From robert@raszuk.net Fri Jun 1 03:18:02 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2857521F861E for ; Fri, 1 Jun 2012 03:18:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TTHu0+UvL7RN for ; Fri, 1 Jun 2012 03:17:57 -0700 (PDT) Received: from mail1310.opentransfer.com (mail1310.opentransfer.com [76.162.254.103]) by ietfa.amsl.com (Postfix) with ESMTP id 3C1A221F860F for ; Fri, 1 Jun 2012 03:17:57 -0700 (PDT) Received: (qmail 15700 invoked by uid 399); 1 Jun 2012 10:17:56 -0000 Received: from unknown (HELO ?172.16.1.61?) (pbs:robert@raszuk.net@91.221.145.233) by mail1310.opentransfer.com with ESMTPM; 1 Jun 2012 10:17:56 -0000 X-Originating-IP: 91.221.145.233 Message-ID: <4FC896D0.3090904@raszuk.net> Date: Fri, 01 Jun 2012 03:17:52 -0700 From: Robert Raszuk User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Russ White References: <5BA9D6DE-BE0E-4922-9E09-7B85BD6F9342@juniper.net> <4FC7FBEE.4040100@riw.us> In-Reply-To: <4FC7FBEE.4040100@riw.us> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: sidr@ietf.org Subject: Re: [sidr] BGPSEC proposal to drop AS_PATH [was: Fwd: request for agenda items for interim meeting 6 Jun] X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: robert@raszuk.net List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Jun 2012 10:18:02 -0000 Hi Russ, > Doesn't this also impact 2 octet to 4 octet transition? I thought about the same but I concluded that it does not. Due to inherent day one design of BGP_SEC_PATH which supports 4 octet AS you may carry it there as opposed to carry it AS4_PATH attribute. > IMHO, this is a huge problem --much larger than we might imagine at > this particular moment in time. I think that the overall assumption is that we will fall back to non-sec where ever and for whatever reason needed. With this in mind I am amazed to see proponents of BGP Sec not caring about it as the end result will be marginal to non BGP Sec deployment result. For example IBGP speakers will not likely to get upgraded to BGPSec in years to come. In traditional ISP this will immediately result in downgrade. When you use RR you are a bit better as only RR needs to be upgraded, but still this is light years for Internet wide deployment. As example I know global SP networks which use full mesh. I am therefor proposing SIDR overlay as smooth gradual introduction of BGP SEC on subset of prefixes yet with full benefits of full blown BGP Sec deployment. Maybe just for easy transition ... Of course this requires Internet wide encapsulation so those allergic to it will not like it :). Best, R. > >>>> - Extensibility to include new segment types. In principle this is a fairly serious omission, but one can argue that new segment types can't be introduced in practice, since existing implementations will treat them as fatal errors. > > Doesn't this also impact 2 octet to 4 octet transition? > > IMHO, this is a huge problem --much larger than we might imagine at this > particular moment in time. > > Russ > From Sandra.Murphy@sparta.com Fri Jun 1 15:56:38 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0F70C11E8097 for ; Fri, 1 Jun 2012 15:56:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.537 X-Spam-Level: X-Spam-Status: No, score=-102.537 tagged_above=-999 required=5 tests=[AWL=0.062, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fwlChpmZs0zF for ; Fri, 1 Jun 2012 15:56:37 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 73E8311E808D for ; Fri, 1 Jun 2012 15:56:37 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q51MuZvq014886; Fri, 1 Jun 2012 17:56:35 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q51MuY3d027115; Fri, 1 Jun 2012 17:56:34 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Fri, 1 Jun 2012 18:56:32 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: WGLC for draft-ietf-sidr-rpsl-sig-05.txt Thread-Index: Ac06Aa7Kr7T1RdCRRuOxqeSeKadtDgGSAwID Date: Fri, 1 Jun 2012 22:56:31 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F133F7@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F109D5@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F109D5@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "draft-ietf-sidr-rpsl-sig@tools.ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpsl-sig-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Jun 2012 22:56:38 -0000 Remember that this wglc ends a week from today.=0A= =0A= --Sandy, speaking as wg co-chair=0A= ________________________________________=0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of Murphy, Sa= ndra [Sandra.Murphy@sparta.com]=0A= Sent: Thursday, May 24, 2012 7:06 PM=0A= To: sidr@ietf.org=0A= Cc: draft-ietf-sidr-rpsl-sig@tools.ietf.org=0A= Subject: [sidr] WGLC for draft-ietf-sidr-rpsl-sig-05.txt=0A= =0A= The authors have stated that they believe that draft-ietf-sidr-rpsl-sig-05 = "Securing RPSL Objects with RPKI Signatures" is ready for a working group l= ast call.=0A= =0A= The draft can be accessed at http://tools.ietf.org/html/draft-ietf-sidr-rps= l-sig-05 and https://datatracker.ietf.org/doc/draft-ietf-sidr-rpsl-sig/=0A= =0A= This announces the beginning of the wglc. The last call will end on Friday= , 08 Jun 2012.=0A= =0A= Please judge whether you believe that this work is ready for publication an= d send any comments to the list.=0A= =0A= --Sandy, speaking as wg co-chair=0A= _______________________________________________=0A= sidr mailing list=0A= sidr@ietf.org=0A= https://www.ietf.org/mailman/listinfo/sidr=0A= From Sandra.Murphy@sparta.com Fri Jun 1 16:00:17 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66DD511E809A for ; Fri, 1 Jun 2012 16:00:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.541 X-Spam-Level: X-Spam-Status: No, score=-102.541 tagged_above=-999 required=5 tests=[AWL=0.058, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5MTHMbG2l3gh for ; Fri, 1 Jun 2012 16:00:17 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id DA8FB11E8116 for ; Fri, 1 Jun 2012 16:00:16 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q51N0GRM014914 for ; Fri, 1 Jun 2012 18:00:16 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q51N0GZe027166 for ; Fri, 1 Jun 2012 18:00:16 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Fri, 1 Jun 2012 19:00:14 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: WGLC for draft-ietf-sidr-pfx-validate-06 Thread-Index: Ac1ASk1a5EstiVISTE2I8YfWJPfP6A== Date: Fri, 1 Jun 2012 23:00:13 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Jun 2012 23:00:17 -0000 The authors have stated that they believe that draft-ietf-sidr-pfx-validate= -06 "BGP Prefix Origin Validation" is ready for a working group last call.= =0A= =0A= The draft can be accessed at http://tools.ietf.org/html/draft-ietf-sidr-pfx= -validate-06 and https://datatracker.ietf.org/doc/draft-ietf-sidr-pfx-valid= ate/=0A= =0A= This announces the beginning of the wglc. The last call will end on Friday= , 15 Jun 2012.=0A= =0A= Please judge whether you believe that this work is ready for publication an= d send any comments to the list.=0A= =0A= --Sandy, speaking as wg co-chair= From Sandra.Murphy@sparta.com Fri Jun 1 16:09:56 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9F69221F8726 for ; Fri, 1 Jun 2012 16:09:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.544 X-Spam-Level: X-Spam-Status: No, score=-102.544 tagged_above=-999 required=5 tests=[AWL=0.055, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GV2pU89FbEE0 for ; Fri, 1 Jun 2012 16:09:56 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 13F3821F8724 for ; Fri, 1 Jun 2012 16:09:55 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q51N9tGl014991 for ; Fri, 1 Jun 2012 18:09:55 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q51N9tDH027399 for ; Fri, 1 Jun 2012 18:09:55 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Fri, 1 Jun 2012 19:09:53 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: slides for interim meeting 6 Jun Thread-Index: Ac1AS6aZVVEIjXi5Tc6LliE+MPcDCg== Date: Fri, 1 Jun 2012 23:09:52 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1341B@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] slides for interim meeting 6 Jun X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Jun 2012 23:09:56 -0000 Should anyone have slides they want to present for the interim meeting on 6= Jun, please get them to the chairs by COB 5 Jun so that they can be upload= ed to the meeting materials page.=0A= =0A= That's 5 Jun, not 5 minutes, folks.=0A= =0A= --Sandy= From kent@bbn.com Mon Jun 4 09:28:20 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82AAC21F88C8 for ; Mon, 4 Jun 2012 09:28:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.274 X-Spam-Level: X-Spam-Status: No, score=-106.274 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F8cXV++H+Z1X for ; Mon, 4 Jun 2012 09:28:19 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 9EB6C21F88B4 for ; Mon, 4 Jun 2012 09:28:19 -0700 (PDT) Received: from dhcp89-089-114.bbn.com ([128.89.89.114]:49155) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sba88-000Bg2-Pk; Mon, 04 Jun 2012 12:27:44 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <20120531145543.F363272E004@rfc-editor.org> <2BAE4694-60C2-4301-BFAF-05DF49054BF4@cisco.com> Date: Mon, 4 Jun 2012 11:52:46 -0400 To: Randy Bush From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: sidr wg list Subject: Re: [sidr] [Technical Errata Reported] RFC6487 (3238) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2012 16:28:20 -0000 At 7:55 AM +0900 6/1/12, Randy Bush wrote: > >... > >while i agree that the change is correct, this is not an erratum, but an >actual change in semantics. > >randy yeah, sort of. The text that was there could not be acted upon by a CA or an RP requesting a cert. The cited field are in KU, not EKU, and were already described in the immediately preceding paragraph. So, this text, which is a MAY, just provides guidance (for a CA or RP re a cert request) consistent with what is already described earlier in this RFC. Steve From randy@psg.com Mon Jun 4 09:35:40 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC4B821F876C for ; Mon, 4 Jun 2012 09:35:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.501 X-Spam-Level: X-Spam-Status: No, score=-2.501 tagged_above=-999 required=5 tests=[AWL=0.098, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cTboxSYn6PQa for ; Mon, 4 Jun 2012 09:35:40 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 4282C21F86F0 for ; Mon, 4 Jun 2012 09:35:40 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SbaFm-0005NN-JY; Mon, 04 Jun 2012 16:35:38 +0000 Date: Mon, 04 Jun 2012 09:35:39 -0700 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: References: <20120531145543.F363272E004@rfc-editor.org> <2BAE4694-60C2-4301-BFAF-05DF49054BF4@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] [Technical Errata Reported] RFC6487 (3238) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2012 16:35:40 -0000 >> while i agree that the change is correct, this is not an erratum, but an >> actual change in semantics. > The text that was there could not be acted upon by a CA or an RP > requesting a cert. The cited field are in KU, not EKU, and were > already described in the immediately preceding paragraph. So, this > text, which is a MAY, just provides guidance (for a CA or RP re a cert > request) consistent with what is already described earlier in this > RFC. i do not intend to have a tantrum or even make a fuss. i just think we need to be careful what we call errata. randy From kotikalapudi.sriram@nist.gov Mon Jun 4 11:53:42 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20A6A11E80BC; Mon, 4 Jun 2012 11:53:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.854 X-Spam-Level: X-Spam-Status: No, score=-5.854 tagged_above=-999 required=5 tests=[AWL=-0.744, BAYES_05=-1.11, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DhHmVPP6B4nI; Mon, 4 Jun 2012 11:53:41 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 92E9F11E80B5; Mon, 4 Jun 2012 11:53:38 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.1.355.2; Mon, 4 Jun 2012 14:53:35 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Mon, 4 Jun 2012 14:53:37 -0400 From: "Sriram, Kotikalapudi" To: "John G. Scudder" Date: Mon, 4 Jun 2012 14:51:45 -0400 Thread-Topic: [sidr] request for agenda items for interim meeting 6 Jun Thread-Index: Ac0/U5HRPlsCbHtVSUK1+tV3UsF//ADKs4sO Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F60F70A267@Hermes.columbia.ads.sparta.com> <24B20D14B2CD29478C8D5D6E9CBB29F625F0975D@Hermes.columbia.ads.sparta.com> <4FBBB6D1.9000008@bbn.com> <4FBC0936.7000905@bbn.com>, <5BA9D6DE-BE0E-4922-9E09-7B85BD6F9342@juniper.net> <24B20D14B2CD29478C8D5D6E9CBB29F625F12333@Hermes.columbia.ads.sparta.com> , <5F5F8CF8-061C-47C9-942C-7908963EF347@juniper.net> In-Reply-To: <5F5F8CF8-061C-47C9-942C-7908963EF347@juniper.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Cc: "idr@ietf.org List" , "Murphy, Sandra" , "sidr@ietf.org list" Subject: Re: [sidr] request for agenda items for interim meeting 6 Jun X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2012 18:53:42 -0000 Thanks for the clarification. The Secure_Path semantics in BGPSEC are the same as the *essential semantics* of BGP AS_PATH. The *essential semantics* being the sequence of ASs the prefix announcement has passed through (including AS prepending). So the Secure_Path semantics would be compatible with AS_PATH as long as said essential semantics do not change. I am curious if there is a realistic example of feature change to BGP such that the AS_PATH would no longer adhere to its essential semantics. Sriram ________________________________________ From: John G. Scudder [jgs@juniper.net] Sent: Thursday, May 31, 2012 1:31 PM To: Sriram, Kotikalapudi Cc: Murphy, Sandra; idr@ietf.org List; sidr@ietf.org list Subject: Re: [sidr] request for agenda items for interim meeting 6 Jun On May 30, 2012, at 8:02 PM, Sriram, Kotikalapudi wrote: >> >> Right, and agreed (see "formally an attack" above). But to repeat my further >> point, if the AS_PATH is present (even if not secured): "at least there's scope for a >> network operator on the receiving end to tolerate the validation failure and use >> the route anyway, if desired. In the case where there's no AS_PATH, the data are >> just gone with no chance for appeal." >> > > John, > > I do not agree that in the event of "validation failure" the route becomes unusable > in BGPSEC as currently specified. That's not what I meant. My point was that a feature may be applied that wants to change the AS_PATH in a way that can't be represented in the BGPSEC_Path_Signatures. In other words, your later statement: > the Secure_Path segment is still usable as it provides the AS path info. is not correct in all cases. Likewise, to this statement: > So validation failure in BGPSEC does not mean that "the data are just gone." My point is not that validation failure causes this. It's that absent AS_PATH, a semantically non-representable AS_PATH will be lost if forced through BGPSEC_Path_Signatures. To reiterate, the options to address the case where a feature wants to produce output that can't be represented in BGPSEC_Path_Signatures are: - Don't solve it. Effectively forbid any such feature. - Carry both AS_PATH and BGPSEC_Path_Signatures in every update. Rules for reconciliation would be required. - Downgrade BGPSEC update to BGP update. - Extend BGPSEC_Path_Signatures format to be able to represent the needed feature. (As Sandy noted, this only makes sense insofar as the feature isn't formally an attack, so this option is incomplete.) The validation failure I spoke of is a potential *consequence* of the middle two options above, and as you say, the operator can then decide what to do. --John From kent@bbn.com Mon Jun 4 12:49:30 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54EBB11E80FE for ; Mon, 4 Jun 2012 12:49:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.382 X-Spam-Level: X-Spam-Status: No, score=-106.382 tagged_above=-999 required=5 tests=[AWL=0.217, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 56rXTj88U3M9 for ; Mon, 4 Jun 2012 12:49:29 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id D2BB811E80B4 for ; Mon, 4 Jun 2012 12:49:29 -0700 (PDT) Received: from dhcp89-089-114.bbn.com ([128.89.89.114]:49158) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SbdGp-000Ims-CV; Mon, 04 Jun 2012 15:48:55 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <20120531145543.F363272E004@rfc-editor.org> <2BAE4694-60C2-4301-BFAF-05DF49054BF4@cisco.com> Date: Mon, 4 Jun 2012 15:37:14 -0400 To: Randy Bush From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: sidr wg list Subject: Re: [sidr] [Technical Errata Reported] RFC6487 (3238) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2012 19:49:30 -0000 At 9:35 AM -0700 6/4/12, Randy Bush wrote: > >> while i agree that the change is correct, this is not an erratum, but an >>> actual change in semantics. >> The text that was there could not be acted upon by a CA or an RP >> requesting a cert. The cited field are in KU, not EKU, and were >> already described in the immediately preceding paragraph. So, this >> text, which is a MAY, just provides guidance (for a CA or RP re a cert >> request) consistent with what is already described earlier in this >> RFC. > >i do not intend to have a tantrum or even make a fuss. i just think we >need to be careful what we call errata. > >randy No problem. I submitted this as an errata at Sean Turner's suggestion. He found the bug in the RFC and brought it to the attention of Geoff and me. Steve From jgs@juniper.net Mon Jun 4 13:09:00 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 59B5C21F886B; Mon, 4 Jun 2012 13:09:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.587 X-Spam-Level: X-Spam-Status: No, score=-6.587 tagged_above=-999 required=5 tests=[AWL=0.012, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S80ZKQ1m6UnH; Mon, 4 Jun 2012 13:08:59 -0700 (PDT) Received: from exprod7og108.obsmtp.com (exprod7og108.obsmtp.com [64.18.2.169]) by ietfa.amsl.com (Postfix) with ESMTP id D4BD321F85FD; Mon, 4 Jun 2012 13:08:41 -0700 (PDT) Received: from P-EMHUB01-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob108.postini.com ([64.18.6.12]) with SMTP ID DSNKT80VySYcLeZ+wsTx2SQAqBkO0I/Segm6@postini.com; Mon, 04 Jun 2012 13:08:59 PDT Received: from [172.16.13.202] (172.16.13.202) by P-EMHUB01-HQ.jnpr.net (172.24.192.33) with Microsoft SMTP Server id 8.3.213.0; Mon, 4 Jun 2012 13:08:33 -0700 MIME-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset="us-ascii" From: "John G. Scudder" In-Reply-To: Date: Mon, 4 Jun 2012 16:08:32 -0400 Content-Transfer-Encoding: quoted-printable Message-ID: <70E22069-12C4-435F-A7D5-109BC0B39910@juniper.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F60F70A267@Hermes.columbia.ads.sparta.com> <24B20D14B2CD29478C8D5D6E9CBB29F625F0975D@Hermes.columbia.ads.sparta.com> <4FBBB6D1.9000008@bbn.com> <4FBC0936.7000905@bbn.com>, <5BA9D6DE-BE0E-4922-9E09-7B85BD6F9342@juniper.net> <24B20D14B2CD29478C8D5D6E9CBB29F625F12333@Hermes.columbia.ads.sparta.com> , <5F5F8CF8-061C-47C9-942C-7908963EF347@juniper.net> To: "Sriram, Kotikalapudi" X-Mailer: Apple Mail (2.1278) Cc: "idr@ietf.org List" , "Murphy, Sandra" , "sidr@ietf.org list" Subject: Re: [sidr] request for agenda items for interim meeting 6 Jun X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2012 20:09:00 -0000 Sriram, Confederations are an example of a standardized change to BGP that = modified handling and semantics of the AS_PATH. There are various = non-standardized AS_PATH rewriting knobs as well, as previously = discussed. --John On Jun 4, 2012, at 2:51 PM, Sriram, Kotikalapudi wrote: > Thanks for the clarification. > The Secure_Path semantics in BGPSEC are the same as the *essential = semantics* of BGP AS_PATH. > The *essential semantics* being the sequence of ASs the prefix = announcement has passed through > (including AS prepending). > So the Secure_Path semantics would be compatible with AS_PATH as long = as said essential semantics do not change. > I am curious if there is a realistic example of feature change to BGP=20= > such that the AS_PATH would no longer adhere to its essential = semantics. >=20 > Sriram=20 > ________________________________________ > From: John G. Scudder [jgs@juniper.net] > Sent: Thursday, May 31, 2012 1:31 PM > To: Sriram, Kotikalapudi > Cc: Murphy, Sandra; idr@ietf.org List; sidr@ietf.org list > Subject: Re: [sidr] request for agenda items for interim meeting 6 Jun >=20 > On May 30, 2012, at 8:02 PM, Sriram, Kotikalapudi wrote: >=20 >>>=20 >>> Right, and agreed (see "formally an attack" above). But to repeat my = further >>> point, if the AS_PATH is present (even if not secured): "at least = there's scope for a >>> network operator on the receiving end to tolerate the validation = failure and use >>> the route anyway, if desired. In the case where there's no AS_PATH, = the data are >>> just gone with no chance for appeal." >>>=20 >>=20 >> John, >>=20 >> I do not agree that in the event of "validation failure" the route = becomes unusable >> in BGPSEC as currently specified. >=20 > That's not what I meant. My point was that a feature may be applied = that wants to change the AS_PATH in a way that can't be represented in = the BGPSEC_Path_Signatures. In other words, your later statement: >=20 >> the Secure_Path segment is still usable as it provides the AS path = info. >=20 > is not correct in all cases. Likewise, to this statement: >=20 >> So validation failure in BGPSEC does not mean that "the data are just = gone." >=20 > My point is not that validation failure causes this. It's that absent = AS_PATH, a semantically non-representable AS_PATH will be lost if forced = through BGPSEC_Path_Signatures. >=20 > To reiterate, the options to address the case where a feature wants to = produce output that can't be represented in BGPSEC_Path_Signatures are: >=20 > - Don't solve it. Effectively forbid any such feature. > - Carry both AS_PATH and BGPSEC_Path_Signatures in every update. Rules = for reconciliation would be required. > - Downgrade BGPSEC update to BGP update. > - Extend BGPSEC_Path_Signatures format to be able to represent the = needed feature. (As Sandy noted, this only makes sense insofar as the = feature isn't formally an attack, so this option is incomplete.) >=20 > The validation failure I spoke of is a potential *consequence* of the = middle two options above, and as you say, the operator can then decide = what to do. >=20 > --John From internet-drafts@ietf.org Mon Jun 4 15:55:11 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C02DF21F8655; Mon, 4 Jun 2012 15:55:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.555 X-Spam-Level: X-Spam-Status: No, score=-102.555 tagged_above=-999 required=5 tests=[AWL=0.044, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k6-OfkjaD6XT; Mon, 4 Jun 2012 15:55:09 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFDB621F8627; Mon, 4 Jun 2012 15:55:09 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.02 Message-ID: <20120604225509.20036.28277.idtracker@ietfa.amsl.com> Date: Mon, 04 Jun 2012 15:55:09 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-ltamgmt-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jun 2012 22:55:11 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working G= roup of the IETF. Title : Local Trust Anchor Management for the Resource Public Ke= y Infrastructure Author(s) : Mark Reynolds Stephen Kent Matthew Lepinski Filename : draft-ietf-sidr-ltamgmt-05.txt Pages : 28 Date : 2012-06-04 This document describes a facility to enable a relying party (RP) to manage trust anchors (TAs) in the context of the Resource Public Key Infrastructure (RPKI). It is common to allow an RP to import TA material in the form of self-signed certificates. The facility described in this document allows an RP to impose constraints on such TAs. Because this mechanism is designed to operate in the RPKI context, the relevant constraints are the RFC 3779 extensions that bind address spaces and/or autonomous system (AS) numbers to entities. The primary motivation for this facility is to enable an RP to ensure that resource allocation information that it has acquired via some trusted channel is not overridden by the information acquired from the RPKI repository system or by the putative TAs that the RP imports. Specifically, the mechanism allows an RP to specify a set of bindings between public key identifiers and RFC 3779 extension data and will override any conflicting bindings expressed via the putative TAs and the certificates downloaded from the RPKI repository system. Although this mechanism is designed for local use by an RP, an entity that is accorded administrative control over a set of RPs may use this mechanism to convey its view of the RPKI to a set of RPs within its jurisdiction. The means by which this latter use case is effected is outside the scope of this document. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-sidr-ltamgmt-05.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ This Internet-Draft can be retrieved at: ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-ltamgmt-05.txt The IETF datatracker page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-ltamgmt/ From rogaglia@cisco.com Tue Jun 5 05:05:39 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8303E21F85AD for ; Tue, 5 Jun 2012 05:05:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.598 X-Spam-Level: X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uAcwgj6gS8IO for ; Tue, 5 Jun 2012 05:05:38 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 5A80921F8682 for ; Tue, 5 Jun 2012 05:05:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=rogaglia@cisco.com; l=11505; q=dns/txt; s=iport; t=1338897938; x=1340107538; h=from:to:subject:date:message-id:references:mime-version; bh=hF3WaRl9iKrMBMblRc9cWIxi8NWpOzKO0xA3jwCPj2k=; b=bYWSUk0GzNwXJZ0/myco1Ib01lFRKb0vSZfBU0M9+ZTWSsOHW2BOUJmq yLp8iGt/gn4Za6Qik2/ir0qM/Lo/G21R5ukO9b1CH+Ql2RiFqDZlY9amh fkL/95A1xjf6DlTztNB3jI5SaNYW3nDgyOYxBzSjzkTv2+nabFbaTl6Vu I=; X-Files: smime.p7s : 4389 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av4EAND1zU+tJV2Z/2dsb2JhbABFtDWBB4IYAQEBAwESAWQHCwIBGQMBAi8CMBsCCAIEEw4Uh2QFlyqgEosThTBgA443gR2FR44QgWaCYA X-IronPort-AV: E=Sophos;i="4.75,718,1330905600"; d="p7s'?scan'208,217";a="89593391" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-5.cisco.com with ESMTP; 05 Jun 2012 12:05:36 +0000 Received: from xhc-aln-x12.cisco.com (xhc-aln-x12.cisco.com [173.36.12.86]) by rcdn-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id q55C5bbl012246 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Tue, 5 Jun 2012 12:05:37 GMT Received: from xmb-rcd-x01.cisco.com ([169.254.1.42]) by xhc-aln-x12.cisco.com ([173.36.12.86]) with mapi id 14.02.0298.004; Tue, 5 Jun 2012 07:05:36 -0500 From: "Roque Gagliano (rogaglia)" To: "sidr@ietf.org" Thread-Topic: New Version Notification for draft-rogaglia-sidr-bgpsec-rollover-01.txt Thread-Index: AQHNQxKUECMrgDsmVEir4o6BsQJLSQ== Date: Tue, 5 Jun 2012 12:05:18 +0000 Message-ID: <2C7763BA-5F9E-47A2-BD49-0BD109DB2C91@cisco.com> References: <20120605115852.31388.99984.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.147.19.47] x-tm-as-product-ver: SMEX-10.2.0.1135-6.800.1017-18948.005 x-tm-as-result: No--34.415100-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: multipart/signed; boundary="Apple-Mail-226--186518652"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Subject: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-bgpsec-rollover-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jun 2012 12:05:39 -0000 --Apple-Mail-226--186518652 Content-Type: multipart/alternative; boundary=Apple-Mail-225--186518720 --Apple-Mail-225--186518720 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Dear WG, We submitted a new version of this draft based on the feedback from our = last meeting in Paris. As mentioned during Brian's presentation we would like to ask for WG = adoption. Regards, Roque Begin forwarded message: > From: > Date: June 5, 2012 1:58:52 PM GMT+02:00 > To: > Cc: , > Subject: New Version Notification for = draft-rogaglia-sidr-bgpsec-rollover-01.txt >=20 > A new version of I-D, draft-rogaglia-sidr-bgpsec-rollover-01.txt has = been successfully submitted by Roque Gagliano and posted to the IETF = repository. >=20 > Filename: draft-rogaglia-sidr-bgpsec-rollover > Revision: 01 > Title: BGPSEC router key rollover as an alternative to = beaconing > Creation date: 2012-06-05 > WG ID: Individual Submission > Number of pages: 15 >=20 > Abstract: > The current BGPSEC draft documents do not specifies a key rollover > process for routers. This document describes a possible key = rollover > process and explores its impact to mitigate replay attacks and > eliminate the need for beaconing in BGPSEC. >=20 >=20 >=20 >=20 > The IETF Secretariat --Apple-Mail-225--186518720 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Dear = WG,

We submitted a new version of this draft based on = the feedback from our last meeting in Paris.

As = mentioned during Brian's presentation we would like to ask for WG = adoption.

Regards,
Roque

=

Begin forwarded message:

Date: June 5, 2012 1:58:52 PM = GMT+02:00
To: <rogaglia@cisco.com>
Subject: New Version = Notification for = draft-rogaglia-sidr-bgpsec-rollover-01.txt

A = new version of I-D, draft-rogaglia-sidr-bgpsec-rollover-01.txt has been = successfully submitted by Roque Gagliano and posted to the IETF = repository.

Filename: = draft-rogaglia-sidr-bgpsec-rollover
Revision: = 01
Title: = = BGPSEC router key rollover as an alternative to = beaconing
Creation date: 2012-06-05
WG ID: = Individual Submission
Number of pages: 15

Abstract:
=   The current BGPSEC draft documents do not specifies a key = rollover
  process for routers.  This document = describes a possible key rollover
  process and explores = its impact to mitigate replay attacks and
  eliminate the = need for beaconing in BGPSEC.




The IETF = Secretariat

= --Apple-Mail-225--186518720-- --Apple-Mail-226--186518652 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMXDCCBWYw ggROoAMCAQICEDG+eY7Bhz6hDsSIPCMJYUYwDQYJKoZIhvcNAQEFBQAwgd0xCzAJBgNVBAYTAlVT MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEg KGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24g Q2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMzAeFw0xMjA1MDgwMDAwMDBaFw0x MzA1MTEyMzU5NTlaMIIBEzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlT aWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVwb3NpdG9yeS9S UEEgSW5jb3JwLiBieSBSZWYuLExJQUIuTFREKGMpOTgxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDEzMDEGA1UECxMqRGlnaXRhbCBJRCBDbGFzcyAxIC0gTmV0c2NhcGUgRnVsbCBTZXJ2 aWNlMRcwFQYDVQQDFA5Sb3F1ZSBHYWdsaWFubzEhMB8GCSqGSIb3DQEJARYScm9nYWdsaWFAY2lz Y28uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs+CGyKUNmmBJ4PgQDVA8hF5E ByrcJ8BQ2C8mSv3vSZqCZNXAyte/JRsl11BJmqwdLiH6baDaJbBKRzNFfaf8Wwe8aS3QvqpHfKtU pYvn+EKseVnXsIKssRV2AwNODN6VMwSA72Jiolo3z4xeoeLw9X/CnFYTJa4AcGM1LKk+rMGTQlly XXl+qc7LeAd+wk7bKsUFmg4uCfvCDhVSQj25S5tnmFl5WPGD2u7QEa2WLkkL5nH+BEedZmRejRgP smmAxDfBX1FVTnCOgz75hNFlrnkYJfPCXLRyfPHvaIGP/NBz6TJbwB3YZSweYHxWAEMglqgRvqIW 3Tr5k5x9yyNYVQIDAQABo4HoMIHlMAkGA1UdEwQCMAAwRAYDVR0gBD0wOzA5BgtghkgBhvhFAQcX ATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vcnBhMAsGA1UdDwQEAwIF oDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwFAYKYIZIAYb4RQEGBwQGFgROb25lMFAG A1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9pbmRjMWRpZ2l0YWxpZC1nMy1jcmwudmVyaXNpZ24uY29t L0luZEMxRGlnaXRhbElELUczLmNybDANBgkqhkiG9w0BAQUFAAOCAQEAuFfFZrObA9gprpHyG6cq O4UZjtN5/moV6mUYbt+ffGrXMbVt06vgnba7r6ldS5eWPQZZQtAAKKqweAmZY37ZcvVQwDsMXOMG 4+MN60sPVKwrrSQz9xXcImVCzBxFsq22S4el6pGx38xytsPgKw4cs8ZVxPLEjZtcOGnl8R8fak2g WyAMt8zkIxu/84zcobhcY5EEPJxYg9WKHi617fD6/jjQqvwvW4zi2XkIjw+HpZSwdPxk2+Cg6id4 SS6WlTwe90rdJmRrCP4gTXyJOdARR7hJU714lamn9QdQuPX7WLJXuMmoyrhvZZUeHpvodO/eNiO2 KvxMUu0uXWiDcDgTvzCCBu4wggXWoAMCAQICEHEVZgVK5JEhTem8RPms09wwDQYJKoZIhvcNAQEF BQAwgcoxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVy aVNpZ24gVHJ1c3QgTmV0d29yazE6MDgGA1UECxMxKGMpIDE5OTkgVmVyaVNpZ24sIEluYy4gLSBG b3IgYXV0aG9yaXplZCB1c2Ugb25seTFFMEMGA1UEAxM8VmVyaVNpZ24gQ2xhc3MgMSBQdWJsaWMg UHJpbWFyeSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSAtIEczMB4XDTA5MDUwMTAwMDAwMFoXDTE5 MDQzMDIzNTk1OVowgd0xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0G A1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0 dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZh bGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24gQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIg Q0EgLSBHMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO3ER98qKB18Bmu71yEyyWwT j+mxjUFONPfaC+Nq+mWIIAsRE+mb4ElOi2/VAdBfDUeRilpMdD4/xpEJu0w0no1uoYJRYvdpdliW B6+eFBgHT1q9n9IxslQZc0ZqGUIR7BJzIY313DDN5dlWCjHFNm0pFJe9LdqJRxmI2EsEPeu2PGce dAATDdCG2pNn+DMDrho8a2l49sAsjuGDP3f5mf/+n1JawrSHCthsqUfBVCllQz5KwJYfwa33d69s sQRevsG2lC2XkC0n0rse6YNqhPbEsq4jBmUmpSdYKwcitG+mYkgad/LVUCeaKdOW+yj1uiR2YuOM Wev7btVCxL5Bx/UCAwEAAaOCArkwggK1MDQGCCsGAQUFBwEBBCgwJjAkBggrBgEFBQcwAYYYaHR0 cDovL29jc3AudmVyaXNpZ24uY29tMBIGA1UdEwEB/wQIMAYBAf8CAQAwcAYDVR0gBGkwZzBlBgtg hkgBhvhFAQcXATBWMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3BzMCoG CCsGAQUFBwICMB4aHGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEwNAYDVR0fBC0wKzApoCeg JYYjaHR0cDovL2NybC52ZXJpc2lnbi5jb20vcGNhMS1nMy5jcmwwDgYDVR0PAQH/BAQDAgEGMG4G CCsGAQUFBwEMBGIwYKFeoFwwWjBYMFYWCWltYWdlL2dpZjAhMB8wBwYFKw4DAhoEFEtruSiWBgy7 0FI4mymsSweLIQUYMCYWJGh0dHA6Ly9sb2dvLnZlcmlzaWduLmNvbS92c2xvZ28xLmdpZjAuBgNV HREEJzAlpCMwITEfMB0GA1UEAxMWUHJpdmF0ZUxhYmVsNC0yMDQ4LTExODAdBgNVHQ4EFgQUeUdh CEH9OASiS+e1zPVD9kkrEfgwgfEGA1UdIwSB6TCB5qGB0KSBzTCByjELMAkGA1UEBhMCVVMxFzAV BgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYDVQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTow OAYDVQQLEzEoYykgMTk5OSBWZXJpU2lnbiwgSW5jLiAtIEZvciBhdXRob3JpemVkIHVzZSBvbmx5 MUUwQwYDVQQDEzxWZXJpU2lnbiBDbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24g QXV0aG9yaXR5IC0gRzOCEQCLW3VWhFSFCwDPrzhIzrGkMA0GCSqGSIb3DQEBBQUAA4IBAQA5Tc9B mYG1qQW1UjjpOYSJbOQ0qFrn2GwJTCQaulmkhztzIfGTgc+/aGNaZ/41hSuhw12jSsI6Gd0w1sxN 7/HSgZfKVFpDvzeLeo4ZjQ9DqIzyr2CzFYqzlZw84J6zJ5ikNXIX5fwqXYfTig3C0UUq+MD0rCqT OtWuEnAI6/s74nfs6CtkNXbNutrg0csU1nFYm77VPn222egkxSRmTF2RH3azFz5/DcYhiS+zN7ih /1yybUneZVJC+w6I0u1KHb9L4/jMcvpIDmWOScjW+JmYO7eUPjFxBof6bFlTLtffK+1fYwCsFe0D uFUWjMZoA+ciqHMLsbyg2lJY3QoOf8GCMYIEizCCBIcCAQEwgfIwgd0xCzAJBgNVBAYTAlVTMRcw FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE7 MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9ycGEgKGMp MDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVyaVNpZ24gQ2xh c3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMwIQMb55jsGHPqEOxIg8IwlhRjAJBgUr DgMCGgUAoIICbTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMjA2 MDUxMjA1MzRaMCMGCSqGSIb3DQEJBDEWBBRd8JpBgXXa8TFqIWk2A67WPwm02DCCAQMGCSsGAQQB gjcQBDGB9TCB8jCB3TELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMR8wHQYD VQQLExZWZXJpU2lnbiBUcnVzdCBOZXR3b3JrMTswOQYDVQQLEzJUZXJtcyBvZiB1c2UgYXQgaHR0 cHM6Ly93d3cudmVyaXNpZ24uY29tL3JwYSAoYykwOTEeMBwGA1UECxMVUGVyc29uYSBOb3QgVmFs aWRhdGVkMTcwNQYDVQQDEy5WZXJpU2lnbiBDbGFzcyAxIEluZGl2aWR1YWwgU3Vic2NyaWJlciBD QSAtIEczAhAxvnmOwYc+oQ7EiDwjCWFGMIIBBQYLKoZIhvcNAQkQAgsxgfWggfIwgd0xCzAJBgNV BAYTAlVTMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3Qg TmV0d29yazE7MDkGA1UECxMyVGVybXMgb2YgdXNlIGF0IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNv bS9ycGEgKGMpMDkxHjAcBgNVBAsTFVBlcnNvbmEgTm90IFZhbGlkYXRlZDE3MDUGA1UEAxMuVmVy aVNpZ24gQ2xhc3MgMSBJbmRpdmlkdWFsIFN1YnNjcmliZXIgQ0EgLSBHMwIQMb55jsGHPqEOxIg8 IwlhRjANBgkqhkiG9w0BAQEFAASCAQAv7B2+6yrERFscvBIPfERqCfDZBKpdKMsYK2Yby7RQpP56 B5Fx3xwKcvfzhI2xuqhIxXkuElAl+iLu37oqZggfOHxd2TkVG03moJtv7+RGvavJFXI4ObJIoPy/ AjwO6HkKTsqbXAKl5fc11a9IOuAVvHr/ba1WdjxX0D2PQco1Xx3iN2DMBtmp8ESVtZ19P1EEDnlC hIt94IzuFxkfHk5IuaLbELfprpKi9VB5YEutj2QR5Ml0UvdwGSZqNuBk0z7y88qYKBuyr/B6FyQb 2oJ+sNhAhby/dlB8Bg9Np/IJcB2pSIOI/a04GXM51H1/oSE7iHEpuX7r5rYXevHWZsAhAAAAAAAA --Apple-Mail-226--186518652-- From randy@psg.com Tue Jun 5 09:27:46 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0EC5121F8631 for ; Tue, 5 Jun 2012 09:27:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.504 X-Spam-Level: X-Spam-Status: No, score=-2.504 tagged_above=-999 required=5 tests=[AWL=0.095, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pSh1w5dmsQDu for ; Tue, 5 Jun 2012 09:27:45 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id A972321F8625 for ; Tue, 5 Jun 2012 09:27:45 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sbwbh-0008q5-6o for sidr@ietf.org; Tue, 05 Jun 2012 16:27:45 +0000 Date: Tue, 05 Jun 2012 09:27:45 -0700 Message-ID: From: Randy Bush To: sidr wg list In-Reply-To: <2C7763BA-5F9E-47A2-BD49-0BD109DB2C91@cisco.com> References: <20120605115852.31388.99984.idtracker@ietfa.amsl.com> <2C7763BA-5F9E-47A2-BD49-0BD109DB2C91@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Subject: Re: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-bgpsec-rollover-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Jun 2012 16:27:46 -0000 >> Filename: draft-rogaglia-sidr-bgpsec-rollover >> Revision: 01 >> Title: BGPSEC router key rollover as an alternative to beaconing >> Creation date: 2012-06-05 >> WG ID: Individual Submission >> Number of pages: 15 >> >> Abstract: >> The current BGPSEC draft documents do not specifies a key rollover >> process for routers. This document describes a possible key rollover >> process and explores its impact to mitigate replay attacks and >> eliminate the need for beaconing in BGPSEC. i support adoption as a wg work item randy From Sandra.Murphy@sparta.com Tue Jun 5 17:19:45 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D53AC11E80AA; Tue, 5 Jun 2012 17:19:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.546 X-Spam-Level: X-Spam-Status: No, score=-102.546 tagged_above=-999 required=5 tests=[AWL=0.053, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hjb5tC7ydt12; Tue, 5 Jun 2012 17:19:45 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id D468311E808C; Tue, 5 Jun 2012 17:19:42 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q560JeKL019112; Tue, 5 Jun 2012 19:19:40 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q560JXlK022878; Tue, 5 Jun 2012 19:19:34 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Tue, 5 Jun 2012 20:19:28 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: reminder of details for tomorrow Thread-Index: Ac1DbvQ1GtcrpXVoTIqiDHuxiFpgBQ== Date: Wed, 6 Jun 2012 00:19:27 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F195C3@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr-chairs@ietf.org" Subject: [sidr] reminder of details for tomorrow X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 00:19:46 -0000 A reminder of information for the interim meeting scheduled for tomorrow.= =0A= =0A= The wiki page is=0A= http://trac.tools.ietf.org/wg/sidr/trac/wiki/InterimMeeting20120606=0A= =0A= Note that the wiki page is updated with new info.=0A= =0A= (Almost) all the following is copied from the updated wiki page.=0A= =0A= The webex session telecon info copied from the wiki page is:=0A= =0A= Event number: 644 985 813 Event password: nanoginterim=0A= Topic: NanogInterim?=0A= Event address for attendees: https://ietf.webex.com/ietf/onstage/g.php?d= =3D644985813&t=3Da=0A= or https://ietf.webex.com/ietf/onstage/g.php?t=3Da&d=3D644985813 =0A= Call-in: +1-408-600-3600 pin: 644 985 813 =0A= =0A= The location info copied from the wiki page is:=0A= =0A= Room 1600, Canfor Policy Room=0A= Simon Fraser University (SFU) at Harbour Centre=0A= 515 West Hastings Street=0A= Vancouver, British Columbia V6B 5K3 =0A= =0A= Here's a map and walking directions from the nanog venue:=0A= =0A= http://maps.google.ca/maps?saddr=3DThe+Westin+Bayshore,+Vancouver,+1601+Ba= yshore+Drive,+Vancouver,+BC&daddr=3DHarbour+Centre,+515+West+Hastings+Stree= t,+Vancouver,+BC&hl=3Den&ll=3D49.288537,-123.120046&spn=3D0.011057,0.023818= &sll=3D49.288415,-123.12006&sspn=3D0.011057,0.023818&geocode=3DFUEj8AId-DKp= -CF_t2V8c69urw%3BFaYG8AIdqHap-CE7vcYNXM1_lw&dirflg=3Dw&mra=3Dltm&t=3Dm&z=3D= 16=0A= =0A= Our kind host provides the following hint:=0A= =0A= Look for this building: https://www.google.ca/search?sugexp=3Dchrome,mod%3= D19&q=3Dharbour%20centre&um=3D1&ie=3DUTF-8&hl=3Den&tbm=3Disch&source=3Dog&s= a=3DN&tab=3Dwi&ei=3D64LOT_XCBsXY2QXtjI2-DA&biw=3D1377&bih=3D707&sei=3D7YLOT= 6LLNqLE2gXMzfDgDA =0A= =0A= The agenda copied from the wiki page is:=0A= =0A= The (draft) agenda is a half day meeting(1300-1800):=0A= =0A= 1300-1500 aspath not present - implications?=0A= 1500-1700 rekeying processes/procedures/implications=0A= 1700-1800 performance measurement bounds=0A= =0A= Plan for interaction, copied from wiki page:=0A= =0A= Remote participation will be done via:=0A= =0A= webex (slides/conf-call-voice)=0A= jabber sidr@jabber.ietf.org (remote-hand-raise + questions + slide syn= c)=0A= jabber sidr2@jabber.ietf.org (live meeting notes)=0A= =0A= The tools team was able to provide us a second jabber room but not an ether= pad in the (volunteer) time available. (The jabber room gives remote parti= cipants the ability to scroll back, where webex shared desktop does not.)= =0A= =0A= If I missed anything, please send message to list.=0A= =0A= --Sandy, speaking as regular ol' wg member= From Sandra.Murphy@sparta.com Tue Jun 5 17:49:00 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C972221F86D9 for ; Tue, 5 Jun 2012 17:49:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.549 X-Spam-Level: X-Spam-Status: No, score=-102.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NIa6p1cj7vlq for ; Tue, 5 Jun 2012 17:49:00 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id D8F3921F87E1 for ; Tue, 5 Jun 2012 17:48:59 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q560mxiB019214 for ; Tue, 5 Jun 2012 19:48:59 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q560mnqv023148 for ; Tue, 5 Jun 2012 19:48:49 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Tue, 5 Jun 2012 20:48:44 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: chair duties at interim meeting Thread-Index: Ac1De6dSvCWq4xVQQemvytFUfHJ14Q== Date: Wed, 6 Jun 2012 00:48:42 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F19637@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] chair duties at interim meeting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 00:49:00 -0000 There will only be one co-chair physically present at the interim meeting 6= Jun.=0A= =0A= The in-person chair will be busy trying to keep the meeting flowing.=0A= =0A= So the in-person chair will not be responsible for jabbering, minutes takin= g or webex session hosting.=0A= =0A= Some generous volunteers have offered to perform the webex hosting duties.= =0A= =0A= Volunteers are needed for jabber and minute taking.=0A= =0A= Please volunteer.=0A= =0A= --Sandy= From kotikalapudi.sriram@nist.gov Tue Jun 5 17:59:57 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA9C611E80AC for ; Tue, 5 Jun 2012 17:59:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.413 X-Spam-Level: X-Spam-Status: No, score=-6.413 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ERvEfwFo6J1w for ; Tue, 5 Jun 2012 17:59:57 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 416CD11E80AB for ; Tue, 5 Jun 2012 17:59:57 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.1.355.2; Tue, 5 Jun 2012 20:59:51 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Tue, 5 Jun 2012 20:59:55 -0400 From: "Sriram, Kotikalapudi" To: "Murphy, Sandra" , "sidr@ietf.org" Date: Tue, 5 Jun 2012 20:57:59 -0400 Thread-Topic: slides for interim meeting 6 Jun Thread-Index: Ac1AS6aZVVEIjXi5Tc6LliE+MPcDCgDMfyhn Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1341B@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1341B@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Subject: Re: [sidr] slides for interim meeting 6 Jun X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 00:59:58 -0000 Sandy, I just emailed you (cc to Chris) a set of slides. Some of the slides are to motivate discussion of some bgpsec performance issues and sizing requirements for routers in defined roles in the network. And the rest are pictures that may be helpful in the discussions related to of AS_PATH, Confeds, and AS migration. Sriram ________________________________________ From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] On Behalf Of Murphy, Sandra [Sandra.Murphy@sparta.com] Sent: Friday, June 01, 2012 7:09 PM To: sidr@ietf.org Subject: [sidr] slides for interim meeting 6 Jun Should anyone have slides they want to present for the interim meeting on 6 Jun, please get them to the chairs by COB 5 Jun so that they can be uploaded to the meeting materials page. That's 5 Jun, not 5 minutes, folks. --Sandy _______________________________________________ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr From randy@psg.com Tue Jun 5 18:04:43 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 846DD11E80B8 for ; Tue, 5 Jun 2012 18:04:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.507 X-Spam-Level: X-Spam-Status: No, score=-2.507 tagged_above=-999 required=5 tests=[AWL=0.092, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7tqECOF3F7vM for ; Tue, 5 Jun 2012 18:04:43 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 1424811E80AB for ; Tue, 5 Jun 2012 18:04:43 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sc4fy-000Aco-EN for sidr@ietf.org; Wed, 06 Jun 2012 01:04:42 +0000 Date: Tue, 05 Jun 2012 18:04:42 -0700 Message-ID: From: Randy Bush To: sidr wg list In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F195C3@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F195C3@Hermes.columbia.ads.sparta.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Subject: Re: [sidr] reminder of details for tomorrow X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 01:04:43 -0000 the more critical information is that revolver coffee is a couple of blocks further east at 325 cambie at hastings. opens at 08:00. From Sandra.Murphy@sparta.com Tue Jun 5 18:38:27 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9423321F8691 for ; Tue, 5 Jun 2012 18:38:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.551 X-Spam-Level: X-Spam-Status: No, score=-102.551 tagged_above=-999 required=5 tests=[AWL=0.048, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LMrfsTJYzMod for ; Tue, 5 Jun 2012 18:38:27 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 0EA7721F8652 for ; Tue, 5 Jun 2012 18:38:26 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q561cMLr019397 for ; Tue, 5 Jun 2012 20:38:23 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q561cGGT023704 for ; Tue, 5 Jun 2012 20:38:16 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Tue, 5 Jun 2012 21:38:10 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: meeting materials Thread-Index: Ac1DhQeOMbBcTcOqS6W/vEPmV5a5zQ== Date: Wed, 6 Jun 2012 01:38:10 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1966A@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] meeting materials X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 01:38:27 -0000 The meeting materials will be available at:=0A= =0A= http://www.ietf.org/proceedings/interim/2012/06/06/sidr/proceedings.html=0A= =0A= --Sandy, speaking as wg co-chair= From randy@psg.com Wed Jun 6 07:00:29 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E80221F8658 for ; Wed, 6 Jun 2012 07:00:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.509 X-Spam-Level: X-Spam-Status: No, score=-2.509 tagged_above=-999 required=5 tests=[AWL=0.090, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8F4Xk-ZjIcBX for ; Wed, 6 Jun 2012 07:00:29 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 0CC9121F8657 for ; Wed, 6 Jun 2012 07:00:28 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1ScGmi-000C4v-EC for sidr@ietf.org; Wed, 06 Jun 2012 14:00:28 +0000 Date: Wed, 06 Jun 2012 07:00:28 -0700 Message-ID: From: Randy Bush To: sidr wg list References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Subject: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 14:00:29 -0000 this draft is relevant to the sidr wg work and i, as author, request it be made a work item. randy From: internet-drafts@ietf.org To: randy@psg.com Subject: New Version Notification for draft-ymbk-rpki-grandparenting-00.txt Message-ID: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> Date: Wed, 06 Jun 2012 06:59:03 -0700 A new version of I-D, draft-ymbk-rpki-grandparenting-00.txt has been succes= sfully submitted by Randy Bush and posted to the IETF repository. Filename: draft-ymbk-rpki-grandparenting Revision: 00 Title: Responsible Grandparenting in the RPKI Creation date: 2012-06-06 WG ID: Individual Submission Number of pages: 5 Abstract: There are circumstances in RPKI operations where a resource holder's parent may not be able to, or may not choose to, facilitate full and proper registration of the holder's data. As in real life, the holder may form a relationship to their grandparent who is willing to aid the grandchild. This document describes simple procedures for doing so. The IETF Secretariat From morrowc@ops-netman.net Wed Jun 6 07:10:13 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 955F821F8532; Wed, 6 Jun 2012 07:10:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001, WEIRD_PORT=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VjpmDimVKXwO; Wed, 6 Jun 2012 07:10:13 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2001:470:e495:fade:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id 8C01121F8531; Wed, 6 Jun 2012 07:10:12 -0700 (PDT) Received: from donkey.her.corp.google.com (unknown [IPv6:2620:0:100a:0:8890:b3c7:5204:9a75]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id 4C6BD32008D; Wed, 6 Jun 2012 14:10:09 +0000 (UTC) Message-ID: <4FCF64C1.3010800@ops-netman.net> Date: Wed, 06 Jun 2012 10:10:09 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20120430 Thunderbird/12.0.1 MIME-Version: 1.0 To: "Murphy, Sandra" References: <24B20D14B2CD29478C8D5D6E9CBB29F625F195C3@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F195C3@Hermes.columbia.ads.sparta.com> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] reminder of details for tomorrow X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 14:10:13 -0000 One last update (I hope), we managed to get the tools folk to turn up an etherpad 'pad' for us to use in note taking as well: So I hope we can take notes there, and simply copy/paste that into the official notes-page thingy. -chris On 06/05/2012 08:19 PM, Murphy, Sandra wrote: > A reminder of information for the interim meeting scheduled for tomorrow. > > The wiki page is > http://trac.tools.ietf.org/wg/sidr/trac/wiki/InterimMeeting20120606 > > Note that the wiki page is updated with new info. > > (Almost) all the following is copied from the updated wiki page. > > The webex session telecon info copied from the wiki page is: > > Event number: 644 985 813 Event password: nanoginterim > Topic: NanogInterim? > Event address for attendees: https://ietf.webex.com/ietf/onstage/g.php?d=644985813&t=a > or https://ietf.webex.com/ietf/onstage/g.php?t=a&d=644985813 > Call-in: +1-408-600-3600 pin: 644 985 813 > > The location info copied from the wiki page is: > > Room 1600, Canfor Policy Room > Simon Fraser University (SFU) at Harbour Centre > 515 West Hastings Street > Vancouver, British Columbia V6B 5K3 > > Here's a map and walking directions from the nanog venue: > > http://maps.google.ca/maps?saddr=The+Westin+Bayshore,+Vancouver,+1601+Bayshore+Drive,+Vancouver,+BC&daddr=Harbour+Centre,+515+West+Hastings+Street,+Vancouver,+BC&hl=en&ll=49.288537,-123.120046&spn=0.011057,0.023818&sll=49.288415,-123.12006&sspn=0.011057,0.023818&geocode=FUEj8AId-DKp-CF_t2V8c69urw%3BFaYG8AIdqHap-CE7vcYNXM1_lw&dirflg=w&mra=ltm&t=m&z=16 > > Our kind host provides the following hint: > > Look for this building: https://www.google.ca/search?sugexp=chrome,mod%3D19&q=harbour%20centre&um=1&ie=UTF-8&hl=en&tbm=isch&source=og&sa=N&tab=wi&ei=64LOT_XCBsXY2QXtjI2-DA&biw=1377&bih=707&sei=7YLOT6LLNqLE2gXMzfDgDA > > The agenda copied from the wiki page is: > > The (draft) agenda is a half day meeting(1300-1800): > > 1300-1500 aspath not present - implications? > 1500-1700 rekeying processes/procedures/implications > 1700-1800 performance measurement bounds > > Plan for interaction, copied from wiki page: > > Remote participation will be done via: > > webex (slides/conf-call-voice) > jabber sidr@jabber.ietf.org (remote-hand-raise + questions + slide sync) > jabber sidr2@jabber.ietf.org (live meeting notes) > > The tools team was able to provide us a second jabber room but not an etherpad in the (volunteer) time available. (The jabber room gives remote participants the ability to scroll back, where webex shared desktop does not.) > > If I missed anything, please send message to list. > > --Sandy, speaking as regular ol' wg member From weiler@watson.org Wed Jun 6 10:06:11 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBB3521F88D4 for ; Wed, 6 Jun 2012 10:06:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, J_CHICKENPOX_64=0.6] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uDZlvefI4hqa for ; Wed, 6 Jun 2012 10:06:10 -0700 (PDT) Received: from fledge.watson.org (fledge.watson.org [65.122.17.41]) by ietfa.amsl.com (Postfix) with ESMTP id BAF4721F8567 for ; Wed, 6 Jun 2012 10:06:07 -0700 (PDT) Received: from fledge.watson.org (localhost.watson.org [127.0.0.1]) by fledge.watson.org (8.14.4/8.14.4) with ESMTP id q56H66n8047261 for ; Wed, 6 Jun 2012 13:06:06 -0400 (EDT) (envelope-from weiler@watson.org) Received: from localhost (weiler@localhost) by fledge.watson.org (8.14.4/8.14.4/Submit) with ESMTP id q56H661J047258 for ; Wed, 6 Jun 2012 13:06:06 -0400 (EDT) (envelope-from weiler@watson.org) X-Authentication-Warning: fledge.watson.org: weiler owned process doing -bs Date: Wed, 6 Jun 2012 13:06:06 -0400 (EDT) From: Samuel Weiler To: "sidr@ietf.org" In-Reply-To: <4FCF64C1.3010800@ops-netman.net> Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F195C3@Hermes.columbia.ads.sparta.com> <4FCF64C1.3010800@ops-netman.net> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.3 (fledge.watson.org [127.0.0.1]); Wed, 06 Jun 2012 13:06:07 -0400 (EDT) Subject: Re: [sidr] reminder of details for tomorrow X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Jun 2012 17:06:11 -0000 For remote participants: tests with WebEx this morning revealed serious audio bridge problems. It's moderately likely that an alternate audio bridge will be in use. Check the wiki and jabber for details. For on-site participants: Use the dedicated Simon Fraser University entrance -- as you walk along Hastings from the Westin, pass the main Harbour Center entrance. The SFU entrance is on the left. A cab from the Westin will cost ~CDN$7. We are in the Canfor Policy Room (#1600) on the ground level. Pass the guard booth, turn left, and look for us on the right. We have access to two different wireless networks, one with IPv6. Both appear to work adequately: no filtering of SSH, jabber, common VPN stuff, etc. Access credentials will be available on-site. There is also eduroam access. We have a single wired link which will likely be reserved for the WebEx machine but can be plugged into an access point if needed. Here are netalyzer reports: SSID: BCNETv6Demo 1 http://n3.netalyzr.icsi.berkeley.edu/summary/id=ae81b058-1486-af3d7950-4438-42e0-94ff ~20Mbps bidirectional, with working v6 SSID: SFUNET http://n1.netalyzr.icsi.berkeley.edu/summary/id=43ca253f-21380-9d2efded-66ae-4687-a834 ~20Mbps bidirectional Wired: http://n3.netalyzr.icsi.berkeley.edu/summary/id=ae81b058-1489-791fc034-f720-4779-8233 ~80 Mbps down, 35 up Many thanks to the local hosts for providing early access to the facility. -- Sam From bje@apnic.net Wed Jun 6 19:58:24 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B40421F8694 for ; Wed, 6 Jun 2012 19:58:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4b3DBi0fqRvP for ; Wed, 6 Jun 2012 19:58:23 -0700 (PDT) Received: from asmtp.apnic.net (asmtp.apnic.net [IPv6:2001:dc0:2001:11::199]) by ietfa.amsl.com (Postfix) with ESMTP id 2906821F8693 for ; Wed, 6 Jun 2012 19:58:21 -0700 (PDT) Received: from [IPv6:2001:dc0:a000:4:8cd8:4e3a:2c:77f4] (unknown [IPv6:2001:dc0:a000:4:8cd8:4e3a:2c:77f4]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by asmtp.apnic.net (Postfix) with ESMTP id C517EB673A; Thu, 7 Jun 2012 12:58:19 +1000 (EST) Mime-Version: 1.0 (Apple Message framework v1257) Content-Type: multipart/signed; boundary="Apple-Mail=_0B67F11A-7EC9-492F-B473-E3B58A34DD45"; protocol="application/pkcs7-signature"; micalg=sha1 From: Byron Ellacott In-Reply-To: Date: Thu, 7 Jun 2012 12:58:19 +1000 Message-Id: References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> To: Randy Bush X-Mailer: Apple Mail (2.1257) Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jun 2012 02:58:24 -0000 --Apple-Mail=_0B67F11A-7EC9-492F-B473-E3B58A34DD45 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Randy, Why does the draft require that C's certificate not be modified to = reflect the update in recorded holder of the INRs at A? That would seem = to be in disagreement with RFC 6484, to me. Byron On 07/06/2012, at 12:00 AM, Randy Bush wrote: > this draft is relevant to the sidr wg work and i, as author, request = it > be made a work item. >=20 > randy --Apple-Mail=_0B67F11A-7EC9-492F-B473-E3B58A34DD45 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIEBjCCBAIw ggLqoAMCAQICCCoPITf60ZNDMA0GCSqGSIb3DQEBBQUAMHMxETAPBgNVBAMMCHN0YWZmLWNhMRIw EAYDVQQLDAlUZWNobmljYWwxFjAUBgNVBAoMDUFQTklDIFB0eSBMdGQxETAPBgNVBAcMCEJyaXNi YW5lMRIwEAYKCZImiZPyLGQBGRYCY2ExCzAJBgNVBAYTAkFVMB4XDTExMTEyODAxNTEzNloXDTEy MTEyNzAxNTEzNlowgZIxGTAXBgoJkiaJk/IsZAEBDAliamUtc3RhZmYxEjAQBgNVBAMMCWJqZS1z dGFmZjEOMAwGA1UEKgwFQnlyb24xETAPBgNVBAQMCEVsbGFjb3R0MQ8wDQYDVQQLDAZQZW9wbGUx FjAUBgNVBAoMDUFQTklDIFB0eSBMdGQxFTATBgoJkiaJk/IsZAEZFgVzdGFmZjCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBANVQo/BOmY5CCWNeAldlgoWZKOzIZpOsFzD6NB2oAErtclDu uiZsXfl+L97UOwUlhu1eGlY5gKuAhGcrEBvDgTT1eEr3vkdKILhJw78s5n8eLOWrmhPKBnW8gSn9 7MbAxVQx3V1/RpToKAF8cR4il03Z7mveaBQbaivM2jReHcgfJPt9w0qhTVZO2POLuVClRcExaNt1 h+QdMLa6VU5x7rJo9JFqjTAvJzMApW+WY/7oumR9+4a9ZGThlETI2b83XAMrrJ7DHm237Jskgl+X FGILIq8zOhNiAbhEg+gAyJ8bOzwwydDY+ggWQ466duZZq4wxmr1+YhxVf51v2R5MSicCAwEAAaN6 MHgwHQYDVR0OBBYEFIQXSivz3cLpaFy23DdhpGhyyo5pMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgw FoAU4D23klvuLqOyPnnbRaswQi8BS6wwDgYDVR0PAQH/BAQDAgHyMBgGA1UdEQQRMA+BDWJqZUBh cG5pYy5uZXQwDQYJKoZIhvcNAQEFBQADggEBAEk9zi8BTUEY4rqDGEIFDNIpmX/yS3fTah39Mele pV93sRsjqLy2G47vhhnkgSTEWV2jJOD7tjzjswxtWUL6KG36dUDVL3XbQ1OObxkiDJbqje4BoWrd a8/5PoIPC0hkSDXGoitvoXkL8Pd9x9Y+kyMlKo1C0lk5bCUG4yjk5wVLuSSm5m+KZ3+YVdPp6dKp C0DRhvFdsrz2zIOT/sWheCQO0HRU300UYngB/xoqc1KWH2dROIUhLqwtyoCQbQKQjW9C+JMMw2Ij vfVXJZGMWjbp5l8RQeUSJ+0vVJXJbIL6PfEsyQupUV3AJsSTRmtllqzCBCz2Abd14xyeqw0eJfwx ggMtMIIDKQIBATB/MHMxETAPBgNVBAMMCHN0YWZmLWNhMRIwEAYDVQQLDAlUZWNobmljYWwxFjAU BgNVBAoMDUFQTklDIFB0eSBMdGQxETAPBgNVBAcMCEJyaXNiYW5lMRIwEAYKCZImiZPyLGQBGRYC Y2ExCzAJBgNVBAYTAkFVAggqDyE3+tGTQzAJBgUrDgMCGgUAoIIBgzAYBgkqhkiG9w0BCQMxCwYJ KoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMjA2MDcwMjU4MjBaMCMGCSqGSIb3DQEJBDEWBBRh DCTgqRbq7YVADJzuE8+1PU4SpTCBjwYJKwYBBAGCNxAEMYGBMH8wczERMA8GA1UEAwwIc3RhZmYt Y2ExEjAQBgNVBAsMCVRlY2huaWNhbDEWMBQGA1UECgwNQVBOSUMgUHR5IEx0ZDERMA8GA1UEBwwI QnJpc2JhbmUxEjAQBgoJkiaJk/IsZAEZFgJjYTELMAkGA1UEBhMCQVUCCCoPITf60ZNDMIGRBgsq hkiG9w0BCRACCzGBgaB/MHMxETAPBgNVBAMMCHN0YWZmLWNhMRIwEAYDVQQLDAlUZWNobmljYWwx FjAUBgNVBAoMDUFQTklDIFB0eSBMdGQxETAPBgNVBAcMCEJyaXNiYW5lMRIwEAYKCZImiZPyLGQB GRYCY2ExCzAJBgNVBAYTAkFVAggqDyE3+tGTQzANBgkqhkiG9w0BAQEFAASCAQB8CRUGGCRapiG2 yfJdVhPCFvEkrZlPoVQIz8nIaK78rYPXgxoNKBqbGQya0AgV19zuLNnrunU5dBUhnKOVtJ0bJqKi f8hR5/mhbvuNwt+JyLXr38neOgRoUuX9h9n5A+WBiPyIRBOHREwie6baYsJhr9TKky2S3a1DE06V mj0lDwopjCic3EDjGJt8ojbaoQ12DSBYdT2Zit1nrKjicIHXebdw+aG6xGLfeMgyoI9oWQFMRb5Z HkHzbVfmEZE5gjYbwjJMYpmmur5MEwFUVieksNrIVw0Kyxvt1lXlui+Q9HAsF7daWfWxCYjnA8K4 X8Ocf5QDXDbfnQ3xjhNKcPY+AAAAAAAA --Apple-Mail=_0B67F11A-7EC9-492F-B473-E3B58A34DD45-- From terry.manderson@icann.org Wed Jun 6 22:54:25 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 263BE11E80E9 for ; Wed, 6 Jun 2012 22:54:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XC6FXSzrduWf for ; Wed, 6 Jun 2012 22:54:24 -0700 (PDT) Received: from EXPFE100-2.exc.icann.org (expfe100-2.exc.icann.org [64.78.22.237]) by ietfa.amsl.com (Postfix) with ESMTP id 6DC8F11E80E8 for ; Wed, 6 Jun 2012 22:54:24 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-2.exc.icann.org ([64.78.22.237]) with mapi; Wed, 6 Jun 2012 22:54:21 -0700 From: Terry Manderson To: Randy Bush , sidr wg list Date: Wed, 6 Jun 2012 22:54:19 -0700 Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: Ac1D7MjRF53PrJ9KSjKhYSccACT4iAAhTHKP Message-ID: In-Reply-To: Accept-Language: en-US Content-Language: en X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3421929259_34031755" MIME-Version: 1.0 Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jun 2012 05:54:25 -0000 --B_3421929259_34031755 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi Randy, I'm presuming that there are cases that prompt you to write this draft as BCP. Are you able to elaborate on why (using the nomenclature from your example) "A" wouldn't re-issue the rpki certificate to "C" to be "10.42.0.0/23,10.42.4.0/22,10.42.8.0/21,10.42.16.0/20,10.42.32.0/19,10.42.64 .0/18,10.42.128.0/17" (ie the 10.42.0.0/16 resources minus "C's" /23) and a certificate to G of "10.42.2.0/23" since both "A" and "C" are in agreement that "G" retains that prefix? Or is this what you are trying to describe? So far the wording seems (to me) that some certificate state will eventuate that "A" issues a certificate for the 10.42.0.0/16 to "C" _AND_ creates a 10.42.2.0/23 resulting object (ROA etc) on "G's" behalf as a subordinate object of "A's" 10/8? I'm not sure that was the intent of the RPKI? Was it? Cheers Terry On 7/06/12 12:00 AM, "Randy Bush" wrote: > this draft is relevant to the sidr wg work and i, as author, request it > be made a work item. > > randy > > > From: internet-drafts@ietf.org > To: randy@psg.com > Subject: New Version Notification for draft-ymbk-rpki-grandparenting-00.txt > Message-ID: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> > Date: Wed, 06 Jun 2012 06:59:03 -0700 > > A new version of I-D, draft-ymbk-rpki-grandparenting-00.txt has been succes= > sfully submitted by Randy Bush and posted to the IETF repository. > > Filename: draft-ymbk-rpki-grandparenting > Revision: 00 > Title: Responsible Grandparenting in the RPKI > Creation date: 2012-06-06 > WG ID: Individual Submission > Number of pages: 5 > > Abstract: > There are circumstances in RPKI operations where a resource holder's > parent may not be able to, or may not choose to, facilitate full and > proper registration of the holder's data. As in real life, the > holder may form a relationship to their grandparent who is willing to > aid the grandchild. This document describes simple procedures for > doing so. > > > The IETF Secretariat > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr --B_3421929259_34031755 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIQAQYJKoZIhvcNAQcCoIIP8jCCD+4CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC Dc0wggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjGCAfwwggH4AgEBMHYwYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xAhAPz2lJUZsAlD35l4oJxf0FMAkGBSsO AwIaBQCgXTAjBgkqhkiG9w0BCQQxFgQU+3EQ28UWDgFAyod/OiYONIM/Ix8wGAYJKoZIhvcN AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwNjA3MDU1NDE5WjANBgkqhkiG 9w0BAQEFAASCAQBcCCWQs0vrookgbUS0zJeQxMLOGzvSVVbTEvBze/c2l32Jhget3P6iYng+ rOWLJ9sNzZxUJnzwOtIvstuwi/y+atUN0pJfyYWzOZxlQEZ7JfsLumUPcQEQ9Qdpj7Ixj2p7 A6cgL9MIPw/IT5yF/SM8WgNTg1KP4VkONPPYFLY7JJaq11Qa2H9errkytNC9kWsdZhUVEKWD biOfBLvHNpWtIZ8v6tJXZZPHFHDLPwcNW4RJU9XmLS9VD6+WPEbCX7QIW3qwap8b65ccdbWu oCT62KoTByLuwF/7AjiJ620GgMQHpIboyhe4H6IqH6kHJ0o6oVcLYjsmXMB7g0tn1rVm --B_3421929259_34031755-- From rogaglia@cisco.com Thu Jun 7 00:53:16 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 621F621F869C for ; Thu, 7 Jun 2012 00:53:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.598 X-Spam-Level: X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 106d6VM0LqYq for ; Thu, 7 Jun 2012 00:53:15 -0700 (PDT) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by ietfa.amsl.com (Postfix) with ESMTP id D086721F869D for ; Thu, 7 Jun 2012 00:53:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=rogaglia@cisco.com; l=10665; q=dns/txt; s=iport; t=1339055595; x=1340265195; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=pqVNhnvr5pmpmndVwiAaXPtDjtDahHP5mjKSIJXxHzc=; b=bw1EE/h+NGWfEDpFvBpDwZh5aQU9y7DOjdxmAqzFvZcuXFmzK8RDInom 338Js6kT6Zv4K2zrUyWyvTnrIZRvLLPXwo8TPNVkig8I6O7ybkYY8y8BC 9YrBE54ERx7y68aGuHIQb44keode25grFNMiLGRud20hMOanMZGASRtAJ Q=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av8EAM9c0E+tJV2a/2dsb2JhbABFtB2BB4IYAQEBBAEBAQ8BWwQHEAIBCBEDAQIoBycLFAkIAgQOBRkJh2kLmHmfcgSLHYUoYAOVHY4UgWaCYA X-IronPort-AV: E=Sophos;i="4.75,728,1330905600"; d="scan'208,217";a="90085308" Received: from rcdn-core-3.cisco.com ([173.37.93.154]) by rcdn-iport-1.cisco.com with ESMTP; 07 Jun 2012 07:53:14 +0000 Received: from xhc-rcd-x02.cisco.com (xhc-rcd-x02.cisco.com [173.37.183.76]) by rcdn-core-3.cisco.com (8.14.5/8.14.5) with ESMTP id q577rEae029079 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Thu, 7 Jun 2012 07:53:14 GMT Received: from xmb-rcd-x01.cisco.com ([169.254.1.238]) by xhc-rcd-x02.cisco.com ([173.37.183.76]) with mapi id 14.02.0298.004; Thu, 7 Jun 2012 02:53:14 -0500 From: "Roque Gagliano (rogaglia)" To: Terry Manderson Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: AQHNRIKWmeMHLOI6skGjzaABNoC0Kw== Date: Thu, 7 Jun 2012 07:53:13 +0000 Message-ID: <1DCEB45E-0AC6-4E34-B4F6-DA760E9ED58D@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [144.254.17.50] x-tm-as-product-ver: SMEX-10.2.0.1135-6.800.1017-18952.004 x-tm-as-result: No--39.593400-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: multipart/alternative; boundary="_000_1DCEB45E0AC64E34B4F6DA760E9ED58Dciscocom_" MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Jun 2012 07:53:16 -0000 --_000_1DCEB45E0AC64E34B4F6DA760E9ED58Dciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Terry, On Jun 7, 2012, at 7:54 AM, Terry Manderson wrote: Hi Randy, I'm presuming that there are cases that prompt you to write this draft as BCP. Are you able to elaborate on why (using the nomenclature from your example) "A" wouldn't re-issue the rpki certificate to "C" to be "10.42.0.0/23,10.42.4.0/22,10.42.8.0/21,10.42.16.0/20,10.42.32.0/19,10.42.6= 4 .0/18,10.42.128.0/17" (ie the 10.42.0.0/16 resources minus "C's" /23) and a certificate to G of "10.42.2.0/23" since both "A" and "C" are in agreement that "G" retains that prefix? Or is this what you are trying to describe? So far the wording seems (to me) that some certificate state will eventuate that "A" issues a certificate for the 10.42.0.0/16 to "C" _AND_ creates a 10.42.2.0/23 resulting object (ROA etc) on "G's" behalf as a subordinate object of "A's" 10/8? I'm not sure that was the intent of the RPKI? Was it? I had the same reaction as you. I looked at the CP document and the Cert. P= rofile. The best reference to this use-case is the second paragraph of the = Security Section on RFC 6487: " A resource certificate PKI cannot in and of itself resolve any forms of ambiguity relating to uniqueness of assertions of rights of use in the event that two or more valid certificates encompass the same resource. If the issuance of resource certificates is aligned to the status of resource allocations and assignments, then the information conveyed in a certificate is no better than the information in the allocation and assignment databases." My understanding of Randy's proposal is that both C and G will have for a p= eriod of time the "right of use" for the 10.42.2.0/23 address space. Your p= roposal on the first paragraph is an alternative but I would say that it wi= ll be much harder to "make before break". Roque Cheers Terry On 7/06/12 12:00 AM, "Randy Bush" > wro= te: this draft is relevant to the sidr wg work and i, as author, request it be made a work item. randy From: internet-drafts@ietf.org To: randy@psg.com Subject: New Version Notification for draft-ymbk-rpki-grandparenting-00.txt Message-ID: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> Date: Wed, 06 Jun 2012 06:59:03 -0700 A new version of I-D, draft-ymbk-rpki-grandparenting-00.txt has been succes= =3D sfully submitted by Randy Bush and posted to the IETF repository. Filename: draft-ymbk-rpki-grandparenting Revision: 00 Title: Responsible Grandparenting in the RPKI Creation date: 2012-06-06 WG ID: Individual Submission Number of pages: 5 Abstract: There are circumstances in RPKI operations where a resource holder's parent may not be able to, or may not choose to, facilitate full and proper registration of the holder's data. As in real life, the holder may form a relationship to their grandparent who is willing to aid the grandchild. This document describes simple procedures for doing so. The IETF Secretariat _______________________________________________ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr _______________________________________________ sidr mailing list sidr@ietf.org https://www.ietf.org/mailman/listinfo/sidr --_000_1DCEB45E0AC64E34B4F6DA760E9ED58Dciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: <39F094F5A79B0345B9748EDFDB1F8E98@cisco.com> Content-Transfer-Encoding: quoted-printable Terry,

On Jun 7, 2012, at 7:54 AM, Terry Manderson wrote:

Hi Randy,

I'm presuming that there are cases that prompt you to write this draft as BCP. Are you able to elaborate on why (using the nomenclature from your
example)  "A" wouldn't re-issue the rpki certificate to &quo= t;C" to be
"10.42.0.0/23,10.42.4.0/22,10.42.8.0/21,10.42.16.0/20,10.42.32.0/19,10= .42.64
.0/18,10.42.128.0/17" (ie the 10.42.0.0/16 resources minus "C's&q= uot; /23) and a
certificate to G of "10.42.2.0/23" since both "A" and &= quot;C" are in agreement
that "G" retains that prefix?

Or is this what you are trying to describe?

So far the wording seems (to me) that some certificate state will eventuate=
that "A" issues a certificate for the 10.42.0.0/16 to "C&quo= t; _AND_ creates a
10.42.2.0/23 resulting object (ROA etc) on "G's" behalf as a subo= rdinate
object of "A's" 10/8?

I'm not sure that was the intent of the RPKI? Was it?

I had the same reaction as you. I looked at the CP document and the Ce= rt. Profile. The best reference to this use-case is the second paragraph of= the Security Section on RFC 6487:
"   A resource certificate PKI cannot in and of=
 itself resolve any forms
   of ambiguity relating to uniqueness of assertions of rights of use in
   the event that two or more valid certificates encompass the same
   resource.  If the issuance of resource certificates is aligned to the
   status of resource allocations and assignments, then the information
   conveyed in a certificate is no better than the information in the
   allocation and assignment databases."
My understanding of Randy's proposal is th=
at both C and G will have for a period of time the "right of use"=
 for the 10.42.2.0/23 address space. Your proposal on the first paragraph i=
s an alternative but I would say that it will be much harder to "make =
before break".
Roque



Cheers
Terry

On 7/06/12 12:00 AM, "Randy Bush" <randy@psg.com> wrote:

this draft is relevant to the sidr wg work and i,= as author, request it
be made a work item.

randy


From: internet-drafts@ietf.org
To: randy@psg.co= m
Subject: New Version Notification for draft-ymbk-= rpki-grandparenting-00.txt
Message-ID: <20120606135903.5473.73476.idtracker@ie= tfa.amsl.com>
Date: Wed, 06 Jun 2012 06:59:03 -0700

A new version of I-D, draft-ymbk-rpki-grandparent= ing-00.txt has been succes=3D
sfully submitted by Randy Bush and posted to the = IETF repository.

Filename:       &nb= sp;draft-ymbk-rpki-grandparenting
Revision:       &nb= sp;00
Title:        =    Responsible Grandparenting in the RPKI
Creation date:   2012-06-06
WG ID:        =    Individual Submission
Number of pages: 5

Abstract:
  There are circumstances in RPKI opera= tions where a resource holder&#39;s
  parent may not be able to, or may not= choose to, facilitate full and
  proper registration of the holder&= ;#39;s data.  As in real life, the
  holder may form a relationship to the= ir grandparent who is willing to
  aid the grandchild.  This docume= nt describes simple procedures for
  doing so.


The IETF Secretariat
_______________________________________________
sidr mailing list
sidr@ietf.org
https://www.ietf.org/mailman/listinfo/sidr
_______________________________________________
sidr mailing list
sidr@ietf.org
https://www.ietf.org/mailman/listinfo/sidr

