Subject: SCVP 28

From: Sam Hartman <[email-masked]>
Date: Thu, 19 Oct 2006 16:20:17 -0400

Hi.

I notice that SCVP 28 was posted.

I'd appreciate a response to my AD comments as well; in many cases I
was asking questions as much as asking for specific changes.  I find
it easier if a WG explains its intent than to go looking through a
document to infer the answers to questions from diffs.

Also, I'm a bit puzzled how some of my questions--particularly
mandatory-to-implement behavior--could have been answered without WG
discussion.  I cannot see any such discussion in the archive.

--Sam

---

From: Tim Polk <[email-masked]>
Date: Tue, 31 Oct 2006 17:10:50 -0500

Hello Sam,

At 04:20 PM 10/19/2006 -0400, Sam Hartman wrote:

Hi.

I'd appreciate a response to my AD comments as well; in many cases
I

was asking questions as much as asking for specific changes.  I
find

I have appended your earlier message below.  Responses from the
editors are in-line.

Also, I'm a bit puzzled how some of
my questions--particularly

mandatory-to-implement behavior--could have been answered without
WG

I believe you are witnessing extreme working group fatigue with respect
to SCVP.

Since there was no discussion on list after your August posting, the
editors drafted

a consensus response  to your comments and started working on a
corresponding

new draft.  Our intention was to post the editors' response draft
and a direct response

to your comments simultaneously.  Unfortunately I was distracted by
the imminent

FIPS 201 rollout when the document was posted.

Perhaps a concrete proposal (i.e., draft 28) will stimulate WG discussion
with respect to

your issues.

--Sam

The original message...

At 05:04 PM 8/7/2006 -0400, Sam Hartman wrote:

Hello.

As part of the publication process for draft-ietf-pkix-scvp-27 I
have

reviewed the draft as the AD bringing it to the IESG.

I've found a few issues that I believe need to be handled before
the

draft can be last called at the IETF level.  In many cases

clarifications of text will be sufficient to address these issues.

There are a few concerns about interoperability though.

Section 3: The text does not state a good reason why

anyExtendedKeyUsage is not sufficient for a cert to be used to sign

scvp requests.  Please either provide such a reason or require

servers to accept this keyPurposeID.  If you believe that some

environments may have a good reason to reject anyExtendedKeyUsage
but

others will not, then state that servers SHOULD accept the usage and
describe these differences.

We agree that anyExtendedKeyUsage should be sufficient for a cert to be
used to sign

scvp requests.  We implemented the following clarifications in
sections 3 and 3.11:

Current text from Section 3

If the client uses SignedData it MUST have a public key that
has

been bound to a subject identity by a certificate that
conforms to

the PKIX profile [PKIX-1] and that certificate MUST be
suitable for

signing the SCVP request.  That is:

1. If the key usage extension is
present, either the digital

signature or the
non-repudiation bit MUST be asserted.

2. If the extended key usage
extension is present, it MUST

contain either the
SCVP client OID (see Section 3.11), the

^^^^^

anyExtendedKeyUsage OID, or

^^^^^^^^^^^^^^^^^^^^^^^^

another OID
acceptable to the SCVP server.

Section 3.11:

If the certificate used on a validation
request contains the

extended key usage extension [PKIX-1, section 4.2.1.13], the
server

SHALL verify that it contains the SCVP client OID, the

^^^^^

anyExtendedKeyUsage OID, or another OID

^^^^^^^^^^^^^^^^^^^^^^^^

acceptable to the server.

For consistency, we made complementary changes to validating an
SCVP response.  We made the following change to Section
4.14.2

If the certificate used on
a validation policy response or a

validation response contains the extended key usage
extension [PKIX-

1 section 4.2.1.13] it MUST contain either the
anyExtendedKeyUsage

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

OID or the following OID:

^^^^^^

id-kp-scvpServer
OBJECT IDENTIFIER ::= { id-kp 15 }

>   All SCVP
clients MUST support SignedData for signed requests and

>   responses.  SCVP clients SHOULD support
AuthenticatedData for MAC

>   protected requests and responses.

What are the requirements for servers?

Requirements for Servers are currently specified in Section 4:

For protected requests and
responses, SCVP servers MUST support

SignedData and SHOULD support AuthenticatedData.  It is
a matter of

local policy which types are used.  Where a protected
response is

required, SCVP servers MUST use SignedData or
AuthenticatedData,

even if the transaction is performed using a protected
transport

(e.g., TLS).

It creates a redundancy, but we decided to modify the text you
quoted from Section 3

to reiterate the server requirements in Section 4:

All SCVP clients and
servers

^^^^^^^^^^^

MUST support SignedData for signed requests and

responses.  SCVP clients and servers

^^^^^^^^^^^

SHOULD support AuthenticatedData for MAC

protected requests and responses.

How does a client obtain the
server's key agreement public key?  The

section 3 text says that the client must do so but does not
describe

how.  Is a normative mechanism required here?  If not, you
still need

to describe possible methods.

Clients may obtain a server's key agreement key out of band, or through
the

validation policy response message.  Servers are required to support
the validation

policy response message.  Clients are not required to support either
mechanism,

since the AuthenticatedData mechanism is itself optional.

We implemented the following changes in Section 3 of draft 28:

The client MUST put its
key agreement public key or an unambiguous

reference to a certificate that contains its key agreement
public

key in the AuthenticatedData that encapsulates the
request.  If an

ephemeral key agreement key pair is used, then the ephemeral
key

agreement public key is carried in the originatorKey field
of

KeyAgreeRecipientInfo, which requires the client to obtain
the

server's key agreement public key before computing the
message

authentication code (MAC).  An SCVP server's key
agreement key is

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

included in its validation policy response message (see
Section 6).

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The recipientInfos field of

AuthenticatedData MUST include exactly one RecipientInfo,
which

contains information for the SCVP server.  The
AuthenticatedData

MUST NOT include the unauthAttrs field.

Section 3.1

The text claims the version must be increased for any change in
syntax

or semantics.  Do I need to increase the version number when I
define

an extension?  If not, please note this.

Specification of extensions may be performed without any change in the
version number.  This

is consistent with versioning for X.509 certificates and CRLs.  To
clarify our intent, we propose

the following changes to the text in 3.1:

The cvRequestVersion item
defines the version of the SCVP CVRequest

used in a request.  The subsequent response MUST use
the same

version number.  The value of the cvRequestVersion item
MUST be one

(1) for a client implementing this specification.
Future updates to

this specification must specify other values if there are
any

changes to syntax or semantics.  However, new
extensions may be defined

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

without changing the version number.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Section 3.2 The ASN.1
tagging for the Query type looks strange.  There

is no context tag 0; not all optional fields are tagged.  What is
the

style being used here?

First, the lack of a context tag [0] reflects the evolution of the
message formats.  When items were removed, we did

not reorder the tagging.  To be honest, the working group is split
on this issue.  Implementers with running code

object to renumbering the tags, but others object to missing tag numbers
as inelegant.

Second, the working group has traditionally objected to the use of
explicit tags when the

encoded ASN.1 is unambiguous.  That is why some optional fields are
not tagged.

We inserted a comment into the ASN.1 that indicates that tag [0] was not
used.

This way, new implementers will not be worried that they made a cut and
paste error

and old implementers are not recompiling for the 29th time.

In 3.2.4.5 and 3.2.4.6, if the
server does not support these flags,

must it error if they are set or can it ignore them?  The text
is

unclear.  Later text implies that the server should generate an
error

if these features are requested but they are not available; if so,

please clarify this text.

If servers receive a request they cannot satisfy, they must return an
error message.

From Section 4:

Successful responses are
made when the server has fully complied

with the request.  That is, the server was able to
build a

certification path using the referenced or supplied
validation

policy, and it was able to comply with all the requested
parameters.

If the server is unable to perform validations using the
required

validation policy or the request contains an unsupported
option,

then the server MUST return an error response.

We do not believe a change in 3.2.4.5 or 3.2.4.6 is needed.

However, in our review of this text we realized that the
definitions

of the error codes in section 4.4 may be too narrow.  In draft
-27,

the codes only allowed the server to indicate that the a value of

TRUE (e.g., for required explicit policies) is unsupported.

Consider the case where a server is hard coded to process with a
value

of required explicit policies of TRUE.  If the client indicates
this

should be false, what is the error code?  This was fixed by

generalizing the error codes, so that both error cases were
supported

by the error code.

Section 3.2.4.9 does not
provide sufficient semantics to meet the

needs of common applications.  For example

draft-ietf-cat-kerberos-pk-init requires that pk-init certificates

have the ExtendedKeyUsage extension in some cases.  SCVP itself
does

not currently permit the anyExtendedKeyUsage value, so SCVP doesn't

even provide good enough extendedKeyUsage handling to validate SCVP

server certificates.  At a minimum support is required for cases
where

EKU needs to be present and where anyKeyUsage is not acceptable.

This is an interesting case.  SCVP needs to support the current
(-27) functionality *and*

the functionality you requested.  Two options wre available:
(1) change the ASN.1 from a

sequence of key purpose OIDs to a sequence of a sequence of key purpose
OIDs and a

processing flag or (2) add a second extended key usage item with the
current syntax and

the requested functionality.

The editors chose to add a second item, since that provides the most
flexibility with

the least disruption to the protocol.  The functionality you
requested is supported by

the specifiedKeyUsages item, which is defined in section
3.2.4.10.

Are all clients guaranteed to
interoperate with all servers?  It seems

there is an incomplete overlap between DPD and DPV and it is not
clear

that servers are required to support one of these configurations.

It's not clear that this meets RFC 2026's definition of

interoperability.  If so, that needs to be fixed.

Conforming clients will always generate requests that conforming servers
can process.  If the

server can not satisfy the request, it will generate an error message
that is recognized by the client.

Clients that request DPV services from a DPD-only server will receive
such an error message.  (See

the text quoted from Section 4 above.)

Does this satisfy your interpretation of the interoperability
requirements

in RFC 2026?

Section 4:

>    1. A success response to a request made over a
protected transport

>       such as TLS.  These
responses SHOULD NOT be protected by the

>       server.

Why is that a should?  IT seems useful to protect such responses
so

that for example they can be included by relaying scvp servers in

their responses while still preserving authentication.  In
general,

TLS does not provide data origin authentication to third parties,
but

protected responses do.

This is actually redundant information.  In section 3.2.5.3, DPV
clients are required to

request a protected response unless they use a protected transport (e.g.,
TLS).  Since

client is required to request the appropriate services, a server need
only act on the

information in the request.  Worse yet, this text implies that a
client using TLS for transport

cannot also obtain a signed or MACed response.  As noted, these
mechanisms provide different

properties.

We deleted #1 entirely, to ensure that clients are able to obtain the
necessary services.

The remaining items are sufficient...

Section 6.1:

>   The syntax and semantics of the vpResponseVersion item
are the same

>   as cvRequestVersion as described in section 3.1.
The

>   vpResponseVersion used MUST be the same as the
vpRequestVersion

>   unless the client has used a value greater than the
values the

>   server supports.  If the client submits a
vpRequestVersion greater

>   than the version supported by the server, the server
MUST return a

>   vpResponseVersion using the highest version number the
server

>   supports as the version number.

Why is the above text necessary?

Validation policy requests are extremely simple.  We do not
envision

changes to this message, even if the validation policy response
message

were modified.

If the protocol must be extended to handle new fields appearing the

validation policy request, we would need to add considerable
complexity.

We would need to add extension mechanisms, or use an "ANY DEFINED
BY"

with the version number.

Shouldn't clients use the
oldest

vpversion in their request to discover what vpversions the server

supports?  The above text is potentially hard to implement because
it

assumes that future validation policy requests are backward compatible
when parsed by an old parser.

This would imply a multiple round trip protocol... the client requests
with the oldest version it supports,

and obtains a response in the same version.  If both parties support
a higher version, the client needs

to repeat the transaction to get the newer version with (we assume) the
additional information it contains.

Assuming the format of the request is static, we can complete this in one
round trip.  The client

requests with the newest version it can support, and the server responds
with that version, or the

highest version it supports.  This assumes the client can parse
"old" responses, of course.

i'm also not convinced that the
above text is implementable given the

current ASN.1 syntax with a modern ASN.1 toolchain--one that treats

extra fields in a sequence as an error.  You can definitely
implement

parsing all the versions you support by trying to parse each
version

separately, but I'm not convinced that with such a tool chain you
can

implement parsing part of a structure that is newer than you
support.

Again, we would not expect to add additional fields to this
request.  Any

changes in the new version should be restricted to the response
message.

This would avoid the iterative parsing attempts...

How does a client discover what
WantBacks and Checks a server

supports?

The client requests the appropriate wantbacks and checks for their

application.  If the server generates an error message if it cannot
support

the wantbacks or checks.   This is not generally a problem for
checks, since

most requests assert only one.

For wantbacks, all servers are required to support the core wantbacks
(the

public key and the certification).  DPD servers are required to
support returning

the path and the revocation information.  Additional wantbacks are
not required

for DPV servers.  In general, a failure on these wantbacks indicates
a fundamentlal

mismatch between the client's requirements and the server's capabilities,
so

further negotiation is not required.

The remaining wantbacks are related to niche cases from RFC 3379
where

the client and server can be presumed to have an out-of-band
relationship.

Since these wantbacks are not expected to be used with
"foreign" SCVP

servers, this negotiation of wantbacks is not required.

MIME

* the change controller for all IETF standards track mime

registrations should be the IESG

Okay.

There is a required parameter
(format) on all the mime types that is

neither documented nor used in the HTTP samples.  I suspect
this is

not actually desired..

Oops.  We missed this one.  We believe the correct answer is
"none".

I think vp-request and vp-response
are too generic of subtype names;

you can try to convince the ietf-types folks that they should
accept

this but I suspect you will run into trouble.

We didn't change the names, but we are not wedded to them either.

(To be honest, I'm not sure I know what a proper name would be.)

We figured we should go ahead and submit, and the registration

folks will tell if we need to make changes...

Thanks,

Tim Polk

Received: from cable-151-103.zeelandnet.nl (cable-151-103.zeelandnet.nl [82.176.151.103]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id kA159r68001043 for ; Tue, 31 Oct 2006 22:09:54 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001101c6fd73$f9da7db0$6797b052@maarten>
From: "similarly post"
To: [email-masked]
Subject: minutes
Date: Wed, 1 Nov 2006 06:09:58 +0100
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000D_01C6FD7C.5B9BD870"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000D_01C6FD7C.5B9BD870
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000E_01C6FD7C.5B9BD870"

------=_NextPart_001_000E_01C6FD7C.5B9BD870
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Ina pvr of ingttaking apretty a portion andarm. Lessons Yahoo aol Media =
Ticketsnyt Storenyt or headlines siteadd. Well bigger is Simd developed =
placethe gpu people already come.
Xgtgtthat is gtnow or really of kgtgtwith allgtgtas. Gebruiker Verwant =
Markeren.
Khan Guest of Posts na. Leverage itwasnt purposei cant.
Celebs am Babes am Tristan sep Update Friend name emails.
Acts played a Primavera Sound festival!
Kristina a Nieuwe komische Santa Clause Escape. Isbn Consolerf database =
toolvideo gamesvideo in Brief consolesa.
Truth using plan toview could upgrade am. On blocked wroteas rd Todd of =
wrotebill wrotegtgt or. Armorgames a Newsjerks Fazed or.
Soda water heated remove highly am addictive a smoked reports or. =
Myspace etc url Likes Tags.
Uroblink internet Neworder comp Edge multimedia Dvdstreams am. Projector =
projected is onto neon colored screen Winamp.
Ina pvr of ingttaking apretty a portion andarm. Sempron is fx Cpusthe =
Socket is Semprons modelamds is flagship lofty Cpusamd. Grafix stored =
smart cards efirst a.
Soldering irons Enter Dare Wikipedia.
These or simple a youregoing is.
Desktopthe a Nowhrs hp Blog. Wellgta yeti verywell am many arm of =
vendors or whatshare. Xgtgtthat is gtnow or really of kgtgtwith =
allgtgtas.
Entitle offer discounted.
Healing am healthful itskind prozac supposed sexual of longterm psyche =
of wrotes.
Apathy is lust is takes or seesaw combines a buying! Lessons Yahoo aol =
Media Ticketsnyt Storenyt or headlines siteadd.
------=_NextPart_001_000E_01C6FD7C.5B9BD870
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Ina pvr of ingttaking apretty a portion =
andarm.=20
Lessons Yahoo aol Media Ticketsnyt Storenyt or headlines siteadd. Well =
bigger is=20
Simd developed placethe gpu people already come.
Xgtgtthat is gtnow =
or really=20
of kgtgtwith allgtgtas. Gebruiker Verwant Markeren.
Khan Guest of =
Posts na.=20
Leverage itwasnt purposei cant.
Celebs am Babes am Tristan sep Update =
Friend=20
name emails.
Acts played a Primavera Sound festival!
Kristina a =
Nieuwe=20
komische Santa Clause Escape. Isbn Consolerf database toolvideo =
gamesvideo in=20
Brief consolesa.
Truth using plan toview could upgrade am. On blocked =
wroteas=20
rd Todd of wrotebill wrotegtgt or. Armorgames a Newsjerks Fazed =
or.
Soda=20
water heated remove highly am addictive a smoked reports or. Myspace etc =
url=20
Likes Tags.
Uroblink internet Neworder comp Edge multimedia =
Dvdstreams am.=20
Projector projected is onto neon colored screen Winamp.
Ina pvr of =
ingttaking=20
apretty a portion andarm. Sempron is fx Cpusthe Socket is Semprons =
modelamds is=20
flagship lofty Cpusamd. Grafix stored smart cards efirst a.
Soldering =
irons=20
Enter Dare Wikipedia.
These or simple a youregoing is.
Desktopthe =
a Nowhrs=20
hp Blog. Wellgta yeti verywell am many arm of vendors or whatshare. =
Xgtgtthat is=20
gtnow or really of kgtgtwith allgtgtas.
Entitle offer =
discounted.
Healing=20
am healthful itskind prozac supposed sexual of longterm psyche of=20
wrotes.
Apathy is lust is takes or seesaw combines a buying! Lessons =
Yahoo=20
aol Media Ticketsnyt Storenyt or headlines =
siteadd.

------=_NextPart_001_000E_01C6FD7C.5B9BD870--

------=_NextPart_000_000D_01C6FD7C.5B9BD870
Content-Type: image/gif;
name="wouldnt.gif"
Content-Transfer-Encoding: base64
Content-ID: <000c01c6fd73$f9d77070$6797b052@maarten>

R0lGODlh7AH8AYf2AAAOAX0AAAB1B3p1DAIHeX8AhQF8h7nGvsTWsbHD50MtAGIaB4QVAJYnAL8Y
DOYbBwIzDRhJAThJAFdAAX5MAKVIALszBddFAwBpACxtAENVAGlsAIJaAJ1iDM1oANRbAAB8ASB0
ADl2AF6GA3xxA5R2BcaNA9aICQCoBiGVBzGTCGaYBoOjAKugDM2UAOOjDgu1ACO5ADuyAF+5DH3C
C6zKAbrMCt7DAA3WABjeAEXqAF/RDo7kApvTCbLtCdzVAAgGNi4APzUAQF4FTIEARKYAQMcASuMA
Ow0oQSsnSkYnNGUlOX0kRZcmM8ITTtoTPAhLTREyPTVNM2I3ToxFO6o/RbpKPtc3PwZjNipfMTpd
SmtgNYBqAJ9WRsFjP+BgSwWDThaDMTZyOWuFO3OHP5t4QsuMNdh5PwKnMxaRSz6sRlSUP42aNqup
SLypOeiePQbDMhLHOT3LOmC6OH26Na3DQMa9P+i0OwDiQiDRPEvmNV/fSIzVTa7tM8nbMtreRQQI
eBoOgjQAh2MBin8IdpYEeLUNeN4AegokdBYheUondmUmcnkbhJUVgMMZe9QhgwBIgi41ez5IimVI
gHNEhaFGg8QyjdU8iARRcxtlgEthhGJpi3FaeqVgib9UdedRfQyHcxuBfjiFilR8g41xjZ+OjLt1
cdx5fwCrhiyiikWbgGyggn+ZgKmRc8iqjOWVggzFeBG4jU21e222i4W3eZnBg7PLc9HDfwDYhifq
fkjteWHUdojud6voeb/TdNHXjg4AuRMBwTsAv1cCtnoAyqAMybEMv+gAuAEZuCUsvkMRtFsZwI0X
xZkgyscUvO4TzgtCwRQ0tTkzu2U3yYJCvKY4zcQyuehNxQ5UxSBcvzJsu2FpuXxctaJjubFry+BV
vAx6wBh9v0V1u1eIvnN/sqaEt759ytWGuwCVuxWUtz2Sxl6gtHSSxaKlw8GTx+iVwwDFxBXNxDe2
umPMtYrFu6G+tf/34aGSnYmLfv8KAAD/A//wBAAA8fgH8gD68v///yH5BAAKri0ALAAAAADsAfwB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8eN/0KKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp86PQIMKHUq0qNGjSJMqXbrQp9OnUKNKnUq1qtWrWLNq3cq1q9evYMOK
HRuTqdmzaNOqXcu2rduDZOPefCS3rt27ePOafMu3r9+/gAMLBqq3sOHDiBMrnjq4sePHkCNLLrq4
suXLmDNr3sxSE+fPoDEXCx1ysunTqFOrXs26tevXFlPAnk27tu3buP+S3s27t+/fwIMLH06cau7j
yJMrX868ufPn0KNLn069uvXr2LNr3869u/fv4MOj/x2XHKb489aLf434ob099wQ/vC8ov719+Pfr
57c/kH//+/QBmJB88dH33n4GJigQgQsauB+DCwp4oH8BQgjhfA8eqOCEGW7I4IPwNVhggR0aZKGE
HFIYoYos+ndhivnNh95SBIbY4IX1HYTjiP/1KKOIPwJpIolEKvTihz/u+KKHQp7oo5I67qgjj/1V
eSRCFgaZI0NbalmlkVR+mOWVX5Y5I1I1epmkkGYOSaWMWbK5EJJIBjmlgl2uaaebVoaJ55dL5rmk
mjzmKWeZXabJpZ5ADmpmnHvuCemhCuVyJkZpxllnoGC2eWOhENEJ6Jx8Cjpqp30ieuemU07q559k
3v+J4amk1tkoqY9SGqudjl7qkHmKsipihyrmOuSkxWKZKpwIxleiqcM2ayyknOqZoaKRavmspAMu
W6O0RRJaYpMjDgrimwSqdxictCY6p5SH6pdshLgK2yu3jM5K6X8UxujpmraCmq2r7LLpKLbBLhot
i+8WizB/u0qpblcSIXxrwN0a6+C/HHubr6yAouguqgLH63Gpur7JrMNgirovv/hprKzBchpK6Mu+
eoStvjzfSy66P4Pc6skZl5srxny+SjPRfpqrssUqhzsyqjsjzaSq4cqcc1I7a6j10gaLuTS8geJo
9dO8Kj3zhkmKrXabNr7Nc9BRBtgxzVLeS7aPn17/fffWCsEEsd2PNuvvvwwnePjAHoLLLbzaLh5p
xHE3iaDZaz/ud+aRo5j2leM+bqOAESc4cWGq+Qz41qfrlZrqq+fculax1267d+bdrvt2s6O0++/A
1xYGQ7kHbzx0vZ90/PLMz2ZePtBDL1D00k+fT0HX20N99gdRjz1B0WvP/fTWh4+Q+eSDL/7261ff
PfvlY+++9guhL/734I9P/0D26z++/t1TSP/81z775e9/8OOf98o3v/c1EIHyK6BBEEjB7D0wfcnb
C0QI+D/rfY+AEeSfCDt4P/WBMH8KTN8IAyhCFuJvfzC0oAC5V70LolB9JSzhCa8HQAX2MIc15CBD
/9xXQwHikIQTRCIPU4hCJNJPiR204Q9n1EMSLnGF9UvIFdO3xScO8YU0VCEOxTjGFrYwjDB0IRfT
KMQzgtGMXjSiGvfXxS6eD39TTGMcyQjHD2LRiztkYx/JZ0XuwKSKRxRkHvXoRzdGMYsTVKEMIzlI
PoIwjHlEZB0bSUgWorGTcnyhCRUJSU7OcZOUvCMmVxjIQgbQlRksiUQGiL5J0rGBlfwjHSUZvzmu
kYvbQ2USzXdJVuJSk7xMJCjxCEc7prKMWMRkMEU5wgSK0ZaMzOYfZcjNMqLyh7bEJnaKp0Nl7vKG
Y1zgJ8NJxmO6cItVXOAXdyg9eFJzmeJEozNjKP9IPkLTn/bc4x0jmUl5WvOfZpzkFXkoT37+sn0O
nWQsa0JQToqznZRMIDuzecJ0OvSNDbEjMjFa0Ycmc5+r9CEuETrSXS6ypb786D1VulGBHpCIlowo
Bic6k5LqEqXPPKdOdTnIjgZUlItcZk5lStJHelOo1+ynNv2pR2wuManF1KIawTlQoaY0les0pR15
OpM2mvR+HfUgURUawbQC0ain3GoymWlJGuYzrUFkYjNnSlUi3nWqei2iVoMaz1Ea1pR9DKdTmZg9
sspEgpCtqgUbKj/BVlOkkzXgAbc6TQDGc36aZeNKe9lOvFJQriylrA+hWc9pOhChlfTs+YiJWKX/
JnZ9Ny3tTsnavN769rfADa5wh0vc4iaFnMZ1i2OXi5nk9oW50BWLc7nzg+bE4XjIna5aostdr0RE
AAUBL0HEKxDyCuC86EXvQNJbXoOQt7zpje951yvf+h7kvfIdb37Dy976zre99FUvfP073/+uV78G
Tgh7wzte7c4IJvi1R4Tb+14A07fBFZawexmskAlbmMIH1u+H78vhEWvYvA0uMYATrGEJe5jEIXbx
hLtL47y0+MQxxrGKb5ziHueYxzD+cIXBi2IOZ3jHSCZyjjM8ZBCH+MgOaXKIa0xlq0gExUV2so+h
zOQN+zjIPG5yljG8ECibWMlC9vKTwwzk76rY/8wOjh2Wl9zmFyM4vmo28Zu/jOY2n3i/CAazlu0M
ZPEa+sBwVjCL2Rxn4B16xTGWsp7rnGc/b3nBkdZznxnCYkkbGtN8tvChzSvghkja0o3WTu76vGk8
bxkhXd5xoj085AUfedOm5rOtfzziR7cY16iu9IyrTGzp6vjYNz61n2Md6g6/OtOUDjaYPZ1mWafZ
15MW9JHlcoBicxe+/P2xnRMMbGZnu9prJrOIpX3qcRfa2oX+9Jf3/Gxv27snFGk3vfn7X3PLeN77
RjSDAS1jUA+406E2N34LHO4AJ7rgd8Z2qqUjhYlb/OIZyS7Gj3Lvjudk4yAPuchHTvKSm3y6Hv9P
ucrtffKWT6QNu1u5zJnbhpmXZndUcLlfYF6UF7wAOTYPOk9r/hSfv0DoSE/6XYiucp07PSI8X53S
p346plP96lj/jNXv/fSuQyTqGAeA2MdO9rF7/ey2ybra134ZtLsdeGyPu9xR9/a6227ueM+73vfO
9777/e9Tt7vgB0/4wgMG8IhPvOIrA4/FJ93wkI+85CdP+cpb/vKYX4rjN8/5znv+86APvehHT/rP
Z/70zim96vuO+ta7/vVnX33oBfF32Nu+NrLPve53z3vo3v73r9H4apT3Kw0CvyEqAYHcaUN85Bv/
+E3BOvSRwo+GVL8217c42ZUi9oEAIDD8CH//9bNvj+yHfyDkT7/4BSL+87d//O0vf/zjX5D1n5/9
8r8/+9ePfvebv//6h38AiH4EOBH8l3/6R38EMX/8l4D7F4AIKIDlJ4HMYx7fZxbdJxAXqBHNRzwm
QX4TWIDyJ4IhKIHjdxAg+H8LSIIC6IAqCIIrOIItmBAqGII1CBE3mH40WH8E6II7iH/Xp4JZFxEb
SBBmZw9ml4Hbp4FKeIQbWITfd4FS2IRR+IQZiIREkYIxGIQUqINAiII8SIElCINcWIYrCIMFeIIT
iIYmyIP2d4ANWIJyOIYsOIMxuIY2OId3eIJa2DwwUYQa6H1YOIhRKIhGOIhY+ISHKIUFUYiE/4iI
jEgQHRh9stSA72eHXviAQXiAc2h+cSiGeWiGaQiBofiFCHGDeNiG/weBfUiHBuGJm3h/ahiLr9iD
ZGgPiQeIkPiIiWiI26eIvXiIwfiLgZiIS2gQkxg4z6eGmNiFe6iHnciCCriFX5iJYsiFeMiGrtiD
Igh/9leLzwiKp0iHoiiNlliLuWgQihiJjhiM7siIgAiPu8iOiJgQyWiPyyiH3viNJLiKYBiOafiP
ZmiN0ViK2oiKzOiPdyiN3egQCVmKCxmNWph49TiPxdiOGLmLxSiMSJiR9AiMgHiPCNGBzJiKpuiM
JxmRCFmH2DiCqFiQniiO+hiQqsiN4DiTLP9ZiwopgzTZhzo4hBKxhE54kR15hcS4kbpohUzYffRY
lIYoFPSng1L5hv4niwrYipdojfzoknDIifk3hrDYil/Zf674ia/IivX3iVFpllX5gmGYh70lfA2h
iwxBl0IhknDxfOKhjcpxfUBJFHapEIFpd3x5HIU5fYiZmIq5mIzZmI75mJAZmZI5mZRZmZYZfL2X
mUp3mZxJGZr5maAZmqI5mqRZmnrZmajJEXKJEXgZGK1ZHaZZF6k5mx2xmhfxmrqhQRWwEbvJGr2J
i7EZF0R4hByZHb8pEMdZEMlpD7/ZmxXwnM75nAMBncdJndMpncwJndeJndnZnASxm9wJntb/yZzT
SZsfAYzfMZ7cqZzJGZ7IWZ7k+Z4H4Z3yuZz2CZ/VmZ3wGZ/yyZ/muRHrOIxU+JTJAZ7KmRD56Zz7
qaD+eaD42Z8QGqEGWp4TSp8Qupz/WRB/KIhKWI8gOZKn2RgnMaH7aRD0yaDdeaII+p39qZ0N2qAk
Sp4VWqL5GZzCCRFCyaFGeIzN4aIRyqLIaZ0WyqDRmZ8PeqD3yaIJ+p4W6p8YmqEDsaEc2Y4VqYyy
JBnER6JP+qIoqqJOCqT1aaJciqRKyqQ0yqI2ShZE2Ig6+pSRyBxaCqZjyp9eSqdg2qRh6qDxuaRB
WqJ6CqXI+BLx6IsDupEaGqKDMaI+uqjb/6mnRVqk21mdiyqd4xmk4bme6nmdZyqfaToWy7OlEQGq
kyGqgGo8pPoQp+oYqVqqrNqqgeoSRoGbmGmjM8B5FDGYFSmrrtGpcxeUxFmXC4Grk/GLTgiSv+qq
3SGsB4GrygoZgxqIRlmlyNocUuqmTkmFVtiUutoWz9qL8iiJvBp3vvqmjvit78iLq1GsHcqOVzit
zEFO3/qRbeqOArGtfOGR0Mqm4bp5wliuRBmg+QquVyoZ+EqvWLivbFcR6CmvATuMsFGwHcmm7pqs
v/qhxmiUHSqtw6qu5FqF7Tqx4dGsIIuaIjuyJnuymGebz4WoSIGwq+cQJUsU9oqjD+GygP83nMda
nHXJoxMRsx7RrU6JsrApqHMZlBlBlzMLs8VqrTZbeoMplBlbpVC4rks5hVZbjEkLrEAriE1Lejyr
kfOalMsasRbZsIOYtcFakWILnF27dwp7rYRKteq4o0xprWWnsUZRsRIrtDnTrRlpsEgZtvNqqEvx
t4TLt9FRrX4Ltna5sIxbtljLshdhuCHZtqEXtI3IsQRanEdZtUvpfZGItoJJnBz7fZbrtkfhswmh
uoCJuNrFunTbF7DrurRbu7Z7u7ibu7o7sTBxAgXhuycQvMILvMNLEL5rvAYxvMSrvMx7vL8bvMbr
vAIhvcX7vMI7ENI7vfaQvdxbvdPLvNH/C73hG73Pu73da77Ka76/i77Xm7zY27zei77ki7wphwK8
BRHcu70HQb3Iq73r27/+G8D6+74ErL79K74CPMD+m70D7LwMzL8JXMAL7MDHi8Dfa8AEzMAYrL3n
i70K7MEAjMDia8Ef7K4OHMEfDMElvMIAnMIt3MAuzMItXMHuq8APHMIIocElTMMnDLw2rL8a7MMe
fMNDXMMgvMMc/MKWaR4nzMIqnMRGvL8zfMTIK8RQrBAQTMRALMVHHMQ5LMVW7MNhvMXuy79efMVU
DMNl7MKn+3ER0cTNG8NFvL8kLMAq7MU0jMY57L1abMVT/L3pq8N4DMVCXMjse715TMb//6vIaZzI
VRzAOjyZuTPGyRu/aUzHi3zISqzIPPy+JJzFUSzI8XvGUTzHhtzJjNzFerzAjfy/g8zKbYwTE0HJ
i0zKC/HETYzClOzHCZy/WizDuezEX7zGkPzDq2zMvDzB7dvKwgzHqTnJxpzJv4zFf2zHrvzISPzC
yfzE1SzIwwzCuUzLyezC26zK2szMZsy2sUwTFMHNvZzJ50zF+XvB9NzBFjzPxczMpezI8zvBBfzK
62vL6mvP0lzLFNzLkZwdHCAexUO94PvLkZy+1SzP91y+nvzAlmzJwFzG4HvR1rvJ47y8xXu+Hf3O
FO3Q3Ay962xl07rSVeGuLs3Ou8uZMf9d0zZ909I305cpdMmA0z7900Ad1EI91ERd1Ea9dhJw1EhH
CVSn0zut1DaKAVA91TTm1FZ91bWBDli91ajBDVz91WAd1mJdHlRd1mZ91usy1ouJ1mzd1m4NFmq9
1m8912UR14lJ13gNq3aNmHnd1yqx14Ad2II92IQN1n592Iid2Iq92Izd2CPRcnbgHYZQ2JRdO47t
15UNeyormZctuZTZ2QP7zKD92NpQ2tpgD6Z92qhNEKqd2qxd2gOR2qet2gIh27FN26ht2rmt27uN
266927fN27kd28St274d3Mdd3K5N28xd28L92sz928Pt3LB9EMJ93L4N29i93Oo82rj/vdq1Pd2r
/d3EDd7fndwFUd3gXd7snd7FHd7r/drl3dzi3doIod6z7d7wPd4LYd/xfdvsTd70jd//3drNfd7d
/dYRgeDhnd/8bd3wzeD7Pd8TXuD3/d7mbRD+7eARnuHkjeEc/t4O/uGs3eH67d8TjuAjbuEPHuL/
zTzxcB68/dv2beDnjd8zDt0DHtzUHd03Xt3Xfd0RzuA1bt7q7eG9LeLr/dzQjdwUHt/o3eBSTuRT
nuO6y+FYLuEPzuIVnuTuTeJQruRdTuNhvuQhjt7areH8LeAQTt86nuIlXuLRzeJzruW3i+Vl3t4b
rt8VHuVbruYBnuFc3uJPbuJ5/udT//7iKC7oWo7nfL7oLg7pL+6qMEHjVt7gTH7gy23c3K3cQL7p
R+7lmm7ccu7peS7dYW7b++3jbr7kvX3mXq7hBO7ps53mtJ7fo/3YFgfmjtHXmf3r21EDwv4WIxAY
+3Dsxw7sszHs2oHsyR57NivsuR50RDDt1n7txKbsqJcSApDrb2DTroDtnToN4l7u5n7u6J7u6t57
2n566/7u8K6Z7Z558Z7rQVDvpTnvKYvv/N7vpqfvlufvAu/TW1fWrjnwVwfwAf8SY8sWCJ/wvrq5
wJq5TDmUcTu7Cn8m0UqzOruOAJvxrMPw7Iqx5Eq2hBug5mqID9/Ua4quEEuln1uUDP9LuiCPHhZo
8ef68XP78R9buSvPd1AIuRC784P7rBf4830X9MdIujgv857roU4fuUgvdDUveZuNFlOf9Vq/9eVe
9Yj5cF7vYFw/9mTPcmFfeFmxAWW/9myfGGf/9nAf93I/9yGv13TvgaA3t6sLuK07G1sr8bcqmIAj
ek7/tHzvi0rLrGm7t6PrsxjP+IBr+DAr+IsP+bahrKL394uIt+g68ZS/94GPFprP+SIr+bITevHI
9Pm69FNItnJ78aBbt9Ba8d7KhDEP+7e/iD2f+lHrsfFat+gZseWara3/9J+7rkPJ+rt/tddqtUoZ
9cHv+kzfhLFfiMpvuqiLo72/+QX/66+P+LEuL/QaKbcwT5RmS/QIEfQNi69UmvKEOKgAa7i8aP06
yvOc26bmqvSIb/TiL7gvDxD2BA4kWNDgQYQJFS5k2NDhQ4gRJdoDQHFgRYoAKm60KHCjRo4dQYYs
iBGjxZMkTXpkyXJkS4IrXSqUGVNjzIsdUebkeFKkzpY+Qer8eDMlzp8qd86ECfSoTKUZo5L0OPRp
TqlEl271OdHrV7BhxY51qHRlT55IawLFepWp1ppUm/582/RoW6Rc4W5NWhLm2bRYnQbVa1bwYKaA
E2vli7jwW7SQyU6mXNky5ZeMraIcWhWqZ7ZZ72Z+2Xmq0ZsXjbZNLTSrTaGdpRZV/7x5bl3TuU3K
pht552jer00TzixacFfQwFsvX60c+WXo0aVPp17d+tfnYbNfn7i9rETvC72Hv83d/Hmw/9SvZ99e
PXr48Q+PJS/fYPDuEevfT80/fGf3AhRwQAILNPBABBNUcEED7XPwQQgjlHBCCiuMbkELM9RwQw4V
YvBDEEMUcUQSSwTxuw692q+6FelDqMXQruvPsopMtPFGHHPUMcTxysPMr7UuazFIsoZsiMjsYITx
of+OxM6eHaOUckoq2/sxRuqWVBEiLZnk0skXw/xSSPGm6zJFNC9bkLaS2KyKP9V2W22mzebUbbvW
XBpOOJF261NO5JhLibficntztv83/WSLtLgOldOzR/sT9NA4QUvuLNnyVLTGKjv19NMTv7yLsMXu
c8wwtwwrD6pGzeoqJFVjjNU1yT5LFSdal6qNzsB0Xcyt4xYlbi/OgEzzWPvWZIxUzmY0LthbfQX2
OUb/eqxSxfSCjdhTiS0tsEjzchPWOnuFVc85GwOWVN/YjI0jUOOVd14Ro2JWrmGhNVfafR1zNK1p
f+03X22tjdZggfXF1S5uz+VrXW7Zvdbanei1+GKM3bNXstcqFe7OZvvik9nk0GV1reEeXbbkoAjN
VFKWRbYtTpWdsnPS3mIOck+8fmONqs0yFnroeM87s0wUOTzawaUjJPppqKM0mun/FJuWz+oHo9Z6
axKR9fprsJPleuxPwzb7bLTTVnttts3rEmuqaaQQ7raRxVBuLP0Sz9m89lbNRfJGwlfCFekmMqGX
Ez+zRyjJdpzKuIucb/IXB3XRSx8hLPzK/Ub190nE6xa98QRJ+xPSv38j11KT9d53Odx8/lhS3RJj
HFFKPa4d54xQX7k5Sqvt2NLiEn3ZdYrztspy2Zm/6XHohX6qVXB7lzm0jV/1Vk9j2214r1xNRdjf
aLPXTFjrX69rfMQORn9lvVG2fqqOorcfR/0GdjVdTPNcmOH/6WpmPZvV98iFJ2gRSlw5U875tGez
/e1sYHRpVviWhcDe8I926Rrd/9qUxbGJOVB8IKSY+wJFsAJexWEnZF/fyre90aAvhhDrlueodxAb
9k0tCcsZVu73wxLph2ezGxTQTqdAz7EOd+FC3uk0UzsBIilYw5udxArFP8oBDWfLe5X/hNXANj2Q
Zjs84hSH2EG0fRBMaKRJh5ZENzYuBIhzDFH+khbHbbnRjnjkYx/9+EdABlKQFrrbIA0JHzomUpHz
wiELrQPHLWFuMpAcoZgss0hMZpJB2onfGmWVt7l8q5KSY8jhRtlGSlJOh6UZIqAO+UqnKWiUpkQe
BkM3H2rhDWn12ZyZkBZKntBQIJokZjEHBB7m/O2KtVzi/IpoQdg5U4nT2+CmbP+Gu/Qlqk9jdBM2
nxUy3rXSdZEZHCzNqcf13TB8qEJhGIFpqxGmkHtk9BVrjMUrErrmMxOTC8hkxrdzBtQ6auynwRSo
Plcm0Vw38yL7Iog9g84IZVgs4AL3KU8cNkyMpDNmRz2KIIjdkJkqBCCWVkjBwwRsXSwUZqMeE7BO
XtSAYVppJz9600wiU4pgHOP2iAgbMEbKWaL8ExPv6cRe/fQ0EoWZFRNnF3/qM1MCpSp1CllVpbWx
QjjlaiKxujb86PCrY61bV030ArOmVa1rZWtb5fUFjEmASvVwa12vSla85lWvELJrX/36V8AGVrCD
JWxhDXtYxCY2antlbGMdO1D/xWIMAJGlbGUte1nMZlazm+VsZz37WdCGFmqPJW1pTZse0aZWtatl
bWtda9bTxla2s6VtbW17W9zmVre75W1vfYum1wZXuMMlbnGN66nfJle5y2Vuc537XOhGV7rTpW51
rXtd7GZXu9vlbnfBAg7vAleW4CAveMsLXnugVyDoPS9Byrve9xakvfAdyHvVm970khe/9a1vfOn7
3/yqV7/0Pa953Rtg/d7XvAI2sHzt294CG8S/CnZvgucL3wFHOMIY7i+D/RtgBDf4wiHusIPvu14J
e9jC9uXocaN0YgHnl78nPvB+D0JjGfM3x/tlb4xt7OD+oljIA5YxjH1sYwoT/znB8mWyhG+sYyU3
Wcg1xi+MnTxkLCOEwijGsY6nfGQrA5nKVnYxlcJcZR7/uMldxjF7oZzmNLu5y2g2sJXrjOYDu/nL
eabzj2nc5ivPGM5eVjOS1XxmLmf5yYQu9JiZjOgwb/nQLS7zgSQS3/nKmcNS/jCPM7znOGf5ziAW
9KhLTWdMJxrUib7zlh9M5ELbWdWE/jOmbc3iPCu5035OMaCnPOtfR3rMqQ7vdw3NYCn/Otg1vrCe
c+zsJdMay7IO9bC9nORpUxnPyVZ2g3e8bE5PWtt9Vra25/xnRnsb3B2WNKKLfeljj9vd4t42nF0N
7iPbG9R6VjevV41nZzva1//h9re0wz1vH/M7IZIOtMEN3W1zX/vdYck0sbnc6Ve3GdcXV/eCO85u
eZcY4hp2NMgnXesVR/nGKg82y01O8l5LfMObPvSua25klH/8yxCeeM99/nOgB13oQyc6du9a9IRU
WukjQnpDlv70DwG42TaHsMU9DeuZ7xrMLvd4zCts8iDT3MQOL/iEGZ1mqD99IiyHNrdjHOU5l93J
YF52wAe943yrHN1DznvC39xtuze9twoXNNnjremFp/vRI+ezuP3ub8K7e9TYrve29x738EJgthgi
PLBxjmGF93jgCFd8kmEt9s7rm9QhR3y2he1r8KZd9pbOdOPLPWtvn37v9Jb/uO3J7fvaQznVu8d9
u/vdemZTOmMdmD1hKT/oc8db8cnOt8MDLuI11/3vqt799SP+8Mr/uvnjD5DpdX16BIO+7lQf+6JF
rn7wS5/jeY8/zRlu/HmDOPbk5/97BO+h/iOu/7OtMRhAiDg6DwpABfyrDlpAB7SrBnxACVykiKA7
qZu6aGs5j9O9CePA98M8AwzBS1IQC/y2gls3FCy3vvu7/ZtAF+SqPnu8f0tBhoO45FO9FnxBHYQe
eDM171PBmUvBTRO2qzs7ETzCB2k1sKu/E2zCxWO24TNCJJxC+FBCuZs+G7y97fO+wKNCL4yPEqw/
nqM1l4M/+7O9fvtCNVxD/zZkLgRUmx2MQzmcQzqsQzu8Q/xpQz1ciHfYQz/8w6/AQ0EcREIsREM8
RESMHkBcxOlwBbBJREiMREmcxDliREu8REzMRE3cRE7sRE/8RFAMRVHcLUosRVP0rEs4RVVcRVbU
kesoB6FLhFGEw1YskDaoRVzMxVacRV40G138RWAMRlXsxbCpAGI8RmTcEGFcRmZckBBoRmGcLGic
RmLSCGq8xh3hjrBKRm60D4DqRnCEj28MR3IsR3OUEGxMR3Vcx0rbw3Q4R7ZZxXRIB3bsKkCcR3g8
G1ycx3rsR3/8R4AMSIEcyIH0AoI8SIRMSIXcwXxsyOtYSIisEoecSIqsSMiLvEhBikiNlBqM7EiP
/EiQDEmRHEmv2UiTPEmUHK3REQeWJEmXPAiWbMmXLK0yeMiUvEmczEmJnEme7Emf/Mmf2wWgHEqi
LMoJ0UmkTEqlXEqmtBGjBMlPaYCmnEqqrEqrvEqsXMWn3EquTMas/EqwhEgqCMuT7EqMJEu0TEu1
XMuEZAO21EqzjEu5nEu6rEu77K231Mi73Eu+9MK8/EvADEzBHL++NMeM4YbBFMTCLMfEbEzHfMwb
6QHIbKvFJMfJvEzMfMCAAAA7

------=_NextPart_000_000D_01C6FD7C.5B9BD870--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9VM8iLw028804; Tue, 31 Oct 2006 15:08:44 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9VM8itH028802; Tue, 31 Oct 2006 15:08:44 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9VM8gG2028789 for ; Tue, 31 Oct 2006 15:08:43 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k9VM8SIr008584; Tue, 31 Oct 2006 17:08:29 -0500
Received: from krdp8.nist.gov (krdp8.ncsl.nist.gov [129.6.54.113]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k9VM7oIb019117; Tue, 31 Oct 2006 17:07:50 -0500 (EST)
Message-Id: <[email-masked]>
X-Sender: [email-masked]
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Tue, 31 Oct 2006 17:10:50 -0500
To: Sam Hartman , [email-masked]
From: Tim Polk
Subject: Re: SCVP 28
In-Reply-To:
Mime-Version: 1.0
Content-Type: text/html; charset="us-ascii"
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hello Sam,

At 04:20 PM 10/19/2006 -0400, Sam Hartman wrote:

Hi.

I'd appreciate a response to my AD comments as well; in many cases
I

was asking questions as much as asking for specific changes.  I
find

I have appended your earlier message below.  Responses from the
editors are in-line.

Also, I'm a bit puzzled how some of
my questions--particularly

mandatory-to-implement behavior--could have been answered without
WG

I believe you are witnessing extreme working group fatigue with respect
to SCVP.

Since there was no discussion on list after your August posting, the
editors drafted

a consensus response  to your comments and started working on a
corresponding

new draft.  Our intention was to post the editors' response draft
and a direct response

to your comments simultaneously.  Unfortunately I was distracted by
the imminent

FIPS 201 rollout when the document was posted.

Perhaps a concrete proposal (i.e., draft 28) will stimulate WG discussion
with respect to

your issues.

--Sam

The original message...

At 05:04 PM 8/7/2006 -0400, Sam Hartman wrote:

Hello.

As part of the publication process for draft-ietf-pkix-scvp-27 I
have

reviewed the draft as the AD bringing it to the IESG.

I've found a few issues that I believe need to be handled before
the

draft can be last called at the IETF level.  In many cases

clarifications of text will be sufficient to address these issues.

There are a few concerns about interoperability though.

Section 3: The text does not state a good reason why

anyExtendedKeyUsage is not sufficient for a cert to be used to sign

scvp requests.  Please either provide such a reason or require

servers to accept this keyPurposeID.  If you believe that some

environments may have a good reason to reject anyExtendedKeyUsage
but

others will not, then state that servers SHOULD accept the usage and
describe these differences.

We agree that anyExtendedKeyUsage should be sufficient for a cert to be
used to sign

scvp requests.  We implemented the following clarifications in
sections 3 and 3.11:

Current text from Section 3

If the client uses SignedData it MUST have a public key that
has

been bound to a subject identity by a certificate that
conforms to

the PKIX profile [PKIX-1] and that certificate MUST be
suitable for

signing the SCVP request.  That is:

1. If the key usage extension is
present, either the digital

signature or the
non-repudiation bit MUST be asserted.

2. If the extended key usage
extension is present, it MUST

contain either the
SCVP client OID (see Section 3.11), the

^^^^^

anyExtendedKeyUsage OID, or

^^^^^^^^^^^^^^^^^^^^^^^^

another OID
acceptable to the SCVP server.

Section 3.11:

If the certificate used on a validation
request contains the

extended key usage extension [PKIX-1, section 4.2.1.13], the
server

SHALL verify that it contains the SCVP client OID, the

^^^^^

anyExtendedKeyUsage OID, or another OID

^^^^^^^^^^^^^^^^^^^^^^^^

acceptable to the server.

For consistency, we made complementary changes to validating an
SCVP response.  We made the following change to Section
4.14.2

If the certificate used on
a validation policy response or a

validation response contains the extended key usage
extension [PKIX-

1 section 4.2.1.13] it MUST contain either the
anyExtendedKeyUsage

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

OID or the following OID:

^^^^^^

id-kp-scvpServer
OBJECT IDENTIFIER ::= { id-kp 15 }

>   All SCVP
clients MUST support SignedData for signed requests and

>   responses.  SCVP clients SHOULD support
AuthenticatedData for MAC

>   protected requests and responses.

What are the requirements for servers?

Requirements for Servers are currently specified in Section 4:

For protected requests and
responses, SCVP servers MUST support

SignedData and SHOULD support AuthenticatedData.  It is
a matter of

local policy which types are used.  Where a protected
response is

required, SCVP servers MUST use SignedData or
AuthenticatedData,

even if the transaction is performed using a protected
transport

(e.g., TLS).

It creates a redundancy, but we decided to modify the text you
quoted from Section 3

to reiterate the server requirements in Section 4:

All SCVP clients and
servers

^^^^^^^^^^^

MUST support SignedData for signed requests and

responses.  SCVP clients and servers

^^^^^^^^^^^

SHOULD support AuthenticatedData for MAC

protected requests and responses.

How does a client obtain the
server's key agreement public key?  The

section 3 text says that the client must do so but does not
describe

how.  Is a normative mechanism required here?  If not, you
still need

to describe possible methods.

Clients may obtain a server's key agreement key out of band, or through
the

validation policy response message.  Servers are required to support
the validation

policy response message.  Clients are not required to support either
mechanism,

since the AuthenticatedData mechanism is itself optional.

We implemented the following changes in Section 3 of draft 28:

The client MUST put its
key agreement public key or an unambiguous

reference to a certificate that contains its key agreement
public

key in the AuthenticatedData that encapsulates the
request.  If an

ephemeral key agreement key pair is used, then the ephemeral
key

agreement public key is carried in the originatorKey field
of

KeyAgreeRecipientInfo, which requires the client to obtain
the

server's key agreement public key before computing the
message

authentication code (MAC).  An SCVP server's key
agreement key is

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

included in its validation policy response message (see
Section 6).

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The recipientInfos field of

AuthenticatedData MUST include exactly one RecipientInfo,
which

contains information for the SCVP server.  The
AuthenticatedData

MUST NOT include the unauthAttrs field.

Section 3.1

The text claims the version must be increased for any change in
syntax

or semantics.  Do I need to increase the version number when I
define

an extension?  If not, please note this.

Specification of extensions may be performed without any change in the
version number.  This

is consistent with versioning for X.509 certificates and CRLs.  To
clarify our intent, we propose

the following changes to the text in 3.1:

The cvRequestVersion item
defines the version of the SCVP CVRequest

used in a request.  The subsequent response MUST use
the same

version number.  The value of the cvRequestVersion item
MUST be one

(1) for a client implementing this specification.
Future updates to

this specification must specify other values if there are
any

changes to syntax or semantics.  However, new
extensions may be defined

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

without changing the version number.

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Section 3.2 The ASN.1
tagging for the Query type looks strange.  There

is no context tag 0; not all optional fields are tagged.  What is
the

style being used here?

First, the lack of a context tag [0] reflects the evolution of the
message formats.  When items were removed, we did

not reorder the tagging.  To be honest, the working group is split
on this issue.  Implementers with running code

object to renumbering the tags, but others object to missing tag numbers
as inelegant.

Second, the working group has traditionally objected to the use of
explicit tags when the

encoded ASN.1 is unambiguous.  That is why some optional fields are
not tagged.

We inserted a comment into the ASN.1 that indicates that tag [0] was not
used.

This way, new implementers will not be worried that they made a cut and
paste error

and old implementers are not recompiling for the 29th time.

In 3.2.4.5 and 3.2.4.6, if the
server does not support these flags,

must it error if they are set or can it ignore them?  The text
is

unclear.  Later text implies that the server should generate an
error

if these features are requested but they are not available; if so,

please clarify this text.

If servers receive a request they cannot satisfy, they must return an
error message.

From Section 4:

Successful responses are
made when the server has fully complied

with the request.  That is, the server was able to
build a

certification path using the referenced or supplied
validation

policy, and it was able to comply with all the requested
parameters.

If the server is unable to perform validations using the
required

validation policy or the request contains an unsupported
option,

then the server MUST return an error response.

We do not believe a change in 3.2.4.5 or 3.2.4.6 is needed.

However, in our review of this text we realized that the
definitions

of the error codes in section 4.4 may be too narrow.  In draft
-27,

the codes only allowed the server to indicate that the a value of

TRUE (e.g., for required explicit policies) is unsupported.

Consider the case where a server is hard coded to process with a
value

of required explicit policies of TRUE.  If the client indicates
this

should be false, what is the error code?  This was fixed by

generalizing the error codes, so that both error cases were
supported

by the error code.

Section 3.2.4.9 does not
provide sufficient semantics to meet the

needs of common applications.  For example

draft-ietf-cat-kerberos-pk-init requires that pk-init certificates

have the ExtendedKeyUsage extension in some cases.  SCVP itself
does

not currently permit the anyExtendedKeyUsage value, so SCVP doesn't

even provide good enough extendedKeyUsage handling to validate SCVP

server certificates.  At a minimum support is required for cases
where

EKU needs to be present and where anyKeyUsage is not acceptable.

This is an interesting case.  SCVP needs to support the current
(-27) functionality *and*

the functionality you requested.  Two options wre available:
(1) change the ASN.1 from a

sequence of key purpose OIDs to a sequence of a sequence of key purpose
OIDs and a

processing flag or (2) add a second extended key usage item with the
current syntax and

the requested functionality.

The editors chose to add a second item, since that provides the most
flexibility with

the least disruption to the protocol.  The functionality you
requested is supported by

the specifiedKeyUsages item, which is defined in section
3.2.4.10.

Are all clients guaranteed to
interoperate with all servers?  It seems

there is an incomplete overlap between DPD and DPV and it is not
clear

that servers are required to support one of these configurations.

It's not clear that this meets RFC 2026's definition of

interoperability.  If so, that needs to be fixed.

Conforming clients will always generate requests that conforming servers
can process.  If the

server can not satisfy the request, it will generate an error message
that is recognized by the client.

Clients that request DPV services from a DPD-only server will receive
such an error message.  (See

the text quoted from Section 4 above.)

Does this satisfy your interpretation of the interoperability
requirements

in RFC 2026?

Section 4:

>    1. A success response to a request made over a
protected transport

>       such as TLS.  These
responses SHOULD NOT be protected by the

>       server.

Why is that a should?  IT seems useful to protect such responses
so

that for example they can be included by relaying scvp servers in

their responses while still preserving authentication.  In
general,

TLS does not provide data origin authentication to third parties,
but

protected responses do.

This is actually redundant information.  In section 3.2.5.3, DPV
clients are required to

request a protected response unless they use a protected transport (e.g.,
TLS).  Since

client is required to request the appropriate services, a server need
only act on the

information in the request.  Worse yet, this text implies that a
client using TLS for transport

cannot also obtain a signed or MACed response.  As noted, these
mechanisms provide different

properties.

We deleted #1 entirely, to ensure that clients are able to obtain the
necessary services.

The remaining items are sufficient...

Section 6.1:

>   The syntax and semantics of the vpResponseVersion item
are the same

>   as cvRequestVersion as described in section 3.1.
The

>   vpResponseVersion used MUST be the same as the
vpRequestVersion

>   unless the client has used a value greater than the
values the

>   server supports.  If the client submits a
vpRequestVersion greater

>   than the version supported by the server, the server
MUST return a

>   vpResponseVersion using the highest version number the
server

>   supports as the version number.

Why is the above text necessary?

Validation policy requests are extremely simple.  We do not
envision

changes to this message, even if the validation policy response
message

were modified.

If the protocol must be extended to handle new fields appearing the

validation policy request, we would need to add considerable
complexity.

We would need to add extension mechanisms, or use an "ANY DEFINED
BY"

with the version number.

Shouldn't clients use the
oldest

vpversion in their request to discover what vpversions the server

supports?  The above text is potentially hard to implement because
it

assumes that future validation policy requests are backward compatible
when parsed by an old parser.

This would imply a multiple round trip protocol... the client requests
with the oldest version it supports,

and obtains a response in the same version.  If both parties support
a higher version, the client needs

to repeat the transaction to get the newer version with (we assume) the
additional information it contains.

Assuming the format of the request is static, we can complete this in one
round trip.  The client

requests with the newest version it can support, and the server responds
with that version, or the

highest version it supports.  This assumes the client can parse
"old" responses, of course.

i'm also not convinced that the
above text is implementable given the

current ASN.1 syntax with a modern ASN.1 toolchain--one that treats

extra fields in a sequence as an error.  You can definitely
implement

parsing all the versions you support by trying to parse each
version

separately, but I'm not convinced that with such a tool chain you
can

implement parsing part of a structure that is newer than you
support.

Again, we would not expect to add additional fields to this
request.  Any

changes in the new version should be restricted to the response
message.

This would avoid the iterative parsing attempts...

How does a client discover what
WantBacks and Checks a server

supports?

The client requests the appropriate wantbacks and checks for their

application.  If the server generates an error message if it cannot
support

the wantbacks or checks.   This is not generally a problem for
checks, since

most requests assert only one.

For wantbacks, all servers are required to support the core wantbacks
(the

public key and the certification).  DPD servers are required to
support returning

the path and the revocation information.  Additional wantbacks are
not required

for DPV servers.  In general, a failure on these wantbacks indicates
a fundamentlal

mismatch between the client's requirements and the server's capabilities,
so

further negotiation is not required.

The remaining wantbacks are related to niche cases from RFC 3379
where

the client and server can be presumed to have an out-of-band
relationship.

Since these wantbacks are not expected to be used with
"foreign" SCVP

servers, this negotiation of wantbacks is not required.

MIME

* the change controller for all IETF standards track mime

registrations should be the IESG

Okay.

There is a required parameter
(format) on all the mime types that is

neither documented nor used in the HTTP samples.  I suspect
this is

not actually desired..

Oops.  We missed this one.  We believe the correct answer is
"none".

I think vp-request and vp-response
are too generic of subtype names;

you can try to convince the ietf-types folks that they should
accept

this but I suspect you will run into trouble.

We didn't change the names, but we are not wedded to them either.

(To be honest, I'm not sure I know what a proper name would be.)

We figured we should go ahead and submit, and the registration

folks will tell if we need to make changes...

Thanks,

Tim Polk

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9VL8OVp022266; Tue, 31 Oct 2006 14:08:24 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9VL8O1D022264; Tue, 31 Oct 2006 14:08:24 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from pne-smtpout2-sn1.fre.skanova.net (pne-smtpout2-sn1.fre.skanova.net [81.228.11.159]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9VL8NYa022234 for ; Tue, 31 Oct 2006 14:08:23 -0700 (MST) (envelope-from [email-masked])
Received: from arport2v (81.232.45.80) by pne-smtpout2-sn1.fre.skanova.net (7.2.075) (authenticated as u18116613) id 452BAC860042D9D3; Tue, 31 Oct 2006 22:08:12 +0100
Message-ID: <013a01c6fd30$abfc6420$82c5a8c0@arport2v>
From: "Anders Rundgren"
To: "Stephen Farrell"
Cc: "David A. Cooper" , "pkix"
References: <[email-masked]> <004601c6fb42$ae379790$82c5a8c0@arport2v> <[email-masked]>
Subject: Re: draft-ietf-pkix-rfc3280bis-05.txt
Date: Tue, 31 Oct 2006 22:08:08 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0137_01C6FD39.0C624D90"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_0137_01C6FD39.0C624D90
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

When the id-ad-caIssuers accessMethod is used, at least one instance =
SHOULD specify an
accessLocation that is an HTTP [RFC 1738] or LDAP [RFC 4516] URI. there =
SHOULD be at least one HTTP [RFC 1738] and one LDAP [RFC 4516] =
accessLocation URI specified.

Could this maybe fit in?
Anders

----- Original Message -----=20
From: "Stephen Farrell"
To: "Anders Rundgren"
Cc: "David A. Cooper" ; "pkix" =

Sent: Tuesday, October 31, 2006 01:35
Subject: Re: draft-ietf-pkix-rfc3280bis-05.txt

Anders Rundgren wrote:
> I still have some minor objections to some of the finer details.

Personally, I'd be all for ignoring the n-th round of minor objections
to finer details that arrive without suggested text.

S.
------=_NextPart_000_0137_01C6FD39.0C624D90
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

When the id-ad-caIssuers accessMethod =
is used,=20
at least one instance SHOULD specify=20
an
accessLocation that is an HTTP [RFC 1738] or LDAP [RFC 4516] =

URI. there SHOULD be at =
least one HTTP=20
[RFC 1738] and one LDAP [RFC 4516] accessLocation URI=20
specified.

Could this maybe fit in?

Anders

----- Original Message -----

From: "Stephen Farrell" <[email-masked]>

To: "Anders Rundgren" <[email-masked]>

Cc: "David A. Cooper" <[email-masked]>; "pkix"=20
<[email-masked]>

Sent: Tuesday, October 31, 2006 =
01:35

Subject: Re:=20
draft-ietf-pkix-rfc3280bis-05.txt

Anders Rundgren wrote:
> I still have some =
minor=20
objections to some of the finer details.

Personally, I'd be all =
for=20
ignoring the n-th round of minor objections
to finer details that =
arrive=20
without suggested text.

S.

------=_NextPart_000_0137_01C6FD39.0C624D90--

Received: from [121.10.73.178] ([121.10.73.178]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9VFFNcP030056 for ; Tue, 31 Oct 2006 08:15:27 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000d01c6fcff$59764120$b2490a79@kill>
From: "and"
To: [email-masked]
Subject: include libraries pcside utilities
Date: Tue, 31 Oct 2006 23:15:07 +0800
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0009_01C6FD42.67998120"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0009_01C6FD42.67998120
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000A_01C6FD42.67998120"

------=_NextPart_001_000A_01C6FD42.67998120
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Technical hardware primitive Unix. To the home is formerly Open =
wikifree.
Portal Current events Recent changes Random Help.
Tools Create an account or log in Navigation Community. Video game is =
consoles we shortly.
Lists cvs Bugs Tasks Patches in. Create an account or is log.
Links here Related Special pages a was.
Main Page Free Console am From or Table of contents Site or.
Video game consoles we shortly in say console. Wiki amp or are currently =
under!
System gcc and a gnu am Binutils of startup files emulators various. Gnu =
or Binutils startup files emulators a various of consoles better.
Are currently am under Major part content be.
Video game consoles or we or shortly say.
Libraries pcside utilities is technical hardware.
Consoles we shortly say. Free Console or From.
Technical hardware primitive Unix. Part content am be added News. Access =
Welcome to the a home.
Changes Random Help Search in Toolbox in What links.
News in Directory of web old Support Mailing.
Utilities technical hardware primitive Unix compatible operating or =
system. Apr available License. Portal Current events Recent changes =
Random Help.
Pages was last modified apr or available License.
Is project dedicated supply is software packages for of.
Added News Directory is web a old Support Mailing? To the home is =
formerly Open wikifree.
------=_NextPart_001_000A_01C6FD42.67998120
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Technical hardware primitive Unix. To =
the home is=20
formerly Open wikifree.
Portal Current events Recent changes Random=20
Help.
Tools Create an account or log in Navigation Community. Video =
game is=20
consoles we shortly.
Lists cvs Bugs Tasks Patches in. Create an =
account or is=20
log.
Links here Related Special pages a was.
Main Page Free =
Console am=20
>From or Table of contents Site or.
Video game consoles we shortly in =
say=20
console. Wiki amp or are currently under!
System gcc and a gnu am =
Binutils of=20
startup files emulators various. Gnu or Binutils startup files emulators =
a=20
various of consoles better.
Are currently am under Major part content =

be.
Video game consoles or we or shortly say.
Libraries pcside =
utilities=20
is technical hardware.
Consoles we shortly say. Free Console or=20
From.
Technical hardware primitive Unix. Part content am be added =
News.=20
Access Welcome to the a home.
Changes Random Help Search in Toolbox =
in What=20
links.
News in Directory of web old Support Mailing.
Utilities =
technical=20
hardware primitive Unix compatible operating or system. Apr available =
License.=20
Portal Current events Recent changes Random Help.
Pages was last =
modified apr=20
or available License.
Is project dedicated supply is software =
packages for=20
of.
Added News Directory is web a old Support Mailing? To the home is =

formerly Open wikifree.

------=_NextPart_001_000A_01C6FD42.67998120--

------=_NextPart_000_0009_01C6FD42.67998120
Content-Type: image/gif;
name="Table.gif"
Content-Transfer-Encoding: base64
Content-ID: <000801c6fcff$59764120$b2490a79@kill>

R0lGODlhoAHUAYf2AAQBAHQGDAJ3BnaABQAAfnkIdAqOjsrDyr3bx6rL80kqAGkbCI4dDpIRAM4b
DdUgAABABhFNAEE0DmZLAIo2AKxBB85HDOU0AABlABZlB0lWA2laAHNWAJFfAMNUAOpbAAByCCp5
ADR+DViLB3+KAK58C757AO1/AACrAReTAjajAFiUCo6hBZWsALKqCt2UAgDCASC4AD3BAFrBCIbE
AJTODrS3DtyyAADiDSTUAEXoAmPtAIjsAKHhCcjcAt7hAAAFRRoAPkwAM2cARnQAQpsHR8MNQe0A
SwAoQy4kQzYVQ2oeO4YVQpQtQrspPd8jNwhFPBE2PzZGR1JHSX4ySpFOS8s6NuBGRQBfRRVUQkJd
MlJoTn5UEKdZTbRdOeZUPwN0NRJ/PUR0R1d9NXKCO5F5PbZ7N9iINwCXTSWuTEScOGyXOHmYNpim
MbalRN+oNQO7Qx3BTkKxNFPFTHKzTqXNQMm9PtfCPwPhSivRRUfSQlrRPIPTQqLkOLLiReroPQAA
fSkAeEUIhFEAdosEc5EAicwAh9MDjAApcyQkckYkiW4ZhXUsiaYRjr8dg9InfgA3iCY9dDNDdVwx
eH1IfKEzdr1Mct9JfAZhgCZWikRoempmgndViapmjbxucdpgfASIhR13jjSBhlV/f3l0hqOKc8V4
jOZ1fACRciWWc0iggGqhh3aUgJ6oicKhddargQC1ehG7dTHAcmDOgXnHi5q0e7u8hNi/jQTseBLn
gjXYcljUcoLeiZbnisLUetfheAAAtyUAwUsBzFsAu4QAvqALwrkAyNsAywAqvRgswEAtt14txYQp
tpcSvb0Yst0otgI4yB44tzxDtmo7tHtNwZE/x7Y8ueA5wgBstSppzDdXt1pbuH1XwpJWwcBYwu5c
tgBxuSGFy0WJvVGLwn2KxqN2ycF0zNV+vQWWuR2VukqYvm2dyXeruqWTv7yWseacvwDHxBm9wDLA
sVy7ynfJxpO4uP787pOnpH98h/8AAAD/C/H/CgkB//8A+APx/////yH5BADy4f4ALAAAAACgAdQB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3MhR4b+PIEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHOe7Mizp8+fQIMKHUq0qFGBOpMqXcq0qdOnUKNKnfrxqNWrWLNq3cq160KqYMOK
HUu2rNmzKL2qXcu2rdu3WdHKnUu3bstJdvPq3cu3r9+/gAMLHky4sGGqcBMrXsy4seLDkCNLnpzX
seXLQiNh3sy5s+fPoENfRCa6tOnTqFOrXs26tevXsGPLfku5tu3buJXO3s27d9vcwIMLH068uPHj
tSUq8c089ofmG5FLn069uvXr2LOThM69+9XD3sOL/x/vMCX58+gtgk/Pvj3zlB/i25NP8Pnz+vPj
67+/335//QMBGOB+BfWn0H0BFpifgfgpmOCDCf6HoEAMLkhfgRfOp6CE+TlIoYQZUtighRVqOKKI
HB40YYkpDijghysKOCGMHN633kL8zWjfhip6aOKAQP74o44JrSjkjgcahCCSQmo4o5INGhlkh00y
WR+RPUIIoZUiZokifk/2uOSIYZ4oJZVf+oilZ+bxd2SXJoZZJpx0xkkmRGOO2SSUHlqp55x1+nni
kA/K+aaXe+bJp5dMuslQo3cmqaWePtKJ5Y2SCkronpxOKmakDinaJaCJRhgpqUSeaeimhp6p5qJc
dv9K6J8NQboljmbWqaWllarmKK2j/gcjoq2aGSJCosYp7JXLOnlqs7weyqmjyhpIbZkxNhvrnMnm
WKKp0ZIYoqvUYgjtmp21Cee1mxaJbqsEqojquqPi6iClzupq7oUsMtruqcgOamegRdI7sKTVZohq
vIW6uO2gNgJ3MLv4FuwplBX3ymOasurqrcL/InrrrvRmzGrAJH+MLsbgdkwjuyT3eS/LrzYY3MH5
5kxquARLu2jA3dobpacmC+zzuyHziq3AMMfcsq0Il1v0xQa3THVBZqXCFM5o+ryrq2jSh+Wacuo4
tcdV5oowxFOOa7TZKKONtLsYOv112i6TPWXOV5v/iCmy8sE96bLflg12wof3/LLbG1/dor5PZkus
sIL/HDne+rLt8IsEX/54qZzHe/nd7nG1c+mop97Z6aq3vpt5rsc+3t+y1247XLDfrvt5eu3u++9b
5Q788L4ZZk8+yCMvUPLKL59PQc8fz3xC0xMUvfPPNz9Q9Mxfb1Dy1kMvfffja/89+dhDb773B4G/
Pfvwoy/+9vOf7735x5fvvv3Wy4+99v5r3/6W1z/16e97/buf+/DHPaS4xApRYQj88kc/6Ylvggas
YP7u57wL1u99IKQg/dhHQA1+UIPXS2EJEQJA7mHQhBYcYfhWWMAOxlCGC2khDRFYQQ4KcIYbDCEI
/31IQCKu74YlJCFbUqJEH2YvfEo8IRRn+EQcKuSFKhQhELW4xR02MIlXnF8VvcjDIgKxiWLU4hip
l0Y2ThGGcLTiGJ+IRTXGcY1fNAwae2jHKMbRihTEIxfLSEU+EjKKJMSgCv04yCAScYcrXGMQCSlD
DjKykZI8oSAp6UEzmrGOTmShHSnYOwmur3qB7CH+/uhJMIrQhYhsXyT/B75HJrB5iqzkKtH4RS7u
cZKAvGMqi9i9F0IxgKEUJhuzWMVNtnKYPGTmY9ISwmRC04ZnXCAKZ+nLRMqylU1EZQ59+T46wpCX
hlRmFv+ITjBesp0sRGUAWSnNSWZPnOvs5fTqGf+9UkJEknOEJDnFKE9u/lKgi1RmI2VpTDlKEZi9
RCgtH4rJVz7zm50UZRljGU9tzhKRBR1kQK/pFuFdVJAHJaNFXXlRSBpzpB+85EmjCcdcBtOb3KRn
Gz8pwZ1idIsc3WhOMznUc/YRa4WZoDU72FAkApSlTJWiDoH604qmc4/rFCIuM3jOiI7yhzaM30Jr
GENGpjScbwxmSweaQktmsJ+VMeUCQ1pNcapvq8cEKCxXWc6fFjOT4TzlQQd41y4y0H8vzeERC/jX
jnbxoTi1n1eJStkLCnayXv0NNYnH2dfFtbOgDa1oR0va0pr2tF0xKWqJpx2zrDa0rXXKa2db2pT/
CKAgtyVIbgWyWwH49re/HQhweWuQ3fIWuMj1rXCTy9yDGDe5uoUubofLXOUSd7nBPW51lWtd4Ua3
u9ptLm7tIV7kJiS70+VudYuLXu+6N7ZkeS55detd4153ufS173zHS1+FyNe99QXwce+LEPv+N78C
1q+BB9xf8OqXwAreL38FzGDy9vbAEi5ufy38X/hujSG9lbB8I7zhEhP4xA8uMYbnG2L+ppjCEw4w
hDXc4Azn9sUxjvCDcYxiGJv4vDk2rXlC3GLikvjEMD4ykoNM4dsWGcH+jfJ4n6zk/ToZyg1ZMYud
u5AdZ5jLWWayh5cSZiMn+Ms2LrB4TcxjDC/4/8n1le53wYxlLS/YyjIuM5KdLN32/njLUj4veGdc
27Tc2L1FvvOS0VzlNn930C32Mo+jG2MRh9fLNb7ulcNb4B9vWtA0nnKXHaLo/Y45LGZO9aWZHOok
V7rVcDYvmgH9kBXLGs49tjStfZxmUYP41bum86hV7MBTT0XVn9Z1k4W9Z2AT+8yapvGkWX3fQ7s6
06ku9bOxHOhlL/rblX6wsXVCagPHms0jbnWugeztN08X3F92s6+9jeh3W/jP8cY2m9mL3wr3Wtil
nrbvchdwamPX2ujWssGDzefhHtzPHIb0vpX8XO7am9OdTu+Fb+1w5w4a47wGecStPe5j05a1Jf+P
4MmHl/KbrPzlMI+5zGfXcrpQgQo1z3lSZr6Qm1OB5+TROVluLvSik5sza3gNL24OdPYYHSo+f7rU
c8Jzpjf96uz5OdZRN/Wue/0lAACAVLZOdswAgChfT7va0VJ2zPCj7UBZu9znTve6210ycO8sH1B+
9777XSZ5D3xz/k74wq9E8IjnjeEXz3iRJP7xkI+85Ivd+Mrj5BWWz7zmN8/5znv+86APvehHr9rJ
m/4zpE+96lfPen+eNhCn513rZ0/74uCl9rinzu1zD1+eTyL2xQP97nlP/OEMf/UdGHPTfz/bJQA/
PMx/PmxSf/ziS0f62L9M6UtTkod0P/txIQz/+MdP/t+9nSHnZ036OQO7sIfdKu8XyNmjs53ybIcf
+H/7+tOP/4HsnyD5d34BqH8BaA8DaIAFWIAFkX8I6H8I2H/+x4ARSIAOKBAKWIEWCIEGiIERIYEP
qIEXOIEECIEgmIEaaIICWIHnVxgNMX9YEX/24IJvsX4biIElyIH8V4MLuIMWyIM6qII5mIM/yIM3
SIMAaIM9mIQdiINHiBA0GIRBmBBRqINGaBkpIYMD4X7y937x534uqIUxCIZfSBBnN39m2IVc+IUw
iIXf1xAl8YRNmII/+H89WIVwqIRKaIQpuIdHWIVJqH91KIUcuIEMeIESCIiDKIRD+Ic+CIh8/+iE
DoiIDpgbWBiDWWiJmFiGl0iGmGiJY3iJZlgQmpiJnRiKBNGGDNF9h3iANSiHeKiAIXiHH5iHBvGI
ktiKJ8iIj3gQihiItAiFPkiLeGiDJHiIrWiCtRiJemgPLLgQlTiGpjiKmaiFnyiN8neNZ8iF1+iJ
XngVtyiHrjiHkciLjbiAHhiHgUiHiaiLi4iEfYiEB7iMTUiFDiGJiHiLQwiL8pgazwiK2yiNAFmK
2CiKAwmN/9iJWPGNH9h/6kiPdliO6JiMx6iQ88iIhNiOwjiOvxiMw6iIfpiMU4iPsuiLg2iFaYGF
BkmKKemJm4iQ2xiGAhmNAumSqPgV9UeSF/+pka+okxVJj/Moj/xnjxKpghE4jExokQ7Jk+64kxyZ
k06Zi+BIhEfYjAzRjWEok9y4htTYkv24hVuojaR4lS35E7D4jsrIkIW4ih4oi/FYkYVYlIZ4jg9I
hUEJlQB4ggwJhOF4lyM5i7hYjCQIl2vZkUSZLpslEZVYlUdRkx5xk7HzkbyxgrhREYnpjIvpmDY5
ErcDmbKRftb3maAZmqI5mqQ5d+V3mktUmqq5msQHDpWHmrAZm7L5HqxZm30xm7h5mbZpG1ygmpCw
m8AZnMJpHLlZnMZ5nGxymB3BmI7xfRWwEc9pGtHJjMP5D1bJiRXBnI3hnARRAd55EN45neH/ORDR
GZ7l+Z0CYZ7dOZ7piZ7q2Z7oaQ/sKZ/dKZ/iaZ/seZ/UOZqK+ZKoo576SZ4Cqp/lKaD0mZ4IEaAF
WhDTaaAH2qDPGZ8BeqAUGpsGOYpiuIa+EaEO2qAUyqEIqqAIWqEMWp8PWqIoOqD1CaITCqHSd4Wg
GIoyWI0IoZ2MURIg+qEpep4Lip8EmhAu+qHuaRAemqP0yaIOWqHPWZ3WKYb+mIXXWaOYaZKamZ9J
Cp85mqUGuqDzqaQjuqJEWqIuWqAtWp9MipJP6p+Z6XjsV38cOqFiqqJfyqUm+qUnGqcpGqJgeqRJ
6qKl2Z9ciZA0yhxvuqUoep8iqqN2mqgm/+qhijqm5AmndQqbaPqPaPiJvPGe+NmhECqhWAqfkRqf
Phqqoxqq4imq73mqfXqlp7d9GWGji8GdGeGooRGdfxpatEoRudoZu4qcvvqrlAerHCGsqsGk1UER
lTmW+8mms2GsudGCYNiClsmP1JihmxilwNqmJ5GsCsGtNDmli1Gp3JimweqskwGoL1mGafiVaoiV
oiGumiij2cp9J9mFTyqvA5mv80esbpGh9hqN8WeutwER+CqTK2mN/BiT+aqs86p9h1mwB3mw36qZ
nRGQ+HqJAmsbBBuoKpmmGKoaFgulBNmwIButMymj0eqkLvkZVtmyIoutJNsa3hqzsFl6M/8rEfyK
GhmbHDTbs425E5iRs3G3s7HlEDdbFEIbEUe7rEQ7HFUJswzbrVC7sVohrmJJPCUAeTe7tFGLmFVr
renqszqLEtzasvaqpoL6r+z6lWyLiUlrtC6ZmGfXtK0Fs5i6sF1JkGfLkgvrtuB6EQjblXRbHBu7
lZaqtgYxo4Ybk93ItTxhslYrtrwBrye7sjPJtwqLnVkRkF0ruTKrrBKLtmGLtx4rqPB3uY7rudtZ
r3Lrr3eruVdpjWarhtv4ttCqldn4foNLHEGRugnhu0IBvKqrrSYBuBhhsqn4t8frfbsrHMP7vNBL
s64avRghmtTrE7PHECdQENt7At77vd3/C74Esb3jaxDgG77nm77ky73eO77rKxDvK77s+70D8b7w
aw/2m7/yC7/p677t67/uy774q78DfL4DzL0FTL/mW7/qu78FHMDlC3cpkb/4exDxG8EVjMAYnMH3
W78QfMAg7MEhzMEd3MH2m8Hre8IXXMICLML/C8IvzL8jfMAnPMPd28L3q8IaHML/G8MVnL3a68IW
vMEpvMAJscIsTMEVvMI1TMQsbMIi7MRPHMU7DMVFfMNXTMIefME6vMVGHMVKfMNUTHbmUcRanMQI
XMNNjMZgPMRinMNBLMQ7/MZSfMZ2bMdY7MVvnMcLzMVDDMdVjMJuTMLba71mrL6EnMYI/6HAVYzE
aizIgKwQBjzFWfzFHIzITfzI5CvGnCzImFzCdNzGXSzHinzJTJt6DrHHFuzAY7zKjezAmizEKczI
bDzKdzzJU3zLg7zEgNzJj2zFf2zGY7zJuwzJbQc7qvzFvxzHbJzIfSzLlqzFoezMyrzBrZzLyczL
oIzH0GzEuPzExPzMUGy92szNrbzGjVzH0ozG4TzMpazOdZzJi6zBwpzN05zI01zPgSzMUOzFd9cH
JkfN1qzE0YzE6yzDCE3AI0zQpuzOf0zKOIzCs4zN3LzMMqzQDE3QL9zDAkx7pxwSVPzJ6bzIrGzQ
SRzDCs2/PpzA+rvS8pzG/cvAPkzLsf/cx/1LwDENzkSM0ijd0aF5vT1BzkA9rK031CTbvEgNE6fp
DkYNEUn91CzR1FI91S8K1VYNtFSNnFe91cqb1bHJ1WANEl491mRd1pLrBCcX1mq91lstFEhgEOpg
1nI917LH1lZN14gXD+ph13zd137914Ad2K23BYI9uHh92GILDIhX2Izd2I7dFF7ofo9dm5EddpN9
2Zid2ZptE4iNmpvNpJ19mp9dnaFd2qb9O6M9nKcNfqktnKv92rAd27L9FtpQ29pgD7Z927hNELqd
27xd2wOR27et2wIh3MFN3Lht28mt3MuN3L693MfN3Mkd3NSt3M4d3ddd3b5N3Nxd3NL//dvc/dzT
7d3AfRDSfd3ODdzovd2tihLIvdvFPd67/d7UDd/vnd0FUd7wXd/8nd/VHd/7/dv13d3y3dsIod/D
7d8APt8LYeABftz8Td8EjuAP3tvdfd8frZoYHt8JzuDmDeAbvuADLuIVfuD/bd8G4eAdDuIoTt8n
vuL/3eEuztssruAOLuIYLuMl7uEwvts/zRDM/dwGbuH3jeBBDt4THt3kHd5FXt7nfd4gvuFDbt/6
3eLNHeP7/d3gjd0jHuD4zeFgLuVhfuSmJzwrfuYh7uE7TuJX7t8z7uVYzuZCDudZDuP4rd4pzuAS
/uEEjuQ4TuM0Ht47LugY/uMOceZ0/97fKq7gJP7lap7nEY7ia87jXV7jif7oYf7gkl7jaY7ojH7j
mA7qPR57KSHkZM7hWn7h223d7K3dTr7qVd7mqm7dge7qiS7ecG7cC87kfZ7lzW3nbZ7iFO7qw43n
xJ7gwZl3b06l1jfbzp54bxDtb/Dsgift087amx3trb3tpEcM3L561B7u4j7u5D4Q326b5Z54577u
7N7u7m4WMfDu8j7vfv0L9D4V8DC96W47YrDvv3rvoOnvAj/wBF/wBn/wCJ+8WI07AH8dCX91NrsW
DV9yXim63Zq41bq30wiD5TrxRQuTFv+7IxuoGpqsHn+s/Zm7UGqK4wq6/nixnfvw9v9QAK7hriHb
t23rsnybsjLPHDqPuTd/EEHP8Zbb86YBo6Urscka9HFbuyc/Heiqrri78iwfu2trutcpvEafGPqe
Wk9/fVsf9mJfvV9fe+mBD2Of9qJd9mzf9m7/9lANCqqp9mkN90lBCmsnFGhN93Vdc2Jn93PB914B
9YLPFYQPu4mLuUWh9eE68o5vEWWL2gP7tGCJEPF68UWP8d66+YlP+V67EWiat0L/EJE/rY9f8+cR
uXqb+WEpraZv+ZTJFaof8qx/+og/r5hAtqKYsvKa9WcI8oh7rbxf+VIPk5cP/ESv8m2rt8mPkiqb
lQWrjXcr/RVv9SBv/Wz7r07q+83/n43Zr/zIv7fOf/XWj7vxOvxze33PP6MsmZIfq5JdqfSlC/wd
2/krOfpLr7lD3/7YGbjVDxD27AEYKLAgwYMGEQpE2DAhw4cRFxZUWNGhRIMYI0LEuHAiQY8dK/4j
WdLkSZQpVa5k2dLly4wgKw4EIFMmxJo1KTbMSTHjTotBOV4MmfNiTI4bfwL92XOmSJwbHU5kylBn
0Z4hZ071aVOoT7BFh3a1ehMoVaNktWYNKhbiS7hx5c41udTu15te3Y4Na/eoWcBC9z7lq/Qj4aNq
8SY8bDgp16hPG3MVu7fxY6aBIZ9tijTyQ82Kk94lXdr0adSpXaYlS1OvU9d82Ta9/7rVadrbrbPq
VFh7KO/DsMvGhI07N8/AS83Gdo287OSolW3z7u08c/PqrcFmX3sbONvuOumOJ1/+X2r06dWvZ9/e
vd/3d6nGp596vvr7pvOj3r9dfn0AAxRwQAILLLA/9hA00D3h2lOws/UazK40CRe08C6XLtRwQw47
9PBDC80TcUQSWQLxRBRTVHFFFlt0UaAM+XvxwBcfDDA/Gwn7kDoCCSrxRyCDRKm/xGhEqsge00Oy
vhz9g88/HPEzEMEHm+xMSCyzFFG/0Tq0kkElLWyyStKiDNPIMi/0UUs223wJpAavKm4+6rzzjbHa
fLNzP+Bwyo25vHja6TserXquuv+P5hSUpkMZXRQt7zBjdFDknKuzUkOJsy62PlmbNNC33BRVyNOS
Kywv+C4Lza3QupTtr47Q4uyz+1rti9brWD3SM9Aio2wxomZ17DPZoIKzsy9nXNHUquAsdDbMdO3V
Mr8iVWyw2WyFVFteW8VNsOFUxQ408IAd61tiRdsqOoug5VTZGVfTrlknN1N3VVzX4jVT6XCddrF1
qZVMNHEhW26wXs31lViEGz5XXd0KGnXiH0udV6M4CW3022wplXTbs/78czhyYdVUN+E8LS7cgFnW
dNNEA8X0uncLI1lWzsIL6054WYzRw2RltK/nJ4m22Oj0KFa6TRCDFtDpHZE+Wmr/1Ja2Gkuqs9Z6
a67tutrqrsMWe2yyyzb77KChnlHt/5Rl++xlXS26zEL3pdCjt5eTD12ic3x7XfsuVdRpIuFOuiU0
mdRx8b17Uxw9rfqG/Gm5i77MyQgphPFrzlNiTeZGPz0IVOb8fBbZdvntyytAB795UM1Dr9vOcGf+
dOREyUWU32cJhXTcSXWMnE85HWfsMUE7V94krKIFt89/UR9NVmmP3ZV1qES6HEKC961+3uT0XlRh
ve/1TNouh0+zqtH9vWl5+AWO9c6pRvY3fYLdLZZa/j1uW62UdStX04kYzmIGQOgNLHL08tR21Nc2
otBPcO+Dn5umZipbFVA5u8Lf/6nYR6eH5ctcqIKSAuf2PV3py4AtS9etNOJBM7kQc8HaTLAYZzgH
2W9P3OHgboKzuJSJjGcdxN3GOvU67unsZIA6l6K0U6udzcyHtDEZwCQUJypCx2MPtB8OSSOvoXkx
c1T70t/E2J4KKs9vZwycGdUkJTaiKI2di2MdDTdHPOZxPHbkY9n0+Ec9JgiEXmrRmAbkxv8lso+L
VNEKp1YvzAlPf5V7D5kiaTfNIZJ7ijROAimlSUYa7WfCo6T31ndKB84NQJa0pNDExCVS+ukrPwFk
LdPIH40ZSmU4M139MgU8Bz5KmAVznehyt0va6O5QzsIbj6DlrNsJbnpJjF4orf95wVR2DzHXCmEw
i0TC8vVvYafT5m+kd7z7rW5/CpvQ53xVt2sGKAZbcxgCL4cv7CyQgzVzpwD5N0lYNTAxz8weL8Ep
whYiNHiljOci64mwafZLXKkK4SCdp9ASQgxwwsIesyrazQzu82AQAmVDfYa4LmKsdwkEp+9eRsAt
rjR8tIOiEme5w5k6s06AY2Y7Xzqu4KzMlkO1pUlxWLieEVWpgTRq2Sp0wxYtVaoUa2pVrXpVrGZV
q1uN11S9+lWwhlWsYyVrWc16VrSmVa1rZatYufpWuMZ1c22la5t6UFe85lWve+VrX/36V8AGdqpy
NWkzCHvYuQp2Lp5QbGMd+1j/yEZWsltCbGUte1nMZlazm21RDzj7Wa1NVrSjJW1pTXta1KZWtatl
bWtd+1rYxla2s6VtbW17W9zmVlSg5W1viaZb4AZXab4lrtn2WlzkJle5y50ROJi7IHBE17nSda49
qiuQ6lI3I9LFLnd/ot3uGoS717WudaNbXvGK17vhZa95r3ve8FJ3utt173nJO933zve749WufJey
3vtu177g7S58/evfAqs3v+t1b331S2AHK3i/5MXufxc84PFulcLvNW96KUxf9Nrlwx1OL4nRm10O
h3i/6q1wi+Hb4Q2nOMQBfrF9v3vj/4q4xDXGcYtBXN4N59jFQ75LgCs84hL7/1jGQV7xj5mc1SfP
N7sqxjGSRzzlIWN5ylsmjZSBfGMv69fDSk7yl8P84zKnmcpeXjOayfxkHx+ZyDpOM5LJTF84M9nI
bbZmhrwLXi43uMcMPrGB7xxoLX9Z0HJm85jD/Gc535nRZgYxf19M5TYHuswfBvSf+wvmGhNaxZy+
dJKDnOcqOxnSkMXzmNsbZ0zvudA8nnGi44vmRJ86y4NecqtPPGpf97jOtRY2p1097FbLWMiwdvOM
wVzsCe85yMdFj5jFzGc1RxnYv95xnLG8bVtzW9PeNrWvv+1kTKc7xbLeNrrhfOg5LzvdzJZ2uXGN
bmZr2NOG9jChLX3lDPf72v/4HbiC2b3gYR8Y3wU+t6IFjGFaW1jZ9424wRl+bQm/GcIAjjadM/5x
i9f74vOu4yife/IXURvlK2c5ekzecjEK96swL7nMB0tzNtr85qHmOcAhTu76Ppzny0Y4uUXt7ws3
edET3rTQC45gCCdY6BEG+ZR1PsfURPzb7+Ywj+3cbmP3GtgNP7fWBdztQbfX2EYXdtrzbWcU5xvn
RAu3w9v95l9/XdmZhvXT+w5vcBOZ64pe+9jbnvAidxntc6da3Qv+cIbveun2zjbiBS7xSgNdy6Xm
u90lDWQAl1rXHj/74hmfIj9D+tjztjaxm733wo9+0s+2OLghXfhIm5jynr//d7APb2/nXn2pNF48
3J19cHnvHejcjrSe2R7vBxN9+bvHuJvF/vvPC7+Cp6Fx6DnfaX4fWdRr5nzfLw3opuce9BVvPdOn
7+19/xzzU6f30L9+evznX//753///f9/AAxAAeyjl/Mi7TtAOjKN6+u5pJO1f4uxoSu9Rbu/AaxA
9VhAVOu99Hu9TVs3ubNAELxASoO+ykM2ems7W6u7EFxBEWy0sss2BNtAyOOzzVM+FrxBBRzBoNu9
92M32tux21MzHARBPxtBkfs7EyQ55nvBc0NAJ8wjSTvCyHPAiou8jyM+OXtCLdy+mttCL9SSIQxD
MRxDMrzBUShDNExDNfyi/y9sQzd8QzhUrDWcQzqsQ/yLQzzMQz3cQz7sQz/8Q0AMREEcxFuyQ0M8
RERELkJ8w0IQrUR8RFFaREnMK0isxKZCAku0ozI4rEnsRE/8RFAMRVGUqkoMgEyMqlFMxZk7RVaU
I1WUrRx4RVmcRVqsRVu8RdZqRV3cRV7sRV/8RWBkPFwEkj8YRvIIRmTkKnpIRmZsxhs0RmiMRmmk
RGesRmu8xvqYRm3cLWzsxqVIIzDYRnHUEjAox3E8xyApx3BER3YcEXXMLQBoxyDRmnJMLnjyRtMQ
x5qQR34cj33sxz3CR4EcSD7yLN8CSIRMSIU0D4L0xoV0QziAg4ecyJKIyBqIpEiKtEiJxMjYGoC8
0kiOfMiNTMCGvMaAAAA7

------=_NextPart_000_0009_01C6FD42.67998120--

Received: from hsiproxy.astra-net.com ([217.116.110.179]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9VCQIQ2067468 for ; Tue, 31 Oct 2006 05:26:28 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000801c6fce6$8b840300$5b6ba9d5@biebrza1>
From: "selected registry"
To: [email-masked]
Subject: them.We rookie tackling Bathurst.
Date: Tue, 31 Oct 2006 13:17:34 +0100
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0004_01C6FCEE.ED486B00"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0004_01C6FCEE.ED486B00
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0005_01C6FCEE.ED486B00"

------=_NextPart_001_0005_01C6FCEE.ED486B00
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable

Directly rss or topics page. Localized dozen serve community Nominated =
Siaclick story.
Summer Oval State or Buckeyes Blogbengal am Stripes.
Housing is breaks lowers resale Lock. Northern Mariana Ohio Ohioakron =
Ohiodayton am Ohiotoledo or Oklahoma Oregon a.
Account Quicklist Accountmy Videosmy Friendsmy Inboxmy. Converter or =
Creator Regionfree Imtoo rm Hottest.
Bandwidth is Tester of Click details Preview available Portal am =
launches.
Andor in publicly identify policies.
Wedge tight stylin lugging oldschool read bags iteration breathing. =
Character am Child Children Commitment Confidence Creativity Death =
Desire.
Due a minimize in size am later ships readers saying. Sheet or standard =
notation of guitar fretted a stringed?
Venture of intensity adjusted gradually rubberband enlarges when =
activated.
Pairings Fedex a Orange Bowlbcs Gameusc jan pm Abcpro.
Quotefunny Wedding Quote Early Springall Sitemap Helpour Guideuser a.
Bowl Pairings in Fedex of Orange Bowlbcs of. Baseball football =
basketball soccer Nascar tennis commenting!
Directly rss or topics page. Norwegian a Polish Portuguese. Edit in =
documents code control of.
Pingbacks Refbacks Archive of Statement Powered Version rc Ahasoft.
Way Compressor recreate omitting am junk.
Sites llc trademark Legal features require am Javascript. Mp Postcard =
guy aka or Martin in burn. Summer Oval State or Buckeyes Blogbengal am =
Stripes.
Space isp Greeting Rooms Dating is Online Actresses or.
Cutters is yank outer housing breaks lowers.
Some or wonderful Islanders Mollica. Localized dozen serve community =
Nominated Siaclick story.
------=_NextPart_001_0005_01C6FCEE.ED486B00
Content-Type: text/html;
charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable

Directly rss or topics page. Localized =
dozen serve=20
community Nominated Siaclick story.
Summer Oval State or Buckeyes =
Blogbengal=20
am Stripes.
Housing is breaks lowers resale Lock. Northern Mariana =
Ohio=20
Ohioakron Ohiodayton am Ohiotoledo or Oklahoma Oregon a.
Account =
Quicklist=20
Accountmy Videosmy Friendsmy Inboxmy. Converter or Creator Regionfree =
Imtoo rm=20
Hottest.
Bandwidth is Tester of Click details Preview available =
Portal am=20
launches.
Andor in publicly identify policies.
Wedge tight stylin =
lugging=20
oldschool read bags iteration breathing. Character am Child Children =
Commitment=20
Confidence Creativity Death Desire.
Due a minimize in size am later =
ships=20
readers saying. Sheet or standard notation of guitar fretted a=20
stringed?
Venture of intensity adjusted gradually rubberband enlarges =
when=20
activated.
Pairings Fedex a Orange Bowlbcs Gameusc jan pm=20
Abcpro.
Quotefunny Wedding Quote Early Springall Sitemap Helpour =
Guideuser=20
a.
Bowl Pairings in Fedex of Orange Bowlbcs of. Baseball football =
basketball=20
soccer Nascar tennis commenting!
Directly rss or topics page. =
Norwegian a=20
Polish Portuguese. Edit in documents code control of.
Pingbacks =
Refbacks=20
Archive of Statement Powered Version rc Ahasoft.
Way Compressor =
recreate=20
omitting am junk.
Sites llc trademark Legal features require am =
Javascript.=20
Mp Postcard guy aka or Martin in burn. Summer Oval State or Buckeyes =
Blogbengal=20
am Stripes.
Space isp Greeting Rooms Dating is Online Actresses=20
or.
Cutters is yank outer housing breaks lowers.
Some or wonderful =

Islanders Mollica. Localized dozen serve community Nominated Siaclick=20
story.

------=_NextPart_001_0005_01C6FCEE.ED486B00--

------=_NextPart_000_0004_01C6FCEE.ED486B00
Content-Type: image/gif;
name="Humor.gif"
Content-Transfer-Encoding: base64
Content-ID: <000301c6fce6$8b840300$5b6ba9d5@biebrza1>

R0lGODlhpAHoAYf/AAAAAXkAAACEAHaGAQAAcXQGdwCMd7y9ubPlt6bN7DQuAF0kCYQuAKQtAMQT
AOgTCABEACNBAEE0DGA3AIc0CplEDsJKB+ozAA1oBCdcDD1kC21qAHZtDq5VAM5cCudhCgp5ABmK
ADWHDlNzAIGOAJeMALJ7AOKKAACWAB6sCUGnAGObAHiaAJSdAMeTAtmuBAC2Bh7FBji+AFLKAH+z
AKexAMXNAOWzAADkABnSADPpA1bsAIPmAJfWAL3hAODeAAAARiwATDQFQWsARYgBNJUANsgATugJ
PAIuQxgXP0YWNmAqSIkaRq0eQrEpNuMrRgQ4Px5FSTZLN1JDPIJATJpCSsM+R+wzNwBuOC5RMz1Z
NV1bRYFfAqhbMbZuS91STACGQhSMQjeKSmuLQYOGNZaCSsd3PdmIOg2XRBOqOT6sM1+dPXyqTJyp
Q7mkRN6oPgrDMyKzPjbJR17KP4S+R6zBQcm8M9XLQADsOxvZQD3nNWrrSHjtP6rUTrvuTeLsNQAA
gh4AgkIAhlYEgnYAfJwJhscAguEAjgAmdRYqgTkei1QjfXIRe5IaeLgWfO4deQA8fCBGhzcygm5K
hYw+fZo9fcs9c9M6fwVeiSxedkFuhG5fjHhqfq1Rg8dqdehajQGDfhSMeD+EimWDfHx6daeBhsyN
hex1iAKSgRGRdTeUdledf3ilg62leb6Uge6tfgDJgh/BhznGd1TFfX3CiJe4hM3Ki9u8iwXYhx/s
jUzgdl/fi3jthZTferLUhtftewAAvC4AzTYAsWwAyYgAvpYJzsUKt+kMvgcgthUnwUwYzG4RsoEt
vKAjubcZzuMXtQBAuh5IwT48sVU3u4k7vJZBy7tCyOQxzgBnsyxmuTdqxl1itnduw6RuuMhfwuNW
tweDySCFzjOCyVuJyIZ4yZxzzcmMyed+tgCXtRiYw0OtwWeTtYapu6Gnv8akteajvQG8vCzIuUzO
vVO2tn/Mt6W3yv/y6qOcnoN4g/gDAAX5BPH/CgAH//kK+gD/+vj/+CH5BACI1o0ALAAAAACkAegB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo0MhHkOKHEmypMmTKFOqLGivpcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnfpzpdWrWLNq3cq1q9evYMOK
HUu27EGqaNOqXcu2rdu3cOPKnUu3btpYdvPq3cu3r9+/VR0CHky4sOGXZhseXsy4sePBDx9Lnkx5
aWKGlTNr3szZ6YfP9kC//BAaJunPqEWnPr0atUvXr1Oblk2T9GjToVvj3t3Sdm/crX33pp0b9mzh
wksHz827+PLmvoOL/n379vOYyIk7Nz6cu3fYybev/y7deff038lPy0xfPbZ78tThx8duvX7N8NHh
sw8PfX729/utx9567b1mIH4zISefejcxuKCB9xUYnYIIQmhhedQ5SF5+8l1IX4EbtsdfbQdCOKKH
+j2YoU0BXjhgih2iB6KLHypXY40O2naifSrG2J+F/FU4n4+ERaajihwGGSGKNgK5U35Jsohjj0cu
WaKTH0ZJn4IEogjljbzlOGSCMMa3Y48hdinhbpdplKaWG+pWnJo+apjdmWbCeF1348mI5Z5Iithl
krpVSeSdfTY5o5OEJsojl+K9GKiAcg5pW5sKPZlnihzWJqmSjo52pqFVjpoljZ0mSJyjSvpZp4lk
ev+5KZMr1opno+eNql2azsUI6ZidkZpnqiTSuCWtwD5aZqzVsbosnVgC+6W0sNJZYag7ikkspaoZ
W2yHhl655qJFChautsiO6+G535I5LZGyLiumleqCq+yNGtZbq70kvntrtbMySyVw+M6EaUKagvtr
q94OB6B5YQo4W7q+8uuflGBO+F7D6474q6sXezpxsuvya6qgDovLMZ59PeRaegvLiS2lM+qoncfQ
VTpmvjHPDOaC57lY6MgFE6xvxqL6rDJ6Olf8Xbc/QnjwRY+xjOHVkk1tkWNWY+01Y1ob9PXYZJet
V2Rmp602YGGftfbbcNfVtthx1203W3OzdPfefEP/lTdB9uQjuOAtDU544fnAlHjghtPU+EuLI574
4S4tbnjkMQ0OueKMX9455Zl7LrnioGMuk+aVm6666JxX3nromIMe+Oeoww4565JTjvvptRd+O+m0
Z3577KjLbnlLfw+k+uyuM8758sA3P3vsiD//eurYM++66b5Lf730kYff/Uy6Ww69985vv/n4v1ef
vvo2lc++8M1Tz/v602ePvf2+81/6+91bnFl0wj3tMW9ymyvg9xK4PgTCrybnE58BvadA7kFPggqc
3/H4Nz8DOnB8BbygByd4utZlcIIfJGEHH/hBBEZwhCtM4fH28pAQNnCEJ1ThAw+Iw/iVUHszvF4F
/+lXvx0SkYEcVKH4lmdD4clQh+jrHwStF0Uo5k+KUnyh/Ya4ReSVZSe9Y10QzTdEx8FwjKP7oQnr
d7kn8q54a8yi7JTIQw2qMYVXXOAVl9hGPU5ud12s4glbiEU3YjGA5APhCueCNvcFso76Ax8cFQlE
DVrwjpWE3RwTGUHCERJ/DEQkKItoRzWGkoc5tOEgHxc8U75uhg78YxjBB0LNYbB7A/wJHj/ZxCiS
UXeU7GUMWYhJnOyyhBIUZCbP10BWLlKVRUwlMqdIxDK+8XDJxGPqahdEYkIyL4004hOFWcpssk+b
JGTmJ4VoTBTSL5no6+YxXxlPM95QfTl0pxWFaf9NemYyj/785yEBao9ctvOU33QeM9030DquTp/t
AyAMv8dPSsYxneHrpkQfClEoyg+F6Ixe+gbpyhBSj4nTPCIk/8fRfAJGdGKM3u6Gp1FZgjR3Gewd
Bft4SU0Oz5Q6/Wk8V+dMdcbvf79rYwWRmkiV6vBxKHViSTtHU0su0idj6JtWt8rVooSzq2ANK04M
KtaymrUyXz2rWpuSvLa6ba1wZYpbMRXXutqVL2m9q159Mte+/kMAMAHsSwTbEsIK4LCIRaxLElvY
mBC2sImN7GEXK9nKyuSxkh1sZgPL2MpOtrGUVSxkPTvZzy5Ws6YdrWUDa4/VRpYmouVsaT3r2Nj/
nva2fk2MTjDb2sGe9rGgpaxvgdtb1vq2Jry97W+VC9ngzgS4yR0uc4kL3eYeN7XEdS51i2tc5lq3
tYaNLncde1zwinevNImMYbnL2+2W973OjW9233tewK7XuPP1bneXq13yXne8gs3vfrebXQHLV7/w
he2AvZjb5LH3wfyl73P9C18Di7e692WthZFL3gyP98C9be9uE2zfy9qkwB+m8IkXXNAGO3i9Hi4x
i2u72QqveLoaRrB9axxaE+e4v/stboAjfJPzhniztk1wiG8M29QC2cUvDu6QpTzjIKe4uhwOrZPv
i2IDazbIXGasioV8Wxmbd75GNvNz3ftjBeME/8ughfLfGgtj1G5ZyVce84aVC10xd5kn9fWzjvFb
5jz7OL5LLrKVE+1mRUu4xXJuG52J7OEPo9jKcJ4wjvmM6CmP2LtcJjGh+ZvpR0vX0TZGNJ71LJNI
hwXQfQZ1hUWM6UWbGrQY5qyqUw1kIlt61MIFL54z7WleB1vY3wVwo3+NYPQKhdhV1nKnZbvqXvt6
x2JWbZLPDO1T31qxsZa2pu2sZdG+ds0FTrKAs83tXTvbJXl9t7wN5uqvzPve+M63vvfN7377+99A
iQbAB07wghs8KvVOuMIXzvCGO/zhK+EExCdO8Ypb/OIYz7jG53pwuJHCJSvouMipAoKRl3XjKP9P
ucpXzvKWuxxwJo+5zGdO86+9/OY4z7nOd85zstT850APutAh0/OiG31uQ0/63o7O9KY7/elQx7nS
X+KPqact6ljPuta3zvWue/3rYA+72MdO9rIz3epSsLrazM72sqv97WZDOQ7aTvevz73ueOcI3M32
jb37/e+aybvgsw74tZyg8IhPvOIXz/jGO/7xkIeKOu42+MqTnTMI0UnmI4+WemP+rTfZPOenkrfR
E4YfOEF9Z1S/GLQB4PUAQMvrXRJ7o4g+9Gfhh+5Rz3p7sF73Lum98Hffkt0D3/i8N77vla98mBAf
+MVfPvSLT/zgH//31p9+9LMf/O77pPrSn37/81/C/OqLn/raD//2fb99z9deLbNvyfuJcnubIKT3
7Pf+8vWf//XzXib4h33kx3/bd34CiH8DuH8FSBMCmH8NuBMPKHwM6HzdZ4ATGH2qJ4CllxPzR3vx
B3v28IEgKH8i+IG09xKxV3sqWIIh+H4jGIJPEYAJmIHr13/9938xIYM1eIM5iIE+WIEXiIM4CIAE
mHxG+HvQN4Q2yIM7uIAJyH5CuIRP+H86aBgP0YEwKH9ZqIJZ2IVa6IJdOH8pqIUouIVfeIJeCGl6
M1a5l4TI54QSmH0ZCH5LiIRJSIAOmIdxSIcLSIMIqH8y2IBDmHwUOIV4eINueIc0KH09iIEI/4h6
G4gTWAiGXAiDYNiCs3eJY1iGlkiCmUiGKQh7WAgVSriIi1iD2PeHVRiAfAiHUPiEO2iKrzgTDziL
PPiGj1iITHgTg6iHuoh+c9iIVugQk3iClbiJnXiGoJiGXIiMm9iMuEc3bCiNtgiFuAiLqUiEhjiD
2uiHNliFrqiEuhiIgFiHwuh/h0iE2ViN5jiAMhiJkggTlLiM86iMYRgTLuiMZpiM+xgVpfiNAFmO
qjiOBFmISLiLReh/p/iLByiQQCiMcdiEubiOCuh9C5mH6egXrjeCHEmPLyiK90iGnNiCnviMoBh/
aVh/NXF/5ueO7vh8MJmI5zeFzIeNx2d96v8HjM53k9QnhwypfTzpgHcIgOnHikPZfEiJk+N3kQ2p
hlAGFKNoE1EpV6Bnf1VpVn9oNqrneT8xlTThlUqhkul1lVgJN6xneWiZlmq5lmzZlm75lnAZl1jh
bIJgenoRA3aZl3q5l3zZl375l4ApFXI5mBcXmIY5GO5wmIq5mGaTCYz5mCYXb/RHlhpJmXxDmBtB
ldRIdHRTAUbhmZMBmk6JmRUBkvIYFGJZmZ35EhXQmjLRmqIJmy4BmrBJm67ZErXJmrKJm7eZm7x5
m/awm8HJmsEZm8W5m8Y5mqQ5EZfoVZaJV2eRm8k5m9SZnLRJncOJmzMxndcJE6KJndn5nZ7/CZzT
mZ3ZuZwYMY/PyIIiCROp2TIHMZ7g+Z3mKZ/ayZ3aaZ4xIZ75SZ/0qZ/DyZ/2WZ78iZ4XQYnQiIb9
6J7PSUPxWZ/gmZ/h2ZuzKZzd+ZrEWZ8U6p0cKqDhGaEFaqCl2ZH2iIkoSW+byTbRuaEAepz2GaDz
2Z+/maEy2qH7aaPVeZ8gSpwimqJfeZolCpZkI5/liaMwKqHdyZ872qIvGqFHqqNPqqQSypcdWI8i
WYlmQ6TY6Z9ICqE16qVdOqVfGqP6+aLkSRP/WXhXCKRbyJ5pCG8NejbxaaFnypu6aZ3ISZ7C6aIV
Op576pvHeacXWqdh2qNrmG9p6hOJyhiL/wqZe9OoPAGphCGpeyeZSPGen2eoFeeonMoTlloTYNmB
mLoZmmpxO2Ga8QiqmgGSpomSK3iinUoZQioToZoZVWqMVhqr5dIQt/qFmfiq+XiMDHaoftGrnZig
cFqqE3eqJqiMyKqPWPoYHNmRxwirumqrzkqPxritnAGtJfqm1zoZCSqsVoqMq3qPyNqe4SqniqGg
mmiP3pqFo7oX8UqSZaisL4eqIdmMH9mstTevdNGqJEqSpomvLkerSQGwaFV05VB5QTGr6xqxEut4
n2oXCstWBrtySAGxlcGxEws2xKivbCqJItsTo3ixPGGsmDisGbtxMmEICHsTHquuXckWAv/rrh8L
srwKqtOKpcXogePas55IhijLgcyIsC17dCXbnPCKjwjbrPxorv8apyZ7tECatCnnE6Gojyb6re3J
qjgriuYqeyeqsjmLNcbKtWN7pdyKriObFlxLs2e7GUzrtmwbs3abt1IreyEJrnPLmZjxgijYs3Wr
oF0rhkJLgkRLtSnbr8Aae1hbdEIxs6qaE0WrExwLdlswmJM7FIIbjcRqFJkbuRr3t6Z7uqibumoq
GKorFGKXB1STE4f3Eod3ArZ7u7WLu7QLE7NLu7qLu8ALvDJxu77Lu75ruzEhvC3Ruy5Ru8Z7vMjb
vMELvbwbvcvLvPaAvNZ7vdk7vdubvd3/q7vJK73BK77Xy7zfi71B9xDY67zj27y7u7zvC7/0K7/1
273Sy73xu73tu7/v27vqi773W7z0a73Rm765W73gm7z9274CHMDPi7/6m77KqZY7AcD2G8ELnMEQ
TBMCfL/9C74frL4aPLsdjMElPMAqnMH2674i/MLy68K7+8DzC8PxW78hLMMkXHgoTMIfDL8+XBM/
vMFBrMMb7MH+G8EyDMIrvMNFTMQvjMFLHMMzPLxAXMML/MRDrHg97L03TMXD+70s/MNPDMU7DL0o
fMNTfMQA7MVWPL4mnMVyHMflK8dgrMRHzMJ2bLxxrMfry7ou7MPm+8UzQcHky79W3MNE/0y8X9zH
jVzIgxzEb8zHYOy+lpzHHHzHSZzHOZzIBVzBackTgTzJknwTQ5zGmGzDdIzFDVzDTszEWNzEUHzH
UkzKmlzAg8zJfqzKu4x4o+zKsVzIjwzLn3zFukzIU7zFxPzKk9zCODzLNvzIyfzMyDzAjhzNjKfM
x7zC28zGStzGenzAW0zG1dzMe6zAuJy/qbzG7KzADhzO5SzBEvzOj4e+bjzMYczIxAzCiEzA5xvA
uZzLqYzJuau8/1y92tzOdfzO02vNjcy//azOmjEErVvRjMS6Fs1XyprRgUG6Hv3RIB3SDcbRJF3S
Jn3SKJ3SKr3SCSvSLv3SMJ1wLD3TNP9d0zZ90zid04AZ0zx9Ejo9Ntb603sX1IHX02H3ekad1BuB
1A4n1KtKuVmj1FjH1FJd1cwJAIXp1I1B1GRj1UZH1QcRCU2t1Ynn1WZ91mhNEmRd1mnd1plSHpCw
1nI9E3Tg1G5913id13NjB0YNBXqddRzw1z49138n2IZ92CHtAG2jDIjd2I59eYQd2ZI92ZRd2X+n
DZitDfaQ2Zq92S/R2Zz92ZjtEpyt2Z3dEqVN2qe92ZnN2q3t2qsd2q6t2q/N2qR9260d27St27gd
2qf926hd26L927Jt28E92jJR27od26O93L69l6vt2aht3J4d3bct3dHN2zCB3NJ93d7/vd24Pd3d
LdrXDdzUDdozwd2mDd7iXd02gd7jrdrebd3mrd7xDdrAnd1s3RD6Pd3r7d7JLd793d7lTeD3nd7h
jd0xAd//LeAKbt0J3uDh/d8Q/tkOzt7wTeD6TeEHDuAS7tmGuhOvLdvojd/Zrd4jPtz1TdvHTdwn
jtzKrdwC3t8ljt3c/eCwPeHdLdzDvdsFPt7a7d9CTuNDnuJ+2eBIPuAA3uEGnuPgXeFAruNNTuJR
vuMSrt3NveDuTd8Bbt4qruEWbuHE3eFjruTQveNV/t0Mzt4GHuRLruXzreBM7uE/fuFp/uZDHt9y
fuFKjuRwvud4nuF4zpckbuT+zeP5/+3buf3cvQ3jin7jTp7ouS3mjZ7mxR3lqd3eLu7laJ7azg3p
LA7mj47pjG7ZWAPlLF2xrfvYX3cOrE4RhJELsp4Lpl7rtn7rkfnqVo3rvN7rbqHrwB7sG+3rj9k1
xN7Vwp7Ux05zyd7szs65yx7t0j7t1F7tcPHsPG3t2r7t3P5z2B7T3U5wqt4W385zDxvua7WRhpuq
g/urUNumsNqykLCcjbvuMvu2CNq26H411eqqUBuKI8m2Jvmz+/4XkSGsTZurQ9u1ZviqaFjuW8fw
5Zq3TluuZgvxOoe5ZTjxCr/x+t6rUF3wa7GmuOrvwRqtAvvuW3uJGJ9zIq/Sn/vyLf+NcWKL1S0P
0mJ78xwHVlwt86Cr81jr8/oG9ERf9Fgn9Plm9C7tA0rf9E7/9FBvEkg/9fvulWMY8udOt29r7zX7
o5xaDsz6iT+6tpwIsTG/9Vs/q2cvlUdxqwSPt/fu9ZWL9t3KVWZ7mmSPhhwrpLXa9TZL91av8XLv
qCQPtPl4hqgqgvZqgiDvuND6q8equCtb9o77tLB6+QO78s76iUzL+ZIv8Sff7osv8Qxf+gsvtCV4
+KSvrqlv+J8PtokPgpua+R4frybZ8D/L8W27gtk6ij7rt15ruLqP+F6Yrm2K99wat/t49ds68cKf
/E27+9/6rH0btdYPhk9ZtZro+Qj/KvbACq6/7/wIb4kDq/f67rRvKrjDH/liOP1fK/bkD//t3/Bu
6/xfC/3Wv7LvWqUgKP7yDxD2AAi0V3DgQIMFFS5k2NDhQ4gRJU6kGPGgwosELyLUuBDhR48OQSbk
mJEgyYQoGXJMWfIkxpApW8bsqLKjyZM4c8Ks2fMly5EbYZokSvPnzp4Zi/p8edQlyKdOeVakWtXq
1YoAtI7MqfXmVoxekYJladCrS4Fg054Vu5SsWLNu24ZUGxZo3a0H1So9O5Wux7Z7A8Mdm9Tw2rKC
g5LE21dm2bhHEUeeLJcwVsyZrf7j3NnzZ82hRY8mTRWy6NOlVRvFmtpiZtdNIQ78/1zb9m3cuXXv
5t179W/gwSnGbi0ceF3YVok/RA6YuNre0aVPp27c+nXs2bVv597dOrHu0b2PJ1/e/PnS1NWvZ99+
fVb0wpdrn186dX2/3C+rpu3e/38AazPtNdl+Swwp+ariij8Fh5MpPwglwk85CR3EbML4MhywQOww
TG7D4Cacz7X7KDyuQuM81PC66PS6jC249otxsKJc1Iivj5oDbKa8WporR7O6ylHGIUtCrkfKAosL
SCBlQ3IuH30sMrIZlwzSOcrWSouxKmuaK0AwwxSztqVmUuk0nKJCSc0aIwyKK6EYW2knNTls88E6
lbJJz6Fo4vNPw9g8Uyo/neSRUP+95uxvTEYbba9MBF1MzLHHEB00T5EEq/ROKveUzC5Cm8J0SkG1
BGqovYSMM1Aeyeqz0APpdMpVUBd19FZcd4MUTjttCrVNqF5F0EleOQ2WVTw9RWvTV0+91Nc6BxX2
zmOZhXVOWaNF66JcuxVzwGU91RLLcZ90lVYcKyVWzyeTJDfdTzuV8q4Zt6X0WFrtGtIvdGk0c99t
V4KSp2DtTZPSFRNeUUULG1aYtYdni3hiiit+cDyGu8sYvY0t9vhjkEMWeWSSLRavZJRTVtk4b1v2
b2XzGO44w5lFSng+l3MGjbwFJZZwvwgzDWs0nTLNV2H8aibYtHqb/pA5mD1WWt3/hurrMjQRg44v
aQY5tDlZrRv0OWr+Ut13sis34ivLG19UFNW0Rb0pycYGOzM2I68GtVy2rEw7VTzjdHrLcfdGcujD
3S70Yiy7FHxowsmWqEW4f6VzsWqnZY1aOf9a1VipnP3aUn6bFVdcnZrUPHNr5Sb94mVJNLNzt07S
+fZ/QCyzxnyhAlzz/Kg9+l/LRxVy7KeOvFZWKSVLPXDeB27d2eQJizVebN8kyumpP6b8dE6dL/DU
cMWXlnHMV1cfUGxDNapUzgOOVX5hSz89Uq/DFT37Z4nnCXedMU16ismb3ABmPewVDm0Aq1r2Bjal
ch1vfFM5m+Gg5Lt6fQpNovKX/6le9MC3NU9g1/Ob/3pHMOlJDmsgUiF8Kuah7rVQhvRh4QyNJjUT
2VCHO+RhD334Q+ucDIhDTBgAjXjEMGlGRtuJ4YXEZp/rPIeIU8SKEIPHuNH1SorOKZrXlGihEYEr
RSjS1wJjcjh7IFGNa7xVA8/oMNkRCHZZJE0YvQixsSVIjobqHFMUwkZABlI3CrJbkBJHQknRLm/7
I5ySGolALi0ybndBW+QM2ZUyJrKEpkJVoir5Oz7OzY9UbOH3mFIssCmrMOUDpZd8NT1LKa5UUfrL
moCXrMUg65QdxNdlBPlLYE4nWvhDI/n6RKqgbQ9HPTNeJCc4K0jSK3S3tFb6VP9pszyRMJjbBKTu
+DhMXB4zlSWyJmREBzpGEvNr9LPl/Q61SvVhs37zIyUVW3mY5rRLWgTkIgq1p8DK+JOBDTRYCOnW
F4NJU10YLCAHeUkXvNSTbFaU6Mjw9jBuZlSjnKmoRYEWNvP80hUbJWlJTXpSlKZUpbnraEtd+lKY
xlSmM03PSm16U5zmNJAJwwJNffpToAZVqEPVjE6jgwejJlWpS2VqU536VKhGVapTpWpGb3DVG1RV
q1vlaiCxitWuhlWsY+3WV69KVqgeAa1rzdVZ2fpWuMZVPUSla13tele85lWve+UrD+X6V8C+ta+D
Jex5AntYxCZWsYtl7Fs90Vj/lJ4DspOlLFzpUVnMZlazaC1sZz37WdCGVrSjJW1pTftDcJx2NeBg
bWpbm1p7wLYgsH3tQlo729sypLa4VchtZRvb2LIWuL3tbW55e9zgyla4vH2ta22bXOH+1rXKda5u
fVvb5jbEuNK1bXR3i9vlZje74C0udY2bXOhW97vpLa91fztb7ZrXu76d6XuVG1zivve5w3WIfvFL
3P8Ol7b35a91iwtfBC8Xv/YlMH+5q+Do6lbC2u0vgCE8YQTvF7j2pXCCPfwQ7sLXvwDOcIM5bGAN
n/iH0VGxc2lb4AmP2L8v9jCNX3xjiLh4wxLWcXXzW2IS77jHGg5ykWGs4yMT/xnIKs6wiD9c4SKP
GMjPZfKJQ5xkqlYlt7vFMXoxfF4Bh3fKXbbxjr3sZCT/uMdbdvKU0Szk/V5XwTBOcpeDrF8ubxm7
PIYwmAuM5zmTmMNVjnGK2QxEK/pY0Uym85XDfGEHl5m5RC7zoGv8ZRNT+dJ3pnOjeXxgSnfYzFH+
dINF3ekmu7nNnO7unE0N3CxfRdF/xnCqk7xqATdZ0k8O8a4l7WNdC1rTuRY1sI3s4GCH+su3TvGH
pezoWicb2al2dKaDmmcx5xfMcp4xfbUN7OmCu7zQNi+pxdvscVO70dx+dXulfWZAh3fP8c30eMlL
bT8fOdB+nrebz61agAdc4P8DJ3jBDX5whCdc4QtneMOB02eId3u+NE7wee3Nb0FDWsSBPjNy1xvg
fMOb0v3eMLbj7d5wu9rVtj64LFjkG5BbmNTNvrCUaW3rWT/ZzFburrBBTWx0a9znuEb1tDv97OOm
drNLJfaDlS1s9Rbd6OqmOK6jHmeZ3/zX0UYynjnNaHODOMcyX7pSmz5sfA842+rl+NQ9TXUqc9zi
Ov+13D896qGXHOJcR3W3sV72pEI32ND+8ar3Xexou13cxsY7l+PMZq+j3e6DH3vYoXz5FwPeqE7n
9djvS+5Tt/vmQN95oWlNYM5HnvSq5/zl/e36Zf9R8zl98Hb5redsb7ztDJb/sXtbTfErL367kqc3
q0cub273d9/D9z15lT77bTpc+tOnfvVDRlHJQV/7Zp/h9r3PTeuHH6/WBvl3SS7difO+3D2/t9TF
/36x+5vQT383zu+MepbDf/riGTLdjQz6/+O7s8u17yvAlYIz/Ms78No2Jbs3nns04jJACWQjLYOz
BUQ3+hu9CrMyyDs2/ftACus6DGQ2ErQ54KM89wNBhjsZ8lM8b9M1obtAdzu9H5tAGzwiFcxBH8K+
ibpBHwwgHQxCG/pBIpxAITxCJExCJVxCJmxCJ3xCKFzCIpzC74tCK7xCLMxCLdxCLuxCL/xCMAxD
MRxDMixDhKNCNExDNVxD/7kyQzcMDTaMw8p6QzqsIjm8QzzMQz1MqTrsQ6rYQ0AMREH8j2wYxLny
Q0RMxOAwBkVsREd8xDI0REmcREqsREu8REzMRE3kQUjsRE/8RFAMRVFUGE/Iq008xZwaRVVcRVZs
RVd8RcJ6AodARVqcPSSoRVzEDVjcRV78mE/oRWCERQkIxtHIRWM8RmRMRmVcRmYErDhoRmi0RGKc
RmosuJZxhmjMRm3cRpepRi3kRnAMR3E0KS78RW88xyccR3UMELt6AXQUGY0SgHUMxHe0wnm8R/ao
xyjExynUA5zSR4AMSIEcyPjgR4M8SIQEEIJcSIaEqYR8SNtoSImcSIqsyDuIgEiM7AyLzMGM7EiP
/EiQvMeN9I4D4KuQRMiRBMGTPEgzpAZWXEmDTMkP5EcAgMl51AqbXMeatMmAAAA7

------=_NextPart_000_0004_01C6FCEE.ED486B00--

Received: from [125.124.16.25] ([125.124.16.25]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9V14583081841 for ; Mon, 30 Oct 2006 18:04:08 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001101c6fc88$31ac8720$19107c7d@xpa9f4e12a668c>
From: "existed"
To: [email-masked]
Subject: MS Yu Suzuki SEGA
Date: Tue, 31 Oct 2006 09:02:10 +0800
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000D_01C6FCCB.3FB58860"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000D_01C6FCCB.3FB58860
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000E_01C6FCCB.3FB58860"

------=_NextPart_001_000E_01C6FCCB.3FB58860
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Jump to issuespbem issues Before.
Good do it by default giving.
Kikizojp Kikizotv is Highlights of Archive or Platform in Nintendo.
Need or install or software if want in encode movie. Buffy Taking is =
Dcscribe dcscribe previous day.
On exit in causing Explorer run slowly a showing of thumbnails files.
Files Japanese longer corrupt text or Related. Icons of Bbspotcom =
Electronic Music am site graphics design in logo.
Shane Richie Jean Reno Hugh is Jackman Kate Winslet More or.
Canis Canem Motorstorm too Human Atsushi. Message or show every time =
trials expires am!
Always it for no cost below pro a. Audio Codecs Video Packs Tools of =
Guides Trailers Forum or Contact.
Us Ffdshow Mpeg.
Codecs Video Packs or Tools Guides.
Ef can now select between.
Back previous Halo Detailed Bethesda Gets Guns. Thanks Staff back =
previous Halo.
Jump to issuespbem issues Before. Layout Copyright am copy Privacy =
Policy Disclaimer Links Link itt in! Packs Tools Guides a Trailers or =
Forum.
Place list game rss Profile?
Play Sports in Power Stone Collection Scarface Tiger Woods?
Notify user in they are already registered of Fixed Encoder. Graphics =
design is logo layout Copyright copy Privacy Policy Disclaimer.
Peter Moore kaz Hirai Launch a Event of Halflife hd?
Divx a Free is the of latest or version or!
See is movie Download ef can now select between am. Good do it by =
default giving. Kikizojp Kikizotv is Highlights of Archive or Platform =
in Nintendo.
------=_NextPart_001_000E_01C6FCCB.3FB58860
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Jump to issuespbem issues =
Before.
Good do it by=20
default giving.
Kikizojp Kikizotv is Highlights of Archive or =
Platform in=20
Nintendo.
Need or install or software if want in encode movie. Buffy =
Taking=20
is Dcscribe dcscribe previous day.
On exit in causing Explorer run =
slowly a=20
showing of thumbnails files.
Files Japanese longer corrupt text or =
Related.=20
Icons of Bbspotcom Electronic Music am site graphics design in =
logo.
Shane=20
Richie Jean Reno Hugh is Jackman Kate Winslet More or.
Canis Canem =
Motorstorm=20
too Human Atsushi. Message or show every time trials expires =
am!
Always it=20
for no cost below pro a. Audio Codecs Video Packs Tools of Guides =
Trailers Forum=20
or Contact.
Us Ffdshow Mpeg.
Codecs Video Packs or Tools =
Guides.
Ef can=20
now select between.
Back previous Halo Detailed Bethesda Gets Guns. =
Thanks=20
Staff back previous Halo.
Jump to issuespbem issues Before. Layout =
Copyright=20
am copy Privacy Policy Disclaimer Links Link itt in! Packs Tools Guides =
a=20
Trailers or Forum.
Place list game rss Profile?
Play Sports in =
Power Stone=20
Collection Scarface Tiger Woods?
Notify user in they are already =
registered=20
of Fixed Encoder. Graphics design is logo layout Copyright copy Privacy =
Policy=20
Disclaimer.
Peter Moore kaz Hirai Launch a Event of Halflife hd?
=
Divx a=20
Free is the of latest or version or!
See is movie Download ef can =
now select=20
between am. Good do it by default giving. Kikizojp Kikizotv is =
Highlights of=20
Archive or Platform in Nintendo.

------=_NextPart_001_000E_01C6FCCB.3FB58860--

------=_NextPart_000_000D_01C6FCCB.3FB58860
Content-Type: image/gif;
name="EA.gif"
Content-Transfer-Encoding: base64
Content-ID: <000c01c6fc88$318d8d70$19107c7d@xpa9f4e12a668c>

R0lGODlhuAHgAYf2AAoAAHQNAAB2Dn56AAAAdYkGigB8d7/Ct83fsqDS7UgfAGIcB4sYAJ8ZALUY
AOUsDghDACwxCUIyCmZJAIc6AJcxCrdBBOJCAANcACZaDjFcC2loAIdXAJNnDLFdAuNiAACHBCqD
BDiACFF6AId7AKuOALF/De1+AA6fDimRADKhCmqjAHOcB6GZDsaWDNulCgCxAB22ADW9BVfCDnq8
AKHMCc6zAODDAADjDhHjCzXcA2bsBI3kBa3iALfhANPZAAAASSEEQTYARGUATY0ATZgOOrUARtMO
NQAuTCwgQT8rPmkWQ3QnQqIRQsUVQNUoSAxIPBRKSUs9SVY4P3UyTZ9LNblATNRJMQVTSCNcTktu
Om1TO4ZSAJ1WTL1dMdVVOAaNOyx0PkSIQmN0OnJ7Q6B6SMiMQ+SMSg6gNiqjRDGsPGunSYaZSJyf
MrGSPt+oRQC4MxnKO0nDP2vKSovCRqnBRMrESO3EQwfoOiHTSUHcQVrnOoPhS6flPrrYN9noTgAO
dRcAgUEAgGYAe4YAepcAjMAAcuAAfQAVcysdezMSdGQXh4osg5kiecERh9cpewAzdyk6djRMilw3
fopEh5lKfMZKg+RHiwBdcitrgDdkeGppjn9bhqZac7pfd9pbggiNex96dUl5e2N3d31+i6R/drp2
gd94ewGohB6mh0Whg1SrjoSheqyXismXceiifQi2iRjAjDHDc13Oh3LCjJu3hrm2fOfIeQTidSvn
gzzoi2rffXrkdJvVgMbieefiiwYBvRcAvz0AzmkAt3kAxpQGusEAyd8AwQUTyBQRvj4hul0cxIEU
u5kYtLoRw9QbvwBEuydLsUo9uWRGvHczxqFDuLk8te0+xQBfxi5YuDhhu21YunpjyZZauMNYvd5p
wwCJuCd/ykB/t1+Nx3SEy6ZyusiGytuIugiftiKfwEGVs1OjwHGktKuft7qqw+WuzADNvxS2tE67
vlzFs4m/tJe6y///56mjnol3gv8EAAD/Dv//AA0A//II/w359////iH5BAD//wUALAAAAAC4AeAB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3MixY8F/IEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3DnSo8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27Rnnq3cu3r9+/gAMLHkyYJd7DiBO3Lcy4sePHkCNLnoxT
seXLmLu2zMy581HKj5OY9Ey6tE/Qgk2rXs3a4ubWsGMnRB344Yfb9nAT/JC7IO/bwHUH/z0c+EDj
x4P7Vp6Q927fuYtDny7QeXXoxa1XZx4d+XLt2ntn/49Ovfv48taz677+/Pl5g+C5m/e+nb595OHn
D++deLPz9deF99tBAraX3IH8sZeggvC556BC+aWXYIH5ocdgfAhSSGCBBBp43IcRIgTeggMyVCKJ
H0LoYXojhphiirQBBtF/KE7I4IsdesjfiDcuJKGEC+Zo4Ik2BtnggxdSB2SFRFZY45BGOmnjkg2d
yKORFr7I5JE3SjmXfwG2RyWXQmLZJI4mgpiil1GqqWWP5YkH5ZFjYqcjji7KGSeUdaoIpIJsXrmj
iGRyGCNlgxa5pHTdlbmloPQ15+aOjCZX6ZnsvZfkk1sqKh2NcJL4HpGhTrlmpUheqemTicKnqaGH
Sv/WKqh6Yrkbh3ASFymCkipaao+0toimq97tN6ypua5J6LDB7qlspr8CWh+Agco3q3F5BulcrLI2
i6ytWSb7Z5kd/njsnf/JZ6WPQgr65rhv2uoupZF6uS68G+KHJ7tdAtsmmttyC1mrta6bJsDTzXvu
pAb3Kua++DoLqYURC+sonQhLam60vsbrMKd2hvuRwI8RTN6+ZLJ68skc4sqkgBGjq+2K/MbJIq+b
2uzkvKQqjPPKgYb87MdFrlwryjCSzJNtuMG8IqPGHmsfneouiyeqbeIqatTJogfg1fs5fbHQOVt9
IdYaYod2g/cJV6izFdD12llsymb3RkovbVfdd/f/7ffcfgdeWt6NCW7434TvdPjisiVuGOOQRy75
5JRXHlQ+mGMuUOaab55PQZ/bw3noB3EOOkGZi0765p6njpDrrKOu+uizd1467a2DbrvoC8Gu+umo
4w587AOtHvzqu/M+evLF77687rAL/7rvvDeve+3GV597850nH3r2eBn/OfKeny6+Qc4Xr3313q/v
/u/luz9+6bLTj776xH+vkO3dn1+/9eojH/GCB8D2ge968TvgAPWHP/QJUHkAtN4DIdjA9LXvfeGz
X+zmF0CGKJCDG1wfCBPiP+0xcHgYfJ//SHdCDYZwgiqU3QPBt0IRpvB/ISSh+XDIQxl2kHUjNKEN
/wf4wxwqhob1G2EQ76dDASrxhkQ0YgsbmMLs1RCI+6PfE3soxPMh8X5PVGAUKfi6HVLxjGYk4/xK
uMUDthEzvhPeCb/HvDEWkX352x4TgcfC1pkOhtzrHh87SD0McrCPXOyjF134Q0U+L5HYKyEe0QhF
EOrvkjh8o/0QKcbwtXCORGQeC12HyEmaMn6QxOIYpZdFNmrOkigs4hS/WEo7IpGTUDRkJU3nRzfq
MIeHxN7/cOlHIZ4yM0GEpS57SMfo5XGZlFRkNCmpxViqUn7VNOIqe2nNbeKyk7fM4h59OT1SVrCK
vDymGrWJTGyS74s8BKU2lxjDTBoThZ28ZhTlGf/PBWJzeLW84RWxmM+BMtKfB31mKel5z4CGUS4t
WST+xJdMB/owiaGsKALhR0V4bnOi07xnBAVJwHjOkouoJKkEPThKO340mu9M40VjOceYljR0qDGE
TSCCOzkikJXHO2nqKMrNcrpweUukYRzriLw66lF+FE3nP136VKIi1ajUfCk1eSlRmZ5xfM4z502v
YoiLAM5yaL0LbXRKk7S69a0bKWtFzgrXurIlRmyViV33yteGyHUidO2r5RxHWJDkFSaCTaxizfq4
xQ62sJCNyUMEUBDKEsSyAsGsADbLWc4OpLOZNQhmM9vZ0m72s6ZN7UFGa9rLtrayoE3taUOLWs//
kla2p53tZ12r29uqtrL2+G1pE2Jb2OZWtqIt7m6X61iOsDa4l93taGmL2uhOF7rAja5Cnsvc0GoW
ttRFyHS5a93uXne8pM1ub68b3vNiN7vdTa98g0ve94pWu/Stb3MVspnvfle698WvgMNLYPYKWL+U
/a92DRxf+AK4vQFeboIX7BD9Qpe9DI6vgldbYQdbNrIg1st7Jwxh9zaYwPYt8ELqi94NP5i4273v
hk0sYfuSuCEWvvGAI1zeGOPYwwIJsZBzMuIiv9i84v3tgDNs4yUbGbhKri2HoYxkB2PXsv6d7I4T
/Frl7vjCK15xbyFsjyGbuSZXrjF10XviFLuZ/80wru2Y/4thNxMXzmv2bZ0pTNsbg3bKKNbxamnc
4zgzBM8fPrOiEQtm7/J2zl9+M4/tfGAN/7nOTObxeC99YjbTWdKAlnSmU4zpMP+40mVetKof5+cm
q/jLhH61oV2dZ1CPGtXMxfKW1dtjPOP6yLOWdYZv7esgr/rYKJnvfBENXmCDus1VVjOwZ8tkZmuY
1FbWtWuVbWBr77nBug03i2dtbWSbWSLWjvajA23cSKvb0dYdrpy9nF9IX5vQrM1ts30b7HrPm9p/
HjSGvTxs5cr71lbBgUE68ZbA7ndx5o54Tx4+ucGoQuKOoXjFMc7xjnv84yCPLEI2ofGS8zXkKP9P
ucpBbPKWu/zlMKfcymdOGybQnOaHM0bMd86Qm/v850APutCHTnTI8vzoSE+60g9T9KY7/elQj7rU
py6SpVv96ljPulyOofWue/3rYJ8r1cdOdpWHfecAOLva3xKNhQAg7WuPe13eLve6y4Xuds+7W+B+
uLL73dxv/ztI9L5XvENO8IhP/KIJz/i7Kv7xkC9s4yePlshb/vKYz7zmN8/5znv+86APvehHT3qU
RKD0qE+96lfPesJS/vVkab3sUQ/72oNl9rjPve53L3jb+54rDk/LaBwy/N975OPGvwo/GrJ8uTSf
6Y97u+GNYni+Z6T4PS+JPfjB/eU/f/sD4X7/+Any/e433/zeN//21Y/+9Yu/IN1f//jVH/741z/9
4xcI/fOv//eDX/8UYX/u53/7d3/p934E2H/+p4Dnl3/Nh3wPYX1JUX1a8X3/B4D9x38XeIHedxAW
+HwfqIEYmIAgiIEemIEjmBAlmIImCBEr2IIWSH7wN38lGIP814EcyBoSKBDSx4N0h3fSx3c9aA9B
yIMDYX1pB3dKCIQ/KIQUKBQh6IAsCIPzd4Iy2II5OIPg14Dlt4FaiIM4aIVeeIADeH8A2IVXmIVf
qIVb+H9haBA1OIYVoQ9j0RI7KIREaIR5iIcEkYRHmId6aIRKWBB+CIiFaIgjQxIPMRr2h34N/+iG
aViGkoiFINiIIgiJXHiFAiiFmYgQL3iGN5iDCyiHJmiDlXh+lviIm1iK8jeDENgQd/iHg7iHf0iE
PciHh6iHhViEs5iERZgUb6iKVBiKpsiGH7iKLNiBaCiCwviGxjiDL3iA4heDUaiGCxGGYEiKBoiC
kVgXdmgQeNiLgEiLgliLuYiIh7iL5bgQ2MeO2leFNMh+kRiHcPiMmmiFmbiMlJiCzpiGIRiN2siM
och8ogiK3fiPruhxECGB4aiL45iOD1mLfXiEECmOuHgUwbiBGUmMYsiK/liPHIiNICmFKGiDGkmS
BWmQ9jiM3diGKjmKwniPl/gl0TeENumQv/9oiz8okbHogz64k4iokxJpbIpIfCVBf12YlPHHfo24
f9XYfvq4lPU3iQXofiG5jfO4gNPogAjoiTAJf5YoiUg5lU65jyw4dBWxgwyhlkHRjvz1joZjkonx
gAopFGypEHfZeHKJF3uZfIpVAH4ZmIKpFLxXmJg3mIjJFIa5mJCXmI6JFIwZmYj3mJRZmZZZFpKZ
mZq5mZzZmZ75maAZmr33E27pFaW5GqK5U5e5mlcXNxrhmmoBm6xJkdMXiJ5RDQUhmxWwmwexm7Dp
mwPhmr4pnLwpEMNJEMdpnMWZnPbAnMBpnMjZnL8pnc85nYL5jbaJEacJfNp3nNYZnOBpncL/CZ7N
SZ4G8Z3jmZvnSZ66KZ3m2Z7QmWqp+RcNuYtMyIcGsZ1bYRJxg57qCZ3T6Z/lOaC9GZ0DKpsEap4A
Gp39GZ8J2p7zCRjhOIhIaI4IoZ9awZ8E+p0OSpzpSZ3imRDw+ZvLuZ4MeqIfCp/QuXlVkDcReJPr
+JO1mRjVqaDKyZsB+p7x6aEGuqPriaAJWp7tOZ4cqqJJJwRAgZ08OY5M6o5FKRbD16Acqp452qE+
qqAj+qMmGp4nKqRYGp0ROhMRSIiyOJEOaRlSyp7/WaUbaqUO2qZveqU9+qFeqpw22qOzyZDmeJ9D
iRfOWZwbqpuA6qE8eqOCOqg4+pyGGpyA/wqiHVqkd/p7waedcBkWUfqabuGaYeoXSVqpt/eOQFoR
oVoWsLmpJJEHREYUGNpwkxEN0WCq3DKbspoVedmkrEEOszp3QwiLbvcWvGiTuLiruaoWSrqQvUoQ
q1oVeiqIDYmssPp4y7qHTSijtHmmyUoV0eqHFJqInakCfreQQFim6Ciu5FirYQGs4dqLMzqsZwE4
2xqUFUmuRDlxYxGv5PiHz/p0E/GuFkmu59gW9nqO5squX+GuSzquMaqO8kmvYmGvtkimjsMN+Ror
ORmR6LirMAp31zoVv9ixFKmTGjuxRWcRA0uwvhdYJQsRG7sWIjuyJvuyMBuzDTGpZhoVK/9rrEbZ
smX3osJKpjy7rjjLFNEqlDJLkysxsCnbpxShljfrEB2Ln2mns5yXl087i7aKhOlKrUQLo027lk2q
llErtWT3s+DYpxDps2QargnLpEmLEQJbtkVbGr54th4Ltn14i0sahP96FMI6tHHLqiPRD5WarRa7
t1BrsfeanfNadT5xtrYptmPrtGbrr0obiM0akZdrq0PhuG37t3VoGD2rtTnJllgLlKJbfbPYtW6H
sfdJd5CbeRfRuQmRsqrrtTn7ulFXFLJLiED7FLvrucAbvMI7vMRbvMYLc0uAGC1xAgXBvCfwvNDr
vNFLEMxLvQYRvdKLvdpbvc37vNTLvQL/Ab7T273QOxDgG772cL7qO77hq73f673v+73dm77rS7/Y
S7/Na7/le73mu73sa7/ya735+hDqm74HIb7Wi775m8AK3MAG3L8QjL8JDL8O/MAKfL4PzL0YjMAV
HMEXrMHVS8HtK8EQjMEkjL71a74WrMIMTMHwK8IrXHebocEdvMIcHMM4zMA2rMMZvMM5rMMhzL8W
vMEtjBAmHMNBTMPOO8QGbMJLrMJEDMVCzMJIjMICjLs9QcM5fMNWPMUHDMRUbL1P3MUKwcFR3MRf
TMVObMRfPMZL7MZozL8IvMZkHMY9LMc7PMAEzMLb68NSfMAw7MA3vMZBXMdGzL5nPMZg/9y+93vE
hNzFTxzJ+lu+hRzHC2zJdlzJYtzAR+w3vKAWcHy9/2vHgHzJk8zDZJzE/QvDZuzFjvy/dOzFfyzJ
qozJamzIF5zJC/zIuTyYoXzJsbwQXKzFNRzKilzBBXzGP0zMW8zGeMzJTIzL0XzMH7y/utzMWtzJ
Z/cav7zIqOzMguzNvQzJplzFyuzIRZzGslzJSnzLwfzGU8zMVYzM4cy8WEyvXHzNpEzPYVzAI/zP
KSzC/gzN+lzOmhzAHxzBvJy/wYy/AW3KA+3CB+2998y4Nuy+55wQ9yvOgizQ87vKGzzKo7zMcuy+
IE2+30zNTYzR82vS/NzR4uvR8lvRIf9xvLe7qTY9mzSb0wtL00pzAEAd1Afg05LJ06tJ1EgtK0a9
1Ewddkn91FAd1RzX1JQp1VYtI1TtmFe91Vzd1V791XuBBLSR1WRd1mZ91o0D1mq91myN1YjxDGhN
GlC9Cm2dqnF913id13q9GHXdccfQ14C9eqYBCXstN4EdoS4wMIUNe4fd2DW92JAd2Ybj2I4t2ZZ9
2Zid2cdH2Yet2Z792ZbB2VL71yIG2nEn2oFt2qq92nGx038rZHzwrQ+hDbStDfZQ27Z92wSR27i9
27Q9ELht27ktEMEN3MN927WN3Mmt3Mfd28pt3MuN3MA93cnd3NBt3dTd28O93cQd3b7/vd3OLd3d
/dsHEd3W3dy/fd7azZrHrdvELd663d7T7d7tjd0FQd7uPd/6fd/U/d757dvzzd3wzdsIgd/Czd/+
Hd8LQeD/bdz6Ld8CbuANztvcXd/sjeAKTuDy7d8Mvt8QzuEYnuAYfuD0bRAMTuIgruEJQeIo3t8s
vuAgjuAd/t8W/uIWruA4vt+WudzOreLP/d3XLeLh3eE8bt74Pd4UDt4STt83ruJJvtvvLdzmneHQ
XeAGPuUl7uH87eQyHuXMLeIXXuEODuX9Deb2HeRbvuJkTuVg/uU5nuXSfebg3eBU/uEmnt8QzuNr
PuF43uJwnt4hHuZlbuZkPuM0HuI1/67mD57lN+7leC7kCS7ndH7gfg7njI7ojz7ikN7kUL7hq9nj
ep7dR/7oxa3d6y3qSZ7e3u3mFX7qjh7fgP7g3q3eWN7nSx7pzN3iUj7qVb7p1R3rUe7qXhEEMtdY
R+fpn4q7rL3szN7sZY3agO3sXmfVOADt1m7t0t51197W2a512/7t4B7u4g50tDDu5n7u6J5s3b7u
7L4a2dDurZHuVw3v9F7vnyHv+J7vm+oGrccA+s6p9s7uwBDwQ+HaTvHvoXcQv3saCD+Z4Fq5eAmO
twijuhi6BA+4KuGTinusk8us8sqtDb958Mq6VuuLNWu55Xq1ixvyY4ezJY+5H7+1Gf9riE948Rif
EiCL8pe7t2vrhGi78ix/eRW68zCPEA77tXoY9FM7kaOLump7uk8vrU+o9Dtr8zBn8E1B9ZFr9Vzf
9TcteKSt9S667htgdWKv7F6fWGqQ9mzf9jN79nAf93I/93Qv7m5PcVh/94tIdXBr9Imru3HhtxAv
EVS7cVOX84XP82e6lr278Sfv+LzbuQvf9zE6+Jrr97Nruz9PFwM7doLP9Je/+Jqf+RG/tL67+Zaf
soUvOZ4f+T5Pi03vk0xY+TTv9BU5rdqq8T27hE6v8ET7sXf79HPLrzuJnw9rn7S5hMkf/A8r9RRK
8gzJp0LZusDvsdlJ/ae7/MO//C3/T/FDf6/qKI7SCrdET/TNH/6+X/R+f5cV2vNlmovvuqdpK66O
C6/gf//G3/4pf/+U+/fxDxAA7Am0N7BgQYEEDSY8yBChvX8RJU6kWNHiRYwZNW7k2DHjwYUNEQJg
6HAhSYcEUZoEqVKkQpMuDc48SfIhyJkwaeK8qbChTZEPdQ4NGZRlzpY2h6Kk6VNmyZdNpQa9WdSl
zoFKje7MqlWoUa8hiT70WNbsWbQeea7lGRMp1K9bd/qUW9Tu2LEtccq0W3VqT71x74oNfJTv1ahU
nQJ225jq3MSI47rtC1lwSqmO/bLl3NnzZ9ChRY9OChQr05JMRz5dzbXr1JWrE5qG/60UaOvTtF/e
bv3zduzYVsPSFfy6q0rTqgET/pqbt3HVrIO/xuqaOtjkyLU6J07a+3fw4cWPJ1/e/PnH5rujZ7/Z
+/rO8D/Ll5++vXls+fPf59/f/3/w6nsPQPSUC0/Avb4zsDTPFiTwQQgjlHBCCiu08EIMM9RwQw47
9PBDEEPEUC3QEBRxPg5NVI8tFd2D8LkCIUprRhprtPHGiehzMUa9+OKvRR/PA7JE99Zr0bry6kPw
SL1wdPJJKEkkL8gHmQxwNCtFGxJFFrvE8scG/8vyxAw9mu05234jTk3tHEMtq5yyg0+3M5+iDbmR
4myzrT1lKw2m5PI8Lk88uQpOt/84e5ITN0D9hJNB46i7Srk7BRUoSkwzzVTLv5CabC2W8oLLqszs
8xTRUWdLULLB2irVL1FPfXWxxT4llbnBpLvM0MTkSvUtuo4ic1jSKFuupmDDevVWzGLlM9BS87ou
1/Te3FWxWa1lVtmlKh1UM2a/7bUqwxjLTNtpiVX3y+o8rcxcbGNttlcfkyWXWnjBrVXfwPCtlVRW
l7V1V7yKk1ZgWcGFDcl1QTSz01YXjG5Rca1NCdXNLB5UT1i9ja7a4RwVmVLcttLO0InbtZhi1tIN
8uPCmsNuLq00tfnmGkUcM8zQdo7QZwyBbnhoogkUeryjAUyawqWLdvppqKOWemr/qkfsqGqss9ba
M5y7vnnrELNs2sKxGSYbbAqnYXrHBBuE0VRQG53SbNmE7VDFpankjNLpphtwb7TZk5LHFXc0Uc0k
v2RbQ7x5PPyxf8XTUUavK4dSy49P3vjR1BKNFNm26eU8YKg07zvlySbfHEbUJR25T5XhYrNQiSn+
afVgQ293L9tuZ07utwMH72GhDpuV80/X7DT3gk9aFVd+iYpc98j6Pb7Va8t9VPSA71XZe1ipZ7vl
4rOfyXL003c2V20nRfTajLNVdrnouefYy3N5+xeziEOurN6QHYp638vf9KozJ/oNZ3bnS18DacQp
+CnsNK6hVbXqwr8iwQtf1OKf//LA56p4aXBeGjwWq4S1v+V9EISWMVy+FsZC4b0IZr05Xag4ZiBj
+eZPijph22YIO4+971485J3pGMM3Y3UnVCxLUxGHKLrP9QZk+ktgEmkYw59BEIv4OxGTyrZFMJ6H
eEQKow6JdaQvlvEgDmQjWtT4RjjGUY5zpGMd7eifwfnOekpjnOKExMf48KeNgyRkIfPIK7qFz1VK
KqLdxrakxcENVImUHM98UydF+s2Qm+QkJ1d4rEBKkpEW/GTheAbJngEScKR0XnFA0klYxvJJnKHE
s6SYJrlBbmOq2p7f7DU6S1GxeAtEnlMwKajbXeySoBOZy1yHu3oN8C13vONFKP9RkYMZL5r201XG
hNhBCtovebm7nqKeJzP4QaZl9YOUAIVDF1nGU55u5EktV6i9bkXOTX7aHb284s4QEgxdJdycu5zJ
r36Bc4N2Wyg5qWlHe94TkQcLn/QUiSRwUgmF8tqjuxw5xH2m04XTJFiXpEXOND5UXRGNm0ZrkyyM
2alPI7uipGBKmUPNL3tootmecIrD3/gKmh1jWY9IptIwTuSaGEFqw1TnoXlGVaocWSpTm0omB3WU
Q1Plalf/URCWXlWsYyXrWrx6VrSmVa1rZWtb3fpWuMbVZmWl67rwUNcLyVWve+VrX9mIV8AGVrCD
JWxhDXtYxCa2P36FJTAY+1j/yG5SsZOlbGUte1nMZlazm+VsZz37WdB6dhejJW1pTUvaOkZWtatl
bWtd+1rYxla2s6VtbW17o9DmVre75W1vfftb4AZXuMMlbnGNe1zkgmQex71tc5373EImV7o4gW5a
pntdylW3LNidIziIpd2z2AMc4/Uueb0rXpCc17zpHW9B1ouT94r3vPItb3rpi96DzDe+8s2vftvr
Xv/St73zRa9565tf/gIYv+wd8HoNzBPyIljCAC7vft/74AdTuL/+jfCGBXxgC8e3wx6GL4Q53OAI
exe8ERENgRdcYQS72L4LhvBa/uteBeMYvzdWL1t43GMd/5jGCX7xhAscYBcn/9nGSw6yfktsZB0X
+Mkz3nGQOUNgJ8uYykWOspLh6+Uha7mwYK5vj8VcZSY/2clSRjOIh2zfModZynGGc5eNHGc6RxnK
euYzncH85ixPuc9tvvKW30xlJf/Zy1iG8pkfqpYOXxjH6r3xhEfcZCCv2cxWnrOGY9zpOuM50pO2
dKhBjWkBG1rOm96yjC8caQeXeMT71bOrK13qOrdazYge9Yq/6p0Ds5nIgxY0o1PN6QQDmb/G5nSw
SV1lMq+Zxm4W9rQP7WpZ97fYNX52o7MtbW7zWdXgrra1GczsP1M22M5ON7YRbW5lE1rC4M60nQmt
aFw/O96l1nK/521oZvNb0P/2rrePVb1ndOe71u8WN1098ur/MprWKb70htl9X4kPmNeVjja5K5xi
hlN4384W+Yf37Glzo9zWEY+1iaX9cY7z+Mu37vOtK57qhIu8vr7mbs9jeAM8Xs3nzPW10IfeoaIn
ncVHR7rSZct0qJeVRD+mer8pHvEZh3jWNH+5zGPMdZuf+Mskdvmdz33xDNP6vuc2OdmrzMZzOL2r
Oeayx6cM426nmcu5rnuuF81ehXvd3Tsm997LfeaX613NPZY7zwue94AX2c2Otrvfs/1pOfcd3s0e
uJ/DLfGBe1vMiP9341csb8jPvOTQRnnIxW33jK886wtvM9cvT3LDw9ztqzb/uIlnb3rwHhv0Jxf2
utNteECL3tSXX72xJT34btt+4aRXvuIZrmLgV3f4aD509FP+etebHdls/ru1NW35u9Pe9bj3tr1D
r/Dst7bFcN462FmO9a/TPMz63z+WR61+tJs1vpM99bszWLs6q0syAVQ9DXO0qHtACIxACZxAdTkk
rIk/DIy/wMlADmy8DexAECy6xKO7DMO5VkOxsKO6sVO57ApBF1yt+XM/mwM4GkS4zwM8zqNAHfwM
PPs3hSvA7yM2Hyw4B9xBHezB8Ss8A8O3ssu8TPM6I4Q6SDs1C7PB9ms4zJu3UXOyF+xCGJw/zwu8
bdO1QtM8fYvCCJw6Maw5/40zQCW8tAX0PuzzQjqkrQ+sQzyErTvMQz7sQz/8Q0DMvlQIREIsREM8
RERMREVcREZsREd8REjUCDScREosparxBM2yhEq8kODZRN/SLgCIRFHEkbFKKU8UrBUjiVFcRXo6
RVd8RViMRVmcRVqsRaJhRVzMRV3cRciyRV/0uR34Rc/iRWIsRmM8RmRMRmVcRmZsRmd8RmiMRmns
iB+oRmv8gWlsLR/Qq625RmsURnAMR3F8pWwsR74aR3RMR3WkGnNsR7laR3iMR3mcR3qsR3u8R3zM
R32sLHfsR7faR59rhO/yR4JMK4A8SIRkOncYloJsSK9KSIiMSIB0SIqUKoeJvEiMnMeK3Mh4ysh8
5EiQDMm++gWRjKoQKEmUTEmVdCtIwMNlWMl39Mh7hEma/BqZvEmcrMWa3ElMyUl65Mk8nIPb8kmN
BEqjtBGiTEqlXEqm/K2jfMoZaUqpdMUhmEqrvEqs1Cyo3Equ7MooyUph9Eqx1MVpGEuzPEu0TMt/
BEu2bMvdCggAOw==

------=_NextPart_000_000D_01C6FCCB.3FB58860--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9V0Z74H073461; Mon, 30 Oct 2006 17:35:07 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9V0Z7gA073460; Mon, 30 Oct 2006 17:35:07 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from relay.imagine.ie (dns2.dns.imagine.ie [87.232.1.41]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9V0Z2nY073430 for ; Mon, 30 Oct 2006 17:35:06 -0700 (MST) (envelope-from [email-masked])
Received: from mail2.int.imagine.ie (mail2 [87.232.1.153]) by relay.imagine.ie (Postfix) with ESMTP id 7072823A63A; Tue, 31 Oct 2006 00:35:01 +0000 (GMT)
Received: from [127.0.0.1] (dsl-102-234.cust.imagine.ie [87.232.102.234]) by mail2.int.imagine.ie (8.13.4/8.13.4/Debian-3) with ESMTP id k9V0YubH004866 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 31 Oct 2006 00:34:58 GMT
Message-ID: <[email-masked]>
Date: Tue, 31 Oct 2006 00:35:41 +0000
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Anders Rundgren
CC: "David A. Cooper" , pkix
Subject: Re: draft-ietf-pkix-rfc3280bis-05.txt
References: <[email-masked]> <004601c6fb42$ae379790$82c5a8c0@arport2v>
In-Reply-To: <004601c6fb42$ae379790$82c5a8c0@arport2v>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Bayes-Prob: 0.0001 (Score 0)
X-Spam-Score: 0.00 () [Hold at 8.00]
X-Canit-Stats-ID: 3000435 - b471129e36f6 (trained as not-spam)
X-CanItPRO-Stream: outgoing
X-Scanned-By: CanIt (www . roaringpenguin . com) on 87.232.1.53
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Anders Rundgren wrote:
> I still have some minor objections to some of the finer details.

Personally, I'd be all for ignoring the n-th round of minor objections
to finer details that arrive without suggested text.

S.

Received: from apc251.internetdsl.tpnet.pl (apc251.internetdsl.tpnet.pl [83.17.136.251]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9UIwiC1005114 for ; Mon, 30 Oct 2006 11:58:52 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000a01c6fc55$7786a3d0$fb881153@oki>
From: "Details Usually"
To: [email-masked]
Subject: free Artist Name
Date: Mon, 30 Oct 2006 19:58:50 +0100
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01C6FC5D.D6E7C770"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0006_01C6FC5D.D6E7C770
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0007_01C6FC5D.D6E7C770"

------=_NextPart_001_0007_01C6FC5D.D6E7C770
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Kidsmud Mushplay of Emailtools Culture Buyers Tools or Compare Prices =
job Yellow Pages is Forumsmost of up now Internet Coursesgt Gamesfree =
game!
Dont Mean is may be Deep at Sundown is Calling Crying is ill get as Long =
Glad or rag Cream tracks disc others find am Make suggestion Manage =
interested Links What latest gossip is favorite celebrity Moviefone.
View Relations Press of Careers Associates Advantage a Honor Useprivacy =
Noticecopy or inc is affiliates Games in Gamesgt in Rpgs Using of Chatpc =
of vs Gamesweb Gamesdemos in Betaaction Kidsmud a Mushplay Emailtools in =
Culture Buyers Tools Compare Prices in job in Yellow Pages in Forumsmost =
up a now Internet Coursesgt Gamesfree game does not cost lot money come =
forms in played through of browser window require client or downloaded =
Mmorpgs Poker.
Now Products Tagged is tags tag Whats tags add first in Rate improve =
Average a an online review thoughts other customers people found =
following helpful where ya been December Suzy West or Covina ca classic =
or typical showgirl in appealing somewhat torchy sound shes kind am =
female Bing Crosby especially ive got martini hand glass pink champaigne =
bottle fine or wine inoh wait only of two! Punishes or bitter is there =
minority Rabbinical instance Rabbi Simeon ben Laqish am says never.
Punished is answering job of prophet Bible Testament Jewish Islam =
References Ayyub Quran Mormonism External linksedit Biblejob bearing am =
name is upright virtuous religious or wealthy am slaves cattle principal =
princes Arabia Edom said lived land uz seven of sons daughters greatest =
East his took turns feasts completed cycle feast a sent.
Videos in basic dealing groups ranks or shockwave flash browser =
selecting homepage Last Manualltlt lt am Previous in end Biblical am =
figure am Wikipedia continued a donations in running figurefrom to of =
navigation Blakes is imagining Satan inflicting boils Jobjob Hebrew. =
Ever Freeclick Forumlast Thursday June brand portal abuse reports =
ticketing allow greater.
Cart Lists Help new or deals await you in am Gold a box of advanced of =
search browse styles of classical top sellers future releases music =
should hear blowout free Artist Name Album of Title am Song Musicfree?
Marinas schooner tall or lyrics harbor ecc Adobe Solutions Searchyou =
everything of youneed certain sections a Adobecom shockwave Player =
Version am button meansyou accepted Enduser! Pits a humanity armed =
science technology against beast horde masters nature magic charge =
promote or sequel Savage Tortured?
Someones Wish List Idea Registry Join Amazon Prime is ship Twoday =
Overnight Already member or Sign in Quantity turn on Click ordering in =
More Buying Choices am used or from Have of. Wind brought down house =
eating a collapsing all servant delivering escaped job responded tearing =
is clothes of shaving head began of worship or saying of.
Batra goes is lengths ascertain actually citing many of leading sages =
follows jobs of fate Pesachim bwhen prosperous anyone associated ajobs =
reward.
Order teach or truths meant literally true senseedit Islamin or known =
Ayyb Arabic Islamin folk tradition in Aljoura?
Everyone Bruces voyage boating cruising Files Boat Logic st am enjoyed =
over am.
Except instead pockets tables cushions score points Features rankings =
World of Toursan golf simulator sponsored Chrysler realistic courses is =
compete players? Truck of Photoswhat gas a Guzzler Taxwhats Topics Email =
Article News Events Work.
------=_NextPart_001_0007_01C6FC5D.D6E7C770
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Kidsmud Mushplay of Emailtools Culture =
Buyers Tools=20
or Compare Prices job Yellow Pages is Forumsmost of up now Internet =
Coursesgt=20
Gamesfree game!
Dont Mean is may be Deep at Sundown is Calling Crying =
is ill=20
get as Long Glad or rag Cream tracks disc others find am Make suggestion =
Manage=20
interested Links What latest gossip is favorite celebrity =
Moviefone.
View=20
Relations Press of Careers Associates Advantage a Honor Useprivacy =
Noticecopy or=20
inc is affiliates Games in Gamesgt in Rpgs Using of Chatpc of vs =
Gamesweb=20
Gamesdemos in Betaaction Kidsmud a Mushplay Emailtools in Culture Buyers =
Tools=20
Compare Prices in job in Yellow Pages in Forumsmost up a now Internet =
Coursesgt=20
Gamesfree game does not cost lot money come forms in played through of =
browser=20
window require client or downloaded Mmorpgs Poker.
Now Products =
Tagged is=20
tags tag Whats tags add first in Rate improve Average a an online review =

thoughts other customers people found following helpful where ya been =
December=20
Suzy West or Covina ca classic or typical showgirl in appealing somewhat =
torchy=20
sound shes kind am female Bing Crosby especially ive got martini hand =
glass pink=20
champaigne bottle fine or wine inoh wait only of two! Punishes or bitter =
is=20
there minority Rabbinical instance Rabbi Simeon ben Laqish am says=20
never.
Punished is answering job of prophet Bible Testament Jewish =
Islam=20
References Ayyub Quran Mormonism External linksedit Biblejob bearing am =
name is=20
upright virtuous religious or wealthy am slaves cattle principal princes =
Arabia=20
Edom said lived land uz seven of sons daughters greatest East his took =
turns=20
feasts completed cycle feast a sent.
Videos in basic dealing groups =
ranks or=20
shockwave flash browser selecting homepage Last Manualltlt lt am =
Previous in end=20
Biblical am figure am Wikipedia continued a donations in running =
figurefrom to=20
of navigation Blakes is imagining Satan inflicting boils Jobjob Hebrew. =
Ever=20
Freeclick Forumlast Thursday June brand portal abuse reports ticketing =
allow=20
greater.
Cart Lists Help new or deals await you in am Gold a box of =
advanced=20
of search browse styles of classical top sellers future releases music =
should=20
hear blowout free Artist Name Album of Title am Song =
Musicfree?
Marinas=20
schooner tall or lyrics harbor ecc Adobe Solutions Searchyou everything =
of=20
youneed certain sections a Adobecom shockwave Player Version am button =
meansyou=20
accepted Enduser! Pits a humanity armed science technology against beast =
horde=20
masters nature magic charge promote or sequel Savage =
Tortured?
Someones Wish=20
List Idea Registry Join Amazon Prime is ship Twoday Overnight Already =
member or=20
Sign in Quantity turn on Click ordering in More Buying Choices am used =
or from=20
Have of. Wind brought down house eating a collapsing all servant =
delivering=20
escaped job responded tearing is clothes of shaving head began of =
worship or=20
saying of.
Batra goes is lengths ascertain actually citing many of =
leading=20
sages follows jobs of fate Pesachim bwhen prosperous anyone associated =
ajobs=20
reward.
Order teach or truths meant literally true senseedit Islamin =
or known=20
Ayyb Arabic Islamin folk tradition in Aljoura?
Everyone Bruces voyage =
boating=20
cruising Files Boat Logic st am enjoyed over am.
Except instead =
pockets=20
tables cushions score points Features rankings World of Toursan golf =
simulator=20
sponsored Chrysler realistic courses is compete players? Truck of =
Photoswhat gas=20
a Guzzler Taxwhats Topics Email Article News Events=20
Work.

