From nobody Tue Jul 11 17:01:46 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C296A1276AF for ; Tue, 11 Jul 2017 17:01:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qZa_WBsFFeYb for ; Tue, 11 Jul 2017 17:01:43 -0700 (PDT) Received: from smtp2.arin.net (smtp2.arin.net [IPv6:2001:500:110:201::52]) by ietfa.amsl.com (Postfix) with ESMTP id 27B42126C7A for ; Tue, 11 Jul 2017 17:01:43 -0700 (PDT) Received: by smtp2.arin.net (Postfix, from userid 323) id 7DAA33986; Tue, 11 Jul 2017 20:01:42 -0400 (EDT) Received: from ASHEDGE02.corp.arin.net (ashedge02.corp.arin.net [199.43.0.123]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp2.arin.net (Postfix) with ESMTPS id EE78D3979 for ; Tue, 11 Jul 2017 20:01:41 -0400 (EDT) Received: from CAS02ASH.corp.arin.net (10.4.30.63) by ASHEDGE02.corp.arin.net (199.43.0.123) with Microsoft SMTP Server (TLS) id 15.0.847.32; Tue, 11 Jul 2017 20:01:36 -0400 Received: from CAS01ASH.corp.arin.net (10.4.30.62) by CAS02ASH.corp.arin.net (10.4.30.63) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Tue, 11 Jul 2017 20:01:41 -0400 Received: from CAS01ASH.corp.arin.net ([fe80::4803:bd5b:dc93:20f6]) by CAS01ASH.corp.arin.net ([fe80::4803:bd5b:dc93:20f6%18]) with mapi id 15.00.1210.000; Tue, 11 Jul 2017 20:01:41 -0400 From: John Curran To: sidr Thread-Topic: RIR's moving to all resources (0/0) RPKI TA's Thread-Index: AQHS+qIKIjFdoBBXSUCHcohHF2rSQw== Date: Wed, 12 Jul 2017 00:01:40 +0000 Message-ID: <30FCD56B-818B-4D1E-B3F3-D2A3E2850D6E@arin.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [199.43.0.124] Content-Type: multipart/alternative; boundary="_000_30FCD56B818B4D1EB3F3D2A3E2850D6Earinnet_" MIME-Version: 1.0 Archived-At: Subject: [sidr] RIR's moving to all resources (0/0) RPKI TA's X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jul 2017 00:01:45 -0000 --_000_30FCD56B818B4D1EB3F3D2A3E2850D6Earinnet_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 U2lkciBGb2xrcyAtDQoNCkZZSS4gICBXaGlsZSBleGNlbGxlbnQgcHJvZ3Jlc3MgaXMgb25nb2lu ZyB3aXRoIHRoZSBhbHRlcm5hdGl2ZSBhbGdvcml0aG0NCnNwZWNpZmllZCBpbiBkcmFmdC1pZXRm LXNpZHItcnBraS12YWxpZGF0aW9uLXJlY29uc2lkZXJlZCwgaXQgaXMgd29ydGggbm90aW5nDQp0 aGF0IHRoZSBSSVJzIHdpbGwgcHJlc2VudGx5IGJlIG1vdmluZyB0byBhbGwgcmVzb3VyY2UgUlBL SSBUQeKAmXMgdG8gaGVscA0KbWl0aWdhdGUgdGhlIHJpc2sgb2YgbWFzc2l2ZSBkb3duc3RyZWFt IGludmFsaWRhdGlvbiB0aGF0IHdvdWxkIG9jY3VyIGluDQp0aGUgY2FzZSBvZiBpbmNvbnNpc3Rl bmNpZXMgdW5kZXIgcHJlc2VudCB2YWxpZGF0aW9uIGFsZ29yaXRobToNCg0KUGVyIDxodHRwczov L3d3dy5ucm8ubmV0L3JlZ2lvbmFsLWludGVybmV0LXJlZ2lzdHJpZXMtYXJlLXByZXBhcmluZy10 by1kZXBsb3ktYWxsLXJlc291cmNlcy1ycGtpLXNlcnZpY2UvPiDigJMNCiJCeSAzMCBTZXB0ZW1i ZXIgMjAxNywgZWFjaCBSSVIgd2lsbCBoYXZlIG1vdmVkIGZyb20gYW4gUlBLSSBUcnVzdCBBbmNo b3IgdGhhdCByZWZsZWN0cyB0aGVpciBjdXJyZW50IGhvbGRpbmdzIHRvIG9uZSB0aGF0IHJlZmxl Y3RzIGFsbCBob2xkaW5ncyAoMC8wKSwgYXMgZnVydGhlciBkZXRhaWxlZCBpbiB0aGUg4oCcQWxs IFJlc291cmNlcyBBcHBsaWNhYmlsaXR5IFN0YXRlbWVudOKAnSBkYXRlZCAyMSBKYW51YXJ5IDIw MTc6ICBodHRwczovL3d3dy5pZXRmLm9yZy9hcmNoaXZlL2lkL2RyYWZ0LXJpci1ycGtpLWFsbHJl cy10YS1hcHAtc3RhdGVtZW50LTAxLnR4dCAg4oCmIOKAnA0KDQpGWUksDQovSm9obg0KDQpKb2hu IEN1cnJhbg0KQ2hhaXIsIE51bWJlciBSZXNvdXJjZSBPcmdhbml6YXRpb24gKE5STykNCg0KDQoN Cg0K --_000_30FCD56B818B4D1EB3F3D2A3E2850D6Earinnet_ Content-Type: text/html; charset="utf-8" Content-ID: <8ADF80A63FA95F48BFE4BA6B6915DCF3@corp.arin.net> Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjwvaGVhZD4NCjxib2R5IHN0eWxlPSJ3b3JkLXdy YXA6IGJyZWFrLXdvcmQ7IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJy ZWFrOiBhZnRlci13aGl0ZS1zcGFjZTsiIGNsYXNzPSIiPg0KPGRpdiBjbGFzcz0iIj5TaWRyIEZv bGtzIC0mbmJzcDs8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8 ZGl2IGNsYXNzPSIiPkZZSS4gJm5ic3A7IFdoaWxlIGV4Y2VsbGVudCBwcm9ncmVzcyBpcyBvbmdv aW5nIHdpdGggdGhlIGFsdGVybmF0aXZlIGFsZ29yaXRobSZuYnNwOzwvZGl2Pg0KPGRpdiBjbGFz cz0iIj5zcGVjaWZpZWQgaW4mbmJzcDtkcmFmdC1pZXRmLXNpZHItcnBraS12YWxpZGF0aW9uLXJl Y29uc2lkZXJlZCwgaXQgaXMgd29ydGggbm90aW5nPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPnRoYXQg dGhlIFJJUnMgd2lsbCBwcmVzZW50bHkgYmUgbW92aW5nIHRvIGFsbCByZXNvdXJjZSBSUEtJIFRB 4oCZcyB0byBoZWxwJm5ic3A7PC9kaXY+DQo8ZGl2IGNsYXNzPSIiPm1pdGlnYXRlIHRoZSByaXNr IG9mIG1hc3NpdmUgZG93bnN0cmVhbSBpbnZhbGlkYXRpb24gdGhhdCB3b3VsZCBvY2N1ciBpbjwv ZGl2Pg0KPGRpdiBjbGFzcz0iIj50aGUgY2FzZSBvZiBpbmNvbnNpc3RlbmNpZXMgdW5kZXIgcHJl c2VudCB2YWxpZGF0aW9uIGFsZ29yaXRobTo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNz PSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPlBlciAmbHQ7PGEgaHJlZj0iaHR0cHM6Ly93d3cu bnJvLm5ldC9yZWdpb25hbC1pbnRlcm5ldC1yZWdpc3RyaWVzLWFyZS1wcmVwYXJpbmctdG8tZGVw bG95LWFsbC1yZXNvdXJjZXMtcnBraS1zZXJ2aWNlLyIgY2xhc3M9IiI+aHR0cHM6Ly93d3cubnJv Lm5ldC9yZWdpb25hbC1pbnRlcm5ldC1yZWdpc3RyaWVzLWFyZS1wcmVwYXJpbmctdG8tZGVwbG95 LWFsbC1yZXNvdXJjZXMtcnBraS1zZXJ2aWNlLzwvYT4mZ3Q7IOKAkzwvZGl2Pg0KPGRpdiBjbGFz cz0iIj4mcXVvdDtCeSAzMCBTZXB0ZW1iZXIgMjAxNywgZWFjaCBSSVIgd2lsbCBoYXZlIG1vdmVk IGZyb20gYW4gUlBLSSBUcnVzdCBBbmNob3IgdGhhdCByZWZsZWN0cyB0aGVpciBjdXJyZW50IGhv bGRpbmdzJm5ic3A7dG8gb25lIHRoYXQgcmVmbGVjdHMgYWxsIGhvbGRpbmdzICgwLzApLCBhcyBm dXJ0aGVyIGRldGFpbGVkIGluIHRoZSDigJxBbGwgUmVzb3VyY2VzIEFwcGxpY2FiaWxpdHkgU3Rh dGVtZW504oCdIGRhdGVkIDIxJm5ic3A7SmFudWFyeSAyMDE3OiAmbmJzcDs8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9hcmNoaXZlL2lkL2RyYWZ0LXJpci1ycGtpLWFsbHJlcy10YS1hcHAt c3RhdGVtZW50LTAxLnR4dCIgY2xhc3M9IiI+aHR0cHM6Ly93d3cuaWV0Zi5vcmcvYXJjaGl2ZS9p ZC9kcmFmdC1yaXItcnBraS1hbGxyZXMtdGEtYXBwLXN0YXRlbWVudC0wMS50eHQ8L2E+Jm5ic3A7 DQog4oCmIOKAnDwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxk aXYgY2xhc3M9IiI+RllJLDwvZGl2Pg0KPGRpdiBjbGFzcz0iIj4vSm9objwvZGl2Pg0KPGRpdiBj bGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+Sm9obiBDdXJyYW48 L2Rpdj4NCjxkaXYgY2xhc3M9IiI+Q2hhaXIsIE51bWJlciBSZXNvdXJjZSBPcmdhbml6YXRpb24g KE5STyk8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNs YXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+ DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_30FCD56B818B4D1EB3F3D2A3E2850D6Earinnet_-- From nobody Wed Jul 12 02:00:58 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3CA7131895 for ; Wed, 12 Jul 2017 02:00:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 22wKntX63uua for ; Wed, 12 Jul 2017 02:00:55 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D85BF12708C for ; Wed, 12 Jul 2017 02:00:55 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1dVDVt-0002KD-Qg; Wed, 12 Jul 2017 09:00:54 +0000 Date: Wed, 12 Jul 2017 11:00:53 +0200 Message-ID: From: Randy Bush To: John Curran Cc: sidr In-Reply-To: <30FCD56B-818B-4D1E-B3F3-D2A3E2850D6E@arin.net> References: <30FCD56B-818B-4D1E-B3F3-D2A3E2850D6E@arin.net> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=ISO-8859-7 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [sidr] RIR's moving to all resources (0/0) RPKI TA's X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jul 2017 09:00:57 -0000 > FYI. While excellent progress is ongoing with the alternative > algorithm specified in draft-ietf-sidr-rpki-validation-reconsidered, > it is worth noting that the RIRs will presently be moving to all > resource RPKI TA=A2s to help mitigate the risk of massive downstream > invalidation that would occur in the case of inconsistencies under > present validation algorithm: what continues to amuse me is that all these contortions address rir failures we have not seen; while the failures we have seen (ee cert in manifest expiration timing, etc.) have not been systematically addressed. randy From nobody Wed Jul 12 04:03:43 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 835BD131675 for ; Wed, 12 Jul 2017 04:03:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tQhVlP4td_Y0 for ; Wed, 12 Jul 2017 04:03:39 -0700 (PDT) Received: from smtp2.arin.net (smtp2.arin.net [IPv6:2001:500:110:201::52]) by ietfa.amsl.com (Postfix) with ESMTP id 0CF12131678 for ; Wed, 12 Jul 2017 04:03:39 -0700 (PDT) Received: by smtp2.arin.net (Postfix, from userid 323) id 704F539AB; Wed, 12 Jul 2017 07:03:38 -0400 (EDT) Received: from ASHEDGE02.corp.arin.net (ashedge02.corp.arin.net [199.43.0.123]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp2.arin.net (Postfix) with ESMTPS id 8A09D3979; Wed, 12 Jul 2017 07:03:37 -0400 (EDT) Received: from CAS02ASH.corp.arin.net (10.4.30.63) by ASHEDGE02.corp.arin.net (199.43.0.123) with Microsoft SMTP Server (TLS) id 15.0.847.32; Wed, 12 Jul 2017 07:03:20 -0400 Received: from CAS01ASH.corp.arin.net (10.4.30.62) by CAS02ASH.corp.arin.net (10.4.30.63) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 12 Jul 2017 07:03:25 -0400 Received: from CAS01ASH.corp.arin.net ([fe80::4803:bd5b:dc93:20f6]) by CAS01ASH.corp.arin.net ([fe80::4803:bd5b:dc93:20f6%18]) with mapi id 15.00.1210.000; Wed, 12 Jul 2017 07:03:25 -0400 From: John Curran To: Randy Bush CC: sidr Thread-Topic: [sidr] RIR's moving to all resources (0/0) RPKI TA's Thread-Index: AQHS+u3BNxE2sF9fbU+7ct0eA4E6wqJQSieA Date: Wed, 12 Jul 2017 11:03:24 +0000 Message-ID: <851E48AE-90C3-4BD5-8A34-310050C212A8@arin.net> References: <30FCD56B-818B-4D1E-B3F3-D2A3E2850D6E@arin.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [199.43.0.124] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [sidr] RIR's moving to all resources (0/0) RPKI TA's X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Jul 2017 11:03:40 -0000 T24gMTIgSnVsIDIwMTcsIGF0IDU6MDAgQU0sIFJhbmR5IEJ1c2ggPHJhbmR5QHBzZy5jb20+IHdy b3RlOg0KPiANCj4+IEZZSS4gIFdoaWxlIGV4Y2VsbGVudCBwcm9ncmVzcyBpcyBvbmdvaW5nIHdp dGggdGhlIGFsdGVybmF0aXZlDQo+PiBhbGdvcml0aG0gc3BlY2lmaWVkIGluIGRyYWZ0LWlldGYt c2lkci1ycGtpLXZhbGlkYXRpb24tcmVjb25zaWRlcmVkLA0KPj4gaXQgaXMgd29ydGggbm90aW5n IHRoYXQgdGhlIFJJUnMgd2lsbCBwcmVzZW50bHkgYmUgbW92aW5nIHRvIGFsbA0KPj4gcmVzb3Vy Y2UgUlBLSSBUQeKAmXMgdG8gaGVscCBtaXRpZ2F0ZSB0aGUgcmlzayBvZiBtYXNzaXZlIGRvd25z dHJlYW0NCj4+IGludmFsaWRhdGlvbiB0aGF0IHdvdWxkIG9jY3VyIGluIHRoZSBjYXNlIG9mIGlu Y29uc2lzdGVuY2llcyB1bmRlcg0KPj4gcHJlc2VudCB2YWxpZGF0aW9uIGFsZ29yaXRobToNCj4g DQo+IHdoYXQgY29udGludWVzIHRvIGFtdXNlIG1lIGlzIHRoYXQgYWxsIHRoZXNlIGNvbnRvcnRp b25zIGFkZHJlc3MgcmlyDQo+IGZhaWx1cmVzIHdlIGhhdmUgbm90IHNlZW47IHdoaWxlIHRoZSBm YWlsdXJlcyB3ZSBoYXZlIHNlZW4gKGVlIGNlcnQgaW4NCj4gbWFuaWZlc3QgZXhwaXJhdGlvbiB0 aW1pbmcsIGV0Yy4pIGhhdmUgbm90IGJlZW4gc3lzdGVtYXRpY2FsbHkNCj4gYWRkcmVzc2VkLg0K DQpSYW5keSAtIA0KDQpXaGlsZSB5b3VyIGFtdXNlbWVudCBpcyBub3QgdGhlIHByaW1hcnkgZ29h bCBvZiB0aGUgc3lzdGVtLCBpdCBkb2VzDQpzZXJ2ZSBhcyBhIGdvb2QgcmVtaW5kZXIgdGhhdCB0 aGVyZSBpcyBtb3JlIHdvcmsgdG8gYmUgZG9uZS4gIFRoaXMNCmNoYW5nZSBzaG91bGRu4oCZdCBi ZSB2aWV3ZWQgYXMgYW55dGhpbmcgb3RoZXIgdGhhbiBvbmUgc21hbGwgc3RlcCBpbiANCnRoZSBq b3VybmV5IG9mIG1ha2luZyBSUEtJIHNlcnZpY2VzIG1vcmUgcm9idXN0LiANCg0KVGhhbmtzLA0K L0pvaG4NCg0KDQo= From nobody Thu Jul 13 14:26:46 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 65A45131782 for ; Thu, 13 Jul 2017 14:26:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.202 X-Spam-Level: X-Spam-Status: No, score=-4.202 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KCFshHoO6d2z for ; Thu, 13 Jul 2017 14:26:42 -0700 (PDT) Received: from roura.ac.upc.es (roura.ac.upc.es [147.83.33.10]) by ietfa.amsl.com (Postfix) with ESMTP id 6D97213177C for ; Thu, 13 Jul 2017 14:26:41 -0700 (PDT) Received: from correu-2.ac.upc.es (correu-2.ac.upc.es [147.83.30.92]) by roura.ac.upc.es (8.13.8/8.13.8) with ESMTP id v6DLQa6x027022; Thu, 13 Jul 2017 23:26:36 +0200 Received: from [192.168.1.36] (107.red-81-43-221.staticip.rima-tde.net [81.43.221.107]) by correu-2.ac.upc.es (Postfix) with ESMTPSA id 223243A9; Thu, 13 Jul 2017 23:26:31 +0200 (CEST) From: =?UTF-8?Q?Jordi_Pailliss=c3=a9_Vilanova?