--_000_1DCEB45E0AC64E34B4F6DA760E9ED58Dciscocom_-- From terry.manderson@icann.org Thu Jun 7 17:30:37 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C1DD21F867B for ; Thu, 7 Jun 2012 17:30:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2OUU68ZhfLfp for ; Thu, 7 Jun 2012 17:30:33 -0700 (PDT) Received: from EXPFE100-2.exc.icann.org (expfe100-2.exc.icann.org [64.78.22.237]) by ietfa.amsl.com (Postfix) with ESMTP id CCB4C21F861E for ; Thu, 7 Jun 2012 17:30:33 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-2.exc.icann.org ([64.78.22.237]) with mapi; Thu, 7 Jun 2012 17:30:33 -0700 From: Terry Manderson To: "Roque Gagliano (rogaglia)" Date: Thu, 7 Jun 2012 17:30:29 -0700 Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: AQHNRIKWmeMHLOI6skGjzaABNoC0K5bvkspw Message-ID: In-Reply-To: <1DCEB45E-0AC6-4E34-B4F6-DA760E9ED58D@cisco.com> Accept-Language: en-US Content-Language: en X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3421996229_34635686" MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jun 2012 00:30:37 -0000 --B_3421996229_34635686 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hey Roque, On 7/06/12 5:53 PM, "Roque Gagliano (rogaglia)" wrote: > On Jun 7, 2012, at 7:54 AM, Terry Manderson wrote: > > > I had the same reaction as you. I looked at the CP document and the Cert. > Profile. The best reference to this use-case is the second paragraph of the > Security Section on RFC 6487: > " A resource certificate PKI cannot in and of itself resolve any forms > of ambiguity relating to uniqueness of assertions of rights of use in > the event that two or more valid certificates encompass the same > resource. If the issuance of resource certificates is aligned to the > status of resource allocations and assignments, then the information > conveyed in a certificate is no better than the information in the > allocation and assignment databases." Thanks for that. But aren't we ultimately talking about _who_ issues the ROAs and what their contents are in relation to the intent of the resource user? BTW, My understanding of that paragraph was about situations where you have trust anchors that overlap. > My understanding of Randy's proposal is that both C and G will have for a > period of time the "right of use" for the 10.42.2.0/23 address space. The idealistic stance might be that the RPKI and associated drafts should not recommend a situation of ambiguity. Being able to have two different ROAs (with different ASNs) for the same prefix issued by EE certs from different res certs (thus different private keys) seems like it is making life tough for the relying party. >Your > proposal on the first paragraph is an alternative but I would say that it will > be much harder to "make before break". Is it? So step wise since G is moving ISPs from C to A (and they originate the route on G's behalf): 1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/23, AS-'C' (10.42.2.0/23 AS-"C" route VALID) 1.5) Worst case of "A" is slow between revoking/reissuing C's cert (all routes UNKNOWN, but still routable) 2) "C" gets new cert from "A" for 10.42.0.0/23,10.42.4.0/22,10.42.8.0/21,10.42.16.0/20,10.42.32.0/19,10.42.64. 0/18,10.42.128.0/17. And recreates it's own ROAs (10.42.2.0/23 AS-"A" route UNKNOWN) 3) "A" (on G's behalf) issues ROA for 10.42.2.0/23, AS-'A' (10.42.2.0/23 route VALID) I think this is a very easy for a relying party to interpret, and 'get it right' If a recommendation comes forth that says: step wise: 1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/23, AS-'C' (10.42.2.0/23 route VALID) 2) "A" on behalf of "G" issues ROA for 10.42.2.0/23, AS-'A' while ROA issued for 10.42.2.0/23, AS-'C' exists (10.42.2.0/23 originated by both AS-"C" and AS-"A" valid) 3) C removes the ROA 10.42.2.0/23, AS-'C' (10.42.2.0/23 originated by AS-"G") Keeping in mind that the example highlights that "C" is moving away from provider "A", but keeping its address space. So at the point 2 is it clear what is the intention of the IP address user "G"? Who it seems has no skin in the game as "G" doesn't have a RPKI private key nor certificate. I'm not sure (right now) that allowing multiple 'resource holders' to create valid MOAS scenarios is a good idea. I accept MOAS do naturally exist, but generally at the desire of one single resource holder or at least one would hope. Is my interpretation wrong here? Is this really just harmless? or does this also then tease out political[*] aspects where an RIR can or might 'responsibly' issue RPKI objects from their own resource cert? [*] yes, yes, the IETF is not a politically focused organisation. ;) Terry --B_3421996229_34635686 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIQAQYJKoZIhvcNAQcCoIIP8jCCD+4CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC Dc0wggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjGCAfwwggH4AgEBMHYwYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xAhAPz2lJUZsAlD35l4oJxf0FMAkGBSsO AwIaBQCgXTAjBgkqhkiG9w0BCQQxFgQU6jSuhZmnp+QBR3qkE+6pEGtHXzYwGAYJKoZIhvcN AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwNjA4MDAzMDI5WjANBgkqhkiG 9w0BAQEFAASCAQCa1+FFTcxEnXO7IqyEQom2t6H0X7jlVn5rta5hAKZ/WdIY6gQzTGlRXcNQ Vp+cZ55CwZgzOm00nTJO5uiZz9M2K+K0gTE7avPtXYxAuT8KOILS6JKe2C+qbRL1nDvozmsr TWvAQrvX/NlqmzszmNPtEYLPnGS2lxhkujR/xRVbRCOMITDBvCPKu7wEe+MXYzmUm+jVg2oe BT/GqPAPSUGmjdfZtQkF+ff9Yzp5xVYs9PpZB7QNz/ckNB4AGJ9IojfSEr1cNJMTweTozZZd elCox/HXmu/DMmFh9sXUR85vRZW6uCzueuUby7kFt4BeUl/9rLLjFVMGo/Q4187T5Mdp --B_3421996229_34635686-- From kent@bbn.com Thu Jun 7 17:44:13 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9477411E809A for ; Thu, 7 Jun 2012 17:44:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yFgw+iHXrX6O for ; Thu, 7 Jun 2012 17:44:13 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id B12E411E8083 for ; Thu, 7 Jun 2012 17:44:12 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:57755 helo=[131.171.70.115]) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1ScnId-0001nm-OA for sidr@ietf.org; Thu, 07 Jun 2012 20:43:36 -0400 Mime-Version: 1.0 Message-Id: Date: Thu, 7 Jun 2012 20:44:05 -0400 To: sidr@ietf.org From: Stephen Kent Content-Type: multipart/mixed; boundary="============_-873006246==_============" Subject: [sidr] comments on RPSL signatures X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jun 2012 00:44:13 -0000 --============_-873006246==_============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" I have a number of propose edits to improve reading, and a number of technical questions about this document. I have attached a PDF with my MS Word change-tracked edits/comments. Steve --============_-873006246==_============ Content-Id: Content-Type: application/pdf; name="draft-ietf-sidr-rpsl-sig-05.pdf" ; x-mac-type="50444620" ; x-mac-creator="4D535744" Content-Disposition: attachment; filename="draft-ietf-sidr-rpsl-sig-05.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNXUtz2zgSvutXdM1hN6nKwgTfnFue Nd7JZD2Ot/aw2QMtQTYnkqghKSf+9/OBIiiBXsugEiiYHOJHavyh0c+vu+E/6Xf6kxLm pXGy/Qt/R1nCUl9+Iek+qAT9h1Z09rrmNK3JY1mYeTyLdx9Ndl+rpxQGKQu9LCOeZCxN Up94lDE/S2KKuceCLAwI/8/5/k/nScginlGYcOaH/b+bDH82efiDn/EnfjhPw9Tz5Bfw p/8sDFjgJVFASRwxHmQJTZf06mqCHyr/YffX1ZLO3nHmEaerOT2j53T1B729AqQ9kdgA FcXMj7PALVBhwnwe4nZdkhS0KIAqdaA85nEvpiupXgcu8uP5m0s68r9LRr8WdSMW4nPx fGKuD1KZNQNp8R1U0iDzWRzEISXdKSet6A+f7XRK6mcsTAKlpIaiP181olqJxrIppT7j PkyfEh3lQbX4h21QMcuSIIbT0UEZiu5Nlc+b8Vp7eX7xlj68fn0yZe0O55iyeiz2/Gyc n5DKupqJGdVN3mzqn+ljk69meTWr6arKp58PXsYrRr/k16Ja5qvTiX57SrdEzzmLwkRF WENlf/t1XVQCIv9Q3oklxEicvyDf434ndMsy9b2AhTyOKengdzI1hH9QM/BNy+iDKGUx osaR6P/5y7/p5cV7y+5wF950DTnoo08X3jwE3yQZGd6euvdD37etE0EIjQ4zSrqTjdPo 3/J74t7WBE+mGPoduKEYyMtZ6sUqlDgCKg1ZEnHlZB0BlUQsTfm3mZBlXeM8RmUbopg8 CuxHMd1UxeqGLi8+vqd/Xf8hpk1NX4rmFl/59Zw+FjcrpA6IZLatm6OKjrKoP4dTOUAc gz/gnrKZbwiittUhBPUQoqg5DvFMpui2IcahTGUfQDxo87ZLGx6jGIxgRdpFg3CR9fjk qXq8EM3cttTSlKUxskcd4WHCx7rUEEoS+Ecdk6nU6mJWWZaazwPU0R4fIPyxUvN5gjoa NKAuNtCLRuRPta4XtsUWJCxIMsfEFvrMD+CDjxNbXdzYlhpYzyQFPTIA+EMdmx9zcHDp AJOpiXoRa77aDgh+5rEkTIcYDxvpyeqoOIK1RpFjmWmYIesD/b/lsg09x8vrugHtY/s+ e+4y1lEetIPT3ScyJJ9HW8npVPTkW/olA358su3YHOTH+yZOHHBkbaEC9ch1PoAHGmZE Q2cf4ER2uJ4m8KH6aQzS8Th8V7dFTbNyulmKVUMzlBAj0B7RE+N97quJ0zSuTqviWtSU 01I0t+WMmpLyxaL8Quu8agp8B19A12TaVOWqmOJb97ZLIhhSFvjwi9153CqJfITjNAvH uSBJHdrVgl5nNXymAQ9ZwqqthS2j5B5IZWlZOkrNRQ7tfVQ2v2/t6GebuCNUOixIPeib DsrQHS2Kz4LKjkFAm4Hu8kUxyxtB9WZ6u2c6JIW8JRUYkfQStg1J9SHVwdwyJNQoIU/H cwuWVbQ3JA2fqSG1rrOGFi7uJb2050NnooETpXw6LWYIDPmCyoqW0JVpUW6sqwKaexH8 KWYvtlJ3SxU8zIeEaZcHmAauE/pUDZ+pKizLWTFHxGyKclVTudr6g85TwAOcQxkWdRdt 615VvtyWVG2s9x5VpynuzuaUQoAQZWE2dkbhdAqh4zNVCLSlLfuuxJcu1ZdzXscIsJ3w oMty07TUuLjBwEwlU0B4qrpYFou8IkS2/DqvRf2CrjdIb0talQ3di4Zu8ztxqoimzueW 1qYxQ6h1NqJFGj5TrUWH5KNttcWEWuJhAExHeJgJGZUWHlFW9eX8ANQjaSENiug2Lcw3 zS1ifRcEqJwTPkfQLxD/i5WoYFlzmopKfqZyyBcouGybUZKCRuG9uN2yIkymJpEfu1pg RRo+Uyu6E1Uxv8f1502rA/lsVnSJAbJAPVOYbzMF5WmVYthWClV2qwO6pRUxJmMwhees Vmj4TLUix3DprFwJupaqIWiBkNsUS1k83paLmag+Pas/PVd+49yyBvhJzHgWhBR1h+k0 wNDjdROiqH3qclNNNd5r0k+iPzJ2PajbTVi6flhqAFcjE4Zu2TYN03ObEabiZSa2Hf3d ivDJhuoJM9hj4ElCE8UMBisRrkAW1j3xwSxnCFy1gXWxalc95I1GXfVA/0x4o72rxoZE FCsaWwMF/ZscvYswAEVeC8uMW4/QNsTqRzf23zmkBxP2Q5lhUBYDs1uHAxb7N7Esbd9s ICsVNCZ0wIdzv1FXe0Tut7vaIGCebL66tDwR+SHjsecsXaLjM42FbdvkRGsGmI1AiyH2 SYd6WOlsFxzcj9BHT7IhKMPwu10zgNHWm+tl0TRbLz3fLBY0LVfzUg60T8V2xg25huVc IogwbenvBOxWMskjbKx5vrPJpIbP1IDWVXlX1FuycU6vXl9QkpJsSLQfZrsQPXl6C+5B 5Hm6adrPHEUdereuHE0eP/i/IXoYA0cFl4GgRuUNIZYxsSbWVbqmIXpkjrgPcGT7+zh8 x7jwDuSk30J9Wt0ycG1J4nMaoNSyr+HVjnLh+5IzbiVu25sDTI948CG61oOjE4+i8EtZ fZYcrBoj6FIyQUq69HZ1AwYJrMKqne+aGK63Dg5lVGclAQOr6feSdsqwMUCF/LFfb31E 1A/KwJP143V8pr78Kq8/07sSVTR9enb+9urdp+foGH0oQQy0FFKJCF7RTVVu1jX4xPtt J2nW8vWg5e1H925PSZ3OLZXAZnoYdDm7qcRHutUjigrVWA6PgffQIeR17wy0Em3Srfx/ P6KFZymax2GK/f1WsCaXPcrTHiHMfs/vKGluPW07hQHSDVbT8vCbqpITW8rFSqnadKuK b3VIqkEK7j3FQJ4u1YMx9XTpUuJBDdWUgIPp0lH4uqCPug2dgdumWf98diaZfzmx+llU TO5YsLK6OZvJHZX6DHtLUkvPmO0CTq0dht2xTKx+lC4cYfU9LxPK8e4Mj4+4xMuEkS8p 35GPWpww8Gj4TAPjvju0+IjKLp/XUP5gSqYbV9Rv1lRye/l8a7x72Xw7I0ggZeTcbf61 WNq2ZtTknodlfnWSzpoN0+XNUgbIuviKVuWqudUnmr9/wtFvmA/QanHoQUqvZUHq4aNH sqBv8j3wQqg8nW1Qhxo+U2WVRJEsJK4FbdZyfHX2ArXiepFP5UdQ1PK6LheYYZzJZuW2 /thVp4hd+cr+YLjKTroTuhWSEDDBKaqQZGhZJ/T+Gj5TtUA3WmxnFZGhFKt8DZZxXRWy Q429gA06gH18sPuoklroCrtjmNy99SIkjlmYZiiMNNmaDrCq+CDHhecCWd1UWPZhfct8 ANgRx+pjpz/g7uZPGj5TC5LTHDCYdtwbJjMtWg5HIKK2HA7onBWhlv9JVviyrw4Du8EI Rc1+sp0TBHi3DzubFHbnMjGp02X4eOABjwqqKOuIhnopw7qIuz5ew2eqoT+k8xpqUH9w mq86rwNQhjG89eNorKLTKtrnr+Swv+bJv3+K7PsJ+h8RmJpOjuMS+gevc+26g/S7lWGt vgDR8bph10EGVxg4tuwcYD+c48WicV3q1+X6vipubhvZLSisZxT9JMUArSP3mmLBmPeN fkdAyS2NAFnjqCX20xUKgYbPNIjs9O7TsylmVtsn/2TnCk8ubkCwy/pSjriuMfUu96Ha JTjsR6GeRPZzgoGUOMDmaRSTOp5T2Q5eFwW37e5WsY7PVCcUP0ByD6KsahSSLxEkW/ck i55aVHdi1oYei40WHw8ge3IUVx3CrZuP5NvYoUopHXFRYcTi0c8zn9BFafhM1VF/mGE7 KScffpNMxt64lPRSO8f195rei5t8YbsY6+blgu5kbulogBd+EiwGuBqxNHym6nCxm5e7 FAus6WLeBprQXv2b7vmOlum26ZvUi1NBdwS37h1FRoJ9Uie6bKi8IzwLQoEOyrBGO9m8 jw7PVBc/Petav41MloTYtX3xPoBY1Tti0PLwpoJvoofW6VX1YJwCNc7/FBh6RiIKSk3M 59LNoyqXvl02N9DOsj3e0eebnb6aSFRnDSz2sMCysjR0t1Wt4zO1ovXmGubSPrjQr7Co HBS558VCYHEdeeddIb5IVcAn6tvWH+AIU9CZqETVydxSBy8DukQFeEeSUA9LGn7fUHMD FOZgmRf1PQpHQKV47jPl6voMQ2L/61Dob/1vPEAKT90T/o++4C//jfzvvxf5jSD+P9uZ sXrFyO9O6ZTl+PjVRgFXW3aaOgzHu0c5d3ip/V87Y7JXwFFJ8jSJ6ACmQ+uIfwFysxzA CmVuZHN0cmVhbQplbmRvYmoKNSAwIG9iagozMTg2CmVuZG9iagoyIDAgb2JqCjw8IC9U eXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA2IDAgUiAvQ29udGVudHMg NCAwIFIgL01lZGlhQm94IFswIDAgNjEyIDc5Ml0KPj4KZW5kb2JqCjYgMCBvYmoKPDwg L1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+ PiAvRm9udCA8PCAvRjEuMCA4IDAgUgo+PiA+PgplbmRvYmoKOSAwIG9iago8PCAvTGVu Z3RoIDEwIDAgUiAvTiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0 ZURlY29kZSA+PgpzdHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRRiUmA UAKGhCZ2RAVGFBEpVmRUwAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ 39nnt9fZZ+9917oAUPyCBMJ0WAGANKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU /L09mZmoSMaz9u4ugGS72yy/UCZz1v9/kSI3QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0 lSkyhjEyFqEJoqwi48SvbPan5iu7yZiXJuShGlnOGbw0noy7UN6aJeGjjAShXJgl4Gej fAdlvVRJmgDl9yjT0/icTAAwFJlfzOcmoWyJMkUUGe6J8gIACJTEObxyDov5OWieAHim Z+SKBIlJYqYR15hp5ejIZvrxs1P5YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQElWW2ZaJHt rRzt7VnW5mj5v9nfHn5T/T3IevtV8Sbsz55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0G QOXhrE/vIADyBQC03pzzHoZsXpLE4gwnC4vs7GxzAZ9rLivoN/ufgm/Kv4Y595nL7vtW O6YXP4EjSRUzZUXlpqemS0TMzAwOl89k/fcQ/+PAOWnNycMsnJ/AF/GF6FVR6JQJhIlo u4U8gViQLmQKhH/V4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMkbj96An3rWxAx Csi+vGitka9zjzJ6/uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0gS4w AixgDRyAM3AD3iAAhIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZc BFfADXALDIBHQAqGwUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQOBQDxUOJkBCS QPnQJqgYKoOqoUNQPfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7HAhHwsvg RHgVnAcXwNvhSrgWPg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgkAREha5EipAKp RZqQDqQbuY1IkXHkAwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5gqVi 1bGmWCesP3YJNhGbjS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA 68MN4SbxeLwq3hTvgg/Bc/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI /YQRwjRRgahPdCKGEHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJ OmRHchhZQF5PriSfIF8lD5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpP vUR9Sn0vR5Mzl/OX48mtk6uRa5Xrl3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOw VqFG4bTCPYVJRZqilWKIYppiiWKD4jXFUSW8koGStxJPqUDpsNIlpSEaQtOledK4tE20 Otpl2jAdRzek+9OT6cX0H+i99AllJWVb5SjlHOUa5bPKUgbCMGD4M1IZpYyTjLuMj/M0 5rnP48/bNq9pXv+8KZX5Km4qfJUilWaVAZWPqkxVb9UU1Z2qbapP1DBqJmphatlq+9Uu q43Pp893ns+dXzT/5PyH6rC6iXq4+mr1w+o96pMamhq+GhkaVRqXNMY1GZpumsma5Zrn NMe0aFoLtQRa5VrntV4wlZnuzFRmJbOLOaGtru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIu WzdBt1y3U3dCT0svWC9fr1HvoT5Rn62fpL9Hv1t/ysDQINpgi0GbwaihiqG/YZ5ho+Fj I6qRq9Eqo1qjO8Y4Y7ZxivE+41smsImdSZJJjclNU9jU3lRgus+0zwxr5mgmNKs1u8ei sNxZWaxG1qA5wzzIfKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVhttOqw+sPaxJpr XWN9x4Zq42Ozzqbd5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ732HR2 KLuEfdUR6+jhuM7xjOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6M X3hwodRV25XjWuv6zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16Il69XkVev t5L3Yu9q76c+Oj6JPo0+E752vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARGBFYH PgsyCRIFdQTDwQHBu4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcE LWJFREPEu0iPyNLIR4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYfGxV7 JHZyqffS3UuH4+ziCuPuLjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRf uXflBNeTu4f7kufGK+eN8V34ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSp lJCUoykzqdGpzWmEtPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruY jv5M9UiMJJslg1kLs2qy3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXu aw6thdauXNu5Tnddwbrh9b7rj20gbUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR 4b0tzlsObMVsFWzt3WazrWrblyJe0fViy+KK4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2 CHfc3em681iZYlle2dCu4F2t5czyovK3u1fsvlZhW3FgD2mPZI+0MqiyvUqvakfVp+qk 6oEaj5rmvep7t+2d2sfb17/fbX/TAY0DxQc+HhQcvH/I91BrrUFtxWHc4azDz+ui6rq/ Z39ff0TtSPGRz0eFR6XHwo911TvU1zeoN5Q2wo2SxrHjccdv/eD1Q3sTq+lQM6O5+AQ4 ITnx4sf4H++eDDzZeYp9qukn/Z/2ttBailqh1tzWibakNml7THvf6YDTnR3OHS0/m/98 9Iz2mZqzymdLz5HOFZybOZ93fvJCxoXxi4kXhzpXdD66tOTSna6wrt7LgZevXvG5cqnb vfv8VZerZ645XTt9nX297Yb9jdYeu56WX+x+aem172296XCz/ZbjrY6+BX3n+l37L972 un3ljv+dGwOLBvruLr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpPKp6qP6391fjX Zqm99Oyg12DPs4hnj4a4Qy//lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX0+OF vyn+tveV0auffnf7vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h +2P0x5Hp7E/4T5WfjT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iagoxMCAw IG9iagoyNjEyCmVuZG9iago3IDAgb2JqClsgL0lDQ0Jhc2VkIDkgMCBSIF0KZW5kb2Jq CjEyIDAgb2JqCjw8IC9MZW5ndGggMTMgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+ CnN0cmVhbQp4Ac1cXZPaRhZ951fcp01S5bTV39LjZJzdTcXxOoFKHrb2QQPNWAmIsSRs z/76HAkJkDyDhRKpeqgyoGHMud3nfva9ek8/03uyLAiNPTzhWUeWhaK8YOsXmaPfKKWX tzmnZU4Bi1QU8MicXs1O1/IlKRkyFUQRcRux0IaCuI6YiKwhwwMmIyUJ/+f6/Nu5VUzz iJTlTKjj52bd76YAD3zHe3w5D1UYBOUFPI7vlGQysFqSNZpxGVlabum7BSAGPDC0KPFV f1I/Lbb08p+cBcRpsaavf0gLl6Wu+IYWv9P3C2A8W6O/D2UoGBcQoIvyIrZvxwZlWGSl Gbp0r7J4XVDnZ+6W+yxJ7+mXt/PX1e++mfVf2ZInLe5VO3dx/4U1jEfytLKzav/BkF77 34FPrSWf1bryDA8GoJVaQtvEkQbXgf0pfiQRcNEC2Sj0MyAHqJSMBDPSnJa0VqmLZG2v 3N8P6qTn2jBhIukXKGWZ4AoGszI+nqwUDLOEdb7OIkIjRuaXhqMxIiLbwldr7OxLFnsZ Z26932weX1CcU/HOPdLK5cssuXP0uNtnlCX374qc4nQFBc2LLFkWyS7N6WNSvCuvPLhl MbJROmlQLWKt557wQkRMWdloUH9LORUvWvj68qLYgQxJTqvdcr91acGIbncrh3+2D7sU F3Jyn4osXhZuRetst21/nLb7fHRahJbZUGmytYSe0SJgJoBeXhVATWguxDm+vrRI0uVm DxrMk+3DJlkn2Pzv5q/odbJ0ae6oACdKO9KYkBUlKSGIKU0GKeZotx7bVtgQETkHJw7i +cUJzplW9sqgekJOtPD15QScBi0y6Du9dvfxht5muw9JXjmJ0mvAwdBDeWkFspReY7cv 6GOcZXFaPIIsYxPCSKaFNmRr4fxiRIDg0Fp/nUcLX19GtNS/pMfT5oKNvPVCc4ZcBpF3 LYVXW4+gm4WBaRyEH8GMCRWzmjcWyhNQVrMw5FcqySK+25QOByELqhIIWEaOt7jQCEds RKYN15M1NMi+eeAZ25C7RFo3bPMudDYtfH2tH0esjEJYtlvtD4EPo2sfJEc2jceUqhHR L9OoIgRxqEJ6GjubFr6+vBDgxTy5T+Nij5Bo/pgW8acqr567LWKhBNXhFk9GpoCIAmZV GFIjjQ8UEJFG1oRKcwPqOgq01q9aTWjSuLXokya1SDHzxOyrAJU0fVjFvkStqrgjLxvc kTZGWWz0AISo/0OZ/uVSlyHhuClQlrrbFy5/QT+5Iob1Xe+ybVxlnZ9TorxCamTtOqNF JZ8PynUs+hrJUcpE5eRa+zp6MfNEi0EQBWuMLHLNEy2obVgvvCM9GS9qAf0ihsAKhpHy mRiDIAomS+9b7LL4vkoKDllp44xfxbAaF2iBvzWTEaMW0C9icMkUD5v0oX+kPqHFGARR MIXNfbPf3o3s8Dg3iGlRjDCDcLqMfnE5DmSWZQ3+A/weePy0bzu/OiFta7H8om2AxggV eu3oBkEUTIO2v8abZJWgirpItk9YtXMidF9PSIxaQK+IoZFnqMjfQ7s2vr6Be+Xjjhnm beYOIXBZha+ocng7L9xD/py3IzuVn2tE9IsXoWFGDDi1m87P6UEQZZUx3cbpLk2WMBv/ v5QdMRqZBMc0vxGmJkHPuKJrzGAK7dF9z77ccjak1ajp4ukg9iPN1+g2tFoYj+P2YRDl MaE7VM2ONu1zCjx9hcKRqXxM9BsB/bJnJmQGbYk+E2MQRPSpQutP5dQz//Y0EbpXKZqM GLWAfhEDTcWhqE9e+sYX03Ui6CHwykyuZARqP/+5+x1dJ7R4fCiLgnNXlAeB9e8u1YV4 MBkrDhJ6Rgq0omtzfbp0dL7j9Hs3LY5an+Pry9oyU/rRPR56GEdGytF2FEkjqA21b//8 rcsKdFUtY9SyaZ+DyChkn1m5KpJ32eEjZU9VVQLgfDrSHjbAL9YqUQ5hNN3CPWPICW1Z C19f1prSmFXt/8jv0cKQo38qq4L2Z3O3roubkBe1iH7xQkoWyGPLg3+8aOHrywsLXvxw 8+ZmICdKjmDkYdwpklNMXIvoFy+EYtwE/nq5Fr6+vAjBi5vlH+nu48at7l3Zs93pJ+iW i8cmQRAwpYUkXcvjAwlkoDHghsmSBtR1idFnFnay4aEOXk/KDlxjMjEQ1y3ihJ63ha+v JkXQpDeH/oEPDqcua5e5dImArLv7z7+f0MLWIvqgXMf+Ah1gqEzWBrbvsk9IiyHwbvbo XM/yr+hmtcLYU34VHw5M4ZN19dUb4BUpFEajMQbZ1Cj9sGDof8M5kGeThgqT30rWZ+3t getZZ+D6quHCTtl7dhj+vjgPfFRpZQM0bDUnqW1QtNjOzqfA/wooCipYPUEZjuomRuSr PiZfQGlRVtbqOVFfQGEjrW0OCHwBJRVD9ODZ9gn0aUju2faheQR3gKhtpy/bF4QMN4Xw a/tkhJtlyGakwJOVkmi15pj18cpOyRBNoLwJ3n1ZKYuGLBn5pX24qQd8X9MV6ctK6fKe L8oz7VNo3z/eI8GXlZIGvg/3NPEpSpACJ/bcs9AFbo+FyrPQBRVc+D7r2fahuBUJz0IX gR6VQHsWuogQrUchb7bvmSp8N6/5MckLt3F/JPQP+nd85zDNkY59dIdBFNzfRVIbcd+j O5Qvrsp7BtxJqLwRmNUoXA9D+P2nhwSVC9S2PrgtlpQ4f1HdAKmEfvbz37dlb7H439j1 4aajqpHGq2qFwC3VJK/PFNuOrMvVq7Z9QA7O4el5aLHtz2O6lIL/CbijwKwKZW5kc3Ry ZWFtCmVuZG9iagoxMyAwIG9iagoyMDc2CmVuZG9iagoxMSAwIG9iago8PCAvVHlwZSAv UGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMTQgMCBSIC9Db250ZW50cyAxMiAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE0IDAgb2JqCjw8IC9Q cm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4g L0ZvbnQgPDwgL0YxLjAgOCAwIFIKPj4gPj4KZW5kb2JqCjE2IDAgb2JqCjw8IC9MZW5n dGggMTcgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdWdbZPbNpLH 3+tTYL2b3XEyVvhMcS+5O+ep4kucZGNvbV3FeSHPaGxlNdJE0sTr+/T3azwQoKSRKY2p cO2qEQmAYANoNP5odDd/VX9Tv6pyGI2K0vzwm1flcJRIQmkvlhP1DzVXH3++itXFSkXD KquiuCr81cCnrS5Ulo6GWVRVKi6r4agcJSrOq2FSlYUq4miYVlmqqPMqfHtcZsM8rlRW xsMkq8sNNt+tIv7zjl95eTzKRlEkCfyv77J0mEZlnqqyyIdxWpXq4lp99hwSozgq1HOh Tz9if55fq4+/ioeRitXzK3X2ZL6eLOeT9UP1/Bf15XNoDPro/VE5SoZxQgM2qdxL26Ou iSqGVZkWx3bdF8vx1Vpt/Hs2ubhdTuev1I8/PPt2I8/cPh2/VUkUJw8H7Xtc+KfBk3pE 9/JFWiXDIi18jw80X+znBtVxj3tmzYthUlSpZda9bHA6orJymMQZs17PoJ4QhXRJETGH Tet4qBRTe7m4vL1YTxfzjsc1TpCIaZGoskltT7owqYZZmfaM2eiyIkqqw8YVEdLxUOas ggVklQ36WHBkORm8azn5/uUvk4v1Sq3Wi+XkUk3nSK7V4nZ5MVGX4/X45Xg1WZ2r2fSf E7V+PVE/PvnhS/XFZ+dqjIB7NZlPluPZ7O3JJKNtYr8kYxwP86w8cBk/IV806GvLFzfL xRrGgCVevlXjuRrfMvzz9fRiLNJJXU8uXo/n09X1X8l8u5hP1MVyQhbr6GLZNTtkI2BA hOyyLesXO0Qs42XpZFdLVHdCdmjQ15YdrheX06u3MrzwwkLLDJEVIhKcmFCvxyu1XvDz 20TBPjeTpeaaxXL6f5ppumaLUTksR1muYA09Ar1iC6DTcBQVvV09mvS1ZQuG+3KhVgvW g/mlcMNycsU64ljh1YK05eL21esdIgQWuZhc3i4nXfOFw9Wuif3ii1E2LPO4t6tH0aCv LV+8OGN0f5teTtRY3YxXqzeL5eW5upgs19MrWUIm52piYdGgzQb2iO1UkpRIgTxXrgVt hr3rDWySJsM8YXFwRB0GJq/H05laTV91jCgTdBxpFqMNaQx+Ww3FfLxmVjPC64vhi4dK fb14M/ltsjwPqB7UWp07NBZHDHiKyqJKk1FNdZsB7xqc1/tnWHE4GsW9hQVN+trOc4S9 RQMs/cvxfHU1Wco24uVk/WYy2b2XYJXoWuInyNSYvnaN6hcnFCg046i/SKBBX1tO2Ngf TFdqvlirV7djuGI9mVyi3nj+mtTrCVyi3rCXADm8mc8W40uDKrvmiTIdJkmVqMI2r188 wSa+yvP+ooAGfW15wu4TvGphLRzg9gvnSm8b2U+wc1wt5uOXs7dqNb6a8HMxG0+vwY7j ddds4TYNhW1hv9giqzj74KjgoBOC0+0liwZ9bdlCNo1uC7nyioVz9fJ23VyPB/bo5/2B hLgaDfMiAyRY0u14t9ymy3oHw06vbxZL0Y3YZlhGRuINu+bXIgVA5kCzJv390NsWWYQ+ Pjfs2pYdTsmuR5D3eCbb28Uchejq9kJvZD3zuiUMVrhaLkRieX3IuZquAUIXi+vJqmuu qLe4ZgD6JcRS2U2gl+mrEGvQ15Zrx+zDrm9mE/XiTMTWaj2dsTVbLzm9YfNzyb5nPfnX Wl1NKfJmun4NHEJhtp68Wk7XnevLs2wYy9ltYZvWL35IkmEyqrLe8kODvrb8YPXl6MZB uk9FB2YWCdDv7O25FgwbEFk0ZifjiHrZsI3rF0fE6TCLR/3dETXoa8sR9d4HjLNaLQLt h7dpuQPYHGFVEqecTooxSdEgtq3O5mKKUu7SSCoWsZVDaMD1hd7JjWdvxm9XajJfId5O gszLEdg3rtvTL46NsAbKRv1d0xr0teVYQS9yxrd+qwfYnu8KX5Bzrdi7iQiT8xxJWqjr sT0Vhr9FtbuYdw50ah2fbeDxXKG3FrvMybYm37AaRRjnJHTjKMeyLLjAoCdJS+BNmWOX hhQrsOBKs2EUpYli75aj2S+kwja2ZEfoPGv1Yl7lw6xKU9sfLbczp4Pejr7DtgaCsKbw GkfQDlmri8V8PZ7OSbXnjyJYBy0N4Y7oYj2+ZRUzvsd0sdkrrDqW/rXG3hFpwdXebeGw c6KKYVylWd1zbYhqKgDeafvZmKyfP2OKVlE+GmGhiR1nUmXA4ODq2edbdpmPvGGmszPl 0KOKzVSKEyzMchVHacHPtWrez9QzbXzpqxBLz3fWKFVJjaY+uasq6K6qkbpHjVJHJnVo KnWtI6yoKiDBUbVm2GCFLW/cH1cjEMW3PNN392u5r8O13KY0W96JgawXvaNiWKBaPp67 3x8K9ERhG13mSWGJ6t960KCPKdrKWO2xusEqCYQynqlbMKqo42pzteB0eaV++vGrz1Hz lT8LagGq3EsBsy1TgNVOuuy36U2xK+fEQeW72rtl6z3YsPWesP4t3h4ipsMFbmBs4ffI w/20F9ixliXi29J+PNZ6fwyeumMcR9RhDK5x7LrrvVgWlSx82HRsELl3Nb7PwtdmoFNY Mc1LcAwn0WXMsmBwKmSa9SvOcoNUjcMCvMGil4xy80Se5pTL84w9ZlFDW2G3NtC2sUwL te82h/eiDD4sMPs/bKRPCG0b9LUVZStxO7AqZVSICzSE9amCaIa8ZhlVojsyc2ftHJV0 rkN0GqPcNq8Ps9/zBP46o8Qel7bt8hOyxDHkjW9uZsbCcrcoeH9CNMZuFkukQuXH0Hk5 fTVdswBjh2QsfdQC6x69QbMHI7JFY5VeoQl9fK+F991SIkWIZXFWuaYcz6Xt9QGOqlo8 cnRcstUI5OMIt7IoQ2VwCvmYs3nIi97qovIGfW0nK6ZuZp+PgdGVOXkThmPbvykM1dO/ P3sOMEQHtUJDRZfPJr+hdu+a86x+0jXveM57fxPby8csEadJ5xjVP/jfoK8tT+yC+ufY Ek05ll29XrxZqdfT648xQkbhjjzqmAGARsMRMCq3bbEM0LKvJ2o2QY5Or9G7q9eL2SVU L64s1O/KJrZ2Mdyg+Qhg2gXTpukwSk9tGLe9uYMdW23uEPva8Sq3dB/GAGxFDtnYHYGg y0RO1UBJjsA+aCjYSyZlhJZ8g6iW0wYXSe39rOa31y+ZMk4kBF15uG3xPhYY7N0jo95k L5VuNMbKs3du71eiwv71doLxwGEOnzR7cKB3MTZDeMfgOt3s97ai15tvWr8vhd+fSFzR y6OKWa4caG3KrjtRlSCjRhO2B6GpZBH7vEg0KegNUXPis88RXIVBp9694k+fSZVXSg8J BzK+IDuZKC5KUQRjFCEl79rnuqr9RlcDuZSF9BRADrPluIgOBHIWHQUToIvjZT9tm0T2 ZOWIc8I3cDDXUxOjvEFf2zm3BXTRY7LTwg+PWTde66nntlraHxdpcjW+WIvzHV7k+tys YwyUOvNZ18J+oeAIBRZ6K80VbXv9hFqCY8gTebuFHF+crdASIQkkt14i3dooRvfozDFS tWemi1XnHhjOIDE3bTyeLe5cQLYA0f5j+lSchkUTn3GMm6YcCzaO6RNc5VuK+K2Vy+kD WoR8yYhdQ4iP4jCoeDqWdPQdNmXsGTcY4ckaXLBahOCgVhPpc5gLrSt6w4aHWAIScKVr AeV8xV3LDuv505ze155rjsg2QD10p+tixa9F+yFEORDYjErUbg53cHrP4YWcOOe4/OjT +8b9UWfYI5RZpkY5Z3d3KPruVVsiZIb1yUuOqTGJ2IsGLW7eH1kjOFv3IRRSn7k7ssX+ edNif+9b3O1pfTYi9pcoa3sKFZv0tQUtnIP/crvCDB3dpw7aMV6vl1MM0ycrCwuuRToT ugGEsFTijk1Ul7GyuvyuhbA7S3KNOx4OdKB2yggCx6nmYUveCZfkY8irF10TlgXgd7sS N0vBhzfL6W+idPznhMAuGCaHpr+iPTfRf7pmCas9t53fM4ZAGBX9Ne7NypC+tiIiMI9R FxLE5QpfbefApk+jxe6XLeT48hK9NDF+2G4Kv4jCZz6Zdc0QztrEta5fLFHE2CCgdOrr qtGgry1L1KM+nuGCe/kW0YDl/3wtXHC9YDlxJ29OEyEnut+b4D/u2a7ZwikYMtvCfrFF nogZwoGh/k64djToa8sWjD4+bAgCo+HVXo92IyQy4aWcV63EK4CCRIVCjAjP1DwioYA6 5wob6iOzDewXV3AMW5b9tb3MGvS15Qrj4cjgT+eXk5sJf8SzzSgkp/juT5w5efMA4A7A doQSJcF1bYQ1vnL092vQ2RihgXYrRD/04llScKKKrquvy1aDvrac+Px0J6cbHfi7jmp9 BLNBVMuT04vxjZhtad8tgf56D6geiPHMg3Pzq777Xl//+OXf/v7kxy+/kPRnXz/+9tsH 510LdLcdsAzRr6kdS9jpore29ETqCuhrO4vMyLohf/b193//1g64XLn0H7/8/PunT7/8 7gvDDU8f/y9McYIFPsfml9DEyrWtXwwRjYbE1nWyvuUEPCHsa9DXmiG+/+H5k++/e/zt AwF2JlTP4uJWzo706aKBfuKxvmSfIPgPK6vLyeoCRZMGg53LCBvBKbPN6xVPpBWeHtjX 93WpbdLXlifEjSaJ4+pnB+6aiv07wN3W0dy7T8iYTsN0FHEq1+zH33XFrc0pU3zrYqK3 2sHtCVEj4qrEtdFDT4gSo7MUL8SDEGeCXuFZbU7+7C2Wv/+SVUY9m1xjyTu96NqvPEGk JES7VKmlv1+yRfTnRR0xpScjnXMSFGe9XQTTBn1tBd4/XndsSCVHkUWBeVqTvrZxOgib KLp9G4hbn6Ab1YwJMTOd3xCMSNwiRXPrTwF0rGWs46ddT6T6KNs1r18TKcuHxcGf5jgd cEsb9LXlWRN4dbG81igMmEZsqglmpRKyTDS4nATOX+lzwBdnj599/uSJ9ShD6LKVVvgd LRfji67N5Wvbc9fIfnEGzjwE7e9tUKq0QV9bzsD3mShl09kYeWAOcyRSIea6Wnf7xTdP nhK+7IuF+Nqob9AJPBGlHhG6yX9KqOkXD7uG9O5g2DWvXzxBBPESA/rDsMwJpUWDvrY8 IZAex/j4Z2MQoE/4+MiLSApZTsw6YtaUjkcfx/hhNgIrprYhbUa/8wjtLva5I+qw0e/c tzwB9Ucce9Sd1mZP0nmnWVeoZp+15ciXXTvCJJh8FuJz0qRvsBdId91naUS8ljxJN4lq qU0SbIeYvphhzMsHmLr9GGDqDucP6cDdtoDvT2Xgd+cxXhpZf09hOYAJ6Gs7K+Qo/ppj NVxa5+rZ0+c/qNec0fMZBT63IpFlV5PJ9YpjNBs6m5h8AL/L8c1aybr+l86Bfs0StnVt hPfpWCKqUIkTu+QgNcQJl+4Gfe1Zwng2qys+tUX0iFXnWjn2I3FFBBC8MsP+3Cs4TzjI eIJxKtxmBTwZUXxigLB/9ZFrP3oqGaXoL2M3HXpCFF/UTWNriNt2CnwzxfJkNvnnVP1Z fT3GAxT9INNWffmvmykTQn2Hf4F2DI3jc/3RVskM/v30w/jVRKU/dwxt681uYhrZK+GY 8N3hJM+djvZ35YYYLV08Inrm/Yl6p5fBT3xBOVY/cxhxab4V/f49DpKMrQzW8hGBVcSi P0nx/JN7goQeadFPDUH8wSylDSYaobHmDz56vSdK6SDnBIOaJBYj3rAVTvbXXG6mzUhD f5+P8J515fKKEao47MwrzhsIA0VdLoUwe0kcMYXJ3ExrkTIInyNmOSe+KW4P/kkiK/Dx C08T0e3LKpFQq45ym6Jr2kjbLrUjhY9tM1R8vZMoV66uGWm4aaUcP7s0UhjHStynDU3B vaVbaqrLmLTBVsp2GfrOl3L9KRS4ulyve5rcyHjKXUrYGpe2VQqqXItdmQv1Gs/pRL1R P5npsenKtj+mJYxVCFdK7El/PeNatN1s8HVeGvON1DgioGbGoZW9y7G799cDn+qvXD4b JpjDpLNu6Ir9G9IElKLpkKsLahKamqk+jbC9GR8B0fkzrtGuCVH6XuYwV/YNcjcguHYE nTaH611XLp+5D52mhGute8NA94R5t/SXo0Oufaq/koGRGKMAnc0wfk3veM8vLPUSs+06 YKE9bEUpw+rMaisYdrHHdtrdKb4mmd5uUrraW4kYnjPiZJA72kNR4dJcKVWX2k7xz1GX 6ZpwdtVJJoqdtCqOJJhzJh+t4HOdMMKQMH7Eq4hZqCpWzY3YC7KmxMpGiYiqhAPsqtIH 3uzk3a2vl2ChicQq0BsTxZskFJ75MdEfgY/U9/xK/aTOnq0fMvSJOkNDwhTk4sZdcE5l UuqsuUvBp1KX/WY7i/p+Vs//R+lwyTLJawp1RD5/u0WwRTCe4EzO1yToldJBKwGYhuyz P3hlxHt9Q9gxwHndxMK1+WObUJqEwZlLiF2JxF24Z+ucyOX81VaymTM4c888fhp2oHiq yfzJsEjVC4MOuRSnObGXRtguEZE/L1geg1AXOianHvO9cUV895dYcNYfy5ABgzeQiARt 5L/5MXxD0PGabz4nwiXMck3D0voHbiANLonVGXyQKWlVoc5+eqhydUabSQcXc00/lDq3 ySsEzxhFCD/DKu4uZ2uYskkkruQmqUwk+f54g1jDLWwra2L/8OChgso/agL+pP9+oEk1 KX/WpP7l4eARFL840/kcTAi1YYEPdSUfhUmm3rBGU+jPDwdtGubHAFUHB92Bhxhx3e8Y hbBhH0DMI8jEU/cRPc/LDc1B2iNbhEbWJWjjQIqEaR+ZKhql2fxLtTYNfpeH4GXS7Bv1 z6CZZssx3PS5eQU9FJAk84QqTFZK7XVfEVjHRArdwQRElxlFMguafXXX0A+Qb2dZU1A4 htpgLy2R0Xdv1KzVpBWjMLjrHVaG5sIzsE6qmZ3WcY3YGOkm8heJwSRgcIrB2Uinw31M AjqgbvlW1HDfDwGXCEn1xp8b+drzu9n/xVmS8C6oggY6/oW8mbuP/vTiIb0fD+z9n0wy xBku4q+MLz/mOSlbJ6G8rkv5ygdUagqbNFPKThM4B474C1XycvMW/6Qlq+6QPazgO4QV c1QbTYnoEmS02SFGeIXT5pEMWMCQUExbLJM2+Bv6INnkf2QmjZ0NJqeS1jCUrkJYwPSK 1G6KmPpsOeSesL6bgKZ44/WNqfwfpgpLmSltp9cnpiZd78BN0cbD5tlP7ZCbBpsqyKn7 uRXjiTsH336wK7T0M0B7s5+35e4nRsrSAwz4OYSbTqG/Png4oBtMhkk/N1KUvqDDP4FO fgzDmUqgmeeGJsncuCcGFDUp5mlEmRmE+nWWc5maJqlN6/n4CgJHcFqj8TtkAd8goF6R NxvA5C55w94NP+UWNddMK/Lk+S8eVN1VM+tjATZ8N82+ZnrO1Rz4xfdJ1SGBVUJVR6wj BBwVaoD9meKzvRLBgGAIJV1l77ZUHZubIaSLD9k3SEFe6LdYjfCZGPHlObalm0nsJAmI nRENRgfEznCqkN1lSsxzwne7JwckbT8pm+WjNsrYkOrwCXEi4Q4k4EN4P5M2S2fWreYe DQj3ujz5uvygvjebQ+FvvQPxuy2aVoz0fnw7LdyB2XKBSgdFVZWJnqNW6ABn0SyxVd1K ujNhgJpo66Ek5RCWSGqhgofAF1nBJ7u9iieuhiUbJFLMznGQu5RwN+nSXCl2ZxvP+RSv FPF1hSoe96TfQjuqghRLu1fWDDi6Ne3ZLrWd4p8jLJ3pGr8Lpbdsp7vNOIXsAMpqarRT LsU3Z7sUNe15zul4NmFcG+UOB78yi6xSRT4pEqpesGbUyh0x4/HKHSRDrdzh2ip3JNWW DvKJ4azrFBVRlojuS0o59VFGEC/zbrlyyp1mapBvVSmSHyp35N6oZdwb5G4Qy7ud8kau bZnGlcsX6p1yx7XWK3ekl5xiCU+A4Nqn+qsjlDsEKGSvKUPheWyLn+CLDX7azxfbPHZ3 iq8pnI6O63aIllBqbIgW6tqWEq6FfnrQHNvqmf3WgIeYyMWkJAZvraXRh9FVEW+6INQy sp1KIsXVFI9ze7LolR6yN9HqjlAZcYCWZiD7b6O3cSqF96OlsQR3qKVp+YawY1wTO9bS WHVNOy0NHDNKsVqvtTQsuADmKr2XlgbX5GIkeudr9dlzraUBQ2xC8G09zRcTjaRnegtq rtHMgKTN9aXeHezSxqDg2w0y+Twd/hcZ6sotkiIsGTdJgpkHH3+FRZmFyPJRncMQp+s2 DtcGJzpcAzFo9OQO1xLkw30O1/h2k65PYujH5uZAwAkgwxdCvpRSMDARWlGw3VYa+I1D hSwSdIXWsIz49IqkIcMqRIx7Fsy569mjQWcu4WJoGF6igjkbtwjsQiNS12xgsy9MbvAs dN2JNxG7RYyHbHio6NLCRcGmBXgTqkbm63ruAJG4vmUqp9PB0uHSPOK0KWFNO56L5ACR D8sKDa5+7O5SvpdAij3qzADdRT6KqcueVrgUTcNm2naprRSOI+sltK4rwJx1ml/FHVVB iqFd1+UOA117tkoFeMCVCTGn661wVXU970GnG7GaduxYzLgG7XFpwTGiK7XrufuAzkxP JAvsuA5Bp+QZGJkRks+DToQDo2ZzisSCTkmt0+r8nJ2H1CmgU5BzE3TyqU/y5BRRrhzo bKYG+RbsSX4IOuXeAEr3BgM65d0OVMq1LdO4cvlCvQOdrrUedEpPGFApVw50NlPD/INP FEXBL+7vIeh0E3IfQ7HdsuyzizG20+5O8TWFqNPVvkPABNPdsbkTANS1S1DYNobtce3e gp18bBC7BxQGG7AzH90TdrI8lKU9Zxj8G6BOQ2+HoLPdC3qOOYVdSiIPv1/IGRGRDH1Z jxDnJkVtACeuitfienIU6Byc0KJLTjcFPjnQmfIVvfuAzhTDQK2Y5CgxNjcHgk6+hFhG JZZc8kWHVDr7Wm2nzRQezSxsYE5gsliRsJTg44LjDSuTexRst+vRozFnCg6WdhG0TTcy vGXFFdMB32p0Kr4wuUHhPZhTwhKzuKYh5qzTgiXBpXmkKBHARwQ18IsE1QwLHfFxR5pb OIgcbkqFNe14DgedDLcxutk/SQzPNMG93GNONNPAxirAnDaFFdzjSZfWIqWBOd1zIeZ0 aTV2lNibmiqfYmkPMWfm2rNVymPOukyAOeveCpbUuudrzOlGJ8TLdlwDzOlKeczpUnY+ dx/MmTMfnaJTrkPMKfcWLbJr8pgT2eAxJd97t2VI9VcOkxboHhzmLHKOOhqKzoK9ocGU cuUwZzM1yLe4T/JDzCn3Bk+6NxjMKe92mFKubZnGlcuXNjnMKXtEaa3HnNITBlPKlcOc zdQw/1DMKYGC8TnIGArPdm6S7mOowV7GqBHmnlKujK8pnJBO6OwQMMF03xQw1LVDULg0 LybuTvGb4UHdN2E/uP7axqpE1uLLrhni1hqyAZtHGSrS+xmyiaKprM0d/g0M2RzB3aHV tm/4HeCqNX5rpSLFk45Yt2K1i3peG7IxF/ku0b3s2LAc48MXoQ0VZpZb6siTaki3SWoD WMco8A85kQ/0o2hIT+J8UGAyHkJVsZy6D1R1n08gWD+ozdxtYdVWzgcZIBpdp4j1ANHY tFCkunJeNApc5nNfAfbSn7eTqHyB4HVpwXPyETxKbaWAcXxaMsI0A615iNk4hazY5VPK 6Qnl01cjTt887TZF1+X0hHeW2n4O2t1yozJXV4jZXF1+EXRUBSmW9hB72fZ4B4TMtXD/ c67/wqXF9bzHbG50PO0uJWyPS9sqFaA4V+a9OCAUZVRDN7kOoZvcGzBWSDz92gGBucIg 2JwqttBNUuu0Or/C98ZBt0rcQBrQrRKffK0ulCsH3ZqpQb6FT5IfQje5N7DMvcFAN3m3 g2Zybcs0rly+UO+gm2uth27SEwaayZWDbs3UMP9g6MahfZTzufYQuu3hK2aA9UCopcMW x0DmdtrdKYO6phC6OV5rJWdq2UBdVoKE8sKleQlyd4p/bpC5vgnnl0/b8EEQiUAMTDmr 9D4IES4l1T2hW8EMyDk1/3fxQcAPQxPcIXRr+Yb3Dd0sLtMm99qhoXY9wBQ5tBMYnP1w t+uBmLPgdyz66D2uB+piJab7g8g5q9xxguxcYGR+ETnDsYlYN7cAbEe4HhjDz/u4HmyT is9EC9eD/xTLYExdsUzFBhZbSyzBMW7lGptU0rFh5W/izGE5mMeGFyNVjGJJN+VNGaxa SWk+5cv8V507sO9inHmXqQFDfurEZJi/NSVtjGCl2dpbKcPUOuWrRnaCiAkwYGbHYb/6 +KvathT/ohICeClNELtnWi6G0WLCnAyEHnEeoUmSJ4xqDHkpIXbS3NjytoT4ZEhJzIYp ok2uufsEs2yKYiUsVT+gI6SMee2H4tVApn39hybVFjXVaFqMVTsFo4eYGGird25slnnI kudqsr/7XmPqsi+j4GH9jdVxUkeG0qbtqH3e0d9n59Ipbu+waYTnDToywiKht8l0nHt5 SzCq224n23bd0o/0Mcb90uVuIMzw1Lbo4tgh2dJxZkD4Kx4l9KwfJNL0IPFry5u6/5uC 2UAMqqX8Y7kzzERB+15bPv3QDCSG7rzNXNsSbrD+GLq72DxHni+jqfXDxYv8IAdjd7dh TD1XtIwMpJr4Xu4YOuxiwqnyqbyOxj4QGmx/cGtYrJkmdv70R52oZ4ApqEeDxz7d9Zy0 nZpl4vG4nV0REkEGSgYlHYilOTfm6c9IQiS5OmVWGskldH5qq3mg51xNqa1NvCVIiyyN 1Bf0Ifz8rqWBMO0VNizWPu4O145t1tx07XDuT7SVVhFk3vKikKaZ+AMo40b6ngLCrP7H PGT57APnbGXL4OPFc7i2WEbhMZrOX8eXrh/rV1nvDPNCU1bkE48gKqjFkmLr151O3iPp ZnKtB4mt3dZlamHIgs69k0HFhxXDNNwGG527z3tOuwY5gfK3/wfXGJGnCmVuZHN0cmVh bQplbmRvYmoKMTcgMCBvYmoKODE2MQplbmRvYmoKMTUgMCBvYmoKPDwgL1R5cGUgL1Bh Z2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDE4IDAgUiAvQ29udGVudHMgMTYgMCBS IC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagoxOCAwIG9iago8PCAvUHJv Y1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9G b250IDw8IC9GNi4xIDI2IDAgUgovRjIuMCAxOSAwIFIgL0YzLjEgMjEgMCBSIC9GMS4w IDggMCBSIC9GNC4wIDIyIDAgUiAvRjUuMSAyNCAwIFIgPj4gPj4KZW5kb2JqCjI4IDAg b2JqCjw8IC9MZW5ndGggMjkgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVh bQp4AdWdaXsbN5KAv/NXYJXYIycW3feRTJ7drCeHJ5OZJHZ2P9j5QEu0zRmJUkQqjvfX 71u4Gk3q6G6pFU7iR+xGA+hCoVCoC9W/qh/Vr6qcRlVRmh9+87qcVokUlPbifK7+Vy3V k6erWB2uVDStszqK66K5mjRlq0OVpdU0i+paxWU9rcoqUXFeT5O6LFQRR9O0zlJFn2/C t8dlNs3jWmVlPE0yX2+y+W4V8T/v+JWXx1VWRZEU8L+/y9JpGpV5qsoin8ZpXarDE/Xf LwAxiqNCvRD4dBP78+JEPfk6nkYqVi/eqP1ny/X8fDlfP1Iv/qm+egGMAY7uDsoqmcYJ A9iE8lrYDsYGqpjWZVoMRd1fzmdv1mrjv+fzw4vzxfKt+umH53/beGZuv599UEn0aNId 30I9LYrU83ktVaQgvE6TyuN7oqkCuulEFXEyMurTOpkWadGPHtTIQDVLKS+mSVGndild S6T3B1RWTpM4gyfp9b0jQMH7UhhgP6YDM5gq9c18OT+fHasv1+vzxeuL9Xz1WH0/X8/U s+Wb0/OT2Xpxuhx5mSTgNKoSmL8dh10mO4LcpJ5mZbpjZJhE0yJK6n4zDusbefHm7N4F YJUt+CzDm9y0Db54N1dHi7eLNfS4WrxdztYXMN3ZanV6uJit50fq/WL9Ts2Whq2fvv7n /HCtFiu1WK/mx2/UTC3n70em1bQqp2WV5X6Eu0WrcTzNs7Kn9HGPZNGCrytZzBxrUsvZ CVSw52ljDwb2bK0OT5erxWq9Uqdv1MlseTRbn55/gE6O1OmZ8K/Z8ehU4TZ6O8DdooqI bb4sHQfrKH3cI1W04OtKFW8W8+OjFQQA11gh2OtbNYNhrNbnF4fCOo7UYglXWM1/vZgv D+dCHkJBmjJ+mx1fzEcnC8cs7AiHk4XWly5TlLaUlWldRQh2CXiscnSm4AJhNamjaQmL UEUNq6jqTCXZNImqStXTKM/jspAOu2hJA+RhL9oh1U2rqKgtPnaOIh18ZnvtSpFns8U5 0tNqfjY719vVa5gQtyeLw9Pj06Xa+3xPk95MvX+3WM/VyNSnpzpjZt1o+mF7dTY7nI8s LqRxPo0i9isHYj95hsX/9PT4GClg8dv8+MPYwLqtfwPYAWJqt9X89DmUV0d5VWGcwISR 1FkcV8HV86dbJomDxibhTCxVNq3jNJXZj/O0mOYqj7JpVmOk2C45Vs+17aHpRgwdN/aa m15Nh3KT5dW0rutK3aJD6QMwq7DXkr4HdVlgmGmPfKNkYK8WnwJjUcjN7Ube9OFG7kqa kY9iG2p4M/RSshH0W4r3Jy0ULfi68uZ1KCSczP41VxdnikKl5QCFqqvvUCBC8VJ50XM6 MrNOy3SaJHWi3PCGiwp3Zy9saKLMp1UV76wEWbTg60oTom7uiUC4p9ix1yIeri4OUTBR KE7OTpfzJdqlbCqTjibZASJRkpbTtKxj5YbQc5NWs+P3sw8rkTOwdx7P1ZfPnz57ZnfC SRc78gCg0wzmXiJZbgA9YCccg1gLdr442lnbSNGCryuxHr5DqDzETQCfmq2RKs9/mzPt /FuqxRGkukADOv884GkYRnim6UFUIshjbB7mBSQ7wt3iYdim6jzf3X2tBV9XspAtDPPH GgLQ5g80CzjY0fxsLtaPpSYHrRqr9YezOQLz994+YjTmsWnC72t2eLtFExlab4Xbrpe3 7h5lnRZ8XWni5GK1VrOzs/nsXM1/h2kcf4AUDueP0Tvn53N4hjOLOavJ9z8/f+FawFxO TlfrsenCuZ4KO8Qdo4sIL0/eT/2/T7IYAJ5QwHRkFdk7mIsshLAlF0w2fN+9XBIbwsrE +OGvdcI2Qmwa4yXDdG+csC2g1IuTSeiQvw1QKtJgdQQqSaaJmOEMUFdYwrZw1s+RE2Jt IsEUN7uunSOnGASf3mT60NoACBtaGwSidhFYozGCv+yjgV+hUfw+6zOMLWPszYhOKsJA shxZujWMySZ5tuJFepHnAKCaNROn0yyunCy9I0Bhvsqzyi7krjE298ieW/B13bXFGf8/ 8/MV/iq1vDh5jaRv6dK7u9SrfSPL7f229+qRdn0g5JsivYW/vjePRmHHuFPbdl7nGAy9 q/4KZgqvby8mKGN84iCuLSkjYsGGAbmar9X6VO3Fe2Pv4XFKaIFEsG0AuhtrP6+KKZxy txhSzuSWeVLsqhrRhq8rQ0pgMD/N36AxiO8U4tO65vxcLA2H+LfQO8/P5ysMZUcSamcr nJ0vfpOH/5p/GFuFcKqlG95u8aKimhYENvamiXvlRYOAvFjhWWe6ZV+CKNiCbCiO354O g+1pMTIZJDD9QjNWOxhLBh25v5hOf/7pb3qvxULSkvYm1oV2hZEyFFp1jPLN0l4KjGlZ ZipvAzuAuXbzIZrQ6esiAiReOk5zfGPI/CUuRhUT8BZlUWxCArBQ30dIQE60NjGA/SZP b9z9dKEB0nCzdRsYW7rajUFte+erD8vDPYWHae/den32an/16tHe2BK8ntWc4HeL134w i4m5tRJcvP4VK2EAUuO6muZFVm0A2FoIW2pvH5g2VmcXU0ESibZTXI60rSD+TejOThdi hIUx4ow5mx/KNgkQq9OL8/EDKbJsSmwAfKVFogOweSVbCfE5ufvQBOLkcZ7HiHb8nKjW 7RDXfI21x/Sne9M3gqBb9BVXqYXN9iYQD+kvjlIJRvCDbd8P7FFiD6RHiUSIdJiHJojb 9OYG3PTXjHjcIIQ8J/IlL/qr+PcqPQ0C8jCQoCU8UaKZv3vG6jo7XS3EKqX1eheYoE0A LSV/ZHHKBzi7KdgtqTpL5OCYO37RUca7bzFhEJCvJS5VGWnhsydPptOplhmkTMSGl6tf XKnIqxDJl8sPaomxiLuxacJLrXZkXWhi7HNjPmImH4Tu1exNW9i/exHHH6/agLC1K29Z o/rIOAPkLm/azdN0GqUDwiTulcUOAtLHSqywmC6Wh8cX2kIRYHbiT6BeIdGG0k5H3Q7p gmBWXDkOs/10me044bPji5Xa+xRdWmmXLhziHta6t6pY1HdZ62NrMw3REq0eF9GOywWD gMTKdno0PxrdvBsX7KAZVNqGckeYEgHhxK0n1mq2I0BFHERNnd/YyBw3qv1wyYDfNCfe r+A3Azi5c9HmQ8BLESCe+yN2J/P1u9Ojxr10As/5jGgRYkHezVZy5O4oPJB3/Pb0nJN4 J6ux5Q4XUGaHuFOsKCNlAWen+xv973P/HAbke2z+yll5D4kYwp4vxn/viLQqyuz4+PQ9 tuCZJwg52XL47r7Iwo1uOF1cae3YWo/XH6tKSTER51WpMvxTSYkJKRVhIE2sDTW6l2NV HPbB/5nF/QSPe9aOHJD9HCOH6EHIP5ooXbC+J0dz6s+Y3Myhv5djk6Ce75zUIYNQ/tPX TzF95iNvEAQ7GaOgA7Ifyn8ZWxRJc04BclCxDV47U8qmkfXyTfXKZRyK8SMYLeMi06bA ArFFrJbt+0GmN4mcw5BHj6Y/fZeX0TBDo+0tL4xVFfhMfyj0A02XVSJGUIHPjLh1P2jE nG4LRmzvBo/YtXcj9vfNiMc1XWb407LUBigMIeYrJMSQlNFIu/gzvNqUlUx74SKmbADA jQ6NniJsCGDPKMNh8GUihiw4zy0Hd5BlJQrBu6DXzgXNaWadx8RFU5kDX9auOvY24ZRp N8DhksoVVLElp9zsg26ooogJUSBTVt/o93uVYAcBaWLisJuL2NpE063mnJU4WkEtEtLy 83Lxu/rqh388/RayiaLP9D8i5ccmCmdNzezQdoso8kT88D1zCd23DDkIyL/OlhczEoPE jwlxYEfF+yLk8fOLp2otbOT/OPJnwyqd+wUKmv9+hhNXQl5mo+u77lAE8cB6EoZTxpUS 0RbDuF6xSSoccUWUqgxJp5SwwD9EsYFnlWVS7LZiY4Hsx06FAo8IFjgh5xE+QEiNo1yS dcsrB5ziHMNa7eIvskG4Xcp2ik52Qeadt0sWhwdX/TiGcd2HyQ8Dl8iM+dv5eQDkjTjd Wig376w+nYUD0pLCtWbM0bUswrkqYnlZwWYRdQEqnM4GU92Yyt3HhsSZjryIK0yeWi1q 3Q9SOjKOj6DG0KOoWe4uToapWb69aINhf6JtDYLPJKdoRty6H9ijjhCxIzZZJeJq6Ih9 eztif9+M+Ga2NWCJQcMm0WrGPoSjwAmv1y6xy6l5DIk6wbmSkqOlr0Q9MmNyroKsBV/X QPDcmnstp/c5McS7as+jzJy2hcDEv5k6Jh+b3iJc7raxhWqXatUNcbjoNAZd4HQjE/GO +woGASn5M0h6dSsCvjbJ0bXnKGPy7SUpJy8I29QY7ichzmcclr8V6DcLBcRWY5THnOdA 7Mcc2tnEXD4HogKUj3JgGS5IfHiK04bAXSSz5ejHwLyi0kb7AC7cTaYwYezXpMKCSoQW UnJvg2i2BkmHi2FRp7YzyaziLJcN542eMp3PmyjJpMrjpgGbV47tjrDpihzikkZPjFpd suHdaiuLqilZwt1WtptBbdkgIP1eIbvCHEMMuYZJ5Oq1bL1N6OAWE6YjMXAkzXObxu1S 5G2zFc6Kuixq17IVn7i7PequhlOdZLIPWxlgOs2ichrXpOkaBmK/+P4h8MEZqprUGhvw tVjEXXp3urAIPa8FHwnIiJmIyrTJfqlZRFnBPc7nk8tYhGvwx7CItOZbBumA5DVj725F Mi3jrKjVYAj7rJMBXNYf3hkGoKRC0clTxlbT4yQnsXS5hcjWevnDgkVT0sbGZGwdbjsY QapOSZ1A4EX/fXNkknPaVhu+rtpWEWhbJgG6TW/ula3XgbJlj/1rQ/bxDFq1no/RnRhO AnSD3Cl9Ky0T8cH218Pv07M1DEixF4vUtE0lxtl1erE+u9Cqt9QMQmRcjNbYirgnDDsH u0UYBdELhUu30yN1yL0SxiAgLyQBpOYDpP46P+UcvoTtBcfxdRSnEMXh7Pjw4ljkcBPd eT+p0G2GfL70o2dgt8gilw9BZf13knsli0FA6kAHQiTMxzLI/Tby5idf3SpzIvTTQeAu lnAvm9Xf5ua1oRpuZzNszn4mZGxm5gKQ3WB2i2ozMh/0/uzPPbvq00FANvsWTvrXs9Wc j1TpAxLC414SPpkRP0mA4rjf70pI6J1ViBFuELs1/Ziv+KqHTR23IwnD0oQkEvGAmKKR 2ZKXyVvwdZXJ/2E/I+PyZVqmekXCuJGJsiww/DDtDtW7RZQxltPMhw/tiPYa1TgHyLpi 3HK7AhSRNcmOOTDJQM9nYLwDczcwleD9x1Ptpq+jffw7lKT58fxfC/VQfTsjnR5fhpK9 76vfzxZE2ai/n/4211n2YuLBkghHePu/lz/M3s5V9svIe4w/JOxGuVPLOeELqWlsj9v/ scHMMfJkXJW5ugambmlcr3Q5OTP3Sz7LGqtfCLE+Mh+gvfuQliRjIyLnEn/50Ick7Ugk eki+UILMISVDgjykD3oQh6P5bAq55pt702PwRd2r0kJNcI7kWPzoja/i8qEo0kFJXMt2 2TFlmFrk5JOvl9dMVI07q6jqKQDEk6CEQZNQSkn/vpYt61AyCduhaCRkewRRTUu2efne bgNUnnNIj8D3BnRbortyQ7yy1nY7QM94Mx/Z45sNrq9jyjgNmOJzdGWUMJ0137UtLFBB gYVcuvKVTNlkq2S7jgbBtUND0RgVEHyZxXsDlJvDBnRXEg7HlW3VAio3ZFfnUL3DMZqo 9+rlL3hUj4gSM25W93Hk678ZBGkxTVCq/kjQiWrfH3PPNwRyiNjXSWO+E5WzRshMhpVc 3xHOIu2Zy9b9tXe2bsExDdrKOtNt9ffQ6rKe+DeTrdPU0LD5O2kP7P7+mjvgSjJSXPm6 x9wjtWfYrH2ZcAK9ePgGds1zuXOwSfvgftK6az+DKPRT0lAanMq7aOsx5t/sMEpvkn7L zYGF1d+3n7bvZPLlO1EgyPjkA8dqy8Ua0CSfm5XTsichnf5htNuwA0fPd8LJ7Bhba9GX mTACWUkxnwrXjAL5jw+WS6aqkpgDiWhLyrje9HLJZhS7749HdYInC7rVSbyn/rbplzQU OWzfyLq8SCraH535FgmP7vjs+Eu1/5w0b2RqV/vkQmHBcnHmLt65C/tosr90JdiQdN3v fCv/iP5+US/+aj5iLizBA3gDvFbsaeDNxH5ENsLIOL0QAQ3U+//RqIp3+YIQLW6AhRvx Ezvi0hRM9l1B7GrwrW6DQNfWF5BBXGMrdTUyd2GqTvZ/+D7EmsRNCufOCNiFSmAXorpI GBGfadRBLWmdsr0SmbLxPXIElmvDGhoaQazjQ/BOrhOJWk6DsTHLLJkf45vnFLMnlqfE pEMhJ4Cf+h9IgDLmP1b7TH6m9hlVofZfPlK52mfMlCNDcw0eSv20TSCkTancntHsIDkq WxoTtVxsgRrlhWRfaAFraCR3NAJl1x8DJu/+/KEGkLO2B8DwKT+AG+myTwBusv+RqWeq PQBIqWAbH7Qevto3VVNT96nu5M+mwYNPHk14G0+6jK6ZCCxMLHm7WmW5MDqmYnLT6K4a j9oaz+SS8VyDlAOLIjNGi4c9PY17eogOCxaCB6bin0ADs+4epi3ECaI97m2Xjx9pwExr 1+yxQWbTuB8y+V5gTGSHZSUamfkWXW+TyhWTztJOJzKj0IMZgQWdUADBqTzXM861hdhU O/hLNyrI+SpsVaUFi7wF+HVzL/C8+Kdhr0GA9ZUqjdtLrErD6h5bpSGQQULrvUITJyQU HxYFr9WZMEti6XImdlZlYIioH1bOlwy3WaKFkO2yQADw9bxikSNbF1WoyuQcXidWEBdz o374sqCdrbVVEqoyfG2RFLwYTQNVBncUcpwIaE7ByvkWQ5KTUbqB3ZaEuszVtbbbhbqM azcJdBlX1ohsHiov2HnYA2XGlTXKjCsJe7JjDts5nAYClMe8V2b87AgX1XqYLwmUGV+2 VatRZnydu1BmoPMYqtfqgL4OlBh9r9WMOOEEvsj/9o4Pf1iFRNYNygdKjlxd8jzLvLJC xBVrShwTTk2KOWFs3y1XbCCipGyUNmVW2NfPA6VE32u1wb9B7iaxvNsqGPra1qG0uXLP BXqrfPjROuVjojGhlQl95eAQ3DWlzdWWosEWaSM4A5UDoaehR75NiEjRUjT8uryErrSo JZr7xFPDFsW01onjIdu1XEnTU2BG8b134jOep9DX7fgMsDveM+GjKQY3IR6asg0FRVZ/ JR8c9goKh29Q95DJiZEMRc9+CookFhWDkVZQnGZi5H4jc4aSeA8FRUuhTgaHOtiW70RB sfCOp6B0fEGIFqdkjKOg+F47KCiyI6QFGVm9gkIi5zKqyY1zCwUlFy6Z2I8niFg8kn6C KnZL/WQL0gg2frN6kj74TyNFWpGXbKmirRhp84EoFciWnyEj6x99p4VkiDr9xNQySozI 372k5Jz5SQgcb6TkmA/73gzxn5B+0e6Al78ot/w1JWg+VvKnCIWPG8aGsgVklda1+Gua mRKkZOqgZ1AfwdnX/C8tcKPeU/6lFrtRt1EZEbRr11tumjH2LoOWySGLtKTk3Bx0RLTP zYPeE8EenAO41WCYD+A/QHHUP1qtPQBgUwO4qPfATyY3MsE00rPnGqt9lpiZbhmG+b6w GDMuV4ZlY9E2o3bORq0u4mrdHIbhoqEy/BVY43VAB6RAZ0YE4pnHjXJGBZSm5uODRxOq hkUyDBkUw6W56cp0bp/8GV2Rl5iOTa0pSNSDFSsABEL/puQLXdU0MCUsA/9CUxJ2ZKGS XjX66ejSgXUhjQanHFSIkjpr1kNEOPsmTre1xo9Bi4GVv4yKv8AHSESlyFKWNcyPqWXG wqR3Ao0ccqRawGnRBu3fXC8sUknB1OiFBVrPbfTCAuzo09ZVohNSyd0wvVCS9kU1kk7g 4vJlgbzmy5xEReoydj/UwMbFJUfBE/GYerGLSqYoaHVFQdNokoluVxFHF+iEGSfcYsKG 6do63TIxk9X6Y11Wx/Uljew58WVec7ymJNChfK1GJ2z68hK3hyoosbAHcrkfj6vVjNCV cA7vknYWeYHI6pDeiO5+YpwIDs7tlIbDcWXbtVzJJGg32L8lkq2oWhOypEl6AaN2yXWo Esq9UfcKXDaNSsgygXjsE67lip7sFZnXmudELcS6T5TGhLPwbZWQr5mIGokaqK+kT2Da KA2fa7VLPw9UQn2vlTz/BnsXk2fSqH8aDl8alDmVUGB2KqEbrVMJJZdcaXxRGl9OJRT8 GEWwfXWNShgoh6FKmBExxTFPmYqG1DqQlSeixmIQkIcjGV+Lzq09wtfaKgktNb5WJw6z xU5CA9IQDqM8Wo4bO01TZk+9ygi06CG8oCaRfaMNlribK2z0oZwved/6aYOSLi+Rfv9d 1EEH8Hj6YNc3jK4QekeV93J1UAgzUqPmfKOjUQgLPFfZLRXCjKRp+JrD7yRvyWh34rHC rYHUdhuP1TaoUVl1UAlvENKtfP2RdsKEMvxj+8SI6UbkNtdG6jTytflrnoqzBhnddGWK WjK8uHYQZHnSSVz1LAKjJNMcCNJdvC+fCPhWx0KGBmYRm7XWNNm3arGrgjIgNW0d4OPm E0DfKrQaGAI5feGrPUgmThETJ440szp221Nl3Vj2Ba7rjdfHWisyb7e9WCUPJPM+29rC YH9Mdav0uw7/bBT83ohupb/TamDaxScaCZhMPNQhOBY4mWZbKLjl2cMvAE6bHdBp9LTY 2oJmTTSGNl49Mq0FnXTCyJ3SE1ayXX3xsOY5WBf8Yg343Nw9tF1rdAjBiWctaG77tgA+ /Bq4MByIDx7ov+EHfdIq0rbwCzgVz3ojlEzJRV2EnkPccjfrgA6hbiAhjnAdfiHUwXjs MO2dxavFvgVYlhymDlv40N56BEyCbtzLPNaEwsCt7V482LzT/rhK9qXYagR3vfEj3xMT O4rZpMWzWnUhuG++1Uv02V/1z3d6bv6mr90TINF2hAnTz2rlmtXKYJhz4GT8slS1mYDh UcI4qAmaKGfcXINAiML0I2hjpZvHpkgojlqmJ5Yf7cwD8wZT1fz1pgbP9chkd5VNhgTF MDu2OQno2sDNpWxv8uTr0CQTsj3/vq0guubtjSCWkOQ9zZKQzV76Qj5yHb7QebkZq5DA AdgGF5hgQJi5PgAxFB0IIfGb6iVOVdvCevqFJimURUkly5FNS7FXUqZpjiqmV1uRSaTo AcuV2TDVv6cLbmyFNu/kZWJ6kgmFJiwEppkF4MED079w9wYeqvTEJnoz5p8Am92sPwI1 r+V9LLavuQFamBB/vzFYME/AL0N8ZQ1EpozR0PJj9jZ+PjVl5uaVZpB0KIyQh9EjWRf2 VdbgxKh1j7YU8qe+6QQc8/5PTQ1Wh4HP4kOnkWzoyYRjOXtjQ10x8Woc4AlWOvaGTU64 bWFMzKB4KRCYwbBUuQYYy42AxgBoil5pI2I2ATkGSWYMbBS0klVLs7/rxuwWFJnHpq15 jSlB/DHdQjE0MY+EhHmf6dj8NS0NaObagPzYtG7b5nAfOdS0EZVLwouM6KusjahrbHM6 hqRPzIZTqC6J2QAuG3HZ6LrB1fOnWxzk+jBcUdoxmyURMlxom6uISHHWtE0eeEOPWBR0 XkXdHx9TxZ9t8jYOtM2Rdwh3Rcs0Z4tCvdkWNSY2wuhxnUrgt4kzx3CV8XFXyRbhy0gD Y8tcretKmnaTFE9ooW0vvmFKftyskBBlZ5tLU07CwlsosbY5XxLY5nzZdq3tksCY5dsF tjlf5s0cHqqgxIAemObcaDbrNGYBVyNo5FEXGuYc0n2shiT/YfYCA4qdqGAktk5gPrF1 GuuJb/SO3DyDYs6dTU5sYWLndbYwsUv5IAr9TFvekigjVMiFacjycDY5fW3rUOqvMMeY 65QYTRtTLpG6GzY5zCj63Zi25NN7wbWxxFFqQjfsc2OTk7qhTU7ujb3NvcHe8W5nkwMO Ey+eCETbz2VM1ibnR+ttchoTzh5In8Y+t1EaPN+MBw94kg/YkNhUR2ITgZuDZi2TnFuM XSjKUwvr2jCIgRTlF5kj1V5cpeEXDXfwZYFTwA3Nswu/fIJ2DifB+G0RQVkbwRkpns1E wlx8cAbnJUgb7vYOd8qnpzEugonlqfOFNcHYsgkODB6fmJCMJTuyjslwoQt3EpvBWZDL Ab6z6PGub7hrY5wobBpfKHL6F5nFFHirXAdjnJCJJDXzwRmEk+PoyjbJRAs5cuxrc7Nv 5CAvIqYcmYgjSM8rgyMFZxjV/jamuG1Qo6KLKe5bkN0I3kZm/OhSGdsGfSN4eimThh+h zPCTmCavHn1s7q1Uansy72jE9El4bOJy6bOZAzkSm7tj9hAIcePbTuttMf3A6WYiYKNY tcPdoTmEZqtsiWZnFAhGgt2Aa9eYYekyrb+YaraReeIUR6upMXijCPBX9+oUTiRvehWb mH8RSKGWVQnNc9u1AW6ra9ESzVuZAK5tNRuqb4dJhV5aYYpvIyLu0VP4ZdjdDglwxwUM DAZ6M6AvtDZrrg8sWlqje4AeB07NSEw989yU2HGYB0+MEUeMTeDtkmr2Bf+gAhhpTY3t yM1kque1VeOBvbNz4G4NHOZlrnUbrVfqTA3VctqBnJChcnm5sr1hK/k4eaUp1YzWTDgr jtfzF5Ao+RSoDRFRZBbspx8zDxg3rKJt6plq8sC1NwvQPDXlYJmpsPo15oUuCnSesv2m SayIhQvHeLleyGLi/JUMwOmFV/PdnLAJcLbVs6x5olY3VfNtqhSDrja0MDohGCEBbLBC JGYVm9UnC1wYFPgDJY5wqCFL1pBmvzWEClly4i9cRFuGhG1onc3dUqEzz7MXMJUgjHl7 ZqA0BiOBFcj1GHnGMjIzy1/XlYxUbk1r2ATBW65+KtjAftiuI0uLFrbQvsI0t2Xm5hMM NBaj9GFBNo9+aMMl1AQSbZUQStuhnIexyDYD6InsaFqkPheM3g+GI9uMgGUAolqDt6Nw yDP1LAbt0GwVMCPr0dW0ozMNXKHMhF4EDapNha8Msn40s2DK7JTot0z2HVmEiBRbIbNg K5r3wwmEOmwZPfXDKl+W55BOaGrtFTUoU9ssII1JTcNABL/xZGsWF4W2viAUX4B1hpiB iJWTenaBmqmxfcj+6buwa1zQZMioeZcggXqtR4If1pWeEZ7ZN1vfgQXHdmngsOTgGtjZ boxn11oZxWYucSwWrVaAvJxFQnsbLPLH/wdghT/yCmVuZHN0cmVhbQplbmRvYmoKMjkg MCBvYmoKODM5MgplbmRvYmoKMjcgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAz IDAgUiAvUmVzb3VyY2VzIDMwIDAgUiAvQ29udGVudHMgMjggMCBSIC9NZWRpYUJveApb MCAwIDYxMiA3OTJdID4+CmVuZG9iagozMCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYg L1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GMi4w IDE5IDAgUgovRjMuMSAyMSAwIFIgL0YxLjAgOCAwIFIgL0Y0LjAgMjIgMCBSIC9GNS4x IDI0IDAgUiA+PiA+PgplbmRvYmoKMzIgMCBvYmoKPDwgL0xlbmd0aCAzMyAwIFIgL0Zp bHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB3Z39exy3ked/n7+iV7azlGNP+v0l e/vsZZPsk+wml1ykXO4eyz/Q1MhiwheFpGLr/vr7FIAC0N0zw54eNkWdnHC6qwF0AV0o fFEoFP6e/M/k70mzTtu6sT/8Vl2zbnMhNO7iZpP8JblKfvbL2yw5u03SdVd2adbV4WoV aLdnSVm06zLtuiRrunXbtHmSVd0675o6qbN0XXRlkVDmm/jtWVOuq6xLyiZb56VPtxq+ O0n5j3f8nZdnbdmmqRD4z9+VxbpIm6pImrpaZ0XXJGeXyb+/hMU0S+vkpfBnsrifl5fJ z/4jW6dJlrx8k5z89upuc3O1uXuevPxr8uuX8Bi10cNx2ebrLKcCQy738vb10kzV664p 6rlN96ub0zd3yeBfj+WVk7Ud7ShS0ZM08532fu2sbddtneW+HVfmayMPk772i83Z+5vz q++TP/3xxe8GnNvb359+SPI0y5+vpsvDjHoUXb6uizrIg6vHXnlIeo2rHXlH4x7Vlap6 nddd4brSE2GqbNZ5VqKTTP9+Ikyh+woU4GFKB1Fb+FNW6PI675Kmx5/rJqv7lGK2TpIX 599fnd69p4tufnx3fnN6d359ldydX26SVydvzjcXr5NnPz579ZyUL9+i3K9vLk/vkus3 yR13/zi9eL9ZugehUrsib30Vn1YPyrt12RTagyaqJ6eRFpYNxvm8SRkbm1lMmm98fptY IeBCvvjV+8vvNjfy/W83Z9dXr2+T2/Ors03y56vzH5Nf//EPv/wNYpOmPzf/W1oyvG51 9XtikpGu65SueRBMeXTJmMMkCuI/T6/en958SLKvkqxr0uQcnYF4/PnlL63u+L/XVxuv NIyaSJAgNMzN0kJRo6ibhgE3t1U7DDhsbm83rxfulwETOBbnj3QGd20D9yNUsO7alBfn DA1tBc6PLgBieVetq6qrkibtwOtVUpTrNC3ypFunVZU1tZQ3BdjPgEgB2GfZuiqb5rAv 9tg9xjF5WLc+tdrz9ebs/PL0gkZ6d7O53Vzd2dEWbXp6lby/umUo3rxOFu4h8q1rMyzM au9zJlLfb26W7iOo9KousqTpt/deNLhemil6RZmVoK0DmNqOAKd13F++oLt2adW2zJ2Z YeddmWVtdPXil6MZ89dhyqwWgLZcd1lRSL/KqjpfV0mZMpXvujYZUy6SF2ZqHIqRefi9 pdJ1KbVZd75UoRS8DUqXHFGqlBF4taVmljKr1KbEJNFrgQFlZqlo0F4LNKVQjmuBUIa2 gFJ6LbCIKSPo5ZQ5bNMoxt3bBbdL+wJTV2at6zatD4dXC+sInZD1+aPLit3i3glZzjTr T5s3m5sNoPrVye2r58nddXINtLpJ3p3e3H3459vkbHNzd/7m/Oz0zqXw87RrO0/77ZuF R5CiKdZ53uWJVvJJAe8addeAWQ4boR8ZRsxj8vb92dv4+98mp+CyS4AEk3aQw6uTGxGe Gy7vrpEdUPnp1QemaG6K/9XSgqFzda3e0xKMplq3baZ67GnO1etZTKIgZALGFMt/6+T2 7fV7rDffbRIm6rfnr1Eqr8Vic/46ub66+CDCcXZ6u0l+IO/ictGsm7asEq3d05KLGqCU pYcPJaIzFh5OvA2nnsWkDBwboyTsGOKl4za5/gdjihEZTOWMNxj1vvvr5uzuK1QG6uMt 85OlpaJpWaLKEq3a0xIKBvKuqp74KDKLyZEomEGDEcN++jPmoigNxAOUgcr44fzu7Vci EEuLQ9myTIVhona1mi8P02ZXds1zr1kkR28VTZfUrEmkVV4nebnO07Z9VLtIXWKFaSsz f/v3lw5K3rvg+diAxjF5GOqKsOxthGOMNZHBTJTrauJi7QzLU87nZURiWJrVwsYwvrD+ z6uM1Y+SlfNZ7SurNktzyMp+UWb4AMziUDDL5ebs7enV+e1lcnpxcf3D7cIcF2oiHnA8 Y2I7TdEsYMbJxGCbNGXtTSMDyiwjRtaJaURMDGrGcZQUM9RsM04oAyNGJyYnS6k71s7E XDSL1wJV3G+BAWVmqbZdQwsUuaEc1QKhDG0BSxm0wLJmnLpMWVevrIKeapB49FFkBo9v T/8hrh6X7y/uzt9dbMIUyIFc8IyFtjLlMVPo0+QH3D/u3rKSjcZZGte0OvmxH2A+rFnC jFaI9mZm9pRXKVkHmMGk9VFgghtNehCVjVjUwLduBcbMduysGN8GgblMiK8vFge7Ovdx VXtaQpHn67ztyqctFLOY9LLgpGBoGjFuLkCSH4ztxMCRpdUD4xjrSUVSuwo9LVHICpa8 2iduG5nFpCxk3rzevNtcvRbrhxk+FkaeosALlvPwg+01617kubR3qHjzZpVx4u0xNdE+ apYlljaDMefGURG32kHDTeTR9/ohIqC7/+FqI199wWlmUbVMM/EdVOafVg9PwdFl+8QR wCwmT9+9u5B1MhZHlu7YBc5G4pNe9xnd27GX7jRZUTG/AvEPmJrYaQQOObQcJui9djzU 7XufK8Nqrzt4XjR4dXXYinvtu8sWtho4/58fZFKILUkrayTc44Kxn2+xG7Z5kIun0PWD TanXmFN3UghENgtH4raU3Fy/v9t8U397lGDcvx8g6FDH8/yGnGazmfLdjVSWjXQwnGoY Q5MMXdp1eYZgyi6WrKys45zdzIKoFDjct5XIcb4uCtacUvzuSjRHbU3KFCniN8XVbuTi d38repcOXP1QDU/cbXkek7qKxbImDfkdix1mUsd07w0uytc/XG1ucKJwa1zJL14oaWmY r6sbWqv5AryAGaBq6zXzj6cN8+cx6bHfccPtvrFr/8a1DANi07KIpPy7Lz9xGL48//7t HQaLnoJ9+D1BWV2Ku3rhuXST/wURzBFNWmM5rkrP62EterP5+/tznCGOatH5zPu5zEAe Fmzp+0eGnAlpxn4436SH2X5enZybHUEfjK/B6/M3xoXtzvisnW9wYzN2FRaVF9aypRlW WWQYtO3Evma2My27QbTMs3XDbljP4fx+9nBAxqiovJXOLwAGMWA7WZuKp3EPxmT0uyqv pHldOhAFuzRx4vApLXwZAR6fIwAeXtGkZZ47iLR/hwJG6nVWs5O4wkGqKnC1hUEQll+J N+9d3b+EEqN7s+35/s4RYBPuOA1uAIfpm0deQ6kck4f1YGMtx/Bpd3v9/s8vXoqR/DS5 OL812/2e3dx+uDr7+c9+tl6vnyVMDZ+9vbt7983C/dl8ddlOrZWagpoOmuzNQNGFh3Kz Wvpb14hHDT/3C22hy07adEsrmgVWuVuz9opxXPYssG7cu5+1vstGCoqSEm155i5tm3lr 0K404iwof648WTKexx9OFJY/V2J8P6/ECo0bamzv5tdY82uN9T7U+H4VPKPPBRWM80ZN NIPDtNtjq+BZTP75T7+7BSf91iAp57Z5ec2FscIZJz3ZFpBIOuOQZ/ZcfmDlAhXNBGHh SAbq2125yk1RxcfNue5XckEsiEQidjazjA0YmbTb4rGlYg6PtxsWWNjqYf0wGZDfXby/ TZ799JlZ1kZcfoGD/xU7cpGKhSUg71KgK86P7BSVxp4iAEsvXvnNjI6nwwTg9vQNtsy3 NPAZa4GL4wb1O+vz2pv3DS3X2zvQTuQfg1tnut7n3yoeU00lpgmBNDlLVMN9v4+CqhlD uqqunjaqdkweNu4wL746u3j/WvyTbjeX52fXF3TVZ//yzBggtSuzU8fpcOnFS+//NR9d HA6qWe3OEHT9+kjjyf2K3dv7lUnX7r3OkgyWebZ3loczlxJCSaa/tW+5w4RBdmPhbbas fcEHFzi+4XZqmR5+WwD2S+gGIGvO9MrA/t79LBDcZAZWU6LAfr1jEnBUafhuWf5c6SwC z4T9xGPo1bh3P4vHLkVWTRtKjfVubo19fldjfx9qvDDsL3MJZ6dBoSba8x4b4M1i0qB7 g/0XVg1hIaLP50fVqQHBF8U6lRVR64n6RJgCIGV1eqBzDN6TAPMXNprHL+7ubs6/Y5E8 hpcrH55xx+gUA7mJVsqswiTaYcqoHNNT8PnSQ2b4vFlFqEh2dz2pz5uyHI8t+dBZ48Id VWMIVHPYw58N94yr5OL6+m+JOLhf2SCIzgWeSDRQXp1c4/rIGhjQ83ZjDLynXk4X3yWu 4QNc/Z6UnJaESSVeY30YtGOgeSSZ6PM31dKxOSVwgNsncZo8+9vmw89t8D7MCB8IQ/Qj +urP+MHe3N7hGSGzFbuZ/O7m/ZnEBlzYsuB3ZGntnoJI+CgXytRhIkEfXFgkvIV/wOCM oXMa1L9/w2zGlJL4t8T7xSSeN3UN9CRmcMGKrIkklhMDZaJ704wR0A82GKlwbyqzgy0K C38xVezK32EDz9vNxTvZwvR684/NxfU76aUL8yufMy0JstNneKqnoBivl+bQeYL0GeyH gp5mU5sGxFZ+YXt3pGopyXj5D5jaMWkZsvfmYvPj+XfsY7vc3L29JsKmOOKKK/MH+eKv z78/vztd3IpQEV2JYIGDGvQ0y5Dv7cK4U7PE/Xv18EaERtwEEjwG5OeSoOfR7ZwJNSEl 11WKZ4QUaQrU+4rwl8eVWIlbRb9MTMXzTAnEZY/r3budwyWOa648GHQ3c2us2V11/W2o 6/1GBMRmdWAs8TAsUBd8bQ/Tuo8I7eaw590bb5eOfpgR9DAviIFR9vicoRMeTtVGnxZL VK27WPr6HzPxKj4KYLuimsZUkpoRYK/Tf2Cqzlir5pyEeH45Ctwx0qOHzSV6elQQ2v3G dQ9DZvH34prY4H5zbZg2Gte/0/d31wQIZ9fNBSGmTl+zUpB8J1utN8nr07vT7wg49WjT y9JVb/5kYufg1bOAT4DFRFTA5aRISgAVZ2UwsBq/OVbeHjPAblnlsm7bPllY7Pjr9Zd7 YybeijxKHDwVsKUhJ9v4OQpAPqZtTsvuqqcIh0tTS6+Ds9NkTQSQbMjUDsw5ZM9vg126 7fRYj0HbTWTzq4NU95ZOOncfV9aBUeqy9c17WBeS3SYipke17hEe57p7Tlt9vkbcMUqO mvr+QShnESIXe78y5brRRFF4fY3Xyx2WzpubD8n1u409uEJGHd/IyzgDB1tVX5vu7f7b 5faQ4WW/5Br5LIjfLgNMI786vni/bGt3MYc9LTDbwn+E2RYu4/ww24pv58w68JB35ZnS zE3DAUZHlNWYwNfCmytNljLnlNe1bJOXQEa+ukPKvFKJLa6lUukOD3t7P7fecQnWfzam hNp7wKh7Ez1IAVLHexMf6RiAEtltmhlO9r7jL3O0l0fNjr/DUMr55bvrG4zrd1jw7CE6 7ErH6v7SBG19x8EAJqSzHL5joo7YAwMuT4lSwf/NkStLG+HVwXPwAWYotocbJWhre+pb iWcay4e6fjhxlDh28j5/zPXS4vg+DDDIes1R4jyfcZxu7KlB2uJPASwgmvZYPWXqMLDg 1j4J/PSRGjXT+BDK/2HicGv0Q0A2cxTcfInwW0MHzH9UxSBb0WQLqPJ0mDb+4e05C6ID 24WY0jBXCFh3zx9x4bOvJmY07cOBSVRXl3KoUMm2m7YmDBj+JCbo7QBLilA3RA8KCc2u wYaIjj6lWKfeBJuUhxhadIAYZjcg3osWp04yBB96qGQYTPIaX6Ps6RpCHH8HCfU3yQkz Ipkif12lycmbm+tLvT69vDaLheYB8AIXY3MpZjmXPOoLz5Nvk5f/OfuQ1PmKhungOm1Y YynnfB/qf3p7e312bnZLuGpJ8Gqq+O1qeoVig6o7F3c4+WIBVM/i2WsJLswxO7J+uu2D 3msJxlHnkPEqZtw4/98/CccmiRbNUKNzGKTF7cj6LypFrE67hrdBxvUr4G3ElqVIsOK5 +U7NFVdox5dA07gvIQGERIAy3A2oTiEBaxMOiaGKXBiF1LQs/uxQSGQgXIvsY+7NeR7L YSGTI3rrAzcW/3CcQel+8WAVOGXZJyG8s2HP6aPe6DRavpgrsnzhKavrQYnTuThT5+mu rszi7zVhavDgO53Riit/kvf9X7Yj3guTbD5tn8uP+mmzFKsEQWgGPO2Y6w0FT0L6siwV NtyEKXc0uIHscK3Y/Oh25bhmRh0tgjj8Nhat0lOYTPkehGIU99fDz7g4RDhnmIZ17tzn D9U8aVfnOaeZXGz+IaYWDkWSHbW/kKjy1qkRr5pgUmF8DTPDWzKd3clK5dJ2FnV/1eo9 MZmQoZJDg62f9o6+N1w/+vh2loLNqcL3YRNrFqjPJTwkZ3IuLNPee0IZPayBIw22NKMa CGoeo2dyrlC06G/d1UIMbuF+dqzV8dRiMhLHD7WVA277tXI65V4k/hV78M3pSBI22s6a Xv51NEPaCWRHOnBcETiJphQ6BS9YL83Khi3X4PSUfWskIxyKAFk7Ty6oV1MTucenxH5X cxqHT7cD8Pr0AfAePQMf12rq5wlDUkuod3GQOMhlRqJ4392IYr+VVUERPzxkf/hq6a7C PvimYndQ0eN6vyfA4orG998+UxM1OYbnc/yLzfLDws2XE/C8lYCXxzffw/U8J4kJ0Wax g3OOeMbcpzTH7/Y63mjVzGcYdyjXBUcBrugd7ixu5q6+yzepdHVvdFO/eVvI/Sh1pGvu nwyE3tdw1G6B/e5RB//7GfSAsMefU973Ogh9f316EW++48hkIy+EaxWnXtmtwBlGfGI8 s9ZFVxYzmtAvUBQ9Fj+uKmAPBpFyWDYfMDVRFWzYDPQd8b/eok8x7LwAHsvyZBYcTWMr zo62FLHt+euOB4kw9N0TBJqpqgkC368O5mcjQe5HYwKssuTlm+TkIHU7YtaJJts1zXja pqnt9+HOB06cxFSSrXYztVOJ9diKnTei4TXAh4POBJeezj6ddbXKc9SAOG+Y28TdHurK QHmr3PjaSwGmNHG8Z0vQ4cc8RWVl7MqzvLnSJPzUobzJ1KBMTQFa197tvPKEE1fXkv2a M+tqeXPZbV19aaGuIwOPrqcUbtAYjD0+uOL9w0ZPxqa5EYdhQ+JisFD0tCaybIfGsv3I DgMHjGU9/qaOZS9Zsbn78E4dsNV+8XpD/KJLDIfObeT86vzy/eV4ay9zl9O7pe0bGniw cDV8WmKBo2xdEunoqUKcHn9TxULjddolbONWZM+9wnHo97/4P8S4ur7mJCwmr5JC/PLV 7BEMC4v75Xc5Z2TUJTGm7Cd4WnKBKm2a4vAzrxaeJHno2+NvqlwA28xGf/ny726u/8Ep 4EC5u833N+d3H4Ry50CdPftMZCQIBJmu10srC3cOWuGq97RkQo7/Jeio0xXbcWYyA2fO mGCEwTbDTiMmoaeqwHr8TRXUv8gB9ubIabPLVUxsfmebrOp4U70JfKmHU98Q04AR7xr9 tjn729Ki6sc1V8OnJatpx2QPe8VTFYsef1PFgkM8EAV7LGOQh/M7FmtY6buVGBbnr+2x 5ZpU3FuM+FifWiLVLR0X1R3vyV4G8wXmi8XOCeBIX4xMSTRoMCV5x6ycbSutHOSIP74c 7vC4URgKOTMXI59rkIlWh2OXkg5A4I4/22WmimQ0Psqms4WHf+84qo15WP/2QYOPO+zi /jb1hwgO+PyoYyYG23WaIv4DpiZKIuCpNw4Bq4nNbHzshG5Gq/PNzdL6xS8X97vTjJad pl9iAxOdQlelwtVBBibp/DXWCewiNd5ZYsTp3c4xutQmgICUJ6XZm4q930eUZY6niEsT W9ic8jpTSV/X3u288mSnjqtrZyJO5nPr6rNjGaGu/jbUdZKdaHb8hZwZYFplDrr27bZD b56DFOvAeHWQGxnHnrCkigukAU59pj5a5IBcQsjgeLedp8REM3gkA7efeOQ1EfwqDq+1 TO1QosPv+F+cH4Jnzd/Ok58kvzn9DisVUJ5/v/7xHWcw3Sb/A3+By4UHUb/Q2K8C1nNx KBot/g+dW2CaVcCvEo5HyoX16N83fzz9fpNU3y49BqjpRCswH2PuWKYZIcz7h/wgGFW9 LkCfDprMGJgejikJgpm1HMlImOYjmbp3tPyGqX+Gr3yavE4W2lfLJmlZDCjR+2YzKKsz hYloVDLZMJQ5Y4qUYZwsKaFlIKD5ierC6pq5tyX6pYbdUw1ZreOwKBQV376BIYIQyJLP mHYBjZXliuCkPl3V8aU63HebtJEF73YVUdA0dUlcTvL5VI42gbKK8hETRraOydZhn7OW nY7iVKNM1bhK5KwFQXHVUYopakAbp9pCOWMrNp+o4aQvX9YFNKJLFnIUtL6xrFiQ6lij VaYiguNcivKJLG01oozT0Ho+VcOyl2lRYcGV5dvdM+W/jWfdU6LqeNooFVy5Kvs0Z8lb 9v/kyQ/JN7ajDFdSvw5LqabDISGg9i4rCtFxiJZIJhNr8eYf3l/wvKZ/IMQ+TZER47s0 UQdZ2Ld3QDLJz7fs3e+9c2mrwr1b3kXJVQUcQ3ZW/s1VbUvnuUSG1zvJH9/vuYOvvCS2 hM97wT32UA6zCzTRBP7tPJc75U3yR/er3l3/GUJhnpauTegW9l5bzL9ZW5TSJO6FfgPH q7/vP+3fycd/gWM1DWR30Gxdr0aLeJms8UgmrWgRT/uIsuvVgZfnB9Bkvo5RX4xo9uhf 6UlZKkcLoyiariTagGD/hnOC2anTdFhzhkO2DEaZHkWacpqH6TPGX2Htb325jZyUmCLR Bs2teJOkdD/GhwKsTnm4K7DN58Xdc75inpyw44Qey8U7vWCfsqW4R6sT4p5aChjepP0v n8s/orywyUx0gufwPoYd9AkMswuUA+wzuDdsg+Yt2yf/FGDlg74hbhitYq11/pmrc2MJ qxMlZJoi1wvN6wk/d3lLTeHz2KSrkz/+Pm43ma2J8i7ZsW/Gj4KgpwhKRah8jukRx7Wy yQeTI/Od0/2eNl5KakbIrMRFL2B+gcsQ5DPZH4v4sbR4afnl9XNU/gmw/uvC/yAD0BCA LDnh65fGNadOTr55nlTJCc0FHRzNNc3QmKd9CcGas8X/pkIx4QRLRxmxmtat+Ib1mLUy wiDqmf3N5/8Mn7z2s58YrojUBCevThxVH7I6+jX0L00tbMrPvzBJ3Q1eUZLg1cmr566k wqSVmykVCW0uViti9TtBp2ukVTVq9XFFvkjN+5A34QPf169p78/lbiVsQ/tvllZ8ZpPA GCnsI5tXKssn6T3/V5Pq1YnNU/wz7UASU65mRvin1JCjUyQKGpJqK4hQrf795d7vcwKP cxytHw+ay1kiwGY5V8RB84bl7QhIi+qJRXc/4DHQHDhuSwCaS8BFfz8PmtcgPuzwgp/8 gOZp0YDmaQEom9lUVQZoXhP0iDNbsUxQloPmnjaBEkPzSiwvGeagCJpXLWABAaF0N2Hg eCo2KXFerkJzR4iR+a40o0wGEzuMqpkugK0OlSvJYw/PTkRxTEeoxVdEU61GFE7MHefz DRcjAdfkRrHLVGHlP4toCDuh0A8aofI9qTRfKOkIVC4jgWDZFYEtFZDLZYTF5daAZTvD yN0NcNyBatnHYBO4i5VQ3MMMJGBKA5tkmZxiY4pzOB95wZ1VkLW5kjx67a/A5kpzaNWk jVC1uTe417/B3sm7HUIWPiySNhyNngvLDjxrPT12lhYwUFguLA+mvTzNX4wgMtpibHHv QWSUA3PFbhVB5EmClOwWEfqSCsmeVFvSRAYALX01SaNs0R5bNMoWvTPWMXE+1zZ8GO2K CWc52Pa6YCJqEZOD1tLbm5bJhofW4rjagiaGkOkwaF1zZmtKuSOkKphpJrReWUTt8bNi xweB1jsZfjBoPfUNDw2tgWC24UbQutUnE6C1jAIcqkOAO4XWmMLTkjMLh4LCF2bxge46 HPUDBgg4j2gpnVimlsbWVBXwdxS2HrEq9rr7sfWvf2peDbgE7oOWgZsAOrC2vQZnClL9 8vmKaYK7AX6Tyt7YtOPcFd+OHGBQsv+b+WuT2pIEq/LA/fBkCjiNPotEUGR67T8LeGcC /H5mIDJsCfLmR3A4P7ze4m87OQjE5ERmDLSLoG3bMDAtEB2aK0NmhpThUogwUxZt52Yi 8iNAPLzUZXBE94JnLj8wnQzCUCJz46+L1Yk+chlc0T2OzFs9D/Qj4Y/vKm91zz5nTsBd P7d/22Gtz56wumqx1V0mzA1k8sPC7v2S9ttnKmMwIl+CFmX2zEzlJ2ZOySzHsk3dESgr giRVuZGnVJtcfzJ/bXr7lEYllyl05RJRVZ+Zb6WPzYSIkmy+uDzajUSWSRqb96SGL5vZ predxTEvMm6lAl5lXsb7EA5fiGXQVuXnz1kLdIXbl1LgYc2eYUMhMrSbkj3AnFOaQrga zDm/gDOqJfLGw/5M1BFFxEjifmgyEtJYkEQuuREh547Pa79BeILMQXIzYHsTpwpvNXN5 y4qd/4pAh3LQKfIim8Axopndr+Xrmamj48uSDm56No0UXS2HkMlsWJqegEH3S/wr6X2w zPuQOAQShmGEv0JfiZTTFp/DFD+/Mg9s0v+wVRUVQ2L7/N/sI3vzOU1i28IUJi1PK1qx 5q8t2GW3+WyGn9rXW1Jub+yTz20eWgteLKs21asTzAvQuDtIXpkTsJ7hIdYDyOteG4mT KPedpepBVgonEFaOqChtb4YCGs+ljGXwa5fcPaLiFDVIb4lGzI3Cke9ki3ccYIUxhhp5 m3+Le3Z4U4JNijIe76Yo3Bfad6U+MOE6JRwxREnl+KrSbDyy1ZHBCJrj8kvRb8HUFLWs lQayfflThhV+Q724sX1M3uIHSffcjT4v7dvIbN7tuPuSUYDcrtlEJ/EaW9aXtjDp5Z4W XnmYVLKumKZMzcLgtYzlbp8W/cIxX1jhcOJmFZUl/dGl2KJHrRnWNaFpZNeONqcT2j/Y D4OCndI8FdaKPGs4b9o1jwO8PbusNSJ7u6zIzCF2P8Xh2P0YdB5jST4jzpjxonJWv651 dsDZC/KdObTMLHPiIUcAaLMeL0YGWUOL1uOH0eiCyUCs+jKZ7bKOZee0ZKcTAdbFijik XUDDZRj7CukkELtxn8tyZsQpzgGal8n8tryypjtrPbdmho1tFD9kvRB3wCHtwjn1RU1Q yxZDnwu2tuWyq41+sh5ZDImikWO0jAygFRtPhBabK5QWjBMVW2OLFu8Ib3ao8MzKS5m1 jWnBXOFT7c9HSPK0pPTYAIqRr8P8T1lqAK3gtMZnINRHKZH5BcesHakoyTkw+DSRucfT xGSiZlAtyxtRKuUqUJT32A6qtHGqEcWYnJwngm+tyGzjWz5w5b5YMEPp94rNV0obp9pC CXbQ4Xx9v5VeDYzeJQGDonRU7xRg7o2JM8ty+jEr+e6uTL2hEw2CqdKYOaGGKzWEEnvQ lCkpUKADQ2jOir/lQ67OnNGzT42eW3skEt9QpjdUmntr2tQ3yN0qk3erIVSuXZrelT6n HqZMiva11TesTEsYc6e5ssZQMd52jqP+1R57aOQ8ENtDOfWJPQ6mcwch0066T6BWe0Ql 7iA7xc4LVCgp7pCaL7KH+jdGamGgYChri4LROsb1CbShXZPuy7Y19KC6DJgNS12dHecy UEmUjFbcsmRu/gm4DCjDI0Psg9k1p77hoe2aAt2MawWw1fx6lwH/ZIpdE62eN3lk1+T4 jjRtukLxlEcdB9g1K47dQn/0TtVuRhPasdfArzZmKnhhrDb2Gj8BrB/2+rWZ61DfkW8A iiFeYA13JQMf8cHFK6vHUg95Wot85twXVie3s5Enc5Ie8oQv5/cUEFp0dfA2CtHBgCBc A6z//hLIM8vLZjb0BEXiiYOTp8JHANeYxvDDeUSEGepi6Jnj8FaIy7vmBZhtyzsbetJs cgpKBDyHFLBuzmIRaQL0hiIw3+e6YGjsl3PhnNy2wE7wVFrhuhXDTqWFUWFVKS2MCkyZ wAOyCu7W2CsCwEHorbt7mqaiJJdKKXgMbslHlcxW0Rh2Suh2dr8r6lxVfKO04wDngB6V Eg9yShunUkooKR5UNV+MOpUWhnHHlBJWlXIeg06laarEpxpTQr7QVvGYqu0eQKd+G78+ 6r9WqE74guNUY8pxoDPn4DnnB5vJdQw65d7CSFRFBDpRGB50cu1Ap1Bd6uh5kQuYs3T6 4wB0FkigBZVypaCzT42eO4gnz2PQKfcWUOob5G6Fr4uAY/eE621X+ly4lzIFdPLX1DaA TmkJCzrlSkFnnxo/H/ipBi29C3RyiBR7hqRrByHTrrZPoPaJShAouq1THWPxUUooKe6P mi+ol1BWpBQG6iV0BilLVY7WMa5PoA1BJ723xhnvwUEnB5oZ69EnAzodwwuCzolveDzQ KeuABoZOAZ0oddCheF04P9UHAZ2MAhQaL6YTQ3G4ivK4oHPEUkookSFLwM/e4cQ2fPmO feVmhwQns7ADgciZXDREezUXNsre6vH8HjM5B9GEZEPfc5GxTsvPbOsn+S2qNQ459uYA yyc+F6sMr4ymwDG8ksCHclY7ls8RDZQnEVJzYKps+i1BQnCNgU0iQXY+r1g+t+SdDT9b JuXSSsyhpdV6txfcCjZ1bcCtgaEusTwNeeFrp5mTDtW1VCfGm0qLBwRHi8yVnD6UV7Ld xCt/Duhhb6R45Y1pI0pc0pZ8uMh2EtM3xpvYszjvItqDVeGuztqJ+JqqudJRDA9D2jjV iNIzC2pZMeBUWhjClauIYnnvmSu1PqNUERjQNAFxsl/Htg2fMOTUlg+IU7+YDvTkc981 Bgj6DcepxpTjEGfBjFARp1zHiFPuHVZkv2Uwc6Ic+GruCW74/irQ/HNm6KZMMXOW+E73 /T1pKYc45UoRZ59qEad57lCfXMeIU+4tVtQ3yN2KrQ2CjN0Trrdd6XOpkyLOwtU2IE5p CYso5UoRZ58aPz8Yccq2H7x/+RRUhkZiy6AKFGxFNNeVVaCYfznx2SYYY9puSigpRpxa +hYFE6uOgYKhrC2KQusY1yfQhoiT7ou3JlLzwGZOFsGyitHjk0GcjuEFEefENzxRxIlW zwqwV4Q4URkdJ9cNgxMfYuYUo3rac9/86IhzxNIkxHmMxXPVs3gyb17E4lmyeWIRrIlj LyGdMd0dDDjNUjtxbZqcHd4x4BzRBEh2nMnAIQ09wCnTHvataV4BnFvyzgec4HGz1B4w 54ACsMQDPoadhBryGJWnLv3KA9GdyBP3wYazjnrIU2nxwOBoEV7M2IrP+dnRUEEQdgll xhgacKbSRpS4pHG+EjcxvEnF+uRzlhx9RVzgCHmyaZLQn00RkKdSDA8OeXqax5m7KTHy 9Kki5Olpftj2XEUUy3uMPH19RqkCAPBpYuTp2q+HPLXlFSgktIr9igECKCVGnvoNx6nG lOOQZ0l0CEWech0jT7m3qFKC9wfkiargq7knbeGQp1A9zT8XKVNbp2y+7yPPCicciyzl SpFnnxo9d+hPnsfIU+4tqtQ3WORpJdw9gY9tV4o8hXtFnlrbgDylJSyylCtFnn1q/Pxg 5EnsCPY6SOf2Yldph4yR2lCgVocJFKXrzjwVO6WEkmLkqam2KJjQ3SvlShUAZYmiYC4R JdIqxtUJtAHwpDFkqYoN1n3gWbVHrq8TCKXtfLjZsMP9iH1Dxi631Jb8yjG8IPCc+Ian CTxFqWPw6ePOGrgxhp0Az2m7hrBXoaQ1rD2AixBWH9nQOWZpCuzc/EiAVjmqadZ6+2Na OsXaGqNPvKW5n2/pJLaNKS9rK2TD3o1MnW3KWdg539eFdfUXGDojBFKsMaIJc2NapBZL zsE16VQJJmWHRyjL7QE/lTiwNq1sAQl60dNCPk01ooBTAk0A78CxsZQdvDJf0iXmpBT7 as+xUSmmLMVdO1NFddY0EU7xZcW4S9P5gcxzFVEc7xF+Kl19QtglpYQh0VPifNpa0bji W97jLv91dLjj67jvFddHaaNUIexSlE/mDceFXcpwwfTwS65j+CX3FlARjDKCX/SVAK+6 xsEvobrU0fMm8m/kHPkB/GJi5eCXXCn86lMt/DLPHQSS6xh+yb2FVvoGC7/k3Qqv5Nql 6V3pc+Fe4ZfWNsAvaQkLr+RK4VefGj8/FH6VskiRt/IpgozukStSWTfelZeGkcTA5pi2 mxJKiuCXL32SnvG6YeV1SqwvtD5Bg+ymhHyU5dom7l+BNsRtNS5GPb9IE0qpYtXnZtML aup9eSbFDSpZbmLXuNvW0INtdsExRicHRFIy0XJ0XRVHBDawPMh2b8fvcqht4gviZrEL x8kJe0psjdk7ZGr8IHGUDlmfLpGStiHqircWYmc+No5SyT6CmvVavzGIwFrMUh88jFJn 9uwcs9V7xOmjRlH67HM+ld3mxWYsNh3x9zNLYkfQlN1GosVAxMS3lPVpbFJOzM0Wwa3L 70TT9fuOCHWm+9rsJqjiC9kLCkdm69PqhO3pYWfoq+f22RdILUlsDrdh6ssv3Y4yt1fr C7fpzFHZsivbzczGP7IWbO+bUrsK6MnaU+5r5xYpepI0CA116F4qncQ+oi9B0/dozdiJ fBTC5uBOi7C7lHho9m4mwhZfAYwFMcB2pHjcc6QwfLETpsvEFcEtqK9K7EsczyEGGqXx ER1tCiXkWxGQEeDMlgdhwXlrgbbFxhybNcuSjREGcCuUVoqUZWmUtTOVpkl8mhg2aL4A r0NZAagoVxHF8R7DZK2Ppgo1VAo8bMmn7RcP/9ryAQa5jxPwjSPEtdmVZpiJmclsZC19 1SFWHJUuwcYSpqjhOkbWcm+xMtISIWv6CLLjnnjXTaEKbYWwheet240kS+qtBKTvhVBq zW4jebdcSZl6LVcrQw00RbSSNkbWcm9Rs77B3fFui5wpyezyAYIPrhRZC8+KrLW2iqxt y1jkTJvQ8P5665V8mF6wUfDD3khKZjJXDpw4fZfcJ1J0XKsVVDro3ZYwR6SMRtAeasvB Th/Nkm3RoaerhEeU3bolmuBrb9mfD+cC0yhxAzgabA0htcS6k4Wf2BRa1+V4afVASM0c psXffYRRjzCFLhpCSbTNVoYfbKvR1Dc8Hqr2e44meH2K201HVJ2AqlvmYsfaQvFGJggE ek+DxSwEqwngQLwBgpDw91uzJ2nbPiQUzvZ9SFVWYNhnbwvTCGVYY31gHh7OBAb4DUz6 O5AwkTdsMA1278MGYBPK5wJLCbhg7/67Bad//p29dfE4LHy2uaZu2UcNpTUbw5Rh1w8/ cZjZDlxWazE6MQDJsHHYBmATpjOrxQMJaNh6NwJLmQw1xeYfoSzMwmKAjbEmhywYWjwg KC3o8TLDTJzKAraiQUKDE5XQDC0D0ijNiBAjTXaccbCvLJOGZIRxJQy67AxyO9TLHPnO 2NQR6qKUUL/VnlTb8unYmvh8MdLU8gM+VK4iiuM9RppaH00FVy6VUnjflnyuPeNB0TV6 ZG/TDxNYV0qMC5Q2TqUU4K/77A+ANgXPBQdOuY7RptxbTNn2HDjpKgYZGgTJtcWYQnWp o+edQ7CStmNa0EebnUGogjDlyqLNlbm2GHP43KI8ocZoU+4tvtQ3uDuHDAVjCh+eGl0p 2hTuFW1qbQPapCVsqHvTXoo2pX0sR/2rSWhTuncQK5m6Dxw42QRpuuk+sUIHW2GIzPxB PFRkfKrIsKupRml6yyuaapKGibSAZd0UdYSG4WgT1ywShtf5tQbaCG/mpK4xhu/FmyvO Lz8Qb8rxs+IAb5HEJ2DDdQyPAPLD4c2Jb3iieFNijROkMsabyIwEih8vvk8O2VmyYIC/ noqJLL6P0Nt4j9GMcPgWcGbHA87AsAOcxC0asTwGnP9LDJPgS7CjDdLFNnxAZWswaL2S +I+CPs1fICjX9ilRvcCm8VMwKyX8aqJ5k104RORlCLbt/P8H7Ow4wiP2HyDq0lGws+XI Aymvo6UyezMZcUpsWkVbYJ+c4YeRNUacSovHA6VFGFDCtDPLV8qqFN9jts/3IKfSNBUH 87hUY0qMOgmJ2GYswcSoU6JZ1USmCKiTuFW4MERxkfACtJS4jkrTWnOUzZ58YazUVDHq VFoYqZSriOJ4j4d+rY+mWpVDClxtyaetFeOD3LV8sG/q1wm8KyWGnUobp1JKkIcHgZ2c UYNgOZDHdQw75ZkFkh2uFcF7k67iYadcW9ipV0C88DxPTeAsUwr7SQfuA8Qscu4D5srB zgHV8OaeG5BnriPYae4NpPRvcHdlbQyS4l0gfHhqdKWwU3hW2Km1DbCTlnCwU9pEYadc OyDcu5oBO7E94AojfVylL/TCfXKFErbaIcKdKkOHyVUoKfRLTzN93M8jnT4K2kGlPVBc n+gBT+0no1ReP4U6Bz0DzbZN7BatNPga2jo5i4CVbTFhuZOYeO3I1jkDe7J/tq1N7F0J efwJYE/H8ILYc+IbHg97SrjSqTvcSwaFFH0eY8/jbZ24IzcpUQAfx9aZHw89A8MKPfN2 AvT8C+gRxAi25C/oEcwJtsxSE2IW6CnI1GJS/hL0lXBQ7rlNbLNjMO0Gjwn+yko7dlBX uglTC66dik1Zk65bPgDnRMZfomcTteDfuxMIZ087jGnO8eiLgFMii8qyn4GqI3S6O4Kp 2cfPIYANJ4IyYIHUcmbl7OMf0dguJbt75LSOkoAYVYYGFRpAQI4L0rzo9m15Z2+ryjgN gAbjvHtr++3f87KUeXOEy7kXtO/Sy3PJz3Ktyb97M3+ZYtPNe8epKilG5jZVZPjlkHgi MUSRowpapGMsj4G5p/kBUymhJKX08uHryfFWYpoLOdmbRwhZMf66YbxgvtNy7ApluWVN pZiyhrRxqhGFwV5BauLLCsA80DzEKZSriGJ5N2U5QxNRb219Rql43zBNBOi1bXrAQVte gTmKwn5Cz7oSotooSdMwM9iZSR0PDluqcCCX+MsOjOcp1xEYN/cORhOh2YNxUQ18MPeE wAz+KtD8c5byTJnYgInWMwgblYvTpeVDrpwv74AaPbfQ1zyPwbjktUBb3yB3q1ze7cC2 uXZpDHAWgB4/lzo5MJ6zS8HUVsH4yrSEmwjQRg6MD6jx850eBzvCRuHSL1vWYyyuogRX XuTKoSjtkwqVnN3iNkxhoLM6HDhxG+uU0MM9O6HPO50Sg3BfkVGqUJJPE4Fw1yZxV9Jm GkFwNnHjnLAlxlRs1DscgReMgRhTdB356SNwZXg5BD71DU8TgYucdOySihH48YFNCQTO kIz9NEDwj731aszSlK1XHzZ383ZdcRTwY8XXz1HPywDTHNU+D5gyUOB9W2CfDsB0TDPD CzHiWTmMgCkx4wlCUQlYtaAWhbct73xgap1mAzDt3QM8ifTbA6Y5ju4xMDXp7wemBc4O DVHjGcQinOZo0TCi6SJESbSBNGN/axghcItvUbfxcOBIozRKWBVbMonbXEPJMS7FTQ7f IDFRKy4VB7jORFW1o9+qUEpkmPK0UDtNNaYEJBfKinGp5vRDe6FcRRTHe8CXlOVo41Rj SsjHhgLbngFL0Fqu0T0s1Q+DJLr91p4SqgOkdp9UU61GlJAm2IvnYNOMUGyKTeU6xqZy b3FnxoQpYFO0g8eeXDtsKlSbuvecTy5lCjbNQfw9/wTOxXUBpsyVYtM+1WJToSkmlOsY m8q9xZ36BotNc96t2FSuXZrelX8O94pNtbYBm0pLWOwpV8pHnxo/PxibCmrP+tv8x/KE iA3kab9cqPQEWdlNCSXF3VHlcItqiRXJQLVs1RL3qRbff3r6yDZLD59qU40BKoHGi2oc GqDu7fmegVCJzNKJ6vxU/BMKx/CCCHXiG54oQkVQOlwsY4R6tI24kCCWuOs9JYA6YmkK QL2+e7u5uZ2LUfHSHUTixzN3ibhUeYEbYryyzxflfr5DKUza8thJnNmbA22ndvdbC8wk Lh9Y0K7tG1eYiIYuxSjYcUhUSRi+piHOJySwQ8d5UJoTjTcuTQyWM89+yo0bRNaKDYTx vnfLsCdnL4dK5ywLixXVJOZplBe+7NjmXbwCLoNh/GD72FRp8QDiaBE2pUGIRxrFoSow ANYYYOOxwJEUiiaaRgkrJcSZmDTgz9LHpkwGcs7wjrAp7nSVWFa1LqtCKfFgqDRNlfhU Y0oAc6GsGJtqWQFRKlcRxfEeMOaq0PqMU40pIZ9vqxibaqMHbKofK6AEpYTqUJT7zJqK dh9QQprjsGlhVh8s/pPrGJvKvUWVOJZF2BStgNS4J7kLQSW6ItDCc7qqYlOxs/Wxacmy l323XCk27VOj5w4fyvMYm8q9xZ36BotNC96t2FOubZr+lX8O94pNtbYBm0pLWOwpV4pN +9T4+cHYVCKeS6SQyIlBu1qQJ76568QqT/vlQqUnyMpuSigp7o4qdVtUS4RNlau9WuI+ 1QKTW/SRbZYeNtWmGmNTiUdOrL2e/0JLjKJjsSkGjbr2TpGfgPXUMbwgNp34hieKTRGU thAruw/Qfzw0lVXPVFYh/Vatj247HbE0BZrevj97OxeYPp7xtOQ0jiWAqazKzwOmrMci RJhEAy4dkQg5ylGkeG0LVPW4FOiH2uJkEc2KutuSdTYuLYkQ6KEmA0x8y+BiIL2vsxlB Ay6NE+/DpZx5URYcphTbTJUWDx6OFuFSvAlqAeo6eID4cNgQ+2uMMZU2ShWXtCUfDn1i kxYW3CYOzuDhvJVKzphQsylubiXGVYrSpXtHMSwMaeNUI0pvOV/LiqGp0gKgVK4iimG9 t5rvajNMg6FT1/JdihiWatNF+08KbXTFETS6+4ABISglxqX6+capxpTjcGnJ/ju1mcp1 jEvl3qLPkl0QwWaKUuCLuSeFi80FiFMLa/ycWZQpU2ymEsazj0urXKIOsKeLs9CwNthI BuY6UMOV4kFJG+NSubeYU99gcam8W3GnXLs0vSt9LjwrLtXaBlwqLWFxp1wpH31q/Pxg XCpx0eWQtBiXeoGK5G4oUMzIDhGoyFQ/zBdKioGpptqiW6Kurlxp56esLTpCaZoqaKAx JeikFbEXbNvEAD3QBs61uHGt08JEXQrOtQpOj4jNZQ8YY55jYMcngE3NkWt6gnzg98G2 dbkGuQ/7PlFkipSwHTpGpjuX9SdHVC1yJu8s6j4hZDrkaAowPb2aD0sBpo8Rxz9n2/gi sLQmyLaHaLKb359bu9fuK2dG0d+6zBhCvb10TGP1HC9O9m2JddQD0wxt1qQZ7gAO04IA t+WdjUz9GffeaDqkXCTsiRL0qsZiTJgBzPIUq6ocAsAmcGdJ3Wk6JRZCIWsHMURVWjyM OFoELHHWN264YTiQfRUtu3TDcABccLRRqrikLflwUMtZ+mKU9zlznIGJ4C/RtRxGzXFI K000WwdHHcFwMCB5OKppRoQA6VaaJkKnSvKo0rPjKYUyHYDmytPGqcaUkC80XBhHBW+p 57ON9Smozn6+ADSVEmozTiXr5rvzieBKDNk5i/pV4Xd/5XIdA1S5tzC0wggdACrqgQ/m nlSZW9QXqqf558TuMGUKQOUwtwFAFVuhBaBypQC1T42eO5Aoz2OAKvcWfOobLECVdysA lWuXpnelz4V7Baha2wBQpSUsAJUrBah9avz8YICKExVqqrf7y/fEIFDSVn2B2i8YYyHb TQklxQBVxW6LZgn93HOlPZ+ytmgIpWkqarNL19DEmooO6dombodAGwBU6fWd7KOLd389 BECVzcCyi/WTQaiO4fsQJOdOswz78k1y8k9hE4xokrTLOfuboLsSyyu6FREykTuLiW94 mhg1Z1cKJ0n2Ig/sBKmTIw8UrA0VYZMgzfbRw/6PWZoCU19v3pxfzTzeNPnm8Zb2a0LF 9yyoYkNCk8+NFUUAG1MeB43i9GHvDlzbL9hMVbPr3oRHkEOvxQI0ojHQiucsRzuRjnAK bKOQgZKDNIjKx4I/oRUkL1h1W97ZWJV6icmZAEAW4vfvAcZARPPctIPcS8AmTW+ek5/A QCb/7iX+HDdAFhal7hFuc7RoNNF0AV0yDOIdg1eujgBJLvDROHRvoY1SxSVtyYefWi7x D2KcypbB1EZgVZyKCxoL6C1lKSp1FDMyDWnjVCNKbEvNtawYrSrNg0zx8zVcBYrjPTam 5lqfUapg1vJpIriqbYp8hZza8t6eql8nGLY8JYKrSgs70JWyNd8xcJXTKqQ3GZumXMdw Ve4tACXYYARXURF8NfekrhxcFaqn+ecNWxKlTIGrEum0b09tKvEkEHuqXClc7VOj5w4y yvMYrsq9haL6Brlb4e8usNo94XrblT4X7hWuam0DXJWWsHBUrhSu9qnx80PhKocyS9xB 6dyR8LjOtk+gmKc5FeCBqKdsEagt4qP5QkkRXPVlbVEwseoYKBjK2qIolDZSMHFJo3wr 3zZxO2h7jRb7RRWYs6QeGK7mnMtAsFum9p+IQVUZXg6uTn3D48FVf4gCFkFGpdXJH38f x1+SYJeiiQnrzeIKodLZkvKwwQpynMQz8SV/OjbVMUtT0Or1mwRX1LmG1cdDqw2jdYRW wTSyeWo2WiW/9R9oKyTE3hwIVjM5aqlgAaMA6SBt4rs1pgnuY6sLuo0NAsCSyuwtByvK FKrzecWwOirvCFfUtpLmye1BXsRvjW9xLsB7R56aNuCWGPY+sTwNeeFrlz1V/FlTiSgY 41SlxcOIo0XoEsf2gt1a0XDAfgPOkJURNwwaShtR4pK25IP9To43iXGquP7mcWwtLPXM 07MYpzqK4UFxqtICKt1J6eFUTRXjVKWFgV+5iiiW9x5O1fqMUkUQQtPEONW1Xw+nassH nKpfTOGB8VM23zWGFfoNx6nGlOPW/Ru8NRSnynWMU+XeIUwCHQezKsqBr+aetKnDqUL1 NP8cYTdlCk5tGSP6OJUwRQ6nypXi1D7V4lTz3GFFuY5xqtxbDKpvsDhV3q04VK5dmt6V PhfuFac2rrYBp0pLWBwqV4pT+9T4+cE4FWXEalAfp2qHjPHZUKAA404tbBOMMW03JZQU 41QtfYuCiVXHQMFQ1hZFobSRgolLGuVb5do2cTsE2tCsSrcHTvaDaj2AWTVHJnIJIfjJ 4FTH8II4deIbFsepPpYWUU4nB9XKGQ0I19Lb0n+0V2rOwJAS0+0p4dQRS1Nw6t3b07vk lMi2wdQuKJ/ZtChb88OvHGTa5kIA9JsLGwv3EQ9TZbJk7aASQV9gFWqYn/lIFaVPfuwF eKZSmNyMkOqes1RpEwtmVqxSEgSkF3BJSbE2damCUgQs5mCPSCnigc/YkINSolSWNokS 58PFoKs6QEooivD0bc9BM8eki9Os7KtXYKaUeGxwtMj0qKm25Qsjj6aKwZqWFUCXchVR DOuMviPSTsKKPdhS314m15x81pBPGz0ANfddlG3/OWOYNkiD96L95JrJEwJG++Zblmhe H7ACLqrEQaAo5FIrIZcAXnIGLktDzHd0M1DrghBZKEbvoO7hetuVfc7yJd4ozqSIbwG9 KD7kCRO5c9E0V5IH8+KA6mmIqoFD5nkE1cy9gWH+De6OdzsoZvjwVGKZMnMxNIVqUieF alpbhWq2JSwUkzZRqMa1jYpqWip+vhOqYenQ457isPuiX5qyWMUWxVkSpcLRn8jsEKAt EhU6mZO6C3qiLgs4UujkKuARxWmQWDtoRTQVUr9Tz8T5bJv0epQnDQEaXZ0lqyjiPgSC 16WZnhOovlZ+O+akRd6c2XUmGx4NQFsFT8cjTnha9LB7ZXhBgOaa5L43LA7Q/MFO7SEA jRFAolH4XUMPcGxqjocy4ZOdkIizwKLx9oujg55GDPsDnqYEPf01UUsJnG8PaSLovhx7 qsc8VSs5CJUQ+wQ7taeMErT0KwmDao+B4o5TSXnyzKSy+QifylNbkqVzjqk9KGrKOaOi v4wvBgFT5GihaN9WWssBAsTXMP4b7ufl5eAU1c/MwVTJiZx6CiPEXv0aPuUoV+5gTojE a+XvZ4SadUeqUuufmRNRQxp4t3Xmmb22h8LSFr4Egqzy1NK/igv7zWc0jE9mE2j5jj+b 939bhqaejoVdJJXDPbVxXIfd1ySHRoJV5fp4h7AWad85l/22smA/H5nXJvApxxTg8EBh YqCeicw59IXA6T3XVKC+pcXYXGk6HPKBijUTjeiYghzX6nTgmuppUT6XakwJwyjhIgkr MYiGKjFp2140VIlIS5+R47IcOveUgM7xe9iZals+jy98voDOQ1keL3uuPMXzHsNzrY+m CjVUCtHuXZ3jfNqmMULXlleEDrR3X8zz7ikxRt+dSvOFkmKYjjaaA9OB0TheOshuriOL qrk3EJyryFFVuorCdHMtaShJHVV7z6PIqCSjS/Vguo+Mag6mtzCdeYLGSx1cKUyX5zFM 95FR/RssDOfdBtoLJBc+PDW68jA+OKr62nqYLi1hAblpE+VD2s5NHHpX8mHuPYu1dzoW Ww5xVTJ9PMjaFLmSSb/RBJGTiMrQYXIVSgr90tNo7oDWtfxIOwz0DPmsBukZAbQ+Ub4J eoaVKNs2vaUKba/Ryr9ohDqOkWrwesVqWnTw0eERqHAjI37hJ+Snqgzfh6bn+6lOfcPi eN0bVHNwDAv+ycmEhX8ZEzh8OjKoPgRgx80QD8V44X8U8v8BD8gqjwfsgWEF7NhJ7j+R tSvA2QJb/1VPFZAbJQoK5St87dLIZ+H2XwCb/IBD+fuFvREYyp2iUguJ7SP5qoKZLaIF /PIC+5fnB4F4CYDfyvbzs0utZJNPqGRu5xJU0eJr5iBfWVL+k+cr7mROoTMVWKciEyF0 2RE0PhNHWMvZoQj6/wFqzdyyCmVuZHN0cmVhbQplbmRvYmoKMzMgMCBvYmoKMTY5MjIK ZW5kb2JqCjMxIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291 cmNlcyAzNCAwIFIgL0NvbnRlbnRzIDMyIDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzky XSA+PgplbmRvYmoKMzQgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0Nv bG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjIuMCAxOSAwIFIKL0Yz LjEgMjEgMCBSIC9GMS4wIDggMCBSIC9GNC4wIDIyIDAgUiAvRjUuMSAyNCAwIFIgPj4g Pj4KZW5kb2JqCjM2IDAgb2JqCjw8IC9MZW5ndGggMzcgMCBSIC9GaWx0ZXIgL0ZsYXRl RGVjb2RlID4+CnN0cmVhbQp4AdWdW5fcxnGA3/ErEIpyliI1wv0imb7RcnyPLdLRSUg9 DIdDce3dWXp2VhJ/Yl6TP5Sv+obGYC4AdrGakOfsAI1Go6q6urqquqr7n+Ffw3+G5Syq ilL/8JvX5axKpKA0F+tl+HW4Cj97dh2Hi+swmtVZHcV10VwFTdn1IszSapZFdR3GZT2r yioJ47yeJXVZhEUczdI6S0PafOt/PS6zWR7XYVbGsyRz9YLtb4cR//nGP/l4XGVVFEkB /91dls7SqMzTsCzyWZzWZbi4DH/1AhCjOCrCFwKfesX8vLgMP/tNPIvCOHzxNjz73Wqz XK+Wm0fhi7+HX74ARo9GdwdllcziBAS2oTwI26dTA1XM6jItxpLu1+v520249e/5cnGz Pl99G371l+d/3Hqmb/80/xAmUZw8CvpTXPinxZOqRw/yRVonsyItGooHii8Oc0M4McUb Zs2LWVLUqWHWg2xwf0Bl5SyJM0a9GkEnAhTSJUXEDBvWsNrEXZkjLYukDssWfAgmETvB MbHzp789fwFT/3252ISbd8vw+vzb1XxzA5vPV2980AMnsPcIo87QmNVRXlUIVURvUmdx XDVXwcEhk0TpLIuLYjdOHVEabInSzXo5HyRHfdADPdPsB/3wLJAk5awo89yBfgqjPUmT WZ6UyNcWj/SdmoQvrl4rFplfh/OJ+TmNciZSBv8WsD+qFEjRH+I83x5lfSm4ulpNTbUk m5Vx3Onig1Sbel5n2M/yIr2LrlTK4i4tsaOpHRI7MnZFuKQZdEHjmNGvdQiUcV2ltVHm 4iyXRt9q/U5eoWJS5YKGeSOa5XmGileEFYpmlCWJiJDJFUsAzcrUztU9Fct7nIFa8PWd gWTGWb7RapqWMrOJx0qcQ7qsYDC3AA4OjhV/LmyMlz1zYYcpj6uJjUaWRLMiYkI/KeUn jmd5Vg60aZJZOgvD55ur9fxbppC3SsN47jSMX88384mV7yROsXcihq5B4BSm46arI0yD knn5lLoaY2BWRYwODdTJSZk2fH2lzAt0mPXy+uZiI3w4f//+4oMYh22V93K5eDdfnV9f hlerxTI8vw6XP8wXm4sP3C8n5tS0rPCHxKFF76QYtajQLvJ44PC/v5mnDV9fnlgtvw/n m836/PXNhtn7aq3YwcxBYfhLdN1VeH5xcXO9Wc8351erJ5pfNuubhTKRhJOmZgvrPbAo nhZflPmsqtA6T1VWtODryxddjUREAabP26uLi6vvrz93+klw3Efn25bKi3lcFUjiEn8Y TkkMSUXe0+rzAl1c1OaTmrTwgtR5bgXUaWhyRVYj0vEIDx0dk/uM6MK8KLIyHAeiE5rx 52H43fziZhm7ITGN21oc+WUe5dsAn0pHR/grc93PfaWMckJPTDavn0dA6Lo5sd2cTAyv 180+vK1e3vb2DTLMtqRxoBdxDjojnbaOI0McB+1uPuqMHNzNPojKGXl8wmi6eRSIrp9T 28/pvfVzC+ATscCLJMHfU2enLLdHgTibTe1accuLWzRsjeBwy18/aATfxrVS4A3I4sqq Lv1N23uckEeB6FZtGMDhd0/jL8LF0/X1h9Xi888+o9Nnsy/Cy6fX7+ZJXnx9vnn31fNf frlarD+8F6Pmi6ktmCJl8SGXNXhN/dPSZiPW/7PKCPW+/nwl1Ft/phaYKU5BiSkoRsG7 eVq7f19MDSr+oxKTsA1pe7n7R5vD8zqfZbV1oRtVrd8c/qN0dxvevuw5f+qm9Pixu0ya y/SxyISpB35MFA4IENmjiX5SAz+vihmT1Ji54MfhhFHwvn7609fz6yXRJ29wtv9s4qHv 1u23iHsas39OXFmZJ8VJOS7yopoVBD8N0zWTWcbCyp9vLl8v1+FXy+urmzX+6mdX3y1l pUV6OegZQuZbGz3dU3HFomcRJ6GF/bTGNZ6CKjGOoFOZdVhwrPNiuOU4ZLz6PdnTbrSh Q/ko+L78bol7XC/qOQX01dn1q0ehMKLnTA/nrI7jJzp/E84Xi6v1G7X0ciU1pp6DMEjq NKlCi+Jp8WqWSAysjXPrb48M4YsRBpPjixZ8fR1bjhd0l6uVk3B9c7G8VusnH8JLAi9X V5vwtSzJXSy/m6+IPVPcYMKMJtdMHFcYBE+LK9J0FqXOwX56XNGCry9XMNY/hPOL66tw tSTcg/5eOCnhuMAGQYcrPbWxYqumtuupxUTOLEy8WZgb3E6LIYjtiguc30PXEe5LTLTg 68sQl8uVuB/ghfOVN1fczkN1LPhrf/i+RPIQeggLGGymZ4HbAEvIWk742RawPWUFwRC3 Yo1bAG6cA1twT2gg3AbWilWyrMMRPYlMOsdl+D9KyP1IxE7yGOUny0Zyyf+Gl8vbBfuO p31SFsRkpmNBX12H/30roh9fc0lwahQRiT2WlceblXcX26qEGFlIACV5PsTrkewzS5JK Qu8lbWl/bKt748eJbc3jnEytKBlPxQlCMfOIwN+0bbYdzajAOzQx6zn1fAx4yP71klin pZpz9ypc4Xt0L2ZomZxffvWbZ2lZ1t9MrYVlFXEv8ICh+/Qz8PFh7lZ/M9ITyeKy3qOe k8D9MUMbvr5K2PKHzXJ1jRp2bcNzF8v15vzt+WJOSByMslyvtbZulLQHiwfh2/PlxRtT f2qWKFPEV52EFr3T4gk8YRmZTaeqmGct+PryRGO/vzojJtJ0/M0KLpFOv75ZvCMu1vHN NmMIJ03OFTpW1uJ3WkxB8jG5IZon+tL8HuXEGPAw3kNPMODIodcXLCyEl0RUn7+/8BIH J+77hETtlORAMrYVnU3f95THhHEy85m5DUelSn90OvqETnOXBdwGe4ThM0RbrCK+m8CE VU7qvHdBxBMpT7M8ZXkuYwkiT7F8Y5bCa2QtUYs5wd6FzoKaJMS1mVZL9M2iyod1430O Fw3fsOEs48X5rqwEfb8+v5yvP7S1w0B1J3r67n0IfKd+3+UZ6VcxW7NRpP3H8sPE6qvL ybEAnoLO72Kut4DqKVdMbpPJkn11tpx9O3uiQ2PvS1EyU2K70yeTL8+eI1UOJHiHz591 9sr4tNksw3B9SV5JHaepjP44SolKZiDEJCuH2/cX4XMVWdw0IaGbR1ssTIu6PXVXkEV6 m9aKQppR8Jn2cu5HtRiLxPUwbt2PbFGAERoKhDFGNXejMXbvG4zdfYPx8dlhxPpTMzsU MavjbORyop7vrAVfX2Xvwfxm0PYEIyhIqENSineqDeHhANup08FdcOgWUD1lLGtCnz/w ErYk+2oV+rScKB3H7kZhwe5jbkxNyySq2LeFfXwsUMOGCLQ0a63tWSp8cM4eRIrSE+vx Nt/Rwt+HqG3VyW4gtUd1GjFqGrmTJxJEcrJ7vWQt+PrKHRcJKCqJpDbqrm4zgnIEPVhf kRIpo41NYB5crc+/PV99/mBqjsAOwc0ISxvsxrPEXdlIbq+ILItnpcTftmykhA12eu77 MEKRb7iRq7JMCkOPnuLyHm0kA98wG8lxo+K4+dRjO04lCJUkLbb+UNQcJjDVgHAjZWoL yc04o2BdbhZTA2gzVMcRc/bq0e2W+Y/77d2WR1sQ/r8yiCRzIowr1nu0weHfjzIPokJs K2lRGTDmDmPhVq3J1hqt9nCZjGsxzuTVBuPW/SgY2UXOw9jejcXYvW8wdvcNxhMbRCkG c4RLTxtEI7h5Cm0pKQhYY3u3QVYanEgM839IVOj55kP44vyyu0XMxBpH4/QxGIzXOKYg ayzbYrIL3kn1NXYH+wpaBjw9XaQFX1/NmEVxHawqnLgRTjyX7VgJWVaqsrcrIhtBiHNX Pb5m00SzKEbZxLyaVmQvVGQfZwbDk+LVtGaj3dTtv3BybNGGry9bqJB1xxLGx+utg4U3 13pxnHD387dwDpzhVk9VsPPUTGE2DbLonRhPiLMWH9SgaeH+zJa09uHryxMPdOS6RNA8 0KLi+v1yQcQEnPBas8CDjRcjMTEHEDM1K1kHDy02w4zELY7F3Pcsh+Fbvh7Xy63bZwvc 01Bk0oq15dgFoZ2eFGvB15djpY+vVKo305liX7bLXq73cu8PHvfew7xm08Mt8cfLsLvy +mBv1RGrRClraRnBlBjhpLtVel38nnw+aUmOX1pXw4bzPQpPA58W7n1Z0U2OnpSZYjPN OMJAI7fXUtFA2ZIy2znogzwSW+68PvvIoDXP0ipCUrdJ1wKKrTEC/1SA3V6xvYzeAuvZ c/LF73SJVqKy8zBJGBBi8Ldux1jnCfub6fZUa+qGsJRRvgPTVkyYpobNtCYQj4EtZ8dn D9fW7bj2xGcgtAPXXLlMkrG4utc1ru62wfW4FwJWCQaeZEC36xMuOKqBEBO7Qc6JJNmm uZzkkRnL1EikPls7DJFF/gAbmGQ7Dr6v35Fku3i3XPxDcma70XY6p5JAPFVHh7fJ7qai jpJjt5wv3k2sgaY2mdIiOH4Cn8CJkmakaZzwqQ1t+AbPoxKI+eb8u/M3N/OLi9sFbh2c Kg7ukBYXRGLmWWhxGaazzMLn2oBaCApPWqNxaHTcIRyOHDlBJnAiSbcWiV0qg9u4KtBn 9uyenfdwsS86zHFG+pAJZunO+RhHDpngfJRINjnYAlYbLEczVKzRp7LwPberiV67ZL9b ixkRFd5U0k/v2H2AhoelBJ/CMmwKJeQW5ToOE1DKslJCVE2ektBrxx789gVmZ38LfuJc Ry/FdrmmDez+pNFmRuRkADbyNlvG9Z18SIBfXK02cxbi34TfszGX8iA5r1PLB3mhXJHS dTJCRkcqj8fVncuRjsLVc5tdt8b4kTCOjp7SxQBy2wF0UE4ptUV2IrMYTD9T3QZYEw2x BWxPp4T1TO4k9d5x3ImZOQa/GQBQlA3CM3x9KduvRGwtq8dxyakaeli6jTbtWRryRp4T dd4MZBV3jn2tR74nd/ZI1MHQ9hnInN9TxlUybA4z/l8mMBPt27iBp966QM66U6ngaRvy bbOyddjcIFv3DsmMaJ9FEYbDEGDtXMRMNIInjrsk3X5GFijjsD5Iwd1ATTCwEvRXsjdC iV+pcEK5+XHfuLIvNONKnVHDBDl6XB2nYTMRxnwtc5FzI2jYd7APASqqWUklsuyUVlLT CO9McmJL+aRakvzjlvJPo/uSikNcSF0/qe5LZL8QFFfFUifiAkk4eTSROVUDtUdV2HZ8 /uH8esM2TP84D38S/nbOjnKXxIby78sf3p+TxBT+mX161EZzcfxEHZgpD71/L/8ip/sU k2eH25MwLJbTa28DRAxqJd5d5PQJiJgYT1hclXgbbw3U0QntJcfXxuE3UOqNPqj37hOD kgzNBmTYADOr8Q7jeE5VYktSZLpkjD9W2ggTFVEnuTwcPqtvdFvemcMHT4IMErUfrznv sUhwIABep+xCnTqXpXK6sSjARLjhlE44/gmdQx8qKO8GUoZanPntXYTvsINfahJva7DH EqAktRM2EFe2wrK5vRCkJRrQoh1HcIutrJ66ysD1TuVfSV/H4pvIWXaGgBxqi1pCBrxy anfKLqjHMlZeCdq6XpDXMGdNABHW8oz46po6roTJR+1ztaOsU8tvacd7svlskUqqV/Mm UaslBPaggo9IL6ppy+JjSkIfR1vWrdUpCTjmGROIo9LkzDHdOjBkrCmmKRuMuTL6mGxb OfPYQuWVaNhVW66WwadTi7a36wgMtoyjP4WmdKFXZijfQGV7sYHdlvj42D7s1uqWLBTb JuH3A9MA4aoCniTMUY/19v1FmMZy2gFiwNVJY/a5kek4i1Bc9F0F5XkfCrbuD96Zumku 4bDqNeUw4FP2m0HKRq0KILmQ+uJM8MtcCedMZuTgykMGNSMf6BJ1K+KMEyVZQQE+fcMX pb6Uc9m9MA85g1JTRVqkssPZth84mqiPuzsDjLtvP23fSb+Ranlk6RAR0LATwZNlhHp2 6ZUZtlOsr1kxcAN+JNvRuh5YtAQhROjYEideWsPW1tohhpxQaKBqxISFXUTAtmjaX0JL O8SQpY0//JoyfWKoYBFzdDyiAAmcYqfEHIvBdsUFodBYU3URb9vgThDLhBDVCQFgnHuv nCzNbdOunHAauaOr+ZLUND/qMAYgR7BzDv3L8Ow5yYmcvhKesUkc8wsX7+3FO3thHgVn K1uCQazq/sG95R7R3jfhi9/rU+0HAWxUvAZglhmYHmOgV2BjF2iwz/6lcXTd6Rd8wlgU C4vzZwbnUhcEZ7aA45A05TgwR1/Yd10Bh4gpeuW2hnuiqwZnf/mTTzdxfcjAydTRtcwZ Uc15fOIViCrCv5iro6jkHHe85lvLugQnHHSLNmwCt9XEnPjmQykrqEyjwjD6R5sP+HEc w/yaLk/Ds4tHYaGYhmu6PLfXhJTBQ+Bbhmfg5rECQkac/VGkvYPNHZtVEP3CZku44rZA Yt2jA9J21MTmnZwAzrde/F0znec32qvRWsq9ZHHnfjTaDA/AZBpt4dTbgRptSpwKjll9 aLPRaLtlzJCc051losA0Gi3ndqPmiCTjoHGj0e56d7xGS6NOSUWj9W/RWQuVUO802oJQ aU+j9Sof0mhpoyqRMYRpNFqhKfOnElPP00PlsFnR8ZtJgiCSWh03saOsU8tvqfseefCz smYTcU+jLWoOMWDPWlo3ejZRGeyokJeNRmtL/KnRlTkM95f4Gq2r5Wm0rswpBA4qr0TD 7mu0Dp9OrUaNcHV8dcPQtKXRWso3qoXtxUZFsCW+Rmv7sFurW3IrjVbiXn2N1t17Gq0r 08qnbN7lNFqJ8PY1WntvFFXzdOvOaLQZOSRGo8UuQe9EX3YqbYZxprRWuTAqbavMe6g0 RXnoqbRyq7RR27TWaeWbRm2VS13Dv7AKr4Xc6LSpxdrptI4q6uvuzui07r79tH03QqdF uBUpwUS+TmsHc6PLBRx0o4f8SMZzGiwtGRGzi/HcMHW1dggiJ2IaqDoiRgkBq9NafLq1 bAktdQVRaWnT0CH0yrZ02kIOf5FNHe9ap0W2R6lw2WX4qxdBoyKKLnGSOq0BeEKdtucX TlOnlVkjSkhwulOdlrNVmM3toS9iLGFpdRTIe9Vpt0BqKdcuwkgp14Hoy1aHFbNmn7aM USRaxlbLILtLW972/6+X395czNftyCsblXFYXQ7YHBZI70ddjsXsV7G9TElcsMuRxCGP dv42O03FbCdo7jrK8oEt9BodS7bQY5slmS6cqHZlnqh2ZVbAsn0LnqGkEn3NiOUM3xee HlYSnECnlinr1uqUoGM1ZRmNZqwxejqjbGWBa4xtza3OmJF1naA6e7CbEtWW8Yzur9V9 D9jdNGbfU/qa8YLaskbTc1A5bRBDV8Pu6X62LOjW6pb471n6eVOWo7ybul3vNLDbfvXx sWWdWkBlPL+upUZnHOXAV7oXnCm+tebaUxnVM6UuxmXC8YriYxR3qIwVOsFdB+6qKXPP K7aIN/ohCxPirWtcnnigMDn0t+VqQUs4PbdKmzKjlqnnnpao7pUS6L4gdwECTRjdPOF6 15V9LjgZNdFh69RERQml9qkrC4fQriltroxKiEztZEi0g/8avuKMkJph4quEblzu4Ct4 W3N74LhhF390y/aXNC15qxOu9V5yxskG2rqdnKHbrJyB8Q1tfDo0ZVsqoYz+KpYNR62b UzyiNXuP4oNpJSUMc3PKVlKc9WRUQuvf1JqhnvR8zWeAmzP03ZywB+6sO3FzWoCnUwn7 fsEnjPY/hmfTuDmNr1S5AqHkQTenTAok4cEF1s2Jg1xFCXe9nGF0OMBbRpVysmecihG7 jdyVRthDH3x2pbyYl3hrcW+aH/yesAJ+7lh5PDOFFD7Ql8r7iROY8vwR/sSzb1TJLh/o Xq0uR7upaiJMPICDX70QgDkzrAOy1hxz6xDHj/9vHynwnqpPR+ovOh7ASHlw9hNV8smj ELAfq3Jd52PlzPWf6nY4ExzM/1UTANzAU1d6dfYogAz6uS5i9zvq6vb0F3QbPPXcv3tR b/qKuLKISFEzQAT1ou6B+kMQ/RRM+R7Y/YIbAPzbH+U2OAMg7h4/1L+6SgJ81IdWGm7+ mib0A4jimgMtHn+ikNZv6xJe6IMceYlyjDz78xrksGClX3fYAa43BZHjdkDOIcFVSQiC bdkjGwEH2478Lsf8glUU0PytItB/qr8IAUFKx5vvN0FywveLSrYjbJDCLN+DlEmf8JAa 5KAHRt/iCJ7d+V60ooWIhVGhIvsWR8WcdhuLw23lJHlqZpujkRZHKmG/2LW+xWHLfE3A ltm5mlA1FpHiPPYsDqQr26qz7uNmdGqZMu+9fSW+xcHqJe4e4PIsDkl4JUDf81JLZnVe 80VnLdkS3+KwZd1aO0o8Dd2+51sctqyxOBxUTsNzsHuWgy1rLA5b4rdkcPbec/TzNSJL easZQmXTi43OZ0s8fPbX8iyO5j1ZXJG4i1tYHBXRK9bikGvf4pB7bU1UleTHW4uDsdJY FGTjmDqUNlfGIiHqVbcpgRtqpzbf4iBHVt6RMBC5MhbHVqn3XOv36rlncah7ZU24L8hd oL5tLAp1beoAUXNlLQ7ByVocFtvG4hBKaItCrqzF0S71n+sYqgEWBzNFHasx7nj0EF95 FoflhpF8RUsm1MLxnm9x2NZ7yRknU9h8+HZyxpNPQWZp44+vpmzL4kg5NCLO8M84i4Mg IrYZvaW9QcAHfGiWy1se6NM0NzS8E1ob/T5w18YGmqcOsrAxFehjO8MvDhobwiNqy2xn bGC/EzWDYOhaG71jKnC+MU/bMHFxP3f0sK7zebSxUdze2HDwWluDXI7jmuOXzoJA30ZZ RsFGuyMERNTn4OwrpVc+VH/FgqAS2wmLbq7Va12Xbtt6GxUdVRsDQ9RSsTO0Ek67+m3z 5AlxN+6J/got9lHGG0uD5beI/Rg8lZkg3OOIfwwCYmmItQDSAMyNKgts2aemyu91TZhU akIw+UkBV9637QC3a0aw01aM2FfkbMkLpjFdz9zYNiAgNSANDf7cvitFP9XvKiCDM4k0 alpKP9ZA26/ZX1MLA4AuGExO1ggJS/KPdSF36Tg5v4YsGJYgxF/gqtSn40iMyaBWrEUU EdBIEehoDqMulOAvMG9dm6pQxns7kLf1N8xzmBKKCOq8jzzhu7pF81zfwMY8pgM1A9Ki hgpzF6j0NxzQg9iPraVnZV76hi650MfpZexWPeIAg44HelABMBlkmgmASRXJ8Hp19gSc 1IW2dvWdrvIYPGlCF+mGpCQQnoILjMmsxykN6c8+1vfmW/pdYVYa0s3ptiXQDetbF+m/ BpLtbw+jXFUTaVR4CZtRL8r918uXr15pYDUwX2kwPlJCxqDmMNUVXz1S5HmoqSGDyuHo ZB6Uffgk0fW1j2APUdVAhaj667bpJxoK3h9IhZhQMm+49fST6K/pv5ZxpKdnjwLBzaBo KSO8AaL8xf8DohpL0/H69VdKTlHjoWEBdo2nvZ/rqqbM3D20VBLubOrL9zVRkD3uK7+D 2nitNOk1EK9aYGggG2IPox/nDBKT3RL/PYbfJ8ApdEplUkM0gBCo1FIYKOKBighdfmAl KirhShVT+IV+Xb+ma4CatKiLRLCDtGldqKdb6oNbTqQcyyuyCZbGzfiZlBOtjyz+zPT+ K8sGmuq60x5/lCoH2EfGQdQE9+5eo2azBnRlRqYHTcdBpDWhnV6vgQ4iFIV7yUlKZB8L TGWbkYS5dxsHEUar3lorZ4dqczPEP+T8IkEqe7JUrbQcW+RZbbbIOXmIXiSPH83HK5Fz jhPka7esV4n/Hkc7cahzgmOmaZ8Io7LGaemWo9mFhRxUOfvZhl+6Es8ItWXNIrwt2fme NWgJWzWti+FolqNtmefksVA5wzs1sGOEdss6JX5LGufWe+RpCk3xLTRvWso3UOkubHw8 trc815AtatAz/d4pYMEzGOkXEgPX+lsk/U6u8aPgwvb8QupeeXqSRMLUrV8oYYiAu3nC 9Y4reEuXIiVUm+IXyiFSayWaZs1KtLqSd8RH1CrVq9PmufK9qGvfLyT1tafHfsHcqZAL d63DGMmmNWvS6sr5jcDD+IUcttYvJOOW7CTx8KurBS3Z611XB1aiWSDxNjaxrMLYZuGM 1GwvNjEdwlGNd8eyz0iOagaoYdVxosXz65AYZcRNIyAsat0SX7QYmrRGlCITwmbbG4QI KCLsWucNwtuVcqLStqE/bPk5JZ2yIEGl41+5RURioP0YK2Z+texs12bvZPl5L8B3lmXT 9wuTe4RcQg5Klk/Jwx4hJgEyDMRraLJsOKC8JJpwm09U+krP5Wcy/Djo3satymrupB6h 8tYeIQ9g6xIiMee4aVpWSuMV3dWY7Mp40GZFIIosFoPcif3Q3LW0YFGv0ZbFFUENNE+q fyKeE+6UbsztTxSGttS8QdU+OrJz/7AgO0vzyLci8Q4fRzI1BgDr+wKoaMyABg5o7faZ 0d5NTeWDUWCLqWC8QOaZfUMr/8YBg8kQeO6aj/VD04y1J6CCNGcb6IJjn6l1f2oqevFr vjyYXirnpx7sLRPKhJImJx1vcNBlTzSW5pFGB5OOavp5m4r6uRhELRy4UWWBNrR4WXqE UvMpQ1KDtLlrtdVym8n3g60+0rV98gtPKkBbDZlv4GPh86qbaMr2DzWHsWcip7vaXXVU CEhRyz5/h4IGCAGxcRDGHyFQA+0rgReogEK8FU+Vha6LgJoK2pTXj3U5fQBfSx/whq7k W4P6sWpeMZir9FD7pB7rtvSN/w2/de2O0k1JzcD6m/QLvstBN6er6tcoGUZR9geo88I7 Uy3q4+61w6YRPkJIAIFqH2ufCZBQZCsCu5BcF+p6QiaIaX0H9hb8dJ+oBsXTbQa1qWBa Mj+Gd1vegk+sNNBfM+4CHFoNBKb+Jxb+dmv6PTPSbGM+zwZ+Fu9uQ78RqexxXCWiVEuC huJZ9nvc5tktkx+e/RQXDyQwkAmgmiP5q5+YIQq9oCIgy3NVLTgT4ehu3UPrW4etqUon NM3bF/QAVQFAqhMUyT4V6cwbBpRP/51bntp34F0e2jfNlzsiSTxBMsM139Rg+IJBjTja Esprj7Z8VrqYH9/BwokM+5IAxHxm/UKSuVp03ychApK9hXo2rOiv/wdCM2YRCmVuZHN0 cmVhbQplbmRvYmoKMzcgMCBvYmoKODI5MAplbmRvYmoKMzUgMCBvYmoKPDwgL1R5cGUg L1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDM4IDAgUiAvQ29udGVudHMgMzYg MCBSIC9NZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iagozOCAwIG9iago8PCAv UHJvY1NldCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+ IC9Gb250IDw8IC9GMi4wIDE5IDAgUgovRjMuMSAyMSAwIFIgL0YxLjAgOCAwIFIgL0Y0 LjAgMjIgMCBSIC9GNS4xIDI0IDAgUiA+PiA+PgplbmRvYmoKNDAgMCBvYmoKPDwgL0xl bmd0aCA0MSAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB1Z37k+S2 ked/r7+CJ6/tHp9cKr6Ljru4WMt27OPs8FqzexEn6SJ6ums0te7HqLtHY+9ff58EkHiQ VdUku6unZhShJpMgKgEmEl8kMhM/Zv+W/Zi1y9W6ae0f/tZdu1wXQmjdxd0m+z/ZTfbV 1/d5dnGfrZZd1a3yrglXi0C7v8iqcr2sVl2X5W23XLfrIsvrbll0bZM1+WpZdlWZUefb +NfztlrWeZdVbb4sKl9u0f/tbMV//MaP/Hi+rtarlRD4z99V5bJctXWZtU29zMuuzS6u s9++hsVVvmqy18KfecX9eX2dffWHfLnK8uz12+zsn28eNnc3m4dX2ev/zH7/Gh6jPno+ LtfFMi9oQJ/Lg7z9+thMNcuuLZu5Xfe7u/O3D1nv3zebiOmFl7Y9PSlykcia+VIHv3fe rZd1U619Ty7M90YiRn3viw9325sfsr/8+Zv/3ePc3v7x/O9ZscqLV4vx8jCjFWVXLJuy CfLgWnFQHrKoa8NA3tO1TxpKdbMsmq50Q+lEmKraZZFX6CQzvk+EKXRfiQKcpnTKZZZ9 s/3h5vzhAwPg67vN+cP29iY7v7nM/uP8antpb7952Ly/P7IcFnW+7MoKOXQNOS05LLpl 1ZYnJofFatmsim7qJ8/56F+f39zebC/4xv9lvnEyoBduZt4zoGdombxGK1ZNl7WO59P6 unm+rKtWJ+wTGdArFHPbqsiNnFWYO5JPqSBrz6ecoZtrwFmD0LUJf27WWzyGcl6/22Q3 t0bJ3L7NLnpSmG3vs839/ebmYXt+lT3cZpfbH7YPXN6rjjqyFiobtGjbooVc605KTpkI l+sVo2gSsHw5kUj5GysSP2xuNndh3vkpzDsf3/Hop81dxjx0jtZ5f7cR2TBl77NrANLF u/ObHzbHFop2zUolz7R5pyUT62rZ1rnqrpNTE03C31iZeHP0dVBbLKt8XbRZyuDY1drH zQaYZPQS8il46fZmk93eZde3ACmvrjKkd/t2u7m7Xx5bSPN6uVoxh2l7TktK23q5Xucn O5k1CX9jpbQPorLLzdvtzeY+e3f70cjDw935zf3b27vre0QEcUlVWHb79thCoZrLNe+0 ZKIBZuar053NEv7GyoSZqrY3YBe0A4MfaQDovNk+3GcIQqQZ+tOeURQXZm47uq7QNX/j mnhacgHC7Or6dGe0hL+xciHA9+H8/q8iDbtgLwJzff7XTba9u9tcbX46v3nInqQclt2q Xq+xaGL3LLoqz9dMbe7qsB2zXNUYMjFvNLsaOrBjLnp2zPObv09agsSryYVYeR+3vJUF mCdnNpnH4eX27dspi6Q5HFbVki7HnjyrDzd3m5sLNMf2ZjKfi8hePqInvSZI+UyWwP0v vPvzGpvBY2Z884GHohmEVETTCGBddnRevewK1po51pdViWHfWtvzquabLN4GWSkxE65r EVn3xmpZ1xU2+CZbsxOwqopCvuKxLf9N1bFSYAvgVBdoCX9jVVeKWsx89oA2uz+/BvG+ +c/Nhe5ZLMbsWcSjyezqPC6lRVGwM1SCbR3/x5+vHpPR/dtARdFit6nrPrMjV2YP7861 O+dtAT2Bc+zaK7MkerFuHvHt1S6s337a2Pp4++GKtRnyevdxe79h6v1wH28MZT8+v7Gz rDHToHCU4/nSulenDux2j311kcq2bNGp8pHrosmYQ4vVeh1UqtS5S6XqCz2VWjb5y6jU FZsttf3qYzXWC5q8qhns9c0DFvWLvfPt+fYK6/zv/3Z+/f7KLh0e3mEU/WRQcLWs6gKg taOZjyPBu3SkPWKLjieGsUDQGz0S/g6il99MhlTBBWExBpwCVtZ1J/o/Fo2Ep+z19SLe +38ComIKFSeIPthnpERgv1xx28BCw+YaVq88y/F66Lo8Gv5mMIcGekSlb/SG/0shqjJn WxO8d0p7rQ14pFh31bSp6AWVUsLfWKV5m1k7uzdaOTv7+fv3V9vNZfbm75nAPjFwvDm/ RzkJVMHUdf8gdGbVIzsq6NaM9v78afX5NsO8z0+Tl2JPnm7MOr5UBEv3LB4twr/Pvju7 /3DxLju/l/07Ixrsy9n9F2va+uc//1R9xf+ajH2at9u/be6/PLZI1GugNj4P2vunJRIr dGy1VtU1Ev8jDy8pErN4PP/wcHuNCFxk55eXW9nM/er6FqsK/gS6s/uFlYzLL7Lzh4e7 7ZsPD4hDtnm4WH736thS0ZZLjAbgb9e4k5IKkMGy6k7Mk6ReN0vU6nTtNQVLDdYsjy/+ MEoZX4OUvwkTmpmwMPdZg5rYXq/YoMnwtLze4vR0ewe0xt9yMdLfMoaoziO1D7zGWlmL CgxRsvuxs22PYmtWsZdzzIPZzSJyp+0zn6LGAzaOtlnmeGt55k9hiBVrnGlZrXimpsEz sQqLmDxk93+/f9hcs2N7XE9c72uSSsCiv1JIvIQnrhQGY+6xlYKIZS4rvpp9+xpv6wz8 v161XbRS2GMo8G98mpVCjdd4K4aNU1op1IDWBtfmaaJ4fADgFWvC31jF+lpMEtcb9rbt GuBJA+UxidyvhfJSplJsQ9rLY7TQ+adiFmsA/rkMLNflY5jdPdqfb/nCRgp6nH0TZWqa nLql4JN69HEQIMEcec1OzjwmN9n19od3D26p8rQenS+r3r1ZG+E+/8hVgeCYJ3XzEzgn MKas8tD90zhPN4/SRkw1vR9qxOJgrAYmJLsfq91vBd0pvEfRFrhxSu/HMHHUjud+HVfq ElcZn9b797fs0U1hfQAYHh+fJSFFXVmsZ45PRPvYDBJYVuF91mfwkwItmbxqdmVgirVX UzVZt2y7im1uhFICzNDNFmgZ1VHJzrqWzDGKroqyCCWN8dZ8KhOkpsZb/8YQktm6Hw8x i2V55HatN4rVRN+xnzhNZF8Q/Fj2ElXwqAP7/Yc319uHB1ZfxtOLwDP8P7cP2UcMY7Kv s7n8Mvv4boulzG49mg3H4PZ1bNtHUyJVNco66foZkv58ICMSBzYq6ma6QezI+sGDYYJU An9jwbD18E238J7E8KFZ7rDnVl5Xy3W3RlO4lkwbeV9m52/Ev37gnybNmW0ieXwCKbw1 YRbb7JeaBcnl7cWHa7N+f7+5EKfrJ26bPs54tWqBz/je9/p7xnB7vp1+EYJOwqixPXOB dZx4XwyiutVPhHK1bwWvb/Smixfa6q+xPRARrnGVI6HxC84XCX9j9cPA2fPug+zss9n/ qbQElp3Vit1L7e9pWuL8p9vt5SdiHYcVwoFxq+yxPmPAPd/8VrCtlhOp7Zmatoi2/h3H NTXiO0dYWzeXxfd3t2+uNtfHNoiGeSAZaJ/WIJqvS9JOgMprDDirGgMOocCE/uOe2sPp 3jfEo+8S+NuwARjUKe6hNdbV1uL1x9H3jOVYgFtluVzJDsNJGURxO8ub1eliwIS/sTr+ NeaZt7dXV7cfJaUDuwfv77M//vs3r7M3m0zdJ7Y3hIddsliQ0JCLd1sCG2Ogtbk89tJA Xb1r10Sn9j+p7gzCiidX0a2KabrzBef+hL+xctEzfmFGIgzMOlR8iWwQEMRepJj2jus6 E4yPrhXTZnzvrvipZn22zJsVKXTqlP0jSu78NZi42hmXyR6zI9FsGhX2pA5/fP0SdiAT 6f60E27B18Z6wa4OuKqo2TvDgWmd5+RoenTC5Y1VyxZgb8LN2Tx4geiPekUUSummtrEq 4gVV2Bz2YuvGkaUxzxuWf2SASfsxGeXjQpH2YPueKTP4uu43v4PrsW03+BTs6LxHtw3A zURx3U/pN8fjczhpBGuQ5X2a0t9MYnsGTs2bSrLXAKyTrj3i556v1POGALTaS+a0njxH 9UwRgUFfPoHvNc4bTe7FdxrjbPK/39xJ+Drg9MgLVA09miAMx3bkD6hpv4C+tCN/MO7h 21iscOQf7hqZqW4hIstOAP5lWhL/mIZtXD+J2ilxuGrV8mES1RBKazZ8fNXaU7RhX2q/ ovULgYrNOkIVGieqiTqgt0c4Q+3R/oNh9Tg+CkwxjiqCqE91dcLuZsTfWOhh8oDdXovN XNy7CdzGFsX69c3mh+3NjVx93D7g8X3s1YmOfW3FKXx6P/iVqWmf/oufffHdK28CuLU7 hqn9bKrzw+PiqnGHyvIp9GMYQnjxEJBtuzHNhDoO1O3dIYm1jfO2WBMsTgDmikAsMsZG FziJGFto1dZZhSNWjX9FVoo9nN10Y5zTtQKxzEfIGRp1B+oV2+C0GfnlFgtVa/lz38uu Xh/dHC/Yi/tH8j8QQrTF0RoF8m77QKT4+/OLjR8NAiWOuZuotm5twrQudmP12HhHnaqU SadeDk53qf54JJpyxnTn7e9TmNoNbfcO1oStr79hiB4KXfzm60G+5V9b/CLpl82PkC6a /awuL0v5znnBZFKT/zkv+NO/v8q+MUmVQxWCfh6tsXE12vrMHYlzsqfU1uDK4/hz9WH0 mFdjxX5E3OLkfhaPVcnYN30oLXZ3s1vs33ct9vehxY+r2kRsxiWJCaq2yfHBJhn4Ke2D YCIU16iJ6XpfUP8n/I1FlJJO+B+z6w9XD9sjK1DsgdjaMPX1OvKgAj12GnNvweoxNdL2 a0KTfLicny8vbm+wwonHmUkrJpnE7plbr44ecCveIORB9V08Bk8eu4s9xp0ln9LDRxbM UqMPezJwUDB3T6LHWMiiFVuxkFtdOFIwUTvy78g9h32iaGWbp5rF5ObHD1tyx7KYVYcw 7FfnFxe3ZNLY3r8zAey/OfZSlnT17ZpzDLQJY4bMsfs1TIQsdFgNndhEWGD1L0lEcdIS OYvJX5Fm3epuWQqdX13Z4NPNzSX3xgNMEsiKJs/eXJ3f/NWuk46e/FFDISrXqNOSUTaB yNqmCupEtCZuZxzhogPnRLXmLCatjOK9vCEcOhZTST4onioqoTJ1Hl00de+8cm05KdEk /6Bs72pe0tMQzbKTxSyT5imrz3lMIpp/2by/Or8QsRQvGW9VirSlM1GrlN5sPhole+R5 3jtOaMtOS1AJhC/zGb5UFuYdG490OStfHHiJLJ/D53dnXxwZiOYrjgMhGUbK32Gb9XeY ++ed0zQy1Rnzz7Jcr7BWJ73mVuaPuiLcsB8xyX44sKo/vv+QFzXolxyDPRYTTTnO2L9n 6RMzZRKfPc6UR7+l5EEqyWNgNGX6Ncdt445jKlsZx5KD4aiBKYnXajST2NiPOXEtFvfa SGnTkCjOZJvBX8UK7E/E4tzJAUMZkThXl+QL+ECiMPxhgzkDeOGDI+AxOd3j6FBjTbaI NXnltIWnpcGJ4alzVORJz+qzmMRVmjSs25uLqw+Xm0kuHDNswD6/QZnymmikT+ZVUJJ9 gaSMuvQ9EaaIXuDUqem5DV/SQlTOYhJA+TsWOua0loctgfFOM6mnfqKZmurYGFLT7Gtj xmigo5tXOSY1x/s2U6amaSCOucj+9PrP2Wt69/6BHLZTQNGM8e0Pr+yxO2MojduxtKfQ HnIvyNk8a0lZkpWgITb4K+degPuyDf5ZNdLQMZno43l7auh9KfmeyfTqhGqayWIivpjx 4cIawPE5Tc7+gE8iuUe/PbJ4ybds5CBf7c1pXP7lD1+TQas+NpPqRzuPye8nrQpmfGpB zZzowMIl/dRHG6PP71XQiDMMCdPXsmV9nSW3c3bYG/HNNPVJbe6mWs3a/9fXiTU0vLna yNo2z5+AUzSW9YpoVt/cPmVOi9ds1/kW683MFuvrrsX+NrT4cX8CVOti4nHPYc2W4w9b 6dZ9upD8dKvbVYfdnIMrT2p1iz0XPzy3jEl76pMtuckMSxCubjidClNEGeek/HGfb890 3Zeuf90Sanq1+es2+0X2T+dvSGpKeCH/fv+391uOysz+dPvT5hpyludfmrPE5WH079s/ n/+wydrvj410NfK0cK0cg3SPbYX0w7mQ+Sl3rt2pOPT7exJPPfQ2KtqIVWq+xjX1AE/j xs1eNKtcfZtxBkD2PVxdZiYh7PPPmqQSFV+81sxI1/jdEmTILQ56VcdRTnOmEamDGhqp YS3OaXmzDve2xlHpbSVbXFFIZL85qKEj5KCQ6XNIu4KGqxapXjjQgb3JhqlRaDnHqYDp 5YwXeXchtH59V9k7gP6332OlvJzqyJjjR0JbieH3bU0pV9J608HaH4bC7B3eulrkvXqE JXGClK+fSzYhECrizzJFWtesMXtf76BdQcN8Wq/bhS9Xd0hrx65ow45yZ8KjAoUuk+gU qd+XcjSlUFOPQk073hMQTuIFel3fzJqCeAeJyvNMsZfdFpjzQnOUEjdRacNSSlk0WuYC vyc59L3lVDGlXUEjPKWUlPNKqzhyrO7w+VCmlLBolHOpSgspbQwlvBf6SljQurTfA1P6 DQPrSgnNCV9wWGpIuTAyXGQfJwowMtWYwc5YF5lK76+4F+FlFItCMGXKnNNrW/q3YuvK 3uChL48WnAlnHrr7g3eu7FqcXURLyE9R8ZqOqLt2vfA/vJaz4qSEYc3fyfuw7u8P3MFX UVXrUBYlUGGakgb490UN+l/nudwpb/J+dL9I7tJnDCXztNU+kN/iXe0w/8Pan1QGa3pn Xo/v06fpnXxzURLeOTtKap6cKxNEEaf7Cs9jPnSg6WDeIbKLaSIblNNAQKlJR2kQdR3N 4b2gwAItqBM3kBYRZZcicm2M26PtZpvDuJYLN/mKKbxh8sO/l7MLSdZIbuomM8uGrsn7 a2iviiU6bkXGLhF5s7EV3YZ6JalM5Y8Y5JfEh939MfFxwFtU+2smnuzsG86S4xSi7Ay3 R/zcucAkZy/e6YV7tDi7UQo4x5T9V/+Wf0R932ev/yUzCfMnMexAX2CYGYPzMXK4N2wD gC3bZ/8tWEye9RfijtEmNtrmr1ybW0tYnCkh1xKFXui7pRLYxjD95Yuu9Iktujj78x/j fpP1qQyACjdBIyjrEoO7ZATlQDbUiSzA265UrOYRjdlaPLyxGMSvYzbXA7dFsJBK2SUm 95AIjP1jAS7hT15gfscnL7Ozq1dZY4SGaz55rdfEASNDtLfNzmhbJAqoCMlaKnEZ5j9/ RwAW+67kN20IVIhYShhJ92AWZ18GEYgW82NRLRx4VPvI4ViTI0xE6QKx1ixlDGBkehDE 9byoFlDqUe5kVMucWZLqS5GpQbV9mqBVztYoyWuVoFpBUUBsfdeg2uG781FtgUUgwqcS oJNSBMOCGJP2c5Cu2HY8FgbVDt7ai2rFCk/28ATVKi1MCsA+Vy5MAcD5dUvYSEQR0F8R w7iDpqWoyZVSCoK/4z3sNTV+EgmqJZ1k2TFJB1jLHhEnCJMjwaN0pcSwVmnDUkpZgKBt TQEHcj6Oo8WwVmlhGleulEJdjveAT6nL0bTUIUp4L/RWPKlqzweQoF8nTPZKCe0J33BY akh5Eq4lp4LFrA7X+vsI13qahZ8E/Hlcy7ncCa7Ve4dU3dPencO1yEeCa1mQ9nBtx4I7 4Fp/53Ctvze4dved4lr/NMK1nmbQp/66xaKeN4dV9d7iWr3bXdb3gcO1a9dhHtdqf1pc q3eKa/29BeT6fdK7GbgWd+QSiJ3gWh3OO0Q2wrUqoLtEb0gbUCJcqzXFQ15pQYWhZvap sAjXKu+xCtM2xu0JtD6ulWQYWBWeHdcCj9sWhWhdXgJMFDRxkrjWMXxEXDvyF04U1yIo OPIXz4xr8Qxvcs3EcRq4dsASh2gPoHbfbmtzxM+EuQtZKlmz4nGNtx3ZWGKYaw6vY0N8 vvEWcGfMv0A/CSnmyIPYHOyXOofCwsV4ixWHPKKVGGVZXnSYGmUq7tNkOmZRJQ4tcvLt am1YL0kT11Vi13PvAnN3vTsf5jb4mgJY8dT1bU0pwFwbAh61H4oBx/oWMLdXzwHjrTvq MIG5SgtzBNBN1tykpA3gdIWlg+2PiIC9tcFiFk8RgHRDG5SKphYtE71XS16alhS0woKz A8tpZ7gCkM3RGW/9UWPU5WzR/iixaMrztGGpAQUA4ydU/16Ecj3No1XPVUSxvJu6nMXV t2dQKpi9fJmAcsHCtv8QNP8muc9MxweQq9/Gs+6/VtQcpUX44NB7IsMzjbeEYZlBhTFU LiNoK7cG1XZ4RHhU23Vsj4jpSpGqu8fiijT5p+mdK4t3uxj4zTMMFQipscs6E3FOWkAZ yc3CXDkk66lZ78pZZQ01Qq7m3qBW/QWLS81vO8Rqrl0ZOApXimi1jQ6lagcoSl1I1xjQ KReOkYQWPewZWZnM9MhufyWqzkuMHB1arhi8sZFVR90YydohMzskKwwdlbUhhUHhB50v FfQMAj9az5iqVDdoC6PW+FYPTKw10pfL2eDPbGJlmwDfOZ84+/ShqDJ8PCg69hdeDop6 W+sIE6sISoNiiiysaJMOJ008MQduQIdPEhPlbAz87IXKzq86DpyChXXI0hgkenH74YrT 3TH87ghgeszkunCOBLHJFUX2rEl9RAsDp0j5YZP6OE8C9LmYXmdDUZkPDLjNCyxs7m6C tZXdcyaQcklKCvAUqKYTtzl8CAY0M1ks0fwcysJvkuJQEHRR5Usk0p4ALO+KtXXHu/Nh KPtP0m8rTCkyadDO6B4IWhhQ6lueFyYrkStvnlOeOde8vx981tjCi46Y7chzwNOiSUFp ATPWYF3AeYQ+a0kTl+MtGqNIpQUM6ShRTVomfg/4UORswcXos2E90MoBWR59EuLEhn4e oU9HMTwoIlWan/bqvZQEfWqpGH0qLczsylVEsbwn6FPbMygVYQQtE+MG7a14VtWe9/BT v06Y7D0lAglKC1BCKTvfewL8ZAK2izo+lrmOAKi5t2AxBwB5CCoqQuGnXFvoaaiudPwc F06FnEhJD3LmzBfGRMp+BJCWmoSPlBpoCjnluRnF1gnAlLcgUn9B7sQrRyTcPeF615V/ Ds9Gg2Bz09Z6vGl6wmBKc6V8SN8FargaWEAD6Iz2+BPQCRhfyaFtEej0g/SQQC0OCoZf 4xwopWVCTRHq9O/tUDDxYrOnYBae91hRaBvj9gRazwIqA3/NCVvPDjs5Bg0PK5cic/EZ wE7H8BFh58hfOFHYKZEZktpmDO7EE3Pczr6c6Vngtxi7Cn/inf0hS2Nw5/nF3e09Z/TN gZ3Zty9mAs0LPP0iGyi70QJD58NO/LxNfU0nE4q5mYg6cwl/xE/IHGjbtayAAXcDGgAO jxI2v4FXAuzY2YfrHN8zkqzbc8jlXVDnrndno85WsifQMMmuC1/J7VXWWAsyazFteSNT r5a/SsrD2r59/bopONOQwPkYcyotnhIcLUKKWFk5NZ7O8xZJzlguq7XYa4a0ASWqadd7 OKHR44Lvw5u4l63EhBUwJ65x5DrrIszpKAnmVFrAnHspCebUUjHmVFrAjspVRLG8J5hT 2zMoFWFOLRNjTtc3scWz1p4PmFO/mE71SKr7rjHm1G84LDWkPGlfH78SkVmL6+Q6xpxy b1FkkbOIUydV0Q8ec3LtMKdQXen4eSdYztJxvulhTjYm3G/LlWLOlGp5M88dwpPrGHPK vcWT+gsWcxL44jGnXNsy6ZViTuFeMae2NmBO6QmLKeVKMWdKjZ/vNXTuw5xEi3VrM7iD 2OlgizFaX6AWXnx2CcaQtp8SaooxpwrnDgUTDXflShXAolbeEwXj2hi3R9s9NHUyfCVp Dqoa7fp83qQ1PtA4i2lOq88AczqGj4g5R/7CiWJOMSC1bJ5EmPPp3qQ1mSpwGHRichK7 7kOWxmBOc9jePMCZ5UDOl9hzB6HJPrCPmHo2wNniWuhhl/j3j9ptFzNnzgxP1AtmTok+ cIBzQANIGjkRM2cEOMEZOdZ2/64Azh3vzgectYmREkipmLNHAVXatPCKOVtMrzHmdOWx y5gaDsBOsdk2RLTGsFNp8azgaBFYxG+/Ijt9NE8QO1CYmM8dNJ07stqVimva8R6+XyBM ASzhTeLWOLMmREllNd5fxapsI9jpKAnsVFqAnXspCezUUjHsVFqYx5WriGJ5T2CntmdQ KoKdWiaGndpb8ayqPR9gp36xMP8rJYad+g2HpYaUp8FOiSRU2CnXMeyUewcYJerNw060 hIedXDvYKVRXOnpekSBSYWeV27grHwdFnikyXBjzplwp7Eyp0XMH/eR5DDvl3kJK/QUL O+W3FVbKtSuTXOlz4V5hZ+laG2Cn9ISFlXKlsDOlxs8nw06wlQlXj02dOkgPCdSCMBar FnYJxpC2nxJqimGn1r5DwUTDXcVcFcBCVYcZ3LrDrm1M2uPaPYSdDN+2xpvtuWEnRohS wjU/F2fP2jF8RNg58hdOFHai1Uv2D58Zdu44jPtTmzoHLI2BnZdkw9pKguXbm+n2TpOo 5AW32U1c3hHgJ8hDMNccg2fJrjln+ogh0+PPIY0Zjp1o8nSLcdMbPCUZaWe26N274M9d 787Gn8XK4HWPPtN7prOVmFxDyzm20WzDK9a05UdgT86iXREZFkNPR4onBkuK4CJe5GSt jlw+a/xkMeqINUjnCg5bdrQBJa5px3s4eq1I8cS0Hd7EArwGYkOxOQM4g5LowLJpIuDp KIYH3WNXWgCeeykJ8NRSMfBUWgCQylVEsbwnwFPbMygVAU8tEwNP13+JvVN7PgBP970C AHCEGHb2yizqHgEYbwXhaZizKkuPOeU6xpxyb1EkQd0R5pQkD+qxybXDnEJ1paPncGnq xGqQ12K1Sjw6JfDXYkq5UsyZUqPnDvfJ8xhzyr3Fk/oLFnPKbyumlGtXJrnS58K9Yk5t bcCc0hMWU8qVYs6UGj+fjDlJuCiHFPIpgsTpWIwxWl+WDonFQLweJTAEwqBz4jVUKtEQ V3bCoNcBkCgV17ikIZ7W31dnyDYdbpc9sFmvnxYx78+R/2zApjv4/ohgc+QvvBzY7AXX H4yYr9HkLB6SiHlWszjfPcWdE3f8biWbgNfZb1+fholzwNIYrPn+/O7hPrt9Ox1oiivs S/pzCpiL7ZzWPXH+xjoGalsfkTTi3Ch3E3fW5eARzOcYK0mDWEieH/TygIY6Iyi6MICU cNx1SeI2oUn4kYBP965ggR3vzgeaQGABkgV+JabfknvmsBw3QnnuWk4kv9lat+XlubxP 8Lx5f7+Rk5il5Uqs/RHS9LRoVlBaQIhyeHfRkVTATwvk18JHvxFzzZA2oMQ17XhPAqNr DGAR1iTjBJmmqN9jzQpvRwhVwJpKMTw4rOlpftrbT4mxpi8lU5pLBeVpfgb3XEUUy3uM NSttz6BUwAK+TIQ1tU9jrOl7PnClX9FP/vq96IcBLfhz+lKDMrwnsjsznIgcYyJRCurE eBhMkPLMQsiaI9SCkRMVwa+6J40kbzJwEmq40ucNOVSkTinRsBGRAs6mlt178eGUKwWc KTV67kCfPI8Bp9xbMKm/YAGn/LYCSrl2ZZIrfS5tUsCprQ2AU3rCAkq5UsCZUuPnUwFn hbsNh3QYxcZOp8lcpgIFW0EUdSirQC0OCsZQWPZTQk0R6vS171AwseroKRjq2qUoXBvj 9mi7B0ZOGb6o7WePaCcqlfx4qKvPBXcqw8fDnWN/4TRxp2h1HLeTiPYn484K89S6SjO/ fmIb55ClMbjz/oHjXsgVNSOI6CW9OZs0cVMuWckVJkq2sTiJ1eGTwU0yUt633qEdMSvu ZiLmzE0YI1mXOBNL5Eug3ZDGpjlG0BXssiWMemsb480pEMJ4grp3wQS73p2NOUlsaWPY WZTbjFd9ylXWAYSAnbYn5NagVFueW1fDwtVwAHeCW1u2mxLcqbR4WnC0CC3iJ77C+BtN FCRLXWMsjWGnIwXU2SMsqh0v6eHhMeYUWE0UfYQ56YG1WEEVTQKnHCWe4pSmpQyETN4L lIDRQl0x5tS6woStXAWK8h6w46JS2rDUkBLey7RrwoxKb7lOV4RAIfcBw9yvlNCcYSlq OvDeUyCnpB9RyCnXMeSUewcWWRYFyImC8JCTawc5hepKR89bDHcKOVvc/lLI2bayFy+Q U64UcqbU6LmDffI8hpxyb+Gk/oKFnPLbCinl2pVJrvS5cK+Qs3GtDZBTesJCSrlSyJlS 4+eTIaes80szroOMuaEW5Am56MnTYbkYyth+SqgpHo4qdTtUS6xIeqqFuqarFj9+Yn3k uiVZxmlXDVGq+JByokvfOso0EFm95Hi3aflESc9BvkBAjbV7JR6gNj1kDMYm5BPN4nyi OPqSN/JZ8okqw0dEqa5LHvuFuGNsFHp2dpx8olOsozIKiHhETsStyqQTfTpIRbdxuIQK ySnEulcDlsaAVA5EuONE+M3pG0fbNPNSXplY7fnGUfIdGaOhwDT8L83dRKBa4CbJm9ja SKqEypCA7yGNeQY39pWkIK0J2O/IAy9zTy1qRiyD7l203q53ZwPVvJQ9RvFAtUbl9B5U LOdxyXPXctCoMY7a8vJc3sfT1bx/AKRin2plnyA2jiotnkkcLQKp5DvujM1YA48qOmqN 1TtBqUoLMNVR4pp2vIcTAsGGdHV4kZRX1Zo8NME2KkFiWFAj26ijGBbUNqq0gFP3UhLb qJaKcarSwsyvXAWKZT0xjbrW9MtE9ilXIsao2nVXQGY1bWmnB5CqHyvABaXEIFU/37DU kPI0u6hEcyhIlesYpMq9hZ2sCyOQinbgi7knXetAqlA9zT9fR6mVcMvogdS1S63EspEr Bakp1YJU89wBRbkWQMnXFeRs3rUAVH/BglT5bQWhcu3KJFf6XLiXOlnhyirYVKy/sABC u8RK5kpBakq1IFVo8kWSDPaPxrmTnIMjJcy4joTHjbMYpfYFCllzGmGXYAxp+ymhphil au07dEs01JUrHfzUtUNHKE1LMZxcqSElINWF75u4H7S/hkgVl9lyRcLv3j6+QarJqVsT kSpHrZAV9vMBqpbfx1Dk/Lz31bgfOFGYipSsJdtBhFOfHqjEAd/MzqcUpzTgaAxMPb94 +MDJ2SdvTO1yCyo1I5N4pj3FmFobTAaqRIUTRS0AbSJGlcXPSo7dIMadI7RNXtAhDV1q Dp0BouLLR+YUE6/dYDEUhOreBKHuenM2QiXWRwCoqV6Qc3zLvNcaeKqNLsypWa4wT6PC 8GUnN68+I5xGwL9sJsTgVJIACC2eQBwtgpQcNEXjZR/dRQpU4GEsTjKXDmkDSlzTjvfk U5KB1fCg9ROHUuH7Su3OS5S8TxwQUUbg1BIMB4pNHSk0eR8hgLmFq5hfDyjQvRbmemUn ojimA8SkJkcblhpSwnscK+c6JcygC5wIbZcHpvRTBYyglNAa6nIfVEtRU48SyjwNmjIe PDSV6xiayr0Fm2s8DYL9FJ3AB7NPuHbQVKieFp6zV6/2004OeUh8RP3ZTGRVYo1ETWJL TamBppBQnsfQVO4tqNRfsNBUkrAp9JRrVya58s/hXqGptjZAU+kJCz3lSvlIqfHzydCU LaZqZUZ1ELKhQPHRewJ1WDBUfIKw7KeEmmJoqmK3Q7PEOqOnWahrh4ZQ2kCzxDUN3ltU 2jdhYGURrediWomTask+zXNDUzz6ORQcITXOg5+BEdUxfERwOvIXXg6d+uOarK32oIup CEoreRGeF53iNc154iomJ2FGTVk6eCjTd2czAanZkgih84ujnTVKaI2gqBA6/1yAVHJU zgOkpPojMk48SgMgHdKwPxr/eeaZCJESNg84FY/SAEl3vTsbkuL9FUPS5FaUuqB532yT NF3xqzwN7x6CpOTKqWXrIIakSosnDkeLgCTW43XJGQFhSiBYoumMq92QNqDENQ3fYxji 2ICjsPDgIGlJk8jmKm4EDpJyHJNk0FoHTKoU5nmPQT1tBCU2mPr3ImDqaX6q91xFFMt7 bDH17RmUCjZTXyZGpq5P+YT+TZIG2J4PyFS/WIAISomRqX7DYakh5UnIlPO/ZJFj0J+5 jpCpuTdYs1jhs+KRqSgHRZ5ybZGpobrS8XMGvEOmBUMwRaacfyO+A6BRc+WQaY8aPbfo 0DyPkKm5N6jT/4JBpoUk73TI01zbMjalpwTZJ8/h2SFT31qPTE1PGORprhwy7VHj55OR KaeFcXShDO5IeNxgOyRQLKScWtglGEPafkqoKRqQvvYdCiYMdy/mqgCoa6goPE1LZQco Ya28qLRv4n4ItB4yLcWNtRVTOkA4SfDE9v5TjKYEKrREXn4+yNQxfERkOvIXThOZiqCY k64jZPrk/f2SzeZSnMJPJ/ipx9JhYPrq5IFpznblMYApB5AEhDYtpxPoDmUjgNNbSnFX 79HEnVSigQwI9abSnLMPOgTQvwt62PXubGDaOegprDG5JLe4lJok+mBqj0052DsAWQpE rx/ApmVHsrQizebkadHUobSAKPFuWIKHI2xa0k2VmFnDFECaAUfzU4dSopq0TPwenmlM yyk2xT6cg2cibIofWolRNcKmjpJgU6UFbLqXkmBTLRVjU6X5yZ6zES1XEcXynmBTbc+g VIANpZaJsKnvrWgK9T3vsal+Heqiu1t2CD0lwqZKY2O0X2pIeRo2Jeu7x6ZyHWNTubdo M8dAErAp+sFjU64dNhWqKx09LzDKKzYlpq+HTcnT57CpXCk2TakWm5rnDpvKdYxN5d7i Tv0Fi03ltxWbyrUrk1zpc+Fesam2NmBT6QmLPeVKsWlKjZ9PxaaS44O9tgSbqkDBVhBF HcoqUAsVlXECtaOUClSoKcKmvvYdCiZgUy/mqjoWnvdYUajy0FIHVI5RCnahS12ub+J+ CLQ+NmXYd2S9fm5sWnJmSrVGzX0uVlNl+HjYdOwvvBw2neJ6imVdDpl+3sD8Erfw0qid kwnMH7I0ZlP/4nxG8idzPBXJn14o92hBjuGj4NS8XK0CXJsEVAtC7Ev2jDzYZHId0mSi AXlQkHIeqBaSmrwgaFdBLmhw17uzgSrtsvv2Dqmm96Digs3RCKJzL2FUfmPfll/4+307 +yXuv9KOyIqqpHgesaUidIkrO9noo+RPJREGjFOJ8wiThtIGlKgmLRO/h28a7njWtUBt qAgQCa/4Wt6Gio+ZHA8V4VRHMTy4jf1SaQGn7qUkOFVLxThVaWGSV64iiuU9wanankGp CC5omRinur6Jbail9rzCiky/l6IDT4hRqvvMWmZx4CWR2Zmx+CznfPIncx1DVHlmQSfg LoKokn7cbeyLmnAQVaiudPQche0hqnGsZtPLR/szSF3yJ3OlEDWlWogqNIWGch1DVLm3 8FN/wUJU+W2FoHLtyiRX+ly4V4iqrQ0QVXrCQlC5Uj5Savx8MkQlNHJF4GdkPfXDM0Zm fVE6JBUqOV66HiUwAsKYc/I31CmRtlB2htoi1g2qLwalopq0TPKe6ZNkKLluGniais5Y c7zJLpupP9dxekhUSRoVctgi7Z/Jbr4yfERc6rrksV94OVw6ZTefPT30GEM9spk+3de0 JMaAEBYVk1PYzR+yNAaYvtn8sL2ZbUF9KWQqmjG2oLYmHn1+QFTrThPNBVqSGSkc6hSl xceph4zQBA9Ijj52Z/wFSfGD0iTgHYtoErdeKi3WpEoLKhEP7qpeicujwidAbCkOzJGW dKRBmQEhvMTkjNVWQr3k97VuXAzW6y42IYqDQU1QaWiLUqQuC82oa28pLSMWJ1tTDGaU FqBZqCtALOUqojjeY4il7dFSoYVKgYcd77nOi6dT1+lgOvqaHF8L/7HCXKmfKm6O0oal lBJqChbEb63jy/jcEjLtCPpZgI58xiRzHaM0eWZxVwkiDYZEhgnC4564PEnUpBmTzJU+ 5zwAj9Lqsr/JTToKwwdxema5YHlKqULT5xYJyfMYpcm9RWD6C+6uyAEe/nrnlT4X7hWl aWsVpWXSM5zDSzoG00eK0qR/AjVcyYfZExkUxQjFJ2CCMzlHIc2YRO1mmB4Sq0zFKjI5 qwhNE6tQUxiVnmZGuLqraP1hzKuwRxTDukF9qhhmaJjMd0sUbRdorE3+LfvR2Ebxxzep twjMIL2Ax2okRe5IoZecwT0Dq3G6SCk54T4brOYYfgxJzQ8LKkf+wsthtepVRiodEgCM 8LxklbgsJOzAYzUyrtct8YZRmoOMNAcr+W/kWe34qDBDS3ILb0PMXqMFW1OL/WOTHWC8 wFvx9dvs2+zs69tXLLDPruG+9H84Jh0acCnPzsh2VJlGNdnZt6+yOjvjVHro61eAorPv DeU3r7LWlPk+e/0v2e9fm2GRphkKd5Kqdm1c5QPDC5uNlFD+AcvZ6+vsqz8w8XqWfys+ mvBXwzN/fvEqg7V/MKSlYco9/x+Gz18Z/m2hX7/KaOR/N0XtC1+aMl8Zysq0JVAWUvWY FsnMaBUAjtorDFjhC7CXufsbxA36JZzSx1+YXoRfmgMv6+yMfvX0nxnu4Ah6TRN4sHq1 4Ma+ED/+uanCvkwzKUnD+XC2jH1qK7LvSn9VprVUZ1+wj21Rywv9QkX0FBVZTuOf9BwJ e796taAJ/vG0LmSvj2RPkZcGHbro9+FQKH5Oc0UaYP/XyOWv+XX5i6zyxWmNPlqc0ZCo IE2hmPSAFKd58kdv+S5S9Of2fTorevaLVwt5ZInu1xwPtvj/tS+TLAMO/p+9+d04gao5 4IyzAc0uqukNp0iTsdzrA2nklLRkmm/65Q5dKGoT7+Udl7FRi+fD7NUN71tH6HUtJixz M4ikO7C4icE/KhGjemx4xndPSPHSxpECymA9hWk8NjzjWydHZyXAw9HiNYottYMSVjcZ OWYxnHUYifwPFrikrNtaPDIcGCrowlwy2/hFiqdEMEppYTmnlJ3vKdInIs/VHhY3ngbg o/dJfAbFcRUolnUw+oC0l7Bw7Y1fKrXrYgiqna4rG/C7/VTKNqsmS4gBaK/M4CVPiBc1 nFd9CcALc5fMx/sT5umiRhYLslDWhQPAHp4a68RgntmlS83aLCxqGB1+USPXrkxyZRc1 i6IBqat3hDlbODE9N0ZzyKJFruQdvd5xZRYosrCQsvGiRu7t0kV/wd2JC50+4dpTWaCI Q4Xwps+lHbqo0daGRY30ki6o7DtCgOqWOv3nIxY1cr64FzEC9CViaRGbnmdJlAoHfaVC pqQRhGggqmReMRJ1OTNeq9CtXhX4oaEUJGyMVnF9wlfpdxOk3npGhn/TmQOPnL8u+Kbt 6q7TyUOtSALOcj3bfSXJGvln0SvHubjbAJMksbiYKg1OWiSRZHZWi2H7hHRcizgdF8OW CfpZ0nFhrDIMH3E9M/IX4o6xC41jpeOasp6RGUCOffTLGbO+kZSdT1jPsJ2KRdJ7dctk uAdLo+2RvieuZ7onr2cihnU9g03ncej6Tz/7GdgNcP1LQCLo+n/ZOzC7gZu/fLUQqnv4 M4Gv0MGdAj9NGVv+H5b2yXdnAlt9ER5GAJwcdXHy13DnB2dBiHJHNEhYxHD89Y5GLNJF 2a9YJfCbwqXF/sIBvw2T/zPgZu5KV0SAOre/+jnN80UdUVoCaDYwnDLf4fosZR3KBlFH LerNzqFFuAQQ4COTmGvRVBD9/wG/l0J2CmVuZHN0cmVhbQplbmRvYmoKNDEgMCBvYmoK MTMwMzcKZW5kb2JqCjM5IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIg L1Jlc291cmNlcyA0MiAwIFIgL0NvbnRlbnRzIDQwIDAgUiAvTWVkaWFCb3gKWzAgMCA2 MTIgNzkyXSA+PgplbmRvYmoKNDIgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0 IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjIuMCAxOSAw IFIKL0YzLjEgMjEgMCBSIC9GMS4wIDggMCBSIC9GNC4wIDIyIDAgUiAvRjUuMSAyNCAw IFIgPj4gPj4KZW5kb2JqCjQ0IDAgb2JqCjw8IC9MZW5ndGggNDUgMCBSIC9GaWx0ZXIg L0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdWd+5Mkt3Hnf++/oo4i6Vlp2ar3w3cOB72k LNmij9auznHH4V3MzvZy25rHamaWFP3X3ycBJICqfkx19daotYzgdGWhUAlUIvHNB4A/ J/+e/DlplmlbN/YPf6uuWba5EBr3426V/Edyk/z6xX2WXN4n6bIruzTr6vBrEWj3l0lZ tMsy7boka7pl27R5klXdMu+aOqmzdFl0ZZFQ59v47VlTLqusS8omW+alL7cYvjtJ+Y93 /JmXZ23ZpqkQ+M9flcWySJuqSJq6WmZF1ySX18k/vYLFNEvr5JXwZx5xf15dJ7/+TbZM kyx59TY5+93Nw+ruZvXwLHn1n8nXr+Ax6qOPx2WbL7OcBgy53MvbF3MzVS+7pqindt1X dxdvH5LBv5eryw9365sfkj98+/L3g3v28puLn5M8zfJni/E9LvLTk0nzRffKRdHly7qo Q48vjFzsl4Zk5h4PwlrVy7zuCiese8Xg6Zgqm2WelYx6M4JOhCm0S4GKOWxYO8mb+XOi MfMmRcs0k5j8ZZJ8+TK5+XD9enV3n3zzx5evkter5PL25sfV3cPqTfJwy/1vf//l7/4t uf/55uHiL8l3f/jNi6ro6u+Xc4+eml5vGkaPa9lpjZ68W5ZNcWKjJ0+XdZp3py2ok5hE UH/37Y91cvHmzd3q/n51n1x/uH8wwnpxc3uzvry4Wv8XAntxn7xZvV3f8HN9Y4W1q/L5 hbVtlk1bVknjWndawpply6psFJdM0KoGsW2Dahtwadm1KRNfDj5qK1Bb9IPJMu/SZQMr CTprWZd0WAYK67o8S7plWlVZU0uNY4DahAk5zH0pM3PTFO4rjQRqT63RHZOHjWY7UMpo oGzV6hdJMTf8ydtq2QKGm35n75W+ufGmkb+ybT1Th3Xu6/XcKL1IK4wJAJD2mmNwb6/N Dc8KbKisqrohUyPHzd3qPTp7BXx4WN/ezAyIiqbFuhz2Xx9zLwYW2Pb+26nzYs2zePFS jNK0aluMSEzNvCuzrI1+vXyxYTp+EWxHNYXbctllhVFIWVXUyyopwedlh017jTHbp1wl L42NGKoRg/TRWitTa7WkUleroWRZckyFyEZleTS1peAiqX9SlXVWDFo+oEyslTmG/gwt r2XWSfhQU9m0j7uWu9r6LZ/FhvcTGHbbsk3raUiPeWzmQdhlOHSqMk+m8Xl+tlr+sHye /PFm/Ze/uwfIrR7+38XD7c352fmz82dLYX4x0lESj1XjSnrcbM/zHO6LxjN/UliuRlM0 4KRTmBeCODZM9W2m1tDIeeGJ8VQ9iUmxkK+uMD4SJrG3679geZyfYYqAsG7eGJvk/Jk3 nP1MZ82PF7/76g9zW8luutPGnZas1kxvWXr6WmoSnze3DxdH6dG9sGGvZzHDoMuLHO+2 43zMZ58bumZZDfIqcaVP6k6gobHXy7oQe31eZzh+8GWadhu8ToDZO2HiFtN4D0zke8tX LYgf0IGgwQYQWzLJE3EQG1pCD1lZWevYRiB4BFyImZWZJ5oOdxSQpCoJQdTenpYZcIw9 vcHu4zNl0P9Vs+yq6sQmpRKXQktY5qBozPzgiL5qa5x0dY8/vpxEixaPRYuqZZK8erdK bi6uV8nt22R1cfkuuXh4uFu//vCw8jNRcOGub3DiXt3+tLpLLi/uV89l3pp7UtLAhzZx jHqaG5MGYS1TYgyVFYux3f7UWGUKj+ro+dPq/YM4Qt9f3D2IiDwgLkFCroDTc/vu1fVT 22ac1ucv0LLieTylEFONzZG3zEenqqt6/I0dNDW66qiJfDpC8nEx7VkngyNNky//Wny3 GhAf8L0XmMyN7II53xODsQkOF6+Ty3cXdxeX5DkcJQ6PI5Ks4gOX+EW0+05hlGcVOK5r cShM6r7zs0/m7jXwJnHDYsjgXqE7x+4dnz4xAV1mNa7ECoje67Wxuufhk8guD2gILHQU 29M1kg89aHsO00gXyT05LVer49h/fAQVRbkss3JjBI1UnPfvLy5XR/XwCBarlugd+Rja k2MG+dwWJUlMyyqvMMl74rrYO4a2f8yPZ1EyCxK7MeoQzFvVPtzKKOoZlD4uWxO/NgWB y3WWN10oaQ3JTdNTnwimZ0sOXlrmuTVWH/eET3DSBjRPyKDM2u60MGZKgKBsFWOOHDtP aHr2+BurUhvg3Dcfrh7W71FDP71bP6zMaI/zhq6uLt7fG+cnitarLFMMt+knCUp5bttT MzFq18aTEoyqqwiP+bSh8YIh9ufMatVD5mlMeog3t6bN8opcGzTTgM8JmvbjZdd6fVSB 4JkC1Od9IkzxbZsKf/GJmpdVj7+x+qhFH0lsRjwayermDfgo1kVRDqPVRDjNVj/Z0oKp Z07+rYjQkgalTRujhmaH1IUiJ+XqMIG4EfU9L+gvmmLJ6An9Ngbbza0Zw+AmJ7UmYf2w bnti32E1iUmvvpmnH959uE8ufrxdy5BKXvwh+fF+yZ/f/yZ5s377djXzyMlb1kaUFSLg GnKYoXS3urlc3bs0gRnXUxQZS02YgjybpyWprH9pcxeQmZL9tGNqHED1hTcHRiyPqXDO dGKEmFnIafmN5THD5Cz0AXr+5fqHm4uHD8SyXtytniKPTBYQNVXK5+1xPcWe29GVE1wi QRGVuayhOmKdxCFG5t6MXtLUyEehnwq+bidLr7B9njyjtyqKZVqkagaOB9Yzz2ca7FP+ erL/aLDvn9c/rm4I2NmlTLev/3N1+fBcEttv794Qz8PGupTRgFNoXjCDRwDIzTItbcZh KpkA1MzdnLOIryiz2jN4Cso4b+pl1hXlkKmRwvlm/cP64eIKv59Tfc8lktfryIUZxQ3L Hhlzm2sZB8raeNYeWctYsEywK/LW8zwGt27HX+M0zAz5s0WVk92ZFdIpkpnau56UQVpU LKAwNdr67BVG3lG15a3y5+pruJ5UY8lqpLjFvetpNaLNQ4tLdzW1xf5512J/HVr8uJfw qPkyL5dZzWx+qgZwj7+xBvDb2ysSOwSj3z+s3gfb9/3q7u3t3fXqzd87bbEYs6Z4grbw qbKV43+6ttihwo766FnFGnCyp+xHPxFXTErKVtHHwI/igPmdfx6nTGEvA6D/5vbO5iJF 09WFcbj8afUzqSjrO5Mwe8m60vVblusBWl7+9n/+8fdfsYZvZvRS6ErSyjbupIS0ZPMD 1ogf7pp7So/wNCY/EAlAMshWI3P6FtNNEpFEPICu7ts7+KqRgrkFQU12bc8YSZh7SVqB 6mwycueVqcPmKDo50RHWw4a6y8bHU6weGw44PQ3Fyqo+Qit+64CRIPuJfXPTmJSVBvi3 Z/68Pql8wOTezzv36PBJ5QOmRn5eFh2uH34G2dzffri7ZGeDaPo5P7tfrUzKeV22zfek i2BPs/uBqK25FZFbtaGNGqOHthtZH290e99SyR46pJBbNTQWij71OJrCI3OQmX4EMB81 lqYnAWGLoqTwlrlOdh9+pDSfn4km+JGtDt7gAr35AZH17QDi+42VdgjFFICfkdjfGM+C EYrD+H14t75PrNfK8znP5kbe/9MX3p7qGjqWD4pTD/pujN/bu3/28JS8ul7Ee0GF7xn3 005PygZXj0mmyF+VExdgNwh2zKrzBH9Pmaea59O0DHxZMBIaqEtM/BODPB82ezBPxAzv EMBjjLmy4b21T6npfVl6sbej1vZenIOpOiMeiM/7RN0KZY+/sbpc4i0mysKyAcLlbLPC IoKwgEBWntzzyd+u7sw2W8yaD+/mnjB1BwJt0WGKKFr/cA+zF3HC9GIGtel3/hqweyJS i3+U2OBp72dFAHgCkz+tyQcBwxkr8w2hbDJ/HwCBTEN2HcwnF58kb9erqzcEiO1Cquv1 zfr6w3VyvxI5n1uO1b2uzZuO/HZOChta9rEteZgSJI5dltmykd0LsZJL9vDp7BLCnEVp I5cQDqajMfGGgDr51TR5fdjAfmrY6Zg8TN/j9sBI9wqUDQ1kkyoWQyB65Eq+/tk4RixO mj2SRwJiLfvFlZP6++Hn9/0I1KFehscAyu40ggJvbpqyidWA8xl16jHMuuSQAbOjgT6b WMpmOUl5FHA+ogHqMx00YG9vP112mHJ12ED872agbe3RQ7Tp/lXcBfkPXY2H3+tTku7y jP1GwV+9pHuzve0M8c+qNvHPFp++3Zknvp4UDazAkUQDqdHs9OOusnxatFJrk13pevVJ yHESfzUb71r+bI2964k1yh5M2uK6tldTW+yfdy3216HFPpHK21s6HQ/srSdaV1GyDojY WX7YfOy8+998+b+3jrKPZ4L5JYnKp9MEe/XT09mFOVthFGwDdqhd+KRBnUlM3q+umJpk e8G1TFDkpwRg4775tGjzvrlqsXc3lJwlQEa/lr0W9bMevY9gYXfdPkgWNoCtMssS2M0d 3x5hVj1qfWYtMng0Emxd1Na8mXmIBf9Vj9P9GZAHOdU2LJXH1/755OD+t97P1PZv/fGm fCOABQt8y7yQ3fUS1gKmWS27ADLhi0/NWlCbOp7y7OoiyKC3bQs215P41Nixh61iNPZ8 IrozbZesWTxdn1qPv7E+tQJvw5d3dxc3P7gwuFGjWH9BeyYXl5fkdUp0wrjU8GKYQrJn 5rzpnX5ZSOnadgJeCUFcJVuO4pBgLOFiJUyep+zcavYJfiKnBE4QSdZpDgNBT+yUUCYP Axv3qz9/kJUSyf371SUZOXbHOsnQ8C4y2UNmZsnL+cwleyPwmaf09MXr2x+P80eMmHFk y2oCtZ7Fw/r5eXJ7vT5qplasgao5EGt4l8mgd/cq+tg3/mhIccIM7tfNKFOH9afEPZOL q6ujuvTxr+5V4oDLvV03N87wrgVRinlKypDZH845FgLOmMuxULI5dcXJKZ2m8cbXk8zs UhZpmxrFEaBX7Nl2VG0m/zuuT8zuSTVWWMFxi3vXE2vUPjSuD4nH0v6pLa70efH4mI2i XX2hxRug08+om6DzKRz9Bfo0Y+/iE59TLZOH6aYIy0mQMTHRKLYJDRGp2Tde4/ycVNb9 DXp5gtr6eL4aH+MpWNnJfiQK7U+EqYYMiAIIcqivZuYZSDOyix5/Y+2NUmL4tzf3D3cf 8NYIrJO175+I48Aso/wkGB7PkdMH9pAkcromUGqio/fPZwZ+fp23Nm+6yTGHoMpmPvWE 7fie0n9ndhwKTO4dTXPDJX+43ICpkfGu1cWPxuxFTMlu+2A2NjWmyGsXrU9W1+8ffp5d e+qCPW3FaQkl28hVGZvqn9JylqIknjzlbLSn0p49/sZqT9lk98v3769+Zstcf7qUWXWe 3H24IvvJOWjIK2Y/JNJM1jeXVx+s64YlmnN7a+zOItr1pyWkhK84WOnwjUyfVHNOYnLr 5NnfZ2KOXLKMdQ2s9M+TwnF9Wt87Z2chcc+dlFLK6DL87qfFFOfDdHKe4Un1FMewcVjb aX0+tv/hLDgfPd0LbLa7XGaAhHlLkJFYzUl9vpwl7gWnGBmRGju5/SsZvQQW/rROPk9+ e8HBn9dsMMG/r//yfs2ElvwbPlU5D5TzCJ6bY3LlZvTvu28vCGK03889zekm8q6RJ6X2 chJO8qo6CQ0j2wtnbYMb6WimHg2JfseZ1VnyPf7TN/Z07o+fvpSXTClugQz7yeDVysWP DcXkM01xukkFvfPU6vja1hidNb5ruxvJQqjwXlEbp9KiOXM6/XqTdAUJn0JFQFhLVR3f qCOoyWqBZVU01SKi1HJAOSqYx3wpRxtBWcTPkbWXZXSasKB1IRUEedmFRJmS40Vy1nn4 tjiCqck1b1eZjYdgmzAdZ+E29hQSqfhqId+qKGSLXvcuOX2tIi0OgmMnojimpSZfytGU sqi1aUqhpi3Pda7jrqK6XJdDsUwt9Kt4xpUQtUVJG2WGBHrtHQes5MlPyXd2YAxzWHcf zCeKG2kiGxfWSBxoFoNrPmSRcZxOxTfVMlAkCxZqmXIOmL1iQaE8z9foXS96V/17Wrbm QASeFaExpTHneB/oyb+5xqEuJahNNjh2V+b5+Lp/t3/F0a9liThoTVdcg2dLnIFKg4Lj 0r/dXilv8rzc1eve1aJ3BV/mGgBo+0TeJUuetMf8m32PGt70ig/au957JR9fDmPcewak KI4gtqSupQUbbF/HtBFiq8qEweXGm8roFLGll3T8+/EwRnHxlCoWHWtBAS1qpW2W2qSE 51CLrlPCuKUuT7PnF0m7sxSdK0rFnHaUIQ5sZVknkqzIGkCzdu0/khs7N13em9kq0+yx tEM58c9E//BM6WWol1MVSzyTDk/xJgmeuD9mjRnA1OaPfZecvSRSyhyQnBGBZojz473+ eKc//K0bpQBYTdl/xU1gn/K3qO/75NW/2D0LRYl4Dk0MJ1xuMOywUWCYffNJnyAwaNPe gK50xau3ydl/C36Xj/oGOsa+gY7RJtba5l+7NjeWsDhTQqYlcv2hzxZKYAsb01++qK/V Fl2cfftN3G+yDFZGckmKuJlsCjn4WtY9kjzSMpYRmJbDHVnSEgsKPcySx72Ze6HXMQVy f/a7fCf6FsXbGHGxf+xiUw4Z873y4vYZk8TZNQ0r/B/kAxoSkCVnfP7SdF6dnH33LKmS M3oFevoMkTv73lDojcaU6QuKpJWnqY302SRzuarIi2w7zIM6MLz4p1fCcNrkGyxbUam8 qPyf/9uXlR0vyRmCdcWgdC9xstjrjWHV5biaYR+4MKzZsN8+xj5yuExNj/7yWUKHf276 7yvT358/W9C7X//Kda90+2fuhnS7fSymuJqef2qeQDap8B/Nb6oa8ymC7HAIJT5cZ3Cb T8H2/Nulx38K2nJ+RmblF8jBC/PyX5iXs/kCFNqHDDE+aAat5P8VRfnzKxpSLOT0ENi1 T9j7f2fvn0urfQX21rmr7le2PE2lbnsr//SXzxZcfepKPvvU1vw/LGP2AVujLfGpfdq/ +bCOcocIOnGSj0422LCjBoJFR33BV5V+4lPJH1jQi8XZF3QVVzAUbsEqvfOZvWNL0200 8zml+IOqksKfoXY8/7j5wiizulkHRyXHIXdtOJnRzSW7hsNClDI8bDlJZacxprpraIwt Xnz0s6gFOGF6daxp4VTnyBhrxZgQwDnZHkMzSQ0GB7Ehvr/cMMd2L7eRiR3vaJbreSWV qIvrLbSrhGMBUs6z4HgOPl3N1AgJSyQtWnvUiTy6gLZR3ZWB9wdDe5Fb4iJ0XgsO9Q3t EQA7hSRuRG2XtOboESnBIwtfh3AjeFPm80zmKwVxSS2bG2FyRgapkiJc50iR+YmvlO5j /1aP6+QcT5OAu4W2USquactzKTo87SSfJzyZsmiepGNvj7JbLOitFZvYWZ9KiUAqxW0p fgxLbVCA8KJxjVHqnxNo6axSTwuo3DEVESznpiq1SrU1G6UiKK9lYsjvehT5Ck9qv3um 9Gt5zpUQNUZJWmYxJHgxCFbpUFntNkdFZo3ZJqNbDD6EqX8dmaO+jDEaWSoUmaMcZW8N RmeO6rU1MHdcaVm2djEo3ZmjHXoCjYrt6ezgLAVvGbbML3kMK3RADTRnzZn7wepcmGtj F7oXWCOx07c7I9Jf26J6t3dlDEZUi2+XMzh9n3iD0/eZMTD9lWNRrzFnMZX1ypqf/mqU wSmKQSUNEUkJ0YpiUBJC4obqQQLphW2PQHr5Uwn1hE1VxXDwOkDlOGgJHR8RZYt+sW3r Dyzb3Ct36q0wYq1GPHZlW2ALOKPRRIk6NtGObIGFGo1qCzxugyHrKWe6bDMarRUQ20ZT jUYWGgFGMBqdqXmM0egYdshqDqNx5BvijlHDz5t3aiM+vdHIVEBIjI3M1WhsxeWLJogF JUFQDjIaUZBti+M4itU0G3h202z8ik8OQCWBB7PQ/sZQxEqxv9kUDrnYZhYiMQpK+xC1 ZP5k1SQQtc/SFoiKAwaU8ert4uzVx4GoyYuX8NXthnTJyxcY8H3W909YDqKSVijYykcL RGF+NIDaMEgikCYALIoX7G6NANSMvaMLIhDmYDgHUDdpV5RjiGfitAgIFWCG7hLjmkPl HELd9qw4oCch1KbFXIkR6oBwlRCxXlYy40btb/C8R09dLTae2gVSmchZ8GaARQTaHC1M ByBBR/Pan/Enma1sQa84VX50sk/dJmlYJoDUbQ+RvNaUuVgE4Tnplw5/kZ+g8BpJGkYR gVRH6YFUpYXW7aT0QKqWikGq0vy0XSlXEcXyHqPUStuzUSoAAF8m4ATTePoznkt9p3uQ 6j+Mn989JUIFSguuaqXAgsfl7hMfhVSBcYJsFO6JPRoDRRceyViNaWINBquKquCj+d82 SGKonhbukwXqkGjGUBSpiN6QEUi075ZflzZAwkaaMTW6b7GcuR+gKHF2yhtE6d8gV0BU yUB1d+S3LdP/5e/TJoc7fWsVdwrYbdy75ZfDmwOqQZ2GtgdjRgueI4yZVC0b0DdmXAep c+Mzwpgb8hQG+ja52KTtpoSaIqDppS6oFsT8UdVi1MVQtWgL4+YE2iBCQV9wKiX5ARtg c7hiyhvyo9zxFcYQ+83puS8Bu8kUrxEKM2Un+MIOAJsLcULbeIQisY8CNpXh+cDm2Dec JtgUQekaoqAR2GS6Jbp1DNisWGjR+qw88TJjAf11weaApb1g8/7kwSYu/NnAZtalZYy2 DkKbBdMreSb2KG+HNjdpTGhsStSyeixGmyx0BgjhKYjQ5rZnJ6NNWibnlHhnJgvWBhRg MC5ZKaPeYSgt0C966mqx+dROvKkHS0ZeUX/2YZgUFp4WECBrAVKwdoQJOZqwJdeV6TMq 5WhKoaYBhRMgtzwnG3M2JAHEmJNPVwFeqN1mDy0q+SCypXlAk0qJJzmlbZZSSqgpBmn6 XIw5lRZmceVKKQvZvsnwHmNHpWkpTsVzpTYp4bnQW/Gsqj0fQKd+xTD9KyW0J3zDzVKb lONAJxEHDzrldww65drCyIxTcyTBxV2ZFC//24FOWc/haR50stGBB505fv0+6JTTZS2o NOfMOtDZp0b3HfCT+zHolGsLKPUNFnTKuxVUym9XpvdL7wv3Cjq1tQF0Sk9YUCm/FHT2 qfH9nZk0u0CnmKEZp9pGnk0/2PYJ1D5RCQLlj26NbBYVOxWoUFM8ILVUUDChLlUUUAYK JgyGWMFoG+P2BNoQdqLVi5Lo48eGnWy+LLuWG9/V4m8AdVp+ZwSd415wopgTKWGWHQU5 SYvBzht65IJ/TgaC8a5XNdtkMF2ejnuzz9HfOOCURfuRd5PD7XBFoHsFHA6/ziP+UqYG Pr0ejlfimXRXG5H3XYnQxEYiNxizXE30Fi2scIPDAx0t1oBKCxoQjy04LzPmtsmO5ohy ECj5WrEGVFr0nCu1QcEN5mni5i4k0yaCWHLeBt5HSX22ECtBWS7ZpFuyo11UWSmmrgFt s9QWSjSD+LoiiKW04IzzXHmo5HkPUInjgWx78Km5cLRSopq0zdFzvk/jGUR7PkAs/To6 s4VvGLXHf9eNUpGnT2sKEGuSa9oimILkTnXvye8Yacm1xU4FqRwBaTFWPJLit0NaQnWl o/uIi6lTcgQ5H3CAtGSdgOVDfql7r0+N7ju0I/djpCXXFkXpGyzSkncrkpLftkz/l94X 7hVpaWsD0pKesEhKfinS6lPj+wcjLZL8CqJXPaSl43KLXCGRLtV+t8TA5oYU7aEsfE0x 0lJZG6VnGKs2dXnhx0SkLyptY689rt0bwWRODBLzUDJLXTSZrHkCQWV2pIOPHQGb7m/I v2f5nRFpjXvB7EjLZyj7ROQR+cciJU2Fme+9e5LvlcvS1Cjn4NBQsuT11uSbBKg1wrU3 