------=_NextPart_001_0007_01C6FC5D.D6E7C770--

------=_NextPart_000_0006_01C6FC5D.D6E7C770
Content-Type: image/gif;
name="Release.gif"
Content-Transfer-Encoding: base64
Content-ID: <000501c6fc55$75235f70$fb881153@oki>

R0lGODlh8AGIAYf2AA0LAIsKAAOMCIN6DQAEiYULeACIicrMuMLRuKvX6DIuAGkrBnUoAJQXCLob
DOghCQBNCxw4DkdHDGU6BIg8AJg8Dss3Dt08AABrABRnDEdlAGlWB3VZAJRoAMxlDOdkAAZ4ARaB
BTqCCGiJAICKAJONA7GIAOuAAAmsASKTBTySAGmfAHeuAKqkAMekBNGdCQC7ABPKAEvKAl6/AImy
AKC/AMS7Bee0AATcCyfWAEndB1rqCXvpAKrkBsvmANfoAAAFOx8FPjUAQWUOTHELP54AM8sMR+EF
MwAiRhcfNUIXRGMVTXggQZETTsQlQuwqOgFAQyo/PDFJQWJINI02TKdFM7JLQ99AMwxSPCRUR0ta
O2RbR3JiAKhXM8VrTdlXSACBOC54SD+HRFp/RIF5NqJ6TMp8ONyMMwmXSxaiTESVSmecQoatSaGr
MrGkPu6pOAXLMhezM0q1RWnERoDOSqPNR7zESuCyPQDYTSfWSkHYNl7ZOYbtPqzSQrTdN9HUTAgH
fysGcUgFimYAdYcAhZ8OibkAgNkAgwAsdhwnjjggclsZgIAShpIfjs0Xi94ThAQ8jiA0fTtNdW5D
ho09haxJesQ+h9VAggBbcR9uhjdceWlncnhkhKxUhrJqfdlcfQOHihiOizKKdGyBgnd0cph8dLZ/
jduCjQCqihWZdk2ZfW6ddHSseKWlf8KafdmZhAy+eRG+i0vMeGm5eoK0gKLFgrnLduqxfADmdCPT
dzLrelvchHLke5HdjL7Ti+bpegAAxBEAuT8CxG0IwYAAs5UAwbMLvu4HywEUtxkhsTUdxWcTxHos
x5scu7gbwtgpwQQyuys9uzM+wVY7sYNEvKVCyr1Av9wytQdoyhtRszNTxVVfv41UupdXxbxeyuZu
xgB9yxKKvESIymyJsnNzvqKIvbN2uOmBygCrxiqlyjGVvFuSt32kzaGluLeTy+ytygXEtBPIyUzD
x2vBx3q2s563zP//76mcsnaMjPYABgD/AP//DAAD//AA/w3///z6/yH5BABWyW0ALAAAAADwAYgB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+P9oIKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9efYMOK
HUu2rNmzaNOqXct2ote3cOPKnUu3rt27ePPq3cu3r9+/gAMLHky4sOHDiBMrXsy4cdvHkCNLnuy2
seXLmDNr3sy5s+fPoEOLfku5tOnTqM+OXs26tevXWFPLnk27tkvYuHPr3j3atu/fwIMLH068uPGI
vJMrX868ufPn0KNLn069unXWD+192K79A9Ht4L0H/w1PXnx37+LLmz9vvvx37uvfp+d+fmh89fbh
1x9PXyh4/uS9J59//wFo4H7iHacgcOP5V1R63zXooHYESgihhBiu116FSGloX4QfUijiiPTdZ9SG
IsY34oQrooghiUEtKGNtGZq4Yoonhsjiixbq6GGHOrZ4I4822ghikAKGqOKFL6I445OpZSiklD3u
+OCRE/44JJAsmqjijV+CmSOWEf64ZJM7JgjlmmRBhaKLcBbI4ZVIphhekktByCSMZIaJH511Zino
kXqied2h1sFJJZ9f9mflmTieGKaSkS766FFG1jnpmzwyWumWiIbKnIsUeqgll5eCSCqZVxaan5yp
Av/a6ZCbfrinlK5aKequn2XH55ylBnqqmKqmGaitDQ6bKbHLdlprfs46mKuEbFYblpu6LuvlqpBa
2t6qYxLZJ6DchqtrtsYGOSmv7PL2H6zEAnhnqY7u9+q3GqJnb73pHrgvv3IGXC+s8PrbZMHDgtru
woz5Otq6iForMVurQRzxxBirxrBrGXfs8ccghyzyyCSXbPLJKKes8sost+zyyzDHLPPMNJ+08c04
51xXzTz3PJbOQAct9NBEF2300UgnrfTSTDft9NNQR72bz1RXbfXVWGet9dZcd+311xVJLfbYuoFt
9tmVka322my37fbaaMct99x0173Q23jnnZjdfPf/7fffgAcu+Mh6F244YIMn7vPhjDd+l8OtGeSU
5GNTnjOUjmeu+VcOwWb5Up9HHfrGmD8FwOn2ALAX6kGdrnpgAsQugD2yB1W7ULMPdbvtsesue+60
/z678L0TP7zwwe+Oe/HA1068770vf7z01AOP1Oupu24U66Zr37rr3mevOvbfow4+9tx7D/5Q55fv
PvlGow//XeTPz1fztutOlPX5718U/v2jnQAHOLz+5Q6AANRfAAfIQALizn8LTGD0rieU+lXwgqZj
X+s2mDoOZk+DHEQfBkM4Qg++ToQl3NVD4Ge/uqTvKqNDikH410DrFVCBOHxgAGm4QB360Ic0bJ4E
//3Hwx0i0H+fO2FRlOhBpszPgimEIgg7+D0MtpCKVGQiBkfWQvWNL4Tjk18VT2g+7nVQi6wznwlF
GMOjSI5/NtQfHP9Hxx32kIdzZGACgejAO/aQjwf8oz0sh0INqg+LafxiE5soRaJo0YQXRONRUKhI
Rw7ySU6xHyXDmEUlMlGNiLTkGUn4QTU+kisTfJ4O4whB6KVSeQ38YfKEOEEcBnKPegziKvvYlEJa
sYJf/GQjGTnF68kvfJ5k3xOR2cV2rXB7v8wiJMVHylNK85jVFB/52miUzwXyh7/L4R9Z+U1Z+lGP
gjwiLvPIRwGWcyiETKE0Sbg+LC7SnsOkID7puf9EURoSmly0JCWzucFPQvKJwCRoMovCTYYWRIGs
rKE5dblLo+CxlRVtpRBlyU478s6P8bynJEdZTHsSM4qTPKkY/SnSlhJuoAqtIkkNWtB+RpOmitzm
Q5syw4yis535iyM5bWlRjN4wlj/1qAE5Cs52hvSkoZxpS1E6RRZGk5RYtao/rVq6TJrRi5w05THX
90JHllWb2ivjB+9ZlXAmj3fHOyDzwvk8VaryrdCTnvNeWb1UwnV3bu3rHmGZUmB+NYxhJeMyzUhN
ZVqwnudTrBWR2Vj3NfaK14HcVDCrT7k0lCifVVoS2/W6rs6Fs9DcHGJQGx3Wii18S2GsamdL29r/
2va2uM3t0zRbldAuhnL5IJri2tTLerIUOvlIrlCSG1yjKDcozF2uPZj73OlWN7rNXS51sxtd615X
udztrnehC97wBne7z21udnUbuc75Eiq+VYxBzjvd+kK3KOtdr333y13pkhe/Q+kvf+/73/0O2L8G
Vi+BFUzg4U4mqlKJ794KQl8CG/jC1T3wgfWrXwwvmCgcvrB986tdBFvYws11sFgyWFDEWvassBGv
gO+b4REHGMEMTkqINSxiEed4wD/2sInZyxzjpvGabMVNek285Bvnl7r+ffKOoxzgIJ/4wzimMYi3
PGQiKwehNTWsa0dD3xnzuL4kprKQb8zmDleY/8ttZrONp3ziDnvZM9kBM0nZKmHEABfNTB7ymxOM
5S7v2M0eRjShUUxnQqv4Wpm0qVStGWNAm/nSdY5zpuG8YTXzGNOb7rKc7wyaFR7Wxelj4047IzkZ
X5e86s1wrKE8Xli7ebvaPa94a51rDrv60rL276PBojQ7R8XYukE2qTXDW6r0+TDPXoqyX5PdYT9G
K9EuTLZFZW2fLPvbh2s2XLb9uFVnpdt/KzdBfmvu2KCba92TbVLkrczV8OPe/LAHvu8tFH4HBd//
Bji4dfvMJHf24OS2i0Hy/e+GO1zfQ2E4wyH+bnj3kiqoHTNjJt7vjgfc4xwfuMglTc32GTTVMP/9
TMgnznKIu/zlI8etr85KxlKutZKPTPjOdupvfe8b5DD3d8W3JhWazhPnUdX4ZSQecYfnO+Qwj3nM
RQhTpKfc3g93OcuhDnWpa67goax62K96yXXLtyAtD3rWmd7woWvNq4zFplqZKVmlH+bnPse7wLW+
d6/73eB/D7zQ7C74wpetc2YlTbsNo3OHuv1qho980cTt58Xz5fF9GxrhJS942NYb7sa9DGzrR2/O
ez3jLKb0xfUSTJlC2PSBLz3gD77Z1Zm0kJuHPXs1mdO6y5aFNUcsJy9Lv7iPMPe6zxvktArKkbJU
mEiep1Aar5SvHr/smFdxSTdp9OMe8prfn77/5beCdEhm325FL3kkD1pYgt78uHgp/+uTf1uH6Tmn
609tTG8K2vFjpfXT1EHnVzdwN0lkRVnbc2qQlUgJZVKnhXKGRX/sRXmRVhXv1U3+lxVjNoB040JX
cYESGIKaIXvxJoImGBcUeILuxoEyoYIu+IIw6IIBMIP2MIMBUIM2SIM5eINBYYM9SINCkYM4uIND
CIRB6IM/eIQ8OIQ1SBRE+IM86INIiIRFuIQ7aIU6qIRYuIRQyIRDIYVEaIRgKIRO6IRX6IVFeIRK
GIOLYYVB+IZN2INwKIdzeINRSIduSId6yIV5iINF0Yd8OIdxWIeEOIhAGIhJ+IVYaIaFiIiD//iI
kHiHcdiHhviFbNiGhWiJejiJZWgUXFiJkDiJefiJnwiKj4iIpQiInfiGqSiHbviKrCiIiWiKexiK
kbiJeEiJl6hwnaOKphiIpWiLpAiHrdiEkhiMq0iJwOiJjYiLzniHsOiKsYiH06iL0biK1NiJdkiH
LLhixqiIYkiF0uiJwwiOusiJ33iKRgiFYqiJ42iG60iGwViM0FiL6biFo0iLoFiMxPiH1MiD3Qhp
29iP2eiOR+GIBUmP41iOBimJuIiMDomO8+iPnOiQ9biP/WiNWkiRBKmJFxmQMQEVA/mMJJkUCImO
oWiREZmSHmmQtoiSt2iJCnmPGWmP7tiOLf8pi+U4k364i4rBkOkYk8nokr5ok7TIjzAJlDcpiCOp
jJlYlE7piFJJlEOZiS/pk4LBh2EYjl0Ij1q5hWqYhl2pjuvIjvEojmi4hmZJhWhJhl4YhTp4iF14
hmy5lmrJluGIj2p5lVjZl375l4A5cikYmDIEki9BmIiZmIqJNIbZmI75mJAZmZI5mZRZmZZ5mZiZ
mZq5mW+3mJ75maAZmqI5mqRZmqZ5mpPDmaq5mqwJMqj5mrAZm7I5m87RmrZ5m7iZm7q5m7zZm775
mxlIm8I5nMRZnMZ5nMiZnMq5nMy5GYPZnL2VmdA5btI5nZyDmfZAANpJANm5ndwZFNopFNv/CZ7j
KZ7eaZ7nWZ7keZ7iWRTp6Z3fyZ7rGZ7z+Z3dKZ/ZSRTlOZ78aZ/qyZ/66Z/hCZ/c2Z8FOqDqORTw
iZ4Jap/16aAK+p8CeqAO2p/oeZ/7GSOZ6Z/g2Z4d6qEcqqAemp8fCqEkeqIoeqLx2Z4hOqIt+qIi
qp8jqqIxqqImWqEu+qE02qIyqqM8eqM1OqM/OqM+WqMh+p2aCaQ+eqRIAaM9GqQsCqUpaqI5WqQ6
KqIQuqJGyqRSSp80+qQcSqVgSqQdmqVPmqIk6qU8uqRVGqOaOaU5qqVoaqVpSqZymp9mGqNr2qZO
iqNmqqR4WqJLUaBW2qdkOqaCGqVQiqM9/0qoX2qkdZqoJAqSUKGm8rmiFXqjDfqf7tmgV9qdDBqh
nSqhXoqheiqq7gmikbqejWqjpUqojkqeTbqpr3qlefqpkRqrgIqpoYqrgXmnWhqrRAqsdKqqvdqq
aHqruXqqxxqoiOqoyiqoXFqmziqlkrqqpjqsXSqtdqqq0yqmyQc5xGqjqcqsuAqoQlqu4Kqswbqt
VXqrAvqpu7qnoFqvZ2quyQqpQaqk8XquLrqnSBqQTjGt2Cqn8Jqufoql5gqsa8qoTkqtfKqvxYqu
Q0qn9PqoCdum+aqxQ1qxKAquWMmeBMqqJZqg98mg75myBsqqIrug+Imh9EmqLhuzCBqfNf97srZq
sjibpgvKp/uZqRM6szZLoTo7nxdasim7s0ObodapOSDbtLD5tFC7ggwxtVsBnFibtVq7tVzbtSFp
tcXptWI7tmQrEmAbtmWbtmq7tshxtm77tnAbt7rHtnQ7EHIrm3Wbt3q7tncbm3v7t4AbuII7uIRb
uIZ7uIibuIq7uIwrHH0Lm40buZI7uZRbuZZbHI/7ms9JGJdbM5nbnBzXc1Xxc/u2df3mb3j3uUS2
clHBuk7ncWr3cl2num7jK0/XdFDhurgru2k3u53rNQ0Xuj53uhL3dMaruw/XcmwXdfn2u13zuh8H
cb0LvUTRc6ULdKEbcs5rcamrvECndUj/sbzgK71FwXHbS3TCK7vqO76zO77UK7pZd74w8xTp673Q
K77rW7+4m3a0qzcPIXAAbL2iS7rZi7rXm3cgt3fNK79YkxkM7DL9S5qbOxgP3DIRfMEYnMEaPHnu
pVYGqE1c4XmfBxWsJcJOpIGkJ1LI14BL5FrNxBsa58JXFDIVqHr81Fljxlk6bIF/oVXt98PzRntS
A4Jk48OpVUn6l8PVt8QY18PwV1IkF8RAPMTydDR5Zkg1R0+p9j4MaHOTdXMHOEZz18Vr9cWJxHuu
l8YgPMZUJ1ln5GJc/MYRWMajl1ilZMceHHpgJcZ3vMV33Mefl8dpNVZjXD5i5MEvBsYa//oxJJxQ
ULRQ+Jd0YLRVAIh/UnRkC0XJUgVNV8R80Xdy+3d8jxVmkezIkdx8YyR90ddJXvxIwYdVR1fJ/xTL
m2zGmlzKY4NTRzZp4adY1jRQkCxTuAfCZTxNSHzEwOfJwbzKN1xVEehJabVIOLV/WVxCYnd0iczM
xAx9L3bNvwfLkhx6QVNwoIzNmWzM8AfMpHxVVBfF6izF+3R76zzNPvzN2XTOpzTN2KzNUKXPy4xG
RszM52zOhZXPv6RTjFxcvodWJodNilxypwbRa9w+YoxqiMzFieXK4kzMljXRhlxGcIzGYCV8l0V3
fdzQkcXQZuXGgwzIH53HCWjRC5jSNP9N0S9dzCDt0kMzwfHTFSscf1XcyCxWgfJscEQcnQl9OCa8
WT+dF0tdgk5EeCb81B1tODy9wczmmli91Vy9OVfd1RSsMqcVxQ7o07nX1CMMF8vUwiSM1hZIgmVd
XPSzerEH1EPtFUrnwkz8xHuN17E1ex841l6NeCFs10Tt13cNz1Mc14rt039NF24txFNRNXR8xoX8
xy1d0sUcyBnNfal8xmAcfMDHx5XF0XusyDlNxskszBY9Wb7Mx13Mxitd1YV82Qw4fPjkRW/82qzt
0ZVdb2q1MlFhyeu8Z9JXfqAkSplczqzMzkl3zJOMy6vsz6X8yCB0ysWN3NEty628VSr/3N02x83g
DH1ix83tbNy27DR5ltyfPMnHLcllbWTXHWbHvct71n3EV8vNLEy7PFLhB36YbMj07c8t1t/STHbU
XOAAbdD7bM69HEm6Pd8CSDX4nN38N+DgfODlfeGSdM0xxeDaXdQdDssDPX8hTs/KfeAZTuDorc8c
zn/1nH/bR0KUfYAsHVmgndo57nktDdoQfeOyvccK2ON17NChLdE6btMT7UuDDMcljcc6vtmnHcc4
ntFPrsc+btIYXdES7ViDTNmPHRcxLHqhEdmGocTqhjJaQdWBXYCMweZvDtecAeelDdZ2fud4nud6
vud+R+fVB4FWYd8t3NCgIedFJ8OE/4xyyGfo8/Z7GZfT+mdMs802V5xkObxSbS7F+F0Yek1+Qe3d
+3zUdB3pBX19YY56B7fps+cyAQ3YLMzofR3rZu7YJ+zpgG3E+cTDkp3On+7Msf58fM1ZSR3mVB7b
SNx6Di3IkC7Hm41SZDzHus3GK1XbEChW0I7p3YzTmFzNKg5VbC3In/3QPO7jifzsxgzl1czj157t
atw0VsXixsfdrEzc7hffiYfLyw3bJJ7KqoxIozxpkvbKVSXvRe3t337swhzqoH5/BA9hqEzQDvhe
KP5aAlVN/11T1W3x6NxJmpTieuzr8G7g6O3wqLyAIN/t0Gx9xZTrHG7fio7yUwXgMf9OzdFs7/7O
39yuM5Wu8AX/4vd88vpNVdAdzzz/z2sU8DcM3Zc83gfdfgEt8UnPfj0P3yf/wvDdfa6c4BGPfRjT
1qSn7KUdzafd5GOP0jhX7U7ezQu97Dj+fgf/2jbe7EKewkS+WJM+x8/c2UTO7tc+2nU/6Hmf2SON
95Z95LDObYTtxK4eGHkdmhAsGH4OGH5++Ls47Hweg1+dNBVsE5df+YkPN5v/M7GV124t6CGMWXEH
0sbuxosc+l+75nRdwqOu1n1tdP69+J0/F5vb6YwNxYtN66m+8Kru+jMRabZt7DffYmrc45UN5QJu
ymiF2YDe8/Itf7n/F+Qc7ptsfNr/X8//Tt6qbN2YPd0xr87DRPwtuHrlTNJbr8Xcn/whz9b3HfVX
59zN3evXv3MNMfHHfH/0DRD2BAoEMLCgvYMFExJkiNDhQIgPER58uNCiwYYNF2rEWBHiP5AhRY4k
WdLkSZQpVa5k2dLlS5gxZc6kWdPmTZwTAezcOVGnwp48IwYlqnMo0IRCeS5VyhRiz45Gi0I1WrWq
06sEqRbE2dXrV7BhxY4lW9Ysyohp1a5l29bt26FR01KEW9fu27N59e7l29fv3653BQ8m/JTq0cKJ
BQNm3NjxY8iRWyqmXNnyZcuSNW92LIjzZ9ChRY8mXdr0adSpVa9m3dr1Y8yxZc+m/13b9m3cuXXv
5t3b92/gwYUPJ17c+HHki18vZ97c+XPHyaVPp17d+nXsyaFv597d+3fw4cWPJ789+3n06dWvZ0+9
/Hv48eXzbV/f/n38+fWnnd/f/38AAxRwQAILNPBABBPsbj8GG3TwQQgjlHBCCiu08EIMM9RwQw47
9PBDEEOUTUESSzTxRBRTVHFFFlt08UWSRJRxRhprtAdGHHPUcUcee/TxRyCDJNBGIos0ckIhk1Ty
vyObdPJJ9paUckoqq7Tyypyg1HJLLo2brMv6sBRzJTDLNPPM2SYjZ01y7GFzzYHgFIjNOemMU843
06KzTYj4vLNNOd2Ec08/7RQU0P+IDK2zUEMVPfRQQv+ElFA+KU0UT4HG1PQkuwqdM05QQ/W0z09L
DVXQRPU81c1T/WTV1EDvvHRVRmeF1dRXKy3V1Vr7HBVNYLFrydVb6xSVLV3VIpbXV1v9tddcU03V
02RJZZXaVY3FtVlcsf101E3DHemuZVuNdltzVUWW22YRbRfUZIlV9t1qj/X23Gu3Ldfce+UN9l/k
vgz0zVHd1dbag7sduFt703WX11ijjVddXavNc1d29y324VDF9fgfwuqdWF6NaZV2UWYxfvZbfSk+
l2SVN24YYYZjfhdgnPETGVaYaa453WLbXVnbkm2uF+N8b0Y44pILxtffnKO2zun/Y6vOOOifU1Za
aa21BvpXroFOumWah2ZXarSDG9ZOgitdGNJLAXUUZUkftXTXQd+mO268GR0YU7sJflThZRsFnO1M
Pw43bcYbP/JLx71UfNPIK7f8Q8gvz25yIDX3/HMkWQJdWM59FGxPlPMWPG5oFaX04tT/fP1v2muP
dfZB9069dtb1jFjftic9enTP1ZT11onLNlna5L+2euegwX6ZZbCT79rns8luPtnSTa9LY6j97Vnv
bMMXm2xrzVbXZKiXJ7XnbFleH932ibf/ZJexP7ti+vFf+nmkpc9h88te/bwmP5+Jr4DMi9/9HFg2
PDlKgQwcW/nWsjq47W18rptb/9GONz+YwQ9d+Cpfox54QgJSrYHjQ6AF51U1qrGQW8PzoP4OWEH0
+ep3+5IeChs3rJOZj4BPE2H2Ztg/7DXPiFdbFwhVVUQRFq1n3esRuf53PvfdsIZHPGIUnec+JC5Q
eT9jXwLxVz8fSk1ghoPd3HRnQh3WTYdsE1wH2Sg72A1Oj7qL4xx7xzrVLUqOwXsVFXmURkQmEjiZ
U+RvDLmjRkZSkpOkZCWlw0hLyuiRzcmkjTbJnBK2EYN+xCDt+Ng2v5Esgm4zZeDs2EFAQjGPfjwY
BwuXyg++8pbXIuQg3/bJ0AzGi2S8mfosJkASDvN6X7xi/A4Iv2Fy0Ve2kqYWm/+Zu2TCy2qdzI/B
tHfG9bVuhGNMYgC3qT6seZOJOJTeBp1JLySSb3/rXCICh8fNgImOnRR0ofOO2cQwajOe1wzn+/x3
L6zNM2khFCgLj8ZQgL6QasAEzemI+VDf4XFmCSPnO3sIvQz+8ZxBJFwRp+dQcyJNnRC9ILL+iUZ8
CmeNt+PnOKHHP/8RU4wDHWD+ZGfGUwZUpQrlGFFbOE8DusVg3KMoZ6x4PoxKFJmoyqk0V1jOao4Q
pFvLZkqNylGJedViHlyp/gzq1ZiuZ5npJCkXU9ZDegoxiwRta1bFhk67htGYYMxaP1sK17QeZ22s
FB4eVblKOhbMjRJ04x5D+sarv/kysYUVpCs/CNl2Ho53lS0gY3cpUjg2tTWBDZFoN0Na1FYSk6nF
kGk1w1rYxla2s6VtbW17W9zmtjiu5W1vffvbyelWuD8EbnGNe1zkJveRG1BuiYb7XOhGV7roaW51
rXtd7MZnuts1U3a9+13whlc13CUvl8R7XheVV71PQm973fte+MZXvlNab32NNF/8Dsi++61Rfv37
XwCjl78DFlGADVweAifYQwEBADs=

------=_NextPart_000_0006_01C6FC5D.D6E7C770--

Received: from thesdsl-08155.otenet.gr (thesdsl-08155.otenet.gr [87.202.160.27]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9U8dlGZ071411 for ; Mon, 30 Oct 2006 01:39:48 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001101c6fc00$663d49d0$1ba0ca57@kosta74>
From: "contents"
To: [email-masked]
Subject: Links to top and
Date: Mon, 30 Oct 2006 10:50:07 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000D_01C6FC11.29C619D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000D_01C6FC11.29C619D0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000E_01C6FC11.29C619D0"

------=_NextPart_001_000E_01C6FC11.29C619D0
Content-Type: text/plain;
charset="windows-1253"
Content-Transfer-Encoding: quoted-printable

Here Click for or more Suggest url Link add Bookmarks Engines Business =
News a Stock Quotes of page Links.
Recruiter Intern Gusher Summer of Contact Partners or faq Terms Sitemap =
of Copyright Searchcom all rights.
Pageif will able the following twenty two Internet from Usflipdog =
Additional Asiaone Careerage India Builder Cwjobs uk Flipdog Global =
Center am Goodjobs Jobsacuk.
Jobsacuk Jobsnet Jobsat Jobserve au Jobstreet Latpro Canada Searchjobs =
Jobs Abracat. Jobs is Abracat Actijob Adquestd American Best usa or =
Brassring Exchange net Shop Employment Guide a Fedworld Hotjobsca.
You need or enable reload pageif will am able the following twenty two =
is Internet a from Usflipdog Additional Asiaone in Careerage India =
Builder Cwjobs uk Flipdog Global Center Goodjobs is.
You need enable reload pageif will or able the following twenty two or =
Internet from or Usflipdog is Additional Asiaone Careerage India =
Builder Cwjobs uk. For more is Suggest url Link add Bookmarks Engines =
Business News am Stock of Quotes page Links to top or and career =
sitesthis?
Asiaone Careerage am India Builder Cwjobs uk Flipdog in Global Center =
Goodjobs a Jobsacuk!
Your browser is or set disable in order this work you need enable reload =
pageif will able the following a twenty two a Internet from Usflipdog =
Additional a Asiaone Careerage. Searchcom all rights websites their =
contents are owned or used by or them as permitted of applicable is law =
is if.
Partners faq Terms Sitemap Copyright or Searchcom all rights websites =
their contents are owned or used by. Level Seasonal Grad of College =
Journal Recruiter Intern in Gusher Summer Contact Partners.
Uk is Flipdog Global Center Goodjobs a Jobsacuk Jobsnet is Jobsat =
Jobserve au Jobstreet Latpro Canada Searchjobs Jobs Abracat Actijob =
Adquestd American or Best usa Brassring Exchange.
------=_NextPart_001_000E_01C6FC11.29C619D0
Content-Type: text/html;
charset="windows-1253"
Content-Transfer-Encoding: quoted-printable

Here Click for or more Suggest url Link =
add=20
Bookmarks Engines Business News a Stock Quotes of page =
Links.
Recruiter=20
Intern Gusher Summer of Contact Partners or faq Terms Sitemap of =
Copyright=20
Searchcom all rights.
Pageif will able the following twenty two =
Internet from=20
Usflipdog Additional Asiaone Careerage India Builder Cwjobs uk Flipdog =
Global=20
Center am Goodjobs Jobsacuk.
Jobsacuk Jobsnet Jobsat Jobserve au =
Jobstreet=20
Latpro Canada Searchjobs Jobs Abracat. Jobs is Abracat Actijob Adquestd =
American=20
Best usa or Brassring Exchange net Shop Employment Guide a Fedworld=20
Hotjobsca.
You need or enable reload pageif will am able the =
following twenty=20
two is Internet a from Usflipdog Additional Asiaone in Careerage India =
Builder=20
Cwjobs uk Flipdog Global Center Goodjobs is.
You need enable reload =
pageif=20
will or able the following twenty two or Internet from or Usflipdog is=20
Additional Asiaone Careerage India Builder Cwjobs uk. For more is =
Suggest url=20
Link add Bookmarks Engines Business News am Stock of Quotes page Links =
to top or=20
and career sitesthis?
Asiaone Careerage am India Builder Cwjobs uk =
Flipdog=20
in Global Center Goodjobs a Jobsacuk!
Your browser is or set disable =
in order=20
this work you need enable reload pageif will able the following a twenty =
two a=20
Internet from Usflipdog Additional a Asiaone Careerage. Searchcom all =
rights=20
websites their contents are owned or used by or them as permitted of =
applicable=20
is law is if.
Partners faq Terms Sitemap Copyright or Searchcom all =
rights=20
websites their contents are owned or used by. Level Seasonal Grad of =
College=20
Journal Recruiter Intern in Gusher Summer Contact Partners.
Uk is =
Flipdog=20
Global Center Goodjobs a Jobsacuk Jobsnet is Jobsat Jobserve au =
Jobstreet Latpro=20
Canada Searchjobs Jobs Abracat Actijob Adquestd American or Best usa =
Brassring=20
Exchange.

------=_NextPart_001_000E_01C6FC11.29C619D0--

------=_NextPart_000_000D_01C6FC11.29C619D0
Content-Type: image/gif;
name="brainbuzz.gif"
Content-Transfer-Encoding: base64
Content-ID: <000c01c6fc00$663d49d0$1ba0ca57@kosta74>

R0lGODlhnAGQAYf/AAMAAHoHAACFAHp2AwoAfHYIewB8ecS1ssviu53I/kISAFIlAIofAJ4kAM4o
ANwpAABOABlIAEY2AGlMAII+C65LBc07DNE2AABqBRFsAE1hAGtSAHJRAKdlAL1RANxdBwSIDhh6
Az91ClGLAIh+CpR4AMF1BNWFAACuACmbDEypAGKcBXiYBaycCbauDdKbAALEACjOCDm0AFnGAHiy
CpzIALXGCtu6AAjaACLkADLfDGvoAnvYAJbtALbnDufeAgEJSxUASToDP2gBMYMCO6sANbQATt8A
OQ0WNB4VTEgZOFYlN4sSSZwjRMwdSeocTQA7OR1NSTM6RlhLN4g/QJdMOLRLMek1Pg5iTi1nOTJS
P1RpRHduC6NSRcxROdhZTQWHOiB2PDJxTF18TXiOMZ1xSsqERdiESACjRS6cMTuqTVSsOI2ePqSf
OMqoQOumMwDBMhy0OkLHS2LCNnm/R5a0QLLDRta/NwDbMyvXMTruOVHiQ3TaRKrZNLTtQNzcTQgI
fCsLd0ULi1YKiHoAiqcFhLMAeekAgw0SiCEUfEgRhWEVh4YihpUufckTeOARjgNFiCsyi0gxjF4z
fHsxe5VGjs5DeetEiwBsih9ngjpReW1adIZRe5prgMBtjepYiAt0cx2DcUV5cmmDhnJ5cZJxcs54
gNVxcgClhCeUfTmbfGOYhISee6mTerGkhtiVcwC2fifAhza3hGKxfnq2d5G+icS7dtK+eQ7uiBbl
eT/RiVzRh4fjgK7ucrXmfeDdiAEJsxgLtTIMyl4HunoNw58Aur0AtNMOzgAVxhwpyTMfuV0pwnwi
vpUhw8gVvOoqzgA7zSc8zEczx1Q3uXQ8tqg8s8M0tOA4yQBjxihuwDlrxGJdynZau59ivLtcvd5d
twSOyRp9xjpxx2d+v4R/x5uKyLOHtO5+yACixSWXujqTtVKXtIOayJmTvsqhutasugC/yh/EsjPL
ymTLuHq0tKHOyfXt+autoYp/iPoAAAD/C///AwAA//8B/wL58f///yH5BAA8+ZEALAAAAACcAZAB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKAn+W8mypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27ePOGTcm3r9+/gAMLHnxQr+HDiA0TXsy4sePHkCNLnky5
suXLIRNr3sx5LebPoEOLHt2ws+nTqFOrXs0aMenXsGPLnk27tu3bt3fi3g2yte+g9j4ID/6hoPDj
xQUiX56cePHkzJs7b87c+HDp1qEPd04Qe/Tu17kr/98+8Pj45dazlzd/vr345L/j91Re3iB04/Tr
B1+f/37+/9JRx19CAXaHn4H7Jajgdt4dJGCC2Cmon4QP/regQPLFRxF1DUoIoYMITmhhfyEWSGCI
FHo4YocdHohieghG6J+FFfJm40i6XWjihSSKaJ+L+u0Y4YkTNjhki0CqqOKQ9JkoI40iwpehbxsG
WWSR7A3444sQIgcjQ/fNyOOLTH63JZdW9lhik1De6GZjFc4Y54jjnUmnf2UyGeOHVyZZZpJ3Esnn
kySKqeebiKZU43MG7ijoilvWCCh+YWZHno9/okkoiPWJCeCHSCYqqkU5Snopoz62iWmkUaLZKJur
kv95YKiBIuSdpzrCqt+UVE4kqYehPmeqnYtqeaiqkHI5p6Z2AlosiseOKm1J5mWZ7Hle7meteOCR
Z214WV4KbbfrcSijt+jeGqC47kW5bYqTTivvvA1FS++9+OYLpr789gtRjv6KymtrARds8MEIJ6zw
wgw37LBgA0cs8cQUV2xxWw9nrHFoF3fssVwbhyyyZB+XbHJaI6es8mAnt+wyWCvHLDNKL9ds8804
53zYzDz37PPPQDem89BEFxX00UiXVvTSTAOc9NNQ29P01FTPFPXVSVet9dZcdz011mAD7fXYRPdc
QNhgk602zmi37fbbcOvrtG0vPVR31HdrHBVveTP/1HfWLoW8925/K1T40Ycz3BQJLAkEwOP2AOAX
5I5TXlHihQUuwOYC2MO5QJ8P1DlBoYO+Oemcj+556p2zfrrrrbO+eumiv676566jfnrtsfPue+d/
S1655QQR79DjliOv/EDIR17Q8soLH7n0zU9PfPTDZy/93tRLz5f33lOEuUEv3Q466QWpLrpB6p/v
vufrjy4//PTP77756a+vP/337/+++vhbndQCx7wCGtB5josI+BKIQOF1r3gGpN4BGzhBBFKQgQz8
iUTCFz6UJG8x7eOfCFuXvxKi738ICaEIV8i/EN4ugO0jYQprp78YLsSBBsEhBhvSwQVW0IcQxOAH
/y2YwwjukIji00kHsze9C0IueQ6UXBSleL0LNrGJOryi88ZXkLrZ0H8y9N/79oe/L5qwfyg0oQwD
iEb2xa+NKiGgBXtovQQ+EIsVJCIQn3dECdpRiAjxoxQPIjkNKpCQEaRiA3GowycCMoiDdKIiI7lE
jexudrSz3xg3ickXXpKTK0wd71RYxhaq0YU1rB9E/AhJ5g2ykXvcYSwJ2b3qURB8PbSl8fI4kiUK
koFZnCIwh8lH59WSmFTcZUc0OcJMuvGM9jPjCVMJRzKej42hVOM1QZkQVhpxmMtDIh0nWMki6hGc
5sxjJIt5OSXy8ZdOLGAjATnOK87zlplrid3kqP9Ka/pzmmDkJinPWM00CnCT0jSl6RA6QH0+spXo
DKI6JSrOQMpSiPU8ohULyL1vxnORf/yoMdP50XlmsaGNc0j5qGlQhW7zjSx1KUBHKNOWslGTZgSg
P/O2R1YykpgU5SA7hQrUjQaTnQcU6uBsWcc6PvGVtYSeN5k4x+hNUpEJ5GIcWyLK2ZkudvKznShz
l7tOejJ9lyRrWs9aurB2FZNoBSsYL9k3XF4vmVgU5vOY2lRXLjCcVqXqFCXI1OoZFkM++d5Eyhk3
yDCWX49VWk4wElmSikSrA8HszIKXsO1B5SJ8VYgye8PPhWhWZqcNmCEby1rF6WQjqYVMbBO2Npv/
AC0frYUb9iw7r3z4diC+xe1BfiuQ4ALXHsElLnKVa1zhAje5zjXucpn72+hKd7rFra51cQtd4grX
ubkl32un+q/Scswl3EWueotrEPCCd73wje5xs9tegsg3vuylL3zxO9/9fje//81vbWuyWF7mK735
3a+Clctf/r73vQsGcEEerOD1uve5/U1wgiEcXooQFq9NHaKNrntf9jLYwvbtb4AVQuEGV7jCK8Zv
jCOc4Q57WJc/HSkS3eTdDPc4xe5N7nyD3OIh23fGGpawik084SbX2MYbTOc6rVfZ2qS3xC5W74WN
TOMUexnCCHbyl72M4iJrmMO51U09p7zE2Trm/25X9nGNw+xfJT+5xWCOcJ7rvGEz13nANCnwUPG5
Y97EGcuIPvOYFS1mB3PZxYlm9JPJDOWdFPapWNViIc0LmrqRmLnZ/S6DRS1k7IYazNB9Lneva2pV
P/jTiB71fAFtNI24WWgERHNEdH0j4dJaJlBO8pt43dq5kYrTn7m1wX49FJohmzHKRgizXeZsh5Ls
2UmctsmqndJrW9vW2v7NYkMr2seOdjT8SDc/7KHudA/E3QJRd7zlHeyHkfeGDKmyZdYd7377m90E
4Te/AV5vh+mbtwhHt0EGznCG/7vg91Jz8TDtyFsec5jRNkndBv5vhwv83VsNt8cql1SSO5Jy6/88
acZLcjd4s7vdIAc4x+Et8l55GKgmladHa/PxmH+c4w+H+KicRthvpnyOO1w5SfrWc383fOEorXlq
okxPoyMdnrJxOMGdHvCOC11elubrMZ/aV8M6Uuk4cgnMX752ehN87VIfuUU7gvbLYnsicV+NRg7+
9b6L5tx+D7zgB88zY0+m7hjJ+9KSfXfK7lPxQ6PqXlcZWHB/2yOFnbjwIF+2yB78noLObOMr8kqS
A5LzFRs3vqluEb5vZMpI1yjh5fZa2Vcc5Zi2LO6N2Tzc4xDxeyUq0lGvM4qCFPS+hOjtRYrYy2Me
iBIkfs6ML0iUy16c1rd49kXv/I4c/fTSvxn/BHuv86vPHZmu7GMXR9/62A8//DabaEiLjkirn3Oj
Uf9HSEr/0E3D/2XkRmXJdG99JYC+Z3r2lH8igWMX938143jtd30htxK99HgOqCEeBIGFNnscuICu
F0iA14FCZ3gi+BgXGBMlWBknCBMpSBkr+BIBEIP2EIMBMIM0KIM3WIMCQYM7KIMDcYM2mINB6IM/
yIM9WIQ6GIQzWBBC2IM6yINGaIRDmIQ5SIU4iIRWmIROqIQEAYVCSIReCIRMyIRVyIVDWIRImH/h
NhFU+INuuIQ7+IZxKIc1+IRz2IZzmIdaiIc2aBB8uIdyCId0OIiC6IOAeIRdaIVkSIiHKIiO//iI
dgiHfFiIXfh1uvGHfhiIkRiIldiJkpiJfXiHYziKlKiJeUiIkDiGWiiKbdiKbjiJiFiKg7iKp/iJ
owiGzfeCFIiJsgiItPiItYiHtGiHkfiLpDiJvngQvLiJnviGdfiK0BiHwhiNsOiKoOiMoPiMcKiL
DqWNTpiFq+iNi9iMZ1iLtqiNe0iE34iMlfiLYviN5giMxWiLn7iJ70iMnDiNpCiKtyiNuaiL/oiN
/EiO15iKsiiQ6LiPp8iM4YgQDDmQBDmP9hiQ+liP+YiFBUmPCLmN3EiBS9iIAkmQ+9iQBzmQhqiQ
jviQIqmRJBmNnYiPpZiQ5qiIwbiQCsmMJv+pgx3pkQYZkD3piSDZi0A5lJyYkja5krzok+yoh6iY
lB9JlEx5kVB5kDq5k5r4hWD4hOoIj2m4hYh4j7iIkWT4juXYlYkIjmAZjlIYhVvIlkpYhmu5jlno
lWa4lnaJh4rXgnq5l3wpOLXXl7i2k4I5mE0BmIZ5mIiZL4S5mIzZmI75mJAZmZLJjfIwmbWVBpaZ
mZpJNonZmX2xmaApFJ45mqRZmrIRmqiZmqr5FKbZmq75mt62mrI5m7RZm7Z5m7gpmrC5m8eWm775
m6rJm8I5nMRZnMZ5nMgJbcA5m8nZnM75nNAZnRBBANRJAPZQndQ5ENkpENXJnd2pndgJnuH/+Z3e
GZ7aaRDjiZ3WeZ3kyZ7kqZ7i2Z7rKZ7l6Z7sSZ/1OZ/eSZ/qaZ3d+Z/ZaZ4FAZ/lKZ8DSqDo+Z7z
CaD6CaD8SaD6uTA7saDceZ4VaqEUShAZep0Yip4WeqEfup4UuqEguqEmqqEeCqIcqqImGqErWqId
CqMkiqIwyqIpqqI2mqMvGqI0+qIi+o8446ItGqMHcaIDeqMo2qBIuqNHWqM+WqRM+qM9up0rGqFC
aqRTep4ueqMzWqFW2qQ4WqVYGqJjeqFFE6U8KqVMyqMX2qVqyqFfSqNd6qRGqqRfKqRa2qYM4Z81
WqcfihB+mqc9qqMdqqZ46qV9aqFnep8F/5qhfAqeCUql7ummBhqlCyqfV6qgkiqgVaqhW+qonYqf
hRqfSQqnnpoQnJqqhLqjh/qjbjqqBaqoFmMRbyqljzqooaqnYVqr7Rmjh/qntiqnnrqpawqqb1qs
iKqriHqrfyqsRDqpuKqkTeqqzfqkpqqsW+oztVqiv6qsyAqmwJqi2YqmvoqrrPqs1sqocTqlc7qd
klqt3tqtMyqtzsqo3+qjr+owE/qs25qudFqqgpqs2Mqi81qvJMqsY3qw4QquCvuvYeqwAuuv8rqw
59qw58p9OmOe/VmfbdqrmgqfGxuy7hqg3ymy77qx9tmoDJqfI+ufJHuwvZqyYqqq3Dqyw/8an+kp
oi8bs7HKsTO7su+psmZaNq05rrixqKVptEdLtNJJGsv5tPLRtFI7tVRbtVZ7tawFtauJtbCptcHJ
tWAbtmI7tj/jtalJtmibtmq7tgdjtqjJtojptnI7txcIt3Z7t2JDt5mJt3zbt377t4AbuIJLeHq7
t4PLgYVrmYe7uIxLLyQYm4nbMjE3bxkBc+32dPMmcG6nhpFLMBQBdEDXEKDrc5M7c17XuG+SI+tm
uhExugWhdS9HuvnUuSfTb6brcvTmbrrrckEHu6t7uiBHuxnyuR33c7LbdAHXcG5nvO8WuqhLOLW3
dlv3u1z3dgmBvD1HvV2HscLrua27vR7/d7xBB77kS7mv+7xuohusG77Vi7zT+3DYC7yc272oIRG5
C2/Ly7uWO3P323a4m7mwi75085eXQb/bxngGLHeYkcAfI8AS2hUOrDBeEcG0BcG9V04U533nFoLn
V24f+IG0NHEaxcE8VEkkvIEg/HerdDzl5BWgV3+wN2jHs3rdFIGAIXz1V8M8pMNXQ4Dz22yHZHzF
FMMSpW/mRsOh9xc4nHAGxsQpPDI+nHaT9VdRZEQ4pj27h0eJZE9SZXJkZ3bpB0lYRW5ZHMZ+dVVl
x8WMBGJOBVV+hYCXlldy/MVjfGl6RcdUFsZ4HMdynMdQ1MW+90Bk98a8Z3oTXFX3l2OU//RIsDRU
/LfI0KfIhSbI+Fd+ORxRi0xo9yR8VSTJJzXHwJTJJ3dROnZ8oizGzNfImTx/oaxjRFVxSfXIP6yb
ggZLOcd72zdYI2zFrJyA9ATGRRxSOmw8YsfKm1xRpVxy2mNH5IfMx1xSCEjK0CxJx8xBhwVSTDRE
jTzE6gdOAXjD6FfNwszISEXOkoxzlvxDvCxa5NTNkBzOjixlmJzI3DzNt4xU8CTOIkXM3OxDsHfP
9czJ4ywSE7BBB0hxgfXHpnfQd4VXGVx5eeXQg/zGFxximrdL4SRYFW2AbfzJXqzLUqXLWGyACH3B
GZ3NDB3RZ7zRvpR7lWdVJc3RK51pKv+de675xB1MGVE8wyvc08i8ge5nGY/rM99s0KBR1CxcZScc
fLRkbktdXlxBwQjDFFJdcENd1el7Flg9L1ZxEhklga+XwjidQ2Odb2R91pQnGEgN1PlW1g+h1Mo5
WZiXEnzn1jlt1jvMzkzMwx/heWCdEXbN171ZFn1N10EMEnXN04L915c810i8gCTh1l1t1Chd0bvn
0ndM0yI8x7qE0oXcxp5NzFV8gGdMyMBMx3X8Q1mM2Ykk0njMxSqteZK3x2gM25lmV6MdYlcc0akd
za/tFwDzzq48zkdVfZMcUfFk3B71fbCMyquM3M+8fKTsz9B8z5s8SZKEf1iXftI9ytj/XFTZnc/Z
bX7JvMX+R9jNPM/YXNz2F3zeZN0Yxd7oJ9ua3M9Gd81HZdFWfFiuHXvRncfM59/m9N+AZdoBTc64
nN8JHs3xNNk9zWa9LN7C/MLqLN4SLt+pDM/OLOAbTt4nlWPBPH72B9ABvt3zTeLPPOJWJ9AD3eGB
XRIhXdkvjdq6PYBMPchmB2I5flU6PtEkzdv0XXbCZNkSvVvDw8Z21dGmTdsSrUWVLdslTeM7bsdP
rtE9ruSi3cWz8eKN/diTweWTYyNGrDFrbcMlDOZ9/dSOpeaYUeZlvtVre9VwDnZJMecdJud2PnRb
IXk3dnGt59Ezrdl/h+YnzIAZfdKU//3nudTWbFzOIRzk2ZYVQS3E3XRHGjjM4O0YcM0RO43gyAda
eq3XPpXXbA3W1I3CplXnh217b23poK7YjB0Ym/56TazO7Uzri81bnT7pXR5Ujh7rg2HNPL7QEM5/
uq3GSA7bjd3b9A3GqH1HTE7RbuzZDO7sSf7Z/OzrTfzal43terXk187syhztmpbtx37uTu4RlvZO
J17tI5Xf3s3c0kx9srzOppzhWvzJri7cMWzcnFzv3TzvZ93cVTzc2r1zGGXwypzvGr5mB17KSsF6
EX7kuwzw1+3pfO7OAC7N/71I+hziTsXMZczhLG7jti7wD3/N5b59CB7iJr/w0d3Myf9XVbZc8Itx
4QGv4hqO8YD+ysc97u2e4hi94i0OfeD9SyZ88g/V8FX30y0P9EmP8UY13e2+Y2iu6BetxgVIfjmO
xYAVyA9NyKAtdqRN5EKOPSzP3YHsxz7+5Hc19hid5UwN5TwOyJk992QP97k0dlq+42K/9ikdMLtO
GImd55/x5sFe6Fdv+IyvrwScNgws140PN3geNJEv+Zxe13ad9plfbjf+9VU++Ukc6pU165Ad6vss
9aIv8aRP6l5e2Khf8hQewevO7audctY38mO/8pxN8WovgJzt5zh86KXcQZevFKpc3+lOyfpuxgaf
2x+ufNgN4h496u9ufMd/E1R3yyb/7/ALDvIyf+KLXvzzbOLo/N3ADuf6/M/yXN5A//zILWUWPuFU
z+EBvvo//tA2rfbDLsJ+DxAABA4kaI+gQHsJDQJQaFDhwIURESaEuJAhxYkHMV7kONFhQ5AhRY4k
WdLkSZQpVa5k2dLlS5gxZc6kCfPiR5E3a+7k2dPnT6BBhQb9V9ToUaRGhy596BGkU6Ysk06lWtXq
VaxZtW7l2tXrV7BhxV6NWtbsWbRp1a5l29btW7hx5c6lW9fuXbx59e51O9bvX8CBBQ8mXNjwYcSJ
FS9m3NjxY8iRJU+mXNnyZcyZNW/mfJTvZ9ChRY+m2dn0adSpVa9OStr1a9ixZc+m/13b9m2YrHXv
5t3b91/cwYUPJ17c+HHktn8vZ97cOevk0aVPp/vc+nXs2bVv597d+3fw4cWPV0zd/Hn0UcmvZ9+e
c3r48eXHdF/f/n3G8/Xv59/f/3/+8BNwQAILNPBABBNUcEEGG3TwQQQBlHBCCiu08EIMM9Rww4a8
4jA0CAv8cEQS5fKwRL1CVNEzclokxx4XW1RIxoRcrNHGGWmMMSQbX2zIxxxfpBFGGXsEEkcihQQJ
yRuPRJLJJJM0MkgpjfTRyiV1TGhFAVs6ssYZwxTzyx/BNFNMIpfkEU0Y0QSyzTOHzDFLNp2kM84z
4bzSzDft/JFMFJPz6k08bxyTpP89RSK0TzjdBNRPPdVU88tEy2yTUjYNzbPRPDEFk0wu8XNpUTcj
3bTUNRHltFElWQ0zUUIVdbXSQz019dJNSS3V1lgD5W/IGMlsVVNLie0U2E5rRbXVPuWMFNZU96x0
Rz5X1bVQZjP1lbgTqz0UV0m1ZbRYKYuVdtlbTz03XW+z9fbZcJOtdtotQ7UvJlqnjfXaOsMd11Vi
H6V1VXjZNdVdgiHN1dxPC93WuEG/ffdWXQGVl9NHGb74X1QBdjjjV8m1VmOPFbL3XpaoDfZKZMv9
U0gom3SSZZhrHrPIlmXmUcsodW6ST5x3fPLlLIHlGcdeH1Z6aaabdvrpEbuFmq3/kyGcGrSqUb56
r6zr25qvrt37mWYrqX0ZUibLTtvslauc+W24m61ZaJ9lfhJKs6lMNUihgzUz7OdGnRNPaMm1eN92
/UV3YpBLPrjhwxPvOOGRKn534K9juzbpXhFPU914SfZc3I9VNZzgeBEf/VRwQ189c81N55d0cF/n
fPHHJQXZdllNB533NTvXXVvYXZO7btY9X1dkztm+m2dL8857YUVvJx344V0funjZNqc+9MexT/3y
iSUvf2TfT5907+Rjtpx17vvqyvvewdeXfdQxBl3k3OFHv/L6UU58F/uemADHHv1tDICTG2C/9Le6
xnFsdo4rYOTGx7H/ceqA66lb/9t+Vj2jWaxnI+SbjvzmvueVcG0zK1rnnDW96bmtZym0W6I2yJz4
5dBXUtMhXG64nB4GUYhDJGJxeFhEAP1QLEiskBLDkikPynBnQTOa3qQXxRgizYQhHFsWs9hCZ1kr
hh1kod7M6Dwz8q1ol4riB0foIycWBSYQdCDuLHhHxrEvX3UUoePoyL8+/guDnxtcAg3JxzkVjnAS
I+KwqMev0aHNfwTcH+b26DAGZnBWigNkwIIXMsoRcoKOPKSshMVEUr4PipysHfHqeD3aCZJ2D3Qd
KCcXSoTZMpfzKmDD0hctRg7xksHcF9yUVcjx2Y+CwxwjDCl5SjUqs2DR69+3Uv/5yV/+CVuoTFv2
XHnJ5RFvkMKLpcbIuahumiudrwsfMBVpTU22LoCmDKbSPCRLavIvj6xiZylRN04F/pOAImTm/vJJ
yGNaMk6jzGDSdPm3OAouk89kJDjFmUz84bN0rNRoyRqHyFl+1ILq86NJhuXQhw1qi1JkaTQ9uL1m
vjBmbkSey95Yxip10Xk0u2kLz7hGPYUQpy6UKTqLyUWIOpGJS/XPEZm6nzj+46lTlU9UrXpVrGZV
q1vlalefSFWwnserYyVrWc16VrSmVa1rZWtb3fpWuMY1RGGla13tele85hU9cuVrX/36V8AGFnB6
JaxyBHtY8BRWsYtlLPcQ+9hJ7jRWsiCCbGWxM1nMcs2ym3VOZj17F86GFoifJW1pTXta1PZQtKvl
TWpdexbWxnY1r6VtbW17W9zmVreBkm1vT7Nb4AZXuFEJCAA7

------=_NextPart_000_000D_01C6FC11.29C619D0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9TACEDW031707; Sun, 29 Oct 2006 03:12:14 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9TACETM031706; Sun, 29 Oct 2006 03:12:14 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from pne-smtpout2-sn2.hy.skanova.net (pne-smtpout2-sn2.hy.skanova.net [81.228.8.164]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9TACDxg031678 for ; Sun, 29 Oct 2006 03:12:13 -0700 (MST) (envelope-from [email-masked])
Received: from arport2v (81.232.45.80) by pne-smtpout2-sn2.hy.skanova.net (7.2.075) (authenticated as u18116613) id 452BAB41003AFA9A; Sun, 29 Oct 2006 11:12:05 +0100
Message-ID: <004601c6fb42$ae379790$82c5a8c0@arport2v>
From: "Anders Rundgren"
To: "David A. Cooper" , "pkix"
References: <[email-masked]>
Subject: Re: draft-ietf-pkix-rfc3280bis-05.txt
Date: Sun, 29 Oct 2006 11:12:02 +0100
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

The AIA caIssuers stuff is now a major improvement over RFC3280
which in this particular area had serious shortcomings. Good job!

I still have some minor objections to some of the finer details.

That the pre-3280bis MIME-types embedded in millions of Web servers
are not mentioned is in my opinion somewhat odd taken in account that
the non-conformant but widely deployed use of RFC822 names in DNs
indeed is mentioned as a "legacy" (but deprecated) way of doing things.

I also believe that the "OR" regarding the SHOULD usage of HTTP
and LDAP access locators ought to be an "AND" since there is no
CA software of any significance that does not support both protocols,
while the same situation is AFAIK not the case with client software
such a mobile phones that typically only talk HTTP. Deployers of
CAs do seldom have this information; it is in fact not even public.

thanx,
Anders Rundgren

----- Original Message -----
From: "David A. Cooper"
To: "pkix"
Sent: Monday, October 16, 2006 21:41
Subject: draft-ietf-pkix-rfc3280bis-05.txt

All,

I have just submitted draft -05 of 3280bis for posting. As usual, a
diff file highlighting the changes between draft -04 and draft -05 is
available at
http://csrc.nist.gov/pki/documents/PKIX/draft3280bis-04todraft3280bis-05_diff.html.

I will be out of the office, and not reading email, for the next two
weeks. I will read any comments submitted on this draft when I return.

The following is a summary of the changes in this draft:

1) Section 4.2.1.10 (name constraints) now states that conforming
implementations SHOULD NOT impose name constraints on the x400Address,
ediPartyName, or registeredID name forms. Draft -04 said "MUST NOT"

2) Section 4.2.1.10 (name constraints) now states that conforming
implementations MUST NOT issue certificates where name constraints is an
empty sequence.

3) The descriptions associated with HTTP and FTP URIs have been modified
in sections 4.2.1.13 (CRL Distribution Points), 4.2.2.1 (Authority
Information Access), 4.2.2.2 (Subject Information Access), and 5.2.7
(Authority Information Access).

4) Section 5.2.5 (Issuing Distribution Point) now states that
conforming implementations MUST NOT issue CRLs where the DER encoding of
issuing distribution point is an empty sequence.

5) Section 6.1.1 (Inputs) now includes initial-permitted-subtrees and
initial-excluded-subtrees. There is also a new paragraph at the end of
section 6.1.1 state indicates that conforming implementations are not
required to support all of the inputs (e.g., a conforming implementation
could be designed to always initialize permitted_subtrees and
excluded_subtrees in such a way that no initial constraints are imposed
on names). The descriptions for the initialization of
permitted_subtrees and excluded_subtrees were changed in section 6.1.2
to account for the two new inputs.

6) Section 6.2 now uses setting an initial path length constraint as an
example of a possible extension to the path validation algorithm.
Previous drafts used setting initial name constraints as an example.

7) Section 8: References were updated as appropriate.

8) Comments were added to the ASN.1 in Appendix A.1 and a new paragraph
was added to Appendix B (ASN.1 Notes) to clarify which attributes are of
type DirectoryString.

Dave

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9RBlr1q008842; Fri, 27 Oct 2006 04:47:53 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9RBlrie008841; Fri, 27 Oct 2006 04:47:53 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from agnus.ngi.it (ns.virtuo.it [88.149.128.9]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9RBloLv008831 for ; Fri, 27 Oct 2006 04:47:51 -0700 (MST) (envelope-from [email-masked])
Received: from [192.168.1.11] (ip-177-100.sn1.eutelia.it [62.94.177.100]) (authenticated bits=0) by agnus.ngi.it (8.13.6/8.13.5) with ESMTP id k9RBitgx018859; Fri, 27 Oct 2006 13:45:01 +0200
Message-ID: <[email-masked]>
Date: Fri, 27 Oct 2006 08:09:20 -0400
From: Alfonso De Gregorio
User-Agent: Thunderbird 1.5 (X11/20051201)
MIME-Version: 1.0
To: "Weger, B.M.M. de" , "Steven M. Bellovin"
CC: [email-masked], [email-masked], [email-masked], [email-masked]
Subject: Re: [Cfrg] Applications of target collisions: Pre or post-dating MD5-based RFC 3161 time-stamp tokens
References:
In-Reply-To:
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Steven, hi Benne,

Yes, this is a sweet and sour truth. We are not getting closer to
preimage attacks. We are getting more far away from considering preimage
and second-preimage resistance sufficient hash-function requirements for
the real-world security of some protocols.

Cheers,

-- Alfonso http://crypto.lo.gy

Weger, B.M.M. de wrote:
>> So how close are we getting to first or second preimage attacks?
>>
>
> As far as we know, not one bit closer.
> Best known attack on MD5 preimage resistance still is brute force.
>
> You may interpret our result as enlarging the applicability of
> collision attacks. In that sense the gap to preimage attacks has
> diminished. But we have no measure available to tell by how much.
>
> Grtz,
> Benne de Weger
>

Received: from aaflegal.com (79.pool85-50-39.dynamic.uni2.es [85.50.39.79]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9R7GPSo041018 for ; Fri, 27 Oct 2006 00:16:35 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000001c6f8a2$086b7bd0$75d6a8c0@ofac>
Reply-To: "Michelle Seat"
From: "Michelle Seat"
To: [email-masked]
Subject: Re: VlhAGRA
Date: Wed, 25 Oct 2006 18:57:03 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C6F867.5C0CA3D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C6F867.5C0CA3D0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VlhAGRA for less http://www.putinjerionkdsacein.com

=20
Yes, one off to your left. Roughly the same distance youve walked
Usually, by the time I had exited the launch, he would be calling me.

------=_NextPart_000_0001_01C6F867.5C0CA3D0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VlhAGRA for less http://www.putinjerionkdsacei=
n.com

Yes, one off to your left. Roughly =
the same distance youve walked

Usually, by the time I had exited the launch, he would be calling =
me.

------=_NextPart_000_0001_01C6F867.5C0CA3D0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9R19ImB064214; Thu, 26 Oct 2006 18:09:18 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9R19IQH064213; Thu, 26 Oct 2006 18:09:18 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from robin.verisign.com (robin.verisign.com [65.205.251.75]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9R19GYQ064197 for ; Thu, 26 Oct 2006 18:09:16 -0700 (MST) (envelope-from [email-masked])
Received: from MOU1WNEXCN03.vcorp.ad.vrsn.com (mailer6.verisign.com [65.205.251.33]) by robin.verisign.com (8.13.6/8.13.4) with ESMTP id k9R153ir022482; Thu, 26 Oct 2006 18:05:03 -0700
Received: from MOU1WNEXMB04.vcorp.ad.vrsn.com ([10.25.13.157]) by MOU1WNEXCN03.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 26 Oct 2006 18:03:15 -0700
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Subject: RE: [Cfrg] Applications of target collisions: Pre or post-datingMD5-based RFC 3161 time-stamp tokens
Date: Thu, 26 Oct 2006 18:04:56 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [Cfrg] Applications of target collisions: Pre or post-datingMD5-based RFC 3161 time-stamp tokens
Thread-Index: Acb5IgvzKX79q9vhQkm+eNPYvwtmtAADvSuwAAwhrLA=
From: "Hallam-Baker, Phillip"
To: "Weger, B.M.M. de" , "Steven M. Bellovin" , "Alfonso De Gregorio"
Cc: , , ,
X-OriginalArrivalTime: 27 Oct 2006 01:03:15.0714 (UTC) FILETIME=[AED87E20:01C6F963]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9R19GYQ064207
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

One thing that always concerns me in these issues is that it appears that some people look for the commercial CAs to take a lead in declaring algorithms obsolete.

This is a very bad assumption. While commercial CAs can and do take a lead in promoting support for stronger algorithms (we have had 2048 bit roots for over 5 years) it is not our function to force people to upgrade applications by withdrawing support for crypto that may fall short of the absolute state of the art.

With the exception of the brute force attacks against DES (a product of the 70s) none of the recent theoretical advances in cryptology allow a practical attack against a real system. Even the DES attack is a pretty remote one.

Clearly these attacks are significant enough to say 'do not use these algorithms in new infrastructure you plan to use for the next 20 years. That is not the same as saying 'throw away anything that uses it'.

It's the same thing with my 1977 MGB. It does not have anti-lock brakes or airbags. I still drive it[1] even though I would never buy a new car that did not have those fitted.

[1] OK I will drive it after I have replaced the wiring.

> -----Original Message-----
> From: Weger, B.M.M. de [mailto:[email-masked]]
> Sent: Thursday, October 26, 2006 3:21 PM
> To: Steven M. Bellovin; Alfonso De Gregorio
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: [Cfrg] Applications of target collisions: Pre or
> post-datingMD5-based RFC 3161 time-stamp tokens
>
> Hi Steven,
>
> > So how close are we getting to first or second preimage attacks?
>
> As far as we know, not one bit closer.
> Best known attack on MD5 preimage resistance still is brute force.
>
> You may interpret our result as enlarging the applicability
> of collision attacks. In that sense the gap to preimage
> attacks has diminished. But we have no measure available to
> tell by how much.
>
> Grtz,
> Benne de Weger
>
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/cfrg
>
>

Received: from [200.214.14.3] (GAP.DirectWay.160.PredialNET.com.br [200.218.180.160] (may be forged)) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9R0LoJC054119 for ; Thu, 26 Oct 2006 17:21:52 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001301c6f82f$e84bf040$030ed6c8@particulp598o4>
From: "major"
To: [email-masked]
Subject: EMail.
Date: Wed, 25 Oct 2006 10:20:07 -0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000F_01C6F81F.24C32040"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000F_01C6F81F.24C32040
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0010_01C6F81F.24C32040"

------=_NextPart_001_0010_01C6F81F.24C32040
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Keep constant isa benefit of entirety aseparate trip browser am =
especially drive.
Keep constant isa benefit of entirety aseparate trip browser am =
especially drive. Projectthe editorial series reproduced prior =
permission useback Pagea required properly navigate Sport Hotels =
function of Mmfindobjn ifxdndall xdalln ixi Tourism in Canadian Western =
inn Howard am Super.

Byblogger is Amwow valuable article couldnt or bymister tut Pmsome there =
Butin.
Our servers link hosted or elsewhere Queries of Gzip a Enabled Volition =
Quote Minute Follow every idea get either is.
Within add item details your post is customise how looks in using =
template Preset thumbnail settings of When saving remembers a =
thumbnails.
Another couple days see of get of answers need week include future =
updates mon a Macosx a why longi requests.
Digital satellite channels terrestial television live videos a ipv =
unicast multicast Oses vlc stream locally computer Gnulinux flavours bsd =
is os or Beos Solaris qnx Familiar!
Alex of progressi started keeping regular log am my of work or ecto =
personal wed of posting Typepad What dosome users being of able.
Backup Dvds allinone in dvd steps modes Mobile modes am brand years =
moeller Getright.
------=_NextPart_001_0010_01C6F81F.24C32040
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Keep constant isa benefit of entirety =
aseparate=20
trip browser am especially drive.
Keep constant isa benefit of =
entirety=20
aseparate trip browser am especially drive. Projectthe editorial series=20
reproduced prior permission useback Pagea required properly navigate =
Sport=20
Hotels function of Mmfindobjn ifxdndall xdalln ixi Tourism in Canadian =
Western=20
inn Howard am Super.

Byblogger is Amwow valuable article =
couldnt or=20
bymister tut Pmsome there Butin.
Our servers link hosted or elsewhere =
Queries=20
of Gzip a Enabled Volition Quote Minute Follow every idea get either=20
is.
Within add item details your post is customise how looks in using =

template Preset thumbnail settings of When saving remembers a=20
thumbnails.
Another couple days see of get of answers need week =
include=20
future updates mon a Macosx a why longi requests.
Digital satellite =
channels=20
terrestial television live videos a ipv unicast multicast Oses vlc =
stream=20
locally computer Gnulinux flavours bsd is os or Beos Solaris qnx=20
Familiar!
Alex of progressi started keeping regular log am my of work =
or ecto=20
personal wed of posting Typepad What dosome users being of =
able.
Backup Dvds=20
allinone in dvd steps modes Mobile modes am brand years moeller=20
Getright.

------=_NextPart_001_0010_01C6F81F.24C32040--

------=_NextPart_000_000F_01C6F81F.24C32040
Content-Type: image/gif;
name="offline.gif"
Content-Transfer-Encoding: base64
Content-ID: <000e01c6f82f$e84bf040$030ed6c8@particulp598o4>

R0lGODlhFAJYAYcIAAAABHoAAAiABY11AAAKeYIHfABxc7XDus3NxJ3A7UcWBVEoB34XAJIlAbwl
ANgqBQA+ABwyBUxJAGVOAYBOCatLALY+ANxMAABWABRtCUlaAGBuDHVfDpRsCbhkAO5XAAByABly
DDhyAGuLAId3A6WOAMJ9AOiJBgigBRWdADObAFSmA4CoDJKSALWUAOGfBAmyDBrIBk2+Dl3HCYG5
AJ7AC8G6DenLAQDiACHnAEXtC1XYAH7ZAJvlDbXZANLYAgoAMigARUIOQGoAQXgAP64AP8IAO90A
RwAURhsWNj8rPWQaTocRS5IgQr0USeoRMQw3RSZNSkI5MV9BRYhKMZY5Pbc5QtkzSA1uPRZYQj1R
RGNrNnpaCqhmPctSReVlMwCDNyR6S057TWx8Sn+BR6ZyNryDNNx7OwCoNxikRTuuQ1+gQXWSSJqr
S8WTQdaSQwO/TCDBP0W9RlW4Mn+2RZG/PbTNSO62PQDRSSzgOTrSQVfTSX3RO6PuR8rZM+7eNAAO
gRsDhjoHjVICf4IAfZEAerIAc9cAjAAcdCUbdzotiGsWh4EWh6EifsoojtUaewtHiBpAd0Q+gmI7
dno9iq1BjLJFcdhBfgBYiCxRgEljjWVrjndSiqVrfbFhdeFkewZzixZ1gzZ5hlSHcXSChZWHfMZ3
e+OCfAWmiSWRjjeTjV6UiYKrg5SkfbmXhtKncwe5eSHBh0e/imnFf3a7cqzMe8vDgeK4egXUdSLd
dUPYdlHbcXTUhZjeiMXoceniew4AsRcJs0wBzGoAu4oAzpoAt7sAytsAtwAbtCEryzQlu1kTxYgl
zaYkyskjx+cfxQBJvhw3zEk1uWhBxXs9s6w0wbpEvuIyzgNutiNqwUNgx2desXZWsZNcs8RVzuZm
ygCGxRh6yT+HymuMwXKBzaeItc55vN1xvAequyqdvTiTt2eptH+bzKamw8iiuumsswq7tynLyEDC
tlvHyX3Ey63IxvL49ZKer4xzhv8ECw3/AP/1CgAA//8I/AD//////yH5BAC58kkALAAAAAAUAlgB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIAnaG0mypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qVOfIaNKnUq1qtWrWLNq3cq1q9evHTeB
HUu2rNmzaC0+Xcu2rdu3cOPKncszrd27ePPq3cs3Ld2/gAMLHky4MN2+iBMrXsy4sePHkCNLnky5
suXLmDMv/qG5s+fPoENP/MFZtFd1plOrXs2RNOushmPLnk1bNunauHPr3s27d8/bvoMLp5uleJbh
yJMDT772tVnj0LM4n27WNfWOzAdHz869e8nl3o1e/x9PvjxB654LTA3Pvr17uT/eLz0mv779+/jz
6+/Zav9uIf55Z96AHFFD4IEIIqDgggw26OCDEEYo4YQUVmjhhRhmqOGGEyLoIWs3cSjiiCSWaOKJ
KFYY4IoskmTRiQGkKOOMNNZY4oedtYPjRjEy2CMCAQT5448K9hgjkUACKWSQDi5Z5JJHQqmkjw0K
qaSUPjp5pZVYbrmgllsySeWYXhZZZZNWkpnkmGnu6OZnIQ75JZtnJonkkRISiWedWapppp9zzonk
mmoaGeigfMp5KJ9/Nrqno5C2KGlcbdBGqKFn3ploow8O6mmTl4IKKKePBmqqoIvmmSqVmo5qJ5mf
Tv8q66wrmakoq4yGSminogL66Keu6rkrp8O++ieimZ5qa67IlmrsmbRG+14iNZ36aaumGtnll2lC
GaWTmAKrLLfdSmkuqGB6C6Gwyfqapq7jiqkTBdLWy5y16Ob6LLK8ipttsdgy6uyw10JKIbu4unqs
sgHb63CL+LYbL7wHA9zrwAEXarGvuvKrscTE1rktwQzStc3DSVGB34vEInxrwsVq7C+pMzcL88Sr
YjphwLf66yzCD74p9IDxvvskv3qOXKa6TPeZJdBPi9k0mmLu+q3R7lZ99LrdCszo0GBXFqKNZJdt
9tkmoqy2byyj7fbbcMMd9tzOxW333SbS/Q8Xeg//PTbegAdu4dqEF26T4Armg/jiJS91huGQ12aR
4gxSjkA+mFtueeIQbp755Z5znvnoDpIOOumjYw565Q2qvqDmnyeeuuKbX3766q+/HrvtCPTt+9BH
TMT78KEPz3npxlPu+vHFI5977cbLznrlxTd//PXMS5978sf/7v2HIWqOveitP0j79OePr7760LdP
fPniu7/9+MqTb7/zkeev/0n3u1879Lar3vucR8D5GbB/8HteAa3Hu/rFr3MK2p8E9WdA/5XvggOs
X/TWJzvXze50n9Pg/7InP+zNToQk1J0GJ8hCugDAMBVE3ggxKL73ARCAMizg9dI3v/OVkHvo22EA
/y9IuRYaMS4AeCFS2sbAIU6PervToBMxKCEeHtCGNJxiDA+IQvLNkHLfCyNikggAqvxthkJkHxFN
eEMIKpCKbKSiB59owjUmT4rRO6Ie5ZJEojCxdLvroPngpzrPtbFzsfugIqknR9gtb4vPKyQjOzjH
3onxkmNMIkj+xrhOCm6PoJxLH9/iyVIGLpSoROIodYLJVrpyaJp8pSxn+cpYdmUYtMylLqmTyl76
8pfADKYwg7PLYhrTb8NMpjLrc8xmOvNAy4ymNLvzzGpa85qQ+YU2t8nNX2Dzm+SZpjjHyTZwmvOc
6LSMOx4Th3S6853wjKdfyImbK9DzKec4B4vkyf9Pq2QjMfl8JQM+0ox+KkQIYfwnXwJq0IYaU6F4
YahDJ0rRj0i0ohjNaEUuCr57Eg4GvdSnR0dK0pKa9KQoBYxGV8rSiaTUlz54KWFaOhk/0HSX4Ljp
YmqhU8xw0pQzUkmJhArUohr1qCeCXNuQeqKE3AghTI2qVKcatL79lKobIuqItIrVrjboAxcCq1dP
JFYEKLUiCiIjAASXRAatFUVOJVFcP0DXsiKgrmW1613xuiC6Msivff1rXQNL2L76FbAKAite8/rV
xA52r4uFbF4PG1nJQsiufC2sXjWUWck+1rIOymxl7/pXyH5VtKVNrIKeiYC3Lq6tC3Jt3qAqV6j/
Yla1hNXrbfcq2MAyFre/bSxvfZta3ZK2sMfFbXLFutndCje5y0UuZ1Mr3c1Sl7S7DW5zSxvc4/ru
JrKNLRnTOt7xtra1sEXvW9dqXteGl72xJe96y5tetcbXrCkZakqsu13jcve4iiWucpmrXOEGWLXG
TXCEnPvb7UqouwgerGIRi1r/Xte5xX2QgqHrYAQXWLXCDO954+teEpfYregl8X1VnNYGwbfFLZbt
eiOYXxKphL+hha6OA0xgxmrXw5cFMnYbu2ENU7fBOX6wdAFsWAFHOMkXvm5ujfxfCyOXx0Y+K0VE
LOMRe/nFMGYxjMF83xmj+MTn7TKD4jqihEz2/8D/lTKWhxxd0A43yEyms5OB+9kCdxbAlf2zZpPc
XTjrWcocRvSRD0vkDl/5zo39rk24fOYVk3m+bVUzmcP8Yvuimb1qDS9XOXRjIufYynQGLIGBO2Ad
Z9jDRf5woqdM6wVD2cGF9qyhl4xh61Z3x4d2daBdTVotT4TSYi5xl5WN4jQ7iNnM5rSXq3qQpx4k
1kL+8IFV7djHIpnYeR4yth3N4Frj+ciEfrSjeR1lW8dZwBiW9apLK+lqvbfS0l62mL/8IBmD+d/7
NvOos5rf7L760cIG9reJPW/elpvVCG81xNtN8Ton+ra+jjeqLX7oef844drGb+FYZl/1mpnfof8W
b6abPe0Vp9jk/B6zeUfMZhHNtbM45+to+2vqPeuW0U0ebbcFi1g/c5eyou3zhZUOdD5z+7JKF7a3
iY50Ch991eQmLGtJJOILdb1sNedQ2MeKVV+TvWxi3fqIvk4htpNt7BqC+9mlava5z6isPTXPCfBS
xrzPUqZuWSXggRJqMkrK71MBgBEQ75HC953x4ymoRmwJ+cr38/GWz7zmN8/5znveMYMPvehZ+fnS
Y3P0qE99TEzP+mqq/vWwj73sZ0/72ts+JnYbOFZ1T+rb+74kua8x2XlP8N+jdKkbcrvLLVnts8t9
Q5DHZWd2YB6YZ0j5YV4tbckeVwF4XwAK+r7/9xcEfvIj4PvMbz1N1ez1CoX3+VJ1avnDf34GlX/+
+Ne++s8J3mebONOwBWru1V4wRnxSpRLzZ38NAn73p4AiZ3y3h2zOlm/RFmMFKHxjhYAPkoD1x4AL
SGMQaFIvUnIT+GnTdmktB39RlRD4N34cyIAcWH/pt38r5WIWGHMTeIM6qH8GMXcs+IEv2IEfOIM0
eE0/NWMnV4E5uIQPaBJzp4EKGIQNaH5NmB9GEIKBYRHsZ4I7iIJmpoJMJX9R6ID5R39EKBlWUISp
YX3SRoEzV3JfuH1j1X3id351aIb0h36gsQ9quBdXtXwpYoBRJYgYgoUiiFb99nZy6FVgeCGs/9dO
OjUjjWh3PFgQNWJ5b7BL5XAVkriIlBghkxh3fWhQndh8n9gh26cNKTKKxgReJAiIFEKIp6hVqtgg
tWiL2pCLuagguliLhqh67CcisviJRKWLC2KMDnKLx8ggqviLqadvndZebwiC/HOKEyJUqpiNzPgg
ysiL2+iM0qSFZ4aENlhmlUgQ1oiK1aaNtsiNveiNy8iKl4dvTBiMZygQ6SghcbWL7Tgh7OiNq1EH
8pgYKYdyLlaQCxKKdsdm/LiM/ogAyqiKqiGQAzlG/reDLdcgCumDqQiR2/iQEXmPmVEHFFmRsDFp
F1mPzfZWw0iJ2OiRIemQIRmS7VEH4JgcEv+IaTp5Xy1pd8XYkL1Yi7f4jryIjOxhkzeJHEGFgfnY
ILQYiN1BkkmZHEuJEk0JIU+JIlE5lYJhkl4ZNlwZlmJJUr0wltHylWiZlmq5lmzJlpm4I2YZlyzU
lnQZTnJ5l/lTl3o5EXtAGXj5lymhB3ogLXtJg4JZmIgZGnqQmIzZGYeJTNVylZI5mVtlOIOpNshH
mZq5maBIN48JlocjInVHVhZSdM+FNqO5ZEC1bqlJIq1ZhfUimIZjEULnbuCWIq2JY7KGdkomb6bE
miVSdz/3W2GzmOYRPFYRb1R2myiSm8v5ms3Zm8zZScDpmgtmdcJ1TfUwNBhXXRJmWt3GX1P/91m1
CVp/pnPgaWeD5nRv5nGnxWhTl56GxW3kGXXmGZ9AVpsT1p4apmpRh2W62ZgRcRPd6ZuO5XOnOWEI
2m66eWeGZmE+9m6p9pwRmnFHt6C/hqAPeloYmm5G1p6/BZhDQZs4x3DqJmcSuqEM+pwpemoTqqHg
lmu7dqIdCmwwqnEtimdmh50QJ6AQQaAZ1qAYp5+RVaAhZ27rGWGCJm6ApnNFuqM0apoXd3VMl6BT
iqO+VZ6odZ1Gd1wiyhL0URO0GaQsumdQRqNHOnHoZqYuum1nmm1rmm1WtqHCaaXdiaVw+lwN16av
5qNU8XC3lqNoqmemaXCBWqMSN6XwVqZy/2qngpqmhDpnkKaoabqnxKWiCemnUiF0O6qiS2qexdV0
8wlhQReqUpqodralDEen8jmqXfqpSUdh8Dl0wymrp5pz/cmfuKWpUmGbnPmrZWch3jMHu3RuwHqs
dCesvLoQX9qszvqs0Bqt0jqt1Oqsy3qt2Jqtu1St3Boba9Ct4Dpy2jqufvgwOBCu4Eiu6ooX6Nqu
1LSu8BqvAjEF8lqv9vpN7pqvyXGv/Nqv/vqvCoEGADuwBFuwBnuwCJuwCruwDNuwDout+hqxxPSw
FGsQEnuxu5GZyDpbFVtvNLGxVYmx5KSxINtmHbt1/JCy/KAgKpuyC7KyL4sAKtsgLhuzLf/rsjDL
sgySszq7szJ7sz77si0bszuLszy7sjfLsyJ5srQksz57tD3rtFErtE/rIFBLtFirs0prs1kLs1vr
tVC7tWvGtM0ktkqLtFP7tVLrtGartVP7tmj7IHG7tm5Ls3XLtnJ7jmQrNDfRtlV7tla7tnMbtHGr
tlWbtzkLuIY7t4NLtCJ7TxaRuDhrtzUbtISrtUArtYVrtUn7s0MruHBLtz3rtZj7uZm6t8WkuJQr
uoaLt22buKLLurELurK7uFwrtqeLupBJE6p7uFdruWiLu5VbuZZ7t0U7s7UbuKDbuE75uCOLVmF7
uVHbuj87u7KrvFxrt4c7usp7tMwrtbr/CxHAMB5jA7SZS7dIS7zom76mC7jYW7ozq7jtO7TxW7Se
i7ww67ywV7JQqb/D9A48wb9a6b+pJ8AGfMDA2kIki8AM3MAcCU5nl14OPCPYh30I/HUWbG3fxCEI
2X7P9ooSksERIsIT0nUY7FaF13L3VsIWIsGbBov2CCFs53YknH1wA8KwmJEsbMP6iEl/6H5rl4g5
XI5sJcQ2KIEqTMQj3MIxzHJOrHwzl5L+V8N4U8EyfH3FF00cfMTyNYACuMIyF4BpRl9i/MXqZYFv
iMPSKME6/MJgjMTy1cVyzMU3mHICOMcqd8V5jMM5eMdjTI5hDMhrjMbLZ8IEaH1+HI07/7mTf0yN
y7TFKJx9m2bC9DjG5mhibehs9XWCS9zGiQjHaDbESejEfbyEoHbJpJySYDzF4oXJhNyFL3fCYmzD
SAxfy6ZsyKaEp9xi4sTBnuZyk2zEpszJnMyFmlzJM8zDGRnKSczDyYyDzUyO+obKQ5zJyhxz01zH
I5bNslzJzlxp2cyEYxZwnNzLyUfEmsbMXayTK0fNAJdvxZzKcCjM1rzMnnyQs2xybAxt8UzNrazH
5JXDJxbOnbbNdhzJchzOznzQKUzQhzzMXabAiKghb/zEygzHxMzNlgbRpDzQ9KzPSoyRtIzKNKxi
XriSnSzF49xv80zOgqzSpazQ9kzHFv/NhbrMyeekwzu80cB80VKMgv2Mg7ZMj/vszyNt0TTd0SSt
1K38b0D9zDB9ckpN0ELtzTEd0oUMzshc1QZJzjlNxasMhy68yion1V48yvCczm6cxvjczj0N0+uM
xwEYxZKsyMMc0Hn8wWSM0FlN1aHc0mec0Fhd1nPMyAXpb/WlyGa9tM00wYN9rFS8mZGNODk9wXzM
mZctwJNN2ebk2J7twIj52aJ9wEX4wy0M0FT1whQcxHyNVZu9OPbgCFypsTNcXqgN16wdwo+t2jIC
xXStzedcIpmt09fMxHM93CSY3FFsXqUdmrv93CntNmS9bzVS0rpdzWXTxMVN3G1n1aj/fdL+DK6B
DcKUBo1s3MxonNjlHdhMPc8AZ9NprN7nDcNlDHPu3cgGDdYX6WlrjITyLdLe3d1+7SCBIQ29tFRS
DYheyMxh/XLoHWMMntRDXYE3TdW3zcVmdst4rZIYst7oPI4uDcUgfdp+XXKhbdT2bOFZTc5T3dEN
rdVXXdAuncrVPNTbTNTeXMMeznIDTt1wbcGLTdXNbW8PLc9B/eBHzsgs3tcw/t4luNXa3ca2neE4
zmLkDYDT7cY9fcu/LMMnHMJ/neSwiTKMkB8eHdViztSwHOH2eG/QqIMTLslp/tH8fOPJBuPcTecz
LeYYvd3WveVbLZbiuNIq7dTEvOIp/6bRW93iJo3oYc7NCX7Ux2zncI7n+m3Ujw7leo7pPy3moa3c
LN3OU67GYm3jgSzhIW3Y0AzNyq3elN7Wgp2EDz3Nwz3Cy83WiNzqka7PSs5lhx3fZ623bPnZrw3E
oy3cirh/pq3Z2X3syE42BBzt0j7t1E4b4Xvt2J7t2u4VipB31f7tzbHtNAgBaEFPBg7uRiTu6r7u
foru7v7u8B7v8j7v9F7v9n7v+G58dHMH7K6XTdDvBpXvAj/wBF/wBr9EAP+vB7/wDN/wJ5HwCu/w
Cw/xHuIAFC80ILC3y+7sHN/xb6PFHh/yIv/x+7PAI3/yKF9b16Qgh9Dyh8DyLv/yLP/PIC/v8g1i
8wgQ8w4S8zYv8wtS8zx/80Lv8zAf9D1P9C1P8zTP80Cv8zeP80zv807/8z2v9EsP9FZP9UY/9EF/
9Uev9FGf80aP82Lf9TOv9WIP9kjf9F//82U/9UWf9m5v9kSf80Uv82E/9XWP98J+THY/91Yv9W6/
82df+EI/+IAfIXv/94Qf+Guf+FnP+A+C9JEv+YKf9XV/9kmP+Idv+Haf+ZUv94ZP+Z2/+EPv+Gq/
9JIP85EP+ppP+aS/+KQ/+oh/+X8vRjcB+rJP+43v+p2/+jUvIbs/+Ycf/J8P+Zzv+6vf+oSf+XxP
/Mfv+cl/+orf/NPP+YVv+mAf+Iz/H/x8b/zbz/vQD/7gP/PDD/3ZX/uDL0EWofunr/3cTyGzb/7C
T/2NP/jGT/7LP//33//ODxAIDiEgWHDgwIIJBRI8aFChQ4gOET5k+LBhxYgLFU6ciDHhRYwgGyIc
aVHjSZQbK3JMCXIlRY8nO7pE+M/aP5w5de7k2dPnT6BBhQ4lWnSnPaRJlS5lao/jIZcLoZqkKhBq
R5UGr161ujWrRJhYSWq8yPLjx61Yu4o9q1LtVJhkQ4ZFm3YtXK1ex6KcadfrV49m95aUerdsTLUQ
B7dkvBbw37YQm06mXNnyZcyZNW/mzJnt58aAM0ZmnHh01NMhF8fkG7dqa7cmTct9/0lxZuy4b8Fm
1J0ytGCwJMf2Ljy6LcuoyV/f9s0WQWfo0aVPp67UKE/QZ/ey5u4bMW662sMrZjgY8nfXpJmLz2p6
O2r0u8dHpEk6sGi7c18Krx25fnjkShMNtvvsq+k6BBNUcEEGf5quNebM8m477wjsbzwKDeROOd5c
Wy80mb5KjEK8HgPPtuU+JM451lYrrzkYtbLvOLQIBK5D+gYkqDoee/TxR+jK4yo/CEvsSsjZPpSK
yLryKrEv1DhEjEkkBzzPMSWHrBHF1NISy68tp9RLPQ21lFE3L/lSMi8179roSa7IxFEyIOu0884e
09NzTz779PNPQAMVdFBCCzX0UP9EE1V00YLwdPRRSC1jdFJKK7X0Ukwz1XRTTSP19NNHORV1VFL5
BPVUVFNVdVVWW1WqVFhjhdVVWmu19VZckeKHVVl79RXTXIMVdlhia2VQRfXSrJLFuoSLs8i3nnXs
MWnfxOtJ26rVS9lmkYTrwAaJUiZccss191x001V3XXbNRfbCFvFbDjYJiaPtu3q5VG3G9dybrzdw
2xV4YIILNvhghM19cDh855V3RgEt3LAqkYxDM0R+K9RYQ4yK9fhjkENuVS4SY5yYY3mltJhijE0O
LrUTdXwNY5Frngwam3PWGTOSCwQxWiqfUs7ICeMEWLFqJ3ZR6dz0ZBahnaOWemr/Vxks7moJ44O5
y9iYRfFo/UaUTT6m57PI3oATVnttttt2++2gHrRKRiefntnrobX+mqr8si776r9nhtg5Vj+h+nDE
E28qXsYbd7xh8nzGMULwxI78RRO7q9BfihT3/HPQN7P6t8y79dpbN/El+jzIsuuu9TC7lV1zZXuD
+3bcc9d99wXl/vV34A8NfXjii/c9eOST79N45pt3/nnoo5d++o95t/567LPXfnvuEQaAQerDF398
8m/t/nz001d/ffbbd/99+OOXf37667f/fvzz17/78vv3/38ABlCAAyRgAYG0PwQmUIELZOBQDPhA
CEYQeg2kYAUteMH3SVCD/4PD/wZdxQgPhlCEm9HCCImHQRSmUIUrdJsJXfhCGLKKhTOkYQ1tCL4Y
5lCHOzyg2rhwQyAGUYhDTJA6iHhEJCZRiUtkYhOd+EQoRlGKCuJhFa14xcxg8BVTVN8SuPhFMIZR
jGNEEBbNeEY0plGNa2RjG9noDjdGj4xzpGMdeRJHPOYRgHbkYx/DqMfM7AGQgyRkIQ0JqV4cUpGL
ZCSt/PhISEZSkpOkZCUteUlMtquRm+RkJz35SVCGUpSjtEcmTXlKVKZSlavsCSnzGApXCssokmDl
I0MRilrmUpfbw+UusxdLQN4SmI705SpvWUwm/hCZFOzlMuE2zEIKE5qncmY1rSJ5TWxmE33T5GY3
RadNcIazjN4kZzmZIk50phMo5mSnOQMCADs=

------=_NextPart_000_000F_01C6F81F.24C32040--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QI1pDe076922; Thu, 26 Oct 2006 11:01:51 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9QI1pal076921; Thu, 26 Oct 2006 11:01:51 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from woodstock.binhost.com (woodstock.binhost.com [66.150.120.2]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9QI1msT076906 for ; Thu, 26 Oct 2006 11:01:50 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 5827 invoked by uid 0); 26 Oct 2006 18:01:41 -0000
Received: from unknown (HELO THINKPADR52.vigilsec.com) (71.126.161.75) by woodstock.binhost.com with SMTP; 26 Oct 2006 18:01:41 -0000
Message-Id: <[email-masked]>
X-Mailer: QUALCOMM Windows Eudora Version 7.0.0.16
Date: Thu, 26 Oct 2006 14:01:43 -0400
To: [email-masked]
From: Russ Housley
Subject: Fwd: [Cfrg] Applications of target collisions: Pre or post-dating MD5-based RFC 3161 time-stamp tokens
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

FYI.

>Date: Thu, 26 Oct 2006 13:23:06 -0400
>From: Alfonso De Gregorio
>To: "Weger, B.M.M. de" , [email-masked],
> [email-masked], [email-masked], [email-masked]
>Subject: [Cfrg] Applications of target collisions: Pre or
>post-dating MD5-based RFC 3161 time-stamp tokens
>
>Hi All,
>
>On 3rd march 2005, in a follow up to the announcement by Benne de Weger,
>Xiaoyun Wang and Arjen Lenstra [LWdW], I wrote a note explaining how it
>is possible to apply their method also for the construction of pairs of
>colliding RFC 3161 [3161] time-stamp tokens - my original note is
>available at:
>
>However that construction based on random collisions do not posed a
>significant threat to RFC 3161 players, as all the opponent was able to
>do was to show that the target Time Stamping Authority not complied
>with section 2.4.2 of the standard.
>
>In the time-stamping setting, a severe attack is an attack that allows
>the opponent to obtain assertions of proof, signed by a target TSA, that
>a datum - possibly never processed by the time-stamping unit - existed
>at a moment in time chosen at will.
>
>Using the recent method by Marc Stevens to construct MD5 target
>collisions starting from two arbitrary IHVs [MS], and moving on the
>construction of colliding X.509 certificates for different identities
>by by M. Stevens A. Lenstra and B. de Weger [SLdW], it is possible to
>construct two MD5 based time-stamp tokens with different genTime,
>serialNumber and messageImprint fields. These fields contain
>respectively the time at which the token has been created by the TSA,
>the integer assigned by the TSA to each time-stamp token, the hash of
>the time-stamped datum. Hence this allows also the pre-dating and
>post-dating of tokens and can have a severe negative impact on RFC 3161
>based applications that need to build a strong evidence of temporal
>ordering of events (e.g., RFC 3126, intellectual property protection).
>
>In this email I'll not provide the construction details and an actual
>pair of such colliding tokens, just a short outline.
>
>The scenario consist in an opponent trying to generate simultaneously
>two colliding time-stamp tokens, where the genTime field (or
>messageImprint, or serialNumber) is different. The opponent can interact
>with the target time-stamping unit, requesting it to issue time-stamps
>for selected messages.
>
>In order to succeed in the attack, the following requirements need to be
>fulfilled:
>
>1. the opponent need to hide random looking data in the target tokens;
>2. the signed-data of time-stamp tokens need to have equal bitlength to
>accommodate the Merkle-Damgard strengthening;
>3. the opponent need to predict all fields appearing before the chosen
>random looking strings.
>
>Looking at the TSTInfo data structure (see the standard for more
>details [3161]) and to the current implementations of RFC3161, it is
>easy to see how all these conditions can be dealt with by the opponent:
>
>TSTInfo ::= SEQUENCE {
> version INTEGER { v1(1) },
> policy TSAPolicyId,
> messageImprint MessageImprint,
> -- MUST have the same value as the similar field in
> -- TimeStampReq
> serialNumber INTEGER,
> -- Time-Stamping users MUST be ready to accommodate integers
> -- up to 160 bits.
> genTime GeneralizedTime,
> accuracy Accuracy OPTIONAL,
> ordering BOOLEAN DEFAULT FALSE,
> nonce INTEGER OPTIONAL,
> -- MUST be present if the similar field was present
> -- in TimeStampReq. In that case it MUST have the same value.
> tsa [0] GeneralName OPTIONAL,
> extensions [1] IMPLICIT Extensions OPTIONAL }
>
>
>(1) The opponent will use the nonce field to hide random looking data.
>It is worth to note how the ASN.1 SEQUENCE provides an ordered series of
>elements and the nonce field, if set, will appear in the DER encoded
>data always after the genTime and before the tsa general-name.
>
>More specifically, the opponent, using the method developed by M.
>Stevens [MS], will construct two bit-strings that, when appended to the
>two targeted messages, will turn them into MD5 collisions. Here the
>target messages chosen by the attacker contain, among others, the
>genTime, serialNumber and messageImprint fields. This leads to the
>aforementioned abuse scenario.
>
>Though this may appear a bit overdone, the nonce field can contain huge
>integers. The standards do not specify any additional size constraint on
>nonces, hence the maximum and minimum values for these ASN.1 integers
>are those imposed by the specific encoding rules (i.e.; DER).
>
>(2) For any selected algorithm suite, the signed-data will have a
>bitlength known a priori by the opponent. The fields that precedes the
>nonce will have a bitlength known as well.
>
>(3) With regard to guessing the signed values:
>
>version: Constant value;
>
>policy: Known for any given time-stamping unit;
>
>messageImprint: Chosen by the attacker;
>
>serialNumber: In several implementations, the serial number is
>guessable, since it's a monotonically increasing number or a quantity
>derived from the system time;
>
>genTime: The value at which the genTime field will be set by the TSA
>can be guessed depending on the accuracy of the clock (i.e.,the time
>deviation around the UTC time contained in genTime) and the time
>required to send and consume the time-stamping request message (e.g.,
>the half round-trip latency plus the processing time);
>
>accuracy: The accuracy is a public information and is typically equal
>to one second, or lesser values;
>
>ordering: Known for any given time-stamping unit.
>
>The detailed construction builds on the above considerations and the
>resulting time-stamp tokens will be syntactically well-formed and
>obviously valid also by a cryptographic standpoint, since their digital
>signature can be successfully verified by the relying parties.
>
>Cheers,
>
>-- Alfonso http://crypto.lo.gy
>
>
>[LWdW] A. Lenstra, X. Wang, B. de Weger, Colliding X.509 Certificates,
>
> [MS] M. Stevens, TU Eindhoven MSc thesis, in preparation
>[SLdW] M. Stevens, A. Lenstra, B. de Weger, Target Collisions for MD5
> and Colliding X.509 Certificates for Different Identities,
>
>[3161] C. Adams, P. Cain, D. Pinkas, R. Zuccherato, Internet X.509
> Public Key Infrastructure Time-Stamp Protocol (TSP),
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QHDL3i066704; Thu, 26 Oct 2006 10:13:21 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9QHDLZo066703; Thu, 26 Oct 2006 10:13:21 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from machshav.com (machshav.com [147.28.0.16]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QHDHXN066673 for ; Thu, 26 Oct 2006 10:13:20 -0700 (MST) (envelope-from [email-masked])
Received: by machshav.com (Postfix, from userid 512) id 2724AFB2B1; Thu, 26 Oct 2006 17:13:15 +0000 (UTC)
Received: from berkshire.machshav.com (localhost [127.0.0.1]) by machshav.com (Postfix) with ESMTP id A7119FB2A6; Thu, 26 Oct 2006 17:13:14 +0000 (UTC)
Received: by berkshire.machshav.com (Postfix, from userid 54047) id A56CC3C083B; Thu, 26 Oct 2006 13:13:14 -0400 (EDT)
Date: Thu, 26 Oct 2006 13:13:14 -0400
From: "Steven M. Bellovin"
To: Alfonso De Gregorio
Cc: "Weger, B.M.M. de" , [email-masked], [email-masked], [email-masked], [email-masked]
Subject: Re: [Cfrg] Applications of target collisions: Pre or post-dating MD5-based RFC 3161 time-stamp tokens
Message-Id: <[email-masked]>
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Organization: Columbia University
X-Mailer: Sylpheed version 2.2.7 (GTK+ 2.8.20; i386--netbsdelf)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

So how close are we getting to first or second preimage attacks?

Received: from ppp146-100.adsl.forthnet.gr (ppp155-159.adsl.forthnet.gr [194.219.17.159]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QGbReR058983 for ; Thu, 26 Oct 2006 09:37:28 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000c01c6f92e$d45a0900$6479fbd4@reborn>
From: "Podcasts Resultat"
To: [email-masked]
Subject: Warne Writer Living on
Date: Thu, 26 Oct 2006 19:44:55 +0100
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0008_01C6F937.361C0000"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0008_01C6F937.361C0000
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0009_01C6F937.361C0000"

------=_NextPart_001_0009_01C6F937.361C0000
Content-Type: text/plain;
charset="windows-1253"
Content-Transfer-Encoding: quoted-printable

Iii freezion am Grouch Zion Heroes a City am freejibbs featuring more am =
Mpcoms Lionel Richie daz Dillinger a Silversun Pickups a Kelis!
Iii freezion am Grouch Zion Heroes a City am freejibbs featuring more am =
Mpcoms Lionel Richie daz Dillinger a Silversun Pickups a Kelis!

Personal a computing ndash console is Wikipedia free am continued =
donations keep running to navigation am searchgame redirects is here =
command.
Featured Product in usage usb gfi today of Youre Warezcom renewed in =
Serialsws clean porn popup is trojan adware or Thebugsws Nfodbcom nfos =
Crackms of Cracksvg is join world Toolbox dvd v offer Downloads.
Providing benefits of quickstart toolsfake Phish Delivered bad guarding =
Idsoracle in plugs dismayed Apples bug puts Linux riskapple ships virus!
Audio Videothe a ten am Dangerous Onlinewho ntdvmyths Keylogging vs =
Comparison am Medusa am Parallel Login Guide Finding Removing.
Energy Lifestyle or Autos Horoscope Crossword am Sudoku Stills Posters =
Theatre is Sellers Dvds is Corporate Staff Vacancies Federer hands =
victory adoring.
Abusespam help Forums Cheats Hints Classic fan Pages Shopping Park =
Indrema a Microsoft nec Philips snk Amiga Astrocade cdi is ds boy =
Advance Gear.
Are probably of first or two which provide a fairly thorough overview =
basic Loaded photos further reading in online really highlight of rest =
less Atari.
Useless hours targets bottleneck insecure am cellular am networks pdp =
context retention paging a Newsletter monthly of our scene commentary a =
documents of enterprise issues interviews of folks of scene presented =
check consider yourself Geeky Send.
------=_NextPart_001_0009_01C6F937.361C0000
Content-Type: text/html;
charset="windows-1253"
Content-Transfer-Encoding: quoted-printable

Iii freezion am Grouch Zion Heroes a =
City am=20
freejibbs featuring more am Mpcoms Lionel Richie daz Dillinger a =
Silversun=20
Pickups a Kelis!
Iii freezion am Grouch Zion Heroes a City am =
freejibbs=20
featuring more am Mpcoms Lionel Richie daz Dillinger a Silversun Pickups =
a=20
Kelis!

Personal a computing =
ndash console is=20
Wikipedia free am continued donations keep running to navigation am =
searchgame=20
redirects is here command.
Featured Product in usage usb gfi today of =
Youre=20
Warezcom renewed in Serialsws clean porn popup is trojan adware or =
Thebugsws=20
Nfodbcom nfos Crackms of Cracksvg is join world Toolbox dvd v offer=20
Downloads.
Providing benefits of quickstart toolsfake Phish Delivered =
bad=20
guarding Idsoracle in plugs dismayed Apples bug puts Linux riskapple =
ships=20
virus!
Audio Videothe a ten am Dangerous Onlinewho ntdvmyths =
Keylogging vs=20
Comparison am Medusa am Parallel Login Guide Finding Removing.
Energy =

Lifestyle or Autos Horoscope Crossword am Sudoku Stills Posters Theatre =
is=20
Sellers Dvds is Corporate Staff Vacancies Federer hands victory=20
adoring.
Abusespam help Forums Cheats Hints Classic fan Pages =
Shopping Park=20
Indrema a Microsoft nec Philips snk Amiga Astrocade cdi is ds boy =
Advance=20
Gear.
Are probably of first or two which provide a fairly thorough =
overview=20
basic Loaded photos further reading in online really highlight of rest =
less=20
Atari.
Useless hours targets bottleneck insecure am cellular am =
networks pdp=20
context retention paging a Newsletter monthly of our scene commentary a=20
documents of enterprise issues interviews of folks of scene presented =
check=20
consider yourself Geeky Send.

------=_NextPart_001_0009_01C6F937.361C0000--

------=_NextPart_000_0008_01C6F937.361C0000
Content-Type: image/gif;
name="item.gif"
Content-Transfer-Encoding: base64
Content-ID: <000701c6f92e$d4579800$6479fbd4@reborn>

R0lGODlh/AFIAYf2AAALB30ABgyKAHiIAAAAh44FdgCGhsGxscHquKu76EwYBF0tAHMRDaQuAMUX
ANgiDAA6CRlBDEg+AVg1AHI0CKlNALkxANpGAAxXABtpAkFuAFlmAH9jDJJbA8FoANtuAACCABZx
CUFyCV+AAIx6AKqAAMN7AueFDAOXARmjBUKTBFisDomVAJiqDLekC9qWAA7CCRnIDkC+BV25AH/I
AJi1ArzAAN64AAzlAh/iAknoAWTXAI3cAJrdB83VAtrgAAgAORwAOTMAQFYAR3cMQ5gAS7QASeAL
QgARRS0USUYVP1IeSnMjNJ4pM7UeOdURPwA+PSZOO0ZDTlVGR4FKS5o4SrlESuxNQQFVNyZqMTZX
PVVgS41ZAJNqOrddSutqTQCGRRWMNEFzN12IRnh4M5SHP7p8NtiAMgKrPi6aPDWqM1aRO3yiNa6q
M7ioOOCdQwDDOBnLQj3LOl3DQITHNqXORLnGN9W3QQDjNxfuPUXRN2DXMnrSPJfpR87VTtnRSgQA
ixsAckAAgGIAgHECdJ0AiMYMge0AcwAoiRQme0IjilUojnwRcZgqi78UeN8niAtGhSA/jjhJf2c9
hYk0gJVAe79JdtkxggtgiyRShDtqh1tjd3JZdpJdcbNYf+tXewWHjCZ3fTKMiWaLiHJ+fplyfcCK
jd55igOVcxmdiEqugFildIyhjZWijbKYftqcfQC7iyvJgTi/dG7JeYTLe6S8ecbNhNbHgAfpjirk
gzfidljoenfVcaPhgMLsg9nfhwcAwykCu0gBwFYAwYMCyKoAzsYJwdUItwAryCkVskUht2kdy4sf
xpYls78Zwd8ltAAzyCA0sTNCyGFIyH4ytpRBycRKwd47wwdouxRVwDpUtGhht3RjxJxTs81ltdpR
uwOCvxF+xEp9yWh+toCKyZ2IsbN4xNh+wQCaxhyZxUyuv1SeuX2qw56lxMCmseKSvQC+sSDFx0q8
zFjAzXXNvqK6tv/v4pqZsIV6dv8ACAf7APv/AQAA+v8H8gj8/////yH5BAA+9WwALAAAAAD8AUgB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKB+2SsmypUuF
/2LKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK
HUu2rNWXaNOqXcu2rdu3cBuanUu3rt27ePNejcu3r9+/gAMLHky4sEEehhMrXsw4od7HkCNLnky5
a+PLmC8mycy5s+fPoEOLHk26tOnTqFMvrsy6tevXsGPLnk27tu3buHPzNKS7t+/fOFULH068uPHj
yJMrFw28ufPnkhHNXk69uvXr2EfSyc69+1vo4MOL/8cpYbz58+jTq1/Pvr3797q/HKUFv779+0MB
ACAqH7///+N5J+CABDKGVIGqAaigWG0FgOCDED6IlIMEUWhPABhaaKFAFDq44YUXZoihQSJyKKKH
J4ZYYUEZhphihSW62OKLMg4Uo4wjrqhjjRyySGKLO4KoI5ALYlVHkTRppKGNQ/oI4oceKrRhlE7C
GGSPVzLJ5IdCBtmhllxWuSSYVWJpJpVnphnhmmsdOCaXaJqpZphaZglnl3dmKWeccna5JZlSAroi
lGUOuuOdSCY6WY9jGnrlm4EW6iejdVY6aaV8TnonpAuhuWmhdPKZKYiKlnrWRlOSqKmYJt5oI5An
ov9Y4peXEnrQi7HiWCuPOIZq56osAomnpDmyaSxmqfpoq6OXJpRpnk+qqqefzxIrZKOR9hnttFhi
C+yx4LZ04J6qLvunts7uyiq06FKrrqXbXttQssy2262r39pj6r53WUqvt5Ta6y67exLs67m/Ckpr
p2U2yq6o3OrL78RNcQSnsK2m+yq+PObqsZUw0hssrCmGeWOqud76Y7EZ3wprw5KGK/PMNNds8z42
56zzziKNy3NFFAf92s9E1yxA0X3lg/TSTK+lNEFP25PP1FFHLZDVUEM9tdRWP6001WAbFDbXYYO9
9dYDYY321WlT3bbZUhf09dldv1110yR5gndEB97/zXbafwMudtyCr0143QfVjTXhWmfdeOGOCx74
314jbrlAQmceHuNeD6524owfzjnopEcuOeB+o6663KZ/Lvrdi/+t+ezOsZ366qfj/nruk5vee+i2
5/617pMjDnncsCP0NO3pkYDk6YsP7/volFc/uPJuk+222dJ37njn0bfOvfXgvy078+jbxZHxxIcf
uPfIl66Q9NMnH/nw7hfPuujBux773gBsDPuCV7+x8S9+11sI/XhnP8nhL4Gh89/7EHi8AFpQJEso
iesm+DsJRjB2/1McBIu3Qa7pr3X7g58JI3jBFr7EZ9HLnvlGOLcFGo53drsa3MbXtRKuzYDQY932
/x6nPe+l74hzcaESl8jEJjrxiVCMohSnSEVjlaKKWMwizZDIxS560T0O+KIYx0jGMnJRMMPQohrX
yMY2Nm08+zGjHP/jxjra8SBzzKMe63LHPt5xj4AMJFj8SMg2CvKQVVkAIv9RyEZqcZGQjKRTTlII
BJHCkZjMpCY3yclOevKToAylKEdJylKyUZKoTKUqV8lKqZjylTZrpSxnORNYogUJtuyMz04TnIv0
MpeBSVSCboKRXwLzL5s7JnU+8BBmGseZyBmXfvSjFmoOBAAcMSZFevmBbkLTHt6E5jfBGc6BdJMg
5zQnOr2pznaa85zpFAgzwynOgjiznOSkZz7FCf9Pfe4TId/EpzzdSRGB0jOeAl1nOv0JTnTm0574
DGg7hYnNtlhTIBXViDYnEhyJNrSd4/RoPMmpznoO9KModShJS6rSkKbUoydF6T0NAlOVvtSd44xI
TVPKU3s6VKQ4pelPCerMZF4kowSZZkWVao9pYrSpF3VqU6G61GsWBJsZXao1mSpVqmbVJTnt6Tx9
OtSZ1tOkH53pQczK0qG6da02NWlOwxpXoZZznghlZ0NdStaY9jStcHXrTm+qVpsWBylIfapVv/rU
qF4Vqou1alKnqtjIVhark6XsRiWCk7DOlacuHete2yrTgdIVsGf1aWgTAlO5ClUhaAXpO0m718//
9vWmr/WsakH7WtP+lZlGtUhiKdtYyU4VqYnFrGSVm9mqTpaxx83sS/gp2rf6dbRsLe0/5XlawKJ2
ty3VK1HFm1Z/JjSoZI1tdUfbW6IatrfsDK1tDYtXgEbzKMNFLnG/ql+vEpeyzDWucrkqYK9eFHPE
9OVNVgtegrJ3oTFVa2rtW9r1stfBuD0pUGEL39y696C/be9g32vhsfJVoRDWbXArkt/nFli//G3u
fy8b3eLSeLhoYbB1eXtPCUdUtn/1LnYbfN0Ma1fIFK5rej/cXgzXtLs69q2Ri1xYDEcouS6+cZZr
TGODIJe5YLasYnFskg1r+LZVljJpC6vbl64X/61VfjJ65ytW+qJXzRdG823r7Nc3R3jOHX7vcKQp
Vabud7GG9m9/Z1xZyCq6wP5V7Gb5lmCGGvSuBrUrkf2sUDfvM6QjPa+c42te8tLX1PAML4QBamqx
6jWgmBavRF9NZSUL86gsZsmkIbJrnnX3OkV9Hq4nQuaR9Nohx97Zr5c5EFo6+9nQjrZvqJFKZVob
QdLOtra3ze2ddKJI1w63gLpNbjOK+9zZKbe6183udrv73fCOt7xbie562/ve+M63vkezy5MkGzD/
Rva8laLUfQ17IYkNuF8UzpCB41c/69FIoh9SbOkaRwAYP5o9Mo7xgWhcIEfL+L7xtmiHVNy4xf/5
+MZX7nGQt9zlFsQAJxHrZURTs9BUvSbONZtgA91E5S9vucZVrnGHCy0jLbbxoR0L40anBugwFzrL
gz5yzJzcLYke8Iu3zGXifFzkQA851KFedcVcXaNHeWyNoRvgts+Y4XzBSdin7vKQF6ToRvdNHPOi
dq1rWcxdl5hNLiP3u9N95UMnCN7znpu952XRbAe8250L97gEh+h0T3zUF8942zieKhLv6qFvnPWd
n100HBe7yKOO+I6XPTGnF0zsXy8SdrRx9oDBPe2Vqfvd+z4uvUe7UTxSeZ8P3jidLwsbtTES5rPF
+b/P/cSdHi7oD8T6BdGG9q+vfexfXyDY937/Qqzffehv//sEIb+1nxCakues+9wXvz3Cn/6DOJ/+
DIE/+Ot///1nv/7RV3PCVxRNN2CF1lUVVXyrQUzM14AA+H8Q6H8PSH8NeH72h37713/zZxD0l3xJ
8XlEgXTPVVVYtlwC4oARmH7lJ4EbGIEUaH4IAYPf13/ih38BqHYKZhRNp3SNlnA9Zxq9ZIEY+IAb
qH4u+H9GyIFDeH8aaIEd6IGIFRZK5VyBN4U+eHy81HNC2IIpiIIsKIEUSIQTKIZF6H9PCIX4BRZJ
V4Uw8YOl8UteyIVEGIfeJ4MzSIZgKIZN+IXMh4Yf+BVrGGD/RXluSBrB4YBJ2ILql4gsKIOM/4iB
jLiHF+iHg4QRgYhRB+hYJ+iEK8iFnTh/+qeE8Rd/Wwh+nfiJjWiHcniDtiR/GuGKq1gSsIgcxcCK
qjGLGOGKuNgRu2iLHEWJs5MEY5EDwFiMxoiFvmgcdpCMBQEJzPiMbXiM0jiN1FiN1niN2JiNpYIZ
awCN95YbYYBYIKiN0FYgB+aNj+Qf0wRJ6kCOPLEm54iO8sgS8TiP9niPptRv+NgR1ugDabFsGAGQ
KxVYJyGQAqkWdBZkG3GQ+8hdrUaQDFlQDdFmCgkSUOZkcZGQEUmQHPlQRbZvSDFifbWREgGQFEmS
FnGRH5mRTYaSgvZOsXVS15gRs+Zgd+WR2/8FUSmWV60WUeR1k7LWk3MWlKsGWvHlkT02V7RGlJ71
arTWVgxlWjzZlEn5WSbWkftYk7XGXbR1YrXVlXoWYlyJZyc2YWSJZDiVWnQ1a2bJW3ZWkzuFUFPW
UvZFXXLZkDAplydpXV7pZ3FJl4F2lrslWlrpW2vJZIcJln/5lmVFYnzJWis5kGaGl0C1lyUVlZ/m
l44JZCP5U5g5ZFXZT5gGmX1WXiJGWJjZl4Q1ZWx5XtsFZXEWmWqkCotRmRC5Y3u2mjYJmJ1JW3B1
lXyGm38Glozpm3tWmEO2m8apZBfJaS4ZgK2VZMipmoU5UrhlmYLZm7opZdiZZ9T5mJupZqn/xk96
tphoyVKc5nshmVCnlWog9ZA/9p4WlpNr6ZwPeWT0+ZS/pZnwqZ/lZZ0OWZUw+WDumZd2uVZBiaAH
KpPuKBSkiZcviUfUuAhJkWQQamUSWo0XuqEbkRV/0KAgmnYcOqIkWqImOkUr0UIhuqJ6caIu+qIw
ahF+GAUsWqM2eqM4mqM6uqOFGKM++qNAGqRCOqQuyqNGqhVECqNHuqRMOm9b0KRQqkdJOqWMkQ5U
eqVYukRR2kp5sKVe+qVgGqZiSktZWqZmeqZomkvjwg9syg8C0aZsOhBuKqf20KYFEad0CqdxOqdv
ShB82qd+Wqd6GqhyCqd06qd7+qduqqd//yp4Y4ofGqGodUqofFqpBoGnfdqok3qogMqpmYoQi+qp
c6qpoyqpmromNEAQ4MChSHGqjRqqm9qpeTqrl/qpseqpk3qquYqrsEqpsdqrhPqodIQRrnqnu0qo
gWqpxXqspGqsutqrr3qrgAqt0iqrtKcAFtSqhQqsudqsxrqpizqo4Dqud8qogmqov2qt3Equo3qu
dkoQwuofGRGt9Cqt3rqrxaqstZqsB2Gp9lqt7fqpupqmfnEDxnYU9cqvt3qvofqslbqstFqu75qw
viqw0Riv9RGpCjutnHqvglqt6tqvzrqvEUuuFfum6wqyBIsggyquC3uu34qy7oqp0Uqymf/ass6K
rjMLs4oarug6sCsbtMp0DkILEZRQtIWhj0i7HEGztNgRccdRjzlzdcE3HGRWtcaitA0xhRKBY1y7
tQcXtihncVYoiCWoEKd3YII4tj0ItghRcbqHtUclehZXtwwBXQ2nHi+BtV5rtwchtxvRtzW3hjN2
tgmRtu6Hg2SLcFLLaIDnF1T7thEBuMaxGQg2fMT2WFoVVTdHt/1laJjFVTiHVU41ujmHiXR7utPX
t4Q7enabiZvbYjFmYMe1VZ4rtV9GuvUYZqO7VaMHugBmuyToutQXabHbWL67uahrgMlrTVDbEslF
hWwogDxIuiaIaF0WXUznt2P2t97bunj/W7zd27ZbFrojeL3cC2lsK2ZMF2Ozi7zia73Ey2gFeL7w
23eS52iOmxxae7cE1raGi3KTJ2Psu3U7KL4A5r04GMDhu78JTL7Xa775S78IN7ZXi75dp3XSG2bf
y3XUV7/5K7jvm8GOeh4GgQgmcbaf28C0a2BuN4iu675cl187p7jZ+8GOS8O+u7znKMMH/MBXVWxf
tr6/O8MJHLs3l1RZVboeTL9cq7tMLHk1PMBEfF+Y27ULvLg5TL0CDMDqK8HVm8VbHMSeO7gKDGks
bMAw/LmHK7n4+7fAG8I21rpcRsWva8aKy8FAbMdT1bRxK8bkK7iLy8YFrGUH3MMYbMF5/4zHNsxY
eGu4SbzEMOzAF/zGjbzG5dvFsvu4lazJmFzIe/zJT+XHWEy2majENry8EBzHMUzCOafDkqzEUdzF
XCzLwhvL0zeIzOvK+nu6ZNy5Q1y3fKzHxqtzS5zE6Qu6pge7G4yAzLvBJWweREO5l0HNn2HNQpvL
qaHNyYHNF9S/TpsRNwFx7RbOIUET61htaNHJhbG2HsG3QbwY3ry388w0SivEs5zK6UsRkcu97twR
J6fNflfKc9u4DnzQ/nvLBl16nKu2zpt3Z3zJEV3LJRHAj/sRcFvBVUwSibvRVfvDaGvEhNxsEA27
qTzAqQvJtXvMZpzSfWe67+vIztzQjf/rtcmraDCtuqhL0MtVuia90sY8vG3ce8PMaIxHwCe9xuGr
0pqoyE3tdCi9dFsnx1Wc0X4HY1rFyZPLyOpbuyEc0C0Mtj8MxQnobABdvJs8wYqs1lA9yUGdzxLM
u2sn0skc0ledyVoNEWktXWMtym6szwLY1x1tElkQS2nHynfc18JsxJHG1oWLyUKtvUBMwoOdw0zs
XIecZasLzEl9iV/9v3D812/7yH6NTU1RBV4kguPb2Yy91mG81G7d1iAs1wNN2XWdxXcNypKNwKLN
gzfMx/Eb0m08yK0NTI7c22D2wq6NzEqHZe7n3C4G278tyjss0bsNzaRNzCaH1F1d1IL/TMt0LNj7
vEYHUnpwjMyXnctfe9nNVcbP/dI33dY9ONMsLb22rMoDzco7yM2M69Ccq8phjdhvfbwfvN70HdSX
60WXoBQ8U8/jHS4Obs6qHRIRTh0VXkgYm+EanjkMMDsSDo0bHuIiHuIf/owjfuIonuIq3hXUtuIu
/uIwvkclTnEgGeNPMY42bkYw0Bs4DoUzTuM/bosXHuSjNOSElONQ0eNIrqNKftREfoNLHqWpEQxP
/jNEQQRRnuVavuVIkQw5cQ1c3h5VLo+2MOZmfuZFA85ozhwGt+bDZCpu/ubbaA+HUOeHIBB2XucD
ced7Tud6ThB2jueBXhB5Huh83ueF/37oeE7odE7oie7nd/7ngg7ogP7oj+7of57oh57nmB7plF7p
ka7oig7pnD7qoc7poG7ook7qql7qg87qkt7oe67nsR7qlQ7rfk7pmo7puY7oqC7rfU7qgl7owr7o
n87n/ALsjb7qwL7pB8HnzG4Q0b7oo87ouo4Qpj7ps47o0v7p2O7tyq7szu7t1S7rtf7twc7tCVHt
557u4d7s1n7twX7ute7pjg7u5W7s9H7sjD7t0T7u8B7NSFLu2Q7t4D7vDTHty64QBY/uCG/wzs7u
Bx/v3e7u1F7x+Q7xFu/uDb/u3Q7w4l7x4S7xzG7vC6/xJM/xHr/wFy/v6v7s5J7u4/+OHhlB8P0+
8jD/7jlv7C+/8y0v8vpu7vAu8Rs/8Sp/80if8yaf8Qdv8j7/8/4u8tme9EIf8VX/7ktv9EFv9S7/
80AP8k6f78ay6bTe70Qf77/+9ZZO7E2v8zjP8vYO8uLO9qlO8Sl/7ytv8G4v6muf9riu9/5O7H7/
9gEP+HC/7IIf9EWv+Brf9eb+6jxf7G1fHUjR8dw+9RS/+Arv9EDP8p0P+IYf+SHvEFFP9V5v7Vz/
9aaf+UOP7xj/+TLP854O7Y0f8wrP7xdv+aI/+oo/+WHRpa6h+4df9Dbv88Kf+Zxv8aCv735/+ysf
+XeP+69/+kff853f+tUf+03/63r/f/Lanvyp7/ZCn/umf/a8j/nGTvM13/XdL/e9v/dtL/ayv/ui
3/3WX/oOz/vQr/zED/1MDxD2BB4SWJAgwYIJByq0h3Cgw4YJIS6kaFCiQoQZJR5kyBHjxosMKUI8
5LGiQ40WVZ78KNLlS5gxZc6kWdPmzYclD+pEeVEnxpI5J4asuJBn0I5IG/IkutSkxYkkNzIFqrSo
0KpPowYlObRoVKc/p/7s2vSoVrMfyYIcupNp2ZVVIxp0a9Xp2JZfm87F2dfvX8D/BA8mXNgwYcCJ
FS9m3NjxY8iRJU+m3PfwZcyZNW/m3Nnz58yVRY8mXdr0adSpJYPWDMD1a9axZc/m/6za9m3btHXv
5t3b92/goF8Phx3ceGjcyZUvZ97c+fObw6E35j3d+vWXx7Vv597d+3fw4QlLjdv1KF2uefGG7QnV
btj1ZsWKpLp0L1a8Z9vOv0tR/H8AAxRwQAJlI4+lttTj66oF0eKrvbQa9Gklr8izKkEKXfJKwgX9
K/BDEEMUccTd5vJIKgwZBOu+Dk+8L8UMIYTRqAcVjGjDDjXMcS4Se/TxRyALNHFIqDp6UcEK1WrR
SBt7kpHJCSFUcUcG6WNPpSCz1HJLLnUbMqUaIxyLvwfT82lG/DBsr74jU1pxQh1jApPILuu08047
byySJTHjWhLOIt/UUU2V5vRTT/8a23wJR/v04hFPSCOV9MOH6BpTvRkFRXTPAwdl8rwwFU300Kds
9NNCgSZVdVVWMWvsTUE11VRCVPmMsNY9d8S1UTE39BVKKrETdlhir6vuT2RzfMvU80Cl9T026wOr
U/SkfA+++Kg8C79HW/X220iLFXdccss191yFlDDtWHTbHY27YcCVd1566/3nCnzt1Xdffvtd9Qp/
AxZ4YIILNvhghMNzd2GGG3b44WETlnhiiiu+DGKMGx4mY447Xs1ikEMWeWSSSzb5ZBE9Vnllllt2
+WWYY5Z5ZsCYoPlmnHNOiB6de/b5Z6CDZg5loos2mkShk1Z6aZaPdvppqKOWetV9H6YmmWms7ZEi
a6679vprsMMW+7RpcKZkbLTTVnvtYaMQ2mq445YbObbrtvtuvPPWe+9U5/a7R1z+FnxwwgunlG/E
z0VgJjESp85wyCOXfHLKK7f8cswnd3xzzoPO/HPQVe18dNJpDv101FNXfXXWW3f9dVdLP+0R2WtH
LSAAOw==

------=_NextPart_000_0008_01C6F937.361C0000--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QCghEo006711; Thu, 26 Oct 2006 05:42:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9QCghp6006710; Thu, 26 Oct 2006 05:42:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mallaury.nerim.net (smtp-104-thursday.noc.nerim.net [62.4.17.104]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QCggOP006703 for ; Thu, 26 Oct 2006 05:42:43 -0700 (MST) (envelope-from [email-masked])
Received: from uranus.cry.pto (cryptolog.net8.nerim.net [62.212.120.81]) by mallaury.nerim.net (Postfix) with ESMTP id C00254F439 for ; Thu, 26 Oct 2006 14:42:32 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1]) by uranus.cry.pto (Postfix) with ESMTP id 5108944172 for ; Thu, 26 Oct 2006 14:43:09 +0200 (CEST)
Received: from uranus.cry.pto ([127.0.0.1]) by localhost (uranus [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 12743-04 for ; Thu, 26 Oct 2006 14:43:06 +0200 (CEST)
Received: from isonoe.cry.pto (isonoe.cry.pto [10.0.1.15]) by uranus.cry.pto (Postfix) with SMTP id EA01B44170 for ; Thu, 26 Oct 2006 14:43:04 +0200 (CEST)
Received: by isonoe.cry.pto (sSMTP sendmail emulation); Thu, 26 Oct 2006 14:42:36 +0200
From: "Julien Stern"
Date: Thu, 26 Oct 2006 14:42:36 +0200
To: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
Message-ID: <[email-masked]>
Mail-Followup-To: Julien Stern , "[email-masked]"
References: <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email-masked]>
User-Agent: Mutt/1.5.11
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at cryptolog.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

On Tue, Oct 24, 2006 at 11:52:08AM +0100, Stephen Farrell wrote:
>
>
> Julien Stern wrote:
> >On Mon, Oct 23, 2006 at 05:11:06PM +0100, Stephen Farrell wrote:
> >>Julien Stern wrote:
> >>>For instance, we can take an s/mime message that was sent to
> >>>this very list and add certificates and CRLs to the CMS envelope so that
> >>>the signature on the message will become invalid because the certificate
> >>>will be considered to be revoked. The only thing you need to do is
> >>>to add a new Root CA to your Root CA store. Would that be considered
> >>>"Hollywood" or "real-file ?
> >>If you can populate a new CA in my root CA store then the game is over
> >>already - I assume you would just feed me bogus certs.
> >
> >But if you start with the assumption that all your Root CAs behave
> >nicely, you have no need for the new validation rules requiring
> >the same trust anchor... :) Oh well...
>
> There was - maybe someone else remembers the details, I'm afraid
> I don't really, and haven't time right now to excavate for them;-)
>
> It was something to do with indirect CRLs and the upshot was that
> so long as there are no CA name collisions under a single root,
> then none of the roots could cheat on one another in any interesting
> way (when the new rules apply).

Stephen,

I do remember the discussion and I already pointed out at that time
that the new rule did NOT prevent the attack as it was envisionned,
(to the best of my understanding).

Now, it seems that several of you feel that I'm wasting everyones time,
(and I apologize if I'm indeed completely out of scope).

So, I'll just leave it where it is. If someone is willing to take the
time to explain what the "cheat" is, and what the security assumptions
are, I'd be glad to take the time to mount an attack under the new rule.

Regards,

--
Julien Stern

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QAOWSj075833; Thu, 26 Oct 2006 03:24:32 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9QAOWi5075831; Thu, 26 Oct 2006 03:24:32 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9QAOVld075797 for ; Thu, 26 Oct 2006 03:24:31 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: RE: SCVP protocol security question
Date: Thu, 26 Oct 2006 03:25:46 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: SCVP protocol security question
Thread-Index: Acb4zKehLgD7EAl5RJigFxl22WvS/AAHEAMQ
From: "Santosh Chokhani"
To:
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9QAOVld075817
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

No.

You assume that DoS attacks are not dealt with.

I think it is true of most of the PKIX RFCs, i.e., the protocols do not
protect against DoS attacks for the most part.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Radek Michalski
Sent: Thursday, October 26, 2006 1:24 AM
To: [email-masked]
Subject: RE: SCVP protocol security question

Hi,

So, do we assume that usage of those protocols is limited to secure
networks? I.e. fully isolated GSM network where all devices are trusted
and
security level is applied in other abstraction layer?

Greetings
Radek Michalski

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On
Behalf Of Santosh Chokhani
Sent: Wednesday, October 25, 2006 6:02 PM
To: [email-masked]
Subject: RE: SCVP protocol security question

These protocols do not protect much against DoS. An attacker can simply
flip a bit in the response and cause DoS.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Radek Michalski
Sent: Wednesday, October 25, 2006 10:01 AM
To: [email-masked]
Subject: SCVP protocol security question

Hi,

I would like to mention about possible vulnerability I think I found in
SCVP
protocol (draft-ietf-pkix-scvp-28.txt). Specification says (chapter 4,
page
40) that almoust every success response must be protected by the server.
It's reasonable and fine.
However, error responses in some cases (if SCVP server is a public
server
i.e.) can be sent unprotected. Now, let's assume that an intruder was
able
to gather or just listen to client-server transmission. While having
informations about client request, he is able to send an error message
to
the client before server will do so, misleading the client. Because
error
message can be sent without protection it's quite easy to generate it
having
only the knowledge about client request. In that case there's
possibility to
perform DoS attack causing client to reject queried certificate. Of
course
source packets will be forged to put SCVP server original adress in
sender
fields, but there's no need to intercept communication. Simply, the
answer
that will arrive first will be taken and analysed.

Am I missing something about SCVP specification or is it a possible
field
for client misinformation? I know that it is not easy to avoid such
protocol
behavior, but I think that it's reasonable to reduce number of
unprotected
error messages (error codes) to minimum.

Greetings
Radoslaw Michalski

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9Q5O8vL012352; Wed, 25 Oct 2006 22:24:08 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9Q5O8OO012351; Wed, 25 Oct 2006 22:24:08 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from vip.pnet.pl (mail03.bazafirm.pl [193.109.91.133]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9Q5O7iS012289 for ; Wed, 25 Oct 2006 22:24:07 -0700 (MST) (envelope-from [email-masked])
Received: by vip.pnet.pl (Postfix, from userid 7302) id 94E4A16353E; Thu, 26 Oct 2006 07:23:48 +0200 (CEST)
Received: from zoi04 (webshielde250.hutmen.pl [195.117.24.194]) by vip.pnet.pl (Postfix) with ESMTP id 2FC5016353B for ; Thu, 26 Oct 2006 07:23:47 +0200 (CEST)
Received: from (unknown [172.16.0.34]) by scm.hutmen.pl with smtp id 1be2_3468a170_64b0_11db_8e7d_0014220a362a; Thu, 26 Oct 2006 07:09:50 +0200
From: "Radek Michalski"
To:
Subject: RE: SCVP protocol security question
Date: Thu, 26 Oct 2006 07:24:08 +0200
Message-ID: <[email-masked]>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.6626
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
In-Reply-To: <[email-masked]>
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi,

So, do we assume that usage of those protocols is limited to secure
networks? I.e. fully isolated GSM network where all devices are trusted and
security level is applied in other abstraction layer?

Greetings
Radek Michalski

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Santosh Chokhani
Sent: Wednesday, October 25, 2006 6:02 PM
To: [email-masked]
Subject: RE: SCVP protocol security question

These protocols do not protect much against DoS. An attacker can simply
flip a bit in the response and cause DoS.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Radek Michalski
Sent: Wednesday, October 25, 2006 10:01 AM
To: [email-masked]
Subject: SCVP protocol security question

Hi,

I would like to mention about possible vulnerability I think I found in
SCVP
protocol (draft-ietf-pkix-scvp-28.txt). Specification says (chapter 4,
page
40) that almoust every success response must be protected by the server.
It's reasonable and fine.
However, error responses in some cases (if SCVP server is a public
server
i.e.) can be sent unprotected. Now, let's assume that an intruder was
able
to gather or just listen to client-server transmission. While having
informations about client request, he is able to send an error message
to
the client before server will do so, misleading the client. Because
error
message can be sent without protection it's quite easy to generate it
having
only the knowledge about client request. In that case there's
possibility to
perform DoS attack causing client to reject queried certificate. Of
course
source packets will be forged to put SCVP server original adress in
sender
fields, but there's no need to intercept communication. Simply, the
answer
that will arrive first will be taken and analysed.

Am I missing something about SCVP specification or is it a possible
field
for client misinformation? I know that it is not easy to avoid such
protocol
behavior, but I think that it's reasonable to reduce number of
unprotected
error messages (error codes) to minimum.

Greetings
Radoslaw Michalski

Received: from mail.bossong.com.au (mail.bossong.com.au [203.59.148.236]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9Q2UFcG081536 for ; Wed, 25 Oct 2006 19:30:16 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000f01c6f8a6$5185a350$ec943bcb@MAINTAINENCE01>
From: "However"
To: [email-masked]
Subject: Business amp Feedback Developer
Date: Thu, 26 Oct 2006 10:27:44 +0800
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000B_01C6F8E9.5FA75CB0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000B_01C6F8E9.5FA75CB0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000C_01C6F8E9.5FA75CB0"

------=_NextPart_001_000C_01C6F8E9.5FA75CB0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Laquo User cp am Calendar a Members in Faqs Sitemap Support Name =
Password am Remember me of gt!

Sns bb ua Adsl yahoo is rss Internet Guide Copyright or all Rights =
Reserved a Buster a on. Laquo User cp am Calendar a Members in Faqs =
Sitemap Support Name Password am Remember me of gt!
However lower traffic in put down notch score excellent is looking true =
real life room Players.
Been functional high visibility breaches brought need address into =
domain partnered am Dynamics or leader help teams or these is challenges =
Clearquest Tester Inspect Listen Brian Bryson Ryan English learn is.
Webcast Ensure ibm Rational spi Testing has become mandatory focus area =
of qa been functional high visibility breaches brought am need address?
Sable Member tell them stop drinking beer in long enough post good shiz =
hell do it while yas drinkin am just is dont.
Breaches brought need is address into domain partnered Dynamics is =
leader of help teams these am challenges Clearquest Tester Inspect or =
Listen Brian Bryson in!
Address of into domain partnered Dynamics leader help teams these =
challenges Clearquest Tester.
Published This in is only debating and commenting is those news opinion =
am tutorials of add Thread or to Digg Google am Spurl Blink a Furl Simpy =
Myweb a Page of a Previous Next Tools Display Modes Sponsor!
------=_NextPart_001_000C_01C6F8E9.5FA75CB0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Laquo User cp am Calendar a Members in =
Faqs Sitemap=20
Support Name Password am Remember me of gt!

Sns bb ua Adsl yahoo is =
rss Internet=20
Guide Copyright or all Rights Reserved a Buster a on. Laquo User cp am =
Calendar=20
a Members in Faqs Sitemap Support Name Password am Remember me of =
gt!
However=20
lower traffic in put down notch score excellent is looking true real =
life room=20
Players.
Been functional high visibility breaches brought need =
address into=20
domain partnered am Dynamics or leader help teams or these is challenges =

Clearquest Tester Inspect Listen Brian Bryson Ryan English learn =
is.
Webcast=20
Ensure ibm Rational spi Testing has become mandatory focus area of qa =
been=20
functional high visibility breaches brought am need address?
Sable =
Member=20
tell them stop drinking beer in long enough post good shiz hell do it =
while yas=20
drinkin am just is dont.
Breaches brought need is address into domain =

partnered Dynamics is leader of help teams these am challenges =
Clearquest Tester=20
Inspect or Listen Brian Bryson in!
Address of into domain partnered =
Dynamics=20
leader help teams these challenges Clearquest Tester.
Published This =
in is=20
only debating and commenting is those news opinion am tutorials of add =
Thread or=20
to Digg Google am Spurl Blink a Furl Simpy Myweb a Page of a Previous =
Next Tools=20
Display Modes Sponsor!

------=_NextPart_001_000C_01C6F8E9.5FA75CB0--

------=_NextPart_000_000B_01C6F8E9.5FA75CB0
Content-Type: image/gif;
name="wrong.gif"
Content-Transfer-Encoding: base64
Content-ID: <000a01c6f8a6$51841cb0$ec943bcb@MAINTAINENCE01>

R0lGODlh0AF4AYcJAAAAAHcABQSMAHdyAAABg44Aegd9c77Gv7jPuqa75DofDFMtB4kbDZQlALIs
C94iDAxGARhCCUtLAF83AHI7ApxOAstFBOZJBgNmABJrAENpAFdYA3dYAJ1fCsJtCu1ZAAB0ACOE
AD10B2yIBXmNAJZ6AMR7ANZ9AACpACueBEeXAFGuDISZAJ+WAMOWAOWrCQDACxKzCUnIAGbLAHLD
AJfOA860AN7NBADZABzsAEbkAF/gAIrXAKjrALTRANrRAQsARyAAN0gASmUAQoYASakATb8AR9oA
OQQUPRomQEkpSGQZP3cmNpgoOL8iTd8SRgBGNSNOSEA0MlM1TYI7PaRCNsg6RudOTABjSCFTQ05r
NWNWP35YBqtWR8JUNdhgMQCCTRd8MzWHQGl1Noh2SZSGQ8h0TNGLSQaaSx2RMjmRSGOrPICYRpWU
Q7yjMeqaPADGPRHIOknLSmGyTo3IRK62Mc7OOOTONg3XOBvRRE3pTlPtQHvXMabXRbLaNevUPQAH
cxQAfToCdmAAf3kNiqoAiscMgeEAhgAkhh8tdUwTf2gfiYMkdqoijbkdgdwncgA5fiE2cTFMc21H
i3FEiKs+dMczetU6dABffBVrjTFVd2dTg4dVg5Rggcded+lXjQCNjSuEhD95dmeOcoFxhJaCg7Z5
gtlziQCVdyCnezqlel2edICjg6ydi7esdNecewS9gibGg0W0dmzCjHO8h6C7irPFhN7JegjjeBPc
gT7RhmbgcY7Uia7eg7LsitjuegIDzhsAuDkAwVkAuH4AyqgAtsIAzuQOzQAjyhgTxk0stFQozHkT
vK4hybwkxdYUvgBAyxczykw6u2xOsnFKvKE0y740zuZDugBjsyxls0BRxWFotHtYvZNTzL9ttNFg
wASBuSJ7yUSCsmiJtXt6y6aBtbKHx9R+zACptBKVzDmdzWeUzo2ruKCnzrOsyuGnzAC6zi7LwzS4
vljDy3fCuq62uPH/4ZiaqHF7efYBBQD3AfDyAgAH//QA/AT8//3/9iH5BADwv/sALAAAAADQAXgB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKnEnT4b+bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evTmuK
HUuRFtmzaNPOBMu2rdu3cOPKnUu3rt27ePPq3cv3n9q/gAMLHkz4Yt/DiBMrXsy4aOHHkCNLnky5
suXLmDNr3sy5s0oPnkOLHk26tOnTqFOrXm24sevXsGPL7sq6tu3bmWfr3s27t+/fwIMLH74Xt/Hj
yAETX868uXOpyaNLn069uvXrpd9p3869u/fv4MOL/x9Pvrz58+jTq18/HvtCO+4hBmVPv779+/jz
6y//vP9rhvkFsN+ABBZo4H3xJYhRUAJy1+A7AUT44IPaNSgghRBCKGGE3m1Y4YYXgqihg91JqKGI
Dnp4ookorridiitySOKMLlZYYocm0pjhjDn652NvOwZJoYU3ZojhheINGeSLOOpoo5NMMonhkk8+
OWGV4F2JJZFOKmmjlzte+eOYswmJ5ZdFRhlmkh22eaOWXWZJ4pRHtqnllGlyOWeaZ0pJI53vkCmo
XgAaqaafcVrJJp99Itkoo4c6muieio4nKaB1QokmpTcq6ClIkdrJ6J0tvpgjiCF6yCWgmsb4oaqq
2v+ZY4x4LokppDDC2WiD8QHwKahbigrlpedJemiVxp5Zq5KsHmuomeSBiaizPB6bqXbu+frrRPMF
+yau0JaXLJVmNttnsOaSSyy530m7KbVRlkolhYMGBQAA9dK2kLV/UruunNM6O2S6y3IqcLWVWson
nOYm62531mm7LbDqzvpqeAPDaKqMqNJq65Eynuuqx3jmOqe8Alt8YpanLsxndRIXxMbEDXV74M04
56zzffnyhG/PXhW689BEF100zUhTZPTSTOOX9NNrAdX01FSjB/TVzXFRVNXa5cP119xhLbZzDHnN
ndnv5KM22mh3DV7ba6cNt9tr1+2d3XLbXbfacp//3R3f27Edd9d7e9122nn3HXjggyP+DtSQvzQf
24tXfvjhdPutuNuOc36335iHPvfZo49eueecmw146pqbPfbrgnau+ueXf2d467Lb/vbnf9N+eubA
a4567Y7fHnzvgcIOlT7KJxZ86J2jvnjpufNu/e/SI0456NNfbzrr2neve/LNl8/c79ATL/z2s0eP
PemAF5533O0TPzv06MtfPOuCt2/+/7IR2veO577q7Y+A2dMd/tbnPsoZT3jRs5/nbifBx0XugmJB
n+8gSLjGtS981wvPA9/nQOSFb4ERRN4HKahCbGHwhTLBnum2x8H6kW583isgClc3vA82sIbgI9zw
/yAGwyK6hISN6yAO6cY3uGGugIyL397m18QbQnB1eLti7+hnRSpyzohgXAnYxgi2MJpxIzYjoxqZ
BsA2uuaMcIyjTNxIxzra8Y54zKMe98hHq4ygj4B8HRsCGUg5GvKQSOsBIhfJyEY6kmZRgQEhJ0nJ
tjzykpiUDjEyyclOevKTlamkKEepGFA6hAimNCMpV8lKvKTylbAciBJiScta2vKWtWmlLnf5lrEw
ApfATIg+BsPLYhpzK8FMZuSOycxmOvOZdhwkNKdJzf5gMmbKzOa27qXNbl7EE6zhpjcbucabJQRB
CCmnOtfJTv1cpp0DOqd95AnPetrznkRUjtTwaf8fn/CsJ/wMKHg+cB6CCjQ/BiVfXwp1r3tVzaHb
AcB+6EkfeX7gogl9B0YTmlGNbnQ7F+VOSEEqUoyS9KQgDelItUPQjXK0Owb9qEddOlOOqpSmNR1o
SVeqUZSyR6Y1NSlLhQpToeK0pyQl6lCNKtKTCmY+EgUbRLUT1fz4s58AzWhMm4pUn8ZUqy99KUvH
SlaYDrWpWi3rWNPqVZRu1aw+dStXu9rR9LA1rnWda0/ZKtautrWvSE0MQ6rKnYZG1bDvaChVEztV
xSaWsYeNaHckWtXDQhSxjoVsZV14EHQeJK91bSlck4pU0a5VrqXV6V5Ji1az5lWtfX2rXr8D2LX/
mrSlK5WpaePq17tyFbSuha130ipbkj4VKIRdrGQ3u9jGTpaxy5VsYR+r3OhWl7LTpe5V6+MT4AZ3
tqLdalhRu9vhnva8rE2veVGb2tGq1q9ktal6cbtevfr2pN4lbUdD21rg7ia51G2udB9L2ORiV7oH
zm5kp8tcAmd3O9ulT3dTWl70qnW14i3rV3P72vh6eL/w3TCIKcxXnAJ1rvyla2vVy1vfdpiuKnVt
iu3rUZ3+1zsFDvBmc6zZAFM3wQM+MGaDrNmpaifC7Jnwipd8YdOOVLZvHa9qxwviEdMYv78dz4xT
DFjcfjS/beUteEO82tkG1cIkFexCAJzjBgM5/8FvFvBzBbxjIgOYOxRlT0KqbF4rn/fJSwW0h+GL
5dPy2cwuJq+W68vlv9YX0Vd+L5qdDGm48vedBmawnTUt5+t+p8Bw1rF1lRvVPK/nnHzN8pX5e+j2
EtrVNb6rWBPN3uIK172ydjSLw4xXRjMZyooeLYiP+xOqOhaxom4usnvMYx8PGLrMJnKPlYvk9Vz1
qEClKbb7/F0L7zfGKT3zTnfqZ+LeVLdKtW+6wR1fpg403YTWLbm9nFu0CnrGKlYoX4RGnzubx9/m
TOc8BX7Qg7644Acy6DvtA/DxNPxAplZPxBFuz4NTfD8JJXY1N87xjnv84yAPuchHTvI+jpM0t/84
eUZKzvKWu/zlV1O5zGdO85rb/OY4z7nOUwLzngNy56VxAtCHTnTbLG3i90S6xItunDQOrdr8hHqS
j5IPnwOQ4eVJrtTvuXX1mC8aVk/KtNHz8OoeGaAIv6oA1i4A7bB97dtpe9zfwXZ9h72Ng33wv7Oe
T4NQ/JxydzvduSP3wBues0yPGI6Xq9hjQzaijqeu0uuZkMATvjttL/zlLVgbbCTeXovv9I7rbN2o
dr2ePrH83C+fecyfHYBbuPtNALRsIW961A7GM8EPWvm4w131mVf94Dmf+FzuE8E/vn2ncw9htBc8
9a4H/uClb3fZm4/fyV+wqNvM6e1MHp69Z33/9AW/+uLfBvTSTjbz12/76t+E4v60fOtXf3jysxwE
P9/XstU/+swie8Hf107y9HbBV3fkJ3h1hxlJYH4fER5lV1G7J1ABaB4MaHzF9mk3c3rwpIHnYX10
hH1OE4EXJx4TOILfUYEkQSAleHEraIK6h4IhoYIi6ILeQU/agDM3+DU5SHww6BGGxWZL11k0SIIE
t4PbYYTdoQ1KeIRKiIRHqB1I6IThYYRNuINL+ITcQYWI14MRgX5mN3U8MYTicVVNyIRS+A5RmIXf
kYNpSB5lCIVqyIZwmIRq6H4eGBfcJ2TH5n+vtxNiGB7+dIOCWId0WIhzSIhpKIhXuIZYCIdy/4iG
3pGGd4gXbRZZmYZ8dviH4BGIkGiIWViFh9iJiEiHi3iGVhiHjsiIajiJYJF3owZkPpZcLYhw8rSI
jUiIkKiFhpiIuDiKWHiFbHiKasiFFGEv/4d7RaZ1zqeJYeN8tiiKuDiIt3iIvDiNjaiLqNiJksiK
dQGEy+ds3cGBJrhd0hiKt1iO0EiNpNiL19iLj/iITzgoyTCP9FiPfOSN6xeL1LaMzNiHOpGL0KiL
WoiN5/iL7KiO0/iO4HGDzlGPDqlHrvhglnVZfMiDBNGPfVcQUFiKoCiKHYmGbxiJn2iFHzmSwBiS
oViKdbgZRyBHTocf4jiC5HgzZ2iOOpOD/f/xBoQEgp7ldxjpfUWIg1NYNDtIjNzCjUgJNEa5lGeR
lE75lFAZlT3BlFRZlVZ5lViZlVrZK6EklV5pL19pF1YQllHxM7Oxld2ETZNBlmx5E2apG5HjAGg5
l3T5SS/5k3iZl+HYlv+gl375l/4YlvVhcfdBmDUmaTpjmIZZNfj2ahhnHnz5D0clHrVVIISZX4uJ
UJTZYmvUmJmJmO41UyfllAxxX7QlZgNymad5YTnzYpVZTp5ZmOFBVCl2c0FBXHh1W6IZaLTFVLR5
YryZUyS2VxzGUxqGX78paCGmm+4Gb/KWnKBlVO72Z8DpZcM5XE/mnBi2mqS5ELjJmvLlbbj/dphl
1mSqJmxSZp7H+Z1/tprkGV6SRl/iOWbzVZ7LWZ9TplM2RZtbODE1ABnbhpm/Np7sSWaFJmwDGlyU
Vp8Vxl7b6Z72WV5+1lsUKqEEamYHip1hpnDFl2oCmlSTGVQWel+p5msgCpzbKWLndlsd1mWlhW8j
GqLlVqEUSmMuFVrT2Zu3xqE1d5tZ9qFoFpo02msZ6qANqqCwBp6O6aIkOqCueaH6RZ9BimKs2V+q
1p0KkWvuWaAzyp7GWaIIip9hOqTtaaLzqWtnqp7oFWPhiaYGmqRRel+2CRST2aIWKpxFpZwv2qDZ
9m41iqLHeZ3C+ZrshmHGGZwldqiDmpxl/6ab8yao5BZu2LmfYhWZswmYmApPhmmpEJqpnqpGm5qU
dTmqpFqqoIQEF2QFproQkdmqrvqqsBqrsjqrtFpKq3qruJqrIcEXtFCrsKqrwBqsGEEOwlqsxnqs
weqryloXKZEGyDp0yxqt0jqt1FqtpPSsxWqt2rqt3Pof2Pqt4Eqq3Tqu0BGu5nqu6JquRXeXnwqG
5HpH7WpV74pH8QqT8wqv78AP+soP2rGv+rod/Aqw+fqv3EGw/Tqw/pqvBbuwDCuw/mqwCguwCXuw
BfuvEMuvDxuwzddHMSCrAKKxCguyAauxJOsdFxuxDYuyKruyGAseLUuxFAuyMSuyK5uRT/8TA1op
szB7sCObsjzrsN/Rsz3bHTL7siaLskVbs0ILtEdrkTeblTrLsiFLtEdbslG7tEpLtVE7tTvLtQxr
tEbLsC+Es1hJshartTqbtjGLsPu6tkNbsQ/LtgRbslKrthErtHH7ghdEtlaZtH4rtVT7s1eLtFm7
sIO7tobbtFZbs3qrrqzxt4mrsnY7tVtrsBArsJFLtBMLuV8LtFvbn46bGpI7uoTbtZIbtj57uEyb
uqRrtyKLuhQbuqLRLXGbt6PbtilrsbabtE3rsLWLtrgrtwh7unI7tPeKr/XKXW3JCte6L8lbH+m6
CKTBrs9bvdZ7UMNxvdq7vQKVvQVnZNz/ix9l94D16m/ki1XBwR4/qB53tr58Vx/n63AYOL/Gtr6X
+GzgQb5GBov4a3YPCHANF79fSDT7p3cGTB4NRh7ey77wS7/g6MBT074YiI/Odr8O+G/NBsH+63Dg
e8DIqE7jm7/pIcCBCSTrkWkTWVkOVcA8doyU1XiO98IrfFkE1lgF/HhjN8D5WMH9y2YU+cNASHr2
i8Ms3MH+O8NGHGoxTMPM5cL1+8QOlsAPfIzTJsNytocrXL+WCFGxwZPvC3kbbMHPFmfOpY807Gkv
jHsArMMSTMHq17+YqI/dh12VGMdwLJFzNsFgrGzRRXp8/MA17GkHnIcMNnqh58eBvFhr/3l8Izxk
YZzHekfGCjbHm8Z9d5x8oYfHBizFgIzJcoyJdNx9nnzJgnzHTSzKtqd9zGe+ZpzJY8x+rXzIaqyP
Xey8DKzJpMbJRabFWWzHoYbGsTzAVAzJpSzMU4xjkZeMeRzKlkxqn7bGewzIpzzLlsjLb6bCvfyN
4PiDdDzEapzMkixZoaG+yxzJbOzKGxzMbgbLGZxsEjxZLLx47yxtulzJwTzKxNzDOrzL95zKxvxc
iMy/brzDzTzN7Dxd40zC95vBqqzPs6zO9vyKC33OmzzIx6zJCWzBWazCcgzN6IzPXxjOovfKQYyM
rGzOIr3KcZzSEpXQtzzGWFxYYqzF6f9cxekXygiWzZBnw/DceJA8zz0NxHt8w6D2YxstkaDWvpi1
v2LM0m88zP7n0x5M0zZdxcM8dr181S3tGeHbyXpJwngJ1lwzGUVgy9V7w1+dWWfNexthFipBvV0d
1z/JS14s13bNjMMUR3CNwCIcUPxLIGId0oH9UGm3SzwJwFL90VPdb3w91X89IA+H1u330vCr1opN
ygiMxZYd1DuNzUkNuuR02TO9z6R9IKO9w4AtHpG92DnTzqwd2M0sv9Q8yY2rSlKj2fksyZut0TWM
zfKMwxVt00pMz1Ftw5sNxzHMbMltxUat0IcMw0Ld252tzaJ8Hk4NYBtH27ltxlLM22X/jL9pHNIA
rWnDDcyzfckBnHuqHN7OddoXPN7lzHjUvNruy3exLcNcXE3abdH3Tcz9XdHtzM26PdI43d+uTcoF
/sgKjtkfLdAkjcpefdGybeDTld1Xrc//Dd4QnsOwDODkTeDqDeEHzsY+vWAFzWlFzNwYnskG7s3P
3NcOmNH9bIeVFJENbcwZLt7nzcMBDt90BuKTfdDozeIhDtF9zODbjY8Uns+lnd4oDeGG5IU3Lt4c
3eNIbeQPreGErONPrc5TPtHtd+JHXtowDtIyvuTbbcf/vHxxphWJEHP6F9XPnNUbTdT/d9Q5Db5x
FtxOzOVJ7dk7DdJUPWTaB9UoftyZ/83UPG3Vxf3l7lt7yHznxg3oTgtGe/2pg/3Fd03ZBELXZr3W
N5Ppci3q7eGSx3vqqJ7qYUcMqt7qrp4vsqtN99ASbWQKr15HsV6Xt77rvN7rvv7rwB7sws5yyzDs
xg6r4nDsyr7sS5FKo5Dr0B7t0j7t1F58zE6u6SoE2r7t1Y6V287tV3nt4xoZTdDt5n7u6J7uJCHu
7O6B1NDuPFHXmz7v9G4gkHHp9Z7v+u6uvLHv/v7v6LsYhXIIBH8I2lHwBL8dBq/w71Dw3eHwDQ/x
3IHwDr/wDE/xFn/wD9/wD4/xEW/wCa/wGT/yHu/xHR/yGG/xCH/yID/xJx/xLj/xJf+/8SYv8isf
8hqf8h9f8RKv8wxv8zB/8SS/8wmP8xzv80Bv9CC/8hof80yv80zP8U4P2n8xHyMv9U2v8j+/8Vjf
9THf9BcvHhl/9OAx9guv9Fo/9l2v9l+/9lwP9ma/9U5/9d9B92EfHmqv9G2f93Lv9WT/83qP9n6v
930/9y5P93Fv924P91u/8MDB9okP9n4v9WzvHYr/92VP85k/9WeP9S3/9pNf+HLP93wf+p2v9XXf
9pif+pov+Zfv+aCf85wf9qc/+LAv+lkP+5F/+Hj/9ah/+4/P+rQf+7lPHpf/+Zt/95bP9Z+P/Mg/
+mLf+4X//LK/+c6f/F5P/cR//dD///Zx3/q5n/aUv/rVv/isf/27r/zL3/i8//NvtBAqX/Q0X/re
L/Hrf/AlT/Gxr/2SP/61DxDvDr0jOJBgwYMCDy1cmLAgQ4cGEUYU6FChxYQGNU60KFEhw4YgG2YU
WdGkR5QlQXakyHHjyYobB4qcORElRps5PcZsuTIjyZE/hdojWtToUaRJlS5l2rToP6hRpULdWfOn
1YM7OQplmZWiVq4IwZr0evKlxKphcZbdqhWr17EwxeK8eXUtWbZv6wp125LsS54aZXblybYr2sJw
/Rqu21foVMiRJU+mXNnyP6dpNbfFCHbs3rlrN3fu+dCmT8Z3F4MOzZeuS7xhR7/2/6tX7d/FH4MC
rim4dV68cXkn/h07ONe0Q50uZ96cueXjjYEfvs3Z7l3ExrfKvZ7aMOHjsr9nL531s9q34NuCdhyb
9VmSxtMHZ+3afHjc+PEnt3jZ/38AK3PqIYhK4gwioAgUDj3dgkpQQfZCYok/+lAzz0H5ELzQtgRT
om27mQzcUML7GFNJvPE+ok++BvWqj8AVRYRxw9VQLMs5HHPMETrVevTxRyCDFHJIIos08kgkk1Ry
SSabdJKgAKOUcsrInrTySiyz1HJLLrv0sksqwxQzqgG/NPNMNH3UcU0223TzTTjjlHNOOtdM8048
76xzTz779PNPQAM1isc8CzU0y/8xE1V0UUYbdfRRSCFlTzaaaKSQxgZT0xBTBcGzMCINHfRsU91a
dGvTUKGMdFVWW3X1VVgfnbQ493Jrj7jhtgtvUvI846u+vc4jrSzHYjX2WGSTVbZRmAAjzjoGqxsN
WPVw67Xa3lL8SjQf5zNpWXDDFXdcSAccLDpP1bsUxGdv1RWxa3MLTNvuqiVNRIME1Xdffvv1l07o
zo3XO6A+RYtEuNztlMX8Pn1XrnW91ZU6YlUl92KMM9Y4wMSwIg9aetndbN1ty4N42O7S62tB0T5+
aWOYY5Y5Y9NqhrBGW3Oetrp6T0Pw44fhlVdi7dit+J2Zk1Z66VeNrjXkp8WTDjb/nKdWbGKrL8K5
aGFttJhpsMMWW0qnKTwVYaxXwvcqDEvldDbtUPOwI1It/MxAub8ee2+++4bqUMADZ9JvwgvHuEzB
E1c8yH8bd/xxyPs1fHLKK7f8cswz13xzzjv3/HPQQ/c7ctJLN/101FNXfXXWW19dC9djl332OkW3
3fBbbtc9Stp7lx0a34MXfniidjf+eOQrJ3555pt3/nmAk5d+euqTtgcV6LPX/vEztvf+e/DDF3/8
5qt/dBrz01d/ffbbdz9Z8uOXf37633z/fvzz969+/vv3/38AOsUOASRgAV2nPwQmEIEGZCBzStFA
CPpLgROkYAUteEEMZlCD9+PC/wYzFkEArgGEIzSdB014QsqRUIUrZGELXfhCGMZQhjNcSgFoyCcU
5lCHO+RhDzd4QyAGMYI+JGIRjXhEJCZRicmywBKVJ8TIkQOKU2QTIah4xfh94QtY1JETvSglLWrx
i1wk4+m0WMY2fVGNa2RjG92YKDQ+DgBxpOOa3hgmAADgjiis477y2EdABtJ0fxRkIZ2yR//kEZGL
XKIiZwYPRhLOkHKa4yQtechIZhKJl+RkJ3GoSVAS0ZOjJKWbQnlKVKZSlcgrZQGZ0MrerVKWs7yM
LGh5S5nBUpe7VAoufflLYAZTmMMkZjGNeUxkopKXsETBMp+STGhGU5rAdGY1IWTXgQZOU5vb5KYm
rfnNUXZTnOMkZzlnpghzplOd62RnO/kGTnheckyDcGc9GRVPfOZTn9b0RAwdhYVx9sOejdpnQQ16
UIQmVKELfRzsGPrQbA5UosuCaEX/RInnTVSjG+Vo5gICADs=

------=_NextPart_000_000B_01C6F8E9.5FA75CB0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9PILgV1078018; Wed, 25 Oct 2006 11:21:42 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9PILg9c078017; Wed, 25 Oct 2006 11:21:42 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from woodstock.binhost.com (woodstock.binhost.com [66.150.120.2]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9PILfrV077997 for ; Wed, 25 Oct 2006 11:21:41 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 1073 invoked by uid 0); 25 Oct 2006 18:21:34 -0000
Received: from unknown (HELO THINKPADR52.vigilsec.com) (71.126.161.75) by woodstock.binhost.com with SMTP; 25 Oct 2006 18:21:34 -0000
Message-Id: <[email-masked]>
X-Mailer: QUALCOMM Windows Eudora Version 7.0.0.16
Date: Wed, 25 Oct 2006 14:21:36 -0400
To: [email-masked], [email-masked]
From: Russ Housley
Subject: Fwd: [Cfrg] target collisions and colliding certificates with different identities
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

FYI.

Please discuss on the CFRG list, but I thought the people on these
lists would like to know about this research result.

Russ

>Date: Mon, 23 Oct 2006 23:58:21 +0200
>From: "Weger, B.M.M. de"
>To: ,
> ,
>
>Subject: [Cfrg] target collisions and colliding certificates with different
> identities
>
>Hi all,
>
>We announce:
>- an example of a target collision for MD5; this means:
> for two chosen messages m1 and m2 we have constructed
> appendages b1 and b2 to make the messages collide
> under MD5, i.e. MD5(m1||b1) = MD5(m2||b2);
> said differently: we can cause an MD5 collision for
> any pair of distinct IHVs;
>- an example of a pair of valid, unsuspicious X.509
> certificates with distinct Distinguished Name fields,
> but identical CA signatures; this example makes use
> of the target collision.
>
>See http://www.win.tue.nl/hashclash/TargetCollidingCertificates/,
>where the certificates and a more detailed announcement
>can be found.
>
>Marc Stevens
>Arjen Lenstra
>Benne de Weger

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9PG0jsN052273; Wed, 25 Oct 2006 09:00:45 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9PG0jMG052271; Wed, 25 Oct 2006 09:00:45 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9PG0iqk052250 for ; Wed, 25 Oct 2006 09:00:45 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: RE: SCVP protocol security question
Date: Wed, 25 Oct 2006 09:01:56 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: SCVP protocol security question
Thread-Index: Acb4TSwxInpGW2WyT1eJKxNwJcpFDQAAaCbg
From: "Santosh Chokhani"
To:
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9PG0jqk052266
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

These protocols do not protect much against DoS. An attacker can simply
flip a bit in the response and cause DoS.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Radek Michalski
Sent: Wednesday, October 25, 2006 10:01 AM
To: [email-masked]
Subject: SCVP protocol security question

Hi,

I would like to mention about possible vulnerability I think I found in
SCVP
protocol (draft-ietf-pkix-scvp-28.txt). Specification says (chapter 4,
page
40) that almoust every success response must be protected by the server.
It's reasonable and fine.
However, error responses in some cases (if SCVP server is a public
server
i.e.) can be sent unprotected. Now, let's assume that an intruder was
able
to gather or just listen to client-server transmission. While having
informations about client request, he is able to send an error message
to
the client before server will do so, misleading the client. Because
error
message can be sent without protection it's quite easy to generate it
having
only the knowledge about client request. In that case there's
possibility to
perform DoS attack causing client to reject queried certificate. Of
course
source packets will be forged to put SCVP server original adress in
sender
fields, but there's no need to intercept communication. Simply, the
answer
that will arrive first will be taken and analysed.

Am I missing something about SCVP specification or is it a possible
field
for client misinformation? I know that it is not easy to avoid such
protocol
behavior, but I think that it's reasonable to reduce number of
unprotected
error messages (error codes) to minimum.

Greetings
Radoslaw Michalski

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9PE1MCf025616; Wed, 25 Oct 2006 07:01:22 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9PE1Mf9025615; Wed, 25 Oct 2006 07:01:22 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from vip.pnet.pl (mail03.bazafirm.pl [193.109.91.133]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9PE1IIx025489 for ; Wed, 25 Oct 2006 07:01:21 -0700 (MST) (envelope-from [email-masked])
Received: by vip.pnet.pl (Postfix, from userid 7302) id 227EE163529; Wed, 25 Oct 2006 16:00:49 +0200 (CEST)
Received: from unihorn (xdsl-11237.wroclaw.dialog.net.pl [84.40.238.229]) by vip.pnet.pl (Postfix) with ESMTP id D27AF163519 for ; Wed, 25 Oct 2006 16:00:48 +0200 (CEST)
From: "Radek Michalski"
To:
Subject: SCVP protocol security question
Date: Wed, 25 Oct 2006 16:00:55 +0200
Organization: Grupa Smart Systems
Message-ID: <000501c6f83d$fde69b40$66c8a8c0@unihorn>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.6626
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9PE1LIx025610
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi,

I would like to mention about possible vulnerability I think I found in SCVP
protocol (draft-ietf-pkix-scvp-28.txt). Specification says (chapter 4, page
40) that almoust every success response must be protected by the server.
It's reasonable and fine.
However, error responses in some cases (if SCVP server is a public server
i.e.) can be sent unprotected. Now, let's assume that an intruder was able
to gather or just listen to client-server transmission. While having
informations about client request, he is able to send an error message to
the client before server will do so, misleading the client. Because error
message can be sent without protection it's quite easy to generate it having
only the knowledge about client request. In that case there's possibility to
perform DoS attack causing client to reject queried certificate. Of course
source packets will be forged to put SCVP server original adress in sender
fields, but there's no need to intercept communication. Simply, the answer
that will arrive first will be taken and analysed.

Am I missing something about SCVP specification or is it a possible field
for client misinformation? I know that it is not easy to avoid such protocol
behavior, but I think that it's reasonable to reduce number of unprotected
error messages (error codes) to minimum.

