to bypass these controls.

> 

> Client authentication alone does not necessarily protect against these privacy leaks. A classic configuration error would limit write access to authorized users, but to allow read-only access to most users. This kind of error would allow privacy leaks. Given the sensitive nature of MAC addresses and other identifiers, it is useful to warn against such errors.

> 

> 

> 

> 

> 

> _______________________________________________

> i2rs mailing list

> i2rs@ietf.org

> https://www.ietf.org/mailman/listinfo/i2rs

> 

--------------D1256F2AD8D9EE12B56C05C7-- From nobody Fri Jun 26 09:21:35 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id DF4143A0962; Fri, 26 Jun 2020 09:10:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1593187810; bh=JLQrNJPp5Jstwv2bz9Ud6vcjfBlANb1NHEMhzFxnddk=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=vcm+e9Vfw2uk7WpLCH1FHJStpk6zm/uYmjmdyB4izmcstMNhw5CXb3PIIkiXEoP8H 9nlCK7tWkE5R5/vtDIFc+XL9hs9xfWqTYbtburtStskIzNljq4ybrmASHzmlpeOU80 OswOtWDhIjzGKC6Y6okpJTg3hcYYgoFlUkjotvfI= X-Mailbox-Line: From new-work-bounces@ietf.org Fri Jun 26 09:10:03 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 363F73A094C; Fri, 26 Jun 2020 09:09:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1593187788; bh=JLQrNJPp5Jstwv2bz9Ud6vcjfBlANb1NHEMhzFxnddk=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=iZuKmCz6yCvC79USiLOMpNNcmmXdIuAnES3nqTTA5h+GmHzmaLT9qXU9GuaKfFX11 2jAUzoKf6HiX45P9VwXWXdJq/H6qgi1EnCElOOFf7x2W7uaQ/S829NA323LcDEU3LO 1SrAdL1eSk9MbjV6dSlcuCIF5JMqVQ+6vtI5lCXM= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 52AC83A08F0 for ; Fri, 26 Jun 2020 09:09:41 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.4.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <159318778131.29096.10852742639187839770@ietfa.amsl.com> Date: Fri, 26 Jun 2020 09:09:41 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Fri, 26 Jun 2020 09:21:33 -0700 Subject: [secdir] [new-work] WG Review: Grant Negotiation and Authorization Protocol (gnap) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 16:10:19 -0000 QSBuZXcgSUVURiBXRyBoYXMgYmVlbiBwcm9wb3NlZCBpbiB0aGUgU2VjdXJpdHkgQXJlYS4gVGhl IElFU0cgaGFzIG5vdCBtYWRlCmFueSBkZXRlcm1pbmF0aW9uIHlldC4gVGhlIGZvbGxvd2luZyBk cmFmdCBjaGFydGVyIHdhcyBzdWJtaXR0ZWQsIGFuZCBpcwpwcm92aWRlZCBmb3IgaW5mb3JtYXRp b25hbCBwdXJwb3NlcyBvbmx5LiBQbGVhc2Ugc2VuZCB5b3VyIGNvbW1lbnRzIHRvIHRoZQpJRVNH IG1haWxpbmcgbGlzdCAoaWVzZ0BpZXRmLm9yZykgYnkgMjAyMC0wNy0wNi4KCkdyYW50IE5lZ290 aWF0aW9uIGFuZCBBdXRob3JpemF0aW9uIFByb3RvY29sIChnbmFwKQotLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQpD dXJyZW50IHN0YXR1czogUHJvcG9zZWQgV0cKCkNoYWlyczoKICBZYXJvbiBTaGVmZmVyIDx5YXJv bmYuaWV0ZkBnbWFpbC5jb20+CiAgTGVpZiBKb2hhbnNzb24gPGxlaWZqQHN1bmV0LnNlPgoKQXNz aWduZWQgQXJlYSBEaXJlY3RvcjoKICBSb21hbiBEYW55bGl3IDxyZGRAY2VydC5vcmc+CgpTZWN1 cml0eSBBcmVhIERpcmVjdG9yczoKICBCZW5qYW1pbiBLYWR1ayA8a2FkdWtAbWl0LmVkdT4KICBS b21hbiBEYW55bGl3IDxyZGRAY2VydC5vcmc+CgpNYWlsaW5nIGxpc3Q6CiAgQWRkcmVzczogdHhh dXRoQGlldGYub3JnCiAgVG8gc3Vic2NyaWJlOiDigItodHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL3R4YXV0aAogIEFyY2hpdmU6IGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5v cmcvYXJjaC9icm93c2UvdHhhdXRoLwoKR3JvdXAgcGFnZTogaHR0cHM6Ly9kYXRhdHJhY2tlci5p ZXRmLm9yZy9ncm91cC9nbmFwLwoKQ2hhcnRlcjogaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9y Zy9kb2MvY2hhcnRlci1pZXRmLWduYXAvCgpUaGlzIGdyb3VwIGlzIGNoYXJ0ZXJlZCB0byBkZXZl bG9wIGEgZmluZS1ncmFpbmVkIGRlbGVnYXRpb24gcHJvdG9jb2wgZm9yCmF1dGhvcml6YXRpb24g YW5kIEFQSSBhY2Nlc3MsIGFzIHdlbGwgYXMgcmVxdWVzdGluZyBhbmQgcHJvdmlkaW5nIHVzZXIK aWRlbnRpZmllcnMgYW5kIGNsYWltcy4gVGhpcyBwcm90b2NvbCB3aWxsIGFsbG93IGFuIGF1dGhv cml6aW5nIHBhcnR5IHRvCmRlbGVnYXRlIGFjY2VzcyB0byBjbGllbnQgc29mdHdhcmUgdGhyb3Vn aCBhbiBhdXRob3JpemF0aW9uIHNlcnZlci4gSXQgd2lsbApleHBhbmQgdXBvbiB0aGUgdXNlcyBj YXNlcyBjdXJyZW50bHkgc3VwcG9ydGVkIGJ5IE9BdXRoIDIuMCBhbmQgT3BlbklEIENvbm5lY3QK KGl0c2VsZiBhbiBleHRlbnNpb24gb2YgT0F1dGggMi4wKSB0byBzdXBwb3J0IGF1dGhvcml6YXRp b25zIHNjb3BlZCBhcwpuYXJyb3dseSBhcyBhIHNpbmdsZSB0cmFuc2FjdGlvbiwgcHJvdmlkZSBh IGNsZWFyIGZyYW1ld29yayBmb3IgaW50ZXJhY3Rpb24KYW1vbmcgYWxsIHBhcnRpZXMgaW52b2x2 ZWQgaW4gdGhlIHByb3RvY29sIGZsb3csIGFuZCByZW1vdmUgdW5uZWNlc3NhcnkKZGVwZW5kZW5j ZSBvbiBhIGJyb3dzZXIgb3IgdXNlci1hZ2VudCBmb3IgY29vcmRpbmF0aW5nIGludGVyYWN0aW9u cy4KClRoZSBkZWxlZ2F0aW9uIHByb2Nlc3Mgd2lsbCBiZSBhY3RlZCB1cG9uIGJ5IG11bHRpcGxl IHBhcnRpZXMgaW4gdGhlIHByb3RvY29sLAplYWNoIHBlcmZvcm1pbmcgYSBzcGVjaWZpYyByb2xl LiBUaGUgcHJvdG9jb2wgd2lsbCBkZWNvdXBsZSB0aGUgaW50ZXJhY3Rpb24KY2hhbm5lbHMsIHN1 Y2ggYXMgdGhlIGVuZCB1c2Vy4oCZcyBicm93c2VyLCBmcm9tIHRoZSBkZWxlZ2F0aW9uIGNoYW5u ZWwsIHdoaWNoCmhhcHBlbnMgZGlyZWN0bHkgYmV0d2VlbiB0aGUgY2xpZW50IGFuZCB0aGUgYXV0 aG9yaXphdGlvbiBzZXJ2ZXIgKGluIGNvbnRyYXN0CndpdGggT0F1dGggMi4wLCB3aGljaCBpcyBp bml0aWF0ZWQgYnkgdGhlIGNsaWVudCByZWRpcmVjdGluZyB0aGUgdXNlcuKAmXMKYnJvd3Nlciku IFRoZSBwcm90b2NvbCB3aWxsIGluY2x1ZGUgYSBtZWFucyBvZiBzcGVjaWZ5aW5nIGhvdyB0aGUg dXNlciBjYW4KcG90ZW50aWFsbHkgYmUgaW52b2x2ZWQgaW4gYW4gaW50ZXJhY3RpdmUgZmFzaGlv biBkdXJpbmcgdGhlIGRlbGVnYXRpb24KcHJvY2Vzcy4gVGhlIGNsaWVudCBhbmQgQXV0aG9yaXph dGlvbiBTZXJ2ZXIgKEFTKSB3aWxsIHVzZSB0aGVzZSBpbnRlcmFjdGlvbgptZWNoYW5pc21zIHRv IGludm9sdmUgdGhlIHVzZXIsIGFzIG5lY2Vzc2FyeSwgdG8gbWFrZSBhdXRob3JpemF0aW9uIGRl Y2lzaW9ucy4KVGhpcyBkZWNvdXBsaW5nIGF2b2lkcyBtYW55IG9mIHRoZSBzZWN1cml0eSBjb25j ZXJucyBhbmQgdGVjaG5pY2FsIGNoYWxsZW5nZXMKb2YgT0F1dGggMi4wIGFuZCBwcm92aWRlcyBh IG5vbi1pbnZhc2l2ZSBwYXRoIGZvciBzdXBwb3J0aW5nIGZ1dHVyZSB0eXBlcyBvZgpjbGllbnRz IGFuZCBpbnRlcmFjdGlvbiBjaGFubmVscy4KClRoZSBncm91cCB3aWxsIGRlZmluZSBpbnRlcm9w ZXJhYmlsaXR5IGZvciB0aGlzIHByb3RvY29sIGJldHdlZW4gZGlmZmVyZW50CnBhcnRpZXMsIGlu Y2x1ZGluZwogLSBjbGllbnQgYW5kIGF1dGhvcml6YXRpb24gc2VydmVyOwogLSBjbGllbnQgYW5k IHJlc291cmNlIHNlcnZlcjsgYW5kCiAtIGF1dGhvcml6YXRpb24gc2VydmVyIGFuZCByZXNvdXJj ZSBzZXJ2ZXIuCgpUaGUgZ3JvdXAgd2lsbCBzZWVrIHRvIG1pbmltaXplIGFzc3VtcHRpb25zIGFi b3V0IHRoZSBmb3JtIG9mIGNsaWVudAphcHBsaWNhdGlvbnMsIGFsbG93aW5nIGZvcjoKLSBGaW5l LWdyYWluZWQgc3BlY2lmaWNhdGlvbiBvZiBhY2Nlc3MKLSBBcHByb3ZhbCBvZiBBUyBhdHRlc3Rh dGlvbiB0byBpZGVudGlmaWVycyBhbmQgb3RoZXIgaWRlbnRpdHkgY2xhaW1zCi0gQXBwcm92YWwg b2YgYWNjZXNzIHRvIG11bHRpcGxlIHJlc291cmNlcyBhbmQgQVBJcyBpbiBhIHNpbmdsZSBpbnRl cmFjdGlvbgotIFN1cHBvcnQgZm9yIG11bHRpcGxlIGFjY2VzcyB0b2tlbnMgaW4gYSBzaW5nbGUg cmVxdWVzdCBhbmQgcmVzcG9uc2UKLSBTdXBwb3J0IGZvciBkaXJlY3RlZCwgYXVkaWVuY2UtcmVz dHJpY3RlZCBhY2Nlc3MgdG9rZW5zCi0gU2VwYXJhdGlvbiBiZXR3ZWVuIHRoZSBwYXJ0eSBhdXRo b3JpemluZyBhY2Nlc3MgYW5kIHRoZSBwYXJ0eSBvcGVyYXRpbmcgdGhlCmNsaWVudCByZXF1ZXN0 aW5nIGFjY2VzcwoKVGhlIGdyb3VwIHdpbGwgZGVmaW5lIGV4dGVuc2lvbiBwb2ludHMgZm9yIHRo aXMgcHJvdG9jb2wgdG8gYWxsb3cgZm9yCmZsZXhpYmlsaXR5IGluIGFyZWFzIGluY2x1ZGluZzoK Ci0gQ3J5cHRvZ3JhcGhpYyBhZ2lsaXR5IGZvciBrZXlzLCBtZXNzYWdlIHNpZ25hdHVyZXMsIGFu ZCBwcm9vZiBvZiBwb3NzZXNzaW9uCi0gVXNlciBpbnRlcmFjdGlvbiBtZWNoYW5pc21zIGluY2x1 ZGluZyB3ZWIgYW5kIG5vbi13ZWIgbWV0aG9kcwotIE1lY2hhbmlzbXMgZm9yIGNvbnZleWluZyB1 c2VyLCBzb2Z0d2FyZSwgb3JnYW5pemF0aW9uLCBhbmQgb3RoZXIKaW5mb3JtYXRpb24gdXNlZCBp biBhdXRob3JpemF0aW9uIGRlY2lzaW9ucwotIE1lY2hhbmlzbXMgZm9yIHByZXNlbnRpbmcgdG9r ZW5zIHRvIHJlc291cmNlIHNlcnZlcnMgYW5kIGJpbmRpbmcgcmVzb3VyY2UKcmVxdWVzdHMgdG8g dG9rZW5zIGFuZCBhc3NvY2lhdGVkIGNyeXB0b2dyYXBoaWMga2V5cwotIE9wdGltaXplZCBpbmNs dXNpb24gb2YgYWRkaXRpb25hbCBpbmZvcm1hdGlvbiAoaW5jbHVkaW5nIGlkZW50aWZpZXJzIGFu ZAppZGVudGl0eSBhc3NlcnRpb25zKSB0aHJvdWdoIHRoZSBkZWxlZ2F0aW9uIHByb2Nlc3MKCkFk ZGl0aW9uYWxseSwgdGhlIGdyb3VwIHdpbGwgcHJvdmlkZSBtZWNoYW5pc21zIGZvciBtYW5hZ2Vt ZW50IG9mIHRoZSBwcm90b2NvbApsaWZlY3ljbGUgaW5jbHVkaW5nOgoKLSBEaXNjb3Zlcnkgb2Yg dGhlIGF1dGhvcml6YXRpb24gc2VydmVyCi0gUmV2b2NhdGlvbiBvZiBhY3RpdmUgdG9rZW5zCi0g TWVjaGFuaXNtcyBmb3IgdGhlIEFTIGFuZCBSUyB0byBjb21tdW5pY2F0ZSB0aGUgYWNjZXNzIGdy YW50ZWQgYnkgYW4gYWNjZXNzCnRva2VuCgpBbHRob3VnaCB0aGUgYXJ0aWZhY3RzIGZvciB0aGlz IHdvcmsgYXJlIG5vdCBpbnRlbmRlZCBvciBleHBlY3RlZCB0byBiZQpiYWNrd2FyZHMtY29tcGF0 aWJsZSB3aXRoIE9BdXRoIDIuMCBvciBPcGVuSUQgQ29ubmVjdCwgdGhlIGdyb3VwIHdpbGwgYXR0 ZW1wdAp0byBzaW1wbGlmeSBtaWdyYXRpbmcgZnJvbSBPQXV0aCAyLjAgYW5kIE9wZW5JRCBDb25u ZWN0IHRvIHRoZSBuZXcgcHJvdG9jb2wKd2hlcmUgcG9zc2libGUuCgpUaGlzIGdyb3VwIGlzIG5v dCBjaGFydGVyZWQgdG8gZGV2ZWxvcCBleHRlbnNpb25zIHRvIE9BdXRoIDIuMCwgYW5kIGFzIHN1 Y2gKd2lsbCBmb2N1cyBvbiBuZXcgdGVjaG5vbG9naWNhbCBzb2x1dGlvbnMgbm90IG5lY2Vzc2Fy aWx5IGNvbXBhdGlibGUgd2l0aApPQXV0aCAyLjAuIEZ1bmN0aW9uYWxpdHkgdGhhdCBidWlsZHMg ZGlyZWN0bHkgb24gT0F1dGggMi4wIHdpbGwgYmUgZGlyZWN0ZWQKdG8gdGhlIE9BdXRoIFdvcmtp bmcgR3JvdXAsIGluY2x1ZGluZyBmdW5jdGlvbmFsaXR5IGJhY2stcG9ydGVkIGZyb20gdGhlCnBy b3RvY29sIGRldmVsb3BlZCBoZXJlIHRvIE9BdXRoIDIuMC4KClRoZSBncm91cCBpcyBjaGFydGVy ZWQgdG8gZGV2ZWxvcCBtZWNoYW5pc21zIGZvciBhcHBseWluZyBjcnlwdG9ncmFwaGljCm1ldGhv ZHMsIHN1Y2ggYXMgSk9TRSBhbmQgQ09TRSwgdG8gdGhlIGRlbGVnYXRpb24gcHJvY2Vzcy4gVGhp cyBncm91cCBpcyBub3QKY2hhcnRlcmVkIHRvIGRldmVsb3AgbmV3IGNyeXB0b2dyYXBoaWMgbWV0 aG9kcy4KClRoZSBncm91cCBpcyBjaGFydGVyZWQgdG8gZGV2ZWxvcCBtZWNoYW5pc21zIGZvciBj b252ZXlpbmcgaWRlbnRpdHkKaW5mb3JtYXRpb24gd2l0aGluIHRoZSBwcm90b2NvbCBpbmNsdWRp bmcgZXhpc3RpbmcgaWRlbnRpZmllcnMgKHN1Y2ggYXMgZW1haWwKYWRkcmVzc2VzLCBwaG9uZSBu dW1iZXJzLCB1c2VybmFtZXMsIGFuZCBzdWJqZWN0IGlkZW50aWZpZXJzKSBhbmQgYXNzZXJ0aW9u cwooc3VjaCBhcyBPcGVuSUQgQ29ubmVjdCBJRCBUb2tlbnMsIFNBTUwgQXNzZXJ0aW9ucywgYW5k IFZlcmlmaWFibGUKQ3JlZGVudGlhbHMpLiBUaGUgZ3JvdXAgaXMgbm90IGNoYXJ0ZXJlZCB0byBk ZXZlbG9wIG5ldyBmb3JtYXRzIGZvcgppZGVudGlmaWVycyBvciBhc3NlcnRpb25zLCBub3IgaXMg dGhlIGdyb3VwIGNoYXJ0ZXJlZCB0byBkZXZlbG9wIHNjaGVtYXMgZm9yCnVzZXIgaW5mb3JtYXRp b24sIHByb2ZpbGVzLCBvciBvdGhlciBpZGVudGl0eSBhdHRyaWJ1dGVzLCB1bmxlc3MgYSB2aWFi bGUKZXhpc3RpbmcgZm9ybWF0IGlzIG5vdCBhdmFpbGFibGUuCgpUaGUgaW5pdGlhbCB3b3JrIHdp bGwgZm9jdXMgb24gdXNpbmcgSFRUUFMgZm9yIGNvbW11bmljYXRpb24gYmV0d2VlbiB0aGUKY2xp ZW50IGFuZCB0aGUgYXV0aG9yaXphdGlvbiBzZXJ2ZXIsIHRha2luZyBhZHZhbnRhZ2Ugb2Ygb3B0 aW1pemF0aW9uCmZlYXR1cmVzIG9mIEhUVFAvMiBhbmQgSFRUUC8zIHdoZXJlIHBvc3NpYmxlLCBh bmQgd2lsbCBzdHJpdmUgdG8gZW5hYmxlCnNpbXBsZSBtYXBwaW5nIHRvIG90aGVyIHByb3RvY29s cyBzdWNoIGFzIENPQVAgd2hlbiBkb2luZyBzbyBkb2VzIG5vdApjb25mbGljdCB3aXRoIHRoZSBw cmltYXJ5IGZvY3VzLgoKTWlsZXN0b25lcyB0byBpbmNsdWRlOgotIENvcmUgZGVsZWdhdGlvbiBw cm90b2NvbAotIEtleSBwcmVzZW50YXRpb24gbWVjaGFuaXNtIGJpbmRpbmdzIHRvIHRoZSBjb3Jl IHByb3RvY29sIGluY2x1ZGluZyBUTFMsCmRldGFjaGVkIEhUVFAgc2lnbmF0dXJlLCBhbmQgZW1i ZWRkZWQgSFRUUCBzaWduYXR1cmVzCi0gQ29udmV5YW5jZSBtZWNoYW5pc21zIGZvciBpZGVudGlm aWVycyBhbmQgYXNzZXJ0aW9ucwotIEd1aWRlbGluZXMgZm9yIHVzZSBvZiBwcm90b2NvbCBleHRl bnNpb24gcG9pbnRzCi0gKGlmIG5lZWRlZCkgR3VpZGVsaW5lcyBvbiBtaWdyYXRpb24gcGF0aHMs IGltcGxlbWVudGF0aW9uLCBhbmQgb3BlcmF0aW9ucwoKV2hlcmUgcG9zc2libGUsIHRoZSBncm91 cCB3aWxsIHNlZWsgdG8gbWFrZSB1c2Ugb2YgdG9vbHMgdG8gZ3VpZGUgYW5kIGluZm9ybQp0aGUg c3RhbmRhcmRpemF0aW9uIHByb2Nlc3MgaW5jbHVkaW5nIGZvcm1hbCBhbmFseXNpcywgYXJjaGl0 ZWN0dXJlIGRvY3VtZW50cywKYW5kIHVzZSBjYXNlIGRvY3VtZW50cy4gVGhlc2UgYXJ0aWZhY3Rz IHdpbGwgbm90IGJlIGNvbnNpZGVyZWQgYXMgd29ya2luZwpncm91cCBtaWxlc3RvbmVzIG9yIGRl bGl2ZXJhYmxlcy4KClRoZSB3b3JraW5nIGdyb3VwIHdpbGwgY29vcGVyYXRlIGFuZCBjb29yZGlu YXRlIHdpdGggb3RoZXIgSUVURiBXR3Mgc3VjaCBhcwpPQVVUSCwgYW5kIHdvcmsgd2l0aCBleHRl cm5hbCBvcmdhbml6YXRpb25zLCBzdWNoIGFzIHRoZSBPcGVuSUQgRm91bmRhdGlvbiwKYXMgYXBw cm9wcmlhdGUuCgpNaWxlc3RvbmVzOgoKICBKdWwgMjAyMSAtIENvcmUgZGVsZWdhdGlvbiBwcm90 b2NvbCBpbiBXR0xDCgogIE9jdCAyMDIxIC0gS2V5IHByZXNlbnRhdGlvbiBtZWNoYW5pc20gYmlu ZGluZyB0byB0aGUgY29yZSBwcm90b2NvbCwgVExTLCB0bwogIFdHTEMKCiAgT2N0IDIwMjEgLSBL ZXkgcHJlc2VudGF0aW9uIG1lY2hhbmlzbSBiaW5kaW5nIHRvIHRoZSBjb3JlIHByb3RvY29sLCAK ICBkZXRhY2hlZCBIVFRQIHNpZ25hdHVyZXMsIHRvIFdHTEMKCiAgT2N0IDIwMjEgLSBLZXkgcHJl c2VudGF0aW9uIG1lY2hhbmlzbSBiaW5kaW5nIHRvIHRoZSBjb3JlIHByb3RvY29sLAogIGVtYmVk ZGVkIEhUVFAgc2lnbmF0dXJlLCB0byBXR0xDCgogIERlYyAyMDIxIC0gR3VpZGVsaW5lcyBmb3Ig dXNlIG9mIHByb3RvY29sIGV4dGVuc2lvbiBwb2ludHMgdG8gV0dMQwoKICBGZWIgMjAyMiAtIEd1 aWRlbGluZXMgb24gbWlncmF0aW9uIHBhdGhzLCBpbXBsZW1lbnRhdGlvbiwgYW5kIG9wZXJhdGlv bnMgdG8KICAgV0dMQwoKCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpuZXctd29yayBtYWlsaW5nIGxpc3QKbmV3LXdvcmtAaWV0Zi5vcmcKaHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9uZXctd29yawo= From nobody Fri Jun 26 09:21:39 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C3AF3A0964; Fri, 26 Jun 2020 09:15:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1593188103; bh=Dv16v/yCOPWKahkTlAEItl64wYaZu1/CT8fFPkaaRzY=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=GCz6zTB1jwHmDwRAU8ZlfF/esj0nd1NDDQbRczMI7W7GM9PNMmGEzNb4NAhhjUPDG LbnOf++3Qwd0QyozBDkwlXzhi9U0IVMpqYZ0r3EhmEX+z7SnK9Oz8Ap3MAz0rYCCte 9zg7prWLjrOY96cPjTnl7LIoQlUr0nKITI/vNR88= X-Mailbox-Line: From new-work-bounces@ietf.org Fri Jun 26 09:14:55 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 48FDF3A0941; Fri, 26 Jun 2020 09:14:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1593188073; bh=Dv16v/yCOPWKahkTlAEItl64wYaZu1/CT8fFPkaaRzY=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=KMMJGnv0SLi56NpnpwNj7rANRpz1bp8QAIM+3dZA91SGr/R9yTAxN/BH0XsmVRgx/ VtN+nG/rpAmDhfw6WJyCQYV7eXhqMMP+Axdade5xWB9GCocCpaIsrE0+WQsI1gjS3q QzkMFu6vJxgri7QnxXOkzSVETmjswn69n3GyDc64= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 0448B3A08F0 for ; Fri, 26 Jun 2020 09:14:25 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.4.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <159318806500.29096.12972185696600236148@ietfa.amsl.com> Date: Fri, 26 Jun 2020 09:14:25 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Fri, 26 Jun 2020 09:21:33 -0700 Subject: [secdir] [new-work] WG Review: Privacy Pass (privacypass) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 16:15:12 -0000 A new IETF WG has been proposed in the Security Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2020-07-06. Privacy Pass (privacypass) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Benjamin Schwartz Joseph Salowey Assigned Area Director: Benjamin Kaduk Security Area Directors: Benjamin Kaduk Roman Danyliw Mailing list: Address: privacy-pass@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/privacy-pass Archive: https://mailarchive.ietf.org/arch/browse/privacy-pass/ Group page: https://datatracker.ietf.org/group/privacypass/ Charter: https://datatracker.ietf.org/doc/charter-ietf-privacypass/ The Privacy Pass protocol provides a performant, application-layer mechanism for token creation and anonymous redemption. Servers (Issuers) create and later verify tokens that are redeemed by an ecosystem of clients, such that: - An Issuer cannot link a redeemed token to one of N previously created tokens using the same key with probability non-negligibly larger than 1/N. - Clients can verify that a token created by an Issuer corresponds to a committed keypair. - Tokens are unforgeable. - The token issuance and redemption mechanisms are efficient. The primary purpose of the Privacy Pass Working Group is to develop and standardize a protocol that meets these requirements, influenced by applications that have arisen from the wider community. The aims of the Working Group can be split into three distinct goals: First, specify an extensible protocol for creating and redeeming anonymous and transferrable tokens. The protocol should permit suitable cryptographic ciphersuites and security parameterization for cryptographic agility. The cryptographic profile used by the protocol participants will be determined by the specific instantiation of the protocol, and it will be fixed for the duration of an Issuer's committed keypair. We will work closely with the CFRG in determining acceptable cryptographic ciphersuites and parameters that satisfy the security and privacy properties of the protocol. The Working Group will specify a preliminary set of extensions, including Issuer-supplied metadata and cryptographic instantiations that additionally support public verifiability of Issued tokens, and may consider any additional extensions that arise in the future. Security and privacy properties of the protocol shall be well-documented. Formal analysis of the protocol will ensure that the security and privacy properties of the protocol are well-understood and well-documented. Second, describe and develop protocol use cases and properties thereof. This includes, though is not limited to: 1. Describing use cases and interfaces that allow the protocol to be used for those use cases. 2. Defining the privacy goals for each Client during protocol execution, along with expectations placed on the Issuers and the ecosystem at large. 3. Describing recommended parameterization(s) of variables associated with the protocol ecosystem that control the size of the anonymity set that the client belongs to. 4. Describing verification mechanisms for trusting Issuers and their corresponding keying material. Such mechanisms should prevent Issuers from presenting any key material that could be used to deanonymize clients. 5. Describing the procedure for including small amounts of metadata with Issued tokens, as well as the associated impacts on privacy. 6. Describing the risk and possible ramifications of Issuer centralization, and exploring possible mechanisms to mitigate these risks. Third, and finally, specify a HTTP-layer API for the protocol. This includes a common understanding of how Privacy Pass is integrated with HTTP requests and responses for web-based applications. The following milestones (along with the approximate dates of completion) will be used to judge the progress of the working group: - Specification of protocol & surrounding architecture - February 2021. - Risk assessment for centralization in Privacy Pass deployments for multiple design options - February 2021 - Specification of application-layer requirements (including HTTP integration) - June 2021. - Specification of HTTP browser API (in coordination with W3C) - October 2021. Note that the specifications developed by this working group will be informed by the following initial drafts: - draft-davidson-pp-protocol-00; - draft-davidson-pp-architecture-00; - draft-svaldez-pp-http-api-00. These existing drafts may be further developed into the core deliverables of the working group, supplemented by any additional extensions. Alternatively, they may contribute indirectly to a future set of documents that meet the core goals of the working group. Milestones: TDB _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Fri Jun 26 09:21:43 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EC9F3A0943; Fri, 26 Jun 2020 09:20:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1593188434; bh=9V4DtbeeFlFG3QLiib8QExpT3e80XCOFvYXNRhXhIgY=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=j+EF0M3ZDOh5oUg0nG25nA/+pENJAJ7/QnYkvFia/RNOe1nGPm3toksn/UDwGUx6J +dAFXcZuXq6GWxMpnZTktLvCLuQGYkMgzvNzKnZ3CMnqMRf9sac1IJ8bdCh60o/+iE FlLPPNYp5OIyavqPG+SdEkClOoGO9zuDbFZl9ikU= X-Mailbox-Line: From new-work-bounces@ietf.org Fri Jun 26 09:20:26 2020 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 592AB3A0954; Fri, 26 Jun 2020 09:20:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1593188409; bh=9V4DtbeeFlFG3QLiib8QExpT3e80XCOFvYXNRhXhIgY=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=PAfdkwETEC46q62MMYK/W/3vBgoebJl7Lnbwk/lBb3e+Q/aIrfPA4Te6TAJsALmvG m1fW2v59imCokBHGgWMOaQMaECxXOEflS/mb2t9UUevCbdH2eU1aEPEdOXLNN6osqo X76L2sFjlTmKsWGwLHUPyK8P92j8YveegxP9C39g= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C04943A0900 for ; Fri, 26 Jun 2020 09:20:01 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.4.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <159318840177.4951.10212351657376096083@ietfa.amsl.com> Date: Fri, 26 Jun 2020 09:20:01 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Fri, 26 Jun 2020 09:21:33 -0700 Subject: [secdir] [new-work] WG Review: Stay Home Meet Only Online (shmoo) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Jun 2020 16:20:42 -0000 A new IETF WG has been proposed in the General Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2020-07-06. Stay Home Meet Only Online (shmoo) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: Amelia Andersdotter Suresh Krishnan Assigned Area Director: Alissa Cooper General Area Directors: Alissa Cooper Mailing list: Address: manycouches@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/manycouches Archive: https://mailarchive.ietf.org/arch/browse/manycouches/ Group page: https://datatracker.ietf.org/group/shmoo/ Charter: https://datatracker.ietf.org/doc/charter-ietf-shmoo/ The COVID-19 pandemic has disrupted the IETF's typical schedule of three in-person meetings per year. It has caused the IETF to have to convert previously scheduled in-person meetings into fully online meetings. Although it is the first time the IETF's meeting schedule has been disrupted, it is possible that other crises could cause similar disruptions in the future. Even in the absence of the pandemic, discussions about the possibility of fully online meetings had been occurring in the IETF community for years as a result of general increases in remote attendance, improvements in web conferencing services, concerns about the environmental impact of travel, and other reasons. The meeting planning activities that the IESG and the IETF LLC engage in would benefit from IETF community consensus guidance concerning novel aspects raised by these developments. The SHMOO working group is therefore chartered to document high-level guidance and principles to the IESG and the IETF LLC. The guidance and principles will concern the following: - Determinations of when a previously scheduled in-person meeting should be canceled and replaced with a fully online meeting. Similar to how RFC 8718 establishes community principles and guidance for the selection of meeting venues, the IESG and the LLC would benefit from community consensus guidelines about which factors to consider when deciding to cancel or replace an in-person meeting and the relative importance of those factors. This work item is expected to be fulfilled with the publication of a BCP. - Meeting planning in the event that a previously scheduled in-person meeting needs to be canceled and replaced with a fully online meeting. Similar to how RFC 8719 establishes guidance for the regional rotation of in-person meetings, the IESG and the LLC would benefit from having community consensus guidelines about the time zone selection, meeting length in days, and other high-level scheduling aspects when an in-person meeting must be canceled. This work item is expected to be fulfilled with the publication of one or more BCPs. - Functional requirements for the technologies the IETF uses to support fully online meetings. This work item is expected to be fulfilled with one or more informational RFCs. - Determinations about the meeting fee for fully online meetings. Since remote participation in in-person meetings has historically been at zero cost to participants, LLC and IESG decisions about meeting fees for fully online meetings need to be informed by community consensus guidelines about whether and how to set a registration fee for fully online meetings. This work item is expected to be fulfilled with the publication of one or more informational RFCs. Suggestions for changing the IETF's overall funding model are out of scope. - The cadence of meeting scheduling and the mix of in-person versus fully online meetings going forward once the disruptions caused by the pandemic have subsided. The working group is expected to document the expected future meeting cadence as a BCP if consensus emerges to depart from the existing cadence of three in-person meetings per year. Notably, any such guidance will not become actionable until 3-4 years after it achieves consensus, given the length of the IETF meeting planning cycle. The working group will not progress this work item until it has requested publication for all of its meeting cancellation-related work items. The work of SHMOO is expected to produce high-level principles, not detailed operational plans. Specifications of details concerning cancellation criteria, meeting technologies, and online meeting agenda formats and content are out of scope. Aside from the fourth work item above, discussion of financial aspects of IETF meetings and changes to RFC 8713 are both out of scope. The goal is to produce guidelines for the IESG and the IETF LLC to operationalize while ensuring they have substantial flexibility to continue to deliver and evolve the IETF meeting experience to best serve IETF participants and the Internet community at large. The disruptions caused by the COVID-19 pandemic may have been mitigated by the time this group completes its work, but the experience of handling meeting planning during the pandemic has proven that having community consensus guidance at hand when dealing with novel conditions in the future would be beneficial. Milestones: TBD _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Fri Jun 26 22:34:45 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80EE53A0D45; Fri, 26 Jun 2020 22:34:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.1 X-Spam-Level: X-Spam-Status: No, score=-2.1 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=outlook.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t_cMDthSY7Li; Fri, 26 Jun 2020 22:34:36 -0700 (PDT) Received: from NAM12-MW2-obe.outbound.protection.outlook.com (mail-mw2nam12olkn2062.outbound.protection.outlook.com [40.92.23.62]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0BFF63A0D44; Fri, 26 Jun 2020 22:34:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=A8yJbFpn5OmYHtilAdPKusjCFuGp1bwwIy3cvJBPimcVnWz9AOjQkMhCR11MUGI5aFZp9VC7cmBWGTd1ICh8WDzeY8KdfQl1+wdNtvDzb20We/j7WMbRmAhBXNrPU6NJiYFcFRMRJk/ZyCwlUvaRdt/1SbD0GN8egMQ7HzHiUdiOD09SMbXYb6bUzYb4UzgInWBSu3t//Bm6Vm2RXkn1UlMfDRSBakFudMWTVC6pjF802SyRAQStykWqF/Xp/BHUeVDYw7PiR3cL0oMK4bBxZLDx37dG5LFC7SIaGd+D8bTfpVJYdjj05CyTo4ewiCdN4oXJDd+/88E9ML+0MwnQUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ANGlOXNffPejA5JHU/RTg6gk3XF+XGmSLS1DLhyFepk=; b=hQ+fGMLw5Fh5pM0qFZ9ry6TjUOjFwJg6/pTNyj8GdwJp5Cm/D5f0NJP28K0kCGxhloSrmAhoeoGLbK3JoRcrZ1j+bRRrJgWqhuWQJEmyIBaWr4XXiKTV+TfVdJQ5dJEpidDR6dxDfBRWhOOO8e7Ur3NzkfSmysosCbC6vJXAh7HQlDlOOvs4Hjue/vyjwmWttPfF16rA8bQDibusOdwNA7vwEfcpBelfMnWBbEjh58RaqjJg78rEqwsu529r6UrfRCGZmrf1MfrnIS1mlKulofwgA8Oxq7EgGyUrbOg9DlI8ifxPHrvSu+yfYRz2MMyclQguSubUHT0NVSnpPxf3LA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ANGlOXNffPejA5JHU/RTg6gk3XF+XGmSLS1DLhyFepk=; b=a6D7YcqYGuPceul6Mm4TWOAA5L0dI0hEv+qyeW2C6ztGXRuHdHTAihG8p7491Et9dqXp7UGrmNJNTmUtqskMjw4r9U6vj9Q6cy2RyTNp803QZkJ3UHylYeVJRi2Wu2kMOO3rSEMACcBCzKF6R62WhxKLL322UWv5dWY+cjRiCLiSVXD9M+AybnWzQwM4+m1+UH4/t229CszhTl11mk2kw5Q1XmjslVKXOIjVow9DBob6j9rvPECm+jnAuT6NK054PbBaHQ56dvYcQy6LFYFJa/h1ohAPIBIpG6s4sRBNFyvFQJLsbB/QdzMtsO+sLNKJr48/+xDb0vM+GQN/QSPdVw== Received: from DM6NAM12FT032.eop-nam12.prod.protection.outlook.com (2a01:111:e400:fc64::43) by DM6NAM12HT010.eop-nam12.prod.protection.outlook.com (2a01:111:e400:fc64::134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3131.13; Sat, 27 Jun 2020 05:34:34 +0000 Received: from CY4PR0701MB3650.namprd07.prod.outlook.com (2a01:111:e400:fc64::4d) by DM6NAM12FT032.mail.protection.outlook.com (2a01:111:e400:fc64::209) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3153.10 via Frontend Transport; Sat, 27 Jun 2020 05:34:34 +0000 Received: from CY4PR0701MB3650.namprd07.prod.outlook.com ([fe80::7970:4441:aada:b3cd]) by CY4PR0701MB3650.namprd07.prod.outlook.com ([fe80::7970:4441:aada:b3cd%3]) with mapi id 15.20.3131.024; Sat, 27 Jun 2020 05:34:34 +0000 From: Charlie Kaufman To: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-ippm-stamp-option-tlv.all@ietf.org" Thread-Topic: Secdir review of draft-ietf-ippm-stamp-option-tlv-06 Thread-Index: AQHWTEQcoR2wUnx5tkW1hwUY5lI/+w== Date: Sat, 27 Jun 2020 05:34:34 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-incomingtopheadermarker: OriginalChecksum:3CF6D8FFD798C51F6BF1149E131786EB73BADC503670709F7A733F4581CC4887; UpperCasedChecksum:C8CADC8B271D0A195AF2040F23084E6EF362ABFDE038777DC55160AFBB67B297; SizeAsReceived:6851; Count:41 x-tmn: [Y4XFGW0nUh/9jKiAL2PvSiwOreBc4Bgo] x-ms-publictraffictype: Email x-incomingheadercount: 41 x-eopattributedmessage: 0 x-ms-office365-filtering-correlation-id: 6e8ee43d-7269-42f9-0f81-08d81a5bc699 x-ms-traffictypediagnostic: DM6NAM12HT010: x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: z71OfeMSN9lTFOIJAYzm7iNF1PszTvfNOsfdf/HJ/nt7b/p1E7YBoJmsFmwCEKuDR5s2TTgvv3T3iUtQemhBP/JgrLREOK0d26tbHi9a1s/7fDf6ROxV7q4WTZXv71DCUeaaNSfUFBKwq9shit6d89ARZmHaAXTyy8GGIjpB21l09ez7xcpE+DPSDeNgZ0Np/sQkioJDlVlcaFKcwWmXxw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:0; SRV:; IPV:NLI; SFV:NSPM; H:CY4PR0701MB3650.namprd07.prod.outlook.com; PTR:; CAT:NONE; SFTY:; SFS:; DIR:OUT; SFP:1901; x-ms-exchange-antispam-messagedata: 80uf8+Sp/BCvtbNJ1KbNoAxt+rgLdyzMwnGcDUo6nOtw9p4zWFJBM6/s3f2Jp758D8QLYLQUShrxthK9iRhte8BGfNOCKgosRKBL7vHuK9v7zigc6vEWxQCztajVo+TTRTe/TwV/0fTMnadbaBGhmQ== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_CY4PR0701MB36501A472EF93F5FCAE71413DF900CY4PR0701MB3650_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-AuthSource: DM6NAM12FT032.eop-nam12.prod.protection.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: 6e8ee43d-7269-42f9-0f81-08d81a5bc699 X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jun 2020 05:34:34.8561 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Internet X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6NAM12HT010 Archived-At: Subject: [secdir] Secdir review of draft-ietf-ippm-stamp-option-tlv-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jun 2020 05:34:38 -0000 --_000_CY4PR0701MB36501A472EF93F5FCAE71413DF900CY4PR0701MB3650_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments. This I-D specifies extensions to the STAMP protocol defined in RFC 8762. Th= e STAMP protocol runs over UDP and is similar to an "echo" protocol intende= d to be used to test network speed and bandwidth. This I-D specifies a seri= es of TLV encoded extensions that can be appended to the end of the UDP pac= kets of the STAMP protocol (as well as defining the TLV mechanism itself). I could not find anything objectionable from a security standpoint in this = extension mechanism. It is a bit odd that when extensions are added to an H= MAC protected packet, instead of adding the extensions before the HMAC and = having the HMAC protect the entire contents, they keep the existing HMAC th= at protects the base packet and add a second HMAC at the end of the extensi= ons that protects only the extensions. This would potentially allow an atta= cker to "mix and match" the extensions from one packet with the base conten= t of a different packet, but it's not clear what an attacker might be able = to gain by doing that. One of the pieces of information an extension can request is the 6 byte MAC= address of the incoming packet as seen by the peer (which will normally by= the MAC address of the last router on the path). That information is not n= ormally available to someone on a distant network, but it's not obvious wha= t harm could come from their knowing it. The protocol can also request the source and destination IP addresses as se= en by the peer (presumably to detect NAT gateways), but the protocol assume= s the originator will know whether the peer will see IPv4 or IPv6 addresses= , so dealing with 6-to-4 gateways could be tricky. On page 19 table 2, this document asks IANA to assign extension type codes.= In all other documents of this sort that I have seen, the document assigns= the codes and asks IANA to track subsequent additions. On some kinds of errors, the protocol specifies that the error is reported = via and ICMP message. For others, it specifies that a field be returned con= taining all zeros. It's probably better to report errors "in band" because = so many routers swallow ICMP messages. The spec does not - and should - spe= cify what to do if the length of the TLV coded extensions does not match th= e length of the UDP packet containing them (or at least I couldn't find whe= re it was specified). --Charlie --_000_CY4PR0701MB36501A472EF93F5FCAE71413DF900CY4PR0701MB3650_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
I have reviewed this document as part of the security directorate's o= ngoing effort to review all IETF documents being processed by the IESG. &nb= sp;These comments were written primarily for the benefit of the security ar= ea directors.  Document editors and WG chairs should treat these comments just like any other last call comments.=

This I-D specifies extensions to the STAMP protocol defined in RFC 876= 2. The STAMP protocol runs over UDP and is similar to an "echo" p= rotocol intended to be used to test network speed and bandwidth. This I-D s= pecifies a series of TLV encoded extensions that can be appended to the end of the UDP packets of the STAMP protocol (= as well as defining the TLV mechanism itself).

I could not find anything objectionable from a security standpoint in = this extension mechanism. It is a bit odd that when extensions are added to= an HMAC protected packet, instead of adding the extensions before the HMAC= and having the HMAC protect the entire contents, they keep the existing HMAC that protects the base packet= and add a second HMAC at the end of the extensions that protects only the = extensions. This would potentially allow an attacker to "mix and match= " the extensions from one packet with the base content of a different packet, but it's not clear what an attacke= r might be able to gain by doing that.

One of the pieces of information an extension can request is the 6 byt= e MAC address of the incoming packet as seen by the peer (which will normal= ly by the MAC address of the last router on the path). That information is = not normally available to someone on a distant network, but it's not obvious what harm could come from their= knowing it.

The protocol can also request the source and destination IP addresses = as seen by the peer (presumably to detect NAT gateways), but the protocol a= ssumes the originator will know whether the peer will see IPv4 or IPv6 addr= esses, so dealing with 6-to-4 gateways could be tricky.

On page 19 table 2, this document asks IANA to assign extension type c= odes. In all other documents of this sort that I have seen, the document as= signs the codes and asks IANA to track subsequent additions.

On some kinds of errors, the protocol specifies that the error is repo= rted via and ICMP message. For others, it specifies that a field be returne= d containing all zeros. It's probably better to report errors "in band= " because so many routers swallow ICMP messages. The spec does not - and should - specify what to do if the lengt= h of the TLV coded extensions does not match the length of the UDP packet c= ontaining them (or at least I couldn't find where it was specified).