= To: sidr@ietf.org Cc: Albert Cabellos , natal@cisco.com, fmaino@cisco.com, vermagan@cisco.com Message-ID: Date: Thu, 13 Jul 2017 23:26:30 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------5112DB009B33BCB65645232E" Content-Language: en-US Archived-At: Subject: [sidr] blockchain draft X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 13 Jul 2017 21:26:44 -0000 This is a multi-part message in MIME format. --------------5112DB009B33BCB65645232E Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi, We have been investigating the applicability, pros and cons of using blockchain for securing the Internet prefixes. We are seeking feedback from the group. Attached you can find a draft that we'll present in IETF 99 (sidrops meeting). Thanks, Jordi --------------5112DB009B33BCB65645232E Content-Type: application/pdf; name="draft-paillisse-sidrops-blockchain-00.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="draft-paillisse-sidrops-blockchain-00.pdf" JVBERi0xLjQKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVyIC9GbGF0ZURl Y29kZT4+CnN0cmVhbQp4nKVWTVPbSBC9+1d05RKowrINm4XkBgS2oBLKC9rksOxhNGrLE0Yz ykwL4/z67R7LX0AKqrBdtkqe6e73+r0e/YRhNoKhvLtfXfcG14dQxd4Qqt7P3ij9Cd2PruEk 5wVHMNqHfNJb7BnB/gEcHnyEvO7tXCHNfLiD7/xlXAV/Bd828LrXZQZjZaw1MeJu/qM3OoD8 S2/nwhEGh9T/HNSEXhkL4J/xaf9EBY3WO5Wjnu6+X8RyJZYQSVEbP8GFm/hQKzK8yP4u1HEG 174MpmrxV/9KkbIS6+yhMQE5xqVyrQpz+GMP9oejo9eV9y2DM05cKSexXo3qN6/zDL4q4/wb Y52aqD3czCNhHd9cF9N2qgq01r8l1rN9fENVl62dw/Ag9eqQY4lwWWVw7ECxBubRRPAToCmC ahprtCqMNTSXm4X1+k5PmWkgDxF1GxAuxqDKkpUQUXB2qn2aWDEROiltD0q0WKVrTlpCYVzJ bonZM9hKUX2/WRqjH00ZfBP761r6w2FGD8R79/9MuY+LSEFp6qLlU4ZUet3W6GgB8hdGmPrZ FiCm1nnrqzlo5aBAaCMbhfwWpg5zYudFPEIS+UaCMo22K8esLbckek0hxEZpzKRohFrq8i1p X+OyKV2QVatUqkbRJhS+HVtDqrDI2QDdvQneCfoIM0NLBdWtJdPwmtIwX20kKblRgQxnExgp 7jh4zsyfG1J3KLEVNJ7HCJkVJCasNKUiBIbG/2vvIrrY8lpb+cAp62zdnps0eyRk6sxXrP1m px7NuwSmqA0Rd4PRTFprJUEi0WlMiDpm1n1qgr83kSlOeU5Ox3B4lDCly48b1fDi7YwLTmfd AF/qZmWK5WI4c5VxiIFXbaXOVbyDc8+Ohdudi7P8/HaX+3nFlC0I9RwlQCUHQ+QWz5mj6Bc9 MEVLyw4/LUA95iZ2OmFjkJTH0gwi8dWqLlQHS1pHMCVqPg0G3C0lJrnDkBmkSeZDNUhei4Mu zuBlltKGjRLvlTVlJ4JaPZi6raWwaB6g9o6m2wNC+iEEiNcakU+5BwEbyw7gKw7ii+gtSuOL ecfbBh3i5XkHkUwtrrlIejGOJxcPiWBEkmxCdvLT8iPnmiAD1UvK2ZTcTj4HOTXv0ia1DOsu NXfPybZ36YRnKXKOSkybvdsi6jkVz3h8AaYTE9j3j47MNPdOfTPnM3ZKohWzKmp9+3ZH3+6m sQ0iK8jFs51RERoMUeRuSrHmxDBpXOtjX6zHYEtTH0RBx1xZSiCERAz3WGZP8aw2Lvz4AzUJ RxvOSuZY1fU+whceiXYr+3jtymu0iroZmXZ9XjaWd3zYTztWT0N7wH5TNlueCd2jx0tPHv+O VYUw+o8jnuW9v/n9P6i907BlbmRzdHJlYW0KZW5kb2JqCjYgMCBvYmoKMTAyOQplbmRvYmoK MTIgMCBvYmoKPDwvTGVuZ3RoIDEzIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFt CnicnVdNU9tIEL37V/QtUAXGlsGGvZmQ3UqK2vUGV+WQ5DBILXmW0YwzHzbOr9/ukYRlMJSM 7EIgzbx5/f34BYP+EAb8qe9p2Tv7OoHC9QZQ9H71hvEl1Le0hOs5LbiEYQLzvFftGUIygsnk EuZl7+iz9mg1+tMbK3IPzXWtTPqQLoTUkBsLn2cgssyic+igfX0JagPJYDg5nv/XG13B/LZ3 RI9/HC28X/5xduZtcB6xL9HnfWOLMyVT1A5Ppc7Nj2MgfMxzTD0YDX6BkAmPYPLjD73hqEFb hnvaJrykNSanZdJBZtJQovZ9gJlC4RAsriSuGYT+aF47AmKIVFjMg1KbExCO12wgQ5daeY+w McGClcXCOxA6IyDnrUz5OAdr6Rf8ZEkcayxvXlD4aDKkH+XSaD4U8NFbkXrMILem3F0OJbmk hpI6VYG23slyqWQuacP13Q3cVk4CTzjMt6Gasb/uMFKD837tqMiJXDdnX8MtFkLBzJqVdNEC NomshyU/ygiDTTLBw1pYK7Tf0Ak1ys45DLmfV5+WJ+MYnbm4V0yDjKdE2vp7SE6h1LImCxVb 6B/4AUh2kiChRzeYSy2bPJijLd1BiKOa3ai/k+H0FaCDdwtUqhvTLRajsbX/rNDGBHyHpVus Co3xPkZqZKaThRY+UA52wjp/hpXE9KSoaRcoGVRhLMW/7IR10bKRcf7Emsg7bGxjjWIsOdeW TTDTlxRfsxdgvGNj5X/KeIKh7zdjH6gBzcw36i9dmD1HS9pod148YIS7I7gOaJMa7bz/dhft wuzyidl5YyOVWwnOU5eMvaS7/9tYbOFUC7Vx8l2xbGNxLKf7wrdncOzDuqqxLto1FLs8UttK F9JTv6Ok6+D74eCJ10Xjr6r/Mb3DbByOWljsL2q7gezaAK6ECtUw6orVrklGY25T70X6QPQK Sg/q2wIoxU7vaZJle735GlayB4t9N0tmQHN9zdXwGq+mJsfse9pkY6egIWFFNf0O8Ne2isbR vq+4MvXMPjS/drCi772xokAohaZbTPzOWE09TtoxfGZmV6wm7y95uk3/nr4PZxfriuOXPmiz VphVxh1Yk1us4aBPU5fqriRCK6QY5GhRp9079hZrGkglWPcBpm/V79tYV1uh8FwQ1Ke0OuT3 a+lTI/VPoKYkfBRQUhdUGMp47gj0jJzDCSVKQy8oYXcUgmuim5qyDJp/cySwEKRvxI+DEgUF ilsTPtK5uuAjZOOzJ17VCYIw49GZdFHJ8mLm4CW6Jx3F1RYcVusK6YVqRCdaT+KJqgDrNkR7 rVDyd1Xj5A21OyVe0mzpuzaJpbCRA2lRiyJdbFsGj2k2JmpdspycaUkSWlJ+jW2O5Q51WWdU iP6MihbhevOb9KDUCH+hpqRWjgnxxDmBNUmjU85Slks1UC6C8qfeKGQdWfGT94Flr9uQ7C8d K8XxRQzQTEilJOXRCZBPBRteXZ8el5I1xRehg7AbOD/hfygu4dn1fcYdIPlJiJ/mvX/p8z9G 31PbZW5kc3RyZWFtCmVuZG9iagoxMyAwIG9iagoxMTM2CmVuZG9iagoxNyAwIG9iago8PC9M ZW5ndGggMTggMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJx1Vk1vGzcQvetX zK02oKqWXcTuMY5T1EGRuo2CHhwfKO6sxHqXXJNcyeqv7xt+2KukkQBLFsnhzHtv3uwTnS2W dCbv8qn72U9/XdImzM5oM3uaLdMilQ/d0/UKG65oeU6rdpbPLOn8gi4vr2jVz05ubWRvOf54 41Ubqb6uO6cf9VYZS63zdHtHqmk8h8CBpq8PY3eg87Pl5enqn9nFL7T6fXaCn992cevGzZZU pLhliqZnci2+m0B7b6Kxm7TQyw1qGDqjVTTOYtPpD7PlRQ20fs1DeabWWGW1UR2FQ4jch7lE MZ7GwIQ9ErI13DU5jkRAbXvnH+VC3L1m+cLPQ+c8N/TlhBebxZzuf1PeoIw3D19OF0SfHNIN o9YouB27EqlcidMmRFlGeYHuE1QhKv34QMo2dP9R9aydsQ9z2m+N7DI9gChR1qPpGklCUWA9 oqibj58WWDx/U4teVWA2DpVW2Bqnx55tlDKiI88D+JD/FUr2klHkASt75ZtwBKKgMtqGsQkJ yt0pJtPg3cA+GpCKX16xDqmQhGzJulC0Np2Jh4p01Q7+b70K0Y86oqA5hYG1abG/gzpSlbi0 RJKD+N1lvufUcMebzL1cujYpw5TQVHVg5Vepck6mImls9K4ZQdIk9SQIi02IprrDv1jcuv1U R9qN0MeaRTNNTcpVMiS9SUr/l4WVsiQPKgwIXC85QdsgreFgNrl3slDsVyAthOYpq6oL7iWI 7kZEALO4oTM9rvQVSMCfKgsmYZSiZ2Ui5K2oo0bpB+dBeJTqrItSW2nH7+oK22Q3dLEzDXgq obTrh44RQXm9NZFTBTlchi1MUPoOu1VIE44nqj9H8jfcJvgy7Cv2fS1ldf1Ovl0sjoxJPIHs GMOWuy6vL7Hjjx37neF9OfvOWc1DHDNpaqoEIwg3aGZv1mPkZl5FkNTvxxA71HPUSo2Kaq0C Z6w1aBXeRE0edfoGnqIkKjotShMDLsu0N3FLfkS0BFpFtWPlpUHS3mwV0SsbEgYhRUdgdChk 1HODO+8UulWbQYnojJ201JHA+360YqjCkc8+THfnd9ULF9liQg9MGMYhRZVQOBcF/W9xSpkp Lanh/OcAN4Gpwfa26bzIpgaZbAU8Dn6TADDIWbpCxReMk3erEBw8HQTQMK5hM/TIh0WJ9TkU 5pJvpPuwL90oaVk5DQdCn0kKjwzNBbg3lJ0mjJo0BGp7GvPFYZtMQOSeqMvzZzIQxL8FYbo2 Ub6nsQDQJpAfaO2dajR6OjfStGygIQk7/PE0TFgr2KNRqgyKF1snHV+ctRAFaThpNJZWxoSC WL6+CfHe1khSOGbBM+owYs07aDNFxPSdk7N8fFdUj8ljEn5pIfC3DOZZsIGMBlEv97nvkjxy FyTDfcEipBTrsJNdtMZsrIi8SvBvOfYKUs7Js2az41xmOj0FHJ1tWowfTAHPvdtluz5KVjsb odkEwWtjUOtdP+mWiughIaw2WRUwsDQ4WmBX5iPvjBtLJqLBsVamPauYx3hukjpAQwalKGzN yXqbLEUoudSZiJ0kBP81/qiLxUMhfIlmJTOTDbV3kNt0Um8A15T/ANOXZDzLg0D2/qYYT6rQ chmHeHhS9Tkt4f1Cm/SFuKKOUJxleQwCVmn4baR3l9PJR64YblWXpPg6OHp0A4ZAz9myXqSD HfIIClu9U6brDNp4TiwYLerD5fvnwchs+aDsKFz9PJdHzSv66nV/JwRePCDi+9XsT7z/A0gp rYNlbmRzdHJlYW0KZW5kb2JqCjE4IDAgb2JqCjEzMTAKZW5kb2JqCjIyIDAgb2JqCjw8L0xl bmd0aCAyMyAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nL1WS2/bMAy++1fw thRNvDyKpettfQxLNxRZZ2CHdQfFURKttpRKcrIA/fEjJfmR1D0U6yYfbFEU+ZHiR+sB+vEA +vSEd5pHb2/HsDRRH5bRQzRwixBeaQ7nCSqcwmAIySLyewYwHMF4fApJHnUm0nItue1daraw UI7zTKX36YoJCQulYTIFNp9rbgw30BzXRbaDYX8wPkp+RaP3kHyJOig+7oVRfTwzf6pw9CYa jEo7jx4IfXxiZnXXmWq+EaowleBDlgWdUvdCc2YR8yNa8jZuinzGUVBHdncEbiXRTBqWWqGk IRmpfBNLyWyhOWkEG38Xj0fROhoA8FxaxxMMLx4vwDD81xiO2x3QiOP4+UXc+XoW/kcmb9pV XieTw3clQxrjo1hS1Q7iHlyoPEcMxuoidaWsFsBgRqWPu2ueJlsFM2ZECjlHtkthcgMM9QvD 52AVrLWyPLVgVxxcO0DxnFl2huZ8e1CLPcaakj1oR85JC6nFpUHKsmyptLCrPK4jGMUDfAAu gq3G/pCopPS8vwpqzTWz5AbRNfKe8Q3PyCL6FXOkPULfR8gliQmd5ikXG5y49Fh1z2UXOEtX sEWcIKyBdTHLRNpba7FBb3DPd2smdFyCU4RNLrlLkNrKA1skDf4IunECyp9z75GRnRLIm9Ih OcIgJi7zEoUIxaolx5lu4CK1bsNOlZ/uE0+wwn5J4Oi71V+wcdcJhTTEjoglgP0/p4jqHMd7 NbRfyW11/Xz3PGj22Hx9svys7sRBjLJLCqnq/rflAdbNfurj+cx3gabTcHRO0qAuftS6rvm3 UvPFATW5WWaypmSzVGt6YnUHerpS38vvRBKH0qwwuMefqy4yYoA/y3obcImHlVIxMnu2B0V5 IlUV2iwCaBQ3VQkeumUZObVaZaA2LSTCQetc2gpHs0Ac6nNhU4Wo7EoYv5o5wlKwIdVkBm1o dIedBhltd2egJN4p3CYPN2WYqjUP3UTI+DCy70QRVPLqxDdTUpAKmMBJvvXLXWQPCI3XCK6N mGW7w7Ac0AUu+p5XJmFRTV3Mh2YJE92o0MyUiSwTeFPCVmKx6VW/pKvfa0Gd65rJgukdnHTp 5nR6+If4MWXYT05+osWrJPqKzx+/X5SJZW5kc3RyZWFtCmVuZG9iagoyMyAwIG9iago4NDcK ZW5kb2JqCjI3IDAgb2JqCjw8L0xlbmd0aCAyOCAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+ CnN0cmVhbQp4nHVWwVIjNxS8+yveLVBlHIyTQLixsJtii0qRXd+yOcijZ4+CRhokjVnv16ef JIMHyHCwqZFa/br7PfmRTmdzOpW/+tl0k5+/nNMmTk5pM3mczPNLqh9NRx+WWHBB8zNaridl z5zOFnR+fkHLbnJ06xIHx+nkJqh1ov3zwfrmoWmVcbT2gW7vSWkdOEaOdPh8HuyOzk7n58fL fyeL32l5NzlazOazsxnRtXeRXRwiKbvxwaS2O/5pcvZbXoS9y5apebuGTKQkr9iloCz1KiTy a1q9UFJOk0kAmy/2YABKwdu6VVYZt5FtWiVV9sZZObMTCKxleS3LD+kJlhDw1Ae/NRpvKXIm 8MTWnmheG8eawmAhRfQAUClzNI3plUuoZBOYK5QH2VykiQn10Nbw0/5YYbZSkUHrEzROLc41 iVpVilh7a/0TqqhQmfZ6cE0ywJNNJsQ0FX8eIn076gabTG9r9fHbMTXKEX83siiDd2pXsVrV 91ysxdKkXAM6A0vZWxV2Ih0y8QRksgrEmx2pzj9TOSwXRG5dwW9QTKY+kqMbYiqaiBpPrWla KFyRZPVWWaMLa4BdwdvIkExP4bPHAnDseh/AMj3XXzWsKP+XIk+aEe8OjtWDx0YF8R4iw8/k KxZyDsscbBon5yuXgxezRQ6baEydB4Rx0LFT8rZiBN6ooEVFtVXGqpV9N+lxNuqH2ySkX2oF fdTPJWEFEpmL+/i8AzgdtQTictAzB9XUwp/ULkq5DKUdb6GzZgu9NI4N+9B5bdaGdW4dsTgw 8oBtlFTXczhBl/j1lGILTE2W9QY4OSsi7ft5WQbloio5ziFdocigmgcgrPBBq53EshfFgdOr mCpQ4S9xRtnsIKwsyCHiAKKN2oejscp0UZAaDmJWIcGHmi/ymPqEigaMtnrE8rD1yKJ7wA37 xI4Vvqwx8OLQdSqYHyXt0pjjWQQxUB4YRZT9bNiBGYmb1nnrN7vLUQRuuE49YOtLoj/98xjE h0m78Zx7QZzK5Mhd9UIDT7Xl2Y+xE6OjcdT1VSxnarMxCWeKdEVVhujXz/+JxldDaiV1Ig3G yPWXuzenS8wcMwI2PurOdEZi1gcjcy9gQFzu44/EI+uPgwm5KctbKmPAec153rxXKoZVamV7 SQRaJvru/bbDATARNeQVtrCp9uOx6AVbXJPDx9yXB7EH6a8mj07prRpk74Cdu4pWQ6qNtW+j 6RuJUuKuTzldyiIyEIW3xg9CsvFBl2aVMYZA6deWuZPA/aBNtgR0rmBxVqk4n++eDuYjHl03 pDyIyhXk6vgcxyWhFd7J6zTfuAf5rXej2DWi8CJih4QrZ+LrIXcNM3yIremxT25FJBHE/6gX do03eVFNyVTYTwpMhK23W35jfKu2edI2jQxHiYxc6TH6BpxKyrb4Qg+8G1O5kjtQn4hhYHAj Hpr4ai6+tVCG435QCp78jgLePeY8hkXkKeHXgrKz/S+kj997ZDnSZ+UGXK30y1R+L13Qq+fv e7Vh+vUfIH5cTv7C339YCDNsZW5kc3RyZWFtCmVuZG9iagoyOCAwIG9iagoxMTQ0CmVuZG9i agozMiAwIG9iago8PC9MZW5ndGggMzMgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJl YW0KeJxtVsFy2zYQvesr9pZ4RlEtu41T35omnSaTSd1EnRySHCBwKaICCQYAJStf37cASZFq JI9lC+Du27dvH/CNrldrupZ3/6nrxU8f7mgXFte0W3xbrNMi9R+6ppcbbHhB6xvalIv8zJpu bunu7gVt6sXTN01k33B89sqrMtLwemmd3utKmYZK5+nNA6mi8BwCB5q+3nb2RDfX67urzb+L 219p827xFF8/eHNQ+nRP9LqJJho81SofjTatiqbZEeLGiml7TqNVQ0pXhg989WSxvh1C4dXm aNQFeVQ1rjnVrgu051NYklnxirxqClfb07MdN+xV5CKtUuMiovVxPNu0Ep0kN55MwQLvtCJ6 00iFgOqaJSlq+CgBWoVdoXKdLWjL50jnLMIOA3d6IgJGUFqCSIXOF+wlW+tRVRNlXe9RwznQ 55cmamear0sKnB9cX6+wfvN8IOCjdUfq2gLpAgh9P88TqFIHliRbpgN7UxoullJLLlRlji8p BV2gQ7M5YNv2RMpacFVwABWbygQshs7GIGUoKkDcicC+ZmHuDH9WcCDtOZHSgVVLJsp3pWkQ HBkOyli1tQmrpJsFmuXO6Y4GmwpuGVBdlotGvdwEtF7ZnfMmVnWqZBYq1ZuhCCxp05zQd8rv mEJ0Xu34XnLiP/OdyZWXotwzt4F23h1Feeg1+uiXl2RuWasuMKFFPd0A6BkgjwoaTL0YaqtR