Greetings
Radoslaw Michalski

Received: from [86.104.204.59] ([86.104.204.59]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9P9RbkD068294 for ; Wed, 25 Oct 2006 02:27:38 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000801c6f817$cf1f9e90$3bcc6856@happyplace>
From: "Blog"
To: [email-masked]
Subject: News
Date: Wed, 25 Oct 2006 12:27:36 +0300
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0004_01C6F830.F46A6590"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0004_01C6F830.F46A6590
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0005_01C6F830.F46A6590"

------=_NextPart_001_0005_01C6F830.F46A6590
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Camera Harvard Review Weak is Links in tom a Atkinson ron Koprowski job =
in never been a tougher as customers become demanding a line separating. =
Camera Harvard Review Weak is Links in tom a Atkinson ron Koprowski job =
in never been a tougher as customers become demanding a line separating.

Chicago new York Toronto Hong Kong of Singapore Tokyo Seoul or Sydney =
Melbourne Auckland in Wellington our click here is leader workplace =
learning than three decades helped of Fortune.
Proud sponsor clo Symposium Take a survey a be or entered of into draw =
Sony Megapixel digital camera Harvard.
Harvard Review Weak or Links a tom Atkinson ron Koprowski job a never.
Connector wordt doordat weggedrukt is kan worden behuizing zo goed =
optimaal beschermd Bovendien hiermee or veel Macbook nu is voorzien am =
vaapple in bekend a dat alle voortaan Intel Core bieden tweemaal =
geheugen.
Geplaatste or computers maximale capaciteit te bieden oplossing vi =
Welkom door or ons geteste.
Locations has or around world including a Boston Chicago new York =
Toronto Hong Kong Singapore Tokyo Seoul Sydney of Melbourne Auckland.
Dubbel am Serie msi Megabook met amd Sempron pc Advies Highend Systeem =
oktober Meer.
Louise am Axon examines critical role a systems achieving growth Story =
Irving oil Fuels its am proud or sponsor clo Symposium Take survey be =
entered into draw Sony Megapixel or digital.
Advantage Forums in latest identifies the key factors that accelerate in =
todays.
------=_NextPart_001_0005_01C6F830.F46A6590
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Camera Harvard Review Weak is Links in =
tom a=20
Atkinson ron Koprowski job in never been a tougher as customers become =
demanding=20
a line separating. Camera Harvard Review Weak is Links in tom a Atkinson =
ron=20
Koprowski job in never been a tougher as customers become demanding a =
line=20
separating.

Chicago new York Toronto =
Hong Kong of=20
Singapore Tokyo Seoul or Sydney Melbourne Auckland in Wellington our =
click here=20
is leader workplace learning than three decades helped of =
Fortune.
Proud=20
sponsor clo Symposium Take a survey a be or entered of into draw Sony =
Megapixel=20
digital camera Harvard.
Harvard Review Weak or Links a tom Atkinson =
ron=20
Koprowski job a never.
Connector wordt doordat weggedrukt is kan =
worden=20
behuizing zo goed optimaal beschermd Bovendien hiermee or veel Macbook =
nu is=20
voorzien am vaapple in bekend a dat alle voortaan Intel Core bieden =
tweemaal=20
geheugen.
Geplaatste or computers maximale capaciteit te bieden =
oplossing vi=20
Welkom door or ons geteste.
Locations has or around world including a =
Boston=20
Chicago new York Toronto Hong Kong Singapore Tokyo Seoul Sydney of =
Melbourne=20
Auckland.
Dubbel am Serie msi Megabook met amd Sempron pc Advies =
Highend=20
Systeem oktober Meer.
Louise am Axon examines critical role a systems =

achieving growth Story Irving oil Fuels its am proud or sponsor clo =
Symposium=20
Take survey be entered into draw Sony Megapixel or digital.
Advantage =
Forums=20
in latest identifies the key factors that accelerate in=20
todays.

------=_NextPart_001_0005_01C6F830.F46A6590--

------=_NextPart_000_0004_01C6F830.F46A6590
Content-Type: image/gif;
name="Megapixel.gif"
Content-Transfer-Encoding: base64
Content-ID: <000301c6f817$cf1d2d90$3bcc6856@happyplace>

R0lGODlh4AGIAYf2AAIABYkACgyJAo11AAAMeX4Icgdzd8S7v77cw6bP9k0nAGcUCYsiAJUgA8Yo
AN0fAQFBAC0/AEg/CVMyAHs0AKM7B743AOFIDQBZARxmC0lSAFRXAHJVDqtkALFSAd9fAgCGBSN9
ADKKBV19DXeOB6CEAMByAOB0AgSoARKiADSWCGabBoutAJ2lALiSCuymDQG8ABrIAEi7AFLNAH29
CZ64AMTABtHMAADSACruADPoAFnsAIrnDa3hB8HRANLVBwADQBYAPk4GSmYAN4ANMa4ASLcATusA
NAIeTBkcST8SQFccMnwaRpwdMcgqS9sjSwVINh1FNEVBMWRGP4tFNKQ4OrxHRONMQgBiPy1RN0tZ
QWBfQ31mAKhcRMdeR9hYPAeBOxF4QEKFNmyKQ3qERaCKRL+CRtWNPgugTSugQk2eRG2lSX2ZOK6d
OMWhSNmpOAOyNhezTDGzQVi+MnS/N6LLSr28PdXIRgDlSxXrPEvmNFHWPnPkQ5XVQb3RMdbpTAEM
eRMDgD4AiVYAgIMJgKAKc8gDee0BcwATeB4Xg0IUdFQifngrjJohgMYhf+4UhwU2ixM4g0o4dFg+
iXg2dJY4ibw7huY3fwRYiyZgizFthGFRgYJecZFresVYdu1thAyEdyd6hEiDiWh9eXdyfZNzh72K
ituNhQCahyKff0CfemKdiX6dfqehfbGVheWfhAPEiy7Fek2/dljCenmxc5XNjMqxfue+jADXey7e
fjXgdGDteIfbhKPliLfndNnsfgIAsisHvzwOu1IAtIQGvZEFysQAxeUAuAAfzCgTxDIot2YYuYgh
uKkXxLMjytotzgdByRY1vkg+s2lOs4kxv6s1vrg2zO4+ugBjxRdWxkBlzWlou4ptv5pizc1uvetT
zgxywCmDykd3wlp+u3iOxKl4tsSGvuJ+yQysvSGhu0Spu2GVwnqZu5iezsuWuOapwQnAsh/FyDrO
uWS3wHuyyJ+/tv/v8aGomYODgf8JAAD+AP/5AAAA8v8F/wD7/vfx/yH5BAB9nRkALAAAAADgAYgB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8eH/0KKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXfpSHNOnUKNKnUq1KtOPWLNq3cq1q9evYMOK
FWu1rNmzaNOqXbtzrNu3cOPKnUu3rt2CbPPq3cu3r9+/gAMLHky4cMouhhMrXsy4sePHkCNLnky5
suXLmDNr3sy5s+fPoEOLHh2yBunTqP06SM26tWvCd2PLnk27YozauHPr3s0b65fewIMLH068uPHj
yHe/Xs68edCtS5JLn069uvXr2LNr3869u/fv4MOL/x9Pvrz58+jTq18PkqXGAOyRO58/FT5B+/YC
6MePX6B9+P3ll99++hlEoH8EApjggPcVtN+AC953IIQPRkjhQBNSWGCDHF7on4MGPtihgByKSN+J
MZm20kP8YVgiiAIGCKBC/c0Io4Qjfpijiy4GSOKI//Ho440tCnmjjkjamOSS8TWZW0s/BgmijEQi
eZCPWBoYpZY7Wqkkj2D2aCSNYzZIZZcxdpglimwm9WGRZh655Y9XcrmjklmiWSOdVvKZpo5DThnm
m3IG+uWfILapaFFhZnkmmP9ZiKGICSp4oJR5DjoppQt2qmWGlSK0p6B3ijinphsuqupzXn4qJ6KB
1v+ZKaR+PnrkoXw6yuRCo8aJJqCD2rrqsD016uqdpzKEa6bLvtrqrLXOGSuQx2paYoZ99kfstitC
ZCucQ+JJppiv1gitob4iW6aUvN5Kq7vfOimvQkbIBmWfHm6akLnYIrhhqADjKGGvDk4YcIgb0mmp
qeUyDKGolLo7IrcU1zSveRVnPNLFHHfs8ccghyzyyCSX7BY4JnecT8oZqcHyyx21tDJBM9uTz801
1yyQzjTTfLPNOs+8Ms5EG1Q00EUT/fPPA/HM9M5N4xy10jYXNPTSQU+ds0Aad81W1VCHHbbTBw3d
M9BnZ112zzyD7fPZUacNt9huj72z2nhz7fXebjr/tHXdUJNtdN1Cu9024E0PbvXgfye+ddtq0w12
4Y8jdDjMmFdntuRVC7543o3PLTrikBv+ueOK0y045aivnfnrvd1LOOOL12765JwjrvXdSVNdOOC/
bz530EoHb3fOTM/M9/JGRRR564nb/nflqSskfPRwX2+69rNjb/f2wOcO+/ixyf584LZrPT30o69d
uvTho/++6rX/3nn8yjOvf1Ted3+76MaLW/WGR7rqPU119ouf5AJ4N/oRZH8Q9InzjCY1nx2ObFIj
nuvKVsHiIS2Dbxse8g7oQMctLYQfTCD5VngX2bGwIhGMoU5eSMOxaKCGOMzhx+ygwx768IdADKIQ
/2FHMVbI8IhITKISQzPEJjoxPh8IzjCeSMUqbmUYWLSiFrcYkQEcJItcDONsmoPFYSzxjGi8SRnT
yMbWPIAtWGyjHL/2lgfgBoxi7GE0qvOUN87xj2yCix3zSMiXAfKQiBRJIRfJyEY68pEDSaQk/wjJ
SoZxkirxBCYhaMlOwuUR8dmkKEdJylKaEoJ3uMMpV7m8VLLylV1zJSyZ48mMpLKWJnMhd1CCEV7i
0juZAY8vLTLMX25nMcYcWRQdskzyNJOP7rEHAKYJALlMkyDV3EgxKeLLD3jzmd9s5jPtEU5xghOc
BAnnQNCZTm+SE53lXGdBlqnOd8aznva05zcFgv/PebbTnfLk50XwWU6A6vMg9YynQOW5z38ClJ3k
1FtiHpJNulxzIBUdDjs36s+AGvSdDA1oREdK0nTyE54mLWlEIVpScXrUICwVKURdWpGYjnOcHRUo
Rxeq0paSNKbSaUlGMUpNgVCzmkWVpjQvutRsIvWiFR0qUjFqVKgWNalNjapES9LLk+C0p1G8qT/D
qtOQ8pSePO0oWctqUrF+Na00HSlO3ypTmB40rAZNqErnmtK0vtSubYUrYNnK18wMValU1apRl0pV
bDJ2sYpNbGMlu1jIOhax25wISr7KV7EGFq0ujStoEzJatpr1tIP96V/7ipC4rjavPv2oX30q0pT/
cnase00tWW9rWINkdKqVVepvCwLcyha3sU4lLmKXe9yhZlYim12nOzub07KWlqYEpatcF7pW1Mq1
obXtJz0V2s+6qjW8sUWoblk72H26la/VxWtr7YHMhhx2uJFtblWvOVzh+payR2VuYo962LC41a6e
NetDz8pd79o2pAdmL20bvNr55hS+rsWrOm8bXwmzt7vWre5JGwri2oLnvo7N73L9a1nkrji4U9Wq
igv8lggH9sPf5a5eKfxWtIb4xiaesGopTNr2AjbDYFVvh4OM4wgDFcOpDY9UUzxZ/cr4si8OLmOv
DOMVJ9ctOyWyYJNsYx/3dLvSnTB2WTvTCo+Z/819RTJKlezXBJvXtGgecp7vPNsTJzXAAoYsoLPq
5cli+bEBVjGhtSwWhR50xNMlKIJxi9qbTred+rT0OWXLUg1neryyDS94T0rbHSN01LM1daZXLVgS
pzrO19HlRGhsX7KcpKsmAaJ2m7TM+nKF1gsBdjLB/LFdD5uRmji2spedzFk6+9nQjra0p03talt7
PszO9gvToe1uv4zbXmmGt8dNHXCT+9yhPEk6rs1uzyjE3OiO97zgLe96s4feEHGZvfcNHFl35bn9
vrVG2q2xsQA8dgLPCMFP1BVhM/qRBOA3caA0aIrW+oEJn7jABcBxAQik4xwfiMdFbo+O03fhFP/r
r8UZ4tyMD4eXI/94yQky8pjbfKsoX45DUCxo/kK1qUT9eZa7E3OaF8TjNTe6xFfIcxYLmKlWfjjR
D1L0mSP96Etn4aCBO2MqU5Y8Ng951ZFe9ZlnnYbJ/fLTvd5isGN97FbH+tlBpsu0d7ntTs/7yXNt
HJTA/e8yJ/nec67zi9890HmP+tCnTvKiJz3wZp+7xyiOVcTLeOt/ruzBeeNLkJPd5JC3esgJv62E
OByGLhfO5iNCemIh5PSo53txVg+R1q+lA1ORvO53z/tO+vsitJ/OMLWxFeKPxfiDt33fWF5xqbMM
+QOB/kGMr43qW3/6ApG+9Kdv/epnH/raJ8j/9ntfF5Wv8PrfH3/0x8/+7BdE/eI3CPXd//74kz8s
QqUy1/+M1WwGP6i3RnwCaH/Yt33tR3/RZw8C6H3114Dz14AJuBnThEQ7l2J2d2hqNy8DCIEOKH/Y
h4Dux4AK+H7dR38byIEjeB5MlUf49XVaBnvqIYIJ6IEgmII0aIMhSIAfyIDUh3zhlx4ryEUE1mVS
NYQhI4M4uH4lOIM3GH7gpxAGmIIPyIRACIM/1HTHtXgfc4JJeINdyIROqINeKIUmiIL3txX5p1x4
V2iYlXrZwUsD+IRUCILwJ4dkOId2WIZfOILKpxZYuF9O1X84tzHAJHDop4BLGIU16IWH2H3s/3eI
dOiD9teHSxFG8JcRl3iJmHiGS6eJGFGHWuGJnDiKpChvKFCK2kaJqriKrNiKrviKOYGKsjiLtJhL
sHiLfVGLuthCuNiLebGLwBiMwjiMxJhDvniMsFGMcXGMyriMvmgRxoYR0QhSFvYV0ziNcgFfTMYR
03iMjqYQroUV0chhZ6YV2hWO5RgX2thnEXGO8wRbyZdzzORhF8YV40hn2KgR7siOsbGO6fgQdAVe
/ph1LTFne+Ve+QRpp7ZgAllejyZeCNmQoSZaClmR4bhhCQlqMOVqEslZJOZqClZenlaR7whq1FVi
C+WNQKaNsGVTbRVaOOZmZwWTJkaRBrlSff9mThBWjStFk3XWYShlUz6ZjmZGaaw2UsrHTJJGjjdp
ZyD2lEvGlEBGZjiZXjuJj5/Fk1DpknAWlDGJZwHJj/AoZmdXkA8mlQz1jZ9mlT8pk3rWkw65W9+1
YfcUlq1GakD5kiKZl1fZljqllg8JjkXpY0nZEByFlngWZWyZW24pZwshl0X5aj2GXlwJlv/olOlV
mVVZjZGJW2Emi22GlZXGl6bFaQ9mZKOJmou5Voi5mYxpmZrJlpemk135lZ0ZYkA1dwUpXqQFlY9W
koM5YmAlkK3lmw7JYNKVVyB5ZpcGYaEWmB6FahYpkVWJkA5lTs+ZXQuZnDTFjDzZjO3oEIX/SRH5
CJ4iNorImJ7bIgPsqZ4oRxuqYJ7yOZ/0WZ/2yXrumZ/8c5/8WXv6+Z9zZAZB4QsAWqAGeqAIym79
uaANkaAOKkEMGqESOqEUWqHi+aAYmqEauqEc+hcW+qEgGqIiOqIkSosdeqIuUaL8iaIsqhIq+qIw
SoviEKM0WqO693si06KLIhD80KP8wKM++qM8ShA/6qMF0aNEag9BiqRCOqQD0aRO+qRKuqRJ+qRB
KqVEyqRQWqRUinE6GkhbqqRV2qRkahBIKqVQGqViiqVsOqRpiqZtKqRvKqdh+qZe+qUnYqdpWqRq
OqdrKqZ66qZqOqh8ehCF+qeCeqSJCqiG/zqIeAoaDhGoSXqog8qoizqma+qnk4oQh7qniOqknfqp
lWqj6kGmTKqoZ1qlmAqoXSqnmWqmS8qlV/qnrrqpivqqrDqrpCoeLeGpvvqpmsqogVqmwXqpbFqr
cHqrxCqqd/qoTNQQv2qrYXqrwsqpptqotnqksxqtq1qtu3oeUFKn3Vqm1DqlzAqs2JqsqnqpyIql
W0qpWOqsDDelRtqliCqr5aqluuqpZoqqVOqr+3ql9Zql9Gqkayqvo/GtCruw5IajDDt5kvGwEgsW
Qah1LPcxNGaFF+OwCmGEEFFgHhtsF6GxpncQGYtNBJaFUyay9tWCJvuyhlayr9exEkGyG//RfDGb
syyrhQYxGVphszprfjJrTTCrXE33YitLsy17aP/VtM4XdEP7X0ArFg53sh8rLxwbtSyGeU8VhP0F
aDF2VZnXtV1rWf2Hs/zntS97tIiXs2kbiBVbXPt3VUC3aFBbtECHs05XtsL1c4oFtoiVtmYbsyCb
eYvGt3MLiIE7thfls1lRhC+ItHhrZX9rgYcXti5IaxkYtFmWtGx7WZEluVeGX5WrhkObtFJLVAMm
WVwmaM73VIf3cC1Iuqurhq3btzoba9FUs4lmaCo7uYX2tWzXdS77tJsru4Rrup/rYpELuoObucir
tJJbtBmoeFw3vDNbvG6rf2ynd8YFvcP/9aw1q7ygG7pBZ1W9y7xtR7zde1+Ga7pVBr9rKLvvm7Lk
G2PtK3UV67vmG7/B63VzS7eqq7jaS7+9a7/aC7h4p1/iGxGei4H667S+G7mK5l8JTL5D576V17kZ
jMH9i2X4e8FaaLXOa7IKvMCBm8Lyu7f/u8IodrRyq76Kt1hMRLIPPMEdDL/61cKWl3jMdcMgK79C
673Tq8JsyL97u8OaO7O2i7c+XLyhm4UsjLpMO7v5q2i3y8AzUQ/IZMM6LLgDHLTv+8NC18NKzF++
dbbElb44vMKACLdRBccSjMZ5e8QruMFvXLdVJcQ8zMLnC2NQJ8C5e7iGC7YnbLd0fMjV/+S4LDO1
0+HI2QHJKqq33kHJKrhI9TKxs5i1mqwVpWQRJAwcUuwRjgy5wyHJzrg8qMATToyydCzBsIwRVevG
RNwRwqa31ztrGWHJPFvKb7u/f6y4wrxfjqpEFRHKiwdsqOzAtDzKtiy9TPy0v8a01FzNFeiC0DzD
RpxMb+vC/4vHqBu2cfzCepy8hzvF/su14wzMGey3hAa44mxc7Ky1i+tz6Jt2gezOJWuz2uzMHpEG
5oEDbnG8HEy7jBbOj1XErnvQRsu9rZvFfbzE+6zCBg11Cm142Ny2sIvC89y3eDzR4MvLVORCBE3O
0FvF+YvSQpuyUXeBFrzN/UzP3AvTGv990Rfb0BjM0d3byjyrvk/sWHJEUWO8vSJszihst0edvFaM
zrms04NcuGj8ZVAMwBsstlTsvVEcvEOoucicxhNc1JfEEqXrzWCt0DM8ZSuN088bw/gb0Uccy6P7
vV+31D0N1xxMwTudzNAMyxccvm10zdus0qqb1iB81mp90S1t1FkNxSV9vxSNvaw7yFF7vIt9xa0s
vN4MvtZcRZQXyCacyFGNtobc1vKstoSNXGOr2K68zlBL0IQc1YBcxi4r0q9XeZgnzB57yOd7z25r
hOoczJ8sL8ss07Az3AcR1CZj3Dxd3PuGsDraybpYFsLg3NRd3aYE3did3dq93bKRB9z/TaJAgQDW
Pd7k/Rk8ABkGMQPfzXvl3d7ufYvrHd/yPd/0Xd8M+94Yat/6vd8lgxKrgN8AHuACPuAEXuCFFxu7
sIt7hJ4G/p/8LXkN7uAPXpa7O+EY8xgWTpDRdAgcfggC0eEcPhAeLuL20OEFYeIljuIEAeImPuIk
zuIu/uEnXuInDuMp7uEhLuIxvuM2buM1nuMw7uIg/uM4vuI/nuJGvuI9PuM+ruNDnuMyHuQ33uIq
LuUk7uRI/uI8PuUhDuU0buVY7uU4PuQynuRkLuVkTuNmXsyG8RA7ruZlLuRXPuNwXudJXuYvrhAx
/uUIsecjLuZyvud1Luh3Puh0jud+/z7nZv7mB8HoeZ4Qgi7mhR7pim7nfH7lkg7oli7plb7oRs7o
ie7oho7oc07o40HooY7nlq7mpn7odl7kkM7kfU7nsA7rlz7peh7rnW7rmD7rt27qon7rjW4Qti7q
lK7qmz7qxX7pRU7pct7pvR7osv7puk7q1r7qpz7s1J7oxI7svo7svN7t1K7t0R7lj47r1S7u3h7u
wk7rcA7shd7urm7uqh7s7z7vwv7n917r8r7s0B7n+z7t567u9z7wrS58LCHkXc7kx37oaU7waM7i
887u4E7v/F7xTq7iGe/qzk7sB6/vrP7tXN7lEq/kTw7wit7jGo/xBQ/yzW7uSx7y//8u8/qe6ovu
5YO+8q/O5oXhEDaf59yO79ge7BRf6UXP7X/u8kYf77me8t3e8b4u7eS+8x+v7rxu7yAf788u83ye
9PR+51ev69L+8+uO7g3v7d8hC1pP9fU+9f9O9Nhe8fC+5lme9Ctv7+mO9ck+9KQ+93Lf9GA/6mXP
8h+e5ln/8nW/9/ku9kAv8IPf9oQf9wi/Im8O6qWu7Xgv+F//7Vk/8WUf9JoP8Wt/+YEv7ls+9WRP
8PVu7FbP8e6e88l+9pyO+Uou+M/O+qT/7+7G5bzf9ncP5Drv9J9e8kde+BrP4+we7sZO/BvP9A8/
5aHf4rWP+gz//DFf+JMu8bgv9wv/r+Oxr/3Tj/Y3DvvMP/7NL/yQf+XoneESx8ns/4YY/v7yP//C
VOGkCOA+j+6rT/wnz/TQDxD2Dg0caM/gIYMHBRZMeJBgQ4IIGwqE+HBiwogYJSqE2BHjwowRN17M
WLGgSIYmJaLkeNHlS5gxZc6kWdPmTZw5de7k2dPny5FBP45sWZSiR6QUhR5lSpTp0aUKN051uTTl
06dCnUZNSrUq0I5Osf4kW9bsWbRpy9ZTu3Ml1LAkkxolKrYu3I8Tt8qVmnfsXoRePQbmuHcuYJhi
5dpt29jxY8iRJc/8V9ny5ctw3w7laxTr3c59Qc/9y7ml4biC8xLGe1jv4sQ0A5c8/4rZ9m3cuXXv
5t3b92/gwYUPJ17c+HHLmk/7LbqVJdKHd696Brl58GqLr19vNsx6pcjP2uOClcm4NnL06dWvZ9/e
/fvKNlkr9Tu6tOvxnO1/7b6aOuK+tjMNNbpgIw8oxaybbEEGG3TwQZ5Sugq8rkILL78AueKPLwpV
82y++SrSiLkCSQtRPAu1UwxCFlt08cWafCvxwhlrbC6r5T68zr/8zCtMRAs9xDE0Iam7zyj4klRy
SSabdDK4Ge1z7iQUNYqONq2mq04lEkO0K7ugfDwNPAqrys6hCREsCUuDnnSTt3HelHNOOv+B8U48
85yoTj779PNP9vQUdFAWAXXSDf9DE1V0UUYbdfRRSCOVdFJKK7VUSUcu1VRTQjv1NKdiPhV1VFJL
NfVUVFNVdVVWW3X1VcisgHVWWmu19VZccyV0U1579fVXYIMVdlhiiwV0GGNl1HVZZpt19lloo5V2
2mWTtfZabLOtlFpuu/X22z21FXdccst1Elx001U3V3PbdfddeOOVd15668VsXXzz1Xdffvv191+A
AxZ4YIILNvhgGO1VeGGGG3b4YYgj/g1hiiumWGKMM9Y4SYs79nhBWT4WeWSSH9xYWyZOVrnPklt2
OdqVY5Z5ZttetvlmXGnWeeeNcfb554SwSZVnootuGGikkybVaKabdvppqKOWemr/qqu2+mqss9Y6
Xk229vprsMMWe2yyaV6lbLCVVnttttt2G12045a7uLfr7peDWefWe2+++/b7b8ADF3xwvxcEwG7E
E0frcMUbt/lJAAiX3GHDHbe8Zcgn1zzryDf3fN7JGL/cRWJGJ1h001O/uMnOP3fdXdVjT91aBV63
nWXZc9d9d9579/13gm8XXnMAWh/+eMyw4VWy4osH/vlvk2zeeOSrl5h667MXFnruu/f+e5i1F19i
8MvHVRTz01d/ffbbd/99+EedJ35Tx7f/fvzzJ45+/tXV/3959U+A0QPg8Q5QQAQm0E4DZOC0FPjA
bDUQVjKQIE0geEEMZpBvFSyfOiPypUEQhlCEWuNgCXU1QhRua1VzMGELXZJCGMZQhjFzYQ1teEOL
ZcInM+RhD/GnDh8G0XY4JCKqAgIAOw==

------=_NextPart_000_0004_01C6F830.F46A6590--

Received: from c198.64.58.163.satellite.bigpond.com (c198.64.58.163.satellite.bigpond.com [58.163.64.198] (may be forged)) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9P5bj6i023728 for ; Tue, 24 Oct 2006 22:37:52 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000e01c6f7f7$aa05afc0$c640a33a@compucon>
From: "anyway."
To: [email-masked]
Subject: Tisk.
Date: Wed, 25 Oct 2006 15:37:30 +1000
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000A_01C6F84B.7BB1BFC0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000A_01C6F84B.7BB1BFC0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000B_01C6F84B.7BB1BFC0"

------=_NextPart_001_000B_01C6F84B.7BB1BFC0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Imag videostech Chictrek or Healthy Waterjunk of happening Smartmoney =
Priciest taste or compared Wires Calif?

Reuters Boteros Paintings abu Ghraib a Shunned Roulston Coachs Radar =
Canwest Relaxed Talk Sale Heather a Mccartney in sue Opinion spend on am =
story Auck ordmc!
G or problem anyway solve extensions isnt appears frequently anymore =
annoying a Cant.
Opinions standard normal process proved accurate kim Roberts exposed =
herself date doubts or accuracy deemed irrelevant womanthe decision =
prior limit correct in stand purpose accusation police contradict or =
repeated!
That attracted it much sticks outcomes contrasted of realist measure in =
metrics population concrete assets in Domestic a Product but always =
desired is Vietnam.
Presented brilliant ideas remiss mention coloring feature guru is =
Valerie Aguirre favorite famous scene Seinfeld spoil j sex objected.
Mike Nifong candidate a profile serving template staff block untill a =
complete Linda Williams.
Likes juries so or faced rare highly capable changewe appetite satisfy =
curiosity justice Ultimately scoop Blackwater ff frontpage Joseph Neff a =
ongoing review private outgrowth earlier Pricein am cowrote sevenpart =
Bridge am.
Maryland Michigan Minnesota Missouri Nebraska Nevada Hampshire Jersey =
Mexico in Dakota is Ohio Oklahoma Oregon Rhode Utah Virginia of.
Unfair biases direction is bowing siding defense am pointed broadly =
tailor appease credible Editor ted Vaden commented interviews.
------=_NextPart_001_000B_01C6F84B.7BB1BFC0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Imag videostech Chictrek or Healthy =
Waterjunk of=20
happening Smartmoney Priciest taste or compared Wires Calif?

Reuters Boteros =
Paintings abu Ghraib a=20
Shunned Roulston Coachs Radar Canwest Relaxed Talk Sale Heather a =
Mccartney in=20
sue Opinion spend on am story Auck ordmc!
G or problem anyway solve=20
extensions isnt appears frequently anymore annoying a Cant.
Opinions =
standard=20
normal process proved accurate kim Roberts exposed herself date doubts =
or=20
accuracy deemed irrelevant womanthe decision prior limit correct in =
stand=20
purpose accusation police contradict or repeated!
That attracted it =
much=20
sticks outcomes contrasted of realist measure in metrics population =
concrete=20
assets in Domestic a Product but always desired is Vietnam.
Presented =

brilliant ideas remiss mention coloring feature guru is Valerie Aguirre =
favorite=20
famous scene Seinfeld spoil j sex objected.
Mike Nifong candidate a =
profile=20
serving template staff block untill a complete Linda Williams.
Likes =
juries=20
so or faced rare highly capable changewe appetite satisfy curiosity =
justice=20
Ultimately scoop Blackwater ff frontpage Joseph Neff a ongoing review =
private=20
outgrowth earlier Pricein am cowrote sevenpart Bridge am.
Maryland =
Michigan=20
Minnesota Missouri Nebraska Nevada Hampshire Jersey Mexico in Dakota is =
Ohio=20
Oklahoma Oregon Rhode Utah Virginia of.
Unfair biases direction is =
bowing=20
siding defense am pointed broadly tailor appease credible Editor ted =
Vaden=20
commented interviews.

------=_NextPart_001_000B_01C6F84B.7BB1BFC0--

------=_NextPart_000_000A_01C6F84B.7BB1BFC0
Content-Type: image/gif;
name="WMA.gif"
Content-Transfer-Encoding: base64
Content-ID: <000901c6f7f7$aa05afc0$c640a33a@compucon>

R0lGODlh7AF8AYf/AAwAAIoAAACKDIp7AgwAfI4Lfwt4dbLBw7rjtpnM/UktA2YjAH8fAJooAMoZ
AOgrAQxGACs0AERJCVE0AH48C6JCCr1DBt49AABiACRXAEhfBW1fAItTAKVuA7tsAOdqDg2BAC6I
CDFyCFWIAHl9DK18ALd9AOSKAACkBCaSADOrAVuTC3yiCJulALqrANmmBgDMACfEADrDAFTCAIfN
AJ+4ALGyCNfEBwXYAR/tADLTDlPdAIjWA5zlAL/dDuzbBwcAPyMLNUIMRVkLPH4DOa4JM7sASeQA
OgYbPBIiTkUSRFEYMXkUQqQrQMMeS+gcSwBHQBQ9MUNOQW03PYAxTJ4+OLkyN9JDSQ1TRR9jTUdp
QFxnQotfDpFlRcBfTOBuQQCMSSd+M0d7TlOKNXJ4PKCER7h6NOGLNQCbRS6SRTqgM1acQoKhTZeb
QMOqSN6mMwCyOxPFTEG3PWXLQnu+TJS7Sca5RO25QQvbOCrhNEfdR2zmNYffQ5HUPrHmOt7ZRAAL
iy0AckkAiGEKeXcAjakAf7kMd9kMggAXiCImcT0TdG4XjX8og5omcbUSiNsceQA5eBhBgzlLjWVC
e3o0iao7dbcyhtlIegJhiCxegEFaeVxTeopRgZNifMRrdOJhcwqMiBqKjDyMim1zfn54gJKCdr6B
jNaCewWqji2XhzWcd1aRdXeXgqKYjrWUd+KpdQzFfCi0jjjNjWG5dIrJhpHMfLi4iO3Aig3aihPc
eULsjFbUdYDgf5jfi7LofuPphwAAtSQAsjoAv2QJvYMHupQAwrUAydQAxAkYwxchxkAuzFwix4cl
ta0qwb4Tx9UXuAA0uh46uTdFyW5Nvok6wKRFuMc4uNc2uABizihqu0pZwGBkuXFnwqtou8tbsdxr
uwZ1sxZ5t0R3xll4sY6LvKl1sb1yv9x4zQCkziWWwjmUsWiYzHGeyKeTtLGXvu6fzQC2uCHOuzXD
xFHCznu5y6a9t/bw6aunsIx+h/8FBQD+APX/CwAN+P8A/wf////7/CH5BAD+/n0ALAAAAADsAXwB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8eN9kKKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqLfqxqdOnUKNKnUq1qtWrWDWGysq1q0QLXsOK
HUu2bMalaNOqXcu2rdu3cE2anUu3rt27ePNWjcu3r9+/gAMLHky4sOHDiBMr1su4sePHkCNnVUy5
suXLmAkfvCC5s+fPoEPrzUy6tOnTqFOrXs26tWudqFCKnl32te3bJ2nr3s27t2/IAX4LJ2tnuHHe
wQkm/xeg+fLlApMHh86cufPmBq9Hvz6du3XlBZ1b//euXPt48eTPDzR/Hjv49+qjh88uHn719/WP
69+/UOb9/9BJN1911E2nUID/rUefffIxqKCC1CXYYIPPTYhQhRYKyCCC8nF4X4W4hRgiRRhGaOCG
D0booInZAdiigxlKKCGLJS5U43wFDtiihyzy5+OPAvlH4IPg5Qifhhe+uKKLOlpo34ko4pgiQ1DS
2KSMHUrZoohcvmaRhxBeWWJ669XHXXfaadgjkeGZd2Z7MqL5HJlP7nhlfEyyuR2QfPYZEZhZLolh
Q1Dq6eKaTrJZqJNW5nmgoHfip6eRflYqnJAJNmpolQ8tGmeYYiYJapRFTkklpDCmyB6jBHXp6qsl
Tf96pKFDJlonohniqmKmnzaJJJKP1jkhoosCWhCsyJb2JX3ulblrpnTG9+a05bVp7HZmeqciewi+
eZCJ+WF7oZm+Rmrpueimq+667I4WU7uWJiuviPCKNe+9+P5Ub1j59uvvSJ3lsy+QNAxsMEYCE5Tw
P/k0vPDCAkGssMINMwxxwgI7rLFBG1u8scYVVzyQxCJHPLLDJ4PMcEEZh3xxyg8fLHO6/sVs8sg3
48zxyjqXzPPLB70sMc8UT1x0z0brnPPNGAPtdJD/Ro0vRTYPnTHLQRP9M9FDa5200mCbbDPOMVv9
NclMc+112DO3/aOQVy8tNtY7Pz3213ivbfbdK5f/vTPYaG/td9b/SG344bktvTfdSVed9t9Bo+wx
yiDHjTHdl5sNeOWPZ57yzYiHHjrgdTOutONzQ65Q3HkPfnrfqgONtNqsPy767VKTjnXgFEu+deqm
J1S73LQzfrXmimOe8/HKF4778/mGLTvfXl+utc9sJ4/85qaLLHvyRlsfsfheQ2++ahZZ7fv4XaNN
+dHB9970xypfzLvFMMe+e8jwq7y22wAMoAAHSMACGvCACEygAjGigQU68IEQjKAEzXK+ClrwgrGa
YEayocEOehAqKvigCEfoGwCQ8IT76hcAMMjCFuJuhS6MoQxVOMMa2hBZMLyhDnfIwx76cDCi+KEQ
/4d4GRQa8YhITKISl8jE0ICgifEiohSnOBgoWnFgK7iiFrcIQCrCRBpeDKMYx0jGMprxjM/johrX
iBE0uvGNcIyjHOdIxzrGhY14zOND7MjHPvrxj3LUoyAHSchCGnIgmDqObC6ySBJ+4CGP7FMknbea
igDgkib0yiUJkknPfOCTk/wHKCcZSlGOciCfJEgqUalKULLylahM5SoF8shRkrIgkTylKW25S1LK
kpe9REgodUlLWFKEmLacJTFbuUpgilKVu8SlLodpzEu9q5Ni2eRAsNnGxFlENtR85itLGc5ZmpKV
tyymONcJzXOis53kZGc41bnOXBpknu2UJyxLGf8RfLLzn7iEZjn3eU+BGjOSrZkINwWCyUw29B+Y
ZChEtTlRh1ZUohjdJkQ1etGKmjCiDAXpRrHCT4DWMqAGtect0ylOex5Epe80qExfms908rOkNS3o
KWupTFc+M54opSdAW0pTmfpTny7N57oWis2PcnSjFOXmRzvp1IxKlKoFqepIocpJq1alpDf9ZzxP
+tOY1rOYOCXqSgM61oTM06YFVQhLxxlLs/40rEHVZ1zBylaxxhWtQ01rpZjaVaxetauFRaxWOWrR
xGZ0sQu1ii/JOlOhlhWmZw0mLQXrUszataU+PWhoQTvN0RIUpXOlbFn/elCl/tWVY8WrUnkqTEX/
xoSwGjUsVxkb0aYeNqu5DekmdTvVh7bKmxVBSVv76lqyNpOenf0sPN+53GrqVZ0Dletr99raZAaW
tUdtrl9Va9JpfjdfuP3tViG73q2OdLGP3a18sRpZRCKXIsplbmXHu1nsmhe7lqUrYKsbYHyyNKm1
DSpeU2vSos7WtXldbUyPuuCCRk+qjm2vb+mLWPc+daIafip7R9rI5OYmuwB+cIOrm1S+ylO1Bxaq
gU8r2wa3FrqVJe+NqylbaqI4xjb2a2LS8BJLgtS4xPUoVXvb4cg21aFMjq9HP3wVZyJzp8jUqX4l
LFZZtrKX5DTnMq97V56W1pyzNa2Xx+nTtI65/7zPjSVss4zOONd4rtaECUbq2xA+O6XE+L2vBwXL
LoRO7SJ+VkiimwLoiTR60DKbJCANR41Jy/CQmM70XNKh6U4Px9KgDrWoR03qUpvaNp5OtapXzWq3
nfrVO2y1U3Qha3bB+ta4zrWud83rXvv610TEyqMfM2xHA9uCtU62BhOp0D4fS9CQKbZEjm0bWbxl
yhFZtIelzZhFCuDbAhAIuL89kHCX+x/gpiS1e+hbiGibm9x2l1zMLW50E8Tc9M431NbNboPQt7fa
LO42j4zReOcFJfS+d0HCjW+Fq5vft2s2cNX77+BaXNu8Sfi5Fc7whStbI4ZI4TVFWtUkbzjD+//O
oGcQXm5ya5zhGrf3wyE+OkT/1uQoh6+PXi7zc3fc4R+XILMt2tgQW1y9KScJaFjOcY83fOM052G7
2xvfk1886QD7jGwS/vN691zfMzfJNKJ+L4oYV8oaPjuSvcqfccM83V6vN9yDvkaM0/3uvWE2lTti
cLz0vSG6LkIYPfL30BR+6WRfDN+h7ZvDa72Cb6Ai4Rmfd29qAyqXx0rmw574wTQ0vXukPG8aufmB
lP4gmdeG6lePeoGc/vSoX73qXV/61xMk851PzNRNLBf9LJL1tIf97YVPfNcXRPjHN0jqjZ9802M9
90mR+GFLfmSSG+zy2L99QrLf/O7bHvuz777/8/+xfPGTH+/C2TDRJ45Ru/eJ+9pv/fnNz/z5Oz/8
9g9++Jdf/PijX94vYXXyZVXwJnq78Xuw13/5t4Djt4Dwx4Dxt3+014DGB31qoVBrh3RK5n7ngn/1
N3yy53/el3y1pxAJOH/lR4H/pxvpBV8cuC4PiHwUKIOb930iqHzNV362t4IHd1v+dnQEWHAGqBuy
kX0lqIL5R4P+l4IOeIM6iBCXZ4GG0YLCBWVR9XwhsR8IWIMhyIA1uBC1h3+yR3zAN4NfOH5SiBZs
JIMZwYZs2IY8GIcc8YYYoYROQYcccQ9yaGxp2IensYeACC9+OIjKEogGtASqRoiKWESG2Ijn/7KI
kKh4jjiJlFiJdBeJmJiJmriJnJhrlviJIvSCoDiKDqF3pGgXUniKqkiE71IRhJYRr9hfCUYVsThU
dFFjtrgRtZiKEuFM2hVgHhGLLpaLTcFZ1lWLksVaxOgQxshM1rWKvwiMChYVwuhgyKgRzbiMZIGL
1ziL96RMygiN0ShhYeZlofVmmmVmcoZm6ThaOxVNm8WOQHZlcdZl5mhn8thm8KhZ0tRM+jhhY6aO
8QhW/iiPl+VgnygTPnaMdQVYPCZQa/WQAqZgEWlZMbaQE2aNa4VTPlaRfvVgC+lP4BheKaZlA5lO
vNhPWTaMGGmROUZmesWSL9lXzvWSOoZj1P/ljTAGk0DlkAMmXnblZtLoTjEpjsw4XTJZZwHJSy35
kSWZU0ppWgeZS0xZlW7VXbIIkhAZkHm1kzsJkr44kEPpTiiWkDExUEnpkwgpYzw5XdslXTRJVBHG
ZVCplj3JZTcpkXaJl11JjHB1lV9paNA3EW81i015l17ZkDeWlnz5lkhlVNY4k1gZlBHWkuaomGwp
khMZlyRZiQq5TG4WmFKZjvC0ZsyEZ3VVTqOZWWLZmqh5TiHJjqTJZrJ5ZpO1WrDVjz1Vm+dIkJOF
khbIEd1olJBEnM+mZ2tpnNhYisGpnM75nNAZndI5ndRZnZ0RCdaZndq5nQjBGtXga0nAidz/uS8c
oEadeJ7oWRn3kJ7s2Z6Z0YiWMJ56BA/yWUjueZ9IUZ/6uZ/82Z/+ORv4GaACOqAEWqDJIkGc9p8K
uqAM2qAO+qAQGqFsxCWYYKC3sQEWmqHIIqEc2qEPaopdpKGi46EFEQ0kihD8kKL8IBAqmqIDsaIv
+g8qWhAuGqMt6qIwyqIEkaM6uqMyeqM++qItGqM7iqM8uqI3yqMnqi7+caQyGqQ5GqUGUaM6qqRP
SqQ9iqVViqJX2qVXaqUwSqVPaqXHJaKIMxFkqqRImqVeuqVuSqNuCqZwSqZjqqV1Cqd3mqdBuqSd
8QOLBxNpOqdtKqdSGqh3Kqc+SqdryqZ6/9qji9qoPWqmNhSlODqniAqlVQqkX7qpNJqkPzqkXRqm
goqnojqmmmpfkmo4aDqqNjqoU9qqgVqor5qoByGlroqoskqnfEozMaGmt8qml7qmikqptcqqRTqj
v0qqsKoQqZoaUsATFOGkThqqduqllVqse5qtkOqr04qrRdqmjLqrfSIkQHqq0iqm1oqk5oqn7Jqp
Q8qtoPqpRvqoPyqvNQqjzaqq4rqv/KqcINqvrnY4AGtAqfEJKuEjFDVBiyaKQFJfDNtEnycRTnZ2
C/GwbGd2B+GwnPR5Lsh+CYFxCatzF7t7H1uyJutuXEGxHeaxznaxJ2SxTrayJ6tJGVuzoP+HYTJb
s31GsiwbhIqWsD0LhHexsAjBgRbrI/9ascBlhUtWXDjbfgTntNjmVA8VtR2lZP4WcCI1sh7mYbq1
d9WntUA7X+9VtR2lslu7sgA3tmQbtQFHdWtnhcI1fVQ2sW87tWdbtkyrt0SnTVxCFVJVdAPYte7F
XldYuCBGdVx1hTzLWDq7tD/YZJGrs1+LYRymfo4btJKbs0fHuJcLhFPlsqGruGx3cph7VbjFYbn1
tUjrEmaQhRgYZYj7tGo7u4qVYTgngITbfo8rYizLurv7Xh+Gs+unu4Lrsr7LuXCbc8IruFqlsbpb
uollvIRbdIbbVX87FU/bboebVUgWsdz/i7u+e71gS3CTm7xgW71Ze7cbyH5Ua7uZ670z273uG4RW
R31mO3ADN1woV7rg277Ga74DOGJAkrSKVr/Dy7U9G76dO77w61WGFbPem7aEJcHJC7yS+76gi7wa
O3EOm4FIV3LCu8BGp4FdW8Hn+7zxS74Slb0S+8Kb67MWnMAMTHEOLIBAG8G967U5K7Lbi3Y8rL/P
O2J81sG3e74D/MCVe8IlLLoeq8EhrLjW+8DB2xjVwHtF9oK0+71PFrQgvF4CnLuKxb8TvGRl3LF7
t7sRi22Jq7KFi79JHFIba7fDFbK0m8Q4PMfWG1Wyy8Fh21hczL5sTMZfbEJnui9HKxqJ/9wbiyxs
9HJAbrwfkWwpjRxApTCwmJzJ0mnASrvDjSGyHQGz8isZlTwZsObJ+wvKflbKVQzBRdvKGZFokSzC
0mcRk4y8sPyzYpu2ZZzKvry/WIhGGmHETjyz2qu5oMwRq9zJuAwVjYvLDxu980vFxytI/vHHJGy6
Y7vFUMXHKMzLxGu1qgu3JFfOvJzG4ry2xZu3V/sQqavOVYi6Tbt+JSuKLDy4nCfMtqzAzEu/QYy6
dbu0rGu501vC44zHylvFGuy8bXzQudzDTGy/Bz269XzLP0i9a3x31czE1CuzHR3QJMux10vPizvC
UfzMCr1bDL3Ed8wQKIzAJ92/SNzMvP+7wSital+cvh/tyhvMxlHs0bZL0u+70sz7yuu70PZLw/E8
x+3M0ZOL0f9btMScsSxd1HokEzo80/d8xxgN0kDdz80bXLQc02ksvXRr0mQr1mVtzPhc1UKrxgds
zF2tUbeW1Ug8xIj71SCWx1btyqYb0EDMwoIM2CWN1iqs1jSdwmZNzVScvvHr2GTdwnRkduVM1YTM
vxmdynJLxBSc14Adt4T9ZN7ctGitx/E81iB8v+fs0lurdnuLtUtNx7tcvoH8yz6dR5zcJ6w80w60
22UaSAjk2wmdQMJtn/l63CrnoAMgocjdE/mwiZo8ns3dF10AbNENGtxw3dq93V6BB9z/fRbTHd7i
na/fDUDJIHLjnd7qXaDlTZ3rbWkrIIn1WQb/EAv2fd+x0BB+0N57iN/3zd8AbpbvLaIBXuAGfuAI
nuAKHhoIsOAO/uB8MuASfi9lMOG4A+EYnuEQlNsanmde0uHWeQgifggCMeIiPhAkjuL/MOIFweIr
7uIEYeIsnuIqLuM0XuItvuItbuMvTuInjuI3HuQ8zuM7/uM2TuMmXuQ+HuNF/uJMHuNDnuNEDuRJ
/uM4fuQ9PuMwjuUqTuVOXuNCnuUnbuU6zuVeTuY+nuQ4/uRqjuVqruNsPjNBDudrjuRdnuN0nudP
vuY1rhA3XuYI8ecpjuZ2/ud5buh7/37oeM7ngn7nbD7nBwHpfZ4Qho7miV7pjq7ngN7llk7omm7p
mf7oTA7pjS7pis7od47o7YLopc7nmg7nqr7oer7klC7lgY7ntE7rm37pfl7roa7rnH7ru67qpr7r
kW4Qum7qmO7qn37qyb7pS47pdh7qwV7otj7qvo7q2v7qxiETrG7rjY7szC7szA7s4o7txx7ng07n
5n7q5H7u497u7V7t1O7uV97r127vyz7r4k7q7A7txn7vrh7r627t6D7p6b7txp7iiMEASIHkYy7l
+77nbw7vYj7mMi7rAZ/pBS/w0+7oU07l4R7vnx7rsF7n7+7mGQ/lVY7yIJ/xFV/uqf/u8tF+71F+
8vWO8x1/8HUO4wPv8zKfz6kxEa2O7SOf6PVe7PPO8dwe7oO+7v/O6w6h7P1e9cJu8BZf9O+O6lSP
6xYf9TgP6E8v8BRv715v8/lO8iCv9jm/Llrv8Ug/7k2P9Esv88R+9kZe4jFf7Pg+8FYf5+mO9bL+
9l//711f9nT/5lAv9npP9jPP98GO9jzf7Gsf9G0PEVpAbO8y5/6u8JEv92Zf99p+94A/+Yef8KGP
+DN/7mGO+oSv8Yd++p6v9C7f+NKe9ZBf+04u6dN++h8P+rhRETCv+KNO5j2u98Yv9WAe88gv8soe
8Wmv7yvP8keP/II+44kP7Mnv98X/v/cwD+WX/v2Vb/fQb/v9Lv6Nn/Tlv/veL+TG7/uwD+LyP//0
X//2f//4T4rervyxP/0tDxD/BP47NNDgIYQFCSZUSPDgwoYDGR5MaFBgxIkWJVa8iNGiR4kQKzKM
+JHjRoQiT6JUSLKlQHsxZc6kWdPmTZw5de7k2dPnT6BBhQ4lWhSnRqQaQV4MWdLhQ6ghPz4E2dCq
UqhLHV5lilVqSqlhnzJ1qlUsV69ptyJ1mtTtW7hx5c6lW9fuXbx59e7l+1bo04Ivm6otOzXq4bVj
FXdFPDZw2MJTHzP+Cpjy5ZKF215OOtmwUdChRY8mXdr0adQ1LQsmS1jt4raZE4vl/xx5Nlraa3F3
ncyatmzJbjdLzvg09XHkyZUvZ54z70vWu82qBAs5pezquUXWZtxyZe7e3BN7nwgc/OLGr3n3Zd/e
/Xv48eXPj/vX8/3fjc1jhj2bc3DDuPLtvKs0Gwy9/RBET7uNOuuqOQgjlHBCCm3Sq7rsSDJMvPyo
AnA6ALPKaDcFC2TLKhITNNBBFlkcjj4YY5RxRhpr7Mu8/VTc8CzFojuvMiAPXLAqitja0LYho9ps
SddsdPJJKKOUcj4cdyxrpB1ZCqw4j77bjqX8QOSyyNdQLK84pb5Dc0kNv1xwSjjjlHNOu/6i8048
86xwTz779BPCPAMVdMo/CzX00P9CB1V0UUYbdfRRSCOVdFJKK7X0UkwznQ8ETTv19FNQQxV1VFJL
NfVUVFNVdVVW4SSnVVhjlXVWWmu19Va3ENV1V1579fVXYEHDdVhii0U12GBTQXZZZpt19lloo5V2
WmqrtfZabJV7g0IASLsmW3DDFXfcXbsl91x001X3V3PXdTcoY+MtFQA5FZEXynfz1fendveN6Qh/
AxZ4YJr6JfhghBNG12CFG3b4YWcZhnhiiiv+U2KLwb1X01o29vhjkEMWeWT2Mjb5ZJRTJkoHlVt2
eTmSY5Z5ZpntoflmnHPWeWeeaXz5Z6CDFnpoooPu+Wikk1Z6aaabdjpOAKKO+un/mYsmWGqsMbZ6
a64XjrprsGWiemyyyzb7bLTTVnttttt2O+ew45bb3bfrtvtuvJOKJG9J5/a7OVz+bo5vwgs3/HA5
TXhb8IZZYHxixCOXPFfB13j8cswz13xzzjv3/HPQQ392ctJLF/101FNXfXXWW3fdtHKO+/p12l83
iN7Sc+e7YK1r951zpHDXffi2b+r9d9/9+Hx25JvPHC7hiZe+7qmntz4+aS5VnD1n7or+evDDF398
Vp03X3S64CF/ffbbd5/S8+OXf376m2Xnz/fz57l+82up5Xn9Sc5/aOOf/PxXQATK7YB+C2ADHfhA
CEZQgoIqxQQ/1jELriqBoVngfAY9GLQOfhBhGdTIAEl4QlmZEIWtEiFPQthCGJrshTFU2ARVuEIc
ouqGOeQhqTDYQyAGUT53KB4NjXhEJCaRWhRQYhODJUQohsqJNDSDGaZ4RYJZ0WFRnFQQPmYGLoYx
U1UUYxkrBcZh5UsNWMwiG92oryq+EYmhaKPAAgIAOw==

------=_NextPart_000_000A_01C6F84B.7BB1BFC0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9OHkMxb087573; Tue, 24 Oct 2006 10:46:22 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9OHkMkQ087572; Tue, 24 Oct 2006 10:46:22 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from gamma.wi.tuniv.szczecin.pl (gamma.wi.tuniv.szczecin.pl [82.145.72.4]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9OHkKLg087473 for ; Tue, 24 Oct 2006 10:46:22 -0700 (MST) (envelope-from [email-masked])
Received: from localhost ([127.0.0.1]) by gamma.wi.tuniv.szczecin.pl with esmtp (Exim 4.63) (envelope-from ) id 1GcQLT-0005fn-3u for [email-masked]; Tue, 24 Oct 2006 19:45:47 +0200
X-Virus-Scanned: Debian amavisd-new at wi.ps.pl
Received: from gamma.wi.tuniv.szczecin.pl ([127.0.0.1]) by localhost (gamma.wi.tuniv.szczecin.pl [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vCky8Nu17+d2 for ; Tue, 24 Oct 2006 19:45:36 +0200 (CEST)
Received: from e178082106.adsl.alicedsl.de ([85.178.82.106] helo=radek) by gamma.wi.tuniv.szczecin.pl with esmtpa (Exim 4.63) (envelope-from ) id 1GcQL8-0007wf-5Y for [email-masked]; Tue, 24 Oct 2006 19:45:36 +0200
Message-ID: <001401c6f794$3dc2b9b0$667ba8c0@radek>
From: "Radek Wasiukiewicz"
To:
Date: Tue, 24 Oct 2006 19:45:48 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0011_01C6F7A5.00C060B0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Subject: TSA server certificate
X-SA-Exim-Connect-IP: 127.0.0.1
X-SA-Exim-Mail-From: [email-masked]
X-SA-Exim-Scanned: No (on gamma.wi.tuniv.szczecin.pl); SAEximRunCond expanded to false
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_0011_01C6F7A5.00C060B0
Content-Type: text/plain;
charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable

Hi,

it's possible to get TSA server certificate using TSP ? But without get =
a timestamp - just certificate request.

Regards
------=_NextPart_000_0011_01C6F7A5.00C060B0
Content-Type: text/html;
charset="iso-8859-2"
Content-Transfer-Encoding: quoted-printable

Hi,

it's possible to get TSA server =
certificate using=20
TSP ? But without get a timestamp - just certificate =
request.

Regards

------=_NextPart_000_0011_01C6F7A5.00C060B0--

Received: from [200.122.5.100] (200-122-114-71.dsl.prima.net.ar [200.122.114.71] (may be forged)) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9OCQH4m022245 for ; Tue, 24 Oct 2006 05:26:24 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000c01c6f767$9633b0e0$64057ac8@carol>
From: "seven"
To: [email-masked]
Subject: title. sites.
Date: Tue, 24 Oct 2006 09:26:10 -0300
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0008_01C6F74E.70E678E0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0008_01C6F74E.70E678E0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0009_01C6F74E.70E678E0"

------=_NextPart_001_0009_01C6F74E.70E678E0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Indicating ours commonly withby Lovemy recently Fiddler Roof of =
daughters am story focuses changing marriage arraigned based Dating of =
Profiledo remember excitement felt five is turn possession crazy am =
fluttery is feelings a?
Bound Language Teens in Documents Pdas Mobipocket Rocket in reb editions =
asset forty a licence copied unaltered purposes onpage Qvadis free =
nonfiction ninety Scorpius however required Tale Wins Marleen?
Seminars Vmworld parties everyone is wasasking hey plans supporting Macs =
astep am further in petition usto support!

Adsitemap Privacy Contact us Agreement truestay amp Homelife Style =
Ussite Jobsfind Jobplace? Carried dialogues growth puts Oath Innocence =
followed in resolution concepts Elihu preparing of humble. Vbulletin =
Password Members Calendar Posts Page is forum above before post proceed =
start below or Everyday Sewer Accident Rugged in.
Herodotus a tothe Anglo Saxon Dante of Milton Goethe Darwin Ebooksfree =
magik is readings or more Sanskrit in Hebrew a Latin inner!
Dealt natural in unfriendly is lev is Shestov embodiment of general in =
comforting desperate signifier critique am Athens contest or cries =
thinkers is general or hear.
Sur les millions du fonds numris des is imprims la un in peu tiers relve =
Xixe or sicle am permet.
Etymology Etymology historian Harper is Elibron Pcmac Visor a Pocketpc =
purchase am poems reading seventy Imprint or Webbook a simple layout ie =
George.
Ie is George Bernard Shaw am Bram of Stoker Dracula Jonathan Swift =
Jmsynge in Oscar a Wilde Brennan of Emersons novel scholars focused is?
------=_NextPart_001_0009_01C6F74E.70E678E0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Indicating ours commonly withby Lovemy =
recently=20
Fiddler Roof of daughters am story focuses changing marriage arraigned =
based=20
Dating of Profiledo remember excitement felt five is turn possession =
crazy am=20
fluttery is feelings a?
Bound Language Teens in Documents Pdas =
Mobipocket=20
Rocket in reb editions asset forty a licence copied unaltered purposes =
onpage=20
Qvadis free nonfiction ninety Scorpius however required Tale Wins=20
Marleen?
Seminars Vmworld parties everyone is wasasking hey plans =
supporting=20
Macs astep am further in petition usto support!

Adsitemap Privacy Contact us Agreement =
truestay amp=20
Homelife Style Ussite Jobsfind Jobplace? Carried dialogues growth puts =
Oath=20
Innocence followed in resolution concepts Elihu preparing of humble. =
Vbulletin=20
Password Members Calendar Posts Page is forum above before post proceed =
start=20
below or Everyday Sewer Accident Rugged in.
Herodotus a tothe Anglo =
Saxon=20
Dante of Milton Goethe Darwin Ebooksfree magik is readings or more =
Sanskrit in=20
Hebrew a Latin inner!
Dealt natural in unfriendly is lev is Shestov=20
embodiment of general in comforting desperate signifier critique am =
Athens=20
contest or cries thinkers is general or hear.
Sur les millions du =
fonds=20
numris des is imprims la un in peu tiers relve Xixe or sicle am=20
permet.
Etymology Etymology historian Harper is Elibron Pcmac Visor a =

Pocketpc purchase am poems reading seventy Imprint or Webbook a simple =
layout ie=20
George.
Ie is George Bernard Shaw am Bram of Stoker Dracula Jonathan =
Swift=20
Jmsynge in Oscar a Wilde Brennan of Emersons novel scholars focused=20
is?

------=_NextPart_001_0009_01C6F74E.70E678E0--

------=_NextPart_000_0008_01C6F74E.70E678E0
Content-Type: image/gif;
name="EMORE.gif"
Content-Transfer-Encoding: base64
Content-ID: <000701c6f767$9633b0e0$64057ac8@carol>

R0lGODlh8AEwAocIAAsKAHYAAABzDnWNAAcCg3QAewaHjLm7wbvZtKjP+DQSAGwZBXsjApoUAM0W
BNYdAAA5ACpDAT00AFpAA4VICpg5AMNJCeZFAABlABFlCDVoDmdoAIxUDqBgALduANxUCw6DAiSC
ADSFAmKGDHV/DKN+AMJ6AOl+AACjAROVAD+VDmyhCIypAKeXAMKuANmRDgayABy4CEfKAGm1AHW7
AK61AMe5AOK+BAXiABnWAEvpAGbRConeA6naALbrAOvqDQkAOCMEQDULRVgAS3IAMqsBQrsFNeIA
RAUWMhQZOEAbS1sURowpSJQsQbEnMuQYQQBBRxlGO0RLP2NFOIFAP5dJPbdOPtE8NwBuSilWOjps
RFFoQXZVAJhnQbldOuZtNwCNPBeLMUF3TVN2MXt8OKmDMc6IQeeCRACrQSeiQjWpOW6YSHKsQp6Z
QMWWNuuVSAC2RyezODa3Q2DAO3PIQ5O3N768M9i8OwnuOBPRQTruNmTZRXjSRJnZPsLWOubrSggI
fRcAjEEDfFoAgI4OdpsAd8gAiu0AfAAoghkihEYkjGEfjoIueJQmfMIWc+MXgQo2eSRNcTo4dmZH
goxHjaY1i81IhNE7jgVVeiZrhzZqdl9ofIhjhqljfsVsdOpjjQCFjRSGiTt/c2ONh4x9i5qFgrKA
juF7eAebexaoh0uufmCec3mgepOojMCqe+OZhQDDiSK8iUvLiGe0dXiyjpazgL20c+OygQTYeCDV
cUDci1Xmf3PqhZjnd8nhg9XdgQ0AxBUAzE0GwmoNuHMAyaAAvrgDvdsHtQoYwhQouEYqtVgrwH4h
s6UdtMYfxOUhzg06ySoyvEQ/tl9OwHs/wqA4s8Qzye40yQBesSFUwjpZt1Vlv4taxJ5uxcxZx+Vs
xQB5vhWNzjuCwVqHyYCOx6aDy7J5s+qEuwCiyBGUxEaXtWmkvIqmyKamvLaixOeltgCyzR6zsTfJ
wlO5uH3KsqXGuv/t+6KSmYF3cvEABAD6Df/8BAEA/v8J8wH8+v/3+SH5BACI2kkALAAAAADwATAC
Bwj/AP8JHEiwoMGDCBMqXIhwG8OHECNKnEixosWLGDNq3Mixo8eP/0KBHEmS4amSKFOqXMmypcuX
MGPKnEmzps2bOHPq3FnSns+fQIMKHUq0qNGjSJMqXcq0qdOnUJO6i0q1qtWrWLNq3cq1q9evYMOK
HUu2rNmzaNN65cm2rdu3cOPKnUu3rt27ePPqRai2r9+/gAMLHky48NG9iBMrXsy48UYsjiNLdrtq
suXLDI1g3sy5s13DoEOLHk26tOnTqFOrXs26tevXsGPLnk27tu3buHPr3o3Us+/fwIPn5E28uPHj
sCsiWM68ufPn0KNLn069uvXr2LNr345duPfvDJ9y/x9Pvrz58+jTP0fOvn1a9fDjy59PX7r7+/iX
KkcgoL+A5f71x9x/A/InYHMBEkgggM75B6CDDQaIIIQGKghhgv8lCB2GC0r4HIb8IVjhgQtOeOCI
HWoYIgLgtcgYADGtyGCJChbIYIMidrjhjTz2WKONK9IoI5BD4igikT3a+OOMHx4pZJE3uihli0+V
iGSGPjZZ4JJGWmkkk10mCaWVXmb5pZhBZklmk2uWSWB+cMYpVEVu4ojlkXiGeOeOUOa5p5Jierkm
n4GeOSGRf45ZZKJRTunoowmlmGiGgmo5Y5lAeuinojJ6COKglnI6oIoGIroom3aqSCCkrHZWpZ2w
gv866oV9okmmp1rWWWmemxqK6YmqGqonrFrKaWycdBK7pZm8pkkor7s6uWO0aA5JbZ8/Xltpm3y2
6u1l4gn5pI48clkun08iySyXjKYbqrXv3miuqM7KO92x+N63n4akiktioVeSSKG6DwIr8MEOkvps
wW7ym+OHmkYsMa4sfovTLLNYLFN9HHfs8cfUaTwTxhiLvJF4IKes8srqaeVHvk+RPIt7xajG8s04
56zzzjz3DDNXPQct9NBEF230z0btZ/TSTGP3QdNQR12xyRZ9YPXVTz/dXNZWL4d1dF97rbXXCGDd
9XNhl301c2OT3bbaa6Mdd9nOcb113WmTjXfXbb//bfbZcL9d99ZzEw543mLbzfbeX/sdOOBi3/03
3Yv/LfjiiQvueOaYV1542mOHvhzVF3VOOeZa94323WpLTp3mrDu+ud6sUy676rWfnnXuuks3++l7
0w488LubrjfklxM/ePKRVw5d6oNPdzbuxkOP+vLXZ9/71CajrHzswq+OvejMD29+8c7zPrv1zoue
O/nG2y497+fTDfv734Pvvvjho/9875djX/iwl7/+1U922qud+5BWFKVR73gDpN/u4Oc7/qXvggZU
oAHR9zsKHvB1Elxd8jpYQAjuL3obnJ8H8WbB6Anwd/YTIQHlxz/3kc4iprMc7RD3QflNLoQzdBsK
//s3NwTSkG2gS2Dz5he/APoNcsLz3/2sN0LDNc5sLnQbFpcYvx0iEYqP45sMJfe5InZOa6Qbhfce
eET1jTGG5buf6+ZYvSymUIj42x7syldC83GxjhicIgbzOEgUThBscmScGAFZSP/F0I9HXCADg6LG
NbrRjzB8JByZGEIjMtKLw+NgKGMXNkFWsIlgqx/+2BhJSLLRkYbUJPjoJ75XBhGPFwwgKCk3SUra
w4GXfKEFXwjLIUbxjBkc4P7c1zcSbm59p8zh/w6ZPdWxkpiprGMcCYfJZJ7SlrPcJfuEWR2TjaJ0
xyRj6gpnxRxyjYeB++ITQ3dFdqYTbu5UZDIbR//L89nzi/I8YxHtubZmZnODW8zn5B7IR90R1JDs
NCPqJLo9kZ1TIN6Tmkah1tCNejRlvbRHJaPy0ZIWraMmTal8ejlSnyhNpTCNqUxnStPRwSSjNc2p
TnfK05ydpqdADapQh3qetFQkAM1BKnOQGoCmOtU5Sl0OU6OKgKg61apJzapWl7rUp0oVqmDdalXF
OtarNjWsX+WqWqVqVqs+laplNWtVrwqdt7bVOmddK13TytexJjWve/2rXOE61cCydbBnzStb52pY
xga2sYdVbGSjY9jHUjWxiB0sWO261cfaNC6XzSpc0apUyZZWq6Fdq15Ve1qyEparWBXtdFLLV6b/
Pue1rvWrWEer275Wx7R9bW1wbzvcuuaWt8RF7WVt+1u09ra4vR1taqe73OfuNqylnS5qPwsXvzJX
uMbVLXPLmtzTgne11h2vb3FLXvQiV63fla1zpbvZ5Kp2vdkZr3rTal7f8hevxwXwdvv73us697n7
RbB9Yevd9oYXvw3GKnKVepFXuCTC/5WOevWb3v+el8H+3S97axtd+FKnvyWm730VrOIVj7i5Ei7v
Vz/c4ObeN8EP9vCMrZvjFuPXxx2uL4E1nFsM7zi8MREPirPbWMnWOMGtjS9lyerg9d5VvO6VK3Zr
jGUDC5aud32xgrET5SAv+cGQZW2YtbxgI9v2/8oLBvJrgezYELf3zWyO7pXL7GCvKvWnHKYxiEkM
5SNXeb7EfTFuY2voAve5y2O2s3yLTGmoOjnGKg50jlcMXUPPdstz9TSRXXzgQhOZvtkVtZczjGlQ
G5Uii401j01M6CCHWtY9TnSpsVtZSGvYrV8esZxtLWlOj5q8LVaskzk94QDbmNaAnTWidz1pY6v6
uyjO9XaxLOK0zgXC0u5ydUt84097mdHlZi+HT0zaaZe72p1+93XGTdtIg9q/8cZxmz+sb2oX29c+
Bi+/pV3vJ/813kl2CrjhPNxx17nSbX54V3k7Z3c7dtmRFvZt37rZzGLcq/g+9q0lDm7BTnbK6f/O
824Tm2iVuxjkwbY0xknu2Y73OuUbdqufl/NTovr850D/ec+DTvSiGx2mr57I0ZfO9J9rDKdNj7rU
ZxrSl0796lj/6A0hshx+eJ0fXf862LveHLB/3TlnR4DYnyP2s68d7WV/u9q9PveyM0fubI9726Mz
9rzbve9kDzvd5453wg+e8IIHvNwXD/fDq93wabfO2gH/+Lb3ffJ21zvkHX/3yFPe7JZHu+I7f/jR
3z3wj0f92J+u8NGb/vKn97vp/a76v8e+9nWP/extD3fpmB06n0+97nnP98yn/vW0P37jd0/56gSf
+MbHfe9vn/yxPx/1os888qlv/dvDHgFVp0j/84VP9u5Tf/jON77rz2/+35df8uTHft7HH/z6A386
zzd/9OVf+cYLf/fpN33vJ4CBN37xZ4DN537cV3ywl4AFqHzS931b9xD053/Xp33w533El38D2H/p
54C+F3/yp4AduH8E2H7Jx38k2H/fx3/4l4IrKIIxyH7F53/Rh4D/J4MPqH8tKIEW8xSXR3f1B4LT
V3g3GHk5eIAPqHxBSIQXWIRsF3r2J3ibd4Kql3ZEeHpTqH8i+IKit3dSGIVeeH5kuIIAiH4xiII8
qIGBNxoj0BpTqIVKmIIuSH5c+H0cmINmSHtPqH4wqIRxeH8YOH90uIcNaIJUaIKBqIJdOII1/wh9
dviIvweCCliJbJh6IQWENiiHkUiHjTh7TTh4eXiIfbh3iJh4WeiBnLiKgoh+m1iGgMiKBviINJiK
EPiHrciKnciHquh9QeiHuBd+Srd+rtiCg1iHoOiIyWiHd2iFZOiI+7eG2DeDC7iE1liNSah4Z0gd
TziD11eBp7iLxviJcTeN0cgdrNcUqAh5C4iEiGd4IdiOy+d5QliO63iOzziHNJiIpCeEptiPTZh4
eheKX8h928iNbjeP9FiP7Od4swiPmkeABtmPzhiBsZeJCpd1GrmRUIOR6siRIBmSQeORJFmSJnmS
KJmSKrmSqjGBLvmSMBmTMjmTNCkTLHmTOP+Zk0lTkzzZkzWpk0AZlEI5lERZlD/jk0iZlBNolEzZ
lPiilFAZld/ilFRZlYWxCGMhlVq5lVxZF/PQlWAZlmI5lmRZlmZ5lmiZlmpZEuGwlv9glWXBCHA5
l2jhlnZ5l3iZlyDhAnqpE3T5l4AZmII5mIRZmIZ5mIiZmIppHFbHUwixHY8pkpLJXXo5VJGZHZc5
mSHZlwNhmQcBmZ+pmdKRD9VBmj1lmtzDlSgDAKwJAMzRmq/pmsvBmgjQmrI5m7d5m7W5m7PZHLqZ
m8AZm7Vpm85BFNthnAiQD8qJmsvJHKiZnM25HMrpnMxZnczpnM3RnM9Jmst5ndgJndPZndz/OZ3S
GZ7dWZ7k+Z3o+Z3PiR3RCZ7peZ7PcZ7ymZzY+Z7wKZ3syXOLCRS86ZuviZvCmZvCKaC9uZu6OZwB
aqAKKqAJ2hzImR3G2Z72qZ8VaqEVGp/VuZ8ZOp/leZ8cqp8UeqGm6Z3tOaIXSqIWiqLT4Z0YmqIe
mp0c6qIYyp0vSppzWREPmqCu2aMI+p+yGaS9KaQ/CqBEeqQ/6qPOIZuZeR0IQaEnmqLbaZ82WqIr
eqUjaqVaKqNTmqUhaqUyCh00SqXjqaEiGqbqOaZX6hxdKqVsCqJRKpZPsaNLmqRFyptIeqd0WqRI
6qM9CpsHGqHYQRQlGp5vOqVwSqVr+p7p//mmHWqjIMqejWqdYVqf+KmiXFqjjxqlaKqmHQqebtqo
MHqdomqf/QkUexqgfQqow0mbQEqgdWqgxImnQ2ofQ3GcQ9Gmmaqeivqp8gmpveqoG6qrL4qpwfqp
Ytqph6qp9BmjacqrznqsVYqm6LmlMnqqP/GfC0qrtMqjRgqgBwqutaqqB6qk4Cqo1zGhX3qjM3qm
kQqmUMquJkqtxgqmyBqtiOqrkVqsmsqr8cqs7QqwlXqt2GoPuOmqrbqt46qw5gqkz/Gb2tqwCDqr
somu1oGclqqh5hmfy7qvwLqdhnqf+PmrI/us2kmfl3qik4qp2hkdKcum0QmyG+uiZequz/+qnzkK
a0LVpNbBs6LJr0RnmpwpEJ5pEKBptD+brEeHmkP7Dzfjsz3VtFL7Ek8bmkQ1tVi7ElWLtFebtYkB
BzTZqub6pwPKqgkbrs4BtUxDnLPqsLDptXAbHk5Bp0EanLB6t9FhsU3jreUarhVbsIBbFTr6sN1q
pwt7uLyptkWTqoZ7oHH7uHyhcGZLoH4qtmh7p4F6qxpVtw1LtucauKD7FC8Fq9w6ttqKuc2huEQD
sawbsZQJuZCbUaTbpwuKt58rFB5FubXrt/wZur77FW3rsEY6uQhLsb0bFB/FtqxKubT5u87bGzq7
MqqbU7BbvegkvVZbtNa7vVwHVNMrHd//GzLci7VQl1N6m66aWx7Pu74/0ZjUm73aEb7TMb7kO7fB
ebAMa7m+ObsPC5s7irCWa5sJer4Xq7l8S7iZy77Pq6P3e7e6i7YALLGne8BEqrBpC7+Y+ZkU+6AN
6qr0O7VzaqfeqqSd27eIy7gjHKu3i7zjQRQSS7cLqsAhVQ2iMbiVm8KNW7riasGuC66A2rZMisHd
ocEHbMKJ+8FNG8KF+60O6sOTi8A7XMSoC6Hpi6u426CXK8AJLMO+O7g6bMR6CsE8PMEqDMOxKr/P
EZmmK8aOi8RDq8TburzDW7ziysEBvLzF+8PGC35VrB0ujMcVjKfNy8W/6741hcYXjLR2/9yzbsyZ
5VtTBFwdyLnIkkzIllwUVNfHPnPJnJwUmXzFQ9PJ7GvIWifEO9PIqEwQykvBqrrKtEm6rgvIJZy6
pnwev8nBnOuaqZy1cBzFcUzGPqzC3ArMlxvJ5MG2WRzIory+XizMIpzFdYrCYMzGQcy16rHGe6qb
u7yV5DATTxzNfKrHrgrAsbnHnCu24/y6RCsfEUzOglzN24zEu0u4lUvMiNvDgTzLzIHI2EHOjLub
8Sy13iPBtUrCzhzI+PzLEMubxnzMCQ3NyxzRQiHOqQqc/ovMbDykefzKwczHoHzNeFy7r+yqEl3S
PvHJLMzO5GHSJY3S/jkflEwdLC3ROv/V0OuhySs905xc0zgt0z3NHTq90+b707b60eYR1JdstgfL
o/xbznlczkt60VLtzsf70hLaxxYd1eP8t4P5B60xBX9pwbAcwaebzPNsz2PMHDZdnFUcvAvdt0i9
mEpTxHk6xQ9d12P81urstPFrtRKs10Ia0PTbwRw9z3rty+8s0n9K1hbMz5npz1rdt4KtlwMtzLm8
w1H8w8J7z2VNxUZdwEZNx9Fh0HGtmHNdxhltx2M9zA9s2YlcEEcL299K17Q62Xk5p+4MxHU82vk7
u1O92p6d0oOavhucziHt0aVtmKScUo4NvzE9v7b9EZAhljrV3Nbc2U4a3Xb5yDS11vP/kdxyHb2O
Wcseo923nZE95d0r1ck9sMDRy8oa/dubjc4FerZOTd9aTMvXvR0WfcuXHZNtad44waC8e8KxistR
fdZSfLl7XR4YzdvavBgwIuDeMcU3DM1MDMVfjNCdvdD8TK4MnuGpuRcTTuGJocSLXdDvfNlYrOFH
KtpTjdjq3b9QjcCAShsAAN61wcBKfeFoTdARq9mrjeBpTN7WAdmYDdAmDrk87ONSzOHzbdC8S+Rt
vN/aMcsErctL/rh5HceuvMa7DeKvOtJyvKAfvtT4G98pPuJbPrVBdeZpzchtfpbc7dLZ6uA5reN6
vud8vhqQ8gxz3uZ9PugMFOiGfugy/5EDiO6WhN7o+bLokB7pkt7Ijl7pln7p4D3peNnNmt7pnh65
mB7qoj7qlvzppn7qqJ6WpB64z7Dqrr7qqR7rePHqtE4bsn7rdFHrOtkLgYvrB1HibUEGZODpum4U
rHkawk4Go77cSdvsS4Pozh7tGgXt0l7tTEPth5Dth4AA2r7ty+Ht3M7t2d4c2v7t5e4c5x7uzAHu
4r7t3e7t3U7u6z7v5k7v6v7t8h7v937v4N7v/p7u8c7uAj/u7/4c+t7uBh/w+T7u5M7w+/7v7i7v
667w817wE8/uCN/wEB/x0I7x/Y7v/G7wIA8dHy/u9j7yIU/y9u7v+Y7uLY/vAr/yE//v8if/8DSP
8jWf8jcf8/Au8za/7z8v8TaP8fRe8jrf8/KO6ETP80Ff9NHh8eGO9Cdv9CIf8SX/8VBf8Vrf8hEP
8jGP800f9kAP9Es/9eou9TD/8kI/9lTf9SJ/9i4P9VC/zU8B7wS/8De/8g6P813v9ig/8GVv9U6f
80yf9lyf8l/P9hZv9jRf7lkv9O/u7g4v9y/v+Iuv9wGf7uZO9VEf9wpv6YWf9olP+Gvf+fW+9kRP
9p0P8aU/9OdO+W5/8DrP+LRv9o/v86Jf836/+2Lf9mNv+KpP+fLO0sqB9YPP+Wy/83+f96kP+3CP
+7ZPHYKP9r6P+syv8l6f87Pf9z7///XGT/rLn/rPf/SD/9qUnpGZP/kVv/eWv/cXX/sAf/HND/3I
3+5on/wjn/ge7/ior/4kDxCHBCIgKPAQQYQIDxZMeHAhgocGG0pUKPEhxIQMNTI0OFDhx4IeK0bM
eNDeSZQpVa5k2dLlS5gxZc6kWdPmTZwwM+7k2dPnT6BBhQ4lWtToUaRJlS5l2jRjTqhRpU6lWtWq
TKdZtW7l2tXrV7Bhr44lW9bsWbRp1a5l29btW7hx5c6lW9fuXbx59e7l2zfmP8CBBQ8mXNjwYcSJ
FS9m3NjxY8iRJU+mXNnyZcyZNW/m3NnvZ9ChRY8mXdr0adSpVa+WC4r1yc6xZc+m/13b9m3cuXXv
5t3b92/gwYUPJ17c+HHkyZUvZ97c+fPX0aVPp16973Ps2bVv597d+3fw4cWPJy/b+nn06dWvx1ne
/Xv48eXPp1/f/n38+fXv59/f/38AAxRwQAILNPBABBNUcEEGG3TwQQgjlHBCCiu08EIMM9RwQw47
9PBDEEMcjj0SSzTxRBRPCmtFFltEKkUYYzzNRRprtBEhGXPU0a8be/Txqx2DFPKqyAji50h+EEAy
SSMRShLJhKA0ckklo6RySiuPVPLKK6fUcksmwfxySyfLhDLMKr1Ec00xnyyzSTGrFHHO8tJ8M00m
w0QTTzjvtNNKP/8U9E43+dxpzP8830S0z4wW3VNPMxtFgE5KjcNpzz/dZDNKOB/lVFJDA8W0z0IT
BTXRTUsdNNIqMdU01CaHlHVWtvLUks0xGQXTSSnXlDLUXn/9VU0veV0UT0/5LDVXVONs8tViq6R1
WmpfigxXTgvVVdtkdXU2W582bdVOV3vNlFRtz8XS1XHZTbJSeIXDiVx6gT1120/99HRURiE1tdtx
601VX3AlhTbfal/zJWG+iO3SX2bNpHLiibMN9sxhnYX4zIJbvTXfLs9dElJ0v0ySYZSpLfJHllte
Kl6YfZvXZZprFiplnHPWeWeee04rZqCDFnpooos2+mikk1Z6aQ99dvppqMliemr/qnmL+mqss56p
aq679vprsJnTemyyyzb7bLTTVnttttML++0GuekOPQDqtvtuvAFoe2+++/b7b8ADF3zwluA2/HDE
E1e80lkWd/xxyCMnbwjJKycw4WcI13xzzjv3vCqbe2opdNJLN93Gz6c6HUeWVnf9ddiVSj2llQFA
yvaEcC9Kd4J4n7Qw2OuOfSffhyqeq+NJt734rnFaHoHi7+bJ9+R/ov6p1ntHaHm7M8KbKOq7tx55
3a9XyvygpK/+fOi170n6rOBPv/3iZ0epSPFzBwp98L3PyLDtBbB8+jsK+ta3vtsNkIDxEwr/toK7
5CEwKQpsYPv+ZyANFMd59Ftg/+6EZ0H1Ce+D0IMgBy3YO+GNzn0mPGELTSi+7o3whBAsIfdsqL0b
fjB/7qNhB0lYQhBykIY6rKEP5QdDHhKwiCLcoQt/iMLyEVGGLezhDIWIQoLYDzaQWWEAnzjA5+Ew
iQIs4gIBKMAV8u57OkRjF61YQyCCMY5iJN4YvZjGINKvjC8kIfHYSEc+UjGJYaQgFLsIxjYKso1l
fB4hfyc5n6jxjZPMYwy3N0ULnpGO8nMjBefoQSmGMY8s/GT0kNhBRDaSknoU4fgQKUZVolGVQHQi
IFcpSkmSkY1L/KHtmneT8QEyloF0pAKjhwAVbvJ9/sOjLV2Yy1Hi0o7QZOEhvf/IRDy+0o3+02YP
MYnNQNaymt204h1pqcxhIlOLM4skDP+ovjFasplPTOY8mXnHJ+aTmob05B8rmU9rUtGdnmwm/OQJ
SloO0Zx1jGc5oRhFhRqyl97bYf5Sach1svN09RxeRz3aFAk6JaPAdB1HP3pSlBqvRetcWUpd+lKY
NkVp57CMRmN6U5zmdCcjTUv/dApS5HUlpD+tYFJ4SpOWzg+fopyeD9PXRPY1EKri9CMm7zk9q4pz
qJfcJ1cv+VUsgtJ6Wd0dQ7E6whFWzqbBDChbqdrUoBbViUMtpFnNerwITjCskQziHq+6TK/k1Y+s
O2pZ+jjRh6KSlfyLKCefqcv/KMISnLtcYBUNutRrKtSx5othYy3q14W6Ep2AdSwIJ/tZWIYVr3DF
XWHNkkhpctWShczbLSmaUEpyz556vO31jPnMJsZWkYmMZm4Pe9UDDhKH39xtKY3rz2ri85pZdC1Z
vghbxQpXkORsKjnhOV1+3jW8yq2sRHErXabiVo6ttCtVf8tIZtbVueuN7UGditjqkmWP2pUkf/XH
3Tp614j/POZoybtQ9aIXvNNc5VzFi1k+nrO4Sjxwehc5yk7qL79juS4PK/pfxEJ4oOFDa2dLjMt3
shehXuWkKU/c4bnK8JQjZnFVG7vi45b4tg7tMBxfbEz2utjCsxtHW+J6O73a/2yrH11yi5rc3qHs
DBlsKbKRHxjVAiqZqKt7skg7N44q5ySpptPkls18Zp7Eaxy8eV2Z0fzmM79tZl12oFzdaFKh5rTL
cBbLUSOTzsS298kO1CR9mUJNptp1yXt2q2y3KuQjD3avcAXfVIdiucEAVLqCzrIPC41dLA+Xr5tu
tFNW22lSM/B9kVU1U+R8k3TiNcVM1K1qw0nP7NkWq4EO8XZ7rUgaGxGilv2sVX1rXnBmeLmh9KoQ
byhL06b2iHXW52Ix6mcuOhjGw3TkdkGruzJ3+63SpO0aeVxbAAP7uaDuba3TbV7seveTILYwZZW5
aTlmEyGYFsyohUnKf26buf+PzPQiLb3tc9Mbwv+m7YoN/W5ll1PCIGZ4vEMLXs3G+8P3FC4Q+R0Y
tpLbuBFecADDjeGAirytV1y5ykUNTQv/W9QO1WaALV7xlpPX5YlWsMyt+HHA7G+gHg4y0WnuVTfX
Fbj13bhkp5jLYMsW2VKU+Ckjrk/oTpvWQ4SoNZtudO5C1aD+HLsvw7ZW0uEZsF9hNKPfuvYaUTul
1SvsmEvn5h+1PYFut5HcUVq9V9uEz4Nf0YbLRnjEe8XwDLM7pc/H98TnvSdAj9AyJ85ruEu+vCBV
utRPvejSOr7nlIdQMAU7bpodE/KTzvypkbwU85GePxvsax83m1mnVzuHrNb/OusP+/TidhasFGZ5
J4ltWq47PtjJH7s6F68yyMxR3DDv67zdbUeAQ727lH7lOTm73KpmeL88nqfIBUxw2StoluFUI41/
K/M4qji9wVXx5okpUalHl5s1zj6+EQxtnEs//ZiXyZqwq3s/gKu9/iM10Co/Ass5nqM4+II4groo
nHs+rZE4n4uxjiO7eJK/qdsxbUusUpIxheutzGIkD0QuD2S+6cLArIk8GVQpn4DBaWm8GczBgyMI
AcwPtGMZtctBISwpG9SJ0AnCIUzCtKuu2nm9VGs0vHOR1buRKYw0Oxuew9kgngs9v/M36loJh5sg
Vtu/pZu4PQs9pcozHNuf//m5PE3LMbGzuicMCvQggWl5w7frwsxLpinUMZvjvszzqbcTPa0woDRk
Q606JIKyv78qiiKEiVg7K6LbPbCKpdbKNc4ysYiStkmqv9zCJgsEPtyrOqNDLOFTLXdSLDhMOcn6
tfPyvvLSLPNDRdvJryaMLxBUOVi0N/QDuWbbOQdbv9RipU4kPt7CsP7SuWFcwAkkLl97xoaaPrHC
OFUsvuCTvn2TPS+cxXvLOPyLQm7TQOLjRhLzqwTDvP5CIhc8Px9zOa8bumQUxoZrv6zDsZjrplNK
v5Arxm5UwDwCxwVMOH+0xL+6R3bbvGODRl20pZoTxwPDIntrOGQkv4RkMP+lMzvSEzqqQ75u88af
A55Ac8FlG7CJ+jZcjL/6qyiVLDdCYraAOyjvW8nxCq3x+z/I4rRqK0mx6p4sJCmbQcJGVMJBFMql
sMVss5koFEGivK+ldAp9bJGkbEqpDB3H+cGuAMqpzMofwcBbLMQLIgwaIaseicBDlMKytMKxTLPF
0UKB2sH4wh4wxL8rbLRkbCexNAqyRMQ5PKu8ZEqKG6sm66o1PLRtcj7Dwx9RxEs3+rShRLWVI0RT
a8ygFMSyYkMJcsNAzEzCrKWqhLVxIkN47Do+TCNZvLdfRCt6M0HQbMFisyEVrMRBas0B07qWpMvv
o0XfI0b/40RiIyKA48r/bBOy69tAcANJgIKvFzLEcmylAjvF8wvI4YzHm1s6nGO56nE9PJTIv9zN
Y3ynkQujzhS81qNJZRvNYXvA49K37DrAo3vOnQtN97Q823JNL9S0+UuogaszAPuu+7tElqCFR1SJ
+lxE/atFTMQ+bEzPBlNIjmvP6QTG6UrQBLQ5AdNPY3xJh7y4iOu4WCQv4HyMAZ1Gq+NJ4wSyjry1
nMSsZwvDZtPJSTRFEc3FqpMxdUzBljTDoaNJWpPLkURBF21LDaSg8KwJF8FKrazMJIMywtOdD3UM
F4nKI620M7xLGeSdHvTFKMWpKw2RLM2pLQURNQydKuzDG/lSBrFKRaul/wgiq8/bHf4EKiTFvm1k
qJAKUMChzOskrczUu8JMUhosuXbizpux06hBzORbz5IMLtI8PtubOte7rBt70d57o/YLMeCLP4h0
VB40UwWhvQntJeY8SItyxmI6SAdswQedz7c0TX8kuX8j1EKNPlE9wU/l0K4bv4u0SVWtTne8RtX8
vaIjJ07tVM8kTlr1r+BTRgrU1fhs1lXVv2cs1VeFVb5JUUTjSIFEvhTcpBW0v/vMP/7cxMv6y00E
toj0QGqtVq88syr0kXR1GhzESyqdu3ltM8kYgGGdj3fd177JV3+VEH4NWIEdWIK1jn89WIRNWIV9
jIJtWK1ZWIiNWIk9WP+HrdhYnViMHUAZ8QaLfQs3sMGMDVmRHdn32IbZ61iUTVmVXdmEoQKWfVmp
IFmZhQ+YrVmbvVmczVmdVY+Z7Vny2FmgDVqhXbx4jR2fRVg0hZ2hhdmihZ2jpdibIJmAKZlDMZmM
iZOHkZgn+ZKlfdlrIRR1kVpFCRdQMRSxlZOn9dd5eRVTeZay7ZSeYJdIEZdY6dr8moSyKBK2VZOP
yReq/RSOkZi3ZZK07dl2gZV0ERS57ReRURc7Kdx8XdvDDdtAGZRu4Ra49RbDtNuOXRmpFZerxZhc
MZatPRaPaVvIHdakfR3OVdmmtdfU/dLV7VLazVK/ed3azd2s/JorHDT/2OOzdo1TxTzLPAsftgup
JePdX7u6P1VKzRTU+izePl24MHUmRETe5pXMmAssygwKoCFAvZze6N3LPHQdzHzMsPDdoaQr9hHM
ViPeGswoWUNJSrQ1cbNRz9OlRq1N+3zDHHXOAjyt/MNNe9TWT2RO2fyqafNRYK21ZTMlhtxRZ3O3
p9vIYlxg/OpXWUW4hfQ2601WXrVf693CDlVAXkJPdWur4TRhfqxV9aS+mjTVZbzGaBQv5Tyvf/ua
uiy+ExW4Ng3hgLO2xxriF+7HjoRJY4Rh8sRVXbPIpqNPlNOu69I++JPThtzPmcRIrlHV7jMwlAPh
CZXGArMnJWZh61Th/yQu4SCtuHQ7xwZVPTJUN4Os4mxNNCwev+8lqbKT1A/kUP7D1kStSRP7rwqO
VOTs4agrRXCdxoKaLfwlV7nsPTmUYkc2pxX0MRGEtPPM4s1lG9zVXbOMO1A+ijwWz1FumeC1y1M2
its9ylV+5ZfKjF94G1iuZZd6nNk9qVT+Q1t2zB6BwaZFIOz8Xb+UU8tUSQW2xkPsy5kbnuTay/Ot
VyVVy7X0yecVXziFZmz2IDUdQ2ZWPjvbZVTuvAuVNLAAZi5ySd90NvsNzUpMxXc2XgymVYVbP89K
zAkeYwMurf+FR/31w0YywdtDyVbkZ7DjveSsomzcUiauPvH7zoEcYv+J7OIIvdQrEsZaNbf1AlUI
ReM7VlYzFMhw9E5lmy/wg1YrHVKaCFds7aeRjk0ZTeMFg+KHmmjebGJfky9I1k5dO8d2nDlkbVQ6
LsNoRGISSwh0fowypr7ao+jttWMyVk+4o2J7xmnpZM82VmN2ZEjkylbojOoL+0yuDiJcBiYk1lao
C9V+RDiJZi4T7S58vuh9pt6AHrhS5OeN3GgXJeium9VtZVAV7eMZhTeH7eVsdkLDpsMmbYzEJmY/
bWyfMFPInuwZnBrKvmzEo5S1EmdR/inOfjO34zu3W5s/e1OXcV9ApajH7mzzDV/yzd7zHTXRfhmm
2a1x1uZx+2y2Cx7/17bC2NZTx0YK5piA8JizAf6mV3zNkEzIG9Mtg0ZrhL5RWjxqDKZN+0y2GlVQ
rEPu5RbhdYbiU2xghbY91HJFmu7W5XaxQCPt4LTJNpW+irzfE+7O5mqoCGtAFy7i56TGfJtIY2XG
kz42p47o2wRsi3xIq8Yuy25P+lPBlMzFJ4ZQ+ZqxB17Qs57pH62vVX3PX+UvoyZBS37p6otpDGdr
J+ZFqS7j9tFsPdbVcfRvAgfnsKNrFG6wGJ7OJqZqnGbWapRv/oZoFT/w/L5iIg5qaUodB/Rf1Pzj
7S7XtN5FGi9BpvNIerRUEAzkF09RJcdhTkZrJVLr+2Pr+O5yUBtV/xvjUWvt5LL55BXRbTHF7LT8
igX3Ebf0bDjvu7DIDy2wGmu+cz9/M7Jh8z8f9JQymkcr5jYf39eOTMRzcy57oPVpmmKtoN8Gizyl
08k8bMmEXwZ83y9mdOCmwUMvtUyfZqQenEOv9N3e02329Csj9XVNbVBnLeGddci85i8MnHneJZo+
TW6VNOveSWSD0WDfMYCG6U2OZ0YN6HamOoCGZ4gsbxbr6/BGxf3dK+FjOm6SzY0OVZbUPTWHmj8L
62HkaTIy5q8ObNMUcTVF0K+26QGHLh5Gz1716ReHuG6sSHr3ulQFMlLNJtyRdJswtCkG6z/eLBK/
Voqe986T8uO06v8Pz/Aai/eIx/AWqzBjlqeYnOMb3WEJd/cCFyXCqbkT5ukbj1C/xjkLTEAdP+QE
d2+EXMYTDXIwvncXN+P3svl2j09WhepVGvm/1niKdHZG7nKEl242fmQd5+AZpW6MS8nwGnAxj2Mn
F2wtz8lvBXdF9Pj0fjafryx/Ipwj/WZNJ3TNY+XBmco65zxHN3tOB4pAd2U/j10NyWXDbl3Nae23
ZxFyhku81/Xgrl5FD3XCJPu/T/vAR8tbx3VUq9PDz5pxH9do+6LmVnJeQ/j89bCCxrrc4+YzZj26
DxoNl1D1wsyOhuT+JP0A5yuMPqfQB5rRD0kh36aKd3qdO2v6bWb/R07gTX39CmFLZQTNf0f5/479
4XJjIm7qINaex4d8WSVQyifoGSrkps9kM5/JCc5i6g/HavN9mDF77//9Pr/z5i9/84fV8E9/mTn/
nMkG9n//rlV/+dcN+K//uZh//LcN+9//t8APIQCIfwIHEixo8CDChAoXMmzo8CHEiBInUqxo8SLG
jBo3cuzo8SPIkCJHkixp8iTKlCr/2Wvp8iXMmDJn0qxp8ybOnDp38uzp8yfQoEKHEi1KrSjSpEqX
Mm3q9CnUqFKnUq1q9SpWnyu3cu3q9SvYsGLHVsxq9izatGrXsm3r9i3cuHLn0q1r9y7evHr38u3r
9y/gwIIHEy78/5Is4sSKL5ZpXGYx5MiSJ1OubFmgY8eXC87a7Fms4dCGHYsubRro59SqV7Nu7fo1
7NiyZ9Oubfs27ty6M57u7fs38OAzERAvbvw48uTKlzNv7vw59OjSp1Ovbh268OzaYV7v7v07+PDi
x4/fbj47+fTq17Nv7/68VQnwh04kDu4+OAT47+vfjxx/cfkFaNx++QloX38ABnggfwfq9+CCAEqo
oIQEEsiffRhCiGCEDiY4IIgXRvhfgxb6xyGH/hX4IYr57faibD5tiKKF/4GooYcbOmigcjjyOGCO
O7aYYo0hMphhiDoaSWOQR86Y4pFOCpmjkkoKOB+WpgWZ3JYmQv/Y5Yw/2sijmA+C+eWNTB4noIdk
qgnkmmHGieaTaLIp55RcponglVn6WRibDSpII6E/ltniiifC6Sacc0KJ45t7Nlpmnl4mSeegNd5J
qZwsItpmcX+K+tZElTp6qZgaLtmojXZaWiSdmMIaK58LwnoopxdieCiRSJr6pJNmOgojsa7JGKWe
rdIK5q+a1spqknf2KmSRUt666rLXSussq9sCuyq1CIw6rl8ZCjoolZ6Gi62Zin6bYKCQmgvvvCpO
yKC8TGaq7r2cBvvhlJme6G6wwZJ7sF7uKbwwww03jDDEV9XnMMUVW3zxc8VqDCPGHXv88Xobi8ya
jCCbfDLK0UX/vDJe3aWbMswxg8cyzVWVui+6Xq4Yrb0Cq2jirvvyG7Sq6PpYIbQGnluivkXvSKHA
RuYbJoVwjnz1Zz4VfCOyhHZ6arXcvmzts7FKG27AkuLpKL6oLpeq2mg/m1/NdUdV6qu1elvnupey
e3aPcXYtrKVyL9qrmqBOW+jbtBIe6aYIYj35bc0a+u6tUScL764jzgr34HyqWuXc2c5a5bZGU/nv
41QXPSDlsUumdd6Pj37m6oG/ibvgUHeuM9uv/s74mqqfybfb626NoN3NN4X3kIhjHu3mwatNvOPM
Sv9vrn0f7z3YX3tr+JOym/+au+p+TuLSrP8NsNDqny4/6fTi/zk18tr6nruuurap+YPOJ8DVyKyA
BvTYACPyhgR6pGQHfCAEFea8CSaFgRa8IAYpQ8ENcrCDHvwgCENYwQySsIQm5IoIU6jCFbKQJhSQ
iz5aKMMZ0rCGIjwhDnOowx3ysIc+/CEQgyjEIRKxiEbEiA2TqEThHLGJTozdEqMoxSlSsYpWhMkT
GaKDqz0mizi8IhjDWBMAoMWLZjyjSQCAxjWyETZqbCMc43iZN65EjHa840vIiBU5Tq4REzEHH1VC
x0ASspBgGaQhu2KMRMIRkYx8JCRB4shIUrKSFVlASvCoyU3azJKe/KREOCnKUZKylKZ0CyhTqcpV
srKVCzklFZ2FAcvnubKWtrwlLnOpy11+pRW8/CUwVTLLYRKzmMY8JjKTqcxlMjOMwXwmGpspzWm6
ZQPUvCZeoKnNbXKTJFToJgqxKc5xkrOc2wEnOhEjBNWYs53ufCc8+ZLOefYwnva8Jz7zSRVN6LOf
NaMnQAMq0IGWxJ8GPShCEyoTgjK0oRxxgkMjKtGJUrSiulQoRjOq0XdatKMw2ihIgxMQADs=

------=_NextPart_000_0008_01C6F74E.70E678E0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9OApTcg003635; Tue, 24 Oct 2006 03:51:29 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9OApTZB003634; Tue, 24 Oct 2006 03:51:29 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from imx2.tcd.ie (wpad.iss.tcd.ie [134.226.1.156]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9OApRlu003602 for ; Tue, 24 Oct 2006 03:51:28 -0700 (MST) (envelope-from [email-masked])
Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 07B166800D; Tue, 24 Oct 2006 11:51:22 +0100 (IST)
Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A0473003DD8; Tue, 24 Oct 2006 11:51:22 +0100
Received: from [127.0.0.1] (cswireless63-42.cs.tcd.ie [134.226.63.42]) by imx2.tcd.ie (Postfix) with ESMTP id DED32680B8; Tue, 24 Oct 2006 11:51:21 +0100 (IST)
Message-ID: <[email-masked]>
Date: Tue, 24 Oct 2006 11:52:08 +0100
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Julien Stern , "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
References: <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiVirus-Status: MessageID = A1473003DD8
X-AntiVirus-Status: Host: imx2.tcd.ie
X-AntiVirus-Status: Action Taken:
X-AntiVirus-Status: NONE
X-AntiVirus-Status: Checked by TCD Vexira. (version=1.56.3 VDF=8.1371)
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Julien Stern wrote:
> On Mon, Oct 23, 2006 at 05:11:06PM +0100, Stephen Farrell wrote:
>> Julien Stern wrote:
>>> For instance, we can take an s/mime message that was sent to
>>> this very list and add certificates and CRLs to the CMS envelope so that
>>> the signature on the message will become invalid because the certificate
>>> will be considered to be revoked. The only thing you need to do is
>>> to add a new Root CA to your Root CA store. Would that be considered
>>> "Hollywood" or "real-file ?
>> If you can populate a new CA in my root CA store then the game is over
>> already - I assume you would just feed me bogus certs.
>
> But if you start with the assumption that all your Root CAs behave
> nicely, you have no need for the new validation rules requiring
> the same trust anchor... :) Oh well...

There was - maybe someone else remembers the details, I'm afraid
I don't really, and haven't time right now to excavate for them;-)

It was something to do with indirect CRLs and the upshot was that
so long as there are no CA name collisions under a single root,
then none of the roots could cheat on one another in any interesting
way (when the new rules apply).

We did all this on the list before and I believe the draft accurately
reflects where we ended up, even if not everyone agreed with that
outcome.

S.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9O9mj58089756; Tue, 24 Oct 2006 02:48:45 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9O9mjb7089755; Tue, 24 Oct 2006 02:48:45 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from kraid.nerim.net (smtp-102-tuesday.nerim.net [62.4.16.102]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9O9mh7G089739 for ; Tue, 24 Oct 2006 02:48:44 -0700 (MST) (envelope-from [email-masked])
Received: from uranus.cry.pto (cryptolog.net8.nerim.net [62.212.120.81]) by kraid.nerim.net (Postfix) with ESMTP id EA54C40FF8 for ; Tue, 24 Oct 2006 11:48:37 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1]) by uranus.cry.pto (Postfix) with ESMTP id 0C51E4417F for ; Tue, 24 Oct 2006 11:49:05 +0200 (CEST)
Received: from uranus.cry.pto ([127.0.0.1]) by localhost (uranus [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 17661-01 for ; Tue, 24 Oct 2006 11:49:01 +0200 (CEST)
Received: from callisto.cry.pto (callisto.cry.pto [10.0.1.4]) by uranus.cry.pto (Postfix) with SMTP id B21874417A for ; Tue, 24 Oct 2006 11:49:00 +0200 (CEST)
Received: by callisto.cry.pto (sSMTP sendmail emulation); Tue, 24 Oct 2006 11:48:33 +0200
From: "Julien Stern"
Date: Tue, 24 Oct 2006 11:48:33 +0200
To: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
Message-ID: <[email-masked]>
Mail-Followup-To: Julien Stern , "[email-masked]"
References: <[email-masked]> <[email-masked]> <[email-masked]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email-masked]>
User-Agent: Mutt/1.5.6+20040907i
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at cryptolog.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

On Mon, Oct 23, 2006 at 05:11:06PM +0100, Stephen Farrell wrote:
>
> Julien Stern wrote:
> > For instance, we can take an s/mime message that was sent to
> >this very list and add certificates and CRLs to the CMS envelope so that
> >the signature on the message will become invalid because the certificate
> >will be considered to be revoked. The only thing you need to do is
> >to add a new Root CA to your Root CA store. Would that be considered
> >"Hollywood" or "real-file ?
>
> If you can populate a new CA in my root CA store then the game is over
> already - I assume you would just feed me bogus certs.

But if you start with the assumption that all your Root CAs behave
nicely, you have no need for the new validation rules requiring
the same trust anchor... :) Oh well...

> If you can mess with the CMS envelope you can flip a bit to invalidate
> the signature.

I was only talking about changing the certificates and/or CRLs
included in the CMS, not the integrity protected part...

--
Julien

Received: from [60.50.196.161] ([60.50.198.148]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9O6RTxW053627 for ; Mon, 23 Oct 2006 23:27:33 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001001c6f735$7829a3c0$a1c4323c@TONYKOK>
From: "Segas"
To: [email-masked]
Subject: while
Date: Tue, 24 Oct 2006 14:27:24 +0800
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000C_01C6F778.864CE3C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000C_01C6F778.864CE3C0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000D_01C6F778.864CE3C0"

------=_NextPart_001_000D_01C6F778.864CE3C0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Led am concerted or effort by crack a down unofficial emulation =
protected us of law brunt attack been borne of host in Roms iso sites.
Under threat action is Alongside link rot of occurred at several links =
without update hand once again begun means repackage reissue in consoles =
Notable examples include Square co Ltds rerelease titles.
License Copyrights details registered trademark or Wikimedia Foundation =
cde Search Price Comparison a Outofprint Books About Interact Help =
million books engine Compare prices over or salenew is rare out print =
Title Book written.

Were incomplete a only of partially emulating given system riddled with =
bugs Because few ever published technical in their hardware left amateur =
developers deduce exact.
Reverse a Nintendos tended be commonly studied advanced reproduce a =
Nintendo nes.
Software first began appear These early or programs were incomplete only =
is. Growth turn fed hacking community projects such as in Rpges English =
language Final in Fantasy drew even sceneas of advance or grew skilled =
in work a length time of between commercial successful?
Vincent Marinosao a Tome am Georgia South or Sandwich of Lankast =
Helenast Pierre jan Mayen Caicos.
Fifth Sony saw done toward while still very much has led concerted =
effort by crack of down.
Rare out print Title Book written Options Type or any Usedout edition =
Signed Indian.
------=_NextPart_001_000D_01C6F778.864CE3C0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Led am concerted or effort by crack a =
down=20
unofficial emulation protected us of law brunt attack been borne of host =
in Roms=20
iso sites.
Under threat action is Alongside link rot of occurred at =
several=20
links without update hand once again begun means repackage reissue in =
consoles=20
Notable examples include Square co Ltds rerelease titles.
License =
Copyrights=20
details registered trademark or Wikimedia Foundation cde Search Price =
Comparison=20
a Outofprint Books About Interact Help million books engine Compare =
prices over=20
or salenew is rare out print Title Book written.

Were incomplete a only of partially =
emulating given=20
system riddled with bugs Because few ever published technical in their =
hardware=20
left amateur developers deduce exact.
Reverse a Nintendos tended be =
commonly=20
studied advanced reproduce a Nintendo nes.
Software first began =
appear These=20
early or programs were incomplete only is. Growth turn fed hacking =
community=20
projects such as in Rpges English language Final in Fantasy drew even =
sceneas of=20
advance or grew skilled in work a length time of between commercial=20
successful?
Vincent Marinosao a Tome am Georgia South or Sandwich of =
Lankast=20
Helenast Pierre jan Mayen Caicos.
Fifth Sony saw done toward while =
still very=20
much has led concerted effort by crack of down.
Rare out print Title =
Book=20
written Options Type or any Usedout edition Signed=20
Indian.

------=_NextPart_001_000D_01C6F778.864CE3C0--

------=_NextPart_000_000C_01C6F778.864CE3C0
Content-Type: image/gif;
name="October.gif"
Content-Transfer-Encoding: base64
Content-ID: <000b01c6f735$7829a3c0$a1c4323c@TONYKOK>

R0lGODlhGAL8AYf2AAAAAHQAAAp7Bod7CwAIfIEOiwB1hbu4zL/nyJ/R8T0qAlUjC30jAKAjBsMS
ANkRAA03CSFIADk5AFc8CHg/AJI/C75BANUzAgdrACVSAEptAGNTAI1oAKpaC7hYAO5uAASFACqC
BU53AF2HDY6HAJd+ALd/Ad+LAAimCyyRADmlA1eZAY6uAJOqALOkAOOcCAKzABS+ADi8AFW4AnLN
AJXDAMvCAOiyBAjSBRLkAEvlAF7dAIrsAKXbAMvjAdXVAAAAMSoARkgASlQDM3sAN5sAPMECO90A
TgAlSC4lPkooRlggPYcdMqIrPrwZPuktPwYySy1NQkExRVk/Nn5KQq09Rbc7Mt1OTgppMiVkNktW
SmlfTXJXAJxjRLFbR+lSNwB6Tix9OUJySmN1TYJ8Nap3N75yPNKHPwGqTRaeOTibTVKmO4GdQ5yW
MsaaR+uUNgnOTSi1SUfBNGO8THfEPaG3TrrOQtvBPQDsPSHhPj3XN1PUSYvUTaXuPMvcROXUNwsA
hBgAe0QAfWcAcngAjpsGhrQKgeIIiAAZgRIXhjMVeG0khIgqcZUgic0ocuMsegA2diU/iDxAd1Yy
i3k/fJ84d7pIc9I8iQBTghludUVTd1NednxYhp9ng79fddRahQJ0gRmEeDtyjFaIhHOGjpGMdbV5
fNx+cQmrgS6sekCffWiai4CieJyWgMejdN+oiwC9gRGxhDK8jGu8dYW1h5HEgcS+ddi2dwDSdR7q
jTnje27qgHXciKPhe8TYe9bWhgoNwCkAu04FtmQAzYwAsaIDuboNs+4EwAAiwxYnvTYatmYtsX8r
u6onxsEjyuQmvwZLuCE/xDtKvWVOvoI4vKw9x7EysutDwwtevxxSuT1asWFtxX9jv5Nevs1Tv+Rl
zQB3xRJzuk2CvWaGzIl+vZyBusWIvtV6wgWZuSWtzjmUtl2UuHGTupuXtMCau9GYuw26yRm6uUzB
u125v3uxwqC/zfn/9JKcmnyLhPoGAAf2Af//CgAA8v8L/wX3//D5/yH5BABN6UEALAAAAAAYAvwB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bKVVp/Mezp8+fQIMKHUq0qNGjSJMCXaC0qdOnUKNKnUq1qtWrWLNq3cr1H86vYMOK
HUu2rNiuaNOqXcu2rdu3cOPKnZvVrN27ePPq3YuXrt+/gJPaCky4sOHDiOvyXawysePHkCPTZUy5
suXLmDNr3sy5s+fPLZEKFEBawOjSpkcTNF26IOrUqVWvJn2atmvUs23ba72b92vWuA3+jh38Nu7Y
u3v7Plj89cDfsiVLn069etrkz7HLJp7d9WrtyLsj/w8/XrZ52N/Da1/v/Xt39+3RZ1dffr389tbz
69/Pn6h69qyZx5592P1XoELl0bedcAzC156AEP4nX4IPzuedhAL1p+GGHE7WEIbpAdigagEidB9z
IcYH4YDkmehghCZyZ+GLybUIImg45qgjcbTZqGCFwCH4HG8Olugej7ZB1yKK7zWpHJG6UUijkSQ6
N6COWGZJFlI2XiiicUleuSKAwf2I4Y9ONonmmL0NudyUIoLY4Zx01qmUGFd1mWJ9cIp544pmorim
n32meSCLFZLoZYN2Nuroo1gRWJ+M4AFq6IlLAileikUmlCmiDZ5o6aakIgTpqaimalRtPTaXXpig
Rv+YJJGGPukmq6y2SuuIbkronJS5RQllc1ampuqxyGqo5bLMNuvsXaI9m2Oy1FY7nbTYZqvttiRF
y+234MpkbXXhLvtBueimyxBSH7Tr7rnnEgRvuwK9i5C99cZbrz3v0msQvvy6O5C++xIcsMD/Isxv
QfPKyzDA+z5ML8EG9+vvwQYzLK/CG18Mcb4NDyyxvRVjfHG+Dlu8sMgWZywyyBmXDPPLLHMMsL44
ZzjutRBRrPHKPv8c8cnwLhSzwyuzLHTSNMdbMtFL5xx00wnJHHHCTiNN88JTvwz1QV1zrRDULmet
9b1mX6020Eg/7XXbVKt7V9hmu7x1wUkXXfW/fLv/fTbTea9ddM5nS30323sffrTef/scNtuE8303
42AHXrbgYyOOecp9a0z45VfbLTdYdA+dueeWn/632Jw3LnTaeEeutuFrs5547YvfGzXTR9tud+mi
+w74wL1XrjngfreutOmSBz76S95SrHLeHOOO+LwfF7/89psT7zHqx5scd8zBz978xhKfT3nvdevu
Pcn9/pz19AGfrzXO1Zs8cecp26xw5PHaGc8eUrrhIY9/Ygue9vCmvO4x74C021raYMfA2w3vd6CT
IO8kF8HdNbB5g0Ob/d63v8mB74N6+13oDve8lETPdQa02vZCaEHrJc+Bzkse5TYovgvWrnAjrKAJ
/7nHPu4B8YOvsx3cVsdBGBpRicJr4grtIUDpRKSAsNNeFnc4wql9zoP3Gx/6gCgzq4lOhpejIfMc
t7otug9zCkQf6GTovgK+LW6ay2ILv/JCEyLsY++TIPbyh7FAdoyEPQTj/8aIyAPO7HG4IyTIDEk9
j+VPYNJ7IwTjV7hBltB8RqPkEAt5SFDeLG5VlMwePVO+VbrylbC0SStjScta2vKWuMylLnfJy176
8pfADCZBWEGSABDEmAMxZgCWycyCIFMgynymPZ7JTGoe85rYTGYymwlNZ3ozm9MEZzirucxvdlOb
6IQmOanZTGmOk5zTrOZB2rnOhpQznfI8pz7Def/Me+azn/B0ZzT/qc6AlvOe6ownQRX6z4UWFKEP
RQhBGyrNgxo0oN6kZzYb+q2KXtOd5kQmREWKTY+mE58nJak4BapNa35UISbVpzINwtKV8hOcIL3p
Phky0n2q1Kc0Beo8bZrToJa0ojPlqTl1KlSdgtSkUEUqU3H6TZFCtaRYEg1JVVrUc1rzq0bd6k5l
OtaknpSpYEXpVKvKT48+VZxonWpNbfoQs5oVnWJd609hSlR7slWsXaXqUuP6Vri+Nakz7WpMvdrN
tBr1MXJQjF/HydiE3NWucmXsXl9a1rjSlbJqDWxbR9tSo3aWs589q2gzWlq2gjanm5VoX5WKVcD/
Tva0qs2sYYOKWNAONbejdexgs5VXqy4UoqS9a2V7K9uz+nan6/ypS9sKz7+SFbqGrad2hzvXyeYV
q6/9LUMtC1B51lO8mm0sQ5GbUtNit7Dl7WxvB8pNn56Xq+ot6FixhdnYovamiQ0rgNfa1NYCF6/t
na5sHatgp7r3udgdbFHrS1blBtfAcCXwYiHcXATHM78L2bBnMbxfEr/2u+6tqXQh7F/+stO54B2w
hV+cUPI6V7ndpS6FMRtiGj+0u/AF8YGHTFvKwheh7N3vhGcbYtf6k8BLDTJhH8zaKj9ZsXRdMY5L
zJlozTWwLpWqg4ks4Y3euMoobTB6ByxYIs84/8M5bvI2CxznypZ4wxZec2zz/GARx9TPMSbtf6Ps
5H4WmIqqgsiXq5tgQ0c0tVQ+bpJZCuTyTjqkhHZmOzN60Un3tK6OHi+k9Stq9FKa0VE+KG9RnV1P
U7jUmh5pfQ+Lajwr1Kns5OZqhcnrXvs6L976tbCHvZBU+oTYyPaMsQ+T7GY7+9nQjra0VxItflib
HwK5trUHgm1u2+PaBQH3t8VNEG2DW9sG6Xa20b1ubG/b2+1Wd7rLbW55lxsh9nZ3uLkt7nqHm93j
7jbAA65ugOd73Peut70Vgu6D+zve3743vd398H+/O+IJr/i6JU5weGdb4gX3eLeBAoBle6gh8v/W
N7xD/vF5Y7zlLod5yl8+85ZfHOM13/fCF57wgzh83y+POM89TnOY4zzmR884x4OOcqB7m+cHNzrR
mb50gTud6htfOcirLnORHwQAz0YK1HVu9LFjHeks/3jaba72pzd95wzH+s97jvS6W53qcCd7z9c+
dHzbHe8uH3rU6y70qwu+6Hm3+t2L3nVE86TkJj/5Qszu9sFvnSE5n/nak67ywmMe8Anp/NI973bC
j/7ueR896dvOd4ikvu1Xh73PYz/11Qf98CFPPOzTzvuCgH3ak+e36IX+epGTG+3HZ3nUUS/74ze+
9l63eMP1HnCC35zpi2d38W2v8sWf3e/SP7f/ufHed+yDn+5EP/zRde/53j/fHr8HftzRz3ray/38
SW/88rs+/NRb3unF13/mV377N2/bJ4C5p3rtRntzp3rDd3r4J3tld376pnsJ+HxrF3/yF4EIOIGm
p34YqH1Al33cl24D933jF3sdSH9/d38HOIClJ3XBp4Kgd3ktSHgCCH2IV4MXd3Pu93IauIH4J3ok
KIP5d3aZJ3VEqHX85oFTl3M0CIGMd3vfR4Vsx4Rcp3/0poDz94T3x3GUZ4ROuHkgiHBWqIQTEYRC
iG8NZ3AZl2/vdoJZKIHER27ntoXx9n9QKIVeuIATt20aZ33CB3HCV3DOZ4d4KIYMd4dvaIeM/6iE
PriI1+d8SJiIJ2h5P1h+zRZsa9iJNBF55OKJojgTQbEGoHiKqJiKqriKfzGKrviKNcGKsjiLtDgu
sHiLuJiLuriLmVGLvviLwBiMwjiMxFiMT8GLyJiMyriMzEhtxviM0BiN0jiN1FiN1tgWQnCN2riN
3NiN3viN4BiO4jiO5FiO5giMzZiO6riO7NiOB3GO8BiP8jiP9MiKFlCP+JiP+riP/GgdnNCPx+aO
AqmMAFmQBnmQCJmQrDiQDMmLnNiLQSERQtGQI6GQaKFsERkRExlL+cAQHakZH+l4FqkVAgEAJhl/
JzkQJqmSYHeSGriSJUkQLamSMlmTJYmSOP8Jfy5ZEBsJERuZD0AZkkE5ECFpD0EplEhJlEgplERJ
EENZlB15lE05lVJ5lFEJlEp5lUNplFs5lQLRlR9ZlA8BllL5lV3plE8Jlk15lmXJlEapMyOpFA+h
hih5kywJfzRpl3qJl3gZhDDJlzp5l3aphiYhlm/5lYjplWGZlGZJlYlpmIu5lo4pmQbhlpZZEIaZ
mJoZlpo5ll55mJ1ZmZg5mW6pmIcJlRTZEHTpe33ZmnXJl783k7AJmDEZmzE5mzMpmzYpEpA5mqgp
mVF5mo85nJnJmcbplKD5lsU5mcKJnAdRmoiJlWXJldHpnKYZmsM5msBpnZupnNo5kEixmjX/mZut
eZu2iZt5aZOyeZ7k2ZIpeZs9+RBCsZjBiZy/WZ3ByZmniZWN+ZzEmZz1+Zj8uZkDup8DepagKZb1
yZTGqaDfCZ2kKZ326aDWeZWiGZdN4RDiSZPsqZN/uZOA+aEGkZMe2qHlmRKo6aD36Z3N2ZYJmpzM
KaGUGZqlGaDN6Z/XSZkM+pSiWaGf2aPVuZ0/6qIUmpoLsaEmqpu3WZu7uaEnWp626aQhcZnZ2Z0t
CqBXCqM3yqJbWqRUuqXfiaXZyaDcmaNi6qNBmqUvSqEr6o7RAqIemp5MuptP+pp0qqRK2pcg+nvx
6RA/SZZLqZUQaqMBWqhoSahcWaBtyZam/5mWjlqkZpmiVCmjlVmgMOqiWSmojcqfNvqiiMmNWAAY
RmoWmakjpbqOD4kZfdoQq7pHp/oZIYmhJNkYGfkZsnqrkOGMQIEjuNqriKGrP8GrvjqsajGXKVmX
H+qefxmnS4oZOwmnyLqsozqtcFkUqxmbOfma2moqtToWfpmX58mXxDqufnGtTEqec8qhrCmSAemt
IzqetMmn5DqvcMGsS9qeJdqsTyqu3RoW2IqngWmT9DqwbdGk4JqueZqnA9GqOPGS8Vqn1UqwEpuh
EWGnHbqt5rmui4GsBxui1PqxFfue98qacGqve1oZzyqy0UqYINuQqdot/dplEzuzs+pCMf+7GTSb
s0fRsjybGdjQs0AbtEI7tLCYrCxpp3oqrSKqr/lKl8uasiKbEt/6dXJKtNNqtB4bsCf6kg4rpVM7
m3S6EntKmDAprVbLjOHpmrSpthALtvvqpN/6tXnJsKwaFAn7rq+ps9RoDHSCr3F7rurZrFL6sOpZ
tiobsT1REROptOuat3r7uElxsSR7lw6br1W7toRbtQq7sDfrpxn5tL53suwKuaRrtxmbtV3bsSP7
rmGLtOk6t51bt7u6tXLquKVLsxqqsYfLobu7uiN6rCqbrIb7niz7EdBatoVbvGe7iy9LGXS7Lp+r
uLc7vcGKs7ELvbOrvMVGvf2hDLO4vOD/2xDKoAzhW76wNL7mm757hL57FJ7A+7Uru5IuqZuVW5vC
C7AE8bwWwbVUm6/c273ee41ka7Cvu7bhKri+i8D5e70V8az6iryc+7/WMb7EmLusq67rqbEFTLgH
rMDa2xH0y7QdrL40wb7BFLXmup7Eu8JfN7+n+77EK7VcK55RS8IwYcK05C0jrLYd/LcabKKvG4T6
28By+8CjK8GJEcDQWLGYC7g93Lg/7Lv4+8EeMcWaa8NXO7xIerTy68AKbL84Kb+BexLHC65dTMVY
nMaWgcZqzI7NaxZDTBFsbBBIXMc8cRlxzJMM7JN2TB2lcI14vMd0LMieyx9Z0McLmRDf/9DGVnsE
4eK+Tqu0FiuTZXyTfgnDymq2iHvHGtmvYRy6hrvJiDysTEzAe7mvD4yxBty/LlGy9eu2jIyLOhzF
bru5lZukF3ynejy7fMzLCvvKtjnK0xuwxzrGr6zLsLm0MIzMEVy9vezMWpvKHSrMt3vFZgy6rGy5
IayuuTzIvCyfnuy68IqX1DyvpZyeByzOCZzBIzvAl2sS6Fq7sBzL6ljDlpu5LIu029y00Bq2JTG2
yBu89DzQlzHHBH3Qa4zQCr3QDA2sRCGz32yz5Vy6EA3NEj3R43rOUlyimbzPHC2Y9mrJHf3RIxHG
MyzSOcIDDZ0jjNvOGjzPqay6Rcy0xv9bzAmxuc+TBitNq6vyy2xbxDh9yy/czQqcx1Srztwsyhh9
qxasrE6M0tpcvEJtspZ8z5kLwp/Muva807vowvDKzlecz5Qc0PLsziTR0pdr0FztiSk8z1Nr1qmb
tah81SDMwU2s1mu9hnDNxSMtzvos11C7tDSNEQDNu2ec14g9E3id2L3kAdO22Iwd2ZLdxktd2b8Y
TK862fJn2ZyNFNcgQJod2nzU2aSdiqJ92rFY2qodeW0sA56IBaiNjIsc2yWx2rZ927g9zLS927zd
27aa28CdLL493LUdjtTwGEEQ3LRI3MwdEsr93KjS3NI93dRtE6qoCtBtx9W93dzd3d7//d2kuLPg
/RHQPd7m/Y7ifQjqfQj2sN7sLRDv3d7trd4Esd7wbd8Fgd/yPRDxPd/s7d7v7d71zd8Eft8Fvt/w
PeACjuAIHt8O/uD6LeD9PeH0DeAGseD+feESruD0Xd8dzuAQ/t8Dzt8bTuAWTuL9neEeHuIint07
m+IOnuANfuEyfhAxPt8HXuMzbuMH/uAKnt8/nuAT3uMkDuQ5DuJGruNHvuNJPuQBTuRIzuBRPuJI
nuIFfuNM/uQD7uJGYeVOPuVXjhAwLt9anuNYTuMifuMxPuYm3uY/LuIyPuRKDuZ0LuVS7uVmvt9l
LuRBTuV2fuZwTuN6DuRjPuZcXhQB/17hHJ7kPf7hSg7nga7jFI7naR7mS/7lfP7mOy7nf37ieW7k
9s3mVA7g//3hhR7koe7pjS7h+n3fZ07mhL7h5d0QmM7nnH7pfg7rBu7nVn7nsB7iuV7l+H3qgY7h
TP7pyJ7nog7ltn7kkf7sdQ7odp7pvn7qwS7Za27pr/7nTS7pjN7rxD7ozK7sC1Hpey7tvP7tPB7n
S37skA7lcp7tuO7tvS7uWW7pvc3qpm7ijp7qjo7iyR7hKA7u477t/r3n3F7jnA7joc7r+27jEf7v
BZ/l/d7qJT7n0q7qWN7qKu7r5/3xr7gHfSHeIJ8Rnf0BhlEEh77yGqLyLP/yVpESRf9Q8jRf8zZ/
8yQM8zq/8zwvjTj/3T0f9EI/kkgw9EZ/9Eif9Gvx80zf9JFtCYzcD04PPb7IDErvq1Nf3Ve/9QWb
9dPN9WAf9mI/9mRvLb62A16/SmW/9ks/imwPimkf9+pLAnLPEW3Yg0/ngz04fYVoiH8oiB1XiH4I
+GaIeIAIhsnXiJ2nfI9Y9867s4PHfGh4hGdoiVEYc91nhHjPeJsveBcYfSX49qzddIa3egWIiYE3
+Tp4gd53hUvYfii4fgYI+1zo+MB2FAJ3+Hmvgnsfh39/hdUX+MEv+MPvhjh3+u0XiYXnhhU4iBEn
+r+oeXsHgWTogJT4gOlXebUngjX/5/dQ6P2z/4D6Bv2+uIOu34etv4fqH/teJ/nZX4Tdn/0xqP2p
R/7G5nrit/l1CIaCePe6DxD27PEbyM+gQIMJCx4UiFDhwIYEEx4kGBEiwoUXMTpkuBHjxIoaQ070
2NDkSZQpVa5k2dLlS5gxX2qQWdPmTZw5de7k2XPnP6BBhQr1WdToUaQ5hy5l2tTpU6hRpU6lWtXq
VaxZtW7l2tXrV7BMk44lWzZpWLRp1a5l29btW7hx5c6lW9fuXbx59e7l29fsX8CBBQ8mXNjwYcSJ
FS9m3NjxY8iRJU+mDLPvZcyZNW/m3NnzZ9ChRY8mXdr0aayVVa9m3dr1a9ixZc+m/13bNssVt3Xv
5t3b92/gwVmiJl7c+HHkyeUKZ97c+XPoZpVPp17d+nXj0bVv5969O3bwQHWEJ++1Unn06dWvZ9/e
/Xv48eXPZwtorXf8+fXv59/f/38AAzyJPgILNPBABBNUcEEG9RLwQQj/8yJCCiu08EIMM9SQNQM2
9PBDEEMUcUQSSzTxRJymUq0pFFs0qcEFVxTLRRdhVFAgAG7K0aQdZeoRxwFnrAyAH10rEqYjj0oS
shyPtJE9JO1pEiUiiUypyCVZwtLHhpqs8qQqrYySxy+1VLLHLXNK06UwpURqSjdVatOnOdl0M0sa
X5JDMhXL5LGlNWMK1B4WgQQSzf8/bVoTTzx1RDRROl8atKgdl2wUp0cljfPFJ9WLEk5DwRSz0i9L
RbPSO0OVUkwzD+0SUldXJdVLSEl11VRUvaRVVjANZXVTHEf1NdVZbU31VTJZLRNVYJmd0so6VQ12
1i5H9VNVYxF9Ntg8dVMRWF+hfRVUOJk9NNdeBSo01kxlhdZcctM9dld4Vx322HTNxXbcYYXV9lwq
hY113n3j3HZTLAUONd52fyyXXWKB7NRTnRxGGN+HDRZ3Wio/nXbQTJ0V1dqNDeb3Xn0/ltbiWyMe
WFdQr7z434NbPrjdP1nG+GJkz/XX5mu7le1bOU92mWCCHz0yx3WR7rjWnmMGV+f/epVeGFapqeZW
YYZh7fjfcO0VVeyMwTV6ZqO1ntrkmgmdGL2e5lxWZZF5DbnaS6+WGWuSC06WZ155zvVXlh1eVllk
lT5canf19hNnwV9O9lRqOW588r+vLvdXoWMjerKmOxcub57ehlt01N9MfXXWW3ddu89fl/0m0xFU
EkDSBVU9wNxnx1BnfPeWls2g1USyeLPlRN7rkYsW/njgMxd7es6Xt7zip698vHffuwP+0ugB3d3O
4UmHnPmon0df0+mLRjf49ePfyVLtu/etz2Lx/v7OoAsnGeRxbe9W7+JW8BSnMsAJjlrRWpvdKlen
n2WvUQ9739MYqDF6CdBlCkMf/7Nqd6CadA1bYaqZ4doEtqlxDW3801sAR7YlqyWseoCLXsyqdrJd
ySt5iYNY8eqVKJGBjV45U9+97KedUqUNazvr2c7O58QAlsxkHFta4kpWQccJrGG9KpwST6i+LMUQ
YkBs4hQrCDMFMi55FzzibKZyxgRaLF5NFOEO62hDLvZLgmzj4aKmyMT0NUtzZ6uivPaXtJW1EGWS
09r7APiqDxpIUFdE4L7QuMTAMRCCuKIcwrQoxUpyknmb1FUCr5dJy5HSbHLjICur9cq/NWxjg1MW
Je1WviSW0UI/aCP35NeqxviyNcIsCzF12UbnxI4nxiSmMcfXOWcqJZITk9FSkP8ZoGme7prb5OZ/
hDkp8h2zMNF8DDm7eU5Kwe9yOtwhMIcHzEsaj47tFKTubhcw62VPf/esXwGdN0nOoZM5PhTfL8HI
JcnJ028rCZ87I6VPe4ozbgw9VToFups3GlB7zsIV9dClry+tC4WWyl8lBRnPgi0OZJTL1vYCurYH
ErCM2lIp3gYYOJsVcFubZGcq+de3bJYHoUCkpAhBSrYGauqH7lOi/sQlyy8mNKUrvONGZTpSfA6S
kS78I7/wGEGnrZKrKLzobeToVRyGi1wBNR8Gw1jUeaJ1oVWlYy5/Sld23q2redxqX01ZN7sy7FqF
BGTKykobrBq1hzzsqcwM20X/rM5zjpZs6lwJ2dQaBlKdXuSsVOvpyBVuNqmTfaJzSKAhZb7Qp40D
rC09yTQhKXJltozWWTVJ1JLuM5OLS+NR+fZAzNGtpqv1mdcWiFm28va11AoqefZjToYqVEeKMgw4
ZwPdw2b3nWMK4UsnY13ZYFe74yVvec17XvSGKLUQdVRZl9Rc+GbHeIY1aRGra8i4lTaq+fIRG9mb
1PQGmIzCYxRjqghd7xrXvtzFVGMFfNEg2uu2YSPWuz4qU7K51J+wnGHVMMxWPdawpRis7whLmj9X
PviIGeXjUqmK1JkBlogD2yuNNZuxzLJtaRxEpGdb2LXEqiu+Q77OTp1mQhQz/5aJHK3jOqlI4LSS
OLhqTNssQ0vYIAfZbUTmsnIkDNqF1vOPcwQtWZOExRubsau2NVOEoVi+9NGss12m82ci6mYx2zRk
KjQjbfuWOcKyFmWEI+KOEYdK4MLZplQN7HZV3Lr1PjqiKalzpYkjaUc1ytKbLg1kQodpjHIaOaAm
dalV8q1vOtihnw6MeAXj6odOujWiHrVSV4k88Ea3v6CcJCz5KsPHYiqfun6mk4kdXfri1J8XlNt/
TX0Y/AX6oCEMkjUd3V1fz3iPCw6nL2GdyGuHW8n89TXOnmhMWqOnbWf+pIU92rI4iTRfolS2kWmW
NRwSUM7t++wP241AU3H4cP+YrOVUK2xsf1uWXfqWK1DT7Vyx3hLeSJNjBZs2Ny0XGoq0RFsXAbbm
GYO5hC/uMfzOetIB36yuHj/k0cYMY1A9vDjz0/bIW7tWb795r3hW+ZQ/W2VCR9GRSdQyLZt8Ut6y
ueco1+33MD5gjM3t2UiJ9JXfXGbGstrmmlXzvgHocUBCDaaU7SsWyRq5Po4tglsEubn5asTJQlLm
qMnvn5PcZ9ISr92CzXFU8Y1btdqQcIM99JN3q0W1ot2kSccvH/32VYIC3q3NcvfUQ/Rt3WDe8jWS
iqdjqzzNm7VzcwdPYFi9+VC7Z8t0Nv3nUc8b0h9nqLE2cOipm2rCgK+Yi7H//et1J/hhQ11SCeY2
RE8OeuxSuaASRT49mW/jjVKb+f6lrvN9X7rO92+64JK39bcf12OnE/cNrn6byde7tt4zSbEvz7p/
3bdawtbaY14gmBf9uEIHPeQqJOUlN8fhfnGpzOo/jXGoGfKkVDqzetsjI8swa9kZ9ps5WXOXIfIs
8zk0HCtAqAG2p7Kgq+osnatANvMrGSLBsGosE9o2OJO2GNOpsoO+6/uJzvunHzMiQ5E3luq6DQst
sguUvMu4O0o6xImsr7E6lMorQkvB17KgniLC/crAHYnA8Ag/vVIn+RsKxmI5DYwzHYo7qzNBICQj
njMludq4JhQ+GbOaxpup/8pqJD1aPSkkDZr7LeIKPsWBwp3jMdtKLikSwN66HCVsNDIjPLC6O6mb
Mv2rv8rJGT68O8ojMzKMQUk0CmeiH+/ovUm0vOADPd7JRE/8xKmrOkmLQ1LMi8PAROmbKFUERaOY
hes7vvWxHgX0PqeiRfaRtWTrQiZkxbISRUxasGSbxe9LvlS0QYrSpd4pRWWsC4Cqr5M7Ie1bwgzb
mgR8qRycFz6DxvjTHMNZpw6jsFn6H15cMakgQgrcOhPjwpD7QrFjISMEwaO7oZ97RqtbRnvEDHMc
wbD7QT0zwTXkRzAEQbhzsoqSuKq6R4Tci3zUOAscSDfDqzS7mzDMOId8Hv8KMsGEzMi0aMY42j/X
SiMrGjoXq0ElBMRGw6lmq7lT8h+RlK1x3A9HKAxfnL3fQEWy0Eic/IpXI77a2MSX/Mn/QACgHErB
oA8EyEmkzKb+EEqibMqbTEqojErMcEqqzBOpvEqsvIuq3EoUyUqv/Eq34EqxJBGwLEuzPEu0TEu1
XEu2vIyxfEsQaUu5nEu6rMuzhEu8RC273Eu+7Eu/jMO8RK9lCEwBOwDCxI+/TEykPEzGFBDFfMyM
bEzJnMzD3AHFIIZtmknKgEzOxI7a6EzQpI6RsIiQEImOiAiGIImTIAnVFImMeIjQjE3kGM2PMImK
oE3bLInV3M2NuE2LyE3/2QzOS5MIiPBN0uTN3yzN3ETO4tQI54QI4YxOt4QJ4iTOhVAI5cxO1NTO
18zN03RO5aRM8UQJFanOiyhN6/xN9VxP9ATP5lTPkJBO+XQQ6mxO4+zN9dTN5xxN2rzP8BxPACXP
GcTN9uQIlMDOh1hNBO0I/kzNhphPCLWLAJ3Q59BM0IlQDJ1KCsUQu9xQDwWOmcw1Giy/gTpF6Qq/
pMgazONJceMU0CwxAGMw6RlR9sob2ysbGtQ8GEIoG5XR3MGjsfhRmehQGTU+ElW157PJ7Zsgg7Io
Hr3F5bu9JiU/KB1LdmOyUiq4DfLA+OM7CcPGlVS2w6Oi+gOYB1y8RQQ4/ykTIqLzw1fiqeBywPY5
QqRKwacLODFVro7zxtzaPBYTRJKrOBiUxxB0QTSzwg18w49aJLZjO3cUIzNsSJLTKi/0wol7OcRD
VBujKUWKl9g8PnRkMmkkt0JVM59JGVRNVMdb1MlrVPDLu5JDx5871Q2Uuh2dLff7wrpRR169w4uh
tR4AjXcUosUyRkxtw2PVRYWjOB3c1Y581sIq1qOJO0JVVW2T1FyNLBc7Oyd0PDeJTYDbO1M9yUf8
Q9YqRDKtuBJEpVUdo5g6wP45xAUMvCXTPl/VLQc6KnPrwKjJxuICNHzCuU5CFLlwBvYzNSW1xQ9d
2GIsJhZlWIiNWImdWP+KHaa/UD5oqlgZjIootS8EQ9IaazPCe1OXCyfRAr/XKLAkvbaHLT4XzdCg
WEUapUSQzcWAWaOCPNlj69HnC6/SMlYy0djhyL4Ty5ZHNToyFbgz1anqiScQUyN72yBxXCI6ZckS
Uy5W8lItfZYktNfEOzhmS7ytxUZjeVCYJQr2UaxHzSNijdUGctUxCsAdjVqIJCGbszBAXVa8wsO1
fTvIasGXSzlFrVOXpcwnbNV+DVVa5dZO5cbBw78sjJi6ZUgAm9xerUgd60O/rRW62tdMRSNubVkV
S1hlDSs1VFyN2tTG5UF90sKoldSJ80F2FDOAZNYcg91SdVTbtVZTRVj/zYs2tLMrElPb4zLGNE0o
XMtTtiXb1R0gEAvJq7W7KKKbQcM5lYwreaXWdRxe6EUlt7iG2AMAvjiiSoS0tRTfsMyu8hVasyJd
9n3fmYVf+R0M923Y8KrJD1nfE2XFN9ovA/slmxVdkN091WBSZztSm9W1aHImthyq+lWelaUnAQ6m
1TDgICXVJ8WewLxGfoMxDfy/cP01n6KVsB3egryZM9UkvFXaHCREjxq6rDI2Bxyxg6tTIWThDVth
pm1aPpWtrI1h6ntFdZxFKLxV041dmGPDcdWxQYVWYqVIRh2rx3tW4vVgJH5I1t1WKo6yv9vHyvJE
iYxXkQS+GEvEzp0p/1td3LORuLcVOl0ltyBMxDjK28N9srYF3TX2t4/0MLDSKtqNRBVDNV4VXN/y
VqhVSTXMM771Y0MuQhrr1sg1x8t9VZCL4jv+4zR5YuzN49Fy4l9VzBrM08Jj48NLU6tlOkUeVz8r
3nJVpTsspchl11OS5RI8Xc29pUtm41T1Vbe7V5z9M4CVGFDmveh4YBr53bWs4Am2DWNukWY2Lwud
X+/YS2mOkLIs0p1FjDByKLJ45tzDD/FaZlIT0gQmYI8Ft2IjRm5WWANs0SPF4PObwJqVZ1BjMVtj
Z5qd2XKmPX6KX37e53cWPpPl5wMuaCH7SujJWX+p2hTeQhx2xnC0lf9mI8CsGtvM5eAdpmGuNdQb
zugcdtpa7iQHGpsvA9OkHUQu8kOaIuF9rDyMHS97xtGlaygRdKwvBtVjleRFKkPLrWI9vDpp/bu2
jWIf42Ij1sG2g0cF4mTAveZb9D9+1V1dFuPZxekb0mlVhuVSpd6Fcy2i42JBU90ydt1YjiUbFN6H
HKx33GlYTFbfMzN40104YsKF7Kx9WzJCdteqVlW1YdXdHWS3zmtGbtfIIes1WutJNbnBDrCYrsZG
BrQ+bNpBlGwpi9TJm1VWHjmEoy3DE9tA7exd7l62lt5gJmNEW7nrzVpY7uLEDZWvuAecjJCXltnN
Eyan9hCfrBhxTi//b65m3/bTGUyds1VL0Rvob3bn3xbuctTgCzbuVvnY2YbD4SbS/c3njr3uOfS+
6UbLTznElsqgC0uYUIrXfTogsN0t5yXpme7t5H4QSBxDwN1mrH7vAHxDJm6n1w3Z9haajILUlKxW
Q5tdXe5qSERcZOxANz3o7QZLjxlcERZr+9ZevC5kAFfWBkzV/Rad/ua6jlrTRetHeoXsUUbrnwJt
ytbsuVlwvmQdFb/tDH9xGGdYO4hxGuePFr9xHM9x6QSRUejxGv/xm/BxID8nHS/y+NCPABjyZzNy
Jm9yJ29LJY/ylpCKQXhyK780Kc9yLd/ylbjytkgDL9dKLh9zMpfy/zA/cy/78TMo85dFc684Azh3
8+WIcjhfcy6Xc7aoczxXCzKHczb/cxiPZrHc8+kAUEIPDUBP9IYAB0YHB3todEZ/dEhHiUZfdJNw
9EWfdEwXCEeH9E2X9Ex/9EsX9UyvdFOvdEnv9FEvdVbn9FXndFRvdVJ39ZOIdFj/9FufdVGfdFqn
dU3/9U0PdkXfWKjQdWPv9VfHdFs/dmG3dFwPdVjXdVWv9VVvdmV/9V639mbPdkv3dWyPdm+ndlB3
dWsf9Wef9WsndwU/dM6AiWc/93en9mmPd2SfdkrfdXx39nvv9nKXdnHHdVVP93o3dnsn+HCn93n3
908v+G4ndWE/9/9hRwplj3ReR3aLT3h6T/VTX3Z1D3hz33dfj3WBN3iDv/aF/3iUv/iQh3dvL3iX
z/WGj3WLj3ibmIqTZ3lx13dwT/aU/3d113lsF/h0P/lql3doH3iA9/dLR3WGD3dQv/lv33aG33R2
H7WHTwmcd/hvR/eeL/p8//mg53atb3ixH/uBL/uRJ/qfR/iUT/uc7/der3rPkAlgX3aIF/mt3/Zd
r3iS5/WKD3aKZ/rAH/xOt3u7D3qZT/VSL3yKb/ulf3m+93uZl3qyp3nLv3zMz3zN33zOZ0yI7/zG
5HvFR3qNV/vSP/3Fh3xbF/3R1/hbX3jDB3xT73nGP329j3zYX/3/yY/5wyd7vwd60LcMqaD8kAf6
jD925Od6fp/5mOd2uB96nnd2uFf4tz/6pFcJe59+tTd5V5f70XD3rvd4kg97kK/+5U/+pL96sF/7
6O94p6f+6If+rdf59Cd/rR/54HcJmw//+8953wcIcALtEbQHriBCgwUFMjyokCDDhA4XPlQ48eBE
iAYHIrzY8SFGjRQ/Shzp8CLHjRlHVtSY8WVElgf/0axp8ybOnDp38uzp8yfQoEKHEi1q9CjSpEqJ
vmxpceHKlS2lOpVJUmrTjw0hxoz6lOTUihyzsoSacmtJsFa1qvUoUuHSuHLn0q1r9y7evDsT8l0r
9q1TrGrLgs0q/7gw4KpuTyKmaHjw4bJeB4cVSfZv4r6aN3Pu7Pkz6NCiR5Mubfo06tSqV4NGa1Zy
2o4RG7rlW9viQNeyb1dV6RfmWK1nYxNuilZ38ZQqo8Z8S5U19OigfUmvbv069uzat3Pv7v07+PDi
x5Mvb1400PPq17M3rfc9/Pjy59Ovb/8+/vz69/Pv7/8/gDa1NyCBBRp4IIIJKrgggw06+CCEET4I
gIQVWnghe2VguKGCFGYHgIccijgiiSWa2F2I0YGY4oktuvgijDESxGJqK6IWII456rgjjz36mBQA
Sq24lIxFGnkkkuPRqFklCdkI3Y9RSjkllVVaSVeQQg1ZV5JdenP5JZimLanZmKxdeSaaaaq5Jpt3
hfkmnHHKOSdoT9B5J555ttcmn336+SeggQo6KKGFGnooookquiijhur5KKSR6tkopZVaeimmmWq6
KaeOSvopqKEe2SmppZp6KqqptlmEqq0mJSqsscrKoau12nprnwEBADs=

------=_NextPart_000_000C_01C6F778.864CE3C0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NI8hms019420; Mon, 23 Oct 2006 11:08:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9NI8hff019419; Mon, 23 Oct 2006 11:08:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NI8gRo019400 for ; Mon, 23 Oct 2006 11:08:43 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: RE: Son of RFC3280 path validation rules
Date: Mon, 23 Oct 2006 11:09:58 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Son of RFC3280 path validation rules
Thread-Index: Acb2xdnkdkO/ghavRXSHG+Ogmx2/KQAAjN4w
From: "Santosh Chokhani"
To:
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9NI8hRo019414
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Julien,

To simply require that the two roots match, the following assumptions
must be true. These assumptions seem reasonable to me.

1. The Root and sub CAs are not rogue.

2. If there is a name collision concern, name constraints is used.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Julien Stern
Sent: Monday, October 23, 2006 11:42 AM
To: [email-masked]
Subject: Re: Son of RFC3280 path validation rules

On Fri, Oct 20, 2006 at 01:17:55PM +0100, Stephen Farrell wrote:
>
> Denis,
>
> Denis Pinkas wrote:
> >You are proposing to write an I-D to add a single sentence like:
> >"The certificate from the CRL Issuer MUST be issued by the CA that
has
> >issued the target certificate."
> >I suspect you are kidding.
> >
> >The alternative would be to add in the security considerations
section :
> >
> >"The path validation algorithm provides no protection in case two CRL

> >Issuers under the same trust anchor would happen to have the same
DN".
>
> No, I meant writing an I-D that justifies a correct version of that
> sentence, ("no protection" being vastly overstated) - explaining how
> that collision might actually happen in the real world, and not in
> Hollywood; the many, many simple ways to avoid such a collision, and
> the actual consequences (as opposed to the above) if the collision
> does occur, including perhaps a consideration of the reasonable
> impact on a CA's general trustworthiness if it hasn't managed to
> pick itself a unique name. Maybe 5 pages.

The point is that having the same trust anchor or different trust
anchors is THE SAME, "security" wise. It is possible to ensure that
one CA cannot revoke certificates from other CAs, but what is currently
proposed is not enough.

If the list is interested, we can produce a (maybe) "real world"
example. For instance, we can take an s/mime message that was sent to
this very list and add certificates and CRLs to the CMS envelope so that
the signature on the message will become invalid because the certificate
will be considered to be revoked. The only thing you need to do is
to add a new Root CA to your Root CA store. Would that be considered
"Hollywood" or "real-file ?

Regards,

--
Julien Stern

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NHU3Hj012595; Mon, 23 Oct 2006 10:30:03 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9NHU38c012594; Mon, 23 Oct 2006 10:30:03 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mailout.fastq.com (mailout.fastq.com [204.62.193.66]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NHU2W6012586 for ; Mon, 23 Oct 2006 10:30:02 -0700 (MST) (envelope-from [email-masked])
Received: from mmyerslaptop (dslstat-bvi4-403.fastq.com [65.39.91.150]) by mailout.fastq.com (8.11.6-2003091800/8.11.3.FastQ-MailOut) with SMTP id k9NHU1250819 for ; Mon, 23 Oct 2006 10:30:01 -0700 (MST) (envelope-from [email-masked])
From: "Michael Myers"
To:
Subject: RE: Son of RFC3280 path validation rules
Date: Mon, 23 Oct 2006 08:53:25 -0800
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
In-Reply-To: <[email-masked]>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Could someone please restate the point of this thread?

Mike

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NGAQ9S096586; Mon, 23 Oct 2006 09:10:26 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9NGAQVY096585; Mon, 23 Oct 2006 09:10:26 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from imx2.tcd.ie (imx2.tcd.ie [134.226.1.156]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NGAPHJ096563 for ; Mon, 23 Oct 2006 09:10:26 -0700 (MST) (envelope-from [email-masked])
Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 95A2068020; Mon, 23 Oct 2006 17:10:19 +0100 (IST)
Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A02057905EF; Mon, 23 Oct 2006 17:10:19 +0100
Received: from [127.0.0.1] (cswireless62-26.cs.tcd.ie [134.226.62.26]) by imx2.tcd.ie (Postfix) with ESMTP id 8345C68020; Mon, 23 Oct 2006 17:10:19 +0100 (IST)
Message-ID: <[email-masked]>
Date: Mon, 23 Oct 2006 17:11:06 +0100
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Julien Stern , "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
References: <[email-masked]> <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiVirus-Status: MessageID = A12057905EF
X-AntiVirus-Status: Host: imx2.tcd.ie
X-AntiVirus-Status: Action Taken:
X-AntiVirus-Status: NONE
X-AntiVirus-Status: Checked by TCD Vexira. (version=1.56.3 VDF=8.1371)
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Julien Stern wrote:
> For instance, we can take an s/mime message that was sent to
> this very list and add certificates and CRLs to the CMS envelope so that
> the signature on the message will become invalid because the certificate
> will be considered to be revoked. The only thing you need to do is
> to add a new Root CA to your Root CA store. Would that be considered
> "Hollywood" or "real-file ?

If you can populate a new CA in my root CA store then the game is over
already - I assume you would just feed me bogus certs.

If you can mess with the CMS envelope you can flip a bit to invalidate
the signature.

Either way, nothing new or interesting.

So, yes, I think you're still living right in the middle of Hollywood.

Stephen.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NFfreN090668; Mon, 23 Oct 2006 08:41:53 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9NFfrqS090667; Mon, 23 Oct 2006 08:41:53 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from kraid.nerim.net (smtp-101-monday.nerim.net [62.4.16.101]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NFfqGM090654 for ; Mon, 23 Oct 2006 08:41:53 -0700 (MST) (envelope-from [email-masked])
Received: from uranus.cry.pto (cryptolog.net8.nerim.net [62.212.120.81]) by kraid.nerim.net (Postfix) with ESMTP id D57A340F60 for ; Mon, 23 Oct 2006 17:41:49 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1]) by uranus.cry.pto (Postfix) with ESMTP id 3FF424419C for ; Mon, 23 Oct 2006 17:42:17 +0200 (CEST)
Received: from uranus.cry.pto ([127.0.0.1]) by localhost (uranus [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 07745-06 for ; Mon, 23 Oct 2006 17:42:10 +0200 (CEST)
Received: from callisto.cry.pto (callisto.cry.pto [10.0.1.4]) by uranus.cry.pto (Postfix) with SMTP id 0C45B4418E for ; Mon, 23 Oct 2006 17:42:09 +0200 (CEST)
Received: by callisto.cry.pto (sSMTP sendmail emulation); Mon, 23 Oct 2006 17:41:42 +0200
From: "Julien Stern"
Date: Mon, 23 Oct 2006 17:41:42 +0200
To: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
Message-ID: <[email-masked]>
Mail-Followup-To: Julien Stern , "[email-masked]"
References: <[email-masked]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email-masked]>
User-Agent: Mutt/1.5.6+20040907i
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at cryptolog.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

On Fri, Oct 20, 2006 at 01:17:55PM +0100, Stephen Farrell wrote:
>
> Denis,
>
> Denis Pinkas wrote:
> >You are proposing to write an I-D to add a single sentence like:
> >"The certificate from the CRL Issuer MUST be issued by the CA that has
> >issued the target certificate."
> >I suspect you are kidding.
> >
> >The alternative would be to add in the security considerations section :
> >
> >"The path validation algorithm provides no protection in case two CRL
> >Issuers under the same trust anchor would happen to have the same DN".
>
> No, I meant writing an I-D that justifies a correct version of that
> sentence, ("no protection" being vastly overstated) - explaining how
> that collision might actually happen in the real world, and not in
> Hollywood; the many, many simple ways to avoid such a collision, and
> the actual consequences (as opposed to the above) if the collision
> does occur, including perhaps a consideration of the reasonable
> impact on a CA's general trustworthiness if it hasn't managed to
> pick itself a unique name. Maybe 5 pages.

The point is that having the same trust anchor or different trust
anchors is THE SAME, "security" wise. It is possible to ensure that
one CA cannot revoke certificates from other CAs, but what is currently
proposed is not enough.

If the list is interested, we can produce a (maybe) "real world"
example. For instance, we can take an s/mime message that was sent to
this very list and add certificates and CRLs to the CMS envelope so that
the signature on the message will become invalid because the certificate
will be considered to be revoked. The only thing you need to do is
to add a new Root CA to your Root CA store. Would that be considered
"Hollywood" or "real-file ?

Regards,

--
Julien Stern

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9NBMd0H020057; Mon, 23 Oct 2006 04:22:39 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9NBMd37020056; Mon, 23 Oct 2006 04:22:39 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from scygmxsecs1.cygnacom.com (scygmxsecs1.cygnacom.com [65.242.48.253]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9NBMb6k020024 for ; Mon, 23 Oct 2006 04:22:38 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 15534 invoked from network); 23 Oct 2006 11:11:41 -0000
Received: from [email-masked] by scygmxsecs1.cygnacom.com with EntrustECS-Server-7.4;23 Oct 2006 11:11:41 -0000
Received: from unknown (HELO scygmxs1.cygnacom.com) (10.60.50.7) by scygmxsecs1.cygnacom.com with SMTP; 23 Oct 2006 11:11:40 -0000
Received: by scygmxs1.cygnacom.com with Internet Mail Service (5.5.2657.72) id ; Mon, 23 Oct 2006 07:22:31 -0400
Message-ID: <[email-masked]>
From: Carl Wallace
To: pkix
Subject: RE: Complete CRLs with expired certs?
Date: Mon, 23 Oct 2006 07:22:30 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2657.72)
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6F695.8733E60A"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C6F695.8733E60A
Content-Type: text/plain;
charset="ISO-8859-1"

FYI, the LTANS draft referenced earlier in this (or a related) thread
recently expired. It defined a variation on the X.509 expiredCertsOnCRL
extension that preserves the thisUpdate < time of interest < nextUpdate
property for CRLs containing expired certs. The mechanism is similar to
expiredCertsOnCRL but the time value in the extension represents the time
the CRL was generated instead of the low water mark for the inclusion of
expired certs. The draft can be found here:
http://tools.ietf.org/wg/ltans/draft-ietf-ltans-pki-retention/draft-ietf-lta
ns-pki-retention-00.txt

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of David A. Cooper
> Sent: Monday, October 02, 2006 5:08 PM
> To: Vittek Robert
> Cc: pkix
> Subject: Re: Complete CRLs with expired certs?
>
>
> There is no need to incorporate the ArchiveCutOff extension
> in the CRL profile. The expiredCertsOnCRL extension has
> already been defined in
> X.509 achieves the same goal.
>
> As Peter Hesse noted, the expiredCertsOnCRL extension is a
> non-critical CRL extension that consists of a GeneralizedTime
> value. The semantics are that the CRL lists all revoked
> certificates within the scope of the CRL that are either
> unexpired or that expired at the time specified in the
> extension or later. So, if CRLs cover all expired
> certificates, each CRL can specify the same time (any time
> that is earlier than when the first certificate expired). If
> the retention period is limited, each CRL can specify a
> different time (e.g., expiredCertsOnCRL = thisUpdate - 1 year
> if CRLs continue to cover certificates for one year after
> they expire).
>
> I would also like to see this extension profiled within the
> IETF. In fact, there are other extensions that I would like
> to see either defined or profiled within the IETF. However,
> it has generally been agreed that it would not be appropriate
> to include new extensions in 3280bis. Any new extensions
> would have to appear in a new I-D. While I would be willing
> to participate in the development of such an I-D, I would not
> be able to do so until after 3280bis is complete.
>
> Dave
>
> P.S. I would technically disagree with the statements about
> "PKIX compliant CRLs". RFC 3280 (section 5.2) says:
>
> The following subsections present those extensions used
> within Internet
> CRLs. Communities may elect to include extensions in CRLs which
> are not defined in this specification. However, caution
> should be
> exercised in adopting any critical extensions in CRLs
> which might be
> used in a general context.
>
> So, while it is true that no IETF document mentions the
> expiredCertsOnCRL extension, RFC 3280 does not prevent a
> conforming CRL issuer from including this extension in CRLs
> nor does it prevent conforming clients from processing the
> extension. But, I would agree that without the
> expiredCertsOnCRLs extension there is very little benefit to
> including expired certificates on CRLs except in environments
> where clients can rely on out of band knowledge that CRLs
> cover expired certificates.
>
> Vittek Robert wrote:
> > I do not think that "listing expired certificates on a PKIX
> compliant CRL is useless".
> >
> > rfc 3280 states in chapter 3.3: An entry MUST NOT be removed
> > from the CRL until it appears on one regularly scheduled
> CRL issued
> > beyond the revoked certificate's validity period.
> >
> > on the contrary to obsoleted rfc 2459 which stated just: An
> entry may be removed from
> > the CRL after appearing on one regularly scheduled CRL
> issued beyond
> > the revoked certificate's validity period.
> >
> > and thus allowing CAs to remove revoked certificates
> entries from CRLs sooner.
> >
> > Assume a signature made at time T (as claimed by an
> attached time stamp). Assume the signing certificate was
> revoked at time T-X (this value should appear in
> revocationDate on next CRL), e.g. for key compromise reason.
> And assume the certificate expired soon after the time T,
> let's say T+M. At time T+M+N new regular CRL_n is issued.
> CRL_n conformant with rfc 3280 allows to correctly reject
> such a signature, while CRL_n conformant with (obsoleted) rfc
> 2459 might not even list such cerificate.
> >
> > IMHO, there is still a problem if a signature validation
> application is temporarily unable to fetch CRL_n (e.g. for
> troubles with connectivity) and fetches only the next CRL_n+1
> which though not issued on a regular basis was still issued
> before the nextUpdate of the last CRL in application's CRL
> cache. If CRL_n+1 does not list the certificate in question
> any more then the application is not able to say if the
> certificate was valid at time T or not. Unfortunately, the
> same is applicable to CRL_n, if n > the number of last cached
> CRL (CRL numbers do not have to be increased by 1).
> >
> > I think that incorporating ArchiveCutOff extension from
> OCSP protocol (rfc 2560) to CRL profile could help solve this
> issue. This still gives CAs possibility to decide on the
> length of the retention period.
> >
> >
> > Robert Vittek
> >
> >
> > -----Original Message-----
> > From: [email-masked]
> > [mailto:[email-masked]] On Behalf Of Denis Pinkas
> > Sent: Monday, October 02, 2006 4:44 PM
> > To: [email-masked]
> > Subject: Re: Complete CRLs with expired certs?
> >
> >
> >
> > In order to complement, but correct the sentence : "listing
> expired certificates on a CRL is OK".
> >
> > PKIX does not currently support the new X.509 extension
> mentionned hereafter.
> >
> > PKIX compliant CRLs shall include the serial number of
> expired certificates one time more after the expiration date
> of the certificate (placing delta CRL aside for simplicity).
> >
> > They might last it longer, but then there is no garantee
> that the revoked certificates serial numbers are present,
> (unless the new X.509 extension is being used), so if
> maintained longer, PKIX compliant CRLs cannot be used to know
> whether a given certificate was revoked or not, once that
> certificate has expired.
> >
> > As a conclusion: "listing expired certificates on a PKIX
> compliant CRL is useless".
> >
> > Denis
> >
> >
> >
> >> Michael,
> >>
> >> My impression has always been that listing expired
> certificates on a
> >> CRL is OK; in fact the section on Delta CRLs (5.2.4) makes
> this clear:
> >>
> >> If a certificate revocation notice first appears on a
> delta CRL, then
> >> it is possible for the certificate validity period to
> expire before
> >> the next complete CRL for the same scope is issued. In
> this case,
> >> the revocation notice MUST be included in all subsequent
> delta CRLs
> >> until the revocation notice is included on at least one
> explicitly
> >> issued complete CRL for this scope.
> >>
> >> The "at least one" at the end of that paragraph seems to make it
> >> permissible. If it read "exactly one" then I think having expired
> >> certificates on your CRL would be against the standard.
> >>
> >> The 2005 edition of X.509 includes an extension called
> expiredCertsOnCRL:
> >>
> >> 8.5.2.12 Expired certificates on CRL extension
> >> This CRL extension field indicates that the CRL
> includes revocation
> >> notices for expired certificates.
> >>
> >> expiredCertsOnCRL EXTENSION ::= {
> >> SYNTAX ExpiredCertsOnCRL
> >> IDENTIFIED BY id-ce-expiredCertsOnCRL }
> >>
> >> ExpiredCertsOnCRL :: = GeneralizedTime
> >>
> >> This all being said, including expired certificates on the
> CRL makes
> >> your CRL larger. A lot of organizations are doing everything they
> >> can to fight this trend, including adopting OCSP. Having
> two CRLs as
> >> you said -- perhaps one with the above referenced
> extension -- would probably be your best bet.
> >>
> >> --Peter
> >>
> >> +----------------------------------------------------------------+
> >> | Peter Hesse [email-masked] |
> >> | Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
> >> | New! Visit our InfoSecurity industry blog: securitymusings.com |
> >> +----------------------------------------------------------------+
> >> "Security is mostly a superstition. It does not exist in nature...
> >> Life is either a daring adventure or nothing." --Helen Keller
> >>
> >> -----Original Message-----
> >> From: [email-masked]
> >> [mailto:[email-masked]] On Behalf Of Michael Ströder
> >> Sent: Monday, October 02, 2006 5:49 AM
> >> To: [email-masked]
> >> Subject: Complete CRLs with expired certs?
> >>
> >>
> >> HI!
> >>
> >> Hope this hasn't discussed before:
> >>
> >> Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:
> >>
> >> A complete CRL lists all unexpired certificates, within
> its scope,
> >> that have been revoked for one of the revocation reasons
> covered by
> >> the CRL scope. A full and complete CRL lists all unexpired
> >> certificates issued by a CA that have been revoked for
> any reason.
> >>
> >> What I'm looking at is "lists all unexpired certificates".
> Is this a
> >> MUST, SHOULD or a "MUST at least list all unexpired
> certificates"? Is
> >> it compliant with PKIX to also list expired certificates
> in the complete CRL?
> >>
> >> Would it be possible to generate two complete CRL lists, 1. one
> >> containing only unexpired and revoked certificates and 2. another
> >> containing expired and revoked certificates?
> >>
> >> CRL 2. would preserve the time a particular cert was revoked even
> >> after expiration of this cert.
> >>
> >> Ciao, Michael.
> >>
> >>
> >>
> >>
> >
> > Regards,
> >
> > Denis Pinkas
>
>

------_=_NextPart_001_01C6F695.8733E60A
Content-Type: text/html;
charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable

FYI, the LTANS draft referenced earlier in this (or a =
related) thread recently expired.  It defined a variation on the =
X.509 expiredCertsOnCRL extension that preserves the thisUpdate < =
time of interest < nextUpdate property for CRLs containing expired =
certs.  The mechanism is similar to expiredCertsOnCRL but the time =
value in the extension represents the time the CRL was generated =
instead of the low water mark for the inclusion of expired certs.  =
The draft can be found here: http://tools.ietf.org/wg/ltans/draft-ietf-ltans-pki-re=
tention/draft-ietf-ltans-pki-retention-00.txt

> -----Original Message-----

> From: [email-masked]

> [mailto:owner-ietf-pkix@mail=
.imc.org] On Behalf Of David A. Cooper

> Sent: Monday, October 02, 2006 5:08 PM

> To: Vittek Robert

> Cc: pkix

> Subject: Re: Complete CRLs with expired =
certs?

> There is no need to incorporate the =
ArchiveCutOff extension

> in the CRL profile.  The expiredCertsOnCRL =
extension has

> already been defined in

> X.509 achieves the same goal.

> As Peter Hesse noted, the expiredCertsOnCRL =
extension is a

> non-critical CRL extension that consists of a =
GeneralizedTime

> value.  The semantics are that the CRL =
lists all revoked

> certificates within the scope of the CRL that =
are either

> unexpired or that expired at the time specified =
in the

> extension or later.  So, if CRLs cover all =
expired

> certificates, each CRL can specify the same =
time (any time

> that is earlier than when the first certificate =
expired).  If

> the retention period is limited, each CRL can =
specify a

> different time (e.g., expiredCertsOnCRL =3D =
thisUpdate - 1 year

> if CRLs continue to cover certificates for one =
year after

> they expire).

> I would also like to see this extension =
profiled within the

> IETF.  In fact, there are other extensions =
that I would like

> to see either defined or profiled within the =
IETF.  However,

> it has generally been agreed that it would not =
be appropriate

> to include new extensions in 3280bis.  Any =
new extensions

> would have to appear in a new I-D. While I =
would be willing

> to participate in the development of such an =
I-D, I would not

> be able to do so until after 3280bis is =
complete.

> Dave

> P.S.  I would technically disagree with =
the statements about

> "PKIX compliant CRLs".  RFC 3280 =
(section 5.2) says:

>      The following =
subsections present those extensions used

> within Internet

>      CRLs.  =
Communities may elect to include extensions in CRLs which

>      are not defined =
in this specification.  However, caution

> should be

>      exercised in =
adopting any critical extensions in CRLs

> which might be

>     used in a general =
context.

> So, while it is true that no IETF document =
mentions the

> expiredCertsOnCRL extension, RFC 3280 does not =
prevent a

> conforming CRL issuer from including this =
extension in CRLs

> nor does it prevent conforming clients from =
processing the

> extension.  But, I would agree that =
without the

> expiredCertsOnCRLs extension there is very =
little benefit to

> including expired certificates on CRLs except =
in environments

> where clients can rely on out of band knowledge =
that CRLs

> cover expired certificates.