--Charlie
--_000_CY4PR0701MB36501A472EF93F5FCAE71413DF900CY4PR0701MB3650_-- From nobody Fri Jun 26 23:27:23 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6CECD3A0D78; Fri, 26 Jun 2020 23:27:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.89 X-Spam-Level: X-Spam-Status: No, score=-1.89 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0993F5MmsCks; Fri, 26 Jun 2020 23:27:07 -0700 (PDT) Received: from huawei.com (lhrrgout.huawei.com [185.176.76.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9547D3A0BD6; Fri, 26 Jun 2020 23:27:06 -0700 (PDT) Received: from lhreml702-chm.china.huawei.com (unknown [172.18.7.108]) by Forcepoint Email with ESMTP id D77AC58B29F0A44CC1B7; Sat, 27 Jun 2020 07:27:04 +0100 (IST) Received: from lhreml702-chm.china.huawei.com (10.201.108.51) by lhreml702-chm.china.huawei.com (10.201.108.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1913.5; Sat, 27 Jun 2020 07:27:03 +0100 Received: from DGGEML405-HUB.china.huawei.com (10.3.17.49) by lhreml702-chm.china.huawei.com (10.201.108.51) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA_P256) id 15.1.1913.5 via Frontend Transport; Sat, 27 Jun 2020 07:27:03 +0100 Received: from DGGEML531-MBS.china.huawei.com ([169.254.5.107]) by dggeml405-hub.china.huawei.com ([10.3.17.49]) with mapi id 14.03.0487.000; Sat, 27 Jun 2020 14:26:57 +0800 From: Qin Wu To: Christian Huitema , Susan Hares , "secdir@ietf.org" CC: "i2rs@ietf.org" , "draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org" , "last-call@ietf.org" , NETMOD Group Thread-Topic: [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 Thread-Index: AdZMSzxxZZkY3O3kQj2fPy6LwO0Mqg== Date: Sat, 27 Jun 2020 06:26:56 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.164.123.57] Content-Type: multipart/alternative; boundary="_000_B8F9A780D330094D99AF023C5877DABAAD7BE6C3dggeml531mbschi_" MIME-Version: 1.0 X-CFilter-Loop: Reflected Archived-At: Subject: Re: [secdir] [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jun 2020 06:27:12 -0000 --_000_B8F9A780D330094D99AF023C5877DABAAD7BE6C3dggeml531mbschi_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhhbmtzIENocmlzdGlhbiBmb3IgY2xhcmlmaWNhdGlvbiwgaGVyZSBpcyB0aGUgdHdlYWtlZCB0 ZXh0IHRvIGFkZHJlc3MgeW91ciBjb21tZW50LCB3aGljaCBpcyBwb3NpdGlvbmVkIHJpZ2h0IGFm dGVyIHRoZSBkaXNjdXNzaW9uIGFib3V0IHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUgYXR0 cmlidXRlcy4NCg0KTkVXIFRFWFQ6DQrigJwNCg0KNi4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25z DQoNCg0KDQogICBUaGUgWUFORyBtb2R1bGUgc3BlY2lmaWVkIGluIHRoaXMgZG9jdW1lbnQgZGVm aW5lcyBhIHNjaGVtYSBmb3IgZGF0YQ0KDQogICB0aGF0IGlzIGRlc2lnbmVkIHRvIGJlIGFjY2Vz c2VkIHZpYSBuZXR3b3JrIG1hbmFnZW1lbnQgcHJvdG9jb2xzIHN1Y2gNCg0KICAgYXMgTkVUQ09O RiBbUkZDNjI0MV0gb3IgUkVTVENPTkYgW1JGQzgwNDBdLiAgVGhlIGxvd2VzdCBORVRDT05GIGxh eWVyDQoNCiAgIGlzIHRoZSBzZWN1cmUgdHJhbnNwb3J0IGxheWVyLCBhbmQgdGhlIG1hbmRhdG9y eS10by1pbXBsZW1lbnQgc2VjdXJlDQoNCiAgIHRyYW5zcG9ydCBpcyBTZWN1cmUgU2hlbGwgKFNT SCkgW1JGQzYyNDJdLiAgVGhlIGxvd2VzdCBSRVNUQ09ORiBsYXllcg0KDQogICBpcyBIVFRQUywg YW5kIHRoZSBtYW5kYXRvcnktdG8taW1wbGVtZW50IHNlY3VyZSB0cmFuc3BvcnQgaXMgVExTDQoN CiAgIFtSRkM4NDQ2XS4NCg0KDQoNCiAgIFRoZSBOZXR3b3JrIENvbmZpZ3VyYXRpb24gQWNjZXNz IENvbnRyb2wgTW9kZWwgKE5BQ00pIFtSRkM4MzQxXQ0KDQogICBwcm92aWRlcyB0aGUgbWVhbnMg dG8gcmVzdHJpY3QgYWNjZXNzIGZvciBwYXJ0aWN1bGFyIE5FVENPTkYgb3INCg0KDQoNCiAgIFJF U1RDT05GIHVzZXJzIHRvIGEgcHJlY29uZmlndXJlZCBzdWJzZXQgb2YgYWxsIGF2YWlsYWJsZSBO RVRDT05GIG9yDQoNCiAgIFJFU1RDT05GIHByb3RvY29sIG9wZXJhdGlvbnMgYW5kIGNvbnRlbnQu DQoNCg0KDQogICBUaGUgTGF5ZXIgMiB0b3BvbG9neSBtb2R1bGUgZGVmaW5lIGluZm9ybWF0aW9u IHRoYXQgY2FuIGJlDQoNCiAgIGNvbmZpZ3VyYWJsZSBpbiBjZXJ0YWluIGluc3RhbmNlcywgZm9y IGV4YW1wbGUgaW4gdGhlIGNhc2Ugb2YgdmlydHVhbA0KDQogICB0b3BvbG9naWVzIHRoYXQgY2Fu IGJlIGNyZWF0ZWQgYnkgY2xpZW50IGFwcGxpY2F0aW9ucy4gIEluIHN1Y2gNCg0KICAgY2FzZXMs IGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBpbnRyb2R1Y2UgdG9wb2xvZ2llcyB0aGF0IGFyZQ0K DQogICB1bmRlc2lyZWQuICBTcGVjaWZpY2FsbHksIGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBh dHRlbXB0IHRvIHJlbW92ZQ0KDQogICBvciBhZGQgYSBub2RlLCBhIGxpbmssIGEgdGVybWluYXRp b24gcG9pbnQsIGJ5IGNyZWF0aW5nIG9yIGRlbGV0aW5nDQoNCiAgIGNvcnJlc3BvbmRpbmcgZWxl bWVudHMgaW4gdGhlIG5vZGUsIGxpbmssIGFuZCB0ZXJtaW5hdGlvbiBwb2ludA0KDQogICBsaXN0 cywgcmVzcGVjdGl2ZWx5LiAgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0aGF0IGlzIGxlYXJu ZWQsIHRoZQ0KDQogICBzZXJ2ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IHByb2hpYml0IHN1Y2ggbWlz Y29uZmlndXJhdGlvbiBhdHRlbXB0cy4NCg0KICAgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0 aGF0IGlzIGNvbmZpZ3VyZWQsIGkuZS4gd2hvc2Ugb3JpZ2luIGlzDQoNCiAgICJpbnRlbmRlZCIs IHRoZSB1bmRlc2lyZWQgY29uZmlndXJhdGlvbiBjb3VsZCBiZWNvbWUgZWZmZWN0aXZlIGFuZCBi ZQ0KDQogICByZWZsZWN0ZWQgaW4gdGhlIG9wZXJhdGlvbmFsIHN0YXRlIGRhdGFzdG9yZSwgbGVh ZGluZyB0byBkaXNydXB0aW9uDQoNCiAgIG9mIHNlcnZpY2VzIHByb3ZpZGVkIHZpYSB0aGlzIHRv cG9sb2d5IG1pZ2h0IGJlIGRpc3J1cHRlZC4gIEZvciB0aG9zZQ0KDQogICByZWFzb25zLCBpdCBp cyBpbXBvcnRhbnQgdGhhdCB0aGUgTkVUQ09ORiBhY2Nlc3MgY29udHJvbCBtb2RlbCBpcw0KDQog ICB2aWdvcm91c2x5IGFwcGxpZWQgdG8gcHJldmVudCB0b3BvbG9neSBtaXNjb25maWd1cmF0aW9u IGJ5DQoNCiAgIHVuYXV0aG9yaXplZCBjbGllbnRzLg0KDQoNCg0KICAgVGhlcmUgYXJlIGEgbnVt YmVyIG9mIGRhdGEgbm9kZXMgZGVmaW5lZCBpbiB0aGlzIFlBTkcgbW9kdWxlIHRoYXQgYXJlDQoN CiAgIHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVlLCB3aGlj aCBpcyB0aGUNCg0KICAgZGVmYXVsdCkuICBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBjb25zaWRl cmVkIHNlbnNpdGl2ZSBvciB2dWxuZXJhYmxlDQoNCiAgIGluIHNvbWUgbmV0d29yayBlbnZpcm9u bWVudHMuICBXcml0ZSBvcGVyYXRpb25zIChlLmcuLCBlZGl0LWNvbmZpZykNCg0KICAgdG8gdGhl c2UgZGF0YSBub2RlcyB3aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEgbmVnYXRp dmUNCg0KICAgZWZmZWN0IG9uIG5ldHdvcmsgb3BlcmF0aW9ucy4gIFRoZXNlIGFyZSB0aGUgc3Vi dHJlZXMgYW5kIGRhdGEgbm9kZXMNCg0KICAgYW5kIHRoZWlyIHNlbnNpdGl2aXR5L3Z1bG5lcmFi aWxpdHkgaW4gdGhlIGlldGYtbmV0d29yayBtb2R1bGU6DQoNCg0KDQogICBvICBsMi1uZXR3b3Jr LWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvDQoNCiAgICAg IHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGFueSBvZiB0aGUgY29udGFpbmVkIGF0dHJp YnV0ZXMsDQoNCiAgICAgIHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhlIGZsYWcgZGF0YSBub2Rlcy4N Cg0KDQoNCiAgIG8gIGwyLW5vZGUtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxk IGF0dGVtcHQgdG8gc2Fib3RhZ2UNCg0KICAgICAgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0 YW50IG5vZGUgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgbmFtZQ0KDQogICAgICBvciB0aGUgbWFu YWdlbWVudC1hZGRyZXNzLg0KDQoNCg0KICAgbyAgbDItbGluay1hdHRyaWJ1dGVzOiBBIG1hbGlj aW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0byBzYWJvdGFnZQ0KDQogICAgICB0aGUgY29uZmln dXJhdGlvbiBvZiBpbXBvcnRhbnQgbGluayBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlDQoN CiAgICAgIG9yIHRoZSBkZWxheSBkYXRhIG5vZGVzLg0KDQoNCg0KICAgbyAgbDItdGVybWluYXRp b24tcG9pbnQtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQNCg0K ICAgICAgdG8gc2Fib3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IHRlcm1pbmF0 aW9uIHBvaW50DQoNCiAgICAgIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUt c2l6ZS4NCg0KDQpTb21lIG9mIHRoZSByZWFkYWJsZSBkYXRhIG5vZGVzIGluIHRoaXMgWUFORyBt b2R1bGUgbWF5IGJlIGNvbnNpZGVyZWQNCnNlbnNpdGl2ZSBvciB2dWxuZXJhYmxlIGluIHNvbWUg bmV0d29yayBlbnZpcm9ubWVudHMuIEl0IGlzIHRodXMgIGltcG9ydGFudCB0byBjb250cm9sDQpy ZWFkIGFjY2VzcyAoZS5nLiwgdmlhIGdldCwgZ2V0LWNvbmZpZywgb3Igbm90aWZpY2F0aW9uKSB0 byB0aGVzZSBkYXRhIG5vZGVzLiBJbiBwYXJ0aWN1bGFyLCB0aGUNCllBTkcgbW9kZWwgZm9yIGxh eWVyIDIgdG9wb2xvZ3kgbWF5IGV4cG9zZSBzZW5zaXRpdmUgaW5mb3JtYXRpb24sIGZvciBleGFt cGxlIHRoZSBNQUMNCmFkZHJlc3NlcyBvZiBkZXZpY2VzLiBVbnJlc3RyaWN0ZWQgdXNlIG9mIHN1 Y2ggaW5mb3JtYXRpb24gY2FuIGxlYWQgdG8gcHJpdmFjeSB2aW9sYXRpb25zLg0KRm9yIGV4YW1w bGUsIGxpc3RpbmcgTUFDIGFkZHJlc3NlcyBpbiBhIG5ldHdvcmsgYWxsb3dzIG1vbml0b3Jpbmcg b2YgZGV2aWNlcyBhbmQgdGhlaXINCm1vdmVtZW50cy4gTG9jYXRpb24gaW5mb3JtYXRpb24gY2Fu IGJlIGRlcml2ZWQgZnJvbSBNQUMgYWRkcmVzc2VzIG9mIG5ldHdvcmsgZGV2aWNlcywNCmJ5cGFz c2luZyBwcm90ZWN0aW9uIG9mIGxvY2F0aW9uIGluZm9ybWF0aW9uIGJ5IHRoZSBPcGVyYXRpbmcg U3lzdGVtLg0KDQoNCuKAnQ0KDQpUaGFua3MuDQoNCg0KDQotUWluDQrlj5Hku7bkuro6IENocmlz dGlhbiBIdWl0ZW1hIFttYWlsdG86aHVpdGVtYUBodWl0ZW1hLm5ldF0NCuWPkemAgeaXtumXtDog MjAyMOW5tDbmnIgyNuaXpSAyMjo1NQ0K5pS25Lu25Lq6OiBRaW4gV3UgPGJpbGwud3VAaHVhd2Vp LmNvbT47IFN1c2FuIEhhcmVzIDxzaGFyZXNAbmR6aC5jb20+OyBzZWNkaXJAaWV0Zi5vcmcNCuaK hOmAgTogaTJyc0BpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3Bv bG9neS5hbGxAaWV0Zi5vcmc7IGxhc3QtY2FsbEBpZXRmLm9yZzsgTkVUTU9EIEdyb3VwIDxuZXRt b2RAaWV0Zi5vcmc+DQrkuLvpopg6IFJlOiBbTGFzdC1DYWxsXSBbaTJyc10gU2VjZGlyIGxhc3Qg Y2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS0x Mw0KDQoNCkkgbGlrZSB2YXJpYW50IEIgYmV0dGVyLCBhbHRob3VnaCBJIHdvdWxkIG5vdCBzaW5n bGUgb3V0IHRoZSBtYWMgYWRkcmVzc2VzIGluIHRoZSAic2Fib3RhZ2UiIHdhcm5pbmcuDQoNCk15 IG1haW4gY29uY2VybiBpcyB0aGF0IG5ldHdvcmsgYWRtaW5pc3RyYXRvcnMgd2lsbCBuYXR1cmFs bHkgYmUgdmVyeSBjb25jZXJuZWQgYWJvdXQgaW5mb3JtYXRpb24gdGhhdCBpcyB3cml0YWJsZS9j cmVhdGFibGUvZGVsZXRhYmxlLCBiZWNhdXNlIHRoZXkgdW5kZXJzdGFuZCB0aGUgaW1wYWN0IG9u IHRoZSBtYW5hZ2VtZW50IG9mIHRoZWlyIG5ldHdvcmsuIEhvd2V2ZXIsIHRoZXkgYXJlIG5vdCBz byBjb25jZXJuZWQgd2l0aCByZWFkLW9ubHkgYWNjZXNzLCBiZWNhdXNlIHJlYWRpbmcgaW5mb3Jt YXRpb24gZG9lcyBub3QgZGlyZWN0bHkgYWZmZWN0IHRoZSBvcGVyYXRpb24gb2YgdGhlIG5ldHdv cmsuIE15IHdob2xlIHBvaW50IGlzIHRlbGxpbmcgdGhlbSwgInlvdSBhcmUgZG9jdW1lbnRpbmcg eW91ciBMMiB0b3BvbG9neSwgaXQgY29udGFpbnMgc2Vuc2l0aXZlIGluZm9ybWF0aW9uLCBtYWtl IHN1cmUgdGhhdCByZWFkaW5nIGl0IGlzIHByb3RlY3RlZCwgbm90IGp1c3Qgd3JpdGluZyBpdCIu DQoNCkkgYWdyZWUgdGhhdCBORVRDT05GIGFuZCBSRVNUQ09ORiBwcm92aWRlIHRoZSByaWdodCB0 b29scyBmb3IgcHJvdGVjdGluZyB0aGUgaW5mb3JtYXRpb24uIE15IHJlcXVlc3QgaXMganVzdCB0 byBjbGVhcmx5IHRlbGwgbmV0d29yayBhZG1pbmlzdHJhdG9ycyB0byB1c2UgdGhlc2UgdG9vbHMs IGRvIG5vdCBsZWF2ZSByZWFkIGFjY2VzcyB3aWRlIG9wZW4hDQoNCi0tIENocmlzdGlhbiBIdWl0 ZW1hDQpPbiA2LzI2LzIwMjAgNDozNyBBTSwgUWluIFd1IHdyb3RlOg0KDQpIaSwgQ2hyaXN0aWFu Og0KDQoxLiAgICAgICBOQUNNIGRlZmluZWQgaW4gUkZDODM0MSBoYXMgYWxyZWFkeSBwcm92aWRl ZCBtZWNoYW5pc21zIHRvIHJlc3RyaWN0IGFjY2VzcyB0byBzZW5zaXRpdmUgaW5mb3JtYXRpb24g dG8gYSBtaW5pbWFsIGxpc3Qgb2YgYXV0aG9yaXplZCBjbGllbnQgb3IgYWdlbnRzIGFuZCBkZWFs IHdpdGggcHJpdmFjeSBpc3N1ZSBpZiBteSB1bmRlcnN0YW5kaW5nIGlzIGNvcnJlY3QuDQoNCjIu ICAgICAgIEJvdGggTkVUQ09ORiBhbmQgUkVTVENPTkYgd2lsbCByZWx5IG9uIHRyYW5zcG9ydCBw cm90b2NvbCBzdWNoIGFzIFRMUyB0byBwcm92aWRlIGNsaWVudCBhdXRoZW50aWNhdGlvbiBhbmQg c2VydmVyIGF1dGhlbnRpY2F0aW9uLCBpLmUuLCBtdXR1YWwgYXV0aGVudGljYXRpb24uDQoNCjMu ICAgICAgIFRoZSBZQU5HIHNlY3VyaXR5IGd1aWRlbGluZSBkZWZpbmVkIGluIGh0dHBzOi8vdHJh Yy5pZXRmLm9yZy90cmFjL29wcy93aWtpL3lhbmctc2VjdXJpdHktZ3VpZGVsaW5lcw0KDQpQcm92 aWRlIHBlcmZlY3QgYm9pbGVycGxhdGUgdG8gYWRkcmVzcyBib3RoIHNlY3VyaXR5IGNvbnNpZGVy YXRpb24gYW5kIHByaXZhY3kgY29uc2lkZXJhdGlvbi4NCg0KTXkgb3JpZ2luYWwgcHJvcG9zYWwg QSB0byBhZGRyZXNzIHlvdXIgY29tbWVudHMgaXM6DQoNCk9MRCBURVhUOg0KDQoiDQoNCiAgIFRo ZXJlIGFyZSBhIG51bWJlciBvZiBkYXRhIG5vZGVzIGRlZmluZWQgaW4gdGhpcyBZQU5HIG1vZHVs ZSB0aGF0IGFyZQ0KDQogICB3cml0YWJsZS9jcmVhdGFibGUvZGVsZXRhYmxlIChpLmUuLCBjb25m aWcgdHJ1ZSwgd2hpY2ggaXMgdGhlDQoNCiAgIGRlZmF1bHQpLiAgVGhlc2UgZGF0YSBub2RlcyBt YXkgYmUgY29uc2lkZXJlZCBzZW5zaXRpdmUgb3IgdnVsbmVyYWJsZQ0KDQogICBpbiBzb21lIG5l dHdvcmsgZW52aXJvbm1lbnRzLiAgV3JpdGUgb3BlcmF0aW9ucyAoZS5nLiwgZWRpdC1jb25maWcp DQoNCiAgIHRvIHRoZXNlIGRhdGEgbm9kZXMgd2l0aG91dCBwcm9wZXIgcHJvdGVjdGlvbiBjYW4g aGF2ZSBhIG5lZ2F0aXZlDQoNCiAgIGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMuICBUaGVz ZSBhcmUgdGhlIHN1YnRyZWVzIGFuZCBkYXRhIG5vZGVzDQoNCiAgIGFuZCB0aGVpciBzZW5zaXRp dml0eS92dWxuZXJhYmlsaXR5IGluIHRoZSBpZXRmLW5ldHdvcmsgbW9kdWxlOg0KDQoNCg0KICAg byAgbDItbmV0d29yay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1w dCB0bw0KDQogICAgICBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBhbnkgb2YgdGhlIGNv bnRhaW5lZCBhdHRyaWJ1dGVzLA0KDQogICAgICBzdWNoIGFzIHRoZSBuYW1lIG9yIHRoZSBmbGFn IGRhdGEgbm9kZXMuDQoNCg0KDQogICBvICBsMi1ub2RlLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3Vz IGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlDQoNCiAgICAgIHRoZSBjb25maWd1cmF0 aW9uIG9mIGltcG9ydGFudCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG5hbWUNCg0KICAg ICAgb3IgdGhlIG1hbmFnZW1lbnQtYWRkcmVzcy4NCg0KDQoNCiAgIG8gIGwyLWxpbmstYXR0cmli dXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2UNCg0KICAg ICAgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IGxpbmsgYXR0cmlidXRlcywgc3VjaCBh cyB0aGUgcmF0ZQ0KDQogICAgICBvciB0aGUgZGVsYXkgZGF0YSBub2Rlcy4NCg0KDQoNCiAgIG8g IGwyLXRlcm1pbmF0aW9uLXBvaW50LWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3Vs ZCBhdHRlbXB0DQoNCiAgICAgIHRvIHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9y dGFudCB0ZXJtaW5hdGlvbiBwb2ludA0KDQogICAgICBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBt YXhpbXVtLWZyYW1lLXNpemUuDQoNCiINCg0KTkVXIFRFWFQ6DQoNCiINCg0KICAgVGhlcmUgYXJl IGEgbnVtYmVyIG9mIGRhdGEgbm9kZXMgZGVmaW5lZCBpbiB0aGlzIFlBTkcgbW9kdWxlIHRoYXQg YXJlDQoNCiAgIHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVl LCB3aGljaCBpcyB0aGUNCg0KICAgZGVmYXVsdCkuICBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBj b25zaWRlcmVkIHNlbnNpdGl2ZSBvciB2dWxuZXJhYmxlDQoNCiAgIGluIHNvbWUgbmV0d29yayBl bnZpcm9ubWVudHMuICBXcml0ZSBvcGVyYXRpb25zIChlLmcuLCBlZGl0LWNvbmZpZykNCg0KICAg dG8gdGhlc2UgZGF0YSBub2RlcyB3aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEg bmVnYXRpdmUNCg0KICAgZWZmZWN0IG9uIG5ldHdvcmsgb3BlcmF0aW9ucy4gIFRoZXNlIGFyZSB0 aGUgc3VidHJlZXMgYW5kIGRhdGEgbm9kZXMNCg0KICAgYW5kIHRoZWlyIHNlbnNpdGl2aXR5L3Z1 bG5lcmFiaWxpdHkgaW4gdGhlIGlldGYtbmV0d29yayBtb2R1bGU6DQoNCg0KDQogICBvICBsMi1u ZXR3b3JrLWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvDQoN CiAgICAgIHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGFueSBvZiB0aGUgY29udGFpbmVk IGF0dHJpYnV0ZXMsDQoNCiAgICAgIHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhlIGZsYWcgZGF0YSBu b2Rlcy4NCg0KDQoNCiAgIG8gIGwyLW5vZGUtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50 IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2UNCg0KICAgICAgdGhlIGNvbmZpZ3VyYXRpb24gb2Yg aW1wb3J0YW50IG5vZGUgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgbmFtZQ0KDQogICAgICAsdGhl IG1hbmFnZW1lbnQtYWRkcmVzcyBvciBtYWMgYWRkcmVzcyBvZiB0aGUgZGV2aWNlcy4NCg0KDQoN CiAgIG8gIGwyLWxpbmstYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVt cHQgdG8gc2Fib3RhZ2UNCg0KICAgICAgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IGxp bmsgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgcmF0ZQ0KDQogICAgICBvciB0aGUgZGVsYXkgZGF0 YSBub2Rlcy4NCg0KDQoNCiAgbyAgbDItdGVybWluYXRpb24tcG9pbnQtYXR0cmlidXRlczogQSBt YWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQNCg0KICAgICAgdG8gc2Fib3RhZ2UgdGhlIGNv bmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IHRlcm1pbmF0aW9uIHBvaW50DQoNCiAgICAgIGF0dHJp YnV0ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUtc2l6ZSwgbWFjLWFkZHJlc3MuDQoNCiIN Cg0KDQoNCldpdGggeW91ciBwcm9wb3NlZCB0ZXh0LCB3ZSBjb3VsZCBoYXZlIHRoZSBmb2xsb3dp bmcgcHJvcG9zYWwgY2hhbmdlcyAoUHJvcG9zYWwgQik6DQoNCk9MRCBURVhUOg0KDQoiDQoNCjYu ICBTZWN1cml0eSBDb25zaWRlcmF0aW9ucw0KDQoNCg0KICAgVGhlIFlBTkcgbW9kdWxlIHNwZWNp ZmllZCBpbiB0aGlzIGRvY3VtZW50IGRlZmluZXMgYSBzY2hlbWEgZm9yIGRhdGENCg0KICAgdGhh dCBpcyBkZXNpZ25lZCB0byBiZSBhY2Nlc3NlZCB2aWEgbmV0d29yayBtYW5hZ2VtZW50IHByb3Rv Y29scyBzdWNoDQoNCiAgIGFzIE5FVENPTkYgW1JGQzYyNDFdIG9yIFJFU1RDT05GIFtSRkM4MDQw XS4gIFRoZSBsb3dlc3QgTkVUQ09ORiBsYXllcg0KDQogICBpcyB0aGUgc2VjdXJlIHRyYW5zcG9y dCBsYXllciwgYW5kIHRoZSBtYW5kYXRvcnktdG8taW1wbGVtZW50IHNlY3VyZQ0KDQogICB0cmFu c3BvcnQgaXMgU2VjdXJlIFNoZWxsIChTU0gpIFtSRkM2MjQyXS4gIFRoZSBsb3dlc3QgUkVTVENP TkYgbGF5ZXINCg0KICAgaXMgSFRUUFMsIGFuZCB0aGUgbWFuZGF0b3J5LXRvLWltcGxlbWVudCBz ZWN1cmUgdHJhbnNwb3J0IGlzIFRMUw0KDQogICBbUkZDODQ0Nl0uDQoNCg0KDQogICBUaGUgTmV0 d29yayBDb25maWd1cmF0aW9uIEFjY2VzcyBDb250cm9sIE1vZGVsIChOQUNNKSBbUkZDODM0MV0N Cg0KICAgcHJvdmlkZXMgdGhlIG1lYW5zIHRvIHJlc3RyaWN0IGFjY2VzcyBmb3IgcGFydGljdWxh ciBORVRDT05GIG9yDQoNCg0KDQogICBSRVNUQ09ORiB1c2VycyB0byBhIHByZWNvbmZpZ3VyZWQg c3Vic2V0IG9mIGFsbCBhdmFpbGFibGUgTkVUQ09ORiBvcg0KDQogICBSRVNUQ09ORiBwcm90b2Nv bCBvcGVyYXRpb25zIGFuZCBjb250ZW50Lg0KDQoNCg0KICAgSW4gZ2VuZXJhbCwgTGF5ZXIgMiBu ZXR3b3JrIHRvcG9sb2dpZXMgYXJlIHN5c3RlbS1jb250cm9sbGVkIGFuZA0KDQogICBwcm92aWRl IGVwaGVtZXJhbCB0b3BvbG9neSBpbmZvcm1hdGlvbi4gIEluIGFuIE5NREEtY29tcGxpZW50IHNl cnZlciwNCg0KICAgdGhleSBhcmUgb25seSBwYXJ0IG9mIDxvcGVyYXRpb25hbD4gd2hpY2ggcHJv dmlkZXMgcmVhZC1vbmx5IGFjY2Vzcw0KDQogICB0byBjbGllbnRzLCB0aGV5IGFyZSBsZXNzIHZ1 bG5lcmFibGUuICBUaGF0IHNhaWQsIHRoZSBZQU5HIG1vZHVsZQ0KDQogICBkb2VzIGluIHByaW5j aXBsZSBhbGxvdyBpbmZvcm1hdGlvbiB0byBiZSBjb25maWd1cmFibGUuDQoNCg0KDQogICBUaGUg TGF5ZXIgMiB0b3BvbG9neSBtb2R1bGUgZGVmaW5lIGluZm9ybWF0aW9uIHRoYXQgY2FuIGJlDQoN CiAgIGNvbmZpZ3VyYWJsZSBpbiBjZXJ0YWluIGluc3RhbmNlcywgZm9yIGV4YW1wbGUgaW4gdGhl IGNhc2Ugb2YgdmlydHVhbA0KDQogICB0b3BvbG9naWVzIHRoYXQgY2FuIGJlIGNyZWF0ZWQgYnkg Y2xpZW50IGFwcGxpY2F0aW9ucy4gIEluIHN1Y2gNCg0KICAgY2FzZXMsIGEgbWFsaWNpb3VzIGNs aWVudCBjb3VsZCBpbnRyb2R1Y2UgdG9wb2xvZ2llcyB0aGF0IGFyZQ0KDQogICB1bmRlc2lyZWQu ICBTcGVjaWZpY2FsbHksIGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHJlbW92 ZQ0KDQogICBvciBhZGQgYSBub2RlLCBhIGxpbmssIGEgdGVybWluYXRpb24gcG9pbnQsIGJ5IGNy ZWF0aW5nIG9yIGRlbGV0aW5nDQoNCiAgIGNvcnJlc3BvbmRpbmcgZWxlbWVudHMgaW4gdGhlIG5v ZGUsIGxpbmssIGFuZCB0ZXJtaW5hdGlvbiBwb2ludA0KDQogICBsaXN0cywgcmVzcGVjdGl2ZWx5 LiAgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0aGF0IGlzIGxlYXJuZWQsIHRoZQ0KDQogICBz ZXJ2ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IHByb2hpYml0IHN1Y2ggbWlzY29uZmlndXJhdGlvbiBh dHRlbXB0cy4NCg0KICAgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0aGF0IGlzIGNvbmZpZ3Vy ZWQsIGkuZS4gd2hvc2Ugb3JpZ2luIGlzDQoNCiAgICJpbnRlbmRlZCIsIHRoZSB1bmRlc2lyZWQg Y29uZmlndXJhdGlvbiBjb3VsZCBiZWNvbWUgZWZmZWN0aXZlIGFuZCBiZQ0KDQogICByZWZsZWN0 ZWQgaW4gdGhlIG9wZXJhdGlvbmFsIHN0YXRlIGRhdGFzdG9yZSwgbGVhZGluZyB0byBkaXNydXB0 aW9uDQoNCiAgIG9mIHNlcnZpY2VzIHByb3ZpZGVkIHZpYSB0aGlzIHRvcG9sb2d5IG1pZ2h0IGJl IGRpc3J1cHRlZC4gIEZvciB0aG9zZQ0KDQogICByZWFzb25zLCBpdCBpcyBpbXBvcnRhbnQgdGhh dCB0aGUgTkVUQ09ORiBhY2Nlc3MgY29udHJvbCBtb2RlbCBpcw0KDQogICB2aWdvcm91c2x5IGFw cGxpZWQgdG8gcHJldmVudCB0b3BvbG9neSBtaXNjb25maWd1cmF0aW9uIGJ5DQoNCiAgIHVuYXV0 aG9yaXplZCBjbGllbnRzLg0KDQoNCg0KICAgVGhlcmUgYXJlIGEgbnVtYmVyIG9mIGRhdGEgbm9k ZXMgZGVmaW5lZCBpbiB0aGlzIFlBTkcgbW9kdWxlIHRoYXQgYXJlDQoNCiAgIHdyaXRhYmxlL2Ny ZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVlLCB3aGljaCBpcyB0aGUNCg0KICAg ZGVmYXVsdCkuICBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBjb25zaWRlcmVkIHNlbnNpdGl2ZSBv ciB2dWxuZXJhYmxlDQoNCiAgIGluIHNvbWUgbmV0d29yayBlbnZpcm9ubWVudHMuICBXcml0ZSBv cGVyYXRpb25zIChlLmcuLCBlZGl0LWNvbmZpZykNCg0KICAgdG8gdGhlc2UgZGF0YSBub2RlcyB3 aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEgbmVnYXRpdmUNCg0KICAgZWZmZWN0 IG9uIG5ldHdvcmsgb3BlcmF0aW9ucy4gIFRoZXNlIGFyZSB0aGUgc3VidHJlZXMgYW5kIGRhdGEg bm9kZXMNCg0KICAgYW5kIHRoZWlyIHNlbnNpdGl2aXR5L3Z1bG5lcmFiaWxpdHkgaW4gdGhlIGll dGYtbmV0d29yayBtb2R1bGU6DQoNCg0KDQogICBvICBsMi1uZXR3b3JrLWF0dHJpYnV0ZXM6IEEg bWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvDQoNCiAgICAgIHNhYm90YWdlIHRoZSBj b25maWd1cmF0aW9uIG9mIGFueSBvZiB0aGUgY29udGFpbmVkIGF0dHJpYnV0ZXMsDQoNCiAgICAg IHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhlIGZsYWcgZGF0YSBub2Rlcy4NCg0KDQoNCiAgIG8gIGwy LW5vZGUtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fi b3RhZ2UNCg0KICAgICAgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IG5vZGUgYXR0cmli dXRlcywgc3VjaCBhcyB0aGUgbmFtZQ0KDQogICAgICBvciB0aGUgbWFuYWdlbWVudC1hZGRyZXNz Lg0KDQoNCg0KICAgbyAgbDItbGluay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291 bGQgYXR0ZW1wdCB0byBzYWJvdGFnZQ0KDQogICAgICB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBv cnRhbnQgbGluayBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlDQoNCiAgICAgIG9yIHRoZSBk ZWxheSBkYXRhIG5vZGVzLg0KDQoNCg0KICAgbyAgbDItdGVybWluYXRpb24tcG9pbnQtYXR0cmli dXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQNCg0KICAgICAgdG8gc2Fib3Rh Z2UgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IHRlcm1pbmF0aW9uIHBvaW50DQoNCiAg ICAgIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUtc2l6ZS4NCg0KIg0KDQpO RVcgVEVYVDoNCg0KIg0KDQo2LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMNCg0KDQoNCiAgIFRo ZSBZQU5HIG1vZHVsZSBzcGVjaWZpZWQgaW4gdGhpcyBkb2N1bWVudCBkZWZpbmVzIGEgc2NoZW1h IGZvciBkYXRhDQoNCiAgIHRoYXQgaXMgZGVzaWduZWQgdG8gYmUgYWNjZXNzZWQgdmlhIG5ldHdv cmsgbWFuYWdlbWVudCBwcm90b2NvbHMgc3VjaA0KDQogICBhcyBORVRDT05GIFtSRkM2MjQxXSBv ciBSRVNUQ09ORiBbUkZDODA0MF0uICBUaGUgbG93ZXN0IE5FVENPTkYgbGF5ZXINCg0KICAgaXMg dGhlIHNlY3VyZSB0cmFuc3BvcnQgbGF5ZXIsIGFuZCB0aGUgbWFuZGF0b3J5LXRvLWltcGxlbWVu dCBzZWN1cmUNCg0KICAgdHJhbnNwb3J0IGlzIFNlY3VyZSBTaGVsbCAoU1NIKSBbUkZDNjI0Ml0u ICBUaGUgbG93ZXN0IFJFU1RDT05GIGxheWVyDQoNCiAgIGlzIEhUVFBTLCBhbmQgdGhlIG1hbmRh dG9yeS10by1pbXBsZW1lbnQgc2VjdXJlIHRyYW5zcG9ydCBpcyBUTFMNCg0KICAgW1JGQzg0NDZd Lg0KDQoNCg0KICAgVGhlIE5ldHdvcmsgQ29uZmlndXJhdGlvbiBBY2Nlc3MgQ29udHJvbCBNb2Rl bCAoTkFDTSkgW1JGQzgzNDFdDQoNCiAgIHByb3ZpZGVzIHRoZSBtZWFucyB0byByZXN0cmljdCBh Y2Nlc3MgZm9yIHBhcnRpY3VsYXIgTkVUQ09ORiBvcg0KDQogICBSRVNUQ09ORiB1c2VycyB0byBh IHByZWNvbmZpZ3VyZWQgc3Vic2V0IG9mIGFsbCBhdmFpbGFibGUgTkVUQ09ORiBvcg0KDQogICBS RVNUQ09ORiBwcm90b2NvbCBvcGVyYXRpb25zIGFuZCBjb250ZW50Lg0KDQoNCg0KICAgSW4gZ2Vu ZXJhbCwgTGF5ZXIgMiBuZXR3b3JrIHRvcG9sb2dpZXMgYXJlIHN5c3RlbS1jb250cm9sbGVkIGFu ZA0KDQogICBwcm92aWRlIGVwaGVtZXJhbCB0b3BvbG9neSBpbmZvcm1hdGlvbi4gIEluIGFuIE5N REEtY29tcGxpZW50IHNlcnZlciwNCg0KICAgdGhleSBhcmUgb25seSBwYXJ0IG9mIDxvcGVyYXRp b25hbD4gd2hpY2ggcHJvdmlkZXMgcmVhZC1vbmx5IGFjY2Vzcw0KDQogICB0byBjbGllbnRzLCB0 aGV5IGFyZSBsZXNzIHZ1bG5lcmFibGUuICBUaGF0IHNhaWQsIHRoZSBZQU5HIG1vZHVsZQ0KDQog ICBkb2VzIGluIHByaW5jaXBsZSBhbGxvdyBpbmZvcm1hdGlvbiB0byBiZSBjb25maWd1cmFibGUu DQoNCg0KDQogICBUaGUgTGF5ZXIgMiB0b3BvbG9neSBtb2R1bGUgZGVmaW5lIGluZm9ybWF0aW9u IHRoYXQgY2FuIGJlDQoNCiAgIGNvbmZpZ3VyYWJsZSBpbiBjZXJ0YWluIGluc3RhbmNlcywgZm9y IGV4YW1wbGUgaW4gdGhlIGNhc2Ugb2YgdmlydHVhbA0KDQogICB0b3BvbG9naWVzIHRoYXQgY2Fu IGJlIGNyZWF0ZWQgYnkgY2xpZW50IGFwcGxpY2F0aW9ucy4gIEluIHN1Y2gNCg0KICAgY2FzZXMs IGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBpbnRyb2R1Y2UgdG9wb2xvZ2llcyB0aGF0IGFyZQ0K DQogICB1bmRlc2lyZWQuICBTcGVjaWZpY2FsbHksIGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBh dHRlbXB0IHRvIHJlbW92ZQ0KDQogICBvciBhZGQgYSBub2RlLCBhIGxpbmssIGEgdGVybWluYXRp b24gcG9pbnQsIGJ5IGNyZWF0aW5nIG9yIGRlbGV0aW5nDQoNCiAgIGNvcnJlc3BvbmRpbmcgZWxl bWVudHMgaW4gdGhlIG5vZGUsIGxpbmssIGFuZCB0ZXJtaW5hdGlvbiBwb2ludA0KDQogICBsaXN0 cywgcmVzcGVjdGl2ZWx5LiAgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0aGF0IGlzIGxlYXJu ZWQsIHRoZQ0KDQogICBzZXJ2ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IHByb2hpYml0IHN1Y2ggbWlz Y29uZmlndXJhdGlvbiBhdHRlbXB0cy4NCg0KICAgSW4gdGhlIGNhc2Ugb2YgYSB0b3BvbG9neSB0 aGF0IGlzIGNvbmZpZ3VyZWQsIGkuZS4gd2hvc2Ugb3JpZ2luIGlzDQoNCiAgICJpbnRlbmRlZCIs IHRoZSB1bmRlc2lyZWQgY29uZmlndXJhdGlvbiBjb3VsZCBiZWNvbWUgZWZmZWN0aXZlIGFuZCBi ZQ0KDQogICByZWZsZWN0ZWQgaW4gdGhlIG9wZXJhdGlvbmFsIHN0YXRlIGRhdGFzdG9yZSwgbGVh ZGluZyB0byBkaXNydXB0aW9uDQoNCiAgIG9mIHNlcnZpY2VzIHByb3ZpZGVkIHZpYSB0aGlzIHRv cG9sb2d5IG1pZ2h0IGJlIGRpc3J1cHRlZC4gIEZvciB0aG9zZQ0KDQogICByZWFzb25zLCBpdCBp cyBpbXBvcnRhbnQgdGhhdCB0aGUgTkVUQ09ORiBhY2Nlc3MgY29udHJvbCBtb2RlbCBpcw0KDQog ICB2aWdvcm91c2x5IGFwcGxpZWQgdG8gcHJldmVudCB0b3BvbG9neSBtaXNjb25maWd1cmF0aW9u IGJ5DQoNCiAgIHVuYXV0aG9yaXplZCBjbGllbnRzLg0KDQoNCg0KICBUaGUgWUFORyBtb2RlbCBm b3IgbGF5ZXIgMiB0b3BvbG9neSBtYXkgZXhwb3NlIHNlbnNpdGl2ZSBpbmZvcm1hdGlvbiwNCg0K ICBmb3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZiBkZXZpY2VzLiBVbnJlc3RyaWN0ZWQg dXNlIG9mIHN1Y2ggaW5mb3JtYXRpb24NCg0KICAgY2FuIGxlYWQgdG8gcHJpdmFjeSB2aW9sYXRp b25zLiBGb3IgZXhhbXBsZSwgbGlzdGluZyBNQUMgYWRkcmVzc2VzIGluIGEgbmV0d29yaw0KDQog ICBhbGxvd3MgbW9uaXRvcmluZyBvZiBkZXZpY2VzIGFuZCB0aGVpciBtb3ZlbWVudHMuIExvY2F0 aW9uIGluZm9ybWF0aW9uIGNhbiBiZSBkZXJpdmVkDQoNCiAgIGZyb20gTUFDIGFkZHJlc3NlcyBv ZiBuZXR3b3JrIGRldmljZXMsIGJ5cGFzc2luZyBwcm90ZWN0aW9uIG9mIGxvY2F0aW9uIGluZm9y bWF0aW9uIGJ5DQoNCiAgIHRoZSBPcGVyYXRpbmcgU3lzdGVtLiBEZXBsb3ltZW50cyBzaG91bGQg bWl0aWdhdGUgdGhpcyBwcml2YWN5IGNvbmNlcm5zIGJ5IGxpbWl0aW5nIGFjY2Vzcw0KDQogICB0 byB0aGUgbGF5ZXIgMiB0b3BvbG9neSBpbmZvcm1hdGlvbi4gQWNjZXNzIHRvIHRoZSBpbmZvcm1h dGlvbiBzaG91bGQgYmUgcmVzdHJpY3RlZCB0byBhDQoNCiAgIG1pbmltYWwgbGlzdCBvZiBhdXRo b3JpemVkIGNsaWVudHMsIGFuZCBzaG91bGQgYWxzbyByZXF1aXJlIHByb3BlciBhdXRoZW50aWNh dGlvbiBvZiB0aGVzZSBjbGllbnRzLg0KDQoNCg0KICAgVGhlcmUgYXJlIGEgbnVtYmVyIG9mIGRh dGEgbm9kZXMgZGVmaW5lZCBpbiB0aGlzIFlBTkcgbW9kdWxlIHRoYXQgYXJlDQoNCiAgIHdyaXRh YmxlL2NyZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVlLCB3aGljaCBpcyB0aGUN Cg0KICAgZGVmYXVsdCkuICBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBjb25zaWRlcmVkIHNlbnNp dGl2ZSBvciB2dWxuZXJhYmxlDQoNCiAgIGluIHNvbWUgbmV0d29yayBlbnZpcm9ubWVudHMuICBX cml0ZSBvcGVyYXRpb25zIChlLmcuLCBlZGl0LWNvbmZpZykNCg0KICAgdG8gdGhlc2UgZGF0YSBu b2RlcyB3aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEgbmVnYXRpdmUNCg0KICAg ZWZmZWN0IG9uIG5ldHdvcmsgb3BlcmF0aW9ucy4gIFRoZXNlIGFyZSB0aGUgc3VidHJlZXMgYW5k IGRhdGEgbm9kZXMNCg0KICAgYW5kIHRoZWlyIHNlbnNpdGl2aXR5L3Z1bG5lcmFiaWxpdHkgaW4g dGhlIGlldGYtbmV0d29yayBtb2R1bGU6DQoNCg0KDQogICBvICBsMi1uZXR3b3JrLWF0dHJpYnV0 ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvDQoNCiAgICAgIHNhYm90YWdl IHRoZSBjb25maWd1cmF0aW9uIG9mIGFueSBvZiB0aGUgY29udGFpbmVkIGF0dHJpYnV0ZXMsDQoN CiAgICAgIHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhlIGZsYWcgZGF0YSBub2Rlcy4NCg0KDQoNCiAg IG8gIGwyLW5vZGUtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQg dG8gc2Fib3RhZ2UNCg0KICAgICAgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IG5vZGUg YXR0cmlidXRlcywgc3VjaCBhcyB0aGUgbmFtZQ0KDQogICAgICAsdGhlIG1hbmFnZW1lbnQtYWRk cmVzcywgbWFjLWFkZHJlc3Mgb2YgdGhlIGRldmljZXMuDQoNCg0KDQogICBvICBsMi1saW5rLWF0 dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlDQoN CiAgICAgIHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBsaW5rIGF0dHJpYnV0ZXMsIHN1 Y2ggYXMgdGhlIHJhdGUNCg0KICAgICAgb3IgdGhlIGRlbGF5IGRhdGEgbm9kZXMuDQoNCg0KDQog ICBvICBsMi10ZXJtaW5hdGlvbi1wb2ludC1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQg Y291bGQgYXR0ZW1wdA0KDQogICAgICB0byBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBp bXBvcnRhbnQgdGVybWluYXRpb24gcG9pbnQNCg0KICAgICAgYXR0cmlidXRlcywgc3VjaCBhcyB0 aGUgbWF4aW11bS1mcmFtZS1zaXplLCBtYWMtYWRkcmVzcy4NCg0KIg0KDQpUaGUgcXVlc3Rpb24g aXMgZG8geW91IHRoaW5rIHByb3Bvc2FsIHdpdGggeWFuZyBzZWN1cml0eSBib2lsdGVycGxhdGUg aGFzIGFscmVhZHkgYWRkcmVzc2VkIHlvdXIgY29tbWVudHMNCg0KT3IgeW91IHRoaW5rIHdlIHNo b3VsZCBlbXBoYXNpemUgaG93IHByaXZhY3kgaXNzdWUgY2FuIGJlIGFkZHJlc3NlZCBieSBOQUNN IGFuZCBjbGllbnQgYXV0aGVudGljYXRpb24gaXMgbmVlZGVkPw0KDQoNCg0KLVFpbg0KDQotLS0t LemCruS7tuWOn+S7ti0tLS0tDQrlj5Hku7bkuro6IENocmlzdGlhbiBIdWl0ZW1hIFttYWlsdG86 aHVpdGVtYUBodWl0ZW1hLm5ldF0NCuWPkemAgeaXtumXtDogMjAyMOW5tDbmnIgyNuaXpSAxMjow NQ0K5pS25Lu25Lq6OiBTdXNhbiBIYXJlcyA8c2hhcmVzQG5kemguY29tPjxtYWlsdG86c2hhcmVz QG5kemguY29tPjsgUWluIFd1IDxiaWxsLnd1QGh1YXdlaS5jb20+PG1haWx0bzpiaWxsLnd1QGh1 YXdlaS5jb20+OyBzZWNkaXJAaWV0Zi5vcmc8bWFpbHRvOnNlY2RpckBpZXRmLm9yZz4NCuaKhOmA gTogaTJyc0BpZXRmLm9yZzxtYWlsdG86aTJyc0BpZXRmLm9yZz47IGRyYWZ0LWlldGYtaTJycy15 YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3JnPG1haWx0bzpkcmFmdC1pZXRmLWky cnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LmFsbEBpZXRmLm9yZz47IGxhc3QtY2FsbEBpZXRm Lm9yZzxtYWlsdG86bGFzdC1jYWxsQGlldGYub3JnPg0K5Li76aKYOiBSZTogW0xhc3QtQ2FsbF0g W2kycnNdIFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaTJycy15YW5nLWwy LW5ldHdvcmstdG9wb2xvZ3ktMTMNCg0KDQoNCkhvdyBhYm91dCBhZGRpbmcgc29tZXRoaW5nIGxp a2UgdGhpczoNCg0KDQoNClByaXZhY3kgQ29uc2lkZXJhdGlvbnMNCg0KDQoNClRoZSBZYW5nIG1v ZGVsIGZvciBsYXllciAyIHRvcG9sb2d5IGV4cG9zZXMgcHJpdmFjeSBzZW5zaXRpdmUgaW5mb3Jt YXRpb24sIGZvciBleGFtcGxlIHRoZSBNQUMgYWRkcmVzc2VzIG9mIGRldmljZXMuIFVucmVzdHJp Y3RlZCB1c2Ugb2Ygc3VjaCBpbmZvcm1hdGlvbiBjYW4gbGVhZCB0byBwcml2YWN5IHZpb2xhdGlv bnMuIEZvciBleGFtcGxlLCBsaXN0aW5nIE1BQyBhZGRyZXNzZXMgaW4gYSBuZXR3b3JrIGFsbG93 cyBtb25pdG9yaW5nIG9mIGRldmljZXMgYW5kIHRoZWlyIG1vdmVtZW50cy4gTG9jYXRpb24gaW5m b3JtYXRpb24gY2FuIGJlIGRlcml2ZWQgZnJvbSBNQUMgYWRkcmVzc2VzIG9mIG5ldHdvcmsgZGV2 aWNlcywgYnlwYXNzaW5nIHByb3RlY3Rpb24gb2YgbG9jYXRpb24gaW5mb3JtYXRpb24gYnkgdGhl IE9wZXJhdGluZyBTeXN0ZW0uDQoNCg0KDQpEZXBsb3ltZW50cyBzaG91bGQgbWl0aWdhdGUgdGhp cyBwcml2YWN5IGNvbmNlcm5zIGJ5IGxpbWl0aW5nIGFjY2VzcyB0byB0aGUgbGF5ZXIgMiB0b3Bv bG9neSBpbmZvcm1hdGlvbi4gQWNjZXNzIHRvIHRoZSBpbmZvcm1hdGlvbiBzaG91bGQgYmUgcmVz dHJpY3RlZCB0byBhIG1pbmltYWwgbGlzdCBvZiBhdXRob3JpemVkIGFnZW50cywgYW5kIHNob3Vs ZCByZXF1aXJlIHByb3BlciBhdXRoZW50aWNhdGlvbiBvZiB0aGVzZSBhZ2VudHMuDQoNCg0KDQot LSBDaHJpc3RpYW4gSHVpdGVtYQ0KDQoNCg0KT24gNi8yNS8yMDIwIDc6MDAgQU0sIFN1c2FuIEhh cmVzIHdyb3RlOg0KDQo+IFFpbiBhbmQgQ2hyaXN0aWFuOg0KDQo+DQoNCj4gVGhhbmsgeW91IGZv ciB5b3VyIHByb21wdCBhdHRlbnRpb24gdG8gdGhlIHByaXZhY3kgaXNzdWUuDQoNCj4gSSdtIHN1 cmUgQ2hyaXN0aWFuIHdpbGwgcmVzcG9uZCBpbiBhIGJpdCAtIHNpbmNlIGhlIG1pZ2h0IGJlIGlu IFBEVCB0aW1lLXpvbmUuDQoNCj4NCg0KPiBPbmNlIHlvdSBoYXZlIGEgc29sdXRpb24geW91IGJv dGggbGlrZSwgd2Ugc2hvdWxkIHZhbGlkYXRlIHRoZSBwcml2YWN5DQoNCj4gY2hhbmdlcyB0byB0 aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2VjdGlvbiB3aXRoIHRoZSBZYW5nLWRvY3RvcnMs DQoNCj4gT1BTLUFEcywgYW5kIFNlY3VyaXR5LUFEcy4NCg0KPg0KDQo+IE1hcnRpbidzIHdhdGNo aW5nIHRoaXMgdGhyZWFkIHNvIEknbSBzdXJlIGhlJ2xsIGhlbHAgdXMgb3V0IGFzIHdlbGwuDQoN Cj4NCg0KPiBTdWUNCg0KPg0KDQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQoNCj4gRnJv bTogaTJycyBbbWFpbHRvOmkycnMtYm91bmNlc0BpZXRmLm9yZ10gT24gQmVoYWxmIE9mIFFpbiBX dQ0KDQo+IFNlbnQ6IFRodXJzZGF5LCBKdW5lIDI1LCAyMDIwIDk6MjUgQU0NCg0KPiBUbzogU3Vz YW4gSGFyZXM7ICdDaHJpc3RpYW4gSHVpdGVtYSc7IHNlY2RpckBpZXRmLm9yZzxtYWlsdG86c2Vj ZGlyQGlldGYub3JnPg0KDQo+IENjOiBpMnJzQGlldGYub3JnPG1haWx0bzppMnJzQGlldGYub3Jn PjsNCg0KPiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LmFsbEBpZXRm Lm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5hbGxA aWV0Zi5vcmc+Ow0KDQo+IGxhc3QtY2FsbEBpZXRmLm9yZzxtYWlsdG86bGFzdC1jYWxsQGlldGYu b3JnPg0KDQo+IFN1YmplY3Q6IFJlOiBbaTJyc10gU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YN Cg0KPiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LTEzDQoNCj4NCg0K PiBTdWUgYW5kIENocmlzdGlhbjoNCg0KPiBJIGhhdmUgcmVzcG9uZGVkIHRvIENocmlzdGlhbiBv biBwcml2YWN5IGlzc3VlLCBteSBwcm9wb3NhbCBpcyB0byBhZGQgTUFDIGFkZHJlc3MgYXMgYW5v dGhlciBkYXRhIG5vZGUgdnVsbmVyYWJpbGl0eSBleGFtcGxlIGluIG91ciBvcmlnaW5hbCBzZWN1 cml0eSBjb25zaWRlcmF0aW9uIHNlY3Rpb24uDQoNCj4gQnV0IElmIENocmlzdGlhbiBvciBzZWN1 cml0eSBkaXJlY3RvcmF0ZSBoYXMgcmVjb21tZW5kaW5nIHRleHQsIHdlIGF1dGhvcnMgYXJlIGhh cHB5IHRvIGFjY2VwdCBpdC4NCg0KPg0KDQo+IC1RaW4NCg0KPiAtLS0tLemCruS7tuWOn+S7ti0t LS0tDQoNCj4g5Y+R5Lu25Lq6OiBTdXNhbiBIYXJlcyBbbWFpbHRvOnNoYXJlc0BuZHpoLmNvbV0N Cg0KPiDlj5HpgIHml7bpl7Q6IDIwMjDlubQ25pyIMjXml6UgMjE6MDQNCg0KPiDmlLbku7bkuro6 ICdDaHJpc3RpYW4gSHVpdGVtYScgPGh1aXRlbWFAaHVpdGVtYS5uZXQ8bWFpbHRvOmh1aXRlbWFA aHVpdGVtYS5uZXQ+Pjsgc2VjZGlyQGlldGYub3JnPG1haWx0bzpzZWNkaXJAaWV0Zi5vcmc+DQoN Cj4g5oqE6YCBOiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LmFsbEBp ZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5h bGxAaWV0Zi5vcmc+Ow0KDQo+IGkycnNAaWV0Zi5vcmc8bWFpbHRvOmkycnNAaWV0Zi5vcmc+OyBs YXN0LWNhbGxAaWV0Zi5vcmc8bWFpbHRvOmxhc3QtY2FsbEBpZXRmLm9yZz4NCg0KPiDkuLvpopg6 IFJFOiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZg0KDQo+IGRyYWZ0LWlldGYtaTJycy15YW5n LWwyLW5ldHdvcmstdG9wb2xvZ3ktMTMNCg0KPg0KDQo+IENocmlzdGlhbjoNCg0KPg0KDQo+IFRo YW5rIHlvdSBmb3IgY2F0Y2hpbmcgdGhlIHByaXZhY3kgaXNzdWVzLg0KDQo+DQoNCj4gSSd2ZSBn b3QgYSBmZXcgcXVlc3Rpb25zIHRvIGhlbHAgdGhlIGF1dGhvcnMgc2NvcGUgdGhpcyBjaGFuZ2U6 DQoNCj4NCg0KPiAxKSBTaW5jZSB0aGlzIGlzIGNvbW1vbiB0byBhbGwgTDIgVG9wb2xvZ2llcywg Y2FuIHlvdSBvciB0aGUgc2VjdXJpdHkgZGlyZWN0b3JhdGUgcmVjb21tZW5kIHNvbWUgdGV4dCB0 aGF0IG1pZ2h0IGJlIGFwcHJvcHJpYXRlPw0KDQo+ICAgIElmIHlvdSBoYXZlIHJlY29tbWVuZGVk IHRleHQsIGhhcyB0aGlzIHRleHQgYmVlbiByZXZpZXdlZCBieSBPUFMtRElSIGFuZCBZYW5nIGRv Y3RvcnM/DQoNCj4NCg0KPiAyKSBXaWxsIGl0IGJlIGEgcHJvYmxlbSBJZiB3ZSB3cml0ZSBwcml2 YWN5IGNvbnNpZGVyYXRpb25zIG9uIElFRUUgc3BlY2lmaWNhdGlvbnM/DQoNCj4gMykgRG8gd2Ug bmVlZCB0byBjb25zaWRlciB0aGUgcmFuZ2Ugb2YgZGVwbG95bWVudHMgb2YgTDIgKGhvbWUsDQoN Cj4gZW50ZXJwcmlzZSwgIHB1YmxpYyBQQkIgc2VydmljZSwgbmF0aW9uYWwgUEJCIHNlcnZpY2Us IERhdGEgY2VudGVycykNCg0KPg0KDQo+DQoNCj4gVGhhbmsgeW91LCAgU3VlDQoNCj4NCg0KPg0K DQo+IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQoNCj4gRnJvbTogQ2hyaXN0aWFuIEh1aXRl bWEgdmlhIERhdGF0cmFja2VyIFttYWlsdG86bm9yZXBseUBpZXRmLm9yZ10NCg0KPiBTZW50OiBU aHVyc2RheSwgSnVuZSAyNSwgMjAyMCAxOjAxIEFNDQoNCj4gVG86IHNlY2RpckBpZXRmLm9yZzxt YWlsdG86c2VjZGlyQGlldGYub3JnPg0KDQo+IENjOiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1u ZXR3b3JrLXRvcG9sb2d5LmFsbEBpZXRmLm9yZzxtYWlsdG86ZHJhZnQtaWV0Zi1pMnJzLXlhbmct bDItbmV0d29yay10b3BvbG9neS5hbGxAaWV0Zi5vcmc+Ow0KDQo+IGkycnNAaWV0Zi5vcmc8bWFp bHRvOmkycnNAaWV0Zi5vcmc+OyBsYXN0LWNhbGxAaWV0Zi5vcmc8bWFpbHRvOmxhc3QtY2FsbEBp ZXRmLm9yZz4NCg0KPiBTdWJqZWN0OiBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZg0KDQo+IGRy YWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3ktMTMNCg0KPg0KDQo+IFJldmll d2VyOiBDaHJpc3RpYW4gSHVpdGVtYQ0KDQo+IFJldmlldyByZXN1bHQ6IEhhcyBJc3N1ZXMNCg0K Pg0KDQo+IEkgaGF2ZSByZXZpZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3Vy aXR5IGRpcmVjdG9yYXRlJ3Mgb25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3Vt ZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhlIElFU0cuICBUaGVzZSBjb21tZW50cyB3ZXJlIHdy aXR0ZW4gd2l0aCB0aGUgaW50ZW50IG9mIGltcHJvdmluZyBzZWN1cml0eSByZXF1aXJlbWVudHMg YW5kIGNvbnNpZGVyYXRpb25zIGluIElFVEYgZHJhZnRzLiAgQ29tbWVudHMgbm90IGFkZHJlc3Nl ZCBpbiBsYXN0IGNhbGwgbWF5IGJlIGluY2x1ZGVkIGluIEFEIHJldmlld3MgZHVyaW5nIHRoZSBJ RVNHIHJldmlldy4gIERvY3VtZW50IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQg dGhlc2UgY29tbWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoN Cj4NCg0KPiBUaGlzIGRvY3VtZW50IGRlc2NyaWJlcyBhIFlhbmcgbW9kZWwgZm9yIHJlcHJlc2Vu dGluZyBMaW5rIExheWVyIHRvcG9sb2dpZXMuDQoNCj4gUmVwcmVzZW50aW5nIHN1Y2ggdG9wb2xv Z2llcyBpcyBvYnZpb3VzbHkgdXNlZnVsIGZvciBtYW5hZ2luZyBuZXR3b3JrLg0KDQo+IFRoZSBz ZWN1cml0eSBzZWN0aW9uIGlzIGZvY3VzZWQgb24gc2VjdXJpbmcgdGhlIHVzYWdlIG9mIHRoaXMg aW5mb3JtYXRpb24gZm9yIG5ldHdvcmsgbWFuYWdlbWVudCwgYnV0IGRvZXMgbm90IGFkZHJlc3Mg cG90ZW50aWFsIHByaXZhY3kgaXNzdWVzLg0KDQo+DQoNCj4gVGhlIHNlY3VyaXR5IGNvbnNpZGVy YXRpb25zIGV4cGxhaW4gY29ycmVjdGx5IGhvdyBhbHRlcmluZyB0aGUgbGluayBsYXllciBpbmZv cm1hdGlvbiBjb3VsZCBlbmFibGUgYXR0YWNrcyBhZ2FpbnN0IHRoZSBuZXR3b3JrLiBUaGUgcHJv cG9zZWQgcmVtZWR5IGlzIGFjY2VzcyBjb250cm9sLCBpbXBsZW1lbnRlZCB1c2luZyBlaXRoZXIg U1NIIG9yIFRMUy4gVGhpcyBpcyBmaW5lLCBhbHRob3VnaCB0aGUgZGlzY3Vzc2lvbiBvZiBUTFMg YXV0aG9yaXNhdGlvbiBpcyBhIGJpdCBzaG9ydC4gQnkgZGVmYXVsdCwgVExTIHZlcmlmaWVzIHRo ZSBpZGVudGl0eSBvZiB0aGUgc2VydmVyIGJ1dCBub3QgdGhhdCBvZiB0aGUgY2xpZW50LiBSRkM4 MDQwIHNlY3Rpb24gMi41IHNwZWNpZmllcyB0aGF0ICJhIFJFU1RDT05GIHNlcnZlciBTSE9VTEQg cmVxdWlyZSBhdXRoZW50aWNhdGlvbiBiYXNlZCBvbiBUTFMgY2xpZW50IGNlcnRpZmljYXRlcy4g SSBhc3N1bWUgdGhhdCdzIHRoZSBpbnRlbnQsIGJ1dCBpdCBtaWdodCBiZSB1c2VmdWwgdG8gc2F5 IHNvLg0KDQo+DQoNCj4gT24gdGhlIG90aGVyIGhhbmQsIHRoZSBzZWN1cml0eSBjb25zaWRlcmF0 aW9ucyBkbyBub3QgZGVzY3JpYmUgcHJpdmFjeSBpc3N1ZXMsIGFuZCBJIGZpbmQgdGhhdCBwcm9i bGVtYXRpYy4gVGhlIHByb3Bvc2VkIGluZm9ybWF0aW9uIG1vZGVsIGxpc3RzIGEgbnVtYmVyIG9m IHNlbnNpdGl2ZSBkYXRhLCBzdWNoIGFzIGZvciBleGFtcGxlIHRoZSBNQUMgYWRkcmVzc2VzIG9m IGRldmljZXMuDQoNCj4gVGhpcyBpbmZvcm1hdGlvbiBjYW4gYmUgbWlzdXNlZC4gRm9yIGV4YW1w bGUsIGFwcGxpY2F0aW9ucyBjb3VsZCBhc3Nlc3MgZGV2aWNlIGxvY2F0aW9uIGZldGNoaW5nIHRo ZSBNQUMgYWRkcmVzc2VzIG9mIGxvY2FsIGdhdGV3YXlzLiBUaGlyZCBwYXJ0aWVzIGNvdWxkIGFj Y2VzcyBsaW5rIGxvY2FsIGluZm9ybWF0aW9uIHRvIGdhdGhlciBpZGVudGl0aWVzIG9mIGRldmlj ZXMgYWNjZXNzaW5nIGEgcGFydGljdWxhciBuZXR3b3JrLiBTdWNoIGluZm9ybWF0aW9uIGlzIG9m dGVuIHByb3RlY3RlZCBieSBwcml2YWN5IEFQSSBpbiB0aGUgT3BlcmF0aW5nIFN5c3RlbSwgYnV0 IGFjY2Vzc2luZyB0aGUgWWFuZyBtb2R1bGUgb3ZlciB0aGUgbmV0d29yayBtaWdodCBhbGxvdyBh cHBsaWNhdGlvbnMgdG8gYnlwYXNzIHRoZXNlIGNvbnRyb2xzLg0KDQo+DQoNCj4gQ2xpZW50IGF1 dGhlbnRpY2F0aW9uIGFsb25lIGRvZXMgbm90IG5lY2Vzc2FyaWx5IHByb3RlY3QgYWdhaW5zdCB0 aGVzZSBwcml2YWN5IGxlYWtzLiBBIGNsYXNzaWMgY29uZmlndXJhdGlvbiBlcnJvciB3b3VsZCBs aW1pdCB3cml0ZSBhY2Nlc3MgdG8gYXV0aG9yaXplZCB1c2VycywgYnV0IHRvIGFsbG93IHJlYWQt b25seSBhY2Nlc3MgdG8gbW9zdCB1c2Vycy4gVGhpcyBraW5kIG9mIGVycm9yIHdvdWxkIGFsbG93 IHByaXZhY3kgbGVha3MuIEdpdmVuIHRoZSBzZW5zaXRpdmUgbmF0dXJlIG9mIE1BQyBhZGRyZXNz ZXMgYW5kIG90aGVyIGlkZW50aWZpZXJzLCBpdCBpcyB1c2VmdWwgdG8gd2FybiBhZ2FpbnN0IHN1 Y2ggZXJyb3JzLg0KDQo+DQoNCj4NCg0KPg0KDQo+DQoNCj4NCg0KPiBfX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQo+IGkycnMgbWFpbGluZyBsaXN0DQoN Cj4gaTJyc0BpZXRmLm9yZzxtYWlsdG86aTJyc0BpZXRmLm9yZz4NCg0KPiBodHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2kycnMNCg0KPg0K --_000_B8F9A780D330094D99AF023C5877DABAAD7BE6C3dggeml531mbschi_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 5a6L5L2TOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KQGZvbnQtZmFjZQ0KCXtm b250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMgMiA0 O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUg MiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQOWui+S9kyI7DQoJ cGFub3NlLTE6MiAxIDYgMCAzIDEgMSAxIDEgMTt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5 OuW+rui9r+mbhem7kTsNCglwYW5vc2UtMToyIDExIDUgMyAyIDIgNCAyIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OiJcQOW+rui9r+mbhem7kSI7DQoJcGFub3NlLTE6MiAxMSA1IDMg MiAyIDQgMiAyIDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5N c29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4w MDAxcHQ7DQoJdGV4dC1hbGlnbjpqdXN0aWZ5Ow0KCXRleHQtanVzdGlmeTppbnRlci1pZGVvZ3Jh cGg7DQoJZm9udC1zaXplOjEwLjVwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsN Cgljb2xvcjojMDU2M0MxOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVk LCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCglj b2xvcjojOTU0RjcyOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5Nc29QbGFpblRl eHQsIGxpLk1zb1BsYWluVGV4dCwgZGl2Lk1zb1BsYWluVGV4dA0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6Iue6r+aWh+acrCBDaGFyIjsNCgltYXJnaW46MGNtOw0K CW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCgl0ZXh0LWFsaWduOmxlZnQ7DQoJZm9udC1zaXplOjEw LjVwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpwDQoJe21zby1zdHls ZS1wcmlvcml0eTo5OTsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCgl0 ZXh0LWFsaWduOmp1c3RpZnk7DQoJdGV4dC1qdXN0aWZ5OmludGVyLWlkZW9ncmFwaDsNCglmb250 LXNpemU6MTAuNXB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4u Q2hhcg0KCXttc28tc3R5bGUtbmFtZToi57qv5paH5pysIENoYXIiOw0KCW1zby1zdHlsZS1wcmlv cml0eTo5OTsNCgltc28tc3R5bGUtbGluazrnuq/mlofmnKw7DQoJZm9udC1mYW1pbHk6IkNhbGli cmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5FbWFpbFN0eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVy c29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6 IzFGNDk3RDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsN Cglmb250LXNpemU6MTAuMHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQg NzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDkwLjBwdCA3Mi4wcHQgOTAuMHB0O30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0K QGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6OTMzNTA5ODg3Ow0KCW1zby1saXN0LXR5cGU6aHlicmlk Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczotMTIwMjgzMTE1NiAxNTYwMzAyMDE2IDY3Njk4NzEz IDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3 Njk4NzE1O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCglt c28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6MTguMHB0Ow0KCXRl eHQtaW5kZW50Oi0xOC4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXIt Zm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10ZXh0OiIlMlwpIjsNCgltc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2lu LWxlZnQ6NDIuMHB0Ow0KCXRleHQtaW5kZW50Oi0yMS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246cmlnaHQ7DQoJbWFyZ2luLWxlZnQ6 NjMuMHB0Ow0KCXRleHQtaW5kZW50Oi0yMS4wcHQ7fQ0KQGxpc3QgbDA6bGV2ZWw0DQoJe21zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCglt YXJnaW4tbGVmdDo4NC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTIxLjBwdDt9DQpAbGlzdCBsMDpsZXZl bDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRl eHQ6IiU1XCkiOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgltYXJnaW4tbGVmdDoxMDUuMHB0Ow0KCXRleHQtaW5kZW50Oi0yMS4w cHQ7fQ0KQGxpc3QgbDA6bGV2ZWw2DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFuLWxv d2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRp b246cmlnaHQ7DQoJbWFyZ2luLWxlZnQ6MTI2LjBwdDsNCgl0ZXh0LWluZGVudDotMjEuMHB0O30N CkBsaXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwt bnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6MTQ3LjBwdDsNCgl0ZXh0LWluZGVu dDotMjEuMHB0O30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDph bHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGV4dDoiJThcKSI7DQoJbXNvLWxldmVsLXRhYi1zdG9w Om5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjE2 OC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTIxLjBwdDt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgltYXJnaW4tbGVmdDoxODkuMHB0 Ow0KCXRleHQtaW5kZW50Oi0yMS4wcHQ7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KdWwN Cgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHht bD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3ht bD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6 ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBl bGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iWkgtQ04iIGxp bms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+VGhhbmtzIENocmlz dGlhbiBmb3IgY2xhcmlmaWNhdGlvbiwgaGVyZSBpcyB0aGUgdHdlYWtlZCB0ZXh0IHRvIGFkZHJl c3MgeW91ciBjb21tZW50LCB3aGljaCBpcyBwb3NpdGlvbmVkIHJpZ2h0IGFmdGVyIHRoZSBkaXNj dXNzaW9uIGFib3V0IHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUgYXR0cmlidXRlcy48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBsYW5n PSJFTi1VUyI+TkVXIFRFWFQ6PG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+4oCcPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPjYuJm5ic3A7IFNlY3VyaXR5IENvbnNpZGVyYXRpb25zPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDsmbmJzcDsgVGhlIFlBTkcgbW9kdWxlIHNwZWNpZmllZCBpbiB0aGlzIGRv Y3VtZW50IGRlZmluZXMgYSBzY2hlbWEgZm9yIGRhdGE8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRo YXQgaXMgZGVzaWduZWQgdG8gYmUgYWNjZXNzZWQgdmlhIG5ldHdvcmsgbWFuYWdlbWVudCBwcm90 b2NvbHMgc3VjaDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgYXMgTkVUQ09ORiBbUkZDNjI0MV0gb3Ig UkVTVENPTkYgW1JGQzgwNDBdLiZuYnNwOyBUaGUgbG93ZXN0IE5FVENPTkYgbGF5ZXI8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+Jm5ic3A7Jm5ic3A7IGlzIHRoZSBzZWN1cmUgdHJhbnNwb3J0IGxheWVyLCBhbmQgdGhlIG1h bmRhdG9yeS10by1pbXBsZW1lbnQgc2VjdXJlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB0cmFuc3Bv cnQgaXMgU2VjdXJlIFNoZWxsIChTU0gpIFtSRkM2MjQyXS4mbmJzcDsgVGhlIGxvd2VzdCBSRVNU Q09ORiBsYXllcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgaXMgSFRUUFMsIGFuZCB0aGUgbWFuZGF0 b3J5LXRvLWltcGxlbWVudCBzZWN1cmUgdHJhbnNwb3J0IGlzIFRMUzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsm bmJzcDsgW1JGQzg0NDZdLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFRo ZSBOZXR3b3JrIENvbmZpZ3VyYXRpb24gQWNjZXNzIENvbnRyb2wgTW9kZWwgKE5BQ00pIFtSRkM4 MzQxXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgcHJvdmlkZXMgdGhlIG1lYW5zIHRvIHJlc3RyaWN0 IGFjY2VzcyBmb3IgcGFydGljdWxhciBORVRDT05GIG9yPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsmbmJzcDsgUkVTVENPTkYgdXNlcnMgdG8gYSBwcmVjb25maWd1cmVkIHN1YnNldCBv ZiBhbGwgYXZhaWxhYmxlIE5FVENPTkYgb3I8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFJFU1RDT05G IHByb3RvY29sIG9wZXJhdGlvbnMgYW5kIGNvbnRlbnQuPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsmbmJzcDsgVGhlIExheWVyIDIgdG9wb2xvZ3kgbW9kdWxlIGRlZmluZSBpbmZvcm1h dGlvbiB0aGF0IGNhbiBiZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgY29uZmlndXJhYmxlIGluIGNl cnRhaW4gaW5zdGFuY2VzLCBmb3IgZXhhbXBsZSBpbiB0aGUgY2FzZSBvZiB2aXJ0dWFsPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyB0b3BvbG9naWVzIHRoYXQgY2FuIGJlIGNyZWF0ZWQgYnkgY2xpZW50 IGFwcGxpY2F0aW9ucy4mbmJzcDsgSW4gc3VjaDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgY2FzZXMs IGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBpbnRyb2R1Y2UgdG9wb2xvZ2llcyB0aGF0IGFyZTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDsmbmJzcDsgdW5kZXNpcmVkLiZuYnNwOyBTcGVjaWZpY2FsbHksIGEgbWFs aWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHJlbW92ZTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJz cDsgb3IgYWRkIGEgbm9kZSwgYSBsaW5rLCBhIHRlcm1pbmF0aW9uIHBvaW50LCBieSBjcmVhdGlu ZyBvciBkZWxldGluZzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgY29ycmVzcG9uZGluZyBlbGVtZW50 cyBpbiB0aGUgbm9kZSwgbGluaywgYW5kIHRlcm1pbmF0aW9uIHBvaW50PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OyZuYnNwOyBsaXN0cywgcmVzcGVjdGl2ZWx5LiZuYnNwOyBJbiB0aGUgY2FzZSBvZiBhIHRvcG9s b2d5IHRoYXQgaXMgbGVhcm5lZCwgdGhlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBzZXJ2ZXIgd2ls bCBhdXRvbWF0aWNhbGx5IHByb2hpYml0IHN1Y2ggbWlzY29uZmlndXJhdGlvbiBhdHRlbXB0cy48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IEluIHRoZSBjYXNlIG9mIGEgdG9wb2xvZ3kgdGhhdCBpcyBj b25maWd1cmVkLCBpLmUuIHdob3NlIG9yaWdpbiBpczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgJnF1 b3Q7aW50ZW5kZWQmcXVvdDssIHRoZSB1bmRlc2lyZWQgY29uZmlndXJhdGlvbiBjb3VsZCBiZWNv bWUgZWZmZWN0aXZlIGFuZCBiZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgcmVmbGVjdGVkIGluIHRo ZSBvcGVyYXRpb25hbCBzdGF0ZSBkYXRhc3RvcmUsIGxlYWRpbmcgdG8gZGlzcnVwdGlvbjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mbmJzcDsmbmJzcDsgb2Ygc2VydmljZXMgcHJvdmlkZWQgdmlhIHRoaXMgdG9wb2xvZ3kg bWlnaHQgYmUgZGlzcnVwdGVkLiZuYnNwOyBGb3IgdGhvc2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7 IHJlYXNvbnMsIGl0IGlzIGltcG9ydGFudCB0aGF0IHRoZSBORVRDT05GIGFjY2VzcyBjb250cm9s IG1vZGVsIGlzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB2aWdvcm91c2x5IGFwcGxpZWQgdG8gcHJl dmVudCB0b3BvbG9neSBtaXNjb25maWd1cmF0aW9uIGJ5PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB1 bmF1dGhvcml6ZWQgY2xpZW50cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNw OyBUaGVyZSBhcmUgYSBudW1iZXIgb2YgZGF0YSBub2RlcyBkZWZpbmVkIGluIHRoaXMgWUFORyBt b2R1bGUgdGhhdCBhcmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHdyaXRhYmxlL2NyZWF0YWJsZS9k ZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVlLCB3aGljaCBpcyB0aGU8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7 Jm5ic3A7IGRlZmF1bHQpLiZuYnNwOyBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBjb25zaWRlcmVk IHNlbnNpdGl2ZSBvciB2dWxuZXJhYmxlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBpbiBzb21lIG5l dHdvcmsgZW52aXJvbm1lbnRzLiZuYnNwOyBXcml0ZSBvcGVyYXRpb25zIChlLmcuLCBlZGl0LWNv bmZpZyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRvIHRoZXNlIGRhdGEgbm9kZXMgd2l0aG91dCBw cm9wZXIgcHJvdGVjdGlvbiBjYW4gaGF2ZSBhIG5lZ2F0aXZlPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNw OyBlZmZlY3Qgb24gbmV0d29yayBvcGVyYXRpb25zLiZuYnNwOyBUaGVzZSBhcmUgdGhlIHN1YnRy ZWVzIGFuZCBkYXRhIG5vZGVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBhbmQgdGhlaXIgc2Vuc2l0 aXZpdHkvdnVsbmVyYWJpbGl0eSBpbiB0aGUgaWV0Zi1uZXR3b3JrIG1vZHVsZTo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLW5ldHdvcmstYXR0cmlidXRl czogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG88bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9uIG9mIGFueSBv ZiB0aGUgY29udGFpbmVkIGF0dHJpYnV0ZXMsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyAmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDtzdWNoIGFzIHRoZSBuYW1lIG9yIHRoZSBmbGFnIGRhdGEgbm9kZXMuPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1ub2RlLWF0dHJpYnV0 ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBv cnRhbnQgbm9kZSBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBuYW1lPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvciB0aGUgbWFuYWdlbWVudC1hZGRyZXNzLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgbDItbGluay1hdHRyaWJ1dGVz OiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0byBzYWJvdGFnZTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0 YW50IGxpbmsgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgcmF0ZTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsgb3IgdGhlIGRlbGF5IGRhdGEgbm9kZXMuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi10ZXJtaW5hdGlvbi1wb2ludC1h dHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdG8gc2Fib3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24g b2YgaW1wb3J0YW50IHRlcm1pbmF0aW9uIHBvaW50PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBtYXhpbXVtLWZyYW1lLXNpemUu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Tb21lIG9mIHRoZSByZWFkYWJsZSBkYXRhIG5vZGVz IGluIHRoaXMgWUFORyBtb2R1bGUgbWF5IGJlIGNvbnNpZGVyZWQNCjxvOnA+PC9vOnA+PC9zcGFu PjwvYj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+c2Vu c2l0aXZlIG9yIHZ1bG5lcmFibGUgaW4gc29tZSBuZXR3b3JrIGVudmlyb25tZW50cy4gSXQgaXMg dGh1cyAmbmJzcDtpbXBvcnRhbnQgdG8gY29udHJvbA0KPG86cD48L286cD48L3NwYW4+PC9iPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5yZWFkIGFjY2Vz cyAoZS5nLiwgdmlhIGdldCwgZ2V0LWNvbmZpZywgb3Igbm90aWZpY2F0aW9uKSB0byB0aGVzZSBk YXRhIG5vZGVzLiBJbiBwYXJ0aWN1bGFyLCB0aGUNCjxvOnA+PC9vOnA+PC9zcGFuPjwvYj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBsYW5nPSJFTi1VUyI+WUFORyBtb2RlbCBm b3IgbGF5ZXIgMiB0b3BvbG9neSBtYXkgZXhwb3NlIHNlbnNpdGl2ZSBpbmZvcm1hdGlvbiwgZm9y IGV4YW1wbGUgdGhlIE1BQw0KPG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5hZGRyZXNzZXMgb2YgZGV2aWNlcy4gVW5y ZXN0cmljdGVkIHVzZSBvZiBzdWNoIGluZm9ybWF0aW9uJm5ic3A7Y2FuIGxlYWQgdG8gcHJpdmFj eSB2aW9sYXRpb25zLg0KPG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj5Gb3IgZXhhbXBsZSwgbGlzdGluZyBNQUMgYWRk cmVzc2VzIGluIGEgbmV0d29yayBhbGxvd3MgbW9uaXRvcmluZyBvZiBkZXZpY2VzIGFuZCB0aGVp cg0KPG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIGxhbmc9IkVOLVVTIj5tb3ZlbWVudHMuIExvY2F0aW9uIGluZm9ybWF0aW9uIGNhbiBiZSBk ZXJpdmVkIGZyb20gTUFDIGFkZHJlc3NlcyBvZiBuZXR3b3JrIGRldmljZXMsDQo8bzpwPjwvbzpw Pjwvc3Bhbj48L2I+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4t VVMiPmJ5cGFzc2luZyBwcm90ZWN0aW9uIG9mIGxvY2F0aW9uIGluZm9ybWF0aW9uIGJ5IHRoZSBP cGVyYXRpbmcgU3lzdGVtLg0KPG86cD48L286cD48L3NwYW4+PC9iPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIGxhbmc9IkVOLVVTIiBzdHlsZT0iY29sb3I6IzFGNDk3RCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPuKAnTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGFua3MuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4t UWluPG86cD48L286cD48L3NwYW4+PC9wPg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNt Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJsZWZ0IiBzdHlsZT0idGV4dC1hbGlnbjps ZWZ0Ij48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVvdDvl vq7ova/pm4Xpu5EmcXVvdDssc2Fucy1zZXJpZiI+5Y+R5Lu25Lq6PHNwYW4gbGFuZz0iRU4tVVMi Pjo8L3NwYW4+PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyIgc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q75b6u6L2v6ZuF6buRJnF1b3Q7LHNhbnMtc2VyaWYiPiBD aHJpc3RpYW4gSHVpdGVtYSBbbWFpbHRvOmh1aXRlbWFAaHVpdGVtYS5uZXRdDQo8YnI+DQo8L3Nw YW4+PGI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q75b6u 6L2v6ZuF6buRJnF1b3Q7LHNhbnMtc2VyaWYiPuWPkemAgeaXtumXtDxzcGFuIGxhbmc9IkVOLVVT Ij46PC9zcGFuPjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O+W+rui9r+mbhem7kSZxdW90OyxzYW5zLXNlcmlmIj4g MjAyMDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtmb250LWZhbWlseTomcXVv dDvlvq7ova/pm4Xpu5EmcXVvdDssc2Fucy1zZXJpZiI+5bm0PHNwYW4gbGFuZz0iRU4tVVMiPjY8 L3NwYW4+5pyIPHNwYW4gbGFuZz0iRU4tVVMiPjI2PC9zcGFuPuaXpTxzcGFuIGxhbmc9IkVOLVVT Ij4NCiAyMjo1NTxicj4NCjwvc3Bhbj48Yj7mlLbku7bkuro8c3BhbiBsYW5nPSJFTi1VUyI+Ojwv c3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPiBRaW4gV3UgJmx0O2JpbGwud3VAaHVhd2VpLmNv bSZndDs7IFN1c2FuIEhhcmVzICZsdDtzaGFyZXNAbmR6aC5jb20mZ3Q7OyBzZWNkaXJAaWV0Zi5v cmc8YnI+DQo8L3NwYW4+PGI+5oqE6YCBPHNwYW4gbGFuZz0iRU4tVVMiPjo8L3NwYW4+PC9iPjxz cGFuIGxhbmc9IkVOLVVTIj4gaTJyc0BpZXRmLm9yZzsgZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDIt bmV0d29yay10b3BvbG9neS5hbGxAaWV0Zi5vcmc7IGxhc3QtY2FsbEBpZXRmLm9yZzsgTkVUTU9E IEdyb3VwICZsdDtuZXRtb2RAaWV0Zi5vcmcmZ3Q7PGJyPg0KPC9zcGFuPjxiPuS4u+mimDxzcGFu IGxhbmc9IkVOLVVTIj46PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyI+IFJlOiBbTGFzdC1D YWxsXSBbaTJyc10gU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pMnJzLXlh bmctbDItbmV0d29yay10b3BvbG9neS0xMzxvOnA+PC9vOnA+PC9zcGFuPjwvc3Bhbj48L3A+DQo8 L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImxlZnQiIHN0eWxlPSJ0 ZXh0LWFsaWduOmxlZnQiPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cD48c3BhbiBsYW5nPSJFTi1VUyI+SSBsaWtlIHZhcmlhbnQgQiBiZXR0ZXIsIGFs dGhvdWdoIEkgd291bGQgbm90IHNpbmdsZSBvdXQgdGhlIG1hYyBhZGRyZXNzZXMgaW4gdGhlICZx dW90O3NhYm90YWdlJnF1b3Q7IHdhcm5pbmcuDQo8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJmb250LXNpemU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cD48c3BhbiBs YW5nPSJFTi1VUyI+TXkgbWFpbiBjb25jZXJuIGlzIHRoYXQgbmV0d29yayBhZG1pbmlzdHJhdG9y cyB3aWxsIG5hdHVyYWxseSBiZSB2ZXJ5IGNvbmNlcm5lZCBhYm91dCBpbmZvcm1hdGlvbiB0aGF0 IGlzIHdyaXRhYmxlL2NyZWF0YWJsZS9kZWxldGFibGUsIGJlY2F1c2UgdGhleSB1bmRlcnN0YW5k IHRoZSBpbXBhY3Qgb24gdGhlIG1hbmFnZW1lbnQgb2YgdGhlaXIgbmV0d29yay4gSG93ZXZlciwg dGhleSBhcmUgbm90IHNvIGNvbmNlcm5lZA0KIHdpdGggcmVhZC1vbmx5IGFjY2VzcywgYmVjYXVz ZSByZWFkaW5nIGluZm9ybWF0aW9uIGRvZXMgbm90IGRpcmVjdGx5IGFmZmVjdCB0aGUgb3BlcmF0 aW9uIG9mIHRoZSBuZXR3b3JrLiBNeSB3aG9sZSBwb2ludCBpcyB0ZWxsaW5nIHRoZW0sICZxdW90 O3lvdSBhcmUgZG9jdW1lbnRpbmcgeW91ciBMMiB0b3BvbG9neSwgaXQgY29udGFpbnMgc2Vuc2l0 aXZlIGluZm9ybWF0aW9uLCBtYWtlIHN1cmUgdGhhdCByZWFkaW5nIGl0IGlzIHByb3RlY3RlZCwg bm90DQoganVzdCB3cml0aW5nIGl0JnF1b3Q7LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwPjxz cGFuIGxhbmc9IkVOLVVTIj5JIGFncmVlIHRoYXQgTkVUQ09ORiBhbmQgUkVTVENPTkYgcHJvdmlk ZSB0aGUgcmlnaHQgdG9vbHMgZm9yIHByb3RlY3RpbmcgdGhlIGluZm9ybWF0aW9uLiBNeSByZXF1 ZXN0IGlzIGp1c3QgdG8gY2xlYXJseSB0ZWxsIG5ldHdvcmsgYWRtaW5pc3RyYXRvcnMgdG8gdXNl IHRoZXNlIHRvb2xzLCBkbyBub3QgbGVhdmUgcmVhZCBhY2Nlc3Mgd2lkZSBvcGVuITxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwPjxzcGFuIGxhbmc9IkVOLVVTIj4tLSBDaHJpc3RpYW4gSHVpdGVt YTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBsYW5nPSJFTi1VUyI+T24gNi8yNi8yMDIwIDQ6MzcgQU0sIFFpbiBXdSB3cm90ZTo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4tdG9wOjUu MHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPkhpLCBDaHJpc3RpYW46PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjE4LjBwdDt0ZXh0LWluZGVudDot MTguMHB0O21zby1saXN0OmwwIGxldmVsMSBsZm8yIj4NCjwhW2lmICFzdXBwb3J0TGlzdHNdPjxz cGFuIGxhbmc9IkVOLVVTIj48c3BhbiBzdHlsZT0ibXNvLWxpc3Q6SWdub3JlIj4xLjxzcGFuIHN0 eWxlPSJmb250OjcuMHB0ICZxdW90O1RpbWVzIE5ldyBSb21hbiZxdW90OyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7DQo8L3NwYW4+PC9zcGFuPjwvc3Bhbj48IVtlbmRpZl0+ PHNwYW4gbGFuZz0iRU4tVVMiPk5BQ00gZGVmaW5lZCBpbiBSRkM4MzQxIGhhcyBhbHJlYWR5IHBy b3ZpZGVkIG1lY2hhbmlzbXMgdG8gcmVzdHJpY3QgYWNjZXNzIHRvIHNlbnNpdGl2ZSBpbmZvcm1h dGlvbiB0byBhIG1pbmltYWwgbGlzdCBvZiBhdXRob3JpemVkIGNsaWVudCBvciBhZ2VudHMgYW5k IGRlYWwgd2l0aCBwcml2YWN5IGlzc3VlIGlmIG15IHVuZGVyc3RhbmRpbmcgaXMgY29ycmVjdC48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFy Z2luLWxlZnQ6MTguMHB0O3RleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxm bzIiPg0KPCFbaWYgIXN1cHBvcnRMaXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxl PSJtc28tbGlzdDpJZ25vcmUiPjIuPHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMg TmV3IFJvbWFuJnF1b3Q7Ij4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwhW2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+Qm90aCBORVRD T05GIGFuZCBSRVNUQ09ORiB3aWxsIHJlbHkgb24gdHJhbnNwb3J0IHByb3RvY29sIHN1Y2ggYXMg VExTIHRvIHByb3ZpZGUgY2xpZW50IGF1dGhlbnRpY2F0aW9uIGFuZCBzZXJ2ZXIgYXV0aGVudGlj YXRpb24sIGkuZS4sIG11dHVhbCBhdXRoZW50aWNhdGlvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0IiBzdHlsZT0ibWFyZ2luLWxlZnQ6MTguMHB0O3RleHQt aW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzIiPg0KPCFbaWYgIXN1cHBvcnRM aXN0c10+PHNwYW4gbGFuZz0iRU4tVVMiPjxzcGFuIHN0eWxlPSJtc28tbGlzdDpJZ25vcmUiPjMu PHNwYW4gc3R5bGU9ImZvbnQ6Ny4wcHQgJnF1b3Q7VGltZXMgTmV3IFJvbWFuJnF1b3Q7Ij4mbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsNCjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwh W2VuZGlmXT48c3BhbiBsYW5nPSJFTi1VUyI+VGhlIFlBTkcgc2VjdXJpdHkgZ3VpZGVsaW5lIGRl ZmluZWQgaW4NCjxhIGhyZWY9Imh0dHBzOi8vdHJhYy5pZXRmLm9yZy90cmFjL29wcy93aWtpL3lh bmctc2VjdXJpdHktZ3VpZGVsaW5lcyI+aHR0cHM6Ly90cmFjLmlldGYub3JnL3RyYWMvb3BzL3dp a2kveWFuZy1zZWN1cml0eS1ndWlkZWxpbmVzPC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiIHN0eWxlPSJ0ZXh0LWluZGVudDoyMS4wcHQiPjxzcGFuIGxh bmc9IkVOLVVTIj5Qcm92aWRlIHBlcmZlY3QgYm9pbGVycGxhdGUgdG8gYWRkcmVzcyBib3RoIHNl Y3VyaXR5IGNvbnNpZGVyYXRpb24gYW5kIHByaXZhY3kgY29uc2lkZXJhdGlvbi48bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ TXkgb3JpZ2luYWwgcHJvcG9zYWwgQSB0byBhZGRyZXNzIHlvdXIgY29tbWVudHMgaXM6PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPk9MRCBURVhUOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mcXVvdDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFRoZXJl IGFyZSBhIG51bWJlciBvZiBkYXRhIG5vZGVzIGRlZmluZWQgaW4gdGhpcyBZQU5HIG1vZHVsZSB0 aGF0IGFyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgd3JpdGFibGUvY3JlYXRhYmxlL2RlbGV0YWJs ZSAoaS5lLiwgY29uZmlnIHRydWUsIHdoaWNoIGlzIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg ZGVmYXVsdCkuJm5ic3A7IFRoZXNlIGRhdGEgbm9kZXMgbWF5IGJlIGNvbnNpZGVyZWQgc2Vuc2l0 aXZlIG9yIHZ1bG5lcmFibGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGluIHNvbWUgbmV0d29yayBl bnZpcm9ubWVudHMuJm5ic3A7IFdyaXRlIG9wZXJhdGlvbnMgKGUuZy4sIGVkaXQtY29uZmlnKTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDsmbmJzcDsgdG8gdGhlc2UgZGF0YSBub2RlcyB3aXRob3V0IHByb3BlciBw cm90ZWN0aW9uIGNhbiBoYXZlIGEgbmVnYXRpdmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGVmZmVj dCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMuJm5ic3A7IFRoZXNlIGFyZSB0aGUgc3VidHJlZXMgYW5k IGRhdGEgbm9kZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGFuZCB0aGVpciBzZW5zaXRpdml0eS92 dWxuZXJhYmlsaXR5IGluIHRoZSBpZXRmLW5ldHdvcmsgbW9kdWxlOjxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgbDItbmV0d29yay1hdHRyaWJ1dGVzOiBBIG1h bGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJz cDsmbmJzcDsmbmJzcDsgc2Fib3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24gb2YgYW55IG9mIHRoZSBj b250YWluZWQgYXR0cmlidXRlcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhlIGZsYWcgZGF0YSBub2Rlcy48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLW5vZGUtYXR0cmlidXRlczogQSBt YWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2U8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBu b2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG5hbWU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IG9yIHRoZSBtYW5hZ2VtZW50LWFkZHJlc3MuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1saW5rLWF0dHJpYnV0ZXM6IEEgbWFs aWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBvcnRhbnQgbGlu ayBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyBvciB0aGUgZGVsYXkgZGF0YSBub2Rlcy48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLXRlcm1pbmF0aW9uLXBvaW50LWF0dHJpYnV0 ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyB0byBzYWJvdGFnZSB0aGUgY29uZmlndXJhdGlvbiBvZiBpbXBv cnRhbnQgdGVybWluYXRpb24gcG9pbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUtc2l6ZS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+JnF1b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPk5FVyBURVhUOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mcXVvdDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7IFRoZXJlIGFyZSBhIG51bWJlciBvZiBkYXRhIG5vZGVzIGRlZmluZWQgaW4gdGhp cyBZQU5HIG1vZHVsZSB0aGF0IGFyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgd3JpdGFibGUvY3Jl YXRhYmxlL2RlbGV0YWJsZSAoaS5lLiwgY29uZmlnIHRydWUsIHdoaWNoIGlzIHRoZTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDsmbmJzcDsgZGVmYXVsdCkuJm5ic3A7IFRoZXNlIGRhdGEgbm9kZXMgbWF5IGJlIGNv bnNpZGVyZWQgc2Vuc2l0aXZlIG9yIHZ1bG5lcmFibGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGlu IHNvbWUgbmV0d29yayBlbnZpcm9ubWVudHMuJm5ic3A7IFdyaXRlIG9wZXJhdGlvbnMgKGUuZy4s IGVkaXQtY29uZmlnKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdG8gdGhlc2UgZGF0YSBub2RlcyB3 aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEgbmVnYXRpdmU8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7IGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlvbnMuJm5ic3A7IFRoZXNlIGFyZSB0 aGUgc3VidHJlZXMgYW5kIGRhdGEgbm9kZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGFuZCB0aGVp ciBzZW5zaXRpdml0eS92dWxuZXJhYmlsaXR5IGluIHRoZSBpZXRmLW5ldHdvcmsgbW9kdWxlOjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgbDItbmV0d29yay1h dHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0bzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgc2Fib3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24g b2YgYW55IG9mIHRoZSBjb250YWluZWQgYXR0cmlidXRlcyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IHN1Y2ggYXMgdGhlIG5hbWUgb3IgdGhlIGZsYWcgZGF0YSBub2Rl cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLW5vZGUt YXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2U8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHRoZSBjb25maWd1cmF0aW9u IG9mIGltcG9ydGFudCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG5hbWU8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICx0aGUgbWFuYWdlbWVudC1hZGRyZXNzIDxi Pm9yIG1hYyBhZGRyZXNzIG9mIHRoZSBkZXZpY2VzPC9iPi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLWxpbmstYXR0cmlidXRlczogQSBtYWxpY2lvdXMg Y2xpZW50IGNvdWxkIGF0dGVtcHQgdG8gc2Fib3RhZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7IHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBsaW5rIGF0dHJp YnV0ZXMsIHN1Y2ggYXMgdGhlIHJhdGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7 Jm5ic3A7IG9yIHRoZSBkZWxheSBkYXRhIG5vZGVzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7byZuYnNwOyBsMi10ZXJtaW5hdGlvbi1wb2ludC1hdHRyaWJ1dGVzOiBBIG1h bGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDsgdG8gc2Fib3RhZ2UgdGhlIGNvbmZpZ3VyYXRpb24gb2YgaW1wb3J0YW50IHRl cm1pbmF0aW9uIHBvaW50PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBh dHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBtYXhpbXVtLWZyYW1lLXNpemUsDQo8Yj5tYWMtYWRkcmVz czwvYj4uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+V2l0aCB5b3Vy IHByb3Bvc2VkIHRleHQsIHdlIGNvdWxkIGhhdmUgdGhlIGZvbGxvd2luZyBwcm9wb3NhbCBjaGFu Z2VzIChQcm9wb3NhbCBCKTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+T0xEIFRFWFQ6PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZxdW90OzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj42LiZuYnNwOyBTZWN1cml0eSBDb25zaWRlcmF0aW9uczxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jm5ic3A7Jm5ic3A7IFRoZSBZQU5HIG1vZHVsZSBzcGVjaWZpZWQgaW4gdGhpcyBkb2N1 bWVudCBkZWZpbmVzIGEgc2NoZW1hIGZvciBkYXRhPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB0aGF0 IGlzIGRlc2lnbmVkIHRvIGJlIGFjY2Vzc2VkIHZpYSBuZXR3b3JrIG1hbmFnZW1lbnQgcHJvdG9j b2xzIHN1Y2g8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGFzIE5FVENPTkYgW1JGQzYyNDFdIG9yIFJF U1RDT05GIFtSRkM4MDQwXS4mbmJzcDsgVGhlIGxvd2VzdCBORVRDT05GIGxheWVyPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyBpcyB0aGUgc2VjdXJlIHRyYW5zcG9ydCBsYXllciwgYW5kIHRoZSBtYW5k YXRvcnktdG8taW1wbGVtZW50IHNlY3VyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdHJhbnNwb3J0 IGlzIFNlY3VyZSBTaGVsbCAoU1NIKSBbUkZDNjI0Ml0uJm5ic3A7IFRoZSBsb3dlc3QgUkVTVENP TkYgbGF5ZXI8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGlzIEhUVFBTLCBhbmQgdGhlIG1hbmRhdG9y eS10by1pbXBsZW1lbnQgc2VjdXJlIHRyYW5zcG9ydCBpcyBUTFM8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7IFtSRkM4NDQ2XS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAg Y2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBUaGUg TmV0d29yayBDb25maWd1cmF0aW9uIEFjY2VzcyBDb250cm9sIE1vZGVsIChOQUNNKSBbUkZDODM0 MV08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHByb3ZpZGVzIHRoZSBtZWFucyB0byByZXN0cmljdCBh Y2Nlc3MgZm9yIHBhcnRpY3VsYXIgTkVUQ09ORiBvcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IFJFU1RDT05GIHVzZXJzIHRvIGEgcHJlY29uZmlndXJlZCBzdWJzZXQgb2Yg YWxsIGF2YWlsYWJsZSBORVRDT05GIG9yPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBSRVNUQ09ORiBw cm90b2NvbCBvcGVyYXRpb25zIGFuZCBjb250ZW50LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IEluIGdlbmVyYWwsIExheWVyIDIgbmV0d29yayB0b3BvbG9naWVzIGFyZSBz eXN0ZW0tY29udHJvbGxlZCBhbmQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHByb3ZpZGUgZXBoZW1l cmFsIHRvcG9sb2d5IGluZm9ybWF0aW9uLiZuYnNwOyBJbiBhbiBOTURBLWNvbXBsaWVudCBzZXJ2 ZXIsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB0aGV5IGFyZSBvbmx5IHBhcnQgb2YgJmx0O29wZXJh dGlvbmFsJmd0OyB3aGljaCBwcm92aWRlcyByZWFkLW9ubHkgYWNjZXNzPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OyZuYnNwOyB0byBjbGllbnRzLCB0aGV5IGFyZSBsZXNzIHZ1bG5lcmFibGUuJm5ic3A7IFRoYXQg c2FpZCwgdGhlIFlBTkcgbW9kdWxlPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBkb2VzIGluIHByaW5j aXBsZSBhbGxvdyBpbmZvcm1hdGlvbiB0byBiZSBjb25maWd1cmFibGUuPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgVGhlIExheWVyIDIgdG9wb2xvZ3kgbW9kdWxlIGRlZmlu ZSBpbmZvcm1hdGlvbiB0aGF0IGNhbiBiZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgY29uZmlndXJh