Of04Ozr9OPDrs4/HpO/uzM+VtOiFS2j9zMS/SYQlCk72JpFym727tFmnNoOa/EoC5jbd 9/zM5IBKiiyF5c5CUl757e5A8omeG9BqG/Bl1iB/TpYC+uZt+lo3E1X/3nJomf4Hk7fr OBDS4swl6VrebeKx/W2bbJv5nCwJslNJxB3Dc8VuW1kuUU3Hsxu2klzLArHHk2t/AQf0 FBzwUskuJj9W8mS5+pTlDPyxebQuJZiGQPoFKR02NZniZHPwpWwpW5k0Wp6U9trkaxpv C9j3UGxM47wlMjidUBpX1CMalwoHrUmmkOxpwxcc0wjJAyb32TbTyI00mjKwKcTPRTlw KYnFPOGokoHMVcrHkUI0Rur53JAXJp07eov0WFQhCR1RhY6FfxiwZPhdnKWOGclU5n2f u2a4Gt3bHU+pq9hRHcOuhxdfv9piTWwReXZsZAGhbvJgktjJURiKj81liZPYP7OZ1S6l WtimQ6Q/6B77xYVpaIUwJn0GZ1zSbtP57glLtA9ItjclXHl75zNXpXQESTO9e1qVZNPz 3AtTvyvh0sPjTO89CqAq8bWkwC3tDTeYthiavg8OzfRWLDHM9CaNhl6fJY2mZsqKDU1Z r3mMoSlrtaQ+MlswNO3VhqG5O4NGTM2cHbAqe7x9x2YTrKIly2eDBjpuyCiX12BBkrHF 6lOhYTUVZNXIIWzyLOkN256dHtOQZYwY1LU5It60M7omeuHOOteW4zKVDnHlzX3KL/z1 rkiGtAk9JtZQMFWVFsFfLReM6hJXQU6Sq4e/9AULwszq9S00Bcm+VFzTlufw+3SszIit bIktSU5usLIxB9KmzYPXQAwEoWAFhOYobQQlTp7xdcVWttYVrGXlKlAs63HuTOlaMywT mdiuRGRh++6Udc9qm2unqyVkhNJ8QG/16KeKLSGlBXtaKcE28pRgYR/mAnImqxGm8Ds2 rSU/3xrLNQ0JpjXaAW7dnVZNa6F6mr/fmE0tLZ315wPTWnZCse82e6K4IEafGt135q3c FzPYLR1mIbSazfoGa1rLu9V0lt/WtO7/0vvCvdQJoibF3LZW38C4pCes6Sy/1LTuU+P7 h5rWsiq56cyniITHjbPIFPWjWAVq4cVglEBtER99LtQUD8Y9uiXWGgPdQl1bdITSNnRL XNPGcwvfN3E/aH9tmuQM+bogHORN8ijBexEv9jws50ZOnjROQ2tv9aIfJ5ngrQzPZ5SP fcPsVrk3xlvwnEmRH2OVS5RMAvneKpcE75oc102jfHT8Q2aOlHyKYJT/tTNu+hxtgaUh u5tO0wWIw5kkgv94z6qOpXr9isW+Yh7fjv71FaxulrOAH9bXq/Cq6MRiwABLfRvUQcOp j/xoUD/mx93KDN0nRMCtyYn2ieScASXZztNDLf4cLmmgnCjla4tyyEeFWuREsaJBTmMM qLQYAyot6NuiE93YRFiuYI18K8tWIh2stOg5V2qD0gu1cEo0Cwr6oRb27MlTcgwCCMRt VdasgAjwzlF6oZadpTafg3edw5JS64pBoNYVZlblKqI43mNA59oTwTlt4f7ntP/i+Up7 Xudtcy6c+YqBd/1ecXuUtlEqgoZaJgDBI0ItLSheQy3yO8aDcm2RXEvyQcCDjBU+grvT pi7UIlRP8/cl7iZ1EmrJ2Z6gjwc5Hk+ewWgwv1yoZUCN7ltMZu5HeNBcGyTn32DxoLxb 8Z78tmiv/0vvC/eKB7W1AQ9KT1i8J78UD/ap8f2D8SAeYlJpxMYNsrZHrijlQi1eO2xI DGxu0nZTFr6mGA+qrI3SM16ncDDTNj3j2tgbJ542SGopWXyeypoRj+sk8oTNaU5VOgLX yd7+ghfNlP03kNUiR90JwzPiupFveDpc1x2C6xCUipU8AdfJqo+SrU6OwXW4a4qalKoA 7HZgnY+y2Ut+dLRF/EuOYY1HwP0Qnm3GI/5ZvMu4RPGh4oaX+Ij1qxqS7JeCAxv3Mg5k HLN4TKETdhEHt3mACAZl2BTFV4EX1v+2JYWykI01qMG9zV7YKkIhE9HAHQ4vh7n++eA5 qS1xXGPMpiHn4uWH2Zx2wZu94OVfsN7rjJbRSi1iqcZfzQNumxQlskOKVGP/b2uxURKz ecvizMVF7H37Lh/j4F365K9cPVrt/4ITeuMb+01++7X1hutdU7f5JLCuRFutfbmGaOwL 875/e+cyUcFtaF32TXOd6kbAFkNC/duLQ/3bOjC3oPuZlolyEC/xeiZXt6lkzoInj8eH ts+IRCoOw5GUdnP0imAXc7Xh3x6F7gv2TmslqhKhe0+LZl1P85i84FDvlAkxoPuCj9eR 5cDMH5VytBGUGN3LCQ3s4SGOt/AkPhF8YOJTdolUqBzZxEOcvi5pSikxulfaZqktlAi1 6HNmcaLFO4nSAk4CVVuuPHLyvEfoXmkB3Sslrsm1OX5O+zRCLb7nFYVx8Ir7ih5feUrc np2lArqPnpu8waQoQouakXMEK/yO0L2MAYfLWXIY0L2MFQTIInZ+W3RvqJ7m7+eFoGZL z8GKvZT1PCcz1L5bfim671Oj+w7dy/0Y3cu1Rff6BoPuc3m3Q+/mtysDNfzS+9Imh+5p t22tR/emJwx6N78cuh9Q4/uHonsOCRUfiozxIKN75IpSDt17aZgoV9RkF94ufE0Ruve0 UXqGseoSqY7VM5F+Wvi+iceX9teGt7eoaU68m4caBcwpRzh72Q6K3Wd0Y2fd+9H6fE/S 2asMz2cUjH3D7EaBT8EC1ox29sqckAIJe0ZBzgq5o3bzKIgmy546T2MUFEcbBYFftQk4 nfhxm+C3v5CMH6An0NxgdkmpAOabP6RgSUIGdItnbclPHRw9Pzt/5h62QFguDgLzuOiX 7HCr5q74mbdslbhpyOwB4SaLZAsIt6wrxO9ZAX20PNiZJDjHJbWqI9GIXUB7XO9Bywas q9v93/8//8bydwplbmRzdHJlYW0KZW5kb2JqCjQ1IDAgb2JqCjk1MjQKZW5kb2JqCjQz IDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA0NiAw IFIgL0NvbnRlbnRzIDQ0IDAgUiAvTWVkaWFCb3gKWzAgMCA2MTIgNzkyXSA+PgplbmRv YmoKNDYgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2Ug PDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjIuMCAxOSAwIFIKL0YzLjEgMjEgMCBS IC9GMS4wIDggMCBSIC9GNC4wIDIyIDAgUiAvRjUuMSAyNCAwIFIgPj4gPj4KZW5kb2Jq CjQ5IDAgb2JqCjw8IC9MZW5ndGggNTAgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+ CnN0cmVhbQp4Ac1dW5fbNpJ+56/A+mFP+5wMQ5Dgbd9mPcnZ7Ez2ZOPe2Yc4D7Ka7Vai S1tSx/H++v0Kd14kkVSzm/ZDkxBBFoBC1YeqQuEz+2/2meVhVGS5+oO/aZmHRUwFub7Y V+x/2ZZ9++7A2fLAorAUZcTLzF0FruywZCIpQhGVJeN5GRZ5ETOelmFc5hnLeBQmpUgY 3nnvf53nIkx5yUTOw1jY54Lmt1mE//jGZ3ycF6KIIirAf3snkjCJ8jRheZaGPClzttyw f78FiRGPMnZL9Mkq+s/thn37PQ8jxtntPbv5YXus9tvq+Jbd/sa+uwWNXh89H5VFHPIY DWhSeZa2v0xNVBaWeZKN7bq/7Rf3R9b4975aPu1XW0150Kc7iTlqDCeH6+ygx3EMpk3A tHrQAznoYIteg/6J/fzT+380KFe3Py6+sjji8dugPz+MaEBSxmGWZI4fdAPO8gObmB/c VEqzMM7KRE+lmRAl8jDmAjJJzu+ZEAXZl0AADhM6YLWJhzKFLM/ikuU1+vT8CC4JxSxk 7N2+Whwrdnyo2GH1abs4PmGa7v6o9rJoXx2e1scD293L2+Viu9uulov16v8Wx9VuO/Xs yZMwjsvYNm9esycuQ5EnZvb0lElaGk3MF9DxcR5BL+ajiHzc75bV4cA+3CyWy93+brX9 xI67BpMstnfsYXF4YIv1p91+dXzYHNjhsVqu7lfV3dScYeWqbt/MOCMKswjTchBEeXHO GEPkaiu54M3mDcMwr++MZHCyY3E87lcfn47Vh7fhxFwQlyn6WXK5asu8uIDzMBW5Aaoz UWQRAEmeDxdaEwssq8hq9PVVZDkU2Q/bQ7U/Su78uDhUE9PLU8h7kUHz1gjuuxwBIqy2 y91ddcf+WKyfoHGVgvWm0UE2xfw68UxKijzMC5Ha5sxqJgGihkWEzp6zPB1HJOGuNx+1 MA2nZlqBpXOZctagdR6iKStEmKd8XvIyy9OwKPhs5WWdvr7ysoC8/OvjYwUERwyoUD6B vDdWAL1hVpEb6AeQ92m1XaynlkVpARWFtZZp27xkUQbDGo9mLotGEbn7+Fu1PE4uhACL 4iSG0bBO5EyEEIBImaYzE0KihDEXts9B+g8GU0zz93ZR/08s2+/Ust0YQWG3s4biE0bQ EUYvnmFhnMLaq8me1/wVEcxLqerKus04aNiMBxlvGv0UKPv1WeumtcNlCYd1CehLju8p 62aLvGHWJZ/AgOz9l82vBpSPo++HLYPpgAxJOwK5xHsVW3hWpqvQTlhGaVHApwDPQ1wK zgvv6my3xxxTPIdTwjRL82dPAw6Q+msRnsRhGmPtNo5w1fUwzZjZP8YFckW3wwWUCA65 r7l9DmIhzjMg4gSyqjYF+y7jFmBxqTS/kTjqqp69PB0TUYBxo3gksfe79Xr3BShvajKN ba7RpyMUvPRhdjkvWw7ES3wpJ71IUgZreZiQtADKjDlcQBAbcNjBsyjopfdOLiZwjhS0 WEINHud4Lk0FHI8ZgzZOsVDJSKRO7e7M4AKLi1IM0/0v53mo04dOIs/cRc/D4Vg9HtiP //P+ln2s2GO1v9/tN9Xdv03MmoRxEugNjGmtV0ew5gm41GLMy9PawQCehIIXZmkxE6Ii ePBFobFJX8H4gvxXo68v/3Eg439W+9X9Vym4D1+3x8WfxgjXvQj+cLO6auHbllDoTANd zgKWhKdhFMGQnNXbWmOQJjoctIzzsSFiQfqA14QjCCQtIVDrRJ1AUU3yqpB9eahgfNiz 1aCgDJAaDIwiSBCVUSYxZn2d1LP91w3yTiokvwclum4PN3jTG+6Ei7DMSCHBgJxyrDgF bJyi0Pqo4FgOoKld+ggVkgQWiIZCojiJF1BIGPNQlDN3e44jcrmDGFhtleV9A//m4rjb f2Xk6Nw9kr97sWbL3eZxt622cIpTufSbG+lxlXy4rCiskd60bg4I2mqvtMhCqFWjvU7I AdZcYyuv58R637rDxxGJQT4A6ZG/89AtF/qigUtS4XT8G4fdAhEoCXCr6udhq9bN4rhE K67q5yuIN7irQXxNArdY4ypiL08nCmOE3M1sjw6D2HLmq3CHpbSqscWB3VWHJbzfcOvB UT61OBAixEJGWPqHccQBtl4K4bnGGnC5k5O8gOmSWxrH292eT/XKqRTnKYgCtkXMK0P0 VBGRAYliT09rXvu807yomEcijl9E80KM5Sks54PMwC8cVpKOIhJhs+GHtxPzIo8QkAEF VSdxJjbgNIPXC2G6XRMEkjHwg5kH6SAfmco4b4nuzy44nE5HgHcB08dM7dLpGPJiLP2+ r6ANJXZbImYEAWuQ4OQGva/2e8huGKxNnNOyHuc0tUhPEegAYaIbNi98h4iXMs2GGwJI AE08sx2+G0Vk54L/G4nvAZqWv2OJelAujNXxK3s6yHBICpglK9bULGFiYFPdtHkxhYhp m4kJ1p4p6B9FZA3K/fLz9+8yUeS/+maVYLDv9ByCDs6KZF4AaWQcoqHWmLrysgg6UJte Bk27lp4wxHpmqpoF48xaBfFaOWJmGrT2tA3/oGPNnWT+cHP48JYh+Hy7O5K9eLH8/LSC oNZel64tHL3Qot721HQkeg3GmFDPlzG2PaVYgUUpVmBxjLD0BMDbx4tdnoM0gfrMYDt1 eFG6DmCpUb6GEe53Myp4p7Ym1ck9PSpOqydJGJEBaZBat5FB7H6xWh/8iXAxiKBlFW+3 wrXn/D4wuGxgzMswEXQrppeH1xCbIqwyB+/Uie0pJzETFtuvV+nOK2hPYZAsC+wcrNM+ 4Zr9GmJLLI0iLOnqxPbsaB8FSu6W2BCbYBQ0xDKZyS0Rd7Q55tTK/vlEjp6paAx4vcRG SwSHhCLLYyVxyFep1ps2hsP4Km0NJ3HkCjXJ+KtKnBimigzDM0jiWKWr5PyzCqDLlguE BSglVqe9xv5Nr0a3wu3FGL2cBpYx4L6ESzrHDtwoFLFhjHOmC1OjwRgvZbqACysuEbqg TBe1TrSoRW/V7e7EvhbWywPr9GAEDz88MD5TXvRcT7+YMVFX6RjyKOTvuz+P+8VSbYVY rw5H8mvaYF5ybiyO7EsFSUYzCstdb0FDBfupVzRmr4Fu4PQKfABPCGyTx37dedvYxhF5 v99tpF57s6gbNbqjvqfevJUgZwCHoYOZ1syLD4D6BcIKZyWwBDwWiECaq8AaRZ7wIzEg mMitYoSWlk9adk0sluKMY6t+gVQVspM1N/YEkMfqwLSLTbaghtkDCQCgrLuTYZxceHtL IrfYO2slSLDgjBFXbxpR45RWjowmetmstqvN06ZGu0kjcp72wEsi0lxNe604T7sxdNUH 4FWhgvFejeLsw+TZRmx2iTp9tS5rDnI3uno+iEosmKQ5BwvmSBeDhbp0ruWldq/lBQRY d2CLrdHAqGimWu5cNpe0DA1DVH+O75K1RmHUnjP/hd1rYhSRdQCIWEsFAlXsMjt+fayu 0/bthXtfo1SMbB8RuZjqDavbNfvx8HkRZfIcgbDxOwdSDtuTEJbYYUriww0MOmTCXKzX 3dPwRBNaXD2+CQ51aUYa1gQXFDVESzwn/WZzoOGXYfS7ZdAr0S+iHBsOsMm1QX9NZj/v ing8swgO7w4FzTeI7SkaF1hidnbzSW0zmFFIfCBXEBYRcJ+nCSK7KapHCBPMQdqGXtoR RmlrPKO2uaKrTXozQTAUNr9hfE2I2fpDronoGd8CE10xrgHWuNfJMNPLRQT9qK3xDfJn OS9t8okGsT3npfLfXBlucwWjIOoqirCjpUH9hF19GQVa/6ohavzC//mkmzH3CsS5ZBn2 /1LkWkaR7NbzeEq4mRoN4fZC5l6RUt6+3KRLe9WRteZegas8HxE+d5VIusx6xt5bpw9D 3GsnVQr7yV/3+8X2k07iVq0R2AmrroM68Jc3k3jJh14ggZtFa7rvtVabCUMk2IIRIdxq 1gu+UUQeqs9PSDCErXX73R8rSjOkA9pMPiF2nNqcZhd2ugHDAA2lxTFm6m/YbrM6Hinq Cisnmo1BzwyuLdPa5dmYWDNUne6ZsGycIXQDu1dnzbKjiERmyYkFbcmhlBCTxESdwLND O3Vy3hK7OaCVYC+rE9UTy9VN5DBDv1pcjkV1uh3Ti/prIKiOpjOdPkw4qbgcp2GNcJV+ i9VB2ngekVQJu8ReKEQtQfLuKAEP4QKhaggwC7PU4ERtcu1cBKMCogZo02Ftc3uMPdxy 2XzZ5NqSse1h6WsMdFCNU8rqTHthNRS66L+wa8jniFC7rClsJBqSWnjUBmfFydQGEd2F TND2UkpYDCt8hqQbFxcM5nnHCCpw6IVs71ERIm+AgWIjurCvieDyuFouTEp40+DLGKxs J9ZjZsFQp6/vgoGSPv9cPa4XQIfkbHWIkCLabbYold2VUhPq1JRekPzE0NHu1zYNnF6V DOIKmktIOjtnCJaUY4i0S0b2BemcEXvKqs0jdjwckNF3+0kiiwmRdxxDVOVpygzx8xr2 AumL+Mwi2JI8poCQ4cuBl5JQNfr6SijK5ovslGuVm6OZc96LxL1KDo2HKTGOTcgLnKdR 7/6+MOXDDQ7PoK23LAk59jVMPBYJ4ldzjt0YdWqByXqdoWHSvhuzUie1z2fylH2LdBig FpGtEXKeYP9wlEmEqjfnnjB5mgoNAPNCFk8cr4LggaFpmqzAvW5j/mXtZZe+DTpnArSw 1SDlWJjPWqWOIhJZg7bL9ZM6QYGMWhZheQl2XyBTvg5uS3Qj5qVa4XvL3OEqM+FJbKlA nvzZ5l1LavT1Va2U+Pmd3NKqof/qjra0aohvebMREq4OhbHHfFyldi/LKhvVZpo4L2YF Ss059uTMWlaNItIe3mLsWWdO+ZiYB7BXJMxFUbBEt0TzQE/QYvWqMr89Pn1cr5YauUx1 Vplj2zrJMxFnHOYcYT2yPfvxhYMb4dgYQeTv1Vdk5ZKZu5yfy9/Rt4EdFnDb/fjGy+ow MSObCGLTtHnJsqiE4TIfruOILzoXAs9nhbMpHbBReQSRMjuTMWY19w8qk1db3JlzOKAP p2YLswfKtG5mfIEgWZy9OG8dF40hssYXzoOjkn3Qj7un4+OT3DJHd03jw+RsoTNVJrpx s2ILnMSHBAgzdz6PI1IfeHed8/QytOXwFEUFAsgbVM4DI8QFDFLwBuppPxOiKHUg1/vw ptwWcHn0rGMoxmm0cYpgY7kGqBP1arm6yHKWFDh2Y1ZEIQqIrHndNKkTmp8lWY0ePaTk UZ7OMwdII3ULjicxRvO+Vtu/U4T1uvp9xf6V/cfiY7XHVgiCQd/9+YhUNAf2XzgzdYNi xvk38mRh+tH798tPC0Tolb9OrUFM8n3TynlpEKTST10y+1eVMBymMF4gCyRy1l5J1EXz 9y9IbcDZr2DSO7UP6d178N25fUjv37XOQv+L42z5QZyKjZibkicJjXGMNBBhygqIJkEh ICihvOEoodwhVLJm7+WJH+41lD7kwlvxDrwBeemRhwTv5DEiley9emOvvZ+U3SpGbpac 9i/TwRAC2aqJxkbRGkV0ZLY+dyFKkAabyihzIzwuumZARa2aD4hw+UV1clMMnG8lWpVR TyHdimtnrWRNLYdnwW87DnqH2drVWgfN96zZg+xzGnxOaY2QbBTKjI5GipFUSqAvNx1l a5TBr5cWeWCfS0twa4kAiQzDHEcCaXlcCdLDZ3REXUeZeQpv0k+ZErypox52/BSU/oBo MF/ERn0EqCGdl6UK0RplgeAS1x5T4rfRlLWfMiVBZp5ZMgpyxw5QnLdhytYoQzaGhI6C M2UiBU8jbzrLDFWmJEB2NEU7vcs+pcv6lLh6rreIBvMu0/OOKjOKjnZT4trjxrD9VLtk CZa5ZzH7MnD6g6syyZyY6TT56/dr3OO0NVJ6NHnlMwlH/hgcKgYvG/ZPqbsM8gT/gmX9 /uydfraUuYrwAfoW3gzuxvfyIrBfxsGT9HbY9IhWe0f1/fszd6ArFqJwdSEGBOzgAm55 +z4ShPbrUiwySxvVp181rUHtrv4bZpP8FbNB9Rd9C3Vtj9kvmx7F20CbuZP1/fv6r/U7 GnUSzlYneBFzdus/CRDHjDh+AUcBkQBxZWZCdzBtMIxpnYBqsSjeZCaqY3YzoV09J8Rc mRMpeioFXkmHMDLtaT/VKgFruDLTN34/uDJ1Yg+1gkdQ/xnsS2mCFNWclEyOfODSClmq jFn+URNWjJN2icoY4UmYazIHl7t176WMSzgiWK+m8CV6Uv+RWfCxmoZauIXSYjfvcQgG DqZjNzi4GMoKF4/m4sFc6J+CGwRKq2dghJPP/t3Wsj/hfb+y2/9kMlJ+EMEaMTqCcZYf joDhoF6SjUWiIvvmX5wN8Fm/4HeMaWJm2vytbnOuCoIbU8DNE7G5MHUTU4DzhWR/2Sfs hXo0uPnpR7/fKPqVJo7A3hypcTDqKRgFvFrAOVGQMi+R3g+hsj6jYKCRZPlstgvHJjgO E0FPtRzLOYW6Ah8Rw6g/agc89s1ZhvkbhjxhN9gOkUmmwTWGPDXXOOUNPIT25uwGbfNY AaKFAik6FkgAJyIBw2YtkrBDv0VSc6GL9c8eX7r9zbFc93dSOgCUTmOpfYbiUU58Ri0T Nc8dnpC52X3Gi0+eEQrnkCyAhhaDc5zeifvRCBz1CWpuGHCY0ka6ZCACR6Q3cDTldMQh EmWEzPeA9K0ygF3sM8SuauStxHeRnykH6ZwSe3BYYkxdgPCuuqNReC4XMOg50CibSl2o b9ey5XQrOwK3tLahBngPuOdB2inkTS0ClKcvWKVlyzylZcqcikpxjJAoCAZrYJwW0M04 EM4H3ras/ZQpCewzns6i9O+IgKFVmnmOIdk2DTYOqNDAGyUgPoPWN6QHtsQD3rbMPNWu 50o8oGrrecDbllmUYanySjTtDp+ALl3Wfqpd4uqBuXSfOt2N/lIdbyGMGRvIZg1FbIlr juRdOdKtpxyE8eoNx93Q7EC3wK7gygz85K49vC1/k4gYh0ZjbQ6oqu7AuGAce403UT5H KnVX9necC6BxNZ34IYG8xdWcI+xMfZuulpqmeqn3O3AscKms5eFneS8Rrv0C3QWc05kE CvvKa/0MSt2V/R3Ua5xsW2twciB7Qn2b+ovqEB103XXVwsRQ3Z0Zjx0/wVRcFnJqu7I2 P4Ex6vwEBtMyocUpoLJddrrEvcmfjubtHdLFm+wN6dItJUwL3ezAaRa61WssHBVg0ciW 5m7BkbH/mZEtnZ+BGH1z0pMDioRX5ohsDcHTIdu+X5gnsiWRnsDy4gFb6Na8TDqALaBt P2CbwuAQ29MsMXkRbvzKwLZN0gnEWTttBXn9Hpaw8A8Dnbrrgpcz/fIMQQU+6ETKCNyP B50Z5Ae9Dyl1SsbV3QDAiQVQkABIwlGGnYlIy5Nz2C+hJltlUG0Al0LgNEnKAZdwWPyo DOsrCgE3dYHquuqOBpzYxUMNhIRUiLN+D3SLpHXyd9kP8h42LfM87mX9QNc/DTmpTVGC 3Ywe5LRlnlIwZQ5y4lhipE0uCe9pzCmwPR1ZU+F67ChrPeW/qaNeBnsTErB6kBNGZ6gM QBoLOQl0RTnyEVkwaUokCdDJZM+2Ze2nWiUw1VgNaut5kNOWWSVuqXIlinT5Km2eFbo1 zWfwscYTHty03bkGJjSPmU4nQqT12QyMR7cZUr8tusyhy7P1huNNUl8Kx2WSmdw1YUNt 38U8zTSCxGYqD29COmDEFLbEtcabVGrL7O/IME8TUCLSnLhfWm3NFyhiTH1bxo5pvFkv 9X7X6I5+9/Em3SsEab6g8CZ92+BJutbP1K7M70S9wZumtQ5vUk8oZElXBm/WS/3fGzbY i3gTGfnDvJRD4TGPnmceQrOz2DBUcJYx3OQwTHa6xL3JA5z27R2yxZcaDdmCd3XICFPW ki3+m1r1Ats3fj+Y/mohVeoY5DXCSqppg4UarR33O8wGS3nreGlO1DbGVwVYlUnNB2QD bLDMt8HCdAVb27PYYA3B0yHVvl/wOwbQRzbx9W2wpAmAVLFs9G2wGexAbRNsb6RKmiOq nwPwykC1RVEvnLpCAuenjY9T/x+Ytc8nCmVuZHN0cmVhbQplbmRvYmoKNTAgMCBvYmoK NjAzNAplbmRvYmoKNDcgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCA0OCAwIFIg L1Jlc291cmNlcyA1MSAwIFIgL0NvbnRlbnRzIDQ5IDAgUiAvTWVkaWFCb3gKWzAgMCA2 MTIgNzkyXSA+PgplbmRvYmoKNTEgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0 IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAgUiA+PiAvRm9udCA8PCAvRjIuMCAxOSAw IFIKL0YzLjEgMjEgMCBSIC9GMS4wIDggMCBSIC9GNC4wIDIyIDAgUiA+PiA+PgplbmRv YmoKNTMgMCBvYmoKPDwgL0xlbmd0aCA1NCAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUg Pj4Kc3RyZWFtCngB1Z37kyS3ced/77+ibEm8IUU2691duvNdWJQclm1ZOu3aiguScTec 7dWONA9qZtYU//v7JIDEo6ofVdXTs73c4HRVFgqVABKJLxKJxF+z/539NVst83W7sj/8 Nt1quS6FsHIXD5vsj9ld9uVXj0V29Zjly67u8qJrw9Ui0B6vsrpaL+u867Ji1S3Xq3WZ FU23LLtVm7VFvqy6usrI82389WJVL5uiy+pVsSxrn27R/3aW849v/JWPF+t6nedC4J+/ q6tlla+aKlu1zbKoulV2dZv98jUs5kXeZq+FP/OK+3l9m335T8Uyz4rs9dvs4jd3T5uH u83Tp9nrP2e/fg2PUR09H5frclmUFKDP5V7evjg1U+2yW1Xt3Kr71cPl26es99+rzdX7 h+u7P2V/+P2rf+s9s7e/vfwxK/Oi/HQxvsZFfhKZNC26Vy6qrly2VRtqfGHkYr80ZCeu 8SCsTbss265ywrpXDF6OqXq1LIuaXm960JkwhXapUDHTunW9zLJX13+627zJfvfdnzdX T9nrH7/fPH6evdo8Zfdv9dk/Pj09XH/3/mnzeGJpLNeonLops5UrznlJY9kt61V1ZtJY 5ss2L7tpDY+OOXEfbhgmW9haJfwxIsl4szg03rx+d/2YPSKQ1/d32ZvN4xXyt3nMLrOb 60cjmfdWXJ9EXLOnd5dP2W9PLJsVg3TRNKFETjZHjqD/+H+yR9vT3j+i+JPaXziwsWMg naPWGUm7qlz76j+vjlQUy6ZeTcQgLyizCX9jZfZJZPby++8f7i+v3n2eXd69QTA3SLER 2EuvQ524/ser19l3PLZC8fb+4dTy2zJCrFaM9K5080XCiOs2UDwApstunQMxSupw3YCP owtgSYFu6MqqyVY5Sqyum6ysl2W+XmfdMm+aYtVKhmMQ8YwuEkBGDgRarapp/fkFpdHx ZzX8eGncPG4ypyYTbaNTmx3aZtCGh0GkaceqZdhOWB07uTBK/NQs1kx7uqbos7gXvS1P zVTD4FG3DClpve1lavvAPa5LfvUK8enyZr1mNsmcs+zqolhHV6++GswhvwiTSJ0Tr+tl V1Smw7TFatlkNTi97pjb3jJHTQg32SszVQyZyLz0UJ6tybNZkqXN0xCKIjsiO4bvxvBn 8sqBcpL5nAxXteXPl7lHmJenrTZf5hWzDCp2Zpn1bVtmd5eW+fAEHqW6mDid9EqVSdty nSPaW6aTi55xYbtE71BPPU2/sIaOvXPcwBSCu2JYSTTpwPYxYG8aVo4ZXIhh6LD+VKzc zuLPYGWDi/+0uds8XN7c/Jht/nZ18x7cnPVhxyUD6vtH5ntP99nt5fXdE/+fGnisqmVZ dmWmxZsPPHbIxIwhK8jEqlmu14VO6kai+Zcb/duEv7Gj/8Pm7eZhc/d0fXmT0cibPz1c P/3IlUGkby6fLr+7fNSJ09Xlw8OP8sDjheOm+cMBBiCgQ83ejoqRbdmUDQbRtNDJeNjv npMG6bhzYrUdoz0qxc37mMpe3y5ie+l2lbZzkB6wNazDaJCmDk1NtUxGWzoXBl9GCtRt vS5IJgbgAiwt0DkUsMKStgb/+BcYGpoaQ3CbrTFH5zUgfSTYPqq7tVRCkau5ImlZKjEx Om+vxLE64FAV7rGVr5noM3vOWsfsGIX1+sRYsamoN9CA8pSMYQftKaZzH8Xh/OpkwaRk gkevTqtzpKqNRrCjCnB4GC4qZqGyNKKM2joeO415//jejL23l3+RWf+dqNM7xuIfrrEM WM17dY8u/puxB5x60EVe1nRpLcoYEb48cf1WzZqJNjZqZcrV7wwlsFOTDnTTIbmt6exF WcETk5oVCtQo0lUnsyKnSSXPtyz8LTEBgmh9Sqq4zldi0ohVbgB8XuWS9arDbhxU7kva N1rgZdc0q3O1byh/0zSagpjPsx/eAXUuxQpMt7u6/55u99beYFq7fHr/ANDBMndUhxtK 0VhMU3YN9nnRfq4ZXDEToe9jmkk9cTJ42D3yVdjhWH6hN6QykzD7vMP0YbVc5Q1r16y3 KVPT1PLj95ur67fXV6dWbnWNImHpusfljKp7PuUmwseSRQNTGBaYhGFYXXV1nYsuSrSb n6V6paVvBKX1ojixRkWu8VeY5KbwgtOyhD9qc9SyljXHmkXXu6uNUVIRvAEkeCFdjDLP pKv9QyUFX27itdg78Sox2nUrHE3atFjbhXdhfUKOUVIw5syQkR71zO53ZSnLEmhTAdP2 MNvXqKFmR3iuDDTqYSVVliuwTUNPS5naAXL77Jn5+gNmGWew/+bi8f3Vu4xR7fbu1E43 YdadsL7Y3vjOIejUTjdh1p0ytaM++2PSdz9+7rvSiAYfoMbDDV7pCmva4PtrbbsUPqO+ l35cs6DWYj3Om7KdoO/1jZ6+r9riRewCdY5TTTMNA76kup/B3uWbW4yrL+Qx1yYVmPTd vrKZ1Hdn6MK1OsylPO3oun3urj7PnjZX76bUm+Nx4X0xD3dfv2SZ8vhB660om+VqvZJR eChtB5cpqLflcvnNp9nV5V12arRbrAGDbYF9YQurh61Rl3d/2hi7yP37Jxwlfsxu798I Rr8Ufx9mcvcCjUQCFiN9TXtSatr/gEds5ZclbBHGWEi26++xFsnDUhlWJaoCdz6MuOcK fxP+xsJf5+tiMc6UDj4YnxU9BoAbXe2FuqHjuyKcvt2PYVY1QsrsDlXaR0HXT4+bm7dH VfRhmS0aLGbdGjieyMRYq+nnxgNKXKEt4g1uUlf372/eZDebS7NY+fbyBoOqM6u+PcqY c7hMddFSJmafWqb5QvJ84M57S+FWiSkSv42qXuZ5xbTNTObx7q+tqXI4meeNolyRTtd8 1AD5ItiOCVu57uqzVWYJf1TSqLk83qm48LOqelT/OkI35DhRYtFpHfdjRPSbi6OYPdxx MJAvq3WOiT+p07HKQJZJNg+3j2rBNesld0/+3g0gYvs9SgMMaz0yQ+wdPqqioc/hupoW MN0v0Ye033w6pdpjLDPSgQQdgH+l2PmSaneifBA6/neBW5gg7h8M6Bq7wQdGp/oHBdCV MroXd2/vYTsV66D+hq1NxUQOCYX0JJwDqT1wd9PqYrrxVg1LO4u3WVWwSNTK/DpN2V92 Nx3F4E9vTtUXggpWc6rV2TPsfYe7Y8CTBWtVxbpzSmIkfjh2fn2o4ncvRHiPqFl8W1+W yLIadb+F39q3A7bH4mM29h2u5oIZBJtvgAuz2H18Z5BOxGTYf7iDyQEgHsEkewlZSkE1 OyanDce4qh/F4HxZCHPNebVrHezNUvxRJThcxaXY0NbgrHlVzOh3//Bm8yDzX3YR/Nf1 mxPzWwEg66IGQ8wSCVbF39/E/mVb2d2ppwcyfEhEZE0yZ9tBywaGis1FGSbYuswxmPTw r0hMV+Ld61PieVAWBRSfUrr5W9OkqZ7WvHt6GjPoi+jpnA2/uHNN09MICyYzs1fq/uTT PY/wHKtOjSQjeH8iul11TJGMvdtIpM3Y08wmbUa5lrV2me50ayg6zXmJtgN/4VNu3eJ/ +XoX9hpUzTTv4kGnOayVdCxV/myDOf4O2urEq+KFdpHQjGXFmkXK6Oi5w4sYO3Sk7/G4 V/oneajOaGCcPe3elilMHdMln38bCaCb3Q5FDlyWTRrJ7ZztFA0uVzY/k5vcdB1rzh1+ XfPzkyzYNbIOea7NNpLVrDxlZ2xU5uR2Do+rkmmMqUP4szdHlTlk4crsCGmZD89bZki0 n7c0rCUxp30Bd+HDejQwhSvgShZXz9Q43yT8jVX0r+2Ky9jJ/4xWXQHXCoHHKYNzlsyf b1rkvZN7TI2cIotFyvgYbsW+z8emX7bosbl34Nmu45+TKbc80WNqZN35CbpxzzztOrmf RM5k9eaHyx8fT9zG3gurx+MHbWPvbdVjamQbX9+ZjWhv3N6jo2rw0PxwtznJO+FqIcYY y4/rPfOZ9U64U5i9OapmDw9+3glXmZo2+BG14ygGj6hNNY0r49Om1p9nxL0R/bT52/c3 11fXT2zo8CWJnTR3TmZ32hO9laJhtxvOl6swbe075x4qvvfz9Vnt8vOVlYJVu64Yg91H CQCF45XZBR5s3dtMI/JGg+07WEaOnl0PyzV2HSaAMbbntcTnSma1B1c87jCYvCH8xs39 DxnLHtnV/e33N5sn9s8+nlrLS/i3omHbXZNwvh8FHTeFHFYzjRgtgOxWnEgEy10s3Sqz 56w4wxjvanZaVwcAx9ulN3fvb9lNncrJhtAu3hyyLTLbeDUwbJRU9p2EU/NMgdq6zYqK ncqE9PHKwZowi3WFzyce/T4hRhTZExoSClbfYuv0L4QerWtSNusZc7thqcaKWujRhEVk ljCt8SSGSCab2429im7MhQSFclF2PAyRx24VOcBP2Ty/PGpBecQAqnub2Y8RFW8Gttsp YoMp2aHG8CKGiZBtIUVWmVVKNrF4GdslOvrGM4rO4TqMRARbjizU2hn4jEp8vklQYKou JWaoxgUcCZBZYz12mfVwxYWZ9yweL089Jvq4n03K396GneTGPOgbhyvNuzH3mBrZsN/d 3F/95RceK55mF0KBo1q+rhmfJ1RcALCnYSr0iIpN65Xf7D+y4l64R8zi8bOMvTknbtuO cX+FzTVrUhY/aKcwvjLYY1OeGC9G+cyZPnHiavNe9CmL+/H1y3UJItwVba4j13l2iVk8 0iXuH9K4lieINOecHpuExf3ed5PatjdbD/FTds+RgrrDN7CUGIcGlbg+cXAqOl3dxTyO dBAMAGAWj7TtLEM3nE71EPRBOJqU00Tr9R0sX66J8X6QgJW2hROeWNgfEQJoB+6Mm9Q4 nRnB2+uJ6sWuJjQ9EbzdctR5it08Hi/fT7IaxpU4sl94jNdjMGnZvrRNAp4xUyMjTnUF E0QAXdZjasdg0WcPu8Uk2BlzOLLaCERkXTV6HO6tthfrpDXuX7VMZ89YD8/jUWDnyfuE Qrwei3vb9tRdwu8r6DE1vktMQZ1zegSWk05C4PYY3FtrL9cjsDkT6+2sO8QcFidPw2a0 rJ+G1QmHexv29N3B7v1JWRrbGS5vp27z8HFGxo4PvjeMr7MX7AwYLVtCJp7z8LCawyPd 4XZz+93mYbKyW0QHGR22jHmrU52y+WH7RJC5OXU3zXF6hh7xE5splfZynaItWEblUKrJ nWKyrLlDs0aqkrZkbVxipNczOTwxf35mPY8/uuz17ff3D9MnOnO7bFqNe7vsy0lfIyGd Vu70ojOdws7iUVTy9ycWwYBQUhb3tu2LQZSUp5EYZWafmKZagkZOedxbby/XJzDwYP4/ b7POLB7pE3hTvaTOS9k8k/Zl8x3G4hkj7rQdQzOgShjTZvH4sjovZXFv276Yzkt5Gqnz ZvaJuTov5XFvvb2czitZzq7wRZyMQl+wT8zikT7xZvP28v3NyYGenwalfJ5JA+OvwJED 5z2ozeLxZZVeyuLetn0xpZfyNFLpze0U2d2kaH+4TtYd4SUlsFMkf3sr7uW0Xk4M+hzb 8TlrvVk80ilefN24Tjk9jyauOo76rho9eSph6oMtHFdsZy04pOuc5W4ej9ccVf51++2M ldDJ7goas7PHaNLC/RXaF9MsFecpc2jFWWuWeTyiWUIjT7SvTG5jHT16rJ5JG8tsrWJT +hmPHtUsHmlj+vHdnOWqicZRxcw9Ps+kgWXnQKvhE8/TOGrPI5vKIw1MkM+7p4cfJ/bg 7I9zGzityzNpYCKoNgX+Pufcg2fxSANP9AmdYa1Sf5UqZfFM2pbYLG3NmVfn3LazeKRt H58IfTDJDd4078S+y5TNbHGoUjbPpH2JWMPZ4S627Zkq51k8SvvOCW5BE08HWO7gvSrl 9EyamKNdVsQtcV04YerDzd0KtmrW571iiiF3Bo8PnAmwYfI23Yd1rl5J2Uza98PN3Dis u1utVK8kTH04oeN4OE4RO6+ewMnSHHXj1wzOo6ZKNmUXnMJ7VjqjlAiwHCFroUi/ouzR u+5sr2MsFMZ/TIJqEmrX7iPOcxuRPtz5zQslgd/Khqi0k/DRv7Jhe3Oz+ct19kn2z5c4 vN1y5gn//fpv31/LcY//fv9fxg8uK4rPszLnnJLkv69/f8n5I0X+7an3fCOaLVszMi3l 6aMnHHbeC1XfSKz2RsPyb5cHd9zXJHmYsddWDpEo1qsmI/z2kUwd3B7/NWUqsm+pqTeZ OTHo+cMZljWYgdUG8X618QJLCRwPhX3zzaxogZIBr7eSYScB/gjw4G9tuEB//NGy2xUu VY4BbDD7klmdcSgzJzObeIt90g2pMCs1HOuhqZqOJupYpcBNkDgwq2YRUWi0TiawvOZT OdoIyiJ+D2MbcSypo/Ai+1/rpiBunPIkx3LgFVhCcWVRismqRxum2kK5ojZprdWKc0Zd 7osb015VJUcW6xdrzsVsiAEPxXEVUSzrkpVPZEiLPmGQgqoLaXDoMtUp39eMtNJFggxH 2i6ebSVEJVHSII0SFpriKntHiJAy+yH72vaMvu7+Iihv08MQDGLDdAVRz1HdyFNLIQnQ 3BHHyN7DvLu/4TlnfzcYKT2tKjhEoYZa57SsvVsRtlnev1qk9/vuruy76zz6FjmviXPU AKDIyX2Z0Ck2d+GV0NH6LcN7uE+fJnfIVlnT7fy7N9wzY6kxsHuadH3/dZ7LnfIm70f3 i+QufYY8mKdAfMu1fIt3fY35L2uNkptRCa4eHK/6lLfjp+mdNP4rYgGA7ggQvy7rKBJN EigoEscCRw0ih9/GIvohxNZrAJXkMaqL/t9TU4kK0v43SDV8L1V5tlKM3vD91lXUDd1L 4ulIzytytG5LlJ6yXUtcHzZzrAgIJZ2hKYnkQxibP0ZuPTJcFXomat6VLCZKJHP5t/S3 IV8Jgs05Gw5R8SVJaX/sdAa8TH6v32ZfZxev8EdhFMgu2BJCF+cCb1V7wRF89sI/4jBD S+EwbZP2X4ePyO/b7PW/2DCiokQ8h4cYduAoMFyLQY9tfDkTHtApiNqyffF3wVz8rF+I KwbEY4rYapm/dISVJSwulFBoilIv9N1KCcxlTWaNEtZ6YZMuLn7/27jerKAgDjWoTARl LTFwJQBUvl6vid2GCFVEhogExR1Vwb7h/buGvfgxQylXVnu7aOWyVZ1jdaWd7I8VFyKA eXH56v5TBomLW9iv/A9CAA3hKLILmr/OLihVm118/WnWZBfUCvT6U2YWF98aCrWxMmlS QZHoc8OZQsPRBOuOWQtB65ThhWU4x/zRZ9mKCvGwPcu//rlh4Cfm7yeGAfv372F1cZEb hn9mivDZpxmlsk+X9gVJlF3IuUmwL83nE8Qv8sq3i1jot5cl9FFC6QFfdCJNJ8mbblAW W/1xWb4QRr6AE063/YI6/wfD9v+wNz+DI2juEdIpCeEMjgluJckpktC++Kn91fcc2Sa1 mVAT/mX7EfdO/umCjKgV/v5Mip309e3F5lwy0XQgxy3FlgD0idANW/AzU2o+yPfks5b7 z4Qjbj/z7Atn7uYP9hmSJg0Gu5SGkknh7dv25jP75H/Z1KE4JrBjADxWc2nhQiuisAl7 Em2rJK5HvzjDRvwMgRTGlX9bKqW6ArhC+rJJwX9qW7FKiCPe6yWx3/tPMqOPona+QMD/ 2bL0a36sgEf8fVbZyiIGoTwUqeFHq90wurhATY4SBZkRNUhCWnWJAPRqTFr99Z/DeKLN kDZKswa8oA/SjBml8pzICP1G6cnYxWrUN0LDc5wI57SuQ4i6nLnIgY8w2P69rcjf2RqU ZqSa+TRi+XOag1oVmeBHDgyTX5teejQ30qP5seldQnvj8tWOQVa28/LXdB3e+geb8j/J A937G35o9f9rf9x7jGP+NZf9z+KsEmZkrPMMSp9yAgMN3SHfd8VzCT8x+l8knxTukQyP IaH//Bg5ipoiXzIVjg5M4QyBEU2RS6VSBVJ2WI94rhbaCsI6ST4JdeiqBa0hjLsffSyj A3WrOZvmWlx8oi3lvpS7ZnTfl6qgRqQqRBYcH5rlJ65mpd4Yq5Ssvy5Ll8cn0qoMuP/T /rjGpd2nVSiBxFqilESyzea7w7L907JEQGzzUxJ7/Y0ZjQpqlLriGcxQoT+llLbO+UvJ fXLRMNSraBh+bCoKxzUl5S9CxOuW/o3LzD6xn/tSKpV0iJK0m/m7LU95srgAyPFlm6p0 nGYXIDP/DfvMfsHyYf9Cj+oUJbNdJwUhZQCsfWRAwcRbBgp0EvFj4tFe9bZIkNQXn+XH Dlm2M4oASE3ZJ05BizhQ5TadERXeEuFE3Y9V0zm7LnOZkjjOnTQkerqvRGFC9XQUOPSM zHHrYD1z5riWchoD3ZzzNoxFriUgFTmIzYMTBKkwvR+Y5OzMmsbXwLv+SoxyVYu9giDQ YKSW8MBMCzGiDGgYUghtW2OMIh3bwxrMcULDJNTITMG9ywR027ti4Zls3ZGWx+wnR4tg GghlTSk3UnqmvHH5i66mTOGtm0U/nxtnd/ATXD+ZbytWhHMO4OUsmGDic7Qww1/4dGGq jmFn3XImWERhib6Us7S30DTVomW7hEmlFM543PIeB0A2slE1Nk8WJSZr8lfz5KIt4LQW e6VaIh0hMr7uTNN/CcuEKBJrmXT5xIZJRwqmGWUnolimTU5ql9CCDFJFBh1NE9smXaUk Ng6tcjE2OWupa6rAuTZoXBpHw3Co5dNUQ0owUMqUP1a4mCT0tmeZFNm1FjzZ7GQN8el9 ZJlcaxpjbSSmplgmO2ddRLblfWrQPnX3e+9c2o5jeXhXzggy73JCWM8yieXcpjC8+Tt5 H43i7/fcwZex6Pm0kWXS04z9UL9urYmeN2dt1HtrmdS77WnXWgfOMulrzFsmtUatZVLv jGVTrKha34bzHXczLJNUd9WyuhFbJrUnxwZ1J7TGaj1DaKNOuVuM4/6uoh20F6Or6yaR zrHaK1pbUd73aa+gq6KcrPZCNCKaq5ukHjytb6CUIF85a9jeQGkcJRgL+gt8Xn+Ps8aV jFytuq4sgr1PZnTG0hfb4SYYKBdig1IDpTW4PY+B0jHsQFBg+PkMlCO/EFeMGhmf1UBZ awV2ejHGQImgrBo2t3gDJQuEHJLdJZbsyQZKDH9tnnpOrgYTkaGJ8lcbM9W4MSZIe41R knmRvX5jQPQ2E+RuHM8wXleYEeSY1IilLWgYYz8TlddvFzLxmYKG1ZS7ZXEavtyyzDbw mL36ilWFMARKJ9o/Iso4AC7riN3j1pIVDTeC8uZD4SZkWAJG9XYiEgY0cpgnSBJUi5Vb IOCAhP7iQNcciMXJCMxUsMFBYvTvMKPqiwJR+nkJ4pwJgksGDFm1wSovyy+3WY/AMMiZ 5qQI5S5xXY1ekRTkAWh1eezBv7h/NWw3SfCv0sIIsmiVFnQ8i42Y0QV86hJXjgtyIwtC W2iaipxcKqUA5Yfv+RNWI/zbEK8SZMMBFG55ftFwRGCDfQyKA8CeEo2InjZMpZSQUwQb /XsyijnA6WkeznqulMKQ6k6HjeCsp2kqWHaphpTwXqgt4UEhtda858q3ToCz2l6hPKEN h6mGlKNgcEeviWGwv49gsKdZsIqlM8DgjglpDIP13gFb97R352CwnO2pELig5xpvAF2c XxQ5w4cBuObKQd8eNX5uQKN5HkFdubfQ1X/BgF7zbQdxzXWghiuFwFqKGweCtQY8rPU1 5CC3q1MPwd198tRCYP/mANZu1eyYBSLhYgFR4nPdRr4k2kFnCqGZD+rMSwVzKHJDStSJ VcRRttr9URxOeUWqZIpSisCvljDKaaiUWvFjkrpJ6sHS4KsHa0W3FBX2+gGs1TFY/agm wlpjM8vbAUo8AtYuLJo9EazdxfDzwdqRXzhPWCuC0q6JExnBWlRQh23piHV36SWVOLNF Dq8fGNYOWcrpTFtM/ml8c2YGinD7ADTA0Rq/Nc7KNcohLTbf2LH2qyA6u3jk3CaOdAof Ok/DcpGvxfYJJEQ+DAR8LiCNTywYNyBK8dJS9bR3WmBsyvjPdCucxhQRw6FskktpjP0N LhYt4YEjMF0REo05HXZmB8NRpNvenQ2nOazNoGXFwliZexRsymsM2gmihkJwz4DCsSkP 3rK+bF55K5Y0huhSVmEim7KYtA0tDF9gTkfzg46cQt2wgIMUO0zd4PtYi306wtSepqnI yaVSCjxseY/N0SUHRzF8hXQUM29dvxE33IUcwFeJ5TmURynRcLwnlb4XcgoY1BzvZ3KP MbXm70FIo1wpZdEo7xFU8TRNhb+SK+GQEt4LtRUN477mPab2reNhiaeE8oQ2HKYaUo7C 1ARuEVujw6ZcR1jaPDM4Go8/phX4ibo7iT4crq27q2iRQPPPOZvT4+aCaKjiRau4mf0N K8kTM7G5EsdZvd525TCqSRvjZsnFImH9gtwtCvm24ma5dmmSK30u3Eue6BtfWsXM4HvZ BSEuqOZK+Uip8fOeQ2rAx1hDdAEtxsdMN5d4ekjnDkKmnW2fQO0TlSBQQXkMxUcpIae4 Q6oyCQom5BW6e1/BhM4QKxgtY1yeQOvjXLovuhE9qP6lz2O+bYgpQkO68NkfgflWGR4A 82fDuWO/cHKc6/1LcQ+IDeF7/UuJLbFsy6J6Zpy7YvVAVkXPCOcOWBqDcx/fc+TrNASq 8wOMuXi9vsROo6IgwFSMQLk90rEB4K6ODeJmILt+zP1Ec26JM/2qxR7ZYkgpjTl3QGLY 6GRaL+4PWNPWFTGphCbu3+LqYN8EgW55cz4AbUC2QEmgeyhnQgGANsbNISp70Yi5L7wF AO3ls9uoKwnLYi22YwVjAC9HC+MDAM3RwvjALslatpNGlIqldgzE8fhAcBND01Tk1KPw vS3vYfcvanKPAagxFQratNvAFg0mu7KlYQLrSomHO6UNUykl5BQPr/pejD+VFgZ0x5QS FkxQLOcBRmaepqn2UcJ7oa7i0VXrPcBPbRsd9UMLhuKEFhymGlKOg58FUwKFn3Idw0+5 t4CTeVMEP1EWAV52nYOfQnWpo+dsXTV5Mg8tSpmOJfCTuZODn3Kl8DOlWiBqnjsIKNcC Fd3eqULuLXDUL1j4Kd9WeCnXLk1ypc+Fe8lT4KeWVr8AkKUmLLyUK4WfKTV+Phl+yla3 lenaQey0q+0TqH2iEgQqCNlQfJQScor7o4prUC8hL1UTUHrqJXSGWL1oGePyBFofftJ7 0Viya8Vtb3om+NkyAViDVgyu+Bjgp2P4hPBz5BfOFH6i1PFWTODn8d4DDTazUhYlzwh+ DlgaAz/v725+PH/4yYr96eBny873CIJNs4FyYCeQzYNIGSv7JIZM1plq3Gpj+FnlRMtg m3sEP7e8OR9+tgQdjIAk9s8eBfjZigdmXHaODjZeCApagZ+Dt3baP2vxLGblIYafSgvj A/jMpQvjgzhD2u32av/EZbFcydanCJIqTd8jJ5dKKeaY8sF7eMHlKxbkYviJi0pX5TH+ xA+u6Ai0pTgya5QSj3dKG6ZSyiJ6T8fOkFeMPzWvMKIrV0pZNMp7AJIcje3Ko6n2UcJ7 obbi8VVrPgBQbZ3Au1ICXghtOEw1pBwHQIm/4wGoXMcAVO4tpKzEL97bP1EXHoBy7QCo UF3q+DnrbZKnAFAJspsC0JrQMhZgypUC0JQaPXcgUJ7HAFTuLXTUL1gAWvFtBZhy7dIk V/45PCsA1dIGACo1YQGmXCkATanx88kAFCzNLlnp3EHstPvtE6h9ohIEio7rlMJQfJQS coo7pL4XFEzIK1ILPQUTOkOsYLSMcXkCrQ9A6b4rvOafHYBW4lSmp8t+DADUMXxCADry C2cKQNHqVW4M5W5//XO4rzYlcR6aXKNtMSSwKjJYVH9R99UhS+MA6Ob88ad1afUL8PR7 MerJwCFose+ecMA/lvGC8Eom0pLYVgpBPv5+qvmTODRFLY6q4ovalsZGO6AxbjA7zivx XuXDHbvIZCyRwypKCUjk3hUL6JZ352PQgnqirBLJyO6OoawJBQyKqpM0Wh9CkRBN4S0w 6OCtnRiUcPkEc01iTjVKC0MEGM2lC0MELvKV2VOlEJSNHgRLwZEmgqBKi16zqYJPWaNp 4vfwWBOf2RiBMkvAKULsnS4QVsMkoSjbkqzUq9VRDAt92jDVgBI74Gnu8BCwnuYfhnTl KqIY1k1WNItEpmpcafppImTgUgT0CQJ21XkTHAwbV+eBIW0WHfN5zTVUjBWUpqlCcyol fk/EVwJPTeulCurMRkmz6F2bVYOwNC73FjbWeOUE8CkmQl1859qBT6G61PFz7BIKPhsm hCn4JGi3A59ypeAzpVo+zXMHAOVagKJaP+XeAkv9ggWfNd9WcCnXNk165Z/Ds+TJD/3V lla/sCikJiy4lCsFnyk1fj4ZfPJFtn9Jrw4y5+Upptk+rPK0Xy6GsrKbEnKKsafKYVAs Qe4iDZEqFrLaoli0hDH0DLQ+9KTftmv2eD+37ZNBopSzcD8a26dj+ITQc+QXXg56StQI bI8mwBG/+5feUeccC4SceOSJ/mLwHzqYZrm49PV1ZORoqYGdGtmG0DvJ+UMDzwFLY4Dn 07uPAHiKiStad+9qswdKluFmAs+OuZQDYx3K2t9OxJ0FoZaaShbUZc+ahO0EyA5ogDli Ate4rZIOrdex3U5oaMRC4gm4d8Gd296djTsxVFBpHRN0LWlKuMnY8GYBfFT+tXFx8G/d LHrZ7Fl4z3FwrThKN7Z8Ki0MDotGaWFwwIOdTWVFgJhwvIQgi4g+lacpZTGgsBVty3us yq4a1sgi3IlnFfFXioA7FzWBz9YrDA4eP3pKNNh52jCVUkJOEVjz70W409P8aO65Ugp5 Od4jDOlpmoptei7VkBLeC7UVj65a8woWgLWuFQMMUEooT2jDYaoh5TjLJ0ABiXIAj+vY 8inPLJwUc3AAn+gLDz65duBTqC519Bxbv8lTbFitiWcae362RAS035YrBZ8pNXruAKA8 j8Gn3FvYqF+w4FO+reBSrl2a5EqfC/cKPrW0AXxKTVhwKVcKPlNq/Hwq+KzFTQitEINP 39n2CdQ+UQkCtU/sVKBCTlGH9OIaFEzISxUFlJ6CCZ1hn4IJ6sTn5Msc3iMvVzdRPUS0 HmytxV9WfDEGsBU8kpzp4Z3rBY8cDPBZ4wLWEdLZLsWG7fNsjLL2rxicTdjvb2JOKtbC LxjM9Sz7/R2/pwOtIz8QVwsmOFPAZ93t791FfaBS+5m9mFWGAmIq48n9jKCVzRWM0Odk LB1wNAayfhyL9S1xsE6FWYuKpbQItE1arC/FFcR4fAbQOqTJUIMvIglj0Mq8GOtcw2p5 AK3b3p0NWimZmD09/gRP9yig5NJiVMXwhiKeEf4tjKWDt3YZS2t2SK1sKBuFcAAqRwuj ClDM0cJYgI9+XrJMGSjEEV+viWERRgcCJjiaploMKCFN/F7bYt4AlcSwlTgMDeGK+aJz GK3Zq8LhssKDM416iuTVp+2mLKL3dMQlDrrLPYatSgtgU7lSCnk53gP8JC9H01T7KOG9 UFvx6Ko172Grb53Au7ZXQBmhDYephpTjYGuLwUFhq1zHsFXuLRBtTQAshaWoDA9buXaw VagudfR8RVxjtZnK0kJqM13RbS0slSuFrSk1eu6gozyPYavcW0iqX7CwVb6tsFSuXZrk Sp8L9wpbtbQBtkpNWFgqVwpbU2r8fDJsZZKN8TyJU+W73z6B2icqQaCCohiKj1JCTnGH VOEMCibkpYoCSk/BhM4QK4q+ggnqJOSkacJ75OXqJq6HQOvDVvGzxVPq2WEr5hKW3/Ro oo8AtzqGTwhcR37hTJErgtIRWzNGrsd7mtY4T6/as4pTNWRpDHh9c3/3ERhcV2YDuF/p J5yLLFjPNrdKOBgDhles+uAxgL+6pQzsraOOVGIHKtZWCdMSQxxHizWqpgt6EPs96/5s 9NY95oIg1thnE8imtGGqASWO/FdTupp9EVRUSIdJibD8AbJldUFdMgsLWMwSTE4K2Hak GbwE2zrQ+IxlbdlFbNJvBcyl7ASKMh0wV+YLoqkWA0pIE7+nFRcPKa7K4dMyBTp0TRU4 V0pcGqUNUykl5BSw2uTQu2IwESi0QAhk05jCIusPyc4OQVbmmQVhKxOqSCEbHYUmcE+4 litycle8Fz3vWh+etGAbSw+ydRw5Yr8tVzY2E7F8E2r83MIieR5DNrm3cEy/4O7aFfLl r7de6XPhWSGbllYhm6kJG2fJ1IlCNqk7y1F6JQ0js9ODYTRU0hATM7WRzh3RXCfdJ1fM J6xcIf4u3pJSkl5yWK5CTjFk0/dGKZhIAbg+kSgK7SdBTeymBMjm64aloqhuXH0NYjDV 4u0kRw96SyOnEhIgm1E0WvlcXD0STFH+uZXPw5ZGopusZZPiR2NqdAyfELKN/MLLQTZv dRxjbERQiEwTQTYOQ2LfAY5ykaBMDS2KnULWRFVMxDdzhGfm7LOPmqPPPooY1rOPMNNv idDEMVnxCQL/j5NtsIoTmZ/4p5ybwMkG/jQkPBMsnfMCSEO8Uk4SwHnBnLMg6eXoAB5w /A83wywIMQCdEwjMuQ6L6EAEVKoG5JbYZ+FOtJ85+0x8n9h0qMfj0gA55qR+eXoHwXCA yi84CgH+MFfzUXvNcRo9yi9sETkEwvO9+nRhT5+A8rmUyxeSUxKoFCGNKUBjFsm7ItMC uH5rCjCmQT637NpjJOzRF9QsHPxO2JIjsqR3+JMyqGOe0QL8teloRJ7+3GZA5dNA9prH UQl2x7L1TUAoUoLaxkdQEaKl3wTDQyl+8gcYhE85lIKf/8YPlSoHLXFHbQpD8MUNHNlW kieUlTMpfmJpLrXQSM0ZJ/5Vd/SH+NDII/dr36IayM++JJUVfd4msJ+lzkimR4HYO3cu yJf+YBBSSJtbzqTabQ42tf0QlKhCIyneJdPs58KNvItEYngaVO/MDERaD/mgFYWbcBQV Fbn1wCc5woeTPKIjfCgMRZe3L039j+RcPE5xPqrAywnnW8Iae50i9aRB384zFhsRy8VM HyaIxHo8aoLICacmv4q1BVyf5WYwN9x9toccg43lisNU2CzHKY/4SQpzA9JNRows8Dze u9hY6pr1bEhM2tacoqEvAq62vDh7RaNi37CUyWxEZHoR32LABThEJa5Ym/GJeRolhq2d Sxi4sHPOXRJzrVZaDFcdLZr9svWRyWkUx7jmYAuOg0znw0oLcNVR4py2vEfI0Iodn1Sy fxOYIfHuQxzjrGLhml2h6+DxrRRgu58ke9oIClDbTwH8ewKZ3azY0zyI9lx5CpvVDO8m L+fyrbQIfGsJB++ZKYe+p7UVw3atec+VbzHPu6dE5VFaNMnRlt723jFu310XYq7JdbyE Ifdm1lvmuAd5zxvRC2buCtCQa7uEYagudfycwCpuCaNk0pHOh8vC7GNk9cBcuSWMHtXM h+1zO/s019F82NybWa//gtwtiARovWRw5TbXLg3UcOXmw4Z7Nx/2pdX5MDN0asLNxbnS +XBKjZ/vnA/viLlW49ZZcDJpMh/WDrlPoBYqKqEzeMoWgdqSSgUq5BR1SJ/XFgUTujua JFUw5LVNUbgyxuXRcg/mtVUnJ0Ji/vPzWuYva9w9jjwyo5aIymb19jb75euPYM+hMnzC ea2rkkNfOM95rQgKUTHF1er5PL85F1oA3TmFFu6xtAVaarDfhRwarNByj5u78WgjjFgv Z5mBbQlabKeQ+g0cxjY/EE7j6v7u8enh/dXThtNA9JtnCmdxFwF3nQDOMqDMhLMAQZYS PCoVONsnAVQl4FRlQG/As+x26Fi5dzhY4OzwxflwVoJoRnA2vmUw54DYGM7i9+4Ty9Pw 7h44WxGmrlgx/EfLO54WjTZKCyC0Mqey0+EjuInDPejeQEm3p7HiKA1DG6SKc9ryHlFA yxVLRTGcpQWY+8hqjtvASDCTJQCzjeCsoxgeQJUFJhlNFQFcTRUAruYUjdb+vRjO6pse hFbKVUSxvMdwllgLtjyDVAHg+jTCg4OzWn80YUQDBYrzv4ez2jpQnDXeU+LyuLYOcNan 2vbeEXAWKOiXd8x1BGfNvQWo9LkIzqIXPJzl2sFZobrU8XOcbxXOlhL9Jo7hxuzMxXAz VwpnU6qFs0JzMNKkjeGsPLMAVb9g4SznQpp3BM7KtU2TXimcFe4VzmppPZw1NWHgqrlS PqTuAjVc7Vne2QFnKxxbiTmTwFkVKNjaLVCLvYIxFJbdlJBTBGd97lsUTKxOnJir6iCv LYpCaZqKcXSXyjFKwSqmha+buB60voYwmG4vm2ZiFExsefwRj/Ijr4ilXElP/lhWd5Th Qxi1Wsoi1+u32cXfBTwyyrV+7BdeDgV7B/URqzuVxJPMzTLgM6JgMEXRsjxipUQWdz50 4I0qZWkvCsaEPgWR6jLYy50bV6JjT4JIOXV8JiItOHitwClcgSXwbEASV2zmAZzfEltY iZvM4XqE2AiQdMubsyFpa06E8xbW5PYGT3ULOp1NWU4EjiBpnHgfJAXI4rKUIFJHiscL R1K1v6gwN5tjUpUC7mODCf9Faj/QhqmUQk5b3sMTJRfn1hiPSmRniUcf8CgWZmKjhJDC C7E5G0o8/CktoM/dlIDfQl4xHtU3w2CuXEUUx3vAleTlaMNUQ0p4L9RfGDZDzQc86hon 4AJHCKUhJ9vM/TQROvUvTYei3tOI9hdRcnCP6xiKyjMLLktW4YNlFYWA0LgnXMvVQtRE RNPnVSEQz6at6JApFK1wPrPflivnaUTQ8JgaP7dwT57HUFTuLczUL7i7ImeS4a+3Xulz 4V6hqJZWoagc9FhZTyNTXwpFpX4sR+nVHijKsqI7zUJ29wdZYt8CwWdoiUDSbhZECaFw nbgvStukoi850exnh2wZTWBnhUitlb89OiWwo7ohyL/0ZzJgH3rQF0oJqYaU8B4rTrZO QvkXgdRzCRc90oovZz/2sA6XeoaS4C5xL1qMQ1sSTTm4LSQe4f7kYlaTQXKs7M7dyYhM sPbLTsb+6W+cg5WuSB/0h6ocwycEoCO/cKYAFO1fV8Ze/4wAlMW8Qs7NPiMAmrL0kQNQ GY1PYRLtONRmnkm0YDsbukZgpDN2gkAHNCAoB+PmMjioJ4CQiHTLKoB/Fay37dXZGLSD D1+u2yy5JdCG7Pk2bu/WDQCK2GRDPcTp98FQzpAjfp3Ey4twmqPFg4ZLF9kzOcPBnN4Z tD/h7jhnIwGijjRIo4RFteUltgZIGJMYhOIMQmnFq0CNoqBvgrrJCYU61CklBqFK01RZ tZsSYNvCp4pBqL4ZxnblKqJY1gMmICtLGqQZEMJLmdZKGDTx67D1DUZQpwNtuwARlBKK Yk4JNC08SBWhjfDeLBCKFVOW1SmqB6FyHYNQuXfwUUISakhh1r2sa7os73Pt7KFCdamj 5wS8MXlKWnzgeiBUdrFaPuRK7aEpNXruIJ88j0Go3FuoqV+QOzlT2Ed1M9cujYGOYiON nwv3CkI5f96UVkHowtSSAmCJaBeut13tAaG77KH4ZK86WIhRqOtlW+QJPOl2Uch5ktsl BS4H0rOHwrzL5RR3RaVt0SoeZXop95StCuKQVvH9J8ahrlqSNQatqqEplM6+LnA1jqGo 2kKzP2Z35jjP6Z7uIg5swVD3zQSKnmVQDWX4hFDUVcmhL5wcitY4YxoMv9aL3bZQ/EXW bL4xP/xyuvByXQpBXAXlYujmjkv16AmLRMdutkuJnbDwYT9h+ScXY+Te/T4o+7d6gX+p LdnT00YvWUI3hcWp99vF63/Jfv3aRdzdOTthYa0qYaraw11PhvvOAbvzlhkaxt8ob/GY T/qHn6pZoztTtf/QwviTtimVLakv58ONTsiu9ZlPTaIwM9tiiqWGiGiG9auOJvx+6p+9 +moQ2I+Pqw+9ighIDaDI6IEzAEMJIA2TpwRSu2UsME6vgFcxzU7dDGlyJAcH+hZgV3gN EPDgLinZnyMh73HpFxyrTq5K4pRYS2Icxyux5nwzj3ZlfMNthci+wZ9AkvUyEw9TJtXf LvLszcS6wuIrPrveCJvcC9jmdF3zHE0tdce9VKpLL/fx+ztdXcFnGKEbDqiIEbDS4rFK aQpdkVUqxRimvY0E5/xS3IPicUdp4b3dlPAeQKjleA2DJMKbxEjpKoJRBxiM75ssygZ8 6whh5CWnHWm2vBSGefdSDIAtCdioy/bKTkRxTMdYVgsySBXntOU9raYYtGiVK2ihEWzz RWBWGyoGLUoL5dtJwdY4CwQr+GxyD4LrJkdSfWjjknsHaw0fHgSjDxAZC3jletuVAFoB vo0D1uZanLsTp4AGgbEgV66sJZZ3Eqo8Xxiagk95HoNgubcAl+OzzRfcHd9WS6vwIVRy cleWN30u5VAQrKVVEMyL1ISFu3Jl+QBkJ9T4+U4f16CYRZupiC0qVnDQukmYDgYv2ztH CZTHt0FDzBQoiqc9LeQ1TbNknvdYQ2h5gn7YTQnvkZerm1APob6GSJhezw7caM+n+sb2 MY4xymq0250jvW5kQo2J49LWMB1+pPcY5xyMso7hQzj1CK+AkV84ORL2Wz0neQUwGlQ5 W4Ej39jjw3QgInL6lYrJyd0Cvvz95uFq8/3T+8ubxcM1mIW9PCuCLcjuMQ4tzQFYhHLH 8gVkinn78je3RfarezC0OKTK2fYrWSIllO+yXXU14ExoTcPqhtJQj6IXis5EBLXpoIBi iNNHKrxmGswqEYWTccqyZYAa0EZReu+ht9cMT1FeINWcs94jrsBWOJxGrFsCOYXSpGkY plICJfEvgXttyChL4eMsj2F/1SQNh5+vZAWNOMaGF0609BRW3eFYtOmANoIitRa/JzUp LRBoWt/KkraIZ9oRrgDGWo5daQYpBFSI2UBnBTJ/FDzdnzgudOIY5DAzchgmFiKK++cZ X756x+rYu4UVxkOfTPT4V6+ee9JDU5pJD0fYgc9vkQ8m/EyC7L3AI/CkmAcdBbjEfg7u ShYDjSi4ewP0BdJE9+QW3aXPkJTw1E6w/D2GH6aa8bc55VE2Fzne5M68H9+nT9M7vpUL LoZvk5NMhnhXCmAp3BNeUJ7rt/XeTP7kfffc3Cd3i+RO+PJp6UhIsb/XOgvfNrXueZM7 ekJyv/dO7Y+68mp20QrU2u3rzwYJNuThR0gN0ZvL0o2Y4uufm73KKDzJx/28vmX7OwZD 50u3XC6zr4tvI3+q/w/ZFkwiCmVuZHN0cmVhbQplbmRvYmoKNTQgMCBvYmoKMTQzMzkK ZW5kb2JqCjUyIDAgb2JqCjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgNDggMCBSIC9SZXNv dXJjZXMgNTUgMCBSIC9Db250ZW50cyA1MyAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5 Ml0gPj4KZW5kb2JqCjU1IDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCAvSW1h Z2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIKPj4g L0ZvbnQgPDwgL0Y3LjAgNTYgMCBSIC9GMi4wIDE5IDAgUiAvRjMuMCAyMCAwIFIgL0Yz LjEgMjEgMCBSIC9GMS4wIDggMCBSCi9GNC4wIDIyIDAgUiAvRjUuMSAyNCAwIFIgPj4g L1hPYmplY3QgPDwgL0ltMSA1NyAwIFIgPj4gL1NoYWRpbmcgPDwgL1NoMSA1OSAwIFIK Pj4gPj4KZW5kb2JqCjU5IDAgb2JqCjw8IC9Db2xvclNwYWNlIDcgMCBSIC9TaGFkaW5n VHlwZSAyIC9Db29yZHMgWyAzMDM5IDI1MTcgMzAzOSAyNTUxIF0gL0RvbWFpbgpbIDAg MSBdIC9FeHRlbmQgWyBmYWxzZSBmYWxzZSBdIC9GdW5jdGlvbiA2MCAwIFIgPj4KZW5k b2JqCjU3IDAgb2JqCjw8IC9MZW5ndGggNTggMCBSIC9UeXBlIC9YT2JqZWN0IC9TdWJ0 eXBlIC9JbWFnZSAvV2lkdGggOCAvSGVpZ2h0IDYgL0ludGVycG9sYXRlCnRydWUgL0Nv bG9yU3BhY2UgNjEgMCBSIC9JbnRlbnQgL1BlcmNlcHR1YWwgL1NNYXNrIDYyIDAgUiAv Qml0c1BlckNvbXBvbmVudAo4IC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4 Afv/HydQKHmpWvVKoxaBIEqBgiY9r62nvIFwgWwIA6gSKOi64C2Eq98GFYdw7aZD1QOV QUSwkgB/Y3mJCmVuZHN0cmVhbQplbmRvYmoKNTggMCBvYmoKNjEKZW5kb2JqCjYyIDAg b2JqCjw8IC9MZW5ndGggNjMgMCBSIC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFn ZSAvV2lkdGggOCAvSGVpZ2h0IDYgL0NvbG9yU3BhY2UKL0RldmljZUdyYXkgL0ludGVy cG9sYXRlIHRydWUgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIC9GbGF0ZURlY29k ZSA+PgpzdHJlYW0KeAGb9h8MpkEoTBImwcAw7f80IAIAVBQq9AplbmRzdHJlYW0KZW5k b2JqCjYzIDAgb2JqCjI1CmVuZG9iago2NCAwIG9iago8PCAvTGVuZ3RoIDY1IDAgUiAv TiAzIC9BbHRlcm5hdGUgL0RldmljZVJHQiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+Pgpz dHJlYW0KeAGdlndUU9kWh8+9N73QEiIgJfQaegkg0jtIFQRRiUmAUAKGhCZ2RAVGFBEp VmRUwAFHhyJjRRQLg4Ji1wnyEFDGwVFEReXdjGsJ7601896a/cdZ39nnt9fZZ+9917oA UPyCBMJ0WAGANKFYFO7rwVwSE8vE9wIYEAEOWAHA4WZmBEf4RALU/L09mZmoSMaz9u4u gGS72yy/UCZz1v9/kSI3QyQGAApF1TY8fiYX5QKUU7PFGTL/BMr0lSkyhjEyFqEJoqwi 48SvbPan5iu7yZiXJuShGlnOGbw0noy7UN6aJeGjjAShXJgl4GejfAdlvVRJmgDl9yjT 0/icTAAwFJlfzOcmoWyJMkUUGe6J8gIACJTEObxyDov5OWieAHimZ+SKBIlJYqYR15hp 5ejIZvrxs1P5YjErlMNN4Yh4TM/0tAyOMBeAr2+WRQElWW2ZaJHtrRzt7VnW5mj5v9nf Hn5T/T3IevtV8Sbsz55BjJ5Z32zsrC+9FgD2JFqbHbO+lVUAtG0GQOXhrE/vIADyBQC0 3pzzHoZsXpLE4gwnC4vs7GxzAZ9rLivoN/ufgm/Kv4Y595nL7vtWO6YXP4EjSRUzZUXl pqemS0TMzAwOl89k/fcQ/+PAOWnNycMsnJ/AF/GF6FVR6JQJhIlou4U8gViQLmQKhH/V 4X8YNicHGX6daxRodV8AfYU5ULhJB8hvPQBDIwMkbj96An3rWxAxCsi+vGitka9zjzJ6 /uf6Hwtcim7hTEEiU+b2DI9kciWiLBmj34RswQISkAd0oAo0gS4wAixgDRyAM3AD3iAA hIBIEAOWAy5IAmlABLJBPtgACkEx2AF2g2pwANSBetAEToI2cAZcBFfADXALDIBHQAqG wUswAd6BaQiC8BAVokGqkBakD5lC1hAbWgh5Q0FQOBQDxUOJkBCSQPnQJqgYKoOqoUNQ PfQjdBq6CF2D+qAH0CA0Bv0BfYQRmALTYQ3YALaA2bA7HAhHwsvgRHgVnAcXwNvhSrgW Pg63whfhG/AALIVfwpMIQMgIA9FGWAgb8URCkFgkAREha5EipAKpRZqQDqQbuY1IkXHk AwaHoWGYGBbGGeOHWYzhYlZh1mJKMNWYY5hWTBfmNmYQM4H5gqVi1bGmWCesP3YJNhGb jS3EVmCPYFuwl7ED2GHsOxwOx8AZ4hxwfrgYXDJuNa4Etw/XjLuA68MN4SbxeLwq3hTv gg/Bc/BifCG+Cn8cfx7fjx/GvyeQCVoEa4IPIZYgJGwkVBAaCOcI/YQRwjRRgahPdCKG EHnEXGIpsY7YQbxJHCZOkxRJhiQXUiQpmbSBVElqIl0mPSa9IZPJOmRHchhZQF5PriSf IF8lD5I/UJQoJhRPShxFQtlOOUq5QHlAeUOlUg2obtRYqpi6nVpPvUR9Sn0vR5Mzl/OX 48mtk6uRa5Xrl3slT5TXl3eXXy6fJ18hf0r+pvy4AlHBQMFTgaOwVqFG4bTCPYVJRZqi lWKIYppiiWKD4jXFUSW8koGStxJPqUDpsNIlpSEaQtOledK4tE20Otpl2jAdRzek+9OT 6cX0H+i99AllJWVb5SjlHOUa5bPKUgbCMGD4M1IZpYyTjLuMj/M05rnP48/bNq9pXv+8 KZX5Km4qfJUilWaVAZWPqkxVb9UU1Z2qbapP1DBqJmphatlq+9Uuq43Pp893ns+dXzT/ 5PyH6rC6iXq4+mr1w+o96pMamhq+GhkaVRqXNMY1GZpumsma5ZrnNMe0aFoLtQRa5Vrn tV4wlZnuzFRmJbOLOaGtru2nLdE+pN2rPa1jqLNYZ6NOs84TXZIuWzdBt1y3U3dCT0sv WC9fr1HvoT5Rn62fpL9Hv1t/ysDQINpgi0GbwaihiqG/YZ5ho+FjI6qRq9Eqo1qjO8Y4 Y7ZxivE+41smsImdSZJJjclNU9jU3lRgus+0zwxr5mgmNKs1u8eisNxZWaxG1qA5wzzI fKN5m/krCz2LWIudFt0WXyztLFMt6ywfWSlZBVhttOqw+sPaxJprXWN9x4Zq42Ozzqbd 5rWtqS3fdr/tfTuaXbDdFrtOu8/2DvYi+yb7MQc9h3iHvQ732HR2KLuEfdUR6+jhuM7x jOMHJ3snsdNJp9+dWc4pzg3OowsMF/AX1C0YctFx4bgccpEuZC6MX3hwodRV25XjWuv6 zE3Xjed2xG3E3dg92f24+ysPSw+RR4vHlKeT5xrPC16Il69XkVevt5L3Yu9q76c+Oj6J Po0+E752vqt9L/hh/QL9dvrd89fw5/rX+08EOASsCegKpARGBFYHPgsyCRIFdQTDwQHB u4IfL9JfJFzUFgJC/EN2hTwJNQxdFfpzGC4sNKwm7Hm4VXh+eHcELWJFREPEu0iPyNLI R4uNFksWd0bJR8VF1UdNRXtFl0VLl1gsWbPkRoxajCCmPRYfGxV7JHZyqffS3UuH4+zi CuPuLjNclrPs2nK15anLz66QX8FZcSoeGx8d3xD/iRPCqeVMrvRfuXflBNeTu4f7kufG K+eN8V34ZfyRBJeEsoTRRJfEXYljSa5JFUnjAk9BteB1sl/ygeSplJCUoykzqdGpzWmE tPi000IlYYqwK10zPSe9L8M0ozBDuspp1e5VE6JA0ZFMKHNZZruYjv5M9UiMJJslg1kL s2qy3mdHZZ/KUcwR5vTkmuRuyx3J88n7fjVmNXd1Z752/ob8wTXuaw6thdauXNu5Tndd wbrh9b7rj20gbUjZ8MtGy41lG99uit7UUaBRsL5gaLPv5sZCuUJR4b0tzlsObMVsFWzt 3WazrWrblyJe0fViy+KK4k8l3JLr31l9V/ndzPaE7b2l9qX7d+B2CHfc3em681iZYlle 2dCu4F2t5czyovK3u1fsvlZhW3FgD2mPZI+0MqiyvUqvakfVp+qk6oEaj5rmvep7t+2d 2sfb17/fbX/TAY0DxQc+HhQcvH/I91BrrUFtxWHc4azDz+ui6rq/Z39ff0TtSPGRz0eF R6XHwo911TvU1zeoN5Q2wo2SxrHjccdv/eD1Q3sTq+lQM6O5+AQ4ITnx4sf4H++eDDzZ eYp9qukn/Z/2ttBailqh1tzWibakNml7THvf6YDTnR3OHS0/m/989Iz2mZqzymdLz5HO FZybOZ93fvJCxoXxi4kXhzpXdD66tOTSna6wrt7LgZevXvG5cqnbvfv8VZerZ645XTt9 nX297Yb9jdYeu56WX+x+aem172296XCz/ZbjrY6+BX3n+l37L972un3ljv+dGwOLBvru Lr57/17cPel93v3RB6kPXj/Mejj9aP1j7OOiJwpPKp6qP6391fjXZqm99Oyg12DPs4hn j4a4Qy//lfmvT8MFz6nPK0a0RupHrUfPjPmM3Xqx9MXwy4yX0+OFvyn+tveV0auffnf7 vWdiycTwa9HrmT9K3qi+OfrW9m3nZOjk03dp76anit6rvj/2gf2h+2P0x5Hp7E/4T5Wf jT93fAn88ngmbWbm3/eE8/sKZW5kc3RyZWFtCmVuZG9iago2NSAwIG9iagoyNjEyCmVu ZG9iago2MSAwIG9iagpbIC9JQ0NCYXNlZCA2NCAwIFIgXQplbmRvYmoKNjAgMCBvYmoK PDwgL0xlbmd0aCA2NiAwIFIgL0Z1bmN0aW9uVHlwZSAwIC9CaXRzUGVyU2FtcGxlIDgg L1NpemUgWyAxMzY1IF0gL0RvbWFpbgpbIDAgMSBdIC9SYW5nZSBbIDAuOTUyOTQxMiAw Ljk5MjE1NjkgMC42MTk2MDc5IDAuNzU2ODYyOCAwLjYxOTYwNzkgMC43NTY4NjI4Cl0g L0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBZcFT2BAGAEDRbNu1tGwbW8aW bduuP3vZ1rJt27Zt2y/1cL97TqBAvwSWIBSUgklwCkEhJRSFpjASlsJReIlAESmSRKYo FFWiUXSJQTEplsSmOBRX4lF8SiAJKRH9IYkpCSWVZJSc/pQUlJJSSWpKI2kpHaWXDJSR MklmykJZJRtlpxySk3JRbslDeSmf5KcCUpAKUWH5i/6mIlKUilFxKUElqZSUpjJUVv6h f6mclKcKVFEqUWWpQlWpmlSnGlRTalFtqiN1qR7VlwbUkBpJY2pCTaUZNZcW1JJaSWtq Q22lHbWnDtKROlFn6UJdqZt0px7UU3pRAPUOCOhNfaiv9KP+NEAG0iAaLENoKA2T4fQf jZCRNIpGyxgaS+NkPE2QiTSJJssUmkrTZDrNoJkyi2bTHJlL8+h/mU8LaKEsosWyhJbS MllOK2ilrKLVtEbW0jpaLxtoI22SzbSFtso22k47ZCftkt20h/bKPtpPB+QgHaLDcoSO 0jE5TifopJyi03RGztI5OU8X6KJcost0Ra7SNbouN+gm3ZLbdIfuyj26Tw/kIT2ix/KE nsozek4v5CW9otfyht7SO3lPH+ijfKLP9EW+0jf6Lj9++wkL8vfqCmVuZHN0cmVhbQpl bmRvYmoKNjYgMCBvYmoKNDY3CmVuZG9iago2OCAwIG9iago8PCAvTGVuZ3RoIDY5IDAg UiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHVnfl33MaRx3+fvwIrx17K sSa4D292sxtZeU4cJ15LOd5KfnkUNbSYjEiZRxL/9/upvhvDGQIYgprY74lAodFT3V2o /tbR3T8k/5v8kDTLtK0b/Ye/Vdcs21wIjbm4XCV/Ss6Tnz29ypKTqyRddmWXZl3trxae dnWSlEW7LNOuS7KmW7ZNmydZ1S3zrqmTOkuXRVcWCXWehr+eNeWyyrqkbLJlXrpyi/5v Jyn/8xs/8ONZW7ZpKgT+d3dlsSzSpiqSpq6WWdE1ycm75JcvYDHN0jp5IfypV8yfF++S n/0qW6ZJlrw4TY5+fX69ujxfXT9OXvw1efYCHoM+uj8u23yZ5TSgz+VO3p7MzVS97Jqi ntp1X1wen14nvf+er05uLs/Ov0++/eb5b3vP9O3Xxz8meZrljxfDe1zkJ5JJNaI75aLo 8mVd1L7HF0oudktDMnOPe2Gt6mVed4UR1p1i8HBMlc0yz0q+evUFHQhTaJcCFTPus9ai NvNoNvmyzNoc1TmJx0+T5PLi5nr1sv5uZkazvFo2bdP1GT2QEc67ZdkU9lsYqLgfeIQn 8cgIX1yefX92Pvf4ZjWTeomui9k8lPFNl3Wadwf9BedTeGR8316sV1ezDy8gqchrhjfi 8kCGN8uWVdmMxF0P/PlO4lF9vt/PPbgp3cfH0UQsxjBl0QOtoxBBDzstNIDeiZ08TEkB UU1jVDOo+1ZMvcGeGtwx/RbyuBCb42585yffSTwytu9W716vLkezuQhMo7vZzJxqjtmM vt1+B44C/mHfYa8NGd8MPdIVdZ40MVMDx/fidHSnGXty4NhmBXpOTLkefzs77cE+CmD7 sk1rM5+N+Shm7rY6XzZZCWNTOZyZP/fJTuOPT/bq7Pvz4+uby9VIThcjjUcngD1OD0QA 23LZVJmZceOpInnxbhH6N/b5KpJUKZNhU0XdVMu2zcZPFSOH0vkBBuqSCq9Wzfw6jb9f XVwmq+OTt17yPkuu366Sb3/1tGgwqFb/vF6dX51dnCfH79+vjpXn4+xciszt3ihwsdW4 7Wy7prs3lEPwNk/ghjdu2bUpfpUcnddWOAWDC4SEnu5S4ahGPDvsuarAL9jg5euWaYW8 1lLhaZLj+0B8K18QqyXrWj4uW1DmtLn9hXSewJnxZskYgd3owrsRgxPYiD8zzSzu8mee rC6vz07PTo6vR+nICXxmAFZllfQ6MtKRqKPI3TpKHU1iyljCPaa2IJs+ezdXqzfJ9UXy 99Xl2emP6kt3U45lfTHERdwDZUMArfosWryxlnXzRQ9k/fmXv//Db7+YWTbzFiUPLrMs apM+noH6YNb22yDXeq/fhoDZvEuXTdm2faa29FufvbPzk/XNm1VyzE9fXdxcnsz93RRN i7Mm67MbfTZ9Jm/vw62KO+zFxdPn6I4urdqWQAvhmLwrs6wNrp4/3QivPPHxFRsuAnN0 WVGIUOZNvUR7l7jtuq5NNgjr5LmKovhKxJ67q85K1dkuO1unIqSFELpkjzqpAj47xaeu E7+t/MiUOqu6iNveI0yrk2AY/enaXjGDQtin7b4K03ZL2KPtWVHlceP7lCmtpw48IGHz LWWf9gd1mA5wlH16oErbXg/0KJN6oEq7Xg8Yyl494OuwPWApUQ8Ecd5t6G4BukNvLKua YEddVUswIOFevn/goIF3edGI2pkdtQnKrKrx3saZZ0aH2iL+hqK21fn1pcCN4+vk7CpZ /XBz9vfjNUSwyGeEEJKTCxDJVfLq6BHe5qvk6v3qREDeo2RuK0MNesFkZZo1DpPQoLlD H4VoTdxEjsNxUYZXj5WtNm/wv2iKJR/MBo/RlN+HoiOn/Agr3/+UTyaEmvM7Uj06AOA7 kj1iyiTF15RqQlYgggrVDXOMggD7VEgdsCnQxNUqc8ykKltwDtNT0PIeZVqtVaprFR5b fbNXy30dtuWW4ls+S2qLCxYIIExbMnFGJeAQK3go1RzxN1Q1n16s1xf/kIwWax9cETk4 v8bng62ofT3Jxeu/rk7Q1niG9tLImzidPCaL2Hf64bwVdFsrN9Kg+gaGs3LHjIUyM8aF Q4qiJGeixB0Xsxmpwj5zowQktH0GhkMK50uLmRpqQY6K/4b8DXRh+jku5m9Cpw0zGXXW 3w6TEVFUAkfcl5Gk0oroNIqgznKcotruy8qKti5Ove+jIOeprQAT9g1UYFUS56mTlsTB tKgz6Z3ZIWSZkuZUGd+FHuQ7/WoPqaYmsHd8fY2XWjmvPh/zCUewYVjg1UU066gfJwgj c/NtSaDhFzLwC/ZzUJGRLYbk3Z7s94FCI3mO4HdlJHF3quSREhf22kC94myWSfxdJIlE R2TOOx6rAUfH42zAuo5Z3Sl080fRTVZdj6mB08br9cXJ3xxy+PH96nPVlxZlWGjxaFzn TvigtWUvRl7UuYuoc/vmyajOncKUAwoxU1s6t8+e6txHM2tCUqdJ3alIc4953Nlxo8DM hI7zqjDD75m14+NbIxXPBB59IsAkHpnsLs9ekzm7nHmAXZ5MHfN5IAOcMn2WrZnrdn+u DyZ1VVdhek9I5p15KO1cF/M31AgM57qbudeKuGztmNfdAzy3PnYZMT2mBurj85t3Q6Y6 +nbmVSHWoWmbMSRtYu6+dUaxZWqcB4W+nX2mI5WjJe8jZvDDxn3dRFe19ZIZeEI+3jjX 0wSE7Sa6aTxOm+gUn+PcMm6i6/EZTXQP7ZbxA8zKxEY8DIdk1FV1u6xZPneoRt00/oKJ 7oxVkSxNGqa5feFHc2twllJ2Rd4mtoFDNPjDwR9WvsqKMC2pw31LD4i5qyksTtNEE0wD r4kiNg9EERGn6ar6sLxLVZnLim6zatMg2gPyLk3jL1BEdpHkAABpiz4iaD63HjJpXLZ5 h6WGimKZFhNyWx9SD03i8ZFeUPmIXAicj68vrt8Swnfa6Up5BBYD1/GHgE7tdHB3cm6e kX4iKc2V4f6whj0vl1mdHphHIKvYDIIMDR0WjjR53233cPN0SiyqsIp84DxdLZPkq9WP V8nx+ZvkqU+0vkpU3vApAvlcFqjMrHnItFoWTZcllW6EEcGBlrisnlEN+KPkOEuiOJFs 43yZK7XZBVhjjg9DFEo2QGGfCGNd7PayPJh8ks+MG81txTBwbOfX3taNFvM31I32glhR sECBeIdOeLtcna4uL3XqvcmocAkJKHpDenQyu22BTceynjKxzTso7V6yvQ7R8tG2xQN5 Viexd3q2Wr959XjumHWXYZWB1NhvKOzDSAF9MPdG2ZAHUVs//uEB+Gn8AeC//sPzF8lr mW2S1fmbmcUwIxuBfWIKhjjszt36fG7PLjkwrGwj5aXH1EB9Lmlm1z+KBtyr8zazyhCy QVllGdMQpqV8N7pThyjE2aNyrL9uWGhqeRqnEFfL5NwBnkFrkiZ4MXICwq1kxMc8flhh zPOGzRyqqs/UQGF8+j9YWsHsvZdI3m1pFWm6LKu8P8y7u/B2fLY16W1jZO/6UuR76HKW PJQghaqo2qRkKwAmFVlZxfZuTVt0UuktSW/ujX7SG3nhD5D0VtYZ7mr25tNW2MAxf0BA GfE3FFDaSebk4hzr650s3ZR8pD8vWemSfPPVr/+cfGsW9YX2WvL+8uL0bD37Eu2KCAFb gyEsuu+HKM/bJXhLptyG/N79WbmgCt+WeKoPel+1aTy+ZHE+i+ma2XdVs1u79NiMUOUw D8cYDbVtkZZsk1lkrNKs8WuUZbZsZAcVvbQeq0Etrc9Tswb/7pUAE5xjXra4apq8HueZ eEBlY/gbhxyssnl7/HeFaUXOZBOI74JdIJRFiza6Pj47v5KVWzP7ggqca2nK5lvlpC7X 68rmnslLvJKy96nl0cxBE76T+9ODLqe+x9TAiRG/xXp1fDV3KlDREvluSWfucTmh64ap mBlWjsleAZWscZI/LHaK7ietnaprWYsmNer69B1Wyl61yf5rUX0AtWk1gvwNf7rG6H4S jyzdNzWq5WLmbmqLbW22xe7et3joomA33xSgiRoYjBrSi0DsfPMg4JZkYSIM48Ht/FOO ywAqJ/HIIrPEblGdkIrBhnV0qN6nggxxtXWFWoV2rHYowoX6YBOOac+4Od5F6uaecxz2 jrt9p+Kc23Hh8sV7srCTqdsNgg+tzdlPROs2o831/STdZrQ5NYTat06n6V43N8iiXTXb mLlC9m2YxB+KRXSva3F0P7FGNT+YFnds8iCz2dQW2/fJl1Etdve+xXej/b0syZw9lwq2 lDlU10LE3wjXgt5SKfnd75UXu7c31LsLvDaywUEiOlrCVShfsw5YHLb75DFvuqGGLgPG JWV8DnGjIxXTj3SM0ns9u3DIDk1e78VMbcHaffbGLfMI+Ru4Ds7tz1DG/O3stJF6eYOt zTGOnfIykk2dEToATcr2RdrTaJfXiqeROm9bXisvtLKNv/c0PigYwy3Ckl4bT98yyBt+ EaDYuHTsCSrLg7FJPF69vbhZv1ERreTRFVsC4EKcd+eQjI2g2DodJ3jMcCSZ/a6cPahV E0OtgPoRT0P1Kmr0UfLsmYskzNyDuaw1l4zcmNuhx8OwjeJnLG9N3qxOSXFWSNu5F189 Vopzxmwzd4aJZf6wPMjshcURO9bq2imTt2vL+3PnYHbqU4DYj0oSu+z+UIfClESHOI1o FEKqSTfTx+kQA356wTazb1aXKl3LLreeK19LxqVg+4ekYG9FYfyg5K5oWeOfHVhCYSFz S8GWQ6OGeP4pzyZsxfwNVdbqECcNatl17BrI67a8+fW33yZvjq+PXx9frciIBAy/v3m9 PjtBXZIdicq8ujl5uxcKvjuYVdh8Ldu6w5JTWR4uPrFDFYmIv6EiQXyVsWaXuvOL5HyF PEjaq8Rf0U6kqxyvyVhBcT2zm2ZTIpCi5IQd4fYxjQYIhUnMV1YH3X9YMlHJlickoh2q TET8DZUJFRE7u77CI3m9+v5ScpaUErhBWJCJEyGoLZXPkIYbQc5YznOLgY2MFaZJRg4G 2iOY9Dfv369heGaA6oxjy6cRjQNBLiSw1VNOX5u519y0FvE3VF7fcCbX9fHab+qvxFUy R1Qm8ur8BDkNUp2WM8tqzqYJdQo+LExzDktnsW8XZwDZeexABJNktobD9w5WkUb8DRXM 54R0xKvIARNyfKZPgud0icsLmVLXKxTp8fdALp3k5A6guFIHU8wsqM5TVpjmHZagZmSr koN3sDIR8TdUJq7UiarMoICswASU/aF8Bgrysf4xUdAM6P2P1Xo9t85yu0bh+Ve9flii wI7anazk0DjrQHQWKa3snG111mEwxb7EbN/oojcHwlRb4HfI7PANxGxfnV1dr9arv50l nyRfHhMqf0d0hv+e/fP9GUHz5Hfsoq0i6Fn2mTqCWB7q/+bWm3bbmdw0bBwYFR5nBlQu H8pyOE6JvvyGOSnJsrlzLp1HtMfmgYit+M0I2Sil82F3x8mwerK2qTisYytPBA4GbIi5 NdXAhrRecpR6lnxHJPCNPjT+/pPI8hK8wSbcONkkxp1L2iO36uCIKSF4qYDXWWGgDwaR PR3cra5wYAZUhYeUyjjCXoVqWMX1jl2S+rQ1NPyDVatPx6rZJhsKI9ThPq85t69tskVA 4ESbXE5UDQsZ2mapDcoifI9csSLPM3IffDlWp2QNJ+Z4pthfk5RhjuxyrBuKqss2Z2up zffgvSQjgXNhZV9JXftiDY3FtgU58ZYGhaEkZ1ltoqi4CiiGd6nLldK0xQZls4ziwb5X m/4THhxNd7xnyo6hZ91SwuZY2kYpmLJNtmVOkresBsmTfyQvv8N39WbkUTuIFttLyrYj WlDj+zUJ35JdidvZlSkyBKemtSUecn3TZOp1hjK633lnyrZ4WNVPy09RcdsSVO6aduF+ uG1BWsKcYs3dyfuw7u533MFXXpatL7vmHptTGuDeFw3gfp3ncmd5k/eD+0V0Fz9DJNTT 2vQJn4W+Nx3mftj2J5XBmr1Tr4f38dP4ToZeDkJypy8FSRzR+jsvkEgmPm3RIZ72wQTX 6wIrzPegxmwLw8/Q0/TW3/IVZSlzlyiJriOYl7Gtc9WwTzhxPuJSZdYP/ssMlMkKiB/E rOpywoCIpDpG2N/6etFCTeO2R+GXpKT5o06sAxNT34vT5GVy9Jwsb7bkTo6I9nOIFRfv 7cVbe2EeLY7OLQXApsp+5d5yj6jvu+TFbxK1Tckohg1s9AwTh2cPUFI9dBIAqFmzffRv Hi/e6y+EHWObWNs2/8y0udGExZElZLZEbi/su4UlsARc9VdlCZ290EUXR998Hfab5LSJ 4i5JjUdQkI8KfcEhT4T7mdrIR66I/bcWpLjpXB1quvMoBS8m5A6UMndqPCdWiOyrxLJO ERf9RycrlYG4PL14jL4/egf7hfuDEEBDArLkiOEvkyNaVSdHLx8nVXJEr0CvHy/4FwQN hd5oVJlYUFhF0aapEmt6y95V7E7bduBO2VjfMLz45QtKpPTFBstaVFiY7CT8lx8p9hgL GNPXnyj2PoWyOPqpehrSSTGhbeFbUjI5ShXz/6n+1de65E9UDZ8+XvTq12U+VrXxi0Ma 60eHUxvKpmq9KcUhowMa+zE/ylh8xvjwBwl9Qq//XO4WR+yjyQ3cCq1ArmklfFHuj9AY L/Po91JcdYAU1CV0tfSDoix4/ERXRzdJKVurLi1izjjTtUFFhSmqi/w7z/jJnz9eSBFd l65e/xQy4h/4N0d2ot4vf2Inmt4zfalauDjSPKoepRMNYx/rNtlO8OzSNPO6oZk/uW62 u1Nt/Q1N9l2pu0T/++pIPzL9Gr+WPV64gTQcmN8UfQQHw8bE9CxZF6JS7denJxl758WT LLycAxO98pAjw29XH+G3+Ep1B42kXTD9C1jjo3FUGqbkS4h8W1xrSvFYJI6u51/Egzf5 CvlXX+uSP9GPwyr0Yz5AV+lP2GSF9/SvvzqS/tQfLSVyvghuYGmIkKGQ0cVYRqYnjIxF 6rOni6TqF3/VE2OQtLzVBLUwwJigaOW5TdCODcDMCVj3boVmVZbubYZyKl9R5LEZamkh frM0bxXSMvb3DcxQjOxSHTMemI6WFrxmSm1QIjOUJHc2YJFzPH25NGNdYFZDMbZxRfJW 0QBnHPS0lNAMtbTNUrdQArvNvheaoZYW4G3LlUfglvfQDDW0wAy1pXa/Z/svxL+m470Z asdGlIm2oC0laE5taRulAjPUlrkPM7TtagwTbchxGRif8kSZh7JIwtmdfCrYS5rOpVws hOYo9qHs6Cpw3diYHY4RsTEpaIzbLE1L7rAn1ZW2LRc9avhcGWLqeWBLqntl7blf0Hfm 95Udih3JLgman+ipthPdM2NHSnuMCWnbbk3IhfSKYkQurI0b0oKHPUuR6cXuz+Ku5BBO L1uZMnNiS3G7bCmkrP0uRiJulZENSeK9vgRuUMJP08nkEE3D12o9YIbzSGPYFkZfimn1 2hwSJcwoS1G+447DpbylqKJSXb2vpZjJSYLoLR1H8oaXzPoHaSkahme0FAf+wsNZisbc VPYSNuRuS5EYHGvWxKVgLEWSmIssZ3dx0tr+lJxrF7Y+CguX9kBLkTViGdt8eLA3q6XY 7G8peoadpbiJTnvoDF/IfwnO1kBTA0EMFDGNQIxff6kg6DOFJb+wptMgoMgZrnlHsJal DrYbhat/baSYsSYuilagotTRnNMDFuEZpHKOnr2fFrHAbbzMa87rDCIWjhYocEdz+hp/ Pd4VvMABBbe8bFQQhB7koaJtltqghJq/Ynl/JvndAVaUU9a7GgPKY0WiJhz6UAaYz1DC CYkTq7eU2nwP3t3kZt+LsKKty83CjquAYngP5mrbHo8VLcXP544Svmf7L5gBXc87sOhG x/NuxzVsj6VtlPJAwNV0H2AxS7FlDFpU1wFcVPcKBXLFR2EDFfLFWMQo1wQZRFEL1V8Z 0Kg2FDGAMWOLPRUE8YAxZzWxBoRydUJNAh5jqqcZcKaeh4BRyisQ6H5B7hbqtw0AVNem DLauv7LPhXuDEF1rHURUPWHAKv1l+ZC+81R/tRFR8DgxiC2EOLEiOpPm6hv3MrpDrhxQ 5NM22mFDYqLvZHsp+56vSXSDCSW62gfpGd7TSFEpnA09Y9sYfiee1ospyJfN4snWI0XZ ISBnT2/rTLCu4nExhYo9RhEOu/Do8JGiZXg+pDj0F+4bKZYAEhVLsDEFvFya0As/7ESK otyJVCMFFinKtiuITrMPUqxYvJTX1PEwMYV2b6QYMOyQ4oYbcxMo/kWAIi7Dn+PRw8/9 GU5HYKP+F9eudjfyQJzcgEdTmggEN7qUfhGXpaN8q2rUFP30p6omXb737hDgKSpKm48N kbMi3LAMzd/31fYaefSpMG29lTs8wjXu3YLk7ir+kaHodlfNHHxV1U2/Zon71OVd/IPm P6JHxZ8ukQT+4PNljIwXX3uGxU2ux4pRoOe5lpAFfz5iBGTgHn9Ex3Ovy9/idMaPz2P9 ri4k/Sa0qHLDg67MljAebvlsKS+REP7oIh8RU9QmCFwETn0KmOIwOE4IGKg0zYogFoI6 v0MK6MXPteQZEV7CCzws6UxCZ79QN1pY8bLTvaaYyL3zq+vniDEvaiHXlZhCn+OSd2V1 LfoN/SmYGs0fXPRDWl2x0gCBBz7HrR4qlYfpnc9yifuCO41vvpGAqHYtSiZG/1NiUrBx GxViaBI2W1t2RG1EBlSSWFOSiNKRYMNeMlVRJ+5+w+bafly6eO5y4EHH0Uvq4PuiVg76 TRpAEYREDrvEctlGoSbiDA0wwz6ihLk5/13exSq57V3JNJqUZUT+mpiqDWeauLbGlLW0 HpAdtj+rJKvVv7Ve9OtZmwwYh6Q8/mNLVAW3Q9vT0jwmXFSWZhFgIsdX0RcSIzDew4os ABI+onQ5R7OlFhsUarrlPT6LlISC0PTkfKW2o3prei6ktzJOHAzgrKWEENfSfKP7FF9T aKrZUgJnTbac+0UP4i1XlkJdmvXQgjQkWyaxZTYI4UumW5TpazLlXKd7juzAWJiPIjFD GrbF0AIj05a67T2bKjfuOzV2HPkP1t7MuQ7tTbnXFmQuqYjO3kRbOHuTa2NvCtWUDp+j A6y9yclKPXuz4EggzYdcWXszpgbPjXUnz8U2NMlu+CE7Y0HaX9D2Zi7rys0TudZWZnzl nsOz1EkgA6+mbq39hUUmPaHtSbmy9mZMDZ9vjUtsszdJySVHUAJFXsbsdxbaZ/YrtgLl v/TbBGOTtp3iawo/Rit2Xrd4gbU6YlO3eK0R+rVse4L3jCbZpPj3qMv0TdQPjta3U1ED DZtlejvVRjQwPxaho9ppV/ls7sx9q8gYI3ne2B+RmapzmUJrbETqm8pu0lYWexDeX+qb 4XdGK1V3yF0/EHaLTV4Da+kWkwejWnwviW9jwhly+lwumYzOSGXXNzYE7oq9jFS1Y290 0swmEN7MfPtipUyCtUod09fkumHk6es3Cv+C8zcy2xAXi8N62TSgITZLxHbqc8SePrdB 82g9g14+ecmBV95OG4JbVddxgO7DZZVwroDsvepwK3vb+t37xs2GCrX63XY59sbuvbuB WHfsJI6jzXjqZCfxogGHBkjN0QJt6mhOB7IdyrJmoahy2qmVDiUnl5Utsum1Ihm9hha8 t40SRglKsiaQjChKUBJHzlNOgrZQjV2fgLQ1yzN8ewwljBJsL7X5Hry7uce+F0YJLM3P f44rNyM63gPYZWk+SmApYU2mzeF7tv+CWcX1vJ1d1X7wahQ973Zcw/ZY2kYpD+DcON9L lKDFIrKoTa5D1Cb3GodJpr9HbXwrDIJ50qYGtQnV0dzzrnVpJTmJszFqy8XPrlCZujKo rUcNnmvkpJ4HqE3dK7zlfkGjNvlti8rkWmOy+Mo+F+4tarOt9ahNekKjMrmyqC2mhs/H orYSqxkXVR6iNvdd3iJXSKQ2TBZOGjYkBjY3adspvqYAtbnaB+kZvlUTJXC8R3rGtDFq j6P10FfJxtbEpoIoAVtDNh1pJvtFCWTn3wq/y79MPoll+C54NH3lwdBfuG8Atj1K4MIF A1YeiKBUDRv6OADGrohl2ahDfUKUroCNeIL607nHPvJ1KHd0KYv26tZIiaD6WdNJur2D BAHDNkhAvPVu12n3RLyW1hes80rwgRp3bqoSSkymtkkgt+ULPKCUd++/eqzrwYmqfMQf /4cuwFhSjJcXQ7yifgQYRc7vMgvQZQRSnH/9BmkIHGZvp+KybbVHHZctnmGb3o+XGm+2 3KUfR1TjsNXbSO4QDpyANWmRaiPLgLXbHbYEWFi8NDad2toMfeC7ePqcLiDBseWoAK42 chOT50835PoO5yoOChBvngJfQuDbcabttI26NfCVLEypj/26S7tp90TgS55bQV5GBHwt LZyQLM1OP4wQOWZZF6zoLdkqU9aqMCn6UpY2gBICX9nrLm3i9JiCLVm7PEyPka3xsjZM j7GUEPhamoe5OyjBhG5LhcDX0jxcdVw54Ot4DwCspXngaylBTbbNwXuuT8MJ3fa8BSiM hRlFDz0sJWjP9lIB8PXvWT/lJGe7BZQumRoAGWVTq3sFZbFlgnxq+VYQIPOkaDTwVVRH c89z9msy7so8xw1MwgVvmnzqPGellOZDrizwjanBcwN85XkIfOVeA1/7Cwr45vLbBtiq a1MGqr+yz6VNBvi61jrgq3pCAVt1ZYBvjxo+Hw18SdpnBULkrtwlVwHwtdIwUa4cOF44 2QuBr619kJ5xOmXheJ+oZwL9RF2mb8Lvy9N6gFm+/kY2ittYqrufu7IUfS4u9XcJGaGH 7640/M4Il3WH3PUDD4eW3dreAWhZZgTCFgFaxvLEfYlVu0f2dUH6H7snWiGZDy7rzANg KRh1n3W6AcMWLg9bp8uiSn5ar8f9QjlbQbmkYOMyJtlAX8uKPVCmAGX+6DdIRsANS14E FF2K1AHwqa4JjCwpOqpuVrZmtqawDJCcdzWFEec3qWcUpJazzJgOwvW6t0DqXpIN6RWp GADw+gk/LtBe8k90NsSTAk4NmO4BbxosZcUaAHh/YpC32BXcxvib1lCS2lVySVi7f9HU Y+C8YST9zzSu19A/oib5UcmLxxT4mj9075f6t5/xRxoztvM4t5zQjt2IW+wRvpm+PbLZ ec4+MlYULNJYZV8tJGWHMTVP4AimrXlliMaaip/pr0DTxNypFu41/Sh66/8owU+y0D34 8+qVvtWVmPJkvjxB9jSLhmb4MGu2e9yJSQjP+gUZONs0TVNiPE5EOeWaJUOh1ad6eXG7 kUVX6h0iXC/3rVAtWorLr+CP3n6NcPDH3P03RFrwF/1MNyfqw49tk+1yalXjE9fDslRX jabtBt0Zug49vhxSIL9oKoh6N8wVWmw3PVUITpxWeJDD/tnWK4u+6fn/klSMOQplbmRz dHJlYW0KZW5kb2JqCjY5IDAgb2JqCjg1MzAKZW5kb2JqCjY3IDAgb2JqCjw8IC9UeXBl IC9QYWdlIC9QYXJlbnQgNDggMCBSIC9SZXNvdXJjZXMgNzAgMCBSIC9Db250ZW50cyA2 OCAwIFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjcwIDAgb2JqCjw8 IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIg Pj4gL0ZvbnQgPDwgL0YyLjAgMTkgMCBSCi9GMy4wIDIwIDAgUiAvRjMuMSAyMSAwIFIg L0YxLjAgOCAwIFIgL0Y0LjAgMjIgMCBSIC9GNS4xIDI0IDAgUiA+PiA+PgplbmRvYmoK NzIgMCBvYmoKPDwgL0xlbmd0aCA3MyAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4K c3RyZWFtCngB1VxdU9tIFn33r7iVh61Q5dWov/SRNwPJDENgWWBnpiqZB2EL0Ma2iD6S sL9+T8tqWzIDsZRt0CaVslBIuN19+tx7z73dn+mf9Jl8xw08f/WBTxX6TsD1C79+yGL6 nZb000HOaJqT64QydFnobZ5Gm3f5lKQIHOmGITE/dAI/4MRU6PDQ98hjriNCKQj/53Xz pzNfOoqFJH3mcLn+vtH2zyYXv/EzPuOHs0AGrqtf4Pf6Kykc4fpKkO8ph4nQp+mC9i9h ostcjy61fdU/qT8uF/TTO+a4xOjyml4fLYs4W8bFHl3+m95ewsbGHP3vrAy4wzgGsG3l k7b93bZRnhP6wus7dYdZdF3Q1q+LeFpmyfKGzs8u3m/93erLk+ieuMv43mj3Gdf4aWGy WtEncSFC7njC28z4qMLF02ggyzO+AavyHO6FogbrkzB4PqOk73AmseurHTQQo8AuAhTT bVv7DtHR5HRCB+kyT2ZxFhUJnhrLO1oz4SO7vAfmmJJOEAbg0troYWGOh470xcAwx13H c3nYbXnBJI2l3Di1R5ayh1tRcIYezPJb9sHvaK8y+p5X+XCaFjEVaYXBsX64ioGnRfol ntFdlqSZfndXXs2TaYXMN1TcxiC5CH+Wq39mmx8D3/EDqdYjHBZWGXOU9Ds682eERcu+ XWExbZER5UVUAA/JEouf5PQlznKQFKXXGgw0S6flIl4Wzp+2kcCl4zOGMKAe1LCQ4MKP +/6wWAue2wlcz7DWMDylF2AdFeu4ZwJ4Sstc6nHgS2K2+lk4mX5apl/n8ewm1vuh6cRt MD+TyFkk3OSWtQNZZF85QYDNOqQYzfOQVDLXbIcdU6/nY+u2fbuy9SVIOCqL2zTL6Wta zmc0Tz5VXj3aILKi6i/RvASRg96LLLkqq1CTrrN0YZu5kVaGggdkBjgo5vYQQ4VKdeSj Z0RFy75dUfFrmtN+Wi6iZT6miyL+EtMxWGlM0XJGF3G0pMsSgkKm3fpdFt9Fq9Rj5dWT 3DYiPOEorqC81IMbFiJkCPEJWk0nieYZEdGyb1dErAM1y26UuYiJkZJ4bStbfmm0JW91 cu1bGe9oJbU9qbKsBQ0PXpMztVrZByLLqCm5/YhN5FZW7WiTYPDkSHH+Wvl5IaM4d3gQ ytqoR3zl9jqGiNJO02yBZBGEcx5fI1lcTmPrsRCEXF+5iryW1aMW5uhHMNcjNd9gjglH ssCEHQMxyoWyLYMadLvK0M/IcS37duW4D+fvDjhj4Z9E+1k0g3+D83PG9Oo4vkdwlM1y uoaoUeax9nv45rxSP5a23R0kLeUJRl49qtrdPbKrtpE60+pLbJm2hQqQwELANDbW3m8Y cFWhcmS4FgV3nDjAtfHL8gQyyBJccA+lqj62nsefywTaG4I0eo9wbZ6/GtP+wRkxOdZI JY3rMZ1E2fSWWIhymG3QKogHnK+HM6gQTQWeA7IfFqcqlCZ9BQQMNG5s29eFU4Xva059 f79cjukAhLrKJTS16nzi2EFKkYJm/3AU0uu334oY5QyoiBXbHp3ZRqrJL80AhwVVD8SK AmZnVLwEdfWydTKbZXGex3kFhskFHc3AYsl1AqUYJKbJSwNoTL+WyxhFVThB24gwzkzV AxoWIhCuBrwWHNpJyHZA/SNJSKfESCk0SyjPJCGPONgH5nUTZZuZ20j3bHy/Pm4KXP3s 0/Gg9AQHd70r53MdDv7mVCi9dOh9AsY6mEd5PreeoXCPocwf0F8O47t1upyq/g/LAQxH 3OK5aEZpG/l0FmW7+UO4riMVF9tGPQLQB6Fzuoh0pJ9C7VzeWJ5AAbIB0cltWwcSQkuu W6pM28SOE9hwQni0PIGbELqXrR9fHxwdnn/ce0NaEzctU1S7J5rkeXKzrAJsHbRMbm6y +KYqa9v2Rn6AmWek6lENyxkJ4biiR1GkgYxng0UvW8/m0dLkUpyv4hHtFMY0KW/KvNAR iWc7ItmQaz2GYYEAtXXmQUAbUrlOMYX2TJd3Dpwtw3EdkrTs65JOSU8GCElQo4mv8zxF TlWJVJq19qM8Zh4yf3xqiGqm0s/oEDyMisg2U63j5npsw0IptikX7RD1u7FTg6ae04H1 MfXtcprOEKaYpEnDZEz/mBbpVZy1QD2qu6MfaSRrxtlVb/T342yuGGq0ErHLyvIhLDwK hOj9QuNvbdOKCHbdaCtWt9svzQO0aCM83bKwFfA9yJlaK2n63HdbyU4pnYRGiM7iWo5q 55mIk1+mriQDdOGHpnm3XssH7e8P5qxb6NnEf8c8s599VZ4Z+AykPpnPUXQf01toYwfR HOkldA88H8YIQ+4h4OL5fXJ1FdfP7yCVwAPYJvY6BDXDG8L2XhfIJA5kSFFrubtu75fh 9V6m6uXXfvzEQWKChBSIeHVYJaYoSyG3N2oZviNK5vTx9eHx0cnHPduQMNlqPaaBQcJF xaxHebIBiy4826O+u05Wpd/H1gvkolFRQjitJVIJ/tD1HX3sxEV1B55rtONJnybf7erv Pc+ROASAo00r64e1/FouC3FEa0j5CPy8lm07HvGwH3SafKRt3648ql2XEqEH1/ULkmGd jPy8kkjxcZJMbyOUIvXbV5fxt6KM5mSbl4ziZ8ZTI3NHweo8RjtbDqdaKTvoZ2vQgI3D NMIUn7bMbcWA27KkbSFt41rx5Ps9SpIvwaO9bJ2UwGy6SMucLu7zIl7Af04uPu7RablA 2mTYVUNcB2HTWL/VFBvYlnyEOboi64ENi2KFdCCuDIxiuQcxkg2XYlv2daLY0FWg2JNk Pkf4d4iIEJ0cqEmskoP9MruKlp9WX+hQ8XeHjqN8egvaPY0LdC59ss265hyqrIc4LLAy fQbY695Z8RI01svWy2QR01mWFuk0ndNv9Rkr+WbzrqpZzG/SLCluF9YbtCUEYX0QXNaj GRYcQN4432i4a8fIoIEF+0HZJjvoZevFXTxFA8Xq1OWrcSOGsXKWCEeyXBfNvrJt7IvG MAxKEcqVfNuoHVdbd50okO666wR3PFieRh7g0BNudmjPYlt4e6BsdbFpK8/rpAaKEJdd CHPMpW3Ui6mBItQ3ZKDlYNX6/sjSPpizZ1MD+9lXpVSh0l0nx9HXaFFmka7wGA1Iv8tv kwVevpqgSX6aLlCUnq3yFd2efHT2xbPt7k1sakY4KH4XkNUF61H5a1B8l331I+pPP1tN T4LOqQGBZspay0HoIm5WqDV7Wb6JxJzJMiMaFiR8rjVikxm8qGdaZ9e4lAYqpTkkM7xD FG37uqQrqDzqdGWjCGn9B+VpRKjXyRy3JIGmJutgtGI2fcTiIvkPukDxl7axuqavegWG hVXcr6KY/L8IT0UvW/+1OkBjm2MlrsoKFaN+RhbA63mcp2U2BXCrS0zQt36PxrDrLMqL rJxq+R1y0fnZ8dHHPUTZlgnWFw6OLPD1cIYFWky21/kCo4bDfcacSvSyVWcEmtfG9C6+ ysooW13w1cwKbAjEnPs4WKUUGauHtewCPRa+qM95Pt3r+2yqtcCU+Wxd/nkkLXggqndL C3oEfabS0ravo1/1t/xqs8byM3RBrfOcozs9RYVYH95HjtDwurY5ysiAZojDAiuDJCB7 VOAaNGXbZ5lTgFCxe9i6OkAFf/THxnUdxBCKKy1oXSsGjfnW3ZW5b8mMZFhQcEMowui1 H1KFWB9WCPnAaiqIOBxXrWsqw8iceCAg/DCzfDsy/HGCAt88/pTQ3+iXCHU8MKTe2m+/ 3eHobE6nltmRu/okP8oQxvx6S+xoPq7Vq4qPDH0e+mrRBivh8cNZdBMT49bvUTMUvzWI gQADN+4KVh9SaauUD2TALlTeQzrV12SywFfEH7fpKeX0v3+KKTYKZW5kc3RyZWFtCmVu ZG9iago3MyAwIG9iagoyODg3CmVuZG9iago3MSAwIG9iago8PCAvVHlwZSAvUGFnZSAv UGFyZW50IDQ4IDAgUiAvUmVzb3VyY2VzIDc0IDAgUiAvQ29udGVudHMgNzIgMCBSIC9N ZWRpYUJveApbMCAwIDYxMiA3OTJdID4+CmVuZG9iago3NCAwIG9iago8PCAvUHJvY1Nl dCBbIC9QREYgL1RleHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250 IDw8IC9GMS4wIDggMCBSCj4+ID4+CmVuZG9iago3NiAwIG9iago8PCAvTGVuZ3RoIDc3 IDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHNWl132kYQfdevmKe2 OW3XO/u9forTOidJ0x7XIacPPX3AthyrMQJL2K7/fUcgAZJrDKQiAw8C/KHLzt2Zu3fm Bn6HG/BCBufnF7ra6EVQ1Qe+flGk8AfkcPBTiXBeghTRRInRLV8ly8/KczA6CCNjBPRR BB8UoI1CRe/AoRQ6Gg30Py9X747eCIsRjEehzOL3ku69QdKT7nFDN8dggpTVB/RcvDNa aOmtBu+sQB09nI/g1YAgSpQOBhW+2Z/Ul8EIDl6jkIAwuITv3ubTtMjT6QsY/A3HA8K4 skb/H8qgBCr6Al2Ua7H92DcoJ6LXbtel+7kYXk6h8/iQnt8WWf4JTk8+vO/8bP721+ED KInqRbL5ilf8aXFyFtG1vNBRCafdcsWTGS/WswF6XvElWa0TykVdk3UtDfYHynih0NCu n+0gJqAou2hKMdtt6zbzeo4qIiUxrRz4nbC+Ts+K22Ex3xWib6yUo9FSau5gZRJsFYXx mtm2UFI4qSKvbUGcs8ZvWe2ObqdX46L8Fo4uLoq0LNOyb7ppWruqKPs2XiZ0k1QjvOdF N6oKIkjX0G1DHUMJr+dQWpKHjnZBGx8psUpnJc/prNPxWVpM4ZesnKbX6eesZ7CorTAR bQdtwoN3LhjhLTablwkob0UI2GwGfrxr4duUd8ejYXZ9CMWMfi+LbJKK/tU+OlNVDA2u hZkL+xwdAVHyTTAtfJsG+uPp20NKglfT6eTw4OD+/l7sK9i0maWMdIht4eYSbErb0Vpm qcZEMiHozM7poOGMpNOPnWPalHV7LLu7wHtVZMO8b2EQGhthpxV8MyRhMBrmfQsCZYUP nuRLax1bpTfpeENbLVzHokjmPtVai2LhBjiNdMY1be49sq4ewdtO8q0CTCpf73kPZSH5 dsL3bnyVl/BmPPmc0fVjnt2lRZlNH+BoMrnO0gs4uXooM0LyfnjWc/QV2YzaIBmSrW/C JUcrJVSgCsIqHaIWBgNfldDCt2m+Prka5+khfI9gaOt7HwA1xp7Zt5SDLcxc2CfJijeh Tj6b+uZ7LHwtfJsGutb9Z1UBfJnl+fhuOM3GeXk9POscAJJFS+QJu381cc4aIs8nTiUD 2btk97saPCvz2cbqcMzMZbMkI5xi5rJZ6ol5S84up8xsXRCOGje8QFHLL6j6mNFusjzS Lduk287m20pWWUt9SusaWdXSejAYJat9wC/ReiBnsDbTetaoqgFbN1naK/X1QGktpG4s AS6glBHoJLPwoaXWtlT1MZEJpyR1E/VTCzXvdyfzfveX8byufFQylw34J9rxhuYKqP1a p85HlGqa8EnVhN8fqECjCrHpcHIBRS05o2uhzQaTFFRn1lMKcM/Rc0iFj+ZLZtWYy0pZ VRW+uj/NBRRZC943uoULKG0EZU5m4VOOKh8yCx9WlppjljvpTEOdPl7h05EmzXRjbzMh uo5VdaThM055SgeywPBJ4fJ16rH2qip9vHYfTcRR7WvsOC6cstXApGG2+4wVbjGbxWWl tKPap2s3lQsoRUYCMpMuVPZEMMykC51CqfZ5ZuGT5CQoZtJF0YSrtMykiwqaah824Xti iqRrCS3GguAbaBqC5DDD8T+TjObU4LfxXTqiPiEg/jAbHq5+uHz8eTL8lJKT/9e+Zoqb b8nK1lU0U6/xP42l7nqvHrj/BbCqJQEKZW5kc3RyZWFtCmVuZG9iago3NyAwIG9iagox MjYyCmVuZG9iago3NSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDQ4IDAgUiAv UmVzb3VyY2VzIDc4IDAgUiAvQ29udGVudHMgNzYgMCBSIC9NZWRpYUJveApbMCAwIDYx MiA3OTJdID4+CmVuZG9iago3OCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQg XSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GMS4wIDggMCBS Cj4+ID4+CmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvUGFyZW50IDc5IDAg UiAvQ291bnQgOCAvS2lkcyBbIDIgMCBSIDExIDAgUiAxNSAwIFIgMjcgMCBSCjMxIDAg UiAzNSAwIFIgMzkgMCBSIDQzIDAgUiBdID4+CmVuZG9iago0OCAwIG9iago8PCAvVHlw ZSAvUGFnZXMgL1BhcmVudCA3OSAwIFIgL0NvdW50IDUgL0tpZHMgWyA0NyAwIFIgNTIg MCBSIDY3IDAgUiA3MSAwIFIKNzUgMCBSIF0gPj4KZW5kb2JqCjc5IDAgb2JqCjw8IC9U eXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXSAvQ291bnQgMTMgL0tpZHMg WyAzIDAgUiA0OCAwIFIgXSA+PgplbmRvYmoKODAgMCBvYmoKPDwgL1R5cGUgL0NhdGFs b2cgL1BhZ2VzIDc5IDAgUiAvVmVyc2lvbiAvMS40ID4+CmVuZG9iago4MSAwIG9iago8 PCAvTGVuZ3RoIDgyIDAgUiAvTGVuZ3RoMSA5NTA0IC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4Ab1aC3hTx5U+M1eSX5Il2RbYFuArLgaHa7CNIbGJAjK2aMBABDiJ BA2RQSaGBHAwkPAIOA+DI0iaEBq6IW3Jttvt7jblWnZaOQ2xt6n7hd2mJdk86CYF2vT1 7YY27aah26Zo/7n3SmDXyZduujvWmX/mnJkzZ86cGd258rat29vIQV0kUWhVa8d60tOU LwP2rNvU2mHUJ9uBR9bt2CYb9fxsIts31nfctsmoFw0ROWpvu2On2X+yRsSebG9rjRly +gB4dTsYRp3NBk5p37TtbqPuew9YfMeWdaZ88nHU8ze13m2OT2+hLm9u3dQGRJqyB1lF x5bObXqVpiwBVndsbTPbszCR/QQxcG10FznpBspCzUXVtJvIet5Ri/kyQ85szsjtJ251 +n/HvJgWUv++F54TOGQ9+fbFHX/wOnw5S1HN0dsLAfRmPXcphDlPurjjYqPDl5EIqUi2 JN2pJuk20C2glWpDPhFfSC4Qp328iRifz/3op/J53J9g6q+/xa8D8zpUisroJGQuEGcH WE+itCyQZA/2ucbVU0M+6yEXiLP7WTd0qewBE/ez7gRXu77F9kHtObYnsJ6dOz9u/IRX X0O2e884r3N32e6q3dLuPSUvvwLWjruQbepAdscWZLdvHue9dfO+2/ntm/dtLd22vcgz 4baNyNZvQNbWXuT9TNvxttNtUlt7952lJZ3jdjWW+HaC+IC0QlqMkV0npYUUAnEKSPWJ vPz6gdSQVJfINwt9Ofb6UEOeNIOYVC3VYAVU/h7/L8oGvp14nqtJ/lbf8zHMlb/ZVzO3 XmBCmSa0oFBUpBd+mKitNwvTZ5oFn2IWxpeYhXy3XjidcKPAu/jdwrwGlW+jEIjDtbeg dAtKeXwJeUG3gyTUmlFrJs7ncguNozJeBywAzuI1wtm82sQq4CTwZ/KaxKQyOQkoGFc/ wC6ytxOSmtsgs/eIsV+zX4le7IKJ75j4nyb+kv1CuIH9HGgB/gyI9ql/YW/35cH0holg MNqBfL8QsSPssK7wMRMPs0cQ4Sp7FJgF/AxQDPgwewRTHhxElVEH8i4hYDcnDlvUJFuZ eFTADYmjAq7u2yepCLD6REFxfUMOm8LKdaNczK2jJXDtB3Df70O/54Gfl5bWP3FMUp88 ZlGPHc1VH4O+Rw/b1MPQ9FnQ545y9fGjknr8KPvi0RNHB49Kz0nXS4vE5KRFiW6uipBo 7HO568uel7AJ6LzIpTnSbHhNbiiQaqkaFACFQBapVioSRkizTKySitCyahBV7EJEjwzi /N3ESRvi5yeJwWwxBP9xYnyFHgI/TiAWkvx84kAu5Of6Bi2YKn+jTykX8fVGwoNFQ/tX EjCpwcG/y4eFP/m3+ZCO/2ziIWH7c3wHv0tMhd9lToXfaUyFbxVT0fMAj6aVRhO5ebr2 WxPji/XCmsSUq/TCKr1fQxFfrXcUuZMvRj6OL6KpIE45fAaVgDjMUxNuj97vqj6Hux7R pohoO8knc1ksN/dxOWFRT0GfjDNkEnKxucoMKXuf/UBfyPPsGZLJx86xZxJTfXKSnUtM 8tU3lLIfsbf0qHnTxH838YcmnmFv6AreYK/r7V5nryK6tEFUGXuNvaoz/01nbmjIY69g HgMiZ6+Yspd1GUY8ncAhMID4/oGIb3WQfYm+DOoHSanz7CuJQg+WgT3EDukDHjQxDhRh fVNiP44JdmOiSwK0JPZbASsSBwQsT/QICCV6hGxZolvAErFQSVaXOCCgJjEomJMNZn4g D8I//NGi/lE0Sg0Fcn8nAvN9dv59Jqo5vZ4J9YGfIeRFbeYJh7Melgb6Q/3R/o7+rv6h /tP95/vf7c/pPxEr++UvLOqD8Sw1ftCmHgKhyzcfrp5V//BDGBLdix6apNQ/dJCrB7uz 1fvutaj3ijmkhvq6Fi8V+vu65jcaOLvewIqZ+rj2rolKfdderu7bq2sN2O8JLqq/B5W9 0CRUyz1Q3YMZHgBjf7dNvf+BXPUBYEd3Vzcf7GYNudJKqYXypZC0HPky6QaRJ6RYWcON 0hJpKTklrzRBmkh2ySm5JDfQLjmkfOA04FXkkHyQK8BJkMvAaeSXfKBJIC/ICbKTnz/N v85PkJ0/xf+Wfwn4Bf5Ffhw4APwWOXgf5M8ANcgTwAH06QNpoi/oKdAXQPfy+yif7+X7 kO/h94hct3c738V3Y6+4uJsXQK+D53MnkHHOJbKzSyzF8d2Pk9xNx0BctMVZ76IvggZB 50BWnNwOmg/aB5KojF3CvilBXy9sKoROD7AEdhSCXCAHyAZi5EdbPzvJnmeDGK+XJVgf 8OvsBNOAp4D/Sg72AuTDwCHIvw08hT4vgIZEX1Av6OugTWwz24J+rWwtWwdcw25lUb2+ PjG+rKxhAVtP80H7QBLbCeluaOtEr+3ADvTaCtwJTZ2gDqERtB7UCloDqmQzyMmmsmnI K9hVlM+mMxV5MSsBp4AVIi9iHnDGsfHIrcyGnDMJObawyANfRahcSjm913iKr/Z45ngK ZnuctR77LE9OjcdW7ZGqPDTTM3VafsU053Q1v1J1TlbypyjOSWX5cpnT6XLbc3Lz7Las bLtksdrhaTtJgcJShaTCMps0oazMOd+5zynJEiuTbpAGpZRk8bKJjuKsUofHNd5RYCly POJllf7p/gr/VP8U/2S/7J/k9/qL/R5/gd/pz/Hb/JKf/KFaphU0U3PLAq2QAVcu0GrV 5qQkr9Bmqc1aTmh1uJexhyPgarwnyahFs/QkOaCgcdXqcJKVCHG3d0DMW2uOdj8U6eW0 QGM9mrIyLCCwPKzJPUkXtYR7OVsQiUS0a5pDKNOCiDpRizWjWdfEiDZLFB6ZGKFmbe5y zassUEenTsHo3KbDZVlvxdSgNj3YqlUGo02X2apKqMDgoHYp2JpkXBkhTDccpSzNBnYi mdUk3xNM8l1Qw/eOrSbTLyktCyalJWgqhUTTbZ0sIxuj0LkNTKbno6X64Nu2w5AREjCQ OuEG0VX4Q4crMt3sTkNAV4opoynNTeMVg1wxbVOn6NWpssawN6KqWrGmIEjSHUyNAliS 7ZGDG5uS7B4D9hqwz4AuA+414D4D7jfgAQO6DdhvwAEDegx4UIA5MzyVXKtzud+A6wyY Z8B8AwIGNBiwwIBGA5oMCBqw0IBPCYDfMLfO3hwR/aEVC5q17BWg0GqtVEHlRVSuRsWu LCCbSiW4Gb1I5encuMgYuWUeFYtS6k09/2W6fGl7Si8TXTojeJ8kibuXIMsnUSL6DhMO 1NS1qUdT79EgtVNRqiH1udQ7Y6q9L7WXztErdIr66Wk6RmdRHqbnaYD+id5G+bsoPU2f pbXo/WX6PHUD/5GeoiO0FXyBgjP857pZxQjeRbpIR1kDLQaOTkeg5cho5ofWf54qHUN2 NjWZ9tAevp3/lLbj7wlo/Bodv6LlBpT/jjpx/x1mF2gte47WYz49FKPP8FDqP6ynaJx0 N648WyzHRSSMSI9TmHZSTHoy9RvEiTMrhC/VE6nfiLv0iPRR7bZg7HQaoEMsl/bCbzW4 mT9BC9KCkQgfXsQc1mEu9+HvKFajD397MO6jV7a0NYla2u5sMqI1HUdW8a4BKfUL0N16 cVj424zYH9MOjOCnGbjOOVNliJvrU22pnanPp04iGsTqf8WMikHU/oEeZUdhwVr6NN3E v4eLnahtQf0mWswmMgd9Abrn6KNkMnNXSQZDxLhIafssphfNvQUrjZS6Nl1ih/HFfJFe pBcoqdvzJB2mOHXBD9sQ36soBNvn4rWE0e5negwLyy+3WUMtiD0kxOA8zOdsWrdA62v6 3jff3fyZfWLvD0vfNvoILxrpUrpA9BJW0tgNPfDGdvhjHVb2or57xPoNY9WeQqylZTdl pN/V11a0n0ezhBWpuam98P336WbawvvwwHI/+vVcHipT+hq46UguprNsXkYysvBJ4n4P 9tAwPT5CYTfdQm0jOKMqo/03SjxG1XoBj45HsGrfwHi78Sfebo1OA4jvYfhpFy2nBjqA dTyL/dGOPRyDx19hMtbnZZxiY6VW6D2NVdkirZfMVR6rGSJE/I2RrBcMZjYxCyI/E7vp pkbspmsjcJ5VojOsAPHxGJ1BTDxN38RZcpvgIoqN9Jet0X20maabfxQIrFh0vf/aufV1 11w9Z3btrJrqqpkzKtXpV1VMm1o+RZnsk8smTZzgLS0pHj/OU1RY4HY58x32vNyc7Cyb 1SLheb6SFWvFjeHgRq2kMYrvwibFJWv2Ze8urdKowOtT3HJtVWSG2UqzqhoVNmtFeOaj QF1Es6mjmyzTpHLXb33ovNQrBzVLOT7K4taYVrEi7FNcr3sz8gjUaqWNYZ/Pq/FyfBZB hM/iVjmmuULgQ6BzFmkUCgtKpn5SBybV+SLIV4S1SekqHkXHMHIAO2polJnLWNzVay9p bNKoqJfsP9HII5q9W0e4hGkVeDQud6Gka6MqjRX9VmOFGvMsxZRGDiG6na8bwwfB2EYl GNsAj8ail336ruFRnxyX4yvC7lqvz6cbjSeR5eHevNxGpbEtF7PAQzMY1JubB06eYGBZ OnqZfR7TC9wenIsn7mwH3FcgzA0K2qgFDkZRUJrgN0gKL0twST50pYjQzWhEaKaXmD6m ZmvUsgwj5A1aoFWjg3Jv5VD8EJ7410ZVe0yJtX46rEmtMKqXpPJge4s2oTm0CiwYAYq2 y2K5m/RMLJ4cbJfjqIu2UeRKE7qO5Mfa26IiTFhUaYIspzF8wDfkxZUkfCCouVXNge6O XT/1SvFg8QZZVOPxA7J2HFeRK6Q+0QZBUDyjUo4HFYwGZcGNC8SKVWWWTY/GRTF9cQIH W2Wta+1G+Ayf1kPp+PfFXZr9fR9WB+uDnmJ3CAcLikU3iqlsRE8LQI4fbNOnekifGuJV PHYKEh0R/XQjeq8KB9uVIPxpDgiHoL9UPrqvz6eVqKJjPB4UJrbGYL3wDD4leFiHGUYF e8KrMtjTqAVadKAWfQ0wYqC1KWKyzAaQWLAOWiDaFImISRkLoGWVH7DOVOS4UJpVrhWp Lt93IBuaUdm8IhxsEtGJlrwxfN2FYu8FlHHRS7NZMdrEqy4IJwnJSqV5uREF7cI/Iou2 GBsYXjNXHk3N9rrWl4q9L6HvQmVhNB5fqMgL49F4azLVtVaRXUq8126PdwSjsr7zGfjP HvRqCw9FNFe0nc3FIot4W4gn+MLlq8XyLJTbW8HBZ77iq/P63FBttMHJMbbY3GeIeMS9 2Gdx1zuYsR0nkldeKI6XJE4Fr+aqE9sUltwYxj5YhyGCMT3D/sA1l3vFTpEi5cENK00H eX0YUg8Yce4tN7lQ4vOJPXQwGaC1qGhdy8NGXaa13gQFqlSsXVRIhtISz41C0pWWZLpH FaxVsbhm6zHxYTGN8zwTz3G3UiDXi8Mc1uGzKKYNtWCOv6/TsuExfbkLG8OSl4smKHGv JEq5Kr4S/Np4Ve8ofIJTMu5S5NOK5lI1a2N4yOuPyC43DkiWCQZTowhT12nlFBOHKBW5 NObX2DixrQiHKtyIQ398HYSZjnIwHjWj78r5oaloHWvP7CNjFti4YpJwg0vBvvUa/nAX KGKq3xPRbnzBadbyhWJTYW10jy2OaPniy07Lf0fPMDlvY1jGMYRtu1wvyEG5Xay6Jkeb 9PMg4hXyNDuZOh9tEudfGIGGJl4zvhHlcJu5J0w3NLeE06UV4Xu8uyIz8KtYZXOScvBN Kt7JJFmqO0lNEwfwO5t06xqIWyplObihCQOicmMlGNN9KN1UidgUoR9WIuKbZFEsLovg j2FaOkLQFo9UIV5XhnFe4lWNTwtEvJliWyQyF3puFnrQBc3jEWjYaGoA6qyqP6FRuLIZ J9XUUBiHbVcTAr1JbGFMdwi7akjMWEwkkrEUFt+zodi0eRVsjkyHfLWhBbHaBRWReFzo XBlWEObxuDeOeZh1vOEZzQiYjCSJLph4MMm6QugLUPTng6DiU4TnI00Y6tPwe/qUwm+P H+3hNRm70fNWWLtG93D0r+Th1o/j4bUfy8PrMpaO8HAMNq8THm4b28Man/oRPr7SpQHD pYExXLp+hEtv+2iXtmcMhVUbYF677tKNfyWX3v5xXHrHx3LppoylI1y6GTZvEi7dMrZL /y+CtmOEh+/8aA9vzdgNIzth7Vbdw9v+Sh7e/nE8vONjefiujKUjPHw3bL5LeHjn/5+H d13hYfywyYjjTg160epks/kTNAwSNz/jfyLEDyg22o+6jHs5A35Ywm8tSOabjQ9r9L/i i9cjVr2nDCvm4k58nL6POm5sQgCRhF+8i75p4xYSVPXSqy/pWU21z+1zlyNjuKd+EJC6 Puiy0h8pYOlCT8zmRWSDuIlK5A048DUsnYDMSieqq1VWWuxaeoGqLtRU186p9bx48aL+ uo6J/1exLMYtOIfCgeoHLX9jGbCcslgsrjz39ZKFrbAcs9qKrDarLSuLHaPsr2YdtLCv yjAVv1NxjuvHNwqLr+c8L9ddUF+l3nLnhVl/EqPMmv+jmuoDqur6Dql3+ub43NY55W6f h81mFZfOsF+xiiOWRxZ/bvcf/h6vqxgNXzrDQ3j/lkVTAgWWY4ysx0iWsqwPUSCb2rhp /EuzaP6F+ZhAITQp7lrPMDt49uylM1krj/z3a7qexdD9mq7nGvGfKc9CNaeb8F8qzJUk y1tJGJ0k22l6Vve/EFhdz6KJpDfiruoaBtW1bsXDXru0/UrdRjRQqg7vJMZKNjAlclMR oiqgN2D45wojvmxUSBRZdv3ilkZ1yfZ1G2Ktn9raujmmv2q5HIEyelWC/KAlILyLoDtS ZkKZMmWGqBlZnzmqXjOqvnpU/RZR/x8DcQd3CmVuZHN0cmVhbQplbmRvYmoKODIgMCBv YmoKNTExNgplbmRvYmoKODMgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9B c2NlbnQgOTY3IC9DYXBIZWlnaHQgNzIzIC9EZXNjZW50IC0yMTEgL0ZsYWdzIDMyCi9G b250QkJveCBbLTEwNjcgLTczNyAxNjQxIDExNjJdIC9Gb250TmFtZSAvWU5ISlRDK0x1 Y2lkYUdyYW5kZSAvSXRhbGljQW5nbGUKMCAvU3RlbVYgMTAzIC9BdmdXaWR0aCAtNDkw IC9NYXhXaWR0aCAxNjQwIC9TdGVtSCA3NyAvWEhlaWdodCA1MzAgL0ZvbnRGaWxlMgo4 MSAwIFIgPj4KZW5kb2JqCjg0IDAgb2JqClsgMzE2IDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMzE2IDAgMCA2MzIgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDMy NSAwIDMyNSBdCmVuZG9iagoyMCAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAv VHJ1ZVR5cGUgL0Jhc2VGb250IC9ZTkhKVEMrTHVjaWRhR3JhbmRlIC9Gb250RGVzY3Jp cHRvcgo4MyAwIFIgL1dpZHRocyA4NCAwIFIgL0ZpcnN0Q2hhciAzMiAvTGFzdENoYXIg OTMgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nCj4+CmVuZG9iago4NSAwIG9iago8 PCAvTGVuZ3RoIDg2IDAgUiAvTGVuZ3RoMSA4OTI0IC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4Ab1aC3hURZY+Vbfz7k53Hh2SNCS3uQSQGwgPHwm20Hl0RohgA0G7 QaEbOhBAIBLeIIloIDb4AB2ZTx3Fndn59jHKTSeOnVVMVhc/2R13kPU1qyuo4+PblR1n 1hG/0aX3r3tvNyST8WM/3b2dU3/VOXVOnTp1qu693dm8aUsL2aiTJPIvCbetIv0aqwEq V64Ptxlt9zfA0pVbN8tGOzeTKP0Xq9pWrzfahYNEthmrb9uR1Bf9vK0t4YghJ6F/dSsY RptdCRzXun7zdqPt/gKYedvGlaZ8bDHa6evD283x6V205Q3h9S1G/7HdwIltG9s3m+2Q 3t7UYvZnASLrMWLgctpGdrqRMtBy0FTaRZR21jYD82W6PJ2l24Prji23e/7AXJgWrr6O l54XOJh2/MPzW//osrmz5qGZpfcXAtjNeP6CH3MuO7/1fL3NnZIIqbh4nG5X47QadCto kVqbC2YjOUCcOngDMT6be6Cn8lncE2Pqb5/j14F5HRqF5XQcMgeIs/2sO1Za7o2ze3od RTVUm8u6yQHi7C7WBVsqu9vEfawrxtXO51gHzJ5hu72r2JmzRaNGv/4Gil27i1z2XeW7 qnZJu3aXvHYarK3bUKxvQ3HbRhTrNhS5lm/oWMfXbejYVLp5S6Fz9Oq1KFatQdHSWui6 v+Voy6kWqaW16/bSkvainfUl7h0g3i8tlOZiZMdxqZH8IE5eqSaWk1vTnxiUqmO5ZqU3 y1rjr82RJhOTpkrTsAIq/4L/F2UCP4y9wNU4f7f3hQjmyt/pnTazRmBMmSCsoFJYqFd+ HZtRY1YmTTErbsWsjCoxK7l5euVULA8V3sm3C/dqVb6Z/CCO0N6K2q2o5fAbyAVaB5LQ akKriTifyS1UROW8GpgPnM6niWDzqSZWAcvAn8KnxcrK5Tggv6imn51nH8YkNbtWZl8Q Y79l/ym02DkTPzPxP0z8lH0iwsA+BlqAHwHRP/GP7MPeHLheOwYMRltR7hMi9hA7rBt8 0MTD7AFKh+IhYAbwfqAY8D72AKY8MIAmozaUnULAbo4dtqhxtih2SMCNsSMCru7tkFQk WE0sv7imNouNYxW6Uw6Wp6PFe+03CN9X/q+49+PS0ppHHpXUxx61qI8eyVYfhL1Dh9PV w7D0Q9CPjnD14SOSevQIe+LIsSMDR6TnpeulOWJy0pxYF1dFStT3OvJqyl+QsAnorCil q6QrETW5Nl+aQVNBXpAfZJFmSIXCCWm6iVVSIXpWDaCJXYjskUGcfx47no78+SA2kCmG 4O/HRk3UU+D9GHIhzs/G9mdDfqZ3wIKp8rd6lQqRX2/FnFg09D8dg0u1Nv4yPyHiyV/k gzr+vYkHhe/P8618m5gK32ZOhd9uTIVvElPRSy8PJY2GYtk5uvXlsVHFemVZbNwVemWJ rldbyJfqiqK087koi/gcGg/ilMUnUwmIwz01lufU9a7oteXVINsUkW3H+Vgui+Xmbi7H LOpJ2JNxhpShFJur3JCyL9mv9IU8y54hmdzsDHsmNt4tx9mZWJm7praU/Rt7V8+ad0z8 VxN/beLb7C3dwFvsTb3fm+x1ZJc2gCZjb7DXdea/6Mw1tTnsNObRL0p22pS9pssw4qkY DoF+5PevRH6rA+wn9FNQH0hKnGU/ixU4sQzsXnZQH/CAiVGgSOubYvtwTLDFsU4J0Bzb lwZYGNsvYEGsW4A/1i1k82NdAm4QCxVn1bH9AqbFBgRzrMHM9eZA+MevLerXolNi0Jv9 B5GYX7KzXzLRzOpxjq7xfoSUF60px2z2Gnjq7fP3hfra+jr7BvtO9Z3t+7wvq+9YpPzT TyzqPdEMNXogXT0Igsqz902dXnPfvRgS6oX3lik19x7g6oGuTHXvnRb1TjGHxGBv59x5 wn5v5+x6A6+sMXDiFH1ca+cYpaZzD1c79uhWvdY7fHNq7kBjDywJ03I3THdjhvvB2NeV rt51d7Z6N7Ctq7OLD3Sx2mxpkdRMuZJfWoByvnSjKGNSpLx2sXSDNI/skksaLY0hq2SX HFIe0CrZpFzgBOAVZJPckCvAMshl4ATySG5QGcgFsoOs5OFP8af5MbLyJ/lf8J8AH+dP 8KPAfuBzZOO9kD8D1CCPAfuh0wvShC7oSdDjoDv5Xsrle3gHyt38DlHq/m7hO/ku7BUH z+P5sGvjudwOZJxziazsAktw3PtxkufRoyAu+uKsd9AToAHQGVAaTm4bzQZ1gCQqZxew b0qg64JPBbDpBJbAjwKQA2QDpYMYedDXw46zF9gAxuthMdYLfJodYxrwJPCfyMZegvwE cBDyF4EnofMSaFDognpAT4PWsw1sI/TCbAVbCVzGlrOQ3l4VG1VeXlvHVtFsUAdIYjsg 3QVr7dDaAmyD1ibgDlhqB7UJi6BVoDBoGaiSTSY7G88moJzIrqBcNompKItZCTj5rABl IXOCU8RGoUxj6Sg5k1BiC4vS+1dIlQsJu+saZ/HVTudVzvwrnfYZTut0Z9Y0Z/pUp1Tl pCnO8RNyJ06wT1JzK1X7WCV3nGIvK8+Vy+12R541KzvHmp6RaZUsaVZE2kqSt6BUIamg PF0aXV5un23vsEuyxMqlG6UBKSFZXGyMrTij1OZ0jLLlWwptD7hYpWeSZ6JnvGecZ6xH 9pR5XJ5ij9OT77F7sjzpHslDHv8MpuU3UVNznVbAgIvqtBlqU1ySF2rT1SYty7800MPY fUFwNd4dZ9SsWbrjHJBfv2RpIM5KhLjL1S/mrTWFuu4N9nCq01i3piwKCPAuCGhyd9xB zYEezuqCwaB2TZMfdaoLqmO0SBO6dY4JatNF5YExQWrSZi7QXEqdOvxqF4z2zTpclPVM HO/TJvnCWqUv1HCRraqEBhz2aRd84TjjyhBhsuMwY0k2sB2X2Yzz3b443wkzfM/IZlJ6 cWm+Ly7dgK6SX3Td3M5SshEq7ZvBZHo5XKoPvnkLHBkiAQNXO8IgVEU8dLik0N1uNwR0 qZhSlpLcJF4yyCXTNm0KrXaV1QdcQVXVijUFSZJUMC0KYHG2W/atbYizOwzYY0CHAZ0G 3GnAXgPuMuBuA7oM2GfAfgO6DbhHgDkzPJVcq3O5x4DrDJhlwGwDvAbUGlBnQL0BDQb4 DGg04AcCEDfMrb0nS2S/f2Fdk5a5EORfqpUqaLyCxtVoWJU6SlepBG9Gr1BFsjReZIzS MovEGxkl3tHLT5P1C1sSep3owtuC910u8e4lyPJdjAjdE4QDNXFt4lDiCxqgVipM1CZ+ lPhsRLN7E3voDJ2mk9RHT9Gj9B7qJ+gF6qe/pQ9Rfxm1p+iHtALaP6UfUxfwb+hJeog2 gS9QcE78qW02cQjvPJ2nI6yW5gKHXw/BykPDmX+2/XGidATZe4mxtJt28y38N7QFn0dg 8ed09JKea1D/S2rH++8Jdo5WsOdpFebTTRG6n/sT/552koqk7Xjl2Wg5KjJhyPUwBWgH RaTHEr9Dntgz/LipHkv8TrxLD7m+rd9GjJ28+ukgy6Y9iNs0vJk/QnVJwVBEDM9jDisx l734HMFq9OKzG+MeurRneoNoJf3OJCNbk3mUJr5rwJX4BLRdr54Q8TYz9n3aihE8NBmv c/ZEOfLm+kRLYkfix4njyAax+j8zs2IArb+mQ+wIPFhBt9BN/Jd4sROtjWjfRHPZGGaj x2H7Kn2UVGHuKslgiBwXV9I/ixlFc2/BS+NKXJusscO4MZ+nV+gliuv+PEaHKUqdiMNm 5PcS8sP3mfhawuj3kZ7DwvOLfZZRM3IPF3JwFubzXtK2wLQ39L1vfnfzJ/6JvX9CetHQ EVE0rgvJCtGrWEljN3QjGlsQj5VY2fP67hHrdwKr9iRyLSm7KSV9WV9b0X8WTRdeJGYm 9iD2/0w300beiweWu6DXfXGoVO3n4CYzuZjeY7NSkqGV75L3u7GHTtDDQwx20a3UMoQz rDE8fsPEIzTTzuHR8SGs2i8w3i58do/QqR/5fQJx2kkLqJb2Yx3fw/5oxR6OIOKnmYz1 eQ2n2EhXGHZPYVU2Sqskc5VH6oYMEZ8RrrRzBjOTmAWZn8rdZFcjd5OtITgrTaK3WT7y 40F6GznxFD2Ls2S14CKLjet/t0Z7aQNNMj/k9S6cc73n2pk11ddcfdWVM6ZPm1o1ZXKl OumKiRPGV4xTxrrl8rIxo12lJcWjipyFBfl5DnuuzZqTnZWZkZ5mkfA8X8mKteL6gG+t VlIfwr2wQXHImnX+5/OqNMp3uZU8eUZVcLLZS0tTNSpo0grxzEfe6qCWrg7vMl+TKhy/ d0N5nkv2aZYK/ClzwxFt4sKAW3G86UrJgzCrldYH3G6XxivwNwci/M0NyxHN4QcfAp0z RyN/QFA88UE1mFTtDqJcGNDKkk08io7gZD921OAwN+ezqKPHWlLfoFFhD1k/0Mgpun1e TXgJ0ybi0bjCgZpujao0Vvh7jRVozDkPUxo6hFA7Wz1CDHyRtYovsgYRjYQuxvRzI6Ju OSpHFwbyZrjcbt1pPIksCPTkZNcr9S3ZmAUemsGgnuwccHIEA8vS1sOss5he4VbfTDxx Z9oQvnzhrk/QWs17IISK0oC4QVJwUYKX5IOXighqRidCN73G9DG19Hotw3BCXqN5wxod kHsqB6MH8cS/IqRaI0okfEtAk8JwqoekCl9rsza6yb8ELDgBCrXKYrkb9EIsnuxrlaNo i74hlEoDVIfyI60tIZEmLKQ0QJZVH9jvHnThlSSw36flqZoN6radv3FJUV/xGlk0o9H9 snYUryKXSN2iD5KgeHKlHPUpGA3GfGvrxIpVpZZNz8Y5EX1xvAfCsta5Yi1ihr/wwWT+ u6MOzfqlG6uD9YGm2B0iwIIiobViKmuhaQHI0QMt+lQP6lNDvorHTkFCEdlPi6G9JOBr VXyIpzkgAgJ9qWK4rtutlahCMRr1CRfDEXgvIoO/Ejysww2jgT3hUhn8qde8zTpQs74G GNEbbgiaLLMDJBasg+YNNQSDYlLGAmgZFfvTpihyVBjNqNAKVYf7HyAbnFzZtDDgaxDZ iZ68PnDduWLXOdTxopdks2L0iVadE0ESkkVK0wIjC1pFfEQRajY2MKJmrjy6mv11q68W u16FbqPSGIpGGxW5MRqKhuOJzhWK7FCiPVZrtM0XkvWdz8D/uwMurfFgUHOEWtlMLLLI t0Y8wRcsWCqWp1FuDYODv9mKu9rlzoNpow9OjpHF5j5DxiPvxT6LOj7DjK04kVxyozhe 4jgVXJqjWmxTeLI4gH2wEkP4InqB/YHXXO4SO0UKVvjWLDID5HJjSD1hxLm3wOTCiNst 9tCBuJdWoKF1LggYbZlWuGLkrVKxdiEhGUxKnIuFpDMpSamHFKxVsXjN1nPiz+U0zvNU PkfzlHy5Rhzm8A5/cyLaYDPm+FW1lomI6ctdUB+QXFx0QY27JFHLVnFL8GijVF1RxASn ZNShyKcUzaFqafWBQZcnKDvycECyVDKYFkWaOk4pJ5k4RKnQoTGPxorEtiIcqggjDv1R 1RCmFGVfNGRm36XzQ1fRO9Ka2kfGLLBxxSQRBoeCfesy4pGXr4ip/lJku3GD09IqGsWm wtroEZsb1HLFzU7L/UwvMDlXfUDGMYRtu0CvyD65Vay6Joca9PMg6BLyJDueOBtqEOdf AImGLi4zv5HlCJu5J8wwNDUHkrWFgTtcO4OT8atYZVOcsnAnFd/JxFmiK04NY/rxO5u0 fBnEzZWy7FvTgAHRWFwJxiQ3ajdVIjdF6geUoLiTzIlEZZH8EUxLRwhaosEq5OuiAM5L fFXj1rxBV6raEgzOhJ2bhR2ooHs0CAtrTQtAnVX13+gUqGzCSTXeH8Bh29mARG8QWxjT HcSuGhQzFhMJpjyFx3esKTZ9XgKfg5MgX2pYQa52wkQwGhU2FwUUpHk06opiHmYb3/AM Z3hNRpyECibui7NOP3QBiv584FPcioh8sAFD3YK4J08p/Pb47RFelvIbmsvh7TI9wqHv KcLhy4nwisuK8MqUp0MiHIHPK0WEW0aOsMbHf0uMLw2p1wipd4SQrhoS0tXfHtLWlKPw ag3ca9VDuvZ7Cum6ywnpbZcV0vUpT4eEdAN8Xi9CunHkkP5fJG3bkAjf/u0R3pTyG062 w9tNeoQ3f08R3nI5Ed56WRHelvJ0SIS3w+dtIsI7/v8ivPOSCOOHTWa+eKFiVK1gWsEU /8mQFMokg4M3JHxDgA9+JsmgwmfTuYUEVb36+qt6MW2qO8+dV4GC4b3wG6/U+U1nGn1N XksnNPEDjH4lqvGeOtIl5MaIDD+0G7V0KiBaPPd6X0OtesOWlWsi4R9sCm+I6K/dRg9h yQEanTAvwUjVzT7/A0clgJIKZW5kc3RyZWFtCmVuZG9iago4NiAwIG9iago0NzQ5CmVu ZG9iago4NyAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3IgL0FzY2VudCA5Njcg L0NhcEhlaWdodCA3MjMgL0Rlc2NlbnQgLTIxMSAvRmxhZ3MgNAovRm9udEJCb3ggWy0x MDY3IC03MzcgMTY0MSAxMTYyXSAvRm9udE5hbWUgL1VKSEVEQStMdWNpZGFHcmFuZGUg L0l0YWxpY0FuZ2xlCjAgL1N0ZW1WIDEwMyAvQXZnV2lkdGggLTQ5MCAvTWF4V2lkdGgg MTY0MCAvU3RlbUggNzcgL1hIZWlnaHQgNTMwIC9Gb250RmlsZTIKODUgMCBSID4+CmVu ZG9iago4OCAwIG9iagpbIDAgXQplbmRvYmoKODkgMCBvYmoKPDwgL0xlbmd0aCA5MCAw IFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBXZDBbsMgDIbvPIWP3aEi 6RkhTZ0q5bB2WtYHIOBESAsghxzy9jMs7aQh+cD/+zM/lufurQs+g/ygaHvMMPrgCJe4 kkUYcPJBtCdw3ub9VjU7myQkw/22ZJy7MEZQSgDIT0aWTBscXl0c8KVoN3JIPkxwuJ/7 qvRrSt84Y8jQCK3B4cjj3k26mhlBVvTYOfZ93o5M/XV8bQmBEzHR/kay0eGSjEUyYUKh mkary0ULDO6ftQPDuHeeWq1KNXxq/8MpaPniM5JdiThN3UMNWgL4gM9VpZjKg7V+AG2a cBAKZW5kc3RyZWFtCmVuZG9iago5MCAwIG9iagoyMjMKZW5kb2JqCjIxIDAgb2JqCjw8 IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL1VKSEVEQStM dWNpZGFHcmFuZGUgL0ZvbnREZXNjcmlwdG9yCjg3IDAgUiAvV2lkdGhzIDg4IDAgUiAv Rmlyc3RDaGFyIDMzIC9MYXN0Q2hhciAzMyAvVG9Vbmljb2RlIDg5IDAgUiA+PgplbmRv YmoKOTEgMCBvYmoKPDwgL0xlbmd0aCA5MiAwIFIgL0xlbmd0aDEgMTI2NjQgL0ZpbHRl ciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBvXoLfFTV1e9e+5wz78eZycxkkknITIYA MmBCQoBAKiNJIBKt4WkCRhJJMCBvkSqoRGIEA1IoDFa/r1fsy768nASlCWpNFdFabdEi 0Goppbbaaq74qlTJyf3vM5MIuer1/r5+98ysvfZ7r71ee5+9z7q1NzcxJ2thEqte0LB6 CTOe/D2M0RuLVzSsTqazzgM/vXj9unAybStgTJm0ZPUNK5JpdzNjzqIblt+aap/9IWOe cHNTQ2OynIn2E5qRkUzTeODhzSvW3ZJMZ/0ncP3yVYtT5dk9SBeuaLglNT57HenwyoYV TcB48jEeG7N61U3rjCTL9wHPXb22KVWfahiznGSE3CBbwdzsamZGSmUFbCNjcruzCPMl o5xYa8/KQ+8scpd+RCGL0d2j254W9LIe5cm/fVx9fqPztHUB6lqN+qIA/Zqf0KsZc7GP qz+e4jw9WCJKxRPsYmtiXewGQB1gTuzyXHY1T0O9RQhXATYBvgl4EKAwxr1MBYQBBQAN oHAvygIsZOCM/h56PX6z1V7yp9OB9KxjryLYeFsgtPG2jJdfQXz9NxCsWI1g+SoEN64M hBatXLVy00qJ3Ug3rty0NnPdzT5/1g3LECxZiqCp2Rda1byp+ZvNEmtSm8JNWtPpJqWn iZqa29ZkZtwU2FCWEbkVwHk338sTj03J0ft5rIv4AaB4F7GDNlvJ2YQ5drmLT+GT2RSW w8M8h5lYjI+gPnA41t/Dszs9npIneTbPSmVkdeYXlHSjJKszIzMVcauokjXYJrMzLc0o yex0ulCSgRLRa4D6Ok0x2+UFdJwRvUqvMM5idCyFf5fCL6fw0RR+iZ4z6r2Ywr9O4ReA QSP9KoWfT+Ej9FynHLNfbqVnIS87ckMA3n+UDndOKAFdxxHJiaQivvRk5IDVVeJ+gu5k OQBOsc69Enh1SecugUYe2GURLMs7YLWVAEcP2B0G7kS6i0KdiUhOF0U6d+UABZNIPgjW fgHHu/p74lP+5k0r2bzbEtuakGO7dlOM7aAdCVtsV0KK7U7w2LcThTkP3kdH957ee3av tDdBsXgiI1QST4DZXXxl551KrIsv73xKiQlhXH8Awmx5nFcyQip0YMRI0AccCBi40+E0 BOLvDOemIunBkm4e4v5OCTPj6Z0BpNHU12l1oMBH5zsNLTl/AGRiyuc7obrddIru6xwW QfpUpy+j5HIbPU1PGdL5ZQr30FNoyC4fTX9kKoCzMMICI9ZCv4DcH6cuo8WhFO5O4Z+n 8MEUfiyFO5O4/zR1dTpcoOEAdWAI++PUgckeJW1AqtqAVLXOlFS1Tkj1SWqlzczDcmCB m0UPT1AzLWWFkHR65yYTxDu6s02gUZ1bZaARnXcJNPzAnZjHIcoFybkHUAGTzujMGCa4 hEjQYBciLg80ICeutkZy+s6Dl5+CsZ+2QGv6ew6c8/tLDOzxChx3nHM6S/75kRT7qMVi VPigsMio8MHw4UYF+weBzJKCjnhHdYdkNOjwBEvib4zNL1HfINFTZ+Ywo+KETtVTou1X YvvblJj6l+q/7PyLtL0NSnomI6MkfGbqmQfP7D/z1JnTZ0y3b0LuHW53yR2pMVsmTzHG bEmN3TJ6TDIdMro+0BJN0uJr8QVLWtp4bGebHLsTvWxC/4Ko0JZp1SVb2myxVjFgW15e SbwtJwcBjOHyW7nEZa4wB31M5+hfwB/SR/RP5oB3ET47hz5mUwHVAIm76SPuYU5uRRs7 sInOcQuwm5VyK8AEkFgp6pbSh4AHaR89hD530x5KAO+kXfQt4J8CP8Kc9AOUPwz8XZR/ H/inaPMDwHdFW8BuwE7AJJoC559DU6iUvob2+VRA44DH0Fi6FHgG8BVofznKy4AvQ3kc eAbaXg64DDAFkA8YE99dGproD07w+4v93vF+d5HfUei3jvObCvxSvp9d6h8x0jVqpHt0 zDUm5s6NuoZH3cNyXOEct1v1OKw2u8NktjgkWXEw4g4meXNypKulp6R+Sc5xT3VXu6UQ ZTuD5kynX013emWfc0zp6NJRpSNKh5fmloZLh5WGSoOl/lJvqbvUWmoqlUpZaXURad4q VjV3mpZGwHOmaUWxqi4pPFsrjFVp1uqFNR1EO2qRq/GtWAvmavLWLg7kLVuwsAaaLorb Qt1QfqZV1bfdW9vB2TSNtmrROTUCxWfVaOGtXSqbW9PBaVptba02saoacTatNpatNVah Wkt2rVYoIjuza1mVNnmWFopOi33ec9NNF+Z2jBpRoY2uaNDGVNSXX1jwf48bHdHn1MMA xhgI1g0tvmjwzxI33fS5NRmaJ+n9P4oHxvisD1F36HCxGJXVhGoFxGJaUItDPKAqxYML WNFFJ8IVy8q76GQS/T6J/pBEryXR6wIZJK3rsArhXjZ7WpVmmQ2oXqhlRpF4HokJSDii 00wxloG93/MsmtzoXBzKM0UpY/1/NMI3jfA1xvSb+99izDQRsRdF3n/lEXs0AfJ/pRPR 9lE2H5Re2f8TxLtZHeIz+r/3xZ3Cdt+n8eSgYvYKbPcjGoWN4Aj2PLaRYs59gCeQY2e/ TvXRzf7OHmbPf3GPooR+eGE5/MUo0HKErWIfX5hvxB9BKOCz587Pol8S28cGdtEPJWtJ Y7lXamdPsQMswU4NadmNkfewXVi4rOw9ysMSto2eoDT2BnsZe+dt/OfS3ezHaNM9pJ1I nsJvK1oPPnQJ+5ha2OXsBHbg49gBClETe5GwbWZvY6avs7fZZvYUZQ3yLNVSyFc8MpMf SWpUMv3fEG4Er59li796zzSKJAp+UX1YRh7sQ0qWfzaPZFpOcbsfNgF9M+zDiE1JlkMf VkIHJmKMLApA1ywksXPsHXD/BLSim+1kd7FbhDyNepeiXhg8VUkmzv4Frp5lv2APDNTC SsNYzNDyV/t/QnlsJNLPDoz05VhZIvg+YM8WBjpe/szmlFdTdp608A8H+tLfM2IH2UH2 CTvN3mW/IZUdpO2g7Fn2NPRtO6S+HRRuZNezD4h0Jj2NeVXj9yWPkqWImVz8bGR7MHth LatAyyl6CSN93rMH+jhEx03V9OoQS2Lsl7DjfejvwudnFyZS8T3SLexDNvOikjcwn5f5 z9k22M1mttIoWyXvk7sxyujkLx6ffUVl6ZTJJZMmTigeX1Q4riD/0rFjYqMvGTVyRN7w aG4knDMsOyuUmRFMD/h9aV6P6nY5HXab1WI2KbLEiY2hoBYsq6lYpmWU1cMVl0fVsOb4 +tmr8jXmDUWinnBRfu3YVC1NiWksrUrzYUVl8Um1mik2tMrXNSlPfT+CxleFwhWanId/ dGZDozZqdk0kqh4PDZbXolsts6wmEglpPA//K1CE/8yGcKOmViMfBUbOFRqrrhHQ1X9m EjLZpEgtwtk12rCBJBb6zyES3qS/ZwiZX6d2tcORUVauMV8Hc5zRmF9UOzuJaaxUG4WN R56KmNEby9fI975GaRr5r8KULh5CNDs96XN4UNG4LFrRuBQcbaz/jKdnkxyNhNvD7bNr PEWhSMQgGgvhrJoOu60sWtZkwyywJUEG67DZkWMXGRDL6g5yXEZGhDsqJmM/Y3GCfV5B boWAZVp8Wz0i0XLwDSVpn5Vgc7z9wiKGZslKDNWMGBljaqYyzZwkIrxUizdobFu4Y0xP +3bsp66vjzkao40N19ZoUgOI6mBSXkXzXC2rqnoBskAEoL45LMRdbgRCeOGK5nA70qJu PcJoOZpenN/Y3FQv1ITqo+Uos5bVbIn0hLDhq9lSoXlimhPNnRveCEntFcGlYZFsb98S 1vZho3dBaUTUgRIEx44Jt1dEMRo6q1g2TUgsf1BshjZe0WgIJ76tIay1XL8MPMO/YfuA /kfaVc3xzwikA/mgpbAOwWABjfXLxFSWoaUMFG7f1mRMdbsxNeir2PQIEA2h/WweWi+o qWiOVoCfqQHBELSX8oa2jUS0jJho2N5eIUhsaAT1gjP4Z2BDBjKSCdhEKEagp0yLzzUQ m2vIACPGG8prU1mpCiiRIQctXl9eWysmlRSAZs7bolwaDbeLTs15mi+mRg6jrGfsmKrZ NRXlQjtRk5fVfK03GOpFHNvogWwKok57fq9gkiiZE62aldSCZsEfEdTPTRowuJaSPKqm 6hu9vhQMvYS206PT69vbp0fD09vr2xu6+luuj4bVaHuHw9G+uqI+bFg+If/QtpA2fXut ptY302QIWejbdGwg02YtFOKZHm5uQA7+U6ORSaGIB10n68BzfH5xys6g8dB7YWft6juY sQMeKRSeLtxLF7xCSFMnCTMFJfNqYAeLMURFoxHAPvASwUPCUqTavIqlc1IMCkUwpKEw wu/NSuWik0hE2NC2rji7HgmtZVZNMh1m14c6WTw/BtnVi5KegRL/PFHSMlAy2Lw+ClkF xUuMoRNfpNPw54P63O6JesMlwpmDOvyvaNR65mKO5yZpFnDMEHdaWY0U4qIKYjwkiZgt hiWhVEuPGQ0FT+Al29Vo+GhUU2OaUlbTEyqtDaseOEgaVIZUj0JN1aPRX5FwosynalSq UUCYFYNTBRvh9NMnoXCwYbiivT6lfRfOD1VF7cbmQTtKzgKGKyYJNqhR2G0oyQ+PNyqm +qLQ9uQCpyl504VRQTYGx2bWai6x2Gmud4wAkwuV1YThhmC2s4xIuCLcLKSuhevLDX9Q GxLlA9ld/afry4X/q4GioUoopd/QcrAtZRMpNlTNrRmIza65PbShdixOb8dUdTErVlLx xttF/W1drDy7G+fB0qLrUDx3TDhcsbQcAyIxbwwyRkcQmz8GuilUvyZaK1aSKxrbw0L5 GzEtA6Ogqb02H/o6pwb+Ei/CES1eGxqMNtXWTkY/14h+0ATV22vRw7JUD8BGVn4fKtWM qYKnGlFdA2fbUg5FLxcmjOn2wKp6xIzFRGoHKQXFty8NpmheAJprR6N8YbIX6GoLuqht bxd9zqmJQs3b20PtmEcqjRf+oRnxVEYXE00w8YouaqlGW6CosT+oiEaigvO15RjqWvB9 wEvhjPzLOXzdIN1ouQjUXmdwuP7fxOGGr8Lh678ShxcPUnoRhxtB82LB4abP57DGR3wJ jy9kaTzJ0vjnsHTJRSy94ctZ2jxIKKhaCvKaDZYu+zex9MavwtLlX4mlKwYpvYilK0Hz CsHSVZ/P0v8OpV19EYfXfDmH1w7SDSJvArVrDQ6v+zdx+OavwuH1X4nD3xik9CIO3wKa vyE4fOv/Pw5vuIDDuPIhxnEio8xgS5QZFAbeDXgBUA/QATcAPgTsAGymT9hS5QCrM9Ww bo43TsBi5SpWJ2tsPn+AdZufZt14k+xWsth86TJ2Jd7TkneADKfLJpwHMRZm85D35Q/H rZGMOzsT7hQtWAVszI72Qx8nzof/Xx43Kl/8Buth3os6SGM+5sd94MCTnopMZpPZHayH ZtJJXsp/JI2Wdsjz5TOKS9mgHFfOmcKmdjMzZ5n/h/kdS6VlJ1rhbRJcFdeOEuaAxW0O 7igt+VjkABa1i7GjAJFGXHodcWAZWAJWXmeHjMO3+Wgkq4dwF2NiIs7VgnERT8STh4BQ 43xcajnforBPWVxuQa0l/a/Jf1Z6wa00VhTPKbJREadSC5XK5EiwDDVhkl2tZ61k9Xtb JZ96vFc9VdfLpvZO7R1XUIdHyWUelUXCIswLe9QIgH/nvP4sztgxI/qa/ox+nsx6n96X h11MLdXRz/R5+g/17+jzu3k1r+7r6NuP8+gwzjHuBx1Wds1jJjUjtxI3JW/F7d5gpRl3 Al45oYhLiryc3Eol7g9WKibZYiZZNrfV8528B9cJXOUaP83PcoXn163pPXLkJfUlNvWP sVjv1L6ecQWxWKQ44lGK8zwRP4VplH6Sz6JRj8jlMzv3fNIjTvCI7QYN60FDBnsyfvfd PqpKo9fSyKrQ7xVaotA0mQrlzfL7slQszZP+Kn0kyX6ex4u5NF2Zr/CvBa4K8EBBIKOy wkSPmV418aUmKjEtNd1vkpSAP7BDVnyyrMyUKSArfjl9b4bXkcixk92acMnJrFYyt3ri weogD4bsYAplqsfrjgCO9aq96YVsat/xOnA+vZDqtshqbMvth8cVUN2aujWxNXUMwlgj /mvqioonTphKrHh8JNdcPKGoUPb7TG4ymSP+3eo3br+VYvq5750487t3KKv9fza+PJLv +EfgwRU3kuW5t1b+fu6fHr/z2PbqH+38B1gCnrwA/dip/C+Ww7ridy7NoCVBqg1SVdbC LJ5pHm2ebJYKnGTyT/Bzq8OV5RrjkhyBwIjAhIAkZZEje3n2bdnbs2W35EpzcVWyJmxx 3zBborCAJUhKDMvwJgo85HEnfLKzNd3Uujp0NsRDEWvGKtsmG7d5wrihqccpF62mFhzw hcGKNceP1BUWItJ7DHpoMKTveG+MZQbVq6CTtOi6uuvAiuvqmEDimVgcKCqcUKxGosUT w57x0QGmqIrs8cmR3Bde/2bbQ/qchVfRt859r/uZk38lSe+m9foxXX/Nfmre1jWUh02m +VdzXih74of6J8vn60eeewv2yuqhL8/gbNGGbzW2x6+90bnRyZfY19u5IlOTTBny/TKX 7U77Dkn2SZJsIbNkp70Oh8y8TlmyKDbZOc22PYdtYryaUTU7ipNCiTH7Ion+hIsivhoz lgokTZIkqHTdmqIigXrfKFR7jrCpRVO9Jfm9PYU9as8WZVAZUIHVwdaLKeIp8kc9QFJa 31X8YXI/8kjfRHqRtp2SFp1/6JR+M1/Kyw0Z65DxVswjwO6J18LwS83XmvlkL53wvenj NepJ9S1VmuKp8vCJygyFmwtszkqbJeF221liKl0NM5cS/gzXXrvkhAS9Z73cG3S5d9gK cMtEcaqGBFtIERedj8JyKV09HoMU+4Re9x4WrkQI0VOS33cEZmpIjC4QWq4ZFhuRwswv ZKU/ecemhD5xwgRpdt/dbvR+g35Ef3ed6cQV991Jl1n5m//Qf6l/8vbvPxHyuQHz+hV0 188i7JvxxkwHzfQv8PPpNJ/49Mz5mXy8jTZY2618ZnBBkM8MLwjzS5wQEt3vI8Xn9+X5 JJaRcHPi3JWTsMAZToWypsFcr/Ys8qzySJ5A21mFlHhGVqUSzWKt9lz1eN+zYn69h+sG rBVSWtOLo0VMyniEodbVEewSU2JRw3NGCtP9I6K5nMYjNPl9QmHpP7b9/gjJ+rF39Hf0 F6iBpu499cK+zsPc1LZ2ReJb61e2Sp4f6Z8+93f9BN1D19Gd9NMJJ+fpp/sevk/bt/4/ fvGQIVucAstvQbZ2tiu+aomV/NY8a4V1nrXJqrilHClfkoISmeQJ8nRZusJWa+Nma7p1 pFXaYKVD1j9YebF0s8T/zqmYk9V2q+0em8S8FmWvSZKxJlnOWiSLkykFSlypVlYrimK/ fRPDmW/Y0OT8urreI3Uq7BW86Jk6wAJ4KcNb1UUuozSCW/ZbyE9F/o0n6NrzuvSh/kf9 4MPnaTJ9evasvqtvxXGxIu6ALI9ClmlsGBtNlvjy9exuxjGhJU5a6qGlEs3MW5D3QJ5U EZ0X5Qkz7bVS7BL66SWUyKbdw2j+MMrBoa9v2OhhtmE72WgfY6OHsRyfbbRJGZ5wZ2Qk FBmpYaMVh5cF1EA4IIlgZ2BfQA6IpWdWTrQycI/F4c7KycrPkkTwYNb+LDkrjoKse+JY y+pxS+5lI+tHrh4psZHqyJ0jpZHtZx3kGOOOrIpsikg5kQcjPNLODBuJCf2vW5MKj9X1 wirUYyL0eNNLjCUWeIth2arrsLrFBW9vKM+augFdqqMRxeOHFxXidNoMLy9Hc4cXq4Sz 7JQaSSldQsZIOnicXK/95uNPqFR/8ZN39df48j0bGutuWmt76KHbVuxe/E0p497nfvbq wW8f3v+DT545+/qjsFnPTa3zb1hwReUK/Q93J9btXV9z5fJZUCvY1mbI4wzWSmFbPz7w sJmwPp+O3+j0VNZiyeO1mSR507xl3jnem7ytXlNFcF6wKSjNzKSy8Jzw4rB0s7vNzSe7 6UQ22eWQHJMlU0bCYvG5WOJqLHxSwpeRA0PLMrXGPcQ8Zz3cE036EokCbfgAyC78STC7 UticYW9g5Jq+Zwf9iXCOQ6wullwKvMWmaC5WR1aUtL3cNMPekkw7+uT39//63t8+o/+T xv6DvDRR/5b+i3uobe3yPbvWr9xsP34VRT/9MbmOvEmX6Bv0H+stepVc8EDnd9d/p2cf +LIUi+Yu3NCIPdzYeFDer7hpP/Oa9ism7Ez2U9xipf2FBTEy1iv4bnVgN1WEXRoBlorN ibhF0U9KuSI07Liu/zWl3uD35vg1CyXhpeaZyWom8ng83OnOdnNH0JteGcC6Y6ImFzV5 6RbzVjNnu1Q/+dN28TTbLrtzl0W2M7VVicNMGba2BVh0ZKvE0gPKch6joHoE62ddJpZS Fa4ZC6vhnJOWC91Luue6PFNk0G3hmoRj71dUOFGpP6Ef1/foy+h+2vj+u/p7P/+HTp4P /nBqSj09QKtoPe0ueW+RfkJ/V/9QP2ZcyHBxY6mch3+ywLKXxSuvt9Mqlarl1XKLvFOW F5pprkQLTYRvSLymTtPTJmmFm5z2bDt3qtkqt8rWXSwtbRdJzlbFuonF/coq7mM3ctzG Gwwe5K7YFwi3I5wPHjA7OYO8okKvZ/zISylG3fx2qqGV+m369/RX/vbBu/XTDnUeUp7X d+s/ghLc+Ao5yXvs3gZxy0TsWWwg9+De3cxy4h7lPibfR0wyKY+uxlebnOXX9f2xB6qY jx1JGtavKNbiZ+m3J0/qJ81zHvnEnNxvLkYfhUYf2KjPiR1Ct7KxaYcHPYQXAbORUIzd vDS4m4eO+Is8UT8v1Mdd2CFndf1vygn058L3lbfHZ81Xqc1NO9Ko1k9b/FQjkx2fhsV4 FZdt6aOwiMt2n324XYJHV73cqTB/kAJ7pYDb7klYVQezB1mby9dqime6mnmGaclnTO07 islN7S0sNCC56WKL6mKpHRfVRYSJ8WLVW1SYLtTacEcqdERavvajI2f6T/zsXpjPiRs3 rNh88q5bfvsW5erko8qtvPpfr0qxW17p0PeL62xwcj7mNFFeDFX1s/viwz34esc5y/my 88/O95xKm0wJ+QcyzzSRKegNVM6Qr5E5XhzOxjNhCjMl2mAjx31uDz3l+S0ciMflY99W hTMPu9MqVde3ecCXsKiq20tWydtqd3hgGHaYAqYqTAFmgNW8F5ojZAlLiPXiky/xdiEM Yk0MX5GK7faaPJNYxeFPoEoRb6RwIkXUaK488XdP6r360xR9971TfdcMoymJx/vmUPtj XXmX4VMlVz98y1H95/qRCvpP8bECCVugP0N+EsuKu5gfCtWGtzSFtQ36C3B9XIFwFN00 yhT716uCR0Y7cwA8CrGfxW0BK0mmNBO3wkEejTdaHZVv2c/Z+RS5Sn5NfluW11nvsu6x SiLgLj/zWzx7bVJwr6KS28J8rjanFMKo+CrKzcgm+ZnP2TTF1+aPb/KT2z/V/5Rf2ucn DcT5UZyV7TeIA4vWrK1bY5hczDA1Ee2DcwPDhKoUHe0tmnoU72Hg2xrw7TosYZiHH7ug QPqEonAG9qliZ46pGaibsjafvW2f94E/0Fj9jc1td+hvtLbeIc/87VsbVr6lP3r+7/zg Mz19M/jBw7/sm5HigbzH0JOGbmbuPxm3Yebc7XVzyS0YYfelV3LJK3FVNt4ss5F2S05j 3jZma7NyFdP2Wpvx5VrTgKaLCbD8HkPVY5hjbFEdZhAbINz/GbWjdv1190/0k7fdu1nQ eOih8+f4U48/13fVoA4/C9rs2GFfG5/sspBLpnuc9zs59j0uN7nSyOYkye4gux1bZnIp noRJxet3wNVq9bVK8aB1KU+XLjDAgTUj6dUWJbdTeBlP+jQjzCv0DOwC+N16v/4yjSMT mWmc/hv9XP+W9TdvuTsD3zSYyUbj9Rf1c/r7+m+6acuBo0cfO/BKUq+u7H+Tv6vkwTNf HS+0WVgizZPgAZdiVxIWt9Ntku1ui5zmbquXe2SOUwc5DL+9E1fsmnxatsgwFGzyxRJ3 RMX7Si9iYkVRXxpXICwmg6LFRcV5fvGW4oNr4O8u+5q+aeNGGvX22z8YUWzKoWY+rbs7 97Xuvr++gGMbLojCnfEk1piMDQmDSEugNXkekw4fmMEyYRNZLJuNwFcWl0GrZ7BKfPNS zWax2ewaoz3hPAcrIR4TWrBpc+ZdOfPq2JU3L17a2DBjbcPKxqax01YtFyMma4mazYB1 gLsAewDfBzwKOAw4BngD8CEayAAfYDhgPKAcMBfQCFgHuAuwB/B9wKOAw4Bj/akHfbDB OGFHfXG6YEh63JB04ZB00ZD0+CHp4iHpCUPS+ErsInomDUmXDElPHpIuG5IuH5JeOCSN L78uGq9xSLppSHr5kPSKIWlju3EBP1cNKYc8GPvfkB7TKwplbmRzdHJlYW0KZW5kb2Jq CjkyIDAgb2JqCjc4MTIKZW5kb2JqCjkzIDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3Jp cHRvciAvQXNjZW50IDk2NyAvQ2FwSGVpZ2h0IDcyMyAvRGVzY2VudCAtMjExIC9GbGFn cyAzMgovRm9udEJCb3ggWy0xMDg2IC00NDAgMTczNCAxMTY5XSAvRm9udE5hbWUgL0JT VUxKTytMdWNpZGFHcmFuZGUtQm9sZCAvSXRhbGljQW5nbGUKMCAvU3RlbVYgMTUwIC9B dmdXaWR0aCAtNTIzIC9NYXhXaWR0aCAxNzUwIC9TdGVtSCAxMDAgL1hIZWlnaHQgNTM2 IC9Gb250RmlsZTIKOTEgMCBSID4+CmVuZG9iago5NCAwIG9iagpbIDMzMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2NjAgNjYwIDY2MCA2NjAgNjYwIDY2MCA2NjAg NjYwIDY2MCA2NjAKMjQ3IDAgMCAwIDAgMCAwIDAgMCA3MTIgNzkzIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMzcxCjAgMzcxIDAgMCAwIDAg MCAwIDY2MyA1ODYgMCAwIDAgMCAwIDAgMzI1IDk3MCA2NTcgNjM5IDAgMCAwIDAgNDA1 IF0KZW5kb2JqCjIyIDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlw ZSAvQmFzZUZvbnQgL0JTVUxKTytMdWNpZGFHcmFuZGUtQm9sZCAvRm9udERlc2NyaXB0 b3IKOTMgMCBSIC9XaWR0aHMgOTQgMCBSIC9GaXJzdENoYXIgMzIgL0xhc3RDaGFyIDEx NiAvRW5jb2RpbmcgL01hY1JvbWFuRW5jb2RpbmcKPj4KZW5kb2JqCjk1IDAgb2JqCjw8 IC9MZW5ndGggOTYgMCBSIC9MZW5ndGgxIDExNDI4IC9GaWx0ZXIgL0ZsYXRlRGVjb2Rl ID4+CnN0cmVhbQp4AZ16C3hU1bX/2vuceWYyMxkmyeQ5Z5hkhjAJCSEPHpGcCUkEIxAg YAZJmQCxUBWCBLXUQqRSMfgIvl+ViIpUbDmZoE4EStRrax8WrK3VPq75WqyPmq+29XUp mbm/fSag9Prd/3f/J1l77b3X+u299tpr77PPTnqu2dpFNuolidS1V3d2k/4ou8FuX3tt j5IqTyolMq28ovvrV6fKuZAbfvv1q755RarsqyBKc6/v6lyXKtNZ8Jr1qEiVWRV40fqr e65PlZUo+JSrNq2dkPs8KGdd3Xn9RP/0B5SVjZ1Xd4HjKb0ByZTuTVt69CKVNoLP7L6m a0KftRNl/OrCsp2IQctK/6A6uoOMxMlJ5bQcI6njL5IBZSE3OFb9cOHNL6921H1izjHr ze//c12ByLz80JrlZ86cHXeSuQi6Fl1fCIAzzU0sonlOOnPmzDZnqichOfdYB9t6w+nS 03QYhI6RKqABEBwtPT1kSq9U4+Aut85jWaHK4eSI9HRs9gy9vuzuyt5j0iFaTTNQfSi2 XFQfGlIbhfqhoRlzUrx8us5j5pTY5K70hnMBKwdxckzkFoPfAdoHOgEywqBD9DYoCZKk g9L+WLMXDT+Bhhxht/QEhqgiPQlKgiRY/wTG8gT9baJGhlWPDVlsovvHdFSe9BhQDqRO UC/oMOgkyECbkO4DJUEScvsh209c2i89GnN6nWGr9AjtAHHpQXIwRl60fv+QU/fNA0OO SZVq2CndQ60gTpq0kEZAHM3uBWwvcai3xMqm6y5sGbLaK53Q3wOj98CQPehyACnTyypy Qn/P0KQsYfx3Yo4MHfetWEVVKjPk9FS2wgvXE5O6pI3kJ6+0HbwQfC14AfgaaR2l63aq Qw5nZS/6q4d6vZRJJRCHpSyqBG+UcilPV9sas6f62RqbMrUSI54neXQVh5ROVVA1S6ZY pVc5Kqm683cPWdKEfbtjzszK49IuyURuaPVCK9vrOC5ZMcdWfSRtQ5b0yv6wTWrDMNvg Fi9sZPCySFVpYwwNhTOkJimfsiC7UiqgTPBmqVDnT0qPUjPK3xsK5HtHjkp36ag7RaPo fm4qtOYOpdsrR8IWaS6kmnQ7JuB2vfP+ocDMSgoHpClUAeLw8Q7kdiDnlPqQ68Os9WGm +jBTfTCqD9FH0i2Q3AKdcmkbdUvXUT9oH/IirDJjcKhYDJmxoimVw1KO5IFjnEfhSoba 3CGLXVjmibkm6WqeIZu9sv64tIUWgziG3DOU7ancdFSaqg+ldMiTJwDdMYTrcSk7NTVo KUtMyXEpH44QjimQCmOZXi3sRVkEspcY/xk/JZzEX+e/EdPNT6Is+M8n+KsT/Jcpnhzh p1KLgv9K8NFwPn8Hja3mf6R9yHF+lL9EFWjgdzwuZp+/xYepHvxNlNeBD4PPAH8+5nvF G+fxITDY/lAsPUsMlr8UC5VPZLzFE5nsvImMK6syXMxf5C9QPpr4LXgR+At8hCaDnwD3 gI/wHnoF/BleTXPAj0zw/+DHRIjz5/izNBN8KGYXJmgxk2CHY0bBfhijVKm13HuM/5Af olyo/iAWyIXw4FCgyOs4ivYYf4L3xAq8rrCVP8ra2cdQGqA3BScX3x+rFY30x44p3mHe z/tVT61arJapB6SK4oqyigOSUqyUKbXKASXs5LdjA9nHsX75HqS1pHBED0gF9fNbYnKt Fh7HmMS4OPUiHdBzUaTdeo6QOvWckH6k5+r5LloM4mhjO2gHqBd0I8lIt4G+BboB9G29 pge5raDrsJt0A9ENRDcQ3TqiG4huILqB6NYRouduILp1RBSIKBBRIKI6IgpEFIgoEFEd IeyNAhHVEa1AtALRCkSrjmgFohWIViBadUQrEK1AtOoIFQgVCBUIVUeoQKhAqECoOkIF QgVC1REVQFQAUQFEhY6oAKICiAogKnREBRAVQFToCAUIBQgFCEVHKEAoQChAKDpCAUIB QtERTiCcQDiBcOoIJxBOIJxAOHWEEwgnEE4dMQrEKBCjQIzqiFEgRoEYBWJUR4wCMQrE KL9uUDoVfhmQU4CcAuSUDjkFyClATgFySoecAuQUIKcmhi4cIQJmBNgRYEeAHdGxI8CO ADsC7IiOHYHmCLAjOlYDQgNCA0LTERoQGhAaEJqO0IDQgNB0xAAQA0AMADGgIwaAGABi AIgBHTEAxAAQAzqiH4h+IPqB6NcR/UD0A9EPRL+O6AeiH4h+HfF/nhp+I2s3413Le1mJ znfQhzrfTm/q/Ns0qPMb6IDOv0U7db6NanV+HQV0jqnWeQ95zSzmrXWEs7AFLAatBm0C 7QMdBp0AmfTcSeTeBiV5tTpZdpgWm/aZDptOmAyHTaMm7jAuNu4zHjaeMBoOG0eNXAnn 8XR9H8XWQncAx2gH0r+B8BJBWq/n6nkV+q3CPluNnypepWaMKX+byk5OZSemssNT2R1T WdjCL2ayvtMpVMvhANau2gJzvW+CagPBudiZbn/2w2xvLFDjjbNjKVaihlD8EDQIOgDa CaoFVYLKQMUgL6g2MBWwdnXyRJPHwIMgH0gB1VJWFo6JrgyzOszT2YGhl9PJIvoJTgHu aCxYARaPBReDPRcLrvGGLexZCopTEXsGi+oQ+OGY9zTEP0ixp2PeoygdjHmrwDpiwWlg l8eCr3rD6Ww5eWUBbZvgyzDhorw05l0BtSUxbwlYKBYMCO2p6KgY0hKcqE+DI6+ji1I9 +WPeOdCeHPPOEtpmCoqJZ0Yq080zIC/K0hAM+tswa5eZmuYd897l/RD2/hWORXi8pcRl sJPFcbZCtXqPlT0C5bA3FrYKfbwfBie4Jvgz3gPFt3gfQlus+FnvA95p3tvL4mZU3wa7 b9G7iHl3KnF+SJ3k7fVWeHvKTnu3eC/xdnqXejuKUR/zrvIeE2ZShLXzQ896W9HgAoyi OOa9uBi2wMRm7ze9qjfonaUcE/6lmaJrRHLZMeEBqkz1Xgr/Ti1G7zHv8to4y1Cnmj4y 9ZsuNzWY5pj8psmmQlOByW12mZ1mu9lmtprNZqNZNnMzmd3x5KgaEt8JbqP+uWCURUHW 804u8kiQEmdmTpeQNklq4S3LGliLNrKWWtYo2qfL/HFmXbJSM/gbmOZqoZa2Bm1mqCVu Si7VakMtmqn18vZBxm6PoFbju+OM2trjLCmqduVprnkQ0q7b8oaJsZxdt0Ui5Mm6tt5T 75qbMau58SuSqF4ZbQx98Xi+nC3Q7m1Z1q49VRDRKkUmWRBp0W5cpqxqH+YOnt7UOMzt gkXah+Vu7mhaKurl7sYI1E7raohmO9QoKBjUzA2kCDXsJw1CDXOU0gsADj2fYNCzplNA 1wtY03U9mQm9wTeVpsZBBQl0ione1HXeLKYv6SBigG0cDCCBll9h7UKLtfsV3bASvSGv FyplSKDCcN7TG/IyvTOt/AuV4gmV6vMq1XpfUsoevRmRoBn3lHM67inQ+cKR/3+5roYQ G5q+dftLTV3+pqi/qQsU1fZcu96j9a5RlMHtW4VA0aRAdM3a9YJ3dmlb/V2N2nZ/ozI4 Xcf9m/glIZ7ubxykl5ra2gdfUrsaY9PV6U3+zsbIUH1de/iCvm4531d73Vf0VScaaxd9 1eu4f+srLMT1oq+w6Css+qpX6/W+mjaIuG9tHzRTQ2Qe5lXwIZ5mRQxH83yRhixn91wR 0MNzfJ7tec/LxA5SWiii2fwNWjpIiMrCZWEhwjoTIjuqHRMiz/Y5vrzn2cEJkRPVGf4G OjcRJPAtWvWSFs23bGW7CBVNhQu+as62iEcXe6hpQyN+Ue7RqWdLz7kWBSeh+T+fnq96 tm7duqUHydbQFqIWbeqyFq1mCSwxmdBVtDGCumnn6iRJrxu0WJriyREIQzCC9YjuRC7E QvCgaiUjmfiAccDExVdEz1BuQeWm4zg37ADhc5hfF8NVghBdNzS5GF9LUCmvTnF8ropy LNdXiR6GagEVvDjF1YwyZPqL+8v6aweKB8oGao2QPnsAld4D4lUaKz8gUU9oyzlnINsT gbNhlujv0Vh+gd7xgMiEQpHQFqb765z+F1yvR/ELx2KM+rNFb174W/cwUpGF04UU85Hq fasoiSeV0bHwsw5CLbRSJb1KJF88KOGq6HnK1+lJypcD+Mai5OlzlNiQPC1kgvMPsJPj BknQxBOjp+m3bApTaIidoWz6nOWw6bQA0fkZvicO0zjdg8/7NrqXuagIX6PLaQGToROi W9lDyWuT79NFdCftTz7HdiafgvwO+jF9Dgv+E2/MWloE/eXURe9L71Ak+SCZ6WZKozm0 lGVRJ72Bn09gx110N/2I3ZD8HL26aSfaq6MwhZMvJM/SVLpV7je8aXmG9tJRZkyuTW7A CWky9fFQ8o3k2xSgCD1GT8OmEBuR55OPrqRddD/LkX6M3D30OCWYjXdI8wwn0NMCWkEb 6Trqo6foZ8zFWg1vGj5Kfiv5LqJwEk2BTRvofVbNFvInZFtybvJ3dDkN0ysYr/gZkS+X nzRcnqhPfi/5Ir6+n2NWdoy9YKg03D5+Y/LR5A9xXxmg6fDIIvSzhr5DL9BP6e/0D74j uYPm0zL0/DIrYAoLwONv8By+nW+XXqdpGG0HrN1K+0ijGD1PR+k4fPN7GqV3mJvlsUvY GraX/YPb+Dp+UnpIOiL9Wmby9+FvPxXDRz30BD1Lv6BX6SQzoP0K1sq+wTax+9j32CjX +If8M9ksf0f+lzxuCCRGE/9KLkp+gm/uXLqUttEO+PYxGqIj9Ev6DW4l/0mfMiebydaz R5nGRtmH3MIn88W8m9+Lr+cfSIukvdILcrXcIF8pvyr/zvBdwx5Tpylx9kDirsQPEq8l n0u+htixo/0ALnA20I2IiifoBL2O1t+iP9KfRPyg/TlsJfsaetnCdrO72Q/Yy+w19gFG iRMHfibzObwRvW7i18BPO/ld/G70flLcdOCS4o/8r/wTySBNlmqkzdKjkibFpVPSX2Sn HJCnydPlxfJKOYmZqTRcbFhmOGg4ZHjR8JGxzrjO2G18z7TTdJP5F+NTx/8zQYn1CS0x hNg1I5K2wROPEC4B4Yuj9DN49JeweJQ+xizkMh8Lwu5ZrJm1sIXsMraKdbGd7GZ2J7uf PcT2sx9iBBgDN8H2EA/zZbyTd/Gb+M38NtxlHOHP85/yN3ChMgbLsyW/FJKmSwukldLl 0kaMoQdXeTfBs3ulp6ST0uvSu9J70hhmLVsulLfK2+QH5CflI/JrhksNV+Nnv+GEYcTw muGs4ayRG3ON+cZy4zeMB41/MhlNNaZW0y2mX5v+ae5m+WwqLFcQ++cfnoM1WMif4m55 BxtDdQG+OhwYeQjzsAyr4p9ULyUwL3Yhh22ZPEeeJOBGVdZwEOxhR6mavUw7jFzCwVAe pRj7Ax+VX+IX0W9YlOXIT0obDT/jPjqE3aifH+NHWQMd4XV8BX9YIvYO3orvIN6vp7vZ lWwLHWJjbDb7NqtlO+jXPEtaxm6iuuR+LjMLW8A+IlhAN8rr6Gvnh/CVGTYLt/PvJx6R 0+UbsD/F6V7M6NP0Nvs+nWGG5IfY3STsRp3YZW5FvO8iset1YJ3twHrMwQ5ylfEkHWFG 3KHXGufK2+gj+i963/A8IqoBu+m7iQ3yI/Kfk7XJMqwwrDI6iHW3ni7GinkHUXIcZVFa hZVuxV6Cy0dqpZW4PPs2dr29SS35cPI7yW8mN9HPgT3DStkZNoAVEQeiDvder2CVvMX2 YB1e/JXD+39WJtbRCH3APKyYVWI9jBmuNfQbnjIcMfzI8KpxOrx9Ez2EiP4TotmKEayl 1+gD+oyZMTc5VEpVsHcmbG+nq3hEOk7zWC51Y81OwT7eMDGSLWhlJ7z3MNbzcayNj7BP rKIf4f6Ms2yMaC36N6OdFvh5NW2hA5jB77Ah1KzDrj2V/opx29lMXA+UkoqW7sWuNQKb /kB/gbeTul2l2Bca2Qq09RldRuvQQw21skHMwLM0Cztro/QL+LuIOamBTWaPAxfFCrXj 8nuW4c+MU2liUXIm3yAdxzsmifoBvL3y6CK2GVY4MI5xymSLqTqxFDa8ziRZY7/SrXiA dyVvlq5LXEU/p+9jTlT5WlMjkRpuU+vnXlQ3Z/asmbXVVTMqp1eUTysrDU0tmRIMFBf5 J/sUb2FBfl5ujic7K9M9yZXhdNjTbWlWi9lkNMgSZ1Ta5G+OKlogqskB//z5ZaLs70RF 55cqopqCquYLdTRF4DohukBTheYV/6appjTV85rMqdRRXVmp0uRXtFcb/UqcrVyCrwnt tkZ/RNHG9PxCPd+v59OR9/kAUJo86xsVjUWVJq352vV9TdHGslI2mGad55/XZS0rpUFr GrJpyGnZ/u5Blj2X6Rme3TR7kJM5HUPUcv2NTVqOH1A0IxU3da7TWpe0NzXm+XyRslKN zVvrX6OROP2GdBWap3ejGedpJr0bZQNOtxrtUQZLR/pujTtpTTRkW+df17mqXZM60UaT lhFCv41a9rbTni+KaBzn5Ju/LM2T+po8GxSh3Nd3s6KNLGn/EjbPJ1qIRNAGsLy4OdrX jK5vxUy1iE8qje+KtGtsF7rEx0KxPqrU+FJfMsXRbyiaxd/gX9/3jSimJrdPo6Xf9MVy c9Xh5CjlNil9be1+n1af5490NuYPuqlv6TeHclQl50JJWemgMyPl2EG7YyJjS/9ypgtO T8n0nK4uci1Lz3uWCRv9C3Ae15S1Cixp92NMM0XSNZP61s7EBOCJMKC0dZiRDZplXrTP OVvUY4hMMxQ7/UrfJ4QI8I99eGFN50SNsdj5CQmhiJPzoaaxznN5LRTSpk4VIWKahzmF jXP1cnVZ6bVxXuPvduJupAYfgtQK33ZGZpfD/T6fmOA9cZXWoKD1LmlPlRVakxcjtRzf SzwqJJjAlCRzuZD0npOch0f9iOQj4t6CMjVz4Pyvw5k1qWn9bI1l/S/irpS8ZZm/BV83 SlNfdCJqW9ouKKXkwqHwG2QTOW3SvHYpj6NO5HiepEsRlKtWnldBod2mycX4NQqjsTok BKVewZRmzRmdn0ojVp9vYsn8T0zcZP4SKJ78SKB09gVsYhTa7NCEnSmrtTkXlC+wztYn tbRhx+EtbSv7+qwXyJqxl/X1NfuV5r5oX2c82bvGrzj9fcP8Sf5kX3cTdqHUhMaTz+/J 05pvjWAo69lshC2nhkE/271kUGW78fk6jCsmZXdbe4wzPi/aEBksgqx9WMGWq9fy87VC RxElamEI9Bg366K8YZWoV9eV9Qq9vBbXS3pdSgl1jNbGearOqetFIpEyHPhxs/UU/VT+ M90nb6EF4G3gYVMBbUd+Kf4YeTPkXiIoijAinO6N1As+G18wqRpRe+EjLsv+74+kQ2Qy /BsUZxFcS4tH/AOARc/h/xdoLe4i47xCqsF5d7d8xtAHCV40+BIUTUjANBzhLGE0xXm9 OokMckIiq0lOMMoxGw0JLh1jAbLgcO8hT8j5ad143SLnx3ULx+uoHnnnWSTTK3wZvoxi JLgNpLOKNHJWNdC/SJFH0Be+a4j9Cac70dc0NU+ayYzGmbLVclji3BhgiqHCwA2Hza8e Eu13iEbrPqX6sfqx6RWT0C4D/ZTlJN7Fh1q64Gf/KVLh6/tworwJX6wWukatNxtko6HY pJgrzCfMb5vlcnM/ri3NJMnFCBsLmU31uJHnxqUSxs9zlbSKNJ4mWxSm4I+ZnOJ8z5B1 +jJPCMPrEONb5OyANQtRwEjFWF2zyjs2g0sGZx3GPCPDl4khg+6Txsbn8HXjDxue/zzx xOfje8WoFyTfw9fFXHx1VbLN6npTrjnfUJCVe0ne/PwFxb93vp1hqclpzrkscEXO1wPf DdyZc1fugdzhvJ/kvpJnMxrTM7OMOVlBY0lmJOc6/l1+wPiM8cdG24mqt5y8oKhyekZp epEamlZVpE6egiSnoGpT0dkiXtRcgHsLtcLuqLqogFGBs0Ar+K8CuaCglM0gFbUOBCmn 5T41P6Pep+Y5kXhyq3y4GXlGNtnSraXiUgQynUOsc2iUQkNV3WmF0wPmEsuU9IjXts/G vTaWtDGbas+qsuUurmJVUczJ7RWMsRklvtXZ7O1stjh7dfambCk7Z8aGcMq1m69ZOPbx 5rEO4d5Qh146LYJpDBcV8PM42McdodO6s0ODRj4PS7q8gG2OjKUKw1SUHHkur6CqrWhd Ee8IRTqAyHDNkuyYFUwL29xBHZtZsKZmRmVWVqbkzsr2BYKBoNHonxyorqqpqa3B2Szg n2xEGJqMme6sGZWoqqlmXcnQr04ei7dIecWJD9KcJmn+4x2PH1/x0J0vX9q6qaWNfa3m g6La9sZLm2Y40/ifpj14d+SW5xLxW3ddml+bY25uju1eeVtLfrGSv6RpTuJXrkpPsG7O ispAbVEXXN6GaOhEpDpw39Gvlrkixog14lqRtcITyb/f9IDlc4ulu7C3kM+WqmyzM6ty LpEabZdkNuY8YLG4xb2VIS1XTIE9zWR3wMnW7BJ7eoDFWYnqcFDuHYWs0Okz5xS01+lO Xji2yLn507qFY+N1f9GDN7WaqAPOmdeupm8wbrBucF2RdYVnQ76xAye5auEdynC6ZlRm YxW7s+GUmpSX5M7Ev8KDK59L/CvxYmwnyxl3lTdu69x909fX3fzw5RF85ppxTM+5mzvP dj916cYnHn/u0X0YbxjjDSL63ZTPHhsmZ/JztTlt1gOWB9PvdR40PGk9ajmaHs81m91s Pr/Y2GxdXHgw/Vnjs7k/sb5ie8P6pu1z02fp6fmO/EwVM52p2jOqHJknMk9mSpkiQh2F 9Tq3Z4Pz21Sbw+5qtUft3O5xMXFzl5NXxWa4SOgWKFU6n1yS4qGyFPfk61x1YFkMiD3a CbNXu1xw85Cc5vIIdxelmcjHyjN9i+3MnlteuLpwU+G+QrnQ4TOr6Y4qOHwiqkPC49gu ENpjCGVxW+n2qFPc9R610IEES8kj1py4jIvUj4trQ3LBOGi4hJFQ0jn0BI+dU/24Y7OA 6PeM+KoZiblmicHEsgXThizWuXox7KvXrwkjp8VK6NC7t6vwkl10ahfd21U4S79KjJTX YZFdEwrVsYwZWC8dm6kjxAyIACUYqHbSjEqSfFkiACYFsExMxmx+hnlq3j+c+OuuDcz9 +hhzGcdVaWdnw8qgdP2KVXV1jC0tf/DRZ/b+EbEQSvwkcfzbe+azq7btmDcPV7+MtuM2 4H7EQpDNGaYS7E8dGdZ69GfLNGbZqqQqc5Wnyt/Im8xNnka/TZHKS5ZZoiW9JftKHjc+ aTpge8b4jE0rOVUyWmKnkvKSVghOlLxdYixRc/Or6lHu1YUGk0825RZkieViNYk9TS2U Tc6MjGBefn4gaGVkdDgDrgx1ZXU0g23CeyXOm1VHbl6gIB91m/JZNJ/lo+5IcSAQFGsr RhQUs+Ow1Auu1sDuIFSDahhUByoKVgXV2RdVlQdPBt8OSo6gN9gblCioBCuCyaAczJny 59SKxEanTyS8vtA55hyv+xQzi3fJp5s7BNMXKd574kesVYZpJBCm55qQ2NBYaJIvU+xo 2fq+hs9HvBWrgmIbM+pZMVV6djuT9oxccW9F8/5VW/dPKUi8WxBcMmf9tMS7hfU14fVl iXflwN7vty1f3rZ6VeP94xG++pFpdfP33JvgvPmhlaXNNz0wfhYLYSnW74OYs3R879+n zn+PvWv+bNJnmfJP+HsG7sox5Fh4xLli0oqsiOc+fr/xfvN9trjlN/z3hj9YfmN71/Cu 8b1055Pmn/NfGF8y/9hm2Gq+xXiTWYLHMTdp2WJu3LLJPcuUG83rzuN5dh/l5Lan3hCp zWuhWEfiCECbOxCi2LUsG5xXYM/a4JFZRwQe6ZhU5YJHKNNN/slFgWKxkU/sWUv7xh/+ O6tK/PTDOxOf9THl3o0b77ln48Z7+eRbmbEv8ZO//T3x0k3Jg48cPDjw8MGDIkZvxlGo FuN10kF1yn0GZrGzZYYrDFsNUrmr3b7e3u3CgcVh89r4HbakjdfbFtu4Lc6vU0tMJmzH Ejdap5DFaamwdFtkS+4O1z4XX+3a4TrsOuWSXU4KMEls1mkc/6gwgBuQnIz6YZaPExVO G5snQgI7yOZPO3IWniaPOHDUjyFoZuEOgYkXGv5cko0/l1SLP6FYK2fCAT5x+BDRkG3S 5z6DDeCMZJh3ZWM0ctnFF81ZWi4H7ruysfqTaeGnEn/HGL3J9/hew/cwo6+qJQopzG8t ccy2X2KPOEw5meSRsjIp2zXJzbJd3M08ksVkNdk8ccZUB2UPZGvZUhRsBG/zOJNjmUy8 mIYoU5wc8WaypVnKreVE5Ww1xgcNdYpHCmS7lmfWu/e5D7ulqLvX3e8+5f7IbSC30624 K9yyOyf3+oFz54IWrRYjnIMRDpM7OTIzUrdQnC5xAHN+nCOcMqafOLEnnsbSyJjhwCO8 wzL9GW6xYdVmG/GOx8u+OsNfPaO6OINvG0kL5gcv8ay54dJts9IsN97IcuXAaKJtZyg/ 73dTZyxpmn4POzn6+uMJ8X98+pMM0m9TuX9LrSgX4P8iG3HnNh93Q0txb3WZrsPIBe+K R/xlgNoXLViw6JJQ+JoNnVeVNWy6at3CNoj+G/shT3oKZW5kc3RyZWFtCmVuZG9iago5 NiAwIG9iago3OTI2CmVuZG9iago5NyAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0 b3IgL0FzY2VudCA5MDUgL0NhcEhlaWdodCA3MjggL0Rlc2NlbnQgLTIxMiAvRmxhZ3Mg MzIKL0ZvbnRCQm94IFstNjI4IC0zNzYgMjAwMCAxMDE4XSAvRm9udE5hbWUgL1hOSUlO SitBcmlhbC1Cb2xkTVQgL0l0YWxpY0FuZ2xlCjAgL1N0ZW1WIDAgL0F2Z1dpZHRoIDQ3 OSAvTGVhZGluZyAzMyAvTWF4V2lkdGggMjAwMCAvWEhlaWdodCA1MzAgL0ZvbnRGaWxl Mgo5NSAwIFIgPj4KZW5kb2JqCjk4IDAgb2JqClsgMzMzIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCA2MTEgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAK MCAwIDAgMCAwIDU1NiAwIDAgNjExIDU1NiAwIDAgMCAwIDAgMCAwIDg4OSAwIDYxMSAw IDAgMzg5IDAgMzMzIF0KZW5kb2JqCjU2IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0 eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL1hOSUlOSitBcmlhbC1Cb2xkTVQgL0ZvbnRE ZXNjcmlwdG9yCjk3IDAgUiAvV2lkdGhzIDk4IDAgUiAvRmlyc3RDaGFyIDU4IC9MYXN0 Q2hhciAxMTYgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nCj4+CmVuZG9iago5OSAw IG9iago8PCAvTGVuZ3RoIDEwMCAwIFIgL0xlbmd0aDEgMTgwMTIgL0ZpbHRlciAvRmxh dGVEZWNvZGUgPj4Kc3RyZWFtCngBhXsJYFTF/f/MvPf2Pt5udjebZLP7kk2WYzlDQghE 8oAE1HBfJkok4ZBTOQKoCBIProiCtlJRK+CJtsiSBAzBlqhUK0rlV6hWW4W2qGgboZZS K2T3/5nZDUfr7/ffl+/M983MezPzveY733lZtnT5bGIjDUQi+szb6xYT8cscj+zNmSuW acl7u58Qw+TbFs+5PXmfthD3d8xZePdtyfsstO/5yNzZdbOS9+QS8oFzUZC8p4XI8+be vuyu5H3GH5EvW7hoZqo+y4P70tvr7kr1T3i9dkfd7bOT7UeW8vvFi+qXJe8rTiGftnjp 7FR7WkWI9ZfX3jsIoWiVTb4lpeSnxEgYUUlfMpUQ+edyNlFwz+sV57Qftb00aLqz9J+m LBMKCHn2L9168vxXT8246fs9nXNUYrLh1iza8wo8ZxwaH0tGqOT7Pd+vVJM98ZquX/YB Mlnq3hzxh469LvUgpwBM6tEUzQ4dkLpJ2U1DQnqrFG52ewucw3pLGt7YV6Qa0kWAPYBD AJlMl4KoVZGuATQA9gAOAY4BDIQg5bUaYBFgO+AUwCBlS4EmLaQO6yZl4NkMzNcppZOz gARAIiGkfQHjANMBmwHbAQbRjpcsAqwBHAKcAxiILqU3PTYAY09vekhkzfMXFojbuuTt tBpx23xTdTIfMyGZl9+QbDY42ax/YbK4z/Bk3q1XMnfnFzTg5c0We0H7MJ/kwyR9GPhi pJQdJk5KSYjskLwkBmAShipKdMndnBcp2H5IkgmVmETJLBJKtEu0ye4qGGZhCXaWuEmI fcM6kjWso9nhKtg+7Eb2Z7IHcAggsT/j+hP7E1nDTnGaIy0DbAccAnwAOAswsFO4TuL6 jH1GnOxT0hdQBpgO2A44BDgLMLJPkarsj1xiRMrxMgBjf0Sqsj9gWn9A6mSfAPuEfZJo Z8ebiksKDggk2jeFhPJTSHpWCnH7ClrZb5v+3QMSFQGnIVEHpVwylAyQcpvy+4daJX9T 6bxQK/tLsxYN7RjWj50gMQDDSE6g5xNEA4wH1AIWAwzAPgT2IWkAbAHsAMQAkDKkKkBj RwDvAz4k/QA6YDzAxI41oZtW9kFTZHhomI/9hr1D0kHxo+zXIn+fvS3y99ivRP4u8iDq j7C3m4IhMsyKeoJnVOQq8r6oV9gbzXnuUGKYix0CBUNI+wLKAOMA0wGbAQZ2iOU2zQq5 8ZKD5Ah0OMSayFcif5E8ayL6/JAeGQEB1HgSGXwdMCTbte0Rpke2bsMtTyKPPAaMJ5EH NwHjSWTlfcB4Elm4AhhPIrPmA+NJ5ObpwHgSGTcZGJJW9sxred1CxeMWUG2Yk90JKt0J Kt0JKt1JZHYnv8i/ZT7Gp5p69gTFntSjPXqGGtpow+u0YSJteJY2zKYN99KG+2hDKW24 lTZEaUOANgRpg04bDtJBIEUD1VuuuS3R/bThCG3YTRvqaUOENuTThjzaoNFivZXlNN0A rUNWIbLmYVzpWE7zdUNhfZwsBxTNgcznwCYcQvoBICHudDTScpONM4I8z23uWZa87zO4 YNGw69lbePAtsOEtchIgg0FvQYzewkvewuucSMsA0wHtgLOABMCA1rmYx2aROpH2BZQB pgPWAM4CDGI4ZzEURhYh5UPcIwbWF2kZYBy/Y2/hysWVw3L0bDWgRtXrpc0B6gzSccFE kBUTnw922e0yuVqpff+/7N/9y07Mw8zsEbYZy0OIbUnlm5v+nR1qpU80RQ6GhnnpT0hQ htTREhKh+cgHkXpxX0QCJl5eSALsZ8gLmgJT8ZizKdIr1EYd/Kn9oX8HToe+CrQyoGcC B0Mfaa0ybQr9DiU/2x86EdgYerdvqwklr0daKbI2TTQ9EBgU2n1ENL0PFU82he7l2f7Q 6sCo0IKAqJidrLi1Hne6MzQxcnPoeryvPDAjpNfjnftDZYFbQ6XJVkX8mf2hfhhCNIn2 xGB7BESn4aB44ZTiVjpX72XcaqwyjjMONBYYexlzjCFjtjHL6DG5TarJYbKZLCaTyWCS TcxETJ7WxCk9ylc9j0EsfgYINCWywFVYGMrNDFLCqImRG0ksTapklZOG08pY+0xSOUOL XZgUbqWWCTfHlPBwGnNXksrJw2ODopWtxsTEWHG0MmYcf0vVXkofqUZpjG1opWRyVStN 8KK1WTH3iKoDhFLX2oezeN597cPV1cTvW1HmL3MPdZWMLP+BpFYU1pZHr/z8V9CoP5od 21o5qSr2SnZ1rIAjiezqytiPJmnTqg7Qb+m5ivID9O88q646IA2l31ZM5OXS0PLq6spW OlW0Ixr9O9pBYpChnQkLM29HNFMw2e7JZLt8PI92eTxDO7OZ5It2+WazaCdT3m5vfV5F +d48JGiTrpF60aY+Xbu6zZF8tMlHgja+BnJEtDnia+BtYkPFawIBNAkiQROaSQKiSYBm iiZi5HtFk76pJhsvN9koepKSoxFteILX2E91tbGfQpurCPl/o7OHR6O0eUj1zGkVs8MV teGK2YDa2EMr5vpjDTM0be/Mal6hxaRI7YyZc3leNztWHZ5dHpsZLtf2DhHP/Uf1NF49 JFy+l0yrmFy1d5o+u7xpiD6kIlxXXt08anxh8TV9bbzcV+H4H+hrPH9ZIe9rlHjuP/oq 5tWjeF/FvK9i3tcofZToiwgZH1+110SGV48A/3jezKwWyGttVk71cJ+6eKgQ3iE5/nuz 2uCt7CLWaHXMFh4eswO4XPce1nsYr4JO8SoHip2pKv+9Q3Ky2uiuVJWKYld4OIkuW16/ nPgr5pUn/+rxQ9Gy5ZwVyTTKy37whyYVMb2unPvWlbGekypjZRNurtprNKK0trwaZYO7 yqzWitZEe7KwDwoH84aSdLkhLyvlZWZzquF/y4IYE4pBnQNwNA42Uz1Il5H6aikWrJzM YAom3wwyTLu5qg2+FF8k6qsxwXoapfVdb+PzEDhJlhBMu74Lli1PYSlaLEvloml9lETr u0jS9booJ5ZIBK2WRWHalDaSAchUXiIZcoRg/5P4EnCG5/F5iTO8nufsaxi61hQQsovs pvPIbnKIvEnP4ak95ABpIdwFKidPk1Xkx2Q9lrWbUbKRTMSloPzHNCPRgp3JTiyYO8lR tL2J3EvaiI/6E1+RNWStdBxPrSV2kkuGkfFkEXmYjk4sJ9PISfkBUkxGkzvIYtqQqEo8 kngs8Tx5gRyQfp3oJFaSSWbiOpr4Rvl94o+kN554nGwjJ+lj5n1ERy8NaPlTspQ8KdXI NDEn8T1GkEPuxBhkMoYcpe0sirfPJl9SP10ljcBbnkvEEofRKkBqyFzyJGmjRXQUy1Gm JcYkjhIf+rgLb91Gmsh+XK3kF+QTalPOJZ5PnCMZpBe5AfNpIb+h7VK88754GeimgEo9 SAlqFpFfknfIMRqmb7BFik0pUHRlZeIE8ZD+ZApG+xKe/IL+i92La430tjwyMZw4QJdH ObXJr8ifaCbtS8fRqawHW8SekZYSE3rsj2sWmQd6P4G3fwYx2s9s7APpOfln8kVDdvxU wgGORMhT5KfkDWrHTDVaT++nH9K/sBFsOnuK/Vn6sfyy/FtjHWZ9K7mdPEx+Rv5F3XQQ nUBvoXPpKrqePkq30aP0GD3DhrHJbAE7K82Vlki/kIfjmiTXyw8o65SHDGfiVfHD8f+J /ytRkFhHJkAe7sPoHyfPYGYHyAfkY1wnyZ+pQq3UgUujOXQKvQfXvfRh+izdRV+mLejl GP0z/QpL0j/pRYaVlhlYFpwf7gKF2VJ4mD9mT7MPcB1jf2P/ltKlXCkqFUmlUrW0CKNa L23BtU/6k5wpfyAnQOcCZauyXdml/Ex5UzlnsBnvxxr//qXnOnt2fhYn8Q3xrfGmeEvi T8QLHmL1wBasFKOvwzUf/N4KidtDjlMbaJdJe9KhdDQoM53Op0voXaDkg/RJ+oIY+6v0 dVDpI3oWY7azgBhzH1bEhrNxuG5ls9kSOGOPsRb2IfteMkpWySl5pZ7SKKlGmi0tk+6W tkox6X3pU+nP0gXpEq6EbJFDcq4ckaPyKHm6vFx+Rv5S/lKZprynfG6wGG43rDO0Gv4O r2aocbxxgrHGuNm433jCVAvpfIvsI69BAi//6CnpPqlC2kceYQPkDGxhfgN5nk5mSWMY JJXtohvYatrC8pS7DEPYEDqWnJMjoPXbbDu7wIZIY2glnUTms/7JFxo88ivASuW3SIf8 Oub2G7z5LoON3svOGmykCT5SCXykX0n95Kj0HvlEOkmN8k7yB9lC02kHe0kaDyn4hTxU qSI50tPkVWkJXU32sQpCLBdNmyDHY+krsAuTaQH9TkrADR4LKSqW/kIeIAvY70kH9HgD +QmdJc8hj5ABdBX5krwIreih3GHoafDSd9k8uZGl0RbC5JcxuxKaRyXFQx6kNdKThrPs Y7KcfCBbyGfSzzH6D9ir0hj5nDKRzoUGrCbryJLEfeRupUr+LZ1DJDqV5MunYN1WSQVy DvI1sCrTYNP2Q7vbYAeGSWNQ4ofkjIZcTIGFeBLXE7ATMiRoHnT8Jlix35AWw2TWSuYo Dgqrg0jNe/GJ5ObEi2RbYg65I/EY6Q17sD6xCm/cRT4nm8kuujZ+D1mMreTH0O3Rykj2 gTIy0Zs1so/ZJLb1Wv6C2vnUT77G9So4M1Q5SBrlj8gkUpbYlPgdpLs7LOw2MgMO62nM 8hv0cL3UTgbEx7K9iZHSYsz3JJmQeCkRohYyN7GQjCOvkxeMCqkzRsHjGP0t5nsPmc0m JpZJs+PzQIfNoIIOai2H/dmoj5gyeZheNvS60iGDSwYVFxUOKOjfr2+f3r2iPXt07xbJ zwvn5mihYHYgKzPDn+7zetLcLtXpsNusFrPJaFBkiVHSqyI8slaLRWpjciR8/fW9+X24 DgV1VxXUxjQUjby2TUzjz9Wh6pqWOlre9h8t9WRL/XJLqmqlpLR3L60irMWOloe1Vnrz hCrgD5eHq7VYh8DHCHyLwO3Ac3LwgFbhn1uuxWitVhEbuWJuY0Vtee9edK/VMiI8Yral dy+y12IFagUWSw8v3kvTh1KBsPSKwXsZMdkxxVhmuLwilhHGo3iNlF9RNys2fkJVRXlW Tk51714xOmJmeEaMcE8pKpqQEaKbmGFEzCi60ebBx4mRh7S9vdobN7WqZEZt1DYrPKtu WlVMqsM7KmKuKPotj6WvPO2/couXwydbf3VtltRY4Z+n8caNjeu12I4JVVc9m5XD31Bd jXfgWZY/srZxJLreBE5Vcl88xtZWV8XoWnQJxzJfzCo5v6TXm187X4uZw8PDcxvn14I1 mY0xMvHunKbMTP1A4hTJrNAaJ1eFc2JlWeHquvLAXg9pnHh3c4auZVxb07vXXtWVJOxe hzOF2OxXI7NB9GSdwERzjlVOvExZyscYvgGeYEybqWEkVWHMaRBPZg8ijTMHgQH4VVM8 FZsFjsyLmUfUNqqDeTmmSGNKvhrWGv9JIAHhjr9dW1KXKjHkq/8kvJLLyWVRi9G6LjwW jcZ69uQiYhwBnmKMQ8V9Ue9eK1pZOLxYxf6ZbxrIeNC2rnpwX5A/J4cz+KFWnczATaxh QlXyXiMzspqI3he+NavlNe1dNd4pvKahq+by47VhSHIL388Sb8wUufznVH1pFXMHx6jv /6ienayvnBSuhGusVTTWpqS2cvI1d8l6TlDQDXUpLJY2okrKYijjGMuSRG3SQ+5qAne5 yhaT8/FnEEI9q9VoglSKEqqNjKm11yfTaktOTkpn/n8PtSbO8adEduWx1DRig6OpgSaH HRtyzf01w7M1SpWTYXIYPPvGRss1dRC15ChvSGWQeGz0c7QRMTIFmpmPP2w5BnGozorp IBlqJkOLRHF1Vur2moZZqYeq8ePS2bvXSNjMxsaRYW1kY21jXWuiYUZYU8ONB9ib7M3G xRWwdknBaU20PZQVG7mpGhSbSwdDPRgZvjdMN0zYq9MNk26uOoAQh7ZhclUTo2xE7fDq vXmoqzqgEaKLUsZLeSFvovEbUkkxySZmEu2zDuiENIhaWRSI+5mIboiyZCOUUTKzlSXL 1K52DGVyskwXZXx+3MaMmFyVYosQCK56kCGc0OA13MfgINeTKYCTgFLAVEAmgJeNAdQB 4KeSKWh7QJma6FSmkq2GV8gTyJ8BTFPeITtRPxJQCVhP3yEbAA9wnAN7hazFs3mEoFOu KASnSgZ4JIRo8N6TJaL4BxKGHYWMnYABpzQmnLNYsHexYb9z9Q/HOf/1c6IEDMHPJVI3 0jSB/W+JB6s8//mwy+I/PyADkAnIAgQA/OfFNQY+1jb4PU/JlUp3Q5phnrHZdNR00XzM 8ldbg11yVDm+dh5Wn3Mtd51135423lPg2ecdhYgXHldwYU5GQnJcOa58JIiOkUua1H5J V8hFosntnE7YS7IS5ThaTjpApMRnTZ4S1pr4TNc8JT+RKJO2S3twmLGCUByPUbxYIhbp DGFnaCt9eR942rzSH1VL1fMdagcpKy0rXa/0idasVg/370drolEvHUDpy1viVRnK377H GxiZkvhSdintoFk2nbIXsjq5SrdkBmXFE7Tb082tiTMtTiebwhE9w24H5iI2XkJ8NhtS Gy8jfbFvPorkKCnrKOvo3y9rr+G/33QebzLwN33RYrcL5Bs9w2oF5iIqLyGqzcZTXnb5 lVfe2WLQMtQAjA/UyPpLLHw+gBvgROhxhmxYzzZYNzjfdShmo9XPKtJGe2/MGJE1OW2a d1rGxKwFxgXWmWkLvQsyarPuZncaVlhXOtcbnjBuVd/1f8I+NHxo/YMz8/LE6816Triw n5kSs2pm5i0hVz2BwdEdKNXgvjGyJfjOQyD1hZpoB5IlUZBbTJ3WLMFGeBD/UUB1dZrq HjigwOdze1VmCOd2i6SpvgEFA11qJJxrNExZcHzHiqZlw+cf33ni7kcPvLxq1csv37vq xhp2nMr0up9Pb44nPonH42/tfuI1+tP4T86ew+5y/jfz1nFZOQkGXgTvLGSPrkm63VW4 QF7DNrNtJhxnUjMxKEwyK9TG6BGLGL2Fz4lQDc8iXNuiqmBda+Jr3SUYGhAMdQiGgsp6 BmdXF08EfzJtim53FipdlOinUA07cqZkWNtoKV1L/NGx6mkQA3RJRVJwUzqms5SUlaWX UFcJF0NSE80JuwwGY9HAgcUD2MWWYccn/+TPfZfJ9wxdFXp11JHpfG443ZWNmFuQvpOS JbNLtfvT0gxT7K2J8y0ul0C+0c2qCizoUYJcRNN5g2CQ1wYDDtQEIaBIW9lB3cYs6ek4 /XQxpoVc7pK+J47y9Cjp28EHW8bTw3C/s1JqwDu0ud1MdKibnS5gyX5O6VZ3GpsS9PAy /u4mvJqritXKpgD5my6o+EO9cR3h/fHeRGf6wCHKEMNB5ZDhoPEd07sB4w22attkxwLb LMdK98q0je7X3Z9nfp51LtN2yPpaGsvCYUa2GlQNv0T4xAjhNyE3g1uZQYtqMhiOBDI9 gUCmKZAJa2HKDEj2oNrKnm8e56I46vDv4zMgghxOymyW+vTjoDaXdXqQ3Qe7rNJBus21 rwxhjkVsDZNZG8vDgcbmvUlhh125EOXmBcals7Sso7PmtMvNOYtkvaNP1AFTgxvwWagA 14BBpIbWLK2uzvfmRIrB8YEDiwoh+gZjt4FcL7weSAL+ZOOlYpae/9yTZ3dtu+f+p+mB tO/+5/iF619689lpwd27h5XObL/38Oe3LfjR041pH3z89e6qV15/fkNdf0jK1MQXsg+S EqXVKcZZM/w6l2J/gFAuqlEbbmiPsMXutDmDFksPbzAgB3sElB72sN3mz6DErcH0sCma McK5yJtH+nKDdrQvv4i7pKxMhUWFtHS8rb7tLlEPRws4QFj07ordZ6+wr7PLFa6bXCuy pIm+hep8zyzfcvvdnnX2Rs/GrBfsFkWT+AmJ1WqzO2QjRb+Us0XHBA5iA9qD2GlRi83m lf1t7HmSwebq3TBKBcO0u+una4s0pvm5JGsNxvqIsE0RSiJqhGHE51/jNZEtvf2tdFBT xnHaRgdhIWnXrVesVa9W+liKh9EOwUVus85Ha5J2qxNsxORUwc8kO6GqMGHQVrqkOq3Y x22WYJyx+DLaxUPORKMPKQnnRqa2hB5fsGbPs6sHjPa4rfWt6+bP2+Rpyfn61buOLLht 1v1b4mc+fCNBH/BvWx+7f9VOzzPsrtUz73/wQW3fO3OaZk1/uk/wF4+0x//5BUwsVmBZ Vdpg3+w0og90V9nm2p60vWx716aMlkbbfyxLbsg4sRkko2KxSkZig7IfkWSPJMmSnTCb XTZKB3EAbMISvEO3EFlGE3LEIrey215TFIueHSq0dFlCIHxhYlOAfCNWKEsrLdbtRj03 XGhsyCkybnFiKQZV7Z5CwlT4chLuT4lngJzez7nA9jla6SZB6b9FozXCEJ7n5qVU/UIV dlA9X3qh1FXCiVxSsr5PVIbKOJ1OkFvEv+1Y890lsHEndOuAEim3d4kkZ2eX8ldUgxlo o3tsurXE1jC+xKZHSmy5AeS9S3iDaDXciiI6wDXAG3ZJLsq2dj7Ifvqjt99uiRfR6S9I +y/d+EJ8J5T68c4FEDy+9ucoL8LGTk1qDs7NMD87JwINOCxBrzfg5pbT6pTlYMDuoMTo x3ohPAKBCC3j6z7XEr7+QYg6D0MzuGL0cAvb6xRpZebd2Y3ZW9NeSnvL9qHtD1kmc5rf 0TNTMvdT+lnbYMckaIeaZvG609KOOJweR5rH4bRDRfQ0PhDdscPBHA6n7qWpQb3mlOlx rj6warrGh+eari5S16ibVVmFkviFkvgp8at+hsEmlcS/RXO/TovwjcjjEKpBTY59P6Qs OLq9WlmuqEsNFjJu88REa1wlfWtgFk6vN/WJKuAiEYZP2Dy6BN7WNWoDXUnL8eZIsHnE 6zHCE4hM+YV328L7W3ZvumlT95cfYR93vjbuwUfbqWnZw+d/3Ukb1MaHDj/7ZNO4Mh/7 +8/jK6bFL/zPO482neJe2xhwzgubl0160nEpqxdy0hBCrBLN6h7U7dRux5KYpeQGPXZL kJJ8FSRIenBqMF3lC366sHnpYA/wlAd39MRR9VddnKzpUA/XcE72XpBBy426tzyjXLvZ PVlbIM0yzjLNd8/SlpmWB9aa1gU+NJ3wuYwa14BuSZ0wTAkLg8eLckSFkVd008JaDq9w 8VGOtzOMM4sen84ZCaNn7hoz/NlBupvsy69XBSNVfHwDfwWzOPca9xLVLb0s3MwFaYnu K0ufnr4ofU26nA6n1DAl3cc7TW9lec3RpJMGTezgK5eweSmLx1cuMBDequAYVx9u7aqp MdJNuGYGI1+g3HyBCucSl1qMOx/1XLGEBulis7/XDQumDpsygw17fU5L553HHvxT/PRP N57Z/Wln8bhHxi59/tl7Vr4iT3LM7zem39Bv/jizNv6v3zZ23Iuw8Cr68hu73rz0ac0r 1a3PPLFnDwhQB3vnw+mSnSzWHYftVMYfM8lm2DKuhf0Ylc02e70kMU6ScWKJllim01Rv /isZB95PZ1IZskV0DZzHDBgiIcVj1fM1S0rHnO8Yq17g3hjfGfDVu8QlbBDmv6QmrSjH ayCSwRge6HYX10n7NsU7Kgc6D0j3/2Oj/P3uTY/H3fGLrX/YTb+m7zzN9zGTIIEZkMB0 