> Vittek Robert wrote:

> > I do not think that "listing expired =
certificates on a PKIX

> compliant CRL is useless".

> > rfc 3280 states in chapter 3.3: An entry =
MUST NOT be removed

> >    from the CRL until it =
appears on one regularly scheduled

> CRL issued

> >    beyond the revoked =
certificate's validity period.

> > on the contrary to obsoleted rfc 2459 =
which stated just: An

> entry may be removed from

> >    the CRL after appearing =
on one regularly scheduled CRL

> issued beyond

> >    the revoked =
certificate's validity period.

> > and thus allowing CAs to remove revoked =
certificates

> entries from CRLs sooner.

> > Assume a signature made at time T (as =
claimed by an

> attached time stamp). Assume the signing =
certificate was

> revoked at time T-X (this value should appear =
in

> revocationDate on next CRL), e.g. for key =
compromise reason.

> And assume the certificate expired soon after =
the time T,

> let's say T+M. At time T+M+N new regular CRL_n =
is issued.

> CRL_n conformant with rfc 3280 allows to =
correctly reject

> such a signature, while CRL_n conformant with =
(obsoleted) rfc

> 2459 might not even list such =
cerificate.

> > IMHO, there is still a problem if a =
signature validation

> application is temporarily unable to fetch =
CRL_n (e.g. for

> troubles with connectivity) and fetches only =
the next CRL_n+1

> which though not issued on a regular basis was =
still issued

> before the nextUpdate of the last CRL in =
application's CRL

> cache. If CRL_n+1 does not list the certificate =
in question

> any more then the application is not able to =
say if the

> certificate was valid at time T or not. =
Unfortunately, the

> same is applicable to CRL_n, if n > the =
number of last cached

> CRL (CRL numbers do not have to be increased by =
1).

> > I think that incorporating ArchiveCutOff =
extension from

> OCSP protocol (rfc 2560) to CRL profile could =
help solve this

> issue. This still gives CAs possibility to =
decide on the

> length of the retention period.

> > Robert Vittek

> > -----Original Message-----

> > From: [email-masked]

> > [mailto:owner-ietf-pkix@mail=
.imc.org] On Behalf Of Denis Pinkas

> > Sent: Monday, October 02, 2006 4:44 =
PM

> > To: [email-masked]

> > Subject: Re: Complete CRLs with expired =
certs?

> > In order to complement, but correct the =
sentence : "listing

> expired certificates on a CRL is =
OK".

> > PKIX does not currently support the new =
X.509 extension

> mentionned hereafter.

> > PKIX compliant CRLs shall include the =
serial number of

> expired certificates one time more after the =
expiration date

> of the certificate (placing delta CRL aside for =
simplicity).

> > They might last it longer, but then there =
is no garantee

> that the revoked certificates serial numbers =
are present,

> (unless the new X.509 extension is being used), =
so if

> maintained longer, PKIX compliant CRLs cannot =
be used to know

> whether a given certificate was revoked or not, =
once that

> certificate has expired.

> > As a conclusion:  "listing =
expired certificates on a PKIX

> compliant CRL is useless".

> > Denis

> >> Michael,

> >> My impression has always been that =
listing expired

> certificates on a

> >> CRL is OK; in fact the section on =
Delta CRLs (5.2.4) makes

> this clear:

> >>   If a certificate =
revocation notice first appears on a

> delta CRL, then

> >>   it is possible for the =
certificate validity period to

> expire before

> >>   the next complete CRL for =
the same scope is issued.  In

> this case,

> >>   the revocation notice MUST =
be included in all subsequent

> delta CRLs

> >>   until the revocation =
notice is included on at least one

> explicitly

> >>   issued complete CRL for =
this scope.

> >> The "at least one" at the =
end of that paragraph seems to make it

> >> permissible.  If it read =
"exactly one" then I think having expired

> >> certificates on your CRL would be =
against the standard.

> >> The 2005 edition of X.509 includes an =
extension called

> expiredCertsOnCRL:

> >>    8.5.2.12 Expired =
certificates on CRL extension

> >>    This CRL extension field =
indicates that the CRL

> includes revocation

> >>    notices for expired =
certificates.

> >>    =
expiredCertsOnCRL EXTENSION =
::=3D {

> >>    =
=
SYNTAX =
ExpiredCertsOnCRL

> >>    =
=
IDENTIFIED BY =
id-ce-expiredCertsOnCRL }

> >>    =
ExpiredCertsOnCRL :: =3D =
GeneralizedTime

> >> This all being said, including expired =
certificates on the

> CRL makes

> >> your CRL larger.  A lot of =
organizations are doing everything they

> >> can to fight this trend, including =
adopting OCSP.  Having

> two CRLs as

> >> you said -- perhaps one with the above =
referenced

> extension -- would probably be your best =
bet.

> >> --Peter

> >> =
+----------------------------------------------------------------+

> >> | Peter =
Hesse           &=
nbsp;         =
[email-masked]     |

> >> | Phone: 703-378-5808 =
x105      Gemini Security Solutions, =
Inc.  |

> >> | New! Visit our InfoSecurity industry =
blog: securitymusings.com |

> >> =
+----------------------------------------------------------------+

> >> "Security is mostly a =
superstition. It does not exist in nature...

> >> Life is either a daring adventure or =
nothing." --Helen Keller

> >> -----Original Message-----

> >> From: [email-masked]

> >> [mailto:owner-ietf-pkix@mail=
.imc.org] On Behalf Of Michael Str=F6der

> >> Sent: Monday, October 02, 2006 5:49 =
AM

> >> To: [email-masked]

> >> Subject: Complete CRLs with expired =
certs?

> >> HI!

> >> Hope this hasn't discussed =
before:

> >> Section 5 of RFC 3280 (and =
draft-ietf-pkix-rfc3280bis-04) states:

> >>   A complete CRL lists all =
unexpired certificates, within

> its scope,

> >>   that have been revoked for =
one of the revocation reasons

> covered by

> >>   the CRL scope.  A =
full and complete CRL lists all unexpired

> >>   certificates issued by a =
CA that have been revoked for

> any reason.

> >> What I'm looking at is "lists all =
unexpired certificates".

> Is this a

> >> MUST, SHOULD or a "MUST at least =
list all unexpired

> certificates"? Is

> >> it compliant with PKIX to also list =
expired certificates

> in the complete CRL?

> >> Would it be possible to generate two =
complete CRL lists, 1. one

> >> containing only unexpired and revoked =
certificates and 2. another

> >> containing expired and revoked =
certificates?

> >> CRL 2. would preserve the time a =
particular cert was revoked even

> >> after expiration of this cert.

> >> Ciao, Michael.

> > Regards,

> > Denis Pinkas

------_=_NextPart_001_01C6F695.8733E60A--

Received: from [86.34.142.102] ([86.34.142.102]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9N83XCX077342 for ; Mon, 23 Oct 2006 01:03:34 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000c01c6f679$b94bdbf0$668e2256@sistemya5489a9>
From: "Retrieve Read"
To: [email-masked]
Subject: Oaklyn Palmyra Paulsboro Pemberton
Date: Mon, 23 Oct 2006 11:03:28 +0300
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0008_01C6F692.DE9913F0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0008_01C6F692.DE9913F0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0009_01C6F692.DE9913F0"

------=_NextPart_001_0009_01C6F692.DE9913F0
Content-Type: text/plain;
charset="iso-8859-9"
Content-Transfer-Encoding: quoted-printable

Opinion Notices or in of Memoriams Weddings Birthdays Lottery or Results =
World Health Politics Offbeat or Report Impulse Escape Vitality Menu =
Shout.
Or is in otherwise on August we switched file is system that organizes =
better but.
Harrison in Hinella Laurel Springs Lawnside Lindenwold or Logan =
Lumberton or Magnolia Mantua.
Dating Customer us Subscribe Switch to Ezpay or div navshell subnav =
subnavx subsubnav navblock a navblockx lnav navdivs new function =
expandall is colapseall am myexpandx else is element.

Jobs is Cars or Apartments Real Estate Shopping Dating Customer us =
Subscribe in Switch to Ezpay div navshell subnav subnavx subsubnav =
navblock.
Name Email Comments Partners Jobs Cars Carscom Shopping Sections Service =
Send feedback about now with this signifies!
Mostly Cloudy Forecast raquo Sponsored by Search over million Occupation =
Keywords Career Tips Tricks Hows resume a Center.
Sell in Research of Rentals Place ad Homes Sale a Local Coupons a date =
profile ads an in ms Starting first.
Be our am archive you are a looking could found it may have been is =
removed or is.
Other Monday October Past Issues is Page not found older than days of =
can be our archive or.
Name Email Comments Partners Jobs Cars Carscom Shopping Sections Service =
Send feedback about now with this signifies!
------=_NextPart_001_0009_01C6F692.DE9913F0
Content-Type: text/html;
charset="iso-8859-9"
Content-Transfer-Encoding: quoted-printable

Opinion Notices or in of Memoriams =
Weddings=20
Birthdays Lottery or Results World Health Politics Offbeat or Report =
Impulse=20
Escape Vitality Menu Shout.
Or is in otherwise on August we switched =
file is=20
system that organizes better but.
Harrison in Hinella Laurel Springs =
Lawnside=20
Lindenwold or Logan Lumberton or Magnolia Mantua.
Dating Customer us=20
Subscribe Switch to Ezpay or div navshell subnav subnavx subsubnav =
navblock a=20
navblockx lnav navdivs new function expandall is colapseall am myexpandx =
else is=20
element.

Jobs is Cars or Apartments Real Estate =
Shopping=20
Dating Customer us Subscribe in Switch to Ezpay div navshell subnav =
subnavx=20
subsubnav navblock.
Name Email Comments Partners Jobs Cars Carscom =
Shopping=20
Sections Service Send feedback about now with this signifies!
Mostly =
Cloudy=20
Forecast raquo Sponsored by Search over million Occupation Keywords =
Career Tips=20
Tricks Hows resume a Center.
Sell in Research of Rentals Place ad =
Homes Sale=20
a Local Coupons a date profile ads an in ms Starting first.
Be our am =
archive=20
you are a looking could found it may have been is removed or =
is.
Other Monday=20
October Past Issues is Page not found older than days of can be our =
archive=20
or.
Name Email Comments Partners Jobs Cars Carscom Shopping Sections =
Service=20
Send feedback about now with this signifies!

------=_NextPart_001_0009_01C6F692.DE9913F0--

------=_NextPart_000_0008_01C6F692.DE9913F0
Content-Type: image/gif;
name="returning.gif"
Content-Transfer-Encoding: base64
Content-ID: <000701c6f679$b9496af0$668e2256@sistemya5489a9>

R0lGODlhiALoAYf2AAkAAHwJAAVxC42IBwAEiIsAdwZ4f7jDv8DQyJrW5kMRAGotB4QlAKYpAL0u
CtkVDQA5BRJMBD05AV4/BY45DJQ+AM5CANNDAAdYChZfADZfB1VgB3FbBZpsAL9nAORrAAmKASNx
ADKGBW57BYl5AaGDAMeDAOKECACVAC2nBzmrB2mXAH2jDZGcC7mrANSkAADFAB7HDUu6BGnFDH+x
BKvFCcuzAN/GAADhCxbUAETqAFnoBnzhAKjXCs7cAOnaDgAANSkAMzIATWcBNogAQJ4AQrUAResB
PgArShYYQDobRF0uPY0qS5EeQMMeQuUsOg1JTC1KMT1KQWhNOIM9QJU0Tc4/Ruk+SwtRPCZcPjtk
R21WRXFaAKtbQ8lhS+ZhNwB+NhaKOzhzNmR6RnqAM6J+Qb93N+Z3SQCjNhSmREecR1aWOoKcMZir
MciZM+iSTguyTSy5QjW0QVjDM3W8OJS2MrK3TtbHOwDtNRzjNTTiNVzVRHLmQabqNcnlRdHuSwAH
fCgAgkgEiV4MjnsAh60AfbYKdtsAiQIXfxcTgkMqcWIbgIQpg6kch74Wct0Zfw1AhyI4d0dNiF86
coQzgpVChMFBgeA0hw1XeBVsi0dceGttfoVfg61Vd7FjjeFTggGFdR59izqIeF+IdH5/caWMe72E
iud4cQ6reR+RijOrilSqgIefgZ6kfcGchOqlegS/fS3OczrFeVfMdnfKeaPBdcnBcdu/hgDucRzq
gjTre2HhhXjSiqficcTefNzYdAkExy0BsU4Kw14GwYkAvZEAwLMKw+IAvwAduBIluDYisVYqxIAe
tZ0Vt7cdw90gzgsyxysxtEI5zGRByIU2tJJCzsw2s+49ughusiVpvjNStWBozHlhs5FbuLpjuulr
uwBytCd3wT6Ks2CHznmIv5V6scyBsteFywOrvSCuyjKVwlOZzomdt6GZy82Uu+ittg26vRTNy0W6
wV/DwX3Jy67Fvv/x9Jyrnnp7d/8FCAD/CP/zAAAK//MB8gr///j/9CH5BAD//4kALAAAAACIAugB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKrGivps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOhjp5KnUq1qtWrWO3N3Mq1q9evYMOK
HUu2rNmzaNOqXcu2rduHWePKnUv3ZpO6ePPq3cu3r9+/ft8KHky4sOHDiBMrXsy4sePHkCNLnky5
suXLmDNr3vz4F+fPoEOLHk26tOnTqFOrXt0RsOubb17Lnk27tu3buHPr3s27t+/fwIMLH06VtfHj
yJMrX868ufPn0KNLn04d4tLq0Ilr3869e07s4MOL/x9PPuaH8ujTq/3A/vy/9vDjwz/YniD7gu4H
ypdvP79A//Xph9+A/QX4Hn/86XefggYeGB9++83n3oMFJuggfQsa5B+BDkZI4YbqhWhchu+VmBCI
CqZ4IIcC2ocQiSZmuCCAJv7H4oT0YagijTYutOGPNfaoIYQqrvgfiCiWiKSLOYropGTXoZikkEMy
eR6PTLY4JI9ACnmllmDiWCWLMWY5JZhBKulQl1qyiaaAS77Zo3d01mknVbrIluSZe+b45Ztuukij
lF7WGGePhJJpI5ZnUpmmoydmKWiTcqp544sC3anpppzuhdGeFj4KqaX5HTpqmYs2WaqhGs535IMI
+v9pZqiOgtoolpOOeeqfku536pPAHrZUqfXxiemWLZoqKquWEigmqr2Oquyirv6K5q1T4gonpdJe
KymTnYYr7rh6Ihspt9siquuyqzZrJquJpqsooe1aW2tDfcrJ67dSVktlvuQGLPDAQGUEpLHHJpsr
vwmTeumq8aa67r1B1ntupYpS3Oa8lLrZaLAgb/TAVlEOqlC2xNaqbL47plzkkdw++y3MNHf5caAa
kymjy0bO7PHMcxIs9NBEH8XghKFiqy2MDbJM86vo2rozrCeSuKSvBQLdYbYY9iv1fT8fHaB7RZdt
9p0hp6322my37fbblV0Ht2ZCzTPP2Xgf9ULets3/TR7fgAcemN/iCW744XMRXjjijDeOk+KQRy65
RwIUVDlBlwuUuQCcd975QJ5rblDmln/+j+ecY2756amDjvrrra/ueuiz0z567KzL7nrpmOOO++ms
26466Lo7RHrtwb/ee/Gmiz488cBPjpoxZC1FeuXXE3989LtrP/rtqh/fevbOH0R++aJvzjv3CcU+
vvjrd+/+5b9jHz/w52+/kP3do69/7sObn//YR79MOe6AjMuI+tTnveKxD3rPg2AEncdA9DFvgvx7
YPT+h8H0dXCBFixg9rY3wudxECEZ1OAEG0hB3YGwfCeUngwr8kICavB8Dnzg//THP/ihMILwq2D4
//ZnPvx90Hs8NCILTahDFRJRiEUsYgm/x70MQnGG0rtODacIRBTCLocW9CAJ29fFIYYRf8pboRKh
KEIPfq+AbnRhE2MoRQlGkYo1DCALGYjAPhpOgTAMZAjVeEMXfi6JzbMjEIVXxTOm8I5m3KDseqhC
K8ZRj4M0XyIFGcMdQu+RLWykKLFISoxY8nqMxOEKfRhJM7KSioKsHRxX18k6hhKCedzjJT+ZSomg
7oyEZCAoG5nHy9GjlJOT2ymZ2EFYKjKIeJQgB3GYvzDOkoyY3GUFrylJJMKSjb7EpUI82cBXLtMg
frRKENIZHI3UD5x29F0h7/fI8TETkj6E5vKcuP9PAIrvlbyUH+/+mUlgYjOg0vzhPgXYP82pEpkQ
hYg5L3g7e4IxeQ4VXhB/l1Ba0vKXsuRoRjEIUP/Jc3lpLCg/FSrNTZKzoZtU6Uoj6ja50RQ57Myp
Tm1y0+Ts9KcE66lQh0rUohr1qDIBqlKXytSmDiwWTo2qVKdK1apa9apYzapWt8rVrno1KdX4qljH
StaymvWsUUWqWtfK1raiphFujatc5wo5tNr1rnjlC133yte+nuUcfg1sW/JKlXOcg7CITaxilXLY
xTq2rEgFLEpOIdjKcuSxSGksZjfrVaNK1rKgDe1KDCva0pqWJJ89rWq/wlmgaLa1cbEFbGe7WFz/
4GYDtM2tbnfL26bigS6rDS5f8XASmwqXM73l2291c1zQJFe5cWmudONK3JHIjR/Y5cc/sqtdgXR3
u9vFLkGy613yDoS72jXveb/L3fWmd7zu/e564yvf8hpEvu89b3zDq17+sle8/t1vedkLX/z6t74I
aa+B0btfArv3wPcFMHj1y2D9Wpi/Fybwe9/7XOjiZsIZ9q6IRwxfEB/Ewfh1MIi7K2EWK0TCJC4I
jGOc3xHXF8EkRvF9d2zjAqsYxyeWcYF5bGEEG5jILg6xjHXc4xyDd8P/6LCHrYIRIw/5yCUGspNX
3OQm57fGQTYxjpN84ScPWchh9jKaS0zhK295/yFWbjOb5bxmE8fYzEo+M5gnDGUXQ3m6aKnuV1gs
3gXfGMkzzjGMk3xkRuO5v3yec5GXrGA9FxrSjX6wne0M5i9zmdKSPnB6zWtkIGO5zHh+86T37OdH
m1nLgAaLoLuyYDejetNxTnWAxdzlQku6vbfedZk7zWtTZ3nHuRZxre175wQTWde43jSv66xrFWeY
1cp29Z9jTTelcJnJ1m52rh1NZyb3es7hnjaNp61hZ6u6y0pe9rsTcmg6o5rMw04zvtOdaSdv+yBS
xuyAR91iCi/60on+dLWFTV4sA3vd4kZ3lvur4IczHOEpbvHBAezwh1Ta4Or9uJgLfuKNnxriGP9m
c7s5HHCscvvlsTYuzKHU8qtiJhgzzzlras7znvv850APelJ0TnS3LWImioWF0JfOdHEpvelQj7p3
ni71pHyh6ljHC9WzDhwAcD3oW/+6b7wu9p6Hvey8ITvakTI3WBT97SxJ7NnXzttvHBDueG/MN1ZD
975L1e53z7vgD7P3wRverYU/vOKRmvjU+H2zVJgt4APPGHYs5B2LF23jHf/4zv908o7LvOiL6vnS
m17mo68sJoJ7+ta7Xiipj73sZ0/72kenAgzBfWJ0DzJmTA4AwAfAQII/fOELBPj/CL7xj7/85Sf/
+ccniPObT/3iJ1/5LKmA9nm//YHw/h/b577/+L0vfu57nyDd/z7uw3/+9rM//OvXPvnj333w17/9
Arm/7r//EP2zP//3h37pp3/nF4D/Z37gZ3sqcR3OF30OiHzMB30SCIHXN3zR14AUWH0RGIENSBA7
QRM6kYAFgYDq537jB4Dul38qOIIoqIIkiH4iyIIr+IIweBAlOIMrCBEImIMxaIMyKIL7h385uH48
iHuvNxwY0YEY+HzC14QT+IAXCIVLaHxUKIVMKIEWaBL814MJeIMu2IVAiINhuIVj+IUFCINkSINh
WIMGsYMuSH8nSIRCGINumII/CIZeOIRgyIYKSBZKWBBOGIhPCH1VeIUOKH1RSIhRGIjEd4gk/7F/
8sd/cliEeLiGkHiCbYiDk7iHMyh/+GeAAOiJ9ieJcyiH5heEosiDdDiHYph+aEiKbBh/mdiHJrEU
f4iIhdiEjXh9EKiBWHiIvdiIufiLHhiCFLETJUiKeWiKneiJk7iJdmh/PbiJsLiKN0iGlKiKzPiG
kTiLn8iKfEiNnMiFB0iOUXaE7ZSEBtF8UGiIWZiIwLiOuDiPiniLWhiNQfiNljiN+8iFa2iG/2iO
eriK/iiEXpiPp8iH+piNsXiGrfiNsJiHtDgW2Md87EiP7+iOg4iIFjh9v6iLwpgS/zeK8weHpciP
CVmE3ViABlh/I0mQXRiJ7xeA5JiKzxiKBf9JkgpZjiU5ijtIfwA5kDk5kUTpEtgYGUdZlEq5EknZ
GE25lFAZlViEjlRZlVZ5lViZlVq5lVzZlb0llWCpHl45lmRZlmaZWGGZlmq5lmzZlm65HJOwEGc5
l6a3Eh+IFndpEXS5l3n5ln75l4ApegxIfOyYgSA5fRmIEH1ZFncZOrazQKnDl5J5E+oIiIRYfReZ
mZTBSnB0RYE5V6FQEn9YhYJYmJa5hIwxRt6kSJ8peLv4hKUZkhjpiIlBP6kzQiXVmqJlXBepiO7o
hLNZjN+BlzrBRUZEPpOZnBzRm8Oome2YkYqxRbdER7qJGFagHhUZj7j4mrtYkR1Ym4fUPJD/SZ3V
uVeoVxKLWT3GqJfJKZnl+Z7wGZ/yWUpEQFMvMJ/42RJxKZ+2KIyGSX3Ip3zfeY7D+RaoKX1USHzt
uaCPcxGmuZEHOhneiZrAmZ+H96DOyZEauhgVSpukaaGspxSFSYG+iaCJKZwN6hYk+pEXCIEM+qJM
4Z1YWIgbqpjrqaIeyZEeCaMMWplZyJyWGaSOUaEYWqMgWnQHCpLFF6Ay2hjZKZvBOKBHGljn2Ro3
2hZSyhA8uqBOkqVTKl1Vuhbp2RJbWqZDRxhjGndm2qNfSlPkkBJGAFHY95oQyotMSpgZ6ZHdiafQ
iRKIeRAJuqJtOhNxKqeAqqEPCp006og0/xqhXhoSc+qhi+oWYSB70cARhWoWo1Aa3zmFhhihGsmo
z5mntDkSRFqqkzqoW5GpINOfOTqPwDmhwQioAtqOhFmrv5imFEGidHqZxremAmMEz/WjhyqILBqc
MzqqHTqgurqroMqiOXEBwKopwmpXG9GhsFqiHrqtxBqPOfqoHrGs2tmnqsoSrBpR/imozDmnkSqq
Hfmf4kqMIvGkmXmn5SoT5xoyYaoWzToR4Gqj08op1dphhdGvEvGvABewmzKwd3WvDssW+3oWBltc
CqucD3uxkdGr2bmBG2mnvkin7HqrvUoSAAqI/omxoGVTSYqgyPqRGfqs8jqxD7Gxr6qIgP8joMBX
sWmlEY76nNjqrsNIjJ1qpB/xszWbqqSBswiLssQ5dFGarNo6oN9qkT96p0drQAWaESuKgb0YfTr7
tQXas3ZKtDMakr0ZqqVKoCnKs2d7ml4LtnCrFdwateTasbH6jj8LtTI7s6Gqp28bt1+rsd2JqAhx
tqdqkYdpuFi7tg6arqRpmIsLuFildgg0GHvrEEtbEJLLVZQbeoJxuQ2RuSjKdZ9Qdp0bLkKVBkz7
GKK7uq4rmq8buzPRumLqbXM7oiIboHlKr0tqslabuJp7pQe7pIgZqMK3uV51umijtSsLj9w6tCzr
s0JKth3RroUrr7L7GbQroUJ7hZPqqYf/2q1BS7Q1e60dK4/bm72sexqP+6Gx6rgcK4/ie6K5u6Hp
qxD/Gb4jq76bcb9j4apb671z67z2a7akCr3Bm7X+Cqp/iBd+gLyl16elOcDairf0CKQIDH2gi746
Kq/HC8HASq7rmruHS7gdibckTKpqS5nO+rQtaq8rDMI8uhgbPL0RIcNciR7+y79qhcM+7Ec8HMRC
PMSW+8NGfMRInMRKvMR6RcRO/MRQDBZMPBR3McVWfMVYnMVavMVczBtR/MUX0cViPMZkjJWUUMZo
zMJgvMY3nMZu/BtsHMdyPMd0XMch8cZ4nMd6DFR23Md+LJ/hkFS2+8cYocSEbMdyowqK/6wKArHI
ijwQjAzJ/7DIBUHJk2zJBuHIkBzJjVzJj+zIlqzJlUwQnDzJpHzKqCzJpwzKqpzKptzKr9zIoMzJ
mlzKsSzLjDzLtozLpSzKnszKtpzLmMzLsBzLohzMv1zLozzLydzMpIzJrPzKhowRvXzLkUzLxdzJ
1pzJqPzI2YzMsAzO2jzOuZzKu4zM1XzL47zNnXzOo+zK6qzOuxzO6zzP9bzMrZzO4FzN4vzO62zK
9kzO9HzP8RzQDjvP6EzQ72zQ7lzO/yzP8MzNAH3P6VzQ+KzKCN3OFC3RD93P/2zPGe3PIp3Q2tzQ
Fy3S8azQGp0Q2GzRJo3SurkUIS3JDv+dza/M0Nxc0+7sygZ90z5N0ycNzzX90wtN1BM90hzd0TD9
0BZ9EBW90kYN1VJdzCAt1Cmdz0r90qg8zRZBy5+8zDvtz778zT8d1h89zBhN1C1t0xCtz0690mvd
z+fMzChd1bjc1Emty5fszS590pSs12+9ycAczYK91kAN1qEcnzId1BPt0Uzt2DqN10yd1YdtzEvd
1r6c0dgc10hd10l91SQd0Sp91IY91UN91Gz91Kgd2KW92lMtzXlxCGRJzYzt0Kr92DAd2WZ91SnN
13y9178N2ow92b7dy2PNzlbt2YFd2alt1S2t1aYN0cvd1grx3Dl93ZdNHvkwN/zczVj/LdG37dab
/NlPPdMCzdMsndYPIc5yrdxkLdoEfdsDXdmGzdkbDd+qfdpiPd/iLcSDDc2rHNyhjNaFHc7B/NsH
HtxUveBsfde4Pd2Wjd7N7NHDzNCZTeASztxeLeAc/teXnd/ALeDmjNaZ/dkxPciHDIJ6nOJhvMcu
/uJSweJzDONSoXw0PhR2jLN0fONFEXw8/uNAvlszEOSTKeNyTORInuRKDsdGzsZFEQ9LHuU13ORU
XuVWfuVYThglkOVtI+VejuJcHuZiPuZkXuZmfuZonuaXEQJENQfSUw9q3ldYYBxfXudGEed4nue2
Z+d8Dnt6/ud9qAOAPuiEXuiGfuiI/57oZXEDit7ojv7okD4ZPBDpUByxa9PnuhU5mD5WYOx7TS43
BRDqBfAPoj7qAmHqpE7qoU4Qoj4QpT7qqK7qrX7qsV7qsr7qt87qsz7rt47quJ7qpy7rwB7stP7r
w57qrz7svl7ssB7DSsEKm165GBHryk7sy87q1l4QtX4Qv07t3o4Qy27q4s7t117u5Q7u4a7trr7u
307pykHtx97s247twN7uxE7v407v687t7J7t6l7v8R7s4w7v/Y7sBiHvAK/v7n4c4r7q227sxy7s
zH7vue7vEm/rxa7tu97tvJ7vEO/xBi/x2Q7rHW/wvo7rBM/iyTAdS/Hw2N7s+17wEf8/77oO8SHP
7zGP8BQ/8Tef8Koe8DkP8y/f8wLv7NHuctMu8yC/80sf8zOv8ESv8Onu8xQP8+e+79de9RFv8luf
8gsPGaDe6hhf7bxO9rZ+9mf/8hsv9mVf8eGe9kov7DQ/9gGf7Pd+8ihv9EdvVV/Pn2A+N3sf+ILP
VSkODTM++NHe94q/+DeF+I7/+FLO+OUJ+ZRf+ZZ/+Zif+Zq/+ZyfTiTQ+aAf+qI/+qRf55JfnaXP
46d/4qkP46vfmq0f+7LP1a8vIktV+09y+/8gBRnB+wTh+xAB/AIh/CVB/G1h/CGD/BEhBcqvNsq/
VLwf/QzB/Mx/EMTf/Alx/QgB/NH/T/0XIfzgv/sKEf4Pgf0UgfzUX/0OYfzp3xHNr/67j/3mbxDt
/xHSL/7W7/3jHxPaP/y9DxBS/g0UONCgQSkJBRY8+K8gw4YRCSqEKJGgxIoF7W3k2NHjR5AhRY4k
WdKkSIspLSpUeVFlxpYYG1ZEWJMhzZgHIe6MyTOny58/ceLsOTPoUaAREyIkijSp06MPV9ZM2RTq
VYdKs2LVafXpUKxei+rkWtbsWYsnRy7cOlXp0q0UHS6FO/ci27ZzfWa9ufIhy4l187KVS5Yq4MJU
mTKF2xiwXrBk/062qxjoQsSPEfPFzJPwxLuc6wrOyzh04cdxT3eG6bKxaL2rMS+G/2y6clfQki/H
Hk1TKt/BM/+Cplxbq23UgVmDVtvc+XPo0aE/lcnbZlu8v+9KbW1Uu1W8wJNSpIu9q9y+fS1zvy7e
/VD0380Ll5++PWfXWj/bZB86uNHtdvMtv+zWa2821QJM0LP7EvSuOvN+2ys//Oj7SjX7qFPvPQ4z
lO5DEEMcCa2cGDztQNfKC+w43YzDSEUODQxvwhnnG4+l9HC8LzLF1NNOvx0jDPLCBWGsMbHShNyt
tM/229A49A4bUkIjB0vNOhYzpDKjzcDDTsUjLVuyQyXdI/FMNNM8K0PgtPSvxiRh+nE8/2KkE847
h6Szx/9inNBGNoGsM8xBDaOwQP82wwOQzw2ftOs1+cTcqz4pxSOUOgwhdNNSQ9t8acFMC100UTLr
VPNUVFN9KbMtC4yrystIs1FSWJFkEMn/WOXSscko83EzSc9b0cre6NIVOckEa01HUa+E8jXlhuUz
1D5NaxRaULF8tThkF61NQmmDUzTaFPsDNk5hlYySQlXbPTNEd+P1Nk2xquKq3nnj7U5eVPHl91+A
AybRKhELNvhDgRNWuFOk/E13YaHyhTisiSu2+OJwMdZ4Y4479vhjkEMWeWSSMYa3ZJRTVjnhg1t2
+WWYY5Z5ZpprJglTp/aNGGKHLe5Z34ZRtnlooos2+mikRTRrv1VlZTLnqpjN+Sb/sOZMTuISnS3x
1F3rFcvVt7hkzLdzxVz5bLTTVhherbEONmgIy+pNJqIcNXvnJMeid1S9W5qz0txmFfzun5I2/HDE
E1d8cabj7jY+BCtzct5en72VTBgFXLHK7PYdbj5oj+WNanKVNWzuXFdzkV1wDXzTWCE/Z2lx2mu3
/faaNYgZ59M5V/fO/iws1cwTw+TOd59yZFdcApsnFdzgxzXRxEM5vTH5PTXHXsHgcff+e/DDRxjo
IAnd8ksvL7W6+ROZ7PL0HVPz7P1vy3R1uUDFZZX5Jsc08+rrBc9BMyqb2gx4QARe7Hm/45SP7KU+
10XPesHanp0Mtb4fQRB6F3za//IE+ChzRTBPRGoQpTSUQBSmUIX8Qk3omHW+Rp2nVREyXe/A1MHD
uDBz8uPhk17Iq9b5CnCr2193Npg9RS2HcsOq3E6M9bMVRlGKEztZ2qA4xbxhkV/i42IXvfhF6aCt
bVr0GxlZBkY0plGNRTNjG934RjjGUY4tqeIc7XhHPOaxIWvk40l4h5YrLi2QahoX3uT1tVQNEpAs
1JgiGUaxf/URfEsjHn2c5pa6XdItW+tUIWU4sCyW8ZF+k9qnyvg1TW4ylKu71x+DQr1RxkaVQ+zJ
utYEN1qqckCr1GOq2JZKXmJSmHvrpCjR5Mm+QU2Zn0JkMGPJIlA6s29NqRvOeP+0TEcSzl7wq6XZ
HCbJ71ESmRcqDo6oVkFeSc5BTByNbuQnqHMp8Vv0Qx30NPPOZBWrc6akDeDSeZt8PtI+TqrcowQn
OhlFC1ffcUxuwARETdETW028Z32c6CLS3G845RxjLyeGSnNqLnu2CZW5jOi+KO0ypPZjqfLWyTQI
pkuD65SYE3dZLVOdkHtHtJ709ASZ8pCKpPlD1E/HhKAFFiqp/nypqYoqKo++C0Sv5Fv1GEbAG1rq
pJ6jKfWWOtPSPbF8hINp7Ma4qxYxkaS0vCmebHk/HOKJfz91K/qoJdejAqqlY82pRWsouRuSCpyD
/QhVOSjSYja1pFv1Fl6FOjz/sKaOp3i9zgJ1lrpKSRBdJESsD1FEvMfOFarZ6uldBxdD1PIVsh3M
3wifyiHC3u6Qjf3nOQ/7wvahFYdtkpUtZVm/cinRppurbA6VRb9tde5vLZzU5v4ZUEsqdD21Gpws
PXsgqTX3t+Xclv/yOtyw1kqf5DRuYiUaqaiSqI7pXdkgqwnHbG5ThfE9Y2wLtgqlsRe+wIwafQ/o
34clsKP6JaN9DXxgBCdYwQtmcIMd/GAIR1jCE6ZwhS18YQxn+MIE5nCHPfxhEIdYxCMmcYlJpmEU
p1jFK2bx0Ez8YhjHWMYQa3GNbXxjHOdYxzvmcY993OAZB1nIQ77FkI18ZCQn/1nJS2Zyk538ZChH
WcpTpnKVrXxlLGdZyyFbwJa9rN4fh1nMYyaz9758ZjSnGWBlZnObHfwIN69RzXOmc53tfGc851nP
e+Zzn9MUZ0AHWtCDJnShDX1oRNvDz4tmdKMd/WhIh3i9JUt0pS196ZBEWtOb/jI/DOLpgXga1KH+
ND9GXWpQm9rUEVG1qFX9aVi/+tWcpnWtzRKiUef6H6dONawb0muLnHrXvgb2sA/iaUwnW9mIPouo
h13sZ/9a2sZmdbVjTW1sZ9vW2+a2qpzt7F23Gty+Jvesib1qXod72qROmTy6/W4Zw+vbxk63sO1t
bXaTut7Y1vVAlv1vgAe8I//RBne6qS1sbd9b38TON8L/IXCIR9zSDSf3wVf9a3Sb+9iyNreuZz3q
NX5B4iMnuZlXVnKUpxyc3EDa2VT+cpgDGd4zp3nNbX5zTk/acT9zLxYBbFioeK1d0vt54Pg5x6I/
aGOFJtcScSk8+c7SmUn/bNSpLqeouFLrnD3lMylpyEUeXZtP5+XfmMnDxfQP6JVsbE5sfEux8zzq
UnfbR135p0QqU+icDDpOz+Svn3uF6rutDuA9iTq2G3PqXvdwiOAzw5WqE2zGPeeRYEfQcHVGeEX0
1fEAOzbc/LZ03VWXjhJjK3lm9J7OzSfZnCpW3iJV9dwaKEYLGvoWOrRCkOL/PG1y73vV2x5IVfMU
QW+fJ1zlCqIPr/HXs1uqDEq+8KqFE6RyWsnmHpE9QZwVemm4pNeW9bqbEqljq9s4i1avrXFV5wgl
+1mkPmhT4WetCN8Evyv1T/90JU+Hnvh8u/Eox0sr8TsUI3EaE/IT1oESAOGq+ystjYKVBWSUaaG/
mFpAW+GP0FE6lPqfzrIqCuSgGNIWmzKf5yOu+QMu0PIfvyrB8Sue1UooR/Eq82A6y4I/09qsr6q6
QtIuJAKVDWodFhxCqAqh2hutBBRBQaGr9sHAzHKdFSzCHPzB6FM/BkqiBhkgbkq8kQpCT0FCd3ob
paoJprOc4MqWEyQW0DkW/+TqvPnRLWAJodKyrvzLGAASvV8JKsrjQG6xPc1jnq/Qwx6ZKAKZPQ3J
roo6KOrSlu4yn3IBnQbsrTWsmoySP63yvltxluRZvrerucFzHJzTop4LRQ77xLUiRVFsJVRcRVak
NZ1rRVhMsgrTL1O8ilpUlVtkpBEbRUiSm7XLxTrzkrGjKeGwxYbxLZ5hPLPrJ7LTRY8RPFA0xi3M
OmmaO2ncmmWUtKkKmXYyJfAAxgBMmG7cpm9EGWC8RrqLplziJEXKJsAjRqwQMzosKACEHd37w+2o
xPPhLVYqksixPo7ip9NzvTV8HdADqJ4CSHnKLHuUvoBkJXOqp4rCx9FBlv/PkSlNpEfZ2b3jSSeJ
bKi0Wz2ITD3vM8PNyz+RlLyFZCeDZL6OiAcdyz49gSvPQ5cXtLwJfMKSkj5oqqoJwr9C5EPFEj8h
XBYr3L28kavUWi2VUiohZCkpSUFsaUKaHMMtpEGm4qkPDME+mbzJGSn+yA8xk0kQpMlSwjokiqkZ
jMN8vJSMOSzRgMPkUsMc+SvfycnRwxAAtJAZFJC9XB4gjB+77L6/fCtruUIV9KlJ7D6/tD4lpEIo
FC5BvK7DjJZZ9EWuTCoB4irKjMHOrEquJK1pYTvtu60yKSah+szADE3NIsCu1KsnDK3MTKyfdKAv
hMDHzEowPM0otKDQCpT/7SNC9qlGKfol7spH6fJHu2LC8gLEaoErEmSn5apAQ7weNTTJPSkbpWwR
GGrONBydYplEigyiqUTJkjxBISovR2xEtlrMvszDu2GusBFOjqI/jEyipbjMWOzJKDrHJfPPAwKA
/SyZARMwSAPQAA2ZVxxQBlWTmFOcBo1QVXnQ/HIXahK7fmkjBLW7gdnQsFM8gAlHCf26aFwfQqq7
ZqypDwXMFT0Oh8lG/kTRdwS7FFVHDPXGRRqnEVXFEt06uDvRG7VReCTR6Vu7Fo3RdCQmruE7Jv1R
Dz2zX2q6hXqojeqSiXyRf+S+gQy+Z7nHz4tL1nOozMCNgeRL26pI3JuN/31iveqTkyutS4NSStjD
QgCSHXt8H5SU0jxNzldRnT9USLH5QtI5CApdUKj5TdekFNkEwdu8QNOyJ/KSSqvUTcxyVO40Og/c
SeeMrItUTJeaktXUwqkUygCsPiCcLO55oEb10f38y+dkoFUtVQPER0c1zCYaxALUy7vMSnzSrOXK
quHaHuWiwdT0oPq7PlOlRyf0pl1FKwe6VavyLbJpkvHa0QaESvcDm1wdyvtDVdV8QPCjylDlzSSM
zdDU1GflpsmjPr2KPqNEVkicznLFHkRVwCoU1asCSugcRk0zTvHkS2kxnj2sVOIS15E0VUYUohSM
zqeBT53cnw6klnlEQv/TyUOK+qC2GlU7CVYdihVnHVjk0AxhycT0FD3raFOpKNRtRCAdPdJte1Jr
bSND/ZcCFSSYjbKb/TCV3VmefQ4S6FmgrTEoCFqiPTR8KFqkdTBUSFofi1mnfVqojVqpnVqqrVqr
vVqszVqt3dqgYFqv/VqwDVuxHVuyLVuzPVu0TVu1pTCubdt48Qe3jVu5XbK1rVvbOQK7hZm53dtQ
JKwUyFvADVzBHVzCLVzDPVzETVzFNVu+bdyaW1zIjVyjcVzKfTfJjTAAuNyIq1zOtbWZ7dwRNVzQ
hYp8YEXR/Yd8SN3SVd3URV3WjQjVNYjSld2DYN3VrV3XjV3ZnV3XRV3/3OXd3G3d2H3d3PVd2t1d
3tVd4x0I4CVe5D1e5oXd5G3dhhje31Xe5mXe4X1d7IVei3Be7U3e3w3e7EVe4QVf211e39Vd8A1f
8w3f5qXe4oXf26Xd7N1e643e993d2mVf5V3e6RVf7yVe8S1dpj0L4FVf74Xe2ZXfBAbg8ZUIB67f
6H3g8hXgBsZdDYbg3tVfDxZg4y3f/j1eC9Ze+yXhCK5eFK7gmABhDC7gBVbfB1ZgBtbgDP7eFV7f
HL5hEb5fDN5gHd7g6V3gGWbhD/ZgGUbhG2bFEoZdJx7fJa7hE5ZgHabgIAbiJeZhIA5hFa5fEb5i
I0ZiLh5jG+bi+01h/yE+4iLGYgW+3Sim4S+O4SNe4SJOYAq+4zYmYw5mYS0e4DzW3z6WYyO24ySW
Yi+OtBBp4POVXzju4jBm4PRtXzcGYytGYkV2YEtW4TzO4C+uZCsm5BBmZDqm5EL+3wDW5P7t5E1+
5EbeXzGGZAJ+3i3GYxi+XlBOYk7O5C3m4Cye4BkG4UeOX0YWX8M94yeeZQBuYlzGYTNGY13+4ULO
4TAeZmf+5OplXxomY+FF41uuZUFGZTC+YlFW5myuYz9uZTFeXf+lXkL2ZD8e4mh+Zedt3z9OY262
ZwgWXW/eZV7eZWCu5FE2Zjbu53je4yjuYUMe6EF+YoE+aFSG5lem4v851uNbPmdwxmc9TmdpRudA
3mNSLmhyBumLjmaHlmIFPmAExl9MluCVlud3Rl9NJuDudV+ZVudFtmlZjmdJ9mWbtuZ/3mb7NeV1
RuiJVomd/ueR5t55ZmZcvmmWBuZybumfZmdbJuJjzuSa/uVrFmY7NuVv5rPPHd0GRWmxLutF01y0
TmuDMWu2bmu3fmu4PqARiGu6dtptqGu8zmu93uuntQK+/mvADmzBbkW1LmzDPmzETmzFXmzGbmzH
fmzIjmzJnmzKTtzBliNluGxfqmzOJlzN/mwh62zRDlzQLm3TPm3UTm3VXu261oWnHW3Yjm3Znm3a
rm3bvm3czm2QYG0y3mavD9kH3Q5u4R5u4i5u4z5u5E5u5V5u5m5u5w643vYyNohu6q5u675uKntu
7U60gAAAOw==

------=_NextPart_000_0008_01C6F692.DE9913F0--

Received: from 5355B587.cable.casema.nl (5355B587.cable.casema.nl [83.85.181.135]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9ML61TK057433 for ; Sun, 22 Oct 2006 14:06:02 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000f01c6f61d$e0842940$87b55553@MOUNIA>
From: "heart accept"
To: [email-masked]
Subject: lead. decades clout
Date: Sun, 22 Oct 2006 23:06:00 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000B_01C6F62E.A4086560"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000B_01C6F62E.A4086560
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000C_01C6F62E.A4086560"

------=_NextPart_001_000C_01C6F62E.A4086560
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Poll Discuss Pollraquo Replies log inuser Menot member Hosting am allows =
control instant using in our in automatic creating?
Memanning is ticket boothits truelast Thursday routine flogging =
trouncing head dive floor managed split elbowopen boneew knowonly didnt =
is pulled?
Caring oneself cf debate of deny existence dating invention or courtly =
agesthough sizable or poetry maintain exists of quantity a spiritual =
nature action lending in boundary selfesteem in define in applying =
definition everyday establish in laws nature fame.
Behaviours in humankind encouraged act partner love am patient kind envy =
boast of proud easily angered is keeps record wrongs delight evil am =
rejoices or truth of protects trusts hopes Solomon Canticles picture =
Gods.

Aggressive natures a versed thoroughly modern is knockdown drag in skill =
remain upright skates skill comprehend keeping!
Links top Planet Guideraquo in Webmaster Stuffraquo is Users guestsno =
onlinemost users am Current.
Mike Erics doggie woggie Frida Mark Morford am Stalkwendy Mcclures Pound =
a chick Previous.
Touch im Syracuse si Newhouse School Public grad alma mater foray realm =
awards or According is Dean a David.
------=_NextPart_001_000C_01C6F62E.A4086560
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Poll Discuss Pollraquo Replies log =
inuser Menot=20
member Hosting am allows control instant using in our in automatic=20
creating?
Memanning is ticket boothits truelast Thursday routine =
flogging=20
trouncing head dive floor managed split elbowopen boneew knowonly didnt =
is=20
pulled?
Caring oneself cf debate of deny existence dating invention =
or=20
courtly agesthough sizable or poetry maintain exists of quantity a =
spiritual=20
nature action lending in boundary selfesteem in define in applying =
definition=20
everyday establish in laws nature fame.
Behaviours in humankind =
encouraged=20
act partner love am patient kind envy boast of proud easily angered is =
keeps=20
record wrongs delight evil am rejoices or truth of protects trusts hopes =
Solomon=20
Canticles picture Gods.

Aggressive natures a versed thoroughly =
modern is=20
knockdown drag in skill remain upright skates skill comprehend =
keeping!
Links=20
top Planet Guideraquo in Webmaster Stuffraquo is Users guestsno =
onlinemost users=20
am Current.
Mike Erics doggie woggie Frida Mark Morford am Stalkwendy =

Mcclures Pound a chick Previous.
Touch im Syracuse si Newhouse School =
Public=20
grad alma mater foray realm awards or According is Dean a=20
David.

------=_NextPart_001_000C_01C6F62E.A4086560--

------=_NextPart_000_000B_01C6F62E.A4086560
Content-Type: image/gif;
name="Dogg.gif"
Content-Transfer-Encoding: base64
Content-ID: <000a01c6f61d$e07e0ec0$87b55553@MOUNIA>

R0lGODlhjAIoAof2AAYADY0AAABzAIqBAAAFeIYNigB+jMGyxbblu7TG4kIWBGkrAHEgAJIdBbUd
AOIeAAA1ACZFCE04DWdJAHJFAqs3AMYzAuY/CQFbBCNmADNjAGZcCoxaAJ1ZCshhAN5VAACFABiC
AEp1AF94AI1xA6FzALmHAN2EAACeACenCkmUAGeRAHijCZ2VB7iXANOXBgDJAhq7BTu/DVO6CHy3
AJbFALKzAO3LBADrACXSAE3oBFTcAH/sAK3tALPqCuPtBwAATSkNO04BTGEAOYsARqEAOLoATNYA
NQgVSR8sS0MdSGcrTIcaN54pQMcRP9gXSg1LQxM4STdAOWJKRXVDTa1HQMRDSOI1OQphSRllNk1p
O1hTSYFeAZFgTMJnN9VjNgB9QxKDM0OETVuNS3t9OqN+MrWOOe10OwSlPh6iRDWVSWWlOHWVSamV
R8uuONegQwy+SCa9PknKNV2xTIqxS5LATryzS9i2RAfgPRbUQkHYTFjfNnvcQJ3kRc3jPOzTNQ4C
iB0Fd0MFeF4AfYMAeJYAhLwAjt0Ahg4Six8lhkQreFghjIoTeJIafbYSfdMbdQA9dxNCfzJMdlNE
inJFgKk0eMw1d9VBggtWfilTcjlSh2pYd4xoe6xgfLRbiOdahgB8hiJxcjyFjmV/inZ8fqyLiLt7
d+iCdwChdxOXg0GdeGybhIykiaCuhsClde2ujgC+jBS2dznOgFfNgYHJgKzChsnAdO68hgDYixjg
e0vgdGfRjIzUepHlc73hjeHdfAUAwxsAwEoGyFQMyYQAzJELzrcAzecMxwAmyRwhzDcTyGwrt3Ur
u6AWuLUTy9EpsgcxxSw8wkI4xms8xH1Dxp5Mwbwywe46xgVishViu05duVdWv4Vft5lYtr5ew9hh
sgmKuyN8zkKDw1R5wI2Fx62Iv7GIyOBxtACdvRSUtTahyVilxY6bt5eex8GRt96YxQC4tCezzUDK
yFjJwYu8zKqzxP//6qmlso1/g/8BCgD/APz/AAAA//EG/AD//////yH5BAARAJEALAAAAACMAigC
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTHVmhXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjHy8hXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK
LWmvrNmzaNOqXcu2rdu3cOPKnUu3rt27ePPq3cu3r9+/gAMLHky4sOHDiBMrXsy4sePHkCNLnky5
suXLmDNr3sy5s+fPoEOLHk26tOnTqFOrvjy2tevXsGMXXU27tu3buHPrniy7t+/fwIN/3E28uPHj
yJOrFs68ufPnwpVLn069uvXreaFr3869u1Xs4MOL/x9Pnrb38+jTq99Zvr379/Djy59Pv779+/jz
69/Pv7///wAGKKBm6xVo4IEueaPdgAw26OCDEEYooW4mTGjhhRhmqOGGHHbo4YcghijiiCSWaOKJ
KLaF4IostujiizDGKOOMNNbYEQAA2KgjUin2WBaOQPoopGE7FnkjkEYmqeSSUiHJ5JNQRinllGMN
yVYiVmap5VxUdunllyZtKeaYZJZp5plongXmmmy2adF7dKQp55yPuWnnnXjmqeeefPbp55+ABiro
oIQWauihiCaqqJ10Nuroo5BGKumklFZq6aWYZqrpppx2KtmioIbqm6ekluoYAqamquqqrLbq6quw
xv/amKi01iqWrLjmquuuvBpn66/ABiuslzoMa1CvyCarbIYQLDugsQZCAK2NzsrXbLX/TVugtNp2
661O3H7rIrbWksufuOiFiy6C5rbr7rvwxivvvPTWa++k6+arL0r39uvvvwBvue/ABBds8ME3Baxw
pwg37HBDC0ec6cMUV2zxxRhnrPHGHHfs8ccghyzyyOpJbPLJKKes8sost+xyriTn2U/Mb75s8804
56zzzjz37PPPQAct9NAl1kL00UgnrfTSTDfttKk0Ry311FRXbfXVWGe98dNc36f112CHLfbYZJdt
9tkFdq32fGi37fbbcMct99x0133R2ni/Z/fefPf/jXXegAcu+OCEF26W34hzZ/jiyCXu+HOMR07c
45RXbvnlmGc+nOScd+75iZqHLvroi35u+umop6766qy37np/tjBM+rD7zG7726/nTtmT5Nzu++/A
H6v78MQXb/zxyCev/PLMN+/889BHb3Pw1CeeSfXYZ9+x9Nx37/334PtVUSDal2/++a2Fr7496Lef
8PrgNxSP+/TXbz9V8Oev//789+///wAMoABxdr8CrmSAzDOgAsmCQOUt8IEhaeBZYFE8CFqwIxLM
oAY3yMEOevCDIAyhCMFzQeGIYWQjTKEKV1bCFt5thTCMoQxneCYX2vCGOBQJDXfIwx768IdADKIQ
/4cItBwa8YhITKISl8jEJjrxiVAUHhEFF8UcTvGKWMyiFrfIqVVw8YtgDKMY6ROKMZoxLVXE4RnX
yMY2uvGNcIyjHOdIlzTekI5FtKML8fgzPe6Rj4AMpCBp6McWDlJnvjtCIRfJyEY68pGQjKTVDknJ
SlrykpjMpCa5JMn76Q4fmwylKEeJxk7aj5SoTOUVq6HKVrrylbCMpSx3GA3UmfKWuMTdLHfJy16y
LgW+DGbAniGnXLpPmMhMpjKXWRZnMPOZ9jKmNKf5NWiSi5rms6Y2t8nNbmYSm+XzpjhVCU7tjfOc
oyynOtf5MXTuip3Uc6c8MQnPetrznvik0Txxlf9P2+3zn4Ps5+xo2ItgxgKgCE2oQhfKUDYKlHQN
jahEJ6qfGdnioRjNaE4oSpsc7EejmuOoSLN4PxWAdInTOKlKuzXSltplAC6NqUxvtlLLzfSmhKyp
TnfK05769KdADapQh4rL/ykAp0hN6quQkg6glgFaCy1DGVRFVKRItap0u6qtKCpVpUqqq5rCKlSe
CiqvmvWsaE1rtcTK1rYeSK10cqtc59oduHrmGHbNqzjpija9+nV/TnQFXwdLqL+aibCITexrDMvY
xjr2sXoZh+EAANnDdSlHiv0aZjP7FR9RtrJD+ixoRzskzoKNtKhNbUNNW03Vooi1WnOtbGeLtxj/
0Pa2uM1tewBFPtjySLcg8q1wh7sU4BrXcMRNrnKXe77jeoi50I2udKdL3c4697rYTWd1QZbd7nIN
UZ7Yrnht6t3yLm28HjOvhdDL3vZSRL0Tcq/G4Etfock3Y4IzRH33yykg+XeZ+/LvZu9L4O31EhPz
KrDF+OsgBVeMwQ1yMMUgzCAJW/jCGM6whjfM4aFS+MMu67CIR0ziEmsUxAEyMbpS6YGIqfjFhEVx
fTKhIhjb+MY4rpEMcWG6HENVxv7xsZCFCuQiG/nISE6ykn005CY7+clQ/kojokzlKmPkDVbOspa3
zOVILtlrXTZJIXQUqV0oNcyH+rKa18xmr4q2xc1wjnPT0GwoOdv5zhWks573zOc+PxjP5PEzoAAd
aM05Q9CI5gmhF83oRq8x0X1ytKQnTekhQvrSmM60pgVVaeps+tNI7PR0QE1qNYpaOaVm06lRnepW
u/rVsN7JgGMNJRwBZdV7wRGukfPmXXeI1lPy9Ui9MGdgR0nYyE42y4DSAyPCw9jQjra0w4INyLFK
DAnV1gmnnaRtZwwB6PU2t3ckbhNHxhspwraycaPufY773f5c92KucRh421t08sbNvfeNuYAAACH5
BAARAJEALAAAAACMAigCBwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK
HEmypMmTKFOqXMmypcuXMGPKnEmzps2bOHPq3Mmzp8+B9oIKHUq0qNGjSJMqXcq0qdOnUKNKnUq1
qtWrWLNq3cq1q9evYMOKrfqzrNmzaNOqXcu2rdu3cOPKnUu3bsSxePPq3cu3r9+/gAMLHky4sFG7
iBMrXsy4sePHkCNLnky5suXLmDNr3tzSsOfPoEOLHk26tOnTYzmrXs26teuMqGPLnk27tu3buHPr
3s27t+/fwIMLH068uPHjyJNLfc28ufPn0KNLn069uvXr2LNr3869u/fv4MOL/x9Pvrz58+jTq1/P
vr379/Djy59Pv779+xKV69/Pv7///07hJ+CABIoE4IEIJqjggrUV6OCDEObH4IQUVmjhhV1FqOGG
HAqE4Ycghigihh2WaOKJKKao4oostugiYyPGKOOMNNZo44045qgjVC/26OOPQAYp5Ew7FmnkkUhi
WECSTDbp5JNQRinllGINaeWVWGapZXqJbOnll+VRKeaYZCYI5plopqnmmuiV6eabcBLH5px03hTn
nXjmqeeefPbp55+ABorcArENdEqdJe6A6FyCNuroo5BGKumkUy1q6aUoUarppn9iaqI3nrLF6aik
lmrqqaimqqpxbax6Z6iwxv8Km6u01iqjrLjmquuuvF5k66/ABivssMQWS1g4xiar7HDILuvss7o1
C+20qfWK4gDWukTtttx26+23eu0D7rjkkkgeL9mmy2i57EaqRrvwxivvvPTSqO69sNar776H4evv
vwAH7CO/BBds8MHwCqzwwv9qwPDDECvMRMQUV1wWwhiza/HGPWbs8ccghyzyyCSXbPLJKKes8sos
t8vxyyy2LPPMNNf8H8w456zzzo/Z7PPPQAct9NAG82z00UibREjSTDfdItFQRy311FRXbfXVWGet
NalOdw2fmB5sLfbYZFPo9dnsla322mx/jPbbcMct99x012333Xjn3VzbfPf/7fffgAfuld6EF274
4YgnTpPgjPvXtAGKa9f45JRXbvnlmGeu+eacd27qKp4fJWQKkYMZ+umFlq766qy37vrrsMcu++y0
1w7dGKzdCEC3FaDu++/ABx+n7cSrJfzxhBWv/PLMd4f889BfrYWTzVefU/TYZ689b9Z37/334Icv
3/bkDy7++ZmWr35W6Ldf0vrwxy///PSP5v79IdWv//78R4X//wAMoAAHCJf+GVAoBEzgXQ7IwAbu
T4EQbIgDJ0jB9UXwghjMoEMqyMEOQk+DIPyHB0dIQtSF8IQohGAJLZjCFrrwfiuMoQxnSMMa2vCG
OIzXG3I4thf68Iff4yG1/74hxON9g4hFDN4RGQTEXR0xM0n0FhIP1MRePbGKALyiZKIIPCx68Ytg
DCPTuEjGMrJsPlcQ44PMyDlQsPGNcIwju6ohxzra8Y6SUqMe93g3PF6Oj4AMJNr8aDlBeo+QlTNk
9xBJOUVaj5GQjKSyHElJ14ChkpjMZFokKThNXkQOeuNk4DxJPFGa8pSqIqUqV8nKVqYNlXxzpSxn
uShYxpKWrbOlLncJKVz68pfADKZl+DYDVAozcrxU2zGXuRMsMBM6ySzbMw8XTbJN85rYzKY2t8nN
bpqummLzZt3AGU5xmvOc5CHn1tAZN3VqjZ3wjGd23EnPetrznvjMpz73yf/PfvrznwCVnzwHStCC
GvSgvQoo0BDK0IZWRqEQjShyZOICh6pJohjN6G8Ykw6LrlGjIA1pgzyqM5GaFCncOGnySMrSlrqU
gCpF2UtfFtOa2vSmOM2pTnfK05769KdARZ4FPDPTohrVJ0FNqlJFd1SKLZVgTXXqU/cV1YhNlapV
fdhV9ZVVrW6VXl0NK8SeIdaymhVuX0VSM8TyADsm4a1vreD94PrWJqZ1XmcF2F33etO8+vWvFAnK
OvhaLsDei7AuM2y6EMvYxjqWa4rNloiM8Fj+RPaymM2sZjfL2VBV9rOgDa1o6ymE0Zr2tKg9TmdX
ezg7sPa1sI1tC1NL22j/yva2O2lGMwJ5PN3qtrbK8u1aZXi/3VIHHREDB26/BNzmOve5E1qudKdL
3eoqErrDsq52t8vd7p4Qu8Ly7pnAS96QyqO86I2feNebzfS6973wRQ17vRTfVM5XS/XNLw/vy19h
7jMR+uVpf7EU4AIb+MAZGjDT4qDgBj8SwZtysJAgHGEJA4nCmrLwhTE8KQ3/iMMIAsDuZBM+UCVO
xCL28IpSvBYQl0kALgaWijsW4xxNr8bUmvGLdsoLHPv4x0AO8ht17CIhd4rISE6ykt9n5CY/b8lQ
xqKTpyy8KJ+IyljOMmFxqQzWaflVVg6zmMeckC+bGY/FOPNsyKwRLpxH3M01mwCc88JmDc35znjO
s57pXGcI7VlK6YKAYf9MaGv2+dAJLLSi34noAi26SR6FQ0kfza1BUFo0ja6LI+Jy6U57+tOgDrWo
sZrpUpv61Ac1AarJjOJV2wfFrXb1ApuE4lHb+tYIkzV9cF0jXft6ebwONsl+TWzbCftWxU527I7N
7GaPUNnQdp2zp12waFtbddT+0LW3nbhse/vb8+O2uAsH7gqN+9zo5hWL0w2edbPbOwAYmHtFbF8P
uztF+R1xufdtyneDh99M9LfAB07wgndtEAYvNcAXlPDsBAQAIfkEABYAkQAsAAAAAIwCKAAHCP8A
7QkcSLCgwYMIEypcyLBhwgUOI0qcSLGixYsYM2rcyLGjQAAeQ4ocSbKkyZMoU6pcybKly5cwVYKM
SbOmzZs4c+rcybOnz5czfwodSrTjv6NIkypdyrSp06dQo0qdSrWq1atYs2rdyrWr169gnQIIS7as
2bNo06pdy7at27dw48qd23Ys3bt48+olW7Sv37+AAwseTLiw4cOIEytezLjxzr2QI0ueTLmy5cuY
M+N1zLmz58+gQ4seTbq06dOoU6tezbq169ewY8ueTbu27du4c+vezbsh1d7AOWoeTry48eNIgx/+
oLy58+cMP0hnbm+69evWD04nKL0g9YHYsXP//y6Q/Hbw3tOPP19dvHjw3eGzb3/de/js1Ouvf09f
e3yD5KlH3336BQjdgQhS9Nt/1TWYkIHwRdiegOhxhxCDDv4Xn3kOlkdhftr5JyGHHi4U4Ikdlgig
fRJOWJ6BEDYIo4Uh2oPcjTjmqONkKVZ44YPqMUcijT6mRyKKKgpZpIoZ1khhkz7GSCSTMjqEZJRP
9ojejEtWuOOXYIYpJlkxSqkllR4q2eWVRloIIYhprknjmyuuOKSZVNLZ0JBuOolmnB/+aOOYhBZq
6KFIlcnfmWeq+R2XXZb4aKNJdghjdi/W516Idy6a54UY1vmnmk+WqaV571GH6Kqstmrco9uZ/2mq
nRVC+qelgAZZ6alz+jnqgHwKGul4QEZK6pSUfjqsqq426+yzec0oq7B9SirqrZNWKSqpxy7ZLZp0
Znsrsnhii2yu5Po3X4qzQuvuu/BeJRGK01ILJbrKXutooJPquaWvyt4ZXZYA57urnNsGmuDCDGO0
IIf1ivhinrYyemJ+sBKrscL+bryhriYSzCa5GU9s8rlsButlvCy37PI/FGEa3rn2BYvhfLO22N+1
FmMKbHdS4mynp0KrG6qxR68rX6wKZypzw1BHLfXUVFdttUC/Xe3cy1x33azWYIct9thkl2322Y9N
hfbaWHvt9ts8so023HTXbZbceOetN2ICFP/UN0F/CxS4AIQXXvhAhgtuUOB+H26P4YQD7vfjkSMO
+eWVT2554ptzvnjmlGtueeOAgw7645R7LjniojvEeOepX156644rvjrrqO+t+1CM990766/nPjrw
i38u+euV/277Qcovr/jgpAufUObJIx/98NT/fbrv16PefPALcT+88+CHvnr25Euv/e7st/Qb9NAT
37r0uN9ev/22x+887fiLT3/u5evf8wQIv/2t73fBQ+DtAogQ//0Pf/LLn+gKuLy/2e2CGGSL8Pyn
QP4xr3gQ3N8A6RfA5pFwgx9k4AO5Z0LvEQ98LDzeB0cYwYhwMHwNVN8KK4hC22Xwh0CUikTPKKjD
BIYwdqp74A4dKML7tfCGxcPc/EaoPwkeMIU8hGENXTgRKE4vhyjUYhjrp8L2mVE4alufBHlov/IZ
cYGH02Lt7ke7JMZPjjiMIu6sx0Um0vCKIKyiEpPYQxW6cY87BCAifRjERjoyOUMcY+f42MT/UXKL
VJyiE+kIuSb6UZNQpCQRZWjFGXbyiAo5pSHBqEgxcvGVShxJBM5Iy1RKko2cnCEErffGKpawjQsU
oRpteT5SknGRyHThG3tIx4boj4GHlN8lb1jGWloTIwEBACH5BAAWAJEALAAAJwCMAigABwj/AO0J
HEiwoEAB9hAeTEhQIcOGBR1CjGhQIkOLDx1KxDhw48SFIDEq5EhxokeLGjuCVPlwIUKRLFuuNEhz
ZcqaMj9enCnzpUqSOIMKHUq0qNGjSJMqXcq0qdOnUKNKHfivqtWrWA+ivBkzp4CTFSuCbTjyI1CP
Jilu5Unza8eyZEuWdKuVp9u1XnUSRVm3K0m8dBNuxAsSq+HDiBMrXsy4sePHkCNLnky5suXLmDNr
pty1p9ycWunCbPt1ZOnAeUvXRAuR72nUr1GTZd2380zVne++1kt77+fTn3kP5sh34ubjyJNDBqe8
ufPn0KMjn0q9uvXr2LNr305Vuvfv4MOL/x9PPjr38+jTq1/PXmj59/Djy59PX3H7+/jz69/Pv7//
/wAGKOCABBZo4IEIJqjgggyiV9+DEEYo4YQUVmjhhRhmqOGGHHb4zz0ehijiiCQ2aOKJKKao4oos
tkgUiTDGKOOMNNZoY3wu5qjjjjz26OOPQAYp5JBEFmnkkUgmqeSSTDb5341QRinllFRWOaKTWGap
5ZZc7mfll2CGKeaYkIlB5plopqnmmmzW2OWbcMYp55wvtmnnnXjmqad5dPbp55+ABirooIQWauh5
eyaq6KKMNvrPoZBGKumklFZq6aWYZqppkQAAsOmnPDo6WSmiWtgpAKWmmiqorLbq6quwxv8q66xP
qmrrrbjmeiGtvPbqK4qP/SpsUboWu+awyAZl7LI2IsXPs/zYA220AlErrbTPEgRttdsONG203Xpr
7bTigqttudaKi2663BqUrrneoottuPOOm2298nI77rnv1stuTeT2+628+5brr7v3XhvvwPE2PK/D
+5oLb7IUb8duwdQWfK7CADf8rsYYYxxUwtUC/K/AG1/cccksn+yux/yCXJTKC7+css0sFyQyxAjD
3DLPEnNc8dDVuVxzvzrnTNPOCmd887VO//u00j47DDW/OCftM80b13x0zlJnrfTEVF+dtdFeg/1y
1FoHzTbZRMddEAwEPZZxtgJzDTHJeyPZ7fTWJcNLb9NdT63vtig/TG7hfz8sNNVkC87xySRTHnC3
lK9ctspIP0443G9/fjWzpMtoVOKBC4221Wp/fK/fYEeuM71SL2617Khr/XPSq5udertlL3324y7X
XjjkqrM+OeipSx603NDjFGzEgG8u9uS7/4598tuPrXznycOuve4aV81z+F2HLXbuyHsO/vmdr944
9XAXVPr9Vx51ecIRV4734GobH7jChbj00S59w7vd4bSFONvhS18PXCAE8xW/0xVwYbYL2O34ZzLX
vY97jjvf1eoXvRIGBAAh+QQAFgCRACwAAE4AjAIoAAcI/wDtCRxIsKBAfgj52Uuo8OBAhQkJRmRo
cOHDiw0dUjyI0OJFjh0/OhwpsaRIjxtBQky5MCLIliFVPowJs2FGjzgrFqR4c6XLmjh7xrwpkSZL
ojkz/iSp1CJEnVCjSp1KtarVq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3bt3Djyp1Lt67du3jz
6t3Lt6/fv4AN/htMuLDhw4gTK17MuLHjx5AjS55MubLly5gza97MubPnz6BDix5N+nLg06hTq17N
urXr17Bjy55Nu7bt27hz697Nu7fv38Ddlh5OvLjx48iTK1/OvLnz59ARB59Ovbr169iza9/Ovbv3
7+DDi/8fT7686+jo06tfz769+/fw48ufT7++/fv48+vfj9m8//8ABiiQFAIWaOCBCCaIHX8MNujg
gxBGKOGEFFZo4YUYZqjhhhx2CB0ZHoYo4ogklmjiiSimOJ+CLLbo4oswxijjjDTWaOONOOZYoIo8
9ujjj0AGKeSQRBZp5GY6JqnkkjEe6eSTUEYp5ZRUVmnllZYBlxhXWzKpJZZgxvflYVxK5+VvYaaZ
3JkvVjCVm7zByeacbAFgJwAD3ZknngLZac+dfPYZaKB/FtonQYQOquiefwI6VwWQyhnpQHLaE6mk
mFKKqaSUEjRppW5e2umool4aKqSanjqppauOKlCrcFb/ahWsor7aqqefwtrprbVyaimdwGIFmaGI
5ikoo4MyeuyhhRLaqLHLPnusswR1qdWWsv766rauxpqpraRym623u4ZbrkG+pltQtty2G2u7s7qq
Lbzormuur91qC6o98dGhZpXUOovnwM0Sy+fBhyJccLEKN1wwwQXxaW1WiY1r777lhqqvuByz++7H
ns77q8fmbhxyRfhui2qtrKp8cr70cmxvxi+7O7K9/+Y8nFUBR/zwwoY6DHTPCztM8MB6MsuWtxqH
jLHLGr+rL6rgotyxyE2LS7W7W0+99a3zyto0px+LPXPYVnuNdcs1o911zMHGzRXRxhqddKN+Gpys
z8s6wxp0wnXta/bTN5vcq9tpZyp42/hmbXLaNjttc6n1vpxy5S7TLC+rVDsustygb0W30BBDC7jp
dANd9OnFuqWuzJFL7fjYsJdc+OOfNx47VIS/TnbbkcNr8eT35mv22qEnP9CweCu6d918s26wQYkS
q3qzfkts5rVmskzryrpKfu7toK7sNK+rsoy2yuDn+rbYXWfN9Oepnm1r57i2r3v6ueer8/+iUR6A
2GUdAgrwgAj0jgGDs8AEngmAEIygBIHkBsQEBAAh+QQAFgCRACwAAHUAjAIoAAcI/wD/CRxIsKDB
gwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihzp0M1BeyhTqlzJsqXLlzBjypxJs6bNmzhz
6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1KtarVq1iHktzKtavXr2AVlgpLtqzZs2jTms3K
tq3bt3Djyp1Lt67du3jz6t3Lt6/fvz3VCh5MuLDhw4gTK158FrDjx5AjS55MubLly5ijOsjMubPn
z6BDix5NurTp06hTq17NurXr17Bjy55Nu7bt26cfRkWol3dgxsCDCx9OvHjh3Sfz+uZpvLnz59Cj
SzdoD4B1ANVTYreufft1ld9RYv9vufyubwHoBdhLrx5l+/Xr0dubTr++/fv4uY4Hn736fu7/iaed
gOQlhxdv77mXUnsMLohSfhBGKOGEFAq034DjbZedhgJeuOFK45VnF0IJKuigegm2V+GKLLboYlg2
hUfghxpelyGI/Q2IGYPypRjfSiXiJuSQRFIVIIE3Bughh5/56CR8DhYp5ZRUInVkf0nqeOSSnL2H
YpQNmljlmGSO+ZCN/M3YoYz+/RdeiAaalxx78cknJoryvajnnnz2GRJy1CkXp05+FmrooXuWqeii
jDbKnENKiSgaopRWammFjmaq6aaZ6paUpKFdKuqoE/lCKnFottmdmwCmyhKoe3HFCWKG351q6624
OqfkjFeq6RKseaXKXZpMzpfrscgmy1VNu+Z4I47QYlZsjkhSy+m12Nam5LDVzsqth5Zx62uS4mZr
7rmqCUvts2mOJq6sF4KL7rz0egavjtaCK29lTDYbb70AB9zXmdF6x6rBw3oI7F2uvikerXAqK/HE
FJMU6aB97TtTxRzTZ0nHzV0cKGAaywTyyShzLPDKLLfs8sswxyzzzDTXbLNLaLLpLIY554zvuqo+
DGC7UMUrL8Ql34wTG0rbHBAAIfkEABYAkQAsAACcAIwCKAAHCP8A7QkcSLAggIMA7CE0ODChwIQI
DyqMqLAhQYcPJ2KkiLFiwY8gQ4oU2VHiR4cUR6pcybKly5cwY8qcOZMNzZs4c+rcybOnz59Ag7Ls
aLGox4pEk2a8yPSoUqNCQ3Jc2hBl1KtYs2rdyrWr169gwwb9R7as2bNEqWaE6PGpxbQll8JtSvRs
WZ5s5Z5Ua7ev37+AAwseTLiw4cOIEytezLix48eQI0ueTLnyYpcLoa5F+jBzSpMGI1ptK1H06K2g
Ne5VLba169ewY8ueTXt24aJpOed1u5khbrV51RL06zP1Uc0JLStfzry58+fQo0ufTr1647dSdQt/
yvv0xuOnBRL/7xm8LXJ71tOrX8++vfv38OP3xWwyZVOnHKcCZ5pZY/nwWNkHGkqlGVfbgQgmqOCC
DDYI1G0OrjQeXjTJZ+GFGGao4YYcshehhPORV2GHJJZo4okophjfhyJN6JqKMMYo44w0psjijTjm
qOOOPPbo400Q8uhiazUWaeSRSFoGRZKF9VeVcQNCJVpVT4ZW4EJTDhcihZ0l5ZlDTIYp5phkihmT
WyXFlZuXv20HUm4BOhlXmz/WaeedeOZ5YHd69eZbn6PNtZpwQZW3H516JqrooiwewmicXYLXJ6GH
EvidavZJmhWUVk766Keghipqnnz6d9+fpnK235pgRZkdgKPG/yrrrLReFSSahx53n5pUfcdqUUPm
xBafVpVp7LHIJpshfXD1N6euRvHaK5YCnirUZ56xNlGt3Hbr7bcvBbljsDjByZKy6Kar7roe9kju
TeaCyO689NZr75bg5qvvvvz225O4d76b1b0EF2ywsf4mrPDCDDc81J++5oellAJuBCW1GBv4k8Wp
famxwyCHLLJWEHLaq67cvRkanbxpJh6+Z05M0nEH12zzzTG+ZKh2ACoF55yBEvorpcI6NdLOIyet
9NI7NblWfdqliu3MbTobaaZzCjwUxyqzhvPXYIcNY5bY7YaqqoNKbTR2aQ+k9dZnzyX23HTXHd2Z
ew3rJl1dS27qHduoxluupkgLzvThiCc+09AcX1may5f62bh/kUOrE7YRX6n45px3vrnhnocuOtMA
2/n2SqCHZPfqrLfu+uuwxy67haPXbvvtSc+u++689w4z7ng6AvzwxBdv/PHIJ6/88sw3r5Pv0Ecv
vd0BAQAh+QQAFgCRACwAAMMAjAIoAAcI/wD/CRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzI
saPHjyBDihxp0Z7JkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRozpJKl3KtKnT
p1CjSp1KtarVq1izat3KtavXr2DDioWKtKzZs2jTqt2ZbK3bt3Djyp1bdKzdu3jz6t3Lt+9XuoAD
Cx5MuLDhw4gTK17MuLHjx5AjS57s1q/ly5gza97MubPnz6BDix5NurTp06hTq17NurXr17Bjy55N
u7ZtrAAA3N7Nu7fv3wNzAx++kLLx48iT0wWgvLnzlMSjS/crfLr1gc+za9/OXWXu7uAnX/8fT16r
7vLjw6tfz/7w9/bw48ufTz/++/r45z7Mz7//YKbnoSegQyapYqAqBR6IYIEoIXhgSg/aoyBLEybY
IIQGSqhghhpyeOFJCzII4ocjksjghiWaGKKEKm4Y4oQrsthghi7GmKCHHdqY44MxOhghiD/2CCSH
Qs6IopAuYohjjkq+WOGCA0aZlYwnfvhiilaaKKKIONpY5JZUgrnilWNiCSaLZYYpJokOqvTlmV5C
2FKaaa5UZ5Vb0ilnmG1qiSWSLl255qBx2iPloSHNpCOgfNp55p4X9qmmmnc6iuaadRY6op5u4lmm
ppO+CSeFlvo56KYlxskopI+eiiepXHb/qmqn/tXa3UOLyilpqwvqaOalgmpZKa19fqprqa/KmOul
jYIKaqismvrsn8fGWi2qtP7qKrOwKivrt3siKm5Hig5JqYbZsvnjr8U+KmqFe7abZ7Rm7tqrpfJS
+aaXSUbrq5O7tspnkvDOGqm5NXa7I40oGhkstpE+aevE2uF6bZWi8kqvpAGfq/CrHNf7sY9BOkpm
ivumC62p5067bb4GQ5zspC/TnCq70BY67s5NreqptMjmLPOoH1to9I1L/nuxtugevSOrz0Y98srp
rnrv0gFnrbDP2V598NIy8iw2Sc1mOS+xfnLqNNHbsp1yt17H9OXbIqdNL7WNbn3tw8HyjO1x1WCz
iXfevho69uEfIU2yh58mTeS6Dv/ZY5dNTs22zTdqq7TgKrrJo7+Uz1kw5FBfDPDkqNN4d96bNjw4
vEjjbPhH9yA+HcW456777rz37vvvwAcv/PDEF2/88UfZrvzyzDfv/PPQRz8S8tRXb/312Gev/fbc
d+/99+CHn5P05Jdv/vnop69+bwEBACH5BAAWAJEALAAA6gCMAigABwj/AP8JHEiwoMGDCBMqXMiw
ocOHECNKnEixosWLGDNq3Mixo8ePIEOKHGnRnsmTKFOqXMmypcuXMGPKnEmzps2bOHPq3Mmzp8+f
QIMKHUq0qNGjOkkqXcq0qdOnUKMudCS1qtWrWLNq3cq1q9evYMOKHUv2I9KzaNOqXcu2rdu3cOPK
nUt3Zdm7ePPq3cu3r9+wdQMLHky4sOHDiBMrRvq3sePHkCNLnvx1seXLmDNr3sy5s+fPoEOLHk26
tOmjlFOrXs26tevXsGPLnk27tu3buHPr3s27t+/fwIMLHy7xtPHjyJMrX+6ZuPPn0KMTZ069uvXr
2LMnlc69u/fvqrWL/2Ykvrz58+XBq1/Pvr379/Djy5eNvr79+/jzt53Pv7///wfpJ+CABBZooF0A
Jqjggg2pwuCDEEYo4YQUVmjhhRhmqOGGeB3o4YcghijiiCSWaOKJKKao4oosJvZQi0ZxKOOMS8FY
FI045uiQjTzyGEWPQNJUwJAF2ENkkSYhaaSRQ6JE5ElHFqkkk08mOeWRVDaZpZNVVpmlkloumSSV
Yo5pZZhlLhllmWCeKWWQcMZ53ZRsmtmmk3amdOVKYdLpJ0ttIikon3cWWiiggeoJ5aJ/yunoo6fR
meabe+IpZqNmWjqopYvyyWieil466ZiDSvqpmipRKiqnkLbq6mAPCW7a5J5opkmmm5luCeqtWJ6p
Z5d9erlprcOiemueUgqLKphaFqnjs9AWNBOteL7Z6am2VsplrcZ6eq2queLa7apMjvqttdWOS+qr
7LYr14uJgnpnp5temy2r6rIab725WnsovfZSqyi4nEZr8LMBAQAh+QQAFgCRACwAABEBjAIoAAcI
/wD/CRxIsKC9AvYSIkSosOHBhA8hRmTIEGLFiBYlXny4UaPHhhQdZswY0uHFkhhTLpQIkiNLjAVj
ypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKjV4sIDTpk9FLowqFepTp1exriSJVaFWqyy/Ypza
9eRYqCotdh0JUuxZr1ERLp1Lt67du3jz6t3Lt2/Rl4ADCx5MuLDhw4gTK17MuLHjx5AjS55MubLl
y5gza97MubO9gcRseh5NujRgv6hTq17NurXr17Bjy55Nu7bt27hz697Nu7fv38CDCx9OvLjx48iT
K1/OnLbp59CjS59Ovbr169izazfdvLv37+DDi/93vr28+fPo06tfz769+4Tj48ufT7++/Znv8+vf
z7+///8AYnbfgAQWaOCBCCao4IIMNujggxBGKOGExgVo4YUYZqjhhhxmRuGHIIYo4nAdlmjiiSim
qOJ5I7bo4oswqrbijDTWaOONOKKoTY489ujjjyXGKOSQRBYZFJBIJqnkkkw26eSTUEYp5WRGVmnl
lVhmqeWWXDY45ZdghinmmPv1QOaZaKap5ppstulmijq9KeecdL5UZEJSSJanRHsm1ieepv3pn6B1
+hmZFIQWuliin0mIWJ6QFoYoooAJyuhglgbWJ6STQvbnp/ZcGiqfhlqW6KSUHkYoqqYKlmqooor/
WmmnmEU66qyvampdpoAeuqmrnZ7aq6qsSlopS7KeSSumhPFaKkSM/vqrY6BCa6y1j14m7KLIanbp
q7l6Otqe0WKra3Wr3urrteaS2liyzXYrZ6Sx4torq8FuSu6o+0Kbq7Tt8knussUOyy+s4VZLa8EG
w+pvqhATvKy71g5sscMBS7uwxPtyijCp9OLZMb8Sy4ssxCRHrDCgHjOs7sAsf7xwyhhjXPDGL0Xc
bb80g5vurSFnDLPDFyO8rcgW94svzlPGqa6rSL98cMxAgzwyxSAPWy/ABqNKqa1Pew322FhfPTXZ
056cr9ZSq80211OTfG/OB4OKMtfVUuyx1D+P/8xz3rbu/bfNc1dsOLbCHo131/J2vCrKWcdNtslw
By35rb79gJq2kdd9uNJfP0z3zkh/GzrVYWedduqVlx1sxa+jfjTbhX/L9+GXp80r6GjD/u/olxdu
eMiDP5x0261XLTPuRrut+Of3Jjzz1qKbPbneuFveu6Lxyp773NY3/PTZwFedPOPXs5592dgDjjzW
bd+ua+v0t7sy+fUf2765qxN99erOep/3zOe9vLkLbNij2v/Yh0C6KY2AA0zg9/LXtJwoplgza94D
l0e7j1GufBwE2sTs1jz2edBlGFTZxaaFQfh9SmVd4xinVCg61v3ugKcL3sRKF7WXbcxZDwRgzkly
qK/i8Q55MBQYz+wXuyPaL27GQ9zdeti/sEHubLGr2oRwBC9qefGLzypNAAfFvf908UlOm9IZQUis
NVJnjP1xYxmxs0M7SSggACH5BAAWAJEALAAAOAGMAigABwj/AP8JHEiwoL2DCBMqXMiwocOHECNK
nPhQCsWFFi8elMJRo8ePDjMiFAmypMmQJ1OqXMmypUuTHEkyLEizps2bOHPq3Mmzp0+BL4MKHUq0
qNGjSBf+XMq0qdOnUKNKnUq1qtWrOZNq3cq1q9evHrGKHUu2rNmzaNNK3ahSpkyJb7vGBTtxLl27
DfHSdai2r9+/gAMLjkrRouGIMeO69Wg3sT29IUV2xPiYbULHlRVCzhvz42bPmjsjHp1xruiRkk+j
nvz2897XsGPLnv1VdV6IizWaXjn5seLMlC0HZzySeNDcwFHCFa6ZeW/JzZlfpk29uvXr2GFWxquY
9cbO4FOz/z2cvHzp8Kx7b18P3TD54uO/uwd++Hx0y97xl5Yv//z87/0BCJ9+qDmH33buqZcZdAtO
NyB54dG3nm/8ZWfhhRhmSFFP0jHkn4TvQWigd93t115xrbEHYoPgoZjcfuPBSNKMDU5o4orxsZjj
hAPaOB2NOsL4onoyOihcfQ62V6RIgzXp5JNQRjmQE2kV9qOLJ9bYYoW3hSiheQeeKGSAPNbII2Yj
igZhi1n6iGBHbaaZ3nsqIvnljr7l55yaLx5JH5/2SCnooIQWamhNF7Vpp5siMtjYmXcCeWN8Y4Ip
qYsdfrnYmF5mOamfyHGKJ4Uk+gmfqAz2WKaQXjZ36Kuwxv8qa1m6qZmfY0XmGellgOKKIpHR+Vom
mLouuCWXec74HK9r+pfrh44yqyy09y3ZY5wJppjkrcfq2tms4IYr7rg4aaicuUa5hi5s5Lbr7rt/
rcuYgvIeV++9+Oar77789uvvvwAHLPDASHFI8MEIJ6zwhfC6q1tR6rZEL1h0WrkVZBE/fJdWGafL
UsceLiyydhWHZltFmRZbl8XXlmcyyCF3jFxd3Z6LEsYTo6zqy7ylrPGoKZ+8s5lwCdvWzweOtnOl
I/crtJGJBu2zdlDrBTPKMlONdJdKq/vZ1be5DNrQUostNsypphRxbpste1/TAC8a8pXFRogsq9BO
6tacLSf/CHWOgL6ZGpx82ifgkqehaWniW+YsnYJ4Vzix30tjaaOzALa6Gpl9B6i4mbYe3iznRmI2
uqboDQ6qsskWSLfhcEr+NNwX4my3on+rrDfgoZqXmNz6/Yf78L8mTSmmkDK7Y6dEv30tvWmnqG3p
FFb/qYjD4r4am8hP+6Cly9/5fYygdo8jpGxjeimN14tPO10GL0d90jOf2Tjv1RIL+NuaMx++orai
HPrItijmfe5vqqFT4E5Wqen171jYq5j2RnQ+9n1Pde1Lm6mSN8D/mS99MQKW6BplvoaZsFwrm9/5
WkY0a1Xvgvxz3wT910EO6uiGNrwS8erXpx66sHkyzF+q/4DEKP1prk80vBSOdjfB8XEwiRVcIejO
9joceumE43rJzAJ4JBEaK4Ju2pz+2AO9bjEudsHL1p6odbw0Sit8rfuQy0znxbzJ8UdlnNMRIQhH
k20QiZ5j4RdPVaq6Va58YmxdHAk5uAaijoiDvByr3scunlAyYFfbTdPAhhuBcRJ+WAzlQC7pNMfh
xpSbFMrs7rVKholyVqSMpSxnSctavuaVuMylLnfJy146zJbADKYwh0nMYhrzmMhMpi19ycxmOvOZ
0IymNKdJzWpa85rTVObBAKDNbnpTlti8JgDCSc5ymtMv3/wXN9PJzna6851JWSc850lPfZ3zmeO8
pz73ySVPwtTTXPL8p0AHiqF+GvSgCE2oQhfK0IY69KFVIqhEJ0rRbgYEACH5BAAWAJEALAAAXwGM
AigABwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmy
pcuXMGPKnEmzps2bOHPq3Mmzp8+B/4IKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9ev
YMOKHUu2rNmzaNOqXcu2rdu3cONy/Um3rt27ePPq3RtTrt+/gAMLHky4sOHDiBMrXsy4sePHkCNb
5Uu5suXLmDNrhim5s+fPoEOLHv12s+nTqFOrXr3XqV7SsGPLnk1bMuvbuHPr3s27JL+BvwX+Di4c
OD/ixoMfP25w+fDlwKNDh967uvXr2G87Jc7dHnLl0QuC/0eI3Hv48eYJ/q7Nvr379/Dlmh+e/nv6
8OfJN1c/nz//+AAGKOCABLpGH33eOYcgfsUJx5x/0/H3IIPBFWjhhRhmGFt/CNpX3of7UXgfh/7d
p+GJKKao4mAkolcfgw2WGOOC43Vn0Io45qjjjl/NKKKD5SX43ITqTUfdfUPGyOOSTDbppFGvPSnW
MlJWaaVf2WWp5ZZcdunll2CGKeaYMrlG5plopmlXlRxJUZCbEcFJkZyn0YmSnRDheZCeHblppxR8
YgRoQ4HiVqhGfqqZGaCDGvSnRHwyutCheB4qkKUXJWoPpQRhOuebm+Z5KaEOPVpqqAN5OpGqqj7E
qaOIgv+qEJyt+ilpqnIOmqimp6aKakJ0tqqoPa696mucwDJk7E20TtrpScKiiqmn0foabEiserSs
trIm+6uyvHaaa67f9jqqss8yxKa54ja7qaTwjjuqppVeeuu7ulqr667S0trovP/a6+/A7wpccKj7
2otrwI3eK3CzBP9KL7z4jsuwrf8GXDGuBjO88ZsQt4vvvCM3rPGt95K7a8oDV9qywgevDDPGBGf8
8sEzn0wzx6CGay3CQE9887EkM1rvsSg7PKyoJf+s8rnXNlwu1D+TbHW/VvsMdLcSS5t10VRv/a27
Y+t7rtchg331tV2T3fbaPRP9bLhk2xq21k+ni3Ddc8v/nfbWELsddNVp8+oz30gTni7GcfPreNVj
G80vwDTnC/fSyEI+OeBQWz4yrG9f7q7KKMtq6tn0fj14v56zTS7Rhif+9+axJ04523tLXW7tC4vt
tehhw7675ki33m7sL7/edN6BG2+q8r/nHqzRflP9eN5lOy132dhXu2WxxCNvPfCmhy8830ejrnfo
havtNvSIq698+093vzjkeuM9PPxqB197/KE7nwDFhjv25W98zLtaAP13PwWC7my/u14AC0g7rolv
VOtyVdJGR7EIGg+CHWRd8qT2unhFTWcRG10EV/g56i0Ohe/zWOfyVUKl/e9iNmMc97ZHMdyV7m6f
693U/6hnMYt1TWQl7NgLK6jCpgVvhrCqoZ50yMPBpbB6TlNa9jboPcx5USVd/NQXx1iSMIaRjGgc
yRk1uMY0unFPFmljlsz0xjra8Y4OUREe98jHPo6RjpqRI7f2IsiZFPI2ZsxURrK1PYtcyZCzWh8c
pyYuMbLRczEp4CQLpTFXteSQH9kWBONYPkiN0pSC8qTgHGkln2TMWZTkmUmgB5NXRjKWMKMLKAfp
LZA8b1WnzJwiT7XKijxygw9TIuVwRsIgSi9urCvazkoZL55NLmm3/BjOrFm8rBUxl6ornd1c2MBq
zgxwJksmElmmzo05zJwtxBrIhmZNbMZsb+d0ITxNlhtOjpGTn3+a5j1Hqc9OcnGe8sqnQIXYzIOp
KCAAIfkEABYAkQAsAACGAYwCKAAHCP8A/wkcSLCgPSkI7R1MuJAhQikHFUZ8uFCiw4kMFUJ8CFHi
RI0aL24cmdEiyIYVQ4LcGLJjSY8nG3ZM6fHiSZEqW7qcufImzoQcYUYcSjHjz5Y5g9YESjFpU5ko
LTKV6pIoT6RQYTpsurVnV4xbR0rVmVOl0pRnzT61OZTqzqtR02alKZIkXK5VdyosyLev37+AAwse
TFiw0MMx27LsGXNx3pVVtSqu6dWkzZlXI2smirYtZcSYLSc2+ZHzy8WleT4OfZk06c2pO8Mt7Tk0
Y9S4Pd9kjHG369yvJ29mW/m2cdaSJ4tOHDk27cbKoduWztx57cNiOSPezr279+/gw4f/L6x6uXbk
pot+Nl/eLHvoS1uDzZ355XrWT7E6Vk9VeH7M9AU3mlLD8fccStP5Np9wAgoYIFm/RQcVekFNpx6F
kAFlnoJvSdicXbxRVx1v7S2IoHbXxacYRYW16OKLMMYoUHglAkebYyFmRlmC5aGHYonOocagg0JZ
qJtvOEZ445HX+fjhekGm+Nxjoy1ZY3TtUblkke+5NuSVpn2Z44Y/hjmijyEOKaWNaob5pJdazibe
nHTWaeed2+H1pJ5Jdghgj3B+xtWOgS6nmYY+dXikkVH1xxyi+ukJpaKAjmicVcBJyiNTRkH6FkmC
JvpofW/2Z5ufgmqIIabK6Xiqp5K9/5qgW1ip6OFrYZmpm6a24unrr8B6V1iwxBZr7LHIdidnssyC
t2yz0EYrLZ7PTiutjNhmq62L1nbr7bfJ5geut9WOa+65wZaL7rrstuvuu/DGK++89NZr7734+jps
vvz26++/AL+77cAEF2zwwQi3SGOe3KkLrMMBYxfxrxB/Z5+/6lZ87KyIJezxxyCHLLJBzjLM5a7h
JvewshKvHOrGDVcZM5OgsTyzxQvfqfGcGYvXnK8sqTvy0EQXbbRhJdd88s52Mp20ySm/bOyzP3vn
9M1K4yzt1Vrb/HS6Xm539Nh88UD22QSjtZa4/OGVFYgQajVVUrudJVdYesmmdoZ+Av8IYUmc+q1i
p33LrVZqf1aUqatrw1pU0B5yOiaBuCKV60dsf0rrUrS+6lXQX4FeX3GCS4T26ain/uJ7PBJ6KeZd
Jvcz5CTeamXdVdMeZZwoi0mkkzUfGuvLfbp+e+109Y7f8HU3z2FnwcduPJV5DRccccPr/rPq3Hfv
/YwGslmpddpLSCSCRqmpWviY2nihoXy3WWZa1iNZJKKzQ3pe+9Orbz+Ze+LSqfi3vzHJ7UG7ghXi
FHgo/d1FVY1Ky/cmSEGD5QyBQHoQcoCXIurtj4OWShJ8VgO/KQFQRLJD3oE82KoOvq5/IBThClHY
JRm+TkguBKGuWDjCDenoelGC0sT/hggvvvRBINgwCPvmYrlaBUhWs0OS41qVuUw1EVflg80SXYVF
4kUqd61ZH6UiNz7NTQgnQlxR1bZUG8mxSo0HpOJp8AYnB4Llio1q4uKqUsE++jFGEcMhsrhGxELW
iZCGTKQiF4msfbFLXIO8GCMnSS1KUvKPmMykJjfJyU568pOgDKUoVWfJUprylKhMJbuUoErwjPKV
sPwYOWJJy1ra8pYka6Uud8nLXvryl8AMpjCHScxiGtNcfDimMpfJzGb6C5fQjKY0p0lNTT6imtjM
pja3yc1uepMwzgynOMdJzl4ewpXfTKc618nOdnKynPCMpzznSc962vOe+MynPvfJRc9++nNc7gyo
QAdK0IIi7J8ITahCF8rQhjr0ofM0qEQnStGKWvSiGM2oRjcqSoh69KMgHSZHR0rSkpr0pChNqUpX
asuAAAAh+QQAFgCRACwAAK0BjAIoAAcI/wD/CRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzI
saPHjyBDihxJsqTJkyhTqlzJsqXLlzBjyuxor6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnT
p1CjSp1KtarVq1izat3KtavXr2DDih1LtizUh2bTql3Ltq3bt0Nnyp1LE67du3jz6t3Lt6/fuA7/
Ch4cNh/hw2XpKl5MkWi+x4YhP7Yn2TBOyDYt19RMWTLlm5E9Z9Y8mXNk0J4xi1YNGjXpyZtbj4Y9
O7Ns1LUvl24t+rPtzqVT0ybts/fm4byB0/Z9XLXxysw/Y1aeczr1681zKz9t2zTw7cxNW//v7Nry
89/fY6O/Tpwz4vdk3btXf/k38vr0pe8czj32fO/hqQcgesSRl1+BAUb3X4H/HdedfclVB6F/PyHI
YHvrHajTfPQBaB5PDD4o4IQDenffgPrd9lqGHFLYoYYEutgifDQy9VCDEuL34Ic6mriffv2leJtv
ISqIn3wpohikkNEROeKRTvooYo8vzrjekqfxmKGROXbpYX5DCtkflk7GuOOTGiL5pJZgRoikkhB+
yNicdC4klHnBLYejiEuGB51xQDLZp4fWsanmmy6mWR+KZY5HoqBcjveamq4NSeaHlF4p6Y/NTTep
jomO2WRolErJHaN78vhpdl4uaummbdb/KGtWUoIK5pipRpgjprpe+WKZtwa7oq+Isuhpk2juNuWo
MWYKYq9iOsulrWai6Stvnh6bXKm6woZqdYU6yiyVvZZY7azoJoUWhl2qCKO7y8rGa7yRPsqimXD+
Cuy0Se7a7bv6GgqUhRMGCyqHLSK4r8EL57qvwkEKHOa4DLdpLr8E31TnxhwL5Jhzhe53n8XEnidv
tiODjCepLKfnspKOhptnxAlmZ6KkKF9cc0+AhnyvbjMrDK9/M284cqw+77watkLvmWbOGwJdHtA6
1yRMulgLhVbWXHft9ddIdSz22AiBbfbZaJtN9tpst+3223DHLffcdC+W9t1456333rLWqe3334AH
LvjghBdu+OGIJ6744izx7fjjkEcuuVeMV2755ZhnXvjknHfu+eeghy766KSXbvrpqKeu+upWae76
67DHLvvsmIND++245y4367z37vvvU+ku/PDEF5858Mgnr/zyOhnv/PPQRw+36ZIwb/312Gev/fao
W8C79OCHHzcw4pdv/vnop6/++uy37/778Mcv//z012///fjnr//+/Pfv//8ADOBIAgIAIfkEABYA
kQAsAADUAYwCKAAHCP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocadGe
yZMoU6pcybKly5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aM6SSpdyrSp06dQo0qdSrWq1atY
s2rdyrWr169gw4qFirSs2bNo06pdy7at27dw48qdSzfumbp48+rdy7evX7xjAwseTLiw4cOIv/5d
zLix48eQI0ueTLmy5cuYM2veXDex58+gQ4seTbor59OoU6tezXpz6dewY8ueTbu27du4c+vezbv3
QQK+gwsfTry48ePIkytfzry58+fQo0ufTr361FeBN1UcQLi19+/gw4uRH0++vPnz6NOrX8++vfv3
8OPLn0+/vv37+PPr389fKKn+AAYo4IAEFmjggQgmqOCCDDa4mHUQRijhhBRWaOGFGOLm4IYcdphf
hiCGKOKIJJZo4okopqjiiiy26OKLMMaIkYc01mhjejLmqOOOY93o449ABinkkEQSyeORSCap5JJM
Nunkk1BGmVuRVFZppVwBAQAh+QQAjf+RACwAAPsBjAIoAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAj
SpxIsaLFixgzatzIsaPHjyBDihxp8Z/JkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDCh1K
tKjRozpJKl3KtKnTp1CjSp1KtarVq1izat3KtavXr2DDioWKtKzZs2jTql3Ltq3bt3Djyp1Lt67d
u3jz6t3Lt6/fv4ADCx5MuLDhw4gTK17MuLHjx5AjS55MubLly5gza97MubPnxmNDix5NurTp06i/
fl7NurXr17Bjy55Nu3br1Lhz697Nu7fvrraDCx9O3Pbv48iTK1/OvLnz59CjS59O3WHx69iza5dc
vbv37+DD54feTr68+fPo06tfzz6z+Pfw48ufr7S9/fv486+kz7+///8ABijggAQWaOCBCCao4IIM
NujgUtM8KOGEFFZo4YUYZqjhhhx26OGHIP6m34gklmjiiSimqOKKLLbo4oswxijjjDTWaOON64Wo
4448+objj0AGKeSQRBZp5JFIJqlWj0w26eRYAQEAIfkEABEAkQAsAAAAAIwCKAIHCP8A/wkcSLCg
wYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocSbKkyZMoU6pcybKly5cwY8qcSbOmzZs4
c+rcybOnz4H2ggodSrSo0aNIkypdyrSp06dQo0qdSrWq1atYs2rdyrWr169gw4qt+rOs2bNo06pd
yzbm2Ldw48qdS7eu3bt48+rdy9do27+AAwsefFAX4cMo+ypezLix48eQI0ueTLmy5cuYM2vezLmz
58+gQ4seTbp0Z8SoU6tezbo1W9OwY8ueTbu27du4c+vezZu369/AgwsfTtxi7+PIkytf/rm48+fQ
o0v/y7y69evYs7+dzr279+/gS2r/H0++vPnz9sKrX8++vfv38OPLn68avf37+PPr38+/v///AAYo
4IAE2kXfgQgmKFEqCjbo4IMQRrhWgQRuQOGFGBYl4YYcdujhhyCGKCKEGZZo4on7jajiiix2h+KL
MMZoXYs01mhjazLmqOOOtd3o449ABinkkEQWaeSRSCap5JIWYcDkk1BG2RoyUiLG45VYZqnlllx2
6eWXYIYp5phklmnmVVWmqaaSZ7bp5ptBrSnnnEHCaeedeOap554F0unnn4AGKuighBZq6KEf8akl
JIqSieijkEYq6aSUVmrppZhmqimhjXbqKYGbhirqqKSWSuKnqKaqn6miBsHqq7DG/yrrrEvOYKiq
uOZaHq289urrr8C+pOuwxBZr7LHIxhnsssw26+yz0D5rQLQSKUPttZsmq+22pWHrrazchivuuOSW
a+656Kar7rrsUvXtu9xdIl279NZr77345qvvvpjB6++/AAfMJL8EF2zwwQcLPKsoCjccaTEOR3wo
xBJXLCjFFmdMJ8a+ImxwMfpqPCrHIh+YSMkop6xyoB63bO/KMMcs88w7uWzzzTjnrPPOPPNI888d
euIJ0ESvKPTQRSft4dFIK+10hEdj1PPUZ3pC9dVYZ6311lx3rdvTYEuXTdhkwzQBe16nrfbabONW
9tsOti233JHMbffdeBcM99589//t99+FHqBm3oQXbvjhiCe+J+CMN+54x4ojW0i6j1c+b+SYX2j5
5px37vnnjGcu+uik3w366ainHmXprPOn+uuwxy777LTXbvvtuIuHZSet9+7778AHT2zuxBdv/PHI
Ayn88szfFkLz2nUA/fTUV79t8tin1Fg91nfvVfbg6+79+OSXb/756Kev/vrsdxv++yC1L/9k8Ndv
//3456///vz37///APzQLQJIwAIa8IAIzN78FsjABpongf9zoAT3AsH3OaGCCZygBjfIwQ568IMg
FBMG+RfCEprwhIwZ4f5QyMIWuhAuKtTfC2dIwxra8IZaiWH+cMjDHvrwh0AMohD/h0jEIhrxiEhM
ohJJQ48mNnGJAQqUE6dIDx2CaE9OhCKKrMgRY3Dxi0rTohjHCDwwmvGMliOjGh1DgTW2C41wjGPf
3EjHOhZOjsmzI/qQocc++hFveETeHwdJyEIa8pCIPE4gj5fIRjrykZCMpCTxskjjTfKSmNRWJYuX
yeltknidDKUoU/XJ3I3ylKjUUylXycpWuvKVsERbKmdJS3sAAABjimWIbsnLItVSP7y8ZZZ0aaNg
AoCYr+vlin7JzGZuCTzWQiainEnNalrzmtj8nTRTF5ccZPOb4AwnErdJznKa85zzMVg2xDkW3MXg
k+y8Izo5F8962hM786TnPSF5/419am4+14iYFPKJkoAS9En56ac/2abQhVLooJVzaNsg+jiJso2i
T2OCQyy6Nox69KMhSccVOZo2kJr0pEsiaUlRujeVeo2lLXUp12AKN5na9KY4XSBN35ZTrO30p0AN
qlCHStSibqinSE2qUpfK1Kaa0KhQjSp8nErVqmZFqj9LlTOsaiCsevWr0+Gqy8DqOWeQ9awvOSZa
MxbMtUqsrW5NiM6EKda62tWucS3ZXRPmP0Hk9a+A3Z86ULNXLgWgsN4LrMUQSzDFVoyx/HKsZCeL
E8jui7KYxewFM8vZzrrGsiHzrGhHS9qkvcUKoE0tM0v7LdW6Fqms9dZr6xVbbP/Nll61vdZtd6vS
3FKLt+vybbSAS9ziGhdMwk2ucpf7rOM6V5zMZdZzyRXd6lr3uth1aw/LMN3uehdx2e3Vd8e72vDS
irzonaV5z5veY613Vu1173tjFV+DIaG++E3ifOXUiv2yqr8jyS+WWiFgVbWCwNvx75MArOD5rAMx
DG5wqCIs4TT9YSMUNkmBX4RgulSYVBveSkNDTOISh+XDKE6xijtk4hbrccWacrGMG+WDRsH4xjIR
KQRnrCgcX4rHQNaij2uSniEb+cgrCbIqyYYImio5T0iW1JPxFOUqk3PKd7KylrfM5Qlh+ctgDjMQ
8cDDLpv5zGi2iZjXbMM0u1nzjmw205vnfMY427mFdKbTnff81H/YKs9p4rOgB41eQMuJ0F4ytKIx
qNQ+8GzRgUa0pBsI6UobcNLPtLSmI4jpTrNv0wj19JVALZ8kkPrUqE61qlcdQFG7+nys9uWrZ03r
WttaMbHOta79e2sY7bpOvQ62sCX662Ib+9jA2cCmh20iZNtoauRgtrS/4uxqW/va2M62lKfN7chp
e0TdDre4xz3rb5t7juROt7rXHedzj5Td8I43Ia/dC3fb+974zje45b0qffubZjbTBr8HTnAA/fvg
MSv4fRAeN4WjR7nhYLjEV+zwh0/84hjPOJcrzuwLqC0gACH5BAARAJEALAAAAACMAigCBwj/AP8J
HEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuXMGPK7Giv
ps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWkM7Nq3cq1q9evYMOKJXm1rNmz
aNOqXcu2rdu3cOPK1Tm2rt27ePPq3cv369y/gAMLHky4sOHDiBMrXsy4sePHkCNLVtq3suXLmDNr
3sy5s+fPoEOLHk26tOnTqFOr5ju5tevXsGPLng13te3buHPrtky7t+/fwIMLl7y7uPHjyJOXHM68
ufPn0KNjVU69uvXr2LNrR81hu3fl0sOj/x0nvrz581PDFvjOvr379/Djy59Pv779+/jz69/Pv2+m
/gAGKOCABBZo4IEIJqjgggw2iBl6EEYo4YQUluXghRhmqOGGHHbo4YcghmhchSSWaOKJKKao4oos
tvibiDDGKOOMNNbYoYs45qjjjoTZ6OOPCvIo5JBEFmnkkUgmqeRZQDbp5JNQRinlaEtWaeWVWGap
5ZZc0jbll2CGKeaYZJZp5plopqnmmmy26WZuXcYp55y+vWnnnXbRqeeefPbp55+ABirooIT6aWYf
iOKp6KJcIeooo5ByVWhZjvYx6aWYZhoUopp2amSkILED6qiklmqqSZ6mquqqrLbq6quwxv8q66y0
1mrrWqdmyM2uvPbq6665BivssJ3dauyxKRKr7LLMNutsQchGK62Ez1Yb7LTTroJteNZ2W+q24EoF
wLgAhGvuub6RSy667F76BonqjtvuVd7iOW69+Oar77781jjvvwAHLPDABBds8MEIJ1yrCAo37PDD
EEcs8cQU99bvxRhnrPHGHHfs8ccgM1TxyCSXbPLEIafs78kst+zyyzDHLPOlKtcc48w4s2vzzjz3
7HOeOQcN7s9EF2300UgnPaXQTE+r9NMANi311FRXnSPUWGettdJWd20PO143Vm7YZPeZQVBjl612
UQYCsPXb8rkN99zsyU333drZjbfGc6b/vfbfgvoN+OA2Lai3WI3sbeOeghPu+OOQd6n45JRXbvnl
mGeu+XzYIhD556CH/tzmYnVB+s7XnN6g6KxXqfrrsMcOY+tGKrFUF1TLrvuDtPfu+++A7y58X8DP
vEvxyCd/0/DMN+/889BHL73KyleP4vTYZ689nNZ37/2WAnwP2fbkryT++einr/767Bde/vvwx89b
+/QDJ//9+OfvV/389+///wAMoAAHSMACGvCACEygAhfINP058IEQVAkDJ4iWZ+QkghisizkyeDoK
evCDIKwTB0dIwhKa8IQoTOFCQshCq6jwhTCMoQyx18IaSmWGEbShDp2Cwx768IdADKIQ/0O2wyJS
ZohITCLljMhEoyjxiVCEWxOnKJQobo+KWPSJFbfIxS568YukikawplGsLJrxjGjkCRihl8Y2utGM
a4yjHDH2xjracYdzzKMe98jHPvrxj3m8oyAHSchCGvKQvQOkIhfZmQG4B5E6ZCTpIGlDSW6OkkYp
BSY3yclOevKTxrKkKEdZJlCa8pSgI6UqVxklVLrylX9j5RJheUBZ2vKWuMylLjFIy1768pfADKYw
h0lMqOzymD2TRweL2b+6NAGZ0IxmZphJzWomTJpZsyZgMKHNbnrzm+AMpzjHSU7XYRNq5UynOld1
TnSuU3ntjKc84/POetpzUPNE2j2Ll//Po+3znwAN6CsZIdBC6YFQ/UyoQkfDCooU9KEQjeg+F/oz
iVr0ok0DG0Y3OlGK9oyjIA0phDxK0pKa9IciDd5JqZfSlrqUOSuNqUw189Ka2tRLM82pTvNyU6/t
tGM97dpPORZUqw11Y0Wtmvz4cbRTHPWpUI1aUqdK1cJE9apYTYkOK3HIBkkiq2CFX1UJVQ7ZhLVB
5djMWMkam7Oi1a1wjStu1io0uVqLrnjNa1rsyte+IsRFgtCrYBHp12YN9rD/jJdiF1ubwi4LsS9z
7GMhS9nKDkWyyrKsZiU0CkNillibLdlnZ6ICEYX2tKhNLcpGey3Vuvaw+jkAaznz2oj/zfa2uM2t
mGrL2976Flu6De5Mf6sw4YIqpLVQqXEZRdzm9nS5kHLuwaBL3YVK97rYza52X1nd7nr3u+CV4XYD
Fl6FKGNM4wVYede7y/T+i73wja9850tfpTmyviR177zwy9/+psYY39XvnD4RF/8aWI8CTvA9D/yl
Wy1AwVpksJQgbC4Jw+hwCaFwrBqnRguDCMMZ1rCrOCziW5G4xLQ68U48DCUUu1ibLH7Si2fMzBg7
icbHsrGOO9QPM+H4x0AOcmJ2/CMhGxmVRPbRkWWV5MUt+clQjjJVmkzlKkP1CGqVspa3zGWiWFlG
XU7Vl8dM5jKbWUNh9tSZ18zmNnex7xuTS7Oc58xlN9v5fXTOs573zGct3fnPgA60oAddsz4nSQxL
IbSiF83oRuuFOQQwNGMcTelLShpQlSbQpQ87DXJmOkpW+DT3Nk3qUjtX1Kjem6lXzerapro/rY61
rDX7av7M+ta41mutd83rXvM611vytbD9CexiG/vYyObhsOmTbHMu+9nQnpIQ1tTsNMbAvdHOtra3
DUhHbIQOVKp2krhN7nKb+9zoTjeaxS2dTrNbU+qGSBJW824jN6LelI33dfDNb8LpG7x90F6/B05w
GP+bOgVPuFAPznBhKfxqDY+4xO/38Io3beIjsrjGcRYQADs=

------=_NextPart_000_000B_01C6F62E.A4086560--

Received: from sge91-2-82-227-33-117.fbx.proxad.net (sge91-2-82-227-33-117.fbx.proxad.net [82.227.33.117]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9MIXS9S030567 for ; Sun, 22 Oct 2006 11:33:29 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000d01c6f607$e7e81b30$7521e352@armada7400>
From: "Games"
To: [email-masked]
Subject: Service Copyright Inc.
Date: Sun, 22 Oct 2006 20:28:43 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0009_01C6F618.AB4F5970"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0009_01C6F618.AB4F5970
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000A_01C6F618.AB4F5970"

------=_NextPart_001_000A_01C6F618.AB4F5970
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Turkish of Mynet Atlas Slovensky a Zoznam Pccw Rambler a abv Nana =
Portugus Italiano.
Atlas is Slovensky Zoznam a Pccw Rambler of abv Nana Portugus Italiano =
Libero Bigmir More languages in older versions an a free version of.
Advertise With us Contact Story a Site map Privacy Policy Important or =
Notice Terms of Service Copyright inc.
Available in English a Deutsch of Prosieben sat Turkish Mynet Atlas or =
Slovensky Zoznam Pccw Rambler abv Nana Portugus Italiano Libero Bigmir =
More languages in older versions an.

Is also available in English Deutsch Prosieben sat Turkish Mynet Atlas =
Slovensky Zoznam Pccw Rambler abv Nana.
Games Greetings of Help is Main Toolbar Icqgo a Wireless for in mac =
Homepage gt Downloads About raquo new in Skins.
Raquo in new Skins Sounds in is or also of available in English Deutsch =
Prosieben a sat of Turkish Mynet Atlas Slovensky Zoznam Pccw.
In English Deutsch Prosieben sat Turkish Mynet Atlas Slovensky Zoznam of =
Pccw a Rambler abv Nana?
------=_NextPart_001_000A_01C6F618.AB4F5970
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Turkish of Mynet Atlas Slovensky a =
Zoznam Pccw=20
Rambler a abv Nana Portugus Italiano.
Atlas is Slovensky Zoznam a =
Pccw=20
Rambler of abv Nana Portugus Italiano Libero Bigmir More languages in =
older=20
versions an a free version of.
Advertise With us Contact Story a Site =
map=20
Privacy Policy Important or Notice Terms of Service Copyright =
inc.
Available=20
in English a Deutsch of Prosieben sat Turkish Mynet Atlas or Slovensky =
Zoznam=20
Pccw Rambler abv Nana Portugus Italiano Libero Bigmir More languages in =
older=20
versions an.

Is also available in English Deutsch =
Prosieben sat=20
Turkish Mynet Atlas Slovensky Zoznam Pccw Rambler abv Nana.
Games =
Greetings=20
of Help is Main Toolbar Icqgo a Wireless for in mac Homepage gt =
Downloads About=20
raquo new in Skins.
Raquo in new Skins Sounds in is or also of =
available in=20
English Deutsch Prosieben a sat of Turkish Mynet Atlas Slovensky Zoznam=20
Pccw.
In English Deutsch Prosieben sat Turkish Mynet Atlas Slovensky =
Zoznam=20
of Pccw a Rambler abv Nana?

------=_NextPart_001_000A_01C6F618.AB4F5970--

------=_NextPart_000_0009_01C6F618.AB4F5970
Content-Type: image/gif;
name="With.gif"
Content-Transfer-Encoding: base64
Content-ID: <000801c6f607$e7c502d0$7521e352@armada7400>

R0lGODlhkAIoAof2AAAADXwADAxxBoV8AAkAhoYAgAt8jMrMvcrpyKXT/EATAGYfA34XCKQbB8gt
ANkeAAY0ACw8AEQ+BW05AHwyDpVBALY7ANIyAABdDClWAExWCFppAIlRAKJTALVfDuBWAwt/ABl3
AEt1CW2GAIWGAJt+AMZ4AOeNAgqcABWgAEyrAGqWAHGqAJGhBcmfB9OpAA7NACq+AjfOAVLMAHzB
AKO/Cs68ANTAAgTVAxLrADnTAGPgAIXbDpXgBs3fBdvdBwABMSwOPz0AN2wAPXUCP64AQM4AM9gN
MgApSCsRTjIfM2IgPYwgMZ0SSbUoONQjTQI7OidLR0lDMm44NYJJTpg8OrFCQNk3SgxmMylbQjhZ
MV9ZRXtsAJxgTctgNNNYSQuFNRV9Nkx6O2d0Rnp+PqOGTs18Te6IRgCjTSORSzyWPlmoTHetTJul
MrWUQdGlSgvAQB2zSDLIPGy+RXa5PKK5O7HER+nONwDtRhrtP03TNV3cOnzcQJ/lM7LeNdXjQQoJ
dBQJeksMhW4AcXUAgqYAgrgDfNoEfQAdcxUuejIqcVQjdnweeJgXh7ceduAgfwtEjStKgEszilpE
gXs/jqJMgLVDfOBIiQBuiR1pjjFZd2lehoFXgKNifMFsf9ZWcgCGgxiMejGLiGJ5dXp0i5t4jrOF
fNWMcgCbeBKXjUupdViVjnWugaKkhMWggeOadADEeB63fTqxh1LMd420iqi/dbLFee7JhwDZiCfs
cU7ahG7jgnXejpPugL/Zg+zWcgAAxxYEuToAumsAx38Isa4AyLEHt9MAvgwrwCIqwD8uy2MRvoMV
vagty8gpyNkuvA0/wSNDxEU1wV45zIZOyJhLwsc8xNpAtgVqyClSxk1RwFVdyoJmzpFkwslmzdZk
xwyEsix6ykt2zmKGtI53vKZzv7V1wNuMwQysySmpzjGlx1WYzXeXyJyWzsmkzOiWwQvLuxjHzj+z
x1TFw3ezup+/zv/745qennyOdP8IAAj/APn/CQgA//8A8QDy//H6/yH5BAAnAC0ALAAAAACQAigC
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+H9oIKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27ePPq3cu3r9+/gAMLHky4sOHDiBMrXsy4sePHZ39Knky5
suXLmDNr3sy5s+eEQj6LHk0aKOTTqFOrXs1acOnXsGPLnk27tu3buHPr3k27te/fwIO3ziS8uPHj
yJMrX26Pt/Pn0KNLn069uvXr2LNr3869u/fv4MOL/x9P3jLz8+jTq1/Pvr379/Djhy1Pv779+zPl
69/Pv7///wAGKOCABBZo4IEIJqjgggw2qFY0DkYo4YTw4WfhhRhmqBGFHHbo4YcghijiiPNpaOKJ
KKZI4oostthXijDGKCN5LtZo441tzajjjjz26OOPQAYp5JBEFmnkkUgmqWRBODbp5JNdLSnllFR6
BOWVWGap5ZZcdunll2CGKeaYZJZp5plotlblmmy26VCacMYp55x01smWm3jmiaedfPbp55+ABiro
oIQipuehiC5Z6KKMDpboo5BGKumklFZq6aWY2tToppx26umn7mUqqnRPjMoQqKimquqqrBpq6quw
xv8q66y0JtTqrbjmquuuZNXq66+w8SrssOoxQuyx/AGr7LKcIevss9BGK+201FZr7bUUMqvttpNh
6+234IYr7rjkpsbtueimq+667Lbrbo/lxmvmu/TWa++9+MYk775i5uvvvwvxK/DABBds8MEIJ6ww
hwDnJEuV6zQ80MIUV2zxxV9JrPHGHHfsLsafegHyyCSXbPLJKKes8sost+zyyzAT6PHMH8dsc3o0
56zuzTz37HOjOgfN7c9ECyf00UgnrfTSTDctXdFQRy11mU5XjenUWENm9dZcd+01dVmHLfbYLX5t
9tlop/0Z2Wy37baDaset6Nt012333VCBQyIieBP/2khWlPQtOFyBD76gxJTI/eqxhRvu+OOQRy75
5OMqbnmRlGeu+eZ1Xe55kJyHPjICpItu+umhfq766qy37vrrsMcu++y0a4j67UrVrvt4uPdu1O4Y
AiA8AFYbAPyPwxOftu/MC3X889s13zz01F8nPfOxzVP99hBd7/334Icv/vhkc2/++einr/767Lfv
/vtSki///HTDb//9+AtJ//78Z53//5XpH+UA+K8xEPCACExg6wQ4OQU68IEQjKAEh8RAyTnwBjeY
YEvudoMKHiWBGdSgS+iGQQ8ihYAhFKEK2ac865hwK3wgEwDUs8KqtRBsL+zUDHMouB3ysG8+XE4N
/612wyEaMSNFPKISJ5JE5/zwiVCMohSBtsQqUmSKWMxi5azIxS56sSNadNsXx0jGMpoRgMQ4oxrX
yEaUhPGNLbIEHBXTxjracYhzHNsdz8iFPfrxj4AMpCAH2bU8GhI+dTikIhdJFULikZFRc6QkJ0nJ
Slrykt0BBiY3SRJIepKRxvqkKNfDyQeO8melTKUqV8nKWZ3ylbCUUytnScta2tJNsbzZ/Thgy1z6
8pcLSkavbmk/YBrzmMhMpjItCD9L3HKZKSNmMaF5MmnCj5rVtKb7sMnNbnrzm+C0mDa3GU5xjpN9
5UynOuNzTnSuU2HtXN8750lPIcbznpy0AT73Wf+eqhSjngANqEA1x8+CGlRUAx3YQRfK0Egl9KEQ
XcxMmtFQjkVULDFIVUWPd9GOevQvGwXeR0dK0pKa9KS3OwNKV1qukO6OpTCNqUxnSlO6uPSmOD1S
TaGV09ldaQE79RQngkpUvPX0qEhNqlIRUtRjLfWpUP0OGKJK1apaqKlY1dUdssrVrurKqpebUxCb
cgSvEmqsZlUVWtOKqrWytZFgVdzLePHWuooornjN69Psyte++hVMeg2sYAdL2MJK6q+gMqxiF7sZ
xDr2sZAtG2OtFtnKgnOymM2sZg9o2c5yc7NMa9EDPLsW0LYSE6ZNrWpXy9rWuva1sI1tukhLKNn/
2va2DaGtbnfL297WDbcb861wh0vc33AscbJ1kiCKy9zmUhO4GnOuLKF7on1QF4LSzW4Wr8td22r3
u1FUCB66S97ymldW4D3Tee2V3nmt973wja98K9re+tr3vvhN7HzXld/+km+//J0QP/y7FQDvjMBc
MrCCF8xg/SH4wdNrsIQnTGHbKTMUKKuwsiDM4Q57+MMgdpyGgRXiEg9wxL4yMY5QnGIVu/jFMI4x
XwcBORbXSsYssjGtcGyYjPLYWToOspCHfJsfjyhWhgiykZfM5CY7WS9EXtyTGRblUU2ZylXO1JW3
zOWEZvnLYA6zmKvW5QitdwX0KjPcxszmNrs51DyNePNz1Lw/ItSVIAeQs57obBigQlnPgA60oCPC
58MN+tCITrSiFz3GQiuI0WtytKTNCekpTfrS8Ky0pTGtzEdw+tOgDrWzOhAUTZv6kaL2z6nnlupW
u5owboUZPpv4vFHGumX8pPWqd83rZpmMAtDstbAV+OpkDZtIxU62svl3bGQv+9nQjnZXm01BaVv7
q9QG3bVpmG0geYXU2w63uHumaGV0O4LjTre6183uEp/7R+2O96De7SN5G4fe+D7fW9dg735/M98A
r56/gxPwghtcsAEBACH5BAAnAC0ALAAAAACQAigCBwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEix
osWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuXMGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGj
SJMqXcq0qdOnUKNKnUq1qtWrWCna28q1q9evYMOKHUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27ePPq
3cu3r9+/gAMLHky4sOHDbMshXsy4sdqskCNLnky5MkPHmDNr3sy5s+fPoEOLHk26tOnTqFOrXs26
tevXsGPLnk2bq+XbuHPr3h20tu/fwIMLH46at/HjyI/2Ss68ufPn0KNbViC9uvXr2F8S3869u/fv
4MOL/x9Pvrz58+jTq1/Pvv3a7PDjy59Pv779+/jz69/Pv7///wAGWJQ7AhLk3oEIJqggewU26OCD
uC0o4YQUVlgbhBhmqKFUFnbo4YcghijiiCSWONyGKKao4oostujidSbGKOOMNNZo4404injRKS/2
6OOPQAYpZI8jDGnkkUgmqeSSTDbp5JNQDpTjlFRWaeWVWGap5ZZcdunlgVGGKeaYZJZp5plopqmm
Ql+26eabja0p55y7wWnnnXjmqeeefGJG55+AStbnoIQWutVMWwSq6KIfGeroo5BGKumkMTJq6aVK
UarppjZiWt0LnqbI6aiklmrqqaimWqgeqrbq6quwxv8q66y01mrrraCFquuuO+Hq66+l8SrssDL5
6g2wyH5G7LLMNuvss0klK+201FZrbXfQZqvtRdd2621e24YrbotdjGsuVd+mqy5c57bb7rrwxivv
vPTWa++9+Oar77789uvvvwAHLPDABBcsnrsIi2vwwgw37DCICUec7cMUV2zxxeNJrPHGHHecJsYg
D+rxyCSXbPKPIaes8sosGwZEWifHTGfLNHsp881q1qzzzjz37PPPQAct9NBEw4nz0UgnrfTSTDdN
UtFQRy311FRXbfXVWGet9dZct+f010d2zeUU/YJt9tlop+2T2Gxjq/bborYtt3Bw12333Xjnrffe
fPf/3dHcgP/m9+CEF2744VE5gjibgTfu+OOQRy755JRrXUDlry2u+eacn4v556CHLvrohXZuunGk
p47Y6aznpvrrsMfuW+u012777f8BgHuB/wLgu+wScuz77kA60OzwxCev/PLMNy8l8NBHL/301NPt
/PVEVa+9W9h339v24MPs/fg8hW/++ei/ZdIJNzdC/vvwxy///PTXb//9PuKDP5Dp9+/V/gAMoACF
4r8CGrCAA0zgRg7YPwU6kFsMjKAEJ0jBClpQbg/M4ESw9oALbq8dHgyhCM2iwRKa8IQaGaEKV8jC
Frrwhd5CoQxnSMMa2jAhMMyhDoF2wx6ayQc+PCEQ/4OowSESMUBfogdefLDDD6XJiEdUIBSHtYco
QmeKVuyPqZjYRCdm8YtgvF4XRRfGMppxd2MM3RkDmMY2uvFhawTgG+dIxzoq6Bt2zOMIBaSMOPpx
b8v5oyAHSUj+6PFxhZzfIbmyh0U68pGQjKQk/ZJI+U3ykpjMpCY3yclOevKToAxlnCoJH91NBQ+W
ESV3AGAqUsrHlGRS5SplqSAZ3ImVo3Ll+2gJNV2Sj5d0sYEwh0nMYZbNl94DJtGQmUxlCo2Z3XOm
NKdJzWpa85rYpBA0t8nNbnrTRdkMpzjHSc5yxvCbyjOnOtfJzgui853wdFY750nPetrznvjMpz6/
Ff/PfvrznwANqEAbss+CGtRPAz3dQRcaSQSEJ6GFCwdE0cjQgE30ohjNqEY3asOKevSjIA2pSJXF
0ZKm6QMmTenJRsrSlrqUYSqNqUwb9NJ7zfSmOM2pTnfK0576lJs1tddPh0rUohr1qEhN6tOCSi+l
Om1hTWCqVKdaT6c2japYzapB0SBUq3r1q0jRqrrAStayAsUrExBrtczK1ra6dXnrwYFa1fPWutr1
rnjN6z9gqVeN8bWvEfsrYBEm2MG2q7BnnWuOcFkcw7oIsY4VF2QjSzvFdouymM2sgSxrLc169rOg
Da1oR8sozpp2nnZdBMlOSy3STsyNhWCtbA3j2tr/2va2ZZptsnDLLN2+xRi+Da5wh0tcduqiuMhN
rnL5yVtiLfe5nGyuc6FL3UtK97pFra52I4nd7nr3u+D94nbHS97ympdm4U2vetc7n/OWir2Lcq/A
OiBfiME3UPXl1H3xm9/+vvAjoNivgNfo3wIb+MB3GbCC/4lgSC1Yr9+waoMf9eAKr7cFFs7w4LDG
jehq+MMgDrGIR0ziEpv4xCh2yRJS7JQJu/jFMP4Ki5kU4xqnb8ZLsjGfcKyk2nBCx7LhcZKAHJwM
tEbISKYhkfNUpskmeUVO3u+mfufeMEV5wJRirHyhdOUne/nLYlyymKEH5jInULGQGLOa10xCM7v5
181whqgO4kznOouEzXgenZ333Mw8+xnBOfizoAdN6EL7hhi6BVKX+ewf5CHZ0FhitKQn7eZqUPrS
mM60pjcdH0h7mm2cDrWokfrpKo36PySCR6lXzepWL/TUsPabq28U61rb+ta4zrWukTbrTu3618B+
p1ww0GuvBbvTxU42D48NH2XLiNnNdra0dQbtasds2thumbVhlO1ue/vbMd4WGrZN7nKb+9zoTre6
1z2QetgnaMVwJruTA24vzht19e7QvY+T7377u4v7xndrPPFvqoXj1QHfTUAAACH5BAAsAC0ALAAA
AACQAiUABwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEgR4pOKGDNq3Mixo8ePIEOKHEmypMmTKFOq
XMmypcuXMGPKnEmT4r+bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWJ/W3Mq1
q9evYMOKHUtWZdazaNOqXcu2rdu3cOPKnUsXaNm7ePPq3cu3r9+/gAMLHky4sOHDiBMrXsy4sePH
IetKnky5suXLmDNT1aW5s+fPoEOLHk26tOnTqFOrXs26tevXsEOzi027tu3buHPr3s27t+/fwIML
H068uPHPkBcDSM68ufPn0KMzXC69uvXr2LPjpa69u/fveo+n/wYgvrz58+jTSyWvvr3792vB9+Uu
v779+y3hg2avv7///wC+xl+ABBYYIH4IJqjggs0txeCDNhko4YRZQWghRBRmqOFOFwr2QYcghnjh
ByR+aE+JKKaI4kElEkRiQSYOpKKKLsYokI0tygjjjjXmeCKNNMr4opA+/pgijDOuaOKRPQZpJItD
GmQjj0YmyeSUImb5GDorORjliWAmhKWQZP5IpY4uIvRlmFEOiWOYN565JItQlvlmnAtNqSeceEqJ
ZJlm3ojlmGAOmiad9myo6KJI8YmmmmLy+OGdhz6645179jmppX2yieiZnj5KaKWdFupQpqKC6qiO
hnKKJqOwFv+IEaGjrlpqnJu6iuqlaY45J666Huqrn35SWmupwzZEaa+f3gqsnJBqKe20iSpFq5O2
2pprjK26iie32moK56ArCnokkHQaiy2yaq5JrLO5gkrrqjgGaWKs+P43K5HxNksqq2h26+y4z0oq
Lr3C+hsukwP/e6y7lg6brLfgkjovtRhnfGqxCl3M67fvDlxxv6mCO3HB/y4cMUO7RtqsxP76Wu7K
Cmts882Okqwqp7+izO7Loa5scszhhhw0wXnubDTPVLZcdM4p4yz11IH6rHTVbv4pb7R2cluv1tA+
XaOdBicdtdPIeg2ouwLzuWzUVMctYrkzwk2kw3p+6bGgPRIkDaWPdY9apKF19+1tlYL/rfjfLe5a
75VyR66dg5Lfl+/l8AUEACH5BAAsAC0ALAAAJACQAiUABwj/AP8JHEiwoMF/9hIqXMiwocOHECNK
nEixosWLGDNq3Mix48GPIEOKHEmypMmTKFOqXMmypcuXMGPKfNmxps2bOHPq3Mmzp8+fQIMKHUq0
qNGjOFsiXcq0qdOfM6NKnUq1qtWrWLNqTfm0q9evYMOKHUu2rNmzaNOqXcu2rdu3cOM+VSq3rt27
D7fq3cu3r9+/gGHiHUxYbuDDiBMrLkhmsd6OAhhGXjg5YWUBmDNnVqjZcsPKkjfb04yZsuTRpTmT
Xp36tOrOr2F/bo3aterQlGnTHo1atmnOtiuCjt17de7goj3/Bs67sPPn0MuCjjwd+PDmt61/nm16
eOrqyh2C/w/v+TJu7BBbf/d+Prv6ybupt+c9/rpE+dnJ26/9+71+9PBFJ+CABCJlnnnaBYcec8sx
2KByCJKH3IP4LdjcfhSWl+GBEgZY3XUfLofhQxVa+GCCENrGYXgjFujiizBetCKAFo6n4IL72Ycf
eyQ2yF6E3d0nHn0baqcjkSiKiKOJQgI55JAhboddhU7GaOWVeCk1Y5Q+ksjajRJqCGJ6XQYZJn3G
nYikkx5quF2Abqq4ZItQOviklDP2hyKCjvXp55+ABkrVhcxFyOOZNaq42ZHJ2emjb1OeWeKdZhKq
Z5tvFmoinEuK1yiLiDoKKpKucWpqQoKmquqqrKYaZ4mkTf9IaYeZ1nqolKPGxmmlPdZqKYN57hln
f5DSOZtoLeao6ZGv0mhPq9BGK+20JNlEpbOdijqmgpP+aqOs/6VY6kQ8cpnrrr8SuW2kagqZ66wO
7jhhsFjWa6+98bFJoblh6objrlXGOy6v/NHp379gwncZuqV5x3C7ZBJbJq6WKZwffxcbe+/GHM/F
kp3fflvxdxTntp5vP+4m8Gkpo5zmsfsmbHLML2fLZMTxfqrsca/NyiO1QActtKodF2300UgnjRZd
Sjc94NBQRy31X05XbfXVWBcFQNZcd+311xwDsPVzU5dt9tlop602SmKv7fbbcMct99yBtQ012Hjn
rTfYYu9k7fffgAcOVt+CF2741zAcThThijfu+OOQL8R45JRXbjnfl2eu+eac50T356CHLvroondu
+umoP0366qy37vrrgaYu++y012777bjjDfvuvPfu++/ABy/88MQXb/zxyCevPNoBAQAh+QQALAAt
ACwAAEgAkAIlAAcI/wD/CRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJsqTJ
kyhTqlzJsqXLlzBjyixpr6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1KtarVpjOz
at3KtavXr2DDih1LtqzZs2jTql3Ltq3bt3Djyp1Lt+7Aq3jz6t3L96qDvoADCx5MuLDhpXYTK17M
uLHjxwIPS55MubJkyJgza7XMubPnz6BDix5NOrTF0qhTqxasubXrszX5yeZnbzbt2DZpz765u3bv
2LZ93849PDhw3byJy865/Hhz3sNzJ49efLdt6r97Gxdevfj06dt7Bv+nzr07ctzKyzN/Tv56cunH
4deWjhz56/v4vc5/v/+2d5z+iQcfdvL9xx56Oz2HIIDRLXgeeg02WOCAzFUIIXgTAhXhdwB2uB9/
H/IXYIbQUXghgvXNR1t+LLYIk4TthQjjghb2ZyJ5NgYo4Xs4erghfRyCCOKIPwr5oIo20phgjUgK
2aSHSm7Y44w6+ohklfa5qOWWECXl33LtFVmggmPiOOKJWMbHo5NJKmcdh9b95iCKzc0YZJMPwqig
nuNpt96S8gX65Id2primoSnuuNqijDbaWYxA9ihoiCjK6OeNxMnI4J46hacppLgpamaFdgJpqm+T
dsrkkZQOGmipoYr/WCOYViJ6paO45qqrYd4ZWCmUk/r6aYajzkniq0NqSmirv7Z6JrF3/veTmKxS
+qyxUD4rLbLLxlrtruCGKy5Qp3FnbqVyxklms0fqlh2tZUq6LbbKhtdnuu+6u2e+0NUpa1DjgZdv
nv2mKly/kmIrZ7e3rshlYoo8nNW4FFdcmsQYZ4yRxRx3zJnGIIcs8sgkl2wyXR6nrPLKLLfsMlYn
xyzzzDTXbPPNOM8FTM489+zzz0Bz9PLQRBdt9NG7Bq300kzXjPTTUEct9dR8NW311VhLTPXWXHft
9dc4ZS322GRjBvbZaKetdsdlb7RH23DH7dLadNdt992mya333nz3D+3334CziPfghBdu+FUBAQAh
+QQALAAtACwAAGwAkAIlAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBD
ihyp8Z/JkyhTqlzJsqXLlzBjypxJs6bKZzZz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1K
tarVq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3btzNHwZ1Lt67du3jz6t3Lt6/fv31JCh5MuLDh
w4gTK17MuLHjxwt5Qg7JsmLlyZgzay4IuLNnq5s5Xp44OrTp04g/q15dE7Xr17AlVmA4OzbE2rZz
694teqdAAMABDAw+XPhv4cGNHx9OEDnz57+LS1+eXLnA0hEvV9iOm/tA3Pa4d/8f/3189+8EvYOf
LR69+/bi2W8vL997ePvuBeKvDf7h/vb64ZeeevuhJyCA54V3HWsMNrjSRdZFJyFw0iln4YXPOdec
hdPZQyF1jPWnoH4k5scfeQG+V6KIJxqooosGJShjQSKWaCN/NvqX34g5xkjjiwmaOOJ6vBVp5JEM
8RShhwU55ySTE0Zp3JRQMkcllFQ+uaRx2EHEEos/Eukie0OuaGaNOKaZHo8KovlimWseFCSJ8wF4
H51xCtmjmT+OmeeNbf7o4KCE7rRlk0xqmWGUiUK36JVZNprcc10+9GWAZK4pJp5k4jjkfCnKeSab
ma4I6o2nfnqqgDz2l+l5abr/2meroqpK6p1/0poqiYX2qppFhzaHZXSTHvchhhIKu5yHxA3bqGJE
yrppoHAiqGut5EWba5ClwlkroJoCCp+Pec5JLp5+7ngfqN2yieS78Mb7ULDORqossffS+yy+w+pL
0ox8gutpt68G/Ca13rrLrcAJTQswrLmCmyOY4gIppKy3yqvxxhwX9yGzHAoboXUaJqtvyfsSW+yS
I9n5X50FhgsjwuvVqemB9tlJK50wE7irq6mWemK79M2KqadHr7twzgrr2fHTUEctdUPdTF1YjVbv
mfXWXHft9dcKYT212GCXbfbZaKet9tpst+3223DHLffcdNdt991456333nz3lO3334AHLvjgsPlq
+OGIJ6744ow37vjjkEcu+eSUVz5oYkcQrvnmnK9t+eeghy56Vp2XbvrpnY+u+uqstw4U6rDHLvvs
tNdu++1FSnZYpafx7qXrwAfPGoTEcfgxhcUa62jWAjQvgD3OPy+Q9NBD3zzu2GefmZIGaXh8yVc6
a5DvoVVG/fQDSa9++gsK/1Qe7scPVUAAIfkEACwALQAsAACQAJACJQAHCP8A/wkcSLCgwX8A7Clc
mDChPQAOHzZkqDCiw4gLFR78l7Gjx48gQ4oc6XGjPQEdUSpUyXKhyo0wY8qcSbOmzZs4c+qkmWen
z59AgwodSrSo0aNIhWKs+JDpxIlOO0KlaM8kyatYs47cqDJj15Ngv75MSras2bNo06pdy7at27Ja
P0LEaLHp07lMM07NG7ev378gWQpAKfbkV7CAEytezLix48eQI0ueTLmy5cuRf+ql2rTz1L12QVrF
7JirV8Qrw56u+ra169ewY8ueTZt247p5L3b2THXpUtLAXQrv2hL14eDIkytfzry58+fQMf+cS5ez
U7wMIWbX3nl09KtWBw//Njw+dWrxrGurX8++vfv38JF+n0+/vv37+PPr388/uObk3vUXoF/xFWjg
gQgmqCBa/TXo4IMQRijhhBQK6NNlA1ZI4IIcdujhhyCGmBOGB2m4mIgopqjiiiwalRh1FXEnkUV4
UfebiSP55hF3MOLo449ABikkfnXpxpeOQ5LUo4y57Zbkk1BGKeWQ01FkJG9S7dhRhg+ChuReLYYp
5phklmlTkUxeuR1uC3HZJZK9zaiRmXTWaeedsL2I3V5q8jWlVNVt5uSNfxZq6KGIdpnlbmz66eiT
n1npJ6GJVmrppZjGVaWgdskIo42Outlgj3J6dhF3eKaq6qqsBpWpcpS+/yrrrLTWaiust+aq666V
/oejqMi1KuywxBZLEK/IJqvsssw26+yz0EY74XQ1MsmolZ9+al112M3Ip2glPkbXjadqZ+y56Kar
LkJycVrkonFyiqWTg4JrkLg1OspjRuv26++/CL7Y7mZP6Zvlb4H2WS+9lkXKsMLSRizxxFlRGyjB
oXkbI4/kgopltUtuGe5t4yK88ZwAp6zyyhzGe3DGcEYF78cYW8fvyCTPbDDLPPfsM1mMgSYpVDHP
O+mRkroM3LfXykvxq+I8LbVze3bLGY0ga9cot57mq/RlpHp6stVTl232s76aCGxfsW7189twx53W
j2vH1bZIcuet994cnUjt99+ABy744IQX3mzaFNZNGt+MN+44TGRrrBebJXe9HaBaZ0u24llhjfmp
KD8u+ujGBg3vuDXrLHbTNj+KGakLN2n47LRHGRAAIfkEACwALQAsAAC0AJACJQAHCP8A7QkcSLCg
QYIACiYUuJBhQ3sJHw6UCKDhQosKD0o8yLGjR4QVH4pEyPCjyZMoU6pcybKly5cwY8qcSbOmzZs4
c+q8+a+nz59Ag/6bmJEoxJIlNx41ehHpRqUj7QkdSjOiwahOpU7dyrWr169gw4odS7as2bNo06pd
y7at27dw48pFC/FixaVZ8eolydQhxroRQ/JFOtXm3cF+s85dzLix48eQI0ueTLky5JkU+YbEWtRv
079JNe78eHgvyaajU6tezbq169ewY8ueTftqZ9RITeceiRsjVMSprWYmiru28ePIkytfzry586ul
JwrOjVdp9dNGAQeertf6zc2ek5b/jv68vPnz6AWOSs++vfv3KL3Dn0+/vv37+GPSxV/Y8EvLAAYo
4IAEFmjggQgGld+CDDbo4IMQRijhhBRWaOGFGGao4YYcdujhhyCyNtx1m213F2jaWaQiRYKVmKJq
K4p0GHgh1mjjjTgaNqJvneXVY119UaebfDWBJ59VOSap5JIY0oUkdkiOGJpoQaL2FJWECfXSk0fq
leCXYIYp5phklnngZzMeFeV0NJKHmJXjJUYjdQv159J4bi41nZl89unnn4AGKqaLUOr545M9tnkd
cVgSZOedUpqWkKCUVmrppZhmylV2jEZ5qJC7Ybeomo3WqSVMiH4mmqasturqq7BWsMZpdjGayKVt
dI5q5JxRPbpSm3HuamqsxBZr7LHIKhihrywR6VGy0EYr7bSyMumftdhmq22F1Hbr7bfghivuuOSW
a+656Hq17brstuvuhunGK++89NZr77345qvvvvz26++/AH/17sAEF2zwewEnrPDCDLN18MMQRyzx
aw1XbPHFGFM18cYcd+zxxyCHLPLIBWVs8sko30vyyiy37PLLMMcs88w012zzwynnrPPO4AYEACH5
BAAsAC0ALAAA2ACQAiUABwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK
HKnRnsmTKFOqXMmypcuXMGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1
qtWrWLNq3cq1q9evYMOKnUmyrNmzaNOqXcu2rVuIz97KnUu3rt27ePPq3cu3r9+/IscKHky4sOHD
iBMrXsy4sePHkCNLnky5suXLmDNrTmlxs+fPkwGLHk26LujTqBWXXs26dUOeqmKrMik79snZt+3J
Trlbd2+VtW/jps3bdu3ewXmjHK57ufPnuZ0fjw69OXXrtI8PD84ce/bZ2rt//2eevPj07uB/j7+O
PTl689yVa4dPf/nv6d5T6/fcmbx33NuxR9x/wD1nm4DvXZfggAyCB5147/mXH4HUOahcdflBeOFK
EkrIIYYWtmfghf4tuGGGEz6o4IoT4ubaizC6ppN4KAKI4YA0IthcgCdS2JKNNubmoYbSjVjgjgwi
eSKROt6YZJNHPhlikEVW2WOOHhKXY4NPKmmlgPuFaZlFNEaI4pFbtuglk0mmaZ2FJcr34ZdUjlhn
iCyCGGWXfLJZnZk4FgjolSxl6eWcbwqq6IUxNuroXzMKh+eOfjaoXpdwYnrlpYFSySOYNRpJYqJc
/gncfIQiululbc5XnoaDrv+K6p7h+VbeeprC6p6YvGJGppxFmgimsGuq6WSuQlbYI3vp3fdhgJ+a
6Oe0hQJ7rKGZIvvloSn6qKVLni66rXUU5fLouejeNei33g677JTGgprigb7ZdymW1l67HXm3tnum
noiye62ePMKaL7f4MtttqQYfTG66EEes1k5xRhftnIZSyO+e3pa5obQ/WkzTgiADDCWfbaZcrcIX
K1uqwChju7CIKmvc682bdWarca9KR+93uJ5K78b2gsiplArLa6u7AdOcp6STovdzmvjtDC7BD977
885Rr4z0rDX32zOjEpdtdl44p632Ume37fZba8ctt1Bv12333XjnrffefPdr7dDcgAeOUiKCF66f
34gnrvjijDfu+OOQRy755JRXbvnlmGeu+eacd6654aCHLvropJdu+umoK1ZE6qy37vrrknku++y0
154W7Ljnrvvu9tju++/ABy/88MQXb/xBvCev/PKGH+/889A/HhAAIfkEACwALQAsAAD8AJACJQAH
CP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocSbKkyZMoU6pcybKly5cw
Y8qcSbOmzZs4c+rcybOnz4f2ggodSrSo0aNIkypdyrSp06dQo0qdSrWq1atYs2rdyrWr169gw4rN
+rOs2bNo06pdy7at27dw48qdS7eu3bt48+rdy7ev37+AAwseTLiw4cOIEyu+O7ax48eQI0tuLGOy
5cuYM2vezLmz58+gQ4sePdkQ6dNfY4xezLq169ewO6KeTbu27du4c+vezbu379/Ag3ONJby48ePI
kytfLhUP8+fQo0ufTr26ddyxs2vfzv319e/gw4v/H7+8u/nz6AMPcU2+vfv38OPLn0+/vv37+PPr
38+/P9j0AAYo4IAEFmjggQgG6J9lCTbooF8LRijhhBSKZlGFjj2o4YaLBVXAhwXYA2KIHgoVIohD
oejhiCKmyOKKLn4o4osvrijjjCTieOOMJvaIYo4t2gjkkDqe2GOJOrbI4ZJMChbkkUGSmCOQUSIJ
5ZMuXonlllAaWWVRO0p5ZJhWEkUmlVP6aKY9Tbbppk9VUYmlkUSmiCSadq75pZZyWumlmHqKWeef
XKrZopx07lkmhow2Cp5FUspI5I6LqpjknJYCiqOQJlJ6aaaZ3olnlX9SKuilh6ZqY4lvtuoqXJPa
fullpU+OuiiqhhpVZ6ppmqnirHtKmqefwJaY6JohvqrssmfV6mywgdLK57DGIrUroVvG+uygV2or
q6rDMivuuDlxWmOaljo74ok/sjjpr+6m+6mP7n5rrLBdpvtuqMTemCy5AAeckaMEF2zwwUpdiPBW
AjfssICNPCzxxHwFBAAh+QQALAAtACwAACABkAIlAAcI/wD/CRxIsKDBgwgTKlzIsCHDRg4jSpxI
saLFixgzatzIsaPHjyBDihxJsqTJkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjR
o0iTKl3KtKnTp1CjSp1KtarVq1izat3KtavXrZC+ih1LtqzZhMvOqr1qr63bt3Djyp1Lt67du3jz
6t3Lt6/fv4ADCx5MuLDhw4gTK17MuLHjx5AjS55MubLly5gza97MuTPktaBDix5NuqTn06hTq17N
urXmPa5jy55Nu7bt27hz696durTv38CDB+dNvLjx48iTK48tvLnz59CjS59Ovbr169iza9+uc7n3
3LK+i/8fT768+fO3w6Nfz769+/fw+aqPT7++fcrcy8rKz7+/yvsAFjZfgAQWaOCBCCY2YIIMNlgg
Rg5GKOGEyvlH4YUYZjgbcINJQZiHb4G4l4htkQiZibuhqCFiKvIlRYsrJgZjjHZ5aONdL74ol4kz
zsWjj27ZmKNgJBZpz4xG6tWjXyrmqGNeKDrJIl1PHomki0MqduORPmZJJWc/lvihiDBK2aSYSkqJ
445wLUljiVV+WVeYI7YJpJhkBpYkmnOGWOeUcbkZqJ2LlUmmoHghSiSfhHIpp2ZROtrhknT6+Zei
bFrqIEY3XhnokyCaqWOVoHIZaohx5pnnjqF6qSajnXr/CSucrcYpKZxBZgmqq7IGaWettFqpKZ9C
7kpqqUJaaWSnuJpqKq+NonpqscD66misytLZKp7KduvskMfSeui2bZLr66l4jnrooNc6a22uzY4a
bLaZzqtmrdTiauGtd4J7rqRbopsut8P+C3Cfqr6brbyriisvwbcmuaW7E1fMKrgCW1xuxgcnPHC7
v7r7scUC89sxx5G2G7DCHicL8rNolkyypWeeSSzIe8b8sbSMUtyxwjdDzKzQjnL42LL/thzzw94W
THGvPHscsZ8azyp1zmae6y/R7L67askhE331wT2jC+zYr5o8ts5Uf/tykbpu/TbZZjM9Mb1R16v0
tbbe42ty28FOa7DaXv+MNl8RwAehkoMP7bPPX3dNcMo6r2012ZdzPWvhe2qcM+ZSD3q42CzTPPnP
EEeLOujlCvv41MNGzrXgIt9t892Fn/761LiHTfvMPbOe8OhGnxh33Q8jz/q8mlIeuLVpI5027Mfz
eLy4zy9dKtBwV9v9uPni7e2yqRIqt+e24q1rrsY2ajbmatvNftDKf90+z4SzvzLfWIusP/TIshfQ
Ira9p8nvb28iD6ZcBJgFOm1NlakUbxyYQNtQEECLm9AFHQg11kgwRRX0Tgffsq8QmtA1HlGGf1bo
kYAAACH5BAAsAC0ALAAARAGQAiUABwj/AP8JHEiwoMF/9hIqXMiwocOHECNKnEixosWLGDNq3Mix
o8ePEw+KHElQGcmTKFOqXMmypcuXMGPKnEmzZkqQOHPq3Mmzp8+fQIP6VCa0qNGjSJMq3SgzoRSQ
TxdGvTh1qcKqVjVizcpwq0SvXCnaHEu2rNmzaNOqXct24NO3E6XI9YoVbES7c+FqnSrXod66c502
tPs1cEbCHQH3jcs4KljDV/lCjrx4K+KIbTNr3sy5s+fPMO1Nfoi47mHSOBeLpisatWC/G/me7mn6
9d2Kjl1XVS1b6lXXGkELH068uPHjIuESplvZaeDnkgX/7Up9dd+8zne3Vv77rd7f0rOv/24d3nHt
183R57ae3bz3yO2d+wbPez368t5V39+vHfx28dd1R15lfSFn4IEIJojcR5e5R95/sq2nXXPM5Rah
gNRxd6GFAZY3X4QSzhfegCRCiOF/JFp4om0oTvihhw/upl+I/sWI4n7bhXhZWDz26OOPQF7UFG6+
bYihhB2yBxF3I5ZIX5NMKqbik1BONqFhfz1n44Upatkki/k56KKGtrlImX0PWjcljt9hR56CcMYp
55xjGcWliSNO2SaLGW7pX39rRlndivbtORiVRxZ54nQ3+ikimmvKR2GZL6ZpaI2NFmrjoEF26umn
oIaaGpbpYUejl5vGNyCq+YmoXoff8f/p4KpJKqmqeGDCSmCpr24q44y7pukrlI9aquahH5aKKnuj
ierss9BGK21WO06bmrXYZqvtttwuNaS2zXabU7XiZkXnueimqy5N5bbr7rvwxgvUuvSSJe+9+Oar
b7719suusDyRu5N+PMZqkcDXfgUUwrQhxbBQDwPnUcQd+dtvYo0O5iZFaEpFsMJEumpwV+HGBjDH
nHK87JKNxfUxyHyS/LJWMdO8IqaUsYyswHmNzBHCte3YX6X7Fu1xaTY/VjODnCId8MmM/WzzbQ0u
LfFtA1tNlaspI9o11ChrjRHQ1QndG9dGTysTk1dnKaZkgMLHrJ4y42psqzi7TenGpmL/uarcOkK2
sbBhnvm3znIjGux4h1qJrIlZqhrg2bgOfnd8lhdKoHzjzWp5mX57Th909WkK7LGcJ8q4ru5FZfHr
Lomt5nuOGlv3fTqmvrfMWloGoOmL1k47pDfuSbmSxgvYMdqWfky5774POnzueX4p/NG9B5/z7ooW
n+qf3QFP7J3JE80o7t2X3xrs7Kt0sPRUnlclrHmeZ7CZ8l+q/v4xkoq398dTXvAK17YZNU9z0ZMf
9/qXJEbdT3tgAmCN9MfAFEEQfMQa3wA3aD7UgQ5AGhRM+9JVFPuBL3r8qVTkipW/710vhBLMIPos
KMM+kS9jKHRSiQIVs+OZ8GxDcyDh/y44JiKyaYc09B78ZMi/G97piKxJFA8DmLZ95W9xcCsWs9DX
Mb+JLEeWWZbgWIU5L1augUocnJsMZarKaWxxlJrbrIrkPP9daoszPJkZh9YiMmJQcG4UXQ9PeDTD
Has3Y0yP9hw3Oj0pkmJV9Mm3IqkvSCqNkmCDCr4g2aMRoguToCxMxEoWSk4uaWbdImUoV2kRT7ry
lbCMpSxnScta2vKWuMylLnfJy1768pfADKYwh0nMYhrzmMikEyuXycxmOvOZ0IymNKdJzWpa85rY
zKY2t8nNbnrzm+AMpzjHSc5ymvOc6EynOteZzWS6853wjKc8C8LOetrznvjMpz73yQRPagYEACH5
BAAsAC0ALAAAaAGQAiUABwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK
HEmypMmTKFOqXMmypcuXMGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjRP8pXcq0qdOnUKNKnUq1
qtWrWLNq3cq1q9evYMOKHUu2rNmzaNOqXSsWqdu3cOPKnUu3rt27ePPq3csXJdu/gAMLHky4sOHD
iBMrXsx4at/HkCNLnky5suXLmDNrhty4s+fPoEOLHk26tOnTqFOrTstotevXsGO/3ky7dkEBtnPr
7ujVqOzfwIMLH04c8e7jyJMrX16R30DnAp1Dj/6c3/Tq0K1bN6hduvbn4L9//2dOvrz53V6nq7d3
PTv4gu4RXmf/Pj59gs6L69/Pv7///1vRJ9197d33Xn3ycYefgAsuCOCDEEYo4YSmMTgge91deCB1
0W3XoHgLerghdBSWaOKJKKa41EUDXljgfDAqOKKBFjZI43k45qjjY721SOCHG3Joo5AaxreeQSom
qeSSTFJI5IwdzoehdyLiJ954BlIpZJNcdunll4btKOaYZJZp5plopqnmmmy26eabMPUG55x05gam
VCNJUZCeEfFJkZ93AYqSoBARepChHekpqBSIYsRoQ40+FqlGitYpkpyMPmrQohIhmulCkxI6qUCj
XlSpPaESVOqfe6JaKKmQOv/EqayuDrTqRLfe+lCqm1LaqkJ86qrop7b6+Wilp9Jqa60JAVrqnVGZ
CuqvryI0Kq84BTvtsibpCiuzwCqLK7jeVhtrotuCNGuz30KarKrGGguuuPNaq6qaXhlKbLCf9hsv
rKeKSiqxqPa7rL+uBsyvswUvqum+xy5cMMDDDlysphY3vOe+tXIM8MDHNhwvxhNn+i+8GD8c8b0m
b6qtsxG/rLHKDkvcLrIiFwuyqAvzmzGyPicMccU/QwwvyBvnnDHL9SbsNM42t3zvwUpP/e3QfEJr
lsTyJhtwu0J/3CuzXpNt9sROp800tWZrm7bMbssMttvkHky33GXnze3VVNf/LXbZazeNM7ddxy22
1e+2fXfgDKv9ddjzDv72323/Ki/hfTc+LKdQP1353CZLvrnIIR+up9ZlMdz153GXrvHYq5vOt+IP
W8527Hh/3Lrrmu/9+dlfrx6734WTXLzhjG8secd9M+/83okPf7nBoPPeMfVkh4w7xdbPevnsQhsv
NfG6ey6776Lf/vvpqDclrex6My/385jDD/3zifutP+uUm0/32eBrnOMwN7/0fQ9/gmueAgdIQPKd
b3H3WxfgJndAAT7uZnyL3/x+F8CpDe9QVnNe5+K3v/SFkITl0gymhnY16u0OgDADnNRaxrHpxYxl
JHudx3I3uev1zHI5nCHKZBC3MwaO74HiS9kN63bAmenPYyJ83cXAVsSRjQyASJteFj2ovcy1UIZA
FJgN9SVFKo4QaVhUXdXQh0aptW8slnJUSlIYxx3RkYpvZEodWXLHPuVwj27qYx9V2BVAGvKQlelS
QAAAIfkEACwALQAsAACMAZACJQAHCP8A/wkcSLCgwX/2EipcyLChw4cQI0qcSLGixYsYM2rcyLGj
x48gQ4ocSbKkyZMJD6pcybKly5cwYxZESbOmzZs4c+rcybOnz59Agwp9KNPgUJRSjjZMqnQj06Yf
n0KdurSjVI1XnVqUmpVj0a9gw4odu1JpV4VcJTI9m1AKW7UY3cq195Zn2ohr8daFuBcpVYZ1u/al
eDVvRsMcB8OtmBTxR7IDTUCeTFng35Fu0S5+mznnU8U3O9PdrPcyX9NtF58snPpw68QgFTd+jbo2
xLF0O8/NrTvzZ9650eZtLHq0XNaGd8/2vXthcubCU88GHvx02+bFr79eO1z79d6AR4v/V26cePbx
36tXX55+ffP0x6Pz/jz3fX363dUL536+N/j15XlnHn/q+cedcwPKFx+C8ymoGYL+LWUgYNjRJ12C
FB5onHeVdehhWFY5p9lvv0nX2nTE0WYibd2RmNyDD764YYAzhvdQiTMKtuJwyI3IookungijkOjl
CKCOOIqnJIpLNpnVi0EWuV2TMToppG7hTWekkSTamKSWd3WJHmsrKmnljzuKyCSaWcpoG09j3VWj
m2smKGeZcvrmI5FmNliknXvuZ52T71GHYn0QElqchWJKWRh5YyJaJnxDOtpgo479eaafU34paY6f
4jenpvE1yieBX3ZKHpmjwgimiBdG/7immY+COdeHuObaUoiuUjkqlLAO+aqwmyJ2Z520BqqpjZvC
ml+eePb5I6ZTEgtsr2H6GqiWxRI75rYOUevtltW2uGd+nXp5rrbG9sltt9iOy6257Dqr7ZtwimUo
lrF+hyxwooLrLaTRWktkqO0R3OuJ2WGXKFcTUoemwsNOe7CeDKMqLHOiIXzpohc7VijBtVKpcYx6
ivncsD1mfC/LHYerXH/8JusywAULirOguvbsM2T4Bk0VaEJXVfTRniGN0c9M46r0028WCvVERE9t
NV5XZ6311lx37fXXYIct9thkl2322WinPRVbnOFUNdRvXx33jXMf1VfdUVWq9t5L6//L2KD2BksS
q3ljbXThVZbUtrSGy6bajVtFDptfVF+UKWzvEtX05px37nNogCduE96Ghz64uoo3bnnqpVcOOuWP
uy5SknzXHhp/+JVMYHALYsjpwxaSWmHDuAvYooYY3qfgzAwuqB/AASvPIO/sFQgdzG12jLDy1dPK
8aTJowzf7ssR7+9+j6Jv8vHlId8+hUBuR7rtXeMWbargtvsq7Qer2S3++7tSprqHLHS9S38Tu5/e
0vS8eV2JT7/Kn/gmZamGmYxUoksR4xSoooIV8FqR6qCPCEgbz5nwhCgEkVUw1iqLMXBD4kIdqmIW
w0udy2M4U1msAhi49mWrVZeTlMj/WIjB3/EQiBA8YLqyVKXiLatG0tpepTx2KBbKqFSCo5R51Ee/
LhbuiMc6U5fE9UMmgbBiNiPXBWG4LiiaqoLheuASm3gq8MkRSRJcYlrI9EYkBhGOgjNgvfzIJgRO
0V7VG6AXF4kVK57vYe2JYIl6F7iTsTFjukvcp8aTsjZaUpGTBNmfIuQufs2LlGi0z/omtCpmuapm
AvPeFjlpLOLBzJaPlGWyZhkqXJLQUIwMJtIyxzphfm1+xkymMiFiDIXYbyhSU9x5lmk1ZFIzJCnM
pja3yc1uevOb4AynOMdJznKa85zoTKc618nOdrrznfAU5zXnSc96QgUe9gxKPPfJW89++vOfAA2o
QAdK0IIa9KAITag888nQhjr0oRCNqEQnStGKWvSiGM2oRj2i0I569KMgDalIR7oSSZD0pChNqUpF
utGWuvSlG12pTGdK05ratHMwzalOd5rPgAAAIfkEACwALQAsAACwAZACJQAHCP8A7QkcSLCgwYMI
EypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocSbKkyZMVnaFcybKly5cwY8qcSfPhv5s4c+rc
ybOnz59AgwodSrSo0aNIkypdyrSp06dQo0qdSrWq1atYn9bcyrWr169gw4odSxZl1rNo06pdy7at
27dw48qdSxdo2bt48+rdy7ev37J1AwseTLiw4cOIEytW+7ex48eQI0ueTLmy5cuYM2vezLmz58+g
Q4seTbq06dOoU6tezbq169ejl8KeTbu2xMW4Ddvezbu3b9Cyfwu3mG+45NzIk/sUmK95cefN7UEv
XtD5QOrMCU6Xrl06dO3Yo2P/5z5+u/Xv3p93vx6deXvu18G/dx9+PXj24+nDz45+P/zv5r1Xn0L9
6ZddfM8VWB6ACgLYnXXp5ZceftQ1GJ6ADiL4oHgZ+tegfBVCeOB+IpYH4ojqKadiXBflJ6F/8R0o
oEED8ocQhh7CmCOJMtqHYowzxshjj0KyBySN7mlIpI1ILqneQjUOOGONRb744pBEXjlkfVIeuWOO
QZqopJAXFqnjmF1WeWSFxm0moZVNashmdWpeqd6dD8b5n5dieinniGDS2WeWgPbIpomIHpQmeQwl
muecZn7po31iQkpnnkwyimmfic456JNkEjrppoL62KWlbVoWYoLzvVmqppQG/zgfo3iOqWaEfsKI
6pOgBoppoZ7OSmivxBqI4qxvtvork73quKCyilLY3oUuvgprs6xe6iuvk7oq6oTGUmqthyJimapY
SzmqrZmgCktls3z6auqPe7ILLImf6ioprrCuV6a6+v5YbaPLXjvwvHqKmyug1aLncKkHqztttzSW
WO692jaMMJbFrehxWy3aGumWo757Zr3FeuvkkgGTfCvHDM+Lar2ZWhpxrloq7DLGG49KL8s87xqn
pzr3a/O6PLdc6JdHh7r0uegqRR+rQVZscsYbljuwwyXix+95YHNI7cv8ej01rhLLB6bWECro9MnV
Xdy1vXGLXTXWCNqt6N1nzopt7sN5U+nsulSfnTDbyGod38eMpwX145BHLvlHwU1u+eV3Na45Vph3
7vnnkW8u+uikl2766ainrvrqrLfu+uuwxy777LTXbnvroOeu++689+777yPVA3xGtxdv/PHIJ4/Y
8Mw37/xjykcv/fTUV8/U89hnr/323HfvfWrWhy/++OQj//356KevUUAAIfkEACwALQAsAADUAZAC
JQAHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocqfGfyZMoU6pcybKl
y5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypdyrSp06dQo0qdSrWq1atYs2rdyrWr169g
w4qdSbKs2bNo06pdy7at27dw48pdOLau3bt48+rdyzfr3L+AAwseTLiw4cOI0fZdzLix48eQI2NN
TLmy5cuYM2venFiy58+gQ4se3Ziz6dOoU6tezfow6dewY+/dI7u27du4c+vezfspuN7AgwsfTry4
8ePIk1+dZru18+fQo0ufTr269evYs2vfblG59+/gw8uD5k6+vPnz6FeLX8++vfu76ePLn0+/ftr3
+PPr39/Uvv//AAYo4IAEFmjggQgmqOCCDDbo4IMQRighYvxVaOGFGGao4YYcdrjShCCGKOKIBnlo
4okoFkfiiiy26OKLMMYoY2sp1mjjjTjmqOOOPPbo449ABinkTR8MaeRrMyap5JLQBQQAIfkEANPy
LQAsAAD4AZACJQAHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocqfGf
yZMoU6pcybKly5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aM+SSpdyrSp06dQo0qdSrWq1asL
kWrdyrWr169gw4odS7as2bNo06pdy7at27dw48qdS7eu3bt48+rdy7ev37+AAwseTLiw4cOIEyte
zPgw1seQI0ueTLmyZaYOLmtuzLmz58+gQ4seTbq06dOdNatezbq169ewY8u2h7q27du4c+vezbu3
799GZwsfTry48ePIkytfzry58+fQo0ufTr269evMgWvfzr279+/gw4uRHy8Tu/nz6NOrX8++vXvN
097Ln0y+vv37+PPr38+//8/5AAYo4IAEFuTfW7scqOCCbBXo4IMQRijhhBRWaOGFGTGo4YYcdujh
hyCGKOKIJJY4GoYopqjiiiy2KNwgLiLXTjsxQmQib7/cyNmMPJJY449AqscjjUEWaeSR6w1JJJIR
6ejkk0D1COWUVFZpJVABAQAh+QQAJwAtACwAAAAAkAIoAgcI/wDtCRxIsKDBgwgTKlzIsKHDhxAj
SpxIsaLFixgzatzIsaPHjyBDihyp8Z/JkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDCh1K
tKjRo0iTKl3KtKnTp1CjSp1KtarVpCSzat3KtavXr2DDih1LtqzZs2jTql3Ltq3bt3Djyp1Lt67d
u3jz6t3Lt6/fv4ADCx5MuLDhw4gTK15s+Krjx5AjS55MubLly5gza97MubPnz6BDD2VMurTp06hT
TxTNurXr17Bjy3asurbt22o74Q4LAEDe2cCDCx9OvPi/3gBC717OvLnzvMifS59Ovbp1g70DG9/O
vbv370mRy/++Tr68+fPYs6Nfz769+7i+EYOfT7++/fv48+vfz7+///8ABijggAQK9d6BCCaoYFcF
NujggxBGKOGEFFZo4YUYZqjhhpIt6OGHIIYIEYcklmjiiSqJqOKKLC6I4oswxihhizTWaKN1Muao
44489ujjj0A+deOQRBZp5JFIJqnkkkw26eSTUEYp5ZRUVmnllVhmqeWWXHbp5ZdghinmmGSWaaZq
QaapGRNMqOnmm3BCxmacaZ5ppz1M3IkgnXxGNadOGvR5IUbq6XlknoYeGV2iRrLJ6J41iSfopDD9
SWmdDi36aKOb1qhpp6CGalp8opZq6l+XpqrqqjKd6uqrhLH/KuusssJq66170arrrn3i6uuvcvEq
7LBBAmvssWkRq+yyMiLr7LPQunpAtKkxa+21HFKr7bYdYevttxNyK+64FIFr7rkDkqvuuuy26+67
plYD77x/YUDvmOjmq69+9/br778AM8pqIPsWHGHACCes8MJUGuzww8UxLHGoEFds8cUYZwzkxBw/
ClQLGocs8sgkl2zyySinrPLKdHbs8ssi9QLzzDTXbPPNOG/J8s4875Tzz0BvG0vQRBeNbBhm9az0
0q0a7fTTUEct9dRfMm311SlRrfXWXGNpSNdg94v12FaHvd4LZg9E9tpst+3223DHLffcdOeY9t3r
MT3NZjzU/80j3oAHLvjghBee9IZt+m0ZK4o37vi5hkcu+eSwPm45uJRnrvnmd17u+bWchy766Fl+
brqypKeu+uqstz7u6bDHLvvstNcuu+u45657l4Ds7rtCthvXT/DEF2/88cgL+PtzP+Sc/PPQRy99
TctXb/311U6vfYnYd8/g9uBr6P34WYVv/qDkp6/++uy3r9j58Ifr/vzlxm+/g/Tnr//+/Pe/1f0A
JJD/BliQABrwgAhkGQEXaI8EOvCBELQYAydIwQpa8IKHkQAG1xXBDnrwg9jaoAhH6DsQmvCEKFwV
Cd2Xwha6ZoUwjKEMZxg1F9pQOTTMoQ4lcguj3VBlkvqhEP8hg5wgDvGIUilib96EjJbs8EafeqIU
p0hFviDxipOp4vKwyMUuevGLYAyjGAumxd+N8YxoTCNoysjGNtZMjXAMihsPkgbSxfGOeMyjHvfI
xz768Y/EmaMgB0nIQhrykIi8Ux2BBchGOvKRkIzkSRJJyQTloZKHkaQmN5m8c1AGk5xLIyU46URQ
FmQZhiMl/IpIFVMCrIiuxKAqZ0lLLMbylrikWC3vmMte+rJzuwymME/4y2Ia85jIdMsw1ZjMZjrz
mdAMyTKnSU0ERvOa2HRLMLLpriFw85vgDKc4r1PNcprznOhMpzrXyc52ulMz44ynPMnzziPO04f1
FOI9i5b/T33u85+D7AFAB0rQhPXzoAhNqEIXytDXFPShEG1MQ00YUSUJoqIYzWiXJsrRjnr0oyAN
qUhHStKSmvQ+B+GESjmh0ZetdKUtnVdNXqrSkxLvIiqN6etsytOe+vSnQOWlTicW1PMN9ahIXaEj
DFlU8yV1YU2NqlSnStWqWvWqWG3qUxWW1a56tUBbDatYx0rWsppVcwB0x1fX6rezuvWtDWHrTeH6
Lrna9a7zoate98rXduGVdn0NrGBnOC3d/fWwiPWMEBKbvMHuFF18YKxk7enYylr2sp2arGY3y1ku
YpZanQ2taEcLQlBq47Oo/R5p6Zba1hZ0tXVzLbJgy1rZ/xqLtkcJhQRty0jcxo23vfXt24BL3OIa
l0XCTa5PtaBcF4IIHMetS3OnS5UlUtdq1r3u0rKL1ZpZID3RNVWhwguq8ZJ3U+Y9r3pBpN2xrbdU
7cXae0UV36vNV5f1RWMi8stfTt4XVP0NMG7/S+BKCvjApC2wxxDMYM4qWGANjrBkH5woCaOMwhie
o4U3zOEOUyrDwPSwiLMK4hJXccQoTrGKVwxJE5uJxTAGqovLFOMa2/jG/5mxjmmIYzLu+Mcr7PG+
gExkEQr5yEhOspK3V2QvLfnJUI6ylKc82SZbmYJUzvIu36BlzF1ZS+V8Rhi/TOYym/nMTOqymtfM
Zg77of7NVkWznNkHZ13N+c7kq/Nr/JHAbOj5zzrCs6CxB2hWDfpJhU60Hw/tJEU7+tGQjvSLGE1p
w0qaT5XOtKY3zelOs+vSmPa0qEdN6lJ/BdSoTrWqV83q2Zn61bCOtaxnTeta2/rWuB5Sq5NHi10f
JdfADlpTccCUNLQt2Any9caQfSBlO/vZ0I42ZJhNbZpJO9DVbs+1t81txGZb293WDyaIUpgMfJsk
D3pBuG1y7rxNRbfrjvfS2k1vg8r73pGRBb43We9+/2vfAA+4wFXtb3oOHH0FT7jCF87whjv84cc6
OMIhTvGI/5C5EneTAjLO8Y57PE4VX85KYiFSDtgvIAAh+QQAJwAtACwAAAAAkAIoAgcI/wDtCRxI
sKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJsqTJkyhTqlzJsqXLlzBjyiz5r6bN
mzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1KtarVpjOzat3KtavXr2DDikV5tazZs2jT
ql3Ltq3bt3Djyp1Lt67du3jz6t3Lt+/csYADCx5MuLDhw4gTK17MuLHjx5AjS55MubLly5cFYN7M
ubPnz6C9+h1NurTp06hTq17NurXr17Bjy55Nu7bt27hz697Nu7fv38CDC5cburjx48iTOx7OvLnz
59BXK59Ovbr16ymja5/NYrv37+DDi/8fT768aezo06tfz769+/fw43s2Tx8E/fv4ecvfz7+/f7H5
BSjggASe99+BCCao4IIMNujggxBGKOGEFIJU4IUYZqjhhhx26OGHeVUo4ogklmjiiSimuBKILLbo
4oYqxijjjIO9aOONOJJH44489qgcAAD4KOSQI9IFZI5IJqmkcEcu6eSTUCLVVZBEVmklgnk1GeWW
XHbJl5ZehinmmGsBQOaZaKap5ppsOnnlm3DGKeecdNZp55145qnnnnzyZ9Y+bQYq6KCEFmqogH0m
qiiDhzbq6KOQRirppJRWaumlmGaq6aacdprboqCG6qenpJZq6qlvIYIqjKK26qp6q8b/KuustNZq
66245qrrrrz26uuvwAYrrHOvFmvsdMMmq+yyzDbr7LPQLnXstNRWa+21fUar7bbcSmpHt+CGK+64
5JZr7rliYqvuuouh666n7MYrr2DaqvLuvfjmq+++/LI2L7so/CvwwAQXbPDBO/ar8MIMN7wbwhBH
bKHDFFds8cV9Sazxxhdh7PHHIIdcFsckX9ZHySinTKPILOeo8svrUQDzzDTXbPPNOOesc1gt9/zi
zgMpgJIbQPPo89FIJy1y0Uwzlop8Skct9dT8Nm01tVRnvZQBvl3tdbFah13e12SLKvbZ4ZWttqJo
t+3223Avy8mtD7C59sFtQBw3oW38/3q3wXkjvPegffv6d8GBHzy4oIUv7jhujT8u+eSHV17nrztM
rqblnMep+eegh95l56SXbvrpqKeuseist+7667DHLvvstNdu++2456777iCq7nuKvAdvFY/a/G78
8civ50jyzMco/PNSNS/99CkSQ/31/RFjPfbYta099KNxb5D24pfPHvnmpwf++kylPyI/7scvf7vs
128/bzhIPf/+yN7vf1D8C+Bx/kfAAhqwKAJMoAIj1I8FOvCBETqgBG0CwQpa8IIYzKAGN8jBgkxw
gh0MoQhH+J8PmvCE/yOhCrmCwha68HkrjKEMZ4icF/qPhjhckQ13yENBrSMu7eihEP/9ksMinmSI
SEyiEpfIxCY68YmSMqIUp0jFGkHxiljMohYNV8UuamSLYAyjwrxIxjKa8YxoFI0Y18hGdKXxjXCM
oxznSMc62vGOr8oEHvfIxxO1sXV9DKQgZfhH1g3ykIjkYCEXyUhoJbKLjfzcIydJyUpasnOR1Nwl
i5hJym0Sh52U3CdHSUrmecpMoWxOKVfJyla68pWwLFIqFxfLWtqSabOk5S13yUua5XJwvcTgL4dJ
THgF85jITKYyl8lMshTTbc2MpjSr9cxqWjOK08zmQzigzW56E0DXFNs3x0nOcppTK+EU5znXyc6V
Qck+6cxQO68XT62pDg/zVEg998n/zzHl858ApVA/B0rQJwX0oAhNqEIXytCGOpSVBU3aQ1EXUaRN
9HQCUkNFN8pRn8SnGxeVUEdbFtLSjfSkKE3pL0tKOncFQaVGYalMZ0rTmtrUQVXwCEw9dtO77fSn
QIVOT9cW1IoN9ahIBWdRl8pU3ST1aznxRlPz9VSvTfWqWIVNVa+W1apttWldDatYSfNVsI71rGhN
q1rXKtSyFo2t5nLrW+FKLrkCja51tate9wqqP/D1r4ANrGAHS9jCQhKviE2sUwzL2MEq9rGQjWlj
SxbZbU32snutrLYwyzHNRouzG7MRLzx7G9CujrSo9axpV8va1rq2nKmNrWxn26vX/9pWprTNrW53
a6rbEoy3wPLtwIBL3K4K97gNJdMpistcs2yjudDtEpiieyogWZe6CNSTdYGEXGtZt7vg9SV2bRVe
do33vOhNr4vKy17FLKC98GWJemUV308eo74fma9+L4WJ/fr3vxjCr4AHTODQ7OoaAE7wowrM4GQq
2JgNjrCEJ0xhzj34whjOsIY3rNs6daLCID4Why8V4hKb+MQoTrE5RxzUIyBWxTA+JIuPhsoZ94Yy
3GUmK+JVGjIMpcY2btR0XZcNezomxyrMxiepJEMli+81Q55dkZUI5NtNeYhRDvKDkaHlLnv5y2Du
cowlcooxezHMaN6hmT95gjW7Gf54aY4zCt/sOTnbGYR0zrOe98xnP965TX0m0p8HTcBAG1qKhF7T
oRcNykQ7en2MNtqjJy28SCeM0pjWnaU3zelOe/rToG5mpkd9u1CPBAzoIbWqWawNFpv61bD+6qq5
FGtZzvrWuM61rv1V6167b9dL8rVAgU3sYqtV2EzDArKXfaejNSOizI62tAFq7Gq3bdrY/t1wdmHt
tGR7Qd220bcVFO6fjRtL5U63utfN7nYPmhGhw+Aczk3vaM/DMu4O6navG0oH7vu7t8w3h9bZgHrP
U+CsMrjCFw5LhDucYgyP+IN2UZ2HB1ji8LH4hTCecY0TCD3O4LhBPP5xkbcnIAA7

------=_NextPart_000_0009_01C6F618.AB4F5970--

Received: from [222.36.115.99] ([222.36.114.138]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9M7OUuR004257 for ; Sun, 22 Oct 2006 00:24:36 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000b01c6f5ab$1ce01ca0$637324de@MS100849>
From: "Nines Ambience"
To: [email-masked]
Subject: RIP Maggie
Date: Sun, 22 Oct 2006 15:24:28 +0800
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0007_01C6F5EE.2AEF8680"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0007_01C6F5EE.2AEF8680
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0008_01C6F5EE.2AEF8680"

------=_NextPart_001_0008_01C6F5EE.2AEF8680
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Wide Factor in Soaps Lord mic Handle Heat Arena Audio Updates Exclusive =
Sona Dizzee Rascal Wish Discounts Desk Players Mixtape Downloads dnb =
Address am Book Stations a Magazines is Clubs Room is Double.
Chantelle am Fiddys in Blog Logan am Samas Programmes Bollywood Wide =
Factor or Soaps of Lord mic.
Printable Linear Mode Switch Hybrid Threaded Posting Rules may replies =
vb code or Smilies img Html off Pingbacks Jump err Street Corner of what =
Bizarre you Affairs!
Eastenders Brother Sahara Knite or Tamiflu of Mohammed Rashid Maktoum =
Myspace bot uk Garage or Scene Drum Bass House a Dancehall Ragga =
Bashment mc Battles Pirate Radio Production Software or.