WeYW1J5BB61AjrEQI0gLHcg4Y75d3eLxVxy0N20qCkh/wEXo40lB8eioBl5qXdtZ5X+4X1De Y1gd4uHnk/N74XNW37j6Mao9X6Bar+ji8S9PH9ynL1c9EkzVfDn1eZRscBZ/KGCrW8uPIAf8 45cBGxgaB7XUMzAinaIYRL1EuzqR6rfOeGlQcDWnYF1MzUcULtG1KDtBvhkYwp7aNVDlvsFw KbTFNAiAav6QeX5Ugke0349n0kUPSEQdXR8I6hY4lQoVFCUWBxhHkIsvS/OIWVCwKow+CPjO 3nFYplhj8kEDUMqZkQR2kg4DuvVdZFGg5lXu8EFZU1DWqUAaZ8A1nCHULkR4qu7qLhtfpkYg tu4IIedEYwhlg5vESfLhRwxggE0ky2YP0STxzQIJ8toVpjwNMh+ZHmYjLyf/7id05+S/98PA bGGNVHpXJ36iaftxHDqWQB6TE+eGMz6LFCNbw9j1kEy5txikHlKs+lC/odJ+BmGU8LcYkZtH o0/qTMXPpdSXWqmhZ0kU6cseUXLcbIJpcSwu2/PgfpmLy+JA3V9wF+Be9tY5qlTBEWqJXiks lBmcAAFWW86JyhMm9lNBCBDAhaWluOgojiZRZ5Bzp/MXFokZRtSSvUyX5YOCgkuUhY0hHS5C u5x4fX19/UHo5Ee5USg7G1ysuQ7ahT/8/vBPZu3LVS4Iw5OeAyxXp9HXEC7o+BO7DonyXpx9 iZOzKU38CLHw6ig6Cvezaj6YsBeSHILBxIB9cH0pXSwXi1Iy0siFAPEwcCqwHDyXZj/RRC5j dHbGWTi2SApKd4tcnta4O51tY5iuyx5iR0T953Y9Cf+bNWhDq8nRAdqidzZPQS+kicTTATm9 jMiZNskwOYOSELI/yVEP+Id8KCbOxkQ91CynuoPEoG0r2CYXAyksz2VI5qf0YNKCx7VyfRpm t1K+OKpMx+S6BgM8GBGz7BGBwfHSLcrNKBsvlk2ckIUwv9yktj3g3mFxpqIyBht2NdxdXz+2 SbNvVdMpf6Kfl3KTfUEXr88PuCbQ86+I+Hqz+Bvv/wBqmLruZW5kc3RyZWFtCmVuZG9iagoz MyAwIG9iagoxMzI5CmVuZG9iagozNyAwIG9iago8PC9MZW5ndGggMzggMCBSL0ZpbHRlciAv RmxhdGVEZWNvZGU+PgpzdHJlYW0KeJx9Vl1TIzcQfPev0BtQZRwMSSD3xiWkwlVScYKr7gF4 kHfHuzr0sUhaG//79Ej7YRsufFO2Wj3dPTP7Ki5mc3HBn93vwkx++PdaVGFyIarJ62SeXhTd r8KIz0u84UbML8VyPcln5uLySlxf34ilmZze20jeUjz/zct1FP3HZ+2Kl6KWyoq18+J+IWRZ egqBgtj/+NLqnbi8mF+fLb9Nrn4Ryz8np/mVxm3Jz4RY1ioIfNXSlyI6UbXSS1xKIihbkIg1 CSqcdWYn3Jr/PTuZzK/2kFYjF2nLDw4IT6+t8lSmS7bSk8A3YDoAZUtqCD9sBKHbABhBb9I0 mvhPGaMsXsiLgv8pEtQB7Ig04oOIa8jLSELFqYjyhQRIRe90z2qPN+p2q4i/RijmkKpQhdRi RZbWKibctbJSQ9ZAWieg4VbAgE6bVRuh0gHcHmJ/dS5phrdc/twr+UeP0otR7D7BaBULx8q2 0RkZmQyuhjOeJJt97jZQJipD5x95UzhW8U3FwQuA1NQhica7lSaDF2QUlqgMXMMK3ju9gV/7 gjhf8k2OkyZkVm8vP6WzSQBZFK61McXyL+c8nQSh5XY2ArHB0Cm0OiZG4GhayxRrCRwKqrK4 2yirbCVCQ4Vaq2JQeQR6Or19uP81PJ1l/ihmo3Ac6Fw2RRXVBlqXG+RZVgSy97Ca+XIS6C2O UHtZWMF2AxSNbgIb4wrPak33+qGzcjzeSI+3qAZvBGWAICqDR4c231nyFTtIa1SlOpsX7msf Z5bLV+BtWMfAvlE+A3URaQhrjm3uZGzaCAbOBkhDs2o2FY9ZxbX05vnpbI/J1exqdglFFt7h Anw9pBZ5Ol24h6ezrrJlyguXUxIcpxqdenwCamb1ewmY81bFWhjnD/MoMZ4ic0M0Ah+Gc9x8 h73ILcBHhVYvpHd94tI7Qh+jr3wBWzntaj/o7AwEZhUCkLobowVpgLbbGq2+tT05xkpUIMXv oEWyqNEI23zdFFFKafQMhn6nIiKZmI+lM6C29s7stbpWucMPpIi7pmvaLamq5vPcIr7kpIAZ jis/cLjtoNatLaUBazQpZGtNw74OFriHQffQgvFQXi03tF8bR9ZyG4TUkDWaFBwBIzfKtX7M 9G482vuUremAkqSHSX4fhEBQW6b5LTXvLZk6EFUi31xdbnieVtkqFQ4CsvUqNZCR30C20XJH PnwQEbIb5Z1lfXL9MnQ0H+/wVk+teU45ajzBDIaEkbXCAo0OMwRjDhJOU7VpfgbCT6k7kPGm IFboYKwSmzSXGh1d7rCc2Gn0WIWiHhdEnmc0N9jYMx0Wj4DRuDR8wEiWqjIdo97IdMGwxIPL GkG4k7641Iqll9sVlkf4dGCGw3CLGMI4al3sZ0mensjQsKIshN2bFCmYzh/PkzxwzukNmyiw hUhw0eo8XGbHF9/u7WjTQpmKIqKmSy4gdxBPcLRDao1hCfYxO7592DQVF/zdrZ2fFVzTOLYo hezhcPEqi+DHFJPhEeQ7sDlYOo0IzJaD7Pfxn6b1P2gMdN6Sog0cMKwTDrzmzYbOKo7n/t85 xY7zCUlKmr5rICbETw8hTaAOJWmY1E2O917b49MM/n+zCuuEB877R4Q0enx4vx0HU0N68jLS qoYz0N2V6OUt+NNlwltIpTEDA0pDAKSe9U+hd29NWmxfpMXT5U78OOVn0htx9PG4wJYW189A vFtO/sHnfwixpBBlbmRzdHJlYW0KZW5kb2JqCjM4IDAgb2JqCjEyODYKZW5kb2JqCjQyIDAg b2JqCjw8L0xlbmd0aCA0MyAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nI1V wXLbNhC96yv2VntGVi3Zjd3e7DYHpzmosWZ6qHuAwBWJGARoAJSifH3fgmRESZlMqYMoAdi3 b9/bxRtdz+Z0LZ/+W9eTnz/dURkn11RO3ibzvEj9l67pcYUN9zRf0Goz6c7MaXFDd3f3tKon F08ucXCcrv4IapNoeB6t16+6UsbRxgd6WpIqisAxcqTx86G1e1pcz+8uV58nN7/S6uPkolsJ yhW+djhCyVM0paPaB6a1RI6EVWptMrVKjBClIGnvUvCW/JbD5U+T+c0oXKqYcj4zrCzeDSue 6CGSbxofuRCgpf97SjqwSsaVkjuwTCRE3JNx/KVhF82Wp8jIaSbnT4G0r5s24bh3ylLjdxwk QOC31gQuZkQrpLL0z1S3MVET/NYUTDUrJ0wRrg8U2bJOOfGtsqbo0p/SrjK6kpBp3xitLNjL HutdCSjv+Izh797aNiIhMN1QZcrqKib1yiGSVq5jy6SsKClvGSj2QNhxSlE1Dasg1Vr3uY0g b2c/VF/43c7m2LQMfm25JqSSuGaXeupSHr/+DO6osyScKpCN8tu7zNtDfWX3X5nMBq/QZRNU TKHVqQ18lC1oQ8b1IR8hPNRcQcTaWFApuAycwYDTBpP2BylSUIXp5Vz++XS1VmIVFXRlEmfE CDbPDWuz6fXYIbaps28lHP92qsijcYUkBsBDcQZr45gIWnlbQNCXiyaYrcjyyvv+z5fLWZ+c 7+oFVK+z57rOKOCdsv/9XQxVwy4CY846pYOIZy76HzkbMUXjrS+lEJRz8nDZywWXs1Och2dy bb0WF47S76gdgFciPgT2oVaDAZp2bY3ORGOlgqiR6UBPTpJfYcQNUVr4CBUmg5IYQTIhcpGH 8dW35VjVrj/hcAWbgteZiA/Ieocs9ug5KQBimk3fjFyabjYNMiIr1RULr2cNNeqOI4iP4NOo kIw2TTeRvlHoa8anSuxMqnybTiG6+WNylXJtZNxVJhQ5/v5M7U+MEpp+/hz0OeYxGurg7x2s b1I8hT4rxhnYMvAWxKhQSWHKF7mRMlzPphvfsIfsAi5QRrEwUBYQ8EGGQjRxNEdqafnQD2Pc HVwZuTdOh8K3Rh05+4jFuL9kAlUqYWs3PuGQ1knHJO/hRPzpMT2ntPapkpw1N2nIKduVoq+Z NjikZOyhUZBFUBpOhG+NjmdOA5U9ycnWqXptyta3EbUeLJAvrsEYUpB3v+TDS2WsNZBnSvCR srPh1n3/pcFdFOmDcq3CxXY7lTv4nk6ef5aqZLr/FxHfryZ/4fMfrxiWgGVuZHN0cmVhbQpl bmRvYmoKNDMgMCBvYmoKOTY1CmVuZG9iago0NyAwIG9iago8PC9MZW5ndGggNDggMCBSL0Zp bHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJxtVk1z2zYQvetX7K3xjKpadhInvTkfnSqT ybixOj00PYDQUkREAjQAmta/71uAlMjEtmdsU8Du2/fe7vKBLldrupTv4bduFr99vaF9WFzS fvGwWKcPafilG3q3xYE3tL6ibbnId9Z0dU03N29o2yxebGxkbzn++sGrMtL49a52+qArZSyV ztPmjtRu5zkEDjT9+tTVR7q6XN9cbL8vrt/S9vPiBR47ovfKUsEUvbKhZO95h39jz2wpVtys Ln5ZXL2en7cuyhUVgtlbnI+OYu+IbTTRILGKcpWCahDXNCwx5tl25tHscLNr5bIizT5KDbVp TByP33e6ooAntfLUetfikIRv1IHJRGodABQ1Swi2jyaoPUBRcaIEcdbXI/RYAZaqa9cHXA7U KkTTplUW/+y45r2KPCEwxwnLEQH4i25AVrme3pmoHSCPxAWSf8OK6A8IwU+qaWte0ub2yy0+ 6eod9d4ggxpipHtKR+NsgqVVNHY/kU9YBYtfN18Boq8MyJB0nbc53hBnuMtJrfHS53SJowac 906QPIE2C4IaqES12xtNOmkxhNlxaURLFcgyizbltAzP31lngDPkJ1YFQhh1LkcZ0p+nipw3 e2NxEBY7ErInxxxzkJ3DCXFW5U61pQ9SINSxsRLKSNrlFAP8pjW3kZqujgZoQVPbQVRlxziu i/JkSWbFK0msfGEQwgNF4zowApxtV9Rg5cDHQGzAohcyAtudiOv8EMuzZvOIR4C0rQzsyICS ocKUeDD1ZeFZHQQJjnnYM5tqwtOJHOTy/NAZNCAi33Pm95UYX3oFeZxH4zD6pOaxMGOhUqOy iQqUCRxAoLyu4DUNs/CkgV+urhFa7GhRVuhwsN5DlFg1P02PIcEtGIhZMcYROEHs9VwASYs+ tqC1Ts2Vypu14LkzE3dMpfEhPhsNBefZIrhmHS2BepB15/5ZJmIz6cjtmgY06MoZzeme5f7n u0YMLV2QWBMV/3Q9Q9A0UlA8y0AI8gSF7LzqC3WW7NuLUZlrkLn+dpESCSeTyRFAg/LGzWfn 30HaByhhRfmrRdpkMTVayCGthmQT0IEqnCgwjWdMiiny4O2dP8hcQPcqqw0gyyj0zkqJk+oG 4VSrClOnphuHGVCfmUpdk6e3QJGDkDFdTUsGk5PrEvK06At0RVoSQ6AfSxsuTgftaZDlVld1 r44ie9a6h/SnzmcDRWTpMSxiUh7qua5/LVhSDMFnlvqQUKVPp7hckWbXo0ygfEvFCE2FlHHx 5CdhmImohIXj0kSFRh4X0hcstPq4pKI75kmItYCefuhUnmOIXim/65XPvY9EwxjwnIf/GdQZ eCqbSlUHtLeKCh7j1X6FYWW1wz7WcVxPadghyebuLF3u1m8X4zQy4hatupCSSQwZspPaZ3vP lWe+5y8PE3xSjqhVG3sYVBr0OSk+REm6z12/kW0lQyHEZb565x2g4Oc+yiL/yZawA1QfqHpu eIDNJrWGhEueHItXoRW6TCo2F9pBo3PnO6gNRkY/CTJ+SpMq2x2qTln4XWZCn5a3tOh0K93e Y2NlGLKw5GZ2w9BGSabpeAeJaYLX5gATjaFcar98Jw/FMEjE0vqP8kKDjdBpEH/SMsHHYmZ/ pn7eDFMPHIcKQleWmdc8cR86RkDUeCoMxeT5M75sCqJjazQW/BEV87DmpOBnqp2bkkKrwHSq Ibul6DAB5ZNBt+S5IVMaO7Ju8c63RKDXr5Lud1h2tQGB8jIDY6zG99mPTy02ZaBPynayxl8u 5e32Df3w9e+dvBO+/Q8RP24Xf+H7fwdD0pFlbmRzdHJlYW0KZW5kb2JqCjQ4IDAgb2JqCjEz NDkKZW5kb2JqCjUyIDAgb2JqCjw8L0xlbmd0aCA1MyAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nLVWTXPbNhC961fsLfZElvXhxO7Rbp1GaSdVE830UPcAgxCJiiQYAJSs Gf34vgVIi5SVpjOdUAdbAPZh39u3K36h8WhCY/40f2UxuPx0TakbjCkdfBlMwiY1f2RBd0sc uKHJlJarQYyZ0HRG19c3tCwGZ/PSK1sqf/GTFStP7XOXG7mWmdAlrYyl+YJEkljlnHLUfT7U +Y6m48n1+fLvwewHWv46OMNyJjaKZK6EJV1KVXq9QSDAfIZ1Y62SnkylrPDalCTKhJyStdV+ R2bFp85fDSazFq5NcoTV6dt29V1tcdAWxqohY7taZvR4SJzvstqtA6JYK7NRSMeRVUktVdK7 QZqiEtggb2hh/hjGYCUcskOIz4QnIWVd1DlSLlMSlAubKhKFqUvPV8wXQGSsg1Icuau0FDlU 4jzDPbl6YsCyD8g7Nf/XoFRmq+yIaPkVFiJ3hgrtdSo88u4SMCwLaHy+aLAehcPOQRo3Yk2R BHA6gnFK3gu5RvTW1DlC6h0A16p0DdLKmiJoE+/AlV4rN6RtZiCXVKgzpCkMiiXsLmSF4Fhl b1pqHCV1hcRbT8R7kdZ70AbDUFDRTe7Yhg1W4BCTLRQIIGNWs2fYkPSJhBNDpfENULCsODYt y+lUnnOS2sZ8HJfigI4T0a+h9o1+YHKnpKidin7WuBIFIVFVwA9Bj3zdStuCJPyvE1aDSYoG SprSQbuaS50atEZWnBQlNs4R5zadHGeD+i40WaJylcbvnV56g2x/g+gbrbZN+5GwMtMebVrb ltuSpe6uw36Fli6czzSaGXu72AptJp0Mev1WYRMKh/KbROxeuecmR23Alea3H28puKZiSO2R 5C0KUZqERbe1ayvHJxFf1Y+5lrRWO66uxizYQjScFZSqUjluRitgRhlnjnM6LUMr53mD1HJv cneVkMEB2sMDK3o4W+mUec8ezlm+w7x7fdF7jr4erbzYfd2TZk8Npzhh9/QZeYqgd1zdByFY VRUOvxcuezhrI/YNlz0toiC/qB1GPg4urN5wTFzglfHluL2ke3r6cP4M8/+ZHQb2i+ddI+fo gn5+WaKewnPPpUF/q1SXB1uhfEq0Y/9UX3a82FM5M3miLA/Ce47vOaMR14Vp8VVTHJoePYU5 XLC2EXYYmi3+hLiAEKPAL8VQAQsMCcYIRavdYeoLKtGD8HAlMG6eDXf13Q13ePbHVeKVTw2P fzXct30bZXhhuFnHcD3fTo99O+1TP8nsv3I60US3i4/zH485fQNmcnlzqokm372Jmu65Qvfc Pwl+r+hM26NGevsmxC+EznON9hiSwgtNPmqx7p8qDa/SB1HW/MN9NeS3upsjtn8uBF55JuO/ gHi/HPyOzz+FcwYcZW5kc3RyZWFtCmVuZG9iago1MyAwIG9iagoxMDI3CmVuZG9iago1NyAw IG9iago8PC9MZW5ndGggNTggMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJzN Vl1v0zAUfc+vuG9sWleaFlh5LGOIAJpKqcQD48F1bhuP1M5sZ10lfjz3Og5Luwk2IaSlUhN/ nXvOvZaPr2DQT2HAv/iW6+T57ARWLhnAKrlK0jAI8SXX8GZOE8aQDmG+TJo1KQxHcHIyhvk6 Oci0R6vRH7+1Yumhfd6URv6QhVAalsZCNgWR5xadQwfd50NdbmE4SE8O55fJ6DXMPyUH1J1p 8LXVPRBlCb5AqIT1itYSHjcLhVZYWWx5gpHCI1CUHEtc0ffhsyQdtVAxLiyYkSM2tGCj9Crg yNpa1L5FUUbfQvcBvhaoQRAcAzGFLWyE9g68gWu0arkNKJ3VZgmiCRU+W809UD7C5GajSyNy F5YubvMkdN6Ass5Wd2TNY94K7YTkMC5i1RUz4Xkr1OhUVNkLOd8UShYUFwpBsWztPCl6p1a1 RXgJFREj5S2S0IA3Yl2VGHjvCDIaefpS3XA0FIRKvRx1ls1cnxBuC3d0vPPsNfd67owe7VTu 585O2W82PTN0ntmE0ffCFRcH2eR8EkajtIfAuEpIjN/TelEqCR9xCy8uDh8O81dlDyUzabf0 raZZNj17rKaXz8e/vzua0qeiaTI9z07vaGqrR80vaqWF5+3adNKE9EUUtatpuKOpMzAKE626 5tBNx//VNMvO4Y6mP8MMR/dqejp1ekeiqFKP0ZQOho2oJ6rp0+Q0bL5H1Wkw+Jumfz/9hq/a 04+f9rTuH8NZPJ3XdenVsal9Ve/YVscddg7kTDuV477XcNNvKyVFCaYiwwuuwsf7Wmix+u07 dLJm0/vslCxKkmcskEx3qTTmPXA1GYNobC06cTSQxjxoycXBMiiK6Xp1cUiWNC/ItwosqxAf NXmXbAjbusTIoRO3Ybgm82I/MzaCKe280BKJiNIBQLluVkDxUvsDcyYpOhTJnIOdRSCNGyCP RgvSIm2bnM3x/kyzu25MXeacCIuXKHn6YhuRWIOhPwva5HwJWKAUtcP2RsM3jy5abkieNuzY 19hhVNEBpogthgxRuShFa4rN1puOh6E0U6HKUlGCeoC8Mfrtzj27qRRlDj4IXQtLntbj+9Z4 b39/m3LV0/Q7QZ7Nk8/0+wUhSpObZW5kc3RyZWFtCmVuZG9iago1OCAwIG9iago4MzQKZW5k b2JqCjYyIDAgb2JqCjw8L0xlbmd0aCA2MyAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0 cmVhbQp4nLVWXXPTOhB996/YN9ohDbUDTXhsoQwBhsmlebu9D4q1tgW25Epy28z0x7Nry42d XmhnoPaDo5V0tB9nj3IFx9MYjvkN37SKXn2bQ+6iY8ijqyhuJyF80grO1rRgAXEC6yzq9sSQ zGA+X8C6ig6W2qPV6I/eW5F56J+z0qQ/0kIoDZmxsFyBkNKic+hg+Hxqyi0kx/H8cP09mr2F 9ZfogMwvj0bP3nDP8mD25eGLKJ71WHejA/eHreUbOg8mC7MfhSsuD05XX5fv2EJg9zC9kYcX KtfCNxaD9Q5cLVLsD1k1m1Kl8Bm3MLs8HMAMJuJ2oVXXwmMwwKORPTGm91hizrg824W0vFjB KezH9HuYeJq8ik8exhQPYvrzaiUnfbV2zweVc3JPpkdwfiuqukSQXUzKaPBWaCdS/k37d8xZ oSXCVUrnIOAHOWpNWZprtKAcOMUwE9hgKhqHgCIthkhQCAfKuxF/hHMmVZRJCXUXP8FOQGgJ RhN7JdaopQN2qkCoLV4r07gh7jQkaqnB0BoLN8ZKNwGLBMWuVkhrgfpF5zxsce7P6o5RLXwA Kkwp0b4YHwKwLijIVGgKEKTRyE3XZULjzSjQG+WLgMWHOVHRDuEFbBrfLczQWt6raGwCwsAn UToDqdGe84syYG22LZzSyitRBjfh8iDrajm/POy9FHVtDae/RO+6QqD2ym8DksRUSeRi7LJU GzpdkYIo3SWddpTb6aj+f1057ptm1PKd9ald9kjL/7rLkmfsstBf80F/jfqF9FAwmzN1O2i8 UbKXnruKyOwL0MZ31BVEmJaHrfozGyVhMBkdVEITnWu0LRaxYNxqFq8aZVFO2ktDaeeFJkV1 3ti+LTZUe/5N3p1egG6qDVrHDOXJ5SrkqnObmEJW4qrWpmGgeyIuiIjPS5s9Vd0xp7WcURS/ 0NyRNg/JB2PDPmueQr5kn3wJL+A8mulD8o2vrcdvimT2+s3vY3qGiyKweDFg8f9RhBnSkWJU 9lPSR2YiaRXreWUIKjWMcjukaS+pLY8lqCxI8a7mRGyRY0WCBKXJKYGBynydUGo/DOg8AYfU X3Sk60nhmJnWVL32qYzUl7FqYT0JHhUiuNB3CMdD6usU66sYSfu1KJWcBCj0KRP95E3r6Eqo slT0J2xCEyTh0z6L57d16+wnoRtht/B6wn/KFntl/HdFMVKd/yPE83X0D70/AYCMt0plbmRz dHJlYW0KZW5kb2JqCjYzIDAgb2JqCjkwOQplbmRvYmoKNjcgMCBvYmoKPDwvTGVuZ3RoIDY4 IDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicbVbBcts2EL3rK/Zme0ZyLbut