Esb3LCQpgy02khXsw20k/DA2pU8fd07QoHQPuu1Bs40vsHD+z8NMAok6wUlhSIAkHSeO iEqnH2vlOeGeCoQLK5CU+Ep5Xhv3s7zijV4hvt6U+CZ3IVdtRcDhaEcJ3JHUjuQ1MRCx +eADAcIHclrsTDgiylL9c/cX3V7Sc3lD3i0XLt4hT/lMr8yvS2XQFxX2MDkSsSfiGlRc 5KM9fDf4boh8Yfuqn2Luh8D9arpKXmZaYl1qW25fmf4QaaSb5HWm+6wP2tbZH05/3/V2 mjsXmtIU0DJ5pml9edZbw4p/Sg/20Gwk6Cc2DGNHH3plJMH6Q2ZqbmVzdDVa79Q1ePxO Spyqkzlb6aP7C/z1MYlKqG/Kq/d2OfKaV/cy75b+l7c056H7kBp4CCkHwV1S05dPji9a KY3hvh08uyVkSXU1jUSKCrl+XOUJEJSkeXxdfoNBulp16PzFC7841P71gtvXPxy/8PHH 8QuPzli3YO7ajbfN2TD4hi2T7tu1+/41L0lZPZ6Yv+OTkztu+0mPXoc3vJ7Ahx3tm9+g k+c++MD0mesfvJQYs2Xciw33v7Kray/LZTIIq/hqctfwmjWEJSDfhQXggmAyXwnE4g7k nN6dc9TvEix1id2ny+/qFbV2DzodIcc4h+RweMh4SoUbaVexq6B8pYFRVQTHD0drCoQR KRCEAee5IKrcin76Ky50YkN91SCurJ16T7F4uoQU/y+9XtvXf3SFnq50pBcOzhzt08O3 +G4K3yYt9N2eOSe8MnN1cFPmQ8EnfS9nvp75te8L7YKWdp3vGd9unzS4xywD68bX3TCE yZ+jGbTuwXGO6XyRDfDp0ePjkya5hQ8CHzGVECsssuvaZXVLL26nW7iZdl2WJZfuYq4t KcuL7TFfPrkocbt7ee3sMrukZgmtwSZZOJhDWVFhN25tkRMIE846+JY5QsWGwStkafFu 36q6SavHD6QDD96+/xI1vr25456Vf3/255+w915YdlfTy6tW76ST1JV3jF7z+8U2/9QF 1PT7k1R9Mv6X+LfxL+PNrx6SCp/af/jpTTC5WEkPYPuzDqf5PDIzCH4EIk5GMzOUylIp NcgWVgq/hjANtNhp2vkENvzQCm4/sRsQLBfqkFY0wCsBDhw9elSqPnr00ktHjxKG83ai VMN/NRIHnbOfOpzYb8NR/LYlhXwnBBEl5/VqLojcRhqmKCLtq/ZT55jmmmvVDdIW9V3l bUO7ek61mpRqHGaPV+daY+o/bP+w/8Nhlm2yXXZIOBBSZBm7C5PBaLQBN+HUFvGk1sR3 ulPs7DWjzYMqJsGofafDmsGqarLNg6fMQUUxBQ2SoZUt1s34tvkrHdFM1katUDir7rZp ZLZRmjgeh8MnZWmLTGV8LaZbx9vajSdt0hYbtfF71Wn8wMjWGBuMzPgj54cfJamVAYrh zw+KZWaokAJ/WWlmR9npUrUDfzw+FYXvtL4PPrxKbR6xMJWsVw8fdhw+vF5J5jA5lTEr viUJImDeIjslk7ENG1+S+I5boWq6lPtb/BdGhCss5UhpOVKkm8EosQH/w6o+/VnnUzs/ pn/fNjI3MEBp+34kfT1ezm6mWw/c+fBDEACcVxNlIjhlpXE9KOUWl5jMg7tZigwDLaMs N0nrpI8k4wrLx9LHFlAI3MJOjE3prmySG5VX5K9NikWmRfKHMsPydko3u3MKJY0niNs1 20rcvLQZ96ZULvM8O6cQeXuz28fLP9Ovy0Cf+fnXmcwZGddhO2zG+Z5FkWRZUywebFXM JpNmNIB/BosFX8HKlBmtOJK3SMyKOGIrG6w7EY3ZocSUduWUIis3mniZtZ+RauBHzCgZ W9k63WbVuChrqcgPN4kiBHRBbGIgK99jDypKOILoD6RVt/AFj9TYhuziDE2SuQaavASL w5IOBBtLS+EWI+EAa8hZyuMAyP1id2M0qaWmUjDQDwZmgYEHiJz4/aDqpInmN+eabS5O r3N6OhCD6nAVmlSHWmjmmEW1q4Wpz3qqIQjJEfCvhXSXORd065VRInPIzSpBaOqz/T6g vhJw6jPEaUpMuZ4SWfeUcDLvywfqTe6Vkq/Bh0Tw+5YsrYkSLkLYOrloDsWf0bX1TfZ7 auzcxu5PkM4L55S2zh7so85XLz3Bvvg6js+0cFZNDE5IjcpOd+2fTIkLupWT0OSwIzYE 3cZWEgjG9Y3enWM2N69WnDYJ/zzATGarg5jMzGI1cJ5YEQdFCj7s562sKhjwRVec7rsu bl1KcosvNdzB4BHSsvZ29dixdh6GiWLzxWlEuoKwIaPGI6oGkUoilUWqiBR0+VYP8xYM fhUcHQPnPHNcsUgWYZHgvicNFh74Tg9xoYgguKhZ3IVOkSg2iVCHlZhMlIk9NH+bQPir LAfZVOIGrabqdiI6IqIjbqCEHSTccYqe7wsJE5Hr0uRksAHp4jg+1OK/LH0NYU6Th2WZ 5BW2dbZfg5S2G2w3OKUecr69l6NKukVeYb/Lsd5usjLFVGIf6BjHKiVsYExj7MMdlifY Nmmrcatpl/SS0eBmToejn8KgY8wEP6CfYgJqsk10TqQ6TKDJZLZYrXa7w4F/+TCzWneD m7nb2C7sHvs3KZqplfbXLTazRdNta6zU2oZJOqgVNawVhtMM10tzLlYpYnBTX9OUWqVB kZRWtqvZNaTaH83AanK+ptTfCUPIbSPwzMs3p2tgKaFSXMG6rkzYT65e61cLg4kMgbYr hvEXxJa4iIjgh1h8PhR2sTJmg851FzpnT3y312Hh1jIVaDixP6fE0StHBBv2F5c4CooF uq83SlMBhWg1LCs0g6/RA3Bk4UsfWExzXGEXPslyPYHvQ27p58tAbIEqB+NT98SrlLaL 3z56/finpEvfj5Tfu1gkn7qoYZV9BjubTmiKHacrTXqv2a4FHlapVnpuUW/xyFYbvC0H SfcHseYQkztigsWBBolzAAjbeT2LC5ApU8uk+Mv02zURwv4/rFhSB1NilrRqwpid6zJm GUOm8eC9kCdsDrEbGqsuqeH3Y1K7IxgylEL4sCfEzAvSg8zrYTk5LuA8EIY9Ys4zrMdj YxY+Vv1N/N34BnrP68/UjO7/YHyj0uZwz95/+8F4Z+fPJbppzbQHvDi4omQa9kx/xdlO P+bVu82UZsr10jJZzu9WJJUERkg3GEdnV4TK80Z2myRVG6dl39R9Y5ojzN0FbhnyuhAc ciZLsA1IIthwJxE0hiFPNk4iaJxE0DiJoPEFfSRv1N0eyWN5Urf8gU582Zpf0fdmbWp4 Sv5C63z7Asdtntn+u60r7Sudq9XlefX566RG60Z7o/NhdW3eA/mP2bc6t3qDqcB875yI OyuSaY70oBFCemS65YL+EXwiyIi9991ZG7NYVr7P3jvYLZ/mKz4YwvN60s8J9jYHgz5J ONJR7CtqAKmsBr5VOuKRyQsBiPw8h92q5ASyg1n47AVfvRhofl4uygwIGPTOxBvZlM2Q jQ58byicdWFlVarR8fh8YDHdQg3wVGN6Wm/epYKuMeIbzRHSg/bgES2Hg00Bcl638zf1 yCzAnGjEjVC+qAIC8kEogaTcKYRBwNKM/jNv4Yce52vGnIbwwMfBJhsCNQZer5gYIqrR 0zw5z2fkwh88RgoUKxl835QAIsO5UVpxkGG3lJSuvG5iS8X3VL50YwQRCYPXk+5DiEOE zMO5eZFpr9mn/3r1olcmjZ82JL5wwrw593774+f+vU5pc+5+ObazZBD9uKph5bqLP30n /o9t9CP1jodvGl5fXjEnnF4XLX5u9qI3Zs17/z7HQ4/cd8u4AQMWdB+yb8XyD+qXfcUl dWfiSyUX+uohH+uWiLNKrjK9a5J93MX3pXkLC+UhppHyjaYVzheVM06jjTAXAhQtBrMn ghXvb2Kd4o4uQqWgGRNxJtyf0gNimanRfFTzjfexWt9iXwP+pcse0SwUK0W7bsHbLUKx cZt0TwTC3wPk+6RiW+TU0vIv4aWg4rukYltqvNyugh9dhK3pGKPW1CwRms5Vu6NM6HQU Ye0BLg+TQUdWhEU/uTd1ybVvzopfPPGb+PeL3xy1e/WH+5W2S3s/jV967hFq/0oad6np 0L4Zb/KzV0ZGJs5IJ0EjFz851Z+3MNmeby+0l9uVIk9R4CY22TLRMykwh81SZptnemoD 7aETyu/SPs34PO1zz9n0v2Z8nn0qlAj5QqFoZqmvNLMyc3FoS8jYh+XZ+/gGsyJ7Jauw j/TcELjJMtU+x/654Uvf9/S8Q6VeyWFVnSQrYDW6iMUbkKz+AXyL68xX1WMuqmL7Vetq cMkhnUdJQuIkxOXmNgRbtPPJsz6XgQu8S/ixKAWjOEFdDn6WhvtvBFmBfKcP5+u8a5k7 7xB8+5PGhFEOGcvwPyGSMchfb/RzfTHirBipWNWNYjNtzOQm25gRLBx/FTtqlozp6Ozi DLRkCdY9BMVPC7Zw1ri4enDFQEiKLMkp4ps/BBbEAWo6d82uDicMmn14ze+Wzz/xQO3W vs2d2s+Xr3hh1z137Vz3zKaLz22nUuOEYczx/Ujmfv/IG29/8v5hzrPKxBk5KA8lXvBs kp4eIgEvNkE1So15inW2tEBZZJ5tNSEqclp4JCDAaX0iJ0B2gKfd3B8r33suZMr93YMz +geGucdkDgtMcON0OVDnvj2zLnCX4S7vBXbBr+JDbac9PX28j0u45As4t6g7ELxU5ayA xUja8GUEAu3CrgtjhcgmIpoIMzyeFpCt6Tqi/38U5gZI8igCyNeCKUDadXO3noUxhHgz Q3wLkR8p5Lk+LIhYT4iGfAPUPKOe17Owi1Nw8y5zChMB7uDsNuLAF6mPT41zqvhqTkXH dJ7GkhiNImSIn1AdWLFoKvRd2rmkNLX/TS6RaAMvmqanYqXYvROXx5gjgqU0R0RUDdKt bb2+OfBV/Cz1/PF3+Jb50hlL09qZmzo/YRNsg6ZuXPUynZr+XAui2BI+HO4e/yz+b1Xb 0zaXPr5uxNwXYZXWI/DIv7L30LoDOPxvb/am803DKX7aapiSLxfhS902uyyKBqdnFKab XDaXR1IQ/gooRo/VYss36wMGFibMtN1MfUI/fDrXDHN3kXq4VmC79jfdxcmErTWE25zJ yYdSePacbGYP5xbuv+PmDZgl9VnDBfjsuB0rzGR64cDCmO+cjy327fDFfAmf7GOefH7u 3q6rGMM5zIdo5Bg5ha9AuIfCB8ARPZ0PgoiuiYl3TYS1E3U+cSTPeD/4XBqdk7HeUdCw y54Mj3DDbVGRXTaBnH88/sK96o4yqBjWHyjZiLt1h8FhzHcYbFnUbnJmURyhRqP3EZxa UbEREmuPF86eCL8YvK71Lfe2r3i1smX5gvEPl2I/9O1jNc8/3Tmd7Vx/z6RHVncehIZt wPKBKhFPOarfah7IZzDOvMW8wxwzt5tPms+ZjcQcMi82N5i3p4pOmRNmSwjfWuBrZ3yx YJDupfh2AdEXgzFfIfJ2eYcck9vlU7KhXT4nMyJr8jHcydhAfyfoBiRFN8QywDIZLjtS D2cX6r5GI4HEhVqj5BJ8dtBQHmv6T+otBfV4eLwsGd7hqzUX8KVLoiLIAxu0oaWlRf7r Bx9c9MqRi5/w1fIBJMVizn/Zr4gJw8tpby4eJL6UaC4sSub9+ifz3PzkFxT5EF+nEsJn 9icVeRySc4oUUhZji5BQ8F+FxMKkpMDwNwnB8Q4oKtxOaDs5B0pfJT1JKggJyb5KegQV iKACMXESoEWSBEASXRv8FC3IWPlaWkBmluLYUpCDk4Df8R/fIj/QwqMofO5cJ7+ARfXR 1XqaIhnS2C61Vf2L9GXaOelCmgG0PqeXWu2Fd6v0CfWY/5Q/4Zc1k8fh8bmhk9Tgs1vs Dpsjzy/00C900iq00Sq0EXvhlDZaBWutuZy1KD2f1Ear0Ebc/zupjVahjbi/gKgVWGwV Cm+lCWzOxiLm265ncs30n/Ozxf4d/pi/3S/7ESXy+gStL+DDkqQe/rBCJkl6RSHx5QxX RaGQslBI3oX7PxV8bLoIgSYJiBRUPS+UlAdGr/4hJMZjKYgvXtFSn8FltpgsRgSf1AhW 7izqtLhT2trzPv69EVjFz3yTvqIvqbHCYXStf3b5p7U7x6uWlp4Lrq9/SY78ZE/F4jEF qzvr2bo7bh/22Pudr/N1cX18npwDLrpxnjZDf8Sm9lavUytVuUyLaSyk9bCFswu8BdnD sxdrWzTT4PTBWTem35hVbbrFNi19WtZ80wLbPPX29AVZ7dpxz6f+TzOPB097TgdPaQnN F5ajatRbJA9W4TGqN6ufW/+aHVetLgeWxYCBS0AAMQNHRt4xC1UtuqXW0mCRNSEHmvBd 4N19gRNoBKoswl/hbiBkN3VOz1UcJclvy4Cc0cOcGZZlNG0AG+DOJ6SdwvvfQWP0HJVD tAz/DSRh0b2kC02hIuBChYdKseHEwbfwYtDigrAaoqkwu1TsWqibc5lmhEYV++nVjiZX F5ytdZ6Ht9/F0VSoWHAz5degFVmSxpmVtK4eEeDu5sLhyOWDkvXPD35s7oZj85efvOfm zX1cL66462cvLavfG5+n/KJxwoRNiSeei198aPTgzovS80cPv/e79458xDVxLRj5Nnjo Iu/qQ/qmUVWmYblQHoF/NrpNXiYbzC6T2WS2p7nMdiKZqFUQn1jM3beYqClXS6NpLNf1 v69Ql23Md7rrKhtj4DSDObkkqAXkvJ5cpJLBHVNykXKPOvxfi9Rpteb8Urh+gjo85Cv8 CaK+u94hwho1Syk23klCYQPEvxjCErT22aHzym65dejw4UNu9QTlyM4l1w9+qduostql nSc4FfIS37KeyjacS/7+ALHACocjhVir4R0BacCnPtRmt1CJ+FSc/FkgfJLVqeaSXGp3 59towmiqMFfUGhcjZrrFKBOjZtyB4Gm78ZjRgPjXN8IoAOHiBjeKb7w5LYDwGFYKER5x ckmHY8UNIKQXmKAI7s+IVcjYxuYTPx2497arKQMpggB18CX89Hn+sQE/qHWVYGM8YID6 LjfD0Wh+etItdoWLBriKxbceYvfC1MzRpTMW9nrwweZ9+9Ki3YM7t6tDZz/LZm6ixoXx hzd1/mhML3xSw/Vd/BLdeNz7B37ZKJNgC9Kw//MS/l2sX/yXVxa+hc3G97x9SD8ygAwk g8gocj2pxP8DjsP/fk0S/5HHeeAG8J8B/4tHxoyYMHpqeXTY0nl1C8dM/n9OMaWhCmVu ZHN0cmVhbQplbmRvYmoKMTAwIDAgb2JqCjEyNjI2CmVuZG9iagoxMDEgMCBvYmoKPDwg L1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgOTA1IC9DYXBIZWlnaHQgNzI4IC9E ZXNjZW50IC0yMTIgL0ZsYWdzIDMyCi9Gb250QkJveCBbLTY2NSAtMzI1IDIwMDAgMTAw Nl0gL0ZvbnROYW1lIC9NQ1FMVkQrQXJpYWxNVCAvSXRhbGljQW5nbGUgMCAvU3RlbVYK MCAvQXZnV2lkdGggNDQxIC9MZWFkaW5nIDMzIC9NYXhXaWR0aCAyMDAwIC9YSGVpZ2h0 IDUzMCAvRm9udEZpbGUyIDk5IDAgUgo+PgplbmRvYmoKMTAyIDAgb2JqClsgMjc4IDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAyNzggNTU2IDU1NiA1NTYgNTU2IDU1NiA1 NTYgNTU2IDU1NiA1NTYKNTU2IDI3OCAwIDAgMCAwIDAgMCA2NjcgMCAwIDAgMCAwIDAg MCAwIDAgNjY3IDAgODMzIDAgMCA2NjcgMCAwIDY2NyAwIDcyMgowIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgNTU2IDU1NiAwIDAgNTU2IDIyMiAwIDAgMjIyIDAgNTU2IDAg NTU2IDAgMzMzCjAgMjc4IF0KZW5kb2JqCjE5IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9T dWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL01DUUxWRCtBcmlhbE1UIC9Gb250RGVz Y3JpcHRvcgoxMDEgMCBSIC9XaWR0aHMgMTAyIDAgUiAvRmlyc3RDaGFyIDMyIC9MYXN0 Q2hhciAxMTYgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nCj4+CmVuZG9iagoxMDMg MCBvYmoKPDwgL0xlbmd0aCAxMDQgMCBSIC9MZW5ndGgxIDI5NDA4IC9GaWx0ZXIgL0Zs YXRlRGVjb2RlID4+CnN0cmVhbQp4AdW9eWBVxd0/PHPOuWtu7r7m7vua3CX7AtxA2BcV I3sUJOCCqCioSC1aoYoUrYobuFWRCrWKbDZotdag9anU+ohaWq3api5tmsfHUuXBcHg/ M/cmhrTP7/39+b7EOWe2M/fMd777fM+4+qo1y0gluZGI5OwFS65cTvi/FYOEKPuWrlxy ZalsvI4QeuPSa1YHSuWKE4QIP1x+5UUrS2X9rbhvueiyteXnzU8RMm/RxcuWdJfaCcYj DRejolSmdbhHLl65GuOyfwYnxl982RVLy+0mjE/2rlxyXfn3yfsoBy5fsnIZ603ICl6+ 8oqrV5fLatyPXnnVsnJ/Oo8Q7UOEonYevZNoyPVEQQRiJEViIkT1mfZHmC/l7eiz6beX 911gaPsnNbFhCHn8ptL9ZU/zlSdfGXxe6VM/h2ol78864BmlWkYn5b0nXzn5S6VvuIW1 sn/z2k8LN9J2YiEiLRIdrmOJjOsYfm0hY5FvJs/j2sRrGnm+gXShpp7ci2sdr6/l9QXS jZocr6nm1wyN4K6gKV5KkhVoT5B6XOM8H+O/GeWtrKdIw3zUAPWTEJ4L8DqWF6mP9/VS DzkXLV7ej+VF6iYzcK3ieRd/wkkduCv4VaR28jIvWXmbhf++mUzGMyZqJCfRz8RbWF6k Bp7X8WsFv2qphnjRi11Fqib/IFqU1FgnkarIf2IkBe4dKCl5fwW/SuV+Ei+J/CpwiFJS g76EzYCcRr0eq87urM8pYAF7Xo8Sy4vASfQm3/D2k+R/yA1oP8lLLC+SE8SM69fkK7IV LV/zlq/JL4iEmn+SJahjLSKuN6Lun+Q4xlPwFpH8s/00cE1CHZ8TbxN5XiRfEBue+i8+ 3gD5O6nAUwO8xPIi6SefEAfq+nnd38hfeY+/8RLLi+Rz4sP1M7IT109JM66fkL8QNZ5h T4o8L5I+8gyDJ+4MAn/m1z8xDCMf8/xHaBfJhzz/R379A7/+nlhRf4z8jkPkGK9jeZG8 x1ve5TXvkP2kHaO/w0tH+fXt0pqRt/kKsPUTyVu85bf8+iapQs1v+ChHeP4NXv9r8h9s rcmveYnlRfI6+RX6KXBnb8/yInmNvMrr2FUkhxmmk15GIeQV8kve8gqJstJptkq/LM+f tYgcU0XyIvk5+QFGfZGP+iJfzZ+TF8h81LEWEVe2mi9g1BjqWIuIK1tLViOSQ+V5HyIF lHo4XH7GR3uOXw/yeR3A+pfgc4DXHjj9W4zAakSyj+zl77CPt+zj77CXPMvfgbWIaGfv 8CzZw9+BtYgosXfYU54TaxF5XqQTSQJY38Gu5Gm+pj/lIz/Frz/h193ADpE8yfM/5ted /LqDPM7olF9F8hijU/IjMh3XR8kjjB/gzuDL8iJ5mD/zEHmQYwa7imQbeQC1Cn4Vyf28 xz28ZSs4ZgtatvLx7mZchtzF2+8kP+Q4za4iuYPRLrmdbCFJ9L6dUyXLi4AFW/vN/Hob v24it6K3gmziv8DyIrmFt3yfY/ZGjhMbyM2oU/CrSL7H22/Cu4iAKzgeWU++SyahfT3Z jRLLi2Qtf/46Pu61/IlryBr+/tfwEsuLZBXPX86vK8llxIBRVpJatLC8iF9nb3wpkbH+ IrmEXAxepsCdURrLi+Qi0ojrcrKA0+Zyxt3IMv6r3aST9+7mq7CUXAiIKchSPiLLi+A5 iyGrFbhXo8TyIjkf783ohF1FsrA87kL+FPsNEdjD3mleefR5HLJziZ/zw7m8bQ7//fPK Pc7jdexdRKw6e3Y2aeDrNZuXzuEjnM3zszi2z+TPz+DX6aQJT0zjrVOZ3CJTeH4y5wmT OM+ayGsmcC42vjz2eHId+rbzsYtYV8a5ivz5ceXSOD4CaxHJGH5t4+O08msLvzbzaxNg 7MTzTRySjeVfYHUiz4ukjo9Vy3sX+DXPrzn+RJZk0LOG13B5izKDQ5pfU7xPkqhQkyjj eILPPc5pJcZ6td8LTsTkUAS/ytYnwnE1zEcI8WuQX7kk5qshAh4S7+vjWOEFFEXiKdd5 eG834J3AaG5eYnmRuMq/4OJ17NdESAH2vnZ+5dIZmoiZSwh2FaEFGQFpBb+KwFw9JL0C d0b/LC8Ct0rUW8nH0GH9GUWxqwjYazC2gl9FjMfqVOX+Kg4D9qyIHqX5KDgHYHkRf6w3 5XhDuISl1LlxC03///gf+f/Xu3u5igpefQjc4lfkCHI7iVZwC1PIOuDxfpQfJE+Rw4KW 3kveoePoz8jddBN9mXbTTbz3EQxgFbPAHh19WVIL/XjiadRtAi8+Qv8sHSN/AO5uIX8Q t5G14ji0rCVP0wXieOh5qyQrL+9An3cIkZrFVnIv1dIX6DH6B7qZ7KSvUfy6OI98ifE2 iQ+KB/GWmyQX+VKsFQX80r34jSf5GBgX9feLAn2MfkAHyEHioMvp01RHnhTux29eS0+C h99LNtFqcie5k44Dz7xQehR1N4Efsr8v8Cv3ky3015j3FqSXxRno/zRme4S68R5HyH66 inSLanoT9EWZnhT1ooONBVl4C/7uJvcLN9NJ9E7BC02KQWALrkT6Snqs9IeCH3AbwG9u IUFpgP0p9GSN4MaboA9qtyityjn0NaGa/oy+Bkh3Cw5hC10JnYYQF+1mT4la9LtTmCWu J1vEtwQXNJItmMNNdJ30mLBDWI6SDjO5g94vLMBT9wqt4NnrlFZJC/jxP9RuYTMVpiiO KMYovJjzveKD9A7xQfIiVRIX7uvIw+K9yo2A2bV0N6B3A4M/WQWodUuP4k2vwN8qpHUY ax5k3BeQaFeIakigI+xt8dYOQErLIIUxVgFSQbJOsQq61tXCW+Rqfr0b0FoLufsh3gb/ 1p/GO90PCZ0rqpQKCQtJMgHjHiE6tXtP8Zx5gV/ND1ZnRhUDRlVgDzl7T+XawM9Onz57 nuRWzN+j8OwRo+o9UjT88f/W+HF1ZvrZ8wI/oxMmdpSHnbi4A5XnzsMv4D9WjZ+b2FGN N5OOkOVIuNN5uCuR9ktHBDXKDyJtQ/ktpAuRX4k7yvQx3D9FOoK8hDsrH0Tai/QUEurJ m+X0eqk/f7YDdey3xiN9IB05LePeiTQLCePz+kW4s36s/CIS+80pSM1IOqQg0jQk9q7s 3op0BxJ7bgySHklAmoM0A7+NORD2DrifHkD+FiQ2/mIkNgZ7nxeQNiJ1I+1E+hzpYqRD 5Xdk+QVI7L3Zu7J3YnNlz7N3S6JfP+6zkdh7vobE3uUPSMy+L9nfBJirpFehHADngfEG O13EFaCH/FBCrqghZ7SQPDrIJD1klBHSywx5ZoUdZYekc0ICVkEievCMFzLUj5GC0PPC kLlR6MlxSMkkSUF6Z6A31ZAsyZE8tPdaaAH10AcItIUmWFEEMouQVtIG7WIsGQfto52M JxMgiydCQ5wMPWYquNp0SMeZZBY5i5xNzgGVnQut6f/L/877l5ebQ+byuhBgdD1ton2C XZgn7BCnidvE30tKKSbNk15QGBWPKgvKo6oZqp+pfeqnNQHNHM0eraSdpN1Wkav4pW6S 7o3Kpsrf6BfpBw13GT4yzjDpTJebneYd5i8tiywnrE/aLrX91X6Z/TPHBucCZ58r5lrg eti1v6pY9aX7Kk/E86J3mk/v+4W/yb83sCHwfvA/Q98PHQ3fHpkSeTX6Rmxx7ER8Q2JS 8vyUlPpF2p5+LFODdxbIcvleabliBzBERRxFjQTUUSsEiWTfeP+NPDEefePoGzmLKWiK Bk3B5RIZvFp0D/5FvlelP/HlVcokm7ZA54krxTWKBcCiMBlbjAd8DptepxDVZvJclXpf JBxwV9nMSp/dpNeoRaLUCZJd8EWMR/vf73c0m8yOZvzQYFtfwdGco6FYXKyva2ilBbuX inoaDv5Ljahz2SW/w77E7vBLdpd8i8sh+u2OxQ67D0VxpStGV+lcTqdLJ98Rc51Z4nNW nt4jva64FnM+l2wuzg/UZ5JS2DdF6jynUq9qSPl+liVhGh7jEGZP0v9snI1MV3VWNEh6 YUxjy7mzz5k1ZfKk4rixDfWFTDqVjAX8PqfDTom+Ugt2G5hgM7jNE8QWt2juNB7tO9pn Mjc3mxzNuOa7iLG3cLStrb/Arr1dBWRYM+sBKORobWOYYsqhGCDQaCnda4ONAAEqaoOW sbS2YLdZlSqxdmSe16WpqtQYDjKwDY1B33tvwXvyMbXLHExKwtaP/cGQj2oXyF/5g2Ev rX0MDYGEINz13g6V2+RPi+LWt3yhkO/kghO+UNAvf/iYqsocSIrine8J1sHBX9ttIY+k U9IHvR6Pf9Dn8QTpYVan1kpyNz1ss4ddSp1S7g64PYFBv8fjlVuHH+Gw33/6c4lIi8EL ppHvF88pkimtte1RsW58ThNJus0+W64naet1+6YcToq+XsMr4oG6ntZopD7SXHmB5gqN QjMx2Fpfm8ol21RNEXO0SMa3q5xBg67JWT2xUqecbny/t/9ob69xgMGcYRcDe3agTx4w vjpgPDqABjOrbTaVm5tz0WFw1VAG54LdMQRogDEcUtqsdoeloZEjJYO+nqocJVinaSge yzI8RZ/aQoNo7LjzrFueXbyykNm+KnZuq0KrDYQLbvO6msL4UNPXFqunbqw9WBXVxarG uCxOj6PTGVCIaz5ubbloauac81tbntu8+OHZk6+ovfSuKj+lfk+4ZdrYmsC06fJT2Rmr MoGYT124uHFOxB9NV6ugbWSTi1tmXRYjVFCLK4XDnAYjRU59EnlOvc/8LcmZQW8lSuv7 t3QmLGBU5XRc4HAyqiqTkdPlcnIygnShD8pXiHnpMGRCsGgSNYbX3Pt8OmL5oZIqTTYf xu/qKzBS7msGLgNOSoFBzgfYKAHIeEyorzM3ctCK+QmmjuZc3jXXYvTPKKy4dO78lgtj Rot0v21z8hH5xO03//P68ftsdlf7lAfo2T27aO0PL1jsYu+wbfgdaoshjeh+zbDP59K4 RJfF5UhqkmLSknSoH+FvZNERvFTb8f4uRnmltwJdNZjr62Lx4aW2m21WAUuKN6TbOswT WvKFqjlWY3A63mr+/LFdMaNVfti6Kfko1Wy58evvjN9nt7raJ98vP92zS37jhxcuqmI8 kJK36IPiSeh0k8g1xVkTx7a3tdbX1VRnYlG/z+uwGw16tYoSmxSqapLa900e395GfIqJ rLlaMYZ1lfJJ3k8xkfWULBU2i3Vi3pa0jpkMNtL3fl/fEEKX8Lq0lG8Uegsl5pKjUQ5Z P+XwVilKcDeU+EmWlmaYpXze42i0fOfPOBTfslzhUapW6SV1hcolikaD/NkLKlVlxXid XqHUK7ferTKoJKO2WImXfEH+q9GkoqB3tVoHJ7Pb7J7lMYkLVgmSwTpDZxDVOnHc75UG lcKgyWpUOu2JExUVanVWw2qUvx8nVmoEm2KG1SAIV1O/zqTDfyVYXght6VLpFugdxWLQ oNGp/C7Prx3kDd2vjarXAw6T1QAI2dXEYbU7DQEscR+kB+Oh4LHEeHxEMUeDnDmGgyaO g/WmIV5q4oRuE/bQFaHqTFi+JxHyVcv3hatzAXpJKhhKCC9nAoGEvCmSQc21iYCvhl4T yWQiwMGV8otiNZ0BPam6WOU0myokvZa49OIRFytADBC1ymVzDRPcG4zdMKIbS5lcYyxk aFmwDG20kX6hrvL/wWCWJPnvKqdeVKknGY0CdYQsOo3CqDrVazALYpXKrKvQKIBr26Dl 1gpZaG7BIuokUVK9RX5rNKhVRKoQjcajvRw7jjNCt4RiYygTHkyeAgaHrQ6HVRzjqPJZ 6EqX/VKL3W651MwMWEofO/2lmKZzoBlaixrxqOZtndJNdJgGg2p/LloCGQckfWzl3PmX rZw377Ids7ovPPvsCy/Ee316+g5JUtwPTdJXNIqV1uVkuUWwaDVEMiqtpbcCIR7tzSmG OS5AUhZpdKM97vaklArhSlfM7UspFO5CJOlV23SK9rpowqO2api+cuT0h1Bj9XhHB7ms uFDZoyM95hd17zhbK1pVdbROMb1iuqqDdigWmhZWdlpWmFZUdlu2V2xXbaVbFbsqdql2 0p2Knooe1UF6UPEqfVXxnum9yt9Zfuf41PRp5WeWzxwRjcomqgweJ6aMmeOF+wb7jQPQ TMDNzLUFcA9BDAkmI8ubjIKw/Oobb7x69Y03rn7hgw9eeOGPf5TWy1+c+B/5v6jpf05Q 4zeL6VJaT+voUvlB+Qj+tnMcpxIh4kmFGnp1ezESNAJICrHyRb+p16kNOM02I3Fp/FJA aTN6A0qDh3pCxqNdvUcHe5miwBAdco1k+wuDWOrctzpDiQfYTEOaANcCWrF5dG1lpcIf DwVossJWYbE/Oj+XSJzanUjk5u+U8oIQ9jojmrNFMez75lVvIoJ/Ca/4FuNrj+E9/wx4 15KNxaURJezcyp71Vmr1JqO93heJz7VOd71infr7oU3SI+rtim3SNve9/odcOww7zLuV u1W71bsVu6Wfup6I9qgPRJ9XPa983v0ClGFPNlObi0EZjCjUoagqIGpVmUDUIdYBPX5x tLefTRMT5cK7f7DX+GoXk9uQK5x+x9GGRgIuDtmswh9YN1OYyqhElQYaHEIrG+N7VFtf +wuvt5EuuH7JuKvDyspoTcSntxR/vnTnh/JTc2vW0deleDAYgxD1OdPV7fs8njo66Z4V G+syasuEzNgINK+p7z7YKz9/Ts01aTB10SDO9Ic53z94+kPxBOCTJ/cVVxOvLdyTi9FY xttjM/TolO9kXrQVpGpr9ezIbP1C49LIUv0lxisjV+rXWdf51hm3woWyNb81clfNVsWd +idqduR30Ef1T1Q+Gtmj30f25/fS/TV7Ii+pgzbiCqiyZtWVIhUXJ69MCkmjK+ASXBpf wXi8t6u362gXkNVU1jH7j/cCY8swy5UEQglGwAtoKUz+4a++rpEBrQTH4XZwJ1FYc9OJ w/f/Pe03vbPo2nsuWuDOdM4O2GYtvmZh57N2T/SjWx98c6mwJ7Dr+mc+XDPJF19+62Xz 15kUoqK9VStKuounXXDdxRH3mLU/v+2SWxnN7gUODSh0yDWRB4pLb6OHqEADXk+VzaqK OjMGY1qqiAZJb7Yir+l1vigmbE22OcJy4Rrh+8JWYadwQNCkE02FbEjKBASrTjQovZ6A RrSJSkLqaX0mofRrideQoAl/LrDeQA3NIBZIhS6IBeOrhS6GTIwFc9IZwqqBASjhctur 5cpcFzVpaJle6oFl4JoAD+dPDjuXqqAqphwCQEyqpqmtTGXCIXkjNeRC4fhqudrl8SpE ulNvNigNkrRcb6qFjLJ6BFGtcns7w0XQHT0i7Dy1QK71JyPBJwO+iYkMLK43XHqBUqPg tp9Sh312jUGdjFQ96Y9FIiWZ+BT4niANwOq+tniWPxkiPnGc+yz3BW7R7ewxAC3eM/ec jalrkr2hdzXvpFc4LrOsUK9zfMey1fVD0w7XoyZNyJcME5sqZoB2RLxX6NbrBN1iH/Wl GWsB/nSB7DhjKfM80NxXXXJvFwcdl158wtIwqpRQCUTIaphAHRK2dOP4K2uf+VyWX3/y zylPxTsLv//jh69b8FOzz5WspSdzuUKN3CrqnY5/7H/pxML2quTMH63/zhMLMi30y6A3 Ho8mS3xeHOR8PkKWFCcG3CGdTXPMgBm+J/bYQj3uF23vRKWwNdxp7xRWqFdI3UK3fZ16 nbRaWG3fULXBusG4M2xUqnwhMwnoVOag0xM1Hu8b7DP2DQwz9a+6BrgxAG21TBeYTHyI d4QZlyd8TozLCPSO7y1fvG5995L19oYNsx7+4N0fH/47PZ/6l4y9Zlb24cN047rtd11z /f133T9p0sDTB/9Km6mCdtKHPPGiQDU++TTnF2+eHhD7sY4hzKroc/jtUlVIh007o663 6l3xUPiSio1ks26bblvF42SXbh95XtdToXXYq0RLZcitq1DATvepK33qxRZqCbOF6y2L BIj80rr1YhG5ccMMm7RQ4o00OCRyxzGULmsDKmGNWm8xTbY6RJFukiUxEg4FKdVCDgj3 eN3aCqtTb9SrDVopna0ORbRaaYHH58JSxIMgafImeJ9clsVZcmfx6ojT8IyGan4v9qRs Pb4XU+/ktF6Fv8pr81+vvl5ao10jbLBv0H9P+z1hs3WzcbN6s7Tduz291b81ud25NbI9 u921Nbw1uiO8I/qT7E9cuzw7AwcDB8MHoz2eHldPTSzi1JlVwbBSFdep3OE4UVV7cpDS vcfB7Y4PlLkfl9bHu37DbZBvV9UyYoUtQ8o/08SGzBNIEHr1xsuv2HjrZStu1d68/KKb b77oou8Fl1z4x5/u/tPiZcsu+/OBA3+6jM67dMONl15803o6sPS767sX33CDvDZ394Xb X/vVD1dszSUfWfHEb//zx8sfYTQrkNfLssEJv9nK4jlEI1oN9tAx7C2L73l6NPYewzua F6MV6gqpwuF2dAYXuhdqu73dwRXuFdrV3tXBde51Wgak2/Tb1dv1uxy7tXZXgKh0Qb/K HFJyfO4/PtjH1r2fwQDoDCGJ/77VCLiOQrjQBDdrMFu40Cwbq9Mavgc0fmdn7xfyj+Tf d4259qyahw8rbl6+5LrvLl1yo7BoYsfff3rwb/JheVDeJV/kiRVFQeOFk/H97zBEf+Bu 5vvhOiO86EwfCxSNmqOi4ajtbfEfTrPSrSNOKOf9zCbk75djimhJHw/Fygr4KG1ySKsU jpTVSjk+pF8K0LtfFuP4LQbP9mJ0SPOO6t8UQ0c9/xCPoMpWUsCVLltE5Xe7osajg0f7 GY/ntkE/VLlPGD+D1gRd6d9o48zxMuIt6ecap/fNShM0c1lt0as14njwIDGN97z88vnz LjseNOs0IlT0T416bLspzRWStkI8OKt76VlnLWU6cQfZIs2RzofNXCxm1FanVfBaLRVa Cnebijo+UL3vS8PvKUw1XGoZbqmSogZmThcczdx0hQWL9+3SDEvyOB0S31w+lSyKuPBB Jhb260P+wb9IykUL1JLodsf0/nAsI6yVn7Ylq3wRrYFeTcVUoZCQAM7KipDXnWS7RwJZ TjdKy8WL4RF2k2TRqX/D9qHqDfJHj91WMl3VZinqqvDw9SzZnoBlzjLE8TmXObO0U7zJ Fwz6Btf7g0H/iLzgiocjMQi2GD0rhlw0GokyeqHwDW+ROodhpXVqBa+tDCsHVX3geN8X IRcQYZJhWcVwiyFaJTErH76NM2E1ROMOancAQODgdFhTFFeditbEwj5D1CO6JfWCeVoJ MKtz+sKxGmEtnQVYeUMVlfLdgpQo5OE3k7cIjoivKmnjsPrg9L3iEcU86HxjyZrilNqC V2wjnoZsrC1JietjqeFP2UptuO3jbFL7sSU5TtJIVVaNVZF2tjpbUtOd01ILnQtSFTEj CRRI2uhpTmVUKXtynPH44PvwXfUXwNFLzsL3++G06jXCm/VOSVAxHZhbklxpKxkhwyRV KtptpiGWFh/i+SA6i6kGLg7mymJuquCizu9uefxH1deZLFW3Ljv219/1PnSX3VAImMLO 5LTY0pv3b1M6lGqjYdGKqeNNBXGHc/NW+TfyX+VX5JdjXnt+Ar2RXkS76Hf/Mihf7PFV BmttVRbj9rX3/FSQ2+kMSi/rmj6bGfPCaRnbDu/BLyJgj2BrsTBdWCgICbFHS3r8f9b2 ZYNe0dCbsOfECr0BXiyfPxDUZaqqjZBuNdFqVSaTZ96P4119IGEYPFjmQomVYJOp3QX+ 04FxsfuNux/Jh2TAn563YNcD5QBSEIn1y6kUxv7+fmO/it3U/fNJFw3C5uXoy6Sio2yO MrczJEIrjQeH3arlGno/feC9O+4ak08vpt7GuJHeYmpIxOrkL2aks+1dS2RpzpLxufRU +X+KqVSbRSCCORhP+r3xwawPd38y5h8Y8MdYLu5jeC+y/Q7pasBIDQ96Af6js5KaT1Wf uI09oT4X6TVLSSlqTVpBJvOTlyguSV4irhXXKtYmv5++TdR7Qi6L5K8qZMzJmFFLVWGz klRWxvz2mFSZsWuIoSpbaxwETh3t54jEvUVcSnCFITtQkNl/YIclbS5N64cyliEYmMoa X4nYSxKT21V3/vGFbXf3fPbW7Zu+s/rE63IxHM6cGwzOzERC9O2jf+yYcNklC2bnr7t8 ywWXX3H+ugXnz7/gmwFuWW70J8PRJx4665pY/AeXLbw354FrD/Q/6/SfpdnSy1ip64rz 1Bl1tbDQtMK0zrTZdK97u+nx3E73vtzztkORE9UnMpWrPfs9ArFodKLrsD+h+9zSK35W sy9xIM/IPeaI2VY7V1s3J3dU76/WGO1Kkg9p7JXpXJ6Z9b39JdMSpj3TCF9lYtPc3JXr WjXET+31TDDBSmJUUzL8hw1M5gAOhwh0Q9CV+Jg2Eor6pEByvFUlWX645Nl3j+1tua7F fb7Vn84WO3ef/7X8Ip309fhN0k1ue6Tpwl0V2eD5HsP0C+RTv/+9fCoY1E9I+nyNicY6 EJSRVtLuAOPHF54elNYAJ3TYY5tfbNE4dD0+sTdlI72+vkq32i2l1WmpVd0q/SS0K/68 +nlJa/A5bZLdHCTKykit21wXqCQGe6GaLX6hr3C8n2kGpTXv7y8c7TfKbYdzUR/wndmD zJI2lekA/oLSgreKBQK/GZ9ujF4bGOf76i+fnMrmbQ9XR6PpNrOxrToaTz/8wf/QxHnn TH9vl/WCLaL4/t8HjgkiW+i4T9wYSETD8kvyf23smzNrssR5PCIUMK8x5AfFsxM12XQw 4rcZNbXNDS0qEhnwf5oeIFn6RZZm+72aHtffjH15VW/DX8kYs8dm1MLvp5ZqAvl4wZO3 kTj9Ik7jOZ+h2VZfKamzY42DvZjqILZWVhkHCvivZPIx0Z+FvSez1LWqT2abMkxLxqqb 2LU5V1ue8fDUmeOQO8yYJYi9r9LGwP9ScygbiaZnFovTq6OxarElFGaUfqqfKr2RsNsT ibjlk4KVUX4kOIT/0XAy3l+XyMy8Q36mviFVPe3Q9FRuYlie+NjMTLJ5MAKfPlkEvrAI sGqC72V6fbahkIilPU5TeiD2aWGANNAvGmhDf8TUE/ibs09PelUqEo+6wh6nWa+WjBVw MdXH8zXhvEciNfSLGlrTGDV4bBXGZuyRFHo5lCBZOJQ4ajCgABYMVmeCaghIYBFM1Rji jcJIvlDyr/57UAnnx1OxSEi2hCLxbHDcuBnpSEhcEwqHQynfqY+p2hMJeN2hiEc+sSUY CUej4WhA5CwiGZdl8BQGo6qphVhKLsQKU73yRMCm4/TH0t3SK9hhvrd48bTcwtxC+wr7 itwNuXX2O3KP5B7JPh543n6obn/DvoAhWEjE0xGz00RMTQbaM05N1f/V1OtMf17ojXzm 2+c80GqvszfE6mINq2tXN+7wqgwao04tVAezCkU8r0gSg85YX+nOtXLeMdjH9UkGKW5w MQ4yIHcB2ThGMRBCA++K1p/BNdPUxKwNcI5AmXOUNplKGHUmoxF3nPB5q6J0T5UrmKrU mZt/f6V8XD5IJ5zs2DRNG/Zk/aFUnUOtiN42f9+7/b3Na58aCARjnmAw6pH/5nTbtKEc nUMhQulyv7/K0bTs1ny8aNGeNUc+9f6f5eOQOhSxkAQ+9sewX7G2OCXUM/GT2khANPWk nX0T6g0i6W1T1Va3NUh1uQlj0lEpETZonGbJqAtUgQQlUkw0dYQNzbm6Oq/UFCSGOpuu zliYjE2WwhtsJ9fYV5BxG/a4MAW8LMEHHGhilwEmchg+lW3Ub9mOUKqm2HYuk+VwTfmJ ksDGE0F67YTWXGryH0ZypLfOTjdMr6YfdjTnq+e9Vh2JphqcxrZMasab52Tqpubl4JZA NOn/lkH5k4mAvIMuCkEqozY4uG5IPtNHGaxeBKz0gFWINBb9AWOPg1GbUq92mCRDRaBK SSSv2Bw0WCuaDWHj+2BAbCu7PF+4aPsLuWiZcP6VywxNyCTeOzOdnnnqR9lILDPzT3+a XhOLVQsXgLFUT//TFm+CvRl8siCLaDgSSfoHWdAQ3m0lZObdeLcsOadYW2HpTHXWdKe6 a1anVteosrGox+xWZvyZT+FQ7lH12Q7kjFpTJZaQGCpNwWjenYOZcbx3sJejLkifObvB OF9lSiZUo7LKExx+S26uQSjyPQWoSz4KBGY3JkYEWf5yeiYcrxaqs5FwZtpNv/zd+bs7 w3ZvxBlSS5JSaf/eotu+I5mH5nDqpr/8Ol1tieb/NilsMWs9EW2w0X3Wwu3PYF5TAHM2 rynkueKkisnpycnaaH260BHsCHUGO0OaRG1w8hSJmAohP9A25exrwJqMUYUKtQ1j2yer aohHapoyDuKhpiU4xQCul53KpAMk39HeLuNXbWx5oE8OFErYyIollbIdqmIDmYwrC1Cp ZXckFv6CxHJIBbRM4bWoUxmlQVW/ot+o0vcPKvX9RkX//FyedP2fuCWQHk75EXonIwMK +84yBGm2X8p26+Iquo1heKu8Gw7GbKBYnJEKh+ic1hRD8R/p7PkMNi7joUi2TS/fMPex n5jHon1xwGvQLI+P++7ky4HricC3LDWQAK5fQu/D+MFoOB6UbzO/IL/ki4ejepf+51PX rNFezPEK0TvSFYB/gpxdTKkrlMQiRm09nj4xbumtiPpjIY/dUilZjWgJxUhe2eIyxgzW pPH9/l7oGkZmwjCYDguUV6FmsoIJzgluX3spExnB/wNFBMUPfSmYiaHBTdlIJD3jhhum MX2DvgISqZ7xpGCld0/PoEJ+Lhz/N8RBoTsR6WXMoZ1sK16haDdgQ9HWniXR9npvfRR7 Re11xQ4v9oraO4rLyDPeZ6KPkZe8L0X3IggqGvF526kqOCbYUNEzRuqri7nFyt5qa8RH 2qnCG3UWPV69uk3X6jGYxlWmirGovqWtobVyzNiYIT+u3j8evsb+Qt/xvj7jJ8ZPBtgd SkfJhilxwMKr5hKRIZKj7IdIDy3/kISlFaWtnXjFaLOkHBzCHnQIF7+nz9fsCASTjUaP ox3at/xpS6owOW171ZDJpDL6180lDPoMsrTd7jU2pkKBHTX5StovXBUJhIMx7+BV3gSk bgIq26JTL6cwlDBucAfDHA7Y272xYDgATzQlwdNfSJsA01bo6E2xYH1wefCSVinRUhds DSg86kLI3JPy9BlJb6O6JdAatE+ojI8PxrN1tYrxrfHayjqPSdPehmiftr5e5ouVOVya QYq9UDoYOTIo5UCKL3FKayGtoLMAC0CDyWbsn88IawhcJd/msNyozfEIDQcdVmSHxUaJ bVE6p3ZaQ0166kngU7LV4upsrW1OWM+vibroifjkhnxqwn/lIuF0s86dzzvcp/rLcoLx XSiyQcGWHtwm2sNceCQCgyavvaJGvAf0IpBp0Eduhj7C/GBjihldr2ju1ewTDzgjlogj bUpXtlbWWeocrSbm0Nug3SDoDJWkw1apzLGNxuMjNxqNZMi6IJRvN3K73SzdLP/273+T 36Q1A3+nuVN/fvLll5/c9dLLwmx5QP4RXQx+YqVd8qOndJT+6U+Unu77E3c5493w7R7X I9Wg5vOLY2gPwRaVExZ4n13Ta4iFYpGFqoXiCtUKcZ1qnaj2u+xGyWExaNRCLKDEJxOV YV2cGMITPRYHCBwqNnRHFkdTFnIsvgbivPBuF3ZJ2SYJsycsZ6iKQ2o1M7E5qzPRF59/ 6MGHHgT7AmtzhKD23TRpHvRC+uY/Bk/+8xnJLOdWr7l69eC6YISxr3CopBG+8Nxzh+Q3 GbzlkxzeacQa/rB4uaGJZHRRf6/9i9CnLkuhV5nptegOKPc1RWojjenqdL6utq6xtbo1 36yeZJ1gm+Sd5JtjPdc2xzvHt8y23Lvct8Z2jfca34aKH9CNvm10a/he3w7FT1S7yMG6 Hhoy4MuN+mylR9NRX5kQc03Yc2N7bKDfku/1Dbbd1jvwlczYHpS/KEJdmHXINL1wCjyc bykAMiXuDp6HJeWcD07Z8hIzI5O+/vRbtKnvE9oo/+c/Xe7KFW3Xj89sj/rnGlyR68c3 vVU/fZfWXr24pmfH4d4ndvT2CgU68Q9UTS+S75e/lvvlp4VLnI5sNO31Txg/JVflXpjZ TMU/fkglefDDD2W4YgTQLZH2gn7VpEh+XJzLFn5RG1v65TXX1Kiq22iirWacJg0cGWcc J4yrIj3BvqxD09tgbMjVJtwOU1ByWWva0mphXHNWnaBGbWicVElqFZWJyia4GxI+qyvb zkQtLAwoxoAINt8AqRK6MErnQpejCxcPJWJvBplnSRuuNSyiVKU39sNVw8gdZvEQUoll +JX1kpEGSCncBb4Jx7ciFFq1WAMpS2958wdbbtv0TkdLLtUi7wlFEjXBlhZoKmG684H7 6ibM3PLdqqTl9WATJOeqfFYp/qJ15riNklu+bFn3suWDVw1L0Ns98VDIG67eet7VTwQM CY/8hj8Wjk5RSjQ8v66kj91x+m2pFjFSE8grxR8mWya3bnJ9v/Xu1gdcW40P5h+GXfJE 6CcTdjb3TDjQesi1P2RKJULVUaLUiq1OV4vU7q/+vK7iczN8Ge11vdHP/PvaD3TYx80o LCosM3b7uuu7m1dYVjhW+1bXr25e51hnWWPcaNxs2dC2wbeh3roivy6/OS8aiKfF6WoN 5ZWNiaRN6VElbZPGNk5SeTpAvNgmLslmHv7WXHKawoTpH+LFJZnNRDUzYpinA3oIt34d Q3peHddMShZxyYrxl2K8ymYM8zKW45DwNB2viMRTSbESLoMqXUX4vktu+tHSC7a++eKp nzdeP1PwhDIhSZ+I1Hv1+uB3zlp736rVjz695+RbU24PV4fzjZ+Zc4k5afukGddfcNZi vdX76J0P/Nbr99qr8m9pw/FpKVuh4bolM+YZrY4f3/7kr0Ncd2F28yrgeJ5cURzncZM8 dF63zaxREqXHKeY8PZV91b7eWLw6mwrEvGG92SS6bZVaDfaT3XnblPBkLxSaKV5DanK2 APcjczj2YX+pzO+4FsOsvzLbe3UoAkulV1k4vOpzDfUsPhPMzoF9p/qS9BGDprLgGhLv gin4heCvDocFrRCJictiEVohxGIJn6CVP97GbeZTb3KbeZv8saifnoxG/EY6LQpDTz5o DtBIODmdSoxFDhnNJRwcg73iLZh/gdxQnNlh63B12jpd3bZu12rrattVLk2VKVOQiKM3 m3LD1OsJqfqyB2pT6Ug8HE6HPP4qZv4yG8HfVBWP16V1TUZDWqpTk3Z4Eofl9hAY2J07 DhCswcwH5qLl0Ze5riEl5VsxPIRB/2LXcRDVH4RHCWbPEWampW3O8A0z7ri5flZ9avwH uUg006I/9vvDf5MQrxoNM5Pt1PtXLEuN6XjqF0KjP8nto8Cpff/4xz9+w/QU/enj0ouA Ab4jK2Y7jTQRNybgajLpMWGnqi9yIBmoyNoEyDVTIGhMqD2SbaoRcTYVU6Uki9vt4upa 1/CUYNyDIJiJYCRGcCmCkU1DqgmvMfBa1HMfM7QV7l4ejuItCz4NIyhGOkOSkIcShLKI 0CmkIP6yrclM7nLsG0/fmK1OtVA4k1J1Ovl+f8TTPD4pSHAmM0UtGh68X7w4zFV7GKyz p0cvRTAE5i0A9w9j3i1kc7HwUohOrppbJYRCNNGcdoranoKpT4p5Aw1ZveCqSqWpuoWE NFpAQj/N1jAt28qmPjTzbNur3FLns7YSDeangdyoIlrkXPwbAeZfZ7+aIi3IpfGXYrM3 quFgh0VUcrB3gYeXlVyHe/T0ETrLzCBouOWMOBo+3U9pHL5qr0vzyoUP1aSTTXSCPRSL 6W4XTZbJDqfm2C9Udtd0K0JHdfF4wEE7GpPp6i0AxJyAyew+tVN0B8IxX9wbCg46/Vaz S9hzapbLaAmJn4SCvpgvFg7wGcwB3K4F3NrJl8W5yuDU9knB+e1zgptMtxgeMN1n2G3a aegxPWf4Wbs+0Z4PGqVQwFQJVHIp+4qFrBjqbU7ktLmGcfZxGdjWRuBUKJcvFNt1Y6L2 jDeqbYiKY8Yjtqn3KLzw73KhCLWJ+0HYhVkCDLcyJA84MhPTBPlsgq3RwXErh3ccwrYC KaC2yNtZb9aH7XmE+HMMN0uYyJ7JoRRibQrgI9/zYJdSXs0zELG0q7QhPqxWu4cs0yF+ NbTzOOQPoGcK4kb6cjoaDg1G44WMRfvnfq0t15CKDIbCyaz8Ml2UgYyTj9dFMsXkaTJY PTGHzZKvQolUDZ0tmQVYofD4hWLyS7QdQVjxaDgWks+W02IoEIwzi4QukR/xxROBeBBo TN8Ets3AWuE7LXxtclMxrQheFRQSQfj3/aKxJ+noq4RvJmgs1Fhjs2pmipNrPbOsM2sN 2smGes7LYXAc/4SLN86/OfRLwDdzANYCXEZu6QPQCHtji2Hgm0hG1sLRm0FQXTZGRum5 ZfxuHeJ5Qwg/XEFN4nh4etrlaHsqO+1OeZ+pDUZs9V9ak/n24JffJAG5qVUPz0in24zy U9zxA17npTOEZkb13HyfRfcGEikf54E98i8Z/iI2ewtisx+D9dFSDOjshgry36ov7f9t 6HMa1BV2I2PnFmxPAHpnVWBXnoVqA+m4GMMOwXFsiEBvVYzQr76N50lTYcqT3kjIK//D n0r5aaU3FPE+eSLg9oZjHsWdnlgQ3lvGBV4/fQdiBVn8Z6BoNqmsWu0l5BIqst1u+M/O jAAtBSLj9xzDu9rilFObFYqM3xV1CqskKe5xx9yKaRVmtScRrTv5ktZa4UUA0xlzHVsM sbmqCGb6JWb87WylR/hULRaJxSBgB52poExo89lismy+I5kR90aU/V3Cxid94aCP6gKp VEA+7oVD/0lECHq88LKevMITC3s9fkJPD8he6UP5buzgmYpKzBEfhIHE8RMIcaW2YL30 4TcG+e5rrmF69y2nP5VuEffDJ1FPbi7OvV6xWYFoSds9qp8odqgQ75LYbTugfd5/yFRZ 5XXVV+Y1RJdyJcWPPrJT+6DmpDFwwvtR7Gvj26lv8mlTi/mQWcyna+oL4EE1fheJJ89W JsKWBqbgHYffgenc3D+d7e8bLPunme+FK9xs5l2APzcr2XZwvaOktnC/jGN0PGA5mJRz abGj8aLabXuvmLP+mHr2y8vvee4f77dcM/by1bN+4ffGPnhqz/78ZAS4PeSJKOkhs+ni eR3zNk55c9qsnRsfftpgVF19eWc22jp73zNyqw8em1AAcOnA13I3I6q0Art+x9rPg95c ia9yKslTcMI8jvsLuO/DXYn2DL4+04EI8XUlYkDY12kf4Yu1KCVoUSJvwJkiNpyVkcEZ JWGcQ+LBt2XsS2mKr/gVSJQ8AZ76BPDzAO4HcFfja7Yk+nrxjAgngwffs0Ug5dj47HyA BL6Lw0rgizczOQ89z0Wf2ehxDsnD193Xh8hUFncEiLJt+VK46gD/2IR9aMIbOLSjJaOY 77+LzBgkNius/FicG8NlrBtSiihYivDglj37btv87LM/bXry0tepTv77q5c8WLDYn4vH ajpslg7saNzvc2/ee/vm/ft+8IP9wk2Tpsn//avD8sC06We7ncxpI5EAAnmtNsx6MXCv GriXIeuKizZ67jA8EH7EsF3/gHlH5nnDofD+jBbh/pSIJumsigsqrqjo9qz2rK94pOKZ ih2ePT6tz3EyUmH6SEp9HXm7usPcYe80d9p3xXYlDsUOJdR6K8kHVZ3WRHwO22tkZnF5 Y6QXO84IH+R6M8O4M7bQ+MZqORyBRSZxzoPQQoT18m3Vu2Nwecdi7rgnt2n+g688f/eE tQ2WQHvUH5ffefKY/CEN/G7GA+JiKejPTT8Ujfrz55z7s7vu+Xk0qnPVx/1nPUHtv/0t dbAP1OD/wPy3AcciwKH32ucAxwxYSQNwTIHzKtTAMwPwTIGvt9XANQOuHqy/CWKgBpgn grCZtvcRQnZMwDUnaj9C/dcov43SaWDPN+jB7NcOYEon7p247wZO7wb2HML9ENec2C53 Gm/hgyuZ/YIZI7PRbeiXxq/FUT8XLecBzxP4QnMOw7J+BC32IpKf4dgQTYOomcdhJIZB NI/hzkJ8ZMMA6BiJTWUSDo8McxTvtpna9l/y89PU+OuLdrTWz61Nxo/43NX5TCwwuGfv ptv2Prt5y9M23+zp59LKX71JLVMn0/UIWQVKffNAMAK77uXb9jy3ZfP+gxzGywHjBfiy 3ANq+nn7LLIc8LwGaSdPdrIL89uFtTiIMjvngVFrEFcboNdDbgT9UqQ7MNZHfDywebR9 jV5vA2IdeLITaSfk2y7Q7S6szi48cQDlQygfQvkQylr+1aoTI3gBXQ+g7gMkNYD1PNQw ap5DIkNYCojiP76J1z/IImAZSIGnbDMjUpKEpZ1+DlFQLFz00SDnm9Sq3rd9DaLgfVBj ut+5BJ+X0dDnb1N79mLDqWXCZsOudRsP0sd++NANMY8358jXUdWxD6j5NDnYFLv52jt/ gBfE274APaZV4Yedekd7LVafnWzhBr8LIvcRcuwLjx68tQF1lNipgLrTwDwCfFOizog8 PvkADLQoE/CnLEoszsWB0eK4+0DzcdTEASMtomIKEBD4ZqD0gdyQ/47pQdjAhFsG5AqI MAfWKK2mpJO3lkkYkEAFxIf3289rxG3JdDJ+6ip23b0jWZ1KPPybT65cURMxb8qvupBe mExnYvLOOyLYvIrgIixF6Fek48DjhXp/wnnB5c0QB/FTDzG4CGSjvEraKD4Mumkkf29f AnpNQecLgGZT2BMP4GSYAL5+T5Hv4P4U0uPIv4D7IeDePuRZzEQamzhZOPz5WVwkBPg0 UIIaBuGPgAcMz9hZIx+hzUwZp/8acQcS9to7AOsOYGkn7p243wbM2Q05sRurcgj3Q7hr MHoOymEWv6XBb/kA4Vr82h0oP4MkIHUC/nHgcJQ0QSHoP97F3KYIzC3tG/f39yEGYwAQ BxnzlWD+FjoUoQUhzL6gGyGXIadLBM6tRxA42OmQxk6FaTfv3Hnz9378Y5rzhJr+Y9NV l9SG3Vd6t35nzNbFz/9z8NDMu6e7vfclEoWJZlH92E3rH398/fodp6p/sCYzbWYm588a bn1i7eTx//PSL041t0yxWcPhRACz72Z6NvhmM3m9fQpwLQ6M04E7MnsvAoxi82P6GEFd HCedGAFDNTA0DZiyk0kYnhYAbw/KYbb5grwTz2VQyyDXDJixs1MaAEMGMwWe8EO+hrHK TnBCC3rN5esZR9u5KC9E39noNZ+0QP6CDcLFWArnANp+67livJJFi8GyGsCHn0MARnWu 8Qy+yP2y//q5TClIdohrlqye2gFLB1jk/W7f1Dtm3vfTbCGTSMhfZYPJ5vClyy7aHm5L BbPyV/F4tmNLSfTaLXJrR/sLO+VWBH1EuBL/6Jp1ty2XF7PoECaiGa7vBIzPViwGrsfJ 9e0pXMOAFzufTUMVxAPYhoGVVYDPN5i/FbkAqDsCSOLLS6yJETjM9JcAoHI+8kXUUL5O cfQLoF8CNI8d3i7+fQiDDFIZQGxz+ji+tRnakysRtqXkmih7qWqHNuG5x0LQxotjE9H2 YrwH5lo0nB08kUikUjT/SjKNLxuibr/0wmVN2XlzkrHByiD2qUHsIeEmOPDDdgub7+fy GnEbn2+KXNPOThGIcRr1Y8X5rIcp1I+5MxjEMH9GoWlQogdzi2PmSswsBnwqzVmHXBi1 cYyEjxkQ34UPfUvaVzlEA9FOnM4w+TPn+q9E9u0ngkwN25xoHxOPFNsT1OALNf/Hrasu BWFd5b3rO/LaJflEQoizCa9orpk/Lx7/5tD6DaCnGkZPt+wU3kSQG5s0xakeRLofdNRG vmqfBEzO4PyDDCIvqsl4zKoT+dm4b0P7Nvjn2S4NO4coAEhYscJtaHehneDJBEarAI+v BGysJIFrANCxguZaMVoFcKQOreyJKjxRjVoEvuFJpvs0IacG/TAtJA55qSNjmLlQ6DsK ecBYEAgGoWIsRBoEw/VZjijML2EnGcreGWPi3oq/NpJmNUhtvAVHfODOvULMOEZ0JbOU 4QDKwb/Atnr/JbiMqbmm0neoJWcYQnT11EDP3OpspHRPsKonnsjOzCXnFJLxl9w+ioDi TIoaYokllorkhYU76bo56SiChf47k4jH5ffoevlYIldSgpnGYrecqv1SH3L48GV7m1YQ FPWZ9fhEHY4HX9Ad18HAp+DqRGKnuLjJ/HY/IIkqyNbTw5RXojU1WlRoYnSIz9gBSSNq 4ojgdqDWwWsQI93b21X6Ug8A5JyIEdooc3MUkQnh3UvyyTidhum1QLZmT4FLgLBs0pbS FJjSVSIn/CrlcbWfQt86i1a1X4oT4ZrIPXinu/mZWAQS04qZKDmunQVpp8dbj4E0reU0 w07tOgkPYQZzrAX+FJH/GjIvxTgPen4DmymMZyYCP7G+0EfHI7WRZUhrkJQ4yyOO+U5E vyn4rWrIwjrghhdPMY4zBhoLOxVLD9gombcGvZbiugh9AzhrzY16JtUvQGsjSovw/FyM yKiA1TFr62wWmNKHPXQj2zo3DvSVmFaJfUGIluL2WMh3to3zeexAslA2BnDG3YDPEKdn MHKGgWOoaSjasaThDfnih3YomUgt7WmUrkPCgaOveKx27LS55jHJUHh92t/RWj3dHW1L hXLg+9Fsh9U8qTaReCBoE5Lnt05aaE9dPvmma41jU5Hw2kRMqN6y9MYr5cXs68rEeC/d OWv63Pq6U8eYLIAb1yvcFEiEw45oJjVm7Li2J18omcg57CqV+Md62G+t5M32aeAIevAB NVY4Dd2CnfzFrJOToGguibGeJqxmBmvBTsVkMrgW68pkRATQ90BvdOHZWr5qlRiHneLZ Cq8EO8GzCVpiZVkSlyzdReg9F/3ZCqXRVpLEVkjiJqwX2/SaT9h+/r8VxmwhhtK/kccj pDHcZd5y7O0IfwNXcUxnLmJp07/2S0jjVDa7+FtxnG37oBhJtUAaL38Q0jgy6WBDMglp zCAbDdotHUPCOB70peBWHBbGKR9bAMx6AWyYq8W9wE4HmVisIx8ZlB/Zvja87exQdVRM V0ynnTgIZKFiId1t2m15wvFE5SHTIcsBx4FKo5jQdWsS5jlO7l0qCR2wUejR5eBa7IhR ZvGXzFsiLN92+NUHHjjcK/xYfv/zz+T3aeSzz2j06lfuu+/w4fvu/yVd8K78BTW++y41 yF8AxgIZD534ZujECcD8j+1zofdGkOLQfb3QfSNIcei+XlAPO5snCqryYBZG4ArDABXq PkJtFnjih0eZ4FwvCR+giPCeqFDzNdZ/Ouza6eABC3FfiPsTsEN2Am8O4H4QdzXkUQFj mjCmGpzOADgxXsi4YAa/GkKOaXtMuoTAL6xoZ1b2OaSexQUy7XdIBjNVrbR1DhcKN7tK UagMWUC1/ztllnAEphg8BbH4GdDt/iIWi2blyYlk7USLZWJtMgEHSccTF7xO9afJa5fu baMNm/fuu+22Pc+cJgjyC0Sg40p6RnRW25JJk+QvjhyWp08Sntl867N7Nt22h8F8FmB+ B7dD6sj78E3txtx/gtk/Dkgwi/N55PchrwTndWEN8G00IC5CM2HaGjtR8iOUI4C2F9T1 ESjva8hPEfBXES/gXw+eq0Vitq0WScAvmDGymfPAFLQZ5o3CGmEF6rAqeYzrRYnJdOYD YxoP8xikAOcoIM74gAUWLuDNeCcDOABaIsD/BeKsERt1Iz6OoyZmdETKXoSRRsYofXhw z2b4pzb/4Bnh6rF7VxyWT1PDf5y/Y5Lbd18ilp9gYT6qhDwpG03E6Gu3Pv3spluf3Tv4 NL1j0nT58G+oYdKkJTYrduID33yJNYgE4A/E+yOeEXL4CvC6NLm5PQtsSgDjPJzTQdYy vMVMmS+G4SzD4SH83gpI7EDaj8ROXGR4yrDUivUxlPG0hJtWYGcF6jJML+4FkPj+ZTky HuoP9+mVGFcueoaUHo40YkJiiF0N2cIqQaIzmEZ86qp4Ipl+umNJLp7oc3su+M218y9v DDpWpmf99BLENw+pxEw7tFl3X7t6SnO0ecwV12Hue3E2jgNzL9KF7fcg/LAAHdGE9S1g TU04362VfA+Y9j1A5XuAyWas9Sbgygbw8u+jz0Nov5vrAG7cPWQ72h9A+1a034v2e4Gd DwBXfop+j6Pf4xjncfTbxWm9EtDLAf9qgNWtwOoqJDeSB/iYgheiGpDNA/YhpCBaMsBO xJJAClRgbDPej0kPJ+cHFVifJpxJF8XJdglgdZQW0f8jPOHEqo1F29vkSqwNeAda2qGT 1uEXKsFlmO+iAuOqMSbOoOLj2rCay3BebhCWdZAgLAx9gqCdLGoJZFw702IR1Mk+XoYT ljFftrsx2Nvf38VcZEPWNacDIHsj90OOCGYoa6bgOqUInTNCsvnhP2d+ULU3GE06jZWp HUsvvfGiGxrfePetn898VKoYiwOTAmFfxm+tv+6c86++5pXf/uLo/uYfXBoumBAjsjcT awqZGtrnTJrcdvstG+5KxwuFNfXZ2rA5nz63OK5BUtyy5ZbHbC6Hg+nrFD7LAelC6RAg 8mh7CyzxSrIaaQPSVqQdSArwAgcg5UPSgx9kweMzeJZpXSfR4kddD2pi3KsG0qE4MQWQ z6MmAH7OZAXTcUXkTXgaXw/gz4B6ioTvrrpgDrDPi0synO+Ed7XBYCh5iYYEO/h12Vlk 4lxkhOOMfT0DhWvIeVSOGcaxXtfmq1MpecV5Fy2UfZ54vvXChyaueSRuNe1OxerOWxWN Z0Jidwg2o7x3x8WXJrzBvCMemT4tvLjbT2cB+L4j9elkYf6vGZym4ES8q3HWYp482c7w kXFHEZifB+4wrZedXleFGubniUHiEWCyHnwjBEhYwKWrMOdqYHgUOSvgYwBuf6u71qCe AJ7Mj8T0Ugeo0QzfJuO4TM5FId0K4LYIoIEKVGa2jHcMwYztvwCMDA85wJhaWvbCDsOF 2UElqJU01JLTZ2QzXXnp1Su3b4qHY6l3Yv6aPHxs8EMs3jTjiSdsHYV48r6wm6767urb LqYPBcOxSLB4anYgyuyejmmNzzxLf8mknIftB1OSPP2B9CjgFSM/ao+DJxhgc0ZBo8zL qCxjho/rDdAdOb9VAlphQCuO52OARABwZVukKkBKBMwYj2YnCMdh9+A/bkmW40AwaQh0 ZkCasSk9EY/GMIgROTaMn9fFsBwTUYvBR++t4uwaRqslHpym/y50gqkBD46HJU6dzbHC hCiVaLBtZkOsmdYnEvnxZvmgK59NZ10il/R+bCOfWivcgk/v/MzHdSreGAw04afp6X7A 5S3ApYUcbR8HSa3CGjPdluCsaYgkzDEMnPFgtswObwXHoujLvK9+pFrIaRdgoAbEMpiW BLtGAsxa0YNFTLjRm+1XteC50jmKtaBgHcqXgGovApVT5CzI6QiLwUAQBtvDQzwNvmZi ATWvQn6XYwTM8AhN5G8Twb0Wf3XEjRzT+KpwV7PfZPv96v7Sle3wsyPKGKzOjK6AvZ3G qazcC4bQjCFGWAK4qvyIsPgmbSIRSRj/oklF4zFa0RCzm0zVgZanbqpIxCNJ4w1PONMT c5E6qvP7I4WPK+PxSEpPB+UooisKwrEggtP9cWdYUkinnqT7EYuRlxcL8+AQ82EXISCc srAqhmzw7Ek4n5ZMoNfApm0AvBqAJmtwvxby4BakTbBEbwH2bUAdi7u9B7Pfhbr9uOsA 2SA0BYJ+QUB2AqRmEN+5BHGy6gTQbAgnsE7ACBMgBSeAphO4sp5GrBQiJdDuxwqyHZ4k cWIF2zGmHjVMf2YrbQCXzKMugJ7jUavGGlcAoVeCf6yAVFuJsgdXG0oS7kWUz0ZajCQi VZAOkEcXYsKNn7AIhNL3B+WvYYYWtwaTn4gAj4n4kVJIx0ROL+Px4yHU5vGHf8iVQj4Y LbEnxiOxV2PBIRMRswBaQzLhRZHKbbWMvoAXpbiP0VEgLNBy1CcLwxQ37Gd2NJaY+Qia /JZzcV0xTjd7C035ernfl2hotdIO+Zf6luraKUca8o116veO2Joacg1U8scLjR75Y3q+ NpbKTX+jvpBLNQ1uiYYioYQvGsInxPV+bhiHIm+/HQzHw3E/viN8R94dRXsoEox9xfCl Gfr5FuBLlrzYXgDAAtClA2QZ0nK+qsyHlgMAmI7YgxXMYrV95TWGXok1ZhZQDqBkJ6Bm 0at00qkaNGwFV7wIdwnr5uY52MBYP3jLjKXFG451Y981lGOk2HIwwLPxGMNjC8F2HQiv 9aOEb9BKQSR8JeAnm89CXEtAHPZFWOCp+Hecr7wOKsGdnloHf1dtNhqPH3tMvpNzQEcT 54AGao1PrIs1f52MZ5pOE+iZXLum44Q3mRzgPPCYwEJrwANBf3g5wPI10J4OsIxToX0p PDsEumcc0i4O6rGSZSivxX0teNRaSMBNyG9CnumfDyD/APJM19yFfGl/zgyIW5EsSGbk 8AEJbKA4OKsFnDIOurGAzuKArAUrw+yWOHoxr2YPoKfASriwegrAzoU1QB6rxVZRATqv RG8r1pJJJCWJoL8OJQrSiIAqbbgbQYkJrFY/DgYocA0QHxjgHCkoiZDOEEgvcRrCMFgS pvYQxipZRE+O08HIzz1L7v9GGix5x7kWU+aQdAv9EvAN1Y0/9XhTi6tGaJMRmRiJTJgi OCZNrq7eUjcHHqGd1fGajDtXI7TWzoVNtDsZx4kBUxmjAi6OwXcDW6CvMZ9DmBTb7cA2 /H8PaAwzsgFibPdTB33ejP/TA9NBcOgGz90NXToCSQFucvwTTPh4G763K+QaeQxH6U1H ntc2Mj/m3OaWc89taT1HbJqN3OzWlnPk7s7mltnntLacu7LUxLKsyzmtzZ38zuzhPwgv iK9Lh7EatWRtO+OF1aAQpjtFIONcWBUzIF8BbYBpoV7MIomVZTYytqR5X9bTh5YqrFMO Myw9w55gO+GMp9rB01VouQftOAwM4cpsWwdq/bdHxJYCBUEfjfwQVIe9thz8XQ4h/Dct 4mKV1bmnQi8J76uNaoUa/68gXSWlshHVT+OoQvEPGqNWoRaERhQE4VOPQasSEQN72KAX BJtk0uLgD/nyf6mVtFChBXJC2Cb+RXoMK5In6wCXPKQQ2yELY35sl99Uhgmz1/WACfOy 9oFVf9vPizoXZl8DnP/2iSGY2ACRACBSA4xg0EFQMjvtC1AZBZnhL4nKsrt83CM7xWqI dZSE+nDDhSqr62mtEQDA0SWCStWkw4TpFyoLavWieExp0glKdWMlDjeRrvUYKtSAitxa WUlFK451lCoUdOu/1AJWWErAhf9DfNQ1pdyoK75KARwUwOn/29OovcCdEof+vz2JunQO NT4igte6dAL1eMiI/7fTp8+D5jAXEQPzcU7+Qninu+D12Q8/GPtHsZ6U55RMrpw3vmPu 1OnpCVesueqSZVeVW1g37PnQ1UjQVOhWpB1I+5F6kY4i9SEdB5AkJCtSBKkOqQOpE6kb aTXSBqStSDuQ9iP1Ih1F6kM6DgBKSFakCFIdUgdSJ1I30mqkDUhbkXYg7UfqRTqK1Id0 HDxfQrIiRZDqkDqQOpG6kVYjbUDairQDaT9SL9JRpD6k42CbEpIVKYJUh9SB1InUjbQa aQPSVqQdSPuRepGOIvUhHQf7lpCsSBGkOqQOpE6kbqTVSBuQtiLtQNqP1It09HT5H1uH 4TwFjZxZDo0qh0eVmTEy8nkmT0aWE6PKLJpoZDuzEEaWOUsf8T7MGh/Zjj2yM8o1o8pM TxjZn1lsI8tc9RsxfmFUe+2oct2ocv2oMtOwR47fOKrMLKOR7c2jyux095HtzP4eWW4b VR4zqjx2VLk4qtw+qjx+VHnCqHLHqDI3K0fAa9Ko9smjylNGlaeOKk8bVZ4+qsx2ukbO f+ao8qxR5bNGlc8eVT5nVJlFPowcn/kgRpY7R5XPG1WeM6rMT60fAR/GkUeOx6zfkeWF o8qLRpW7RpUvGFVeMqp84ajy0lHl7lFlpoWOfJ/lo8oXjSqDB5/Rn1nyI5+/dFR5xajy ZaPK8E2f8fzlo8pXjCpfOaq8alT5qlHlq0eVV48qrxlV5nJ1xPpdO6r9ulHltaPK159Z DozihwHmsRgBrwACVgj5fwAH5e8+CmVuZHN0cmVhbQplbmRvYmoKMTA0IDAgb2JqCjE5 NTM0CmVuZG9iagoxMDUgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2Nl bnQgNzU0IC9DYXBIZWlnaHQgNTk1IC9EZXNjZW50IC0yNDYgL0ZsYWdzIDMyCi9Gb250 QkJveCBbLTY1NSAtNDA5IDc2NCAxMDg5XSAvRm9udE5hbWUgL1VCRFdJSytDb3VyaWVy IC9JdGFsaWNBbmdsZSAwIC9TdGVtVgowIC9NYXhXaWR0aCA4MjMgL1hIZWlnaHQgNDYy IC9Gb250RmlsZTIgMTAzIDAgUiA+PgplbmRvYmoKMTA2IDAgb2JqClsgNjAwIDAgNjAw IDYwMCAwIDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwIDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwIDYwMAowIDYwMCA2MDAgNjAwIDAgNjAwIDAgNjAwIDYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwCjYwMCA2MDAgNjAwIDYwMCA2 MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2MDAgMCAwIDAgMCAw CjAgMCAwIDYwMCA2MDAgXQplbmRvYmoKOCAwIG9iago8PCAvVHlwZSAvRm9udCAvU3Vi dHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250IC9VQkRXSUsrQ291cmllciAvRm9udERlc2Ny aXB0b3IKMTA1IDAgUiAvV2lkdGhzIDEwNiAwIFIgL0ZpcnN0Q2hhciAzMiAvTGFzdENo YXIgMjExIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNvZGluZwo+PgplbmRvYmoKMTA3IDAg b2JqCjw8IC9MZW5ndGggMTA4IDAgUiAvTGVuZ3RoMSA0MTg0IC9GaWx0ZXIgL0ZsYXRl RGVjb2RlID4+CnN0cmVhbQp4Ac1Xe3BU1Rn/vnPua5OQbB6EhRW4yyURyS4hhEcCGJYk G5Ps2CYQZBe17OYBiSQSE6Tgg4kiiptEt4U6o1UBFeWpdwlIQEYoCmbGdtQZ7Wih2s7g 4FjijFWk06lJv3tPyACt/bv3y29/53uc75zvnHNz713XcX8TpEAXcPA3tEXbwb5Sa4gm NKxfpwtdOgAgz1/VvrpN6I6vAKSVq1s3rhJ66joA3NrcFG0UOvyLeG4zGYSOs4mnNret 2yD01EpirXVtw4g/tZV0pS26YWR8OE+6fm+0rUnEO73E3va1nTSOdaVZ+We2dzSNxGMI gNfBfjgMR+wA+kmlKRExTIF86CWVgZNaxWS+JK0knyVUlvp6tdR6eWXawsuaW7M77z64 bchqDGwtofqGapK+UAtITbHjLQf1UwuGaI2SewCGP0j6YtRjea2L+VOgooIaGemav1Lv Z3MPVc4i2mwTHhC0X9BeQXsEvSboZUG7BO0QVCWoUtBtgkoF+QWVCFooqFiQIkgSxAWh /+c0p/OEc4Q/Ef5IeIfwJuEI4Q3CQcIBwh7Ca4QdhBcJLxB6CJsJDYSVhH58Q6Q+KGif oFcF7Rb0iqAXBZULWizoVkFFglRBsiAmCPx+GukzwieEAcJ7hLOEM4SjhMOEPsLrhJ2E XxM2EhorZ2U5shzz4v243l+lxnep8W1qvFeNr1XjrWp8lRpvUuN3qfEVajysxkPqVG2K pmuTtJu0CZpLy9aytAzNqaVqKVqSpmmKJmlMAw3MTB5kwaWlGDRPNUCwXjd/WGr0Y1Lt ClM2StHMCEKwrtRlFuWZbGs/Ql2oH4cTiE9tcZsZZaFjgDi8pdc9wuEwZOf95+W6zhSs 2XgCJuM8UOm3sE+d/K5K/uBSssZta9yyxm2rCw/VwKxgtDsyEa5LcqOCNxp+UsdAi1Vu TSihQWm47C7BfSw5ieqJuD3h0mxne4ld3AKPa5P7uAS4B5LzwmaKUWqOIVh1+xb7Flsu iW4jcqWSOW3E5dq0wOM+jntGXE4yp9NSWjfW/9X10U/OpgAKoAFD7BG2glq/hXr6fY7Q SHgWtsN21kctioFCgkmtargoD8As6LDthfAQcTn8gxbucduyEOrJX0/RZ4hLyNdAjORr gO3YY/PD8Bjl/pb1sdPstO1dRHmrrQghrE8eILs18mZ4HT7HU5ThQdhG3mPwkdWLMm+H g3AFp5F045c4yGrIikDjU541FL2d5vs2fAbfYRaWYAxPUEwGe8Seixiti2LOkHxkZ7Ey 3Y6tuBY78EnKeYFxNoeyrmVb2U5mstM8LJXIA0qGMk9tpSxI/6k5pFOFVrafwVIauR7u o2eUyGplPgMfIsNarMNmfAZ30hzO4CDJ98zHFtGqW/IbHpFSpK/kNfJLJAPKMvUFTaHc MigwAXTIgdlUVYDGqKXKGuEeeMCWB6nGh+BheBR2wE7YBXshAcfhd9aYcA4+hyu0Omkk Vl3zsBiXk4RJOnATPkbr0X2N9OLz2IfHaX7v4ydsMlUtpJWqF7PczJ5jh9n77PfsC3aB fc2+5cAdfCWv5518N9/HP+AfSJXSTmmXdF46L6Ns2iuVoWQpdyvdJD2qQ12jPqb+Sn1B fTNpBoyjurxUVzUsp6o2UiUPwVaI2buWoEqsJ+QRGICvrTpIhkcqsaopxnKswGUkYVyB EWzDTtwwWtEr+CruwcNUyyckn+I5/Cv+Db+x5QpTWDbLG62vhi1ly9ka9gx7lj3P9tOJ 7GMn2Kfsc6rxArtMNSbzDD6WT+IBXkFSx+/kG/hmfpCf5uf4IO1binSrVCItk+6m2s9K F6SvaCeZzOUceY48n6RZvlfeJHfLL9KJHpQHlRQ6P5ZkKguUJ5QdSp/ymfKjOlbNVqeQ zFAL1KVqq7pe3adeUC9qBxyLHS2OjiQv7IOZcPSG+/gIne532N1KPkzAc3Qa7uNpFKXT ep5hKWqro4X1WbNTl+I02qk/wxXugKB0FpbzO6FVrufJ6iXYg53SI7ifV8AB2K2uxxM8 wgf5bjlHWSDOB3uO71M3qhH1Is30e75NblZn4GK5G/ewRXRHd2At/ICX4Rc08jo2Hc7C k7AV19MDZ7t2AMfQHXyGTcZu+SV+SNrJA/ImvIV20C0P8C0wB8bS28o0mEJnXYYsAvjn Fc2bXTirYGb+DJ83b/ot027OzZlqTPHokydNvMk9YbxrXPbYrMyMdGda6piU5CSHpiqy xBmCN2BURHQzN2JKuUZlpc/SjSgZotcYIqZOporrY0zd6hcl13WRfopcdUOkX0T6RyPR qS+EhT6vHjB08w/lBr1arKgNUbu33Ajr5qDdvt1uS7m2MoYUj4d66AFXc7luYkQPmBXr m2OBSLnPi4nkpDKjrCnJ54VEUjI1k6llVhjtCawoQbvBKgLzEwy0MVSjWW2UB8wqg7pS Gp4TiDaaNbWhQLnb4wn7vCaWNRj1JljPrDw7BMrsYUylzFTtYfQWk8qBbj3hPRXr6XdC fSQvpdFojN4VMnmUcgTM9DzzNqPcvO2BCy6ftx9frQuZjjL7DeEYVA93Jaq6ysvD1mj0 uHzCDh9H4eMeuODmsYCrRTdJjcWe0M2dtSEr2VWvx4oJhympzxtcEvLQrI1Aj26VsSRk V0BJ0ZVPE7dsVpmi4CYjYFki9+imwyg1mmP3RGizJsRMWLLRc2hCtf/Y8F+gOqDH6kKG x1zkNsLR8psSWRBbsrGvyq9XXe/xeRPOdLHSidS0kUbKmGsbTbQLwme37HCrRbO+utRo zcioMv10xhp0mknIMFlOkfXTVASxhiLaEbrCSCvaQusXiTnnU3WmnOM09NhloINgDF66 3hIdsSg5zstgOa3jMnrkTIxebZt5eeb06dZJUctoa2lmJbY+x+ddbwaNdqduBmnJoCZE ncLz82nJPR5rl7v7/VBPitlVGxK6DvXuQ+DPp1cdFrE8p656xi6zPF1XPaPdIwYd58P0 OAQYa2q5o39pzuzMQPN8E7P/h7tJ+On2CegJSc6J1YRyo7Fud24k1hOmU11Bd3UsVmHo FbFILNo/3FVv6E4jlggGY+0BuhtFSf3Dp7rdpr8n3Iy0qGahWA0zsyzE3cw6mdRibh72 WW9xXcpJuIMmK76rrO8lhQDgGbUA5MK7ZGH0LAfeRW8inF5hDX+a+jFKH+PL9FE5DPIw P4ZfAuQPDToHYdE39FswszDdk57jSfd0cfixi8EQyAP/LOqSBuj7De4YPqc0y4OQTM8+ g77wFkDbUdfEiS733JlT38J9MB3cbIE/yZPyKGQ8qkz3KP245SiM3+CauGGS7y3cCzdD Ie71jyke+zRPe9rhurl4kuQ4xjKA5w+OK3bS+PkjAvmDxaOG4uL04uL8/IKZsg7pTvDY vznXtHlhhkfPLFQUY0pu5pTcObPnFs6if7KK55o2Xzn09lAxvoelJO8NFQ+9jeOxd6hz 6CJJJ/a+cWuV5aoqGffdyZN/P15YWVk4u7IK3yqsqiokJefanlamBuylBOPxqaEOkYI9 OHQSF3946RL+stLqcQ2sfbCv4SJ6+/lvF/mROTrbWlqbVkUbrG9xhAz7QNLXOrgAVgTK 76gK5C1vuXd1I6HTt6Rp9f2t0Q6AfwMO+PCTCmVuZHN0cmVhbQplbmRvYmoKMTA4IDAg b2JqCjI3MTMKZW5kb2JqCjEwOSAwIG9iago8PCAvVHlwZSAvRm9udERlc2NyaXB0b3Ig L0FzY2VudCA4OTkgL0NhcEhlaWdodCA4MjMgL0Rlc2NlbnQgLTIxMSAvRmxhZ3MgNAov Rm9udEJCb3ggWzAgLTIxMSAxMzU5IDg5OV0gL0ZvbnROYW1lIC9aRURWSUUrV2luZ2Rp bmdzLVJlZ3VsYXIgL0l0YWxpY0FuZ2xlCjAgL1N0ZW1WIDAgL0F2Z1dpZHRoIDg5MCAv TWF4V2lkdGggMTQ0MyAvWEhlaWdodCA3MjMgL0ZvbnRGaWxlMiAxMDcgMCBSID4+CmVu ZG9iagoxMTAgMCBvYmoKWyA4NDMgXQplbmRvYmoKMTExIDAgb2JqCjw8IC9MZW5ndGgg MTEyIDAgUiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFdkMFqxCAQhu8+ xRx3D4tm6VGEsmUhh25L0z6A0TErNCoTc8jbV23YQg8Kzu83fg6/9C998Bn4O0UzYAbn gyVc4koGYcTJB9adwXqT91OrmVknxgs8bEvGuQ8ugpQMgH8UZMm0weHZxhGPtfZGFsmH CQ5fl6FVhjWlb5wxZBBMKbDoSrtXnW56RuANPfW25D5vp0L93fjcEkIxKkT3q2SixSVp g6TDhEwKoeT1qhgG+y/agdGZuyYmz52SIMSTBle3RuxZZesfH05mJSo6bRDNtBr4gI9Z pZjqi239AMHwcBUKZW5kc3RyZWFtCmVuZG9iagoxMTIgMCBvYmoKMjI3CmVuZG9iagoy NiAwIG9iago8PCAvVHlwZSAvRm9udCAvU3VidHlwZSAvVHJ1ZVR5cGUgL0Jhc2VGb250 IC9aRURWSUUrV2luZ2RpbmdzLVJlZ3VsYXIgL0ZvbnREZXNjcmlwdG9yCjEwOSAwIFIg L1dpZHRocyAxMTAgMCBSIC9GaXJzdENoYXIgMzMgL0xhc3RDaGFyIDMzIC9Ub1VuaWNv ZGUgMTExIDAgUiA+PgplbmRvYmoKMTEzIDAgb2JqCjw8IC9MZW5ndGggMTE0IDAgUiAv TGVuZ3RoMSAyNDkzNiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHtvHlg VNXdN37OvbPv+5LJMpPJzCSZJDOTyc4kuUkmC4RAgABJ2BIYMCAqyCKoSBQjGBRFRdyq tLK0tH0dwD7FPq1NrVq0Yt3K08cugktrVSr6dENheD/nzgyLj31/vz/e9/3rneR7zrnn nHvv+a7ne77nzKy9ft1SoiajhCfhJdcMryLip3gDsseWrF/rTl+bcK14fNmqq65JX7sc hGj6rlq5cVn6uuQxQmq/N7J0OJG+JueQ14ygIn1Nq5AXjVyzlj0Xn8BKQqhm5XVLMu0l FlRuu2Z4Q+b95He4dl87fM1S1puQ4S4k7lXXL820035CjAVXXvN95LvkafID8QYkOrwC WRuZIOVkN5ERjhhIiGDEynnGAuBLxXbpP2eWSfckF+ljfyMuhXjzM398qJEVjjXmbv1r 1Sfdts8cn+JSiSekP3iu/JFUPSH2wb9Wnd9r+0x8UqZRzNqeIW6aelrpoFPcR+kX2cLZ bOGf2cI/soW/ZwtnsoVPs4W/ZAuns4VPsoWPs4U/ZgsfZAvvZwvvZQvvZgunsoWT2cKb 2cIb2cLr2cKvsoVXs4Xj2cIr2cKebOGebGFHtjCeLWzLFrZmC3dkC/OyhcFsYSBb6M8W +rKF3mxharbQnS1MyRZqsoVwthDKFsqzhbJsQZktyLMFqXBB5NxfxfRzMf1MTM+I6adi elpMPxHTj8T0AzF9X0zfE9NTYvoHMX1bTH8jpm+K6XExfUVMXxbTl8T0mJi+KKbPi+lz Yjohpj8V05+I6RExPSSmT4npPjHdK6Z7xHSHmN4tpneJ6XYxHRfTO8V0TExvF9MtSIWm Ke5R8WqzmN4ippvEdLGYzhDTXjHtEtNWMdWxVN+yRNJCCgAhQDNgOmAR4DrAZsA9gCcA TwF+CvgVQEsW8R9BlUb5v5J7AXsAScAE4DXAScAZgAJPjeKpUTw1iqdG8dQonhrFU6N4 ahRPjeKpUaLCGKrQuwq9q9C7Cr2r0LsKvauIHG/1kncAnwJ4okdaAGgGLAI8IfEKXumZ d2ny/MR5buL8a+dPnj9zXpLO+IkLr104eeHMBcmqFpXEh2FPIH0NcBJwRuITNJKTz555 lhMTfYtR4sGDPcwKcf3orUd6EsDhtSp2LVE8TfV+qm9xSeTitQzpZs4u9n2MFHCPkRCg GTAdsAggI+8g/RRwgXtMmMW/c9Jmz33r10huutnmuulm5+tvoLz+BiTXrEKy8jokV19r c1197ebrc9aus1hzr1qBZNlyJEtHLK6lI2Orc5xrbDe2OT0bAc6WCHcfeRjAkVykZazE Pcw9wj1KNNzd3A7uHuTj3HbuLqIhLu5hsh0AlJA+Afh3wG8BEm4f+hwgWu4J3PtN5I/h 3seJ9sKH3I7DFm/9Myg8wgotOdxt3CawOMjdyt1MpMhv4W4kEuSbMvmN3Fyx/gbuKjG/ ipt7WBp0H+VWHXa563/CXY921v9a1EtY/dwjkWi9sqWFW02cgINoRyX6LMfV2yh9COC5 27mNoGiQG0XO7t+MnI3jpky+kZsjtm/g2KwX5NYjZ+3rMvmaTL4s028tctZvTSa/jptz WB4saenFNSV3sJRbwC3kFoGEM7iZ3Czk07jpXC9IqeamAWYQFbeATEJ5AOX1gHW4fhTX P0D+n8hV3HLccTUIugRPWop8CE9ajHw5iXFLAEOABYAZgGmAOBcTqdbGGcGoICdkrptw zbBu5IygWkeLFfWUdCB9EcBxk9AuR3s9ckal2kx/D/rLGZWjh822+hYbF8o0VGTycuSM jWWZ62AmL8WN0mBnSyuuKZEi3QfggG6UdAMSuFoLkHCtnEF8dQty9qRm5GzoDZn6ukxe k8mrM7k7k1chZ/dFMnk4U1+SyYs5A1AYb7kW15TkIH2GqwTKds7BOcEUNafhtMgVnJJT icxRgDlqEN+O0SrAHDWYowZz7GCOAsyxgzkKtHtxhw/MyMOTCpDn4Em5yL1gRB4gB2AH qAEKEqOzaA/DjE7L5HPofMYUOjuTz0XO2t+mb8G2BelvMvkH9CTDkJ7K5Cfpx+L1p8hZ /0/ox6C1cBSZUgVlm6CSw5FIpgClOXph4ulfFLjr0YM/XFZW/yPKM+/ocEGh9xlWPDKR n+/NVublZStzcy9WulzZSktOpjSqNmdKglKFEkfpEaF3O0oUT2SlFhUqCZlOClgVyzEy crh3tjgycsTrZSMiP8zLrxc+dLnEYf6pyFc/5yhVCGb6+99Ig5NOdJ/ghKRaW/+zCWkQ eAi1T5jN9cJjoXD9Y4/Q4KOPSIOP7JQEv/OwJPjwfXxQeKEsUn/fTj64bedDOznlEseS Xyzh3Uu0ejz8zNOdBb76Xx6lKiGXPrSLBmsfpw/u4oKO3f7SevtuatjVLNT/5y76Y1pD yzBfBGn48HFJ8CgNHX6FZeWHj/PIyljlj+lUOkXsM+XwZmnwGTqP9kGv9C1O2gd0+whH 76DbROZsRc6YfGcm30bvEW/cgZzV33NkTBpsbtHQPYTSV+krYuMbyKGG9HX6ymEZ46z8 cGVlPcuewhguTBz5Q77IVsH4O0dO/Usv88GXj0mCwjFPIaPikWNWu5i/CGqy6xdtOSwX vD8tj9T3zgCdZoDeHwCt99/DxXulpfXHX4EEvdIaF/u/Egiw/Iev2HPqn/uIAmvl4bfF FwvRj3y++nc+osLzrrz6I4ekwUNgjDDR2Fg/8ZQk+OZT0uBTm2Cu3zbZ6l/4CXXvoIYd lA1he02d+OjtgaA4lMrtePZdd0uDd49LgneOS4PjoONfP+WDn38qDX42ygXP7JEEPwVp hE8qq+qFT/A29pg9M2am8/bOdF4XEx+n3gPGv7OH7sGdrN8DkH/kwlujoM+tm2nwFoxq E15xGvCbzXTzmK9g2xgNbgXcjrdsAZSM1Y9NHuOXjdGOMVozRv1j1FVrddRYrdVWU5VV H7VqKq3KiFUWtvIhK6mwnv1C7z4bPsv5A7rigL40qCsL6gu9uiKvPr9A5y7QE6lBysUa derY2tjDMV5vMGqUKrVGJldoeIlUgwlCI+MTBatKqb6UqvXdeliKSSTOr+W/S36rl6mJ mlfrJ5FJygF+nnI9/yh5VPmw/j+J5hmqphqhVO+ieVqHPEdrNdi1JolFGzp73dknzu45 +6uzr52VNZ8Vzj51Nnn25FkpOUrVh0NnQz+iatJM1UKF5MvY2dg/Yn+LlcVKY8Uxf6wo Vhhzx/JjrpgjZo2ZYvqYMiaL8TES64320aSpm3T3tSbNFPms1mQ02H2Ud89MVga7k8re ef2HKN0xgNoktw363JeUbDvKITO1Dc7rP0qdrHnM9QzEmyS7h8buHggG85KJ7ln9ydG8 gWQlK9ybN0C6k5Uzki5va/DrPmvWrhOrka9Zm+6wJrgmXThU7G9PlrYPJ8vah+LBbK3Y Rtfgk+6fuSuYzdP3iimemb26WMhWXMozTSyjYi1Zyx62lr1w7eVPXfN178Ad5NKzrrgS n5jFKtOHZBFOX2daLz3hX9xzxRtwId5HWZp0JJvBu692OKRkTOyd2Zrk2uZ3JxMzu5P5 vfOGkjne1u7kMVzV9M5LarytGA8jJT7I165Zh4SBWHOIcG19hziWyJDMm9ffsoSmSIJ+ ATgL+CfgH4C/A84APgX8BXAa8AngY8AfAR8A3ge8B3gXcApwEvAm4A3A64BfAV4FHAe8 AtgDuAewAzAO2AbYCrgDMA8wCBgA9AP6AL2AqYBuwBRADSAMCAHKAWUAJUAOkArLE39N fJ74LHEm8WnidOKTxEeJDxLvJ95LnEr8IfF24jeJNxPHE68kXk68lDiWeDHxfOK5xETi p4mfJI4kDiWeSuxL7E3sSexI3J24K7E9MZ64MzGWuD2xJTGa2Jy4JbEpsTgxI9Gb6Eq0 JnSJrzLm/8w1VO//xodI74YDQ6SzEZMJihETIrGjnPnwP06Xsbz6BiEXzmTrUzMvlXH3 IaLlG4mWPYWzXjjDnSSGC3su75G971LOo0/6isV6GEjYZSvZxDJ8lqQz5OlYE/Ph//Xn uX/d9C9bXiUvkX8nW8T2H5Mj5HuZnt9D7GqMPEd+TNJRsgE4RLeTPUj7UDNIJpPZZCFZ jt6ryV6yL3PXYjJEIvgjpAkUHc/Uvkw+JP9Gz6Hfo5maS9n9eMv15Cje9CiZguc1kZ3A 9gFEz54g3eQOXF36nBCLJ7lhsoKsIQdIEvcmyIhY20NuJV1kPsbWQeZgTNfi7YPkKfI0 WUoOkYdR/2Mykzwue5YouLWMUxf+i2u48F9kO+5+kFuL9d0OfpSsJTeTx8kfCJb85J7U c/9r7l0a2L8s3UseAha3kx3g6SDfyPfyQxd5+y9vyjT8EPT6GWizAVzZD748Tu6lPvII 2Uo2UQ35BvkxrbyCOv9fz/u69h+Su/DsKz8/J8+AbvvA3x2g2Brw5dsYfe+VnRDOLKYq yM0KMkh15Auy6Kvt/1uuV0EWNkDibsN7rgfm/YiYRsg65COAddl3wAVuItvA9SdhFN9H fSu5hVxLPTRMXiTbqIPciP7fQO0D5Ec0jL5ryNO0mJyFVs0Dlv/tA3sAvRTtAdoUhNrI q0w3+S9YV/6jrD1gV0xGaBE5Rsgle0C9VAt5+yE5iPd/izxKXZQnfyOnSIqGaC44V0Je B7wIuv2I/Az0+wQ9HOQ/2Lrjq5+vjgV3bJcuFe0Euv73sUDa7758LNCLA+Qx6NcmyNDT 0PWfkfvIvyG/C1d7oEG7yfchA/shS6MY68WPdJBEQYOrWCrSQEd+nrFPuOYnWP2F1y8c Z63plJVSOy6Wfw1t/i30uRe24v99/h8F/i9SgJOfe0/6DjdZqpfSCx9LDsolqXn0bxjA Pmj8/Uhvwt9VXz8g/jz/ofSpC3+R/ijVKjVKi1KrUzdjLvsP8p/kV+QF8h55k/yavEz+ xIf5F/hT/OeSIYlMelz6LfIDSQW5gTz41adKrpWMSGZI9koGJRXSADQol/TArs7FXDVE FpOrYdeI9F55RHKfdI40wX/OfyF9CM9YCbt3B2zT/bBkRBhcmli0cMH8eYMD/bP7ZvZM 7Z4yuauzI97W2iI0NzXGJjXU19XWVFdFKyPhUEV5WbC0pDjg9xV5Cz3ugvy8XFeO02G3 WS1mk9Gg12k1apVSIZdJJTwCHmXUkXS09bevSDrbhuA7x70Gd1Iz7UxPKElMLo/X6I6G BsozvZLSYJKYu5OW3v5DRKgbSMqCX+0yLcn7DJ97cHOPy92elPjw750ynEgWz+z3eA0n XBfbB/DYZE5bv8fjSnI+/E9GE/6nDLsTSUMv6tEg1kxOkt5+BkcvvFuHSlLnGUA6sz+Z n70cYE9Lo3LZIJ+BbZr4yjCn0XHDIY2zLZ4klkNE826SWFm3M3XwJ2LJYiwLfQaUxKeR UJJaPk9Sc5Jae4DSla9gt52s+xoatCdWeNsTy0HRxNAlmp5JU9TjHnePz+w3Rl0ejzho rFxm9B9Sq9q8bUtVwAJLS1SQQyo1atSsAmxZdYhqmqhY4DTtDYc4otCCfCY23HYGK5LC 9iEUvHHQDS3mSy2ILNx1eRPBbelOBN3EEhXfmZS1JeXpQbiXJ4XhJNnuPlQ2MX7XUQNZ PBTUJLyJ4fn9SX4YgzpEeF/7SF8yt7t3EFUYBGBoxM3YHRcTxjx3+4h7HNes7xBSbxy3 XlmfGFk6xMSEDnnjaFO29W/1TLiwHO/f2p40BpNa3K698X0XP97uWO5ml+PjW93JPTP6 L2/1sD4QAkd5mXu83Yu34WHtK1oZx0IX2SZK4+SEyBxh+7A7Obp4BWiG/+G7svLvGTck NX/3gDvgD+5k2sEIzCAxtIKhsgJ3SpC5x7cvFVG9S0QN8upuXxFnwG6E9JPZuHuwv33E 2w56Zl4IguB+3vfVez2epDPIbhwfb2dDHE5g9Iwy+HdiRYxhpC+gE64gxXjakkKfmJE+ kQd4ozAcH8hUZTqgRQI+JIWh+MAAQyrNgKTct1Va4XWPs4fKfUlL0OB5Hm0T5WXdM/vb 40w60ZNr62887XCdRrm792I1daDPeOg0IxJrmeXtnpGWghFGH5YM9aUVGFTLcB5dM/3F px53uI6n3zC/v8PbMTQ+3uF1d4wPjQ8fvTC62Os2eMcPaTTjq9qH3KL6U9T/aLsr2XHX QNIwNEIbRA6x1wM53teB1b95xjzGqg73yDBq8N/s9dS5PMaLfWBFvr45o3OQfugA07lx wyfAXgPr5HJ3MFODiGydK2moYyqLAc3uh04swSvaE2ICXUFgiHMxreEHfO3LZ2WI5fLg laLwMBs4I1OLh3g8TJ+2HxXIYlwkR2f0p6/dZLHrMBFCQfBxiLVMZFuss1nLaLbl4u1D XvDNwQJTonz8K/mGbb8o2+NGr8ldzww7Rof/yYnkRB9w/GddUgGKiaw3t/XzLo51QYlz 8aykCmJ6iCXtQfFGRhNYzHGD1/2aN2kIJqVt/ROu2IDbYISxpOjThY5MUg2veV+izI4S iyFJY0lqY/UEdhXUg92316HxoiC528eHMgJ4OVroynonRi6qUnrw0F2GG7A3eKG6rjQZ jCYvw/AVJvDZicHXwfQKLBEJNWUgqWPzXVL3iZhgvK62fjcsETR3hlhwt7tHGLOT7qG4 aBIGXKw9W330wsmhODOB/ZBBdHFlRByCnibtlaJYXvb/V9BHIei33jUw0oAxCaXAwF2N 1zKit/X1Z9RN5JOoBHjXZIbKle0XqZjtA8MGdfYkwzkvOSCoOQ5Rq9O6e7EzmNAHbC4y 4PKXiW1Z8WAjSXZg/k/bAHFkyU7xWsSdNXd9pXlythnmY5PrRvTDRNZ6yEu3zTgk0G2z BvufwcLLva2v/zBHubah1oFDRWjrf8YNJ0isRdxuqJVVsi5udkG6KZ52GBtirL/rGYGQ UbFVIlaI10sQ6BXr0p1QR8kSRH3FOkO2H4c6SbpOEOswn2CI7Y4RmLd+L5ieSAq9/TcP jIwPDTBiE1taACHZ3iaS5LxNhygn0yRV3qWtSbW3ldU3s/rmdL2M1cu9rRB/KIf7KFR9 fMgL9YcB7icuOsBEmEk553MfvXABFvQ4LK8nKfPNB8DAKoMD7qTUNwX9OhkMobozObpk mI2DiSnulfsmLxlIKi4+EF0mJ5V4gjLzBPToEO/B9MxuWgJhHfaKRVRDOUYHkgNB9tL+ 5WxEbjf8oS5vQ1LmTw9S6mcvCg2Mm7yV4nQi8yVVvq24A++YIhpCscaFS7yMzUf4l2sw 8iVe9Foy5AYHJGTJLAijxM/+VYxvqFmKWV3ix6QKUEGRxUacu2CKr9aqksoKPBD/rKyu wAPxLx8AURjy4tXWTAe825BUY0T+y0iZuQHUQdNkNhb8b8XgWdefscfMOEpmejckqUhR 8VVyNCe1vsnDcBbS96tR44Xfl74Zz1L4WBV7xvPpWjnDXCM6tH1HLxzwbmRKkv2Ul3mT pK+fCSbBPgMRyMD4VyuS82A4FV+t1YrV4+MK7dffkKaXQnsxZ09xty+HrBI35hSQUeaf PLy9zlRVLo2TZylb0Z8jMsn7ZKNklNwg7SYbJI+g3E02Sm8hG7mHkCvT17I7yDrp9YAG coNkO+r+STby/ySrJM+SVmmIDEreIjb5ImKT3EtMkh6ykP+Q9EqGSZjfSpZLVpHl/J/I CLeSTOf/ipMnK4jA1ZNZnIdIJZU4RVJGmmXfJrMkNwCa0X8NmSwZIiP8dDKLX0UWcj8g PsnVqFMQs6yS5PF/IHaULfyTZAbdSxzYxj6I/Bru22QlNxlHdIbJfPoC6cRm8XJAJ/8J aeJ15GlAUHItOQy4FXAv4AFAAoxIn7/DQUJsZLKIkAfRIj3xklziIKVoLSJ+Uo7ocAHx kRziJPnETSqJi5SQalJBqnAer47UkwBpIGUkD4eHwsSAVaMCz6klJqLDBrh4nABPlxAz YieFiGPZcQIwRhpxnEBDrIiUqCEKLXhvMWkmNmys1hB2EpGQ9fj7lK6lp7gm7kW+i/+F hJc8KPmzdJX0pKxctkPulH9Lfl6xUPGWcpby56pc1dvqHvW/a2Ka72sLdXrdg7pP9G36 Pxq8RovxSePfTGOmL80j5nOWPssxa8T6uq3f9oa9077G/oT9h/ZfO4gj4bjf8Udn1DnD +ZjzjznhnMddHtdS1wmM+1lIyx3SPoyvDPhVkW7BZw1VFZeUkbI8daSiqkxdUaEuq5JU 15CSYDhqMpt1DkdFhCfNxytD+G/+/YnjlUYTtdeH8DEcNxw3Rg3HKw2/fzESptVVTVxt E19d5fcW6ji5t7qmJlqZz1ktuNDxVqvd6q2mRo+RAVcrs5UW2f0ufUuTO1zkVA7F7mzr WNKUqy+Klbn9VrnpXnruvIwfPldH/2Sz+UqrA85QtN7bPdNSVJl/W35FXrSjxN/U2FHu KQsU58qu/eY3U+9LHvlymeQfX3wPCBIOfCKg8FLwu5BsEuIKpadQqla5C3WFTkeh21PI S3XSnIKCIp3drFAXWtwqXrVT0Lunuzkj73Y7TNSSzxtNxv1xYtPJXFJToUNCmqMhezRo JPao0VTvCGFFn3M6aDSR+vowFinRqKkeidFkrzdGo4atExMTDCKe6iYOVAkEPHKZzGqx 2a0e0KaWRmk+Z7dSD8/nVkYcBr0vVVGYY2hsTs2umxWg33yc9jl8VeXnjtBvPRtROYJF hdMjty6eMrUgVqeMRJSrRiSzvtw3bWaFOsLlcmOQto3AeAVinnmQ9xpytTDJZq0pLa3h a3YKpZq80p3F4bxyvnxnnpBH98fzTBo/79+pETTq/XENb7zF44nYSp23RCJ1pcHN0tCp SiBzyljPUtIcJDkOw+kgcWRLKIayuEfCUYahsaqCC1R7Km2IU8hkcms69/KViGtUcN5C mdxotEUra3Dp93u9G5tKtSq7Hy1P/Gxh28rZ2+7a+PajRQ99s3z6ymb/zQWTB7fsbOl8 4LZHI4ZA1xR+uL3Za9VG4mPL5472FSlLvrt+2/d6uM/uv6t9Xo1dwp3/4vy18tZbh4dv aWKW4IYLZyQm8N5NrhMMFoPO2mXRmxaZrjPxJjuBzyuEUQUh6cX5ptc4iZLn8u06XrdT sJvzZbxsZ74kn8pknIqa93ImU6HqlpzQKcbbUxD+evyTZpEWIABxGJ6HGNQHDc8jgRYY vSKuEHuTiGxt1CiTeQuJscpUFK20SUxLHFMWt1/1zflTH1g5c6TTvWThC+tTqXNbqezf 5j0irUt9PPeqsjtTp3/+fOrju0PLlqTedTppP519gmI7HFKNvRzJW+CxC5asXnC78vn8 nS7BBYa6TDrN/riuhC/ZqePNm3y+8tzNMnHY4N9p7AZf5J3IL/4iv5iKcnIZZNMbwJCb JNVVHFRYvqGi2KYCh0L0337y2f6ZPVOEBT0vH6gvntZ3+8o5Nc51v34g3hjR2AqFdn64 o7kQ3Jn1rc8OfCd1Ye7USHHhAklu7OrtB5f+kko3INZNReksxcgryNZniB5HJbqVmi69 qqDA7uA4JV7EmwTUmOw7BVVFoQrSWujdHy908I6dQmFF+f54hZJX7qzgjXv1JpOD7uU4 h8e9t6AgrHJsDmTEVZRZkVEZlJmMMtRDOedfDIqa6giBfyHDixleSbweI5NJsIkxzmv0 VDbxtVFe1Nm0REvci/XuwpK6QOr5E2WVHv3ChbrCUOgErY00lhXaLUvM5xZnRFk6O/VG ZEplvvr8X50xITUaa8w5/1NjSWtnPPXNK8Q4Sw8l6FFKtgqziM6gc+v26JI6qZLXKTlO oVTaeL2xwBgyPmX8qVGqNNp2CkRJrbyyNF+5UxnOLcgv2B/PLy3ZHy9V8Iqdpbx+r1Gn 8zLClCntm70ZklxBDZiuKKMGM1znX1y4IEMRw4uoSMsu/1V6WJiNupwaysW2kvJYJPXb V9PE0BeGKl7VuWuKU/HLyBDvKzOdP5kX70wNxtvzUhtiXaU4ynIlEUSZkEpAgzqyQAgH 9bx+pxD02oM7w2GZ0so77I79cYXd5ItU8YWVXm/h/riXJ5vLtNoGfenmPOjxET3tyQsF RVsVZWYK+BntUUdz2kiLjD8NTvtgy7NYeIxfRcljxfSESQlmCfbLquOskntlOosvkFpQ W2Y8/5bSWlKRmpdBju4rC9jVXJmxeBJ9sq7M8EVDg9dmUkUiusKOWfTJ1IK2piKH5kpM I2qbp7U99ThdPFcoNKCrt2NmWiO4AmCfQ4oEk1QhV+yPy60ms2l/3Aw0NaLdBUKOEENL ROJKVojjpgfF4Q1mh7efDe+LfzmIjORJmeS1k3lCHSnlSwWbn+dJU4TszA+78qN8OBLG BOFx8BGdUeAbmxr3x/VKC9/Et6uNNpfHJw9urg2dssPvy8yGjuy0yChuj+YcZ9olqlVN Lf7Y5CcSVk7FKY9Nf6yOFzXua9lBv53vb57WO+Qt02sqiunT7qaW5lSSrmxojRWmOn2F duefS/xlvuqv480njtbBq8P1gTxXsU8Sici9jR2pO85/2tdWII1EeJvNFC2i85qKzf8L XmXslQFUyiedQoAoDUpOwyuVdqKGlVVjtt0pqJ02u21/3M6rlHsVCjfZbEibW9CFcUyc IDMaJuqXD7ZFcqVtSbPwO1QWbCjx5LssSy3nNmU5ua/M59DMV1l9sXnzUtdeoToRjdnd igmMsh1UGTuxUEOWCZOqnILS1OV0Rn1qXYAv8hXtj2t9JBKN7I9X2118lHc6qhxQmaqq Atlpm72aN5nqclxRvmA0yNgJU2GPsnkuGMV5eJG1QOIyfycIKaRMVy5nmanWi91S6MCV 1aIvQKlHpmUCKbJpUX2ZQSkzptauSd0LiybW3Z/FdildRG+jM6VFoq6ceyIjwbqijhl0 825aXX/Ow3/amJr4Tuq+rxHuc1H+OKPGhS+kPKhRRdqEomKf37c/LrH7DdrKqsr98Vxd FW8d5SV2XqGoceVW8e7Rsktow7djmEaB8YuVaYWjNps96ueqmfsiyi8w91IYCYas9XIa iO38Y0WRHK1UobD6KuhIuc+u2XT+zaoys1EOYwYLchHVei4vNljXSK++7412gc2bEY3F LUz+8gl+/9zeQE/qmmOvfA2KzKdlfs3P4dcY4NkEBTvWTxbMCmZlLp+7UynRbnI4Co2b pKE/g4d/vuSjRMLSQj/wqDLBIcfQLZyMGkxQT1N6ptdx3I4NL9zds+38gcP/ddNdF1La I9+75qGpA48sG7x1dsAw/QCV/OAdKhz4RupXv/0o9ewe7pep46mJ7VRz5G1acFvfo7/D yJjvWSdqS5DEBV+um3fvFHJzzfKMXROtGvNNzLz9lqKi8gLRwFUaRe9S9E5EKye61Ziz v87aVcKv1MGPDFSnnUjmZ8npd7SuikhqclaMznz0QdftTy+5rnHt6vunVcxY1bqk8vyk jhK7+kqLfOSHI/tXVEhmTbpz9Zw1HXmSDAb/BAZsRbdUqM51kUiE8BHQl0ySFynhH+2P e/xyi3l/3DKJn7TTwpcWFLj8Puz731Jb2+SL0M1azLkhhpIRCwA4itCiNGoZ0cpiJ64Y 2Hz732SI4Si6zna7OO9C2AIVvJeHjyKuIeCX0YNqm78iddHgf/rRh7t3N86tHgzUNYRT H/vjnv7iaDASuXb13JXza1tuXzXIzUh9r6vFwwTtcl/64JE7J2oUzgWL93ZNLVZEqm9s PjC1K0/Nffv8/3B2bJq36JZWaNSqC2f4XZC4MBkT9CHmSYfKQ6gnaomNOdIx1NjM8IId bseoQ6LjHY5cdVGRJLccS9ydQrnZzGTTLHHsnW6ndnux+7ReHy4+LZdXkr3htLmEsIJg oQWimwovNbOsYBQUPRVTPYwo2pFHwuZ8DtxnK4hABSSaLTFt9ozPzdZWNtAtIybGtyzx lbPXbapav3Hdtrblv9wydec1S+wdC7tbropFV64YvXt667onh79xnNb2L4vcuK572WCs 4brbelbtGzTkpj7vXxwID7d1Lu6rEq69e+HynfNKqqmJWdxWSPrNkBM3mS2U601GTNdG Xl9AtXxBgVHpJE7eCZnhub28TlXgaC3Y63Z7VJuhmR6GBTOvp4LU8PmpDKYki2Y0M82b PUCHhyeaFQ5JtTG9oG6VNCy2BcO1tZtFma/FKtisviXUWBU0L4HruXdOosp2jmSkXW6w FzXFJMRUv7wXox6E5Xgbo46QqJCrELVTYTaXlvM2K6awoJWP7PH7ozmbddkVQ9rsi9yA pFqwPmC6B5pnlnnMTWJDFAXzctdpqcXs9448kNj4/dWVKnNRhO6Fl1QyZdnUjhWdOcZA I72nIWigv7lmendD1eTSmpsO3MrdN63WbYd0Mr/ofGz49smeSOK+m7jVaW9JXxRn3pIN GPwaGHjIzcJsmdtIe2RulY5OlbOiXCwqWFEhFpWCEm1KN2Y7pctssroRRcIRHqyTzNI8 vUNK+Byly5Xr1Ou9Hmmx3kCnSnNDx0VBOw4WZSZAzAOiNxkJZ8/gBilDHGt4M21ioY6s X+OlbA6gb1eEsZD/iBbINEq+tpXuLamMeFPDW1JPuYrDWP1EFI4yH9bx517ja8ylxfna WC1cR5W/b/6X35PMm9cTUOHoHcP1rHwIuPrILc9gi/o1AYJFp1rDLDWJKVaxrwn1StqD StqDOtrjM1l5zqTGklChhCtpzpXoiKNQruR9RVZrPr4hYDIpLGacBMoPKLAAYjZKNFIs loHiJWcOUz9DmH0opvYKniGZjlyYEbQwX/TneDn18t9PTXwr9XsTvtHhod9ripgML9HW b1PpJ8HoJDqeX+QJ5KQeuEcy58snJU3xOREnFgGacNA71HjuI8m1X+7kvtw+qbGG0cAZ HJz65UsMe6iZ5CFgHyRzhIo8otPJfV6/z78/7pNaHbzoJ9s4lckllfMOXZ4U0UtpmS5v MyHlZaKKsZgFVOxdaNhF/5TN6GhkQRqIs8gs4CQy0px2RjMO6kW146vpuyl8F6AKFneh y3vshWJPsJTeVNIkNKU+0uRi0qkNV+Rq8Q0nuqAXQZiIuiOvqzW1hc7vnOcvKoHjqa8e vDrlT/24vqPUgXaVPdjRwPBbiNNXXwA/G0kI1URukMOzlMstKgVV4NsxOwWF3gRrYjIp bRqLRcNrMNWY9prNNrVaJd8rkzmIKgTGiYoaRcYmGTajGNPmMhuWyVhPzKRwOzmsbz3V 1FOo4+VY41ppJ13e1lJa6Fh8LsF9P7UrUF7k9ZoX83fMd1YPLU3tjEiOaV1V8+J0bpj5 Hb2YBZLwsPyImP4RB+svfPg0UxkI4YeCipW4CponKcZmmhBX6ruK1eoAH3hQWKUeVSfV E2oJURvUvep71XvUUg2vVjvDtEJSwVc8LkhsvqIDcZ/VbQ6b95iTZkkYCWdm36QIBMq6 JGYLrpxaa561HCtf3mpwGnjDQ06D2WJR5I9RtZ+vZC9VQs0rK6tKxxS4YotCBRaFTArS /uxxkUQkCi8c4ZrVwQWrEcZKTzRw+DKEWs3mHSyPRVc9GPQFWNjG76+uKvKx6YbFr7zV TbB3iGtBSNh6kheVQgzzVHNP6uc+PGfq2iYcWvQUz+matsixZWh0tHXJhhinsgTKUn/R /PLlio5w/LqmeyQDUyZd3XHfE9qWkQ11M2feVhlyNd+2JbV3SmNVgU0Toce4keX1rc7W ZfjaGAmD9meluxHHriALBV8ZLZHCj9otSA3wuG0GrVfr5b27BK0tx3kgnkNyqXKLn9FP y/ji94cNFRW5Y2YxGsAoAnG5iDyExtHcLE64oAP0wp7BD/E74B6QB2Dsof0QHiCcnnfZ VGSlCyQdC5ZMuvrhWUt+dvuULV0d7bzWHoh+PknnaZ4W3nDz6uvre6f7+AI6udV7zduP P3lqjauw0SBpHppanW9SVqm+fL1nXqzS/PzzL/7CO6WrAjqxHFjOhIR5yA1C3I0jnlwS X+IqGDV3uonJYHKbeGWBiUIxnAgT+Uu6THoHwgW7BYetAAG7XUKBwWBQmdxmsxffC/Oq trhEn4KZ8hwnUkeIMDTTTIe3coKx+XpEQZynEdg8vmA1kLemI3cwCqKPUYuIIIiQ8TH4 KZuNla2RjpXNjoahzvYbhProtIG50Z8cW/Xy7TO38/teb+nOHzw6NvvuRF1NvLWuscT8 5ekHPrgZ5pZjuEmC4GAhVmlXCRXGgwaD/kDcYI1aQo4QH2JIFJYUFICrDA+57EBcThRU NWayFPJexkom3l5vXRnDKiPVX+ViWngR+QCOhg+AzSXGIWgg99YG2PSdxcbO+AqJhv0T A368JMM/mSVY80lMo29esDy29/DaF25qXVmv89S1hUbvuHZVWUNdg0t3GRdvnNZW7FRX qfZK2tqKz36894NVVkfq0LSFQpnl+MTEMb2nIYygAigwAu4+AO46wd8NQqvbbMv3GHnj g4LHo7aRTvc7zk+dHHEanG7nGSfCsU6bxMbbdsM8qBHg3CWo0WI3EY/JsCUnx2u6XS7S 4TNT/QljPfibZWuaxYYT4C2+d3xatPcZb7IedvAyCsC59jBvETJdy6IQUG5+VLh6tOfV N65+8dalO2aH+PPj1RuHZ25puVpW2he/6ib1wbapwX98tuv9m4XrvrPNtP6b8xrb6eyV d07e9zCz6dOB5p+kj2FfZaXgVskV8gNxhdVgAptt9C9BPXEb3G73hPs1t1TLYztzQnAU +rrcCMUX8UUP5sGf5jz73EFuzKFH4xED7dFjFf5Z5VuM3+JKjokpE9rm09FKJsfMVoHN l9xEBHRhnyTYgYlWYquFWSws1a1RbsmnWmdJeeqqMr9VtdHvtBu1EmXjurHB6bVLzNEK T7nfpf2Un3v+yba414qJWIzocguicPhyohXXbBsKqH8wKWLyC4umLsfERZpTLfy74GUl drpmkTPC3FbPzEBApQgpanjFrokaqq8pqAnV8MqampB+Jp0pEAO1whbpDQWGkOFTwwWD 1MsbDKEuikfw5C9Cpd7ZxXftEpy5oWa+eVfIEFBpCqcWMSKVgBBFRfme1tap7W6DmU5t z8/v45TFEUnppNulBqiFVGqNEjJ7KpsF1Hr0mGq1zo7eXioKyPEgqMdcAkwG2JOpZw4e XB0U0HC8EnGaSyYhYwVFmWHyA9twHEuOEIrp6ZXF/SFFNCAXNzawDhXXG1FxQhANprgg qWVTRo2YMmNq91BRx9gGEJtDzOKUcXEB6y3k331GWVD00jOzYlPz2uJnVtxRv/KVbUsP 3NDS1xOqEWZ0ddcvHe/t6qSLz09ZNhTtKrdWzqlblHBGo/fcP3hrXBfoatg1g58rVxdc 3fTkIWtDnc9vaL1uysL7ZzrqF3Q0XxUwT6msX9RYeu/8OZtnlRhTr23aFogPRPrX195y 7rR/ds3g7PBgLLe61AkZxkpXUgg71UBWCDGeUZcrRkJZQlhiMAf54pLiA3FTidVN86R5 fB6bh+pqD8Sxd0o1Yw5HjHjHwhkRDmcis5dPOSzAkonOpn3M9JyTz4JKWLyxSDPbmRCl N73AuFiXnonoNZJp8waitXNaSiz6wKTU+kChXeua3lks9AXllpJgai2Tc9GcfRbDDDS9 2Z1T3XP1zNTWuc1exF41JndbnMrG7u7I7ZoaTN0abwg44Zyl9zHasxMUbNYsqPWfscfO w2rNEUrtEqfkQNxpzVpvPbdkFU/1/Ds8p+cXIeN5uoUzj3GqjAuCXFRkVSgYfP6U4RQJ LVi94HTaPme1FzuiiKpmllRslhVJQDcfXRbw2LUSR6T8z42G8mhqgzT+3HNfnMbYWzvo 08K0kF1RrTxfPafNqxXtqzTVTteJY7Ujkh5RKxTYK3lIUORaLQfitoNWDFb46mgVbqVS 76C3c/axy2zOqbdOMYURjSobcM7p5g8u+UriLFltZtt7gcvGTdf98HDDPaOFTS2lNpml tPajRnG8v7rr2+t8/Y5g/VA396dp8YBDXa1ktrIZchaDnAnkzmeI6cKHzGGDyyfmFhZU aERFaUWj2+6SWov4EoHDkoDTYBdJ78yN8BWhigNxV8iq1x2I6/VNjQfiTUSgOqPVWSQl pWM1GbrXMOljMWrR3WE4pJe0GXcv57g9ilUPkBXlENHqWuwCsf/Mqg44ylkEUNysZdqL SAw2iNis8VWRXOn2WJ2x2oqQUuErpU9VjNT+kborZ4RTozlOdWH5DYV5blcd4+OayoBR npFNrlyuDEaDMScWZ4UybOgKVW+ntrU2wwTzRos+r7JpT3mu5ozI44g2N9BWw18SzzQV 6e9ARRsJC1YJ1ucH4jBI5gNxC7HidBIZ02YIoU07fWkyiLOG7+tw+Or4vviXb4ZmyBbx r+D0+ylhjloBZqlYVFlcbEvYJc8Sjq29KUsISxRRmcMVnT5TWlNdcyDem1NtXXRw4cIF B+IL9VRZHOyQtsna+LbdWplBWT4WY9IA289ygRmiWKzfPKb30LZ34F0zBUMj8g9h81Hw LB4iXWM4/DhxBAEA5KIosQOfrF8/FBCiwMLbwSDsuuhCoQIRX+bxswW+6DSlA8CQioxI pBfAdjaf2kTHOP+rBkkiOsOXrRjhVl2sS284XVJuep0u1tPV7Enc4uheMFzXNtxWoDL7 y1M3MAOmNLsKK/zF7TOKLtWprJ7CirySrm6/TGvx+VIb/B6HhtmEjxr5Qkms0WeYv2hq VyAw48arUlunNrjt2HXKWLfZ17X6cw3uqT1VqfuvbBlYFS+1qX0dU8tSd9bHCq1mNuNf YVaYhoLDkhA4HCPrhcYKxoByZv/LWBJkiTM3hq8ecFhwUGvJweLiwIF4sb7MpA8zpzxs qBlTKJrKSi1jhQhTMPVGPvG0wUinFoIHaV5gVhAXXJfILzIjPSt4MvPARXJernQItNRG 5WmWZDYjJKH0RKAwu3zhQKCjzy+azawV/ahRrZsyb0FVzeyWUqvC4g9lCdVx/eSSPGPB 1Cnh1Pa0vF9JjCcl3YLXWdWzclZqa3sTGJXx5/kT8IC0WJNNFgoIPNldAs5O5fA5u+QG m0FNe2xbVG4N9EKVr4MU/gA1ui08k1tU8tBH5pggveSAiDH6zFqDHZ+40mvgLK/9ds2x 0RO/u/bl1LYtN7YtnJTTsqpr462Gv53Z9/51Z/+8//3V9ItXf99y7c7p9z837w3MXpNT MyVqcLAYe6ujQikLX2NZ4SL+Cj8W3rsEv60mJ1oQ5aO7seSwH4RLg4lCX7glkpm9kGMJ Ce2JRBqII4evEycJQYkaPZMHuKfB9JYRcnY+BKuO7ELyYgg366X6Lm6WiOogrijBP6ZY DFesS/j0mqvakF5erlLag+HUSFG5QyHR2APlHzdq9U1dPZ3F+w4lfnr7lA2VjsZZ8Y03 flA3o9eT/2aL4HOwCJK1pKOBH+xqLM4xKauVT0qa6/2Gf/xl36nVTrpoaKTF/dLzdJt3 2uRScUUC+rjBw3xERAcFf74ozNRVoSjVYEN0t6Cx2YrMZjjnu8wGh95usDnHFCJN2Fos EokGtujTa7HoKZwGac6EYC7GFLKY07QcX7bysNlr7aLFwAqNrTuySzCJOzUSDtqVNQuu F/YdWvPq1s7rYx1xpb28KPWeo2Fa9a13Xndd6aT6STm61EycBvI1t9KBxskVf/94/wer 89yNhi93TGrHeQ3+9QXLOgte+wlWX4UNIbb6ErWZLweuAcSb8m1OB+IEDiuLu/gP+vR6 qiEKg4Kz8ArpqIbNviaDrQthGo3UoFQoSgLUNJaf0eJ8NqWyPRsEVI7j5wXYmgS+MqbR tJOQWZOImpldgjCb+d+UF7awduE17Q2h1Y6aUFFnq9MWjaauucy+2fi2nlLZH2sipb0d 4dS35rW7WdzwMjtVpWKYLcS6UgXMIuRhwRbKac6ZnsP/NAc/umPIcUMbc/x5lMlxl8nW FUI4gUr9mvWaOzScT1Ot4XiiMeD4U69mSIPtcE1ehRX+7C7BaqvAHuKuCkPOPqeztJLi m9EKw1hhYVQxll5VsM0K0UkSLVh67cnib6DEogUgBnMw2MkKbFksuJ4t0bJ8vrQ3gbBx lC0+03s6l+1kcBeGbLGptb2L/L1Ll13XXLN4a2/f492LXSsWFLXXuIv7Vsy7tnng26tb b1rAnYq153a3VMSqgmVTFsenr4znOy2vz5+l98bKo0J1ub9rcdvMjYLWzOjkw7fZn5Mc gb2aI0TsBt7iNgv+UJdZ0Oi7zIbddoRT9TKq4WVyQUXgXKn+ItebLUplvlyqHsPZp3rG 9BMsjIa1Z5br9c3nTwSD8BTZtgw7NGP1WMXDFWxRbRfVGktSX2WT16LeQdtSPzGU1ZUV dxSWd26O33rLA/y4orh50bx/LE21Da9pyfUU1LQ3Pfwkh6/vUzIZERMfvrWPH0cQCvMO 5ua6DsRzrVhXe+W8fLfgtZnLaBk8Haq3jbnzIbXpEKBGU8GNIQqJiAn8gGLmdhQzO8WM bZSdDxF3eC9X0nSwBFsul3YyxHB3ek5nYRMRD7+4JAlMpnmmotYGf8ccn0xn9gZoHrzd mg8aZfpZu6fOW9+g9TXxP07x625sKs3vnhKhN9Snz4acn90TzwRKBvu67rmN3tjX7GM/ DmW+8HeJCngWIC4kKMNmOFFhtm8hN7DgnUJM4VahrHTYDOZ8tolxIC7V4hSGlOjNOnCo NT/f7XQolR43JK5RPIOIAyPUcBKCmY1+N7N4Pn5DBD/ncXH74sqod2b74rsVfrNW9z9e sRjKY3R9oLQ0L/XU+tRnuZ4AuBFRW9wu16RASkY/CDe5SsuwY6PwdArnXdzHPfW5CtHW 5F34UlYGjHzkOcGgM4jTBRJE5+AHMoctDwWLG4mRJTpxLmEJYmJijzPY6wAFLAaWGsVU vK9Rj70Pi5ulxnRq8fHUSkx6FXY8xICLROvILZQq9L4iiyXPzFGj0YytBEVeHvY7IALi Lgfb6QChrtzviF6+4wG3j/3sCfvJFUQSERy6YvfDfBndxO2P/NQX28/YCyAM2xtKNJpv UHr320mdqbyGLoDYepypd7ZyH583cH/smpTHfK1AgJGQ42XnvqB/9rfnl7KtA7k+r1E4 74ZE2BFi+QXoV0sSz5DSC/9kzhN+YOifQhgFVynRSbxhk9XHF3oLIf9euaqSD4VDCDaF 9UTnKpVgJyis9JlM9b40yjioi9BHWvLh6V48zWFnyx4apFjxXLbeMacttVgVuHRYFdsH 5iwhMF/ZOcVt1pzCItrpn17/q/cj0wKpa2fpzDsfMZp9xanDnura8td+XVZVZqPbpltt XMs+V9Rlz5dHImqhM5U63tqhx2RdZfU7Xz5m89ldXmyVaIrqa/HjXUWxmlwshTSV9opc ZgcsqSmiflRAP5rUDqOt6wP139ScXECJbZy45dgUkKsFuDrq7wqSXDcx2KyBUnZyDA6p Xa/YJ5fbcFjCXWJLsx9m7PRFYsDhFyOGMGivwHgHF8CQSdlUfdE612Y2ijJbfpfxnpNz itqRTXNq2wc0RYX5oWh7MPWhy+MP0N0hv0mrO3zMaA41pHVo5s2PTNO+WOK2160d4D6b 3JCPuUxt9eS4GgIpNT1Z3JYXzOoScJ4BCZgFCbCQxwQLzkeqOHzjysIpebdS28XrOCzr TgolKGularFFb9ERlUHFOXmVlMMp1l0Cp2YzmFqv3KeSsBm9ALIj0TIF06q0Kt6yj4jK hoPNLNfxkArRH0WAKwRLGUSwQoyMsa0kWEh2wNWA04LQGzatBRcuEA8LivtJWCWL+0ni HhM/61yKK0p9VtlQ5ZjL/f3876m8qspf5KSFqT9E+Iaivk5qqDz3C4N36kzGXUfqE9qG XxbREq9gkh2e0AoMK5lcyx1Sq/U6vCp06sUXK0komPMJwrfpY8UBNmcGaLUuvHx+TbTC Iv+wI96xdk17Y7gHZ6OnMN/uIB5+Pb61wONcflQo4JKEN/Buvpe/l5fqeV6eFGSUkz4l UyhlTxVDCwynopXicWZ2LvJ0JsbBDqtff+zYMX7rRx+dH/7wQ4z3Gjy3FuPliV1Q8clR jj7FcVKJOE4CWmGM7K7alz9Ed/RfSX/Gxbj56O8WTBzluacFQnGCk0qklBQ3gLSZE+R4 pafaw8VSYfoa/dmjDIcJPOB+7BEyHMqEHI4NGiEm7OIWN5A3+dYrhv85VhKOZpxxfRVP wmkRMxvG/S3DkZeOSWef6+Z/8OX9bEQcvrFOeBtOc/jwrYceocStUNiIPykUsy0WzsOb bKM2CNB9Non/qRLfKCGmnFtUKvA8xDZS2DR66kRaNDI+AHsli6jitenT/9kwZ+b0P4uU YscR6pM+/R9TOasjDdGc0qmV0xeZtl3/RM+Gb3Tq8yvqO6vDFu8xuqewpLJ+WuOU+Usa e66uWbhwb0NF180zStpb2ztmNXV31juPpinbyX+HzkfsQ0d8gkEOqup0arlbwUNuDHqR Hycubfscx+jEkC2CVmlrR9s02uK5A42RCplGutszzd26bPm02KSNc/Pj7aD4cv55nkq/ Dbl0wWMSBBwFEmwKqzyXarVquULtcjmtbptTfYR3HjGGPvvDKUP2bYYT2c2mE5XO45U5 juP4Pj9OjLGFHXOJrBa754or/AKfWl3UN6O+NmBMmS4W6Xv880VT85qXrphc03HTQNuM Ky7w+1TgZSd/hHtIpEEeqRVyFHa33EbyaF6ey2Z36XQa/Oib6YiLP6JJj5Bx0HCCpbB/ b1WCPGxoWbqISuW54opG1WrvrFn1JV6Tkf7lUlm6mw0mMTK1pnrK/Ob00C5dMblvSs3k v4+R8SRP0PCUcxHq5rOaEs1pPA5ta27G23G4gP/++YpvcG9Jd//z3+XtuPfpVA/3nvRR rMvKBLsKZv1BQUUJNoEeJC51vvV2qdRdwBh8HnbhYvQej2IH3IwGE84DWQsRCxP/cATf jhOadluUe+/gf2yoqd7wm4MdNY3BcL7XaMr35pb6opMWpnqWvY4fyMynuXTGWytmanTF ZdPnP/TNC6dSLyT6QiVWB8MoiFENfmVUrvSoaL5aervVmh7V6StHZcZeMX6wgYMPWY3w YvoPZ+4CfvbnDf7LQUkfXfZ66nDq3dT7qaeuGBSdlBkUftcSuvwqdDmHNAn5Jhs0TCFT KpQP48Q0fvtKZ7MpZfhO07hOl+tKW1Ic+Yiy3RDSfOmoXZTtaGQPR7PFuZ9thQVoVGbl fqj1NC3sOZ933aJKe67LvX5uGX2rVkalDZN8VjU3ebLUWNjUwQeLfa0NPdQ+dBB0uhVj egljKiaLhag7D0cYHA6bIs/G59geFfIkSqlgMHdJixXFfPETCqfTpJTKZe67TKZSZ7FS 6djhDJ2Khph7FvrsROVxlpOQOAO9GGQzNY5lsh1rnLBDE4yteKwBJ/VZ0LY2vZTCicD0 947Shkcm556NxIqshtnGcy8F77tjbbSu1hFe0v3vLRs3vtn3o2et5VPnr352YI8mtzyU +l14+e92jbZ2LV8Q6l7T+tpEffTJR6sH5iau2vDSg8DtXqw1XwZuYXKLENdqfH6/j/c9 IvglNv8jxWF9DjXyOWBGfrktn3fmPyLYzJJynpY/KpFoFH5/aRjfSctR3FVammO6y+Op dO1If6VENKpAlOXi90rEzb0srkCWTRFspri0j2kWv1iV0VVrPp8JoWScFua7edlBBZaD l0+sfXnh6oOD8ZsWN67ur1762q45v5i1wbtmyW1jyYODW58ZXL964fpcScOztTUdW+bN vnWoQqmu7lvXvfbpkYD7rZGFO7bf90i/on98znUbli0HFR64cFbCYV7S4btjuTwX1mhk HDuCjE34J7TQdU4j1ekMWrUmdPwFoBRlvzTSndTOxPeCifTCh3UDqMwex3A04yLH8JJo CappNU6n4GtjZg++zvOjnZwr1VUS8djMcyz8oNT3xVsRyTq9PrciTuPM+iXAjY/BDSdO RfQJwQKpTKY0KbHmf0xQKgP4zgxPBafZhGMoj5gkUi+lWuvdXm+47G6c0cRbL5KbTZw4 rp4WrAyNsTiAdFWzb4Vkl3/4alu00mS0cBK5mYldVtpEx5DW33V8k1XV9+Si1U/0xtYf Wv/G776V+t3PD/jbW5udSp2idvWs7pGW/BsDkZv/6wVJrG7JkQ2D39zYmfpD6szZ1P2/ NHG7tM6ATZFTWn7nz5dUzbupa9dewqyOCcA+MlCbTG/r7JvSEmwbvmbx9cuH/ycOKpSf CmVuZHN0cmVhbQplbmRvYmoKMTE0IDAgb2JqCjE2NTgxCmVuZG9iagoxMTUgMCBvYmoK PDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgOTUwIC9DYXBIZWlnaHQgNjc0 IC9EZXNjZW50IC0yMjIgL0ZsYWdzIDQKL0ZvbnRCQm94IFstMTQ3NSAtMjQ2MyAyODY3 IDMxMTddIC9Gb250TmFtZSAvT0NHVEpBK0NhbWJyaWEgL0l0YWxpY0FuZ2xlIDAKL1N0 ZW1WIDAgL0F2Z1dpZHRoIDYxNSAvTWF4V2lkdGggMjkxOSAvWEhlaWdodCA0NzUgL0Zv bnRGaWxlMiAxMTMgMCBSID4+CmVuZG9iagoxMTYgMCBvYmoKWyA1NjggMjcxIDQ4OCA0 ODggNDMwIDIyMCA4MzIgNTMxIDUwNCAzMzggNTUyIDU1OCA0NDEgNTQ3IDQ5NCAyNzgg MjA1IDU1NQo0MTQgMzMyIDc3NCAyMDUgMzI0IDIyMSAzNzUgNTU2IDM3NSA1NTIgMzAz IDY4MSA1MDQgNjIxIDYyOSA2ODcgMjY2IDQyMiA1OTMKNjUzIDY2MiA0OTYgNjIzIDQ5 MCA1NzUgNTYzIDY0OCAyNjQgNTI0IDQ1NSA1MzggNDgzIDM4MiAzODIgNTM3IDgxNSA5 MjEgNTU0CjUzNyA1NTQgNTU0IDU1NCA1NDcgNTU0IDU3MCA2MTEgMjg2IDYwNCBdCmVu ZG9iagoxMTcgMCBvYmoKPDwgL0xlbmd0aCAxMTggMCBSIC9GaWx0ZXIgL0ZsYXRlRGVj b2RlID4+CnN0cmVhbQp4AV2Uy27bMBBF9/oKLtNFYEoU7RgQBBQpAnjRB+r2A2SJSgTU siArC/99zx27KZLFNXA1M+ScIc3V4+7LbhwWt/oxn9p9Wlw/jN2czqfXuU3ukJ6HMcsL 1w3tcnP2rT02U7aieH85L+m4G/uTq6rMudVPSs7LfHF3n7vTIX3St+9zl+ZhfHZ3vx/3 9mX/Ok1/0jGNi/NZXbsu9Sz3tZm+NcfkVlZ6v+uID8vlnqr/Gb8uU3J0REV+bak9dek8 NW2am/E5ZZX3dfX0VGdp7D6EbgWHvn1p5qwq1nXlvPdb/XT8FJ6fxjurvWV9qAml1RRK bzpX+Px9evTXpg79rZsiryvJ++hr9iywyPt1KxuwCBtlWV3C5rIRi7zfBNkNFhHtZB+w CNvLbrGI5LVsg0XYUvaARSQ/yLZYhE2yHRZhbaOERdhC0R6LsBtsYL4SdisLnMT4RBSA k4hq3wCcRBtaKkAjYW0pTiAgatVGAE7yvrSVgQuC9LlZ4IIgfW4bAReugBpsAE4iquEE 4CQ20mADcBJdaTgBOImNbF/gggFutFEJnMSRqecSOInkgyxwElaTLIGTWLmR5fQk71kQ C6vEUppGCatErUVhLa+8FoWVNZWsU2AGJpJ1GUpYJWZltbDSj5YSYAmrhLVaWEvjjRaF FVKiTIxkWCV6FhEX08SsFI2wSrRhFlbmgN2Il9YqWLDcPSxwEvsyWP5y/y5+Hj78ESLc Epk6oAi3xC66CRFuiQ4FG2GXSNZZ04iJqOgi3BLWauGOxs71IAq3RMO2FNzxyq7TjHBL 7KvkNewSGynK384EnWq5/iaS39PpbdEb+PZmta/zzHNlD6W9ZHqhhjG9vaXTadJ4TH8B vjFfuAplbmRzdHJlYW0KZW5kb2JqCjExOCAwIG9iago2NTMKZW5kb2JqCjI0IDAgb2Jq Cjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL09DR1RK QStDYW1icmlhIC9Gb250RGVzY3JpcHRvcgoxMTUgMCBSIC9XaWR0aHMgMTE2IDAgUiAv Rmlyc3RDaGFyIDMzIC9MYXN0Q2hhciA5OCAvVG9Vbmljb2RlIDExNyAwIFIgPj4KZW5k b2JqCjExOSAwIG9iagooTWljcm9zb2Z0IFdvcmQgLSBkcmFmdC1pZXRmLXNpZHItcnBz bC1zaWctMDUuZG9jeCkKZW5kb2JqCjEyMCAwIG9iagooTWFjIE9TIFggMTAuNi44IFF1 YXJ0eiBQREZDb250ZXh0KQplbmRvYmoKMTIxIDAgb2JqCihTdGVwaGVuX0tlbnQpCmVu ZG9iagoxMjIgMCBvYmoKKE1pY3Jvc29mdCBXb3JkKQplbmRvYmoKMTIzIDAgb2JqCihE OjIwMTIwNjA4MDA0MjM5WjAwJzAwJykKZW5kb2JqCjEyNCAwIG9iagooKQplbmRvYmoK MTI1IDAgb2JqClsgXQplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUgMTE5IDAgUiAvQXV0 aG9yIDEyMSAwIFIgL1Byb2R1Y2VyIDEyMCAwIFIgL0NyZWF0b3IgMTIyIDAgUiAvQ3Jl YXRpb25EYXRlCjEyMyAwIFIgL01vZERhdGUgMTIzIDAgUiAvS2V5d29yZHMgMTI0IDAg UiAvQUFQTDpLZXl3b3JkcyAxMjUgMCBSID4+CmVuZG9iagp4cmVmCjAgMTI2CjAwMDAw MDAwMDAgNjU1MzUgZiAKMDAwMDE5OTE3NiAwMDAwMCBuIAowMDAwMDAzMzAyIDAwMDAw IG4gCjAwMDAxMTQxMDEgMDAwMDAgbiAKMDAwMDAwMDAyMiAwMDAwMCBuIAowMDAwMDAz MjgyIDAwMDAwIG4gCjAwMDAwMDM0MDYgMDAwMDAgbiAKMDAwMDAwNjIzOSAwMDAwMCBu IAowMDAwMTc2OTk0IDAwMDAwIG4gCjAwMDAwMDM1MDQgMDAwMDAgbiAKMDAwMDAwNjIx OCAwMDAwMCBuIAowMDAwMDA4NDQ3IDAwMDAwIG4gCjAwMDAwMDYyNzQgMDAwMDAgbiAK MDAwMDAwODQyNiAwMDAwMCBuIAowMDAwMDA4NTU0IDAwMDAwIG4gCjAwMDAwMTY5MTEg MDAwMDAgbiAKMDAwMDAwODY1MyAwMDAwMCBuIAowMDAwMDE2ODkwIDAwMDAwIG4gCjAw MDAwMTcwMTggMDAwMDAgbiAKMDAwMDE1NjM5MSAwMDAwMCBuIAowMDAwMTIwMTIyIDAw MDAwIG4gCjAwMDAxMjU3NTUgMDAwMDAgbiAKMDAwMDEzNDM0NCAwMDAwMCBuIAowMDAw MDAwMDAwIDAwMDAwIG4gCjAwMDAxOTg3MzkgMDAwMDAgbiAKMDAwMDAwMDAwMCAwMDAw MCBuIAowMDAwMTgwNTkwIDAwMDAwIG4gCjAwMDAwMjU2NzEgMDAwMDAgbiAKMDAwMDAx NzE4MiAwMDAwMCBuIAowMDAwMDI1NjUwIDAwMDAwIG4gCjAwMDAwMjU3NzggMDAwMDAg biAKMDAwMDA0Mjk0OSAwMDAwMCBuIAowMDAwMDI1OTI5IDAwMDAwIG4gCjAwMDAwNDI5 MjcgMDAwMDAgbiAKMDAwMDA0MzA1NiAwMDAwMCBuIAowMDAwMDUxNTk0IDAwMDAwIG4g CjAwMDAwNDMyMDcgMDAwMDAgbiAKMDAwMDA1MTU3MyAwMDAwMCBuIAowMDAwMDUxNzAx IDAwMDAwIG4gCjAwMDAwNjQ5ODcgMDAwMDAgbiAKMDAwMDA1MTg1MiAwMDAwMCBuIAow MDAwMDY0OTY1IDAwMDAwIG4gCjAwMDAwNjUwOTQgMDAwMDAgbiAKMDAwMDA3NDg2NiAw MDAwMCBuIAowMDAwMDY1MjQ1IDAwMDAwIG4gCjAwMDAwNzQ4NDUgMDAwMDAgbiAKMDAw MDA3NDk3MyAwMDAwMCBuIAowMDAwMDgxMjU1IDAwMDAwIG4gCjAwMDAxMTQyMjQgMDAw MDAgbiAKMDAwMDA3NTEyNCAwMDAwMCBuIAowMDAwMDgxMjM0IDAwMDAwIG4gCjAwMDAw ODEzNjMgMDAwMDAgbiAKMDAwMDA5NTkzOCAwMDAwMCBuIAowMDAwMDgxNTAxIDAwMDAw IG4gCjAwMDAwOTU5MTYgMDAwMDAgbiAKMDAwMDA5NjA0NiAwMDAwMCBuIAowMDAwMTQy OTc1IDAwMDAwIG4gCjAwMDAwOTY0NDUgMDAwMDAgbiAKMDAwMDA5NjcyMyAwMDAwMCBu IAowMDAwMDk2MzAxIDAwMDAwIG4gCjAwMDAwOTk3NDcgMDAwMDAgbiAKMDAwMDA5OTcx MCAwMDAwMCBuIAowMDAwMDk2NzQyIDAwMDAwIG4gCjAwMDAwOTY5NTUgMDAwMDAgbiAK MDAwMDA5Njk3NCAwMDAwMCBuIAowMDAwMDk5Njg5IDAwMDAwIG4gCjAwMDAxMDA0MjUg MDAwMDAgbiAKMDAwMDEwOTA3MiAwMDAwMCBuIAowMDAwMTAwNDQ1IDAwMDAwIG4gCjAw MDAxMDkwNTEgMDAwMDAgbiAKMDAwMDEwOTE4MCAwMDAwMCBuIAowMDAwMTEyMzI4IDAw MDAwIG4gCjAwMDAxMDkzNDQgMDAwMDAgbiAKMDAwMDExMjMwNyAwMDAwMCBuIAowMDAw MTEyNDM2IDAwMDAwIG4gCjAwMDAxMTM4OTQgMDAwMDAgbiAKMDAwMDExMjUzNSAwMDAw MCBuIAowMDAwMTEzODczIDAwMDAwIG4gCjAwMDAxMTQwMDIgMDAwMDAgbiAKMDAwMDEx NDMyOCAwMDAwMCBuIAowMDAwMTE0NDIwIDAwMDAwIG4gCjAwMDAxMTQ0ODUgMDAwMDAg biAKMDAwMDExOTY5MSAwMDAwMCBuIAowMDAwMTE5NzEyIDAwMDAwIG4gCjAwMDAxMTk5 NjggMDAwMDAgbiAKMDAwMDEyMDI5OSAwMDAwMCBuIAowMDAwMTI1MTM4IDAwMDAwIG4g CjAwMDAxMjUxNTkgMDAwMDAgbiAKMDAwMDEyNTQxNCAwMDAwMCBuIAowMDAwMTI1NDM2 IDAwMDAwIG4gCjAwMDAxMjU3MzUgMDAwMDAgbiAKMDAwMDEyNTkyMiAwMDAwMCBuIAow MDAwMTMzODI1IDAwMDAwIG4gCjAwMDAxMzM4NDYgMDAwMDAgbiAKMDAwMDEzNDEwOCAw MDAwMCBuIAowMDAwMTM0NTI3IDAwMDAwIG4gCjAwMDAxNDI1NDQgMDAwMDAgbiAKMDAw MDE0MjU2NSAwMDAwMCBuIAowMDAwMTQyODE5IDAwMDAwIG4gCjAwMDAxNDMxNTMgMDAw MDAgbiAKMDAwMDE1NTg3MSAwMDAwMCBuIAowMDAwMTU1ODk0IDAwMDAwIG4gCjAwMDAx NTYxNDQgMDAwMDAgbiAKMDAwMDE1NjU2NiAwMDAwMCBuIAowMDAwMTc2MTkzIDAwMDAw IG4gCjAwMDAxNzYyMTYgMDAwMDAgbiAKMDAwMDE3NjQzOSAwMDAwMCBuIAowMDAwMTc3 MTY4IDAwMDAwIG4gCjAwMDAxNzk5NzMgMDAwMDAgbiAKMDAwMDE3OTk5NSAwMDAwMCBu IAowMDAwMTgwMjM5IDAwMDAwIG4gCjAwMDAxODAyNjQgMDAwMDAgbiAKMDAwMDE4MDU2 OSAwMDAwMCBuIAowMDAwMTgwNzY1IDAwMDAwIG4gCjAwMDAxOTc0MzkgMDAwMDAgbiAK MDAwMDE5NzQ2MiAwMDAwMCBuIAowMDAwMTk3NzAyIDAwMDAwIG4gCjAwMDAxOTc5ODcg MDAwMDAgbiAKMDAwMDE5ODcxOCAwMDAwMCBuIAowMDAwMTk4OTA0IDAwMDAwIG4gCjAw MDAxOTg5NzMgMDAwMDAgbiAKMDAwMDE5OTAyNiAwMDAwMCBuIAowMDAwMTk5MDU4IDAw MDAwIG4gCjAwMDAxOTkwOTIgMDAwMDAgbiAKMDAwMDE5OTEzNSAwMDAwMCBuIAowMDAw MTk5MTU1IDAwMDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgMTI2IC9Sb290IDgwIDAgUiAv SW5mbyAxIDAgUiAvSUQgWyA8ZDc4ZDI3ZTZjMjYxMzM3N2VlNGM2NTZhZjNlZWFlYjk+ CjxkNzhkMjdlNmMyNjEzMzc3ZWU0YzY1NmFmM2VlYWViOT4gXSA+PgpzdGFydHhyZWYK MTk5MzQzCiUlRU9GCg== --============_-873006246==_============-- From randy@psg.com Thu Jun 7 23:09:48 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B70A21F8440 for ; Thu, 7 Jun 2012 23:09:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.514 X-Spam-Level: X-Spam-Status: No, score=-2.514 tagged_above=-999 required=5 tests=[AWL=0.085, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jR5mCbeF967r for ; Thu, 7 Jun 2012 23:09:47 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 71B7511E8080 for ; Thu, 7 Jun 2012 23:09:47 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1ScsOH-000Hcd-Ld; Fri, 08 Jun 2012 06:09:45 +0000 Date: Thu, 07 Jun 2012 23:09:44 -0700 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] comments on RPSL signatures X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jun 2012 06:09:48 -0000 > I have a number of propose edits to improve reading, and a number of > technical questions about this document. I have attached a PDF with > my MS Word change-tracked edits/comments. can you send a normal .txt, or does it have graphics figures? randy From kent@bbn.com Fri Jun 8 03:59:15 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B434C21F8896 for ; Fri, 8 Jun 2012 03:59:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.203 X-Spam-Level: X-Spam-Status: No, score=-105.203 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 63BqzpqTmxfP for ; Fri, 8 Jun 2012 03:59:11 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id D6B9A21F8894 for ; Fri, 8 Jun 2012 03:59:10 -0700 (PDT) Received: from dommiel.bbn.com ([192.1.122.15]:50136 helo=[131.171.70.131]) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Scwtm-0006nn-QB; Fri, 08 Jun 2012 06:58:34 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: Date: Fri, 8 Jun 2012 06:59:06 -0400 To: Randy Bush From: Stephen Kent Content-Type: multipart/mixed; boundary="============_-872969347==_============" Cc: sidr@ietf.org Subject: Re: [sidr] comments on RPSL signatures X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jun 2012 10:59:15 -0000 --============_-872969347==_============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" At 11:09 PM -0700 6/7/12, Randy Bush wrote: > > I have a number of propose edits to improve reading, and a number of >> technical questions about this document. I have attached a PDF with >> my MS Word change-tracked edits/comments. > >can you send a normal .txt, or does it have graphics figures? > >randy attached is a .txt version of the change-tracked MS Word file. Steve --============_-872969347==_============ Content-Id: Content-Type: text/plain; name="draft-ietf-sidr-rpsl-sig-05.txt"; charset="iso-8859-1" ; format="flowed" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="draft-ietf-sidr-rpsl-sig-05.txt" ; modification-date="Fri, 8 Jun 2012 06:58:09 -0400" SIDR R. Kisteleki Internet-Draft RIPE NCC Intended status: Standards Track B. Haberman Expires: November 11, 2012 JHU APL May 10, 2012 Securing RPSL Objects with RPKI Signatures draft-ietf-sidr-rpsl-sig-05.txt Abstract This document describes a method to allow parties to electronically sign RPSL-like objects and validate such electronic signatures. This allows relying parties to detect accidental or malicious modifications on such objects. It also allows parties who run Internet Routing Registries or similar databases, but do not yet have RPSS-like authentication of the maintainers of certain objects, to verify that the additions or modifications of such database objects are done by the legitimate holder(s) of the Internet resources mentioned in those objects. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on November 11, 2012. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents Kisteleki & Haberman Expires November 11, 2012 [Page 1] Internet-Draft Securing RPSL May 2012 carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Signature Syntax and Semantics . . . . . . . . . . . . . . . . 3 2.1. General Attributes, Meta Information . . . . . . . . . . . 4 2.2. Signed Attributes . . . . . . . . . . . . . . . . . . . . 5 2.3. Storage of the Signature Data . . . . . . . . . . . . . . 6 2.4. Number Resource Coverage . . . . . . . . . . . . . . . . . 6 2.5. Validity Time of the Signature . . . . . . . . . . . . . . 6 3. Signature Creation and Validation Steps . . . . . . . . . . . 7 3.1. Canonicalization . . . . . . . . . . . . . . . . . . . . . 7 3.2. Signature Creation . . . . . . . . . . . . . . . . . . . . 8 3.3. Signature Validation . . . . . . . . . . . . . . . . . . . 9 4. Signed Object Types, Set of Signed Attributes . . . . . . . . 10 5. Keys and Certificates used for Signature and Verification . . 11 6. Security Considerations . . . . . . . . . . . . . . . . . . . 11 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 12 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 12 9. Normative References . . . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 13 Kisteleki & Haberman Expires November 11, 2012 [Page 2] Internet-Draft Securing RPSL May 2012 1. Introduction Objects stored in resource databases, like the RIPE DB, are generally protected by an authentication mechanism: anyone creating or modifying an object in the database has to have proper authorization to do so, and therefore has to go through an authentication procedure (provide a password, certificate, e-mail signature, etc.) However, for objects transferred between resource databases, the authentication is not guaranteed. This means when downloading an object stored in this database, one can reasonably safely claim that the object is authentic, but for an imported object one cannot. Also, once such an object is downloaded from the database, it becomes a simple (but still structured) text file with no integrity protection. More importantly, the authentication and integrity guarantees associated with these objects do not always ensure that the entity that generated them is authorized to make the assertions implied by the data contained in the objects[1]. A potential use for resource certificates [RFC6487] is to employ them to secure such (both imported and downloaded) database objects, by applying a digital signature over the object contents. A maintainer of such signed database objects MUST possess a relevant resource certificate, which shows him/her as the legitimate holder of the Internet number resources in question.=20 This mechanism allows the users of such database objects to verify that the contents are in fact produced by the legitimate holder(s) of the Internet resources mentioned in those objects. It also allows the signatures to cover whole RPSL objects[2], or just selected attributes of them. In other words, a digital signature created using the private key associated with a resource certificate can offer object security in addition to the channel security already present in most of such databases. Object security in turn allows such objects to be hosted in different databases and still be independently verifiable. The capitalized key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 2. Signature Syntax and Semantics When signing an RPSL object, the input for the signature process is transformed into a sequence of strings of (ASCII) data. The approach is similar to the one used in DKIM (Domain Key Identified Mail) [RFC4871]. In the case of RPSL, the object-to-be-signed closely resembles an SMTP header, so it seems reasonable to adapt DKIM's relevant features. Kisteleki & Haberman Expires November 11, 2012 [Page 3] Internet-Draft Securing RPSL May 2012 2.1. General Attributes, Meta Information The digital signature associated with an RPSL object is itself a new attribute named "signature". It consists of mandatory and optional fields. These fields are structured in a sequence of name and value pairs, separated by a semicolon ";" and a white space[3]. Collectively these fields make up the value for the new "signature" attribute. The "name" part of such a component is always a single ASCII character that serves as an identifier; the value is an ASCII string the contents of which depend on the field type. Mandatory fields must appear exactly once, whereas optional fields MUST appear at most once. Mandatory fields of the "signature" attribute: 1. Version number of the signature (field "v"). This field MUST be set to "1". 2. Reference to the certificate corresponding to the private key used to sign this object (field "c"). This is a URL of type "rsync" or "http(s)" that[4] points to a specific resource certificate in an RPKI repository. The value of this field MUST be an "rsync://..." or an "http[s]://..." URL. Any non URL-safe characters (including semicolon ";" and plus "+") must be URL encoded. 3. Signature method (field "m"): what hash and signature algorithms were used to create the signature. The allowed algorithms which can be used for the signature are specified in [RFC6485[5]]. 4. Time of signing (field "t"). The format of the value of this field is the number of seconds since Unix EPOCH (00:00:00 on January 1, 1970 in the UTC time zone). The value is expressed as the decimal representation of an unsigned integer[6]. 5. The signed attributes (field "a"). This is a list of attribute names, each separated by an ASCII "+" character (if more than one attribute is enumerated). The list must include any attribute name = at most once. 6. The signature itself (field "b"). This MUST be the last field in the list. The signature is the output of the signature algorithm using the appropriate private key and the calculated hash value of the object as inputs. The value of this field is the digital signature in base64 encoding [RFC4648]. Optional fields of the "signature" attribute: Kisteleki & Haberman Expires November 11, 2012 [Page 4] Internet-Draft Securing RPSL May 2012 1. Signature expiration time (field "x"). The format of the value of this field is the number of seconds since Unix EPOCH (00:00:00 on January 1, 1970 in the UTC time zone). The value is expressed as the decimal representation of an unsigned integer[7]. 2. Reference(s) to other party's certificate(s) (field "o"). If such certificates are mentioned (referred to) in any signature, then this signature should be considered valid only in case when there are other signatures over this current object, and these other signatures refer to, and can be verified with, the certificates mentioned in this field[8]. This mechanism allows having multiple signatures over an object in such a way that all of these signatures have to be present and valid for the whole signature to be considered valid. This would allow interdependent multi-party signatures over an object. One application for such a mechanism is the case of a route[6] object, where both the prefix owner's and the AS owner's signature might be required (if they are different parties). The va= lue of this field MUST be a list of "rsync://..." or "http[s[9]]://..." URLs. If there are more such reference URLs, then they must be separated with a plus "+" sign. Any non URL-safe characters (including semicolon ";" and plus "+") must be URL encoded[10] in al= l such URLs. 2.2. Signed Attributes One can look at an RPSL object as an (ordered) set of attributes, each having a "key: value" syntax. Understanding this structure can help in developing more[11] flexible methods for applying digital signatures. Some of these attributes are automatically added by the database, some are database-dependent[12], and some do not carry operationally important information. This specification allows the maintainer of each object to specify which attributes are signed and which are not, from among all the attributes associated=20 with an object; in other words, we define a way of including important attributes while excluding irrelevant ones. Allowing the maintainer an object to select the additional attributes covered by the digital=20 signature, subject to the constraints noted=20 below, achieves the goals[13] established in Section 1. The type of the object determines the minimum set of attributes that MUST be signed. The signer MAY choose to sign additional attributes, in order to provide integrity protection for those attributes too. When verifying the signature of an object, the verifier has to check whether the signature itself is valid, and whether all the specified attributes are referenced[14] in the signature. If not, the verifier Kisteleki & Haberman Expires November 11, 2012 [Page 5] Internet-Draft Securing RPSL May 2012 MUST reject the signature and treat the object as a non- signed RPSL object. 2.3. Storage of the Signature Data The result of applying the signature mechanism once is exactly one new attribute for the object. As an illustration, the structure of a signed RPSL object is as follows: attribute1: value1 attribute2: value2 attribute3: value3 ... signature: v=3D1; c=3Drsync://.....; m=3Dsha256WithRSAEncryption; t=3D9999999999; a=3Dattribute1+attribute2+attribute3+...; b=3D 2.4. Number Resource Coverage Even if the signature(s) over the object are valid according to the signature validation rules, they may not be relevant to the object; they also need to cover the relevant Internet number resources mentioned in the object. The term "cover" means =8A Therefore the Internet number resources present in [RFC3779] extensions of the certificate referred to in the "c" field of the signature (or in the union of such extensions in the "c" fields of the certificates, in case multiple signatures are present) MUST cover the resources in the primary key[15] of the object (e.g., value of the "aut-num:" attribute of an aut-num object, value of the "inetnum:" attribute of an inetnum object, values of "route:" and "origin:" attributes of a route object, etc[16].). 2.5. Validity Time of the Signature The validity time interval of a signature is the intersection of the validity time of the certificate used to verify the signature, the "not before" time specified by the "t" field of the signature, and the optional "not after" time specified by the "x" field of the signature[17]. When checking multiple signatures, these checks are applied to each signature, individually. Specifically, the=20 signing time of the object must be contained with=20 the validity interval of all of the certificates=20 used to verify all of the signatures. Kisteleki & Haberman Expires November 11, 2012 [Page 6] Internet-Draft Securing RPSL May 2012 3. Signature Creation and Validation Steps 3.1. Canonicalization The notion of canonicalization is essential to digital signature generation and validation whenever data representations may change between a signer and one or more signature verifiers. Canonicalization defines how one transforms an a representation of data into a series of bits for signature generation and verification. The task of canonicalization is to make irrelevant any differences in representations of the same object that would otherwise cause signature verification to fail. Examples of this are: o data transformations applied by the databases that host these objects (such as notational changes for IPv4/IPv6 prefixes, automatic addition/modification of "changed" attributes, etc.) o the difference of line terminators used in different systems. This means that a database might change the representation of some the submitted data after it was signed, which would cause signature verification to fail, absent canonicalization. This document specifies canonicalization rules to avoid this problem. The following steps MUST be applied in order to achieve canonicalized representation of an object, before the signature generation and verification processes are is performed: 1. Comments (anything beginning with a "#") MUST be omitted. 2. Any trailing white space MUST be omitted[18]. 3. A multi-line attribute MUST be converted into its single-line equivalent. This is accomplished by: * Converting all line endings to a single blank space. * Concatenating all lines into a single line. * Replacing the trailing blank space with a single new line ("\n"). 4. Numerical fields must be converted to canonical representations. These include: * Date and time fields MUST be converted to 64-bit NTP Timestamp Format [RFC5905[19]]. Kisteleki & Haberman Expires November 11, 2012 [Page 7] Internet-Draft Securing RPSL May 2012 * AS numbers MUST be converted to ASPLAIN syntax [RFC5396]. * IPv6 addresses must be canonicalized as defined in [RFC5952]. * IPv4 addresses MUST be converted to a 32-bit[20] representation (e.g., Unix's inet_aton()). * All IP prefixes (IPv4 and IPv6) MUST be represented in CIDR notation [RFC4632]. 5. The name of each attribute MUST be converted into lower case, and MUST be kept as part of the attribute line. 6. A tab character ("\t") MUST be converted to a single space. 7. Multiple whitespaces MUST be collapsed into a single space (" ") character. 8. All line endings MUST be converted to a singe new line ("\n") character (thus avoiding CR vs. CRLF differences). 3.2. Signature Creation Given an RPSL object, in order to create the[21] digital signature, the following steps MUST be performed: 1. For each signature, a new key pair and certificate SHOULD be used. Therefore the signer SHOULD create a single-use key pair and end-entity resource certificate (see [RFC6487]) to be used for signing (and validating) this object. 2. Create a list of attribute names referring to the attributes that will be signed (contents of the "a" field). The minimum set of these attributes is determined by the=20 object type[22] (Section 4); the signer MAY select additional attributes to be signed. 3. Arrange the selected attributes according to the selection sequence specified in the "a" field as above[23], omitting all attributes that will not be signed. 4. Construct the new "signature" attribute, with all its fields, leaving the value of the "b" field empty. 5. Apply canonicalization rules to the result (including the "signature" attribute). Kisteleki & Haberman Expires November 11, 2012 [Page 8] Internet-Draft Securing RPSL May 2012 6. Create the signature over the results of the canonicalization process (according to the signature and hash algorithms specified in the "m" field of the signature attribute). 7. Insert the base64 encoded value of the signature as the value of the "b" field. 8. Append the resulting "signature" attribute to the original object. 3.3. Signature Validation In order to validate a signature of a signed an object, the following steps MUST be performed: 1. Verify the syntax of the "signature" attribute (i.e. whether it contains the mandatory and optional components and the syntax of these fields matches the specification as described in section 2.1.) 2. Fetch the certificate referred to in the "c" field of the "signature" attribute, and check its validity using the steps described in [RFC6487]. If the=20 certificate(s) cannot be acquired, the signature=20 fails. If any certificate fails the verification=20 procedure in [RFC6487], the signature fails. 3. Extract the list of attributes that were signed using the signer from the "a" field of the "signature" attribute. 4. Verify that the list of signed attributes matches the minimum set of attributes for that object type. (If=20 not all mandatory attributes are listed, the=20 signature fails.) 5. Arrange the selected attributes according to the selection sequence provided in the value of the "a" field, omitting all non-signed attributes. If any attribute in=20 the list is not present, the signature fails. 6. Replace the value of the signature field "b" of the "signature" attribute with an empty string. 7. Apply the canonicalization procedure=20 (Section 3.1) to the selected attributes (including the "signature" attribute). 8. Check the validity of the signature using the signature algorithm specified in the "m" field of the signature attribute, the public key contained in the certificate mentioned in the "c" field of the signature, the signature value specified in the "b" field of the signature attribute, and the output of the canonicalization process. Kisteleki & Haberman Expires November 11, 2012 [Page 9] Internet-Draft Securing RPSL May 2012 4. Signed Object Types, Set of Signed Attributes This section describes a list of object types that MAY signed using this approach, and the set of attributes that MUST be signed for these object types[24]. This list generally excludes attributes that are used to maintain referential integrity in the databases that carry these objects. These attributes usually make sense only within the context of a database, whereas the scope of the signatures is a specific object. Since the attributes in a referred object (such as mnt-by, admin-c, tech-c, ...) can change without any modifications to the signed object itself, signing such attributes could lead to false sense = of security (in terms of the contents of the signed data); therefore these attributes should be signed only in=20 order to provide full integrity protection of the object itself[25]. The signature attribute is always included in=20 the list, but is explicitly noted below for=20 completeness. The attributes enumerated below for=20 each object type are the ones that MUST be=20 included the signed attribute list. as-block: * as-block * org * signature aut-num: * aut-num * as-name * member-of * import * mp-import * export * mp-export * default * mp-default * signature inet[6]num: * inet[6]num * netname * country * org * status * signature route[6]: Kisteleki & Haberman Expires November 11, 2012 [Page 10] Internet-Draft Securing RPSL May 2012 * route[6] * origin * holes * org * member-of * signature For each signature, the RFC3779 extension appearing in the certificate[26] used to verify the signature SHOULD[27] include a resour= ce entry that is equivalent to, or covers ("less specific" than[28]) the following resources mentioned in the object the signature is attached to: o For the as-block object type: the resource in the "as-block" attribute. o For the aut-num object type: the resource in the "aut-num" attribute. o For the inet[6]num object type: the resource in the "inet[6]num" attribute. o For the route[6] object type: the resource in the "route[6]" or "origin" (or both) attributes. 5. Keys and Certificates used for Signature and Verification The certificate that is referred to in the signature (in the "c" field): o MUST be an end-entity (i.e. non-CA) certificate o MUST conform to the X.509 PKIX Resource Certificate profile [RFC6487] o MUST have an [RFC3779] extension that contains or covers[29] at least one Internet number resource included in a signed attribute[30]. o SHOULD NOT be used to verify more than one signed object (i.e. should be a "single-use" EE certificate, as defined in [RFC6487]). 6. Security Considerations RPSL objects stored in the IRR databases are public, and as such there is no need for confidentiality. Each signed RPSL object can have its integrity and authenticity verified using the supplied digital signature and the referenced certificate. Since the RPSL signature approach leverages X.509 extensions, the security considerations in [RFC3779] apply here as well. Kisteleki & Haberman Expires November 11, 2012 [Page 11] Internet-Draft Securing RPSL May 2012 7. IANA Considerations [Note to IANA, to be removed prior to publication: there are no IANA considerations stated in this version of the document.] 8. Acknowledgements The authors would like to acknowledge the valued contributions from Jos Boumans, Steve Kent, and Sean Turner in preparation of this document. 9. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC3779] Lynn, C., Kent, S., and K. Seo, "X.509 Extensions for IP Addresses and AS Identifiers", RFC 3779, June 2004. [RFC4632] Fuller, V. and T. Li, "Classless Inter-domain Routing (CIDR): The Internet Address Assignment and Aggregation Plan", BCP 122, RFC 4632, August 2006. [RFC4648] Josefsson, S., "The Base16, Base32, and Base64 Data Encodings", RFC 4648, October 2006. [RFC4871] Allman, E., Callas, J., Delany, M., Libbey, M., Fenton, J., and M. Thomas, "DomainKeys Identified Mail (DKIM) Signatures", RFC 4871, May 2007. [RFC5396] Huston, G. and G. Michaelson, "Textual Representation of Autonomous System (AS) Numbers", RFC 5396, December 2008. [RFC5905] Mills, D., Martin, J., Burbank, J., and W. Kasch, "Network Time Protocol Version 4: Protocol and Algorithms Specification", RFC 5905, June 2010. [RFC5952] Kawamura, S. and M. Kawashima, "A Recommendation for IPv6 Address Text Representation", RFC 5952, August 2010. [RFC6485] Huston, G., "The Profile for Algorithms and Key Sizes for Use in the Resource Public Key Infrastructure (RPKI)", RFC 6485, February 2012. [RFC6487] Huston, G., Michaelson, G., and R. Loomans, "A Profile for X.509 PKIX Resource Certificates", RFC 6487, Kisteleki & Haberman Expires November 11, 2012 [Page 12] Internet-Draft Securing RPSL May 2012 February 2012. Authors' Addresses Robert Kisteleki Email: robert@ripe.net URI: http://www.ripe.net Brian Haberman Johns Hopkins University Applied Physics Lab Phone: +1 443 778 1319 Email: brian@innovationslab.net Kisteleki & Haberman Expires November 11, 2012 [Page 13] [1]Please move the last sentence to the=20 beginning, and re-word. It's odd to have a=20 sentence that claims to contain the "more=20 important" argument for using signatures be at=20 the end :). [2]Not reading ahead yet, but I argued previously=20 that signing data that is not covered by the RPKI=20 certificate creates a false sense of security.=20 Hopefully this concern is addressed later in this=20 document. [3]"a" white space or just "white space" which=20 allows more than one space, tab, etc? [4]rsync support is mandatory in the RPKI, while=20 http is not. This distinction should be reflected=20 in this attribute. [5]This does not tell me how to encode the=20 signature method, unless you intend for the value=20 of "m" to be an OID. If, in the future, we want=20 to support DSA/ECDSA signatures, we may need to=20 specific curves and points. Unless we assign an=20 OID for each combination, this description of=20 "m:" is not sufficient. [6]Since this field value is compared to the=20 validity interval from certificates, it might=20 make more sense to adopt the character string=20 format used there. Also, that format has a time=20 zone, and there is no mention of a TZ here, which=20 leads to ambiguity re the comparison. [7]Same comment as above re signature time format. [8]This sentence is way too long to be=20 understandable. Please rephrase. Also, this text=20 does not explain how multiple signatures are=20 applied, e.g., are they parallel or serial? Only=20 later, in the details of signature generation,=20 can on determine (reading between the lines) that=20 multiple signatures are serialized, I think. [9]Same comment as earlier re rsync vs. https support [10]Cite an RFC here. [11]More than what? [12]What does this mean? [13]There is no clearly enumerated goal list in Section 1. [14]"referenced" is not well defined yet. [15]Define this term, or cite an RFC that defines it in RPSL. [16]This example is too long a sentence/phrase to=20 be easily understood. What is needed is a more=20 explicit description of the relationship between=20 the 3779 extension values and the relevant=20 attributes, probably by a table. Also, the term=20 "union" is ambiguous here. [17]I'm surprised that the requirement here does=20 not require the signing time be bounded by the=20 not before and not after times in each=20 certificate, if that is the intent, it needs to=20 be stated more clearly, as a series of checks to=20 be performed. [18]How about changing multiple white spaces to a=20 single white space, analogous to step 3.2? [19]See my comments about time formats above. [20]32-bit ? This is binary object, while most=20 other data values are character strings. [21]This described how to perform a single=20 signature. It omits important details about=20 performing multiple signatures on the same object. [22]Do we specify a canonical order for the attributes that MUST be signed. [23]See comment above re attribute order. [24]The list below is confusing because it fails=20 to state explicitly that these are these the MUST=20 attributes. I like having a list of MAYs, as=20 indicated here, instead of allowing a signer to=20 choose ANY additional attributes to sign, but I=20 don't see that list below. [25]By the end of this paragraph, I no longer=20 know if these examples are precluded from=20 signing, or if they are MAYs! [26]Here the certificate is singular. Make it=20 clear where multiple signatures are=20 needed/allowed, and where only one certificate is=20 allowed. [27]Not MUST? [28]You need more text here to explain the=20 verification procedure, and probably some=20 examples too. [29]"contains or covers" is imprecise. [30]Huh? I would think that, in the simple case,=20 the certificate MUST contain one or more 3779=20 extensions that cover EVERY resource attribute. --============_-872969347==_============-- From rogaglia@cisco.com Fri Jun 8 06:10:25 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 502F821F881B for ; Fri, 8 Jun 2012 06:10:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.598 X-Spam-Level: X-Spam-Status: No, score=-10.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fSYbVA9UKQiX for ; Fri, 8 Jun 2012 06:10:24 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 48E1321F8809 for ; Fri, 8 Jun 2012 06:10:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=rogaglia@cisco.com; l=13105; q=dns/txt; s=iport; t=1339161022; x=1340370622; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=kUJ55q1TkGivf87Puxg1WRFvOB+kodoFv9ZwnYZB6uY=; b=hkof86d7hzysSSkn42aOcJ0k398k6t2iVH4HqFXPvNMXrUEnI1BjKTDs fG4d/KGf235qPgB/HDabc828sFUz3lsv+l2qj3KUQwVuQZnUgjKyBkZ4w hEuxW+VxCNDPEPWjQVYCu/3F/2rWJmGXeZ/SIT++CsvOWLkPZJiiN37RO w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av4EALb40U+tJV2Z/2dsb2JhbABFtE6BB4IZAQEEEgFfBxACAQg/BzIUEQIEDgUZCYdpmTmfbYVwhTaFIGADlR6OFYFmgmCBVgIfBA X-IronPort-AV: E=Sophos;i="4.75,738,1330905600"; d="scan'208,217";a="90728102" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-5.cisco.com with ESMTP; 08 Jun 2012 13:10:21 +0000 Received: from xhc-rcd-x08.cisco.com (xhc-rcd-x08.cisco.com [173.37.183.82]) by rcdn-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id q58DALV1005574 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Fri, 8 Jun 2012 13:10:21 GMT Received: from xmb-rcd-x01.cisco.com ([169.254.1.99]) by xhc-rcd-x08.cisco.com ([173.37.183.82]) with mapi id 14.02.0298.004; Fri, 8 Jun 2012 08:10:21 -0500 From: "Roque Gagliano (rogaglia)" To: Terry Manderson Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: AQHNRXgOmeMHLOI6skGjzaABNoC0Kw== Date: Fri, 8 Jun 2012 13:10:20 +0000 Message-ID: <2F3884FD-D52F-4C3C-8920-292DDFA11C65@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.147.19.47] x-tm-as-product-ver: SMEX-10.2.0.1135-6.800.1017-18954.006 x-tm-as-result: No--43.153200-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: multipart/alternative; boundary="_000_2F3884FDD52F4C3C8920292DDFA11C65ciscocom_" MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 08 Jun 2012 13:10:25 -0000 --_000_2F3884FDD52F4C3C8920292DDFA11C65ciscocom_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Terry, On Jun 8, 2012, at 2:30 AM, Terry Manderson wrote: Hey Roque, On 7/06/12 5:53 PM, "Roque Gagliano (rogaglia)" > wrote: On Jun 7, 2012, at 7:54 AM, Terry Manderson wrote: I had the same reaction as you. I looked at the CP document and the Cert. Profile. The best reference to this use-case is the second paragraph of the Security Section on RFC 6487: " A resource certificate PKI cannot in and of itself resolve any forms of ambiguity relating to uniqueness of assertions of rights of use in the event that two or more valid certificates encompass the same resource. If the issuance of resource certificates is aligned to the status of resource allocations and assignments, then the information conveyed in a certificate is no better than the information in the allocation and assignment databases." Thanks for that. But aren't we ultimately talking about _who_ issues the ROAs and what their contents are in relation to the intent of the resource user? This is more a question for Randy. IMHO, his text says both: "A may certify G's resources, or issue one or more EE certificates and ROAs= for G's resources. Which is done is a local matter between A and G." BTW, My understanding of that paragraph was about situations where you have trust anchors that overlap. Your english is definitely better than mine, but I do not find any referenc= e to trust anchors. I think it applies generally to any registry database. My understanding of Randy's proposal is that both C and G will have for a period of time the "right of use" for the 10.42.2.0/23 address space. The idealistic stance might be that the RPKI and associated drafts should not recommend a situation of ambiguity. Being able to have two different ROAs (with different ASNs) for the same prefix issued by EE certs from different res certs (thus different private keys) seems like it is making life tough for the relying party. How would a RP check this? (think particularly on bottom-up fetch + validat= ion) What the RFC 6487 security section is basically saying is that you should b= e at least as good as your registration back-end. Your proposal on the first paragraph is an alternative but I would say that it w= ill be much harder to "make before break". Is it? So step wise since G is moving ISPs from C to A (and they originate the route on G's behalf): 1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/23, AS-'C' (10.42.2.0/23 AS-"C" route VALID) 1.5) Worst case of "A" is slow between revoking/reissuing C's cert (all routes UNKNOWN, but still routable) Here you break. UNKNOWN/NOT FOUND may have a different policy (loc. pref. ,= etc.). 2) "C" gets new cert from "A" for 10.42.0.0/23,10.42.4.0/22,10.42.8.0/21,10.42.16.0/20,10.42.32.0/19,10.42.64= . 0/18,10.42.128.0/17. And recreates it's own ROAs (10.42.2.0/23 AS-"A" route UNKNOWN) 3) "A" (on G's behalf) issues ROA for 10.42.2.0/23, AS-'A' (10.42.2.0/23 route VALID) I think this is a very easy for a relying party to interpret, and 'get it right' If a recommendation comes forth that says: step wise: 1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/23, AS-'C' (10.42.2.0/23 route VALID) 2) "A" on behalf of "G" issues ROA for 10.42.2.0/23, AS-'A' while ROA issue= d for 10.42.2.0/23, AS-'C' exists (10.42.2.0/23 originated by both AS-"C" and AS-"A" valid) 3) C removes the ROA 10.42.2.0/23, AS-'C' (10.42.2.0/23 originated by AS-"G") Keeping in mind that the example highlights that "C" is moving away from provider "A", but keeping its address space. So at the point 2 is it clear what is the intention of the IP address user "G"? Who it seems has no skin in the game as "G" doesn't have a RPKI private key nor certificate. I'm not sure (right now) that allowing multiple 'resource holders' to creat= e valid MOAS scenarios is a good idea. I accept MOAS do naturally exist, but generally at the desire of one single resource holder or at least one would hope. Is my interpretation wrong here? Is this really just harmless? or does this also then tease out political[*] aspects where an RIR can or might 'responsibly' issue RPKI objects from their own resource cert? I have not written RP software, but I believe it will be harmless as it wou= ld validate. I do not believe iit breaks the CP document as the only refer= ence to "unique holder" that I found was in the abstract section. All in all, I think it is good that Randy raised this issue. I wonder if we= need another document or add it to the "Use Case" document as it has not y= et been ship to the IESG. Roque [*] yes, yes, the IETF is not a politically focused organisation. ;) Terry --_000_2F3884FDD52F4C3C8920292DDFA11C65ciscocom_ Content-Type: text/html; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable Terry,

On Jun 8, 2012, at 2:30 AM, Terry Manderson wrote:

Hey Roque,

On 7/06/12 5:53 PM, "Roque Gagliano (rogaglia)" <rogaglia@cisco.com> wrote:

On Jun 7, 2012, at 7:54 AM, Terry Manderson wrote= :


I had the same reaction as you. I looked at the C= P document and the Cert.
Profile. The best reference to this use-case is t= he second paragraph of the
Security Section on RFC 6487:
"   A resource certificate PKI can= not in and of itself resolve any forms
  of ambiguity relating to uniqueness o= f assertions of rights of use in
  the event that two or more valid cert= ificates encompass the same
  resource.  If the issuance of re= source certificates is aligned to the
  status of resource allocations and as= signments, then the information
  conveyed in a certificate is no bette= r than the information in the
  allocation and assignment databases.&= quot;

Thanks for that. But aren't we ultimately talking about _who_ issues the ROAs and what their contents are in relation to the intent of the resource<= br> user?

This is more a question for Randy. 

IMHO, his text says both:
"A may certify G's resources, or issue one or more EE certificat= es and ROAs for G's resources. Which is done is a local matter betwee= n A and G."

BTW, My understanding of that paragraph was about situations where you= have
trust anchors that overlap.

Your english is definitely better than mine, but I do not find any ref= erence to trust anchors. I think it applies generally to any registry datab= ase.


My understanding of Randy's proposal is that both= C and G will have for a
period of time the "right of use" for t= he 10.42.2.0/23 address space.

The idealistic stance might be that the RPKI and associated drafts should not recommend a situation of ambiguity. Being able to have two different ROAs (with different ASNs) for the same prefix issued by EE certs from
different res certs (thus different private keys) seems like it is making life tough for the relying party.

How would a RP check this? (think particularly on bottom-up fetch += ; validation)
What the RFC 6487 security section is basically saying is that yo= u should be at least as good as your registration back-end. 


Your
proposal on the first paragraph is an alternative= but I would say that it will
be much harder to "make before break".<= br>

Is it?

So step wise since G is moving ISPs from C to A (and they originate the
route on G's behalf):

1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/= 23, AS-'C'
(10.42.2.0/23 AS-"C" route VALID)
1.5) Worst case of "A" is slow between revoking/reissuing C's cer= t (all
routes UNKNOWN, but still routable)

Here you break. UNKNOWN/NOT FOUND may have a different policy (loc. pr= ef. ,etc.).

2) "C" gets new cert from "A" for
10.42.0.0/23,10.42.4.0/22,10.42.8.0/21,10.42.16.0/20,10.42.32.0/19,10.42.64= .
0/18,10.42.128.0/17. And recreates it's own ROAs (10.42.2.0/23 AS-"A&q= uot; route
UNKNOWN)
3) "A" (on G's behalf) issues ROA for 10.42.2.0/23, AS-'A' (10.42= .2.0/23
route VALID)

I think this is a very easy for a relying party to interpret, and 'get it right'

If a recommendation comes forth that says:

step wise:
1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/= 23, AS-'C'
(10.42.2.0/23 route VALID)
2) "A" on behalf of "G" issues ROA for 10.42.2.0/23, AS= -'A' while ROA issued
for 10.42.2.0/23, AS-'C' exists (10.42.2.0/23 originated by both AS-"C= " and
AS-"A" valid)
3) C removes the ROA 10.42.2.0/23, AS-'C' (10.42.2.0/23 originated by
AS-"G")

Keeping in mind that the example highlights that "C" is movi= ng away from
provider "A", but keeping its address space. So at the point 2 is= it clear
what is the intention of the IP address user "G"? Who it seems ha= s no skin
in the game as "G" doesn't have a RPKI private key nor certificat= e.
I'm not sure (right now) that allowing multiple 'resource holders' to = create
valid MOAS scenarios is a good idea. I accept MOAS do naturally exist, but<= br> generally at the desire of one single resource holder or at least one would=
hope.
Is my interpretation wrong here? Is this really just harmless? or does= this
also then tease out political[*] aspects where an RIR can or might
'responsibly' issue RPKI objects from their own resource cert?

I have not written RP software, but I believe it will be harmless as i= t would validate.  I do not believe iit breaks the CP document as the = only reference to "unique holder" that I found was in the abstrac= t section.

All in all, I think it is good that Randy raised this issue. I wonder = if we need another document or add it to the "Use Case" document = as it has not yet been ship to the IESG.