YmxlIGluIGNlcnRhaW4gaW5zdGFuY2VzLCBmb3IgZXhhbXBsZSBpbiB0aGUgY2FzZSBvZiB2aXJ0 dWFsPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB0b3BvbG9naWVzIHRoYXQgY2FuIGJlIGNyZWF0ZWQg YnkgY2xpZW50IGFwcGxpY2F0aW9ucy4mbmJzcDsgSW4gc3VjaDxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJz cDsgY2FzZXMsIGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBpbnRyb2R1Y2UgdG9wb2xvZ2llcyB0 aGF0IGFyZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdW5kZXNpcmVkLiZuYnNwOyBTcGVjaWZpY2Fs bHksIGEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHJlbW92ZTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsgb3IgYWRkIGEgbm9kZSwgYSBsaW5rLCBhIHRlcm1pbmF0aW9uIHBvaW50LCBi eSBjcmVhdGluZyBvciBkZWxldGluZzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgY29ycmVzcG9uZGlu ZyBlbGVtZW50cyBpbiB0aGUgbm9kZSwgbGluaywgYW5kIHRlcm1pbmF0aW9uIHBvaW50PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyBsaXN0cywgcmVzcGVjdGl2ZWx5LiZuYnNwOyBJbiB0aGUgY2FzZSBv ZiBhIHRvcG9sb2d5IHRoYXQgaXMgbGVhcm5lZCwgdGhlPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBz ZXJ2ZXIgd2lsbCBhdXRvbWF0aWNhbGx5IHByb2hpYml0IHN1Y2ggbWlzY29uZmlndXJhdGlvbiBh dHRlbXB0cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IEluIHRoZSBjYXNlIG9mIGEgdG9wb2xvZ3kg dGhhdCBpcyBjb25maWd1cmVkLCBpLmUuIHdob3NlIG9yaWdpbiBpczxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsm bmJzcDsgJnF1b3Q7aW50ZW5kZWQmcXVvdDssIHRoZSB1bmRlc2lyZWQgY29uZmlndXJhdGlvbiBj b3VsZCBiZWNvbWUgZWZmZWN0aXZlIGFuZCBiZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgcmVmbGVj dGVkIGluIHRoZSBvcGVyYXRpb25hbCBzdGF0ZSBkYXRhc3RvcmUsIGxlYWRpbmcgdG8gZGlzcnVw dGlvbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgb2Ygc2VydmljZXMgcHJvdmlkZWQgdmlhIHRoaXMg dG9wb2xvZ3kgbWlnaHQgYmUgZGlzcnVwdGVkLiZuYnNwOyBGb3IgdGhvc2U8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7IHJlYXNvbnMsIGl0IGlzIGltcG9ydGFudCB0aGF0IHRoZSBORVRDT05GIGFjY2Vz cyBjb250cm9sIG1vZGVsIGlzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB2aWdvcm91c2x5IGFwcGxp ZWQgdG8gcHJldmVudCB0b3BvbG9neSBtaXNjb25maWd1cmF0aW9uIGJ5PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OyZuYnNwOyB1bmF1dGhvcml6ZWQgY2xpZW50cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOyZuYnNwOyBUaGVyZSBhcmUgYSBudW1iZXIgb2YgZGF0YSBub2RlcyBkZWZpbmVkIGluIHRo aXMgWUFORyBtb2R1bGUgdGhhdCBhcmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHdyaXRhYmxlL2Ny ZWF0YWJsZS9kZWxldGFibGUgKGkuZS4sIGNvbmZpZyB0cnVlLCB3aGljaCBpcyB0aGU8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+Jm5ic3A7Jm5ic3A7IGRlZmF1bHQpLiZuYnNwOyBUaGVzZSBkYXRhIG5vZGVzIG1heSBiZSBj b25zaWRlcmVkIHNlbnNpdGl2ZSBvciB2dWxuZXJhYmxlPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBp biBzb21lIG5ldHdvcmsgZW52aXJvbm1lbnRzLiZuYnNwOyBXcml0ZSBvcGVyYXRpb25zIChlLmcu LCBlZGl0LWNvbmZpZyk8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHRvIHRoZXNlIGRhdGEgbm9kZXMg d2l0aG91dCBwcm9wZXIgcHJvdGVjdGlvbiBjYW4gaGF2ZSBhIG5lZ2F0aXZlPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOyZuYnNwOyBlZmZlY3Qgb24gbmV0d29yayBvcGVyYXRpb25zLiZuYnNwOyBUaGVzZSBhcmUg dGhlIHN1YnRyZWVzIGFuZCBkYXRhIG5vZGVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBhbmQgdGhl aXIgc2Vuc2l0aXZpdHkvdnVsbmVyYWJpbGl0eSBpbiB0aGUgaWV0Zi1uZXR3b3JrIG1vZHVsZTo8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLW5ldHdvcmst YXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxkIGF0dGVtcHQgdG88bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHNhYm90YWdlIHRoZSBjb25maWd1cmF0aW9u IG9mIGFueSBvZiB0aGUgY29udGFpbmVkIGF0dHJpYnV0ZXMsPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyAmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDtzdWNoIGFzIHRoZSBuYW1lIG9yIHRoZSBmbGFnIGRhdGEgbm9k ZXMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1ub2Rl LWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdl PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGUgY29uZmlndXJhdGlv biBvZiBpbXBvcnRhbnQgbm9kZSBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBuYW1lPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvciB0aGUgbWFuYWdlbWVudC1hZGRyZXNz LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IG8mbmJzcDsgbDItbGluay1h dHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0byBzYWJvdGFnZTxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdGhlIGNvbmZpZ3VyYXRpb24g b2YgaW1wb3J0YW50IGxpbmsgYXR0cmlidXRlcywgc3VjaCBhcyB0aGUgcmF0ZTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgb3IgdGhlIGRlbGF5IGRhdGEgbm9kZXMuPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi10ZXJtaW5hdGlv bi1wb2ludC1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgdG8gc2Fib3RhZ2UgdGhlIGNvbmZp Z3VyYXRpb24gb2YgaW1wb3J0YW50IHRlcm1pbmF0aW9uIHBvaW50PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSBtYXhpbXVtLWZy YW1lLXNpemUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPiZxdW90OzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5ORVcgVEVYVDo8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+JnF1 b3Q7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPjYuJm5ic3A7IFNlY3VyaXR5IENvbnNpZGVyYXRpb25zPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZu YnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgVGhlIFlBTkcgbW9kdWxlIHNwZWNpZmllZCBpbiB0 aGlzIGRvY3VtZW50IGRlZmluZXMgYSBzY2hlbWEgZm9yIGRhdGE8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7IHRoYXQgaXMgZGVzaWduZWQgdG8gYmUgYWNjZXNzZWQgdmlhIG5ldHdvcmsgbWFuYWdlbWVu dCBwcm90b2NvbHMgc3VjaDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgYXMgTkVUQ09ORiBbUkZDNjI0 MV0gb3IgUkVTVENPTkYgW1JGQzgwNDBdLiZuYnNwOyBUaGUgbG93ZXN0IE5FVENPTkYgbGF5ZXI8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7ICZuYnNwO2lzIHRoZSBzZWN1cmUgdHJhbnNwb3J0IGxheWVyLCBhbmQg dGhlIG1hbmRhdG9yeS10by1pbXBsZW1lbnQgc2VjdXJlPG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyB0 cmFuc3BvcnQgaXMgU2VjdXJlIFNoZWxsIChTU0gpIFtSRkM2MjQyXS4mbmJzcDsgVGhlIGxvd2Vz dCBSRVNUQ09ORiBsYXllcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgaXMgSFRUUFMsIGFuZCB0aGUg bWFuZGF0b3J5LXRvLWltcGxlbWVudCBzZWN1cmUgdHJhbnNwb3J0IGlzIFRMUzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m bmJzcDsmbmJzcDsgW1JGQzg0NDZdLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7IFRoZSBOZXR3b3JrIENvbmZpZ3VyYXRpb24gQWNjZXNzIENvbnRyb2wgTW9kZWwgKE5BQ00p IFtSRkM4MzQxXTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgcHJvdmlkZXMgdGhlIG1lYW5zIHRvIHJl c3RyaWN0IGFjY2VzcyBmb3IgcGFydGljdWxhciBORVRDT05GIG9yPG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyBSRVNUQ09ORiB1c2VycyB0byBhIHByZWNvbmZpZ3VyZWQgc3Vic2V0IG9mIGFsbCBhdmFp bGFibGUgTkVUQ09ORiBvcjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgUkVTVENPTkYgcHJvdG9jb2wg b3BlcmF0aW9ucyBhbmQgY29udGVudC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyBJbiBnZW5lcmFsLCBMYXllciAyIG5ldHdvcmsgdG9wb2xvZ2llcyBhcmUgc3lzdGVtLWNv bnRyb2xsZWQgYW5kPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBwcm92aWRlIGVwaGVtZXJhbCB0b3Bv bG9neSBpbmZvcm1hdGlvbi4mbmJzcDsgSW4gYW4gTk1EQS1jb21wbGllbnQgc2VydmVyLDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mbmJzcDsmbmJzcDsgdGhleSBhcmUgb25seSBwYXJ0IG9mICZsdDtvcGVyYXRpb25hbCZn dDsgd2hpY2ggcHJvdmlkZXMgcmVhZC1vbmx5IGFjY2VzczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg dG8gY2xpZW50cywgdGhleSBhcmUgbGVzcyB2dWxuZXJhYmxlLiZuYnNwOyBUaGF0IHNhaWQsIHRo ZSBZQU5HIG1vZHVsZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgZG9lcyBpbiBwcmluY2lwbGUgYWxs b3cgaW5mb3JtYXRpb24gdG8gYmUgY29uZmlndXJhYmxlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+Jm5ic3A7Jm5ic3A7IFRoZSBMYXllciAyIHRvcG9sb2d5IG1vZHVsZSBkZWZpbmUgaW5mb3Jt YXRpb24gdGhhdCBjYW4gYmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGNvbmZpZ3VyYWJsZSBpbiBj ZXJ0YWluIGluc3RhbmNlcywgZm9yIGV4YW1wbGUgaW4gdGhlIGNhc2Ugb2YgdmlydHVhbDxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mbmJzcDsmbmJzcDsgdG9wb2xvZ2llcyB0aGF0IGNhbiBiZSBjcmVhdGVkIGJ5IGNsaWVu dCBhcHBsaWNhdGlvbnMuJm5ic3A7IEluIHN1Y2g8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGNhc2Vz LCBhIG1hbGljaW91cyBjbGllbnQgY291bGQgaW50cm9kdWNlIHRvcG9sb2dpZXMgdGhhdCBhcmU8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHVuZGVzaXJlZC4mbmJzcDsgU3BlY2lmaWNhbGx5LCBhIG1h bGljaW91cyBjbGllbnQgY291bGQgYXR0ZW1wdCB0byByZW1vdmU8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5i c3A7IG9yIGFkZCBhIG5vZGUsIGEgbGluaywgYSB0ZXJtaW5hdGlvbiBwb2ludCwgYnkgY3JlYXRp bmcgb3IgZGVsZXRpbmc8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGNvcnJlc3BvbmRpbmcgZWxlbWVu dHMgaW4gdGhlIG5vZGUsIGxpbmssIGFuZCB0ZXJtaW5hdGlvbiBwb2ludDxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDsmbmJzcDsgbGlzdHMsIHJlc3BlY3RpdmVseS4mbmJzcDsgSW4gdGhlIGNhc2Ugb2YgYSB0b3Bv bG9neSB0aGF0IGlzIGxlYXJuZWQsIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgc2VydmVyIHdp bGwgYXV0b21hdGljYWxseSBwcm9oaWJpdCBzdWNoIG1pc2NvbmZpZ3VyYXRpb24gYXR0ZW1wdHMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBJbiB0aGUgY2FzZSBvZiBhIHRvcG9sb2d5IHRoYXQgaXMg Y29uZmlndXJlZCwgaS5lLiB3aG9zZSBvcmlnaW4gaXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7ICZx dW90O2ludGVuZGVkJnF1b3Q7LCB0aGUgdW5kZXNpcmVkIGNvbmZpZ3VyYXRpb24gY291bGQgYmVj b21lIGVmZmVjdGl2ZSBhbmQgYmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IHJlZmxlY3RlZCBpbiB0 aGUgb3BlcmF0aW9uYWwgc3RhdGUgZGF0YXN0b3JlLCBsZWFkaW5nIHRvIGRpc3J1cHRpb248bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jm5ic3A7Jm5ic3A7IG9mIHNlcnZpY2VzIHByb3ZpZGVkIHZpYSB0aGlzIHRvcG9sb2d5 IG1pZ2h0IGJlIGRpc3J1cHRlZC4mbmJzcDsgRm9yIHRob3NlPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNw OyByZWFzb25zLCBpdCBpcyBpbXBvcnRhbnQgdGhhdCB0aGUgTkVUQ09ORiBhY2Nlc3MgY29udHJv bCBtb2RlbCBpczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgdmlnb3JvdXNseSBhcHBsaWVkIHRvIHBy ZXZlbnQgdG9wb2xvZ3kgbWlzY29uZmlndXJhdGlvbiBieTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg dW5hdXRob3JpemVkIGNsaWVudHMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsg VGhlIFlBTkcgbW9kZWwgZm9yIGxheWVyIDIgdG9wb2xvZ3kgbWF5IGV4cG9zZSBzZW5zaXRpdmUg aW5mb3JtYXRpb24sDQo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7Zm9yIGV4YW1wbGUgdGhlIE1BQyBhZGRyZXNzZXMgb2YgZGV2aWNlcy4gVW5y ZXN0cmljdGVkIHVzZSBvZiBzdWNoIGluZm9ybWF0aW9uDQo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9 IkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 Yj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Y2FuIGxlYWQgdG8gcHJpdmFj eSB2aW9sYXRpb25zLiBGb3IgZXhhbXBsZSwgbGlzdGluZyBNQUMgYWRkcmVzc2VzIGluIGEgbmV0 d29yaw0KPC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyZuYnNwO2FsbG93cyBtb25pdG9yaW5nIG9mIGRldmljZXMgYW5kIHRoZWlyIG1vdmVtZW50 cy4gTG9jYXRpb24gaW5mb3JtYXRpb24gY2FuIGJlIGRlcml2ZWQ8L3NwYW4+PC9iPjxzcGFuIGxh bmc9IkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7ICZuYnNwO2Zyb20gTUFDIGFkZHJlc3NlcyBv ZiBuZXR3b3JrIGRldmljZXMsIGJ5cGFzc2luZyBwcm90ZWN0aW9uIG9mIGxvY2F0aW9uIGluZm9y bWF0aW9uIGJ5DQo8L3NwYW4+PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5i c3A7Jm5ic3A7Jm5ic3A7dGhlIE9wZXJhdGluZyBTeXN0ZW0uIERlcGxveW1lbnRzIHNob3VsZCBt aXRpZ2F0ZSB0aGlzIHByaXZhY3kgY29uY2VybnMgYnkgbGltaXRpbmcgYWNjZXNzDQo8L3NwYW4+ PC9iPjxzcGFuIGxhbmc9IkVOLVVTIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48Yj48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7dG8g dGhlIGxheWVyIDIgdG9wb2xvZ3kgaW5mb3JtYXRpb24uIEFjY2VzcyB0byB0aGUgaW5mb3JtYXRp b24gc2hvdWxkIGJlIHJlc3RyaWN0ZWQgdG8gYQ0KPC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1V UyI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PGI+PHNw YW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyZuYnNwO21pbmltYWwgbGlzdCBvZiBhdXRob3Jp emVkIGNsaWVudHMsIGFuZCBzaG91bGQgYWxzbyByZXF1aXJlIHByb3BlciBhdXRoZW50aWNhdGlv biBvZiB0aGVzZSBjbGllbnRzLjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVT Ij4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IFRoZXJlIGFyZSBhIG51bWJlciBvZiBkYXRh IG5vZGVzIGRlZmluZWQgaW4gdGhpcyBZQU5HIG1vZHVsZSB0aGF0IGFyZTxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJz cDsmbmJzcDsgd3JpdGFibGUvY3JlYXRhYmxlL2RlbGV0YWJsZSAoaS5lLiwgY29uZmlnIHRydWUs IHdoaWNoIGlzIHRoZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgZGVmYXVsdCkuJm5ic3A7IFRoZXNl IGRhdGEgbm9kZXMgbWF5IGJlIGNvbnNpZGVyZWQgc2Vuc2l0aXZlIG9yIHZ1bG5lcmFibGU8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jm5ic3A7Jm5ic3A7IGluIHNvbWUgbmV0d29yayBlbnZpcm9ubWVudHMuJm5ic3A7IFdy aXRlIG9wZXJhdGlvbnMgKGUuZy4sIGVkaXQtY29uZmlnKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsg dG8gdGhlc2UgZGF0YSBub2RlcyB3aXRob3V0IHByb3BlciBwcm90ZWN0aW9uIGNhbiBoYXZlIGEg bmVnYXRpdmU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7IGVmZmVjdCBvbiBuZXR3b3JrIG9wZXJhdGlv bnMuJm5ic3A7IFRoZXNlIGFyZSB0aGUgc3VidHJlZXMgYW5kIGRhdGEgbm9kZXM8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jm5ic3A7Jm5ic3A7IGFuZCB0aGVpciBzZW5zaXRpdml0eS92dWxuZXJhYmlsaXR5IGluIHRoZSBp ZXRmLW5ldHdvcmsgbW9kdWxlOjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7 IG8mbmJzcDsgbDItbmV0d29yay1hdHRyaWJ1dGVzOiBBIG1hbGljaW91cyBjbGllbnQgY291bGQg YXR0ZW1wdCB0bzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsgc2Fib3Rh Z2UgdGhlIGNvbmZpZ3VyYXRpb24gb2YgYW55IG9mIHRoZSBjb250YWluZWQgYXR0cmlidXRlcyw8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7IHN1Y2ggYXMgdGhlIG5hbWUg b3IgdGhlIGZsYWcgZGF0YSBub2Rlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZu YnNwOyBvJm5ic3A7IGwyLW5vZGUtYXR0cmlidXRlczogQSBtYWxpY2lvdXMgY2xpZW50IGNvdWxk IGF0dGVtcHQgdG8gc2Fib3RhZ2U8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5i c3A7IHRoZSBjb25maWd1cmF0aW9uIG9mIGltcG9ydGFudCBub2RlIGF0dHJpYnV0ZXMsIHN1Y2gg YXMgdGhlIG5hbWU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0 Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7ICx0aGUg bWFuYWdlbWVudC1hZGRyZXNzLCA8Yj5tYWMtYWRkcmVzcyBvZiB0aGUgZGV2aWNlczwvYj4uPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mbmJzcDsmbmJzcDsgbyZuYnNwOyBsMi1saW5rLWF0dHJp YnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0IHRvIHNhYm90YWdlPG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0aGUgY29uZmlndXJhdGlvbiBvZiBp bXBvcnRhbnQgbGluayBhdHRyaWJ1dGVzLCBzdWNoIGFzIHRoZSByYXRlPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBvciB0aGUgZGVsYXkgZGF0YSBub2Rlcy48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1V UyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+ PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOyZuYnNwOyBvJm5ic3A7IGwyLXRlcm1pbmF0aW9uLXBv aW50LWF0dHJpYnV0ZXM6IEEgbWFsaWNpb3VzIGNsaWVudCBjb3VsZCBhdHRlbXB0PG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyB0byBzYWJvdGFnZSB0aGUgY29uZmlndXJh dGlvbiBvZiBpbXBvcnRhbnQgdGVybWluYXRpb24gcG9pbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7Jm5ic3A7 Jm5ic3A7Jm5ic3A7Jm5ic3A7IGF0dHJpYnV0ZXMsIHN1Y2ggYXMgdGhlIG1heGltdW0tZnJhbWUt c2l6ZSwNCjxiPm1hYy1hZGRyZXNzPC9iPi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+JnF1b3Q7PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPlRoZSBx dWVzdGlvbiBpcyBkbyB5b3UgdGhpbmsgcHJvcG9zYWwgd2l0aCB5YW5nIHNlY3VyaXR5IGJvaWx0 ZXJwbGF0ZSBoYXMgYWxyZWFkeSBhZGRyZXNzZWQgeW91ciBjb21tZW50czxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5PciB5 b3UgdGhpbmsgd2Ugc2hvdWxkIGVtcGhhc2l6ZSBob3cgcHJpdmFjeSBpc3N1ZSBjYW4gYmUgYWRk cmVzc2VkIGJ5IE5BQ00gYW5kIGNsaWVudCBhdXRoZW50aWNhdGlvbiBpcyBuZWVkZWQ/PG86cD48 L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4t VVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4tUWluPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPi0tLS0tPC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTrlrovkvZMiPumCruS7tuWOn+S7tjwvc3Bhbj48c3BhbiBsYW5nPSJFTi1V UyI+LS0tLS08YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5Y+R 5Lu25Lq6PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj46IENocmlzdGlhbiBIdWl0ZW1hIFs8YSBo cmVmPSJtYWlsdG86aHVpdGVtYUBodWl0ZW1hLm5ldCI+bWFpbHRvOmh1aXRlbWFAaHVpdGVtYS5u ZXQ8L2E+XQ0KPGJyPg0KPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuWP kemAgeaXtumXtDwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+OiAyMDIwPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuW5tDwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+Njwv c3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L5L2TIj7mnIg8L3NwYW4+PHNwYW4gbGFu Zz0iRU4tVVMiPjI2PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuaXpTwv c3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+DQogMTI6MDU8YnI+DQo8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OuWui+S9kyI+5pS25Lu25Lq6PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj46 IFN1c2FuIEhhcmVzIDxhIGhyZWY9Im1haWx0bzpzaGFyZXNAbmR6aC5jb20iPg0KJmx0O3NoYXJl c0BuZHpoLmNvbSZndDs8L2E+OyBRaW4gV3UgPGEgaHJlZj0ibWFpbHRvOmJpbGwud3VAaHVhd2Vp LmNvbSI+Jmx0O2JpbGwud3VAaHVhd2VpLmNvbSZndDs8L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOnNl Y2RpckBpZXRmLm9yZyI+c2VjZGlyQGlldGYub3JnPC9hPjxicj4NCjwvc3Bhbj48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk65a6L5L2TIj7mioTpgIE8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjog PGEgaHJlZj0ibWFpbHRvOmkycnNAaWV0Zi5vcmciPg0KaTJyc0BpZXRmLm9yZzwvYT47IDxhIGhy ZWY9Im1haWx0bzpkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LmFsbEBp ZXRmLm9yZyI+DQpkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LmFsbEBp ZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzpsYXN0LWNhbGxAaWV0Zi5vcmciPg0KbGFzdC1j YWxsQGlldGYub3JnPC9hPjxicj4NCjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L 5L2TIj7kuLvpopg8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjogUmU6IFtMYXN0LUNhbGxdIFtp MnJzXSBTZWNkaXIgbGFzdCBjYWxsIHJldmlldyBvZiBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1u ZXR3b3JrLXRvcG9sb2d5LTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5Ib3cgYWJvdXQgYWRk aW5nIHNvbWV0aGluZyBsaWtlIHRoaXM6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5Qcml2YWN5 IENvbnNpZGVyYXRpb25zPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5UaGUgWWFuZyBtb2RlbCBm b3IgbGF5ZXIgMiB0b3BvbG9neSBleHBvc2VzIHByaXZhY3kgc2Vuc2l0aXZlIGluZm9ybWF0aW9u LCBmb3IgZXhhbXBsZSB0aGUgTUFDIGFkZHJlc3NlcyBvZiBkZXZpY2VzLiBVbnJlc3RyaWN0ZWQg dXNlIG9mIHN1Y2ggaW5mb3JtYXRpb24gY2FuIGxlYWQgdG8gcHJpdmFjeSB2aW9sYXRpb25zLiBG b3IgZXhhbXBsZSwgbGlzdGluZyBNQUMgYWRkcmVzc2VzDQogaW4gYSBuZXR3b3JrIGFsbG93cyBt b25pdG9yaW5nIG9mIGRldmljZXMgYW5kIHRoZWlyIG1vdmVtZW50cy4gTG9jYXRpb24gaW5mb3Jt YXRpb24gY2FuIGJlIGRlcml2ZWQgZnJvbSBNQUMgYWRkcmVzc2VzIG9mIG5ldHdvcmsgZGV2aWNl cywgYnlwYXNzaW5nIHByb3RlY3Rpb24gb2YgbG9jYXRpb24gaW5mb3JtYXRpb24gYnkgdGhlIE9w ZXJhdGluZyBTeXN0ZW0uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5EZXBsb3ltZW50cyBzaG91 bGQgbWl0aWdhdGUgdGhpcyBwcml2YWN5IGNvbmNlcm5zIGJ5IGxpbWl0aW5nIGFjY2VzcyB0byB0 aGUgbGF5ZXIgMiB0b3BvbG9neSBpbmZvcm1hdGlvbi4gQWNjZXNzIHRvIHRoZSBpbmZvcm1hdGlv biBzaG91bGQgYmUgcmVzdHJpY3RlZCB0byBhIG1pbmltYWwgbGlzdCBvZiBhdXRob3JpemVkIGFn ZW50cywgYW5kIHNob3VsZCByZXF1aXJlIHByb3Blcg0KIGF1dGhlbnRpY2F0aW9uIG9mIHRoZXNl IGFnZW50cy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48 c3BhbiBsYW5nPSJFTi1VUyI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPi0tIENocmlzdGlhbiBIdWl0ZW1hPG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj5PbiA2LzI1LzIwMjAgNzowMCBBTSwgU3VzYW4gSGFyZXMg d3JvdGU6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZndDsgUWluIGFuZCBDaHJpc3RpYW46IDxvOnA+PC9vOnA+PC9zcGFu PjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5i c3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZndDsgVGhhbmsgeW91IGZvciB5b3VyIHByb21wdCBhdHRlbnRpb24gdG8g dGhlIHByaXZhY3kgaXNzdWUuJm5ic3A7DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBJJ20gc3VyZSBDaHJpc3Rp YW4gd2lsbCByZXNwb25kIGluIGEgYml0IC0gc2luY2UgaGUgbWlnaHQgYmUgaW4gUERUIHRpbWUt em9uZS4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgT25jZSB5b3UgaGF2ZSBh IHNvbHV0aW9uIHlvdSBib3RoIGxpa2UsIHdlIHNob3VsZCB2YWxpZGF0ZSB0aGUgcHJpdmFjeQ0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZndDsgY2hhbmdlcyB0byB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnMgc2Vj dGlvbiB3aXRoIHRoZSBZYW5nLWRvY3RvcnMsDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBPUFMtQURzLCBhbmQg U2VjdXJpdHktQURzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgTWFydGluJ3Mg d2F0Y2hpbmcgdGhpcyB0aHJlYWQgc28gSSdtIHN1cmUgaGUnbGwgaGVscCB1cyBvdXQgYXMgd2Vs bC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFu IGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgU3VlPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsm bmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+Jmd0OyAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4m Z3Q7IEZyb206IGkycnMgWzxhIGhyZWY9Im1haWx0bzppMnJzLWJvdW5jZXNAaWV0Zi5vcmciPjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5tYWlsdG86 aTJycy1ib3VuY2VzQGlldGYub3JnPC9zcGFuPjwvYT5dIE9uIEJlaGFsZiBPZiBRaW4gV3U8bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJF Ti1VUyI+Jmd0OyBTZW50OiBUaHVyc2RheSwgSnVuZSAyNSwgMjAyMCA5OjI1IEFNPG86cD48L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMi PiZndDsgVG86IFN1c2FuIEhhcmVzOyAnQ2hyaXN0aWFuIEh1aXRlbWEnOw0KPGEgaHJlZj0ibWFp bHRvOnNlY2RpckBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1k ZWNvcmF0aW9uOm5vbmUiPnNlY2RpckBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsg Q2M6IDxhIGhyZWY9Im1haWx0bzppMnJzQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2lu ZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+aTJyc0BpZXRmLm9yZzwvc3Bhbj48L2E+Ow0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZndDsgPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5l dHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3JnIj4NCjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0 ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5kcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3Jr LXRvcG9sb2d5LmFsbEBpZXRmLm9yZzwvc3Bhbj48L2E+Ow0KPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgPGEgaHJl Zj0ibWFpbHRvOmxhc3QtY2FsbEBpZXRmLm9yZyI+DQo8c3BhbiBzdHlsZT0iY29sb3I6d2luZG93 dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+bGFzdC1jYWxsQGlldGYub3JnPC9zcGFuPjwvYT48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jmd0OyBTdWJqZWN0OiBSZTogW2kycnNdIFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3 IG9mDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3Bh biBsYW5nPSJFTi1VUyI+Jmd0OyBkcmFmdC1pZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9s b2d5LTEzPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNw YW4gbGFuZz0iRU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBTdWUgYW5kIENocmlzdGlh bjo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jmd0OyBJIGhhdmUgcmVzcG9uZGVkIHRvIENocmlzdGlhbiBvbiBwcml2YWN5 IGlzc3VlLCBteSBwcm9wb3NhbCBpcyB0byBhZGQgTUFDIGFkZHJlc3MgYXMgYW5vdGhlciBkYXRh IG5vZGUgdnVsbmVyYWJpbGl0eSBleGFtcGxlIGluIG91ciBvcmlnaW5hbCBzZWN1cml0eSBjb25z aWRlcmF0aW9uIHNlY3Rpb24uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1Bs YWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgQnV0IElmIENocmlzdGlhbiBvciBzZWN1 cml0eSBkaXJlY3RvcmF0ZSBoYXMgcmVjb21tZW5kaW5nIHRleHQsIHdlIGF1dGhvcnMgYXJlIGhh cHB5IHRvIGFjY2VwdCBpdC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IC1RaW48 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jmd0OyAtLS0tLTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk65a6L5L2T Ij7pgq7ku7bljp/ku7Y8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPi0tLS0tPG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZn dDsgPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuWPkeS7tuS6ujwvc3Bh bj48c3BhbiBsYW5nPSJFTi1VUyI+OiBTdXNhbiBIYXJlcyBbPGEgaHJlZj0ibWFpbHRvOnNoYXJl c0BuZHpoLmNvbSI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9u Om5vbmUiPm1haWx0bzpzaGFyZXNAbmR6aC5jb208L3NwYW4+PC9hPl08bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyA8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5Y+R6YCB5pe26Ze0PC9zcGFu PjxzcGFuIGxhbmc9IkVOLVVTIj46IDIwMjA8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OuWui+S9kyI+5bm0PC9zcGFuPjxzcGFuIGxhbmc9IkVOLVVTIj42PC9zcGFuPjxzcGFuIHN0eWxl PSJmb250LWZhbWlseTrlrovkvZMiPuaciDwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+MjU8L3Nw YW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OuWui+S9kyI+5pelPC9zcGFuPjxzcGFuIGxhbmc9 IkVOLVVTIj4NCiAyMTowNDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IDwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1m YW1pbHk65a6L5L2TIj7mlLbku7bkuro8L3NwYW4+PHNwYW4gbGFuZz0iRU4tVVMiPjogJ0Nocmlz dGlhbiBIdWl0ZW1hJyAmbHQ7PGEgaHJlZj0ibWFpbHRvOmh1aXRlbWFAaHVpdGVtYS5uZXQiPjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5odWl0ZW1h QGh1aXRlbWEubmV0PC9zcGFuPjwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRm Lm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUi PnNlY2RpckBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgPC9zcGFuPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuaKhOmAgTwvc3Bhbj48c3BhbiBsYW5nPSJFTi1VUyI+ Og0KPGEgaHJlZj0ibWFpbHRvOmRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xv Z3kuYWxsQGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29y YXRpb246bm9uZSI+ZHJhZnQtaWV0Zi1pMnJzLXlhbmctbDItbmV0d29yay10b3BvbG9neS5hbGxA aWV0Zi5vcmc8L3NwYW4+PC9hPjsNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IDxhIGhyZWY9Im1haWx0bzppMnJz QGlldGYub3JnIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246 bm9uZSI+aTJyc0BpZXRmLm9yZzwvc3Bhbj48L2E+Ow0KPGEgaHJlZj0ibWFpbHRvOmxhc3QtY2Fs bEBpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9u Om5vbmUiPmxhc3QtY2FsbEBpZXRmLm9yZzwvc3Bhbj48L2E+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgPC9zcGFu PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTrlrovkvZMiPuS4u+mimDwvc3Bhbj48c3BhbiBsYW5n PSJFTi1VUyI+OiBSRTogU2VjZGlyIGxhc3QgY2FsbCByZXZpZXcgb2YNCjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7 IGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3ktMTM8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IENocmlzdGlhbjo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyZuYnNwOzxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVO LVVTIj4mZ3Q7IFRoYW5rIHlvdSBmb3IgY2F0Y2hpbmcgdGhlIHByaXZhY3kgaXNzdWVzLiZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOw0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jmd0OyBJJ3ZlIGdvdCBhIGZldyBxdWVzdGlvbnMgdG8gaGVscCB0aGUgYXV0aG9ycyBzY29wZSB0 aGlzIGNoYW5nZToNCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgMSkgU2luY2Ug dGhpcyBpcyBjb21tb24gdG8gYWxsIEwyIFRvcG9sb2dpZXMsIGNhbiB5b3Ugb3IgdGhlIHNlY3Vy aXR5IGRpcmVjdG9yYXRlIHJlY29tbWVuZCBzb21lIHRleHQgdGhhdCBtaWdodCBiZSBhcHByb3By aWF0ZT8NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7ICZuYnNwOyZuYnNwOyZuYnNwO0lmIHlvdSBoYXZlIHJlY29t bWVuZGVkIHRleHQsIGhhcyB0aGlzIHRleHQgYmVlbiByZXZpZXdlZCBieSBPUFMtRElSIGFuZCBZ YW5nIGRvY3RvcnM/DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IDIpIFdpbGwg aXQgYmUgYSBwcm9ibGVtIElmIHdlIHdyaXRlIHByaXZhY3kgY29uc2lkZXJhdGlvbnMgb24gSUVF RSBzcGVjaWZpY2F0aW9ucz8NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IDMpIERvIHdlIG5lZWQgdG8gY29uc2lk ZXIgdGhlIHJhbmdlIG9mIGRlcGxveW1lbnRzIG9mIEwyIChob21lLA0KPG86cD48L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsg ZW50ZXJwcmlzZSwmbmJzcDsgcHVibGljIFBCQiBzZXJ2aWNlLCBuYXRpb25hbCBQQkIgc2Vydmlj ZSwgRGF0YSBjZW50ZXJzKTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFp blRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsmbmJzcDs8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5n PSJFTi1VUyI+Jmd0OyBUaGFuayB5b3UsJm5ic3A7IFN1ZTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86 cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0i RU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0t LTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxh bmc9IkVOLVVTIj4mZ3Q7IEZyb206IENocmlzdGlhbiBIdWl0ZW1hIHZpYSBEYXRhdHJhY2tlciBb PGEgaHJlZj0ibWFpbHRvOm5vcmVwbHlAaWV0Zi5vcmciPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5k b3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5tYWlsdG86bm9yZXBseUBpZXRmLm9yZzwvc3Bh bj48L2E+XTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFNlbnQ6IFRodXJzZGF5LCBKdW5lIDI1LCAyMDIwIDE6MDEg QU08bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jmd0OyBUbzogPGEgaHJlZj0ibWFpbHRvOnNlY2RpckBpZXRmLm9yZyI+DQo8 c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+c2VjZGly QGlldGYub3JnPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBDYzogPGEgaHJlZj0ibWFpbHRvOmRy YWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdvcmstdG9wb2xvZ3kuYWxsQGlldGYub3JnIj4NCjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5kcmFmdC1p ZXRmLWkycnMteWFuZy1sMi1uZXR3b3JrLXRvcG9sb2d5LmFsbEBpZXRmLm9yZzwvc3Bhbj48L2E+ Ow0KPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4g bGFuZz0iRU4tVVMiPiZndDsgPGEgaHJlZj0ibWFpbHRvOmkycnNAaWV0Zi5vcmciPjxzcGFuIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0O3RleHQtZGVjb3JhdGlvbjpub25lIj5pMnJzQGlldGYub3Jn PC9zcGFuPjwvYT47DQo8YSBocmVmPSJtYWlsdG86bGFzdC1jYWxsQGlldGYub3JnIj48c3BhbiBz dHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246bm9uZSI+bGFzdC1jYWxsQGll dGYub3JnPC9zcGFuPjwvYT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxh aW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBTdWJqZWN0OiBTZWNkaXIgbGFzdCBjYWxs IHJldmlldyBvZiA8bzpwPg0KPC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRl eHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IGRyYWZ0LWlldGYtaTJycy15YW5nLWwyLW5ldHdv cmstdG9wb2xvZ3ktMTM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5U ZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFJldmlld2Vy OiBDaHJpc3RpYW4gSHVpdGVtYTxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Q bGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFJldmlldyByZXN1bHQ6IEhhcyBJc3N1 ZXM8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IEkgaGF2ZSByZXZpZXdlZCB0aGlz IGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlJ3Mgb25nb2luZyBl ZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBwcm9jZXNzZWQgYnkgdGhl IElFU0cuJm5ic3A7IFRoZXNlIGNvbW1lbnRzIHdlcmUgd3JpdHRlbiB3aXRoIHRoZSBpbnRlbnQg b2YgaW1wcm92aW5nIHNlY3VyaXR5IHJlcXVpcmVtZW50cw0KIGFuZCBjb25zaWRlcmF0aW9ucyBp biBJRVRGIGRyYWZ0cy4mbmJzcDsgQ29tbWVudHMgbm90IGFkZHJlc3NlZCBpbiBsYXN0IGNhbGwg bWF5IGJlIGluY2x1ZGVkIGluIEFEIHJldmlld3MgZHVyaW5nIHRoZSBJRVNHIHJldmlldy4mbmJz cDsgRG9jdW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0cmVhdCB0aGVzZSBjb21t ZW50cyBqdXN0IGxpa2UgYW55IG90aGVyIGxhc3QgY2FsbCBjb21tZW50cy48bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IFRoaXMgZG9jdW1lbnQgZGVzY3JpYmVzIGEgWWFuZyBtb2Rl bCBmb3IgcmVwcmVzZW50aW5nIExpbmsgTGF5ZXIgdG9wb2xvZ2llcy48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBS ZXByZXNlbnRpbmcgc3VjaCB0b3BvbG9naWVzIGlzIG9idmlvdXNseSB1c2VmdWwgZm9yIG1hbmFn aW5nIG5ldHdvcmsuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgVGhlIHNlY3VyaXR5IHNlY3Rpb24gaXMgZm9jdXNl ZCBvbiBzZWN1cmluZyB0aGUgdXNhZ2Ugb2YgdGhpcyBpbmZvcm1hdGlvbiBmb3IgbmV0d29yayBt YW5hZ2VtZW50LCBidXQgZG9lcyBub3QgYWRkcmVzcyBwb3RlbnRpYWwgcHJpdmFjeSBpc3N1ZXMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFu Zz0iRU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv UGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBUaGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbnMgZXhwbGFpbiBjb3JyZWN0bHkgaG93IGFsdGVyaW5nIHRoZSBsaW5rIGxheWVyIGluZm9y bWF0aW9uIGNvdWxkIGVuYWJsZSBhdHRhY2tzIGFnYWluc3QgdGhlIG5ldHdvcmsuIFRoZSBwcm9w b3NlZCByZW1lZHkgaXMgYWNjZXNzIGNvbnRyb2wsIGltcGxlbWVudGVkIHVzaW5nIGVpdGhlciBT U0ggb3IgVExTLiBUaGlzIGlzDQogZmluZSwgYWx0aG91Z2ggdGhlIGRpc2N1c3Npb24gb2YgVExT IGF1dGhvcmlzYXRpb24gaXMgYSBiaXQgc2hvcnQuIEJ5IGRlZmF1bHQsIFRMUyB2ZXJpZmllcyB0 aGUgaWRlbnRpdHkgb2YgdGhlIHNlcnZlciBidXQgbm90IHRoYXQgb2YgdGhlIGNsaWVudC4gUkZD ODA0MCBzZWN0aW9uIDIuNSBzcGVjaWZpZXMgdGhhdCAmcXVvdDthIFJFU1RDT05GIHNlcnZlciBT SE9VTEQgcmVxdWlyZSBhdXRoZW50aWNhdGlvbiBiYXNlZCBvbiBUTFMgY2xpZW50IGNlcnRpZmlj YXRlcy4NCiBJIGFzc3VtZSB0aGF0J3MgdGhlIGludGVudCwgYnV0IGl0IG1pZ2h0IGJlIHVzZWZ1 bCB0byBzYXkgc28uPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4 dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0OyBPbiB0aGUgb3Ro ZXIgaGFuZCwgdGhlIHNlY3VyaXR5IGNvbnNpZGVyYXRpb25zIGRvIG5vdCBkZXNjcmliZSBwcml2 YWN5IGlzc3VlcywgYW5kIEkgZmluZCB0aGF0IHByb2JsZW1hdGljLiBUaGUgcHJvcG9zZWQgaW5m b3JtYXRpb24gbW9kZWwgbGlzdHMgYSBudW1iZXIgb2Ygc2Vuc2l0aXZlIGRhdGEsIHN1Y2ggYXMg Zm9yIGV4YW1wbGUgdGhlIE1BQyBhZGRyZXNzZXMgb2YNCiBkZXZpY2VzLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7 IFRoaXMgaW5mb3JtYXRpb24gY2FuIGJlIG1pc3VzZWQuIEZvciBleGFtcGxlLCBhcHBsaWNhdGlv bnMgY291bGQgYXNzZXNzIGRldmljZSBsb2NhdGlvbiBmZXRjaGluZyB0aGUgTUFDIGFkZHJlc3Nl cyBvZiBsb2NhbCBnYXRld2F5cy4gVGhpcmQgcGFydGllcyBjb3VsZCBhY2Nlc3MgbGluayBsb2Nh bCBpbmZvcm1hdGlvbiB0byBnYXRoZXIgaWRlbnRpdGllcyBvZiBkZXZpY2VzDQogYWNjZXNzaW5n IGEgcGFydGljdWxhciBuZXR3b3JrLiBTdWNoIGluZm9ybWF0aW9uIGlzIG9mdGVuIHByb3RlY3Rl ZCBieSBwcml2YWN5IEFQSSBpbiB0aGUgT3BlcmF0aW5nIFN5c3RlbSwgYnV0IGFjY2Vzc2luZyB0 aGUgWWFuZyBtb2R1bGUgb3ZlciB0aGUgbmV0d29yayBtaWdodCBhbGxvdyBhcHBsaWNhdGlvbnMg dG8gYnlwYXNzIHRoZXNlIGNvbnRyb2xzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZn dDsgQ2xpZW50IGF1dGhlbnRpY2F0aW9uIGFsb25lIGRvZXMgbm90IG5lY2Vzc2FyaWx5IHByb3Rl Y3QgYWdhaW5zdCB0aGVzZSBwcml2YWN5IGxlYWtzLiBBIGNsYXNzaWMgY29uZmlndXJhdGlvbiBl cnJvciB3b3VsZCBsaW1pdCB3cml0ZSBhY2Nlc3MgdG8gYXV0aG9yaXplZCB1c2VycywgYnV0IHRv IGFsbG93IHJlYWQtb25seSBhY2Nlc3MgdG8gbW9zdCB1c2Vycy4gVGhpcw0KIGtpbmQgb2YgZXJy b3Igd291bGQgYWxsb3cgcHJpdmFjeSBsZWFrcy4gR2l2ZW4gdGhlIHNlbnNpdGl2ZSBuYXR1cmUg b2YgTUFDIGFkZHJlc3NlcyBhbmQgb3RoZXIgaWRlbnRpZmllcnMsIGl0IGlzIHVzZWZ1bCB0byB3 YXJuIGFnYWluc3Qgc3VjaCBlcnJvcnMuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+Jmd0 OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxz cGFuIGxhbmc9IkVOLVVTIj4mZ3Q7Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb1BsYWluVGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsmbmJzcDs8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQi PjxzcGFuIGxhbmc9IkVOLVVTIj4mZ3Q7IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb1BsYWlu VGV4dCI+PHNwYW4gbGFuZz0iRU4tVVMiPiZndDsgaTJycyBtYWlsaW5nIGxpc3Q8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBsYW5nPSJFTi1VUyI+ Jmd0OyA8YSBocmVmPSJtYWlsdG86aTJyc0BpZXRmLm9yZyI+PHNwYW4gc3R5bGU9ImNvbG9yOndp bmRvd3RleHQ7dGV4dC1kZWNvcmF0aW9uOm5vbmUiPmkycnNAaWV0Zi5vcmc8L3NwYW4+PC9hPjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29QbGFpblRleHQiPjxzcGFuIGxhbmc9 IkVOLVVTIj4mZ3Q7IDxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGlu Zm8vaTJycyI+DQo8c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dDt0ZXh0LWRlY29yYXRpb246 bm9uZSI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9pMnJzPC9zcGFuPjwv YT48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvUGxhaW5UZXh0Ij48c3BhbiBs YW5nPSJFTi1VUyI+Jmd0OyZuYnNwOzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90 ZT4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_B8F9A780D330094D99AF023C5877DABAAD7BE6C3dggeml531mbschi_-- From nobody Sat Jun 27 07:09:35 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 68A5F3A092F; Sat, 27 Jun 2020 07:09:27 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Watson Ladd via Datatracker To: Cc: ippm@ietf.org, draft-ietf-ippm-route.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.4.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159326696737.10306.5653213903966509356@ietfa.amsl.com> Reply-To: Watson Ladd Date: Sat, 27 Jun 2020 07:09:27 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-ippm-route-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jun 2020 14:09:28 -0000 Reviewer: Watson Ladd Review result: Has Nits I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is Has Nits. One little thing: class C has a meaning already, and I think the authors meant a class to be referred to by C, not the ancient term for a division of IP space that fell out of use long before my birth. Later on this becomes clear, but in the introduction it did throw me off. The conclusion paragraph also seems to describe a much less comprehensive document then the introduction pragraph. This does seem to have been an effect of evolution, and is pretty easily fixed and mostly cosmetic. Now for the meat: what about the security considerations? Since this draft is describing enhancements to traceroute and ways to describe the measurements taken by such enhanced traceroutes, the security impact is minimal and the authors reference the existing RFCs describing the security impacts of tracroutes on networks. Sincerely, Watson Ladd From nobody Sat Jun 27 09:17:54 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 000403A0805 for ; Sat, 27 Jun 2020 09:17:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.888 X-Spam-Level: X-Spam-Status: No, score=-1.888 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FrTCLYtftXAx for ; Sat, 27 Jun 2020 09:17:49 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F38713A0802 for ; Sat, 27 Jun 2020 09:17:48 -0700 (PDT) Received: from xse251.mail2web.com ([66.113.196.251] helo=xse.mail2web.com) by mx105.antispamcloud.com with esmtp (Exim 4.92) (envelope-from ) id 1jpDWQ-0003tr-QH for secdir@ietf.org; Sat, 27 Jun 2020 18:17:47 +0200 Received: from xsmtp21.mail2web.com (unknown [10.100.68.60]) by xse.mail2web.com (Postfix) with ESMTPS id 49vJnK362pz2ZsY for ; Sat, 27 Jun 2020 09:17:41 -0700 (PDT) Received: from [10.5.2.14] (helo=xmail04.myhosting.com) by xsmtp21.mail2web.com with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.92) (envelope-from ) id 1jpDWP-0006FV-8E for secdir@ietf.org; Sat, 27 Jun 2020 09:17:41 -0700 Received: (qmail 7994 invoked from network); 27 Jun 2020 16:17:40 -0000 Received: from unknown (HELO [192.168.1.107]) (Authenticated-user:_huitema@huitema.net@[172.58.43.153]) (envelope-sender ) by xmail04.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 27 Jun 2020 16:17:40 -0000 To: Qin Wu , Susan Hares , "secdir@ietf.org" Cc: "i2rs@ietf.org" , "draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org" , NETMOD Group , "last-call@ietf.org" References: From: Christian Huitema Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mDMEXtavGxYJKwYBBAHaRw8BAQdA1ou9A5MHTP9N3jfsWzlDZ+jPnQkusmc7sfLmWVz1Rmu0 J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PoiWBBMWCAA+FiEEw3G4 Nwi4QEpAAXUUELAmqKBYtJQFAl7WrxsCGwMFCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgEC F4AACgkQELAmqKBYtJQbMwD/ebj/qnSbthC/5kD5DxZ/Ip0CGJw5QBz/+fJp3R8iAlsBAMjK r2tmyWyJz0CUkVG24WaR5EAJDvgwDv8h22U6QVkAuDgEXtavGxIKKwYBBAGXVQEFAQEHQJoM 6MUAIqpoqdCIiACiEynZf7nlJg2Eu0pXIhbUGONdAwEIB4h+BBgWCAAmFiEEw3G4Nwi4QEpA AXUUELAmqKBYtJQFAl7WrxsCGwwFCQlmAYAACgkQELAmqKBYtJRm2wD7BzeK5gEXSmBcBf0j BYdSaJcXNzx4yPLbP4GnUMAyl2cBAJzcsR4RkwO4dCRqM9CHpVJCwHtbUDJaa55//E0kp+gH Message-ID: <90a9ffa5-4db7-fdaf-5a55-48ed2745bde0@huitema.net> Date: Sat, 27 Jun 2020 09:17:39 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A3510C022F77668DCEC42238" Content-Language: en-US X-Originating-IP: 66.113.196.251 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 66.113.196.251/32 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=66.113.196.251/32@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: Mvzo4OR0dZXEDF/gcnlw0f6LF1GdvkEexklpcFpSF5apSDasLI4SayDByyq9LIhVUZbR67CQ7/vm /hHDJU4RXkTNWdUk1Ol2OGx3IfrIJKywOmJyM1qr8uRnWBrbSAGDcQkv3rfK9nOh84B6FNp+WsRX qYbtEQV1z/L435ZRxFTiprFfcNAudSSxiWJ1U9wzZfHZrMQ8Ke0Z8pjKFUegibQrHWZPpqYwb4n/ 5SxQwXAlwKhAEGVwhQsL2SvUkQCl1VzUjpi3KNxdQZ39cmOPHsxKTagmQ3xMyVZ07UERWzx6BTXs FxcSzhpFHKuVDd8Suy8lNDS0QWWkADhl7glCR9PbrhSmW22tW1yBxgRT8bmxZJSIFVPkVVALPRKr lHlM3kWCH4Q79vaQ+COHDJAgLHQOD0r6/AaHZiEtdTMtMlgTBUa5LSawQcdT80HH17nNg8oiq9mz mwrbQbTulSg7juWBOXp8nHKe0R+FkIqN7hkFZqA6TBkpoO/ktnXt0JlLIRFsicyJMEhQFtD8PLoi nuxTyssp4L0plUGigax8zy4LpVxP5YFZg5fgueXLf6LKHDJ71JSXKkUqfqsTqwEEUOidX4Ts4xdG +C13IyWeZaIoMFHPZrhemjbJa4mqCRZ7GBfTiFUgMuua665ZNZolbW4IRCnb6wQQVR+pLtNn/pka D/mvIqhyxQ9hLuINTPl8y3FyYdWcNJ6ZwoSkrV/2CUqTD2ipD9y2znxCv9uYkc8RFZ4oobg8BBg3 Jq+ntzj0IgYYU4XH/XxAGFPgiMfxPA9mDnaXtu0kZC/OWmUorWhMTB/QSDpC7n1b5ncFlzXuem8a 2eTZ/0wwaqFm1kzHHnW8TfMUfXZNQGXIjuXCLLoOWDcSwiNE7BnXRBr2jsxhz1caQoi44Wcfj1z/ J5tTt7j1ptfltBQnq8NvNwuG6kuhBG0YWFj/7xYZzwR7/PiKfowXlsolACJrkW/vjDp2NmSdEOMf tBjsWb6BDQzjSsG66974nkMwEqjhfSKHlA2Q3p5onVdn12r9xqR15ROHBesyXD9BkbKX7eGI2jGt /RQxL7hrJSk60SF3F6RYOYr2 X-Report-Abuse-To: spam@quarantine11.antispamcloud.com Archived-At: Subject: Re: [secdir] [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Jun 2020 16:17:53 -0000 This is a multi-part message in MIME format. --------------A3510C022F77668DCEC42238 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Works for me. Thank you. -- Christian Huitema On 6/26/2020 11:26 PM, Qin Wu wrote: > > Thanks Christian for clarification, here is the tweaked text to > address your comment, which is positioned right after the discussion > about writable/creatable/deletable attributes. > > *NEW TEXT:* > > “ > > 6.  Security Considerations > >   > >    The YANG module specified in this document defines a schema for data > >    that is designed to be accessed via network management protocols such > >    as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer > >    is the secure transport layer, and the mandatory-to-implement secure > >    transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer > >    is HTTPS, and the mandatory-to-implement secure transport is TLS > >    [RFC8446]. > >   > >    The Network Configuration Access Control Model (NACM) [RFC8341] > >    provides the means to restrict access for particular NETCONF or > >   > >    RESTCONF users to a preconfigured subset of all available NETCONF or > >    RESTCONF protocol operations and content. > >   > >    The Layer 2 topology module define information that can be > >    configurable in certain instances, for example in the case of virtual > >    topologies that can be created by client applications.  In such > >    cases, a malicious client could introduce topologies that are > >    undesired.  Specifically, a malicious client could attempt to remove > >    or add a node, a link, a termination point, by creating or deleting > >    corresponding elements in the node, link, and termination point > >    lists, respectively.  In the case of a topology that is learned, the > >    server will automatically prohibit such misconfiguration attempts. > >    In the case of a topology that is configured, i.e. whose origin is > >    "intended", the undesired configuration could become effective and be > >    reflected in the operational state datastore, leading to disruption > >    of services provided via this topology might be disrupted.  For those > >    reasons, it is important that the NETCONF access control model is > >    vigorously applied to prevent topology misconfiguration by > >    unauthorized clients. > >   > >    There are a number of data nodes defined in this YANG module that are > >    writable/creatable/deletable (i.e., config true, which is the > >    default).  These data nodes may be considered sensitive or vulnerable > >    in some network environments.  Write operations (e.g., edit-config) > >    to these data nodes without proper protection can have a negative > >    effect on network operations.  These are the subtrees and data nodes > >    and their sensitivity/vulnerability in the ietf-network module: > >   > >    o  l2-network-attributes: A malicious client could attempt to > >       sabotage the configuration of any of the contained attributes, > >       such as the name or the flag data nodes. > >   > >    o  l2-node-attributes: A malicious client could attempt to sabotage > >       the configuration of important node attributes, such as the name > >       or the management-address. > >   > >    o  l2-link-attributes: A malicious client could attempt to sabotage > >       the configuration of important link attributes, such as the rate > >       or the delay data nodes. > >   > >    o  l2-termination-point-attributes: A malicious client could attempt > >       to sabotage the configuration of important termination point > >       attributes, such as the maximum-frame-size. > >   > > *Some of the readable data nodes in this YANG module may be considered * > > *sensitive or vulnerable in some network environments. It is thus >  important to control * > > *read access (e.g., via get, get-config, or notification) to these > data nodes. In particular, the * > > *YANG model for layer 2 topology may expose sensitive information, for > example the MAC * > > *addresses of devices. Unrestricted use of such information can lead > to privacy violations. * > > *For example, listing MAC addresses in a network allows monitoring of > devices and their * > > *movements. Location information can be derived from MAC addresses of > network devices, * > > *bypassing protection of location information by the Operating System. * > >   > > ” > > Thanks. > >   > > -Qin > > *发件人:*Christian Huitema [mailto:huitema@huitema.net] > *发送时间:*2020年6月26日22:55 > *收件人:*Qin Wu ; Susan Hares ; > secdir@ietf.org > *抄送:*i2rs@ietf.org; > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; > last-call@ietf.org; NETMOD Group > *主题:*Re: [Last-Call] [i2rs] Secdir last call review of > draft-ietf-i2rs-yang-l2-network-topology-13 > >   > > I like variant B better, although I would not single out the mac > addresses in the "sabotage" warning. > > My main concern is that network administrators will naturally be very > concerned about information that is writable/creatable/deletable, > because they understand the impact on the management of their network. > However, they are not so concerned with read-only access, because > reading information does not directly affect the operation of the > network. My whole point is telling them, "you are documenting your L2 > topology, it contains sensitive information, make sure that reading it > is protected, not just writing it". > > I agree that NETCONF and RESTCONF provide the right tools for > protecting the information. My request is just to clearly tell network > administrators to use these tools, do not leave read access wide open! > > -- Christian Huitema > > On 6/26/2020 4:37 AM, Qin Wu wrote: > > Hi, Christian: > > 1.       NACM defined in RFC8341 has already provided mechanisms > to restrict access to sensitive information to a minimal list of > authorized client or agents and deal with privacy issue if my > understanding is correct. > > 2.       Both NETCONF and RESTCONF will rely on transport protocol > such as TLS to provide client authentication and server > authentication, i.e., mutual authentication. > > 3.       The YANG security guideline defined in > https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines > > Provide perfect boilerplate to address both security consideration > and privacy consideration. > > My original proposal A to address your comments is: > > OLD TEXT: > > " > >    There are a number of data nodes defined in this YANG module > that are > >    writable/creatable/deletable (i.e., config true, which is the > >    default).  These data nodes may be considered sensitive or > vulnerable > >    in some network environments.  Write operations (e.g., edit-config) > >    to these data nodes without proper protection can have a negative > >    effect on network operations.  These are the subtrees and data > nodes > >    and their sensitivity/vulnerability in the ietf-network module: > >   > >    o  l2-network-attributes: A malicious client could attempt to > >       sabotage the configuration of any of the contained attributes, > >       such as the name or the flag data nodes. > >   > >    o  l2-node-attributes: A malicious client could attempt to sabotage > >       the configuration of important node attributes, such as the name > >       or the management-address. > >   > >    o  l2-link-attributes: A malicious client could attempt to sabotage > >       the configuration of important link attributes, such as the rate > >       or the delay data nodes. > >   > >    o  l2-termination-point-attributes: A malicious client could > attempt > >       to sabotage the configuration of important termination point > >       attributes, such as the maximum-frame-size. > > " > > NEW TEXT: > > " > >    There are a number of data nodes defined in this YANG module > that are > >    writable/creatable/deletable (i.e., config true, which is the > >    default).  These data nodes may be considered sensitive or > vulnerable > >    in some network environments.  Write operations (e.g., edit-config) > >    to these data nodes without proper protection can have a negative > >    effect on network operations.  These are the subtrees and data > nodes > >    and their sensitivity/vulnerability in the ietf-network module: > >   > >    o  l2-network-attributes: A malicious client could attempt to > >       sabotage the configuration of any of the contained attributes, > >       such as the name or the flag data nodes. > >   > >    o  l2-node-attributes: A malicious client could attempt to sabotage > >       the configuration of important node attributes, such as the name > >       ,the management-address *or mac address of the devices*. > >   > >    o  l2-link-attributes: A malicious client could attempt to sabotage > >       the configuration of important link attributes, such as the rate > >       or the delay data nodes. > >   > >   o  l2-termination-point-attributes: A malicious client could attempt > >       to sabotage the configuration of important termination point > >       attributes, such as the maximum-frame-size, *mac-address*. > > " > >   > > With your proposed text, we could have the following proposal > changes (Proposal B): > > OLD TEXT: > > " > > 6.  Security Considerations > >   > >    The YANG module specified in this document defines a schema for > data > >    that is designed to be accessed via network management > protocols such > >    as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF > layer > >    is the secure transport layer, and the mandatory-to-implement > secure > >    transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF > layer > >    is HTTPS, and the mandatory-to-implement secure transport is TLS > >    [RFC8446]. > >   > >    The Network Configuration Access Control Model (NACM) [RFC8341] > >    provides the means to restrict access for particular NETCONF or > >   > >    RESTCONF users to a preconfigured subset of all available > NETCONF or > >    RESTCONF protocol operations and content. > >   > >    In general, Layer 2 network topologies are system-controlled and > >    provide ephemeral topology information.  In an NMDA-complient > server, > >    they are only part of which provides read-only access > >    to clients, they are less vulnerable.  That said, the YANG module > >    does in principle allow information to be configurable. > >   > >    The Layer 2 topology module define information that can be > >    configurable in certain instances, for example in the case of > virtual > >    topologies that can be created by client applications.  In such > >    cases, a malicious client could introduce topologies that are > >    undesired.  Specifically, a malicious client could attempt to > remove > >    or add a node, a link, a termination point, by creating or deleting > >    corresponding elements in the node, link, and termination point > >    lists, respectively.  In the case of a topology that is > learned, the > >    server will automatically prohibit such misconfiguration attempts. > >    In the case of a topology that is configured, i.e. whose origin is > >    "intended", the undesired configuration could become effective > and be > >    reflected in the operational state datastore, leading to disruption > >    of services provided via this topology might be disrupted.  For > those > >    reasons, it is important that the NETCONF access control model is > >    vigorously applied to prevent topology misconfiguration by > >    unauthorized clients. > >   > >    There are a number of data nodes defined in this YANG module > that are > >    writable/creatable/deletable (i.e., config true, which is the > >    default).  These data nodes may be considered sensitive or > vulnerable > >    in some network environments.  Write operations (e.g., edit-config) > >    to these data nodes without proper protection can have a negative > >    effect on network operations.  These are the subtrees and data > nodes > >    and their sensitivity/vulnerability in the ietf-network module: > >   > >    o  l2-network-attributes: A malicious client could attempt to > >       sabotage the configuration of any of the contained attributes, > >       such as the name or the flag data nodes. > >   > >    o  l2-node-attributes: A malicious client could attempt to sabotage > >       the configuration of important node attributes, such as the name > >       or the management-address. > >   > >    o  l2-link-attributes: A malicious client could attempt to sabotage > >       the configuration of important link attributes, such as the rate > >       or the delay data nodes. > >   > >    o  l2-termination-point-attributes: A malicious client could > attempt > >       to sabotage the configuration of important termination point > >       attributes, such as the maximum-frame-size. > > " > > NEW TEXT: > > " > > 6.  Security Considerations > >   > >    The YANG module specified in this document defines a schema for > data > >    that is designed to be accessed via network management > protocols such > >    as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF > layer > >    is the secure transport layer, and the mandatory-to-implement > secure > >    transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF > layer > >    is HTTPS, and the mandatory-to-implement secure transport is TLS > >    [RFC8446]. > >   > >    The Network Configuration Access Control Model (NACM) [RFC8341] > >    provides the means to restrict access for particular NETCONF or > >    RESTCONF users to a preconfigured subset of all available > NETCONF or > >    RESTCONF protocol operations and content. > >   > >    In general, Layer 2 network topologies are system-controlled and > >    provide ephemeral topology information.  In an NMDA-complient > server, > >    they are only part of which provides read-only access > >    to clients, they are less vulnerable.  That said, the YANG module > >    does in principle allow information to be configurable. > >   > >    The Layer 2 topology module define information that can be > >    configurable in certain instances, for example in the case of > virtual > >    topologies that can be created by client applications.  In such > >    cases, a malicious client could introduce topologies that are > >    undesired.  Specifically, a malicious client could attempt to > remove > >    or add a node, a link, a termination point, by creating or deleting > >    corresponding elements in the node, link, and termination point > >    lists, respectively.  In the case of a topology that is > learned, the > >    server will automatically prohibit such misconfiguration attempts. > >    In the case of a topology that is configured, i.e. whose origin is > >    "intended", the undesired configuration could become effective > and be > >    reflected in the operational state datastore, leading to disruption > >    of services provided via this topology might be disrupted.  For > those > >    reasons, it is important that the NETCONF access control model is > >    vigorously applied to prevent topology misconfiguration by > >    unauthorized clients. > >   > > *  The YANG model for layer 2 topology may expose sensitive > information, * > > *  for example the MAC addresses of devices. Unrestricted use of > such information * > > *   can lead to privacy violations. For example, listing MAC > addresses in a network * > > *   allows monitoring of devices and their movements. Location > information can be derived* > > *   from MAC addresses of network devices, bypassing protection of > location information by * > > *   the Operating System. Deployments should mitigate this privacy > concerns by limiting access * > > *   to the layer 2 topology information. Access to the information > should be restricted to a * > > *   minimal list of authorized clients, and should also require > proper authentication of these clients.* > >   > >    There are a number of data nodes defined in this YANG module > that are > >    writable/creatable/deletable (i.e., config true, which is the > >    default).  These data nodes may be considered sensitive or > vulnerable > >    in some network environments.  Write operations (e.g., edit-config) > >    to these data nodes without proper protection can have a negative > >    effect on network operations.  These are the subtrees and data > nodes > >    and their sensitivity/vulnerability in the ietf-network module: > >   > >    o  l2-network-attributes: A malicious client could attempt to > >       sabotage the configuration of any of the contained attributes, > >       such as the name or the flag data nodes. > >   > >    o  l2-node-attributes: A malicious client could attempt to sabotage > >       the configuration of important node attributes, such as the name > >       ,the management-address, *mac-address of the devices*. > >   > >    o  l2-link-attributes: A malicious client could attempt to sabotage > >       the configuration of important link attributes, such as the rate > >       or the delay data nodes. > >   > >    o  l2-termination-point-attributes: A malicious client could > attempt > >       to sabotage the configuration of important termination point > >       attributes, such as the maximum-frame-size, *mac-address*. > > " > > The question is do you think proposal with yang security > boilterplate has already addressed your comments > > Or you think we should emphasize how privacy issue can be > addressed by NACM and client authentication is needed? > >   > > -Qin > > -----邮件原件----- > 发件人: Christian Huitema [mailto:huitema@huitema.net] > 发送时间: 2020年6月26日12:05 > 收件人: Susan Hares ; Qin > Wu ; > secdir@ietf.org > 抄送: i2rs@ietf.org ; > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org > ; > last-call@ietf.org > 主题: Re: [Last-Call] [i2rs] Secdir last call review of > draft-ietf-i2rs-yang-l2-network-topology-13 > >   > > How about adding something like this: > >   > > Privacy Considerations > >   > > The Yang model for layer 2 topology exposes privacy sensitive > information, for example the MAC addresses of devices. > Unrestricted use of such information can lead to privacy > violations. For example, listing MAC addresses in a network allows > monitoring of devices and their movements. Location information > can be derived from MAC addresses of network devices, bypassing > protection of location information by the Operating System. > >   > > Deployments should mitigate this privacy concerns by limiting > access to the layer 2 topology information. Access to the > information should be restricted to a minimal list of authorized > agents, and should require proper authentication of these agents. > >   > > -- Christian Huitema > >   > > On 6/25/2020 7:00 AM, Susan Hares wrote: > > > Qin and Christian: > > >  > > > Thank you for your prompt attention to the privacy issue.  > > > I'm sure Christian will respond in a bit - since he might be in PDT > time-zone. > > >  > > > Once you have a solution you both like, we should validate the privacy > > > changes to the security considerations section with the Yang-doctors, > > > OPS-ADs, and Security-ADs. > > >  > > > Martin's watching this thread so I'm sure he'll help us out as well. > > >  > > > Sue > > >  > > > -----Original Message----- > > > From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu > > > Sent: Thursday, June 25, 2020 9:25 AM > > > To: Susan Hares; 'Christian Huitema'; secdir@ietf.org > > > Cc: i2rs@ietf.org ; > > > draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org > ; > > > last-call@ietf.org > > > Subject: Re: [i2rs] Secdir last call review of > > > draft-ietf-i2rs-yang-l2-network-topology-13 > > >  > > > Sue and Christian: > > > I have responded to Christian on privacy issue, my proposal is to add > MAC address as another data node vulnerability example in our > original security consideration section. > > > But If Christian or security directorate has recommending text, we > authors are happy to accept it. > > >  > > > -Qin > > > -----邮件原件----- > > > 发件人: Susan Hares [mailto:shares@ndzh.com] > > > 发送时间: 2020年6月25日21:04 > > > 收件人: 'Christian Huitema' >; secdir@ietf.org > > > > 抄送: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org > ; > > > i2rs@ietf.org ; last-call@ietf.org > > > > 主题: RE: Secdir last call review of > > > draft-ietf-i2rs-yang-l2-network-topology-13 > > >  > > > Christian: > > >  > > > Thank you for catching the privacy issues.      > > >  > > > I've got a few questions to help the authors scope this change: > > >  > > > 1) Since this is common to all L2 Topologies, can you or the security > directorate recommend some text that might be appropriate? > > >    If you have recommended text, has this text been reviewed by OPS-DIR and Yang > doctors? > > >  > > > 2) Will it be a problem If we write privacy considerations on IEEE specifications? > > > 3) Do we need to consider the range of deployments of L2 (home, > > > enterprise,  public PBB service, national PBB service, Data centers) > > >  > > >  > > > Thank you,  Sue > > >  > > >  > > > -----Original Message----- > > > From: Christian Huitema via Datatracker [mailto:noreply@ietf.org] > > > Sent: Thursday, June 25, 2020 1:01 AM > > > To: secdir@ietf.org > > > Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org > ; > > > i2rs@ietf.org ; last-call@ietf.org > > > > Subject: Secdir last call review of > > > draft-ietf-i2rs-yang-l2-network-topology-13 > > >  > > > Reviewer: Christian Huitema > > > Review result: Has Issues > > >  > > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG.  These comments were written with the intent of improving > security requirements and considerations in IETF drafts.  Comments > not addressed in last call may be included in AD reviews during > the IESG review.  Document editors and WG chairs should treat > these comments just like any other last call comments. > > >  > > > This document describes a Yang model for representing Link Layer topologies. > > > Representing such topologies is obviously useful for managing network. > > > The security section is focused on securing the usage of this information for > network management, but does not address potential privacy issues. > > >  > > > The security considerations explain correctly how altering the link layer > information could enable attacks against the network. The proposed > remedy is access control, implemented using either SSH or TLS. > This is fine, although the discussion of TLS authorisation is a > bit short. By default, TLS verifies the identity of the server but > not that of the client. RFC8040 section 2.5 specifies that "a > RESTCONF server SHOULD require authentication based on TLS client > certificates. I assume that's the intent, but it might be useful > to say so. > > >  > > > On the other hand, the security considerations do not describe privacy issues, > and I find that problematic. The proposed information model lists > a number of sensitive data, such as for example the MAC addresses > of devices. > > > This information can be misused. For example, applications could > assess device location fetching the MAC addresses of local > gateways. Third parties could access link local information to > gather identities of devices accessing a particular network. Such > information is often protected by privacy API in the Operating > System, but accessing the Yang module over the network might allow > applications to bypass these controls. > > >  > > > Client authentication alone does not necessarily protect against these > privacy leaks. A classic configuration error would limit write > access to authorized users, but to allow read-only access to most > users. This kind of error would allow privacy leaks. Given the > sensitive nature of MAC addresses and other identifiers, it is > useful to warn against such errors. > > >  > > >  > > >  > > >  > > >  > > > _______________________________________________ > > > i2rs mailing list > > > i2rs@ietf.org > > > https://www.ietf.org/mailman/listinfo/i2rs > > >  > > --------------A3510C022F77668DCEC42238 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit Works for me. Thank you.