Xd8UxTN16umoiWZ6aHqAyCWJGgRoAJSifH3egpQoWqUOlAhi9+3btw96o5vrOd3Ip79n9eSn z/dUhskNlZO3yTwtUn/LavqwxgsPNL+ldTHp9szp9o7u7x9oXU8un21kbznOPnpVRDpcH4zL XrNKaUuF8/S8IpXnnkPgQKfXp9bs6fZmfn+1/m9y9xutXyaXv1zPr4lW3gVSNqfM2XB1Mbn9 NS1iz7OlWOlAgbOonaUd4z1l9t8Zz5ma043kiu5l5bNKR+xoPSPa/O4QLXN1ozznFB1Fr3It MZWh1R/PpG3hFYfo27QvPI5wLPKtslGV3XN54og+csYWcYz+zvkj/emo/0246bgXVNE7ExLW zZGmKelIOoyg4QpVwqZqZ0tSxhCwRp3pBpnD9QgOkiPbchGmtPz8gso9UuPlQmcqgnbLnPeQ cl3qCEin69P3qZfHRSF50cbKeZDDKXLKAGh91DMkX3TdGOwGds+vvNe2fKQF4RuheOO2DHTK EqugoYAN2sYeSqmxYbN/D0WH0GohAOl20iUbVNd7UOIEIRa73nOhvwEimtm9jIyN0r5vUOp3 4t+kRGlTUDVT5UzOHrpbi1qgoQxiTRBPsQ1hdhp8tGiZ3TqzTeCshNM+n0mP9meULNkG50Ol mxmkpENECx8paJt1uu2BiWLVqMZzVYhmDUcGc60F7LS/q6ATvDCht2ir1D9NDzxvXd9LVwx1 jCbzUJS8bxga0bXE6CJfBOGhRi8SqFQ3hyGS20ToWJjQMZzmB6lPW8aWM2Q92CEG+rfVroXE dha17FRItXqHtJxPu8dC4aHMrPUegzVEGBNHIWoZGtTHfisRENE1jQv9wCfeDwkS9UOo5eJi VAd9vYTyFeHVDVcqNX25+Hp11ukXXcNqctmLDXCPgEY/y3iTdRGdeGv10XGwSA44PNZyTjM9 6vXvbseYFviDpZX70tkEpC36VH4vQdAW7XJMqoEgFAZVrEaGekxuZ8fQHRbQ5ZkrZhvxSYkA 3rGJgsMoqBhV9nruLiczXcNwS655UDB8p/ODkwKT8NLsjSoaNpP4QMUql5LU1un/s5JFC09W G8OPx2kXYxfkOUOl/e9+VNH/7FVmGzehrGNglH8wXSk9xxxB1ZZ7fUKUHvZohaUCung3DAOd vWOM4OIQ3Enm0xNBmpY7PvQeLXLSBS+Onvl9E13pVVPpjMpWQb2RcaDQ4qjT9/CBGWcTWica DvsQuZbDRJ0FF4Z2bMwMJxj406E6NbBx6ppBiNWhxukBwH309+cftaZjweyHQIeswlPpHKhP w+HaoxdVuqxmwPCK2T23RReinADORSRSTZOOir+hYXFwjETSBgZaxjAX+Vcq+XsOMzBOnfEj ZUNWuujcXWbBn560gkD+vGDDSsEdYGg8JY5Q1/Xhb8nTt0ZLvZ+UbWXIfp7Kn5QHGl//rKBj mt/9i4hP68lf+PwAT4X4+2VuZHN0cmVhbQplbmRvYmoKNjggMCBvYmoKMTExNgplbmRvYmoK NzIgMCBvYmoKPDwvTGVuZ3RoIDczIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFt CnicdVbBcuM2DL37K3BLMuN1Y2e3Sfe2mWam2dlp08S3pgdagiQ2EqmQlL3++30gKctOtnJm 7EjEwwPwAOiVLhdLupRP/i662S+P11T72SXVs9fZMj6k/FV0dLvGgRtarmhdzZLNklZXdH19 Q+tudn5vAjvD4cPvTlWBxuu2tcVL0ShtqLKO7h9IlaVj79nT8fV1aPe0ulxeX6z/m139Rutv s3PctkTflKuZfLBO4dvx66Adl59p3TBtJvTa2Z0XH7xlR8pTh58XZ7Pl1YiFK573pBwLDS7n 451CGWMDbcRBZ7dcLmC6+jWaflqsFkRPXAxOhz3xVrWDCtoaHIkPl3j8JQQVoWuQ8YEUPdin DxvluaTCGs/GD3ja1hYgTSem4LNutCfPhaBRj7SwCThFrQaErSggxs7it+MWfg1w3/o5CfHB WVjh7ymoF57ckTIlNXZHwVKng65VYAHv3oS5jLEk49ppU2pTZ6qnN0GoYucFL3JURvdDG7My 8v551BNX1My6ErUCRu9sLaLQW4YM7CZIRaWAqDvczmkH84haW9WKB69rM5HLVYwWlUgEeQTQ wWpog+4k5tEcqBIFOAZn5U4GCieiQi7ug5ArmEsvoqps20Jnn2nXsImnU0EQRqMkHRlH6KGO EWpOOsBT1w+BJRlttOstwt20PHJ/Pt8qtxdS8rRUQWUolFmXqVrPF5KsCiUANhA32qSUh0YF qpE9H60bXTcMcSQfuoVsM9iUOUjC4qxL/qUaYlkNYXCc4g4SopwWUOg0HYSSxhjZICmILYsA zb+z7mWRZR3TVgKN8I/jnpH/Mg6BMQWGv4ejfAkp2/fWhcFAo+yB9Jc0M2oHCZwke6eBEZMc az6Riv/mlA4m6Pb/tJggVLtTe2nBFk0oRzPMwRFiS7XE4QQbmTje7FHxbawXFGqOpHQEcySl qdGk70XyGFQmpNQmdylGbwdXsOA4hGU7g76gQeaIcDkmOvWSUJR2TBqUMdYoFw1Ui7GMRktd xqUuwruel/H2J8QQVRFSy+UA3t6WWlrDY49XgylVhzDQVaVTu02cTXg4DqITlnkoQb15isvc xSAZYMwxy2le2qRFbQogR1GfJLVXLuhC9xiHIpF7yX3XwQgTNwP5nMqclszW8C5VJAM5Lhjw YESM8tlOF4jj4BYtyYt6Mae7WPAB7Qd3f9hd3DCxbqVln8FkfTS2LcdOmjYdeQAqp+0chAB+ EgD5xg6wgvk7VvuJS2yqo5SgDnOZRyiKdNWGZfHhTtFo3k5zUUXlY5mI0rYa8edUHLPrVZGq kvWsZCMNbkz3uNjfyeYKpB6Vqce2HDPxRYR7uCuK6dmBXydE91Q4TILkBzdfoPfu0LGiHwxw e7ophHDQ/WGxTKMZ2Aiw4D4MaNA98tvpVrlxImUGBhId5wNydvao/YuAYc+7tAjOpGpPeQ9f IbJlElYs8lS+n8wH6bje6S3KAP+V2jiISEqiEk8sCl00kJIqCqy7OC/sEdDPJpMbWvaY9XFC oZdT00tjJOGh/ZyuMftb6cVFRrplw5UOWe2HoSKaaQcsEHlhEPfTWh0bbZpSGer5/BigiALd JN0Kusrmh5eBdBCMMWcc7xBFkuCnVSzhg0IgGq98c2K8sbSL8aXv7nsfp8BXZQYsP/o4l1fA Gzq9/nmQF7/lx3+BeLee/Y3PDxlhf6dlbmRzdHJlYW0KZW5kb2JqCjczIDAgb2JqCjEyNjQK ZW5kb2JqCjc3IDAgb2JqCjw8L0xlbmd0aCA3OCAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+ CnN0cmVhbQp4nHVWTXPbNhC961fsrc6MoljKh9NjPMlMk8m0aq1b3QNELknUIMAAoGX21/ct ANqU3UoHUSSw+/bt2wf+oMvNli7lW36rfvXmjytqw+qS2tWP1TY9pPJT9XR9wIKPtN3RoVnl PVvavaWrq4906FcXX21kbzm+/uxVE2n+XBtX3VWd0pYa5+nrnlRdew6BAy0/30Yz0e5ye/Xq 8Pfq7c90+L66wO3YMUWvbFBV1M5Sp0N0fqLoiL0KTIoGNfVsI/WqZkIa2eK8brVV5tVPq+3b OdbxEcoG93cf5vsHbAi6HwyHSMGZMWVChohspGJU1R3JVV1r2yKj53v2kYzudczr+H8SraXo o84bcXkXqHVyfZSYvfOorlOWfs17wkbQ6IBoEmfw7l7XIEpRz+BAcgGfrnUzpTIXFRH94k6C a03WyR7EjSVOp+6xltmSaxqjLadWvMxOJ20MWeaacJcfpKHKIOXoKy6xJCxYrnWlYsrCVDnv uYo0A/kakTHkhChhcAEBAb3OjJZAboyAAyJsXaoWjk/dhGr37mZRm9y3LtIweoZIoh9DRK/m QAiAjvwYtU9MhV6hCNW70aYEafmi4e83u8128w45v0sPsGJQPupKD0r6XoLu53s2BhFVxqRM C2XFri9MAZQyJzUF6KeVRQn0Gv9sdS4J8DRRr9sugpfHNpw6tvmRQi8CG9AIrtAckzSHKDbq ew6bAuuaKzUGTnWBsXXivxGlU+PLiOBZh0SvQ1R37LMQMr7c5RKqQosBBYqZCIJq2MsQNd71 OeiIAgPH5+E2eV5qLS2fQzkb0AAG3BkZEsYxESrdSxAk6uD8jHFYMLzUVs0VNA9qcN06Fvbz iC0VUcDP3c44S5Qkf5FhQXLWXkFj3InYurHt1oQBlliGZUSymG30zswibZ5nBpaXGhvYwT3e YDRb5atukr6MgbyGENoSKnA1QjuTZKgwWOGZJneA/Cl5DVTcIlXIlO13e4xkPME8SqQ0KwiX 6hmgehaRqrI3dyZN3En5Oo/oaGv2ZhLnQbwzZZbYNJYp5QcUaluxUrhEn1lDqdiaOrgcjExP gfWf9por26K2z59/u5lBlh03IvDFvpDGQNsuaRGjflQCCvmFBGFWR9QGG8jKn84KKUygPaJX 9lBS6zkpEk9wbijJhgqXSJIBzjLGbq+M/gc5A3tMxvOcxZDrJ0HP7InhqbnTmDXdwCABxo79 EXGe6V3UadN5IuwmFcr5kqxk9n4Xgj6aBPiOeRBHnm2jcsP0UpovWBdFHRZnZ2Ocq58E+YnC gFmDdcRpSDQtiEkzDc6S+VWeIYN09BnlIY1H5Z81wHAr5+FTxnnw5U4jbL40Z3fHWHZ7oTc8 e1wNG2xxuEg2l1blXXh1QIsb/cDh9tU837xgeJm5xJJpT4jneZcdM++yx/LpHHF2lpedhBoB TE1o/rGYcLZ/UzrRw4djNislB0Brzgaj+CbDaCuxdIsDbO5hoVyZgEOSB7aYWmcXoxU7L/CH fGQ+c6Tbi2UBb2AMztaJoZv0UvP4SjOT0qtJzBNAyxsM4rUIMYIqMahxQPJTp6vu/HWtmG4Y jE4H6of3qfN7hbNQY8WaWAjZzK90Xx6GdCZ/Q2iFU+bdWl7wPtL558+9Qn+27/9CxC+H1e/4 /gvPBHZwZW5kc3RyZWFtCmVuZG9iago3OCAwIG9iagoxMjQwCmVuZG9iago4MiAwIG9iago8 PC9MZW5ndGggODMgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJxlVk1z2zYU vOtXvFudGVe15MROe2s+2jqTmaiuZnqIc4DAJxEVCDAAaFn/PvsAUBZd6aARCS72vd194He6 mi/oSr71V3ezX+5vaRdnV7SbfZ8t8k2qP7qjd2sseEuLJa23s/LMgpbXdHv7ltbd7OLOJQ6O 088fgtomGj/vrNd73SrjaOsD3a1INU3gGDnS+efTYI+0vFrcvlr/N7v+ldafZxe4/GVL2g8h 8iV5hxWpZbK8M8l0KjG13jYcyG9JkVVhx6Q6P7gkV563evXTbHE9ImrlqOcAMh3QTCSVktL7 ORYtb/KiN/Mlvtdzons/JON2dYngCMIaHAaHfe1Rbq6WK0LdBx/2hCo3p4IjNR5VOp8oHXuj lUUBQwRHd5xQiqyHYNKROsaDzsTukni+m+PRBqsHFO0Snk/GO0ITDVq9yw+gzLp15dYHn7z2 FlAxqh3HufBFlezUxoJN75OAZS6NiWHok3nksUKs/sOHisVPqustOh971uUJ1Ia2NxT8buBM L4o+tqEm+B5cDpSCclFp4RovK9KhNbqlQ16Y+0ND3wAoQtQs6XPT0JwGCqvHqnPZpOIMTvuu G5zJLOZFCt5uWUsRDiVLR7KqewMc8UUpjBru2TWyYcVq/SFvLfIpu/PoZ9tBCgswtIk5xMxF 1iTfe+t3x4Ken6kotftn7sHFv/yBHzlc5rWdj2nadeV2HPwwOu9EGSaBEIEn3hid1auQTGkq mTnPyURvVXEn7QDXZzNkRbbBd3lvmF+iULnKlREuevl7lDSIP8/aSqyglcfdQA8XYsNRxa+/ 96gFu+6NBPXbw6uqgAYr/j6w03wqptYmZbUKATj4ioLGRClj7OW59AFYgUVbibu4srB54fGx Fdj+X0Qjw5wuiqtV37M606+0JTCIOsgr2BWrkgA81cwejLW0YYHRKjRCRashlkZHDo9G8yk5 4FCB7pLUCpaplcTL8lz4O5O0R22tihQHWDUgPtF0BuPqxVz5itItlExcrn/730x6LQ1/zhdp dtGH2Jq+QuR2qDo3Gthd1bwhSLr1XqauChuDkAYDL5Zgnkd2Yj4RBDBgjJHjAVK953yZCVuj KQw2DwGXAsZOTtUUbgoEmMrp5WSqtLGghBCJBkM8BbN2o17n2FlemYVO/uZs8ZO2A0CyfZGU A0KdBT6z6CkNUEeQp5idOor6TgL8THlqVDC/y66rUFI8P704dDheliRUxHrmAG+DqiRxPWeb 3P2zwhan+Y2NcX4pVxIoN3Oc+QmHRI275pAkL51vRAJVs7DyMRq0skJhPgylJmB6K0Me5nLN b5NZ5Yn+NI+C23mI1Afj88mCosvZOunOw0W1rs0rqrkxCMY4gQXmCBwJwJK63Gd+ag1cNx3N G27Vo8HpXk+7wJ0XJhML1rzXoJpQ/fyi1XIqWkzdUHIn6+QkzfOoUhMXNo3czwjxLFw3aN6X 3O73KNKganUy7818IS8C6GDpc0X7MPDoCxNEs5BbT06lIZQpeH4OYuKAizonPw3aqRCZExuW FNvxsJXIOBKXQxeT54zM7L7KnXmo/Sg7FqgDLJddgz8PF0D0PVYXqPf3n+Npcud3qgJkbIZH quK+iPBmmemtFCaiifIKxsC28/GV7eNTb8CaPik3qHCk15fyAveWpp+vK7yG0OLmGxA/rmd/ 4/sDsq5stGVuZHN0cmVhbQplbmRvYmoKODMgMCBvYmoKMTI1OAplbmRvYmoKODcgMCBvYmoK PDwvTGVuZ3RoIDg4IDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicXVXBcts2 FLzrK96t9gytSnYncnuL27RV2pmojmZ6aHqAyCcKNQjQAGiF+fruA0BLMnWQBIL79u3uA59p MV/SQj7lu+5m3z+uqA2zBbWz59ky3aTyVXf0sMWGe1re0nY/y88s6faOVqt72nazq7WN7C3H m1+82keargfj6qf6oLSlvfO03pBqGs8hcKDz6+NgRrpdLFfX2/9mdz/S9s/ZFZbjgclzzfpF 25bYRh1Hio4C2ybdPKHtVP0kt2TVed1qqwy5o2V//d1seTchHnU8kCLLR4pe2aDqqJ2taDdE PKoDNdwDPJCzCap1rjlqA6i9/AeWoGQmc6L31LsQ9M6gaC9IQkEZ447g/eJqldaObjAN7RJd aUQVGMMqMEXd8cR8J3oFKfbamVTZQ9x0Pz8hBKv0H30UrIMzDTZlmtPTGY/UEF0HKjWYjeBR uw6Kyb4eLLUbpF2uChJ8OsmqPGeh9uw9N6k9aLRXg4lTzS9XPG/nWH9cP365Bt8thCxgZyr0 3tXcDAB81YMtUoFF2o3Z68FwuJR695qgOVZu301GPnKrfGOkydLzeSlndD2SQkoU7vcwKXNH K42WLQjH5o/1RTTCGCJ3EJZVfZCoQpy9/opuDWolXGeh35uE9F6/qMj0xCOYFNZy4+RIGDJg 6kX8DGmpIh2pcejYuggrJ4pDiBDz5/dnflCeIWDV7KPew8qYovFJGEG9juFRVgIhPuckVNab gnXWS61siqRBtrg5E/fd/BbAn6PzqmXqlMVXh8QXiG2K3Qs6gwqS5qC/8eTByS1RD2MaESHY EWVilLnUG3FUO21kpnUIA4syMcGkkZiaOXo4ZtsKVKKk51RjCpnRT0wPOtYOdT0/DxrbOifR PaDL5WJBvz0kI3JT0p7u+uSlYQGHyAUrDF2nvP6WFpHSs1NCDocWASqzE7gevJAH8Mb9fbPD aDYFJdOroI2thQVrf9rv2Wh+zQ+GsR8Sh94doWrhPyEhES3jFBM7sb2bZweMs20+E0aZ0Xwa HDARZ4t4toCoGHE8Xg7Q76gGFytw/5y5F9aIZAokaI5C8i1BmaoDo6/q0s5e1XwTVDqqQxTC rbRZ0Ip0F8qhl1+RbtSMSnSazsUg5mCbM0OO6nReRFeBUVb0LW/wxdzKkTV5gEmR9WJ6ymn1 6i+q4fcucJyym8f13O95QVrjCD+oiFeYnOxIJDZDuhctbxGJaGl3/EkUvs8SbxReG8g1aqKG MvPpXffhaw9/A31UdlB+pB8qefPd0+X1z0Y4L1f/AvLDdvYXPv8DNU19T2VuZHN0cmVhbQpl bmRvYmoKODggMCBvYmoKOTY5CmVuZG9iago5MiAwIG9iago8PC9MZW5ndGggOTMgMCBSL0Zp bHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJytVV1v2zYUfdevuOhLE8zWLDutnb45rYcm aDc3MTpg7R5o6tpiLZEKP5J5yI/vIW03dpoNQVEKoGTq3sNzzz2Ur6mXF9SL1/Yum+zXyyEt XdajZXadFeklbW+yobMZAkZU9Gm2yDY5BfUHNByOaNZkR+fas9Xsu2+sWHjajbPayJWshNK0 MJbOpyTK0rJz7Gh/XIR6Tf1eMTyefckGpzR7lx1h+ZduHP81749HYo6fZ8Vgh3RHYBznIs39 NA/SHEcex+bx7mQ4GvTTPEjzyR2Qfgab/ssdm1PI/kdd0vybPE/a4mFJNpVkU0k2lWRTSfYE 85MR92n16U+rPFOLHrH25LzAL2/ItSyVqCmu+w1v97QdfpT/QcPQnR/abb+2Ab022isdmG6N XSm9JFiVLfmKH6vrN7UMlpHYpTE51bQ1lGBZaXUdkiaWyyB5r4mQy1ixZADce3hWKUeiba0R strmOJob4523WI88pHG+Q8oTQsHNV6SNjy98JfyBaD6ixUTPyzXQroMCdfI2OE9Gf1dLh1zA tpsfJIWmOW/rM3MPzlzSrcKGeGOC75pFdy50SQ0KFVq5hj4fOWa6YukV8F/k/byAlDjNW5hF AF+oqDTWGhGjPh/n99oPca6QHeCrdeyAUyXbFLYTOilUGhmaaDmhGhfVDRpx8B/IxKLcDiI2 QskNAJkFBQehHmh00JTUM1Mb6BWNHHH48EskakQnxD3eI/A+H/8+/h/ODTcGdcs6lEDRJvWD 0QjsE1OTZ0+BM5YrbW5rLpcca7wHYRLBV8ai7cpVMQ8d1yu6MLZU9Jatxb7dCyO0NI2wXnVo rEE7HBR8aUoLs/K/3TdGCxiComobjDOxrpUW6fMLYZSliut2EWoqlZPBub2ixBwWoDPlpYFu EeNRGfdEKnpRpV3nb5guecGWNSy+xfw0bmFuU4uVit/3vw+I7437sA69zzv0l6mERbV4jETe 5fRR6DnfMBafvVVfhFxt+v4AZ8v+FUQJ6QiNvRfR+zDva7tuPXxmI0PFLk9/OXQ+mUy+B7pa N6CkQhMzvxk4cpladSPkGifjagqrP+skmKjKyxepsqlQda1grQ7hIIo632FO/mnTcb0QOgi7 ppOUOjrcmD5N8Q2hYhS1msyyD7i+Alr6HS5lbmRzdHJlYW0KZW5kb2JqCjkzIDAgb2JqCjg2 MwplbmRvYmoKOTcgMCBvYmoKPDwvTGVuZ3RoIDk4IDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2Rl Pj4Kc3RyZWFtCnicfVRNU9swEL37V+z0Ap2Jv0hKUk4NNBQYYFLiTjvT4aDI61jEllxJbpp/ 35WxwSVJ7YM90urtvqe3+wuiIIbIve2Xl174MIaV8SJYeb+8uNmE9sNLOE8oYALxCSSZ93wm hpMhjMcTSErv+Fpa1BKt/1mzzEL3nBeKr3nOhIRMabieA0tTjcaggf5zUxdbOIni8fvkyRt+ hOTWO6bln+fCciXkI8A9W7NSWTWARTCAd+3GGUxhjqh9q3z3hVmB3GolBYcLZvL3R1487NB6 z2JrLJYB5NZW5iwMl89wgdKrl/8qzd4NqKhoEhDMyelrUY6UsYyvHw/hTwsxALTACir2rin4 5RC4or8UaskKYlUKuQImU1hYpdkKCXFvrbBAXmtMYbntqWoG8G0xu7/+AVMpawJMkOdEnhW7 OBdKZqhRcmxoxadvaM1sTtt1eZBUkiN0QVBp9URSE7NOw81mE2C73Qi5P80V08ItH0zjAgYw DRpVkgBu2drkJZOUylXQOa2nAgm6S/ezMFaLZW0xHUDCyopc8oCGVpm0kGgmDeNWKAmXmpW4 UXrtPLoLZHtJA7gUmUWUNofpxR18p1MmVxUQzJUiWFUJbkDIXZh7tC6H2a8K2YCMkDF9WP5r aUSKwOA5FlxwK3+r/nLJA67KMKstWSXcrcGQx7ahSx99iEb+Bv1CqTWmvmiwfeYb5Jq6mOdC okG/7QV/F4qKOOAj8jQ2TXuISBfQ845sl3q+id/Auvb+L6wzRxcEXG8rq6hjnOG3vUxVGxHQ bVKmXWJ7GGlkhVbkJGb/2/VXtEkz6AFToak3jHNZltEoutSqhPjjq3fnWv0mwbUBq/Z0PGUq oB1x5k2LbQg7ba6ZKh2F0SQUptpzQd3VkX0z22o66hGb1jZX2hzBtJvILcaN0qmAORNFIWj5 H7Lf5hf+OdMcCyWZmzXtGR62x74IGr4MYn/Y7rxED2ggW0Z/ggFEk2g4aiMWFWv65VXwWUnJ z+DJIVafGA/qigeY1q6UeNxEvZTXjdmO9uxPRQIZuGE0D/UWRg3xyb/akJto1NKNuKucJd5X ev8Cj/HowWVuZHN0cmVhbQplbmRvYmoKOTggMCBvYmoKODA3CmVuZG9iagoxMDIgMCBvYmoK PDwvTGVuZ3RoIDEwMyAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nLWST1Pb MBDF7/oU7wbMEGPHGZz2BAmBIdMyKTG9MBw2smLU6k+QbIbw6ZESuy0z5cjqIHv3ad/P1j4h TTKkcXU71+zktkDtWYqaPbFsV0S3cY1JGQRjZEOUa7Y/k2GYoyjGKDU7vDaNcEY0gwtH6wZ9 TJTlv/kjSYO1dbhegKrKCe+Fx78xb9UWwzQrjspfLP+C8hs7DOlztRKusbi1lZN1K14HN9SQ OjpgWd5rptJzi+XWN0L7UIm5rEhRktdkcOHks+jSy/A+t14cY3repe6W8Wl42nebaZLqK0y0 OeOxdcKtDpK/UD+lIcycpprM55M8i73TBzCXtJIW38MPtp/PstbR5wOS/V1hSiuhlPXvaO4W 08GEHBfKGioFf+x8+ElwdpXElXShgmyQd5U/6kAV78IaSUA6TvNRj70JMP+jJL5HOCOetBue iKqNsny00y2CRkkfP1c0IJX0Izh72cgwmZiTacltMTqOAznG+7hfUC1C4SG0nJXsR1hvNCfc d2VuZHN0cmVhbQplbmRvYmoKMTAzIDAgb2JqCjM4NgplbmRvYmoKNCAwIG9iago8PC9UeXBl L1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9S ZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgOSAwIFIKL0ZvbnQg MTAgMCBSCj4+Ci9Db250ZW50cyA1IDAgUgo+PgplbmRvYmoKMTEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDE0IDAgUgovRm9udCAx NSAwIFIKPj4KL0NvbnRlbnRzIDEyIDAgUgo+PgplbmRvYmoKMTYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDE5IDAgUgovRm9udCAy MCAwIFIKPj4KL0NvbnRlbnRzIDE3IDAgUgo+PgplbmRvYmoKMjEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDI0IDAgUgovRm9udCAy NSAwIFIKPj4KL0NvbnRlbnRzIDIyIDAgUgo+PgplbmRvYmoKMjYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDI5IDAgUgovRm9udCAz MCAwIFIKPj4KL0NvbnRlbnRzIDI3IDAgUgo+PgplbmRvYmoKMzEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDM0IDAgUgovRm9udCAz NSAwIFIKPj4KL0NvbnRlbnRzIDMyIDAgUgo+PgplbmRvYmoKMzYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDM5IDAgUgovRm9udCA0 MCAwIFIKPj4KL0NvbnRlbnRzIDM3IDAgUgo+PgplbmRvYmoKNDEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDQ0IDAgUgovRm9udCA0 NSAwIFIKPj4KL0NvbnRlbnRzIDQyIDAgUgo+PgplbmRvYmoKNDYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDQ5IDAgUgovRm9udCA1 MCAwIFIKPj4KL0NvbnRlbnRzIDQ3IDAgUgo+PgplbmRvYmoKNTEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDU0IDAgUgovRm9udCA1 NSAwIFIKPj4KL0NvbnRlbnRzIDUyIDAgUgo+PgplbmRvYmoKNTYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDU5IDAgUgovRm9udCA2 MCAwIFIKPj4KL0NvbnRlbnRzIDU3IDAgUgo+PgplbmRvYmoKNjEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDY0IDAgUgovRm9udCA2 NSAwIFIKPj4KL0NvbnRlbnRzIDYyIDAgUgo+PgplbmRvYmoKNjYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDY5IDAgUgovRm9udCA3 MCAwIFIKPj4KL0NvbnRlbnRzIDY3IDAgUgo+PgplbmRvYmoKNzEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDc0IDAgUgovRm9udCA3 NSAwIFIKPj4KL0NvbnRlbnRzIDcyIDAgUgo+PgplbmRvYmoKNzYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDc5IDAgUgovRm9udCA4 MCAwIFIKPj4KL0NvbnRlbnRzIDc3IDAgUgo+PgplbmRvYmoKODEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDg0IDAgUgovRm9udCA4 NSAwIFIKPj4KL0NvbnRlbnRzIDgyIDAgUgo+PgplbmRvYmoKODYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDg5IDAgUgovRm9udCA5 MCAwIFIKPj4KL0NvbnRlbnRzIDg3IDAgUgo+PgplbmRvYmoKOTEgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDk0IDAgUgovRm9udCA5 NSAwIFIKPj4KL0NvbnRlbnRzIDkyIDAgUgo+PgplbmRvYmoKOTYgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDk5IDAgUgovRm9udCAx MDAgMCBSCj4+Ci9Db250ZW50cyA5NyAwIFIKPj4KZW5kb2JqCjEwMSAwIG9iago8PC9UeXBl L1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9S ZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTA0IDAgUgovRm9u dCAxMDUgMCBSCj4+Ci9Db250ZW50cyAxMDIgMCBSCj4+CmVuZG9iagozIDAgb2JqCjw8IC9U eXBlIC9QYWdlcyAvS2lkcyBbCjQgMCBSCjExIDAgUgoxNiAwIFIKMjEgMCBSCjI2IDAgUgoz MSAwIFIKMzYgMCBSCjQxIDAgUgo0NiAwIFIKNTEgMCBSCjU2IDAgUgo2MSAwIFIKNjYgMCBS CjcxIDAgUgo3NiAwIFIKODEgMCBSCjg2IDAgUgo5MSAwIFIKOTYgMCBSCjEwMSAwIFIKXSAv Q291bnQgMjAKPj4KZW5kb2JqCjEgMCBvYmoKPDwvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMyAw IFIKL01ldGFkYXRhIDEwNiAwIFIKPj4KZW5kb2JqCjcgMCBvYmoKPDwvVHlwZS9FeHRHU3Rh dGUKL09QTSAxPj5lbmRvYmoKOSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxMCAwIG9i ago8PC9SOAo4IDAgUj4+CmVuZG9iagoxNCAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagox NSAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iagoxOSAwIG9iago8PC9SNwo3IDAgUj4+CmVu ZG9iagoyMCAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iagoyNCAwIG9iago8PC9SNwo3IDAg Uj4+CmVuZG9iagoyNSAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iagoyOSAwIG9iago8PC9S Nwo3IDAgUj4+CmVuZG9iagozMCAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iagozNCAwIG9i ago8PC9SNwo3IDAgUj4+CmVuZG9iagozNSAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iagoz OSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago0MCAwIG9iago8PC9SOAo4IDAgUj4+CmVu ZG9iago0NCAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago0NSAwIG9iago8PC9SOAo4IDAg Uj4+CmVuZG9iago0OSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago1MCAwIG9iago8PC9S OAo4IDAgUj4+CmVuZG9iago1NCAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago1NSAwIG9i ago8PC9SOAo4IDAgUj4+CmVuZG9iago1OSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago2 MCAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iago2NCAwIG9iago8PC9SNwo3IDAgUj4+CmVu ZG9iago2NSAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iago2OSAwIG9iago8PC9SNwo3IDAg Uj4+CmVuZG9iago3MCAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iago3NCAwIG9iago8PC9S Nwo3IDAgUj4+CmVuZG9iago3NSAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iago3OSAwIG9i ago8PC9SNwo3IDAgUj4+CmVuZG9iago4MCAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iago4 NCAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago4NSAwIG9iago8PC9SOAo4IDAgUj4+CmVu ZG9iago4OSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago5MCAwIG9iago8PC9SOAo4IDAg Uj4+CmVuZG9iago5NCAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago5NSAwIG9iago8PC9S OAo4IDAgUj4+CmVuZG9iago5OSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxMDAgMCBv YmoKPDwvUjgKOCAwIFI+PgplbmRvYmoKMTA0IDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5kb2Jq CjEwNSAwIG9iago8PC9SOAo4IDAgUj4+CmVuZG9iago4IDAgb2JqCjw8L0Jhc2VGb250L0Nv dXJpZXIvVHlwZS9Gb250Ci9TdWJ0eXBlL1R5cGUxPj4KZW5kb2JqCjEwNiAwIG9iago8PC9U eXBlL01ldGFkYXRhCi9TdWJ0eXBlL1hNTC9MZW5ndGggMTM1ND4+c3RyZWFtCjw/eHBhY2tl dCBiZWdpbj0n77u/JyBpZD0nVzVNME1wQ2VoaUh6cmVTek5UY3prYzlkJz8+Cjw/YWRvYmUt eGFwLWZpbHRlcnMgZXNjPSJDUkxGIj8+Cjx4OnhtcG1ldGEgeG1sbnM6eD0nYWRvYmU6bnM6 bWV0YS8nIHg6eG1wdGs9J1hNUCB0b29sa2l0IDIuOS4xLTEzLCBmcmFtZXdvcmsgMS42Jz4K PHJkZjpSREYgeG1sbnM6cmRmPSdodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJkZi1z eW50YXgtbnMjJyB4bWxuczppWD0naHR0cDovL25zLmFkb2JlLmNvbS9pWC8xLjAvJz4KPHJk ZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9J3V1aWQ6Y2VhZjlmM2ItOWZmZi0xMWYyLTAwMDAt M2QxZmZjNTlhMzljJyB4bWxuczpwZGY9J2h0dHA6Ly9ucy5hZG9iZS5jb20vcGRmLzEuMy8n IHBkZjpQcm9kdWNlcj0nR1BMIEdob3N0c2NyaXB0IDkuMDUnLz4KPHJkZjpEZXNjcmlwdGlv biByZGY6YWJvdXQ9J3V1aWQ6Y2VhZjlmM2ItOWZmZi0xMWYyLTAwMDAtM2QxZmZjNTlhMzlj JyB4bWxuczp4bXA9J2h0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8nPjx4bXA6TW9kaWZ5 RGF0ZT4yMDE3LTA3LTEzVDA4OjUyOjIyLTA3OjAwPC94bXA6TW9kaWZ5RGF0ZT4KPHhtcDpD cmVhdGVEYXRlPjIwMTctMDctMTNUMDg6NTI6MjItMDc6MDA8L3htcDpDcmVhdGVEYXRlPgo8 eG1wOkNyZWF0b3JUb29sPkdOVSBFbnNjcmlwdCAxLjYuNS45MDwveG1wOkNyZWF0b3JUb29s PjwvcmRmOkRlc2NyaXB0aW9uPgo8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0ndXVpZDpj ZWFmOWYzYi05ZmZmLTExZjItMDAwMC0zZDFmZmM1OWEzOWMnIHhtbG5zOnhhcE1NPSdodHRw Oi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vJyB4YXBNTTpEb2N1bWVudElEPSd1dWlkOmNl YWY5ZjNiLTlmZmYtMTFmMi0wMDAwLTNkMWZmYzU5YTM5YycvPgo8cmRmOkRlc2NyaXB0aW9u IHJkZjphYm91dD0ndXVpZDpjZWFmOWYzYi05ZmZmLTExZjItMDAwMC0zZDFmZmM1OWEzOWMn IHhtbG5zOmRjPSdodHRwOi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLycgZGM6Zm9ybWF0 PSdhcHBsaWNhdGlvbi9wZGYnPjxkYzp0aXRsZT48cmRmOkFsdD48cmRmOmxpIHhtbDpsYW5n PSd4LWRlZmF1bHQnPkVuc2NyaXB0IE91dHB1dDwvcmRmOmxpPjwvcmRmOkFsdD48L2RjOnRp dGxlPjwvcmRmOkRlc2NyaXB0aW9uPgo8L3JkZjpSREY+CjwveDp4bXBtZXRhPgogICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCjw/eHBhY2tldCBlbmQ9J3cnPz4KZW5k c3RyZWFtCmVuZG9iagoyIDAgb2JqCjw8L1Byb2R1Y2VyKEdQTCBHaG9zdHNjcmlwdCA5LjA1 KQovQ3JlYXRpb25EYXRlKEQ6MjAxNzA3MTMwODUyMjItMDcnMDAnKQovTW9kRGF0ZShEOjIw MTcwNzEzMDg1MjIyLTA3JzAwJykKL1RpdGxlKEVuc2NyaXB0IE91dHB1dCkKL0NyZWF0b3Io R05VIEVuc2NyaXB0IDEuNi41LjkwKT4+ZW5kb2JqCnhyZWYKMCAxMDcKMDAwMDAwMDAwMCA2 NTUzNSBmIAowMDAwMDI2MzcxIDAwMDAwIG4gCjAwMDAwMjkxNzQgMDAwMDAgbiAKMDAwMDAy NjE3NyAwMDAwMCBuIAowMDAwMDIyOTM1IDAwMDAwIG4gCjAwMDAwMDAwMTUgMDAwMDAgbiAK MDAwMDAwMTExNCAwMDAwMCBuIAowMDAwMDI2NDM3IDAwMDAwIG4gCjAwMDAwMjc2ODAgMDAw MDAgbiAKMDAwMDAyNjQ3OCAwMDAwMCBuIAowMDAwMDI2NTA3IDAwMDAwIG4gCjAwMDAwMjMw OTQgMDAwMDAgbiAKMDAwMDAwMTEzNCAwMDAwMCBuIAowMDAwMDAyMzQyIDAwMDAwIG4gCjAw MDAwMjY1MzcgMDAwMDAgbiAKMDAwMDAyNjU2NyAwMDAwMCBuIAowMDAwMDIzMjU2IDAwMDAw IG4gCjAwMDAwMDIzNjMgMDAwMDAgbiAKMDAwMDAwMzc0NSAwMDAwMCBuIAowMDAwMDI2NTk3 IDAwMDAwIG4gCjAwMDAwMjY2MjcgMDAwMDAgbiAKMDAwMDAyMzQxOCAwMDAwMCBuIAowMDAw MDAzNzY2IDAwMDAwIG4gCjAwMDAwMDQ2ODUgMDAwMDAgbiAKMDAwMDAyNjY1NyAwMDAwMCBu IAowMDAwMDI2Njg3IDAwMDAwIG4gCjAwMDAwMjM1ODAgMDAwMDAgbiAKMDAwMDAwNDcwNSAw MDAwMCBuIAowMDAwMDA1OTIxIDAwMDAwIG4gCjAwMDAwMjY3MTcgMDAwMDAgbiAKMDAwMDAy Njc0NyAwMDAwMCBuIAowMDAwMDIzNzQyIDAwMDAwIG4gCjAwMDAwMDU5NDIgMDAwMDAgbiAK MDAwMDAwNzM0MyAwMDAwMCBuIAowMDAwMDI2Nzc3IDAwMDAwIG4gCjAwMDAwMjY4MDcgMDAw MDAgbiAKMDAwMDAyMzkwNCAwMDAwMCBuIAowMDAwMDA3MzY0IDAwMDAwIG4gCjAwMDAwMDg3 MjIgMDAwMDAgbiAKMDAwMDAyNjgzNyAwMDAwMCBuIAowMDAwMDI2ODY3IDAwMDAwIG4gCjAw MDAwMjQwNjYgMDAwMDAgbiAKMDAwMDAwODc0MyAwMDAwMCBuIAowMDAwMDA5NzgwIDAwMDAw IG4gCjAwMDAwMjY4OTcgMDAwMDAgbiAKMDAwMDAyNjkyNyAwMDAwMCBuIAowMDAwMDI0MjI4 IDAwMDAwIG4gCjAwMDAwMDk4MDAgMDAwMDAgbiAKMDAwMDAxMTIyMSAwMDAwMCBuIAowMDAw MDI2OTU3IDAwMDAwIG4gCjAwMDAwMjY5ODcgMDAwMDAgbiAKMDAwMDAyNDM5MCAwMDAwMCBu IAowMDAwMDExMjQyIDAwMDAwIG4gCjAwMDAwMTIzNDEgMDAwMDAgbiAKMDAwMDAyNzAxNyAw MDAwMCBuIAowMDAwMDI3MDQ3IDAwMDAwIG4gCjAwMDAwMjQ1NTIgMDAwMDAgbiAKMDAwMDAx MjM2MiAwMDAwMCBuIAowMDAwMDEzMjY4IDAwMDAwIG4gCjAwMDAwMjcwNzcgMDAwMDAgbiAK MDAwMDAyNzEwNyAwMDAwMCBuIAowMDAwMDI0NzE0IDAwMDAwIG4gCjAwMDAwMTMyODggMDAw MDAgbiAKMDAwMDAxNDI2OSAwMDAwMCBuIAowMDAwMDI3MTM3IDAwMDAwIG4gCjAwMDAwMjcx NjcgMDAwMDAgbiAKMDAwMDAyNDg3NiAwMDAwMCBuIAowMDAwMDE0Mjg5IDAwMDAwIG4gCjAw MDAwMTU0NzcgMDAwMDAgbiAKMDAwMDAyNzE5NyAwMDAwMCBuIAowMDAwMDI3MjI3IDAwMDAw IG4gCjAwMDAwMjUwMzggMDAwMDAgbiAKMDAwMDAxNTQ5OCAwMDAwMCBuIAowMDAwMDE2ODM0 IDAwMDAwIG4gCjAwMDAwMjcyNTcgMDAwMDAgbiAKMDAwMDAyNzI4NyAwMDAwMCBuIAowMDAw MDI1MjAwIDAwMDAwIG4gCjAwMDAwMTY4NTUgMDAwMDAgbiAKMDAwMDAxODE2NyAwMDAwMCBu IAowMDAwMDI3MzE3IDAwMDAwIG4gCjAwMDAwMjczNDcgMDAwMDAgbiAKMDAwMDAyNTM2MiAw MDAwMCBuIAowMDAwMDE4MTg4IDAwMDAwIG4gCjAwMDAwMTk1MTggMDAwMDAgbiAKMDAwMDAy NzM3NyAwMDAwMCBuIAowMDAwMDI3NDA3IDAwMDAwIG4gCjAwMDAwMjU1MjQgMDAwMDAgbiAK MDAwMDAxOTUzOSAwMDAwMCBuIAowMDAwMDIwNTgwIDAwMDAwIG4gCjAwMDAwMjc0MzcgMDAw MDAgbiAKMDAwMDAyNzQ2NyAwMDAwMCBuIAowMDAwMDI1Njg2IDAwMDAwIG4gCjAwMDAwMjA2 MDAgMDAwMDAgbiAKMDAwMDAyMTUzNSAwMDAwMCBuIAowMDAwMDI3NDk3IDAwMDAwIG4gCjAw MDAwMjc1MjcgMDAwMDAgbiAKMDAwMDAyNTg0OCAwMDAwMCBuIAowMDAwMDIxNTU1IDAwMDAw IG4gCjAwMDAwMjI0MzQgMDAwMDAgbiAKMDAwMDAyNzU1NyAwMDAwMCBuIAowMDAwMDI3NTg3 IDAwMDAwIG4gCjAwMDAwMjYwMTEgMDAwMDAgbiAKMDAwMDAyMjQ1NCAwMDAwMCBuIAowMDAw MDIyOTE0IDAwMDAwIG4gCjAwMDAwMjc2MTggMDAwMDAgbiAKMDAwMDAyNzY0OSAwMDAwMCBu IAowMDAwMDI3NzQyIDAwMDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgMTA3IC9Sb290IDEgMCBS IC9JbmZvIDIgMCBSCi9JRCBbPDI3QkU5NEQ5N0JDODExRUI2RjE4RkZBMkNGRkI5NjRDPjwy N0JFOTREOTdCQzgxMUVCNkYxOEZGQTJDRkZCOTY0Qz5dCj4+CnN0YXJ0eHJlZgoyOTM1Mwol JUVPRgo= --------------5112DB009B33BCB65645232E-- From nobody Sun Jul 16 14:43:16 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C192126CB6; Sun, 16 Jul 2017 14:43:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.721 X-Spam-Level: X-Spam-Status: No, score=-2.721 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=icloud.