Roque


[*] yes, yes, the IETF is not a politically focused organisation. ;)
Terry

--_000_2F3884FDD52F4C3C8920292DDFA11C65ciscocom_-- From randy@psg.com Sat Jun 9 04:14:15 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC6EB21F8493 for ; Sat, 9 Jun 2012 04:14:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.772 X-Spam-Level: X-Spam-Status: No, score=-1.772 tagged_above=-999 required=5 tests=[AWL=-0.662, BAYES_05=-1.11] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O1meHOfX4i7R for ; Sat, 9 Jun 2012 04:14:15 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 4D88121F84A2 for ; Sat, 9 Jun 2012 04:14:15 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SdJcS-000MLu-BG; Sat, 09 Jun 2012 11:14:12 +0000 Date: Sat, 09 Jun 2012 04:14:11 -0700 Message-ID: From: Randy Bush To: Byron Ellacott In-Reply-To: References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Jun 2012 11:14:15 -0000 byron and all, before the wanderings, there were three announcements. A 10.0.0.0/8 C 10.42.0.0/16 G 10.42.2.0/2 gonna be hard to convince C to become chopped liver so that G can be independent. also gonna be a bit of pollution. randy From warren@kumari.net Sat Jun 9 15:01:30 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30DAB21F861D for ; Sat, 9 Jun 2012 15:01:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.438 X-Spam-Level: X-Spam-Status: No, score=-106.438 tagged_above=-999 required=5 tests=[AWL=0.161, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bUa-LfbGA976 for ; Sat, 9 Jun 2012 15:01:29 -0700 (PDT) Received: from vimes.kumari.net (vimes.kumari.net [198.186.192.250]) by ietfa.amsl.com (Postfix) with ESMTP id 9E06621F860F for ; Sat, 9 Jun 2012 15:01:29 -0700 (PDT) Received: from [192.168.0.12] (unknown [64.13.52.115]) by vimes.kumari.net (Postfix) with ESMTPSA id 683FF1B40256; Sat, 9 Jun 2012 18:01:28 -0400 (EDT) Mime-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset=windows-1252 From: Warren Kumari In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> Date: Sat, 9 Jun 2012 18:01:25 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> To: "Murphy, Sandra" X-Mailer: Apple Mail (2.1278) Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Jun 2012 22:01:30 -0000 On Jun 1, 2012, at 7:00 PM, Murphy, Sandra wrote: > The authors have stated that they believe that = draft-ietf-sidr-pfx-validate-06 "BGP Prefix Origin Validation" is ready = for a working group last call. >=20 > The draft can be accessed at = http://tools.ietf.org/html/draft-ietf-sidr-pfx-validate-06 and = https://datatracker.ietf.org/doc/draft-ietf-sidr-pfx-validate/ >=20 > This announces the beginning of the wglc. The last call will end on = Friday, 15 Jun 2012. >=20 > Please judge whether you believe that this work is ready for = publication and send any comments to the list. I'd like to note that there was IPR filed on this (submitted on = 2011-06-02, posted at https://datatracker.ietf.org/ipr/1569/. The title of the IPR disclosure is "Cisco's Statement of IPR Related to = draft-ietf-sidr-pfx-validate-01."")). I do not recall there being any real discussions as to how the WG felt = about advancing an encumbered draft (but perhaps there was when it was = adopted (the pre-WG doc was also encumbered)?), but figured I should = mention. I have read and support this draft (although, in case it wasn't obvious, = would prefer it if it had no IPR=85) W >=20 > --Sandy, speaking as wg co-chair > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr >=20 -- Consider orang-utans. In all the worlds graced by their presence, it is suspected that they = can talk but choose not to do so in case humans put them to work, = possibly in the television industry. In fact they can talk. It's just = that they talk in Orang-utan. Humans are only capable of listening in = Bewilderment. -- Terry Practhett From randy@psg.com Sat Jun 9 15:31:07 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63A8D21F85A4 for ; Sat, 9 Jun 2012 15:31:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.499 X-Spam-Level: X-Spam-Status: No, score=-2.499 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IJl57GyPoiGg for ; Sat, 9 Jun 2012 15:31:06 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 7762C21F856D for ; Sat, 9 Jun 2012 15:31:01 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SdUBP-000NcJ-Ro; Sat, 09 Jun 2012 22:31:00 +0000 Date: Sat, 09 Jun 2012 15:30:59 -0700 Message-ID: From: Randy Bush To: Byron Ellacott In-Reply-To: References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Jun 2012 22:31:07 -0000 > before the wanderings, there were three announcements. > A 10.0.0.0/8 > C 10.42.0.0/16 > G 10.42.2.0/2 /24 > gonna be hard to convince C to become chopped liver so that G can be > independent. also gonna be a bit of pollution. randy From hannes@juniper.net Mon Jun 11 08:14:48 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFE0E21F862B for ; Mon, 11 Jun 2012 08:14:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.587 X-Spam-Level: X-Spam-Status: No, score=-4.587 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FAKE_REPLY_C=2.012, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NoVLpe1kNbaf for ; Mon, 11 Jun 2012 08:14:47 -0700 (PDT) Received: from exprod7og125.obsmtp.com (exprod7og125.obsmtp.com [64.18.2.28]) by ietfa.amsl.com (Postfix) with ESMTP id A48B321F8566 for ; Mon, 11 Jun 2012 08:14:46 -0700 (PDT) Received: from P-EMHUB03-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob125.postini.com ([64.18.6.12]) with SMTP ID DSNKT9YLZWON/HPwUBDJMeMpP03kD/TKIafS@postini.com; Mon, 11 Jun 2012 08:14:46 PDT Received: from ubuntu (172.23.5.207) by P-EMHUB03-HQ.jnpr.net (172.24.192.33) with Microsoft SMTP Server id 8.3.213.0; Mon, 11 Jun 2012 08:13:08 -0700 Received: by ubuntu (Postfix, from userid 1000) id 38BAE20F72; Mon, 11 Jun 2012 17:12:50 +0200 (CEST) Date: Mon, 11 Jun 2012 17:12:50 +0200 From: Hannes Gredler To: Randy Bush Message-ID: <20120611151250.GB13019@juniper.net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Cc: sidr wg list Subject: Re: [sidr] I-D Action: WGLC on draft-ietf-sidr-pfx-validate-06.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jun 2012 15:14:48 -0000 ... have implemented logic as mentioned in the draft, code got hardened the last 9 months, exposed to our SP customers, could not spot any glaring errors; support ! - thanks, /hannes From Sandra.Murphy@sparta.com Mon Jun 11 12:45:31 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6746621F8624 for ; Mon, 11 Jun 2012 12:45:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bTWxo4LG0Q69 for ; Mon, 11 Jun 2012 12:45:30 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 7FA4121F861A for ; Mon, 11 Jun 2012 12:45:30 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5BJjSEU015487 for ; Mon, 11 Jun 2012 14:45:28 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5BJjSn6021147 for ; Mon, 11 Jun 2012 14:45:28 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Mon, 11 Jun 2012 15:45:18 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: audio recording for 06 Jun 2012 interim meetings Thread-Index: Ac1ICjMh2zBQeOVHQ02/D77fAxOhCw== Date: Mon, 11 Jun 2012 19:45:17 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A0A8@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.137] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] audio recording for 06 Jun 2012 interim meetings X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jun 2012 19:45:31 -0000 For those interested in the outcome of the 06 Jun interim meeting last week= , the audio recording is available at:=0A= =0A= https://ietf.webex.com/ietf/lsr.php?AT=3Dpb&SP=3DEC&rID=3D7070277&rKey=3D92= b809cece287683 =0A= =0A= You can playback online or download for local playback - by installing the = webex recording player.=0A= =0A= --Sandy=0A= From ejkern@gmail.com Mon Jun 11 14:05:04 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5CBCB21F8582 for ; Mon, 11 Jun 2012 14:05:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X8T14OwgYLiU for ; Mon, 11 Jun 2012 14:05:03 -0700 (PDT) Received: from mail-pb0-f44.google.com (mail-pb0-f44.google.com [209.85.160.44]) by ietfa.amsl.com (Postfix) with ESMTP id D39BA11E8083 for ; Mon, 11 Jun 2012 14:05:03 -0700 (PDT) Received: by pbcwy7 with SMTP id wy7so6072354pbc.31 for ; Mon, 11 Jun 2012 14:05:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:mime-version:content-type:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to:x-mailer; bh=ZJ5jTNuo5s9CpSjEUZh2WtJmeKq4zq6xH+9aBnIYDis=; b=UOCg6/eUUTGDrRYKqeANGptE8dQ/IjzB0SUvigyh0Z2tBlZZy9bA8BArPqOeZY3O2Q RG9esOjiRob7QctOebayJpalZgiZPZP9c6wuD8wZPG/VwwP2P9WZPATtpTTtZ8JkA5pu jss82Ve7Ft0EcEPxeq9OEj1Zvj+NtUHcOnGp2TbT/RX2/KUGTe0Y1gKeokZ292cbJLNW Jsy5oE3L9CzrGKdU2OohkN6VSBAdL4/8qzLJkDjR8gmvlEtv5R98F4X7UNLb/NoLKChQ UX9XCH9eDhxeS/6uXZpKmwzp4CRynAnFzy1OdmKLIKTZ/f91/rd13tswhpxosip6+OI4 rIIw== Received: by 10.68.134.161 with SMTP id pl1mr30712619pbb.29.1339448703590; Mon, 11 Jun 2012 14:05:03 -0700 (PDT) Received: from [10.0.2.2] (128-107-239-233.cisco.com. [128.107.239.233]) by mx.google.com with ESMTPS id ph1sm19637858pbb.45.2012.06.11.14.05.02 (version=TLSv1/SSLv3 cipher=OTHER); Mon, 11 Jun 2012 14:05:02 -0700 (PDT) Mime-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset=us-ascii From: Ed Kern In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> Date: Mon, 11 Jun 2012 14:05:00 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: <77B9F8E3-804D-4D1A-9C99-6EDCC8924398@gmail.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> To: "Murphy, Sandra" X-Mailer: Apple Mail (2.1278) Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Jun 2012 21:05:04 -0000 Have read numerous versions along the way....Am happy and support 06 for = advancement. Ed On Jun 1, 2012, at 4:00 PM, Murphy, Sandra wrote: > The authors have stated that they believe that = draft-ietf-sidr-pfx-validate-06 "BGP Prefix Origin Validation" is ready = for a working group last call. >=20 > The draft can be accessed at = http://tools.ietf.org/html/draft-ietf-sidr-pfx-validate-06 and = https://datatracker.ietf.org/doc/draft-ietf-sidr-pfx-validate/ >=20 > This announces the beginning of the wglc. The last call will end on = Friday, 15 Jun 2012. >=20 > Please judge whether you believe that this work is ready for = publication and send any comments to the list. >=20 > --Sandy, speaking as wg co-chair > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From terry.manderson@icann.org Mon Jun 11 17:28:26 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4473821F8550 for ; Mon, 11 Jun 2012 17:28:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hrokn+NkepDS for ; Mon, 11 Jun 2012 17:28:25 -0700 (PDT) Received: from EXPFE100-1.exc.icann.org (expfe100-1.exc.icann.org [64.78.22.236]) by ietfa.amsl.com (Postfix) with ESMTP id 90D6421F849A for ; Mon, 11 Jun 2012 17:28:25 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-1.exc.icann.org ([64.78.22.236]) with mapi; Mon, 11 Jun 2012 17:28:25 -0700 From: Terry Manderson To: "Roque Gagliano (rogaglia)" Date: Mon, 11 Jun 2012 17:28:20 -0700 Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: AQHNRXgOmeMHLOI6skGjzaABNoC0K5b12Zn4 Message-ID: In-Reply-To: <2F3884FD-D52F-4C3C-8920-292DDFA11C65@cisco.com> Accept-Language: en-US Content-Language: en X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3422341700_36292392" MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 00:28:26 -0000 --B_3422341700_36292392 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi Roque, On 8/06/12 11:10 PM, "Roque Gagliano (rogaglia)" wrote: > > This is more a question for Randy. > > IMHO, his text says both: > "A may certify G's resources, or issue one or more EE certificates and ROAs > for G's resources. Which is done is a local matter between A and G." Fair enough, although I'm not so sure that it makes sense to > >> BTW, My understanding of that paragraph was about situations where you have >> trust anchors that overlap. > > Your english is definitely better than mine, but I do not find any reference > to trust anchors. I think it applies generally to any registry database. > My understanding comes from probably a bad memory of the early discussions relating to such 'uniqness' issues. >> >>> My understanding of Randy's proposal is that both C and G will have for a >>> period of time the "right of use" for the 10.42.2.0/23 address space. >> >> The idealistic stance might be that the RPKI and associated drafts should >> not recommend a situation of ambiguity. Being able to have two different >> ROAs (with different ASNs) for the same prefix issued by EE certs from >> different res certs (thus different private keys) seems like it is making >> life tough for the relying party. > > How would a RP check this? (think particularly on bottom-up fetch + > validation) As far as I can tell, without experimentation, is that any match would work. So if both AS 'C' and AS 'G' originate the 10.42.2.0/23 route and both ROAs may exist, then you have a MOAS event. > What the RFC 6487 security section is basically saying is that you should be > at least as good as your registration back-end. > I think you are trying say "we know that G has the resource, but are going to pretend they don't so we can cut a ROA for G, so that their routing works but we can be lazy on changing certs to C." That might not be a bad thing, if there was some way to inhibit C from creating a ROA, that might mess with G. The idea that securing routing is based on 'a legitimate holder' [rfc6480] being able to authorize one or more ASes of its choosing appears to be relaxed in this text. Is that a slippery slope? >> >> Is it? >> >> So step wise since G is moving ISPs from C to A (and they originate the >> route on G's behalf): >> >> 1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/23, AS-'C' >> (10.42.2.0/23 AS-"C" route VALID) >> 1.5) Worst case of "A" is slow between revoking/reissuing C's cert (all >> routes UNKNOWN, but still routable) > > Here you break. UNKNOWN/NOT FOUND may have a different policy (loc. pref. > ,etc.). OK. lets just say "UNKNOWN". I feel more comfortable in knowing that a RP can make decision based on unambiguous information. Be that implemented in local policy application (local pref etc) or otherwise. > > I have not written RP software, but I believe it will be harmless as it would > validate. I do not believe iit breaks the CP document as the only reference > to "unique holder" that I found was in the abstract section. Indeed. I always considered the holder to be very singular in nature. > > All in all, I think it is good that Randy raised this issue. I wonder if we > need another document or add it to the "Use Case" document as it has not yet > been ship to the IESG. Good question. T. --B_3422341700_36292392 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIQAQYJKoZIhvcNAQcCoIIP8jCCD+4CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC Dc0wggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjGCAfwwggH4AgEBMHYwYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xAhAPz2lJUZsAlD35l4oJxf0FMAkGBSsO AwIaBQCgXTAjBgkqhkiG9w0BCQQxFgQUJbPovE7aqLAxyS563xA7m8kV3e0wGAYJKoZIhvcN AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwNjEyMDAyODIwWjANBgkqhkiG 9w0BAQEFAASCAQAdzDQBB3YWqXCy/jyX5D9Xx7+DbPDPLssY5Mpu8Gt7Icxztb6HDtYfAEJJ u3h/taJfdDu7Pf5jeoabN8fuJ8tHLJTB3VXVOrUt0ndMjG8c8Ak0a7BcPkes/9epGEU02fd0 wKDjxV76Z9oWLj3U9WUnKYLlLZxa4u1zZJ91aP1GK0nbXDmmBWEiGEN5Fbu4VmOO7m7MyLGY KVwMB6SOw2VAbY8N/4uo+fkPXbc1Co4L8PbRzvCnK7aVkzqkyPOqsougDUI0Gix+agZaUJ4E hbDnMAqEzysuriflhIBLkTn7wL18bBTxXIkJv/HyEwKxqqFtxQv02kNH4jVi5xgM5p4v --B_3422341700_36292392-- From terry.manderson@icann.org Mon Jun 11 17:28:26 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37B8F21F854D for ; Mon, 11 Jun 2012 17:28:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MC2euwa0JKwL for ; Mon, 11 Jun 2012 17:28:25 -0700 (PDT) Received: from EXPFE100-2.exc.icann.org (expfe100-2.exc.icann.org [64.78.22.237]) by ietfa.amsl.com (Postfix) with ESMTP id 920CE21F852A for ; Mon, 11 Jun 2012 17:28:25 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-2.exc.icann.org ([64.78.22.237]) with mapi; Mon, 11 Jun 2012 17:28:25 -0700 From: Terry Manderson To: Randy Bush , Byron Ellacott Date: Mon, 11 Jun 2012 17:28:17 -0700 Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: Ac1Gj53/Rj1/BNaOQs2DzA1efNjnTQBoqTMu Message-ID: In-Reply-To: Accept-Language: en-US Content-Language: en X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3422341697_36297637" MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 00:28:26 -0000 --B_3422341697_36297637 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi Randy, On 10/06/12 8:30 AM, "Randy Bush" wrote: >> before the wanderings, there were three announcements. >> A 10.0.0.0/8 >> C 10.42.0.0/16 >> G 10.42.2.0/2 > /24 > >> gonna be hard to convince C to become chopped liver so that G can be >> independent. also gonna be a bit of pollution. > Can you define 'pollution'? in what sense? In C no longer going to announce the full /16 aggregate? Is the goal here routing security, or bgp table growth limitation? Why does 'C' having their resource certificate list specifically what resources they are in control of ("chopped liver") and therefore what they can announce/route have any bearing on something that is a) the antecedent for routing security, and B) something that is mostly machine generated and machine parsed? Cheers Terry --B_3422341697_36297637 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIQAQYJKoZIhvcNAQcCoIIP8jCCD+4CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC Dc0wggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjGCAfwwggH4AgEBMHYwYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xAhAPz2lJUZsAlD35l4oJxf0FMAkGBSsO AwIaBQCgXTAjBgkqhkiG9w0BCQQxFgQUc6xOhw8hGfIC0CHvxHMf4bMI2LYwGAYJKoZIhvcN AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwNjEyMDAyODE3WjANBgkqhkiG 9w0BAQEFAASCAQAkLV+7Tb6oTZXlWsNkDPxANyH6FJsD4acXHsRCVqEnMhVoSXcNdF7/j2xR 3KZJxSgqlVI1JqiojNbdifzRJd47zg87cqli5QUsjxcrS3gCvCJ5gfQ6tcDnK1EmQaEdV04s 7iR8fqb2NX8tPgkYPhREDLO/V/tobhI75xWTSQ4r/GbkzFrAjE347uqtN/YphWEp1e7CAPhE WESOOi1d29DvSWvYIFVqyt5KVLje+P/lhouHIPjJPM/UJHZu9vq658OSosuV+0gwsHtKORiH LCuNOGCeAgPIIEgU/kgV92WoM3hRMjSyH0BJhop/kiq/OL8krWWKAwGc4SQUdLFvoz4t --B_3422341697_36297637-- From tim@ripe.net Tue Jun 12 01:31:26 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0A2C21F85A3 for ; Tue, 12 Jun 2012 01:31:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ucnzg0a7ifZc for ; Tue, 12 Jun 2012 01:31:26 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id BFA5821F8510 for ; Tue, 12 Jun 2012 01:31:25 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1SeMVV-0006Rk-31; Tue, 12 Jun 2012 10:31:23 +0200 Received: from s258-sslvpn-1.ripe.net ([193.0.20.231] helo=vpn-142.ripe.net) by ayeaye.ripe.net with esmtps (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1SeMVU-0003BK-Jw; Tue, 12 Jun 2012 10:31:20 +0200 Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Tim Bruijnzeels In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> Date: Tue, 12 Jun 2012 10:31:19 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> To: "Murphy, Sandra" X-Mailer: Apple Mail (2.1084) X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20120612 clean X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a071988437e8b36b5d2ee993bed2014ec186b Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 08:31:26 -0000 Hi, On 2 Jun 2012, at 01:00, Murphy, Sandra wrote: > The authors have stated that they believe that = draft-ietf-sidr-pfx-validate-06 "BGP Prefix Origin Validation" is ready = for a working group last call. Prefix validate assumes full knowledge of all applicable ROAs (or other = sources of information if they are used) and I believe this should be = stated more strongly. The security considerations section addresses the possibility of a = malicious attacker tampering with the database that is used for = validation. It does not address the possibility of a database becoming = incomplete for other reasons.=20 In particular I am worried about repositories: 1- being completely unreachable for a prolonged time 2- being inconsistent @1: A relying party tool may choose to use old information if a repository = can not be reached. This assumes that the RP has this old data, and it = will only work for a while. There is some unclarity what to do if the = manifest goes stale (next update time in the past) vs a manifest EE = certificate expiring (http://tools.ietf.org/html/rfc6486#section-5.1 = dictates a one-time use EE cert should match this). In particular consider this case: Parent CA: - has cert for 10/8 - ROA for 10.0/16 AS A - signed cert to child for 10.0.0.0/22 Child CA: - publication point is unreachable, old data expired (new RP instances = unaware even) There is a very real possibility that the parent's ROA invalidates the = child announcements. I believe that the only reasonable, automated, action an RP can take in = this case is to disregard any INRs mentioned on the child CA's cert = whose pub point is unreachable. @2: With inconsistent I mean the following cases: - hash invalid for ROA - missing ROA - surplus ROA The RP has a very tough time deciding what to do: - the invalid ROA could be a publication error, or it could be that = another ROA with the same name was intended to be published, but we = didn't see it - a missing ROA could validate an announcement that is now considered = invalid because of another ROA - the surplus ROA's intention is unclear, it could be that the CA forgot = to delete and revoke this, and it's invalidating announcement(s) I understand that the authors intended manifests as a replay detection = mechanism and most of the wording regarding validation uses SHOULDs and = 'local policy'. However, I believe that this is not strong enough for = pfx-validate. Local policy sounds very reasonable when in doubt, but I = have no faith that operators will have enough knowledge to make educated = decisions in all these cases. By and large I expect that operators will = go with the *default* local policy decisions that are implemented in the = RP tool they use. In short I think that pfx-validate's requirement for full knowledge = dictate that there MUST be a valid manifest listing the ROAs the CA = intended to publish, they MUST all be present, all be valid, and no = additional ROAs for the publication point can be considered. From keyupate@cisco.com Tue Jun 12 02:19:10 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD2B521F863B for ; Tue, 12 Jun 2012 02:19:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 18sz1SPCeoyg for ; Tue, 12 Jun 2012 02:19:10 -0700 (PDT) Received: from mtv-iport-1.cisco.com (mtv-iport-1.cisco.com [173.36.130.12]) by ietfa.amsl.com (Postfix) with ESMTP id 6462C21F8637 for ; Tue, 12 Jun 2012 02:19:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=keyupate@cisco.com; l=1136; q=dns/txt; s=iport; t=1339492750; x=1340702350; h=date:subject:from:to:cc:message-id:in-reply-to: mime-version:content-transfer-encoding; bh=WNjusvu/FsBX4D3B8lsi+CgBuQ+ebyo/JABLDzDMACI=; b=N20VE0l7YdbwP2zN7KRT4wsxZmWNN4K72wrGhzdMN5rVDaeWhuBr3S3H gEYvq845nGSDPJTzFaFGWHgPLRF7CsIT6ni21Le5tQHxHRDd3aG2I8X1B v8TqKT86LQSkXsT6IkJfMWg+a0bc1iOtoS2IOgL6NEWXdqRWp5Z2pk2Pv 4=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av8EAMsI10+rRDoH/2dsb2JhbABFtTuBB4IYAQEBAwEBAQEPAScCATELEgEIDgpPBjABAQQOBSKHWwMGBAELmQ2WDg2JTopCYYYRA4hAjF+BEolsgxeBZoMAgTgj X-IronPort-AV: E=Sophos;i="4.75,755,1330905600"; d="scan'208";a="45480666" Received: from mtv-core-2.cisco.com ([171.68.58.7]) by mtv-iport-1.cisco.com with ESMTP; 12 Jun 2012 09:19:10 +0000 Received: from xbh-sjc-211.amer.cisco.com (xbh-sjc-211.cisco.com [171.70.151.144]) by mtv-core-2.cisco.com (8.14.5/8.14.5) with ESMTP id q5C9JAoc003426; Tue, 12 Jun 2012 09:19:10 GMT Received: from xmb-sjc-239.amer.cisco.com ([128.107.191.105]) by xbh-sjc-211.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.4675); Tue, 12 Jun 2012 02:19:09 -0700 Received: from 10.21.66.179 ([10.21.66.179]) by xmb-sjc-239.amer.cisco.com ([128.107.191.105]) via Exchange Front-End Server email.cisco.com ([128.107.191.79]) with Microsoft Exchange Server HTTP-DAV ; Tue, 12 Jun 2012 09:19:08 +0000 User-Agent: Microsoft-Entourage/12.31.0.110725 Date: Tue, 12 Jun 2012 02:23:16 -0700 From: Keyur Patel To: Ed Kern , "Murphy, Sandra" Message-ID: Thread-Topic: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 Thread-Index: Ac1IfP9N4ikP6f9yiEyGi2aJfwkwpQ== In-Reply-To: <77B9F8E3-804D-4D1A-9C99-6EDCC8924398@gmail.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 12 Jun 2012 09:19:09.0966 (UTC) FILETIME=[6CA74AE0:01CD487C] Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 09:19:10 -0000 +1. Regards, Keyur On 6/11/12 2:05 PM, "Ed Kern" wrote: > > Have read numerous versions along the way....Am happy and support 06 for > advancement. > > Ed > > > On Jun 1, 2012, at 4:00 PM, Murphy, Sandra wrote: > >> The authors have stated that they believe that >> draft-ietf-sidr-pfx-validate-06 "BGP Prefix Origin Validation" is ready for a >> working group last call. >> >> The draft can be accessed at >> http://tools.ietf.org/html/draft-ietf-sidr-pfx-validate-06 and >> https://datatracker.ietf.org/doc/draft-ietf-sidr-pfx-validate/ >> >> This announces the beginning of the wglc. The last call will end on Friday, >> 15 Jun 2012. >> >> Please judge whether you believe that this work is ready for publication and >> send any comments to the list. >> >> --Sandy, speaking as wg co-chair >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From wesley.george@twcable.com Tue Jun 12 05:22:52 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54E1221F8555 for ; Tue, 12 Jun 2012 05:22:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.163 X-Spam-Level: X-Spam-Status: No, score=-0.163 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HXkUMUySQ3Wx for ; Tue, 12 Jun 2012 05:22:50 -0700 (PDT) Received: from cdpipgw02.twcable.com (cdpipgw02.twcable.com [165.237.59.23]) by ietfa.amsl.com (Postfix) with ESMTP id 4B65421F8547 for ; Tue, 12 Jun 2012 05:22:50 -0700 (PDT) X-SENDER-IP: 10.136.163.10 X-SENDER-REPUTATION: None X-IronPort-AV: E=Sophos;i="4.75,758,1330923600"; d="scan'208";a="377199284" Received: from unknown (HELO PRVPEXHUB01.corp.twcable.com) ([10.136.163.10]) by cdpipgw02.twcable.com with ESMTP/TLS/RC4-MD5; 12 Jun 2012 08:22:12 -0400 Received: from PRVPEXVS03.corp.twcable.com ([10.136.163.26]) by PRVPEXHUB01.corp.twcable.com ([10.136.163.10]) with mapi; Tue, 12 Jun 2012 08:22:49 -0400 From: "George, Wes" To: "Murphy, Sandra" , "sidr@ietf.org" Date: Tue, 12 Jun 2012 08:22:47 -0400 Thread-Topic: WGLC for draft-ietf-sidr-pfx-validate-06 Thread-Index: Ac1ASk1a5EstiVISTE2I8YfWJPfP6AIS0ySw Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 12:22:52 -0000 I have read this draft and previous versions and I support publishing it. One nit - we've had several conversations about whether to use AS_Path as s= ynonymous with AS4_Path since we require (with a MUST) support for 4-octet = ASNs. I don't remember which way we came down on the matter, whether to exp= licitly say AS4_PATH since that is what will really be used, or to leave th= at as an exercise for the implementer. Thanks, Wes George > -----Original Message----- > From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of > Murphy, Sandra > Sent: Friday, June 01, 2012 7:00 PM > To: sidr@ietf.org > Subject: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 > > The authors have stated that they believe that draft-ietf-sidr-pfx- > validate-06 "BGP Prefix Origin Validation" is ready for a working group > last call. > > The draft can be accessed at http://tools.ietf.org/html/draft-ietf-sidr- > pfx-validate-06 and https://datatracker.ietf.org/doc/draft-ietf-sidr- > pfx-validate/ > > This announces the beginning of the wglc. The last call will end on > Friday, 15 Jun 2012. > > Please judge whether you believe that this work is ready for publication > and send any comments to the list. > > --Sandy, speaking as wg co-chair > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout. From wesley.george@twcable.com Tue Jun 12 06:23:57 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B22B21F8557 for ; Tue, 12 Jun 2012 06:23:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.813 X-Spam-Level: X-Spam-Status: No, score=-0.813 tagged_above=-999 required=5 tests=[AWL=0.650, BAYES_00=-2.599, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nh7-sayMsQ5P for ; Tue, 12 Jun 2012 06:23:56 -0700 (PDT) Received: from cdpipgw01.twcable.com (cdpipgw01.twcable.com [165.237.59.22]) by ietfa.amsl.com (Postfix) with ESMTP id 5BF6B21F8516 for ; Tue, 12 Jun 2012 06:23:56 -0700 (PDT) X-SENDER-IP: 10.136.163.12 X-SENDER-REPUTATION: None X-IronPort-AV: E=Sophos;i="4.75,758,1330923600"; d="scan'208";a="394277440" Received: from unknown (HELO PRVPEXHUB03.corp.twcable.com) ([10.136.163.12]) by cdpipgw01.twcable.com with ESMTP/TLS/RC4-MD5; 12 Jun 2012 09:23:27 -0400 Received: from PRVPEXVS03.corp.twcable.com ([10.136.163.26]) by PRVPEXHUB03.corp.twcable.com ([10.136.163.12]) with mapi; Tue, 12 Jun 2012 09:23:55 -0400 From: "George, Wes" To: Randy Bush , sidr wg list Date: Tue, 12 Jun 2012 09:23:53 -0400 Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: Ac1D7L5Bw3TC05JiRRudUhZWRrVTlgEsIkKA Message-ID: References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 13:23:57 -0000 Randy - I'm thinking that there's a simpler use case for this - In the situation where A delegated space to C, who delegated it further to = G, and G would like help managing data, but C is not willing or able to do = so, and so G works with A to make this happen. The concept of changing prov= iders may not be necessary to illustrate the point. Regarding adoption, I'm not certain I understand from the current text why = this can't be incorporated into existing drafts as a brief note. If I'm int= erpreting this draft correctly, you're saying that there's nothing technica= lly hard about doing this, but that there are some business and contractual= issues to deal with, mainly on account of the potentially fractured busine= ss relationship between the parties involved, and proper validation of the = information you're certifying. But that's true of any relationship where on= e party certifies on anothers' behalf. What's different about this case tha= t requires it to be treated separately from other operational consideration= s? I love the "responsible grandparenting" title, but I'm just thinking it'= s easier for reader and implementer alike if this is consolidated. Thanks, Wes George > -----Original Message----- > From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of > Randy Bush > Sent: Wednesday, June 06, 2012 10:00 AM > To: sidr wg list > Subject: [sidr] draft-ymbk-rpki-grandparenting-00.txt > > this draft is relevant to the sidr wg work and i, as author, request it > be made a work item. > > randy > > > From: internet-drafts@ietf.org > To: randy@psg.com > Subject: New Version Notification for draft-ymbk-rpki-grandparenting- > 00.txt > Message-ID: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> > Date: Wed, 06 Jun 2012 06:59:03 -0700 > > A new version of I-D, draft-ymbk-rpki-grandparenting-00.txt has been > succes=3D sfully submitted by Randy Bush and posted to the IETF > repository. > > Filename: draft-ymbk-rpki-grandparenting > Revision: 00 > Title: Responsible Grandparenting in the RPKI > Creation date: 2012-06-06 > WG ID: Individual Submission > Number of pages: 5 > > Abstract: > There are circumstances in RPKI operations where a resource > holder's > parent may not be able to, or may not choose to, facilitate full and > proper registration of the holder's data. As in real life, the > holder may form a relationship to their grandparent who is willing to > aid the grandchild. This document describes simple procedures for > doing so. > > > The IETF Secretariat > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout. From hannes@juniper.net Tue Jun 12 06:52:07 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3614621F8587 for ; Tue, 12 Jun 2012 06:52:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.593 X-Spam-Level: X-Spam-Status: No, score=-5.593 tagged_above=-999 required=5 tests=[AWL=1.006, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BkA1guaXWxnl for ; Tue, 12 Jun 2012 06:52:06 -0700 (PDT) Received: from exprod7og116.obsmtp.com (exprod7og116.obsmtp.com [64.18.2.219]) by ietfa.amsl.com (Postfix) with ESMTP id 8787B21F856D for ; Tue, 12 Jun 2012 06:51:48 -0700 (PDT) Received: from P-EMHUB01-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob116.postini.com ([64.18.6.12]) with SMTP ID DSNKT9dJcxPVhInaxVxNZVAO91ZyUyiSqu7b@postini.com; Tue, 12 Jun 2012 06:52:05 PDT Received: from hannes-sslvpn-nc.jnpr.net (172.23.2.62) by P-EMHUB01-HQ.jnpr.net (172.24.192.33) with Microsoft SMTP Server id 8.3.213.0; Tue, 12 Jun 2012 06:50:50 -0700 MIME-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset="windows-1252" From: Hannes Gredler In-Reply-To: Date: Tue, 12 Jun 2012 15:50:45 +0200 Content-Transfer-Encoding: quoted-printable Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> To: "George, Wes" X-Mailer: Apple Mail (2.1278) Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 13:52:07 -0000 On Jun 12, 2012, at 2:22 PM, George, Wes wrote: > I have read this draft and previous versions and I support publishing = it. >=20 > One nit - we've had several conversations about whether to use AS_Path = as synonymous with AS4_Path since we require (with a MUST) support for = 4-octet ASNs. I don't remember which way we came down on the matter, = whether to explicitly say AS4_PATH since that is what will really be = used, or to leave that as an exercise for the implementer. >=20 =85 i'd leave it that excercise to the implementer. for internal APIs (ala "give me the rightmost AS") usually you operate = on a normalized representation of data and not the binary message stream.=20 >> -----Original Message----- >> From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf = Of >> Murphy, Sandra >> Sent: Friday, June 01, 2012 7:00 PM >> To: sidr@ietf.org >> Subject: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 >>=20 >> The authors have stated that they believe that draft-ietf-sidr-pfx- >> validate-06 "BGP Prefix Origin Validation" is ready for a working = group >> last call. >>=20 >> The draft can be accessed at = http://tools.ietf.org/html/draft-ietf-sidr- >> pfx-validate-06 and https://datatracker.ietf.org/doc/draft-ietf-sidr- >> pfx-validate/ >>=20 >> This announces the beginning of the wglc. The last call will end on >> Friday, 15 Jun 2012. >>=20 >> Please judge whether you believe that this work is ready for = publication >> and send any comments to the list. >>=20 >> --Sandy, speaking as wg co-chair >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >=20 > This E-mail and any of its attachments may contain Time Warner Cable = proprietary information, which is privileged, confidential, or subject = to copyright belonging to Time Warner Cable. This E-mail is intended = solely for the use of the individual or entity to which it is addressed. = If you are not the intended recipient of this E-mail, you are hereby = notified that any dissemination, distribution, copying, or action taken = in relation to the contents of and attachments to this E-mail is = strictly prohibited and may be unlawful. If you have received this = E-mail in error, please notify the sender immediately and permanently = delete the original and any copy of this E-mail and any printout. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From Sandra.Murphy@sparta.com Tue Jun 12 09:28:18 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 124AE21F8617 for ; Tue, 12 Jun 2012 09:28:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.227 X-Spam-Level: X-Spam-Status: No, score=-102.227 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C4DrSQA3iGge for ; Tue, 12 Jun 2012 09:28:17 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 245BE21F8613 for ; Tue, 12 Jun 2012 09:28:16 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5CGPMfp022645; Tue, 12 Jun 2012 11:25:22 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5CGPKFn014879; Tue, 12 Jun 2012 11:25:21 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Tue, 12 Jun 2012 12:25:09 -0400 From: "Murphy, Sandra" To: Terry Manderson , "Roque Gagliano (rogaglia)" Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: AQHNQ+zWiDAxYMZ0Bkmzxjjf+kJXoZbunymAgAAhOYCAARaigIAA1EwAgAV0bQCAAMR0YQ== Date: Tue, 12 Jun 2012 16:25:09 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A278@Hermes.columbia.ads.sparta.com> References: <2F3884FD-D52F-4C3C-8920-292DDFA11C65@cisco.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 16:28:18 -0000 Speaking as a regular ol' wg member:=0A= =0A= wrt:=0A= =0A= >So if both AS 'C' and AS 'G' originate the 10.42.2.0/23 route and=0A= >both ROAs may exist, then you have a MOAS event.=0A= =0A= The architecture specifically allows there to be multiple ROAs for a single= prefix. That was a deliberate choice from long, long ago.=0A= =0A= (For a look at the number of occurrences of multiple origins, you can look = at http://bgp.he.net/report/multi-origin-routes. (And thanks to HE for tha= t site, btw.) It gives a clue into some reasons why multiple origins might= occur.)=0A= =0A= --Sandy, speaking as regular ol' member=0A= =0A= ________________________________________=0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of Terry Mand= erson [terry.manderson@icann.org]=0A= Sent: Monday, June 11, 2012 8:28 PM=0A= To: Roque Gagliano (rogaglia)=0A= Cc: sidr wg list=0A= Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt=0A= =0A= Hi Roque,=0A= =0A= =0A= On 8/06/12 11:10 PM, "Roque Gagliano (rogaglia)" wrote= :=0A= =0A= >=0A= > This is more a question for Randy.=0A= >=0A= > IMHO, his text says both:=0A= > "A may certify G's resources, or issue one or more EE certificates and RO= As=0A= > for G's resources. Which is done is a local matter between A and G."=0A= =0A= Fair enough, although I'm not so sure that it makes sense to=0A= =0A= >=0A= >> BTW, My understanding of that paragraph was about situations where you h= ave=0A= >> trust anchors that overlap.=0A= >=0A= > Your english is definitely better than mine, but I do not find any refere= nce=0A= > to trust anchors. I think it applies generally to any registry database.= =0A= >=0A= =0A= My understanding comes from probably a bad memory of the early discussions= =0A= relating to such 'uniqness' issues.=0A= =0A= >>=0A= >>> My understanding of Randy's proposal is that both C and G will have for= a=0A= >>> period of time the "right of use" for the 10.42.2.0/23 address space.= =0A= >>=0A= >> The idealistic stance might be that the RPKI and associated drafts shoul= d=0A= >> not recommend a situation of ambiguity. Being able to have two different= =0A= >> ROAs (with different ASNs) for the same prefix issued by EE certs from= =0A= >> different res certs (thus different private keys) seems like it is makin= g=0A= >> life tough for the relying party.=0A= >=0A= > How would a RP check this? (think particularly on bottom-up fetch +=0A= > validation)=0A= =0A= As far as I can tell, without experimentation, is that any match would work= .=0A= =0A= So if both AS 'C' and AS 'G' originate the 10.42.2.0/23 route and both ROAs= =0A= may exist, then you have a MOAS event.=0A= =0A= =0A= > What the RFC 6487 security section is basically saying is that you should= be=0A= > at least as good as your registration back-end.=0A= >=0A= =0A= I think you are trying say "we know that G has the resource, but are going= =0A= to pretend they don't so we can cut a ROA for G, so that their routing work= s=0A= but we can be lazy on changing certs to C."=0A= =0A= That might not be a bad thing, if there was some way to inhibit C from=0A= creating a ROA, that might mess with G. The idea that securing routing is= =0A= based on 'a legitimate holder' [rfc6480] being able to authorize one or mor= e=0A= ASes of its choosing appears to be relaxed in this text. Is that a slippery= =0A= slope?=0A= =0A= =0A= >>=0A= >> Is it?=0A= >>=0A= >> So step wise since G is moving ISPs from C to A (and they originate the= =0A= >> route on G's behalf):=0A= >>=0A= >> 1) "C" has the 10.42.0.0/16, presumably ROA issued for 10.42.2.0/23, AS-= 'C'=0A= >> (10.42.2.0/23 AS-"C" route VALID)=0A= >> 1.5) Worst case of "A" is slow between revoking/reissuing C's cert (all= =0A= >> routes UNKNOWN, but still routable)=0A= >=0A= > Here you break. UNKNOWN/NOT FOUND may have a different policy (loc. pref.= =0A= > ,etc.).=0A= =0A= OK. lets just say "UNKNOWN". I feel more comfortable in knowing that a RP= =0A= can make decision based on unambiguous information. Be that implemented in= =0A= local policy application (local pref etc) or otherwise.=0A= =0A= =0A= >=0A= > I have not written RP software, but I believe it will be harmless as it w= ould=0A= > validate. I do not believe iit breaks the CP document as the only refere= nce=0A= > to "unique holder" that I found was in the abstract section.=0A= =0A= Indeed. I always considered the holder to be very singular in nature.=0A= =0A= >=0A= > All in all, I think it is good that Randy raised this issue. I wonder if = we=0A= > need another document or add it to the "Use Case" document as it has not = yet=0A= > been ship to the IESG.=0A= =0A= Good question.=0A= =0A= T.=0A= From Sandra.Murphy@sparta.com Tue Jun 12 09:48:25 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0CEE021F865C for ; Tue, 12 Jun 2012 09:48:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.351 X-Spam-Level: X-Spam-Status: No, score=-102.351 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I-ND5RqhUUlh for ; Tue, 12 Jun 2012 09:48:24 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 4319E21F865B for ; Tue, 12 Jun 2012 09:48:24 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5CGmNxu022916; Tue, 12 Jun 2012 11:48:23 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5CGmL6j015722; Tue, 12 Jun 2012 11:48:23 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Tue, 12 Jun 2012 12:48:09 -0400 From: "Murphy, Sandra" To: "George, Wes" , "sidr@ietf.org" Thread-Topic: WGLC for draft-ietf-sidr-pfx-validate-06 Thread-Index: Ac1ASk1a5EstiVISTE2I8YfWJPfP6AIS0ySwAAi+IM8= Date: Tue, 12 Jun 2012 16:48:09 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A29D@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 16:48:25 -0000 Speaking as regular ol' member:=0A= =0A= wrt:=0A= =0A= >One nit - we've had several conversations about whether to use =0A= >AS_Path as synonymous with AS4_Path since we require (with a =0A= >MUST) support for 4-octet ASNs. I don't remember which way =0A= >we came down on the matter, whether to explicitly say =0A= >AS4_PATH since that is what will really be used, or to leave =0A= >that as an exercise for the implementer.=0A= =0A= I do not believe that AS4_PATH would "really be used" by a bgpsec capable r= outer.=0A= =0A= The MUST support for 4 byte AS numbers means that the following text from R= FC4893 applies:=0A= =0A= The new attributes, AS4_PATH and AS4_AGGREGATOR SHOULD NOT be carried=0A= in the UPDATE messages between NEW BGP peers. A NEW BGP speaker that=0A= receives the AS4_PATH and AS4_AGGREGATOR path attributes in an UPDATE=0A= message from a NEW BGP speaker SHOULD discard these path attributes=0A= and continue processing the UPDATE message.=0A= =0A= Each neighbor that has negotiated the bgpsec capability is a "NEW BGP spea= ker" because it must support 4 byte ASNs. NEW BGP speakers use 4 byte ASNs= in the AS_PATH (not AS4_PATH).=0A= =0A= The RFC4893 text says SHOULD rather than MUST, so it is possible that a bgp= sec speaker might actually receive the AS4_PATH attribute, but dropping the= attribute is expected and just fine.=0A= =0A= --Sandy, speaking as regular ol' wg member=0A= =0A= ________________________________________=0A= From: George, Wes [wesley.george@twcable.com]=0A= Sent: Tuesday, June 12, 2012 8:22 AM=0A= To: Murphy, Sandra; sidr@ietf.org=0A= Subject: RE: WGLC for draft-ietf-sidr-pfx-validate-06=0A= =0A= I have read this draft and previous versions and I support publishing it.= =0A= =0A= One nit - we've had several conversations about whether to use AS_Path as s= ynonymous with AS4_Path since we require (with a MUST) support for 4-octet = ASNs. I don't remember which way we came down on the matter, whether to exp= licitly say AS4_PATH since that is what will really be used, or to leave th= at as an exercise for the implementer.=0A= =0A= Thanks,=0A= =0A= Wes George=0A= =0A= =0A= =0A= > -----Original Message-----=0A= > From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of= =0A= > Murphy, Sandra=0A= > Sent: Friday, June 01, 2012 7:00 PM=0A= > To: sidr@ietf.org=0A= > Subject: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06=0A= >=0A= > The authors have stated that they believe that draft-ietf-sidr-pfx-=0A= > validate-06 "BGP Prefix Origin Validation" is ready for a working group= =0A= > last call.=0A= >=0A= > The draft can be accessed at http://tools.ietf.org/html/draft-ietf-sidr-= =0A= > pfx-validate-06 and https://datatracker.ietf.org/doc/draft-ietf-sidr-=0A= > pfx-validate/=0A= >=0A= > This announces the beginning of the wglc. The last call will end on=0A= > Friday, 15 Jun 2012.=0A= >=0A= > Please judge whether you believe that this work is ready for publication= =0A= > and send any comments to the list.=0A= >=0A= > --Sandy, speaking as wg co-chair=0A= > _______________________________________________=0A= > sidr mailing list=0A= > sidr@ietf.org=0A= > https://www.ietf.org/mailman/listinfo/sidr=0A= =0A= This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout.=0A= From Sandra.Murphy@sparta.com Tue Jun 12 14:27:56 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84E7B21F85A1; Tue, 12 Jun 2012 14:27:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.45 X-Spam-Level: X-Spam-Status: No, score=-102.45 tagged_above=-999 required=5 tests=[AWL=0.149, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lP0BBm1sZuT6; Tue, 12 Jun 2012 14:27:55 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 7B73C21F8570; Tue, 12 Jun 2012 14:27:55 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5CLRq2C026590; Tue, 12 Jun 2012 16:27:53 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5CLRnTF026195; Tue, 12 Jun 2012 16:27:49 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([::1]) with mapi id 14.01.0355.002; Tue, 12 Jun 2012 17:27:38 -0400 From: "Murphy, Sandra" To: "Roque Gagliano (rogaglia)" , "sidr@ietf.org" Thread-Topic: WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover-01.txt Thread-Index: AQHNSOIwNrVBzjzRWEybbcwHJs86jA== Date: Tue, 12 Jun 2012 21:27:37 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr-chairs@ietf.org" Subject: [sidr] WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 21:27:56 -0000 The authors request below that the wg adopt this work as a work item.=0A= =0A= The draft is available at http://tools.ietf.org/html/draft-rogaglia-sidr-bg= psec-rollover.=0A= =0A= Please respond to the list to say whether you accept this draft as a workin= g group draft and are willing to work on it. Remember that you do not need= to accept all content in a draft to adopt, as draft editors are required t= o reflect the consensus of the working group. =0A= =0A= This call will end 26 Jun 2012.=0A= =0A= --Sandy, speaking as wg co-chair=0A= =0A= =0A= =0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of Roque Gagl= iano (rogaglia) [rogaglia@cisco.com]=0A= =0A= Sent: Tuesday, June 05, 2012 8:05 AM=0A= =0A= To: sidr@ietf.org=0A= =0A= Subject: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-bgpse= c-rollover-01.txt=0A= =0A= =0A= =0A= =0A= =0A= Dear WG,=0A= =0A= =0A= =0A= We submitted a new version of this draft based on the feedback from our las= t meeting in Paris.=0A= =0A= =0A= =0A= As mentioned during Brian's presentation we would like to ask for WG adopti= on.=0A= =0A= =0A= =0A= Regards,=0A= Roque=0A= =0A= =0A= =0A= =0A= Begin forwarded message:=0A= =0A= =0A= =0A= From: =0A= =0A= =0A= =0A= Date: June 5, 2012 1:58:52 PM GMT+02:00=0A= =0A= =0A= =0A= To: =0A= =0A= =0A= =0A= Cc: ,=0A= =0A= =0A= =0A= =0A= Subject: New Version Notification for draft-rogaglia-sidr-bgpsec-rollover-0= 1.txt=0A= =0A= =0A= =0A= =0A= A new version of I-D, draft-rogaglia-sidr-bgpsec-rollover-01.txt has been s= uccessfully submitted by Roque Gagliano and posted to the IETF repository.= =0A= =0A= =0A= =0A= Filename: draft-rogaglia-sidr-bgpsec-rollover=0A= =0A= Revision: 01=0A= =0A= Title: BGPSEC router key rollover as an alternative to beaconing=0A= =0A= Creation date: 2012-06-05=0A= =0A= WG ID: Individual Submission=0A= =0A= Number of pages: 15=0A= =0A= =0A= =0A= Abstract:=0A= =0A= The current BGPSEC draft documents do not specifies a key rollover=0A= =0A= process for routers. This document describes a possible key rollover=0A= =0A= process and explores its impact to mitigate replay attacks and=0A= =0A= eliminate the need for beaconing in BGPSEC.=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= The IETF Secretariat=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= From randy@psg.com Tue Jun 12 15:17:48 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D990A21F86BA for ; Tue, 12 Jun 2012 15:17:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.358 X-Spam-Level: X-Spam-Status: No, score=-2.358 tagged_above=-999 required=5 tests=[AWL=0.241, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id orsoiKq6v0jK for ; Tue, 12 Jun 2012 15:17:48 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 932AB21F866E for ; Tue, 12 Jun 2012 15:17:48 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SeZPE-0007XH-OJ; Tue, 12 Jun 2012 22:17:45 +0000 Date: Wed, 13 Jun 2012 07:17:43 +0900 Message-ID: From: Randy Bush To: Sandy Murphy In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 22:17:49 -0000 > Please respond to the list to say whether you accept this draft as a > working group draft and are willing to work on it. yes, yes randy From terry.manderson@icann.org Tue Jun 12 16:29:35 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6AEB21F86E0 for ; Tue, 12 Jun 2012 16:29:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.534 X-Spam-Level: X-Spam-Status: No, score=-106.534 tagged_above=-999 required=5 tests=[AWL=-0.065, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SARE_RMML_Stock10=0.13, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5V6zhEZDhtiY for ; Tue, 12 Jun 2012 16:29:35 -0700 (PDT) Received: from EXPFE100-1.exc.icann.org (expfe100-1.exc.icann.org [64.78.22.236]) by ietfa.amsl.com (Postfix) with ESMTP id 65EE521F86C9 for ; Tue, 12 Jun 2012 16:29:35 -0700 (PDT) Received: from EXVPMBX100-1.exc.icann.org ([64.78.22.232]) by EXPFE100-1.exc.icann.org ([64.78.22.236]) with mapi; Tue, 12 Jun 2012 16:29:34 -0700 From: Terry Manderson To: "Murphy, Sandra" , "Roque Gagliano (rogaglia)" Date: Tue, 12 Jun 2012 16:29:33 -0700 Thread-Topic: [sidr] draft-ymbk-rpki-grandparenting-00.txt Thread-Index: AQHNQ+zWiDAxYMZ0Bkmzxjjf+kJXoZbunymAgAAhOYCAARaigIAA1EwAgAV0bQCAAMR0YYAAemas Message-ID: In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A278@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en X-MS-Has-Attach: yes X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha1; boundary="B_3422424573_37799957" MIME-Version: 1.0 Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jun 2012 23:29:35 -0000 --B_3422424573_37799957 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit Hi Sandy, On 13/06/12 2:25 AM, "Murphy, Sandra" wrote: > Speaking as a regular ol' wg member: > > wrt: > >> So if both AS 'C' and AS 'G' originate the 10.42.2.0/23 route and >> both ROAs may exist, then you have a MOAS event. > > The architecture specifically allows there to be multiple ROAs for a single > prefix. That was a deliberate choice from long, long ago. Yes, I understand that - my interpretation and underlying assumption is that MOAS still exist at the desire of a single resource holder. While doing what Randy has documented is certainly possible with the current architecture, I not sure if that in allowing parents and grandparents to be able to assert a security condition of a MOAS without the full buy-in of the resource holder is something that should be recommended. T. --B_3422424573_37799957 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" MIIQAQYJKoZIhvcNAQcCoIIP8jCCD+4CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC Dc0wggcDMIIF66ADAgECAhAPz2lJUZsAlD35l4oJxf0FMA0GCSqGSIb3DQEBBQUAMGIxCzAJ BgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2Vy dC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0IEFzc3VyZWQgSUQgQ0EtMTAeFw0xMjAzMjcwMDAw MDBaFw0xNTAzMjcxMjAwMDBaMIGsMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p YTEXMBUGA1UEBxMOTWFyaW5hIGRlbCBSZXkxPDA6BgNVBAoTM0ludGVybmV0IENvcnBvcmF0 aW9uIGZvciBBc3NpZ25lZCBOYW1lcyBhbmQgTnVtYmVyczEXMBUGA1UECxMORE5TIE9wZXJh dGlvbnMxGDAWBgNVBAMTD1RlcnJ5IE1hbmRlcnNvbjCCASIwDQYJKoZIhvcNAQEBBQADggEP ADCCAQoCggEBAKRhZ4W3U6MnfS2woYEFCIyN+g1MNILokbUKk+PTl5mmK3QtWQxTSOu2sdzN xHMy6p2RoT9BMGOamttFq2WswSru6/7JT1TflytGaPHfK5kMP/pI47hmcwUEm9Z169I5ar7z BTiEAQA06cGKtgJ8XiiLFUIHLVuRq3WGxjnFTHlAHXY6mdgDT/ntAnoEvvPVm4XqUnjJiZTS ojzyr1q2RqFvyXs2blOARumDqvLI33yLGcUuaEL+A+hgodzM/fL4kdoy964mXvmEerpm4d4f Y/JfbRUWxc0Eomu9nwGFNk6ijO41qk+OIboct2qeA+5PPclXJNNHYVfzT2dyWfGgxaMCAwEA AaOCA2gwggNkMB8GA1UdIwQYMBaAFBUAEisTmLKZB+0e36K+Vw0rZwLNMB0GA1UdDgQWBBSz wvR2YXpP9XjS9cknMX5g3LM2jTAkBgNVHREEHTAbgRl0ZXJyeS5tYW5kZXJzb25AaWNhbm4u b3JnMA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwfQYD VR0fBHYwdDA4oDagNIYyaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJl ZElEQ0EtMS5jcmwwOKA2oDSGMmh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEFz c3VyZWRJRENBLTEuY3JsMIIBxQYDVR0gBIIBvDCCAbgwggG0BgpghkgBhv1sBAECMIIBpDA6 BggrBgEFBQcCARYuaHR0cDovL3d3dy5kaWdpY2VydC5jb20vc3NsLWNwcy1yZXBvc2l0b3J5 Lmh0bTCCAWQGCCsGAQUFBwICMIIBVh6CAVIAQQBuAHkAIAB1AHMAZQAgAG8AZgAgAHQAaABp AHMAIABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIABjAG8AbgBzAHQAaQB0AHUAdABlAHMAIABh AGMAYwBlAHAAdABhAG4AYwBlACAAbwBmACAAdABoAGUAIABEAGkAZwBpAEMAZQByAHQAIABD AFAALwBDAFAAUwAgAGEAbgBkACAAdABoAGUAIABSAGUAbAB5AGkAbgBnACAAUABhAHIAdAB5 ACAAQQBnAHIAZQBlAG0AZQBuAHQAIAB3AGgAaQBjAGgAIABsAGkAbQBpAHQAIABsAGkAYQBi AGkAbABpAHQAeQAgAGEAbgBkACAAYQByAGUAIABpAG4AYwBvAHIAcABvAHIAYQB0AGUAZAAg AGgAZQByAGUAaQBuACAAYgB5ACAAcgBlAGYAZQByAGUAbgBjAGUALjB3BggrBgEFBQcBAQRr MGkwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBBBggrBgEFBQcwAoY1 aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEQ0EtMS5jcnQw DAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOCAQEAYpwxK/KvdhbyQqrKp2ylMQpNzqVH ofo4hPILTnp/o+UyYVn6daWSilaV+XNBzE5Rm/f7ms2iA1zBzOvGv55pLH0n6lgIRTeuAGzf KIsPCwPvYQkkMAPXHzh9A44m19hvigTgOPNyjzcOTiHqwwCJSDTEZx17CEkrzQPq1vfG1Lvk +AWjEtxCsGmsuCHHaZjwQ8SsGI7W5cA1Y4RTcQf6S9eIpSsOwXIYdDgWq9Uhi/amW7ryW06Y GH7BHaitqgmm32MZuid3UzJUU6+Ljx7uGA9Fe6k1uPEHhaXTAoobPSpPdOgGmnxUCRQu2OI7 +I8vHiSe7DC/LmxEDC5kB+lUTjCCBsIwggWqoAMCAQICEAoE3yF0XU0rjOozcgUAUOkwDQYJ KoZIhvcNAQEFBQAwZTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcG A1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEkMCIGA1UEAxMbRGlnaUNlcnQgQXNzdXJlZCBJRCBS b290IENBMB4XDTA2MTExMDAwMDAwMFoXDTIxMTExMDAwMDAwMFowYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A MIIBCgKCAQEA6IItmfnKwkKVpYBzQHDSnlZUXKnE0kEGj8kz/E1FkVyBn+0snPgWWd+etSQV wpi5tHdJ3InECtqvy15r7a2wcTHrzzpADEZNk+yLejYIA6sMNP4YSYL+x8cxSIB8HqIPkg5Q ycaH6zY/2DDD/6b3+6LNb3Mj/qxWBZDwMiEWicZwiPkFl32jx0PdAug7Pe2xQaPtP77blUjE 7h6z8rwMK5nQxl0SQoHhg26Ccz8mSxSQrllmCsSNvtLOBq6thG9IhJtPQLnxTPKvmPv2zkBd XPao8S+v7Iki8msYZbHBc63X8djPHgp0XEK4aH631XcKJ1Z8D2KkPzIUYJX9BwSiCQIDAQAB o4IDbzCCA2swDgYDVR0PAQH/BAQDAgGGMDsGA1UdJQQ0MDIGCCsGAQUFBwMBBggrBgEFBQcD AgYIKwYBBQUHAwMGCCsGAQUFBwMEBggrBgEFBQcDCDCCAcYGA1UdIASCAb0wggG5MIIBtQYL YIZIAYb9bAEDAAQwggGkMDoGCCsGAQUFBwIBFi5odHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9z c2wtY3BzLXJlcG9zaXRvcnkuaHRtMIIBZAYIKwYBBQUHAgIwggFWHoIBUgBBAG4AeQAgAHUA cwBlACAAbwBmACAAdABoAGkAcwAgAEMAZQByAHQAaQBmAGkAYwBhAHQAZQAgAGMAbwBuAHMA dABpAHQAdQB0AGUAcwAgAGEAYwBjAGUAcAB0AGEAbgBjAGUAIABvAGYAIAB0AGgAZQAgAEQA aQBnAGkAQwBlAHIAdAAgAEMAUAAvAEMAUABTACAAYQBuAGQAIAB0AGgAZQAgAFIAZQBsAHkA aQBuAGcAIABQAGEAcgB0AHkAIABBAGcAcgBlAGUAbQBlAG4AdAAgAHcAaABpAGMAaAAgAGwA aQBtAGkAdAAgAGwAaQBhAGIAaQBsAGkAdAB5ACAAYQBuAGQAIABhAHIAZQAgAGkAbgBjAG8A cgBwAG8AcgBhAHQAZQBkACAAaABlAHIAZQBpAG4AIABiAHkAIAByAGUAZgBlAHIAZQBuAGMA ZQAuMA8GA1UdEwEB/wQFMAMBAf8wfQYIKwYBBQUHAQEEcTBvMCQGCCsGAQUFBzABhhhodHRw Oi8vb2NzcC5kaWdpY2VydC5jb20wRwYIKwYBBQUHMAKGO2h0dHA6Ly93d3cuZGlnaWNlcnQu Y29tL0NBQ2VydHMvRGlnaUNlcnRBc3N1cmVkSURSb290Q0EuY3J0MIGBBgNVHR8EejB4MDqg OKA2hjRodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURSb290Q0Eu Y3JsMDqgOKA2hjRodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVkSURS b290Q0EuY3JsMB0GA1UdDgQWBBQVABIrE5iymQftHt+ivlcNK2cCzTAfBgNVHSMEGDAWgBRF 66Kv9JLLgjEtUYunpyGd823IDzANBgkqhkiG9w0BAQUFAAOCAQEAhGFOQR64dgQqtbbvj/JV hbldVv4KmObkvWWKfUAp0/yxXUX9OrgqWzNLJFzNubTkc61hXXatdDOKZtUjr0wfcm5F2XVA u6I7z41JL8BBsOIpo1E4Q1CZFKwzBjViiX13qVIH5WwgV7aBum+8s8KU7XYCgNl8zoWoHOzH Q0pLsVfPcs7f9SU8yyJP/Z9S0TfLCLs4PuDVPm95Ca1bfDGzdzXD5GP5aAqYB+dGOHeE0j6X vAqgqKwlT0RukeHSWq9r7zAcjaNEQrMQiyP61+Y1dDesz+urWB/JiCP/NtQH6jRqR+qdlWye KU9T7eMrlSBOKs+WYHr4LIDwlVLOKZaBYjGCAfwwggH4AgEBMHYwYjELMAkGA1UEBhMCVVMx FTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3LmRpZ2ljZXJ0LmNvbTEhMB8G A1UEAxMYRGlnaUNlcnQgQXNzdXJlZCBJRCBDQS0xAhAPz2lJUZsAlD35l4oJxf0FMAkGBSsO AwIaBQCgXTAjBgkqhkiG9w0BCQQxFgQU1B2xdH1hKgTJl46S0LuoqZf0+G0wGAYJKoZIhvcN AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTIwNjEyMjMyOTMzWjANBgkqhkiG 9w0BAQEFAASCAQBlW/jbC96pggwBvYLHEeCamlMz9Vz1mIf+tbAl3ppO6DLEnRfzf5Ew6gdg +WvSPv5ldWAYnezjV+KIKi0D5ZWb8i0DVzNyxNp9a+/Of5xno99jjqKPzutbLeHCazECU9Hj 0iPwObbGOZktSsAS0PmptDQHrbS1312jj7LFSGRkzelas95CMfDpbIRMpCkdQ1k+N4U9adRB PJVW22K9dTZiXev/ZR/UoT4BsC00m2XfGW2DDhc+VpdTbxkQxyJUIOdv1MBYgoPXvNJn1zk5 TCNlu/u/arMaPTPKTAf2UfLGI9h3xbAA4yK4MRfDeC7Xe9e0xkOYbax1BpudlRac9LU8 --B_3422424573_37799957-- From kent@bbn.com Wed Jun 13 10:13:42 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE69121F859A; Wed, 13 Jun 2012 10:13:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s6LYM329+b-e; Wed, 13 Jun 2012 10:13:40 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 3406721F8596; Wed, 13 Jun 2012 10:13:40 -0700 (PDT) Received: from dhcp89-089-114.bbn.com ([128.89.89.114]:49337) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Ser7r-0002UE-C9; Wed, 13 Jun 2012 13:12:59 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> Date: Wed, 13 Jun 2012 13:13:32 -0400 To: "Murphy, Sandra" From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: "sidr-chairs@ietf.org" , "sidr@ietf.org" Subject: Re: [sidr] WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jun 2012 17:13:42 -0000 I am i favor of beginning work on this topic, using this document as a starting point. I am alreday generating comments on the I-D for the authors. Steve From alexey.melnikov@isode.com Wed Jun 13 10:18:43 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2093221F864B for ; Wed, 13 Jun 2012 10:18:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.266 X-Spam-Level: X-Spam-Status: No, score=-103.266 tagged_above=-999 required=5 tests=[AWL=-0.667, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RRaIZi79ZJOJ for ; Wed, 13 Jun 2012 10:18:42 -0700 (PDT) Received: from statler.isode.com (statler.isode.com [62.3.217.254]) by ietfa.amsl.com (Postfix) with ESMTP id 7C91621F853C for ; Wed, 13 Jun 2012 10:18:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1339607920; d=isode.com; s=selector; i=@isode.com; bh=m82dRnaMKpqtIVNPq1Hw3lzIBrkZIpDDFcxhKMNu4Do=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=IwgxeTswjfCrIDc1vm+9FpaQU95Lg95VgfeIa9Y3fZmF36voGYifvB27LJnPhrfG8OmSdM 59tuVx3QesedLq1snwaT+knXnFgvxYz+TSTs58600B6JjayYoKxb7oyr1q486ZsS3prmT9 WrVDH5CVy4VoEFY0uB2vwNm6rHoHfLg=; Received: from [172.16.1.29] (shiny.isode.com [62.3.217.250]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Wed, 13 Jun 2012 18:18:39 +0100 X-SMTP-Protocol-Errors: PIPELINING Message-ID: <4FD8CB92.9030205@isode.com> Date: Wed, 13 Jun 2012 18:19:14 +0100 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:10.0.2) Gecko/20120216 Thunderbird/10.0.2 To: sidr wg MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [sidr] Discussion topics for the virtual interim on June 29th X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jun 2012 17:18:43 -0000 Hi, Please send your discussion topics by the end of Friday. If there are no topics/not enough topics, chairs might cancel the virtual interim. (The face-to-face one on July 27th will happen as planned.) Thank you, Alexey, as a SIDR co-chair From kent@bbn.com Wed Jun 13 11:25:32 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A4A8921F852D for ; Wed, 13 Jun 2012 11:25:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.449 X-Spam-Level: X-Spam-Status: No, score=-105.449 tagged_above=-999 required=5 tests=[AWL=-1.150, BAYES_00=-2.599, MANGLED_LOAN=2.3, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pKdSGooVtWh1 for ; Wed, 13 Jun 2012 11:25:30 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 3EDC221F8525 for ; Wed, 13 Jun 2012 11:25:30 -0700 (PDT) Received: from dhcp89-089-114.bbn.com ([128.89.89.114]:49353) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SesFR-00055X-5B for sidr@ietf.org; Wed, 13 Jun 2012 14:24:53 -0400 Mime-Version: 1.0 Message-Id: Date: Wed, 13 Jun 2012 14:25:25 -0400 To: sidr@ietf.org From: Stephen Kent Content-Type: multipart/mixed; boundary="============_-872510567==_============" Subject: [sidr] comments on draft-rogaglia-sidr-bgpsec-rollover-01 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jun 2012 18:25:32 -0000 --============_-872510567==_============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" I have attached Word, PDF and txt files with suggested edits and comments. Steve --============_-872510567==_============ Content-Id: Content-Type: application/octet-stream; name="draft-rogaglia-sidr-bgpsec-rollover-01.docx" ; x-mac-type="5758424E" ; x-mac-creator="4D535744" Content-Disposition: attachment; filename="draft-rogaglia-sidr-bgpsec-rollover-01.docx" Content-Transfer-Encoding: base64 UEsDBBQABgAIAAAAIQCLQKs2mQEAAEUGAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCi BAIooAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAC0lU1PwkAQhu8m/odmr6Zd8GCMoXBQPCqJGM/rdgqr3Y/sLAr/3tkCjRKg KHJpQod532dmd6a9wVxXyQd4VNbkrJt1WAJG2kKZSc6ex/fpNUswCFOIyhrI2QKQDfrn Z73xwgEmlG0wZ9MQ3A3nKKegBWbWgaFIab0WgX76CXdCvosJ8MtO54pLawKYkIaowfq9 OyjFrArJcE6vlySUzpLb5f+iVc6Ec5WSIhAoj1G+Nc9DhXsSP0yxQZeuyDLKrMVxqhxe 7HZ4czDZcFA6llYHiOqR2ulVAclI+PAgNLHzT+sLXlg501R3tr+4LYy2LJWEJj+qOW8l INI56SprIloos2bfyYFhUQH+P8VS90D7FxWmw7IESRekvR8a01h0trT4ltvuBiFQkw4x +Xlt07am40q5FeETXp9ORvFNvBVEWh3v3wl6sVZuRShppMfitYIDDv2X59FIt0IEWlPA 62f3aI5aZp8lDefIW4e09vwfyl7vp5id0tQ78EFBs6G2TXnjSDvz6PogLuUCii3evP4I 9L8AAAD//wMAUEsDBBQABgAIAAAAIQDHwie8DAEAAN8CAAALAAgCX3JlbHMvLnJlbHMg ogQCKKAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAArJLBTsMwDIbvSLxD5PuabiCE0NJdENJuCJUHMInXBtokSjzY3p6ww0ql UU1ix8TOn+/37+Vq13fik2Ky3imYFyUIctob6xoFr/XT7B5EYnQGO+9IwZ4SrKrrq+UL dcj5UWptSCKruKSgZQ4PUibdUo+p8IFcrmx87JHzMTYyoP7AhuSiLO9k/K0B1UhTrI2C uDY3IOp9yD//R1v2xGiQUWofaRZiJotssxdRY2yIFRivn/N1OnQUmRrkaaDb84H8ZmM1 PXq97cnxCc+SdkzOkJlGwhCmiOaXJBozD/P58tHIPKSDlSmaxfk0fy/DEBi32/7Noe0G lGNUx1rxHqj5CUyO1rL6BgAA//8DAFBLAwQUAAYACAAAACEA2O2+/i4BAAA8BAAAHAAI AXdvcmQvX3JlbHMvZG9jdW1lbnQueG1sLnJlbHMgogQBKKAAAQAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACsk81OwzAQhO9IvEPk O3FSoEWoTi+A1CsEcXaddWIR25G9/OTtcVOFJmoJl1ws7Vqe+WzvrDffuo4+wXllDSNp nJAIjLCFMiUjr/nT1R2JPHJT8NoaYKQFTzbZ5cX6GWqO4ZCvVOOjoGI8IxVic0+pFxVo 7mPbgAk70jrNMZSupA0X77wEukiSJXVDDZKNNKNtwYjbFtckytsmOP+vbaVUAh6s+NBg 8IwF9YAYbuaDJnclICN9Jw6chJ5HuJkT4Qt2LycUg+YUyO2cIMLq/TMN3qLvTCEs50SQ 1mDOdzUc/+O3NQWxmhMCw6wOALqSdms6xZDOyeCxrUOwjlPZ1VP2iz/stRLOeisxDr9J D4nYJ2E1Dhs9OL4prB6lBDEcg5OtnoOOMp/9AAAA//8DAFBLAwQUAAYACAAAACEAjArW /hlhAACynwMAEQAAAHdvcmQvZG9jdW1lbnQueG1s3H1bc+NGlub7Rux/QOil7QirjPtF McUJXLtr7La1pfJ6ZzrmASIhCV0kwQXBkrW/fr+TAEgkmKAASt0NsHrGkigKzDx58tzP d/7t3/9YLaVvSb5Ns/XHK+WDfCUl63m2SNePH69++xJd21fStojXi3iZrZOPVy/J9urf Z//zf/zb880im+9WybqQ8Ij19uZ5M/949VQUm5sff9zOn5JVvP2wSud5ts0eig/zbPVj 9vCQzpMfn7N88aMqKzL7bpNn82S7xef58fpbvL2qHrfK+j1tFc/rB6uybP+4itP1/hnH K8o2yRrrfcjyVVxsP2T5I/4i/7rbXGOFm7hI79NlWrxgfbK5f8y3j1e7fH1T7ep6vyv6 mxss4Obbalm/Gcvufm9JgZvyS/0X+dFGBYss/ySoSM6W92OeLLHgbL19SjcHup37NNDj qV7SyQ03Nvu8UfSjz9uTp8+hB3n8jLOvP/h5c/Q4ATEW5R+tliUdiKEObNR+oiL3OBF6 xH4NfZbAf2a9kibzPZ9HmgMnPW9wBd9yof6cZ7vNfleb9G1P+7T+un8WSYIBK5NNdtWb W9sOesCRrLh7ijfJlbSa33x6XGd5fL/EikBxiTjyagbpdJ8tXujrRsLLN5s4jz8tPl5p oeqaXqhdsVeL5I+CXrWqf3j1BpJw8fnjFURJpPp6sH/pFtf06MUgeYh3y+L4N7f0UuBb mqyy1Wxuc7aYu+JlmeBTvsXLj1e3S8iqL1jD1Y+zf/sRS6U30dfjdVu+5biRZk1t3aam a75mqFNbt+a4jqwEI143OLXmVo41iXeK2S9JAQn1Vfod/4F4lZgokHr++/xB+nP8uEzj dUbsWDCm7GRNVfMs/C8a7xGfJtWndZHk66S4huJ4KHqSqPG2nz5It3GRLHuQynAVObR8 Z8qkWi+SBVmExW57I90xyzBfbKUveTz/2qCK+Fvvg/R7km77kMpw7MjXYIOR+B6joD7N VeEfmzRPQKIgmSer+ySXrB8kGL2qmDDNV/10O8+ku5dtkaz6kMp0FNkyHVjukyQV2fs3 2008hwbfgGRJ/i25mjUJMvT7/9itE8koyd2D1TTLVfRImZxNoKumZsq+P95z77BlHNvQ dc0d77pPXu2T/Or9+fYu9CUY3lAq0tfkBd8ulxkcbCneSvFaipekbeC2fUukIpPuk3ie raGhe/CpbDuWaetTFYkn6Xa44vDtHorrPHtkFsg1rPH8+v5xs03meLEk5bWs9CCXptlW 5MnKeNlMfD1k1TNU15jqMc/c+20BY6DocUSWpxqBFU3Oq7GMwFMCf6omb+dN/PKUSPNd nlNQr5Jk7DpKdahvi++kdVZI200yTx/SBDKNk3J9Dl1VNFuxR6xuzxP/VQRKQmixkv/b D5L05SklolWR0kWynefpPSPbJkPUE3GLwfRTDN8MTMRlL8vcq+mHWLOU/LFZZrAFpbTA /yMuOy9IW67SIn2EryXlyWYZv0hxUcDrIL266MF48OdDVbEvzk5OlukqhUkBgwL3d53A PyMe3JsWUrqubvOHHlTSFc8KVWfE11OsNnXT8kJbn6xvDVcaLrWUPeAUITL+mqz6BF8U 1/ZUNZycD2CaPmzZy1MCTNy3Iko4ze3uHrKrwM3EXXzYLZcSrH6Wg1rPEQ5Oiye6uz1u pwyDVvejEd/Os5Xnt5RykOwGeP6tZNkk1iX2rdNLcHmR4umaMV69KBZciup4mm+M+Aqf d6T8LYCSzsHpVTi6NogqeZdI9ZulcP2YQoXl/Vxi0zYtCP7LM8Tj7VcpynIIh+8+hV+i 72FJ/pIxDR8XUgZZkUuPlN3bSiuyg5bbTFqk8LvSewQeesgRI5BtyzAovTXF8GqnB3PM YAi71MxVRvhLqzyRlqAXqdva4dm/qwf5VNv2DDeaqo/eSb6Agi+wuHFbC6lK8C5iWCYU 3U/yD2lSPLCaCeYWbn+saPdjH/ksG2pgKM6I5ZxYPmumK1uye3Hhyj2/V4dO8pkd695d 3UpIU6elNxFD0PyRrnYrujLb9A9pla2Lpz7pCV2Xw8gPw0sTNWSdkPC9T6TdBpckWfxQ +qVz+g4OWHa/zZYJGX33L5XMPug93K94/dJD1Mih7MqKr18a+Yp0lUCrfSpI2sB93cD/ 3+Qpc2Mzabc92ASV2KYAep48JIhOzfuoOE2OVFv3RixvzrOrUKcF8yheEoshJjJPS8cf F5OZBcUTZRm20hXL/8PdAF0fEUrZfrjqwW2mGqDMxB6xsBMLaVn3gjDwR2z8n3fYIn/y OYX/iAgZ8stStj5KMPfTxYZlqpE3XqHSdcyWH+rWZMty/GzzkqePTwVZ86iF7XEjddPQ HcUfsaUuPirNMF3Ncy9Obx2O8Lv592VFB3loKIDZwZ8go4CisBtUVFMwI10gl0KJkgXJ 5H4xHt2ywsBWpsrknc5FbfxI8a54ynLyw1xIMnYfSLWzyo9FH/Fl2hqMSnly4kuTZc8J L6/ygU9ylfHOvydlzqYRy6OLcbgrf9pKPyePcZ+6Od32lci4PBfiNs/qqOdnVsuPSk2Y dIxGQZUz7ONiGbqs25o74jz6edbPd1UIoiDZmiSH8MMSunO9Ta5TBNG/p5h68vBA/AZz iJiMvDH4qX20q695ZmSNWLueR7nN7h40Yt0h+5RSLX8hd2+XSQwPK0++pckzkQw/1L/u w3BKBO/K8C6ObHMEQSg98/JDpa5fpDplL71kOyT2yXhjCWdSWIi3zlkDTpnCwSsoi+hT +KLphqw47sW5KxBeLHtZ8xJYzc8WCf6z2qB9bA3Sod2BqoMoSZ1nK/7t0gr3vMettaJI dzxrxKVd593adD1f7kCuO5Q8LEur0bsLpJ9LaSdRFTTxZc2SLJt4B45D3kzSP/QUeaYR +apjTDVR3mlekuAvjXBmVkgN5UpWOYU3EQr5Bot8wa4rSjSl5zjP43WBDEovqWf4nuIY F5dt4viJyCjmvz6Wueo5joyI+dQCC6qt6gH+b3LrtlzdkYMRS0JxdMCMDB21zFMtYpvV /VE/SAlE8hJ6rvxXtX0cBeXq39df/3YbPyaS8t89lJ2iawrqJUd8xKeU3X2OLrXiZUPN Hdhy1enY2Uymu7oSqsZEPZllvC0+J+iQypMFHbCXJ/FX9HZSDx2fbqv5oPq6bxuoegVa v8aPrKeF+od6cIzhO4aiWCMuEhILBSPwPT2wR5wp7Fi3Z3roxZlqYensC7VPk5voI6dL RnoPHkOOSA/16ZXuq3Yke6Y+4tDhKWnKsDaEzXIKVNDn5P/ukBQiTI4tVemX7r/0oef/ JK3PuRt2qFiX12yogn4Q0Xm22JX+VF+qHd4n6T3op1qqGyjOxfkQGuj3U7PdbV903pP7 8PdGD/ppsmfb8uWF0CVJ+0B32CUnFa0hcFLxDSHjsGL+ykDgGgoPnFd+149+iuKjEuvi 0nI6aCciEsIlKF1CtHMH/z9+BOAGsnRl+wgVubH+kR5sp7hRKNv6RO3SbrVBhubhpva+ qk3Wk+w+9AsdWXe0ln+tqq5sGCop43857sp5aldC3I2ubcV6HCWAkJUssbMUCDNkG96U ec+PV3dFsnlK1pCX64Jep3TFxysy7q9l81rRvijajWbfyPJ/XZHvQB4UQ6XhcD6qF4ME QDKyjKiL63vs7fhQwpSZfU6uqUmKllS/RN+XrhdeoUfjNuA5tEByL9+8wNZKaA31Epog IvjU7n0xb6kjyFfeV0Tv1ovsGbd4b+4IGLcXW6qyYRrumMuduo7/FJnoUusfyKI5IRHn qBNLtwjAZ6RoCkSRa/HIMbHY41G9wFdD++JKFIhy9K/VX9gUd69934vvNDtSZDe8OC/E AM99cn9xyZNE536Sl/h0kuB+dtFRkXvwn6JqvhMoF1fbaYJ+SOjsckAQnklDpRc2gmtq kXl5CTQL9HPnX9fZ8zJZPFaecBeniV/vFWFTrUhF6+XFmYM26Pe5rrHeDri1B1oqfaII chDJVhRMNfzfYZ6Q5rCZOfgLgxcljJfB1OxFPyM0DdW5vIIool8ZiWHNsQwlZyAFe9EP LT3oQHYujv/csrLyT5K7WFDNPxAUDjez33dKnygMEDzkyI1GXL8itlsNEy0hpj25dZsq 8gseIRI/j7RdU0xvM/JQ6gTHdGLr1j1gbQXqiO1LMb0txFhCy5sefztqIPtA7p0Yn8iy Zuh2OLl1IznsRP6Y0+xi/lZNRzWVMaOCitdt2K6tKtOT3yhTtfzIHHFmu4PelutZ7vSa pkzbUZFomFzlhumqlmNOj09kz5d9ecyVG2L+Boa0Axz7yel5NXACqJ7J6UvZB7oYJPjk 7BNVjmzbH7GfK+ZvVOlEij89eWIgroXy+sn5Dabj2LJvT85Pk8kcDINwavdSMS2a5jE9 egP41grHnDcQyxNDtkMLoKlT4xNZt4AzLE9OXyqRoupuFEyN3ooXwDqJJqcvlUg2ARk+ OXsQMHRI5CqT4xPL0C3dDSe3bt1TVBNV9uO9lyfrXd6p7Ubt1XYTyG7g++40STW07Ub3 dXRkjVh+nOaLf2ZzDUa6qcqYSSU2gRTMYdMid8RXX7xuXTdDTdZHbOKfZs3OxoweZU6G qkWhrYx47+Izs2zPdhX14pocvqA3mkrwAa23AMLeX3+7+3L1Q/lV+uVX9v3n8H/99ukz LAO8fvcX9+ef99+U7+hz6iFccW3MbXAnOb6zOAb0+PW3nyvK0HcHmvm//vWv4S9A8GPk dP8TX6hn/+rX2y+ffv3F/fmKitQJWaIH+VRFQWrLGbFtdh75akwNhmSAql3gjqY0unCT M4zRNi7E3z4D5kFRnP/u07ZvuKEf2mOu5xULGj1wgY46vXygCvBFVTEnp4wtR1V8z51c PlCV7cBD5mG8xryYvy3bdTxTGzFWi3jd4BLZQZH75OithY7tTG9csanopozQ7NTobVi2 o7hj7sYW87eu+EhRhZOjtykrlmWGI/bzxfS2Is1RFE2dGn/rnmEAqGxyel4FSKmrGpPT 84prKWirmhy9FRMoTpoxubyD7MLZCqdnxwJ+CvEJbXJ8YgbA+zKd6eUxzUj1XW/EwXSx 3sEoXiuCIJya3kGZrK6Y2uTqUFQMpQqjYMSxGzGfAAgp8tQxo7qI123JkW6azvT420Mx telPzj4xI131FWVydYRmCIXpRJOT36Zim1445nGZ4nspO4ZtmGPubxevW/FDH1OWJ8ff qgOQTTWanDyRA83VQndyfrGMrKYVTs8+UexAN71gcnyiIp+IAVn61OxYVQscx3ImJ0/M wLENOZrcumXLNJGXmpw9aGFqve9PryjHdCzbGjVyrFjP64HhoTxucvEqSEEPOH6Ti9sr rquY0ZiHqYn5RAt13fGDyekd09EVzRpzHfjJGpJ3qpPV+tTJykg8qkYw4tT6KVINrZNV LNk3xtyXdmqz/1QQeiU05MCcXuuhEuq+bU2vFMqyI3TWGhO9h8WsDcDdo9JPi4xIBZr7 1LwaLbJMN5iqyOwGE/60rgBHUb3J6mTzrJpn8R1mVefJNWpn0/UjBvaxUah7gGtMHiA0 0kf8rsep65jXh96yVk0U8JFs1bUpczBRKGFu603sYIruDIDmVW8MdRB2cOhbruM2sYPF Jbw0GYoW2QNNmKTQm5dMaMKNtRWzuEWivHnW1Tvrlzis5FNgudwzsbtzwYlzzBNLcgw1 pQLxTZzmP4DNtzvwNM1XZITbYyA3T5ds42Gk0oadrosCK+50Z/Msp1GFGQbVrHseKEUE 3rxKdqDlcrqPqbG6lK2uQTX+wA8bK2ZHgqM6RvAqPooArklLDNvBW2/RjI0y7Lwt+830 ZtU1ZnWG68V1iJHSBQP23tNG7H4ptqzLnjdVm0AshgCyOU9yGqqN+ab8BPXmvSIfv+d5 y/YXRb7R5EH3ylYM0zebUnPGuhPe8bypBYITT839Uezln7s/8XFghmz2tbdiIK395lWT HKnIj6cdQ+MzcT9jC2uRb3/nGo8o3922PRp+VOO93R8nJg5/fG/QLqRCsuURO8yzFU37 +QzjKbkr4hwTLUs0f5kGrTX2cCxjZt2XqPlUyJuuZxJd3BDxHZndgvwWowXwkXfFC6ZJ Pd98izGZAINf2QJrTOFqWREGTdHkgXg7T1N0Va0w/2CVrrP8Ly5ww4lHnuib499gV6Bi 9VH1OuuHcwult71GAqAds9Hl9aSV5xTz6NdJsuDYRixbzVBXnFGXSJ48/g5+lWgewFO8 2WA8RUyDUh53yzgvG41woHz/FTOWaqJTruM9b3Z5LX9on8S55hnmYeWrGJOdpcUuoU0u s3m8lDYZxmSngMnFZpN4/tT+uA0tY8NQKTdxHn8iQ0J3LHnUvTvnHfw6KdDX+LVPu5gi I7qD3hQc+aTgaC0LtTeK23IdreofMTBTJkzgo2CRjYMV6Jf6fUHyEO+WxfHbb+mlwLfQ Ks5E46YUjRtONN4uMYyIJrVUMzGrN+X1049FduedDTAwAH4Gx7zc5RzgQnYbQ2yfB6un mEEpcR950G8Hs1sZ4Ap2fzRHi4pAQTn5RmCHMT/xHe2wfRij0hMU3ijdPaYsEMzIpMdk TdMuEoqASL/dBu6XsE0boSwJIsuVR1xPcJ4sWQF7HPNPt9S2i17pJCcSbdPHNUQumTLk yZCfjFfRxrqjaWf4NqWxhUn6+HSf5ds+csj0DVt3xwyDeB757jIED9bFLiUA/OUL8dsD TTuCqcfH1WrD5Qndv9t0lZKuTh4eMMyH19RiEwYV8GYEJPfxivHzyAdiEJPdQ6FnaxKM NZnwtRytdw/Wwzuq8Uj38TaR6vZqus19bq6iApjBb6sSL5JV22Uyb5qqBCQqZ0HVxOFo 8XxT29xHHof+qschVl+Y6ZWn94idtdVX85MaXkj7c0grIacvA9SImfuj8ULYQnt4IR1k qUYVxm2yNFTrwKDcewyVQxC/nujWqWBhokNFs6FyA4Nu4hXSCTfm2xXw7Os1NONfZ3sG 5VQ5+IJ/yZ6TbwkCt5AN+ZFpI1DfhqdhWvmYYevPFKA0K1Na71b30NzIzmSbapIX1Pci KeJ0yWweqG4IWDbnCwo8fWAyNfljgxnEnNQQax+0X6GGSG5L0Mkb40W6SqSHNEG0hoGW 7NUMR5MTktR6VZLO9kLzxDMbMrP9RLpRfqhbwFsZl8xkCz1bZlJeEeOvs2/Joo/1aDiW 7wH2ZLzmT8fFAXpsGDrheNd9ntRhobjaDNvLmRgxmu02pQn15DG0fTG6Y5UZh3A5dx06 qOdh9IWiUqJ4pLGL86gHubvMkNZjQrgpsJP1tzTP1hSGlZ5JsXF03EKE7yCq7vuIbNMO MX3DbZVPKrrtKUAPBEUnGj9hDiibFF2Zv2mG8OfeAmups2YWRhmQhqHBvuqNbg1KM1kA ZgSeOInp2uC6Ji6vf6DvcxYUxytMmNenwMVM6DfFjMymcug1d1G4UBHp455x3O4NkYJp rLyYfT3yR48StCr5oW/+ZG7XFSmCMlLUWFBNPRbvrX8YQkqx0b7nmVIicUQWSyMjsH2U T0bjlUbidVuhGWEE4eQaBeC124CMn5zOl33VVUJvco1eAO+0NXfMHpKYv1Hja6P1aHL0 Vn07clxvcvJE8YHx6ow5MyPmE1mzTcdzJ0dvI0Tnvzy9Ri/ZVU0M3KO40kitdzGfWI6P 2YyeP7V1Y2aG7nljBlMV01v3rdDwpgckggGHVFwwYt9eTG8AQcE6md6ALMN0dcPQJye/ MW3PsaPpNaKbCjJkkd+KIIypAkPM35DfgSZPj956FCBoM+YUbwe94Vt6Zji5CiNdxXQs TFiZmp7XTFPHjMPJ+cUGEnA+YihTozeGBMoGoIantm4LbdE+wHKmtm4Z+D6KPL14FRrR DcXWphdnc73QRi3M1PhE8WxF9oPJ0VuXAyOyjMmt28Q4ScOb7nSfP8ePyzReo14vKaR4 iSKS8l/IqiC2UpDME1ZFYf0gqbKi1r+vv/7tFmWSkt4HaAEGP1D1oxGHPk4lLgcCLWhK oNvymO3WU5v9pwIt6LKBmX7Tw/bSDD105HByoQ5EOdwAE5rGq9pOs6YGIfVTs5JiX0HR I18JP9jWDW/Emxf7k5gdYLmGNWJ7++ShdaSbqX2NL+fYlzrvDxXdXKiqzwpUeKCn6zlB h9sieUjXqNh7SYo+dVJoY9H8yLs42jXKPVE4xnr/UNEYSysUEsVFlqONP8/m6GSoW8a2 GSr7UA6J8tA+V0XX9QB1MROVE50s90CgHs9UVj+PUTizvelBCxnDzoHjOLkwq6n6somB V5d2hlXF3Hb+lCx2S4iCuqzuRqqr6RrtwVvIkG+4GWuJFffGBcqj+hy6p1hRMOZhHOfJ 3NJ2h4hIpO9+yYr/HS/ThfsA8I/voVndZfGU7R6f0MxE5aj72sVmixiPYyJWWBpsOhdw nJfGeSXxqP+rwWAQvkS1Yg8DxIoYG0AqjJZ1B28P1tNUT3E9dcS25VtY7zHLFtBN8bxI 56yXOV5km4LRjPUzv5CS2m1JRKOKv2q1I0gaFMv2IJ5poHnVUEds472FeBwBuqvwkcp8 FUGBmkV4GBb+eYcK/KOnUYGkESlIFYyrAr9cKEQSakrPoXKtRyTQZt3LujS9KNTdMUMq igW0ggZ43WhDm2qaG6ghm7I90VroyjRoSmfWzIJCccJog70ndbekqcMbzfVB5dCNrpWq bFdsp7psjZ2VvYcWNZVSGT2rjqv+dMGKWw01FP95ILwJspSoRwotU+RwwSnjdX/jijUe UZUtf+ZqmVkFt3iz/HmAXc9thROcfUtcgqJYHfX2qQOAy7oJx22RL9c+PuoZY8Q/nYJZ Et9VXVUwtLYdtVAMQLj4LJAzybvafTTkc76ZpwcdTQdjVmHutHEbaNWd9zLvZv3Zd9vd /Emqervdu18ALMBMnrvd/d/R8P49/PYXhsdQogpw1BGzBQbUKo5seJdpY5fiegGfhIJE pfG8j2gQmgDaNMtuob3SLmMbBDTVg3pA3PR8Oby4sFDJs039R95J25ImbDbEgdBv+A1A QkzOD6KegcJKywkvlPc49uGN4iZMmWq+bmQ3DuLEUxumdvuZpFhDxYj0sotqNDBl5eYh mV4ztWe9grQqbGh/epOuTEv3EGC7uDhHZUoB2S4HNNC80bgq3VEYebtJ5ina6edpPt+t tkW8RqRZ2us43kwUqy9TCWRMCWsHOVxN9nXWcTNJq6YyGWA1rxB+X6WEDYRIUKneK7XF JG9LGjQs0+HQnwKT/oT5Y3uaFXDQn2LzZ69XaamdNk/DF6GQy5vtNpJ3jRVWcBkoQ4BD 3qLZ3txq/E23BSbe5BnOxwyaMq7izNyKxHyuWI437j79hhvHsc0pn23P5wcs2z5yXvdd F1ml9qUfEWqG+BANGa2AqjPiwsHzDvFTIW0RumYd9NJ8mQCAC1CSxROL/QPDC9/i5xYc fp1XTI+6ogUgMwiOUaDw4izFSpYvJERKKmFQ+yoARZS28OkoerJItnMAREE5PmXPFWGr tCwcvh7iQ1UiX9Uvz9JGrjpdbZZMrvcDPDEVFWNztRHjvYllB6Y9WGhkoIDTSJv+TsqO mfZBocwgOd8l/Fx9/w+cz2Fy9GBqwJ2FmHgxYqEgPkoL070t5fIQGynEUpn8QpSag47g DveEa+y87hpT+kkqgJdZoLIHCWaKR+DTuU8QH4Phy7ISyRQnnOKN6rBEJbph39It1Abl PlcJhcDS7YqiXFDCz7WaRhgeSChzvoiHP4pGPKF9EGQra4GqquVQjfHEE9hCcd6vxxMO dWNNgvXgGwyTUAPfb9XxqF7g+TqbTjhRl7PBKg2ZHAMriSrnUCe3hweFpj2R/2K6tacH V6LnGMag/JdhyY7MT3P5HWD7wK2n0+vhY2oDcNq7V0h3oLGUYsZhd7UZ6dx0FIL9292q fU0P/rKm9veXB+zlyCg/e/0kdtrEEFj4puUHrmvRyTSkMboIjQgw67THKWLJchtnvImN UOZQG55yHXZJbE/XgMxL3nd1I7oUBkspnbw5eU39vo49quTiXZFR7nfeoY/2tabdJBqQ XO3mbG7J1T6CEgurcXlrodHUivVrtECok1K0ED0bl29AkrF7iUeCJIFLk70cT+Co7mDj 8ylk3FPUVvlnARexwJemqlBpLFhzHGs/+/J/1zrdxtKHByj7LN3lPhBnVi0dh1nfvOEB RsEHn2Ar+0DKmoVYJLv+4YifBl+vfUVle7MCuWqgl8+17Za1okTAPNeYNzlJudpl5XIE 4W4qpWjf/6a832gWoFLCf4HzssnTb1RWSy7UEtD3WylbY2IL+DhdoNCx9LG4fYLLBQeP OEdkeph6xylUw1cMRZ0yODuSRvHXJOco0DxpfQCE4gCZ+H4njagonWK4ptQIQyQFWG8u 3SXzHWztL3m8xlhCTLFqy84mFnwzgaz3qNIM7760CNZ82sHRO3pWSzeMxtErF1pq5tOB p+9bGz+oIH2A6fwKpxyMrWLGf+BBBQ0W86ecLIY+8GZ5NkiLie1H5vQQiTvVW4PgAyy6 Vwh+0LHkd7U8jAZDNPi3Mv7+kRWFM4QSimyeMUe0icsvkM+Gi9oh1xkxClCDjByjnM7o sR4yDBlDoqIupcxIcWG0zXq+3OHbg2uwH4csUX5jQ+PwUGbEXVixctPCyFVV4+LqrjD/ L13tVkj4YOZNtmHaYZ5texWRoxJCd/RoxAwlPktDC9AYJ19cq8XvtUW3jVHr0jTrYAFs nxBYA+I4RvGlmFWUEzA5x/d8KJbT98brUfFyMhcfxOGf2ND57eeRzPQ03dJGViyms4WC iV4N7tKwqH04kyOrmAUtFQkZw/V5W3lMiGznyWII3UW6rWcLtb2L/aTPsliYy6QiVdeD bkBPtUzPvbiru+9Y3GbLHcvAU111rb+IjgWZ6SjMojxL1Q7dvOI9aGe4jhPBHbs0nmPO TEylC+TOUPZpnRAmzBdQ7fanT/9H+v3PrB0f5X55ARFI8zbh4sInIrGYrDGG7L5X+g5Q P4GqTzUhLramURDF+hgpdfe3T9fBhzQpHq43X9M/ruerORt6sDcreXnOaYh2+e+x+Tbb Jjm8TgQZqqGN4GOOafmnN7RF+9mkLRzMgwVODRmG4/EQ2UL7aIs+wEO6qciGfzTqbvQl Z5bvA6okGnG5y3ma7dMDYDxK2bFbs9maEC8sVbZh8rqsOGumIfb2wD5TuL9JYqNA0YG9 5EfBpQno5A+YBKTy96W5dR1qsx2dTKi9GoRbyzBA6jE5feAuFA3jMeTpTWtQAtd3PZbI byQip28LUvnVL+iD9w+1ttItHPDb3T3Gf7PunRumpB/SHPyxLZIN9WqSsVMzCqcgxJdG 1nXFQjtD69JoqqYGDEF9oukGqlQ+SBAK4Waw9zAIkqi3fWJkIpQB9vP8qAKJC1APyHxR 0lC7kQXjklhgyzZ93S6TdmJ7gkbo4iK3oSbaB1klyfLuENkM3PPpMMe4/QBRfCu0XcWT R1zsLOZgS9M8FZCMLQ4evabXIt3RbHt69EY1j6+MGZX2pIUyex/0S6OXEerrGnCHJ2rM DUS/BFCdjajMVP1joB8ADWmdFNdBHj8UdadL9bWKjNeKtfVb+vE/duuEoaX2ELVKYEWO J4/YFRaLWl0zXc9jCduRmlridUNihQbS6ONVESdFlthUqHgwnlPTYWXTwM55zOIlGwbN gyhR63ejK7ms5lonxzVLAstANjQVE15aNqLsIRpms1b6CduIMAvRk1LFVBDdIjpVNiJ+ 4u5ysxwQVlzv8pTKJrQH1czaB1OxStSKuQCBOFpkn2TugIqa7iW3zVhMdW4RaW+UNt7a baeKd8UTHvt73eAVP4i8odb6QCosh2o6jQGVJ92GPRerqzYalAWLfQ9xnuWAtdhkCIxU aaUe52mQpu1ZUdC9+sYhlbWE8QbBAyS/UNLUIty/6GBnnxGF5pYiFvLAf3NUX2k15eu6 7LumSeV0g6QUf4L1HwfJQ7xbFoxokerrFGtij72llwIfqLMqc+82tyzntbkrXjAD+vnm W7z8eHW7BKLSF/QJVvnA8j0NfhxQ31KdqMOECkDfQBMWySXalM/dHxfHoKdrAUin5AnC SClByXJEb3rExoBi6P6iRHyDKw+9RCvZZOhO5ZbVSzaQM/yFL1PgtkOG2LCbJBDmRzcp 2Y8DZyArx32zlVBrMMDA8mREGgQL4c674k+enYkJ8KnEirNyWfVPjI+atdPDuaiOPbJs 5bcY3V7cgXGEH1AOXfKRIh9r0TbhxXwEDCZuHQfGadB/eKTn7fQHQC3riWuOPI9PwYVx FHwXO6RNwRnUJn/7hdQablCU4oqlnSrG5Ku7XuNW8dECtpaOtoOH8RuBTauifwVz4VuQ BIriOHJQthsNaV8JOH1fb+20tmgYB2dpC4Y+OUxqHWkLpix8BpGIRZNNZA63Kg6H+vo+ 6DBIPZVfy0+uf6qkUr2Qc5Xhu3MXkxsdzNX0Ccx30YqDpHfHfSA1/mp73XDJvkg2Cdyj yuXYZ+Oa8sgcrkoP7LNf0ZE8eu4Q3YdSVTYVeNBt6KNKZrzRAK6tdHbjgwfrMLnHjsUH m0Aul/iBr9NjsCrrQw/xslCUsJWo73ST5NdlJRvhHJYlcz9I6JTYr3v/1oPHDXZKYoAk Hv6QpUDmcIVyYE09xPN0mRYvP7yuvs3hylBwFO9wAbFjUIN8z/1+lwS4V0UU+siSwbpV UY4to0FbmbH+hR5rs4a7zW8l8yxBmTFYH5xRGkslswzX+rKjI3fRCsibUagqCqDtasXN 5A/n3/UwU+o//sdqfdZwO0zOlYzR8BGPtb41WNk22O09tb41XIe+lbfEMo1UKP5BjEE+ xQidMmmU/j9c4bIS6/sTzHdGNLcl3pp2hTVYpzYOZ69Th8mClA2MkSj0IvkuDYV4QlU7 xUcJHCqRPt3dnti/2ORGPZbihT6xWiN7oPhhZGBeySQu32D/vDqJ05dvsAXRON93vXzD bYa3Kp3XLh/BkNEEF0rNwRjYoAT1Rfou/ZB8YKjJrKwD83wYTzJmRfRhD6YymENRBwOk HxbVa3Ao4nou5hi6Qzn08ztqgtpv4uTCYHOnwTfnyYWTxwXSs16q7087TOJPJq+tED+e UjJ0lA2HA1ZK5Say6Wjn6MP3dhMxnQxNVGWwq9OIOrgNbErkm9d97CiVtjZHroPXciCb PdjNfzPvzNKHExfyDJXJLv0hWk1Kitt3867YbzFwxBxb2XsBF/qpYhgUWe1g5uU2e+f7 Qa7FkiyV1u4bzDbYqlLUY2+izWziDdayuroK+0t74EIxOZkAmJVWBrcREn30yw0zG6AB 4k+IU1mhpzlBu+pLdhQjQDXYVW2M97TkXxHVgxI7tN63ZWCYfuNo0Ayx2IPNQVGSoH2Y s/frl+falJrK+frzPrWEWkxB4y23zeG2VgfPeqEVueGpqkvpb/O0SI4quqpYzyl+/cDc gCaTC3hV9zzTCsIAXNkwK8ZUoSy+Y5omO16otJp2dV9zNENhtuKQGPl47piKdCDabx67 r9hwi7yD90zTMJyK92ZoEuI+8iASG4p5uA0u+OgTzl5jRbWZwhL99Q+0wjJAj1e6jSQm rsUaQLpN8jRb3AA8FD1j/Ja5Gz7cfhVslQRZY09IaPah8vDwmuCj/7VURrAVVC4LuVDC dEAmBgA9M42KFG3MrJa8zXUCGaUgHWabSjReGXWOhVgGcZp1bzASD+VdCCdSMIM5jo/L 7B5mVMOe3K2LdElv6EE+0wZes6yR3BipiD+ffIyPysmgD0lB01epDZ4RbY7APQCPYoRj 4aQRLYmMcM5ZY0ryB6Y99iCe6pnwsI0R68fziVcDRJAkpCbRkpjlcOsKeR2UYyZTPScC 82pxtQlKIu6DSyKrmiVrbS2tRsB7deTBYbXxaGm6u6iKQ7nVVnogmUYcx3FTU5k4g5MS uKey/F/MLNxbeKRMGsZ+hw8nZTggVpDEAzYc9Pn+gZyKOKEzcWO6tzbcVz97a+xWN2Qg t6jD/g72ijPcsRYsjiMT71g3jqM2UQJaVf0Dfc/ZKwe3lw1uGBZjEaytzROzRQdRBh96 sk0fMSsgwywdXPaj6EVjI4NdvvOZu3SFeG48HPyJPc5oE4SuEEvAEkKybpmuoDVQ+6bq bYqJDBDNQgMaIEwuUINi1ka+xRVHE3TdQULIScsl1Z4vMjSOPJDwB/0QNaFwJ7VKxzSH I5Pib1l6xHEC+lm27YSaRV5zwwJRzdD2jBJ8bJrOGqkBMiw4FmqG9pzhgYJh+KDHEkjs 95CKL9fZRzYNdzEFqz6STZWZ0SLW/tY23l9HyDjRe0JD8QfQTyJULgrM7HmMJA1EAQZ/ tEaLtZba0CzDPWEBhbjtvaZZxOdaZpponZ3nuicw93GMmjM05q+5TeJBgvtr+AhTKarH 398xBYnON4LjBZnBwDWKUVYOXoCOWD7HKBraZ+uk4jnj+pMI0Z6VevQgne4grxxcHjIf s4CzHXKfpDsqxB12k/bgs7U6OZiklAahvq5kwbrA+pAvskxHb3fHAXHY12WNCdfpag5u +5zWGB58+sdIF+ZCM+HaKV0ahuDwuJVg1Q0tUIqoz8nyhZzTW6TX04R3ahq3vvF376U9 DuJekYd7cIK9cQL4PHlf1vccRzVOH9IJFSBWK+Vkl3iZJ/HiBQhb38oqBoJ+aHFtE/r3 jlC4sC+q1VbkHkjCVIF44nkHoKjjpzXOm/hkNEhR1UqhR+H4NfiTO/uSsz9wWxdrXkVT PF33yMtuWM5j0rwd67ZVM4raDW+arRuqr1Egd1DD23gCPxqFD+Ed0YwoJBGo4Aw6bYUB tOui7GxGNz7NoiVYcfwSNULcKTfFvIJ+PBACCLZPWf7x6g4gOYTy+RMeRa8vUJP78UqV FfVaNq+rFqNhLT2Ob7pqmeGpBLj4uiMRWnr4PcS8wlBY3rxqur+N5RXIrh8PSa+SnAcd ozBcgmEfLqjBpA+HWYFqWxZiK2a8FAJLCz55uCsnOKzGtus7cCwZxIfEM9JhjfnQBwk8 1iaFhzt/p/fJhJ14SzWOLXdF3rAz6BOeSs0orCIPd9rO3hm7+U/dfX0nDm12nyR9nDLV U1ASqJCtOFLVcFL9iTmC3Ar8I9chWVwz+E8Wi9oW2UbabVmWAgGXX38O2EwL8sQoUEmv U2wKIYa8aHOTyKE1Is0zgovM6hyo9Ev4O1EJKstFZVepnqpOFkbUus9F6uqrF+t2WXF0 zzIo7ntxjEfa+7fbwP0S3kl/3wG6Dle4ysQWLxtA26GYrU6wUMwoTxAd3T4R/8EZ5jFV xdTDJHknMEySRRdHvXuWaiUabjLgACYUV2YzHQ40I+zjA99Jj/AwCmm9W93DXMpYEeZr BUu27TuO22qTGZNFfL7YO3Af8AG3W4RsWWQeIak1qIb5PWsagyDd3YbuT+Hn8kLX1mgf qaeHoREFZHVeHOuVJrhE7EV5iz0O/j5WhwbAskkryxnEaxvNvA/9UCgXBjCoL5B+2xe0 0Kza1lO3d2+/PjdgmcV8cqgLBlrBvAZ0oTTuDfPuXTl0lDIHXtWscoglfrYir+tzwiYe zJPqEVFG6Uq4Vdt5mn55QlD/4xUivFn+FxdTr3B0N0/0zfFvuD6YeuP1w/FnZVSDrRSS /X28+1ALqpLgkV7IDh1myoFseRcng3XoK//zz9JtE8bWRSqA4loMKOWAX0v5AcIxJmxj dKH91f1PQKrMMVathyBBPRvGjV+mBcU8H+TWmYVZlbOxJClClynMp72uZy+SIQ+Vdhf6 PcimKnroaqy6d6TXpSHCerv1pcfTrANEnUIKGQZOBD9+KphSi6k3A5qNnHeWZmF0pp/A fETrHvTDrdVMw6ZARoN+Jv5Fpj/xaixmrC8xV5pIwtGCjwEMTlKoguJaUk+Wb8gY8nIi uoGAFr8SCNMqrpR3x2xmDU5o7aORkFAGJyRE++B4tFpSUPYMNbZ3MnSIMhBaZWfg8MRO OyIAKDFMcxQHw52nWeG7DQVC2YVokaPW0fH6MeFSD8B55c0Jbp9l8B2X68TjGpmHo4e1 Dn88mYdype9lm6h26MLNGnGIpMM28VTd9c2WkW6qkeZ4Pu1mopkHA7qAKiCvP7Osu3Rb NSlJvwN+YpHHz/HyRgpLKIrFDooiE4nCpggZnH1QBRWI3NXiRYijmr5TIsrX4oFNParG HJ0UG42AtDK4QVC0ThZ4PyyomOXJN4I9KUcucaKgFtNi/jLsyPI9hrHaUKKyDbbzGH7A RPmLzBDSnWSRNVQQr8G49JVCEcBBuRjRwQxiILHK4C3Lk3x1Qh3NEEsmAjD9UzMGvcIx B2dNKINzQiIKtFlTvEmpKz8mZlPNwMgU1Ww1fahhiEGX0YQTsMSmDfb801FlclPCDU5l qcOqNgQSDmCqKQyWagJWLfeIhRAxwH/xChkgTfk2OC0lWmWbiWZsIcCm4rgXC3jdAhXz 3wkQGIUloYZJgrcSWrzI2vjvpPup+3/oGqpgdI7LbNrEFKSWNIC5u5rRSsuZihmoTonC N92KNebTUwEfWRdkfu/WNO2HGRscaXg9Mdzn+sdwBznV1R1k8LL0fdetZDhcb2bpo1sJ Bk3b4+b3PNl4d22mctrxhK/Jq+le13z2+ctnFhSnEfJIwtDdgfLnzhEPErC4YkW65o55 OPC7xGGgW1j8ik1gYqWrcEeXGbzNXGLSVfouL3B4e/u7B+nkyDZDOWqp5cvIXlUpq+/L oBWV+oJedQcRZMYLojPPxGlMjCCWFSPPTxXEfzoqvxEwna5bchSGLb8OnSWeYQRMhU5X riIJOi8nDaKnRqJ7eWCqOhPIMRdnQKiDe/C6DAg3kjFDpYxpvSPoxv2uQPwGmJvZDiGx evJta0MNu00d7pmax/2SnOjkPdPGPmtLobLz6x9pcQ3VIJaDWhDJvhW0CyFsxfdki9me U2bJVQYhR1kPSj5//uRJSLYBML2M76/ny92Cuqur6D2w9+rJ0CfOdbgn/+ZzpeqgcpBM x9HyV2m4SytYIenxBot1dOoCWD19SCEXy4Idjmy1AhfzneHAj1PYdJtGCELVIstVLO+q th1oGfbrSKFjKa7lCMAZkGye2zBbTHAqg+SB2L0g55PQq4un03bk3qLjPvOE+cYuVYsA DRexBI0aUiisCgjQjy0rk4dbTM2OJ82qGUrNuL/ib9ZwL7fHFt5RSZ1E8lPUwS05ohPg 2OE1lSRmwbd4uOInVtVYZSCU9yP4WzjcjROMGv1nkKBhSrD5hmMQHWeNUUL3B0nz9774 s656z8b9bgiLWp9wR3dCmPE81E92oAagW3Zow+1BAec1dnRq8cwlEW9BrI3RoBg4xtFU dFMNdVsmd2XCCYHfP335S/DZ/f3E2Qy36TrOxpJ1GQ1D7Gxm7s9HPmEVuGxe7uHWmuCz ObZ+TSjP7ogUnabkYMUvfVejx9OcRCD9EVZm8kf5/fe9OsRMO0Q3iwtGaxiDY4ooiK+N iXHuiCFRBmWk625IQ45HTkkPqnfGrAlMqcu2MO33LdCHcd8s+HGYVkL6PPkD/efJes5Q CHo15OuqrMpue9ipaTpqYJqT9QAkCZouWyF7Mj9031NpPehJpXYSFfOW1WLNHBAvKTir s2wRH6Q/BRKCNIcGumIedimdPqAqixOJByXXFE/D00+CD+dYjxdPjTXVEokhpdY/0BIb QQzOmtOG2+OCZqhBixObn6cHZJ1zB/tWw2l6FIV2xAsgZG8sJyrnV04zelNDtcUM4ZKu z0H4cEzL88NwB+etzCrmh7LN4aSWbXjG2rs4JUcX/B6QMGyY1LE0PjZDmBgeZqS/lXSz e+Zqd1704XYIS36S3oofy9oHBgZI0T8YxGu+jl+s0GU0l9ihRXJlpApdvG7cdwvxtBEb Ih3rRjOK51nthEhl+eEU/uV+h3jd5v8n71uX20iS9V6lQ388EyHKda9uhYd2X2e1e2ZW lsZnfTyx4YDAJokjEM0BQGm4v/wifjk/ib+qBsjuZqHVgLTjKnoiNKJAEKzOynt+mZkm Wcqkx+ceNTrnP86ulovZCv2UqGfNlqh2tf+VFre6iYp6Xtt2Nv0yMt37++/v//71rRnF pZ5M9HbUvFSVkTJ+UvPy6IrHSPXBaCF0TaIBB1rF9ueAI1qHxPGwmpSizIIdMnX+ZmUW wdTbs2I9u9zub3v3985rfYgHBt/GP/98h1F7hl96NtotQjSh2FVk120FpWoxcUHRhJsA JahzE4B3slIZX6NzblUlUpHcpujCdBWZsNMfexzXi5/E8flHR5TwxL2yUUq3z3fnVBmF YSnZiyvG4m2Ttd83Gz20FUPYHpq4TciI3TcIIevLxe+oWLbd3L1HdgsZxgNUKsVyht6l U1y6SIuAL73FXKCXCN3E6/pstGojjs+8Trn/tiDrYIBO9NzOBT0qdHf86h4jfTF6RrA0 GniM8Of5lFwdssS5TqTHfZNuUdB5okqJbqeeKDDBFJG6wKv/z13NMT/kQP0dNtfk6i4X a4x5MCMekYO73UTf/YwhZ3mNYXOXLbbxLYTk7WNDqG1MQrvR4d0RVByfl3awrtGaZnpk rndZpx13fkFsTBxzXDDq+N0jYtM50j78HNvR4WYowStFGPU4aX0aQ721ey++BzbWIJ2u UWeDkp1dY4qebR82Sy/suHiT9cXckIem4n2Cc9bPZR4gXoWwL80HCGMRF1mBTQXhSmPP JvfdkOMzqQ6mHgqUO/9k9z33joJb+LJ/cg7P/3Oz/rgbD9MMQb5dy/bPTr06RNTy1V5e zdP18sLrvQbvyf2Y39UyOJwqtMbb5sx6ia2sQC/O5/XSLCAw6M7Lu+0dvjv0MNxcjS5k xkXy7FSCCfnsIKspDoIiMRBbdtpoJ9Dwv5hHSBaX6HGA8gnq3JLIKpapcWGCOrfOkpjy LLxcq8B+tqcgbo8SWm7lpDmrKmVrZkHxCdbJy5SIQY3Lf32CASk8pUMXx/9zC54jJrIL bAPjk6ogVRJcYo5SkUODm3grKHrzpIKdL4M7N8UanFLHwdlLSUtaYPJiaHwiK2T6xXBi j/96UKdVnCXh+VUw8zFJhriqAOhNYp0m3GAxg9KDtNKguAgubqBxmsk0PP1NSJ4mgA2E xic65pXE3NfQzs0pL2lsZ6sFJZdciRQrY8OzlyJnPAkPDM1ThqZ62/caFp/g2BRDBYOT yyyPZZ6GZy9JopIqDS7vowv4UDw8v0qlcSHhooTG3yKTKlaxqd4HpU8AvmZVKgaFZv/9 b8GqBP3XwflVKkXWvrAbfYLiExpXvMzCszuKIEhDqBaaXJIUw0C53WMeFJ8owbIsz4KL G3Re8QrtKaHxCVckxUD78OKGJJYZBgmFRm+daoLQIbh8rChJzNAeHRq9McKvwGJDj+38 KG7pG/Uu6Cm9CzLTBRfDITU+uXJjpDqyd0EViufC57hs7GG3f2TvAtM6N0mx0ERfCaXK RARnImRGKkCKDGDdU9dtnDXNTpZd9wyAZI8d9VjMNkNn62xjIGZoWgREbwtM5e3S7G7H NLLZ/KMF+7c/OwT0OfqPSAG+VHZum6eEcmNTGJZ3lBIrlHoXzGQh88xqpHDB2eZm8ceA s3sX2OtctqPYj0M8O1bC9pCP/UYBxMimrdXAIXcISjdydL8g0Bz1INQSbIpPt7ukxPG9 y46DG1Rr54Tbc9PEa4ZPDCi23mM8Oz+wf6n38GOwz95n4jEn4GJ3Ioohs010s9gu0F5s sM9GTvdi+jqaXVzgW81q+PkOMdWAqTDJBiG0KErGMJgfQhAou5tW68g0XWOH6c2tGQOz J4qdwWhGUpv1ST0K9Req9XagoMnkiztQ2lVMI5/YWYPy5PM6bGQ4xp81KO1JwZyAOPdQ 5O1Qh6M6ig7IWyY5+njatgy3LjDcvrNauwU2NwM6u+TRit75bvNj7/3TZA2mMr9brzGo c3m/+/XDT3FJVFEWucDz9AxIKJ764e6e5hKbAY2X8ChV39WmSftxwMH3Zr/rzMyX2dbt BN5HT6JHuZ7FkSavfpTF4eSo+bS6kilPuxbn3K6WPWhVHpjpqSY/N5q29yzgJQcXYC+E lmUx0KtUsawQFkAaqF7du4LQrzuB7BGjryFMQfCrL9Zoxs4NHmDQnVroHWaalHdWw+6G TdnhSLu5L+BntLviUaP3t/XsIyRg+Cscl88zWqYyHeTtSMU4hSNpiBJmg7Odq9qsF1eL VduSYujS7nc2GrpHmb6IG1J8NSf0pHFHxGK3X+2JiLsNyQf0IzV2v7k57EEF0HErbRbz q48+ZGLsSzqbXWBm8XaxqaPv/s//+t/tyfDF9wMyPiijzmfsOahHkW/saZqmup1soLsZ jd+mMWlwNhAQR7HutzSoha+mU++BvnTF52NtWAfUMs2l5LYPvxOVUopiempxc4FK5si9 HN0ex+lXWle36HV8hcmyd/QULdfZO3Kz8wjb0TI9mj3aii5PHx1Sun7/cTxtvKtR+jzo g97ntk8Gj9UuiN8ZL7PQOZpfm42Oxi8zyzbMFLPVhRljBt09pIDDlDEzA50Xw9KC0phN ZQsOgQpMc2vaKocxcs99UUcvBXXd/hPumz3ZLfvlsN8tUXC0zaILDLo0czuMvt4tEdre j9hiZXKXxynqf45CuJ59anfLTjHD6vggwXHqJ5dxPWgRh2e2szrvOu/dv/RU4g5czFCw vnzD53aAyKaerefXRjphb4cf4pBOBS+T5MzjgmWHoJOph8GlSzP8CfL5qd5MafSlWUKr wi5r6Jh1n2Jutzsi0kwB8jkATgqNbYO8XdsSYKAgXtHHIkOPiXsxQbu97Zj8EXdMIegx Vd9hTBJslG7X7+w1zLv6bB+/718yB0RqC//HK8aKdnx/dXzY4jiiUSSds2zP39l0bY8y j+7Hg/7pPdmYb9+G5NijsbpoPiMX/NsdFj4b0z/8DQ4FIlRKCPW5nOUWHIKFnDJJB4ge JTUVkChj4AIUHIzQebOKfn1zVrxa1NvLs83iYn324ep2U8/PcK2bv0fv27TaJuJ9rTiS ucYIky9mrnWPU/of1klaP/kow9lpzGLEyIZB/UlatydtJfsUC2T8KfGKv7RO1YA4Xf1w fMzr2PlsqMgLlWs2lgLf74lcLlD2sef6dLdcwYn9sFhiL+mT/MskjYI0xF4fducgORSF wRGLbJjS4kTmhOcmyxmowA0uFzYAj2ITGur4wHn8cvc06in23YtFm8bqsMHePqXmhPt/ mK8PGqvjg+Xx87Yh5axHoWlcZeECvZ/rm9Xjw+opJwU+YRNhi9p8vfgwqNc+Hrtzwfr4 +M5xjKNu80C40LHZiNORaNvU1ngfvPYRJ+EcvtdfMft0cXPbrBHrIwGAzbImEQDq2ATu xd3aMfvMIfMix8TGohhAIWghS4LO3uco83YG7HGx8XEskVAuMZPXiNbuct0sYYL5qYIP uwEtcpQj7Ti09VIfT7c97wt+x4p23ulUaWO+ak8pPErlGD+3fm3vB3txhD6+ynTkPuRH quwFcizx3KFUTzeMkQXVNKRHGwO+eolEXQ/PYeR25OmPD1G+9undHNusUCQfZdmRS3Z/ ZI2KM/JbuyzRg4PSsyV2481xzO94/g5Lj1zTwyM+HGUaBy8wy+26Xtu0bvdHHSqXmaxq Rj3uSDyFvbHk0QIDEJ8CVoj1vDdwV2+bZXN1v0tPt5bpBgVWY6RgAO2e0Sh9H93OsB5y 1YxIwPFOODuqwJHkWM/dRjh7+R+zzuAJx8UKTGPHQq4B1B2ZHqQGeMA4q90C73mLk4Hv gQi2MdweYXzjxeZltGf+MR12vKftkOGesu271VOtLrLB4yqsE/vp491tx6GHiufcJMUH vP6gNztv/iMMr81Ir5oHUe0dy83lWEFWMloNUC8+5WFPU1+7GtpLKCL45mB2G3FfQ5NZ 9xpKy86hfbDcFn34CI6YQDnNVCq8nmV9GuV6j97PLPUAlsDLfTFNtUMjjHxkJ1n15AM7 0mNsvD/JqvakEChE9qNEnjQUXbM4UzIxOdCgSiEqzgVgx4Ngk2hA95QtkASaYPoF3gw0 wfsyj/6KeegXzfzORuMDLu5YlrasflQ8d2C3M41ZAjs14tL+ih2Z9d/7tnmaU2sWi0Wb BiO4FxdoGzGo6l4aw2yKMJ7cwO3tOe92suNxzvuEJ3VCNEFfQwY4cDCdNr9nxzl89S8f 8To61N/7jWOwU7dFhUgUST4clQpwfqaRNYaQBykWA+bv3srx0byDJY66FXfwGUW2p8Kc dH975ute9vXBM+v9Pitu57uqHPajtNIP17jaicSnGXqrbmb/DiQlEvcQHCMnt7uNKrbm 0KOPmzEw6K3Mk2FvOPppUZLJbFIgzApYR4mgpAns7QdomJUlEQIKxBWg14VpSgMxP9f1 x82OsLMIaMr7aHMDvG6PfH2Nc3y6xMFexpVAvSbH3pr2st0beNwXR9HswPVwGC/RXMmM l35IdFcg7QqEr7VGPQHpB2cdQu4E7ZBAwsk2eKdmZcl9ilQe+OQPd3DjIYzYUDLGO8cn GvTTRMOQdw4cacDCD5qm8+N73d+jbcuPe0L1PgXs6LCCx8fejofqHeFL13v+ra/PpUG7 zgh07X2rRob0cCRq0ObJM1EZQfTUfx6NEQ6wU9RXoD06jERlcfzlqMy182xXcnpnkKed mOzJxxluxszSlFZWkfoTk7Unbe39KL2nxWSSc1mE16QvylgrgGoClYVz8YrBO9hFX652 d5PXWWxMNnrftDbofe8Jitue80yVRJRFoEQ6qDCARto1e00gAlFZVWAWhb9EcF8eOsuS QlQej6EY1T4HL89kHX67Q/MzvCW4yUjGmw1ay8VHtP9jrdDmI6qKr6P5bGXWCT1OgUDn 5ieE870L7wfNx0M3jnMXOkDJcW/w7lvXYPv1bje7UKUy/WRgv5RVRZWdZRJkNB6h3Haz WM7WeyVomGbfuXuYF+z8uuMSKA507Ijr+JQXTNvcHrB20P/vpNJsGvSrj2i8lM5ZtgdQ czvnen3YLz8grvue2s+LLZypFtxn4X7TmgA4UGPQv89Ohz30av7nHg+6JZOLHCuc+SB9 7FPlyX1uqjGDWMSDihkWaWXYxWJjszDTOMYAzVabz0jYjOJXkuPBS8cpkYqwGFDOXfL3 l/r3Aw3kFhpnGO2gXhkR7PN/K9/3mLSXdEqOz2k6ntHGSo8Ps23D6C6e5GQF9PkaezVN EvJpD4G5vUH6rfegbq6WpWI50tZ9dxBLbzVhxKZRwuRqm3g04PAeDXoeUnJ8htFx2SNW cTpDfwFCOMbPu63WMLfwD00/GtjAMEh9cYWSDoxUm4g1L7XzAADV6bckuBmDlCXnJDbg 0WeVXcnuo7uNodMDxV5G982dBfMu6+3WfMsQaxeLzjsLkT/NlouLp62obvrxHBtHRGWU 5rOin+l6NsNjQDOUDR/GNu2d0B4g0mT8/9R8rpHvbxs07jBCobnsiaSbeoLlhgE9ro2f Fu1dmqKJgXh3g7mNAX4DmWK8Spjih/lXmHo1u7hZIO+xNR3QqOLOm82UXjFdakw18Xnd +mnUM/p8vdiY+Yb7UlxjR8BczhZLw2zpY9m+vtjNwnj5KOkTGE9iwWglxLMT2w3iFeQV UKLb3N2afgNDHwyiu9s2N+CtOZINzRItDaDwHg9wZUFTnernBPJRWVSqHIInfXLuT+M8 YxHerEyrc432jO1DvfOiQQOHldurpkHaxiw8txoSuZt5g4lk8y1oOmUMFddxlWe2j/VZ 2Yse04wUMJIJ3Y+LFUYCfapXi2HLbP9zO3WMJ59qq3KcVkiVm0DDnzpGe1JYw7U919Gp iZ3rj7yg0YhTPDzGMEW9IAOgs0+y6vYNJMDZeVEOPFMSJ0nM0E66p5y5aewazYXJ97fZ Ppev/q6oL2d3y+3Tt781LxWAAJC23fP2rb2a2/fb+yWE/jXcwR9evF1iAK+JVU35zZy3 fdPa+SttyfdAaqkFnWBm3xrBODQMAPU20J0tN83Oc8ckL5tKfYgk++HM8UVvx5RHF4mK tuVRPYrNeMJ3sf3WGV8447vpZe+tecJviNCh0NMtB5hFZjFPCo/LHacZpNsuCKnnTZrU sHWKTC39qjaNxxg8i5lCszUiwnb06TQnnMIkFcjVPbcQZjcHbz9OMPoOAUqbVYEffosg sA3HO2LWrZL3wNCJ/nLZvaj+R49RDxur4Yf5a6zsSScYq/Pvd6Cv7TXyEnAoN8AEGQdq 0ddkbuHFAvdCl88P4QG30Hb6XsAJt0q+zdPs8ncg1GZer2brRQN/HZxpa30blHrwdutr Yi54j6MOUA+FXp1UHsfQ7nNTxTNMCDLmzFNP+MC5SV4xLAEK7dxa07igPu+4GjWR32i3 SzxltwspWR7TxOPa1RipjtztInMtpNIDP9un+GDsYf/Q3S5aMU0zO4ckKJUlMWKVo2sn OJWFhSVVOWxBCoY1D4aAnWoDQD8mt4Q8kumwNuWIhwjIhPq7KNHk62am0bHBF+37J3gG ukL8XAa7zesg+QaUsqHiPlB6jKEvTJnURJAohJkJLJiGYNJ7LREnUI+mUqFjaKAXVZ7r rLK4ukChRR3mix7TxT2C9BMOR/ZVi9fU0aExknBIlYpRxPgiIGBfVPmKsRbn62a5rC/O GpSqBk/cBSkdialzP7GJ6jqPdgDlMCxcr/cZpc6P71/q0dAmmc4faTJ4HNfntD+CeSZm 9jD21mBVD5D6dn5ZWym1DVa96YVPwrdTIQ0QwcEJkVzCg5nOP0aOHPwEgh8HYuzcwx5N kjerTVukW94/tHjtv2mOiiwg/o9XDNkeuaNdNXYEhM192M71ttfyy3Uf5YnfbWntDkI0 L9NYqYFyCt8y7g2eoyyPeLn+/RaVFhNNm5DZjs8G7GG5+NRW81FThYbvsZmbeujtElz6 PJ121OU9aBh3yI+nxJtSJ0AWUKgszkNzErGrqCwqOkBbYlOvEljFiKcJ1E6nF58wLG6G ZC6UNObk7nA/UN49Du/aaoYSBp73qN7A47BOHdTtXlcehwBmbY/01x7RqM/OWf5JCOAu /Pqm3vWmvO6R361gBJMUjVQeJxDc5+ZxUpFkuCQpfLNi5l8XDbA3q8Ys0bQDmWFBdqtn plxoLJK8Eh7XSNwXikWCNMfs8r5SJyluubRPE6hyNG1kKXrRe1fXV4VHwj7dblrP5d6Z kqKtk1ZYYF+0JeO9KnzAyY0XRrvOpC1kT9eG7lMabdg5zvYcjtJuDVyPQOCRU/33CNPh FvMFRMiMQ71BNXyLP3DFEGS/e/uXN8Pf42jkZawEgl4MkPU+KRe3DPEiKxn3WZmf5i1y I0O7xaRuDKIBGd/OFhZCZnIntkJlRj7YatZnuCdP4kPHvQumVc7K4caa3cWH66ChH9ME IiCKWa5oU009KegXgLv1ZAO5/+JwrcUKQwMACb2bbzGFdOSTH3FQTz/XaIYYa+rLdsSt Nzio3UkhcG2Y7WAbRWlZqtzkYoJKtuskjpMnuCWf1Nxp6sIsKs8RYpvxLwY+YYZmtfp/ 3mAQjNlAaHtbDboZiaSVMQ6DoaJTtAXB4pi8yo319vTaTyOf0RZA4tYgj2nVsDsbkZqG QTVDiB7QYPj3d0A9v4kwktUOOURqoyf7bhvFhGaCUY+L6adTbW91MLv0TWQSuCZ721/K 6CaKKAFTzn2e3es+N1FJXsDpeG4iIKFBSpNuNstK2/ali8VmfrcxoBeUtaLP101kRr4a X6P1ie08Llz3xMSeSCuuS/EslcejT2+h5xOUgk45IhQSnMOtC5Vk3PbtdUwAA8aJ0djW ZsJsViwWG6yYPT6pZ7uOp8eI/PXX7+U6Nql3ZI3QfUTPk3roAM9YWQXnkCI/LsuUP7v4 yyT1fjJbkAfdc8sG3TkXdxZUsa+PPvgNqH4uzVCHq+vouvk8QYnKTCqCatFzM8bGH32g jsGibs1sR5Mf7RFlLIidMCF6jlapYaW9i7Luxq7DjzPqoJQsBoDFlEg9il3tSdvYddSt nTSLjBRlLkvqsbfn9lJ5VaKG+vxqBSa1/BO6cW/ubgDDtiscN4t/1NGH5m5lkNwI4kzC 0+R9btEObYPefS/gxEwoqdKSFHZTSsfBCT9FYHTKfDa/xo5Y7J24BIkwHchMsDIOvqnR 2z7K2bVpn0RRc6qioeTL2TJzAyOf19EzTz7Nuh2CZNDxfumZ9qRT9IzttWgRPUz0yOCW XcaFKjPyLOMkO/4yMv30RoJRnridYbU4GPJhRMGNcRoMlmQNpkEdw4owTKAZ8fR0T50j NalZhoZD4rHKHjVLB/EjRn7t6Bmr4Azo1EozMJNrxOC70o8h3s0MMfunGki8C+yrbO7r iykIE1HRmFNd+OtKuaVFlaxC88Sgmk9JplQZm5RboEVUUwB6s5qbdi2kYy7uV7Obxbyn PXrAN2rw40eAS8Rr5tjrZLStTihD408LfGunERgT2/vVuIqTa5UGMGNMNKaUNGiybdb9 zvz+Ux0JmZn2VG4RexnVGyDYFpiIDsmxWx+jPMUxd9ieAwTo1IvbxRvTcwE4LXePvO7e gfu046soPjTNx5vZ+mOvrkWNRXkNPqp/ePE/f2yy2fxja7r37+7aYdF+q/t0Jsr69hxm 0fPLKzPd/xqjZdtcu0k5tk/4RHVZvnOrAlYwruLhdDifPDf3uQXDrC9sKAB9n5XHaYpS Ngdgg35cqZX71gd9GZkx8sglY/6JsVkAPOOfDZxQvAhzj31oH5/cvcPa00LTvPJ5JK37 zjkTPIvDWyWv0koVmZ1D6CmvuulNMwkpyzzGZLvPLYSqMC47uAEhuuCUYBePvzrNTW9Z YPEkwwJLb3Wx+9wE+HBFhpuP/Ld9NEH+m8ceB7tuejOOzHNs8dJB6UGudEmZGmBOA+CT IoHBzIPrkpVpLhljwekTNOBkuco9xqy45VImudS0DI7eBI6VoDo4OADJVYVdlB7XXUez bd9ocEUyZXAFK82mUZ8b/cdIdeTgCpLEmmBXiL9+1NjD/qGDK2hh1mFkwYm+mVyYAvjj 7xW7TYQAXybC50z3OGsapN6b9Oc0Ml3S2D9j5hLjq2F+0pEswdJEKlMdnPOnUgJ35PlV s39u2ovE5JDjLhLqAuOllceoIbfo8ZiwKsDVblg2KhT1mQHd9JaCpjnPgxuHxmghcupz RtxNb50yRtAXE5pJRNGPoBMsuOhaCEkzkgSXHcWUQkoVCc51othqUMXhZf95wnUWD0Hr /me9WJKRkuRlcPqEpgWOHVxIo1SBpnw0jgeW/Qe540z43MXrtpdopqpyzG0Mjd48jSl6 +oIDS1FO0rwIr8ufEc0kCB4an8gilkAnBBdwA1CHiVM8OLujY2yboD5vl3brQaaoVCn3 OIvuPjctk7gkcXB8opISa35CtJeYXiDDGwOHUgAjOQ0uLhaSYX91eFU5mqhM5Cw4/wTx vKJYXhaaneca42TT4TqkAOLLKk0VK4KzOxwKvIplcPkTkqUZXPDw5JJqzYgMTn9TxigP ML6kFdMsCQ+FyHONpdVJcPxNCBZm4k9odocmJkwrgosvJWFlRpXHHQ/ueAfA4DhLRXD0 ZjGmtUkdnJ2XeYZWqPDiYpKIjFTh1edplSQJ0DGh6UGFDTogeHB5ZEmx9qvQweU1Ba0E KsYe113HIVQ/zq6Wi9mqQc8ndkMvAahq/yvNaF602xb1vL75gMlm+mWEnRJs//3d37++ NZPfKZmC+pSlJKqSHpuMMVIdifoUZZ5lqfYYlzT2sH8o6lPHWc6z8CbLKDOxFjvLQjMR kqCNLlfK33OPs6aCknpfz9GXvr0/Hvmpc2AosyI4gA/JpJAlC9XQuHv3YUWA/MSus/Yy ++jPKU3P2C9UyJSHl47JVKZlGhy8gog4x0Kn8OiNQVYx4O7+6jx3mE2Q1cCiE491tfvc LEuqlAmP3Z8D51aMiLwMLwwhnOmqDE4u0VfJVCrCSzeqBHNKsK4gMHgcdijnmFYZHH+T NDGzYYPjE2R3GUWnUWh8wsEmSvo8jNetvzlyjbkID7ZKJPBDSXidjyqTEp6sxzkdN58I TWIq7JT2oIZW0JzEKTR4aPqE8gxoLR6cHlRY7gNDH569LCsqkvB2isgkLlKSB8cnLLHZ 7eDiecZ4GVOf1xi59TdcE1GVSXBlLkJTjTV9wZ2bZpgnybLg4ksqBeMsPP+b6YRpFHJD s/M8VnlRBTgJg+dZikF9odEbq8MJyXRw+UGKbGwqi/D8KlGkcRzekD5RZrxkZXB2RykK PgkvThMU4P3K7rkPKr5URcUQ04cnlzHJZRJe/lvmcAalDi6eN6uScfbg9AlgwhwjJ4KD 26oilxhhExy9heK6Ssrg+FvlOqt0XoTmD6q0KCUQoMGdG8iWokjDy/vwEpnNwmP+HsdS fRv4J50C/9TYTgOUn8eqd4xUR8I/Gfogq8JnP2rsYf9Q+KddaaZSj/nCnYIEZBVAyvDm h+ssQc5AeJyqHmdNDfhnOv+4aj4v64ur2qxGmzLxk6U5yzO7+SeoiIwUlUwk1lB5izQZ va6DuM+/1dhsc7e8iJaLj3YHLpYw7e80eoddSPdRdre5fhm9Xy/Ws5voL8128XG2nN3e XSzw4ra+va5XEya9Mmxyo4nPGcnT6PcX8H1kVka9t7T66W59e30/BTIrtcjTPMDJdTwG AjoNLjWBuaOFKsKbiCAlxjXllceu7SG7XHDUIIJL5QtMHpUVlf4qeje9SZwgWC6Do7dW AEgEuN9I5bJAz7jHDoGbT0RRyAojVkLjb4bJuhULb+IeUrScYThjaPTmupQY+hHcuUmW cDQ9BJd644nCfroiOLsjM2nWMnkcx7r1IOGZKuAThiaXNK7Q/OVzqtNNbx3nKLKpKjR6 K40lWHESXF6M0jTLMh6eXAqOnVThQVJowQqtwqO3FjQ3KInQ5FLzMqkED05/ayoglzI8 uaQSi2hJcKVBqnMY+gDtJRMs4eHtjdQVJyjJhMffKeFpwoOz8yLRlVbhTdxDkIZ9YT7v Y3T7sarMaYxFy6HZS0yTxKxXHVzrAHa2lwqzYsKjd8GRIAxOn7AEM7O8HkvklktRoZhe 5uFNCizRjynCg1yJDLMCKQsunieEFIQFOPKnZGma0uDqO1TmaVWUwcklUt9Y0BZe/lsk mIWHUC00e6mSPK+ECK7egPoOAjWfcRyjwJav3Te/mzzKpkBPZamzXBceu3JjpDoSeooO tUJBh/grh2MP+4dCTxGa6DQJb4i55gVq0uGZZMlglAUNVA635zGgp+/qy3pdr+b1JNBp TCqU4IPznTSmWWDvncc513EdEr+iuKqfm/XNbLv4VB93aQSTyHNaBpdI5BjYlWTc48Bo 9NIOIoV/fVflGKKW/D2KsvXsYlWvgf999TJ68Zf6Hhji9cUmumzW0d2mjharCG/eRNsm erO6WMxn23oCRFgQrRPl827h0wjXmdX+rv7tDvPcDVg++pf6U73cvHgZZfnbiIqXhmSR IfDL6KfZen4dAS6tpyCJBVbFcJV7rM4PZGziquS58jhSOe2+jaCY3fUQlHf1x+utEZR/ g6D8CwDzv+BvixZ/Ff1phsH+EJ80yiA8GO3/I8Tk8+x+gqTIXGIcrc+YhNMo15GUt+tm 28ybZSSi77If356J7yEpRkIMZV9Gf56t7mbre+xCIGqKjMiMoXWXBYeiBhSZKeFzleS0 mzYyIikxMpIvZ4tNDTVobMn723q+uDQWY9GsouYy2l7X0Zu3UbVsPsOWwMAYV6KZ0nHC y6rE1E+P/YfTSNcREmwHadbb6Ls3b6s3//376EFmjB02hCt/n1/PVtgMAkKCiL+sZ5eg 7RQFg/U1aRXsOpWDPkyHdkOO2qkXw5Q99RJPUS/IKcdZEgcHoqFSYosi8TjpdpqM7NQL g3r5r3eL7bb+iDuFfsnW97PVtvVbu3onXWw/1quX0dudef7zpEtXWHaXpR5HlacRryMk P9X3xnt50dG80U/NRb20rr5DL0PlGJX04uUEJaPLQkguPK5IfzX9jMMCjcKO1yjoGcjj MrwJyhiPUpWx8hiWN3qpyC0xpCwe+P3YpIWWiYiz8LpUZJli7p70GK0wem0HDf6vb86K V4t6e3l2+3Hx+9n8Zn62qdef6vXH+v6qRg7DepOTihepRrcAe87a/j28xdlFayl/Wdzc 1MtHi/j+VfTL3domfV7kP+XQ89t6tYEnvnk9QdVzgIzRyBqqVjjIXh1T+d6yVWSSYT8+ MNYkO8hLmsUF9Xh4+2my1yHOBSKP7dkX5fCMkOg7pBI/IoM4gauw9LEqhAg1PT6Fq27X zRXSRJvvux4EZZPc01JXaJj0WObcaUFZ6FRz4XEsdZo4PJqizeJiffbh6hYL187W9W+b KeaHF6nkqnh2BrqjJLJ6uWw+LRCGmbJCO3Xk3S4gK15Ff5utYZte7FcOTtAPRHEAYULd dLqdoh86BYW2/IJcafR2tr2O/nW2XFxY72aSEZJ5LMrS500zp0ldh786RmgogWeEPxie 6FHnTuAxzTKmvV6Y/NV0a6tRZuvwFLMjRMyzhHhc/nSbHQyuxX70/1/MzvZ6Xc+2kywP vKyCVj7P2v5qDjdDnIzVsaW59FWUX6NU9+IXS6NOvutBt+5t0CTNisV6JbZQe+yHfTX9 DmjWHZOdEXaicqVVlufo0w8UQzfFgFf1h/WukjlNvzKkIUr88Zcmbv2K7U3Y9eWzXThN DAZufbNeXC1WZ58evK+zzeJqhX+trqa4+TJOecWCRXxN4fifmuvZ7Wy7nrXJJTirJs/0 Fzj67+d3FwBCtAmo1t0vdv7/uymuBxNJHhfkOauLNip6YS3Rur5c/B791TJcx93HUEaQ tE3QXdQXE3xYBqxySfRzrpTnzc3N3Qqb6lHmHVqrEZFFQmoC/czYNSxFfXZV1E7stM/K dYIj4Do/1TcfAFxCaECmyCdJaElVeK1uimFnYukzPv2bmK7by9/3dqueYqtUadYEJh5j qk4jS4ftB7bqgIHqp6ommSqdJ2mRcY+nfX017dK7zbY22bxRazUphJJZEccorfrr8341 tYZGqSuMZ4SeGkDleSFKGWoT0hR3shtA0UlWKBM807HH8bg7gOJVKRVTHqtb97llURUV Oln8FV73ubGhSGfE50n1o0rnGzV28imeAIkroEXzQNXMkY2d2J1SYNW6xwmYcb54s0JH wqrenhWmKN9xdsyXCCzfl3m0bkwpDq790//+fLeqjcfPJgRGvMgyEfsMwXaLvhR5nGU0 uBoGNk5Vz7J0broFGFOA8/48WwN4ZBppbLL+T6+idPmp3iCdtDLV4R/vFkCnLlZ1Ww39 23qxReYNb53ArZJlKAD5vHx2VLCnOEtv0p/TKAdoC1RqoW+bCMUM22yxa9pDgsQ0pDHV ttsYsk8B82IpNcYaZh6LzFcT76eZ7Tea1BAgaFlKQj2OWNyaT2EaUSbCm+aMDGZOuM+5 CDe9ZUZ5xn0urrrPTbElMNPUY4/PfW5kH42j6nGq9sC5GS0roYLr8cXOaMwW9rmRzE1v jQlhOvY5pe8+tyyJ5HF4I0lIIkRBU49Ld256c8KyuOLBJTcoY5xS6bG75qa3UhJLBMLb 2iAk4VqFtzUNZU1E8OFNtRcYvqor6nFrgJu/RQa4XZKEpwcLLK/hVXDxjkhSkqN4H1py mmuk4FBMD+3cSrGKVCS84otSVCodnJ0XFcpGVAUnl4pkWmodnP7WIoXh0TI0uUTCu0gY 87io4baXqmRFjA17odFb8UTneXgTCSWN0wrBWmj0linPee5zK5ibvyUvOS3D2wooMsYy jBAKjU9IIQVTyuM2SzefaIKhrlh1FBq9KWxllibhnTuNRUZ8rhW6+URVKiaEBeefEPQ/ 69znkcWH6F0APRxePE8kkmwJCa6+w7O8okUWXDyPKiDLVRJcvCNynSBSCy4u1kLnuvS5 z+qAPtGk0ll4295kTEqRk+D4hOs4TioZXJ6NVFIqYMH89QdH4TjfCLwqpoBX4X9SKXxe WDlGqiPBqxJ54zz1efvV2MP+oVtJMFo6TTQJzpWQVFRxWQaXYteCpWXFPYbmjLNmere9 btab/xClFxdmZNe0zSQl01Xss/Jx+yGiVIzL5zct5V3z212NSfxXy8Vs1UwADaNXH1Ah FaqhPQgazhebeRO9v0cP382UFTuEYZVDJTwuNI1K70E6pJ/qFTjiAoDy/7YFlnwTyQlc oXgsS/78JhO+Q18IRvX/axFFFFuQJ1AC8PFCxT4n3k/ji/efF9t/1Osl2g4mUEGmIiZZ 4bF0uNU8javMNHkHGkYclOryZrZYvkab05XV9P9lbrTdq3lzM+EuNTKRIhbBlcCojHMM 5w7OnxU85VxUHqesT9MgmBR8tzazGuvlBK5TmgNAmHh8e6dR4Vg/A0XcWFPmcWL6NDpQ TaK/Ycb2bHMzW0XFevFpAlMgdkiFrDxWRacR4z1I8OfGLAXK0yhKJOViAjWElqmOg924 etBY5emEh9fCrE+OPY6e3R6GlnmRc5/3XJzGwjsPA2sG7jDsrD7Ow6AFgocqvLsUKcM8 9uCK+UxmGsnyZ+dhZGskMaK/1YtJAXyCsb1e97yfJojHOhiizNAj6HPn12l0OMnBUGmV MRrsrIuDJvU0B4NXmMBfSY+L9KexxiQHAx0HXJLYY8fb7WAoQPoy3NozTWF8qD8f5VsQ VkqZJdRfcrivkfNKQRux0M4NuAZNmM+FEje90RMlWRXe6B4Rl5nOfa7HuOlNClJlqc+L ft3nZpUC1JsGB5jmOdEF9XnZvJvekMs4YUlwelCkZZYRHVxDgCiLsiThAXglkmFZHp7d ESUcbFEEl/sQaCPOvJ4979YniutClrnHdQX3uYHaizGryuPUt/vcOikpAfY4ND9WxJUQ yI2Edm4MxBGYgexxBfsQn4DaGHoYGr2VQfGVOjjANPgko14vc3fzCbxvzMaMg4vn0R4a FzwPDhGD9Us0zoItMn4jYL2cAqzXmSZplQdgorGIdft2HSF7isGo7354QTDQmuXWaLQv vV0/fdHMTTWvCmr2jL44/0+fX99evf8HPuXzDy8wX0sYn+r1Nb6WsRQv/mP7BixTxKvb 5vaHF6hXm3dgf881PoiS2P7Ah2a7bW4evrusLzvfvK5nGNz6wwug+M2PXjYNZjk//PPq bmv/SdpfNm+WG7xpczub1+17cAZokfZp7Zcfmot7+8VFM7+7wRa88/8rAAAAAP//AwBQ SwMEFAAGAAgAAAAhAF5pakKaCwAAhC4AABEAAAB3b3JkL2NvbW1lbnRzLnhtbNRa227r xhV9L9B/mOqpBWyZV1ESYgfULTDSJAe2g6J9G5Eja2qSwwxJ6egtvxGg/bl8SdceUhJ9 aUGevhwBhm2Rc9Psvddee8188+3nNGE7oQupstuBPbQGTGSRimX2fDv4+Wl1PR6wouRZ zBOVidvBQRSDb+/++Idv9tNIpanIyoJhiKyY7vPodrAty3x6c1NEW5HyYpjKSKtCbcoh Gt+ozUZG4mavdHzjWLZl/su1ikRRYL45z3a8GDTDparbaCmPjgM7ljW+SbnMTmO8X5HK RYb1bpROeVkMlX5GD/1S5ddYYc5LuZaJLA9YnzU6DbO7HVQ6mzbf6vr0rajPFAuY7tLk 2BjL/u9t6x2Y1n+OPfS7L/rBIusuCxVVtOdmeTdaJFiwyoqtzM/79qWjYT+2xyX9zy/c +rL73PbezXfani5GX2i+h+2PE+/zd8N9sBlx3SlN6n0ghzq70dsRbauDRWiI0xq6LOH1 nMeVtJ1v/2Vbc/akfY4Q/H8C6jutqvz0rXL5/412n72cxiIk6LEya2RCvf3Vil4DvMOK xy3PxYCl0fT+OVOarxOsCDvOyCMHd2d0YvupjAFswLX9lFflViHcHkuRb0XGvkco0fOY l+gOSHKurdG17T7ZztR3p5b1D3orM1lKnmDFj0/fm7FzhqmmOdf8nsZ2V5NgYq3QFk9L 8bk0T73J0l8tAZ/7KdA1frgdWNZq5a0WzunRQmx4lZStN7Ty/JM2fx7LQyLQe8eT28G8 BtsnjD64ufvm5tTMtNV1F/1RlwexERqYLpp+TVueZao08IEG9Yj1UDR3eXe/YeVWMC14 oTIGuKw/qiRRyBZXjBcM/UXM8JYaZlgYK0REeHTFZMEioUsJvMfWMvE5l9rMdUWNM4bf aJLwomQI7/oVdcKQDJ8JnUU8ZI/qigmJHjQ7XtPeYiYR41/Foi3PngX9p8UmwdSm0RXD Wj+e/Nx1LVgsikjLNb5BLDdmh8rkMKSNLc32YjNok81vwDyh7gdu5ZEtu7mVNX6yranr dHWrwAndWbAKX7vVKJjYVugtTj7Ucp6jp33FbvUjjMc4S5UWLNcikgVcR1UZg41F380P em9+55i23IVvub7/evPtIHDn3nh+oZt/v5ZxXw937O6bXAOnN+7q4Y7vWhZ+Xm8ydn7u LZeX6uFPBFQpPzBgTKkrwWSGj9mBRSoj/Cqu2LoqmWwBGVr+syoILREcaG6wrmne215g rV0RqUl0dld7uaNg5s9m7mt7Ob7tLDxvQvNeYKL7EVkMO85hkjqTPXz6/p7tBeMJkl98 YLEyaUmLXyoJ1NJip5DUkOaYqnOkSuJXCQfFEiDuRcDkdYaSG3yeh+gaCbkTBeNxDEqh Mp7gWaEqjQqoznb8GeWLSZJUdZWC0o7BxmN25MmeH5D+4Fm9XcOYqFuyalzD6+oao/HK WSxHxHZaHMh3577r+cvLdA0qRKdFziNwQ+SqQuidGNzBX9gye05ksWWvEha8nwhCcUgR CBsE++3gb6hsqJJGcYZyectBPVeWFx6JGDU3fcqPp2JP+sCMR/Q1tdcDtRteMupqamcV jJe2RcynZWrPGoWjkU0k+BJRYPn4hCjfG5BGBCJEWcRzXosBRDFRX+4kiSR4YzxBXz+L jKgrMBuxfsUKVQP3OW4NoWXQTZ5BYCOlEf8lEWdgv5FUit5mJT7SkW42EdzZrNYkGC0W kzfJ2HfC1cqazS7UrE+oTH6pBHJrDdf7rTDVhODRlqE6LmGYLSzCWZVJNDSonXOJAgdV xLE1zIsmwP4CIUz8NYVJWYrKTeao0OpxCrxVFVIBsjnwHXhRoKngOpFULzXJRWalVjdr Hr08o1vWm455PdJ7E9hB18AOFq41sd03GO4Eo5mzGhuufYHp/VFQdqciA2mer1G8IuWa J6lC9UkpGRm2EUApowMJ+oalbfWAW4pLd2p3toozc4PVxHtDuqzxeOEsJheaWe/CjIHa aCBodED81KICoLGAuknRaMgT9FitUlSIQwY1AoB8ehC3Y5es+/uv/yIB4vdf/11jMUJ6 fwxGeh9x1JkMPIw+NHF/hm96SDNS4DNib8T1ABoU6m1m14gXhp6nKhYJuKEost9//a3E dPqlv98Ydag7I3OnTmeybs3tlW8FhNytNG2FY38eOJfqNz+QbhCLksvEEGKoCTASaQdD tgJii888BSQDbkmMEimIMjF7MvDTD0BsRDzgeS0gMNUgcFamjgj9hs1DgErgOxgBPeqE Dr06BlUgHQwpQiKTgB8UYIg8Zo1TNekmE3v286dF+LQEvQ+TAnIWLYW0Y7BC4z2mtkj5 CwYvWZQgX5yXXOQCLzRNW9EBielMY56cVWXJgdJURr1pdYCzouCgjVjS0cHx9LyMV5S1 g8Bl94Y2p3PR4AW27zurt0zSmfuLsGawF5hwTP1PxbvmsYxwOtZQgFq8NGopDFWqXEbD Rgc1sqZ5qMAt1vK5UpVROOGrVSE2VULm5Cg4jVYKP8ePJEen8lDVaiwcYIOwMP3g1QlY LDzjAH0W8LdVipyYlNKdgq/t4I+ktTYfySmPfj9kG4nCNAGjRdH68NdXoumgykkrjwEq DZPCSmig9gjkiPXAccOKzQrkLsIsgGChU2qCPdrUbm3it69j+j0VfXfqdsbOYAzpzxuT UN/CTjdcTqzZ6FJLnEehcYrBsipd47jX8NnaBcjYbCfpDAU2r4Hx8G2DV8AdmO2gKqBV nelKnrywTaUJEolRQcwi66MoOg/PeI7cDZJtkBj/rjE6fJHaKoLgWKs8P0J3X9OPepZB MH134dfzgtHcJYm3bfpgPBovL1bjMpjUCFhGUSLewn786QlxiqMPsgl4V8FxmqIFoAPi JYQHNvvu0+NyjtRm0hBYWElKJgFAQfVwWZ/21AoFMisBVHYNX7je10KZGYmXJaodMyBI 32dEP8lewC2csvcmTEFPCQuW71wAB6HtQsEg3blleS+0/PEouNTy5x6FbYxwpxscwGxw IQplE+T6YCgFqAsH1pMmTWF85CYAaEIHw0h6m2ncm9e6nesh258Fvue/4bXOYjb3bO9S sTmsZd9X1iJrQC5ApHxonSr7MttM+oPnpLOC4CxW4SikGVohZDkzmGdp5r1AQnd/ynwv pBCaIKIoMZG0BecH0UpREtRlSN9cNulxiFlLB57V1RzuaLZaTGZvEM3y7bkX2pd6XrP8 nBOWUXRwXC7LDmlfeHLoZlcfGdWb2p1DwPdHs4k3p6qpHQLWwlnOzBWRszo+dnHMeVZW W6f2zRs6H/gqLoP8RGVmznGhw3BFc/jE/i5wlImcHz7CGEgsMU7zcamirjKQ+kEb/6y0 fJbZX9oiSsE2Rl7JcN2iroBz8A0OQoG7gTXSQUk3BEWgwj6wh0/1+KTTmgqm1BJvyANQ 00TnayZmOZBcTa/jqsBTqCSmdcFjzL2D1vwSihNYaF3VgNTQ0VqzFBLq9yJJhidhf10l iTjpCsoIAEbsN0OvcRqwoSo8OynO/R2zJ73xeuhBo/HMG1nOm2LbXi7D0JqbfH3C5qXv jFcfOmbz5mtxzI+PzUIqLSMtIPjC+rkqwDfrC0wgNamgQ1lZpOaMnu4SkVOB4kZyQ24I JJdplbJnzbMq4Ros1XRuRMOWuzHcy5I4xz2YLK3x6XRzdsjAuLMXqnbhEeZ8ASvZSBwW GAFAwKlxyNwerHk/ZA/1qUTrXV2rHY+jOVtjzNOdJYqN+txawcE1Wy7bw+Ks6XyobYpx CZH0t5rbVVl9u4sKP9qEV6kLp3jtk7xZOLKscECGL+8gPZCc0DrFxoYXEDxAV4ovSoNO 3/t58PzOF6nsycL357M3kOxaS3s+DoyKcPL8iWfN3DNRaUFy8+br9vwHEYPucxxoNDfW 3tmU1v9FJ9R3Q/ZJi2u4aX0MSrUDSVASyAr1nW9J/SR1R6biT9DhXznTe50RT5olFnf/ AQAA//8DAFBLAwQUAAYACAAAACEAnVyLvhAHAACHHQAAFQAAAHdvcmQvdGhlbWUvdGhl bWUxLnhtbOxZT28bRRS/I/EdRntvEydOmkR1qtixCbRpo9gt6nG8O/ZOM7uzmhkn8Q21 RyQkREEcqMSNAwIqtRKX8mkCRVCkfgXezOyud+Jx45QAFTSH1jv7e2/e+70/82evXjtO GDokQlKeNoLa5cUAkTTkEU2HjeB2r3NpLUBS4TTCjKekEYyJDK5tvvvOVbyhYpIQBPKp 3MCNIFYq21hYkCEMY3mZZySFdwMuEqzgUQwXIoGPQG/CFpYWF1cXEkzTAKU4AbW3BgMa EtTTKoPNQnmbwWOqpB4Imehq1cSRMNjooKYRcixbTKBDzBoBzBPxox45VgFiWCp40QgW zV+wsHl1AW/kQkzNkK3IdcxfLpcLRAdLZk4x7JeT1jr19SvbpX4DYGoa1263W+1aqc8A cBiCp9aWqs56Z63WLHRWQPbntO7W4spi3cVX9C9P2bzebDZX1nNbrFIDsj/rU/i1xdX6 1pKDNyCLX5nC15tbrdaqgzcgi1+dwneurK/WXbwBxYymB1NoHdBOJ9deQgac7XjhawBf W8zhExRkQ5ldeooBT9WsXEvwPS46ANBAhhVNkRpnZIBDyOIWZrQvqJ4AbxBceWOHQjk1 pOdCMhQ0U43ggwxDRUz0vXz23ctnT9DJ/acn9388efDg5P4PVpEjtYPTYVXqxTef/vHo I/T7k69fPPzcj5dV/C/ff/zzT5/5gVA+E3Oef/H416ePn3/5yW/fPvTAtwTuV+E9mhCJ bpIjtM8TcMyw4lpO+uJ8Er0Y06rEVjqUOMV6Fo/+tood9M0xZtiDaxKXwTsC2ocP+N7o nmNwNxYjlcfb8ex6nDjAXc5ZkwsvC9f1XBWae6N06J9cjKq4fYwPfXO3cOrEtz3KoG9S n8pWTBwz9xhOFR6SlCik3/EDQjx83aXU4XWXhoJLPlDoLkVNTL2U9GjfyaaJ0A5NIC5j n4EQb4eb3TuoyZnP621y6CKhKjDzGN8jzKHxPTxSOPGp7OGEVQm/gVXsM7I7FmEV15YK Ij0kjKN2RKT0ydwS4G8l6NehdfjDvsvGiYsUih74dN7AnFeR2/ygFeMk82G7NI2r2Pfl AaQoRntc+eC73K0Q/QxxwOnMcN+hxAn32d3gNh06Jk0SRL8ZCR1LaNVOB05o+qp2nEA3 zt25uHYMDfD5V488mfWmNuItIMFXCTun2u8s3Omm2+Iiom9+z93Go3SPQJpPLzxvW+7b lhv851vurHqet9FOeiu0Xb29sZtis0VOZu6QB5SxrhozckOaTbKEdSLqwKCWM6dDUp6Y shh+5n3dwQ0FNjJIcPUhVXE3xhlssGuBVjKUueqhRBmXcLAzw17dGg+bdGWPhSv6wGD7 gcRql0d2eFkPF+eCUo1ZbYbm8FlMtKwVzDvZ8pVcKbj9OpPVtFFzz1YzpplW58xWugwx nHYNBks2YQOCYNsCLK/C+VxPDQcTzEikebdrbxEWE4W/J0S519aRGEfEhsgZrrBZM7Er UshcEEBKeUJ3PjZL1oC0s40waTE7f+YkuVAwIVmX3alqYmm1tliKjhrB+srSSoBCnDWC ARxJ4WeSQdCk3rJhNoR7nVAJm7Vn1qIp0onH6/6sqsEtw4yCcco4E1JtYxnbGJpXeahY qmey9i+t1HWyXYwDNlFfw4rlNUiRf80KCLUbWjIYkFBVg10Z0dzZx7wT8pEiohtHR6jP RmIfQ/iBU+1PRCXcLJiC1g9wDabZNq/c3pp3murlk8HZccyyGOfdUl+jFBVn4abeShvM U8U88M1ru3Hu/K7oir8oV6pp/D9zRS8HcNBfjnQEQriFFRjpem0EXKiYQxfKYhp2BKz7 pndAtsBVKrwG8uEu2PwvyKH+39ac1WHKGs5rap8OkaCwnKhYELIHbclk3xnKavnSY1Wy XJHJqIq5MrNm98khYT3dA1d1Dw5QDKluukneBgzudP65z3kF9Yd6j1KtN6eHlEunrYF/ euNiixmcOrWX0Plb8F+a6Fn9rLwRL9bIqiP6xWSXVC+qwln81tfzqV7ThHkW4MpaazvW lMdLK4VxEMVpj2Gw3M9kcF2D9D+w/lERMvthQS+oPb4PvRXBdwLLH4KsvqS7GmSQbpD2 Vx/2PXbQJpNWZanNdz6atWKxvuCNajnvKbK1ZfPE+5xkl5sodzqnFi+S7Jxhh2s7NpNq iOzpEoWhQXEOMYExX6SqH414/x4Eehuu50fMfkaSGTyZOsj2hMmuPo/G+U8m7YJrs06f YTSSpftkgGh0XJw/SiZsCdlPGcUW2aC1mE60UnDZd2hwBXO8FrWrZSm8dLZwKWFmhpZd CpsbMp8C+JCVN259tAO8bbLWa11cBVMs/SuUzWG8nzLvyWdeyuxB8ZWBeg3K1PGrKcuZ AvKmEw8+RQoMR5Ou6b+w6NhMNym7+ScAAAD//wMAUEsDBAoAAAAAAAAAIQBgXWfG7KMA AOyjAAAXAAAAZG9jUHJvcHMvdGh1bWJuYWlsLmpwZWf/2P/gABBKRklGAAEBAQBIAEgA AP/iBUBJQ0NfUFJPRklMRQABAQAABTBhcHBsAiAAAG1udHJSR0IgWFlaIAfZAAIAGQAL ABoAC2Fjc3BBUFBMAAAAAGFwcGwAAAAAAAAAAAAAAAAAAAAAAAD21gABAAAAANMtYXBw bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2Rz Y20AAAEIAAAC8mRlc2MAAAP8AAAAb2dYWVoAAARsAAAAFHd0cHQAAASAAAAAFHJYWVoA AASUAAAAFGJYWVoAAASoAAAAFHJUUkMAAAS8AAAADmNwcnQAAATMAAAAOGNoYWQAAAUE AAAALGdUUkMAAAS8AAAADmJUUkMAAAS8AAAADm1sdWMAAAAAAAAAEQAAAAxlblVTAAAA JgAAAn5lc0VTAAAAJgAAAYJkYURLAAAALgAAAepkZURFAAAALAAAAahmaUZJAAAAKAAA ANxmckZVAAAAKAAAASppdElUAAAAKAAAAlZubE5MAAAAKAAAAhhuYk5PAAAAJgAAAQRw dEJSAAAAJgAAAYJzdlNFAAAAJgAAAQRqYUpQAAAAGgAAAVJrb0tSAAAAFgAAAkB6aFRX AAAAFgAAAWx6aENOAAAAFgAAAdRydVJVAAAAIgAAAqRwbFBMAAAALAAAAsYAWQBsAGUA aQBuAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGkAbABpAEcAZQBuAGUAcgBpAHMAawAg AFIARwBCAC0AcAByAG8AZgBpAGwAUAByAG8AZgBpAGwAIABHAOkAbgDpAHIAaQBxAHUA ZQAgAFIAVgBCTgCCLAAgAFIARwBCACAw1zDtMNUwoTCkMOuQGnUoACAAUgBHAEIAIIJy X2ljz4/wAFAAZQByAGYAaQBsACAAUgBHAEIAIABHAGUAbgDpAHIAaQBjAG8AQQBsAGwA ZwBlAG0AZQBpAG4AZQBzACAAUgBHAEIALQBQAHIAbwBmAGkAbGZukBoAIABSAEcAQgAg Y8+P8GWHTvYARwBlAG4AZQByAGUAbAAgAFIARwBCAC0AYgBlAHMAawByAGkAdgBlAGwA cwBlAEEAbABnAGUAbQBlAGUAbgAgAFIARwBCAC0AcAByAG8AZgBpAGUAbMd8vBgAIABS AEcAQgAg1QS4XNMMx3wAUAByAG8AZgBpAGwAbwAgAFIARwBCACAARwBlAG4AZQByAGkA YwBvAEcAZQBuAGUAcgBpAGMAIABSAEcAQgAgAFAAcgBvAGYAaQBsAGUEHgQxBEkEOAQ5 ACAEPwRABD4ERAQ4BDsETAAgAFIARwBCAFUAbgBpAHcAZQByAHMAYQBsAG4AeQAgAHAA cgBvAGYAaQBsACAAUgBHAEIAAGRlc2MAAAAAAAAAFEdlbmVyaWMgUkdCIFByb2ZpbGUA AAAAAAAAAAAAABRHZW5lcmljIFJHQiBQcm9maWxlAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABYWVogAAAAAAAAWnUAAKxzAAAXNFhZ WiAAAAAAAADzUgABAAAAARbPWFlaIAAAAAAAAHRNAAA97gAAA9BYWVogAAAAAAAAKBoA ABWfAAC4NmN1cnYAAAAAAAAAAQHNAAB0ZXh0AAAAAENvcHlyaWdodCAyMDA3IEFwcGxl IEluYy4sIGFsbCByaWdodHMgcmVzZXJ2ZWQuAHNmMzIAAAAAAAEMQgAABd7///MmAAAH kgAA/ZH///ui///9owAAA9wAAMBs/+EAdEV4aWYAAE1NACoAAAAIAAQBGgAFAAAAAQAA AD4BGwAFAAAAAQAAAEYBKAADAAAAAQACAACHaQAEAAAAAQAAAE4AAAAAAAAASAAAAAEA AABIAAAAAQACoAIABAAAAAEAAAGLoAMABAAAAAEAAAIAAAAAAP/bAEMAAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAf/bAEMBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEB AQEBAQEBAQEBAQEBAQEBAQEBAQEBAf/AABEIAgABiwMBEQACEQEDEQH/xAAfAAABBQEB AQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEF EiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpD REVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOk paanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4 +fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUE BAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZ GiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeI iYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl 5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AP7+KACgAoAKACgAoAKACgAoAKACgAoA KACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgA oAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAC gAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAK ACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAo AKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACg AoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKA CgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgBGbarMegBP5DNAHDz+OdOtm2zvbRfNt BkulXJ/EUAb8PiLRJkV11SxyyhiPtEeRn8QaAFPiLQhnOrWGRn/l5j7fjQBT0/xPp1/N PEtxbDycncLhG3jJ5/yT1zQBmXPjnTbVyk0ltGN5UM90qhuccZGPfGaALtz4w0eGGGSO 9s52lxlFukyuR3Iznnj3oA1E13SWjR21GzXeoYj7RGcZ6j73Y8UAOTXdHk3CPUrJyuSQ txGf5GgDn7rxrYWhbzjbom8osj3KornnGCRjJHOM0AbkHiDSJ4Ipv7Rs18xA+PtEZxkZ IznnHr3oAfFr2izyNFDqljLIudyJcRswx1yA1AGqrK6hlIZWAKsDkEHkEHvmgBaACgAo AKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAydb1RdH06a/ZA4i25BbaPmYL1IPrQBha J4xtdYmht1WJJJt2AJwzfKCfu7R6ev8AjQBY1PxVaaXcy28/kjytuWedU+8AeQQfX+vT mgCrN450SLS5r9r+xWSIEiA3cYY4PqeefXFAFnw/4u0rXLBb1bu0jBdl2i5R+nfPFAGs +vaLG22TVLJG64a4jB/U0AWrfULG7Aa2u7ecMSAYpUfJ9Bg8n+dAFygAoAKACgAoAKAC gAoAKACgAoAKAILmMy280YOC8brn0yDzQB+avx5+E2o3drYvB4jubctdux2B+hXpxMv/ AOqgDxLwp8DtYv5rlZfGt5CEjyCwkbJ54A+1jtQA1vgFq73MgTxzePiU5wZDwG7gXRxx /hQB63YeCbzwdDbufEc2otcJHCy7mUoeFLHErZz36UAb/wAQvgpeeK9I0qSPxdNYN/r2 2gsTvXO3i4Q8evp60AeYeFvgNqlpdXe/xrdyhVKgnefu5OR/pRxnH4UAYni7wBqlt5EF t4nu52M5jbymdiuTtyw87jGfXr1oA91+Gf7LGsxltRl8c3r/AG22hn8l4pGEe/D45uz0 zg/4c0Aeu+Pf2Y7/AMY6HZ6TD4yuLB7aWKVp0t2Zn8uN0II+1R9d+fvHGAOetAHBt+xp q7WMNn/wsS8BhRV8z7NIS21SnI+2jGc5+8aAMn4efsR614J8Vah4im+JN7qUd6kqLaSW sirH5kqSZ3G/kzjZj7gznPHSgD780XT20rSrDTmmM7WdrDbtMwwZDGioWIJbrjPU9etA GpQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFAHMeMPDzeKNCu9HW5No1z5eJwu 4rskVzxuXqFx170AePeD/gfdeF/FVp4hfxFLdx23mZtTCVD74XjHJnboWz93r/31QB5J 8avCV34r8TavpkOqy6d9p+z4kXLBNkUTH5fMjHO3H3h19c0AfO+s/sWa1q2jXnihPiVf RRwRkG1FvIVYocH5hfjHJ67TzQA3wb8LdQ8IaMuly+J7m6KyvIZnZ0PzHoQZ2wB25oAz vFPwW1DWxca7H44ubYpEALVWc529932kcnvx+IoA+s/2aPhpd6T4Z03ULjxFNfG2v5nM cgYmQD+Ekzv6/j1+oB9l0AFABQAUAFABQAUAFABQAUAFABQA1/uN/ut/I0AfIfxo/wCP LT/+vhv5UAeE2Fo85kHmtBhc7skZ4I7Ed/f2oAj8OWb2d3qDyXLSB1kA3HpnOCMnuefb 9aAMHw9G+oazqayXDbY5WK72JH+s7ZPt/nrQB6/Ho9xq8Cxfa5YVt49wJ3ENj0+ZcZHp nj86AMbw/ZGW61K3e7MfkrKA5/j2gj+8D19zz60AcZ8O9BeXxJ4gN1dGRI5JGQSruX5Z Cfly2O3bNAH114V+IEdmzWotFbyIkh3ecBnYAM42nGevU+lAHea58QzpFjFeDTTP5hHy ibB5Utn/AFZ64oA830L4/Nq2sXemzaEbVLZZSJmuchikgTGDCuMgk/eP49aALA+PS/br q0OjArA0gEn2rG8K2Af9Tgbhz1NAHLL+04p1C4szoAAhkdA5vODtbaD/AMe/fr1OOmT1 oA1tX/aJ/s2xt7saD5nnsi4+18DeCSf9Qc4I9Bn1GOQD0D/haedA0/WY9LMjXsUMrQLP kp5kXmHkR9umcDnsM4oA5KH48PJdSwPoJQRlhuNyeSGxyPJ49epx060AU9b/AGgjpcEc seg+e0kqptF1yN27kgQE8Ecg469R3APZfCfi4eJbKxuja/Znu7WK4KGTeVMkYcr91eme Tgc9h0oA7SgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAPBPiV4KOdS8ULenP7nFsIjn+ CL74fP6e/tQBmeENR/tHw7/wiTL5bahJJH9oZssm87s7CAT0z1oA+e/i14en8L6jeael xJcKlssnnBCgG/t1bv7/AJ0AeTeHtFuddkhha/kiWaQockkDGOcbl+vvQB9yfCLRf+Ec 02y0w3f2k/apH3fdzuzxjc386APoegAoAKACgAoAKACgAoAKACgAoAKAILmQxW80gGSk btj1wDQB+eXxd+It5cxW0I0Wf9zdN8wLcjGf+ef9en50AeTweOrrVlW3TSpYGhA3Mu4k nocjyx/n2oA2Lu5vbaCOSO1nkaVcsFVsj5e/yn1/pQBzng+W/u9VvAbK4iw4JJVznMnP 8I7f/roA+xNRgk0XRLG4WBpnntRlQCCMRE8nBPXHXntQB8TT/ETUpNY1OFdEuoxDczLv Dvh8OR0ES+nqeOtAAPiff6HvmTw/cytPkNtZ0PQ8k+SxOc+3rQBT8LfGfVLvULsP4duk CMGHzuc/N04hU/ic+uM0AfZHgfx5cePJI9Il0qSzEFosvmOS24rsTGPLXB+cnOTwD3oA Xxh4H+xQ/bI52Vp7jB2RFCA+5iNwbJwQOo5oAbefB2W10S01oasztexpJ5QhIZfNjMnL eaScYI5APc80AfGuvz3+na7qNqljcS/Z72aIShXG/ZKyhvunr16kfXrQB7Zoui3HjPS9 P09hJZtHBDOztGXzhFG0glP72TznIHvQB9neEfh79h0XTY5L7zQtlCmGhz/yzXtv9s/X v6gGZe/BlLu6uLhdVEfnSvJtFr03MT180Z60AYcXwDC3Mk0muCRWztRrXIGWyOsxzjp0 569aAPVPDPgw+HpIXF6Z1hjEYXy9oOFK/wB8465/CgDvKACgAoAKACgAoAKACgAoAKAC gAoA5nxf4gfwzod3q8dq149v5eIFYqX3yIh5CseN2ehoA+dD+0ldLf8A2M+FZh/tG4b+ 7np9n/r1/KgCpeftN3VtO0Q8JzPtxz9pbuAf+fY+vr/gADqL34rXPiLwW+oHQpYTcYzF 5hfG2cL18oZ6A9B1z70AfNN38Y7zw14rtbhdAmuDbFZVhEjJvJGMcRN3zyV/OgBPFfxn vfiDcTWknhOfT/t8awGdnaTywo+8SYE69+R9aAPHJfFd94Q1iLSo9IuLwLiTz1LqMvzj Ajc8d/m696APtH4J61d6/DpmoS2s1qpvHUxvuIGM8klR1PrQB9e0AFABQAUAFABQAUAF ABQAUAFABQAjDcrKejAj16igDznVvh5Z6moVnhHLHJtlPUY67qAOD0f4F22l3l3dNqEU wuSxC/ZFXZls/wDPQ5/T170AdtZfDi0tmcyTQyBlwA1spx7/AH6AH2Hw6srKeWZXg/eH OBbL6567u1AHX6hosN/bQ25KIIRjPlhsjbjpkfXrQB55J8KLB5Xk8y3y7s5P2RMknufm 7/55oAjb4S2DA5ktzkY5tU/+KoAy7D4J6dZTzTLcWzecScCzUYyc/wDPQ5oA7rw34Jt/ D1493HJFIXiMeFhCcFlPXcfT/PcA2/EOhLrlrHb+YsOyUSbvLDZwGGMZHrQA+XRFm0y1 04ygC3WNd5TIOxNv3d3H5/8A1wDhLj4W2VxNJM0sBaR2Yk2qEksSSSS3cmgC9p3w8gsJ C63Mf3doAgA4yDjh/b/PcA9Ft4vIgihBz5SKmcYztGM45xQBNQAUAFABQAUAFABQAUAF ABQAUAFABQAUAFAFLUbJNQtJLVyAsm3JZd44YN0JGelAHyf8WrxPA1pqeq2+lrqcln5O Io0EbSeY0anBCSEYDlvunoSe5oA+Vj+0JdscnwFMT6lz/wDIdAH034S+L8mo+BraR/CT QeZv+QsWK4uGHe3XOcZ6Dt2waAOa0qRPFfxB0m4l01bRJpVjKPEHA255OVXg9qAOw+LH iiHwE+oWtt4dj1Jra2SZZIohHvLDO0ERSEEd+uKAPlvS/j5catr9npUvgGSMXbhDcuS2 zPOebRSenTP0yKAPuz4X+KPPsrSzGji2Ety48wDbsz1P+rH+e560Ae8UAFABQAUAFABQ AUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFA BQAUAFABQAUAFABQAUAcvqfhm31SeWWd4ysu3Mbwhx8oHUlueRmgDI/4V/pP/PK0/wDA RP8A4qgDeTw5ZR6WNNSKBQOkggUfx7vu/p1oAwrbwPBbatb6kk0Y8hgwRYAucZ77uOv9 aANfVfDNrq1w083lHcoUq8IkyAMdSRQBjr8PtJVxIsNoHHIcWiBgfZt2f1oA6vTNLg02 BYUWMlWLB1jCnn8/50AalABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFADHkSPBd1XPT cQM/nQBF9rtv+fiH/v4v+NACm6txyZ4hn1df8aAHLcQSEhJo3I5O11P4nBNAEtACEgck gfU4/nQAvXmgBCQOSQPqcfzoAXrzQAUANd0QZdgozjLHHP40ANWWNzhJFY9cKwJ/SgCS gAoAKACgAoAazKg3OwUerHA59zQAK6PyrK2emCDmgB1ACEgckge5OKAAMp6MCfYg0ALQ AmRnGRn0zz69OvvQApIHJOPcmgABB5Bz7g5oAKAAkDknHuTQAAg8g59wc0AFABQAUAFA BQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAeMfGTW7nRNM0+W2tpblpJpQREWBG 1M87VbP4/rQB+fF78cPEMOoXEI8NakwjuXTIlnwQHxn/AI9z1+tAHUeIfjRr1vp+nyL4 d1FmlC5VZJQVyATkiAnjpz9etAHrvwQ8a6p4mvdTF3p15ZrBaJMvmmUhiSTtG5F/P1oA 9D1n9oG/0Qvbp4UuLn7O7w7xK4DiLK7v+PdvvYz1P1oA8T1n9sXWLjfa/wDCv72MQzH9 79qk+bblen2IcHOep7fWgCg37c19aRw26eAZ5pUKQuBfMXGCFLMv2Ekc9fQ8etAH05N8 WotV8G6Nrz2K2suo29vdvaG5+eFpYPMMbHy1yVJ2n5Rz26UAfL3iP9ujVfDF9caZF8Or u/is7prNLlbx1WVY3ZBIMWL5Dbcg7jweTmgD6Ssfj5Jd+E9G8SHQGjm1S1trh7I3PzwG eASlCfJBJQnafkBz+NAHk/jL9pS8ubcW0XhmZSlxy6XLEkAOOggHHfOT+PWgBdC+Ol1o 0cWp/wBiy3TXEChrc3DAx71DnJ8puVI2/dHJ6igBmp/th6np+4r4BupgHKAi6dc9fmz9 jbPTH40Abnws/atvviD4nOg3fgufR4vn/wBKmumZfkR2/itYupUD73c0AbHxQ/acl+H0 F7PH4YfUVtblYFK3RQSBv4uLeTH6+pPNAGnoH7Rk+s+F9O8Qt4Zkh+3RCTyTck7Mn++b dcn/AICM9qAOJ0P9ri51bxtdeFZfB8lvDbiQi+a8OxtnYD7KBz6+YfxNAFj4l/tF3Fjo s5t/DkkxSdFBjujk+/EDEA9xz15oA4fTv2o9R0jSrbVB4SuLyQpj7MLpgw3cElvszk7e /wAvOeooAm0T9tfUtV1dtNl8AXNqoVj5r3bbcjtzZLye3PNAGX4r/bUvrY3FjH4Hndop QPMW9Y7h1yFFn/7MeeuelAHXeDP2kr3UorTUZfDM8Rni3mJ52wpJHG4wDP4jJzQBv2n7 VtxceLF8Nt4QkSM5zeG8O3/VGX7n2Udxt+/xn60AafiD48XejTT6xF4dmuRFtxEs7bG3 BUPzCFu7eh/M5oA0bT4/Ta/4fW6/4R6S2mnzmEXDNIu2Ur93yVboCeg49skgHkeqftha z4Z1h/D6fD+9vY7fGLsXEih94D9PsT9N2PvHkfgACvaftta1c6kLE/Da+RW/5am5kKjA J/58RnOMdepoAm1j9sXWHSWzHw9vRu2/vRcyez8L9i98H5qANJP2tdX0zwwNSHgO9meL P7nz5A7bpCvX7GTxnP3enPTigD0z4TftE6j8SNR0yzufCVzo66h5255ZXfyvKSRhnNtF nds45H3gfagD6qoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAIpYIZwBN FHKByBIoYD880AUDomjk5Om2ZJOSfIjzn/vmgBx0bSmwG060IHTMCcfpQBPBp9jbFjb2 lvCWGGMcSJkdcHAGaAGvp1hJnfZ275OTuiQ5J6npQBxHjPTdLttNV49KtZGMuDtt0Lco /PC5oA+FtGsfI8ca/cSaKZYWlu9kbQHYP9IBG35D06D/AOvQAkWj6n4t1u90xVurCC3l lmjHluYgEl2BFX5AB83HoBj3oA9PvLm10rSrPTX8Ox3ctmIoHumgG6Zo0KFz+7Jy2Cxy x57nPIBx2uX91YWiXcWlzOkrAJbiNwkasrMoUBCBgDAAXgflQB5bP4+u0lkjPhWd9rkZ MTnOCef9UfzoA7TwNql1c6jJPNokwSSAusLxttTLJwMx9s9McdOTyAD1lvG8UH+jt4UW TyvkLGLqVyuc+Vntnr3oAydT8W/a4DHaeGjYyn/ltDEVfgg/eWIMcjI5OD3x3APP/Guo XWr+Hjp76NMz+ajGVo2cnb9UB/M5+tAHo9nNLa/DbSLYaa+6OONdoiOeTx/CT9P5igD5 68ceL7zQLOe7tfDM886zKu+OJ1kYMeTuELH68Z+nWgC7oXjK/wBS0ezuLjw7cBpYwzRy RuxBz0OYRyPoKAPRPBfiNjrCLP4cYx+W/wArwnGce8XT+9QB1WoXsOpX09vH4eW2YtuE iwnOByQcRjPHJyfzoA4yHQg+ryiTTCwOSQ1uSM8k9sdMH/69AHZXj/ZNOjhi0cjyuNyx EdQe2z8v6UAcTd389qj3SaNK0wxyIWDHnH3thPf8ee9AHr+gaobzwfDPPo5LtuzG8RLH E7DqY8np3H3fyoAh8H2bx+MbXU2smFuN+bQxkR8xMvUrt689On5UAfVtrpmkX8KXcmk2 aySbshoEZhgkdSo9M9KALI0HRQ24aXY7vX7PHn/0GgBx0TRz102yP/bvH/8AE0AKdF0h l2nTrMr/AHTAmP5fj9eetAEsGmafasr21lbQMudrRxKpGeDggd8/160AXqACgAoAKACg AoAKACgAoAKACgAoAKACgAoAKACgChPqum2wBuL61hDHAMkyLk+nJoAi/tvSMA/2lZYP Q/aIznP/AAKgCcajYEZF5bkHkHzU5/WgCL+2NLzj+0LPP/XxHnP/AH1QBoK6OAUZWBGQ VYEEHocjsaAHUAFABQA10Rxh1DDOcMM8/jQBVGn2KuzraW4ds7m8pMnPqcUAKlhZRuXS 1gV2zlljUE59TigBzWdo/wB62hbnPMann8qAGvYWTqFe0t2UdAYkI/lQBB/Y+lHk6fZ/ 9+I//iaAJU02wiOY7O2Q4xlYkHH5UAONhZE5Npbknv5Sf4UAJ/Z9j/z6W/8A36T/AAoA RtNsGGGs7YjrgxJ/hQA/7FabBH9mh2DovlrgfhigCvJo+lSgiXT7RwTkhoEOT75FAAuj 6WihV0+0VR0AhQD+VAEqabp8Z3JZ2yn1ESA/yoAeLKzByLaDJ7+Un19KAAWVmDkW0GT3 8pPr6UAK1laNw1tAfrGv+FAEZ06wYYNnbkehiT/CgCRbO1RQiW8KoOiiNdvXPTHrQA9b a3Q7lhiVh0IRQfzxQBMABwOPpQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQ AUAFAEU6l4ZUBwWjcZ9MqeaAPhD4w/BXVvGUNlHa+JL3Tzb3TSs0ccrFgQOOJ09D68fl QB59bfs2a5qEUMLeMdQiNqqHcYZTv24zn/SVHOM9+vSgD1fS/hbqnkixbW7v/RYfK8zb IN5Qbd3Mp+vX8cUAcTB8ANZvNRuJG8VX0YWfzQvly4IEmSv+vx0/nQB9reCLOXT7WGyl keVrWyhgMj7suYwqluSeTj1P1oA76gAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoA KACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAI2i if70aNjplRQBFI1pbDdIYIQ3GX2JnHuaAMsa54dVmUalpobOGAnh3ZB6HnOc/rQBcS80 sDclxZ4YZ3CSPkdc5z+NAELa5okZ+bUrBDnH+viBJ9OtADzrekAZOpWWDzn7RH/8VQBH /wAJDoecf2tYZzj/AI+Y+v8A31QBcfULGNFke7t1RhlXaVQrDrkHNAGa/inw4hIfW9NQ g4O67iXn05brQAreJ/DqKHbWtNVGxtZruIKcjIwS2Dkc0AWLfXNHu222up2U7Y3YiuI3 OPXhunNAD7jWNKtRuudRtIVJxmSeNRn05agCI6/oiqHbVbAI3RjcxYP47qAJ4NW0y5OL e/tZjjdiOZHOPXgnjnr70ANuNY0q0G651C0gGduZZ0Xn05PWgCFfEOhv9zVrBsjPFzGc j/vqgCM+JvD4YqdZ04MDgg3UWQff5qAH/wDCRaEeRq9gff7TGf8A2agCzFq2mTkCG/tJ SeQEnjYn8moAS41fTLVS9xf2kKA43STxqMn3LUAPj1LT5Y1mjvbZ435V1mQqfoc0AV31 7RY2KSapYq6nDK1xGCD7/NQBbXULJ41mS7gaJ+VkEilT9DmgCnJr+iRMyS6rYoynDBrm MEH3y1ACL4h0N/u6tYNn0uYz/wCzUASjWdJPTUbM/wDbxH/8VQA1td0ZBltTsgPU3Ef/ AMV/nrQBYj1KwljEsd5bPGejrMhU/jmgAOo2CjJvLcD1Mqf40AVjrujK2xtTsg3903Ee f/Qv8/jQBaXUbGRPMS8t2Q/xCVCPzzQBDJrOlRZ8zUbNCOu6eMH1/vUAIus6S6711GzK /wB4Tpj893+TQA1tc0dMltTshjrm4j/+KoAIdc0e4kWKHUrKWVzhUS4jZmPoBu5oA1AQ eQQfcHNAC0AFABQAUAFABQAUAFABQAUAFABQAUAFABQB5j8TPCKeLdPtLV9bXRfKeUiZ iB5m9NuOZI/u5z1P4daAPgxf2KpG1e+1FfjIzC5unuPIx/qwZN+3P9o846ZwKAPoOz+D NlaWEFi3xDhdoLdYDIXALFU2lsfaievPU0AeM6x+ySmp3UlwnxeEPmTtNsUdAzZ25/tA Z/IeuKAN65/ZIuLizgiX4oSARRj94EJ34XrzfrjI56nmgDzu0/ZDmmvpPN+LLwiGYMN2 fnKvnbg3464xjn8uaAPq3Xvgq2reHtJ0hfGRtzY2qQ/asZ8/bD5e/H2hcZ6n5m9M96AP h7X/APgnle6tfXd0PjnPbefdSXHliM/IGdmKbhqvIBOOg6Z7UAXNV/YGn1PRrLSU+OUk Ulp5W6ZVbc/lxlDnGp55Jz9KAPWPg9+ySPhrqbXlx8XP7azZfZDFINmG3RNvyb+XJ/d+ n8XX1AOt+KX7K1x8T9Nj02w+JEmmyR3gvDLbxmVmUCQbSFvouD5mc7u3TnIAPMPGX7Gm t2HhXTLBfiRfM1oYYjOtvKGl8uJlyR9u43Yz95vqaANz4D/CmTwv4juYL/xo9yINPe2J nYqS6ywgsQ1y+GJU8Y4yeeooA7P4t/svyfFOxNjY/Eo6U4vzel7dfNbbiQeWQt9Fx+86 56DpzmgDydf2NrrwtZwm4+LMs+1FtyZEMYyFxu51BvTgZPHc9SAcin7B8t7fS6mvxwdB du0wgEZPliQltuf7U5xnqF5IzxQB1Vv+xgttElu3xpDPGNpLcEn3zqXegD2TwN+zzbeF ri3lk+J0eoeTC0e0sBvz/F/x+P8Aj1z60ATfFP8AZhn+I3h6fTLX4iSaWJ7hJ1u4oy+A p5UYvYsg9zuH09QCXwf8I7Xw14f07wRceP4rm40mEQyX0kgWSUoc5aM3TkH/AIG2O9AH mviD9kca7rN7qUXxdEC3UhkEKchB6Z/tBf5CgD3e0+GNv4f8Dad4dPjSO8lsUSNrvzAr ylTuLFftDkY7/OcetAHyZr37MreNPE2oRj4qnTBcSmUANv8ALxztwL6Pn19O+etAHX6T +xJe2cULj4tT3EYXAk8pir85z/yET/n86AO6tv2T7i0twH+JkhRf+WjIVHJJ5/004646 n16UAczq/wCyUt95g/4W4IWfHGM4wAOD/aAznGTwODQB634T+Ctn4f8ADNtoD/ESG8lh 35uGYBn3StLyv2tum7aPnPAz7UAZms/DGJfNtV8aqcY/eiX5TnB6faPX/a/WgDyHXP2W 7m/lm8SQfE2TMm3bYIC542xnpfAnP3/uj5vxyAet+DPhgbHw/a6Nd+LirLv3XUzFRzK8 nINwfX+8aAMHxL+zMniqaeK0+KIhludu2OE73XYATtUXqk528+xNAFjTv2WLjStGTSp/ iTIzRZzPIpVjuYtzm9OOuByeBj3oA8k8X/s53EV/JaQ/EiSQvGMGPJOfbF719aAOp+FX 7MFxoevaP4tvPiVJMmm3fmvYzAgShR0LNenGe3yN+NAH33ZarolhAIH1mxkIJO5p4wTk 56Fj/OgDctry1vIxLa3ENxGSQHikV1JHUZBPNAFmgAoAKACgAoAKACgAoAKACgAoAKAC gAoA8B+PXgg+NdK0q1GunRPs9zI/mhsGTcmMf62P+fWgD490f9mi4tLq8mHxJluPtG47 AzEx5JPe8PY46dfQc0AYVx+yjdyTyyH4oSrvkZtu5uMnOOb0dKAIY/2U51kjP/C05Dh1 ONzc4YHH/H93oA+sdO+BMsOlWkJ8as+y0RDIf4sR4LE/aT9Tz9aAPn7xN+zm2p3eU+I5 tzBdmVgGPzBWzt4u1649+KAPfNM8FHxDpdroh8SG0/si0SL7UX3faCkfl7/9apGcbvvE +vrQB4dr3wBW6muFPxI8g+e5+ZzjjcMc3aDOT0yT3+oBwenfsz3b6hOw+JMzIdxU/MVI zwVP23BBB4IOD1HGaAN/SP2ZptPv5rk/EuSferDytzAoSwOebxhxjHAoA+j/AIVfDlNA 1aV38WrfbbRoyjPno8Zycztz8vP160AexeJLy3v7JdMaWKMW7hROZQRJtVlBx75J684P Q0AfJmpfs3N4t1i/uLbx2dOa4uJbvaibwgd2byxi7i4G8YOeg6UAbHhr4JzeDLyWS58a yXSLEbcNKWRWIKneAbl+uzPU9TzmgDC8ffCG38aWn2GDx/HYyJdGdmSUO3G8FSouUI+/ znoQB9ADyUfsw3Onfvl+Jss3bYCx9un233/nx0NAFO4/YP1q+B8Tr8Wb5Ir4iRbcW8mx A3YONSyfb5B747gHS+G/2PL9bmOzb4o3DPGjAlkYkkc8qb/+Zz6A0AfRNz4LXw34WtfD D+JhcS6bsiN4ZNjSledxTznx3/5aN+NAHzLqf7KF94g1+88TR/Eqe3TUHaVbVVZhGG42 7xern67fzoA2V/ZFn023TUJviu5yMGFgQQT6k3+Rj3GaANy1+AIjhjiHxFMu0Ebt559f +Xphj8fbrQBi/wDDDt5qOpS6+nxXmiW8JdYRCSEyOm7+0ByP90frQB7fp3wzi8MaDaeH rjxks7aegie7kk8vzCDnJzO4HXgFz9aAMvU/B8er2UmhQ+LFQS4xcRy7jw3m8YmweRg4 PH6EA8fl/ZUn1/WjHF8UpIJJ+kCkvKu1Mn5PtynnGeg7mgDUuP2L9Q0eNr6b4qXDrDjK PGy53EDknUD656f40APH7OTvY/Zh8RGYn/lpyQfn3dPtf/s3Tj3oA2dA+DC+FZobuXx1 9u+z7swuxVW37l5BuX6b89+mPegDq9Z+EK+P9Ol0q28YjTJL3G2WMhzH5bAnCi4j6lMH 5hwx69CAeeeD/wBlq7+HXjq18S3XxJm1KCw37rSUNGknm27xcsb2RRtL7hweg6daAPU/ GngZPESXbWvisQy3Hl7Uil3EbNgOMTKegP6n2oA5fwr+yrqGp3dp4jfxvcERSkG3Nu8g bZxy/wBrHX/cP40Aeha7+zBqGrQzwxeM7m1EybQUgc7fcAXS/TtnuaAPJbv9hnXLmUyL 8TL9RgDAtZB/7kKAPqz4N/CO6+F3hy20S61+bW5ILqW4NxLEyMwk6Kd00vT/AHj9BQB7 jQAUAFABQAUAFABQAUAFABQAUAFABQAUAfOn7Q3g658X6PpEFvqcmmtbXE0heMEmT5OA cOnf3NAHxz4B+G+p6fqmsiXX7qZdkirvV+NpOSP3x+nX9aAOU1HwfqX267X+3boZnkHV +7H/AG/8+9AFRfg9qTMtwfFtyMsJSuG453Y5uefT3oA900fUrn7ImmNdS7ra3W280yv8 5VPL3ct3PPUn3xzQB5frPwJ1d7mTU4vFd44u52ufJSKQ+WGbftyLnnB4zgZ7UAdhpVhe JGLBr2aMwRCAyl2UuQvl7j82ck5JBY/XPNAHA+Iv2ZdX8RK08fjm9tfNuDdYWFyQDuOz Iu1zjOM4H88gF9fBNz4X06205tflupLONLR5dzK8hjXYXYGV8Z256n0zzQBDo/w11GO9 l1MeI7mUXaswhG8+X5jBu0zdDxnaMdOOhAOr0j4f6l4HvpfEj67dX634KfZCrp5XmsJc 7xM5O3ZjGxep6DigD1XR9JufFjG3W+lt2ERmypZn7DBG4Ecv1PfrzQBykWg3fhzWL2Sb VJpFEkkXzM8Y4fOclyD9zp1IoAoeLdOm8R2CWqatJZnzN4mWRiWO11wcOp5LZ69e9AHy 8n7Pes6Prd/r/wDwm17cR38kpFvsfEYlfzMhjdkNtA2/dGTzigD1rwl8IL8XUU0nimeQ OudjK3GVPXNweQfb+tAH07Yajs0e18Ii5zJZKqtd+ZkvtJJ+TORk/wC0frQBzdt4Ju7f WZdV/tqYxyZ/d/MBz7+b3Pt2oAwfGXwnvLyyl1NPEU/+kSq3lKHOM5PUTZP1x9aAPJ31 a+8Pf8SppbiYWn7vzjIy7z64IbGfr/8AXAPFfGZ17W5LoRXeoW8UswdXV5SuBzx8yg57 85/lQB1fwr+GuseI9VtdPm8R3lsGt3cu4kOCBkD/AF4/z2oA/QjRvgdeDw9ZWY8UTsVj X975TknBz/z39fc4680Aec+OP2RtT8W2MtnF48urEySeZ5q2zuw+Vhj/AI+07t6/40AZ XhX9jPUvDtrbQSeP7q8aDfmRrV1L7ix5BvG6Bsdf/rgF3w5+x/qmh/Ee38dP4+u7iGHf nTDbOEbdbNb/AH/tjD+Ld/qz0oA9b8cfAm88XabeWMfiiexN15eJFhZ9mx0Y8faEznZj qPvZoA870r9lPUdNs47VvG9zMY8/vDbMC25i3I+1t0zjr2/MAxLz9jzUrrUXvz49ulDY /c/ZX2jChfvfbPUbvu9fegDpvDn7LV/oWpwXzeNbmdId+YjbuAdysv8Az8nu2eh/rQBu +LP2cr7xJZ3Noni6e08/ZiQW7MV2lD0+0rnO3HUdfxoA4bwr+yHqPh7WbfU5vHdzeJDv zA9owD7kdOSbx+hbd905xQB9f+FPD58NaUmmm5N0VkeTzSuz75zjG5v5/nQB01ABQAUA FABQAUAFABQAUAFABQAUAFABQAUAFABQBzPiXw//AMJBBDD5/keUzNnbuzuGP7y0Aed2 fwjW1muJf7TDGfdkC3243Zzz5hzQBxdx+zz588s39vY8yRnx9l6bjn/nv2oAb/wzxJ/0 MTY/69v/ALdQAi/s7srBx4gOc5z9l98/896APVdL+HiafEIpL0TYhEW5oeuBgtgucZ69 eOme9AHCap8CxfzNLHrQhJmaX5bX1Ocf60fn/wDroA62D4ZeTbxwnUixSMIX8nkkDG7/ AFnGeuO1AHj+q/syTalqF3e/8JO8a3FxJMI/spO0O5bbn7QM4zjoPpQB2Hhr4FNoMgd9 bN0BD5QVrbHPy/NzM3939eSTzQB0uo/ChdQhWE6kE2sGz9n3cAEYx5gHegCTwP8ACw+E NZutTbU/tiTwSQrCYNgUu6MDkyP0C46DOexoAy/Hfwcbxgkgj1f7Cz3ZuSVg38HfleJE /vdc9hx6AHAXH7NM81tDAPE7gxbfm+yk52jH/Px378n8TzQBvt8AC1hb2h14loVRS5tf vbV2n/lt3PPU4PHPWgBbH4BPaSh/7fZgOg+zEY4x1879O/egClbfs8TQa1Nqp8SOyybs RfZjxnp83n8+/wAoz7dSAd1L8JzJZJaf2sQVx+88g5OPbze/1oAu2/wzaG3jt21MyLGA MtDwcdDgyGgDzTxF+zimuT3E410QmeTeALTO32z565x68Z7igDZ/4UJbHQLbRjqMRlgC g3RtF3Njrx5ueRxyxI680AJ4f+Ay6Ffrex6yGKoybVttn3v9oTHHr05oA9+0yzOn2Nva GTzDCm0uRjdz16n+dAF+gAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKA CgAoAKACgBkj7Ed8Z2qWx64GcUAfMvxR/aCuvh7DYSxeGZdUN5dG3IS4MflgY+ckW82e voPXJ6UAY2uftMzaTpul3yeFnuG1BYy0QuiDF5gB5P2ck4J5yB6+1AHRv8fJFs7S6/4R 5s3KI5U3JGwuM4yYeeT+HU9cUAdRp3xZmv43c6K8e2HzeZSd3BOBmIf/AF+tAHH+D/2g bjxRrGr6W3huS0GmM4ExuCwm2OVzgwLtz9W5496ANbVvjhNppGdAdvnZMmcrnHcZhOfp 75zQBjD9oSbKg+HHG4gZNyR1PqYKAOm1r4x3Gl2FtepoMlwbhN5jWY5TKb+vlHPpnAz1 9qAPn9f2zr039zZ/8ILOPs8rpv8AtrHcEbb0+xgjPJzk9MfUA9I8A/tJXPjPVZdOfwtL YiO3abzWuS+SHRduDAnXfnr2NAH1NY3JvLS3uSuwzRJJtznbuUHGePWgC1QAUAFABQAU AFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQ AUAFABQAUAIw3Ky/3gR+YxQB53rHgC21ZVEssR2sWG+3DYJ9Mt680AcNL8EIZmy+qIVD blRrQMF5zgZl/XFAGnd/CKO5hgiGoqgg28/Zgc7e2PMoA7ODwXDDbx2/2hDsiEe7yAM4 XaT9/v8AWgDndE+F1vo99e3i3cbm7LEqLYKV3NnBO/5vqfT3zQBP4g+GkWtxwIL1ITE+ 8n7MG3f+Pj/PrQBjXXwgiuI4IxqCRmEqd32YHdt5/wCenr/ntQB2Ufgm3W2jt3njcJEI 8tAD0XGeX+vegDzif4FWU1xNOL+FTLIz4+xA43Enr5tAG34e+EdtoV29yt9HIWjKYW1C HllPUSHP3RQB6/BGLeCKHcMRoqbj8oOB6Z4z6UAT9eaACgAoAKACgAoAKACgAoAQkDkk D3JxQABlPRgT7EGgBaACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKA CgAoAKACgAoAKACgDzn4ieOZvA9jbXkOmSamZ3lUxo5Qr5ab8kiOTr06UAfIfhn9tHWd f1nWdLk+HN7arpbyqs73MhE+xyoIBslxnGT8x9c0Adj4Y/ar1LX7+9s5fA91aC1JxI9y 534bHQ2i4z9W/HrQBseO/wBpi+8IWNldw+D59Qa6cq0aXLIU4zk4tZM88YwPXJ6UAeQ2 v7cWtTySofhpfKI84P2qTBx/24HP5/nQBoaP+2rrOpzXMT/Di+h8lSwY3EhDYzwP9CX+ Z4oAxpf26dbjuWgPw0vsCbyt5upAPvbd3Nh079aAPT9f/arv9F0Sy1f/AIQq4ma7WImD 7SyFDJGz4LfZWyRj+6Ov5AHluift4anq2q3enP8ADi6t1txIwma9cq+xguAPsK9c9dxz jNAGbL+3FrOs6lcaOPhxe26W0zYuReSESbH8vOPsI4Oc/ePOKAPrXR/jHLceG9K1I6K/ m3NpbyPbeeTJGXiV2Dfus5UnacqOaAOU0f8AaMv9T12+0lvB9zFHaebtn85yJPLkCAgf Zh1zn7x/HrQBmeM/2m9Q8LWxuI/Blze/vjFsW4dDwHO4n7K/9z079TQB80az/wAFF9a0 uaWFfhTezGOcxZF9IM4JGf8AkGt6f/X9QDu9L/bo1PUbK2uh8OrlXnhSVohfMzIXUMQf 9AB4zzkD6DOKAL7ftt6mgy/w8ulHq16wH5mxoAsaB+2nq2tat/Z3/CvbuFNrMJvtTsDj sP8AQlzntz/jQB6/qv7Q1/p2gRayvhG5meQoDAJnyN3+19nOfb5Rk+lADz+0Hf8A9gW2 s/8ACJXG+cKTB5z5XOf4vs/Pt8oyfSgDz3xR+1FqtvpjOngm7Y+Yows8m79LU8etAHUf Cr40ah4r1W1juPDt1ZLPbSSnzZHIUgdCTAucevFAGr8Qv2h7/wAFG98nwjcaj9lnEI2T um8HncMW0n5c/WgD541X9vPXdOEjL8Lr+bYwUAXUvOe+f7PNAHRp+2xrL6Hbav8A8K2v g867jb/aZdy5B7/YfUZ+70oA5m7/AG9tetoWlHwu1CQjHy/apRnkD/oHn1/OgAtP29te uYVlPwu1BC2flN1Ke5H/AEDx6fnQB23gn9srWPFXiC00ab4eXtklz5mbh7iQqmyN5OQb JM524+8OT3oA7Pxt+1DqfhWK7lh8E3V79m2YRJ3DPv2dP9EfGN+T14BPHSgDk9L/AGxd X1Czjum+Ht7EXz8huJCRgkcn7GOuM9O9AHqNr+0Lf3Ph5NZPhK5SRs/uDM+RiXy+v2b8 fu+3XmgDy3xV+2Nq/h20ubmP4eXt4YNuEW4kBfcVHBFm3TOenb8wD2f4N/HS9+KOn6Ve XXhifRG1Hz9ySzPIYvKaVRktbxZ3eXnoOuPegD6NoAKACgAoAKACgAoAKACgAoAKACgA oAKACgAoAKACgDxb4zfEp/hxpum3qeH21/7ZPJEYQSPK2pndxFLnPfgUAfLvhr9qoaxf ahB/wqoWZtwxMh6y4Pc/YVznqeTQBLB+0k+u3Nzap8OGsDaM580Et5uDjGBZpj1+83p7 0AZ9x8f53cxzeApZljc43Kx6HGRm2OM/jQBauv2o002GLb8KVkJAQkfKTjuf9BbP6cn3 oA7D4f8A7QsHi67vLeT4aR6d9niEm9sNvycYwbKPHXrk56YHWgBfiX8YLTQbfTZIfh9F cm6uhE2xACuSBuP+iuDjOeg+uOKAOu8TX8KeFtL1YaIrm8igm+y+VkxGWFpNn3P4enQf hQB8un4kNqOsXWlJ4INt9mmcfahGT5oSTy84+zLjdnd95vxFAH2n4J8NaXq+j2M0mmW1 rLJp8c7M1ohfcY0O0nCljz36nmgDxqx8SXGl+NdcsP7Hmlt7Se6gjYIwRliuAgZR5ZUA gcY6A0ATeNf2jJPAlglzbfD46hL5/wBmYxfI7ffJdiLSQ8lOfqOaAOa0T9pWXx44sbn4 cvYAR/aPMcmTJBC7MGzjwfnz1PQjFAHM+M/HkGi2/wBuXwMl408+wxrDtKhw7Ft32dyc FcdOeuc0Ab/wu12PW9SaWbwyLRJrUzhHgyE3vEdvMS9N2M8cZyM0Aet+O7Czi0L7RDpE TO235UtxkEuvoueh/wAaAH/CbVLO/wBXttJm8ORQFLaVjdPABuK47mME5z3OfWgD6cbT rBk8trO2ZB/CYkI/LFAC/wBnWJQR/Y7fYOi+UmB+GKAIW0fS3GG0+0YehhQ/0oAlh06w t2DwWdvEwBAZIkU4PXkCgAm06wuM+dZ28u45bfEjZPvkUAU28O6E2S2k2DZ5ObaI5Pr9 2gCT+wtG2hP7Lsdo6L9njwP/AB2gCM+HdBPB0mwP1toz/SgAHh3QRwNJsB9LaP8AwoAk i0PR4HEkOm2Ubjoy28YI/HFAEsuk6ZPnzrC1kz13woc/mP8AJ560ARromkIMLptkB7W8 f/xNAFgadYCPyhZ24j/uCJNvr0x/npQBXfRNIlBEmm2Tg9Q1vGc/mtAFm3sLK0VVtrWC BUztEUSJtznONoGM5NAFugAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAK1za2l 0FW7ghmVSSomRXAJ64DA8+tAGYuneHo2YraaajNncQkIJ9c/1oAkGn6EpLLaWAJ6kRxc /pQAn2HQSTi104nv+7hJ/HigAGmaFKSFs9PcjqBFCSOe+B6+tAD47PRbYkx29hCTwSqR KTigBZrfR5gPPisXA5G9YsDvkZ/P9aAHCbSZwIA9lKIxxEDGwUDj7vtQAg0rRyd4srLJ 53eVHk++cf5PPWgC4slrEAiNDGFG0KpUYA7cf5PWgCIWmn72lEFtvcks+xCzEnJJPrQB WmsNGnys9rYyc5w8cR5/EUAQxWnh6JiIoNNRhwQqwgj6/wCfegCd7PRpQA9vYuOoykRH 16f5/GgCaGx02H5oba1jyMZRIxx+H+e1AA8mnSZhd7VyDgxsY2wR7UACLp0DeZGLWJum 5dinn3460AT/AGu1/wCfiH/v4v8AjQAourY9J4ifaRT/AFoAkEiEZDqQeQdw5oAYbiAM VM0QYdV3rkfUZzQAhubccmeIe5df8aAHLPC5wssbZ6YcHP60ABnhBIMsYI6gsP8AGgBv 2q3zjz4s+m9c+vTOfegBTc245M0YHqXX/GgBPtVvjPnxY9d64/PPrQA/zotnm+Ynl/39 w29cfezjrx160ARC9tC2wXMJb+6JFJ/LNADvtVvnHnxZ9N659emc+9AC/aIP+e0f/fY/ xoADc245M0YHqXX/ABoAQXNueRPEfcOp/rQBIsiPyrq2fRgc0APoAKACgAoAKACgAoAK ACgAoAKACgAoAKACgAoA5PxXKIrWNi4T/Wc7sZ+X680AfD+q+L5ItSvlEzkR3U2AJmwd rnjOeM/pQBhXHxzvLXZbw6XPdlW8pmjuGJAB27iFiOPzOaAL+s/E+58L2lrqX2aa6bUg Mw/aGBhLjdg/K3TPcD0oA2vAXxRnmub2aa1kAlhEio87cFucAsoHft/KgCl4i+JdzLIi wW8rf6QQdk7HA3d8Ln+f9aAIvGXxCv8ATdL0ySOzuZGuNqnbK4K7hjPC++f160AY/h3V ZfD1z/bkuoPc/bo+bZrgqYjKySEHLN90jB4HegD6Dh+IdvHpltOpSaSSJC0S3HzDKZyT g+nIxwaAPI4Pi9qmoa7fWK6JdrFBLL5c4kkKOFl2rj92AQVO7OeR6k5oA9Wg+IVxDZxN Pp00eY1y0kjLuJXPBZAMnBOPrQB47qnxtli1C7gWyZtk0iAi5PADkdPLJ49c/XmgCCPV 7tv+Jwk07m+/em3WVyU80hyCR6cA8Yz0GKAJ9X+Ld9oFjA/9nT3DB0iI89geFOSfkJ4I 7888mgD0rwp8WRrVtCs9t9iLWgkLSXGfnKr8vKrzyf5+goA8eu/HGraV4m1K9SzvLiBr q4KEPJ5boZHAKnYw2nIIPOBjJ5oAs+IPi5dR6QJ1spvNLruiE7bx1zkBM8f/AK80AeX2 Hxyvr3U309tPuIdgJMpuXIyO2DEMZ/3jz60AewaN401EJDfi2unSRCf9ZJt/BiuDn/8A UaAPc9G8ZpNp9s0jCOVk+aNpfmB75zgn64FAHB+G/ED+IviNe6NLcNY24Eri5eUmMkDg YJVRuPP3vpQB0niuYWrXNlb6h9oaGUKGilJLAdSArHj8aAPPvCXxTuf+Eqfw7cWUsUNs jg3ss7bXK9OGTrn/AGqAPSNS10/vLqGUy7myESU/jjGe9AHlGteOL3SrqXUDBcOsePlM rheQF67SvU56dOepoApWfxUu9dkWwNnNbrN/y289iBtBb+4vpjr1OPWgDI1X4q6jYXcn h+PTbqdI8f6Ys0hVsqJeojPTJHDHoc+lAHv2leMhqPwwS2c+TePnhp/3y4uifukB+QO/ Y/jQB8+6r4uvPDd/JqaGe8eDGLYTOGfeFjPZugbPTt680AZ2lfGi/wBR1yIyaZcweZuz uuHwMI3UGMDkj07596ANHWPj3d6XezWw0eeVI9v70XLgHcoP/PI9zjr/ADoA0tH+Ld34 oEdoLCe2Fzn5xOzFdm5v7i9Qvr1OKAO0u/FOpaFotzdx2d3em3VpAFeT5uemdrUAdt8J fiJf+I2037RpFzZme6eNjK8hCjnk7o16DrQB9XUAFABQAUAFABQAUAFABQAUAFABQAUA FABQAUAeZ/EvSP7WsLWP7X9k8t5G3Dq2UPH3l/D3oA+BtR8FxNfXg/tdCfPlzgg/xHr+ 86+vvQB2Xwn8AWOm6hq01xqMF158PyrKq/ITnJBZ2x9cdaALXiL4c22pSuX1eJFSd3VS ikdT8o/eY7frmgCvpngpZPNhjuxGIY8F1TO8AYz9/HPTqfXpQBP4J8FWD6rqIuNXgbaS QJNpIYNk8NJxx+vB4oA9R8SaDpf2GCKS9tMIGVWbY2cIeRluD37/AJUAfKF/8N47m9um TxGNrzSMqKchQzZGB5nGKAOi+HHwjZNeuZm8TmZTA58nHT95GTnM7dz/AHR36dKAPs3w nJp+jslq9lbXLW8AgMxRFMjJtUuSVbJYjPB78cdADW+Imjaf4q0G2tbW7trOZZkmcQ7G dQI5FKHBU4yw+uCelAHxEfg+Br2pO+sjHmznLR8H97nvIBzz0J7cUAepeBdAtLbUZbKW /hmEEDR4dl6qyLkjccH1980AaHjPwnpy2/mpfW8xefd5QVfkyHPUMc4I7jnNAHjuseFY tQhhgi1VbMxzI25G2kgZG3Iccc9KAPrrSodKbwVoulzR2m+20+0ie9fZumKRRAyMSM5f Gepz7UAfO3iLwLZJrN9qEeqwSxySNttVClQPb94fw+XigDz668EWMlzLKL+CNmY/LhQV 9v8AWcUAfXWi+HtP074eaRItxbXEgijU4VNxySSc7mJxQB8zx6LqOrePtQtYzcw2zGRk kVHMfA7YIH454oAxfiBZSeGLG4uY53a4jmSNirGOU7jzk5JHvQB03wg0o6lf2WpT6kXa 5tndreR97KTk85c9Op+WgDtvHPhGKdbkwXKQymZTvjQB+nI3Bwx6/wCNAHJ/DSMzeLf7 CvLvyoYIubqdv3bESKP4mA755P8ALkA9Y+InhiKfTb6xt5EmjPl7byJAyH50JwVJzzkH DepoA8hsdHt7OyTTBKhnXPzDAl5Jf7mTJ0PvxzQB7DoWhWUGgw3Nx5DyjdueRV3n94VG c8jgjqen50AeN6r4dCeMZdYi1Tbb/Lt09WIi/wBSEPAbb975unWgC3J4VtWvTrsuoxMO 9m4BHTy+ctg+vK/eoAsyeFbK8X7bb3MH2h+lvEimTjjgK2T8uTwPrQBz+o+D0njeGVhF K2Ms6fMOh5yR1GOp78c4oA3/AAJ4csrHVrOFruAunmZztBOUdum49/zyD16gH2j4XTRo NKW2nmsZWMjkiQxEkHkdaAOjjudBtSFjm06BlOQFaFCCe4wQefWgDRivLWcBobmGUEkA pIrAkdRkE0AWAQeQQfcHNAC0AFABQAUAFABQAUAFABQAUAFABQAUAFAHmHxO0yPUtPtI 5L8WAWSXDk43ZQ5H3l6dfrQB8ND4WWy6jfTL4vhlMs0jFAVJT5ieR5/HXn3460AW4fC9 torlo/EsVw8uEZUkVSuT32yseD69/egC1rHhUTw2skOub2LCRlVsnBPfEnr1zQB6V4Tt YBFcQ3V0luFtCiySsF3tgjIJPzHvQB4ZpPwnni1/Wr1PE7hLq5lkVQpAVWkLgA+ecjnH Tn07UAbPibwK2qWtvbWviQyyW5IkELmRl+XB3BJSRz649Ae1AHCeHfhH9i1Cea48V4Dq w2yjGGLKec3Bz3z/AProA7/RfBkHhS+l1QeJkvBcbohFvChQ7q4OfNYcBcfU/mAfR+lQ WVxp9vKmpQ+Y9sjECVS2SgPPzZzz/PFAHkvhK0ePxxrjXGqkQbrrZ5kuI/8Aj4UjaS5H Tpx93OeaAL2uWGk3dzcxr4htI5DNJuxKm4Es2RnzBn6f/roA4DT/AIeW+m6ld6ofF0ZS 680qm9VA8xw4w3nHOACBxz1oAfYeF0l1K5L+IVeI79pMgI5cYOTKRwOM+h96AM/VPhna X0hP/CXQwEzeZgFc4JJ25E2SMn06DHWgD2K48LafqHhXTtFXxVbwvbWtvEbgSruYxogJ K+aMElefm6n8SAeaWfwhkstWlvh4na8ibcFGCyNnGCD5zA/WgDlpPhTDq3iG6gm8VpZK 7M+WP3T2GPOUDvxn6c0AenaJpsVh5XhyPWlvFslKLOsmRIF6EIHI9f4j9c0AfXXhb+w9 O8P6c1zNYJKkCrJPKYldmJ/iLHOT9aAPl/4sfDnTfFF5ql1D4jtYY7q6WVUUo6qPQHzV zz+f0oA81+HPga08L+KVnm8SwvBFDIgDusacg+srAe9AHtOsaTpWyTUDr9oUkcEZkQpy ccN5mD7cc80AeK6x4YstauJ7e212G0dm3C5iYbiMnuJAD1znPPbkcgH0V4UlsPD/AMO7 bw9Pf29/NBv3X8kq7333LSDIYt0DBfvdqAPLtK8C2Go/EOLxBJ4lt7e3k3ZtWKeUMWxj 7ygfeG7p1596AO78WeGNP/0nyPEduU+TaI3XZztBwRL6nPT260AeEN4asxrp3eIYffMg z/qsdTJ+PT73HWgC1qXw9M4kvLfX/ORtuEj+YHGBwBLz0J6dcmgDqvhb8NrzRfFmneKZ tQnvLeHzs2LxsIn3QyQ93YcE7uV7fjQB67448INrt1d6lDI1qZ9mIEiLBdoVDhgV643f d/WgDwlfg5qK65/a66xcqo/5YiBwP9Vs6+Z6/N0/xoAtf8K+1ebxBbw/2pepG5UFgsgA 9/v4Htk8e2aAMbxZ8IdauNfEMev36I8ajcqzEA9+koH5n60Ae+/CvwLfaDptpptxqlxd MLl3aaVXBwTnlWds/wDfVAH0tYWhsoBCZDKQSd5GM5OfU/zoAu0AFABQAUAFABQAUAFA BQAUAFABQAUAFAHlHxV+HE/xF0+ysoNWfSjaySu0iIZN4ddoBAkj6HnqaAPjzRP2F9T0 nU9Uv3+I13cDUWlZYmtJAIvMYtwftzA9fQcUAZum/sEanY395eSfEq6nW6kZxG1i52bm LYGb8j2zx9KAPYfDf7K91oblpPF8t1lEUB7VsDaR2a5brj+mTQB0fxB/ZzuPGen6XZW3 ieTS20+QO80VsWacADggXERGSM/ebHTjrQA23/Zxngso7X/hJ5Cy24hMv2Y5Y7Nu4/v+ Tnk5PPr3oA5H4VfsmXnw88QeItZuvGc2sJrYkEdtLasq2xd2bKs11L0Bxwq/pQBS8Z/s h3vilZBB41msC901wGjtGJAJbEfF2nHzdf0GcEA821n9jXU9DsoJB46ursl1iK/Ynz0J 3H/TWyePxoA9W8G/sv6jpkFvdyeMrmUSWqARNbuAuQp6G5OOh4oA3Nc/ZjudWt/Kh8Vy Wshbc0qWzbmyrDBIuATnOTzzQB80XX/BOnWbnWb3VP8Ahat6q3c8k3k/YJCE8yQvgH+0 ucZxnaM9eOlAHbat+wpqepaLZaUPiPdxNaeXmcWblpPLQqcj7cMbs5+8ffmgDpdN/Yyv 7Cxt7Q+PLiRoIViMptHBfaoXcf8ASyecZ6nrQByd5+wjqtzczXC/Ee7QSuXCi0f5cknA P24dOmetAEI/YO1odPiZej/t0f8A+T6APo/wr+z7P4f0LT9Im8SyXclnF5bXDW7BpDn7 xBuGxn/eb60AeP8Ai39jDUPEWq32owePbiy+1y+YI0s2+Qem4XqZ+u0Z9O9AGt4E/ZBv fCOqxajP43m1DZE8ZjezZclv4ixvH/8AQTn1HWgDpvHX7Meo+LdNlsLfxnc6eZJVkDxw OdoHVQBdJ+eR9KAPP/8AhkXVNI0yKN/Hd3d+UAhzbuGYk8E/6W3Q9eTQBh+Jv2I9T8Xa ELSH4g3WnSTOsvnJZu0i7f4T/psecnIPze/NAEM37Cery+FLXw4fiXeb7YIDdfY5Nz7T nlft/c9fnPrQBNp37Cuo2VpDbt8RLmRolwZDYtuY+pP28k/nQB3tp+yTqFtpa6afHFw+ 3/lr9lYE5ff0+1nHJ9eSPxoA5PU/2JdTvjI0fxDuoXfHK2j5XHHDfblPPU8dCRQBbt/2 L9Vi01dPk+IV3JjOZGtXJPzb+VN7g/3R83oaAOYuv2DtTnnaVfiNdLnoBZNxxjj/AE70 oA92+H/7Ntx4Ms7G1uPFEmpfZPM3NJbFTJvLsM5uJPul/fpQB9L6NpEWk2MNp8krRbv3 mwKTuYt059fX3oA1jHGwwUUj0KigBn2eD/njH/3yKAAW8AYMIYgw6NsXI/HGaABreBm3 NDGzf3iik/njNAD1jROFRVx6KBQA+gAoAKACgAoAKACgAoAKACgAoAKACgAoAKAMrVdU XTI45GQOJGI5fZjAznODQBlWHi3S7ySSOS6tLcxj+K5QknPIwcdKANNtf0VfvapYjPTN xH1/76oAVtd0ZAGbVLEBuhNxHz/49QA6LW9Jn3CHUbOUqMkJPGcD35oAy7bxZpU080Mt 3aQCIkB3uU+chscA4/rQBpPr2jRrufVLEAjIJuI+f/HqAMyy8W6Xd3MkH2q0jVAxEhuU IbBwODjqOetAG019psijddWrqfmGZYyPr1oAg/tzRVbyxqdiGXjZ58eRjtjNAFkalp7D cL22I65EqEfzoAwbXxfo9zf3Fl9tskaAuC32uMklW28r1X3z06HmgCW/8WaNaIGjv7K4 k37TGt1GGA5ySASeDgfU0Aa8OpWkttDcm4hRJUVwTKpA3DOM55oAwoPGOjS3s9nJfWUR hLjcbqMklWxyvBGevPSgDUfxDoaLvfVrBV/vG5jA/wDQqAGDxLoDfd1jTz9LqIn/ANCz QBIuv6I52pqtix9Bcx//ABVAF1b6zdQyXUDKeQwlQg/jmgDK1LxJpWnRNI97aM6sAYzc Ip5/E0AS2uvaXdW0c7XtookG7aZ4yB+JIoArQeI7CW9azWW3CLnEwnQq2BngdP1oAiHi zShfSWct3aRLGSDK1ygBP0Pqfc0Abg1GxaJZxd25iblZPNXafoc0AB1GwEfmm8txH/fM ybfzz/nrQBTbxDoaNtbVrAN/dNzFn8t34/rQAv8Ab+ibd39q2O31+0R4/wDQqAGN4j0F QS2r6eB3JuY//iqALkWqadPEJob22libpIkyMp/EGgCnda/psCuI7u2nuFxi3WdPMbJ5 wBk8DmgB0GuWEkKyT3NvbO2d0UkyhlwTjOcdf58daALMeq6bKQI761cnoFmQ5/X/ACeO tADJtY0qAlZtQtIyBkh50BA9/moAg/4SLQv+gtYf+BMf/wAVQBnSeL9HS8W2F7ZtG2Mz i6j2jPXI9j15oA3rfULG7Aa2u7ecMSAYpUfJ9Bg8n+dAFygAoAKACgAoAKACgAoAKACg AoAKACgAoA4Px3ai7soEM4g+aQbicfeQj1FAH57+Ifgtcatf3csfjiS333UsoRMtt3uf kwLpenrQBzF3+zZq1ysZXx9eKFYMSEfkDnr9toAfq/wIuL62tbRviJJbvBtQtvOXbgYx 9rH1696AO68HfAHUfBJlv5PGtzqcd/CqKrB1CZGd2TdSZyMigCHWvgPd+NZFgg8cS2T2 0xmYxksxDNjaQtyh/P8AU0AR+OP2XrvTtL0kyfEmaPJRcsGXcQBnJN5z/j1zQByeqfDK 40Kwt5U8ZS3RUpHhXYE4H3/+Phjzt9T1znigD0bw/pMlzZ29s2vurLbKC5mJJOAuT+89 +fegDzi5+AN5da1eakPiDOi3VxJKIBuYRh5C20f6YPu5xnA+g6UAfTtl8E7vTfDemyv4 rnmV7WJAxVl3boR82TcNnPXHJ65OaAPl9/2dbzS/FOsa3N8Q5hHfz3O23bcixebKXwG+ 1nOMY+4M9foAUtG/Z0vNO1u71k/EWe5jumdlgO/ageQScN9rbOMY+6OvfrQB9Ly6cJdA sNEGugPZQxRtOJfmdoovLLFfMzyeTyefzoA+atX/AGdr3VNVvb+P4hzQ/a7iSbylyfLE khbbkXgJC5xnA57UAdR4i/Ym1nV/DNpIvxPvbcTRRSBxbydH2N97+0Fz1xnvk+5oA880 H9jfWLbUvsCfFG9uZYVZSojk3HA5JUX7kfnx1yelAHZXH7M2qeDwdUn8f3dxsIiML705 foSTdtg/hmgD23w3pgs9HsrVtf8ANeKPaWMpJP8A5FzigDxzUvg5c+KvFd/KPGstnHcu 0gHzsF46f8fSfjkDjt0oA0B8MLmA/wBgjxfMRbYAut7AvjuV88/j8x4xQB3+leCpbW1g sx4laeWJcFg/zNjvjzSaAPPfF/wQvtb+0Sf8JpPYLNIHDfNhcc7c/aV6nPf8e1AHuui/ De5HgDSfDv8AwkUshtogv9oZb99gH5secfXP3z+dAHn3iLw7cWmnz+GBrsrOu3/ShIwb llm+6JCe+OpoA+f7v9m3UdX1R9YPxHubUSYzaEv8uE2feN6vXGfuDr35BAPQbH9lHV73 SUKfEK88t84nEchXhiD84veemPr+AoA8d8R/s3atNq8/hf8A4WJdxE7c3XznHyLL9z7a D145bpz94YoA+kPBngOfwB4EtNAn8Uyam1l5mbyRmQyeZcNLyDPJjG/A+Y9MnrigCj4S 8BPY+P7bx4/i5p4E350tpCYjmB4OpnPc+Z/q+ozn+KgDS+IPhiXxprV6IPEL6bHd+XtM blhHsjjzgCWPOdnqOW/u9QDo/A3wbu9Igs538WzXax+Z8x3DduMg/wCfh+m7HU/ligDi fHXwUvvGXjiOwg8ZXFh9tjjhUpvYoQM5x9pTP6ce9AHO65+x3q2i+b5nxMu3ESByWR04 Pr/p5HU++O4oAq6X+z5dy2X9iL8QJnmuWZVlBYuCevyi6LHB9+eucUAfXPwU+CN94E02 wFz4muNUNpdyTnzI3HmA5+U5nk79c9evbkA+pKACgAoAKACgAoAKACgAoAKACgAoAKAC gDyT4sWT3un2EaTtAfNlBZQSTlMdiOmc0AfEd78L7nS7ue+bxBLKLmcyeWdwCZYnH+uO ffpQB6n4V0mDXEksBqaxtb26xlw29iSChJG8Y9RyaAOS1P8AYp1DWLs6jH8QriIS3BvP KS0YhQz+YEyL4ZA6ZwPoOlAHoXi/SZ/CmiaPpZuHu2gRLAzHKljEgiMhALYJ6kZP170A Zng/4PXWlXFxrD6/NKNSjE/ksjDyt/z7c+cQcdjgetAGT8SvhdN8VLay0m38SvpTaPO0 jSJukMuDtwQJoyvqeW/xAPPNb/Z6utB0+3aXxTNcYKRHfGwB+Ukt/wAfDDJKgj2P1oAy F+GK6NCt5J4oDCVdnlsdoUt83/Pb2/lQBUsvBPl3j3K+IzL5hLbPMJABcN083j9eaAPp TUfHCz+EdJ8POgg/s2K3j+2Ncf6/yYDHnBUfe6/ePPNAHz1468Dz+OLOO2tNcltGFytw XhLO2AHGPlkXj5+vPPHOeABk3w/m8O6LYK3iB7mREihdeQ2QmCWHnMeo6HoOMnrQB0fh r4OS6pIbv/hKnzcQmXycFtm9lbGPPHIzz6nnHFAFgfBW60/UJpn8TyspkYAOrBeZAwxm bHOD65ODQB9XmIX3g7SvD4ufLa0s7aE3Yfc0hiSMbiuRjdtyfmPJP4gHivhLw3H4I+Id 34nm1xb9Ss0X2B2CAeZ3JMj8j/doA2PiR4NbxzZXN5BqxshfXCTrHGDIqDHIGHT69KAP mq7+G17oE0kn9uTziMlNuGXP4eaRx1oA6SPwHMNOi1L+3WjeUcpnBGcdW83PzfQUAJae ApbqXMmuNErZJmY8E/7xlGfzoA1fhz8Opbrx7JayeIG8gRSESsC0Zx0xmbHP1P1NAG38 Y/BW7SLvS4Nc2NFcoBPGDlsemJhkE/7X50AdX4dvRpfw60bSHu/NltIQhuC+134PJ+Zu ufU+vUUAeNfZrjVvGggNzIkUmczEllGIc9SRnp69fegDtLr4Bza3M2oJ4rkt1mxiJVO1 do2cYnHXbk8Dr+NAHuHh2CHRPCMHw8a/S4uId2b8yDzjula65TcW6MV/1n+FAHi3jD4L yC/ufEa+Inz8mIdhA6JHyfNz3z09R0oA8x1bw7NqVnL4cGqvE0mP9IyWxhxJ93zB6bfv +3XigDmdJ+EVzpt9FcHxRLL5ef3WGXOVI/5+D6+ntQB2x8GSr8x1hx/tEnPp18zNAHsn g5S9ha+HPtZIO/N5vJPV5eEzn/Z+90x25oA9E0X4KTXPiGx8U/8ACQPstZQfs/klt2wc jf53HPT5T1oA6zxv8H5/FsN5EmvSWf2mERAiFm2kc7uJl/mM9c0AeOeF/wBk298PeLNL 8SP41nuk0+YStaNaMFlA7FzdnGep+RvxoA+ytPs/sNuIN/mYYndjb1OemTQBdoAKACgA oAKACgAoAKACgAoAKACgAoAKAPJPizevZadYukDTkyzZCk5GEyOx64oA/PLxB8Rb+7ur m0TSLgeXcSR7gzt/EVzjZx1+p6UAZ/hG11LwZfXGsGe4vP7WKsbc7k8jc2/G4M+cEkHI X25oA+ydO+MMuiWNrIdIkuDNbxphp2XHyjnmNs8/jjmgCpa60fiTcSxPbGwFmxucsfN3 Fmzt6JjGDz3oAm8W+PJvCNlZwLp73XnN9kDAlNvGzf8AcbOM7scfWgDltN8NXvhZ28Rf aJ7v+3R54tSGHkeb+827tzZxn+6M/rQBsazfSeMrSPSlRrR4CJWkB3k7QUYYwuDls5z2 +tAHzd8T/g5qV3pqNHrtzDuuw42RtxlZOP8AXDpnA9FyPqAef+HfhvqehypLJq1zcjy1 jw0bKCcrzuMrZyAccdMUAeu+JPBF74p8PWOnx3c9m0HlyGdY2cvtjK4wHTrnOcnmgDI8 P/bfh+5eVJtS2Qm0+cFATwd/PmY+4R1J+br6gHOaadQ8Z+ItRiaO5s42ea4Unc6gGXAU AbegftxxwMUAely2mofC21h19ftGrfa9lr9lG5NgkUyb8/vOnl45UHBOT2IA7xD47vNV 0eznGmzW7StFK2HbILxlipOwZx0/KgDufhz4vvPEd3baK9nNB5cQTzi5bOyMksRsB52n v6kmgDzfxx4B1KDxNquqrqN0UlnOIQr4G7pzvx7/AMqAOhtPHV34f0S1s2sZbprVVQky EFvcgq2PXvQB1sWjS+LNMh1Is1qb1fN8ooX25465XP8AnrQB5d/Yd7q3iC58LiaaBYGY i4Ckg7P9jcMf99GgDrPiD8Pr7S/AETQXs8lwkkSkxxMGIJ5OVcnpQB5F4f13UNBSBGt7 iSaBCjSEsjk85ydpb29+9AG94ebUPiN4kk0CZLmwSVXm+1Pvdfk5xzszn3bJoA6/VfAd 3YpJpQvZnW2bb5uxsN1/28fU5P6UAbVp4RNn4fSRrgl1z+9KFW5kI+/u3Dg4688GgDJT xrd6ef8AhHUtZplT/l5WQktn950Ck8Dj733uOlAHDtNf6T4pPiwy3EqRf8uRLBTui8nu T2YHlfU+9AHSav8AFO+1awltRpU8ay7f3gkLAYYH/nkO4PfrQBxXhy1u9c8RwRuZbcTb /mIJA2xt2464z9T/AHqAPebP4LXN3OuojWZQrZ+QQk9Bt+95ntn7vU+tAHaD9nqbVbDc PELweb2NsSRtbv8Avlz09u/UdQDe8N/AKbQbi3nbxC8/k78r9nKk7gw6+c2MFs9+npxQ B77oWlHR7FbRpjOQ7PvI2/ePTqaANmgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAo AyNX0lNViSJ3VAhY5ZN/3hj1H86APJoPg1ZxXNzcNdQP9oZ22m0X5dxJ67+evX15680A UZPgfBJIXOqJ94sF+yDC85wP3uP0oA0r34QR3cEMP9pKnlADP2bOQPbzB396ANHw58L1 0CaeVdREvnIF4t9uMH/roc0AWPEPw1h12O3Rr1I/Il8zm3Dbsc934+vv3oA7G48PxXGn WdgXRfskKRB/KDbtqBc43fj1oA4fSfhgum6jcXp1ISifzPk+z4C73Df89D6elAFzX/h1 HrVsluL1YSsgfd9n3dAw6eYP7xoAwLj4QQS2sMH9oxxmMrmQ2w+faMEYMnegDsLLwPBa 2kFt9ojfyokTf5A52qBn759PWgDl9Y+E1tqe7N9FDulLljbKc53Ej/WDrn/PSgBvh34S 2miXj3SX8MzPGUIW1VTyysSSJCTyB/k0AdLqXgK31GERSTRFQ27DW4IzgjPLe/8AnqAD l9Q+EFvewrCL2OIKwORag8AEYx5g9aANLwh8MIfC2pjUFvEuMKRsFuE5KsvXe3rn8Peg Dota8HQ6sZmMsaGVw+DCDj8dwzQB53d/BOG6meU6mih2zs+yg4/HzRmgDutL8CxadY29 mLpX8lNu7yMZ/DeaAMW1+F0Ftrs2s/bUJl3fu/s/I3d93mZOeePfvQB31zocF1pqadL5 bKm07miDA7Tn7pP9aAPJdS+CtrfXs90uoRRiVtwQWg+Uen+tFAHQaJ8MbbRnjkjuYjIi FDItsFY56n75PP1oA273wVFdxFDcoCTkkwAk9e+/1OaAMXV/hqupaLLpa6gIXk24lEGS MSBz/wAtB1x69/woA5TSvgfFp7RPJqqzsm7dutRls5xyZSeM+vv3NABrHwPi1QTAaqsQ k24X7KDjGM8+aCc49eh/CgCa0+Cdtb6Umnm/jZ1z+/NqM8uW6eYe3HJPTPWgB1j8FYbG 5S4XU0JTPAtdpOQR180kdaAPYtG0tdKsIrMsJjHu+cqATlifU+vrQBrAAcDj6UAFABQA UAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFAHnPxE8czeB7G2vIdMk1MzvKpjRyhX y035JEcnXp0oA+Q/DP7aOs6/rOs6XJ8Ob21XS3lVZ3uZCJ9jlQQDZLjOMn5j65oA7Lwx +1VqfiC/vbOTwNd2gtScSNcOd+Gx0NmuM/Vvx60AbPjv9pXUfCFjZXcXgy5v2unKlFnd Cny7s/8AHrJn8h65PSgDx+2/bh1ueWVG+Gl8ojzgm6kAOP8AtwP+fWgDQ0f9tXWdTmuY n+HF9D5KlgxuJCGxngf6Ev8AM8UAY8n7c+uJctb/APCs78gTeVv+0yY+9t3f8eHTv1oA 9S139qfU9I0Sy1ZfA93cPdJGxgFw6sheNnOT9kbptwflHWgDy/Q/259b1fVbvTn+GN/A tuJGEzXUpV9jAYH+gL1znr/9cAyZv239c1fU7jRv+Fa6hbrbTNi5+1SkPscx9PsA4IOf vGgD6qt/jNeReFNH1n/hHZ2kvLW2drcyPuQyQeaQW8nJIPB+Uc0AeNWP7U+reJ9f1Dw6 /gi9so9PeVlvDNIyzGF/LwB9lT72dw+c8A9eoAPQ/BPxf1C/1m6tZdAuY1it5GDs74ba 6DoYRyc9cn8eaAOS8e/tXar4Oa4EPgW71DybuS2Gyd1LBC438WkmB8vv1HJzmgDynSv2 9tb1G+ms2+F99EIgx3m8k52tjp/Z/B9fegDp/wDhtbWf+icXv/gXJ/8AIFAHtmk/H++1 LQLLWW8KXET3aKxgM7kpu7bvsy59PuDPtjJAOG0H9qzVNX8bXPhV/A13BDAsjC9adyrb R2X7IOvrvP0NAFX4iftaar4JtLq6g8BXmpGCdYRHHcSKzBj944s5MY79cZBzQB5fbft6 a9cQxzH4XX6FxnabqU4/8p9AHGaj/wAFHfEVjeTWo+EOpSiJtu8XsoDe4H9mHj8T9aAN rSv+ChOv6kUDfCfUId6lsm8lbGOxzpq80AfaHgv4w3firw1peuy+HprGTUIBK1s8jM0R J6FjCmfrtH0oA2fD/wATLnWvEsmgvostuiBj9qZ2IOCo+6YgP4v7x6UAYPxP+Mt38P49 ReDw5Nqv2Hydvlysnm+aYwcEQSYx5meh6Y96APn20/bO1i5mER+HV6m7+I3UhxgE9PsI znGOvegD3r4d/Gy88cX9hZz+Gp9MF5526R5Xby/LSRhkGBM5246jrQB9CUAFABQAUAFA BQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAISB1IH1OP50ARywQzgCaKOUDkB1D Dn0zmgDPTQtGjZnj0yyVnzuZbeMFsnJyduTk9aAJF0rS4SWSxtIy3UiGNSf0oAfLpmnT gCWytpFHQNEhA/SgCoND0JSSNN08E9cQRD8+KAHpoWjJkppdiu7ri3j5z/wGgBp8PaGT k6VYZ65+zx/4UAWG0nTHUI1hasqjAUwoQAOnb/P40AQLoGiIxZdKsFZs5ItosnPXPy80 AA8P6IGLjSrAOerC2jBPfrt9aALv2Gz2CP7LBsXhU8tdoxwMDGOlAFdNG0qNzImn2iyN 95xAgY565OKAJk0+xjYvHaQIx4LLGoJ/ECgCGXR9KnyZtPtJCSSS8KEknqckdaAMSz8G aJaXs94thYnzt/yC0jUjc27lup/HrQBsf2Ho/wD0DLL/AL8R/wDxNAFldPsUQItpbhB0 URJj+VAESaRpccpnTT7RZjnMggTec9ecUAJNo+lXAIn0+0lBOSHgjYE+vIoAg/4R3Qh0 0mw/8Bo/8KAIz4Y8PE5Oi6cSe5tYv/iaAHDw3oC9NH04fS1iH67aANKOytIUWOK2hjjU YVFjUKB7DFADktbaN/MSCJX/AL6oobn3xmgBs1naXOfPtoZt33vMjVs46ZyDmgCoNE0c dNNsv/AeP/4mgC1DY2duVaG1giZc7THGqkZznBA75oAtUAFABQAUAFABQAUAFABQAUAF ABQAUAFABQAUAFABQAUAFABQBHK/lRSSY3bEZ8ZxnaCcZ560AfKPxH+Ol/oMMBi8L3Vy Vmcfu5JATtGT0hbr+nX2oA+aZv8AgoLr1nO9mfhTqD+RIYBIbyUb9jbd2P7OPXr1oA9q 8Gfta6p4qEpl8B3dl5dsJxuuZH3Eru282afnk/1oA8h+I37cWu6G8MMPw01C523jwlku pRkKwG4gWDcH6n696APefhL+0xqXxEE0Nx4MutJNvYx3AaSd5N5cfcwbWLBB92z0wOpA OL+I/wC0Rq3gxkmg8J3uo+ddyxlUkkXaFY85FvJ1PHsPegCDwh+2PrOvNNby/D29tvs0 KkO1xIQ/sM2S8/ieKAH67+2XrGkmEJ8O72fzZvKJFxIMZONx/wBCbj8qAPpH4afFa68e zxwz6FNpYewF4WkkZsMTGNhBij5+cnr2PFAHtVABQAUAFABQAUAFABQAUAFABQAUAFAB QAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQBTl0 6wmGJbO2kA5w8KN169RQBzmq+EPD94I9+n6bAQ5bc1pCd5645A/H1z3oA07fT9BtkWOO DTl2qEJVIRkAY5oAjl0nwzN/rbLSpOc/NHAefXmgC1b2mi22fs0FhFxg+UsS8e+O1AFa WLw3cnZMmmTFTna4hYg9D15zQBPFo+hx/NFp9gu4dUiiGR9QKAGSaZ4fb/W2WmnBP3oo evfkigDQgt7KDDW8VvF8oUGNUX5eMDI7dKAGnUbAOyG8tw6khlMqZBHXIzQBMLm3IBE0 ZB5BDqc/rQAkt3bQKHmnijQnAZ3UAn6k0AVv7X0snA1C0JHUeemf/QqALIu7YqGFxEVb kN5i4OeeDmgBFvbRmKrcwsw6gSKT/OgAa9tF+9cwrzjmRRz+dAE4dWUOGUqwBDAjBB5B B96AIjdW6khp4gQcEGRQQffmgBPtdr/z8Q/9/F/xoAb9us84+1QZ9PNT/GgCbzotu/zE 2nkNvGDn3zQBGbu2HW4hz7yL/jQAfa7X/n4h/wC/i/40AH2u1/5+If8Av4v+NAEnnRFd /mIVPRtwwfxzQBG95axqXkuIkUdWZ1AH45oAYL+yZd4uoCv94Spj+f8AnrQA8Xdsy7hc RFf7wkXHXHXPrQAgvbQtsFzCW/uiRSfyzQA43VsDg3EQPvIuf50AO8+Hbv8ANj2f3t67 euOuaADz4du/zY9n97eu3rjrmgCL7dZ7tv2qDd6eamf50ATpLHIAUkRwehVgcnv0JoAf QAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAebfEeR47KzKuyZkkyVJHAXPOKAPiT xt4+k8NkSRO960s8iMiTtlMEnnG79aAMDQfijdavNJHPDNaKgUh5J3w2TzjIGeOevvQB 6rc+JRoVnHdJe/bWu4TmNZ8GIlc9QX6Z64FAHgnhjxDqms6/qgR7vatyz4SWR8Bpjngd iPX+ZoA+6V1pdO0fTXmmG57WNW3yYORGOuTnPX3zx1oA81k1ldcuZYo73yPIlZ8rPv3D d0OCMfj39TxQB3cXiu3ht0ga4QtHEIy3mjJIXBPXrmgD54v9Lu5de1HUU1WZo7m5mkWJ ZHIXfKXA4c9On3ee/NAHqngzUtQ1S4GlSRXMaWluMXDM5EgjKJkHHfOeT06880ARfGRi fDdrbx6gYZY7tAzLKVbIjlUg/MD378g4BxmgD5m0LwhrN3fvKms30iyDeAplcYLDsJPf r0HSgD7Au/C0un+D9GkfWX80w2ysGJDhvI5BzJkHI5B70AeVWl7LoGoXV3LfPKreZGN8 xRTlt2csSD933/I0AcJd+NbnWdTuLOB5VEdwz7knZ8gPt6YAxhux46daAPraPxg1j4L0 hTbtLJFZWqk+ad7ERxgk/KT0yT+vNAHzBrHxFuLjxFfQFJYV3sR++YbfQY2gZ9u9AHoe gQJrMUMj62IDKjOUMuSpBGB/rAT+PP1oA4LxTezeF7q6vU1CS7RJfLAEzAMH753MPyHN AHdT/Er7H4Hsb+NDPMwTMSzneMnk7tpJ/EUAeUzfETWbyV7iPTb7ZIcja0rD8wmPyoA6 2LVNXk02G/8AJvQZRkx/veM8DnGTz0OOaAMm+8TazaQGVbS/kOQMDzR9f4T/AJ9aAPc/ DutX2o+GtPZ7e5ikeIMd2/cDyOpAJ+pGfxoA8i+J/iXWLbS9R06CyvpHXycSRtKCcvG/ ZT29/wCooA4fw7quu3Ph2CKSDUUkbdkt5xIxKzDqAOevSgD0q01fVbfw8lu1veuVz+8J lzzKT/dJ6kjr7dOaAMM6hrGmf8VAIr6Zo+ltmUZz+6+8QR3HXPfHODQA3SPFms+Jtbjt Hsb6zFzn94TKwXZGzdNqg52+o6/jQB3PizxZqXhvwxdWcdjd3ktvs/fKZAX3zKegVjwG I+9+ZoA0/Ceuaj4k8FWxkt7qzlud/wB7zC6bJ37kKeQv5c9TQB594ig1fQ5p75Hvrkw7 f3Y80btwVOoLAY3f5PNAHs/wf8QX2o2lgbm1uIS906t5u88cjJLAfl2/GgD6coAKACgA oAKACgAoAKACgAoAKACgAoAKACgAoAKAOE8d6cdRsYY1YqQZeQCfvRkZ/OgD897H4GX0 mv6zdTarPIk91NKsb2zFU3SFsKTMc9cAge+OaANnxT8H7iW0tYoLuWJkJDNHbMpbAwM7 Wz155/nQBy/hj4FanFc3by61dSLIvyq9vJhcntmY/THXvQB7t8JfhSfB2p6reT3BvRex BQr25XYSxOQSzZP5fWgDQ+KfhG81K0skguJ4sTscRo5wCMdFIxj9elAHmegfBzUdMlnu m1e5l+1JnYYX+Qsc9fMOaAINT+FWp2uZxql1IHlPyiKTjOT0EhP+cUAdtofgO7tYoHku ZnJjTO6FiScLnPzZySMnPOeTQB9j+HLCC20XTkEMYlFlDG8nlqGY+WoJbjPXrQB8efF7 4WXmqXF5dJqdwFn1SWYRLG7Kis8jbRtfoMgAgfTigDvvhToR8Mi3aeI3mNPSDEkWw7sR /OSdxJypzn6d8gAu+OfDlzrMbNFPNArXPnLGqswVTvIUAEAAZxx+HAzQB8y/EbwXqOs6 ZFpsU11btb3QzOkLsX2rIvI3L1znO6gCTwf8JbvwokGry3k9611bpGYmt3BHmbH3HLvy MEHjqeuaAPqTTNAkm02zLFwDBGdjKTg7Rxg9MUAeGeJPg9PqGuX18l9JF50pYKtuTgEe okH8qAONm+DGq6ZK9/HrV44JIESxSKBn6Sn+VAHcv8DbrxF4ft4ptZmheUCRmaBmbIOO f3it09Tk980AZdn8FLzSJBbPqs1zFCCgDQNtI7HHmNQB9o+CPD9jY+GNKtZbS3lkitwr O8KhmOe4OTn8TQB2H2CyChfssG0dB5SY/lQA06dYMMNZ2xHoYkP9KAJVtLZFCpBEqjoA igD9KAI5NPsZc+ZaW8meu+JGzj1yKAEXTdPQbVsrZQOgEKAfyoAf9is9u37NBt9PLTH8 qAENhZMuw2sBX+6Ykx/KgBqabp8bB0s7dGHRliQEfjigB8ljZyqVktYHU9Q8aMDj1yKA Fjs7WJQkdvCiDOFWNQoycnAA9aAB7K0kBEltC4PUNGpz+lACxWltBgQwRRYORsRVwT3G BQBYoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAIZpoIQDPJHGCTgyMqgnvgtQBk x6p4ekZ1jvdNZ1zvCyw7hg87sHPXrmgCaO70W4JWOexlZeoV4mx+poASe90OzAa4uNPt wxwDJJCm4/iRmgBE1XQvvJfafyOomiGR19fxoAhk1zw43EupaYcHo88PX8TQAq6v4dfh L/TW+k0R69O/5UAXwdPdQR9ldTyD+7YH3FAES3Oks7RJNZF0yGQPFuXBwQRnjFAD31PT YBiS9tY1HHzTIAPbrQBWXV9CumMa3+nzspJZRNC5BHUkZ9+T70AINX0BHKC/05XXgqJo gRjtjNAE8eoaTdHZFdWc7DnakkbH64BoAZLLooyJXsOvO8xZz3znvQA5ptISNWaSyWPj aS0W32x6UAVv+Eg8Oq3lf2ppoZeNnnwgjHbGeKAL0MunXQDwyWswcFgyNG24dzwaAK7X uiec1s1zYeehO+Fni3gjrlSc0ASPqWkW6BpLuyijGAC0kSqPQdaAIV1TQZTlb3T3J5yJ YjnP40AWP7T0uKMMb20SMdD5yBRz259aAGxa1pM8nlQ6jZySddiTxs35BqAJJdV02BS8 19axqDgs8yAZ+pNAFMeJfD5baNY08t6faos/+hUAXl1Kwki89Ly3aE/8tRKpTrj72cda AIv7Z0rOP7RtN3p56Z/9C/H6c9KAGPrmjp9/U7JfXNxGP/Zv89aALMeo2MsQmju7d4j0 kWVSh5x97OOtACm/slXebqAL/eMqY/n/AJ60AQHWdKX72o2YPvPHn1/vf5/GgCE+INDU 4Oq2IPvcx/8AxVAGlBcwXUSzW00c8TZ2yRsHQ4ODhhkdaAJqACgAoAKACgAoAKACgAoA KACgAoAKACgAoAKACgAoA8h+Lfh4+IdNsbcakdN2STfvAcFt6bf76dM569e9AHxh4H/Z ck0/Xdd1CX4otKNQaV1hkyBBvctgbr7kgHBwB06AUAes+Cf2fIvCuo6jey/EdL4XoIEb 4UR/MW+8b193X0X1z2oA5r42fs/p440/Sra1+I66a1pdNKzxHcXBHQ7bxCB785/mAcd4 b/Zi8pDFN8USu2BYw8hIDnbjI/04nOeeex55oAw9T/Yjn1mSR7f4xyAq7zFY0L4ByQON SHGelAGFpH7MV3pl28V18S5tlu6ory7lEhjYZI3XuPmwc9fy5IB9seHNDtPsNrpr+I4f 9Fso4vtDTA+YY0C7sGXqcZ6nrwTQB53oXwlt18X6xf8A/CdI4uZLhxD5m4IJJg+B/pHG OgyB159CAJ4z/Z+j8T25t0+IqWJ84y7lwzc7xtI+2Ier+vbpQB5f4U/ZRn8Dazea63xP k1dLxJIRa7Soj8xlcOCb6QHAXj5RwSc4FAGfb/spXeua/qN2nxMlhFy8s4hAZ/LDuWCc 3yDjdgY7dqAOh0H4UXPwg1G41i58Wy6ykqPZLFKWhXLMsgkDG4mHPlcDHG7GcmgDK1qP +1p5JY9cMBmuDLgXBIG9idv319ecfQcdQDv9U8BXV74Y03b4gmi3xwnzCzbTmAjIPmjP X16+2aAPm+x/Y2uNR8R3usyfF+W2F9PNc/ZnVsQ+azN5e46iAdu7H3RkjpQB9v8Aw7+G +n+B9M020ufHNvqH2G3MJmkdVEhPAY5uXAP/AAI8980AeXXPwAsrn4iar4zX4oQrDqEj uunB1KRbhgAMLzB/79j060AXPGH7P9v4r0htLt/iVHaSPIr+ajBmwvUY+2J/6FQBznhn 9kK+0yaKZPiVPfYjYBViY7gerZF8+cfT8fUA7zXv2YdS1nRhpa+Nbq3cMG84QOx47Y+1 L/6F+dAHMeB/2QtW8J+JP7cm+IF5fRiKSP7O1vIq/P3yb18Y9Npz6jrQB1fjz9mXUvF+ nTWUPjS6sGlmWQSJC7EAcY4uk/PI+lAHzjD/AME8/EEWry6mfizqJEhz5P2SXA5HRv7S Pp/d6EjigD6r0D9n2/0bwHD4PfxXcXE0O7N+0Th23XBn5X7Qx4B2j950+nIB57/wyPq3 9s/2r/wn15j/AJ9/s8m37mz7323/AIF93368UAYuv/sZaxrM08yfES9t/O2/IttIdu0B eD9uXrjJ47+tAHs3hT4C33h3wTbeFJPFNxdywbs3zROGfdO03K/aGPAO3754FAE958Cb 250trAeKLhHP/LQRP/z0D9PtA9MdffrxQB5F4i/ZQ1aaC4uF8d3i52fIsEmeq9MXY7jn 8/oAeXJ+xnr2p3wUfEPUIRLn/lhKduAT/wA/oHJ9/wBaAPvT4TeBJ/hx4K0zwpc6pJrE th526+lUo8vmzyTDKmSUjaJNo+c8AUAelUAFABQAUAFABQAUAFABQAUAFABQAUAFABQA UAFABQB5r8SfBh8Y2FrbjVf7KNu8r+ZjPmbkxt5kj6depoA+ItG/ZykvdZ1cSfEVrYed KRuBA5cjAzdgnnj6UAbtv+yqtnJLK/xWDCbONw24z7/b2J59h+fFAFQ/sgyTu8kfxVaT JL4Ee7jOf+gh0zQByPiv9ma/eG1t4/H9xH5UuwyKrfPj5c8Xf49fzoA9D+Hn7MDeFnmv Lj4m/bPtlug8qQ7fLJ5PW+fkfh3oA0PHP7Nlr4vgtILf4lQ2DWs3mO0YVmftg4vE/UnP X3oAz4v2YIba3ijf4qINiLHubC7iBgH/AI/epx6mgCv4f/ZMk0zVrnVF+KDXS3SviML8 qiRg+Q325s4xgHHIP40AQeJ/2aNkZmPxO2lp87c42/e4P+mjA56Z/lyAbfh/4PmyjihX xmbzy4FjJVslgABu/wCPhs5xn3Oee9AHWeHfgZDo2p3Gr3Hj9Ct2j4t348tndXxk3RyR tx0GRzQBrfEf4N6f430C10lfHNtYG2mSc3A2SGTZHIhGPtUeCxcNkselAHy7of7MUmp6 9d6Y/jswQ2bOUuzDlJ/KkC8ZvFHz53cMf1oA+y7r4bacfCGkeHH8W20b6bbwQNeNsBl8 mDyixHn8bj82NzY9+TQB81a9+ybBq11dXEXxajthcTSShEUfJvcttBGoDgZx0+nFAGJf fsYtqenrYRfGMrJkHeiFm46/8xIE/wBaAOW079gW90/UWv2+NU0qkEeWYmVfm9zqh/8A QetAGzp/7Lsmiaq+fik115YZdm4gnPQ4+3NjHc84zQB9nfC3wPB4WTT5W8Tx6o8Ns8Rh Ljcc/wARBmfBHXvjPegD3CS/sogWluoIwDgl5UXn8TQAn9o2OwSfbLfYej+amD+OaAOJ 1f4h6VpryxJNaTvE4XAu0DHPfbgn/OaALOk+OtK1Ixq9xaQF1LEm6Q45+g+nXmgDqI9X 0uZwkWoWkjnoqTIzH8AaAHzanp9uCZ722iA6l5UXH1yaAFj1KwljEsd5bPGejrMhU/jm gDFk8V6XFqBsZLq0RR1ma5QD7uen1460AbUepWEsYljvLZ4z0dZkKn8c0AYEvjDRY9TO my3tip7s91GG+5v5jPP+c+9AGxDq+jzMBDf2TsegSaMk+uMGgCLUtc0/TbaS5lurbEeM q06KDkgctk460AZumeKbfVZIltkjkjkYr50UwkXIGTyFwT688UAdXQAUAFABQAUAFABQ AUAFABQAUAFABQAUAFABQAUAeR/Fm3a40+wRbs2v76QFgcE5TA/iHTrQB8BfEH4dXD+T Pb+KJYzLcs7CItn5myQSJxn/ADmgDldR+D+raxbWSJ4uvIjHtYsjSHIwCc/6QMcc9+e9 AHp+ifD6+8KxRSS+Jp73zIY0ZGd1wVxk/wCubOeSf8aAO5j05tdT7MNSaMwIRu3lznpn 74xx3z9eaAPMtZ+FN7byNIPF1xi4lYBdzqF3k4A/f9s56dKAI7P9lTVismoH4g3hW5jM 4j2SHbuG/H/H4OO3H8qAPLZPgDrXim/uNGh8cX1u9lM7mVEkcusb7SMC7XrnPXtQB7Vb fD7VfA+kWML69d6i0EUVozHzELsqAGQ5lc5JTOCe/JyKAOc134J3/iiBLk+Nbix+0y/a PLO5thfJCc3KdA2M9/TJFAHrfgP4IXXhuOK5l8WTXymyEYDK2PuodwzO3Py+vrnnqAeK +O/A1/4k1O+0uLxLcWP2a+lcSq7/ADBZJF2485MA545PAycnkAHJ678KdUj0mzh/4S68 XyXiBl3SDftU563Aznr95u/U4JAPXLTTC3hzS9LXWCs9rbQo9yJD5kpji2FmxJuyzckl jz15zQBzR+FWp/EKZ9Fj8U3em/Z2M/2kM8gcIQm0ATocHfnqemevQA623/YZ1u4hilHx Pvh5iB9ot5D1Gf8AoIZoA4q5/Z61v4eapcXZ8aX2qm1YwGDZIm4t/Fj7VJgjPoc+tAHX L8OrvVdPjeTxXNZvJgsjO25SOxJnU8n2oA4Kb4GXWnajLrH/AAnkswkJHkbiMbuvzfam /l/hQB798NvhPdaNdWniF/FE14ktuw+zkvsO/qQ3nNn/AL55oAp/EPTbjV2vdLi1Wa2I nDCVZH/h7YDjvmgDE0HSLvWLeDwm+szW5t0yb5pGO/YcjgyAf+PcfXNAHn1t8AL298cX 3/FazlHMh2fMwHHTH2n86AK3in4A6rpBnuYvGF3IokwI1icY4LcMLrHUen05oA3fhp8M rvQdX0/xFdeLppzB5u6wlLKx3JJHyTctj7277h49xQB3HjTwlN8Qbq80O38RSadJfeXt njlZ2j8pVkOFEqH5hGR1HDZ69QDYg+HV38P/AAILOXxFPqMllnMrF0MnmXG7vNIfl3+/ AoA8K17wDfeLYppofEtxZtc7cRo7sU27QcATIedpP4+nBAOu8LwXPhnR7bwpcaxLcSwb 913JMys26RpRlTI3TcAOefbOAAeNeNPgxqWueIbvxLb+NbqFJtm20jLtjbEsRwwuV67S T8vXjpzQB6x8J/gvqNjfabqk/jG5m2edut3D5OUlQZY3Ldufue3XBoA+jfFH7PF/450O 4gh8X3Fh9t2YkWJ5GTy2U/8APymc7Mde5oA9M+DXwhuPhd4cttEuddk1qWC6luDcywlG YSdFOZpen+8c+1AHudABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQB5H8WvDJ8Sad YxC9Nn5Esr7gMlvk6feH+etAHw3qHghkvJkk1cnZO4XcT2btmT6UAXb65k8MQQOu6884 eVxlccY3fxdT/jmgBbKOfU2Z5JXhDrvAZsgF+w5HQ5+v1oA0NF0VtHuLiaW+Li5JUbiV AySOu455Pbp196APU7X4IP4qWOaLxE0G1Uudoi8zhsNt/wBcv5nPHvzQB0muRjwtY2lo 919oIAsy7PsyVUpuxk9+cZPpnvQByOh+E/8AhDL2bxOLk6n/AGmj/wCihcGPz2Wbdu3S Zx5eM7B1680AZGq+KF1Wea3mtBbBZXcM7ZA5YbcFQMjJHrQByWkeGH8aapPp0OpNaCHd NuTLg7WC7Qu9BjDdjjj2oA9R8WXr/Dzw3YHzGv3TyrMkuUJ/ct85Hz/3OeScnr1oA+dU 0uXxDqNxqH2prY3bvdbSdwUyPv2/eXpnH4dKANfV9Cm8RafDoq3ElubMqTchSxlEalDw DwGyCeevfmgDj9K8Cz29/LDJrDhUyo3ghchsdDJwSefbGPagD6d8L+DR4etrbVF1ETtP bRqVxj7yq+c7z2U/iTQB3Fj8Tf7GmKNZGfyQYyTPtDBQVyPkIGeo5OO3FAHN2V4nivxT dXJURi7Mkvk7vM29PYehPT8aAPKPHvwuurq9v7iLWJrcPcZESIw2j0yJAe/9360AeT+I /hjdaHow1Q+IppmLqvkEMD83fmZj+YzQB7F4E8WzWehaZpskTv5FuF89pSN2DycFTj8+ /egDu/8AhX3/AAkH/E3/ALV8g3n7wxbd2w+m7eM/WgDyy90p9P1u501bo5gbb9oB2lgA T2PGfY49aANrwj4fuLLxE2pm8klDo4wc/wAXJO4sc/rn1oA6nxNrflpJC8G/ZIQXLZzh euMHn/PFAHgVz4bu9Z199Qiv5raGXGIV3eWuI9vQOvXHPHcn3oA7Hwh4GutM8U2usPqk 0qR78xMGCHMTR9S5HBI6nqB3oA7rxjqc+rR3fh8JIkcnl/6VuJUYZH6YGckY4b1zQBxF n4Kk0K3XW21Jp1izm3K43biU67ywxuz06+1AGCvw4PjfXftK62dPN30iCljHsj7fvE6l Mn6/hQB0N98KpvCVu87a098ttjhoyC+/jk+Y3Tf+YoAt6LLNpYh1RGeTy92IAxAOcj3H U5/+vQB9ZeEPHOPDFrO9pl/nypl+b/WsOmz/AD196AKOsfGb+yzIP7H83Yob/j525J7f 6o49c/hQBykP7R0ElxHbyaOkbOcfNeDI98GH8Oo+tAC6p+0ULESGLQfP2LuBW7zk9/8A lienTv64oA9i+HHjU+O/DsetvZ/2e7zyxfZ2k3kbDwclUJz/ALv50Ad/QAUAFABQAUAF ABQAUAFABQAUAFABQAUAeT/Fa9ms9PsDFE8pkmkUhCQR8nB6GgD5Fn8FXHiO5leO9kg2 StOwVSx5Odpyy9TkfXk0AQa7p0ltBa20qNIIWWPeykbihwTz6jnrQBFqCMLezEalT8md ox3A5/CgDpNX8Cz6tp1nKL57cxxiY/u/vfLvxneOuMZ569KAKHw1+Md14e1TVNOfSZbs W6fYxI87IG8ttocbo269cA8fSgDJ+K3iK41aCyuI4pIc3T3BQOWxubdt6D3Ge9AFLw78 driHbYyaBJMtvbiESNMTuKbVDYMJ6gZx+vNAG54d05/i/rV3ppc6CFEl955TzN37wLsx mHr5uc5/h6dwAe/+AvgO/g7UptSbXzeiW2aML9n2/eZHznzn/u+nc89iAeO/FsS6k1zp W1wLPUXAk5IfyzKvTjGc56nOM+tAHhmp6lL4fs4Gjhedt6QkKSDjGCTgN6frQB7T4XvX TTrXUHs2P2i1RtrAjBdVb723n/PrQB5X4yknM886K8e+6Z8L2yXOP0/A8daAOj0j4iTX 1ja6MbZs2UKLvEuWPlqqZKhcjJIOCfXPzUAQa3rtwLUlLaQsTyRnJyR7H8T15z9QBvgf 4k3fhDW01ZtKlvQsTx+Sz7Qd/fd5bfyoA91sfFzeLrk3xsPspvA0xi379mOo+4ufrgUA eL/EnTbgJeTKZGBnT90AcD19vy69qAMDw5qE19Db6MbZoPKjybg9Tt6AjA9euTQB7HH4 lm0PTIIvJeVYRt3+YVDcdvlOOe1AHlR1G417xDc5gkgSRi/mkkrkD12jJ7Z//WQDt9D8 ZywX39hHTmcWylftO77+OM42ZH/fRoATxE73KSTeWy+Y5OME4yOmcD/69AGIbs6Vo32v yDIY/wCHBBOXC/ewTwT/ADFAHe6LetqvhWO7WExySZwgGWGJmU84DcgenSgDCvfELWsL WDWBZ16zE4Y8hhnKk9PegBbO1k15EtdzQ+dnjBbG3LdMjqR+dAGJq3h+48AmXxYtzJe/ YtuLIKYy/mYhPzbm6By33fvD34ALNt45l8ZaSscmnvafas7maQvs2OcZ+RSchc/jz3yA ef3njZtF1ZtBWwa4MOMTbjhtyB+mw9M/oT70AdZZfFe6s7ZbYaNKyrngSFRySenln1oA 9QttHbxf4DvvGbSmyeHen2ErvZvLOM78r1zj7vv9QD5S1bwRd6jr8WtJfSwLGqj7OIyV O338wde/ynn86APQvBWmzXvifS/Ds2/ZeThGuXXcq7uckE4/Xj3zQB+gPhTwSvhq3hgj vhOkUrSYWLYp3duHYe5/WgDv6ACgAoAKACgAoAKACgAoAKACgAoAKACgDhPHVx9nsoGE HnktJwF3EYQ89D3/AFoA+Hj8WL3wtqmoMPDc96s1xJEANygAOef9S3B/n1yKAHa98Vrv XrWDHhqW3Mf73oWzkZA/1I5HQ0AfPuv/AB91bRJ4I18F3dyGuhBnfJgAOPm/49jgd/XH egD6+fx7dXXhvSLoaHNE1xYwysmWypkhDFf9UDkZPYf0oA+bf+E5vbDUL+ZfDk7F5ZDk IwzhiQciM5yfWgDmIPi3qPiW7msW8MXMX2RyNxLNn59p48lcc+/t70AegzajPoVrDqK6 LJctcBVMQibcu8FifuEnBGPfNAGpY/Eu+0NUv4PDlwzyqqsse9HAbDHJEWcZX/PcA9h0 T9qbVGhism8E3WYYFXzTcOdxUBe9r1Ppk/WgDw74sfHvUdLtG1RfB9xcNd3xzEHbK+YJ XJJFsxPPsM9eDwQDzjwP4/1Lx3qMkM/hq5sUMJuwZFeRc7k+TmFOzn8sgAcUAfUN18Q7 jTNFsrFPD8khto44d+CuQiFMgeUeo5x64560AeI+M/Hl8tv548PTyeZP91QwI3BzyfJP HTPHX8KAPPvDGualpOqXGstot1KLuN8QFJPk8xhJ12HJBGM4HPbrQB6p4S8dXfijWDpU vhya1UM375gzj5VYnKmFe4/vHrnnrQB2OsXkumh9ukSSlGCn9ywz6/wEf54oA4Cz+Omp eGNYlC+ELm5SDdGMOyq2e4H2ZsA+2ee9AH0yJpPFngyx8Tvp7Wz6kEmazKl2i3HBBOxS TnqdoxQB4Ppfiq5u/GV14YXQZoVtt2L0K+H2cn5fKGM/75H1zQBo/GDxpe+EPBDXtvoc +oSw3EUXlJuV2Dnk8ROf0oA8v8N/HPUNT0iyt28FXNtK0Qdpizlsg85H2Zev1/U0Adlo vxLvVvhIfDM+7acsQwP4kxHOfzoAreLPjlfWdtIieEp5WjkI4Zsn5Sc/8e5/l/jQBU0z 4taj4k0SOxbwpc232jOZDubbtcn/AJ4L1Ix2/HuAe3+EPElxpWiWsj6TK5i3/IwYE7pG X7pQ+ue/b0zQBpauJNUspfEYsni8zH+i+USRhhFy2Ae2enfPTigD54uvjjqfhDxc9inh K6vY7bGJAzorb4c/8+7jjfz9C3+zQBtP8bdS8dXJ0aTwhc2MV51mZ3kVfLG/7htkByUx 98cHPU0Aa9xq1zoOktJHpUsxhxhFjZS25x0wp9T+FAE+leG7jVrSLxzJbyxmTdmwaBmY YYwcscHkDd93qf7tAFm9v5rWB5ho8jlcceSwzzjrsPrnp696APRPDHii6u/CkunjSZoR OzrwH2jJ6ldmCcZz70AeNXnjK9tviHp/gkaDO0V8YwdQ2Ntj8znO0xc4H+3zQB9e+D/h ckr2utG9EUkMx/dm2+b5ehDeYCM9P1oA99sLQ2UAhMhlIJO8jGcnPqf50AXaACgAoAKA CgAoAKACgAoAKACgAoAKACgDzf4j+NH8G2NrdJpTaqbh5U8sEjZtTdk4ST73ToKAPgbX P2obi01CaJfhtJOTdvGWyT/H97iyPc8+3I5oA9gs/iaLnToL0+EChltROY/L5UlN5XPk jvx0/CgDw7Sf2nDq2s6rp0/wtMS6ZLIEmcFhMY5CoIDWYAJAzkEnnqRwQDT1D9sXULlo dPHwvnRIJRAHDsVKhgmcCw6Y5xkgUAe36546i03QdL1ZPCyTyanbJK8AiG6EyxbypPks SVz6A0AfNWnfHSXQ9T1GcfD15RLJIOFK4wxOf+PMj3+v40ASv+1xctIYT8NZGCybMFiQ OcZI+xfienP4UAe33vxaFt4Y0vXx4KMj6hFBK1tsyYzND5pXP2fnGMdM5oA47R/2m2tr +dD8Ni+1XUZOOA2M4+x9T9eRzQBzOv8A7RsmpTSxt8NnK+ezYYkqDlhwfsR9fyyc5oA6 zw9+0QNKjjnj+HGXaBVIC7eNoOMi0y34ge4oA5jXv2rbi2mmkPw5lfdMw2FyQMk8j/Qs +/vyexoA6L4d/H5/HeqTadc/D9rGOK2a4E0ilgxV41282qDkPnOegJoAufE346DwBp0d 7B4CGplrsW3lIuzauJDuyLaQnGzuOc9u4Bxvg79rppb2OU/DQ27Ou4kvjkoT1NkO5PuP XNAHrHjH9pN7fwkmsJ4BMzSvH+5V93U4yCLU/hx1oA5DwH8eF8ZapFYz/D8WXmwtKZXG /BHYD7KhI/4FQB3Xir9p248E2Mlpb+BJNQWykWFIo5CuRnglRaSYxyT17c0AcNa/tTXE ePEH/CtJPOuBlodzAru6/P8AYj09Ng5zQBQk/acudcunS4+HEvlSkv5chaRFI5HBsgDg 9Dxz0xQB4837Zt1D4vvfDMfwemWKzZ1S9AYRyBR1C/2ft5zwA2D1oA968J/HR/EPkeZ4 BazM0ZkOUJ2kHp/x7L+tAHmtx+0bPD461HQn+G0ssFs7KLoqxSTkDO37GV7/AN7nHbuA dLN+0/JoNwZo/hi86w9I1BUNuX0+xMBjOe/ce9AFa8/a41C5ge9X4aXEStjFsHYgYx6W IP8AtdvyoA+nvCnxOfxF8LbbxHL4Za0ln37rJss6bbto+8CnnG/le4+pAPlfxz+0zJ4X 1a8s1+GL6ibfZi4CkNJuVWPIsnPG7HDdRz1wADp/Dn7UT6t4fgf/AIVe9o8m7J5MiYkb p/oSnnGefoOKAOW1f9qq+sbuW0/4VrPOiYw53fNlQTkfYyOM44PqDQB7x8L/ANoZ/E8G m2Evgg2AufOyjtkps8xuUNqnUr3Pf8KALfxb+O7eDtG1OaDwKdSa18nakeVaTzGizjba ueN56dxQBofAT41v8RNG0+W48GNopvL2WBklJbywv8Z3W0XXHfp+NAH0rN4X06bVY9Ua 3tvOixj/AEdN/Ho/XrQB0aqqDaqhR6AYHPWgB1ABQAUAFABQAUAFABQAUAFABQAUAFAB QAUAeZ/Evxj/AMIfp9rdf2P/AGv57TL5f/PPZGWz/q5PvdOg/GgD887f9sWW11rVrZ/h A8wguZY1kYth9shG4Z09uvXg/iaAOz0/9tG7un8s/CiWNQAB+8IGM4wP+Jfjp2oA2PEv 7RqW9nZ3cXwzUPP+8fyx8xJAYhiLLn6nvQBxq/tjlCsP/CnclSI9+eSc43f8g7r3oA+h vh78Wm8Ri5lufCLQILRblIpQWCZUt5YBgX12/XtQBk+GPj1B4j1nW9Jk+HSWw015Y1uG w4n2OybgPsaY3dfvN6e9AHFa34/g0Cae/XwSl35s7r5aw/dyS2f9QRxtx0zz14oAseDv 2pJtf1Gbw/N8NWt4bGJtk0hLRv5bLGMKbJcbs5xuPA70AaHiT4sx6YjX0fgcSmaU5jWP ld2W6i3ORx6Dk/mAeGeLf25p/CFuqp8GHvzHOLXcGKlgA/z4/s5uuzPU8ZOaAPR/hp+0 y3iyRb6b4ZmxF3ZC78mT5ljMgRtnNknI34HsKAKN/wDG0azrN/p//CvvJFvNKwlKkq2y QrgD7IvXORyf50AEn7WkvhlVs7b4VNI9uRameNipkCHZvIFg3DYyeTyeuKAPRLb4qr4i 06DU7nwZt+2wrdG2lj8wRNIu/b81uBlc4J2DnJxQB81698cZm1jUNMh+Hcka29zLGs6o wVgjsAVAtMDOOOSMcAnrQB9JeG/HK3HhHS7qfwrnzYlLQSR7gpOexhHfocA9fegCkfjb /wAI1cvcweAzMYvkCohTIbgnP2ZsY6jA/LNAHj15+1bd2XiW9vJfhfNdoXYeUxYoSe4z YkY/Dr+dAFu9/bcms7fzF+DTyAEAIGI69eRpp/HrQB9KfBj4y2/xRutOgufAUehi9tJL lmlRZDGUGQpDWsXOec56UAfS58NeHzIZTo2neY3V/skW4/8AAtuaALcekaXFjy9PtExw NsEYP54oAiOhaMZGlOl2JlblnNtHuJ9zt56UAK2haM4w2mWRHvbx/wDxNADf7A0Tbt/s ux2+n2ePH8qALsdjZxQi3jtoEgHSJY1Cdc/dxjrQBTl0HRZmLS6XYyMepe3jYn65FADl 0TR4xtTTLJR6C3jA/wDQaAGNoGiOctpViT6m3j/+JoA5+HwVYW+ujWIUt4lXpAkCqB+7 2HBB/Hp1/OgDqZtM065BWeytplb7wkhRgfTOQc0AOttOsLNQtrZ29uqksoiiRME9SMDr QBcoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAIpYIZwBNFHKByBIoYD880AZZ8O 6ESWOk2G5iSx+zRZJPJJO3JyfWgBy6BoiHK6VYg+ot4wf/QaAJDo2ksAG060IHQGBP8A CgCH/hHtDzn+ybDPX/j2j6/lQBdi06xhz5Vpbx5GDsiQZHoeKAGx6Zp0TM8dlbIz/eYQ pls+pxnnv60AD6Zp8gxJZWzjrhoUP8xQBFHoukxMXj06zRz1ZYIwfzxQBK+madIMPZWr jrhoUI/UUAYeq+DdB1SJY30zT1KuH3NaRSdARjBHv1oA0bPQNJsoIoYdPs18uNUylvGu doA6Y4z6UAT/ANj6Vkt/Z9puPU+QmT9ePz9Tz1oAjbQtGf7+mWTd+beM8/l+P1560AWF 0zT0UKtlbKoGAohTAH5UAVzoWjFi50yyLnksbePJPrnH1/WgC0un2KIEW0twg6KIkx/K gCNtK01slrC1bJycwocn15FAFdvD+iMSzaVYknqTbx/4UANPhzQT10jTz9baI/zWgC7b 6bYWhU2tnbwFQQpiiVCAeoGAOKALtABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQA UAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFAB QAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAFABQAUAF ABQAUAVJL+yi5ku7dM/3pUHP50AJ/aFif+Xu3P8A21T/ABoAf9stSM/aYcdc+Yn+NAEY 1KwYkC8tiR1HmpkfrQBZSaKX/VyI/GflYHj14oAry6hYw/667t4+SPnlReR1HJ60AT+f DtD+bHtYAq28YIIzkHPcc0ANjureUkRzxOR1CupI+vNAE9ABQAUAFAFOTULGIlZLu3Rg SrBpUBBHUEE5zQA1dU05jhb22J9pk/xoAkN9ZgZN1AAe5lT/ABoAamoWMrFI7uB2HJVZ VJ/Q0ALJf2UQ3S3dugBwS8qLz+JoAi/tbTDyL+1Pv5yH+tADTrGljrqFnn3uI/8A4qgB 39raYeRf2p9/OQ/1oAuJNFIoeOVHRhlWVwQR6g5oAUSxltgdS390MCfXpQBFLd20GTNP FFg4O91XBPrk0ARJqWnyHal7bMfQSoT/ADoAsLPC5ASVHJ6BWBz+RoAloAKACgAoAKAC gAoAhkuIIs+ZNGmOu9wuM+uTQBX/ALT0/dt+2227085M+vrQADU9PLiIXtsZD0Tzk3HP PAzmgCwLiAsFE0RY9F3rk/hnNAEm5T0ZSfqDQA6gAoAKACgAoAKACgAoAKACgAoAKAIp 1LwyoDgtG4z6ZU80AfFfxI8D6myQS2+pXZJnZiEWTjgY4D98flxQB5SketwlYi2oMIyE LHzvm2nBPU9ee9AHoEQ1U26Bvtu4x4z+9zyOKAOTtfC+s293PcG8vmWWTeE/fYGWyRnd /Tnr70AfU3wovbu5lvbe5imTybJEDyljuYfLkZA5xzwTx1oA8m+JPwv1LXbiN4Nbu7bb qEk5VEkPyl923iUDHb6UAerx6VdDR7Cz8+YvaWaRNL8wZ2SMDcck8kj3oA838HpqGkaz qskhup1ldgA3mYH7wnIznv6devSgD6f0bVmvgkLW7RbIA24sTkjAxgqOTnPWgDoKACgB G+630P8AKgD4a+I/gzVbnVdUuoNRvEWbUbiRVRZCAGeRsDa4456/h7UAeN+HtN186zc2 csuo7IN48xvOw2yRVJxkkZPrmgD12DRdV1SMWZub2HykyHPmnO0bRjLD1PXnuaALPgTw hqll4ivpZr+8lTypVCuJAP8AWow5LkHp6cjPc5oAh+IXgzVdUtbmGHUryHdMWBRZeP3g PGHz249KAPL7f4f67BCkX9qag20Y3ETc+/8ArKAOe1X4beIE8y6Gs6kdzABAs/Gen/LT 60AbWneBNe+xw7tS1HO3OSJsnPc/vO9AH2x4P0K403wVpDy3Us0qQKrK6sHyT3yxPHv9 e9AFvwx9o/4SeTf5vlbJfvbtvTjrx1oA87+J2h3/AIhuNRsLe6uLQNcq6yxhyMKOwDL3 560AeP2XgDWPD839oNqt7d7Rs8srKv3upz5jfjxQB9MfDywuV+xXE0kx3wHKvu4O4EZ3 Hrj15oA9qoAKACgAoAKACgAoA+ePiNYXmpX+oWkMs8KyeVh03kDaqNxgjuPWgD5+1f4f 6zaGTVV1a+cW6hjCFl+b158wkc8dDQByvhzw5rl9440i/e81COJZlDRMJthIznJLAc0A fU8vh27tr1NU+1zv5GG8jDkPj1O7v1PFAHeeHbma6ubeV1kT94QQ27pjvmgD0+gAoAKA CgAoAKACgAoAKACgAoAKACgCJ4IZOHijcDpuRT169QaAITYWROTaW+eufKT/AAoAeLO1 HAt4cf8AXNf8KAD7Ja/8+8P/AH7X/CgB6QwxEmONEJGCUUKSOvOBzQA5oo3+9Gjc55UH mgBdiDjavH+yKAIvs1vknyIsnknYuT354oAlCqv3VA4xwAOKAHUAFABQBC1vA5JaGNiT klkU5PryOtAEK6fYqxdbS3DN1YRJk/pQBKLW2HIgiB9kUf0oAcsECEssUasepCKCfqcU AIbeBs7oYznk5RT/ADFADfslr/z7w/8Aftf8KAENnaMMG2gI940/woABZ2gGBbQgf9c1 /wAKAJwihQgVQo4CgDaPoOlACCKMNvCKG/vBQD6daAGtDExLNEjMepKgk/U0ANNtbnrD Efqin+lAEixogARFUDoFAGPyoAfQAUAFABQAUAFABQBG0MTks0aMx6kqCT+JoAYba3YE NBEQeoKKf6UAMWys0YMltArDkMI0BH44oAnMaMCCikHqCooAFjROFRVx6KBQA+gAoAKA CgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoA KACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgA oAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAC gAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAK ACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAo AKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACg AoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKA CgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoA KACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgA oAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAC gAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAK ACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAo AKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACg AoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKA CgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoA KACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgA oAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKACgAoAKAC gAoAKACgAoAKACgAoAKACgAoA//ZAABQSwMEFAAGAAgAAAAhAEv96FiEBQAAoQ8AABEA AAB3b3JkL3NldHRpbmdzLnhtbKRX23LbNhB970z/QcPn2uL9NpYzFC+pU7vxREmmrxAJ SahJggOAUpSv74IULTveuJnkSdCe3cViL8TB1ZsvTT3bUyEZbxeGdWkaM9qWvGLtdmF8 +lhchMZMKtJWpOYtXRhHKo0317//dnWIJVUK1OQMXLQybsqFsVOqi+dzWe5oQ+Ql72gL 4IaLhij4K7bzhoiHvrsoedMRxdasZuo4t03TN05u+MLoRRufXFw0rBRc8o3SJjHfbFhJ Tz+ThfiRfUfLjJd9Q1s17DgXtIYYeCt3rJOTt+ZnvcERd5OT/WuH2Df1pHewzNc0T8c9 cFE9WvxIeNqgE7ykUkKBmno8bkNY++jGcl84ekz1JaR6Pu49167A3DKH1TlyWb+wR6o9 VvGWrQURY5mhAXQUTRnfbFsuyLqGpjpYrnENHfWV82Z2iDsqSigStKPtGnMN0GZNq9VR KtoUvFVyECpByocPdM90746iim5IX6uPZL1SvANXewJxBrY5uqmY7Gpy/JML9hXckDoT 5AAZeitYlcMQHCeL5/qfqVCs/H9t/jdXnyS9I2LLWllw8cT9e8FAOMTd8vu+LVU/9N5f VLQQwQCUOwJHUlSsOlKCMIUYBa+noCrtP4XBEVDX8UCS7Om9gBTQwz0Dl4IOjgbNz6Rm FVE02ULGpVoNM3mGM5hQUQJ+00KSWPUPtIlO9TiZetVLWuS35Mh79QRZjVMPQbWkgdqN +qdJvuMVNQDqBXvRHt9tL20w1Am64JWNOBQI6kShuDVdqWNNdSus2FeatNW7XioG34Yh p78QwWsB0Fbv/B6+aR+PHS0o0fmG78ZPH/e1zYYSFjXr7pgQXNy0FUzEr242f1pe+ORX UtdZLz5wrqYymKbneZl1mgGNnhEz8pOgGAN/jlihHQUhhtheEOUJimSmE0YY4lieZ6co 4vvL0EGRzLZtdB8n89PAxmxcy/QdD0Uia5kGGPL97HiBGZloBF5hWX6GefMdq/DQfXzf 86IctYnc1ELPA+dMMwuzCUzXtHwUiSx7iSOpW6RoFYLUMxMcKbzEQXMQWp6fovuEjm2n aFeFjpvnSyzqMPRTF+23cOkEGb7P0nVStN/Cwk5dtD6R5Xg2GkFk+2mERhC55hLvqsh3 oxCdrAg6J8X3SV0nQXs0Sv3ERjsk8f3QQ/dJQjv0UG9J7kYpbpP7eYD2aFKYyRKNeum4 gYN2yNJz0gCtwjLxTXx+lrlp4tlZ5kGRoDlIczfI0ZpmiZlH6JRkkDgX7Z0sDRzTxjox t7zCRU+ae3ZYoNnJEytx0SnJ0yCJUKQw7dBHq1AEdmKh81METu6h2SkKt8iG88CtcLoL mliT2HtxfTWu9AU7a8bLOSXNWjAyu9M0F67pJl6LhyVrJ3xNgebTp8iqX0/gxcUIyIbU dQEkZwKGdmtiTcwyuvlGWo9M6hupQKXA/N49etXskYq3gvfduO9BkO4D2+40kWli1qpb 1kxuZb9eTXot0FQUmp9Tc4gVvG4G8nFL2u10N9L24tNKkwFKpEokIwvjX3Lx7l4HANdu LQYCBuSw64Dagd56ay2MWgdlaTMF/yp4HA1/1lv7hNkDBv80NvwhpT4eaJ8WWmFcgtZp cZY5k8w5y4D6j3ruWeZNMu8s8ycZPM4O8Q5Ij6hZ+wDMblpq+YbXNT/Q6s9JuDBeiMYk DJwm6RWfSOyJs47cXe5IR6EJNIEHXsLjQXBi9HK2j+kXeBLQiil4kXasasgXeCGY9jAR J20g98BWn+lqT1q5eyadATOGCg3fgPkz4+srmIdvYjnEQ+j58AoB2gwPjO304CgZ9PTq 2KzPRP1yPG7NgHXTDji94gISNXDcPwbMcsFjeQPEClaDPLCD0HTGq1sHcHpbX/8HAAD/ /wMAUEsDBBQABgAIAAAAIQDlyrNDBQEAAK8BAAAUAAAAd29yZC93ZWJTZXR0aW5ncy54 bWyM0FFLwzAQB/B3we9Q8r6mlSFS1g5BJr4MYfoB0vTaBpNcyGWL+/beNhXEl73luNyP u/9q/elscYBIBn0r6rISBXiNg/FTK97fNosHUVBSflAWPbTiCCTW3e3NKjcZ+h2kxD+p YMVT43Qr5pRCIyXpGZyiEgN4bo4YnUpcxkk6FT/2YaHRBZVMb6xJR3lXVffim4nXKDiO RsMT6r0Dn87zMoJlET3NJtCPlq/RMsYhRNRAxPc4e/GcMv6XqZf/IGd0RMIxlXyMvGwk TxSP19X55awonG5eJo9R9ZYTzPVSdByfshbz6/ZZnooBt5h26gCPtOMFLGyMBe7IPzF3 XwAAAP//AwBQSwMEFAAGAAgAAAAhAMZDje2SCQAA1EkAABoAAAB3b3JkL3N0eWxlc1dp dGhFZmZlY3RzLnhtbNxcW3PbthJ+PzPnP3D47uhiW3Y0VTq27DTupK1bOdNnioQs1iTB Q1JWnF/fxYKEwJu4EJlO5zzZJoH99vLhW8gG/MOPX8PAemVJ6vNoYU/ejW2LRS73/Oh5 YX95+nh2bVtp5kSeE/CILew3lto/fvjvf37Yz9PsLWCpBQaidL6P3YW9zbJ4Phql7paF Tvou9N2Ep3yTvXN5OOKbje+y0Z4n3mg6nozxuzjhLktTQFs60auT2rm5kNOshY5bGJ6O x9ej0PEjZaPuEY9ZBP5ueBI6WfqOJ88wI3nZxWfgYexk/toP/OwN/BvPlJnXhb1Lonke 1ZmKSsyZgwPz1zAoBoPb7WNlBubySzEjqQXa4KSccsfdXciiDN0bJSwAh3mUbv34kLdT rUE+toVLRwPWgt3Hk4sankoPpeh3ibOH2hfA+7hmriEZnpwUBjIPglAHGlUtTsaEiggT ygeKC2XMwhOdfPvTUnNg0j6GBdhnQf2U8F2soor9ftYeohdlS+iAgWfjGS51PbTUyEBN K1ZbJ2a2Fbrzh+eIJ846AI8g45ZgpP0BtMnj7h3bOLsgS8WPyWOS/5j/hF8+8ihLrf3c SV3ffwLNAiuhDwY/3USpb8Mb5qTZTeo7+sv7/Jl4vxUD9ZdqpptmmsFb3/PtkQANnOgZ Jr46wcJm0dmXlQ6zsP9yzn5+FI/WMGNhO8nZ6kZMHGEMxVctllhFJkdVAgeJAMFYSaWG tLDNZ+6+MG+VwYuFDWqPD788PCY+T0D6Fvb79/nDFQv9T77nMdEYioHR1vfYn1sWfUmZ d3j++0eU1Nyiy3dRtrCnVzMsRpB6919dFgu1ArzIEYn+VUwA3YQ+ouGgQzv/4I18UEHF h/8rICd5ZptQtswRrcxC/48CYdS73kBTEZEeANo18vW8v4mL/iYu+5uAFto3F1f9TcAG pq8XkhsaK+lFzbgryadz4vz9EcqKGTUWdc6okaZzRo0jnTNqlOicUWNA54xawTtn1Orb OaNWzqMzXAeFq8qic8wGaWE/+VkA7apD6SY9pS5vCtajkzjPiRNvLdHfqm4fE8vVbp3R XEU5PV0sV1nCxa6vIyNTuQxO1uT7MN46qQ+b4y6gnql/EjsQ66fEh11kB9SlJF8tJrk5 aGphj4Hjsi0PPJZYT+yrrKjB/F+5tYodF7fZZSHsWcXP/vM2s2AvJjpsZ+Czlhy3By7t f/ZTDPlo8561hNJlnFSyWQsN243/wjx/FxapIWw+ZlK+DapagUAXj6foQpSovmY7oxAF oIQgu4N5CGif4L/sJeb2RY0p/svOc6J9gv+yT51oH/lxvL7GwnIHv/mwSMvrynjtLnnA k80uKNZApzxcGa9gBUELwXgRK/skkbgyXsEl+bRuXBc+qFF4alyLg44aoBiXQ6LgYqPH YlyUiuxNDCIyLlAFa2qA1U9rDYCMRfcP9uqL3/WaNgNUabW17FzO5y0ZgBZE2jL/vuNZ 95Z52qJ5VJSHCH47kjKLhnbesvKoaDmfZL8zqHG/xmcA1K8DGgD1a4UGQC38aN/zqJ5I B+nfHA2wjGVZdTGkHVmZr4yVWQGZtYCB+iZh/9Wyetu5UO+bBBTjAtX7JgHFuDqVXqb6 JgFrsL5JwGrpGu010jXVJCjjvqkDqZ0AIaJhxJsANIx4E4CGEW8CUH/x7gYZTrwJWMba oDRVF28CEA4x+aivgHTxJgAZa4NUu/x3RkXfQyvHP9wOIN4EFOMC1cWbgGJcnTbxJmDh EBMmVLCU1BGwhhFvAtAw4k0AGka8CUDDiDcBaBjxJgD1F+9ukOHEm4BlrA1KU3XxJgAZ y4MC0sWbAIRDTLShUbxx1X938SagGBeoLt4EFOPqVARVbVIJWMYFqmAp8SZg4RATMuRY SG6ToIYRb0JEw4g3AWgY8SYADSPeBKD+4t0NMpx4E7CMtUFpqi7eBCBjeVBAungTgIy1 oVG8cTF+d/EmoBgXqC7eBBTj6lQEVekcAcu4QBUsJd4ELORLb/EmAOGQU4FMIhpGvAkR DSPeBKBhxJsA1F+8u0GGE28ClrE2KE3VxZsAZCwPCkgXbwKQsTY0ijeuke8u3gQU4wLV xZuAYlydiqAq8SZgGReogqWkjoA1jHgTgJCYvcWbAIRDTgDCVWRSpmHEmxDRMOJNAOov 3t0gw4k3ActYG5Sm6uJNADKWBwWkizcByFgbxLFaOB5KPo06aSEB9ZxBcaqBDDhtKRIV MA/wD7ZhCVweZN2nQ3oCFhEaILbQgxriLecvFu0c93kLQchQ/jrwOZ7gfsNTOtq9g/Or IxcHnn5bWp/kfZfaPKRU+eQNXCnSbweJy0l4oxP8zN5iuKETFwfJhTW4OSRuU+U3fnDg A9z/yW/xiMniWg8MxJtN+WP8u22Oit/DNVOvGDMeX15e3sGpd/nmMUEPvhWvpxfihXbv CTHrXrpbcNPNWHLEy/xovDq+hAfjqz63nJ9H7w6XNwr38nP0h+2XHFc63in9b/E7E2fG j/iMZ8qPptfCITJ9dQfhGhe61OUhVHsdyOTDNw+RqM8+v8cleeB9daQpeL9kQfCLg6XK eNw+NGCbTL6djLF5VkyteZbxsH1+gmfL0ZMmA0AL3Rn5owgCvmvJd7QL1yzJT6q3slk0 HbyzVmazPCbbQgVqptt9K600tbbg4L8f4Yn/KlXxjbwMgD6tHbiM95u4W1dbfYEfvRTP lcElrJku3pT3bwhTXr3Li8vb6/LqTUo3Khf2ku8SX65MvCl5eCKpeVjsxXL6thQXMjEK 6EowCpIGlzePFbYkAO4uBV6txH3HqlSVo29PqXXITiWvjTKCkTRmuSvD/850NnPx1gkC zpvZmL8z56Nm9JDzPkpWzuj15HK2nMkqIIeAShWCft65vufAzR34BwcoxjlNa89duLFc flhh8ORaAqUag+Wz4RhczVeVw3oh+rJYw+ricaXD/D8UQWnwkofiPy4cNprVnDtRxOEu tbjZnKj9L3KDLB7DMf72fjxe3pYYnyqN7cPQZlHIk9PYorS8ZOLSWlNK9F2irqCa3e+h C41Z0vrOKRvPI32nGk2VQfl7lM++q1bD6rVqG1OkGjMmCDZamtRRd+tHiQSfI/9ibn3/ pXEpzYc00akWfATEK5yuvWwgXI7/D3FuLWNYpvj1sE6n+Z6qlF58NlwnybOhB9xGy3xM OzO1zB4y157doXnZmsbBWaquzlRTpV5gJeEfZMC/zMBvycpe7pl3N+P79/mOON+4aPRo kafi00X64W8AAAD//wMAUEsDBBQABgAIAAAAIQCwb3WS9QgAAHJGAAAPAAAAd29yZC9z dHlsZXMueG1s3Fzbcts2EH3vTP+Bw3dHF98ST5WMLTuNO0nqVs70mSIhCwlJqCQVx/n6 LhYkBJGEuDCZTqdPlklgD3b34CzkYPPLm29J7H1lWc5FOvMnL8a+x9JQRDx9mPmf7t8e vfS9vAjSKIhFymb+E8v9N69//umXx4u8eIpZ7oGBNL9Iwpm/LorNxWiUh2uWBPkLsWEp vFyJLAkK+DV7GCVB9mW7OQpFsgkKvuQxL55G0/H4zC/NZBQrYrXiIbsW4TZhaYHzRxmL waJI8zXf5JW1R4q1R5FFm0yELM/B6SRW9pKAp9rM5KRhKOFhJnKxKl6AMyO1opE0BdMn Y/yUxL6XhBe3D6nIgmUMwXucnPivIXKRCK/ZKtjGRS5/ze6y8tfyN/zxVqRF7j1eBHnI +T2EFAwkHGy9u0xz7sMbFuTFZc4D8+VN+Uy+X8uB5ks9M8wLw+AVj7g/kqBxkD7AxK9B PPNZevRpYcLM/M/B0W938tESZsz8IDtaXMqJI/Sh+mn4stGeqVE1xyFlkMCF4hGEha3e i/ALixYFvJj5wEV8+On2LuMiA67M/FevyocLlvB3PIqYpG01MF3ziP21ZumnnEW753+8 RQ6WFkOxTYuZPz0/w2TEeXTzLWQbyR7ASwMZ6I9yAuQPWG7g4IK2fLca9aCGig//riAn ZWTbUNYskBvNw/UfBEKvt72BptIj0wG067TW4/4mTvqbOO1vAjSnbyzO+5sAee27CsUN g5X0pBYiVOQzOXH86gBl5YwGizpnNEjTOaPBkc4ZDUp0zmgwoHNGI+GdMxr57ZzRSOfB GWGAwlVn0TFGg7Sx73kRMzn/oABNekpdWRS8uyALHrJgs/Zkfasv+5BYLrbLgrZUlNPn i+WiyET60BmRqdoGz9bkm2SzDnIOh5WO0E97hv5eHj68XzMedUKdKvI1fFKHg7YSdhcH IVuLOGKZd8++qYw6zP8ovMUmCKEKNrkglbFhCh6SaP2eP6wLb7HGCtvp+JklxnbHlf33 PEeXD+6dMwshu4yTUnZmoaHd+AcW8W1ShYZw+DhT8t1IBRkCl3g4RCeYfncImQCKC6o6 PNM+Yf2qlrjblzmmrF9VnmfaJ6xf1aln2kd+HM6vs7Bcw1dFj7S9zp337lzEIltt42oP dMrDufMO1hA0F5w3sbZPEolz5x28J5/eZRjCFzUKT51zsdNRBxTndCgU3Gx0X5yTUldW B4+cE1TDmjpg9dNaByBn0f2TfeXyL1GuxQCrgD5adm7nY0sEqGeLP7ai6D4yTy2aR0W5 TeGvIznzaGjHlp1HRSv5hJF0IVO/wudApn4V0AGoXyl0ALLww36s0jWRDtK/ODpgOcuy rmJIO7IynzsrswZyKwED1U3C+cuye+1caNZNAopzgpp1k4DinJ1aLZtUlCNgDVY3CViW qmHPkampLk45100TSIs3waNhxJsANIx4E4CGEW8CUH/x7gYZTrwJWM7aoDXVFG8CEA5p /mHHvo00kCneBCBnbVBqV/7NqBIhtHL4y+0A4k1AcU5QU7wJKM7ZsYk3AQuHuDChhqWl joA1jHgTgIYRbwLQMOJNABpGvAlAw4g3Aai/eHeDDCfeBCxnbdCaaoo3AchZHjSQKd4E IBziog2t4o27/oeLNwHFOUFN8SagOGenJqj6kErAck5QDUuLNwELh7iQocRCcrs4NYx4 EzwaRrwJQMOINwFoGPEmAPUX726Q4cSbgOWsDVpTTfEmADnLgwYyxZsA5KwNreKNm/GH izcBxTlBTfEmoDhnpyaoWucIWM4JqmFp8SZgIV96izcBCIc8F8jFo2HEm+DRMOJNABpG vAlA/cW7G2Q48SZgOWuD1lRTvAlAzvKggUzxJgA5a0OreOMe+eHiTUBxTlBTvAkoztmp CaoWbwKWc4JqWFrqCFjDiDcBCInZW7wJQDjkGUC4i1zSNIx4EzwaRrwJQP3FuxtkOPEm YDlrg9ZUU7wJQM7yoIFM8SYAOWuDvFYL10PJt1EnFhJQ7xlUtxrIgFNLkqiApYN/shXL oLWJdd8O6QlYeeiAaKEH1cUrIb54tHvcxxaCkKH4MuYCb3A/4S0do+/g+PxA48D973Pv nep3acxDSu3f6oWWIrM7SDYnYb8ZrLN42kCHzqa6SC6tQeeQ7KYqO35w4C30/5RdPHKy bOuBgdjZVD7Gf3AqUfEzNMFF1Zjx+PT09Bpuvas3dxmu4Hv1enoiXxh9T4jZXGW4hmWG BcsOrLK8Gq+vL+HF+PqaLffncXW75o1qeeU9+t3xS43bu96p1m9ZdyHvjB9YM94pPxhe D4eo8DUXCG1cuKSuFUK2l7EKPny4TWV+oKsP/8FN8SD6FihT8H7O4vhDgKkqxMY+NGar Qr2djLF41kwtRVGIxD4/w7vluJI2A0ALczHqV+kEfLLEO90mS5aVt+CtbJZFB3vW9tms rslaqECNtH1teztN7y24+M9TvPFfpyq+Uc0AuKZlAM14v8veusbui3n6pXquDc5hz3Tx Zv/8hjD7u3d+cnr1cn/3ZnsdlTN/LrYZVzsTOyV3TxQ1d5u92k7f57IhE72AqgSjIGjQ vHkosXsCEG5z4NVC9jvWpWrfe3tIvV10anFtlRH0pDXKXRH+b4aznYtXQRwL0c7G8p07 Hw2ju5j3UbL9iL6cnJ7Nz1QWkENApRpB329DHgXQuQPt1yjGJU0bz8N85u8/rDF48lIB 5QaD1bPhGFyPV53DZiL6stjA6uJxrcL8H5KgNXguEtkBvzto1mMepKmAXmrZ2Zzp8y9y gywewzH+6mY8nl/tMT7XGtuHoe2iUAantUQZcSlk01pbSMxToqmght0foQutUTLqznMO ngfqTt2bOoPK9yiffXetgdVr17aGSBdmDBActAypo57WDxIJvkd+ZmHz/GVwKS+HtNGp 4XwKxKsW3XjZQrgS/1/i3FL5MM/x526fQjNq+cTgJD4brpKU0TAdttGyHGNnphHZXeTs 0R2al9YwDs5S3TpTD5V+gXmD/yAD/ssM/EhW9v2aeX05vnlVnojLg4tBD4s8Vd8u8tf/ AAAA//8DAFBLAwQUAAYACAAAACEAg6GcpYABAADwAgAAEQAIAWRvY1Byb3BzL2NvcmUu eG1sIKIEASigAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAjFJNT8MwDL0j8R+q3Nv0Y0yj2joJ0C4wCYkhELeQeFtYm0aJt27/ nrTduhU4cIv9np/t54yn+yL3dmCsLNWEREFIPFC8FFKtJuR1MfNHxLPIlGB5qWBCDmDJ NLu+GnOd8tLAsyk1GJRgPaekbMr1hKwRdUqp5WsomA0cQzlwWZqCoQvNimrGN2wFNA7D IS0AmWDIaC3o606RHCUF7yT11uSNgOAUcihAoaVRENEzF8EU9s+CBrlgFhIP2u10HPdS W/AW7Nh7KztiVVVBlTRjuPkj+j5/emlW9aWqveJAsrHgKUrMIRvT89O97PbzCzi26S5w ADfAsDTZC4Jeg/Ie3W5N7QmoLd/AoSqNsK68F7l6AZYbqdEdshXvJRw7Zxbn7rJLCeLu 8KPPb7xuZ2An65+R3Qyahl3s1mvcbKcG4Tl/0tbNE/KW3D8sZiSLwyj2w6EfjhbRII1v 0zD8qPfq1dd+tYniOOE/FKNkEY3SOOkrngRai/p/NPsGAAD//wMAUEsDBBQABgAIAAAA IQDevXBmsAIAAJsKAAASAAAAd29yZC9mb250VGFibGUueG1s3FZNb9owGL5P2n+IfC9x QkopaqiAwjRp2mHqtLMxBqzFdmQHGNf2vvMO3U+YdtikXfpvkHrtX9jrJISWDxGkssOM EOS1/djv8zx57YvLLyJypkwbrmSIvApGDpNUDbgchejjde+kjhyTEDkgkZIsRHNm0GXz 9auLWWOoZGIcmC9NQ9AQjZMkbriuoWMmiKmomEnoHCotSAKPeuQKoj9P4hOqREwS3ucR T+auj3EN5TC6DIoaDjllV4pOBJNJOt/VLAJEJc2Yx2aJNiuDNlN6EGtFmTGQs4gyPEG4 LGC8YANIcKqVUcOkAsm42Y5cCwXTPZz+ExFyBG28HUmlST8C7mZegJo5cc6sIYmAYIeI vuYk7YiJVIZ50DclUYiwjwN8iqvwDXANfuEZuRaBjok2LCkG4iw8JIJH82WUTBKVxWOe 0PEyPCWwHOwn6zJ8BB0T08ch6mJofq+HsogXosBGgiLiw57ylo+pPo/QFCcd4p2nOBAB nGIW7N7NnLNBxOP9j8f7X87Dt68Pd99TOtayDLpHyrLW6pz1rnrtPKciS8/fkyVY99As r7lgxnnPZs4HJYjcIbufym1lPwXRq8eX3W8VIoNcHdDrrB5464Tg8z2EYOxlOOVl76iJ 5kzvIAIDAc9aZoE1Z+CX8X++UDVP8qlvszeicAYsmEV2+x+osGPKE/FuQvmAOG80FFu2 g442+AJeyNQV/tHLgQdrtbpPyoHVopUrDCXjEDq89oHl4BNUY3sKma1UrLnCKrfdGf6L 1AyLb9vKGZYb2/JISSrq2aR0VnlntKBgR1tp8LF1RABOWH6OfkBsrRTLV2ZFwxEqRX5A LG5+L27+LG5vFzc/U1LWisF/cUx0SMThWrBD9N6qAPyDW4G1+satoNUpDoyDRN97XubX A9P8CwAA//8DAFBLAwQUAAYACAAAACEARFBw/pQBAADoAgAAEAAIAWRvY1Byb3BzL2Fw cC54bWwgogQBKKAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAACckk9P4zAQxe8r8R2i3KmTQvmnqREUrfawIKQGOFv2JLFwPJZt EP32O9nQktXe8GnmjfX8/LPh+mNwxTvGZMmvy3pRlQV6Tcb6bl0+NT+PL8oiZeWNcuRx Xe4wldfy6Ac8RgoYs8VUsIVP67LPOVwJkXSPg0oLHnuetBQHlbmNnaC2tRrvSL8N6LNY VtWZwI+M3qA5DgfDcnK8es/fNTWkx3zpudkFDiyhwSE4lVE+jHHcwlAeQBxUaCgr19gB 5WrF+qGDR9VhkjWLUwUvFE2SJ1V1CWKqYdOrqHRmiLI+r1fnIGYK3ITgrFaZAct7qyMl anNxr7T1mVJfjCYg5ruACW1Rv0Wbd7ICMW/ht/VjoNMliKnkiFF1UYU+yVPePWthq5XD DZOQrXIJQXwJsKEhKL+Tt7cPRYO69+So4+fk9J+T8azX9BQauhvRfVr8K84u/2Jzvw1K c7xlVS/P5hhmM9gyLjR8qb3jlwC/+L2iG49lhL5Ds9/z/2AE+zx9XMaxqHj9xbjXmMTh R8k/AAAA//8DAFBLAQItABQABgAIAAAAIQCLQKs2mQEAAEUGAAATAAAAAAAAAAAAAAAA AAAAAABbQ29udGVudF9UeXBlc10ueG1sUEsBAi0AFAAGAAgAAAAhAMfCJ7wMAQAA3wIA AAsAAAAAAAAAAAAAAAAA0gMAAF9yZWxzLy5yZWxzUEsBAi0AFAAGAAgAAAAhANjtvv4u AQAAPAQAABwAAAAAAAAAAAAAAAAADwcAAHdvcmQvX3JlbHMvZG9jdW1lbnQueG1sLnJl bHNQSwECLQAUAAYACAAAACEAjArW/hlhAACynwMAEQAAAAAAAAAAAAAAAAB/CQAAd29y ZC9kb2N1bWVudC54bWxQSwECLQAUAAYACAAAACEAXmlqQpoLAACELgAAEQAAAAAAAAAA AAAAAADHagAAd29yZC9jb21tZW50cy54bWxQSwECLQAUAAYACAAAACEAnVyLvhAHAACH HQAAFQAAAAAAAAAAAAAAAACQdgAAd29yZC90aGVtZS90aGVtZTEueG1sUEsBAi0ACgAA AAAAAAAhAGBdZ8bsowAA7KMAABcAAAAAAAAAAAAAAAAA030AAGRvY1Byb3BzL3RodW1i bmFpbC5qcGVnUEsBAi0AFAAGAAgAAAAhAEv96FiEBQAAoQ8AABEAAAAAAAAAAAAAAAAA 9CEBAHdvcmQvc2V0dGluZ3MueG1sUEsBAi0AFAAGAAgAAAAhAOXKs0MFAQAArwEAABQA AAAAAAAAAAAAAAAApycBAHdvcmQvd2ViU2V0dGluZ3MueG1sUEsBAi0AFAAGAAgAAAAh AMZDje2SCQAA1EkAABoAAAAAAAAAAAAAAAAA3igBAHdvcmQvc3R5bGVzV2l0aEVmZmVj dHMueG1sUEsBAi0AFAAGAAgAAAAhALBvdZL1CAAAckYAAA8AAAAAAAAAAAAAAAAAqDIB AHdvcmQvc3R5bGVzLnhtbFBLAQItABQABgAIAAAAIQCDoZylgAEAAPACAAARAAAAAAAA AAAAAAAAAMo7AQBkb2NQcm9wcy9jb3JlLnhtbFBLAQItABQABgAIAAAAIQDevXBmsAIA AJsKAAASAAAAAAAAAAAAAAAAAIE+AQB3b3JkL2ZvbnRUYWJsZS54bWxQSwECLQAUAAYA CAAAACEARFBw/pQBAADoAgAAEAAAAAAAAAAAAAAAAABhQQEAZG9jUHJvcHMvYXBwLnht bFBLBQYAAAAADgAOAI0DAAArRAEAAAA= --============_-872510567==_============ Content-Id: Content-Type: text/plain; name="draft-rogaglia-sidr-bgpsec-rollover-01.txt"; charset="us-ascii" ; format="flowed" Content-Disposition: attachment; filename="draft-rogaglia-sidr-bgpsec-rollover-01.txt" ; modification-date="Wed, 13 Jun 2012 14:23:43 -0400" Network Working Group R. Gagliano Internet-Draft K. Patel Intended status: Standards Track B. Weis Expires: December 7, 2012 Cisco Systems June 5, 2012 BGPSEC router key rollover as an alternative to beaconing draft-rogaglia-sidr-bgpsec-rollover-01 Abstract The current BGPSEC draft documents do not specifies a key rollover process for routers. This document describes a possible key rollover process and explores its impact to mitigate replay attacks and eliminate the need for beaconing in BGPSEC. Status of this Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on December 7, 2012. Copyright Notice Copyright (c) 2012 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Gagliano, et al. Expires December 7, 2012 [Page 1] Internet-Draft BGPSEC rollover June 2012 Table of Contents 1. Requirements notation . . . . . . . . . . . . . . . . . . . . 3 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Key rollover in BGPSEC . . . . . . . . . . . . . . . . . . . . 5 3.1. A proposed process for BGPSEC key rollover . . . . . . . . 5 4. BGPSEC key rollover as a measure against replays attacks in BGPSEC . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4.1. BGPSEC Replay attack window requirement . . . . . . . . . 8 4.2. BGPSEC key rollover as a mechanism to protect against replay attacks . . . . . . . . . . . . . . . . . . . . . . 8 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 6. Security Considerations . . . . . . . . . . . . . . . . . . . 11 7. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 12 8. References . . . . . . . . . . . . . . . . . . . . . . . . . . 13 8.1. Normative References . . . . . . . . . . . . . . . . . . . 13 8.2. Informative References . . . . . . . . . . . . . . . . . . 13 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 15 Gagliano, et al. Expires December 7, 2012 [Page 2] Internet-Draft BGPSEC rollover June 2012 1. Requirements notation The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Gagliano, et al. Expires December 7, 2012 [Page 3] Internet-Draft BGPSEC rollover June 2012 2. Introduction In BGPSEC, a key rollover (or re-keying) is the process of changing a router's key pair, issuing the corresponding new End-Entity certificate and revoking the old certificate[1]. This process will need to happen at regular intervals, normally due to local policies at each network. During the rollover process, a router needs to generate BGP UPDATE messages in order to signal the new key to be used to its neighbors. So, intuitively, a frequent key rollover process has similar effects as the beaconing process proposed by the BGPSEC base documents to protect a BGPSEC attribute [2]against a replay attack. However, there are a number of operational details to be considered if the expire time field in the BGPSEC attribute[3] is removed. This document details a possible key rollover process in BGPSEC and explores the operational environment where key rollovers could be used as a protection against a replay attacks against BGPSEC Gagliano, et al. Expires December 7, 2012 [Page 4] Internet-Draft BGPSEC rollover June 2012 3. Key rollover in BGPSEC The key rollover process in BGPSEC has not been well defined yet. However, this will be a mandatory process due to some of the following causes: BGPSEC scheduled rollover: BGPSEC certificates have an expiration date (NotValidAfter). Although it is possible to generate a new certificate without changing the key pair, it is normally good practice to adopt the policy of using a new key pair in every[4] rollover event. BGPSEC certificate fields changes: Information contained in a BGPSEC certificate (such as the ASN or the Subject) may need to be changed. The normal process requires the rollover of the old certificate with a new key pair and the revocation of the old certificate[5]. BGPSEC emergency rollover Some special circumstances (such as a compromised key) may require the replacement of a BGPSEC certificate. It should be clear at this point that a key rollover process is required for BGPSEC. The next section describes how this process may be implemented. 3.1. A proposed process for BGPSEC key rollover The BGPSEC key rollover process should be very tighten to the key provisioning mechanisms that would be in place[6]. The key provisioning mechanisms for BGPSEC are not yet documented. This document assumes that an automatic provisioning mechanism will be employed. (A possible provisioning mechanism, when the private key lives only inside the BGP speaker, is the Enrollment over Secure Transport (EST[7])). That protocol will allow BGPSEC code to include automatic re-keying scripts with minimum development cost. When the same private key is shared by different routers[8], a mechanism to distribute the private key will need to be implemented. A possible solution may include the transmission of the private key over a secure channel. The PKIX WG has started work on this sense by adopting [I-D.ietf-pkix-cmc-serverkeygeneration[9]] If we work under the assumption that an automatic mechanism will exist to rollover a BGPSEC certificate, a possible process could be: 1. New Certificate Pre-Publication: The first step in the rollover mechanism is to pre-publish the new public key, in a new certificate . In order to Gagliano, et al. Expires December 7, 2012 [Page 5] Internet-Draft BGPSEC rollover June 2012 accomplish this goal, the new key pair and certificate will need to be generated and published at the appropriate RPKI repository publication point. The details of this process will vary as they depend on whether the keys are per-router or shared, whether the keys are generated on each router or in a central facility, , and whether the repository is local or externally hosted (i.e., will need to use the RPKI-Repository protocol [cite].) 2. Staging Period: A staging period will be required from the time a new certificate is published in the RPKI global repository until the time it is fetched by RPKI caches around the globe. The exact minimum staging time is not clear and will require experimental results from RPKI operations. RPKI repository design documents [cite] mention a lower limit of 24 hours. If rollovers will be done frequently and we want to avoid the staging period in case of emergency rollover, an administrator can always provision two certificate for every router. In this case when the rollover operation is needed, the Relying Parties would already have the new keys[10]. 3. Twilight: At this moment, the BGP speaker that holds the private key that has been rolled-over will stop using the OLD key for signing and start using the NEW key. Also, the router will generate appropriate BGP UPDATES just as in the typical operation of refreshing out- bound BGP polices. This operation may generate a great number of BGP UPDATE messages. In any given BGP SPEAKER, the Twilight moment may be different for every peer in order to distribute the system load[11]. 4. CRL Publication: As part of the rollover process, a CA MAY decide that it will publish the serial number of the OLD BGPSEC certificate on its CRL. It may also be the case that the CA will just let the old certificate expire and not update its CRL[12]. 5. RPKI-Router Protocol Withdrawal: Either due to the revocation of the OLD certificate or the expiration of the old certificate's validity, RPKI cache servers around the globe will need to communicate to their RTR peers that the OLD certificate's public key is not longer valid (rtr withdrawal message). It is not documented yet what will be a router's reaction to a RTR withdrawal message, but it should include removal of any RIB entry that includes a BGPSEC attribute verified using that public key, and generation of appropriate BGP route WITHDRAWALs (either implicit or explicit). The proposed rollover mechanism will depend on the existence of an automatic provisioning process for BGPSEC certificates. It will require a staging mechanism based on an RPKI propagation time of around Gagliano, et al. Expires December 7, 2012 [Page 6] Internet-Draft BGPSEC rollover June 2012 24hours, and it will generate BGP UPDATES for all prefixes in the router been re-keyed. The first two steps (New Certificate Pre-Publication and Staging Period) could happen ahead of time from the rest of the process as each network operator could prepare itself to accelerate a future key roll-over. Gagliano, et al. Expires December 7, 2012 [Page 7] Internet-Draft BGPSEC rollover June 2012 4. BGPSEC key rollover as a measure against replays attacks in BGPSEC There are two proposed measures to mitigate replay attacks: addition of a timestamp or addition of a serial number[13] to BGPSEC update messages. Currently BGPSEC offers a timestamp (expiration time) as a protection against replay attacks of BGPSEC update messages. The process requires all BGP Speakers that originate a BGP UPDATE to re-advertise ("beacon") the message before it expires. This requirement changes a long standing BGP operational practice and the community has been searching for alternatives. 4.1. BGPSEC Replay attack window requirement In [I-D.ietf-sidr-bgpsec-reqs] Sections 3.7[14] and 4.3, the need to limit the vulnerability to replay attacks is described. One important comment is that during a window of exposure, a replay attack is effective only if there was a downstream topology change that makes the signed AS path no longer current. In other words, if there have been no topology changes, no security threat comes from a replay of a BGP UPDATE message[15]. The BGPSEC Ops document [cite] give some ideas of requirements for the replay attack in BGPSEC. For the vast majority of the prefixes, the requirement will be in the order of days or weeks. For a very small, but critical fraction of the prefixes, the requirement may be in the order of hours[16]. 4.2. BGPSEC key rollover as a mechanism to protect against replay attacks The question we would like to ask is: can key rollover provide a similar protection against replay attacks without the need for beaconing? The answer is YES, when the window requirement is in the order of days and router re-keying is the edge router of the origin AS. By using re-keying, you are letting the BGPSEC certificate validation time as your timestamp against replay attacks. However, the use of frequent key rollovers comes with an additional administrative cost and risks if the process fails. As documented before, re-keying should be supported by automatic tools and for the great majority of the Internet it will be done with good lead time to correct any inconvenient[17] in the process. For a transit AS that also originates BGP UPDATES for its own prefixes, the key rollover process may generate a large number of UPDATE messages (even the complete DFZ[18]). For this reason, it is recommended that routers in this scenario been provisioned with two Gagliano, et al. Expires December 7, 2012 [Page 8] Internet-Draft BGPSEC rollover June 2012 certificates: one to sign BGP UPDATES in transit and a second one to sign BGP UPDATE for prefixes originated in its AS. Only the second certificate should be rolled-over frequently, as a means of limiting replay attack windows. The transit BGPSEC certificate is expected to be longer living than the origin BGPSEC certificate. Advantage of Re-keying as replay attack protection mechanism: 1. Does not require beaconing 2. All expiration policies are maintained in RPKI 3. Additional administrative cost is paid by the provider that wants to protect its infrastructure[19] 4. Can be implemented in coordination with planned topology changes by either origin ASes or transit ASes (if I am changing providers, I rollover) 5. Eliminates the discussion on who has the authority over the expiration time Disadvantage of Re-keying as replay attack protection mechanism: 1. More administrative load due to frequent rollover, although how frequent is still not clear[20]. 2. Minimum window size bounded by RPKI propagation time to RPKI caches. If pre-provisioning done ahead of time[21], it means 24 hours minimum in paper. However, more experimentation is needed when RPKI and cache servers are more massively deployed. 3. Increases dynamics and size of RPKI repository, especially during CA rekeying [cite] and algorithm transition [cite]. 4. More load on RPKI caches, but they are meant to do this work. Gagliano, et al. Expires December 7, 2012 [Page 9] Internet-Draft BGPSEC rollover June 2012 5. IANA Considerations No IANA considerations Gagliano, et al. Expires December 7, 2012 [Page 10] Internet-Draft BGPSEC rollover June 2012 6. Security Considerations No security considerations. Gagliano, et al. Expires December 7, 2012 [Page 11] Internet-Draft BGPSEC rollover June 2012 7. Acknowledgements We would like to acknowledge Randy Bush, Sriram Kotikalapudi, Stephen Kent and Sandy Murphy. Gagliano, et al. Expires December 7, 2012 [Page 12] Internet-Draft BGPSEC rollover June 2012 8. References 8.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC4271] Rekhter, Y., Li, T., and S. Hares, "A Border Gateway Protocol 4 (BGP-4)", RFC 4271, January 2006. [RFC5101] Claise, B., "Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of IP Traffic Flow Information", RFC 5101, January 2008. [RFC5102] Quittek, J., Bryant, S., Claise, B., Aitken, P., and J. Meyer, "Information Model for IP Flow Information Export", RFC 5102, January 2008. 8.2. Informative References [I-D.ietf-pkix-cmc-serverkeygeneration] Schaad, J., Timmel, P., and S. Turner, "CMC Extensions: Server Key Generation", draft-ietf-pkix-cmc-serverkeygeneration-00 (work in progress), January 2012. [I-D.ietf-sidr-bgpsec-reqs] Bellovin, S., Bush, R., and D. Ward, "Security Requirements for BGP Path Validation", draft-ietf-sidr-bgpsec-reqs-03 (work in progress), March 2012. [I-D.ietf-sidr-bgpsec-threats] Kent, S. and A. Chi, "Threat Model for BGP Path Security", draft-ietf-sidr-bgpsec-threats-02 (work in progress), February 2012. [I-D.ietf-sidr-origin-validation-signaling] Mohapatra, P., Patel, K., Scudder, J., Ward, D., and R. Bush, "BGP Prefix Origin Validation State Extended Community", draft-ietf-sidr-origin-validation-signaling-00 (work in progress), November 2010. [I-D.ietf-sidr-pfx-validate] Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R. Austein, "BGP Prefix Origin Validation", draft-ietf-sidr-pfx-validate-01 (work in progress), February 2011. Gagliano, et al. Expires December 7, 2012 [Page 13] Internet-Draft BGPSEC rollover June 2012 [RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, May 2008. Gagliano, et al. Expires December 7, 2012 [Page 14] Internet-Draft BGPSEC rollover June 2012 Authors' Addresses Roque Gagliano Cisco Systems Avenue des Uttins 5 Rolle, VD 1180 Switzerland Email: rogaglia@cisco.com Keyur Patel Cisco Systems 170 W. Tasman Driv San Jose, CA 95134 CA Email: keyupate@cisco.com Brian Weis Cisco Systems 170 W. Tasman Driv San Jose, CA 95134 CA Email: bew@cisco.com Gagliano, et al. Expires December 7, 2012 [Page 15] [1]If the reason for the rollover, as noted on the next section, is certificate expiration, then this last operation is not performed. So, either this text needs to change to reflect this, or certificate expiration needs to be described differently. [2]Need a more precise noun here [3]Ibid. [4]This may be true in many contexts, but it needs to be justified in this context. [5]Note that in the RPKI we already do not require revocation of the old certificate and a key change if a CA receives additional resources. So, again, the statement here is not always true. [6]Not English :) Try again. [7]EST now contains a capability to provision a server-generated key, so this statement is no longer correct as it stands. [8]The question of whether each router has a unique key pair, or whether keys are shared among multiple routers should be addressed earlier, in the intro/background. [9]See the note above re the most recent version of EST. [10]An emergency rollover assumes a key compromise. If a compromised router has the "next" key, as would be the case if the router generated the key pair and requested a certificate, then this model doesn't work. [11]More detail is needed here. For example, it seems that the TM must be before the expiration in the old certificate, else there is no window over which to spread generation of new UPDATEs. Also, the wording does not make it clear that the speaker is using the new key pair only when it is necessary to generate new UPDATEs. [12]This contradicts earlier text on this topic. this text is too ambiguous to be useful to an operator or implementor, as it fails to explain why one choose to revoke vs. not revoke the old cert. finally, a CRL needs to be "updated" whether or not the old cert is revoked, so the choivce of term is confusing here. [13]Serial numbers are not really viable, are they? Also, since you don't talk further about the serial number approach, it probably out to be dropped here. [14]This requirement does NOT refer to message replay by a BGPSEC speaker. It mandates protection against an on-the-wire replay attack by an external entity. [15]I understand what you are trying to say, but the wording is not clear. [16]Again, I understand the intent, but the wording is unclear. [17]I don't know what word you had in mind here. [18]Expand the acronym. [19]Only partially true. Yes, an AS that decides to replace (origin) certificates frequently does pay a price, but so does every RP that has to retrieve these certificates, and every AS that processes the more frequently issued updates pays a price as well. so this bullet seems to overstate the benefit in question. [20]A concrete proposal for this mechanism may need to specify a minimum granularity for router certificate validity interval encoding. Think of it as a profile on the RPKI certificate profile. Router certificates are already a bit different than the other EE certificates in the RPKI, so it's not unreasonable to impose additional constraints here. [21]Redundant comment :). Pre-provisioning implies "ahead of time!" --============_-872510567==_============ Content-Id: Content-Type: application/octet-stream; name="draft-rogaglia-sidr-bgpsec-rollover-01.pdf" Content-Disposition: attachment; filename="draft-rogaglia-sidr-bgpsec-rollover-01.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmls dGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAHVnVuP3LYVx9/nU6jOxbOuV5Z40cW9 AU2ahwYFHHSBPsR5MBzHcZE4dWz08/fPyzkUOZIoraSOg32QdnTmz8PbTxRFnnlXfFO8 K9qy6prWHXDUfVt2wnzQ+pNfXxX/Kt4WT754Xxcv3xdV2XeV7IXAWadVX4WT0/uXRafK TjVNX7RVUzatlIVSotRNUYuyrfu+LaD3Q1HZP9i/g4xQ7n9z0ldljeQVvt+XbS/l6eXP xV/vYFXBz+LuZSFba+0Pdz8XT76qy6qoi7sfim+L87MXNzg/v35lD8VNoYtz89QeipsT /vn2plDFuf7OHtz1L2+KW1Gc3Vd+shfc+YebQtLn398U3xV3fy/+dmfK7RS7XaO0ZNV3 7Hbh3J5z9ozE7/4NvZOph1hPtLpUrUA1+GLwerYYpkvhRKXwT3hucvQf5Ayl8aM7vHrr jkgYRfC1z7X/EN+Yzp+UTdl21W75U7JHhbbNaP5mqpkz2Dyx9VtLfxSuJmtX03DU1viz f0SZSgpZ112pRROc8G1tUaWhEaArVLrrTPMtpehVXXfhzHcG2Zi+VPelRFvGVdX2fa/R hEvVVZWqtesP6DZZy5PtOaGDkajvYImiFm2pqmHidalUVdn+6tNmRZd2pUshbY+VZaUK trfpBj0y4+t04uQWGCZ5JlKE0iFYXCh6plCKq6nS9NrWRKBKXdnmplA5+PMHSxVBVDn/ 8pa6qkVm3FVr9NBKoOsn2rOKM3pMwKbry1ozAU3jwp8/JB4O9JYCGpAtdR0DWlSVXAro BshrpFShKH8TgCa39wJ0ond1QCf+LGLZyA2IAZ3o5e7DxwCanDgK0E3XOvQFBLmzrkoA PWfJOHUjIDYNgAb8WZE5yXZMNU6bFS2gMZwqKzekmgM0m7EenSQ4nTaMAc2kCKVjAG1g caHomUIpWkCvokojbU0EquwI6Fh7O6B1U/ZhiLo7oDFwluD/fUfQjTJjSL5/5Hru2hG0 OGgETW7vBmhfDB/LCHqn/AVAj+Tv/z6CpkwdBmitHfoCgnA2NoJuZiwZpx7QZBoAPVQM gCY7phqnzYoO0AqDLzekmgU0mbEenaQ4nTRMAE2kCKUzMYJuyJJSXD+ClnjajqiyBNBv 3vtn3dEBtLmZdBhAx9Lb+SwwGYEHGt8od+dzjbmKXqp787mWpawPG0Afxmfv9m58jvWu P4CO/dk+gI71crfhgwbQ3onD+CyEI18gkDvj4S7NcDQzlkxTz2cyDXweH0CTHUON02ZF x+eqK1tte+wsn8mM9egk5fOkYcJnIkUonSk+kyWluJrPuu9sTawbQC/icyK9mc+6F3aK +CA+67YrKzefxTPQax5FdFcP519yHfdjGT+T23vxOdG7Op8TfzbzOdHLVfMxfCYnjuKz xqyiJV8gEDMyZtWcJdPU8ZlNM3xmO4Yap82Kls+6bUpt5smVmuMzm7EenSR8njZM8kyk CKUzMcHBTKEUV09w6AZvUnAPOoLPsfR2PjeVnSE+is94cO3a+4+ftcKdLky/5DruR8Nn 7/ZufI71rs/n2J/tfI71ctV8EJ+9E4fxWeNV5KI3hHrGkmnq+Uymgc+j8xssyVADB50l Kzo+K1Wq/BtCTWasRycpnycNEz4TKWI+m+UEF4qeKZTi+vGzxBR2RJXd5jdA/aH0dj6L zk4QH8VnPDO2G14Q6roZTr/kOu5Hw2fv9m58jvWuz+fYn+18jvVy1XwQn70Th/FZNI58 gUDu7GJ+AwtKJi2Zpp7PZBr4PDq/wZIMNU6bFR2fMWoV+ReEmsxYj05Smk4aJnwmUoTS mRo/kyWluH78XAlbvr6m0dz243MsvZnPqm/MBPFR888K8xM6eT8oXMXkl9cpzMeZ5Xmh GHddvXHU5DO5vRecE72rwznxZzOcE73rwJmcOArOqlcOewE/DMgYVHOWjFIHZzbNwJnt mGicNitaOGNEXdb5l4Nsxnp0ksB52jDJM2EilI6F84Wcpwkl58i8mCctVsVFPNkNyyqW 3o7lRtl5Yd8c934tqJRf7Okbji3sxcWoMVWNRvJbw7J3ezcsx3rXx3Lsz3Ysx3pXwrJ3 4jAsN8IBL4CH0ZggasaSIeqxTKY5LJMd44zTZkWHZdWWvRtFzc05KzJjPTpJOTppmOSZ MBFKZxTLZEbJrcSy7GwdBJ7sh+VYejuWsfrDTAcfheXaL/G8F5YFVviHpdi5/vqxTGUo 7/ZuWI71ro/l2J/tWI71ctV8zFQGVdphWBa9A14AD84w3VvXCaGmDRmhHspkGaA80ON1 dIrMmGWUMOs5JNfabv3KvAbE5hlnxnJ0kiJ50jDJMCEilMwoksmMkluJZOyfMTecI5Ac S29GsuyxBy+MRvceKcvOL+q8D5JlhztbmFzJ9dW1SJYHrW4mt/dCcqJ3dSQn/mxGcqKX q+aFSK79dsGF+wPJiaOQLLHp1ux1vdgfmCJ5xpAR6pDMlvNIZjNm2TiSZSfNZq/cygw2 Yzk6SZA8bRgjmRExj2Q2o+TWIVliY81gr/EsN7Ex2G7aHVnIjOleJVpsal2jN9i5l24C 5p2AsmntTO9BQ2OJB0G/bD0slHP1kJ9IltgEY1bZhdvZrhPJh3HYu70bh2O963M49mc7 h2O9K3HYO3EYhxvtKBdoQzhMsDRtmHKYLDMcJjMGGCXMenZoLDUM8m/42Izl6CTlMOnR 9WTXN63aZkSEkhkbGrNZkDN7OxazRNW2/H39bufwCr1FHJbR7vHdx8N4/MTSwGjD3/Ky E3I4fZLroGvHw+qo8bB3ezcOx3rX53Dsz3YOx3q5al46HtZo/oiNsnQ87J04jMNSOsoF 2hAOEw5PGzI3/XiYLDMcJjMGGCXMeo7DJvgG9m4NpijwsEyk4xkPSWYshxNrmHJ40jDJ MCEilMwoh8kspLuKwwhpEe8cXjJr/P7Di9evZjBaIyJJjzgpBQLlDOVnMT+jF4bHVbRn fG8sY2uiWbYX7fNbjGXR18MplFx//ViwTG7vheVE7+pYTvzZjOVEL1fNx2CZnDgMy1Xt oBfg484uFsHJGUsGqQczmQYwjy6CY0lGGqfNihbNArE8EDZniGYX9igOY8RmrEcnCZqn DWM0MyZC6Yyhmc0ouXVTFZhfSDYN74rmRH4zmkUb7RbfHc14IPQL0tfPXAjdD2dVcn12 LZr1QSNmcns3NPti8HrXR3Psz3Y0x3q5aj4IzXFbW5SpNRHmRGNjhZlIdIMIc0OQ0pP8 nCWD1KGZTTNoZjtG2hSatbI7tgaj5lE0kxnr0UmK5knDBM2EiVA6o2gmM0puJZqxS2UQ rw0NbQmaX754+eOiUbOI5bejGes3zKyvHy3sjmYE3/Br0e+BZjwqmICJS0Yyz2Ym5DGd pxpE0RSxnmFA202H0WTUv3jtA2fiMQQRMxv3H2JMqpOJ3omPEE0UEUK1uwDi4x93wcQU NbFDEU7UHHw8zjiIKHrrMPYpBxFN3F1Ki/T9AQcRTfQyiOfczwURpfzPBhFN8sdBRMkf d8s53Td/HAKJ9HxzySGeMzgdRNQEikVszjWTIuTE2H35FIep5civOcQXLqKuG9ciBKvZ 7nqBeIQTZXBnLRmMHvEkGiGeFXkiQ5AdozGglMKSurQRi8PE3EkRn5KbzFiPT5Jh+qRh kmfCTfDLIt7lN+SDzDi5wY0g/7JLwNrWAQclHkO8q+0QPnQ54mP5CPGpKNrm5HtIiqEs EFnVTig7dyPEz+jNRBD1DdI1nhrxO/yK9oB4Vy35oqwRidVGm+WiHHtvmHScXHxnM4fp 4js3w9H3FwbPp/MvP+MIZvuDC/H81sV4dl3dx4Y2u1cGsZATjIkKb+tNbGbKwpK71Ex1 MaYTvatjmvzZC9Okty+mcQddg2ly4jBMVy7o2AJMz1immCbTHKbJjvEWcBhhusbkqdn+ lcE0m7Een8SYnjaMMc3ICH6NYZrNOLlVmK4Rz8NOCzi2aEcjf7C3YlnW/KD3uxvTwYvz A3/8xB8/NUeM3T4DNazB5+YDRFN/6A2en+0VkOX5jT0DWx6Zazj+3n6Abz/2KqRKIuEr STqn863XZw0SLa0oGEdiZEkG7CqpBzHESUcu4BldGmQszdDgUrB+cGNi3oe0E7eHwqRX 2TQH36HM1zcnOIOiZIf5ZJigqxfK7GSCyzKZlTEV67JI/rNTXBNCUjGSnLIfICvmGcAW kPv2KXww6XhoSkhp+oajsD5H9bIvqF0PAIo47fhNhPEWzuNciXZiClvDExzdf3iYMV6X nz2/Qb7N5Tkf+GVLjd1T9rluUd/igqO+MqhyKmVuJWlr9l8edi/6zkWDn7xA9SR8Mqcz 9yJKT9BJcDK0wlS4pfr+zLZhNG7O40U9U9pBjVsUSt/ChfNItuzdhVpQIZ9YjTLgO/np zGXKcuwlJRQyyzIdNW5CYW86hGsaw7aNvu7RZxuTbfUsQn2cNMhZ6lyUL/KZvziTP6pu +s5T7xdp/4EcJwMWxbO6zQGlWofq890VWfEwIrXgCGSmu2XoEtrtDsGQ4oSfKkFJ4WcW lvTLR7dPHxrXTZ80HuNo08bxAT44mQ8emhrE8bE3+Pz2EdmYvOCKv9B8YisFH5iqxsF/ 0R5O59403GDtbfx3//gnd/HP5IWpXhjf3j7+lD4ytzh89ND7ZUBoLPzlv7h//USIaX64 +NinQg7fPvZm/kudy+KDWzJ4cPvIX3pIJ5Sph2ST+GMKyjlWOrWRgoLFkmrEM65ZUe6H uxmmUjeihmW8sB1hdVulEcKALF6KtKlhMnJsWdi7OfWyi4Y/1Q3Jb+pCZHchQIkSqTiD IXH6ziPTHTG0EGxDqVAO+AIlR+oBJJSOtt0RXKXvklYw5Xsuy6bFECrB3dHRVaZbgFm1 1mANa1FHLeDirnp68hXGje6uanpd9vm7xoaXwTPuyPM3/3JRMiU09RNL8fN37R81/FPB ujEydrHYfY/HPH+3w+fvL9E3xGnV7yuZod/gZ6F4arT2bu/2zB3rXf+ZO6qW7VOjSXnt NDUq1k2NkhNHPXOblUU2EgoohHde/veV3Fny/DljmTxzs2jmmZvt+Fk1eBE/c5sYzOb+ EqJbYilYr52HPEWJGTVnxno4sYbJXOa0YZJnwkTwa/SZm8xCumbNmNNaMJ+HRVi2Dpgn S6ZG//vipzffv/jw5pe30zjFO7WyxjuCOkrhFM2OFtO/h5S+FeFhGzbdYAmf1B4lEZ1n 9GZmR6MfwOtccGON6g6zo64K86WJnXFmQwpthl7cbRf++t0lnelX7rb9+h25PdbRXZFe 3vBGfnyIZ0QTvQydeUZn7sUVvZ/72tyTkGs0PDNUxSzwYIBgBg2Duw+/uEr8WfTiaiR/ /OIq0ctVM2dw+sWVmQFfSWdyYuUtFf1g2a/f+Z9c07ilX9CZmWtfHs1ZMtPcuwc2Temc QJLtmGrsBSvatBElxwzVTHediwPBZqxHJ06OMT5tGOeZMcF+uVUHqRzRhJIbrk345n/q UgrvCmVuZHN0cmVhbQplbmRvYmoKNSAwIG9iago0MTA3CmVuZG9iagoyIDAgb2JqCjw8 IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA2IDAgUiAvQ29udGVu dHMgNCAwIFIgL01lZGlhQm94IFswIDAgNjEyIDc5Ml0KPj4KZW5kb2JqCjYgMCBvYmoK PDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA3IDAg UiA+PiAvRm9udCA8PCAvRjMuMSAxMSAwIFIKL0YyLjAgOSAwIFIgL0YxLjAgOCAwIFIg Pj4gPj4KZW5kb2JqCjEyIDAgb2JqCjw8IC9MZW5ndGggMTMgMCBSIC9OIDMgL0FsdGVy bmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ2W d1RT2RaHz703vdASIiAl9Bp6CSDSO0gVBFGJSYBQAoaEJnZEBUYUESlWZFTAAUeHImNF FAuDgmLXCfIQUMbBUURF5d2MawnvrTXz3pr9x1nf2ee319ln733XugBQ/IIEwnRYAYA0 oVgU7uvBXBITy8T3AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahIxrP27i6AZLvbLL9QJnPW /3+RIjdDJAYACkXVNjx+JhflApRTs8UZMv8EyvSVKTKGMTIWoQmirCLjxK9s9qfmK7vJ mJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFcmCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAUmV/M 5yahbIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn5IoEiUliphHXmGnl6Mhm+vGzU/li MSuUw03hiHhMz/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbmaPm/2d8eflP9Pch6+1Xx JuzPnkGMnlnfbOysL70WAPYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTenPMehmxeksTi DCcLi+zsbHMBn2suK+g3+5+Cb8q/hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzMDA6X z2T99xD/48A5ac3Jwyycn8AX8YXoVVHolAmEiWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1r FGh1XwB9hTlQuEkHyG89AEMjAyRuP3oCfetbEDEKyL68aK2Rr3OPMnr+5/ofC1yKbuFM QSJT5vYMj2RyJaIsGaPfhGzBAhKQB3SgCjSBLjACLGANHIAzcAPeIACEgEgQA5YDLkgC aUAEskE+2AAKQTHYAXaDanAA1IF60AROgjZwBlwEV8ANcAsMgEdACobBSzAB3oFpCILw EBWiQaqQFqQPmULWEBtaCHlDQVA4FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0GroIXYP6 oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfCy+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAs hV/CkwhAyAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAOpBu5jUiRceQDBoehYZgYFsYZ 44dZjOFiVmHWYkow1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2EZuNLcRWYI9gW7CX sQPYYew7HA7HwBniHHB+uBhcMm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz8GJ8Ib4K fxx/Ht+PH8a/J5AJWgRrgg8hliAkbCRUEBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthB vEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9Jr0hk8k6ZEdyGFlAXk+uJJ8gXyUPkj9QlCgm FE9KHEVC2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9RH1KfS9HkzOX85fjya2Tq5FrleuX eyVPlNeXd5dfLp8nXyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9hUlFmqKVYohimmKJYoPi NcVRJbySgZK3Ek+pQOmw0iWlIRpC06V50ri0TbQ62mXaMB1HN6T705PpxfQf6L30CWUl ZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOMu4yP8zTmuc/jz9s2r2le/7wplfkqbip8lSKV ZpUBlY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6rjc+nz3eez51fNP/k/IfqsLqJerj6 avXD6j3qkxqaGr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1BFrlWue1XjCVme7MVGYl s4s5oa2u7act0T6k3as9rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9YL1+vUe+hPlGf rZ+kv0e/W3/KwNAg2mCLQZvBqKGKob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7jWyaw iZ1JkkmNyU1T2NTeVGC6z7TPDGvmaCY0qzW7x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtY i50W3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rEmmtdY33HhmrjY7POpt3mta2pLd92v+19 O5pdsN0Wu067z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R91RHr6OG4zvGM4wcneyex00mn 351ZzinODc6jCwwX8BfULRhy0XHhuBxykS5kLoxfeHCh1FXbleNa6/rMTdeN53bEbcTd 2D3Z/bj7Kw9LD5FHi8eUp5PnGs8LXoiXr1eRV6+3kvdi72rvpz46Pok+jT4Tvna+q30v +GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYEVgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQW AkL8Q3aFPAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVEQ8S7SI/I0shHi40WSxZ3RslH xUXVR01Fe0WXRUuXWCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj7OIK4+4uM1yWs+za crXlqcvPrpBfwVlxKh4bHx3fEP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543xXfhl/JEE l4SyhNFEl8RdiWNJrkkVSeMCT0G14HWyX/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirAr XTM9J70vwzSjMEO6ymnV7lUTokDRkUwoc1lmu5iO/kz1SIwkmyWDWQuzarLeZ0dln8pR zBHm9OSa5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5rDq2F1q5c27lOd13BuuH1vuuPbSBt SNnwy0bLjWUb326K3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5sxWwVbO3dZrOtatuXIl7R 9WLL4oriTyXckuvfWX1X+d3M9oTtvaX2pft34HYId9zd6brzWJliWV7Z0K7gXa3lzPKi 8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9qR9Wn6qTqgRqPmua96nu37Z3ax9vXv99tf9MB jQPFBz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9nf19/RO1I8ZHPR4VHpcfCj3XVO9TX N6g3lDbCjZLGseNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf754MPNl5in2q6Sf9n/a2 0FqKWqHW3NaJtqQ2aXtMe9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4VnJs5n3d+8kLG hfGLiReHOld0Prq05NKdrrCu3suBl69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N1h67 npZf7H5p6bXvbb3pcLP9luOtjr4Ffef6Xfsv3va6feWO/50bA4sG+u4uvnv/Xtw96X3e /dEHqQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V+Ndmqb307KDXYM+ziGePhrhDL/+V+a9P wwXPqc8rRrRG6ketR8+M+YzderH0xfDLjJfT44W/Kf6295XRq59+d/u9Z2LJxPBr0euZ P0reqL45+tb2bedk6OTTd2nvpqeK3qu+P/aB/aH7Y/THkensT/hPlZ+NP3d8CfzyeCZt Zubf94Tz+wplbmRzdHJlYW0KZW5kb2JqCjEzIDAgb2JqCjI2MTIKZW5kb2JqCjcgMCBv YmoKWyAvSUNDQmFzZWQgMTIgMCBSIF0KZW5kb2JqCjE1IDAgb2JqCjw8IC9MZW5ndGgg MTYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AdWd3Y/cthHA3/VX CHYv3o17sihSX+5LvpqHFgUc9IA+5PzgXs72FbGdxEbaP7/DjxmKs6IorSSsEwNZ3u7s cEiKvyFH1Oyv+Q/5r3lblF3T2hd4rfu26Cr9RusKv93n/8rf58++/Sjyu495af59vIOv lkWl7N+60JeFgC+qvBVl0fdSZnfv8m9uQKoUZZPf3OVKGmn3cvMuf/Z9VZS5yG9e54ff X/388NOrTw8f3h/zm//kf70x1oVViFoWQoJtYQ2TevO4Om9xqYq2lspZLDpjp3thdg70 QTO7UvZVBW3satWXvpBBB3Wq6FTT9HmjKxJS5kpVRd3koipa0fdtDl372nZgPtWhTS+L Sg47FIZMdyh0hR4O92IMFdihP+aHF6+O0LmHN/fmBQyv80Pz3Lzkxwz++PGYq/zQvTQv 9vPvjvl1lR/sV342H9jyp2Mu8f2fjvnL/OZvbpAyNkhw4ciy76DZ1uzcXgdTxh6wVzN9 SYb6qrYuVFu1XB9cV2UX74XMXFbQC/8Ey3WLfoGWQW+8tS/3cJnpP6Fi6IK/u1a7N+Eb 8fZJ2RRtB1Vv1D4le2hJ23B9pn0Tw0wNbJ6Z8RXSvVZ2JIUd6aqxf774R9Ao1sm16Iq6 arwRbirMGjSYqTAVyrrrNA8KWfVK6MmDJTcZZKOxUlZFB9cyfKravu9ruIQL1ZWlErWd DzBtkpKZmTk0wUipm2BMY121hSqHlYtCqbI089XVTRpN3U3XFU1rZqwsSpWTvKmX9JEY fY4Fq26GYNhmIoXvHYQF14hMwRqXU6XtzEgsw3Ru/oszVUBf93AF5M1Z6v/78OktsmDU AfSFkjD1QuWrHUDTApi9y9rcAdTQKXXoAKqylLMdQANYh8vRD9UfwwE4szdzAKG+yzuA 0J5ZrBxxcN4BhPou5ACcEXs5gKYtLVo94mypK5kDmJIkXLsVFir1DgCcC2n0HEY5oibV TRqtA6iborZLtkkHgGKkDwsc11FB5gCQFL53tAPQsDjR6JiCNRoHsIgqqjEj4akyZ50+ 3wGcpX6uAwiVr3cACjrcL7E3dwBVXbTgX87eAVRd0cPl6Ifqj+EAnNmbOYBQ3+UdQGjP egcQ6ruQA3BG7OYAJGw1NFo94qA0tgNoJiQJ184BoKh3AEON3gGgHFGT6iaN1gFUsA2x S7ZJB4BipA8LHNdRQeYAkBS+d2I7AJTEGpfvAIQyI+Gpsq0DOEv9XAcQKl/vAMquqPwS e2sHAJuLopFSnesA6h6CDj5ClSKDjanNDwH1O4WA0OytHADTd3EHwOxZ7QCYvtQwzw0B tYtCQGjEbg6gbCxaPeJsidbrGAJqJiQJ184BoKh3AOM7AJQjalLdpNE4gLqvCtGbGTvl AEiM9GGBOYC4YOgAiBS+dyIOgCSxxsUOoO4qMxLLHMCbh9/v308FaTAExNSvZnTdNiaO 7szdnNGw81U26Edh+iX7qboBd+qDSKnJ+9kw2pm9GaNDfZdndGjPekaH+lLDvBOjnRF7 MbpulaWfpxBxkvFqQpKIahlNShOMJjkCG9VNGi2jG+h9fTNBqUlGoxjpwwJndFSQtRlJ 4XsnEqWpURJrXBylqWu4eQh+aC9Gh+rXMxpGQoe692J01RdSrFhHy2oY50lN3klGd6e3 UkW58UK6g1uoCm4h187uzSAd6rs8pEN71kM61Jca55mQluWyhbQzYjdIw3ECgz+PIQIl A9aEJCHVQRpFU5BGOSIb1U0aLaRhOdi16YU0ipE+LHBIRwVZmxEVvndiC2mUxBqXL6Th 9rkeiWWQ/vf9q7sP7x/ev5laTLsjL/oG/aCG9ZwWwkSkd+K0gmNEcFrn/HhHCYdAfDgm NX8/H047uzfjdKjv8pwO7VnP6VBfapx34rQzYjdOl70m4GnEWwiGrLggMdVRGiU9pSHe jfoo3F2jGJENYGgESZ9htOrh/lT6dieJkTosMEbHBcMGEyaSjCZJrHExo1VXm1HYj9Gs htWMhgNSOmiMXmXreIeCPaQ+pzmMSVd2fNKHPFXTDWMxqYm7GNBip4U02r0VoJm+iwOa 2bMa0ExfapznAlosWkijEXsBWsGRVYM/jyFbOolIT0kSUi2iSdQjejQiTXJENqqbNFpI N7Ko07ckFYqRPixwSEcFGaSRE753TLTjRJ3DCVZnQx2zgQILXT0Gy/B8/79fHn4zp8Yn 19D21KAKq1jPZwXnSv0idXM+w/bRHJV1F5Dp9NndKethHCY1bz8fPju7N+NzqO/yfA7t Wc/nUF9qnHfiszNiNz6r2pLPE4gYyVg1IUk0dXxG0RSfUY64RnWTRstnKQpp11NT0WiF YqQPCxyoUUHWZuSE751RPqMYVreQz5UwY7Ann8Mq1vNZ1DpYjC5lcz7DttE9JODvF87m cwnubqObhWOB6Gqv9bOzezM+h/ouz+fQnvV8DvVtxWe1bP3sjNiNz0Ja8nkCQWkQkMAD HSouSCx1dEZJT+eBPgpwkEKCGlZM+gybZd+bR+gSdwpJjNRhgbE5LsjYjIzwPTPKZhTD 6paxWXZwV8zDZBKcX8ef3YEzZqpq4Um0Jfom1t30fKWE21g6Guyuv61BLCEW4Q7rLwex bMUwyJKaoIsXynuBGO3eCsRM38VBzOxZDWKmLzXOcxfKy0CMRuwFYtkJizmPG+RhyKUJ QQKnBTFJToOYxIhgWDHpsyBu4IFze8hqapEsUYzUYYGDOCrIGoyM8D0zBmJCCVa3EMTw +M7gSe31IF6gbxaI4bTH4NH8zUEMj0a7Q/NngBiegx5EU1ITdDGI5U4rYuns3gzEob7L gzi0Zz2IQ32pcd4JxM6I3UCs4KH+Obf8ZFyQwOlAjJIJEKMYESwCYgnh2vQtP3hmwYqR OixwEEcFGYiREQkQoxhWtxDE8HBM+MT0nEdbPr29n6Co0OEECYkfZKh8kvIT+vzyGM52 6EDvXstjyG4CJwjPu88nS8jmAQfunG2p2fr5UNnZvRmVQ32Xp3Joz3oqh/pS47wTlZ0R u1FZNBZmnj0IRwapuCCnMkomqIxihDOsmPTZ5TGkR4HnvFInmiWKkToscCpHBVmDkRG+ Z0aXxyiG1S2jcgXP1ISPMW9IZaZ8NZWrLng8fuu1cgUpR+BA39kn5HRapEFMJTVhPxsw o91bgZnpuziYmT2rwcz0pcZ5HzCjEXuBuYIAscGexw/yMeTUhCCB1C6XSXIazCRGRMOK SZ8BcwWZQ+DhLj1dp+IWJEbqsMDAHBdkDUZM+J7RYNbp4040OqBgjYbNS/LMVfD4S/iQ 8ZZ4DpWvx3MdPLy+OZ5hg2jObLrLx3hDOzTpw3EVnI0fhFlSc3Yxm9UwlPGtTWT34R28 Qio792KT9r23WftgE0LZ/kT98pgNsttBGoZhFscK7ru0JeQmxDYkOJ3p3I0TmxxNDpO9 j+kb53R2ksPw/Ox92WgKScrex+xJcDqLpaSk5E1MX3zMs2ffD5M0xrL3TWXrUx2cV2vB ZKx0sDsDRKUzQz6XcLHobJD2BcZP50J8of/KDvMSBWLVk9eH9UbD62MyUaDOgom3Cqsa Qoh61+rBFyFzXJBQ6lwCSjKXwEGKYgRSrJj0WZcAuUR0zqCBS4Dbgt0Jl1GM1EHBCFp1 dC+zigoyV4Ro8j0zoNNAnSOYr1dnkrK6ZjCsgoetdf9TFledLxEurdp+177YCQt394hh X13Vt4c/m4yU11+alz+Z/98en+L7V92jp7fHq/5JffXUilxf3R6/PMLVcugf3x4U/PXk yn7tad9eyRqkb4+Prq+6J1be6jeij63c1e3hCUh9UVwbldlBTE4gne6phYRjVdjKoG25 gRG0zV3FVxN3TjH3bQWhHHOm2vYa90rDuc9mRSyTrJsT7gqG/dfJkcDZIwq7a5OF0I/o SBrZUwSPpZGlIyehY9G5VK2z+Q5YUmWL8sgyTyTw2cfK2b1w8RnNI8v0jXsiO/hDUE95 oky3OpVHlrXPe6JgXLKEJ4omR/aeKOyvuCeC/MvDBsY80XOTK1guyyOLnTzmHtglxiZC PI9s4B5EO34kEDLKMlxOSBLQ3fRCUe8gbI5aq9GjFeUIrR7FmJnWugg4eDN2JJDrQzHS R4Uw4WwVFWRtRk54u0ZdBIpRdUbK6kq7CHAPdgwIKGP7BTvaPtE3JBCMg1TAA0tlBcmj R3VnqSTir397dadTiIN/iC3YRAOPOsmeKnBUWb0fEbAm2/GwoYB94NmHDQUswuGw4W5B fNhSMPJjpvDzMogj+dHuMYgwQBNERhKs0h6E6UuQn0IpU+RflUGc2TOL/CPtI/IzfSny UwPj5NfufSH50YiF7npyYzDMIC7gOT7DVM82XwroOyVJvLTkJ1FOfrZGJzkiJtVNGg35 BRwr0ydBBpsDm3E8BDqJkT4sWHXkcuKC5MNcvY4TZJcN0Z+oc2JY3bJAvoC0JoMDh3Ch jZHfTtHF5D9L9xLyhxWsJ38dROL5mj/4lYuB64MLPrbmD349QsBeBU438hsFvR33GV4a ApaDp0hTUKCN3OSy3/96hGiG8F8ajIIvzwlGCdeGhCOYHYxi+sYdAVumrvopiUQwitmT cATpYBTTFx/z4YYUGphwBMvyCKIRuzkCeJzPINajDkqDU+IYStI/GxMRJGg7N4CS3g0M 9HkYoxjREysmfRbGEKmZcdhRoBipwwKndlSQOQFEhu8ZvbCHewE914iSWCPeNJiPF4ig DA6vjEdQCCpfK4gLQLAkPzw1BfhJmcdHvTHOD7cH/Kg9ZlYGIi5QgM++wgK9U+M7/muw 6IefHMkP104hhIqg/dkBAkTm/duj+Q5s06nu0y9TBV76kdN3fdS/dJMfSOTUcv8lNMLX 4D9rjR0i85p0OBZszQ++WWQsVecVeIts112ZDgPTOtTzJOiDXAfkTB+cmkwD4urJaECw 38gAbxwN1RdaL4xmYSqGxSK223VxdrCjkE/H4ySs6UrRSrj67NXkQB9cTZbHFGvUvRfb 5NHRKiFcEHQkHsf4TjsI+3M2Md8cxONESXkz6MCrn2UzfDNkHTbxPNpBj+V1Z4ZG0vqO heTaE9+cHWbfKNJfnnGjSLg2LMR8NDzH9I37Zrb7S/jmVeE5tMdekuvDc6jP9VfcNy8L z/WwtIT5N/NnntCIsQUVu9zYvJgXnoPff7L3RrwHghL40hKiEOEmbUKSvJrzzigaeGfS 6N0zypFTo7pJo/XPEP/SWab4Jo07SRQjfVRgu7moIGszYsP3Dvpna6BvCkpSjShoNaYR A0eudN6weoyodhbRHQ6YRaeOFj0HehTv0L4xzNeee+CrtOeGt/6CjsiLowLyUeRX6B30 a+Q8hprdUoCEUR86GDSU1PbON1nBzPtWkmD1eTdJEqf+knxtdfrZiQlYAXpFtBX/FlO7 Hwm+sFHw62OzhjAXZvcDliedIqyLtdNR7pIY2bDCbQF302uwYf3h/+Mt7DUKZW5kc3Ry ZWFtCmVuZG9iagoxNiAwIG9iago0MDg2CmVuZG9iagoxNCAwIG9iago8PCAvVHlwZSAv UGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMTcgMCBSIC9Db250ZW50cyAxNSAw IFIgL01lZGlhQm94ClswIDAgNjEyIDc5Ml0gPj4KZW5kb2JqCjE3IDAgb2JqCjw8IC9Q cm9jU2V0IFsgL1BERiAvVGV4dCBdIC9Db2xvclNwYWNlIDw8IC9DczEgNyAwIFIgPj4g L0ZvbnQgPDwgL0YzLjEgMTEgMCBSCi9GMi4wIDkgMCBSIC9GMS4wIDggMCBSID4+ID4+ CmVuZG9iagoxOSAwIG9iago8PCAvTGVuZ3RoIDIwIDAgUiAvRmlsdGVyIC9GbGF0ZURl Y29kZSA+PgpzdHJlYW0KeAEtjsEKgzAQRO9+xVwEe1k3xrjJtdLehYV+QNBDQUHz/9DY hDm82YUHc2LBCSH2kxRkuiDkh/shtVwrPjjQz8kgJvA/KWaVaRjLfZfAZLI4QtiTC9Y2 ccdT4YpRoTv6tyUDA93QtQ/oFy/NU5YfwFUekQplbmRzdHJlYW0KZW5kb2JqCjIwIDAg b2JqCjExNQplbmRvYmoKMTggMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAg UiAvUmVzb3VyY2VzIDIxIDAgUiAvQ29udGVudHMgMTkgMCBSIC9NZWRpYUJveApbMCAw IDYxMiA3OTJdID4+CmVuZG9iagoyMSAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1Rl eHQgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDcgMCBSID4+IC9Gb250IDw8IC9GMy4xIDEx IDAgUgo+PiA+PgplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAvUGFnZXMgL01lZGlhQm94 IFswIDAgNjEyIDc5Ml0gL0NvdW50IDMgL0tpZHMgWyAyIDAgUiAxNCAwIFIgMTggMCBS Cl0gPj4KZW5kb2JqCjIyIDAgb2JqCjw8IC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAg UiA+PgplbmRvYmoKMjMgMCBvYmoKPDwgL0xlbmd0aCAyNCAwIFIgL0xlbmd0aDEgMTgy ODQgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB7Xx7YFTVue9ae8/7kdkz k3ll8tiTycwkmSSTyeQ1MEl2kkkICY8QAiQ8JCGDBkQEQXwisRjBoKhtKb6qtIK0tvcw gD2FHtumHmvVA63W1tPah+CrVEXQ24dYmdzf2jMDSPXe+8e956+zme9b33rstdf6Xutb a++w8brrVxI9GSM8qR65Zngdka/Ax0iWjmzaKKbzlhsJ0Tx65bqrrknn3U5CDP1Xrbnp ynS+9BFCCv9ldOVwIp0nnyKtH0VBOk9rkZaMXrMR/bArsAbo7jXXjmTqS/uR77pm+MbM 88nvkRfXDl+zEimuGbOAxHXXrczU0wFCzEWHUFhOCblFQQgHempqagvGSfJB9/bnEII6 4iWTpJLsJio0EUiIYMTaJeYizJfK9cqP+yqUe5LLTbG/ErcGNxBy9J0Hmlj6fFP+tr/U vt9j/9B5Blmt/BBWgX7VD6WihDgW/6X2/F77h3JPrCZ7eY8Skaae0jppt3iEfpIlzmWJ j7PE37PE37LE2SxxJkt8kCVOZ4n3s8R7WeKdLPF2lngrS7yZJd7IEiezxIks8UqW+GWW eDlL/CJL/DxLHM8Sx7LEnixxb5bYmSUmssT2LLEtS9yZJZZkicVZYjBLDGSJ/izRmyVm ZYmeLNGdJeqzRHWWCGWJyixRkSW0WUKdJZTSlCy5v8j4Ixl/KOOzMj4j49Myfl/G78r4 bRm/JeM3ZXxSxn+U8Wsy/o2MX5HxcRkfk/GLMn5Bxs/L+DkZPyvjZ2Q8KeMfy/iHMj4s 44MyPiDjfTLeK+M9Mt4p43tkfLeMd8h4QsZ3yXhcxnfIeCuw1Nwtjsm5LTK+TcabZbxC xvNk3CvjLhm3yTiHYVPriKKVFAFCgBbAXMBywLWALYB7AY8BDgB+DPgFwEiW8+/ClMb4 v5D7AHsAScAk4CXACcBZgAa9RtBrBL1G0GsEvUbQawS9RtBrBL1G0GuE6DCGWrSuReta tK5F61q0rkXrWqLGU73kdcAZAE9MwEWAFsBywGMKr+RVnn2DJs9Pnucmz790/sT5s+cV 6YSfnHpp6sTU2SnFuladwodhTwK/BDgBOKvwSQbFiR+d/REnI1OrWeFBxx7mhbgBtDYB nwBweKyO5RWap6jJT02tboVazquAt3AOue0jpIh7hIQALYC5gOUAFXkd+AxgintEms+/ fsLuyP/Vr4FuudXuvuVW18u/BL3pBqBr1gGtuRbo6rV299Vrt1yXt/H6XFv+VauBrlwF tHI0171ydHx9nmuD/eZ2l+cmgKs1zH2ZPAjgSD5wBaO4B7mHuIeJgbuH28ndi3SC28Hd TQzEzT1IdgAwJeDHAP8G+B1Awe1Dm/3EyD2Ge7+B9BHc+ygxTp3idh7K9UaPgniIEa15 3Je4zRBxkLudu5Uokd7G3UwUSDdn0pu5RXL5DdxVcnoVt+iQMige4dYdcovRH3LXoZ61 X4tyBStfdDgciWpbW7n1xAV4EvUoRJtVyL0G6hSA5+7gbgJHg9wYUnb/FqRsHLdk0pu4 hXL9jRxb9YLcJqSs/vpMuiGTXplptxEpa7chk17LLTykDpa19iJPyZ0Mc8u4K7jlYOE8 ro+bj3QON5frBSv13BzAPKLjlpHpoAdBbwJcj/zDyH8P6W+R6rhVuONqMHQEPa1EOoSe ViBdRWLcCGAIsAwwDzAHEOdiMtfaOTMEFeSkTL4ZeTbrJs4MrnW22lBOSSfwcwCOm456 NeqjSBmXGjLtPWivZlyOHLLao612LpSpqMqklUiZGCsy+WAmLceNyuCM1jbkKVEC7wNw mG6E9AASyG0EKLg2TpAf3YqU9dSClA19Wqa8MZPWZ9K6TCpm0lqk7L5wJq3OlJdl0lJO wBQmWtciT0ke8FGuBlN2cE7OBaHoOQNnRKrhtJxOFo4GwtGD+Q6MVgPh6CEcPYTjgHA0 EI4DwtGg3os7fBBGAXoqQpqHnvKReiGIAkAewAHQAzQkRufT2WxmdE4mXUiXMqHQBZl0 EVJW/xr9FXxbkP4mk75NT7AZ0pOZ9AR9T86fQcrav0/fA6+lI0i0OhjbJFUcCoczBIzm yNTkUz8rEqNowR+qqIj+gPIsOjpUVOw9ysjDk4WF3mxhQUG2MD//QqHbnS3MzctQY3pr hpK0OlAcpYel3h2gKHpkVKsOhYTMJUWsiKUYGTnUu0AeGTns9bIRke8XFEalU263PMw/ lfiiC49QjWSlf/iNMjj91Z5XOSmpN0Z/MqkMYh5Sw2NWa1R6JFQdfeQhGnz4IWXwofsV wW8/qAg++GU+KP20Ihz98v18cPv9D9zPaUecIz8b4cURowmdn31qRpEv+h9HqE7Kpw/s osGGR+nXdnFB525/edSxmwq7WqTob3fRp2k9rcB6EaTVh44rgkdo6NAxllQeOs4jqWCF T9NZtFtu031oizJ4lC6h/bArU6uL9mO6/YSjd9LtsnC2IWVCviuTbqf3yjfuRMrK7z08 rgy2tBroHkLpz+kxufKXSGGG9GV67JCKSVZ9qKYmypIDGMPU5OE/Fspilcy/d+ZFX3iR D774vCIoPe8pZlw8/LzNIafPgZss/5w9j6WS98eV4WjvPPBpHvj9Nqb11pvIvFleHj1+ DBp0rC0utz8WCLD0+8ccedFn3qWYtfbQa/KDpci7Pl/09Xep9Ky7IHr4oDJ4EIKRJpua opMHFMFXDiiDBzbDXb9msUd/+kMq7qTCTsqGsKO+Ue56RyAoD6VmB/q++x5l8J4JRfCu CWVwAnz8yxk++NEZZfDDMS54do8ieAaskd6vqY1K7+NprJs98/rSaceMdNoYk7vT74Hg X99D9+BO1u6r0H+k0q/GwJ/bt9DgbRjVZjziNOA3W+iWcV/R9nEa3Aa4A0/ZCigbj47P HOevHKed47R+nPrHqbvB5qy32epsllqbKWIz1Ni0YZuq2saHbKTKdu4Tk3iu+hznD+SU BkzlwZyKoKnYm1PiNRUW5YhFJqIUlFysKUcf2xh7MMabBLNBq9MbVGqNgVcoDVggDCo+ UbSunJrKqd7UY4KnmE7i/Eb+O+R3JpWe6Hm9aTqZrh3kl2g38Q+Th7UPmn5LDEepnhqk cpObFhid6jyjTXAYLYpcY+jcteceO7fn3C/OvXRO1XJOOnfgXPLciXNKcoTqD4XOhX5A 9aSF6qUqxT9i52J/j/01VhErj5XG/LGSWHFMjBXG3DFnzBazxEwxbUwV42Mk1hvpp0lL D+npb0taKdL5bclIsOcIL/Yla4I9SW3vkoGDlO4cRGmS2w577k8qth/hkFjaFy8ZOEJd rHrcfRTqTZI9Q+P3DAaDBclEz/yB5FjBYLKGEfcVDJKeZM28pNvbFvy8a8PG6+VipBs2 phtsCG5IEwdL/R3J8o7hZEXHUDyYLZXr6AZc6faZu4LZNH2vjNFnNneByBZcTDNVLKFy KdnIOtvIHrjx0l43fN4zcAe52NdncnKP2Vll2pDshNP5TO3FHr7gns88ARn5Pspw0pls gewub3BQy4TY29eW5NqX9iQTfT3Jwt4lQ8k8b1tP8nnk6nuXJA3eNoyHsRIX0o0brgdi IJccJFx7/0GOIRXQkiUDrSM0RRL0E8A5wMeAvwP+BjgLOAP4AHAa8D7gPcA7gLcBbwHe BLwBOAk4AXgF8EvAy4BfAH4OOA44BtgDuBewEzAB2A7YBrgTsASwGDAIGAD0A3oBswA9 gG5APaAaEAJUAioAWoAaoJRWJf6S+CjxYeJs4kzidOL9xLuJtxNvJd5MnEz8MfFa4jeJ VxLHE8cSLyZeSDyfeC7xbOKZxGTix4kfJg4nDiYOJPYl9ib2JHYm7kncndiRmEjclRhP 3JHYmhhLbEnclticWJGYl+hNdCXaEjmJywXz/ycP0/uvuIjyHgQwRLkAZzLB9KGJwgE6 c/FPp2lsr76Oc52z2fJU30Uadx8kRr6JGFkvnG3qLHeCCFN7Lm2Rve9iyqNNOsfOehjg 8IiQNrKZJbhG0gnS9FkTi+G/+Hrmi6u+sObn5AXyb2SrXP80OUy+m2n5XfI9Mk6eIU+T 9CnZIAKiO8ge4H6ULCYzyQJyBVmF1uvJXrIvc9cKMkTC+EdIMzg6kSl9kZwi/0o/RbuH MyUXk6/gKdeRI3jSw6Qb/TWT+zHbr5LvkMdID7kTuYvXqzJ5ghsmq8kGsp8kcW+CjMql s8ntpIssxdg6yUKMaS2evpgcIE+RleQgeRDlT5M+8qjqR0TDbWSSmvqf3LSp/0l24O6v cRuxv9vJj5GN5FbyKPkjwZaf3Jt65n8vvYsD+0LqPvIAZnEH2QmZLuab+F5+6IJsv/Cm TMX3wa+fgDc3QipPQC6PkvuojzxEtpHN1EC+Tp6mNZ/hzv+pv8+r/z65G31/9vp3chR8 2wf57gTHNkAu38Loez/bCMeOpVQHvVlNFtMc8glZfnn9/5P8OujCjdC4L+E512HmAzgx DZPrkY4Crs8+AyFwM9kOqT8Op/gWytvIbWQt9dBq8hzZTp3kZrT/Okq/Sn5Aq9F2A3mK lpJzsKolmOU/XfAHsEvZH6BOQ6id/JzZJv8Ja8q/m/UHLMd0hJaQ5wm56A+olxqhb98n T+L53yQPUzflyV/JSZKiIZoPyZWRlwHPgW8/ID8B/95HCyf5T7bvuPy6fCy4Y4dypewn 0PSfxwJtv+fSscAu9pNHYF+boUNPwdZ/Qr5M/hXp3cjtgQXtJv8DOvAEdGkMY71wKReT CHhwFcMyD3LIv2f8E/L8JCufennqOKtNY0aldl6gfw1r/h3suRe+4r+v/+bAfyEHOPWn bypf52YqTUo69Z7iSbUitYT+FQPYB4v/CvAt+HfV5w+IP8+fUh6Y+kD5g1Sb0qwsSa1P 3Yq17D/Jb8kvyE/Jm+QV8mvyIvkTX83/lD/Jf6QYUqiUx5XfJN9TVJEbyNcu71WxVjGq mKfYq1isqFIGYEH5ZDb86iKsVUNkBbkafo0o71OHFV9WLlQm+I/4T5QPoI818Ht3wjd9 BZ6MSItXJpZfsWzpksWDAwv6+2bP6ume2TWjM97e1iq1NDfFpk+LNjbU19VGasLVoarK imB5WWnA7yvxFnvEosKCfHeey+mw23KtFrNgyjEa9DqtRq1SKngceFRQZ9LZPtCxOulq H0LsHPcKYtIw5+zsUJJY3B6vWYyEBiszrZLKYJJYe5K5vQMHidQ4mFQFL28yJ8n7hI88 uHm2W+xIKnz4ebuHE8nSvgGPV3jVfaF+EN0m89oHPB53kvPhNxNV+HUPi4mk0ItyVMgl M5Okd4DBkak3GlFIGj2DwH0DycJsdpD1lp7KJYM8Ct80edkw59AJ4aDB1R5PktyDxPBG kthYs7ONiCdiyVJsC30CKLk3EkrS3I+S1JqkttmY0mcfwW470fg5POhIrPZ2JFaBo4mh izw9m+aoR5wQJ/oGzBG3xyMPGjuXeQMH9bp2b/tKHWaBrSUKyEGdHiV6VgCxrDtIDc1U JjhDx7SDHNEYwT4LG24Hg9VJaccQCG8cfEON9WINThbuvrSK4LZ0I4JmMkXlZyZV7Ul1 ehDiqqQ0nCQ7xIMVkxN3HxHIiqGgIeFNDC8dSPLDGNRBwvs6RvuT+T29i1GEQQCGRkUm 7riMmPDEjlFxAnnWdgjYG8etny1PjK4cYmpCh7xx1GnbB7Z5Jt3Yjg9s60iag0kjbjfe /Jabn+hwrhJZdmJim5jcM2/g0loPawMlcFZWiBMdXjwNnXWsbmMSC10Qm6yNMxOycKQd w2JybMVq8Ay/4buz+u+ZEJKGv3kgHcgHdzLrYAxmkBhazaayGncqkIgTO1bKU71bnhr0 VexYHWfAboT2kwW4e/FAx6i3A/zMPBAMwf287/J7PZ6kK8hunJjoYEMcTmD0jDP4ubAj xjDSGdiEO0gxnvak1C8npF+WAZ4oDccHM0WZBqhRQA5JaSg+OMgmlRZAUu3bpqzyihOs U7UvmRsUPM+ibrKyoqdvoCPOtBMtufaBptNO92nQPb0XiqkTbSZCpxmTWM18b8+8tBaM Mv4wNNSfNmBwLSN5NM20l3s97nQfTz9h6UCnt3NoYqLTK3ZODE0MH5kaW+EVBe/EQYNh Yl3HkCibP0X5D3a4k513DyaFoVE6TZYQezwmx/s6sfu3zlvCRNUpjg6jBL8Wr6fR7TFf aAMv8vnVGZuD9sMGmM1NCO9j9gZ4J7fYyVwNTmQb3UmhkZksBrRgADYxgkd0JGQEW8HB EOdmVsMP+jpWzc8wy+3BI2XlYT5wXqYUnXg8zJ52HJHICmSSY/MG0nmRrHAfIlIoCDkO sZrJbI1tAasZy9ZcuH3IC7k52cGUrB9fpN/w7Rd0e8LstYhR5tgxOvxmJpKT/Zjjx41J DTgmi97aPsC7OdYEFOfmGaULYnmIJR1B+UbGE3jMCcErvuRNCsGksn1g0h0bFAUznCVF my40ZJoqvOR9gTI/SnKFJI0lqZ2VE/hVcA9+39GIyguKJHZMDGUU8NJpoSlrnRi9YErp wcN22dwwe8EL03Wn2WC2eNkMjzGFzy4Mvk5mVxCJzKjuwWQOW++SOe/LCON1tw+I8ESw 3HkyIXaIo0zYSXEoLruEQTerzxYfmToxFGcucAA6iCbujIpD0dOs/awqVlb83yr6GBT9 9rsHR6dhTFI5ZiDW4bGM6e39Axlzk+UkGwGeNZNN5bP1F7iYbQPHBnP2JKvzXnBCUfOc slWnbfdCYwihH7O5IIBLHybXZdWDjSTZifU/7QPkkSVnyHl57qy667LqmdlquI/N7pvR DgtZ20Ev3T7voES3z188cBQbL3F7/8AhjnLtQ22DB0tQN3BURBAkl+LcbqiNFbImIsuQ HoreDuGFGGvvPioRMibXKuQCOT+Cg165LN0IZZSM4NRXLhOy7TiUKdJlklyG9QRD7HCO wr0NeCH0RFLqHbh1cHRiaJAxm9jTCgjN9jaTJOdtPkg5lSGp865sS+q9bay8hZW3pMtV rFztbYP6wzjEIzD1iSEvzB8OeIC46SBTYablnE88MjUFD3ocnteTVPmWAuBgtcFBMan0 daPdDAZDKJ6RHBsZZuNgaop71b6ZI4NJzYUO0WRmUosetJke0KJTvgfLM7tpBMo67JVJ FMM4xgaTg0H20IFVbESiiHioyzstqfKnB6n0sweFBics3hp5OVH5kjrfNtyBZ3TLjlAu cSOLh7H1CD+1ASMf8aLVyJAICSjIyHwoo8LPfjomN5SsxKqu8GNRBehgyHIlvrtghq83 6pLaKnSIH6P1VegQP/UgmMImL+e2ZRrg2UJSjxH5L2Fl5gZwB1Uz2Vjw24bBs6Y/Yd3M O0L6vDcmqcxR+VFqVCeNvpnDCBbS9+tR4kXcl74ZfWl8rIj18Wy6VM1mbpAD2v4jU/u9 NzEjyV6VFd4k6R9giknwnoFIZHDi8oLkEjhOzeWlRrl4YkJj/Pwb0vzSGC+krBexYxV0 lYhYU8BGlX/m8I5GS22lMk5+RNmO/lOiUoyRG7gHyE2KHsDHgB+RNv4U6VUMk2p+G1ml WEdW8X8io9waMpf/C74cWU0kLkrmK2rwBUgFaVF9C/QNgBa03UBm8nPJfH4duYL7HvEp riYzFRpiVdWQAv6PxAE6l+4lTsA19KdkBu+TT7HS37/hQz68SJwDxnhIMV6zm4hAnLBV HbGRXOIiDhzG6NHGQgqInYjEiu/gckgePtYpwod2hcRNzHghqcLr5mJoE4de2LUJ/87Q pfQB+h6+k3iZv1fBKdYpPlSuUP6n6ll1j/obmrjmdu11Oqqbr3tT36t/yxAzJI0u49Ec KecHOe/kpEyVJvaFxo/ArTuV/aSUVJBqUkt6JJ8tVFtaVkEqCvThqtoKfVWVvqJWUVdP yoLVEYvVmuN0VoV50nK8JoRfyx9ePV5jtlBHNIRLOC4cN0eE4zXCH54LV9O62mauoZmv q/V7i3M4tbeuvj5SU8jZcpHJ4W02h81bR80eMwOuQWUvL3H43abWZrG6xKUdit3V3jnS nG8qiVWIfpvach/99LyKH/60kf7JbveV1wVcoUjU29OXW1JT+KXCqoJIZ5m/uamz0lMR KM1Xrf3GN1JvKR76x5WKv3/yXUwQnFNhrn9WrgRfi8lmKa7ReoqVep1YnFPschaLnmJe maPMKyoqyXFYNfriXFHH6+6XTOJckTPzoui00NxC3mwxPxEn9hyVW2kpdipISyTkiATN xBExW6LOEHa0eaeDZguJRqsRpEciliiQ2eKImiMRYdvk5CSDsKeumQNXAgGPWqWy5dod Ng9400AjtJBz2KiH5/Nrwk7B5EtVFecJTS2pBY3zA/Qbj9J+p6+28tPD9Js/CuucwZLi ueHbV3TPKoo1asNh7bpRxfx/7JvTV6UPc/ncOHTshqmzCgtmLJJrJSFXyLF15Zosyy3X WniLgyDSkapRBNb04quWlziFlucKHTl8zv2Sw1qo4lX3FyoKqUrF6ah1L2exFOtuywud ZDM6CZFH8SMtp4PE2YIpE6fwLCYfDQrPAkH2Zm8V5y1WQdgWe6QGk4uYVSpvMTHXWkoi NXaFZcTZvaLjqm8snfXVNX2jM8SRK366KZX6dBtV/euSh5SNqfcWXVVxV+r0vz+beu+e 0JUjqTdcLjpAF7xK8RIUM7sJoy7CaWYeKZEsSo1a80RcbbNYLU/ErTzZYgidJC2QSsQZ Yjhc7ctljJXZbq6t4gJ1HhsUkD6ptZVVpRY3lxt1Dn8VfaIi4NB/0t5c4jSEw0Kgq5sf 7mjx2ozhsN7uaesg6ecqBDy3kMyQAkQraDkDr9U6iN7wRFwPO71f0rvsDvsTcQev0+7V aESyRZB5dhJ+JT0icEvWEFlbMDRPTbOiIcL/0+C+TVXBaWWeQnfuytxPN2fHuK/C5zQs 1dl8sSVLUms/O0qDVWxj4mTcUXyMUYZIjKyU6vLdJBwmfPh+iZDp6hKtSq16Iu7xq3Ot T8Rzp/PT78/ly4uK3H4fTmxva2ho9oXpFmPoZE3IHA2dNEN1IWx8D4hxE6bTbBppdc/q OpP3P3G4BqczKrXNbnc4ZOb7oe9VvJc3R2pk7YdToE/q7f5LBHDm3VO7dzctqlscaJxW nXrPH/cMlEaC4fDa9YvWLG1ovWPdYm5e6rtdrR4mk0sF9OThuybrNa5lK/Z2zSrVhOtu btk/q6tAz33r/L+4OjcvWX5bG2TXBq7cCq6IZIFUabKYoSxm3lREjXxRkVnrIi7eBQ7x 3F4+R1fkbCvaK4oe3Rans9gDVU8LMUiFj06mNR5MyFh8JKNkVg+Unvd6L7BCUWdOO742 xbQV9mB1Q8MWo7sqnGqAt7Lqbws11QatI8oFqb0LE7X2T8n0zjKHPhxWC46S5piCWKKr eiHL3qmzfJI/TvykhryDV/hTp54yCXiBemTqlKRjFFdFCxSlCNuluNbUVarXB/jA16R1 +jF9Uj+pVxC9AP9/n36PXmng9XpXNa1SVPFVj0oKu69kf9xnE63V1j3WpFVRDcRZ2Tcb gUBFl8Kai5zLaCuwVdp4LW8TXAIvPOASrLm5msJxqvfzNeyhWhOdXVNTWz6uQe4wMppQ kDmJoCPCkuNMb8ArOAe4iPXBZetbMi6DaVGGg+uZIpFIEI3C1cGgL8Bchd9fV1vig5uE oqiweDRz8Bt2G7jLw5R52XHKrqWOe9y06MGFszY24/WIp3Rh15zlzq1DY2NtIzfGOF1u oCL1geE/XqzqrI5f23yvYrB7+tWdX37M2Dp6Y2Nf35dqQu6WL21N7e1uqi2yG8L0eW50 VbTN1XYlPlAj1eD9OeVurMNV5ArJV0HLlGV82W5JKVhsZrtg9Bq9vHeXZLTnufbH80g+ 1W71M/4ZmVz8/mqhqip/3ApLskQZR+CULkweS4SzpYW5TsYHGJAjM79cee4BdQCOig/U wW9iwvCgmVXURpcpOpeNTL/6wfkjP7mje2tXZwdvdAQiH03P8bTMqb7x1vXXRXvn+vgi OrPNe81rjz5+coO7uElQtAzNqiu0aGt1/3h59pJYjfXZZ5/7mbe7qwp2sQqz7IOGecgN UlzEyyQuic/FisasM0RiESyihdcWWajJQl28RfKXdVlMThNv2i057UVYJHZJRYIg6Cyi 1erFF2he3VY3cxqh45hxngvYGSLpFSKzTrzKxHwdFkrX6TyncHzZekzell4tsBYWQsr1 DViFoAB1tSxgsPPdW8w1beHONS3OaUMzOm6QopE5g4siP3x+3Yt39O3g973c2lO4+Mj4 gnsSjfXxtsamMus/Tn/17VutzBNiboogJFhM6slVUpX5SUEw7Y8LtkhuyBniQ2wSxWVF RZAqm4datT+uJhqqG7fkFvNeJkqm3l5vYwWbVUarL5diRoZOJlvhbczmouCw6Ki9DYEc LIXZ2TiYXKHRWPbhCBV1vCIjP1VusP79mMHUsmxVbO+hjT+9pW1NNMfT2B4au3Ptuopp jdPcOZdI8eY57aUufa1ur6K9vfTce3vfXmdzpg7OuUKqyD0+Ofm8yTOtuhkvrTkyCul+ FdJ1Qb43Sm2i1V7oMfPmr0kej95OZoivu864OOISXKLrrAshgMuusPP23XAP+kK+cJek R43DQjwWYWtentdyh1rmw4eW6KvmKOSbXf6zwoVs8YXzaXhMZ+ji8uC7hANYDDyYPDPd Bl4OEtT8mHT12Oyf//Lq525fuXNBiD8/UXfTcN/W1qtV5f3xq27RP9k+K/j3D3e9dat0 7be3WzZ9Y0lTB12w5q6Z+x5ka/JcTPNPykcQwa6RRJ1ao94f19gEC8Rspx8ETUQURFGc FF8SlUYeG6dJyVns6xILpIISvuRrBRR3e/aJQW7caULlYYHONoWCkQ9rfsXkLUc4TE2Z 0racjtQw58VMFmK+6Oh5OPo6rOLNMFQEtcxjsfg2wo2cMbrKKlNXVfhtupv8LofZqNA2 XT++eG7DiDVS5an0u41n+EXnH2+Pe226cNhgL5Y6uGURlTonL1J1zfahgP5708MWv7R8 1iq8oCQtqVb+DciyhrSS+eSstKjN0xcI6DQhTT2v2TVZT031RfWhel5bXx8y9dE+iQjU Bl9kEoqEkHBGmBKUXl4QQl0UXfDkA6nG5Oriu3ZJrvxQC9+yKyQEdIbiWSWMSWVgRElJ oaetbVaHKFjprI7Cwn5OWxpWlE+/QynALJRKG16YLpjFVgG9CS1m2WwLIneUywpyPAju sXUTiwGiX/iDIIskQKDieA2ioYuhY8YLyjrD9Ae+4fgy3AoS7pEF06iKguMBNRaAXKwN AWY+9oi8IMgOswrxdH0DWzLSmDlTh4fKNsZCbbaGWOUlgwWjdYgBvd5i/o2j2qKSF47O j80qaI+fXX1ndM2x7Sv339DaPztUL83r6omunOjtmkFXnO++cijSVWmrWdi4POGKRO79 yuLb4zmBrmm75vGL1Pqiq5sfP2ib1ujzC23Xdl/xlT5ndFlny1UBa3dNdHlT+X1LF26Z X2ZOvbR5eyA+GB7Y1HDbp6f9C+oXL6heHMuvK3dBhxGZKYrhp6aR1VKMZ9zlSoEoQ4Qh wRrkS8tK98ctZTaRFigL+AK2DjU27I83kig1jDudMeIdr86ocDX4jlWHxcEXlhysM86W 9GaFrbL4iE5ecwp5rKmI0lh4DEWWeZXDsXU2HTKzsvRKRK9RzFkyGGlY2FqWawpMT20K FDuM7rkzSqX+oDq3LJjayPRcdmcfxrACzW0R8+pmX92X2raoxStAvS1ie5yqxu/pzO+a FUzdHp8WcCHgkbWe78guUPBZ82HWf8ZunofXWiiVOxQuxf64y5b13iZuZB1PTfzrPGfi lyPhebqVs45zukwIglQ2ZF0oGHz2pHCShJatX3Y67Z+z1ou9Jy/Pl20H2Cors4BuOXJl wOMwKpzhyj83CZWR1I3K+DPPfHIaY2/rpE9Jc0IOTZ32fN3Cdq8R/pWSFkguBslJ5K6j xDJ1ioVACKLkNJftsZpQUF7VJDrcSlsJXyZx2OpzBnztYHLlh/mqUNX+uDtkM+Xsj5tM zU37481Eojlmm6tEScrH6zMzqWfydMBqZGkyJ5QWZCaAyjuODagclMuSpZGaBmy52I9t M7HbUanUapoWMlN/ORaHCTAruiD4jJDXiB6bK9ZQFdJqfOX0QNVowztUrJlXnRrLc+mL K28oLhDdjYwzG2oCZnVG2lylWhuMBGMum62wWIXNqFT7Wmp7WwucGm/ONRXUNO+pzDec lbkWNuYH2usvEXiai/T34KKdVEs2hVoFHw4Tt+6P5xIbThbJuDHDCGM6jEqzQfbDvs+b w+Xj++QLnwxdUy3nj+HN9UlpoV4DYemcQFoRSMGyPEMcy1KGCEOaiMrpjsztU9bX1e+P 9+bV2ZY/ecUVy/bHrzBRbWmwU9muaufbdxtVgrZyPMa0Ad6UpRIz7VhswDpu8tD21xGv MpVFJdJT8KIgPCuGSNc4XlxMHjbT2UhlVWIva1i7Aag0VIHZdjAITykHJSjASQQLJR0w cTkMaZH3adAKCxxn9otDGDxWKHva7C83cQXbq1xm9hfKWMiddg9pc6HX5sRmd7V4Erc5 e5YNN7YPtxfprP7K1A3MJWit7uIqf2nHvJKLZTqbp7iqoKyrx68y5vp8qRv9HqeBWdm7 TXyxItbkE5Yun9UVCMy7+arUtlnTRAe24Bl/seDaNn++IM6aXZv6ymdrBtfFy+16X+es itRd0VixzcrW0M8YKrNQSFgRgoRjZJPUVMUEUMk8agVDQYZc+TF8NsAhhKe2sidLSwP7 46WmCoupmoW51UL9uEbTXFGeO158ZOolZt5IJ58SzHRWMWSQlgX8bDqSv8B+WRhp1nuy rMuy81Kjk72P+qInhtdVhNKuVWN1+6oDgc5+v+yIsn7p3SZ9TveSZbX1C1rLbZpcfyjL qM7rZpYVmItmdVendqT1/bPMeFzRI3ldtbPXzE9t62iGoDIRMv8qYgojdjkzpSKC2HCX ROzqPD5vl1qwC3o6275VJxpgF7rCHGjh91CSs5VneotCHvbIlnrgi0t6uFp5Id7Feq36 7DrM5b70uw3Pj736+7UvprZvvbn9iul5reu6brpd+OvZfW9de+7PT7y1nn7y8z+0rr1/ 7leeWfJLrAczU30KPSRYShrJmFTODjAQqLuJv8qPrewuyW+vz4sURfjIbgTxjicRJOyP 203FW8OZ9QApNmWwnnB4GnHm8Y3jLNSTtCgxMX1AwBc86UjbFCSZNqALYX0mjM3GfT62 SbloDvIeDfJjhsXmikifT+9i6gTZoug6rSNYnRotqXRqFAZHoPK9JqOpuWv2jNJ9BxM/ vqP7xhpn0/z4TTe/3Tiv11P4Sqvkc0KNdbayzmn84q6m0jyLtk77uKIl6hf+/sG+k+td dPnQaKv4wrN0u3fOzPKMhvOVkGGAJKRCu8uJ3ajTxnb3/id9JhM+rdQIGi6X1yjHDGxF sgj2LhwGGJSCVqMpC1DLeGFGswvZMlPDojUc8OJzeRb5IiLD0tLy9iWRr6yt2UCX+Yx/ Umj4h4YrrumYFlrvrA+VzGhzIVhLXXOJzdv59tnlqnfqw+W9ndWpby7pEHGEeam61uLz ZUquwO5Fh5mFyYOSPZTXkjc3j/9xHv6ITMgToaF5/gLKJNllsXeFsGmlSr9hk+FOA+cz 1Bk4nhgEg2ToNQwZlFqloaDKhqhpl2SzVyl55a4qIW+fy1VeQ/Glr0YYLy6OaMbTsSvb vp5ksats1ZnjHoSh4MTyZWAGW3SXITCNhpYtu45tBORdjLyWpk+3oQOBugjb4qRPugJy eMr2sg5uasgem9XQu9zfu/LKa1vqV2zr7X+0Z4V79bKSjnqxtH/1krUtg99a33bLMu5k rCO/p7UqVhus6F4Rn7smXujKfXnpfJM3VhmR6ir9XSva+26SjFbGJx++zn5GcRg2vFAK OwQ+V7RK/lCXVTKYuqzCboed05lU1MCr1JKOIODQfaA2WXO12kK1Uj+OU90oE/qr7LAG O5ys1KMt518NBrHJw4GutZlviNg8Ng+LC+Utuqzq2Pj4apq9ufqdtD31Q6GisaK0s7hy xpb47bd9lZ/QlLYsX/L3lan24Q2t+Z6i+o7mBx/n8Dk6JTOxL/fhK3R87C8VFzyZn+/e H8+3YffmVfPq3ZLXbq2gFVj9qck+LhZCa9MHTQZDFTeOsy7YLtbGUrYUlzLbZQ4oEoG4 5MNJ+USaHatknDFGnxk2xJEOZuV8enMuz8MvB76BmbTAUtI2zd+50KfKsXoDtECVW17/ dpPKNH/3rCWbphl9zfzTKf76m5vLC3u6w/SG6DSv3aILn18wO57Zji/u77r3S/Tm/hYf +2NH69TfFDrMswinD5K22orAolqbQ2epBXZEpJExQg3QWqddsBayPwvcH1cazXa3kpis OZBQW2Gh6HJqtR4RGtckv1PAsTYVTkAxM+8eEA1ipcHfxODPU6gNqzheKVitcqAnH3Vz any+yxZu+p0qv9WY8y/HcoXKGN0UKC8vSB3YlPow3xOANML6XNHtnh5Iqejb1c3u8gqc smo8M6Tzbu692dF8jRzvFkz9Q1WBGfnIM5KQI8guFAhnQIiNWBBTACJXBDIzlCP7V4Zw 8iK3OCuZGQdyBYbNMpbvazK5UCoybE7jXB9PbcRi0rkLeXlbrzA684uVGpOvJDe3wMpR s9lqgfEWFAQ0IagAO6aOMACjgMkl7AGZDYPYnw6xP+NhKc6rcASRDpBlptHIpXzjwTe+ MPXJjrOOIijDjmllBsPXKb3ntWSOpbKeLoPaelyp17dx750XuHe6phew+CMQYCzkeNWn n9A/+zsKy/E+Jqw2FTRJ50VohAMb+Z+Bfw0kcZSUT33MAgr8wdzHUjUIdznJUXirLTYf X+wthv571boaPlQdwpFGtYnkuMsVlmpokM9iifrSU8aLN2yw05qP6C+U3hewV06ySlDs Ai7ZA1gzewBWFLj48gnv6axZRjA+cJov2fKKS+gM/9zoL94Kzwmk1s7Psd7/kNnqK00d 8tQ1VL7064raCjvdPtdm51r3uSNuR6E6HNZLM1Kp422dJixgtTa/68Xn7T6H26sAW0qi Dfhj1JJYfT62B4YaRxX+FxFKclPdsn1UwT6a9U6zvett/V/1nFoCRdSCWlTj6Fmtl7D8 678jKfJFIthtgXLe6XAiSHOYNPvUartARLHMnhY/3NjpC8xAECyfS8GhHYPzDi6DI1Pm 4DDugndukM0Cb4M+x2Y4TcPo5oUNHYOGkuLCUKQjmDrl9vgDdHfIbzHmHHrebA1NS9tQ 360PzTE+VyY6GjcOch/OnFaItUxv8+S5pwVSenqitL0gmLUlzNmZep+24+9HjMQrWVSH Jo2S1thlVKmN3EG93pQjLzzPPVdDQsG89/F+SI4q1AG2kgRoXU71qqX1kapc9anOeOfG DR1N1bPxBrCb8fIaoAb0yxOHpOOTYxw9wHFKhdwfwWEc+mIvXBtePHXqFGs/g/82XYo9 Vw7xSYJaIjQnR68WNTxGIZjku169eIB7HOucfPiiUgfSGkXbDcbSRYNN4SqVQbnbM0ds u3LVnNj0mxYVxjsQs93PP8s9gd55vPMulWz4zxYEyJ9q2P+9cIBXHFCrtRr5Ib+C22ah 1zJ2pob3Qx4A7ZdW5XG2ltUu5e5UJX2FAXvtjXstAHapMG7S3RXvn9EWbB++ZsV1q4b/ F9Kf2SAKZW5kc3RyZWFtCmVuZG9iagoyNCAwIG9iagoxMTc1MgplbmRvYmoKMjUgMCBv YmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9yIC9Bc2NlbnQgOTUwIC9DYXBIZWlnaHQg Njc0IC9EZXNjZW50IC0yMjIgL0ZsYWdzIDQKL0ZvbnRCQm94IFstMTQ3NSAtMjQ2MyAy ODY3IDMxMTddIC9Gb250TmFtZSAvSkhEVEdCK0NhbWJyaWEgL0l0YWxpY0FuZ2xlIDAK L1N0ZW1WIDAgL0F2Z1dpZHRoIDYxNSAvTWF4V2lkdGggMjkxOSAvWEhlaWdodCA0NzUg L0ZvbnRGaWxlMiAyMyAwIFIgPj4KZW5kb2JqCjI2IDAgb2JqClsgNTkzIDU1MiAyNzgg NDMwIDIyMCA0NDEgNTMxIDU1OCAzMzggNDE0IDQ4OCA1NTUgNDg4IDI3MSA0ODMgNTU2 IDIwNSA4MzIKNTQ3IDQ5NCA1NTIgMzAzIDIwNSA3NzQgNTA0IDUwNCA1MjQgNTYzIDYy MSA1MzcgMzkzIDMyNCA2MjMgMjIxIF0KZW5kb2JqCjI3IDAgb2JqCjw8IC9MZW5ndGgg MjggMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AV2TzY6bMBSF9zyF l9PFKAaTZCIhpGpGI2XRHzXtA4BtMkgTQIQs8vb9jhOlUhcH6eP6XPuYy+p1/7Yf+sWs fs6jP8TFdP0Q5ngeL7OPpo3HfsjywoTeL3dK7/ypmbIV5sP1vMTTfuhGU1WZMatfWM7L fDVPX8PYxi9692MOce6Ho3n683pIbw6XafqMpzgsxmZ1bULsaPetmb43p2hWyfq8D9T7 5fqM69+K39cpGk6EI78dyY8hnqfGx7kZjjGrrK2r9/c6i0P4r3Q3tJ3/aOasKtZ1Zay1 Oz0Cj8LyaKxJ3vsq9zDd2xd5XUnWrsuaJgXohJsXYQkia7dOuAER1YRbEIGdqi8gAqNw ByK8qXMDIrBQtQURi3OhB0PCtDiCiKpXtQMRXp3KcSUSaIUcXyKx9nVEkPAGIWkkUPs6 0kjgVsilSbRaCwknUd0ICSfRWcdwhJNYnLyEc7eAO1UJJ1FNXsK5W8BWVQJK1pa6OkdW iWtPpyKrS3nLtBFZXcrL98iqkqwSXm1UklUCdXUlWaXC5lQZk7a7fVtNjCb7MYn+Ms8M YRr/NJ+au36Ijz9kGic1SPoL5yLfoQplbmRzdHJlYW0KZW5kb2JqCjI4IDAgb2JqCjQ0 MwplbmRvYmoKMTEgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBl IC9CYXNlRm9udCAvSkhEVEdCK0NhbWJyaWEgL0ZvbnREZXNjcmlwdG9yCjI1IDAgUiAv V2lkdGhzIDI2IDAgUiAvRmlyc3RDaGFyIDMzIC9MYXN0Q2hhciA2NiAvVG9Vbmljb2Rl IDI3IDAgUiA+PgplbmRvYmoKMjkgMCBvYmoKPDwgL0xlbmd0aCAzMCAwIFIgL0xlbmd0 aDEgMTE0NjAgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngB1Vp5fNTVtT/3 9/vNkn0m2yQkmSWz/GayMEtIQhY0A2ER0KIia1NBQ1AU2USkPB9SpAgY0YIIipbKUqEu kU2NS13iVqViQS1PbeNravV1zONZFIth8r7nzgQhH98f78/O5Jx77zn33t/vnnu2eyc3 L146hzLodlJp0ozZC9tIfspOEYmj186fvTDRzroZ5e+uveVmZ6Kd9i2Rck/bwrnzE+3M O1G2z71xeXK8BeOG5F43Z3Zrgk99KGuuAyHRFsNQeq6bf/OtiXZWAcof37jg2iTf0oR2 aP7sW5PPp4/Rdt40e/4clPiUHQdyLlywhN8Ln7I7gCYtXDwn2V9MI0p9iASoNnEvpdBP yUAKWaiJrESmz1N/hfUKyUefdUdv6rk6q/FrYTXzZLRzVaJ8ubhu4ZlX+54z2s1Pg2yU /bkDxhjNcXQybjnz6plXjPZzHObyxxbtV24XUcohVTRROvBFFAceIXE9XYR6HT0HPFxS amW9hlpAqaYtwMMkvUrSI9QKSkhSKiWuEB6UBlEmWwG6AXw/VQPrsu6Tz/RKLvdUhVvO 6hQOKsU4p6RxXRV22bdEFNOV4JTIflxXRRFNBB4i64VyRIGwoTRIrIp8elm2ciUvRz4/ m8ZijFVY6Az6WSWH66rIkvV0idMkThUpVIJejFVhpn9QKlpm7JMqTPQHzGRA2YyWUfY3 SKwl+2mypUqsSIkKGoq+xCugftAzsetccp+z0AIen4kW11XoJHrTd5J/hv5Jt4F/Rra4 rtK3lA18mr6hzeCclpzT9BJpoHxNs0Fjjgp8O2hf0ynMZ5Aclb6O9kPXNNDkmiRPlXWV TlIeRv23nK+XvqQ0jOqVLa6rFKPPyAZaTNL+Tv8le/xdtriu0hdkB/6c9gD/jeqAP6O/ khljeKQq6yr10JMsT5Qsgb9I/J+sYfSprHeDr9KfZf1PEn8k8X9QLugn6I9SIickjesq fSg5H0jK+3SQopj9fdk6LvGxxJ7RMbkDvH8qvSc5RyV+l4aA8ns5yxFZf0fS36bf8V7T 27LFdZXeojfRz4CS357rKr1Br0saY5VeY02nLrYQepVekZxXycutft6lV5LrZ44qNVWl F+kFuguzvihnfVHu5gv0PE0HjTkqMO/m85jVBxpzVGDeS6ao1JlcdydF0HpWyuUZOdvT Eh+W6zqE/U/I55CkHuo/ihmYotIB2i/f4YDkHJDvsJ+eku/AHBV8foenqEO+A3NUtPgd OpJrYo4q66oYTX5ofTNjekLu6eNy5sck/o3E+6AdKj0q67+WeI/Eu2gn26nEKj3Cdkq/ ognAO+iX7A9Qsny5rtLDcsxDtF1qBmOVHqBtoBokVmmr7HGf5GyGx6wHZ7OcbxN7GfqF 5N9L90idZqzSRrZdupvaKYDed0ur5LoKWfDeb5B4vcTr6E70NtA6+QSuq7RWcn4uNXuN 1Ik7aDVoBolV+pnkr8K7qJArPB6tpH+nMeCvpH1ocV2l5XL8rXLeZXLELbRUvv8tssV1 lRbJ+k0Sz6cbKQuzzKcqcLiu4un8xvMojv1X6Xq6Dr7MgJItjesqzaVa4DaaIW2zjb0b zZFPbaXJsner3IVr6RpIzEDXyhm5rsLnzEKsNqCsRIvrKv0E7812wlilmcl5Z8pR/AwV 2sPvNC05+zQp2ankkP5wquRNkc+/KtnjKknjd1Gx6zz2CqqR+3WFbF0uZ5gk65dJbb9U jp8o8QQajhHjJfcSjls0TtbHSp8wRvqs0ZIySnqxkcm5R9Kt6BuVczdhX9lzNcnxFydb F8sZmKPSCIkb5TwNEtdLXCfxcMi4AOOHS0nWJp/ANFXWVRom56qSvSMShyUOyRFBqkDP oZIi4y3aLIdyictknwCZQPEnddwv165LW/Fxr+gWeCKOQx48lffHI3XVLWcoldglsYzE cjdUyEOTfe1SK0ogRZWKk7Ri2bsI8vZjtiLZ4rpKhcknFEoaP01FFOD3zZdYRmdkItky QjBWkQVZIGmDxCo0NxOR3oCS7Z/rKnQrYb0Zco507D9bFGMVsk/B3AaJVczHNFOyv0nK gMeq6JFYj0F6AK6r+HJvIfWGZIQVomBNuyj/F/7Qv9a7l8gUFb66E97iTTqC2h5KVYqU cbQCenwQ7e30GL2mpIot9L64WDxDm8Q68bJoFetk7yOYIFcNQnvSxcuaWYlhxBOgrYMv PiL+op2gj6C77fSR+gAtVy8GZzk9IWaoI5HnLdJyZXsX+rxPpNWpDbRFpIrnxQnxkdhA e8QbAk9Xp9FXmG+dul09jLdcpxXSV2qVquBJW/CMR+UcmBf0raoiHhGfiF46jGy/TTwh 0ulRZSueuUycgQ/fQutEJd1L94qL4TOv0XaAtgr+kL8n8ZSt1C7exrrbAS+rE9H/Caz2 iCjCexyhg2IRtapmsQr5YlycUTNVG8+FWLgW3020VVktxoh7lRJkUiyBdmDSvtEeSXzR cEBuvXhmO7m0Xv4aMmmpUoQ3QR9Q2425xiniDaVSPCPegKRbFZvSLuYjpyEqFK08Sk1F v3uVy9SV1K6+pxQiI2nHGlaJFdojyi6lDa10rGSj2KrMwKgtSgN89gpjrpYK+ckvqO28 UmWc4YhhhKEEa96ibhcb1e30ojBSIcoV9LC6xbgGMlsm9kF6t7H8aRGk1qrtwJsuwHcR YAXmmoYYdxIRbYFqRgQ6wm+Lt7ZBUqksKcyxCJJy0QrDIuRaS5T3aInEmyCt5Yi7f8bb 4LOyH++0FRE61GQyGjRsJFU4LR2K95LWjqbLpznfnO6qrBjUdFpMzg6a1JGx3PlMf/+k aVqRYXqHobhD9Zo7NK/70/+L+WllxYRJ05zPiFGjm5PTjp7VDOKV0/AE/DEZjxvdXIk3 045QGwClmK8d6Y+jvhbQDJgFmAZg/vOANYBWwB5AJ+A6wAzASADG0n4A9w9gnhjKKzB9 4uxJ2DUj9pLIiSiNg8sPfpQfpP4QUf0h4v+DpsFjG+HJzfDsqfD16XJsBnAmYoMFpRUe OwdlLs4w+ZJLyKhKkaucErcrEWW/2qrGtfWGy4xkvNV41HSH6Q/mu1JSUy2pu9JCaV9l pOIU3hbforUZdiEKmMjWlKKRUZgNikbBdz5+J0yW4+8cfyeUY3VZvS6rq02jviVqUd9f 41tMmd9+tdgY4IcKMT/+olopJiLyVTYNKci2pmmZqVSYqR4p5EaqhqhkKswrtByP2eow Z9872XV1VltdSFwkGkQkPy/XaBKZwl3qC4qhorpR1IqT5iGOj7KyNS3+pakgUzWZx1gs irCV5qSnGCyms11Z2Yo6xJSdnpaCm4T+ODTjQ9iEQiHa3BSZoMxUFL/6bCo96/hLak/Q VaJmdfnzQ2paZhYJxe5wutIrhlRackTOUG+lqaIibDne03OqpSebXy/YGLNFYqdilt4Q lDFaSAqy+RBHSZQOgB2QJaM0c7DLwE6AC8D9QiaDJRaLWWImLsyx6dQiXGq5KPVVD6up ckXybaJKLtrtkqQGobtMgyhiq9j24cZfjAiXzxIltbpFrLXW+H3D4icnlgejLbPj2pTZ I0Pll8T/2VRW1pijkJLt0gOOEr0vaEfpCPgcvb0OH9d0O++RQmv7/6atVQ9Ci6ppddPU nxo2GB40PJB3n+k3hl2mXd7f+PflHUp9ztFpzRhSUlidEU6h9LLCgNrdnS/y+1LOWJzf lnT7TluOlX0XLrfWZ3dmq+HyodWRDGRmjkLSA5OMfndOjeXjLoguwpLEHodbKBjr6evr sfTGW3qx5/jjrc+uC7Vgp92lxrzc/KpITbVN7j6LB9KpHuYDB9qQaOdZE7JhAepqc+3c qgf2L5iy8oT5ipfb7nv6Hx/X33LRTTdf9pKjxPfJYx0Hw2NDfv9DxR6j6My2Xjetedqa ce+Ov2zPmoefyLKYltw0OehtuOLAk/EGu+7xlDohl+b+Xm01PHAa9u5E9CoahVzrSsBj sKidKJ9HeQClEfwKZJHp2Hl4aOh6MeTaDcvzwlVUgNYNzmm0j6HVT27cZRQj0+JsS+Ak YAAI2g2b3Q2bPYTyEEozTo4B9C3BGBV+pxhnCQ/snefnM4YfFo6dIB3lVeh5JfpcgR6X U9jS19PT09dl6R2Qqg3yZYn39vbEey34JhhS2l4IWYoVAlcvgv5RXi5BxDpsL6mZDcKa kLk0SWV7e8eB9Rueeurx4Y/Oe0ukx798/frtkZz8p3Xf0Oa8nOaIX99qL9qw/+4NBw/c dddBZdWY8fH/efO1eO/4CZOKCjwef4lGTr/Hk5uHVc+C7lVC9ypoRdOP1xRvzNrm/mXW g5nbsndVPJfV6T5YkWpOMwlSrdqP0q5OW5DWWnxz8cq0X6Y9mbaruMOeared8aRZu7Wy 055jlc3ZzfmTsyfn7/Xt9Xf6Ov3mzFwKu0yTc/36lEpLX+xUV0yKwQLZxLos8a4WK5TR yhqX0KcSkcvKpZ+nf7U1tax5ebmau5SqhxHq6iafP+Dw+Yr04tC66dtffW7TqOU1Oc6o 16HH33/0RPzPwvnHidvUWZrLEZrQ6fU6wpdf+cwv7nvB600vrNYdP9ot8o8eFTZ2kApN w/ofgI55oEMfRqdAx7Kwk1nQMQPOvGboWRb0zIAM0AxdywIuxv7zqWAoNE9F3k7QhG54 aCt0rQDUbtBPo30MrX5oz3fo0UxBgI5zYxCgY+Y0QApmTQOkYNZC9CrHW9jJJZ+QjZl5 9jz0K8fTdNCngnMV9NyPmDOFtSx2CpLsgQhhuQM2DaOGf7xAw+DLRkgnriQEaDtfm5Im 7BYJc5eaqG7KszYevP6FfmF5e+6uhuqpVQH9iL2oMlzhc/Z17F+3fv9TG9qfyLNfMeFK kfHmuyLnkrFipSPAKvXdNpen1CdeXt/xdPuGg4eljNsg4xnITothTS9EL8OZ3kC3APZI yKe9WN9e7MVhtPmsyNbqAs6D9J7FTQTfJxtx+8E2zXsGdw/eafQ6Bok1gzIZsAdnub2w 273Ynb0YcQjtTrQ70e5EOxVnQd47wqzZqKVA1n7gAuRoJdKap5BnQEshUfzBZC09sb6W rhYpUuipHfbpSTg9EzvGhErCYmGqXpfUW5FrPvDgUpFbYveXDW19/3pYvCj94pjID16X dXaOsiFr74o1h8Uj9zx0m6+4JGQLDxOmE5+I7H46PNy3etm9d+EF8bbIdbQGg4PCtDFa hd3n03ER/J0LtW7Uglj9s3jrLNAE5QsFtH5oHkHfjKBZUDdBf2xYtxHUAEZoMgbaMJsO Kdth8zooOmSUirwlggAR6es63sV+i+0yEXJ7IwgQjb0RmCskgvDgvTBAntOlZEiQFowg USIQTiEXt8uqPhAoD+hnFzPetytQWeZ/+PefLbxhqCd7XXjRNeKaQHmFL75no8ftwcft Ua71odZ8aGek2uEvuPqmOoQD/exDLBeF1sQXaWvUh2E3tfRldDbstQyncCdstox+jPJG wBLU/w3lY4CdqD+PshO6dwD1dKy6HHcbQdwkyPt85GRGqhEECku4G7rBesb3Fd3gZQv2 9KcpKDTckjRD1s3Q0skoJ6NcD83ZhzixD7vSibITZQpmD+GmK4hnpeBZdki4Ck/biPaT AAUwGfLXocNeGm45jrDc0tPX2GVN2jBSk57jrHDxcztRxz7yXEge5oOflOqXjMOI0wkD T7YRp2uS2Vu5UMav3rNn9c9+/WsRKi4d/rt1i6+vchctLNn8byM2z3ru677OSzdNKCq5 3++PjM5WzY+sWrlz58qVu85W3rW0YvylFSFHMOvO3cvHjvznb186W1c/Li/X7fY7sfpW 6OcK+M06eis6DrqmQ+PS4ccEZOyBRvH6pKGCpuO2xAIZmqGh5ZAp326wnkYg72K03ZBO HuoFGFcBKkuuDjLj+5cayJBlZsAIB+KrG7tcAE+Yg15T5X7q4F2J9kz05RPDdKpH/IUb bOyx9MR7pNJKdT6X4chMstcGxWY/meChW6j2nC5Dc60cilEkjP1cPmhNhOoLyVW9Oc1w kVuL7JdsvPT+x4ORCr8//k3QFahzz5sz90F3Y5krGP9G14PN7YnQm58Tb2iOPr8n3uCC yjsC/hKxY+mK9W3xWZwjcohmXd8DGU8yzIKu6/TTaBmwG/Li33hShIGKobNuaOUQyOc7 rD8XNSfs3QNJpqOdAZkbMaIEVMLZ04hbQgv2h/dJRz8n+vlh8119XS3HEZhlFIEY8McC ikUQXmIsFiFzPzblUl/OgFEnM+akxDh1zlNS9aaL/N5ok/6siOped7DvW7+/rEyEXw2U +/3CW+TQnr9xeHDalICvL8Pl4XW6S5VVXrfbnY+jkoD1kMYn7iKaHnVg1SDBh/WfW2Fi TWZwTGDxejV8CStiCU3CmgSAKcWwqq6WPngsTnaxtuSCsJhEIiVf2DpoMYp73+xwQBfj i+yiHolu8Cx2AwvI09o5uOXncHBLvDaeIXCqJ20lcqcGejc6HvLOhKcw473KYdd8c8eZ wRlEH4QrMmOnrLCBCuwI/6rF+l+F3eT98WAviuGzCzG2CllmCHPxydKAmatRqvA8qaAl rCCRZf4Yvaeifwi4HLyEFeTCCobDCvhX4+nUaIEN/JAh8BYPAJ+qBtnCeZagRPJLcBQ8 zxK+T0kvsIRyJaERX8ESyoLBWd+bQrDxkyZPWT0soW07LMEz5nBNIABLUFY5/V5Xfk7z gCHoLnuZbv/eEMrsbi8MQaEZyB+WqPuxyzYa3TSMurOM3Xmns44VNJua0yYYJojJpslp Mw0zxT7rvpzdtt0ZndbOnEO2QxkW1Z/emuLPnlLAcT0mwzlnR4hh3+fcgrPtZBxX2h54 7fVt217rUn4d//iLz+MfC8/nnwvvklfvv/+11+7f+oqY8UH8pLB88IHIip+EjBUaiXi0 GvHID5n/KToVMccD0BF3ShB3PAAdcacE1udHDPZCt4uxCgt0hTXABFo3qEHoiYMs0BMb 9MQkVJxcTKCcxv5PQE45AZ5uJsqZKHcjB9gDvTmE8jBKM/xhBHNaMacZ2p+VtA+2gwo8 tRQ09rSENylF/pgLPme4l1M1/GSEI4+MM6wSyXOKJYbji0x5LL2RpKIgAA12hd+fSRI6 gjQIWbpPv0C6rSd9Pm8wPtYfqBqdkzO6KuDH4aR599Vvicx+emPe/kZRs2H/gfXrO57s J49Hd3oQX7RMp9/tzs2bPWZM/OSR1+ITxihPbrjzqY516zvY7ubD7hbA7sppdTTIXgyr L5ZWB1/AMoREOSdn+bE8B2S9GRLbBTgI4Nt7lhlLLBcSzJI+RUvKKReSSgOtgv1jFyTE +TWuReSpORLrk2e7hBGFvBd4kQuOagOmM5ATmRRNTGTPeHax7g+UP9E8O6T7e4qKr/79 suk31bps88sve/z69gEfo6xyBNzuvNx9y24eV+etG7HgVqx9f/8Xmg1rbxIzo/fh998I fpOzwgdEcCKw4q6wAXeEQwBFgGL8IpiDm8lsugN+5efo8xD4m8DfBP4m8B8Efxv4m8Hf Av4WeJJt0LHH0W8n+u1Ev53ot1fqXQakF0KuMxS/XDRAq4cAigDF8NxlyEYrIdkwZF8K cIFTgdynAXo3HLKM4ClW6ckKsAoNlG7QV6LnCuyVAn1vQv9ujCjArl0E3jFaiH7oC04U sX0YnpABjed7nDTMa8acuAuT8+ZhN+fgt1cXMiwX/Vburwu2EwSV4G+j2MfYcaTxHObk NlpiLT3IdmOxFj4qJZOAhFNErlUrk1lbvo3zfXYVA1dEEb4TgR0kTqr690dV9ExESJ2P Bb79Lm+gwJJRtuvaebfPva32nQ/ee+HSHVraRfZSl9Ntr3DkVt96+U+W3PLq0ZeOH6y7 a547YnV7x+2v8A0vtdZEp4wZ23j32jt+Ua5HIkurg1Xu7HD5lU0X12iGte1rH8krtNnC WJXA2bVXu0brhER2ROuRkWXQzYA7AJsBuwAGeB4bJGUHZMIHBeFvKjA2ExI8A44DtGdB 8cnTFUxHmEE9hl30ISZxbOKzA5/J3Ni9IGp8dsgCXQBwN9fSGIvAQpLZAy4Qe/paGrti ydPCQJCB7xg4C8hTZsKRJDJYHPZHfH+9MSKRbJQIdVm4sqwsfsNVc2fG7cV6uOGah0Yv /aWea91X5ht21SKvXlGqtpYid4jv33XdPH+JK2zTPRPGu2e1OsRlEL79SHV5IDL9bZZT oP8TbQfu7X30q6gOHc/Cb/Fe6ByfnozJldqlT0Zclv7DCK/hhhx0rN4HKTkhMb7XNUGr VfgL9jn866qOPAN/rD68dL6ehCiQM/H1ZDZlidEY6sMkFtR4Goek+SgTbf74+EJSXkea LbHpYWrJSSZWUl7lIuX8fIUPmYnLWH37yDBSqoI6X2SUV2jC1Xhpja9OVPv94ZHZ8cOF 4WB5sFCVXtSh+51nlytrcd3o4Nz9rF7rcg7Ho0V/DHJ5D3Kpp+PRi5F/mGDFnDcQfoeH i8Ua3bDlYqyWZC4yDMKpRy8Ny9DgMTzIQXB/DIlVYFkaTmQaZNaAHmb4hiL05nu4elgu 5/gejMhA7lmP2QP4dT8E/vXwP3NBa+BbXvwl5BiRgrS8jmiEm+iEKN0QGL+NB2UVvsOo CDWOpkNQmvmZBlzqmmMJPD0sWoQqTVFXz0v55LmpHL9YyZzGViQGDDvhxE3JIcqsVal+ v8dv+WtKmVf3ibQaX77VWumsf2xVml/3BCy37S4oHx3yDBPpDocn8mmGrnvKMkVf3Ouz +yLKCZde6nHoBW7NoJ19VBz02fVwfJYyDYm+HbcjTuVsDpNY2XBi0fDbHY0St0Tnwcvh v/+gJktRLoN/WwtYRyNRZsGuie6TUAV/PBK+tgqSK4WvKwc1grIep+EpKK8BzEO9Ddzl KNcBtgHSsKOjZE8Ldgr/Nwi+AzvIN1cBKsAORjFnJiicm/BOZ8Hqw6A50XMkqGbscRoU ej58/Q3w0vPRLgbOQ0tD2YT2JMAsgApIo2aYR0vPqR7LZ6c+k2Yis804p5wDmzsUix9N EUApHogFocb2MhIPL0UZxhcf1Phqv1TyeMRIAL9aRI7lUU6AVY4b4FWxfcnL/gEklUSS 2NxEi3dQVjNgcefOz7baC/SHbTIx5FwmrIsNJZHh4ep4zO6vacgVzfFXMusrq8YdqQnX DjN/eCRveE2oRmgOPVJbHP9U/CTVVxaa8E51JFQ2vK/dW+op9du9pWKiqHbg8OcG4dgx l1t36w6vO/5+fJ8X/FKPy/eNvPtiUcQ34f7shz42EPm/FPhWbDQyg7H4n5JL8AvzBNyR /AgZ3xXI/K6CjkyFlc9ANskamA3gjxE7TzOiE2eMHVU+asHSxdfPWZzkMLcVwP8zejvg HsAOAJIxeglwFNANOMnTASwAJyAEaAJMAswCLATcDrgHsAPQAXipP/khfM7VBbb1wjZH rfP50UHt2YPa1wxqXzuozes5fz7OE85vtw1qzx3Uxtnvgv7sMc8ff+Og9k2D2gsGtSGb C8YvHtReMqgt/5/3PHlJfTivvWxQ/1u5/b/jhi2ECmVuZHN0cmVhbQplbmRvYmoKMzAg MCBvYmoKNzEzMAplbmRvYmoKMzEgMCBvYmoKPDwgL1R5cGUgL0ZvbnREZXNjcmlwdG9y IC9Bc2NlbnQgNzU0IC9DYXBIZWlnaHQgNTk1IC9EZXNjZW50IC0yNDYgL0ZsYWdzIDMy Ci9Gb250QkJveCBbLTY1NSAtNDA5IDc2NCAxMDg5XSAvRm9udE5hbWUgL1pBTFpHQytD b3VyaWVyIC9JdGFsaWNBbmdsZSAwIC9TdGVtVgowIC9NYXhXaWR0aCA4MjMgL1hIZWln aHQgNDYyIC9Gb250RmlsZTIgMjkgMCBSID4+CmVuZG9iagozMiAwIG9iagpbIDYwMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgNjAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCA2MDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA2MDAgNjAwIDYwMAo2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCAwIDAgNjAwIDAgNjAwIDYwMCA2MDAgMCA2MDAgNjAwIDYwMCAw IDYwMCA2MDAgNjAwCl0KZW5kb2JqCjkgMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5 cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvWkFMWkdDK0NvdXJpZXIgL0ZvbnREZXNjcmlw dG9yCjMxIDAgUiAvV2lkdGhzIDMyIDAgUiAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAx MjAgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nCj4+CmVuZG9iagozMyAwIG9iago8 PCAvTGVuZ3RoIDM0IDAgUiAvTGVuZ3RoMSAxNDk3MiAvRmlsdGVyIC9GbGF0ZURlY29k ZSA+PgpzdHJlYW0KeAG9ewtgVNW57vrX3nvejz2TmclMJmFmMgSQARMSAgSijCTBCD7C 0wSMBEkwIG+FoqgEYgQjKgiD2nN6xL60VQ9DUExQS6qA1vpAi4DVUmptpdVcsGqlSnbu t/ZMIuRYr/eenrsz//7Xe6/1v9faOzetWNnA7KyJSaxq1txl85l+jf6AMf7gvMVzl6Xy OWHgF+atuklgXJYCxpQx85ddvziVdzYyZi+6ftHN6f4DhjAWGNbYMLc+Vc/OAo9qREEq TyOBBzYuvml1Kp/978B3LFo6L12fg+ez8sVzV6efz95DPrxk7uKGVPvR7cDDli298aZ0 fjpw/bIVDen2VM2Y6RgjlEbYYuZkVzEjciorYGsYk1vtRVgv6fXEmjuX7P14jrP0cwqa 9OGeuvsFMV/WqTz/5y+qzq6xnzDPQluz3l5UYFzjc1oVYw72RdUX4+wn+mpErbgi7Wx5 rJ1dD6gFTItdksuu4hloNwf3pYC1gPsADwMUUNvNVEAYUABIAhTuRp2PBXUc6Omk9+Ir zdaS35/wZWYffhu3Nbf6gmtuDbz5FtKrvofb4mW4LVqK2w1LfME5S5YuWbtEYjfQDUvW rsi6aaXHm339QtzmL8CtodETXNq4tvG+Rok1qA3hhmTDiQals4EaGluWZwVu9N1SFojc DOC8g2/niafHhbQeHmsnvhso3k5sj8VScjphjF3i4OP4WDaOhXiYh5iBxfgg6gaFYz2d PKfN5Sp5nufw7HRBdlt+QUkHarLbAlnphFNFk+y+PlltGRl6TVab3YGaAGrEqD7qbjPE LJcU0BFG9Da9xTiL0eE0/k0av5nGh9L4NXpJb/dqGv86jV8BxhzpV2n8chofpJfa5Jj1 EjMdAL+sKA0CeM8h2t82qgTzOoJEKJJOeDJTid1mR4nzOVrHQgBOsbbtEmh1QdsWgQbv 3mISJMvbbbaUAEd3W206bkO+nYJtiUionSJtW0JA/hSS94C0/4Ti7T2d8XF/dmeUrN9q im1MyLEtWynG7qV7E5bYloQU25rgsQcThaGHH6BD209sP71d2p6gWDwRCJbEEyB2O1/S tk6JtfNFbfuUmGDGdbvBzKZneSUj5IK7Bw3G/IB9Ph232ew6Q7xt4dx0ItNf0sGD3Nsm YWU8s82HPLp62sw2VHjobJsuJWd3Y5pY8tk2iG4HHacH2gZEkD/e5gmUXGKhF2ifzp1f pnEn7UNHdslQ+h1TAZyFcS/QU030C/D9WWrXe+xN4440fiaN96Tx02nclsI9J6i9zebA HHbTLjzC+iztwmIPUbKXq8leribb0lxNtoGrz1MzrWcuFoIGrhcjPEeNtIAVgtOZbWsN YO/QthaBhrRtlIEGtd0h0MDd67COvZSLKefuRgMsOtAWGCCohIRfJxcSDhckIBRXmyOh 7rOg5Vcg7FdNkJqezt1nvN4SHbvcAsdtZ+z2kr9/LsU+bzLpDT4tLNIbfDpwoN7A+qkv q6RgV3xX1S5J77DL5S+JfzA8v0T9gMRIbVkD9Iaj2lRXSXKnEtvZosTUP1b9cfMfpU0t ENL3A4GS8Pvj33/4/Z3v73v/xPuG29ai9Hans+T29DObxo7Tn9mUfnbT0GGpfFAfendT NDUXT5PHX9LUwmObW+TYOoyyFuOLSQU3TKgq2dBiiTWLB7bk5ZXEW0Ih3KAMl9zMJS5z hdnoCzpD/wD+jD6nvzMbrIuw2SH6go0HVAEk7qTPuYvZuRl9rMAGOsNNwE5Wys0AA0Bi pWhbSp8BHqYd9AjG3ErbKAG8mbbQ/cCPAz/J7PQT1D8K/EPU/xj4cfT5CeCHoi9gK2Az YAyNg/EP0TgqpYvQP58KaATwMBpOFwJfCnwZ+l+C+jLgi1EfB74UfS8BXAwYB8gHDItv LQ2O9vpHeb3FXvdIr7PIayv0mkd4DQVeKd/LLvQOGuwYMtg5NOYYFnPmRh0Do84BIUc4 5HSqLpvZYrUZjCabJCs2RtzGJHcoJF0l7ZN6JDnkHO+sckpByrH7jVl2r5ppd8se+7DS oaVDSgeVDizNLQ2XDigNlvpLvaXuUmepudRQKpWy0qoiSrons8nTJyQzCHjahGRRbHK7 FJ6aLIxNTpqrZlfvIrq3BqVJvhG+YHpS3tjOgdxls2ZXQ9JFdUuwA8LPkpPrWu6p2cXZ hCRtTEanVQsUn1KdDG9sV9n06l2cJtTU1CRHT65Cmk2oieUk6yejWVNOTbJQJDbn1LDJ ybFTksHohNg3XTfeeG7priGDKpJDK+Ymh1XUlZ9b8X9O6wPRN7TDA/Rn4HZT/+rzHv51 5sYbv7ElQ/fUfP9Lde8zvh5DtO3/uFiMyqqDNQJisaQ/GQd7MKs0Dc4hRTsdDVcsLG+n Yyn0Tgr9NoXeTaH3BNKndNMus2DuxVMnTE6apgKqZiezosi8jMwoZGzRCYYYCyD2e5lF U4HO+Xd5kqhlrOd3+v1D/f4uY9rKnpOMGUYj9aoo++9cIkYTIP93BhF9n2IzMdPLe36O dAerRfrSnh/980Ghu3+jkWSjYvYWdPdzGoJAcBB7GWGkWHM34DmUWNmv02N0sL+wR9nL /3xEUUM/Pbce9mII5nKQLWVfnFuup5/EXcDX17qvk9+S2sF6o+hHUq2k4dwttbJ9bDdL sOP9enbgydvYFjguM/uE8uDC7qbnKIN9wN5E7Hw3f0a6k/0MfTr69RPZ4/jbiN59F13A vqAmdgk7igh8BNtNQWpgrxLCZvYRVvoe+4itZ/sou49m6Z6Cv+KSmfxkSqJS+f+B+xrQ +gCb991HpiEkkf+ftYdm5EE/pFT91+tI5eU0tXugE5A3XT/01LhUPeRhCWRgNJ6RTT7I mokkdoZ9DOofhVR0sM3sDrZa8FNvdyHahUFTlWTi7B+g6mn2C/b93lbwNIzFdCl/u+fn lMcGI3+g90nfjpX5gu69+mximMebX+uc8nZaz1Ma/lnvWNonemoP28O+ZCfYKfY6qWwP bcLMDrAXIG+bwPVNmOEadh37lEhj0gtYVxX+vuVSshWxkvOvNWwbVi+0ZSnmcpxew5O+ 6doGeewn44YqerufJjH2S+jxDox37vXEuZl0epu0mn3GJp1X8wHW8yZ/ht0NvVnPluh1 S+UdcgeeMjT1F49PvayydNzYkjGjRxWPLCocUZB/4fBhsaEXDBk8KG9gNDcSDg3IyQ5m BfyZPq8nw+1SnQ67zWoxm4wGRZY4sWHkT/rLqisWJgNldTDF5VE1nLRdefqK/CRzByNR V7gov2Z4ulVSiSVZxuSkBx6VxcfUJA2x/k2uTEp56t8i6HxFMFyRlPPwi06aW58cMrU6 ElWPBPvqazBsMqusOhIJJnkefpehCr9Jc8P1SbUK5ajQSy5LsqpqAe09749BIRsTqcF9 anVyQG8Wjv4bJglr0tPZb5pXUqu6yxYoK08yzy5mez/JvKLZ6TEsyUqTQxB45KlI6aOx /CR5/pakjCR5r8CSzn+E6HZizDfQoKJ+YbSifgEoWl/3NU1PpygaCbeGW6dWu4qCkYg+ aTjCKdW7rJayaFmDBatASIICtstiRYlVFIAty3aR7WLSE9xWMRbxjMkO8rnFdCsELEzG 765DIloOuqEm4+saBMebzq1i6JZqxNBMT5H+zKShLGlMTSK8IBmfm2R3h3cN62zdhHjq urqYrT5aP/ea6qQ0F5PaxaS8isbpyezJVbNQhEkA6hrDgt3l+k0wL1zRGG5FXrStwz1a jq7nl9c3NtQJMaG6aDnqzGXVGyKdQQR81Rsqkq5Y0o7u9ls+CEqtFf4FYZFtbd0QTu5A oHdObUS0gRD4hw8Lt1ZE8TQMVrFwguBYfh/bdGm8rF5nTvzuueFk03ULQTP85m7qlf9I q5q0/T0C7oA/6Cm0QxBYQH3dQrGUhegpA4Vb727Ql7pJXxrkVQQ9AkRHSD+bgd6zqisa oxWgZ/qBIAj6S3n9+0YiyUBMdGxtrRBTnFuP2QvK4BdAQIZppDLQiWCMMJ+yZHy6jth0 nQd4YnxueU26KN0ANTL4kIzXldfUiEWlGJA05m1QLoyGW8WgxrykJ6ZG9qOuc/iwyVOr K8qFdKIlL6u+qMsf7EIaYXRvMfnRpjW/SxBJ1EyLTp6SkoJGQR9xq5ueUmBQLc15NE23 10d9zR98DX0nRifWtbZOjIYntta1zm3vabouGlajrbtsttZlFXVhXfMJ5XvvDiYnbqpJ qnWNNBZMFvI2EQFkxpTZgj0Tw41zUYLf+GhkTDDiwtCpNrAc31yd1jNIPORe6Fmr+jFW bINFCoYnCvPSDqsQTKpjhJpiJjOqoQfz8IiKev0G/cAmggeFpkg1eRULpqUJFIzgkbrA CLs3JV2KQSIRoUN3t8fZdcgkm6ZUp/Jhdl2wjcXzY+Bdnajp7K3xzhA1Tb01fd3rouCV X2xidJn4ZzINe94nz62uqDtcIow5ZoffZfXJzulY45kxSRMoprM7o6xaCnLRBCkelETK EoNLKE1mxvSOgiawkq1qNHwomlRjSaWsujNYWhNWXTCQ1CcM6RGFmKqHor8iYUSZR01S aZJ8Qq0YjCrICKOfOQaVfR3DFa11aek7d31oKlrXN/bpUWoVUFyxSJBBjUJvgyl6uNxR sdRXhbSnHFxSyZsolAq80Sk2qSbpEM4u6fhYv2FxwbLqMMwQ1HaKnghXhBsF15PhunLd HtQERX1vcXvPibpyYf+qIWhoEkzLN6QcZEvrRJoMk6dX96amVt8WvKVmOE5vh01uZ2Z4 UrHjbaeelnZWntOB82BpzrWonj4sHK5YUI4HIjNjGAqGRpCaOQyyKUS/OlojPMll9a1h Ifz1WJaOUdHQWpMPeZ1WDXuJjXAkGa8J9iUbamrGYpyrxTjoguatNRhhYXoEYL0ovxuN qodNhqUaVFUNY9tUDkEvFyqM5XZCqzrFisVCavpmihnftsCfnvMszLlmKOpnp0aBrDZh iJrWVjHmtOooxLy1NdiKdaTz2PD3L4inC9qZ6IKFV7RTUxX6AkX1+KAiGokKyteU41HX gO69Vgpn5N9O4Wv75o2eczDba3UK1/2LKDz3u1D4uu9E4Xl9Mz2PwvWY8zxB4YZvpnCS D/oWGp9L0niKpPFvIOn880h6/beTtLFvopjVAkyvUSfpwn8RSW/4LiRd9J1IurhvpueR dAnmvFiQdOk3k/R/QmiXnUfh5d9O4RV988Ykb8RsV+gUvulfROGV34XCq74Thb/XN9Pz KLwac/6eoPDN//8ofMs5FMYrH2IcJzLyney4cimbr1xKYeCtgFcAdQANcD3gM8C9gPX0 JVug7Ga1hmrWofwn6zCWsQ75JOB+No9jFwqYJz/FpipXsFo5yWaiTy12lx38+2j7Avog rWSj/ArWIV3MLsdeLvWekOEE2oAzI8bCbAbKvu3ieK8k462eAW8dTfATFmZFb/t/6eLA m8lzL7GDdekFbv2ecW4l0h6AN13m03EmEycRAZaVLg2ybJbDBrBQOh9O47FsLKtjP2Z/ pmWk8ev461KV9JR8q2JSRio7lLOGjcZBxvUmn2mMqc500jzV/LKl0rLd0mYdaV1vPW67 0rYdr7QwlCJeVUpYFRziNLzXNOXDMQJMKl7IHgKIPNLSe0gDy8ASsPIe26sf2M1EJ1nd i/c3BibSXC0YEXFFXHm4EVqcjUtNZ5sU9hWLy02g8nHtmPQozlTwni7umygRSVzax8gj ziOIS/ix/ML8Ija+KL9wgxLbcNv+EQVUm0FFdJx7n+r+SDtmOP0P/WCAs/k978p/ULrA iwxWFA8VWaiIU6mJSmWyJVhATRhkR/NpM5m97mbJox7pUo/XdrHxXeO7RhTU4lJymUtl kbC454VdagTAf3BWO4AzflCHLtJe1M6SUevWuvMQRdVQLT2hzdB+qv1Am9nBq3hV967u nTgPD0OiH8I8zOzqpw1qILcSb2pOxq1uf6UR7yTcckIRL0nyQrmVStzrr1QMsslIsmxs qeObeSdWzFWe5Cf4aa7w/NrlXQcPvqa+xsb/LhbrGt/dOaIgFosUR1xKcZ4r4qUwDdGO 8Sk05Em5fFLbti87xQkisa2YwyrMIcCej995p4cmZ9C7GWRW6B2F5is0QaZCeb38N1kq lmZIf5I+l2Qvz+PFXJqozFT4Rb4rfNxX4AtUVhjoacPbBr7AQCWGBYaHDJLi8/rulRWP LCuTZPLJilfO3B5w2xIhK1nNCYecKmomY7Mr7q/yc3/QCqJQlnqk9iDgcJfalVnIxncf qQXlMwupdoOs9jJ2ee3y2PJaBmYsF7/ltUXFo0eNJ1Y8MpJrLB5VVCh7PQYnGYwR71b1 e7fdTDHtzI+Ovv+bjym79T/r3xzM7/2r7+HFN5DppZNL3pn++2fXHd5U9djmv4IkoMkr kI/Nyv+C7rTH1y0I0Hw/1fhpcvbsbJ5lHGoca5QK7GTwjvJys82R7RjmkGw+3yDfKJ8k ZZMtZ1HOrTmbcmSn5MhwcFUyJyxxzwBLorCAJUhKDAi4EwUucjkTHtnenGloXhY8HeTB iDmw1LLWwi2uMN4Q1QmpXkZNOGAMgxTLjxysLSxEousw5FAnSPeRrhjL8qtXQCZpzrW1 14IU19YygcQ1uthXVDiqWI1Ei0eHXSOjvURRFdnlkSO5r7x3X8sj2rTZV9D9Z37U8eKx P5GkddAq7bCmvWs9PmPjcspDkGv81bRXyp77qfblopnawZdO4uME2A4mvwg9tMCKbYpf c4N9jZ3Pt66yckWmBpkC8kMyl612672S7JEk2URGyUrbbTaZue2yZFIssn2CZVOIrWW8 ilEVO4STSokx6xyJfo8XVXwZViwVSElJkiDStcuLigTq+qBQ7TwI5R7vLsnv6izsVDs3 KH3CgAasFnajmCKuIm/UBSRldF/BHyXnk092j6ZX6e7j0pyzjxzXVvIFvFznsQYeb8Q6 fOyueA0Uv9R4jZGPddNRz4ceXq0eU0+q0jjXZBcfrVyqcGOBxV5pMSWcTitLjKeroOZS whtwbLdKdnDQfdrN3X6H815LAd5yUZyqwMEmUsSL1qeguZSpHomBi91Crrv2C1MimOgq ye8+CDXVOUbnMC3XCI2NSGHmFbzSnr99bUIbPWqUNLX7TidGv147qJ26yXD0sgfW0cVm /uFftV9qX370zpeCP9djXb+C7HpZhN0Xr8+y0STvLC+fSDOJT8yamcVHWugWc6uZT/LP 8vNJ4VlhfoEdTKKHPKR4vJ48j8QCCScnzh2hhAnGcDyENQPqepVrjmupS3L5Wk4rpMQD 2ZVKNJs1W3PVI90HxPq69tf2aiu4tLwLR5tYlH4JRa2tJegllsSiuuWMFGZ6B0VzOY3E 3eD1CIGlf7v7nYMka4c/1j7WXqG5NH778Vd2tO3nhpYVixP3r1rSLLke07566S/aUbqL rqV19PioYzO0E92PPpDcserffvGIzlucQssnwVsr2xJfOt9MXnOeucI8w9xgVpxSSMqX JL9EBnmUPFGWLrPUWLjRnGkebJZuMdNe82/NvFhaKfG/cCrmZLbcbLnLIjG3SdlukGT4 N9Npk2SyM6VAiStVyjJFUay3rWU4cw7rkpxfW9t1sFaFvoIWneN7SQArpVur2sjFlEEw y14TeanIu+YoXXNWkz7TfqftefQsjaWvTp/WtnQvPiK8673g5SHwMgN+fCiZ4otWsTsZ x4Lm22mBixZINClvVt7386SK6IwoTxhpu5liF9DjF1Aih7YOoJkDKIRDZ8+AoQMsAzaz oYgahiIi8FiGGpSBCWcgkFBk5AYMVWxu5lN9YZ8kbpt9O3yyT7ieKaFope8uk82ZHcrO z5bE7eHsndlydhwV2XfF4cvq8JbezQbXDV42WGKD1cGbB0uDW0/byDbMGVkaWRuRQpGH IzzSynQdiQn5r12evh+u7YJWqIfF3eXOLNFdLPAGXbNVx351gwNuXBee5bW9slRLg4pH DiwqxOm4EVZejuYOLFYJZ+lpMZLSsoSCwbTnCDneff2LL6lUe/XLU9q7fNG2W+prb1xh eeSRWxdvnXefFLjnpSfe3vPg/p0/+fLF0+89BZ113dg88/pZl1Uu1n57Z+Km7auqL180 BWIF3VoPfrwPXyl062e7HzUS/POJ+A12V2UNXB6vySLJneEuc09z3+hudhsq/DP8DX5p UhaVhaeF54Wllc4WJx/rpKM5ZJWDckyWDIGEyeRxsMRVcHxSwhMIQdGyDc1xFzHXaRd3 RVO2RCJfCz5Asgp74s+pFDqn6xsIubz7QJ89Ecaxn9bFUq7AXWyI5sI7sqKU7uVm6PqW Itqh53+889f3vPGi9nca/ldy02jtfu0Xd1HLikXbtqxast565AqKfvUzchz8kC7QbtF+ pjVpk+WC77f9cNUPOneALgvgNLfgDZGIB4fH/fJOxUk7mduwUzEgMtlJcZOZdhYWxEj3 V7Ddam80VYSIjwALRHAi3uIgyssVd12Pa3veVep0eq+PXz1bElZqhpHMRiKXy8Xtzhwn t/ndmZU++B0DNTiowU2rjRuNnG1RveTN2MIzLFus9i0m2crUZiUONWX6p3+HmGyWWKZP WcRj5FcPwn/WZsGVqjDNcKy6cU5pLmQvZZ5r8wyRPrOF1zQcsV9R4Wil7qh2RNumLaSH aM3fTmmfPPNXjVyf/vb4uDr6Pi2lVbS15JM52lHtlPaZdlh/IcTFG1PlLOyTCZq9MF55 nZWWqlQlL5Ob5M2yPNtI0yWabSB8w+I2tBleMEiLnWS35li5Xc1RuVk2b2EZGVtIsjcr 5rUs7lWWcg+7geNrAJ3AfdQVcYEwO8L44AKxUyvIKyp0u0YOvpBi1MFvo2paot2q/Uh7 68+fnqqbsLdtr/KytlV7DEJww1tkJ/fhe+aKt1ykz3sr5m1hf4hvnyfRGsNHBu41NBh4 niFhOGD4k0GeZaY/KtSliMm/ZCC7TItlulkmu4lqTa+ZuMlgNKwzmzxmg2I2yQbFsF7E CbLB7MR3KtwpjQf6vXRKUsyqRJsRBnBJgn02MTfiC0leq9A+hZjSpHCHYmJGcklG1Wgz SIIOVkEDnQTdnQiWxmD1hQdBgeUwxZ2d+OHbKQQT14qgIrVF2GDyw9Qoqb1COpAUZhpJ XTIjZoqQq4OG8FHEunv4bdra7jeUl7sL+evdjWcP8WPdeE2o08XQCrrYiMV3DDNdbuLD rJdbeUgiLyeFe3kFn8HlQXwP/zuXfOZBZm62BCy80fKyhWfJZJGz5FmyZJYD8gXyO/Jf ZEU2m8w6YSTZAvu6zmrxWPEGUHJaQhb0NTA3lw0S6GFa6zSEDHy8YY7hPsM+wykQ1Gwp kIhJZP29RE6JVIkzq2ptsm627rAqeZIwIbtHjq8UOG41Oyutt7O4vY9yXbGYIFvgMKiE X2Hh4drl/i4QMLNofOd+1GBzpVvnDYJyacKtEARbvgKCthxkA82EVkcF4R6keijBfO0D 7YEz2n8oL391SnZ9OUauPWuQzV9tEzYVuiC36TLlZjfGR1c4Zjj4pcarjfwvdnoFS8Qm Ee9Pk7JsNpi3WOP4DHOLp4C53RB/Z7MuC2SW9H2Sw+GuVDxWCyQho2893Z2wlEINdItz XsQ8R/fIQingSVgkGiARMY+MRDu4TI4PtV9rf20q/Y9ntA9XKy8/ffi09nn3c5Jz6+36 By3E5sEXlME2Rdmz8esbM8mbQ0YPPWOin9roITP9u+sJF5+eRZnZG7L5kGya76QFEVog 07YgmbJystZZTWCpyZqVY5JzVYbVbMnNcG8JZ1CGd4sq6+V2w20h/1p7RtzirMwI2Vko xTJ75VWhtSEeymPCGyAuZQPVgzFEHDF1v7o/pmLbpPvS3m2C8Kwpj5oORlLBmC7l6W3C yEH5dCHpXlWPyYQHDdEA0sPP+ad+/r27Zq6e99KPyf67Xcf/eMf8NTO/t/DID7XXtU/b 7Fr9wtmV88pHL3vtrmeOF3XNmD3pomvKxq1+ZcvrYjNF7AA2ndvwrZCRheIu5QEmPwDh NChPLWNN4H5+bffvOuG+8rGLyUDMG0X8foDeOHZMO2ac9uSXxtQedR7GKNTHwEHBtNhe DCvrhwaIuvbiIMKoZxT9NEHqO02AX/EWuaJeXqiNOHdAzqb2fAhjOw/nI4PYw/GKve5X 3HyB8WbjXUZJcee5ueQ32ypDD8TNVWZeh2MAM3cFEn5fIjiA5T3Ifc5EvmO8gztsCZdq yZkQ8oc2eByCN2Gro9LBciGQufA2QzyN3KmElKXKPkX2S4OV+bBOEMW0lUZKMOug+icQ ILXHLSw8BO+TslIgCBwPwe1Ec0W8EykqTu/iwgHywPNkoiKfiqNhPXLmv9n2s81PQemc V7345K5fHaCd05x+47WVe0baJ2p/mHZR46r7kpv2HKh//LpXL4cDz1on/zT7vod//9RF 08CFWtAjAfo6cIZ0W3zKTJVanHRvBtV4aYOXqmWy4vPeGJ/MZUvmEAicbPVYB1olRMWq m9sV5vWTb7vkc1pdCbNqY1Y/a3F4mg3xLEcjDxiw7F7H1H0Iax3fVVioA8QRRGBzamPC TeGi2ogIU3ix6i4qzBRGZJDYGahYrbRoxecH3+85+sQ9CEGO3nDL4vXH7lj9xknK1chD lRt51T/elmKr39ql7RSfJGFNM7Gm0eCximjtgfhAF77AtE+xv2n/g/0Tu9IiU0L+icyz DGTwu32Vl8pXyxyHL6fjWQgnJkl0i4VsDzhdtM/1BoIwl8PDHlR1DjszKlUHZMCTMKmq 0w1Wu5utNhfYbUU4ITiMcAKhBHZEXVickG0wN/Y1UwkHF/hPAHFksRy8hUNGTAZ3HHFH CkdTRI3myqN/87zWpb1A0VOfHO++egCNSzzbPY1an27Puxifmzp6EJ8d0p7RDlbQv1NA rLVWq5UTWGsWG8g2xmfNyG7J5jW5tCGXqi1k8lsclbaB2QOHDbx84DUDlWJXhWuGSxoV mhji7MGwiDsfDGQHjdHtZm+2awA+Cnc7DW5XsMXjZISdT6TZFh8EUc6zfc3I/ViaCid7 LjeFCAsD0xsxZYwWG7qLKMVQrDFzdMTlgfuP5JKrl6+/9D/z0x/fv+gf+/9M/Mhj94XI clH1Nu3TffTqDSuX3fHGfdrjR6dv+sH2Lsr7kox00calZ/d+dfzKJqmUEje/+oT2C8Fr 3f/KwsaobG4HM/Yci1ugv9zpdnLJ2d5zKG71ZFZyyS1xVdZP2HKQd0r27YpKiGUsLWau trC429yIL4gbeqUVnqOL5Xfq4io8SGxOLZYXE3EBtrE+L7BQSBEdbPnT1p9rx269Z70h 1l11cu8jZ8/wfc++1H1Fem70B8xNYtlxB/PC+OFRssJa+uJhaMSIAjEsRjLE/vF235qM PvA0yJ6IW3xmkgwZBm6G1z4Ur8fqTlrPWPk4ebL8rvyRLN9kvsO8zSyJG3d4mdfk2m6R /GJ9ThPzOFrsUhBPxVfHOku9zGNvGOdp8cbXesnpHe/d55V2eCmJyXnB8ewcrz45rHk5 PLseUuqGq1YkBVlgoYQaFx3qKhp/COeMkOnlkOlrocBYh1eQJ3NUEexUmkR9lMpef/rW He7v/5aGax+sb7ld+6C5+XZ50hsnb1lyUnvq7F/4nhc7uy/le/b/svvSPr7qOvx/zVfn /wNf9Yl/I1/FHM9la9q+HMDcrDhBuiY+1mEih0x32R+yc+zrHU5yZJDFTpLVRlYrjoTI obgSBhXHyz5Hs9nTLMX95gU8U/pap/pF7XNSxwU4bE7F7Po9r9DVu8vld2o92ps0ggxQ jBHwxWd6NqxaueHOAL4ZNJKFRmqvame0v2mvd9CG3YcOPb37LSFXiLe0lfInmLew9a1x /0OZtM1A15lXmNebJfsQRBrD1VpV2MKT8Utg6q3OoJMP8tL98g/lNlnKMyLscofcc9yS XXEEnXZXwurzSz6IGoJ3J6y+yQFJyzIt4IGvVQkRifoNlh8BGBYZ0zdYwvlDbtxelUVz BwdI2I5iGEMjlAKW/4897OiTmxbB7L/TfLO2Unn7jZPacQ1nRO0bNQP/+erfJGmKMPzE Lu/5kJ9S8rCzuipeaDGxRIYrwX0OxaokTE670yBbnSY5w9lSJ3fKXASXYYQCm/UQ84Rs krE/wCGd2KIeVHHe2IWU2BGqr40oENY6QNHiouI8rzhlFE6Yn1p4kbZ2zRoa8tFHPxlU bAhRI5/Q0ZH7bkf3n15xCHrrV88YVp9K9btHkIcbxWw98FM+Jt7iiHc4qbc3g/Cd5oWs gBWxUexi6G85u5RV4ovDyfiGtopNYVPZNHY1RiCMgJ0tLoN4C3RldWXZleWxy1fOW1A/ 99IVc5fUNwyfsHSRmEGqlWi5CfAg4DEAXtHoXyeLXTcOefGdKSMTwA8QG5wxgEpANaAR sBqwEfAg4DFAO+BlwDHAScAZLNwE8AOGAMYAKgHVgEbAasDGnvSF57G+NLFwv3x+v3xB v/yIfvnCfvmifvmR/fLF/fKj+uXxpfp588NazsuX9MuP7Zcv65cv75ef3C8Pp3He+FX9 8tP65Wf3y+Pr9fP6z+2X1+XwHHo39Ku/vl8e/DpvvEX98ov75fUjjnPGX9qvflm//E0i /78B2AtSugplbmRzdHJlYW0KZW5kb2JqCjM0IDAgb2JqCjk0MzAKZW5kb2JqCjM1IDAg b2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvQXNjZW50IDk2NyAvQ2FwSGVpZ2h0 IDcyMyAvRGVzY2VudCAtMjExIC9GbGFncyAzMgovRm9udEJCb3ggWy0xMDg2IC00NDAg MTczNCAxMTY5XSAvRm9udE5hbWUgL05YSENORCtMdWNpZGFHcmFuZGUtQm9sZCAvSXRh bGljQW5nbGUKMCAvU3RlbVYgMTUwIC9BdmdXaWR0aCAtNTIzIC9NYXhXaWR0aCAxNzUw IC9TdGVtSCAxMDAgL1hIZWlnaHQgNTM2IC9Gb250RmlsZTIKMzMgMCBSID4+CmVuZG9i agozNiAwIG9iagpbIDMzMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNTY1IDY2 MCA2NjAgNjYwIDY2MCA2NjAgNjYwIDY2MCA2NjAgNjYwCjY2MCAyNDcgMCAwIDAgMCAw IDAgMCAwIDcxMiA3OTMgMCAwIDAgMCAwIDAgNzEwIDAgOTA4IDAgMCA2MTMgMCAwIDU3 MSAwIDAKMCAwIDAgMCAwIDM3MSAwIDM3MSAwIDAgMCA1ODggMCAwIDY2MyA1ODYgMCA2 NjAgNjU3IDAgMCAwIDMyNSA5NzAgNjU3IDYzOQo2NjMgMCAwIDAgNDA1IF0KZW5kb2Jq CjggMCBvYmoKPDwgL1R5cGUgL0ZvbnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9u dCAvTlhIQ05EK0x1Y2lkYUdyYW5kZS1Cb2xkIC9Gb250RGVzY3JpcHRvcgozNSAwIFIg L1dpZHRocyAzNiAwIFIgL0ZpcnN0Q2hhciAzMiAvTGFzdENoYXIgMTE2IC9FbmNvZGlu ZyAvTWFjUm9tYW5FbmNvZGluZwo+PgplbmRvYmoKMzcgMCBvYmoKKE1pY3Jvc29mdCBX b3JkIC0gKQplbmRvYmoKMzggMCBvYmoKKE1hYyBPUyBYIDEwLjYuOCBRdWFydHogUERG Q29udGV4dCkKZW5kb2JqCjM5IDAgb2JqCihTdGVwaGVuX0tlbnQpCmVuZG9iago0MCAw IG9iagooTWljcm9zb2Z0IFdvcmQpCmVuZG9iago0MSAwIG9iagooRDoyMDEyMDYxMzE4 MjM1NVowMCcwMCcpCmVuZG9iago0MiAwIG9iagooKQplbmRvYmoKNDMgMCBvYmoKWyBd CmVuZG9iagoxIDAgb2JqCjw8IC9UaXRsZSAzNyAwIFIgL0F1dGhvciAzOSAwIFIgL1By b2R1Y2VyIDM4IDAgUiAvQ3JlYXRvciA0MCAwIFIgL0NyZWF0aW9uRGF0ZQo0MSAwIFIg L01vZERhdGUgNDEgMCBSIC9LZXl3b3JkcyA0MiAwIFIgL0FBUEw6S2V5d29yZHMgNDMg MCBSID4+CmVuZG9iagp4cmVmCjAgNDQKMDAwMDAwMDAwMCA2NTUzNSBmIAowMDAwMDQz NTExIDAwMDAwIG4gCjAwMDAwMDQyMjMgMDAwMDAgbiAKMDAwMDAxMjA1NCAwMDAwMCBu IAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDQyMDMgMDAwMDAgbiAKMDAwMDAwNDMy NyAwMDAwMCBuIAowMDAwMDA3MTg2IDAwMDAwIG4gCjAwMDAwNDMwOTYgMDAwMDAgbiAK MDAwMDAzMjg2NiAwMDAwMCBuIAowMDAwMDAwMDAwIDAwMDAwIG4gCjAwMDAwMjQ5OTkg MDAwMDAgbiAKMDAwMDAwNDQ1MCAwMDAwMCBuIAowMDAwMDA3MTY1IDAwMDAwIG4gCjAw MDAwMTE0MDUgMDAwMDAgbiAKMDAwMDAwNzIyMiAwMDAwMCBuIAowMDAwMDExMzg0IDAw MDAwIG4gCjAwMDAwMTE1MTIgMDAwMDAgbiAKMDAwMDAxMTg0NyAwMDAwMCBuIAowMDAw MDExNjM2IDAwMDAwIG4gCjAwMDAwMTE4MjcgMDAwMDAgbiAKMDAwMDAxMTk1NCAwMDAw MCBuIAowMDAwMDEyMTUxIDAwMDAwIG4gCjAwMDAwMTIyMDEgMDAwMDAgbiAKMDAwMDAy NDA0NCAwMDAwMCBuIAowMDAwMDI0MDY2IDAwMDAwIG4gCjAwMDAwMjQzMDQgMDAwMDAg biAKMDAwMDAyNDQ2MCAwMDAwMCBuIAowMDAwMDI0OTc5IDAwMDAwIG4gCjAwMDAwMjUx NjEgMDAwMDAgbiAKMDAwMDAzMjM4MiAwMDAwMCBuIAowMDAwMDMyNDAzIDAwMDAwIG4g CjAwMDAwMzI2MjQgMDAwMDAgbiAKMDAwMDAzMzAzOCAwMDAwMCBuIAowMDAwMDQyNTU5 IDAwMDAwIG4gCjAwMDAwNDI1ODAgMDAwMDAgbiAKMDAwMDA0Mjg0MiAwMDAwMCBuIAow MDAwMDQzMjc4IDAwMDAwIG4gCjAwMDAwNDMzMTQgMDAwMDAgbiAKMDAwMDA0MzM2NiAw MDAwMCBuIAowMDAwMDQzMzk3IDAwMDAwIG4gCjAwMDAwNDM0MzAgMDAwMDAgbiAKMDAw MDA0MzQ3MiAwMDAwMCBuIAowMDAwMDQzNDkxIDAwMDAwIG4gCnRyYWlsZXIKPDwgL1Np emUgNDQgL1Jvb3QgMjIgMCBSIC9JbmZvIDEgMCBSIC9JRCBbIDwzNzQzMDAxYTgxMjE2 YWUyZThhY2IzY2EwNTJmYjc3MT4KPDM3NDMwMDFhODEyMTZhZTJlOGFjYjNjYTA1MmZi NzcxPiBdID4+CnN0YXJ0eHJlZgo0MzY3MAolJUVPRgo= --============_-872510567==_============-- From kent@bbn.com Wed Jun 13 14:17:54 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AAFEE11E80A3 for ; Wed, 13 Jun 2012 14:17:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.561 X-Spam-Level: X-Spam-Status: No, score=-106.561 tagged_above=-999 required=5 tests=[AWL=0.037, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RFuDt5ufJDF8 for ; Wed, 13 Jun 2012 14:17:53 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id B26BA11E8097 for ; Wed, 13 Jun 2012 14:17:53 -0700 (PDT) Received: from dhcp89-089-114.bbn.com ([128.89.89.114]:49364) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SeuwG-000AZP-09 for sidr@ietf.org; Wed, 13 Jun 2012 17:17:16 -0400 Mime-Version: 1.0 Message-Id: Date: Wed, 13 Jun 2012 17:17:48 -0400 To: sidr@ietf.org From: Stephen Kent Content-Type: multipart/alternative; boundary="============_-872500224==_ma============" Subject: [sidr] grandparenting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Jun 2012 21:17:54 -0000 --============_-872500224==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" OK, I just got around to reading this doc, and I have several observations: In the introduction (Section 1) the first example is: provider A allowed a child, C, to move to other provider(s) and keep their [sic] address space, either temporarily or permanently, and C's child, G, wished to stay with provider A. This seems like a poor example, absent additional info about the nature of the contractual arrangement between C and G. It might be the case that the arrangement allows G to opt out of having C advertise the address space that C received from A and sub-allocated to G, but that was not stated. If that option is not part of the deal between C and G, then G may have no basis for asking A to advertise this space, right? So, it would help to have more details in this example to make sure we're not suggesting that the RPKI be used to circumvent an agreement. I think the second, more generic example, is better, but it too could use some tweaking. The situation here is one in which a resource holder (C) is a player in the RPKI, but does not want to assume responsibility for managing resources that it sub-allocates, e.g., to G, AND it has no objection to this function being provided by the resource holder from which C receives its allocation. I agree with Wes's example. G may be looking to outsource management of its RPKI functions, but not change service providers. That has different implications for how this process is managed, and who does it. For example, G might hire someone to manage RPKI functions for it, and that need not be A, IF C is willing to issue a CA cert to the 3rd party selected by G. This would be invisible to RPs, if it is managed in the way I mentioned, whether the service is provided by A or Z. Section 3 talks about A having to verify that G is the holder of the resources in question. It omits a discussion about A verifying with C that C does not object to A inserting itself into the hierarchy in this fashion, essentially between C and G. The initial example fro Section 1 is used here and, again, I think it needs additional text to state assumptions as I noted above. I worry about the statement "Although A has the rights over their child's, C's, resources, it would be prudent and polite to ensure that C agrees to A forming a relationship to G." This implies details of the relationship between A and C that have not been stated. I also would have imagined a different technical proposal here. For example, A might reissue a certificate to C removing G's prefix(es) at some point in this process (consistent with a "make before break" model). This would ensure that C does not reallocate the prefix that A is now managing directly in its relationship with G. Also, removing that prefix would prevent C from issuing a ROA for the subsuming address space, causing G's traffic to be directed to C, if more-specific routes for G disappear. Yes, there needs to be a time overlap for this, but not suggesting this as the preferred end state is likely to confuse matters. The text here suggests that A might issue EE certificates and ROAs on behalf of G. I'd suggest it would be much cleaner for A to create a CA certificate representing G and the issue EE certificates and ROAs (and manifests and CRLs) relative to that CA, if G does not wish to operate its own CA. Since these certificates contain no names, A is not impersonating C or G by doing this, and it makes for a cleaner distinction between the resources that A is managing in the normal, hierarchic fashion, and the ones that are being treated specially. --============_-872500224==_ma============ Content-Type: text/html; charset="us-ascii" grandparenting
OK, I just got around to reading this doc, and I have several observations:

In the introduction (Section 1) the first example is:

   provider A allowed a child, C, to move to
   other provider(s) and keep their [sic] address space, either temporarily or
   permanently, and C's child, G, wished to stay with provider A.

This seems like a poor example, absent additional info about the nature of the contractual arrangement between C and G. It might be the case that the arrangement allows G to opt out of having C advertise the address space that C received from A and sub-allocated to G, but that was not stated. If that option is not part of the deal between C and G, then G may have no basis for asking A to advertise this space, right?  So, it would help to have more details in this example to make sure we're not suggesting that the RPKI be used to circumvent an agreement.
I think the second, more generic example, is better, but it too could use some tweaking. The situation here is one in which a resource holder (C) is a player in the RPKI, but does not want to assume responsibility for managing resources that it sub-allocates, e.g., to G, AND it has no objection to this function being provided by the resource holder from which C receives its allocation. I agree with Wes's example. G may be looking to outsource management of its RPKI functions, but not change service providers. That has different implications for how this process is managed, and who does it. For example, G might hire someone
to manage RPKI functions for it, and that need not be A, IF C is willing to
issue a CA cert to the 3rd party selected by G. This would be invisible to RPs,
if it is managed in the way I mentioned, whether the service is provided by A or Z.


Section 3 talks about A having to verify that G is the holder of the resources in question. It omits a discussion about A verifying with C that C does not object to A inserting itself into the hierarchy in this fashion, essentially between C and G. The initial example fro Section 1 is used here and, again, I think it needs additional text to state assumptions as I noted above. I worry about the statement "Although A has the rights over their child's, C's, resources, it would be prudent and polite to ensure that C agrees to A forming a relationship to G." This implies details of the relationship between A and C that have not been stated.
I also would have imagined a different technical proposal here. For example, A might reissue a certificate to C removing G's prefix(es) at some  point in this process (consistent with a "make before break" model). This would ensure that C does not reallocate the prefix that A is now managing directly in its relationship with G. Also, removing that prefix would prevent C from issuing a ROA for the subsuming address space, causing G's traffic to be directed to C, if more-specific routes for G disappear. Yes, there needs to be a time overlap for this, but not suggesting this as the preferred end state is likely to confuse matters.

The text here suggests that A might issue EE certificates and ROAs on behalf of G. I'd suggest it would be much cleaner for A to create a CA certificate representing G and the issue EE certificates and ROAs (and manifests and CRLs) relative to that CA, if G does not wish to operate its own CA. Since these certificates contain no names, A is not impersonating C or G by doing this, and it makes for a cleaner distinction between the resources that A is managing in the normal, hierarchic fashion, and the ones that are being treated specially.
--============_-872500224==_ma============-- From randy@psg.com Thu Jun 14 19:14:32 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 958BE11E809F for ; Thu, 14 Jun 2012 19:14:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.549 X-Spam-Level: X-Spam-Status: No, score=-2.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id av72I6rfFIsc for ; Thu, 14 Jun 2012 19:14:32 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 2FFF011E8098 for ; Thu, 14 Jun 2012 19:14:32 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SfM3T-000Fhd-9L; Fri, 15 Jun 2012 02:14:31 +0000 Date: Fri, 15 Jun 2012 11:14:30 +0900 Message-ID: From: Randy Bush To: Alexey Melnikov In-Reply-To: <4FD8CB92.9030205@isode.com> References: <4FD8CB92.9030205@isode.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg Subject: Re: [sidr] Discussion topics for the virtual interim on June 29th X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 02:14:32 -0000 we can always discuss draft-ymbk-rpki-grandparenting-00.txt i can try to put out a -01 randy From randy@psg.com Thu Jun 14 19:18:53 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B7BE811E80B6 for ; Thu, 14 Jun 2012 19:18:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.556 X-Spam-Level: X-Spam-Status: No, score=-2.556 tagged_above=-999 required=5 tests=[AWL=0.043, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id do-dA8UXB57R for ; Thu, 14 Jun 2012 19:18:53 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 5E1BC11E809F for ; Thu, 14 Jun 2012 19:18:53 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SfM7g-000FiI-3k; Fri, 15 Jun 2012 02:18:52 +0000 Date: Fri, 15 Jun 2012 11:18:51 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: References: User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr@ietf.org Subject: Re: [sidr] grandparenting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 02:18:53 -0000 steve. the EXAMPLE in the draft was one of a thousand. perhaps we need only one example. maybe two if the semantics are wildly different. randy From alexey.melnikov@isode.com Thu Jun 14 23:46:38 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32DA321F8480 for ; Thu, 14 Jun 2012 23:46:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.901 X-Spam-Level: X-Spam-Status: No, score=-101.901 tagged_above=-999 required=5 tests=[AWL=0.698, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PXmbDLlFd9ai for ; Thu, 14 Jun 2012 23:46:37 -0700 (PDT) Received: from statler.isode.com (statler.isode.com [62.3.217.254]) by ietfa.amsl.com (Postfix) with ESMTP id 7FE2021F847F for ; Thu, 14 Jun 2012 23:46:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1339742796; d=isode.com; s=selector; i=@isode.com; bh=L9I7Fh8J1pYwnCGwXmWe+MpbaFCulEKnxrrYQw7l68k=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=Weud0BcToWe9qfgkLUkEreHlNxr/aX5VRAaiI4dJZ0O8L9/Wvgc6qo3EUHBwFWdCZMR6qV q6hGaC8IrMBikMDblhbmB912bFSwAwIgZlth9yUAtfvzkrBXIJ3BhNQTP+YxVdUuF2Mz+4 rV4iA6wme9ciMK/+IbZhe5UNYeThuts=; Received: from [188.29.2.53] (188.29.2.53.threembb.co.uk [188.29.2.53]) by statler.isode.com (submission channel) via TCP with ESMTPSA id ; Fri, 15 Jun 2012 07:46:36 +0100 References: <4FD8CB92.9030205@isode.com> In-Reply-To: Message-Id: <996DA30F-DC37-4147-B8EE-CDF02A11A258@isode.com> X-Mailer: iPad Mail (9B206) From: Alexey Melnikov Date: Fri, 15 Jun 2012 07:46:20 +0100 To: Randy Bush MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii Cc: sidr wg Subject: Re: [sidr] Discussion topics for the virtual interim on June 29th X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 06:46:38 -0000 On 15 Jun 2012, at 03:14, Randy Bush wrote: > we can always discuss draft-ymbk-rpki-grandparenting-00.txt How much time do you think we will need to discuss it? > > i can try to put out a -01 From morrowc@ops-netman.net Fri Jun 15 10:53:54 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1824311E8088; Fri, 15 Jun 2012 10:53:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B84cPpJ4BQxt; Fri, 15 Jun 2012 10:53:53 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2001:470:e495:fade:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id 56B1311E8079; Fri, 15 Jun 2012 10:53:51 -0700 (PDT) Received: from donkey.her.corp.google.com (unknown [IPv6:2620:0:100a:0:b85f:c8c3:e6f3:d2de]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id 0D283320374; Fri, 15 Jun 2012 17:53:50 +0000 (UTC) Message-ID: <4FDB76AE.3020401@ops-netman.net> Date: Fri, 15 Jun 2012 13:53:50 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20120430 Thunderbird/12.0.1 MIME-Version: 1.0 To: "sidr@ietf.org" , "sidr-chairs@tools.ietf.org" , sidr-ads@tools.ietf.org, iesg-secretary@ietf.org X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [sidr] Requesting SIDR Interim (Virtual) meeting: 06/29/2012 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 17:53:54 -0000 Hello IESG Secretary, Please send out an announcement to the right places for an interim meeting (virtual attendance only) for the SIDR-wg, 06/29/2012 Location: Virtual! Time: 0900 - 1300 EDT Draft agenda to be sent 6/22/2012. Thanks! -Chris (sidr-co-chair) From iesg-secretary@ietf.org Fri Jun 15 11:11:52 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 137B221F8551; Fri, 15 Jun 2012 11:11:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.505 X-Spam-Level: X-Spam-Status: No, score=-102.505 tagged_above=-999 required=5 tests=[AWL=0.094, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EmqSKmW7KBgf; Fri, 15 Jun 2012 11:11:51 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F81121F854F; Fri, 15 Jun 2012 11:11:51 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: IESG Secretary To: IETF Announcement List X-Test-IDTracker: no X-IETF-IDTracker: 4.20 Message-ID: <20120615181150.10068.10181.idtracker@ietfa.amsl.com> Date: Fri, 15 Jun 2012 11:11:50 -0700 Cc: sidr@ietf.org Subject: [sidr] SIDR Working Group Virtual Interim Meeting: Friday, June 29, 2012 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 18:11:52 -0000 The SIDR working group will hold a virtual interim meeting on June 29, = 2012. Location: Virtual! Time: 0900 - 1300 EDT Agenda and dial-in information will be posted to the SIDR mailing list on J= une = 22, 2012. From jgs@juniper.net Fri Jun 15 11:43:52 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF08D21F8638 for ; Fri, 15 Jun 2012 11:43:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jTgz16U+4Vm4 for ; Fri, 15 Jun 2012 11:43:52 -0700 (PDT) Received: from exprod7og119.obsmtp.com (exprod7og119.obsmtp.com [64.18.2.16]) by ietfa.amsl.com (Postfix) with ESMTP id 2456221F8637 for ; Fri, 15 Jun 2012 11:43:49 -0700 (PDT) Received: from P-EMHUB02-HQ.jnpr.net ([66.129.224.36]) (using TLSv1) by exprod7ob119.postini.com ([64.18.6.12]) with SMTP ID DSNKT9uCZGqAfWD6zaIBoVh5FE9SBek2y06r@postini.com; Fri, 15 Jun 2012 11:43:51 PDT Received: from [172.16.13.202] (172.16.13.202) by P-EMHUB02-HQ.jnpr.net (172.24.192.33) with Microsoft SMTP Server id 8.3.213.0; Fri, 15 Jun 2012 11:42:11 -0700 MIME-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset="us-ascii" From: "John G. Scudder" In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A29D@Hermes.columbia.ads.sparta.com> Date: Fri, 15 Jun 2012 14:42:10 -0400 Content-Transfer-Encoding: quoted-printable Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com>, <24B20D14B2CD29478C8D5D6E9CBB29F625F1A29D@Hermes.columbia.ads.sparta.com> To: "Murphy, Sandra" X-Mailer: Apple Mail (2.1278) Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 18:43:53 -0000 True in the context of bgpsec. But this is just pfx-validate. = Nonetheless, I am OK with leaving it as an exercise for the implementor = -- as Hannes notes, this is how it ends up working anyway. --John On Jun 12, 2012, at 12:48 PM, Murphy, Sandra wrote: > Speaking as regular ol' member: >=20 > wrt: >=20 >> One nit - we've had several conversations about whether to use=20 >> AS_Path as synonymous with AS4_Path since we require (with a=20 >> MUST) support for 4-octet ASNs. I don't remember which way=20 >> we came down on the matter, whether to explicitly say=20 >> AS4_PATH since that is what will really be used, or to leave=20 >> that as an exercise for the implementer. >=20 > I do not believe that AS4_PATH would "really be used" by a bgpsec = capable router. >=20 > The MUST support for 4 byte AS numbers means that the following text = from RFC4893 applies: >=20 > The new attributes, AS4_PATH and AS4_AGGREGATOR SHOULD NOT be = carried > in the UPDATE messages between NEW BGP peers. A NEW BGP speaker = that > receives the AS4_PATH and AS4_AGGREGATOR path attributes in an = UPDATE > message from a NEW BGP speaker SHOULD discard these path attributes > and continue processing the UPDATE message. >=20 > Each neighbor that has negotiated the bgpsec capability is a "NEW BGP = speaker" because it must support 4 byte ASNs. NEW BGP speakers use 4 = byte ASNs in the AS_PATH (not AS4_PATH). >=20 > The RFC4893 text says SHOULD rather than MUST, so it is possible that = a bgpsec speaker might actually receive the AS4_PATH attribute, but = dropping the attribute is expected and just fine. >=20 > --Sandy, speaking as regular ol' wg member >=20 > ________________________________________ > From: George, Wes [wesley.george@twcable.com] > Sent: Tuesday, June 12, 2012 8:22 AM > To: Murphy, Sandra; sidr@ietf.org > Subject: RE: WGLC for draft-ietf-sidr-pfx-validate-06 >=20 > I have read this draft and previous versions and I support publishing = it. >=20 > One nit - we've had several conversations about whether to use AS_Path = as synonymous with AS4_Path since we require (with a MUST) support for = 4-octet ASNs. I don't remember which way we came down on the matter, = whether to explicitly say AS4_PATH since that is what will really be = used, or to leave that as an exercise for the implementer. >=20 > Thanks, >=20 > Wes George >=20 >=20 >=20 >> -----Original Message----- >> From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf = Of >> Murphy, Sandra >> Sent: Friday, June 01, 2012 7:00 PM >> To: sidr@ietf.org >> Subject: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 >>=20 >> The authors have stated that they believe that draft-ietf-sidr-pfx- >> validate-06 "BGP Prefix Origin Validation" is ready for a working = group >> last call. >>=20 >> The draft can be accessed at = http://tools.ietf.org/html/draft-ietf-sidr- >> pfx-validate-06 and https://datatracker.ietf.org/doc/draft-ietf-sidr- >> pfx-validate/ >>=20 >> This announces the beginning of the wglc. The last call will end on >> Friday, 15 Jun 2012. >>=20 >> Please judge whether you believe that this work is ready for = publication >> and send any comments to the list. >>=20 >> --Sandy, speaking as wg co-chair >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr >=20 > This E-mail and any of its attachments may contain Time Warner Cable = proprietary information, which is privileged, confidential, or subject = to copyright belonging to Time Warner Cable. This E-mail is intended = solely for the use of the individual or entity to which it is addressed. = If you are not the intended recipient of this E-mail, you are hereby = notified that any dissemination, distribution, copying, or action taken = in relation to the contents of and attachments to this E-mail is = strictly prohibited and may be unlawful. If you have received this = E-mail in error, please notify the sender immediately and permanently = delete the original and any copy of this E-mail and any printout. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From mlepinski@bbn.com Fri Jun 15 12:08:47 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 22FFD11E80C7 for ; Fri, 15 Jun 2012 12:08:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ts8BKNC3Ssbb for ; Fri, 15 Jun 2012 12:08:46 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 59C9311E8088 for ; Fri, 15 Jun 2012 12:08:41 -0700 (PDT) Received: from mail.bbn.com ([128.33.0.48]:33449) by smtp.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SfbsI-000DPN-NI for sidr@ietf.org; Fri, 15 Jun 2012 15:08:02 -0400 Received: from [128.89.253.157] by mail.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1Sfbst-0004MN-Dz for sidr@ietf.org; Fri, 15 Jun 2012 15:08:39 -0400 Message-ID: <4FDB8840.2030903@bbn.com> Date: Fri, 15 Jun 2012 15:08:48 -0400 From: Matt Lepinski User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: sidr@ietf.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [sidr] Follow-up on June 6 Interim : Confederations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 19:08:47 -0000 We had significant discussion at the June 6 Interim on the topic of supporting confederation in BGPSEC without an AS-Path attribute. My understanding was that at the interim there was some consensus for the following confederation solution (but this consensus has not yet been discussed/confirmed this consensus on the list): 1) We specify the first bit in the (signed) Flags field of the Secure_Path as a marker for entering a confederation. (Note: the Flags field is specified in -03 version of the bgpsec-protocol draft but all 8 Flag bits are reserved for future use in -03) 2) When a signed (BGPSEC) update message enters a confederation, the first member of the confederation who gets the update sets the first bit of the Flags field to 1. (That is, the first confederation member when adding its own AS number to the Secure_Path also includes a Flags octet with the first bit set to 1.) 3) When a signed (BGPSEC) update message is about to be sent to a peer outside the confederation, the BGPSEC speaker traces backward through the Secure_Path to find the most recently added Secure_Path segment containing a Flags field whose first bit is set to 1. The BGPSEC speaker then deletes all of the Secure_Path segments up to and including the segment with the Flags bit set to 1. Finally, this BGPSEC speaker then adds his a Secure_Path segment containing the Public AS of the confederation. (Note that this means that any BGPSEC speaker in a confederation who has a peer external to the confederation must have a signing key associated with an RPKI router certificate containing the public AS of the confederation.) The advantage of this above approach to confederations is that it does NOT require that a BGPSEC speaker in a confederation be explicitly configured with the AS numbers of every AS belonging to the confederation. Also, this approach does not make any assumptions about the loop detection algorithms employed by any BGP speaker on the path. If it would be helpful, I could push a quick -04 revision to the protocol specification next week that fleshes out what this change would look like when incorporated into the BGPSEC protocol draft. (Though not included in this message, the protocol draft will also need to include explicit instructions for re-constructing the AS_confed_segments of the AS_Path attribute in the case where within a confederation the update message is sent to a peer that does not support BGPSEC.) Final note: At the interim, we discussed both confederations as well as AS number migration (and other circumstances in which a single router needs to use different AS numbers on different BGP sessions to different peers). I outlined above the protocol change that I believe is needed to accommodate confederations, and I believe that no changes new protocol mechanisms are needed to accommodate routers that use different AS numbers on different BGP sessions. No one at the interim raised any other issues arising from the removal of AS_Path. (That is, if you weren't able to make it to the interim and you have a new issue that arises from the removal of AS_Path from BGPSEC update messages, please send mail to the SIDR list.) - Matt Lepinski From kotikalapudi.sriram@nist.gov Fri Jun 15 13:07:38 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A113A21F84FC for ; Fri, 15 Jun 2012 13:07:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aeE+a3IsIs+7 for ; Fri, 15 Jun 2012 13:07:38 -0700 (PDT) Received: from wsget2.nist.gov (wsget2.nist.gov [129.6.13.151]) by ietfa.amsl.com (Postfix) with ESMTP id 7766D21F8508 for ; Fri, 15 Jun 2012 13:07:37 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget2.nist.gov (129.6.13.151) with Microsoft SMTP Server (TLS) id 14.1.355.2; Fri, 15 Jun 2012 16:07:15 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Fri, 15 Jun 2012 16:07:36 -0400 From: "Sriram, Kotikalapudi" To: Matt Lepinski , "sidr@ietf.org" Date: Fri, 15 Jun 2012 16:07:36 -0400 Thread-Topic: [sidr] Follow-up on June 6 Interim : Confederations Thread-Index: Ac1LKfOv+wFfjLumSzmFiaaDEqc6oQABwIMg Message-ID: References: <4FDB8840.2030903@bbn.com> In-Reply-To: <4FDB8840.2030903@bbn.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Subject: Re: [sidr] Follow-up on June 6 Interim : Confederations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 20:07:38 -0000 This solution for confeds *requires* each AS within a confed to sign internally (i.e., from AS to AS within the confed). It does not allow the choice to a confed operator to sign or not sign the updates internally. For instance, the operator may be satisfied with the level of mutual trust within the confed, and therefore may choose to not sign updates internally. Do we want to provision this choice into the protocol? Discussion points: Having this choice helps the operator to avoid the extra processing burden for the confed ASes when they have sufficient trust within the confed. If we decide that the protocol must be flexible enough to offer this choice, then one solution would be to keep the AS_PATH. Then the confed sequence info is carried in the AS_PATH as normal, and the operator can choose to sign or not sign updates internally. A secondary advantage of the AS_PATH based approach is that in the lazy mode or super lazy mode (which we discussed at the last meeting), the processing of updates in the confed ASes becomes less complex. The processing cost also decreases for the case when a BGPSEC router needs to do conversion to regular BGP update for a non-BGPSEC peer. Sriram >-----Original Message----- >From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of Matt >Lepinski >Sent: Friday, June 15, 2012 3:09 PM >To: sidr@ietf.org >Subject: [sidr] Follow-up on June 6 Interim : Confederations > >We had significant discussion at the June 6 Interim on the topic of supporting >confederation in BGPSEC without an AS-Path attribute. > >My understanding was that at the interim there was some consensus for the >following confederation solution (but this consensus has not yet been >discussed/confirmed this consensus on the list): >1) We specify the first bit in the (signed) Flags field of the Secure_Path as a marker >for entering a confederation. > (Note: the Flags field is specified in -03 version of the bgpsec-protocol draft but >all 8 Flag bits are reserved for future use in >-03) >2) When a signed (BGPSEC) update message enters a confederation, the first >member of the confederation who gets the update sets the first bit of the Flags >field to 1. > (That is, the first confederation member when adding its own AS number to the >Secure_Path also includes a Flags octet with the first bit set to 1.) >3) When a signed (BGPSEC) update message is about to be sent to a peer outside >the confederation, the BGPSEC speaker traces backward through the Secure_Path >to find the most recently added Secure_Path segment containing a Flags field >whose first bit is set to 1. The BGPSEC speaker then deletes all of the Secure_Path >segments up to and including the segment with the Flags bit set to 1. Finally, this >BGPSEC speaker then adds his a Secure_Path segment containing the Public AS of >the confederation. > (Note that this means that any BGPSEC speaker in a confederation who has a >peer external to the confederation must have a signing key associated with an >RPKI router certificate containing the public AS of the confederation.) > >The advantage of this above approach to confederations is that it does NOT >require that a BGPSEC speaker in a confederation be explicitly configured with the >AS numbers of every AS belonging to the confederation. Also, this approach does >not make any assumptions about the loop detection algorithms employed by any >BGP speaker on the path. > >If it would be helpful, I could push a quick -04 revision to the protocol >specification next week that fleshes out what this change would look like when >incorporated into the BGPSEC protocol draft. (Though not included in this >message, the protocol draft will also need to include explicit instructions for re- >constructing the AS_confed_segments of the AS_Path attribute in the case where >within a confederation the update message is sent to a peer that does not >support BGPSEC.) > >Final note: At the interim, we discussed both confederations as well as AS number >migration (and other circumstances in which a single router needs to use different >AS numbers on different BGP sessions to different peers). I outlined above the >protocol change that I believe is needed to accommodate confederations, and I >believe that no changes new protocol mechanisms are needed to accommodate >routers that use different AS numbers on different BGP sessions. No one at the >interim raised any other issues arising from the removal of AS_Path. (That is, if >you weren't able to make it to the interim and you have a new issue that arises >from the removal of AS_Path from BGPSEC update messages, please send mail to >the SIDR list.) > From mlepinski@bbn.com Fri Jun 15 13:52:34 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A030311E80D7 for ; Fri, 15 Jun 2012 13:52:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HnxR5311jwLg for ; Fri, 15 Jun 2012 13:52:30 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id BECEB11E8088 for ; Fri, 15 Jun 2012 13:52:28 -0700 (PDT) Received: from mail.bbn.com ([128.33.0.48]:34532) by smtp.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SfdUk-000F9T-Ny; Fri, 15 Jun 2012 16:51:50 -0400 Received: from [128.89.255.6] by mail.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1SfdVL-0008Kl-Eg; Fri, 15 Jun 2012 16:52:27 -0400 Message-ID: <4FDBA094.5020906@bbn.com> Date: Fri, 15 Jun 2012 16:52:36 -0400 From: Matt Lepinski User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: "Sriram, Kotikalapudi" References: <4FDB8840.2030903@bbn.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: "sidr@ietf.org" Subject: Re: [sidr] Follow-up on June 6 Interim : Confederations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 20:52:34 -0000 If we want to make it optional for ASes to sign internally to a confed, that is perfectly fine with me. As long as they add their AS number to the Secure_Path, it would be easy to modify this solution so that ASes within a confed can optionally leave the digital signature field empty. With regard processing requirements and the AS_Path attribute. I believe that carrying the AS_Path attribute in BGPSEC messages slightly increases the amount of processing that must be done when receiving a signed update message (since the receiver must perform some additional checks to verify that the secured data in the Path_Signatures_Attribute is consistent with the AS_Path attribute), but slightly decreases the amount of work that must be done when sending to a non-BGPSEC peer (since stripping the signatures attribute is easier than recomputing the AS_Path). However, in either case, I don't think it a big difference in the amount of processing required. Also, I haven't thought enough about this to know to what extent processing changes in the "lazy" case or the confederation case. - Matt Lepinski On 6/15/2012 4:07 PM, Sriram, Kotikalapudi wrote: > This solution for confeds *requires* each AS within a confed to sign internally > (i.e., from AS to AS within the confed). It does not allow the choice to > a confed operator to sign or not sign the updates internally. > For instance, the operator may be satisfied with the level of mutual trust > within the confed, and therefore may choose to not sign updates internally. > > Do we want to provision this choice into the protocol? > > Discussion points: > > Having this choice helps the operator to avoid the extra processing burden for > the confed ASes when they have sufficient trust within the confed. > > If we decide that the protocol must be flexible enough to offer this choice, > then one solution would be to keep the AS_PATH. > Then the confed sequence info is carried in the AS_PATH as normal, > and the operator can choose to sign or not sign updates internally. > > A secondary advantage of the AS_PATH based approach is that > in the lazy mode or super lazy mode (which we discussed at the last meeting), > the processing of updates in the confed ASes becomes less complex. > The processing cost also decreases for the case when a BGPSEC router > needs to do conversion to regular BGP update for a non-BGPSEC peer. > > Sriram > >> -----Original Message----- >> From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of Matt >> Lepinski >> Sent: Friday, June 15, 2012 3:09 PM >> To: sidr@ietf.org >> Subject: [sidr] Follow-up on June 6 Interim : Confederations >> >> We had significant discussion at the June 6 Interim on the topic of supporting >> confederation in BGPSEC without an AS-Path attribute. >> >> My understanding was that at the interim there was some consensus for the >> following confederation solution (but this consensus has not yet been >> discussed/confirmed this consensus on the list): >> 1) We specify the first bit in the (signed) Flags field of the Secure_Path as a marker >> for entering a confederation. >> (Note: the Flags field is specified in -03 version of the bgpsec-protocol draft but >> all 8 Flag bits are reserved for future use in >> -03) >> 2) When a signed (BGPSEC) update message enters a confederation, the first >> member of the confederation who gets the update sets the first bit of the Flags >> field to 1. >> (That is, the first confederation member when adding its own AS number to the >> Secure_Path also includes a Flags octet with the first bit set to 1.) >> 3) When a signed (BGPSEC) update message is about to be sent to a peer outside >> the confederation, the BGPSEC speaker traces backward through the Secure_Path >> to find the most recently added Secure_Path segment containing a Flags field >> whose first bit is set to 1. The BGPSEC speaker then deletes all of the Secure_Path >> segments up to and including the segment with the Flags bit set to 1. Finally, this >> BGPSEC speaker then adds his a Secure_Path segment containing the Public AS of >> the confederation. >> (Note that this means that any BGPSEC speaker in a confederation who has a >> peer external to the confederation must have a signing key associated with an >> RPKI router certificate containing the public AS of the confederation.) >> >> The advantage of this above approach to confederations is that it does NOT >> require that a BGPSEC speaker in a confederation be explicitly configured with the >> AS numbers of every AS belonging to the confederation. Also, this approach does >> not make any assumptions about the loop detection algorithms employed by any >> BGP speaker on the path. >> >> If it would be helpful, I could push a quick -04 revision to the protocol >> specification next week that fleshes out what this change would look like when >> incorporated into the BGPSEC protocol draft. (Though not included in this >> message, the protocol draft will also need to include explicit instructions for re- >> constructing the AS_confed_segments of the AS_Path attribute in the case where >> within a confederation the update message is sent to a peer that does not >> support BGPSEC.) >> >> Final note: At the interim, we discussed both confederations as well as AS number >> migration (and other circumstances in which a single router needs to use different >> AS numbers on different BGP sessions to different peers). I outlined above the >> protocol change that I believe is needed to accommodate confederations, and I >> believe that no changes new protocol mechanisms are needed to accommodate >> routers that use different AS numbers on different BGP sessions. No one at the >> interim raised any other issues arising from the removal of AS_Path. (That is, if >> you weren't able to make it to the interim and you have a new issue that arises > >from the removal of AS_Path from BGPSEC update messages, please send mail to >> the SIDR list.) >> From randy@psg.com Fri Jun 15 14:43:12 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E59B11E80F7 for ; Fri, 15 Jun 2012 14:43:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.566 X-Spam-Level: X-Spam-Status: No, score=-2.566 tagged_above=-999 required=5 tests=[AWL=0.033, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1E9pl+4dUexj for ; Fri, 15 Jun 2012 14:43:12 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 05CBE11E80F5 for ; Fri, 15 Jun 2012 14:43:12 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SfeIO-000ILy-No; Fri, 15 Jun 2012 21:43:09 +0000 Date: Sat, 16 Jun 2012 06:43:07 +0900 Message-ID: From: Randy Bush To: "Sriram, Kotikalapudi" In-Reply-To: References: <4FDB8840.2030903@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: "sidr@ietf.org" Subject: Re: [sidr] Follow-up on June 6 Interim : Confederations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Jun 2012 21:43:12 -0000 > This solution for confeds *requires* each AS within a confed to sign internally > (i.e., from AS to AS within the confed). It does not allow the choice to > a confed operator to sign or not sign the updates internally. > For instance, the operator may be satisfied with the level of mutual trust > within the confed, and therefore may choose to not sign updates internally. > > Do we want to provision this choice into the protocol? sure, if they strip bgpsec and reconstruct the as-path. in bgpsec, all ass sign. end. randy From morrowc@ops-netman.net Fri Jun 15 19:38:06 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43AD421F850B for ; Fri, 15 Jun 2012 19:38:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k3XPxzJHiSP5 for ; Fri, 15 Jun 2012 19:38:05 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2001:470:e495:fade:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id C264221F847B for ; Fri, 15 Jun 2012 19:37:57 -0700 (PDT) Received: from [192.168.1.126] (c-98-204-226-233.hsd1.va.comcast.net [98.204.226.233]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id 953D7320283; Sat, 16 Jun 2012 02:37:55 +0000 (UTC) Message-ID: <4FDBF181.7060809@ops-netman.net> Date: Fri, 15 Jun 2012 22:37:53 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:12.0) Gecko/20120430 Thunderbird/12.0.1 MIME-Version: 1.0 To: "'sidr-chairs@tools.ietf.org'" , "'sidr@ietf.org'" X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [sidr] Minutes of 6/6/12 meeting uploaded X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2012 02:38:06 -0000 Thanks to the minutes taker (Anuja) we have minutes, I uploaded them to: -chris co-chair From randy@psg.com Fri Jun 15 21:50:35 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30F8521F8470 for ; Fri, 15 Jun 2012 21:50:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.572 X-Spam-Level: X-Spam-Status: No, score=-2.572 tagged_above=-999 required=5 tests=[AWL=0.027, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gzB3ho4SDOl0 for ; Fri, 15 Jun 2012 21:50:34 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 3572921F8467 for ; Fri, 15 Jun 2012 21:50:34 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sfky1-000Kt3-Kq for sidr@ietf.org; Sat, 16 Jun 2012 04:50:33 +0000 Date: Sat, 16 Jun 2012 13:50:31 +0900 Message-ID: From: Randy Bush To: sidr wg list In-Reply-To: <4FDBF181.7060809@ops-netman.net> References: <4FDBF181.7060809@ops-netman.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Subject: [sidr] bgpsec and confeds [was: Minutes of 6/6/12 meeting uploaded] X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2012 04:50:35 -0000 bgpsec and confederations allow me to try to state clearly for the list When an update enters the first AS in a confederation, all last internal ASBRs within the entry AS of the confederation, i.e the first signers within the confederation, set a flag in the signature block that says "I am the first signature within the confederation." The update wanders around normally in the confederation and every sending internal confederation ASBR signs it with their internal AS. A confederation's exit router looks backwards in the AS sequence until it finds the first, i.e. most recent, instance of that flag. If it finds no flag, the update is treated as originated within the confederation. It strips the signature block containing the flag and all subsequent signature blocks. All signs of the internals of the confederation have now been removed. It then forward signs to the next AS, using the identity of the public confederation AS. While the update is traversing the confederation, if it should hit a peering where the peer is is not bgpsec capable, it strips all bgpsec gloop and reconstructs a classic AS_path. this is believed to handle the loop disease (e.g. the cisco "neighbor allowas-in" command). what if anything should be done if you find the confed flag when you are not inside a confed is a topic for discussion. does anyone see a flaw in the above? please please review so we can put it to bed. randy From jakob.heitz@ericsson.com Sat Jun 16 00:31:03 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D219E21F855B for ; Sat, 16 Jun 2012 00:31:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.979 X-Spam-Level: X-Spam-Status: No, score=-5.979 tagged_above=-999 required=5 tests=[AWL=0.620, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FiRoSUK0rerf for ; Sat, 16 Jun 2012 00:31:02 -0700 (PDT) Received: from imr3.ericy.com (imr3.ericy.com [198.24.6.13]) by ietfa.amsl.com (Postfix) with ESMTP id D2A7121F855F for ; Sat, 16 Jun 2012 00:31:02 -0700 (PDT) Received: from eusaamw0707.eamcs.ericsson.se ([147.117.20.32]) by imr3.ericy.com (8.13.8/8.13.8) with ESMTP id q5G7V1mF019294 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Sat, 16 Jun 2012 02:31:01 -0500 Received: from EUSAACMS0701.eamcs.ericsson.se ([169.254.1.64]) by eusaamw0707.eamcs.ericsson.se ([147.117.20.32]) with mapi; Sat, 16 Jun 2012 03:31:00 -0400 From: Jakob Heitz To: Randy Bush , sidr wg list Date: Sat, 16 Jun 2012 03:31:29 -0400 Thread-Topic: Confeds and clusters Thread-Index: Ac1LkfoGVSx4n83+Qliu1LRmD2nVGw== Message-ID: <8F5B0091-FF46-479B-8608-DA0537B15427@ericsson.com> References: <4FDBF181.7060809@ops-netman.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] Confeds and clusters X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2012 07:31:03 -0000 All the effort to sign the confed AS got me thinking. A route reflector cluster is like a member AS in a confed. Is there a case for signing the cluster list too? IMHO: AS boundaries are for marking boundaries of trust. Confeds are for achieving scalability within an AS. I think signatures are only needed across trust boundaries. More is unnecessary complexity. -- Jakob Heitz. On Jun 15, 2012, at 9:50 PM, "Randy Bush" wrote: > bgpsec and confederations >=20 > allow me to try to state clearly for the list >=20 > When an update enters the first AS in a confederation, all last > internal ASBRs within the entry AS of the confederation, i.e the > first signers within the confederation, set a flag in the signature > block that says "I am the first signature within the confederation." >=20 > The update wanders around normally in the confederation and every > sending internal confederation ASBR signs it with their internal AS. >=20 > A confederation's exit router looks backwards in the AS sequence > until it finds the first, i.e. most recent, instance of that flag. > If it finds no flag, the update is treated as originated within the > confederation. >=20 > It strips the signature block containing the flag and all subsequent > signature blocks. All signs of the internals of the confederation > have now been removed. >=20 > It then forward signs to the next AS, using the identity of the > public confederation AS. >=20 > While the update is traversing the confederation, if it should hit a > peering where the peer is is not bgpsec capable, it strips all > bgpsec gloop and reconstructs a classic AS_path. >=20 > this is believed to handle the loop disease (e.g. the cisco "neighbor > allowas-in" command). >=20 > what if anything should be done if you find the confed flag when you are > not inside a confed is a topic for discussion. >=20 > does anyone see a flaw in the above? please please review so we can put > it to bed. >=20 > randy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From tim@ripe.net Sat Jun 16 01:43:29 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 232EE21F8597 for ; Sat, 16 Jun 2012 01:43:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s-DA+W+Ntcis for ; Sat, 16 Jun 2012 01:43:28 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id DBFEF21F8593 for ; Sat, 16 Jun 2012 01:43:27 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1SfobK-0007FS-MT; Sat, 16 Jun 2012 10:43:24 +0200 Received: from s258-sslvpn-1.ripe.net ([193.0.20.231] helo=vpn-143.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1SfobK-0000B1-6U; Sat, 16 Jun 2012 10:43:22 +0200 Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Tim Bruijnzeels In-Reply-To: Date: Sat, 16 Jun 2012 10:43:21 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> To: Tim Bruijnzeels X-Mailer: Apple Mail (2.1084) X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20120616 clean X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07193cce04d62fdcfa005b4a402fbc60914c Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2012 08:43:29 -0000 Hi, Please allow me to clarify my earlier comments. On 12 Jun 2012, at 10:31, Tim Bruijnzeels wrote: > Hi, >=20 > On 2 Jun 2012, at 01:00, Murphy, Sandra wrote: >> The authors have stated that they believe that = draft-ietf-sidr-pfx-validate-06 "BGP Prefix Origin Validation" is ready = for a working group last call. >=20 >=20 > Prefix validate assumes full knowledge of all applicable ROAs (or = other sources of information if they are used) and I believe this should = be stated more strongly. >=20 > The security considerations section addresses the possibility of a = malicious attacker tampering with the database that is used for = validation. It does not address the possibility of a database becoming = incomplete for other reasons. This is the main point I wanted to make. I believe this can be easily = addressed by just stating the requirement in this document. Perhaps = something along these lines at the end of the first paragraph in the = security consideration section: "Additional or missing records resulting from retrieval and/or = validation errors can lead to the same problems." The following was just a discussion on how RPs can mitigate these = problems. But.. perhaps this is better addressed in a separate BCP, or = future work on specifications related to the repository and = retrieval/validation by RPs. If the WG can agree with this then I can support last call.. > In particular I am worried about repositories: > 1- being completely unreachable for a prolonged time > 2- being inconsistent >=20 >=20 > @1: >=20 > A relying party tool may choose to use old information if a repository = can not be reached. This assumes that the RP has this old data, and it = will only work for a while. There is some unclarity what to do if the = manifest goes stale (next update time in the past) vs a manifest EE = certificate expiring (http://tools.ietf.org/html/rfc6486#section-5.1 = dictates a one-time use EE cert should match this). >=20 > In particular consider this case: >=20 > Parent CA: > - has cert for 10/8 > - ROA for 10.0/16 AS A > - signed cert to child for 10.0.0.0/22 >=20 > Child CA: > - publication point is unreachable, old data expired (new RP instances = unaware even) >=20 > There is a very real possibility that the parent's ROA invalidates the = child announcements. >=20 > I believe that the only reasonable, automated, action an RP can take = in this case is to disregard any INRs mentioned on the child CA's cert = whose pub point is unreachable. >=20 >=20 >=20 > @2: >=20 > With inconsistent I mean the following cases: > - hash invalid for ROA > - missing ROA > - surplus ROA >=20 > The RP has a very tough time deciding what to do: > - the invalid ROA could be a publication error, or it could be that = another ROA with the same name was intended to be published, but we = didn't see it > - a missing ROA could validate an announcement that is now considered = invalid because of another ROA > - the surplus ROA's intention is unclear, it could be that the CA = forgot to delete and revoke this, and it's invalidating announcement(s) >=20 > I understand that the authors intended manifests as a replay detection = mechanism and most of the wording regarding validation uses SHOULDs and = 'local policy'. However, I believe that this is not strong enough for = pfx-validate. Local policy sounds very reasonable when in doubt, but I = have no faith that operators will have enough knowledge to make educated = decisions in all these cases. By and large I expect that operators will = go with the *default* local policy decisions that are implemented in the = RP tool they use. >=20 > In short I think that pfx-validate's requirement for full knowledge = dictate that there MUST be a valid manifest listing the ROAs the CA = intended to publish, they MUST all be present, all be valid, and no = additional ROAs for the publication point can be considered. >=20 >=20 >=20 >=20 >=20 >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From kotikalapudi.sriram@nist.gov Sat Jun 16 07:24:02 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0018721F8551 for ; Sat, 16 Jun 2012 07:24:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSXRXMutIfYE for ; Sat, 16 Jun 2012 07:24:01 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 2DF1521F8549 for ; Sat, 16 Jun 2012 07:24:00 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.1.355.2; Sat, 16 Jun 2012 10:23:50 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Sat, 16 Jun 2012 10:23:59 -0400 From: "Sriram, Kotikalapudi" To: Randy Bush , sidr wg list Date: Sat, 16 Jun 2012 10:21:25 -0400 Thread-Topic: [sidr] bgpsec and confeds [was: Minutes of 6/6/12 meeting uploaded] Thread-Index: Ac1LezwsOsGomRojS9WmFifAVRAiLwAPgk5p Message-ID: References: <4FDBF181.7060809@ops-netman.net>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Subject: Re: [sidr] bgpsec and confeds [was: Minutes of 6/6/12 meeting uploaded] X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2012 14:24:02 -0000 My notes / suggested wording changes inline below, marked with "KS:". One other observation: We also discussed Lazy and Super Lazy modes of router operation at 6/6/12 meeting. If we were to include descriptions for those cases for the confed ASBRs, the description gets a bit more complicated. Especially because the ASBR has to perform operations that are different depending on whether it is in an AS in the middle of the confed or in an exit AS connecting to an external peer. Sriram ________________________________________ From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] On Behalf Of Randy Bush [randy@psg.com] Sent: Saturday, June 16, 2012 12:50 AM To: sidr wg list Subject: [sidr] bgpsec and confeds [was: Minutes of 6/6/12 meeting uploaded] bgpsec and confederations allow me to try to state clearly for the list When an update enters the first AS in a confederation, all last internal ASBRs within the entry AS of the confederation, i.e the first signers within the confederation, set a flag in the signature block that says "I am the first signature within the confederation." KS: Please add: However, the flag MUST NOT be set if the update entered the confed at an AS and also exits from the same AS to go to an external peer AS. (In this case, the update is not traversing any eBGP peering links internal to the confed.) The update wanders around normally in the confederation and every sending internal confederation ASBR signs it with their internal AS. A confederation's exit router looks backwards in the AS sequence until it finds the first, i.e. most recent, instance of that flag. If it finds no flag, the update is treated as originated within the confederation. KS: The last sentence above is not true. Explanation as follows. Consider: AS1 --- (AS2 --- AS3 --- AS4) --- AS5 AS2, AS3, AS4 form a confed. AS1 and AS5 are external peers. Consider an update that is exiting the confed at AS4 and being forward signed to AS5. If the update originated from AS2 or AS3, then it is an update that indeed originated from within the confed but it *will* come with the flag set. And if the update originated in AS4, it should not have any signatures yet; AS4 will add the first signature when it forward signs to AS5. So I suggest the following change of wording: "If the ASBR finds no flag, then it means that the update has entered the confed at this AS (i.e., the same AS where the ASBR is) and hence it has not traversed any confed internal eBGP links." It strips the signature block containing the flag and all subsequent signature blocks. All signs of the internals of the confederation have now been removed. KS: Please add the following: It also strips from the Secure_Path segment the sequence of ASN and pCount fields corresponding to the internal ASs in the confed. It then forward signs to the next AS, using the identity of the public confederation AS. While the update is traversing the confederation, if it should hit a peering where the peer is is not bgpsec capable, it strips all bgpsec gloop and reconstructs a classic AS_path. KS: Suggest adding the following for clarity: The classic AS_path will include the standard confed sequence that is reconstructed from the Secure_Path and includes the sequence of ASNs starting with the ASN with the flag set and all ASNs that follow. From pmohapat@cisco.com Sat Jun 16 13:59:42 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9EDC621F855A for ; Sat, 16 Jun 2012 13:59:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XhZABy1VYouq for ; Sat, 16 Jun 2012 13:59:41 -0700 (PDT) Received: from mtv-iport-4.cisco.com (mtv-iport-4.cisco.com [173.36.130.15]) by ietfa.amsl.com (Postfix) with ESMTP id BFF8321F8557 for ; Sat, 16 Jun 2012 13:59:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=pmohapat@cisco.com; l=1484; q=dns/txt; s=iport; t=1339880381; x=1341089981; h=subject:mime-version:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=1qKPMBo5pa2nrZyP4uAIDfxSpmLVPGEHLP5B/owNpOs=; b=BY2cZi14uK8WbyzmAHA0Ae9TAiF1GKkqgtyH3HrCmFzNa2/SSgdPTVON mxx5YJg9fKAhigwV4gmboXwHoK1dsKpl1j+Ik1jhY5AV6fi0zygiT/zQj I+Es6xn7ilFLRh8JjThCYEDFi5/+FNNNtwuirZdik9bRV27NMn4wIGGoI o=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av0EANry3E+rRDoG/2dsb2JhbABFtVOBB4IYAQEBAwESASc/EAtGVwY1h2QEmHSfEJETYAOIQoxijheBZoMAgTgj X-IronPort-AV: E=Sophos;i="4.75,783,1330905600"; d="scan'208";a="49139994" Received: from mtv-core-1.cisco.com ([171.68.58.6]) by mtv-iport-4.cisco.com with ESMTP; 16 Jun 2012 20:59:41 +0000 Received: from sjc-vpn6-1550.cisco.com (sjc-vpn6-1550.cisco.com [10.21.126.14]) by mtv-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id q5GKxfiJ006886; Sat, 16 Jun 2012 20:59:41 GMT Mime-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset=us-ascii From: Pradosh Mohapatra In-Reply-To: <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> Date: Sat, 16 Jun 2012 13:59:41 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> To: Tim Bruijnzeels X-Mailer: Apple Mail (2.1278) Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Jun 2012 20:59:42 -0000 Hi Tim, >> Prefix validate assumes full knowledge of all applicable ROAs (or = other sources of information if they are used) and I believe this should = be stated more strongly. >>=20 >> The security considerations section addresses the possibility of a = malicious attacker tampering with the database that is used for = validation. It does not address the possibility of a database becoming = incomplete for other reasons. >=20 > This is the main point I wanted to make. I believe this can be easily = addressed by just stating the requirement in this document. Perhaps = something along these lines at the end of the first paragraph in the = security consideration section: >=20 > "Additional or missing records resulting from retrieval and/or = validation errors can lead to the same problems." >=20 > The following was just a discussion on how RPs can mitigate these = problems. But.. perhaps this is better addressed in a separate BCP, or = future work on specifications related to the repository and = retrieval/validation by RPs. >=20 > If the WG can agree with this then I can support last call.. I do not agree this is a "security" issue. I am guessing you meant = permanent/eventual inconsistencies between the local and global = repositories (since transient inconsistencies will always be there). = That kind of inconsistency is most certainly a (protocol) implementation = error and has to be dealt with at that layer. - Pradosh From trac@tools.ietf.org Sun Jun 17 15:02:48 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A81BB21F8512 for ; Sun, 17 Jun 2012 15:02:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -93.137 X-Spam-Level: X-Spam-Status: No, score=-93.137 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FRT_PENIS1=3.592, J_CHICKENPOX_57=0.6, J_CHICKENPOX_63=0.6, J_CHICKENPOX_65=0.6, J_CHICKENPOX_66=0.6, SARE_MLH_Stock1=0.87, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T3Bscfh1TTYv for ; Sun, 17 Jun 2012 15:02:48 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 01C3121F850B for ; Sun, 17 Jun 2012 15:02:48 -0700 (PDT) Received: from localhost ([127.0.0.1]:52923 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1SgNYJ-00062O-9O; Mon, 18 Jun 2012 00:02:35 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-ietf-sidr-signed-object@tools.ietf.org X-Trac-Project: sidr Date: Sun, 17 Jun 2012 22:02:35 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/sidr/trac/ticket/19 Message-ID: <048.92806eaea0b384ce24a590a346f2d674@tools.ietf.org> X-Trac-Ticket-ID: 19 X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-ietf-sidr-signed-object@tools.ietf.org, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: achi@bbn.com, kent@bbn.com, mlepinski@bbn.com Resent-Message-Id: <20120617220248.01C3121F850B@ietfa.amsl.com> Resent-Date: Sun, 17 Jun 2012 15:02:48 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: [sidr] #19: history of stocks X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Jun 2012 22:02:48 -0000 #19: history of stocks [http://www.squidoo.com/history-of-penny-stocks {Peter Leeds|Timothy Sykes|History of Penny Stocks|Penny Stocks|Buying Penny Stocks Online|Tim Sykes: Penny Stock Genius|Become a Self Made Millionaire|What to Look for in a Penny Stock}] Never ever witnessed everything as evident as dust, to ensure as useless due to the fact this publish! -- -----------------------------+--------------------------------------------- Reporter: anonymous | Owner: draft-ietf-sidr-signed-object@… Type: task | Status: new Priority: trivial | Milestone: milestone1 Component: signed-object | Version: 1.0 Severity: Dead WG | Keywords: history of stocks Document | -----------------------------+--------------------------------------------- Ticket URL: sidr From randy@psg.com Sun Jun 17 19:30:03 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD0021F85DA for ; Sun, 17 Jun 2012 19:30:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.574 X-Spam-Level: X-Spam-Status: No, score=-2.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id x++FiVLWPXpq for ; Sun, 17 Jun 2012 19:30:03 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 4BF2121F85D6 for ; Sun, 17 Jun 2012 19:30:03 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SgRj7-0000rh-PP; Mon, 18 Jun 2012 02:30:01 +0000 Date: Mon, 18 Jun 2012 11:30:00 +0900 Message-ID: From: Randy Bush To: Alexey Melnikov In-Reply-To: <996DA30F-DC37-4147-B8EE-CDF02A11A258@isode.com> References: <4FD8CB92.9030205@isode.com> <996DA30F-DC37-4147-B8EE-CDF02A11A258@isode.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg Subject: Re: [sidr] Discussion topics for the virtual interim on June 29th X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 02:30:03 -0000 >> we can always discuss draft-ymbk-rpki-grandparenting-00.txt > How much time do you think we will need to discuss it? in this wg, discussing anything takes two hours. and that is not counting revisiting old decisions. it sounds as if tim wants to discuss a point in pfx-validate, and whether it is a security issue. we need to get that draft gone, so let's try to clear any issues folk have. i'll try to address comments on sidr--ops, so you may want to leave time if folk want to discuss them ear-to-ear. randy From randy@psg.com Sun Jun 17 19:47:59 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39C0721F857F for ; Sun, 17 Jun 2012 19:47:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.576 X-Spam-Level: X-Spam-Status: No, score=-2.576 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7xi-P5zShJ88 for ; Sun, 17 Jun 2012 19:47:58 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id DF53021F857D for ; Sun, 17 Jun 2012 19:47:50 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SgS0L-0000tq-Oy; Mon, 18 Jun 2012 02:47:50 +0000 Date: Mon, 18 Jun 2012 11:47:48 +0900 Message-ID: From: Randy Bush To: Shane Amante In-Reply-To: <48A7C4A7-7FFB-44CB-ABCA-76E148AE0574@castlepoint.net> References: <805B0799-7026-4532-A53C-4CFE3E863A33@castlepoint.net> <48A7C4A7-7FFB-44CB-ABCA-76E148AE0574@castlepoint.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] WGLC: draft-ietf-sidr-origin-ops X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 02:47:59 -0000 shane, going through the mailbox to pick up any un-addressed issues, i came across your comment > what I've been attempting to ask here is how one configures, in one's > _local_ RPKI cache (that syncs to the outside world), /where/ the > RIR's publication points are on Day 1. Do I contact one RIR (which > maintains a list of other RIR's publication points) -or- each RIR > individually to ask what is their publication point? (If you can help > provide an answer as to what is the expectation on the operator, I can > then potentially help to provide text). i think there are a number of issues here o the general issue of how one gets trusted trust anchor(s), presumably out of band. this problem is not unique to the rpki, so maybe we can get some help/clue here from the four or five steves in the group. o i do not see a reason to trust TAs shipped with software any more than TAs from any other random source. o one hopes that the current pathetic joke of having five RIR TAs will pass. there is a long history of failing to really 'solve' a layer nine cf at layers seven and below. o the answer "iana will publish the root ta and sign it with their pgp key" may be a bit too glib because ... o we have an analogous problem for the operator who wants to use the global rpki, an lta rpki, and a private ta for 1918 or whatever. especially if the lta is built by a third party. but i think that all this bs boils down to how to distribute a TA out of band. all pkis have this problem, dnssec has this problem, ... i would love to hear from the steves on this. randy From tim@ripe.net Mon Jun 18 04:09:49 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E006B21F85A2 for ; Mon, 18 Jun 2012 04:09:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bwi975-YQ8Cz for ; Mon, 18 Jun 2012 04:09:49 -0700 (PDT) Received: from postlady.ripe.net (postlady.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1341]) by ietfa.amsl.com (Postfix) with ESMTP id 08E6821F8593 for ; Mon, 18 Jun 2012 04:09:49 -0700 (PDT) Received: from ayeaye.ripe.net ([193.0.23.5]) by postlady.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1SgZq5-0008AZ-0e; Mon, 18 Jun 2012 13:09:46 +0200 Received: from s258-sslvpn-1.ripe.net ([193.0.20.231] helo=vpn-10.ripe.net) by ayeaye.ripe.net with esmtps (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1SgZq4-0005o6-HK; Mon, 18 Jun 2012 13:09:44 +0200 Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Tim Bruijnzeels In-Reply-To: Date: Mon, 18 Jun 2012 13:09:43 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> To: Pradosh Mohapatra X-Mailer: Apple Mail (2.1084) X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816066, check: 20120618 clean X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a0719eb8cb072e993f2cb524815bbd50229a3 Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 11:09:50 -0000 On 16 Jun 2012, at 22:59, Pradosh Mohapatra wrote: > Hi Tim, >=20 >=20 >>> Prefix validate assumes full knowledge of all applicable ROAs (or = other sources of information if they are used) and I believe this should = be stated more strongly. >>>=20 >>> The security considerations section addresses the possibility of a = malicious attacker tampering with the database that is used for = validation. It does not address the possibility of a database becoming = incomplete for other reasons. >>=20 >> This is the main point I wanted to make. I believe this can be easily = addressed by just stating the requirement in this document. Perhaps = something along these lines at the end of the first paragraph in the = security consideration section: >>=20 >> "Additional or missing records resulting from retrieval and/or = validation errors can lead to the same problems." >>=20 >> The following was just a discussion on how RPs can mitigate these = problems. But.. perhaps this is better addressed in a separate BCP, or = future work on specifications related to the repository and = retrieval/validation by RPs. >>=20 >> If the WG can agree with this then I can support last call.. >=20 >=20 > I do not agree this is a "security" issue. I am guessing you meant = permanent/eventual inconsistencies between the local and global = repositories (since transient inconsistencies will always be there). = That kind of inconsistency is most certainly a (protocol) implementation = error and has to be dealt with at that layer. >=20 I see your point about security, I don't really mind which section = addresses this. With inconsistencies I did not mean that the validated cache is out of = date, which I agree, will always be there even if it could be minimised. The inconsistencies I refer to are different in nature. It's that the = snapshot that the RP tool got when it validated is in itself = inconsistent: surplus or missing ROAs, or the hash of 1 or more ROAs = doesn't match. Longer discussion omitted, but at this point the RP just = doesn't know for certain what to do and guidance is needed. This is = where *explicitly* stating a strong requirement, rather than leaving it = implicit, in pfx-validate comes in.. Having this will help to either come up with best practices for RP = tools, or preferably improvements to the repository related standards. Anyway, I get the feeling that I am the only one here who sees this as a = problem, so I guess the rough consensus is there.. Tim= From kent@bbn.com Mon Jun 18 09:14:29 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E69E421F8692 for ; Mon, 18 Jun 2012 09:14:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.639 X-Spam-Level: X-Spam-Status: No, score=-105.639 tagged_above=-999 required=5 tests=[AWL=-0.899, BAYES_20=-0.74, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7b-sqyuVDuoj for ; Mon, 18 Jun 2012 09:14:28 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 4AEAE21F8627 for ; Mon, 18 Jun 2012 09:14:28 -0700 (PDT) Received: from dhcp89-089-227.bbn.com ([128.89.89.227]:49185) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SgeaL-000Cgf-CK; Mon, 18 Jun 2012 12:13:49 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: Date: Mon, 18 Jun 2012 11:22:34 -0400 To: Randy Bush From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: sidr@ietf.org Subject: Re: [sidr] grandparenting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 16:14:29 -0000 At 11:18 AM +0900 6/15/12, Randy Bush wrote: >steve. the EXAMPLE in the draft was one of a thousand. perhaps we need >only one example. maybe two if the semantics are wildly different. > >randy I'm all in favor of including examples. But, I dislike including examples that may give readers the wrong impression. So, I suggest including one or two examples that are less prone to misinterpretation. Steve From brian.peter.dickson@gmail.com Mon Jun 18 09:38:41 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9983421F86E1 for ; Mon, 18 Jun 2012 09:38:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.598 X-Spam-Level: X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ciyC3g5+TPDP for ; Mon, 18 Jun 2012 09:38:40 -0700 (PDT) Received: from mail-we0-f172.google.com (mail-we0-f172.google.com [74.125.82.172]) by ietfa.amsl.com (Postfix) with ESMTP id B878A21F86E0 for ; Mon, 18 Jun 2012 09:38:39 -0700 (PDT) Received: by werb13 with SMTP id b13so4451735wer.31 for ; Mon, 18 Jun 2012 09:38:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=dJhmSrgiHr4+BT6drgT0SUW9/EQwJmKVVsOH+SNwt28=; b=ms0XKJSll/04ifJEb3vBtj6D0/AYpRmzob9gU1qItbY18eB9DOFihjg4t+yTh9tECp R3bn9YjYSdGMoDlOwTv6tMmtjVfTEFzgkN9LQQVy/wyk1NB4wlFW8WqzRhT9qSCT6dfx NHXOKbtqZulqhnYe0PJHdUTdNsOEYw/u4Bts7gvAh18lEVkTb4JAVdu2Lki3db9SC24O 7Nw/taYxKCS5AjNl9mbGV0i6Gs7ulXXZPFVXcwS9UNQLEobwuDBxDsGskk1RDI919DEE nCKSpYqEg7DvxIumcJqMBeHfSXYbiQv1Ypzu81+QgZhcbgZ5Pl4Bxm99AbsACh7TRCGV OuzA== MIME-Version: 1.0 Received: by 10.180.86.194 with SMTP id r2mr2287471wiz.15.1340037518450; Mon, 18 Jun 2012 09:38:38 -0700 (PDT) Received: by 10.223.39.19 with HTTP; Mon, 18 Jun 2012 09:38:38 -0700 (PDT) In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> Date: Mon, 18 Jun 2012 12:38:38 -0400 Message-ID: From: Brian Dickson To: Tim Bruijnzeels Content-Type: multipart/alternative; boundary=f46d044286dc45de7504c2c1cc57 Cc: "Murphy, Sandra" , "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 16:38:41 -0000 --f46d044286dc45de7504c2c1cc57 Content-Type: text/plain; charset=ISO-8859-1 While I think it is a subtle and "fine print" issue, I think it may be obvious enough that other folks aren't commenting, which is why there are not a lot of comments on this. However, this is one case where silence should not be seen as consent. One good analogy is the DNSSEC method for determining consistency/completeness: a DNSSEC signature set is expected to contain a set of NSEC or NSEC3 records which "prove" the existence or non-existence of every possible name in a given zone. The records form a "ring" which must be unbroken and complete. Even if it isn't part of the wire format, and even if some elements of it are implementation-dependent, there should be at least recommendations, if not requirements, that any data retrieved be checked for completeness, so as to prevent downgrade attacks or vulnerabilities introduced by sloppy implementations. IMHO. Brian On Mon, Jun 18, 2012 at 7:09 AM, Tim Bruijnzeels wrote: > > On 16 Jun 2012, at 22:59, Pradosh Mohapatra wrote: > > > Hi Tim, > > > > > >>> Prefix validate assumes full knowledge of all applicable ROAs (or > other sources of information if they are used) and I believe this should be > stated more strongly. > >>> > >>> The security considerations section addresses the possibility of a > malicious attacker tampering with the database that is used for validation. > It does not address the possibility of a database becoming incomplete for > other reasons. > >> > >> This is the main point I wanted to make. I believe this can be easily > addressed by just stating the requirement in this document. Perhaps > something along these lines at the end of the first paragraph in the > security consideration section: > >> > >> "Additional or missing records resulting from retrieval and/or > validation errors can lead to the same problems." > >> > >> The following was just a discussion on how RPs can mitigate these > problems. But.. perhaps this is better addressed in a separate BCP, or > future work on specifications related to the repository and > retrieval/validation by RPs. > >> > >> If the WG can agree with this then I can support last call.. > > > > > > I do not agree this is a "security" issue. I am guessing you meant > permanent/eventual inconsistencies between the local and global > repositories (since transient inconsistencies will always be there). That > kind of inconsistency is most certainly a (protocol) implementation error > and has to be dealt with at that layer. > > > > I see your point about security, I don't really mind which section > addresses this. > > With inconsistencies I did not mean that the validated cache is out of > date, which I agree, will always be there even if it could be minimised. > > The inconsistencies I refer to are different in nature. It's that the > snapshot that the RP tool got when it validated is in itself inconsistent: > surplus or missing ROAs, or the hash of 1 or more ROAs doesn't match. > Longer discussion omitted, but at this point the RP just doesn't know for > certain what to do and guidance is needed. This is where *explicitly* > stating a strong requirement, rather than leaving it implicit, in > pfx-validate comes in.. > > Having this will help to either come up with best practices for RP tools, > or preferably improvements to the repository related standards. > > Anyway, I get the feeling that I am the only one here who sees this as a > problem, so I guess the rough consensus is there.. > > > > Tim > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > --f46d044286dc45de7504c2c1cc57 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable While I think it is a subtle and "fine print" issue, I think it m= ay be obvious enough that other folks aren't commenting, which is why t= here are not a lot of comments on this.

However, this is= one case where silence should not be seen as consent.

One good analogy is the DNSSEC method for determining c= onsistency/completeness: a DNSSEC signature set is expected to contain a se= t of NSEC or NSEC3 records which "prove" the existence or non-exi= stence of every possible name in a given zone. The records form a "rin= g" which must be unbroken and complete.

Even if it isn't part of the wire format, and even = if some elements of it are implementation-dependent, there should be at lea= st recommendations, if not requirements, that any data retrieved be checked= for completeness, so as to prevent downgrade attacks or vulnerabilities in= troduced by sloppy implementations.

IMHO.

Brian

On Mon, Jun 18, 2012 at 7:09 AM, Tim Bruijnzeels <tim@ri= pe.net> wrote:

On 16 Jun 2012, at 22:59, Pradosh Mohapatra wrote:

> Hi Tim,
>
>
>>> Prefix validate assumes full knowledge of all applicable ROAs = (or other sources of information if they are used) and I believe this shoul= d be stated more strongly.
>>>
>>> The security considerations section addresses the possibility = of a malicious attacker tampering with the database that is used for valida= tion. It does not address the possibility of a database becoming incomplete= for other reasons.
>>
>> This is the main point I wanted to make. I believe this can be eas= ily addressed by just stating the requirement in this document. Perhaps som= ething along these lines at the end of the first paragraph in the security = consideration section:
>>
>> "Additional or missing records resulting from retrieval and/o= r validation errors can lead to the same problems."
>>
>> The following was just a discussion on how RPs can mitigate these = problems. But.. perhaps this is better addressed in a separate BCP, or futu= re work on specifications related to the repository and retrieval/validatio= n by RPs.
>>
>> If the WG can agree with this then I can support last call..
>
>
> I do not agree this is a "security" issue. I am guessing you= meant permanent/eventual inconsistencies between the local and global repo= sitories (since transient inconsistencies will always be there). That kind = of inconsistency is most certainly a (protocol) implementation error and ha= s to be dealt with at that layer.
>

I see your point about security, I don't really mind which = section addresses this.

With inconsistencies I did not mean that the validated cache is out of date= , which I agree, will always be there even if it could be minimised.

The inconsistencies I refer to are different in nature. It's that the s= napshot that the RP tool got when it validated is in itself inconsistent: s= urplus or missing ROAs, or the hash of 1 or more ROAs doesn't match. Lo= nger discussion omitted, but at this point the RP just doesn't know for= certain what to do and guidance is needed. This is where *explicitly* stat= ing a strong requirement, rather than leaving it implicit, in pfx-validate = comes in..

Having this will help to either come up with best practices for RP tools, o= r preferably improvements to the repository related standards.

Anyway, I get the feeling that I am the only one here who sees this as a pr= oblem, so I guess the rough consensus is there..