-- Christian Huitema

On 6/26/2020 11:26 PM, Qin Wu wrote:

Thanks Christian for clarification, here is the tweaked text to address your comment, which is positioned right after the discussion about writable/creatable/deletable attributes.

NEW TEXT:

“

6.  Security Considerations

 

   The YANG module specified in this document defines a schema for data

   that is designed to be accessed via network management protocols such

   as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer

   is the secure transport layer, and the mandatory-to-implement secure

   transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer

   is HTTPS, and the mandatory-to-implement secure transport is TLS

   [RFC8446].

 

   The Network Configuration Access Control Model (NACM) [RFC8341]

   provides the means to restrict access for particular NETCONF or

 

   RESTCONF users to a preconfigured subset of all available NETCONF or

   RESTCONF protocol operations and content.

 

   The Layer 2 topology module define information that can be

   configurable in certain instances, for example in the case of virtual

   topologies that can be created by client applications.  In such

   cases, a malicious client could introduce topologies that are

   undesired.  Specifically, a malicious client could attempt to remove

   or add a node, a link, a termination point, by creating or deleting

   corresponding elements in the node, link, and termination point

   lists, respectively.  In the case of a topology that is learned, the

   server will automatically prohibit such misconfiguration attempts.

   In the case of a topology that is configured, i.e. whose origin is

   "intended", the undesired configuration could become effective and be

   reflected in the operational state datastore, leading to disruption

   of services provided via this topology might be disrupted.  For those

   reasons, it is important that the NETCONF access control model is

   vigorously applied to prevent topology misconfiguration by

   unauthorized clients.

 

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      or the management-address.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size.

 

Some of the readable data nodes in this YANG module may be considered

sensitive or vulnerable in some network environments. It is thus  important to control

read access (e.g., via get, get-config, or notification) to these data nodes. In particular, the

YANG model for layer 2 topology may expose sensitive information, for example the MAC

addresses of devices. Unrestricted use of such information can lead to privacy violations.

For example, listing MAC addresses in a network allows monitoring of devices and their

movements. Location information can be derived from MAC addresses of network devices,

bypassing protection of location information by the Operating System.

 

”

Thanks.

 

-Qin

发件人: Christian Huitema [mailto:huitema@huitema.net]
发送时间: 2020年6月26日 22:55
收件人: Qin Wu <bill.wu@huawei.com>; Susan Hares <shares@ndzh.com>; secdir@ietf.org
抄送: i2rs@ietf.org; draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; last-call@ietf.org; NETMOD Group <netmod@ietf.org>
主题: Re: [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13

 

I like variant B better, although I would not single out the mac addresses in the "sabotage" warning.

My main concern is that network administrators will naturally be very concerned about information that is writable/creatable/deletable, because they understand the impact on the management of their network. However, they are not so concerned with read-only access, because reading information does not directly affect the operation of the network. My whole point is telling them, "you are documenting your L2 topology, it contains sensitive information, make sure that reading it is protected, not just writing it".

I agree that NETCONF and RESTCONF provide the right tools for protecting the information. My request is just to clearly tell network administrators to use these tools, do not leave read access wide open!

-- Christian Huitema

On 6/26/2020 4:37 AM, Qin Wu wrote:

Hi, Christian:

1.       NACM defined in RFC8341 has already provided mechanisms to restrict access to sensitive information to a minimal list of authorized client or agents and deal with privacy issue if my understanding is correct.

2.       Both NETCONF and RESTCONF will rely on transport protocol such as TLS to provide client authentication and server authentication, i.e., mutual authentication.

3.       The YANG security guideline defined in https://trac.ietf.org/trac/ops/wiki/yang-security-guidelines

Provide perfect boilerplate to address both security consideration and privacy consideration.

My original proposal A to address your comments is:

OLD TEXT:

"

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      or the management-address.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size.

"

NEW TEXT:

"

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      ,the management-address or mac address of the devices.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

  o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size, mac-address.

"

 

With your proposed text, we could have the following proposal changes (Proposal B):

OLD TEXT:

"

6.  Security Considerations

 

   The YANG module specified in this document defines a schema for data

   that is designed to be accessed via network management protocols such

   as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer

   is the secure transport layer, and the mandatory-to-implement secure

   transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer

   is HTTPS, and the mandatory-to-implement secure transport is TLS

   [RFC8446].

 

   The Network Configuration Access Control Model (NACM) [RFC8341]

   provides the means to restrict access for particular NETCONF or

 

   RESTCONF users to a preconfigured subset of all available NETCONF or

   RESTCONF protocol operations and content.

 

   In general, Layer 2 network topologies are system-controlled and

   provide ephemeral topology information.  In an NMDA-complient server,

   they are only part of <operational> which provides read-only access

   to clients, they are less vulnerable.  That said, the YANG module

   does in principle allow information to be configurable.

 

   The Layer 2 topology module define information that can be

   configurable in certain instances, for example in the case of virtual

   topologies that can be created by client applications.  In such

   cases, a malicious client could introduce topologies that are

   undesired.  Specifically, a malicious client could attempt to remove

   or add a node, a link, a termination point, by creating or deleting

   corresponding elements in the node, link, and termination point

   lists, respectively.  In the case of a topology that is learned, the

   server will automatically prohibit such misconfiguration attempts.

   In the case of a topology that is configured, i.e. whose origin is

   "intended", the undesired configuration could become effective and be

   reflected in the operational state datastore, leading to disruption

   of services provided via this topology might be disrupted.  For those

   reasons, it is important that the NETCONF access control model is

   vigorously applied to prevent topology misconfiguration by

   unauthorized clients.

 

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      or the management-address.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size.

"

NEW TEXT:

"

6.  Security Considerations

 

   The YANG module specified in this document defines a schema for data

   that is designed to be accessed via network management protocols such

   as NETCONF [RFC6241] or RESTCONF [RFC8040].  The lowest NETCONF layer

   is the secure transport layer, and the mandatory-to-implement secure

   transport is Secure Shell (SSH) [RFC6242].  The lowest RESTCONF layer

   is HTTPS, and the mandatory-to-implement secure transport is TLS

   [RFC8446].

 

   The Network Configuration Access Control Model (NACM) [RFC8341]

   provides the means to restrict access for particular NETCONF or

   RESTCONF users to a preconfigured subset of all available NETCONF or

   RESTCONF protocol operations and content.

 

   In general, Layer 2 network topologies are system-controlled and

   provide ephemeral topology information.  In an NMDA-complient server,

   they are only part of <operational> which provides read-only access

   to clients, they are less vulnerable.  That said, the YANG module

   does in principle allow information to be configurable.

 

   The Layer 2 topology module define information that can be

   configurable in certain instances, for example in the case of virtual

   topologies that can be created by client applications.  In such

   cases, a malicious client could introduce topologies that are

   undesired.  Specifically, a malicious client could attempt to remove

   or add a node, a link, a termination point, by creating or deleting

   corresponding elements in the node, link, and termination point

   lists, respectively.  In the case of a topology that is learned, the

   server will automatically prohibit such misconfiguration attempts.

   In the case of a topology that is configured, i.e. whose origin is

   "intended", the undesired configuration could become effective and be

   reflected in the operational state datastore, leading to disruption

   of services provided via this topology might be disrupted.  For those

   reasons, it is important that the NETCONF access control model is

   vigorously applied to prevent topology misconfiguration by

   unauthorized clients.

 

  The YANG model for layer 2 topology may expose sensitive information,

  for example the MAC addresses of devices. Unrestricted use of such information

   can lead to privacy violations. For example, listing MAC addresses in a network

   allows monitoring of devices and their movements. Location information can be derived

   from MAC addresses of network devices, bypassing protection of location information by

   the Operating System. Deployments should mitigate this privacy concerns by limiting access

   to the layer 2 topology information. Access to the information should be restricted to a

   minimal list of authorized clients, and should also require proper authentication of these clients.

 

   There are a number of data nodes defined in this YANG module that are

   writable/creatable/deletable (i.e., config true, which is the

   default).  These data nodes may be considered sensitive or vulnerable

   in some network environments.  Write operations (e.g., edit-config)

   to these data nodes without proper protection can have a negative

   effect on network operations.  These are the subtrees and data nodes

   and their sensitivity/vulnerability in the ietf-network module:

 

   o  l2-network-attributes: A malicious client could attempt to

      sabotage the configuration of any of the contained attributes,

      such as the name or the flag data nodes.

 

   o  l2-node-attributes: A malicious client could attempt to sabotage

      the configuration of important node attributes, such as the name

      ,the management-address, mac-address of the devices.

 

   o  l2-link-attributes: A malicious client could attempt to sabotage

      the configuration of important link attributes, such as the rate

      or the delay data nodes.

 

   o  l2-termination-point-attributes: A malicious client could attempt

      to sabotage the configuration of important termination point

      attributes, such as the maximum-frame-size, mac-address.

"

The question is do you think proposal with yang security boilterplate has already addressed your comments

Or you think we should emphasize how privacy issue can be addressed by NACM and client authentication is needed?

 

-Qin

-----邮件原件-----
发件人: Christian Huitema [mailto:huitema@huitema.net]
发送时间: 2020年6月26日 12:05
收件人: Susan Hares <shares@ndzh.com>; Qin Wu <bill.wu@huawei.com>; secdir@ietf.org
抄送: i2rs@ietf.org; draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org; last-call@ietf.org
主题: Re: [Last-Call] [i2rs] Secdir last call review of draft-ietf-i2rs-yang-l2-network-topology-13

 

How about adding something like this:

 

Privacy Considerations

 

The Yang model for layer 2 topology exposes privacy sensitive information, for example the MAC addresses of devices. Unrestricted use of such information can lead to privacy violations. For example, listing MAC addresses in a network allows monitoring of devices and their movements. Location information can be derived from MAC addresses of network devices, bypassing protection of location information by the Operating System.

 

Deployments should mitigate this privacy concerns by limiting access to the layer 2 topology information. Access to the information should be restricted to a minimal list of authorized agents, and should require proper authentication of these agents.

 

-- Christian Huitema

 

On 6/25/2020 7:00 AM, Susan Hares wrote:

> Qin and Christian:

> 

> Thank you for your prompt attention to the privacy issue. 

> I'm sure Christian will respond in a bit - since he might be in PDT time-zone.

> 

> Once you have a solution you both like, we should validate the privacy

> changes to the security considerations section with the Yang-doctors,

> OPS-ADs, and Security-ADs.

> 

> Martin's watching this thread so I'm sure he'll help us out as well.

> 

> Sue

> 

> -----Original Message-----

> From: i2rs [mailto:i2rs-bounces@ietf.org] On Behalf Of Qin Wu

> Sent: Thursday, June 25, 2020 9:25 AM

> To: Susan Hares; 'Christian Huitema'; secdir@ietf.org

> Cc: i2rs@ietf.org;

> draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;

> last-call@ietf.org

> Subject: Re: [i2rs] Secdir last call review of

> draft-ietf-i2rs-yang-l2-network-topology-13

> 

> Sue and Christian:

> I have responded to Christian on privacy issue, my proposal is to add MAC address as another data node vulnerability example in our original security consideration section.

> But If Christian or security directorate has recommending text, we authors are happy to accept it.

> 

> -Qin

> -----邮件原件-----

> 发件人: Susan Hares [mailto:shares@ndzh.com]

> 发送时间: 2020年6月25日 21:04

> 收件人: 'Christian Huitema' <huitema@huitema.net>; secdir@ietf.org

> 抄送: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;

> i2rs@ietf.org; last-call@ietf.org

> 主题: RE: Secdir last call review of

> draft-ietf-i2rs-yang-l2-network-topology-13

> 

> Christian:

> 

> Thank you for catching the privacy issues.     

> 

> I've got a few questions to help the authors scope this change:

> 

> 1) Since this is common to all L2 Topologies, can you or the security directorate recommend some text that might be appropriate?

>    If you have recommended text, has this text been reviewed by OPS-DIR and Yang doctors?

> 

> 2) Will it be a problem If we write privacy considerations on IEEE specifications?

> 3) Do we need to consider the range of deployments of L2 (home,

> enterprise,  public PBB service, national PBB service, Data centers)

> 

> 

> Thank you,  Sue

> 

> 

> -----Original Message-----

> From: Christian Huitema via Datatracker [mailto:noreply@ietf.org]

> Sent: Thursday, June 25, 2020 1:01 AM

> To: secdir@ietf.org

> Cc: draft-ietf-i2rs-yang-l2-network-topology.all@ietf.org;

> i2rs@ietf.org; last-call@ietf.org

> Subject: Secdir last call review of

> draft-ietf-i2rs-yang-l2-network-topology-13

> 

> Reviewer: Christian Huitema

> Review result: Has Issues

> 

> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving security requirements and considerations in IETF drafts.  Comments not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments just like any other last call comments.

> 

> This document describes a Yang model for representing Link Layer topologies.

> Representing such topologies is obviously useful for managing network.

> The security section is focused on securing the usage of this information for network management, but does not address potential privacy issues.

> 

> The security considerations explain correctly how altering the link layer information could enable attacks against the network. The proposed remedy is access control, implemented using either SSH or TLS. This is fine, although the discussion of TLS authorisation is a bit short. By default, TLS verifies the identity of the server but not that of the client. RFC8040 section 2.5 specifies that "a RESTCONF server SHOULD require authentication based on TLS client certificates. I assume that's the intent, but it might be useful to say so.