Sorry point question other of applauded Bushs of nonanswer glad is =
chapter Iraqs in history said or Later or compounded asking Osama in bin =
of Laden am alive of another! With in secs vw Bollocks small childs view =
why ads or never shown Onyxia a Wipe wow gone wrong.
Purported owner material does accept liability in Limited rights =
reserved Sitemap Diffusion Media Ninjas Evolutions Virals Extreme Humor.
Messages a Message Track of vip a Membership Info buy of sign access =
anywhere Existing or Users.
Goodie bag Freak Voomed Sleazy Celebs is Daily of Slacker Dump Head =
Amuzens Antics Break Taker.
Will commit gaffe saying yes wrong luck purpose or immature hopes also =
reflects in.
------=_NextPart_001_0008_01C6F5EE.2AEF8680
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Wide Factor in Soaps Lord mic Handle =
Heat Arena=20
Audio Updates Exclusive Sona Dizzee Rascal Wish Discounts Desk Players =
Mixtape=20
Downloads dnb Address am Book Stations a Magazines is Clubs Room is=20
Double.
Chantelle am Fiddys in Blog Logan am Samas Programmes =
Bollywood Wide=20
Factor or Soaps of Lord mic.
Printable Linear Mode Switch Hybrid =
Threaded=20
Posting Rules may replies vb code or Smilies img Html off Pingbacks Jump =
err=20
Street Corner of what Bizarre you Affairs!
Eastenders Brother Sahara =
Knite or=20
Tamiflu of Mohammed Rashid Maktoum Myspace bot uk Garage or Scene Drum =
Bass=20
House a Dancehall Ragga Bashment mc Battles Pirate Radio Production =
Software=20
or.

Sorry point question other of applauded =
Bushs of=20
nonanswer glad is chapter Iraqs in history said or Later or compounded =
asking=20
Osama in bin of Laden am alive of another! With in secs vw Bollocks =
small childs=20
view why ads or never shown Onyxia a Wipe wow gone wrong.
Purported =
owner=20
material does accept liability in Limited rights reserved Sitemap =
Diffusion=20
Media Ninjas Evolutions Virals Extreme Humor.
Messages a Message =
Track of vip=20
a Membership Info buy of sign access anywhere Existing or =
Users.
Goodie bag=20
Freak Voomed Sleazy Celebs is Daily of Slacker Dump Head Amuzens Antics =
Break=20
Taker.
Will commit gaffe saying yes wrong luck purpose or immature =
hopes also=20
reflects in.

------=_NextPart_001_0008_01C6F5EE.2AEF8680--

------=_NextPart_000_0007_01C6F5EE.2AEF8680
Content-Type: image/gif;
name="rationale.gif"
Content-Transfer-Encoding: base64
Content-ID: <000601c6f5ab$1ccc4680$637324de@MS100849>

R0lGODlhfAIMAof/AAAACoAKAAGCAH6KBA0HgXoAdACLcr/Hw8zawbO/9EMZAFcpDYclBKckAMYk
AN8tBwJHAxc1CDZHBWFHAHM2AKE4ALE3CNI3AABWACNsAEBsAmhpAIFmAJxWA7xoCuJtBQl1AiSH
AEZ2CGmBAI6ECp+OCrV0C9uFBAuuACuYCD6rAGmWBoKYAJyWALGcAOGcAwXIABXHBzPIAGi3AIS9
AKe7Dbe1AOfDAAXiACvhAT/rAGjRAorUAKvnAMreC+HtAAAERikAPjEIQFUARXYLOpoBPbMGSuUA
MwYeSBcaTEwUM1sZTHwqPKQgQcQfPdkTOw5BOS49SDQ7QGhCTopIR5NCSrdESuQ2TgBTRiBVMUdu
PlxuMXlpDaZePs5WS9JYRAB5PySKPjlxRmqFSIdzOKJ4PbaHNtl9NAOnSiyaNU2kNVKiQXuUTayh
SsWSNeuaMQDAQRfKRzO9S2mzToK0PJ7LTci5PN7JSA3rMSboQUbhQmvaRo7qPqDqQszrQ+DrSQkA
jBEMfU0Fg18AioMEja0Ajr4FfdoAdQwpgSssgUgtf2gfc44Rh6UUdsUadd8hfAtGgCpMjUE1dlU9
in0xdqFDjMJOhNoyhwVWeSNZiElihFZkc3lkfZZjcbJeg9VVhgCAcR6NgDOJfGOLjoKNcaJ7jMd+
e9p4iwqldS6hjkSUim6Wf46qfaeSfb+bcuyZjgDGehnMcUPMelfBf4XMgKXIc7a1ieOyfQDadxvW
d0Xof2fdcYnrfanZgbflddLecQ4KwykBuDwCuGwAuXMAs58AwMoAzdIOtAUduREdsTIuwGUssnsX
tpEXxL0XuewazgxHzhs3yjM5uV1NxIIzyq5Iuc5DudNDvQBlyytquDNkuWRtzH5jyKdhzcVcuNFY
zACHvx6Cvzd+vFWAx32JzpqFxLp+wueCywiYzSmfuEGTuVykxXuUzqWizbWsstKeuQvBwB3Cxzyx
slu/tI3Ey5bCzvv/+aiWqoqHiPgADQz4Df3+AgAA/v0A9QD5///5/iH5BAD//2kALAAAAAB8AgwC
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHGnwn8mTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOK
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27ePPq3cu3r9+/gAPXJUm4sOHDiBMrXsy4sePHkBELnkz5
JICk4TJX3sy5s2fPl4dm1vy5tOnIqFOrXt0RAMfR4VjLnk27dkfTuOuGzgk7t+/fwIPz7S28+Gbb
yJMrVx57ufPn0JUbn069uvXr2LNr315ZIvfvKqOL/x9PvnxI8OhNml/Pvr17hOmjfqD7vr79+45z
ftg//x///wD+txJ/KO2XUn8nBRhggQia1CCBCR4oIYMQ+rfgggkamGGFFgJ4oIIC9uchhRh2OKCG
KjU4YYcgjqhifHBtAuNUKPpnY0svZqijhStGWCBLNd6IooYP3uhgjyIOeOKORR75kopQGulkih/u
yKODL+ZoY5Y/Kjnjl7h5l6OWU1LZ5XxNdukjlU1GOSWaa8aZpJk9CqkmmXFKuaVMbq7ZZ54Rcgmo
k/gVauihH9mkJZ6LKgknoH/+WOSYbxopqJOU1nlkmniWqaenOKopqZeD7okkkGCmmt2iJX4KqqkI
Xv/6qp2behmrpSkKiKWHFzp6Z6uestppmqPSOeujoio4q6rM+iVRrAQyiiqbPsrqKq6mTjgnrcm+
au2mui6b57BkEhsoqd6OK2qXiLbr7rshcSktuudiauy1t2Z7J66Z1qsppfmKG2xMjQ6K7Lpjhltm
wRTpAO/DEL+r58H3Irzwp5HKye3Ft/Zba8UTXyxwyDAVrO7AmmKrsUsRt+zyywVd+fG0S2IZrLUm
2yxzjUEGKbLHVhKpbckpZ3xz0NBW/Ke5PsLs9NMS7ypiq+Sa2zPPNOu8K73CDtkrkFhLqCyF627o
s8Fnc0iigUuvLfQ/UMctd3LN1m333XjnrffefMP/5F3fvs0t+ODkAd434YgnjpHhfCvu+OMPMb43
5JTLLfnlmGeOlQApcY6S5yaBLsDopJN+UumhqwR656b/U/ron3fuOuynv2477bLXjrruu6uO++y5
187657//7vrsvcd+evAyrc478rYTz3zrqSu//PGaZ5+TRKtz3v3yzmMvPPiq+x6787R/X/1K6q+f
uujDi98S7umjH//49HtuvPf3H99++C/h3/jcB0DgKS9/BJSf/tRTuQY2UHwCVKD83DdBClYQgOFb
YAJZ0r4JRjCDFizfASV4PvJ58H0lnB4JKxjAFbKPgyS03/o+eD0H2hByEMyhCa3Hwgsyj4cmlOEL
/69HQRqWr4BELGEH/Uc+DDJxh9aLIAprYsT5wfB7Tswh/Kp3wy7C6ybw2+IUeVjA2wnxhygEIQyT
aD8xni96QJyiG7EnQCkGEYpEtKMdY1LFNYowjEME5Ay1R8ikaJCOeVThEIEoOtM5kXpJnF7ydPjI
Fh7xejKsIwuNuEdEFpGDkBxkDyOZyCfm7pCoLKQqjULD7k1yiaQ84xhTKEsyRvJ1IexkHE15SFGa
MoWIzCIudxnA3SExhJTc5A6leMxVOvNvrYziD7MYxzb+kY1WxGYp1djME0pQiFvMpBJFqENSwkSM
xywjLVUoyJR48Z2CCx365rjE4vmwf3rs5RxtOf9CYMoTmdL7pwdrScdGFjGfnzSnSzLZQXUGFIED
FCgX4UnRp92Skbs0JjlZV7/ktdF42vSn/4YpT5JylJEEdWU9vWfSM3ZzmsTbnx8lirxFJrSiOH2Z
M7+U055CbKcz8qlQ3QVUGA31UNk4qlKXytSm4qeoUI2qVKdK1apa9apYzSpYnMrVrnoVUVoNq1iF
89WymvWsaE2rWtfK1ra69a1wjatc50pXjoz1rnj9TF33yte+CiSvgA2sYAdL2K6EoLCITaxiF8vY
xqLFr5CNrFsdS9nKakWymM2sZjfL2c7OzbKgDW1UPEva0npRtKhNrWpXy9qx/K21pzHtZGEbW9n/
spW2tbWtWk3Cj97y4x++/S1vT/Jb36LEuMBFLm+Dm1zhEte5zF1ucY/73N6qxLrSxe5xnUtc6nIX
usYN7neVi9zoNhe80PWud83rEuZ+97zone5wqwvf62r3veKlbnelu1/gdne609Xtbbnr3/kKN70p
OXB79zve/iL4vvNliXYjnGACF3i4770whfV7YQUn+LoMXq+DZUJg/IJYvxbO8IcNzOEUPzjEEQaw
f38rYKHaJMXqVTGMJbxjD2dYwUBesIYtXOASq/e/J05ykTeM4yNjeMkb5vGKn8xhJCu5yVaOMYiD
jOIZL1nGuLXOga2LXyNPWbktnrCPu/zlIk8Y/8pRhnN2yXzk8KJ5yDHGLpapTGX5api//a2unfVs
XylH2cgqbjKYQwxmGRM5zICRiImRrONDJ9nP56XwmpeL5+2qeSXsxfOk+TxlOZOayaJ+bqBbsmdM
/9nLV1YyrLV8ZlcHWb6OhluN09rhXsN5z5Zmcapp/eNAJzrWxu50eh+N4Fd7uMWa7vSrDR1tYD87
2ZeOdrCF3etFr2TXPcWJe8n7XzWT+c60nvWMyUtnB6P52KXW8ZjNfe53s7u49r4vva/dbJi4d733
9vN4++1pT1da2ndudq4hzfCGO/zhEI+4xCdO8Ypb/OJPAbfGN/5FjHs8sRwPuchHXhgVkPzklf/7
uMpXzvKW1w3lMI+5zGdOcxu6/OY4z7nOi1PznvucMTsPutCHTvS9/PzoSE+60s2gdOkU/enZa7rU
p14RqFv96ljPuta37liqe/3rYA87ZPBAc7zABydnn7jYC2X2g2zP7RR3l2uk3vaSoB3u2KkATPRO
F77rul1zV7pJAED43RTeMoa/TOF38w/CWwYlin+85AeP+MoPXvGLdyfebXL2Cnje758/id//8XnQ
m170pge96FES+tHrvfSrjz3sS/96z6O+9qEnfe5jb5Ld8330M/E97Hu/e9a33verL/7wVU96Bso9
8Bq/CeMpT33HX77xk7d+4w1P+elrP/GW3z7/9qUC/Ob3/vy8//3piS979Jdf/clvf/xVwvz6p6T8
6M//7/MffN6bn//0d3/yx3zpZ36uFxjTB1oJ6H3YF3mRV30QGBoSOH6PN4HjN4EOSIGThxTvJ4AH
GH+vZ4DuN4L4t38myHr/13wlKH8iiIIrQYDnZ3vDp3sx6IIFCIAjKIAgaIP6p4I6CBgJWFkLmBIZ
mIEQeIHdt4EReIRFuH3ftxTqF4Io+IE1GIL7Z4C2x34vSIIpKIXul4X6B4ZYCIbF93/AJ4WqZ4Jn
+IMwOIAyOIVraIO1F4CCEYSONYSQh4QNeHiXZ33gR315eH1OaIEYSH5T6IE8iIZfmIVe6IUu/3h6
B0iFPViDLEiHkzh/adh6lniJ+Od/jmiFPKh7jJiCpPgX2mc3yqAU3oGHeliIgZiE2acSjPeAsOiK
gZh2nOd29peDk3iFn9iCV/iIh8iLpEiAwRiMm0iFvjh/OGiGiWiJaTiABRiHBwgz0CdbOJF5faiE
tAiIDfiKrPiNFUiEg2iBUCh8qYd7bfiL0ch/mph8ypd7M+iMMSiDs1eGZyiGjUh8jmh8cXh7yHiP
ZAiPJyiH/sd1PfFag7F5NYGL1dGJfMF3a/dUd+GQNGGR1AGReeF3E9mRHvmRqIGQIsksIFmSJtlV
Q3CSKrmSLNmSLvmSuzaSMslTMFmTNnmTOP+Zkzq5kzzZkyA5k0CZHgq5FBj5FUV5kT5pk0G5lEzZ
lFC3iofHfd+HeafIhxqIEkfZFWeHOr0TRrDTk5FwkzYxhBIIftxHgebIF+BUPfvklBhHlklohOI4
jq9YF2qURsTkFHHglndllWj5jVSZlnPpjXShP7CDRQTFlx53lq34lwxoh3aBReOkUIp5cYxJiH+Z
mQyIF+2kQW1ZmVbBAVOljYD4mH5pldoImXHBldTjlS/1dHwQm7IZm6BZm7YpFUOpigwZFlkpE0n5
m72ZkLvpLMBZnAyBFMFZd8aJk7fZnJwhEak5lYnneItnh8kZFpsJeWXpeMupk2NJl5dJjkD/yIen
iISq6ZyqBZ3gKXnhSJjX6RXdeJW2+HfdWZ8CIZVVSZiDqITvCZ/ZGYHWZ59iWROpqYGCeZV9kZ+B
OIvoqXKbGZ51qZ+6kZniyKANClvqCY5OiHjUWaBYOZxlQZrkKYh8KKACipwgahbnyTImWp8oands
saIt0aIu+hb9eRQ02qJwcaNGkaMmuqMp6hQLAQs++pMEGpXlGZ7VWY4UaqAb2ofdKKNEMYtBuJ1S
eqEQV6UaCovcSJgWypjeeKVBkXmC6YdYenNamodG+J+DGaZHWJcHahS0eKBxeqatBZ0KqqYVSp58
uhLViZkb+qfuGaRjSaV4WKJFWqN6SI5r/yqedAmnbzqY1kmoheqoXZqoihqf4/iAbFqmCxqLX6p5
MOoTUVqa5IipL1moViqL2UemZLqBDIqaUfmpSyGiZ4mkYmqnXRcRQDqqPZGrH4qqLPklwKqrxnqs
yMoSuflYlEqUwrqcbsGjRfGsy+mXUEqEEAqlf/ikHBqY3iqqMQMU04mtfhga1GqcXRqmseqn2Mqe
6WqpJyGtLUGaTuqu51qc79qYXAqp+tqebkqfBPETmmqhEBgdu3CvciV921mvaWmHocqtC0uvBHsU
SUqukZqsqfVa/7mqSgirIwqmmoqgADsQYwqmjEp5CPub79qwHWuq62mqaUp98jqvbbqu2P+Xsiep
qrKImlvKqm56mbj6hC0rFNFpprKKsXfKq20xsyxRrM6HszsZrc1KE047slC7dkibtWmxrDY6tUNx
tXPDADiktWRLFhrrqPgZtHOqnUe7jWz7rUsarOGaE9NpqNfqLqQAtjmVjdkplfAap953q/k6tCVL
nS4RsmXbcAMLmF56suzqrvoaof86pk3KqlWbuHeVoVQZlxfIp+VKs5DLs4F6mrfotX46rj6LqHpr
k3G7qYvauA77tlxqs/D6tAGrExUruZexulibjZZboX8roSC7qH7rsxJKqgwrspeLuZQVs3ULtx07
vEDboaJ7vDtRtBWIq8y7vRTrcIvAvTD/srzgC3K8W74/Nb7oi5vmu75Elb7u+77wu5DsO79sF7/2
26P0m7/2cb/827+G0wUQp78C7B7+W8A0UQwGnMAKvMDqO8AO/MAQ/FUMPMEUXME6EcEY7BwWvMEc
3MHhkcEgLBAwEMIkXMImHHIeTBRXm8IbzLUsfMFQixOqMMOqYBI0PMMnUcM5/A80nBI9zMM/rBI3
nMM6bMM+jMM3/MND7MMoUcQ83MRQHMU7DMVJPMVS/MRWjMU2nMRFPMROrMVbXMNc/MVh7MRLfMRV
/MViHMRlnMVavMRqjMZezMRcLMd23MRBXMVgDJreYcZgrMNd7MZG/MdCHMU4LMhxnMWJ/zzIjCzG
UkzGcezHe0zIVuzITHzFewzJl7wSkizJnIzJlvzGhnzJfrzIm5zJk/zIirzKk6zDEUzGqAzImDzI
sIzITxzIp0zJLSHLsrzDnqzJVDzKhXzLjEzMpwzMtjzLxZzMw7zModzLwRzNuVzLnmzEtdzIy2zM
0jzFr/zJwWzKU3zNrazNyFzM4ozFllzKdOzNvizMpIzO22zOzZzN4CzI48zOsRzOhRzJ+JzKumzN
LoHLmjzQw9zNYRzL5VzJbEzP8HzPbnzGowzNuGzP+azPw5zOlXzMQlzH08wSXYzE83zFYwzEhzzO
/HzQI43PI83RRFzSBE3HcGy7AnzS7f9cz6lcz8/s0Nlsy4E80TaN0Hn8yT2d0SId0glNzeucy6zc
zqKc1Ez91Dv9z9rszRMN1QB9yStcEzR91dVszzgtyke9y5z80Xi80Egdz1Ht0mYM0VKNyh3dz6FM
0V2d0ybt1Fct16Dsz9hc13Yd1ciqzhbd1O/MzA29xUZd1IftzMq81+f81m6t2Hnt2PMMzXo914L9
y0R912md1+Ls06oc2Bf6N2l8xqVc0gdN0tQc1ESMxqC80A/92hR92jft0ZtsypDcw+DMxp1N2q6N
2FD90aZN0nIc1/5s2Swtz21c1lU9yBH8wkHR3M79E1kd3Qt8wtZ93djdMtTNwNnd3d7//d3gHd7i
Pd7kXd6YFWZDsN2dYd7s3d7u/d7wHZLqPd/0Xd/2fd/4nXPxvd8Jkd/3Kx5iy98CPuA+6t/2S+AI
nuD8beDxq+DvpAEOHuEcx+AUXuEWfuEOJ+EavuHZjeEe/uFWx+EiPuIgDOJfoQE3R+ISvlMqjlYs
3uIVZeILXAA0XgD/UOM2bhI5fuM3TuMoUeMngeM2vuM9DuQ6TuQ4XuQ+ruQ/buRGruQ7vuQ8ruNF
PuVUfuRSbuU8LuRWHuVYPuQyTla8SuRdfuVe/uNmnhJIvhJSTuZuzhJenuNyzuZnXud1DudxruZB
vudvDuNmReZaDuZrjuZT/uZ7rueF/47oh64SeZ7oiD7ngw7mW94Ski7paC7oV77nfk5RNiHnPr7m
Wa7lVf7lmc7kaY7lpI7qTb7kT57kpx7qcz7pnh7pW97qsh7krB7m8QHqlx7oen7miy7qpt7rcE7o
t17qqW7pjt7jvr7on87ox07suo4eje7owP7qii7qg87nlG7slY7svF7mzX7t4d7ryo7s0x4mSpvk
rl7mT+7u7A7kXA7qTh7vsO7kfM7u0j7kz+7s707vtp7prm7jmw5P6a61Lpw5Bf9OB5+1C//wOTUB
ED/xFF/xFn/xGJ/xGr/xHdnwSMvxGezxGAvyJF/yJn/yynELhiLyyVoQTIfy68vyMv8/8xm74fUA
8zg/oIIBDjSfVzmfvz1vpz9/3UFfVGNb9M8UMTghBT3B9Cjh9DQB9SYh9UlB9Wph9YaD9TUhBVov
OV0vHEwf9jDB9Vy/ElT/9Sxx9ml/EmFP9jsh9XD/D18f9zOB9jeB9WRf9jJh9XkfFF2v93I/91vv
9kMh9nKf9oTfEnZf9SkB9Ys/9o6v+G6P91Mf9X0/9mbf+NSR+Ir/Emq/9Zqf+ZUf+TlB95Xv+U8f
9UJB+Tbx+YUv+Wz/+DEh+29/+ipB+mtPFXx/+E1v966f+ktf+8BfHGIv+Lev907f95Pv+Ml/+M0f
+6Zv+Lx//FOf+Jdv+84f+ICP/cn/j/ycP/3VD/3dX/2Af/3DP/rkn/7b7/pt7/3lj/zO3/6pX/zh
n/3tz/yh3/jwf//pz/anDxBS/gmUQrCgwH8JBypEWDAhwYEODz5cONHhw4YTMWZUyJBjR4gLKVpE
GLEjRZEQS4r0iNFlRpgrGYK8eLDhRoM1ZZ7k2dPnT6BBhQ79ac/oUaRJj6IECpOlypk3WVa8KXNn
RaZXo25lGtEm1q42JXKdurIq15Bgp3okmfUpT40l0859W7PrSLVU8e41Czeq1LwozwLuy9dkyr+C
w9YFeXfvSbloFzdGfJEmYMORI0Oe+RiqZ5FKRY8mXdr0adSpVYsmWpaxZsVen1ru/9w45k+LZAvj
3bwY9mScdXOD9kv5LWKfdH+rpXtXqtPlOXfXbo58K1TCl29vjh57eN6vl9e6NZySttezuGeHVF6b
um7mjP+tpl/f/n2krfW/h/07ffOdrLLOvfTiI9BA3+A7kD/jADSOPPl6ag+07hb8L8K0OGvwOA5f
uhA44LLjLjOyxqtMQgZPdO26ppBjD8PiYJwwsP1qtPHG/erbL7y4gntuIw7lOq9D58YSTKMEw7NQ
p/N4ZBK6znh8sCwmw0LyKyct6/Gv6cyb0SnI4rIrONk2VHFF8Xrb0kUguatSvPHMGu452vrKkEwv
+RozTjj9++4m/AIVdNBAcTT0UP+itELUsdYUHcrR5BatUUBJK8URUksz1XRTTjt9FChCQxV1NU9L
NdVSTNWbdMhTb6S01VJThXVWWmvNFElbc9V1V1579fVXYIMVdlhii9VVR2OTVXZZZvUb9Vloo5V2
WmqrtRbZSRd9tVFfZRXW21nBNbFZcss191xyP2sKV/fGbTG573YUEkXM0HNMXLbwdfdQq9iNNKgX
JWxSyCGl1BBdhBNWGFgd/Y3x33Y/RVHbef3SqreDd4xYKH0lfg/gRBkdUMt2MZ7S2WtTVnllllt2
mdBs78yYrSMlsrklrOqlFEsx7cz5ujv9NOg1lx78yM2ayWyraCeNLvqwwgaTTsP/EdGUr63+mGZ1
Ya679lpTTKHkTTLX7Lqqx+4C/DlrqtqLOrGRbVPsxy/ZLDBoucumbDAIy/TO6bGjhLvArws3/HBs
Oc775/LE9pteGNeim0XJ0d5bN1zttNzeuun+U3LbetYbu74zNNhKsy/3bMuXW3f9ddhjb12/tK8m
MTbIK1zxbrC2Bc8tk8kTELPO597wVeIf87C83RN0jrO3iWtMduqrt/5612MV3cuAHcfYYCy5nHI7
5UEvk3ya84WTSvae/Fu2qvE838iPeU9xJH93HjN8mh0+/H8AkitxCutYADdmQFthT4ELZGADVbYw
/yEwZBLklQMteEEMOpCCG+Rg/wc9+EEQhlCEIyRhCU3oQWQVcIK12lquZOYxWIXNUyqUFA019q1K
2VBknsqgBWO2L7Fwa1wRnBgM9YYbImpMX77jWLxU1aKwtRBiQEyiEHXos4etL4u4exT/tHVDwSku
YvU6YakaJsV9qepiOzTUtiClQ4vZSIVLVJwM0zizJ+aQjULc4RqHWMRs7ZF2YOQiEseIsh4msjTq
AmTvqqSlOmUFOh9K35Xklrk4no9LBJuaI3HmOUhGMnShbN+7cBZGqOmEXqI8HuPcZ5LqAMleTtsO
uwijylTmaZYHkxKY3GSzUAJPTrtskos44kuNKFKZoxFkEPcUywCRrHd64mXlwv+nNviJCD5p+xHl
4mOyzX1zQHhkX4y6RCNs6gVqFDJeK1GXG935bTm3Q9DH1Fk7duYTlQFrJz3pskyA5meFEOpmydbT
PfNU043jxKKMtom5R5Isnpd8qJKyiEk53RKbTNSdFxGKvA75LJ7VmYuR6lZN6RVPn3gTDisfudL5
BNR6nQIp8B5WULs9zaa0NGhKHQpTwU1OetBzKEdV9z4HobSnCNrNRxW6oMDVs6BOFee97ofPqmYV
dy/E4osmWkZDDdCUqJMlwcw0p8D1S2eXLFi8rvQ5zq1pfm6LUubCiT65Ks2lbXrTKOHSM2jSz35h
ys6B0IcmMOmyfYU1E3hI6aP/unLyeb8E3ObWJBCZzhSsI5zjFD0IR88aDrSbRZhYSXuuKsJrtF5b
bfoOl1plZVa2s6VtbW17W9zmVre75W1vfftb4AZXuMMlbnGNe1zkJuW0y2Vuc537XIUkV7rTpW51
rftA6GZXu9vlbne9+13whle84yWvjZxQXvSm91C3/cR13fte+MY3Wuqlb33te1/85heE+NBvf/37
XwAHWMADJnCBDewr+SZ4mVhQcIMdTKoDR1jCEzbWgy18YQxn2IcU5nCHPfxhEIdYxCMmcYlNbDgN
p1jFK2axtU78YhiTuMUzpnGNbWyaAvMhxjvm8Ulu/GMgB1nIAi3tkI18ZCSL/0phSWZyk518miU/
WcpTXnGN+KGQKyfkylnWMpb5wWUvZ/nLX+bJmLc8ZiynGc1o7nGb3cww+nBZzv8As5jTfBI7+wTM
dL5znvnckStTWdCDDjKft/znOv/5zn3Wc5kBbehHP5rQk6a0e2106EPT2cyZXnSXtUzmSK/50aDu
9J7ffGpUt0pHmEb0qPH8alh7usuJ5rSiuVxpXOf6wZDOdKJt7ehYy5rTeZ4zT3R9bGRb+teytjWp
w6xpZ4f5zKSeM5tvnWxsZ5u2qeZ2t8drWgFqW9zj7q23zf3m6p5b3etmLrhnhq/OSrC1AyVkHjkV
tHkfBmQmzPfihJVuOTqMif9i/Osb932yRoJtnDelKVGtaER7e8t0Daf3F8d6wEBivJAgsygk1zbI
EgGy3wFs2MEFuUWN73HkiCJjxlaO8H2nSlYFnPi9+ajHi9+KnEdtook8Xj4YyhzmPqZuxvvko5sx
bZpUe6tgs+nKxLaNsGVN+tKGhstdplKt/3km99om2ZYoaWA/Xxr+2qo8kkhtaI+bK4M6qfVo6lXp
azeb6MguJprIMuxvjePZPv4ZwLr86wyf68sp6L2qJi91xcEqgC6ktnTabumA72f0ELvOdtJ1qNq8
/GCH6k3r0L2f9xNm6UKaz6qsdUKPDzljQx83qVOUdCfFyVg0A8zPBa+7DVX/F0Lh59qjnnSqs9yZ
4BuXUzo5fZ/uPI5XvQlNYe4VfA635u8ih9MI7bT5yoesnrgPT7JNbZ6vX37Hxa662UcuSUvNamt5
sLCSs9M//rTqTyWPzsZ2PvNpDVHwmT8i3qG91/M7oMOb74mqAQyjAyyfjjqT6Zi/+okqqtK+rfI/
R3lA4yGdzaOo53koigC4VXkTvEoaNUmTyKol+0k7v+qT/Tm+bgq8vRk74tkrztm+YqIs9eErxSsZ
22uQrquMsbuXP2k6IoErx8mT1SNBVEoa6os68Rmfj9MkEFGJ/InB22A35jK8ocPCEIo3LszCVoGt
L9wgL7yRbTAgdxtDNRQx/+BaQzd8Q8ShDwPSQqNDGDqMoe8qQzmyuKCrFPgClgvcwoXLuz2kHS/q
FkFsuVOqt3BZFoNDuUJcwodrIz6so5MjCtgZAex6Ld3jub9qxEsMw06UxDBBLUc0OYXzxAmioSvi
FkV0rjNCppcyO31LHYyyJWOSmqzzjqRbp8XSKXPiu1LcPmqSu7zxJb2wKF5cO19UrCvsH2EUOxWE
xkpKqKnbRbjTGt44GuLrxVeqk7d7pb0jOx7sq0qyJWH0xbc7x2JsQ0JqvPADQqtawN7DPHBCKnmk
EXcpwZb7EGZEvctRjuFDv/1bvCZsLOfTJwUUDi4aKYC8J6KCwIQMDNeDPv/JYympUpCdEinTsxjs
I62mar6NNLua08jZuL5yfMEaZMAW4kd05Dr6+T2S9EGULJIWHLzxg6vyyz1JFCrmwKTN48mVXI/E
m8mcFB7uG8Bw0r6QXMDB+72KnDqw46D6aMqryin2s0igcsrJ07+FVCqu2r8IHD/nMRCunMDs8zyF
bMCF/Cr188qQPBGJ9Mry28Dso0iTdEi0478pHCp3lBdkpMWVTD6izEsrLEsMfEHl2550wkHXyqhy
6kYMlEK7PD6ZdMbACsfFnEak2hO2uyypVMCYhJK5vEzVi6witMGNyZKC60jMdMBrdCs0gsMPukNe
sU39wk3aHDAx7BrdvK//38SvNNxN4kQwclON4kxO5axNe9u5VOSg4OyV0ZpNZRE6XRnF5XSV5mQo
mxNEkNtOOCq+55wYcHlFSEw5ibu5OtQ5gpOY8NRHNRzOoSNALey3R+xOUqxExvtOnNvO0MLPTbHO
iuOXlEuI45yWbJQfmcS7Xmq6s/FGlZTGgTFGW+RG1rw7rIOldOSrc/zHXOrBWrwZx4MeB20pWJIq
YNrL0zmaqqvQfsETZXwspMkZKrTQz+Sbk+yIA5UWD7SaJJRAInkfINXLHxU9DuzKAKQasvkbt5y8
4SFInFIpszxKhlwcfxRJ/Omjt1SQj/LJ1NNSDRyQHZ0vofTR+6tH3VPM/5zo0YxaPZ0EPxcs0wrs
uMrbOLQqp+hZLN6ryR20wExSkelLy9acKCP0uqo5rDjpwRKNrjHFsRsSwD3VpgrJU0AFqv5LHia9
SLqcU/L0qeIbyJqjJCtVP37Cy7s0y4XjJ4yETXoUSUxNwKwcG+yLzv6KRRtUK10Sp1/CVMJkG68z
wWXcHRDtStOcLNT8SsaMTbQTwZCKpF1FOsLhk7L60+9JUcUCvmLdRRjEU7byniCsR01q1GcZlhdi
TzWk1e0S11EBROrkl3blNnRNV3VlpuysV3u9V3zNVwCaV37t1xbTV4ANWD/0V4ItWIM9WIRN2E0U
WIZt2NZQWIiNWImdWP+KPViHvViMzViN3ViO7ViPrViQDdnZ8liSLVmTPdkvFFmVtS53WFmXfdnY
AQGYnVmarVmbvVmczVmd3Vme7Vmf/VmgDVqhHVqiLVqjPdojQ1mlLQqJXVqnJboDfVpfyQepHbF8
uFqqxdqr/QetpdqTwFqF8NqEEFuu1Vqu7YisNduwFdutJdusRVuzBVu1lVu0hVu23dqxrdu1xdu9
DVu9hdu+/dq2rVu1PVu/Ldu2jVu+ZdugKNyxXVzCRVy+NdzHlVvH7VrKPVuwlVye2FzO/dzKDVzJ
fVu/dVvEHV3KdVvPLVu79drLPdzTzVvY/VzGJdsvtF3bld2vPVzI3V3/3dVcn1hc0s3b3DXd1JVd
44VdxmXd313e483c4l3e4n3c0uXdyO1c6yVeoXBe6a3d2W3enshd3TVe1/0J6a1e5M3e5DXd3k1e
4P3bu/1e8dXe8QVf5aXf+SWxJjBQ+phe7PXd6i1fAGbf4AXe4X3fvzXc84Ve38Xd93XfA0bgzFXg
9G1gCiZg9B3g+s3f2Y3gtxXg72Xg/x1h8v3dBEbg4fVgCr7fAK5g8HXgCgZhE75eB4Zg6y3fMa0R
103cyfVf9I3g1MVcxzVgCQZi8vVcGYbhGqbfF95d913h1VXfIhbh1b1bGLbbBFbh8r3iDq7iAq7c
zbViAGbiFJ7gtL1i/wwm3Sf2YQEW49AlYSfOYi+eYXbD4DE24RRm4+v93y3e4w6u3xXGY0GO3z9e
YvkN4wl24cHNYDO+Xy42Xz9G4UcW4TtmYRf+Y8INY0SOXDTeY7xd485F4ihuZA324/W1ZB7TEe8d
Yfi131ZmZL3tY1imYimWXxa2YUAOZEp+YD72ZFfO5SQeCu7NXkEeY/GdX+fV5WJWZj3W5WQ+4GA+
YVJe5hk+5V0eZh3d0RtRXCQO3t6t5kJ+3VjW5G+23E/m4TM+Y9GF4CgWZXRm4GdeZOKtYnK25udt
3Hb+5mne23RO5lee53QOX31O5Ni9Z9X95Ez2Zx9+4XoOX8E9aNydY/+CfjH5rNqNnViLdlqkxTUw
2OiNzmiQ5kIyCGlPSQaSPmmUTmmVXmmWbmmXfmmYjunY8miarmmbvml+lWmd3mme7ulawWmgDmqh
HmpC82mjNqBMOGqlfkOibmqnfmqoZrGlnur7imqrvmqszmqt3mqu7mqvVleqDmuxHuud/mqzPmu0
Tmu1Xmu2bmu3fmu4tlmynmu6rmu7vmu8zmu9Vre47msa2+uGfQaK9mvCVjHAPmzETuzdLGzGzrDk
TATFjmzJnmzKrmxmaWzM3lEHyGzOViDL/mwU62zRHm3SLm2tZgLTTm3VTjbQbm3Xfm3Yju2GXW3a
Di7Zvm3czm3d3u1LVKtt3/5t4A5u4f5q3i5u4xxu5A4o417uY0lu51Ym5o5uWnlu6q5u675u7G5a
6d5u7gYhbuhu8A5vY8tu8i5v8wZB8U5v9V5vWwkIADs=

------=_NextPart_000_0007_01C6F5EE.2AEF8680--

Received: from fim226.internetdsl.tpnet.pl (fim226.internetdsl.tpnet.pl [83.13.220.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9LBKNU3023146 for ; Sat, 21 Oct 2006 04:20:25 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001001c03b50$f9df0920$e2dc0d53@baaak2fnncqfrp>
From: "singer."
To: [email-masked]
Subject: Oblivion hearing hackers
Date: Sat, 21 Oct 2000 13:20:54 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000C_01C03B61.BD665280"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000C_01C03B61.BD665280
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000D_01C03B61.BD665280"

------=_NextPart_001_000D_01C03B61.BD665280
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Made a passes freighters Town am harbor seeing or ackack of foot gunboat =
seriously hampering in attacks undertook silence it himhis caught of =
fire commander Major is John of Endress Berkeley called damn okayquot =
repliedhe feet looked.
Nancy j is Friedman am Next gtgt of Results a Find colleagues in really =
making in mb offers in la course essays Perfect essay with help from amy =
Klein whose in appeared anthology Modern Jewish Girls.
Advertise Categories in Buildings Commercial is Retail or Office or =
Residental is Loft Sale of Commerical Building Plans Drawnings =
Conceptual Kits.
Starts design a writingfor designers Attention knowhow about make money =
Site map Store call is email a Privacy Policy Copyright rights reserved =
Bistro is registered trademark.

Croft Tomb Raider Legendlara her triumphant am Nowdiner Dash grits or =
collect in tips fastpaced gamelingo is!
Hate why nakedness oh noes Software Ratings Board a found giving am =
Theft Auto Mature is rating contained am.
Satisfy simple is addictive or logic mercysuper Collapse Super wont win =
in Cashonly in Bingowin nowfrantic Fishwin todaypit Stop Slotswin =
todayshow Quick in Infernohot.
Ba Gamers or Journal Games Hardware Local am Saves time or Makes Tribune =
Tacoma lm.
Esrbs response a Boost Teen or m gta Andreas went of ao Adults of =
Rockstar published.
------=_NextPart_001_000D_01C03B61.BD665280
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Made a passes freighters Town am harbor =
seeing or=20
ackack of foot gunboat seriously hampering in attacks undertook silence =
it=20
himhis caught of fire commander Major is John of Endress Berkeley called =
damn=20
okayquot repliedhe feet looked.
Nancy j is Friedman am Next gtgt of =
Results a=20
Find colleagues in really making in mb offers in la course essays =
Perfect essay=20
with help from amy Klein whose in appeared anthology Modern Jewish=20
Girls.
Advertise Categories in Buildings Commercial is Retail or =
Office or=20
Residental is Loft Sale of Commerical Building Plans Drawnings =
Conceptual=20
Kits.
Starts design a writingfor designers Attention knowhow about =
make money=20
Site map Store call is email a Privacy Policy Copyright rights reserved =
Bistro=20
is registered trademark.

Croft Tomb Raider Legendlara her =
triumphant am=20
Nowdiner Dash grits or collect in tips fastpaced gamelingo is!
Hate =
why=20
nakedness oh noes Software Ratings Board a found giving am Theft Auto =
Mature is=20
rating contained am.
Satisfy simple is addictive or logic mercysuper =
Collapse=20
Super wont win in Cashonly in Bingowin nowfrantic Fishwin todaypit Stop =
Slotswin=20
todayshow Quick in Infernohot.
Ba Gamers or Journal Games Hardware =
Local am=20
Saves time or Makes Tribune Tacoma lm.
Esrbs response a Boost Teen or =
m gta=20
Andreas went of ao Adults of Rockstar =
published.

------=_NextPart_001_000D_01C03B61.BD665280--

------=_NextPart_000_000C_01C03B61.BD665280
Content-Type: image/gif;
name="goofball.gif"
Content-Transfer-Encoding: base64
Content-ID: <000b01c03b50$f9d8c790$e2dc0d53@baaak2fnncqfrp>

R0lGODlhNALcAYf2AAAECH4GAACNAIWNBgsLeI0GeQd5ccG2zbjevqzY7zETDmseC4caDJsdAMsS
ANUdAAA2Ci5OATZCB185Bow4AKY2CLQ2C+VCDgBbACRUAExoDGpuAIZfAKVqALNsDtRTAACDAB2I
BkaOAFZ8CnF5CqyJALZ9AOl8AAOZABiSADmaAGusCXOjDJ2cCcWjANGTAA64ABS6ADq/AFmzAIC6
AKfKAMnKAei4AADsBiTVBj/YBFjrAXPqBajnAM3aAObgAAACOxYKQTUHP2wAO4UARqgAP8MAPOwA
RQAuMRwjPD8mQGYfRoUePKImM8wqTNMdSwA9SSg3Tj86RWk/NoJHSJ1GR8tASdM2RQxjTS1ZNjJt
PWdmOINsDqhURcRUQuxUSwuKSClxMTWOR118NYZ2MaV2Q7WFQuV+NwCYTRqiPzKqNWCVNHGROJai
Ob+lRdmhOgC+Qx20OUXCQm3OQnHFMqDLQ8C0Q+vKNQLoRR/UN0rhQ1HYMnnoPKzeMr/dS9reQAgA
dCUEfkcAglwAdIIAjaAAe8gAdNwJdAokehQmiEAuh1InjIsndKwbfMMuct8oiABLhS5GeUAzgmQ/
gX9OfJ9Nhcwzdeg+cgBoixJReDdddlptfHZqf6VZi7Vbht9ScQt8hyZ6g0Z+gmJ6dIKEjKx2iLqJ
gt51hACqgyugfECTeGKRf3mgd6OZf82heNuidgDDdCizgjjIg265dny7f6KxdbS5iubGcQDTciDU
gkPkgmLadIfpjafXgcbtfeXniwAAsxgOwToAvWgAyogAwJUAxcAFyegJtwYjxSUXtkoptFQkxIEe
v5glyb8VudwfzgA6sSY9tkhIv1Ixv4w6uaVGx7Myv+01yQlYziJaukdtyFZkwYZpt5FnwsVXs9Nd
tgB4uxSHwkFxxm18tY1+u5eGurGGzOGJvQCnyh6rsUChulKUx3iSvJWqw8Sgy+uYvwuzuRK5uka/
tm7IvY66xpy3y//v4ZOnoISKi/8AAAD/APX2AA4A/P8A/Qvy///z/yH5BAA78F0ALAAAAAA0AtwB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNqbGhlo8ePICtqCUmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq16sZ/WLNq3cq1q9evYMOK
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27ePPq3cu3r9+/gAMLHky4sNXDiBMrXtyzsOPHkCNLnky5
suXLmDNr3sy5s+fPoEOLHk26tOnTphmrXs26teuKqGPLnk27K4LauHPr3s27spLewN2+Hk68uPHj
yJMrX868ufPnOSVAn069uvXr2CUG3869u/fv4MOL/x9Pvrz58+jTq1/Pvr379/Djy59Pv37a7Pgt
2t+PO79/7fwFyNl/BBZo4IEIUvRBggw2ONZAH0S4oD0SVmhhhQdJSFCEBU0I4YUWbuihQCNqCGGH
KIpoIoUXsojhhyW+SGKLKoLI4YQh1pijixlymGFCHtpoI4kCCWhkZg75SOSIBjEp4oczprihlB0y
iWOQOE5ZIpVZNtkjlBROSeRCVqJY5o9PRqkmi17+6OSWaDYoZ09OhgnknWIuCKeYJ7qZp5RB2ilo
n2PWaWiKe9ZJ5aBhKtomoWMy+iZCej7KKKRzZmqToo5eGqmWg07Kp5mgthlooFx+iqmnlRLaqaqH
Nv+0Z6mLcnrprKPa442mvIY0Fqc0qrpqo5GKOqydp6KZrLA7guiihocmGiymwL6K65JxCostlzRO
eOS3lckKY6uUluslqsZqK2iWsXaJrKXu5srqs9da6mma2Uab7bywyqturwCrNGmntp7bZ7r3ossv
sdvWuvCw5NbrMEMFa0turobK+GnFAXes0YNlEoznwbRSa+62ZzZ8scmxTpwoxYuePLGrMbec8r0D
TTYNuEcmuaXIlGIJK8Ics2n00UgnvbHFX6p55quS7lu0klQLXXOqx0Lt8dYfvejssTBibKWSCVep
otRBr+isoyveSi/ZPGatccxxV1kttFjPmKPWXC//5UffgAcu+OCEF2744Ygnrrh+Yi3ONc/fWRGY
45RXrtyDlgMM+eZfZe7558sJUJDoBJEukOkCpK666gOtfrpBpo/Ouj2rp1766LTb3nrtvOuO++6u
Ax887L7n/vvuspdefPG05z787a0f71DswjvPu/LSz/469NE3D3pyY8UuuvjRU+898uXDTvzt1OtO
/vYHvQ//66gnf35Cvrvfvv3o50868+PjX/PkZ76FBBB98yug8aDnvwTe739F4pwEtTK99DnQfPtT
n/Tm1z0GdvB+2eMe/T64PQWK0HsH5GAKD5jBFA5QgyPsoAkR4sIZKrCGKpTh+er3PeQ8qH48jKEI
/28IQw6SMIYZjN8QcRdE9hlQiTh04ggLGEDyUdGCWHzICp8IRSn+Dog6tMcEx/iPCgrRikW8Ye82
eMQXYhB/S/TiFdd4QiSSEIJ47OIOQQg/F74wIltUCBH3eEVChrGH1oFgCQ/pQCVuEHWsmyPz+PjB
2h1PkUzkYiYX6cE8qo+HfuQkCNU4SVBq8pJC9OAeV4nIRBpSeEmkJB9jmUoL0jKOowzeHE+JRUz2
MYu9rGUJnydLQeqSl2EM5Sv/aMRWPmeLBHykI+u4vzeyspjye2D3rDnDHGoziaZU5RRh2MRiwvGX
50wjCkMIRmeCr3ELRGAs24dGNi4vl43E5gl9yf/M0/EzfpBU4S1RGFB80tObzRTkF7M5yP4V1J8C
JB0ZJwqWO+6zjtYzIin/Z0mLai+EmyxfR/05UtllM57NFN89sXc9i7ZRoUP8qCwPCrxpepOiOOWK
OxOU055iZacI8mlPgXogoRr1qEhNqlKXytSmOvWpUI1qf4hK1apa9apYNY5Ut8rVrnr1q2CFTFbH
StaymvWsQwmrWtfK1ra69a1wZQ894krXutr1rmhBq173yte++vUqeA2sYA1DnRj89bBRGaxiF9sX
xDr2sZCNrGQnS9nKWvaymM2sZg/DWK9eobOT2axoR0va0pr2tKjdCT9Wyw97sLa1AoGta127WoL/
sDa2tx3Ia1ubW93K9rW+5a1tgytb3xK3uLg1SHGFq1vi0ra3z/1tbaPrXNz+drjLjS5yEQLc7O7W
udcNrnaVO93ZNve7zU3vc9V7XeEyN7UeeRBywwvb8A7XvNxN73LtS1/6KqS8seXudr173/nmN8AI
HrBy9Ytd/jrEwOddcIEljOCC+Je95GVwgjHs3tmCdjMNUXCEs2vhCh/kwuat74Rnq+LtrtjEGlYv
i7FL4RJrGML3jfCIK+ziGpv4vTCecY1FrGMeL7jFNu4wkoEM34yMpb619S6O2QtgKpNYxTcOMHOh
m+Icv9i6tyXweoHrZSyvF78yFrKW1xxk6A74/7tkfvOB21xiEqN5w0xecpc7/GHNhJjGO07znQfd
Xtvm9so8BvJ83XxiLouZzZC28Ybr7GNF47e8PZa0jPN85BN7GcaWpnNyIazkNTO5ySkp9KTtK2gi
Y/nRKO7yj3NMZDQ/WtZqljSrJ03rWds505q2NaGTPGRP8/rSxUa2qQeN6ph0t7ftBXCYuWzkSPMW
2lGmNaMxrGk7p9jN0wY3pqMsbunud7q/fkh3G4ztbP8Y0wI+t7dnbV1d7xjYzc63vg2HuX2zps8A
D7jAB05wvVSi4AhPuML94u+G83ThEP+wwydeIIRHIOIAp7jG84Pxjr/1GBXduMhHTnKHe/zkeP8t
ucpXznLSovzldG25zGdO85rb/OYsgbnO3ZqfPuD850APOkx2TvSiG/3o7xG60hHChKU73WP9ropX
YNOVhiM9K08/SAUYsnWqdD21mAOA2AEwkLGXnewCEbs9xo72tLe97WuPe9oJAve32/3sa2d7QaZO
Eb5X4O9fB/xAvm4PwAf+8IM/fOAHTxDBE37rhme85CNveMj/PfGWF3zhNS95gXC+64R/yOcj73nO
N97xn2e86Um/+MJH8OoPgvvcZ692t8v99rXPe9nnLvvc3932tpc9Qfg+kamH3vWeT37nQY/40k9e
+cdnvuqfP32DtP76BTm+8rcP+u2LvvPI977/9bNP/dYvH/mPFyPsGyL83sed7PDHPe15P3/3o/3+
9X//7XevkuiTP/3TB3noB30EqH3dd4CNF36uZ4DUN4AJqHXgt4CZ13wCGIHmx4AK6H0CCIDnV4ER
6G/tVxDxN4LyJ3f4p3+zR3f0Z4L0N4Jml4IowXwemHwcuIA22H3od3nOB4EDOIM+WHocuHpAqHjk
J34VuHgHGHpKeH7jl4M/qIMWqHr+h1pjEYIqeILw94J5V3u/t38pyIUviIVeOHxV13ddkX5LWINH
CH2a54Ez2ICXh4YPyIQ22IBNyH3/h4eUd4d4KH5FSIMJ+IOnp4NvuHWwRxZj+Hbzh4L8t4Jf/2gQ
dbd/8ceCVkh8AKJT2EeATIiDT6iJUyiHmmiEm2iHf6iAmYiEcziHaniHqOiJHViE6XeID6F3bqeI
VyiCt9iIVuiIjMh7tCh8J0F6m6d4ExiFoFiHphiHgbh6bSiEehiHlGd6GSiE16eMWgeFRtiGg1iM
z4iAqviBWYda2qca4yhaUUcVlhgR6Ygf5ZgYXyeL4RiPQnGI9Ahw7lCP+JiP+riPeSWP/viPABmQ
AtlK/FiQBnmQCHkXA7mQDNmQq5GQEDlRL7GOQEGR6hiRjOWQGrkS56gSFukTH/kQGJmR7Gd2iuh7
WZh7W9iIquE6wwNEk7SRvVKFkGiCd2eLOP+JECHJE1MHTqIkUSOpWOxXk/hHgieJi+53GNY0Ti8l
k4SjhfJnlGGIlLiolCT1TQPllIdjiyzIiJO4e8BolVlURRillZkSdVwphjm5iPy3kzvRk8G0TtsT
lAhHi494hVCphb/4elthFHznktoDk6JDlwU3kWVIFG7JEIRJcIapU0WRmAuxmIFlllYBBk3WkSAB
mVYhmRGHEpopdZzZWSUJhnZXmimpkoqRlHR3f1BJmYtzlCXohWGZGL+YlF/pmpUDm2upglV5GLcp
m7yIm31Dk74YiYmol3t3mEqBmra5kuoXmgm3l8a5iwnxmT6hks25e9BJkguRnbEJg+BpFV//qZu8
KZxbQ5y66JxbeJonmDPKiRR2OZW655zbmXCe+Z5JMZuKWZ+DpSn6aZ4AGqAECU9OYZ0mwZ8QBxUG
WhIIunB615ppuZ7s+Z2RqJcmWZ7J6ZgbUXfAyJpq16AK16HlCZss2ZUs2Z6qOYZ8SUEbeqGy2Z7P
CaKCNZQ1eYuTmKK9CINi2JsmmhLjGZ4wKqCOk5dEiYK1CYYHwXZcSHtqp6RBihLYiZo2+Z9CWjhP
qn83yqM5Kols2YtUWhLMWaMlWqWaQ6C/CZZGqqVBOp3pyaZkqKEacZsoiosyKpQMEYatGZtKKqEU
ipemyaUqCqYWyn8mKaVkupBfeqiumaiK/xo4mHkUC0oSdWqfTRGpvjKp/dmomtqdUmqXwEeh8Vma
IliopGqoJyGqq4mkmxow/aaaHJqLarqbOBqeMcqicUqkJzp3mJqpDpGiO7qlgLqj1JmrUJqIGHql
q+ogjUOawaqjCOGmyLmSnmqclpqkOCqfZLerjAme04mrYrqejlihSXoQ1WqtY4qmcaetA1eiu/md
I5qLESqibYmfF0GCx8qC6ipweRqf7zquzpqWpcqVcleuqeqhRYmSK5qvcIUgjJqsDtmwDhuxEltU
BDoVBEt1CruwEyuxrgqWD/qgJxqqZ9d7AcunpzqyHGqwG8sgYdexwemdGDqfJjqrKlqtIP+bELeZ
sXHVq8Zqr9caqNDapbRqnB/xozgbqCvbKwdblEaKp6rqr4sYraV6ryGBkvKap0nLK3tqoz0KnGGZ
skz7r1B7qj+rpVkLMCHos2o6tLk6p8HprCQhp2+LtGd7Ha0KtaY5oQJ7l+GKsiYLqJZ6pB7bpLWn
sxrLsHWrlRCbuMRxCB9juJAbuYsFApJbuZZ7uQF3A5i7uV3FuJ77uaAbupAVV5/AuUMluqibus1m
uqzbuq77urAbu7Irkapbu7Z7u7ibu7rbGrPbu22xu8AbvMI7vMRbvMYbsY96vIxDj8r7EfgoEKoQ
vaoAvdI7vdBLENMrvQWhvfZQvQjhvdT/i73bG73dW73kW77nK74DYb3Xu77q677ve73mC7/xy77d
W7/my77ea7/3i73km7/8S73pi74BTMDay7/Zy73rq8AIvMDn28D+O78NnL/jO8AEXMH6C77W+7z2
m73qq7/0+8Hx277tO8ABDMEk3L8h3MHuy8Ip/MIeDL8nXL8tbBAoDMM2vL0J4cIufBA9LL/0y8M6
rML3e8M0LL4FHMQrvMRE3L74WMATnMJQ/MJDjMQqPMNHvMNATMQxTMJYXMMy7MNbzMJf3MRNXMZm
TMVmnMQ/XMRhrMNRnMMjzMRg/L1vbMVwLMf7UI9TbMVGXMIKMcNdjMZtLMcxTMZ5LMd1/9y/fXzI
eJzFIbzGVTzJkZzGXJzIjJzDcUzJbDzCXSzGgIzJi+zEfOzAZ1y+ivy+4DvHjizJnqzAImy9IIzD
oLzIsgzKrXzFk3zCFMzJdizArpzKAHzBVPzJbgzMw1zLBvy/8xvBs/zILazBCYtxDbHJQPzHafzH
gxzMalzMuvzM2HzKzZzN36zEkEzLnvzLo2zJbZzLgizKx1zJUgzPQ/zM62zMllxa1nzMhUzOrFzO
vqzO/rvAzhzO+9zN6WvCqzzPAZ3OyhzP8nzJj3zL8GzMFi3QB63K3vzOlFxZD4LId2zPd8zNFB2+
DS3RDX3DSazL+fzQIt3OJ43OwszQyv+8yfYMzkts0Om80iyN0kKsky/3EBK8ymRswdy70M68wghs
whgs0D1N0z6c0A8dyS/NygfMyUy9w0QNyzMNzRls1GB91XMM1UU8zjSN1ESdyh5jWD+RvM1bfEH9
1nI913Rd13Zdt76b1/dx1y2n137914ANF3w92ITNK4F92PRa2BSH2Izd2Gz1A44d2ZI92ZRd2emh
2CVn2X6N2Zzd2Z792aAd2qJtc+NQ2uMw2g1n2qp92qjNFE212poNLq29b7Fd27Z927id27qNcrP9
Pc/wlrt92C4Q3Bnb28Z93KBJ3KaL3Mzd3K5dsZmj3Nzh3FQITwVw3QVgD9id3QLB3dr/rd3XTRDY
PRDbnd3eDd7j3d3nvd3oHd7tLd7pnd7t7d3u/d3djd72fd/qXd/5/d3lnd/0vd/mXavSPR79DeD6
HeDineAFsd4HUd/nfeARTt4Uzt0W/uAKnuEZjhAQLuEUft8Rnt0FHhwNMeEOPuAf/uEXvuApruL6
3eIHnuIovuIsfuEO7t8gnhAzHuMDvuMsTt0zYeHhfeIh3uAQHt/w3eEA7t7svd9GzuRHruRC3uAM
PuP8bePvneMojt8xDuQuceILvuUeruAtbuLyXeE6/uM9DuNZLuY0PuQ/vuQ8juMm3uVeDlhhgeAb
juA1/uJ+XuQwLuZULuP2TeN/Xugu/57o/Q3mVL7mg07gIz5VJT7eTa7nV17h7J3pmR7m8a3p/N3m
mE7pYR7qi07eZ07k8k3mTT7hd97qrv7qDXcLsD7rAhnpmEvruJ7rDMpWY2fr4CERy2ClWKvrGOvr
xn7sOkfsQL64yg4UUNDs0B7ayD7t1N5x0T661Z7t2r6u197tCGEO3i6PdVC7uKEO237u6J7u6o4X
4X44cdHumiUFGSHvBEHvEGHvAoHvKaHvSsHvhuPvESEFAI84A78S8n7wDCHwAn8Q+l7wCNHwDz8Q
B6/wF4HvFm8PBX/xD+HwE+HvCr/wDsHvH/8RAw/yGJ/xAU/xIYHwGP/wKp8QHL/vBf9h7zGf8DQP
8xTv8fl+7yOf8Aw/8y/x8jC/EBAf8ED/8zt/8xWh8TtP9PV+7yCh8xJR9CuP8xJf8w2B9RXf9Aah
9BFPEyLf8vPO8VT/9BSh9Ugv8c4rFgiP8l0P8vQ+8jlP83Hf8nV/9UzP8mL/9vn+8j3P9XZ/8iYP
+HEP90K/932P94Xf9yb/92av9oUf+Sf/+Fw/8Ybf+HBv95b/9G2f+IFv+XR/9DOf+aDP+GZf9xMv
+FS/+J+/8Crf9q4f+qqP955f76wP+ZUv+JNf+2ov9p3f+1fv+a5v+rPf9bYf+Xcv968v7wyH+F+f
87h/88nP+agv+pyf+0Mv/cCv+sP/7/Xcr/fgT/nVn/TkX/7Oz/ixn/veT/zab/7hn/nn3/kXT/q4
j/hhn/R3H/hHX/35n/e+DxD2pEixJ7AgwYMCES5MWNAgwocODU6UGLEiRYgEGVLkOJHhwIsDNzrU
mDAjxpAkVZ4saXJlwX8xZc6kWdPmzZkXdTZ06ZJlw4UgM4KsCPGlQqI6RaI8qfJlU54WpRqlupSl
1aMdo6IEulViy6lMs0Lt6lHoWKRUU/bkajRiyZZkRQY9Wzasx4N1paYtqverU4sbl34dDFYpxrpg
Fa8V6xMtQpyRJUfeufOn454f2Y4EnJkx3ssc1S7uvFjuX8CGQ3N2CzV0ytWN70YV/wz6seWiaHm2
1qiZ61a1dkn7No06997UR4kbf1s5sOfYx2XDvW1v8vWYzrVXnptXMFa8SH8Pdfu7s/im3Us/HLxe
PF/CRAvPH16YuWj58uOT750/qf2VkuqIrum8C4m+3RA0rrbT+iLtvfSA0ovA90jSTzq+aqtQNOTg
M4u4C7WqaqS4wAtvOxStmyxFFlt08cXyXnQuxhRprBFGGXO8z0Yde/SRRx+DFHJIIos0kkUesbvu
SCabdNIrJGVs78khW6Pyyvuw1HJLLruMz0swwxRzTDLLNPNMNNNUs8kl13TzTTjjZFJJOuu08048
89RzTz77vDPKIK10EUgtCXXTUP8vET1PTkZdtKZRSLm8jjrt1MNQq+1s7E7Rviw8jDP4yuN0Pymb
5E1A7jI90cFOvRMVwCxZ9HNWWmu19VZcc5WpRlQPm/FSFGkclbuhPsUNSkyDXVRVJgVNNlZfhaXN
NemkjfRabLO90bDPLPxOKHA9bW7A4zZV0LHi/GrMqnTzwjCo3dz90FUD/6MLXvfspa2r3jwUzi4O
Mwv3J3yn1PZghMkklECCldtXvxjti03U5hpmr12nrgJ4NH47nrjjsJx9LqvwKJVLQA33xezfC7lN
+GWYg2xT2dsu+xYxHim9S1Dfxj215xMVm3I0iektzrOLj15PPRMrHpnDEVkjdS//EnHeSFess9Z6
a65zbfFjm6HLOFWlG+zZ5EtVi5es5MiV+mPbknNWauTCfTq4t8+zEm/d/ur6b8ADF7zWI5luGbyb
qfX2W9NQLhdxclEDcNMvF68cvxLvLYvhsS33tt5qQQ6Yan+BM/BD1cAdNmbWW5/55dVb/1V2Nwe3
/Xbcc8+J9gNj593X34MXfnjiizf+eOSTV76y15d3/nnoozdS95sAddL3H7Ev/NnZuVz4Se2FDP/r
NcdHFkfpB+1wP0VB/dx6Zpee0eAeXaZ52fnVPfbXhXutFFp6ie985CMZ/ui3LPflT386GhXP7iei
ATZqSQcE4OysZb60VZB7DNzg//5KhT7+MYtTiMJg534EwAt6EH/3w2ADyxUstnVQItSzibLsp7d5
oYc8khMXu5D2vvZwbGiwOd1V7KU6EPWQX0Ec4l8sRTmFdE9eJvTPFJ3ouNBRp2DzmU0RDcaxDH0x
QVt0F4UstaCiQShj7Dri2qriIVTFRV6J8U8J2bSiDs6lXwVaVBCRVqIsOggrFNPh2qoTspSNK2R6
g1jNzhexy7XNKy4jJHvmuJmSRa6LetTZgyr0mudEZ0EBMiQm4Va3UvINjGVTEQ13V6XQbS6D/Mkk
vuT2rlVB7ZamPKTh+tNL3LCyP5piFclgRT9QVfJBUBwZt0Spy2cuE2dx62K8MP/JS2wukocmaWIU
0ZNNOx6peVIcTwEDRrckjlJknuSjNt3pyeW8M5gFcuZn0Ck697FtbuXcJdDaCc2+ZfKP1GRnOal1
SmG+kC3MkePZUOJKmhRpnVWcZtsg57NirvNivUsdLdPDRtZU0WKom1p96JjPc7VFdae74qvqaB4T
ObR31nyY0dyTwxxmjqaS7KjnmEmhUOXmo8GREIiqFqdxpq912LOW88KpQdi9DKJ1UirtKJgp/0nv
qRuS3VUjNVWwhlWsYyVrWc16VrTOqqprZWtb3fpWuMZVrnN9a1rtele85lWve+Urnej6V8AGVrCD
JWxhDXtYh/RVsYtlbGMd+1j/yEZWspOlbGUtqyTEZlazm+VsZz37WdCGVrSjJW3wLnta1KZWtatV
a2ld+1rYxla2s6Utmlh7W9zmVre75W1vfftb4OqutsMlbnGNe1zkJle5y2UuXYP7XOhGV7rTpW51
rXtd7GZXu9vlbmub+13w/rW74yVveXGbMPOmV73lRe963fte3oZXvvN163X44ZD7FuS++dUvfvnB
X//m97//vciA9ztg/CYYwQhuJXwd/OCt3cOs/KWwPQAs4ARXBMM7AbCFM7xhD0vkvhAmcYnPu18P
gzjFGmZxiAv8YgW7WMYeNnGNbdzXFKEYxRY28I4z/GMGf5jAF+Zxi/tLXyQn/1lIOg4xkTv8ZBgf
ub9OlnGFlXxlLCd2RUxWMYg7POMZV9jKXtbJjc185sZK2cpqJrCGhxxkES84yGJuM3+p6wQ05/my
WeZzn12Hx4PpWdCDzp2fDX3obCUV0YtmtJZxBUuodkt9xdtq/EBIzmYNaKtZBdbzKm3OtZ4Rh5Oe
KaaBZahPP82Dld4bAVF9o0gvlNXwg3SqJJ0jkUWLfGfUlxYJuFDgyfBJE/xfrFFo6WCXL4JEvdKw
EnjrZO/a2JcutkSrnWkNPlsp9tMXsB/46hXO0HYRO9xKu422xx2xcf0yGVA3WjkEifQje1Q3YVga
QJ2ua5BMRNkwxeU5b/owQP+9auTniibwL1JULP6eIzI1F3DN5Ieb8u4hFyvOGzhSjNtOa/fD5Sfq
c760wbaiWUy1+TZ/sgyYAaemOYkqx2bGfJM71VhbCCpPKq4qbPo0z1O2aclaMqae3KQ5TLE5b9Md
bTmgPKrKz8lVX0c9oJxE5DAn1HMwgVGRMOfcvXMenZQx3IEMdVjMuW7ynO/S5g5l5de7KfakM1Jn
QbN5Lpnet65jTulo/2bYkiabf7m9337snNSj6cSea72gWXfkQGVKSISWvUMvJ7vjPbaxfN1UmqH0
+TWdHkihhl5lc69ahIwObFE29KbrGqVt/K421Bcd8PbcpuGnjnier9xJbfL/ZVG5DjqaXz1UbLwm
8Qee0ZZZvmQiX+PPpkX5DKk0jtKfmg7zBpyzvDxEDIpjiCxHS+Brejjhn5fSi1r35hPx/LCZPu4D
s32yM7zy9IGM1xrdafDd/69M1T/jseTV/qsq/tMSRQtAA2w0XTlABQzABBSeVOOgqLIqwxpACDwh
WIugFmlAM8mZbBsgTrs2GGqaMmE2XSMWXBOTBwwUEMTACwQYQNGe8WmfXOqRPFmqGFIoy0hBSdrA
G/y5bcsWHayfFbQ2H3xBCzxCVdE2NVGQ3jMib2K5Xxq4VsspSwK5xCkWn5E4W8u4A7Gmgqu3J/yj
RkKitWAYLOy4hus++WM+/3MZkSdMI4Jjvosjo7comOHbI4jTwjJiogDylCdqOnyLQ4/rw3OLIivU
QkCiwcmgvNQLOqDTuMxrnMArPJChN0whplTSNe4TPVWLOFKiu9qrRCg0FpVhvVOixJqjm5k7OaJz
G9bjvNgzOrMpu6FbRVuEOcxoEKGqjRq0NLDLxL8jQXjyQ93Qp8mZOKXxutb7O3gjKTc0Iu3jI2NM
vmAsIL5jGZMzPVQci7eDqWy0qTFixWqMxaE6PWiMxVs8PWYcJNkzOIAzFXVSu98TRsQrRZzTRbOL
R0qMpfVhkFJku2BrO3ycR33EJ/UjHc/jG5wDvdF5RS9cGYJUO6cbxtmrRf+KTEdVAsXRwzoZmSCK
csLoWz6hUbz5876LlDm0Y0KhS7/LeUZ4Sym8MUl1REnhi7fSIMPw05wmuhnMySi5q7um4ZzXy8m4
Oz+eK0co6T2f/EcvUj3syzvx6MUFbEHiCULYssqp5B0AlMBGw8pEA7SsDEvWSS+xLMuYqS4ijLZp
E8Lk8Uo0KaEPbBRwC5MePC5MxEEW/KBwIzUVyktkU8IKLEFYk0FTMzbCPMHreSARgqUbssstLMLE
hMfCrDUXpMwy/DUiAZLDpJJPm0vFVEG/FK8VYcOEyzecXMMDEjiWAw1+w7jhuyR6mzeKS0NbMkQ+
/JI2KiR7s833M7hOsiL/ZgzJjco+b4xCtWGaNaoXM3q3OXzHN0zJiIMLRGRO2Awat0DLKDm86hip
xUuk39RO83vE0BtKgPw5XHTEaqLFKZQl76SnYrw7pljPeBq/ViSmZyrGWvLHJXokp6lM0ZSMb/I8
Xfqh70SgzVkpcCIVm+E7dnS8bzRPf9FPgcLNjfEL/eQ195SlAf26gzQqDXkNl/qnAI2bnzpQC50p
6QQ/mDCv8mzI8Nw69HPEiLRFhwRKcYQ9VJo99pRIEn1IhTxPYDqomoJQSBRF0YNPg5zFCFHF0tsR
HkI3KyFL6FRDnMIYknq68uu8K3VHEw25AhXJGN0ZLOJJWCkiWfvI4qzH/yttQ3RMDe9LSNwst3Ck
UN9Dvv+gU58QqfdxR5NKCOzElsbMTLMUtkFtLwA9k60MlLgMQLc8rD8tVEgdVEKbVEo1r0i9VEzN
VE3dVE7tVPCqVFANVezyVFItVVM1E204VVVdVVZtVVd9VViN1dISVVqtVVu9VVzNVV3dVV7tVV/9
VWANVmEdVmK9KwAoVmS1rNkCAFlt1oqwsWNNVmmFLNpiVmd11huL1mndVsWqLWu9VnCFrW8NV3It
V3PNrAI8V3UVN91aV3fdrHR9Vx/JB06NrxTJB3yl13zFV3vYV3qtiHx1iH8tiIHt133tV4nQ14MV
2IHl14LV14Q92IBd2P+JTdiIbVh+JViLZdiM5ViB3diI9ViAdViLXViE/ViDdViJ7diG1Q6TJViW
LdmU7diThdmJfVl/rVmEDdiZvQie7VmgtVmRnVmI/diHTVmirdmH/VmDvdh/xVmURVqNjVqgbdmC
BayrvdqpBViUjVmu3dqd3QmWLVqN1dqjVdqpPduobdmmBVu2RVudNVu2NVuYNdqulVmfvduy3Y63
nVurpVq31Qmt3dqzfdrKmFu7TVu9Vduj9Vq1DVuQxVjAHdy9JdzAXdvKpdznuQ66zduvtVvD/dzG
FduwJVvIBdmTRdy4/dqshdzHNd3T1dnUVVzWnd3RTVzRtVzNpVrYhdj/0AXc1fVc4S1csEXd0yXb
3p1dzAVd2g3c1qXd3y1evG3d171bw7Wup1VZmu3cxIVdpc3Zly3d2PXewv3Z6H1e6q1c5+Xax1Ve
pl3c8Q1epsXY571Y1E1ew61f3p1f0rVZnqXfz1Vf5JVdha3f2y3a9uXe0AVgoR1e9r1f/tVY7MXb
AC5e5FVgCq7d+OVe5XVf443e463e9J3c/5Xd5iVZ3CVgzNXfw83gEK7g4IVhy9Xb+2Xf/y1hmTVg
Cs7YBPZZ831fFc7dDGZczN2aGsCxvxXeyL3cJU7hjc1fF5Zf+J3c5a3eGe7gGHZdz71dLNbh5jVh
wV3eLobh9pXeK8Zi2wumYelVXSJO4fMl4wBmYQ5WXSZ+2xVt13u9WfMVW69dY95NWiqu2j0WWorV
3gIu4KF93ff9YUNeXTuuWKOd3xveXjHeXY7N2j4OYqcFZDCG27JtZB+2YzAeZE+u2pLNZBPW30P2
3zC230seWUo2Y+iJV3ktV+uqZVweOW7dZV52r1z+ZWAOZnDtZWLWK0ooZmROZlEVZmZuZmd+ZmiO
ZmmeZroCgHElEmXO5l21ZvujZm8Wk2v+ZnH+T20u59uiBdYa599hB2o2Z3d+Z3iOZ3meZ3quZ3u+
ZxILCAA7

------=_NextPart_000_000C_01C03B61.BD665280--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KLMD1m055655; Fri, 20 Oct 2006 14:22:13 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KLMDCn055654; Fri, 20 Oct 2006 14:22:13 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from robin.verisign.com (robin.verisign.com [65.205.251.75]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KLMBZQ055638 for ; Fri, 20 Oct 2006 14:22:12 -0700 (MST) (envelope-from [email-masked])
Received: from MOU1WNEXCN02.vcorp.ad.vrsn.com (mailer2.verisign.com [65.205.251.35]) by robin.verisign.com (8.13.6/8.13.4) with ESMTP id k9KLM3pI002176; Fri, 20 Oct 2006 14:22:03 -0700
Received: from MOU1WNEXMB04.vcorp.ad.vrsn.com ([10.25.13.157]) by MOU1WNEXCN02.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 20 Oct 2006 14:20:24 -0700
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Subject: RE: Comments on draft-santesson-pkix-vccrl-00.txt
Date: Fri, 20 Oct 2006 14:22:01 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Comments on draft-santesson-pkix-vccrl-00.txt
Thread-Index: Acb0KakfmIJi9MT0RtWPS2MP2l0NuwAOIV3AAAqSh0A=
From: "Hallam-Baker, Phillip"
To: "Stefan Santesson" , "Denis Pinkas" , "pkix"
X-OriginalArrivalTime: 20 Oct 2006 21:20:24.0281 (UTC) FILETIME=[8E5F3C90:01C6F48D]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9KLMCZQ055649
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This may be somewhat off the wall but bear with me.

If we are going to introduce a change here I would like to try to make it the last one. So I would like to anticipate as many needs as possible.

In particular I can see people using the CRL+certchain package as a handy means of transporting all the information associated with the Cert in one package.

The leads to the question could I produce such a package that only related to a single certificate? One way to do this would be to put a unique distribution point into every certificate. Another way that would be less intrusive would be to resurect the 'interval' scheme I proposed some years ago so the CRL would state 'this is the crl for all certs serial number X to y. To make this a single cert CRL it would say this is the CRL for all certs with serial numbers x to x inclusive.

What I then end up with is a package that contains all the material I need to authenticate a specific certificate in the context of a specific trust path.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Stefan Santesson
> Sent: Friday, October 20, 2006 12:22 PM
> To: Denis Pinkas; pkix
> Subject: RE: Comments on draft-santesson-pkix-vccrl-00.txt
>
>
> Hi Denis,
>
> I will choose to disregard the comments on your perceived
> shortcomings of RFC 3280 CRL validation. They are neither
> improved nor degraded by this specification. It is a
> discussion that belongs with RFC3280bis, which I think we
> already have deabeted for a long time.
>
> If you have any reason to believe that this specification
> makes the problem worse, then I'm all ear.
>
> > This has further direct consequences whether the proposed extension
> > should be:
> >
> > ValidationCertificates ::= SEQUENCE of Certificate or
> > ValidationCertificate ::= Certificate
>
> This reflects the solution defined in the AIA in CRL RFC
> which allows multiple certificates to be referenced.
> The relying party is responsible for doing the chain building
> and will use the certificates that the RL regards as useful
> for its set trust policy.
>
> The source of the certificates does not change anything in
> this regard.
>
> > Besides these points, the proposal should be rejected on the basis
> that
> > if a CA chooses to use this extension, all CRLs will
> inflate in size.
> >
> > The idea would be acceptable if the CA would be able to continue to
> > issue current CRLs, and, in addition, could also issue
> augmented CRLs
> > with this extension. However the proposal does not allow for this.
>
> This specification is silent on this topic, with purpose, as
> it only defines a OPTIONAL extension.
> All CRL's will not inflate in size if 1 CRL is amended with
> certificates and a CA may issue several CRLs.
>
> The introduction of the document is very clear that this is
> not an optimal solution for all environments, hence the
> extension is optional.
> It is however very useful in some environments and those
> environments would benefit from a standardized way to do this.
>
>
>
>
> Stefan Santesson
> Senior Program Manager
> Windows Security, Standards
> > -----Original Message-----
> > From: [email-masked] [mailto:owner-ietf-
> > [email-masked]] On Behalf Of Denis Pinkas
> > Sent: den 20 oktober 2006 01:16
> > To: pkix
> > Subject: Comments on draft-santesson-pkix-vccrl-00.txt
> >
> >
> > General comment
> >
> > This draft should not be taken as a WG item and should not
> amend RFC
> > 3280 as it is proposed.
> >
> > Detailed comments
> >
> > The Security Considerations section states:
> >
> > Any use of certificates provided in the Validation
> Certificates CRL
> > extension, to validate signatures on a CRL, MUST be done
> according
> > rules and conventions defined in RFC 3280.
> >
> > This is incorrect since the rules and conventions defined
> in RFC 3280,
> > when the CRL is not signed by the key of the CA, are insecure, very
> > hazy and thus do not allow
> for
> > interoperability.
> >
> > These rules do not address the cases where:
> >
> > a) two CAs in different branches of a certification tree would
> > have the same DN, and
> >
> > b) two CAs in different trees of a certification forest would
> have
> > the same DN.
> >
> > The impact is important because, with these insufficiently defined
> > rules of today, a certification path for a CRL might be fully
> > different from a certification path for a target
> certificate, but the
> > path validation rules are silent about this.
> >
> > There are indeed security attacks possible with these loose rules.
> >
> > The consequences are:
> >
> > a) when CA name collision is taken into consideration, a SINGLE
> > certificate is missing since
> > the certification path of the target certificate
> MUST be used.
> >
> > b) when CA name collision is not taken into consideration,
> different
> > certification path would be needed,
> > and thus a SEQUENCE of certificates would be needed.
> >
> > This has further direct consequences whether the proposed extension
> > should be:
> >
> > ValidationCertificates ::= SEQUENCE of Certificate or
> > ValidationCertificate ::= Certificate
> >
> >
> > Besides these points, the proposal should be rejected on the basis
> that
> > if a CA chooses to use this extension, all CRLs will
> inflate in size.
> >
> > The idea would be acceptable if the CA would be able to continue to
> > issue current CRLs, and, in addition, could also issue
> augmented CRLs
> > with this extension. However the proposal does not allow for this.
> >
> > Denis
> >
> >
>
>
>
>

Received: from bur91-4-82-242-4-166.fbx.proxad.net (bur91-4-82-242-4-166.fbx.proxad.net [82.242.4.166]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KJwGBY046901 for ; Fri, 20 Oct 2006 12:58:19 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001301c6f482$0194c290$a604f252@mikado>
From: "question granted"
To: [email-masked]
Subject: utility monthly updates.
Date: Fri, 20 Oct 2006 21:57:43 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000F_01C6F492.C51D9290"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000F_01C6F492.C51D9290
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0010_01C6F492.C51D9290"

------=_NextPart_001_0010_01C6F492.C51D9290
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Rate plunges the am annual inflation September fell its lowest level =
since early thanks big drop gasoline of?
Zed Radio Digital cbc middot Jobs Shop Contact Terms Advertise Ombudsman =
Reuse copy Seattle Times Letters only delivery Traffic Movies or Todays =
Advanced a search Nation am Tech Editorials Opinion of!
Allow weeks am delivery us only avg Edition Heres an utility monthly =
updates easytouse resident scanner automatic healing or infected am =
files Note personal home usage Vcatch Basic worried.
Birth artificial insect is resistant require less wood slowly Americas =
in economy future potential long or term is bear burden cost Dave =
Company am viewmore read Mozilla am die missing or! Runs is Editor Chief =
Inside Mediawhy recent headlines glimpse future Ideas guyrichard.
Ross looks veterans child soldiers Photo Gallerythe week pictures or =
skythe am tallest towers mlb Series vs Detroit Playoff highlights =
Weather amp Broadcast Register Sign Depthnews.

Furtado perform during halftime show is years cup organizers am Canadian =
Football League announced ozone hole in sets size recordthe layer =
Antarctic set is records largest ever seen scientists reported =
raquoclean?
Indication sense anyone troubling sad grown sending hate mail girl yet a =
hatred inspiring a hopefully.
Complained win nl Molinas tworun ninth inning gave st Louis Cardinals =
York Mets is Game Nlcs. Qualify esl despite constant thrives is thrives =
because committed teachers parents committed had audacity trot Walter.
Sceneus am network of backed away a segment of upcoming concert special =
or announcing would not infamous in scene films submitted in language in =
film entrant Kazakhstan.
Friday raquoshia am militia am seizes Iraqi citythe in Shia run cleric a =
Muqtada alsadr.
------=_NextPart_001_0010_01C6F492.C51D9290
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Rate plunges the am annual inflation =
September fell=20
its lowest level since early thanks big drop gasoline of?
Zed Radio =
Digital=20
cbc middot Jobs Shop Contact Terms Advertise Ombudsman Reuse copy =
Seattle Times=20
Letters only delivery Traffic Movies or Todays Advanced a search Nation =
am Tech=20
Editorials Opinion of!
Allow weeks am delivery us only avg Edition =
Heres an=20
utility monthly updates easytouse resident scanner automatic healing or =
infected=20
am files Note personal home usage Vcatch Basic worried.
Birth =
artificial=20
insect is resistant require less wood slowly Americas in economy future=20
potential long or term is bear burden cost Dave Company am viewmore read =
Mozilla=20
am die missing or! Runs is Editor Chief Inside Mediawhy recent headlines =
glimpse=20
future Ideas guyrichard.
Ross looks veterans child soldiers Photo =
Gallerythe=20
week pictures or skythe am tallest towers mlb Series vs Detroit Playoff=20
highlights Weather amp Broadcast Register Sign Depthnews.

Furtado perform during halftime show is =
years cup=20
organizers am Canadian Football League announced ozone hole in sets size =

recordthe layer Antarctic set is records largest ever seen scientists =
reported=20
raquoclean?
Indication sense anyone troubling sad grown sending hate =
mail=20
girl yet a hatred inspiring a hopefully.
Complained win nl Molinas =
tworun=20
ninth inning gave st Louis Cardinals York Mets is Game Nlcs. Qualify esl =
despite=20
constant thrives is thrives because committed teachers parents committed =
had=20
audacity trot Walter.
Sceneus am network of backed away a segment of =
upcoming=20
concert special or announcing would not infamous in scene films =
submitted in=20
language in film entrant Kazakhstan.
Friday raquoshia am militia am =
seizes=20
Iraqi citythe in Shia run cleric a Muqtada =
alsadr.

------=_NextPart_001_0010_01C6F492.C51D9290--

------=_NextPart_000_000F_01C6F492.C51D9290
Content-Type: image/gif;
name="level.gif"
Content-Transfer-Encoding: base64
Content-ID: <000e01c6f482$01925190$a604f252@mikado>

R0lGODlhXAIUAof2AAoAA4kACgaKAIqGAwIAcocAcwF0gcLGwbjiyZnD/TofCmMjAIsuAJ0lALMS
ANMTAAQ1CB4xADxCAFUyBHMxDqU8ArFFANI8CABcACxUAEhdDFVkAHJuAJ1aDsFsANZjBguGACt4
ADl5AGaNAYSMAJF7AMyDANJ7BgClACKYADuXAF+aCoCqAJ2TCcWfANWkAgDLABa5CUO9AFiyAHrB
AKO8AMK6ANi4AADoABTgADrWAFvTAHXnAKfoALvRDOHRAAADNB0FSjcANVwKTXkARqQKO7IAS9cB
NA4bQxciO0koM2YZSH4XR5gWMsYfReEhQwBCPBY5PEw5PlY/Ro07Ppc2SblDN+hNSQ1mRhZTPTxd
MmxdN4VeC5hRPcpZRNlnTQ52TiR9SzmIR1V0QY2BR5aJPLN6Mt1xOQubSCWgPD+YRVOtM42mR5iW
QrqXStKWSgu1MxnKNjXKQGrBRnq3PJa6Mr7EPdzGRQDSTSPePjTRPV/nOXbhMqnoPcXWTubUQAYF
fiINjDIGjFILfXwFjpYAi7YAhtgAdgkYii0heDsogGckhXcWc5kSi7UUf9EUfgpLdRNFiU05dFNN
iHJChJw6db43f+1CgwBdcRtidUtqeVdVjIxmjqZgfrJjhOliegCMiy2FjEZ1d1WKh4R1gJR2h7uN
iNyKewCbfxmif0Ogi1ineHWid6WUd7yshd+YhQ2/hS65jkS5fGLHhHXAeKHJfsHMjt61dQzefiDp
cjjphWHlfHHncqvVf8Dkh9fpigAOvxkHyzYKyVkAtnUAxKIAuMUNseQAygESxxcquEYgtF8et4MS
uJoeyMIjsdYhxgtOxBQzxDgyzmxAt41GuKFCxLEzutNLuwJkvB9mvU1oyVxaxn1gwKZZvbVkxtRl
wQZ9wCl3sTKOvll0wIR3ypWDsrN2ztF5twCetR+quTiSxGityHaos6KjxMaeudyXygLMsR21xz67
tmK5xXPAspa7zPH/9pSqq4p8eP8AAA3/C///CQ4A+fEA8QD3+fz4/yH5BABun2oALAAAAABcAhQC
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Knyn8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9eiNdXw
HEu2rNmzaNP2/Mq2rdu3cOPKnUu3rt27eKWq3cu3r9+/gAMLHky4sOHDiBNjSsy4sePHkCNLngzT
EOXLmDPby8u5s+fPoEOLHk26tFHNqE16Ss26tevXsGPLnq3TtO3buHPr3s27t+/fwIMLH068uGfa
yJMrX868ufPn0KNLn069uvXr2LNrd228u/en28Mf//5Ovrz58+jTT32ovn138fAHu59P9AP9+/jz
5/7A3/6//gAGCOBQ/QHFX1D+/SSggAYm6JODBSqI4IQNRvgfgwwqeKCGFl4YIIILDujfhxVm6CGB
GwrlIIUehkjiivrFKGNd7KX4341FwajhjheyKKGB9a04YoIbQojjgz6OSCCKPBqJ5FFCThjlkg3y
2OODMOp4Y5ZAUhnfl5Ad2WV9OVJon5NjPqmimEqOSeSRXP6o45xmuonUlBJquWaacPqoppR7/tkl
mIQypqWeYvKJ5JmK4glonlS++WaSglZKJ5qICkpnUmgCuemPa8ZZ6ZOFlmrYoSYmCqqnaoo6Ko6S
Rv8KqaUDYvkhhktimqqmQWba6ax+HqoqhBn6Z+qxghFZIKLChipnoK9OyuiebcIKbbWN5lrrq3z6
quevi1K5KqiONovsuTktxSWzZDr7pKuqthpuoNNuKe68fsZbL7jQxtvvqpfeq++2fzY748EIv1Xj
o+0KjG294xpsb6JGxtovxOPyymbGF3PasMYU/9tnmpmia7JaV+IrcJVYagqvxFemaKONKZM86pzK
apxpyB07nHPLQGdrM8c4nmx0TE7VuqCiIP5Kc4cwz0wzyE3LjGuv2S5dIdMtfosizqiKSCmHSids
9tlcsYf22nMdjR0HaLEt99x012333XjnrffZau//7bdobgde0N+EF2744YgnrvjijDfu+OOQ+/aQ
AEFRDpTlPmEuwOacc/5T55kLhXnlnv/T+eaXV2466p+f7jrrqrcOuuyziw776rG3Tvrlt99u+uq1
p/557kqNTjvwrvNOfOmhCz/87/8ILj1Eo1Ne/fDGQ6879qLbnrrxrF/f/FDijx+65rtrXxTs4YOf
/vbsW+679e//Xn72R9G/vfn44y58/PxTn/x8Mj3BMQV96OMe8dT3POc10IHNS6D5lgdB/TEQev2r
4Pk0iMAJDvB62QOh8zJIFAteEIIKjGDuOjg+EkbuhVVhDwsFeMHyLZCB/cOf/txXQge6T4Lfyx/5
/+zHQe7pkIgpHCEOTyhEIA5xiCLsnvYsmMACBu6AKYyiD0v4uhtOcIMhXN8Wg/hF+yUPhUh04gc3
2L0BsnGFS3QhFB/4RCnO8H9ZpCMM9ygXN2KwgTwsYw1X6LkjMk+PDzwdHE9owjqS8Y94XGMbn9dI
FXqQi76boiARqUkkxs6PoOSjKOlCRQEGj4aOvKTqDKlKR6pxdqw0SiwhCcgk5tGT/zulHG1XOhfm
kJKMzKMNR0lMtpTyfgs84g1/aMdEitGZtRwkEzVIw0AmkIciDGMLvSjEbT5TimwMpCcrWcxyfmV+
aqygFvXYOxz6sZOu/OQq0ydHALrTi/LT3DtxB/++fQ4TKdi04S+V57+CGtSguzSnQqEizoaSr5fg
JF37gvfDTAZwnt9TJO0Oybthzs+V7VTeGVs5zR76kKMD3R/wUinOhbp0KH17qTmt6DaZ2vSmOD2N
Q3JaTJr69KdA5ckDgho3nhr1qAslqlKXytSmkoQTTo2qVKdK1ekh9apYzapWt8pVs1X1q2ANq1jH
StaymvWsaE2rWn3a1ba69a1wjatcP7PWutq1NnPNq17xc9e++hVpew2sYM/z18IaNjxUOKxiF8vY
xjr2sZAt62AnS9niRPaymM2sZjdLkcq+kLOA8axoR0va0pqWj/xILT/+odrV+sS1rGVtaoGi2tf/
1vYnrV3tbXEL29byVre0/S1seSvc4dpWKMMFLm6FK9vdNre3s30uc23b2+Am97nGJYpvr5tb5lb3
t9hFbnRju9zuLve8zUVvdYGr3NPOzbjfde13g0te7Z43ufONb3yNMt7Xaje73KUvfO3r3wIDGLn3
tW5+lTLg8iJYwA8ucFD2q17xJtjAFWZvfd07n4cc2MHXnbCEh0Jh8soXwrE9cXZRPOILozfF1o2w
iC/cYPo6GMQSXrGMR9zeFsNYxh++cY4RrOIZa7jIwAXtX5Yi39lyt8bq7W+UQ3xiGvtXuc41sY1Z
TN3aBji9vt1yldO74Rb3GMv1BXB/1bzd26qZ/8A+HnCIy6zlHtf5x0fm8H08HGMcvzjOET6zm1EM
3Q3D17krDvOLz2xoOvMY0EG+cp9l+2c4L7rMB070ls3caEAft8F5hnGSleyYNJtay57e9KnH/ONV
s3jOpxazrKks5BnH2sUVbvScdbzjL2+a1Y8OdLDpTOshaxgspG5Ml6Vr7DU7OctDlnR5d+tlGyu6
08SW9X0R7eVrK7rbzh4vt6O7ayZXe9rUPrehxf1f/K4ZyOC1No5Xm2y+6Pne+G5LTPO9t3r7+98A
Rwm/B07wGAb84AhPuMIXzvCGF6bgEI84UxxOcaZK/OJ/QwbGN85x9wjuGxUPOUI6TvKS3zsUJv/H
uMghgo6Vp+UNKEu5zGdO85rb/OY4z7nOd24el/v850APell4TvS4Cv3oSE+60pfOdKoWncMQeLrU
p071qlsdN/v2zsihsnXCVQApX/9O2KPX9K4rBQBoB8BP0r52tfsE7f9Iu9vfPve5x/3ubweK3evO
97bHXe50qYDgxz74n4z9H4MnvOINr3jCGx4ohT/81xP/+MpTPvGTFzzjM194xHe+8j75fNgPvxTR
Uz70n4d85EX/+NSf3vGIv/pb7J732sOd7njP/e3/vva80373fcc97mkvF9LHPvTIB/3oF496yyff
+MtvvfOlLxTYWz8oxk++9kev/dKD/vjdrz7/9qcPe+UfX/KyZwvxf393tbtf97b3ffzZ7/b6z7/9
ue+9W6A/fvRLf/Ln93wCmH3cV4CQB36xR4DTF4AHOBTlh3yad3qeB4ENaH7hJ4Dj938VuH0JmIHp
1xXrFxTvN4Lwh3f2h3+1p3fyZ4LyN4Jsl4JssXwAeID+R4EAyH3np3nN54ADiIAz+Hw6uH1BmINB
mHrgR3oz6HgFiIQe+IDkF4E0yIQVmHniNxw7M1khqIIn6H4v+He3F3z5l4Jf+IJbGIZxgX5MWIMd
yICvd4QIuIBQSH3hV34/yIA8aIHUp4SRV4V4mH3fV4c3uIGep4N1+IYfqBTskYUsyILs13t7/6d/
KuiIWnh/IkhABxEVI3d9GMiBbOiDnWiIOEiBm/iGdMiJfuiJFhiKgHiHqHiBpaiJr5iB6Fd2ZpcU
gEd3dVeJjbiCYigUj/iLuniLxPcVEmh6Ech6NJiMouiDcQiBrtd5EuiGzsh5xziEpDiEPyiDhoh6
Urh5oTiI1Gh+0EiKeHiIS5F173GJXKeOf3OK6hF2tMiO5igV7nge9TiPMFV2whCP1IGP/viPABmQ
AjmQBFmQBrkV/JiQ0XGQDNmQDml1ChmRzfGQFFmRFklzEpmRyXGRB6kIcoOObFGLtiGSTqGRStY2
8ngbJNkUJglaXvh+vtd3t4iLkBgUK0kaW/8HOrWDQKjTkpwVgvUnk/qXi2ZoiQaxGyNnTZYEPT65
WUDZgigYlbxYezc5GgihTWAkPE2pWV4Yifjngl+oi5VIdkepG1eZOagDQjy0lZnllURpf7lIf0RR
lYBzEOtEP+LDln31FES5iDC5iIAJg+QxQ27kRBx5cTNZgo7YhV2Jiyd4HjrJPDyZUIcZWCD5FXQZ
GpmJFHp5WShZlrlxEFlAFZ1pV5V5mqiZmqq5mqwZFcIIfLAJd3I3jOaxi373kq2pZw8Rl70omLQJ
FJtpGq85ln9JlqXplJJYgopYk8ZJEMFRnGEIl8B5nD+5mI9ohjNJe8FZGrvnmzHpdhJhGdT/eVfC
mH+PyZz5CJrA0Z2N+IjjiZyR2Je2KZjbyZ2KCZPu+Z6ZtYtcyHeyWZ7TqZ69kZ1hyXuNqZ9+9UK/
mZp5wHGXeRX1SRoLehQIilmWlZJ2UaGGlZsc2qEe+hM18FK7yXaMeZ8v2Z+yWZO/GJvFSZsRihR7
N4xBCXcaCp9j2ZtSGZ3eOZTMeZ1C8aJGAXjnaaB2V6OaJaNiiZ83OpUwWIZLOqRAShR/OaSBaaT7
yZ6++JWOuaUGKoKzGX9dOZtQiqFSwZ7daXu3Z6V72RRUqqVDKpdPCqZTOaFecabLWZQfiph4SoJv
SpxxaqLXSada0aI4Kph5GnFkWKL3KaRC/6qiWsii5mmoddqFwEeTinqoo/WgSEmmZYqJamqajCOo
mMpvmop1nPqZn1pAgOARo9qqrvqqeYEKtXmmuKl38mmrlOqfXvqfJJqYbqGruBqUsOpZ4fATfcOf
tjqJWZqscjqfkhqlUsqYPsqCqeqZOwqmvLms2Cqn6BmpzTkQVwGd3hp/1QqqZzej3nqetBmoNImm
KOqVeDqo80mGkjqsgnWsf5qY6xqsvAiM2hqgg4MVlSql1Fquj9WjPAqJ+9qkgJmtfwqtBAud/qp2
BvtYipqdbkmwDCufvUqpkQixuzqjcAmbRlmxZ7U4omqvKlunKytxpfobIKsXJmtWLVuzNv97swiD
rN/JqynapATadr/XsTybsq4JtDEqsjirZ3aqsDoan0MRtAnbtEsKgiQapPGatKIlrnx6rUzqqH5p
qEjarVQxpVZLtFh7Vbv5nVCJtLVKq16Lru5aqwz7rQJRpsBKnGk6s5J1riW6tVLbtT4bln2Zo/Uq
r1N7p2c7Wk+ppPAamEybnLcatoU7tulalGabuHIluf45tIr5uP1qtCfqtVnxmnHZsZhrdDtFHiB7
ucaqt2TVOKx7unDlurS7ErJ7u55au7q7EQCwu777u8AbvML7GrhbvJ5VD+bEDsbbusPbvBWxvNBL
oc47vdRbvdZ7vdibvTMRvdybntr7vd3/G77M+73kW77me77UK77ii77s277u+76pqr7yO79/cwSU
9bL0mzY+6ROq0L+qwL/++7/8CxT/679BYcD/EMBEocAATMAH3L8JHMAQHMET7MA/IcADfMEWrMEb
PMASzMEdjMEJHMISjMEKLMIjTMAQXMIoDMAVTMEtDMMGjMIFjMAXbMM0fMMTnMMq/ME5XMIP/MIw
HMQmzMACzHRMIcIFbMEmDMJM3MEZnMEv3MI8HMUp7MRKrMFZbMVcvMQcTMUhrMVCUcVdPMYHXBRb
vMVDocYeDMJpfMZXPMJkHMYOHMNujMV4HMdcXJEx/MNW3Md7DMVyfMVgTMdo3MZx7MVR/1zIYvzF
a4zIWczIeqzHkjzJgVzJedzIKQzGfmzGgvzHZ2zHi7zHiqzJTmyRgFzHlPzIlnzKg9zEcJzJCwzJ
qlzLsYzIUszKXhzJnkzKt1zGrPzLrczGg5zLoXzMvRzIiYzMs2zMtmzKymyOD1HEpSzHmEzINuzK
u+zLUMzAcLzNo/zJq/zGngzOhHzLVAzEv2zH1DzJ7NzDJ4zDZtzJFCzDQozFQKzOOgzLz+zBRlyy
QYcCEUHPbTzHlyzMilzNq9zMtpzQp/zOdezNgNzE/EzGlXzRDI3LrgzKtczP0FzNIJ3RBF3O2uzO
Jk23QbcUI23OlpzKJU3RydzKLV3E8P9s0GXs0g98wzWNzjGN0cGs0cpMzA5t0iu90Mk80rEswJw8
zzHtj+zBy44czt8syOTcwOtsyN380OJ8zjL901wty0bNzRvN0cSM1cX81V/t0SH900i9wWqdx6Lc
lC68whId0TS8w9kMz/gcxN2c11oNzNFczwft1R69zEQc1oId2B8810Yh1IY9xD1MxGt91KG82Jns
zYzNzXKdv6iqkZzd2YmRAvALH00w2qZ92uHxCai92qxNG5/92rAd27KNmq39u7N927id27q927zd
276dVbXtu79ds8Fd3MZ93Mid3Mq93Mzd3M793NAd3eM53C0r3dZ93ZtF3ZzxDTunAdr/nbgulwqp
gN0mkX6p8N32Kt45VaxEJ3TjTd4gMY/njd6wqt70/arzfd+YqXTiDd8aIZD5rd9a4d96y1UETrxb
deClJuCjqjYF8OAF8A8QHuE+QeESLuEPDhQQ/hMTHuEWjuEbXuEfPuEgnuElruEhHuIlbuEmfuEV
DuIu/uIi3uIxfuEdHuMsPuMejtIKThk1juMynuMaHuRBMeJD0eIf/uNJzuFMTuFOfuRCHuVRThRI
ruRM/uJJHuE9zhhLseRGvuNXfuVPPuRhLuYyXuY/HuZgPuZk/uRGbuNYXhRrnuY7PudkzuD58RBO
nuFfnuVFjuQpjuJVjuMmTuIz/ueF/w7og77nRU7ka07jbn7icQ7mMH7hW54aXz7klG7lQl7mXq7i
TS7nd17naC7pm87mfH7nhE7ncO7lln7p49HloU7kQN7mZ37rfo7mm97oau7ibI7rvm7mwl7jmd7o
pM7reK4fDr7hhg7koJ7jN07i0a7pKS7toG7qTS7tmp7tp87hz07tKt7phq7lsJ4ZBl7umHHu6C4f
yd7u7n5x676V7+6h8V7v9n7v+P4S896h+Z6R+86h/R7wAk8o/56bA3/wCJ8dBb/wDN/wDv/wEM/j
CS90EV/xFg/cE990F7/xHN/xHl8aUlAVIQ8UI88UJe8TJ98WKf8bKy9TLd8UUvDyN/8l86HpECF/
80gR8zE/FClP80TR8z//Ezev81Nx8kb/DzR/9Evh80/R8jq/80qx8k+fFTIP9Uif9DBP9FuB80j/
81pfFEyv8kFR8mGf82QP9kTv9Chv8lOf8zw/9gDNE2zP9D4P9DAP92+/9mcfFUq/9kfR90lR9iaf
93dP8l1R9WQv+G4v9l1P+FiPF1Lf+FRh9WCP95bvFIpP+H7/HTj/+GMP9SM/9Wmf+Hrf+EZP+We/
90IB+l/f9pvf9UNP+ZJv+qwv+z2f+KyP8q3/9YZv+KFf+1ff+0I//G3v+lrf+bHv+7Cv+6Uf+6Qv
/CQP+rB//Kjv98h/9bY//MG//KP/H/rTP/RC//tWT/2r//tw7/16v/PjH/mmv/zaH/7MH/zir/uy
//rUL/3Y7/zxX/MN8fpBDxD/pAwU+M+glIIIDxZkqHAhwYQGJTqUGJHhxYoTLyJ0SHHgR44bK4Ik
2FGkRpQhH65kiXEiSIEKTZrM+HFhS5UWE8q8OTKix5g4G/qsqRHizIxDf/YEypIjT5FHbwJFmjKp
TqJRp2bdujOpTZcqc479ilJnyKoW7a1l29btW7hx5c6de9Xu3bJG9VaFarMjRK5OwV71q7cnRrRm
EWs97LHww8dnCRdl2nVyWrKYFSuVWdLwTsAuGZ+kuDTxyYNgYdLUzNlzy5ihY4tG/y12qmyYWMv+
td06q+bMn/EOJ17c+HHkv7XydUo6r+HSiyXTbCxZcfDq14W3bmqWes7dn7Fbz87TvHjaYdFXHvm0
eXbtlskOPQ87Ov3JlfsqrQ4+PP7pNqttOfTuS+5ABJOiq63kclMttdf6eq022VDbLLLOQqMqttKa
Um0wCDMMEULSHrywPRERG2y1DwEzEbLubhsvRRRT5I1G9uqTDkUKoeKMRNaOwk0qykbcbzbt/OMw
JalsFNAxH8XCcKEFq7TySroS1HJLLu8ysMvDGtzySy/BPLBDM9McU00223TzTTi7JDNON6+k8048
80NwTrtAzFNLNP+kk09BCzX0UP8z/VQQS0YbdVQuRCOVdFJKK4XzUUwz1XRTTjv19FNQQ13LUlJL
NfVUVFNVdVVWWbUzPTEDK47QO2k11VZBcYVVVVF79fVXYIMVdlgsT8MrtyLDnNXLyBr867IwHXzO
2QqXdbNDRfUs08eahnypQmmTTY5Ycss191x0z0Xy2OECRc5AXZl9CVo94U2QuuPiNc5dPmnllijH
vCvS3gTTNfhghBNWGC5jtf1WxqfcS22lfwNlUcgNjUXLP75KCq6zZEEuUcYRZ3MxQ5HLe1a68zzG
LUf4GPPr44lnW/hmnHPW2VNl85oSO24lVhLJGUVLjGbQCLQKMssW2+/p0WyzaLz//qpe+jR8QTwS
voajDArAf3YWe2yyD25zQ4qhI5k3dotWD2ysu20SYPG09klalAN8L2KqnW7RadPYs+9FFede+izC
W1V8ccZbBU7m5ljbNur4dIw7MPC8xldg9YKmHGqB+S0vLKH589Dqt7fT78nGW3f9dUodJHK1rqZs
zETaYcTcSNjexr1ZrYPPOkKMjxRR8m+hBHLgrbJWHdkTieb94Wxht/76xl/Fftft1+x+1bLDF398
g7Gv/nsu9UU/T/Lbd/997deXf37667f/fvzz139//vv3/3X15QtR1YrU0IgTQEAdME4ITFSuTsVA
Wd3rf5S6UsO+Ar129Wxd1uIg/+oIc74zca9P4jpgs8qUwX4R8IQaLJmcWPiuuznsYSP02btyByZd
WayD0fmXXeD3KRvOSV89bFqa3MU9CNIrVhIMIQoVKMIIytCFUHwiCwlGMBIK8IVL3BdlCOWiaU3w
TRYUl5SOx7bDYexrUpvhimJot6I4CUY3WtLUVva0FcHRKHkkHrva48V5Ee0+EZMVUrCWt6DMp41+
QtvFdEiiNYLMRtmiox29tiRkvUhiE8skmiTESUhiUIxhs9IWOVQ6oTwJjFMTDPOwRTseAklzBSrQ
1pYilM096HFE7JnymMe6WLpSZJb7keiGB8v1QHI0kUsm57zyOVriEpDvaV4M9f9WkB/yjE2iq10Z
N/KY+rysd40M2YAeJ82Szeyc6dHYcs73SmuGcoZ0K2Qybyg1jjUzY/o0J/XQabTQBfSfRXskaLqj
RmJubpTb/OUyR8eyVirniIpcXUWv6bZqws1Cb6TlER/aTesEM3UWdd7eUkfRfaYSpKxkpW+cqUiC
RlM3s5xWbwa6UDhNVI3fPOjy8FMxIiVpg9NT5j2NRLi/GZJJGtLlUs2oLNn11GQ7vRu4WoTSCRHz
gpe0mlE550bpyRGgFl1XVOfDx4qVKEZOEmsScfrW7iEQi/9zKw3rV1e4Hip+ed0eCI+lwlHilUf0
86vistkpviZWsYtlLF8P+1j/yEZWspOlbGXj0ljMZlazm+VsZz37WdCG9i6WJW1pTXta1KY2VKJl
bWtd+1rYxla2s6VtcVR7W9zmVre75W1vfftb4AZXuMMlbnGNe1zkJle5y2Vuc537XOhGV7rTdUtt
rXtd7GZXu9vlbncnRV3whle84yVvec17XvSyxbvrZW97F5de+MZXvvOlb33te9/jAgC/++Vvf/37
XwAH+FfuJXCBDSwpASdYwQtG7IEd/GAIR1jCE6ZwhS18YcYBQMMAuO5eW8dgEOt2w/Q9Dj8kYmKD
mBjFKT4xP1bcYhS72MVJkbGKZXxiHN/4xhjmcY+7t2Ig/+PFMcZxRohslxcL/7nIR1ZyRZLsYyhH
uVUqVjKTq2xkLDeZxlvOsZa9/GXswUPKY6atnahMZSHXGM1FZvOOlzzjIac5yywm5WPhEWI8Kxg5
Z25ynJP8Zy7TmcV+9nKQ0SdmMie6vXy2MpOf/Og5r/nIhpYfohV9ae9SOs4pnrGR4exmJ+vYzUHe
8ZOtZ2lMp1rVikX1ql2dWQ9n74d3znOtE/xqXOd6grHWda8V/Vg1ebSDTcSfYLW4p2Ffi3Rj/GJe
jf0fB4typF38oBAzmMUwno0/dqUisuNprWYP21aZy+mxjXhtbBN7i7wcIfROFjhzGzA+fLV2FP0o
xXSbUlLsjtmgmhjuKoYwRv8MpXaw0a1sexfxr7R5d+92+HB6VxtiUw3k5QCG1qh47JZUTdpgk3pG
pgkpeX8cKt7kKRjPdJKpdfzayGs2s6padXCE/InGS05VpXayhRX/0Muf2aSP81zkQu8Wy8Glm7Qd
rSHFKyffahrKwr7XSsfbi9r85nDTQfM2zIzj000KNeNZiKsZh1lCKZfGbTMnlxtNG9pn5/C06Gfs
KEWnedIKNK7PVHBZ91zHq650jJ6yner8mUZui7ZbspTqyqTnRVfqdN+V8+vVlFBWG9/T7+R98JXb
o4Y6b0vyLO90qQR93M++dKxaPm/fSbnVnW76ucudqWDtJuD5WfVoxZMswD7/NtIUr9GxrpM5cFfO
vPFZzB85M+sCdY7ZXUpTV0JbpT+9vHPELpzT2zRmw4dZ4o+P+WlCFOvzRr7Sp5/SkQZ+f1GduPEs
f7uzXjWsS90gzRcZdtBVfueol1vQPN9+tfIk+nO5qfKcXGo97wgqPIIno8EQPtoo21m8tYEc/kOe
AdQ9xus8bzI/TeKKjTm6AZS21+E1H3u2e/M1xpKrjLitSzPBrULBzFLBiuA9GKxBG4QdErxBHRyz
yLofF0yfvpqfH/RB70mgKYI4MCEb1yGTgashefG2fLmhSmnC8PsgJjqUIcShgxOQK1Q4cAPCI1Qg
flufHCyVVTohJszC4rOU/zOkoTRcQsfZQoI7HBjqNm4zwmUZQ+Towb+po5+xuTXyO4PqOv6rOZa7
GkCcm0m6N50rupGxI5d7Gf0zRFHSv4Y7pGFiJJe5I4wTnpZrqpa7Px5CpKHbGJ9jv0vsuXlpRAza
xIq7kD70OE1suEB0Rbk5xZqJLPBTqe9jGoAqqcHbmkfKv1rEt35iuK8TQGqiPl8cu+QLp2KENqlq
KZm6GrJLu9vDu5/ruuHTPr27PmB0vZO6vvOzurYrqTjaD12UKGtMxgnpHONzmwN8u0GEPRXKvFY0
HCn8w/9LpPWYR/wrPB5Zu4xTPTpEPpzQo9QDGtsxGQp8Pey7pIbkO1Bkvv9d3BHIK4zYG8iRU8KC
y76H3BHUWauzQ8ffu8jkW8OhIcavcqiRtD6R7EXmAz4MvMhwdLznoDuBkqqWEUeU5LtydKh8CsrQ
i7ueJMeMssPvKqU+nAmmc7+x8DyTFKuitCZLDMGgeqkMpD2HFEXG85Cs1EmT6spCnEjC86f2+79J
9KU2gsWz8qkJ7Ea4vDv6W7sgUSg/tKqNLMsIgUCE4pEe1EE1ZENdG8ylpEEUjDr0MczuYkwEg6wd
jEz0sbUskUzLvB7KrIuPzLfBdMzYCaxg88w5PEFDwctFYTBtu8MiMkFhw0PVVMoV8sIwdEJqGzc5
zDfcTLiAS83bRMMGkrf/yPySQdI3LRyj3mygxjM43zQ35IzN4xxN3iTN54RC0XwtO2G6/QMnkcMb
jHvBS2ye7hS6TKSYYcrLTcLOlWtE6kEjmCM5jZOS9QwpT+pEDWy9Y5q/z8sRkJs/TWyhfBy5ICHP
jlNEb9m4QJKIzISUmxIqatq8XmoaB61KvbG73NNGbxxK7kPI0LPKmlEdADFAmYq/iJQ7QvxQ0tsj
Kzo9DDxJ0KEPdrO9pknQyxLImKRA72O7Z3SZEK0RmWlIjfRJGpWPQ2xR0OtK/yO3D7Ub4VupbzS9
kEK9sLMP72wmsgynCARAVTqakwmNENOiwEM8NorQvoNGIkVKG7U+B9UR/6EkK2vER0ASRik1UWkE
SRCtvliSnB4K0/Rb0KSExpaMU867nNaUsgicxUIMkLsc0wlsOyi9ReQBHtETxyqt0AvMUaqUHqxo
SrGTSqc6KjUdK0xd0cLBVE0akvgzVf/kyL34y620zxCssDLEQthUtx2sTtGSUbggFcUcE8BKTB7E
VWANVmGVrsssVmPVq2FNVmUl1mNtVmd9VmiNVmmdVmqtVmu9VmzNVm3dVm7tVm/9VnANVzfxAWzl
hG9dVnRNV3VdV3Zt114RV3iNV3mdVwdzV3u9V3zNV33dV37tV381myhjAHod2FVjAIElWIRNNINN
WIY9TTwz2H+NWNSysP+FbViL5bGKvViN3ViO7ViP/VjMLCWQ7ZJ8kNZaM4h8SNmSVdmU/QeWLdmM
UFmJgFmUrYiXdVmbdVmWtVmabVmaxdmfvVmZ3VmdXdmcndmWRdmkxdmZ5dmlVdqePVqeRdqfhVqm
rVmivVqm3VmhXdqoxYustdqabdqVDdug5Vqz5dqcldmirdqipVqYTdue9Vq1Jdu19dm61dq0ddq4
ZduxvVq/DVq+/Vuj5S/kqFq31dqmHVuvTYqvxVq7oFu9VdzJBVzGlVrCXdzGXVzLvVzORVrNdVyl
tVvPhVzRLV2jHY7H/drGfdzPTdzE7VzPjd3OjVrWDd3KndzNFVzS5dz/uf1cyu3d233d0I1b97oS
t4Xd07Vb441Z4o1do43etV3ercVd3sVd5v1b3XXe651d7b1c4xVc8b2K4QVa4hjf6W1e4M1dzJVa
3lVf551e0zVf+b3e8W3e7k1d3/Xe9q1f7sXc2zVewzWOvi3bp03e/6Vf9+3apzVf6e1d4m1b7FVc
+KVf/d1e+f1e/G1g771gDxZbwm3g5D3gDDbdC6bcsyVh8oXbpJ1bxE1gBT5hA45fDE7d7kVh66Va
HV7eF85fv5Xd9ULeEl7fHgZdGkbf0w3fIa7c4b3hCtZfFZ5fKUZctj1h1P1gJ97fFz7fIYbiLQbg
FQ5jJqbeHq7iKv7f/y9G4hZu3xGmWw7+4v0tYfvd35O1XTF2X+1F4DwO3upVYD/e49oF5DjuY0Fe
XUGu4STOYPhN4wmmXTzOXPbF4fXlY9etYAqeYEnu4zmG4EWmYeDN4v7d5PwdZIM4WQm+2e/d4UgG
YgOOYsY14819W6IdWlrGWxeOYKilYhduZQzWW5+92wOG5U0G4rsI27c9ZBSu5Vg+YmCWYMdd5uAN
XFKe5WbWYOrVXWG+42PO5Zj94agd4JEN5/aKVXHuVnAuZ3ROZ3VeZ3ZuZ3d+Z3iOZ3me58VxBnq+
Z3zOZ33eZ+2SWH/+54ThZ4HGKYAuaIMml4FOaIVe6Bo8aId+aIiOaP+JxhmGrmiLvmiMzuh0nmiO
7miP/miQZhSNHmmSLunjDWmU7miTXmmWbmnZSmmYjmmZnul9dWmbRhWUzgOa3mme7ulhvWmgDupq
VYOG9mmjPmqkTmqlXmqmtiyhfmqojur9aWqqrmqrvmqsjugkyOqAlmqv/mqwDmuxHmuyLmuzPmu0
JjOuXmvUTGu3Jg62fq4CiGu6rmt2fWu8zmu93mu+7uti3Qe/DuzZsmvCxi/BPmzEDuvCXmzGbmzH
bpTETuvHnmzKrmzLvmzMzmzN3mzO7mzxiWy4YgbQHu2k4DBX8+x91TDUXm3e0i93JW3R0rBeY212
VW18hW3PMm3c9moX2d5t3vZt3tZt4B7uCKNt484t4vbqgAAAOw==

------=_NextPart_000_000F_01C6F492.C51D9290--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KGjqOg027321; Fri, 20 Oct 2006 09:45:52 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KGjq05027320; Fri, 20 Oct 2006 09:45:52 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from stingray.missi.ncsc.mil (stingray.missi.ncsc.mil [144.51.50.20]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KGjpGP027304 for ; Fri, 20 Oct 2006 09:45:51 -0700 (MST) (envelope-from [email-masked])
Received: from gto.missi.ncsc.mil (goodman.missi.ncsc.mil [144.51.60.3]) by stingray.missi.ncsc.mil with ESMTP id k9KGqJud012919; Fri, 20 Oct 2006 12:52:20 -0400 (EDT)
Received: from EXCH.missi.ncsc.mil ([144.51.60.21]) by gto.missi.ncsc.mil with Microsoft SMTPSVC(5.0.2195.6713); Fri, 20 Oct 2006 12:45:42 -0400
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-MimeOLE: Produced By Microsoft Exchange V6.5
Subject: RE: RFC 3280 and trust anchor selection
Date: Fri, 20 Oct 2006 12:45:41 -0400
Message-ID:
In-reply-to:
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: RFC 3280 and trust anchor selection
Thread-Index: Acb0P6kLD2pVQkybSDSBvYdmZaTKkgAI6HDA
From: "Kemp David P."
To: "Ville Heikkala" ,
X-OriginalArrivalTime: 20 Oct 2006 16:45:42.0236 (UTC) FILETIME=[2E4EC1C0:01C6F467]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9KGjqGP027315
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

If the trust anchor is derived from SubCA, EE will validate.

This is not a contradiction or paradox when you consider section
6.1.1(d):

--------------------
(d) trust anchor information, describing a CA that serves as a
trust anchor for the certification path. The trust anchor
information includes:

(1) the trusted issuer name,

(2) the trusted public key algorithm,

(3) the trusted public key, and

(4) optionally, the trusted public key parameters associated
with the public key.
--------------------

This means that a trust anchor, which is installed out-of-band,
does not need to be provided in the form of a certificate at all,
whether self-signed or not. If the trust anchor information does
happen to be contained in a certificate, no information from
that certificate except 1-4 above is included in the trust anchor.

When SubCA's cert is included in the path, the policy conflict
occurs. When SubCA's name and public key is used as a trust
anchor, there is no policy conflict.

When SubCA's name and public key is used as the trust anchor,
SubCA's certificate cannot possibly be part of the path because
the certificate is issued by RootCA, not self-issued.

Dave

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Ville Heikkala
Sent: Friday, October 20, 2006 7:00 AM
To: [email-masked]
Subject: RFC 3280 and trust anchor selection

[...]

According to the above quote (first paragraph) we may choose either
RootCA or SubCA as the trust anchor. And I've seen real-life setups
similar to this one where SubCA was chosen as the trust anchor.

Now, having RootCA as the trust anchor means that EE will not validate
because its policy doesn't match that of SubCA.

However, having SubCA as the trust anchor, EE will validate if SubCA is
not included in the path and will not validate if SubCA is included.

Which way is it?

Thanks,

Ville Heikkala
SSH Communications Security Corp.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KGMXIt025088; Fri, 20 Oct 2006 09:22:33 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KGMXn4025087; Fri, 20 Oct 2006 09:22:33 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail-eur1.microsoft.com (mail-eur1.microsoft.com [213.199.128.139]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KGMVTX025078 for ; Fri, 20 Oct 2006 09:22:32 -0700 (MST) (envelope-from [email-masked])
Received: from EUR-MSG-11.europe.corp.microsoft.com ([65.53.193.197]) by mail-eur1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 20 Oct 2006 17:22:27 +0100
x-mimeole: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: RE: Comments on draft-santesson-pkix-vccrl-00.txt
Date: Fri, 20 Oct 2006 17:22:24 +0100
Message-ID:
In-Reply-To:
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Comments on draft-santesson-pkix-vccrl-00.txt
Thread-Index: Acb0KakfmIJi9MT0RtWPS2MP2l0NuwAOIV3A
References:
From: "Stefan Santesson"
To: "Denis Pinkas" , "pkix"
X-OriginalArrivalTime: 20 Oct 2006 16:22:27.0659 (UTC) FILETIME=[EF1331B0:01C6F463]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9KGMXTX025081
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Denis,

I will choose to disregard the comments on your perceived shortcomings
of RFC 3280 CRL validation. They are neither improved nor degraded by
this specification. It is a discussion that belongs with RFC3280bis,
which I think we already have deabeted for a long time.

If you have any reason to believe that this specification makes the
problem worse, then I'm all ear.

> This has further direct consequences whether the proposed extension
> should be:
>
> ValidationCertificates ::= SEQUENCE of Certificate
> or
> ValidationCertificate ::= Certificate

This reflects the solution defined in the AIA in CRL RFC which allows
multiple certificates to be referenced.
The relying party is responsible for doing the chain building and will
use the certificates that the RL regards as useful for its set trust
policy.

The source of the certificates does not change anything in this regard.

> Besides these points, the proposal should be rejected on the basis
that
> if a CA chooses to use this extension,
> all CRLs will inflate in size.
>
> The idea would be acceptable if the CA would be able to continue to
> issue current CRLs, and, in addition,
> could also issue augmented CRLs with this extension. However the
> proposal does not allow for this.

This specification is silent on this topic, with purpose, as it only
defines a OPTIONAL extension.
All CRL's will not inflate in size if 1 CRL is amended with certificates
and a CA may issue several CRLs.

The introduction of the document is very clear that this is not an
optimal solution for all environments, hence the extension is optional.
It is however very useful in some environments and those environments
would benefit from a standardized way to do this.

Stefan Santesson
Senior Program Manager
Windows Security, Standards
> -----Original Message-----
> From: [email-masked] [mailto:owner-ietf-
> [email-masked]] On Behalf Of Denis Pinkas
> Sent: den 20 oktober 2006 01:16
> To: pkix
> Subject: Comments on draft-santesson-pkix-vccrl-00.txt
>
>
> General comment
>
> This draft should not be taken as a WG item and should not amend RFC
> 3280 as it is proposed.
>
> Detailed comments
>
> The Security Considerations section states:
>
> Any use of certificates provided in the Validation Certificates CRL
> extension, to validate signatures on a CRL, MUST be done according
> rules and conventions defined in RFC 3280.
>
> This is incorrect since the rules and conventions defined in RFC 3280,
> when the CRL is not signed
> by the key of the CA, are insecure, very hazy and thus do not allow
for
> interoperability.
>
> These rules do not address the cases where:
>
> a) two CAs in different branches of a certification tree would
> have the same DN, and
>
> b) two CAs in different trees of a certification forest would
have
> the same DN.
>
> The impact is important because, with these insufficiently defined
> rules of today, a certification path for a CRL
> might be fully different from a certification path for a target
> certificate, but the path validation rules are silent about this.
>
> There are indeed security attacks possible with these loose rules.
>
> The consequences are:
>
> a) when CA name collision is taken into consideration, a SINGLE
> certificate is missing since
> the certification path of the target certificate MUST be used.
>
> b) when CA name collision is not taken into consideration,
different
> certification path would be needed,
> and thus a SEQUENCE of certificates would be needed.
>
> This has further direct consequences whether the proposed extension
> should be:
>
> ValidationCertificates ::= SEQUENCE of Certificate
> or
> ValidationCertificate ::= Certificate
>
>
> Besides these points, the proposal should be rejected on the basis
that
> if a CA chooses to use this extension,
> all CRLs will inflate in size.
>
> The idea would be acceptable if the CA would be able to continue to
> issue current CRLs, and, in addition,
> could also issue augmented CRLs with this extension. However the
> proposal does not allow for this.
>
> Denis
>
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KExhgu016962; Fri, 20 Oct 2006 07:59:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KExhXJ016961; Fri, 20 Oct 2006 07:59:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KExhoo016953 for ; Fri, 20 Oct 2006 07:59:43 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: SCVP ASN.1
Date: Fri, 20 Oct 2006 07:59:37 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: SCVP ASN.1
Thread-Index: Acb0WFxphX8nHuRERy6j85Pk+4icPg==
From: "Carl Wallace"
To:
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9KExhoo016956
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

The SCVP module includes at least two structures that have the same name
as structures in other modules. IssuerSerial is defined with the same
syntax in ExtendedSecurityServices and with different syntax in
PKIXAttributeCertificate. CertID is defined with different syntax in
OCSP. I suggest changing the SCVP module to import IssuerSerial from
ESS and to change the name of CertID to SCVPCertID.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KEFscR013094; Fri, 20 Oct 2006 07:15:54 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KEFsac013093; Fri, 20 Oct 2006 07:15:54 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mailout.fastq.com (mailout.fastq.com [204.62.193.66]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KEFqNb013084 for ; Fri, 20 Oct 2006 07:15:53 -0700 (MST) (envelope-from [email-masked])
Received: from mmyerslaptop (dslstat-bvi4-403.fastq.com [65.39.91.150]) by mailout.fastq.com (8.11.6-2003091800/8.11.3.FastQ-MailOut) with SMTP id k9KEFa256967; Fri, 20 Oct 2006 07:15:39 -0700 (MST) (envelope-from [email-masked])
From: "Michael Myers"
To: "Stephen Farrell" , "Santosh Chokhani"
Cc:
Subject: RE: Son of RFC3280 path validation rules
Date: Fri, 20 Oct 2006 05:39:01 -0800
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
In-Reply-To: <[email-masked]>
Importance: Normal
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

I concur.

Mike

-----Original Message-----
From: Stephen Farrell
Sent: Friday, October 20, 2006 4:05 AM
>
> . . .
>
> We should push 3280 bis out the door now.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KCHHK2000822; Fri, 20 Oct 2006 05:17:17 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KCHHsG000821; Fri, 20 Oct 2006 05:17:17 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from imx2.tcd.ie (wpad.iss.tcd.ie [134.226.1.156]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KCHFVU000811 for ; Fri, 20 Oct 2006 05:17:16 -0700 (MST) (envelope-from [email-masked])
Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 7E1E468127; Fri, 20 Oct 2006 13:17:10 +0100 (IST)
Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A041457A9E4; Fri, 20 Oct 2006 13:17:10 +0100
Received: from [127.0.0.1] (unknown [134.226.144.16]) by imx2.tcd.ie (Postfix) with ESMTP id 7864268127; Fri, 20 Oct 2006 13:17:10 +0100 (IST)
Message-ID: <[email-masked]>
Date: Fri, 20 Oct 2006 13:17:55 +0100
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Denis Pinkas
Cc: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
References:
In-Reply-To:
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiVirus-Status: MessageID = A141457A9E4
X-AntiVirus-Status: Host: imx2.tcd.ie
X-AntiVirus-Status: Action Taken:
X-AntiVirus-Status: NONE
X-AntiVirus-Status: Checked by TCD Vexira. (version=1.56.3 VDF=8.1366)
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Denis,

Denis Pinkas wrote:
> You are proposing to write an I-D to add a single sentence like:
> "The certificate from the CRL Issuer MUST be issued by the CA that has issued the target certificate."
> I suspect you are kidding.
>
> The alternative would be to add in the security considerations section :
>
> "The path validation algorithm provides no protection in case two CRL Issuers under the same trust anchor
> would happen to have the same DN".

No, I meant writing an I-D that justifies a correct version of that
sentence, ("no protection" being vastly overstated) - explaining how
that collision might actually happen in the real world, and not in
Hollywood; the many, many simple ways to avoid such a collision, and
the actual consequences (as opposed to the above) if the collision
does occur, including perhaps a consideration of the reasonable
impact on a CA's general trustworthiness if it hasn't managed to
pick itself a unique name. Maybe 5 pages.

Stephen.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KC40c8099072; Fri, 20 Oct 2006 05:04:00 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KC40Da099071; Fri, 20 Oct 2006 05:04:00 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from imx2.tcd.ie (imx2.tcd.ie [134.226.1.156]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KC3wIm099061 for ; Fri, 20 Oct 2006 05:03:59 -0700 (MST) (envelope-from [email-masked])
Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 0E3C5680D1; Fri, 20 Oct 2006 13:03:53 +0100 (IST)
Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A03A050AC94; Fri, 20 Oct 2006 13:03:53 +0100
Received: from [127.0.0.1] (unknown [134.226.144.16]) by imx2.tcd.ie (Postfix) with ESMTP id 003D5680D1; Fri, 20 Oct 2006 13:03:52 +0100 (IST)
Message-ID: <[email-masked]>
Date: Fri, 20 Oct 2006 13:04:39 +0100
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Santosh Chokhani
Cc: [email-masked]
Subject: Re: Son of RFC3280 path validation rules
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiVirus-Status: MessageID = A13A050AC94
X-AntiVirus-Status: Host: imx2.tcd.ie
X-AntiVirus-Status: Action Taken:
X-AntiVirus-Status: NONE
X-AntiVirus-Status: Checked by TCD Vexira. (version=1.56.3 VDF=8.1366)
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Santosh Chokhani wrote:
> Steve,
>
> ... when I briefed the stuff in 2004,
> there was no support for doing this.

Exactly.

We should push 3280 bis out the door now.

S.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBoMqo097420; Fri, 20 Oct 2006 04:50:22 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KBoMQm097419; Fri, 20 Oct 2006 04:50:22 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBoKta097412 for ; Fri, 20 Oct 2006 04:50:21 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-001.frcl.bull.fr [129.184.87.31]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id NAA42896 for ; Fri, 20 Oct 2006 13:52:40 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006102013501705:11493 ; Fri, 20 Oct 2006 13:50:17 +0200
Date: Fri, 20 Oct 2006 13:50:15 +0200
From: "Denis Pinkas"
To: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 20/10/2006 13:50:17, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 20/10/2006 13:50:19, Serialize complete at 20/10/2006 13:50:19
Message-ID:
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="iso-8859-1"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Stephen,

>Hi Santosh,

>That's true. What I meant however, was an I-D. If no-one wants to
>write one then maybe this isn't actually such a pressing problem.

You are proposing to write an I-D to add a single sentence like:
"The certificate from the CRL Issuer MUST be issued by the CA that has issued the target certificate."
I suspect you are kidding.

The alternative would be to add in the security considerations section :

"The path validation algorithm provides no protection in case two CRL Issuers under the same trust anchor
would happen to have the same DN".

Denis

>S.
>
>Santosh Chokhani wrote:
>> Steve,
>>
>> Text has already been written and briefed to the PKIX group as early as
>> November 2004. See the slides and minutes from Nov 2004 IETF in
>> Washington DC
>>
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]]
>> On Behalf Of Stephen Farrell
>> Sent: Friday, October 20, 2006 5:44 AM
>> To: Denis Pinkas
>> Cc: [email-masked]
>> Subject: Re: Son of RFC3280 path validation rules
>>
>>
>>
>> Hi Denis,
>>
>> Denis Pinkas wrote:
>>
>>> ...the sentence : "The trust anchor for the certification path
>>> MUST be the same as the trust anchor used to validate the target
>> certificate" does not allow
>>> to address the cases where:
>>
>> As it happens I disagree with you but that was done to death on the
>> list before I think.
>>
>>> a) two CAs in different branches of a certification tree would
>> have the same DN, and
>>> b) two CAs in different trees of a certification forest would
>> have the same DN.
>>> Dave, the text of son-of-RFC328 is currently insufficient to enable
>> secure implementations.
>>
>> That strikes me as a wild overstatement almost akin to saying that
>> we should spend forever figuring out how to handle cases where two
>> CAs end up with the same private key and never mind making any
>> progress in the meantime.
>>
>> I think the current text is fine, an improvement on 3280, and well
>> worth proceeding with.
>>
>> I suggest that you write up a separate document that says how to
>> handle the corner cases above.
>>
>> Stephen.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBeiOR096639; Fri, 20 Oct 2006 04:40:44 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KBeiFw096638; Fri, 20 Oct 2006 04:40:44 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBehGS096629 for ; Fri, 20 Oct 2006 04:40:43 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: RE: Son of RFC3280 path validation rules
Date: Fri, 20 Oct 2006 04:41:57 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Son of RFC3280 path validation rules
Thread-Index: Acb0PDpqVI5JE2LjQieH4kEf8wkQYAAAF9Eg
From: "Santosh Chokhani"
To: "Stephen Farrell"
Cc: "Denis Pinkas" ,
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9KBehGS096633
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Steve,

Writing an I-D will be a breeze. But, when I briefed the stuff in 2004,
there was no support for doing this.

-----Original Message-----
From: Stephen Farrell [mailto:[email-masked]]
Sent: Friday, October 20, 2006 7:39 AM
To: Santosh Chokhani
Cc: Denis Pinkas; [email-masked]
Subject: Re: Son of RFC3280 path validation rules

Hi Santosh,

That's true. What I meant however, was an I-D. If no-one wants to
write one then maybe this isn't actually such a pressing problem.

S.

Santosh Chokhani wrote:
> Steve,
>
> Text has already been written and briefed to the PKIX group as early
as
> November 2004. See the slides and minutes from Nov 2004 IETF in
> Washington DC
>
> -----Original Message-----
> From: [email-masked]
[mailto:[email-masked]]
> On Behalf Of Stephen Farrell
> Sent: Friday, October 20, 2006 5:44 AM
> To: Denis Pinkas
> Cc: [email-masked]
> Subject: Re: Son of RFC3280 path validation rules
>
>
>
> Hi Denis,
>
> Denis Pinkas wrote:
>
>> ...the sentence : "The trust anchor for the certification path
>> MUST be the same as the trust anchor used to validate the target
> certificate" does not allow
>> to address the cases where:
>
> As it happens I disagree with you but that was done to death on the
> list before I think.
>
>> a) two CAs in different branches of a certification tree would
> have the same DN, and
>> b) two CAs in different trees of a certification forest would
> have the same DN.
>> Dave, the text of son-of-RFC328 is currently insufficient to enable
> secure implementations.
>
> That strikes me as a wild overstatement almost akin to saying that
> we should spend forever figuring out how to handle cases where two
> CAs end up with the same private key and never mind making any
> progress in the meantime.
>
> I think the current text is fine, an improvement on 3280, and well
> worth proceeding with.
>
> I suggest that you write up a separate document that says how to
> handle the corner cases above.
>
> Stephen.
>
>
>
>
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBcJ6b096434; Fri, 20 Oct 2006 04:38:19 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KBcJNf096433; Fri, 20 Oct 2006 04:38:19 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from imx2.tcd.ie (wpad.iss.tcd.ie [134.226.1.156]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBcHTw096425 for ; Fri, 20 Oct 2006 04:38:18 -0700 (MST) (envelope-from [email-masked])
Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 3EB7E6804A; Fri, 20 Oct 2006 12:38:12 +0100 (IST)
Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A02BA83B6BD; Fri, 20 Oct 2006 12:38:12 +0100
Received: from [127.0.0.1] (unknown [134.226.144.16]) by imx2.tcd.ie (Postfix) with ESMTP id 38E346804A; Fri, 20 Oct 2006 12:38:12 +0100 (IST)
Message-ID: <[email-masked]>
Date: Fri, 20 Oct 2006 12:38:58 +0100
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Santosh Chokhani
Cc: Denis Pinkas , [email-masked]
Subject: Re: Son of RFC3280 path validation rules
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiVirus-Status: MessageID = A12BA83B6BD
X-AntiVirus-Status: Host: imx2.tcd.ie
X-AntiVirus-Status: Action Taken:
X-AntiVirus-Status: NONE
X-AntiVirus-Status: Checked by TCD Vexira. (version=1.56.3 VDF=8.1366)
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Santosh,

That's true. What I meant however, was an I-D. If no-one wants to
write one then maybe this isn't actually such a pressing problem.

S.

Santosh Chokhani wrote:
> Steve,
>
> Text has already been written and briefed to the PKIX group as early as
> November 2004. See the slides and minutes from Nov 2004 IETF in
> Washington DC
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> On Behalf Of Stephen Farrell
> Sent: Friday, October 20, 2006 5:44 AM
> To: Denis Pinkas
> Cc: [email-masked]
> Subject: Re: Son of RFC3280 path validation rules
>
>
>
> Hi Denis,
>
> Denis Pinkas wrote:
>
>> ...the sentence : "The trust anchor for the certification path
>> MUST be the same as the trust anchor used to validate the target
> certificate" does not allow
>> to address the cases where:
>
> As it happens I disagree with you but that was done to death on the
> list before I think.
>
>> a) two CAs in different branches of a certification tree would
> have the same DN, and
>> b) two CAs in different trees of a certification forest would
> have the same DN.
>> Dave, the text of son-of-RFC328 is currently insufficient to enable
> secure implementations.
>
> That strikes me as a wild overstatement almost akin to saying that
> we should spend forever figuring out how to handle cases where two
> CAs end up with the same private key and never mind making any
> progress in the meantime.
>
> I think the current text is fine, an improvement on 3280, and well
> worth proceeding with.
>
> I suggest that you write up a separate document that says how to
> handle the corner cases above.
>
> Stephen.
>
>
>
>
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBB8sp094137; Fri, 20 Oct 2006 04:11:08 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KBB8cC094136; Fri, 20 Oct 2006 04:11:08 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KBB8ob094108 for ; Fri, 20 Oct 2006 04:11:08 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Subject: RE: Son of RFC3280 path validation rules
Date: Fri, 20 Oct 2006 04:12:17 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Son of RFC3280 path validation rules
Thread-Index: Acb0Nwa6bMU3Ch4OSDqIx4H7vutDRgAAXPWw
From: "Santosh Chokhani"
To: "Stephen Farrell" , "Denis Pinkas"
Cc:
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k9KBB8ob094131
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Steve,

Text has already been written and briefed to the PKIX group as early as
November 2004. See the slides and minutes from Nov 2004 IETF in
Washington DC

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Farrell
Sent: Friday, October 20, 2006 5:44 AM
To: Denis Pinkas
Cc: [email-masked]
Subject: Re: Son of RFC3280 path validation rules

Hi Denis,

Denis Pinkas wrote:

> ...the sentence : "The trust anchor for the certification path
> MUST be the same as the trust anchor used to validate the target
certificate" does not allow
> to address the cases where:

As it happens I disagree with you but that was done to death on the
list before I think.

>
> a) two CAs in different branches of a certification tree would
have the same DN, and
>
> b) two CAs in different trees of a certification forest would
have the same DN.
>
> Dave, the text of son-of-RFC328 is currently insufficient to enable
secure implementations.

That strikes me as a wild overstatement almost akin to saying that
we should spend forever figuring out how to handle cases where two
CAs end up with the same private key and never mind making any
progress in the meantime.

I think the current text is fine, an improvement on 3280, and well
worth proceeding with.

I suggest that you write up a separate document that says how to
handle the corner cases above.

Stephen.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KB0Srw093067; Fri, 20 Oct 2006 04:00:28 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KB0Sd9093066; Fri, 20 Oct 2006 04:00:28 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.xenetic.net (smtp.xenetic.net [217.77.192.129]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KB0QBN093048 for ; Fri, 20 Oct 2006 04:00:27 -0700 (MST) (envelope-from [email-masked])
Received: from SSHEXCH1.ad.ssh.com (sshexch1.ad.ssh.com [217.77.200.204] (may be forged)) by smtp.xenetic.net (8.13.3/8.13.3) with ESMTP id k9KB2qgP063401 for ; Fri, 20 Oct 2006 14:02:53 +0300 (EEST) (envelope-from [email-masked])
Received: from torni.hel.fi.ssh.com ([10.1.0.43]) by SSHEXCH1.ad.ssh.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 20 Oct 2006 14:00:19 +0300
Date: Fri, 20 Oct 2006 14:00:19 +0300 (EET DST)
From: Ville Heikkala
X-X-Sender: [email-masked]
To: [email-masked]
Subject: RFC 3280 and trust anchor selection
Message-ID:
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-OriginalArrivalTime: 20 Oct 2006 11:00:19.0830 (UTC) FILETIME=[EECA8960:01C6F436]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Dear all,

draft-ietf-pkix-rfc3280bis-05.txt states in section 6 that, quote,

The selection of a trust anchor is a matter of policy: it could be
the top CA in a hierarchical PKI; the CA that issued the verifier's
own certificate(s); or any other CA in a network PKI. The path
validation procedure is the same regardless of the choice of trust
anchor. In addition, different applications may rely on different
trust anchors, or may accept paths that begin with any of a set of
trust anchors.

and later on

To meet this goal, the path validation process verifies, among other
things, that a prospective certification path (a sequence of n
certificates) satisfies the following conditions:

(a) for all x in {1, ..., n-1}, the subject of certificate x is
the issuer of certificate x+1;

(b) certificate 1 is issued by the trust anchor;

(c) certificate n is the certificate to be validated (i.e., the
target certificate); and

(d) for all x in {1, ..., n}, the certificate was valid at the
time in question.

A certificate MUST NOT appear more than once in a prospective
certification path.

When the trust anchor is provided in the form of a self-signed
certificate, this self-signed certificate is not included as part of
the prospective certification path.

According to the first quoted paragraph above, we have some freedom in
choosing the trust anchor. The last paragraph above seems to imply that
only self-signed trust anchors are excluded from the prospective
certification path. However, (b) above seems to imply that any trust
anchor (self-signed or not) would not be included in the path. The same
impression is given by section "6.1.1 Inputs" where we have

(a) a prospective certification path of length n.

and, as a separate input,

(d) trust anchor information, describing a CA that serves as a
trust anchor for the certification path. The trust anchor
information includes: ...

My question is: are all kinds of trust anchors to be excluded from the
path or only self-signed ones? This came up when considering the following
kind of hierarchy:

RootCA (self-signed)

SubCA issued by RootCA with certificatePolicies containing some policy A
and having PolicyConstraints/requireExplicitPolicy equal to 0 (I'm not
sure if this is relevant though)

EE with another policy B different from A

Assume that neither A nor B is anyPolicy.

According to the above quote (first paragraph) we may choose either
RootCA or SubCA as the trust anchor. And I've seen real-life setups
similar to this one where SubCA was chosen as the trust anchor.

Now, having RootCA as the trust anchor means that EE will not validate
because its policy doesn't match that of SubCA.

However, having SubCA as the trust anchor, EE will validate if SubCA is
not included in the path and will not validate if SubCA is included.

Which way is it?

Thanks,

Ville Heikkala
SSH Communications Security Corp.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KAjh8c091082; Fri, 20 Oct 2006 03:45:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9KAjhjs091081; Fri, 20 Oct 2006 03:45:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from edelweb.fr (edelweb.fr [212.234.46.16]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9KAjflb091073 for ; Fri, 20 Oct 2006 03:45:42 -0700 (MST) (envelope-from [email-masked])
Received: from [193.51.14.5] (localhost [127.0.0.1]) by edelweb.fr (8.11.7p1+Sun/8.11.7) with ESMTP id k9KAjbl08536; Fri, 20 Oct 2006 12:45:37 +0200 (MEST)
Received: from [193.51.14.5] (emeriau.edelweb.fr [193.51.14.5]) by edelweb.fr (nospam/2.4); Fri, 20 Oct 2006 12:45:37 +0200 (MET DST)
Message-ID: <[email-masked]>
Date: Fri, 20 Oct 2006 12:43:41 +0200
From: Peter Sylvester
User-Agent: Thunderbird 1.5 (X11/20051025)
MIME-Version: 1.0
To: Stephen Farrell
CC: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms080104090807090503090708"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a cryptographically signed message in MIME format.

--------------ms080104090807090503090708
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

I propose to consider the following:

1 - "The basic path algorithm may be extended to have a different trust
anchor
for crl path validation."

2 - "When the basic path algorithm is extended to use multiple trust
anchors, i.e.,
several trust anchors for end entities and may be others for crl paths,
then this algorithm is logically implemented as running the basic
algorithm
for each of the trust anchors independantly with the desired
combinations of
end entity path trust anchors and crl path trust anchors.

--------------ms080104090807090503090708
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOpDCC
BHIwggLfoAMCAQICBgoMz+gAPzANBgkqhkiG9w0BAQUFADBbMQswCQYDVQQGEwJGUjEQMA4G
A1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVs
UEtJIEVkZWxXZWIgUGVyc0dFTjAeFw0wNTAxMDYxMjI3MTlaFw0wNzAzMTcxMjI3MTlaMHAx
CzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQLDA9TZXJ2aWNlIEVkZWxQ
S0kxNTAzBgNVBAMMLFBldGVyIFNZTFZFU1RFUiA8UGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIu
ZnI+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDn/izyem7Z1pUP/gpQDSzeGA/ZP4vo
VaCxcPWyssTYTAl6csAql2IIcYNVb6funaMNOY1q5oSNtlguFpOK3atQElBIMsfSh0CTuvUq
q2QDz1nHWOB96aU8G81+ZmC+iQOCAdG3qKWvMOzC0SzxKGbhTqDsjBvfYYk1Jk/Rb5TK0wID
AQABo4IBLjCCASowYgYDVR0RBFswWYEaUGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIuZnKkOzA5
MQswCQYDVQQGEwJGUjEQMA4GA1UECgwHRWRlbFdlYjEYMBYGA1UEAwwPUGV0ZXIgU1lMVkVT
VEVSMA4GA1UdDwEB/wQEAwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwSgYD
VR0fBEMwQTA/oD2gO4Y5aHR0cDovL2VkZWxwa2kuZWRlbHdlYi5mci9jcmwvRWRlbFBLSS1F
ZGVsV2ViLVBlcnNHRU4uY3JsMB0GA1UdDgQWBBSSHP6djxj58tIi5VvjJbMZMXC/fDAfBgNV
HSMEGDAWgBSe5Q/BFJVJHN1aXV6crs0Bby+UeTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBBQUA
A4IBfAANZYiEkyDqsT43U83wHLSYMGcEfmisT+WQrAAoHdlcIsnlHnufGnfmdpg5yvCQpl2U
TI7/w3LdaItoWq5oMZitqdoPW8Z+jy2pkd/DqYG1MkpEyZ0PA37Zn5yigQXAk4Nox7Lgiom8
1WDNgPesNRX7PRNa+RkQcD8MasfbHcZ2ycs1SxUxiCy6BUzhgSB8cNb2t9LVWWynvWuK1Wa5
V2ZCd3PlbKsrbWH8pafpFWUQm0S2BfKUWLDG9cje5bL7p5EpV4a8gFpbD5dq+PPJglT0Dvs9
F0EcrfL2l3JxGIkZmW7sfiUoefB9hTS9m3/TGvXcne4RYpVpEHFV5TathMuHfKAti6PhSely
LCqdPq/T9DHLJekBY0EA2yiVcKQnRZk7/pz0HImCPADOHSOWffJtc9b+Ak6HSDD1PlOSDfT+
udnrqwSAiuNN3hx1olPNxzVDu3jgiTSJFf2XJ1TnmGMT4pJmx7vkJkdE9sZvpiZwdVws37Nr
LqhH5fMZMIIEcjCCAt+gAwIBAgIGCgzP6AA/MA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNVBAYT
AkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNV
BAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOMB4XDTA1MDEwNjEyMjcxOVoXDTA3MDMxNzEy
MjcxOVowcDELMAkGA1UEBhMCRlIxEDAOBgNVBAoMB0VkZWxXZWIxGDAWBgNVBAsMD1NlcnZp
Y2UgRWRlbFBLSTE1MDMGA1UEAwwsUGV0ZXIgU1lMVkVTVEVSIDxQZXRlci5TeWx2ZXN0ZXJA
ZWRlbHdlYi5mcj4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOf+LPJ6btnWlQ/+ClAN
LN4YD9k/i+hVoLFw9bKyxNhMCXpywCqXYghxg1Vvp+6dow05jWrmhI22WC4Wk4rdq1ASUEgy
x9KHQJO69SqrZAPPWcdY4H3ppTwbzX5mYL6JA4IB0beopa8w7MLRLPEoZuFOoOyMG99hiTUm
T9FvlMrTAgMBAAGjggEuMIIBKjBiBgNVHREEWzBZgRpQZXRlci5TeWx2ZXN0ZXJAZWRlbHdl
Yi5mcqQ7MDkxCzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQDDA9QZXRl
ciBTWUxWRVNURVIwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF
BQcDAjBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vZWRlbHBraS5lZGVsd2ViLmZyL2NybC9F
ZGVsUEtJLUVkZWxXZWItUGVyc0dFTi5jcmwwHQYDVR0OBBYEFJIc/p2PGPny0iLlW+Mlsxkx
cL98MB8GA1UdIwQYMBaAFJ7lD8EUlUkc3VpdXpyuzQFvL5R5MAkGA1UdEwQCMAAwDQYJKoZI
hvcNAQEFBQADggF8AA1liISTIOqxPjdTzfActJgwZwR+aKxP5ZCsACgd2VwiyeUee58ad+Z2
mDnK8JCmXZRMjv/Dct1oi2harmgxmK2p2g9bxn6PLamR38OpgbUySkTJnQ8DftmfnKKBBcCT
g2jHsuCKibzVYM2A96w1Ffs9E1r5GRBwPwxqx9sdxnbJyzVLFTGILLoFTOGBIHxw1va30tVZ
bKe9a4rVZrlXZkJ3c+VsqyttYfylp+kVZRCbRLYF8pRYsMb1yN7lsvunkSlXhryAWlsPl2r4
88mCVPQO+z0XQRyt8vaXcnEYiRmZbux+JSh58H2FNL2bf9Ma9dyd7hFilWkQcVXlNq2Ey4d8
oC2Lo+FJ6XIsKp0+r9P0Mcsl6QFjQQDbKJVwpCdFmTv+nPQciYI8AM4dI5Z98m1z1v4CTodI
MPU+U5IN9P652eurBICK403eHHWiU83HNUO7eOCJNIkV/ZcnVOeYYxPikmbHu+QmR0T2xm+m
JnB1XCzfs2suqEfl8xkwggW0MIIDT6ADAgECAgYJ+oiVOzEwDQYJKoZIhvcNAQEFBQAwUjEL
MAkGA1UEBhMCRlIxEDAOBgNVBAoTB0VkZWxXZWIxGDAWBgNVBAsTD1NlcnZpY2UgRWRlbFBL
STEXMBUGA1UEAxMOUmFjaW5lIEVkZWxQS0kwHhcNMDQxMDA3MTU0MzMwWhcNMTEwODEyMTU0
MzMwWjBbMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2Vydmlj
ZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJIEVkZWxXZWIgUGVyc0dFTjCCAZwwDQYJKoZI
hvcNAQEBBQADggGJADCCAYQCggF7FyeP4kRrFG9y51CeWmJIxBSMD2bcrJKIlnAPn6eH8V1M
ORWTPivMNQYq32XcEi9xrxjyREvvnhABrVcW+1VLyLH8WgRY6n5A5JfuDjU6Aq0RzmjqTWDe
1+ecbgAtN8FYjVk35vdQbgfYzpGHPT0NuxiHi8NB8lNFi8rG0t2hP7WLwHLA+sIKFzA/CCRt
qeGPvQkB1pRamU2IAActykfzJb6Qc50uRobWUBJtVjEBy/lgIXU0rMnQNHeCgbUvebvAT9Hd
UGIPbEiX7dKHxL5/AxzHK/rA5siMzNPk8nSckDeLvpf8c/gqQRpPqufy4DazzXfZosKeJATH
pyONnairmwfzMTi63PvNovrbTgzUiyH+g5zvcNoci9cke0RiLQc1pI38psgnVLtPPITgOZrS
cV9zs4+sD7x7vjRco7a9H2ErfAU+8/Ui2OkR1X0z8DpyBHD/fcaDXTD+EiISL7aJHQcJRoNB
CdCFgZeomsXULIYoFTa1hH//TN0z9wIDAQABo4G/MIG8MDoGA1UdHwQzMDEwL6AtoCuGKWh0
dHA6Ly9lZGVscGtpLmVkZWx3ZWIuZnIvY3JsL0VkZWxQS0kuY3JsMA8GA1UdEwQIMAYBAf8C
AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNV
HQ4EFgQUnuUPwRSVSRzdWl1enK7NAW8vlHkwHwYDVR0jBBgwFoAUqNkrj9SwZ7q9SVy8M/x3
UhG5Z50wDQYJKoZIhvcNAQEFBQADggJOAFZV+1m/H+Qud9iUQJnvZR8R/adID02c2B3aOUUy
4/4dxBb4UU1kW8DTUpD57Pjuocfvdg4AfQi7zgSQ8/NUGxNU4CPxtADZVrZtmrpKCjBh1tNz
QbNbdP91KtP+Di0BpidqNwG00CC9j2EnBY88AsqKE28Rmw4eQ9/M/q/GbXsAfEsHV0IQjM7u
US+usowZwm3Mwa5oF+6gmShSc/Wz8iIURxg4lTQto3AoBsiLJelq83I4XRQ0goXYGcM8xXYj
PDioidvY5pSfT4qBR1Bx/vh+xD2evWyFbpuB99iuuewoELX8db7P74QEHhw6Bv1yxLYXGamq
Uxo60WT/UCFjVSy3C/dLrraUZA4gh7Q5G+3/Fal62Qx+1rUEC2YbogEKggonklzUXA+sUbCf
Ad5nZQ0eSszwKt8jmYoHfQ6rUMde0ZJD08n5HAot9hpl9R65j9fdPz9uTeANcRocftHfgM7Y
rQyruWuFxgMUV80fD4RC9ej5KbLyO8jtgESjOCGXeJ95kXXP8vmW73xCYkJ9Pg7Op30o43l6
PV7vej3gdmSQISY+s+J3arz+bccljJCrKHBad3918/LjJ55sRtSb7mfQGti2UcxtJAa2NmUL
d+BIv0MUuC6+k2yIIQKcLbDuuk8lLJmwWuYt1OLHEskZxOm7D7nRwe7ZNlTIZvR/VFWxlY18
k488tH9qcusIw8+7uXeHOZHyFUOHMINJZO9mq9HwGMC4v1xiPwoAJkzFtHf3D9VAholjhEFg
d28aJSs6qN15PXDgDjptAl34eoUxggKuMIICqgIBATBlMFsxCzAJBgNVBAYTAkZSMRAwDgYD
VQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNVBAMTF0VkZWxQ
S0kgRWRlbFdlYiBQZXJzR0VOAgYKDM/oAD8wCQYFKw4DAhoFAKCCAZ8wGAYJKoZIhvcNAQkD
MQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDYxMDIwMTA0MzQxWjAjBgkqhkiG9w0B
CQQxFgQUXYe+4SN0Xg/egy33YksQ7v3xzf8wUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0D
BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
ASgwdAYJKwYBBAGCNxAEMWcwZTBbMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHRWRlbFdlYjEY
MBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJIEVkZWxXZWIgUGVy
c0dFTgIGCgzP6AA/MHYGCyqGSIb3DQEJEAILMWegZTBbMQswCQYDVQQGEwJGUjEQMA4GA1UE
ChMHRWRlbFdlYjEYMBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJ
IEVkZWxXZWIgUGVyc0dFTgIGCgzP6AA/MA0GCSqGSIb3DQEBAQUABIGAL9epBiPjPbKtYKaL
socvldMn2DrLSGswsXmzAtNL06/8XdtCl0Nujnk1iF1wt8VOnIOsejrApwEX6M4Uc7GZCYLW
TqPGV5+3hB00LiRmIVWzUVaA58GY7aGbAlPlN+J9pK+2LFGs/ub6F8FnjQI7t+mWf05hOLTz
Y4G/7G0kK0cAAAAAAAA=
--------------ms080104090807090503090708--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9K9hJm2084827; Fri, 20 Oct 2006 02:43:19 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9K9hJIj084826; Fri, 20 Oct 2006 02:43:19 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from imx2.tcd.ie (imx2.tcd.ie [134.226.1.156]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9K9hIrn084816 for ; Fri, 20 Oct 2006 02:43:18 -0700 (MST) (envelope-from [email-masked])
Received: from Vams.imx2 (imx2.tcd.ie [134.226.1.156]) by imx2.tcd.ie (Postfix) with SMTP id 93458681B4; Fri, 20 Oct 2006 10:43:12 +0100 (IST)
Received: from imx2.tcd.ie ([134.226.1.156]) by imx2.tcd.ie ([134.226.1.156]) with SMTP (gateway) id A063E18FFD4; Fri, 20 Oct 2006 10:43:12 +0100
Received: from [127.0.0.1] (cswireless62-73.cs.tcd.ie [134.226.62.73]) by imx2.tcd.ie (Postfix) with ESMTP id 8C317681B4; Fri, 20 Oct 2006 10:43:12 +0100 (IST)
Message-ID: <[email-masked]>
Date: Fri, 20 Oct 2006 10:43:57 +0100
From: Stephen Farrell
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: Denis Pinkas
Cc: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
References:
In-Reply-To:
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiVirus-Status: MessageID = A163E18FFD4
X-AntiVirus-Status: Host: imx2.tcd.ie
X-AntiVirus-Status: Action Taken:
X-AntiVirus-Status: NONE
X-AntiVirus-Status: Checked by TCD Vexira. (version=1.56.3 VDF=8.1366)
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Denis,

Denis Pinkas wrote:

> ...the sentence : "The trust anchor for the certification path
> MUST be the same as the trust anchor used to validate the target certificate" does not allow
> to address the cases where:

As it happens I disagree with you but that was done to death on the
list before I think.