Tim
_____________________= __________________________
sidr mailing list
sidr@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/sidr

--f46d044286dc45de7504c2c1cc57-- From kotikalapudi.sriram@nist.gov Mon Jun 18 09:54:45 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5575121F86EF for ; Mon, 18 Jun 2012 09:54:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f5D0ZMAe9tfN for ; Mon, 18 Jun 2012 09:54:44 -0700 (PDT) Received: from wsget1.nist.gov (wsget1.nist.gov [129.6.13.150]) by ietfa.amsl.com (Postfix) with ESMTP id 4F0CE21F85E1 for ; Mon, 18 Jun 2012 09:54:43 -0700 (PDT) Received: from WSXGHUB1.xchange.nist.gov (129.6.18.96) by wsget1.nist.gov (129.6.13.150) with Microsoft SMTP Server (TLS) id 14.1.355.2; Mon, 18 Jun 2012 12:54:42 -0400 Received: from MBCLUSTER.xchange.nist.gov ([fe80::d479:3188:aec0:cb66]) by WSXGHUB1.xchange.nist.gov ([129.6.18.96]) with mapi; Mon, 18 Jun 2012 12:54:39 -0400 From: "Sriram, Kotikalapudi" To: Randy Bush Date: Mon, 18 Jun 2012 12:54:37 -0400 Thread-Topic: [sidr] Follow-up on June 6 Interim : Confederations Thread-Index: Ac1LP4NeY5j66eGZQ0GV3Ugw83k43gCLH+iw Message-ID: References: <4FDB8840.2030903@bbn.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: Re: [sidr] Follow-up on June 6 Interim : Confederations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 16:54:45 -0000 Comments below. Sriram > >> This solution for confeds *requires* each AS within a confed to sign >> internally (i.e., from AS to AS within the confed). It does not allow >> the choice to a confed operator to sign or not sign the updates internally. >> For instance, the operator may be satisfied with the level of mutual >> trust within the confed, and therefore may choose to not sign updates >internally. >> >> Do we want to provision this choice into the protocol? > >sure, if they strip bgpsec and reconstruct the as-path. > >in bgpsec, all ass sign. end. Quoting from the sidr-bgpsec-ops-05 document: "To prevent exposure of the internals of BGP Confederations [RFC5065], a BGPsec speaker which is a Member-AS of a Confederation MUST NOT sign updates sent to another Member-AS of the same Confederation." You might like to reword the above but ... Our position all along (for at least two years, except for the recent shift) had been that we did not require confed AS members to sign internally within the confed. http://tools.ietf.org/html/draft-sriram-bgpsec-design-choices-01#section-7.3 Concern for the confed operator: If updates enter a confed with 3 sigs in them, and if the confed adds another 3 sigs internally, then the updates are getting pretty bulky and the processing/memory costs are going much higher for the confed operator. May not like that when they know their confed ASs are within a trust boundary. (Also see Jakob's comment.) Sriram From randy@psg.com Mon Jun 18 09:56:51 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D1AF21F859E for ; Mon, 18 Jun 2012 09:56:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.579 X-Spam-Level: X-Spam-Status: No, score=-2.579 tagged_above=-999 required=5 tests=[AWL=0.020, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8mqzTporgnWb for ; Mon, 18 Jun 2012 09:56:50 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id AA6C621F856C for ; Mon, 18 Jun 2012 09:56:50 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SgfFv-0002hu-FZ; Mon, 18 Jun 2012 16:56:47 +0000 Date: Tue, 19 Jun 2012 01:56:46 +0900 Message-ID: From: Randy Bush To: "Sriram, Kotikalapudi" In-Reply-To: References: <4FDB8840.2030903@bbn.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: "sidr@ietf.org" Subject: Re: [sidr] Follow-up on June 6 Interim : Confederations X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 16:56:51 -0000 >> in bgpsec, all ass sign. end. > > Quoting from the sidr-bgpsec-ops-05 document: > "To prevent exposure of the internals of BGP Confederations [RFC5065], > a BGPsec speaker which is a Member-AS of a Confederation MUST NOT > sign updates sent to another Member-AS of the same Confederation." good catch. matt, when you put the confed stuff in, i am sure you will remember to remove that one. randy From mlepinsk@bbn.com Mon Jun 18 10:34:41 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C40B221F86D0 for ; Mon, 18 Jun 2012 10:34:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Oke0J5tOLxO for ; Mon, 18 Jun 2012 10:34:41 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 2C5FC21F86CF for ; Mon, 18 Jun 2012 10:34:41 -0700 (PDT) Received: from mail.bbn.com ([128.33.0.48]:35722) by smtp.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sgfpy-000Ef6-Tt for sidr@ietf.org; Mon, 18 Jun 2012 13:34:02 -0400 Received: from [128.89.253.206] by mail.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1Sgfqa-0000WA-Ek for sidr@ietf.org; Mon, 18 Jun 2012 13:34:40 -0400 Message-ID: <4FDF66C7.10505@bbn.com> Date: Mon, 18 Jun 2012 13:35:03 -0400 From: Matt Lepinski User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: sidr@ietf.org References: <4FDBF181.7060809@ops-netman.net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] bgpsec and confeds [was: Minutes of 6/6/12 meeting uploaded] X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 17:34:42 -0000 This is consistent with my understanding of the consensus at the interim meeting. I am happy with this approach as a way forward. On 6/16/2012 12:50 AM, Randy Bush wrote: > bgpsec and confederations > > allow me to try to state clearly for the list > > When an update enters the first AS in a confederation, all last > internal ASBRs within the entry AS of the confederation, i.e the > first signers within the confederation, set a flag in the signature > block that says "I am the first signature within the confederation." > > The update wanders around normally in the confederation and every > sending internal confederation ASBR signs it with their internal AS. > > A confederation's exit router looks backwards in the AS sequence > until it finds the first, i.e. most recent, instance of that flag. > If it finds no flag, the update is treated as originated within the > confederation. > > It strips the signature block containing the flag and all subsequent > signature blocks. All signs of the internals of the confederation > have now been removed. > > It then forward signs to the next AS, using the identity of the > public confederation AS. > > While the update is traversing the confederation, if it should hit a > peering where the peer is is not bgpsec capable, it strips all > bgpsec gloop and reconstructs a classic AS_path. > > this is believed to handle the loop disease (e.g. the cisco "neighbor > allowas-in" command). > > what if anything should be done if you find the confed flag when you are > not inside a confed is a topic for discussion. > > does anyone see a flaw in the above? please please review so we can put > it to bed. > > randy > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From wesley.george@twcable.com Mon Jun 18 13:09:11 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C219011E8099 for ; Mon, 18 Jun 2012 13:09:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.013 X-Spam-Level: X-Spam-Status: No, score=-1.013 tagged_above=-999 required=5 tests=[AWL=0.450, BAYES_00=-2.599, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2vVT52t1hFew for ; Mon, 18 Jun 2012 13:09:11 -0700 (PDT) Received: from cdpipgw01.twcable.com (cdpipgw01.twcable.com [165.237.59.22]) by ietfa.amsl.com (Postfix) with ESMTP id F31CA11E8089 for ; Mon, 18 Jun 2012 13:09:10 -0700 (PDT) X-SENDER-IP: 10.136.163.10 X-SENDER-REPUTATION: None X-IronPort-AV: E=Sophos;i="4.75,793,1330923600"; d="scan'208";a="397600012" Received: from unknown (HELO PRVPEXHUB01.corp.twcable.com) ([10.136.163.10]) by cdpipgw01.twcable.com with ESMTP/TLS/RC4-MD5; 18 Jun 2012 16:08:30 -0400 Received: from PRVPEXVS03.corp.twcable.com ([10.136.163.27]) by PRVPEXHUB01.corp.twcable.com ([10.136.163.10]) with mapi; Mon, 18 Jun 2012 16:09:10 -0400 From: "George, Wes" To: Jakob Heitz , Randy Bush , sidr wg list Date: Mon, 18 Jun 2012 16:09:08 -0400 Thread-Topic: Confeds and clusters Thread-Index: Ac1LkfoGVSx4n83+Qliu1LRmD2nVGwB+3OQQ Message-ID: References: <4FDBF181.7060809@ops-netman.net> <8F5B0091-FF46-479B-8608-DA0537B15427@ericsson.com> In-Reply-To: <8F5B0091-FF46-479B-8608-DA0537B15427@ericsson.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] Confeds and clusters X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 20:09:11 -0000 > -----Original Message----- > From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of > Jakob Heitz > Sent: Saturday, June 16, 2012 3:31 AM > > IMHO: AS boundaries are for marking boundaries of trust. > Confeds are for achieving scalability within an AS. [WEG] Yes and no. While confeds are sometimes used for scale, they aren't *= exclusively* used for scale, and therefore your two statements are in confl= ict with one another. In some cases Confeds have nothing to do with scale a= nd everything to do with boundaries of trust for those of us with different= internal and autonomous organizations responsible for managing different p= arts of our network. A confed requires some manner of coordination between = the members of the confed, but it in no way implies that all of the members= of the confed are centrally managed, nor should it. Wes George This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout. From kent@bbn.com Mon Jun 18 15:00:19 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7E19411E80D6 for ; Mon, 18 Jun 2012 15:00:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.418 X-Spam-Level: X-Spam-Status: No, score=-106.418 tagged_above=-999 required=5 tests=[AWL=0.180, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Zkk9UUo7-yO6 for ; Mon, 18 Jun 2012 15:00:18 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id D80D611E80D5 for ; Mon, 18 Jun 2012 15:00:18 -0700 (PDT) Received: from dhcp89-089-227.bbn.com ([128.89.89.227]:49220) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sgjz1-000Jkg-6j; Mon, 18 Jun 2012 17:59:39 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: <4FDBF181.7060809@ops-netman.net> References: <4FDBF181.7060809@ops-netman.net> Date: Mon, 18 Jun 2012 18:00:13 -0400 To: Chris Morrow From: Stephen Kent Content-Type: multipart/alternative; boundary="============_-872065680==_ma============" Cc: "'sidr@ietf.org'" Subject: Re: [sidr] Minutes of 6/6/12 meeting uploaded X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 22:00:19 -0000 --============_-872065680==_ma============ Content-Type: text/plain; charset="us-ascii" ; format="flowed" some typos in the minutes: "Randy eludes to the discussion" => "Randy alludes to the discussion" "He says ambulating (?) alias AS" => (my best guess) "He says emulating alias AS" in several places: "As" => "AS" --============_-872065680==_ma============ Content-Type: text/html; charset="us-ascii" Re: [sidr] Minutes of 6/6/12 meeting uploaded
some typos in the minutes:

"Randy eludes to the discussion"   =>

"Randy alludes to the discussion"


"He says ambulating (?) alias AS"  => (my best guess)

"He says emulating alias AS"


in several places:  "As" => "AS"
--============_-872065680==_ma============-- From randy@psg.com Mon Jun 18 15:03:58 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 966EA11E80DB for ; Mon, 18 Jun 2012 15:03:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.58 X-Spam-Level: X-Spam-Status: No, score=-2.58 tagged_above=-999 required=5 tests=[AWL=0.019, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N9XIsgVpqwyf for ; Mon, 18 Jun 2012 15:03:58 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 32C1B11E80CC for ; Mon, 18 Jun 2012 15:03:58 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sgk3A-0003LT-QK; Mon, 18 Jun 2012 22:03:57 +0000 Date: Tue, 19 Jun 2012 07:03:55 +0900 Message-ID: From: Randy Bush To: Stephen Kent In-Reply-To: References: <4FDBF181.7060809@ops-netman.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg Subject: Re: [sidr] Minutes of 6/6/12 meeting uploaded X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 22:03:58 -0000 > "Randy eludes to the discussion" => > "Randy alludes to the discussion" maybe it was actually elides. i was pretty whacked :) randy From randy@psg.com Mon Jun 18 15:09:44 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D88311E80F6 for ; Mon, 18 Jun 2012 15:09:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.581 X-Spam-Level: X-Spam-Status: No, score=-2.581 tagged_above=-999 required=5 tests=[AWL=0.018, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bDhz0-bGSU32 for ; Mon, 18 Jun 2012 15:09:43 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id A26D411E80C1 for ; Mon, 18 Jun 2012 15:09:43 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Sgk8k-0003MI-B7; Mon, 18 Jun 2012 22:09:42 +0000 Date: Tue, 19 Jun 2012 07:09:41 +0900 Message-ID: From: Randy Bush To: Wes George In-Reply-To: References: <4FDBF181.7060809@ops-netman.net> <8F5B0091-FF46-479B-8608-DA0537B15427@ericsson.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg Subject: Re: [sidr] Confeds and clusters X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 22:09:44 -0000 > In some cases Confeds have nothing to do with scale and everything to > do with boundaries of trust for those of us with different internal > and autonomous organizations responsible for managing different parts > of our network. A confed requires some manner of coordination between > the members of the confed, but it in no way implies that all of the > members of the confed are centrally managed, nor should it. for sure. in verio, it was all about trust boundaries and segregating igps. 66 acquisitions in three years, and sharing needles was just not in the cards. randy From kent@bbn.com Mon Jun 18 15:12:52 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E80911E80FD for ; Mon, 18 Jun 2012 15:12:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.445 X-Spam-Level: X-Spam-Status: No, score=-106.445 tagged_above=-999 required=5 tests=[AWL=0.154, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6T7v8JTdUGOD for ; Mon, 18 Jun 2012 15:12:51 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 831BE11E80C1 for ; Mon, 18 Jun 2012 15:12:51 -0700 (PDT) Received: from dhcp89-089-227.bbn.com ([128.89.89.227]:49222) by smtp.bbn.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SgkBA-000Jv2-Pu; Mon, 18 Jun 2012 18:12:12 -0400 Mime-Version: 1.0 Message-Id: In-Reply-To: References: <4FDBF181.7060809@ops-netman.net> Date: Mon, 18 Jun 2012 18:12:29 -0400 To: Randy Bush From: Stephen Kent Content-Type: text/plain; charset="us-ascii" ; format="flowed" Cc: sidr wg Subject: Re: [sidr] Minutes of 6/6/12 meeting uploaded X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Jun 2012 22:12:52 -0000 At 7:03 AM +0900 6/19/12, Randy Bush wrote: > > "Randy eludes to the discussion" => >> "Randy alludes to the discussion" > >maybe it was actually elides. i was pretty whacked :) > >randy I defer to the judgement of the speaker ;-). Steve From jgs@bgp.nu Tue Jun 19 12:19:29 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62E9111E814A for ; Tue, 19 Jun 2012 12:19:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.043 X-Spam-Level: X-Spam-Status: No, score=-102.043 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_IS_SMALL6=0.556, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wZED-xWttRDN for ; Tue, 19 Jun 2012 12:19:28 -0700 (PDT) Received: from bgp.nu (bgp.nu [147.28.0.53]) by ietfa.amsl.com (Postfix) with ESMTP id DD88611E8144 for ; Tue, 19 Jun 2012 12:19:28 -0700 (PDT) Received: from [172.16.13.202] (75-151-14-10-Michigan.hfc.comcastbusiness.net [75.151.14.10]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by bgp.nu (Postfix) with ESMTP id EB2E666D370; Tue, 19 Jun 2012 15:19:27 -0400 (EDT) Mime-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset=us-ascii From: "John G. Scudder" In-Reply-To: <8F5B0091-FF46-479B-8608-DA0537B15427@ericsson.com> Date: Tue, 19 Jun 2012 15:19:26 -0400 Content-Transfer-Encoding: quoted-printable Message-Id: <896FF5B3-960D-414C-A3AA-6A7F3AAA7F48@bgp.nu> References: <4FDBF181.7060809@ops-netman.net> <8F5B0091-FF46-479B-8608-DA0537B15427@ericsson.com> To: Jakob Heitz X-Mailer: Apple Mail (2.1278) Cc: sidr wg list Subject: Re: [sidr] Confeds and clusters X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Jun 2012 19:19:29 -0000 In addition to Wes and Randy's observations about trust boundaries, it's = also the case that mechanically, the confederation embeds its loop = prevention information in the AS path, so we have to have *some* way of = dealing with it since bgpsec is monkeying with the AS path. The same = problem doesn't exist for the cluster list since it's a separate = attribute. --John On Jun 16, 2012, at 3:31 AM, Jakob Heitz wrote: > All the effort to sign the confed AS got me thinking. > A route reflector cluster is like a member AS in a confed. > Is there a case for signing the cluster list too? >=20 > IMHO: AS boundaries are for marking boundaries of trust. > Confeds are for achieving scalability within an AS. > I think signatures are only needed across trust boundaries. > More is unnecessary complexity. >=20 > -- > Jakob Heitz. >=20 >=20 > On Jun 15, 2012, at 9:50 PM, "Randy Bush" wrote: >=20 >> bgpsec and confederations >>=20 >> allow me to try to state clearly for the list >>=20 >> When an update enters the first AS in a confederation, all last >> internal ASBRs within the entry AS of the confederation, i.e the >> first signers within the confederation, set a flag in the signature >> block that says "I am the first signature within the = confederation." >>=20 >> The update wanders around normally in the confederation and every >> sending internal confederation ASBR signs it with their internal = AS. >>=20 >> A confederation's exit router looks backwards in the AS sequence >> until it finds the first, i.e. most recent, instance of that flag. >> If it finds no flag, the update is treated as originated within the >> confederation. >>=20 >> It strips the signature block containing the flag and all = subsequent >> signature blocks. All signs of the internals of the confederation >> have now been removed. >>=20 >> It then forward signs to the next AS, using the identity of the >> public confederation AS. >>=20 >> While the update is traversing the confederation, if it should hit = a >> peering where the peer is is not bgpsec capable, it strips all >> bgpsec gloop and reconstructs a classic AS_path. >>=20 >> this is believed to handle the loop disease (e.g. the cisco "neighbor >> allowas-in" command). >>=20 >> what if anything should be done if you find the confed flag when you = are >> not inside a confed is a topic for discussion. >>=20 >> does anyone see a flaw in the above? please please review so we can = put >> it to bed. >>=20 >> randy >> _______________________________________________ >> sidr mailing list >> sidr@ietf.org >> https://www.ietf.org/mailman/listinfo/sidr > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From trac@tools.ietf.org Wed Jun 20 18:20:06 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C71B911E8087 for ; Wed, 20 Jun 2012 18:20:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -96.968 X-Spam-Level: X-Spam-Status: No, score=-96.968 tagged_above=-999 required=5 tests=[AWL=3.831, BAYES_00=-2.599, J_CHICKENPOX_63=0.6, J_CHICKENPOX_71=0.6, J_CHICKENPOX_75=0.6, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2kj5ri9lyHUK for ; Wed, 20 Jun 2012 18:20:05 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id DE8D011E8079 for ; Wed, 20 Jun 2012 18:20:04 -0700 (PDT) Received: from localhost ([127.0.0.1]:59790 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1ShW41-0004tx-K3; Thu, 21 Jun 2012 03:20:01 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-ietf-sidr-roa-format@tools.ietf.org X-Trac-Project: sidr Date: Thu, 21 Jun 2012 01:20:01 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/sidr/trac/ticket/20 Message-ID: <048.216735640e2d8e07a931f0a374aba880@tools.ietf.org> X-Trac-Ticket-ID: 20 X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-ietf-sidr-roa-format@tools.ietf.org, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: dkong@bbn.com, mlepinski@bbn.com, skent@bbn.com Resent-Message-Id: <20120621012004.DE8D011E8079@ietfa.amsl.com> Resent-Date: Wed, 20 Jun 2012 18:20:04 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: [sidr] #20: http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jun 2012 01:20:07 -0000 #20: http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725 [http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725 http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725] Beausourire|Last night I stayed up late playing poker with Tarot cards. I got a full house and four people died. - Steven Wright|One of the healthiest ways to gamble is with a spade and a package of garden seeds. - Dan Bennett|A Smith Wesson beats four aces. -American Proverb|Poker's a day to learn and a lifetime to master. -- -------------------------------------+------------------------------------- Reporter: anonymous | Owner: draft-ietf-sidr-roa- Type: task | format@… Priority: minor | Status: new Component: roa-format | Milestone: milestone1 Severity: Waiting for Shepherd | Version: 1.0 Writeup | Keywords: | http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725 -------------------------------------+------------------------------------- Ticket URL: sidr From tim@ripe.net Thu Jun 21 04:02:18 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD72521F851A for ; Thu, 21 Jun 2012 04:02:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IF+Jp5VPvoLO for ; Thu, 21 Jun 2012 04:02:18 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id D050E21F8517 for ; Thu, 21 Jun 2012 04:02:17 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1Shf9S-0007kz-Vq; Thu, 21 Jun 2012 13:02:16 +0200 Received: from s258-sslvpn-1.ripe.net ([193.0.20.231] helo=vpn-146.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1Shf9S-00021m-Mf; Thu, 21 Jun 2012 13:02:14 +0200 Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Tim Bruijnzeels In-Reply-To: Date: Thu, 21 Jun 2012 13:02:14 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <4FD8CB92.9030205@isode.com> <996DA30F-DC37-4147-B8EE-CDF02A11A258@isode.com> To: Randy Bush X-Mailer: Apple Mail (2.1084) X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20120621 clean X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07194c1356ca88c8f7102aa9e7706e16d7d9 Cc: sidr wg Subject: Re: [sidr] Discussion topics for the virtual interim on June 29th X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jun 2012 11:02:19 -0000 Hi, On 18 Jun 2012, at 04:30, Randy Bush wrote: > it sounds as if tim wants to discuss a point in pfx-validate, and > whether it is a security issue. we need to get that draft gone, so > let's try to clear any issues folk have. I am not sure if a lengthy discussion is needed. My point is just that I = believe that pfx-validate should state its requirement for full = knowledge clearly. How to meet this requirement is another matter and it = does not have to block this draft as far as I am concerned. I would like to discuss stuff we are working on wrt another way to deal = with the rpki repository, including ideas that might help to meet this = requirement, at the pre-ietf interim. Tim From dmandelb@bbn.com Fri Jun 22 08:12:01 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AC44021F8507 for ; Fri, 22 Jun 2012 08:12:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.11 X-Spam-Level: X-Spam-Status: No, score=-5.11 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J76EDb3R6Dp6 for ; Fri, 22 Jun 2012 08:12:01 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.0.80]) by ietfa.amsl.com (Postfix) with ESMTP id C956521F846F for ; Fri, 22 Jun 2012 08:12:00 -0700 (PDT) Received: from mail.bbn.com ([128.33.0.48]:48703) by smtp.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Si5Wd-0008to-5P for sidr@ietf.org; Fri, 22 Jun 2012 11:11:55 -0400 Received: from dhcp89-089-068.bbn.com ([128.89.89.68]) by mail.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1Si5Wd-0003PF-4N for sidr@ietf.org; Fri, 22 Jun 2012 11:11:55 -0400 Message-ID: <1340377917.19317.82.camel@titan> From: David Mandelberg To: sidr@ietf.org Date: Fri, 22 Jun 2012 11:11:57 -0400 Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.2.3-0ubuntu6 Content-Transfer-Encoding: 7bit Mime-Version: 1.0 Subject: [sidr] rpstir-0.4 released X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Jun 2012 15:12:01 -0000 BBN's RPKI relying party software, rpstir, version 0.4 is now available at http://sourceforge.net/projects/rpstir/. Major changes include: * Significant improvements to processing and validation of RPKI objects in conformance with specifications. See below for tests used to improve conformance to the specifications. * Conformance test cases for various specifications. These are also available at rsync://rpki.bbn.com/conformance/. See rsync://rpki.bbn.com/conformance/README for more information. * Better resistance to denial of service attacks through manifest file lists (e.g. paths with "../") and an improved algorithm for matching large lists of ROA prefixes against EE certificate prefixes. Smaller changes: * Performance tuning for rsync. * Remove dependency on python-netaddr and improve performance where python-netaddr used to be used. * Fix build and tests on NetBSD. * Fix compiling/linking with pthreads on some platforms. * More tests can be run under valgrind. * Various bug and compiler warning fixes. From morrowc@ops-netman.net Fri Jun 22 19:01:58 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9159711E808E for ; Fri, 22 Jun 2012 19:01:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id He7bEQejFy8l for ; Fri, 22 Jun 2012 19:01:57 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2001:470:e495:fade:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id 6D51A11E8088 for ; Fri, 22 Jun 2012 19:01:57 -0700 (PDT) Received: from [192.168.1.126] (c-98-204-226-233.hsd1.va.comcast.net [98.204.226.233]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id 9A06732038F; Sat, 23 Jun 2012 02:01:55 +0000 (UTC) Message-ID: <4FE52393.1000204@ops-netman.net> Date: Fri, 22 Jun 2012 22:01:55 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13.0) Gecko/20120615 Thunderbird/13.0.1 MIME-Version: 1.0 To: "'sidr-chairs@tools.ietf.org'" , "'sidr@ietf.org'" X-Enigmail-Version: 1.4.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [sidr] 06/29/2012 Interim meeting update/draft-agenda X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jun 2012 02:01:58 -0000 Howdy folk, Just in case people aren't refreshing the wiki page incessantly... links to: which has more information about the 6/29 meeting. -chris From trac@tools.ietf.org Sat Jun 23 03:56:10 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0ABA521F8540 for ; Sat, 23 Jun 2012 03:56:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.784 X-Spam-Level: X-Spam-Status: No, score=-99.784 tagged_above=-999 required=5 tests=[AWL=2.816, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ldlmm-3MX33B for ; Sat, 23 Jun 2012 03:56:09 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 5540521F8539 for ; Sat, 23 Jun 2012 03:56:09 -0700 (PDT) Received: from localhost ([127.0.0.1]:51240 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1SiO0U-00058t-3n; Sat, 23 Jun 2012 12:55:58 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-rogaglia-sidr-bgpsec-rollover@tools.ietf.org X-Trac-Project: sidr Date: Sat, 23 Jun 2012 10:55:57 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://trac.tools.ietf.org/wg/sidr/trac/ticket/21 Message-ID: <048.748dc0c8a2ca86436c9322af4f298dc7@tools.ietf.org> X-Trac-Ticket-ID: 21 X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-rogaglia-sidr-bgpsec-rollover@tools.ietf.org, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: bew@cisco.com, keyupate@cisco.com, rogaglia@cisco.com Resent-Message-Id: <20120623105609.5540521F8539@ietfa.amsl.com> Resent-Date: Sat, 23 Jun 2012 03:56:09 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: [sidr] #21: news24 live X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Jun 2012 10:56:10 -0000 #21: news24 live [http://news24live.tk/ news info] news24 stay, is a site on a daily basis actulizat ensue that calculate with the newest newscast in the world, all you need to know you will get hold of at this time -- -------------------------------------+------------------------------------- Reporter: anonymous | Owner: draft-rogaglia-sidr- Type: enhancement | bgpsec-rollover@… Priority: major | Status: new Component: draft-rogaglia-sidr- | Milestone: milestone1 bgpsec-rollover | Version: 2.0 Severity: Active WG Document | Keywords: news24 live -------------------------------------+------------------------------------- Ticket URL: sidr From trac@tools.ietf.org Sun Jun 24 14:44:58 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9280521F8562 for ; Sun, 24 Jun 2012 14:44:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -99.422 X-Spam-Level: X-Spam-Status: No, score=-99.422 tagged_above=-999 required=5 tests=[AWL=0.577, BAYES_50=0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z96MeuoW6C8M for ; Sun, 24 Jun 2012 14:44:57 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 8136421F845B for ; Sun, 24 Jun 2012 14:44:57 -0700 (PDT) Received: from localhost ([127.0.0.1]:46885 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1Siubr-0001IK-Qd; Sun, 24 Jun 2012 23:44:43 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-ietf-sidr-roa-format@tools.ietf.org X-Trac-Project: sidr Date: Sun, 24 Jun 2012 21:44:43 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://tools.ietf.org/wg/sidr/trac/ticket/22 Message-ID: <048.ba505da8b552214a6910b5df1ceb6c4a@tools.ietf.org> X-Trac-Ticket-ID: 22 X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-ietf-sidr-roa-format@tools.ietf.org, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: dkong@bbn.com, mlepinski@bbn.com, skent@bbn.com Resent-Message-Id: <20120624214457.8136421F845B@ietfa.amsl.com> Resent-Date: Sun, 24 Jun 2012 14:44:57 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: [sidr] #22: quit smoking cigarettes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Jun 2012 21:44:58 -0000 #22: quit smoking cigarettes [http://www.prlog.org/10335872-electric-cigarette-try-it-risk-free.html smokeless cigarettes] quit smoking cigarettes, and / or smokeless cigarette, is an electrical unit the fact that models the action of tobacco smoking by simply doing a particular puffed mister system supporting a physical sexual enjoyment, physical appearance, and they sometimes the flavor and various information in puffed cigarettes though without the presence of odour in cigarettes. These devices takes advantage of temperature, or perhaps many cases ultrasonics, to help vaporize a new propylene glycol- and / or glycerin-based aqueous method within a particular aerosol mister system, similar to the solution a new nebulizer and / or humidifier vaporizes options pertaining to breathing. Most ecigarettes are built to appear to be precise tobacco smoking instruments, which includes smoking, lighters, and / or pontoons, but a majority use the style of ballpoint pens and / or tools as those models are usually simple to deal with a things that's involved. The majority are in addition recyclable, together with exchangeable and refillable elements, however designs really are non-reusable. The principle suggested using the electric cigarette could be a new cigarettes unit, mainly because it attempts to deliver the expertise in using cigarettes while not, and / or together with cut down tremendously, undesirable health and wellbeing influences usually relating to cigarettes. Yet, issues have been completely elevated who make use of of this unit nonetheless holds health, and that also it could actually draw in non-smokers, certainly infants, problems . nice idea, flavorings, and even over-stated remarks in safety. -- -------------------------------------+------------------------------------- Reporter: anonymous | Owner: draft-ietf-sidr-roa- Type: task | format@… Priority: minor | Status: new Component: roa-format | Milestone: milestone1 Severity: Waiting for Shepherd | Version: 1.0 Writeup | Keywords: quit smoking cigarettes -------------------------------------+------------------------------------- Ticket URL: sidr From trac@tools.ietf.org Sun Jun 24 17:30:10 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FDE921F86E3 for ; Sun, 24 Jun 2012 17:30:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -97.435 X-Spam-Level: X-Spam-Status: No, score=-97.435 tagged_above=-999 required=5 tests=[AWL=-1.698, BAYES_00=-2.599, FRT_PENIS1=3.592, J_CHICKENPOX_57=0.6, J_CHICKENPOX_63=0.6, J_CHICKENPOX_65=0.6, J_CHICKENPOX_66=0.6, SARE_MLH_Stock1=0.87, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0BAuk0F8xoWE for ; Sun, 24 Jun 2012 17:30:06 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 6DF8E21F86B9 for ; Sun, 24 Jun 2012 17:30:06 -0700 (PDT) Received: from localhost ([127.0.0.1]:56721 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1SixBf-00067C-DF; Mon, 25 Jun 2012 02:29:51 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-ietf-sidr-signed-object@tools.ietf.org, morrowc@ops-netman.net X-Trac-Project: sidr Date: Mon, 25 Jun 2012 00:29:51 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://tools.ietf.org/wg/sidr/trac/ticket/19#comment:1 Message-ID: <063.643d249f657768270efb739680fa77dc@tools.ietf.org> References: <048.92806eaea0b384ce24a590a346f2d674@tools.ietf.org> X-Trac-Ticket-ID: 19 In-Reply-To: <048.92806eaea0b384ce24a590a346f2d674@tools.ietf.org> X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-ietf-sidr-signed-object@tools.ietf.org, morrowc@ops-netman.net, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: Resent-Message-Id: <20120625003006.6DF8E21F86B9@ietfa.amsl.com> Resent-Date: Sun, 24 Jun 2012 17:30:06 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: Re: [sidr] #19: history of stocks X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jun 2012 00:30:10 -0000 #19: history of stocks Changes (by morrowc@…): * status: new => closed * resolution: => invalid Old description: > [http://www.squidoo.com/history-of-penny-stocks {Peter Leeds|Timothy > Sykes|History of Penny Stocks|Penny Stocks|Buying Penny Stocks Online|Tim > Sykes: Penny Stock Genius|Become a Self Made Millionaire|What to Look for > in a Penny Stock}] > Never ever witnessed everything as evident as dust, to ensure as useless > due to the fact this publish! New description: [http://www.squidoo.com/history-of-penny-stocks {Peter Leeds|Timothy Sykes|History of Penny Stocks|Penny Stocks|Buying Penny Stocks Online|Tim Sykes: Penny Stock Genius|Become a Self Made Millionaire|What to Look for in a Penny Stock}] Never ever witnessed everything as evident as dust, to ensure as useless due to the fact this publish! -- -- ----------------------------+---------------------------------------------- Reporter: anonymous | Owner: draft-ietf-sidr-signed-object@… Type: task | Status: closed Priority: trivial | Milestone: milestone1 Component: signed-object | Version: 1.0 Severity: Dead WG | Resolution: invalid Document | Keywords: history of | stocks | ----------------------------+---------------------------------------------- Ticket URL: sidr From trac@tools.ietf.org Sun Jun 24 17:30:45 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9036C21F86DE for ; Sun, 24 Jun 2012 17:30:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.527 X-Spam-Level: X-Spam-Status: No, score=-100.527 tagged_above=-999 required=5 tests=[AWL=2.072, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yvenpfAh55w6 for ; Sun, 24 Jun 2012 17:30:41 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 7C73E21F86B9 for ; Sun, 24 Jun 2012 17:30:41 -0700 (PDT) Received: from localhost ([127.0.0.1]:56810 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1SixCQ-0005ot-6t; Mon, 25 Jun 2012 02:30:38 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-rogaglia-sidr-bgpsec-rollover@tools.ietf.org, morrowc@ops-netman.net X-Trac-Project: sidr Date: Mon, 25 Jun 2012 00:30:38 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://tools.ietf.org/wg/sidr/trac/ticket/21#comment:1 Message-ID: <063.42b291afe770dfcfcc35d4d3f49bd01e@tools.ietf.org> References: <048.748dc0c8a2ca86436c9322af4f298dc7@tools.ietf.org> X-Trac-Ticket-ID: 21 In-Reply-To: <048.748dc0c8a2ca86436c9322af4f298dc7@tools.ietf.org> X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-rogaglia-sidr-bgpsec-rollover@tools.ietf.org, morrowc@ops-netman.net, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: Resent-Message-Id: <20120625003041.7C73E21F86B9@ietfa.amsl.com> Resent-Date: Sun, 24 Jun 2012 17:30:41 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: Re: [sidr] #21: news24 live X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jun 2012 00:30:45 -0000 #21: news24 live Changes (by morrowc@…): * status: new => closed * resolution: => invalid Old description: > [http://news24live.tk/ news info] news24 stay, is a site on a daily > basis actulizat ensue that calculate with the newest newscast in the > world, > all you need to know you will get hold of at this time New description: [http://news24live.tk/ news info] news24 stay, is a site on a daily basis actulizat ensue that calculate with the newest newscast in the world, all you need to know you will get hold of at this time -- -- -------------------------------------+------------------------------------- Reporter: anonymous | Owner: draft-rogaglia-sidr- Type: enhancement | bgpsec-rollover@… Priority: major | Status: closed Component: draft-rogaglia-sidr- | Milestone: milestone1 bgpsec-rollover | Version: 2.0 Severity: Active WG Document | Resolution: invalid Keywords: news24 live | -------------------------------------+------------------------------------- Ticket URL: sidr From trac@tools.ietf.org Sun Jun 24 17:31:27 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4060E21F86FD for ; Sun, 24 Jun 2012 17:31:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.872 X-Spam-Level: X-Spam-Status: No, score=-100.872 tagged_above=-999 required=5 tests=[AWL=1.727, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 70blK2J7PDTY for ; Sun, 24 Jun 2012 17:31:17 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 1827D21F86FA for ; Sun, 24 Jun 2012 17:31:17 -0700 (PDT) Received: from localhost ([127.0.0.1]:56829 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1SixD0-0000fI-Mf; Mon, 25 Jun 2012 02:31:14 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-ietf-sidr-roa-format@tools.ietf.org, morrowc@ops-netman.net X-Trac-Project: sidr Date: Mon, 25 Jun 2012 00:31:14 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: https://trac.tools.ietf.org/wg/sidr/trac/ticket/22#comment:1 Message-ID: <063.26bfd17ec82a9cbbf3cdfe0b59226ff5@tools.ietf.org> References: <048.ba505da8b552214a6910b5df1ceb6c4a@tools.ietf.org> X-Trac-Ticket-ID: 22 In-Reply-To: <048.ba505da8b552214a6910b5df1ceb6c4a@tools.ietf.org> X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-ietf-sidr-roa-format@tools.ietf.org, morrowc@ops-netman.net, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: Resent-Message-Id: <20120625003117.1827D21F86FA@ietfa.amsl.com> Resent-Date: Sun, 24 Jun 2012 17:31:17 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: Re: [sidr] #22: quit smoking cigarettes X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jun 2012 00:31:27 -0000 #22: quit smoking cigarettes Changes (by morrowc@…): * status: new => closed * resolution: => invalid Old description: > [http://www.prlog.org/10335872-electric-cigarette-try-it-risk-free.html > smokeless cigarettes] quit smoking cigarettes, and / or smokeless > cigarette, is an electrical unit the fact that models the action of > tobacco smoking by simply doing a particular puffed mister system > supporting a physical sexual enjoyment, physical appearance, and they > sometimes the flavor and various information in puffed cigarettes though > without the presence of odour in cigarettes. These devices takes > advantage of temperature, or perhaps many cases ultrasonics, to help > vaporize a new propylene glycol- and / or glycerin-based aqueous method > within a particular aerosol mister system, similar to the solution a new > nebulizer and / or humidifier vaporizes options pertaining to breathing. > > Most ecigarettes are built to appear to be precise tobacco smoking > instruments, which includes smoking, lighters, and / or pontoons, but a > majority use the style of ballpoint pens and / or tools as those models > are usually simple to deal with a things that's involved. The majority > are in addition recyclable, together with exchangeable and refillable > elements, however designs really are non-reusable. > > The principle suggested using the electric cigarette could be a new > cigarettes unit, mainly because it attempts to deliver the expertise in > using cigarettes while not, and / or together with cut down tremendously, > undesirable health and wellbeing influences usually relating to > cigarettes. Yet, issues have been completely elevated who make use of of > this unit nonetheless holds health, and that also it could actually draw > in non-smokers, certainly infants, problems . nice idea, flavorings, and > even over-stated remarks in safety. New description: [http://www.prlog.org/10335872-electric-cigarette-try-it-risk-free.html smokeless cigarettes] quit smoking cigarettes, and / or smokeless cigarette, is an electrical unit the fact that models the action of tobacco smoking by simply doing a particular puffed mister system supporting a physical sexual enjoyment, physical appearance, and they sometimes the flavor and various information in puffed cigarettes though without the presence of odour in cigarettes. These devices takes advantage of temperature, or perhaps many cases ultrasonics, to help vaporize a new propylene glycol- and / or glycerin-based aqueous method within a particular aerosol mister system, similar to the solution a new nebulizer and / or humidifier vaporizes options pertaining to breathing. Most ecigarettes are built to appear to be precise tobacco smoking instruments, which includes smoking, lighters, and / or pontoons, but a majority use the style of ballpoint pens and / or tools as those models are usually simple to deal with a things that's involved. The majority are in addition recyclable, together with exchangeable and refillable elements, however designs really are non-reusable. The principle suggested using the electric cigarette could be a new cigarettes unit, mainly because it attempts to deliver the expertise in using cigarettes while not, and / or together with cut down tremendously, undesirable health and wellbeing influences usually relating to cigarettes. Yet, issues have been completely elevated who make use of of this unit nonetheless holds health, and that also it could actually draw in non-smokers, certainly infants, problems . nice idea, flavorings, and even over-stated remarks in safety. -- -- -------------------------------------+------------------------------------- Reporter: anonymous | Owner: draft-ietf-sidr-roa- Type: task | format@… Priority: minor | Status: closed Component: roa-format | Milestone: milestone1 Severity: Waiting for Shepherd | Version: 1.0 Writeup | Resolution: invalid Keywords: quit smoking cigarettes | -------------------------------------+------------------------------------- Ticket URL: sidr From trac@tools.ietf.org Sun Jun 24 17:31:41 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F0E421F86E5 for ; Sun, 24 Jun 2012 17:31:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.119 X-Spam-Level: X-Spam-Status: No, score=-101.119 tagged_above=-999 required=5 tests=[AWL=1.480, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mUN4xrXMUn0l for ; Sun, 24 Jun 2012 17:31:37 -0700 (PDT) Received: from grenache.tools.ietf.org (grenache.tools.ietf.org [77.72.230.30]) by ietfa.amsl.com (Postfix) with ESMTP id 8D6DF21F86B9 for ; Sun, 24 Jun 2012 17:31:37 -0700 (PDT) Received: from localhost ([127.0.0.1]:56839 helo=grenache.tools.ietf.org ident=www-data) by grenache.tools.ietf.org with esmtp (Exim 4.77) (envelope-from ) id 1SixDL-0007ba-Db; Mon, 25 Jun 2012 02:31:35 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: "sidr issue tracker" X-Trac-Version: 0.12.2 Precedence: bulk Auto-Submitted: auto-generated X-Mailer: Trac 0.12.2, by Edgewall Software To: draft-ietf-sidr-roa-format@tools.ietf.org, morrowc@ops-netman.net X-Trac-Project: sidr Date: Mon, 25 Jun 2012 00:31:35 -0000 X-URL: http://tools.ietf.org/sidr/ X-Trac-Ticket-URL: http://tools.ietf.org/wg/sidr/trac/ticket/20#comment:1 Message-ID: <063.609182f970d708f89b8320d2b6a7ff0e@tools.ietf.org> References: <048.216735640e2d8e07a931f0a374aba880@tools.ietf.org> X-Trac-Ticket-ID: 20 In-Reply-To: <048.216735640e2d8e07a931f0a374aba880@tools.ietf.org> X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Rcpt-To: draft-ietf-sidr-roa-format@tools.ietf.org, morrowc@ops-netman.net, sidr@ietf.org X-SA-Exim-Mail-From: trac@tools.ietf.org X-SA-Exim-Scanned: No (on grenache.tools.ietf.org); SAEximRunCond expanded to false Resent-To: Resent-Message-Id: <20120625003137.8D6DF21F86B9@ietfa.amsl.com> Resent-Date: Sun, 24 Jun 2012 17:31:37 -0700 (PDT) Resent-From: trac@tools.ietf.org Cc: sidr@ietf.org Subject: Re: [sidr] #20: http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jun 2012 00:31:41 -0000 #20: http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725 Changes (by morrowc@…): * status: new => closed * resolution: => invalid -- -------------------------------------+------------------------------------- Reporter: anonymous | Owner: draft-ietf-sidr-roa- Type: task | format@… Priority: minor | Status: closed Component: roa-format | Milestone: milestone1 Severity: Waiting for Shepherd | Version: 1.0 Writeup | Resolution: invalid Keywords: | http://www.pldtathome.com/Stores/StoreFront/ViewHome/1317/57725| -------------------------------------+------------------------------------- Ticket URL: sidr From sra@hactrn.net Mon Jun 25 08:30:03 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E2FC211E808F for ; Mon, 25 Jun 2012 08:30:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XGOy99cfe4zT for ; Mon, 25 Jun 2012 08:30:03 -0700 (PDT) Received: from cyteen.hactrn.net (cyteen.hactrn.net [66.92.66.68]) by ietfa.amsl.com (Postfix) with ESMTP id 1FAD211E808C for ; Mon, 25 Jun 2012 08:30:03 -0700 (PDT) Received: from thrintun.hactrn.net (thrintun.hactrn.net [10.0.1.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "thrintun.hactrn.net", Issuer "Grunchweather Associates" (verified OK)) by cyteen.hactrn.net (Postfix) with ESMTPS id 8663928465 for ; Mon, 25 Jun 2012 15:29:59 +0000 (UTC) Received: from thrintun.hactrn.net (localhost [IPv6:::1]) by thrintun.hactrn.net (Postfix) with ESMTP id 0642D17415 for ; Mon, 25 Jun 2012 11:29:59 -0400 (EDT) Date: Mon, 25 Jun 2012 11:29:58 -0400 From: Rob Austein To: sidr@ietf.org User-Agent: Wanderlust/2.14.0 (Africa) Emacs/23.4 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Message-Id: <20120625152959.0642D17415@thrintun.hactrn.net> Subject: [sidr] RFC 6485 is inconsistent with base CMS specifications X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jun 2012 15:30:04 -0000 Section 2 of RFC 6485 says that the OID in the CMS signatureAlgorithm field MUST be sha256WithRSAEncryption. This turns out not to be consistent either with the base CMS specifications or, more importantly, with the running code in the existing RPKI implementations. For those not familiar with the details of CMS: the SignerInfo structure includes separate fields indicating the digest and signature algorithms (digestAlgorithm and signatureAlgorithm, respectively). RFC 2630 12.2.2 specified that the signatureAlgorithm should be rsaEncryption when using RSA. RFC 3370 3.2 added the option of using OIDs like sha256WithRSAEncryption which indicate both digest and signature algorithm in a single OID, but maintained the requirement that CMS implementations which include RSA MUST support the rsaEncryption value of signatureAlgorithm. RFCs 4055 and 5754 define OIDs for SHA-2 (including SHA-256) and specify how to use them in CMS, but do not relax the MUST requirement for rsaEncryption. Furthermore, RFC 5754 3.2 explicitly refers back to RFC 3370 3.2. So the requirement to support rsaEncryption is consistent throughout the CMS specifications. Given this history, it should not be a surprise that existing CMS implementations such as OpenSSL and BouncyCastle just use rsaEncryption; it's the only mandatory-to-implement value for this field when using RSA, thus is the obvious choice for a signer whose author wants to maximize the chance that relying parties will be able to verify the message. Unfortunately, RFC 6485 says that only sha256WithRSAEncryption is allowed, so any CMS signer which takes the conservative approach suggested above will be in violation of RFC 6485. It turns out that all of the current RPKI CA engines of which I am aware (APNIC's, RIPE's, and mine) use CMS engines which do the conservative thing, thus are in violation of this portion of RFC 6485. I do not believe that this is what the SIDR WG intended, but that, of course, is for the WG chairs to determine. Given both the history of the base CMS specifications and the current text in RFC 6485, the correct fix for this appears to be to say that RPKI implementations MUST support rsaEncryption for the signatureAlgorithm field and MAY support sha256WithRSAEncryption. If we're seriously worried about compatibility with implementations which only support sha256WithRSAEncryption per RFC 6485, we could require support for both, but as far as I know, no such implementations exist, so it would be cleaner just to re-align the RPKI specifications with the base CMS specification and have done. Note that this is not a blanket change to all uses of sha256WithRSAEncryption in RFC 6485, it's only a change to the signatureAlgorithm field in the CMS SignerInfo. I will leave it for the WG to decide whether this change should take the form of an updated RFC or an erratum, I don't much care. Thanks to Andrew Chi, David Mandelberg, and Russ Housley for their help in finding and understanding this problem. Any errors here are my fault, not theirs. From mlepinski@bbn.com Mon Jun 25 11:25:03 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCBAE11E8091 for ; Mon, 25 Jun 2012 11:25:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fL049ERIS1Fj for ; Mon, 25 Jun 2012 11:25:02 -0700 (PDT) Received: from smtp.bbn.com (smtp.bbn.com [128.33.1.81]) by ietfa.amsl.com (Postfix) with ESMTP id 908F111E808C for ; Mon, 25 Jun 2012 11:25:02 -0700 (PDT) Received: from mail.bbn.com ([128.33.0.48]:37707) by smtp.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SjDxV-000LMj-NX for sidr@ietf.org; Mon, 25 Jun 2012 14:24:21 -0400 Received: from [128.89.253.190] by mail.bbn.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1SjDy9-00040J-Av for sidr@ietf.org; Mon, 25 Jun 2012 14:25:01 -0400 Message-ID: <4FE8AD06.7040702@bbn.com> Date: Mon, 25 Jun 2012 14:25:10 -0400 From: Matt Lepinski User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 MIME-Version: 1.0 To: sidr@ietf.org References: <20120625152959.0642D17415@thrintun.hactrn.net> In-Reply-To: <20120625152959.0642D17415@thrintun.hactrn.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [sidr] RFC 6485 is inconsistent with base CMS specifications X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Jun 2012 18:25:03 -0000 Rob, Thanks for the clear write-up of the issue. I support your proposed resolution that RPKI implementations MUST support rsaEncryption (for the signatureAlgorithm in SignerInfo) and MAY support sha256WithRSAEncryption. (I would be equally happy with SHOULD support sha256WithRSAEncryption, instead of MAY.) - Matt Lepinski On 6/25/2012 11:29 AM, Rob Austein wrote: > Section 2 of RFC 6485 says that the OID in the CMS signatureAlgorithm > field MUST be sha256WithRSAEncryption. This turns out not to be > consistent either with the base CMS specifications or, more > importantly, with the running code in the existing RPKI > implementations. > > For those not familiar with the details of CMS: the SignerInfo > structure includes separate fields indicating the digest and signature > algorithms (digestAlgorithm and signatureAlgorithm, respectively). > RFC 2630 12.2.2 specified that the signatureAlgorithm should be > rsaEncryption when using RSA. > > RFC 3370 3.2 added the option of using OIDs like > sha256WithRSAEncryption which indicate both digest and signature > algorithm in a single OID, but maintained the requirement that CMS > implementations which include RSA MUST support the rsaEncryption value > of signatureAlgorithm. RFCs 4055 and 5754 define OIDs for SHA-2 > (including SHA-256) and specify how to use them in CMS, but do not > relax the MUST requirement for rsaEncryption. Furthermore, RFC 5754 > 3.2 explicitly refers back to RFC 3370 3.2. > > So the requirement to support rsaEncryption is consistent throughout > the CMS specifications. Given this history, it should not be a > surprise that existing CMS implementations such as OpenSSL and > BouncyCastle just use rsaEncryption; it's the only > mandatory-to-implement value for this field when using RSA, thus is > the obvious choice for a signer whose author wants to maximize the > chance that relying parties will be able to verify the message. > > Unfortunately, RFC 6485 says that only sha256WithRSAEncryption is > allowed, so any CMS signer which takes the conservative approach > suggested above will be in violation of RFC 6485. It turns out that > all of the current RPKI CA engines of which I am aware (APNIC's, > RIPE's, and mine) use CMS engines which do the conservative thing, > thus are in violation of this portion of RFC 6485. I do not believe > that this is what the SIDR WG intended, but that, of course, is for > the WG chairs to determine. > > Given both the history of the base CMS specifications and the current > text in RFC 6485, the correct fix for this appears to be to say that > RPKI implementations MUST support rsaEncryption for the > signatureAlgorithm field and MAY support sha256WithRSAEncryption. > > If we're seriously worried about compatibility with implementations > which only support sha256WithRSAEncryption per RFC 6485, we could > require support for both, but as far as I know, no such > implementations exist, so it would be cleaner just to re-align the > RPKI specifications with the base CMS specification and have done. > > Note that this is not a blanket change to all uses of > sha256WithRSAEncryption in RFC 6485, it's only a change to the > signatureAlgorithm field in the CMS SignerInfo. > > I will leave it for the WG to decide whether this change should take > the form of an updated RFC or an erratum, I don't much care. > > Thanks to Andrew Chi, David Mandelberg, and Russ Housley for their > help in finding and understanding this problem. Any errors here are > my fault, not theirs. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr > From internet-drafts@ietf.org Tue Jun 26 12:59:07 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14BA011E80C5; Tue, 26 Jun 2012 12:59:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.542 X-Spam-Level: X-Spam-Status: No, score=-102.542 tagged_above=-999 required=5 tests=[AWL=0.057, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IRREG++GerZt; Tue, 26 Jun 2012 12:59:06 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EA3621F85DF; Tue, 26 Jun 2012 12:59:06 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.21 Message-ID: <20120626195906.19632.28558.idtracker@ietfa.amsl.com> Date: Tue, 26 Jun 2012 12:59:06 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-algorithm-agility-06.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jun 2012 19:59:07 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : Algorithm Agility Procedure for RPKI. Author(s) : Roque Gagliano Stephen Kent Sean Turner Filename : draft-ietf-sidr-algorithm-agility-06.txt Pages : 29 Date : 2012-06-26 Abstract: This document specifies the process that Certification Authorities (CAs) and Relying Parties (RPs) participating in the Resource Public Key Infrastructure (RPKI) will need to follow to transition to a new (and probably cryptographically stronger) algorithm set. The process is expected to be completed in a time scale of months or years. Consequently, no emergency transition is specified. The transition procedure defined in this document supports only a top-down migration (parent migrates before children). The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-algorithm-agility There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-algorithm-agility-06 A diff from previous version is available at: http://tools.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-algorithm-agility-06 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From rogaglia@cisco.com Tue Jun 26 13:04:03 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A961A21F85F7 for ; Tue, 26 Jun 2012 13:04:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TDREEaP6s61e for ; Tue, 26 Jun 2012 13:04:03 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 085FE21F8606 for ; Tue, 26 Jun 2012 13:04:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=rogaglia@cisco.com; l=2153; q=dns/txt; s=iport; t=1340741043; x=1341950643; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=fpBHiKKuemlJUiOBLFmCO24M0Tz3F8M2EViWPMxFLxE=; b=V8mu9zs+O7XVLVJnWIgAPHL1rh6+FLvXb/OGw592uJ27iU57U/vS/v6E Eow2oQskBzaRi6ntpI+sIvZcm/QoG6QtJs3sNEzpORIS5Z6qa8Qt9dGyW W1Bpg3wPwkU+KLx+NGss4s/zaZPBRWx9thR4W7+M3tfWil6W2jeoUN09W U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Av4EAKUU6k+tJV2Y/2dsb2JhbABEtjWBB4IYAQEBAwEBAQEPASc0GwIBCDYQJwslAgQTIodkBQuZFqBQizeFJGADlTKBEo0LgWaCXw X-IronPort-AV: E=Sophos;i="4.77,478,1336348800"; d="scan'208";a="96198012" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-5.cisco.com with ESMTP; 26 Jun 2012 20:04:02 +0000 Received: from xhc-aln-x11.cisco.com (xhc-aln-x11.cisco.com [173.36.12.85]) by rcdn-core-1.cisco.com (8.14.5/8.14.5) with ESMTP id q5QK42Uf012765 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Tue, 26 Jun 2012 20:04:02 GMT Received: from xmb-rcd-x01.cisco.com ([169.254.1.99]) by xhc-aln-x11.cisco.com ([173.36.12.85]) with mapi id 14.02.0298.004; Tue, 26 Jun 2012 15:04:02 -0500 From: "Roque Gagliano (rogaglia)" To: "sidr@ietf.org" Thread-Topic: [sidr] I-D Action: draft-ietf-sidr-algorithm-agility-06.txt Thread-Index: AQHNU9bUdl573GZljEKjNdQTyuN38Q== Date: Tue, 26 Jun 2012 20:04:01 +0000 Message-ID: <831DCFF1-B985-44A8-96CD-0960B0E9B2E2@cisco.com> References: <20120626195906.19632.28558.idtracker@ietfa.amsl.com> In-Reply-To: <20120626195906.19632.28558.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.55.83.152] x-tm-as-product-ver: SMEX-10.2.0.1135-7.000.1014-18996.004 x-tm-as-result: No--43.224700-8.000000-31 x-tm-as-user-approved-sender: No x-tm-as-user-blocked-sender: No Content-Type: text/plain; charset="us-ascii" Content-ID: <431906B597AC5B4D91B3B2FB392AF493@cisco.com> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] I-D Action: draft-ietf-sidr-algorithm-agility-06.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jun 2012 20:04:03 -0000 Dear WG, This update covers quite some comments received from the WG Chairs review a= fter the WGLC. The main change is an organization one as we created a speci= fic section on how to deprecate a suite (Section 10). We do not have pending issue and we believe it should now move to next step= in the publication process. Regards, Roque On Jun 26, 2012, at 9:59 PM, wrote: >=20 > A New Internet-Draft is available from the on-line Internet-Drafts direct= ories. > This draft is a work item of the Secure Inter-Domain Routing Working Grou= p of the IETF. >=20 > Title : Algorithm Agility Procedure for RPKI. > Author(s) : Roque Gagliano > Stephen Kent > Sean Turner > Filename : draft-ietf-sidr-algorithm-agility-06.txt > Pages : 29 > Date : 2012-06-26 >=20 > Abstract: > This document specifies the process that Certification Authorities > (CAs) and Relying Parties (RPs) participating in the Resource Public > Key Infrastructure (RPKI) will need to follow to transition to a new > (and probably cryptographically stronger) algorithm set. The process > is expected to be completed in a time scale of months or years. > Consequently, no emergency transition is specified. The transition > procedure defined in this document supports only a top-down migration > (parent migrates before children). >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-sidr-algorithm-agility >=20 > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-sidr-algorithm-agility-06 >=20 > A diff from previous version is available at: > http://tools.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-algorithm-agility-06 >=20 >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr From Sandra.Murphy@sparta.com Tue Jun 26 14:01:51 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C0B8311E80E2 for ; Tue, 26 Jun 2012 14:01:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.555 X-Spam-Level: X-Spam-Status: No, score=-102.555 tagged_above=-999 required=5 tests=[AWL=0.044, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YrYJjku5Z9xz for ; Tue, 26 Jun 2012 14:01:50 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 430C111E80CC for ; Tue, 26 Jun 2012 14:01:50 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5QL1mUr023896; Tue, 26 Jun 2012 16:01:48 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5QL1LLh005734; Tue, 26 Jun 2012 16:01:21 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Tue, 26 Jun 2012 17:00:57 -0400 From: "Murphy, Sandra" To: "John G. Scudder" Thread-Topic: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 Thread-Index: Ac1ASk1a5EstiVISTE2I8YfWJPfP6AIS0ySwAAi+IM8Ao+HBAAIlny41 Date: Tue, 26 Jun 2012 21:00:57 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2DEF8@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com>, <24B20D14B2CD29478C8D5D6E9CBB29F625F1A29D@Hermes.columbia.ads.sparta.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr@ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Jun 2012 21:01:51 -0000 Speaking as regular ol' member=0A= =0A= wrt:=0A= =0A= >True in the context of bgpsec. But this is just pfx-validate. =0A= =0A= Whoops. Absolutely right, my bad. Please disregard my comments.=0A= =0A= --Sandy, speaking as regular ol' member=0A= ________________________________________=0A= From: John G. Scudder [jgs@juniper.net]=0A= Sent: Friday, June 15, 2012 2:42 PM=0A= To: Murphy, Sandra=0A= Cc: George, Wes; sidr@ietf.org=0A= Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06=0A= =0A= True in the context of bgpsec. But this is just pfx-validate. Nonetheless, = I am OK with leaving it as an exercise for the implementor -- as Hannes not= es, this is how it ends up working anyway.=0A= =0A= --John=0A= =0A= On Jun 12, 2012, at 12:48 PM, Murphy, Sandra wrote:=0A= =0A= > Speaking as regular ol' member:=0A= >=0A= > wrt:=0A= >=0A= >> One nit - we've had several conversations about whether to use=0A= >> AS_Path as synonymous with AS4_Path since we require (with a=0A= >> MUST) support for 4-octet ASNs. I don't remember which way=0A= >> we came down on the matter, whether to explicitly say=0A= >> AS4_PATH since that is what will really be used, or to leave=0A= >> that as an exercise for the implementer.=0A= >=0A= > I do not believe that AS4_PATH would "really be used" by a bgpsec capable= router.=0A= >=0A= > The MUST support for 4 byte AS numbers means that the following text from= RFC4893 applies:=0A= >=0A= > The new attributes, AS4_PATH and AS4_AGGREGATOR SHOULD NOT be carried= =0A= > in the UPDATE messages between NEW BGP peers. A NEW BGP speaker that= =0A= > receives the AS4_PATH and AS4_AGGREGATOR path attributes in an UPDATE= =0A= > message from a NEW BGP speaker SHOULD discard these path attributes=0A= > and continue processing the UPDATE message.=0A= >=0A= > Each neighbor that has negotiated the bgpsec capability is a "NEW BGP sp= eaker" because it must support 4 byte ASNs. NEW BGP speakers use 4 byte AS= Ns in the AS_PATH (not AS4_PATH).=0A= >=0A= > The RFC4893 text says SHOULD rather than MUST, so it is possible that a b= gpsec speaker might actually receive the AS4_PATH attribute, but dropping t= he attribute is expected and just fine.=0A= >=0A= > --Sandy, speaking as regular ol' wg member=0A= >=0A= > ________________________________________=0A= > From: George, Wes [wesley.george@twcable.com]=0A= > Sent: Tuesday, June 12, 2012 8:22 AM=0A= > To: Murphy, Sandra; sidr@ietf.org=0A= > Subject: RE: WGLC for draft-ietf-sidr-pfx-validate-06=0A= >=0A= > I have read this draft and previous versions and I support publishing it.= =0A= >=0A= > One nit - we've had several conversations about whether to use AS_Path as= synonymous with AS4_Path since we require (with a MUST) support for 4-octe= t ASNs. I don't remember which way we came down on the matter, whether to e= xplicitly say AS4_PATH since that is what will really be used, or to leave = that as an exercise for the implementer.=0A= >=0A= > Thanks,=0A= >=0A= > Wes George=0A= >=0A= >=0A= >=0A= >> -----Original Message-----=0A= >> From: sidr-bounces@ietf.org [mailto:sidr-bounces@ietf.org] On Behalf Of= =0A= >> Murphy, Sandra=0A= >> Sent: Friday, June 01, 2012 7:00 PM=0A= >> To: sidr@ietf.org=0A= >> Subject: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06=0A= >>=0A= >> The authors have stated that they believe that draft-ietf-sidr-pfx-=0A= >> validate-06 "BGP Prefix Origin Validation" is ready for a working group= =0A= >> last call.=0A= >>=0A= >> The draft can be accessed at http://tools.ietf.org/html/draft-ietf-sidr-= =0A= >> pfx-validate-06 and https://datatracker.ietf.org/doc/draft-ietf-sidr-=0A= >> pfx-validate/=0A= >>=0A= >> This announces the beginning of the wglc. The last call will end on=0A= >> Friday, 15 Jun 2012.=0A= >>=0A= >> Please judge whether you believe that this work is ready for publication= =0A= >> and send any comments to the list.=0A= >>=0A= >> --Sandy, speaking as wg co-chair=0A= >> _______________________________________________=0A= >> sidr mailing list=0A= >> sidr@ietf.org=0A= >> https://www.ietf.org/mailman/listinfo/sidr=0A= >=0A= > This E-mail and any of its attachments may contain Time Warner Cable prop= rietary information, which is privileged, confidential, or subject to copyr= ight belonging to Time Warner Cable. This E-mail is intended solely for the= use of the individual or entity to which it is addressed. If you are not t= he intended recipient of this E-mail, you are hereby notified that any diss= emination, distribution, copying, or action taken in relation to the conten= ts of and attachments to this E-mail is strictly prohibited and may be unla= wful. If you have received this E-mail in error, please notify the sender i= mmediately and permanently delete the original and any copy of this E-mail = and any printout.=0A= > _______________________________________________=0A= > sidr mailing list=0A= > sidr@ietf.org=0A= > https://www.ietf.org/mailman/listinfo/sidr=0A= =0A= From Sandra.Murphy@sparta.com Wed Jun 27 14:09:26 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C89421F867E for ; Wed, 27 Jun 2012 14:09:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.564 X-Spam-Level: X-Spam-Status: No, score=-102.564 tagged_above=-999 required=5 tests=[AWL=0.035, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q6O0m50RFfxV for ; Wed, 27 Jun 2012 14:09:25 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 3003B21F85CD for ; Wed, 27 Jun 2012 14:09:21 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5RL9JcM001024 for ; Wed, 27 Jun 2012 16:09:20 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5RL99wd002279 for ; Wed, 27 Jun 2012 16:09:12 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Wed, 27 Jun 2012 17:08:45 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: upcoming important dates for IETF 84 Thread-Index: Ac1UpltL8fXSL3A9T+6m4Hx7ByGlJA== Date: Wed, 27 Jun 2012 21:08:43 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E3AC@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] upcoming important dates for IETF 84 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Jun 2012 21:09:26 -0000 Below are some dates to keep in mind for the upcoming meeting.=0A= =0A= The crucial dates for draft submission are:=0A= -00 version drafts must be submitted by 2012-07-09 17:00 PT (UTC -7)=0A= later version drafts must be submitted by 2012-07-16 17:00 PT (UTC -7)=0A= =0A= Note that if you are submitting a draft accepted as a wg work item, ie, the= draft name is draft-ietf-sidr-xxxyyyfoobar-00.txt, then the chairs will ne= ed to approve the submission. It is "appreciated" if you let the chairs kn= ow you will be doing that by 2 July 2012. =0A= =0A= 2012-07-02 (Monday): Working Group Chair approval for initial document (Ver= sion -00) submissions appreciated by 17:00 PT (UTC -7).=0A= 2012-07-06 (Friday): Final agenda to be published.=0A= 2012-07-09 (Monday): Internet Draft Cut-off for initial document (-00) subm= ission by 17:00 PT (UTC -7), upload using IETF ID Submission Tool.=0A= 2012-07-16 (Monday): Internet Draft final submission cut-off by 17:00 PT (U= TC -7), upload using IETF ID Submission Tool.=0A= 2012-07-18 (Wednesday): Draft Working Group agendas due by 17:00 PT (UTC -7= ), upload using IETF Meeting Materials Management Tool.=0A= 2012-07-20 (Friday): Early Bird registration and payment cut-off at 17:00 P= T (UTC -7).=0A= 2012-07-23 (Monday): Revised Working Group agendas due by 17:00 PT (UTC -7)= , upload using IETF Meeting Materials Management Tool.=0A= 2012-07-23 (Monday): Registration cancellation cut-off at 17:00 PT (UTC -7)= .=0A= 2012-07-27 (Friday): Final Pre-Registration and Pre-Payment cut-off at 17:0= 0 local meeting time.=0A= =0A= --Sandy= From wesley.george@twcable.com Thu Jun 28 13:27:24 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC88D11E809A for ; Thu, 28 Jun 2012 13:27:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.144 X-Spam-Level: X-Spam-Status: No, score=-1.144 tagged_above=-999 required=5 tests=[AWL=0.319, BAYES_00=-2.599, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TIOgdq0nwDCp for ; Thu, 28 Jun 2012 13:27:23 -0700 (PDT) Received: from cdpipgw01.twcable.com (cdpipgw01.twcable.com [165.237.59.22]) by ietfa.amsl.com (Postfix) with ESMTP id 8AEE521F8501 for ; Thu, 28 Jun 2012 13:27:23 -0700 (PDT) X-SENDER-IP: 10.136.163.11 X-SENDER-REPUTATION: None X-IronPort-AV: E=Sophos;i="4.77,493,1336363200"; d="scan'208";a="402945962" Received: from unknown (HELO PRVPEXHUB02.corp.twcable.com) ([10.136.163.11]) by cdpipgw01.twcable.com with ESMTP/TLS/RC4-MD5; 28 Jun 2012 16:26:14 -0400 Received: from PRVPEXVS03.corp.twcable.com ([10.136.163.27]) by PRVPEXHUB02.corp.twcable.com ([10.136.163.11]) with mapi; Thu, 28 Jun 2012 16:27:13 -0400 From: "George, Wes" To: "sidr wg list (sidr@ietf.org)" Date: Thu, 28 Jun 2012 16:27:12 -0400 Thread-Topic: AS Migration and aliasing Thread-Index: Ac1VbE964Tl5GD4nQX6M/ASwsnhZ3A== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] AS Migration and aliasing X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 20:27:25 -0000 During the last SIDR Interim, we talked about BGP Aliasing as a means to mi= grate from one ASN to another. I proxied some concerns from Shane Amante an= d others who weren't present, but I ended up being the stuckee to write up = the requirements/use case so that we can make sure that it's being appropri= ately addressed. Shane and I have worked to put together the below. If it's= helpful to put this in draft form, we're happy to do so, or the relevant b= its of text can be incorporated into existing drafts, or whatever. I figure= d the main thing was that I needed to get this out of my edit buffer and in= front of the right people without any additional delay so that we can disc= uss it further as necessary, so I'm sending it to the list as raw text for = now. General scenario - merging two or more ASNs, where eventually one subsumes = the other(s). Confederations are NOT being implemented between the ASNs. In= this example, AS200 is being subsumed by AS300. The reason that this may d= rive a slightly different solution in BGPSec than a standard confederation = is that unlike in a confed, eBGP peers may not be peering with the "correct= " external ASN, and the forward-signed updates are for a public ASN, rather= than a private one, so there is no expectation that we should strip them. There are two types/directions of migration to consider, each of which uses= some set of implementation-specific knobs to tweak the AS-Path. It's impor= tant to emphasize that a fundamental goal of these "proprietary knobs" is t= o (absolutely) ensure that you are NOT changing the AS_PATH length during t= he ASN migration. Note, this is critical in *both* the inbound (CE -> PE) = and outbound (PE -> CE) directions. This is important because for large ca= rriers who bill customers based on bits (usage), any lengthening of the AS_= PATH in either direction will cause traffic to shift away from their networ= k, which is bad (less usage =3D=3D less revenue). Local-AS: You have an end customer/eBGP peer that is peering with AS200. Yo= u wish to reconfigure that router to be in AS300, and need to be able to do= so without disrupting/coordinating the change with all of the eBGP peers s= imultaneously. So you reconfigure the peers with Local AS 200 so that the r= outer still appears to be in the same ASN. However, if the peer is doing BG= PSec, you have some additional wrinkles. For outbound announcements, this w= ould require the router to have the right keys for AS200 so that it can con= tinue signing with the right ASN towards peers configured this way. Inbound is more complicated - the peer doesn't know that you've changed ASN= s, so it is forward-signing all of its routes with AS200, not AS300. How do= you fix? Reference: http://www.cisco.com/en/US/docs/ios/12_2t/12_2t11/feature/guide/ft11bhla.ht= ml In the direction of CE -> PE (inbound), and speaking about IOS specifically= , (although equivalent knobs do exist in JUNOS and possibly others): 1) 'local-as ': appends the value to the AS_PATH of rou= tes received from the CE 2) 'local-as no-prepend': DOES NOT prepend value to th= e AS_PATH of routes received from the CE. For the reason stated above, one prefers configuration #2. This ensures th= at routes received by a PE through eBGP sessions with this 'local-as no-prepend' knob configured get transmitted out to SFI peers and/or cus= tomers with normal/natural neighbor sessions so that they do not = see a longer AS_PATH. IOW, if you had the following: NOTE: Direction of BGP Update as per the arrows. PE-1 is a PE whose "global configuration AS" has been changed from AS 200 t= o AS 300 to make it part of the "go forward/keep" ASN. PE-1 needs the configuration: router bgp 300 neighbor remote-as 400 neighbor local-as 300 no-prepend CE-1 ---> PE-1 -------------------> PE-2 ---> CE-2 400 Old_ASN: 200 New_ASN: 300 100 New_ASN: 300 CE-2 should see an AS_PATH that looks like: 400 300, (without seeing AS 200= *anywhere* in the AS_PATH due to the 'local-as no-prepend' knob). (NOTE: = if you *just* had the "local-as 300" knob configured on PE-1, then CE-2 wou= ld see an AS_PATH that looked like: 400 200 300). So, to answer the questions above: yes, in a BGPSec world, CE-1 in AS 400 w= ould (by default) be forward-signing toward , (a.k.a: AS 200). I'= m guessing the ISP would still need to publish public-keys for AS 200 if it= is to appear in the BGPSec_Path_Signature in order that receivers can vali= date the BGPSEC_Path_Signature arrived intact/whole. And, you need to roll= the keys for AS 200 indefinitely (or, as long as you keep AS 200 around in= your network). Replace-AS: You are trying to remove AS200 from the AS-path to ensure that = routes learned from AS200 don't have a longer AS-path and/or you want to ma= ke them look like they only transited AS300, not AS200->AS300. So you confi= gure routers to do replace-AS. How do you manage the routes that have been = forward-signed into AS200? What about routes originated by AS200? Do you re= -originate with AS300? Is there actually provision in the Origin validation= spec to allow you to re-originate routes, or do you have to do this with m= ore standard methods (filter the original announcement/origination and gene= rate a completely new announcement via null routes, network statements, etc= ). And from an RIR perspective, how do you manage this? Do they allow an ov= erlap period on RPKI for transitions like this? This is the opposite direction, from PE -> CE: http://www.cisco.com/en/US/docs/ios/12_3t/12_3t11/feature/guide/gtbgpdas.ht= ml The reference above is specifically looking at the 'replace-as' knob in Cis= co-land, (similar knobs also exist in JUNOS). To re-use the above diagram,= but in the opposite direction we have: CE-1 <--- PE-1 <------------------- PE-2 <--- CE-2 400 Old_ASN: 200 New_ASN: 300 100 New_ASN: 300 By default, *without* replace-as enabled, CE-1 would see an AS_PATH of: 200= 300 100, which is bad. Now, if we change PE-1 to have the following confi= g: router bgp 300 neighbor remote-as 400 neighbor local-as 300 no-prepend replace-as In this case, CE-1 would see an AS_PATH of: 300 100. In this direction, I don't believe CE-1 will care in a BGPSec-world, becaus= e PE-1 could begin forward-signing from to AS 400 at any time and= , as long as CE-1 has the certs for , then the path should validat= e OK. But we need someone to confirm this, so we document it for completen= ess. A couple of additional wrinkles to mention here: 1) Companies rarely stop with one M&A, and end up accumulating several leg= acy ASN's over time, which don't go away very quickly, if at all. In a BGP= SEC world, does this mean that every router in your network needs to mainta= in a unique public/private key-pair per "legacy ASN"? I'm really not sure = what is the answer, but would want to make sure this is considered, and ans= wered, as solutions are being proposed to solve this. 2) That second Cisco URL above also mentions the "dual-as" knob. My under= standing of that knob is it allows a eBGP peer, specifically a CE, to estab= lish a BGP neighbor session with /either/ or ... it's r= eally up to the CE's discretion to choose one or the other. Of course, thi= s allows the customer to decide, at a time of their choosing, when to migra= te from the ISP's to in their CE device's config. The reason for "dual-as" is that it's an enhancement above and beyond "= local-as". With just 'local-as' enabled, the PE is (in my understanding) o= nly expecting the CE to establish a neighbor relationship with , n= ot (ever) with . Anyway, point of mentioning this is to ensure th= at, again, this is captured in the reqmt's since the eBGP neighbor ASN can = migrate pretty rapidly. 3) In many ways, we're talking about a use case where there are valid reaso= ns to do exactly what BGPSec Path validation is trying to prevent - changin= g the AS-Path so that it differs from the path the update actually traveled= to make one path seem preferred over the other. How do we do this without = opening up an attack vector to allow malicious users to circumvent BGPSec? Thanks, Wes George, with a lot of assitance from Shane Amante This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout. From Sandra.Murphy@sparta.com Thu Jun 28 13:44:26 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5EC2611E80C2 for ; Thu, 28 Jun 2012 13:44:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.392 X-Spam-Level: X-Spam-Status: No, score=-102.392 tagged_above=-999 required=5 tests=[AWL=0.207, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xS28OCPeSsAM for ; Thu, 28 Jun 2012 13:44:25 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 6B51C11E80C4 for ; Thu, 28 Jun 2012 13:44:24 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5SKiNWm010281 for ; Thu, 28 Jun 2012 15:44:23 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5SKhxwE029843 for ; Thu, 28 Jun 2012 15:44:02 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Thu, 28 Jun 2012 16:43:34 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: a message burst coming Thread-Index: Ac1VULQqUKWz3vWsQ9u2TLupLJiAwg== Date: Thu, 28 Jun 2012 20:43:33 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E503@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [sidr] a message burst coming X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 20:44:27 -0000 The sidr chairs made some decisions on a bunch of drafts today. I happen t= o have easiest net connectivity, so I'm the one selected to send the messag= es. So expect to see a flurry of messages from me, speaking for the triumv= erate sidr-chairs.=0A= =0A= --Sandy, speaking as wg co-chair= From Sandra.Murphy@sparta.com Thu Jun 28 13:46:17 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CC9C11E80A4; Thu, 28 Jun 2012 13:46:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.398 X-Spam-Level: X-Spam-Status: No, score=-102.398 tagged_above=-999 required=5 tests=[AWL=0.201, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2+soltb0O7iO; Thu, 28 Jun 2012 13:46:16 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id CE61611E809C; Thu, 28 Jun 2012 13:46:16 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5SKkE1h010316; Thu, 28 Jun 2012 15:46:14 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5SKk1x8029931; Thu, 28 Jun 2012 15:46:01 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Thu, 28 Jun 2012 16:45:36 -0400 From: "Murphy, Sandra" To: "Roque Gagliano (rogaglia)" , "sidr@ietf.org" Thread-Topic: [sidr] WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover-01.txt Thread-Index: AQHNSOIwNrVBzjzRWEybbcwHJs86jJcQMGbr Date: Thu, 28 Jun 2012 20:45:35 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E583@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F1A3E8@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "sidr-chairs@ietf.org" Subject: Re: [sidr] WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 20:46:17 -0000 There were only two responses to this call for adoption. Both were positiv= e (and one was followed by extensive comments), but that's a pretty low ind= ication of wg interest.=0A= =0A= On the chance that people might be on holiday, we will give the wg until 5 = July (one week from today) to consider this work.=0A= =0A= This is your last chance, so speak up.=0A= =0A= --Sandy, speaking as wg co-chair=0A= ________________________________________=0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of Murphy, Sa= ndra [Sandra.Murphy@sparta.com]=0A= Sent: Tuesday, June 12, 2012 5:27 PM=0A= To: Roque Gagliano (rogaglia); sidr@ietf.org=0A= Cc: sidr-chairs@ietf.org=0A= Subject: [sidr] WG Adoption call for draft-rogaglia-sidr-bgpsec-rollover= -01.txt=0A= =0A= The authors request below that the wg adopt this work as a work item.=0A= =0A= The draft is available at http://tools.ietf.org/html/draft-rogaglia-sidr-bg= psec-rollover.=0A= =0A= Please respond to the list to say whether you accept this draft as a workin= g group draft and are willing to work on it. Remember that you do not need= to accept all content in a draft to adopt, as draft editors are required t= o reflect the consensus of the working group.=0A= =0A= This call will end 26 Jun 2012.=0A= =0A= --Sandy, speaking as wg co-chair=0A= =0A= =0A= =0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of Roque Gagl= iano (rogaglia) [rogaglia@cisco.com]=0A= =0A= Sent: Tuesday, June 05, 2012 8:05 AM=0A= =0A= To: sidr@ietf.org=0A= =0A= Subject: [sidr] Fwd: New Version Notification for draft-rogaglia-sidr-bgpse= c-rollover-01.txt=0A= =0A= =0A= =0A= =0A= =0A= Dear WG,=0A= =0A= =0A= =0A= We submitted a new version of this draft based on the feedback from our las= t meeting in Paris.=0A= =0A= =0A= =0A= As mentioned during Brian's presentation we would like to ask for WG adopti= on.=0A= =0A= =0A= =0A= Regards,=0A= Roque=0A= =0A= =0A= =0A= =0A= Begin forwarded message:=0A= =0A= =0A= =0A= From: =0A= =0A= =0A= =0A= Date: June 5, 2012 1:58:52 PM GMT+02:00=0A= =0A= =0A= =0A= To: =0A= =0A= =0A= =0A= Cc: ,=0A= =0A= =0A= =0A= =0A= Subject: New Version Notification for draft-rogaglia-sidr-bgpsec-rollover-0= 1.txt=0A= =0A= =0A= =0A= =0A= A new version of I-D, draft-rogaglia-sidr-bgpsec-rollover-01.txt has been s= uccessfully submitted by Roque Gagliano and posted to the IETF repository.= =0A= =0A= =0A= =0A= Filename: draft-rogaglia-sidr-bgpsec-rollover=0A= =0A= Revision: 01=0A= =0A= Title: BGPSEC router key rollover as an alternative to beaconing=0A= =0A= Creation date: 2012-06-05=0A= =0A= WG ID: Individual Submission=0A= =0A= Number of pages: 15=0A= =0A= =0A= =0A= Abstract:=0A= =0A= The current BGPSEC draft documents do not specifies a key rollover=0A= =0A= process for routers. This document describes a possible key rollover=0A= =0A= process and explores its impact to mitigate replay attacks and=0A= =0A= eliminate the need for beaconing in BGPSEC.=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= The IETF Secretariat=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= _______________________________________________=0A= sidr mailing list=0A= sidr@ietf.org=0A= https://www.ietf.org/mailman/listinfo/sidr=0A= From Sandra.Murphy@sparta.com Thu Jun 28 13:48:14 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0597C11E808A for ; Thu, 28 Jun 2012 13:48:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.405 X-Spam-Level: X-Spam-Status: No, score=-102.405 tagged_above=-999 required=5 tests=[AWL=0.194, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RrDLbwbTlNzW for ; Thu, 28 Jun 2012 13:48:12 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 5A58611E808D for ; Thu, 28 Jun 2012 13:48:12 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5SKm77b010332; Thu, 28 Jun 2012 15:48:07 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5SKleVJ030003; Thu, 28 Jun 2012 15:47:46 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Thu, 28 Jun 2012 16:47:15 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: WGLC for draft-ietf-sidr-rpsl-sig-05.txt Thread-Index: Ac06Aa7Kr7T1RdCRRuOxqeSeKadtDgbYa9xL Date: Thu, 28 Jun 2012 20:47:14 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E593@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F109D5@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F109D5@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Cc: "draft-ietf-sidr-rpsl-sig@tools.ietf.org" Subject: Re: [sidr] WGLC for draft-ietf-sidr-rpsl-sig-05.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 20:48:14 -0000 This wglc has ended. =0A= =0A= There were a few very thorough reviews of the document. The authors are re= quested to consider the comments and submit a revised draft. Discussion of= some of the points on the mailing list might help in deciding what revisio= ns would help.=0A= =0A= --Sandy, speaking as wg co-chair=0A= ________________________________________=0A= From: Murphy, Sandra=0A= Sent: Thursday, May 24, 2012 7:06 PM=0A= To: sidr@ietf.org=0A= Cc: draft-ietf-sidr-rpsl-sig@tools.ietf.org=0A= Subject: WGLC for draft-ietf-sidr-rpsl-sig-05.txt=0A= =0A= The authors have stated that they believe that draft-ietf-sidr-rpsl-sig-05 = "Securing RPSL Objects with RPKI Signatures" is ready for a working group l= ast call.=0A= =0A= The draft can be accessed at http://tools.ietf.org/html/draft-ietf-sidr-rps= l-sig-05 and https://datatracker.ietf.org/doc/draft-ietf-sidr-rpsl-sig/=0A= =0A= This announces the beginning of the wglc. The last call will end on Friday= , 08 Jun 2012.=0A= =0A= Please judge whether you believe that this work is ready for publication an= d send any comments to the list.=0A= =0A= --Sandy, speaking as wg co-chair=0A= From Sandra.Murphy@sparta.com Thu Jun 28 13:50:25 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9909211E808A; Thu, 28 Jun 2012 13:50:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.41 X-Spam-Level: X-Spam-Status: No, score=-102.41 tagged_above=-999 required=5 tests=[AWL=0.189, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1PsiribkSrwt; Thu, 28 Jun 2012 13:50:24 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id A471A21F8526; Thu, 28 Jun 2012 13:50:24 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5SKoGFU010357; Thu, 28 Jun 2012 15:50:19 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5SKnr08030072; Thu, 28 Jun 2012 15:50:00 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Thu, 28 Jun 2012 16:49:28 -0400 From: "Murphy, Sandra" To: Christopher Morrow , "sidr@ietf.org" , "sidr-chairs@ietf.org" Thread-Topic: [sidr] WGLC: draft-ietf-sidr-bgpsec-pki-profiles Thread-Index: AQHNGbJYVFqjinwqf0u680pkRvsHwZcQlJer Date: Thu, 28 Jun 2012 20:49:28 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E59B@Hermes.columbia.ads.sparta.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] WGLC: draft-ietf-sidr-bgpsec-pki-profiles X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 20:50:25 -0000 This last call has ended. There were only three comments during the wglc. = =0A= =0A= Two noted that the document was solid, but that it was premature to advance= the draft when the protocols spec was still undergoing changes and might p= roduce new required features for the router certificates.=0A= =0A= So what is the desire of the working group:=0A= =0A= - put the document on hold, refreshing versions numbers as necessary to kee= p it on the secretariat list of current drafts, until we are more certain n= o further features will be needed=0A= =0A= - publish the draft now and amend if new features should pop up=0A= =0A= If the later, more support for publication is needed.=0A= =0A= --Sandy, speaking as wg co-chair=0A= ________________________________________=0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of Christophe= r Morrow [morrowc.lists@gmail.com]=0A= Sent: Friday, April 13, 2012 4:16 PM=0A= To: sidr@ietf.org; sidr-chairs@ietf.org=0A= Subject: [sidr] WGLC: draft-ietf-sidr-bgpsec-pki-profiles=0A= =0A= Helo WG peoples,=0A= The following update posted today. Sean and Tom have come to agreement=0A= on their differences, I believe this closes the last open items on=0A= this document.=0A= =0A= Let's start a WGLC for this, ending: 4/27/2012 or 27/4/2012=0A= =0A= Thanks!=0A= -Chris=0A= =0A= =0A= On Fri, Apr 13, 2012 at 3:03 PM, wrote:=0A= >=0A= > A New Internet-Draft is available from the on-line Internet-Drafts direct= ories. This draft is a work item of the Secure Inter-Domain Routing Working= Group of the IETF.=0A= >=0A= > Title : A Profile for BGPSEC Router Certificates, Certif= icate Revocation Lists, and Certification Requests=0A= > Author(s) : Mark Reynolds=0A= > Sean Turner=0A= > Steve Kent=0A= > Filename : draft-ietf-sidr-bgpsec-pki-profiles-03.txt=0A= > Pages : 11=0A= > Date : 2012-04-13=0A= >=0A= > This document defines a standard profile for X.509 certificates for=0A= > the purposes of supporting validation of Autonomous System (AS) paths= =0A= > in the Border Gateway Protocol (BGP), as part of an extension to that= =0A= > protocol known as BGPSEC. BGP is a critical component for the proper= =0A= > operation of the Internet as a whole. The BGPSEC protocol is under=0A= > development as a component to address the requirement to provide=0A= > security for the BGP protocol. The goal of BGPSEC is to design a=0A= > protocol for full AS path validation based on the use of strong=0A= > cryptographic primitives. The end-entity (EE) certificates specified= =0A= > by this profile are issued under Resource Public Key Infrastructure=0A= > (RPKI) Certification Authority (CA) certificates, containing the AS=0A= > Identifier Delegation extension, to routers within the Autonomous=0A= > System (AS). The certificate asserts that the router(s) holding the=0A= > private key are authorized to send out secure route advertisements on= =0A= > behalf of the specified AS. This document also profiles the=0A= > Certificate Revocation List (CRL), profiles the format of=0A= > certification requests, and specifies Relying Party certificate path=0A= > validation procedures. The document extends the RPKI; therefore,=0A= > this documents updates the RPKI Resource Certificates Profile (RFC=0A= > 6487).=0A= >=0A= >=0A= > A URL for this Internet-Draft is:=0A= > http://www.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-0= 3.txt=0A= >=0A= > Internet-Drafts are also available by anonymous FTP at:=0A= > ftp://ftp.ietf.org/internet-drafts/=0A= >=0A= > This Internet-Draft can be retrieved at:=0A= > ftp://ftp.ietf.org/internet-drafts/draft-ietf-sidr-bgpsec-pki-profiles-03= .txt=0A= >=0A= > _______________________________________________=0A= > sidr mailing list=0A= > sidr@ietf.org=0A= > https://www.ietf.org/mailman/listinfo/sidr=0A= _______________________________________________=0A= sidr mailing list=0A= sidr@ietf.org=0A= https://www.ietf.org/mailman/listinfo/sidr=0A= From ietf-secretariat@ietf.org Thu Jun 28 14:09:48 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3333D11E809C; Thu, 28 Jun 2012 14:09:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EbdDb1O34L+P; Thu, 28 Jun 2012 14:09:47 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B4AFF11E8087; Thu, 28 Jun 2012 14:09:47 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: IETF Secretariat To: IETF Announcement List X-Test-IDTracker: no X-IETF-IDTracker: 4.21p1 Message-ID: <20120628210947.30602.91191.idtracker@ietfa.amsl.com> Date: Thu, 28 Jun 2012 14:09:47 -0700 Cc: sidr@ietf.org Subject: [sidr] SIDR WG Interim Meeting, Friday July 27, 2012 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 21:09:48 -0000 The SIDR working group plans a face-to-face interim meeting on Fri 27 July = 2012 in Vancouver. The meeting will be held 0900-1700. Location will be announced later. Anticipated topics include discussion of performance and measurements of th= e RPKI system. At this time, the agenda will be: 0900-1130 Discussion 1130-1330 Lunch 1330-1700 Discussion Refinements of this agenda will be announced on the SIDR mailing list. Remote participation by webex, teleconference, and jabber will be provided.= Details will be announced before hand. From Sandra.Murphy@sparta.com Thu Jun 28 15:21:09 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E5B021F85B1 for ; Thu, 28 Jun 2012 15:21:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.45 X-Spam-Level: X-Spam-Status: No, score=-102.45 tagged_above=-999 required=5 tests=[AWL=0.149, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hc0O1V1-seoC for ; Thu, 28 Jun 2012 15:21:08 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id CBE2421F858F for ; Thu, 28 Jun 2012 15:21:07 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5SML6H2001659; Thu, 28 Jun 2012 17:21:06 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5SMKr3f003874; Thu, 28 Jun 2012 17:20:59 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Thu, 28 Jun 2012 18:20:28 -0400 From: "Murphy, Sandra" To: "George, Wes" , "sidr wg list (sidr@ietf.org)" Thread-Topic: AS Migration and aliasing Thread-Index: Ac1VbE964Tl5GD4nQX6M/ASwsnhZ3AAD9AuL Date: Thu, 28 Jun 2012 22:20:27 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E6D7@Hermes.columbia.ads.sparta.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] AS Migration and aliasing X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 22:21:09 -0000 Lots of stuff to consider here!=0A= =0A= Last minute, but would you like to fit this into the interim meeting tomorr= ow?=0A= =0A= --Sandy, speaking as co-chair=0A= ________________________________________=0A= From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of George, We= s [wesley.george@twcable.com]=0A= Sent: Thursday, June 28, 2012 4:27 PM=0A= To: sidr wg list (sidr@ietf.org)=0A= Subject: [sidr] AS Migration and aliasing=0A= =0A= During the last SIDR Interim, we talked about BGP Aliasing as a means to mi= grate from one ASN to another. I proxied some concerns from Shane Amante an= d others who weren't present, but I ended up being the stuckee to write up = the requirements/use case so that we can make sure that it's being appropri= ately addressed. Shane and I have worked to put together the below. If it's= helpful to put this in draft form, we're happy to do so, or the relevant b= its of text can be incorporated into existing drafts, or whatever. I figure= d the main thing was that I needed to get this out of my edit buffer and in= front of the right people without any additional delay so that we can disc= uss it further as necessary, so I'm sending it to the list as raw text for = now.=0A= =0A= =0A= =0A= =0A= General scenario - merging two or more ASNs, where eventually one subsumes = the other(s). Confederations are NOT being implemented between the ASNs. In= this example, AS200 is being subsumed by AS300. The reason that this may d= rive a slightly different solution in BGPSec than a standard confederation = is that unlike in a confed, eBGP peers may not be peering with the "correct= " external ASN, and the forward-signed updates are for a public ASN, rather= than a private one, so there is no expectation that we should strip them.= =0A= =0A= There are two types/directions of migration to consider, each of which uses= some set of implementation-specific knobs to tweak the AS-Path. It's impor= tant to emphasize that a fundamental goal of these "proprietary knobs" is t= o (absolutely) ensure that you are NOT changing the AS_PATH length during t= he ASN migration. Note, this is critical in *both* the inbound (CE -> PE) = and outbound (PE -> CE) directions. This is important because for large ca= rriers who bill customers based on bits (usage), any lengthening of the AS_= PATH in either direction will cause traffic to shift away from their networ= k, which is bad (less usage =3D=3D less revenue).=0A= =0A= Local-AS: You have an end customer/eBGP peer that is peering with AS200. Yo= u wish to reconfigure that router to be in AS300, and need to be able to do= so without disrupting/coordinating the change with all of the eBGP peers s= imultaneously. So you reconfigure the peers with Local AS 200 so that the r= outer still appears to be in the same ASN. However, if the peer is doing BG= PSec, you have some additional wrinkles. For outbound announcements, this w= ould require the router to have the right keys for AS200 so that it can con= tinue signing with the right ASN towards peers configured this way.=0A= Inbound is more complicated - the peer doesn't know that you've changed ASN= s, so it is forward-signing all of its routes with AS200, not AS300. How do= you fix?=0A= =0A= Reference:=0A= http://www.cisco.com/en/US/docs/ios/12_2t/12_2t11/feature/guide/ft11bhla.ht= ml=0A= =0A= In the direction of CE -> PE (inbound), and speaking about IOS specifically= , (although equivalent knobs do exist in JUNOS and possibly others):=0A= 1) 'local-as ': appends the value to the AS_PATH of rou= tes received from the CE=0A= 2) 'local-as no-prepend': DOES NOT prepend value to th= e AS_PATH of routes received from the CE.=0A= =0A= For the reason stated above, one prefers configuration #2. This ensures th= at routes received by a PE through eBGP sessions with this 'local-as no-prepend' knob configured get transmitted out to SFI peers and/or cus= tomers with normal/natural neighbor sessions so that they do not = see a longer AS_PATH. IOW, if you had the following:=0A= =0A= NOTE: Direction of BGP Update as per the arrows.=0A= PE-1 is a PE whose "global configuration AS" has been changed from AS 200 t= o AS 300 to make it part of the "go forward/keep" ASN.=0A= PE-1 needs the configuration:=0A= =0A= router bgp 300=0A= neighbor remote-as 400=0A= neighbor local-as 300 no-prepend=0A= =0A= CE-1 ---> PE-1 -------------------> PE-2 ---> CE-2=0A= 400 Old_ASN: 200 New_ASN: 300 100=0A= New_ASN: 300=0A= =0A= CE-2 should see an AS_PATH that looks like: 400 300, (without seeing AS 200= *anywhere* in the AS_PATH due to the 'local-as no-prepend' knob). (NOTE: = if you *just* had the "local-as 300" knob configured on PE-1, then CE-2 wou= ld see an AS_PATH that looked like: 400 200 300).=0A= =0A= So, to answer the questions above: yes, in a BGPSec world, CE-1 in AS 400 w= ould (by default) be forward-signing toward , (a.k.a: AS 200). I'= m guessing the ISP would still need to publish public-keys for AS 200 if it= is to appear in the BGPSec_Path_Signature in order that receivers can vali= date the BGPSEC_Path_Signature arrived intact/whole. And, you need to roll= the keys for AS 200 indefinitely (or, as long as you keep AS 200 around in= your network).=0A= =0A= =0A= Replace-AS: You are trying to remove AS200 from the AS-path to ensure that = routes learned from AS200 don't have a longer AS-path and/or you want to ma= ke them look like they only transited AS300, not AS200->AS300. So you confi= gure routers to do replace-AS. How do you manage the routes that have been = forward-signed into AS200? What about routes originated by AS200? Do you re= -originate with AS300? Is there actually provision in the Origin validation= spec to allow you to re-originate routes, or do you have to do this with m= ore standard methods (filter the original announcement/origination and gene= rate a completely new announcement via null routes, network statements, etc= ). And from an RIR perspective, how do you manage this? Do they allow an ov= erlap period on RPKI for transitions like this?=0A= =0A= This is the opposite direction, from PE -> CE:=0A= http://www.cisco.com/en/US/docs/ios/12_3t/12_3t11/feature/guide/gtbgpdas.ht= ml=0A= =0A= The reference above is specifically looking at the 'replace-as' knob in Cis= co-land, (similar knobs also exist in JUNOS). To re-use the above diagram,= but in the opposite direction we have:=0A= =0A= CE-1 <--- PE-1 <------------------- PE-2 <--- CE-2=0A= 400 Old_ASN: 200 New_ASN: 300 100=0A= New_ASN: 300=0A= =0A= By default, *without* replace-as enabled, CE-1 would see an AS_PATH of: 200= 300 100, which is bad. Now, if we change PE-1 to have the following confi= g:=0A= =0A= router bgp 300=0A= neighbor remote-as 400=0A= neighbor local-as 300 no-prepend replace-as=0A= =0A= In this case, CE-1 would see an AS_PATH of: 300 100.=0A= =0A= In this direction, I don't believe CE-1 will care in a BGPSec-world, becaus= e PE-1 could begin forward-signing from to AS 400 at any time and= , as long as CE-1 has the certs for , then the path should validat= e OK. But we need someone to confirm this, so we document it for completen= ess.=0A= =0A= =0A= A couple of additional wrinkles to mention here:=0A= 1) Companies rarely stop with one M&A, and end up accumulating several leg= acy ASN's over time, which don't go away very quickly, if at all. In a BGP= SEC world, does this mean that every router in your network needs to mainta= in a unique public/private key-pair per "legacy ASN"? I'm really not sure = what is the answer, but would want to make sure this is considered, and ans= wered, as solutions are being proposed to solve this.=0A= 2) That second Cisco URL above also mentions the "dual-as" knob. My under= standing of that knob is it allows a eBGP peer, specifically a CE, to estab= lish a BGP neighbor session with /either/ or ... it's r= eally up to the CE's discretion to choose one or the other. Of course, thi= s allows the customer to decide, at a time of their choosing, when to migra= te from the ISP's to in their CE device's config.=0A= The reason for "dual-as" is that it's an enhancement above and beyond "= local-as". With just 'local-as' enabled, the PE is (in my understanding) o= nly expecting the CE to establish a neighbor relationship with , n= ot (ever) with . Anyway, point of mentioning this is to ensure th= at, again, this is captured in the reqmt's since the eBGP neighbor ASN can = migrate pretty rapidly.=0A= 3) In many ways, we're talking about a use case where there are valid reaso= ns to do exactly what BGPSec Path validation is trying to prevent - changin= g the AS-Path so that it differs from the path the update actually traveled= to make one path seem preferred over the other. How do we do this without = opening up an attack vector to allow malicious users to circumvent BGPSec?= =0A= =0A= Thanks,=0A= =0A= Wes George, with a lot of assitance from Shane Amante=0A= =0A= This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout.=0A= _______________________________________________=0A= sidr mailing list=0A= sidr@ietf.org=0A= https://www.ietf.org/mailman/listinfo/sidr=0A= From Sandra.Murphy@sparta.com Thu Jun 28 15:27:00 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F17C911E80E6 for ; Thu, 28 Jun 2012 15:26:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.453 X-Spam-Level: X-Spam-Status: No, score=-103.453 tagged_above=-999 required=5 tests=[AWL=1.144, BAYES_00=-2.599, GB_I_INVITATION=-2, HTML_MESSAGE=0.001, USER_IN_WHITELIST=-100, WEIRD_PORT=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bWPB28OVylrI for ; Thu, 28 Jun 2012 15:26:58 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 8F35A11E80E1 for ; Thu, 28 Jun 2012 15:26:58 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5SMQv9P001692 for ; Thu, 28 Jun 2012 17:26:58 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5SMQpsA003990 for ; Thu, 28 Jun 2012 17:26:51 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Thu, 28 Jun 2012 18:26:26 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: remote participation information for the interim meeting Thread-Index: AQHNVX0NUPzxG6ChSECNOMNLw5nHCQ== Date: Thu, 28 Jun 2012 22:26:25 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E6C1@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: multipart/alternative; boundary="_000_24B20D14B2CD29478C8D5D6E9CBB29F625F2E6C1Hermescolumbiaa_" MIME-Version: 1.0 Subject: [sidr] remote participation information for the interim meeting X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Jun 2012 22:27:00 -0000 --_000_24B20D14B2CD29478C8D5D6E9CBB29F625F2E6C1Hermescolumbiaa_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Here is the webex invitation including the dial in information. No slides have yet been sent to the chairs from anyone, so this meeting wil= l start out as conversation only (after the usual brief chair presentation)= . If anyone has slides they wish to share at any point, send them to the chai= rs for upload to the meeting materials site. The meeting materials site is: http://www.ietf.org/proceedings/interim/2012/06/29/sidr/proceedings.html We'll be using the usual sidr jabber room for chatting and an etherpad for = real-time notetaking: http://grenache.tools.ietf.org:9001/p/notes-interim-2012-sidr-4. --Sandy, speaking as co-chair ________________________________ From: Secure Inter-Domain Routing Working Group [messenger@webex.com] Sent: Thursday, June 28, 2012 5:26 PM To: Murphy, Sandra Subject: Meeting invitation: SIDR virtual interim Hello , Secure Inter-Domain Routing Working Group invites you to attend this online= meeting. Topic: SIDR virtual interim Date: Friday, June 29, 2012 Time: 9:00 am, Eastern Daylight Time (New York, GMT-04:00) Meeting Number: 644 568 840 Meeting Password: interim29Jun ------------------------------------------------------- To join the online meeting (Now from mobile devices!) ------------------------------------------------------- 1. Go to https://ietf.webex.com/ietf/j.php?ED=3D155818382&UID=3D1257744337&= PW=3DNMDc3Mjc1ZGQ2&RT=3DMiMxMQ%3D%3D 2. If requested, enter your name and email address. 3. If a password is required, enter the meeting password: interim29Jun 4. Click "Join". To view in other time zones or languages, please click the link: https://ietf.webex.com/ietf/j.php?ED=3D155818382&UID=3D1257744337&PW=3DNMDc= 3Mjc1ZGQ2&ORT=3DMiMxMQ%3D%3D ------------------------------------------------------- To join the audio conference only ------------------------------------------------------- Call-in toll number (US/Canada): +1-408-600-3600 Access code:644 568 840 ------------------------------------------------------- For assistance ------------------------------------------------------- 1. Go to https://ietf.webex.com/ietf/mc 2. On the left navigation bar, click "Support". You can contact me at: sidr-chairs@tools.ietf.org To add this meeting to your calendar program (for example Microsoft Outlook= ), click this link: https://ietf.webex.com/ietf/j.php?ED=3D155818382&UID=3D1257744337&ICS=3DMI&= LD=3D1&RD=3D2&ST=3D1&SHA2=3D-hwqhFNWt89kguyS2vaABQei-zLgghfcmasRaCSoaUo=3D&= RT=3DMiMxMQ%3D%3D The playback of UCF (Universal Communications Format) rich media files requ= ires appropriate players. To view this type of rich media files in the meet= ing, please check whether you have the players installed on your computer b= y going to https://ietf.webex.com/ietf/systemdiagnosis.php. Sign up for a free trial of WebEx http://www.webex.com/go/mcemfreetrial http://www.webex.com CCP:+14086003600x644568840# IMPORTANT NOTICE: This WebEx service includes a feature that allows audio a= nd any documents and other materials exchanged or viewed during the session= to be recorded. By joining this session, you automatically consent to such= recordings. If you do not consent to the recording, discuss your concerns = with the meeting host prior to the start of the recording or do not join th= e session. Please note that any such recordings may be subject to discovery= in the event of litigation. --_000_24B20D14B2CD29478C8D5D6E9CBB29F625F2E6C1Hermescolumbiaa_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Here is the webex invitation including the dial in information.

No slides have yet been sent to the chairs from anyone, so this meeting wil= l start out as conversation only (after the usual brief chair presentation)= .

If anyone has slides they wish to share at any point, send them to the chai= rs for upload to the meeting materials site.

The meeting materials site is:
http://www.ietf.org/proceedings/interim/2012/06= /29/sidr/proceedings.html

We'll be using the usual sidr jabber room for chatting and an etherpad for = real-time notetaking:
http://grenache.tools.ietf.org:9001/p/notes-interim-201= 2-sidr-4.

--Sandy, speaking as co-chair


From: Secure Inter-Domain Routing Working= Group [messenger@webex.com]
Sent: Thursday, June 28, 2012 5:26 PM
To: Murphy, Sandra
Subject: Meeting invitation: SIDR virtual interim


Hello ,

Secure Inter-Domain Routing Working Group invites you to attend this online= meeting.

Topic: SIDR virtual interim
Date: Friday, June 29, 2012
Time: 9:00 am, Eastern Daylight Time (New York, GMT-04:00)
Meeting Number: 644 568 840
Meeting Password: interim29Jun


-------------------------------------------------------
To join the online meeting (Now from mobile devices!)
-------------------------------------------------------
1. Go to https://ietf.webex.com/ietf/j.php?ED=3D155818382&UID=3D1257744337&P= W=3DNMDc3Mjc1ZGQ2&RT=3DMiMxMQ%3D%3D
2. If requested, enter your name and email address.
3. If a password is required, enter the meeting password: interim29Jun
4. Click "Join".

To view in other time zones or languages, please click the link:
http= s://ietf.webex.com/ietf/j.php?ED=3D155818382&UID=3D1257744337&PW=3D= NMDc3Mjc1ZGQ2&ORT=3DMiMxMQ%3D%3D

-------------------------------------------------------
To join the audio conference only
-------------------------------------------------------
Call-in toll number (US/Canada): +1-408-600-3600

Access code:644 568 840

-------------------------------------------------------
For assistance
-------------------------------------------------------
1. Go to https= ://ietf.webex.com/ietf/mc
2. On the left navigation bar, click "Support".

You can contact me at:
sidr-chairs= @tools.ietf.org


To add this meeting to your calendar program (for example Microsoft Outlook= ), click this link:
https://ietf.webex.com/ietf/j.php?ED=3D155818382&UID=3D1257744337&= ICS=3DMI&LD=3D1&RD=3D2&ST=3D1&SHA2=3D-hwqhFNWt89kguyS2vaABQ= ei-zLgghfcmasRaCSoaUo=3D&RT=3DMiMxMQ%3D%3D

The playback of UCF (Universal Communications Format) rich media files requ= ires appropriate players. To view this type of rich media files in the meet= ing, please check whether you have the players installed on your computer b= y going to https://ietf.webex.com/ietf/systemdiagnosis.php.

Sign up for a free trial of WebEx
http://= www.webex.com/go/mcemfreetrial

http://www.webex.com=

CCP:+14086003600x644568840#

IMPORTANT NOTICE: This WebEx service includes a feature that allows audio a= nd any documents and other materials exchanged or viewed during the session= to be recorded. By joining this session, you automatically consent to such= recordings. If you do not consent to the recording, discuss your concerns with the meeting host prior to the= start of the recording or do not join the session. Please note that any su= ch recordings may be subject to discovery in the event of litigation.
--_000_24B20D14B2CD29478C8D5D6E9CBB29F625F2E6C1Hermescolumbiaa_-- From morrowc@ops-netman.net Thu Jun 28 19:36:12 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C54D11E810A for ; Thu, 28 Jun 2012 19:36:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.6 X-Spam-Level: X-Spam-Status: No, score=-3.6 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_INVITATION=-2, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IfTqu7hWlLT7 for ; Thu, 28 Jun 2012 19:36:11 -0700 (PDT) Received: from mailserver.ops-netman.net (mailserver.ops-netman.net [IPv6:2001:470:e495:fade:5054:ff:fe79:69db]) by ietfa.amsl.com (Postfix) with ESMTP id BF3DA11E8085 for ; Thu, 28 Jun 2012 19:36:11 -0700 (PDT) Received: from [IPv6:2001:470:e03a:b00b:224:d7ff:fe9a:c078] (unknown [IPv6:2001:470:e03a:b00b:224:d7ff:fe9a:c078]) (Authenticated sender: morrowc@OPS-NETMAN.NET) by mailserver.ops-netman.net (Postfix) with ESMTPSA id A98C53203DD for ; Fri, 29 Jun 2012 02:36:06 +0000 (UTC) Message-ID: <4FED1492.3000805@ops-netman.net> Date: Thu, 28 Jun 2012 22:36:02 -0400 From: Chris Morrow User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 MIME-Version: 1.0 To: sidr@ietf.org References: <370492630.1340918800182.JavaMail.nobody@jva2wl006.webex.com> In-Reply-To: <370492630.1340918800182.JavaMail.nobody@jva2wl006.webex.com> X-Enigmail-Version: 1.4.2 X-Forwarded-Message-Id: <370492630.1340918800182.JavaMail.nobody@jva2wl006.webex.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: [sidr] WEBEX Details for 6/29/2012 Virtual Meeting invitation: SIDR virtual interim X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 02:36:12 -0000 -------- Original Message -------- Subject: (Forward to attendees) Meeting invitation: SIDR virtual interim Date: Thu, 28 Jun 2012 21:26:40 +0000 (GMT) From: Secure Inter-Domain Routing Working Group Reply-To: sidr-chairs@tools.ietf.org To: sidr-chairs@tools.ietf.org **** You can forward this email invitation to attendees **** Hello , Secure Inter-Domain Routing Working Group invites you to attend this online meeting. Topic: SIDR virtual interim Date: Friday, June 29, 2012 Time: 9:00 am, Eastern Daylight Time (New York, GMT-04:00) Meeting Number: 644 568 840 Meeting Password: interim29Jun ------------------------------------------------------- To join the online meeting (Now from mobile devices!) ------------------------------------------------------- 1. Go to https://ietf.webex.com/ietf/j.php?ED=155818382&UID=0&PW=NMDc3Mjc1ZGQ2&RT=MiMxMQ%3D%3D 2. If requested, enter your name and email address. 3. If a password is required, enter the meeting password: interim29Jun 4. Click "Join". To view in other time zones or languages, please click the link: https://ietf.webex.com/ietf/j.php?ED=155818382&UID=0&PW=NMDc3Mjc1ZGQ2&ORT=MiMxMQ%3D%3D ------------------------------------------------------- To join the audio conference only ------------------------------------------------------- Call-in toll number (US/Canada): +1-408-600-3600 Access code:644 568 840 ------------------------------------------------------- For assistance ------------------------------------------------------- 1. Go to https://ietf.webex.com/ietf/mc 2. On the left navigation bar, click "Support". You can contact me at: sidr-chairs@tools.ietf.org To add this meeting to your calendar program (for example Microsoft Outlook), click this link: https://ietf.webex.com/ietf/j.php?ED=155818382&UID=0&ICS=MI&LD=1&RD=2&ST=1&SHA2=R3KseNCHA1cujPFRU3xN24i/u1e4KW9rzHKty0nD9Sk=&RT=MiMxMQ%3D%3D The playback of UCF (Universal Communications Format) rich media files requires appropriate players. To view this type of rich media files in the meeting, please check whether you have the players installed on your computer by going to https://ietf.webex.com/ietf/systemdiagnosis.php. Sign up for a free trial of WebEx http://www.webex.com/go/mcemfreetrial http://www.webex.com CCP:+14086003600x644568840# IMPORTANT NOTICE: This WebEx service includes a feature that allows audio and any documents and other materials exchanged or viewed during the session to be recorded. By joining this session, you automatically consent to such recordings. If you do not consent to the recording, discuss your concerns with the meeting host prior to the start of the recording or do not join the session. Please note that any such recordings may be subject to discovery in the event of litigation. From Sandra.Murphy@sparta.com Fri Jun 29 05:55:10 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C8F621F8746 for ; Fri, 29 Jun 2012 05:55:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.485 X-Spam-Level: X-Spam-Status: No, score=-102.485 tagged_above=-999 required=5 tests=[AWL=0.114, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CHQGncIgMP09 for ; Fri, 29 Jun 2012 05:55:09 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 9C40921F867E for ; Fri, 29 Jun 2012 05:55:09 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5TCt7f4004417 for ; Fri, 29 Jun 2012 07:55:07 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5TCt0pv013031 for ; Fri, 29 Jun 2012 07:55:00 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Fri, 29 Jun 2012 08:54:35 -0400 From: "Murphy, Sandra" To: "sidr@ietf.org" Thread-Topic: chair slides and agenda for today Thread-Index: Ac1V9jnHpu+kEYwTTx2mmb0G7x59yA== Date: Fri, 29 Jun 2012 12:54:33 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E7A9@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: multipart/mixed; boundary="_002_24B20D14B2CD29478C8D5D6E9CBB29F625F2E7A9Hermescolumbiaa_" MIME-Version: 1.0 Subject: [sidr] chair slides and agenda for today X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 12:55:10 -0000 --_002_24B20D14B2CD29478C8D5D6E9CBB29F625F2E7A9Hermescolumbiaa_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Just in case people have not yet found the meeting materials page, here are= the chair slides.=0A= =0A= --Sandy, speaking as co-chair= --_002_24B20D14B2CD29478C8D5D6E9CBB29F625F2E7A9Hermescolumbiaa_ Content-Type: application/pdf; name="sidr.interim.29Jun2012.virtual.chairslides.v1.pdf" Content-Description: sidr.interim.29Jun2012.virtual.chairslides.v1.pdf Content-Disposition: attachment; filename="sidr.interim.29Jun2012.virtual.chairslides.v1.pdf"; size=11893; creation-date="Fri, 29 Jun 2012 12:53:48 GMT"; modification-date="Fri, 29 Jun 2012 12:53:48 GMT" Content-ID: <180391fe-5fae-4da5-8b8f-f45e238a5e55> Content-Transfer-Encoding: base64 JVBERi0xLjQKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nHVUy27bMBC86yt4JIN6u1wuH3st2gQJ0ENaoTkEPQSJ4z5itzHiQ/++S8qm jNS1IGGwj9nZEeVng+DJYL0O4H49PA8B0dR73VCqj6eByys8wW/DzZnZDN7Ua7vqvRxrOepjuxwe z4brAc2F3ivlLxDqrw08xvdr824c3n7KxjMgm/FRGzwg+pLNwpsFmsgMQiYLkBnXw609dxFIomS7 dQhUJGKy3xV6CT5nazSPmDhbch64EHsrziOgD/Eoe+UWQaV4trtW54vYzVRHonWajcQYK80+iL3Q 9xi5hafABGK/aDrmkvkgJ0k5Fvkyc+6mfrZ3k0YJ9skVyMTafTT7cpIrTdq+8KXHlj32rxV19tqV EL6OV0Mihui9Oj4+DCp+/NFM59emy950yqVmNADEk+2flTaVVEpQUQhREkX7XgWQMIr91JFxaquP Ym8UIGrVL815UbCtRRg82Z+OICCnKtdDxqIvadPKgk92dWgwfdKFNkhj26rhukyKNBPvDuC3q+vW 3QL9Z7cQGIqhEqHsV7vU7pBKM5kgh4xZTT7Elj3WTBbO0kQzk5BaHMBjzNJOlsesIj722Ny7PME8 s8xzV22BxJByVsUcQVJ9abfT6SpF+KhvVjSz7jrXXUdPjogq8UIi6MlhZU6AZWI+196UqJze8OEE 3x+3QP0qMyW2b/reswPUK6Uj0xVeHXXPajcnKskl4BxD0E+vZfVQ+46oefVh1L+a6+EvvHf+IWVu ZHN0cmVhbQplbmRvYmoKNiAwIG9iago1NTcKZW5kb2JqCjEwIDAgb2JqCjw8L0xlbmd0aCAxMSAw IFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nO1bS3PjNhK+61ew9iRORQzx4mNvM9k4 NamtrY3XlRySHGRZsp3YsjMa5/HvFyCB7gbQJOUkm9NmaqYYEs9+fP11A/qpqCshi9r9CQ+7x9VP K1XXhfv7ODw17p+Hle6S5/HxbvXNm+K4EoX78+EW+mrjmtf2nw/71eHN6qtVXXxh/97a8btKuf+G Cenz7rF4d7X69LIthK5qXVwdbAdR1bXo2mIjik1dGK2rXhZtX8ni6nH17fqiNJXsTd+uP5R1Jbve 1M363j6KXom2XRf2e103ul3LUlS6k1qs+1LUVS2UIV+/LDfKLkXo9cvQTnT9+ji2k71tZ78aqWvj hvEva2go4J0sN0IqLat+/bX9bNqu1WE5Td/RRX7EMV/G/nq9HdfYq/VD2VWt1LY3mfv9uNx+WJpv +BHe7eFdLgo392PZKfX91ZerRurKCGElfnWzsku++mEQuk6F3nuhi9ouoClkr0eZ/8tOZP+n7tdP 9kn00thV1JXpG/u0D68KePVNqex49NuDfWjrzurioZRSukV9emlNcFLvVllFY1914wre2l6VNtoJ YiPtZvtWrH8rZVvVrTEgMtOuT6D1F7CUa3h6dOtohVMRCPkEaj2BWsnnp6FzM0wtVNXJ1lAVfbR6 62RtQsPWKP7zHYyz58zsPT5+DoZ0BTNeQO/RhHW0RlzZR7QENI8jdL6Bhvtggjdk5GFAMUjMPlq7 tuv+rVSmamor72hbME20Lz8hafmZ/ax6qSI5hieUzgfXQ8vO2grZ1zUs96V0NqOMVV/nDfnbTPZu SDJQAZ5ywOXSlqYStezoap/h6ws84SIesOH9MLbs1HoHu94GkY7SabXd9T2sYZxYW8P02jKarBCB 4BRGIcuCkckKHqBvkRqrm4TfXZh4S6AD5DWIU3S6iUcMfQ64K27ddFdnWbVteQHLLawvd07Fm6Dj jcUG2Y2Kfo/+fQRfRu3vwef9btpWgk+Qr95qtQ0EG7SIfwQLBZFtAREOMAex+Fw6rYntDr5fuu92 bEUcGDwiVjDEoNxXOUs4jh7aNIr30BMJGLDyLfcSkGAER6k1Cx0objILdsGhb1Kga9zC7F6M6ta/ 2Hhpt9+1hrgGBcmw5wjdBt/XfVXLNvh+QXrzWJR5EXoqqo3uL5fIr0Reye47Kf+wb4SG1DUGh7CC oq6Ra38XL2xwWiKxn0M7KuNNV0mtGsnbSxYQExynwsuBDLuQcW7g856Dmz2xmDlAPHIg4Y3BgYRo Rov4W6mrtpeW+BC4SEXrgAMpJOEN3is76ffnPrNhFVAiilMYNpgu9xxgHIEu+IVbFVbYkIj+P7AH HH0HgHHHwQQyGRKLtow1oxJ472d2cyJezZnPkS4yC1svBN/mnJWJ01wURIM5eZRQVaPanCEkwTlh SK/dPLXUaOsJS7PoPBECg01fMLYPk+BiTmXGDzKOOuWSnxCmMMs3cozeo8hDT5Z3gHQpduTDEd+J 0XuwT4SyTAkmpUMZNlAM8RAxWgLlEUgFHiARxHc7QhQSXuoIRY4LoAKLHzuO1KOXojlDCgIPLwwm 3EeD+JGRJeACFzIVTG7iqF1XKs4/572R857UmEwtAys5J2+4j9aTed88FOSkNqbnTKDc+wzCpsKq CfjwCYck1mCbqjNuQspHwmcckoVeSq39aumuxrRBhmYq4OBowxl7n0WAfaK9MUYynoX48PdSKVn1 vQ+jqqv6xhQb+87l4U4kb4apbSsaHTF43sHTnqmqzEReJ84LTmCsAve0KOM/o/lbrxSisqsA8ovR yNo1sXoc58Q8Zc5jtHPCRggnHotaveUW/1xdvflfiAXD+heui6ybhrfHheR2C/gQed9YG6FSAcBB ocCra+r+9mPdTaU0Ed0m1QSW4I12iqTnsJBFjQDYmcjDr5lpkOlv8xC1NMuBS2UW9lV4eiEsiYYC BEfhqVpboKtjt41ohpJW5mfC+p8xzfptqerK7n/QpTXxtmkm6lyLnpZUdRBnAfZHD8jjOr5DPnOb MJuuVnk5xHOXLEZRAsJ0wVl8qBP9FGNks0Nc42x9ji9UhUW8x+LXEnKhxCb3n6aMDFf8OBqU3bCV VjAo7L1nyO6BlSiXMREc2EjVWvY1hDWpql50bBHsR4ZWIru65WjYLQlX4PQYal6gzzOXy86Xqrjc kWO+uAaWKXKUEuWEPIh0eeCUdYr5zxBUWaue39VS9WYEC9k4fUXEFblnVu3wMQcKYIgqIfog1yV8 FevknJ0SBEX3y/xU9jGhywPWkeFPSHIpqDDujp0jcgocAOTrC+IzmVYKibnP4LSg62cIRjkbj+3S QrcnDKatneZG5vDXwnySbjUTVfEfuUOODES7Jvf0ZCAcHROYCU9ni6RBB1hzZ9dLUx3OwHKlDjbZ C9N1LOYz3BrHO1h+PJyZ/RmcD9U9nl7p9bsyr/1O0Du2NhwESendOIvIsqhZfudZdDJdE2d4y/wu q6ceGDDhtZXSu75ZondMHJygd0yOulQlJjwgCPQtUL4eEsZ3ZTseX278+0lKd669QMPLYBvzRwUI AzcMuJJtLp1N4HklF6pecXAZA7vGg5aolk4WccwVMHU0E45PSG/EbPZ0hjs/mwhncTE15mwTdRWf Gm4A6pVw9xMG9eMh9QNqlTyeB+tLFWrFhtdXFKjzA50UWJ1NoI5oCSmOmwmIUPPI04EXsA7M535I E36ngx3axHya9sTzfQL+XBoXVkYWjvErq0BMnchOoM0AGNLytuGGy2AVrFsHs8blGJhOwVMbJu6Y 9adFUPbIsLHiHhcQnyl9Bu/InlSYrs9X0DMr+G6NZBi1ixQAOXx67jh0SW4gJKThmmfI8J3uClqy 29IweRdmbOEV7uu7EnKFCs+ZvC5pgQwT/PxkNaLTyMp9GO4leTd3vCCX0vasWhs5HXox9XZmkvyw rqWlt+niSXpLIDvqjBLlRWI+fYJlefHrDkFiWGRztOjQOj0njZJ6wo/DiLe+jGztQYr8MPqc7PHM SwQ5fZqhZrUSfO8D56OYK/MHydydlfDEipS49R3r9bzNZMxg4tg+Y4DQjqm2owo8Sx5rw4HV4U5w d2T59CLKqGN6xkwS6PmLKPg1OBb5eEPC+yxxi/BwzuPZVA4L6y8ACOz5zdLcXAbyx7wb1cZEe/4i A7E1d5PBwjw9Y4oK5+fnrbmols6dQoQ3vQze/+exS4Qt5hiAvbO1LzeytUIXFHkpYjCO94pLWWFu DKwcJBD3mb3HZzTBIPbiyvxB9oS9z9b97mBEjgTO32qJyYpv+GtksF62g1WoppICYgIOSCNmAJem qSsL2lGRjy3t3UNBASt2WGRAmKEVwtTKouNphA+gOZ7cjAdd/waTIKkLYtcWUldcD5vO7uAll//T vIAh3yz1J0w6dBntUqlI+QbGVrDXFt51HMVK798R+tpOrYFJ0oNZ8Uzan5H3bIJ65k1W5pg+ZqEZ XGI4REdCzY/Z66h5zF+JGp/BrpDikksRzIH+qHvfFM0Xy3xcOGHjEkvAzquMxbeTXlEZZgbHWxxL l+2SGKWFmchelm7bpWzc2c38bSXWWrkL0lxAgSC880gmKjyTwjme59W1dEv59xKGJj5hmsrW8wtI OY1lkxfMWCOWkFNkpiTwO25ZESXnTBQ0gYFy1Hat+GtRbIy64WJiegKTJNzvIMQTWYYCqJDxpfs0 mrWyUrWMohleqMQfYhDgII8ca84DgIUVDE1xOdDjeeKnKdGKQiBeBcm49CXEFAbj2ftUM7e3jV4y /OwaiImMk1YbyF1GjwlTlxndsaYykcHkZT8uHlAm8P948JfFgwiK/ROcyOOlmCenEWW6hl6qRIhN 74PFlyLmC5psbWHrw4H7aVqT36lduOLJhKGJnyfNlmvSM1pdt/xNkCcO9baxFONrdkWkta5y178Q JrFdelIYJ0fskRgAOb0RAO1w6Jnicvq7AlrA8vcWAKpxYtYm6U2OuZkx1mzLjfUba+aCuaHgDYLC Pf7GDuGcwEbAJIIaN7RHnj9wzpz9Vo1IQ+qw5l6Y+FpgKP1cQxmE1jjzM42fmRu3bIUQY881iJVz x/NLLVMlvkxTeDmB/6Uag5lgktHPDDzyf361+sr++S+J8GzcZW5kc3RyZWFtCmVuZG9iagoxMSAw IG9iagozMDgyCmVuZG9iagoxNSAwIG9iago8PC9MZW5ndGggMTYgMCBSL0ZpbHRlciAvRmxhdGVE ZWNvZGU+PgpzdHJlYW0KeJzFWVtvWzcMfvevOI/nFLMi6q487dYVKzAM7Yztod1DEjtOuzhtnXbb H9l+7yjpSJR9lEvnoEkQg5BEiSI/fqScDx1nIDoefrNwtpl9mEnOu/C3iZIJH5cz5fbkJF7MfnvS Xc2gC7/bddFVOizn+LFdzc6fzF7MePcM/9a4v2My/MQDa/ls0327mB29tB0oxlW3OEcFYJyDs90c ujnvtFLMi856JrrFZvaq/2HQTHjtbb8dOBPOa276NyiCl2Bt3+E850bZXgzAlBMKej8AZxykrmaf D3OJpoDqP8V14Hx/ldYJj+twVgvFddhmHORlIZQxMcxBSCWY73/FaW2dVdkc411t5Efa81PSV/1J stHL/nJwzAqF2tXZPyZzfTRtXPixjK3K2NQV4ezN4KT8ffF8ZoRiGgA9vljOejks3kanS8+8qZ3u R6cDWNw4hJUJldz+chDMSMdVOtUL7vrrYc6Z1gbQne/QD0xzLQxerojRLq88qp1Vi+stgn3BGFGH vxjiTDCEov/PMLdWMGdF/3PcUCgNwTsC8eO9RjcKpsDg1m+GucB4KDyPpldF6oKVyqLHvhkkE9qi Q9dBxaPjg2+LGLXxPqZfJm0Z4pYl2ofGrpIyiEqD1v1SzrskEytrl+W8VdG+Rkd6pUd4TA78WMaO B2Fd8KnUDBMCHSkxGCYG/t8Q+KeLmJqcGQ7aSBJePmsOb++XwM3wCXAhrUFaZk0K4EUJANlM0vsy e4xOwsh61R9VUl73F45JA1o3JTbMETYGIGRihsOq4azzIrEivSvrtmFMGu0EAiMPHu3burvw3WAZ l945xHuJ2KoR0GWByBSnOL1uRZ7O3tHJG6V7GS/ry462WZ59YZG0NiF1lMD45k2jlihavEhQJLHn g6hCC028JFjX3tFX2gGeWnGGhJUo6VV9SzJzWd1CJiaL6AUnHXIUEgOoTjnpY8k5AKbKhhSpYToJ M0JydKVRMoMEB/fDvMcyS6IRgiKFrBlmwuJFA7Nj7LhUJpCdEMUtyKequAW0S5X4s8pw2z021okm Cf80WuMx7U7KrSt43sHH6wYf77Bi1q78U5NdlrpMe1+S3iTXzKG3ucmeGQNm1BdlN+MrxB3Ibtma GmZUZ6aBhX5OG520dq8y5KIivRzYPycJJHd9gZLB3sZX06ctKrqTQgoRVkq0sq7ZWaIT/x5COTVc jL6MyvvpGQc3id6kYoDYGOktJmqADiWrtog1pyOFaSySD5OrEjlMqXauPk8OstZXqXpaSVXz0+A8 StAmEZJUQ4eA3lXSY+RqcowwkPwyQUvA4gQtAb9fY7OKvSp2mW8J/ScFI6cNVE7Kb9iHkvCwpkRi Oigbsha7acITtvrYb9kIKLDKPxSgjA9PxSagnqZG1rjKeurvmiAiCiQIjl63j07n6aoCTHwW3btb xajczufrFhwo9NT1EX/ukOYUVqxhDWGEJKq+zf6iBiJ1keHxCXDP+hH4dF2a3mPiQWr4eEOitrIi 4/etwavGtZqd7nhDRON8KNCR3Ft8RfLYE0mr7YGtovTx64iq5Ndt3RQszSQglVQsLDCHb+tcLOa0 UhAn87IT0KDIqVMV4fsxm5G+VlKVyyQmwViZwDxYF6mEYTc0kd+V3uaCrnbS8twdju32U3OHZ9aN Z9gjU05yitCeuR3CiRjPRPL5hFO3jaV92ukgH6QSVQ1kJgCy5pa3S3x3XpbOq+qomrQ36SoD59z1 2J08mz+jR0y5QQmBJS5UhZgRUmh9IIcojV3EDoecUWd20QDu/RNg8nSMZEQ9vcJ3rtd+7+EoraeM 5/l+h2e8U4zf8OXd9wWMlfV0Y0IeXbiK3fHj9pLjxcBhK5bTFhNAoe039Al59riRrEeNRD+wlt+e yvm4e3/TRczRmk3W4CNU3FRvDJPo8nDTOlgqIA205AF2QkrxP2DH9/5rkCOkMbeMqlPsdR+ZEMEP MSO4BQjfWhsGCg9HiTNMcbwlOppjPQaDo9ehHnGlhIvvF2556FLKypOivqbBFYnd4FHb6vAyvmV7 qfV4vsIsHE9CzyCswv5gRvU4e42zXopY7fK6tCX3PP3rYRSvSOkPusfOlYJ5TgSOyFKyw0ilqv2X 2Y7t6EStapPOy0LapzrmqzJNO8a6BA4iaAxz0hpRW1ldo6X+lqYrO073RYn1dYxHvNEWCVC4EPgu 0jvyP3MImrHxounKC5W4GRwTgOVrtIlzO/rQWF+fkwAmsOiepSuJ+P7LK18PO19nvpj9B4ZwpoVl bmRzdHJlYW0KZW5kb2JqCjE2IDAgb2JqCjE2OTQKZW5kb2JqCjE5IDAgb2JqCjw8L0xlbmd0aCAy MCAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nH1UTW8TQQy9z6+Y42ylDLbH8+Fj KwGigkNhVQ6IQ5q2aaGJ1LTln/B/8exmPxoCWe3KGvs9v3m28mjBI1mozxCsNubRBABb300Xpfp5 MFwO4j68M19P7Nagrc9uPWI51nLQz+7G3J6YCwP2vb5r5S8+1F/XcB6vNvasNW8+Z4vsgW17qwD0 AFiyXaBdgI3MXshm8WTbjfnm3jXRk0TJbteApyIRkrvXECVgzs5qHiBxdtSg50KMThoEDxjiLHve LIJKQXYvXR0Wcdu+jkTrNBuJIVaa/SGMhTieUbNACkxe3KWmYy6ZBzlJylzk88T50uPZLXuNEtxD U3wmVvSs94dernTS9oXP49nNePa3FbX3pikhfG/PTSL2EVEdb6+N46b90ZnOh6bL3nREqRnKOLh+ qqyppBjRXWtXFIpKrzIhZ9Ge6DMUdXo7JO/VF70hErunZgGekaVEFQ8+StKCnaKFSCc2oX815ANw SgMcYlaL6hWq3kD/0ivJl9mO/G4WLCoExJ3VoRRh9VfNYuKk5pPPIUNWA4fIajakEtl9GQB3h2Ux zADPPUCn8NTo5leJHL0k23407ckrCZ/0pvUmvU+9hu1I9HJIqRqmNp13QpkSd7uLkMqs93Is/Dkr nOBqcr8BnDyUI9rO9zAIaUZ2dSSak+rehABx5tqTZguiW/V8qcB+9SWU/Yj14kKvCP9n2ukwhvUR BZN712O0PDLLq3Fwy6OOTiOeBE7c607g21b/yi7MHxoyFallbmRzdHJlYW0KZW5kb2JqCjIwIDAg b2JqCjU3MAplbmRvYmoKMjMgMCBvYmoKPDwvTGVuZ3RoIDI0IDAgUi9GaWx0ZXIgL0ZsYXRlRGVj b2RlPj4Kc3RyZWFtCnic7VfJbhtHEL3PV/RxRsC0e19ycxA7iBEgsEDYB8MHhqIkRyIli6ZgfUj+ N9WzvhF7JCWGDRsIByQKPbW+etXd/MgEl4qJ9PTCalN8LLQQLH03jeTSz2Vhwj25Fc+Lt0dsW0iW npuzwdbYpC7o52ZdnB4VrwvBfqXvGfkPXKdPExDl1Yb9vCieHXsmDReGLU7JQHIhZPCslqwWzBrD o2I+csUWm+Jd+bKyXEUbfXlTCa5CtMKVH0iUUUvvS0bvhXDGl6qS3ARlZBkrKbiQ2sLbV1WtKRVp yn2jJ0Mst62eiqRHb60ywiY33aIYFOWwpqpaKm0Uj+Ubem198KZPx8WASX4afe5be1Mu2xyjLi+r wL0yZA2xf2vTjU1qneKnYW09rB1CkWJvqqD1+8WrwinDrZSE+OKkKG21+KsB3dwHPXagSxnTG61E o5Bgf05uXXDWyvKMwsqobBO/Eba9cNILyyrFTUGU59Flg1jPNXb2b4JSOyqdgK4FD8EGpah3oywy ciQUa7LkUksb75taLl20jho2iKjBkmwM8clThZoLJbSnKkaNDVUUrXEJWFr11ggizxY0PiTXZOZD uWvyiN6E1OzkWdND3RnSQye3ozYuLytrXUJPa07A/V4sjp6CjXwcm3sqAMgD2DQV/FIpmhWl5CRT KHc1invwARq7BG9wagrkFShvZ4Kjzims/wQyq5QPCTQveXCG1cqRSaL7u0k7oRXLQ7cqStl3ruEE gHc3ljJy4k/wcdEpaIVmEPA6owy91+QPDM9ms+6bhXhhjRhnmfeynoEdWdvxOgTdq9D8hyGv/Nw1 Kihz8IjeP7cAOJM2tK53dd88Yr5XbfNG4ucI/sRNAU3lj0981Ok6abyf+kesz8HPGnoDhPj689Mn R6vIPszzdGKpubSK+rjLb5PZrCxGvJ6B73N2UG+HNmFhlxBxLvpyppy+zMNJ6VnnoBnY1CWs4+yd zOjvxmHC/q7G5X2+7V1JVsRp6nej5cCMWum06/mGG9613AD6zzEaVNZ5JqE2dBsrnOHdzFBiHOzU UAuW0tP8Dxp1KpguicfN5aV71Z6/x8M+gGXuDzvfjMBMnQxULibZ9oS4y3MdAcJz4VkeoRniXeQB +oKY1/k6r4BstyOTkGy7/DJaIvGRCqg/3RU1D0ak86QTzsHDesYb5IfBYXRwGC8hdn4wejY94RBG xsDuuDrsB63O+duO5MEBnhmjmUwev6Cu+0tpbeg+L6J+wiH92IH9wCGtfvxD+tveTr/96YpXX9wf rvMAY1Z9O6YH8NUjTqbayAU7kBMukO4haqr/Tk39PzW/d2pe5fNGJ8hY+AO/zff/31ET2eJyt48X i+I1Pf8ApLgB1WVuZHN0cmVhbQplbmRvYmoKMjQgMCBvYmoKMTAyMwplbmRvYmoKNCAwIG9iago8 PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA2MTIgNzkyXQovUm90YXRlIDkwL1BhcmVudCAzIDAg UgovUmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRm9udCA4IDAgUgo+PgovQ29udGVu dHMgNSAwIFIKPj4KZW5kb2JqCjkgMCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94IFswIDAgNjEy IDc5Ml0KL1JvdGF0ZSA5MC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAv VGV4dF0KL0ZvbnQgMTMgMCBSCj4+Ci9Db250ZW50cyAxMCAwIFIKPj4KZW5kb2JqCjE0IDAgb2Jq Cjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDYxMiA3OTJdCi9Sb3RhdGUgOTAvUGFyZW50IDMg MCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9Gb250IDE3IDAgUgo+PgovQ29u dGVudHMgMTUgMCBSCj4+CmVuZG9iagoxOCAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAg MCA2MTIgNzkyXQovUm90YXRlIDkwL1BhcmVudCAzIDAgUgovUmVzb3VyY2VzPDwvUHJvY1NldFsv UERGIC9UZXh0XQovRm9udCAyMSAwIFIKPj4KL0NvbnRlbnRzIDE5IDAgUgo+PgplbmRvYmoKMjIg MCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94IFswIDAgNjEyIDc5Ml0KL1JvdGF0ZSA5MC9QYXJl bnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0ZvbnQgMjUgMCBSCj4+ Ci9Db250ZW50cyAyMyAwIFIKPj4KZW5kb2JqCjMgMCBvYmoKPDwgL1R5cGUgL1BhZ2VzIC9LaWRz IFsKNCAwIFIKOSAwIFIKMTQgMCBSCjE4IDAgUgoyMiAwIFIKXSAvQ291bnQgNQo+PgplbmRvYmoK MSAwIG9iago8PC9UeXBlIC9DYXRhbG9nIC9QYWdlcyAzIDAgUgovTWV0YWRhdGEgMjcgMCBSCj4+ CmVuZG9iago4IDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5kb2JqCjEzIDAgb2JqCjw8L1IxMgoxMiAw IFIvUjcKNyAwIFI+PgplbmRvYmoKMTcgMCBvYmoKPDwvUjcKNyAwIFI+PgplbmRvYmoKMjEgMCBv YmoKPDwvUjcKNyAwIFI+PgplbmRvYmoKMjUgMCBvYmoKPDwvUjcKNyAwIFI+PgplbmRvYmoKMTIg MCBvYmoKPDwvQmFzZUZvbnQvSGVsdmV0aWNhLUJvbGQvVHlwZS9Gb250Ci9TdWJ0eXBlL1R5cGUx Pj4KZW5kb2JqCjcgMCBvYmoKPDwvQmFzZUZvbnQvSGVsdmV0aWNhL1R5cGUvRm9udAovRW5jb2Rp bmcgMjYgMCBSL1N1YnR5cGUvVHlwZTE+PgplbmRvYmoKMjYgMCBvYmoKPDwvVHlwZS9FbmNvZGlu Zy9EaWZmZXJlbmNlc1sKMTQ5L2J1bGxldC9lbmRhc2hdPj4KZW5kb2JqCjI3IDAgb2JqCjw8L1R5 cGUvTWV0YWRhdGEKL1N1YnR5cGUvWE1ML0xlbmd0aCAxODgyPj5zdHJlYW0KPD94cGFja2V0IGJl Z2luPSfvu78nIGlkPSdXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQnPz4KPD9hZG9iZS14YXAtZmls dGVycyBlc2M9IkNSTEYiPz4KPHg6eG1wbWV0YSB4bWxuczp4PSdhZG9iZTpuczptZXRhLycgeDp4 bXB0az0nWE1QIHRvb2xraXQgMi45LjEtMTMsIGZyYW1ld29yayAxLjYnPgo8cmRmOlJERiB4bWxu czpyZGY9J2h0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMnIHhtbG5z OmlYPSdodHRwOi8vbnMuYWRvYmUuY29tL2lYLzEuMC8nPgo8cmRmOkRlc2NyaXB0aW9uIHJkZjph Ym91dD0nY2ZjMjJhY2YtYzQ0NC0xMWUxLTAwMDAtOTEwZTA4ZjFkZGNjJyB4bWxuczpwZGY9J2h0 dHA6Ly9ucy5hZG9iZS5jb20vcGRmLzEuMy8nPjxwZGY6UHJvZHVjZXI+R1BMIEdob3N0c2NyaXB0 IDguNzA8L3BkZjpQcm9kdWNlcj4KPHBkZjpLZXl3b3Jkcz4oKTwvcGRmOktleXdvcmRzPgo8L3Jk ZjpEZXNjcmlwdGlvbj4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9J2NmYzIyYWNmLWM0NDQt MTFlMS0wMDAwLTkxMGUwOGYxZGRjYycgeG1sbnM6eG1wPSdodHRwOi8vbnMuYWRvYmUuY29tL3hh cC8xLjAvJz48eG1wOk1vZGlmeURhdGU+MjAxMi0wNi0yOVQwODo1MjoyNy0wNDowMDwveG1wOk1v ZGlmeURhdGU+Cjx4bXA6Q3JlYXRlRGF0ZT4yMDEyLTA2LTI5VDA4OjUyOjI3LTA0OjAwPC94bXA6 Q3JlYXRlRGF0ZT4KPHhtcDpDcmVhdG9yVG9vbD5cMzc2XDM3N1wwMDBQXDAwMERcMDAwRlwwMDBD XDAwMHJcMDAwZVwwMDBhXDAwMHRcMDAwb1wwMDByXDAwMCBcMDAwVlwwMDBlXDAwMHJcMDAwc1ww MDBpXDAwMG9cMDAwblwwMDAgXDAwMDBcMDAwLlwwMDA5XDAwMC5cMDAwOTwveG1wOkNyZWF0b3JU b29sPjwvcmRmOkRlc2NyaXB0aW9uPgo8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0nY2ZjMjJh Y2YtYzQ0NC0xMWUxLTAwMDAtOTEwZTA4ZjFkZGNjJyB4bWxuczp4YXBNTT0naHR0cDovL25zLmFk b2JlLmNvbS94YXAvMS4wL21tLycgeGFwTU06RG9jdW1lbnRJRD0nY2ZjMjJhY2YtYzQ0NC0xMWUx LTAwMDAtOTEwZTA4ZjFkZGNjJy8+CjxyZGY6RGVzY3JpcHRpb24gcmRmOmFib3V0PSdjZmMyMmFj Zi1jNDQ0LTExZTEtMDAwMC05MTBlMDhmMWRkY2MnIHhtbG5zOmRjPSdodHRwOi8vcHVybC5vcmcv ZGMvZWxlbWVudHMvMS4xLycgZGM6Zm9ybWF0PSdhcHBsaWNhdGlvbi9wZGYnPjxkYzp0aXRsZT48 cmRmOkFsdD48cmRmOmxpIHhtbDpsYW5nPSd4LWRlZmF1bHQnPlwzNzZcMzc3XDAwMHNcMDAwaVww MDBkXDAwMHJcMDAwLlwwMDBpXDAwMG5cMDAwdFwwMDBlXDAwMHJcMDAwaVwwMDBtXDAwMC5cMDAw MlwwMDA5XDAwMEpcMDAwdVwwMDBuXDAwMDJcMDAwMFwwMDAxXDAwMDJcMDAwLlwwMDB2XDAwMGlc MDAwclwwMDB0XDAwMHVcMDAwYVwwMDBsXDAwMC5cMDAwY1wwMDBoXDAwMGFcMDAwaVwwMDByXDAw MHNcMDAwbFwwMDBpXDAwMGRcMDAwZVwwMDBzXDAwMC5cMDAwdlwwMDAxPC9yZGY6bGk+PC9yZGY6 QWx0PjwvZGM6dGl0bGU+PGRjOmNyZWF0b3I+PHJkZjpTZXE+PHJkZjpsaT5cMzc2XDM3N1wwMDBz XDAwMGFcMDAwblwwMDBkXDAwMHk8L3JkZjpsaT48L3JkZjpTZXE+PC9kYzpjcmVhdG9yPjxkYzpk ZXNjcmlwdGlvbj48cmRmOlNlcT48cmRmOmxpPigpPC9yZGY6bGk+PC9yZGY6U2VxPjwvZGM6ZGVz Y3JpcHRpb24+PC9yZGY6RGVzY3JpcHRpb24+CjwvcmRmOlJERj4KPC94OnhtcG1ldGE+CiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKPD94cGFja2V0IGVuZD0ndyc/PgplbmRzdHJlYW0K ZW5kb2JqCjIgMCBvYmoKPDwvUHJvZHVjZXIoR1BMIEdob3N0c2NyaXB0IDguNzApCi9DcmVhdGlv bkRhdGUoRDoyMDEyMDYyOTA4NTIyNy0wNCcwMCcpCi9Nb2REYXRlKEQ6MjAxMjA2MjkwODUyMjct MDQnMDAnKQovVGl0bGUoXDM3NlwzNzdcMDAwc1wwMDBpXDAwMGRcMDAwclwwMDAuXDAwMGlcMDAw blwwMDB0XDAwMGVcMDAwclwwMDBpXDAwMG1cMDAwLlwwMDAyXDAwMDlcMDAwSlwwMDB1XDAwMG5c MDAwMlwwMDAwXDAwMDFcMDAwMlwwMDAuXDAwMHZcMDAwaVwwMDByXDAwMHRcMDAwdVwwMDBhXDAw MGxcMDAwLlwwMDBjXDAwMGhcMDAwYVwwMDBpXDAwMHJcMDAwc1wwMDBsXDAwMGlcMDAwZFwwMDBl XDAwMHNcMDAwLlwwMDB2XDAwMDEpCi9DcmVhdG9yKFwzNzZcMzc3XDAwMFBcMDAwRFwwMDBGXDAw MENcMDAwclwwMDBlXDAwMGFcMDAwdFwwMDBvXDAwMHJcMDAwIFwwMDBWXDAwMGVcMDAwclwwMDBz XDAwMGlcMDAwb1wwMDBuXDAwMCBcMDAwMFwwMDAuXDAwMDlcMDAwLlwwMDA5KQovQXV0aG9yKFwz NzZcMzc3XDAwMHNcMDAwYVwwMDBuXDAwMGRcMDAweSkKL0tleXdvcmRzKCkKL1N1YmplY3QoKT4+ ZW5kb2JqCnhyZWYKMCAyOAowMDAwMDAwMDAwIDY1NTM1IGYgCjAwMDAwMDgyMDggMDAwMDAgbiAK MDAwMDAxMDYwOSAwMDAwMCBuIAowMDAwMDA4MTIyIDAwMDAwIG4gCjAwMDAwMDc0MDEgMDAwMDAg biAKMDAwMDAwMDAxNSAwMDAwMCBuIAowMDAwMDAwNjQyIDAwMDAwIG4gCjAwMDAwMDg1MDMgMDAw MDAgbiAKMDAwMDAwODI3MyAwMDAwMCBuIAowMDAwMDA3NTQzIDAwMDAwIG4gCjAwMDAwMDA2NjEg MDAwMDAgbiAKMDAwMDAwMzgxNSAwMDAwMCBuIAowMDAwMDA4NDMzIDAwMDAwIG4gCjAwMDAwMDgz MDIgMDAwMDAgbiAKMDAwMDAwNzY4NyAwMDAwMCBuIAowMDAwMDAzODM2IDAwMDAwIG4gCjAwMDAw MDU2MDIgMDAwMDAgbiAKMDAwMDAwODM0MyAwMDAwMCBuIAowMDAwMDA3ODMyIDAwMDAwIG4gCjAw MDAwMDU2MjMgMDAwMDAgbiAKMDAwMDAwNjI2NSAwMDAwMCBuIAowMDAwMDA4MzczIDAwMDAwIG4g CjAwMDAwMDc5NzcgMDAwMDAgbiAKMDAwMDAwNjI4NSAwMDAwMCBuIAowMDAwMDA3MzgwIDAwMDAw IG4gCjAwMDAwMDg0MDMgMDAwMDAgbiAKMDAwMDAwODU4MyAwMDAwMCBuIAowMDAwMDA4NjUwIDAw MDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgMjggL1Jvb3QgMSAwIFIgL0luZm8gMiAwIFIKL0lEIFs8 REM4Q0I2NTAwMzk4NDkyMUE5Q0E5MTA0QzVBOTdGMTI+PERDOENCNjUwMDM5ODQ5MjFBOUNBOTEw NEM1QTk3RjEyPl0KPj4Kc3RhcnR4cmVmCjExMTc5CiUlRU9GCg== --_002_24B20D14B2CD29478C8D5D6E9CBB29F625F2E7A9Hermescolumbiaa_-- From randy@psg.com Fri Jun 29 06:51:13 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3205321F86FE for ; Fri, 29 Jun 2012 06:51:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.584 X-Spam-Level: X-Spam-Status: No, score=-2.584 tagged_above=-999 required=5 tests=[AWL=0.015, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IrwWJbpS48mT for ; Fri, 29 Jun 2012 06:51:12 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 14D5B21F86CA for ; Fri, 29 Jun 2012 06:51:12 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SkbbK-000Cns-Fv; Fri, 29 Jun 2012 13:51:10 +0000 Date: Fri, 29 Jun 2012 03:51:09 -1000 Message-ID: From: Randy Bush To: Tim Bruijnzeels In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 13:51:13 -0000 > With inconsistencies I did not mean that the validated cache is out of date, which I agree, will always be there even if it could be minimised. > > The inconsistencies I refer to are different in nature. It's that the snapshot that the RP tool got when it validated is in itself inconsistent: surplus or missing ROAs, or the hash of 1 or more ROAs doesn't match. Longer discussion omitted, but at this point the RP just doesn't know for certain what to do and guidance is needed. This is where *explicitly* stating a strong requirement, rather than leaving it implicit, in pfx-validate comes in.. would you like us to pull in the crucial paragraph from sec 6 of origin-ops? Like the DNS, the global RPKI presents only a loosely consistent view, depending on timing, updating, fetching, etc. Thus, one cache or router may have different data about a particular prefix than another cache or router. There is no 'fix' for this, it is the nature of distributed data with distributed caches. randy From wesley.george@twcable.com Fri Jun 29 07:32:03 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50E8721F8754 for ; Fri, 29 Jun 2012 07:32:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.69 X-Spam-Level: X-Spam-Status: No, score=-0.69 tagged_above=-999 required=5 tests=[AWL=-0.227, BAYES_00=-2.599, HELO_EQ_MODEMCABLE=0.768, HOST_EQ_MODEMCABLE=1.368] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ebAgjXxofCHX for ; Fri, 29 Jun 2012 07:32:01 -0700 (PDT) Received: from cdpipgw02.twcable.com (cdpipgw02.twcable.com [165.237.59.23]) by ietfa.amsl.com (Postfix) with ESMTP id F0BE721F86E3 for ; Fri, 29 Jun 2012 07:31:59 -0700 (PDT) X-SENDER-IP: 10.136.163.13 X-SENDER-REPUTATION: None X-IronPort-AV: E=Sophos;i="4.77,498,1336363200"; d="scan'208";a="386052400" Received: from unknown (HELO PRVPEXHUB04.corp.twcable.com) ([10.136.163.13]) by cdpipgw02.twcable.com with ESMTP/TLS/RC4-MD5; 29 Jun 2012 10:20:52 -0400 Received: from PRVPEXVS03.corp.twcable.com ([10.136.163.27]) by PRVPEXHUB04.corp.twcable.com ([10.136.163.13]) with mapi; Fri, 29 Jun 2012 10:20:53 -0400 From: "George, Wes" To: "Murphy, Sandra" , "sidr wg list (sidr@ietf.org)" Date: Fri, 29 Jun 2012 10:20:52 -0400 Thread-Topic: AS Migration and aliasing Thread-Index: Ac1VbE964Tl5GD4nQX6M/ASwsnhZ3AAD9AuLACGIg8A= Message-ID: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E6D7@Hermes.columbia.ads.sparta.com> In-Reply-To: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E6D7@Hermes.columbia.ads.sparta.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] AS Migration and aliasing X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 14:32:03 -0000 I unfortunately won't be attending much of today's interim if at all - $day= _job calls... Thanks, Wes > -----Original Message----- > From: Murphy, Sandra [mailto:Sandra.Murphy@sparta.com] > Sent: Thursday, June 28, 2012 6:20 PM > To: George, Wes; sidr wg list (sidr@ietf.org) > Subject: RE: AS Migration and aliasing > > Lots of stuff to consider here! > > Last minute, but would you like to fit this into the interim meeting > tomorrow? > > --Sandy, speaking as co-chair > ________________________________________ > From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of George, > Wes [wesley.george@twcable.com] > Sent: Thursday, June 28, 2012 4:27 PM > To: sidr wg list (sidr@ietf.org) > Subject: [sidr] AS Migration and aliasing > > During the last SIDR Interim, we talked about BGP Aliasing as a means to > migrate from one ASN to another. I proxied some concerns from Shane > Amante and others who weren't present, but I ended up being the stuckee > to write up the requirements/use case so that we can make sure that it's > being appropriately addressed. Shane and I have worked to put together > the below. If it's helpful to put this in draft form, we're happy to do > so, or the relevant bits of text can be incorporated into existing > drafts, or whatever. I figured the main thing was that I needed to get > this out of my edit buffer and in front of the right people without any > additional delay so that we can discuss it further as necessary, so I'm > sending it to the list as raw text for now. > > > > > General scenario - merging two or more ASNs, where eventually one > subsumes the other(s). Confederations are NOT being implemented between > the ASNs. In this example, AS200 is being subsumed by AS300. The reason > that this may drive a slightly different solution in BGPSec than a > standard confederation is that unlike in a confed, eBGP peers may not be > peering with the "correct" external ASN, and the forward-signed updates > are for a public ASN, rather than a private one, so there is no > expectation that we should strip them. > > There are two types/directions of migration to consider, each of which > uses some set of implementation-specific knobs to tweak the AS-Path. > It's important to emphasize that a fundamental goal of these > "proprietary knobs" is to (absolutely) ensure that you are NOT changing > the AS_PATH length during the ASN migration. Note, this is critical in > *both* the inbound (CE -> PE) and outbound (PE -> CE) directions. This > is important because for large carriers who bill customers based on bits > (usage), any lengthening of the AS_PATH in either direction will cause > traffic to shift away from their network, which is bad (less usage =3D=3D > less revenue). > > Local-AS: You have an end customer/eBGP peer that is peering with AS200. > You wish to reconfigure that router to be in AS300, and need to be able > to do so without disrupting/coordinating the change with all of the eBGP > peers simultaneously. So you reconfigure the peers with Local AS 200 so > that the router still appears to be in the same ASN. However, if the > peer is doing BGPSec, you have some additional wrinkles. For outbound > announcements, this would require the router to have the right keys for > AS200 so that it can continue signing with the right ASN towards peers > configured this way. > Inbound is more complicated - the peer doesn't know that you've changed > ASNs, so it is forward-signing all of its routes with AS200, not AS300. > How do you fix? > > Reference: > http://www.cisco.com/en/US/docs/ios/12_2t/12_2t11/feature/guide/ft11bhla > .html > > In the direction of CE -> PE (inbound), and speaking about IOS > specifically, (although equivalent knobs do exist in JUNOS and possibly > others): > 1) 'local-as ': appends the value to the AS_PATH of > routes received from the CE > 2) 'local-as no-prepend': DOES NOT prepend value to > the AS_PATH of routes received from the CE. > > For the reason stated above, one prefers configuration #2. This ensures > that routes received by a PE through eBGP sessions with this 'local-as > no-prepend' knob configured get transmitted out to SFI peers > and/or customers with normal/natural neighbor sessions so that > they do not see a longer AS_PATH. IOW, if you had the following: > > NOTE: Direction of BGP Update as per the arrows. > PE-1 is a PE whose "global configuration AS" has been changed from AS > 200 to AS 300 to make it part of the "go forward/keep" ASN. > PE-1 needs the configuration: > > router bgp 300 > neighbor remote-as 400 > neighbor local-as 300 no-prepend > > CE-1 ---> PE-1 -------------------> PE-2 ---> CE-2 > 400 Old_ASN: 200 New_ASN: 300 100 > New_ASN: 300 > > CE-2 should see an AS_PATH that looks like: 400 300, (without seeing AS > 200 *anywhere* in the AS_PATH due to the 'local-as no-prepend' knob). > (NOTE: if you *just* had the "local-as 300" knob configured on PE-1, > then CE-2 would see an AS_PATH that looked like: 400 200 300). > > So, to answer the questions above: yes, in a BGPSec world, CE-1 in AS > 400 would (by default) be forward-signing toward , (a.k.a: AS > 200). I'm guessing the ISP would still need to publish public-keys for > AS 200 if it is to appear in the BGPSec_Path_Signature in order that > receivers can validate the BGPSEC_Path_Signature arrived intact/whole. > And, you need to roll the keys for AS 200 indefinitely (or, as long as > you keep AS 200 around in your network). > > > Replace-AS: You are trying to remove AS200 from the AS-path to ensure > that routes learned from AS200 don't have a longer AS-path and/or you > want to make them look like they only transited AS300, not AS200->AS300. > So you configure routers to do replace-AS. How do you manage the routes > that have been forward-signed into AS200? What about routes originated > by AS200? Do you re-originate with AS300? Is there actually provision in > the Origin validation spec to allow you to re-originate routes, or do > you have to do this with more standard methods (filter the original > announcement/origination and generate a completely new announcement via > null routes, network statements, etc). And from an RIR perspective, how > do you manage this? Do they allow an overlap period on RPKI for > transitions like this? > > This is the opposite direction, from PE -> CE: > http://www.cisco.com/en/US/docs/ios/12_3t/12_3t11/feature/guide/gtbgpdas > .html > > The reference above is specifically looking at the 'replace-as' knob in > Cisco-land, (similar knobs also exist in JUNOS). To re-use the above > diagram, but in the opposite direction we have: > > CE-1 <--- PE-1 <------------------- PE-2 <--- CE-2 > 400 Old_ASN: 200 New_ASN: 300 100 > New_ASN: 300 > > By default, *without* replace-as enabled, CE-1 would see an AS_PATH of: > 200 300 100, which is bad. Now, if we change PE-1 to have the following > config: > > router bgp 300 > neighbor remote-as 400 > neighbor local-as 300 no-prepend replace-as > > In this case, CE-1 would see an AS_PATH of: 300 100. > > In this direction, I don't believe CE-1 will care in a BGPSec-world, > because PE-1 could begin forward-signing from to AS 400 at any > time and, as long as CE-1 has the certs for , then the path > should validate OK. But we need someone to confirm this, so we document > it for completeness. > > > A couple of additional wrinkles to mention here: > 1) Companies rarely stop with one M&A, and end up accumulating several > legacy ASN's over time, which don't go away very quickly, if at all. In > a BGPSEC world, does this mean that every router in your network needs > to maintain a unique public/private key-pair per "legacy ASN"? I'm > really not sure what is the answer, but would want to make sure this is > considered, and answered, as solutions are being proposed to solve this. > 2) That second Cisco URL above also mentions the "dual-as" knob. My > understanding of that knob is it allows a eBGP peer, specifically a CE, > to establish a BGP neighbor session with /either/ or > ... it's really up to the CE's discretion to choose one or the other. > Of course, this allows the customer to decide, at a time of their > choosing, when to migrate from the ISP's to in their > CE device's config. > The reason for "dual-as" is that it's an enhancement above and > beyond "local-as". With just 'local-as' enabled, the PE is (in my > understanding) only expecting the CE to establish a neighbor > relationship with , not (ever) with . Anyway, point > of mentioning this is to ensure that, again, this is captured in the > reqmt's since the eBGP neighbor ASN can migrate pretty rapidly. > 3) In many ways, we're talking about a use case where there are valid > reasons to do exactly what BGPSec Path validation is trying to prevent - > changing the AS-Path so that it differs from the path the update > actually traveled to make one path seem preferred over the other. How do > we do this without opening up an attack vector to allow malicious users > to circumvent BGPSec? > > Thanks, > > Wes George, with a lot of assitance from Shane Amante > > This E-mail and any of its attachments may contain Time Warner Cable > proprietary information, which is privileged, confidential, or subject > to copyright belonging to Time Warner Cable. This E-mail is intended > solely for the use of the individual or entity to which it is addressed. > If you are not the intended recipient of this E-mail, you are hereby > notified that any dissemination, distribution, copying, or action taken > in relation to the contents of and attachments to this E-mail is > strictly prohibited and may be unlawful. If you have received this E- > mail in error, please notify the sender immediately and permanently > delete the original and any copy of this E-mail and any printout. > _______________________________________________ > sidr mailing list > sidr@ietf.org > https://www.ietf.org/mailman/listinfo/sidr This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout. From andrei.robachevsky@gmail.com Fri Jun 29 08:05:46 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFAEF21F8697 for ; Fri, 29 Jun 2012 08:05:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id he5hP29DeSqG for ; Fri, 29 Jun 2012 08:05:46 -0700 (PDT) Received: from mail-ey0-f172.google.com (mail-ey0-f172.google.com [209.85.215.172]) by ietfa.amsl.com (Postfix) with ESMTP id A489121F86C1 for ; Fri, 29 Jun 2012 08:05:45 -0700 (PDT) Received: by eaaq13 with SMTP id q13so1631614eaa.31 for ; Fri, 29 Jun 2012 08:05:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:cc:subject :references:in-reply-to:x-enigmail-version:content-type :content-transfer-encoding; bh=FnCJe6B/e7rV2IPRCV7emX++sBaG/IMpX/ukZabkyrg=; b=o2mBMTpdhX8bnm/MmvrMWUPlkC8Ogqok8bveRQStIedZQwL9paZD+Z+IyF9FshkbYC 9H4Ul/Gj/5CqU0IJwGiqmFC9viEG3brtnl90ZC35LuWCBmFFFdV4tsTrIKRTJ6IwrCbD ehCaag2VmU0w7AZMHmppfzkKF6HibgVulCt5OMIrladtmPJCtWLrdE9fZiKBfOnCU622 3WyigCLhaBdGwlMDVV7s4ut4d/BEvB+7pI24vsW/seJySWyL13aIZiqDX+XTYXATJAZy AQ594pyDsMKdHUTYtjM/J3eT+u8MRRVzX9txXnMVFsweUVjV32MDg2jLFvHf9OJkcxTs zMGg== Received: by 10.14.95.138 with SMTP id p10mr760623eef.110.1340982344723; Fri, 29 Jun 2012 08:05:44 -0700 (PDT) Received: from Andrei-Robachevskys-MacBook-Air.local (d126092.upc-d.chello.nl. [213.46.126.92]) by mx.google.com with ESMTPS id m46sm8736094eeh.9.2012.06.29.08.05.42 (version=SSLv3 cipher=OTHER); Fri, 29 Jun 2012 08:05:43 -0700 (PDT) Message-ID: <4FEDC445.2030402@gmail.com> Date: Fri, 29 Jun 2012 17:05:41 +0200 From: Andrei Robachevsky User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 MIME-Version: 1.0 To: Randy Bush References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> In-Reply-To: X-Enigmail-Version: 1.4.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 15:05:47 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Randy, Randy Bush wrote on 06/06/2012 16:00: [...] > > Abstract: There are circumstances in RPKI operations where a > resource holder's parent may not be able to, or may not choose > to, facilitate full and proper registration of the holder's > data. As in real life, the holder may form a relationship to their > grandparent who is willing to aid the grandchild. This document > describes simple procedures for doing so. > The procedures make sense, but I am still trying to figure out what the draft is trying to recommend. Surely, what is described is technically possible, but it gives RPs no clue if the procedures were followed. In fact, what a RP may see would not be "congruent with the number resource allocation framework" [CP]. IMO a clean implementation would necessarily entail punching a hole in C's certificate. But this is not what the draft recommends. Andrei -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.14 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAk/txEUACgkQljz5tZmtij8WPwCg2kRVgtBPaa/R2Ww60zYZEAvs 9koAoOKvcGU06yERG1op2ehL1IQoTvzk =K7Ly -----END PGP SIGNATURE----- From tim@ripe.net Fri Jun 29 09:03:39 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E1A621F862A for ; Fri, 29 Jun 2012 09:03:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ZuHLARauL-p for ; Fri, 29 Jun 2012 09:03:38 -0700 (PDT) Received: from postgirl.ripe.net (postgirl.ipv6.ripe.net [IPv6:2001:67c:2e8:11::c100:1342]) by ietfa.amsl.com (Postfix) with ESMTP id 6719C21F859B for ; Fri, 29 Jun 2012 09:03:38 -0700 (PDT) Received: from dodo.ripe.net ([193.0.23.4]) by postgirl.ripe.net with esmtps (TLSv1:AES256-SHA:256) (Exim 4.72) (envelope-from ) id 1SkdfT-0001xA-2m; Fri, 29 Jun 2012 18:03:36 +0200 Received: from s258-sslvpn-1.ripe.net ([193.0.20.231] helo=vpn-33.ripe.net) by dodo.ripe.net with esmtps (TLSv1:AES128-SHA:128) (Exim 4.72) (envelope-from ) id 1SkdfS-0005wE-Mn; Fri, 29 Jun 2012 18:03:34 +0200 Mime-Version: 1.0 (Apple Message framework v1084) Content-Type: text/plain; charset=us-ascii From: Tim Bruijnzeels In-Reply-To: Date: Fri, 29 Jun 2012 18:03:34 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> <27839AC4-30E4-4C02-A64E-EAAC6F8B58D4@ripe.net> To: Randy Bush X-Mailer: Apple Mail (2.1084) X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.48/RELEASE, bases: 20120425 #7816575, check: 20120629 clean X-RIPE-Spam-Level: -- X-RIPE-Spam-Report: Spam Total Points: -2.9 points pts rule name description ---- ---------------------- ------------------------------------ -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay domain -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] X-RIPE-Signature: 784d7acfe6559f2a0b602ec6519a07194dc45b91c74a0713b5059d3c31ef02b6 Cc: sidr wg Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 16:03:39 -0000 Hi, On 29 Jun 2012, at 15:51, Randy Bush wrote: >> With inconsistencies I did not mean that the validated cache is out = of date, which I agree, will always be there even if it could be = minimised. >>=20 >> The inconsistencies I refer to are different in nature. It's that the = snapshot that the RP tool got when it validated is in itself = inconsistent: surplus or missing ROAs, or the hash of 1 or more ROAs = doesn't match. Longer discussion omitted, but at this point the RP just = doesn't know for certain what to do and guidance is needed. This is = where *explicitly* stating a strong requirement, rather than leaving it = implicit, in pfx-validate comes in.. >=20 > would you like us to pull in the crucial paragraph from sec 6 of > origin-ops? >=20 > Like the DNS, the global RPKI presents only a loosely consistent > view, depending on timing, updating, fetching, etc. Thus, one cache > or router may have different data about a particular prefix than > another cache or router. There is no 'fix' for this, it is the > nature of distributed data with distributed caches. >=20 No, not exactly. I think it makes more sense to have this kind of = guidance in an ops targeted document. Here I would just like to see it = documented that the same kind of concerns raised with someone able to = mess with the validated cache database (adding/removing records) apply = to attacks or operational problems that happen before stuff goes into = that database. Addressing this to the best of our abilities in operations and relevant = standards is another discussion. One that I would like to save for = another thread, and which does not have to block pfx-validate as far as = I am concerned. Tim= From Sandra.Murphy@sparta.com Fri Jun 29 11:16:51 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E292C21F884C for ; Fri, 29 Jun 2012 11:16:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.496 X-Spam-Level: X-Spam-Status: No, score=-102.496 tagged_above=-999 required=5 tests=[AWL=0.103, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L4yJi1bjT-rK for ; Fri, 29 Jun 2012 11:16:48 -0700 (PDT) Received: from M4.sparta.com (M4.sparta.com [157.185.61.2]) by ietfa.amsl.com (Postfix) with ESMTP id 55C2521F882E for ; Fri, 29 Jun 2012 11:16:47 -0700 (PDT) Received: from Beta5.sparta.com (beta5.sparta.com [157.185.63.21]) by M4.sparta.com (8.14.4/8.14.4) with ESMTP id q5TIGfZ8007688; Fri, 29 Jun 2012 13:16:42 -0500 Received: from Hermes.columbia.ads.sparta.com ([157.185.80.107]) by Beta5.sparta.com (8.13.8/8.13.8) with ESMTP id q5TIGWOH022836; Fri, 29 Jun 2012 13:16:32 -0500 Received: from HERMES.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) by Hermes.columbia.ads.sparta.com ([2002:9db9:506b::9db9:506b]) with mapi id 14.01.0355.002; Fri, 29 Jun 2012 14:16:06 -0400 From: "Murphy, Sandra" To: "George, Wes" , "sidr wg list (sidr@ietf.org)" Thread-Topic: AS Migration and aliasing Thread-Index: Ac1VbE964Tl5GD4nQX6M/ASwsnhZ3AAD9AuLACGIg8AABVFq3A== Date: Fri, 29 Jun 2012 18:16:06 +0000 Message-ID: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E856@Hermes.columbia.ads.sparta.com> References: <24B20D14B2CD29478C8D5D6E9CBB29F625F2E6D7@Hermes.columbia.ads.sparta.com>, In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [157.185.63.118] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: Re: [sidr] AS Migration and aliasing X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 18:16:51 -0000 Thanks, and understood.=0A= =0A= No one on the call had had the time to read your message thoroughly so we c= ould not discuss it well.=0A= =0A= Discussion can (and should) proceed on the list, of course.=0A= =0A= I hope you will be in Vancouver (interim and/or regular IETF slot) and we c= an discuss the topic there. Providing we don't finish the discussion on th= e list before hand, of course.=0A= =0A= --Sandy=0A= ________________________________________=0A= From: George, Wes [wesley.george@twcable.com]=0A= Sent: Friday, June 29, 2012 10:20 AM=0A= To: Murphy, Sandra; sidr wg list (sidr@ietf.org)=0A= Subject: RE: AS Migration and aliasing=0A= =0A= I unfortunately won't be attending much of today's interim if at all - $day= _job calls...=0A= =0A= Thanks,=0A= =0A= Wes=0A= =0A= > -----Original Message-----=0A= > From: Murphy, Sandra [mailto:Sandra.Murphy@sparta.com]=0A= > Sent: Thursday, June 28, 2012 6:20 PM=0A= > To: George, Wes; sidr wg list (sidr@ietf.org)=0A= > Subject: RE: AS Migration and aliasing=0A= >=0A= > Lots of stuff to consider here!=0A= >=0A= > Last minute, but would you like to fit this into the interim meeting=0A= > tomorrow?=0A= >=0A= > --Sandy, speaking as co-chair=0A= > ________________________________________=0A= > From: sidr-bounces@ietf.org [sidr-bounces@ietf.org] on behalf of George,= =0A= > Wes [wesley.george@twcable.com]=0A= > Sent: Thursday, June 28, 2012 4:27 PM=0A= > To: sidr wg list (sidr@ietf.org)=0A= > Subject: [sidr] AS Migration and aliasing=0A= >=0A= > During the last SIDR Interim, we talked about BGP Aliasing as a means to= =0A= > migrate from one ASN to another. I proxied some concerns from Shane=0A= > Amante and others who weren't present, but I ended up being the stuckee= =0A= > to write up the requirements/use case so that we can make sure that it's= =0A= > being appropriately addressed. Shane and I have worked to put together=0A= > the below. If it's helpful to put this in draft form, we're happy to do= =0A= > so, or the relevant bits of text can be incorporated into existing=0A= > drafts, or whatever. I figured the main thing was that I needed to get=0A= > this out of my edit buffer and in front of the right people without any= =0A= > additional delay so that we can discuss it further as necessary, so I'm= =0A= > sending it to the list as raw text for now.=0A= >=0A= >=0A= >=0A= >=0A= > General scenario - merging two or more ASNs, where eventually one=0A= > subsumes the other(s). Confederations are NOT being implemented between= =0A= > the ASNs. In this example, AS200 is being subsumed by AS300. The reason= =0A= > that this may drive a slightly different solution in BGPSec than a=0A= > standard confederation is that unlike in a confed, eBGP peers may not be= =0A= > peering with the "correct" external ASN, and the forward-signed updates= =0A= > are for a public ASN, rather than a private one, so there is no=0A= > expectation that we should strip them.=0A= >=0A= > There are two types/directions of migration to consider, each of which=0A= > uses some set of implementation-specific knobs to tweak the AS-Path.=0A= > It's important to emphasize that a fundamental goal of these=0A= > "proprietary knobs" is to (absolutely) ensure that you are NOT changing= =0A= > the AS_PATH length during the ASN migration. Note, this is critical in= =0A= > *both* the inbound (CE -> PE) and outbound (PE -> CE) directions. This= =0A= > is important because for large carriers who bill customers based on bits= =0A= > (usage), any lengthening of the AS_PATH in either direction will cause=0A= > traffic to shift away from their network, which is bad (less usage =3D=3D= =0A= > less revenue).=0A= >=0A= > Local-AS: You have an end customer/eBGP peer that is peering with AS200.= =0A= > You wish to reconfigure that router to be in AS300, and need to be able= =0A= > to do so without disrupting/coordinating the change with all of the eBGP= =0A= > peers simultaneously. So you reconfigure the peers with Local AS 200 so= =0A= > that the router still appears to be in the same ASN. However, if the=0A= > peer is doing BGPSec, you have some additional wrinkles. For outbound=0A= > announcements, this would require the router to have the right keys for= =0A= > AS200 so that it can continue signing with the right ASN towards peers=0A= > configured this way.=0A= > Inbound is more complicated - the peer doesn't know that you've changed= =0A= > ASNs, so it is forward-signing all of its routes with AS200, not AS300.= =0A= > How do you fix?=0A= >=0A= > Reference:=0A= > http://www.cisco.com/en/US/docs/ios/12_2t/12_2t11/feature/guide/ft11bhla= =0A= > .html=0A= >=0A= > In the direction of CE -> PE (inbound), and speaking about IOS=0A= > specifically, (although equivalent knobs do exist in JUNOS and possibly= =0A= > others):=0A= > 1) 'local-as ': appends the value to the AS_PATH of= =0A= > routes received from the CE=0A= > 2) 'local-as no-prepend': DOES NOT prepend value to= =0A= > the AS_PATH of routes received from the CE.=0A= >=0A= > For the reason stated above, one prefers configuration #2. This ensures= =0A= > that routes received by a PE through eBGP sessions with this 'local-as=0A= > no-prepend' knob configured get transmitted out to SFI peers=0A= > and/or customers with normal/natural neighbor sessions so that= =0A= > they do not see a longer AS_PATH. IOW, if you had the following:=0A= >=0A= > NOTE: Direction of BGP Update as per the arrows.=0A= > PE-1 is a PE whose "global configuration AS" has been changed from AS=0A= > 200 to AS 300 to make it part of the "go forward/keep" ASN.=0A= > PE-1 needs the configuration:=0A= >=0A= > router bgp 300=0A= > neighbor remote-as 400=0A= > neighbor local-as 300 no-prepend=0A= >=0A= > CE-1 ---> PE-1 -------------------> PE-2 ---> CE-2=0A= > 400 Old_ASN: 200 New_ASN: 300 100=0A= > New_ASN: 300=0A= >=0A= > CE-2 should see an AS_PATH that looks like: 400 300, (without seeing AS= =0A= > 200 *anywhere* in the AS_PATH due to the 'local-as no-prepend' knob).=0A= > (NOTE: if you *just* had the "local-as 300" knob configured on PE-1,=0A= > then CE-2 would see an AS_PATH that looked like: 400 200 300).=0A= >=0A= > So, to answer the questions above: yes, in a BGPSec world, CE-1 in AS=0A= > 400 would (by default) be forward-signing toward , (a.k.a: AS=0A= > 200). I'm guessing the ISP would still need to publish public-keys for= =0A= > AS 200 if it is to appear in the BGPSec_Path_Signature in order that=0A= > receivers can validate the BGPSEC_Path_Signature arrived intact/whole.=0A= > And, you need to roll the keys for AS 200 indefinitely (or, as long as=0A= > you keep AS 200 around in your network).=0A= >=0A= >=0A= > Replace-AS: You are trying to remove AS200 from the AS-path to ensure=0A= > that routes learned from AS200 don't have a longer AS-path and/or you=0A= > want to make them look like they only transited AS300, not AS200->AS300.= =0A= > So you configure routers to do replace-AS. How do you manage the routes= =0A= > that have been forward-signed into AS200? What about routes originated=0A= > by AS200? Do you re-originate with AS300? Is there actually provision in= =0A= > the Origin validation spec to allow you to re-originate routes, or do=0A= > you have to do this with more standard methods (filter the original=0A= > announcement/origination and generate a completely new announcement via= =0A= > null routes, network statements, etc). And from an RIR perspective, how= =0A= > do you manage this? Do they allow an overlap period on RPKI for=0A= > transitions like this?=0A= >=0A= > This is the opposite direction, from PE -> CE:=0A= > http://www.cisco.com/en/US/docs/ios/12_3t/12_3t11/feature/guide/gtbgpdas= =0A= > .html=0A= >=0A= > The reference above is specifically looking at the 'replace-as' knob in= =0A= > Cisco-land, (similar knobs also exist in JUNOS). To re-use the above=0A= > diagram, but in the opposite direction we have:=0A= >=0A= > CE-1 <--- PE-1 <------------------- PE-2 <--- CE-2=0A= > 400 Old_ASN: 200 New_ASN: 300 100=0A= > New_ASN: 300=0A= >=0A= > By default, *without* replace-as enabled, CE-1 would see an AS_PATH of:= =0A= > 200 300 100, which is bad. Now, if we change PE-1 to have the following= =0A= > config:=0A= >=0A= > router bgp 300=0A= > neighbor remote-as 400=0A= > neighbor local-as 300 no-prepend replace-as=0A= >=0A= > In this case, CE-1 would see an AS_PATH of: 300 100.=0A= >=0A= > In this direction, I don't believe CE-1 will care in a BGPSec-world,=0A= > because PE-1 could begin forward-signing from to AS 400 at any= =0A= > time and, as long as CE-1 has the certs for , then the path=0A= > should validate OK. But we need someone to confirm this, so we document= =0A= > it for completeness.=0A= >=0A= >=0A= > A couple of additional wrinkles to mention here:=0A= > 1) Companies rarely stop with one M&A, and end up accumulating several= =0A= > legacy ASN's over time, which don't go away very quickly, if at all. In= =0A= > a BGPSEC world, does this mean that every router in your network needs=0A= > to maintain a unique public/private key-pair per "legacy ASN"? I'm=0A= > really not sure what is the answer, but would want to make sure this is= =0A= > considered, and answered, as solutions are being proposed to solve this.= =0A= > 2) That second Cisco URL above also mentions the "dual-as" knob. My=0A= > understanding of that knob is it allows a eBGP peer, specifically a CE,= =0A= > to establish a BGP neighbor session with /either/ or = =0A= > ... it's really up to the CE's discretion to choose one or the other.=0A= > Of course, this allows the customer to decide, at a time of their=0A= > choosing, when to migrate from the ISP's to in their= =0A= > CE device's config.=0A= > The reason for "dual-as" is that it's an enhancement above and=0A= > beyond "local-as". With just 'local-as' enabled, the PE is (in my=0A= > understanding) only expecting the CE to establish a neighbor=0A= > relationship with , not (ever) with . Anyway, point=0A= > of mentioning this is to ensure that, again, this is captured in the=0A= > reqmt's since the eBGP neighbor ASN can migrate pretty rapidly.=0A= > 3) In many ways, we're talking about a use case where there are valid=0A= > reasons to do exactly what BGPSec Path validation is trying to prevent -= =0A= > changing the AS-Path so that it differs from the path the update=0A= > actually traveled to make one path seem preferred over the other. How do= =0A= > we do this without opening up an attack vector to allow malicious users= =0A= > to circumvent BGPSec?=0A= >=0A= > Thanks,=0A= >=0A= > Wes George, with a lot of assitance from Shane Amante=0A= >=0A= > This E-mail and any of its attachments may contain Time Warner Cable=0A= > proprietary information, which is privileged, confidential, or subject=0A= > to copyright belonging to Time Warner Cable. This E-mail is intended=0A= > solely for the use of the individual or entity to which it is addressed.= =0A= > If you are not the intended recipient of this E-mail, you are hereby=0A= > notified that any dissemination, distribution, copying, or action taken= =0A= > in relation to the contents of and attachments to this E-mail is=0A= > strictly prohibited and may be unlawful. If you have received this E-=0A= > mail in error, please notify the sender immediately and permanently=0A= > delete the original and any copy of this E-mail and any printout.=0A= > _______________________________________________=0A= > sidr mailing list=0A= > sidr@ietf.org=0A= > https://www.ietf.org/mailman/listinfo/sidr=0A= =0A= This E-mail and any of its attachments may contain Time Warner Cable propri= etary information, which is privileged, confidential, or subject to copyrig= ht belonging to Time Warner Cable. This E-mail is intended solely for the u= se of the individual or entity to which it is addressed. If you are not the= intended recipient of this E-mail, you are hereby notified that any dissem= ination, distribution, copying, or action taken in relation to the contents= of and attachments to this E-mail is strictly prohibited and may be unlawf= ul. If you have received this E-mail in error, please notify the sender imm= ediately and permanently delete the original and any copy of this E-mail an= d any printout.=0A= From randy@psg.com Fri Jun 29 11:44:26 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C525421F884E for ; Fri, 29 Jun 2012 11:44:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.584 X-Spam-Level: X-Spam-Status: No, score=-2.584 tagged_above=-999 required=5 tests=[AWL=0.015, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RrblSeByEc3o for ; Fri, 29 Jun 2012 11:44:26 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 21D1521F884D for ; Fri, 29 Jun 2012 11:44:25 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1SkgB6-000DN8-3o; Fri, 29 Jun 2012 18:44:24 +0000 Date: Fri, 29 Jun 2012 08:44:23 -1000 Message-ID: From: Randy Bush To: Andrei Robachevsky In-Reply-To: <4FEDC445.2030402@gmail.com> References: <20120606135903.5473.73476.idtracker@ietfa.amsl.com> <4FEDC445.2030402@gmail.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg list Subject: Re: [sidr] draft-ymbk-rpki-grandparenting-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 18:44:26 -0000 > Surely, what is described is technically possible, but it gives RPs no > clue if the procedures were followed. In fact, what a RP may see would > not be "congruent with the number resource allocation framework" [CP]. > > IMO a clean implementation would necessarily entail punching a hole in > C's certificate. But this is not what the draft recommends. if A and C both ran CAs, and G has used C's CA to issue a cert and ROA for G's space, then (when C went unresponsive) A could either issue a ROA to G or a cert and a ROA. both work. seems to me to be more a matter of style than conformity. it is no more a matter of 'hole punching' than A issuing a ROA for various sub-pieces of its own space. what is interesting is the sharing of responsibility and control, not that it is a subset of the space. note that A might have owned a /16 which it then delegated a the whole /16 to C who redelegated the /16 to G. look ma, no holes! randy From randy@psg.com Fri Jun 29 12:24:23 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C23621F88A1 for ; Fri, 29 Jun 2012 12:24:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.585 X-Spam-Level: X-Spam-Status: No, score=-2.585 tagged_above=-999 required=5 tests=[AWL=0.014, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSau9v6J43Q3 for ; Fri, 29 Jun 2012 12:24:23 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id F3B2D21F8860 for ; Fri, 29 Jun 2012 12:24:22 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Skgnl-000DT3-6r for sidr@ietf.org; Fri, 29 Jun 2012 19:24:22 +0000 Date: Fri, 29 Jun 2012 09:24:16 -1000 Message-ID: From: Randy Bush To: sidr wg References: <20120629190740.14764.81719.idtracker@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Subject: [sidr] New Version Notification for draft-ymbk-rpki-grandparenting-01.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 19:24:23 -0000 From: internet-drafts@ietf.org To: randy@psg.com Subject: New Version Notification for draft-ymbk-rpki-grandparenting-01.txt Message-ID: <20120629190740.14764.81719.idtracker@ietfa.amsl.com> Date: Fri, 29 Jun 2012 12:07:40 -0700 A new version of I-D, draft-ymbk-rpki-grandparenting-01.txt has been successfully submitted by Randy Bush and posted to the IETF repository. Filename: draft-ymbk-rpki-grandparenting Revision: 01 Title: Responsible Grandparenting in the RPKI Creation date: 2012-06-29 WG ID: Individual Submission Number of pages: 4 URL: http://www.ietf.org/internet-drafts/draft-ymbk-rpki-grandparenting-01.txt Status: http://datatracker.ietf.org/doc/draft-ymbk-rpki-grandparenting Htmlized: http://tools.ietf.org/html/draft-ymbk-rpki-grandparenting-01 Diff: http://tools.ietf.org/rfcdiff?url2=3Ddraft-ymbk-rpki-grandparenting-01 Abstract: There are circumstances in RPKI operations where a resource holder's parent may not be able to, or may not choose to, facilitate full and proper registration of the holder's data. As in real life, the holder may form a relationship with their grandparent who is willing to aid the grandchild. This document describes simple procedures for doing so. The IETF Secretariat From randy@psg.com Fri Jun 29 12:36:47 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA23B21F88B9 for ; Fri, 29 Jun 2012 12:36:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.585 X-Spam-Level: X-Spam-Status: No, score=-2.585 tagged_above=-999 required=5 tests=[AWL=0.014, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IqOqUle2xpL2 for ; Fri, 29 Jun 2012 12:36:47 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36]) by ietfa.amsl.com (Postfix) with ESMTP id 3D62621F88BA for ; Fri, 29 Jun 2012 12:36:47 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=rair.psg.com.psg.com) by ran.psg.com with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Skgzl-000DUa-Q2; Fri, 29 Jun 2012 19:36:46 +0000 Date: Fri, 29 Jun 2012 09:36:44 -1000 Message-ID: From: Randy Bush To: Tim Bruijnzeels In-Reply-To: References: <24B20D14B2CD29478C8D5D6E9CBB29F625F1340A@Hermes.columbia.ads.sparta.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Cc: sidr wg Subject: Re: [sidr] WGLC for draft-ietf-sidr-pfx-validate-06 X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 19:36:47 -0000 > Prefix validate assumes full knowledge of all applicable ROAs (or > other sources of information if they are used) no, it can not. there is no notion of global completeness in the RPKI, only manifests to resist object removal attack. from origin-ops 6. Notes Like the DNS, the global RPKI presents only a loosely consistent view, depending on timing, updating, fetching, etc. Thus, one cache or router may have different data about a particular prefix than another cache or router. There is no 'fix' for this, it is the nature of distributed data with distributed caches. Operators should beware that RPKI caches are loosely synchronized, even within a single AS. Thus, changes to the validity state of prefixes could be different within an operator's network. In addition, there is no guaranteed interval from when an RPKI cache is updated to when that new information may be pushed or pulled into a set of routers via this protocol. This may result in sudden shifts of traffic in the operator's network, until all of the routers in the AS have reached equilibrium with the validity state of prefixes reflected in all of the RPKI caches. randy From internet-drafts@ietf.org Fri Jun 29 13:16:41 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E93C21F88DB; Fri, 29 Jun 2012 13:16:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.468 X-Spam-Level: X-Spam-Status: No, score=-102.468 tagged_above=-999 required=5 tests=[AWL=0.131, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pkAaUHX6SGyl; Fri, 29 Jun 2012 13:16:39 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA82021F8893; Fri, 29 Jun 2012 13:16:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.21p1 Message-ID: <20120629201614.9623.33379.idtracker@ietfa.amsl.com> Date: Fri, 29 Jun 2012 13:16:14 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-origin-ops-17.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 20:16:41 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : RPKI-Based Origin Validation Operation Author(s) : Randy Bush Filename : draft-ietf-sidr-origin-ops-17.txt Pages : 10 Date : 2012-06-29 Abstract: Deployment of RPKI-based BGP origin validation has many operational considerations. This document attempts to collect and present the most critical. It is expected to evolve as RPKI-based origin validation is deployed and the dynamics are better understood. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-origin-ops There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-origin-ops-17 A diff from previous version is available at: http://tools.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-origin-ops-17 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From internet-drafts@ietf.org Fri Jun 29 13:17:00 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 585FF21F88EE; Fri, 29 Jun 2012 13:17:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.471 X-Spam-Level: X-Spam-Status: No, score=-102.471 tagged_above=-999 required=5 tests=[AWL=0.128, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ghc27vfk37w3; Fri, 29 Jun 2012 13:16:58 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F6AB21F88E6; Fri, 29 Jun 2012 13:16:58 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.21p1 Message-ID: <20120629201658.9617.65085.idtracker@ietfa.amsl.com> Date: Fri, 29 Jun 2012 13:16:58 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-pfx-validate-07.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 20:17:00 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : BGP Prefix Origin Validation Author(s) : Pradosh Mohapatra John Scudder David Ward Randy Bush Rob Austein Filename : draft-ietf-sidr-pfx-validate-07.txt Pages : 9 Date : 2012-06-29 Abstract: To help reduce well-known threats against BGP including prefix mis- announcing and monkey-in-the-middle attacks, one of the security requirements is the ability to validate the origination AS of BGP routes. More specifically, one needs to validate that the AS number claiming to originate an address prefix (as derived from the AS_PATH attribute of the BGP route) is in fact authorized by the prefix holder to do so. This document describes a simple validation mechanism to partially satisfy this requirement. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-pfx-validate There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-pfx-validate-07 A diff from previous version is available at: http://tools.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-pfx-validate-07 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From internet-drafts@ietf.org Fri Jun 29 13:17:01 2012 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C62E521F88E9; Fri, 29 Jun 2012 13:17:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.364 X-Spam-Level: X-Spam-Status: No, score=-102.364 tagged_above=-999 required=5 tests=[AWL=0.008, BAYES_00=-2.599, SARE_SUB_OBFU_Q1=0.227, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IyM3CsHfEcGB; Fri, 29 Jun 2012 13:17:01 -0700 (PDT) Received: from ietfa.amsl.com (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26F7021F88EA; Fri, 29 Jun 2012 13:16:59 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.21p1 Message-ID: <20120629201659.7037.76659.idtracker@ietfa.amsl.com> Date: Fri, 29 Jun 2012 13:16:59 -0700 Cc: sidr@ietf.org Subject: [sidr] I-D Action: draft-ietf-sidr-bgpsec-reqs-04.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Jun 2012 20:17:02 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Secure Inter-Domain Routing Working Group= of the IETF. Title : Security Requirements for BGP Path Validation Author(s) : Steven M. Bellovin Randy Bush David Ward Filename : draft-ietf-sidr-bgpsec-reqs-04.txt Pages : 8 Date : 2012-06-29 Abstract: This document describes requirements for a future BGP security protocol design to provide cryptographic assurance that the origin AS had the right to announce the prefix and to provide assurance of the AS Path of the announcement. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-sidr-bgpsec-reqs There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-sidr-bgpsec-reqs-04 A diff from previous version is available at: http://tools.ietf.org/rfcdiff?url2=3Ddraft-ietf-sidr-bgpsec-reqs-04 Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/