> 

> On the other hand, the security considerations do not describe privacy issues, and I find that problematic. The proposed information model lists a number of sensitive data, such as for example the MAC addresses of devices.

> This information can be misused. For example, applications could assess device location fetching the MAC addresses of local gateways. Third parties could access link local information to gather identities of devices accessing a particular network. Such information is often protected by privacy API in the Operating System, but accessing the Yang module over the network might allow applications to bypass these controls.

> 

> Client authentication alone does not necessarily protect against these privacy leaks. A classic configuration error would limit write access to authorized users, but to allow read-only access to most users. This kind of error would allow privacy leaks. Given the sensitive nature of MAC addresses and other identifiers, it is useful to warn against such errors.

> 

> 

> 

> 

> 

> _______________________________________________

> i2rs mailing list

> i2rs@ietf.org

> https://www.ietf.org/mailman/listinfo/i2rs

> 


--------------A3510C022F77668DCEC42238-- From nobody Sun Jun 28 08:55:59 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E69CE3A0D5B; Sun, 28 Jun 2020 08:55:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l72YUG3C_Mxw; Sun, 28 Jun 2020 08:55:44 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0b-00191d01.pphosted.com [67.231.157.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5163A3A02C1; Sun, 28 Jun 2020 08:55:44 -0700 (PDT) Received: from pps.filterd (m0049463.ppops.net [127.0.0.1]) by m0049463.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 05SFrFYu018856; Sun, 28 Jun 2020 11:55:42 -0400 Received: from tlpd255.enaf.dadc.sbc.com (sbcsmtp3.sbc.com [144.160.112.28]) by m0049463.ppops.net-00191d01. with ESMTP id 31x2gb6w4w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 28 Jun 2020 11:55:42 -0400 Received: from enaf.dadc.sbc.com (localhost [127.0.0.1]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SFtfsk104844; Sun, 28 Jun 2020 10:55:42 -0500 Received: from zlp30496.vci.att.com (zlp30496.vci.att.com [135.46.181.157]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SFtW2F104691 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 28 Jun 2020 10:55:33 -0500 Received: from zlp30496.vci.att.com (zlp30496.vci.att.com [127.0.0.1]) by zlp30496.vci.att.com (Service) with ESMTP id DDF91403A432; Sun, 28 Jun 2020 15:55:32 +0000 (GMT) Received: from clph811.sldc.sbc.com (unknown [135.41.107.12]) by zlp30496.vci.att.com (Service) with ESMTP id B2AFD403A430; Sun, 28 Jun 2020 15:55:32 +0000 (GMT) Received: from sldc.sbc.com (localhost [127.0.0.1]) by clph811.sldc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SFtVZ9124298; Sun, 28 Jun 2020 10:55:32 -0500 Received: from mail-green.research.att.com (mail-green.research.att.com [135.207.255.15]) by clph811.sldc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SFtQ9V124018; Sun, 28 Jun 2020 10:55:26 -0500 Received: from exchange.research.att.com (njbdcas1.research.att.com [135.197.255.61]) by mail-green.research.att.com (Postfix) with ESMTPS id 5612C10A202D; Sun, 28 Jun 2020 11:55:25 -0400 (EDT) Received: from njmtexg5.research.att.com ([fe80::b09c:ff13:4487:78b6]) by njbdcas1.research.att.com ([fe80::8c6b:4b77:618f:9a01%11]) with mapi id 14.03.0468.000; Sun, 28 Jun 2020 11:55:25 -0400 From: "MORTON, ALFRED C (AL)" To: Watson Ladd , "secdir@ietf.org" CC: "ippm@ietf.org" , "draft-ietf-ippm-route.all@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-ippm-route-08 Thread-Index: AQHWTIyZvXQz0VhNUkW5CnKGDiRZYajuKL2Q Date: Sun, 28 Jun 2020 15:55:24 +0000 Message-ID: <4D7F4AD313D3FC43A053B309F97543CF0108A69B10@njmtexg5.research.att.com> References: <159326696737.10306.5653213903966509356@ietfa.amsl.com> In-Reply-To: <159326696737.10306.5653213903966509356@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [69.141.203.172] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687 definitions=2020-06-28_11:2020-06-26, 2020-06-28 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 spamscore=0 lowpriorityscore=0 bulkscore=0 mlxlogscore=999 clxscore=1011 cotscore=-2147483648 priorityscore=1501 adultscore=0 phishscore=0 impostorscore=0 suspectscore=0 mlxscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2006280117 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-ippm-route-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jun 2020 15:55:46 -0000 SGkgV2F0c29uLCANClRoYW5rcyBmb3IgeW91ciByZXZpZXcgYW5kIGNvbW1lbnRzLg0KcGxlYXNl IHNlZSByZXBsaWVzIGJlbG93LA0KQWwNCg0KPiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0K PiBGcm9tOiBXYXRzb24gTGFkZCB2aWEgRGF0YXRyYWNrZXIgW21haWx0bzpub3JlcGx5QGlldGYu b3JnXQ0KPiBTZW50OiBTYXR1cmRheSwgSnVuZSAyNywgMjAyMCAxMDowOSBBTQ0KPiBUbzogc2Vj ZGlyQGlldGYub3JnDQo+IENjOiBpcHBtQGlldGYub3JnOyBkcmFmdC1pZXRmLWlwcG0tcm91dGUu YWxsQGlldGYub3JnOyBsYXN0LWNhbGxAaWV0Zi5vcmcNCj4gU3ViamVjdDogU2VjZGlyIGxhc3Qg Y2FsbCByZXZpZXcgb2YgZHJhZnQtaWV0Zi1pcHBtLXJvdXRlLTA4DQo+IA0KPiBSZXZpZXdlcjog V2F0c29uIExhZGQNCj4gUmV2aWV3IHJlc3VsdDogSGFzIE5pdHMNCj4gDQo+IEkgaGF2ZSByZXZp ZXdlZCB0aGlzIGRvY3VtZW50IGFzIHBhcnQgb2YgdGhlIHNlY3VyaXR5IGRpcmVjdG9yYXRlJ3MN Cj4gb25nb2luZw0KPiBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWluZyBw cm9jZXNzZWQgYnkgdGhlIElFU0cuICBUaGVzZQ0KPiBjb21tZW50cw0KPiB3ZXJlIHdyaXR0ZW4g cHJpbWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUgc2VjdXJpdHkgYXJlYSBkaXJlY3RvcnMu DQo+IERvY3VtZW50DQo+IGVkaXRvcnMgYW5kIFdHIGNoYWlycyBzaG91bGQgdHJlYXQgdGhlc2Ug Y29tbWVudHMganVzdCBsaWtlIGFueSBvdGhlciBsYXN0DQo+IGNhbGwNCj4gY29tbWVudHMuDQo+ IA0KPiBUaGUgc3VtbWFyeSBvZiB0aGUgcmV2aWV3IGlzIEhhcyBOaXRzLg0KPiANCj4gT25lIGxp dHRsZSB0aGluZzogY2xhc3MgQyBoYXMgYSBtZWFuaW5nIGFscmVhZHksIGFuZCBJIHRoaW5rIHRo ZSBhdXRob3JzIG1lYW50IGENCj4gY2xhc3MgdG8gYmUgcmVmZXJyZWQgdG8gYnkgQywgbm90IHRo ZSBhbmNpZW50IHRlcm0gZm9yIGEgZGl2aXNpb24gb2YgSVAgc3BhY2UNCj4gdGhhdCBmZWxsIG91 dCBvZiB1c2UgbG9uZyBiZWZvcmUgbXkgYmlydGguIExhdGVyIG9uIHRoaXMgYmVjb21lcyBjbGVh ciwNCj4gYnV0IGluIHRoZSBpbnRyb2R1Y3Rpb24gaXQgZGlkIHRocm93IG1lIG9mZi4NClthY21d IA0KVGhlIGNsYXNzIEMgdGVybWlub2xvZ3kgYXBwZWFycyBmaXJzdCBpbiB0aGUgVGVybXMgYW5k IERlZmluaXRpb25zLCB1bmxlc3MgSSBvdmVybG9va2VkIGFuIGluc3RhbmNlIGluIHRoZSBpbnRy by4uLg0KDQpXZSB3ZXJlIGFza2VkIHRvIGRlZmluZSB0aGUgdGVybSBSb3V0aW5nIENsYXNzIG9u IEFEIHJldmlldywgd2hpY2ggd2UgZGlkLiBQZXJoYXBzIHdlIGNvdWxkIGFkZCB0aGUgY2xhcmlm aWNhdGlvbiBmcm9tIHNlY3Rpb24gNC4xLjI6ICAuLi4gKHVucmVsYXRlZCB0byBhZGRyZXNzIGNs YXNzZXMgb2YgdGhlIHBhc3QpIC4uLiANCkJ1dCBzb21laG93IFJGQyAyMzMwICh0aGUgSVBQTSBG cmFtZXdvcmspIGFuZCBtb3N0IHJlY2VudGx5IFJGQyA4NDY4IHVzZWQgZGVzaWduYXRpb24gd2l0 aG91dCBtdWNoIGRpZmZpY3VsdHkuDQoNCj4gDQo+IFRoZSBjb25jbHVzaW9uIHBhcmFncmFwaCBh bHNvIHNlZW1zIHRvIGRlc2NyaWJlIGEgbXVjaCBsZXNzIGNvbXByZWhlbnNpdmUNCj4gZG9jdW1l bnQgdGhlbiB0aGUgaW50cm9kdWN0aW9uIHByYWdyYXBoLiBUaGlzIGRvZXMgc2VlbSB0byBoYXZl IGJlZW4gYW4gZWZmZWN0DQo+IG9mIGV2b2x1dGlvbiwgYW5kIGlzIHByZXR0eSBlYXNpbHkgZml4 ZWQgYW5kIG1vc3RseSBjb3NtZXRpYy4NClthY21dIA0KVGhhbmtzLCB3ZSBhbHNvIHNlZSByZXF1 ZXN0cyB0byByZW1vdmUgImNvbmNsdXNpb24iIHNlY3Rpb25zIGZyb20gUkZDcywgYW5kIHRoYXQn cyBhIHBvc3NpYmxlIHJlc29sdXRpb24gdG9vLg0KIA0KPiANCj4gTm93IGZvciB0aGUgbWVhdDog d2hhdCBhYm91dCB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbnM/IFNpbmNlIHRoaXMgZHJhZnQg aXMNCj4gZGVzY3JpYmluZyBlbmhhbmNlbWVudHMgdG8gdHJhY2Vyb3V0ZSBhbmQgd2F5cyB0byBk ZXNjcmliZSB0aGUgbWVhc3VyZW1lbnRzDQo+IHRha2VuIGJ5IHN1Y2ggZW5oYW5jZWQgdHJhY2Vy b3V0ZXMsIHRoZSBzZWN1cml0eSBpbXBhY3QgaXMgbWluaW1hbCBhbmQgdGhlDQo+IGF1dGhvcnMg cmVmZXJlbmNlIHRoZSBleGlzdGluZyBSRkNzIGRlc2NyaWJpbmcgdGhlIHNlY3VyaXR5IGltcGFj dHMgb2YNCj4gdHJhY3JvdXRlcyBvbiBuZXR3b3Jrcy4NClthY21dIA0KSSdtIGxvb2tpbmcgZm9y IHRoZSBhY3Rpb24gaW1wbGllZCBpbiB5b3VyIGNvbW1lbnQuICBEbyB3ZSBhZGQgdGhlIHNlbnRl bmNlczoNCg0KVGhpcyBkcmFmdCBkZXNjcmliZXMgZW5oYW5jZW1lbnRzIHRvIHRyYWNlcm91dGUg YW5kIHdheXMgdG8gZGVzY3JpYmUgdGhlIG1lYXN1cmVtZW50cyB0YWtlbiBieSBzdWNoIGVuaGFu Y2VkIHRyYWNlcm91dGUgdG9vbHMuIFRoZSBzZWN1cml0eSBpbXBhY3QgaXMgbWluaW1hbCBhbmQg dGhlIGF1dGhvcnMgcmVmZXJlbmNlIHRoZSBleGlzdGluZyBSRkNzIGRlc2NyaWJpbmcgdGhlIHNl Y3VyaXR5IGltcGFjdHMgb2YgYWN0aXZlIGFuZCBoeWJyaWQgbWVhc3VyZW1lbnRzIG9uIG5ldHdv cmtzIChvZiB3aGljaCB0cmFjZXJvdXRlIG1lYXN1cmVtZW50cyBhcmUgYSBzdWJzZXQpIGJlbG93 Lg0KDQpPcj8NCg0KPiANCj4gU2luY2VyZWx5LA0KPiBXYXRzb24gTGFkZA0KPiANCg0K From nobody Sun Jun 28 09:05:18 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 082593A0D8A; Sun, 28 Jun 2020 09:05:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eKJ8Aed89cza; Sun, 28 Jun 2020 09:05:06 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFF733A0DB6; Sun, 28 Jun 2020 09:05:05 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id s9so15389199ljm.11; Sun, 28 Jun 2020 09:05:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=NvJZeI/hgGK8NXItQJeJWusBVO+x33mlPJu9W/3YUAI=; b=FnNcFVLUiewJa1t4vIh8Q72D6stv1udhv7tadPky3Ut/DP037QPWnac2TctysFTcLZ /VdIltBqsjJm1+FIMFbwHSokcMolujz0JbIpLgMO5H8+mIfv6ydWZmbVjw+/99ku/jQj drW1ltBlVjBsQUvmkpB9cyOEQd4NaHk99T9RwrW+D7o9sde0N/GaGpg3MDXxRTEarTb7 En6l/+PEIlXw1avJjDOJfOYkc1gI+FF7a3iJHMDKSgjpPjaTr7gnzH7z6Ar9sLaJM1ry 4Pyw6LndREaY0tPGahlEmvKhVm/xnTS+AcgfPeMMKfgva21wYNVORB/YuWyZuAgiCuJq ud2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=NvJZeI/hgGK8NXItQJeJWusBVO+x33mlPJu9W/3YUAI=; b=JKOItPRzwf5gcG/3Z8LNNIpvPJGBwAqBKSNh9rfGAd0olmu97Sy11RI4O0OYAxr0Xz ikLFzCXUKIN0VRuWlH5F4/pLOeI9ITFg5McNgnu0fUhevV698wz5kqRfSMELXLVmKZAY QdZte6QJZdk0x7vwpvT0Xoih723yB+sqc4TFhIAFGrdCkvraK52csu4dUGdfU6cdGypD 2UDwR/zHpWNwz0Ipmj/gDec+zeDGiQw2N6eo1k5YjKXjvXcd5jDtIi0UuUE1rqZi+hQW eRYl0u7U85tXzP0RrdzHSL7gSlRhmFXdjonrV07pctyQY7Vpq0xwgCwEGr4eQhoMmmus 5Vmw== X-Gm-Message-State: AOAM530j/D63c3LkVFhabWcoz5X//JzUdpeFQcFyfdQaDih1jrEWLBal T/xEG8jp45gvIHFg9J8Ms2Cxe8eLDjqWwPYTXXM= X-Google-Smtp-Source: ABdhPJxbcUn3+xv6XUnGf7jaJmMMbE5CsNGJEZWsxxqEzVtRCJHQU2OLp8ppaAY2udyibIB4XyTMYpPYzW89R/VzAl0= X-Received: by 2002:a2e:a16e:: with SMTP id u14mr1350767ljl.321.1593360303830; Sun, 28 Jun 2020 09:05:03 -0700 (PDT) MIME-Version: 1.0 References: <159326696737.10306.5653213903966509356@ietfa.amsl.com> <4D7F4AD313D3FC43A053B309F97543CF0108A69B10@njmtexg5.research.att.com> In-Reply-To: <4D7F4AD313D3FC43A053B309F97543CF0108A69B10@njmtexg5.research.att.com> From: Watson Ladd Date: Sun, 28 Jun 2020 12:04:52 -0400 Message-ID: To: "MORTON, ALFRED C (AL)" Cc: "secdir@ietf.org" , "ippm@ietf.org" , "draft-ietf-ippm-route.all@ietf.org" , "last-call@ietf.org" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-ippm-route-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jun 2020 16:05:15 -0000 On Sun, Jun 28, 2020 at 11:55 AM MORTON, ALFRED C (AL) wrote: > > > > > Now for the meat: what about the security considerations? Since this dr= aft is > > describing enhancements to traceroute and ways to describe the measurem= ents > > taken by such enhanced traceroutes, the security impact is minimal and = the > > authors reference the existing RFCs describing the security impacts of > > tracroutes on networks. > [acm] > I'm looking for the action implied in your comment. Do we add the senten= ces: > > This draft describes enhancements to traceroute and ways to describe the = measurements taken by such enhanced traceroute tools. The security impact i= s minimal and the authors reference the existing RFCs describing the securi= ty impacts of active and hybrid measurements on networks (of which tracerou= te measurements are a subset) below. My apologies: you read as a suggestion which I thought was a description. I don't think it has to change at all. > > Or? > > > > > Sincerely, > > Watson Ladd > > > --=20 "Man is born free, but everywhere he is in chains". --Rousseau. From nobody Sun Jun 28 09:08:43 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8A5963A0DA2; Sun, 28 Jun 2020 09:08:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6YNrhDt9KFPR; Sun, 28 Jun 2020 09:08:32 -0700 (PDT) Received: from mx0a-00191d01.pphosted.com (mx0a-00191d01.pphosted.com [67.231.149.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 181DA3A0D8B; Sun, 28 Jun 2020 09:08:32 -0700 (PDT) Received: from pps.filterd (m0049297.ppops.net [127.0.0.1]) by m0049297.ppops.net-00191d01. (8.16.0.42/8.16.0.42) with SMTP id 05SG2xbD011188; Sun, 28 Jun 2020 12:08:31 -0400 Received: from tlpd255.enaf.dadc.sbc.com (sbcsmtp3.sbc.com [144.160.112.28]) by m0049297.ppops.net-00191d01. with ESMTP id 31xm5hw8bu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Sun, 28 Jun 2020 12:08:30 -0400 Received: from enaf.dadc.sbc.com (localhost [127.0.0.1]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SG8T1K123250; Sun, 28 Jun 2020 11:08:30 -0500 Received: from zlp30494.vci.att.com (zlp30494.vci.att.com [135.46.181.159]) by tlpd255.enaf.dadc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SG8Oj3123164 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 28 Jun 2020 11:08:24 -0500 Received: from zlp30494.vci.att.com (zlp30494.vci.att.com [127.0.0.1]) by zlp30494.vci.att.com (Service) with ESMTP id 1C7F84005C32; Sun, 28 Jun 2020 16:08:24 +0000 (GMT) Received: from clph811.sldc.sbc.com (unknown [135.41.107.12]) by zlp30494.vci.att.com (Service) with ESMTP id E8D534005C31; Sun, 28 Jun 2020 16:08:23 +0000 (GMT) Received: from sldc.sbc.com (localhost [127.0.0.1]) by clph811.sldc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SG8NsM052592; Sun, 28 Jun 2020 11:08:23 -0500 Received: from mail-blue.research.att.com (mail-blue.research.att.com [135.207.178.11]) by clph811.sldc.sbc.com (8.14.5/8.14.5) with ESMTP id 05SG8I4P052458; Sun, 28 Jun 2020 11:08:18 -0500 Received: from exchange.research.att.com (njbdcas1.research.att.com [135.197.255.61]) by mail-blue.research.att.com (Postfix) with ESMTPS id B7A9B10A18F8; Sun, 28 Jun 2020 12:08:16 -0400 (EDT) Received: from njmtexg5.research.att.com ([fe80::b09c:ff13:4487:78b6]) by njbdcas1.research.att.com ([fe80::8c6b:4b77:618f:9a01%11]) with mapi id 14.03.0468.000; Sun, 28 Jun 2020 12:08:16 -0400 From: "MORTON, ALFRED C (AL)" To: Watson Ladd CC: "secdir@ietf.org" , "ippm@ietf.org" , "draft-ietf-ippm-route.all@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-ippm-route-08 Thread-Index: AQHWTIyZvXQz0VhNUkW5CnKGDiRZYajuKL2QgABM7gD//71r8A== Date: Sun, 28 Jun 2020 16:08:14 +0000 Message-ID: <4D7F4AD313D3FC43A053B309F97543CF0108A69B34@njmtexg5.research.att.com> References: <159326696737.10306.5653213903966509356@ietfa.amsl.com> <4D7F4AD313D3FC43A053B309F97543CF0108A69B10@njmtexg5.research.att.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [69.141.203.172] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687 definitions=2020-06-28_11:2020-06-26, 2020-06-28 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_policy_notspam policy=outbound_policy score=0 bulkscore=0 suspectscore=0 priorityscore=1501 cotscore=-2147483648 malwarescore=0 adultscore=0 phishscore=0 mlxlogscore=999 spamscore=0 lowpriorityscore=0 mlxscore=0 impostorscore=0 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2004280000 definitions=main-2006280118 Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-ippm-route-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jun 2020 16:08:42 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBXYXRzb24gTGFkZCBbbWFpbHRv OndhdHNvbmJsYWRkQGdtYWlsLmNvbV0NCj4gU2VudDogU3VuZGF5LCBKdW5lIDI4LCAyMDIwIDEy OjA1IFBNDQo+IFRvOiBNT1JUT04sIEFMRlJFRCBDIChBTCkgPGFjbUByZXNlYXJjaC5hdHQuY29t Pg0KPiBDYzogc2VjZGlyQGlldGYub3JnOyBpcHBtQGlldGYub3JnOyBkcmFmdC1pZXRmLWlwcG0t cm91dGUuYWxsQGlldGYub3JnOw0KPiBsYXN0LWNhbGxAaWV0Zi5vcmcNCj4gU3ViamVjdDogUmU6 IFNlY2RpciBsYXN0IGNhbGwgcmV2aWV3IG9mIGRyYWZ0LWlldGYtaXBwbS1yb3V0ZS0wOA0KPiAN Cj4gT24gU3VuLCBKdW4gMjgsIDIwMjAgYXQgMTE6NTUgQU0gTU9SVE9OLCBBTEZSRUQgQyAoQUwp DQo+IDxhY21AcmVzZWFyY2guYXR0LmNvbT4gd3JvdGU6DQo+IDxzbmlwPg0KPiA+DQo+ID4gPg0K PiA+ID4gTm93IGZvciB0aGUgbWVhdDogd2hhdCBhYm91dCB0aGUgc2VjdXJpdHkgY29uc2lkZXJh dGlvbnM/IFNpbmNlIHRoaXMNCj4gZHJhZnQgaXMNCj4gPiA+IGRlc2NyaWJpbmcgZW5oYW5jZW1l bnRzIHRvIHRyYWNlcm91dGUgYW5kIHdheXMgdG8gZGVzY3JpYmUgdGhlDQo+IG1lYXN1cmVtZW50 cw0KPiA+ID4gdGFrZW4gYnkgc3VjaCBlbmhhbmNlZCB0cmFjZXJvdXRlcywgdGhlIHNlY3VyaXR5 IGltcGFjdCBpcyBtaW5pbWFsIGFuZA0KPiB0aGUNCj4gPiA+IGF1dGhvcnMgcmVmZXJlbmNlIHRo ZSBleGlzdGluZyBSRkNzIGRlc2NyaWJpbmcgdGhlIHNlY3VyaXR5IGltcGFjdHMgb2YNCj4gPiA+ IHRyYWNyb3V0ZXMgb24gbmV0d29ya3MuDQo+ID4gW2FjbV0NCj4gPiBJJ20gbG9va2luZyBmb3Ig dGhlIGFjdGlvbiBpbXBsaWVkIGluIHlvdXIgY29tbWVudC4gIERvIHdlIGFkZCB0aGUNCj4gc2Vu dGVuY2VzOg0KPiA+DQo+ID4gVGhpcyBkcmFmdCBkZXNjcmliZXMgZW5oYW5jZW1lbnRzIHRvIHRy YWNlcm91dGUgYW5kIHdheXMgdG8gZGVzY3JpYmUgdGhlDQo+IG1lYXN1cmVtZW50cyB0YWtlbiBi eSBzdWNoIGVuaGFuY2VkIHRyYWNlcm91dGUgdG9vbHMuIFRoZSBzZWN1cml0eSBpbXBhY3QNCj4g aXMgbWluaW1hbCBhbmQgdGhlIGF1dGhvcnMgcmVmZXJlbmNlIHRoZSBleGlzdGluZyBSRkNzIGRl c2NyaWJpbmcgdGhlDQo+IHNlY3VyaXR5IGltcGFjdHMgb2YgYWN0aXZlIGFuZCBoeWJyaWQgbWVh c3VyZW1lbnRzIG9uIG5ldHdvcmtzIChvZiB3aGljaA0KPiB0cmFjZXJvdXRlIG1lYXN1cmVtZW50 cyBhcmUgYSBzdWJzZXQpIGJlbG93Lg0KPiANCj4gTXkgYXBvbG9naWVzOiB5b3UgcmVhZCBhcyBh IHN1Z2dlc3Rpb24gd2hpY2ggSSB0aG91Z2h0IHdhcyBhDQo+IGRlc2NyaXB0aW9uLiBJIGRvbid0 IHRoaW5rIGl0IGhhcyB0byBjaGFuZ2UgYXQgYWxsLg0KW2FjbV0gDQoNClRoYW5rcyBmb3IgeW91 ciB2ZXJ5IGZhc3QgY2xhcmlmaWNhdGlvbiwgV2F0c29uIQ0KQWwNCg0KPiANCj4gPg0KPiA+IE9y Pw0KPiA+DQo+ID4gPg0KPiA+ID4gU2luY2VyZWx5LA0KPiA+ID4gV2F0c29uIExhZGQNCj4gPiA+ DQo+ID4NCj4gDQo+IA0KPiAtLQ0KPiAiTWFuIGlzIGJvcm4gZnJlZSwgYnV0IGV2ZXJ5d2hlcmUg aGUgaXMgaW4gY2hhaW5zIi4NCj4gLS1Sb3Vzc2VhdS4NCg== From nobody Sun Jun 28 16:54:52 2020 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D219B3A0FC5; Sun, 28 Jun 2020 16:54:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Steve Hanna via Datatracker To: Cc: draft-ietf-emu-eap-noob.all@ietf.org, emu@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.5.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159338848381.14481.6078519980317282415@ietfa.amsl.com> Reply-To: Steve Hanna Date: Sun, 28 Jun 2020 16:54:43 -0700 Archived-At: Subject: [secdir] Secdir early review of draft-ietf-emu-eap-noob-01 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 28 Jun 2020 23:54:44 -0000 Reviewer: Steve Hanna Review result: Not Ready Reviewer: Steve Hanna Review result: Not Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document defines a new EAP method for bootstrapping IoT devices. After reading the document, I have many questions: * Bootstrapping an IoT device involves many tasks that extend far beyond what is accomplished by EAP-NOOB: configuring the services that the device can/should employ within its new context (including how to reach and authenticate them), the networks and protocols that it should use and how it should obtain access to those networks, the access control policies that it should use (who is permitted to access the device and what operations can they perform), as well as many other configuration elements such as which lights a switch should control. The current document does not specify how such things are provisioned or even hint at this as an important problem. Without specifying such things, only a tiny part of the IoT device configuration problem has been solved. Perhaps another provisioning protocol could be used after EAP-NOOB but that protocol would need to be specified. With this extra step would come more complexity and user effort. Why not do this all with one protocol? * IoT device provisioning is not a new problem. In fact, it has been solved hundreds of times. Most of those solutions are proprietary but some standards efforts are ongoing now: IoTopia, FIDO IoT, Connected Home over IP, IP-BLiS, etc. Why ignore these? Why not reach out and try to help them? * This proposal assumes that the IoT device has a user interface (camera, screen, etc.). What about those that don’t? Many small IoT devices do not have a user interface of any sort or they only have a very primitive UI: a temperature sensor, motion detector, wall switch, light bulb, circuit breaker, etc. * Won’t this protocol apply to a relatively small subset of the networks that IoT devices will need to connect to? Few IoT networks run EAP. Mainly, EAP seems to be used in cellular networks and enterprise Ethernet and Wi-Fi networks. How will EAP-NOOB work in the Smart Home, where Wi-Fi is the most common network type and EAP is not used? * How will the device know which network to connect to, in the first place? At most locations, there are many wireless networks. Do you envision the user selecting from a list of Wi-Fi SSIDs and entering the network password with a touchscreen and keypad? What about the small IoT devices that don’t have a touchscreen and keypad? The server can’t help because the device is not yet connected to the network. * How will the user get OOB Output from the OOB sender to the OOB receiver? The specification doesn’t seem to As an IoT device maker, what am I supposed to put into the instructions? Ask your local network administrator what to do? * If the server indicates that it can handle peer-to-server OOB, what does that mean? Must the server have a camera? If so, what is it expected to scan and process? And if the peer prints out a page with a QR code, what should go into the code? The same questions apply to OOB implemented with audio, flashing LEDs, NFC, etc. In order to achieve interoperability, all of the details of these OOB methods would need to be specified exactly. The current specification includes no information like this. Without this information, multi-vendor interoperability is highly unlikely. Even if each OOB method was fully specified, consumers would still be frustrated if their server only supports QR codes and their device only supports NFC or audio. In my view, this protocol as currently specified is mainly of theoretical interest. I could not recommend that the IETF adopt it as an RFC as it would have almost no practical value. From nobody Sun Jun 28 18:43:52 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1F4393A101F; Sun, 28 Jun 2020 18:43:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c-Om2ah0NSdb; Sun, 28 Jun 2020 18:43:40 -0700 (PDT) Received: from tuna.sandelman.ca (tuna.sandelman.ca [209.87.249.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10A4B3A08B3; Sun, 28 Jun 2020 18:43:36 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by tuna.sandelman.ca (Postfix) with ESMTP id 6709538990; Sun, 28 Jun 2020 21:40:50 -0400 (EDT) Received: from tuna.sandelman.ca ([127.0.0.1]) by localhost (localhost [127.0.0.1]) (amavisd-new, port 10024) with LMTP id Po1o2pOtwi03; Sun, 28 Jun 2020 21:40:49 -0400 (EDT) Received: from sandelman.ca (obiwan.sandelman.ca [IPv6:2607:f0b0:f:2::247]) by tuna.sandelman.ca (Postfix) with ESMTP id A65803898E; Sun, 28 Jun 2020 21:40:49 -0400 (EDT) Received: from localhost (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id 03BEAF11; Sun, 28 Jun 2020 21:43:35 -0400 (EDT) From: Michael Richardson To: Steve Hanna , emu@ietf.org cc: secdir@ietf.org, draft-ietf-emu-eap-noob.all@ietf.org In-Reply-To: <159338848381.14481.6078519980317282415@ietfa.amsl.com> References: <159338848381.14481.6078519980317282415@ietfa.amsl.com> X-Mailer: MH-E 8.6+git; nmh 1.7+dev; GNU Emacs 26.1 X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m Archived-At: Subject: Re: [secdir] [Emu] Secdir early review of draft-ietf-emu-eap-noob-01 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jun 2020 01:43:42 -0000 --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Steve Hanna via Datatracker wrote: > Reviewer: Steve Hanna > Review result: Not Ready Steve thanks for the great review! I wanted to respond as an IoT onboarding expert and EMU WG member. > * Bootstrapping an IoT device involves many tasks that extend far bey= ond what > is accomplished by EAP-NOOB: configuring the services that the device > can/should employ within its new context (including how to reach and Hi, so your comments are well taken, but it's really an unreasonably high standard. While it is really important to get the configuration mechanisms in place, they are even more diverse than onboarding. That's an entire ocean of disagreement here. I would certainly love to get a handle on this. When it comes to standardization, really have to be very selective on how b= ig a thing to bite off. I think that we can incrementally get to this, but first we need some success with getting even one onboarding spec working. So I don't think it's reasonable to evaluate EAP-NOOB (or BRSKI-TEEP) by th= is critiera. > * IoT device provisioning is not a new problem. In fact, it has been = solved > hundreds of times. Most of those solutions are proprietary but some s= tandards > efforts are ongoing now: IoTopia, FIDO IoT, Connected Home over IP, I= P-BLiS, > etc. Why ignore these? Why not reach out and try to help them? Well, of those groups, many of them are completely pay-to-play fora, and do all of their work behind closed doors. In many cases, they look to the IETF for components, such as EAP-NOOB, BRSKI, etc. that they can incorporate into their designs. Some are actively hostile towards an an actual written standard, preferring that everyone license a particular software stack inst= ead. I think that EAP-NOOB has benefited greatly from academic and industrial re= view. > * This proposal assumes that the IoT device has a user interface (cam= era, > screen, etc.). What about those that don=E2=80=99t? Yup. Some don't, and you need to do something else. But, a lot of devices *do* have displays. Think about any industrial or hospital instrument. They all go "ping", and have a cool display to put a graph on :-) > * Won=E2=80=99t this protocol apply to a relatively small subset of t= he networks that > IoT devices will need to connect to? Few IoT networks run EAP. EAP is very popular in industrial and enterprise situations. EAP can be easily introduced into home network, with the Authentication Server running locally. Many have done this, and it is supported in Openwr= t today. > * How will the device know which network to connect to, in the first > place? This is a good question, and I can offer no answer for the EAP-NOOB case, a= nd I leave it to the authors to respond to your other comments. =2D- ] Never tell me the odds! | ipv6 mesh network= s [ ] Michael Richardson, Sandelman Software Works | IoT architect = [ ] mcr@sandelman.ca http://www.sandelman.ca/ | ruby on rails = [ =2D- Michael Richardson , Sandelman Software Works -=3D IPv6 IoT consulting =3D- --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEbsyLEzg/qUTA43uogItw+93Q3WUFAl75R0YACgkQgItw+93Q 3WVSEwf/XLh1lMokJI+hi4FnrGCmPuvPtjB+QwHROA4aFFuQ6DoVOxIKHuis09Gx VNnfet2f9fKf6FilZ2F9mUXEB3yLfb4gsQyytdiINOS6TWoxnxzmQGHhXIioqlLD vG9YuZQ/2LVDmZIwAFBjem6RV5W6dDn8Ktydvfv8g7kBHD+adyGaxswS1hzJXLe7 /K21MGOjF0Dg7ZApRbkMMYsAeVuLhNa3OFLVn/k+/eor7r4+bXS2LCPl/+qTUOf3 8GjgEUkgYeKkfNGXokLE72SbPeIULwQqNKTj8R02xxMTtWY7KVYBR5caTWEH+BSU 8WFTo32gf/rHFZzG3em9Ed4g7e45cg== =SaKs -----END PGP SIGNATURE----- --=-=-=-- From nobody Mon Jun 29 06:44:04 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F22E93A0EEF; Mon, 29 Jun 2020 06:43:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3cd3wIO5oKv8; Mon, 29 Jun 2020 06:43:53 -0700 (PDT) Received: from cnet.fi.uba.ar (cnet.fi.uba.ar [157.92.58.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D563C3A0EEE; Mon, 29 Jun 2020 06:43:52 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by cnet.fi.uba.ar (Postfix) with ESMTP id 396C6140077; Mon, 29 Jun 2020 10:43:48 -0300 (ART) X-Virus-Scanned: Debian amavisd-new at cnet.fi.uba.ar Received: from cnet.fi.uba.ar ([127.0.0.1]) by localhost (cnet.fi.uba.ar [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TTz2cGTfPF5s; Mon, 29 Jun 2020 10:43:37 -0300 (ART) Received: from [192.168.1.34] (unknown [181.27.208.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by cnet.fi.uba.ar (Postfix) with ESMTPSA id 96240140068; Mon, 29 Jun 2020 10:43:37 -0300 (ART) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) From: J Ignacio Alvarez-Hamelin In-Reply-To: Date: Mon, 29 Jun 2020 10:43:39 -0300 Cc: "MORTON, ALFRED C (AL)" , "draft-ietf-ippm-route.all@ietf.org" , "last-call@ietf.org" , "ippm@ietf.org" , "secdir@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <9E3E3976-499B-4362-950A-1BB95A7ED68D@cnet.fi.uba.ar> References: <159326696737.10306.5653213903966509356@ietfa.amsl.com> <4D7F4AD313D3FC43A053B309F97543CF0108A69B10@njmtexg5.research.att.com> To: Watson Ladd X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [secdir] [ippm] Secdir last call review of draft-ietf-ippm-route-08 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jun 2020 13:43:55 -0000 Dear Watson, Thank you for your review. Concerning the security considerations, this = method does not introduce new security problems, basically because it = does not create any new field or option into packets. Eventually, we can = imagine some man in the middle, changing some bits into the packet, but = this kind of behavior does not affect the network. I think it can affect = one measurement for a particular hop where he/she is intercepting, but = this case is similar to any traffic; therefore, I do not see any = potential problem.=20 Are you visualized another security problem?=20 Regards, J. Igancio _______________________________________________________________ Dr. Ing. Jos=C3=A9 Ignacio Alvarez-Hamelin CONICET and Facultad de Ingenier=C3=ADa, Universidad de Buenos Aires Av. Paseo Col=C3=B3n 850 - C1063ACV - Buenos Aires - Argentina +54 (11) 5285 0716 / 5285 0705 e-mail: ihameli@cnet.fi.uba.ar web: http://cnet.fi.uba.ar/ignacio.alvarez-hamelin/ _______________________________________________________________ > On 28 Jun 2020, at 13:04, Watson Ladd wrote: >=20 > On Sun, Jun 28, 2020 at 11:55 AM MORTON, ALFRED C (AL) > wrote: > >>=20 >>>=20 >>> Now for the meat: what about the security considerations? Since this = draft is >>> describing enhancements to traceroute and ways to describe the = measurements >>> taken by such enhanced traceroutes, the security impact is minimal = and the >>> authors reference the existing RFCs describing the security impacts = of >>> tracroutes on networks. >> [acm] >> I'm looking for the action implied in your comment. Do we add the = sentences: >>=20 >> This draft describes enhancements to traceroute and ways to describe = the measurements taken by such enhanced traceroute tools. The security = impact is minimal and the authors reference the existing RFCs describing = the security impacts of active and hybrid measurements on networks (of = which traceroute measurements are a subset) below. >=20 > My apologies: you read as a suggestion which I thought was a > description. I don't think it has to change at all. >=20 >>=20 >> Or? >>=20 >>>=20 >>> Sincerely, >>> Watson Ladd >>>=20 >>=20 >=20 >=20 > --=20 > "Man is born free, but everywhere he is in chains". > --Rousseau. >=20 > _______________________________________________ > ippm mailing list > ippm@ietf.org > https://www.ietf.org/mailman/listinfo/ippm From nobody Mon Jun 29 13:19:47 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 486E43A087D; Mon, 29 Jun 2020 13:19:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.696 X-Spam-Level: X-Spam-Status: No, score=-0.696 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_COMMENT_SAVED_URL=1.391, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_HTML_ATTACH=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6j8CrHkM31Q4; Mon, 29 Jun 2020 13:19:32 -0700 (PDT) Received: from mail-lj1-x22b.google.com (mail-lj1-x22b.google.com [IPv6:2a00:1450:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 522A13A087C; Mon, 29 Jun 2020 13:19:31 -0700 (PDT) Received: by mail-lj1-x22b.google.com with SMTP id f5so3851939ljj.10; Mon, 29 Jun 2020 13:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jSTwFG4gENTuSoYc3yg+iwSvtpa4L7LlpPLJyneDqRE=; b=ZzCoZCuvt3Y+IWoYD88edo+7yF+6pK6E1vAa5+N7k/Dn8d3Sfc/HgZskAgkdTlsvwj 3dCfzIzY5EegZGAHFQ953lRGGJ/hDpjEIQEbTzwPR1QuLN5IwE1lzhK18x+gUV1+ARYg It7E7UpWizqNcizvmnnVmkOKHqc5HkBwbDzkkUf3na+cvaIPxA2vYMbIYwi7ed7tlTu2 +t6WDQNwSanUwNQaKPri9OYxvYJvKDDDG72BN5K5ykqI74B+ijAJR44adSWctbXKKyxw ng/qs+9HPFx/NZ37wXh5WjfC0/5dZuVONdBL/VxdRmRRtsZPhTWnzW4/sTg+R8H+W/dG bYhA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jSTwFG4gENTuSoYc3yg+iwSvtpa4L7LlpPLJyneDqRE=; b=JU/eQ73QpLSkB/4kkhVbISaDgfpom33Ks8QKjn6ZFajhMq67jGYNZiJv+NGDE9KaZw SyZajhJxkL6hRdWhVnOo1h/yHWGSAgYZzZZHMqBBxnMe5ssPfueIo/rIFaiZSHvaxsJT Af0kpSVidepSJHd30Ghz3f3I+f69PMqZaFJDTPZ5VFx/cj3BcEkwNC/8vUNlwbB51q7B 6DEhIWrWAjUyN1Z7l+eOm0xrsozV/xkM8HDYQbYZN5UGIZTyc3N4L/g25xmanjqtybEK BJvy08QE2sHra638C49V/ojEvV+1HFz8WyzSPi9BGuPj4omFD7XYXZEcm07qtkcs3d97 2wng== X-Gm-Message-State: AOAM531RXSWFwBxSqSm9Q4+TYrZ+GLb2dOcmRdLLz1/OSpx0r1XrQ+60 CVzRqaNnr5nmURk+XmD0L9xNDa+lkuyRCifGwY4= X-Google-Smtp-Source: ABdhPJxLqi7iShq7+V9bM5/1pc6zmnUa42jVy0TciDXAGif4h/fzuGOk3frzGAvAQFk03eCeghTUicIH0q9Ft29nrXY= X-Received: by 2002:a2e:7804:: with SMTP id t4mr8990599ljc.8.1593461969082; Mon, 29 Jun 2020 13:19:29 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Greg Mirsky Date: Mon, 29 Jun 2020 13:19:18 -0700 Message-ID: To: Charlie Kaufman Cc: "secdir@ietf.org" , "iesg@ietf.org" , "draft-ietf-ippm-stamp-option-tlv.all@ietf.org" Content-Type: multipart/mixed; boundary="000000000000a26e9f05a93ec681" Archived-At: Subject: Re: [secdir] Secdir review of draft-ietf-ippm-stamp-option-tlv-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jun 2020 20:19:41 -0000 --000000000000a26e9f05a93ec681 Content-Type: multipart/alternative; boundary="000000000000a26e9c05a93ec67f" --000000000000a26e9c05a93ec67f Content-Type: text/plain; charset="UTF-8" Hi Charlie, thank you for your thorough review, detailed questions, and thoughtful suggestions. We've discussed your comments and propose changes that are described below. Also, you can find the changes highlighted in the attached diff between the -06 and the new working version of the document. Please find my answers, notes in-line below under the GIM>> tag. Regards, Greg On Fri, Jun 26, 2020 at 10:34 PM Charlie Kaufman wrote: > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the IESG. > These comments were written primarily for the benefit of the security area > directors. Document editors and WG chairs should treat these comments just > like any other last call comments. > > This I-D specifies extensions to the STAMP protocol defined in RFC 8762. > The STAMP protocol runs over UDP and is similar to an "echo" protocol > intended to be used to test network speed and bandwidth. This I-D specifies > a series of TLV encoded extensions that can be appended to the end of the > UDP packets of the STAMP protocol (as well as defining the TLV mechanism > itself). > > I could not find anything objectionable from a security standpoint in this > extension mechanism. It is a bit odd that when extensions are added to an > HMAC protected packet, instead of adding the extensions before the HMAC and > having the HMAC protect the entire contents, they keep the existing HMAC > that protects the base packet and add a second HMAC at the end of the > extensions that protects only the extensions. This would potentially allow > an attacker to "mix and match" the extensions from one packet with the base > content of a different packet, but it's not clear what an attacker might be > able to gain by doing that. > GIM>> I think that the STAMP YANG data model could be used to minimize the possible attack vector you've described. We will certainly keep that as one of the objectives when updating draft-ietf-ippm-stamp-yang . Also, HMAC TLV might be required even in unauthenticated STAMP mode to protect the integrity on a certain TLV(s). Do you see this as a useful scenario or unnecessary feature? > > One of the pieces of information an extension can request is the 6 byte > MAC address of the incoming packet as seen by the peer (which will normally > by the MAC address of the last router on the path). That information is not > normally available to someone on a distant network, but it's not obvious > what harm could come from their knowing it. > GIM>> As mentioned above, HMAC TLV may follow some STAMP TLVs. Do you think that the document should recommend using HMAC TLV with the Location TLV? > > The protocol can also request the source and destination IP addresses as > seen by the peer (presumably to detect NAT gateways), but the protocol > assumes the originator will know whether the peer will see IPv4 or IPv6 > addresses, so dealing with 6-to-4 gateways could be tricky. > > On page 19 table 2, this document asks IANA to assign extension type > codes. In all other documents of this sort that I have seen, the document > assigns the codes and asks IANA to track subsequent additions. > GIM>> Martin Duke, the Responsible AD for IPPM WG, asked this question in his review. He has agreed to leave the text as-is since no one asked for a particular number. > > On some kinds of errors, the protocol specifies that the error is reported > via and ICMP message. For others, it specifies that a field be returned > containing all zeros. It's probably better to report errors "in band" > because so many routers swallow ICMP messages. The spec does not - and > should - specify what to do if the length of the TLV coded extensions does > not match the length of the UDP packet containing them (or at least I > couldn't find where it was specified). > GIM>> Thank you for pointing out this awkward handling. We had continued discussion with Martin Duke and Rakesh Gandhi on improving the mechanism of reporting TLV errors. The discussion is in the updated Section 4 of the new working version and is copied below: 4. TLV Extensions to STAMP Type-Length-Value (TLV) encoding scheme provides a flexible extension mechanism for optional informational elements. TLV is an optional field in the STAMP test packet. Multiple TLVs MAY be placed in the STAMP test packet. A TLV MAY be enclosed in a TLV. TLVs have the two octets long Type field, two octets long Length field that is equal to the length of the Value field in octets. If a Type value for TLV or sub-TLV is in the range for Vendor Private Use, the Length MUST be at least 4, and the first four octets MUST be that vendor's the Structure of Management Information (SMI) Private Enterprise Codes, as recorded in IANA's SMI Private Enterprise Codes sub- registry, in network octet order. The rest of the Value field is private to the vendor. The following sections describe the use of TLVs for STAMP that extends STAMP capability beyond its base specification. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |U|L|R|R|R|R|R|R| Type | Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ~ Value ~ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 5: TLV Format in a STAMP Extended Packet where fields are defined as the following: o U - a one-bit flag, located as specified in Section 5.2. A Session-Sender MUST set the U flag to 0 before transmitting an extended STAMP test packet. A Session-Reflector MUST set the U flag to 1 if the Session-Reflector has not understood the TLV. o L - a one-bit flag, located as specified in Section 5.2. A Session-Sender MUST set the L flag to 0 before transmitting an extended STAMP test packet. A Session-Reflector MUST set the L flag to 1 if the Session-Reflector determined the TLV is malformed, i.e., the Length field value of the fixed-size TLV is not equal to the value defined for the particular type, or the remaining length of the extended STAMP packet is less than the size of the TLV. o R - reserved flags for future use. These flags MUST be zeroed on transmit and ignored on receipt. o Type - one-octet long field that characterizes the interpretation of the Value field. It is allocated by IANA, as specified in Section 5.1 o Length - two-octets long field equals length on the Value field in octets. o Value - a variable-length field. Its interpretation and encoding determined by the value of the Type field. A STAMP node, whether Session-Sender or Session-Reflector, receiving a test packet MUST determine whether the packet is a base STAMP packet or includes one or more TLVs. The node MUST compare the value in the Length field of the UDP header and the length of the base STAMP test packet in the mode, unauthenticated or authenticated based on the configuration of the particular STAMP test session. If the difference between the two values is larger than the length of UDP header, then the test packet includes one or more STAMP TLVs that immediately follow the base STAMP test packet. A system that has received a STAMP test packet with extension TLVs MUST validate each TLV: if the U flag is set, the STAMP system MUST skip the processing of the TLV. The implementation MUST try to process the next TLV if present in the extended STAMP packet. if the L flag is set, the STAMP system MUST stop processing the remainder of the extended STAMP packet. if an implementation of a Session-Reflector does not recognize the Type field value, it MUST include the copy of the TLV into the reflected STAMP packet. The Session-Reflector MUST set the U flag to 1. The Session-Reflector MUST try to process the next TLV in the extended STAMP packet; if a TLV is malformed, the processing of extension TLVs MUST be stopped. The Session-Reflector MUST copy the remainder of the received extended STAMP packet into the reflected STAMP packet. The Session-Reflector MUST set the L flag to 1. Detected error events MUST be logged. Note that rate of logging MUST be controlled. Please note, that IANA is also requested to create a STAMP TLV Flags sub-registry. We hope this is an acceptable solution. Always welcome your questions, comments, and suggestions. > --Charlie > --000000000000a26e9c05a93ec67f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Charlie,
thank you for your thorou= gh review, detailed questions, and thoughtful=C2=A0suggestions. We've d= iscussed your comments and propose changes that are described below. Also, = you can find the changes highlighted in the attached diff between the -06 a= nd the new working version of the document. Please find my answers, notes i= n-line below under the GIM>> tag.

Regards,
Greg

On Fri, Jun 26, 2020 at 10:34 PM Charlie Kaufman <charliekaufman@outlook.com&g= t; wrote:
I have reviewed this document as part of the security directorate'= ;s ongoing effort to review all IETF documents being processed by the IESG.= =C2=A0 These comments were written primarily for the benefit of the securit= y area directors.=C2=A0 Document editors and WG chairs should treat these comments just like any other last call comments.=

This I-D specifies extensions to the STAMP protocol defined in RFC 876= 2. The STAMP protocol runs over UDP and is similar to an "echo" p= rotocol intended to be used to test network speed and bandwidth. This I-D s= pecifies a series of TLV encoded extensions that can be appended to the end of the UDP packets of the STAMP protocol (= as well as defining the TLV mechanism itself).

I could not find anything objectionable from a security standpoint in = this extension mechanism. It is a bit odd that when extensions are added to= an HMAC protected packet, instead of adding the extensions before the HMAC= and having the HMAC protect the entire contents, they keep the existing HMAC that protects the base packet= and add a second HMAC at the end of the extensions that protects only the = extensions. This would potentially allow an attacker to "mix and match= " the extensions from one packet with the base content of a different packet, but it's not clear what an att= acker might be able to gain by doing that.
GIM>> I think that the STAMP YANG data model could be used to = minimize the possible attack vector you've described. We will certainly= keep that as one of the objectives when updating draft-ietf-ippm-stamp-yang<= /a>.=C2=A0Also, HMAC TLV might be required even in unauthenticated STAMP mo= de to protect the integrity on a certain TLV(s). Do you see this as a usefu= l scenario or unnecessary feature?

The protocol can also request the source and destination IP addresses = as seen by the peer (presumably to detect NAT gateways), but the protocol a= ssumes the originator will know whether the peer will see IPv4 or IPv6 addr= esses, so dealing with 6-to-4 gateways could be tricky.

On page 19 table 2, this document asks IANA to assign extension type c= odes. In all other documents of this sort that I have seen, the document as= signs the codes and asks IANA to track subsequent additions.
4.=C2=A0 TLV Extensions to STAMP

=C2=A0 =C2=A0Type-Le= ngth-Value (TLV) encoding scheme provides a flexible extension
=C2=A0 = =C2=A0mechanism for optional informational elements.=C2=A0 TLV is an option= al
=C2=A0 =C2=A0field in the STAMP test packet.=C2=A0 Multiple TLVs MAY = be placed in the
=C2=A0 =C2=A0STAMP test packet.=C2=A0 A TLV MAY be encl= osed in a TLV.=C2=A0 TLVs have the
=C2=A0 =C2=A0two octets long Type fie= ld, two octets long Length field that is
=C2=A0 =C2=A0equal to the lengt= h of the Value field in octets.=C2=A0 If a Type value
=C2=A0 =C2=A0for T= LV or sub-TLV is in the range for Vendor Private Use, the Length
=C2=A0 = =C2=A0MUST be at least 4, and the first four octets MUST be that vendor'= ;s
=C2=A0 =C2=A0the Structure of Management Information (SMI) Private En= terprise
=C2=A0 =C2=A0Codes, as recorded in IANA's SMI Private Enter= prise Codes sub-
=C2=A0 =C2=A0registry, in network octet order.=C2=A0 Th= e rest of the Value field is
=C2=A0 =C2=A0private to the vendor.=C2=A0 T= he following sections describe the use of
=C2=A0 =C2=A0TLVs for STAMP th= at extends STAMP capability beyond its base
=C2=A0 =C2=A0specification.<= br>
=C2=A0 =C2=A0 =C2=A0 =C2=A00 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 1 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 2 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 3
=C2=A0 =C2=A0 =C2=A0 =C2=A00 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 = 8 9 0 1 2 3 4 5 6 7 8 9 0 1
=C2=A0 =C2=A0 =C2=A0 +-+-+-+-+-+-+-+-+-+-+-+= -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
=C2=A0 =C2=A0 =C2=A0 |U|L|R|R= |R|R|R|R| =C2=A0 =C2=A0 Type =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 Length =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0|
=C2= =A0 =C2=A0 =C2=A0 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+= -+-+-+-+
=C2=A0 =C2=A0 =C2=A0 ~ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Value =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0~
=C2=A0 =C2=A0 =C2=A0 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+= -+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 Figure 5: TLV Format in a STAMP Extended Packet

= =C2=A0 =C2=A0where fields are defined as the following:

=C2=A0 =C2= =A0o =C2=A0U - a one-bit flag, located as specified in Section 5.2. =C2=A0A=
=C2=A0 =C2=A0 =C2=A0 Session-Sender MUST set the U flag to 0 before tra= nsmitting an
=C2=A0 =C2=A0 =C2=A0 extended STAMP test packet.=C2=A0 A Se= ssion-Reflector MUST set the U
=C2=A0 =C2=A0 =C2=A0 flag to 1 if the Ses= sion-Reflector has not understood the TLV.

=C2=A0 =C2=A0o =C2=A0L - = a one-bit flag, located as specified in Section 5.2. =C2=A0A
=C2=A0 =C2= =A0 =C2=A0 Session-Sender MUST set the L flag to 0 before transmitting an=C2=A0 =C2=A0 =C2=A0 extended STAMP test packet.=C2=A0 A Session-Reflecto= r MUST set the L
=C2=A0 =C2=A0 =C2=A0 flag to 1 if the Session-Reflector= determined the TLV is
=C2=A0 =C2=A0 =C2=A0 malformed, i.e., the Length = field value of the fixed-size TLV is
=C2=A0 =C2=A0 =C2=A0 not equal to t= he value defined for the particular type, or the
=C2=A0 =C2=A0 =C2=A0 re= maining length of the extended STAMP packet is less than the
=C2=A0 =C2= =A0 =C2=A0 size of the TLV.

=C2=A0 =C2=A0o =C2=A0R - reserved flags = for future use.=C2=A0 These flags MUST be zeroed on
=C2=A0 =C2=A0 =C2=A0= transmit and ignored on receipt.

=C2=A0 =C2=A0o =C2=A0Type - one-oc= tet long field that characterizes the interpretation
=C2=A0 =C2=A0 =C2= =A0 of the Value field.=C2=A0 It is allocated by IANA, as specified in
= =C2=A0 =C2=A0 =C2=A0 Section 5.1

=C2=A0 =C2=A0o =C2=A0Length - two-o= ctets long field equals length on the Value field in
=C2=A0 =C2=A0 =C2= =A0 octets.

=C2=A0 =C2=A0o =C2=A0Value - a variable-length field.=C2= =A0 Its interpretation and encoding
=C2=A0 =C2=A0 =C2=A0 determined by t= he value of the Type field.

=C2=A0 =C2=A0A STAMP node, whether Sessi= on-Sender or Session-Reflector, receiving
=C2=A0 =C2=A0a test packet MUS= T determine whether the packet is a base STAMP
=C2=A0 =C2=A0packet or in= cludes one or more TLVs.=C2=A0 The node MUST compare the value
=C2=A0 = =C2=A0in the Length field of the UDP header and the length of the base
= =C2=A0 =C2=A0STAMP test packet in the mode, unauthenticated or authenticate= d based
=C2=A0 =C2=A0on the configuration of the particular STAMP test s= ession.=C2=A0 If the
=C2=A0 =C2=A0difference between the two values is l= arger than the length of UDP
=C2=A0 =C2=A0header, then the test packet i= ncludes one or more STAMP TLVs that
=C2=A0 =C2=A0immediately follow the = base STAMP test packet.

=C2=A0 =C2=A0A system that has receiv= ed a STAMP test packet with extension TLVs
=C2=A0 =C2=A0MUST validate ea= ch TLV:

=C2=A0 =C2=A0 =C2=A0 if the U flag is set, the STAMP system = MUST skip the processing of
=C2=A0 =C2=A0 =C2=A0 the TLV.=C2=A0 The impl= ementation MUST try to process the next TLV if
=C2=A0 =C2=A0 =C2=A0 pres= ent in the extended STAMP packet.

=C2=A0 =C2=A0 =C2=A0 if the L flag= is set, the STAMP system MUST stop processing the
=C2=A0 =C2=A0 =C2=A0 = remainder of the extended STAMP packet.

=C2=A0 =C2=A0 =C2=A0 if an i= mplementation of a Session-Reflector does not recognize the
=C2=A0 =C2= =A0 =C2=A0 Type field value, it MUST include the copy of the TLV into the=C2=A0 =C2=A0 =C2=A0 reflected STAMP packet.=C2=A0 The Session-Reflector = MUST set the U flag
=C2=A0 =C2=A0 =C2=A0 to 1.=C2=A0 The Session-Reflect= or MUST try to process the next TLV in
=C2=A0 =C2=A0 =C2=A0 the extended= STAMP packet;

=C2=A0 =C2=A0 =C2=A0 if a TLV is malformed, the proce= ssing of extension TLVs MUST be
=C2=A0 =C2=A0 =C2=A0 stopped.=C2=A0 The = Session-Reflector MUST copy the remainder of the
=C2=A0 =C2=A0 =C2=A0 re= ceived extended STAMP packet into the reflected STAMP packet.
=C2=A0 =C2= =A0 =C2=A0 The Session-Reflector MUST set the L flag to 1.

=C2=A0 = =C2=A0Detected error events MUST be logged.=C2=A0 Note that rate of logging= MUST
=C2=A0 =C2=A0be controlled.