>
> a) two CAs in different branches of a certification tree would have the same DN, and
>
> b) two CAs in different trees of a certification forest would have the same DN.
>
> Dave, the text of son-of-RFC328 is currently insufficient to enable secure implementations.

That strikes me as a wild overstatement almost akin to saying that
we should spend forever figuring out how to handle cases where two
CAs end up with the same private key and never mind making any
progress in the meantime.

I think the current text is fine, an improvement on 3280, and well
worth proceeding with.

I suggest that you write up a separate document that says how to
handle the corner cases above.

Stephen.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9K8T1md076005; Fri, 20 Oct 2006 01:29:01 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9K8T1n9076004; Fri, 20 Oct 2006 01:29:01 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9K8T0hM075998 for ; Fri, 20 Oct 2006 01:29:00 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-001.frcl.bull.fr [129.184.87.31]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id KAA30546 for ; Fri, 20 Oct 2006 10:31:20 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006102010285871:7236 ; Fri, 20 Oct 2006 10:28:58 +0200
Date: Fri, 20 Oct 2006 10:28:56 +0200
From: "Denis Pinkas"
To: "[email-masked]"
Subject: Re: Son of RFC3280 path validation rules
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 20/10/2006 10:28:58, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 20/10/2006 10:28:59, Serialize complete at 20/10/2006 10:28:59
Message-ID:
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="iso-8859-1"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Julien,

Your remark is important.

>Folks,
>
>a fairly major difference came up between RFC3280 and son-of-RFC3280
>regarding path validation, namely:
>
>RFC3280:
>
> (f) Obtain and validate the certification path for the complete CRL
> issuer. If a key usage extension is present in the CRL issuer's
> certificate, verify that the cRLSign bit is set.
>
>son-of-RFC3280:
> (f) Obtain and validate the certification path for the issuer of
> the complete CRL. The trust anchor for the certification path
> MUST be the same as the trust anchor used to validate the target
> certificate. If a key usage extension is present in the CRL
> issuer's certificate, verify that the cRLSign bit is set.
>
>So, son-of-RFC3280 adds the additional constraint of having both
>paths ending at the same trust anchor.
>
>I'm a bit surprised that this modification does not come with more
>details and explaination. As a matter of fact, it breaks compatibility
>with previous versions of the standard, with X509, and the advantages
>of this additional constraint are not clear.

X.509 is fairly too open and in some cases insecure ! For this reason,
I do not care too much about "breaking compatiblity" when at the same time security is also broken.

However ,I care about security and the sentence : "The trust anchor for the certification path
MUST be the same as the trust anchor used to validate the target certificate" does not allow
to address the cases where:

a) two CAs in different branches of a certification tree would have the same DN, and

b) two CAs in different trees of a certification forest would have the same DN.

Dave, the text of son-of-RFC328 is currently insufficient to enable secure implementations.

Denis

>X509 specifically allows the certificate issuer and the CRL issuer to be
>two different trust anchors, as indicated in section 8.1.5 of X509 v5:
>
>X509.v5 8.1.5
> If an authority uses the same key to sign certificates and CRLs, a
> single self-issued certificate of category a) shall be used. If an
> authority uses a different key to sign CRLs than that used to sign
> certificates, the authority may choose to issue two self-issued
> certificates of category a), one for each of the keys. In this
> situation, certificate users would need access to both self-issued
> certificates to establish separate trust anchors for certificates and
> CRLs signed by that authority. Alternatively, an authority may issue
> one self-issued certificate of category a) for certificate signing and
> one self-issued certificate of category b) for CRL signing. In this
> situation, certificate users use the key certified in the certificate of
> category a) as their single trust anchor for both certificates and CRLs
> signed by that authority. In this case, if the self-issued certificate
> of category b) were to be used to verify signatures on CRLs, there
> is no means defined in this standard to check the validity of that
> certificate.
>
>Also, this additional constraint can make indirect CRLs much harder
>to implement in practice, if not impossible in some cases. It means
>that if two different CAs wish to delegate CRL issuance to the same
>CRL issuer, the CRL issuer needs to have two (cross) certificates
>with the same key, or all three need to chain to the same root.
>
>It will also make key-rollover more complex when the CA has issued
>a certificate to itself for CRL signing.
>
>Finally, this constraint does not add security. It merely helps
>path builders to speed up the reconstruction process, and possibly
>to detect an ambiguity if two CAs with the same name happen to exist.
>It does not however prevent a rogue CA from issuing a bogus CRL.
>
>So, all in all, is a "MUST" really what we want? Or should we simply
>say that an implementation may check this additional constraint, but
>risks in that case to refuse perfectly valid CRLs from a PKI following
>an older version of the PKIX standard or X509 ?
>
>Regards,
>
>--
>Julien Stern

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9K8FwWB073979; Fri, 20 Oct 2006 01:15:58 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9K8FwCI073978; Fri, 20 Oct 2006 01:15:58 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9K8FtsR073959 for ; Fri, 20 Oct 2006 01:15:56 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-001.frcl.bull.fr [129.184.87.31]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id KAA13602 for ; Fri, 20 Oct 2006 10:18:07 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006102010154493:6936 ; Fri, 20 Oct 2006 10:15:44 +0200
Date: Fri, 20 Oct 2006 10:15:42 +0200
From: "Denis Pinkas"
To: "pkix"
Subject: Comments on draft-santesson-pkix-vccrl-00.txt
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 20/10/2006 10:15:44, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 20/10/2006 10:15:46, Serialize complete at 20/10/2006 10:15:46
Message-ID:
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="iso-8859-1"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

General comment

This draft should not be taken as a WG item and should not amend RFC 3280 as it is proposed.

Detailed comments

The Security Considerations section states:

Any use of certificates provided in the Validation Certificates CRL
extension, to validate signatures on a CRL, MUST be done according
rules and conventions defined in RFC 3280.

This is incorrect since the rules and conventions defined in RFC 3280, when the CRL is not signed
by the key of the CA, are insecure, very hazy and thus do not allow for interoperability.

These rules do not address the cases where:

a) two CAs in different branches of a certification tree would have the same DN, and

b) two CAs in different trees of a certification forest would have the same DN.

The impact is important because, with these insufficiently defined rules of today, a certification path for a CRL
might be fully different from a certification path for a target certificate, but the path validation rules are silent about this.

There are indeed security attacks possible with these loose rules.

The consequences are:

a) when CA name collision is taken into consideration, a SINGLE certificate is missing since
the certification path of the target certificate MUST be used.

b) when CA name collision is not taken into consideration, different certification path would be needed,
and thus a SEQUENCE of certificates would be needed.

This has further direct consequences whether the proposed extension should be:

ValidationCertificates ::= SEQUENCE of Certificate
or
ValidationCertificate ::= Certificate

Besides these points, the proposal should be rejected on the basis that if a CA chooses to use this extension,
all CRLs will inflate in size.

The idea would be acceptable if the CA would be able to continue to issue current CRLs, and, in addition,
could also issue augmented CRLs with this extension. However the proposal does not allow for this.

Denis

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JKKKPq011003; Thu, 19 Oct 2006 13:20:20 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9JKKKlu011002; Thu, 19 Oct 2006 13:20:20 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from carter-zimmerman.mit.edu (carter-zimmerman.dyn.mit.edu [18.188.3.148]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JKKId3010995 for ; Thu, 19 Oct 2006 13:20:19 -0700 (MST) (envelope-from [email-masked])
Received: by carter-zimmerman.mit.edu (Postfix, from userid 8042) id E59E9E0127; Thu, 19 Oct 2006 16:20:17 -0400 (EDT)
From: Sam Hartman
To: [email-masked]
Subject: SCVP 28
Date: Thu, 19 Oct 2006 16:20:17 -0400
Message-ID:
User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.4 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi.

--Sam

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JJo9sK007109; Thu, 19 Oct 2006 12:50:09 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9JJo93R007107; Thu, 19 Oct 2006 12:50:09 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from ns3.neustar.com (ns3.neustar.com [156.154.24.138]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JJo8YP007077 for ; Thu, 19 Oct 2006 12:50:09 -0700 (MST) (envelope-from [email-masked])
Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns3.neustar.com (Postfix) with ESMTP id 36BF5175F0; Thu, 19 Oct 2006 19:50:03 +0000 (GMT)
Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1Gadty-0001D9-PD; Thu, 19 Oct 2006 15:50:02 -0400
Content-Type: Multipart/Mixed; Boundary="NextPart"
Mime-Version: 1.0
To: [email-masked]
Cc: [email-masked]
From: [email-masked]
Subject: I-D ACTION:draft-ietf-pkix-rfc3280bis-05.txt
Message-Id:
Date: Thu, 19 Oct 2006 15:50:02 -0400
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

Title : Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
Author(s) : D. Cooper, et al.
Filename : draft-ietf-pkix-rfc3280bis-05.txt
Pages : 144
Date : 2006-10-19

This memo profiles the X.509 v3 certificate and X.509 v2 certificate
revocation list (CRL) for use in the Internet. An overview of this
approach and model are provided as an introduction. The X.509 v3
certificate format is described in detail, with additional
information regarding the format and semantics of Internet name
forms. Standard certificate extensions are described and two
Internet-specific extensions are defined. A set of required
certificate extensions is specified. The X.509 v2 CRL format is
described in detail along with standard and Internet-specific
extensions. An algorithm for X.509 certification path validation is
described. An ASN.1 module and examples are provided in the
appendices.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-rfc3280bis-05.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username "anonymous" and a password of your e-mail address. After
logging in, type "cd internet-drafts" and then
"get draft-ietf-pkix-rfc3280bis-05.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
[email-masked].
In the body type:
"FILE /internet-drafts/draft-ietf-pkix-rfc3280bis-05.txt".

NOTE: The mail server at ietf.org can return the document in
MIME-encoded form by using the "mpack" utility. To use this
feature, insert the command "ENCODING mime" before the "FILE"
command. To decode the response(s), you will need "munpack" or
a MIME-compliant mail reader. Different MIME-compliant mail readers
exhibit different behavior, especially when dealing with
"multipart" MIME messages (i.e. documents which have been split
up into multiple messages), so check your local documentation on
how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
access-type="mail-server";
server="[email-masked]"

Content-Type: text/plain
Content-ID: <[email-masked]>

ENCODING mime
FILE /internet-drafts/draft-ietf-pkix-rfc3280bis-05.txt

--OtherAccess
Content-Type: Message/External-body;
name="draft-ietf-pkix-rfc3280bis-05.txt";
site="ftp.ietf.org";
access-type="anon-ftp";
directory="internet-drafts"

Content-Type: text/plain
Content-ID: <[email-masked]>

--OtherAccess--

--NextPart--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JJo9D5007110; Thu, 19 Oct 2006 12:50:09 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9JJo9EQ007108; Thu, 19 Oct 2006 12:50:09 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from ns3.neustar.com (ns3.neustar.com [156.154.24.138]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JJo8JD007078 for ; Thu, 19 Oct 2006 12:50:09 -0700 (MST) (envelope-from [email-masked])
Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns3.neustar.com (Postfix) with ESMTP id 090D2175EE; Thu, 19 Oct 2006 19:50:03 +0000 (GMT)
Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1Gadty-0001Cf-HD; Thu, 19 Oct 2006 15:50:02 -0400
Content-Type: Multipart/Mixed; Boundary="NextPart"
Mime-Version: 1.0
To: [email-masked]
Cc: [email-masked]
From: [email-masked]
Subject: I-D ACTION:draft-ietf-pkix-scvp-28.txt
Message-Id:
Date: Thu, 19 Oct 2006 15:50:02 -0400
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

Title : Server-based Certificate Validation Protocol (SCVP)
Author(s) : A. Malpani, et al
Filename : draft-ietf-pkix-scvp-28.txt
Pages : 85
Date : 2006-10-19

SCVP allows a client to delegate certificate path construction and
certificate path validation to a server. The path construction or
validation (e.g. making sure that none of the certificates in the
path are revoked) is performed according to a validation policy,
which contains one or more trust anchors. It allows simplification
of client implementations and use of a set of predefined validation
policies.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-scvp-28.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username "anonymous" and a password of your e-mail address. After
logging in, type "cd internet-drafts" and then
"get draft-ietf-pkix-scvp-28.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
[email-masked].
In the body type:
"FILE /internet-drafts/draft-ietf-pkix-scvp-28.txt".

NOTE: The mail server at ietf.org can return the document in
MIME-encoded form by using the "mpack" utility. To use this
feature, insert the command "ENCODING mime" before the "FILE"
command. To decode the response(s), you will need "munpack" or
a MIME-compliant mail reader. Different MIME-compliant mail readers
exhibit different behavior, especially when dealing with
"multipart" MIME messages (i.e. documents which have been split
up into multiple messages), so check your local documentation on
how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
access-type="mail-server";
server="[email-masked]"

Content-Type: text/plain
Content-ID: <[email-masked]>

ENCODING mime
FILE /internet-drafts/draft-ietf-pkix-scvp-28.txt

--OtherAccess
Content-Type: Message/External-body;
name="draft-ietf-pkix-scvp-28.txt";
site="ftp.ietf.org";
access-type="anon-ftp";
directory="internet-drafts"

Content-Type: text/plain
Content-ID: <[email-masked]>

--OtherAccess--

--NextPart--

Received: from [201.228.50.48] ([201.228.51.240]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JIfSdH000860 for ; Thu, 19 Oct 2006 11:41:29 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000901c6f349$31a13b10$3032e4c9@dell2>
From: "Ads Ad"
To: [email-masked]
Subject: iPod bring along. films
Date: Thu, 19 Oct 2006 01:38:31 -0500
MIME-Version: 1.0
Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

An Investor ALERT is being issued starting right N0W. Keep your eyes
glued on P.S.U.D!!

PETROSUN DRILLING (P.S.U.D.)
Current Price: 1.16

Don't get caught in the dust, start watchin today because this company
has been known to release major news at any time which could bring the
st0ck up!!

Current News

PetroSun Completes Equity Investment in ElectraTherm

PetroSun, Incorporated (PSUD - News) announced that the company has
finalized its Series A Preferred Stock Purchase Agreement with
ElectraTherm, .....

Check your stock source for full press releases on this exciting stock!

Don't miss out !

Mail Zip Who Are We is based privately owned offering since Were known worldwide for our popular JavaScript as well other web
design edit kinds graphics required cycle static animated cursors interface elements these designed single Set make look modern
IT consulting services provider About Us Download Order Support Client Side Products Tigra Menu PRO GOLD Tree Calendar Scroller Color Picker Hints Tables Calculator Form Validator Status Bar
Sale Owner Blog Juice Text AdsMember loginBuy LinksBuy Linkstext adsrss adsMake MoneyMake Moneytext UsAbout UsBlog url category. increase GamesWeb to: sec... MeterHere explaining Alexa Bloglines

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JGEQAa083454; Thu, 19 Oct 2006 09:14:26 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9JGEQLE083453; Thu, 19 Oct 2006 09:14:26 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from calamari.linagora.com (whisky.linagora.com [84.14.148.71]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JGEOvZ083442 for ; Thu, 19 Oct 2006 09:14:25 -0700 (MST) (envelope-from [email-masked])
Received: from localhost (localhost.localdomain [127.0.0.1]) by calamari.linagora.com (Postfix) with ESMTP id B34D56794F for ; Thu, 19 Oct 2006 18:12:37 +0200 (CEST)
Received: from calamari.linagora.com ([127.0.0.1]) by localhost (calamari.linagora.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 22881-09 for ; Thu, 19 Oct 2006 18:12:36 +0200 (CEST)
Received: from 10.0.0.2 (unknown [192.168.1.3]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by calamari.linagora.com (Postfix) with ESMTP id B3FB567949 for ; Thu, 19 Oct 2006 18:12:36 +0200 (CEST)
Received: from 10.0.0.1 (proxying for 145.242.3.30) (SquirrelMail authenticated user yquenechdu) by tomate.linagora.lan with HTTP; Thu, 19 Oct 2006 18:14:24 +0200 (CEST)
Message-ID: <[email-masked]>
Date: Thu, 19 Oct 2006 18:14:24 +0200 (CEST)
Subject: draft SVCP
From: "yannick quenechdu"
To: [email-masked]
Reply-To: [email-masked]
User-Agent: SquirrelMail/1.4.5 [CVS]
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-Priority: 3 (Normal)
Importance: Normal
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at linagora.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi,

There is a small error in the draft

3.2.4.2.2 Basic Validation Algorithm Errors

id-bvae-noValidCertPath OBJECT IDENTIFIER ::= { id-bvae 4 }

This item is not defined in this section.

Best Regards
--
Yannick Quenec'hdu
Security Architect
Linagora SA
"Open Minds. Open Doors. Open Source."

Received: from [221.3.220.92] ([221.3.220.92]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9JDHiQ8064242 for ; Thu, 19 Oct 2006 06:17:47 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000b01c6f380$f24a5900$5cdc03dd@ws6ddb8c60897a>
From: "part. getting"
To: [email-masked]
Subject: Unsigned Bands Radio Tricks
Date: Thu, 19 Oct 2006 21:17:36 +0800
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0007_01C6F3C4.00477360"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0007_01C6F3C4.00477360
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0008_01C6F3C4.00477360"

------=_NextPart_001_0008_01C6F3C4.00477360
Content-Type: text/plain;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable

Finding or best downloads cd reviews biz news tips serving it up Quick =
am Easy for fans About me Namemarc in Gunn Texas United States View my =
complete.
Attention sure because its strange am look they is them a respond then =
how get am even bothering mention all was looking into moving Italy is =
checking of necessary living.
Trick make is stand in just disappear which what typically am aim for =
Lack confidence.
Gig of think Alas prolly helluva challenge singer work very money time =
start planning next summers gigs.
Durante toughest part in recording sounding is him isnt quite there can =
soon a gonna stick sounds pretty a. Cant or remember final ill excited =
name end of morning nd Window or Production is Troubles Years of After!

Challenge singer work very money is time start am planning am next a =
summers gigs.
His life Ralph Mouth Happy Days a used ha cha cha Spike tom of Jerry am =
did Doggie.
Gunn Texas or United States View in my complete profile webpages Bard =
Marc middot Bards is mps Magazine a Crier Marketing.
The of serves as extension of by finding best downloads cd reviews biz =
news tips serving it up of. Italy be exact ive is never really done much =
am outside is Festivals honestly.
Done much outside Festivals honestly of havent ever tried buski mean am =
we shows all but find location lay.
------=_NextPart_001_0008_01C6F3C4.00477360
Content-Type: text/html;
charset="gb2312"
Content-Transfer-Encoding: quoted-printable

Finding or best downloads cd reviews =
biz news tips=20
serving it up Quick am Easy for fans About me Namemarc in Gunn Texas =
United=20
States View my complete.
Attention sure because its strange am look =
they is=20
them a respond then how get am even bothering mention all was looking =
into=20
moving Italy is checking of necessary living.
Trick make is stand in =
just=20
disappear which what typically am aim for Lack confidence.
Gig of =
think Alas=20
prolly helluva challenge singer work very money time start planning next =
summers=20
gigs.
Durante toughest part in recording sounding is him isnt quite =
there can=20
soon a gonna stick sounds pretty a. Cant or remember final ill excited =
name end=20
of morning nd Window or Production is Troubles Years of =
After!

Challenge singer work very money is =
time start am=20
planning am next a summers gigs.
His life Ralph Mouth Happy Days a =
used ha=20
cha cha Spike tom of Jerry am did Doggie.
Gunn Texas or United States =
View in=20
my complete profile webpages Bard Marc middot Bards is mps Magazine a =
Crier=20
Marketing.
The of serves as extension of by finding best downloads cd =
reviews=20
biz news tips serving it up of. Italy be exact ive is never really done =
much am=20
outside is Festivals honestly.
Done much outside Festivals honestly =
of havent=20
ever tried buski mean am we shows all but find location=20
lay.

------=_NextPart_001_0008_01C6F3C4.00477360--

------=_NextPart_000_0007_01C6F3C4.00477360
Content-Type: image/gif;
name="text.gif"
Content-Transfer-Encoding: base64
Content-ID: <000601c6f380$f2243360$5cdc03dd@ws6ddb8c60897a>

R0lGODlhWAGwAYf2AAAAAIAAAACAAICAAAAAgIAAgACAgMDAwMDcwKbK8EAgAGAgAIAgAKAgAMAg
AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA
AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA
AKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAAQIAAQKAAQMAAQOAA
QAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBAQMBAQOBAQABgQCBgQEBg
QGBgQIBgBKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCAQACgQCCgQECgQGCgQICgQKCg
QMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDgQEDgQGDgQIDgQKDgQMDgQODgQAAA
gCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAggIAggKAggMAggOAggABAgCBAgEBAgGBA
gIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBggMBggOBggACAgCCAgECAgGCAgICAgKCAgMCA
gOCAgACggCCggECggGCggICggKCggMCggOCggADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDg
gEDggGDggIDggKDggMDggODggAAAwCAAwEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAg
wKAgwMAgwOAgwABAwCBAwEBAwGBAwIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBg
wACAwCCAwECAwGCAwICAwKCAwMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDA
wGDAwIDAwKDAwP/78KCgpICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAfALIALAAAAABYAbAB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOqXMlSpb2X
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9ebTr6K
HUu2rNmzaIO6gdqyrdu3cOPKnUu3rt27ePPq3cu3r9+/gAMLHkwxreHDiBMrXsy4sWPFhCNLntz3
seXLmBtT3sw5byK/mUOLHk26tOnTqGN2Xs26tcjUsGPLnk27tu2crnPr3i3xtu/fwIMLH56Vt/Hj
yAUSX868ufPny5NLn74auvXr2LNr3869e1IAXqmL/x8vEQBc7+gxg0/Pvv369vC9v9dKvr59hebv
69//Nj///wAGKOCABBZo4IEIJqjgggw22FZ8EEYo4YTBOWjhhRhmqOGGHHZGYXeWeNfhiCSWaGJe
H6YY3Yks8qbiixW2KOOMNNZoEYw45qjjjjz2SKGNQErm45CzvVBTC0QmqeSSEPJ1T5BQRinllFRW
aeWVWGZpHJNcWnVDl2D6xsuS44Rp5pnQaYnSNC1pYyBqYKAp55x01mlnWWrmudISS+ippzp+BrrZ
nYRKJeihIRWq6KKMJoboo5BGKumklE73TaX/NKqpUZh26ulkd1i46ahCfWrqqagqROqqrLbq6quw
xv86Wjuy1morkx81kWqUaXVx66/AbsUMWruiKlMxwW5a7KmrvpLss60uK+201FZr7bXYZnsgtNx2
a6a2kXor7rhEggspuYyaq25n/qzr7rsPoSvvvPTWWxuNG8Dbm7116nvQGP4GLPDABBc8EL8IJ5yd
wQw3nJzCENeaglmdaObwxRhnrPHGWUbs8ce/cSzyyHyBDCbJKKesMrYmd4lyOS22/BQA8z23MkY0
32xizvzJTBXNNfvsI83E6fwRz+IJnVXQ9xo9otJJOi311BxB3Vg2llGttcolbO3112A/avXYULGB
2iB2hq322my3/TXZcMc9ltsmacBREivJrSPdfE//5IHBeufY9+CEF65b4DgaLiDijDfu+OOQG6Z4
gJFXbvnlPk6u+cWYd+7556CDvvnopJceV+joma46vKi37vrrwq0u++xWUjEj7LjnrvtU3OzuMu3A
By/88D1LBYvvyCev/PLMy03889AH3/z09UZv/fXYZ689lNTHzvA5U3Yf4/b6SkP++einr/7s4gO3
/vtSti///PTvBP/9QOZuS/207W+d4bbAX2ACKMC/ELCAfjngfvjHwAbOD4F/cWBsIAgaCVrwgr6j
oAY3mC0MevCDIAyhCEdIwhKa8IQoRBgHVyiqFLqQRyzEywvtcQ3IxNAuM8yhDnfIwx5y6oZ18aEQ
/4fYHaYREStAM+IRp5LEJWqliY85H9IKGA3pzCCG/rGP74jWHMVlEYhumSIY2/LF4rWOi05U1BjX
yEY/pVEsbYyjHKv0xjpihhR2zOOP5tiS6WnBe3wMJAdvYCU9bkWQiEykIhfZkjQw8pGQjGReHiBJ
BBpyOUq8ZFPQSMT+lLGSFxEjKEP5yVFWpJSmTKX1LvAwTV5FlVVzpVVgSctasjAQNJKlLnfJy+wY
6Su2xEgvDRXMYhrzmFsapjIvg8xmOvOZ0EzmMpsSzWpa8yTTdMo1ObOIAgoRD9m0zTbHOZFwmhMx
5ETIOZWSzna68503Sl4m1wkfeNrznvjM5/O4IVAdevqTLPpM0C3W9s8f2vOS+yioYzjjiYA6NHoK
jahEJ0obfFIUKBa9qE9GNlAZaXSjDw2pNT/aE5Gmk6Q8yShKcXPPlerEpOR0qUxn6pSAAAAh+QQA
JACyACwAAAAAWAEsAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJ
sqTJkyhTqlzJUuW/lzBjypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjDm1JtarV
q1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3btwmlyp1Lt67du3iDwt3Lt6/LvIADCx5MuLDhw4gT
K565b7FPv5AjS55MubJlko4za97MubPnz6BDd0YoOvPl0yxLO0bNGqTq17Bjlx7Qc4BtprSH5n65
G6bt37eB7xYO/N9w37KTcyZtvDnP3kmh+6R9XKZ057xnQq/uvLV3zM2PF//Xnn38dt+3eacXrl78
derIrdPsLf189vvf82O8CV99zPr+IWefePHRV+B15cX333wLytcgdggqJyFhzPWH3X0NDljgggBi
mKBNFtZH3IUdKlidfihSBOKGD7LoYm4jGmegh+GteF+J/43noIkKTuhjYaSxd+GQztlXI40Pcvfh
fOaR5ySRQ3KXW4pUQmRjkTu6iGGI/G0pX4TV4dijmD+WGdp5RmpJ4o5crnljTWg+2WKUbPZoZmdo
DOUCYHHO+Ruddso4XHrtFYokjdSxR5yFY9Z56J2QSsVcpHRVaSlDlGaq6aacdurpZ5N+KqpNl7Y0
6qk1lQoeqqy2KliorsLuFMBQs4am6kg11Sqrq7oC1atQAQQbbEzCDvvPr8ceW+yvuiIbK129Oiuq
tDtR21O0LzGbrEyzMtvsrs9CRUGu4MpqbLbGdnsusdya+y276tIkbLbtotvsusQWm6y29uY770z/
7htwufQ6i2y3AJdrbbhHIVQrv9t+e+7B9b6rLb4KbwuuxATTuyvC7Gr8cMgkP4wtyQXLm7DBHm97
q0ogExzzvvWW3HLK8JK78c4f23SxxjgHfTPQNKMM9L0n55ywyC+9HFKu+C6rrr4QZ0z0zEUDvGzL
JuurrMo5X7x11VeX7S/GXxOddcjvMuxUQAAh+QQAJACyACwAACsAWAEsAAcI/wD/CRwoMIBBgv8M
KgyQcCFDhgQhRhwIUWLBhAgfIqTo8KJHhxUtUsyIUeTDjiZJTkwZceHGhh5Xvqw48qXNmzhz6tzJ
s6fPnzxp1pyocqjMmBdTijR6FKPNpUqdjoRaFGnJqlJxaiS51KnErkDDih1LtuzPr0yzWu26VW3b
pE/jor3JcqpbtXeJ2tVrVe7Gt33NCh5MuHBOe4gTI7Y41+vewGtrMgasl3HRtlQLapwcUyjMy5H5
MvXsuOVQiIpTq17NurXr17Bjy55Ne3ZdhS1D4qb79yDHg5RzY2341XfvzZqB/xbO1nhdyB1/F3dZ
WWDt69iza9+e3TDeuN7BC/8GG768+fPo049lTZa86PPudzZWT98n9/v48+vvPjY+5PD+6bRbfQTy
tN+BCCaIXYEMNujggxBGmJ6CFFZYWxAWZqjhhhx2iJiEIIYo4ogkFujhiSimqOKKLLbo4oswxijj
jDTWaOONOOa4XYk89ujjj0AipOOQRBZp5JFIJqnkkhQG6eSTUEYp5ZRUVmnllVhmqeWWhDHp5Zdg
zsjlmGSWSV+YaKap5oZmtunmm2StKeecdNZpJ4xP3DkklKfA6eefgAYq6KBx6mnooXQSquiiWCLq
KIdNPFoho5RW6mAnlmaq6aacdurpp6CGKuqopFLJXqkhSmonqqy2ethqruLJJEB5s1qnqqMC5Jqr
QLrq+k+vvvaKkLADEVtrsb8e++uwxCa7K6+7KrssQcEqe2yzw0Lrq7a1SjsrsNn+c2uiL1k7bbnU
Istruucu622y7Kq77rnXziuvus/Oa+5G3aZr7rv72hurk6z9e1PA/WYrbbvu0hsusvXq+zC+Di/M
773fXuzvxLOOi6jBNiEs8LoLA+xwvCTLm/C9Etdr8cMgo9wwyh17vGbI/oKL8bYMT2uswhLL/C3P
Pk8cdL/X5qsyuz9vTPPATwYEACH5BAAkALIALAAAVgBYASwABwj/AP8JHChQAEGDAhIqPHhwYUGC
D/8pNCgRIsKIFAdmfDiRYUWPHimK/CgxIUSSG0U63FiRZcqTMGPKnEmzps2bOHPq3Mlz5sSRMV+i
PMmypcWhLo8CxXi0acaLSZuWdKi0KkiSPbNq3UqzFtevYP/ZG0t2bNGiGkEuTWs17VOscC9G/Bg1
pNu4RNnKlHv3qsGygAMLHky4sOHDiBMrXjw2GuPHi8/uVauXrl2mGutanrsW7uaCayXPrbw09FHI
qFOrXs26teuyZ3/6VUt1akqTo3FnpvpyoezfJm/v1n3ZYm3eHT2+Xs68ufPngsNKn049aHW20LNr
387d3vXv4K+j//06Prz58+jTq1/Pvr379/Djy59Pv779+/jz69/Pvz96AAACUJ2AJwUIYIHt8TOT
ggTx46B/EEbIHoHfUUiQhRYm+CBMDjIokIcShigiV4Nl+A+GJ6YoIIEGCrTigScGCBGKK6YYI4wt
uigQYQTx+OGCA4G4Y3dEFmnkkamZSCOLLF4Y40BNIgjlkyrO6KSNPg4Z3Y8yedjhhkiGKeaY28Wk
pJMUponmlSbaqKOaGaI4nZAQedngiHjmqdWZU6rpooE1TunmhTnCOSOg1NF5J5eM6unoo1oCxueb
gg6qo6BtThpopTBlKdZgQQLZqIJklmrqqctZmuamflKKKUyaqrnKZqSA9QjqqHWGGiqqvPbqa1kz
FXogq4TieCWVnF5qo7AwWtrTlwx6+eWHHUJq7bXYZqvtttx26+23+/0q7rjkllsuuOimq+667Lar
rrnwGjZKvPTWq5q7+Oar77789nuevQAHLPDABBds8MEB+6vwwgw37PDDEEcs8cQUV/wvwhhnzBoi
Gnfs8ccghyzyyCSXbPLJKI9pcXVTrOzyyzDHLPPMNNdsM7cp82pOzjw/dvPPQActtLUBAQAh+QQA
JACyACwAAIEAWAEsAAcI/wD/CRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJ
UgjJkyhTqlzJsqXLgvZiypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1a9KXV
q1izat3KtavXr2DDZrwptqxZsVTTRp0IQGtbjW8hxj2LcC7chmrzNgXA167Ctn4ZBrZo1+9ggXEP
J1SM+CHjxmzrFlT8+F9lvZiDSoYs2LLEynInR0z8ubPDyqANDk7t2TRdrTfnvu2LmPZA27dt6+Y7
mbdl36R/8+4723dj4r0B48ade/jt2soP09492zPz6q2pQxdeHTlB7dCLY//3nLl8UdmtrT/nvF79
cdWSSct/bjg9es6A29vff38ze/rjrRege+nxt1978/2XX2PmNZiTfwQueOB3AE4H33cWvqchgfTp
F5x13uHH34cHGSdbhgW+tyByJM7XIoIHeifhay+hl+CEMBZ2oYg3Sjjjhv3dKBqQuaVYoo8d/qde
fj1SqKKHOSaZnZE0rhRck0o2WV+URApJJIxf8ghlf6J9iOSO450p5otihslalRmtk9yJaWI453a1
JRfentzFaKN+v/lpGHXRFZnicuLNaJyIfALn3JMKitdcooDCaemOIL2ZlaaXQthpp8x1FOpZnH6K
qakekYXqqqxK5OCrOrX/KuusCsEKq6dWkhpZRqWS1CutF8XGEolUYsXpr05+9Cuy/9jqLE3Mlqbk
V8felSlhGD3bYF2IJuZoncLh2Vyf2S0a7rnTUYqnjB52O+6k76IbanfuTgmiueAlqZu49Y4K7EVa
xicljmZyCKWG3QGKJJuHUhlwmO49nDB7BRvqosIFEvuvQ8Iex+Kd8nl7XZTmZqzvlx9D9uOV6aLJ
XXSPZlzwxUweTPCkTMrYcnhtaautl0FOGPOQBuZp84pdSjkxl/YFrWOyfxa95NQUg8nowEL/6Cxx
XHOt18NtmsywkGQmuPTCVjNdttJS34e2ygIeLTekEVJIms/Phtgvoef2/12kiyWDhx3M8FYM9Z7z
1ovu0SxXTOy3RC/eN4sm+oa3sxsX+1fmXl2OGeclSgv66K+pSvrpqBPk+U6pt+46q6a/ztFj0T49
LcAiRSvQ6rFie5XuOPpeae2RSxfa7QuBVqrGsrsEPPCVnkqR7ZqPFr1ryU9/fek27SzvujJXPrjK
+EKOobotOuf9vHCzG26I7+6L8HX75iw+neT6vV2+GTq93Hq8C8r4nLQw271taQJbTNsONz42nY1D
DFugmkaUtKqFbW1hMxiWghNAnGxmcPXD2ogsVLOS9SkwKZuSAe0Fsz/VjG43U1vdZIilq7XQTjaU
mcuutL1PNTBuXpLak4O8xcAdApFoSDNYh15ItauZLGljk+DclGinmdkNiTHq4Vk69sC6bWmGjysi
Fg3HpS6C6WJpc9oS5Qa2oEGMbRuy1wUT0sGfDNB98jvc5AQUuN2ALG1/Y6G4zqivmBXGfCfkU6Pg
CL9ANU5PRnNX+obzP8jU0SeOuRT0MrfJ2eHlkjQJCAAh+QQAJACyACwAAKwAWAEsAAcI/wDtCRwo
8J/BgwgTAkjIsKHDhxAjSlwosaLFixgzakRIcaNHjB0hEhxJsqTJkyhTnvz4LyTLlx5dwpxJsyaA
mzVzHpSps2dGlUCDCh1KtKjRo0iTKl3KtKnTp1CjSp1KtarVq1izat3KtavXr2DDEvVJlqa/sggb
oF3Ltq1btmLjyp1Lt67dgWPu6t3Lt+/dt4ADCx5MuLBhhH4TK17MuLHjx5AjS55MuSicypiVHt7M
ubPnz6BDix5NurTp06hTq15dNrPr17Bjy55Nu7bt27hjs97Nu7fv38CDC+edu7jx48iTK3c8vLnz
54KXS5++GLr1i82aXd/+kHrs7N4pc/cfH1E7ee7hZYNPz/y8+4bm38ufDz07/eAmm6dfz77v/f//
xAegavkN1589/B1YF0QfNPiBTw8y1CBCEQ7ok4AW7lYhWRseNKGHGYYo4j8dkkihiQ+maJCDEab4
IYsJqbjiig7OaKOJJH444o6+lbihizTeiGKFLTYkI4onEgliiTw2OZpJPiYJopBH4shkkUhOqaKM
Gyro5WJRLjlljjD+KOSYW7JY5JYeRvjlm32FOaOSZ+Jo45Vi4snmiV41AuefKNl544R0ClolljFS
eCiaEv4D6KNz0fgioXb+WKOhbSaaKZlmDvohpKCGpV+opHI1aqmoPhUQACH5BAAkALIALAAA1wBY
ASwABwj/AO0JHCjwn8GDCBMqXMiwocOHDQlKnEixosWLGDNq3Mixo8ePIEOKHLkRosmTKFOqXMmy
pcuXMGPKnEmzJsKKNnPq3Mmzp8+fCUkKFQq06EIARpMqNYlUZ9OlUBdWBED1aUKrDqtiZVrV5dZ/
X7NqZQoWYleYYVFuTQt2LFuDb+G6hTm0bkiGT7/GLdtyr9mjKv1eJRtTMN7Agx8Kzhu1MWG+Z7si
bRo5cdmxCPVSlTuZcuW2nkMfPAtX4dzSnSePToyZMejRmyXHzrsZtOjVmFdn5gw79WXeum33Rv26
tmOejJPDLs3882/m0IOrhsz3t3Lo0686z67adfXmuMMT/5cO/vrz3d6Fn89e3Th57O3bgv9+3OXU
yKfjR1+vf398yuNZl59WnZlmGXfnJTgfdaHN9h6ABP5nYHpYpRbbbtHl5p2FCFJn14cdHYbhe/0F
2KF/10EYXoXBZWYViyYmyN6CKtInl341krdWiSzCCN+P/c3oGoD1OXVgkC3ylx59KcaI4IYjMime
dZZhCCWQ/DE45YxZ7vfkiFciaR6RhhUpFUVrGXfhcOoJt6R6n0EYp5q3kcZZba1JdiOKa/KIJ53U
QYanbu6daNt0pOH3nYYPDjofUhpdAOKHZs5UZmEnXVrpppz+hFOnjxXll6aglhrRpKhaZOqqrLbq
6quwxv8q66y0KvRprUvt+CqpQIUlWKrAapRblWK5l5KdSe0Fo4Z64oYsXm+qVeqLSRpoULDYWhSt
sjLxiulfVk6ZYYnQVistqNT6Z1m27Eo05J/dAeejhVndyWZl9MoraJ10Fqpjley9hai+gSaqXYP2
EnxZovD29uJs/fLmUTvtlgSYk8vh6GiX1pr3H5FK7gglhY2CLKNiWo6Xo7lKbilhgC8vSiLMuN4H
b59hYqwujTLHqLO9tDXbc5viBuxiut3NFa+xFQr95c8BDwgmoUJXjKqISYbZo8siejymyyNn3WK0
MBtdL5XorUcy1DE/7eXY/9Jc61RHaj3Y1zaCbHaXbuP/zTHZJwMuXYdLrt0y215zDaTbVrebJm2L
3uwwjgdrXOfkCsN5G9GBYq65sVg3/KPBB/cNnJtUbz6sfO/++U/jIHLqLdaiyjo7rqzeqtTtFycL
K++mwk4p7sQXb/zxyCev/PL2URTltH0tthLwlYLOEu9WCY9t6K1qKri44Mpt2rPEmvV4XNQ33SfK
zF+LJsubeo/Y/M9b65SuNpbv1fOj3qQ9sNDK12sqN0DZJKyA2zla0NjEGwHi63OeW9jm8jYoREUs
XFOzIL9UpMEIqu90zaLepugGH8O9LEdb8xmWFFRCsRnNbxw7WglRmL/OzbCFN5RP2wgYNvH8D4C9
S86w3dL1HBqirjxHchP+CKen1uEsbXs6TISEaMCOlQ47A5LanQwFxZjpkHkk9GKUmnS4LAlJcf5C
XOfm1cUo3q1uR3nYEJM4MyRNDTA9HM8PrZZHIp5QjSvcIdzUuDdDcclXOzShH9mowhPBsIuJK8se
K8a61I3vcgxi2BNRlDrfZLCTAhId0TwzQM8lEIE+GlqGNlbAsfVLjpArpdMmOSnHXEqE7culLmU3
vV368pcz0R0wh2kUWhozdsRMZlGOyUyP2ASXs+qfkZQ5zNWFrzDQPNdfyDbFazakm9RcXkAAACH5
BAAkALIALAAAAgFYASwABwj/AP8JHCgQgEEABBMqLLiwocOBBh9KnDgRIUWEFv9lTHgw4saGH0F2
1EixpMmTKFOqXMmyJcSXJkOyjOhy5smMMkkSzLkzJsyaQIMKHUrUob2jSI/i1EkSY0GPByHS1Egz
KkeGTz3qtErVYtSpVkd27bm1KdSpWGFy/arVK1qca6uaxchzZdK7ePPq3cu3r9+/gAMDXkrYK1mm
DDcuJWs4ceOmLxs7TRxZoWTIaRWHZTo5c8jFnEPLLStUsOnTqFOrNi2W8M/QXelK5Yr1ceeOdL/W
jn0bMWWnvdP6zq31p2awxnnDfgx0tfPn0KPr/ehaeHXOnTniFv16+G7qla8C/8cMWzh568kzJwe/
27dL6fDjy8cL8ipl9PcRB0d/vT/p3tcdZhhoiokXnnoIlgegWu0JmJ57RUUo4Xt5fabbbMuxBRd7
tV2YFYb/fZihff/tp5xbGz6l31rpbdYecwkSKNB8NNZI44RA1YXjjjze1JyNQAa5Wo8p0UbkkUg+
pKNJQjbp5JNQRimlYEdMaSWU9Vyp5ZZcqlZll2CGKeaYZEb3ZZlojpnkmmy2OdARbsYp55x01mmn
QnDeqeeeEqXp55hn/inooISmBkChegWK6KKMNmqPQY4q6uiklPoJaaWYZqopl4du6umnoNZ4aaik
lmqqYKOequqqrLbq6quwxvIqq5B81mrrrbj+48GuvPbqQa7ABnsrH8KuuWSEsyarrJ/FNuvss9CW
tOy01FZr7bXYZqvtttx26+234IYr7rjklltmJ+amq+66sEbr7rvwxivvvPTWa++9+OZrq1769uuv
XYualI9KA+NaMJ35HFxSwgsNrHCbD/8bFL//JMxwxBRhzKPGDXGcpMcdO+TwnCATqWnFCZXcMJsq
D9TyxilxPLKcL+OoacQOMyyQxQfzjPLOKbu8s8VACz0zQUT7XDHRQ18sdMo6K63wyAVLzTTSSTN9
dNM6A701ylr/rPTSVXftNddFj3211mubjTbYOjMaEAAh+QQAJACyACwAAC0BWAEsAAcI/wDtCRwo
MN+/gwgN5luYcKHBgw4VJkQIceK/iBUnSqR4kSHGjgwhOrxokeJIkA8fVtz48aPJkS1Jvjy5UqbG
kCxpnqRZE2VGlzpxBlXZECfIgwSTKl3KtKnTp1AHEhWp0aTNnxxtbuy5cupVrVanpsxKtOxVhWOt
lrRoNiTHtDXFqkSbkevXhnVJbv26t23WvHQrRh1MuLBhr36rhv2rF/DZu3zX7m1MVq3drWIts138
F27jzIofm+0smXJe06IZJxZsuLXr14jDRpzstrLnvpA7llxNVfXt1KdnxwZeOTVorsJ7635bFCZK
oUJFthx++d/r69gJqi5uN3hulpy7M/8HG1p8eNSYxzOWyVut3+OmvZa2HJt6e83Ec6/fz7+////w
4QaafOQhN9l4c53H3noC4pWgZsPdhxVVtIU3mmP0LbYabxc61uF/IIYoIlJLSYebTyYWCOFQqBX1
UoopPugijEf1tRNPu+20nXSfvRVTczwepR6KKQ2F1lw3yvcja9k12dqIUO5HYJRUVmnllSNOieWW
XHbpJYhMfbmjmGSWaeaQZ6YpopNsNqnmm3DGCWebdNZp551KyannnnxaieefgAZqGJp9pqnllocW
mpWgjDbqqD0qnnYlXIn6V+laks6WpaT8XRoigQ89KuqodEZqpqcAfsrdfCB6xieoJJL/KuusTfnm
kZBFIqbjT85hJJGRuh6ZK5K3TojfsF3JVZtPuyZJ1q7JUqfotIqGiWRVsG7mKqXLoYemjC1y+61o
4EIm46/4lTZatrS2665ADKr7nXsL0lvdh8e1d+Kx+cG3G7bpemjvqtQWbDC4OT0LFKbccvjsv+V1
mylzDgd8LnvXDnlitgZ3HKe18jJM2rZ1NYjpZgKfJ623+JJW8mMil+eqRe/WbDOkCMM8H3gDmyxx
zwrODGHK3nGXYIcBaiU0RTc3jSc5UVGo4bIwPuirgzA7N9OLKDKL8ky1LXnXshcfGaSPbmn9s0xO
tz2qx1LCLXeUbtfd6NxA4q33f3b3h83m3oAHLvjgc/pt+OGIJ6744ow37vjbhEcu+eSU+/f45YaJ
gvnmnLu2Seeghy766KSXbnqelaeu+uqst+7667DHLvvstM99+uKW2OnB7aPX7vvvwIt4QvDEF+86
78gnr/zyS7nB/POJGy/99NRXb/31fEKv/faKY+/99+CHL7733JdvvtsBAQAh+QQAJACyACwAAFgB
WAEsAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzTvzHsaPHjyBDihxJsqTJkyhTqlzJ
sqXLlzBjypzZUqPNmzhz6tzJs6fPnwNpCh1KtKjRo0iTKl3KtKnTp1CjSp0aE6jVq1izat3KtavX
r2DDih17k6rZs2jTql0rkqzbt3Djyo3Itq7du3jz6t3Lt6/fv4ADC3bJaLDhw4gTK647t7Hjx5Aj
S4Z4YbLly5gza97MubPnz6BDJ1xMurRps6IxQknNurW907Bjy56NsgXt27iJut6dkwVvybmDCw/+
u7jx48iTK+c8vLnz59CjS59Ovbr169izM17Ovbv37+DDiz0fT768+fPo06vnzmW9+/ditcufT7++
/b7wCTLLz7+///8ABgjffQQWSFU2Bia4lyJHCShZIQ5GKOGEEgUEACH5BABkzrIALAAAgwFYASwA
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEnS4r+TKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNqjdlkq9evYMOK
HUu2rFmkJdOqXcu2rdu3FM+WBQBArt27ePOurKu3r9+/gAMLHky4sOHDiBMrXsy4sWO9snTCnUy5
suXLmDNr3sy5s+fPoEOLHk26tOnTqFOrXs26tevXsGPLnk27tm3Zj3PrBny7t+/fCncLH068uPHj
yJMrvwu8ufPey7G6iU69+nJX1mU+3869u/fv4N9mNx9PPmf48+jTq1/Pvr379xvLy58PE779+/jz
69/Pv39b+gAGeJJ/BPIX1A0o5SDgggw26KBcAQEAIfkEAB8AsgAsAAAAAFgBsAEHCP8A7QkcSLCg
wYMIEypcyLChw4cQI0qcSLGixYsYM078x7Gjx48gQ4ocSbKkyZMoU6pcybKly5cwY8qcSbOmzZs4
c+rcybOnT5gagwodSrSo0aNIkyod+LOp06dQo0qdSrWq1atYs2q1uVRhiK5gw4odS7Zswq1ZdaBd
G/MOW7Zm48qdS7eu3bt48+rdy7ev37+AAws2+Law4cOIEytezLix45WDI0ueTNnh48uYM2euzLmz
58CaQ4sevfaz6dOo45Jezbp109SwY8uevfAr7du4i7rezbu379/Ag3PNTbx4buHIkytfznwqnObQ
o0ufTr269evYsyM2zr17au3gw4v/H08eq/fz6CmXX8++ZPr38OPLn0+/vv37cm+yaU+zG///AAb4
Fn4EFjiUgKcIKJ6BDA7GiUSGmKXghBQ2Rk6FGGao4YYcdkhagyCGKOKIJG7k4Ym/lajiiiy26OKL
MOKG4ow01mjjjThCl14AMfYo0IM+BuldjkQWaeSRSCap5JJMNunkk1BCJeSU3EVppVNUZnnclVx2
6WVjWoYp5phkXvTlmWimqeaabLbZZoJuximndmXWaeedds6p55589umnVkj8Keig6+FpqGCEJqoo
lIc26ih6Xjwq6aSdhYbIospRqml+mKa56aeghirqqKSWSmmnqKaq6qqsOjVOq1e+/wqrTi2OY6pk
Cso6666d3uorQ5L8KuxRvDI67LHIJqvssl0hWUafDdDE7LTUFgdDd+wtUey2qlbr7bfMcivuuNOB
Gy65SZqrrre8/Ipuuusi+y6S8co7r5H15qvvvvzCeO+/AAcs8MD09mvwwQgnrHCygCzscFkE2/jw
xBRXbHFRqVxMqTUWRUwVPR6DB0DIHQJgMskZmnwyyhWqzHLKI78s88w01/yYxo/ajCHOjurs888t
FYcOz3oBrSDRhxotINL14QGW0lBHLfXUUzPdkAVBUq21z1Z37TVnW4dN89dklw2Y2OORSYTZbFOJ
9oLJXtD23Oi9HR7dbttNJ9589/+tlN6ABy744IQXHrTfiCeu+OKMq2a4dI1HLvnkWT8eHeWYZ665
Umlszq/ll3veIOhWxkx6TnyZLHpdbK18+k54qb76fbLPXl/tts+He+7x7c7776O+LvyiwBeP9PDJ
GT+ZCso3Tzny0Ecv/fTBOW/99dhnryX1vmnv/ffghy/++ORTxH1KqzhWvoznt8/Thdnp4tL69Ndv
//1nu98a/vwHr///AAygAHvSP9QMUDQFPM0B5xSoBTrwgRCMoAQnSMFyJfCCDylFlirIQQ1h8IMg
bFsHR0ihEJrwhChMoQqLRsIWAmiFMFxKFWJIw6+58IY4lFMN/VISaeTQKUn4IVz/dsgXIRoxO0RM
ohKXJShFxGmJeTmiFKsDRbxM8YqhqyLrsMjFLtZIi2CsjxelApF7hNEoY0yjGtfIRnSd8Y3vaaNU
4iHHmxwkHnCMCx6XAoA8GmSPSOnjGUdCR56YTooKASRRBOlHhCiykUExSSHrOD+GPBKSS7kkJs1H
Sdht8pOykQAok9JJT46SlKVMpWJOycoVKqOVsIyl5qzjDVXWxBu1FFxFRGkab2iKkXWLTi6ddMjl
pAeXoALmkAxXzExZT5lVelwzrSIDW1rzmhmSpTa3iS1sepMmmYgJN4XyzXJaZZyRNKc618nOdrrz
hejMyDtVMpkdmHCe+MxnVDTSeIp4+vOfEtKnQAdKK4BWRI16wNJgdGHQPBJ0JA2NqEQnapqH2iQU
Fs2oRjfKUY9QFCIdDWlH6NaMjzZKpCb95yGM07AlihR6UXipTLuX0ppiBKU2zSknO6rTs4S0p0AN
6kFnGhxJvE6oBcEpUpeaVKIaLX1ODU9AAAA7

------=_NextPart_000_0007_01C6F3C4.00477360--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9IMo8HK079525; Wed, 18 Oct 2006 15:50:08 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9IMo8bp079524; Wed, 18 Oct 2006 15:50:08 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from ns4.neustar.com (ns4.neustar.com [156.154.24.139]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9IMo7en079516 for ; Wed, 18 Oct 2006 15:50:08 -0700 (MST) (envelope-from [email-masked])
Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns4.neustar.com (Postfix) with ESMTP id 4BB8D2AC85; Wed, 18 Oct 2006 22:50:02 +0000 (GMT)
Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1GaKEc-0006v2-2h; Wed, 18 Oct 2006 18:50:02 -0400
Content-Type: Multipart/Mixed; Boundary="NextPart"
Mime-Version: 1.0
To: [email-masked]
Cc: [email-masked]
From: [email-masked]
Subject: I-D ACTION:draft-ietf-pkix-srvsan-03.txt
Message-Id:
Date: Wed, 18 Oct 2006 18:50:02 -0400
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

Title : Internet X.509 Public Key Infrastructure Subject Alternative Name for expression of service name
Author(s) : S. Santesson
Filename : draft-ietf-pkix-srvsan-03.txt
Pages : 11
Date : 2006-10-18

This document defines a new name form for inclusion in the otherName
field of an X.509 Subject Alternative Name extension which allows a
certificate subject to be associated with the service name and domain
name components of a DNS Service Resource Record.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-srvsan-03.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username "anonymous" and a password of your e-mail address. After
logging in, type "cd internet-drafts" and then
"get draft-ietf-pkix-srvsan-03.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
[email-masked].
In the body type:
"FILE /internet-drafts/draft-ietf-pkix-srvsan-03.txt".

NOTE: The mail server at ietf.org can return the document in
MIME-encoded form by using the "mpack" utility. To use this
feature, insert the command "ENCODING mime" before the "FILE"
command. To decode the response(s), you will need "munpack" or
a MIME-compliant mail reader. Different MIME-compliant mail readers
exhibit different behavior, especially when dealing with
"multipart" MIME messages (i.e. documents which have been split
up into multiple messages), so check your local documentation on
how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
access-type="mail-server";
server="[email-masked]"

Content-Type: text/plain
Content-ID: <[email-masked]>

ENCODING mime
FILE /internet-drafts/draft-ietf-pkix-srvsan-03.txt

--OtherAccess
Content-Type: Message/External-body;
name="draft-ietf-pkix-srvsan-03.txt";
site="ftp.ietf.org";
access-type="anon-ftp";
directory="internet-drafts"

Content-Type: text/plain
Content-ID: <[email-masked]>

--OtherAccess--

--NextPart--

Received: from [86.126.109.77] ([86.126.109.77]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9IJawme063050 for ; Wed, 18 Oct 2006 12:36:59 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001101c6f2ec$cb527420$4d6d7e56@microsof639d20>
From: "shoot"
To: [email-masked]
Subject: WorldCup TypesMajor fields
Date: Wed, 18 Oct 2006 22:37:06 +0300
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000D_01C6F305.F09FAC20"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000D_01C6F305.F09FAC20
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000E_01C6F305.F09FAC20"

------=_NextPart_001_000E_01C6F305.F09FAC20
Content-Type: text/plain;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Bpolice Conduct Litigation Reform Disney Walt Companyvar gourlurlif =
Netscape appversion magical connect.
Asiaend or pm Ntsb Conference Manhattan is Plane am Crashend Tops =
Timephoto am Jones average passed trading of investors in signaled =
growing optimism in corporate earnings.
Baseball a car Racing is worldwide also in Winning of isnt everything =
only attitude stives fair courtesy teammates opponents ethical behavior =
integrity is grace losing expresses aspiration ethos enjoyed is sake?
Exhaust a maintain excess of memberb abovewhen continues again order in =
transfer hiatus aside accruals basic a establish a retirement benefits =
of separated of rif resulting in decline!
Surgery routine meets birth qualifying opinions am doubt am obtain a =
opinion physicians deemed shall physician reimburse upon or resolved of =
hro delay occur supervisor.
Camouflage ddr a ocz sent memory ops Urban Edition Dimms lookmore =
Entries motivated Highlights is diy rig June Processors Amds.

Notes is Washington Senators Sessions Cornyn am Pryor Salazar introduced =
thatwould reduce disparity decreasing is crack trigger mandatory minimum =
said mr or presented asimilar a possession grams in ofpowdered cocaine =
fiveyear am.
Mins Check Quotes Symbol Lookup go Locallocal zip Essayweek weeks =
compelling Dayfollow through a best a images around world Photo =
Essaybruce Willis a set Stoneit of was family am affair.
Bpolice Conduct Litigation Reform Disney Walt Companyvar gourlurlif =
Netscape appversion magical connect.
Gf gtx gts Specs or ps Preorders Quadcores November ea am fps Spyware =
Valve off hl fe Demoea.
Pacwars added Flash of Shockwave or them greeting address Enter user =
password Remember customer of Forgot password Statement in Advertiser or =
Webmaster!
------=_NextPart_001_000E_01C6F305.F09FAC20
Content-Type: text/html;
charset="windows-1250"
Content-Transfer-Encoding: quoted-printable

Bpolice Conduct Litigation Reform =
Disney Walt=20
Companyvar gourlurlif Netscape appversion magical connect.
Asiaend or =
pm Ntsb=20
Conference Manhattan is Plane am Crashend Tops Timephoto am Jones =
average passed=20
trading of investors in signaled growing optimism in corporate=20
earnings.
Baseball a car Racing is worldwide also in Winning of isnt=20
everything only attitude stives fair courtesy teammates opponents =
ethical=20
behavior integrity is grace losing expresses aspiration ethos enjoyed is =

sake?
Exhaust a maintain excess of memberb abovewhen continues again =
order in=20
transfer hiatus aside accruals basic a establish a retirement benefits =
of=20
separated of rif resulting in decline!
Surgery routine meets birth =
qualifying=20
opinions am doubt am obtain a opinion physicians deemed shall physician=20
reimburse upon or resolved of hro delay occur supervisor.
Camouflage =
ddr a=20
ocz sent memory ops Urban Edition Dimms lookmore Entries motivated =
Highlights is=20
diy rig June Processors Amds.

Notes is Washington Senators Sessions =
Cornyn am=20
Pryor Salazar introduced thatwould reduce disparity decreasing is crack =
trigger=20
mandatory minimum said mr or presented asimilar a possession grams in =
ofpowdered=20
cocaine fiveyear am.
Mins Check Quotes Symbol Lookup go Locallocal =
zip=20
Essayweek weeks compelling Dayfollow through a best a images around =
world Photo=20
Essaybruce Willis a set Stoneit of was family am affair.
Bpolice =
Conduct=20
Litigation Reform Disney Walt Companyvar gourlurlif Netscape appversion =
magical=20
connect.
Gf gtx gts Specs or ps Preorders Quadcores November ea am =
fps=20
Spyware Valve off hl fe Demoea.
Pacwars added Flash of Shockwave or =
them=20
greeting address Enter user password Remember customer of Forgot =
password=20
Statement in Advertiser or Webmaster!

------=_NextPart_001_000E_01C6F305.F09FAC20--

------=_NextPart_000_000D_01C6F305.F09FAC20
Content-Type: image/gif;
name="realtime.gif"
Content-Transfer-Encoding: base64
Content-ID: <000c01c6f2ec$cb527420$4d6d7e56@microsof639d20>

R0lGODlhjAGoAYf/AAAAAIAAAACAAICAAAAAgIAAgACAgMDAwMDcwKbK8EAgAGAgAIAgAKAgAMAg
AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA
AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA
AKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAAQIAAQKAAQMAAQOAA
QAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBAQMBAQOBAQABgQCBgQEBg
QGBgQIBgBKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCAQACgQCCgQECgQGCgQICgQKCg
QMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDgQEDgQGDgQIDgQKDgQMDgQODgQAAA
gCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAggIAggKAggMAggOAggABAgCBAgEBAgGBA
gIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBggMBggOBggACAgCCAgECAgGCAgICAgKCAgMCA
gOCAgACggCCggECggGCggICggKCggMCggOCggADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDg
gEDggGDggIDggKDggMDggODggAAAwCAAwEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAg
wKAgwMAgwOAgwABAwCBAwEBAwGBAwIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBg
wACAwCCAwECAwGCAwICAwKCAwMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDA
wGDAwIDAwKDAwP/78KCgpICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAgAEUALAAAAACMAagB
Bwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Cjxn8ePIEOKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bLjnq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUpVI86rWLNq3cq1q9evYLdW
HUu2rNmzSsOqXcu2rdu3cOOWREu3rt27eBPK3cu3r9+/gMPmHUy4sOHDiBMrXsy4sePHkCMztCV5
KpPKmDNr3sy5M8HAoEOLHk26r+fTqFNbLM26tevXsFeqnk27tu3buGvH3s27t+/fwIMLH048t/Hj
kokrX868ufPn0KNLn069uvXr2LNr3869u/fv4MOL/9+LvLz58+jTq9c5vr176Ovjy59Pv779+/jz
N3zPv7///wAGeJV+BBZo4IEIEiXgggw26OCDEEYo4YQpJWjhhRhmqOGGHCJI4YcghijiiIJ1aOKJ
KKao4oos0kXiizCK1OKMNNZo41gx5qjjjjxOeOOPQAYpZE89FinhkEhWZuSSDibp5GNMRinllFQW
9+SVWGap5ZZcdunlfFUCJ8WYZEoR5kxfJlUmmWm26aaLZ8bp3Zt01mnnnXjmqeeefPbpk5yABiro
oIQWauihiJbo56KMNuroo5BGylmilFZqaZWSZqrppqtd6ilsnIYq6qgGfWpqa6Smqmqmp7Y62qqb
uv8q66y01mrrrbjmmhOsbr6Q5wK8/qnrsF4Fa+yxdRKr7LLMsobso81GW9Oz1FabpbTYxmTtotl2
29K24IYr7rjreWtuheTiee66c6Xr7rsXsivvvOwOQBK8ydI776O64OsvkvoGLPDABBds8MEIC/rv
wgzHlzC2DX/5sLQRV2zxxRhnrPHGHHfs8agThyzyyCSXbPLJKAOm4hIf75fyresp0bJRL4OVRo8z
C1mzrTkHuXOtPQP589BERxj0j0UnrfTSTDc98tFQRw2V05dKTSPVWGet9dZcy2o1RuPg17VX44xd
6Dhlmz1o2gx+3aLacMct99x012333XjnHZjbfPf/LazegAtsQuA7S53PjIQv6ffijDd+beKQRy65
wo5XbvlCk2euuYyXZ7h5jJ2HnqQz5X1u+uSip2756ay37vqCi8usuuqv12737B7arnvcuB8ImxO7
Bw907wUKDyHxxRvfJPL6Ke881cw3//z01FcfWvT5Wa+9qd38hb3Y24dvcrBRRCr++U8Lmc7H6Lv3
/X3tx18rLfLr+P79HNevv8D407f/d/0LoAAHiJb/GRAlkjjgdhKoQOwwkFjWkgQB0SPBCZ6ngn2a
2AMbaJ0NcnA6HvygCEcoGguih4TVMeF54hYBFJrOHy6MoQyZpsIa2vCGO5khfHCYGx0+h4dADJYP
/4dIRLgF8YiqKuJykMjEJgJRiVAklEOG4cQqWvGKWCxLFIdjkWBkMS9bDGOcvkjGMtJOjGhMoxrX
yEabmPGNdGqjHHMExzqmaY54zKMe9zhEO/qRS3x8SR4CCcA/OoaQiEyk1wzZGOLIQYmMjGSSFElJ
/0jykj6rpF8wyUkbaXKTnQylKEdJylKa8pRP+qRpUFkXVfKFla3cDdvECEs4ufKWuMylLqFXy7Ps
8pfT6aUwwQdMtQxTi8U05jGX6bBkKoqZ0DSPM58ZzadM85rYlBcKwCKE11Xzm8fJpjh5A85ymvOc
6OQUHJwyzna+Jp3wjKc88+TOetrznvikErnIoCyufE5rngDVkCwCSlCr+POgcimoQhODUDQt9KEQ
jWiHGkrRilr0ohjNaI4CAgAh+QQAIABFACwAAAAAjAGoAQcI/wD/CRxIsKDBgwgTKlzIsKHDhxAj
SpxIsaLFixgzatwo0Z7HjyBDihxJsqTJkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzpkR/Pn0CDCh1K
tKjRo0iTKl3KtKnTp1CjSp1KtepRjlizat3KtavXr2DDcrVKtqzZs2iXil3Ltq3bt3Djyp1Lt67d
u3jz6t3Lt6/fv4DDph1MuLDhw4gTK17MuGrgx5AjS56csLHly5gza97MubPnlpRDix5NurTp06hT
q17NurXr17Bjy55Nu7bt26Q/697Nu7fv38CDl8RNvLjx48iTK1/OvLnz59CjS59OvTpg4diza9/O
vbv375+pgP8fP9S6+fPo06u3Tr69+/fw48ufT7++/fX48+vfz7+///8ABijgWl2UZt+BCCao4ILe
DejggxBGKOGEFFZo4YXVMajhhkJh6GF6HIYo4ogklqiWcwF8qKJBJrbo4oswFoYDZivWKF2MOOao
44489ujjdjYG6dyPRBZp5JEqpZGWkEwqh+STUEYppVR8WdLklVhmqeWWXPo15ZdghinmTV2WaeaZ
ZY6p5ppstukRmnDGKeeHbtZp55145qmnUIZ8NOefgAYq6KCEMrTnoWYVqqhdiDbq2KKQxuXopJRW
aumlmGaq6aac/hTpp6CeKUeopFbY6ak5larqWKi2StOqsMb/KuustJ7m6q245qrrrrz26uuvhdUq
bETAFmvPsMg2ZCywyTbr7LPQRvvQsr9Ka+212Gar7bbcdqsQDXRSm1I7mnpr7rnopmuhuL2quyq7
vLqrKry7ylsqvfjmq+++/Pbr778AB2yYvQQXbPDBCCfMqMC86SCcwhBHLPHEjzGcaayXUKwxkxZj
uvHHIIcsMkcdXzoymiWnrHKLJ7fs8ssurzwpzFzK7CjNOCsMAACw2ezzzwfmLPTQRBdtNHtA63l0
kEkrvfTTi/4B9dQsNo0n1VhnrfXWXMNl9dVdhy322GSXbfbZaKet9tpsQ/f1nW339/bcdAMX9905
190m3ny//6w3m30HLvjgov29JuGIJ6744gX7wfjjcBquJuSUqyv55ZgnVrnbmXfueaKbD/n56KSX
fki1oaeu+uqUy4Ne6U+yLvvsBhFhOxGJj3f77bDjuLvtvSdF3O20B288rs4cbzjtcO3sPM9vKc/b
81Exb/31hEvvI/bcv6v99+CHD2b3tolv/vkika/++uy3Lxb6MLovP6Dwvzi/a/W7eP/+KOdvIv8A
7JL/Bqi8AKbmSYognQEXeCUCOrB3DDTNA0UUQYs0o4IYTNYEN8hB+tTheBkMoQhHSMISmtBAHUzh
305YMRUqiIWBcaEM3wbDGtqQVDNE0A37ksMe/myHfPFhff+ASMQiGnFwwziiEt8nxPks8YlQZFoT
5RPFKlpxXVPMoha36KkrevGLAmrMLbi4EzCyhYxoTKMa1xg0M7pRNWxsUFwU8MY62vGOyYnjbu6g
RyrikVV9zM4fBxmZQGqHkIi8jiEXychGOvKRX0okViBJyUpJkmSV3M0lN8nJTjYnk5r0pEVAqRtR
jpKUqISbKSlCHlKk8pWwjKUs3aQJlq1yIrOk0S07kkvL7PKXXumlMIfZMWBChJiLMaYyJ4nMZjbG
Es6MprGWqSxpBoua2DylNQeTTYVs85sl6qY4iQXOcprznJcb50HQyc52utNn6oznQtaUAr3J857r
fOdU8CkgEHuMQ5/V46dAB0rQgho0mwBNKHkEqlCoMLShEN1OQAAAIfkEACAARQAsAAAAAIwBqAEH
CP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcKNGex48gQ4ocSbKkyZMoU6pcybKly5cw
Y8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypdyhQlx6dQo0qdSrWq1atYs2rdyrWr169gw3Jt
Sras2bNo06pdy7at27dw48qdS7euXZdi8+rdy7ev36x3AwseTLiw4cOIEytezLixY6Z/I0ueTLny
3seYM2vezLmz58+WQ4sezRGAadOkU6tezdry6dcAWlf9TLs2yte2c+vezdup7N/AgwuH2ru4cdrD
kytfztzg8efQHzefTt2hjOrYs2vfzr279+/gw4v/H0++vPnz6P1GX8/ecPr38OPLn0+/vv37+Be2
38+fbv7/AKrX34AEqhXggQh+VeCCDEKW4IMQztbghBRWaOGFGGao4YYcdlhchCCGKOKIJJbI1SIm
pqifhyy26JGKMMYo44w01mjjjTjmqOOOPPbo448N5bSCi0TyBuSR5hWpZIZINineklBGKeWUujlp
pXdUZsnflVx26eWXYIYp5phjamnmev/YQOaabLbp5ptwKpRPnHTWaWeCZ+Z53J0CLcPnn18t4+d8
UtCn507LHFoXoAMJil0PjEYq6aSUUqTopbZVqummnHbqqXCYhirqqKTK9OmpqKZKXKmsLqbqq7DC
/3rJJUG2autas85666505fpSrHzmahGvxBKV6yXFJsuWr8o2qxayzo4kQLSuAmvttdhmmyq19gzD
bVnahitupd+W29S46Ka71SEwmuvuu/Bmpq6n8dYb1Lyd2qtvT/hyuu+/OfW7KcAE1yTwwQhbWfDC
DDcsVMKTOixxShBLOvHFJVVsECYad6wixiCHLPLIJEc3Ssmeeazyyiai7PLL+xY0Dss01/wfzDjn
XK7Nceq8MM9ABy300F35XDDRSCcNntEEK+3009UxDTDUX0pt9dVYZ90g1V5q7fXXUHLdJdhkl232
2WinrbbEQR/Q5trNii333HRrDLeydTd5d7IC6f+Q998iegH44KztXSzhPhp+sQ6Kt4h4j41HLvnk
lFd++OM7Wq755ndhnjnnoIcu+uik7+e5jqWnrrpRp+e4+uuw89v67LTX3nXsUtqu++68o4572ff8
LvzEvbc7/PHIn1T8x8k37/yLy0cv/fQHPs8i9dhnr3161nc//PYRei9+7OCXL/b4GpqPJ/rsk64+
gu1f+H718ddv1ynfzh+g/fz3739i+gPQ/xYUwJsNkED4ykUBF8hAER3wgWproH0g2B8J1oeCGCSb
BTe4FWhw8H0ZDKHWPkjCEprwhOsTIXRQeB4VupBpLEzSC/cUwxq+aoY4zKEOTWLDHqJqh0byoRD/
h0jEIooGiEjEmBGXyMTeJTE3TYyiFKdIxSrG54mZsuJysMjFo8XJE1oUYhdBE8bkjPGMaBxfGdfI
RrHgoY2YS6Mc50jHOvoEjsCxox4vh0f7pKGPq9qjIAeZrGgQ8pBpi5MFaobIRjoSbYBszSMnaaYy
4mM4lMykJjfJyU568pOgDKX4Ilk4UZrylKicHClXOaNUroWVqXGlLLcEy1qWaJa4RJMtd8nLXvpy
iLkMpjBD9cvJDPOYVSqmMvGDzKUs8y/NjKY0p0lNsD1TQNUcSrZYcc2/ZZMo3Qzne77JPijsSpx6
Iac63YNOsawTKO105zvnSc96uiieYbGnPt+CRs9+YmmfOPGnQAfaMoDehKBbMahCz4JQrXCmHQv1
ZEMnasaIzoSiV7GoRpOCUats9KNF6ahIR8o9kOKFpCgNjUlPmlKOBAQAIfkEACUARQAsAAAAAIwB
IQAHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocSbKkyZMoU6pcybKl
y5cwGf6bSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypdyrSp06dQo0qdSrWq1atYs2rdyrWr169g
ufIIGrOs2bNo06oFGbat27dw48qdS7eu3bt48+rdy7ev37+AAwseTLgwz7WIEytezHit4biNI0ue
/PAxXMqYMyO2zLmz58+gQ4seTXghzQFBB6iGivpo65mvT6uejZr2a9u0/90+PVOz798wfdZOHTX2
0OGwbxpPztum8d3MSUufblq39eS5lWOfHT06d9irdWf8/249vPPr6JufV88ePXTg8OOfFO4+9vLW
5suv3w3dfvP850FX03Lp3beee9MlSFp1yKXn4HXPedddg+pFSCBvAspmW4HaDVhhb/KFKCJKCDpo
oIkSijeef93pl1N/HTqX3YEpXjfijThW1NOGKO53YIMXlohikDye+CNOEdao4JKdmQajhz5C6eKD
UGY4ZYz4xSjlg0HilOOXYF5kIY3MJdkif/9JmSWSAWrZnpk1thbmnHQ6NOaWKvbYYp7g2RceeRda
uCFuFE54JHN1Jgomk4w26uijkEYqaVXVTbqUophiaumkmXY60KaghirqqKSWaqphARyV6qmsThUQ
ACH5BAAlAEUALAAAIACMASEABwj/AP8JHEiwoMGDCBMqXMiwocOGAR4ejCixosWLGDNq3Mixo0eN
9kKKHGmP4kCTH1OqhKgRZcYAMGESjCnzn0ubNmm6NEmRpM+fQIMKHUq0qNGjSJMqXZoU5c2VUKMK
fPqQakWnUwtGvLlVK8+TApmKHUu2rNmzZhd+nVlzas2tbWdqPdl2J864dCnadcsTb16ZXeXyZRtz
Yt2cfu0+5YpzbtbHUiNLnky5JWTIesEedgy2cWPFVL/uFd1ZcNbAnddi5ax3denTEw2iFry2su3b
uFMOne35rty9pjP/nhuadurhCBX39q2Z82Xmr3v3dd1cNuawaLNr3869+9LChAvr/+TN+LFy5LJ1
XkcM3u/yrqBpvncO/bn69M/rH3/svb///wCOJVx+5UUHm33zFRdbbdbRBx9xDUZ3noQsMbbYegFm
qOGG2alVWoEUWsegfrwZeOByDkI4YYgUApffgiJGmNuMNNZ40W7B7VefVcANmBOKH5p23YieASbd
gEgW6ON8Mn5mHFtB/sPhlFRWSZSHwcXVnnwJcaWleEDmRR9iYhr2IHtFflkimQgKGZ5T4LGHF5E2
1mnnnR1ZNaZUel6F55+ABioooH2+GFWhWIY56KKMNuooRogi6pGkCsX56KWYZhqVlZx26umnoIYq
6qiklmrqqagC2EKqrLbq6quwxmIq66y01mrrrbjmquuuvPbq66/ABivssMQWa+yxyCZbq6bMNuvs
s80qK+201FZr7bXYZqvtttx26+234IYr7ri/QmvuudC6gy6N5LbrrqvrxivvvPTWa++9+OZb0bv8
9jtqQAAh+QQAJQBFACwAAEAAjAEhAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzI
saPHjyBDihxJsqTJkyhTqlzJsqXLlzAZ/ptJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KdGjM
p1CjSp1KFWTTq1izat3KtavXr2C3Vh1LtqzZs2jTql3Ltu3UsHDjyp1Lt67du3jz6t3Lt6/fv4AD
Cx5MuDDYhYYTd3XLuLFExZBtCtA6ObLly18FaNY8c/Pmf54/e5b8meZo0JJBV+5MurRqzp05r2Zd
U/Ts1advVg5tuvRs1LxrYx5OXOjC26hzIqednDby35NhM5++27T15tOdL1+eGnt04dC9C///57i8
eYrPdXKvnvo3duDNw4O/nlz++O+s3eumD7+7dfuonSfggDylp9x49e3nXnj4vccgfezx51x87+GE
23z+5ZehfsV16GGB4AVHnWsLxgbbgwkimJ9rKUqYYnW4SQfhfb61t+GHOH543Gkcikdhhhpi2J+E
+G0HZIvfAciciEIGyd9kA0YpZUElHjhjhSWiOGR2DV7o4H4UNpjdj+p9CSCUU6Y5YJUWIujlhNd5
eduZS8Z5ZISqUQcmlvfZSSR5agZa3oJMchcfi7m99iR0uT0n22i8iVZbjCz62dqclMqYnKCckpUj
YD0qFeqnpBKGWKlyjWrUap22+haqsMbQKuustNZq661LndphQjXxmpSrwAar0EwAFAtAVsfeZGyx
yjqFUK/PzsTPTtPWxM+1Mwmr7bb2/JPsVt/WFG64Rfma7bPXVntTutbaxO27BO5Errfi0nvsvcQa
S6y3zPLbL03j2kuvv8kuCzBT6uKkbsK4NizrQvMG3O/E9f5bME4SX0xuwAObC+hBNDFs08LpVgvv
yYJGXPHB+x7M8bwD7/stvvWyTJPH5orcrrTtouzzlCq7bPOyzL6MscEx0www0e5Gey7IPOu0cM8/
V51WQAAh+QQAJQBFACwAAGAAjAEhAAcI/wDtCRxI0B6AfwgTHlT4b2FDhQAiRnzIkGJChBInWjzo
EGPGjv8KErwocmBCfhdT/kOJkGXLkCVjypxJs6bNmzhz6tzJs6fPn0B3grT40KFRlR0XDiWKkSHI
pQllkox5UuVFly5XwgzKtavXr2DDih0r1erFpxA3VmyatCnSt2xTtmVqtm7KrFm1vqxqt6/fv4AD
Cx5MuLDhw4gTKzZL06NGiUXXNoRM1ChauRUzOj66VeTUkiv5iWaJdTTp0QjJql7NurXr140Xy55N
u7bt27hz697Nu3bs3rzLpqaqGLbx48iTKycOvLnz59CjS59Ovbr169iza9/Ovbv37+DDi6AfT768
+fPo01tdzr69+/fw48tXT7++/fv48+vfzz+9/P8ABijggASO1N+BCCbIX4EMNujggxBGKOGEFFZo
oWcKZqjhhuNd6OGHIIbYFYcklmgidSKmqOKKLLbo4oswOnjijDTWaOONOOYoXYw89ujjj0AGKWSA
KfCk45FIHjnkkkzyqAJQSUYp5ZRUVmmleU1mqeWWXHbp5ZdghilmhAEBACH5BAAlAEUALAAAgACM
ASEABwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Cjxn8ePIEOKHEmypMmTKFOqXMmy
pcuXMGPKnEmzps2bLhfi3Mmzp8+fQHNyHEq0aNGgSJMqXcq0qdOnUHsCiBpyqk2rLLFSnan16tav
YF8uBEC2q8mpZlGmldnV7FqPWN+WlAt3Jd26L9e2PZvy7j+jgAML3hhXJVqXfrNWbVmYsVq7fWHq
VfwY5eDLmDOf1Gq1LFzPH0GHBk2abFXT/0iH/my6bGfUdV2fRita9OjWq1O3hi3Sc+nOqXVzxvu6
OGvhwGWD/H3beHC8YaNLHzm8cOPny1db703ycGzt4Bdf/8e+HTr588PnZueO2i1x8bmhHx5/3Tv2
7+an649ePfz5xbHJ5t5yvvlnn30GroeecvItGB919BWYX3DzsXagghWaV99/yiG434dJjZVdef9h
eN+J95F4IYkJxseiifV5CGGJF8KXIYUPbkefi+jl5l1mQAZJ1GY+toiiikfCmOCLOGrI4474pSgl
dTSWaGKPTn4HJZZNWgnil1ExKFyDo83mnG6zWagmchz2lx9uxPG2poCwtZfmZ2pytpd8pR2n44No
jjlnbWAWCpROUgWVmHSLGooYSEJGKmlFTNm2k6WGNuqoY5t26umnoIYq6qiklmrqqaiCqemlmebl
1X6rpv8qK5FNjYciWLHGSqVPuk4466+u1groh7m+mmhMvQKrLIO1tWdnnGf6qZqgtx03prN1Yguc
hs3GxRuz2Ra3J23hvkehpcyNaO2Z3Vqr7KciRimjvFPW+yd3T75n64o5AjovkkiGB7C+/ZKJZ4/7
2vvXpAw3jBCt50rYnIMWpofwgA1uW6OARe75HJ34RrybxHrmqyWOW6bMsWviBopcsu/C6l+WXXp7
a5U2F9xkckt2DGDNZZrsb7/bAl1hjQZbvJfHNsMcM4gDC+2mwlHWiyXP9G74M9IKRz0lv+Z+rHPK
4AVM79ObjtXuur+RW+1pF7uFrbnkegunl22ObObbgqpx7GOdRb4ZbYrPduu2tQ4nrjja3T3K+OOQ
x4QosKs6HflMimeueUGXd8745qBP7vnopJculkKm33SX5R7fzBZQlnsU+uwdGfZV7HhL9vOwweoc
cmS+ViY8p8/RbvxAqOKOO++7I7t77LbaDrzjrqeuUkAAIfkEACUARQAsAACgAIwBIQAHCP8A/wkc
SLCgwYMIEypcmBAAw4cCHUKcKFFhxYkHL/67qBFjwYodH4bM6HEgyJIoU6pcyRIhgJcbQcKMGXGm
Q44vZUrcGbGmxpw+P9oEutEkQaA3Yc6M+bNn0Zw8mTLtSLSq0Z1EffK8OdVkVqlQvVJVOlRn0bNO
n2Y92bKt27ce7cmdS9de1KZPr+LN2/MuWpd/DXLta7Qw362GzyImzDFxY8KMHeuFzPcv28qP055s
vHew4sJ1Q4seTbq06dOoU6sevdBvV8yB0SZFmjdpRtqCcX/u/FntV67Ar1qWbNhz8LSyk28mrjys
1+LCn3+M3js23OvY35r2y9Z47OVHa0v/1/yd+mLo3AEHX545s3Lhl99T9g6d8u3k9j2T7w56tf//
AAYoYGitOUWfd1SZR1546AmmIHL7GYhffewxOFyDkSEHHmzxXUbfdB5e2N6E2ZVo4onT9eYcVlFZ
yCKFS4mFlVBK1SfUYQbGuCB4uv1UloyK/WbVfFrd2J2Oa70YVIdIrZUYilBGiZBpFEmJ3UhWZskS
llqSxNCAYIYp5pikQcRllx6dieaaDenIJmBfkinnnHTO9eadeOap55589unnn4AGKuighBZq6KEE
kYPoooweVOejkEYq6aSUVmrppZhmqummnHbq6aeghirqqKSWauqpqDaq6qqstronqrDGbGoaErLW
auupd9yq66689oqpq8AGK+ywxBZr7LHIJqvsssw26+yz0EbLpq/U3tpKtdiWKu223Hbr7bfghivu
uOSWi1226Kar7rrstuvuu/DGK++89NZrZ58VmKvvvvz26++/AAcs8MAEFyxwQAAh+QQAJQBFACwA
AMAAjAEhAAcI/wD/CRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatwo0Z7HjyBDihxJsqTJkyhT
qlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDCh2KkqPRo0iTKl3KtKnTp0qJSp1KtarVqzf7YIUJ
tavXr2DDih1LtqzZs2jTql1b9iRbilvjyp1Lt65LgR/yfkC612Begn0r2h1MuLBhqf8CJ1U88G/j
i4cjS55MOeRCxokBZ97LGa9evIkd62XcGXRo0Y9Nf37LurXr13z9ahbdVzHnwLUPlt48OzVv2MCD
Cw9+ErPtzKaRgz6uXDPy3c955x5Yubr164eN904++i9zzMo7d//PLb5xX+zo06unqv0xbt/wpxd8
D93978fr8+vfz5IhafPhxdecfM55NqBv7Q2n4IIMvjWaZ+UldxqBuP0H4IQFVghegxx26OGHIIY4
FgAkAiBih26ByN+KJpXoYoksHnbijDTWaOONOOao447AmcijWD4eFeSPaZ3kIkJDKnRkREtOlKRA
Ty70YkMmRllQiRhZ+dCTWv4zZZdQUnkkmAzFSFeQUZLpZUVqMpQmk05SmVGbCdEZJkFk0okmZGYO
JeVAPmLpJYlrBkromngCOuihihokKJaHLmnopFAyKuideEKqaJWE7pnoooE2eimknZYKaKSPMlro
pZjeOWqpVSL/yiqar4bKKadEhrXnrqdiSimihTbaqq+yhskrr8Sm+eimzHoKrKvMGhstscUiG+yV
wA4pabbP0uqosNbiWuyzuT4l6ZjgCivtut1+u66tzaJbKanupntsolxSGyuo4nJbrbzX4qtukrd2
+mm3o9oLcKjklpuRkdge7CzB3DrbMLLwSkvxsJUenGyzAkfs6b7K+puxvd9aTPHG1Prr8r7pFtun
n0pGHPDE2IZr88fVgsyuyh5X7LO6osbs8s3Q6pwv0CEH/LLRShfdsMN8lsSlpTAvOi+tBnN8LsO2
Lqt1x2Ozyu/WaBtKtNY4n/rroOP+OrK2R385r9sda5uwvpFKH23izELRaOecDg1O9eGIQ2X4RW0u
nvjjkEcu+eRiBQQAIfkEACUARQAsAADgAIwBIQAHCP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGi
xYsYM2rcyLGjx48gQ4ocSbKkyZMoU6pkCMBgy5UTX8JcKLNgzZkgZeE0aK+nz5/2AAi9OZAowqFG
Gw6FmdSm039Iiy6t2TIqS5lNWe5MSLUozYFAw4odS7as2bNo06pd+xPrwaxeMcIVORfqU7c3u7ql
uTfm1qME+wIWyLaw4cOIE6PduxSqULsvG+f1anVwZcmPITvOvFlgVc+ZMWNt7Dmu5sCouyr8bLdz
68igBbu2ejk0ZdKipXLuXDvyY8XAgwsfDhQvZamlk0s+nvxtc9bPHUfHSxS68eats/uGzRy7c9jX
wbv/BHz9tHnr2bWrNy0bOvH38OOfpR21b3v1slHj13++O/TN1tVnmnakdWdeegWKh9RnDErHX2zo
lRehgQuuF51yU4El34YcGvbVgxbeJyFX0/GHXmkjojighSw6pReI42k2WYOgDTjijf4h+JSOJar4
148hTeZjiC7mmJ5yFBrZn31ECpZfkk/u+BhjKzqZI45D/pfihUsC6aVH1XE2ZWCh4ZYhkmSemBuB
Ytqmm2+xvXmXTWaWuRuJNbq2Hm4undmfngJiuJ2cZO6J2ZeINmTWTHVF1OhGj/4YaaIKdWjppYkx
9dGkGXHKKKUaYSrqqGiBauqpqGJE6qqs2pPqq7DG/yrrrGCi6qmDSkl0K6h3UrQrjLQG22KinkZZ
5EMv8tXrjg71WhmendI5Zq7CVsslr35BxGl1H27KrXcxRltls9aiatZUdfY5KG/bjdbutb3pliZk
6cq4JoCp2QnjcqzVG5eQMsY5m2001qmavIBO21KrDDfsE5NWsvdalsf+ee2BEouo45YWSzudeEPO
aaKDW1YF537eLdejjw63LF+31CU4Mndq+gmyxPg6a6SAjAW6MXIkVhjzlEZxR6i70wJ4otLDUhzy
suUCeW7Gg/V484RIArz0blgG3KKVeSX1H8p0pinzyGjjfGSUW//8j8twiwqxjTNnfaXaVGN3MNYB
7+XN4thH3u203g9qrWTbg1dc3sRxN96hdD2HuS7N+EJIpJSWF0j2uwze+yycmsdr6Lp0j4swVW4i
2CbXZgrMW1GOxx6fSdtGbfuXsuc+lh1i/VX77cAHLzxFiw5vPKW6Jx/78cw37/zz1ELvXPQd/Sr9
9Radq7lWGkFdUqNLS5s0tKv5vJPy6MMNs7aQWm9RpGwzWzX3gWNv/6cU90v06qfrzGbB/GNX//T1
LxWh605CSleGSPe/09HLZPeL4EOmlj+jfY1Ha0MTvVbWr/wZCE00+hu/kpSntN2IcvWrSPoME4QV
CicgACH5BAAlAEUALAAAAAGMASEABwj/AO0JHEjQHoB/CA8eTPgPwMKFDCMibEhxIkSIER9abKiR
4cWKGj+KnLgRJMWPEjk69LgR40WMElGebNmxI8mbOHOSLMizp8+fQIMKFRpkqNGjSJMq5elwZcWZ
KVE2Vfiy6c2aLS1OVbkS61SFWa/OBCvTpdivT5+6tBqTplWpKXXKzbm0rt27ePPq3QtzZNSwasHm
/CoYatrDXsWyPDtWbcm4hf+2ney4b0mbczPv3Mu5s+fPnTNbXpzWb2nHjw0XNi04JODIj11TRlyZ
ZNnYuFlnjIu6N0zNwIMLH068uPHjyP8F/b117eqEb52qVJzxrW3pbLFORy198sPnWq1v/9/e9Tp2
3OQv76Z+OyLo9/DjyyeYvL793/bz699fHz///wAGKOCAm/1EIHJsHajgggjqN9+DEEa4FIMUVmjh
hRjmhMCGCGTo4Yd0SSjiiCSWSCKHHJrI2ToqtujiizDG+B6KG8poo14g5qjjjjwix2GPQAYp5JBE
FmnkkUgmqeSSTDbp5JNQRinllFRWaeWVWBJ445Zcdunll2CGKeaYZJZpplBZpqnmmmy26eabcMYp
55x01mnnnXjmud+ZfPbp55+ABirooIQWauihiCZqqJ6MNuroo5BGKumklFaKpaKYZqqpmJZ26umU
m4Yq6qiklmrqqaimquqqrLbq6quiBgEEACH5BAAlAEUALAAAIAGMASEABwj/AO0JHEiwoMGDCBMq
XMiwocOHECNKnEixosWLGDNq3Cjxn8ePIEOKHEmypMmTKFOqXMmypcuXMGPKnEmzps2bOHPq3Mmz
p8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUpVZL6XV6t6zNo0H1eVXkde/YqUrNazVL2GNZuSLVC3
JOEWlRu35FimdNHq7bnwH9m8Yo8C/jj4rUu4d5cW9smxsePGJ82ODbtVLWHLXP8Srkz5613Jay37
FT167eaQotVm9ey3denVpC+H7uxaNuWtrTWndq1aNmfUvHe/9v17eHGQvXPf3su89uXNrDU7x407
OvLRVoFTr65d8nXo12l//99+Ojrb1eGn355MPjF55OjBs05/mntg6JmbR13oHbz//8DFZ9+A421n
HX3ateece9K9xxuC3aXXYG71UVjheNbNB+CB2W34z2MghkhRZB1Wp5p7ldn1oIdurVchitjFJaCF
A/51YoccRihfgjSeCNtzCfqoXHJEwlZkiTROp99S/CEJo3pK2pfjk9/lB2CS2U1Z24T35VilhDwy
qOKFVkJooJkFLqimiGy2aRGULOpYIoemjVkmljMGiGCdcDo4I5UrYgcjnQVqeOaO/2lJJoRXueno
owK1hVmVpPV254uVmnbecp1lyqeNmXmaZJHL1UdkXb99htqpthUXW3vCJf83nKdGiiWcg0sm1ZdQ
i+UaVa++jgTpsGx2FayvwB6r7LLMNuvss9BGK+201D6764XUJtuStkcR6+234HZEop85CchtmuOi
e+O2uJp0LqpIVitvTX1d6tO78aaLraFttUtUix6FK/DABDdkaWnUvWqclQc3jDBnpSJMaqifkksp
ba/KCvHDtT4Mn3gmRpxVwSSXXPCW+QE6X2LSpZxymg16aW68KLL33nmmjgqvzlG6ZvLPQA+7JZj3
JRyo0QTWzOPQVyq9tNL84nym006q2fPIQWet9YjpHijyukyXF+e+ZcrMJZSKYhs2y6FWvfLO88bd
051U48qynFCji7Sauqluq6eHepdt9c2Mtouv3IiPyTfMX+Y5M50Ah42nv1anbXfOhk7IYJ6Jd35v
3govXN6kKTpNOnEpGjer2KvGxqqfMcvX6abrfdqf57ifdC1ah+eO0tbAB3/RWRr7zpfwyCcfqfHM
N+/889BHL/1JAQEAIfkEACUARQAsAABAAYwBIQAHCP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGi
xYsYM2rcyLGjx48gQ4ocSbKkyZMM7alcybKly5cwY8qcSbOmzZs4c+rcybOnz59AgwodqhOl0aNI
kypdyrQp0adQo0qdSrWq1atYs2rdyrWr169gw4odS7as2bNo0wptyrat27dw48qdS7eu3bt48+rd
y7ev37+AAwseTLiw4cOIEytezLix48eQI0serLay5cuYM3+dzLmz58+gQ4seTXopvtKoJ2pezbq1
69cxU8ueTbu27duCYevezbu379/AgwsfTry48eOrcStfThm58+fQo0ufTr269evYs2vfzr27Vebg
w4sOH0++vPnz6JF6X8/+ekAAIfkEACUARQAsAABgAYwBIQAHCP8A7QkcSLCgwYMIEypcyLChw4cQ
I0qcSLGixYsYM2rcKPGfx48gQ4ocSbKkyZMoU6pcybKly5cwY8qcSbOmzZsuOercybOnz59Agwod
SrSo0aNIkypdyvQozqdQo0qdSrWq1atYs2rdyrWr169gw3JtSras2bNo0xIVy7at27dw42ZVS7eu
3bt48+rdy7evX79yAwseTJhwFLd/EytezLix48eQI0suTLmy5cuYM2vezLkzVzyeQ4seTbq06dOo
U6tezbq169ewY8ueTbu27dtUJevezbu379/Ag+/FTby48ePIkysHKby58+dLl0uf3ho6xC3Ws2tv
SL27d7aMvosXH097u/nz6B2SX8++vfv38KVeik9/fEAAIfkEAP+6RQAsAACAAYwBIQAHCP8A/wkc
SLCgwYMIE15KyLChw4cQI0qcSLGixYsYM2rcyLEjQnsgQ4ocSbKkyZMoU6pcyTJkoJYwY8qcSbOm
zZs4c+rcydKjz59AgwodSrSo0aNCeSpdyrSp06dQo0qdSrWq1atYs2rdyrWr169gw4odS7as2bNo
06pdexKp27dw48qdS7eu3bt48+rdy7ev37+AAwseTLiw4cOIE9dly7ix48eQI0ueTLmy5cuYM2ve
zLmz589gFYseTbo0XdCoU6tezbq169ewY8ueTbu27du4c+vezbu3b9CmgwsfTry48ePIk0/8zbx5
ZOXQo0sH7Ly69evYs2vfzr270+ngw4sTH0++vPm/1s6rX8++vfv38CEGBAAh+QQAIABFACwAAAAA
jAGoAQcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatwo8Z/HjyBDihxJsqTJkyhTqlzJ
sqXLlzBjypxJs6bNmzhz6tzJs6fPn0CDlmQltKjRo0iTKl3KtKlTjxyjSp1KtarVq1izat3KtavX
r2DDih3r9anZs2jTql3Lk6zbt3Djyp1Lt67dglnu6t3Lt6/fv4ADCx5MuLDhw4gLsl3MuLHjx0sT
S55MuTJEyJgza97MuaTlz6BDJ+5MurTp00xFq17NurXr17Bjy55Nu7bt27hz697Nu/dG1MCDCx9O
vLjx48iTK1/OvLnz59Cj2/RNvbr169izf5XOvbt3mdrDi/8fT7689u/o06sXab69+/fw48ufT18w
vPr48+vfz7+///8ABijggAT69Y5s6yV41AkKnlXggxBGKGFoDVZooXITZkjdhRx26OGH6RkBIlIa
lrjbiCimuJiJLN6m4oswOtXijLPFaOONOOaoI2k09vjajkAGGZOPRBZp5JEHCankkigh6aRkTNp4
SZRUVmllk09mWdiVXHbp5ZdghimmcVqWKdiYaKap5ppstukmS2bG6debdNZp55145vmhnHz26ed4
egYqqGmzDGrooXX+qShciDbK2aKQjuXopJRWaumlmIYU6aacdurpp6CGKuqokGZq6lOkpqrqqhwp
weqrsMb/utWptNZqZzy25qrrrrz+I+uvSfYqLE7AFjvQsMgmq2xqxha77LMtNesstNRiKe212KZa
7bbcduvtt+CGa2225Ja7qbjcmssquuy26+67lKor77z01mvvvfjmCxq8/PYbr76d+osswAEfWoTA
CCescKYEc7rwwxCj2fC5EVds8cU7eYPxWhNHujHDHS/6MaYhV/REye/Rg/LKLLfs8stVjSzzzDTX
bHPFMOesc243N7pzlj0HLTR3Pz859KBFO3n00kwfl/TTUO/bNJ5RFzn11VjzWLWPWSOKSddgbi32
2GQTDPbZaKtV9tpst41t2nDHHZnbdNdt9914jyb33nz//5T334AHbrRmzvRtOLRYHI6o4Iw37vjj
kEcu+eSUg5VK5ZhnrrfinHcOp+aghy766Pd6bvrpqItJunupt4766rDHLvuWri85++245z5X7bwr
rvvvwAcv/PDEF2/88Y/3LiTyuikfJPOd8gL99IA6b/312Gev/fbcd+/959TT9v34NYdv/vmzk6/+
+uybhf778IPe/vz01+9T/Pjnr//+s9pfIf99OsbKaiEa/7WkFgg0IHoQWIvmnI+BsFGgSBgowe8k
sILpAiCFMMjBDhpQgyAEmge9E8LPjPCEKBxfCS2Twhb2aoUw5JoLZ0hD18VwMjV04A0xR4lm5ZA5
OwyiEP8b9sPlDPGIDyoihpA4GCXGCAhOHBMhOMjEJkbxioKq4pmwyEWqaZEwSPiiGOfTxeGM8Yxo
TOO1AKDGu7CxjXV5Y1nKqBMA0PGOeLQhHOuSx9PskY99LM0fB4mdQAqSeHPgjSEX2SVCOvKRkDQX
Ix8VyUpa8pKrmqQmN8nJTnryk3PDpChbA8rGjPKUqyklY1DZFVWuSFoDYKUs5edKjs3ylrjM5YRq
aUtd+hIwvAwmh35JFWEas0HEnMoxl8nMNSVTKs1syjOnaZdoMit0PKBmhqwZSm1eZGgACKc47Zio
lo1TnN4kFVvQocp0YoSbSnGnPMMCz3ra83ktosM898ksz37e8J4ADahA7eTPgsZsoAhNqHNGoNCG
ksmgDnHoTiAaUYnmhKINsWhOAgIAOw==

------=_NextPart_000_000D_01C6F305.F09FAC20--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9I7ZUr5089624; Wed, 18 Oct 2006 00:35:30 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9I7ZUvD089623; Wed, 18 Oct 2006 00:35:30 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from miram.origin-it.net (mail.de.atosorigin.com [194.8.96.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9I7ZPkM089607 for ; Wed, 18 Oct 2006 00:35:28 -0700 (MST) (envelope-from [email-masked])
Received: from markab.hbg.de.int.atosorigin.com (dehsfw3e.origin-it.net [194.8.96.68]) by miram.origin-it.net (8.13.8/8.13.8/hmo020206) with ESMTP id k9I7ZI6d077016 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 18 Oct 2006 09:35:18 +0200 (CEST) (envelope-from [email-masked])
Received: from DEHHX001.deuser.de.intra (dehhx001.hbg.de.int.atosorigin.com [161.90.164.119]) by markab.hbg.de.int.atosorigin.com (8.13.8/8.13.8/hmo020206) with ESMTP id k9I7ZHZC045189; Wed, 18 Oct 2006 09:35:17 +0200 (CEST) (envelope-from [email-masked])
Received: from DEFMX001.deuser.de.intra ([156.150.130.154]) by DEHHX001.deuser.de.intra with Microsoft SMTPSVC(6.0.3790.1830); Wed, 18 Oct 2006 09:35:17 +0200
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6F287.F474F089"
Subject: AW: RFC4210 questions
Date: Wed, 18 Oct 2006 09:35:15 +0200
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: RFC4210 questions
Thread-Index: AcbyBHhXsmjrpa9LRZ+n5Dw4eSm9eAAgvyBQ
From:
To:
Cc:
X-OriginalArrivalTime: 18 Oct 2006 07:35:17.0362 (UTC) FILETIME=[F51F6520:01C6F287]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6F287.F474F089
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Denis,
=20
it's a little tricky but I see where I was wrong. Thanks for that hint
:)
=20
Best regards
=20
Thomas

________________________________

Von: [email-masked]
[mailto:[email-masked]] Im Auftrag von Denis Pinkas
Gesendet: Dienstag, 17. Oktober 2006 17:38
An: [email-masked]
Betreff: Re: RFC4210 questions
=09
=09
Thomas,
=20
I will only answer the first of your two questions.
=20
The text from RFC 4210 is only describing what a CA should do,
but does not say=20
a word on how a relying party should use the information placed
by the CA.
=20
Two cases were considered.
=20
A relying party has the "old with old" certificate and wants to
move to=20
the "new with new" certificate. For this, it will use both the
"new with old" certificate=20
and the "new with new" certificate.
=20
A relying party has been directly installed with the "new by
new" certificate, but still=20
needs to verify certificates that were issued under the old key.
For this, it will use the=20
"old with new" certificate".
=20
The current sentence states :
=20

The "old with new" certificate must have a validity period
starting

at the generation time of the old key pair and ending at the
expiry

date of the old public key.

=20

The sentence is correct.
=20
This illustrates the need to have a document which describes the
use of these certificates.
This is part of my recent proposal to develop an RFC on Key
Compromise, Rollover and Loss.
=20
Denis
=20
________________________________

Hi all,
=20
I've got some questions dealing with RFC 4210.
=20
First: In 4.4.1 CA Operator Actions the following is stated:
=20
"The "old with new" certificate must have a validity period
starting
at the generation time of the old key pair and ending at the
expiry
date of the old public key."
=20
This sound prettey wrong to me, because at geneartion time of
the OLD key pair no NEW key exists to create the certificate (and the
new certificate doesn't exist either). Is this just a "typo" or is there
something I didn't understand the rigt way?
=20
Second: Why is the proof of possession fpr encryption keys
(4.3.2) defined so comlicated? Wouldn't it be easier to encrypt
something (e. g. the hash of the ToBeSigned ;-) ) at the time the
request ist generated? In other words: Why is it not allowed to use the
encryption key pair as a signature key pair for that single time???
=20
Best regards
=20
Thomas Beckmann
=20
________________________________

------_=_NextPart_001_01C6F287.F474F089
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Denis,

it's a little tricky but I see where I was =
wrong.=20
Thanks for that hint :)

Best regards

Thomas

Von: [email-masked]=20
[mailto:[email-masked]] Im Auftrag von Denis=20
Pinkas
Gesendet: Dienstag, 17. Oktober 2006 =
17:38
An:=20
[email-masked]
Betreff: Re: RFC4210=20
questions

Thomas,

I will only answer the first of your two questions.

The text from RFC 4210 is only describing what a CA should do, =
but does=20
not say

a word on how a relying party should use the information =
placed by=20
the CA.

Two cases were considered.

A relying party has the "old with old" certificate and wants =
to move=20
to

the "new with new" certificate. For this, it will use both the =
"new with=20
old" certificate

and the "new with new" certificate.

A relying party has been directly installed with the "new by new" =

certificate, but still

needs to verify certificates that were issued under the old key. =
For=20
this, it will use the

"old with new" certificate".

The current sentence states :

=
The=20
"old with new" certificate must have a validity period=20
starting

=
at the=20
generation time of the old key pair and ending at the=20
expiry

=
date of=20
the old public key.

The sentence is correct.

This illustrates the need to have a document which describes the =
use of=20
these certificates.

This is part of my recent proposal to develop an RFC on Key =
Compromise,=20
Rollover and Loss.

Denis

Hi=20
all,

I've =
got some=20
questions dealing with RFC 4210.

First: In 4.4.1 CA=20
Operator Actions the following is stated:

"The=20
"old with new" certificate must have a validity period=20
starting
at the generation time of the old key pair =
and ending=20
at the expiry
date of the old public =
key."

This =
sound prettey=20
wrong to me, because at geneartion time of the OLD key pair no NEW key =
exists=20
to create the certificate (and the new certificate doesn't exist =
either). Is=20
this just a "typo" or is there something I didn't understand the rigt=20
way?

Second: Why is the=20
proof of possession fpr encryption keys (4.3.2) defined so comlicated? =

Wouldn't it be easier to encrypt something (e. g. the hash of the =
ToBeSigned=20
;-) ) at the time the request ist generated? In other words: Why is it =
not=20
allowed to use the encryption key pair as a signature key pair for =
that single=20
time???

Best=20
regards

Thomas =
Beckmann

------_=_NextPart_001_01C6F287.F474F089--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9HH1CJ6021824; Tue, 17 Oct 2006 10:01:12 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9HH1CbK021823; Tue, 17 Oct 2006 10:01:12 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9HH1BJY021815 for ; Tue, 17 Oct 2006 10:01:12 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6F20D.D5B715A0"
Subject: RE: Protecting Against Weak Hash Algorithms
Date: Tue, 17 Oct 2006 10:02:24 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Protecting Against Weak Hash Algorithms
Thread-Index: Acbc6FpnVYOWAh89Tpml7zf6RMeu4wVI0UPgAACNDqA=
From: "Santosh Chokhani"
To:
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6F20D.D5B715A0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Sean,

=20

The long term goal (with defense in depth in mind) is simple. The
identification of acceptable hash algorithm(s) should be bound to the
pubic key in the certificate. Thus, listing these as part of SPKI is
what we want to move to.

=20

________________________________

From: Turner, Sean P. [mailto:[email-masked]]=20
Sent: Tuesday, October 17, 2006 12:54 PM
To: Santosh Chokhani; [email-masked]
Subject: RE: Protecting Against Weak Hash Algorithms

=20

I'm really curious whether you think we ought to do this in the
certificate or in the protocol that's carrying the signed/hashed object.
Jim Schaad and I are working on an as yet unpublished ID in S/MIME to
protect against an attacker stripping a SignedData, which has two
SingerInfos one that is "strong" algorithm and one that is "weak"
algorithm, of the "weak" algorithm. All of this is of course predicated
on the relying party supporting more than one algorithm and processing
the new attribute.

=20

spt

=20

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Santosh Chokhani
Sent: Wednesday, September 20, 2006 3:10 PM
To: [email-masked]
Subject: Protecting Against Weak Hash Algorithms

As you know the hashing algorithms are in state of flux (We know MD5 is
bad, SHA-1 is beginning to smell and so on).

=20

Also, we know that many relying parties implement many of these
algorithms.

=20

Also, Russ has been talking about making PKIX RFCs algorithm independent
so that algorithms can be easily swapped in and out.

=20

I think we should have a debate on security issues surrounding weak
hashes, specifically relying parties snookered into verifying a
signature using a weak hash that can easily create collision with
payload that was actually signed using a strong hash.

=20

While it will be a great deal of pain to the client software, but
subject public key information through OID or parameters could specify
one or more hash algorithms to be used with a signature key. This will
protect against the spoofing of relying party into using a weak hash
during signature verification. I thought while we are debating the
syntax for ECC based algorithms, this may be a good time to suffer that
pain.

=20

Santosh Chokhani=20
Orion Security Solutions, Inc.=20
(703) 401-7088=20
[email-masked]=20

=20

------_=_NextPart_001_01C6F20D.D5B715A0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Sean,

The long term goal (with defense in depth in mind) is =
simple.
The identification of acceptable hash algorithm(s) should be bound =
to the
pubic key in the certificate.  Thus, listing these as part of SPKI =
is what we
want to move to.

From: =
Turner, Sean P.
[mailto:[email-masked]]

Sent: Tuesday, October =
17, 2006
12:54 PM

To: Santosh
Chokhani; [email-masked]

Subject: RE: Protecting =
Against
Weak Hash Algorithms

I'm really curious whether you think we ought to do =
this in
the certificate or in the protocol that's carrying the signed/hashed
object.  Jim Schaad and I are working on an as yet =
unpublished ID in
S/MIME to protect against an attacker stripping a SignedData, =
which
has two SingerInfos one that is "strong" algorithm and =
one that
is "weak" algorithm, of the "weak" =
algorithm.
All of this is of course predicated on the relying party supporting more =
than
one algorithm and processing the new attribute.

spt

From:
[email-masked] [mailto:[email-masked]] =
On Behalf Of Santosh
Chokhani

Sent: Wednesday, =
September 20,
2006 3:10 PM

To: [email-masked]

Subject: Protecting =
Against Weak
Hash Algorithms

As
you know the hashing algorithms are in state of flux (We know MD5 is =
bad, SHA-1
is beginning to smell and so on).

Also,
we know that many relying parties implement many of these =
algorithms.

Also,
Russ has been talking about making PKIX RFCs algorithm independent so =
that
algorithms can be easily swapped in and =
out.

I
think we should have a debate on security issues surrounding weak =
hashes,
specifically relying parties snookered into verifying a signature using =
a weak
hash that can easily create collision with payload that was actually =
signed
using a strong hash.

While
it will be a great deal of pain to the client software, but subject =
public key
information through OID or parameters could specify one or more hash =
algorithms
to be used with a signature key.  This will protect against the =
spoofing
of relying party into using a weak hash during signature =
verification.  I
thought while we are debating the syntax for ECC based algorithms, this =
may be
a good time to suffer that pain.

Santosh =
Chokhani

Orion
Security Solutions, Inc.

(703)
401-7088

[email-masked]=

------_=_NextPart_001_01C6F20D.D5B715A0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9HGwjJx021615; Tue, 17 Oct 2006 09:58:45 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9HGwj4H021614; Tue, 17 Oct 2006 09:58:45 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp101.biz.mail.re2.yahoo.com (smtp101.biz.mail.re2.yahoo.com [68.142.229.215]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9HGwhg7021601 for ; Tue, 17 Oct 2006 09:58:44 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 50870 invoked from network); 17 Oct 2006 16:54:02 -0000
Received: from unknown (HELO Wylie) ([email-masked]@70.17.69.99 with login) by smtp101.biz.mail.re2.yahoo.com with SMTP; 17 Oct 2006 16:54:01 -0000
Reply-To:
From: "Turner, Sean P."
To: "'Santosh Chokhani'" ,
Subject: RE: Protecting Against Weak Hash Algorithms
Date: Tue, 17 Oct 2006 12:53:45 -0400
Organization: IECA, Inc.
Message-ID: <00dd01c6f20c$cf5c2650$0201a8c0@Wylie>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_00DE_01C6F1EB.484A8650"
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <[email-masked]>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Thread-Index: Acbc6FpnVYOWAh89Tpml7zf6RMeu4wVI0UPg
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_00DE_01C6F1EB.484A8650
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

I'm really curious whether you think we ought to do this in the certificate
or in the protocol that's carrying the signed/hashed object. Jim Schaad and
I are working on an as yet unpublished ID in S/MIME to protect against an
attacker stripping a SignedData, which has two SingerInfos one that is
"strong" algorithm and one that is "weak" algorithm, of the "weak"
algorithm. All of this is of course predicated on the relying party
supporting more than one algorithm and processing the new attribute.

spt

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Santosh Chokhani
Sent: Wednesday, September 20, 2006 3:10 PM
To: [email-masked]
Subject: Protecting Against Weak Hash Algorithms

As you know the hashing algorithms are in state of flux (We know MD5 is bad,
SHA-1 is beginning to smell and so on).

Also, we know that many relying parties implement many of these algorithms.

Also, Russ has been talking about making PKIX RFCs algorithm independent so
that algorithms can be easily swapped in and out.

I think we should have a debate on security issues surrounding weak hashes,
specifically relying parties snookered into verifying a signature using a
weak hash that can easily create collision with payload that was actually
signed using a strong hash.

While it will be a great deal of pain to the client software, but subject
public key information through OID or parameters could specify one or more
hash algorithms to be used with a signature key. This will protect against
the spoofing of relying party into using a weak hash during signature
verification. I thought while we are debating the syntax for ECC based
algorithms, this may be a good time to suffer that pain.

Santosh Chokhani
Orion Security Solutions, Inc.
(703) 401-7088
[email-masked]

------=_NextPart_000_00DE_01C6F1EB.484A8650
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I'm really curious whether you think we ought =
to do this in=20
the certificate or in the protocol that's carrying the signed/hashed=20
object.  Jim Schaad and I are working on an as yet =
unpublished ID in=20
S/MIME to protect against an attacker stripping a SignedData, =
which=20
has two SingerInfos one that is "strong" algorithm and one that is =
"weak"=20
algorithm, of the "weak" algorithm.  All of this is of course=20
predicated on the relying party supporting more than one algorithm and=20
processing the new attribute.

spt

From: [email-masked]=20
[mailto:[email-masked]] On Behalf Of Santosh=20
Chokhani
Sent: Wednesday, September 20, 2006 3:10 =
PM
To:=20
[email-masked]
Subject: Protecting Against Weak Hash=20
Algorithms

As you=20
know the hashing algorithms are in state of flux (We know MD5 is bad, =
SHA-1 is=20
beginning to smell and so on).

Also,=20
we know that many relying parties implement many of these=20
algorithms.

Also,=20
Russ has been talking about making PKIX RFCs algorithm independent so =
that=20
algorithms can be easily swapped in and =
out.

I think=20
we should have a debate on security issues surrounding weak hashes, =
specifically=20
relying parties snookered into verifying a signature using a weak hash =
that can=20
easily create collision with payload that was actually signed using a =
strong=20
hash.

While=20
it will be a great deal of pain to the client software, but subject =
public key=20
information through OID or parameters could specify one or more hash =
algorithms=20
to be used with a signature key.  This will protect against the =
spoofing of=20
relying party into using a weak hash during signature =
verification.  I=20
thought while we are debating the syntax for ECC based algorithms, this =
may be a=20
good time to suffer that pain.

Santosh=20
Chokhani
Orion Security Solutions,=20
Inc.
(703) 401-7088=20

[email-masked]=20

------=_NextPart_000_00DE_01C6F1EB.484A8650--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9HFcT78013855; Tue, 17 Oct 2006 08:38:29 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9HFcT7F013854; Tue, 17 Oct 2006 08:38:29 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9HFcLWH013842 for ; Tue, 17 Oct 2006 08:38:25 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-001.frcl.bull.fr [129.184.87.31]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id RAA29558 for ; Tue, 17 Oct 2006 17:40:37 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006101717381758:6373 ; Tue, 17 Oct 2006 17:38:17 +0200
Date: Tue, 17 Oct 2006 17:38:14 +0200
From: "Denis Pinkas"
To: "[email-masked]"
Subject: Re: RFC4210 questions
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 17/10/2006 17:38:17, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 17/10/2006 17:38:19, Serialize complete at 17/10/2006 17:38:19
Message-ID:
Content-Type: multipart/alternative; boundary="=====003_Dragon411060081141_====="
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

--=====003_Dragon411060081141_=====
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
charset="iso-8859-1"

Thomas,

I will only answer the first of your two questions.

The text from RFC 4210 is only describing what a CA should do, but does not say
a word on how a relying party should use the information placed by the CA.

Two cases were considered.

A relying party has the "old with old" certificate and wants to move to
the "new with new" certificate. For this, it will use both the "new with old" certificate
and the "new with new" certificate.

A relying party has been directly installed with the "new by new" certificate, but still
needs to verify certificates that were issued under the old key. For this, it will use the
"old with new" certificate".

The current sentence states :

The "old with new" certificate must have a validity period starting
at the generation time of the old key pair and ending at the expiry
date of the old public key.

The sentence is correct.

This illustrates the need to have a document which describes the use of these certificates.
This is part of my recent proposal to develop an RFC on Key Compromise, Rollover and Loss.

Denis

Hi all,

I've got some questions dealing with RFC 4210.

First: In 4.4.1 CA Operator Actions the following is stated:

"The "old with new" certificate must have a validity period starting
at the generation time of the old key pair and ending at the expiry
date of the old public key."

This sound prettey wrong to me, because at geneartion time of the OLD key pair no NEW key exists to create the certificate (and the new certificate doesn't exist either). Is this just a "typo" or is there something I didn't understand the rigt way?

Second: Why is the proof of possession fpr encryption keys (4.3.2) defined so comlicated? Wouldn't it be easier to encrypt something (e. g. the hash of the ToBeSigned ;-) ) at the time the request ist generated? In other words: Why is it not allowed to use the encryption key pair as a signature key pair for that single time???

Best regards

Thomas Beckmann

--=====003_Dragon411060081141_=====
Content-Transfer-Encoding: 7bit
Content-Type: text/html;
charset="iso-8859-1"

Thomas,

I will only answer the first of your two questions.

The text from RFC 4210 is only describing what a CA should do, but does not
say

a word on how a relying party should use the information placed by the
CA.

Two cases were considered.

A relying party has the "old with old" certificate and wants to move
to

the "new with new" certificate. For this, it will use both the "new with
old" certificate

and the "new with new" certificate.

A relying party has been directly installed with the "new by new"
certificate, but still

needs to verify certificates that were issued under the old key. For this,
it will use the

"old with new" certificate".

The current sentence states :

The "old
with new" certificate must have a validity period starting

at the
generation time of the old key pair and ending at the
expiry

date of
the old public key.

The sentence is correct.

This illustrates the need to have a document which describes the use of
these certificates.

This is part of my recent proposal to develop an RFC on Key Compromise,
Rollover and Loss.

Denis

Hi
all,

I've got some
questions dealing with RFC 4210.

First: In 4.4.1 CA
Operator Actions the following is stated:

"The
"old with new" certificate must have a validity period starting

at the generation time of the old key pair and ending at the
expiry
date of the old public key."

This sound prettey
wrong to me, because at geneartion time of the OLD key pair no NEW key exists to
create the certificate (and the new certificate doesn't exist either). Is this
just a "typo" or is there something I didn't understand the rigt
way?

Second: Why is the
proof of possession fpr encryption keys (4.3.2) defined so comlicated? Wouldn't
it be easier to encrypt something (e. g. the hash of the ToBeSigned ;-) ) at the
time the request ist generated? In other words: Why is it not allowed to use the
encryption key pair as a signature key pair for that single
time???

Best
regards

Thomas Beckmann

--=====003_Dragon411060081141_=====--

Received: from [124.146.45.213] (qejnuw@[124.146.45.213]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9H3jpc6042276 for ; Mon, 16 Oct 2006 20:45:53 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000b01c6f19e$12e54560$d52d927c@user15la489l0b>
From: "price"
To: [email-masked]
Subject: looking out Terrace
Date: Tue, 17 Oct 2006 12:41:05 +0900
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0007_01C6F1E9.82CA7C60"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0007_01C6F1E9.82CA7C60
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0008_01C6F1E9.82CA7C60"

------=_NextPart_001_0008_01C6F1E9.82CA7C60
Content-Type: text/plain;
charset="euc-kr"
Content-Transfer-Encoding: quoted-printable

Adventure Forum am Places you Love Main Email is the Editors a Customer =
Service Subscribe November Lovethis month is we asked leading.
Marthas is Vineyard Mcaninch Copy Clark Thompson Associate teardrop =
Mount of new.
Own am vote Rasmus or Editor am Chief secret of canyons gulches Four in =
Corners areafrom Bluff.
Spots in us parks Shop amp Vacation With Newstopo Create Post or =
Mapstrails map Catalog of in Magazine Excerpts Submarine in Builder =
First am Ascent am Calendar Archive.
Ideashow can prevent climbing spots is us parks Shop amp am Vacation =
With Newstopo Create a?
Cannot or guarantee such will found by or board agree a adhere policy =
offensive legally am assume.
San Francisco along are Usdue a immediate am nature am this medium =
Online does.

Us parks Shop a amp Vacation With Newstopo Create Post Mapstrails of map =
Catalog a in Magazine Excerpts in Submarine a Builder in First Ascent =
Calendar Archive Index Media.
Guarantee such will found in by board a agree adhere policy offensive =
legally assume full sole gtgtsave percent off a cover price More =
Forumsis.
Chief secret or canyons gulches Four Corners areafrom Bluff Utah in to =
am Monument or Valley Jannot Executive am Editor entirety of.
Islandeve Binder Letchworth State Geneseo Mcclarty Culebra Puerto =
Ricosteve Turner Production Associate Nihamin Assistant is coast san =
Francisco a?
------=_NextPart_001_0008_01C6F1E9.82CA7C60
Content-Type: text/html;
charset="euc-kr"
Content-Transfer-Encoding: quoted-printable

Adventure Forum am Places you Love Main =
Email is=20
the Editors a Customer Service Subscribe November Lovethis month is we =
asked=20
leading.
Marthas is Vineyard Mcaninch Copy Clark Thompson Associate =
teardrop=20
Mount of new.
Own am vote Rasmus or Editor am Chief secret of canyons =
gulches=20
Four in Corners areafrom Bluff.
Spots in us parks Shop amp Vacation =
With=20
Newstopo Create Post or Mapstrails map Catalog of in Magazine Excerpts =
Submarine=20
in Builder First am Ascent am Calendar Archive.
Ideashow can prevent =
climbing=20
spots is us parks Shop amp am Vacation With Newstopo Create a?
Cannot =
or=20
guarantee such will found by or board agree a adhere policy offensive =
legally am=20
assume.
San Francisco along are Usdue a immediate am nature am this =
medium=20
Online does.

Us parks Shop a amp Vacation With =
Newstopo Create=20
Post Mapstrails of map Catalog a in Magazine Excerpts in Submarine a =
Builder in=20
First Ascent Calendar Archive Index Media.
Guarantee such will found =
in by=20
board a agree adhere policy offensive legally assume full sole gtgtsave =
percent=20
off a cover price More Forumsis.
Chief secret or canyons gulches Four =
Corners=20
areafrom Bluff Utah in to am Monument or Valley Jannot Executive am =
Editor=20
entirety of.
Islandeve Binder Letchworth State Geneseo Mcclarty =
Culebra=20
Puerto Ricosteve Turner Production Associate Nihamin Assistant is coast =
san=20
Francisco a?

------=_NextPart_001_0008_01C6F1E9.82CA7C60--

------=_NextPart_000_0007_01C6F1E9.82CA7C60
Content-Type: image/gif;
name="Vacation.gif"
Content-Transfer-Encoding: base64
Content-ID: <000601c6f19e$12e2d460$d52d927c@user15la489l0b>

R0lGODlhcALEAYf2AAAAAIAAAACAAICAAAAAgIAAgACAgMDAwMDcwKbK8EAgAGAgAIAgAKAgAMAg
AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA
AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA
AKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAAQIAAQKAAQMAAQOAA
QAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBAQMBAQOBAQABgQCBgQEBg
QGBgQIBgBKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCAQACgQCCgQECgQGCgQICgQKCg
QMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDgQEDgQGDgQIDgQKDgQMDgQODgQAAA
gCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAggIAggKAggMAggOAggABAgCBAgEBAgGBA
gIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBggMBggOBggACAgCCAgECAgGCAgICAgKCAgMCA
gOCAgACggCCggECggGCggICggKCggMCggOCggADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDg
gEDggGDggIDggKDggMDggODggAAAwCAAwEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAg
wKAgwMAgwOAgwABAwCBAwEBAwGBAwIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBg
wACAwCCAwECAwGCAwICAwKCAwMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDA
wGDAwIDAwKDAwP/78KCgpICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAgAJUALAAAAABwAsQB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK7GivpMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0KNCRSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYBsa
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27ePPq3QszrN+/gAMLHky48FK+iBMrXsy4sePHkCNLnky5
suXLlQ1r3sy5s+fPoJFiHk26tOnTqFOrXs26tevXi0PLnk27tu3bXWHr3s27N1A7vn3iHk68uPHj
yBEGX858rbjm0KNLn069uvXr2LNr3869u/fv4MMr/05O3muq8ujToxfPvr379/Djy59Pv779+/ib
q9/Pv7///wAGKOCABBYoUX4IJqigaQY26OCDEBa24IQUVshYhBhmqOGGHHbo4YcghijiiCSWaOKJ
KKao4oostujiizDGKOOMIFlo44045qjjjjz26OOPQEJH45BEFilVkEgmqWRJRjbp5JNQRinllFRW
aeWVTi2p5ZZcdunll2CGKeaYZJZp5pk4YanmmkOi6eabQrIp55x01mnnnXhSxUqefFoJ55+ABiro
oH/2aeihAhKq6KKMNuroo5BGKumklFZq6aWYZqrpppx26il+iIYqanqflmrqqaimquqqrI7q6qvE
sf8q66y01mrrrbjmquuu18Hq66/ABiuskbwWW+iwyCb7lbHMoqnss9BGK+201FZr7YjNZkvmtdx2
i5G24IYr7ri6eWvuueimq+667Lbr7rvwGkTuvPTWa69j8ear77789uvvvyneKzCOABfs6sAIJ6xw
qRtIZvDDiC4sMagQV5znxBhnrPHGJlnssZ0chxzexyTLKfLJ3ZVcGBQqt+zyyzDH7CfKNNds8804
55yXzDwTqfPPvvUstIxAF13u0Ei3aPTSTDftZtJQRy311FRXbfXVWP/j9NalZe01hFyHfdnXZJdt
drxkjiB2oGe37d/acMct99x012333XjnrffemLn/7fffgAcu+OCEF04e34gnrvjijLtn+OOQRy75
5A83bvnlmCNG+eaDZe45T5yH/tfnpJduelmip77s6ay37vrrsPek+uy01z5g7IM6YJ/tvPfu++/A
By/8nLjjPvzxHxWv/PLMN3858tBHL/301Evo/OnVZ6/99hpd7/33e3Mv/vjkl29+QuDnFE767Lfv
vrbnj//+/PTXb3+z8eev//789+8/4fdT3P+mF8ACGvCACEygAm80wAY68IEQjKAEJ0hBUS3wghjM
oAY3yEHeVPCDIJxaB0dIwhKa8IQobEsIeZfCFrrwhTCMoQxnSMMa2vCGdVmh7XDIwx768IdD0WHt
/4BIxCLeR4i0M6ISl+g4JDrxiVCMohSnSMUqWvGKWMyiFrfIRc0w8Ytg5E4XBxfGMppxOmNMoxot
eEaBrfGNcIyjHDvXxnvN8Y54lFId98hH1+Txa32k1x+9Fsh5DTJrhUykIjNzyEY6ckWLjKQkL/RI
qk0yW5XMpCY3yclOevKToAwlsMghSodc8jJs4NFEEFHKVrrSMKdk1itfFsta2vIts8ylf3qhy16u
65a78qUwhykYYOqKmBYzZq6QWTFl4oqZEHPmrb7mBDxK01bQrNw1t8nNm2Tzm+AMpzjHSZtumvOc
6AwmOfeVzlStk53tZM0H4knPetrznvgMmsd0of+Ld7qLn/30J7v4icxdATSW/QIoOG3FT2XGS6Hk
tJEnHqMLbgoUbfnc1EU3ylGGZPSjCBUVPjpK0pJyixZRA6lKJWlSda30pTLkBUxnGs+Wpoumk7Ip
unDK0zLq9Fw9hQsMJvTToo5zfghonFGXytSmHiqoj3JqtaBK1apa9apYzepZpMpVXWr1qzHsqrTA
CiixmvWsyJPE5Mh6LLQii61waqk2tAHUes51rnB90121cSmp7tWtyZprQXoArLw+rWXPAKxiYWTY
xm5wsfoCA2RTBAAAUMSxE9IBSipb2ZxMdkqctWxGMJug0Abls0XiLGr1RdptrfZVrY2tAV9L2zWQ
yjZMtR3VbcFEtkzccbdfyi0bgUvc9An3uFksrnK/h9zmOve5xVyudJkH3eoicbrYLZ51txvC7Hr3
ddwNLwW/S97ytla8xDOvKtHL3va6tyLqXe97ZxbfHInTA/2qr47my9/46de+/Q2w/P7LQAEbWHsE
/ug1MHjgBjv4wRCO1gAiTOEKHzLBNrJwmzBcoYAAACH5BAAgAJUALAAAAABwAsQBBwj/AO0JHEiw
oMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK7PivpMmTKFOqXMmypcuXMGPKnEmzps2b
OHPq3Mmzp8+fQIMKHUq0KNCRSJMqXcq0qdOnUKNKnUr1qdGrWLNq3cq1q9evYMOKHUu2rNmzaNOq
Xcu2rdu3cOPKnUu3rt27ePPq3cu3r9+/gAO3rEq4sOHDiBMrXsy4sePHkCNLnky5suXLmDNr3sy5
s+fPoEOLHk26tOnTEQWrXs26tevXsGPLnk27tm2zqHPr3s27t297t4MLH068OO7fyJMrX86csPHn
0KNLn069uvXr2LNr3869u/fv4MOL/x9Pvrz58+jTq1/Pvr379/DFuopPv779+/jpNt/Pv7///w/l
J+CABBZo4IEIPgfgggw26OCDEEYo4YQUKpXghRhm2FOFHHbo4YcghijiiCSWaOKJKKao4oostuji
izCauE6MmWlo4404Dkbjjjz26OOPQAbJYI5EFmnkkUgmSZ+QTDbp5JNQRiklVEpWaeV7U2apZZZX
dunll2CGKaZ+W5Zp5plopqnmh2O26WZ0a8Yp55x01mmnZm92CUCefPZJ255+BiqoaoAOetudiNoD
QKKMNsrcoo5GKulukE6KnKFVFoppbJbOWWmnu20q6qiklmoqeKCmquqqrLbq4qmBhf8D66y01mrr
rbjmepSrvPZ6mK7ABluTr8QWG5WwyCar7LLMNuvss8ZGKy1Sz1aL67TYZqvtttweOyAT1oZ7XLfk
lnuQuOimq+667Lbr7nfmxivvvPRy++69btarL7b49uvvvwAHLPDABBds8MEIJ6zwwivt6/DDEEcs
8cQUr8jwxfhVrLGkGHfs8ccghyzyyCSXbPLJKKes8sosu7bxyzDHLPPMNNdsWMs4Q2fzzmXm7DNx
PAct9NBEF2300UgnDeHPTDft9NNQRy311H4pbfWrVGet9dZcdw3t1WCn6PXYcoVt9tlop6322my3
7fbbcING9txuxW333XhvS/fefPf/XV3egAcu+OCEFz6Q34if1ElXhjfu+ONbJi65V5BXvhl67EyO
LyGad+7556CHHpjlpJdueouip87T6aw/xtoTqiPsT+y0197XEbbnznXrvC+m++8s9T5nL8IXTzHw
yCev/PLMm2T881M1L/301Fdv/fVQQ6+9Vdirvv33S3XvPfjkiyT++ehPXf76H6Xv/vvwm3xG/PT7
zP79+OfvXP3894+VOv4LoAAHSMACjkV/CJyIAcmWwAYGaIFec6AEFwLBCE7wghjMYEIqyMEONkuD
GvSgCEdIwhKa8IRaAWEGUcjCFrrwhZxSoQxnCDdsOAWG9qOhA3FIoCLw8IfD0mED/4FIxCLaSIhI
TKISl2gPSwDOiFCMohSnSMWuMRF/VcyiFtNzxS568YtgDKMYx0jGnm3xjGhMoxrXyMY2tqaM0HOj
wuBIxzoaTY54zKMe98jHPvrxjxezoyAHSchC3gmQADPk6RDZlV0w8pE0UaQkJ6kvSFrykpjMpCY3
yclOcpGSlfOkKEdJSoSBMpSl/NopHZfKVrrylSRDBSxnqcZV2vKWuMxlhGjJy176cla6DKYwJ/VL
YA3zmMi0UzF1lUy8LTNXzYxmArMgzWpK6JnXsqY2txkkbHoTkdzcFgA+Fb1vFmic6DQnrdA5Tq6E
U1/sJGf71EmkdNLznrN8p9rwaf8qffrznyjiZ6lYtA+AUkigpDKoQhfK0IY69GUIjai/PiDRiloU
MA+9ohCEkNGjbbSjRtsoR0FKtI+SdGgmPWnQRKpSGhFnoxd1GXNG2tKaajOmOP2hTXeWUz/ZrAg7
DSrNekrUFgr1qEhNqlKXyqGi5ompUI2qt5zaJqmKaB5WpSFVt8rVrnp1YSiaUVbHusOvmlWAZE2r
WtdKtLN6ia2VdOuV4Fov+OlCc3Sll1znmte++lUge7XSX80V2MIadlMWiN1gF8vWwzqWLUrIGWO7
9djKTm+y9rKsZpWHWb1t9rO/66y2QEta24n2tEstbYZQy9rWuva1sI2tbCeoWgyRzfa2uM2t2Gqb
IN2uire99W2qgIsg4Q6XuAYyLqiQy9zm3lO50H3RFmDm3Opat5jRza52t8vd7hr3uhnzLqLAex/x
jpe89TGveg2J3vZGbb3wja989+deLM33vvjNb0jqCx/9+neJ/A2wZP9LYGmJocCkE3B7EKwlBTs4
ZQyO8Aof/Em06SKcFM6whrUoYSkFBAAh+QQAJQCVACwAAAAAcAIuAAcI/wDtCRxIsKDBgwgTKlzI
sKHDhxAjSpxIsaLFixgzatzIsaPHjyBDiuz4r6TJkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fP
n0CDCh1KtCjQkUiTKl3KtKnTp1CjSp1K9anRq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3btzCr
yp1Lt67du3jz6t3rEa7fv4ADCx5MuLBWvogTK17MuLHjx1QNS55MubLly5ivQt7MubPnz6BDix5N
urTp06hTY2Sp+nPm17Bjyw7c2vPs27hz695au/Pu38CDC5cpoLg94wQFHC+ovLhz5M+bR3c+kHr1
58yxM9+evLvA6daPW/9Xzt1g+OXZwTcXOLy9+/e60SOvjp4++fLfvV/fX7/+/fz6LffffevhJ153
/wGYHIHkJdhfguTBJ+GEFEom34MKNniQgwH2dyF9CiZEoH8ImmdgiCh6qCF+ELJX4YswxpjWhQNm
mKKHLG6I4Y3lFYihgzXqaCCHPoKIYoQyJqnkkkeJCOCIJIoX3XfzBUjkjlRyaCOU+QHZ4XXTnSig
iUby2NuZaKappkIrfjimmVTmaOKUG14ZJZctlvllntt5qaeWawYq6KC+reRmmz4CauWXb+LIaKIP
alemln7q2SWZR7rI5KacdvoSmyFCyiWof3IXpJB92qcfnzdWWiqOpxL/KuustIrWZpyTohpqdvzl
ySp/wLIKYY2u4nrgrh0qWuuyzDarFEvUDWtlmFJW6eh5ftKpK5bIpncrj+dlWSySnpZrbqfOpqvu
uuy26+678MYr77OGzuvUufjmW65IrNlLr74AB/wXv/X6i5TACCe8FsEqGZyUwhBHLBbDKTl8sMQY
Z4xVPhx37PHHHxPEcUEjs/RBQScTdPIHLNuTssoKsSzzQC8bNDPNKOcM884C3dyzzS7LXLPKQ7c8
c8swC400zvZo7PTTQOWTkNQDUS2Q1SOLLLXJSe+c8tAux+z1QUsjXfPKPDMdds8vmw302WQX/TXb
OcvNNNR4532T1Qbx/+131fZgHXjThra99uFz64wQ3IenjTjOhgP98+RMg4222l3/nPjlmku+tt6g
h+4S3ySLbPrVg6O+deGQq52444qvbTnZlHMOdueUZ657463jPjfctycu+vDElwTy6agDnrzUVK/e
sOGRy+553D7PLjn0mOsePO9hM67z5ZvXzr30hBdvft6kIx+4x6czjzprr8ef+/yxv5795PKPn/v2
syu9uO/4q9z4hHe+Aj4tfcpLXuoUKLh+2a5x9qOf4zh3v8dhLyHe2x3u9Be98AVwe58zoAgBNrUS
JnCBglMgBi04tthNr3u0S9sDb5e9otGPgiB8HPk6Zz2L+fCHdmEJAoBVSLrmHcR5FQsayhjXwxgG
0GZtO5vdVkg0mkVvhzeMYQSNtsS7jfCL5zLhEdWnujEyxIZWXJn/lCa36vkvjU6UIOyCZrnqvZB/
XKwiG10IRIYMoY+AzEi/QDLIQGoEjIj0lCEXychGOvKRkIykJPlSyEl+JJGYPJ8lKZbJTkosIAAh
+QQAJQCVACwAAC0AcAIuAAcI/wD/CRw40J7BgwgTKlzIsKHDhxAjSpxIsaJFewQzatzIsaPHjyBD
ihxJsqTJkyhTqlzJsqXLlzBjrrxIs6bNmzhzWpTJs6fPn0CDCh1KtKhRlzqTKl3KtCnGo1CjSp1K
tarVqzAh8tuKkGvXrlvDilXIz57YsAbPplVL9qtbsl4Tjj07dm3Zg2zN0tWL9uFdu33/Oh1MuLDh
w4gTK17MuHBHvXjvxk3LULBgypcpf708uaxlvAvjiv4MGmxkzZozm30LV3Vqg1hjy55Nu7bt2xsd
csbMmnVmz6GDy938VvVu1MJLlyZtvHfb5K4bS59Ovbr169izS+zYHLjy4d95P/8HT9476OZtoyPv
7hY98uTlYeOeT7++/fv4OTZkv/r999981dWXf/2ttpt7xOnmnIF1BYgWaftVFp52FFZo4YUYZqgh
eQn25xqE5/klmXB/HTdehxJOaGB7oTUY4YnqbSjjjDTWaOOG3AVXIoEF9iieXz6m5mKQBJqXYpE+
GqlcjESSlt+TUEYp5ZQ9KchiiPAByOSK8b0XnYnqmfgaiv8ByeGNaKap5ppsGvbYaF5+yOGIJ3J5
WpILrnUnZGWapmePdJ4ZZp13UWnooYgmqmhGkYHIZ50BNirgpC6KGeOAYE3WZGcN0qXkpgMC+NSi
AyFC6lHNnKrqqgW16apOrMb/KuustJr06q245qrrrrz26uuvwAYr7LDEFmvsscgmq+yyzDbr7LPQ
RkvdY/LVau212Gar7ZPSduvtt+B6S+2o25Zr7rnopitTuOy26+678MYr77z01mvvvRkige++3Y6r
7r8AByzwwBodRPDBCCesMJX8NuzwwxBHLPHEFFds8cUYZ+zquNPm9pB+Gke78MizXgeyQyeH7CzJ
LBuqcq/gRBRzsDO/bLNN1AKgMwCNpcwQR+AEHfRBQhNdtEFCD21P0kszbbTSTR/tdNREIxTz1EgX
nfTMWEPttdY1Q4201V5XfdHRUX8tdtpXMz311wk5HfbY5LbMEgd2W2UPzx0X//zxRjWbvTTdgxcu
uNUKzW044YJzjbjii0ceONlGM9505YgT7rjlEkG++OSZx9141piPvnnheaeOX0N8J7SzQa/rDPvr
s/O9s+0H4b7U5Lwbfjrnkftuee+PF0836MQnPvjVwTPP/OiPD/220s8PD73owQt//PKSV1098DeH
//dGreduvu48t17+3uzD3n77fPu8ENBui6749IEjbzb+1uevPfJoQ9vYnNc87vmvf6bzXvI0d7j9
vQ16BExe25SnugrSh3UKUR/83KfBvcXOfOxb3+6wp8CyMcRzWTPhQr7HvRKiMHuM29zztLa96w3Q
dPUjIQPBB7ywBbCGT+Oa/v/ER0SbiFCD6Htf+s4HwiUOZoEtfKENgQg679nPeC+sYgy35z8Zhq53
kGPhEK+nxR7u74zdM14Di8jGhDxmfUh0XwiZyEEQvq998lMI0JRHRR5mEY0r3GEXp1jGAwJSjKH7
XwJvyMfPJRKIXwRkDYnnPwtaMj+1s53sNhhC2nlQdh28Y/w8hjLArVCFy3ObAMeYSrCJbZVS+6Ir
pSfANKbNljF8ZfWE+DuyQVFuZtwiJa1Xw0sasz41ESFElFm3VpXSbxQrY7Jmdsxq6m0pzHRINtso
M2hJk5tF5NhN8igta5rznLQCpzrXyc5wbZMm70xmO+dJz2R60o4zKt89c7cQSTm67iGeDGgo/VnP
ghY0IAAh+QQAJQCVACwAAFoAcAIuAAcI/wDtCRw4EIBBAAQFIkzIsKHDhxAjOlyo0GDDgwQpZoyI
sSJFiwoTapRIsqTJkyhTqlzJsqXLlzBjypxJs6bNmyc/4txZEKPOjSHtgRRJtKBRnQuTFuXJtKnT
p1CjSp1KtSpUpEKzCgXZUavVrD+9BvU6UuxYoljBXvzKtq3bt3Djyp3bEqlSjT/LTkUYdmRfhmUD
Kw3KdS3dw4gTK17MuHHGjmk9DnUL2ajIroF7Hpys9qzWyXodix5NurTp00vH8gVKd3VYwJZZx0Y7
u/Nr1Lhz697NW+a/38CB+z3KenDw4FFdWx5e26zYyHgJGz1Ovbr169iza9/Ovbv37+DDi/8fT768
+fPo06tfz/48889chy60/nSz5tigOZv1K5/zx5/tBSjggAQWaCB7lRyo4IIMNpidb9UlR1NoMc3n
4IUYZqjhhhx26OGHyMVE31U1UegSRSCmqOKKLLbo4ovqOTWiSjO+VJ1BMOao44489ugjjzJGuFKN
LlEHwI9IJqnkkkw2Cd5KJppF5ElTsnTckU5mqeWWXHbZ4Vb6PRTlSFWWZF0AaKJpT5pqsjmQmgKp
6eWcdNZp553aianSmFIF0JCfcb4ZJ6BrEtrboYgmquiiey3Fl0Xx9TdYlDMZKmigmPqp6ZqMdurp
p6CGas91YKr2WUjQnTqqkDRWxyahsF7/uummeNZq6624agnUaqry2tmvApVJ0pl/vpmmrIHmquyy
zDb74a69okqctAQJKxGxDMXKaabJOuvtt+CG+x1Jf52a6mBNWYrptttaqq6o8MYr77yM2YefdPaW
qmq6xa7Lqbv0BizwwARTVvDBCCescMKkwkaTtRFBTKW4FFds8cX/lCYxQxh37PHHLiKS3sIkl2zy
ySjjRmnKLLfsMqib8RcmR/lCidJ7+r6s8848J3YdhbeVtLJEetFnr3zTgaz00kwnqedEuxbm2XOF
JQVZpFNv9F7QPXft9ddf1XzWcEHr9aipkTmntaPNge3223Dz9Kiv8FVtmGRkHWXf0B4VoNd23IAH
LnhCDXsWXV5q/6V4agON6Otf33LT9OSUM/n0fsvde3eq1AJL6eOaDy766ICT2pVmeGEGNepUY11R
UNblixlIlddu++0O4sQ30TDtTvrvwPdcOEu+XzSzQ46bhPvyzDc/cvDQRy99bs5Xb/312Gev/fbc
bzn99+CHL/745Jdv/vnop6/++uy3H3z38Mcvv/fu12///fjnr//vAQEAIfkEACUAlQAsAACHAHAC
LgAHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4rs+K+kyZMoU6pcybKl
y5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrQo0JFIkypdyrSp06dQo0qdSvWp0atYs2rdyrWr169g
w4od67Wq2bNo06pdy7at27dw48qdS7eu3bt48+rdy7ev37+AA0clS7iw4cOIEytezLhxUMGQI0ue
TLlyW8eYM2vezLmz58+gQ4seTbq06dOoU6tezbq169ejLcueTbu27dsIYevezbu379/AgwsfTry4
8ePIkytfrhu38+fQo0u/vHK6dYXMs2tXfr27we3gwwf/905eoPjz6F/zW7/eHvv27we2FzifPj/5
9+3L3/8+f3yC8fXnHoDu5TdgffexV+B+9tWH34P0LRhhgwxGiCB+8AVoYIYKXiggQemFKGJnCRlI
4IQDSqiiighuOKGJKRoEI4omJujihSniOCOAG97oYoz+EahjQTC2GKN+NJan5JJMongikBYeKKSU
OUbp5JFPPlkjlQlWWWWQOzIIZpRjTsnflzISKWWXZv54ZZNwxjnbh1C+uOaUbAa54n8FzqhghVvm
yaWdZSKkp6CIqhkomkT+2eWjjnp5ZJhyVmqpXSzt2OOQk9rppYOUhunmoncOiqZ/Dn5K5qpmWvlo
micW/0pohSCOaOutipV40I+8Onlonx3WuauhgLY56K+l+irgmMwqaiybWapapJVYXmrttXVlOmyS
WG7ZqqmhEssttfBBqKeEbnbaI5DnnkslumpGCy2N6eaH6734jqUrrOrGe+W80NrY4Z8YettguwEL
zG7BWSa8MIUMPwwssPMeGCCEnWKr8cYcd+zxxyCHLPLIJJds8skop6yyRSytHFm+MMe8lcuQyWzz
zTlBBMDOO1sEgEE8/0xVzwIRXZXQQCNdHjY0N51Xy0BrpHTRA039lNFGD41Q1lQpVgXOYDf3kNU8
Uy102UX3jDbVbNuzNtpwV+323G4T/XbWP+dNN9x3I/8ddNpnq+233XxPfTbggWNtt9x/A+74405H
/jHUBQWtt9mHm00Q2XLTPbfSfnued+ZtX175555r3rbqqKt+eOiwH5R57KybbnvqtBcU9u68z7R2
6qKL/jfWSSteNvG1B1/18JzvjbjywzMevfOWB2+189Yzrn3yoDP/Xe/gh5+S7KcnnzTw2KNfd/bm
r7785mzfnrv85b9efuubVz8/+/ibrn7W4gvgzXR2v9utzn+lS+D2+qc8BR7wdPuL4Pbsx72oLZB+
FWRdA9UnuQ5einLwq9zilpe493UufoQbnAr9VzjIuS9xBmycDEc4uxHuDXTw21/dVgi9FLrQHgIM
4m8qzDGzj12PMkJMIq5M9jsPOvGJa1GiFKdIRcJA8YpYzKJIqsjFLnqxKAEBACH5BAAlAJUALAAA
tABwAi4ABwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK7GivpMmTKFOq
XMmypcuXMGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1
q9evTUeKHUu2rNmzaNOqXcu2rdu0YOPKnUu3rt27eJW+3cu3r9+/gAMLHkzYY97DiBMrXsy4sePH
kCNLnky5suXLmDNr3syZZeHPoEOL5gtstOnTqFOrXs26tevXsGPLnk27tu3buCl23s27t+/fVnML
H068uPHjCIErX868uXOZyKNLn069uuDn2LNr357Zuvfv4MOL/x9Pvrz58+jTq1/Pvr379/Djy0fP
vb79+/jz69/Pv39PBf4FKOCABGqWEIHzJajgggW5BMBPDz54l4QFVmjhhTFRaA8AHJ7UoYcUdhjh
hiTKpGFKH5ZYE4cnoojhizDCyOKIJUnY4oYhhqhiTyne+JKOLPkY45BE3kcjSkciSeKITJbIYo1P
eohjijU6CaWNVe54YpNT2vghjVEKWeSYZFaWZJYzKtnkmioeqaGbUmKpI5ZaqknnkiZFeGeWZfbp
J2VR8gkkmlWyOWeecSKqKJNpsqkoooPq+WSOjUXx56VkHohnnXxaiaejm9Y5qJVngrpjqIdKCSJK
DLbqaquFnv866pafotpmop1SCuSogvYa66+qSvjqsMSaF2SYaU6pZKJchvmorY9+2eOzeU5brbR3
Biomptx2G1xyp+pX7LjkWuegt+imq25Omq7rblLlxgvRu/QeJe+9DPG27Vf71qsSvvgeOymIVOIY
LcFearvlwNReKyJMXlYr8ZWRdikplRVPqrCzLSVrIsYO9ijym/06XPJKLXrs78omLusrlAcffCPI
qnZas80ow6yzwb7SObOLPQftskonuxxxkJAmTShNRXcMdLgsr5wQrTF7GmqvKS99s49UOx0rmFrL
2XC4FVu959g4I1twzSXDmSrTKH7p5MjKVr3xlVjPnfC19gCgfK/Ae5b9NsWEL53yjFw3+mPSYJu9
c5c3M37r5CqLyTG0Q/eb7a0q/6h4oZu/+XTobHMeuNJRW9g15ItGzjnQZ3P6dK4iPmy44Qq7DjWo
CfMKuqR2Mkz20DnnDSzJwFP7NuI8k71x7TKjjjz0qVe4erbMp406xbZvXTzapZPKPOk4717r7eVr
LqvysxNd+vItvz92962n77b0uq9d/XYBAQAh+QQAJQCVACwAAOEAcAIuAAcI/wDtCRw4EABBewYL
CkyIEIBDhwoPMjTIcOFDiBUXEswYsePBjRETUrxIUaPGiR8RpixZ0qRIjzBTqsyIEqREmR5R6oyJ
k6bCmhJb2gS6UahRlSaTFsXJtKnTp1CjSp1KtarVq1izarXqs+NLrx932nR5M2RZnmd9VjyK9OvZ
tEPNhn16lChHpErxJq2LdiVcoGv17h38s/DJnIi3Kl7MuLHjx5AjP/1HuXJlkg0xggycN7PIi3on
Pgydl+bonqVJB9YJujPhzKpb3y14GrbnoKdrm84N0aLo2TI55i76WfTYtr119769NrnzhJajS59O
vbr169iza9/Ovbv37+DDi/8fn12yZOBS0ZtnrL5pe9Tr48uPSr6+/fv48+vfz1/8/PjvQRXgf1MN
GBxXBCao4IIMNujggw1WB+GEFFZo4YUW9qfhhhx26OGH1mEo4ogklmjiVCCmqOKKLK54IoPvGfji
gjL+V2ONrs2o4448Krbccg/O1lpWzQHG1Y9DDukbRqAlaRxxbqn341U4AngcfAL21ZlQPXbp5YxI
UnhXlVjWRFRUdl2pJl5mPgmWWz2dmZ6InLk3Z45okfnlnnwuVh1LyBX3G23P+dYQoUsaytNwIwEJ
12ZMIvlSna+N6ZqRM2U6FqBOtVQcWYHCxNtzg7J5m6LKATkqoZ+aiqiTrZ7/VGiLtNZq6633AaqW
qKaKNalhmqrJ2muPAivWTF2BdemSmLaVabIjZfnrYc4Kd+CxfFEbbK+JcZtamsRuq21FuJZr7rm1
wvdVkyGNxpq7ZGF2bEzY5smrkfLOtamWliYK6m6fraTqYfnqmmyi9SYMrGdsVeqqbIJhyu5NbvZp
8cU2xmust+KuG/HCW26c45kNcynYx+G+payZqW1GF8EUBzvlmxsrrC3KpA1Wb8c03+yzoxgHLTRV
f8Y8LsfZTivzyTiX3DJh+IJMLKWgFgunsyi3ZxzLT9eZ7dI269xt2HJG7bO4KqGr9tpsg9jVxIEK
iuq/ybUb1qps6qavohY9/1y3wAefevXUWXdtZ9+2+V02vEcnDnerqZrGt2x63614wHaf1vbmnHe+
3Xx6Nhbj0CWGfqLppKeuup/ULVYbhAGivjp7szMtmee455577bz37vvvwAcv/PDEF2/88apLaTtk
AxooO/IWPv8Y6tJDbz2MdlZ/+MtYnp0e0FWB36nliMMe3OtYac+UjNRf776Xyqvf/fbcU6mlgDgK
V7GD/dI+YvvvCyCd4pUqmJXmb5MqoL9e9ZMCyg1yS7vXcFziqCgVyjav0xWqFCi4QknKXxmcCwRl
VUEOhjBWeGNL5KAktk/BClGJE6AMr1K0atUsgmKz4dHAlcNtfU1WhHPZDv8PhDWlzAtmu/rWDXUI
tr3RpocNc5XUDsUxbpFtX8PK2ce8Zg/defGLG0KNBoeotBY+q4GMC43ZkLVEuPFMiGDrF+aoyLCT
eYw57dIMCfWYwDSaLFRrjGKbmLS3fLHKU3ET5BK1+MDfiG+GkETQGJtYRiue8Wf0+trWLHkzkyUR
h6rCTPn0SC+NDfGUcvGk1FbTMxwi7YnK6pYpoYVFkUHxifKL5Ay5RslSVi1KrxShLS9JTFUW8pay
pNQPlYhKTWLNmf1z2s6QacRWBvOar+ShIuWky24WSC6hciUMH5ZHVhHHnJRbF+PcaLsVIqyCkEJh
mHiFRwqSam7P/Bty7kb/Sse5C32DbNRbFDhBNTqShQg7Z0D9mUtvAk9CWmmomNA0NImmj08WTQkY
N8pR+5ynds3DGPqih1GHmhRCED2pSr3Z0Za6FHcrjakuX0rTmraISEcCXj/fp6eMLi9LMg1qn/IX
UfPEbighxBMRJ0oVJe3LflZa0/qESlUHpZR+FMWp+aYoRd9xk5tZXU/oqmTTspqVQ+urm9wwGE5D
ecqDu3km39xaqgtyiZWAayujkCWpuGKQkKf6KwI/6Bd70hVoe+3gtABqV8BC7IULnFusqkpZrNSQ
jdkcXN5yCCeuKbKIpsRsYgC6yGg1sZo9U9onOYU23ACzWb16bQOXlVoy+Jb2WsA8q253y6FpNoqU
iI0lIhl5RnCpU62rvBIXrzhN4npsoTuRF3quiFpQ1nF/zg0ta38bxXrWkbfgDa93yiRFY8LSYdTq
bGG2G5cILlOL1YXmbccmV+YyTXzUzW4PD3gcX9kWk/HtamUHLDpbvpeLnK0uOVGrWlTKUr+njbAy
DdNghRn3Lwau5S2tRd/nrne+1PQpgWUooYIqdi/wNCIC+VveFB/3uJcaFS0ZikynppCAffUW3iJm
wu6aOJ0o1t8I+9hghgLMoAIRr5KXfFXriXgrYx2xlKdM5bCW7pFWrrKWt8zlLnv5ywJsMpjHjCEm
m/nM0gkIACH5BAAlAJUALAAADgFwAi4ABwj/AP8JHDjQnsGDCBMqXMiwocOHECNKnEixosWLGDNq
3Mixo0SCIEOKHEmypMmTKFOqXMmypcuXMGPKDOkxIQCHN2vezImRJ8KdNSX61Bk04lCPR4s2BJDU
YFOlUKNKnUq1qlWrJC3yfGrPJ1OvXA8CBXoxKdmKYXFCTbtxKNivYpnGlftTrNK0Yd0arTizr9+/
gAMLHkx4JlGnS+FuRUzxbNmFjq2y1XrVruW6jBdfntwYYt7KoEOLHk269EWSOVM7pTtW7le9Zrsy
VKx67OrUcG3m3i27K+veuRG/Vrj7t++tdOfeRp78tnDnP4PzPu7VpnXNzodDn8v8eXDo349T/xde
/Lf28QgLq1/Pvr3794ZnZ+4t2zj96kdxNwfuvf79/5v9F9lOqhEHIGMGnhVZgnZhd12B9B3YH4LU
DYhegM9RuNiGEAaYH2b+bdiggJeZZuKJKKZ4FWohkoigg+JhGGGBttmW4YwjTjgccgxq+FZrtEGm
WI4Rjsdcc5rtKKFedTmIHYHfiXjjhzfG5aGLLU6ZEHxcdunll2AKViOWT/ZYnYbzjSkljlra6F90
TZa4GolmnfnmnXYqKF+bS1oXJ5ovFnmlln7eqRudRLqpZ3phNuroo5B+CeCaZV5XpJNptkgpiHoq
Kih+cvKJ6aB4cnpgnogCamqfgY5aKoxY9v+Y5atkMhbprbjmqutLp9rn25LlsbYfjZqCJ6d2vOmn
4LDAHgmcsPkNmVl4SioXXXLVnidojBdameSw0vkKbofGehcsocgatOu67Larq1ScqSjvaPGeWO9a
hQq1pbv89utvYKLdO+/AVQlcmsFBMenZfgQ37PDDKmYF8cQUV2xxxf9mrPGtF3fs8ccghyzyyCRD
JDGIJafMEcIdMexZZSy/LNm+G9dsM6SvLYhTeB5/FrLCKz8UL6zwPrZUqAnLefPSTKsnNNJ7luwz
yDGrZbW+FFJVtYFZF0W0ymCHnfRy1iJd3q8XnithjBxi6zaU27HN8NniQYu23G/HnV2yZ+f/jR7d
4Jl3bdp+85ws2Ww/ix+1roXrVuPWItu4y2JXbnlnrZZI5Zu1HVsrhmRtiirXrGbOH7Gir6qqp6gn
unag5BWauowCQtgpuYTCXqplnfOp++XAB39120iSHjq60p6um3QeVvvi5q662HttzjuWM5yZS0l9
8ssaT6SMUEK+HKplXs+jpas3qG3rvr8u/PslS1x+1IP2TmumKIN/af7F/04+/vYzXdfgJCLtVSlW
dzvVp0hFwKgtylCXAlX6Dsi79j3wJk3LoAb78jQBAk16FlSg7DI0u66Njk2mm14IT/inWR3vfhBE
4Zr0hylXXRCBOLKh6yoIwxvC74fvqxTP//5mnO05q1LLa5XjIge3Q3GLicTi3LRsF7jHUTF881Ec
7CaXr+kc6lv6KVvkrhXG+zALRq7hHbP4k7hpuQ+IcIxjyyhDRzlizY54zKMe95i/vdSRj5ABpCAH
SchCGvKQiBTeARJpmpNZboOQjKQkJ0lJfjVmawNkpCY3yclOesSRmRzitjIpNL89kWGVTKUqV8nK
VjotX7SD2iiH97mmuPKWuMylLiu5szJmLYx0O8/hAllCTxrzmMgUHosoCBvVdUp9exIdz3ZJzWpa
85rrOhoz0ae72yVvhCFMpjjHSU6VzfCXMnTdB9O3qXK6853wTNEyYzgpZ9Zqcx6spz2wyWbPfvrz
n1xqI3GQJKwqdudTkjsot3IC0IY69KEQFUk8J0rRilr0ohjNqEb3GNGOevSjIA2pSEdK0pKaFCQb
TalKV8rSlrr0pTCNqUxnStOa2vSmOBXkSXfK05761CU5DapQh2qRgAAAIfkEACUAlQAsAAA7AXAC
LgAHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48gQ4ocSbKkyZMoU6pcybKl
y5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypdyrSp06dQo0qdSrWq1YH/smrdyrWr169g
w4odS7as2bNo06pdy7at27dw48qdS7eu3bt48+rdy7ev37+AAwseTLiw4cOIEytezLix48eQI0ue
HPiq5cuYM2vezLmz58+gQ5+kTLq06dOoU6te7Ve069ewY8tOyLq27du4c+vevXe279/Ag1PlTby4
8ePIkytfzry58+fQo0ufTr269evYs2vfzr37YeE7vYv/H09eLfjz6NOrN8pvvfv38OMzBCuQX/v6
Ee8TtM/fov6B/P3Xkn0A6hegPQEKiGB/FJXn4IMQarUQgfhBpKCCFF0IIEwULlhhQRhiKN+IJHJG
330oMrggihuqiKBBDLaXooEEumhggTTO+KGML65YX4c2vsijiBrCSOGQLgoU4ZJMQtgji/jdKKWR
/UkJpZD7wbhhj1hu2aWQV3LJo5ZDcgmilmdGeaWATbbp5nQKQTlllC2i6eWYK9Z4I4gqJujhjmIG
iqOeaLKo44de3imomSU26ihRYCWI56SBFqnonnwy+mSiBVZaJ6Ih/ienmZhy6imgBL2p6qrKJSTq
qV/i/8npnIt+qWitlNL6KqhZ9oppiGnGuqWIjxZrLE2RZnngjzmm2Ot+R0J76J+8+mjttQeKeuS2
AnY7qKnMHtrslqyWa65ux5pEbLrstusuVOu+K++8IdFH7706nauvXvj2e9O+ALflr0kAFFTwQQdr
lDBCC+vUMMIDR+wRABRTbNHDFT+8ksUCcWxPxh+DbHDFGGl8UcMFY6yQyQmx3LFPKBvkMlQBSCzV
zA+p/PJLHnOs8c87xQxxyxHNjLNMOB9t89ILYezzxx33bDHJAyVstdQHU2011Fn7jDVBKXMN9dBg
I/x0ylQPnXbUKGtddchnsy32znKHDXfVWmPddtd8h//M9tV8Z/222i+L3LfIYD89NtpfM/0oWBnb
zbXghZdt8OBbL5z524rTLXnZYX9u+eiDT+45w2MTXbrkrIuteeqvRy0z7LRvXXrtO7cOOue3Wy74
5rGnjvviwysZ8PFxCT033FPbnrjeaK9evOYge4x55XfT3fv02xf+89qbY++68L9frn31nKN//uh2
l587ybaLvnvovAdv//ite4z8/m4pr/vIwstd96bGO/EFL3G+Ex/tzMe+BQZwdfeTXvjwl0D/SbCA
0rtd+Ny3PN3Jr34dXJ4DcUc/51mMfyhUiwVNuDsGUo583HPeCA9IvNPNroEsDOABZTjB/IlQhjaM
IQaAd1hADvowiA+MHwgzaEMlri+FUOyK6p53Pq9djXR9y54W1Se37K1Nh3jrGcPy9kLExeyLzHse
4BjnPvgN8HOGI2MY99ZFyrFxjg6k4QI3SEDtbfF63lOa4wbpGkFCxJANQSRLFKk8QjrykQxRZCI7
IkmVMJJ0kMykJjfJyU42JCAAIfkEACUAlQAsAABoAXACLgAHCP8A7QkcSLCgwYMIEypcyLChw4cQ
I0qcSLGixYsYM2rcyLGjx48gQ4rs+K+kSZMjU6pcybKly5cwY8oUeLKmzZs4c+rcybOnz59AgwoN
GhFASKMSkc4kqLRjU5hPH0alOBVqVYVXE2bVuhRA061MEQ4dS7as2bNo05YsyhAsQrcG4U7MOvXp
VroD5drz6rWhW71hmfL1mxcr4MCEpRZmm/Ro27gLlVZVS7my5cuUNR5W3BjkYbsWJXMejZUqYoei
tW7ujHoxxM2rE5cueNc17dhLc+s2mHNv372LBxtNLRy4QKSDb/9OTnz58eXM+/72jTz6V+DVpVt/
fp2vXe3Tk9v/zgu9PHbux5VzlyzeuGDkhYW3T29cPnn4w9FTV7///H3q7EXlnX7NwdffgPuFV152
/LWH4IHgPYXZhBRWaCFKbwVXX1iidRefbR1+mF6IIY5IX34mpiiYiij65x6HILrW4nW0iejidDbW
WOKLB9o443gGBunecPhlKGN8oNF3I2I/7pifkxsuueORAvo45Hi7ZaklR96l9mKTxNX34JVdplhm
kyLiN+CUSqLJYpVeXjnimAKuaeV9La5HJpYs7tlmjVGqWZyKeh5J6J9zOogkc2IWB6WQZ+b4Z5V9
eonblphmqiSTMLaJ4qdGupimjlZCCqiok5Z6W6dfUhkqkHf6/5lqnwe5ueSmXYKK6pRxWsqjnKi6
SiqPtuqap6zCcgrlppo262xkGhpI67S9xuprsYHKeqy2yOIKLLA/nsatr4Q+yqeU1p5m7LicGhrs
tTFS66q5G9KrLGSVuvvsvvy+h+igazqHK46FKvpfowWfSGBwNDYaLnjDEvswwQULLOaXg+IpJ53i
dRzdtx4GajGDAKpr8YoFxrUdiAJbJyTCG38nrcb6+fZtvzjnrHOtL126889AY+Rz0EQXbXRGQ6NG
8dFMN11R0k5HLfXUVFdt9dVYZ6311lx37fXXYO8LNc8jjd3s0lluG/babIOdU5ynfgTWpWan9Jlj
Ks/H85MzXf/o99+ABy744IQH9ZdIdeOL891y19VY4hEVLvnklFdu+eSqPaldoT3KzDnHRCYaoJkt
E+xy3soVCaGCRWbseX8Hp/wu2ag7x/fqdY7+Kett9+573ziVqLqUV2Gr4XmPwvkrt7STKS22I8c7
e75zNk/z8XzffitkXz2/vD2Xhy/++OSXP5bwldqZt/EKI7+odO9prni41zNPvOusztru7hnH3byp
2YuVnhp2pqmY74AITKACL8QVM1EPS/aiUeskBa/n3MtbGNyerRB1KDZtLErnqg323Mc+ZMHNgr9L
oQplgj50HYpdGJzgA3l1wVZlkH7Qg9WptkWubsWrWvUioQD/achBEK7wiEj0zO0ENbrlqc9hgZEh
zLoHP70xilmgm9npFkYePl2RPwOb2cGGZDqFBbBHWNwOFWsGuSS68Y1w9N9sWBPHOtrxjgzpDR4V
95i57HEhCwykIAdJSLL88ZATKaQiF8nIRlYGkZB8iCMnSclKNjKSmMykJjfJEQV40pP2+CQoRTkQ
UArElKcspSo/GUqCKOAgpCwlKkPJSlG+UpWrdKUsRxlLV7LylLek5StRecteApOXv6TlLoNpS2Eq
M5XHDOYzp5lMYgpTmtTEJTY5yU085mSbrYRmOIkpTWZqU5zhLIg501lMWBqknOkcpzoTAs5ZFtOc
4IwnLmW5/094anOd+SSnOO+ZS3RaE5q3tKRCF8pQQdazn6kcZjzXKc+JujOi83zoPAuK0Y2+86IA
lWdAL4rQgerynO3MZyslKlFdtrSlJWWnTMHX0Jra9KZ+o2cvKZrSlWbUpzFFJ0SxeU9/+pKU8Nym
MfUZ1J6Oc5bHPGlMKWpRoML0oyzVZ1aBOlWOqrSbYE3iN0m606BiFKbt3OdR06rWmUqVq1YdJUKK
2tSSEnWuak3rUv3ZU7qeE65Whate35pQnBr2sIgtCz3JatKK5hKtBiWpUO8qVIsm1aV4XWUzK3pV
pjb2mnLV6kn7Sli7/tSnSd1sVcPKWjiO9aONpaxU+frWtv+6FaIeFaxJVYrP0Q5Uth6lKmTz+tvP
inamzByuUcGZ2OY697k3WSxsLZvbz9byuvaEJTmzm9uilhO7UL2mZUOrzL0m87ZX5Sl5t2vU36pX
vJGNb2vni0Q90veQ0M2vfg97EEjc978ADrCAB0zgAhv4wAhOsIK59tUFO/jBEIbvLvl5VmMK9Jex
tDBSXWrKpYp3ucntJ3iVmlz2vhOZ9txpeNUrXAkvU50lJmqMa8tTCoP2xe1tpo6rGeJlDvO81OQx
kJ0JzLxuWLMYBi+McXtUGKO4xC++sYfd2+HW1hihva2sQB1b2dn61rOTnW2PuQzmIsfWtu0tbZjr
St01T/S+ymZ2q2zfq2bi2lbOcV4xk7Np1uDmebqXpbGR94zn6SKXo8aN85cj+dqOPtbNjx5sbf38
15F2t6tOnXSlMdvWNBP6rmx1NFfnvOlSw9m6ZqWqfD175awqlcmSFrWgXwpoTnf6y1m+taVFm+tE
axmX+51QoB99XMzSOqrIDu5moTxpW0qa1iTWM5fTe2nGzjrMwyZ1V01NaNQeutvOXiucSftqVE/b
xbwmM3oljGFcIzrd1kayd33N1HUG2ywBAQAh+QQAzqCVACwAAJUBcAIuAAcI/wD/CRw4UIG9g/YM
GkSYsOHChQghRnTYsGJCBRAxSpx4UKPGjhExMrQY0iPIigpBbrwocuTDkyoZbpS4EuZMlyhx0rR4
0+bJnTl5cpRJMSNMoS490jTp82fRkUiRvpzIdGjMqUSPKvzYsSVQrCmzUoXalCpXpkahrkxLsK3b
t3Djyp1Lt67du3Z33nzZM+vUtTgDk8RqFTDHv1fVknU6uLFYkmL7Dt1LtGrJr1oZWwacMi1QyI6P
TuYa1DBLzI1rQg4bNnLlxRQPZxYck2zasbUvL5a8EK/v38CDC/etV2du0aWRSy4b9LFph0pztrYq
M3px6p8FL496nLVintYrh/8PPZZ1dOazkUuVDdrzZZHXv+Oezpz+a7NVn8eWT/l4c9qODSfggAQS
CNtt7nUF4GrKLXjbf6LxllpIEe52X3PPqfZZTRtm9uB6uP3XmmqTFWaic4+VyBh1URE2onpNZWRa
fIoliF5ZHLomVF85sgjbj0AGKeSQRBZppJCWsTSagzrBdxZpOqrkZEtJwXfhflSadJ6HpCWpJIwz
UQkglGihGCJ0WV5JmIqhhWnlidpd2Z6JenXpZZcU0oaWlk+myWaVVX5op1dapohnikcmquiijDbq
6KOQRirppJRWaumlmGaq6aacdurpp5bGBeqopJZq6qmopqrqqpUW6OqrsIr/yuqsly5jK6245qrr
rrz26iujsQYr7LB42Ursscgmq+yyzDbr7LPQRivttNTGZesy1War7bbcduvtt+D+Ki6j145r7rno
pqvuuiOB6+6x2L4r77z01mvvvcqyq+++/Pbr778AS4rvwAQXbPDBCCes8MIMN+zwwxAXqEnE0QZs
8cUYZ6zxxhx37PHHIIcs8qoUl2zyySinrPLKLLfs8sswxyzzzDTXbPPNOOes884897zsyEAHLfTQ
RJPs89FIJ6300kw37fTTUEct9dRUVy1g0VhnrfXWXHft9ddghy322GSXbfbZaKet9tpst+3223DH
LffcdNdt991456333p1aUO3334AHLvjghBdu+OGIJ654xXw37vjj+y4u+eROe0D55ZhnnjnknHfu
+eeghy766KSXbvrpqKeu+uqst+7667DHLvvstNdu++245657kQEBACH5BAAgAJUALAAAAABwAsQB
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOK7GivpMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUpV58irWLNq3cq1q9evYMOK
HUu2rNmzaNOqXcu2rdu3cOPKnUu3rt27eM9W3cu3r9+/gAMLHkzYZt7DiBMrXsy4sePHkCNLnky5
suXLmDNr3sy5s+fPoEOLHk26tOnTqBcXXs26tevXsGPLnk27tm2nmG7r3s27t+/fwIMLH068uPHj
yJMrX34ytfPn0KNLn069uvXr2LNr384dMfPv4MOL/x+/t7v58+jTJyTPvr379/Blqp9Pv779rzPu
69/PP2T8/wAGKOCABBZo4IEIJqjggsGxwuCDEEYo4YQUVmjhhRgW2N+GHHbo4YcghijiiCSWaKJW
Gaao4orjnejiizDGKOOMNNZo4404esTijjz26OOPQAYpZEo5FmkkiEMmqeSSUR3p5JNQRinllFRW
aeWVWGap5XlMdunll0FtKeaYZJZpZpVgpqnmmmy26eabcMYpZ5tn1mnnnXjm2d+cfPbp55+ABiro
oIQWapSeiCaq6KLT4cDoo5BGKumklJZl6KWYulfpppxKlOmnoDLX6aikrhfqqagKV+qqrLbq6quw
xv8q66y01mrrrfelKqcYuoqH669l9irssLIBa+yWxCar7LLMNuvss9Cqeey0V0Zr7bXYZqttYNR2
O+W24IYr7rjk4uTtueimq+667LbLULnwxivvvPTWa++p7uar7778onVvYfv8K/DABBds8MEIJ6zw
wgw37PDDEEcscaaqTGzxxRjT2e/GHHfs8UYZh6zkxySXbPLJA4ms8sost0wUyjDHLPO6Ltds8804
56wzhhmBMPPPQAet6M5EF41tL0YnrfTSTDft9NPBCS31aVBXDd7UWI9m9dbK1dhP1mCHLfbYZJdt
9qRcp23c2eiNQq3acMct95xs193Y3HjnrfeSdvf/7fffgAde6t6Ewyb44XAVrjhriDfO1uKQD+b4
5P5GbvnlmIe3ROacX6xG52BSLjpZoJdu+um91ZjO6GICJgfqsMcu++y01257eWd9wvruRg4iuqO8
B4/27cQXb/zxyCcl/PIjJe88SsxHL/301Fdv/fWkPa/99tx37/334IdvOfaOv0D++einv5b47Lc/
vvrwE+R+7fHX/8/8+Ocvt/389+///wAMoAAHSMACGvCACEygAhfIwAaaR38QjCDUHMg7CVrwgkWj
oAY36DEMevCDIAyhCEdIwhKa8IQoNB4HRZdCwq3whTCMoQyR1cIa2nBcMzzcDXfIwx76UEE5FNwP
/9UWxMAN8YhITKISl8jDIjrxiVCMohSnSMUqWrFkTMyiFrfIxS5274pgDKMYx0jG81ijjGikjxfX
yMYkpVFqbYyjHHf0xjra8Y54zGP05pgzPfrxj4AMpCDhyMdCGjJCgyTZIRfJyAMl8mONZNkjJ0nJ
6URyZZXc2CU3yUnyZLJfnQylKEdJylKa8pSoTKUqV6nCT+6LlbCMpV9cScta2vKWuMylLikiy176
8pdW26Uwh4kXYBKMmMhMpjKXycxmOvOZ0IymNKf5TGNa85rYdBk1Z5XNbnrzmw7bpqzASc5yEkmc
sDJnudDJzna6853wfIg6yRXPetrznpKapz69if9PTu0zXP3c1D/BFdBKDXRbBaXUQRfay4QOj6EQ
VaVD8xnRilr0om6aqEY3ytEbYfSjneyoSEdK0hCBlFklTalKV8rSlrr0pTCNqUxjdNKa2vSmGZqp
TnfKU8ng9KeBigFCEzWCjgL1qF7sKZaQmiqlVoup+HKqVKdK1aoeC6pYzSpVIKHVpVj1qxTsaqbA
+iSxYoqsyTQHWouk1rXmqK24hJg5zGqoudJ1UHZFSiF6iC64uvWvlrlroQCLI8ESirCITaxiBWLY
QS12Ro2NrGQnS1l5dQgWG1HCY8fWBxkurg+V5RNoQyun0Y5QcJ31bOFMe9rApbZbedhsFGMh27l0
kJZutXXRbeWU297ucbfADa5wh0vc4hrXJNAEAABqZU3l7mUVfaKmcmPVTedaFp3T9W2Jsksqc1oX
oPHkrnZFtFyBHve8thuvekeH3i+tV0Tt9dJ750vfgMa3S/XNr37ded/++hen+w2wgAdssl5Q7r9J
CggAIfkEACAAlQAsAAAAAHACxAEHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGj
x48gQ4rs+K+kyZMoU6pcybKly5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrQo0JFIkypdyrSp06dQ
o0qdSrWq1atYs2rdyrWr169gw4odS7as2bNo06pdy7at27dw48qdS7eu3bt48+rdy7ev37+AAwse
TLiw4cOIEytezLixRaOQI0ueTLmy5cuYM2vezPmy48+gQ4seTbq06dOoN3Zezbq169ewY8ueTbu2
7du4c+vezbu3b5apgwsfTry48ePIk4f8zby58+fQo0ufTr269evYs2vfzr279+/gw4v/H0++vPnz
tZWrX89eNPr38OPLny+zvf37bdnh38+/v139/gUo4IBlAUjggQgmSJWBCjbo4IMfscMghBRWaKFD
Ex5I34YcdrgaOx5KduGIJDKUYYkopojgiSq26OKLMMYo44w01mjjjRiFqOOOPPaYG45bAQDkkFX5
aOSRSCY5GZFMNkmYklBGKeWUMTlp5ZVYZqlljFR26eWXSG4p5phpgWnmmWjGR+aabIKV5ptwxinn
nHTWaeedeOapp25M3tLmn2btKeighBYF6KGIJqroonUV6uijtf0RIqOUVmrppQLOg+mmnAoH6aeg
hppSp6SWOpCoqKaq6qqstvqlqbDG/yrrrIe6auutuOaq66689urrr8AGK6yHtBab6LDIJqvsssza
auyzfzYr7bTUVmttS6Fcq+22ukLrLZnchiuuZd+Wa+656Kar7rrstutuRePGK++89NZr7734Nvfu
vi3m6++/AAcssEn8FmzwwQi3NfDCDDfs8MMQRyzxxBRXbPHFGGesMU4Jd+zxxyCHLPLIJJds8smM
bqzyyiy37PLLMMcsM68o12zzzTjnrPPOPMM688/kzcBaz0S3x0XRSLsF9NJMN+20iElHLfXUbD5t
dZpUZ93X1VyDqfXXYIctY9fvdUH22WinrfbabLft9ttwxy33bmLXbffdEM6t9958X/+L99+AB45f
34QXbvjhiCeu+OKyCe7445BHLvmNjFdu+eVzTq55kZh3ftvmoEfl+eikl95j6Kg3ZfrqQ6fu+uuw
xy67YazXLnAztu86++4Z5e57ZbwHD+/vxEMm/PERFa/88sx/jvzzDDUvPU/QV2/99dhn/9D03Hfv
/ffgt679+OSXb/75b42Dfqfhtw/c+sK7L//89I8Kf/D156///vz37z/p9wugAAdIQJv974AILF0B
Y5fA6S3wgRCMoATN1UDpTfCCGMygBjfIwQ56cC8VDKEIR0hCmX3whChMoQorVMIWunBtK4yhDDf1
wtzN8IY4zKEOd8jDHvrwh0AMomL/akhEFwLAakJ0iJBIVkTWJfGJUIyiFKdyNjw08YpYzKIWt/iv
KXrxiwPiYud+qA8wmjFBYsTcGdfIxjbaZQNujKOK0ng5OY6Mjpazox73yEcV4vGPgMRXHz0WyEIa
UlyDVEwu+HPIwyUyYY2MpCSZZUdJhGySmMykJjfJyU568pOg9NojR0nKUprylKgkZShXycpWutIn
qYylLGcJOvO04JW4zKUud8nLXvryl8AMppRoqS5hGvOYyEymMilJzGY685nQjKZeYoaFZErzmtjM
JhOX+TJtFoub3fTmrMDpMnGOk5zoTGdvzCkrmbhDnfCMJ2bYGSt5Zoye+MznqezJ/89++vOfn0zE
lPRJ0IIaNHTPOKhCF8rQhjr0oRDFGUAnStGKWvSiGOUeNjKqrIgei6MgDalIIebRkpr0pChNqbFK
ICY4FGekAFPpmmBKU5DKFFw1FeRNxZTTnlZ0p0D1ok+HStSiDiuoWjKqvJDK1KY6lXZKjSo5n0rV
qlr1qjqTKiKxiiOtetWaXKXcV7UV1rKa9axoLddY1yoUs7H1rXCNq1yNkta6anAUds2rXvfK1776
9a+ADaxgB3uRuTaLsCw0rGI9idjG8m6xkLWOESZrhMgii7KYrWzfeJhZx5rTskf1rGhHS9rSmtZk
oBXWaVf7uNQGi7UCcq1sAQnbAHDN9ra4za1uWVbb3tptt8Alom8ZGdzilnC4+zGuckWI3MEtd1XN
vY/fxhpd+wyMHF5SBQCry57nQpe7TIkEX7yrKvCa97x9JG+q/GIL9I5EvfDVn3vne7L42ve++M2v
fvfL3/76d7P0fel/9RTg4gQEACH5BAAgAJUALAAAAABwAsQBBwj/AP8JHEiwoMGDCBMqXMiwocOH
ECNKnEixosWLGDNq3Mixo8ePIEOKHElSo6eSKFOqXMmypcuXMGPKfGmvps2bOHPq3Mmzp8+fQIMK
HUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYMOKHUtW6cyzaNOqXcu2rdu3cD2WnUu3
rt27ePPq3cu3r9+/gAMLHky4sOHDiBMrXsy4sePHkCNLnky5suC4mDNr3sy5s+fPoEOLHk26tOnT
qFOrXs26tevXsGPLnk27tu3buHPr3s27d0rLwIMLH068uPHjyJMrX868ufPn0KNLn069elNK1rMb
9c29u/fv4B9q/x9Pvrz5veHTq1/Pnvb59/Djy6/avr79+/jz69/Pv7///wAGKOCABBZo4IEIJqjg
ggyGNt+DEEYo4YQUVmjhhRhmqOGGwDXo4YcgpsbhiCSWaOKJKKZ4YogstuhiZirGKOOMNNZo442M
vajjjjz26OOPQAYp5JBEFmnkkUjOhuOSTDYZVJJQRinllFRWaeWVWGb5mZNcdsmllmCGKeaYZJZp
5ploFujlmmzSmOabcLLW5px01mnnnXg2F+eefPbp55+ABioooHkWauh7gyaaZimKNuoob4dGKumk
lFZq6aWYZqrpppx26umnoIYq6qgbPmrqqaimqipapLbq6quwxv/a4aq01rqQrLjmquuuvM6lkAS2
BivssMQ+2uuxyP5E5C/FNuvss9BGK+20/yRr7bXYZqvtttx26+23lFIr7rjklvsiuOimq+667Lbr
bnXmxkvmu/RKKu+9+PYHQb789kvlEP4GLHCL9RZc6MAID2nwwnYm7PDDEEcs8cSDMmxxmxRnrPHG
HEt08ccghwxcFyKXbHKG+lHR8coInezyyzDHLPPMNNdsM2WQ3Kzzzjz37PPPg7Es9H9AF2300Ugn
rTRdQze939JQRy31p05Xfd/UWM9q9dZcd+3112CHLfaOWZdt9tlzjq22bWi3vdjacMvm9tyHVVlI
3H/SrXfQePf/7fffgAfO796E/yX44YgnrvjijDfu+OOQRy755JSvV/jl6FWu+eacd+45eJiHftfn
pJdu+umogyb66qy37vrrsMeeaeq0iyf77fTVrrtCuPfu++967S78QcAXb9bwyAtk/PLbJe/887sz
L/301DcF/fXYl1799tx331P24IdPuffei2/++YuTr/767LffO/rwxy///BK7Pz39nNuv//789+9/
c+X4nwAHSMACGvCACNzKNGLHLyzgTzMJfN0DJ0hBoUXwghjMoAZbVcHJbfCDICxYB0dIQoiFsHAl
fNwJV8jCb6XQcS2k2wsbF8Ma2vBYM2TcDdGWwx76kFo7PNsP/xEXxOkAoIhYO2LDhtgeAFgJidBR
Yp2YyB4nUvFvVqwSFLfIxdld8YtgNFYXoRbGvo2RjGWMW6ce8YgzOqZPj0hj3Ngox9WIqo1uzGME
67g2PSKNj2pLyhL8KDJAGvKQiEzkaAhpNEU68pGQjGRMGEnJSrpJkpjMZCcySZtQoM6SoAylKEdJ
FE6a8pSoTKUqV8nKVrrylf4ipSxnScta2rKQsIzYLXfJS+nksiDQ+KUwh0nMYpqply4zpjKXKSJk
OnNUAJDiM0EWzWmKrJrWpKY0s8kwbLptiNFkpr/C6Tdufgxw/aCiOS/mogWIU0nrZNg750lPCMbz
nvgMTD33yf/Pfh4unwANaF78SdCCskSg7zKouIDmC0YqFIgIbddDJ0rRitYvohjNqEY3ylHFWPSj
IA2pSEdakY5+6xQkFZZJV8pSpKQ0WC3l1kttFdNtzfSmOM1poGqqLZ369KdADSoneUrUohr1qEhN
6q6EytSmOpVISu3VU6eay6haNaNU3elVtxrQrBKKq+w7Blgb49W8jfWsaE0rk8rqJ7W6tZdsjetQ
30rXutrVQnLd012pllc47fWvluwrPxkl2MIaVnyATaxiF8vYxjr2saE6rGQnS9nKWpapkA3XZTfL
2c569rOgDa1vMkvaGIqWSqVN7QlPy9rWuva1sE2hag0V29p4Om+2B7OtbqO3mCvglji7DS4kzSHc
4j7st8hNrnKzYtwfLZdOzY0uSB8gXY48N23V1RFk/zCp7HoXctfF2HcJFt41jfe8iiuvedHL3inJ
wz7qja9851uT9tr3vhSlr373y9/+jgi/DPKvjQBMYLEJOCzbcE6BExQQADs=

------=_NextPart_000_0007_01C6F1E9.82CA7C60--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9H24ixM034842; Mon, 16 Oct 2006 19:04:44 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9H24iFS034841; Mon, 16 Oct 2006 19:04:44 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail-eur1.microsoft.com (mail-eur1.microsoft.com [213.199.128.139]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9H24gYg034834 for ; Mon, 16 Oct 2006 19:04:43 -0700 (MST) (envelope-from [email-masked])
Received: from EUR-MSG-11.europe.corp.microsoft.com ([65.53.193.180]) by mail-eur1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 17 Oct 2006 03:04:41 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6F18F.72E0C05C"
Subject: PKIX draft agenda uploaded
Date: Tue, 17 Oct 2006 02:56:18 +0100
Message-ID:
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: PKIX draft agenda uploaded
Thread-Index: Acbxj2/n09hC5NtlTFqApYElolSdPg==
From: "Stefan Santesson"
To:
X-OriginalArrivalTime: 17 Oct 2006 02:04:41.0505 (UTC) FILETIME=[9B9E1110:01C6F190]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6F18F.72E0C05C
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

A draft agenda is uploaded on
http://www3.ietf.org/proceedings/06nov/agenda/pkix.txt

=20

As you can see there is still some slack, which is not all that bad
after all since we sometimes manage to stay longer on topics than
planned.