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eRyUKp8EoTVM; Sun, 16 Jul 2017 14:43:13 -0700 (PDT) Received: from mr25p46im-ztdg02101301.me.com (mr25p46im-ztdg02101301.me.com [17.111.255.91]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 474AE126BF3; Sun, 16 Jul 2017 14:43:13 -0700 (PDT) Received: from process-dkim-sign-daemon.mr25p46im-ztdg02101301.me.com by mr25p46im-ztdg02101301.me.com (Oracle Communications Messaging Server 7.0.5.38.0 64bit (built Feb 26 2016)) id <0OT700100DLF3L00@mr25p46im-ztdg02101301.me.com>; Sun, 16 Jul 2017 21:43:13 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=icloud.com; s=04042017; t=1500241392; bh=MW5C8bUbbqtY5VWNqSQ6Bj2Tqyewpt9sg6PY1Zpbvtk=; h=Content-type:MIME-version:Subject:From:Date:Message-id:To; b=Sp4vtrfRLagvG6/r4meoh53DpNUhxuHXVM+H7/BHv4EmF+GlzqIXJtflsDDzVvl3y PBfgayMXGGXvoRXQboOk7lLTatw3ElOWQ7BA45lGOgqMZCVuNkqcbucVBS34rIlt6a d3ZSuFqEZUWtD4Er1sQVS4ai5+4n7yPxx+0Ran5qrNqXK0fG2VfQF8xW+9gI0smhCj dbFjgUqkG5deo94VEUG6CWUwuuo+Oca4B7jD/Q4hwHe/qqKHtqXWLoQQqAnl5eNqin T+A5gXN/EpeGIpwbqqDMdyMaKt3tlUKlhS71x6CT3lRSsJYJNBR3LZyfH/zjhTqlSv MygaS+ETbAy7g== Received: from icloud.com ([127.0.0.1]) by mr25p46im-ztdg02101301.me.com (Oracle Communications Messaging Server 7.0.5.38.0 64bit (built Feb 26 2016)) with ESMTPSA id <0OT700O59DNVGY20@mr25p46im-ztdg02101301.me.com>; Sun, 16 Jul 2017 21:43:12 +0000 (GMT) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-07-16_16:,, signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 clxscore=1034 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1701120000 definitions=main-1707160365 Content-type: text/plain; charset=gb2312 MIME-version: 1.0 (Mac OS X Mail 10.3 \(3273\)) From: Di Ma In-reply-to: Date: Sun, 16 Jul 2017 23:43:06 +0200 Cc: IETF SIDR , sidrops@ietf.org, kent@alum.mit.edu, Declan Ma Content-transfer-encoding: quoted-printable Message-id: References: <20160412100344.32250.28492.idtracker@ietfa.amsl.com> To: Oleg Muravskiy X-Mailer: Apple Mail (2.3273) Archived-At: Subject: Re: [sidr] New Version Notification for draft-madi-sidr-rp-00.txt X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Jul 2017 21:43:15 -0000 Oleg, Thanks very much for your comments. See my responses in lines.=20 > =D4=DA 2016=C4=EA7=D4=C213=C8=D5=A3=AC17:05=A3=ACOleg Muravskiy = =D0=B4=B5=C0=A3=BA >=20 > Hi Di, >=20 >> On 27 Apr 2016, at 03:46, Declan Ma wrote: >>=20 >> Hi, folks, >>=20 >> Steve Kent and I have generated this document to try to consolidate = RP requirements in one document, with pointers to all the relevant RFCs.=20= >=20 > I read the document, and I appreciate you putting it together, but I = can't say I support this effort. >=20 > As you state in Section 1: >=20 > The follow sections present requirements imposed on RPs as defined = in > the following RFCs: >=20 > RFC 6480 (RPKI Architecture) > RFC 6481 (Repository Structure) > RFC 6482 (ROA format) > RFC 6485 (Algorithms) > RFC 6486 (Manifests) > RFC 6487 (Certificate and CRL profile) > RFC 6488 (RPKI Signed Objects) > RFC 6489 (Key Rollover) > RFC 6810 (RPKI to Router Protocol) > RFC 6916 (Algorithm Agility) > RFC 7730 (Trust Anchor Locator) > RFC XXXX (Router Certificates) >=20 > This document will be update to reflect new or changed requirements > as these RFCs are updated, or new RFCs are written. >=20 > I agree that there are many documents that one has to consult on order = to make or verify an implementation of RPKI validation, but this = document will *add* to that number! >=20 > Once this document is out, someone will have to keep it up to date = (and not conflicting) with all those other documents. This could create = more problems than it could solve. >=20 > My following comments basically show why it is difficult to keep this = document in a state that would not create more problems. I understand your concerns but I do think this document deserves our = efforts.=20 It=A1=AFs not in state of art at present yet I hope it would be adopted = to move along with help from the WG.=20 >=20 >=20 >> As I mentioned in IETF 95 meeting, there is no standards language = (e.g., MUST, SHOULD, MAY, ...) in this doc, as it is just POINTING to = the docs that have the real requirements.=20 >=20 > Well, actually there is normative language: >=20 > 3.3. CRL Processing >=20 > The CRL processing requirements imposed on CAs and RP are described > in [RFC6487]. CRLs in the RPKI are tightly constrained; only the > AuthorityKeyIndetifier and CRLNumber extensions are allowed, and = they > MUST be present. No other CRL extensions are allowed, and no > ^^^^^^ > CRLEntry extensions are permitted. RPs are required to verify that > these constraints have been met. Each CRL in the RPI MUST be > ^^^^^^ > verified using the public key from the certificate of the CA that > issued the CRL. >=20 > And there are several other places where the normative language is not = used, but implied. Thanks for catching the typos.=20 We will change =A1=AEMUST=A1=AF into =A1=AEmust=A1=AF. As for the implication stuff, the text is just paraphrasing the = requirements from RFCs which I don=A1=AFt think is sort of = inappropriate.=20 >=20 >=20 >> This doc outlines the RP functions, summarizes them and then gives = reference to those precise sections or paragraphs, in order to make life = easier for implementers to make sure he/she has addressed all of these = requirements. >=20 > I have two comments for this paragraph. >=20 > First, it might seem appealing to create a document that will give a = "reference to those precise sections or paragraphs", so that the = implementer could skip reading those long RFCs in full. But I do not = think it is possible or advisable. Even in your draft you say: >=20 > An RP is required > to verify that a resource certificate adheres to the profile > established by [RFC6487]. This means that all extensions mandated = by > [RFC6487] must be present and value of each extension must be within > the range specified by this RFC. Moreover, any extension excluded = by > [RFC6487] must be omitted. >=20 > or >=20 > To determine whether a manifest is valid, the RP is required to > perform manifest-specific checks in addition to those specified in > [RFC6488]. >=20 > So very often it is more practical to refer to the whole RFCs, because = an implementer has to implement all of it, not just specific paragraphs. >=20 We are not suggesting that implementers skip reading those RFCs in full. This draft is born to be a guide to help implementers get the essentials = of RP functionalities scattered in different RFCs. Anyone who wants to = comprehend RPKI cannot be exempted from reading all the RPKI RFCs, let = alone the implementers. One might see the RP requirements document as a=A1=B0Manifest=A1=B1 for = all necessary RP functions.=20 >=20 > Second, what if, for whatever reason, this document will not list = *all* of the requirements? Will it be OK for the implementer to say "I = did everything specified there", or will (s)he be required to = double-check with other RFCs you refer to? Or even with those you do = not refer to? >=20 > I=A1=AFm not sure how to define the applicability of such document. This is document is intended to be Informational, which is going to help = implementers to find what they want. The tricky part is the your = concerns are of different granularity! This document tell readers an RP system is supposed to contain these = categories: --Fetching and Caching RPKI Repository Objects -- Processing Certificate and CRL --Processing RPKI Repository Signed Objects --Delivering Validated Cache Data to BGP Speakers But for whether an implementer did everything specified =A1=B0there=A1=B1,= they should double check =A1=B0there=A1=B1 which is specific paragraph = in the referenced RFCs.=20 Once again, we are not suggesting that implementers skip reading those = RFCs in full. IF they want to do double-check, they are encouraged to know the = breakdown of every categories in terms RP requirements.=20 >=20 >=20 >> Any comments and feedbacks are appreciated. >=20 > Here are my comments for some specific sections: >=20 > 3.1. Verifying Resource Certificate and Syntax >=20 > Certificates in the RPKI are called resource certificates, and they > are required to conform to the profile [RFC6487]. An RP is required > to verify that a resource certificate adheres to the profile > established by [RFC6487]. This means that all extensions mandated = by > [RFC6487] must be present and value of each extension must be within > the range specified by this RFC. Moreover, any extension excluded = by > [RFC6487] must be omitted. >=20 > I think you should not repeat the text of other RFCs, otherwise you = risk of being incomplete or going out of sync with referenced RFC. Good suggestion.=20 We authors will see how to address issues. And I would appreciate your help.