--000000000000a26e9c05a93ec67f-- --000000000000a26e9f05a93ec681 Content-Type: text/plain; charset="US-ASCII"; name="draft-ietf-ippm-stamp-option-tlv-07.txt" Content-Disposition: attachment; filename="draft-ietf-ippm-stamp-option-tlv-07.txt" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kc0y3ika0 CgoKCk5ldHdvcmsgV29ya2luZyBHcm91cCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIEcuIE1pcnNreQpJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYLiBNaW4KVXBkYXRlczogODc2MiAoaWYgYXBw cm92ZWQpICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlRFIENvcnAuCkludGVu ZGVkIHN0YXR1czogU3RhbmRhcmRzIFRyYWNrICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IEguIE55ZGVsbApFeHBpcmVzOiBEZWNlbWJlciAzMSwgMjAyMCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgQWNjZWRpYW4gTmV0d29ya3MKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFIuIEZvb3RlCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBOb2tp YQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgQS4gTWFzcHV0cmEKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICBBcHBsZSBJbmMuCiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgRS4gUnVmZmluaQogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBPdXRTeXMKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBKdW5lIDI5LCAyMDIwCgoKICAgICBTaW1wbGUgVHdvLXdheSBBY3RpdmUgTWVh c3VyZW1lbnQgUHJvdG9jb2wgT3B0aW9uYWwgRXh0ZW5zaW9ucwogICAgICAgICAgICAgICAgICBk cmFmdC1pZXRmLWlwcG0tc3RhbXAtb3B0aW9uLXRsdi0wNwoKQWJzdHJhY3QKCiAgIFRoaXMgZG9j dW1lbnQgZGVzY3JpYmVzIG9wdGlvbmFsIGV4dGVuc2lvbnMgdG8gU2ltcGxlIFR3by13YXkgQWN0 aXZlCiAgIE1lYXN1cmVtZW50IFByb3RvY29sIChTVEFNUCkgd2hpY2ggZW5hYmxlIG1lYXN1cmVt ZW50IHBlcmZvcm1hbmNlCiAgIG1ldHJpY3MgaW4gYWRkaXRpb24gdG8gb25lcyBzdXBwb3J0ZWQg YnkgdGhlIFNUQU1QIGJhc2UKICAgc3BlY2lmaWNhdGlvbi4gIFRoZSBkb2N1bWVudCBhbHNvIGRl ZmluZXMgYSBTVEFNUCBUZXN0IFNlc3Npb24KICAgSWRlbnRpZmllciBhbmQgdGh1cyB1cGRhdGVz IFJGQyA4NzYyLgoKU3RhdHVzIG9mIFRoaXMgTWVtbwoKICAgVGhpcyBJbnRlcm5ldC1EcmFmdCBp cyBzdWJtaXR0ZWQgaW4gZnVsbCBjb25mb3JtYW5jZSB3aXRoIHRoZQogICBwcm92aXNpb25zIG9m IEJDUCA3OCBhbmQgQkNQIDc5LgoKICAgSW50ZXJuZXQtRHJhZnRzIGFyZSB3b3JraW5nIGRvY3Vt ZW50cyBvZiB0aGUgSW50ZXJuZXQgRW5naW5lZXJpbmcKICAgVGFzayBGb3JjZSAoSUVURikuICBO b3RlIHRoYXQgb3RoZXIgZ3JvdXBzIG1heSBhbHNvIGRpc3RyaWJ1dGUKICAgd29ya2luZyBkb2N1 bWVudHMgYXMgSW50ZXJuZXQtRHJhZnRzLiAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC0K ICAgRHJhZnRzIGlzIGF0IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZHJhZnRzL2N1cnJl bnQvLgoKICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMgdmFsaWQgZm9yIGEg bWF4aW11bSBvZiBzaXggbW9udGhzCiAgIGFuZCBtYXkgYmUgdXBkYXRlZCwgcmVwbGFjZWQsIG9y IG9ic29sZXRlZCBieSBvdGhlciBkb2N1bWVudHMgYXQgYW55CiAgIHRpbWUuICBJdCBpcyBpbmFw cHJvcHJpYXRlIHRvIHVzZSBJbnRlcm5ldC1EcmFmdHMgYXMgcmVmZXJlbmNlCiAgIG1hdGVyaWFs IG9yIHRvIGNpdGUgdGhlbSBvdGhlciB0aGFuIGFzICJ3b3JrIGluIHByb2dyZXNzLiIKCiAgIFRo aXMgSW50ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gRGVjZW1iZXIgMzEsIDIwMjAuCgpDb3B5 cmlnaHQgTm90aWNlCgogICBDb3B5cmlnaHQgKGMpIDIwMjAgSUVURiBUcnVzdCBhbmQgdGhlIHBl cnNvbnMgaWRlbnRpZmllZCBhcyB0aGUKICAgZG9jdW1lbnQgYXV0aG9ycy4gIEFsbCByaWdodHMg cmVzZXJ2ZWQuCgoKCgoKTWlyc2t5LCBldCBhbC4gICAgICAgICAgRXhwaXJlcyBEZWNlbWJlciAz MSwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDFdCgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAg ICAgIFNUQU1QIEV4dGVuc2lvbnMgICAgICAgICAgICAgICAgICAgSnVuZSAyMDIwCgoKICAgVGhp cyBkb2N1bWVudCBpcyBzdWJqZWN0IHRvIEJDUCA3OCBhbmQgdGhlIElFVEYgVHJ1c3QncyBMZWdh bAogICBQcm92aXNpb25zIFJlbGF0aW5nIHRvIElFVEYgRG9jdW1lbnRzCiAgIChodHRwczovL3Ry dXN0ZWUuaWV0Zi5vcmcvbGljZW5zZS1pbmZvKSBpbiBlZmZlY3Qgb24gdGhlIGRhdGUgb2YKICAg cHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVudC4gIFBsZWFzZSByZXZpZXcgdGhlc2UgZG9jdW1l bnRzCiAgIGNhcmVmdWxseSwgYXMgdGhleSBkZXNjcmliZSB5b3VyIHJpZ2h0cyBhbmQgcmVzdHJp Y3Rpb25zIHdpdGggcmVzcGVjdAogICB0byB0aGlzIGRvY3VtZW50LiAgQ29kZSBDb21wb25lbnRz IGV4dHJhY3RlZCBmcm9tIHRoaXMgZG9jdW1lbnQgbXVzdAogICBpbmNsdWRlIFNpbXBsaWZpZWQg QlNEIExpY2Vuc2UgdGV4dCBhcyBkZXNjcmliZWQgaW4gU2VjdGlvbiA0LmUgb2YKICAgdGhlIFRy dXN0IExlZ2FsIFByb3Zpc2lvbnMgYW5kIGFyZSBwcm92aWRlZCB3aXRob3V0IHdhcnJhbnR5IGFz CiAgIGRlc2NyaWJlZCBpbiB0aGUgU2ltcGxpZmllZCBCU0QgTGljZW5zZS4KClRhYmxlIG9mIENv bnRlbnRzCgogICAxLiAgSW50cm9kdWN0aW9uICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgIDIKICAgMi4gIENvbnZlbnRpb25zIFVzZWQgaW4gVGhpcyBE b2N1bWVudCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAzCiAgICAgMi4xLiAgQWNyb255 bXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgMwog ICAgIDIuMi4gIFJlcXVpcmVtZW50cyBMYW5ndWFnZSAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgIDMKICAgMy4gIFNUQU1QIFRlc3QgU2Vzc2lvbiBJZGVudGlmaWVyIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA0CiAgIDQuICBUTFYgRXh0ZW5zaW9ucyB0byBT VEFNUCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAgOAogICAgIDQuMS4g IEV4dHJhIFBhZGRpbmcgVExWIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgMTAKICAgICA0LjIuICBMb2NhdGlvbiBUTFYgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gIDExCiAgICAgNC4zLiAgVGltZXN0YW1wIEluZm9ybWF0aW9uIFRM ViAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxMgogICAgIDQuNC4gIENsYXNzIG9m IFNlcnZpY2UgVExWICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTMKICAg ICA0LjUuICBEaXJlY3QgTWVhc3VyZW1lbnQgVExWICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gIDE0CiAgICAgNC42LiAgQWNjZXNzIFJlcG9ydCBUTFYgLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxNQogICAgIDQuNy4gIEZvbGxvdy11cCBUZWxlbWV0 cnkgVExWIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMTcKICAgICA0LjguICBI TUFDIFRMViAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g IDE4CiAgIDUuICBJQU5BIENvbnNpZGVyYXRpb25zIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICAyMAogICAgIDUuMS4gIFNUQU1QIFRMViBSZWdpc3RyeSAgLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMjAKICAgICA1LjIuICBTVEFNUCBUTFYg RmxhZ3MgU3ViLXJlZ2lzdHJ5ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDIwCiAgICAg NS4zLiAgU3luY2hyb25pemF0aW9uIFNvdXJjZSBTdWItcmVnaXN0cnkgLiAuIC4gLiAuIC4gLiAu IC4gLiAuICAyMQogICAgIDUuNC4gIFRpbWVzdGFtcGluZyBNZXRob2QgU3ViLXJlZ2lzdHJ5ICAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMjIKICAgICA1LjUuICBSZXR1cm4gQ29kZSBTdWItcmVn aXN0cnkgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDIzCiAgIDYuICBTZWN1cml0 eSBDb25zaWRlcmF0aW9ucyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAy MwogICA3LiAgQWNrbm93bGVkZ21lbnRzIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgMjMKICAgOC4gIENvbnRyaWJ1dG9ycyAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDI0CiAgIDkuICBSZWZlcmVuY2VzICAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAyNAogICAgIDku MS4gIE5vcm1hdGl2ZSBSZWZlcmVuY2VzICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAgMjQKICAgICA5LjIuICBJbmZvcm1hdGl2ZSBSZWZlcmVuY2VzICAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gIDI1CiAgIEF1dGhvcnMnIEFkZHJlc3NlcyAgLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAyNQoKMS4gIEludHJvZHVjdGlv bgoKICAgU2ltcGxlIFR3by13YXkgQWN0aXZlIE1lYXN1cmVtZW50IFByb3RvY29sIChTVEFNUCkg W1JGQzg3NjJdIHN1cHBvcnRzCiAgIHRoZSB1c2Ugb2Ygb3B0aW9uYWwgZXh0ZW5zaW9ucyB0aGF0 IHVzZSBUeXBlLUxlbmd0aC1WYWx1ZSAoVExWKQogICBlbmNvZGluZy4gIFN1Y2ggZXh0ZW5zaW9u cyBlbmhhbmNlIHRoZSBTVEFNUCBiYXNlIGZ1bmN0aW9ucywgc3VjaCBhcwogICBtZWFzdXJlbWVu dCBvZiBvbmUtd2F5IGFuZCByb3VuZC10cmlwIGRlbGF5LCBsYXRlbmN5LCBwYWNrZXQgbG9zcywK ICAgYW5kIHRoZSBhYmlsaXR5IHRvIGRldGVjdCBwYWNrZXQgZHVwbGljYXRpb24gYW5kIG91dC1v Zi1vcmRlcgogICBkZWxpdmVyeSBvZiB0aGUgdGVzdCBwYWNrZXRzLiAgVGhpcyBzcGVjaWZpY2F0 aW9uIGRlZmluZXMgb3B0aW9uYWwKCgoKTWlyc2t5LCBldCBhbC4gICAgICAgICAgRXhwaXJlcyBE ZWNlbWJlciAzMSwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDJdCgwKSW50ZXJuZXQtRHJhZnQg ICAgICAgICAgICAgIFNUQU1QIEV4dGVuc2lvbnMgICAgICAgICAgICAgICAgICAgSnVuZSAyMDIw CgoKICAgU1RBTVAgZXh0ZW5zaW9ucywgdGhlaXIgZm9ybWF0cywgYW5kIHRoZSB0aGVvcnkgb2Yg b3BlcmF0aW9uLiAgQWxzbywKICAgYSBTVEFNUCBUZXN0IFNlc3Npb24gSWRlbnRpZmllciBpcyBk ZWZpbmVkIGFzIGFuIHVwZGF0ZSBvZiB0aGUgYmFzZQogICBTVEFNUCBzcGVjaWZpY2F0aW9uIFtS RkM4NzYyXS4KCjIuICBDb252ZW50aW9ucyBVc2VkIGluIFRoaXMgRG9jdW1lbnQKCjIuMS4gIEFj cm9ueW1zCgogICBTVEFNUCBTaW1wbGUgVHdvLXdheSBBY3RpdmUgTWVhc3VyZW1lbnQgUHJvdG9j b2wKCiAgIERTQ1AgRGlmZmVyZW50aWF0ZWQgU2VydmljZXMgQ29kZSBQb2ludAoKICAgRUNOIEV4 cGxpY2l0IENvbmdlc3Rpb24gTm90aWZpY2F0aW9uCgogICBOVFAgTmV0d29yayBUaW1lIFByb3Rv Y29sCgogICBQVFAgUHJlY2lzaW9uIFRpbWUgUHJvdG9jb2wKCiAgIEhNQUMgSGFzaGVkIE1lc3Nh Z2UgQXV0aGVudGljYXRpb24gQ29kZQoKICAgVExWIFR5cGUtTGVuZ3RoLVZhbHVlCgogICBCSVRT IEJ1aWxkaW5nIEludGVncmF0ZWQgVGltaW5nIFN1cHBseQoKICAgU1NVIFN5bmNocm9uaXphdGlv biBTdXBwbHkgVW5pdAoKICAgR1BTIEdsb2JhbCBQb3NpdGlvbmluZyBTeXN0ZW0KCiAgIEdMT05B U1MgR2xvYmFsIE9yYml0aW5nIE5hdmlnYXRpb24gU2F0ZWxsaXRlIFN5c3RlbQoKICAgTE9SQU4t QyBMb25nIFJhbmdlIE5hdmlnYXRpb24gU3lzdGVtIFZlcnNpb24gQwoKICAgTUJaIE11c3QgQmUg WmVybwoKICAgQ29TIENsYXNzIG9mIFNlcnZpY2UKCiAgIFBNRiBQZXJmb3JtYW5jZSBNZWFzdXJl bWVudCBGdW5jdGlvbgoKICAgU1NJRCBTVEFNUCBTZXNzaW9uIElkZW50aWZpZXIKCjIuMi4gIFJl cXVpcmVtZW50cyBMYW5ndWFnZQoKICAgVGhlIGtleSB3b3JkcyAiTVVTVCIsICJNVVNUIE5PVCIs ICJSRVFVSVJFRCIsICJTSEFMTCIsICJTSEFMTCBOT1QiLAogICAiU0hPVUxEIiwgIlNIT1VMRCBO T1QiLCAiUkVDT01NRU5ERUQiLCAiTk9UIFJFQ09NTUVOREVEIiwgIk1BWSIsIGFuZAogICAiT1BU SU9OQUwiIGluIHRoaXMgZG9jdW1lbnQgYXJlIHRvIGJlIGludGVycHJldGVkIGFzIGRlc2NyaWJl ZCBpbiBCQ1AKICAgMTQgW1JGQzIxMTldIFtSRkM4MTc0XSB3aGVuLCBhbmQgb25seSB3aGVuLCB0 aGV5IGFwcGVhciBpbiBhbGwKICAgY2FwaXRhbHMsIGFzIHNob3duIGhlcmUuCgoKCgpNaXJza3ks IGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIwICAgICAgICAgICAgICAg W1BhZ2UgM10KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RBTVAgRXh0ZW5zaW9ucyAg ICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgozLiAgU1RBTVAgVGVzdCBTZXNzaW9uIElkZW50 aWZpZXIKCiAgIFNUQU1QIFNlc3Npb24tU2VuZGVyIHRyYW5zbWl0cyB0ZXN0IHBhY2tldHMgdG8g U1RBTVAgU2Vzc2lvbi0KICAgUmVmbGVjdG9yLiAgU1RBTVAgU2Vzc2lvbi1SZWZsZWN0b3IgcmVj ZWl2ZXMgU2Vzc2lvbi1TZW5kZXIncyBwYWNrZXQKICAgYW5kIGFjdHMgYWNjb3JkaW5nIHRvIHRo ZSBjb25maWd1cmF0aW9uIGFuZCBvcHRpb25hbCBjb250cm9sCiAgIGluZm9ybWF0aW9uIGNvbW11 bmljYXRlZCBpbiB0aGUgU2Vzc2lvbi1TZW5kZXIncyB0ZXN0IHBhY2tldC4gIFNUQU1QCiAgIGRl ZmluZXMgdHdvIGRpZmZlcmVudCB0ZXN0IHBhY2tldCBmb3JtYXRzLCBvbmUgZm9yIHBhY2tldHMK ICAgdHJhbnNtaXR0ZWQgYnkgdGhlIFNUQU1QLVNlc3Npb24tU2VuZGVyIGFuZCBvbmUgZm9yIHBh Y2tldHMKICAgdHJhbnNtaXR0ZWQgYnkgdGhlIFNUQU1QLVNlc3Npb24tUmVmbGVjdG9yLiAgU1RB TVAgc3VwcG9ydHMgdHdvCiAgIG1vZGVzOiB1bmF1dGhlbnRpY2F0ZWQgYW5kIGF1dGhlbnRpY2F0 ZWQuICBVbmF1dGhlbnRpY2F0ZWQgU1RBTVAgdGVzdAogICBwYWNrZXRzIGFyZSBjb21wYXRpYmxl IG9uIHRoZSB3aXJlIHdpdGggdW5hdXRoZW50aWNhdGVkIFRXQU1QLVRlc3QKICAgW1JGQzUzNTdd IHBhY2tldCBmb3JtYXRzLgoKICAgQnkgZGVmYXVsdCwgU1RBTVAgdXNlcyBzeW1tZXRyaWNhbCBw YWNrZXRzLCBpLmUuLCB0aGUgc2l6ZSBvZiB0aGUKICAgcGFja2V0IHRyYW5zbWl0dGVkIGJ5IFNl c3Npb24tUmVmbGVjdG9yIGVxdWFscyB0aGUgc2l6ZSBvZiB0aGUgcGFja2V0CiAgIHJlY2VpdmVk IGJ5IHRoZSBTZXNzaW9uLVJlZmxlY3Rvci4KCiAgIEEgU1RBTVAgU2Vzc2lvbiBpcyBpZGVudGlm aWVkIHVzaW5nIDQtdHVwbGUgKHNvdXJjZSBhbmQgZGVzdGluYXRpb24KICAgSVAgYWRkcmVzc2Vz LCBzb3VyY2UgYW5kIGRlc3RpbmF0aW9uIFVEUCBwb3J0IG51bWJlcnMpLiAgQSBTVEFNUAogICBT ZXNzaW9uLVNlbmRlciBNQVkgZ2VuZXJhdGUgYSBsb2NhbGx5IHVuaXF1ZSBTVEFNUCBTZXNzaW9u IElkZW50aWZpZXIKICAgKFNTSUQpLiAgU1NJRCBpcyB0d28gb2N0ZXRzIGxvbmcgbm9uLXplcm8g dW5zaWduZWQgaW50ZWdlci4gIEEKICAgU2Vzc2lvbi1TZW5kZXIgTUFZIHVzZSBTU0lEIHRvIGlk ZW50aWZ5IGEgU1RBTVAgdGVzdCBzZXNzaW9uLiAgSWYKICAgU1NJRCBpcyB1c2VkLCBpdCBNVVNU IGJlIHByZXNlbnQgaW4gZWFjaCB0ZXN0IHBhY2tldCBvZiB0aGUgZ2l2ZW4KICAgdGVzdCBzZXNz aW9uLiAgSW4gdGhlIHVuYXV0aGVudGljYXRlZCBtb2RlLCBTU0lEIGlzIGxvY2F0ZWQsIGFzCiAg IGRpc3BsYXllZCBpbiBGaWd1cmUgMS4KCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgpNaXJza3ks IGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIwICAgICAgICAgICAgICAg W1BhZ2UgNF0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RBTVAgRXh0ZW5zaW9ucyAg ICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgogICAgICAgMCAgICAgICAgICAgICAgICAgICAx ICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMwogICAgICAgMCAxIDIgMyA0 IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAg ICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rCiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICBTZXF1ZW5jZSBOdW1i ZXIgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICAg ICAgICAgICAgICAgICAgICAgIFRpbWVzdGFtcCAgICAgICAgICAgICAgICAgICAgICAgICAgICB8 CiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICAgICBFcnJvciBFc3Rp bWF0ZSAgICAgICAgfCAgICAgICAgICAgICBTU0lEICAgICAgICAgICAgICB8CiAgICAgICstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rCiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8CiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgIHwgICAgICAgICAgICAgICAg ICAgICAgICAgTUJaICgyOCBvY3RldHMpICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgIHwg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8CiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICB8CiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgIHwgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAg ICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rCiAgICAgIH4gICAgICAgICAgICAgICAgICAgICAgICAgICAgVExWcyAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICB+CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCgogICBGaWd1cmUgMTogQW4g ZXhhbXBsZSBvZiBhbiBleHRlbmRlZCBTVEFNUCBTZXNzaW9uLVNlbmRlciB0ZXN0IHBhY2tldAog ICAgICAgICAgICAgICAgICAgICAgZm9ybWF0IGluIHVuYXV0aGVudGljYXRlZCBtb2RlCgogICBB biBpbXBsZW1lbnRhdGlvbiBvZiBTVEFNUCBTZXNzaW9uLVJlZmxlY3RvciB0aGF0IHN1cHBvcnRz IHRoaXMKICAgc3BlY2lmaWNhdGlvbiBTSE9VTEQgaWRlbnRpZnkgYSBTVEFNUCBTZXNzaW9uIHVz aW5nIHRoZSBTU0lEIGluCiAgIGNvbWJpbmF0aW9uIHdpdGggZWxlbWVudHMgb2YgdGhlIHVzdWFs IDQtdHVwbGUgZm9yIHRoZSBzZXNzaW9uLgogICBCZWZvcmUgYSB0ZXN0IHNlc3Npb24gY29tbWVu Y2VzLCBhIFNlc3Npb24tUmVmbGVjdG9yIE1VU1QgYmUKICAgcHJvdmlzaW9uZWQgd2l0aCBhbGwg dGhlIGVsZW1lbnRzIHRoYXQgaWRlbnRpZnkgdGhlIFNUQU1QIFNlc3Npb24uICBBCiAgIFNUQU1Q IFNlc3Npb24tUmVmbGVjdG9yIE1VU1QgZGlzY2FyZCB0aGUgbm9uLW1hdGNoaW5nIFNUQU1QIHRl c3QKICAgcGFja2V0KHMpLiAgVGhlIG1lYW5zIG9mIHByb3Zpc2lvbmluZyB0aGUgU1RBTVAgU2Vz c2lvbgogICBpZGVudGlmaWNhdGlvbiBpcyBvdXRzaWRlIHRoZSBzY29wZSBvZiB0aGlzIHNwZWNp ZmljYXRpb24uICBBCiAgIGNvbmZvcm1pbmcgaW1wbGVtZW50YXRpb24gb2YgU1RBTVAgU2Vzc2lv bi1SZWZsZWN0b3IgTVVTVCBjb3B5IHRoZQogICBTU0lEIHZhbHVlIGZyb20gdGhlIHJlY2VpdmVk IHRlc3QgcGFja2V0IGFuZCBwdXQgaXQgaW50byB0aGUKICAgcmVmbGVjdGVkIHBhY2tldCwgYXMg ZGlzcGxheWVkIGluIEZpZ3VyZSAyLgoKCgoKCgoKCgoKCgoKCgoKTWlyc2t5LCBldCBhbC4gICAg ICAgICAgRXhwaXJlcyBEZWNlbWJlciAzMSwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDVdCgwK SW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIFNUQU1QIEV4dGVuc2lvbnMgICAgICAgICAgICAg ICAgICAgSnVuZSAyMDIwCgoKICAgICAwICAgICAgICAgICAgICAgICAgIDEgICAgICAgICAgICAg ICAgICAgMiAgICAgICAgICAgICAgICAgICAzCiAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEg MiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAgICArLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwogICAg fCAgICAgICAgICAgICAgICAgICAgICAgIFNlcXVlbmNlIE51bWJlciAgICAgICAgICAgICAgICAg ICAgICAgIHwKICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rCiAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICBUaW1l c3RhbXAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAgfCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rCiAgICB8ICAgICAgICAgRXJyb3IgRXN0aW1hdGUgICAgICAgIHwgICAgICAgICAgIFNTSUQg ICAgICAgICAgICAgICAgfAogICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgIHwgICAgICAgICAgICAgICAgICAgICAg ICAgIFJlY2VpdmUgVGltZXN0YW1wICAgICAgICAgICAgICAgICAgICB8CiAgICB8ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAog ICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSsKICAgIHwgICAgICAgICAgICAgICAgIFNlc3Npb24tU2VuZGVyIFNlcXVlbmNl IE51bWJlciAgICAgICAgICAgICAgICB8CiAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwogICAgfCAgICAgICAgICAgICAg ICAgIFNlc3Npb24tU2VuZGVyIFRpbWVzdGFtcCAgICAgICAgICAgICAgICAgICAgIHwKICAgIHwg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICB8CiAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKwogICAgfCBTZXNzaW9uLVNlbmRlciBFcnJvciBFc3RpbWF0ZSB8 ICAgICAgICAgICBNQlogICAgICAgICAgICAgICAgIHwKICAgICstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICB8U2VzLVNl bmRlciBUVEwgfCAgICAgICAgICAgICAgICAgICBNQlogICAgICAgICAgICAgICAgICAgICAgICAg fAogICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSsKICAgIH4gICAgICAgICAgICAgICAgICAgICAgICAgICAgVExWcyAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICB+CiAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwoKICAgICBGaWd1cmUgMjog QW4gZXhhbXBsZSBvZiBhbiBleHRlbmRlZCBTVEFNUCBTZXNzaW9uLVJlZmxlY3RvciB0ZXN0CiAg ICAgICAgICAgICAgICAgICBwYWNrZXQgZm9ybWF0IGluIHVuYXV0aGVudGljYXRlZCBtb2RlCgog ICBBIFNUQU1QIFNlc3Npb24tUmVmbGVjdG9yIHRoYXQgZG9lcyBub3Qgc3VwcG9ydCB0aGlzIHNw ZWNpZmljYXRpb24sCiAgIHdpbGwgcmV0dXJuIHRoZSB6ZXJvZWQgU1NJRCBmaWVsZCBpbiB0aGUg cmVmbGVjdGVkIFNUQU1QIHRlc3QgcGFja2V0LgogICBUaGUgU2Vzc2lvbi1TZW5kZXIgTUFZIHN0 b3AgdGhlIHNlc3Npb24gaWYgaXQgcmVjZWl2ZXMgYSB6ZXJvZWQgU1NJRAogICBmaWVsZC4gIEFu IGltcGxlbWVudGF0aW9uIG9mIGEgU2Vzc2lvbi1TZW5kZXIgTVVTVCBzdXBwb3J0IGNvbnRyb2wg b2YKICAgaXRzIGJlaGF2aW9yIGluIHN1Y2ggYSBzY2VuYXJpby4gIElmIHRoZSB0ZXN0IHNlc3Np b24gaXMgbm90IHN0b3BwZWQsCiAgIHRoZSBTZXNzaW9uLVNlbmRlciwgY2FuLCBmb3IgZXhhbXBs ZSwgc2VuZCBhIGJhc2UgU1RBTVAgcGFja2V0CiAgIFtSRkM4NzYyXS4KCiAgIEluIHRoZSBhdXRo ZW50aWNhdGVkIG1vZGUsIGxvY2F0aW9uIG9mIFNTSUQgZmllbGQgaXMgc2hvd24gaW4KICAgRmln dXJlIDMgYW5kIEZpZ3VyZSA0LgoKCgoKCgoKCgoKCgoKTWlyc2t5LCBldCBhbC4gICAgICAgICAg RXhwaXJlcyBEZWNlbWJlciAzMSwgMjAyMCAgICAgICAgICAgICAgIFtQYWdlIDZdCgwKSW50ZXJu ZXQtRHJhZnQgICAgICAgICAgICAgIFNUQU1QIEV4dGVuc2lvbnMgICAgICAgICAgICAgICAgICAg SnVuZSAyMDIwCgoKICAgICAwICAgICAgICAgICAgICAgICAgIDEgICAgICAgICAgICAgICAgICAg MiAgICAgICAgICAgICAgICAgICAzCiAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQg NSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAgICArLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwogICAgfCAgICAg ICAgICAgICAgICAgICAgICBTZXF1ZW5jZSBOdW1iZXIgICAgICAgICAgICAgICAgICAgICAgICAg IHwKICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rCiAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAgfCAgICAgICAgICAgICAgICAgICAgICBN QlogKDEyIG9jdGV0cykgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgIHwgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAg ICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKwogICAgfCAgICAgICAgICAgICAgICAgICAgICAgIFRpbWVzdGFtcCAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwKICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICArLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwogICAgfCAg ICAgICAgRXJyb3IgRXN0aW1hdGUgICAgICAgICB8ICAgICAgICAgICAgU1NJRCAgICAgICAgICAg ICAgIHwKICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rCiAgICB+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfgogICAgfCAgICAgICAgICAgICAgICAgICAg ICAgICBNQlogKDY4IG9jdGV0cykgICAgICAgICAgICAgICAgICAgICAgIHwKICAgIH4gICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB+ CiAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKwogICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgIHwgICAgICAgICAgICAgICAgICAgICAgIEhN QUMgKDE2IG9jdGV0cykgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICB8ICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfAogICAg fCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwKICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rCgogICAgICAgICBGaWd1cmUgMzogQmFzZSBTVEFNUCBTZXNz aW9uLVNlbmRlciB0ZXN0IHBhY2tldCBmb3JtYXQgaW4KICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGF1dGhlbnRpY2F0ZWQgbW9kZQoKICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAg ICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMwogICAgICAwIDEgMiAzIDQgNSA2IDcg OCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEKICAgICAgKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSsKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgIFNlcXVlbmNlIE51bWJlciAgICAg ICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAgICAg ICAgICAgICAgIE1CWiAoMTIgb2N0ZXRzKSAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAg fCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAg ICAgICAgICAgICAgICAgVGltZXN0YW1wICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAg ICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgIEVycm9yIEVzdGltYXRl ICAgICAgICB8ICAgICAgICAgICAgU1NJRCAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsK ICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgIE1CWiAoNCBvY3RldHMpICAgICAgICAgICAg ICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAgICAgICAgICAg ICAgIFJlY2VpdmUgVGltZXN0YW1wICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgIE1CWiAoOCBv Y3RldHMpICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKCgoKTWlyc2t5 LCBldCBhbC4gICAgICAgICAgRXhwaXJlcyBEZWNlbWJlciAzMSwgMjAyMCAgICAgICAgICAgICAg IFtQYWdlIDddCgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIFNUQU1QIEV4dGVuc2lvbnMg ICAgICAgICAgICAgICAgICAgSnVuZSAyMDIwCgoKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAg ICAgICAgICAgICAgU2Vzc2lvbi1TZW5kZXIgU2VxdWVuY2UgTnVtYmVyICAgICAgICAgICAgICAg IHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgIE1CWiAoMTIg b2N0ZXRzKSAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAgICAgICAgU2Vzc2lvbi1TZW5k ZXIgVGltZXN0YW1wICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAg Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSsKICAgICAgfCBTZXNzaW9uLVNlbmRlciBFcnJvciBFc3RpbWF0ZSB8ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICsKICAgICAgfCAgICAgICAgICAg ICAgICAgICAgICAgIE1CWiAoNiBvY3RldHMpICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAg ICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSsKICAgICAgfFNlcy1TZW5kZXIgVFRMIHwgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSsgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICsKICAgICAgfCAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwK ICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgIE1CWiAoMTUgb2N0ZXRzKSAgICAgICAgICAg ICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAg ICAgICAgICAgICAgICAgICAgIEhNQUMgKDE2IG9jdGV0cykgICAgICAgICAgICAgICAgICAgICAg IHwKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSsKCgogICAgICAgRmlndXJlIDQ6IEJhc2UgU1RBTVAgU2Vzc2lvbi1SZWZsZWN0b3IgdGVz dCBwYWNrZXQgZm9ybWF0IGluCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBhdXRoZW50aWNh dGVkIG1vZGUKCjQuICBUTFYgRXh0ZW5zaW9ucyB0byBTVEFNUAoKICAgVHlwZS1MZW5ndGgtVmFs dWUgKFRMVikgZW5jb2Rpbmcgc2NoZW1lIHByb3ZpZGVzIGEgZmxleGlibGUgZXh0ZW5zaW9uCiAg IG1lY2hhbmlzbSBmb3Igb3B0aW9uYWwgaW5mb3JtYXRpb25hbCBlbGVtZW50cy4gIFRMViBpcyBh biBvcHRpb25hbAogICBmaWVsZCBpbiB0aGUgU1RBTVAgdGVzdCBwYWNrZXQuICBNdWx0aXBsZSBU TFZzIE1BWSBiZSBwbGFjZWQgaW4gdGhlCiAgIFNUQU1QIHRlc3QgcGFja2V0LiAgQSBUTFYgTUFZ IGJlIGVuY2xvc2VkIGluIGEgVExWLiAgVExWcyBoYXZlIHRoZQogICB0d28gb2N0ZXRzIGxvbmcg VHlwZSBmaWVsZCwgdHdvIG9jdGV0cyBsb25nIExlbmd0aCBmaWVsZCB0aGF0IGlzCiAgIGVxdWFs IHRvIHRoZSBsZW5ndGggb2YgdGhlIFZhbHVlIGZpZWxkIGluIG9jdGV0cy4gIElmIGEgVHlwZSB2 YWx1ZQogICBmb3IgVExWIG9yIHN1Yi1UTFYgaXMgaW4gdGhlIHJhbmdlIGZvciBWZW5kb3IgUHJp dmF0ZSBVc2UsIHRoZSBMZW5ndGgKICAgTVVTVCBiZSBhdCBsZWFzdCA0LCBhbmQgdGhlIGZpcnN0 IGZvdXIgb2N0ZXRzIE1VU1QgYmUgdGhhdCB2ZW5kb3IncwogICB0aGUgU3RydWN0dXJlIG9mIE1h bmFnZW1lbnQgSW5mb3JtYXRpb24gKFNNSSkgUHJpdmF0ZSBFbnRlcnByaXNlCiAgIENvZGVzLCBh cyByZWNvcmRlZCBpbiBJQU5BJ3MgU01JIFByaXZhdGUgRW50ZXJwcmlzZSBDb2RlcyBzdWItCiAg IHJlZ2lzdHJ5LCBpbiBuZXR3b3JrIG9jdGV0IG9yZGVyLiAgVGhlIHJlc3Qgb2YgdGhlIFZhbHVl IGZpZWxkIGlzCiAgIHByaXZhdGUgdG8gdGhlIHZlbmRvci4gIFRoZSBmb2xsb3dpbmcgc2VjdGlv bnMgZGVzY3JpYmUgdGhlIHVzZSBvZgogICBUTFZzIGZvciBTVEFNUCB0aGF0IGV4dGVuZHMgU1RB TVAgY2FwYWJpbGl0eSBiZXlvbmQgaXRzIGJhc2UKICAgc3BlY2lmaWNhdGlvbi4KCgoKCgpNaXJz a3ksIGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIwICAgICAgICAgICAg ICAgW1BhZ2UgOF0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RBTVAgRXh0ZW5zaW9u cyAgICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgogICAgICAgMCAgICAgICAgICAgICAgICAg ICAxICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMwogICAgICAgMCAxIDIg MyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAx CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rCiAgICAgIHxVfEx8UnxSfFJ8UnxSfFJ8ICAgICBUeXBlICAgICAgfCAg ICAgICAgICAgTGVuZ3RoICAgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIH4gICAg ICAgICAgICAgICAgICAgICAgICAgICAgVmFsdWUgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB+CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rCgogICAgICAgICAgICAgIEZpZ3VyZSA1OiBUTFYgRm9ybWF0IGlu IGEgU1RBTVAgRXh0ZW5kZWQgUGFja2V0CgogICB3aGVyZSBmaWVsZHMgYXJlIGRlZmluZWQgYXMg dGhlIGZvbGxvd2luZzoKCiAgIG8gIFUgLSBhIG9uZS1iaXQgZmxhZywgbG9jYXRlZCBhcyBzcGVj aWZpZWQgaW4gU2VjdGlvbiA1LjIuICBBCiAgICAgIFNlc3Npb24tU2VuZGVyIE1VU1Qgc2V0IHRo ZSBVIGZsYWcgdG8gMCBiZWZvcmUgdHJhbnNtaXR0aW5nIGFuCiAgICAgIGV4dGVuZGVkIFNUQU1Q IHRlc3QgcGFja2V0LiAgQSBTZXNzaW9uLVJlZmxlY3RvciBNVVNUIHNldCB0aGUgVQogICAgICBm bGFnIHRvIDEgaWYgdGhlIFNlc3Npb24tUmVmbGVjdG9yIGhhcyBub3QgdW5kZXJzdG9vZCB0aGUg VExWLgoKICAgbyAgTCAtIGEgb25lLWJpdCBmbGFnLCBsb2NhdGVkIGFzIHNwZWNpZmllZCBpbiBT ZWN0aW9uIDUuMi4gIEEKICAgICAgU2Vzc2lvbi1TZW5kZXIgTVVTVCBzZXQgdGhlIEwgZmxhZyB0 byAwIGJlZm9yZSB0cmFuc21pdHRpbmcgYW4KICAgICAgZXh0ZW5kZWQgU1RBTVAgdGVzdCBwYWNr ZXQuICBBIFNlc3Npb24tUmVmbGVjdG9yIE1VU1Qgc2V0IHRoZSBMCiAgICAgIGZsYWcgdG8gMSBp ZiB0aGUgU2Vzc2lvbi1SZWZsZWN0b3IgZGV0ZXJtaW5lZCB0aGUgVExWIGlzCiAgICAgIG1hbGZv cm1lZCwgaS5lLiwgdGhlIExlbmd0aCBmaWVsZCB2YWx1ZSBvZiB0aGUgZml4ZWQtc2l6ZSBUTFYg aXMKICAgICAgbm90IGVxdWFsIHRvIHRoZSB2YWx1ZSBkZWZpbmVkIGZvciB0aGUgcGFydGljdWxh ciB0eXBlLCBvciB0aGUKICAgICAgcmVtYWluaW5nIGxlbmd0aCBvZiB0aGUgZXh0ZW5kZWQgU1RB TVAgcGFja2V0IGlzIGxlc3MgdGhhbiB0aGUKICAgICAgc2l6ZSBvZiB0aGUgVExWLgoKICAgbyAg UiAtIHJlc2VydmVkIGZsYWdzIGZvciBmdXR1cmUgdXNlLiAgVGhlc2UgZmxhZ3MgTVVTVCBiZSB6 ZXJvZWQgb24KICAgICAgdHJhbnNtaXQgYW5kIGlnbm9yZWQgb24gcmVjZWlwdC4KCiAgIG8gIFR5 cGUgLSBvbmUtb2N0ZXQgbG9uZyBmaWVsZCB0aGF0IGNoYXJhY3Rlcml6ZXMgdGhlIGludGVycHJl dGF0aW9uCiAgICAgIG9mIHRoZSBWYWx1ZSBmaWVsZC4gIEl0IGlzIGFsbG9jYXRlZCBieSBJQU5B LCBhcyBzcGVjaWZpZWQgaW4KICAgICAgU2VjdGlvbiA1LjEKCiAgIG8gIExlbmd0aCAtIHR3by1v Y3RldHMgbG9uZyBmaWVsZCBlcXVhbHMgbGVuZ3RoIG9uIHRoZSBWYWx1ZSBmaWVsZCBpbgogICAg ICBvY3RldHMuCgogICBvICBWYWx1ZSAtIGEgdmFyaWFibGUtbGVuZ3RoIGZpZWxkLiAgSXRzIGlu dGVycHJldGF0aW9uIGFuZCBlbmNvZGluZwogICAgICBkZXRlcm1pbmVkIGJ5IHRoZSB2YWx1ZSBv ZiB0aGUgVHlwZSBmaWVsZC4KCiAgIEEgU1RBTVAgbm9kZSwgd2hldGhlciBTZXNzaW9uLVNlbmRl ciBvciBTZXNzaW9uLVJlZmxlY3RvciwgcmVjZWl2aW5nCiAgIGEgdGVzdCBwYWNrZXQgTVVTVCBk ZXRlcm1pbmUgd2hldGhlciB0aGUgcGFja2V0IGlzIGEgYmFzZSBTVEFNUAogICBwYWNrZXQgb3Ig aW5jbHVkZXMgb25lIG9yIG1vcmUgVExWcy4gIFRoZSBub2RlIE1VU1QgY29tcGFyZSB0aGUgdmFs dWUKICAgaW4gdGhlIExlbmd0aCBmaWVsZCBvZiB0aGUgVURQIGhlYWRlciBhbmQgdGhlIGxlbmd0 aCBvZiB0aGUgYmFzZQogICBTVEFNUCB0ZXN0IHBhY2tldCBpbiB0aGUgbW9kZSwgdW5hdXRoZW50 aWNhdGVkIG9yIGF1dGhlbnRpY2F0ZWQgYmFzZWQKICAgb24gdGhlIGNvbmZpZ3VyYXRpb24gb2Yg dGhlIHBhcnRpY3VsYXIgU1RBTVAgdGVzdCBzZXNzaW9uLiAgSWYgdGhlCiAgIGRpZmZlcmVuY2Ug YmV0d2VlbiB0aGUgdHdvIHZhbHVlcyBpcyBsYXJnZXIgdGhhbiB0aGUgbGVuZ3RoIG9mIFVEUAog ICBoZWFkZXIsIHRoZW4gdGhlIHRlc3QgcGFja2V0IGluY2x1ZGVzIG9uZSBvciBtb3JlIFNUQU1Q IFRMVnMgdGhhdAogICBpbW1lZGlhdGVseSBmb2xsb3cgdGhlIGJhc2UgU1RBTVAgdGVzdCBwYWNr ZXQuCgoKCk1pcnNreSwgZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAg ICAgICAgICAgICAgICBbUGFnZSA5XQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBTVEFN UCBFeHRlbnNpb25zICAgICAgICAgICAgICAgICAgIEp1bmUgMjAyMAoKCiAgIEEgc3lzdGVtIHRo YXQgaGFzIHJlY2VpdmVkIGEgU1RBTVAgdGVzdCBwYWNrZXQgd2l0aCBleHRlbnNpb24gVExWcwog ICBNVVNUIHZhbGlkYXRlIGVhY2ggVExWOgoKICAgICAgaWYgdGhlIFUgZmxhZyBpcyBzZXQsIHRo ZSBTVEFNUCBzeXN0ZW0gTVVTVCBza2lwIHRoZSBwcm9jZXNzaW5nIG9mCiAgICAgIHRoZSBUTFYu ICBUaGUgaW1wbGVtZW50YXRpb24gTVVTVCB0cnkgdG8gcHJvY2VzcyB0aGUgbmV4dCBUTFYgaWYK ICAgICAgcHJlc2VudCBpbiB0aGUgZXh0ZW5kZWQgU1RBTVAgcGFja2V0LgoKICAgICAgaWYgdGhl IEwgZmxhZyBpcyBzZXQsIHRoZSBTVEFNUCBzeXN0ZW0gTVVTVCBzdG9wIHByb2Nlc3NpbmcgdGhl CiAgICAgIHJlbWFpbmRlciBvZiB0aGUgZXh0ZW5kZWQgU1RBTVAgcGFja2V0LgoKICAgICAgaWYg YW4gaW1wbGVtZW50YXRpb24gb2YgYSBTZXNzaW9uLVJlZmxlY3RvciBkb2VzIG5vdCByZWNvZ25p emUgdGhlCiAgICAgIFR5cGUgZmllbGQgdmFsdWUsIGl0IE1VU1QgaW5jbHVkZSB0aGUgY29weSBv ZiB0aGUgVExWIGludG8gdGhlCiAgICAgIHJlZmxlY3RlZCBTVEFNUCBwYWNrZXQuICBUaGUgU2Vz c2lvbi1SZWZsZWN0b3IgTVVTVCBzZXQgdGhlIFUgZmxhZwogICAgICB0byAxLiAgVGhlIFNlc3Np b24tUmVmbGVjdG9yIE1VU1QgdHJ5IHRvIHByb2Nlc3MgdGhlIG5leHQgVExWIGluCiAgICAgIHRo ZSBleHRlbmRlZCBTVEFNUCBwYWNrZXQ7CgogICAgICBpZiBhIFRMViBpcyBtYWxmb3JtZWQsIHRo ZSBwcm9jZXNzaW5nIG9mIGV4dGVuc2lvbiBUTFZzIE1VU1QgYmUKICAgICAgc3RvcHBlZC4gIFRo ZSBTZXNzaW9uLVJlZmxlY3RvciBNVVNUIGNvcHkgdGhlIHJlbWFpbmRlciBvZiB0aGUKICAgICAg cmVjZWl2ZWQgZXh0ZW5kZWQgU1RBTVAgcGFja2V0IGludG8gdGhlIHJlZmxlY3RlZCBTVEFNUCBw YWNrZXQuCiAgICAgIFRoZSBTZXNzaW9uLVJlZmxlY3RvciBNVVNUIHNldCB0aGUgTCBmbGFnIHRv IDEuCgogICBEZXRlY3RlZCBlcnJvciBldmVudHMgTVVTVCBiZSBsb2dnZWQuICBOb3RlIHRoYXQg cmF0ZSBvZiBsb2dnaW5nIE1VU1QKICAgYmUgY29udHJvbGxlZC4KCjQuMS4gIEV4dHJhIFBhZGRp bmcgVExWCgogICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIg ICAgICAgICAgICAgICAgICAgMwogICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQg NSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAgICAgICstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwg ICAgICBFeHRyYSBQYWRkaW5nIFR5cGUgICAgICAgfCAgICAgICAgICAgTGVuZ3RoICAgICAgICAg ICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgIH4gICAgICAgICAgICAg ICAgICAgICAgICAgRXh0cmEgUGFkZGluZyAgICAgICAgICAgICAgICAgICAgICAgICB+CiAgICAg IHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rCgogICAgICAgICAgICAgICAgICAgICAgICBGaWd1cmUg NjogRXh0cmEgUGFkZGluZyBUTFYKCiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBhcyB0aGUg Zm9sbG93aW5nOgoKICAgbyAgRXh0cmEgUGFkZGluZyBUeXBlIC0gVEJBMSBhbGxvY2F0ZWQgYnkg SUFOQSBTZWN0aW9uIDUuMQoKICAgbyAgTGVuZ3RoIC0gdHdvIG9jdGV0cyBsb25nIGZpZWxkIGVx dWFscyBsZW5ndGggb24gdGhlIEV4dHJhIFBhZGRpbmcKICAgICAgZmllbGQgaW4gb2N0ZXRzLgoK ICAgbyAgRXh0cmEgUGFkZGluZyAtIGEgcHNldWRvLXJhbmRvbSBzZXF1ZW5jZSBvZiBudW1iZXJz LiAgVGhlIGZpZWxkCiAgICAgIE1BWSBiZSBmaWxsZWQgd2l0aCBhbGwgemVyb3MuCgoKCgpNaXJz a3ksIGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIwICAgICAgICAgICAg ICBbUGFnZSAxMF0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RBTVAgRXh0ZW5zaW9u cyAgICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgogICBUaGUgRXh0cmEgUGFkZGluZyBUTFYg aXMgc2ltaWxhciB0byB0aGUgUGFja2V0IFBhZGRpbmcgZmllbGQgaW4KICAgVFdBTVAtVGVzdCBw YWNrZXQgW1JGQzUzNTddLiAgVGhlIHVzZSBvZiB0aGUgRXh0cmEgUGFkZGluZyBUTFYgaXMKICAg UkVDT01NRU5ERUQgdG8gcGVyZm9ybSBhIFNUQU1QIHRlc3QgdXNpbmcgdGVzdCBwYWNrZXRzIG9m IGxhcmdlciBzaXplCiAgIHRoYW4gdGhlIGJhc2UgU1RBTVAgcGFja2V0IFtSRkM4NzYyXS4gIFRo ZSBsZW5ndGggb2YgdGhlIGJhc2UgU1RBTVAKICAgcGFja2V0IGlzIDQ0IG9jdGV0cyBpbiB0aGUg dW5hdXRoZW50aWNhdGVkIG1vZGUgb3IgMTEyIG9jdGV0cyBpbiB0aGUKICAgYXV0aGVudGljYXRl ZCBtb2RlLiAgVGhlIEV4dHJhIFBhZGRpbmcgVExWIE1BWSBiZSBwcmVzZW50IG1vcmUgdGhhbgog ICBvbmUgdGltZSBpbiBhbiBleHRlbmRlZCBTVEFNUCB0ZXN0IHBhY2tldC4KCjQuMi4gIExvY2F0 aW9uIFRMVgoKICAgU1RBTVAgU2Vzc2lvbi1TZW5kZXIgTUFZIGluY2x1ZGUgdGhlIExvY2F0aW9u IFRMViB0byByZXF1ZXN0CiAgIGluZm9ybWF0aW9uIGZyb20gdGhlIFNlc3Npb24tUmVmbGVjdG9y LiAgVGhlIFNlc3Npb24tU2VuZGVyIFNIT1VMRAogICBOT1QgZmlsbCBhbnkgaW5mb3JtYXRpb24g ZmllbGRzIGV4Y2VwdCBmb3IgVHlwZSBhbmQgTGVuZ3RoLiAgVGhlCiAgIFNlc3Npb24tUmVmbGVj dG9yIE1VU1QgdmFsaWRhdGUgdGhlIExlbmd0aCB2YWx1ZSBhZ2FpbnN0IHRoZSBhZGRyZXNzCiAg IGZhbWlseSBvZiB0aGUgdHJhbnNwb3J0IGVuY2Fwc3VsYXRpbmcgdGhlIFNUQU1QIHRlc3QgcGFj a2V0LiAgSWYgdGhlCiAgIExlbmd0aCBmaWVsZCdzIHZhbHVlIGlzIGludmFsaWQsIHRoZSBTZXNz aW9uLVJlZmxlY3RvciBNVVNUIHplcm8gYWxsCiAgIGZpZWxkcyBhbmQgTVVTVCBOT1QgcmV0dXJu IGFueSBpbmZvcm1hdGlvbiB0byB0aGUgU2Vzc2lvbi1TZW5kZXIuCiAgIFRoZSBTZXNzaW9uLVJl ZmxlY3RvciBNVVNUIGlnbm9yZSBhbGwgb3RoZXIgZmllbGRzIG9mIHRoZSByZWNlaXZlZAogICBM b2NhdGlvbiBUTFYuCgogICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAgICAgICAg ICAgIDIgICAgICAgICAgICAgICAgICAgMwogICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEg MiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAgICAgICstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAg ICAgIHwgICAgICAgICAgTG9jYXRpb24gVHlwZSAgICAgICAgfCAgICAgICAgICAgTGVuZ3RoICAg ICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAg ICAgIFNvdXJjZSBNQUMgICAgICAgICAgICAgICAgICAgICAgICAgICB8CiAgICAgICsgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r CiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfCAgICAgICAgICAgUmVzZXJ2 ZWQgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIH4gICAgICAgICAgICAgICAgICAg IERlc3RpbmF0aW9uIElQIEFkZHJlc3MgICAgICAgICAgICAgICAgICAgICB+CiAgICAgICstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rCiAgICAgIH4gICAgICAgICAgICAgICAgICAgICAgIFNvdXJjZSBJUCBBZGRyZXNzICAgICAg ICAgICAgICAgICAgICAgICB+CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICAgIERlc3RpbmF0 aW9uIFBvcnQgICAgICAgfCAgICAgICAgICBTb3VyY2UgUG9ydCAgICAgICAgICB8CiAgICAgICst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rCgogICAgICAgICAgICAgICAgIEZpZ3VyZSA3OiBTZXNzaW9uLVJlZmxlY3RvciBMb2Nh dGlvbiBUTFYKCiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBhcyB0aGUgZm9sbG93aW5nOgoK ICAgbyAgTG9jYXRpb24gVHlwZSAtIFRCQTIgYWxsb2NhdGVkIGJ5IElBTkEgU2VjdGlvbiA1LjEK CiAgIG8gIExlbmd0aCAtIHR3byBvY3RldHMgbG9uZyBmaWVsZCBlcXVhbHMgdGhlIGxlbmd0aCBv ZiB0aGUgVmFsdWUKICAgICAgZmllbGQgaW4gb2N0ZXRzLiAgVGhlIExlbmd0aCBmaWVsZCB2YWx1 ZSBNVVNUIGVxdWFsIDIwIG9jdGV0cyBmb3IKICAgICAgdGhlIElQdjQgYWRkcmVzcyBmYW1pbHku ICBGb3IgdGhlIElQdjYgYWRkcmVzcyBmYW1pbHksIHRoZSB2YWx1ZQogICAgICBvZiB0aGUgTGVu Z3RoIGZpZWxkIE1VU1QgZXF1YWwgNDQgb2N0ZXRzLiAgQWxsIG90aGVyIHZhbHVlcyBhcmUKICAg ICAgaW52YWxpZC4KCgoKCk1pcnNreSwgZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIg MzEsIDIwMjAgICAgICAgICAgICAgIFtQYWdlIDExXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAg ICAgICBTVEFNUCBFeHRlbnNpb25zICAgICAgICAgICAgICAgICAgIEp1bmUgMjAyMAoKCiAgIG8g IFNvdXJjZSBNQUMgLSA2IG9jdGV0cyA0OCBiaXRzIGxvbmcgZmllbGQuICBUaGUgU2Vzc2lvbi1S ZWZsZWN0b3IKICAgICAgTVVTVCBjb3B5IFNvdXJjZSBNQUMgb2YgcmVjZWl2ZWQgU1RBTVAgcGFj a2V0IGludG8gdGhpcyBmaWVsZC4KCiAgIG8gIFJlc2VydmVkIC0gdHdvIG9jdGV0cyBsb25nIGZp ZWxkLiAgTVVTVCBiZSB6ZXJvZWQgb24gdHJhbnNtaXNzaW9uCiAgICAgIGFuZCBpZ25vcmVkIG9u IHJlY2VwdGlvbi4KCiAgIG8gIERlc3RpbmF0aW9uIElQIEFkZHJlc3MgLSBJUHY0IG9yIElQdjYg ZGVzdGluYXRpb24gYWRkcmVzcyBvZiB0aGUKICAgICAgcGFja2V0IHJlY2VpdmVkIGJ5IHRoZSBT VEFNUCBTZXNzaW9uLVJlZmxlY3Rvci4KCiAgIG8gIFNvdXJjZSBJUCBBZGRyZXNzIC0gSVB2NCBv ciBJUHY2IHNvdXJjZSBhZGRyZXNzIG9mIHRoZSBwYWNrZXQKICAgICAgcmVjZWl2ZWQgYnkgdGhl IFNUQU1QIFNlc3Npb24tUmVmbGVjdG9yLgoKICAgbyAgRGVzdGluYXRpb24gUG9ydCAtIHR3byBv Y3RldHMgbG9uZyBVRFAgZGVzdGluYXRpb24gcG9ydCBudW1iZXIgb2YKICAgICAgdGhlIHJlY2Vp dmVkIFNUQU1QIHBhY2tldC4KCiAgIG8gIFNvdXJjZSBQb3J0IC0gdHdvIG9jdGV0cyBsb25nIFVE UCBzb3VyY2UgcG9ydCBudW1iZXIgb2YgdGhlCiAgICAgIHJlY2VpdmVkIFNUQU1QIHBhY2tldC4K CiAgIFRoZSBMb2NhdGlvbiBUTFYgTUFZIGJlIHVzZWQgdG8gZGV0ZXJtaW5lIHRoZSBsYXN0LWhv cCBJUCBhZGRyZXNzZXMsCiAgIHBvcnRzLCBhbmQgbGFzdC1ob3AgTUFDIGFkZHJlc3MgZm9yICBT VEFNUCBwYWNrZXRzLiAgVGhlIE1BQyBhZGRyZXNzCiAgIGNhbiBpbmRpY2F0ZSBhIHBhdGggc3dp dGNoIG9uIHRoZSBsYXN0IGhvcCBUaGUgSVAgYWRkcmVzc2VzIGFuZCBVRFAKICAgcG9ydCB3aWxs IGluZGljYXRlIGlmIHRoZXJlIGlzIGEgTkFUIHJvdXRlciBvbiB0aGUgcGF0aCwgYW5kIGFsbG93 cwogICB0aGUgU2Vzc2lvbi1TZW5kZXIgdG8gaWRlbnRpZnkgdGhlIElQIGFkZHJlc3Mgb2YgdGhl IFNlc3Npb24tCiAgIFJlZmxlY3RvciBiZWhpbmQgdGhlIE5BVCwgZGV0ZWN0IGNoYW5nZXMgaW4g dGhlIE5BVCBtYXBwaW5nIHRoYXQKICAgY291bGQgY2F1c2Ugc2VuZGluZyB0aGUgU1RBTVAgcGFj a2V0cyB0byB0aGUgd3JvbmcgU2Vzc2lvbi1SZWZsZWN0b3IuCgo0LjMuICBUaW1lc3RhbXAgSW5m b3JtYXRpb24gVExWCgogICBTVEFNUCBTZXNzaW9uLVNlbmRlciBNQVkgaW5jbHVkZSB0aGUgVGlt ZXN0YW1wIEluZm9ybWF0aW9uIFRMViB0bwogICByZXF1ZXN0IGluZm9ybWF0aW9uIGZyb20gdGhl IFNlc3Npb24tUmVmbGVjdG9yLiAgVGhlIFNlc3Npb24tU2VuZGVyCiAgIFNIT1VMRCBOT1QgZmls bCBhbnkgaW5mb3JtYXRpb24gZmllbGRzIGV4Y2VwdCBmb3IgVHlwZSBhbmQgTGVuZ3RoLgogICBU aGUgU2Vzc2lvbi1SZWZsZWN0b3IgTVVTVCB2YWxpZGF0ZSB0aGUgTGVuZ3RoIHZhbHVlIG9mIHRo ZSBTVEFNUAogICB0ZXN0IHBhY2tldC4gIElmIHRoZSB2YWx1ZSBvZiB0aGUgTGVuZ3RoIGZpZWxk IGlzIGludmFsaWQsIHRoZQogICBTZXNzaW9uLVJlZmxlY3RvciBNVVNUIHplcm8gYWxsIGZpZWxk cyBhbmQgTVVTVCBOT1QgcmV0dXJuIGFueQogICBpbmZvcm1hdGlvbiB0byB0aGUgU2Vzc2lvbi1T ZW5kZXIuCgogICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIg ICAgICAgICAgICAgICAgICAgMwogICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQg NSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAgICAgICstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwg IFRpbWVzdGFtcCBJbmZvcm1hdGlvbiBUeXBlICAgfCAgICAgICAgICAgTGVuZ3RoICAgICAgICAg ICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgIFN5bmMuIFNyYyBJbiB8IFRpbWVzdGFtcCBJ biAgfCBTeW5jLiBTcmMgT3V0IHwgVGltZXN0YW1wIE91dCB8CiAgICAgICstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCgogICAg ICAgICAgICAgICAgICAgIEZpZ3VyZSA4OiBUaW1lc3RhbXAgSW5mb3JtYXRpb24gVExWCgogICB3 aGVyZSBmaWVsZHMgYXJlIGRlZmluZWQgYXMgdGhlIGZvbGxvd2luZzoKCgoKCk1pcnNreSwgZXQg YWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAgICAgICAgICAgICAgIFtQYWdl IDEyXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBTVEFNUCBFeHRlbnNpb25zICAgICAg ICAgICAgICAgICAgIEp1bmUgMjAyMAoKCiAgIG8gIFRpbWVzdGFtcCBJbmZvcm1hdGlvbiBUeXBl IC0gVEJBMyBhbGxvY2F0ZWQgYnkgSUFOQSBTZWN0aW9uIDUuMQoKICAgbyAgTGVuZ3RoIC0gdHdv IG9jdGV0cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDQuCgogICBvICBTeW5j IFNyYyBJbiAtIG9uZSBvY3RldCBsb25nIGZpZWxkIHRoYXQgY2hhcmFjdGVyaXplcyB0aGUgc291 cmNlCiAgICAgIG9mIGNsb2NrIHN5bmNocm9uaXphdGlvbiBhdCB0aGUgaW5ncmVzcyBvZiBTZXNz aW9uLVJlZmxlY3Rvci4KICAgICAgVGhlcmUgYXJlIHNldmVyYWwgbWV0aG9kcyB0byBzeW5jaHJv bml6ZSB0aGUgY2xvY2ssIGUuZy4sIE5ldHdvcmsKICAgICAgVGltZSBQcm90b2NvbCAoTlRQKSBb UkZDNTkwNV0uICBUaGUgdmFsdWUgaXMgb25lIG9mIHRob3NlIGxpc3RlZAogICAgICBpbiBUYWJs ZSA1LgoKICAgbyAgVGltZXN0YW1wIEluIC0gb25lIG9jdGV0IGxvbmcgZmllbGQgdGhhdCBjaGFy YWN0ZXJpemVzIHRoZSBtZXRob2QKICAgICAgYnkgd2hpY2ggdGhlIGluZ3Jlc3Mgb2YgU2Vzc2lv bi1SZWZsZWN0b3Igb2J0YWluZWQgdGhlIHRpbWVzdGFtcAogICAgICBUMi4gIEEgdGltZXN0YW1w IG1heSBiZSBvYnRhaW5lZCB3aXRoIGhhcmR3YXJlIGFzc2lzdGFuY2UsIHZpYQogICAgICBzb2Z0 d2FyZSBBUEkgZnJvbSBhIGxvY2FsIHdhbGwgY2xvY2ssIG9yIGZyb20gYSByZW1vdGUgY2xvY2sg KHRoZQogICAgICBsYXR0ZXIgaXMgcmVmZXJyZWQgdG8gYXMgImNvbnRyb2wgcGxhbmUiKS4gIFRo ZSB2YWx1ZSBpcyBvbmUgb2YKICAgICAgdGhvc2UgbGlzdGVkIGluIFRhYmxlIDcuCgogICBvICBT eW5jIFNyYyBPdXQgLSBvbmUgb2N0ZXQgbG9uZyBmaWVsZCB0aGF0IGNoYXJhY3Rlcml6ZXMgdGhl IHNvdXJjZQogICAgICBvZiBjbG9jayBzeW5jaHJvbml6YXRpb24gYXQgdGhlIGVncmVzcyBvZiBT ZXNzaW9uLVJlZmxlY3Rvci4gIFRoZQogICAgICB2YWx1ZSBpcyBvbmUgb2YgdGhvc2UgbGlzdGVk IGluIFRhYmxlIDUuCgogICBvICBUaW1lc3RhbXAgT3V0IC0gb25lIG9jdGV0IGxvbmcgZmllbGQg dGhhdCBjaGFyYWN0ZXJpemVzIHRoZSBtZXRob2QKICAgICAgYnkgd2hpY2ggdGhlIGVncmVzcyBv ZiBTZXNzaW9uLVJlZmxlY3RvciBvYnRhaW5lZCB0aGUgdGltZXN0YW1wCiAgICAgIFQzLiAgVGhl IHZhbHVlIGlzIG9uZSBvZiB0aG9zZSBsaXN0ZWQgaW4gVGFibGUgNy4KCjQuNC4gIENsYXNzIG9m IFNlcnZpY2UgVExWCgogICBUaGUgU1RBTVAgU2Vzc2lvbi1TZW5kZXIgTUFZIGluY2x1ZGUgQ2xh c3Mgb2YgU2VydmljZSAoQ29TKSBUTFYgaW4KICAgdGhlIFNUQU1QIHRlc3QgcGFja2V0LiAgVGhl IGZvcm1hdCBvZiB0aGUgQ29TIFRMViBpcyBwcmVzZW50ZWQgaW4KICAgRmlndXJlIDkuCgogICAg ICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAg ICAgICAgMwogICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAg MSAyIDMgNCA1IDYgNyA4IDkgMCAxCiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICBDbGFzcyBv ZiBTZXJ2aWNlIFR5cGUgICAgfCAgICAgICAgICAgTGVuZ3RoICAgICAgICAgICAgICB8CiAgICAg ICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rCiAgICAgIHwgICBEU0NQMSAgIHwgICBEU0NQMiAgIHxFQ058ICAgICAgICAgICAg UmVzZXJ2ZWQgICAgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCgogICAgICAgICAgICAgICAg ICAgICAgRmlndXJlIDk6IENsYXNzIG9mIFNlcnZpY2UgVExWCgogICB3aGVyZSBmaWVsZHMgYXJl IGRlZmluZWQgYXMgdGhlIGZvbGxvd2luZzoKCiAgIG8gIENsYXNzIG9mIFNlcnZpY2UgVHlwZSAt IFRCQTQgYWxsb2NhdGVkIGJ5IElBTkEgU2VjdGlvbiA1LjEKCiAgIG8gIExlbmd0aCAtIHR3byBv Y3RldHMgbG9uZyBmaWVsZCwgc2V0IGVxdWFsIHRvIHRoZSB2YWx1ZSA0LgoKCgoKCk1pcnNreSwg ZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAgICAgICAgICAgICAgIFtQ YWdlIDEzXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBTVEFNUCBFeHRlbnNpb25zICAg ICAgICAgICAgICAgICAgIEp1bmUgMjAyMAoKCiAgIG8gIERTQ1AxIC0gVGhlIERpZmZlcmVudGlh dGVkIFNlcnZpY2VzIENvZGUgUG9pbnQgKERTQ1ApIGludGVuZGVkIGJ5CiAgICAgIHRoZSBTZXNz aW9uLVNlbmRlciB0byBiZSB1c2VkIGFzIHRoZSBEU0NQIHZhbHVlIG9mIHRoZSByZWZsZWN0ZWQK ICAgICAgYnkgdGhlIFNlc3Npb24tUmVmbGVjdG9yIHRlc3QgcGFja2V0LgoKICAgbyAgRFNDUDIg LSBUaGUgcmVjZWl2ZWQgdmFsdWUgaW4gdGhlIERTQ1AgZmllbGQgYXQgdGhlIFNlc3Npb24tCiAg ICAgIFJlZmxlY3RvciBpbiB0aGUgZm9yd2FyZCBkaXJlY3Rpb24uCgogICBvICBFQ04gLSBUaGUg cmVjZWl2ZWQgdmFsdWUgaW4gdGhlIEVDTiBmaWVsZCBhdCB0aGUgU2Vzc2lvbi1SZWZsZWN0b3IK ICAgICAgaW4gdGhlIGZvcndhcmQgZGlyZWN0aW9uLgoKICAgbyAgUmVzZXJ2ZWQgLSAxOCBiaXRz IGxvbmcgZmllbGQsIG11c3QgYmUgemVyb2VkIGluIHRyYW5zbWlzc2lvbiBhbmQKICAgICAgaWdu b3JlZCBvbiByZWNlaXB0LgoKICAgQSBTVEFNUCBTZXNzaW9uLVJlZmxlY3RvciB0aGF0IHJlY2Vp dmVkIHRoZSB0ZXN0IHBhY2tldCB3aXRoIHRoZSBDb1MKICAgVExWIE1VU1QgaW5jbHVkZSB0aGUg Q29TIFRMViBpbiB0aGUgcmVmbGVjdGVkIHRlc3QgcGFja2V0LiAgQWxzbywgdGhlCiAgIFNlc3Np b24tUmVmbGVjdG9yIE1VU1QgY29weSB0aGUgdmFsdWUgb2YgdGhlIERTQ1AgYW5kIEVDTiBmaWVs ZHMgb2YKICAgdGhlIElQIGhlYWRlciBvZiB0aGUgcmVjZWl2ZWQgU1RBTVAgdGVzdCBwYWNrZXQg aW50byB0aGUgRFNDUDIgZmllbGQKICAgaW4gdGhlIHJlZmxlY3RlZCB0ZXN0IHBhY2tldC4gIEZp bmFsbHksIHRoZSBTZXNzaW9uLVJlZmxlY3RvciBNVVNUCiAgIHNldCB0aGUgRFNDUCBmaWVsZCdz IHZhbHVlIGluIHRoZSBJUCBoZWFkZXIgb2YgdGhlIHJlZmxlY3RlZCB0ZXN0CiAgIHBhY2tldCBl cXVhbCB0byB0aGUgdmFsdWUgb2YgdGhlIERTQ1AxIGZpZWxkIG9mIHRoZSByZWNlaXZlZCB0ZXN0 CiAgIHBhY2tldC4gIFVwb24gcmVjZWl2aW5nIHRoZSByZWZsZWN0ZWQgcGFja2V0LCB0aGUgU2Vz c2lvbi1TZW5kZXIgd2lsbAogICBzYXZlIHRoZSBEU0NQIGFuZCBFQ04gdmFsdWVzIGZvciBhbmFs eXNpcyBvZiB0aGUgQ29TIGluIHRoZSByZXZlcnNlCiAgIGRpcmVjdGlvbi4KCiAgIFJlLW1hcHBp bmcgb2YgQ29TIGNhbiBiZSB1c2VkIHRvIHByb3ZpZGUgbXVsdGlwbGUgc2VydmljZXMgKGUsZy4s IDJHLAogICAzRywgTFRFIGluIG1vYmlsZSBiYWNraGF1bCBuZXR3b3Jrcykgb3ZlciB0aGUgc2Ft ZSBuZXR3b3JrLiAgQnV0IGlmCiAgIGl0IGlzIG1pc2NvbmZpZ3VyZWQsIHRoZW4gaXQgaXMgb2Z0 ZW4gZGlmZmljdWx0IHRvIGRpYWdub3NlIHRoZSByb290CiAgIGNhdXNlIG9mIGV4Y2Vzc2l2ZSBw YWNrZXQgZHJvcHMgb2YgaGlnaGVyLWxldmVsIHNlcnZpY2Ugd2hpbGUgcGFja2V0CiAgIGRyb3Bz IGZvciBsb3dlciBzZXJ2aWNlIHBhY2tldHMgYXJlIGF0IGEgbm9ybWFsIGxldmVsLiAgVXNpbmcg Q29TIFRMVgogICBpbiBTVEFNUCB0ZXN0aW5nIGhlbHBzIHRvIHRyb3VibGVzaG9vdCB0aGUgZXhp c3RpbmcgcHJvYmxlbSBhbmQgYWxzbwogICB2ZXJpZnkgd2hldGhlciBEaWZmU2VydiBwb2xpY2ll cyBhcmUgcHJvY2Vzc2luZyBDb1MgYXMgcmVxdWlyZWQgYnkKICAgdGhlIGNvbmZpZ3VyYXRpb24u Cgo0LjUuICBEaXJlY3QgTWVhc3VyZW1lbnQgVExWCgogICBUaGUgRGlyZWN0IE1lYXN1cmVtZW50 IFRMViBlbmFibGVzIGNvbGxlY3Rpb24gb2YgImluIHByb2ZpbGUiIHBhY2tldHMKICAgdGhhdCBo YWQgYmVlbiB0cmFuc21pdHRlZCBhbmQgcmVjZWl2ZWQgYnkgdGhlIFNlc3Npb24tU2VuZGVyIGFu ZAogICBTZXNzaW9uLVJlZmxlY3RvciByZXNwZWN0ZnVsbHkuICBUaGUgZGVmaW5pdGlvbiBvZiAi aW4tcHJvZmlsZQogICBwYWNrZXQiIGlzIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1l bnQgYW5kIGlzIGxlZnQgdG8gdGhlIHRlc3QKICAgb3BlcmF0b3JzIHRvIGRldGVybWluZS4KCgoK CgoKCgoKCgpNaXJza3ksIGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIw ICAgICAgICAgICAgICBbUGFnZSAxNF0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RB TVAgRXh0ZW5zaW9ucyAgICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgogICAgICAgMCAgICAg ICAgICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMwog ICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1 IDYgNyA4IDkgMCAxCiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgRGlyZWN0IE1lYXN1cmVtZW50 IFR5cGUgICAgfCAgICAgICAgICAgTGVuZ3RoICAgICAgICAgICAgICB8CiAgICAgICstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r CiAgICAgIHwgICAgICAgICAgICAgIFNlc3Npb24tU2VuZGVyIFR4IGNvdW50ZXIgIChTX1R4Qykg ICAgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgIHwgICAgICAgICAgICAgU2Vzc2lv bi1SZWZsZWN0b3IgUnggY291bnRlciAgKFJfUnhDKSAgICAgICAgICAgICB8CiAgICAgICstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rCiAgICAgIHwgICAgICAgICAgICAgU2Vzc2lvbi1SZWZsZWN0b3IgVHggY291bnRlciAgKFJf VHhDKSAgICAgICAgICAgICB8CiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCgogICAgICAgICAgICAgICAgICAgICBG aWd1cmUgMTA6IERpcmVjdCBNZWFzdXJlbWVudCBUTFYKCiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVm aW5lZCBhcyB0aGUgZm9sbG93aW5nOgoKICAgbyAgRGlyZWN0IE1lYXN1cmVtZW50IFR5cGUgLSBU QkE1IGFsbG9jYXRlZCBieSBJQU5BIFNlY3Rpb24gNS4xCgogICBvICBMZW5ndGggLSB0d28gb2N0 ZXRzIGxvbmcgZmllbGQgZXF1YWxzIGxlbmd0aCBvbiB0aGUgVmFsdWUgZmllbGQgaW4KICAgICAg b2N0ZXRzLiAgTGVuZ3RoIGZpZWxkIHZhbHVlIE1VU1QgZXF1YWwgMTIgb2N0ZXRzLgoKICAgbyAg U2Vzc2lvbi1TZW5kZXIgVHggY291bnRlciAoU19UeEMpIGlzIGZvdXIgb2N0ZXRzIGxvbmcgZmll bGQuCgogICBvICBTZXNzaW9uLVJlZmxlY3RvciBSeCBjb3VudGVyIChSX1J4QykgaXMgZm91ciBv Y3RldHMgbG9uZyBmaWVsZC4KICAgICAgTVVTVCBiZSB6ZXJvZWQgYnkgdGhlIFNlc3Npb24tU2Vu ZGVyIGFuZCBmaWxsZWQgYnkgdGhlIFNlc3Npb24tCiAgICAgIFJlZmxlY3Rvci4KCiAgIG8gIFNl c3Npb24tUmVmbGVjdG9yIFR4IGNvdW50ZXIgKFJfVHhDKSBpcyBmb3VyIG9jdGV0cyBsb25nIGZp ZWxkLgogICAgICBNVVNUIGJlIHplcm9lZCBieSB0aGUgU2Vzc2lvbi1TZW5kZXIgYW5kIGZpbGxl ZCBieSB0aGUgU2Vzc2lvbi0KICAgICAgUmVmbGVjdG9yLgoKICAgQSBTZXNzaW9uLVNlbmRlciBN QVkgaW5jbHVkZSB0aGUgRGlyZWN0IE1lYXN1cmVtZW50IFRMViBpbiBhIFNUQU1QCiAgIHRlc3Qg cGFja2V0LiAgVGhlIFNlc3Npb24tU2VuZGVyIE1VU1QgemVybyBSX1J4QyBhbmQgUl9UeEMgZmll bGRzCiAgIGJlZm9yZSB0aGUgdHJhbnNtaXNzaW9uIG9mIHRoZSBTVEFNUCB0ZXN0IHBhY2tldC4g IElmIHRoZSByZWNlaXZlZAogICBTVEFNUCB0ZXN0IHBhY2tldCBpbmNsdWRlcyB0aGUgRGlyZWN0 IE1lYXN1cmVtZW50IFRMViwgdGhlIFNlc3Npb24tCiAgIFJlZmxlY3RvciBNVVNUIGluY2x1ZGUg aXQgaW4gdGhlIHJlZmxlY3RlZCB0ZXN0IHBhY2tldC4gIFRoZSBTZXNzaW9uLQogICBSZWZsZWN0 b3IgTVVTVCBjb3B5IHRoZSB2YWx1ZSBmcm9tIHRoZSBTX1R4QyBmaWVsZCBvZiB0aGUgcmVjZWl2 ZWQKICAgdGVzdCBwYWNrZXQgaW50byB0aGUgc2FtZSBmaWVsZCBvZiB0aGUgcmVmbGVjdGVkIHBh Y2tldCBiZWZvcmUgaXRzCiAgIHRyYW5zbWlzc2lvbi4KCjQuNi4gIEFjY2VzcyBSZXBvcnQgVExW CgogICBBIFNUQU1QIFNlc3Npb24tU2VuZGVyIE1BWSBpbmNsdWRlIEFjY2VzcyBSZXBvcnQgVExW IChGaWd1cmUgMTEpIHRvCiAgIGluZGljYXRlIGNoYW5nZXMgdG8gdGhlIGFjY2VzcyBuZXR3b3Jr IHN0YXR1cyB0byB0aGUgU2Vzc2lvbi0KICAgUmVmbGVjdG9yLiAgVGhlIGRlZmluaXRpb24gb2Yg YW4gYWNjZXNzIG5ldHdvcmsgaXMgb3V0c2lkZSB0aGUgc2NvcGUKICAgb2YgdGhpcyBkb2N1bWVu dC4KCgoKCgpNaXJza3ksIGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIw ICAgICAgICAgICAgICBbUGFnZSAxNV0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RB TVAgRXh0ZW5zaW9ucyAgICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgogICAgICAgIDAgICAg ICAgICAgICAgICAgICAgMSAgICAgICAgICAgICAgICAgICAyICAgICAgICAgICAgICAgICAgIDMK ICAgICAgICAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0 IDUgNiA3IDggOSAwIDEKICAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rCiAgICAgICB8ICAgICAgIEFjY2VzcyBSZXBv cnQgVHlwZSAgICAgIHwgICAgICAgICAgIExlbmd0aCAgICAgICAgICAgICAgfAogICAgICAgKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSsKICAgICAgIHwgICBJRCAgfCAgUmVzdiB8ICBSZXR1cm4gQ29kZSAgfCAgICAgICAgICBS ZXNlcnZlZCAgICAgICAgICAgICB8CiAgICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwoKICAgICAgICAgICAgICAgICAg ICAgICBGaWd1cmUgMTE6IEFjY2VzcyBSZXBvcnQgVExWCgogICB3aGVyZSBmaWVsZHMgYXJlIGRl ZmluZWQgYXMgZm9sbG93czoKCiAgIG8gIEFjY2VzcyBSZXBvcnQgVHlwZSAtIFRCQTYgYWxsb2Nh dGVkIGJ5IElBTkEgU2VjdGlvbiA1LjEuCgogICBvICBMZW5ndGggLSB0d28gb2N0ZXRzIGxvbmcg ZmllbGQsIHNldCBlcXVhbCB0byB0aGUgdmFsdWUgNC4KCiAgIG8gIElEIChBY2Nlc3MgSUQpIC0g Zm91ciBiaXRzIGxvbmcgZmllbGQgdGhhdCBpZGVudGlmaWVzIHRoZSBhY2Nlc3MKICAgICAgbmV0 d29yaywgZS5nLiwgM0dQUCAoUmFkaW8gQWNjZXNzIFRlY2hub2xvZ2llcyBzcGVjaWZpZWQgYnkg M0dQUCkKICAgICAgb3IgTm9uLTNHUFAgKGFjY2Vzc2VzIHRoYXQgYXJlIG5vdCBzcGVjaWZpZWQg YnkgM0dQUCkgW1RTMjM1MDFdLgogICAgICBUaGUgdmFsdWUgaXMgb25lIG9mIHRob3NlIGxpc3Rl ZCBiZWxvdzoKCiAgICAgICogIDEgLSAzR1BQIE5ldHdvcmsKCiAgICAgICogIDIgLSBOb24tM0dQ UCBOZXR3b3JrCgogICAgICBBbGwgb3RoZXIgdmFsdWVzIGFyZSBpbnZhbGlkIGFuZCB0aGUgVExW IHRoYXQgY29udGFpbnMgaXQgTVVTVCBiZQogICAgICBkaXNjYXJkZWQuCgogICBvICBSZXN2IC0g Zm91ciBiaXRzIGxvbmcgZmllbGQsIG11c3QgYmUgemVyb2VkIG9uIHRyYW5zbWlzc2lvbiBhbmQK ICAgICAgaWdub3JlZCBvbiByZWNlaXB0LgoKICAgbyAgUmV0dXJuIENvZGUgLSBvbmUgb2N0ZXQg bG9uZyBmaWVsZCB0aGF0IGlkZW50aWZpZXMgdGhlIHJlcG9ydAogICAgICBzaWduYWwsIGUuZy4s IGF2YWlsYWJsZSwgdW5hdmFpbGFibGUuICBUaGUgdmFsdWUgaXMgcGFzc2VkLAogICAgICBzdXBw bGllZCB0byB0aGUgU1RBTVAgZW5kLXBvaW50IHRocm91Z2ggc29tZSBtZWNoYW5pc20gdGhhdCBp cwogICAgICBvdXRzaWRlIHRoZSBzY29wZSBvZiB0aGlzIGRvY3VtZW50LiAgVGhlIHZhbHVlIGlz IG9uZSBvZiB0aG9zZQogICAgICBsaXN0ZWQgaW4gU2VjdGlvbiA1LjUuCgogICBvICBSZXNlcnZl ZCAtIHR3byBvY3RldHMgbG9uZyBmaWVsZCwgbXVzdCBiZSB6ZXJvZWQgb24gdHJhbnNtaXNzaW9u CiAgICAgIGFuZCBpZ25vcmVkIG9uIHJlY2VpcHQuCgogICBUaGUgU1RBTVAgU2Vzc2lvbi1TZW5k ZXIgdGhhdCBpbmNsdWRlcyB0aGUgQWNjZXNzIFJlcG9ydCBUTFYgc2V0cyB0aGUKICAgdmFsdWUg b2YgdGhlIEFjY2VzcyBJRCBmaWVsZCBhY2NvcmRpbmcgdG8gdGhlIHR5cGUgb2YgYWNjZXNzIG5l dHdvcmsKICAgaXQgcmVwb3J0cyBvbi4gIEFsc28sIHRoZSBTZXNzaW9uLVNlbmRlciBzZXRzIHRo ZSB2YWx1ZSBvZiB0aGUgUmV0dXJuCiAgIENvZGUgZmllbGQgdG8gcmVmbGVjdCB0aGUgb3BlcmF0 aW9uYWwgc3RhdGUgb2YgdGhlIGFjY2VzcyBuZXR3b3JrLgogICBUaGUgbWVjaGFuaXNtIHRvIGRl dGVybWluZSB0aGUgc3RhdGUgb2YgdGhlIGFjY2VzcyBuZXR3b3JrIGlzIG91dHNpZGUKICAgdGhl IHNjb3BlIG9mIHRoaXMgc3BlY2lmaWNhdGlvbi4gIEEgU1RBTVAgU2Vzc2lvbi1SZWZsZWN0b3Ig dGhhdAogICByZWNlaXZlZCB0aGUgdGVzdCBwYWNrZXQgd2l0aCB0aGUgQWNjZXNzIFJlcG9ydCBU TFYgTVVTVCBpbmNsdWRlIHRoZQogICBBY2Nlc3MgUmVwb3J0IFRMViBpbiB0aGUgcmVmbGVjdGVk IHRlc3QgcGFja2V0LiAgVGhlIFNlc3Npb24tCgoKCk1pcnNreSwgZXQgYWwuICAgICAgICAgIEV4 cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAgICAgICAgICAgICAgIFtQYWdlIDE2XQoMCkludGVybmV0 LURyYWZ0ICAgICAgICAgICAgICBTVEFNUCBFeHRlbnNpb25zICAgICAgICAgICAgICAgICAgIEp1 bmUgMjAyMAoKCiAgIFJlZmxlY3RvciBNVVNUIHNldCB0aGUgdmFsdWUgb2YgdGhlIEFjY2VzcyBJ RCBhbmQgUmV0dXJuIENvZGUgZmllbGRzCiAgIGVxdWFsIHRvIHRoZSB2YWx1ZXMgb2YgdGhlIGNv cnJlc3BvbmRpbmcgZmllbGRzIGZyb20gdGhlIHRlc3QgcGFja2V0CiAgIGl0IGhhcyByZWNlaXZl ZC4KCiAgIFRoZSBTZXNzaW9uLVNlbmRlciBNVVNUIGFsc28gYXJtIGEgcmV0cmFuc21pc3Npb24g dGltZXIgYWZ0ZXIgc2VuZGluZwogICBhIHRlc3QgcGFja2V0IHRoYXQgaW5jbHVkZXMgdGhlIEFj Y2VzcyBSZXBvcnQgVExWLiAgVGhpcyB0aW1lciBNVVNUCiAgIGJlIGRpc2FybWVkIHVwb24gdGhl IHJlY2VwdGlvbiBvZiB0aGUgcmVmbGVjdGVkIFNUQU1QIHRlc3QgcGFja2V0CiAgIHRoYXQgaW5j bHVkZXMgQWNjZXNzIFJlcG9ydCBUTFYuICBJbiB0aGUgZXZlbnQgdGhlIHRpbWVyIGV4cGlyZXMK ICAgYmVmb3JlIHN1Y2ggYSBwYWNrZXQgaXMgcmVjZWl2ZWQsIHRoZSBTZXNzaW9uLVNlbmRlciBN VVNUIHJldHJhbnNtaXQKICAgdGhlIFNUQU1QIHRlc3QgcGFja2V0IHRoYXQgY29udGFpbnMgdGhl IEFjY2VzcyBSZXBvcnQgVExWLiAgVGhpcwogICByZXRyYW5zbWlzc2lvbiBTSE9VTEQgYmUgcmVw ZWF0ZWQgdXAgdG8gZm91ciB0aW1lcyBiZWZvcmUgdGhlCiAgIHByb2NlZHVyZSBpcyBhYm9ydGVk LiAgU2V0dGluZyB0aGUgdmFsdWUgZm9yIHRoZSByZXRyYW5zbWlzc2lvbiB0aW1lcgogICBpcyBi YXNlZCBvbiBsb2NhbCBwb2xpY2llcywgbmV0d29yayBlbnZpcm9ubWVudC4gIFRoZSBkZWZhdWx0 IHZhbHVlCiAgIG9mIHRoZSByZXRyYW5zbWlzc2lvbiB0aW1lciBmb3IgQWNjZXNzIFJlcG9ydCBU TFYgU0hPVUxEIGJlIHRocmVlCiAgIHNlY29uZHMuICBBbiBpbXBsZW1lbnRhdGlvbiBNVVNUIHBy b3ZpZGUgY29udHJvbCBvZiB0aGUKICAgcmV0cmFuc21pc3Npb24gdGltZXIgdmFsdWUgYW5kIHRo ZSBudW1iZXIgb2YgcmV0cmFuc21pc3Npb25zLgoKICAgVGhlIEFjY2VzcyBSZXBvcnQgVExWIGlz IHVzZWQgYnkgdGhlIFBlcmZvcm1hbmNlIE1lYXN1cmVtZW50IEZ1bmN0aW9uCiAgIChQTUYpIGNv bXBvbmVudHMgb2YgdGhlIEFjY2VzcyBTdGVlcmluZywgU3dpdGNoaW5nIGFuZCBTcGxpdHRpbmcK ICAgZmVhdHVyZSBmb3IgNUcgbmV0d29ya3MgW1RTMjM1MDFdLiAgVGhlIFBNRiBjb21wb25lbnQg aW4gdGhlIFVzZXIKICAgRXF1aXBtZW50IGFjdHMgYXMgdGhlIFNUQU1QIFNlc3Npb24tU2VuZGVy LCBhbmQgdGhlIFBNRiBjb21wb25lbnQgaW4KICAgdGhlIFVzZXIgUGxhbmUgRnVuY3Rpb24gYWN0 cyBhcyB0aGUgU1RBTVAgU2Vzc2lvbi1SZWZsZWN0b3IuCgo0LjcuICBGb2xsb3ctdXAgVGVsZW1l dHJ5IFRMVgoKICAgQSBTZXNzaW9uLVJlZmxlY3RvciBtaWdodCBiZSBhYmxlIHRvIHB1dCBpbiB0 aGUgVGltZXN0YW1wIGZpZWxkIG9ubHkKICAgYW4gIlNXIExvY2FsIiAoc2VlIFRhYmxlIDcpIHRp bWVzdGFtcC4gIEJ1dCB0aGUgaG9zdGluZyBzeXN0ZW0gbWlnaHQKICAgcHJvdmlkZSB0aGUgdGlt ZXN0YW1wIGNsb3NlciB0byB0aGUgc3RhcnQgb2YgdGhlIGFjdHVhbCBwYWNrZXQKICAgdHJhbnNt aXNzaW9uIGV2ZW4gdGhvdWdoIHdoZW4gaXQgaXMgbm90IHBvc3NpYmxlIHRvIGRlbGl2ZXIgdGhl CiAgIGluZm9ybWF0aW9uIHRvIHRoZSBTZXNzaW9uLVNlbmRlciBpbiB0aGUgcGFja2V0IGl0c2Vs Zi4gIFRoaXMKICAgdGltZXN0YW1wIG1pZ2h0IG5ldmVydGhlbGVzcyBiZSBpbXBvcnRhbnQgZm9y IHRoZSBTZXNzaW9uLVNlbmRlciwgYXMKICAgaXQgaW1wcm92ZXMgdGhlIGFjY3VyYWN5IG9mIG1l YXN1cmluZyBuZXR3b3JrIGRlbGF5IGJ5IG1pbmltaXppbmcgdGhlCiAgIGltcGFjdCBvZiBlZ3Jl c3MgcXVldWluZyBkZWxheXMgb24gdGhlIG1lYXN1cmVtZW50LgoKICAgQSBTVEFNUCBTZXNzaW9u LVNlbmRlciBNQVkgaW5jbHVkZSB0aGUgRm9sbG93LXVwIFRlbGVtZXRyeSBUTFYgdG8KICAgcmVx dWVzdCBpbmZvcm1hdGlvbiBmcm9tIHRoZSBTZXNzaW9uLVJlZmxlY3Rvci4gIFRoZSBTZXNzaW9u LVNlbmRlcgogICBNVVNUIHNldCB0aGUgRm9sbG93LXVwIFRlbGVtZXRyeSBUeXBlIGFuZCBMZW5n dGggZmllbGRzIHRvIHRoZWlyCiAgIGFwcHJvcHJpYXRlIHZhbHVlcy4gIFNlcXVlbmNlIE51bWJl ciBhbmQgVGltZXN0YW1wIGZpZWxkcyBNVVNUIGJlCiAgIHplcm9lZCBvbiB0cmFuc21pc3Npb24g YnkgdGhlIFNlc3Npb24tU2VuZGVyIGFuZCBpZ25vcmVkIGJ5IHRoZQogICBTZXNzaW9uLVJlZmxl Y3RvciB1cG9uIHJlY2VpcHQgb2YgdGhlIFNUQU1QIHRlc3QgcGFja2V0IHRoYXQgaW5jbHVkZXMK ICAgdGhlIEZvbGxvdy11cCBUZWxlbWV0cnkgVExWLiAgVGhlIFNlc3Npb24tUmVmbGVjdG9yIE1V U1QgdmFsaWRhdGUgdGhlCiAgIExlbmd0aCB2YWx1ZSBvZiB0aGUgU1RBTVAgdGVzdCBwYWNrZXQu ICBJZiB0aGUgdmFsdWUgb2YgdGhlIExlbmd0aAogICBmaWVsZCBpcyBpbnZhbGlkLCB0aGUgU2Vz c2lvbi1SZWZsZWN0b3IgTVVTVCB6ZXJvIFNlcXVlbmNlIE51bWJlciBhbmQKICAgVGltZXN0YW1w IGZpZWxkcy4gIElmIHRoZSBTZXNzaW9uLVJlZmxlY3RvciBpcyBpbiBzdGF0ZWxlc3MgbW9kZQog ICAoZGVmaW5lZCBpbiBTZWN0aW9uIDQuMiBbUkZDODc2Ml0pLCBpdCBNVVNUIHplcm8gU2VxdWVu Y2UgTnVtYmVyIGFuZAogICBUaW1lc3RhbXAgZmllbGRzLgoKCgoKCk1pcnNreSwgZXQgYWwuICAg ICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAgICAgICAgICAgICAgIFtQYWdlIDE3XQoM CkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBTVEFNUCBFeHRlbnNpb25zICAgICAgICAgICAg ICAgICAgIEp1bmUgMjAyMAoKCiAgICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAg ICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMwogICAgICAgIDAgMSAyIDMgNCA1IDYgNyA4 IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMQogICAgICAgKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSsKICAgICAgIHwgICBGb2xsb3ctdXAgVGVsZW1ldHJ5IFR5cGUgICAgfCAgICAgICAgICAg TGVuZ3RoICAgICAgICAgICAgICB8CiAgICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKwogICAgICAgfCAgICAgICAgICAg ICAgICAgICAgICAgIFNlcXVlbmNlIE51bWJlciAgICAgICAgICAgICAgICAgICAgICAgIHwKICAg ICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rCiAgICAgICB8ICAgICAgICAgICAgICAgICAgICAgIEZvbGxvdy11cCBUaW1l c3RhbXAgICAgICAgICAgICAgICAgICAgICAgfAogICAgICAgfCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgICstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rCiAgICAgICB8ICBUaW1lc3RhbXAgTSAgfCAgICAgICAgICAgICAgICAgICAgIFJlc2VydmVk ICAgICAgICAgICAgICAgICAgfAogICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKCiAgICAgICAgICAgICAgICAgICAg RmlndXJlIDEyOiBGb2xsb3ctdXAgVGVsZW1ldHJ5IFRMVgoKICAgd2hlcmUgZmllbGRzIGFyZSBk ZWZpbmVkIGFzIGZvbGxvd3M6CgogICBvICBGb2xsb3ctdXAgVGVsZW1ldHJ5IFR5cGUgLSBUQkE3 IGFsbG9jYXRlZCBieSBJQU5BIFNlY3Rpb24gNS4xLgoKICAgbyAgTGVuZ3RoIC0gdHdvIG9jdGV0 cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDE2IG9jdGV0cy4KCiAgIG8gIFNl cXVlbmNlIE51bWJlciAtIGZvdXIgb2N0ZXRzIGxvbmcgZmllbGQgaW5kaWNhdGluZyB0aGUgc2Vx dWVuY2UKICAgICAgbnVtYmVyIG9mIHRoZSBsYXN0IHBhY2tldCByZWZsZWN0ZWQgaW4gdGhlIHNh bWUgU1RBTVAtdGVzdAogICAgICBzZXNzaW9uLiAgU2luY2UgdGhlIFNlc3Npb24tUmVmbGVjdG9y IHJ1bnMgaW4gdGhlIHN0YXRlZnVsIG1vZGUKICAgICAgKGRlZmluZWQgaW4gU2VjdGlvbiA0LjIg W1JGQzg3NjJdKSwgaXQgaXMgdGhlIFNlc3Npb24tUmVmbGVjdG9yJ3MKICAgICAgU2VxdWVuY2Ug TnVtYmVyIG9mIHRoZSBwcmV2aW91cyByZWZsZWN0ZWQgcGFja2V0LgoKICAgbyAgRm9sbG93LXVw IFRpbWVzdGFtcCAtIGVpZ2h0IG9jdGV0cyBsb25nIGZpZWxkLCB3aXRoIHRoZSBmb3JtYXQKICAg ICAgaW5kaWNhdGVkIGJ5IHRoZSBaIGZsYWcgb2YgdGhlIEVycm9yIEVzdGltYXRlIGZpZWxkIG9m IHRoZSBwYWNrZXQKICAgICAgdHJhbnNtaXR0ZWQgYnkgYSBTZXNzaW9uLVJlZmxlY3RvciwgYXMg ZGVzY3JpYmVkIGluIFNlY3Rpb24gNC4xCiAgICAgIFtSRkM4NzYyXS4gIEl0IGNhcnJpZXMgdGhl IHRpbWVzdGFtcCB3aGVuIHRoZSByZWZsZWN0ZWQgcGFja2V0CiAgICAgIHdpdGggdGhlIHNwZWNp ZmllZCBzZXF1ZW5jZSBudW1iZXIgd2FzIHNlbnQuCgogICBvICBUaW1lc3RhbXAgTShvZGUpIC0g b25lIG9jdGV0IGxvbmcgZmllbGQgdGhhdCBjaGFyYWN0ZXJpemVzIHRoZQogICAgICBtZXRob2Qg Ynkgd2hpY2ggdGhlIGVudGl0eSB0aGF0IHRyYW5zbWl0cyBhIHJlZmxlY3RlZCBTVEFNUCBwYWNr ZXQKICAgICAgb2J0YWluZWQgdGhlIEZvbGxvdy11cCBUaW1lc3RhbXAuICBUaGUgdmFsdWUgaXMg b25lIG9mIHRob3NlCiAgICAgIGxpc3RlZCBpbiBUYWJsZSA3LgoKICAgbyAgUmVzZXJ2ZWQgLSB0 aGUgdGhyZWUgb2N0ZXRzLWxvbmcgZmllbGQuICBJdHMgdmFsdWUgTVVTVCBiZSB6ZXJvZWQKICAg ICAgb24gdHJhbnNtaXNzaW9uIGFuZCBpZ25vcmVkIG9uIHJlY2VpcHQuCgo0LjguICBITUFDIFRM VgoKICAgVGhlIFNUQU1QIGF1dGhlbnRpY2F0ZWQgbW9kZSBwcm90ZWN0cyB0aGUgaW50ZWdyaXR5 IG9mIGRhdGEgY29sbGVjdGVkCiAgIGluIHRoZSBTVEFNUCBiYXNlIHBhY2tldC4gIFNUQU1QIGV4 dGVuc2lvbnMgYXJlIGRlc2lnbmVkIHRvIHByb3ZpZGUKICAgdmFsdWFibGUgaW5mb3JtYXRpb24g YWJvdXQgdGhlIGNvbmRpdGlvbiBvZiBhIG5ldHdvcmssIGFuZCBwcm90ZWN0aW5nCiAgIHRoZSBp bnRlZ3JpdHkgb2YgdGhhdCBkYXRhIGlzIGFsc28gZXNzZW50aWFsLiAgVGhlIGtleWVkIEhhc2hl ZAogICBNZXNzYWdlIEF1dGhlbnRpY2F0aW9uIENvZGUgKEhNQUMpIFRMViBNVVNUIGJlIGluY2x1 ZGVkIGluIGEgU1RBTVAKCgoKTWlyc2t5LCBldCBhbC4gICAgICAgICAgRXhwaXJlcyBEZWNlbWJl ciAzMSwgMjAyMCAgICAgICAgICAgICAgW1BhZ2UgMThdCgwKSW50ZXJuZXQtRHJhZnQgICAgICAg ICAgICAgIFNUQU1QIEV4dGVuc2lvbnMgICAgICAgICAgICAgICAgICAgSnVuZSAyMDIwCgoKICAg dGVzdCBwYWNrZXQgaW4gdGhlIGF1dGhlbnRpY2F0ZWQgbW9kZSwgZXhjbHVkaW5nIHdoZW4gdGhl IG9ubHkgVExWCiAgIHByZXNlbnQgaXMgRXh0cmEgUGFkZGluZyBUTFYuICBUaGUgSE1BQyBUTFYg TVVTVCBmb2xsb3cgYWxsIFRMVnMKICAgaW5jbHVkZWQgaW4gYSBTVEFNUCB0ZXN0IHBhY2tldCwg ZXhjZXB0IGZvciB0aGUgRXh0cmEgUGFkZGluZyBUTFYuCiAgIFRoZSBITUFDIFRMViBNQVkgYmUg dXNlZCB0byBwcm90ZWN0IHRoZSBpbnRlZ3JpdHkgb2YgU1RBTVAgZXh0ZW5zaW9ucwogICBpbiBT VEFNUCB1bmF1dGhlbnRpY2F0ZWQgbW9kZS4KCiAgICAgICAwICAgICAgICAgICAgICAgICAgIDEg ICAgICAgICAgICAgICAgICAgMiAgICAgICAgICAgICAgICAgICAzCiAgICAgICAwIDEgMiAzIDQg NSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEKICAg ICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSsKICAgICAgfCAgICAgICAgICAgIEhNQUMgVHlwZSAgICAgICAgICB8ICAgICAg ICAgICAgIExlbmd0aCAgICAgICAgICAgIHwKICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSsKICAgICAgfCAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwK ICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEhNQUMgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgfCAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwKICAgICAgKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSsKCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBGaWd1cmUgMTM6IEhNQUMgVExWCgogICB3 aGVyZSBmaWVsZHMgYXJlIGRlZmluZWQgYXMgZm9sbG93czoKCiAgIG8gIEhNQUMgVHlwZSAtIGlz IHR3byBvY3RldHMgbG9uZyBmaWVsZCwgdmFsdWUgVEJBOCBhbGxvY2F0ZWQgYnkgSUFOQQogICAg ICBTZWN0aW9uIDUuMS4KCiAgIG8gIExlbmd0aCAtIHR3byBvY3RldHMgbG9uZyBmaWVsZCwgc2V0 IGVxdWFsIHRvIHRoZSB2YWx1ZSAxNiBvY3RldHMuCgogICBvICBITUFDIC0gaXMgMTYgb2N0ZXRz IGxvbmcgZmllbGQgdGhhdCBjYXJyaWVzIEhNQUMgZGlnZXN0IG9mIHRoZQogICAgICB0ZXh0IG9m IGFsbCBwcmVjZWRpbmcgVExWcy4KCiAgIEFzIGRlZmluZWQgaW4gW1JGQzg3NjJdLCBTVEFNUCB1 c2VzIEhNQUMtU0hBLTI1NiB0cnVuY2F0ZWQgdG8gMTI4CiAgIGJpdHMgKFtSRkM0ODY4XSkuICBB bGwgY29uc2lkZXJhdGlvbnMgcmVnYXJkaW5nIHVzaW5nIHRoZSBrZXkgYW5kIGtleQogICBkaXN0 cmlidXRpb24gYW5kIG1hbmFnZW1lbnQgbGlzdGVkIGluIFNlY3Rpb24gNC40IG9mIFtSRkM4NzYy XSBhcmUKICAgZnVsbHkgYXBwbGljYWJsZSB0byB0aGUgdXNlIG9mIHRoZSBITUFDIFRMVi4gIEhN QUMgaXMgY2FsY3VsYXRlZCBhcwogICBkZWZpbmVkIGluIFtSRkMyMTA0XSBvdmVyIHRleHQgYXMg dGhlIGNvbmNhdGVuYXRpb24gb2YgYWxsIHByZWNlZGluZwogICBUTFZzLiAgVGhlIGRpZ2VzdCB0 aGVuIE1VU1QgYmUgdHJ1bmNhdGVkIHRvIDEyOCBiaXRzIGFuZCB3cml0dGVuIGludG8KICAgdGhl IEhNQUMgZmllbGQuICBJbiB0aGUgYXV0aGVudGljYXRlZCBtb2RlLCBITUFDIE1VU1QgYmUgdmVy aWZpZWQKICAgYmVmb3JlIHVzaW5nIGFueSBkYXRhIGluIHRoZSBpbmNsdWRlZCBTVEFNUCBUTFZz LiAgSWYgSE1BQwogICB2ZXJpZmljYXRpb24gYnkgdGhlIFNlc3Npb24tUmVmbGVjdG9yIGZhaWxz LCB0aGVuIGFuIElDTVAgUGFyYW1ldGVyCiAgIFByb2JsZW0gbWVzc2FnZSBNVVNUIGJlIGdlbmVy YXRlZCAod2l0aCBjb25zaWRlcmF0aW9uIG9mIGxpbWl0aW5nIHRoZQogICByYXRlIG9mIGVycm9y IG1lc3NhZ2VzKS4gIFRoZSBDb2RlIHZhbHVlIE1VU1QgYmUgc2V0IHRvIDAgYW5kIHRoZQogICBQ b2ludGVyIGlkZW50aWZ5aW5nIEhNQUMgVHlwZS4gIEFsc28sIGJvdGggU2Vzc2lvbi1TZW5kZXIg YW5kCiAgIFNlc3Npb24tUmVmbGVjdG9yIFNIT1VMRCBsb2cgdGhlIG5vdGlmaWNhdGlvbiB0aGF0 IEhNQUMgdmVyaWZpY2F0aW9uCiAgIG9mIFNUQU1QIFRMVnMgZmFpbGVkLiAgVGhlIHBhY2tldCB0 aGF0IGZhaWxlZCBITUFDIHZlcmlmaWNhdGlvbiBNVVNUCiAgIGJlIGRyb3BwZWQuCgoKCgoKCgpN aXJza3ksIGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIwICAgICAgICAg ICAgICBbUGFnZSAxOV0KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RBTVAgRXh0ZW5z aW9ucyAgICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgo1LiAgSUFOQSBDb25zaWRlcmF0aW9u cwoKNS4xLiAgU1RBTVAgVExWIFJlZ2lzdHJ5CgogICBJQU5BIGlzIHJlcXVlc3RlZCB0byBjcmVh dGUgdGhlIFNUQU1QIFRMViBUeXBlIHJlZ2lzdHJ5LiAgQWxsIGNvZGUKICAgcG9pbnRzIGluIHRo ZSByYW5nZSAxIHRocm91Z2ggMzI3NTkgaW4gdGhpcyByZWdpc3RyeSBzaGFsbCBiZQogICBhbGxv Y2F0ZWQgYWNjb3JkaW5nIHRvIHRoZSAiSUVURiBSZXZpZXciIHByb2NlZHVyZSBhcyBzcGVjaWZp ZWQgaW4KICAgW1JGQzgxMjZdLiAgQ29kZSBwb2ludHMgaW4gdGhlIHJhbmdlIDMyNzYwIHRocm91 Z2ggNjUyNzkgaW4gdGhpcwogICByZWdpc3RyeSBzaGFsbCBiZSBhbGxvY2F0ZWQgYWNjb3JkaW5n IHRvIHRoZSAiRmlyc3QgQ29tZSBGaXJzdAogICBTZXJ2ZWQiIHByb2NlZHVyZSBhcyBzcGVjaWZp ZWQgaW4gW1JGQzgxMjZdLiAgUmVtYWluaW5nIGNvZGUgcG9pbnRzCiAgIGFyZSBhbGxvY2F0ZWQg YWNjb3JkaW5nIHRvIFRhYmxlIDE6CgogICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0tLS0t LS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rCiAgICAgICAgICB8IFZhbHVlICAgICB8IERl c2NyaXB0aW9uICB8IFJlZmVyZW5jZSAgICAgICAgICAgICAgIHwKICAgICAgICAgICstLS0tLS0t LS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwogICAgICAgICAg fCAwICAgICAgICAgfCAgIFJlc2VydmVkICAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8CiAg ICAgICAgICB8IDEtIDE3NSAgICB8ICBVbmFzc2lnbmVkICB8IElFVEYgUmV2aWV3ICAgICAgICAg ICAgIHwKICAgICAgICAgIHwgMTc2IC0gMjM5IHwgIFVuYXNzaWduZWQgIHwgRmlyc3QgQ29tZSBG aXJzdCBTZXJ2ZWQgfAogICAgICAgICAgfCAyNDAgLSAyNTEgfCBFeHBlcmltZW50YWwgfCBUaGlz IGRvY3VtZW50ICAgICAgICAgICB8CiAgICAgICAgICB8IDI1MiAtIDI1NCB8IFByaXZhdGUgVXNl ICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHwKICAgICAgICAgIHwgMjU1ICAgICAgIHwgICBS ZXNlcnZlZCAgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfAogICAgICAgICAgKy0tLS0tLS0t LS0tKy0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rCgogICAgICAgICAg ICAgICAgICAgICBUYWJsZSAxOiBTVEFNUCBUTFYgVHlwZSBSZWdpc3RyeQoKICAgVGhpcyBkb2N1 bWVudCBkZWZpbmVzIHRoZSBmb2xsb3dpbmcgbmV3IHZhbHVlcyBpbiB0aGUgU1RBTVAgRXh0ZW5z aW9uCiAgIFRMViByYW5nZSBvZiB0aGUgU1RBTVAgVExWIFR5cGUgcmVnaXN0cnk6CgogICAgICAg ICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKwog ICAgICAgICAgICAgfCBWYWx1ZSB8ICAgICAgRGVzY3JpcHRpb24gICAgICB8IFJlZmVyZW5jZSAg ICAgfAogICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0t LS0tLS0tLS0tKwogICAgICAgICAgICAgfCBUQkExICB8ICAgICBFeHRyYSBQYWRkaW5nICAgICB8 IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAgICAgfCBUQkEyICB8ICAgICAgICBMb2NhdGlvbiAg ICAgICB8IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAgICAgfCBUQkEzICB8IFRpbWVzdGFtcCBJ bmZvcm1hdGlvbiB8IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAgICAgfCBUQkE0ICB8ICAgIENs YXNzIG9mIFNlcnZpY2UgICB8IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAgICAgfCBUQkE1ICB8 ICAgRGlyZWN0IE1lYXN1cmVtZW50ICB8IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAgICAgfCBU QkE2ICB8ICAgICBBY2Nlc3MgUmVwb3J0ICAgICB8IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAg ICAgfCBUQkE3ICB8ICBGb2xsb3ctdXAgVGVsZW1ldHJ5ICB8IFRoaXMgZG9jdW1lbnQgfAogICAg ICAgICAgICAgfCBUQkE4ICB8ICAgICAgICAgIEhNQUMgICAgICAgICB8IFRoaXMgZG9jdW1lbnQg fAogICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0t LS0tLS0tKwoKICAgICAgICAgICAgICAgICAgICAgICAgICAgVGFibGUgMjogU1RBTVAgVHlwZXMK CjUuMi4gIFNUQU1QIFRMViBGbGFncyBTdWItcmVnaXN0cnkKCiAgIElBTkEgaXMgcmVxdWVzdGVk IHRvIGNyZWF0ZSBTVEFNUCBUTFYgRmxhZ3Mgc3ViLXJlZ2lzdHJ5IGFzIHBhcnQgb2YKICAgdGhl IFNUQU1QIFRMViBUeXBlIHJlZ2lzdHJ5LiAgVGhlIHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmUgaXMg IklFVEYKCgoKCk1pcnNreSwgZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIw MjAgICAgICAgICAgICAgIFtQYWdlIDIwXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBT VEFNUCBFeHRlbnNpb25zICAgICAgICAgICAgICAgICAgIEp1bmUgMjAyMAoKCiAgIFJldmlldyIg W1JGQzgxMjZdLiAgRmxhZ3MgYXJlIDggYml0cy4gIFRoaXMgZG9jdW1lbnQgZGVmaW5lcyB0aGUK ICAgZm9sbG93aW5nIGJpdCBwb3NpdGlvbnMgaW4gdGhlIFNUQU1QIFRMViBGbGFncyBzdWItcmVn aXN0cnk6CgogICAgICAgKy0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0t LSstLS0tLS0tLS0tLS0tLS0rCiAgICAgICB8IEJpdCBwb3NpdGlvbiB8IFN5bWJvbCB8ICAgRGVz Y3JpcHRpb24gICAgfCAgIFJlZmVyZW5jZSAgIHwKICAgICAgICstLS0tLS0tLS0tLS0tLSstLS0t LS0tLSstLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKwogICAgICAgfCAgICAgIDAg ICAgICAgfCAgIFUgICAgfCBVbnJlY29nbml6ZWQgVExWIHwgVGhpcyBkb2N1bWVudCB8CiAgICAg ICB8ICAgICAgMSAgICAgICB8ICAgTCAgICB8ICBNYWxmb3JtZWQgVExWICAgfCBUaGlzIGRvY3Vt ZW50IHwKICAgICAgICstLS0tLS0tLS0tLS0tLSstLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0r LS0tLS0tLS0tLS0tLS0tKwoKICAgICAgICAgICAgICAgICAgICAgICAgIFRhYmxlIDM6IFNUQU1Q IFRMViBGbGFncwoKNS4zLiAgU3luY2hyb25pemF0aW9uIFNvdXJjZSBTdWItcmVnaXN0cnkKCiAg IElBTkEgaXMgcmVxdWVzdGVkIHRvIGNyZWF0ZSBTeW5jaHJvbml6YXRpb24gU291cmNlIHN1Yi1y ZWdpc3RyeSBhcwogICBwYXJ0IG9mIHRoZSBTVEFNUCBUTFYgVHlwZSByZWdpc3RyeS4gIEFsbCBj b2RlIHBvaW50cyBpbiB0aGUgcmFuZ2UgMQogICB0aHJvdWdoIDEyNyBpbiB0aGlzIHJlZ2lzdHJ5 IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlCiAgICJJRVRGIFJldmlldyIgcHJv Y2VkdXJlIGFzIHNwZWNpZmllZCBpbiBbUkZDODEyNl0uICBDb2RlIHBvaW50cyBpbgogICB0aGUg cmFuZ2UgMTI4IHRocm91Z2ggMjM5IGluIHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxsb2NhdGVk CiAgIGFjY29yZGluZyB0byB0aGUgIkZpcnN0IENvbWUgRmlyc3QgU2VydmVkIiBwcm9jZWR1cmUg YXMgc3BlY2lmaWVkIGluCiAgIFtSRkM4MTI2XS4gIFJlbWFpbmluZyBjb2RlIHBvaW50cyBhcmUg YWxsb2NhdGVkIGFjY29yZGluZyB0byBUYWJsZSA0OgoKICAgICAgICAgICstLS0tLS0tLS0tLSst LS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwogICAgICAgICAgfCBWYWx1 ZSAgICAgfCBEZXNjcmlwdGlvbiAgfCBSZWZlcmVuY2UgICAgICAgICAgICAgICB8CiAgICAgICAg ICArLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsK ICAgICAgICAgIHwgMCAgICAgICAgIHwgICBSZXNlcnZlZCAgIHwgVGhpcyBkb2N1bWVudCAgICAg ICAgICAgfAogICAgICAgICAgfCAxLSAxMjcgICAgfCAgVW5hc3NpZ25lZCAgfCBJRVRGIFJldmll dyAgICAgICAgICAgICB8CiAgICAgICAgICB8IDEyOCAtIDIzOSB8ICBVbmFzc2lnbmVkICB8IEZp cnN0IENvbWUgRmlyc3QgU2VydmVkIHwKICAgICAgICAgIHwgMjQwIC0gMjQ5IHwgRXhwZXJpbWVu dGFsIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfAogICAgICAgICAgfCAyNTAgLSAyNTQgfCBQ cml2YXRlIFVzZSAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8CiAgICAgICAgICB8IDI1NSAg ICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHwKICAgICAgICAg ICstLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwoK ICAgICAgICAgICAgICAgVGFibGUgNDogU3luY2hyb25pemF0aW9uIFNvdXJjZSBTdWItcmVnaXN0 cnkKCiAgIFRoaXMgZG9jdW1lbnQgZGVmaW5lcyB0aGUgZm9sbG93aW5nIG5ldyB2YWx1ZXMgaW4g dGhlIFN5bmNocm9uaXphdGlvbgogICBTb3VyY2Ugc3ViLXJlZ2lzdHJ5OgoKCgoKCgoKCgoKCgoK Ck1pcnNreSwgZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAgICAgICAg ICAgICAgIFtQYWdlIDIxXQoMCkludGVybmV0LURyYWZ0ICAgICAgICAgICAgICBTVEFNUCBFeHRl bnNpb25zICAgICAgICAgICAgICAgICAgIEp1bmUgMjAyMAoKCiAgICAgICAgICAgICAgKy0tLS0t LS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsKICAgICAgICAgICAgICB8 IFZhbHVlIHwgICAgIERlc2NyaXB0aW9uICAgICB8IFJlZmVyZW5jZSAgICAgfAogICAgICAgICAg ICAgICstLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rCiAgICAg ICAgICAgICAgfCAxICAgICB8ICAgICAgICAgTlRQICAgICAgICAgfCBUaGlzIGRvY3VtZW50IHwK ICAgICAgICAgICAgICB8IDIgICAgIHwgICAgICAgICBQVFAgICAgICAgICB8IFRoaXMgZG9jdW1l bnQgfAogICAgICAgICAgICAgIHwgMyAgICAgfCAgICAgICBTU1UvQklUUyAgICAgIHwgVGhpcyBk b2N1bWVudCB8CiAgICAgICAgICAgICAgfCA0ICAgICB8IEdQUy9HTE9OQVNTL0xPUkFOLUMgfCBU aGlzIGRvY3VtZW50IHwKICAgICAgICAgICAgICB8IDUgICAgIHwgIExvY2FsIGZyZWUtcnVubmlu ZyB8IFRoaXMgZG9jdW1lbnQgfAogICAgICAgICAgICAgICstLS0tLS0tKy0tLS0tLS0tLS0tLS0t LS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rCgogICAgICAgICAgICAgICAgICAgICBUYWJsZSA1OiBT eW5jaHJvbml6YXRpb24gU291cmNlcwoKNS40LiAgVGltZXN0YW1waW5nIE1ldGhvZCBTdWItcmVn aXN0cnkKCiAgIElBTkEgaXMgcmVxdWVzdGVkIHRvIGNyZWF0ZSBUaW1lc3RhbXBpbmcgTWV0aG9k IHN1Yi1yZWdpc3RyeSBhcyBwYXJ0CiAgIG9mIHRoZSBTVEFNUCBUTFYgVHlwZSByZWdpc3RyeS4g IEFsbCBjb2RlIHBvaW50cyBpbiB0aGUgcmFuZ2UgMQogICB0aHJvdWdoIDEyNyBpbiB0aGlzIHJl Z2lzdHJ5IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlCiAgICJJRVRGIFJldmll dyIgcHJvY2VkdXJlIGFzIHNwZWNpZmllZCBpbiBbUkZDODEyNl0uICBDb2RlIHBvaW50cyBpbgog ICB0aGUgcmFuZ2UgMTI4IHRocm91Z2ggMjM5IGluIHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxs b2NhdGVkCiAgIGFjY29yZGluZyB0byB0aGUgIkZpcnN0IENvbWUgRmlyc3QgU2VydmVkIiBwcm9j ZWR1cmUgYXMgc3BlY2lmaWVkIGluCiAgIFtSRkM4MTI2XS4gIFJlbWFpbmluZyBjb2RlIHBvaW50 cyBhcmUgYWxsb2NhdGVkIGFjY29yZGluZyB0byBUYWJsZSA2OgoKICAgICAgICAgICstLS0tLS0t LS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwogICAgICAgICAg fCBWYWx1ZSAgICAgfCBEZXNjcmlwdGlvbiAgfCBSZWZlcmVuY2UgICAgICAgICAgICAgICB8CiAg ICAgICAgICArLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLSsKICAgICAgICAgIHwgMCAgICAgICAgIHwgICBSZXNlcnZlZCAgIHwgVGhpcyBkb2N1bWVu dCAgICAgICAgICAgfAogICAgICAgICAgfCAxLSAxMjcgICAgfCAgVW5hc3NpZ25lZCAgfCBJRVRG IFJldmlldyAgICAgICAgICAgICB8CiAgICAgICAgICB8IDEyOCAtIDIzOSB8ICBVbmFzc2lnbmVk ICB8IEZpcnN0IENvbWUgRmlyc3QgU2VydmVkIHwKICAgICAgICAgIHwgMjQwIC0gMjQ5IHwgRXhw ZXJpbWVudGFsIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfAogICAgICAgICAgfCAyNTAgLSAy NTQgfCBQcml2YXRlIFVzZSAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8CiAgICAgICAgICB8 IDI1NSAgICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHwKICAg ICAgICAgICstLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tKwoKICAgICAgICAgICAgICAgICBUYWJsZSA2OiBUaW1lc3RhbXBpbmcgTWV0aG9kIFN1Yi1y ZWdpc3RyeQoKICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIHRoZSBmb2xsb3dpbmcgbmV3IHZhbHVl cyBpbiB0aGUgVGltZXN0YW1waW5nCiAgIE1ldGhvZHMgc3ViLXJlZ2lzdHJ5OgoKICAgICAgICAg ICAgICAgICArLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKwogICAgICAg ICAgICAgICAgIHwgVmFsdWUgfCAgRGVzY3JpcHRpb24gIHwgUmVmZXJlbmNlICAgICB8CiAgICAg ICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSsKICAg ICAgICAgICAgICAgICB8IDEgICAgIHwgICBIVyBBc3Npc3QgICB8IFRoaXMgZG9jdW1lbnQgfAog ICAgICAgICAgICAgICAgIHwgMiAgICAgfCAgICBTVyBsb2NhbCAgIHwgVGhpcyBkb2N1bWVudCB8 CiAgICAgICAgICAgICAgICAgfCAzICAgICB8IENvbnRyb2wgcGxhbmUgfCBUaGlzIGRvY3VtZW50 IHwKICAgICAgICAgICAgICAgICArLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tKwoKICAgICAgICAgICAgICAgICAgICAgICBUYWJsZSA3OiBUaW1lc3RhbXBpbmcgTWV0aG9k cwoKCgoKTWlyc2t5LCBldCBhbC4gICAgICAgICAgRXhwaXJlcyBEZWNlbWJlciAzMSwgMjAyMCAg ICAgICAgICAgICAgW1BhZ2UgMjJdCgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIFNUQU1Q IEV4dGVuc2lvbnMgICAgICAgICAgICAgICAgICAgSnVuZSAyMDIwCgoKNS41LiAgUmV0dXJuIENv ZGUgU3ViLXJlZ2lzdHJ5CgogICBJQU5BIGlzIHJlcXVlc3RlZCB0byBjcmVhdGUgUmV0dXJuIENv ZGUgc3ViLXJlZ2lzdHJ5IGFzIHBhcnQgb2YgU1RBTVAKICAgVExWIFR5cGUgcmVnaXN0cnkuICBB bGwgY29kZSBwb2ludHMgaW4gdGhlIHJhbmdlIDEgdGhyb3VnaCAxMjcgaW4KICAgdGhpcyByZWdp c3RyeSBzaGFsbCBiZSBhbGxvY2F0ZWQgYWNjb3JkaW5nIHRvIHRoZSAiSUVURiBSZXZpZXciCiAg IHByb2NlZHVyZSBhcyBzcGVjaWZpZWQgaW4gW1JGQzgxMjZdLiAgQ29kZSBwb2ludHMgaW4gdGhl IHJhbmdlIDEyOAogICB0aHJvdWdoIDIzOSBpbiB0aGlzIHJlZ2lzdHJ5IHNoYWxsIGJlIGFsbG9j YXRlZCBhY2NvcmRpbmcgdG8gdGhlCiAgICJGaXJzdCBDb21lIEZpcnN0IFNlcnZlZCIgcHJvY2Vk dXJlIGFzIHNwZWNpZmllZCBpbiBbUkZDODEyNl0uCiAgIFJlbWFpbmluZyBjb2RlIHBvaW50cyBh cmUgYWxsb2NhdGVkIGFjY29yZGluZyB0byBUYWJsZSA4OgoKICAgICAgICAgICstLS0tLS0tLS0t LSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwogICAgICAgICAgfCBW YWx1ZSAgICAgfCBEZXNjcmlwdGlvbiAgfCBSZWZlcmVuY2UgICAgICAgICAgICAgICB8CiAgICAg ICAgICArLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LSsKICAgICAgICAgIHwgMCAgICAgICAgIHwgICBSZXNlcnZlZCAgIHwgVGhpcyBkb2N1bWVudCAg ICAgICAgICAgfAogICAgICAgICAgfCAxLSAxMjcgICAgfCAgVW5hc3NpZ25lZCAgfCBJRVRGIFJl dmlldyAgICAgICAgICAgICB8CiAgICAgICAgICB8IDEyOCAtIDIzOSB8ICBVbmFzc2lnbmVkICB8 IEZpcnN0IENvbWUgRmlyc3QgU2VydmVkIHwKICAgICAgICAgIHwgMjQwIC0gMjQ5IHwgRXhwZXJp bWVudGFsIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfAogICAgICAgICAgfCAyNTAgLSAyNTQg fCBQcml2YXRlIFVzZSAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8CiAgICAgICAgICB8IDI1 NSAgICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHwKICAgICAg ICAgICstLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t KwoKICAgICAgICAgICAgICAgICAgICAgVGFibGUgODogUmV0dXJuIENvZGUgU3ViLXJlZ2lzdHJ5 CgogICBUaGlzIGRvY3VtZW50IGRlZmluZXMgdGhlIGZvbGxvd2luZyBuZXcgdmFsdWVzIGluIHRo ZSBSZXR1cm4gQ29kZQogICBzdWItcmVnaXN0cnk6CgogICAgICAgICAgICAgICstLS0tLS0tKy0t LS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rCiAgICAgICAgICAgICAgfCBWYWx1 ZSB8ICAgICBEZXNjcmlwdGlvbiAgICAgfCBSZWZlcmVuY2UgICAgIHwKICAgICAgICAgICAgICAr LS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKwogICAgICAgICAg ICAgIHwgMSAgICAgfCAgTmV0d29yayBhdmFpbGFibGUgIHwgVGhpcyBkb2N1bWVudCB8CiAgICAg ICAgICAgICAgfCAyICAgICB8IE5ldHdvcmsgdW5hdmFpbGFibGUgfCBUaGlzIGRvY3VtZW50IHwK ICAgICAgICAgICAgICArLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tKwoKICAgICAgICAgICAgICAgICAgICAgICAgICAgVGFibGUgOTogUmV0dXJuIENvZGVzCgo2 LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMKCiAgIFRoaXMgZG9jdW1lbnQgZGVmaW5lcyBleHRl bnNpb25zIHRvIFNUQU1QIFtSRkM4NzYyXSBhbmQgaW5oZXJpdHMgYWxsCiAgIHRoZSBzZWN1cml0 eSBjb25zaWRlcmF0aW9ucyBhcHBsaWNhYmxlIHRvIHRoZSBiYXNlIHByb3RvY29sLgogICBBZGRp dGlvbmFsbHksIHRoZSBITUFDIFRMViBpcyBkZWZpbmVkIGluIHRoaXMgZG9jdW1lbnQgdG8gcHJv dGVjdCB0aGUKICAgaW50ZWdyaXR5IG9mIG9wdGlvbmFsIFNUQU1QIGV4dGVuc2lvbnMuICBUaGUg dXNlIG9mIEhNQUMgVExWIGlzCiAgIGRpc2N1c3NlZCBpbiBkZXRhaWwgaW4gU2VjdGlvbiA0Ljgu Cgo3LiAgQWNrbm93bGVkZ21lbnRzCgogICBBdXRob3JzIG11Y2ggYXBwcmVjaWF0ZSB0aGUgdGhv cm91Z2ggcmV2aWV3IGFuZCB0aG91Z2h0ZnVsIGNvbW1lbnRzCiAgIHJlY2VpdmVkIGZyb20gVGlh bnJhbiBaaG91LCBSYWtlc2ggR2FuZGhpLCBZdWV6aG9uZyBTb25nIGFuZCBZYWxpCiAgIFdhbmcu ICBUaGUgYXV0aG9ycyBleHByZXNzIHRoZWlyIGdyYXRpdHVkZSB0byBBbCBNb3J0b24gZm9yIGhp cwoKCgpNaXJza3ksIGV0IGFsLiAgICAgICAgICBFeHBpcmVzIERlY2VtYmVyIDMxLCAyMDIwICAg ICAgICAgICAgICBbUGFnZSAyM10KDApJbnRlcm5ldC1EcmFmdCAgICAgICAgICAgICAgU1RBTVAg RXh0ZW5zaW9ucyAgICAgICAgICAgICAgICAgICBKdW5lIDIwMjAKCgogICBjb21tZW50cyBhbmQg dGhlIG1vc3QgdmFsdWFibGUgc3VnZ2VzdGlvbnMuICBUaGUgYXV0aG9ycyBncmVhdGx5CiAgIGFw cHJlY2lhdGUgY29tbWVudHMgYW5kIHRob3VnaHRmdWwgc3VnZ2VzdGlvbnMgcmVjZWl2ZWQgZnJv bSBNYXJ0aW4KICAgRHVrZS4KCjguICBDb250cmlidXRvcnMKCiAgIFRoZSBmb2xsb3dpbmcgcGVv cGxlIGNvbnRyaWJ1dGVkIHRleHQgdG8gdGhpcyBkb2N1bWVudDoKCiAgICAgIEd1byBKdW4KICAg ICAgWlRFIENvcnBvcmF0aW9uCiAgICAgIDY4IyBaaWppbmdodWEgUm9hZAogICAgICBOYW5qaW5n LCBKaWFuZ3N1ICAyMTAwMTIKICAgICAgUC5SLkNoaW5hCgogICAgICBQaG9uZTogKzg2IDE4MTA1 MTgzNjYzCiAgICAgIEVtYWlsOiBndW8uanVuMkB6dGUuY29tLmNuCgo5LiAgUmVmZXJlbmNlcwoK OS4xLiAgTm9ybWF0aXZlIFJlZmVyZW5jZXMKCiAgIFtSRkMyMTE5XSAgQnJhZG5lciwgUy4sICJL ZXkgd29yZHMgZm9yIHVzZSBpbiBSRkNzIHRvIEluZGljYXRlCiAgICAgICAgICAgICAgUmVxdWly ZW1lbnQgTGV2ZWxzIiwgQkNQIDE0LCBSRkMgMjExOSwKICAgICAgICAgICAgICBET0kgMTAuMTc0 ODcvUkZDMjExOSwgTWFyY2ggMTk5NywKICAgICAgICAgICAgICA8aHR0cHM6Ly93d3cucmZjLWVk aXRvci5vcmcvaW5mby9yZmMyMTE5Pi4KCiAgIFtSRkM1MzU3XSAgSGVkYXlhdCwgSy4sIEtyemFu b3dza2ksIFIuLCBNb3J0b24sIEEuLCBZdW0sIEsuLCBhbmQgSi4KICAgICAgICAgICAgICBCYWJp YXJ6LCAiQSBUd28tV2F5IEFjdGl2ZSBNZWFzdXJlbWVudCBQcm90b2NvbCAoVFdBTVApIiwKICAg ICAgICAgICAgICBSRkMgNTM1NywgRE9JIDEwLjE3NDg3L1JGQzUzNTcsIE9jdG9iZXIgMjAwOCwK ICAgICAgICAgICAgICA8aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM1MzU3Pi4K CiAgIFtSRkM4MTI2XSAgQ290dG9uLCBNLiwgTGVpYmEsIEIuLCBhbmQgVC4gTmFydGVuLCAiR3Vp ZGVsaW5lcyBmb3IKICAgICAgICAgICAgICBXcml0aW5nIGFuIElBTkEgQ29uc2lkZXJhdGlvbnMg U2VjdGlvbiBpbiBSRkNzIiwgQkNQIDI2LAogICAgICAgICAgICAgIFJGQyA4MTI2LCBET0kgMTAu MTc0ODcvUkZDODEyNiwgSnVuZSAyMDE3LAogICAgICAgICAgICAgIDxodHRwczovL3d3dy5yZmMt ZWRpdG9yLm9yZy9pbmZvL3JmYzgxMjY+LgoKICAgW1JGQzgxNzRdICBMZWliYSwgQi4sICJBbWJp Z3VpdHkgb2YgVXBwZXJjYXNlIHZzIExvd2VyY2FzZSBpbiBSRkMKICAgICAgICAgICAgICAyMTE5 IEtleSBXb3JkcyIsIEJDUCAxNCwgUkZDIDgxNzQsIERPSSAxMC4xNzQ4Ny9SRkM4MTc0LAogICAg ICAgICAgICAgIE1heSAyMDE3LCA8aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM4 MTc0Pi4KCiAgIFtSRkM4NzYyXSAgTWlyc2t5LCBHLiwgSnVuLCBHLiwgTnlkZWxsLCBILiwgYW5k IFIuIEZvb3RlLCAiU2ltcGxlCiAgICAgICAgICAgICAgVHdvLVdheSBBY3RpdmUgTWVhc3VyZW1l bnQgUHJvdG9jb2wiLCBSRkMgODc2MiwKICAgICAgICAgICAgICBET0kgMTAuMTc0ODcvUkZDODc2 MiwgTWFyY2ggMjAyMCwKICAgICAgICAgICAgICA8aHR0cHM6Ly93d3cucmZjLWVkaXRvci5vcmcv aW5mby9yZmM4NzYyPi4KCgoKCgoKCk1pcnNreSwgZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVj ZW1iZXIgMzEsIDIwMjAgICAgICAgICAgICAgIFtQYWdlIDI0XQoMCkludGVybmV0LURyYWZ0ICAg ICAgICAgICAgICBTVEFNUCBFeHRlbnNpb25zICAgICAgICAgICAgICAgICAgIEp1bmUgMjAyMAoK CjkuMi4gIEluZm9ybWF0aXZlIFJlZmVyZW5jZXMKCiAgIFtSRkMyMTA0XSAgS3Jhd2N6eWssIEgu LCBCZWxsYXJlLCBNLiwgYW5kIFIuIENhbmV0dGksICJITUFDOiBLZXllZC0KICAgICAgICAgICAg ICBIYXNoaW5nIGZvciBNZXNzYWdlIEF1dGhlbnRpY2F0aW9uIiwgUkZDIDIxMDQsCiAgICAgICAg ICAgICAgRE9JIDEwLjE3NDg3L1JGQzIxMDQsIEZlYnJ1YXJ5IDE5OTcsCiAgICAgICAgICAgICAg PGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjMjEwND4uCgogICBbUkZDNDg2OF0g IEtlbGx5LCBTLiBhbmQgUy4gRnJhbmtlbCwgIlVzaW5nIEhNQUMtU0hBLTI1NiwgSE1BQy1TSEEt CiAgICAgICAgICAgICAgMzg0LCBhbmQgSE1BQy1TSEEtNTEyIHdpdGggSVBzZWMiLCBSRkMgNDg2 OCwKICAgICAgICAgICAgICBET0kgMTAuMTc0ODcvUkZDNDg2OCwgTWF5IDIwMDcsCiAgICAgICAg ICAgICAgPGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNDg2OD4uCgogICBbUkZD NTkwNV0gIE1pbGxzLCBELiwgTWFydGluLCBKLiwgRWQuLCBCdXJiYW5rLCBKLiwgYW5kIFcuIEth c2NoLAogICAgICAgICAgICAgICJOZXR3b3JrIFRpbWUgUHJvdG9jb2wgVmVyc2lvbiA0OiBQcm90 b2NvbCBhbmQgQWxnb3JpdGhtcwogICAgICAgICAgICAgIFNwZWNpZmljYXRpb24iLCBSRkMgNTkw NSwgRE9JIDEwLjE3NDg3L1JGQzU5MDUsIEp1bmUgMjAxMCwKICAgICAgICAgICAgICA8aHR0cHM6 Ly93d3cucmZjLWVkaXRvci5vcmcvaW5mby9yZmM1OTA1Pi4KCiAgIFtUUzIzNTAxXSAgM0dQUCAo M3JkIEdlbmVyYXRpb24gUGFydG5lcnNoaXAgUHJvamVjdCksICJUZWNobmljYWwKICAgICAgICAg ICAgICBTcGVjaWZpY2F0aW9uIEdyb3VwIFNlcnZpY2VzIGFuZCBTeXN0ZW0gQXNwZWN0czsgU3lz dGVtCiAgICAgICAgICAgICAgQXJjaGl0ZWN0dXJlIGZvciB0aGUgNUcgU3lzdGVtOyBTdGFnZSAy IChSZWxlYXNlIDE2KSIsCiAgICAgICAgICAgICAgM0dQUCBUUzIzNTAxLCAyMDE5LgoKQXV0aG9y cycgQWRkcmVzc2VzCgogICBHcmVnIE1pcnNreQogICBaVEUgQ29ycC4KCiAgIEVtYWlsOiBncmVn aW1pcnNreUBnbWFpbC5jb20KCgogICBYaWFvIE1pbgogICBaVEUgQ29ycC4KCiAgIEVtYWlsOiB4 aWFvLm1pbjJAenRlLmNvbS5jbgoKCiAgIEhlbnJpayBOeWRlbGwKICAgQWNjZWRpYW4gTmV0d29y a3MKCiAgIEVtYWlsOiBobnlkZWxsQGFjY2VkaWFuLmNvbQoKCiAgIFJpY2hhcmQgRm9vdGUKICAg Tm9raWEKCiAgIEVtYWlsOiBmb290ZXIuZm9vdGVAbm9raWEuY29tCgoKCgoKTWlyc2t5LCBldCBh bC4gICAgICAgICAgRXhwaXJlcyBEZWNlbWJlciAzMSwgMjAyMCAgICAgICAgICAgICAgW1BhZ2Ug MjVdCgwKSW50ZXJuZXQtRHJhZnQgICAgICAgICAgICAgIFNUQU1QIEV4dGVuc2lvbnMgICAgICAg ICAgICAgICAgICAgSnVuZSAyMDIwCgoKICAgQWRpIE1hc3B1dHJhCiAgIEFwcGxlIEluYy4KICAg T25lIEFwcGxlIFBhcmsgV2F5CiAgIEN1cGVydGlubywgQ0EgIDk1MDE0CiAgIFVTQQoKICAgRW1h aWw6IGFkaUBhcHBsZS5jb20KCgogICBFcm5lc3RvIFJ1ZmZpbmkKICAgT3V0U3lzCiAgIHZpYSBD YXJhY2Npb2xvLCA2NQogICBNaWxhbm8gIDIwMTU1CiAgIEl0YWx5CgogICBFbWFpbDogZXJ1ZmZp