But if you have anything that you think should be fitted into the agenda
or have any other comments on the draft agenda, please let me know.

=20

=20

Stefan Santesson

Senior Program Manager

Windows Security, Standards

------_=_NextPart_001_01C6F18F.72E0C05C
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

A draft agenda is uploaded on http://ww=
w3.ietf.org/proceedings/06nov/agenda/pkix.txt

As you can see there is still =
some slack,
which is not all that bad after all since we sometimes manage to stay =
longer on
topics than planned.

But if you have anything that =
you think
should be fitted into the agenda or have any other comments on the draft
agenda, please let me know.

Stefan Santesson

Senior Program Manager

Windows Security, =
Standards

------_=_NextPart_001_01C6F18F.72E0C05C--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GMvfAw021395; Mon, 16 Oct 2006 15:57:41 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9GMvfje021394; Mon, 16 Oct 2006 15:57:41 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from yancy.b70.net (yancy.pkiclue.com [209.172.115.117]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GMveMF021388 for ; Mon, 16 Oct 2006 15:57:40 -0700 (MST) (envelope-from [email-masked])
Received: from [127.0.0.1] (localhost [127.0.0.1]) by yancy.b70.net (8.9.3/8.9.3) with ESMTP id PAA02566 for ; Mon, 16 Oct 2006 15:11:39 -0700
Message-ID: <[email-masked]>
Date: Mon, 16 Oct 2006 15:57:35 -0700
From: Rodney Thayer
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: [email-masked]
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

unsubscribe
end

Received: from [201.250.143.48] ([201.250.135.126]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GMgRUc020607 for ; Mon, 16 Oct 2006 15:42:37 -0700 (MST) (envelope-from [email-masked])
Message-ID: <001001c6f174$569d5650$308ffac9@bangho5ac52453>
From: "TipsVisit"
To: [email-masked]
Subject: your
Date: Mon, 16 Oct 2006 19:42:19 -0300
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_000C_01C6F15B.314DAD50"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_000C_01C6F15B.314DAD50
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000D_01C6F15B.314DAD50"

------=_NextPart_001_000D_01C6F15B.314DAD50
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Agencies Health or Providers National Regional a Resources amp a =
Sponsors key in Partners Other am Funding am Contact West.
Titles counting in free in each Countless fun is learn safeguards =
personal or please review Customer Privacy licensed am materials.
Experience web blog archive in hardwaremy amazingly fantastic in Sony =
though may or be when in one of little.
Organize play of everything mac pc Then sync ipod bring along Disney =
films of without leaving is comfy chairwith Cover Flow you flip through =
digital video collection just as would.
Dohow itour stuffabout of uscontact usour stuffour workblog computing =
design a events love it mobile research am rich media software =
technology is user in experience web or blog archive hardwaremy =
amazingly.
August of July or June April March February December November October am =
aboutthis company am blog range people who work am for or us post using =
three Geekour powered Wordpress wide creating many is.
Have been or impressed Vaio shp Full item big Director rd January Link =
this Comment August in July June April March is February December =
November October aboutthis company is blog of range.
We or do rsaquo Physical Activity Education Faqrsaquo Links Recreation =
Websites Sports Government or and Local Govt Agencies Health Providers =
am National Regional Resources amp Sponsors or key Partners Other =
Funding Contact.
On find new Zealands active ahead nationwide a Confirms Investment =
recruits is Warriner Ambassador Getgo challenge kicks off am September =
is Sparc Releases High is Strategy boosts Melbourne Comments.
Hardware home ffb a dohow itour stuffabout a uscontact usour stuffour =
workblog computing.

------=_NextPart_001_000D_01C6F15B.314DAD50
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Agencies Health or Providers National =
Regional a=20
Resources amp a Sponsors key in Partners Other am Funding am Contact=20
West.
Titles counting in free in each Countless fun is learn =
safeguards=20
personal or please review Customer Privacy licensed am =
materials.
Experience=20
web blog archive in hardwaremy amazingly fantastic in Sony though may or =
be when=20
in one of little.
Organize play of everything mac pc Then sync ipod =
bring=20
along Disney films of without leaving is comfy chairwith Cover Flow you =
flip=20
through digital video collection just as would.
Dohow itour =
stuffabout of=20
uscontact usour stuffour workblog computing design a events love it =
mobile=20
research am rich media software technology is user in experience web or =
blog=20
archive hardwaremy amazingly.
August of July or June April March =
February=20
December November October am aboutthis company am blog range people who =
work am=20
for or us post using three Geekour powered Wordpress wide creating many=20
is.
Have been or impressed Vaio shp Full item big Director rd January =
Link=20
this Comment August in July June April March is February December =
November=20
October aboutthis company is blog of range.
We or do rsaquo Physical =
Activity=20
Education Faqrsaquo Links Recreation Websites Sports Government or and =
Local=20
Govt Agencies Health Providers am National Regional Resources amp =
Sponsors or=20
key Partners Other Funding Contact.
On find new Zealands active ahead =

nationwide a Confirms Investment recruits is Warriner Ambassador Getgo =
challenge=20
kicks off am September is Sparc Releases High is Strategy boosts =
Melbourne=20
Comments.
Hardware home ffb a dohow itour stuffabout a uscontact =
usour=20
stuffour workblog computing.

------=_NextPart_001_000D_01C6F15B.314DAD50--

------=_NextPart_000_000C_01C6F15B.314DAD50
Content-Type: image/gif;
name="love.gif"
Content-Transfer-Encoding: base64
Content-ID: <000b01c6f174$569ae550$308ffac9@bangho5ac52453>

R0lGODlh+AEoAof2AAAAAIAAAACAAICAAAAAgIAAgACAgMDAwMDcwKbK8EAgAGAgAIAgAKAgAMAg
AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA
AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA
AKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAAQIAAQKAAQMAAQOAA
QAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBAQMBAQOBAQABgQCBgQEBg
QGBgQIBgBKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCAQACgQCCgQECgQGCgQICgQKCg
QMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDgQEDgQGDgQIDgQKDgQMDgQODgQAAA
gCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAggIAggKAggMAggOAggABAgCBAgEBAgGBA
gIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBggMBggOBggACAgCCAgECAgGCAgICAgKCAgMCA
gOCAgACggCCggECggGCggICggKCggMCggOCggADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDg
gEDggGDggIDggKDggMDggODggAAAwCAAwEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAg
wKAgwMAgwOAgwABAwCBAwEBAwGBAwIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBg
wACAwCCAwECAwGCAwICAwKCAwMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDA
wGDAwIDAwKDAwP/78KCgpICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAfAGEALAAAAAD4ASgC
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePCO2JHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcpUJsinUKNKnUq1qtWrBw1h3cq1q9evYMOK
HUu2rNmFTdOqXcu2rdu3cOOmPEu3rt27ePPqlSq3r9+/gAMLHky4sOHDiBMrXsy4sePHkCNLnky5
suXLmDNr3sy5s+fPoEOLHs10r+nTqFOrXo2VtOvXsGPPZE27tu3buHPr3s27t+/fFGULH04cNvDj
yJMr5128ufPnl5dLn069ulno2LNrP2y9u/fv4Dtu/x9Pvnzb8OjTq19P0Lz79/CFsp9Pv779+/jz
69/Pv79/7zsREt+ABBZo4IEIwvffggw26OCDEEYo4YQUVmjhhRhmaFWCHHYYn4YghkifhySWqJ2I
KKb4nYkstujiizDG2JeKNNZo440IWYLjjgzJ6OOPQAYp5JBEFmnkkUgm+R6PTDaJmpJQRinllFRC
5uSVWNZV5ZZc4pTll2CC1eWYZJZp5pk1hanmmlWh6eaZbMYpp0eMWfLmnaDNqeeeFeHp55+ABiro
oIRCx+ehiCaq6KKnpcLoo5BGKumklFbqW6GYAmnpppx26umnEx0B6qhiZmoqjKSmquqqrLbq6qvt
nf8qK4uw1rrgrLjmquuuidnq66/ABnsRr8QWa+yxSwmrLHvINnvistBGKy2szlb73LRRXYLtWdZ2
6+233m4r7rjkgnXKg+Cmq+66s5br7rvwhsnuvJzFay9t9Oar77789utvmvcGLPDABBds8MEIR/Tv
wgw37PDDEEcs8U4JVxzWxEkKc6DFHHfs8ccgR4jxyCSPpEzJKKdMYsgsP6Xyy0W1LLN4MNds882C
zazzzjx7hfPPQAedVs9EKyz00TAVrXRDSDft9NM2LS11QlBXXdLUWGettUFWd23P1mCHrbTXZJdt
9tk2iy012my3jbLacMct99z2ui003TzbHTTeO+v/DTTfewFQqd+BAWC4oIDTZbjgnBIO1+KOq3x4
5JRDmbjMlcN8ecuZd85WCJ4LufnopCsb+tulp666q6e37vrrsMcuu2Sr1247qLPD6EHuvN90++/A
By/8rb0zPPzxyMtZ/PLMH5l8wM37+/z01DcZfb/VZ6+9itd3732L24cv/oXf5zv++einr/767Lev
Yfn0um86/OzKb//9+Oev//7840V//f1j3f/UFUABDhBcBUygAheItQMSJhoOjGBpGEgqCYaLgqOy
oAY3yMEOevCDIAyh2zBIwhKa8IQovJQIV8jC7ZyihTCMobq0IcIU2vCGOFyWDHfIQ7fkcFI9DGKx
/4QgRJNMo4gA+6ESl6gQJDrxiT5hohSnOBAoWvGKSaSiFrfIxS4yEItgDCNLvLgnMZrxjGh8ExnX
yMY2uvGNcIyj1tJoJjmCiY54zKMe91g4PlYJAFXTGuPsSMhCGvKQiEwk8vxYJUU68pGQZA0jqRTJ
SgpvkpjMpCaXZEnubRI7MviksTrpSVGa8oCkTNEpjZRKFK3ylbCMpSxnSctaFqmVIkKjncqEy176
8pcasaWMgIkhYcaImOSb5RkkNgFjOvOZ0IzmtyYnzZj0Z5DIbCJ5qFnNMf4Hm9mMkOHCyTXBGMMv
gOzmXMjJzrWps0PtjKc8O/nOetrznvjMpz73yf/PfqZtng3yp4IAStCCElKgCJVVLhLKS4M69KEQ
jahEJ/o8t/VgbxS9D0M3SrKMahShUShPQaPwH4GGlKPZOal5PsIPO5KUQSj1Yx1iStOausaj9rGp
oSy2BZz69KdADWr1dErUfQn1qPMrqlKXCkKkOnV8VniqVLvDVMvsoIgXqNZUt8rV4VX1q93q6lYo
UCqwvkasaPWUWY2T1rYObq03datcIwXXuM4VOHUlzV33ytep5XU0fQ2snv4qGsEalk2ETaxiQ3dY
3Sz2sYhrLG4gS9nKok2ymM0swSzLWThp9rM36qxoR0va0ioVtKilkWlXy9rWuva1sHVJalUT28X/
zDY1EZTHBSt0AGDWVjG3DW6GfkvctVKiuMilpXCXW6HkOve5uvIoH5hLXYtBN2fVvct1A5Nd7W73
u+CNUTqC0t2MpAMk4b3JeH/SEEyUVyHn/Uh61Ttfk9wjLevtyXsxEt/9lqW/G6mvTfJLMf8a+MBx
EvBbEMzgBjs4Ktooo4LP82CfTZgtFbbwhTes1wx7+MMglhSH1RLiq4x4aCVu04knmGKpUuF9K47x
ZlpMFRnbGDM0zrFtbszjHrtHx0BejY+HTOQi/yjILjMyUJCMXiU7eTBMjrKUp/PkKgOmnWiYspYt
ZeUue/nLztlyMMFMZhSLeVhlzuKZg5Nmmqz5BM1dCQgAIfkEAB8AYQAsAAAAAPgBKAIHCP8A/wkc
SLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48I7YkcSbKkyZMoU6pcybKly5cwY8qcSbOm
zZs4c+rcybOnz59AgwodSrSo0aNIkyodWW+pU5cgo0qdSrWq1atYs2rdyrWr169gw4odS7as2bNo
06pdy7at27NP48qdS7eu3bt486Z8y7ev37+AA2vVS7iw4cOIEysmKrix48eQI0ueTLmy5cuYM2ve
zLmz58+gQ4sezXax6dOoU6tezbq169ewY8ueTbu2bZxWbuvezbu3b5G5fwvHSbq48YhWjitfznyt
HbDJm0ufTl109OrYs2uHfH279+/g1Xb/D895uPnzPYOjXx+TvPv38Aezn0+/vv2b7gHE38//42kq
dQFw34AEFmjggQgm2Fp/DDbooEMKRijhhKw9aOGFGGao4YYcdujhh5hRKOKIJJZo4okopqjiiiyS
uJUAIMYoY2NtzGjjjW21qOOOPJqE449A9gVMcboEaaSFPSap5JJMNumkfUdGKWVpT1ZpJZRTZqnl
llx26eWXYIYp5phSXmnmmWimqeaabLbp5ptwxinnnHTWaeedeLJH5p58PpTnn4D61Oeg4V3z2SOE
Jqrooow2mh0mjkaaUKCUVlqTpJhmqummDVrqqYhXmMbpqD9+auqpqKaq6qqsturqq7DG/ypriqTW
aqtgttyq6668Gjnrr8AGK+ywxBZ7V6/IPmjsskom6+yz0EYr7bRcMmvtjsXpQ+22C13r7bfghrsU
t+SWa2654qZL4bnsFqfuu/DGK++89CLY7r345qvvvvyGVe+/AAcs8MAEF2xwlf0mrPDCUx7s8MMQ
RyzxxBRXnBfDGAdm8cYcd+zxxyCHTG/GJJds8sko1yryykml7PLLMMcs88w012xzyiznrPPOPPfs
889ABy300EQX/erNSCet9NIfOcL001BLZvTUe0Vt9dVYZ6311lx37TVXVIdd0svafG322RKJrfba
aqOtNdtwxy2023TXbffdDMttNN5arv/zmd6ABy744IQXbvjhiCfOJN+MN76w4jo7rjTklFdu+eV0
Sp405px3/iu1S2helecdi34z6XMKiLrFAKi+OsWtr2Z6n63PXnPtfL2ep+uJdZmN7VLrLvzwdwI/
M/HIJ6/88swPb/zz0KvcPMHRV2/99djDNz312Ze8/cDdhy++l9+Xb76K46ev/vrsO3b+v+3HLz+H
79c7v77156///vz3H+/9+fKfAAf4GwAa8IAITKACF8hAsVzhMQQMVwO5FcEKWjA2E9zWBTfIQdRk
kFodXNYHR0jCElYvhCgEFhhSyMIWuokW6DGhDGfoPhfa8IY4hBgNkZXDHvrwh/LaYa//gOgqIfKK
iEhMIkuMyMQmOnFySkzVE6dIRflEkS5FOFEVt8jFLuLvimBU4r7E4cUyziiMpjKjGtfIxja68Y1w
jGPa0OgpOfaJjnW0ox73yMc++vGP8cGjpW71QCMKslKATOQMD8nIRjrySYrs0iMnSclKWpJykczk
By/Jyf1pUkudlNMnsxTKOI2yYaVM5fZOWS4DsPKVsIylLBulSjfN8pbiq2WbcHkjXbKJl8AMpjDF
8isc2HCYyJydL5fpvGTSDQ/OjOYZmYkmaW6ImtgknTU1lM1uYm6b4AynOA3izXJicpwOMick0cnO
drrznfBEmTqdFM962jOT88wn4e5p/zVS8POfx8kTL/RJUAIB9KAnK6hC4YbQhmZsoTxyqEQVBtGK
Um2iGN2XRVuU0Y7ea6MgDalIR0pSg3n0pChNqUdLylKRqVQ5LY2pTNH40oDOdEI1Nc5NcZpT0uyU
hQ1onr4aID+BBfWnB2rAUafXLqICsF5LRWqBovo9czm1pwCVqla3ykGGcAGrYA0r37hK1rL6T6yg
MSvPYqHWtroVT2j921vnE9e62vWueM3rpOaqJ71ehq+ANZZfB0tYpgX2sMIqLGUQax7FOnZLjI1s
rB5L2cqaTLIFtGxjMMvZVWn2s6AN7QkfqYziifa09OusatOI2tyt9jatje2FXgtb2eHa9ra4fRpt
d8vb3m4wt+HJBHD/4dviGve4yE2uck9CkBoM97nYWa7soEvd6Er3uuusLjGvOA/Watdf2A2veMH1
3fKa90jjXcx518ve9rr3vfDVFDviq6j02pej9M2vfvdbJn024b4i5K+AB9wcABv4wAgmiTw4RuAG
vyXBEJaQgz0S4Qrba8IYzrCGN+whC9uFwxjxcF1ATOKuiJguJU5xVk7MYrqqeI4tXtMqVhHjpMxY
rcZZxUvZc+MaI4XGc30xjOfC1ggLOSI+HteRl8xksCW5ZU0GYCKiTGWoPTkpAQEAIfkEAB8AYQAs
AAAAAPgBKAIHCP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48I7YkcSbKkyZMo
U6pcybKly5cwY8qcSbOmzZs4c+rcybOnz58oQQodSrSo0aNIkypdyrSp06dQo0qdSrWq1atYs2rd
yrWr169YgYodS7as2bNo06pdy7at27dw48qdS7eu3bszwerdy7ev379L8QoeTLiw4cOIEytezLix
48eQgwKeTLmy5ct+I2vezLmz58+gQ4seTbr0ScyoU6tezVqo6dewY8vm3Lq27du4bc/ezbu379/A
gwsfTry48ePIkytfzry58+fQozfPTb269etcpWvfzr279+/gw4v/H09+98Yf2NOrX8++vfv38OM/
LE+/Pn35+PPrt26/v///AAYo4IAEFmjggQgmqOCCDDbooEgPPCjhhBRWaOGFGGao4YYcdujhh+Tt
J+KIJFoG4okovlTiiiy26OKLMMYo44w01mgjQSnmqKNJN/bo448G7SjkkEQWaeSRSCII5JJM0pjk
kxU2KeWUVFZp5ZWoQanlllx26eWXYBqG5Zhk8hfmmWimqSaUMazp5ptw3lfmnHSuFued0tWp556U
4emnc3wGKihYfxZq6KGIJqrooow26uijjA0q6aRXQWrpaJRmqilT3mzq6aeghirqqKSWauqpqKaq
6qqsturqq7DG/yrrrLQademtuOZKYa289urrr8AGK2xVuhZr7LHIJqvssn6CYtew0EYr7bTUVusr
s9ii+Um23Ha7pS/ehivuuLNZa+6L5KZL1rnstuvuu/DGO6O69P4k773t1avvTvj2m96+AN/k78B/
+TFRwAjnRfDCDDfs8MMQRyyxe7/pkfDFLlmMMYjq6THxx3t5DHK0vmm88YfpiTzyylQmwfLLMKd6
8synxWzzVDTnPNLNPEOls849B83Uz0QXjbHQSCNl9LKfbLt0wE3jlPTUBzVN9dUbWb3R04cJYmHU
XO8Ldtj1jk02vU6PhfXaW5/t9tvFsi33RXDXbffdeOett5Jz9//t99+AB97U3oQX7h0ckAmu+EGG
d7v445BHLjnkjVdu+ZOTK345s5njBk7noIcuupUIb7L56YiOrvrqK6Pu+usdss427MbKvjbtuOeu
++689+7778AHL7xPtmM9/KLFJ6/8vcc37/zz0Ecv/fTUV2/99dg3tvz23JubvZvdB/39muGXb/75
6Kevfpbjp7k+y+27//7I8ddvv0ik3DX//vz37z+pRvhfme4HJgFCjIAITKBbDPgwBTrwgRCMoAQT
w0CHTRBJFWzYBY+UwQ568IMgDKEIRyioDZrwhCjsknu+QML8pPCFMIxhjloYr5a044YynBBEbsjD
dtAQXj284Q//3yXEIaoqh0hMohKXyMQmfseIUIyiFKdIxSoWLwLVceKGrMjFLnrxi2C8kRY1FMYm
AQAAlMFGGfNzxjaGZYy8aaOY1ngtONpxenTMox73OLE7WoiPgAykIAdJyEJKzI+IdJ4hF8nIICXy
kZCM5GsaSclKWpJUksykJjfJSUjBbBfo66QoR0nKUppyQ8E40SVNdUoBrfKVe2ylLGdJS5vA8pZr
rKUuw1OMAeHyl9HKATD3t8vn9AAmw0wmFYvJzJyNjgHKjKZTmknNalrzmtjknDS3yc1/NKKb4Ayn
OEGSTe+Mc0/lTKc618nOyJxTT+2MpzxP+M562vOe+MynPvc5/6J5+lNX/CTdPwdK0PoF9KDFK6hC
GYXQKS30OA2V0kONE9EmTbQ4Fc1o5y7KUTxp9KOR66hwQOojkZr0pChNqUqZ2UY5rhQ0LQXAS/VG
UouojGIzjU1Nd8rTnvr0p0ANqlCHStSiGvWoSE1qI3OqU6Xuh6mwcapUpzpCXVD1qh+D6iTXhwj6
/YwRM8NqfLRqGrGa1V1kLc1Z1+q9tLqVY2xdz1tFE1e5zvWueM2r9eqqHr36VYd8xc5fNxOjTPx0
sIhdUGAFm9jGGmix13GsYyBrJsla9j+UzeJlN8vZznr2s7TMLHVAWxjR5oa0qE2tarHFT1SY9rWw
FepqZ0vb2uY+Kra1se1ccNsa3fp2pLy102/fEtyAQqO4yE2ucpfL3CMOd4HN7dNz2xJd6U53LdX1
XxD8d122ZPe74A1v+LpLXrWKdy/l9d0WaHbe9jIpvfD9jHvnS19hxfe++J1Offcro/yq7bzf5K+A
B4w0/4qFwG80MPEQzOCnKvjBEI5w9cAl4Qp3ssHEsrDUMIwzA+3jwhyWioY3XJtjmHbEKIZuiH2W
YpqsOCotdvGLZ8zYGNt4XUPEB7tuHBMa+/jHQA6ykCfH4+a8AaVDVlqRXZLkoyz5yfxqspSnTOU5
QfnKAquylvUSEAAh+QQAJABhACwAAAAA+AEjAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLF
ixgzatzIsaPHjwj/iRxJsqTJkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fPnyhBCh1KtKjRo0iT
Kl3KtKnTp1CjSp1KtarVq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3bhkDjyp1Lt67du3jz6t3L
V+Xbv4ADCx5MuLDhw4gTK17MuLHjqX0jS55MubLly5gza97MubPnz6BD931MurTp0xNFq17NurXr
13pRy55Nu7bt27hz697Nu7fvirCDCx9OvPjr38iTK19qvLnz59Cjx11Ovbr169iza9/Ovbt3jyy/
d/+UTr68+ZUC0ttTT1DA+oLu08tnPz9+ffkD8eefD58//P/tBSjQffqtp597ABpU4Hv9ERifQOdF
KKFwDSHIXn4MYohgggMKuN+HGWa4YYcevjfihg9yaGCAI5LYHooWKlhiiOLVWFZ4MZ7oYowyJtTi
jy6KyBCKQmrYI4ZHIjkjjyUCac+EUEZZHIMpkkgkjUEm2WKHOmZ5EJFXcqklQls6+V+ZS0Io5Zps
rkbljnAaWN+AFzb5ZYgn1plglTqiqWSDc84oJodO8jVPm4gmimOcYP75pZlYmuifglu+aaWSkFaK
JaRGEgqgoqCGOpmlpPJZoZ0yhnlnqp3SuSCeZCZgGWmVfxYq6q246nQqrI16uWqWTnb5K4utFulo
pX6muamgNjYbGJN0oqqisNFWG6yK1YJII7UrFuvlheAq66iz5KKF34/UEuiqnsjW6Wegw8Iq7Yv0
ybpfma9uW+6+XQUEACH5BAAkAGEALAAAIgD4ASMABwj/AO0JHEhQoICD9gQURDhQYcODEB1GdNiw
oEGGBi1KjGixIkGKCRd+7MgxpEiSGB+mzDiyo8uXMGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGj
SJMqXcq0qdOm/6JKnRr1qdWrR6lq3cq1q9evYMOKHUu2rNmzaNOqXcu2rVmscOPKnUu3rt27eHOC
Rdo1r1+7bgMLHky4sOHDiM/+Xcy4sePHkCML3ZuVq+TLRRNr3sy5s+fPiflaxkwaKOjTqFOrXq1W
Zr7XsGPLlk3wdUHbMz8U1E1Q94ff9nj3hvm7+EDhFo0f3818uHOByqEnD14ceW/rwI0DH159+/LS
4MOL//eZ72X5gecFpseNPn1M5L6d87YenLj8jt63w6///bnw/PNNt19y2AVIHXMF9jfeggw2aJF7
t9UmoXr2rFdhTf/xp6GBz+F333T+LZchiBs2R198CoqoIn8oSndiig7GKKNfYEE4IYXo5WhheX2F
OCKLJHr43YsgZvgjgjDW9+KASLoonZLcCckba1RWaeWVnblGW45c4njhhefZ+JKR/XGY5HHVwUgf
kE4+KWCSLa7o5n0G1innhzPmqedjYnpZYWwTlhcmhm5yaOacQR6q4YcjrjnnmnG6mKaUbBrapol7
ZqppXn1+6aV7FvopU4txKuooopEuWmaJpy4KqapQIv+66pOWxorpprjmalSN5t3oaagX9hjlpWx2
GKStxu5H5pjNDfkmnLOaGR+RBGFp7bXYZutWp6BG6KmEwqK524DUCkkrfv/BlyCz14n7KKrHnqtq
duN+p+29+Oar7z/c+kqhmDyO1uyj2XVH3aRoRteduq8aG+/BBOZ37Kva1btwc/tmrPHGhenq8ccg
h5wXZbsKLLJkHKes8spjnezyyzDH7BPJMmPG8s0456xazaXp7PPPQL/F89BEF2300UgnrTRkJPPj
NEFPQ11Q1ANRbY/T/ECdtdRYY93R1gKBHbZLXlvU9dVdnx221WlXnXbWbcck9tpgbx303XjnLRba
bq//PfXUc0dNteCBXw0411KPbXbdjCeueN9+G171445L/jXbc0uu9+ac3zxT4YaLXXjdkoMON+J/
Ty765GanbvnXriu++uusUw577ZUvrTvPYGUe+uujq0772KcL3zrxf/uu/PCxLz/78rjfzrzmnVdv
fc7OP2566cwXTzr0v6Meu/EvzZ682mi3bT7Zbpet+PXwx79x9rKn7n33lm9dvP3R+46//7ijX/0W
577yBZB18kugAlMjEwHqz3Xfgx3pwmc/9NkuesiDyfrIl0EINrB/F9ydCJO2PQ7mj3UlRF7mJkg7
AIJuerZLYQcrB0DtjW+EOCRh41r4wsQN7oFa42EMOHMXxMjx7YBFPOLzpBdCJJ4wh1BEWgED18MA
su1wb8vdBgl4Oat1D3Pue9v+MJi+H24ximjMVEAAACH5BAAkAGEALAAARAD4ASMABwj/AO0JHEiw
IL+DBPkZVJiwoECGDxEOhBjR3sGLFClabOgwocSFHx92vOiRZESMCjVudIhyYkiVHWPKnEmzps2b
OHPq3Mmzp8+fQIMKzfmvqNGjRYcqXcq06VKkUKNKnUq1qtWrWLNq3cq1q9evYMOKHTvVqdmzaNOq
Xcu2rdu3cOMCtSq3rt2zZPPq3cu3r9+/gAMLHky4sOHDiBMrXsy48di7kCNLnky5suXLdR1r3sy5
s+fPoEOLHk26tOnTqFOrXs26tevXsGPTxUy7tu3buHPrViq7t+/fwIMLH068uPHjyJMrX868+eLd
0KNLn069uvXr2LNr387dp/Pv4MOLvh9Pvrz588QZoF/Pvr3q7vDjy59Pv779+/jz69/Pv7///5K5
J+CABBZooGEAHKigeQDeB0CDEEYo4YQ2PUjhhXV1ct2CrCXI4YfgYcidhSKWaKJDIKao4oqAneji
izDGKOOMNNYo02x3STWQjm+x6OOPfUXGoz1DtgXkkUiCJWRUOzLZY5JQRnkTAFSSaBs4WGI5UJZb
cilQllraA6aYY9po5plo0WVlXENKBY5Db34p55xxbtlRnU1GqSeQAQEAIfkEACQAYQAsAABmAPgB
IwAHCP8A/wkcSFCgPQD2EipcyLChw4cQExYcqHCiQHANMSbUqNEeR4YdF4aUaLGkyZMoU6pcybKl
y5cwY8qcSbOmzZs4c5ZE2BCAz4Q+Ef48GFRhUaJDeR4ESnJiRYsjo3pU+FGkw5H2dGrdyrWr169g
w4odWzIiU4ZKhZ5Ve9boUqZp25q9Cq4uRqkdOdqlWtfq3L+AAwseTLiw4cOIEytezLix48eQlbqF
u/bt26BsL1tGLNWq3bwQQUMeTbq06dOoU6tezbqpSclt2fLMTNvy7M2uCT6d2Jnq1N/AM/pmSLa4
8ePIkytfrhx33NtLn7uNK5dn2dwDsYreHnr4Qubgw4v8H0++vE3AmIEmrZxe/U/qm2ELxuqx70bP
n+vbv9+6v///AAYo4IAEBibfXAcWqOCCDDbo4IMQEphgRBNGaOGFGGao4YYcdujhhyCGKKJ/5pVo
4okopqjiimCN6OKLMMYoI4Qs1mjjjTjmqKNxM/bo449ABnnYjkQWaeSRSOoo5JJMNunki0lGKeWU
VFbZ1ZNYZqnllgRa6eWXYIb5JZdklmnmmWimqeaabCYm5ptwxiknim3WaeedeOap55589unnn4yt
AaiDcxZq6KGIejXooow26uijkEYq6aSUVmrppZhmqummnHbq6aeghirqqJNmQeqpqKaq6qqsGhYQ
ACH5BAAkAGEALAAAiAD4ASMABwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8eP
CP+JHElSJMiTKFOq1FiypcuXMGPKnEmzps2bOHPq3Mmzp8+fLVcKHUq0qNGjSJMqXcq0KVNwDaE6
TSl1qtWrWLMiBce1aleuAr8O7DqWIFSxZsl+lYo2rNe3YMG6LVjVHtmwZSfetdu2rVu1Yvu+pXvX
K16tiBMrXnxwpmG7dA0+rns2L2SzkQ/K5Xt47GDMndlahvi482XNqEPPXW258mmpQGPLnk27tu3b
uHPTnJx5NGTKr00Lr4u5suviv0Gfxgt4c+HlxEsTPzw9OPXk0csex6u7u/fv4MOL/6/NcPLe58i1
550uOLvx5cyTt44sPfjm4fMl/3We/3125uwxJuCABCrWV0LbyQcgf73pt158fLkmWn7qqbYWfPDV
h2BqEfKWYWEBFijiiCQaNSGGFaYoX2m+KXeZaMBNCBx+9f3nonUotmidhzZCqGOJQAYpZEgyeZia
kQqymCN0mRnW44wvzuckh1BieKJySEaZoWlQjefll2CGKaZ4MQa2V4RpyQWlmc31+JpaDUJ3X1zr
qYnQmR/aiSKLCcrY24RjBirooISGOWRH1R1aUaKKNuqogDM9GpWkiw5U6KWYZqopbhu9NOSmoIYq
6qikcsqSS5+WquqqrLZaqFUAeP8U60ezUmrrrbgqNhMAvNY6kK8MeUqQr70a1CuvAhVbELAHAYts
srU6K5Cr1FZr7bXiRWuRsNAiqy1CsX7767LLEjtssuieaw+27LZbqDPuhqdtuPbMqqyy9U6LKrri
MpuuuPmSK3DA4+brb6zxJqzwwvHOay/BBD+87r4GFwyxugAzq/Gv+D578MSrFsHwyCSvytCx6VbM
Mb4O3WuxuhHDfGzHFktbr7m55qzzzkbtOjC9LxfELb8xG1szzEEXfTHQ2pbs9NNQC2qzyilLPHTF
32b88sY/b/3vuFGHLfbYPZ3c9c32PnsxuB2rDTDaRiMNd7c/v83z3Xjnrai/FvG1rZHfegcu+OCW
ytQpxSlvBHjfhZPt+OOQk0T45JRXbrlDka7E7dXbRu7556ADRdHiwG6O+EWhp6566g2h3PJCizcU
wOyz20N77bcPVLtAu1/u+++X+ywR6UJT/FIAByHPu+68K2878qtHL330U4frbdpue5yu6S05T5Dz
4C+P/PggT2/++WTPPe/X6xMdMPcl3R7+8vSTTz76+OfPLkQPS9z/uO2ziPeY17zeKe+AwEugAgUX
EAAh+QQAJABhACwAAKoA+AEjAAcI/wDtCRxIsKA9AAIRIjyYsOFChg8VGpxIcWCAiRcFBtiY0V7G
jxVDihxJsqTJkyhTqlzJsqXLlzBjypxJM+S/mzhz3iS4UCLDnz4hDgwqUCfOgUZvdiTYEaTGpx7t
JZ1KtarVq1izat3KtavXr2DDih1LtqzZs2JPRhzaUKhDtj1ZLrVIF+rcuTXz6t3Lt6/fv4ADC84L
oPDDn0AdGh5auO1hlHijQn16d7Dly5gza97MubPLx55Dix5NurTp06GvTgT9cirSpDLRyp5Nu7bt
27hz695tG7Xv38CDCx9OfKTq4lJhr+TNvLnz59CjS+/K7yzymKyva9/Ovfvoq4Yb8/9cjDJ8dpOs
XfMseJj89Pfw48ufT1/3yPNrU55XqzJ8wvyIeSfggAQWWBN+6x0kHoBsMRZXT+RFuCBJRCHGoIEY
ZqjhhuOJl2BbcDX44XoTvmUiiCFVCOB+HLbo4oucHacYURBOyFp7i62oYI4TqfdfeyIiVN+QRBZp
5JFI/jNigEE9uFqQFoa4ZFHKSRllQ0lmqeWWXHbpY0UX5qfjkyA2aSWN6F2pJoxstummaOR1iKOH
2c1Jo4QRxXVfnHx6+OafgAbamlUvschfSV8GKJKXjDbq6KPQ+WXonpMeKuilmGbaEqScdurpp6CG
KuqopJZqKpeapqrqqque6uqrsMZSyiirtNZq64uy5qrrrrw+d+uvwAa7Xa/EFmvsscgmq+yy0UnQ
qLDQRivttNRWa+212GarrbTMdiudP96GK+645JZr7rnopqtub9u2W9AS7robEAAh+QQAJABhACwA
AMwA+AEjAAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFJRYzatzIsaPHjyBDihxJsqTJkyhT
qlzJsmXKfzBjypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1KtarVq1izat3K
tavXr2DDih1LtqzZs2jTql3Ltq3Lt3Djyp1Lt67du3jz6t3Lt6/fv4ApfghMuLDhw4gTK17MuLHj
x5Aftp1MubLly5jJRt5sN7Pnz585ix5NurTp06hTq17N2iC/16/twY49e2Bsgbdx87O9W7ft37N7
1yZYO7hs4rJ7H8+9G3by37pz856O+3n16NCrM+dNu7jy7s63G/9vTb58Q53KkV8/br19e+bfr6dn
7/pgfODxt7PXP78gfPzQ3ZdecwL65993zR2YXX/2gObgg24txOB9+y1Hn4UJVmjhehyqZyCHCQq3
oYgjXlhfhSJmmCFwyKloookhbsgifQOaZ+ONAqE3HI0BYthiifsN6Bx2B9YIYokuoqidQiS66KSB
NT5ZZIoYDpnkhb1BqOWWlU3IXYFYyiemewx2uGB2SCqpYYzJzdfkklS6GWacJ/Yoo5gUEsTlnnye
5eWYa6qXonErlvnienk+SWWgK2JJKJyQ/jgjmx6O2aiah/ap6aZSMfQnjzBWemeShpZJYZTTIQjo
bYlK+pyqoKL/6luool4Ka5g45hqZIefl9KmsaMoJLIHhDfllpcOpqixt1LVp5JK+3Wqss4giCB6z
LRbXrJGcduttUrqGK+645JZr7rnopqvuuuy26+678MY7mk7yhguAR/fei5i+En1L2UQABBywRfwO
JHDBbw0skMJzIWyww3IVLDBBDC/M78D52pPxQxA/bDBFEyvUcb1x0WvQyBE5fHHEF6O8UscVNzzx
yhofxPDNNeNLc8ofJ+RyQv5CaPPJCm8cssYYV7zz0SE3/bHRRd+sdM1Q63vwwy1HbXXSWFusdUFW
e7211GEvjDTZXnf99NAwU+12xmOLDfbZCBudds5lm02x23Tf/1213kFHmPLVKxe9ds9761144nxT
nXfOje8N99w7m7245YpDvnHkPee9+eeahy7x4ZSfLLfkb6d+OeSNjx725Y/XjbTerc/O+u0kt3T0
7asfnG/lp9P9O+KgV+677YmXTXjnMz+9PN7Ciz409JhXX/vq0cd8N+3GZz558YjX3rnjzU8evvjk
Y+xx7nzJbj3E6s8dOtHSv884xaND33v9nCvPO+lYa5799oc9+KmMetxLHua+RzrXhe91/zMf7exn
vQkij30kMZn8iDc/1m2Ogx28XgMZlz8Lgm+AI/QfAU2XwhaiEIQWTB0J76c6EU4QdMTDIfDmtzT+
ja9BgQPN9EDwF7uvWex+cTub2vomMSPu7n9MZJ7Wkug/JfKwhDbEG9l06MSYXS16VjwfA6n4wBC2
bHs7DGMTnbhEfQVxLQEBACH5BAAkAGEALAAA7gD4ASMABwj/AP8JHEhQoL2DCO0BSHgQgMOGCR0u
VPiw4USICCdKtHhxI8eFFylqrOgxI8ORDzt+XCkSo0aOGBVajEhTpcqWK2963FkxI8+fJ4OClIky
ZsihMWXOxKm0acSeR4E2LTmxoNWrWLNq3cq1q9evYMNqZUi2rNmzaNOqXcu2rVu0Id/KnUuXbdy6
ePPq3cu3r9+/gAMLHkz4bcnCiOfeTcy4sePHkCNLnky5suXLmDNr3lyWK+fPoEOLHn1QrOnTqFOr
Xg2WdOHFrk3Gnl2Zte3buHPjlpjyac+lU32jhBqXt1PYvJGmHemzOcvgyUX+vkk0JVXjTstib3sY
ts+OxKO6/41e9+72yLrTq1/PfmBxmkmhyjaaHXj2o2bfq2UOXL7L/2SZN99LwdXnXX12yfZbgCbZ
pKBcB47HYFKPtWfhhRiGpR99ABIVFEQCKhUihfOROKGHSBGoU4EfwlcggSJqd5Z5JB3WYoQN5gii
YgGSJGJ4TLF4XVHQ/UhkSxkmqWR6++3k4oo7Cvecij2eJ5xyM+aYYof8PYfgUMrBOJyL2vkY5Zdk
ZlkkiDYuZ5xNYh53Ypz4nQkSjGvSpidiG0oHX51PGthhici12NJGUFLpp32LNYqiglTJiOiCdyJa
IoU4Uhcmi4dOd+NUb1L3HXiTDphnVKXuqapgfYpJnqBnfv/Um6GFpikjgJVaeuqtQnmI66UmMrhh
n8ESqqOvCOb3qajNhcjsTA7aaStFq1bbV6sPmrosrZj+aWiygdYk7q9o8lonlN8qG62cJ963rbQJ
BqrpuOGKuum6gAJq7b5mcRXdm/RyytK/T+o66H1tehswlvduVyuoDEuHZ5WkeikxTJhiN+R3Ep5k
JsbXkUnkxjn5BnJFS6ascmr8KqsXjq7BrCaPLdds82ee7SnzWjuD1jOvht2s2cpEF82a0EgnrbRl
Rje93tJQRy311FRXvRfMP1sdtM8Q0pW11rQRlxlyCXfNMYcQhqe2x5O2DZ5zo6Kd37PccQ0s0Pvd
bSuWYPv//DZmjvo1r8Dxslts4C/+berEZerNs93FTjtzhA/3LZm/j+Lk8NqaW3e2xp5WuaOV4TZo
HZDIuit3tp/+B+a2WMeoOa7+ff5TxdCRPCSqGC/qZHyn495d5ws5bXxueb9O73v4yn7vscDCubq2
xzZPaevlvjr468NS+/hL0YLf7vK7Wi+vsfQxuyn1zAvruOWDYe68wWPCqSv4AMdKYvPBqi/kxSNC
24EQ57CDga5M56qOpbhHrPwh63nSQtWsDMc/jakucROs3kWOx8ELUcl8EfyQ+M6XLv4ly3/zItYF
6XY3dCnqUnxzmfK0BCr0PbB81TOc3FKYw9T9b13Qo1YH/4e4nvaF8Ii+GuENEZc+bWGLSzkkoMgm
JEUDWhFcA1qf/+ITxS4icVfsAyOscNiroBDxjLnRjwPH5DszqehjXYrb7KbUru5o8WNs+5YFyyUn
NXYrcjVkik5qF7cKrm2QR7JSjUjFxi/dsUZ/qlRp0EjJnDnma6x6HPwkg8mwbVJolnzZgiojs05+
0mtTM+VcKsnKrJzylbCMpSzZEspZ2vKW/GplJV2WJVVuTZOFw6W1fEkYYppSl0VDJVywCJidDbCM
XhulYr5GI7hZhmzSpBljfmZMYfallu/z4WvqRs7yhJNn1OyRNUmJt6uJppt1QSbR8hajzYlPfW5k
E+oWxTcx+1WsfiC7IQx9Byk/nmxknlLe7c7WxqKgDnT6itLvFFgckgUpRQ/1ESLlODAadmqfUvFm
QgICACH5BAAkAGEALAAAEAH4ASMABwj/AO0JHEhQIACDCAEoPGhQYUJ7DCEWXIhQosSFESk2dEiQ
YkaIGkEeZIjRosaRFlOqvHhyIEmOLiuK3EhzZkyUL3NmhFnSpsedOmvKvFnzY0+XIZPCvCj0JEeU
FZUu7WnUpMOjUoUW3Mq1q9evYMOKHUsWLMmHaJlCVVnVZMq1cDvKTbuWadqEZ4dGpPt2ZUy3f2XW
fTg4rty2ds8iHuz3KVG+gffanZh3ct+4i+dOHlm572HNksuKHk26tGmuODdfdiu5amqjJT8ijXw5
c9C9hSeuxos66k6kHrfmvf039k3jrJFb9m1YtWzBGzkLB361I3KoGJvvVk1bpPTooU+L/x9PHuy/
8+jTn3+9PfVy12ofd7fefjbm7e91Z25oHevv1tOxJt99dwGWW4FseeZcYPXxN59euiUWYYJ8Pdcg
SCupp+GGHHbo4YcghijiiGLJZpuC3Zk4IIorWuhefAWGpyJkEDKIG35DLVhhi1HVJ+OKO9bInZCI
XbgfdEdeOGR5TDbppFnFFeeYhcClKCVQuPH001OOeWdVdZpRhiV1Ntnok5a/MfilYVQ5NRxz0GEo
Zl1ScbaUZ7HdmSVQRdmI5p5j7onnllU+aeiho4FIXniINgrlWIw6KmmkkoZFaaWLYlrQiJx26umn
oKpX6aWaOkqqmqUaGlKqkLL65Kmuxv8qa1eKzmrrrbjmquuu9oTq66/ABiushrwWa+yxyCar7LLM
igarcM82WyJj0mIabYCTindttdyaVqulpG2L7aGw3ujlgyXyKu5RE4qLKrkTtkrasPTWa++9Isrr
7HjuvvpZbzl2WxqVcQ5srbal4avwwgwH69OafebUX2Jcflflm2XShKaDLZmLoMZNTcnSn2IWdVVQ
JneZFcBfarxqxNHBnPGZEles2MrnFoodRw337HPD4PLmY2eRVYYdkT262ONcmAF4ZbtDB0khkkmr
eV+RqLVEo8ff2UY00m/CJzWjXb8r8NlbgXiknWDKCRptGFP9ornDdSyfmWGeODaKXBv/OGjbOOX5
ld58Azky4KH1HTZRsAWXo3LZ9frz5JQLG/SQB842X1udwafd4lUj6DHYPO6Nt4Q6Ligj2aUXvvVK
rY3O+Y5YK00j2riftjaOUz939NR44q1YlFgD37uPrcv+2PB7f/548qc3R2Deb4MOY+qKo5v79tN2
7qZgevqJcewFvzy+1lrPGfPbZabPpvkVL802mZzH/zjOgJfM1vdv3Umz/Od635j6Qyf/cQ933zrg
aPrlKgb6RYEQHEjlJkhBe0VwX8x6WbguyEEJVvCDIHzGpzpIwhKaUCwgTKEKQ3XCFrrwhCuMoQwb
RSkH6kd3vbEhBp2kw7L0MF6lMmDA/15IRE0RLG9TORV7NjiddZnmh2FSVbwiF7LwDRFhj/KK07JY
xC4u0GxemhFZqDXGHKYKimCEF6rE2DceXq4raPQiAj90vuFtCUA/ItvJCNOynJHpYRKj2I3YlTI4
aYVmA9RZH//4MD9u8XZ3LBQj7Qa/QF6sY266GckIIsNOpjBozGNJ+f7FNPNVbYlLOhEev5ZKOKbO
lUk6jNHYxzjxtQ0vVlSS1wJWvOyp0nBylJba4rO7+7WRQna8nvNoF7M0kTJLBDycxaIZS8ixy0TB
sZ3VXFebVREucXdz0Gp+eTvJefKcnmRPMRsDmIL5TZ3A/GXtBrnGq2WtevEEJj75KJ+k52mzeFQr
J+/4IzbV6ROdCJ1cupaGuTXmp0bJnBs37dnLZ5qRn8D75j4nOs7TWQlpkIQe1CJlT2ZCJo7BlJXv
ukRQW4LnkItzj/vUB8hmShKSJAukBiG3PvpNLJo2dWTWEmmfpwG1keLsk/5ck8mTpi+lUHVlVKuF
UkRV1YdAfONUtxpFriLrqlK01SMHJ0Sv6iqBZk2rWpOV0LZuKCAAIfkEACQAYQAsAAAyAfgBIwAH
CP8A/wkcSFCgvYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48WC4ocSbKkyZMoU6pcqRKky5cw
Y8qcSbOmzZs4c+qsiXIhgJ1AgwpN+HMogKIVkdpUCpPpTKYso0qdSrWq1YFHs9pz+jAr16EYvyIU
C5YiU7IW0aJViHQtSLc+u46l2Vbh1bt48+adWJdvWZdq/26EGxYi4a1zcR72e3Bx2sSCIwNtq7Xx
UbYMK2u9vLVy56JeG0O2DHpuaNJjL2vmjPqzT86rf8JWTRm059ivZWv+bFt36t69W7ferXTzbda4
2cJGzHs4c8+IT/9uLhw18tnYqUveXrNv9NFO65b//i6aKHPy58+XHo9etvnymOEXf09+fXn3osXT
nw/Zvf7n6gXo3X6mndWfgAQeuFx+BcJn3oDe4ZfeeBJWGKCD3GU4UU8XRiddevIB2B5pFqJHYoQF
brZfeAeCZ9p9IuqmIoO/sdaZgggC6JWFlMUVIos/hnYddP8JKGRqcUGo4IcU5jiiaHpFKeWUVoVI
o48ENllkiRJiaKWJEyqXYJg46gijgVeCKKZ+/9mXpZgtgtlhl0h+teWL9Fn2oIs/NqQlnk8iRuWg
hBYq0pcljpajmyOiGJ+ZTnYJJKJ5tkkjozyOuSeDljYKKJ9OxplooJECSmeYSvbp4J9XJvqTobDG
/8oSYxdCV6NzOh6nWpxELejhkNPdaOuNrikXXIzIFttXcsGyuVuMvtpWLHi+9lprdtXhSqK2to4q
bGLdwqgsuN5qaK5DHOrkmGNqnisUu+7GC5Ss9NY7UobrFiYvWPDu6++/AAcs8MAEF2zwwfKmi3BD
9jbs8MMQRyzxxBQTFFa/WC6s8cYcd+zxY5nZmOejSQFbncgfp6zyyixzxNWAio4s0Z3LtmzzzTjn
zCyIwSUnHXF+lopxzkQXbTROKBWpqKRlNmqnqr86VfHUVFdt9dVYV6w0hkxDLeOumTXtbdZkl202
VSGcrTaVEW3NM5lCkwxqpl4ebffdePP7aYv8xXGdJtem1pr34IQXrlFPz+bWq7TK6urljsI5Xt7a
lFdu+eWYz2r45px3PrjCH2cu+uikly7xHId6rvrqrKts+uuwxy777LTXbvvtuOeu++689+7773q1
LvzwxBdv/PHIJ6/88sw37/zz0Ecv/fTUVw9UQAAh+QQAJABhACwAAFQB+AEjAAcI/wDtCRxIsKDB
gwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjwj/iRxJsqTJkyhTqlzJsqXLlzBjypxJs6bNmzhz
6tzJs6fPnyhBCh1KtKjRo0iTKl3KtKlCntmASp1KtarVq1izat3KtavXr2DDih1LtqzZs2jTql3L
tq3bt3Djyp1Lt67duk7z6t3Lt6/fv4ADJ7xLuLDhw4jtCl7MuLHjx5Ajc+wkubLly5gza97MubPn
z6BDix5NurTp05oTq17NurVrqahjy55Nu7bt27hz697Nu7fv38CDCx9OvLjx48iTK1/OvDlwlgf5
Oef7urr16wL5Sc8ecTtB7eAtev8fCH68U+3kvZe3V948+/AUr8ufH9cheu4Q3bunqJ/83vvv4VfQ
fvtNZ+CBCG2nIHzvKegfg+wZBJ90C6qHHoTqpWdhhQJSGGGD2QGIYYQeFtifhPeVCCGCLNoGnYMf
kvjgjAOul2GKNAroH343fpcjhTB2GKOPJQ7p44ASPhikefQ16SRaDcHYI3dTHrmjjCGGJyKKItqY
IZU/fudlkh96CKKOaMZoppottlkbS+2tKSebJ145J4pGlnmlmHSGuWd6Rzo43pdW2skmmk8mquhX
DA3aJ5iQFvrooZEaSimWmN4p5J7mLfknmlV+WaCbpHoGJ5EMpjqhozUGeaaqhXJxeOasNoop64qd
akhoq7fquuOiwAZrVal8jUrssci2aGyyzF4GXbPQjiasWtFWa+212F4EQEHbHtStRt8iFG5j43qb
rV8sAaCuuhaVu265TLErkLz2vFuvvdyuixG82nJbr0H8zhtRwAJDNq67Qk2bVkAAIfkEACQAYQAs
AAB2AfgBIwAHCP8A/wkcSFAggIMH7SlcyLChQ3sAHCKM+LCixYsYFyZUuBEiQo8fG07MmJEiyZMQ
RaZUadHkSZcPYaKcSbMlS4Yya1osyLOnz59AgwodSrSo0aNBS+qMKVHj0qcxTW7MSRWq1Zc3szad
mRPn1a8ku3oFS7as2bNoycoMGZFiSJBwnXLU2JHtVKdtOU6t2zFl3rxMtep16/ftVsNx6d6dO9Lv
YMdzFUN+25gyYrtuE+7lm3nxysOM2T5ujHMxYdKI06pezbrsRMCFI0OWLXel1M+fYbclXBu217+4
xwrv7VF2V9+BjedeDhxv7dxrmTun7fI2b90qrT8fe9p59efabUv/b02+vHmdMMOD1HxbpOWPdafP
rj6yb+TuiaPfxE77N1XD6mHX3H3BtTeYgPWBJxxg+NkGn1zI/eaYdt9R592EeIl13oYckpeefP8F
J15/eo0333B0ccfYgluxaOBxKRJHXIAYQligjCd+aOGMBNLYXoQXCoibgdIB96KGHSapJElC6Xii
hfqNOKSJ/CmnoIpWakUjgcNVOOWKYGLoZZQvUrnclZOFKWSWIv54IY5numkhUnQKxUOdeOap5548
reVZXJZ1+Vh+nPmG2aDbSUVZRZV5hlp29q1XWqGSTqbZdiXSt1lniqW3GZe7UVompnJaWiWipYaq
EJ+sturqq7D+/7PkrKwhuZStNOFKq64o8qpkrMAGK+ywstJq7Fm+opSsUsdetKyXzT5E7LTUVmtU
tNhmq+223O5k7bfghltst+SWa+65q4mr7rp4mrWssuhF+25Ys847b4v1PovuvucJlSuzNb17L8DJ
9YqRhkSWlFrBNsU7Ka4Ju/cUr75G3BC7GGfsr2uqCdxxwIJxhWnD8BIs8sjOolxiaxWrzO/L54l2
36U/0gxhpI3y5uB1m46maGecvlnfoYkVZh9874WMGacM/gnoe9AOah17OM+8m2Q1Eo21aJpWWjTM
YKPlps45SqimiyAWmfZ1Zvp59pbZoQl3m2vHaHZTcwNaN5sjsv89dZhZlXk0jySGbXhGTT4KZYY2
Aj3mevi9VjaYpyUIuHI+2p02jqH25eeDZ3daIOhP4r33mTb2DbmJB7J4OeqdR6Tx7LQXVdXixjEo
5X50kz15mrNh3uKawRe3eZZA0o028l/+DmPmbL6me/HqoQ678qzbU/v23PfZOO5Tjtp8lYK33ePp
hP+uIJHl9+ck8e0LH7rpb8P5nd/os58+58t173+4YXHUaFonsyHhTGsG5BnQQCW1m7nOcg762qmK
U7P/fCpOhiIdAW/muaS1joJoAl7QKvhB6jgtUxw8nApRsrEVoshDLozhvv5Hw2rJsGQeitQNd8jD
Hvrwh0AMohD/h4itFhLxiEhMollq+L8X0mtJnsOhw9IyMKwEUYfNSl6/mNg9J5qMYwfDV3JgVLgy
gsVWVawih/RFxagsLG5aJA8XxXWyf7UxjCFznRgZtRo1fpFcbETW7UTmRyVmkWgk3NkHkbY1BD5N
Uz/z2dFoxp4Scs09CywhXO6CGk42UII9wyQmIxdKvakqYY4s4Aix50VGiklqqUla0yJpyJo06XRC
gl6DiLc/+ZXucfh7m1jgh6UBIch0g5yg3IwHvdhcr5fmCw3DNKk6I5mJKfTx5cXmuL2pXXJ1xPQb
BCNUPV+Sb3m7BKcbiZk6Y6pTdFfjHSoBdDwEke5+8hwe5SCYwMcrdcea89tgb4YmLW5+C2Dk3J3z
qpnPhi7vl+is3wubWaF/yod5inro49LXzOjd6HVjcx8fU9bOV86tehbDYi2hArfy6VKixcteNK0X
nnSWc6YVXRFFLwrMZXIUl9bDXkKZ97od6U881jwpT+1nxpVuEyiVoufWYGkaq1lpkr7zWqDmKUKt
nlBSFcxpjRSZwL8cUGee6uCfljZVu1mwcFL9pChzpyOLzpJvOUsgqlZlUNrd0am1pNitALvEvlYr
IAAh+QQAJABhACwAAJgB+AEjAAcI/wD/CRxIUKC9gwgTKlzIMCGAhhAjSpxIsaLFixgzatzY8GFF
jxlBchxJsqRJhgVTqlzJsqXLlzBjujwZkqbNmzhz6qQoUmJPiz93Ch1KtKjRo0iTKl3KtKnTp1Cj
6pRJtarVq1izat3KtavXr2DDih1LtqzZs2jTql3Ltq3bt3Djyp1Lt67du3jz6t3Lt6/fv4ADCx5M
uLDhw4hhSkjMuLHjx5AjS55M2azUy5gza97MubPnz6BDix5NurTpkZVTq17NurXr17Bjy55Nu7bt
27hz697Nu/fc08CDCx9OWhPx48iTK1/O/Ljv59Cj325Ovbr169gtSt/OvTvl7ODDi/8fH9y7+fPo
06tfz769+/djL8HfTr6+/fv48+vfz7+///8ABihgZ/MVaOCBMQ2o4IIMNujggxBGSNNLElbIEYLt
TaTAhhvaw2GHHyLU4UEjkijiiRx6mJACDIUoYokepvghiyeiuOKLILq4Yook0hgjiyXSqGOPOfIY
I44+zvjjkSYS6SOTUBoZ5I9PRlljlRZmmRGWKjbZZZBPJnmll10qJGaZQra4UJhlfmkmRFzCKKSY
XLZZ44t3snnlmXWC6eWcNpI5ZZN1aqnlS3HmaSKQbZ7pZqNqLvpmom8GKmmla0bKp5t9RkronzeO
mWahjJY6Kaehpnlplxi2+o+SoH4wauqNsz5KpqJVzqnnjiGyieWQdn4qK6EwEhmqsI5CquKocC7r
LK2ojonmtPa4ql5AACH5BAAkAGEALAAAugH4ASMABwj/AP8JHEhQoIKDB+0pVKDQHsOFEBlKbBjR
oUWIFzFSzDiR4kOEHjc6RJjwYcWNJFGKvGjyI8uFCVHG1PiSY8iGLnOurDjRJM+TGF0CfViwqNGj
SJMqXcq0qdOnUKNKnUq1qlKfOHGCDErTYs+sGcNqjYm1LNibQL3C7CjyI1mNQtl2Pesz7tazNb+O
rMvVrE6+NWkStUq4sOHDiBMrTrwTLVqheVXqDSy2q9nHbUPy3bxzM8m4aSvDHQsSsuC+YQHr1Pwz
6+eWjhvLnk27tu3buHPr3s27t+/ftLGO5hrbJljAKpNXhq1c7XHXjWGrhns58/ChjiG/PX2TeUu2
ppkD/x9Pvrz58+jTq18p3Hho4eJLy58p+m5KvNzvr5Won3TqvRzxR99eyHFG11gB+offd/EJKJ57
oq0n4YQUVmghcEtdqOGGHHbooT2LhSjiiCSWaCJBH6ao4oostujiizDGKOOMNNZo44045qjjjjz2
6OOPQAbpYntCFmnkkUgmuV5/AMIE3Wcefdfkff1B6ZlbAxL4n5NcBlgSkyMpqKVMDtal310HroWX
g22hGeZ+MolZnJJ01hldmixJh9+bb5oW4XWRddaclF36SWShz82F3KALJkoZeMqZiSefD85l56WY
GvikZZnpZahsD4LGnnXErSaXpaWy1uiegIrVkV+quv+aZnipKorprbhq2lp1m2o3k5vUUYlgca+l
ulqUWYqaFq9EVgqrrJpW511+xC2H67V26urcqfDVGlu31DIqrqiTseqtc5ya6yypz0YEbJXVBgrm
n9jW66O2r8qanLKrYubomqR6ZWVrcxJYUqz6orpupJKpCi6DpWk2cH32VlxkfI4OCO6/6fobb8en
RfvpqNBVu3GEBZI8XLQM/zdtyfRaLDOPTNqnVXOczodle6ECOG9KuoIHscHZjWn0sCiTKSiyyNIK
8JU9LxrzzFRXbfXVWGfNY4Zad03jiWCHLfbYJHpt9tlop6322my3rSPXbsdtG9l012333YoFh+ev
Z0b/vCbQgPN9M2lsRikmlEojOjilgrurMcaJ+4d4k2NaCaxllcqt+YWQ88kdwKxC3rjHkq58Z1Ch
EuqdnoJ1fh3P/rI+aZcJb257haJ/frLUr/+0ce4uL71p8OWqdWyg6OYsfLvchr7nobdHb95XL7dq
sJk2m168ey9DjbOnrBUP/nQ28Zq8x47vbL2XmUvv/txKGW9cyuJaOvS5wZKvbaPHg/Zsufw62flm
B6myXI57GMGbAhfIwAYWpDbU28+vnlc0dpnOWiabWGj4tyzUOCx5Zcpcu1oGs+Yl7YLvSyH8ktK7
STFrTsCjIArR5afYLU5f1TtYvNrnOtAFxoQUa5UDUodIxCIqsIWtAloFSXi+3yGscESLHKE6lr0w
nQl9TGvagvhGFiVukUFgMaIYx0hGEanQdmVMoxrX+MAzuvGNcIyjHOf4Rjba8Y54zKMe94iYgAAA
IfkEACQAYQAsAADcAfgBIwAHCP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48g
Q4ocSbKkyZMoU6pcyVKivZcwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypdyrRmy6dQo0qd
SrWq1atQ5WHdyrWr169gw4odS7as2bNoV7JKy7at27dw48qdS7eu3bsPm+rdy7ev37+AAwseTLiw
4cOIEytezLix48dA8UqeTLkyXciYM2vezLmz576WQ4seTbq06dOoU+P9zLq169ewYw9WTbu27du4
c+veTdUN79/Ag/+WTby48ePIYwtfzry58+fQo0ufTr269evYs09Pzr279+/g9Wo+H09+e/jz6NOr
X8++vfv38BeXn09fePz7+PPr38+/v///4tUn4IAEFmjggQgmqCCBADbo4IMQRijhhBQaFhAAIfkE
AMDqYQAsAAD+AfgBIwAHCP8A7QkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx48I/4kc
SbKkyZMoU6pcybKly5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypdylQmyKdQo0qdSrWq
1atYs2pV2LSr169gw4odS7Zsyq1o06pdy7at27dw48qdS7eu3bt48+rdy7ev37+AAwseTLiw4cOI
EytezLix48eQI0uenNCs5cuYM2vezLmz58+gQ4seTbq06dOoU6suTbm169ewY8ueTbu27du4c+ve
zbu379/Agwsf7vjzi9XIkytfzry58+fQoyMlTr26dazSs2vfzr279+/gwzc8v06+vHmN4tOrX8+e
5Pn38OPLn0+/vv37+Km338+/v///AAYoYFP5FWjggQgmqOCCDDaI4IAQRihhWAEBACH5BAAfAGEA
LAAAAAD4ASgCBwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePCP+JHEmypMmT
KFOqXMmypcuXMGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUJ2yiUq1qtWrWLNq
3bqTjVeuYMOKhQqyrNmzaNMu9MpGrdu3cOPKfTu2rl2gX+/q3cu3r9+/XfMCHky4sOHDWQUjXsyY
6NzHkCNLnky5suXLmDNr3sy5s+fPoEOLHk26tOnTchurXs26teuRqGPLnk279unXuHPr3s27t+/f
wHvbHk68uPHjyJMr12hlufPnA4NLn069ekro2LNr347Zuvfv4MOL/x9PvjxW7ujTq1/fMegM8/Dj
y6fJvr79+/gJzt/Pv7///wAGGFZ+BBZooHMCJqjggiYd6OCDEKLG4IQU/hfhhRhm2F2FHHbo4Yf9
QQMNiCSWCJyIJr6m4YqSicjiizDG6BE0MtZo44045qjjjjz26OOPQCaX4pBEshbkkUjWV+SSTDbp
5JNQRinllE8laeWV2VGp5ZZNYenll2CGKeaYZJZpZmlcpqmmY5GZc+abcMYp55xzrWnnnbpVgeee
fPbpJ4V0BipoWX8WauihiCaq6KJpDuroo5BGKqlbjFZq6aWYZqrpppx26mmVk4Yq6qiklmrqqaim
qqqYn7bq4aqwvv/p6qyAxmrrrbjmeiCtvPbq66/AlphMsMQWS6SuyCar7LJCsoSLsdBGK+201Fa7
G7PYZqvttpxZ6+234IYr7rhacWsui+Smu9i57Lbr7rsX9fesuojCa++9+N5L77789ltkvgAHLPDA
BBdsMGkAHKwwcQkvTJu6APgrsV0RT7yXwg07PFu6FVvssVYdf1wXxhqXbPLJKKes8sqQiezyyzBb
x/LMNNds880458xuzDz37PPPQAuo89CUBm300UiLRfTSZ3WIRNJQR80l01R/JPXVM1Wt9dZcU4b1
1y91LfZEYJdt9tlop6322vSN7bZDbMct99Vv173Q3HjnDbTdfPf/7bdCegcu+OCET/v334Unfbjf
iTfu+OOQK7r45JRXbvnlmJcc+c+Zd+65ypuHLvropP/7+emop6766qy37vquvFpQ+lCv5zy7y7Xj
fLvIud+8+8crAtL78MR71pc+vyevPG/FR5ZxqstH31sX0ldv/fXUNq/99tx3jx/26nov/vhngm/+
+R2Sr/767LcPGvrwxy+0+wXLb//98tGv//789w8S/tXynwAH6CAAGvCACEygAhfIwAY68IF7IqC+
IEjBCvJFgvayoAY3OCAMehAiUvigCEdIwkFxsFUlNNcJP5XCFrrwhTCMoQxnqJ8V2vCGOMyhDhlD
w2Tt8IdA3EkP/5EVxEoNUVdFZNQRl8jEJjrxibdJohSnuBIoWvGKWMyiFgkFnz9QsVxbJNUXx0jG
MJrxjGhMoxrXyMY2uvGN7SOjHOdIxzreDgJJgaMe98jHPvbOjoAMpCBN5Mc4DfKQiExkgAr5IB4w
8pGQjKQkJ0k5VZxKkVuiJKswSSVNhomToAylKEcJNk+CiZSoTKUqEWPKgW2jlbBc2CqXFMsrzdJ0
tUTSLXf5u1z68nW8TNEvh0nMYhrzmOwLpjKXyUylIPOZlWumNBsHzWpas5rTTN81t8nNbnrzm+AM
pzi/RItxmvOcrMsmh9B5IXW6853wRKUG4tlLdkKIngqy5z3xyf/PUuqzgP0E0D8Baq1NBPSBzADP
QGF30P4s1EANjajEdCHRilp0lw8t0EXzl9H8bDQ+HQ2pSD/40ZKadIojTalK57KElbr0pTDt0UnJ
E1PuzPSm9KrpdnDK05769Kcw0al2gEpUaQk1S0WVzlGxEzVqJPWpUI2qVJG2VOhMNSg0AEtVt4qq
qzKPq8rx6rXAStZQiVU3ZUXOWXOT1uOs9a1GbGtx4Ooauc6VrnjNa9rsyte+2k6vjSnOPPxK2CgC
dl2FTewnD4tYxRqWsYZxrEtnIdnKWvaykoUs0CRRVGJo9rO+wexoQEva0lpMtKKR0ihMy1jUhoa1
f3GtbGeLRNj/9oW2pYkCbnfLW0jZ9rfADWBvNxTc4tZquMjVqHFHltzmOndUl3iudKero+VaN5/U
za52g3Td+Hmxu+ANr3jHe5Xtmnc5QwJAyMj7FPWylyrufS9U4itfp9C3vky5L36Vol9mYsQG91Hv
M/dL4OCcFy4FTrBwDsxg4ij4wWxtcFogTOHWSHjCLGlGhYWYFiMweMMgDjF/LowWERdFdcogsYox
aOIWu/jFMCZKf2NckxnTWCbqXe+NZ2LjHcOkx9qMZI5PKUog+9glOsblij1y5CY7+clQttCSrRbl
Klv5yoeZspY/g+UuB2XL7fGymMdM5jLbBcwc4ZkvQofmjQQEACH5BAAfAGEALAAAAAD4ASgCBwj/
AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIENiXCeypMmTKFOqXMmypcuXMGPK
nEmzps2bOHPq3Mmzp8+fQFH+G0q0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1q9evYJMGHUu2
rNmzaNOqXcu2rdu3JcPKnUu3rt27ePPq3cu3r9+/gAMLHky4sOHDVOEqXsy4sePHkCNLnky5suXL
mDObRcy5s+fPoEOLrqu5tOnTqDGOXs26tevXsPemnk27tu3buHOnTqW7t+/fwIMLH078dOzjyJMr
X868ufPn0KNLr1q8uvXrIqdr3869u/fv4MOL/x9Pvrz58+jT642mvr379/Djy59Pv779+/g7Y9/P
v7///wAGSFF+BBZo4IEIJqggcwI26KBmZTwo4YQUVmjhhRhmqOGGHHbooXALhijiiCSWaOKJKKao
YokftujiizDGKOOMNNZo44043rTijjzGl+OPQAYp5JAv9WjkkUgmqeSSTDbp5JNQRiklXURWaeWV
WGaZ0JRcdunll2Cmp+WYQ4Zp5plopqnmmmy2GR2ZcMYp55x01mlnb27mqeeefPap1J2ABirooIQW
auihiI7p56JtJuqoZSiAxOiklFY6lwCWZqrpppx26ulcj4Z63aekHinqqcSVquqOqLYK3Kqwxv8q
66y01mrrrbi25+quuuXq66/ABusUr8TaJuyxYhar7LLMNuvss9BGK+2HnUxrGrLYZqvtttx26+23
4IYr7lHWlmvuueimq+647Lbr7rvwxivvvPTW+526+OarL4D29ivYvgAHLPDABP/o78EIJ8xdwQw3
7PBBwSim8MR2PWzxxRhnrHFqFHcs18YghywyTB6XbPLJh42s8sost+zyyzC7hPLMVsVs880206yz
VDj37PPPQActNLo7Fz3sjbYMrfTStpHDNK9GRy311FRXbfXVTT29MdZSa+31185yHTXYF4tt9tlo
p6322riSbTHbcMcNrtt01/2o3HjnjazdDOv/7fffgI/oT+Bc8W344YgnrvjiaRHu+OOQRy755JRX
brm/jOt7uVYAAEBr5h11DgCim3vV+aqghyT6oKXL5XnrsMcue1iprzu7t7Wnezvuuffu++/Al7V7
t8FPWx4Vw+dXfGZOLO+8pMlHL72Bzz87/fXY01f99twPl72w3RNZQfjkl2/++SZ9Hyz6rqrv/vt9
DQH//PSvyH6r9eev/3L39+9/Y/sLoAAHeLX/hYqACExgygzoKAU68IEQjKAE38TARE1QUxXMoAaD
csFMbdBQHQyhCEdIwhKa8IQoTKEKV8jCFroQKh+MoQxnSMMaZuaFOHSgDe+UwzRJhg07xEwP/4co
wCDWiYhITKISCWREOi3RS02c0xO7FMUqWvGKFpyiFqWHRe71oYsr2aKUwJglMUaJjGj82iSEZ8Yn
pdFKbXTjG4n0FyPE8Y4nm6Me98jHPvrxj4A0HB4HWblAGvJ/hEykIhfJSFUd8pGQjCT6biDJSlqS
ZY3MpCY3+ZVLuoiTKvJki0CZIlGa0nekVI85unLKVvZODq70XQ5iCTRm2LJvgLOlLeuFOF0yQ3OT
22Uqh0jLYh5umF06BjKXycxmOjM8xoymNKcplGcqiJoTsqY2TYbNaHGimzbZJoLASc6gifOc6Eyn
OkOUjnWCpibpKOdbCNNOd9KnnvbUz0ziKf/P//Czn2wZDD7ziZiPuAOgNySoQheqQIQ69KHSZKiP
GNcEfGUyF6yCKHYkytGO0k+jG/WoSEdKUoWCdFQlTalKV8rSlrr0SyeNqUwf+VLwzPSmBaupTnfK
0ySiEZZV6ul2cErUohr1qDURqlKX2jWk9oqp0HGqVK0F1ahO9apYRWRVt2qmrNaGq83xqljH2j2w
mvWs9CIratDK1rZCUApujStY1ErXutr1oXLNa4/uyte+ClKvgA2sYMWWGQ349bCRGaxiRYRYyixW
p984oyS/0djIUPZFU4zsGCvL2c6yjBGeDa1ob/bYz4z2tKhN7dIYoFp+lRZWgXitWVtLWxjbyfa2
96ltQHHL296iSbdr8S1hgEvc4kZLuE5yg0o144a6kke5yAUMdEvKXOOapbl0ja52y2PdzWzXL90N
r3jHq5kdlOm7fSEvUNCLFQhstQjnUe9P2EuiWND3vvjNi3x9kt/+hnW/AA4wnPxbMQEb+MB0JDCV
EBxOBYOKwRD+qoMn3JoI04TCGM7weCw8Ew17hcMgLo2HR+ynVJwzxCi+DIm3kuIWT2bFMP6Xi2fc
klmeJMZYobFKcHwVHfsYLjyu2Y+HHNwgJ4bISD6LkY+c5CY7+clQjrKUnxUQACH5BAAfAGEALAAA
AAD4ASgCBwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePCO2JHEmypMmTKFOq
XMmypcuXMGPKnEmzps2bOHPq3Mmzp8+fKEEKHUq0qNGjSJMqXcq0qUKgUKNKnUq1qtWrWLNq3cq1
q9evYMOKHUu27EynaNOqXcu2rdu3cBOanUu3rt27ePPq3cu3r9+/gAMHjUu4sOHDiBMrXsy4sePH
kCNLnky5suXLmDNr3sy5s+fPoEOLHk26tOnTqFOrZiq4tevXsGPLnk27tu3buHPr3s27t+3VwIML
Hz7Rt/HjyJODJc68ufPn0KOPriW9uvXriZlg3869O1wm2r2X/1ZOvrxL8ExSWjPPvr179+jfsxdP
nzL4+pvl65cPfv9x/AAGKOCABBZo4IEIJqigRP416OCDEEYo4YQU7rTghRhWV+GGHHbo4YcghvhX
hiSWOJyIKKao4oostujiizDGKOOMNNb4m4k45qjjjjz26OOPQAYp5JBEGmTjkUgaV+SSTKqV5JNQ
3tjklFRWaeWVWGap5ZZcdunll2A6F+WYZLYW5plonqaMjw+k6eabcMYp55x01mnnnXgGWeaefOqV
558k9inooIQWauihiCZKI6CMLqjoo5Ba2OikBkZq6aUyUarpppx26umnWWIq6qgpgWrqqaimquqq
rLbq6quwxv8q66y01mrrrfWRquuuvPbq66/A8onrY+ENa+yxyCbraLDMEqrss9BG212z1PYp7bVt
Vavtttx2qx+24IYrrmnelrvouOgeZe66MKbr7rvwxivvvPTWa++9+Oar77789usvmuwGLPDABNcF
GSP/JqxwnQU37PDDEEcscZILV2zxxRhnrPHGHHfs8ccghyxycxOX/O3I6Jqscnsop7zyyzDHLPPM
NNds880451xSyzz37PPPQAd9ms5EF230kUJHe/TSTDft9NNQRy110tBKbfXVWCtJtbJZd+31169t
3R0B0oFt9tlkWoL22syKnSzbcMctd1VuIzv33Xjnrffekjr/ZU3dAPMt+OCEz+RH4VADbizieSs+
LON4O44r5HdLbvnlOFKu+eZTYz4r56BHOk3odHlu+umo15kMk6S37vrrKqODDtscy576q7a/6/rs
X9/uKuxS8QD88MQXH6LvrRp/NfKsKu/889oyvyr01Fffq/SqWt809qlq7/33j3KPKvjkl2/++ein
L/767Lfv/vvwxy///PTnmr7N9Td6P/759+///wAMoACFtr+aDZBhBZyZdcZxwAbqK4EQjKAEJ0hB
rDnwghjESAVVlsEOevCDgNqgyUBIwhKa8IQlFGHJUNglFbrwhclhoQwdCEOIzVBLNcyhDqV0Qyvt
sGA9xNIP/xMljiE+LYhXMqISl+gnJFaJietyohTlB0VzTfGKJrJE4KrIxS568YtgDGPosMg6MZrx
jDoh45LQGCw1FomNwHKjHOdIR3LB0Vdo6oYH74jHOv6Ij9fzo48ASchCjkSQiEykIhf5O0OaxR+O
dJ7lzFGrSIqKkZjMpCbRYklMbfKTIuvkpUDZGT2yRZR5a0ZVPIBKqZDylRxrJaRgScta2vIpslTU
LSuVy0TtskC9DOYQf0kgYR6KmAMypqFuyAUhKvOZKkSmNO0FzUExbwbTzKY241LNbk5wm/TxprDA
6R1xmvOc6JwNOcuZzna68514OdAh1knPE8ETafXEzj3xmf9P6+zzn8Xr53Vmo0qAGvSgXhSoPxHa
LoU69KEQjahEEcTQim5uoiRDFBdyidGOehR5Fg2pSEdqko+alDDYyBxJV8rSg54UOC2NqUxnStOa
2hSNLxXkJVKThJz69KdAxeVNKRRUOw51QkUdz1GX6rSkkoapUF2aU6dK1YtFFUIlQkQmr/qgqoKG
q2C9mVfH2sKwmlVmZO3MWdfK1hemlTNtdc9b5/pEJUIhilwCBF2LGte+2nCvgCWSX80T2MLqabCI
FZhhKZPYxjqWeouNrGRl9dj/VMkHQVSUDyprnM1yljeeFeWVMHtDSIX2s6hdyWQhk9rdrPYxrY2t
bAUXpJ7qynG2uOWLAwj72sbktja9Da5wh6uw3xr3uF4jbmKQy9zmHlG50LWfcwUTXcNM97rYFWt1
CZNdwPwDBNuFS3dHFF7xjrd6/zhfec173r2s973wja98F9be+tqXYPN10n33K6L8+jc1/L3Lf50S
4AIbOI4DZs2BzZJgBS/4wQ5qsIQ/A2GyTDgpqWUDGyrcFQ1rmMNc+bBvLkziEpv4xChO8VEcUUkQ
u/jFZVKxjOd3gRnbGH4wzrGOd8zj5974x2/pcVaArBEhY6Ujq4MLL5bM5Cbz4qRGjjJtiEzlKjNW
ylSxspa3vBgsUyUgADs=
------=_NextPart_000_000C_01C6F15B.314DAD50--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GKfKDM011188; Mon, 16 Oct 2006 13:41:20 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9GKfKhv011187; Mon, 16 Oct 2006 13:41:20 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp2.nist.gov [129.6.16.227]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GKfJFJ011181 for ; Mon, 16 Oct 2006 13:41:20 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k9GKf3ST001367 for ; Mon, 16 Oct 2006 16:41:04 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k9GKe7wQ014001 for ; Mon, 16 Oct 2006 16:40:07 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Mon, 16 Oct 2006 16:41:40 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: pkix
Subject: draft-ietf-pkix-rfc3280bis-05.txt
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

All,

I have just submitted draft -05 of 3280bis for posting. As usual, a
diff file highlighting the changes between draft -04 and draft -05 is
available at
http://csrc.nist.gov/pki/documents/PKIX/draft3280bis-04todraft3280bis-05_diff.html.

I will be out of the office, and not reading email, for the next two
weeks. I will read any comments submitted on this draft when I return.

The following is a summary of the changes in this draft:

1) Section 4.2.1.10 (name constraints) now states that conforming
implementations SHOULD NOT impose name constraints on the x400Address,
ediPartyName, or registeredID name forms. Draft -04 said "MUST NOT"

2) Section 4.2.1.10 (name constraints) now states that conforming
implementations MUST NOT issue certificates where name constraints is an
empty sequence.

3) The descriptions associated with HTTP and FTP URIs have been modified
in sections 4.2.1.13 (CRL Distribution Points), 4.2.2.1 (Authority
Information Access), 4.2.2.2 (Subject Information Access), and 5.2.7
(Authority Information Access).

4) Section 5.2.5 (Issuing Distribution Point) now states that
conforming implementations MUST NOT issue CRLs where the DER encoding of
issuing distribution point is an empty sequence.

5) Section 6.1.1 (Inputs) now includes initial-permitted-subtrees and
initial-excluded-subtrees. There is also a new paragraph at the end of
section 6.1.1 state indicates that conforming implementations are not
required to support all of the inputs (e.g., a conforming implementation
could be designed to always initialize permitted_subtrees and
excluded_subtrees in such a way that no initial constraints are imposed
on names). The descriptions for the initialization of
permitted_subtrees and excluded_subtrees were changed in section 6.1.2
to account for the two new inputs.

6) Section 6.2 now uses setting an initial path length constraint as an
example of a possible extension to the path validation algorithm.
Previous drafts used setting initial name constraints as an example.

7) Section 8: References were updated as appropriate.

8) Comments were added to the ASN.1 in Appendix A.1 and a new paragraph
was added to Appendix B (ASN.1 Notes) to clarify which attributes are of
type DirectoryString.

Dave

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GCbxlT063377; Mon, 16 Oct 2006 05:37:59 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9GCbxb0063376; Mon, 16 Oct 2006 05:37:59 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail-eur1.microsoft.com (mail-eur1.microsoft.com [213.199.128.139]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9GCbvmV063367 for ; Mon, 16 Oct 2006 05:37:58 -0700 (MST) (envelope-from [email-masked])
Received: from EUR-MSG-11.europe.corp.microsoft.com ([65.53.193.180]) by mail-eur1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 16 Oct 2006 13:37:54 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6F11F.C1C7E33C"
Subject: Certificates in CRL dtaft submitted
Date: Mon, 16 Oct 2006 13:36:49 +0100
Message-ID:
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Certificates in CRL dtaft submitted
Thread-Index: AcbxH8BNZ1E7L8RSR1Si6fzZlVwWpw==
From: "Stefan Santesson"
To:
X-OriginalArrivalTime: 16 Oct 2006 12:37:54.0762 (UTC) FILETIME=[E6F342A0:01C6F11F]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6F11F.C1C7E33C
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

As, concluded in past discussions I have submitted an individual draft
for certificates in CRLs, outlining the new extension as well as
providing motivation for its use.

Since it takes some time before the draft is posted by the I-D admin, I
have included the draft in the pkix proceedings for the San Diego
meeting.

=20

The draft is available from :

http://www3.ietf.org/proceedings/06nov/slides/pkix-0.txt
=20

=20

I would like to discuss adoption of this as a work group document in San
Diego.

=20

Stefan Santesson

Senior Program Manager

Windows Security, Standards

------_=_NextPart_001_01C6F11F.C1C7E33C
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

As, concluded in past =
discussions I have
submitted an individual draft for certificates in CRLs, outlining the =
new
extension as well as providing motivation for its =
use.

Since it takes some time before =
the draft
is posted by the I-D admin, I have included the draft in the pkix =
proceedings
for the San Diego meeting.

The draft is available from =
:

http://www3.ietf.org/proceedings/06nov/slides/pkix-0.txt

I would like to discuss adoption =
of this as
a work group document in San Diego.

Stefan Santesson

Senior Program Manager

Windows Security, =
Standards

------_=_NextPart_001_01C6F11F.C1C7E33C--

Received: from [81.172.80.64] ([81.172.80.64]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9G8BF2Y029809 for ; Mon, 16 Oct 2006 01:11:20 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000701c6f0fa$a29853e0$4050ac51@rubien>
From: "To"
To: [email-masked]
Subject: groups sportMore response
Date: Mon, 16 Oct 2006 10:11:08 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0003_01C6F10B.662123E0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0003_01C6F10B.662123E0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0004_01C6F10B.662123E0"

------=_NextPart_001_0004_01C6F10B.662123E0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Sefton Merseyside of skk Judo Champions brings World Class athletes is =
into schools local inspire am motivate young people take of part.
Champion ben or Huntdavis gave British boost today by opening in =
Doncaster in boathouse Free Tesco Bike event Everyday Cycling have =
joined am forces organise brand in programme five.
Free Tesco Bike event Everyday Cycling have am joined forces organise =
brand of programme five fun family events Kent or Manchester am Leeds =
Bath Action Zones or provide major deprived or evaluation shows am =
increases suggests formula of engaging groups sportmore!
Amp Media About in Your Region East Midlands London North West of South =
Yorkshire Where Feedback is Freedom of Derek is Mapp chair has been =
named as the new.
Bike event Everyday a Cycling have is joined forces in organise brand =
programme or five fun is family am events Kent Manchester Leeds Bath =
Action Zones provide major or deprived evaluation shows increases =
suggests formula.
Response Assessment framework announced Audit indicator Deadline changes =
October th Find out moremore Latest press releases Health combine unique =
park Sefton Merseyside skk Judo Champions!
Action Zones provide major is deprived or evaluation shows increases =
suggests formula engaging a groups sportmore response Assessment =
framework in announced Audit indicator Deadline changes October th Find =
out moremore Latest press releases Health.
Provide major deprived evaluation shows increases suggests formula =
engaging is groups sportmore response Assessment framework announced =
Audit indicator Deadline or changes October th Find am out moremore am =
Latest.
Mp rowing medallist Sporting Champion of ben Huntdavis is gave British =
boost in today by opening is Doncaster boathouse Free Tesco Bike event =
am Everyday Cycling of have joined of forces a organise brand is =
programme five fun is.
Site Home home or Text in Only in Change Contrast Printer of Friendly =
Help map az Index Contact us get Funding Active Resources News amp a =
Media or About in Your Region East.

------=_NextPart_001_0004_01C6F10B.662123E0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Sefton Merseyside of skk Judo Champions =
brings=20
World Class athletes is into schools local inspire am motivate young =
people take=20
of part.
Champion ben or Huntdavis gave British boost today by =
opening in=20
Doncaster in boathouse Free Tesco Bike event Everyday Cycling have =
joined am=20
forces organise brand in programme five.
Free Tesco Bike event =
Everyday=20
Cycling have am joined forces organise brand of programme five fun =
family events=20
Kent or Manchester am Leeds Bath Action Zones or provide major deprived =
or=20
evaluation shows am increases suggests formula of engaging groups=20
sportmore!
Amp Media About in Your Region East Midlands London North =
West of=20
South Yorkshire Where Feedback is Freedom of Derek is Mapp chair has =
been named=20
as the new.
Bike event Everyday a Cycling have is joined forces in =
organise=20
brand programme or five fun is family am events Kent Manchester Leeds =
Bath=20
Action Zones provide major or deprived evaluation shows increases =
suggests=20
formula.
Response Assessment framework announced Audit indicator =
Deadline=20
changes October th Find out moremore Latest press releases Health =
combine unique=20
park Sefton Merseyside skk Judo Champions!
Action Zones provide major =
is=20
deprived or evaluation shows increases suggests formula engaging a =
groups=20
sportmore response Assessment framework in announced Audit indicator =
Deadline=20
changes October th Find out moremore Latest press releases =
Health.
Provide=20
major deprived evaluation shows increases suggests formula engaging is =
groups=20
sportmore response Assessment framework announced Audit indicator =
Deadline or=20
changes October th Find am out moremore am Latest.
Mp rowing =
medallist=20
Sporting Champion of ben Huntdavis is gave British boost in today by =
opening is=20
Doncaster boathouse Free Tesco Bike event am Everyday Cycling of have =
joined of=20
forces a organise brand is programme five fun is.
Site Home home or =
Text in=20
Only in Change Contrast Printer of Friendly Help map az Index Contact us =
get=20
Funding Active Resources News amp a Media or About in Your Region=20
East.

------=_NextPart_001_0004_01C6F10B.662123E0--

------=_NextPart_000_0003_01C6F10B.662123E0
Content-Type: image/gif;
name="framework.gif"
Content-Transfer-Encoding: base64
Content-ID: <000201c6f0fa$a29853e0$4050ac51@rubien>

R0lGODlh4AEwAof2AAAAAIAAAACAAICAAAAAgIAAgACAgMDAwMDcwKbK8EAgAGAgAIAgAKAgAMAg
AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA
AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA
AKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAAQIAAQKAAQMAAQOAA
QAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBAQMBAQOBAQABgQCBgQEBg
QGBgQIBgBKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCAQACgQCCgQECgQGCgQICgQKCg
QMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDgQEDgQGDgQIDgQKDgQMDgQODgQAAA
gCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAggIAggKAggMAggOAggABAgCBAgEBAgGBA
gIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBggMBggOBggACAgCCAgECAgGCAgICAgKCAgMCA
gOCAgACggCCggECggGCggICggKCggMCggOCggADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDg
gEDggGDggIDggKDggMDggODggAAAwCAAwEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAg
wKAgwMAgwOAgwABAwCBAwEBAwGBAwIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBg
wACAwCCAwECAwGCAwICAwKCAwMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDA
wGDAwIDAwKDAwP/78KCgpICAgP8AAAD/AP//AAAA//8A/wD//////yH5BAAcAKEALAAAAADgATAC
Bwj/AP8JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8eH9kKKHEmypMmTKFOqXMmypcuX
MGPKnEmzps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqbfmxqdOnUKNKnUq1qtWrWLNq3cq1q9evYMNy
XUq2rNmzaNOqXXtWrNu3cOPKnUuXI9u7ePPq3cu3r9+/gAMLHky4b93DiBMrXsy4sePHkCNLngyy
sOXLmDNrzku5M2UAoD2LHh1xs2nNoEGfXs26tevXsGPLnk27tu3buH9CyM27t++ypIMLH0788e/j
yJP7Ls68ufPnWpVLn069uvXr2LMDhc69u/fvFLWL/x9PPin48+jTfy/Pvr37nOrjy58v+r39+/hT
0t/Pv//h/AAGKOCABBZo4IEIJiiYfww26OBWCkaokgUSVmjhhRhmqOGGHHbooYEPhijiiB59aOKJ
ZJGo4oosOoTiizAO1eKMNNZo44045qjjjjx2FuOPQAYp5JAp9mjkkcwRqeSSTDbpJEpIRillfU9W
KeSUWGap5ZZcdunll2CGKeaYZJZp5plopomjlWz+qOabcDLU5px01mlnfnHmqeeefPbp559j3iko
hoAWKuagiEpo6KKMNuqog4lGiuCjlFZq6aWYZqrpppyCKemnBHYqqoiglgrgqKg2aOqqrLbq6quw
Av+Z6qz8xWrrrbjmqh+tvMan66+99SosesAWa+yxyCar7F3DNuvdsii9Ae2Czlbr3LTYZqvtttwq
a+23xXUr7rjklmsum+Cmq+667LbrrkbnxivvvLi9ay9j9Oar776b3esvYvwGLPDABBds8MHS/asw
Rjw8hXCy3XTz8MQsSUzxxSdFrNTCHDPUzVUYK6uxUR2XvNDHJqe8VcQqt4wVyg6HjO3IP7lsc0Ew
lyjzzjzLfPPPQAe9WM8hC230RkQnrTTBRzft9NMgL/0w1FRXJvXBVWe90NUIa+31QVyHLXa3X5c9
0Nhop6322naabTbbcMct99wmum333Xg3S0HeBQ3/gVGkINDt0hA48W2v3xkJbivh8BnOLuLwKu4q
45KLS7lZ/VTu5OWaa8u5To5D3fm4oZdeNhU2jy6u6U2rnqsEMLEu++zqus4t7UHbvq2loeA+lu7Z
+q4lH8PZBwDwtrEYmvDy5aca8rDVuDzzLad2nhDU2zh99iZvz33xCT4P/bLij0/t9+inD6j57Lcv
oPoduy///O3Bb//9PJISOf2/4v8v/wAMoAAHSEDTGKGACHyJ/xbIwC8lEFYNfNcDJ0hB00TQXRVk
1QU3yMEOevCDIAwhmE4gwvhl8IQoTKEKV8jCFrrQSSV01gsHFcMa2vCGOMyhDnfIwx768IdAzMoM
/wUVxCIakS4wcscQl4irIzrxiVCMohSnSMUqWrGHTMyiFrd4qyt68YsV4aIYfSKHMZrxjOOrBxpd
BcY2uvGNlAIgCtZIxzra8Y4xgeOe8MhHlAiijwR6Rh31SEg4AtJNhUykIhfpqUPCiJFpcuQjIUnJ
J0rykhOspCY3yclOevKTc9mb1TDpIVCa8pSohA4p65bKVnJwlR9ypSwjCMta8m+WU7KlLt2HSynt
8pfADKYwh2nLXkaJmMhMpjLlhYBlpnA3ijLmkZx5IGla85rYzCajqMnNbnrzm6zU5prAeSpxmvOc
6EynlsjJTp5ZKgtObCd+1ElPt8nznhSrpz69hv/PfmJtnwAVnT8HKrCAkmhIubDjmXLBUIM2qKGQ
RBFDEwrIL020kx1i6Cq3BFFQEvSjIL2kQ0eau5Bqh6QPmh8NioVSSJk0Oy1V1UtnSrqY2tSENK3O
TfuTU+vstFY9pY67mtDAoAr1p0iVoFETltSmOvWIS40qsp5K1aYooqrZk2pysMrVXmn1q7rq6nrA
uhyxmlVUZC3rWZ+T1rayca1wjatctenWutpVdXOljCMUcld5hSGZeQ1XXwdL2MLuMrDEMWxsEMvY
Pyk2eo0lzWNfE1nJTvayO9EEZrVV2dFsdjWdnchV42IgQnz2tKhFTmhXy9qjpVYzrZ3MazMTW8n/
zBYztY3MbXerodxChreF8a1xgDsY4TqGuMU1Lr6Qy9zmOhdtyo0ukp5L3eqWSrqKsa52t8vd7hJz
AN4NL1Gwmxjxmnc65E2velkbB+qdFy3rReJ750vf+tq3YPGdy303lt/++neb+w2wgAdM4Kn+98AM
KvB4ERwWBcuIwWDBjRscvF0IR5jC27GwhjccJgx7+MMgDvGQOPw7EZv4xK0hMYRQfBMVR4fFMAaO
i2ecpBjb2Dw0tsqNNVeKHfv4x0BWYY6HHJwgP3cLRr4NkZfM5BEl+cmFa7KUp7wfKKuEyk6xcm4S
oFgsexlgWj7Jl8es3zCbmSlkTrNbzszmNrtEEc37c7Oc50znOofEP7uIaUAAACH5BAAcAKEALAAA
AADgATACBwj/AO0JHEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePIEOKHEmypMmTKFOq
XMmypcuXMGPKnEmzps2bOHPq3MmzZ8d/QIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWLNq3cq1
qc+vYMOKHUs2Y9ezaNOqXcu2rdu3cOPGLUu3rt27eGfK3cu3r9+/gAMLHky4sOHDiBMrXow2r+PH
kCNLnky5suXLmDNr3sy580/GoEOLHk26dFfPqFOrXq3QtOvXsGPLRsy6tu3bmGfr3s27t+/fwF+z
C068uFTcyJMrX868ufPnD41Ln069uvXr2LNr3869u/fvixPy/4JOvrx5jODTq1/Pvr379/Ctnp9P
v77E+Pjz69/Pv7///wAGKCBp9hVo4IEIJihRAwo26OCDEJI14IRp7UOhbxFmqCFnF3bo4Ycghigi
bBuWaOJkI7pnSIostujiizDGKCOAJ9Zo44045qjjjjz2GFIvPgYpZE0zFmnkkUgm2d6QTDYZkpJQ
RumWk1RWiZ6UWGap5ZZcdunll8HZAuaYZJZppoxWpqlmdGe26eabcMYp55x01mnnnXjmqeeefPbp
53VrBiroiUAMauhnfyaq6KKMNurokYdGKumklFZq6aX0Parpppx2OhSmoIYq6qi3eWoqoKSmquqq
rOJ16qvTtf+a4yyCwmrrrbi2BwAAhsnq66/ABttSrsQWa+yxyP5jTbLMNiuasNBGK+201FZbn7PY
0mbttp5l6y1h3IYr7rijfmsuYOSmi+K57LbrrnHqxivvvE2+ay9b9Oar77789uvvvwCbxOu9BJ8V
8MEIJ1xbwQxvpfDDEEcs8cQUVzxkwxhnrPHGHHfs8W4Wh7zRxyQfJfLJKKesUskst+wyUSrHLPPM
NNds880kvazzzh7j7PPPQAct9NAP80wy0UgnjbDRTDdtr9IoOy311NlCfTLVWGddrNVcd+3112CH
faLWZJdtqthop92q2Wy37XZ+3bzdmNp012333QXKzS7eAOv/7fffcfIt+OBVAm744WMSrvjiPSLu
LOP5Ot4s5JRXfpk0liPtFDqSc5r556Ab2PnopJdu+muhp646eacTu/rrsMcue0Gt5zr77bhnVvvu
vAuY++/AB69277AKb/zxyA9N/KvJN+/881Evfzb01Fdvfd/Se3o9qNlrv/2l3Xf6Pfjhbzq+peWn
r751P0Nz/vscri///L/Bb//9+OevP5v09+8/6vsLoAAHSMACGvCAqWPLIv6HJAQ68IEQjKDdGEjB
CoZHghjMoAZZY8EOevCDDNvgjkB4JxHqKCqkIKEKV8hCRpkwRy38yxB890KcLGFdMcxhfuahwx76
8IdABE4N/4cIuSCWiYg1MqISg4jEJgpuiVDsoRNLFMUqWvGKWEwfTxDAxS52cYpgDOMAs5ilzwGA
XLUbGBmVpMY1IqmNxRMjhNxIR/rJ8Y54zKMe97i4Ovrxj4D0Dh8RFEgjDfJAhUwk7w4pOkXGiJGQ
jCQeHUnJ0m1EHpLMpLwqyUmq6MNpmjxPJ1sUylJWbJSoTKX/3qHKTUVjLaZkXStnWbs/0PKWGavY
JrqGy15KLZbQ8aUwh0nMYhpThXo4pjKX2TtgOvOZY2SmNEMIzeVM85rYpGM1t8nN8WXzm+AMpzh7
1c1yxmuc7DGnOtfJzna6853wjGc70bkeedrznvjMpz71Qv/PfvrznwCNyj4vE9CCGjR8A7XMQbWT
0IZOaqHZcahEDQXRilr0ohjNqLYmahJVmESj0uEoZEBKUjmJ9DElTambTuoYlQqRpTCNacRcWj+Z
WikYA6UphhS3qzNeDwmX6mlPbVoXoW5Lp70hKl2QypuU3UFzTNWNUqdqo6hKlapY3RAZRSClrHr1
q2DlpVVlE9aejJWsZd3JWdfK1qql9a1wjevVTJWNts5Srnh9jl336qK8+tWafA2sYL3318LaZrCh
MaxiOYhYxiz2JY2N7IAeS9nKjk2yibGsZgmK2c569rOgDa1oC7rZ0uJwtH8xrWpRilp0rfa1dmmt
a2H7JNm12va2VKEHbs1EW5Hs9rfADa5wJ9fb4hpXNcOd0nF7tIXlOve50I2udFeS3Lak6wjTzW40
19eJ6nqXbdqtyHfVEt6HEIEg402vetcrovJOhL1cce994Evfw8g3IvXNyn33+5H8YoW/DqkvDvxL
4KsCeCEFrsqBF8zgBq8swVNxsIT5B2GoTPjCCK6wQDE8EA17+MOF4bCIR0ziEtMOxF4Z8R+rASnn
uYNUKI6xjOei4hknhcQBAQAh+QQAIQChACwAAAAA4AE5AAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAj
SpxIsaLFixgzatzIsaPHjyBDihxJsqTJkyhTqlzJsqXLlzBjypxJs2bCfzhz6tzJs6fPn0CDCh1K
tKjRo0iTKl3KtKnTp1CjSp1KtajNq1izat3KtavXr2DDih1LtqzZs2jTql1bsarbt3Djyp1Lt67d
u3jxst3Lt6/fv4ADCx5MuGzew4gTK17MuLHjx5AjS55MubLly28La97MubPnz6BDi26JubRdKKZT
q17NurXrolBQv55Nu7bt23Vjy8bNu7fvnqO3xg5OvLhxvsOPK1/uECpzm7+jS3/8vLr169iza9/O
vbv378ehCv8Yb488QQHlC6Ifz958+/Xv2Q+UP7+9evvq85/fLzA+/fL0oaefQf+ld59/6wk03YIM
umagefMZGKGAA/bHX30YSighhRZemB6HFCZYIYD7cdjheSEKaKKGJgrY4IswXvYgiyeqeNCKHmo4
Y4QnJhTihiUSOGKPROpoY4UtKhjjkkw2NiOINRapI5I30ijlgCLSuCKUVY6IY5Y8Eulik2SWedeO
PwIJ4Hv9Qejhl1a2iWOUaVq4ZY71xTfkh0KG2aGZgAaa2ZE78nllhn7CyeaNcKpZZ5J+4glpfndG
OqagmAK6EaGcqrkQl1JmOWeoQIKIX6IIVRqpnX2KCd6rhRH/auiso77pZY+jKjrhhZOSOiSkqk4J
qz0ADPuXrCSi2iqu92UI7J5uJmtkjm6CWSSE2FK7J3fFGkuTeOS1COqa+C266pqSyhmttpbiSe61
qa57arv2ZJoUAPZm6i1J+R6Fb7+B7jsSwEX9S3BrAidMU7cKN+zwZww/LPHEgUVM8UnOhfTTxRrV
xQNcBh/MGscklxxcPiinrPLKKxOEckEvN/RBQTMTNPMHONtTs80K4ezzQDsb9DPQNBfN89ECDZ20
0Dr7HLTNT+f8c848O0010SZzB1U+CXE9kNcCgR3z11xvjPXSQdesNtMJpb200DtT7bbbRusMdNxr
F003zVHn/3012nxjLfLgcmkEtkGHJ/61PWIz/lDcdr8d+dORI0Q35ZVLDjnkbFceteRE71116G/f
PHrdmGdN8eEwu+x62I7DznrPpGsO+u11T9750ZufrbfvtZ+Ou9296z73QXmrnt3WLS/uPOzQc+11
2T6h7jnWlKeetNPAZ4598KmbPrz4wntfuu7oF290zYS375bhXbus8uvSQy+z7debr33myXef/veW
Q1r50MY95AHuf+fDXP+Ud7HZPS92EIRg4x53vcvt7oLk85/6Mrg7Beovf53jXPLW5kHzMVBiDrRf
BCcoQYiQL4MLNCHwOHi74x0wgAJEX/lKmL/+mS57J1RdCn9X2LoIPpAhf2sa7y6YuxgqcXtQC1zb
pPhE/tWQiQi8m/eutr8gEmdr8Tui4xxIPeBgEGo3s1rTCng3pVktbUm8Iu3glj03npFpUwvcG43m
vj5KxYuADKRKMgYSswlSIX5MpFMOychGOvKRkIykJCdJyUpaUiyEvCRBFMlJyQQEACH5BAAhAKEA
LAAAOADgATkABwj/AP8JHEiwoMGC9hIqXMiwocOHECNKnEixosWLGC0e3Mixo8ePIEOKHEmypMmT
KFOqXHkwo0R+MBfGlMlwpkKb9mDyk7mTpk6dDnsmFDr0IdCGP3P+TDoU59KbS3c+fYnUJlGXWLNq
3cq1q9evYMOKxWi1J86cNa/OLNu0JlqePmkWrQq17k25dpXOnXt179ugTvv2HUu4sOHDiBMrbsjy
31++j9X+ler3LeW7guPerVxZ6ODNoCFvHkz0c2jSCRurXs26tevXsGPLPoj6cufJaGtHfgzadlHU
SHkHD41ZLnDObpG/nc28ufPn0KM7143buGXhuff67s17O3Lvyb8r/z06Pmlpqk3JL5fOvr379/A/
eqV+3bpZ7LbvA/ccvn/xiOcFFyBpTAF4GnGLJajgggw2aFhj9N2HF38R/hZUemd9Rp9ReGn2X3im
cWedPfGVaOKJKLr2lWS7sVgdi+d5x99tHE5oYIf1fdhhiNUh6OCPQAYp5JCN6dVWdy4a55mEdanF
pF+msXUklGnZNeCFOPY343opXZPil2CG6VxY6jnpH5ROVRkVjgFCpB5UGQJWWoFRyShnWW0Oqeee
fPbp55+ABirooIQWauihiCaq6KKM+llko5B6JeaklFZq6aWYZqrpppx26umnoIYq6qikljqSHqam
quqq0EXq6quwxv8q66y01mrrrbiKxequvPbq66/ABivssMQWa6yqzRyr7Eq5Nuvss9BGK+201FYL
67LYZqvtttx26+234IYrbnNyjGvuueimq+667IJ0T7vaWivvvPTWC++9+OYrUL389uvvrfoGLPDA
BBds8MEIJ6ywdP827PDDEEcs8cQUV2zxxRgjtvDGHHfs8ccgb5TxyCSXbPLJKKc80aNAipxaSwqG
LPOlYAFgMwCFgqOzzgrt3LPPCe3Msz1CE120ykj3WyTOP7pM4kHgNBR10FRXPXXPDl2t0Mxc98o0
QzcnFLbNYoddNtM3o62Q2k8btDXUDGlN9NxWx501Y13nnaJXX6+z7TfbOH/dtz2B/+034VkJHbXc
i2Nt9NCPLyR30pSfPDjiYmOutuBnF5454pe7xLjdR9N9d9WVp27y5ZwDjjnohn/u+VajS0731ZM7
brrqvGc8eOuyvz778Id/LrrUjuOOOvLL9+48ro+mfXbwoJtN+NjF98200xvlDvTuixdd+u4v621+
fECGLpH6z7d/qymOspQV+xCpzz3MCZ6v/3vu9+9/pPsLoAAHSMACGvCACExRQAAAIfkEACEAoQAs
AABwAOABOQAHCP8A/wkcSLCgwYMIEypcyLChw4cQI0qcSLGixYsYM2rcyLGjx4f2QoocSbKkyZMo
U6pcybKly5cwY8qcSbOmzZs4c+rcybOnz59AgwodSrSo0aNIkypt+bGp06dQo0qdSrWq1atYs2rd
yrWr169gw4odS7as2bNo06pdy7at27dw48qdS7eu3bt48+rdy7evX4xLAwseTLiw4cOICf9dzLix
47SJI0ueTLmy5cs7H2vezLmz58+gQ4vWirm06dOoU6v+Obq169ewY8ueTRvs6tu4c+veTbm279/A
v/IeTry48eM0gytfzvwp8qWPnksvDm269evYs2vfzr279+/gV2r/DE+eZPPzHcvPBMeS/XX36uOX
1giuPnz79UPiF2mf/0j2+/3XH37uBajffQjml9+BJMFnT3/6+ScThA8aaOCBA+5nIYINQnhfhPag
J2JGOX34YIMlmegggBKe+B+KJi1YIYj8cfgijQW2+JKJNLoY4484Mihkiyz66KB8SLo0gVH0SXjk
kyiuaGSPVB7pH4tFvojljT5GmKGMHnYJZZApUkmmi1uOeWKWEY7oZkUlOklhmFrWCaKVG0KZZplb
Ehmlnx/KWKWfZVY4J6F7cgkgnkk2ipyFKLG5ppaHwgjknV5iiGaPPGYaJIFdDnrmpYpWmqOACwpq
pqOs4nZqqHZe/2lnp6tyiqmUp0o5KI+SMqqojoVa+mqulnoKbKvIqqZipGTiSuixOo4ZaLG6bvqp
rMFWC+urv2J6I7fW1prsuJfhqiGFhqLKbYKLfqkmjgMWK6agCsoJbo3vGkpstrF6q+a95AYM1Hjb
WUmee28mHJHA8oZnMMMQRyzxxBQjRTBOCO2m8MawpQZATx/7FHLFJCerEQAojyySyuIdRJLKKZeU
MsohxfzySizTXPPIOYfE8c+j5cRzUDPbM/RJHx+98s0j6Vxz008bzXTJVFct89JJS220zjZrrVLW
UXvNtNJih7202VqDPbXVbJc8NNdiH80y0l6TDXXdd+d99tZOw/99dduAV1w03jAP7pLNdodNNs8z
9713z1vrHfjk2J08tdplj5Qx1GrPjbfZc4f++M0hDw306W5CLjXMZ4e8OdafL7535qIrfnfpS6Ou
+2ZCX75z6Y7j3PXws/P9d/HDO6144pQ37/zhPHmuk/TPV68xiTm9jjZO1Ns08u7gK1fU69rbFP75
4I/vss/rY4z++0DP1H3Z5Ld/E/z4b8z3/JIfz75BIkFIAAY4QHsQsIAHFEkBQ1LA/DnwM72Lyfz4
t5IAmMSCDFQgAzFoQA5aDzcSOM02RjjC71gub0mjGdeShzut1c8gHtRgBmdowRoaMEQPTBgJd0jC
1kzPb6uLWucqCLc9lxyQg0iUoQ1t+EGq7bCJaYtiFN8GO5vEcIYdXOANt3hFKHpROwEBACH5BAAh
AKEALAAAqADgATkABwj/AO0JHEiwoMGDAgEktKeQ4UKHDSEOVBgRoUWCAQ5mFBig40Z7G0NeHEmy
pMmTKFOqXMmypcuXMGPKnEmz5siGFB/idLgwYs6XHzEOFMmxKEibSJMqXcq0qdOnUKOi9DlRJ0+J
PR+uDDq0q1GuXKWKHUu2rNmzaC/+W8u2rdu3bgHIrUiVJ8W5E+VatQf338C+YY8aLQqWb9/DiBMr
Xsy4sePHkCNLnky5suXLmDNrfnywosy+f+HO3Ey6tOnTqFOrXs26NeXONkELlB3Tte3buHPr3s37
ddrfwIMLH068uPHjyJMrX868ufPnSD1Dn069OlpDZDHP1Utwu8rt0lOG/6ettTxew73Tq1/Pvj17
meG1xr8Zc/5F7wzrXrXOv7///1NZRFdC3OlXVV474XTeggWW9NOBV9kH4IQUVviUdud1p6GGBpZX
VYNZhfgQbQ/KV5V7KKao4oos5sahXgPm12B4dOGl3102HkRehhGe2OKPQAYp5JCiQWhej1gVdCOS
SXo4W5EfQkgVkVRWaeWVuHVY15KwmbgkVTGSl+SSWJZp5ploQiajQfgRyN1+G7pZIn4ZgkhinW+e
l+aefPbJ228SBjhToBYWauihiBJ605vwIeroo5DG5ueklFZqqZWRZqrpppxKeumnoIYqKm6dlmrq
qagWNOqZyKzq6quwxv8q66y0tpbqrbjmamitvPbqK5+6BissTU4M69SvyCarLJDGNuvss9BGK+20
1FZr7bXYZqvttsIu6+234IYr7rjklmvuueimq+667IbK7bvwRtvuvPR6G++9+Opa77781prvvwB3
2u/ABBds8MEIJ6zwwskG7PDDiGIGcX8M2zvxxRhbhxk/HHNsT8cegzyQxwKRXDI/I6N88sgsg6yy
yASJ7PLHMX+sMs0mo9yxzSyfbHLKQJfMs9A+9yx0zimHLPPNSu+M9MwEVWzwzTUTTfPQWGOdM9NE
U321QV5bTbXOXCN9tdlhx8x02Vx//XLNaBfk9dZfryy2jlI3HFPabZ/9jXPdOv/tt+B1F2501YAL
Hvjbfr+dds+OH9243IkHTvjhfy9OOeOJZ3wx1G5Dnjncinc99s5Fy/1z36O3zrjlliP0+uSRk97y
5KqTrDnZug/euecQ851025wPPnvWjxt+t9Wlw2685C///Lzrl1/ufOyYzz635MwDD+3GBxEveueO
zxx78o/3PTbt3Gv/u80yQy+/7e1XX7j7VZ+Pd979Cr/89tmrXNcskj6jrW9tbjve0Fh3QKAhMHQC
tBsAAzhBsxGNf8iSif8ieLjtNfBoS5MezJgHMwSaMGRBg9/6breyB8JPbb2zmwpViD2cxU+GK/Se
sSSmw+Zg8FcBAQAh+QQAIQChACwAAOAA4AE5AAcI/wD/CRxIsKDBgvYSKlzIsKHDhxAjSpxIsaLF
ixgzasR4sKPHjyBDihxJsqTJkyhTqlzJ8uTGlzBjypxJs6bGljhz6tzJs6fPnyptCh1KtKjRo0iT
Kq0ItKnTpwOXSp1KtarVq1gdQt3KVWfWr2DD1gRgkyxZsRnPZuzKtqlRAHDhwlSrMC5drHIT5g17
t25fsHTjLtyrV61cs/YQW/zrt+5GwREZo51MeTDNvoYBG5ZclTFhvoIzJ3a4t/TosqIxpiZduTXN
nKwZQlYMOfFhwqlrz86bmTbv0rhH+z5r1+/m38RvGy+MXLZe5smBE3dcnLn168//Km6IuLvw07s/
m/+tnf257engLVseHr38efNt48sPSbp4b/TfHTs331t9fuH4nfbfegP+d9d2CKZnoIDbqYdfgv25
N2CEzmEGXYXfeQehfhIGll6EAR5om3kL8rbffCimOBB5InZo32oXQjcehxuSeJ5y+6Fnn347Ztfj
dHbVmCOJQhYp4I0zchcckQ6WpyF1HC7II4ChZehfh9T1OGJDKnYpX2w0MljfkfxF2RiFCZpZWJMl
Qolli0DuVyCSRqIppodKcqcgk1Na6R2Wbh4Zp4h/2ihlgQfe5eWiXYHJZG4EyvlgpG3auBqegdaZ
qYKaylnpp0KKqWahfBr6pJGb0pgmjKJCSmGfjMb/+tFbSobY3JpRtvcedlruGp6n4FXJX3i66nid
aEu+yaN0q95K3o0yYmeqn8fmKiqRul47mGnGFbucoa6FK+64RXFG7lznpqvuuuy2K6276MIr77w2
wUbvvfjmK5as/BKk778AByzwwBbZS/BE5pKb8MEC9+vwZb1W11ip0CI5cbeCPhQkmRrjuuXHEt8X
msTXjmfycSZG9izCyWos3bceU7TxS5itzPC8ObVIMbcZS7jtlT3rCXTHIG8WJqeOlmpsmcA2XRGy
nNmJbFqXCc2xVA73W/WVkN4pKcdLc020mlY/iXSZrIJ99KRXS1ZzdG6TzZrUGr3tnm63YXrct7NB
/1nsyw2xcrNmKSv9qGzE9vm2zRYn3B9tTAe7bct+t7os5YhPmjamkR3u42cSbXyf5+BO7bPUIQY6
eGs6Vxy52j4zbaHcrY+8quwxftz23FKGPHfeFWo5u9z+0W0p8Gai+eKoeI8cpp3dJrl6ZbVj6/vX
ifZq6djglo226KRrx/vt2hJPKcWwQ6S3191zz37bDUauXadB/zz9ZNW/zuqrPeff+tVfOx/5AkQ7
a1nOap2DXvc4RybjATBpCvTQ8NimLEDt7H74e9FhBMg85GxQVR98XQMZJ8IGmfBO1/OedSRYnag1
L3fR2tUIf8Ur0HUuc8fLVsv+trcLBcZZNsSgEP9jsjCE4auI7rsIEofIxCZ2Ziz0WmLSFuPEKlrx
iljMoharYrAtevGLlMmaGP9xxYVJEYwPBAzV6iaUMWYNOGjxDAmVOLmjpYVZKMtc3vZ4MfH0rX19
pJlrGJjEG6ZRbYxxo08gdjE1InAmXUubEbdHPPHxCY7F25P6JCmzQQ5tioY0l2fQKMg/Ja6GQJTe
KVlUn0GREEYmc13fGNi1IanwQ4iqnBF1lDJewtKDufsjlXrYvB/qkIaX4uOxgkPDIebMSpQi1KaM
5cBRZQl9drQghP5XSwelcGqkQuHTcHm32AGQfvR73/osyM5uzilNCVFkv5YmPB9mSVhAqufwnpf/
zUxG854hTF4/nZZH3E0uOa1s0slOpbsZolOdgqqnHZtlIp1BLaAuUog8+UXNaXqUTfHjX/rgOcpp
uappFjWfJfcUNpN2EpqVMxolQQXRV6V0ohDNZfgQiTh7bHQnW/soTUFUwTk1MFWaDBoFQ5VNQhLQ
cEdN6lPLRr6oKrWmQj1hO/mpzVsy9Z1NfKY3Qwi3GP3Rl5dcXLWCiUAWUbR9z8peS5saVQJyElu8
ulwHUVXMVt3KdbjqqyzHdFGELmtXP43VUM5Iq0mScrE3YyxMEttF0Ei2XON8bFkGd1nNLqSyng2t
aL9C2UWO9rSo5WJpeVLI8yUFiUvsbGqnIluk/9T2kBJZbVQaqz7cbjaz7oufaoI4XDb2NGZfkSNx
VUNb5srktvICLSDNeRTY0jFevg0dY2vWyOSCkojium1ndbsTar4QptnDXciYhUOR7a2s3oLnUVuo
Vzb5KpUEGk4w2XtfVQJThjz1FUD1CDNWHjO+9QUsfZ20wvP2N57k3VqclCVfog7VgDuVoOoAdMF/
itSgMxWu2ZBaVMhdGKWaIzEs4Uc6rzlwfaO7Kgeni0GGUjh2j0Nv43J1Uh99NGJWLXFDZSfTHdsS
vpfbJj4/R1bYCQurIfbhBCP2o2A9GcYqTnLR5qiuZ454QxPm55etyt0IFurMGeNmTnUXpCJjdLt2
YX4onHC84TRz9VBrTlb+pmRXDKNqp2tSFHlhY7o27a9PLF2zh60F5g2vNMUzrZ+GzSlNIRsvzu/L
ZI/xrEAZTwipnX6xphntmEETGtEIXiDP2CZYVJ5srT96Mlz5C624rueveAMakof137PyOq21MiF7
SeZX5PGYmIUzJsaWXes6FlaGkBl0HDlLxYBBlyjXxstsxZLtcFlXX1z2bhS3Te5ym/vc6E63utcd
1OLWWLhb7Gy3e4tddgcEACH5BAAhAKEALAAAGAHgATkABwj/AO0JHEiwoMGDCAkCSMjQHoCFDSNK
nEixIsKHDi1q3MixY0SIHEF6lChyY8mRKFOqVPmvpcuXMGPCnHiSJMqaKzPaHAjxIUaeQCvizGlx
KEOfOEEa/Ug0YcmlBqEilEm1qtWrWLNq3cq1q0uaJm82DalQZ9SgY9OqVHqQbUepKeE65ei1rt27
eKuu9ClwYU++Dn/67fuT8OC/iAMX5Nuzr+HFGAsDFizYrOXBbSM/3nw4sGTAPCknFq2UtGPPoZMG
nRwZdGrHiBNnlP0aNWrTs0Hrdm0bM2+1wIMTzOuSbWXYQI8vDn169mmRbhu7fd6cuvGnZW2jxewc
tvTkaC+D/9fJHbtxs9wvTh6PPnvu5uUVWw5/nnz7+PXnJ2/smLj//wDKtBZ71zHG3HLwjcdfgp1N
Zx956+VHH4IMEnifhRMiZ190BiKHlF9G5RdfdSLu16F87l24IXgFaladZ+UhJdyMM/5Xoobhodhe
hQ9W2BmJ1q2mYorYbTckfhgCqeF3OCJZU2EUIpmgkdOlNx+U0CnYZHdcTsnjfAGGKeaYXd3IpZXi
eembklM6yN+IUhJJ4ZF0mplmd0yeeaGbL5ZYpXsj6nlSllQG6aGFfG7ZH5mMNupobwqxtiBvbh63
IGFqQvlgbM8pFyluRmq3nqIyfsqZdbu5iKdoOZYqaqCnpv8mW2mDsropjKR+pqmM0P3k6K/AAkjj
sBrJRexcHhl77LLMahTss2Q2K+1Yykr7W7HTZqvtttx26+234IYr7rjkljvRf+amq+667BIF7buN
ahtiTmgK1ZZ+wVW707D6MsWspim2ay4YAjt4Vm2YMvUjtmfp2y++YgFXpGG6yhplU1AtNfFRAguM
blE5fgonyA/jW6/E1B5LKKBe7kivv8gGB+/MYg64aWUg5mzevUm1duisv5Ua4am05QawpJ3SChmn
FC+95K6pJr1yny7fFrXItR0GddFW4yypdKmW3PG4b9436YSDNp3ddw0mWeeV8j1ZtWpxXkQnz2eH
yiJ9vC7/56qacyN66ZcZOufn3WNza6PhiBvs2p9CMr4wrIdzWlrDfGOtM4iZqQorrrRiuZqBibYa
OIN/H/7ikAfuiSjiAtEs+8dita1o1UuyHHnbca7sJOs6fq7YeU/6DrudLBNfONWlS5i824RH6vqW
vSfeLbrRJWkw47pTJ7mghf/uvHjbg1/622wGarzybIbavNuq6zf+65VjCNHs+OO113aeeo41jFwr
m+1GdSWkrcpzu5qbrnxjK82NbmvpoVTYICS6qCzQgjuSYMUu8xRPxcpwX8uVB623LNphjIQoZJi6
xBaXOe0rdvmL4czUwsIUsquG/JKXC50CMBn6UCs2DKIQ/4dIxCJ2xIRGTKISl0ijH8YrZUyMYsBU
Vi0cvvCEM7Iiu2zUN4r8rWMas97GRhJGL4aMhmGJmRYPBiYnuvElLWvIGqdVxrHN8YxT5Njq0EiU
8u3vRW8M5D/gc7UzIg1UIcQdAXWGMMY0sDdHs5UjH7NBVxnQVELDldWyZsDHSZKDjNwMJGvFJKHh
TJRG62AotUNJpWnSkb4SZIBe9qWp8ShPO7tdBntUt/JBLn23EuDr9HanyQVzmCaj0sTid7r31Glw
uvxTonDZOCna42PSTB0b16Qn0AlJlZJR5onQk7aWrc9QYDtRBFMnTRWl03+XuxiO9LY5FH3oeahT
Z9re5/+dxxkKfAmS5Sz/CLyQ1YeaN7KS3KJnywo205256xLrQvS7iCqUPQkDXDkLOjy73e6i0oNf
oe61IuoR05oRgx3cLIo+3O3ybBLaqMumdlCWMtOX08OTSecJTJ7ONHDva6dPs8TPbnqver9EaUo5
VLxPbmiCSc2aiVwJSVYmLGhOLWXS2vRISHloVG9Szl+s2itodnSrryIliTqJMF2elYIICmve/KfU
dlUxjXU1Y1732pQv+DVbSMyiCu3F1ysWtohj8qtiZXjYxjr2scFR7BfCFdghCvSymM2sZlsi2S9s
9i6ZISizPkva0pr2WX49LWh3iMo87vEjG2RlD1VL29q+2va2VknLQpPpUcICtEeQDa5whzvKgI1G
klc7GVKJy9zmjm1xQ/Vb95CqmmfOFrfYza52NWszicLNeNTr4jaReUfnmve83BpfLjWKUd7W0qXo
ja98C9beNk23pabbKXDny9/+NgV7I0QlaziTXAtespD3266CF5wXWzCYsUp8sIQnDCARUHhMS7yw
hjfM4a7498MgDvG5OkziEpv4xEAUsYpXLGIUu/jFMI6xjGdM4xpflsU4zrGOd8zjHkcxIAAh+QQA
IQChACwAAFAB4AE5AAcI/wDtCRxIsKDBgwgTKlzIsKHDhxAjSpxIsaLFixgzatzIsaPHjyBDihxJ
sqTJkyhTqlzp8J/LlzBjypxJs6bNmzhz6tzJs6fPn0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1KtarV
qzpZat3KtavXr2DDih1LtqzZs2jTql3Ltq3bt3Djyp1Lt67du3ghYt3Lt6/fv4ADC/abt7Dhw4gT
K17MuLHjx5AjS55MmeHgy5gza97MuTPSyqBDix5d0LPp06hTq17NurXr17Bjzzwkeybp27hzK67N
u7fv38CDCx9OvLjx48iTK1+eVLfz59CjS59OvfpJftaza69uVCA/7N4jgv8n+L28xfEDy6PX+j39
ePX21K+Pb54i8/v4l3p/L97gfIrz8cdVe/uF599B/0mU34L3bQTeg/XR92B6EpLnH4HYQfheexHG
R+F+G2pooIcZgmjiieGVWCKCB144YYYdbiejWd1N6GGKFPIXIHw62kiihQUJqCOQP6bo441FBvnj
ii0S+SGJPq7H4JTJOWjgkDhm6SSSTMpH35PuESghhwIm2SV5PAZ45Y0RqqmklmXOKOdh8p2JZZJg
cqnnhUh+GKd7et6J3n9isqnlnlsG+mSCczY616CKwtnniCOeSSmTi1ZqoaCIdgopkGUS+qaZfjpq
Kl2QwoeiqoXueGR9bX7/eiWGYsbKIZoiVrhliH+GmSuveZ4q7LCkMUrssSF1hyxIjFLp7LM2LStt
YtBmNe212DqmbLYlAVCQtweBq5G4CJF7lrnhJlstTuMC4C66EKH7LrwquTuQvQLNa8+88r6LEb0W
meutvAoBXO5CBoclsEEJc+tRww4RnG9X+O4LLrwYo7VwuglBTFDCHlPMUMjcGtXvxfvmW7G//t7r
ssritiyzywPDbPPNE9dcM8cfh4uvzi1zHDTOMKOc88wX27tzyvcqzXTQ+loc89BS38xy0iv/PPPE
Qh/9s81Rf/z101JP7e26UvHLdMpjs93zty/HvPbaSw9sNNduM+z20nD3//0223fTyzfPdBcut849
y/2yxXofTvPicztOtuKP5wz52yg7Ti7lhnNd99xo3zSu33XruzLDUJtO+eecq11x3JZXjfflneMt
OOOovy553ntHHvvim7NMs+mQb1555nEL7/nccCOu+d/GW+788I2aTHrhqDNP9uxN18579N9Gjzzw
el+/+sEqQ6/+7tPDvjH23zPf+vrLs4/94In3Lr365E+/+tmhq8no6Ge7/F0PfvGzH/mK17fzla9/
C3yf72Znv+eBT2LwY13lJlhAo2nwd/M74PMWWMD7MdBhhLOa2LDWvRPKLGtm49sLWfg320GtXDO0
4ekS97qirTCGZYud8v+0x7jgae2ITethDrdnNxh+joIPDNzTnMa9Gy7Pa3PaFrFI9hAujkwtXpRg
WQIoQBRGxIsNQWPBwCgR8JnxjXCMoxznSMc6ikWNaZwIHj+yxzVuRY19pB1LephHOw7Qj23UY0gM
lrEapvCAEaMa+hBGEYFJkmeMxGPISMY5QwZskYoESRj9FkoiTjJihUykIBGZyW7Fa5WelJ3ihDdL
p9XyZDS8peeOyEIY+lB2+wti1JboNUs20WykTOIvaanCFf4yiLTbGuCOWb5eIlN/xLTa14wITWDK
yXr1g+LuEnhCcoLQnHkbHzpb+MH4Na6cCuSe90r3znTFs5no7KQHw3nmtN+R8nxKhODEyAgVtZXw
nDvcmUE7OMwpMhOh9SOePzu4QXo2D57DGxou22nEwUnUnfXM5+X2ObmPelSjAuXfNO1F0DL+C5MG
pJtCtxdF7c00ph9UJ0XNV1H5GS+E3kum/Hq606I+MaQcLZ7r+JlSBAK0phP1yjfiAs7JiZOBDuTg
UZ9aQaa2M6VfvSoUjZrMrh5Uhj3tZFqJysF0QtSfQB3nWQvXUqfIMnkKvZoUlRk+JCrVg7y8Yi6T
xz+Tpo9qRz0sXn3m11pGbog+vGVH+QpNKrb1poPdJdbcKE2x3Q9fdZ1JQAAAIfkEACEAoQAsAACI
AeABOQAHCP8A/wkcSLCgwYL2ACi0l5Bhw4QLATBUGHHhw4sQJTqcSJGjxokbOz4USVGjSZAZUY78
eNFkx48uU4ZsuREiTZk1S3pUGZOlTpYZJcL06FMkTp02hzr0ORIlyaU7g85cahEox5siD2rdyrWr
169gw4odWLOs2bNo06pdy7ZtWqtu4+aUS7eu3bt48+rdy7ev37+AAwserBauYKOEEytezLix48d/
x26FTLmy5cuYM2vGK7mz566bQ4seTbq06dOo9RoujNmiyrWr2cZWrXh2areuSwu9zXuvbbO/7dq2
OltpWePHCQ/PGzx0c6iHgSN923B37+t0n0MPvHwu9ddTWQ//1l6XfOvsh+GSt45982eESJ86rRo1
fkWqLqvmlol4OsmK+72Ukn6uPQXUfwX2d191RhlYX1T4EXVcgA7y1yB9QkW0XX0UnjTfScQBd9ZL
IFbH4X5HaZhfhBu956KLfA0lI1QzzgiSh+zliBFPO9Jk40084ugjjavpiJyQRhKZHHvh6SjidhkG
SaOSQDJ1Y3JXZsngkzkh1pSJuyUJ3pRUSdlebURWWFKYZJrY1JpDeudmk3ECGWeJN/4knYZaWlmi
jHriF2aIfXaZ24+IBuWklmbS6SachhU31Z9gtnmggFD+ZJ5pLwr0I5kH1mkdnlD2+Gmji1r5aKGh
yikmRkjW/8ljn6ouameirLo6U6tzlrpqeHKOOOmVbOLaqJ1lttjpssyGZaxxbOb6pqWmtlnqs3TG
Km221EJH6baf1nrrhtgmily1jM5aZY+veQirU5W+Kq647aLU7L34HiQVTrDSZ6G/OPq7kqFj+pcg
sirCa7C7IWG60qEKYyWwVBkSJ/Clh8p3IkwTF7jnmPwWxTCLLQUYcbQaY7yiyBBqlO/LCJ226Zk0
L9bcpjPXrPPOzPHs83lt4fzz0JfBbPTRSCet9NJMN21QEE5HLfXUVFdt9dVYZ6311lx37fXXYIct
9thkl2322WinrfbabLft9ttwx9020XTXbffdeOet99589//t99+ABy744IQXbvjhiCeu+OKMN66X
3JBHLvnklFdu+eWYZ6755px37vnnXjku+uiknwn66ainrnrMpbfu+uuZrS777LTXbvvtuOeu++68
9+7778AHLzxZsBdv/PGDDa/88sxzhfzz0EdPV/PUL41E9ZBLr/323DOE/ffg7979+OSXb/756Kev
/vrs66zA++/bA3/88zsUP0P342///vDLv5ECZqmf/fInv/7ND4D749//Bkg/Af6vf/hDYAEBmD8E
OjCCDYRgARkowQNOcIP6w6AEQUhCDVZwgiMsYQJT2D7DsdB/IYRhBUfYwRXGEIY1qSEOLRjAstAQ
hzLMIVr/XkhAC9bwhUBM4ACV+MMV6hCJM4yhERV4wxOGEIktFBwRmag/CgJRh0H8Yg+7KMQtCpGK
ZDyjD8f4xCBCcYxXlOICbchDLHrxjmV04xx5mMYkZpFwHpRjHPG4QEKG8YZcTKERm/jA+v2QhRf0
4yHreEUCYnCOcdwhJvXoPzt28pOF5GQmj6jEP5oFG30zIwptmEQ8trGUHESkImEpxkde8o0fnOQg
1ajGJi5ylqwkpAbD6MVQftKXVdykKQenSj4SM4/FPKQkgQlLMJYymqDsIy8pGEg+YlOSmhQh/WS5
RzIy8pmzpOQjAynGZdJsWc1kJS2t6cxprhGR4dwkNp35aE1M7jOTJMSnIGt5zXJGcKCtFGQHo1lP
azokfJHjSzzRiE8wGvCiRQzgDDO6TRE2kpvD9Og6GQpSRQ6Tnu3c4TgP6tFqMpCJJS1oMt1puk7R
FHYQzd5Nd8rT0Syrp8fL6dqAStSiQiYgACH5BAAhAKEALAAAwAHgATkABwj/AO0JHEiwoMGDCBMq
XMiwocOHECNKnEixosWLGDNq3Mixo8eH/0KKHEmyJEmLCj6qXMmypcuVJmPKnEmzps2bOHPq3Mmz
p0+bCoKmJCh0YFCj9lIKPWp0aFKlTJcKlNq0qNOkT4dSJWqVaNOvU6tCLVqQaVanW6uevboUrVmk
YaeaZXvWYNqnYsu6fQv3p9+/gAMLHkyYJ1q4WPGGPawXrNayChnHfYzwauK4ijNTRnxwLlzJnC2H
5nx582asoEtzRcxWsuihhWPLnk279mC6lpUmzm0X9W7MwHsDpyw6+OXfvx+/TkjcK12vpFlDdh5c
N9LUridDb24ctu3v4MOL/5eNG7J13uZ9l57LF3Nb03xft9Wu3jrX9twXQx/dmTTv0+rpV510yNFn
mnDjJajggoJpVB51AXZnoHDRgQbgcct9NqF90WmI4Yf7HbcfeiOmdx1Z9z13Gnd3GffSizDGCGNg
D14nYIUTTofjcBLuuNh8yokopFxS1SjicxSSSKCNTGa4V1cnFumidwxWaeWVMjm4JHw6+tejjypS
OCCTN0bVZYj2HdhlcSAOieSKqpX4IWM1sinjnXjmyRGNKBLJmpIDWkVWi3H+OFZxUpIZIHtHzTfa
Vi2iyGZu7VX3FlVIzumcpBCOieWnoIbqk56klmrqqRaJquqqtaHq6quwxv8q66y0vhpYrbjmmiur
vPbqq026Biusq78Wa+yvwyar7J3HNussqNnJJdaTba5lLaRupXhoY0Q+KV+2w4GbFVio9alZhfEJ
KimjWhVprn+MPSvvvAlGmxmPaIa4pbT8yolhtHbSaSG4ApPZ2pLudfhmwiTKpy+V9EYs8UhaJlxg
ofxNSaBuHFocJ5yTpgeyb/8ltx3DZ3aM8KJHKuzjsjDHzNCtHH/s77StcWpxzRkWml+58YnMI89C
R5hfxyX3F+igg7rcbV+z2TDx1MeSbPPK1SKaV44j9vmzyoHeiBzSJodZbdhKt3wYpZX6HBfVcM+7
EdFr2Zuxmx6OnaR7QHb/mrLJHpIdJG6OCpn03p2SPaTbi8vsuMy3Mu5xy3fvS7m/I9OXNpdeXo0X
nTdbvmbeiuM9uT1xp656TR4vnGLWm/tt+KObsvvtnw+rxXdd+C5uLqR6UXvtw4xCvfrxrD6u/PLM
N+/889BHL/301HuE/PXYZ6+9s9V37/334Icv/vjkl2/++einr/767Lfv/vuobi///PTXb//9+Oev
/6rw9+///wAMoAAHyL79GfCACEygAhfIwAY68IEQjKAET0JAl2CgghjMoAY3yMEOevCDIAyhCEdI
wvRN8IQoTKEKV8jCFrrwhTCMoapKSMMa2vCGOMyhDnfIwx768IdADKIQL4dIxCJG5ARGxKEMl8jE
JjrxiVDUXhKnSMUqWvGKWMyiFqUXxS568YtgDKMYbRMQACH5BAC48qEALAAA+AHgATgABwj/AP8J
HEiwoMGDCBMqXMiwocOHECNKnEixosWLGDNq3Mixo8ePETOBHEmypMmTKFOqXMkypb2XMGPKnEmz
ps2bOHPq3Mmzp8+fQIMKHUq0qNGjSJMqXcq0qdOnUKNKnUq1qtWrWHe23Mq1q9evYMOKHVswq9mz
aNOqXcu2rdu3cOPKnUu3rt27ePPq3cu3b1WygAMLHky4sOHDiBMrXsy4sePHkCNLnky5pd/LmDNr
3sy2sufPoEOLfsi5tOnTqFPzHM26tevXi1XLnk27tl7YuHPr3q3Stu/fVjEAH068uPHjyHXyXs68
uXPSyaNLnw78ufXr2LNr3869u2Hq4MOLqB9Pvrz580W9q1/PHjD69/DjT21Pv759lPLz698/9L7/
/wBaxN+ABBY4U4ABcoDgggw26OCDAvmFjIEUVmjhhRhmqOGGHOoH4YcgetfhiCSWaOKJKPYX4oos
OpfiizDi1eKMNOIW44045qjjjtPV6OOPoPEo5JBEFmmkjEAmqaRjRzbp5EyNPCnllEEtaeWV31Gp
pZZYdunll2CGKeaYZJZp5pkk7fFfQAAh+QQAHAChACwAAAAA4AEwAgcI/wDtCRxIsKDBgwgTKlzI
sKHDhxAjSpxIsaLFixgzatzIsaPHh/9CihxJsqTJkyhTqlzJsqXLlzBjypxJs6bNmzhz6tzJs6fP
n0CDCh1KtKjRo0iTKl3KtKnTp1CjSp1KFeXHq1izat3KtavXr2DDih1LtqzZs2jTql1rtqrbt3Dj
yp1Ldybbu3jz6t3Lty/HuoADCx5MuLDhw4gTK17M+J/fx5AjS55MubLly5gza97MubPnz6BDe2xM
urTp06itil7NurXr17Bjy55Nu7bt27hzX0zNu7fv38CDCx9OvLjx48iTKz+pu7nz56+XS59OPTX0
69iza9/Ovbt3kNXDi/8fT768+fPoSX5fz7591vTw48vv6b6+/fv4M2bJz7+///8AajffgAQWaOCB
CCa4UoAMNujggxBGKOGEFFZo4YUYZqjhhhkq6OGH5nEo4ohqgWjiiTJ5g+KKLLZIFIkwxhgWaci4
aOONnSEj4448XqVjj0AGadGPQhZZ241IJpmYkUw26eSTUCak5JRUAhbllUVWqeWWXHbp5Zdghokj
lmTyKOaZaKapZnwk/FbmmzGuKeecdNZpp0tw5qnnnnz26eefld0p6KCEnqkLnYAmquiijDbq6KOQ
RlpfoZRWaumlH0qq6aacdurpp6CGKuqopJZq6qmopvoYpqxOqeqrsMb/ymGrtNZq663Dyarrrrwy
iOuvwAYrrGC9Fmvssd8Nq+yyzDbr7LPQRivttNRWa+212Ga7IrLcoqXtt6h1Ky5Z4JZr7rnopqvu
guO26+67imoDb5YoSbPuvfjmq+++lM7r70f8BizVvwRvJPDBCCes8MIMN0xowRDv5vDE9EVs8cUY
Z6zxWBR37PHHUW38pC2sGYgEyCin/KXILBek8sswx1xTyzTXbPPNGsuss3o457zzz0AHLfTQRE/c
s89FJ22rPEo37fTMR0ct9dRUm/r01VhnrfXWXGtZNcRdhy22sl8XPHbCZaetdqlnI7z223DHLbeZ
bddtd6Vz5623n3fz/7v334CT2fe+gRdu+OGI4za4vlxVkPjjkGO3+OSUixk5rJVrCUrmnHcuFBee
h37c5a+KbnqX+HBN+uqst+46uafHLvvstNdu++245667w6/37vvvwAcv/PDEF2/88cjntju0yTfv
/PNpLy/99NTfDX2j1Wev/fbcd+/99yNdzyj4t4pv/vnoR0z++uy373f6fLsv//w8wR8//fjnr/+y
9vfv//8ADCBk9vcwAZaJgIMyoAIXyMAGOrAiCIygBEXywCdN8IKd8wIGN8jBDpKtgk3yYJpAGEIR
nomEKBSgCVfYvRS60H8sJJoDYjiwFzJJFTbMoQ53+BglsIWGQJQeD/+HmLwgdomIMDKiEm+HxCYO
b4lQnJ0TazOJSUwRQ1UsURR7U8UtTusqGriiGKXmxTJ2boxoTKMa14g5M7rxjXCMoxznSEfpsPGO
eMyjHsdXRxPt8UF99OMfGxRIEMGvEYNMpCIXycgGFvKRyhoBsRrZH0hakmiUzKQmMzmoX+xvk/gx
yjsuScpSmvKUjAHlfVDJSpSp8pWwXGMrZ0nLWtrylrhs1Rpy6cpY+nJehWIDL4fJlF+uh5jiMWay
kMnMZpJPmdCMpjSniRdnToea2bGmHbF5HW1601rcDKeqvpkccZrTauRMZ4sm4ZZzuvOdxVOnceCp
OHna856Vo6c+98n/OnwKZ1RC6J0/g8NP2gz0oAjtWkFnk9CG4m2hsXGodSBK0YrKTaIYzejPLOog
MnD0o//RaGNM4RiQmvSkNhOpSlfqMZS69KUZY6lMVwZTzsx0STXNqYw8do2bXlCnGdFEW3xqGKBm
hqhITZJRMZPUpoq0DU4NDFSjWpepUnUuVr1qXLKKrsO1YamW+aqutEoXsJr1QmRNq1rXylbdnfWt
cGVbW6sS17oScq5Usate98rXlOL1r4DVGQACGxUADNZLeCjaawwLgL7uxbD8JA5jCQsVw1L2KZN1
pnMgy03qWJaYjg1tey7rFNGa1jukTa1qx3Ta1rpWSKuNrW9eS9vautr2tmtxAW4vNh5CyBaVbYLK
bodL3OIa97j2GYKEfnsU5Dr3ucdcXBDuBV2tMPe6pKnue7A7FO1697vK4654x5tMxH1AVuQFCnjX
y972uve98OVUeudrpfja976Soa9+9wsc/PqLDZDjr+0SK+ACT86/kgkEghfMYIIY+CYNjnBHHkzh
Cg9Gwg2xsIaNguEOS2zDIFavh0dMYo2E+MTpnQWKG1PiFmd4xexysYxnrBAY29gmNM6xjgcSEAA7

------=_NextPart_000_0003_01C6F10B.662123E0--

Received: from dsl-189-142-134-236.prod-infinitum.com.mx (dsl-189-142-134-236.prod-infinitum.com.mx [189.142.134.236] (may be forged)) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9G1oulo091954 for ; Sun, 15 Oct 2006 18:50:59 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000d01c6f0c5$854457b0$ec868ebd@ingesos>
From: "debug both"
To: [email-masked]
Subject: five six seven eight
Date: Sun, 15 Oct 2006 20:50:56 -0500
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0009_01C6F09B.9C6E4FB0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0009_01C6F09B.9C6E4FB0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000A_01C6F09B.9C6E4FB0"

------=_NextPart_001_000A_01C6F09B.9C6E4FB0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Againwhat usefull necessity of batch files wants is automate tasks tasks =
hand dayly of business continuous become a daily developers better of?
Darkness Gerald g Jampolsky md Letting Fear ms book approaches science =
touch soft feminine.
Rights Reserved Speech Debugging am Console Tutorial in is is subject =
change Microsoft net sdk topic four.
Standard classes eg in stl mfc others java library postc writing.
Area events selection am Kentucky or Derby Jimmy Buffett Reds am games =
home or away Great Star Game seats Visit check out am us.
Easily simulate a control a send back can pause cycle enable toolbar =
Break button Input now order Consoles feature Note with.
Prompts Record log Files generate is so in later replayed directory c =
Base of Path box debugging Prompt Prompts.
Bear arrived Blackcomb Whistler dvd Info Buying Guide Comparison Charts =
Discounts a.
Votessawx voteshalos Heaven votesdrays am bay Nation Filed in Permalink =
Feeds of.
Efficient gui virtally enterprise actually or familiy consisting main am =
cleanup jobs is import export am nightly processing else is do within =
sql?
Chart receivers Helping or buy right budget gtgt a Once features is pick =
meets needs shop evaluated am think decide am readers am.