=20 >=20 >=20 > 3.2. Certificate Path Validation >=20 > In the RPKI, issuer can only assign and/or allocate public INRs > belong to it, ... >=20 > I don=A1=AFt think assignment or allocation of INR happens in RPKI. Agreed. It should have been expressed like: In the RPKI, issuer can only = authorize the custodianship of public INR belonging to it, =A1=AD >=20 >=20 > 3.3. CRL Processing >=20 > The CRL processing requirements imposed on CAs and RP are described > in [RFC6487]. CRLs in the RPKI are tightly constrained; only the > AuthorityKeyIndetifier and CRLNumber extensions are allowed, and = they > MUST be present. No other CRL extensions are allowed, and no > CRLEntry extensions are permitted. RPs are required to verify that > these constraints have been met. Each CRL in the RPI MUST be > verified using the public key from the certificate of the CA that > issued the CRL. >=20 >=20 > Apart from using normative language mentioned above, you seem to = repeat the text of other RFC. > Is it the only bit of RFC6487 that is applicable to CRL processing in = RPKI validation? > Aren=A1=AFt any CRL validation (not only in RPKI) requires that CRL = must be verified using the public key of it's issuer? We will be considering adding text in terms of generalized CRL = specification. >=20 >=20 > 4.2.1. Manifest >=20 > To determine whether a manifest is valid, the RP is required to > perform manifest-specific checks in addition to those specified in > [RFC6488]. >=20 > Specific checks for a Manifest are described in section 4 of > [RFC6486]. If any of these checks fails, indicating that the > manifest is invalid, then the manifest will be discarded and treated > as though no manifest were present. >=20 > This description is quite incomplete. Perhaps you should merge the = content of section "4.3. How to Make Use of Manifest Data=A1=B1 in = here, but even there I do not see a reference to section 6 (Relying = Party Use of Manifests) of RFC6486, which is quite a big omission. Manifest has been a tricky part.=20 Manifest processing has proven to be significantly more complicated that = initially anticipated.=20 I hope SIDROPS WG to take the chance to give an operational advice along = with this draft.=20 >=20 >=20 > 4.2.2. ROA >=20 > To validate a ROA, the RP is required perform all the checks > specified in [RFC6488] as well as the additional ROA-specific > validation steps. The IP address delegation extension [RFC3779] > present in the end-entity (EE) certificate (contained within the > ROA), must encompass each of the IP address prefix(es) in the ROA. > More details for ROA validation are specified in section 2 of > [RFC6482]. >=20 > The second sentence is almost a 1-to-1 copy of Section 4 of 6482. = What=A1=AFs the point of copying it instead of referencing? For smooth reading, in some cases, the text of this draft paraphrases = the requirements, and in other cases it may merely restate them. >=20 > Section 2 of RFC6482 defines the ROA content-type, not the validation. >=20 >=20 > 4.2.3. Ghostbusters >=20 > The Ghostbusters Record is optional; a publication point in the RPKI > can have zero or more associated Ghostbuster Records. =20 >=20 > This is true for all objects except manifest and CRL. >=20 > If a CA has at > least one Ghostbuster Record, RP is required to verify that this > Ghostbusters Record conforms to the syntax of signed object defined > in [RFC6488]. >=20 > And this is also true for any signed object. >=20 > The payload of this signed object is a (severely) profiled vCard. = An > RP is required to verify that the payload of Ghostbusters conforms = to > format as profiled in [RFC6493]. >=20 > I'm mentioning it here, but it applies to many places in this = document: the validation section of RFC6493 already references RFC6488. = So why duplicate it here? >=20 They are not duplicate. RFC6488 is for generalized validity check in terms of syntax yet RFC6493 = is for syntax check especial for Ghostbusters.=20 >=20 > 4.3. How to Make Use of Manifest Data >=20 > For a given publication point, the RP ought to perform tests to > determine the state of the Manifest at the publication point. A > Manifest can be classified as either valid or invalid, and a valid > Manifest is either current and stale. An RP decides how to make use > of a Manifest based on its state, according to local (RP) policy. >=20 > If there are valid objects in a publication point that are not > present on a Manifest, [RFC6486] does not mandate specific RP > behavior with respect to such objects. However, most RP software > ignores such objects and this document recommends that this behavior > be adopted uniformly. >=20 > Instead of =A1=B0recommending" it in this document, maybe we should = review and change 6486? >=20 > In the absence of a Manifest, an RP is expected to accept all valid > signed objects present in the publication point. =20 >=20 > Actually, 6486 says that all such objects "SHOULD be viewed as = suspect, but MAY be used by the RP, as per local policy", which has = subtle difference. >=20 As I mentioned above, Manifest has been a tricky part. Manifest = processing has proven to be significantly more complicated that = initially anticipated.=20 We might as well considering to update RFC 6486.=20 >=20 >=20 > I think this confirms that keeping such document up to date and = consistent with other documents is not an easy task, and having this = document will not relieve the implementer from studying deeply all the = documents it refers. As far I responded to you above, I think this document is worth efforts = as a WG item though it is not in state of art at present.=20 I would appreciate help and contributions from the WG, especially guys = in charge of RP software.=20 Di From nobody Wed Jul 26 12:33:05 2017 Return-Path: X-Original-To: sidr@ietf.org Delivered-To: sidr@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D7FB9128BC8; Wed, 26 Jul 2017 12:33:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: The IESG To: "IETF-Announce" X-Test-IDTracker: no X-IETF-IDTracker: 6.57.0 Auto-Submitted: auto-generated Precedence: bulk CC: draft-ietf-sidr-rpki-validation-reconsidered@ietf.org, morrowc@ops-netman.net, Chris Morrow , sidr-chairs@ietf.org, sidr@ietf.org, aretana@cisco.com Reply-To: ietf@ietf.org Sender: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-ID: <150109758383.22932.4989139734698533154.idtracker@ietfa.amsl.com> Date: Wed, 26 Jul 2017 12:33:03 -0700 Archived-At: Subject: [sidr] Last Call: (RPKI Validation Reconsidered) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2017 19:33:04 -0000 The IESG has received a request from the Secure Inter-Domain Routing WG (sidr) to consider the following document: - 'RPKI Validation Reconsidered' as Proposed Standard The IESG plans to make a decision in the next few weeks, and solicits final comments on this action. Please send substantive comments to the ietf@ietf.org mailing lists by 2017-08-15. Exceptionally, comments may be sent to iesg@ietf.org instead. In either case, please retain the beginning of the Subject line to allow automated sorting. Abstract This document specifies an alternative to the certificate validation procedure specified in RFC 6487 that reduces aspects of operational fragility in the management of certificates in the RPKI, while retaining essential security features. The use of this updated procedure is signaled by form of a set of alternative Object Identifiers (OIDs) indicating that the alternative version of RFC 3779 X.509 Extensions for IP Addresses and AS Identifiers, and certificate policy for the Resource Public Key Infrastructure (RFC 6484) defined in this document should be used. Furthermore this document provides an alternative to ROA (RFC 6482), and BGPSec Router Certificate (BGPSec PKI Profiles - publication requested) validation. The file can be obtained via https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-validation-reconsidered/ IESG discussion can be tracked via https://datatracker.ietf.org/doc/draft-ietf-sidr-rpki-validation-reconsidered/ballot/ No IPR declarations have been submitted directly on this I-D. From nobody Wed Jul 26 14:12:46 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7700131471; Wed, 26 Jul 2017 14:12:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.523 X-Spam-Level: X-Spam-Status: No, score=-14.523 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hGXIgOT5m0rt; Wed, 26 Jul 2017 14:12:43 -0700 (PDT) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9757131D14; Wed, 26 Jul 2017 14:12:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3026; q=dns/txt; s=iport; t=1501103557; x=1502313157; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=cvV8M+HomSm3S7VeKUpP/fMNxfuXvQPHfWZPSHzYsng=; b=hPXEVrzZ7P8rU0sgptZY8WIvikKsKtVmf4ryxF2x9gH0APq6IQ0YgLv6 pw+EAeTSokp3U6XlJbeq2EGVSBt5fkj5CCc+62clgFMMu0qvRblsIHGkR dMlm20GgXRgJr4pxVdiREL9XRhlD5Soq7MLJYKuQ4uNM3PYotjfNcIs8T c=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BlAQB0BXlZ/5xdJa1dGwEBAQMBAQEJA?= =?us-ascii?q?QEBg1pkbScHjgWnaw6CBC6FGQIagzU/GAECAQEBAQEBAWsdC4UZBiMROgsQAgE?= =?us-ascii?q?IGgIfBwICAjAUARACBA4Fii8QsSOCJotGAQEBAQEBAQEBAQEBAQEBAQEBAQEBG?= =?us-ascii?q?AWBC4Idg02BYSuCeYQ9NoMTMIIxBYcnkDGIAwKHTYcXhTyCDIVQil6VbwEfOIE?= =?us-ascii?q?KdxVbAYU4gU52hncrgQWBDgEBAQ?= X-IronPort-AV: E=Sophos;i="5.40,416,1496102400"; d="scan'208";a="461204248" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by alln-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Jul 2017 21:12:36 +0000 Received: from XCH-ALN-002.cisco.com (xch-aln-002.cisco.com [173.36.7.12]) by rcdn-core-5.cisco.com (8.14.5/8.14.5) with ESMTP id v6QLCaXk032608 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 26 Jul 2017 21:12:36 GMT Received: from xch-aln-002.cisco.com (173.36.7.12) by XCH-ALN-002.cisco.com (173.36.7.12) with Microsoft SMTP Server (TLS) id 15.0.1210.3; Wed, 26 Jul 2017 16:12:35 -0500 Received: from xch-aln-002.cisco.com ([173.36.7.12]) by XCH-ALN-002.cisco.com ([173.36.7.12]) with mapi id 15.00.1210.000; Wed, 26 Jul 2017 16:12:35 -0500 From: "Alvaro Retana (aretana)" To: "sidr@ietf.org" CC: "draft-ietf-sidr-rpki-validation-reconsidered@ietf.org" , "morrowc@ops-netman.net" , "sidr-chairs@ietf.org" Thread-Topic: Last Call: (RPKI Validation Reconsidered) to Proposed Standard Thread-Index: AQHTBkYBBykr1oUDM0WVW2Qz6POQOaJmrAQA Date: Wed, 26 Jul 2017 21:12:35 +0000 Message-ID: <943AE76A-DF05-48F1-B0B1-44701ECD406D@cisco.com> References: <150109758383.22932.4989139734698533154.idtracker@ietfa.amsl.com> In-Reply-To: <150109758383.22932.4989139734698533154.