bmlAb3V0c3lzLm9yZwoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCk1pcnNreSwg ZXQgYWwuICAgICAgICAgIEV4cGlyZXMgRGVjZW1iZXIgMzEsIDIwMjAgICAgICAgICAgICAgIFtQ YWdlIDI2XQo= --000000000000a26e9f05a93ec681 Content-Type: text/html; charset="UTF-8"; name="Diff_ draft-ietf-ippm-stamp-option-tlv-06.txt - draft-ietf-ippm-stamp-option-tlv-07.txt.html" Content-Disposition: attachment; filename="Diff_ draft-ietf-ippm-stamp-option-tlv-06.txt - draft-ietf-ippm-stamp-option-tlv-07.txt.html" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kc0y3r8g1 PCFET0NUWVBFIGh0bWwgUFVCTElDICItLy9XM0MvL0RURCBYSFRNTCAxLjAgVHJhbnNpdGlvbmFs Ly9FTiIgImh0dHA6Ly93d3cudzMub3JnL1RSL3hodG1sMS9EVEQveGh0bWwxLXRyYW5zaXRpb25h bC5kdGQiPgo8IS0tIHNhdmVkIGZyb20gdXJsPSgwMDQyKWh0dHBzOi8vd3d3Ni5pZXRmLm9yZy9y ZmNkaWZmL3JmY2RpZmYucHlodCAtLT4KPGh0bWwgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzE5 OTkveGh0bWwiPjxoZWFkPjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PVVURi04Ij4gCiAgIAogIDxtZXRhIGh0dHAtZXF1aXY9IkNvbnRl bnQtU3R5bGUtVHlwZSIgY29udGVudD0idGV4dC9jc3MiPiAKICA8dGl0bGU+RGlmZjogZHJhZnQt aWV0Zi1pcHBtLXN0YW1wLW9wdGlvbi10bHYtMDYudHh0IC0gZHJhZnQtaWV0Zi1pcHBtLXN0YW1w LW9wdGlvbi10bHYtMDcudHh0PC90aXRsZT4gCiAgPHN0eWxlIHR5cGU9InRleHQvY3NzIj4gCiAg ICBib2R5ICAgIHsgbWFyZ2luOiAwLjRleDsgbWFyZ2luLXJpZ2h0OiBhdXRvOyB9IAogICAgdHIg ICAgICB7IH0gCiAgICB0ZCAgICAgIHsgd2hpdGUtc3BhY2U6IHByZTsgZm9udC1mYW1pbHk6IG1v bm9zcGFjZTsgdmVydGljYWwtYWxpZ246IHRvcDsgZm9udC1zaXplOiAwLjg2ZW07fSAKICAgIHRo ICAgICAgeyBmb250LXNpemU6IDAuODZlbTsgfSAKICAgIC5zbWFsbCAgeyBmb250LXNpemU6IDAu NmVtOyBmb250LXN0eWxlOiBpdGFsaWM7IGZvbnQtZmFtaWx5OiBWZXJkYW5hLCBIZWx2ZXRpY2Es IHNhbnMtc2VyaWY7IH0gCiAgICAubGVmdCAgIHsgYmFja2dyb3VuZC1jb2xvcjogI0VFRTsgfSAK ICAgIC5yaWdodCAgeyBiYWNrZ3JvdW5kLWNvbG9yOiAjRkZGOyB9IAogICAgLmRpZmYgICB7IGJh Y2tncm91bmQtY29sb3I6ICNDQ0Y7IH0gCiAgICAubGJsb2NrIHsgYmFja2dyb3VuZC1jb2xvcjog I0JGQjsgfSAKICAgIC5yYmxvY2sgeyBiYWNrZ3JvdW5kLWNvbG9yOiAjRkY4OyB9IAogICAgLmlu c2VydCB7IGJhY2tncm91bmQtY29sb3I6ICM4RkY7IH0gCiAgICAuZGVsZXRlIHsgYmFja2dyb3Vu ZC1jb2xvcjogI0FDRjsgfSAKICAgIC52b2lkICAgeyBiYWNrZ3JvdW5kLWNvbG9yOiAjRkZCOyB9 IAogICAgLmNvbnQgICB7IGJhY2tncm91bmQtY29sb3I6ICNFRUU7IH0gCiAgICAubGluZWJyIHsg YmFja2dyb3VuZC1jb2xvcjogI0FBQTsgfSAKICAgIC5saW5lbm8geyBjb2xvcjogcmVkOyBiYWNr Z3JvdW5kLWNvbG9yOiAjRkZGOyBmb250LXNpemU6IDAuN2VtOyB0ZXh0LWFsaWduOiByaWdodDsg cGFkZGluZzogMCAycHg7IH0gCiAgICAuZWxpcHNpc3sgYmFja2dyb3VuZC1jb2xvcjogI0FBQTsg fSAKICAgIC5sZWZ0IC5jb250IHsgYmFja2dyb3VuZC1jb2xvcjogI0RERDsgfSAKICAgIC5yaWdo dCAuY29udCB7IGJhY2tncm91bmQtY29sb3I6ICNFRUU7IH0gCiAgICAubGJsb2NrIC5jb250IHsg YmFja2dyb3VuZC1jb2xvcjogIzlEOTsgfSAKICAgIC5yYmxvY2sgLmNvbnQgeyBiYWNrZ3JvdW5k LWNvbG9yOiAjREQ2OyB9IAogICAgLmluc2VydCAuY29udCB7IGJhY2tncm91bmQtY29sb3I6ICMw REQ7IH0gCiAgICAuZGVsZXRlIC5jb250IHsgYmFja2dyb3VuZC1jb2xvcjogIzhBRDsgfSAKICAg IC5zdGF0cywgLnN0YXRzIHRkLCAuc3RhdHMgdGggeyBiYWNrZ3JvdW5kLWNvbG9yOiAjRUVFOyBw YWRkaW5nOiAycHggMDsgfSAKICAgIHNwYW4uaGlkZSB7IGRpc3BsYXk6IG5vbmU7IGNvbG9yOiAj YWFhO30gICAgYTpob3ZlciBzcGFuIHsgZGlzcGxheTogaW5saW5lOyB9ICAgIHRyLmNoYW5nZSB7 IGJhY2tncm91bmQtY29sb3I6IGdyYXk7IH0gCiAgICB0ci5jaGFuZ2UgYSB7IHRleHQtZGVjb3Jh dGlvbjogbm9uZTsgY29sb3I6IGJsYWNrIH0gCiAgPC9zdHlsZT4gCiAgICAgPHNjcmlwdD4KdmFy IGNodW5rX2luZGV4ID0gMDsKdmFyIG9sZF9jaHVuayA9IG51bGw7CgpmdW5jdGlvbiBmb3JtYXRf Y2h1bmsoaW5kZXgpIHsKICAgIHZhciBwcmVmaXggPSAiZGlmZiI7CiAgICB2YXIgc3RyID0gaW5k ZXgudG9TdHJpbmcoKTsKICAgIGZvciAoeD0wOyB4PCg0LXN0ci5sZW5ndGgpOyArK3gpIHsKICAg ICAgICBwcmVmaXgrPScwJzsKICAgIH0KICAgIHJldHVybiBwcmVmaXggKyBzdHI7Cn0KCmZ1bmN0 aW9uIGZpbmRfY2h1bmsobil7CiAgICByZXR1cm4gZG9jdW1lbnQucXVlcnlTZWxlY3RvcigndHJb aWQkPSInICsgbiArICciXScpOwp9CgpmdW5jdGlvbiBjaGFuZ2VfY2h1bmsob2Zmc2V0KSB7CiAg ICB2YXIgaW5kZXggPSBjaHVua19pbmRleCArIG9mZnNldDsKICAgIHZhciBuZXdfc3RyOwogICAg dmFyIG5ld19jaHVuazsKCiAgICBuZXdfc3RyID0gZm9ybWF0X2NodW5rKGluZGV4KTsKICAgIG5l d19jaHVuayA9IGZpbmRfY2h1bmsobmV3X3N0cik7CiAgICBpZiAoIW5ld19jaHVuaykgewogICAg ICAgIHJldHVybjsKICAgIH0KICAgIGlmIChvbGRfY2h1bmspIHsKICAgICAgICBvbGRfY2h1bmsu c3R5bGUub3V0bGluZSA9ICIiOwogICAgfQogICAgb2xkX2NodW5rID0gbmV3X2NodW5rOwogICAg b2xkX2NodW5rLnN0eWxlLm91dGxpbmUgPSAiMXB4IHNvbGlkIHJlZCI7CiAgICB3aW5kb3cubG9j YXRpb24ucmVwbGFjZSgiIyIgKyBuZXdfc3RyKQogICAgd2luZG93LnNjcm9sbEJ5KDAsLTEwMCk7 CiAgICBjaHVua19pbmRleCA9IGluZGV4Owp9Cgpkb2N1bWVudC5vbmtleWRvd24gPSBmdW5jdGlv bihlKSB7CiAgICBzd2l0Y2ggKGUua2V5Q29kZSkgewogICAgY2FzZSA3ODoKICAgICAgICBjaGFu Z2VfY2h1bmsoMSk7CiAgICAgICAgYnJlYWs7CiAgICBjYXNlIDgwOgogICAgICAgIGNoYW5nZV9j aHVuaygtMSk7CiAgICAgICAgYnJlYWs7CiAgICB9Cn07CiAgIDwvc2NyaXB0PiAKPC9oZWFkPiAK PGJvZHkgZGF0YS1nci1jLXMtbG9hZGVkPSJ0cnVlIj4gCiAgPHRhYmxlIGJvcmRlcj0iMCIgY2Vs bHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIj4gCiAgPHRib2R5Pjx0ciBpZD0icGFydC0xIiBi Z2NvbG9yPSJvcmFuZ2UiPjx0aD48L3RoPjx0aD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5v cmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtaXBwbS1zdGFtcC1vcHRpb24tdGx2LTA2LnR4dCIg c3R5bGU9ImNvbG9yOiMwMDg7IHRleHQtZGVjb3JhdGlvbjpub25lOyI+Jmx0OzwvYT4mbmJzcDs8 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1pcHBtLXN0YW1w LW9wdGlvbi10bHYtMDYudHh0IiBzdHlsZT0iY29sb3I6IzAwOCI+ZHJhZnQtaWV0Zi1pcHBtLXN0 YW1wLW9wdGlvbi10bHYtMDYudHh0PC9hPiZuYnNwOzwvdGg+PHRoPiA8L3RoPjx0aD4mbmJzcDs8 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1pcHBtLXN0YW1w LW9wdGlvbi10bHYtMDcudHh0IiBzdHlsZT0iY29sb3I6IzAwOCI+ZHJhZnQtaWV0Zi1pcHBtLXN0 YW1wLW9wdGlvbi10bHYtMDcudHh0PC9hPiZuYnNwOzxhIGhyZWY9Imh0dHBzOi8vd3d3Ni5pZXRm Lm9yZy9yZmNkaWZmP3VybDE9ZHJhZnQtaWV0Zi1pcHBtLXN0YW1wLW9wdGlvbi10bHYtMDcudHh0 IiBzdHlsZT0iY29sb3I6IzAwODsgdGV4dC1kZWNvcmF0aW9uOm5vbmU7Ij4mZ3Q7PC9hPjwvdGg+ PHRoPjwvdGg+PC90cj4gCiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+TmV0d29yayBXb3JraW5nIEdyb3VwICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgRy4gTWlyc2t5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+TmV0d29yayBXb3JraW5nIEdyb3VwICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgRy4gTWlyc2t5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij5JbnRlcm5l dC1EcmFmdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBYLiBNaW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij5JbnRlcm5ldC1EcmFmdCAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBYLiBNaW48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPlVwZGF0ZXM6IDg3NjIgKGlmIGFwcHJvdmVkKSAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFpURSBDb3JwLjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPlVwZGF0ZXM6IDg3NjIgKGlmIGFwcHJvdmVkKSAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIFpURSBDb3JwLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+SW50ZW5kZWQgc3RhdHVzOiBTdGFuZGFyZHMgVHJhY2sgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgSC4gTnlkZWxsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+SW50 ZW5kZWQgc3RhdHVzOiBTdGFuZGFyZHMgVHJhY2sgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgSC4gTnlkZWxsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIg aWQ9ImRpZmYwMDAxIj48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPkV4cGlyZXM6IERlY2VtYmVyIDxzcGFuIGNsYXNzPSJk ZWxldGUiPjI0PC9zcGFuPiwgMjAyMCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQWNjZWRp YW4gTmV0d29ya3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+RXhwaXJlczogRGVj ZW1iZXIgPHNwYW4gY2xhc3M9Imluc2VydCI+MzE8L3NwYW4+LCAyMDIwICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBBY2NlZGlhbiBOZXR3b3JrczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIFIuIEZvb3RlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IFIuIEZvb3RlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTm9raWE8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTm9raWE8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBBLiBNYXNwdXRyYTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBBLiBNYXNwdXRyYTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBB cHBsZSBJbmMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBcHBsZSBJbmMu PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEUuIFJ1ZmZpbmk8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIEUuIFJ1ZmZpbmk8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIE91dFN5czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIE91dFN5czwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy IGlkPSJkaWZmMDAwMiI+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIEp1bmUgMjxzcGFuIGNsYXNzPSJkZWxldGUiPjI8 L3NwYW4+LCAyMDIwPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgSnVuZSAyPHNw YW4gY2xhc3M9Imluc2VydCI+OTwvc3Bhbj4sIDIwMjA8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgICBTaW1wbGUgVHdvLXdheSBBY3RpdmUgTWVhc3VyZW1lbnQgUHJvdG9jb2wg T3B0aW9uYWwgRXh0ZW5zaW9uczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg U2ltcGxlIFR3by13YXkgQWN0aXZlIE1lYXN1cmVtZW50IFByb3RvY29sIE9wdGlvbmFsIEV4dGVu c2lvbnM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlm ZjAwMDMiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgICAgICAgICAgICAgICAgZHJhZnQtaWV0Zi1pcHBtLXN0YW1w LW9wdGlvbi10bHYtMDxzcGFuIGNsYXNzPSJkZWxldGUiPjY8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAgIGRyYWZ0LWlldGYtaXBwbS1zdGFt cC1vcHRpb24tdGx2LTA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij43PC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij5BYnN0cmFjdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPkFic3RyYWN0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoaXMgZG9j dW1lbnQgZGVzY3JpYmVzIG9wdGlvbmFsIGV4dGVuc2lvbnMgdG8gU2ltcGxlIFR3by13YXkgQWN0 aXZlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhpcyBkb2N1bWVudCBkZXNj cmliZXMgb3B0aW9uYWwgZXh0ZW5zaW9ucyB0byBTaW1wbGUgVHdvLXdheSBBY3RpdmU8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIE1lYXN1cmVtZW50IFByb3RvY29sIChTVEFNUCkgd2hp Y2ggZW5hYmxlIG1lYXN1cmVtZW50IHBlcmZvcm1hbmNlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgTWVhc3VyZW1lbnQgUHJvdG9jb2wgKFNUQU1QKSB3aGljaCBlbmFibGUgbWVh c3VyZW1lbnQgcGVyZm9ybWFuY2U8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG1ldHJp Y3MgaW4gYWRkaXRpb24gdG8gb25lcyBzdXBwb3J0ZWQgYnkgdGhlIFNUQU1QIGJhc2U8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBtZXRyaWNzIGluIGFkZGl0aW9uIHRvIG9uZXMg c3VwcG9ydGVkIGJ5IHRoZSBTVEFNUCBiYXNlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBzcGVjaWZpY2F0aW9uLiAgVGhlIGRvY3VtZW50IGFsc28gZGVmaW5lcyBhIFNUQU1QIFRlc3Qg U2Vzc2lvbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHNwZWNpZmljYXRpb24u ICBUaGUgZG9jdW1lbnQgYWxzbyBkZWZpbmVzIGEgU1RBTVAgVGVzdCBTZXNzaW9uPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBJZGVudGlmaWVyIGFuZCB0aHVzIHVwZGF0ZXMgUkZDIDg3 NjIuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgSWRlbnRpZmllciBhbmQgdGh1 cyB1cGRhdGVzIFJGQyA4NzYyLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij5TdGF0 dXMgb2YgVGhpcyBNZW1vPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+U3RhdHVzIG9m IFRoaXMgTWVtbzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHIgaWQ9InBhcnQtMiIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+PHRoPjxzbWFsbD5za2lwcGlu ZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0dHBzOi8vd3d3Ni5pZXRmLm9yZy9yZmNk aWZmL3JmY2RpZmYucHlodCNwYXJ0LTIiPjxlbT4gcGFnZSAxLCBsaW5lIDQyPHNwYW4gY2xhc3M9 ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0aD4gPC90aD48dGg+PHNtYWxsPnNraXBw aW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3Jm Y2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMiI+PGVtPiBwYWdlIDEsIGxpbmUgNDI8c3BhbiBjbGFz cz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgSW50ZXJuZXQtRHJh ZnRzIGFyZSB3b3JraW5nIGRvY3VtZW50cyBvZiB0aGUgSW50ZXJuZXQgRW5naW5lZXJpbmc8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBJbnRlcm5ldC1EcmFmdHMgYXJlIHdvcmtp bmcgZG9jdW1lbnRzIG9mIHRoZSBJbnRlcm5ldCBFbmdpbmVlcmluZzwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgVGFzayBGb3JjZSAoSUVURikuICBOb3RlIHRoYXQgb3RoZXIgZ3JvdXBz IG1heSBhbHNvIGRpc3RyaWJ1dGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBU YXNrIEZvcmNlIChJRVRGKS4gIE5vdGUgdGhhdCBvdGhlciBncm91cHMgbWF5IGFsc28gZGlzdHJp YnV0ZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgd29ya2luZyBkb2N1bWVudHMgYXMg SW50ZXJuZXQtRHJhZnRzLiAgVGhlIGxpc3Qgb2YgY3VycmVudCBJbnRlcm5ldC08L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB3b3JraW5nIGRvY3VtZW50cyBhcyBJbnRlcm5ldC1E cmFmdHMuICBUaGUgbGlzdCBvZiBjdXJyZW50IEludGVybmV0LTwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgRHJhZnRzIGlzIGF0IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZHJh ZnRzL2N1cnJlbnQvLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIERyYWZ0cyBp cyBhdCBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RyYWZ0cy9jdXJyZW50Ly48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBk b2N1bWVudHMgdmFsaWQgZm9yIGEgbWF4aW11bSBvZiBzaXggbW9udGhzPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgSW50ZXJuZXQtRHJhZnRzIGFyZSBkcmFmdCBkb2N1bWVudHMg dmFsaWQgZm9yIGEgbWF4aW11bSBvZiBzaXggbW9udGhzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBhbmQgbWF5IGJlIHVwZGF0ZWQsIHJlcGxhY2VkLCBvciBvYnNvbGV0ZWQgYnkgb3Ro ZXIgZG9jdW1lbnRzIGF0IGFueTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFu ZCBtYXkgYmUgdXBkYXRlZCwgcmVwbGFjZWQsIG9yIG9ic29sZXRlZCBieSBvdGhlciBkb2N1bWVu dHMgYXQgYW55PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0aW1lLiAgSXQgaXMgaW5h cHByb3ByaWF0ZSB0byB1c2UgSW50ZXJuZXQtRHJhZnRzIGFzIHJlZmVyZW5jZTwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRpbWUuICBJdCBpcyBpbmFwcHJvcHJpYXRlIHRvIHVz ZSBJbnRlcm5ldC1EcmFmdHMgYXMgcmVmZXJlbmNlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBtYXRlcmlhbCBvciB0byBjaXRlIHRoZW0gb3RoZXIgdGhhbiBhcyAid29yayBpbiBwcm9n cmVzcy4iPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbWF0ZXJpYWwgb3IgdG8g Y2l0ZSB0aGVtIG90aGVyIHRoYW4gYXMgIndvcmsgaW4gcHJvZ3Jlc3MuIjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDA0Ij48dGQ+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxv Y2siPiAgIFRoaXMgSW50ZXJuZXQtRHJhZnQgd2lsbCBleHBpcmUgb24gRGVjZW1iZXIgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+MjQ8L3NwYW4+LCAyMDIwLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj4gICBUaGlzIEludGVybmV0LURyYWZ0IHdpbGwgZXhwaXJlIG9uIERlY2VtYmVyIDxz cGFuIGNsYXNzPSJpbnNlcnQiPjMxPC9zcGFuPiwgMjAyMC48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+Q29weXJpZ2h0IE5vdGljZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPkNvcHlyaWdodCBOb3RpY2U8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg Q29weXJpZ2h0IChjKSAyMDIwIElFVEYgVHJ1c3QgYW5kIHRoZSBwZXJzb25zIGlkZW50aWZpZWQg YXMgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQ29weXJpZ2h0IChjKSAy MDIwIElFVEYgVHJ1c3QgYW5kIHRoZSBwZXJzb25zIGlkZW50aWZpZWQgYXMgdGhlPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBkb2N1bWVudCBhdXRob3JzLiAgQWxsIHJpZ2h0cyByZXNl cnZlZC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBkb2N1bWVudCBhdXRob3Jz LiAgQWxsIHJpZ2h0cyByZXNlcnZlZC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgVGhpcyBkb2N1bWVudCBpcyBzdWJqZWN0IHRvIEJDUCA3OCBhbmQgdGhlIElFVEYgVHJ1c3Qn cyBMZWdhbDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoaXMgZG9jdW1lbnQg aXMgc3ViamVjdCB0byBCQ1AgNzggYW5kIHRoZSBJRVRGIFRydXN0J3MgTGVnYWw8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFByb3Zpc2lvbnMgUmVsYXRpbmcgdG8gSUVURiBEb2N1bWVu dHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBQcm92aXNpb25zIFJlbGF0aW5n IHRvIElFVEYgRG9jdW1lbnRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAoaHR0cHM6 Ly90cnVzdGVlLmlldGYub3JnL2xpY2Vuc2UtaW5mbykgaW4gZWZmZWN0IG9uIHRoZSBkYXRlIG9m PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgKGh0dHBzOi8vdHJ1c3RlZS5pZXRm Lm9yZy9saWNlbnNlLWluZm8pIGluIGVmZmVjdCBvbiB0aGUgZGF0ZSBvZjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgcHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVudC4gIFBsZWFzZSBy ZXZpZXcgdGhlc2UgZG9jdW1lbnRzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg cHVibGljYXRpb24gb2YgdGhpcyBkb2N1bWVudC4gIFBsZWFzZSByZXZpZXcgdGhlc2UgZG9jdW1l bnRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0i cGFydC0zIiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNo YW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZj ZGlmZi5weWh0I3BhcnQtMyI+PGVtPiBwYWdlIDIsIGxpbmUgMjM8c3BhbiBjbGFzcz0iaGlkZSI+ IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8g Y2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcvcmZjZGlmZi9y ZmNkaWZmLnB5aHQjcGFydC0zIj48ZW0+IHBhZ2UgMiwgbGluZSAyMzxzcGFuIGNsYXNzPSJoaWRl Ij4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBkZXNjcmliZWQgaW4gdGhlIFNp bXBsaWZpZWQgQlNEIExpY2Vuc2UuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ZGVzY3JpYmVkIGluIHRoZSBTaW1wbGlmaWVkIEJTRCBMaWNlbnNlLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij5UYWJsZSBvZiBDb250ZW50czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPlRhYmxlIG9mIENvbnRlbnRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIDEuICBJbnRyb2R1Y3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuICAgMjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIDEu ICBJbnRyb2R1Y3Rpb24gIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuICAgMjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgMi4gIENvbnZlbnRpb25z IFVzZWQgaW4gVGhpcyBEb2N1bWVudCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAzPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgMi4gIENvbnZlbnRpb25zIFVzZWQgaW4g VGhpcyBEb2N1bWVudCAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICAzPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgIDIuMS4gIEFjcm9ueW1zICAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgIDM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgIDIuMS4gIEFjcm9ueW1zICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgIDM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAg Mi4yLiAgUmVxdWlyZW1lbnRzIExhbmd1YWdlIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuICAgMzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgMi4yLiAgUmVx dWlyZW1lbnRzIExhbmd1YWdlIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAg MzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgMy4gIFNUQU1QIFRlc3QgU2Vzc2lvbiBJ ZGVudGlmaWVyIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA0PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgMy4gIFNUQU1QIFRlc3QgU2Vzc2lvbiBJZGVudGlmaWVy IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA0PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICA0LiAgVExWIEV4dGVuc2lvbnMgdG8gU1RBTVAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgIDg8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICA0LiAgVExWIEV4dGVuc2lvbnMgdG8gU1RBTVAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgIDg8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 ciBpZD0iZGlmZjAwMDUiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA0LjEuICBFeHRyYSBQYWRkaW5nIFRMViAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gICA8c3BhbiBjbGFzcz0iZGVs ZXRlIj45PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDQuMS4g IEV4dHJhIFBhZGRpbmcgVExWIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MTA8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPiAgICAgNC4yLiAgTG9jYXRpb24gVExWICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4xMDwvc3Bhbj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA0LjIuICBMb2NhdGlvbiBUTFYgIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJpbnNl cnQiPjExPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgIDQuMy4gIFRp bWVzdGFtcCBJbmZvcm1hdGlvbiBUTFYgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAg PHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTE8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPiAgICAgNC4zLiAgVGltZXN0YW1wIEluZm9ybWF0aW9uIFRMViAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xMjwvc3Bhbj48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA0LjQuICBDbGFzcyBvZiBTZXJ2aWNlIFRMViAg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUi PjEyPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDQuNC4gIENs YXNzIG9mIFNlcnZpY2UgVExWICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAg PHNwYW4gY2xhc3M9Imluc2VydCI+MTM8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICAgIDQuNS4gIERpcmVjdCBNZWFzdXJlbWVudCBUTFYgIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgMTQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgIDQu NS4gIERpcmVjdCBNZWFzdXJlbWVudCBUTFYgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAgMTQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgNC42LiAgQWNjZXNzIFJl cG9ydCBUTFYgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxNTwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgNC42LiAgQWNjZXNzIFJlcG9ydCBUTFYg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxNTwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDAwNiI+PHRkPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICAgIDQuNy4gIEZvbGxvdy11cCBUZWxlbWV0cnkgVExWIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAgMTxzcGFuIGNsYXNzPSJkZWxldGUiPjY8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgNC43LiAgRm9sbG93LXVwIFRlbGVtZXRyeSBUTFYgLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxPHNwYW4gY2xhc3M9Imluc2VydCI+Nzwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgNC44LiAgSE1BQyBUTFYgIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxODwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgNC44LiAgSE1BQyBUTFYgIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICAxODwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDAwNyI+PHRkPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICA1 LiAgSUFOQSBDb25zaWRlcmF0aW9ucyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MTk8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIDUuICBJQU5BIENvbnNpZGVyYXRpb25zIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yMDwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA1LjEuICBTVEFNUCBUTFYgUmVn aXN0cnkgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNz PSJkZWxldGUiPjE5PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAg IDUuMS4gIFNUQU1QIFRMViBSZWdpc3RyeSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjA8L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgICAgNS4yLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U3luY2hyb25pemF0 aW9uIFNvdXJjZTwvc3Bhbj4gU3ViLXJlZ2lzdHJ5IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgMjA8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA1LjIuICA8c3BhbiBjbGFzcz0i aW5zZXJ0Ij5TVEFNUCBUTFYgRmxhZ3M8L3NwYW4+IFN1Yi1yZWdpc3RyeSAgLiAuIC4gLiAuIC4g LiAuIC4gLiAuIDxzcGFuIGNsYXNzPSJpbnNlcnQiPi4gLiAuPC9zcGFuPiAgMjA8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA1LjMuICBUaW1lc3RhbXBpbmcgTWV0aG9kIFN1Yi1y ZWdpc3RyeSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPjIw PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgIDUuMy4gIDxzcGFu IGNsYXNzPSJpbnNlcnQiPlN5bmNocm9uaXphdGlvbiBTb3VyY2UgU3ViLXJlZ2lzdHJ5IC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAgMjE8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgICAgNS40Ljwvc3Bhbj4gIFJldHVybiBDb2RlIFN1Yi1y ZWdpc3RyeSAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRl bGV0ZSI+MjE8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNs YXNzPSJpbnNlcnQiPiAgICAgNS40Ljwvc3Bhbj4gIFRpbWVzdGFtcGluZyBNZXRob2QgU3ViLXJl Z2lzdHJ5ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjI8 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIDYuICBTZWN1cml0eSBDb25z aWRlcmF0aW9ucyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBj bGFzcz0iZGVsZXRlIj4yMjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICA1LjUuPC9zcGFuPiAgUmV0dXJuIENvZGUgU3ViLXJl Z2lzdHJ5ICAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4yMzwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgNy4gIEFja25v d2xlZGdtZW50cyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g IDxzcGFuIGNsYXNzPSJkZWxldGUiPjIyPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj4gICA2LiAgU2VjdXJpdHkgQ29uc2lkZXJhdGlvbnMgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjM8L3NwYW4+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIDguICBDb250cmlidXRvcnMgIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRl Ij4yMjwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgNy4gIEFja25v d2xlZGdtZW50cyAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g IDxzcGFuIGNsYXNzPSJpbnNlcnQiPjIzPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj4gICA5LiAgUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjI8L3NwYW4+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIDguICBDb250cmlidXRvcnMgIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0 Ij4yNDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICA5LjEuICBOb3Jt YXRpdmUgUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxz cGFuIGNsYXNzPSJkZWxldGUiPjIyPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJs b2NrIj4gICA5LiAgUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu IC4gLiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9Imluc2VydCI+MjQ8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgOS4yLiAgSW5mb3JtYXRpdmUgUmVmZXJlbmNlcyAg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4y Mzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICA5LjEuICBOb3Jt YXRpdmUgUmVmZXJlbmNlcyAgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gIDxz cGFuIGNsYXNzPSJpbnNlcnQiPjI0PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij4gICBBdXRob3JzJyBBZGRyZXNzZXMgIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+MjQ8L3NwYW4+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgOS4yLiAgSW5mb3JtYXRpdmUgUmVmZXJlbmNlcyAg LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4y NTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgIEF1dGhvcnMnIEFkZHJlc3NlcyAgLiAuIC4gLiAuIC4gLiAuIC4g LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yNTwvc3Bh bj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+MS4gIEludHJvZHVjdGlvbjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjEuICBJbnRyb2R1Y3Rpb248L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgU2ltcGxlIFR3by13YXkgQWN0aXZlIE1lYXN1cmVtZW50 IFByb3RvY29sIChTVEFNUCkgW1JGQzg3NjJdIHN1cHBvcnRzPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgU2ltcGxlIFR3by13YXkgQWN0aXZlIE1lYXN1cmVtZW50IFByb3RvY29s IChTVEFNUCkgW1JGQzg3NjJdIHN1cHBvcnRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICB0aGUgdXNlIG9mIG9wdGlvbmFsIGV4dGVuc2lvbnMgdGhhdCB1c2UgVHlwZS1MZW5ndGgtVmFs dWUgKFRMVik8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgdXNlIG9mIG9w dGlvbmFsIGV4dGVuc2lvbnMgdGhhdCB1c2UgVHlwZS1MZW5ndGgtVmFsdWUgKFRMVik8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGVuY29kaW5nLiAgU3VjaCBleHRlbnNpb25zIGVuaGFu Y2UgdGhlIFNUQU1QIGJhc2UgZnVuY3Rpb25zLCBzdWNoIGFzPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgZW5jb2RpbmcuICBTdWNoIGV4dGVuc2lvbnMgZW5oYW5jZSB0aGUgU1RB TVAgYmFzZSBmdW5jdGlvbnMsIHN1Y2ggYXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IG1lYXN1cmVtZW50IG9mIG9uZS13YXkgYW5kIHJvdW5kLXRyaXAgZGVsYXksIGxhdGVuY3ksIHBh Y2tldCBsb3NzLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG1lYXN1cmVtZW50 IG9mIG9uZS13YXkgYW5kIHJvdW5kLXRyaXAgZGVsYXksIGxhdGVuY3ksIHBhY2tldCBsb3NzLDwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDAwOCI+ PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj4gICBhbmQgdGhlIGFiaWxpdHkgdG8gZGV0ZWN0IHBhY2tldCBkdXBsaWNhdGlv biBhbmQgb3V0LW9mLTxzcGFuIGNsYXNzPSJkZWxldGUiPiA8L3NwYW4+b3JkZXI8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgYW5kIHRoZSBhYmlsaXR5IHRvIGRldGVjdCBwYWNr ZXQgZHVwbGljYXRpb24gYW5kIG91dC1vZi1vcmRlcjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgZGVsaXZlcnkgb2YgdGhlIHRlc3QgcGFja2V0cy4gIFRoaXMgc3BlY2lmaWNhdGlvbiBk ZWZpbmVzIG9wdGlvbmFsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZGVsaXZl cnkgb2YgdGhlIHRlc3QgcGFja2V0cy4gIFRoaXMgc3BlY2lmaWNhdGlvbiBkZWZpbmVzIG9wdGlv bmFsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBTVEFNUCBleHRlbnNpb25zLCB0aGVp ciBmb3JtYXRzLCBhbmQgdGhlIHRoZW9yeSBvZiBvcGVyYXRpb24uICBBbHNvLDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFNUQU1QIGV4dGVuc2lvbnMsIHRoZWlyIGZvcm1hdHMs IGFuZCB0aGUgdGhlb3J5IG9mIG9wZXJhdGlvbi4gIEFsc28sPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICBhIFNUQU1QIFRlc3QgU2Vzc2lvbiBJZGVudGlmaWVyIGlzIGRlZmluZWQgYXMg YW4gdXBkYXRlIG9mIHRoZSBiYXNlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg YSBTVEFNUCBUZXN0IFNlc3Npb24gSWRlbnRpZmllciBpcyBkZWZpbmVkIGFzIGFuIHVwZGF0ZSBv ZiB0aGUgYmFzZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgU1RBTVAgc3BlY2lmaWNh dGlvbiBbUkZDODc2Ml0uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgU1RBTVAg c3BlY2lmaWNhdGlvbiBbUkZDODc2Ml0uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PjIuICBDb252ZW50aW9ucyBVc2VkIGluIFRoaXMgRG9jdW1lbnQ8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4yLiAgQ29udmVudGlvbnMgVXNlZCBpbiBUaGlzIERvY3VtZW50PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjIuMS4gIEFjcm9ueW1zPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+Mi4xLiAgQWNyb255bXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgU1RBTVAgU2ltcGxlIFR3by13YXkgQWN0aXZlIE1lYXN1cmVtZW50IFByb3Rv Y29sPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgU1RBTVAgU2ltcGxlIFR3by13 YXkgQWN0aXZlIE1lYXN1cmVtZW50IFByb3RvY29sPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0icGFydC00IiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90 ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6 Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtNCI+PGVtPiBwYWdlIDUs IGxpbmUgMjM8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8 L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRw czovL3d3dzYuaWV0Zi5vcmcvcmZjZGlmZi9yZmNkaWZmLnB5aHQjcGFydC00Ij48ZW0+IHBhZ2Ug NSwgbGluZSAyMzxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICB8ICAgICAgICAgRXJyb3IgRXN0aW1hdGUgICAgICAgIHwgICAgICAgICAgICAg U1NJRCAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg IHwgICAgICAgICBFcnJvciBFc3RpbWF0ZSAgICAgICAgfCAgICAgICAgICAgICBTU0lEICAgICAg ICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgIE1C WiAoMjggb2N0ZXRzKSAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgTUJaICgyOCBvY3Rl dHMpICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHIgaWQ9ImRpZmYwMDA5Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIDxzcGFuIGNsYXNzPSJkZWxl dGUiPnwgICAgICAgICAgICAgVHlwZSAgICAgICAgICAgICAgfCAgICAgICAgICAgTGVuZ3RoICAg ICAgICAgICAgICB8PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAg ICB+ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPlRMVnM8 L3NwYW4+ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3NwYW4+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj4gICAgICB+ICAgICAgICAgICAgICAgICAgICAgICAgICAgIDxzcGFuIGNsYXNzPSJkZWxl dGUiPlZhbHVlPC9zcGFuPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAg ICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEZpZ3VyZSAxOiBBbiBleGFtcGxl IG9mIGFuIGV4dGVuZGVkIFNUQU1QIFNlc3Npb24tU2VuZGVyIHRlc3QgcGFja2V0PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgRmlndXJlIDE6IEFuIGV4YW1wbGUgb2YgYW4gZXh0 ZW5kZWQgU1RBTVAgU2Vzc2lvbi1TZW5kZXIgdGVzdCBwYWNrZXQ8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgICAgICAgICAgICAgICAgICAgICBmb3JtYXQgaW4gdW5hdXRoZW50aWNhdGVk IG1vZGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAg ICAgZm9ybWF0IGluIHVuYXV0aGVudGljYXRlZCBtb2RlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIEFuIGltcGxlbWVudGF0aW9uIG9mIFNUQU1QIFNlc3Npb24tUmVmbGVjdG9y IHRoYXQgc3VwcG9ydHMgdGhpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEFu IGltcGxlbWVudGF0aW9uIG9mIFNUQU1QIFNlc3Npb24tUmVmbGVjdG9yIHRoYXQgc3VwcG9ydHMg dGhpczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgc3BlY2lmaWNhdGlvbiBTSE9VTEQg aWRlbnRpZnkgYSBTVEFNUCBTZXNzaW9uIHVzaW5nIHRoZSBTU0lEIGluPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgc3BlY2lmaWNhdGlvbiBTSE9VTEQgaWRlbnRpZnkgYSBTVEFN UCBTZXNzaW9uIHVzaW5nIHRoZSBTU0lEIGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBjb21iaW5hdGlvbiB3aXRoIGVsZW1lbnRzIG9mIHRoZSB1c3VhbCA0LXR1cGxlIGZvciB0aGUg c2Vzc2lvbi48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBjb21iaW5hdGlvbiB3 aXRoIGVsZW1lbnRzIG9mIHRoZSB1c3VhbCA0LXR1cGxlIGZvciB0aGUgc2Vzc2lvbi48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEJlZm9yZSBhIHRlc3Qgc2Vzc2lvbiBjb21tZW5jZXMs IGEgU2Vzc2lvbi1SZWZsZWN0b3IgTVVTVCBiZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIEJlZm9yZSBhIHRlc3Qgc2Vzc2lvbiBjb21tZW5jZXMsIGEgU2Vzc2lvbi1SZWZsZWN0 b3IgTVVTVCBiZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcHJvdmlzaW9uZWQgd2l0 aCBhbGwgdGhlIGVsZW1lbnRzIHRoYXQgaWRlbnRpZnkgdGhlIFNUQU1QIFNlc3Npb24uICBBPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcHJvdmlzaW9uZWQgd2l0aCBhbGwgdGhl IGVsZW1lbnRzIHRoYXQgaWRlbnRpZnkgdGhlIFNUQU1QIFNlc3Npb24uICBBPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0icGFydC01IiBjbGFzcz0i Y2hhbmdlIj48dGQ+PC90ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+ PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQt NSI+PGVtPiBwYWdlIDYsIGxpbmUgMjc8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+ PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFs bD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcvcmZjZGlmZi9yZmNkaWZmLnB5aHQjcGFy dC01Ij48ZW0+IHBhZ2UgNiwgbGluZSAyNzxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9l bT48L2E+PC90aD48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICB8ICAg ICAgICAgICAgICAgICBTZXNzaW9uLVNlbmRlciBTZXF1ZW5jZSBOdW1iZXIgICAgICAgICAgICAg ICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICB8ICAgICAgICAgICAgICAg ICBTZXNzaW9uLVNlbmRlciBTZXF1ZW5jZSBOdW1iZXIgICAgICAgICAgICAgICAgfDwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgfCAg ICAgICAgICAgICAgICAgIFNlc3Npb24tU2VuZGVyIFRpbWVzdGFtcCAgICAgICAgICAgICAgICAg ICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgfCAgICAgICAgICAgICAg ICAgIFNlc3Npb24tU2VuZGVyIFRpbWVzdGFtcCAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgfCBTZXNzaW9uLVNlbmRlciBFcnJvciBFc3RpbWF0 ZSB8ICAgICAgICAgICBNQlogICAgICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgfCBTZXNzaW9uLVNlbmRlciBFcnJvciBFc3RpbWF0ZSB8ICAgICAgICAg ICBNQlogICAgICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAr LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICArLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgIHxTZXMtU2VuZGVyIFRUTCB8ICAgICAgICAgICAg ICAgICAgIE1CWiAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgIHxTZXMtU2VuZGVyIFRUTCB8ICAgICAgICAgICAgICAgICAgIE1CWiAg ICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAg Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMTAiPjx0 ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxibG9jayI+ICAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPnwgICAgICAgICAgICAgVHlwZSAgICAg ICAgICAgICAgfCAgICAgICAgICAgTGVuZ3RoICAgICAgICAgICAgICB8PC9zcGFuPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgfiAgICAgICAgICAgICAgICAgICAgICAgICAg ICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5UTFZzPC9zcGFuPiAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxl dGUiPiAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKzwvc3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICB+ICAgICAgICAgICAgICAgICAgICAg ICAgICAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPlZhbHVlPC9zcGFuPiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIH48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg ICBGaWd1cmUgMjogQW4gZXhhbXBsZSBvZiBhbiBleHRlbmRlZCBTVEFNUCBTZXNzaW9uLVJlZmxl Y3RvciB0ZXN0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICBGaWd1cmUgMjog QW4gZXhhbXBsZSBvZiBhbiBleHRlbmRlZCBTVEFNUCBTZXNzaW9uLVJlZmxlY3RvciB0ZXN0PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgICAgcGFja2V0IGZvcm1h dCBpbiB1bmF1dGhlbnRpY2F0ZWQgbW9kZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgICAgICAgICAgICAgICAgICBwYWNrZXQgZm9ybWF0IGluIHVuYXV0aGVudGljYXRlZCBtb2Rl PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEEgU1RBTVAgU2Vzc2lvbi1SZWZs ZWN0b3IgdGhhdCBkb2VzIG5vdCBzdXBwb3J0IHRoaXMgc3BlY2lmaWNhdGlvbiw8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBBIFNUQU1QIFNlc3Npb24tUmVmbGVjdG9yIHRoYXQg ZG9lcyBub3Qgc3VwcG9ydCB0aGlzIHNwZWNpZmljYXRpb24sPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICB3aWxsIHJldHVybiB0aGUgemVyb2VkIFNTSUQgZmllbGQgaW4gdGhlIHJlZmxl Y3RlZCBTVEFNUCB0ZXN0IHBhY2tldC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICB3aWxsIHJldHVybiB0aGUgemVyb2VkIFNTSUQgZmllbGQgaW4gdGhlIHJlZmxlY3RlZCBTVEFN UCB0ZXN0IHBhY2tldC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBTZXNzaW9u LVNlbmRlciBNQVkgc3RvcCB0aGUgc2Vzc2lvbiBpZiBpdCByZWNlaXZlcyBhIHplcm9lZCBTU0lE PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhlIFNlc3Npb24tU2VuZGVyIE1B WSBzdG9wIHRoZSBzZXNzaW9uIGlmIGl0IHJlY2VpdmVzIGEgemVyb2VkIFNTSUQ8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGZpZWxkLiAgQW4gaW1wbGVtZW50YXRpb24gb2YgYSBTZXNz aW9uLVNlbmRlciBNVVNUIHN1cHBvcnQgY29udHJvbCBvZjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIGZpZWxkLiAgQW4gaW1wbGVtZW50YXRpb24gb2YgYSBTZXNzaW9uLVNlbmRl ciBNVVNUIHN1cHBvcnQgY29udHJvbCBvZjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg aXRzIGJlaGF2aW9yIGluIHN1Y2ggYSBzY2VuYXJpby4gIElmIHRoZSB0ZXN0IHNlc3Npb24gaXMg bm90IHN0b3BwZWQsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaXRzIGJlaGF2 aW9yIGluIHN1Y2ggYSBzY2VuYXJpby4gIElmIHRoZSB0ZXN0IHNlc3Npb24gaXMgbm90IHN0b3Bw ZWQsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0i cGFydC02IiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNo YW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZj ZGlmZi5weWh0I3BhcnQtNiI+PGVtPiBwYWdlIDgsIGxpbmUgNDc8c3BhbiBjbGFzcz0iaGlkZSI+ IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tpcHBpbmcgdG8g Y2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcvcmZjZGlmZi9y ZmNkaWZmLnB5aHQjcGFydC02Ij48ZW0+IHBhZ2UgOCwgbGluZSA0NzxzcGFuIGNsYXNzPSJoaWRl Ij4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBmaWVsZCBpbiB0aGUgU1RBTVAg dGVzdCBwYWNrZXQuICBNdWx0aXBsZSBUTFZzIE1BWSBiZSBwbGFjZWQgaW4gdGhlPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZmllbGQgaW4gdGhlIFNUQU1QIHRlc3QgcGFja2V0 LiAgTXVsdGlwbGUgVExWcyBNQVkgYmUgcGxhY2VkIGluIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgU1RBTVAgdGVzdCBwYWNrZXQuICBBIFRMViBNQVkgYmUgZW5jbG9zZWQgaW4g YSBUTFYuICBUTFZzIGhhdmUgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg U1RBTVAgdGVzdCBwYWNrZXQuICBBIFRMViBNQVkgYmUgZW5jbG9zZWQgaW4gYSBUTFYuICBUTFZz IGhhdmUgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0d28gb2N0ZXRzIGxvbmcg VHlwZSBmaWVsZCwgdHdvIG9jdGV0cyBsb25nIExlbmd0aCBmaWVsZCB0aGF0IGlzPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdHdvIG9jdGV0cyBsb25nIFR5cGUgZmllbGQsIHR3 byBvY3RldHMgbG9uZyBMZW5ndGggZmllbGQgdGhhdCBpczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgZXF1YWwgdG8gdGhlIGxlbmd0aCBvZiB0aGUgVmFsdWUgZmllbGQgaW4gb2N0ZXRz LiAgSWYgYSBUeXBlIHZhbHVlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZXF1 YWwgdG8gdGhlIGxlbmd0aCBvZiB0aGUgVmFsdWUgZmllbGQgaW4gb2N0ZXRzLiAgSWYgYSBUeXBl IHZhbHVlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBmb3IgVExWIG9yIHN1Yi1UTFYg aXMgaW4gdGhlIHJhbmdlIGZvciBWZW5kb3IgUHJpdmF0ZSBVc2UsIHRoZSBMZW5ndGg8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBmb3IgVExWIG9yIHN1Yi1UTFYgaXMgaW4gdGhl IHJhbmdlIGZvciBWZW5kb3IgUHJpdmF0ZSBVc2UsIHRoZSBMZW5ndGg8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIE1VU1QgYmUgYXQgbGVhc3QgNCwgYW5kIHRoZSBmaXJzdCBmb3VyIG9j dGV0cyBNVVNUIGJlIHRoYXQgdmVuZG9yJ3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBNVVNUIGJlIGF0IGxlYXN0IDQsIGFuZCB0aGUgZmlyc3QgZm91ciBvY3RldHMgTVVTVCBi ZSB0aGF0IHZlbmRvcidzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0aGUgU3RydWN0 dXJlIG9mIE1hbmFnZW1lbnQgSW5mb3JtYXRpb24gKFNNSSkgUHJpdmF0ZSBFbnRlcnByaXNlPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdGhlIFN0cnVjdHVyZSBvZiBNYW5hZ2Vt ZW50IEluZm9ybWF0aW9uIChTTUkpIFByaXZhdGUgRW50ZXJwcmlzZTwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgQ29kZXMsIGFzIHJlY29yZGVkIGluIElBTkEncyBTTUkgUHJpdmF0ZSBF bnRlcnByaXNlIENvZGVzIHN1Yi08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBD b2RlcywgYXMgcmVjb3JkZWQgaW4gSUFOQSdzIFNNSSBQcml2YXRlIEVudGVycHJpc2UgQ29kZXMg c3ViLTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcmVnaXN0cnksIGluIG5ldHdvcmsg b2N0ZXQgb3JkZXIuICBUaGUgcmVzdCBvZiB0aGUgVmFsdWUgZmllbGQgaXM8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICByZWdpc3RyeSwgaW4gbmV0d29yayBvY3RldCBvcmRlci4g IFRoZSByZXN0IG9mIHRoZSBWYWx1ZSBmaWVsZCBpczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgcHJpdmF0ZSB0byB0aGUgdmVuZG9yLiAgVGhlIGZvbGxvd2luZyBzZWN0aW9ucyBkZXNj cmliZSB0aGUgdXNlIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcHJpdmF0 ZSB0byB0aGUgdmVuZG9yLiAgVGhlIGZvbGxvd2luZyBzZWN0aW9ucyBkZXNjcmliZSB0aGUgdXNl IG9mPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYw MDExIj48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPiAgIFRMVnMgZm9yIFNUQU1QIHRoYXQgZXh0ZW5kIFNUQU1QIGNhcGFi aWxpdHkgYmV5b25kIGl0cyBiYXNlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IFRMVnMgZm9yIFNUQU1QIHRoYXQgZXh0ZW5kPHNwYW4gY2xhc3M9Imluc2VydCI+czwvc3Bhbj4g U1RBTVAgY2FwYWJpbGl0eSBiZXlvbmQgaXRzIGJhc2U8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIHNwZWNpZmljYXRpb24uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg c3BlY2lmaWNhdGlvbi48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyIGlkPSJkaWZmMDAxMiI+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgICAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjAgICAgICAgICAgICAgICAgICAg MSAgICAgICAgICAgICAgICAgICAyICAgICAgICAgICAgICAgICAgIDM8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQg NSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xh c3M9Imluc2VydCI+ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5z ZXJ0Ij4gICAgICB8VXxMfFJ8UnxSfFJ8UnxSfCAgICAgVHlwZSAgICAgIHwgICAgICAgICAgIExl bmd0aCAgICAgICAgICAgICAgfDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAg ICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgfiAg ICAgICAgICAgICAgICAgICAgICAgICAgICBWYWx1ZSAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIH48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICArLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwv c3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNs YXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgRmlndXJlIDU6IFRMViBGb3JtYXQgaW4gYSBTVEFN UCBFeHRlbmRlZCBQYWNrZXQ8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij48L3Nw YW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICB3aGVyZSBmaWVsZHMgYXJlIGRlZmlu ZWQgYXMgdGhlIGZvbGxvd2luZzo8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2si PjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij48 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBvICBVIC0gYSBvbmUtYml0IGZs YWcsIGxvY2F0ZWQgYXMgc3BlY2lmaWVkIGluIFNlY3Rpb24gNS4yLiAgQTwvc3Bhbj48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgIFNlc3Npb24tU2VuZGVyIE1VU1Qgc2V0IHRoZSBV IGZsYWcgdG8gMCBiZWZvcmUgdHJhbnNtaXR0aW5nIGFuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xh c3M9Imluc2VydCI+ICAgICAgZXh0ZW5kZWQgU1RBTVAgdGVzdCBwYWNrZXQuICBBIFNlc3Npb24t UmVmbGVjdG9yIE1VU1Qgc2V0IHRoZSBVPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2Vy dCI+ICAgICAgZmxhZyB0byAxIGlmIHRoZSBTZXNzaW9uLVJlZmxlY3RvciBoYXMgbm90IHVuZGVy c3Rvb2QgdGhlIFRMVi48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij48L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBvICBMIC0gYSBvbmUtYml0IGZsYWcsIGxv Y2F0ZWQgYXMgc3BlY2lmaWVkIGluIFNlY3Rpb24gNS4yLiAgQTwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFu IGNsYXNzPSJpbnNlcnQiPiAgICAgIFNlc3Npb24tU2VuZGVyIE1VU1Qgc2V0IHRoZSBMIGZsYWcg dG8gMCBiZWZvcmUgdHJhbnNtaXR0aW5nIGFuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imlu c2VydCI+ICAgICAgZXh0ZW5kZWQgU1RBTVAgdGVzdCBwYWNrZXQuICBBIFNlc3Npb24tUmVmbGVj dG9yIE1VU1Qgc2V0IHRoZSBMPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAg ICAgZmxhZyB0byAxIGlmIHRoZSBTZXNzaW9uLVJlZmxlY3RvciBkZXRlcm1pbmVkIHRoZSBUTFYg aXM8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBtYWxmb3JtZWQsIGku ZS4sIHRoZSBMZW5ndGggZmllbGQgdmFsdWUgb2YgdGhlIGZpeGVkLXNpemUgVExWIGlzPC9zcGFu PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgbm90IGVxdWFsIHRvIHRoZSB2YWx1 ZSBkZWZpbmVkIGZvciB0aGUgcGFydGljdWxhciB0eXBlLCBvciB0aGU8L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICByZW1haW5pbmcgbGVuZ3RoIG9mIHRoZSBleHRlbmRl ZCBTVEFNUCBwYWNrZXQgaXMgbGVzcyB0aGFuIHRoZTwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNz PSJpbnNlcnQiPiAgICAgIHNpemUgb2YgdGhlIFRMVi48L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFz cz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBvICBSIC0g cmVzZXJ2ZWQgZmxhZ3MgZm9yIGZ1dHVyZSB1c2UuICBUaGVzZSBmbGFncyBNVVNUIGJlIHplcm9l ZCBvbjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgIHRyYW5zbWl0IGFu ZCBpZ25vcmVkIG9uIHJlY2VpcHQuPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2Nr Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgbyAgVHlwZSAtIG9uZS1vY3Rl dCBsb25nIGZpZWxkIHRoYXQgY2hhcmFjdGVyaXplcyB0aGUgaW50ZXJwcmV0YXRpb248L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBvZiB0aGUgVmFsdWUgZmllbGQuICBJ dCBpcyBhbGxvY2F0ZWQgYnkgSUFOQSwgYXMgc3BlY2lmaWVkIGluPC9zcGFuPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNw YW4gY2xhc3M9Imluc2VydCI+ICAgICAgU2VjdGlvbiA1LjE8L3NwYW4+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBj bGFzcz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBvICBM ZW5ndGggLSB0d28tb2N0ZXRzIGxvbmcgZmllbGQgZXF1YWxzIGxlbmd0aCBvbiB0aGUgVmFsdWUg ZmllbGQgaW48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBvY3RldHMu PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4g Y2xhc3M9Imluc2VydCI+ICAgbyAgVmFsdWUgLSBhIHZhcmlhYmxlLWxlbmd0aCBmaWVsZC4gIEl0 cyBpbnRlcnByZXRhdGlvbiBhbmQgZW5jb2Rpbmc8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0i aW5zZXJ0Ij4gICAgICBkZXRlcm1pbmVkIGJ5IHRoZSB2YWx1ZSBvZiB0aGUgVHlwZSBmaWVsZC48 L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBBIFNUQU1QIG5vZGUsIHdoZXRoZXIgU2Vzc2lvbi1TZW5kZXIgb3IgU2Vzc2lvbi1SZWZs ZWN0b3IsIHJlY2VpdmluZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEEgU1RB TVAgbm9kZSwgd2hldGhlciBTZXNzaW9uLVNlbmRlciBvciBTZXNzaW9uLVJlZmxlY3RvciwgcmVj ZWl2aW5nPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhIHRlc3QgcGFja2V0IE1VU1Qg ZGV0ZXJtaW5lIHdoZXRoZXIgdGhlIHBhY2tldCBpcyBhIGJhc2UgU1RBTVA8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBhIHRlc3QgcGFja2V0IE1VU1QgZGV0ZXJtaW5lIHdoZXRo ZXIgdGhlIHBhY2tldCBpcyBhIGJhc2UgU1RBTVA8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIHBhY2tldCBvciBpbmNsdWRlcyBvbmUgb3IgbW9yZSBUTFZzLiAgVGhlIG5vZGUgTVVTVCBj b21wYXJlIHRoZSB2YWx1ZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHBhY2tl dCBvciBpbmNsdWRlcyBvbmUgb3IgbW9yZSBUTFZzLiAgVGhlIG5vZGUgTVVTVCBjb21wYXJlIHRo ZSB2YWx1ZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW4gdGhlIExlbmd0aCBmaWVs ZCBvZiB0aGUgVURQIGhlYWRlciBhbmQgdGhlIGxlbmd0aCBvZiB0aGUgYmFzZTwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGluIHRoZSBMZW5ndGggZmllbGQgb2YgdGhlIFVEUCBo ZWFkZXIgYW5kIHRoZSBsZW5ndGggb2YgdGhlIGJhc2U8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIFNUQU1QIHRlc3QgcGFja2V0IGluIHRoZSBtb2RlLCB1bmF1dGhlbnRpY2F0ZWQgb3Ig YXV0aGVudGljYXRlZCBiYXNlZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFNU QU1QIHRlc3QgcGFja2V0IGluIHRoZSBtb2RlLCB1bmF1dGhlbnRpY2F0ZWQgb3IgYXV0aGVudGlj YXRlZCBiYXNlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgb24gdGhlIGNvbmZpZ3Vy YXRpb24gb2YgdGhlIHBhcnRpY3VsYXIgU1RBTVAgdGVzdCBzZXNzaW9uLiAgSWYgdGhlPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgb24gdGhlIGNvbmZpZ3VyYXRpb24gb2YgdGhl IHBhcnRpY3VsYXIgU1RBTVAgdGVzdCBzZXNzaW9uLiAgSWYgdGhlPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBkaWZmZXJlbmNlIGJldHdlZW4gdGhlIHR3byB2YWx1ZXMgaXMgbGFyZ2Vy IHRoYW4gdGhlIGxlbmd0aCBvZiBVRFA8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBkaWZmZXJlbmNlIGJldHdlZW4gdGhlIHR3byB2YWx1ZXMgaXMgbGFyZ2VyIHRoYW4gdGhlIGxl bmd0aCBvZiBVRFA8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGhlYWRlciwgdGhlbiB0 aGUgdGVzdCBwYWNrZXQgaW5jbHVkZXMgb25lIG9yIG1vcmUgU1RBTVAgVExWcyB0aGF0PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaGVhZGVyLCB0aGVuIHRoZSB0ZXN0IHBhY2tl dCBpbmNsdWRlcyBvbmUgb3IgbW9yZSBTVEFNUCBUTFZzIHRoYXQ8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIGltbWVkaWF0ZWx5IGZvbGxvdyB0aGUgYmFzZSBTVEFNUCB0ZXN0IHBhY2tl dC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBpbW1lZGlhdGVseSBmb2xsb3cg dGhlIGJhc2UgU1RBTVAgdGVzdCBwYWNrZXQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgIEEgc3lzdGVtIHRoYXQgaGFzIHJlY2VpdmVkIGEgU1RBTVAgdGVzdCBwYWNrZXQgd2l0 aCBleHRlbnNpb24gVExWczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEEgc3lz dGVtIHRoYXQgaGFzIHJlY2VpdmVkIGEgU1RBTVAgdGVzdCBwYWNrZXQgd2l0aCBleHRlbnNpb24g VExWczwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgTVVTVCB2YWxpZGF0ZSBlYWNoIFRM Vjo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBNVVNUIHZhbGlkYXRlIGVhY2gg VExWOjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9 ImRpZmYwMDEzIj48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIGlmIDxzcGFuIGNsYXNzPSJkZWxldGUiPmFuIGlt cGxlbWVudGF0aW9uIGRvZXMgbm90IHJlY29nbml6ZSB0aGUgdmFsdWUgaW4gdGhlIFR5cGU8L3Nw YW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgIGlmIHRoZSA8c3BhbiBj bGFzcz0iaW5zZXJ0Ij5VIGZsYWcgaXMgc2V0LDwvc3Bhbj4gdGhlIFNUQU1QIDxzcGFuIGNsYXNz PSJpbnNlcnQiPnN5c3RlbTwvc3Bhbj4gTVVTVCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5za2lwPC9z cGFuPiB0aGUgPHNwYW4gY2xhc3M9Imluc2VydCI+cHJvY2Vzc2luZzwvc3Bhbj4gb2Y8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PHNwYW4gY2xhc3M9ImRlbGV0ZSI+ICAgICAgZmllbGQg aXQgTVVTVCBpbmNsdWRlPC9zcGFuPiB0aGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+RXh0cmEgUGFk ZGluZyBUTFYgaW50bzwvc3Bhbj4gdGhlIDxzcGFuIGNsYXNzPSJkZWxldGUiPnJlZmxlY3RlZDwv c3Bhbj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgdGhlIFRMVi4gIFRo ZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5pbXBsZW1lbnRhdGlvbjwvc3Bhbj4gTVVTVCA8c3BhbiBj bGFzcz0iaW5zZXJ0Ij50cnk8L3NwYW4+IHRvIHByb2Nlc3MgdGhlIG5leHQgVExWIGlmPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIFNUQU1QIDxzcGFuIGNsYXNzPSJkZWxldGUi PnBhY2tldC4gIFRoZSBMZW5ndGggZmllbGQ8L3NwYW4+IE1VU1QgPHNwYW4gY2xhc3M9ImRlbGV0 ZSI+YmUgc2V0IGVxdWFsIHRvPC9zcGFuPiB0aGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+dmFsdWU8 L3NwYW4+IG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgIDxzcGFuIGNs YXNzPSJpbnNlcnQiPnByZXNlbnQgaW4gdGhlIGV4dGVuZGVkIFNUQU1QIHBhY2tldC48L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIHRoZSA8c3BhbiBjbGFzcz0iZGVs ZXRlIj5MZW5ndGggZmllbGQgb2YgdGhhdDwvc3Bhbj4gVExWLiAgVGhlIDxzcGFuIGNsYXNzPSJk ZWxldGUiPnNpemUgb2YgdGhlIFZhbHVlIGZpZWxkPC9zcGFuPiBNVVNUPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICA8 c3BhbiBjbGFzcz0iZGVsZXRlIj5lcXVhbCB0aGUgdmFsdWUgb2YgdGhlIExlbmd0aCBmaWVsZC4g IFRoZW4gcHJvY2VlZDwvc3Bhbj4gdG8gcHJvY2VzcyB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIG5leHQgVExW IGlmIDxzcGFuIGNsYXNzPSJkZWxldGUiPmFueSBwcmVzZW50Ozwvc3Bhbj48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJibG9jayI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMTQiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgPHNwYW4gY2xhc3M9 ImRlbGV0ZSI+Zml4ZWQtc2l6ZSBUTFZzIGFyZSB2ZXJpZmllZCB0aGF0IHRoZSBMZW5ndGggZmll bGQgdmFsdWUgZXF1YWxzPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICAgICBpZiB0aGUgPHNwYW4gY2xhc3M9Imluc2VydCI+TCBmbGFnPC9zcGFuPiBpcyA8c3BhbiBj bGFzcz0iaW5zZXJ0Ij5zZXQsPC9zcGFuPiB0aGUgPHNwYW4gY2xhc3M9Imluc2VydCI+U1RBTVAg c3lzdGVtPC9zcGFuPiBNVVNUIDxzcGFuIGNsYXNzPSJpbnNlcnQiPnN0b3AgcHJvY2Vzc2luZzwv c3Bhbj4gdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjxzcGFuIGNsYXNzPSJkZWxl dGUiPiAgICAgIHRoZSB2YWx1ZSBkZWZpbmVkIGZvciB0aGUgcGFydGljdWxhciB0eXBlLiAgSWYg dGhlIHZhbHVlcyBhcmUgbm90PC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2Nr Ij4gICAgICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5yZW1haW5kZXI8L3NwYW4+IG9mIHRoZSA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij5leHRlbmRlZCBTVEFNUCBwYWNrZXQuPC9zcGFuPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICBlcXVhbCwgdGhl IHByb2Nlc3Npbmcgb2YgZXh0ZW5zaW9uIFRMVnMgTVVTVCBiZSBzdG9wcGVkLiAgQWxzbyw8L3Nw YW4+IGlmPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj4gICAgICB0aGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+c3lzdGVtPC9zcGFu PiBpcyB0aGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+U2Vzc2lvbi1SZWZsZWN0b3IsIGl0PC9zcGFu PiBNVVNUIDxzcGFuIGNsYXNzPSJkZWxldGUiPnNlbmQgdGhlIElDTVA8L3NwYW4+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48 c3BhbiBjbGFzcz0iZGVsZXRlIj4gICAgICBQYXJhbWV0ZXIgUHJvYmxlbSBtZXNzYWdlIHdpdGgg Q29kZSBzZXQgdG8gMCBhbmQgdGhlIFBvaW50ZXI8L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyYmxvY2siPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48c3BhbiBjbGFzcz0i ZGVsZXRlIj4gICAgICByZWZlcnJpbmcgdG88L3NwYW4+IHRoZSA8c3BhbiBjbGFzcz0iZGVsZXRl Ij5MZW5ndGggZmllbGQ8L3NwYW4+IG9mIHRoZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj5UTFYuPC9z cGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDAxNSI+PHRkPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICBEZXRlY3RlZCBlcnJvciBldmVudHMgTVVTVCBiZSBsb2dnZWQuICBOb3RlIHRoYXQgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+dHJhbnNtaXNzaW9uPC9zcGFuPiBvZiA8c3BhbiBjbGFzcz0iZGVsZXRl Ij5JQ01QPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICA8c3Bh biBjbGFzcz0iaW5zZXJ0Ij5pZiBhbiBpbXBsZW1lbnRhdGlvbiBvZiBhIFNlc3Npb24tUmVmbGVj dG9yIGRvZXMgbm90IHJlY29nbml6ZSB0aGU8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs YmxvY2siPjxzcGFuIGNsYXNzPSJkZWxldGUiPiAgIEVycm9yIG1lc3NhZ2VzIGFuZDwvc3Bhbj4g bG9nZ2luZyA8c3BhbiBjbGFzcz0iZGVsZXRlIj5TSE9VTEQ8L3NwYW4+IGJlIDxzcGFuIGNsYXNz PSJkZWxldGUiPnRocm90dGxlZC48L3NwYW4+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgIFR5cGUgZmllbGQgdmFsdWUsIGl0IE1VU1Qg aW5jbHVkZSB0aGUgY29weSBvZiB0aGUgVExWIGludG8gdGhlPC9zcGFuPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4g Y2xhc3M9Imluc2VydCI+ICAgICAgcmVmbGVjdGVkIFNUQU1QIHBhY2tldC4gIFRoZSBTZXNzaW9u LVJlZmxlY3RvciBNVVNUIHNldCB0aGUgVSBmbGFnPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9 Imluc2VydCI+ICAgICAgdG8gMS4gIFRoZSBTZXNzaW9uLVJlZmxlY3RvciBNVVNUIHRyeSB0byBw cm9jZXNzIHRoZSBuZXh0IFRMViBpbjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQi PiAgICAgIHRoZSBleHRlbmRlZCBTVEFNUCBwYWNrZXQ7PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xh c3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgaWYg YSBUTFYgaXMgbWFsZm9ybWVkLCB0aGUgcHJvY2Vzc2luZyBvZiBleHRlbnNpb24gVExWcyBNVVNU IGJlPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgc3RvcHBlZC4gIFRo ZSBTZXNzaW9uLVJlZmxlY3RvciBNVVNUIGNvcHkgdGhlIHJlbWFpbmRlciBvZiB0aGU8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICByZWNlaXZlZCBleHRlbmRlZCBTVEFN UCBwYWNrZXQgaW50byB0aGUgcmVmbGVjdGVkIFNUQU1QIHBhY2tldC48L3NwYW4+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48 c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICBUaGUgU2Vzc2lvbi1SZWZsZWN0b3IgTVVTVCBzZXQg dGhlIEwgZmxhZyB0byAxLjwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAg IERldGVjdGVkIGVycm9yIGV2ZW50cyBNVVNUIGJlIGxvZ2dlZC4gIE5vdGUgdGhhdCA8c3BhbiBj bGFzcz0iaW5zZXJ0Ij5yYXRlPC9zcGFuPiBvZiBsb2dnaW5nIDxzcGFuIGNsYXNzPSJpbnNlcnQi Pk1VU1Q8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICBiZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5jb250cm9sbGVk Ljwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+NC4xLiAgRXh0cmEgUGFk ZGluZyBUTFY8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij40LjEuICBFeHRyYSBQYWRk aW5nIFRMVjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgMCAgICAgICAg ICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMzwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAwICAgICAgICAgICAgICAgICAgIDEg ICAgICAgICAgICAgICAgICAgMiAgICAgICAgICAgICAgICAgICAzPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5 IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgICAgIDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQg NSA2IDcgOCA5IDAgMTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgfCAgICAgIEV4dHJhIFBhZGRpbmcgVHlwZSAgICAgICB8 ICAgICAgICAgICBMZW5ndGggICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgICB8ICAgICAgRXh0cmEgUGFkZGluZyBUeXBlICAgICAgIHwgICAgICAgICAg IExlbmd0aCAgICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAg Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgfCAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgICAgfiAgICAgICAgICAgICAgICAgICAgICAgICBFeHRyYSBQYWRkaW5nICAgICAgICAg ICAgICAgICAgICAgICAgIH48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICB+ ICAgICAgICAgICAgICAgICAgICAgICAgIEV4dHJhIFBhZGRpbmcgICAgICAgICAgICAgICAgICAg ICAgICAgfjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgfCAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHIgaWQ9ImRpZmYwMDE2Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICAg IEZpZ3VyZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj41PC9zcGFuPjogRXh0cmEgUGFkZGluZyBUTFY8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgICAgICAgICAgICAgICAgICAg RmlndXJlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjY8L3NwYW4+OiBFeHRyYSBQYWRkaW5nIFRMVjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB3aGVyZSBmaWVsZHMgYXJlIGRlZmlu ZWQgYXMgdGhlIGZvbGxvd2luZzo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB3 aGVyZSBmaWVsZHMgYXJlIGRlZmluZWQgYXMgdGhlIGZvbGxvd2luZzo8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgRXh0cmEgUGFkZGluZyBUeXBlIC0gVEJBMSBhbGxvY2F0 ZWQgYnkgSUFOQSBTZWN0aW9uIDUuMTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IG8gIEV4dHJhIFBhZGRpbmcgVHlwZSAtIFRCQTEgYWxsb2NhdGVkIGJ5IElBTkEgU2VjdGlvbiA1 LjE8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAw MTciPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNs YXNzPSJpbnNlcnQiPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICA8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICBvICBMZW5ndGggLSB0d28gb2N0ZXRzIGxvbmcgZmllbGQgZXF1YWxzIGxlbmd0 aCBvbiB0aGUgRXh0cmEgUGFkZGluZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IG8gIExlbmd0aCAtIHR3byBvY3RldHMgbG9uZyBmaWVsZCBlcXVhbHMgbGVuZ3RoIG9uIHRoZSBF eHRyYSBQYWRkaW5nPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBmaWVsZCBpbiBv Y3RldHMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgZmllbGQgaW4gb2N0 ZXRzLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBFeHRyYSBQYWRkaW5n IC0gYSBwc2V1ZG8tcmFuZG9tIHNlcXVlbmNlIG9mIG51bWJlcnMuICBUaGUgZmllbGQ8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBFeHRyYSBQYWRkaW5nIC0gYSBwc2V1ZG8t cmFuZG9tIHNlcXVlbmNlIG9mIG51bWJlcnMuICBUaGUgZmllbGQ8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgICAgIE1BWSBiZSBmaWxsZWQgd2l0aCBhbGwgemVyb3MuPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgTUFZIGJlIGZpbGxlZCB3aXRoIGFsbCB6ZXJvcy48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhlIEV4dHJhIFBhZGRpbmcgVExW IGlzIHNpbWlsYXIgdG8gdGhlIFBhY2tldCBQYWRkaW5nIGZpZWxkIGluPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhlIEV4dHJhIFBhZGRpbmcgVExWIGlzIHNpbWlsYXIgdG8g dGhlIFBhY2tldCBQYWRkaW5nIGZpZWxkIGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBUV0FNUC1UZXN0IHBhY2tldCBbUkZDNTM1N10uICBUaGUgdXNlIG9mIHRoZSBFeHRyYSBQYWRk aW5nIFRMViBpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRXQU1QLVRlc3Qg cGFja2V0IFtSRkM1MzU3XS4gIFRoZSB1c2Ugb2YgdGhlIEV4dHJhIFBhZGRpbmcgVExWIGlzPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDE4Ij48 dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPiAgIFJFQ09NTUVOREVEIHRvIHBlcmZvcm0gU1RBTVAgdGVzdCB1c2luZyB0ZXN0 IHBhY2tldHMgb2YgbGFyZ2VyIHNpemU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgUkVDT01NRU5ERUQgdG8gcGVyZm9ybSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5hIDwvc3Bhbj5T VEFNUCB0ZXN0IHVzaW5nIHRlc3QgcGFja2V0cyBvZiBsYXJnZXIgc2l6ZTwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgdGhhbiB0aGUgYmFzZSBTVEFNUCBwYWNrZXQgW1JGQzg3NjJdLiAg VGhlIGxlbmd0aCBvZiB0aGUgYmFzZSBTVEFNUDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIHRoYW4gdGhlIGJhc2UgU1RBTVAgcGFja2V0IFtSRkM4NzYyXS4gIFRoZSBsZW5ndGgg b2YgdGhlIGJhc2UgU1RBTVA8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAg IDx0ciBpZD0iZGlmZjAwMTkiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgaXMgNDQgb2N0ZXRzIGluIHRoZSB1bmF1 dGhlbnRpY2F0ZWQgbW9kZSBvciAxMTIgb2N0ZXRzIGluIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmJsb2NrIj4gICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij5wYWNrZXQgPC9zcGFuPmlzIDQ0 IG9jdGV0cyBpbiB0aGUgdW5hdXRoZW50aWNhdGVkIG1vZGUgb3IgMTEyIG9jdGV0cyBpbiB0aGU8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGF1dGhlbnRpY2F0ZWQgbW9kZS4gIFRoZSBF eHRyYSBQYWRkaW5nIFRMViBNQVkgYmUgcHJlc2VudCBtb3JlIHRoYW48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBhdXRoZW50aWNhdGVkIG1vZGUuICBUaGUgRXh0cmEgUGFkZGlu ZyBUTFYgTUFZIGJlIHByZXNlbnQgbW9yZSB0aGFuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBvbmUgdGltZSBpbiBhbiBleHRlbmRlZCBTVEFNUCB0ZXN0IHBhY2tldC48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvbmUgdGltZSBpbiBhbiBleHRlbmRlZCBTVEFNUCB0 ZXN0IHBhY2tldC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+NC4yLiAgTG9jYXRp b24gVExWPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+NC4yLiAgTG9jYXRpb24gVExW PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFNUQU1QIFNlc3Npb24tU2VuZGVy IE1BWSBpbmNsdWRlIHRoZSBMb2NhdGlvbiBUTFYgdG8gcmVxdWVzdDwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIFNUQU1QIFNlc3Npb24tU2VuZGVyIE1BWSBpbmNsdWRlIHRoZSBM b2NhdGlvbiBUTFYgdG8gcmVxdWVzdDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW5m b3JtYXRpb24gZnJvbSB0aGUgU2Vzc2lvbi1SZWZsZWN0b3IuICBUaGUgU2Vzc2lvbi1TZW5kZXIg U0hPVUxEPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW5mb3JtYXRpb24gZnJv bSB0aGUgU2Vzc2lvbi1SZWZsZWN0b3IuICBUaGUgU2Vzc2lvbi1TZW5kZXIgU0hPVUxEPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBOT1QgZmlsbCBhbnkgaW5mb3JtYXRpb24gZmllbGRz IGV4Y2VwdCBmb3IgVHlwZSBhbmQgTGVuZ3RoLiAgVGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgTk9UIGZpbGwgYW55IGluZm9ybWF0aW9uIGZpZWxkcyBleGNlcHQgZm9yIFR5 cGUgYW5kIExlbmd0aC4gIFRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgU2Vzc2lv bi1SZWZsZWN0b3IgTVVTVCB2YWxpZGF0ZSB0aGUgTGVuZ3RoIHZhbHVlIGFnYWluc3QgdGhlIGFk ZHJlc3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBTZXNzaW9uLVJlZmxlY3Rv ciBNVVNUIHZhbGlkYXRlIHRoZSBMZW5ndGggdmFsdWUgYWdhaW5zdCB0aGUgYWRkcmVzczwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgZmFtaWx5IG9mIHRoZSB0cmFuc3BvcnQgZW5jYXBz dWxhdGluZyB0aGUgU1RBTVAgdGVzdCBwYWNrZXQuICBJZiB0aGU8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBmYW1pbHkgb2YgdGhlIHRyYW5zcG9ydCBlbmNhcHN1bGF0aW5nIHRo ZSBTVEFNUCB0ZXN0IHBhY2tldC4gIElmIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHIgaWQ9InBhcnQtNyIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+ PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0dHBzOi8v d3d3Ni5pZXRmLm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTciPjxlbT4gcGFnZSAxMCwg bGluZSA0NjxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGg+IDwv dGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0dHBz Oi8vd3d3Ni5pZXRmLm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTciPjxlbT4gcGFnZSAx MSwgbGluZSA0MTxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICArICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg ICsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHwgICAgICAgICAgIFJlc2VydmVkICAgICAgICAgICAgfDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgfCAgICAgICAgICAgUmVzZXJ2ZWQgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB+ICAg ICAgICAgICAgICAgICAgICBEZXN0aW5hdGlvbiBJUCBBZGRyZXNzICAgICAgICAgICAgICAgICAg ICAgfjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIH4gICAgICAgICAgICAg ICAgICAgIERlc3RpbmF0aW9uIElQIEFkZHJlc3MgICAgICAgICAgICAgICAgICAgICB+PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICAgICB+ICAgICAgICAgICAgICAgICAgICAgICBTb3VyY2UgSVAgQWRkcmVzcyAgICAgICAgICAg ICAgICAgICAgICAgfjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIH4gICAg ICAgICAgICAgICAgICAgICAgIFNvdXJjZSBJUCBBZGRyZXNzICAgICAgICAgICAgICAgICAgICAg ICB+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICAgICB8ICAgICAgICBEZXN0aW5hdGlvbiBQb3J0ICAgICAgIHwgICAgICAgICAg U291cmNlIFBvcnQgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgIHwgICAgICAgIERlc3RpbmF0aW9uIFBvcnQgICAgICAgfCAgICAgICAgICBTb3VyY2UgUG9y dCAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMjAiPjx0ZD48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxi bG9jayI+ICAgICAgICAgICAgICAgICBGaWd1cmUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+Njwvc3Bh bj46IFNlc3Npb24tUmVmbGVjdG9yIExvY2F0aW9uIFRMVjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmJsb2NrIj4gICAgICAgICAgICAgICAgIEZpZ3VyZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij43 PC9zcGFuPjogU2Vzc2lvbi1SZWZsZWN0b3IgTG9jYXRpb24gVExWPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBhcyB0aGUgZm9sbG93 aW5nOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHdoZXJlIGZpZWxkcyBhcmUg ZGVmaW5lZCBhcyB0aGUgZm9sbG93aW5nOjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBvICBMb2NhdGlvbiBUeXBlIC0gVEJBMiBhbGxvY2F0ZWQgYnkgSUFOQSBTZWN0aW9uIDUu MTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIExvY2F0aW9uIFR5cGUgLSBU QkEyIGFsbG9jYXRlZCBieSBJQU5BIFNlY3Rpb24gNS4xPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDIxIj48dGQ+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgTGVuZ3RoIC0gdHdv IG9jdGV0cyBsb25nIGZpZWxkIGVxdWFscyB0aGUgbGVuZ3RoIG9mIHRoZSBWYWx1ZTwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIExlbmd0aCAtIHR3byBvY3RldHMgbG9uZyBm aWVsZCBlcXVhbHMgdGhlIGxlbmd0aCBvZiB0aGUgVmFsdWU8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgIGZpZWxkIGluIG9jdGV0cy4gIFRoZSBMZW5ndGggZmllbGQgdmFsdWUgTVVT VCBlcXVhbCAyMCBvY3RldHMgZm9yPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgZmllbGQgaW4gb2N0ZXRzLiAgVGhlIExlbmd0aCBmaWVsZCB2YWx1ZSBNVVNUIGVxdWFsIDIw IG9jdGV0cyBmb3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIHRoZSBJUHY0IGFk ZHJlc3MgZmFtaWx5LiAgRm9yIHRoZSBJUHY2IGFkZHJlc3MgZmFtaWx5LCB0aGUgdmFsdWU8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICB0aGUgSVB2NCBhZGRyZXNzIGZhbWls eS4gIEZvciB0aGUgSVB2NiBhZGRyZXNzIGZhbWlseSwgdGhlIHZhbHVlPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAgICBvZiB0aGUgTGVuZ3RoIGZpZWxkIE1VU1QgZXF1YWwgNDQgb2N0 ZXRzLiAgQWxsIG90aGVyIHZhbHVlcyBhcmU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICBvZiB0aGUgTGVuZ3RoIGZpZWxkIE1VU1QgZXF1YWwgNDQgb2N0ZXRzLiAgQWxsIG90 aGVyIHZhbHVlcyBhcmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIGludmFsaWQu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgaW52YWxpZC48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgU291cmNlIE1BQyAtIDYgb2N0ZXRzIDQ4IGJp dHMgbG9uZyBmaWVsZC4gIFRoZSBTZXNzaW9uLVJlZmxlY3RvcjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIG8gIFNvdXJjZSBNQUMgLSA2IG9jdGV0cyA0OCBiaXRzIGxvbmcgZmll bGQuICBUaGUgU2Vzc2lvbi1SZWZsZWN0b3I8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg ICAgIE1VU1QgY29weSBTb3VyY2UgTUFDIG9mIHJlY2VpdmVkIFNUQU1QIHBhY2tldCBpbnRvIHRo aXMgZmllbGQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgTVVTVCBjb3B5 IFNvdXJjZSBNQUMgb2YgcmVjZWl2ZWQgU1RBTVAgcGFja2V0IGludG8gdGhpcyBmaWVsZC48L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgUmVzZXJ2ZWQgLSB0d28gb2N0ZXRz IGxvbmcgZmllbGQuICBNVVNUIGJlIHplcm9lZCBvbiB0cmFuc21pc3Npb248L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBSZXNlcnZlZCAtIHR3byBvY3RldHMgbG9uZyBmaWVs ZC4gIE1VU1QgYmUgemVyb2VkIG9uIHRyYW5zbWlzc2lvbjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9InBhcnQtOCIgY2xhc3M9ImNoYW5nZSI+PHRk PjwvdGQ+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0 dHBzOi8vd3d3Ni5pZXRmLm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTgiPjxlbT4gcGFn ZSAxMiwgbGluZSAxMzxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48 dGg+IDwvdGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9 Imh0dHBzOi8vd3d3Ni5pZXRmLm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTgiPjxlbT4g cGFnZSAxMiwgbGluZSA0OTxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90 aD48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBpbmZvcm1hdGlvbiB0byB0aGUgU2Vzc2lvbi1TZW5kZXIuPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW5mb3JtYXRpb24gdG8gdGhlIFNlc3Npb24tU2Vu ZGVyLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgMCAgICAgICAgICAg ICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMzwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAwICAgICAgICAgICAgICAgICAgIDEgICAg ICAgICAgICAgICAgICAgMiAgICAgICAgICAgICAgICAgICAzPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICAgICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAg MSAyIDMgNCA1IDYgNyA4IDkgMCAxPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgIDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2 IDcgOCA5IDAgMTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgICAgfCAgVGltZXN0YW1wIEluZm9ybWF0aW9uIFR5cGUgICB8ICAg ICAgICAgICBMZW5ndGggICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICAgICB8ICBUaW1lc3RhbXAgSW5mb3JtYXRpb24gVHlwZSAgIHwgICAgICAgICAgIExl bmd0aCAgICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgfCAgU3luYy4gU3JjIEluIHwgVGltZXN0YW1w IEluICB8IFN5bmMuIFNyYyBPdXQgfCBUaW1lc3RhbXAgT3V0IHw8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICAgICB8ICBTeW5jLiBTcmMgSW4gfCBUaW1lc3RhbXAgSW4gIHwgU3lu Yy4gU3JjIE91dCB8IFRpbWVzdGFtcCBPdXQgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9 ImRpZmYwMDIyIj48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgICAgICAgICAgICAgICAgRmlndXJlIDxzcGFuIGNs YXNzPSJkZWxldGUiPjc8L3NwYW4+OiBUaW1lc3RhbXAgSW5mb3JtYXRpb24gVExWPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAgICAgRmlndXJlIDxzcGFu IGNsYXNzPSJpbnNlcnQiPjg8L3NwYW4+OiBUaW1lc3RhbXAgSW5mb3JtYXRpb24gVExWPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBh cyB0aGUgZm9sbG93aW5nOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHdoZXJl IGZpZWxkcyBhcmUgZGVmaW5lZCBhcyB0aGUgZm9sbG93aW5nOjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBvICBUaW1lc3RhbXAgSW5mb3JtYXRpb24gVHlwZSAtIFRCQTMgYWxs b2NhdGVkIGJ5IElBTkEgU2VjdGlvbiA1LjE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBvICBUaW1lc3RhbXAgSW5mb3JtYXRpb24gVHlwZSAtIFRCQTMgYWxsb2NhdGVkIGJ5IElB TkEgU2VjdGlvbiA1LjE8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgTGVu Z3RoIC0gdHdvIG9jdGV0cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDQuPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgTGVuZ3RoIC0gdHdvIG9jdGV0cyBs b25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDQuPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIG8gIFN5bmMgU3JjIEluIC0gb25lIG9jdGV0IGxvbmcgZmllbGQgdGhh dCBjaGFyYWN0ZXJpemVzIHRoZSBzb3VyY2U8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBvICBTeW5jIFNyYyBJbiAtIG9uZSBvY3RldCBsb25nIGZpZWxkIHRoYXQgY2hhcmFjdGVy aXplcyB0aGUgc291cmNlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBvZiBjbG9j ayBzeW5jaHJvbml6YXRpb24gYXQgdGhlIGluZ3Jlc3Mgb2YgU2Vzc2lvbi1SZWZsZWN0b3IuPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgb2YgY2xvY2sgc3luY2hyb25pemF0 aW9uIGF0IHRoZSBpbmdyZXNzIG9mIFNlc3Npb24tUmVmbGVjdG9yLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgICAgVGhlcmUgYXJlIHNldmVyYWwgbWV0aG9kcyB0byBzeW5jaHJvbml6 ZSB0aGUgY2xvY2ssIGUuZy4sIE5ldHdvcms8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICBUaGVyZSBhcmUgc2V2ZXJhbCBtZXRob2RzIHRvIHN5bmNocm9uaXplIHRoZSBjbG9j aywgZS5nLiwgTmV0d29yazwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgVGltZSBQ cm90b2NvbCAoTlRQKSBbUkZDNTkwNV0uICBUaGUgdmFsdWUgaXMgb25lIG9mIHRob3NlIGxpc3Rl ZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIFRpbWUgUHJvdG9jb2wgKE5U UCkgW1JGQzU5MDVdLiAgVGhlIHZhbHVlIGlzIG9uZSBvZiB0aG9zZSBsaXN0ZWQ8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMjMiPjx0ZD48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgICAgaW4gVGFibGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+NDwvc3Bhbj4uPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgIGluIFRhYmxlIDxzcGFuIGNsYXNzPSJpbnNl cnQiPjU8L3NwYW4+LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBUaW1l c3RhbXAgSW4gLSBvbmUgb2N0ZXQgbG9uZyBmaWVsZCB0aGF0IGNoYXJhY3Rlcml6ZXMgdGhlIG1l dGhvZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIFRpbWVzdGFtcCBJbiAt IG9uZSBvY3RldCBsb25nIGZpZWxkIHRoYXQgY2hhcmFjdGVyaXplcyB0aGUgbWV0aG9kPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBieSB3aGljaCB0aGUgaW5ncmVzcyBvZiBTZXNz aW9uLVJlZmxlY3RvciBvYnRhaW5lZCB0aGUgdGltZXN0YW1wPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgICAgYnkgd2hpY2ggdGhlIGluZ3Jlc3Mgb2YgU2Vzc2lvbi1SZWZsZWN0 b3Igb2J0YWluZWQgdGhlIHRpbWVzdGFtcDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg ICAgVDIuICBBIHRpbWVzdGFtcCBtYXkgYmUgb2J0YWluZWQgd2l0aCBoYXJkd2FyZSBhc3Npc3Rh bmNlLCB2aWE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBUMi4gIEEgdGlt ZXN0YW1wIG1heSBiZSBvYnRhaW5lZCB3aXRoIGhhcmR3YXJlIGFzc2lzdGFuY2UsIHZpYTwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgc29mdHdhcmUgQVBJIGZyb20gYSBsb2NhbCB3 YWxsIGNsb2NrLCBvciBmcm9tIGEgcmVtb3RlIGNsb2NrICh0aGU8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICAgICBzb2Z0d2FyZSBBUEkgZnJvbSBhIGxvY2FsIHdhbGwgY2xvY2ss IG9yIGZyb20gYSByZW1vdGUgY2xvY2sgKHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgICAgbGF0dGVyIGlzIHJlZmVycmVkIHRvIGFzICJjb250cm9sIHBsYW5lIikuICBUaGUgdmFs dWUgaXMgb25lIG9mPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgbGF0dGVy IGlzIHJlZmVycmVkIHRvIGFzICJjb250cm9sIHBsYW5lIikuICBUaGUgdmFsdWUgaXMgb25lIG9m PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDI0 Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgICAgIHRob3NlIGxpc3RlZCBpbiBUYWJsZSA8c3BhbiBjbGFzcz0iZGVs ZXRlIj42PC9zcGFuPi48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgdGhv c2UgbGlzdGVkIGluIFRhYmxlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjc8L3NwYW4+LjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBTeW5jIFNyYyBPdXQgLSBvbmUgb2N0ZXQg bG9uZyBmaWVsZCB0aGF0IGNoYXJhY3Rlcml6ZXMgdGhlIHNvdXJjZTwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIG8gIFN5bmMgU3JjIE91dCAtIG9uZSBvY3RldCBsb25nIGZpZWxk IHRoYXQgY2hhcmFjdGVyaXplcyB0aGUgc291cmNlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICAgICBvZiBjbG9jayBzeW5jaHJvbml6YXRpb24gYXQgdGhlIGVncmVzcyBvZiBTZXNzaW9u LVJlZmxlY3Rvci4gIFRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIG9m IGNsb2NrIHN5bmNocm9uaXphdGlvbiBhdCB0aGUgZWdyZXNzIG9mIFNlc3Npb24tUmVmbGVjdG9y LiAgVGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRp ZmYwMDI1Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIHZhbHVlIGlzIG9uZSBvZiB0aG9zZSBsaXN0ZWQgaW4g VGFibGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+NDwvc3Bhbj4uPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyYmxvY2siPiAgICAgIHZhbHVlIGlzIG9uZSBvZiB0aG9zZSBsaXN0ZWQgaW4gVGFibGUg PHNwYW4gY2xhc3M9Imluc2VydCI+NTwvc3Bhbj4uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIG8gIFRpbWVzdGFtcCBPdXQgLSBvbmUgb2N0ZXQgbG9uZyBmaWVsZCB0aGF0IGNo YXJhY3Rlcml6ZXMgdGhlIG1ldGhvZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IG8gIFRpbWVzdGFtcCBPdXQgLSBvbmUgb2N0ZXQgbG9uZyBmaWVsZCB0aGF0IGNoYXJhY3Rlcml6 ZXMgdGhlIG1ldGhvZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgYnkgd2hpY2gg dGhlIGVncmVzcyBvZiBTZXNzaW9uLVJlZmxlY3RvciBvYnRhaW5lZCB0aGUgdGltZXN0YW1wPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgYnkgd2hpY2ggdGhlIGVncmVzcyBv ZiBTZXNzaW9uLVJlZmxlY3RvciBvYnRhaW5lZCB0aGUgdGltZXN0YW1wPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDI2Ij48dGQ+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAg ICAgIFQzLiAgVGhlIHZhbHVlIGlzIG9uZSBvZiB0aG9zZSBsaXN0ZWQgaW4gVGFibGUgPHNwYW4g Y2xhc3M9ImRlbGV0ZSI+Njwvc3Bhbj4uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PiAgICAgIFQzLiAgVGhlIHZhbHVlIGlzIG9uZSBvZiB0aG9zZSBsaXN0ZWQgaW4gVGFibGUgPHNw YW4gY2xhc3M9Imluc2VydCI+Nzwvc3Bhbj4uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjQuNC4gIENsYXNzIG9mIFNlcnZpY2UgVExWPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+NC40LiAgQ2xhc3Mgb2YgU2VydmljZSBUTFY8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgVGhlIFNUQU1QIFNlc3Npb24tU2VuZGVyIE1BWSBpbmNsdWRlIENsYXNzIG9m IFNlcnZpY2UgKENvUykgVExWIGluPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg VGhlIFNUQU1QIFNlc3Npb24tU2VuZGVyIE1BWSBpbmNsdWRlIENsYXNzIG9mIFNlcnZpY2UgKENv UykgVExWIGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0aGUgU1RBTVAgdGVzdCBw YWNrZXQuICBUaGUgZm9ybWF0IG9mIHRoZSBDb1MgVExWIGlzIHByZXNlbnRlZCBpbjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBTVEFNUCB0ZXN0IHBhY2tldC4gIFRoZSBm b3JtYXQgb2YgdGhlIENvUyBUTFYgaXMgcHJlc2VudGVkIGluPC90ZD48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDI3Ij48dGQ+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIEZpZ3Vy ZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj44PC9zcGFuPi48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+ICAgRmlndXJlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjk8L3NwYW4+LjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAg ICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAgICAgICAgMzwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgICAgICAwICAgICAgICAgICAgICAgICAgIDEgICAgICAgICAgICAgICAg ICAgMiAgICAgICAgICAgICAgICAgICAzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAg ICAgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYg NyA4IDkgMCAxPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgIDAgMSAyIDMg NCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMTwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgICAgfCAgICAgIENsYXNzIG9mIFNlcnZpY2UgVHlwZSAgICB8ICAgICAgICAgICBMZW5n dGggICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICB8 ICAgICAgQ2xhc3Mgb2YgU2VydmljZSBUeXBlICAgIHwgICAgICAgICAgIExlbmd0aCAgICAgICAg ICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgICAgfCAgIERTQ1AxICAgfCAgIERTQ1AyICAgfEVDTnwgICAgICAgICAg ICBSZXNlcnZlZCAgICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICB8ICAgRFNDUDEgICB8ICAgRFNDUDIgICB8RUNOfCAgICAgICAgICAgIFJlc2VydmVk ICAgICAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICArLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDI4Ij48 dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICBGaWd1cmUgPHNwYW4gY2xhc3M9ImRlbGV0 ZSI+ODwvc3Bhbj46IENsYXNzIG9mIFNlcnZpY2UgVExWPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICBGaWd1cmUgPHNwYW4gY2xhc3M9Imluc2Vy dCI+OTwvc3Bhbj46IENsYXNzIG9mIFNlcnZpY2UgVExWPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBhcyB0aGUgZm9sbG93aW5nOjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5l