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/f.22.0.170515 x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.117.15.4] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [sidr] Last Call: (RPKI Validation Reconsidered) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2017 21:12:46 -0000 RGVhciBzaWRyIFdHOg0KDQpJIHdhbnQgdG8gY2FsbCBhdHRlbnRpb24gdG8gdGhpcyBMYXN0IENh bGwuDQoNClRoZSBkb2N1bWVudCBoYXMgdW5kZXJnb25lIHNpZ25pZmljYW50IGVkaXRvcmlhbCBj aGFuZ2VzIHNpbmNlIHRoZSBXR0xDIOKAkyBub25lIG9mIHdoaWNoIGNoYW5nZSB0aGUgb3BlcmF0 aW9uIG9yIG90aGVyIHRlY2huaWNhbCBhc3BlY3RzLiAgVGhlIGNoYW5nZXMgYXJlIG1lYW50IG1h aW5seSB0byBub3Qgb2Jzb2xldGUgdGhlIGN1cnJlbnQgcHJvY2VkdXJlcyBhdCB0aGlzIHRpbWUu DQoNCkkgaGF2ZSBhc2tlZCBmb3IgYW4gZXh0ZW5kZWQgSUVURiBMYXN0IENhbGwgKDMgd2Vla3Mg aW5zdGVhZCBvZiAyKSB0byBnaXZlIHRoZSBXRyB0aW1lIHRvIHJldmlldy4NCg0KVGhhbmtzIQ0K DQpBbHZhcm8uDQoNCg0KDQpPbiA3LzI2LzE3LCAzOjMzIFBNLCAiaWVzZy1zZWNyZXRhcnlAaWV0 Zi5vcmcgb24gYmVoYWxmIG9mIFRoZSBJRVNHIiA8aWVzZy1zZWNyZXRhcnlAaWV0Zi5vcmc+IHdy b3RlOg0KDQoNClRoZSBJRVNHIGhhcyByZWNlaXZlZCBhIHJlcXVlc3QgZnJvbSB0aGUgU2VjdXJl IEludGVyLURvbWFpbiBSb3V0aW5nIFdHDQooc2lkcikgdG8gY29uc2lkZXIgdGhlIGZvbGxvd2lu ZyBkb2N1bWVudDogLSAnUlBLSSBWYWxpZGF0aW9uIFJlY29uc2lkZXJlZCcNCiAgPGRyYWZ0LWll dGYtc2lkci1ycGtpLXZhbGlkYXRpb24tcmVjb25zaWRlcmVkLTA4LnR4dD4gYXMgUHJvcG9zZWQg U3RhbmRhcmQNCg0KVGhlIElFU0cgcGxhbnMgdG8gbWFrZSBhIGRlY2lzaW9uIGluIHRoZSBuZXh0 IGZldyB3ZWVrcywgYW5kIHNvbGljaXRzIGZpbmFsDQpjb21tZW50cyBvbiB0aGlzIGFjdGlvbi4g UGxlYXNlIHNlbmQgc3Vic3RhbnRpdmUgY29tbWVudHMgdG8gdGhlDQppZXRmQGlldGYub3JnIG1h aWxpbmcgbGlzdHMgYnkgMjAxNy0wOC0xNS4gRXhjZXB0aW9uYWxseSwgY29tbWVudHMgbWF5IGJl DQpzZW50IHRvIGllc2dAaWV0Zi5vcmcgaW5zdGVhZC4gSW4gZWl0aGVyIGNhc2UsIHBsZWFzZSBy ZXRhaW4gdGhlIGJlZ2lubmluZyBvZg0KdGhlIFN1YmplY3QgbGluZSB0byBhbGxvdyBhdXRvbWF0 ZWQgc29ydGluZy4NCg0KQWJzdHJhY3QNCg0KDQogICBUaGlzIGRvY3VtZW50IHNwZWNpZmllcyBh biBhbHRlcm5hdGl2ZSB0byB0aGUgY2VydGlmaWNhdGUgdmFsaWRhdGlvbg0KICAgcHJvY2VkdXJl IHNwZWNpZmllZCBpbiBSRkMgNjQ4NyB0aGF0IHJlZHVjZXMgYXNwZWN0cyBvZiBvcGVyYXRpb25h bA0KICAgZnJhZ2lsaXR5IGluIHRoZSBtYW5hZ2VtZW50IG9mIGNlcnRpZmljYXRlcyBpbiB0aGUg UlBLSSwgd2hpbGUNCiAgIHJldGFpbmluZyBlc3NlbnRpYWwgc2VjdXJpdHkgZmVhdHVyZXMuDQoN CiAgIFRoZSB1c2Ugb2YgdGhpcyB1cGRhdGVkIHByb2NlZHVyZSBpcyBzaWduYWxlZCBieSBmb3Jt IG9mIGEgc2V0IG9mDQogICBhbHRlcm5hdGl2ZSBPYmplY3QgSWRlbnRpZmllcnMgKE9JRHMpIGlu ZGljYXRpbmcgdGhhdCB0aGUgYWx0ZXJuYXRpdmUNCiAgIHZlcnNpb24gb2YgUkZDIDM3NzkgWC41 MDkgRXh0ZW5zaW9ucyBmb3IgSVAgQWRkcmVzc2VzIGFuZCBBUw0KICAgSWRlbnRpZmllcnMsIGFu ZCBjZXJ0aWZpY2F0ZSBwb2xpY3kgZm9yIHRoZSBSZXNvdXJjZSBQdWJsaWMgS2V5DQogICBJbmZy YXN0cnVjdHVyZSAoUkZDIDY0ODQpIGRlZmluZWQgaW4gdGhpcyBkb2N1bWVudCBzaG91bGQgYmUg dXNlZC4NCg0KICAgRnVydGhlcm1vcmUgdGhpcyBkb2N1bWVudCBwcm92aWRlcyBhbiBhbHRlcm5h dGl2ZSB0byBST0EgKFJGQyA2NDgyKSwNCiAgIGFuZCBCR1BTZWMgUm91dGVyIENlcnRpZmljYXRl IChCR1BTZWMgUEtJIFByb2ZpbGVzIC0gcHVibGljYXRpb24NCiAgIHJlcXVlc3RlZCkgdmFsaWRh dGlvbi4NCg0KDQoNCg0KVGhlIGZpbGUgY2FuIGJlIG9idGFpbmVkIHZpYQ0KaHR0cHM6Ly9kYXRh dHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1zaWRyLXJwa2ktdmFsaWRhdGlvbi1yZWNv bnNpZGVyZWQvDQoNCklFU0cgZGlzY3Vzc2lvbiBjYW4gYmUgdHJhY2tlZCB2aWENCmh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWlldGYtc2lkci1ycGtpLXZhbGlkYXRpb24t cmVjb25zaWRlcmVkL2JhbGxvdC8NCg0KDQpObyBJUFIgZGVjbGFyYXRpb25zIGhhdmUgYmVlbiBz dWJtaXR0ZWQgZGlyZWN0bHkgb24gdGhpcyBJLUQuDQoNCg0KDQoNCg0KDQo= From nobody Wed Jul 26 14:30:35 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 822991317C1; Wed, 26 Jul 2017 14:30:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.203 X-Spam-Level: X-Spam-Status: No, score=-4.203 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ePwohz9wsOuM; Wed, 26 Jul 2017 14:30:26 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3064131471; Wed, 26 Jul 2017 14:30:26 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id 9628DB81913; Wed, 26 Jul 2017 14:30:16 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, sidr@ietf.org Message-Id: <20170726213016.9628DB81913@rfc-editor.org> Date: Wed, 26 Jul 2017 14:30:16 -0700 (PDT) Archived-At: Subject: [sidr] RFC 8181 on A Publication Protocol for the Resource Public Key Infrastructure (RPKI) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2017 21:30:28 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8181 Title: A Publication Protocol for the Resource Public Key Infrastructure (RPKI) Author: S. Weiler, A. Sonalker, R. Austein Status: Standards Track Stream: IETF Date: July 2017 Mailbox: weiler@csail.mit.edu, anuja@steer-tech.com, sra@hactrn.net Pages: 21 Characters: 38546 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-sidr-publication-12.txt URL: https://www.rfc-editor.org/info/rfc8181 DOI: 10.17487/RFC8181 This document defines a protocol for publishing Resource Public Key Infrastructure (RPKI) objects. Even though the RPKI will have many participants issuing certificates and creating other objects, it is operationally useful to consolidate the publication of those objects. Even in cases where a certificate issuer runs its own publication repository, it can be useful to run the certificate engine itself on a different machine from the publication repository. This document defines a protocol which addresses these needs. This document is a product of the Secure Inter-Domain Routing Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Wed Jul 26 14:30:53 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 47D22131D21; Wed, 26 Jul 2017 14:30:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.203 X-Spam-Level: X-Spam-Status: No, score=-4.203 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id adXRqc7vu9db; Wed, 26 Jul 2017 14:30:32 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 367241317C1; Wed, 26 Jul 2017 14:30:32 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id D8C03B81918; Wed, 26 Jul 2017 14:30:21 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, sidr@ietf.org Message-Id: <20170726213021.D8C03B81918@rfc-editor.org> Date: Wed, 26 Jul 2017 14:30:21 -0700 (PDT) Archived-At: Subject: [sidr] RFC 8182 on The RPKI Repository Delta Protocol (RRDP) X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2017 21:30:34 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8182 Title: The RPKI Repository Delta Protocol (RRDP) Author: T. Bruijnzeels, O. Muravskiy, B. Weber, R. Austein Status: Standards Track Stream: IETF Date: July 2017 Mailbox: tim@ripe.net, oleg@ripe.net, bryan@cobenian.com, sra@hactrn.net Pages: 24 Characters: 52486 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-sidr-delta-protocol-08.txt URL: https://www.rfc-editor.org/info/rfc8182 DOI: 10.17487/RFC8182 In the Resource Public Key Infrastructure (RPKI), Certificate Authorities (CAs) publish certificates, including end-entity certificates, Certificate Revocation Lists (CRLs), and RPKI signed objects to repositories. Relying Parties retrieve the published information from those repositories. This document specifies a new RPKI Repository Delta Protocol (RRDP) for this purpose. RRDP was specifically designed for scaling. It relies on an Update Notification File which lists the current Snapshot and Delta Files that can be retrieved using HTTPS (HTTP over Transport Layer Security (TLS)), and it enables the use of Content Distribution Networks (CDNs) or other caching infrastructures for the retrieval of these files. This document is a product of the Secure Inter-Domain Routing Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Wed Jul 26 14:31:19 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 288FA131E63; Wed, 26 Jul 2017 14:31:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.203 X-Spam-Level: X-Spam-Status: No, score=-4.203 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MswV4yjR_mga; Wed, 26 Jul 2017 14:31:07 -0700 (PDT) Received: from rfc-editor.org (rfc-editor.org [4.31.198.49]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 747C9131E6B; Wed, 26 Jul 2017 14:30:47 -0700 (PDT) Received: by rfc-editor.org (Postfix, from userid 30) id E9A64B81921; Wed, 26 Jul 2017 14:30:34 -0700 (PDT) To: ietf-announce@ietf.org, rfc-dist@rfc-editor.org X-PHP-Originating-Script: 1005:ams_util_lib.php From: rfc-editor@rfc-editor.org Cc: rfc-editor@rfc-editor.org, drafts-update-ref@iana.org, sidr@ietf.org Message-Id: <20170726213034.E9A64B81921@rfc-editor.org> Date: Wed, 26 Jul 2017 14:30:34 -0700 (PDT) Archived-At: Subject: [sidr] RFC 8183 on An Out-of-Band Setup Protocol for Resource Public Key Infrastructure (RPKI) Production Services X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 26 Jul 2017 21:31:18 -0000 A new Request for Comments is now available in online RFC libraries. RFC 8183 Title: An Out-of-Band Setup Protocol for Resource Public Key Infrastructure (RPKI) Production Services Author: R. Austein Status: Standards Track Stream: IETF Date: July 2017 Mailbox: sra@hactrn.net Pages: 23 Characters: 46747 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-sidr-rpki-oob-setup-09.txt URL: https://www.rfc-editor.org/info/rfc8183 DOI: 10.17487/RFC8183 This note describes a simple out-of-band protocol to ease setup of the Resource Public Key Infrastructure (RPKI) provisioning and publication protocols between two parties. The protocol is encoded in a small number of XML messages, which can be passed back and forth by any mutually agreeable means which provides acceptable data integrity and authentication. This setup protocol is not part of the provisioning or publication protocol; rather, it is intended to simplify configuration of these protocols by setting up relationships and exchanging keying material used to authenticate those relationships. This document is a product of the Secure Inter-Domain Routing Working Group of the IETF. This is now a Proposed Standard. STANDARDS TRACK: This document specifies an Internet Standards Track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the Official Internet Protocol Standards (https://www.rfc-editor.org/standards) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor@rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC From nobody Wed Jul 26 20:30:21 2017 Return-Path: X-Original-To: sidr@ietfa.amsl.com Delivered-To: sidr@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F3D8A131DA3; Wed, 26 Jul 2017 20:30:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.902 X-Spam-Level: X-Spam-Status: No, score=-6.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4k1VR_teRBSL; Wed, 26 Jul 2017 20:30:19 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E4983129ADA; Wed, 26 Jul 2017 20:30:15 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.86_2) (envelope-from ) id 1daZV6-0003uw-EH; Thu, 27 Jul 2017 03:30:12 +0000 Date: Thu, 27 Jul 2017 12:30:10 +0900 Message-ID: From: Randy Bush To: "Alvaro Retana (aretana)" Cc: "sidr@ietf.org" , "morrowc@ops-netman.net" , "sidr-chairs@ietf.org" , "draft-ietf-sidr-rpki-validation-reconsidered@ietf.org" In-Reply-To: <943AE76A-DF05-48F1-B0B1-44701ECD406D@cisco.com> References: <150109758383.22932.4989139734698533154.idtracker@ietfa.amsl.com> <943AE76A-DF05-48F1-B0B1-44701ECD406D@cisco.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/24.5 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [sidr] Last Call: (RPKI Validation Reconsidered) to Proposed Standard X-BeenThere: sidr@ietf.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Secure Interdomain Routing List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 Jul 2017 03:30:20 -0000 > I want to call attention to this Last Call. /me is holding his nose