ZCBhcyB0aGUgZm9sbG93aW5nOjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBv ICBDbGFzcyBvZiBTZXJ2aWNlIFR5cGUgLSBUQkE0IGFsbG9jYXRlZCBieSBJQU5BIFNlY3Rpb24g NS4xPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgQ2xhc3Mgb2YgU2Vydmlj ZSBUeXBlIC0gVEJBNCBhbGxvY2F0ZWQgYnkgSUFOQSBTZWN0aW9uIDUuMTwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBMZW5ndGggLSB0d28gb2N0ZXRzIGxvbmcgZmllbGQs IHNldCBlcXVhbCB0byB0aGUgdmFsdWUgNC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBvICBMZW5ndGggLSB0d28gb2N0ZXRzIGxvbmcgZmllbGQsIHNldCBlcXVhbCB0byB0aGUg dmFsdWUgNC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgRFNDUDEgLSBU aGUgRGlmZmVyZW50aWF0ZWQgU2VydmljZXMgQ29kZSBQb2ludCAoRFNDUCkgaW50ZW5kZWQgYnk8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBEU0NQMSAtIFRoZSBEaWZmZXJl bnRpYXRlZCBTZXJ2aWNlcyBDb2RlIFBvaW50IChEU0NQKSBpbnRlbmRlZCBieTwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgdGhlIFNlc3Npb24tU2VuZGVyIHRvIGJlIHVzZWQgYXMg dGhlIERTQ1AgdmFsdWUgb2YgdGhlIHJlZmxlY3RlZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgIHRoZSBTZXNzaW9uLVNlbmRlciB0byBiZSB1c2VkIGFzIHRoZSBEU0NQIHZh bHVlIG9mIHRoZSByZWZsZWN0ZWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIGJ5 IHRoZSBTZXNzaW9uLVJlZmxlY3RvciB0ZXN0IHBhY2tldC48L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgICBieSB0aGUgU2Vzc2lvbi1SZWZsZWN0b3IgdGVzdCBwYWNrZXQuPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0icGFydC05 IiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBh dDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5w eWh0I3BhcnQtOSI+PGVtPiBwYWdlIDE0LCBsaW5lIDI1PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwv c3Bhbj48L2VtPjwvYT48L3RoPjx0aD4gPC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5n ZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlm Zi5weWh0I3BhcnQtOSI+PGVtPiBwYWdlIDE1LCBsaW5lIDE3PHNwYW4gY2xhc3M9ImhpZGUiPiDC tjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgIHwgICAgRGlyZWN0IE1lYXN1cmVtZW50IFR5cGUgICAgfCAgICAgICAgICAg TGVuZ3RoICAgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgfCAgICBEaXJlY3QgTWVhc3VyZW1lbnQgVHlwZSAgICB8ICAgICAgICAgICBMZW5ndGggICAg ICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgICAgIHwgICAgICAgICAgICAgIFNlc3Npb24tU2VuZGVyIFR4IGNv dW50ZXIgIChTX1R4QykgICAgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgICAgfCAgICAgICAgICAgICAgU2Vzc2lvbi1TZW5kZXIgVHggY291bnRlciAgKFNf VHhDKSAgICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIHwgICAgICAgICAgICAgU2Vzc2lvbi1SZWZs ZWN0b3IgUnggY291bnRlciAgKFJfUnhDKSAgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgfCAgICAgICAgICAgICBTZXNzaW9uLVJlZmxlY3RvciBSeCBj b3VudGVyICAoUl9SeEMpICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIHwgICAgICAgICAgICAgU2Vz c2lvbi1SZWZsZWN0b3IgVHggY291bnRlciAgKFJfVHhDKSAgICAgICAgICAgICB8PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgfCAgICAgICAgICAgICBTZXNzaW9uLVJlZmxl Y3RvciBUeCBjb3VudGVyICAoUl9UeEMpICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyIGlkPSJkaWZmMDAyOSI+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICBGaWd1 cmUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+OTwvc3Bhbj46IERpcmVjdCBNZWFzdXJlbWVudCBUTFY8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgICAgICAgICAgICAgICAgICAgRmln dXJlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjEwPC9zcGFuPjogRGlyZWN0IE1lYXN1cmVtZW50IFRM VjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB3aGVyZSBmaWVsZHMgYXJlIGRl ZmluZWQgYXMgdGhlIGZvbGxvd2luZzo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICB3aGVyZSBmaWVsZHMgYXJlIGRlZmluZWQgYXMgdGhlIGZvbGxvd2luZzo8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgRGlyZWN0IE1lYXN1cmVtZW50IFR5cGUgLSBUQkE1 IGFsbG9jYXRlZCBieSBJQU5BIFNlY3Rpb24gNS4xPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgbyAgRGlyZWN0IE1lYXN1cmVtZW50IFR5cGUgLSBUQkE1IGFsbG9jYXRlZCBieSBJ QU5BIFNlY3Rpb24gNS4xPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIExl bmd0aCAtIHR3byBvY3RldHMgbG9uZyBmaWVsZCBlcXVhbHMgbGVuZ3RoIG9uIHRoZSBWYWx1ZSBm aWVsZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIExlbmd0aCAtIHR3 byBvY3RldHMgbG9uZyBmaWVsZCBlcXVhbHMgbGVuZ3RoIG9uIHRoZSBWYWx1ZSBmaWVsZCBpbjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgb2N0ZXRzLiAgTGVuZ3RoIGZpZWxkIHZh bHVlIE1VU1QgZXF1YWwgMTIgb2N0ZXRzLjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgICAgIG9jdGV0cy4gIExlbmd0aCBmaWVsZCB2YWx1ZSBNVVNUIGVxdWFsIDEyIG9jdGV0cy48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgU2Vzc2lvbi1TZW5kZXIgVHgg Y291bnRlciAoU19UeEMpIGlzIGZvdXIgb2N0ZXRzIGxvbmcgZmllbGQuPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgU2Vzc2lvbi1TZW5kZXIgVHggY291bnRlciAoU19UeEMp IGlzIGZvdXIgb2N0ZXRzIGxvbmcgZmllbGQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJwYXJ0LTEwIiBjbGFzcz0iY2hhbmdlIj48dGQ+ PC90ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0 cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMTAiPjxlbT4gcGFn ZSAxNSwgbGluZSA3PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0 aD4gPC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0i aHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMTAiPjxlbT4g cGFnZSAxNSwgbGluZSA0NzxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90 aD48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICB0ZXN0IHBhY2tldC4gIFRoZSBTZXNzaW9uLVNlbmRlciBNVVNUIHplcm8g Ul9SeEMgYW5kIFJfVHhDIGZpZWxkczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg IHRlc3QgcGFja2V0LiAgVGhlIFNlc3Npb24tU2VuZGVyIE1VU1QgemVybyBSX1J4QyBhbmQgUl9U eEMgZmllbGRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBiZWZvcmUgdGhlIHRyYW5z bWlzc2lvbiBvZiB0aGUgU1RBTVAgdGVzdCBwYWNrZXQuICBJZiB0aGUgcmVjZWl2ZWQ8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBiZWZvcmUgdGhlIHRyYW5zbWlzc2lvbiBvZiB0 aGUgU1RBTVAgdGVzdCBwYWNrZXQuICBJZiB0aGUgcmVjZWl2ZWQ8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIFNUQU1QIHRlc3QgcGFja2V0IGluY2x1ZGVzIHRoZSBEaXJlY3QgTWVhc3Vy ZW1lbnQgVExWLCB0aGUgU2Vzc2lvbi08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBTVEFNUCB0ZXN0IHBhY2tldCBpbmNsdWRlcyB0aGUgRGlyZWN0IE1lYXN1cmVtZW50IFRMViwg dGhlIFNlc3Npb24tPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBSZWZsZWN0b3IgTVVT VCBpbmNsdWRlIGl0IGluIHRoZSByZWZsZWN0ZWQgdGVzdCBwYWNrZXQuICBUaGUgU2Vzc2lvbi08 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBSZWZsZWN0b3IgTVVTVCBpbmNsdWRl IGl0IGluIHRoZSByZWZsZWN0ZWQgdGVzdCBwYWNrZXQuICBUaGUgU2Vzc2lvbi08L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFJlZmxlY3RvciBNVVNUIGNvcHkgdGhlIHZhbHVlIGZyb20g dGhlIFNfVHhDIGZpZWxkIG9mIHRoZSByZWNlaXZlZDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgIFJlZmxlY3RvciBNVVNUIGNvcHkgdGhlIHZhbHVlIGZyb20gdGhlIFNfVHhDIGZp ZWxkIG9mIHRoZSByZWNlaXZlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGVzdCBw YWNrZXQgaW50byB0aGUgc2FtZSBmaWVsZCBvZiB0aGUgcmVmbGVjdGVkIHBhY2tldCBiZWZvcmUg aXRzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdGVzdCBwYWNrZXQgaW50byB0 aGUgc2FtZSBmaWVsZCBvZiB0aGUgcmVmbGVjdGVkIHBhY2tldCBiZWZvcmUgaXRzPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB0cmFuc21pc3Npb24uPC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+ICAgdHJhbnNtaXNzaW9uLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij40LjYuICBBY2Nlc3MgUmVwb3J0IFRMVjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjQuNi4gIEFjY2VzcyBSZXBvcnQgVExWPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMzAiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgQSBTVEFNUCBT ZXNzaW9uLVNlbmRlciBNQVkgaW5jbHVkZSBBY2Nlc3MgUmVwb3J0IFRMViAoRmlndXJlIDE8c3Bh biBjbGFzcz0iZGVsZXRlIj4wPC9zcGFuPikgdG88L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgQSBTVEFNUCBTZXNzaW9uLVNlbmRlciBNQVkgaW5jbHVkZSBBY2Nlc3MgUmVwb3J0 IFRMViAoRmlndXJlIDE8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xPC9zcGFuPikgdG88L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIGluZGljYXRlIGNoYW5nZXMgdG8gdGhlIGFjY2VzcyBuZXR3 b3JrIHN0YXR1cyB0byB0aGUgU2Vzc2lvbi08L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBpbmRpY2F0ZSBjaGFuZ2VzIHRvIHRoZSBhY2Nlc3MgbmV0d29yayBzdGF0dXMgdG8gdGhl IFNlc3Npb24tPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBSZWZsZWN0b3IuICBUaGUg ZGVmaW5pdGlvbiBvZiBhbiBhY2Nlc3MgbmV0d29yayBpcyBvdXRzaWRlIHRoZSBzY29wZTwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFJlZmxlY3Rvci4gIFRoZSBkZWZpbml0aW9u IG9mIGFuIGFjY2VzcyBuZXR3b3JrIGlzIG91dHNpZGUgdGhlIHNjb3BlPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBvZiB0aGlzIGRvY3VtZW50LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIG9mIHRoaXMgZG9jdW1lbnQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIg ICAgICAgICAgICAgICAgICAgMzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg ICAgMCAgICAgICAgICAgICAgICAgICAxICAgICAgICAgICAgICAgICAgIDIgICAgICAgICAgICAg ICAgICAgMzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAwIDEgMiAzIDQgNSA2 IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAwIDE8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgIDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAx IDIgMyA0IDUgNiA3IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMTwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgfCAg ICAgICBBY2Nlc3MgUmVwb3J0IFR5cGUgICAgICB8ICAgICAgICAgICBMZW5ndGggICAgICAgICAg ICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgfCAgICAgICBBY2Nl c3MgUmVwb3J0IFR5cGUgICAgICB8ICAgICAgICAgICBMZW5ndGggICAgICAgICAgICAgIHw8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgICAgIHwgICBJRCAgfCAgUmVzdiB8ICBSZXR1cm4gQ29kZSAgfCAgICAgICAgICBSZXNl cnZlZCAgICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAg IHwgICBJRCAgfCAgUmVzdiB8ICBSZXR1cm4gQ29kZSAgfCAgICAgICAgICBSZXNlcnZlZCAgICAg ICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDAzMSI+PHRkPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj4gICAgICAgICAgICAgICAgICAgICAgIEZpZ3VyZSAxPHNwYW4gY2xhc3M9ImRlbGV0ZSI+ MDwvc3Bhbj46IEFjY2VzcyBSZXBvcnQgVExWPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPiAgICAgICAgICAgICAgICAgICAgICAgRmlndXJlIDE8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4x PC9zcGFuPjogQWNjZXNzIFJlcG9ydCBUTFY8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVm dCI+ICAgd2hlcmUgZmllbGRzIGFyZSBkZWZpbmVkIGFzIGZvbGxvd3M6PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgd2hlcmUgZmllbGRzIGFyZSBkZWZpbmVkIGFzIGZvbGxvd3M6 PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIEFjY2VzcyBSZXBvcnQgVHlw ZSAtIFRCQTYgYWxsb2NhdGVkIGJ5IElBTkEgU2VjdGlvbiA1LjEuPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgbyAgQWNjZXNzIFJlcG9ydCBUeXBlIC0gVEJBNiBhbGxvY2F0ZWQg YnkgSUFOQSBTZWN0aW9uIDUuMS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg byAgTGVuZ3RoIC0gdHdvIG9jdGV0cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVl IDQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgTGVuZ3RoIC0gdHdvIG9j dGV0cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDQuPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIElEIChBY2Nlc3MgSUQpIC0gZm91ciBiaXRzIGxvbmcg ZmllbGQgdGhhdCBpZGVudGlmaWVzIHRoZSBhY2Nlc3M8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBvICBJRCAoQWNjZXNzIElEKSAtIGZvdXIgYml0cyBsb25nIGZpZWxkIHRoYXQg aWRlbnRpZmllcyB0aGUgYWNjZXNzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBu ZXR3b3JrLCBlLmcuLCAzR1BQIChSYWRpbyBBY2Nlc3MgVGVjaG5vbG9naWVzIHNwZWNpZmllZCBi eSAzR1BQKTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIG5ldHdvcmssIGUu Zy4sIDNHUFAgKFJhZGlvIEFjY2VzcyBUZWNobm9sb2dpZXMgc3BlY2lmaWVkIGJ5IDNHUFApPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBvciBOb24tM0dQUCAoYWNjZXNzZXMgdGhh dCBhcmUgbm90IHNwZWNpZmllZCBieSAzR1BQKSBbVFMyMzUwMV0uPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgb3IgTm9uLTNHUFAgKGFjY2Vzc2VzIHRoYXQgYXJlIG5vdCBz cGVjaWZpZWQgYnkgM0dQUCkgW1RTMjM1MDFdLjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHIgaWQ9InBhcnQtMTEiIGNsYXNzPSJjaGFuZ2UiPjx0ZD48L3Rk Pjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRwczov L3d3dzYuaWV0Zi5vcmcvcmZjZGlmZi9yZmNkaWZmLnB5aHQjcGFydC0xMSI+PGVtPiBwYWdlIDE1 LCBsaW5lIDQ3PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0aD4g PC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0 cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMTEiPjxlbT4gcGFn ZSAxNiwgbGluZSA0MDxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48 dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNz PSJsZWZ0Ij4gICAgICBBbGwgb3RoZXIgdmFsdWVzIGFyZSBpbnZhbGlkIGFuZCB0aGUgVExWIHRo YXQgY29udGFpbnMgaXQgTVVTVCBiZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgIEFsbCBvdGhlciB2YWx1ZXMgYXJlIGludmFsaWQgYW5kIHRoZSBUTFYgdGhhdCBjb250YWlu cyBpdCBNVVNUIGJlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBkaXNjYXJkZWQu PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgZGlzY2FyZGVkLjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBSZXN2IC0gZm91ciBiaXRzIGxvbmcgZmll bGQsIG11c3QgYmUgemVyb2VkIG9uIHRyYW5zbWlzc2lvbiBhbmQ8L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij4gICBvICBSZXN2IC0gZm91ciBiaXRzIGxvbmcgZmllbGQsIG11c3QgYmUg emVyb2VkIG9uIHRyYW5zbWlzc2lvbiBhbmQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg ICAgIGlnbm9yZWQgb24gcmVjZWlwdC48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICAgICBpZ25vcmVkIG9uIHJlY2VpcHQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIG8gIFJldHVybiBDb2RlIC0gb25lIG9jdGV0IGxvbmcgZmllbGQgdGhhdCBpZGVudGlmaWVz IHRoZSByZXBvcnQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBSZXR1cm4g Q29kZSAtIG9uZSBvY3RldCBsb25nIGZpZWxkIHRoYXQgaWRlbnRpZmllcyB0aGUgcmVwb3J0PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBzaWduYWwsIGUuZy4sIGF2YWlsYWJsZSwg dW5hdmFpbGFibGUuICBUaGUgdmFsdWUgaXMgcGFzc2VkLDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgICAgIHNpZ25hbCwgZS5nLiwgYXZhaWxhYmxlLCB1bmF2YWlsYWJsZS4gIFRo ZSB2YWx1ZSBpcyBwYXNzZWQsPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBzdXBw bGllZCB0byB0aGUgU1RBTVAgZW5kLXBvaW50IHRocm91Z2ggc29tZSBtZWNoYW5pc20gdGhhdCBp czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHN1cHBsaWVkIHRvIHRoZSBT VEFNUCBlbmQtcG9pbnQgdGhyb3VnaCBzb21lIG1lY2hhbmlzbSB0aGF0IGlzPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBvdXRzaWRlIHRoZSBzY29wZSBvZiB0aGlzIGRvY3VtZW50 LiAgVGhlIHZhbHVlIGlzIG9uZSBvZiB0aG9zZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgICAgIG91dHNpZGUgdGhlIHNjb3BlIG9mIHRoaXMgZG9jdW1lbnQuICBUaGUgdmFsdWUg aXMgb25lIG9mIHRob3NlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHIgaWQ9ImRpZmYwMDMyIj48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgIGxpc3RlZCBpbiBTZWN0aW9uIDUuPHNw YW4gY2xhc3M9ImRlbGV0ZSI+NDwvc3Bhbj4uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPiAgICAgIGxpc3RlZCBpbiBTZWN0aW9uIDUuPHNwYW4gY2xhc3M9Imluc2VydCI+NTwvc3Bh bj4uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIFJlc2VydmVkIC0gdHdv IG9jdGV0cyBsb25nIGZpZWxkLCBtdXN0IGJlIHplcm9lZCBvbiB0cmFuc21pc3Npb248L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBSZXNlcnZlZCAtIHR3byBvY3RldHMgbG9u ZyBmaWVsZCwgbXVzdCBiZSB6ZXJvZWQgb24gdHJhbnNtaXNzaW9uPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICBhbmQgaWdub3JlZCBvbiByZWNlaXB0LjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgIGFuZCBpZ25vcmVkIG9uIHJlY2VpcHQuPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBTVEFNUCBTZXNzaW9uLVNlbmRlciB0aGF0IGlu Y2x1ZGVzIHRoZSBBY2Nlc3MgUmVwb3J0IFRMViBzZXRzIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIFRoZSBTVEFNUCBTZXNzaW9uLVNlbmRlciB0aGF0IGluY2x1ZGVzIHRo ZSBBY2Nlc3MgUmVwb3J0IFRMViBzZXRzIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ ICAgdmFsdWUgb2YgdGhlIEFjY2VzcyBJRCBmaWVsZCBhY2NvcmRpbmcgdG8gdGhlIHR5cGUgb2Yg YWNjZXNzIG5ldHdvcms8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB2YWx1ZSBv ZiB0aGUgQWNjZXNzIElEIGZpZWxkIGFjY29yZGluZyB0byB0aGUgdHlwZSBvZiBhY2Nlc3MgbmV0 d29yazwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaXQgcmVwb3J0cyBvbi4gIEFsc28s IHRoZSBTZXNzaW9uLVNlbmRlciBzZXRzIHRoZSB2YWx1ZSBvZiB0aGUgUmV0dXJuPC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaXQgcmVwb3J0cyBvbi4gIEFsc28sIHRoZSBTZXNz aW9uLVNlbmRlciBzZXRzIHRoZSB2YWx1ZSBvZiB0aGUgUmV0dXJuPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBDb2RlIGZpZWxkIHRvIHJlZmxlY3QgdGhlIG9wZXJhdGlvbmFsIHN0YXRl IG9mIHRoZSBhY2Nlc3MgbmV0d29yay48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4g ICBDb2RlIGZpZWxkIHRvIHJlZmxlY3QgdGhlIG9wZXJhdGlvbmFsIHN0YXRlIG9mIHRoZSBhY2Nl c3MgbmV0d29yay48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBtZWNoYW5pc20g dG8gZGV0ZXJtaW5lIHRoZSBzdGF0ZSBvZiB0aGUgYWNjZXNzIG5ldHdvcmsgaXMgb3V0c2lkZTwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZSBtZWNoYW5pc20gdG8gZGV0ZXJt aW5lIHRoZSBzdGF0ZSBvZiB0aGUgYWNjZXNzIG5ldHdvcmsgaXMgb3V0c2lkZTwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgdGhlIHNjb3BlIG9mIHRoaXMgc3BlY2lmaWNhdGlvbi4gIEEg U1RBTVAgU2Vzc2lvbi1SZWZsZWN0b3IgdGhhdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIHRoZSBzY29wZSBvZiB0aGlzIHNwZWNpZmljYXRpb24uICBBIFNUQU1QIFNlc3Npb24t UmVmbGVjdG9yIHRoYXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyIGlkPSJwYXJ0LTEyIiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90ZD48dGg+PHNtYWxsPnNr aXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3Jn L3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMTIiPjxlbT4gcGFnZSAxNiwgbGluZSAzOTxzcGFu IGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGg+IDwvdGg+PHRoPjxzbWFs bD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0dHBzOi8vd3d3Ni5pZXRm Lm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTEyIj48ZW0+IHBhZ2UgMTcsIGxpbmUgMzA8 c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRkPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICBUaGUgQWNjZXNzIFJlcG9ydCBUTFYgaXMgdXNlZCBieSB0aGUgUGVyZm9ybWFuY2UgTWVhc3Vy ZW1lbnQgRnVuY3Rpb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGUgQWNj ZXNzIFJlcG9ydCBUTFYgaXMgdXNlZCBieSB0aGUgUGVyZm9ybWFuY2UgTWVhc3VyZW1lbnQgRnVu Y3Rpb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIChQTUYpIGNvbXBvbmVudHMgb2Yg dGhlIEFjY2VzcyBTdGVlcmluZywgU3dpdGNoaW5nIGFuZCBTcGxpdHRpbmc8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAoUE1GKSBjb21wb25lbnRzIG9mIHRoZSBBY2Nlc3MgU3Rl ZXJpbmcsIFN3aXRjaGluZyBhbmQgU3BsaXR0aW5nPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICBmZWF0dXJlIGZvciA1RyBuZXR3b3JrcyBbVFMyMzUwMV0uICBUaGUgUE1GIGNvbXBvbmVu dCBpbiB0aGUgVXNlcjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGZlYXR1cmUg Zm9yIDVHIG5ldHdvcmtzIFtUUzIzNTAxXS4gIFRoZSBQTUYgY29tcG9uZW50IGluIHRoZSBVc2Vy PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBFcXVpcG1lbnQgYWN0cyBhcyB0aGUgU1RB TVAgU2Vzc2lvbi1TZW5kZXIsIGFuZCB0aGUgUE1GIGNvbXBvbmVudCBpbjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIEVxdWlwbWVudCBhY3RzIGFzIHRoZSBTVEFNUCBTZXNzaW9u LVNlbmRlciwgYW5kIHRoZSBQTUYgY29tcG9uZW50IGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICB0aGUgVXNlciBQbGFuZSBGdW5jdGlvbiBhY3RzIGFzIHRoZSBTVEFNUCBTZXNzaW9u LVJlZmxlY3Rvci48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgVXNlciBQ bGFuZSBGdW5jdGlvbiBhY3RzIGFzIHRoZSBTVEFNUCBTZXNzaW9uLVJlZmxlY3Rvci48L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+NC43LiAgRm9sbG93LXVwIFRlbGVtZXRyeSBUTFY8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij40LjcuICBGb2xsb3ctdXAgVGVsZW1ldHJ5 IFRMVjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBBIFNlc3Npb24tUmVmbGVj dG9yIG1pZ2h0IGJlIGFibGUgdG8gcHV0IGluIHRoZSBUaW1lc3RhbXAgZmllbGQgb25seTwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEEgU2Vzc2lvbi1SZWZsZWN0b3IgbWlnaHQg YmUgYWJsZSB0byBwdXQgaW4gdGhlIFRpbWVzdGFtcCBmaWVsZCBvbmx5PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDMzIj48dGQ+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAg IGFuICJTVyBMb2NhbCIgKHNlZSBUYWJsZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj42PC9zcGFuPikg dGltZXN0YW1wLiAgQnV0IHRoZSBob3N0aW5nIHN5c3RlbSBtaWdodDwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICBhbiAiU1cgTG9jYWwiIChzZWUgVGFibGUgPHNwYW4gY2xhc3M9 Imluc2VydCI+Nzwvc3Bhbj4pIHRpbWVzdGFtcC4gIEJ1dCB0aGUgaG9zdGluZyBzeXN0ZW0gbWln aHQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHByb3ZpZGUgdGhlIHRpbWVzdGFtcCBj bG9zZXIgdG8gdGhlIHN0YXJ0IG9mIHRoZSBhY3R1YWwgcGFja2V0PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgcHJvdmlkZSB0aGUgdGltZXN0YW1wIGNsb3NlciB0byB0aGUgc3Rh cnQgb2YgdGhlIGFjdHVhbCBwYWNrZXQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRy YW5zbWlzc2lvbiBldmVuIHRob3VnaCB3aGVuIGl0IGlzIG5vdCBwb3NzaWJsZSB0byBkZWxpdmVy IHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRyYW5zbWlzc2lvbiBldmVu IHRob3VnaCB3aGVuIGl0IGlzIG5vdCBwb3NzaWJsZSB0byBkZWxpdmVyIHRoZTwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW5mb3JtYXRpb24gdG8gdGhlIFNlc3Npb24tU2VuZGVyIGlu IHRoZSBwYWNrZXQgaXRzZWxmLiAgVGhpczwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIGluZm9ybWF0aW9uIHRvIHRoZSBTZXNzaW9uLVNlbmRlciBpbiB0aGUgcGFja2V0IGl0c2Vs Zi4gIFRoaXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRpbWVzdGFtcCBtaWdodCBu ZXZlcnRoZWxlc3MgYmUgaW1wb3J0YW50IGZvciB0aGUgU2Vzc2lvbi1TZW5kZXIsIGFzPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgdGltZXN0YW1wIG1pZ2h0IG5ldmVydGhlbGVz cyBiZSBpbXBvcnRhbnQgZm9yIHRoZSBTZXNzaW9uLVNlbmRlciwgYXM8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIGl0IGltcHJvdmVzIHRoZSBhY2N1cmFjeSBvZiBtZWFzdXJpbmcgbmV0 d29yayBkZWxheSBieSBtaW5pbWl6aW5nIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIGl0IGltcHJvdmVzIHRoZSBhY2N1cmFjeSBvZiBtZWFzdXJpbmcgbmV0d29yayBkZWxh eSBieSBtaW5pbWl6aW5nIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAg ICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgaW1wYWN0 IG9mIGVncmVzcyBxdWV1aW5nIGRlbGF5cyBvbiB0aGUgbWVhc3VyZW1lbnQuPC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgaW1wYWN0IG9mIGVncmVzcyBxdWV1aW5nIGRlbGF5cyBv biB0aGUgbWVhc3VyZW1lbnQuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIEEg U1RBTVAgU2Vzc2lvbi1TZW5kZXIgTUFZIGluY2x1ZGUgdGhlIEZvbGxvdy11cCBUZWxlbWV0cnkg VExWIHRvPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgQSBTVEFNUCBTZXNzaW9u LVNlbmRlciBNQVkgaW5jbHVkZSB0aGUgRm9sbG93LXVwIFRlbGVtZXRyeSBUTFYgdG88L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHJlcXVlc3QgaW5mb3JtYXRpb24gZnJvbSB0aGUgU2Vz c2lvbi1SZWZsZWN0b3IuICBUaGUgU2Vzc2lvbi1TZW5kZXI8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICByZXF1ZXN0IGluZm9ybWF0aW9uIGZyb20gdGhlIFNlc3Npb24tUmVmbGVj dG9yLiAgVGhlIFNlc3Npb24tU2VuZGVyPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBN VVNUIHNldCB0aGUgRm9sbG93LXVwIFRlbGVtZXRyeSBUeXBlIGFuZCBMZW5ndGggZmllbGRzIHRv IHRoZWlyPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgTVVTVCBzZXQgdGhlIEZv bGxvdy11cCBUZWxlbWV0cnkgVHlwZSBhbmQgTGVuZ3RoIGZpZWxkcyB0byB0aGVpcjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9InBhcnQtMTMiIGNs YXNzPSJjaGFuZ2UiPjx0ZD48L3RkPjx0aD48c21hbGw+c2tpcHBpbmcgdG8gY2hhbmdlIGF0PC9z bWFsbD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcvcmZjZGlmZi9yZmNkaWZmLnB5aHQj cGFydC0xMyI+PGVtPiBwYWdlIDE3LCBsaW5lIDI0PHNwYW4gY2xhc3M9ImhpZGUiPiDCtjwvc3Bh bj48L2VtPjwvYT48L3RoPjx0aD4gPC90aD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBh dDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5w eWh0I3BhcnQtMTMiPjxlbT4gcGFnZSAxOCwgbGluZSAxODxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8 L3NwYW4+PC9lbT48L2E+PC90aD48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgfCAgIEZvbGxvdy11cCBUZWxlbWV0 cnkgVHlwZSAgICB8ICAgICAgICAgICBMZW5ndGggICAgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgfCAgIEZvbGxvdy11cCBUZWxlbWV0cnkgVHlwZSAg ICB8ICAgICAgICAgICBMZW5ndGggICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgIHwgICAgICAg ICAgICAgICAgICAgICAgICBTZXF1ZW5jZSBOdW1iZXIgICAgICAgICAgICAgICAgICAgICAgICB8 PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgIHwgICAgICAgICAgICAgICAg ICAgICAgICBTZXF1ZW5jZSBOdW1iZXIgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xh c3M9InJpZ2h0Ij4gICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg ICAgICB8ICAgICAgICAgICAgICAgICAgICAgIEZvbGxvdy11cCBUaW1lc3RhbXAgICAgICAgICAg ICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICB8ICAg ICAgICAgICAgICAgICAgICAgIEZvbGxvdy11cCBUaW1lc3RhbXAgICAgICAgICAgICAgICAgICAg ICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgIHwgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAgICAgKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICB8ICBU aW1lc3RhbXAgTSAgfCAgICAgICAgICAgICAgICAgICAgIFJlc2VydmVkICAgICAgICAgICAgICAg ICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICB8ICBUaW1lc3RhbXAg TSAgfCAgICAgICAgICAgICAgICAgICAgIFJlc2VydmVkICAgICAgICAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMzQiPjx0ZD48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgICAg ICAgICAgICAgICBGaWd1cmUgMTxzcGFuIGNsYXNzPSJkZWxldGUiPjE8L3NwYW4+OiBGb2xsb3ct dXAgVGVsZW1ldHJ5IFRMVjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAg ICAgICAgICAgICAgIEZpZ3VyZSAxPHNwYW4gY2xhc3M9Imluc2VydCI+Mjwvc3Bhbj46IEZvbGxv dy11cCBUZWxlbWV0cnkgVExWPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHdo ZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBhcyBmb2xsb3dzOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgIHdoZXJlIGZpZWxkcyBhcmUgZGVmaW5lZCBhcyBmb2xsb3dzOjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBGb2xsb3ctdXAgVGVsZW1ldHJ5IFR5cGUg LSBUQkE3IGFsbG9jYXRlZCBieSBJQU5BIFNlY3Rpb24gNS4xLjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIG8gIEZvbGxvdy11cCBUZWxlbWV0cnkgVHlwZSAtIFRCQTcgYWxsb2Nh dGVkIGJ5IElBTkEgU2VjdGlvbiA1LjEuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQi PiAgIG8gIExlbmd0aCAtIHR3byBvY3RldHMgbG9uZyBmaWVsZCwgc2V0IGVxdWFsIHRvIHRoZSB2 YWx1ZSAxNiBvY3RldHMuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgTGVu Z3RoIC0gdHdvIG9jdGV0cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDE2IG9j dGV0cy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgU2VxdWVuY2UgTnVt YmVyIC0gZm91ciBvY3RldHMgbG9uZyBmaWVsZCBpbmRpY2F0aW5nIHRoZSBzZXF1ZW5jZTwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIG8gIFNlcXVlbmNlIE51bWJlciAtIGZvdXIg b2N0ZXRzIGxvbmcgZmllbGQgaW5kaWNhdGluZyB0aGUgc2VxdWVuY2U8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgICAgIG51bWJlciBvZiB0aGUgbGFzdCBwYWNrZXQgcmVmbGVjdGVkIGlu IHRoZSBzYW1lIFNUQU1QLXRlc3Q8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAg ICBudW1iZXIgb2YgdGhlIGxhc3QgcGFja2V0IHJlZmxlY3RlZCBpbiB0aGUgc2FtZSBTVEFNUC10 ZXN0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBzZXNzaW9uLiAgU2luY2UgdGhl IFNlc3Npb24tUmVmbGVjdG9yIHJ1bnMgaW4gdGhlIHN0YXRlZnVsIG1vZGU8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBzZXNzaW9uLiAgU2luY2UgdGhlIFNlc3Npb24tUmVm bGVjdG9yIHJ1bnMgaW4gdGhlIHN0YXRlZnVsIG1vZGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJwYXJ0LTE0IiBjbGFzcz0iY2hhbmdlIj48dGQ+ PC90ZD48dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0 cHM6Ly93d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMTQiPjxlbT4gcGFn ZSAxNywgbGluZSA0NzxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48 dGg+IDwvdGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9 Imh0dHBzOi8vd3d3Ni5pZXRmLm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTE0Ij48ZW0+ IHBhZ2UgMTgsIGxpbmUgNDE8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwv dGg+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBvICBGb2xsb3ctdXAgVGltZXN0YW1wIC0gZWlnaHQgb2N0ZXRz IGxvbmcgZmllbGQsIHdpdGggdGhlIGZvcm1hdDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIG8gIEZvbGxvdy11cCBUaW1lc3RhbXAgLSBlaWdodCBvY3RldHMgbG9uZyBmaWVsZCwg d2l0aCB0aGUgZm9ybWF0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBpbmRpY2F0 ZWQgYnkgdGhlIFogZmxhZyBvZiB0aGUgRXJyb3IgRXN0aW1hdGUgZmllbGQgb2YgdGhlIHBhY2tl dDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIGluZGljYXRlZCBieSB0aGUg WiBmbGFnIG9mIHRoZSBFcnJvciBFc3RpbWF0ZSBmaWVsZCBvZiB0aGUgcGFja2V0PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB0cmFuc21pdHRlZCBieSBhIFNlc3Npb24tUmVmbGVj dG9yLCBhcyBkZXNjcmliZWQgaW4gU2VjdGlvbiA0LjE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgICB0cmFuc21pdHRlZCBieSBhIFNlc3Npb24tUmVmbGVjdG9yLCBhcyBkZXNj cmliZWQgaW4gU2VjdGlvbiA0LjE8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIFtS RkM4NzYyXS4gIEl0IGNhcnJpZXMgdGhlIHRpbWVzdGFtcCB3aGVuIHRoZSByZWZsZWN0ZWQgcGFj a2V0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgW1JGQzg3NjJdLiAgSXQg Y2FycmllcyB0aGUgdGltZXN0YW1wIHdoZW4gdGhlIHJlZmxlY3RlZCBwYWNrZXQ8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIHdpdGggdGhlIHNwZWNpZmllZCBzZXF1ZW5jZSBudW1i ZXIgd2FzIHNlbnQuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgd2l0aCB0 aGUgc3BlY2lmaWVkIHNlcXVlbmNlIG51bWJlciB3YXMgc2VudC48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgbyAgVGltZXN0YW1wIE0ob2RlKSAtIG9uZSBvY3RldCBsb25nIGZp ZWxkIHRoYXQgY2hhcmFjdGVyaXplcyB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICBvICBUaW1lc3RhbXAgTShvZGUpIC0gb25lIG9jdGV0IGxvbmcgZmllbGQgdGhhdCBjaGFy YWN0ZXJpemVzIHRoZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgbWV0aG9kIGJ5 IHdoaWNoIHRoZSBlbnRpdHkgdGhhdCB0cmFuc21pdHMgYSByZWZsZWN0ZWQgU1RBTVAgcGFja2V0 PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgbWV0aG9kIGJ5IHdoaWNoIHRo ZSBlbnRpdHkgdGhhdCB0cmFuc21pdHMgYSByZWZsZWN0ZWQgU1RBTVAgcGFja2V0PC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBvYnRhaW5lZCB0aGUgRm9sbG93LXVwIFRpbWVzdGFt cC4gIFRoZSB2YWx1ZSBpcyBvbmUgb2YgdGhvc2U8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICAgICBvYnRhaW5lZCB0aGUgRm9sbG93LXVwIFRpbWVzdGFtcC4gIFRoZSB2YWx1ZSBp cyBvbmUgb2YgdGhvc2U8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 ciBpZD0iZGlmZjAwMzUiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgbGlzdGVkIGluIFRhYmxlIDxzcGFuIGNs YXNzPSJkZWxldGUiPjY8L3NwYW4+LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4g ICAgICBsaXN0ZWQgaW4gVGFibGUgPHNwYW4gY2xhc3M9Imluc2VydCI+Nzwvc3Bhbj4uPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIG8gIFJlc2VydmVkIC0gdGhlIHRocmVlIG9j dGV0cy1sb25nIGZpZWxkLiAgSXRzIHZhbHVlIE1VU1QgYmUgemVyb2VkPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgbyAgUmVzZXJ2ZWQgLSB0aGUgdGhyZWUgb2N0ZXRzLWxvbmcg ZmllbGQuICBJdHMgdmFsdWUgTVVTVCBiZSB6ZXJvZWQ8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgIG9uIHRyYW5zbWlzc2lvbiBhbmQgaWdub3JlZCBvbiByZWNlaXB0LjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIG9uIHRyYW5zbWlzc2lvbiBhbmQgaWdub3Jl ZCBvbiByZWNlaXB0LjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij40LjguICBITUFD IFRMVjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjQuOC4gIEhNQUMgVExWPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBTVEFNUCBhdXRoZW50aWNhdGVkIG1v ZGUgcHJvdGVjdHMgdGhlIGludGVncml0eSBvZiBkYXRhIGNvbGxlY3RlZDwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoZSBTVEFNUCBhdXRoZW50aWNhdGVkIG1vZGUgcHJvdGVj dHMgdGhlIGludGVncml0eSBvZiBkYXRhIGNvbGxlY3RlZDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+ICAgaW4gdGhlIFNUQU1QIGJhc2UgcGFja2V0LiAgU1RBTVAgZXh0ZW5zaW9ucyBhcmUg ZGVzaWduZWQgdG8gcHJvdmlkZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGlu IHRoZSBTVEFNUCBiYXNlIHBhY2tldC4gIFNUQU1QIGV4dGVuc2lvbnMgYXJlIGRlc2lnbmVkIHRv IHByb3ZpZGU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHZhbHVhYmxlIGluZm9ybWF0 aW9uIGFib3V0IHRoZSBjb25kaXRpb24gb2YgYSBuZXR3b3JrLCBhbmQgcHJvdGVjdGluZzwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHZhbHVhYmxlIGluZm9ybWF0aW9uIGFib3V0 IHRoZSBjb25kaXRpb24gb2YgYSBuZXR3b3JrLCBhbmQgcHJvdGVjdGluZzwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgdGhlIGludGVncml0eSBvZiB0aGF0IGRhdGEgaXMgYWxzbyBlc3Nl bnRpYWwuICBUaGUga2V5ZWQgSGFzaGVkPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgdGhlIGludGVncml0eSBvZiB0aGF0IGRhdGEgaXMgYWxzbyBlc3NlbnRpYWwuICBUaGUga2V5 ZWQgSGFzaGVkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 ciBpZD0icGFydC0xNSIgY2xhc3M9ImNoYW5nZSI+PHRkPjwvdGQ+PHRoPjxzbWFsbD5za2lwcGlu ZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0dHBzOi8vd3d3Ni5pZXRmLm9yZy9yZmNk aWZmL3JmY2RpZmYucHlodCNwYXJ0LTE1Ij48ZW0+IHBhZ2UgMTgsIGxpbmUgMjk8c3BhbiBjbGFz cz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tp cHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcv cmZjZGlmZi9yZmNkaWZmLnB5aHQjcGFydC0xNSI+PGVtPiBwYWdlIDE5LCBsaW5lIDIxPHNwYW4g Y2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAwIDEg MiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxIDIgMyA0IDUgNiA3IDggOSAw IDE8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgMCAxIDIgMyA0IDUgNiA3 IDggOSAwIDEgMiAzIDQgNSA2IDcgOCA5IDAgMSAyIDMgNCA1IDYgNyA4IDkgMCAxPC90ZD48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0r LSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAg ICB8ICAgICAgICAgICAgSE1BQyBUeXBlICAgICAgICAgIHwgICAgICAgICAgICAgTGVuZ3RoICAg ICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAg ICAgICBITUFDIFR5cGUgICAgICAgICAgfCAgICAgICAgICAgICBMZW5ndGggICAgICAgICAgICB8 PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAg IHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgSE1BQyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBITUFDICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgICAgIHwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB8ICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIHwgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8PC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICArLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKzwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgICAgICstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rLSst Ky0rLSstKy0rLSstKy0rLSstKy0rLSstKy0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMzYiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAgICAgICAg ICAgICAgICAgICAgICAgIEZpZ3VyZSAxPHNwYW4gY2xhc3M9ImRlbGV0ZSI+Mjwvc3Bhbj46IEhN QUMgVExWPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAg ICAgICAgICAgICBGaWd1cmUgMTxzcGFuIGNsYXNzPSJpbnNlcnQiPjM8L3NwYW4+OiBITUFDIFRM VjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICB3aGVyZSBmaWVsZHMgYXJlIGRl ZmluZWQgYXMgZm9sbG93czo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB3aGVy ZSBmaWVsZHMgYXJlIGRlZmluZWQgYXMgZm9sbG93czo8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgbyAgSE1BQyBUeXBlIC0gaXMgdHdvIG9jdGV0cyBsb25nIGZpZWxkLCB2YWx1 ZSBUQkE4IGFsbG9jYXRlZCBieSBJQU5BPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgbyAgSE1BQyBUeXBlIC0gaXMgdHdvIG9jdGV0cyBsb25nIGZpZWxkLCB2YWx1ZSBUQkE4IGFs bG9jYXRlZCBieSBJQU5BPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBTZWN0aW9u IDUuMS48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBTZWN0aW9uIDUuMS48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgbyAgTGVuZ3RoIC0gdHdvIG9jdGV0 cyBsb25nIGZpZWxkLCBzZXQgZXF1YWwgdG8gdGhlIHZhbHVlIDE2IG9jdGV0cy48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvICBMZW5ndGggLSB0d28gb2N0ZXRzIGxvbmcgZmll bGQsIHNldCBlcXVhbCB0byB0aGUgdmFsdWUgMTYgb2N0ZXRzLjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICBvICBITUFDIC0gaXMgMTYgb2N0ZXRzIGxvbmcgZmllbGQgdGhhdCBj YXJyaWVzIEhNQUMgZGlnZXN0IG9mIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIG8gIEhNQUMgLSBpcyAxNiBvY3RldHMgbG9uZyBmaWVsZCB0aGF0IGNhcnJpZXMgSE1BQyBk aWdlc3Qgb2YgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICB0ZXh0IG9mIGFs bCBwcmVjZWRpbmcgVExWcy48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICB0 ZXh0IG9mIGFsbCBwcmVjZWRpbmcgVExWcy48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyIGlkPSJwYXJ0LTE2IiBjbGFzcz0iY2hhbmdlIj48dGQ+PC90ZD48 dGg+PHNtYWxsPnNraXBwaW5nIHRvIGNoYW5nZSBhdDwvc21hbGw+PGEgaHJlZj0iaHR0cHM6Ly93 d3c2LmlldGYub3JnL3JmY2RpZmYvcmZjZGlmZi5weWh0I3BhcnQtMTYiPjxlbT4gcGFnZSAxOSwg bGluZSAyMDxzcGFuIGNsYXNzPSJoaWRlIj4gwrY8L3NwYW4+PC9lbT48L2E+PC90aD48dGg+IDwv dGg+PHRoPjxzbWFsbD5za2lwcGluZyB0byBjaGFuZ2UgYXQ8L3NtYWxsPjxhIGhyZWY9Imh0dHBz Oi8vd3d3Ni5pZXRmLm9yZy9yZmNkaWZmL3JmY2RpZmYucHlodCNwYXJ0LTE2Ij48ZW0+IHBhZ2Ug MjAsIGxpbmUgMTc8c3BhbiBjbGFzcz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRk PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+NS4xLiAgU1RBTVAgVExWIFJlZ2lzdHJ5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+NS4xLiAgU1RBTVAgVExWIFJlZ2lzdHJ5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIElBTkEgaXMgcmVxdWVzdGVkIHRvIGNyZWF0ZSB0aGUgU1RBTVAgVExWIFR5cGUg cmVnaXN0cnkuICBBbGwgY29kZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIElB TkEgaXMgcmVxdWVzdGVkIHRvIGNyZWF0ZSB0aGUgU1RBTVAgVExWIFR5cGUgcmVnaXN0cnkuICBB bGwgY29kZTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgcG9pbnRzIGluIHRoZSByYW5n ZSAxIHRocm91Z2ggMzI3NTkgaW4gdGhpcyByZWdpc3RyeSBzaGFsbCBiZTwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIHBvaW50cyBpbiB0aGUgcmFuZ2UgMSB0aHJvdWdoIDMyNzU5 IGluIHRoaXMgcmVnaXN0cnkgc2hhbGwgYmU8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlICJJRVRGIFJldmlldyIgcHJvY2VkdXJlIGFzIHNw ZWNpZmllZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFsbG9jYXRlZCBh Y2NvcmRpbmcgdG8gdGhlICJJRVRGIFJldmlldyIgcHJvY2VkdXJlIGFzIHNwZWNpZmllZCBpbjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgW1JGQzgxMjZdLiAgQ29kZSBwb2ludHMgaW4g dGhlIHJhbmdlIDMyNzYwIHRocm91Z2ggNjUyNzkgaW4gdGhpczwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIFtSRkM4MTI2XS4gIENvZGUgcG9pbnRzIGluIHRoZSByYW5nZSAzMjc2 MCB0aHJvdWdoIDY1Mjc5IGluIHRoaXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHJl Z2lzdHJ5IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlICJGaXJzdCBDb21lIEZp cnN0PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcmVnaXN0cnkgc2hhbGwgYmUg YWxsb2NhdGVkIGFjY29yZGluZyB0byB0aGUgIkZpcnN0IENvbWUgRmlyc3Q8L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxlZnQiPiAgIFNlcnZlZCIgcHJvY2VkdXJlIGFzIHNwZWNpZmllZCBpbiBbUkZD ODEyNl0uICBSZW1haW5pbmcgY29kZSBwb2ludHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICBTZXJ2ZWQiIHByb2NlZHVyZSBhcyBzcGVjaWZpZWQgaW4gW1JGQzgxMjZdLiAgUmVt YWluaW5nIGNvZGUgcG9pbnRzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhcmUgYWxs b2NhdGVkIGFjY29yZGluZyB0byBUYWJsZSAxOjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIGFyZSBhbGxvY2F0ZWQgYWNjb3JkaW5nIHRvIFRhYmxlIDE6PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwMzciPjx0ZD48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPistLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSs8L3NwYW4+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4rLS0t LS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICB8IFZhbHVlICAgICAgICAgfCAgICAg ICAgICAgRGVzY3JpcHRpb24gICAgICAgICAgIHwgUmVmZXJlbmNlICAgICB8PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICB8IFZhbHVlICAgICB8IERlc2NyaXB0aW9u ICB8IFJlZmVyZW5jZSAgICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgIDxzcGFuIGNsYXNzPSJkZWxldGUiPistLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSs8L3NwYW4+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4rLS0t LS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICB8IDAgICAgICAgICAgICAgfCAgICAg ICAgICAgICBSZXNlcnZlZCAgICAgICAgICAgIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICB8IDAgICAgICAgICB8ICAgUmVzZXJ2ZWQg ICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk PjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9j ayI+ICAgIHwgMS0gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+NjUyNzk8L3NwYW4+ICAgICAgfCA8c3Bh biBjbGFzcz0iZGVsZXRlIj5TVEFNUCBleHRlbnNpb24gVExWLCB1bmFzc2lnbmVkPC9zcGFuPiB8 IElFVEYgUmV2aWV3ICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAg ICAgfCAxLSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xNzU8L3NwYW4+ICAgIHwgIDxzcGFuIGNsYXNz PSJpbnNlcnQiPlVuYXNzaWduZWQ8L3NwYW4+ICB8IElFVEYgUmV2aWV3ICAgICAgICAgICAgIHw8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgIHwgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+ NjUyODA8L3NwYW4+IC0gPHNwYW4gY2xhc3M9ImRlbGV0ZSI+NjU1MTk8L3NwYW4+IHwgICAgICAg ICAgIEV4cGVyaW1lbnRhbCAgICAgICAgICB8IFRoaXMgZG9jdW1lbnQgfDwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgICAgfCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4xNzY8 L3NwYW4+IC0gPHNwYW4gY2xhc3M9Imluc2VydCI+MjM5IHwgIFVuYXNzaWduZWQgIHwgRmlyc3Qg Q29tZSBGaXJzdCBTZXJ2ZWQgfDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgIHwgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+NjU1MjA8L3NwYW4+IC0gPHNwYW4gY2xhc3M9ImRl bGV0ZSI+NjU1MzQ8L3NwYW4+IHwgICAgICAgICAgIFByaXZhdGUgVXNlICAgICAgICAgICB8IFRo aXMgZG9jdW1lbnQgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFz cz0iaW5zZXJ0Ij4gICAgICAgICAgfCAyNDAgLSAyNTE8L3NwYW4+IHwgRXhwZXJpbWVudGFsIHwg VGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4g ICAgfCA8c3BhbiBjbGFzcz0iZGVsZXRlIj42NTUzNTwvc3Bhbj4gICAgICAgICB8ICAgICAgICAg ICAgIFJlc2VydmVkICAgICAgICAgICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+ICAgICAgICAgIHwgPHNwYW4gY2xhc3M9Imluc2VydCI+MjUyPC9z cGFuPiAtIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjI1NDwvc3Bhbj4gfCBQcml2YXRlIFVzZSAgfCBU aGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3Ry PgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAg ICA8c3BhbiBjbGFzcz0iZGVsZXRlIj4rLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC9zcGFuPjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgICAgfCA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij4yNTU8L3Nw YW4+ICAgICAgIHwgICBSZXNlcnZlZCAgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9j ayI+ICAgICAgICAgIDxzcGFuIGNsYXNzPSJpbnNlcnQiPistLS0tLS0tLS0tLSstLS0tLS0tLS0t LS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0 ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICAgICAgICAgVGFibGUgMTogU1RBTVAgVExWIFR5 cGUgUmVnaXN0cnk8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAg ICAgICAgICBUYWJsZSAxOiBTVEFNUCBUTFYgVHlwZSBSZWdpc3RyeTwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICBUaGlzIGRvY3VtZW50IGRlZmluZXMgdGhlIGZvbGxvd2luZyBu ZXcgdmFsdWVzIGluIHRoZSBTVEFNUCBFeHRlbnNpb248L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICBUaGlzIGRvY3VtZW50IGRlZmluZXMgdGhlIGZvbGxvd2luZyBuZXcgdmFsdWVz IGluIHRoZSBTVEFNUCBFeHRlbnNpb248L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRM ViByYW5nZSBvZiB0aGUgU1RBTVAgVExWIFR5cGUgcmVnaXN0cnk6PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgVExWIHJhbmdlIG9mIHRoZSBTVEFNUCBUTFYgVHlwZSByZWdpc3Ry eTo8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICstLS0tLS0t Ky0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAg ICAgICAgIHwgVmFsdWUgfCAgICAgIERlc2NyaXB0aW9uICAgICAgfCBSZWZlcmVuY2UgICAgIHw8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgfCBWYWx1ZSB8ICAg ICAgRGVzY3JpcHRpb24gICAgICB8IFJlZmVyZW5jZSAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGVmdCI+ICAgICAgICAgICAgICstLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0t LS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAg ICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgIHwgVEJBMSAgfCAgICAgRXh0cmEg UGFkZGluZyAgICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICAgICAgICAgICAgfCBUQkExICB8ICAgICBFeHRyYSBQYWRkaW5nICAgICB8IFRoaXMg ZG9jdW1lbnQgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHIgaWQ9InBhcnQtMTciIGNsYXNzPSJjaGFuZ2UiPjx0ZD48L3RkPjx0aD48c21hbGw+c2tpcHBp bmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcvcmZj ZGlmZi9yZmNkaWZmLnB5aHQjcGFydC0xNyI+PGVtPiBwYWdlIDIwLCBsaW5lIDU8c3BhbiBjbGFz cz0iaGlkZSI+IMK2PC9zcGFuPjwvZW0+PC9hPjwvdGg+PHRoPiA8L3RoPjx0aD48c21hbGw+c2tp cHBpbmcgdG8gY2hhbmdlIGF0PC9zbWFsbD48YSBocmVmPSJodHRwczovL3d3dzYuaWV0Zi5vcmcv cmZjZGlmZi9yZmNkaWZmLnB5aHQjcGFydC0xNyI+PGVtPiBwYWdlIDIwLCBsaW5lIDQ4PHNwYW4g Y2xhc3M9ImhpZGUiPiDCtjwvc3Bhbj48L2VtPjwvYT48L3RoPjx0ZD48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAg ICB8IFRCQTMgIHwgVGltZXN0YW1wIEluZm9ybWF0aW9uIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgIHwgVEJBMyAgfCBUaW1lc3Rh bXAgSW5mb3JtYXRpb24gfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgICAgICAgICB8IFRCQTQgIHwgICAgQ2xhc3Mgb2YgU2VydmljZSAgIHwgVGhpcyBk b2N1bWVudCB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgIHwg VEJBNCAgfCAgICBDbGFzcyBvZiBTZXJ2aWNlICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICB8IFRCQTUgIHwgICBEaXJlY3QgTWVhc3Vy ZW1lbnQgIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ ICAgICAgICAgICAgIHwgVEJBNSAgfCAgIERpcmVjdCBNZWFzdXJlbWVudCAgfCBUaGlzIGRvY3Vt ZW50IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICB8IFRCQTYgIHwg ICAgIEFjY2VzcyBSZXBvcnQgICAgIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgIHwgVEJBNiAgfCAgICAgQWNjZXNzIFJlcG9ydCAg ICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAg ICAgICB8IFRCQTcgIHwgIEZvbGxvdy11cCBUZWxlbWV0cnkgIHwgVGhpcyBkb2N1bWVudCB8PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgIHwgVEJBNyAgfCAgRm9s bG93LXVwIFRlbGVtZXRyeSAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgICAgICB8IFRCQTggIHwgICAgICAgICAgSE1BQyAgICAgICAgIHwgVGhp cyBkb2N1bWVudCB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAg IHwgVEJBOCAgfCAgICAgICAgICBITUFDICAgICAgICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICArLS0tLS0tLSstLS0tLS0tLS0tLS0t LS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgICAgICAgICAgICstLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICAg ICAgICAgICAgICAgVGFibGUgMjogU1RBTVAgVHlwZXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJpZ2h0Ij4gICAgICAgICAgICAgICAgICAgICAgICAgICBUYWJsZSAyOiBTVEFNUCBUeXBlczwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYw MDM4Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPjUuMi4gIFN5bmNocm9uaXphdGlvbiBTb3VyY2UgU3ViLXJlZ2lzdHJ5 PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjUuMi4gIDxzcGFuIGNsYXNzPSJpbnNl cnQiPlNUQU1QIFRMViBGbGFncyBTdWItcmVnaXN0cnk8L3NwYW4+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFz cz0iaW5zZXJ0Ij48L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBJQU5BIGlz IHJlcXVlc3RlZCB0byBjcmVhdGUgU1RBTVAgVExWIEZsYWdzIHN1Yi1yZWdpc3RyeSBhcyBwYXJ0 IG9mPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgdGhlIFNUQU1QIFRMViBU eXBlIHJlZ2lzdHJ5LiAgVGhlIHJlZ2lzdHJhdGlvbiBwcm9jZWR1cmUgaXMgIklFVEY8L3NwYW4+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICBSZXZpZXciIFtSRkM4MTI2XS4gIEZsYWdz IGFyZSA4IGJpdHMuICBUaGlzIGRvY3VtZW50IGRlZmluZXMgdGhlPC9zcGFuPjwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNw YW4gY2xhc3M9Imluc2VydCI+ICAgZm9sbG93aW5nIGJpdCBwb3NpdGlvbnMgaW4gdGhlIFNUQU1Q IFRMViBGbGFncyBzdWItcmVnaXN0cnk6PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJs b2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2Vy dCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+ICAgICAgICstLS0tLS0tLS0t LS0tLSstLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvc3Bhbj48 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy YmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAgICB8IEJpdCBwb3NpdGlvbiB8IFN5bWJv bCB8ICAgRGVzY3JpcHRpb24gICAgfCAgIFJlZmVyZW5jZSAgIHw8L3NwYW4+PC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj48c3Bh biBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgKy0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9Imlu c2VydCI+ICAgICAgIHwgICAgICAwICAgICAgIHwgICBVICAgIHwgVW5yZWNvZ25pemVkIFRMViB8 IFRoaXMgZG9jdW1lbnQgfDwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90 ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPiAgICAg ICB8ICAgICAgMSAgICAgICB8ICAgTCAgICB8ICBNYWxmb3JtZWQgVExWICAgfCBUaGlzIGRvY3Vt ZW50IHw8L3NwYW4+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj48c3BhbiBjbGFzcz0iaW5zZXJ0Ij4gICAgICAgKy0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC9zcGFu PjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9 InJibG9jayI+PHNwYW4gY2xhc3M9Imluc2VydCI+PC9zcGFuPjwvdGQ+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFz cz0ibGJsb2NrIj48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+PHNwYW4gY2xhc3M9 Imluc2VydCI+ICAgICAgICAgICAgICAgICAgICAgICAgIFRhYmxlIDM6IFNUQU1QIFRMViBGbGFn czwvc3Bhbj48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPjxzcGFuIGNsYXNzPSJpbnNlcnQiPjwvc3Bhbj48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjxzcGFu IGNsYXNzPSJpbnNlcnQiPjUuMy48L3NwYW4+ICBTeW5jaHJvbml6YXRpb24gU291cmNlIFN1Yi1y ZWdpc3RyeTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNs YXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBJQU5BIGlzIHJlcXVl c3RlZCB0byBjcmVhdGUgU3luY2hyb25pemF0aW9uIFNvdXJjZSBzdWItcmVnaXN0cnkgYXM8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBJQU5BIGlzIHJlcXVlc3RlZCB0byBjcmVh dGUgU3luY2hyb25pemF0aW9uIFNvdXJjZSBzdWItcmVnaXN0cnkgYXM8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIHBhcnQgb2YgdGhlIFNUQU1QIFRMViBUeXBlIHJlZ2lzdHJ5LiAgQWxs IGNvZGUgcG9pbnRzIGluIHRoZSByYW5nZSAxPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgcGFydCBvZiB0aGUgU1RBTVAgVExWIFR5cGUgcmVnaXN0cnkuICBBbGwgY29kZSBwb2lu dHMgaW4gdGhlIHJhbmdlIDE8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRocm91Z2gg MTI3IGluIHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxsb2NhdGVkIGFjY29yZGluZyB0byB0aGU8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aHJvdWdoIDEyNyBpbiB0aGlzIHJl Z2lzdHJ5IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij4gICAiSUVURiBSZXZpZXciIHByb2NlZHVyZSBhcyBzcGVjaWZpZWQgaW4g W1JGQzgxMjZdLiAgQ29kZSBwb2ludHMgaW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0 Ij4gICAiSUVURiBSZXZpZXciIHByb2NlZHVyZSBhcyBzcGVjaWZpZWQgaW4gW1JGQzgxMjZdLiAg Q29kZSBwb2ludHMgaW48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRoZSByYW5nZSAx MjggdGhyb3VnaCAyMzkgaW4gdGhpcyByZWdpc3RyeSBzaGFsbCBiZSBhbGxvY2F0ZWQ8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgcmFuZ2UgMTI4IHRocm91Z2ggMjM5IGlu IHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxsb2NhdGVkPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBhY2NvcmRpbmcgdG8gdGhlICJGaXJzdCBDb21lIEZpcnN0IFNlcnZlZCIgcHJvY2Vk dXJlIGFzIHNwZWNpZmllZCBpbjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIGFj Y29yZGluZyB0byB0aGUgIkZpcnN0IENvbWUgRmlyc3QgU2VydmVkIiBwcm9jZWR1cmUgYXMgc3Bl Y2lmaWVkIGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9 ImRpZmYwMDM5Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwv dGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFtSRkM4MTI2XS4gIFJlbWFpbmluZyBjb2RlIHBvaW50 cyBhcmUgYWxsb2NhdGVkIGFjY29yZGluZyB0byBUYWJsZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj4x PC9zcGFuPjo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAgW1JGQzgxMjZdLiAg UmVtYWluaW5nIGNvZGUgcG9pbnRzIGFyZSBhbGxvY2F0ZWQgYWNjb3JkaW5nIHRvIFRhYmxlIDxz cGFuIGNsYXNzPSJpbnNlcnQiPjQ8L3NwYW4+OjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICst LS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwgVmFsdWUgICAgIHwgRGVzY3JpcHRp b24gIHwgUmVmZXJlbmNlICAgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICB8IFZhbHVlICAgICB8IERlc2NyaXB0aW9uICB8IFJlZmVyZW5jZSAg ICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICArLS0t LS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgfCAwICAgICAgICAgfCAgIFJlc2VydmVkICAgfCBUaGlzIGRvY3VtZW50 ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgIHwg MCAgICAgICAgIHwgICBSZXNlcnZlZCAgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwgMS0gMTI3ICAgIHwgIFVuYXNzaWdu ZWQgIHwgSUVURiBSZXZpZXcgICAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICB8IDEtIDEyNyAgICB8ICBVbmFzc2lnbmVkICB8IElFVEYgUmV2aWV3 ICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICB8IDEy OCAtIDIzOSB8ICBVbmFzc2lnbmVkICB8IEZpcnN0IENvbWUgRmlyc3QgU2VydmVkIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgfCAxMjggLSAyMzkgfCAgVW5hc3Np Z25lZCAgfCBGaXJzdCBDb21lIEZpcnN0IFNlcnZlZCB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgfCAyNDAgLSAyNDkgfCBFeHBlcmltZW50YWwgfCBUaGlzIGRvY3VtZW50 ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgIHwg MjQwIC0gMjQ5IHwgRXhwZXJpbWVudGFsIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwgMjUwIC0gMjU0IHwgUHJpdmF0ZSBV c2UgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICB8IDI1MCAtIDI1NCB8IFByaXZhdGUgVXNlICB8IFRoaXMgZG9jdW1l bnQgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICB8IDI1 NSAgICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgfCAyNTUgICAgICAgfCAgIFJlc2Vy dmVkICAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICst LS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDQw Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsYmxvY2siPiAgICAgICAgICAgICAgIFRhYmxlIDxzcGFuIGNsYXNzPSJkZWxldGUiPjM8 L3NwYW4+OiBTeW5jaHJvbml6YXRpb24gU291cmNlIFN1Yi1yZWdpc3RyeTwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmJsb2NrIj4gICAgICAgICAgICAgICBUYWJsZSA8c3BhbiBjbGFzcz0iaW5z ZXJ0Ij40PC9zcGFuPjogU3luY2hyb25pemF0aW9uIFNvdXJjZSBTdWItcmVnaXN0cnk8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwv dGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIHRoZSBm b2xsb3dpbmcgbmV3IHZhbHVlcyBpbiB0aGUgU3luY2hyb25pemF0aW9uPC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIHRoZSBmb2xsb3dpbmcg bmV3IHZhbHVlcyBpbiB0aGUgU3luY2hyb25pemF0aW9uPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICBTb3VyY2Ugc3ViLXJlZ2lzdHJ5OjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPiAgIFNvdXJjZSBzdWItcmVnaXN0cnk6PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICst LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xh c3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIHwgVmFsdWUgfCAgICAgRGVzY3JpcHRpb24g ICAgIHwgUmVmZXJlbmNlICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAg ICAgICAgICAgICB8IFZhbHVlIHwgICAgIERlc2NyaXB0aW9uICAgICB8IFJlZmVyZW5jZSAgICAg fDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICArLS0tLS0tLSstLS0t LS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0t LS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAg fCAxICAgICB8ICAgICAgICAgTlRQICAgICAgICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIHwgMSAgICAgfCAgICAgICAgIE5U UCAgICAgICAgIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4g ICAgICAgICAgICAgIHwgMiAgICAgfCAgICAgICAgIFBUUCAgICAgICAgIHwgVGhpcyBkb2N1bWVu dCB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICB8IDIgICAg IHwgICAgICAgICBQVFAgICAgICAgICB8IFRoaXMgZG9jdW1lbnQgfDwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgICAgICAgICAgICB8IDMgICAgIHwgICAgICAgU1NVL0JJVFMgICAgICB8 IFRoaXMgZG9jdW1lbnQgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAg ICAgICAgfCAzICAgICB8ICAgICAgIFNTVS9CSVRTICAgICAgfCBUaGlzIGRvY3VtZW50IHw8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgfCA0ICAgICB8IEdQUy9HTE9O QVNTL0xPUkFOLUMgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJp Z2h0Ij4gICAgICAgICAgICAgIHwgNCAgICAgfCBHUFMvR0xPTkFTUy9MT1JBTi1DIHwgVGhpcyBk b2N1bWVudCB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIHwgNSAg ICAgfCAgTG9jYWwgZnJlZS1ydW5uaW5nIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICB8IDUgICAgIHwgIExvY2FsIGZyZWUtcnVu bmluZyB8IFRoaXMgZG9jdW1lbnQgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAg ICAgICAgICArLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgKy0tLS0tLS0rLS0t LS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDA0MSI+PHRkPjwvdGQ+PC90cj4K ICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAg ICAgICAgICAgICAgICAgICBUYWJsZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj40PC9zcGFuPjogU3lu Y2hyb25pemF0aW9uIFNvdXJjZXM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ICAg ICAgICAgICAgICAgICAgICAgVGFibGUgPHNwYW4gY2xhc3M9Imluc2VydCI+NTwvc3Bhbj46IFN5 bmNocm9uaXphdGlvbiBTb3VyY2VzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwNDIiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+NS48c3BhbiBjbGFzcz0iZGVs ZXRlIj4zPC9zcGFuPi4gIFRpbWVzdGFtcGluZyBNZXRob2QgU3ViLXJlZ2lzdHJ5PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPjUuPHNwYW4gY2xhc3M9Imluc2VydCI+NDwvc3Bhbj4u ICBUaW1lc3RhbXBpbmcgTWV0aG9kIFN1Yi1yZWdpc3RyeTwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0i bGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij4gICBJQU5BIGlzIHJlcXVlc3RlZCB0byBjcmVhdGUgVGltZXN0YW1waW5nIE1l dGhvZCBzdWItcmVnaXN0cnkgYXMgcGFydDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQi PiAgIElBTkEgaXMgcmVxdWVzdGVkIHRvIGNyZWF0ZSBUaW1lc3RhbXBpbmcgTWV0aG9kIHN1Yi1y ZWdpc3RyeSBhcyBwYXJ0PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBvZiB0aGUgU1RB TVAgVExWIFR5cGUgcmVnaXN0cnkuICBBbGwgY29kZSBwb2ludHMgaW4gdGhlIHJhbmdlIDE8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBvZiB0aGUgU1RBTVAgVExWIFR5cGUgcmVn aXN0cnkuICBBbGwgY29kZSBwb2ludHMgaW4gdGhlIHJhbmdlIDE8L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgIHRocm91Z2ggMTI3IGluIHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxsb2Nh dGVkIGFjY29yZGluZyB0byB0aGU8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0 aHJvdWdoIDEyNyBpbiB0aGlzIHJlZ2lzdHJ5IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcg dG8gdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAiSUVURiBSZXZpZXciIHByb2Nl ZHVyZSBhcyBzcGVjaWZpZWQgaW4gW1JGQzgxMjZdLiAgQ29kZSBwb2ludHMgaW48L3RkPjx0ZD4g PC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAiSUVURiBSZXZpZXciIHByb2NlZHVyZSBhcyBzcGVj aWZpZWQgaW4gW1JGQzgxMjZdLiAgQ29kZSBwb2ludHMgaW48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIHRoZSByYW5nZSAxMjggdGhyb3VnaCAyMzkgaW4gdGhpcyByZWdpc3RyeSBzaGFs bCBiZSBhbGxvY2F0ZWQ8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGUgcmFu Z2UgMTI4IHRocm91Z2ggMjM5IGluIHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxsb2NhdGVkPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBhY2NvcmRpbmcgdG8gdGhlICJGaXJzdCBDb21l IEZpcnN0IFNlcnZlZCIgcHJvY2VkdXJlIGFzIHNwZWNpZmllZCBpbjwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgIGFjY29yZGluZyB0byB0aGUgIkZpcnN0IENvbWUgRmlyc3QgU2Vy dmVkIiBwcm9jZWR1cmUgYXMgc3BlY2lmaWVkIGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHIgaWQ9ImRpZmYwMDQzIj48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgIFtSRkM4MTI2XS4g IFJlbWFpbmluZyBjb2RlIHBvaW50cyBhcmUgYWxsb2NhdGVkIGFjY29yZGluZyB0byBUYWJsZSA8 c3BhbiBjbGFzcz0iZGVsZXRlIj4xPC9zcGFuPjo8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJi bG9jayI+ICAgW1JGQzgxMjZdLiAgUmVtYWluaW5nIGNvZGUgcG9pbnRzIGFyZSBhbGxvY2F0ZWQg YWNjb3JkaW5nIHRvIFRhYmxlIDxzcGFuIGNsYXNzPSJpbnNlcnQiPjY8L3NwYW4+OjwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICAgICAgICstLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwg VmFsdWUgICAgIHwgRGVzY3JpcHRpb24gIHwgUmVmZXJlbmNlICAgICAgICAgICAgICAgfDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICB8IFZhbHVlICAgICB8IERlc2Ny aXB0aW9uICB8IFJlZmVyZW5jZSAgICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgICArLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAg Ky0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgfCAwICAgICAgICAgfCAgIFJlc2Vy dmVkICAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICAgICAgIHwgMCAgICAgICAgIHwgICBSZXNlcnZlZCAgIHwgVGhpcyBkb2N1 bWVudCAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwg MS0gMTI3ICAgIHwgIFVuYXNzaWduZWQgIHwgSUVURiBSZXZpZXcgICAgICAgICAgICAgfDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICB8IDEtIDEyNyAgICB8ICBVbmFz c2lnbmVkICB8IElFVEYgUmV2aWV3ICAgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgICB8IDEyOCAtIDIzOSB8ICBVbmFzc2lnbmVkICB8IEZpcnN0IENvbWUg Rmlyc3QgU2VydmVkIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAg fCAxMjggLSAyMzkgfCAgVW5hc3NpZ25lZCAgfCBGaXJzdCBDb21lIEZpcnN0IFNlcnZlZCB8PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgfCAyNDAgLSAyNDkgfCBFeHBlcmlt ZW50YWwgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICAgICAgIHwgMjQwIC0gMjQ5IHwgRXhwZXJpbWVudGFsIHwgVGhpcyBkb2N1 bWVudCAgICAgICAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwg MjUwIC0gMjU0IHwgUHJpdmF0ZSBVc2UgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICB8IDI1MCAtIDI1NCB8IFByaXZh dGUgVXNlICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgICAgICAgICB8IDI1NSAgICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1l bnQgICAgICAgICAgIHw8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAg fCAyNTUgICAgICAgfCAgIFJlc2VydmVkICAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgICAgICAgICstLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAg PHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyaWdodCI+PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHIgaWQ9ImRpZmYwMDQ0Ij48dGQ+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsYmxvY2siPiAgICAgICAgICAgICAgICAgVGFibGUg PHNwYW4gY2xhc3M9ImRlbGV0ZSI+NTwvc3Bhbj46IFRpbWVzdGFtcGluZyBNZXRob2QgU3ViLXJl Z2lzdHJ5PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAg VGFibGUgPHNwYW4gY2xhc3M9Imluc2VydCI+Njwvc3Bhbj46IFRpbWVzdGFtcGluZyBNZXRob2Qg U3ViLXJlZ2lzdHJ5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoaXMgZG9j dW1lbnQgZGVmaW5lcyB0aGUgZm9sbG93aW5nIG5ldyB2YWx1ZXMgaW4gdGhlIFRpbWVzdGFtcGlu ZzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRoaXMgZG9jdW1lbnQgZGVmaW5l cyB0aGUgZm9sbG93aW5nIG5ldyB2YWx1ZXMgaW4gdGhlIFRpbWVzdGFtcGluZzwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgTWV0aG9kcyBzdWItcmVnaXN0cnk6PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyaWdodCI+ICAgTWV0aG9kcyBzdWItcmVnaXN0cnk6PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tKy0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAg ICAgICAgICAgICAgICstLS0tLS0tKy0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC90 ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5l bm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgICAgIHwgVmFsdWUgfCAgRGVz Y3JpcHRpb24gIHwgUmVmZXJlbmNlICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgICAgICAgICAgICAgICB8IFZhbHVlIHwgIERlc2NyaXB0aW9uICB8IFJlZmVyZW5jZSAg ICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICAgICArLS0tLS0t LSstLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFz cz0icmlnaHQiPiAgICAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKy0tLS0t LS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICAgICAgICAg fCAxICAgICB8ICAgSFcgQXNzaXN0ICAgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgIHwgMSAgICAgfCAgIEhXIEFzc2lzdCAg IHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAg ICAgICAgIHwgMiAgICAgfCAgICBTVyBsb2NhbCAgIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQ+ IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICAgICB8IDIgICAgIHwgICAgU1cg bG9jYWwgICB8IFRoaXMgZG9jdW1lbnQgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg ICAgICAgICAgICAgICB8IDMgICAgIHwgQ29udHJvbCBwbGFuZSB8IFRoaXMgZG9jdW1lbnQgfDwv dGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgICAgfCAzICAgICB8 IENvbnRyb2wgcGxhbmUgfCBUaGlzIGRvY3VtZW50IHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0t LS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgICAgICst LS0tLS0tKy0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNs YXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwNDUiPjx0ZD48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ ICAgICAgICAgICAgICAgICAgICAgICBUYWJsZSA8c3BhbiBjbGFzcz0iZGVsZXRlIj42PC9zcGFu PjogVGltZXN0YW1waW5nIE1ldGhvZHM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJibG9jayI+ ICAgICAgICAgICAgICAgICAgICAgICBUYWJsZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij43PC9zcGFu PjogVGltZXN0YW1waW5nIE1ldGhvZHM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+ PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+ PC90cj4KICAgICAgPHRyIGlkPSJkaWZmMDA0NiI+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGJsb2NrIj41LjxzcGFuIGNsYXNzPSJk ZWxldGUiPjQ8L3NwYW4+LiAgUmV0dXJuIENvZGUgU3ViLXJlZ2lzdHJ5PC90ZD48dGQ+IDwvdGQ+ PHRkIGNsYXNzPSJyYmxvY2siPjUuPHNwYW4gY2xhc3M9Imluc2VydCI+NTwvc3Bhbj4uICBSZXR1 cm4gQ29kZSBTdWItcmVnaXN0cnk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg SUFOQSBpcyByZXF1ZXN0ZWQgdG8gY3JlYXRlIFJldHVybiBDb2RlIHN1Yi1yZWdpc3RyeSBhcyBw YXJ0IG9mIFNUQU1QPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgSUFOQSBpcyBy ZXF1ZXN0ZWQgdG8gY3JlYXRlIFJldHVybiBDb2RlIHN1Yi1yZWdpc3RyeSBhcyBwYXJ0IG9mIFNU QU1QPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNz PSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBUTFYgVHlwZSByZWdpc3RyeS4gIEFs bCBjb2RlIHBvaW50cyBpbiB0aGUgcmFuZ2UgMSB0aHJvdWdoIDEyNyBpbjwvdGQ+PHRkPiA8L3Rk Pjx0ZCBjbGFzcz0icmlnaHQiPiAgIFRMViBUeXBlIHJlZ2lzdHJ5LiAgQWxsIGNvZGUgcG9pbnRz IGluIHRoZSByYW5nZSAxIHRocm91Z2ggMTI3IGluPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij4gICB0aGlzIHJlZ2lzdHJ5IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlICJJ RVRGIFJldmlldyI8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICB0aGlzIHJlZ2lz dHJ5IHNoYWxsIGJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gdGhlICJJRVRGIFJldmlldyI8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHByb2NlZHVyZSBhcyBzcGVjaWZpZWQgaW4gW1JG QzgxMjZdLiAgQ29kZSBwb2ludHMgaW4gdGhlIHJhbmdlIDEyODwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPiAgIHByb2NlZHVyZSBhcyBzcGVjaWZpZWQgaW4gW1JGQzgxMjZdLiAgQ29k ZSBwb2ludHMgaW4gdGhlIHJhbmdlIDEyODwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90 cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAg dGhyb3VnaCAyMzkgaW4gdGhpcyByZWdpc3RyeSBzaGFsbCBiZSBhbGxvY2F0ZWQgYWNjb3JkaW5n IHRvIHRoZTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRocm91Z2ggMjM5IGlu IHRoaXMgcmVnaXN0cnkgc2hhbGwgYmUgYWxsb2NhdGVkIGFjY29yZGluZyB0byB0aGU8L3RkPjx0 ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICJGaXJzdCBDb21lIEZpcnN0IFNlcnZlZCIgcHJvY2Vk dXJlIGFzIHNwZWNpZmllZCBpbiBbUkZDODEyNl0uPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJy aWdodCI+ICAgIkZpcnN0IENvbWUgRmlyc3QgU2VydmVkIiBwcm9jZWR1cmUgYXMgc3BlY2lmaWVk IGluIFtSRkM4MTI2XS48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 ciBpZD0iZGlmZjAwNDciPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgUmVtYWluaW5nIGNvZGUgcG9pbnRzIGFyZSBh bGxvY2F0ZWQgYWNjb3JkaW5nIHRvIFRhYmxlIDxzcGFuIGNsYXNzPSJkZWxldGUiPjc8L3NwYW4+ OjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICBSZW1haW5pbmcgY29kZSBwb2lu dHMgYXJlIGFsbG9jYXRlZCBhY2NvcmRpbmcgdG8gVGFibGUgPHNwYW4gY2xhc3M9Imluc2VydCI+ ODwvc3Bhbj46PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQg Y2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICArLS0t LS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgfCBWYWx1ZSAgICAgfCBEZXNjcmlwdGlvbiAgfCBSZWZlcmVuY2UgICAg ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgIHwg VmFsdWUgICAgIHwgRGVzY3JpcHRpb24gIHwgUmVmZXJlbmNlICAgICAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICstLS0tLS0tLS0tLSstLS0tLS0tLS0t LS0tLSstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICArLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICB8IDAg ICAgICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgfCAwICAgICAgICAgfCAgIFJlc2Vy dmVkICAgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgfCAxLSAxMjcgICAgfCAgVW5hc3NpZ25lZCAgfCBJRVRGIFJldmlldyAg ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgIHwg MS0gMTI3ICAgIHwgIFVuYXNzaWduZWQgIHwgSUVURiBSZXZpZXcgICAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwgMTI4IC0gMjM5IHwgIFVuYXNzaWdu ZWQgIHwgRmlyc3QgQ29tZSBGaXJzdCBTZXJ2ZWQgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICB8IDEyOCAtIDIzOSB8ICBVbmFzc2lnbmVkICB8IEZpcnN0IENvbWUg Rmlyc3QgU2VydmVkIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICB8IDI0 MCAtIDI0OSB8IEV4cGVyaW1lbnRhbCB8IFRoaXMgZG9jdW1lbnQgICAgICAgICAgIHw8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgfCAyNDAgLSAyNDkgfCBFeHBlcmlt ZW50YWwgfCBUaGlzIGRvY3VtZW50ICAgICAgICAgICB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgfCAyNTAgLSAyNTQgfCBQcml2YXRlIFVzZSAgfCBUaGlzIGRvY3VtZW50 ICAgICAgICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgIHwg MjUwIC0gMjU0IHwgUHJpdmF0ZSBVc2UgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+ PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgIHwgMjU1ICAgICAgIHwgICBSZXNlcnZl ZCAgIHwgVGhpcyBkb2N1bWVudCAgICAgICAgICAgfDwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPiAgICAgICAgICB8IDI1NSAgICAgICB8ICAgUmVzZXJ2ZWQgICB8IFRoaXMgZG9jdW1l bnQgICAgICAgICAgIHw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAgICArLS0t LS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgKy0tLS0tLS0tLS0tKy0tLS0tLS0t LS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0rPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlmZjAwNDgiPjx0ZD48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgICAg ICAgICAgICAgICAgICAgVGFibGUgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+Nzwvc3Bhbj46IFJldHVy biBDb2RlIFN1Yi1yZWdpc3RyeTwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmJsb2NrIj4gICAg ICAgICAgICAgICAgICAgICBUYWJsZSA8c3BhbiBjbGFzcz0iaW5zZXJ0Ij44PC9zcGFuPjogUmV0 dXJuIENvZGUgU3ViLXJlZ2lzdHJ5PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgog ICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwv dHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAg IFRoaXMgZG9jdW1lbnQgZGVmaW5lcyB0aGUgZm9sbG93aW5nIG5ldyB2YWx1ZXMgaW4gdGhlIFJl dHVybiBDb2RlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgVGhpcyBkb2N1bWVu dCBkZWZpbmVzIHRoZSBmb2xsb3dpbmcgbmV3IHZhbHVlcyBpbiB0aGUgUmV0dXJuIENvZGU8L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHN1Yi1yZWdpc3RyeTo8L3RkPjx0ZD4gPC90ZD48 dGQgY2xhc3M9InJpZ2h0Ij4gICBzdWItcmVnaXN0cnk6PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGlu ZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xh c3M9ImxlZnQiPiAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0t LS0tLS0tLS0tLS0tLSs8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAg ICAgICstLS0tLS0tKy0tLS0tLS0tLS0tLS0tLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0rPC90ZD48 dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8i PjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICAgICAgICAgIHwgVmFsdWUgfCAgICAgRGVzY3Jp cHRpb24gICAgIHwgUmVmZXJlbmNlICAgICB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgICAgICAgICAgICB8IFZhbHVlIHwgICAgIERlc2NyaXB0aW9uICAgICB8IFJlZmVyZW5j ZSAgICAgfDwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICArLS0tLS0t LSstLS0tLS0tLS0tLS0tLS0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0 ZCBjbGFzcz0icmlnaHQiPiAgICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0t LS0tKy0tLS0tLS0tLS0tLS0tLSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgICAg ICAgICAgfCAxICAgICB8ICBOZXR3b3JrIGF2YWlsYWJsZSAgfCBUaGlzIGRvY3VtZW50IHw8L3Rk Pjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICAgICAgICAgIHwgMSAgICAgfCAgTmV0 d29yayBhdmFpbGFibGUgIHwgVGhpcyBkb2N1bWVudCB8PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+ PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJs ZWZ0Ij4gICAgICAgICAgICAgIHwgMiAgICAgfCBOZXR3b3JrIHVuYXZhaWxhYmxlIHwgVGhpcyBk b2N1bWVudCB8PC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgICAgICAgICB8 IDIgICAgIHwgTmV0d29yayB1bmF2YWlsYWJsZSB8IFRoaXMgZG9jdW1lbnQgfDwvdGQ+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgICAgICAgICArLS0tLS0tLSstLS0tLS0tLS0tLS0tLS0t LS0tLS0rLS0tLS0tLS0tLS0tLS0tKzwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAg ICAgICAgICAgICAgKy0tLS0tLS0rLS0tLS0tLS0tLS0tLS0tLS0tLS0tKy0tLS0tLS0tLS0tLS0t LSs8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0i cmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyIGlkPSJk aWZmMDA0OSI+PHRkPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3Rk Pjx0ZCBjbGFzcz0ibGJsb2NrIj4gICAgICAgICAgICAgICAgICAgICAgICAgICBUYWJsZSA8c3Bh biBjbGFzcz0iZGVsZXRlIj44PC9zcGFuPjogUmV0dXJuIENvZGVzPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyYmxvY2siPiAgICAgICAgICAgICAgICAgICAgICAgICAgIFRhYmxlIDxzcGFuIGNs YXNzPSJpbnNlcnQiPjk8L3NwYW4+OiBSZXR1cm4gQ29kZXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+Ni4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zPC90ZD48dGQ+IDwvdGQ+PHRk IGNsYXNzPSJyaWdodCI+Ni4gIFNlY3VyaXR5IENvbnNpZGVyYXRpb25zPC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBj bGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoaXMgZG9jdW1lbnQgZGVmaW5lcyBleHRlbnNpb25zIHRv IFNUQU1QIFtSRkM4NzYyXSBhbmQgaW5oZXJpdHMgYWxsPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNz PSJyaWdodCI+ICAgVGhpcyBkb2N1bWVudCBkZWZpbmVzIGV4dGVuc2lvbnMgdG8gU1RBTVAgW1JG Qzg3NjJdIGFuZCBpbmhlcml0cyBhbGw8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+ CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIHRo ZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBhcHBsaWNhYmxlIHRvIHRoZSBiYXNlIHByb3RvY29s LjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIHRoZSBzZWN1cml0eSBjb25zaWRl cmF0aW9ucyBhcHBsaWNhYmxlIHRvIHRoZSBiYXNlIHByb3RvY29sLjwvdGQ+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBj bGFzcz0ibGVmdCI+ICAgQWRkaXRpb25hbGx5LCB0aGUgSE1BQyBUTFYgaXMgZGVmaW5lZCBpbiB0 aGlzIGRvY3VtZW50IHRvIHByb3RlY3QgdGhlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdo dCI+ICAgQWRkaXRpb25hbGx5LCB0aGUgSE1BQyBUTFYgaXMgZGVmaW5lZCBpbiB0aGlzIGRvY3Vt ZW50IHRvIHByb3RlY3QgdGhlPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAg ICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICBpbnRlZ3Jp dHkgb2Ygb3B0aW9uYWwgU1RBTVAgZXh0ZW5zaW9ucy4gIFRoZSB1c2Ugb2YgSE1BQyBUTFYgaXM8 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBpbnRlZ3JpdHkgb2Ygb3B0aW9uYWwg U1RBTVAgZXh0ZW5zaW9ucy4gIFRoZSB1c2Ugb2YgSE1BQyBUTFYgaXM8L3RkPjx0ZCBjbGFzcz0i bGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQg Y2xhc3M9ImxlZnQiPiAgIGRpc2N1c3NlZCBpbiBkZXRhaWwgaW4gU2VjdGlvbiA0LjguPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgZGlzY3Vzc2VkIGluIGRldGFpbCBpbiBTZWN0 aW9uIDQuOC48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQg Y2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBj bGFzcz0icmlnaHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRy Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+Ny4gIEFja25vd2xlZGdt ZW50czwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjcuICBBY2tub3dsZWRnbWVudHM8 L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9Imxp bmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRkPiA8L3RkPjx0ZCBjbGFzcz0icmln aHQiPjwvdGQ+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFz cz0ibGluZW5vIj48L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgQXV0aG9ycyBtdWNoIGFwcHJlY2lh dGUgdGhlIHRob3JvdWdoIHJldmlldyBhbmQgdGhvdWdodGZ1bCBjb21tZW50czwvdGQ+PHRkPiA8 L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgIEF1dGhvcnMgbXVjaCBhcHByZWNpYXRlIHRoZSB0aG9y b3VnaCByZXZpZXcgYW5kIHRob3VnaHRmdWwgY29tbWVudHM8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPiAgIHJlY2VpdmVkIGZyb20gVGlhbnJhbiBaaG91LCBSYWtlc2ggR2FuZGhpLCBZdWV6 aG9uZyBTb25nIGFuZCBZYWxpPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgcmVj ZWl2ZWQgZnJvbSBUaWFucmFuIFpob3UsIFJha2VzaCBHYW5kaGksIFl1ZXpob25nIFNvbmcgYW5k IFlhbGk8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0ciBpZD0iZGlm ZjAwNTAiPjx0ZD48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 dGQgY2xhc3M9ImxibG9jayI+ICAgV2FuZy4gIDxzcGFuIGNsYXNzPSJkZWxldGUiPkF1dGhvcnM8 L3NwYW4+IGV4cHJlc3MgdGhlaXIgZ3JhdGl0dWRlIHRvIEFsIE1vcnRvbiBmb3IgaGlzIGNvbW1l bnRzPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIFdhbmcuICA8c3BhbiBjbGFz cz0iaW5zZXJ0Ij5UaGUgYXV0aG9yczwvc3Bhbj4gZXhwcmVzcyB0aGVpciBncmF0aXR1ZGUgdG8g QWwgTW9ydG9uIGZvciBoaXM8L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAg IDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+ICAgYW5kIHRo ZSBtb3N0IHZhbHVhYmxlIHN1Z2dlc3Rpb25zLiAgPHNwYW4gY2xhc3M9ImRlbGV0ZSI+QXV0aG9y czwvc3Bhbj4gZ3JlYXRseSBhcHByZWNpYXRlPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxv Y2siPiAgIGNvbW1lbnRzIGFuZCB0aGUgbW9zdCB2YWx1YWJsZSBzdWdnZXN0aW9ucy4gIDxzcGFu IGNsYXNzPSJpbnNlcnQiPlRoZSBhdXRob3JzPC9zcGFuPiBncmVhdGx5PC90ZD48dGQgY2xhc3M9 ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRk IGNsYXNzPSJsYmxvY2siPiAgIGNvbW1lbnRzIGFuZCB0aG91Z2h0ZnVsIHN1Z2dlc3Rpb25zIHJl Y2VpdmVkIGZyb20gTWFydGluIER1a2UuPC90ZD48dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyYmxvY2si PiAgIGFwcHJlY2lhdGUgY29tbWVudHMgYW5kIHRob3VnaHRmdWwgc3VnZ2VzdGlvbnMgcmVjZWl2 ZWQgZnJvbSBNYXJ0aW48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0 cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxibG9jayI+PC90ZD48dGQ+IDwv dGQ+PHRkIGNsYXNzPSJyYmxvY2siPiAgIER1a2UuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90 ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0 Ij48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9 ImxlZnQiPjguICBDb250cmlidXRvcnM8L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij44 LiAgQ29udHJpYnV0b3JzPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8 dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAg ICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgIFRoZSBm b2xsb3dpbmcgcGVvcGxlIGNvbnRyaWJ1dGVkIHRleHQgdG8gdGhpcyBkb2N1bWVudDo8L3RkPjx0 ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICBUaGUgZm9sbG93aW5nIHBlb3BsZSBjb250cmli dXRlZCB0ZXh0IHRvIHRoaXMgZG9jdW1lbnQ6PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48 L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij48 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij48L3RkPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48dGQgY2xhc3M9Imxl ZnQiPiAgICAgIEd1byBKdW48L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBH dW8gSnVuPC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNs YXNzPSJsaW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBaVEUgQ29ycG9yYXRpb248 L3RkPjx0ZD4gPC90ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBaVEUgQ29ycG9yYXRpb248L3Rk Pjx0ZCBjbGFzcz0ibGluZW5vIj48L3RkPjwvdHI+CiAgICAgIDx0cj48dGQgY2xhc3M9ImxpbmVu byI+PC90ZD48dGQgY2xhc3M9ImxlZnQiPiAgICAgIDY4IyBaaWppbmdodWEgUm9hZDwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPiAgICAgIDY4IyBaaWppbmdodWEgUm9hZDwvdGQ+PHRk IGNsYXNzPSJsaW5lbm8iPjwvdGQ+PC90cj4KICAgICAgPHRyPjx0ZCBjbGFzcz0ibGluZW5vIj48 L3RkPjx0ZCBjbGFzcz0ibGVmdCI+ICAgICAgTmFuamluZywgSmlhbmdzdSAgMjEwMDEyPC90ZD48 dGQ+IDwvdGQ+PHRkIGNsYXNzPSJyaWdodCI+ICAgICAgTmFuamluZywgSmlhbmdzdSAgMjEwMDEy PC90ZD48dGQgY2xhc3M9ImxpbmVubyI+PC90ZD48L3RyPgogICAgICA8dHI+PHRkIGNsYXNzPSJs aW5lbm8iPjwvdGQ+PHRkIGNsYXNzPSJsZWZ0Ij4gICAgICBQLlIuQ2hpbmE8L3RkPjx0ZD4gPC90 ZD48dGQgY2xhc3M9InJpZ2h0Ij4gICAgICBQLlIuQ2hpbmE8L3RkPjx0ZCBjbGFzcz0ibGluZW5v Ij48L3RkPjwvdHI+CgogICAgIDx0cj48dGQ+PC90ZD48dGQgY2xhc3M9ImxlZnQiPjwvdGQ+PHRk PiA8L3RkPjx0ZCBjbGFzcz0icmlnaHQiPjwvdGQ+PHRkPjwvdGQ+PC90cj4KICAgICA8dHIgaWQ9 ImVuZCIgYmdjb2xvcj0iZ3JheSI+PHRoIGNvbHNwYW49IjUiIGFsaWduPSJjZW50ZXIiPiZuYnNw O0VuZCBvZiBjaGFuZ2VzLiA1MCBjaGFuZ2UgYmxvY2tzLiZuYnNwOzwvdGg+PC90cj4KICAgICA8 dHIgY2xhc3M9InN0YXRzIj48dGQ+PC90ZD48dGg+PGk+ODYgbGluZXMgY2hhbmdlZCBvciBkZWxl dGVkPC9pPjwvdGg+PHRoPjxpPiA8L2k+PC90aD48dGg+PGk+MTQ2IGxpbmVzIGNoYW5nZWQgb3Ig YWRkZWQ8L2k+PC90aD48dGQ+PC90ZD48L3RyPgogICAgIDx0cj48dGQgY29sc3Bhbj0iNSIgYWxp Z249ImNlbnRlciIgY2xhc3M9InNtYWxsIj48YnI+VGhpcyBodG1sIGRpZmYgd2FzIHByb2R1Y2Vk IGJ5IHJmY2RpZmYgMS40Ny4gVGhlIGxhdGVzdCB2ZXJzaW9uIGlzIGF2YWlsYWJsZSBmcm9tIDxh IGhyZWY9Imh0dHA6Ly93d3cudG9vbHMuaWV0Zi5vcmcvdG9vbHMvcmZjZGlmZi8iPmh0dHA6Ly90 b29scy5pZXRmLm9yZy90b29scy9yZmNkaWZmLzwvYT4gPC90ZD48L3RyPgogICA8L3Rib2R5Pjwv dGFibGU+CiAgIAogICAKPC9ib2R5PjwvaHRtbD4= --000000000000a26e9f05a93ec681--