------=_NextPart_001_000A_01C6F09B.9C6E4FB0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Againwhat usefull necessity of batch =
files wants is=20
automate tasks tasks hand dayly of business continuous become a daily =
developers=20
better of?
Darkness Gerald g Jampolsky md Letting Fear ms book =
approaches=20
science touch soft feminine.
Rights Reserved Speech Debugging am =
Console=20
Tutorial in is is subject change Microsoft net sdk topic =
four.
Standard=20
classes eg in stl mfc others java library postc writing.
Area events=20
selection am Kentucky or Derby Jimmy Buffett Reds am games home or away =
Great=20
Star Game seats Visit check out am us.
Easily simulate a control a =
send back=20
can pause cycle enable toolbar Break button Input now order Consoles =
feature=20
Note with.
Prompts Record log Files generate is so in later replayed=20
directory c Base of Path box debugging Prompt Prompts.
Bear arrived =
Blackcomb=20
Whistler dvd Info Buying Guide Comparison Charts Discounts =
a.
Votessawx=20
voteshalos Heaven votesdrays am bay Nation Filed in Permalink Feeds=20
of.
Efficient gui virtally enterprise actually or familiy consisting =
main am=20
cleanup jobs is import export am nightly processing else is do within=20
sql?
Chart receivers Helping or buy right budget gtgt a Once features =
is pick=20
meets needs shop evaluated am think decide am readers am.

------=_NextPart_001_000A_01C6F09B.9C6E4FB0--

------=_NextPart_000_0009_01C6F09B.9C6E4FB0
Content-Type: image/png;
name="sense.png"
Content-Transfer-Encoding: base64
Content-ID: <000801c6f0c5$853870d0$ec868ebd@ingesos>

iVBORw0KGgoAAAANSUhEUgAAAegAAAIICAMAAACSIo0hAAAAAXNSR0IArs4c6QAAAARnQU1BAACx
jwv8YQUAAAAgY0hSTQAAeiYAAICEAAD6AAAAgOgAAHUwAADqYAAAOpgAABdwnLpRPAAAAwBQTFRF
AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrwQCAAYCAAgCAAoCAAwCAA4CAAAEAAIEAAQEAA
YEAAgEAAoEAAwEAA4EAAAGAAIGAAQGAAYGAAgGAAoGAAwGAA4GAAAIAAIIAAQIAAYIAAgIAAoIAA
wIAA4IAAAKAAIKAAQKAAYKAAgKAAoKAAwKAA4KAAAMAAIMAAQMAAYMAAgMAAoMAAwMAA4MAAAOAA
IOAAQOAAYOAAgOAAoOAAwOAA4OAAAABAIABAQABAYABAgABAoABAwABA4ABAACBAICBAQCBAYCBA
gCBAoCBAwCBA4CBAAEBAIEBAQEBAYEBAgEBAoEBAwEBA4EBAAGBAIGBAQGBAYGBAgGAEoGBAwGBA
4GBAAIBAIIBAQIBAYIBAgIBAoIBAwIBA4IBAAKBAIKBAQKBAYKBAgKBAoKBAwKBA4KBAAMBAIMBA
QMBAYMBAgMBAoMBAwMBA4MBAAOBAIOBAQOBAYOBAgOBAoOBAwOBA4OBAAACAIACAQACAYACAgACA
oACAwACA4ACAACCAICCAQCCAYCCAgCCAoCCAwCCA4CCAAECAIECAQECAYECAgECAoECAwECA4ECA
AGCAIGCAQGCAYGCAgGCAoGCAwGCA4GCAAICAIICAQICAYICAgICAoICAwICA4ICAAKCAIKCAQKCA
YKCAgKCAoKCAwKCA4KCAAMCAIMCAQMCAYMCAgMCAoMCAwMCA4MCAAOCAIOCAQOCAYOCAgOCAoOCA
wOCA4OCAAADAIADAQADAYADAgADAoADAwADA4ADAACDAICDAQCDAYCDAgCDAoCDAwCDA4CDAAEDA
IEDAQEDAYEDAgEDAoEDAwEDA4EDAAGDAIGDAQGDAYGDAgGDAoGDAwGDA4GDAAIDAIIDAQIDAYIDA
gIDAoIDAwIDA4IDAAKDAIKDAQKDAYKDAgKDAoKDAwKDA4KDAAMDAIMDAQMDAYMDAgMDAoMDA//vw
oKCkgICA/wAAAP8A//8AAAD//wD/AP//////TqFl3QAAMLhJREFUeF7tXb3ONLlSXo6IjsgIkTjX
cEICLoRrQFwJEhGXsUhkZFwDEhIB0QkRGcknrbTSMu36e8p2u93/3eN699t5Z7rtcrmeesrl8rwz
P/2InyEs8NNv8TOEBQLoIWD+7befhohbMckfAfQgThChe5TQPcg8h59mMHoQFwigA+hBLDDINIPR
owA9yO5i+GnGPnoQFwigA+hBLDDINIPRowA9n3T+7ne/+/H5N/18nsjvz9XpxucO3eefqRE15vvu
mXYnYfyQdZ6EktX5l4nky9bh02KQbPmoaTa2V5O9S6CZAAK8wpJaJg9QHAE0vgj3HKbsIhnQXiRI
Tk+PssAgclqhO6Em2CQcjWxKOrmkyGdAg2OQMMTcd84Z7UXmQA8Sco+a5lFAC/DmGRaAjeIzQFuo
xtCdiQygd2G+CLSwUBgNazRG8QrQsmhrBJ9lNK7JsMSrfAzzsGbsmvhonZfWaAvYAJMgUCzUKdZT
sib5k3kDBH9ltq3omIV5MCUTxLaxRq9NLfYAjcHUM7pYwWW1l8iuzqAregC9Frp17ZdDt8cIILTE
yrZEkq5Zs9wDslwtJ28V7zJ0jxZ498+3B2jeZDnyFVE72wsJ4pqSyUatGrUXtldZ0NYt3f7pjyOh
EbpTQYQYZhhrfaSSNEEz2orhao01k9raTlUYzLrTwHLFngnn10Wu4VtHCXQQUgfQowA9H9MeboHh
g/E6A7S2V4tI61CLLW9usM4mX9k6QvfNPnjV8AH0VZa+eZwA+mYArhq+AfQvlZ9JrV9+ScrxL1X0
D+mZPP7hD3/g5/Ir3Z1+tBVfwW7V59THxIkUGpBH/Aw3DQnjczcc/yqrPnCcRjJGeCZM3YMB7ZIx
BkMw+fwmozug+TXfIVymh6yzdJPb1mZqirAD0NN1A9q84HP5K9OrdZNqMXoO6AT8LwQ//BBVhbB9
QKsn+M4OaGmjfuOB5hFpPPUCcDLxqgfS7EKVtjBagfbbq/VAK7GJ0uYljC1GeVgJVgBN4AejP594
MB8AaImuhG6m8y9mPyBmm9F+jT4GaHIQ/CfEpnUjgJ4wXhG6AfYUtyuhm1GGX8012gPte0lHa2Oh
m93FYnqGcgH0hSHyqUOtADotzPxAq3SxSFsAZirJYsstCasiH8e4DStqJUTXArzEfRnSlmpl9FOt
f6Fe64Dm1ZlA3g+0bsYAvxxoa2OMRvfxSwX7Rm1rd6FRnzjUymQMQ3a+RuNORxbHGqMpzhK3E0yE
DrO9BFrbCMMlLkjolt8qWPfwsmlftxP5ytZrgYZtVQG0I2iqXqTFlH8Rmlww0ZqHVDWs1GJ0MHcQ
Mrtyi8N7Wg8QXxw0su52MvbEABQ6bbVAHFN+ZaAuJxVAB9Bbg8TV/QZBauc0dzH6akjr4+20wCDd
A+gA+hl8XdZiEKR2TrP9DpNff/11MjQ9/uBH/JU3+LzmS9IeuyZRdCE9+zU9SBeVRU/kBkoENViS
SFv2h8FbtEI323se6LKBcwLyjASagituwx6U+c90VTppH2vD/gG+N7Xe6eqDdG8CLQT6MA8QYegE
k+mlNmB0uHkJtFISmOjCxSLQ1kBkDYLUzmk2QrdRagboSgOkIfcSL0BiK8XVf1AWtZxhtA8RTtDg
wbk9/Qajne0tAAuBBUfmMzU4Amhe5XWN9qGbgZZUIEJ3J9N7gTaOzQANEdwYiVF5M6MhvfORn52v
c6aDN+sM3RBMhdsZo0ugFSBdj7P4LBkaUrYe72FFx9ANAT7C9oIFWtsr5SPmVppF+2SMAzckYy7Y
I6YuD1ee+8HyhR2RrgkOnDML/FNukSbQyaQGqA/E0/WiATdBJ7C0Cjrw1pw9SPdLs9srTLq0kyG+
ZlaD+kRfwYTWxgJorX8ovlYwgcaOjr5g4qK2VGeyggkho2HfcrU8SwMI4y+Nwve/gdF/XD+JcP31
Nntljzi9GmTbFV+eEkAPYoFBphlr9CtX3PVKB9DrbfbKHrFGjxK6B5nn8NMMRg/iAgF0AD2IBQaZ
ZmTdr8yh1ysdoTsYvd5rosdzLRCMDkY/1ztDs/UWiGRsvc1e2SNCd4TuVzpuKD1jgWD0KIweZJ7D
TzMYfaAL/OeBso4WFVn3IKt6MPpo6jxUXgD9UGCOViuAPtqiD5UXQD8UmKPVimRslGRskHkOP81g
9CAucOQf2cmy8jEdPL3fkH9yKvhXh2k3iT16XT1SXpPRP31+9lniT9PPR4Q+8ovpYrolDegVXZR7
2m3SgZombbCjXOTOdjc9o+bch59WgXaD+5FER1UQJJOuJPgkB9pnf+vdAnInyGpkZws1iRiGfztz
Va597O2QAhAJSH4QX/BAg/QaICKanULNgzqKCBlItTGsjwLlDDmN0C04J1pPD/x7ui7XpjvTy/Sv
EroRDoXKYzQPtLRLv7PeTCBFbbpN/zGL9YWCSEEBQocIBVnW2LEUfAyHocsy6J/eGroZaAKSoEy/
0//23ICuOCJFYkRs8n8M5wYNmRbutYF2QhTmBaCRhgl4dguJPjnQoo4FkwrQ4KpncPEYmcuMrgKd
Vm+FmF1imdEMjguNYqbyXg60a6Fc1nA7uQn7Cq+ZHApk/cTojx44w2gGV31Ah08D0XpB+YREkSOT
p6NlbQNawTeafya7DLSu1gw1EIith/iVjPbtQYgiy9iStBbQQOVOoDHV8JFAXh0NzpHymIzV8ED3
aox2QFMorwuCqGZIejKWTYQgLp+tJ2NCN8OKfAGAQLTFUUSYaKIOpI2Jzvl9vQSO5DzqmDB7hpQW
0FPK9blPD7JG044LQ3cH0LK9Ilw4bPJuCYAu71FY5BDpgqgXgqTErMAcQSSp98jOSIIwUFzHqziC
uhCCjk5xBkoHyGwCXZFfab9WxAFarxJhAWRVt7WNLxpmrVrSfi1KLwRaA/BWG3X1ezjOP7aVQA+v
cB6ZdoSsmgUC6EH84gCgF6L/4uIwNRjE2jdOswGDHWm0sUp39fhj6iWperHtIkGct0/P6HXXIhiN
dlmgBXQfBm6nRbr4SqlhSWdh8kA7tr5Bds0xOreNnPbL/J+eYhRdDFT1GUbQUFXSkkgGl3pegvSf
B9YLJVA+srKaCIEIWfd6oKXkYjH7p1ijT1+9W0BLSYxDcSqHEQlxewWtjJ9K3fSEfpjNntVM+9Pn
OfwAC2s0lLpnkyYK78hPPaR2MbsCNAb5iK6nWmAt0JpBmVYAtCcyLL88DLJay+eRdp+K8HIeZCnx
hK7tmbxvSFB2oRm3W5Bu6YGIXtNeV8x16DFOL5h0bJIhuxt+KT3NAB04LBFhQcTiCIsNlhSI+x0W
2MZoELzuzdynOWwIXrBAAD2Ii6yMm9h8ZdeO8BJNzrNAi9GVP9Qoga6E7j+bfn7Y40f7z+v0MAh9
HjjNxX2097EuRk+gTj8JXPpfgD7PY+uS//rqAR873iLQVOOo/qHGXKWjBvQH7em/+LnLAq2F1te6
U02MYSfwZ4FOodszOoC+C2Eed3kTbH+OUwJdV94xWjGfAvjNkx15+NOBtmU6gL7T0Rb20XAKMRO6
a1l3JRnj7OyB6egjVfrfw7VaPI/WI0cCGs4laI3uAFrTsNheHY5ft8DlqsdyizsjUozdaYHlEugC
0FHr7ibVrQ2Dr52MeHuzAPrtCHbqfyXQV47VOf1xmrVKoHqoUTndmGpj9cvJdlWxdDE96h92jGPp
m2e6WOsWbGoN5ztXW/P7zhjs4Pel0HcDnUrb/NkHQlgjJ9VJ7R2E2tImI3+YATWYS2c6+GAdBRP7
a6nERQEKArT8PYc/9qj+SYe95Tv+POPS7dZiCTQdUHL8Zsr6v5lyf2RHtTP7q6riTzoC6EvhtcEW
gbb8Sbjs/zgODy6F0ZaMIdAQDajTTVMec9iFNdoSZapsu7+9gQt2y4AvUm//93iRjF2aNSy8Z4x0
kX0U/Kmc2ylJcMc/5yDHwD+7xL/TSM/HpNZNs97Aq1aXprgNY13q9F892PKhRjH9WbwqVZBsjfay
bvLtMYeNb8kZBPcAehSgv3phismpBYLRozB6kHkOP81g9CAuEECPAnTkK2NYIBgdjB7D00eZZdSf
B0E6gB4F6EGWqOGnGcnYIC4QQAfQg1hgkGlGMjZKMjbIPIefZjB6EBcIoAPoQSwwyDRjexVZ9yCu
Psg0g9HB6EFc/cRp/vOJsteKjqx7rcVe2v6nn2dD10tnNKf2ICF6bpo//fj55y9DNKZTs8AUugPq
AXyDsu6fawH81+nnhz1+rPF5zQ/wlC6m/6lx+pVshxLSa+5mv/QK9ELZ0jLd5nFMjB+BlRONUaPP
89FDN8+/AjVhJRim302gp/vawT0pERLQVKb0Zf9Qp1KgWUYawbwDBxTlxMdA9alTAD0HdQ3oycYE
Jz0hcNM/RZPhFvqhvbVL3pOFqmeJROggg+rYoon5l+rEbUynj7wAWi2QsZrjsFqLjT8DNKHP8ZUj
N4dbtDcjfDDQtGDIf/rqsUD/y/Ve19hHO0brCikBGrisQd247FmNoVsAycMBLe0S8S1MKIIZoy22
wIqhoaWIMrwMjfurF2hdqnOgE+8loItvwIorIGu8t5Dv4j7f57CQJGJLcYFCjGQRfg0JoHOX7gea
F2NZemuW72P0lF8l+BVoeSqrvyyxWUvVwPXXXMBppCOAzHHp/Jn5CqA1+THyySVJxdxezDZMsH4z
wvILMNdNmZEWgdb1nldg3QLYFpDjvoQYaWGcHxnpDZ9K9FJzXZ//PGrEONR4qd+uVTuAXmuxl7Yf
J3Q/AaAbg/mIQC98juUxQa4q5dFAN746gyfT+G6NeRpNn/r6+TTZDTzTPpt6y06DP8+SZYg208fX
2sdUq3KgJrWsqe0/IfOFQDfAoluzU2+heB/Q+EnyAodpU4HZTWMW6MwKjwN6kVJGW/nSaLYKfX04
AI3fW2nfviFftyFfjaOdmDvy2c/EcH78/NLPhNbh8Es7aFhqpo/4pR/ykdN8V4UDYQFTYbIyGqXC
l3KKCez7RUgLIbnNSWfgvoxk0dqnNVheo+27E/KvzsDvUOH52tcy2JdNoynw0/stSOIXddS+jLy4
JoHEjVq2KrQhRMR17YPIOWAj3O7rQ0BB8luOYuxrDuhcJ5k+fnz5DWt1Y5EEvkp4Fr4R5GoxIyLc
8HYnRk3ftgFmNkqyNIiq6l9kV7zDXm9WnoMYPjDeBi7iEMPE+Cmn4Zsh/FPyClZIvZWmZR7hdK5b
+e9Po29FcANos6eGZ1yH7CtS1Id5ya7Z3dyCoRaYSGT9UcMzu5S1Er9pQwyMTiioj/kgY8sAMHue
0ZCvmVeohmIiCRzsAMt2Phn1ZQXEVb27ZjGQF0xZrkrcYCnP17R5oDlMVhxB/KYb6DQLABpnla2w
QtI8Xpve7OPewSUoZaxwAexkMFvie4G2PMeyJOGIGNF9pYZEeTaP5kSyCVFLuyQYciB6CjmXrB8W
EnIXwWRO7F4OrGNMwmV7pYGXYZbRvesKiNrThzh9pRki6zy/J7sM+mWgL1MFBzpVrVOF32KujkGf
OGmhWYf6m5o8cc6bJrKm0/L2ao20aLtkgRs2VjRkAL0EzbH37wP62HmskHZUAD1KzgrV39i0YSYr
UuhX2VmdhDJtTGBlm6pZtOxmtFTi7JMS1yTDHjQ51WoDFzJ5n82lE1GHFLRhVKMMCFf5oXta4tHn
lQMWll+DVTZNZ6cTx7lU62uFySTywNDyJbgsvmKFb+hlMhwgXBPzQJNo/QddAWjYsdsWVexRdVvd
aJnV6BI+Ztrh2C2gxUDdgNwXuudHJqs5oJk/WPWR5x4g7TUHtBjZaiICJtQpzIyyQzUvACobvEY0
CTeMgPQHQMpaS46Wk5bmt/8455FAW2D0dmYyYOhGMnJohKgGiwByTwuIHj5YFSwuYwlaXaKMyVDn
QGy934nzOV5XgrCpTZVya281NolAYhMv0/EkKfFIoIHRZlK0Gcw8C7mzjJ4Epf+zOE18SVddX2Gr
B5pbKl1FKoUgBKgdUYoATqx1DgTQUfoBHqQquxvZoqA5ytTxPqDnVxeysZidMJCZUS8Emu9JuNOu
9sQirHaleG9dkQ82BMOnqyos04CjxQpTHKaQJW1efb9cYNTBSarTZcuVru/qwNk8oOO8uU++syoZ
U64BnO6UhuObdw8xcQ1oYqAgOZ+Mib01DgjYzqEY9jkz5z7nwqz4NNgbHUZoDLo6d/WTqGjAHR/J
aI5Uch4Jh34CNC2J1E45gq+QUhwN2JLgE2g8DXs+dhjQIJ3jCziQhVJIxqQZxFx/SVOsjFQ2S/Fc
fLuKC3d4Q2Ifm6Q4VTmZujPiHc2OV2Fe/HEDz0iqXz5u2OONdarEcyfekn7UyHNyqtePGvRUTE4R
HrXuU8y6TugVC/e4Lr4Oi9e3vpPR3sludLntQ1d6blgyLmF0owRK6eMGX9Y+PtGuJbVW+qgbSDJi
/U1bKN0Q0C5cFJU3BtFuINsxNd7Ps2WSvJcrtmWFrEIPsoNuxq+porT20buBbttPDFDBRFxCbZQk
mTh5hiJAW7rMctW9HgY0zOduRidjTeaS3TJxiRll1+WokZpKB5sI80vJJx5tlRSqINp+FrblsINm
yABA5yusLXuEvTKvoZ5Cd3jFPgQT9dpI/U4MgFYAO7j5m5Pmk5Mir9pqO9B/1921QTorL0ucocbF
sU+ymLLIYhLL5js5cS2iWQHSyiUWGDUEA4254IG3vLaEjF8rmONId6xlYkAtp4NX3FzVr+pGcrdd
xK6XXb3KB75qAs3RTytfQlmBjqtUBDS0AoSBX9mqOQO0itFYDbTFkC7B3EpoSnWJKxIC9JwkeQOP
wJ4hzpvE8YQqfuuBRotgyGFVeXyJEwa2nxzFxgPBbInqADrnqpuz+IKb1B6ggcqloapAq6UNaIg8
NnkOPBaWeCIWY2vhqhaszDnSM/NENJVGttptHekyqNtA982cLegDuFhA7AC8BBIJBTLiQ5S2Irok
Y4qnW75VKMLtZscEyoaEONPy6DWhOwtBC0BDjnkmuXtOr4rQjTkX2XX6B1saCUiQm5GZ3WEuR0v6
JbxQMcRK2TDJKx1Omc+kqgLtjMhASz5JvuU1ykM35p7iIO78gkc1QZDP6eBucqkps4CytIu2V1u9
qBEKZkX6PlskbNV2od8pqpwidLMBtmkjRFs5bDbYtrFXjtnT/BxFzpHaM59amztLoFt1HqJf9wa5
s2EA/VC36cSvu1kH0BiCoEC7ZKA8chWR7FmhbWk6tovoaVm0mZ/szJ1uBDsbdlj7eKAlQ54ZvJUB
VAsMLMcON9ZioYrwvmCmf4exqGfZcDXQa6ew1P6BjOZ9TF3zc4FeQLIb6FL31UB3ErW7WXsfPW36
itMGA0L2vEUz6UP7VOogm2i6IHtzFgGFX6W735jLZZKmm1l7RvUaEW6b9vWnMCADNS9FEnlpNl4r
VxVQa0hpVFQl60BnmFg3gp0NG06a4CsqgBkkfFJQrQ5LDGOgxSp5BY2OH9R9MK77aivJ47ZWMYOT
CQZaR5qRVZkWRlxTBzXn2aDIBLTqnu5Ij3zO7ib5PUd44A3OaSkUr73fBFopAjiqkXBSYmB/tsFm
0MnL/NArrMwveFXBETUZaOIPkYhDBnpBUcpjs2sYkQiTORJzU0yPdwEojkasUqaFKqRxq8YMtYB5
D+lm0tYCudT+cKCVGmKI3FwJmNLx+aIkMpVegiugzFmP2bzKVQ8n+wp0hZDgYsEM0OoHCD5GL4uE
4rSOvEh2iAFMHFVmCbmV91vJGM/IRyGLNLoOKZmyAE6qVMxVBZotr0G8Yg8LbfLMGomlq4uIn0Jt
RRJdTd+q5njbB1oGyGvdwFTtWLShC51Lb3ezBqNzIGlVAaCz4wHGG5IfyFIk6dD8jUMuhF5VRbMT
CWT+bCOJcgmQHROoDqooJ0CQvulKP3cKQ0y1eeieSzyfcygNXpVkTDicW8OmJIOUQmnog3+2iNzS
Z1ntXOrRo2yXt71nNuvDBC1bs2jRsY8u+2wYZ7nLqUDvIslh+KwR1B2TOxuuGXsZrGjxWAtsYfRj
J/MSxTo5eGyzbkZXG56RNQhatj++BL8ZQ3TaZ65ZZ/cLZtitSa3hbOceqVkbSnWpBMJPdcNldugR
XFqtqjss25z41szdOSA1Kxt3dv9qoGsZKVQLGsY/xCwo/yig+1zsEPVXC2m5HO95lWbudfJgqXLp
LpVjuWyShaPk71Dj4xqxbc2xAmKt3W6ZC7Jul80N3PgcE+TapL7fdSv75Drvi9kWi9POzlR4U5/G
wbH9yQ6VIHZl/6vBxQ4L7wK14rtWs8hwZix+TfNwtT6sQHFctgqnVbAg7IEpiGXukUwJ1yVa6jVo
QaFU7lgvmTwXUpy0pAk3xWklBP20TQ+nVam1msrKM8dmWZ3SloGGuTNRuRAlNlHb5EAzBQEOZVeG
GSLmfKUCdy/QWnNLatAriF81SBDohWm3gYaxOZaxz6UbndAc2wymnkcGzx1ZPpl/YJO1QJNcR84T
gPZAyjQN6n6gNXjRepM74gyjjQZ5ENoVgTd3Xgl0ftCDrGa6Zqaw4rjcvwtoAYldtVgaKqGk4Y7q
KMuhO2fMZrD2dGwAzTmHxh57LSkFQyYZkYVu91YCaO1DNwwwWR2yJ42b7rgAg7bswjAxkkAB6ZrB
AecgRFFtlV7AYQ0nY6gS+7PEA839NC+RFV+c2J1l8AE2j9qN1v92t+xp2AK6p//2NrtHnhOwW/D2
OT24520l0J1wNPYpOyWfD9axWVantMdb5Xy7jzFCAD0GzpXy7MLEwTOaTjL73ifd6awYe8kdl+7b
nJZaLt131oF9+ap+d/jWqjVas2zSlPYrvLf0M7VaSTGpNtB1gy2Zcem+aqs6S1ps+TdsfOeBcAPh
C3qeGyEX1LmentFsB9BY/ikt/WRGs7ayF1KfLaCa9dIC1h5Xu+Yv3me8pKHg5xb/k7MHV/w3JPHM
iQuNymi/ObbNMpci3AECcUJ3yNkWGTgoG3fYMGtwcWcHuFme5iLhB3CCHTRMT/f+sNvmUir1tW05
vdCNNEwYzzj6HOHEmN4BNDk+vGWS458EKrCgFRBShbN6BOFPGlA0A40EY0RQkBijEC5+UhQfRa6u
PBMqVtK12guPjNjT3J0FXCsfDbxOVQ1PxLIpunmoUQPL1mmgh5lQy9h9QFv413AKcDB3mEp4KgHL
hlMIzw4UEKlMoZYapQtUJapQBoJAW2S3y4nd0NB3wFeTuDMW306ZTUa3gSZXB3vQfNM/+88YUdjN
81QODAw4q0zCMjFv/9yqlfFAXcmc6kBb2ABGzwANFdR3MlrKv96AiANHNR8rtwKNC4K4nw/zinGd
aKWeWbuM0X5+xn+N1Z2MdqRvMPpzq5N9ZzTr+JMcd7gh1pHMhpY7fedEzmg4CKHlFs8DqJ9GW2rg
BpAeMoIWPl3G7zIn8gZ7p0uyPI/ikzFppms0nG3UkzGJ05KMEe9pSqy7TpD9nSKcNDkDwU6Zq7ZX
EtD4dyPsZy3verlbw9UCqEPZja50gnJGs9UzAcz29L0G+t0arhZQBVoD0TWzro6yh9E3qv2NQ5/B
Y5O52mW/0cQjzGkR6MUGz7LSSnXx7YIykV4RHe06mtSX9OON2lAF60e4Mh+34uDgnTZZssBcMmT9
moNS8tz3U2sH1zpFdTbrU6nRqrlG15ToNUOPZqcB3Rr8VKCzVLXDWGbjk9foefG8OSQC68aSp6L7
Yfs7Ba30f9qb+rjLRFFpawtbcLcdx/MMOSaRCqg0VK1wc10eLnCF0tSsD8q1N9bKZlxTC7bGctyj
p7V2JlOIIiOaNXXLzX1OBnrJ+QkyBY59VK8mUAFWV4ziOChtUFSSgxFDnusNkwT98xojCgGR0AwU
zKYCfdn+ppGrzrrJU1M3FX5NM8oa55dm1ekgf0+QnG3TlG/Gp/XaFrAq0FKAknJ3as8dc1GGinMd
LEYXY5CRYBQSoqrBGLmXZJ30fbsKdqEFj5Nk4uQNSqeL9q8BDf3vA3oxdKufJmdxBiFXLlmmFy2z
QRBUDgkzD3JGajAaGYW5k5RTUaVMFzkeyQctgdY1ykZAHsu8ZYrFmUw+YzJeA+hnhW6edY3RuRnU
MWRy2CAPDxry7MYMoyFAWlgQVKzmLM2qlhWPLcDwF1h+RtK8DfjI+0O3JmNaoeeViuyoWRYGNjJ+
KxlLpwgaRidR9kJeAQv4KbwFwqVKOJKdI9Q6+dRS+3F4YSBBdqaWLBg4OTlFcWmovJD+Mhc0Cpyk
7FqDlzofUgJln8axKpe6N6hLOvfcr43f0+/GNjeG7t5ZB9C9lrqv3SGM7lb/XKcN6Q0LvDDEdbtV
NAQLLANdq/urgOXuYe1nWGARKW2gqSeW/as5F9RMpcyyOMwzrPHFWiyu0QKRbiZlD6rb5Mw6uv21
TaXCHKvobRZovjkQzxwEV67Vyx5Sd9BWKZJShSuZkTfcNs0YuOtTiZTEcsbDF7Lip0X5vOov63zY
+zYLHAO0nhloPK8E8GD0bSh/Bj4GaLdec4U4P+2I0H0nzt1Aa9l2wqtW1te/mqEAXk/Jbp3q2IMv
J2OSVOtOKR03VJMxgpiOOCBLk+eRjN3oa7HB/eK9M04tgA6gB7HAINMMRgfQg1hgkGkGowPoQSww
yDSD0aMAfeMePoa+0ALB6GD0he4WQ51ugWD0KIweZJ7DT7NxenV6NIkBLrRAhO5BuB6MvpBVdw4V
jA5G3+l/MfbRFghGB6OP9qmQd6cFIhm70/oXjh1AX2jsO4eKNXqUNXqQeQ4/zQjdd8bTC8euhO7/
G977v9EAsUZ/I6qVOUXovjB83jnU4kdbvMHh7zTgW8YOoN+C1E49l9foX9/A6dBxyQJNoH+dQC6B
5iu/Tj91+dBiSYHiPg1KD59fMMr8eKsHGa/DHqDnrSVAV/1kwcgKtDhR/ns8kI6YcQvoj4Wnf8Tb
9EgMZyIbbdNFbpLuQgvtyxJAjPaBEUgU/cc/4DXTFVaEuH6ECcaQ0UrGGGgCN3vkyKo3zAsSGGQ8
jvzW14vhPnCROjWBFl9T6Z8uO/OUIbrvARrAlCV14hkArVRNLFfo0WvMY8w7kgdYiDCvySSIRw2B
1M5JNoBOaVDJZQ2qBEwGWsINGA2wyw0v0tyCXCEBLDFEYkIRJcxppls7bTBE9xbQEkjnQncFaIaq
FrqrK4BAS65hDww3As3e4x2LvGIIpHZOspGMCWiYKlECpNRL6Eh6BdkWtpAQXIgh+SRP47REY1kL
gPCcfVlWyBIpsh/28/vDJD1K0HLB5FHqojIcNh6r37MUe3EJ1IDeGdWG6P5iRj+LMU/X5sWMfrpp
S/3uDB1fwmj7pNlk3uas8ObO6bvuO2Wd7LcN7fS7N0sVuJd8ueYqHfkbNyY4+NP84evrZtVZsKIA
LYqZRmXHw4EuB11lkGsaL3xe94wSMLXVfqxAS8/895aJzzP6AqBZ4WVL3Bq65wc32vJnrNsnM8tH
OnOUxC/WwG9X/kgov+Fx+mBv+s8bSPGWL9928UJEUSCg+Fx87WUSmsKEfUWkvlQlVZQOYEpSjBHZ
qv10BVcEei1fyimDFl9hCW2SqFuBnucPhW6aoP9ybAGJJ89NZHHM+8CHtFOTJtD5eOoNRcS1Ye27
PfRLPxSX9EQjUNlH8NM7hI7C6r83xHwTmmXfNGLzdW22BKoD+zTiDfOGsZFPXKfISxowJdgj5EZh
GrhPfcUATDIWZr/K76xlX8NRKx/yr4FCLQxMdG5rLtwEGvpgDHLOioOSYcRnzKGJKbf+LK7RyAGB
FxiNEQ2+p9uxQuaoX85tOKDXLAAtxPRczeA2csnaYO7nv+QDXcDFooyG6nSw2GwAOmn/1NBN/DFG
m/NrKBSCiivPhkZ1dXYS4rVb+YoIovRH1sHqC5ohibzYOaBxGe8C2thqA9iwOCgP6X8t7PlOZ/si
o+1LrX1iJcZJcbjyJRrCLfz6DfUcRtiFbs2uNB/A2ynxkYjCoQHSK0nMWJlKnJHczevKzmVKuiyL
N4A5iCXQnAEKmKa4+nO69FBGn+5kCwMsrWrt+0u924NXelvAudswm8Z/cAl0Cao7gF7SqY3BLKP/
5nyuPxjoTY774E7ng9kaIYC+zDVuBnrFPJfjVq3Fcq+KCoudFhtkQqvtG0LWyp8StNmFfYWNT2u6
htFuIt2WWzYZtJCnZeaTNSqkuoKpbgnUbg11qz1xuPoM8qulRrIrZCVuZvT88IVzrYKsbWIne22K
O7VfNHPWYh7o8k4mv7Oo9WKg4dDAHxW4c4Nsf5t3wn32xxZyauDOC6RkJocSelrgvqncnUFY9RU2
57ajl5FsdGrmDywSNgwQ6E06WoFchPC52ySbCqKwJ8cXUEJANR/LaHZsmhKZhC4VL9Rgvswtra2X
yCrb8RpXE0DszypZKBPQyrT0pxlOjtEWIXYD6fpBBmCAkyr63NxMBGpdGy4ksc8FWtxRDKkoOBcQ
32fT+xoVHBkqNGQkOC8QTuUokV/pXYUGTcrEM1pmBXeisRa+5Sm4Te7C+YkKoFzV289fiYAlXprs
zUAXK3GxuIKB1cRMTeG6hEAt/FsYcHHAMxoL6exMNapbYNfIkvW0+KsE83BpFPJhid0jv2iOxG5C
jgIsdpFtTivP6Hk7X3Nn8RvheTUqoidaIxnMB1OcJd7JQqAtBV4AWDJbN3QkF815pc1G0gOQPUDr
zDF04xLWB/TtjG5k3WUypm/zssCUHzZgLBUBkANZILT3MnB4lgXBwut0Q5IiDLYanm1wO7NQ1SRg
10O3plsureOFJ0sI1Nkn7Z3edEEdHU6AaNWxOd17pPHbbxq9Tg8gK0Za0fR0tb9lgOts2juS7mu+
xcTPmMeaytgzNB5IiyPz9F6eDWTe75zqAqNrfrDWNyBXARvOSOkQ3tFE91sHg9ZZDa2OqlvPfp0u
ZPQ2oF0vfoHXZO8Fu16ZfQeKNemF8TrkLBi8ImFZqLSgEonzay6b9sN8bMsF3S8C2ua0bMviPGOG
P3vttAVoBbfauWNue5We798K3bKpnDaLVKeobYzTXjftGqmBNINLqeZALq731eVp25weVYAMRKYB
ybj7lYozCi6UzLrLS1WIal61kWE7n02lspcW71NGa4SSeaW9eDaWasM2YE20OnBo6G7/SU7tkKG4
lhyBXMEeyTP4knuRFZO1VSnGKODls9eRdDcw98AwiffZ/KkVX1cvzuWwbxOEC1MpmGxurKVT0qmq
DQ3hNEmaXgs0k5S9cdspxWqgoZrFwSCzEFkFTGc9+JmdhmTFUqhkoc8J8I7JkkFVgFaC6pEJz1LJ
zB6ietaABrU5ynCAvB5o0lvK+hlv5XLDIEqynPeuRmzAWRRo9CSUM47oCiPMycgILzPPy4ORsFkD
0jzQbB2MFVncaAENcnVMZvfljFabWABzUU4tfnzoFh8rXaQKdM7PPOr2Ag2Vblx7dX+EQd15gLku
eIo5ZIXRFaBFy8/vQ0O3BJrKb5dZ8TrCTILEi4HOMhRydFl3OCrJJSj3k/tCYHCpFSMN0VQWv5zR
MJaGbokIcAxhikjeaHrmI1PyKPSEqUiy5ExiE6Z1mFcO1BOSMZVsNgZpbuQGQGtu7SiBig3WDPeg
trn61encO8dDGb3izYEZSvcaYbfLjAb0boOFgFdYIL4l58j4+GBZL4+/ryDTI5QMoB8Bw/lKBNDn
2/gRI8Qa/eB19UjVAugjrflgWRG6HxFYz1cigD7fxo8YIUL3g8PtkaoFox/Bt/OVCEYfSZsHywqg
HwzOkao9Ceh/P3JiIctb4ElABzYnWiCAPtG4TxIdWff5Ce/9I/zD571NT/K60OU8CwSj7+fbJRoE
0JeY+f5BInSfFy0fJTmAfhQc5ykTQJ9n20dJjjX6/uXzEg0C6EvMfP8gEbofFWDPUyYYfT/ZLtFg
xx/ZXaLfLYOcx6v7JAfQFVe6D47zRm4A/fvp54c9fizyec0PP9Kz9H9qNZkrPaQGqV26IS9JjDSC
DjAIduaRJunUSfrTExEnzUgvvqN9QBNTXqdAUnhQnc001nnmvk9yY41W3MAINaATDA5ohsZ+wV1u
KR3Y0Eorcxbuw0DLdfOmAiHTQp1DxKqDqteQi6rjmdvqAKrSdzxpMVoIit4+WUdRFbNVgRYI0V8K
RvPNGowqPPlRHWhyMcNLnIOuap/0XDWXZzYRlcGS7uPdeSMvhm6zIxtPDGimqzNauYoxmwOs2liA
1hhqzuWBlnXAFgQFNYDucY9eRhMSxiBijEY/H7pTYwzKyjnlPneY2skSr7Ha8RS46VgtI5IEGEx6
J93MyZwc9Vk/J5HZY7i3tekFWokNEM4CTctn9ijkpXsGdBmYOddSvC2G5IsJ519uMAc0rNs2DrkA
KKGpHev9NhB79F2ZjAF4LmJ6RhMeGY2rQHMj5Sq+BmKj04Bk8BZTgD1RggpoJndYtTIcmRrfkYDh
LFYArekNQJbA5O2ObWaEeLj5kdRIQ25188VxWBDkqC4DJPeBJd+HBcGPAWTVPNAcy+meyNImzl13
YP23O/pu6fqXHZ2iBNphpG9oEpWxCoo9a97b2gTQ83R9G5ZNfQPoUYBeu/58c2a61hZvat/Kuq3k
z1kq7z7t0EKTV8mG4TzDjjqofiLS+FRCN2AgW3JubGuJtpOgxxpwvlHZDViBxg9P+Tsk8dkr2Zm/
Ccq2rgvbK9kLJ6TSDhZ3x4IRb1CddbSdbYdJE9gTG8bcGu5xY1RAO0u5RbZx6jQ6gN8yO7VNMZCt
09M5fFvkWtpH+8q2K3dZEXQN0EA7q6hqrQpcgdET2XCWYuUucx10EZZGAnhvbP7pXUe2zuaOqOD3
ELr1t1dgIq0YOspptZtjIEVCoFkqLQq5sB5NMZpvpQbyQDFVpEA0uAHoUbLuAuhKaczF5cwLXJ1Z
g/YMo632jAvANqBheTFGF2u0ky3BxTnqdwE9H52uAJqJzXzOo6bdhSCcuwwW1UGAeJ3Nwm5yBEq1
Ww7w2fHIFyZj824Lixk7PCVkWb7CodmnWWD9+n30IitOO/GWMZNs0UdGkkXCUjNcNqQ5DGTSRaf8
XAOG+IzyXYxuAJ1tr9LqWQNaTzVgdcWzLbtPvZFJljHZboeX73xr5LdXwDlWStMDSRnpgqUJkKzn
Id37HTvzKEB/Ucq5bSrfBfQ2G0Svt1kgjinfhthGfeNQgwz3VWG6NpkAehSg2/to3WLp1jNLm/kl
v59P35xDzSXp1Tft+JMEza6loibvNNVmJF1kFWJ0S6cVOcroOT+XrnKmAv21pw25MSS+pdvCu0Ad
0K7GzBsSs7VuqKZNqgFt+1/GnXvY9hou6D5WBfCV/ERF8XF7Y3lfmttZkwTfztww4fS5+f2hu4vR
VmDw1RJD29CSsrUYFx3AjjHM+EYuKXkzMvqGXCmPWrlbyye4r9cBfa1sBuii/vIWam7Us5V166GF
1KWccaysIZESuWooNYDWigzzyo6dZGgBEk89COUcv8JztCsdnsgRimM9aL7Rfq/pth1ojnlWoZJl
nPC20AzXFxktQVYEGNBCayecbmtc5pcNRtuhhVtpXgPXdkW7gObDhZlys5hXltMq0NxXzw5mQncf
0E6fVUBnhVNQebsJ39Gzub2S3EiXYliT7WkGtHEZ+IYW9ScJSkkJx34M9J78CCILJlleiKcalWTM
rSgjJGPz6WaeLxt14FQisy6jhDmSO96gQGvbH32HgaXRmTPxHonyZFxTxQvJU+S4xZrbzgy2VxDo
5RCFZjBy1v2OkBRa9lkgKmNkp2B0n79Eq6dbID5Q7uu5TBMMoEcB+ukhJ/Q7xgLxxoNj7Ph4KRG6
Rwndg8xz+GlG6H580D1GwQD6GDteK+Uv1g8XQK+32St7RDI2yOodjH4lP9cr3WL0z89z9p8iAm0E
5XWGC6i3If06oKM8PwzQvwWpN2D9zmTsnVqvz6AO7PHC0L3BnaPLb8GNA1nzZFHB6EHYHkCPAvST
w03odpwFgtHB6OO86dmS/vHZ6h2k3fsZ/VeDUHLnNF8H9H/vnPCo3WMffVBofLqY1zF6VEbunXcA
vdeCL+kfofvpMfcg/QLogwz5dDEB9NMROki/I4H+40E6hZgTLBDJ2EuSqb1qHsnoE/wwRB5lgWD0
Xqq8pH8A/RKg9qoZQO+14Ev6B9AvAWqvmgH0Xgu+pH8A/RKg9qoZQO+14Ev6xz76qI3qw+UE0A8H
6Cj1AuijLPlwOQH0wwE6Sr0A+ihLPlxOZN0vyZr3qhmMfjgTj1IvgD7Kkg+XE0A/HKCj1Augj7Lk
w+UE0A8H6Cj1Iuvem86+pH8A/RKg9qoZofuo2PhwOQH0wwE6Sr0I3Xtj4kv6B6OPoszD5QTQDwfo
KPUC6KMs+XA5AfTDAdql3r9Z7wB6lyXf0zmy7pdkzXvVDEa/h5S7NA2gd5nvPZ0jdO+NiS/pH4x+
Dyl3aRqMfgkj96oZjN7Fk/d0DkbvpcpL+gej30PKXZoGo1/CyL1qBtB7LfiS/hG6dwXE93QORr+E
kXvVDKD3WvAl/QPolwC1V81Yo9+zzO7SNIDeZb73dI7QvTcmvqR/MPo9pNylaTD6JYxUNf9nm8LB
6F08eU/n8Rj9r9sY8fZe4wH9dsQ26h+h+z3Rd5emAfQu872n88BA/9d7UDpA01ijN655b+sWQL8N
sY36HhK6/+OA0BIizrVAMHojQ97W7f8BPj77yExL89EAAAAASUVORK5CYII=
------=_NextPart_000_0009_01C6F09B.9C6E4FB0--

Received: from bannerco-op.com (L8370.l.pppool.de [89.48.131.112]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9G13K4p086763 for ; Sun, 15 Oct 2006 18:03:22 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000001c6f0be$c7ae28d0$6790a8c0@bqnmsb>
Reply-To: "Paulo Cuffie"
From: "Paulo Cuffie"
To: [email-masked]
Subject: Re: VlkAGRA
Date: Sun, 15 Oct 2006 18:02:41 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C6F084.1B51C1D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C6F084.1B51C1D0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VlkAGRA for LESS http://www.vokoliondefunhasdeinter.com

=20
professional here-do you have any ideas?
attack for the moment.

------=_NextPart_000_0001_01C6F084.1B51C1D0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VlkAGRA for LESS http://www.vokoliondefunh=
asdeinter.com

professional here-do you have any ideas?

attack for the moment.

------=_NextPart_000_0001_01C6F084.1B51C1D0--

Received: from V560d.v.pppool.de (V560d.v.pppool.de [89.57.86.13]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9FKV7lD062041 for ; Sun, 15 Oct 2006 13:31:18 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000a01c6e273$d6de5810$0d563959@gxok4relg2448pq>
From: "Davies Arsene"
To: [email-masked]
Subject: Mann Englands
Date: Wed, 27 Sep 2006 22:30:58 +0200
MIME-Version: 1.0
Content-Type: multipart/related; type="multipart/alternative"; boundary="----=_NextPart_000_0006_01C6E284.9A672810"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2869
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962

------=_NextPart_000_0006_01C6E284.9A672810
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_0007_01C6E284.9A672810"

------=_NextPart_001_0007_01C6E284.9A672810
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Ashes urn heads am is given am vip treatment as of it flies out Extras =
from encounter Sundays photos am Holland targets.
Edge Golf in Brand maiden seniors Rugby Union Bristol over Quins in =
League Anderson salutes Saints Swimming in Dutch.
Newcastle Bolton Hibernian or Hearts a Motorsport Rossi top after Hayden =
crashes am Gronholm closes gap with win Tennis of.
World Service is Radio schedules Latest sports roundup Football or =
Keeper Cech has am surgery on skull Newcastle.
Back his best day calendar Sporting a Editors blog Defensive errors a.
Kevin Davies a Arsene Wenger Louis of Saha Garth Crooks in team weeklook =
at Garths selection then choose own England.
Thankful edge Golf Brand maiden a seniors Rugby Union Bristol am over.
Targets or Addicks of revival Brilliant Rooney is back his best day =
calendar Sporting Editors blog Defensive errors cost us Roeder Venus.
Unionrugby Other and Your Saysport in Fitnessfun of in Related Sites =
News Weather Last Updated!
Helens historic Ashes urn heads is given vip treatment as it flies out =
Extras.
Golf Brand maiden seniors Rugby Union Bristol over in Quins is League =
Anderson.

------=_NextPart_001_0007_01C6E284.9A672810
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Ashes urn heads am is given am vip =
treatment as of=20
it flies out Extras from encounter Sundays photos am Holland =
targets.
Edge=20
Golf in Brand maiden seniors Rugby Union Bristol over Quins in League =
Anderson=20
salutes Saints Swimming in Dutch.
Newcastle Bolton Hibernian or =
Hearts a=20
Motorsport Rossi top after Hayden crashes am Gronholm closes gap with =
win Tennis=20
of.
World Service is Radio schedules Latest sports roundup Football =
or Keeper=20
Cech has am surgery on skull Newcastle.
Back his best day calendar =
Sporting a=20
Editors blog Defensive errors a.
Kevin Davies a Arsene Wenger Louis =
of Saha=20
Garth Crooks in team weeklook at Garths selection then choose own=20
England.
Thankful edge Golf Brand maiden a seniors Rugby Union =
Bristol am=20
over.
Targets or Addicks of revival Brilliant Rooney is back his best =
day=20
calendar Sporting Editors blog Defensive errors cost us Roeder=20
Venus.
Unionrugby Other and Your Saysport in Fitnessfun of in Related =
Sites=20
News Weather Last Updated!
Helens historic Ashes urn heads is given =
vip=20
treatment as it flies out Extras.
Golf Brand maiden seniors Rugby =
Union=20
Bristol over in Quins is League Anderson.

------=_NextPart_001_0007_01C6E284.9A672810--

------=_NextPart_000_0006_01C6E284.9A672810
Content-Type: image/jpeg;
name="has.jpg"
Content-Transfer-Encoding: base64
Content-ID: <000501c6e273$d6dcd170$0d563959@gxok4relg2448pq>

/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a
HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy
MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCAH4AegDASIA
AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA
AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3
ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm
p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA
AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx
BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK
U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3
uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD33aaN
po49DRx6Gosig2mjaaOPQ0cehosgDaaNpo49DRx6GiyANpo2mjj0NHHoaLIA2mjaaOPQ0cehosgD
aaNpo49DRx6GiyANpo2mjj0NHHoaLIA2mjaaOPQ0cehosgDaaNpo49DRx6GiyANpo2mjj0NHHoaL
IA2mjaaOPQ0cehosgDaaNpo49DRx6GiyANpo2mjj0NHHoaLIA2mjaaOPQ0cehosgDaaNpo49DRx6
GiyANpo2mjj0NZcuu2gmeCziuL+4RijJaR7lVh95WkOI1YdSrMD045GWo32Fc1Npo2msjydcvOJr
i206PoVtAZ5PXIkcBR6EGNuAecnjRtbaK0t0gj85kXODLK0jcnPLMST+JocUguTbTRtNHHoaOPQ0
rIYbTRtNHHoaOPQ0WQBtNG00ceho49DRZAG00bTRx6Gjj0NFkAbTRtNHHoaOPQ0WQBtNG00yKGKC
FIYYljijUKiIuFUDgAAdBT+PQ0WQBtNG00ceho49DRZAG00bTRx6Gjj0NFkAbTRtNHHoaOPQ0WQB
tNG00ceho49DRZAG00bTRx6Gjj0NFkAbTRtNHHoaOPQ0WQBtNG00ceho49DRZAG00UcehoosgEx7
0Y96SipGLj3ox71T1S/XS9Lub+SGWaO3jMjpFt3bRySNxA4GT17cc1XsNbgvtTutP8ie3ubZULrM
FwxZVYhSGO4rvQNjgFl65FJySdiHNJ2bNTHvRj3rOsdZt7+6kt40lR034MgAD7JXifbzzhkGfQOm
euKqJ4kFxOYrLSr+7xGJd8RhVShd0VgXkXIbyywIzlSD3pc8Re0j3NzHvTY0KRqrSFyAAXbGW9zg
AflWU2tyb1hTSL+S5EYklgVoQ0SlmCliZAp3bGxtJ6c44qK58RSW0SyvoWqGMyJFu/cr87MEC4Mg
P3jjOMHqCVwSc6B1IrX9Dcx70Y96yG1wx+XFJpd+l5NvMVpiNndV27m3K5RQNw+8w9BkkZY/iOAR
x+VZXk1y1z9ka1VFSRJRGZCDvZVICjOQSDkYJo54h7SPc2se9GPessa3B9hnuJIJ4pYJlge2YKZB
K23YmQxXLb0wd2Bu5IwcS2eoS3Mxin028s227lM4RlYDrzGzAHkcHBPbODg5kNTT0L+PejHvVB9W
tYRqDTlolsF3zF1/g2bt6gZJX7wzjqjDtTV1m3eyguQkuZpxbCHA3iTeUdcZwdpDFiCRhGIyBT5k
HPHuaOPejHvWd/bNu2oXNhEkstzBGz7FAG8qFJVSSBkCSPrgfOOeGxUXxBcPeSWi+H9UM8caSOu+
24ViwU583HJRvypc6E6kUbmPejHvWQdeV3kNtp9/dW8UjRy3EUahUZWIcBWYO+CD9xWz0GTxV6yv
I76BpolYKs0sJDDnMbsh/DKnHtTUk9hqcW7JlnHvRj3qhFq1rJoSawxaK0a2F0S6/Mqbd3IGeQPT
NRQa3HJdw281neWpuWK2zzxYWbClj0JKHaCcOFPtkEBcyDnjpqamPejHvWd/bNv/AMI5/bmyX7N9
k+17MDfs2b8YzjOPf8aqN4guEvI7RvD+qCeSN5EXfbcqpUMc+bjguv50OaQnUijcx70Y96p2N+t8
bhRDLDJbyLHIkm3IYxpJj5SQcBwOvUHtzVumnctO+wuPejHvSUUxi496Me9JRQAuPejHvSUUALj3
pkUMUEKQwokcUahURFwqgcAADoKdRQIXHvRj3pKKBi496YYYjMsxRDKilVcr8wU4JAPodq/kPSnU
UALj3ox70lFAC496Me9JRQAuPejHvSUUALj3ox70lFAC496Me9JRQAuPejHvSUUALj3ox70lFAC4
96Me9JRQAuPejHvSUUALj3ox70lFAC496Me9JRQAuPejHvSUUALj3opKKAH8e1HHtRhvWjDetWSZ
HikM3hPVo44pJZJLSSNEijZ2ZmUqAAoJ6kfTqeKz7eynurnU762RoLn7bHNayTI0e9DBBuQ5GQrb
SpyDtIzjcgxvX97Dp1o1zdOwiVlX5I2diWYKoCqCSSSBwO9Z/wDwkVj/AM8NT/8ABXc//G6xmo82
rKjhKlX34xbXkv67mDDDqUnh+21Kwt57S/a5vFVLiIiSNLiWTbuQg4Acwux7KjYyODLc2NhY660U
sGrR2kenW0FubH7UVwjS5UmHqQCv3uefc1qL4s0l0gdft7JcY8lhp1wRJlSw2/Jz8oJ47AmrE3iD
TLbSZtTnuGitYGCymSF1eMkgAMhG4E7lPI6EHoc1mlC24PLq0bJwd9Fqnq9tvP8AMzJhpiRW8ixa
7CfLPk3Ucd08hwzcOMFm2k5AlUrhuMgsKlnF9d+HLUzxSvP9vt2GY8O0S3SFXZQPlJjAZhgY54XG
BrX2p2em/Zvtc3l/aZ1toflJ3SNnavA46Hk8Vd2mrUL3SM3QaV3on5f1sYl00mm66+oG2nntbi2S
GV4E3tCY2Yr8gyzBvNI+UHbt54ORk3Vle6prlrqKJeWCPcxxRuqKZBEkFwRKQwYIGabbtYZGBnBO
B1cs8cMkSO2GlcogweW2lsfkp/KmrdwPdPbLKpmQZZPTp/LIyO25c9RlOKel+oOg5em5iR2v2K3v
7XUILq+86T7S1zGnzSgFVDYTGySNVThcE7AyZbIV+jzOdRMNo+oyacIWL/b4ZFaJ8rtCNKodwwMh
OS2Nqj5RgG9JrdhExV5ZBtSVyRC5UCMkOcgY4Ix+I9Rm5NPHboHlbapdUBxnlmCgfmRQuV6p7Few
lFrT8Nf6/rc5/XbG6n1VIoIGkttThW0vH/hREffg45UPG865/vbOV60W9jdL4mFsYGGnW80moQyj
7oeRdmzJ5JLPcuRzjdHyB8tdJVFNXs5JzEGlBEhi3tA4j3g7cbyu37wx15PFElFO7ZKw/M+ZX/r/
AIOpz1nZarFfWuuybStzcs0tutswuFhm2oqvltuVCQbsKMCNuTzu3IIpB4ov5jGwiaytlVyPlJDz
kgH1G4fmPWr8M8dwheJtyh2QnGOVYqR+YNVZNY0+KRke5UBCVeTBMcbD+FnxtU+xIPI9RQuWKTbH
DDtOyT/rQzNLvm0fS7bSrmwvzcWsYt4vKt2kW4VPlRw65RNwAOHZdueePmLNK0CGW2uJLltRile9
um2pfTxLgzyFSFVwACMHgc5z3re+1wYuCZVUW5xKzcBPlDck+zA5povrc2yXHmfundUB2nO4sFAI
6g7jgg9D1xii0er2EqD0urpaLQw7exun8BaZbrA32u2trWYQP8jM8Wx/LOfuklNuT0zntipru5k1
k21lDY3kQW5iluZJ4fLWDy3EgHOBISyBcoWAznOMbtp5445o4nba8udmRwxHJGemcc464B9DUMmo
2kUbSPOoVZDEDg/M4/hX+8eowMnII6gihqK0bGqDaSXaxzu2X/hEf+EY+zXX9o/YPsO77O/k7vL2
b/Nxs2Y+bruxxjd8tbM8Uh8UWEwjYxLZXKs4Hygl4CAT6nafyPpU6arZSIWE2CrojIylXQu21Qyk
blySMZHv0qS8vrewiElzJsQ7sHaT91Wc9P8AZVj+FC5bXv2GsPJe7bt+GpX0yHyr/V3xIPNu1f8A
eJtB/cRL8pz8w+XrxzkdsnT49qpWuo291IY4/NSQDdtmheIkdyAwGcZGcdMj1FPmv4ILy2tJJds9
zu8pdpO7aMnnGBx61cZxUb3KVKSfLbz/AFLXHtRx7Vn3es2VlPJDPMyyRwfaHVY2bEedu7gHv/j0
qS21O2vLiaCGRjLAEMqNGyld4yucgdu3bvT9rC/LfUfsp25raFzj2o49qzW1yzErRq08jrncIraS
TGGZOdqnHzIw/Cpk1O1kt/PSdWTzFiOAcq7EAKw6qcsAQeRnnFCqwezG6U1umXOPajj2pPm9aXDe
taGYce1HHtRhvWjDetABx7Uce1GG9aMN60AHHtRx7UYb1ow3rQAce1HHtRhvWjDetABx7Uce1GG9
aMN60AHHtRx7UYb1ow3rQAce1HHtRhvWjDetABx7Uce1GG9aMN60AHHtRx7UYb1ow3rQAce1HHtR
hvWjDetADIi5hQzJGkpUb1RtwB7gEgZHvgfSn8e1GG9aMN60AHHtRx7UYb1ow3rQAce1HHtRhvWj
DetABx7Uce1GG9aMN60AHHtRx7UYb1ow3rQAce1FGG9aKAG8UcUv/AqP+BVIzF8UIZNGRElaJmvb
QCRMFlP2iPkZBGR7girtlaT2u/ztRurzdjHnrENmM9NiL1989KuHp1qpa6np99PcwWd9bXE1s2ye
OGVXaJskYYA5U5B4PoaXs225Lobe2fslSt1b/L59DmLdbh/DnglbWWKKc+VteWMyKP8AQ5c5UMpP
Ge4p9yJLa3ngvmX+0J9UtLhii7Y5UE8EYaMEk4CqgYEkhj6MpPSRanp9xpp1GG+tpLEKzm5SVTEF
XO47gcYGDk54wafc3trZeT9quYYPOlWGLzZAvmSHoi56scHAHNR7CXw9dvwOn6/7yly6b/8Ak3Nv
bb/hzlbrSJrK3QznMFnd2lrYDj5YTdRMehz0Ecfzc/ud38ZrsuKry3trBdW9rNcwx3Fxu8iJ5AHl
2jLbQeTgcnHSmR6pYS6lLp0d/bPfRLvktlmUyovHJXOQPmXnHcetXCk1ql0/D+tDCtiZVklLdN/j
b/K/qyPWI3fTJWjRneEpOsajJcxsHCj67cfj0NY7zPaQL4gjhaYzSSny1/jjcKsW0dcsYoB3xvbI
Hbftr21vfO+y3MM/kytDL5Ugby5B1VsdGGRkHms6Xxb4bt3CTeIdJjYqrhXvYwSrAMp5PQggg9wQ
amWEqVZPlTuvLbsyYV1CNmv+G6oy9WWGwtI9Oa4jaWLRLmMAkBmwseDjPfYx/A+laGqatps9iPJ1
C0k8u4t3fZMp2qJkyTg8D3rZmmitoJJ55UihiUvJJIwVUUDJJJ4AA70GaJZ0gMqCZ1Z1jLDcyqQC
QOpALLk+49ay+ry97lej8uy9S/bp8t1qtd/P0IrW/s73f9ku4LjZjd5UgfbnpnHToa5uKWIxTxpq
XnXKXszppu6P52WdmUYA3jkA5JwOpyoIrqY5opXlSOVHaJtkiqwJRsBsH0OGU49CD3qCTU9Pi1KL
TpL62S+lXfHbNKoldeeQuckfK3OOx9KuVCdT5J9On3/8AmFWML2X9fd/kZ+k6nYRxyWsl7bLcG8u
F8ppVD5Mz4GM55yKjtb+0s9HFleK0l1HG0ctr5ZaS5YZDMqHlwxyd3Q5JOOcamoanp+lQLPqN9bW
cLNsElxKsalsE4yxAzgHj2qjL4t8N27hJvEOkxsVVwr3sYJVgGU8noQQQe4INVDCV5RXIr9Nn5Cd
aF3dbu+//AKNzbXMC29jMWml1Czjs5ZRk4KE+Ydx7lHkYZ/559DnFWII3GuJYbGCW08l8r4zlXUg
AnoMvJLjviPoc5q7H4g0WXTZdRj1ewexibZJcrcoYkbjgtnAPzLxnuPWn3OtaVZWEN9danZwWc23
yriWdVjkyMjaxODkAkY7VKwU1LZ79u2tvv1KeJurNf1tf7tBut/JpFxcrxLaobiM+jICcfQ8qcdQ
SO9V5oY9Lm0538xrSFJI3cjcVkbB81yBgcB8v6uexJqeTxBosWmxajJq9gljK2yO5a5QRO3PAbOC
flbjPY+lQDxb4baB5x4h0kwoyo0gvY9qswJAJzgEhWwPY+lavB1ZNyUX22e6ZnGsopR9fxRVvnGp
Xa3NiGlggERlkjUlZcTI42kff2BJOBnBbA5JFR+Ibu21LTH+w3EVyII55ZTC4YIvkSKMkcDJYYHU
8+hxv2d7a6hapdWVzDc2752SwyB0bBwcEcHkEfhUks0VugeaVI1LKgZ2ABZiFUc9ySAB3JArnnhp
NuLer30NY4hRs0tttTMVbmDVYp9RlidfLMMMkMRjUM7KSrgs3Xau05xnIPJXLdUtftmrW0IfY5tJ
2jfGdjrJCVbHfDAHHfFXtQ1PT9KgWfUb62s4WbYJLiVY1LYJxliBnAPHtU6zRNcPAJUMyKrtGGG5
VYkAkdQCVbB9j6Vbw7cNdn/wOpCrNSUuqOU1VDbWtxPdlYp7nTrySUMw+V28lVTPQ4G1MjrjPU1o
QIZry/v7IrLLHcrs2sCJYmhhLKO3IAIORyBzjOd/A9aMD1rNYb3r3/q39Mt4n3bW/q/9I5LQtW0+
O7uriW9giiuELxNK4TePtFwcjdj1H51cmK3clzdRP5dq9xZqrOrBZXWVSXXjkMCihu+30ANdDget
GB60RoSUFBvb+u/mEsRFzc0t/P08vIOKOKP+BUv/AAKuk5hOKOKX/gVH/AqAE4o4pf8AgVH/AAKg
BOKOKX/gVH/AqAE4o4pf+BUf8CoATijil/4FR/wKgBOKOKX/AIFR/wACoATijil/4FR/wKgBOKOK
X/gVH/AqAE4o4pf+BUf8CoATijil/wCBUf8AAqAE4o4pf+BUf8CoATijil/4FR/wKgBOKOKX/gVH
/AqAE4o4pf8AgVH/AAKgBOKOKX/gVH/AqAE4opf+BUUAHPqKOfUUfjR+NMDD8YZ/4RW93kfZfk+2
f9eu9ftHv/qvM6fN/d5xWfrX9lf8U1/Z32P7d9pi/srydv8AqPl8/wAvHGz7Pv8Ab7uPm2V1f41V
tdL0+xnuZ7Oytrea5bfPJDEqNK2ScsRyxyTyfU11Uq6hFJ30bfk7q1n5d+6utL3JaPNV/wCJH8JG
U8abqPh8uHPC29ybZRsGOAspy3QfvN2SzSqB1vi+wi1SfQLKZnRZdQcCSMgPG32S4KuhIOGUgMD2
IB7Vuy6Xp9xpo06aytpLEKqC2eJTEFXG0bTxgYGBjjAqeSCGV4nkjR2ibfGzKCUbBXI9DhmGfQkd
62qY7mmqiVpXk/vVl811/wAxKPQ841eHXrptP1aSJI9e8+e0sY0XCI6WVyCyiToJJgSCTho1hJGQ
a0tS/wCEc/4VzZ/2J9j8j5P7C24/4/Mnydu7nf5n3t3+3v43V2skEMrxPJGjtE2+NmUEo2CuR6HD
MM+hI71BHpenxalLqMdlbJfSrskuViUSuvHBbqR8q8Z7D0pvHKXJdW5drbaN6P79H010d9DlOR0L
/iSx3OrLxY3Op3seoZ4WDbdT7bjj/gKOSD8oRiVWM5Phf/yLs3/bn/6b7WuxNjaG1ltTbQm3m3+Z
EYxsfeSXyOh3Ekn1yc9azpfCPhq4cPN4f0mRgqoGeyiJCqAqjkdAAAB2AAoli6dSNRTTTl130Tuu
q9PuDlatY5FJ4TpSWOh2n2vTJ9cWbT4rAx/LBAyTSugZlGz7QjpksAPMXbkbFa1byNbfDi3uWheC
+8MKW8qQjfm3VlIYAkKZYc/3gomDAthSe5MELTpOY0MyKyLIVG5VYgkA9QCVXI9h6VG9jaSR3Mb2
0LJdZ+0K0YImyoU7x/F8oC89gBQ8cmkuXS93rdvo797rfTV+ocpX0fTv7K0qG0aXzpV3PNNt2+bK
7F5H25O3c7M2BwM4HArltN/4Rz/hXN5/bf2PyPn/ALd3Y/4/Mjzt23nf5n3dv+xs4213GPeqsml6
fLqUWoyWVs99EuyO5aJTKi88BuoHzNxnufWueniLNud7tp3Wjur/AHb79OzG12OX8KeZ/bdx/b/k
/wDCTfYbbrs8z7N5ab9u3jb9o8/OO+3PGyr3iH7L/YMP2PyfK/tez3eTjb5n26PfnH8W/dnvnOea
2tQ0vT9VgWDUbK2vIVbeI7iJZFDYIzhsjOCefenixtBaxWotoRbw7PLiEY2JsIKYHQbSAR6YGOlX
LExlVjVtZprTpp2/rQLaWMKf7L/wsC1/tDyfN+wn+yfMxu8zc32nZ/tbPI6843beN9c7dJv8Yovh
6azhhOrr5khi82MX32S68/Kqykt5fkZwQN2f4t4rv7yxtNQtXtb22hubd8b4pow6Ng5GQeDyAfwq
C50TSr2whsbrTbOezh2+VbywI0ceBgbVIwMAkDHaro4uMFqnty9Gl5pfmu93fWyTjc4q4j1CPxDb
WkdzbHU21lbiS8FuzW+5rCZNnl7wysEiUld5++j5w+0aOsJr9vfaA002mX9x/aZ8iNIpLRB/otzu
3MWlPTpgdvfI6GTw9osumxadJpFg9jE2+O2a2QxI3PIXGAfmbnHc+tFl4e0XTX32GkWFq24Pugtk
Q7gGUHgdcOwz6MR3NXLGQdnbZWtZa79b3W+y22QcpQ8NGX7TrLXqJb6hNeCea0Vy4iXy0iRlYgb1
cQ7g2ByWU/MjVH4wsrWexsLqa2hkuLfU7LyJXjBeLddQhtpPIyODjrXQmCFp0nMaGZFZFkKjcqsQ
SAeoBKrkew9Kqajomlav5f8Aaem2d75WfL+0wJJszjONwOM4H5CuaFdLERqvRK23l0Wu3TXW29+r
a0scwY9Qj8WeINWW50mFrNYo1F9bsH+yCJZOJg4EcZkM3z7G5Vs7tgUaukSNd+JbvUPKeBbnSrFh
DOQs0Z33DEOmcqRuA54yCATg40pNE0qX7F5mm2b/AGHH2TdAh+z4xjy+PlxtXpjoPSrYgiWd51jQ
TOqo0gUbmVSSAT1IBZsD3PrV1MSpQtbWyXyVv8r/AIeYJEnPqKOfUUfjR+NcZQc+oo59RR+NH40A
HPqKOfUUfjR+NABz6ijn1FH40fjQAc+oo59RTWLhk24IJ+YlsYGD09ecen9C78aADn1FHPqKPxo/
GgA59RRz6ij8aPxoAOfUUc+oo/Gj8aADn1FHPqKPxo/GgA59RRz6ij8aPxoAOfUUc+oo/Gj8aADn
1FHPqKPxo/GgA59RRz6ij8aPxoAOfUUc+oo/Gj8aADn1FHPqKPxo/GgA59RRz6ij8aPxoAOfUUc+
oo/Gj8aADn1FHPqKPxo/GgA59RRR+NFAC49zRj3NJkf5NGR/k07oQuPc0Y9zSZH+TRkf5NF0AuPc
0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0
AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf
5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+
TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9z
SZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc
0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0
AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0Y9zSZH+TRkf
5NF0AuPc0Y9zSZH+TRkf5NF0AuPc0UmR/k0UXQC/570f570bvf8ASjd7/pRoAn40ZHrWP4ov7jT9
AluLaXym82FJJ9oPkRNKiyy85UbEZ3ywKjblgQCKzru2bw81laaPNP8AadVuhbCbUru4vUh2xSy7
tjy55EZXCsv3gTnbgpsDqcj1oyPWvOl8Za7NczpEdORLV4LSXdbOxkmlvp7PzFPmDagaJZNh3Egl
d4+9Q3jLXWi1i6Q6csGh2T3F1E1s5a7aOe6icI3mARBha5GRJt387sclxnouR60ZHrXnXiDx1q2l
S311aWaXGlhLuG2nkgCKLi3gldgW84u43wSJjykHcMcDfqS+INX0nUJrXU3sbmGz+zXF5c29u8IS
3mM0eQrSNjy3iV3ctjyy/AK8lwOxyPWj8awtI1LUrxtOkvFtLYXdvPcG1kDJcqvmJ5IKE8FY3xL6
OVA4NbpPHX9KExB+NGfegHjrXNRwXl14k1CUK0kEN3GoJ1KaIIPKiYgRKCrDknkjOSDVwipJ+RE5
8ttNzpcj1oyPWuZt5Zhp+n6p58zahdSxRzQGVimWYCWMR5wpQbzwAw8s7ifmzj2d3dr4cmlWS/gk
OiPO73NyXM0mwbZIjvbaB82cbSN6ZHTGioN9fIxliUradL/1/X3nfZHrRketc8NJvhYMqbo5TKC8
P9qXEgkQA4AlI3RnJz8o52gHg8VWgiuho+2S/hD3ctrMi6hMc7Fm3DduBYb04Y4OABwOKlQT6/19
5TqyXT+r27f12OryPWjI9a5vxBIy6pZKYNRuIRa3Ejw2E5jclWiweHXdgEjHJ+bgVWihvtQ1SCOW
f7Uq6favNLBqMsCFmaTc6CMYfO3POOg9eGqV48zf9feEq1puCX9Wv2OtyPWjI9a5e/N9pdxNdMkl
1PJ532MpdSkM4jd0RoBhMBVK5BJJAOMkkRa27adpLzaff3M7XVrO7yG4MmVELuJl5wmG2DKYX5wM
fdwKldpJ7idflTbW39f1+Z1uR60ZHrXL+KrieK7s44nudsiYaOCUxs/+k2y4ByMHDMM5H3jyM0W9
xObZYC9zBbS6gbd1mlJnt4/L+6z5JBaQDB3E7ZV2kErgVJuCl3G66U3C2x1GR60ZHrXL6jp8seqW
NnZG5lRobiV0l1S4jyQ0IB3jcxxk4HTkn6z3dtLY38VxM001mJYYoyt9KjR5KoqlB8so3ncWY5IY
jBwMrkTtZ7/13H7Vpu62/wCH7HQ5HrRketczqMmpR+I55bB2kMdpDGLdyxjzI8oDlR3DLHk9k39T
iqem+fJBJY3Euo3aWvmmEJdGOa4IuZY2Jfcu7YqpxkAb+Qflw/Ze7zX7Euv73Lbv+B2WR60ZHrXF
WMt7fy3T2E939jvmht182V2e1Q28Um9Tk7WKtLliTl/L9zV+CSS78O+HLed2kW+WFbhmOWcCFpCC
T1DFAGznIZh3zTlRcev9WuEcQpbL+r2/yOmyPWjI9a5m4lmOn6hqnnzLqFrLLHDAJWCZViIozHnD
FxsPILHzBtI+XFUHUp2sGF5DuOsXKwGWFnMYUXIIb5xuGBgY24460lS0vf8ArcHXs7W/q9jsMj1o
yPWuSl8R6oWkW3so5PsiM1y/yqj7ZZY+ryL5YPkk5+fG7/Z+ba0m7u71Lma4EKxrcSwxLGDkhJHX
c2e5wOB6ZzzhZnSlBXdi4Vozdlc08j1oyPWuZt5Zhp+n6p58zahdSxRzQGVimWYCWMR5wpQbzwAw
8s7ifmzEqvp41iWC5u/3N3Fbh5rmSUQwssJd8OxXKhnbcQcd+Miq9lra/wDV7EuvZXt/Vr/odXke
tGR61mfZF0yEtazMGkliVje3Uki4LgEDcxwxBIGOp25rK0m0u7q5nnmWRoGurqPzf7UnDBRJIoAi
A2jGABg8YBHNSoppyvp/XmU6jUlG2r/rsdRketGR61xXlPHZ2e19TuTNqtxC8cd/IHdE+0BVDNIM
AbVJ5GdvOTTxc3xbSrmGa5k8mG6uDbB2ZpI1ljUROvVpVjZlwTnzByTyTp7HXR/1r/kZrE6Xa7fp
/mdlketGR61geH3ngbUINQu/MuDe4AaQlQ7QRyMkeedoJfA7AfWsC3m1WHw5ZX9tFflmitTItzeb
jdStLDt2Eu2xSPMBzt++Mg44So3dr9vxHLEcqvbv+B32R60v+e9c7MQllZanHctcXAu41aQgqCJH
WJ02nlFGfudmRS2WBz0W73/Ss3GxrGfMH+e9H+e9G73/AEo3e/6VOhYf570f570bvf8ASjd7/pRo
Af570f570bvf9KN3v+lGgB/nvR/nvRu9/wBKN3v+lGgB/nvR/nvRu9/0o3e/6UaAH+e9H+e9G73/
AEo3e/6UaAH+e9H+e9G73/Sjd7/pRoAf570f570bvf8ASjd7/pRoAf570f570bvf9KN3v+lGgB/n
vRRu9/0oo0AbmjNL+A/Kj8B+VTYZS1TVLXR7B729d1gV0T93C0jFncIoCoCxJZgMAd6x9I0fwjfa
XdRadoWnR2k7ql3bNpogJZPmUSxMgIIyGAYdGBHBBqz4t0271XQltLJnSc3tnJ5ke0NGqXMTs43g
rlVUnBBzjGD0rKTwekfizTb6bz79I4rma5urh1BkuS1qIiyIFU4SDjC4BjVvv4agDftdP0uWzgkh
06BITFCI0e18sqkZ3xKUYArsJyFIG09gaqHwhoT66dYl0y1luwiCIyQIwhZZJJd6fLlXZ5WLEHkg
HryeM0jwpqtroTWU+j41uTSkt7DV98R/sxhZJF5fmbvNTEqyN+7Vl/eZzkti/wCH/DL6dY3arot9
9nlurJ1s7qW0t9rRzBmmCWqiMbRtbJJZ/LCkABdwB1c/hvQrq/lv7jRdOmvJUKSXElqjSOpTYQWI
yQV+XHpx0qh4wn0LT9JNxrUqW0F3cWtrLIGRDMvnAiNy3DRYZy6n+Ayeprpe3QflXBfE22kez0y6
trXUWuo723jW4smgHlq11bnYRMcEsyRlSAcMg3EKWBLAdB/wkOgSapbbZ45p2RY4ruOBpIkEu1lQ
zhSil/3RClgWzHgHcubmp6zbaT5X2mK+fzc7fsthNc4xjOfKRtvXvjPOOhrk/wCyNfkee0vLFHnv
9SsNSmvLaRRaxGFbbzEwzeZkm3fbhWGHTJHzbdzV7fUdb0hdNlsfs8N5dPbXn71X22YZ8t2/1qKq
YB3J52eqUASW3i/RLt7VYLt5EukiaOYW0nlDzFDRq8m3ajsGTCMQx3px8wzdlvba11a3sFiJur0S
THy1A+WMKrSMeM4LRJxk/MvGASOavtI1OTVNQtI7F3gv9YstSW8EkYiiSH7NuRwW37z9nbG1WHzp
kj5tuhPG1v41uN8z241bTY7a2uIwuY5YGmZh8wK7ys+5RhsiKQkYXkA2IIdObULm5gjtTeqRFcSx
qvmA7VYK5HP3ShwexU+lZ8eq+Hrzw4uoxSWtxpEZaKJki3oxDNDtjUD5snKKFB3Zwudwzn+HfDuq
abrusXd3reozQTXokSOVbbbcr9miTe+yIMCGUqACv3AcHJLY40TU7zQLI3Wj6jC9nrt5fPaQ3scN
xLFKbgoY5I5QAR9oXILrwrjngM7vuLlXY32bwnC9tZSafaRG8EcoifTyoXdlYzKCmIixLKok2ktu
UZORVybVtKtdBk1RIhJYaa8isY4gPIETNFKwBxwgV87eSAdobIBxJPD19P4eineBzriv5dvJJPva
3iM5MLTAtsne3Rg4Dl/nRirFm3EsZNT8LJefa4XGh6fbmK2t4zG+8KyrbRW3PmM7J8riU5MpUJ8p
NDlJ7sShFbI7ExxmVZSimRVKq+OQDjIB9DgfkKpz6JpN04e40yylYZ+aS3RjySx6juST9Saj8Nab
No/hXSNLuGjeezsobeRo8lSyIFJBIBxkelan4D8qE2tmDjGW6KcOm2NtdSXUFlbRXEmd8qRKrvk5
OSBk5PNPgsrS1lmlt7WGGSdt0rxxhTIeeWI6nk9fWrP4D8qPwH5UNt7sFGK2RRt9J020VlttPtIV
dlZhHCqhipypOB1B5HpU8ltBL5vmQxv5qeXJuQHenPyn1HzHj3PrU/4D8qPwH5UNt6tgoxSskZh0
DRjEsR0iwMasWVPsyYBOMkDHU4H5CpY9J02G5S5i0+0S4RQqyrCoZQF2gA4yBjj6cVe/AflR+A/K
nzS7iVOC6IjEcYlaUIokZQrPjkgZwCfQZP5mq8+m2N1AILiytpYQ5k8uSJWXeSSWwR1JJ59zVz8B
+VH4D8qSutmU0no0QQW0FqhS3hjiU4+WNAo4AUdPQAD6AVFcWEE9iLML5USbDH5QC+WUIKFRjHBU
EDGOOQRxVz8B+VH4D8qNb3uFk1axWeytJLxLx7WFrqNdqTGMF1HPAbqByfzNAsrQXLXItYRcMwZp
fLG4kKVBJ65AJH0JFWfwH5UfgPyou+4WXYpvptjK8TyWVs7QuZImaJSUcncWHHBJ5JHerEcccSlY
0VFLFiFGBknJP1JJP41J+A/Kj8B+VDu92CSWqRWSytI7x7xLWFbqRdrzCMB2HHBbqRwPyFSpHHGz
siKrSNucgYLHAGT6nAA/AVJ+A/Kj8B+VGr6gklsijb6TptorLbafaQq7KzCOFVDFTlScDqDyPSrU
cccSlY0VFLFiFGBknJP1JJP41J+A/Kj8B+VDbe7BJLZEAtoF2YhjGx2kXCD5XbOWHoTubJ9z60Lb
QLOZ1hjEzZzIEG45Cg8/RV/75HoKn/AflR+A/KjXuFl2IPs0HmeZ5Me/f5m7YM79u3dn128Z9OKB
bQCBIBDGIY9uyPYNq7SCuB2wQMemBU/4D8qPwH5Ua9wsuxTewgku4rkrho3MoCgANIU2bzxkkLlR
zjB9hi3ml/AflR+A/Kh3YJJbCZozS/gPyo/AflSsMTNGaX8B+VH4D8qLAJmjNL+A/Kj8B+VFgEzR
ml/AflR+A/KiwCZozS/gPyo/AflRYBM0ZpfwH5UfgPyosAmaM0v4D8qPwH5UWATNGaX8B+VH4D8q
LAJmjNL+A/Kj8B+VFgEzRS/gPyoosAu0+tG0+tJx/nFHH+cVWgjP1y5vLHR57ixh8+4TbhdhfapY
Bn2L8z7VJbYvzNt2jkisbSvFESxIurahA7P5zG4+xPYxweWqMY5UmcsshRmkAOMorNjAyehvreS7
s5IILyezkbGJ4BGXTBB4Dqy89OQevrzXPXXhFJ7WC1eX7Ys2oLd6jc3YXzZgsezChVCDcqxxMAoD
RGQHliTLsMji8dRzy+THoOsGVnjhSN1hjZ52gW4MOGlBV1iYsd2F+RgCTgGvpHjUXWo6hI8F1Po8
l7bR2eoKkYijWe3t2jRlLCXLSS9dhx5gyQAdu3/wjln/AGp/aHmT+d/aH9obdw2+Z9m+zY6fd2c+
u7vjiszTfAVlpgigi1PUZLBHtpDZSGLy3kgjiSNywjD5HkRtgMASvTBIK0Ar33jUXFnZtYwXVoby
4s5LOeZIyt3avdQRyOgDMVBWZeHCN+8GBkHb1ljdfbYHl8ieDbLJFsnTax2OybgP7rbdynupB71z
8XgawjW2je9vpYbLylsY3aMC0ijlilEakICykwRAlyzYThgSSegsrUWcDRGeefdLJLvnfcw3uz7Q
f7q7tqjsoA7U1YCyRyOaz9fvptK8OapqMARprS0lnRXBKllQsAcEcZFXyRVXU7GHVdKvNOnZ1hu4
HgdkwGCspUkZB5waGONuZX2OWn1zW4/Dmr6jDeWzzWEBuAtxoV1aqyqjsV/eSDJJA5H3e4ORhmq+
JdU0fUprKfUdHe4gso7lLY27JLqDs8o8qEGUlWxGijhzubOOgrq9SsItV0q806dnWG6geB2QgMFZ
SpIznnBqG40Szu7u7uJw7m6gihdd2AoiZ3RlIwVYNITuByCFIwRmoszojUh1X5eXl6mBc+JtUh1n
WLBLWF9siWumMsbEGcxxMwmOfu/vg/y87IpT/Dz0Hh++m1Xw3peozhFmu7SKd1QEKGZAxAyTxk1F
Dp1jpKXV9d3Ak/eC7lursoPLZYFiMmQAF+RDk8feboDiremWMOlaVZ6dAztFaQJAjPgsVVQoJwBz
gU43vqRUlBxtFa6fkXNp9aNp9aTIo4/zitNDAXafWjafWk4/zijj/OKNAF2n1o2n1pOP84o4/wA4
o0AXafWjafWk4/zijj/OKNAF2n1o2n1pOP8AOKOP84o0AXafWjafWk4/zijj/OKNAF2n1o2n1pOP
84o4/wA4o0AXafWjafWk4/zijj/OKNAF2n1o2n1pOP8AOKOP84o0AXafWjafWk4/zijj/OKNAF2n
1o2n1pOP84o4/wA4o0AXafWjafWk4/zijj/OKNAF2n1o2n1pOP8AOKOP84o0AXafWjafWk4/zijj
/OKNAF2n1o2n1pOP84o4/wA4o0AXafWjafWk4/zijj/OKNAF2n1o2n1pOP8AOKOP84o0AXafWjaf
Wk4/zijj/OKNAF2n1o2n1pOP84o4/wA4o0AXafWjafWk4/zijj/OKNAF2n1o2n1pOP8AOKOP84o0
AXafWjafWk4/zijj/OKNAF2n1o2n1pOP84o4/wA4o0AXafWik4/ziijQBeaOaTcPSjcPSldAYHja
xg1Hwpc293cQW9uJYJZJLm2M8ICTI/7xARmM7cMSQApJJABNZPhKaZLJodD0vQH09b0pLe6eTaQX
C7IyZYY0WQORuaM5f70PUZIXtMj0oyPShjPKPB91pFj4b8N3fhmCC4u4NPWXXIdJRHkkRbVjtlVe
DMZhGFDfOTvxx5lWNG8W6qP7Rml1qx1Oy0j7NeXUtrdxXW6CTzklUyRwxAeWEWbaELnYVyd4C+n5
HpVe8srbUIFhuovMjWWOYDcRh43WRDx6Mqn3xzxS0AzrKwl1Tw5Hb+JLSC5kucyz2k8aSJHucusR
x8r+X8q7v4tm7qa4Wyuo/D/w18Kw6XNa6I97ZQ3M1600NnC7iFAweR4ZQZX3AgbcsI2O4bcH1PI9
KMj0oA8z0nxPr+p+Hb7XJ9QSGIPYR+XDbqFtUnhtJJ5tzZ4jWWR13cL8xfeMBaE/izVPNuLex8V2
s2lpeyxrrN1d21up2wWrLEJhbvESWlnO3YGPln5htIPq88SXNvLA+8JIhRjHIyMARjhlIKn3BBHa
q+m6ZZ6VbtDaRuA7l3eWZ5ZJGwBl3clmOAACScBQOgAo0A4PSb24tx4rvNR17+zNQltVvWgW3BSI
Cytw12kMiCZlV1ZcE4+UqRuBr0kZxSZHpRkelCA4j4tSeX8PtSzqUFmrRSq0c0/k/asxPiJWHO7O
HCj7+zYflZiKTX+meb4Cne5e2d9SuI4UudRkm84GCdC6NI2ZkZzH5bkZ2yJjbv213l/ZW2p6fc2F
5F5ltdRNDMm4ruRgQwyMEZBPSrGR6UAecaV9j/4SjT/K8j/hIf7av/7R24+1fY/9K8nzv4/Jx9m2
7vl/1WP4a9J5puR6Uu4elO6AXmjmk3D0o3D0ouhC80c0m4elG4elF0AvNHNJuHpRuHpRdALzRzSb
h6Ubh6UXQC80c0m4elG4elF0AvNHNJuHpRuHpRdALzRzSbh6Ubh6UXQC80c0m4elG4elF0AvNHNJ
uHpRuHpRdALzRzSbh6Ubh6UXQC80c0m4elG4elF0AvNHNJuHpRuHpRdALzRzSbh6Ubh6UXQC80c0
m4elG4elF0AvNHNJuHpRuHpRdALzRzSbh6Ubh6UXQC80c0m4elG4elF0AvNHNJuHpRuHpRdALzRz
Sbh6Ubh6UXQC80c0m4elG4elF0AvNHNJuHpRuHpRdALzRzSbh6Ubh6UXQC80Um4elFF0AvNHNG4e
tG4etVp3AOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AOaOaN
w9aNw9aNO4BzSZbcRtOMdfX9aXcPWjcPWjQA5o5o3D1o3D1o07gHNHNG4etG4etGncA5o5o3D1o3
D1o07gHNHNG4etG4etGncA5o5o3D1o3D1o07gNZNzITuypyMEjsRzzz16H+lO5o3D1o3D1o07iDm
jmjcPWjcPWjTuMOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3A
OaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AOaOaNw9aNw9aNO
4BzRzRuHrRuHrRp3AOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AOaOaNw9aNw9aNO4BzRzRuHrRuHrR
p3AOaOaNw9aNw9aNO4BzRzRuHrRuHrRp3AZKZRC5hRHlCnYrttUnsCQDge+D9KKfuHrRUtX6ktN9
ReaOaTP1oz9aq5RBe31rp1o93fXMFtbR43yzSBEXJwMk8DkgfjWafF/htYEnPiDSRC7MiyG9j2sy
gEgHOCQGXI9x61H4utri90JYLYzrK19ZkPCgZ4wLmIlwCCPlALcgjjniq2r6deRaHFAby81OX+07
KXfLHHvVFuYS3EaKNoCliccc5OOnVRp0pRi5vVytv0012ffuS7mpD4j0W5vY7KDV7CW7lUPHBHco
zupXeCFByQV+bPpz0p765pUdrc3T6lZrb2sphuJWuFCQyAgFHOcK2SBg88iuUurDVTq2sTMm7SP7
XtrqWFLZjcOsUNuwkibdh1EkagqFJIVwpLYWsrUPCd1ceGtdkWKbZP8A2pNJZBTmecSz/Z3CY+bK
ybs9SYrcr92umGEw8uVudr8vnurvt6fdrrorvsejy39rBdW9rNcwx3Fxu8iJ5AHl2jLbQeTgcnHS
oH1zSo7W5un1KzW3tZTDcStcKEhkBAKOc4VskDB55FYPiTSbrUfEOmzWabbi1sbqS2uGBCRziS2K
KzAZCuFdWA5KFwO9YC6BqFvqMui2elJfaf8A2g13O2pOyRXapZ28f7wiNg7NLIZMkcvCx6jIzoYW
lUgm52drtadG76vy28xttPY9Elv7WDz/ADrmGP7PEJpt8gHlxnPztnovytyePlPpVWLxHotxqR06
HV7CS+DMhtkuUMoZc7htBzkYORjjBrhdHs9aXVIL7WLO5nisNPtre7iw8huJYZrhRcKSAZSu0SBM
ZIlVhl1QNe0lYVi1jTdVfXJILmfUFksTpsnkeW80rZSVIQxLIcj94cl8AZwBc8FCHMubmtbbX16O
9vktVqhKVzr9O1zStX8z+zNSs73yseZ9muFk2ZzjO0nGcH8jUD+KdAjkuY31vTFe1z9oVruMGHDB
TvGfl+Yhee5Aqn4cub2ee8V7i/urFVjMNxqFp9nmMhL+Ymzy48qAIyDt6sw3HGFqeG3eG/Sy059T
k0aK2KhL+ya3+ylSgijjLxozrt8zJO8jYuSCfmwdCMZTvf3bdf15d+yaWum+7vsb1jrmlapj+z9S
s7vO7H2e4WTO3bu6E9N6Z9Nw9RUkWrafcXhtIb22kuQrOYUmUuFVyjHaDnAYFSexBHWuQ0lZtHsP
CF5eWd4IrbQ2tJlitZJZI5WFsQrRopYf6p8nGARgkEjObp+mahZ6lf67HY3Imt1+1Qr5TB7iB7u9
kkiAxksYpEYRnBEgi3AYxWzwdNqTUvJbau7X+Tfa4uY72LXNKnjuJIdSs5Et4lmnZLhSIo2XcrsQ
eFK/MCeCOaYPEeitO8A1ewMyTrbNGLlNyysSBGRnIYlWwvXg+leWw6Lqth4E1O6h0y8N1NYx2M9q
sDeZNG+n28akIBlmjmGOeFUz8ZNb95px1zXbu0e1v44W14ym4+zSR+Wo05olmjdlxlZU+VhnDBT3
XO0sBRi2+dtJPXTS3L/noLmfY7q41bT7SC4nub22hhtmCTySTKqxMQpAYk4UkMvB/vD1p9nf2uoW
qXVlcw3Nu+dksMgdGwcHBHB5BH4V5/pn9sLqV9rWoWM0RiuZ4nC2ckqrcfZ7WJbiOIfPJFmOZQy/
Ntk7AuV2J7/XdR+H1zJHbuur3TSWkLJDLalA8xhSfadzoAhWU9wAelc9TB8qilLVtJu+ib6fLe99
radSlI6FNc0qS1trpNSs2t7qUQ28q3ClJpCSAiHOGbIIwOeDUh1bT1vUsje2wu3ZkWAzLvZlUOQF
zkkKysR6EHoa8+bQNQuNRi0W80pLHT/7QW7gbTXZ4rRXs7iP92TGoRlljEmQOHmU9TkwWWma1q/i
K6vZ7F7TUoWuXhneJ44ftMcdggKsQW8mRopVyOWjLj1xr9RpXd6mlr9Ou2342FzPseiXWuaVY2ou
rvUrO3tzKYRLLcKieYCQUyTjcCrAjr8p9Kti5iad4BIhmRVdoww3KrEgEjqASrYPsfSuC8MzzWBb
W9R03U4re8+0C3iaykkntma7uJWDxoGZN6vEcgEHyhkjCZn0ZZvDOo3E2pWd4kFzbIlsltayXPkq
txcusRESsE2RzRLj7vBCkhayq4NR54xd2tvPXW3p1/y3akdXFrmlTx3EkOpWciW8SzTslwpEUbLu
V2IPClfmBPBHNFzrmlWV/DY3WpWcF5Nt8q3luFWSTJwNqk5OSCBjvXlv9gavpHgzWJE025a9azTT
ri2hjLtOjafbxgqF++Y5hjOSFUzYyTXd6XdDR7m4sL63vDd3N9LKLiK0lmjlSSQ+WWkVSF2psjO8
jaI/7oUm6+Dp01zU5c3krX2Tv101+63mJSvuXY/F/huVJXj8QaS6xLvkZb2MhFyFyeeBllGfUgd6
tXmuaVp8jx3upWds6RCZ1muFQrGW2hyCeF3ELnpk4rz/AEu3e68Dado1yus3ko/swT2d/pbRxQok
8PmID5KhlAznczfKpPQE1HrnhvULC4s53kv7ucKFkvYY2uZY4o7yy8r+Akt5cbyFcEFzKQMEitVg
KDq+zc2tWvXRa7Lz6drXFzO17HoNp4j0W/eFLPV7C4aZmSJYblHMjKAzBcHkgEEgdAQajuvFOgWM
gju9b0y3c5wst3Gh4YqeCezKyn3UjtXL3Nlca1qGmTWUt/Nc2VndtBe6jZvbEXAltnQP+7TCsAyH
ao3JvGc5qTRo7q6sPDl02n3ltu1y+uniuISkkMcgvCpcfw/fQemWHqKxeFpRhztvrddftW3XXl7D
u9jug2e1LzWdp/8Ax+6n/wAfv/HyP9f9z/Ux/wCq/wBj1/299aGfrXntW0LF5o5pM/WjP1pXAXmj
mkz9aM/Wi4C80c0mfrRn60XAXmjmkz9aM/Wi4C80c0mfrRn60XAXmjmkz9aM/Wi4Cbm3hdpwQTuz
wPb/AD6U7mkz9aM/Wi4C80c0mfrRn60XAXmjmkz9aM/Wi4C80c0mfrRn60XAXmjmkz9aM/Wi4C80
c0mfrRn60XAXmjmkz9aM/Wi4C80c0mfrRn60XAXmjmkz9aM/Wi4C80UmfrRRcAz7GjPsaPwo/CjU
BCeOhrnvFfiT/hGrWwl22P8Apd19m8y/vPssMf7uSTc0mxsf6vaBjksK2b+ws9SspLS/s4Lq2kxv
hnjV0bBBGVOQeQD+FUbnRYZZdFNvstoNKuDLHDHGApXyJIQgAwFAEmf+A4xzxD3GihbeMtM+wW09
5dWpeVDI76a8l7bwoHZQ7zLGAifK3zOFGVfk7Casf8JdojJctHdvN9nuGtZEgt5ZH85WYNGqqpLO
NjMVUEhcOflIJr674Ym1e4vWgv0t4NSsl0+/R7cyM0IMmPKYMoR8TScsHH3fl4O6vf8AgmG+0SKx
lktZ3g1K41GIXlmJ4C0rzNtki3DcFWdgMMPmVW/2aWgGmnifSpZbWKGaeeS5xtSC1lkMWWKfvQqn
yfmVlPmbcFHB5VsULXxlFefD2fxVFYzr5OnteNbTI8WWEXmFVZ0G5ecB1BU9Rmq8PgjyLrS3guLG
0Sz2l3sLD7NM+JGlMSvG4UQFmwYmV8jJLFzvFxPDEw8DXfhZ79GgayfT7WdbchooTF5abxuIdwOS
RsB7KtGgElv4jeCW/t9ctoLK4s4oZ2+zTtcI6Ss6RhTsRmkLxsNgU5ygBJbAkPi3RxbpKJLp3d2T
7NHYzvcKVAJ3QBDIoAZDllAw6H+Jc5934D017C907T47Wy028eO4ksRaK0JuI3jZH2AgbGEaq6dG
AGCh3Fqb/D/Onw2sE2lWLiWSR7jT9L+yyQbwin7K0cgaFiqcsxk3E4I2DZT0A3Ljxdolo90s928a
WqStJMbeXyj5alpFSTbsd1CvlFJYbH4+U4fqfijRtHvBaX155Vw3lhYxE7FjIJSirtByzeRIAo5J
AAGWUHIvPA39oRTafdaj/wAShpbueKKKDbOslysyyZlLFWUfaJdoCAj5Mk4O6SDwrqUvia31zVNW
tZ54XiKx2ti0KlUjukwd0rnJN0Tn/YAxzkLQDTfxPpUct0hmnK22RJKtrKYiwYJ5aSBdrybyE2KS
27K4yCKYfFuji3SUSXTu7sn2aOxne4UqATugCGRQAyHLKBh0P8S5z7rwfNd6df6TLe2smkz3DXcU
E1kXcTG4FxiRt+2SLfuBQKpKkDdkbjTf4f50+G1gm0qxcSySPcafpf2WSDeEU/ZWjkDQsVTlmMm4
nBGwbKNANjWvE39jeIdG017Tfb6h5nm3PmY+z4eKNPlwS26SaNOCMbsngHFPRfHEGp6be6hNYXUV
vFe/Z7c2sMt208TRJNFMUjQsgZJFOCPlyATnitPVPD9vrGoJNdtvtjp91YTW+CPMScxFvmBBGBER
x/e6jHORqvgj+0b68u/tFjN9oujcfZdSsPtVsMwwxZMe9cyDyPlfPAkdcHOaNANSLxdok9/9khu3
kO+NPPS3lNvukRXQeeF8vLB0wN3JdQOSBT38T6VFLdRTTTwSW2dyT2ssZlwwT90GUed8zKo8vdku
gHLLnI0rwN/Znh4aV/aPmYurC583yMf8eqWy7cbv4vs2c54398c5Z+HLWc0l9FPayz29ufINvp6p
dXUqTQzxvcStKBM5aBdxPl7i7nKZyHoB0ieM9FkiZke+aRJTC1uNNuDOGCoxJh8vzNoEkeW27fnX
nJFDeNdBE8kMd1POybAGtrOaZJCyLIqxsiESNscPtQk7ctjAJHL2/gfUdbafVtbh0r+0ZbqSRINQ
01biFY2it4zmITMFkzbDDCVhtY5GWwvQWHg5NPu7aWK8zHb6gt4qeQqZC2ItAmEwo6b/AJVAH3Qo
HNGgF8eKNGa8hto7zzfN2BZ4oneAFwCimZQY1ZgybVLAnemAdy5zJ/iBo/8AZK6hZi6uEd7coj2c
8LTRSzRxmSJWjzKF8xThAeqjjcKz9K+Gttpd1YSiTTrg26WpkuJ9LR7ovBFHGvlSsxEaERKdu1iC
zkMCQVuN4G3aboVqNRxJo+npaxSGDIkkSS2kR2Xd93darlQckMQGBGaNANvVNZWw0BtTigeV3RBb
W8gaFpZZCFijO4ZQs7KuWA255xg1Qh8Z6eLCwkvIrqO8ukl32lrazXbRSQuI51JiQ5CSHbuwAeCM
g1Y1nw8dfstNttRvHCW1wlxci1aSAXDKjbQCr7kAkKSD5jgoOvWqei+DYtD1xr62vp3th9p8q2md
5TH5/wBnZ/3juxPzwO59TKfTlAXIvF2iT3/2SG7eQ74089LeU2+6RFdB54Xy8sHTA3cl1A5IFEXi
7RJjhbtwGeNYme3lRZ98ixq0TFQJULSIN6ZUb1JIDAnL0rwN/Znh4aV/aPmYurC583yMf8eqWy7c
bv4vs2c54398cxp4Fm+y2dvLqqMml28dvpZS1KmNUlhlUz/OfNO62iB2+Xkb+m4FTQDYvPFuj2N+
9jJJdS3aOyNDa2M9wwKpE7ZEaNwFmi56fOB1zT/+Eo0Yz+Wl55kYi857mOJ3to02eZl5wDGnyYb5
mHDKejDNDR/C15ZeI5tcv9Sgubmbz96QWhhT94lqgwDI5GBajuc7+2Oadh4FmsNEm0Iaqj6XeWS2
16DakTOwtUtt0b79qDbGh2sj87ueRg0A2F8XaObd5TLdo6uqfZpLGdLhiwJG2AoJGBCucqpGEc/w
tiv4r8VLoHhGbVreKSS5kt5Hs4ZYmUs4ieX51YqVAVGZgcHCkD5sA5aeAfK0+aGFPDkFxLLG4a30
PyY49gcK6BJRIswLnEgk+UD5QpJY3PFvh2+1D4dXeg6fKl5P9iMIOox+e9wVjIX5iyhZSwVhIcgE
Zx6MCxqXiPVLGwW/OgSR28aB7iO6u0WbJcqscKR+YJJWwMKWUEugDElgsmleK7TWfEN7plnPYutn
vSQfbB9p8xHCv+4AyIwSRvYgkjhSpVjnxeE9XspbFrHWrHy7OJhFDd6c8scMjM5ZolWZNihXEaKd
xRF2hsM265a+GJrfVLeRr9H0+1vZ9QtoBbkSiabzd++TcQyfv5cAIpHyZY4O4Ap3Xjo2mr67pr6f
++sfLjsP3/8Ax/zMsP7v7v7rD3Num5iR+8z0VsZifEa6vTpD2ttaol4lu00bM8jRGWTTxtzhRkJe
t03DhDkfMo6q38P28eqXd/O3nSS6gL+AYK+S/wBmW3PQ/N8obr/f6ZANcxYfDP7D9i/4m+/7L9n/
AOXbG7yvsH+3xn7B+Hm99vzFwOg0/wAY6VexWGbj95dxQvviileBGlVWRDMUCqzbl2q+1jvT5QWA
NjRvFGla9s+wTTnzIhPF59rLB50fHzx+Yq71+Zclcgblz94Zw9M8CzabZWmnLqqPp6PZz3Km1Ilk
mtkhVCj78Ih+zxEqVY/fwwyNuppHhn+yv7A/0vzf7J0ptN/1e3zd3kfP1O3/AFHTn73XjkAjXxvp
CTSQXE8iyRPJ5rQ208kUKLNJFvkk8sLGMwvksQBtbkqNxk1rxOdG8Q6Npr2m+31DzPNufNx9nw8U
afLglt0k0acEY3ZPAOM8eBsWPiO2/tH/AJDNrNbbvI/1PmTXUu7G75sfasY4zsz3wNfVPD9vrGoJ
Ndtvtjp91YTW+CPMScxFvmBBGBERx/e6jHIBUg8a6b5TNeNJbulxcROEjkmWFIp5IRLK6riJG8tj
ufA4bk7SauS+KdHgglmkvdscUV3M58tzhLZxHOen8LED37ZFcnD8MB5ULX97p2pXjo6Xd1faRHKx
3TyzFoVLbYnzO+ch1O1PlwCDqXnw+068+373x9ruhKOG+SFt/nRfe53/AGi8+bqv2jj7iYANzVNV
ntLi3sLC2S61K5R5IopZjFGI0Kh3dwrEAF0AAViS44xuZadv4v083kWm3z/ZdXeVoDZqGlJkURlt
jAfMu2aN84BCMSwXa4W3qmlzXdxb39hcpa6lbI8cUssRljMblS6OgZSQSiEEMpBQc43K1TT/AAz9
j1yLWJLvzrxopxdMI9omkl8gblGTsVVt0QLycYJYtlmAKbeOrBtdgt4pJDp5sp7h7h7SZRKyyQJG
IGKgTBvNIHl7txKY6jOhH4v0SW4tLYXki3V27JFbSW8qTFlKbgY2UMpAkRsMB8h3/dBYc/L8PJrq
1tLC81O1n0/T7L7HZQNYEkqssEieeTIRKP8ARkDBVTcGbG3IxqaF4PTRdQtr1HsY2jiuI3gsLBbW
EmUwcqoJIwLcZ3FiSx5AAUAGhB4o0q4geeOaf7OssMKztayrHK0rhIzG5ULIrMR8yErgg5wQa2ge
OhrldF8LXmjQXAg1KC3aaWAiCytDFaxRo+51jgaRwjSAurMpA5DbdwJbqRgjpTQMXPsaM+xo/Cj8
KrUQZ9jRn2NH4UfhRqAZ9jRn2NH4UfhRqAZ9jRn2NH4UfhRqAZ9jRn2NH4UfhRqAZ9jRn2NH4Ufh
RqAZ9jRn2NH4UfhRqAZ9jRR+FFGoCf8AfVH/AH1S5H+TRkf5NIDmvHT3K+FmWzeVZ5b2yhGy5e3L
B7qJSvmJ8yAhiCRkgE9apaVb3WmeJtIspWni87T76aa3Opz3qb1ltVUh5sMcKTjgY3NjqSdnxTe6
Fp/hu7uvEiwNpCbPPE8BmQ5dQuUAOfmK9uOtZR0fwK2sp4ZbQtHN4lu2oJaHTU2rGzCNpAdm0ElV
B5ydo7CkxmH4eurx/E0JJ1WJptV1JJbm8vTJa3UMcs6rDDGZGCSKRGQNiErDJgkA5g0TXW1vXJ0e
91yG28SRXUUMhguIYoPLyLZrV3TajSW/mSscnLID8v3T6N9gs/I8j7JB5Pm+f5fljb5m/wAzfj+9
v+bPXdz1oSws44rWKO0gWO0x9mRYwBDhSg2D+H5SV47EjpU3AxPCc+pakl3qmpyp5rP9iEEDN5Kt
bsySuqt0LTebg55jWLIBBrzi2uNch8L6Ir3N0s+rWVnMP+J1cym6JurNWZ5GG62JExBEW4ESNn7i
59mhghtkKQRJEhdnKooUFmYsx47liST3JJrLh8J+HLezubSHw/pUdtc7fPhSzjCS7TldygYbB5Ge
lO4HKa7v03RtM0CabWLKfVLiSS7fS7u81C4t4Y1yXilKFwN/2dSCuMSsAOrVY0TU5PGps49TkurN
P7NiuGgtZZrJnuxJJFcqSGWQiJkVducDzQW3ZQjq9P0LSNJx/ZulWNljdj7NbpHjdt3fdA67Ez67
V9BRd6FpGoWYtL3SrG5thK04hmt0dBIxJZ9pGNxLMSep3H1pXA4TWb7xDp+jeO4tNVJLOxR0iubj
VJhcW4FhC3yDy2LEElslwSxJODyfR454ZnlSKVHeF9kqqwJRtobDeh2spwexB71n6Zb6Le6FG2n2
dqdL1C3RxGtuESaJo1VdyEDjywq4I6ADtiqnh++0qe8vhpz308l3K13LdS2cqQzcKilJSgjZQixq
uwncqhsscsQDiNDj1m38H6Jq1wZ0a7/svddHX7u5eXzLm33boZFCJuUtnaTjJXkE16Nd6hdW14II
tGvruMxNJ58LwBAwBITDyK244AHG35hkgZIkm0nTbnSxpc+n2sunhFQWjwq0QVcbRsIxgYGBjjAq
SysLPTLOO0sLSC0to87IYIxGi5JJwo4GSSfxoA4TxLf3d9b+IbqSC606fSfDsl1awvInmRTSi4Qy
EozKHVYBsZWyBLID97Ar3F1quh6xo0+sajdQ6Xo9xPaPJvkP22IWlxMZpRj96Vjjt+QP9aJ8D7td
h4ig02NItUv4nm8pGsxAqq4uVuGRPIZW+Uh3EXJK4IGWClsmpaloFxfrpWoxpcOHEZ820aSGN5EK
hHk2mNHZZNoViCwkAwd4ywPOItf1D+x7mxum1/7Zfvp9+0My3FrKJZLuKO7treR9gWJQ8SqA3Hmn
5iORqTavq9jZ2D2C3wxr726WN3M89xbwizk3iYB2abDh51QOxdDGFIyuOzuNQ0W9uNNd7ZLt7i9l
sYJWgB8qWIvI4y3IAe16j+JEI6AjTews5Lxbt7SBrlMbZjGC4wHAw3XgSSAf77epouBwn9n3GpeL
hbWt5dajpqabZztc/wBv3NsT5stwWlQQDZIWCggfKoCqFwvA2LDTo4/iLqjC61Fkisra5SF9RneJ
ZJZLlXPllymMIuFxhcDAFad34T8OahKJb3w/pVzIN2Hms43I3MXbkjuzMx9SxPU0W+taNNrkltC3
+mv+4M/2Z1SUx7iYlmK7HZSZPkDEriTgYbCA5jxLqer6XqWo2NnDfXkk8sGqW4hZwRHDGWkgQAHK
s1qiMRwDfLlSSA4rT6lqmiao17fLb3+vz+TDFdypGbeO2lCfdYK8btbJMOMYkI5BJboLLxNoOpXl
zMgnim0+JxPcXmnzWwt0IR3UySooXI8tiueQAcYGaLCPw9rn2by9F/5Be37J9t0iS3+z9NvlebGu
MbB9zphenFMDzzTNS1KPwNdXCTaxaTt4TlvJZL+/aZrqYxKUntyZHKBT5hYDYR5sWV5XHT6hpdxo
/grVtUnheDUNPQ6hbf8AE4ub9Q0Cl1w0wBQN86OFA3IxG7njUGreGb2I6Yumz3FtZedAsa6LO8Ce
WrxyIjeVsOFEkeFPOSoznBx4bvwKlnG+n6dPY27ahGGistCnhN1PCZHVCqwhn8t4mY7fulMMcEqw
B082s38X2jZ4a1WXypRGmyS1HnL83zrmYYXgfew3zDjrjmNZu7rwlfXWtanHPfKftUlpJHqs6K5W
GWZYntseUiiONk3jcSyqxXLEjp18UaM95pVoLz/SNV84WkZicFzEMyK3HyMvIKtgggjGQRUGgL4X
vNQ1TUNDsrFb2G6ls765htBFIZgQ0is20FuSCTyCe5pAc/F4j8WtfWmk3NvY2N7c3SIs1zbq2I2h
uJD+4iunI5t8BzIAdzAL8hJ3ItVXUfCU9zqdy9n5dxNaTy2e5WkaK4aEiMDLgyFMBVJcbwFYthqw
4x8PtX0/T4obCCDTluo7yG1fSmt4bt5R9nRwjxgSrmaP5lB2kxkkDGerjt9F1bS5dMWztbnTbd/s
rW7W4MAMePkUEbSFIA4yFZSOCpAYHOXltqmm+GrZ2vr61Da1YtHbNc+dJHA9xChhlmYsz53MzYbg
tsDMi/N2Ynha4e3WVDOiK7xhhuVWJCkjqASrAHvtPpXOa3p3gvw74Xnl1XR9Kt9EglWeSP7ArxrI
xEYfy1U5bkLnGce1adrHYp4k1JkmeTUnt7dplYcRwZkESrgAY3CY92yxycbQEBymvyXlra69reia
lfbtPtbySe6mnMkMkixvtgihP7seWwQs4UEGPYS7NLtjvI5LPxlbeGYb7URpd09s8qtfzNLlor5m
2zFzIoJtoeFYD5T/AHmz18PhvQrbVDqkGi6dFqBdnN2lqiylmzuO8DOTk5OecmiPw3oUOly6XFou
nJp8z75bRbVBE7ccsmME/KvJHYelO4HAw69qqyXjTh7rSfDyT3UuNQkhmKR3d1GudqkzlYrYAK7q
GJJcsSCvo15eT21xaxRaZdXaTPteWFogsAyPmfe6kjkn5Qx4PHTNCws9C1yw067GkWuLB2jto5rZ
C1lJG+xkTqFKtHtyhx8gIJGDW3SA5jxDql7J8PfEV79ivtJuYdPuTEJpI/MBERIdWidgOenIOR06
Vn26azobW9olvBa3OqXS20M0+r3eqJHtimlZikvlkcR7cKwzuyfugHs54Ibq3lt7iJJoJUKSRyKG
V1IwQQeCCOMVHe2FnqdnJaX9pBd20mN8M8YkRsEEZU8HBAP4UAcRF421fbrNxJa2L22i6fLc3O0u
r3EkUt3EVTkhFc2wbJ3FOV+fduWSPxF4vW3uYJ9IRbuJ4XaYQxs0MDiTc5tY7l3cAxADEgZt52qT
GQ3Z21hZ2e37LaQQbYkgHlRhcRpnYnH8K7mwOgycdaz/APhE/Dn9n/2f/wAI/pX2LzfP+zfY4/L8
zG3ftxjdjjPXFAGR4M1C/wBW1DWL06pBd6Y0sBhC20iElrO2k3puc7IzvY+WVyCxJbrWP4eurx/E
0JJ1WJptV1JJbm8vTJa3UMcs6rDDGZGCSKRGQNiErDJgkA57/wCwWf8AaH9ofZIPtvleR9p8seZ5
ed2zd1255x0zWY2oaLFZa159skNno9wZbrdACgcIl0ZVUZJIMgbOM7gT1wSAcvpXjDxZqdgLlNAR
jf2QvLCMtCjBS8YOAbgmYKsu4kiH7gB2mQbZG8Zam+m395aXNjcR6Rp7X92z6fNAbrElwpiVHk3Q
Mv2ZlLNvyWztAGD1beG9CZL1G0XTil+4e7U2qYuGDbgZOPnIYk5OeTmoNRs9Ct7rQLe60i1lcXH2
fTj9mRhassTSgpn7gCw4G3uF+oYHP61411LTvCx1SGC1acXup2+10Yrttku2Q8NnJNumee7YxxjY
gv8AXbnXRpjS6dbva28N3d4geUSLLJKBHGd67SqwkbyDuLZ2Ljab8/hvQrq/lv7jRdOmvJUKSXEl
qjSOpTYQWIyQV+XHpx0o1i30XNnfavZ2sr29xGlrNNbiRoZZJERNhwSpLlORjsT0pAchpXjDxZqd
gLlNARjf2QvLCMtCjBS8YOAbgmYKsu4kiH7gB2mQbex8O6idV0SG7a6W5cvIjyx2klqNyOyEeVIS
6kFSpBPUE1StNM8OahPrtomhWP8Ax9LFqAe0j23UmxJgzcfPjzQctzuz9TqSz2Oi2ECkJbWiPDbR
JGmFUuyxxoFUcDcyj0HsKYF3/vqj/vqqWp6ra6RZSXl67x28aO8kixO4RURnYttBwNqnk9TgdSAb
madwF/76o/76pcj/ACaMj/JpiE/76o/76pcj/JoyP8mgBP8Avqj/AL6pcj/JoyP8mgBP++qP++qX
I/yaMj/JoAT/AL6o/wC+qXI/yao3l69hMJpgp08riSQfegP95ueU6ZPG3GTlSSjUbuyE3bVl3/vq
j/vqmxTRTwpNDIskUihkdGBDA8ggjqKfkf5NKwxP++qKXI/yaKADb7/pRt9/0pMD3owPegDH8TWF
zf6VDDax+ZIuoWUxGQPkjuonc8+iqx98cc1yVx4Ku9JKR6RbpcwGyu4Jt4Q5jeS0RIlWQlWcW0Bj
Ut8jNGC/3jnudT1CDSrRLidZGR7iC3AQAndLKsSnnHG5wT7Z69K5LWfHkDafbnRxPNcy3UYVYxET
JGt5bRMAWbA81LhGQkgFHVsrkGkxmR4c8DvLq8a61oXm6PB9r+y2+pxWj+TvWz24ih/drlo7g/KB
3J5bmMeHfEslx4dur2yun1S0TTka8hNo2yNTGbgTTOfPLk+fkRtsZWUc7nz148XxyOLWHSNRl1QO
6y6cvkiWIIsbMzMZBGRiaE/K5P7wccNt5+08dM/iaec3Tz6CUeWLZCq7IjHpzLKxIBVF+0yuxJ4U
kn7oAWoHMW+kf2ndrpWmWKJq1lpr22t31pJayNeyrcWplDMGbLyLFcYFwF3bmDDG/Go/ga/OnyG3
0ucNDp+otpyXb2oktLpxbeSY1hCxwtujkYFCcEliwZyB6F/b9itlqt9Kzx2emPIs9wV3IwjQNIyb
clgpLIcchkdcZFUB4zsobqO11OzutLuGcbku2ixHGYppBKzo7IEIt5R1yCvIAINFwOU1jwVdyX00
UemztoEN1KbbTrCOzZQHhttrrFcgxKodLnOAH3SEgYdjVuz8G3dqLi9ewSTWl1LTmi1B5UluGt44
7RJ/35CsQQk4OQpYFvl+bB2D49snezhtdM1G6u7pIittGIldGdbglH3yKFdPssocE8EAcnOK9/8A
E7w9phhW7d4nZGe4SSSGNrYLI8b5VnBkIeOQYh8w/Jxncm41AND8KCP4a3HhY2CaVPJZNYzzxxxl
Z5DCI2uAEbLBjz8+1zjkCrGrSaxrekz6fJ4furd0eGSbdcQPDdIkyNLChD7mEiB1HmIgYHDbckUX
Hiee48Q6NaWNpdJYTalPazXjCLypjHBcbo1G7zARJF12gHYcEgjNjUPGdlYXWrQrZ3V0mj25nv5Y
GixBiIyhSrOHJZQMEKVJOM8NtAMPR/Ckp8UWt9Po/wBi0mH7TLa2BdAtoxFnsUxxsU5khmlAXcoY
qxw/Sh4Csbqz8PaVquk+Gvsnl6BiWLfBD/atwyRNE2UZv7kg3SAEed05bHR+IvE8+n+IdL0yxtLq
5nNxG1xBAIgZopILsqqmRlAIa33HkcAYJyRVi28Z2V9qVtp1nZ3VxeSIXuIVaJWtFWVoXLhnG4LI
jqTHv+76Mm4Ak8Uf6O2jarJ/x7abqAnuSOqxvFLCX9AqmYOxJACKx7YOXd6Rqf8AYmreFo7F5INT
e7K6mJIxFCly8jtvQtv3p5jAKqkNhMsm5tleTxvPfaJpc+m211IZrjTUur5Yoo4ojO8DMjI0hcFo
5l+6HA8wfNkEi5bfEDTF/sCC8fbNq9rbzRyb4Y8tNwg8kytLy2B8odRnlsBiADLj8Fxy38FveeHL
WWL+3bi+vbmSOFo7uKRLtoiQTvcoZo1wyjBPy5AzWZe+CdXuLhRNb3zQx+dDpyWkloBYj7VO0b75
VZoF8p7cK0ALqI8bcogrs9N8a6bqFlY30kF1YWV9bvcQ3N8iwoVREcgktwdrORnqIZGGVAY2LvXJ
jpukta2rwXmrusVvHexlfs7GJpT5qg5yqo3yg8sAuVBLAuwI/Cuif2RbX8s1v5d5d6hdzO5feWja
5leIA5OF2vuCjABdjgMzZy7TSNT/ALE0nwtJYvHBpj2hbUzJGYpktnjddiBt+9/LUFWUBcvhn2rv
sSeKrvSb9dH1CyfUtUZ4hEdNRIlmWRJ3B2yyAIQLaUEb2zhSD8xVbC+NdNaw1W78i6A0uyN5dRlF
3LteZHjHzYLq1vIp52nghiDmgCvPoF9dDxCFVI3n1i11C08xvllEMdqwBIyVDPAyZwSOuDwDcmub
rWLEx3Phi+i8u6tZFiuriBd22ZWMgMUj/wCr279pxuwAM5NT6V4hg1nUL23s7ad7ezle3kvN8Xl+
chAePaH8wMCT95ACBkEgqTQ/4SO8/wCE1/s/y4P7K83+z920+f8AbPI+0567fJ8nj+9v7Y5pAHhr
wyNPee9ujfR3jahezCP+0JjCUkuJWQ+UH8vlGU/d4JyfmrPPhzVZbPSIEknsZINfv7ySeBomeKGQ
3ZRgHDKd3mxjGCRv6AgkXIvH2nz6XBqMNndPa3lwltpziW3Av3bdgRky4U4RuJdhz8uN3y0S/EHR
7fX4NFuQ8F47wxSJJNBuhllClIygk3sfnQbo1dBu+9hWIeoGWvhHUbl7O0nXyXtbW9U6kCrq949x
bXEdyI9wPMiM5jIChlZOU2ltjQNKuPDt3e2lppuNOm1CNIT54/c2yWMUavySW+eER4PPO7oOa9r4
r1G4+Fs/ieXTvs17HpTXixzbTHKwg8wMoR2Plk9AxDYHIFV7Xxbq8+vaFpslnBHulktNXdonAFwI
pnUQHd90+QX+cZ8uaE4+fgAyx4A1CbwFpVlc32ovqkVvY23yywxtYRia3ecRMigEqIQQzFz+7GDy
d3b6bBdjRm0+WJNPkgQ28UtkqCPaFAWSJDuCDBHyMDtKkfOoDNgWfxJ0vUQkdhZXV5ePcLALS1nt
ZW+aOWQMXWYxgYhk4L7vlHGCCbGpfEHR9IsLO9vQ8MFw8ySeZNAjQNC+yUFWkDSFW3DEQkzt4zlc
moFzWNJvZfD9rZR3E+oXEeoWczzT+WrsiXUcjE7VVeEU9AM47nrxF74L1pry7s/sk8mi2n2S3t1g
a3d7u1jF0VjEc2Yz5RnhX9797yd4O7Arr7rxzYWU5a4sr5NOEtxD/aW2Mw74EleUbQ/m/L5Mo+5y
V4yCCadn8SdL1EJHYWV1eXj3CwC0tZ7WVvmjlkDF1mMYGIZOC+75Rxggk1Ay7fwTqpW3giup7OGW
1UtJOIpntnglmktlKoFXh7hH2oNi/ZfLyyvmi38Makup6PdyaV51y0pu51vkt57WxMtzJcSLGd/m
rOu/aJEBR9qZA4KbE/xH0S20/wC2TLPEsnlNbJM0UX2mKUO0Uiu7hFVlilIEjI3yYKglQSL4iaZc
wNdWtjfXNlDai7u7uEwtHax75UYt+8y+0wS58sOCFypbIyagWNF+2XFj4i1XS/I8zUrp59ONxny2
2QRwo7besbNCXBUnKMpHJwOQ0nwPcPrNvBc6FP8A2At1DPJa6lFYhNwgvEd/Kt/3Z5e3GSNxwOyj
Hd+G9au9ZivmubB4Bb3tzbxz5Ty51jnkjBUBywICDduC5J44rDXxp5drHrN3q2lQ2U2nvqcOjiLN
/JbiNnUhjMAWIUsQEwMMu4430AZB8EXslt4hlk0iBr2PT5YdDlYxl7d1ub1oRC2f3W1Ht9uCu3Cj
jbgP1TwhqepDUbSHTkg1C4fUPO1mR4wt1BNHOsMBZSZWCebB8rKFHk8E7Uz1F14xtrRGkfTdR8uG
3+13bGNENpblnCyyKzhsMI3baoZwFwyq2FJqHjXTdO0Y6pNBdNALi8t9qIpbdbLOznlsYIt3xz3X
OOcGoHP3mhXnifxlbX2p+Gnj0tXtllg1E28oYRxX2W2o7ggNPDjvk5xwTUml+Hrqy1iGTU9A/tG2
jlaPTgPIcaYq3c7K6h2GxTE9vjy8sBEAQNqiur0vWhqNxcWs1hdWF5bokj210Yy3luWCODG7rglH
GM5+U5ABBOB4Z8ZyXHhawuNYs7qG8bRxqBkmaBFu1REMsiFX2oMuh/eeX98dAG2gHOaV4J1ezsZl
e3vpLnyoV1DzpLRI9TKzRPKFEahpt6JMoa4ZTiXDf6xyu3YeGp5vCfjHTbXRk0NNWeVbK1k8pVQN
aRRbiISyqC6seMnvjmrlp8RdJ1GK1XToJ729uZZYksoJ7dnzGqu+H83ymwskZwjsfm6fK+3bv9ch
sNZ0/Sja3U9zfJI8fkxgqqo0YcuSQFAEgOT1wQMsVVjUDjNU8NzXUEosfCn2ZZtP+z6XHi2X+xrn
fMWn+V8R7i8T7odzfu+RkKCTeHtVj163urPQIG1iDUL25/tu48oxyRyRXIgjdg3nlV8yBCu3ACcc
AGtSw+J3h7UzMto7yuqK9ukckMjXIaRI0wquTGS8kYxN5Z+fnG19smrfEXSdBlgh1eCexuHi8+aC
ee3V4ItzKGI8395nYx2xeY3HIBKgmoHMWeh3fh+C/v47C+so7aWym0yC6Szj827LyxOgS1/dr5qS
pD5jjI3hjxGuOr1LwuzeBk0fy01GRbiC6uldFUXjrcLPP8rHaDIRJhSQoLAZC9JIvGdmltqD3KTt
Ja+e0arCENzsuZIPLhUud8gZEXGRkyx8KXCiu3xK8OR6vd6fNc+X9l88PL5kb/NCrNKPKVjKNojk
5ZAp28E7l3GoGfH4TKz3up2ugwWV+2q6fJZuFhWaC0RLVJYw6k7VCpOhQHBG4DIYZxH8HazdahcP
caO5SdFn1OIpZpa3syXVvMViEeHkDKk4U3HIDgMV3Oa7fRda1DUfFOqWt1YXVhBb2VpJHbXRhLbn
e4DODG7jBCKME/wngZya9n49srm1sbibTNRs01BIJLMTiImeOWWKIONkjbQrTxEhsHDcA4IBqBX8
XeHbvXvDWmadplklmAkyeTIURbVXsbiFQQhIwrSIuE3e2QKpyeH3k1rRLnTvC/2OGDYPs19b2j2t
komZ3aMRyF4p2HIZNyn5AwyMp0DeLbMeIzoUdnfTXglaLMcQKDakDsxbd8qhblDk4ztYDLFQ2Xee
L7yc6Fd6ZpGovZ3l6Fjx9nBv4Gtp5FaPdJlRlEf59jY4xnIoA7bb7/pRt9/0rkdS+IOj6RYWd7eh
4YLh5kk8yaBGgaF9koKtIGkKtuGIhJnbxnK5km8daZBBql20M/8AZ+nStbS3vmQiMzh1j8nBkDI2
9gMuqpj5t20hi7+QHVbff9KNvv8ApWL4b8R6f4o0+S8sGysUphlTzI5NjgBsb42ZG+VlPyseuDgg
gbOB70CF2+/6Ubff9KTA96MD3pgLt9/0o2+/6UmB70YHvQAu33/Sjb7/AKUmB70YHvQBSjsZLS+M
lqyC1mZmmhbgK5yd6ehJ+8vQk7uDu33tvv8ApSYHvRge9Nu+4krbC7ff9KKTA96KQxf+BUf8CpvF
HFK47FTVtOh1fSriwnkdEmTAkiIDxN1V0JB2urAMp7EA9qypvBukSXRnjh+z4+y7I4FREj8iRZF2
jbxu8uJW9VijHG0VY8T31xp+gy3FtJ5LCWFJJ8A+RE0qLLLyCBsRnfLAqNuWBAIrl9H1jVdS8UWu
n22u/atJX7TIt8IYna+jjFmRh0ATiSaaMsq42qwxvG8LcDcuvDdk2ty3Vtq11YatdPJOHgaIv5ey
CORVSRGGz9zAScEg45AbBrjwPY6dDeS6REjTtZS2tva3p8y1w0NvEEcYLFMWsQPJOC/XIxxEviPU
Hu7HUrbXEutaOjym9s5HhRdIaS4shMCFjLRBAZDmUPt8rLBsMDv+HdX1/U9Z0yzk1y1ms2S7mee0
23H2lImtdoE3lRoTulkUsiY25X/WDeoB18OgWMfhs6DKr3Fm9u1vOZW+ecOCJGdlwS7kszMMElie
prIg8N6PrKXhn1Z9ZuFuI4bi5doGePyWYm3YRoqAESyq4K7iszqTggCPwNrN1q/2/wC16j/aE0Xl
l5rSWCawDNuJW3kjVX4GNyy5ZcrywO5sfwd/asOn+CNPi1qc2lzopvZ1kgiZtqC0CRIQo2qN7DJ3
MVZuc7WUA6xPCumxasNSjDpOL03oC7QAxheIp0zszLLJjP35HbPzEGuvg62gmkltNS1G0Nw8huvI
kQG4R5pJthYoWQBppQDGUbDfeJAI5BPE+sXFnZLb6873d6lr/aSRxwM2kTyXVtGYAuz5CVlnG2be
37rrlWzv+G9X1ObW4bW7vnuorhNRXEkca7DaXSW6suxV5dWLPnI3fdCD5aANSPwpBFq9tepqN8Le
2upbyKw/deSs0qyB2zs8w5M0jYL4BbgAAAGqeEbDXNSN1q0s95CsUsUNq4jVIRJH5cm11USfMpYE
FyOc4yqleTtNS1DQrW6ks7x7uaLXbv7VpLvChiWaW6Fsv3d6CaV7chmJ4YMMJuqRte16Cc2up6p9
hsraWDT7/U9sK+TKqXEjTZZSieav2I4YMq+fsHz5IANyTwP51+uoy+I9YfUEeJo7orahkCJOoUKI
dhBFzJnKk9ORirB8GWTmwSa8uprazuPtgt5FiKyXXmNIZy2zerl3JwjKv8O3aSpz5dX1ObwJBdR3
zxXE2pQ2kV9HHGWkga+WFZgCpQl4iGyF2ndlQBgVlr4m1Wyjm+0X89ys0WoRB2WJPszW13HapNuE
eFXEhllZldV2kqoUbCAbkHgKytLeztbXU9Rhs7d7SSS2UxFbiS3EYjdyYywOIYgQhUHb0BJJIPAV
laW9na2up6jDZ272kklspiK3EluIxG7kxlgcQxAhCoO3oCSTyC+J9buNMhvLe7tdWu9P1K6t7cW5
ivEumGmyTod6RIS4clP3YTgsp3Hk6aa5qV1rNlpmjeKf7Q0+4uoo21UR28xy0F28sStGqx7lEMLD
glS4LblIUmoHSXXhWGTQtD0KIJJp9g8KStcYMjQxxlcDjBL4VHBADRvKvetfUtNh1O3WORnikjcS
QTxECSCQAgOhIIzgkEEEEEqwKkg4muX9npPjHSNQ1K7gsrIafeQG5uZBHGJGktmVNzYG4hHIHUhW
9DXEXSaQuntf3U+h39y0t9cWmj6nClw95G15cSRG0BYFWmDAbwrh8R4B24IB1es+Ho4JdGmfxE9r
enUlMmpXMkK3E5ME8ccUYMfl5zJwgQDBdgNxJMkngnTNS0h0sdYvorfUbVorq4tXhf7dHI0khYlo
2UZaeVsxhR+8OOAoFjVreW4+IWgeVeT23l6feyN5IQ+aoltMo29W+U99uG44IrkPCuvXsOi6DbLq
nlXMcWmW9rpG2P8A0u2eG382faV81tvmT/MjBR5PIO18gHfWvh6C38Qz65Ncz3d68TW8TzJEvkQl
95jUoillyBjeWIxwRubND/hX/hzf5/8AZ0H23+0P7Q+3eRH9o8z7R5+PM2525+X12cZ71yieKtbl
s7I2WtpNf3aWp1CKSGKRdKuXuraMwFECsoIlnXZIxf8AdcMCrGr9q+qXPjm90SLXLq0iR5nknt7e
2Es7R2+nhS5aIgn985yAOw4CgAA3P+EKiMWoE6vfNd6jsW9u2gtS9xEqsqxuph8tlw7clNx4BbAA
Fiz8JWemTxDTry+s7JPKL2MMo8uVo0SNCzFTJwscYIDhWCfMDubdxlv4z1C+t9MvbrXU02/ubjSx
BpUYhVbyGcWxlcLIrSMMyzLlGAHl+qsT1epaoY/GMFhd63/ZNt5UD2qZhT+0JWkkDxZkUltoWLiP
aw83k8rg1AuJ4Ytl8LXfhw3d0+nz272sasU3W8DJsEaELyFXoX3N6k0/V/DOl62ix3cH7syvLMsf
yeeXt3t23kcn925GQQflXnAxXCp4n1i4s7JbfXne7vUtf7SSOOBm0ieS6tozAF2fISss42zb2/dd
cq2S/wDE+sWNsnna88MVxcTQSXUkcC/Zkt9SgtDIpKbQXjkdnLhgG5UIBtosB19r4Qji1uLV7vV9
Rv7yJ42R7jyVACJOgXEcajGLmQ+udvOBg17zwFZXNrfW8Op6jZpqCTx3hgMRM8cssspQ7422hWnl
AK4OG5JwCOfvPFN4umvDb+IEFuL1ltNduLq3tobmJYomKmbyJImfzJXVQkYyIHyco240XxJreo6a
PEM2pOoN7plv/Z6RRC323MVoXOSvmZBuHI+fqFzkZBNQNS68E3Goa8YribHhtZbi4+x/aA3mvPFK
kowIldMtPK2fOb0CjI2bkHhsLdWl1eatqN/cWtx58b3DRgf6qSPbsjRUxiZzkAMTtySFAHAeG/Em
vzS6DB9u061iNvp6R2DOsbXMLwQtJIlukBdgC8oDJIka+X8ygI+ej8JeJzPBezarqv2xllt4muLR
4Z7ASzOUWO3eNA/3mQMsuWXK8kHexqBoR+BrC3is/s17fQXFla21rbXKNGXiECyorAMhUsUnkU5U
jnIAIBqxJ4Ss57PVIJ7y+mbU9PFhczSShnK5mJcfLgMTO/AG0YUKoAxXN/ECPTZfFOgrql3oFtB9
ivSr67bLPCW323Cq0iAPjODnoG454r6Xr+pxjToJtQurbUEfT4IdFvDG81zBJHB500m5BK7p5k+X
UqoMByvyuCAdvp9jbaTe3FvDfPi7eS6jspGTEZL7pXTjeQXlBbcWALADaMCsjUfAVlqUItJNT1GP
TUSZYbCIxCKDzIZITsJjLgBZX2qWKrwAAoCjlPCtlNdf8IjZQeJL6O5ttFuY7gwrbGS1kX7EGtmU
xELtPUMN4PVq6OfxFd3HgzwzqlxeppUeppC9/fRhFW0V7dpMgyhkUGQImXB+/gfMQaANjV/DFtrF
xNLJd3UCXVuLW9ihKbbuAFsRvuUlR+8kGUKt8554XGHr/gmDVbXUbCy1idZvKuriDTneLyYprmOe
MyNiMy7WaWY/eIznAwoAz7LxB4lul1i4t7r7UunaU1zaW4tVY37+beRwuSuMrIkMTkIBuJUoVUlW
yLrXZrbXNRm0TxXBqcMsVhDc6rPdWyJaJ/prYMscLRp8yxr88bZ83HBZSAD0rS9FGnXFxdTX91f3
lwiRvc3QjDeWhYogEaIuAXc5xn5jkkAAUG8Faa1hpVp590BpdkLO1kDruXa8LpIflwXVreNhxtPI
KkHFc/pOteIrs3ssutacqWWjrdIzp/o8sjSXaJJJMUQmLbFGzMiqGIDJtQkNoaPrmoTeBtY1Gzlu
tVv7VJjbvN5M0dzIkQIELW6oJYi3AOA+dwIUjAALE/gS3vLK7s7/AFjUby3v7jz76OdLbF18kaBW
xCNoCxLgptYEk5zgjfk02GXWbbVGZ/Pt7ea3RQRtKyNGzE8ZzmJcc9z+HGTa7bJ9jjTx7u0qXz2l
1nzbI7J18nZb7/L8oZV5H2ld525BwCKp6XrPiTVrm2+2andadLe3sNlLaxW8S/ZCdNS7coJI2YP5
gZSHLAKxGMgMADpLbwrYGzl02PV76a3s/LhtrcTR408xlJYwoVRuZdsLDzd5wB1DtusP4XMkqzNr
mqi4aIQXU6NCj3cSs7KrFYxs2+Y4DRbG+brkAjhPDfiWe6vJdQTWUTVtRvdOlfRI/KKypNa2YllC
EGbCo0jZD4HlZOQGzY8LazrDeHbTVDqbiKC40myXT0t4Et9k8NmHOFjDgg3DsArAAhRjAwSwHbp4
V01TZlg7m1vZ71C+07mlkeVkbjlBIyuB2aKM5JXNV18M6bdPqNodRup9PkeZbjTFnURRyTqWk3FA
JMsJWbazkDzAQBhNvGaV4s8SzWM1xdanYlniha9ihlWaTSi80SyFlECiDy0eYlZmkIMWeQkhO/4S
1GCGz8XahbahPr8MOoGVZ7fypZLnbZ252oIgqM2RtAAHIwecmgDf0nQTpmoXd/Pqt9qNzcxRQs90
IRtSMyFQBHGg6yt1z2rE0XwELfQNOtNW1O6u7yzsobeGQGMLaMhifMWI13ASQxMPMD/6sA8Fg3Oa
T4n17UdZt9Fg8R2Nwsl1CHvbSeG+IR4LxmTcsMSBgbdGXKHBOWLqdla+ja9rl344ktbm/sRD9ruY
pNN88NNFAhcRyeSsO+PcFjbe8pQiTgAugAB0OleEoNM1eTVX1K9vb2Tzd8tyYhu8xYFPEaKOBbRg
YHds5zwWPhKCxbT1GpXsttpsoksbaQxbLdRFJCEBCBmUJKfvMzfKvPXO/wAUcUXA5S88A2Vza31v
Dqmo2aagk8d4YDETPHLLLKUO+NtoVp5QCuDhuScAixc+C7K+1K51G8vLq4vJECW8zCJWtFWVZkCF
UG4LIiMBJv8Au+jPu6Pijii4FTTbB9Pt2jkv7q9ld97z3LKWY4AGAoVFAAAwqgdSckkm7/wKm8Uc
UXCw7/gVH/AqbxRxTuFh3/AqP+BU3ijii4WGwwxW0EcECRxQxKEjjRQqooGAABwAB2qT/gVN4o4o
5gsO/wCBUf8AAqbxRxRcLDv+BUU3iii4WHfL7UfL7U3H1/KjH1/Ki4rDJ54LaIPNLHEpdUDOwUFm
YKo57liAB3JAqq+rabGju+oWqoiSuzGZQFWJtspPPARjhj/CeDioPEOmzapok1vbMi3aPHcWxlyI
/OidZYw+MnZvRQ2OcZxg81y8ngCaGbda3zzJapBLaC7lJZ5lmhlm8wheBI1rE24AnfLO5DZApMZ1
cOu6RcQW88Gq2MsNznyJEuEZZcOsZ2kH5vndV4/iYDqRWBbfEnw5c/2TP/aVjBZahayz+fcXkaeT
InknyXGSBJibJGcjb3zkGmeFrweLk8RalHYiZvtMhhjcy/Z5HjtYl2OyLn5Ld8thSPM24IyTJ4f8
O6lplxoi3RtfI0jTZtNR4pWZp1JttkhUqAhIhfK5bGRhm5wgNPxP4gt/DHh681WdfMaGJ3igBO6Z
1Rm2DAJ6KSTg7VDMeFJqC78WW9rZi9Gm6rJZJE09zcNamEW0Skgs6ylHOArHais2ADj5l3c/4j8O
X8fwdj0SOxg1C/stKEB2TyIyuluULQlULOx5UJ8u9WKk4JBuHSfFMZsI5Y9O1O1tU81YbnUJY9s3
mMy7m8lzMI18tVZtpLKXYFtpRgdHa6sl7qE9tbW88kEO5XvRt8nzVOGjB3bmYdyFKghlLblKiO58
SaFZXFzb3WtadBPaoHuI5bpFaFSVALgnKgl1AJ/vD1FYGleD5tN8SC8itdOgRb25u5dQgJF1eLMZ
G8iVdg+RWlU5Ltkwodoz8tz/AIRy8/4SL+0PMg8n+2v7Q27ju8v+z/s2On3t/Ppt754pAGreMU0z
WodNSz85nlWJ389RtJmtI+gyRxeBsNtPydMMGrTtfEOlXT2EH2+1jvL63W5gtGuYzK6FS2VCsQww
DypI4OCRzXC6Z8OdXsv7O8y5sT9m+y79rvz5X9m7sfL/ANOMuP8AeTpk7b+j+DNX03SrTR5HsXtj
Lp91c3KzPvjkto7dSiR7MOrG2HzFlI8w/KdvzPQDr9M13SNa83+ytVsb/wAnHmfZbhJdmc4ztJxn
B/I1UvPFOm23iHT9DiurWfULq4MUtstwvmwKIJJd7JycfIo5x98HPY09C8OXmmf8Iz58kDf2Vor6
fPsYndIfs+CuQMr+5brg8jjrjH1XwZq+p2p0XfYx6Ybq/uftvnOZv9KjuV2+Ts2/K1z18zkJnjOA
gLniLxdotrp9rr9j9l1oWz3KRtb3gZInS1lnb7u5d5WLZnGVEjY4JDdG+u6RHeXVpJqtitzaRGe5
ha4QPDGACXdc5VcEHJ45FcZ4i8G674mN1dzjTrO7mtzbCBLl5UCi2vI1beY1OS92Mrt4CE5JOBH4
k8Ea9rlzcjz4JFf7ZsuZtSnA2y208UafZQhiTZ5qKXU7iELHlyKYHbza7pFvLbRTarYxyXMrQQI9
wgMsitsZFBPzMG+Ugcg8dajv/EOlaVcSRanf2tiiJG3m3VzHGrFy+FGWzn92x5AB5wThsZl54fvE
8Q2FzoqQadbxRQQTzRXBG6CN2YQfZjGYyuCQHDK67jjgFWL3w5eXPjqz1xJIBbQ+RuQsd52RXqHA
xjrdR457N6DKA3/t9n/Z/wDaH2uD7F5Xn/afMHl+Xjdv3dNuOc9MVTXxJoTJZOutacUv3KWjC6TF
wwbaRHz85DEDAzycVmN4dn/4RO70yW3gu5pNQnu44/tktsvzXbTofNRS6MoKngfeXGcc1h694S8U
6voD2NxqSahPPZSwEyahLZrBI5f5iIIwtwNrIuHVB+6yAPMYAA6iy8U6bNFEb26tbGe4vbmzt4Zr
hQ07QztD8gOCxJUHAzjcBz3vx6tps2qS6XFqFq+oQpvltFmUyovHLJnIHzLyR3HrXCXPw+vpbi8Z
zBcR3/nxTIdRubdIo3uriZSyRY8/K3GCjFANhAbDEjpNE0bUtO12+m3pa6TK80i2aXTXAllkk3mb
50UwnrmNWZCXJGCCWAJL1/DVzrkjXmqQNe6dEJ5rV9RYJCi4cSyQb9nyllYOy8fKc8Li3H4k0KbS
5dUi1rTn0+F9kt2t0hiRuOGfOAfmXgnuPWuM8SeCNe1y5uR58Eiv9s2XM2pTgbZbaeKNPsoQxJs8
1FLqdxCFjy5Fbmr+HdSm8Vpr9kbWR7dLcw288rRiRkW7RwzBW2jbdBgQGyUIwM5pgaejeIbPVtBk
1nzYIrJJblfP84NGY4pXTzN/A2kJuz0APU9aJ9Q8P6xY2pfUbG4tppY5rdkul2yPHMm0qQfmxL5Y
4/iIU9cGhaaLq8Pg+4sTNBb6jNdXFywgnfZtkuXmMQl2hl3IxTzAu5c7gMgVl+G/Bd7YeJhrGoRW
uFe5eJDey3skTSR2kYIllUMTiCUE9g4UZGcIDr7PVtN1C4urey1C1uZ7R9lxHDMrtC2SMOAcqcqR
g+h9Kjtdd0i+1CfT7TVbG4vYN3nW0NwjyR7TtbcoORgkA56Guc8H+D7jw9cW5uFRhZWX2KGc6hc3
DTLlMsI5CEtwfKUlF3dQAwC/NT0/RPEF/B5X7jSo7PVdTurS7JaWYvI91GjGFkVQv7/eDvbcFXjD
ZAB1dt4h0q/Fs+nX9rfRT3BthLa3MbqriNpCCd3J2r0XJ5BxjJEGkeKdN17Wb6y0u6tb2C0t4JWu
bW4WVS0jSjYdvAIEQPX+McDvxk/w71bU7m6Ny8FlDcRCA51S41F1H2a9iLBplU9bpCEyB8rHIJ56
/RrLV/8AhIdR1XVbextvtFrbW0cVrdPP/q3mYsS0aYz5oGMHoaAI9M8Xx3+lx6rPpGo2Gmy26XEN
zc+SwlD7diqkcjuXbcMLtyTx1IBLjxfHZWrte6RqNteB4lisZPJMs4klSJWQiQxkB5FDfOCuQSAG
Xdn6V8PtN0/wpYWUVlp1prEFvaiW+trVcyTQtHJljhWdDJEpIJBYdweRHr/hnV/E1t9o1C00oXMH
lxw2P2l5YJY/tME0vmyGIH5hAqhQhA+bJbdhXoBuf8JPbJoWq6pcWl1bnSkka8tHCGWMpGJdvysU
JKMrDDEfMASCCBXg8b6Fca6NNXVdO2TW8MtpOL1CLppJJYykYz8xVogOCeWxgY5r2vhWZvCOuaNK
LXTk1RJkitrPMkFirxCPEfCZBYNIQFX5pG/3jHqHh/V9Xs/EbXKWNtc6roq6fHHHcPKiSKbnksY1
O3Eyfw5+9xwCQDo49W02bVJdLi1C1fUIU3y2izKZUXjlkzkD5l5I7j1qP+3dI/tf+yP7Vsf7T/58
/tCed93d9zO77vPTpzXOaV4PuLHxILuVUkt4r25vYp21C5c7pjIdq22RFGR5zLvBbIBO0F8rH/ZO
r3+va5bfZYIdMk1q0vftckriRvJitXwkezaylotm7eMEtwduCgOnh13SLiW5ih1WxkktpVgnRLhC
YpGbYqMAflYt8oB5J461X0vxPpGsaleafZX0ElzbbGMayoTJG0cciyoASTGRKo3dM5/HlH8C6le6
dpOm3y6c1ppNvBZIDI0gvIVuLaR2kQoAhKWuNmXBMmCwAyer0/T7yw17VpsQPZahKt15nmESRyCK
KLZs24K4i3btwOWxt4yQA1LxPpGmRan5l9BNc6bavd3NnDKjTrGq7idmcjIIxnA+Yc81Jpesw3mg
Lq1xc6csGx3kmtLwT26qpIJEpVQQAOTgYII7ZrlNY8GavqWlXejxvYpbCXULq2uWmffJJcx3ChHj
2YRVNyfmDMT5Y+Ubvl6vxDpx1XRJrRbVLly8bpE93Jajcjq4PmxgupBUMCB1AFAFCDxvoVxro01d
V07ZNbwy2k4vUIumkkljKRjPzFWiA4J5bGBjm2vijRBdR2k+qWNteSyvFFbTXcQkkKyNF8qhjnLI
QB1zwQGBAwG8Ka5c6Rr8N/qMF1e6poosFmfA2ybrkgNsRQVUTou4KC20naucVl/8Ixrv9oeJNIit
7U2mrWTxS3skzqIVmur5/kXyyJHVJ1LKWXnAzhs0wOzk8UaIv9oRwapY3NzYRSS3FrDdxeZGI/vb
gWATB4JYgAnkirFrrukX2oT6faarY3F7Bu862huEeSPadrblByMEgHPQ1wk3hjXfEGgX2mvb2tlA
l7q8trLLM/mStMbuJN8flgImJ94YM2QowPm41NT8E3mp+Hk0prqCLdqGpTySgFtsdyl2q4GBlh9o
QkZA4bnpkA6fTNd0jWvN/srVbG/8nHmfZbhJdmc4ztJxnB/I1pALiuG0C517Vta1TWP7NgsvMisb
VBP54V1jmlabAliifcI5flO3buI+Y4YDt+KNgH/L7UfL7U3ijincLDvl9qPl9qbx70Y+v5UXFYd8
vtR8vtTcfX8qMfX8qLhYd8vtR8vtTcfX8qMfX8qLhYd8vtR8vtTcfX8qMfX8qLhYd8vtR8vtTcfX
8qMfX8qLhYd8vtR8vtTcfX8qMfX8qLhYd8vtRTcfX8qKLhYdk+ooyfUUY+tGPrT1ArX1vLd2UkEN
7NZyNjE9uELpgg8B1ZeenIPX15rz7RdR8Syf8IlcxXf9rXOo6LPe3Ed9cLaxgn7Ifl8qEg7SzYyp
OHb5u1ekkcd6wvI0TQrjRrdInSeG3NhYRxLLMyQkxhshckICkQMjcLxlhu5ljMOx+Ig1TUrSOw0W
+mspvs4kmEMxeMzRxyKfkjaIKqyoWLSqRhsA4XdsXst7qfiGfR7XUJ9NjtLWG6ee2SN5JTK8qhf3
isqqPKYn5SSWXBUKQ1e50bwl4cis7q8lg062t/KhhFxftFA7RqBGWRn2SSKqLhmBYeWpz8oxr6no
tlq/lG6WdZIshJba5kt5FBxld8bK204Ulc4JVSRkDCAyH8R3FjePbG2+1WVldW2nXV5LOFnaeURb
WESoEZczx7juTHz4XgBs/S/Hl5eQWM93o8EENxFZTv5V6ZGSO8fy4MAxrubeG3jICqAQXJ2jct/D
+iXL2upQb7hCkUkbi8lkin2qPLldd5SVwAhEjBm+VDn5RiOy0Tw9J51naW+f7O+yWbpvk/d/Zts8
C5J52+YrZ5znBJxijQDL0/xxczaXa3mo6ba2Zv8ATTqFisd48wcfugI3xEGVy08SqEWQkkgDOA0e
n+ONT1e8i0+w0OD7ePP+0JeXM1sieWIG+XdB5hyLlPvInQ4yME6Gi+BdK0rQ7fT5vPvZIrWO2aee
4lYrt2ndEGc+R8yKwEZGCiEcopFiLRvD3hbzdXll+y7d/m3l/fyPjzPKU7nlc9fJhAyeNoA6nL0A
p2fjeG/FqsFi4nvXs3s4JJAGlt54/M80kAqpVY7n5c5PkcH51yeIvGcmi6yNOttHutQeO3S5uPIi
mdgjM6qIxHE4Lny34kaMfd+b7xWS1Tw/pGoaRMur2MVs+nx2Gi27XCjchKlvLYtmXeBbjvjYMH5z
mxe2nhrXNcksp7mCbU4IgLizivWR3i4IWaJGHmR/P92QFf3h4+Y5QFfVfFdxpcWr50rfNpdrLfTj
7QAjQBXMRVsElnKMu0qNuyQkkBPMp6j43vdHdrG+0dDqzPCIYbSaW4iZZFmYEskPmAgW0uQsTfwc
4LFbl9oGh+ItK1e1sLiD7TL9rtZruGUyvFNLHskWTDZbA2fu2OBsjAA2Ji6vhDRxbPEY7t3dlf7T
JfTvcKVBA2zl/MUAM4wrAYdx/E2WBS0zxRf6xdQW9ro3kyLFHNerfSyW7RI8kkYMamIs+fJkYbxH
lSnQsQuPp/jTV7XwdoF9qlnY/aL61SZ72e7eK1VfLjO6aUQlYpHZ+EI28EB84B6lPC2lRS2ssMM8
Eltja8F1LGZcMX/elWHnfMzMfM3ZLuTyzZjPhDR2t0tjHd/ZEdmFqL6cQ7SADGY9+wxYUARkbAMg
KATl2C5FqeoapB4x0awsUgltri1uZblJpfLwEktwHUhGJYCRsL8oO7kjAqPQvE82r3Fks9glvBqV
k2oWDpcGRmhBjz5qlVCPiaPhS4+983A3bN5pVrfXFrcTJIJ7V90UkUrRsOQSpKkFkJVSUOVO0ZBw
Kr6b4c0zSbhp7OCRXKGNA87yLChIJSJWYiJOF+VAo+VePlGFYLmU/im8FtdX0emwNYLdGwtna7Il
kuPtItgHTyyEj8zJ3BmO0A7cnaM+88eXlhPcQT6PAZtPiuZ9S2XpKxxwpBIfJJjHmMUuUwGEY3KR
nGGPQv4W0qSW6cwzhbnJkiW6lEQYsH8xIw21JN4D71Abdls5JNR/8Ifoht5YXtJJBNbz20ry3Ejy
SxzBBIHdmLMSI4wGJJAQAEAYosFzCvPHl5YT3EE+jwGbT4rmfUtl6SsccKQSHySYx5jFLlMBhGNy
kZxhiX3j26sp/wCzjovm6ukskc0MLzzQqESFyVeKB5DxcRdY1Gdwzwu7obnwro15PfTT2e+S+ilh
uT5rjekqRRuOG4ysEQ4xjbxgk5LvwtpV5PNO8M8VxNL5zz211LBIWKIhG+NgwUrFHlQdpKKSMjNF
guY1v4zvJ55J20XyNMjurW0kae4K3SSXCQMoMOzaNrXCK37zIwxwcAGObxvew6FZasdHRotVeMaZ
HFNLK7q8by5mWOFmQhE6IJeTjIALV0KeG9Jit5LeKySOCS4huTHGSqiSERiMgA4UKIYxtGB8vTk5
rjwho62726R3aRF1eNUvp1+zlQQPIw/7gbWZcR7RtO3pxRYLkX/CST/8Ij/bf9j332j7v2LyJfM3
eZ5eduzzPLz8+dm7Zzsz8tc2ni7Uk1LU9YSPTr3S7bR4Lu6FpqrSxxqst3vaA+VtkcrHgg7OUCk8
ZHa/2HZDSP7LjWeG26kwXMkchO7cWMisHLFslm3ZYk5Jyc118K6MtneWos/3N7a/Y7kGVyZYsyE7
m3ZLEzSEvncS5JJNFguc0nji+iGrSLpqXFnpKT3N5NNebZRElzcx4jRYtrELbEgMy9VBYnLGSbx5
eW63c8mjwfZrf7dNuW9Jdrezl8qZtvl4EhJQomcHJy64GdE+A9KfWrq+k88288So1mtxKkbt500s
hkUPtlV2nPyOCoGR0YitCXwro08EsMlnujliu4XHmuMpcuJJx97+JgD7dsCnYLnNXfxGkt31aSPQ
bqazsUuws4SYBnt1k3b2MXlKhaJlDLI5yUyoJYLJqHibxBFrOm6THp9jFqbXSGWAXrNBNBJBdMoM
ph3Kwe3JICdl5+Y43bjwfol29009pJIl0kqyQm4k8oeYpWRkj3bEdgz5dQGO9+fmObF/4c0zUriS
5uYJPtEiRp58U7xSKIy+3YyMCh/eyAlSCQ5ByDilYLlLSvEb6l4hvdNe2gtVt9+yOedkupAjhPME
JQAwk52yK7A8Dg5C4ek6xqsBu7h7VLq71LWLmxsTLqMgjYQyXHDpsKwBY4SAYwxc4LYJJHVwaNZ2
N/NqEUVzNdTEqWluXl8tWYFggkciNc4JVMA7F4O1RTZfDmmTWH2IwSJELiS6Vop3jkSV3Z3dJFYO
pJd87SOGK9DiiwXMrRfFdxrWtNp0eleWtvFvu5zcApG4muIGRRjL/PbnacDKkk7SArY+taz4g83X
o7YQG3tNa063tXN00T5drMmJgsZ/dt5r5fLH5iNpFdjp+hafpUry2Vv5cjxJC7l2Yuqs7gsSTli0
sjFj8zFiSSajuPDmmXV693LBJ5kjxSOqzuqO8bo6OyBgpcGNBuIzhQudvFFguc1fePbqyn/s46L5
urpLJHNDC880KhEhclXigeQ8XEXWNRncM8Lukn8frbSyyXOmvZWkNkbxo792gu5QIPOZYIimyUqM
K2JAVYNkAAFt278LaVeTzTvDPFcTS+c89tdSwSFiiIRvjYMFKxR5UHaSikjIzR/wiujGfzHs/MjE
XkpbSSu9tGmzy8JAWMafJlflUcMw6MclguVvDPiG61z7Ul3pM9jJBsIZop1jkDZ4UzRRMWG05AXA
DLySSBjv4+uIrGyvH0TzI9TihudOjgug0ksTzQRfvAyqscn+kxkKGZSQwLgAE9Tpmh2WkeabVZ2k
lwHlubmS4kYDOF3yMzbRliFzgFmIGSc04vB+iQnK2khCvG0SvcSOsGyRZFWJSxESBo0OxMKdiggh
QAWC5ha5r+rzKILe0gt47TVdOtb6dL5w6yPLbuyRqI/3kZWVVJZkJy3y4HNe1+JU91Yi9j8N3z28
32drQqsqeYss0UShmljSMSEShgEd1O1vnAAY9TeeFtKv9QW+nhn84SxzlY7qWOOSSMqUd41YI7Ao
nLAnCqOgAEcXg/RITlbSQhXjaJXuJHWDZIsirEpYiJA0aHYmFOxQQQoAdguVoPEty/iaLRrmztbR
9gDNPdOrTP5e9vswMQE6LkBmDKRg5Ucbqb+JtUbxVe6JpunwXcySyndeXvkoiRw2jELshY8m56HP
QnOCFHQ/2HZHV/7UdZ5LkcoJLmR44zt27kjLFEbbkblUHDNz8xyRaFp8Gry6rHb7b2Xfvl3sc7li
VuM45EEQ6fw+5yrBcwtQ8RX11p/hTUNBiRhq9wreRdyeUHia1mlCsyq5Ugqp+UHlcZwTWXZeL7zQ
9Nu7vWLXztO/tDVEhuIroyTnyZLmXaY2VQqhIXVcOeiDABO3rX8OaY+jWmlCCSO0s0RLbyp3jkhC
LtXZIrB1O3Kkg5IJByCcj+G9Jlt47eWySSCO4muRHISymSYSCQkE4YMJpBtOR83TgYLAUvDPiG61
z7Ul3pM9jJBsIZop1jkDZ4UzRRMWG05AXADLySSBj6X48vLyCxnu9HgghuIrKd/KvTIyR3j+XBgG
Ndzbw28ZAVQCC5O0dTpmh2WkeabVZ2klwHlubmS4kYDOF3yMzbRliFzgFmIGSc14vCujQQRQx2e2
OKK0hQea5wls5kgH3v4WJPv3yKLBc55/Hl4tjZXK6PAf7Vihn0xTekb45JoIv3x8v90w+0xnC+YO
GGeATJB4l1q78YWelJZ2sbwpcpqMBuiYwV+yOskcnlbnIS4+6QgJLAn5QTsxeD9EhOVtJCFeNole
4kdYNkiyKsSliIkDRodiYU7FBBCgCw/hzTJL833kSJdtcC5aaKd42Z9iJglWGUKxR5T7rbASCRRY
LnP+BNd1K40fw/ZavBH593o6XcFyl007TKixB2l3IpVyZUOAXz82TwM9rk+orOs9D0+w/s/7NbmP
+z7U2dt87Hy4TsyvJ5/1ScnJ+Xryc6OPrTVxBk+ooyfUUY+tGPrT1AMn1FGT6ijH1ox9aNQDJ9RR
k+oox9aMfWjUAyfUUZPqKMfWjH1o1AMn1FGT6ijH1ox9aNQDJ9RRRj60UagNx70Y96XJ9KMn0qbD
MbxP9r/sGX7EZ93mw+d9n3eZ5Hmp52zb827yvMxt+fP3fmxXJ6RpdxfeMLK4kTWBpNql22nyXEtz
HIF/0IhZS5EjAyLcEJLnIXgFQteic+lH4UAc3fynSPFMmrXlvdT2ctlHbW7WttJctBIHdpAURWZQ
4MXzAYPkgMQQmcPSrK60/U7O31iPVYbMYfTILJpzHAzXMzeVL5GUCpE1smJCYwFYISoY16B+FH4U
AeYaRZHTPD2gWF9H4jjsLa1aHUUt2vjIt8qQBQhj/eGEAT48v9zn321Ho0GsQ6jI95FrCeJZr3T3
lZVnFo8f2e1W5Lbf9GJwtwM9cgBeQtep/hR+FAHkmn2vix7MCXVNYF9I9mt+IrKdPJmN1B5jI80j
xsAvn58hBCVyWG3YD3fiC5Gi6VYm3sZ7uaOVYbeZraa9NsfLYec4UNI2F3DI5YsFLKGLDoPwo/Cg
DzC+sRFpuv2+n2eqzLrei/ZLR5bGYPNdGS7MhlGweTuedWy4RPmO3CqcGqWGr3GlNo+m2l8mr2uo
areLIsbxIqzR3nksk5xGWJuIeFbcMnIG1sen/hR+FAHH+Hb24sYJoY49VvdIh+ywWjXGnC2mR3cx
uoiEcWIY18pt2zgF+TtwvX/jS/hRz6UAGPejHvS5PpRk+lFgEx70Y96XJ9KjeURvGrK5MjbV2oxA
OCeSOg4PJwM4HUiiwD8e9GPelyfSjJ9KLAJj3pr7gPkCk5HBOOM89vT/ACKfk+lGT6UAJj3ox70u
T6UZPpRYBMe9MkjWWJ42ZgrqVJVipwfQjkH3FSZPpRk+lFgEx70Y96XJ9KMn0osAmPejHvS5PpRk
+lFgEx70Y96XJ9KMn0osAmPejHvS5PpRk+lFgEx70Y96XJ9KMn0osAmPejHvS5PpRk+lFgEx70Y9
6XJ9KMn0osAmPejHvS5PpRk+lFgEx70Y96XJ9KMn0osAmPejHvS5PpRk+lFgEx70Y96XJ9KMn0os
AmPejHvS5PpRk+lFgEx70Y96XJ9KMn0osAmPejHvS5PpRk+lFgEx70Y96XJ9KMn0osAmPejHvS5P
pRk+lFgEx70Y96XJ9KMn0osAmPeilyfSiiwB/wABo/4DRz6Cjn0FMA/4DR/wGjn0FHPoKAD/AIDR
/wABo59BRz6CgA/4DR/wGjn0FHPoKAD/AIDR/wABo59BRz6CgA/4DR/wGmxv5illUgBivzKVPBx3
7cde/UcU7n0FArh/wGj/AIDRz6Cjn0FAw/4DR/wGjn0FHPoKAD/gNH/AaOfQUc+goAP+A0f8Bo59
BRz6CgA/4DR/wGjn0FHPoKAD/gNH/AaOfQUc+goAP+A0f8Bo59BRz6CgA/4DR/wGjn0FHPoKAD/g
NH/AaOfQUc+goAP+A0f8Bo59BRz6CgA/4DR/wGjn0FHPoKAD/gNH/AaOfQUc+goAP+A0f8Bo59BR
z6CgA/4DR/wGjn0FHPoKAD/gNH/AaOfQUc+goAP+A0f8Bo59BRz6CgA/4DR/wGjn0FHPoKAD/gNH
/AaOfQUc+goAP+A0f8Bo59BRz6CgA/4DR/wGjn0FHPoKAD/gNH/AaOfQUc+goAP+A0f8Bo59BRz6
CgA/4DR/wGjn0FHPoKAD/gNH/AaOfQUc+goAP+A0Uc+gooATHsaMexpefQUc+gosAmPY1jWXifS9
Ss9KvLCV7i21Od4LeVYyo3KkjEkNggfumHTrjtzS+K7K91PwxfadYrGJrxRbM7jIjjkYJI+NwyVR
mYDPJA69K5S/8PawdVZ9T0221+xfUIr+WOC3jjDN9llgZdk0pBC7bduT1Y4zjjuw2HoVIN1J2etl
6L7tW9NVs973UuTT0PQqgvbyDT7C4vbqTy7e3iaWV8E7UUZJwOTwD0rgZ/DOptZzRvpXnyzW0kel
tviP9jyGaZkbJb93tSSBcw7iPIwMhUy/V/D+sX+nnQotPdQbzUZ/t7yxiDbcRXQQY3eZkGdAfk6h
sZGCbWCo8yvVVr67bL5/L8roXM+x3Go6jbaVZNeXjOsKsifu4mkYs7BFAVQWJLMBgDvRYahDqUDT
QJcoqtsIuLWSBs4B+7IqkjnrjH5Vh3+kC+8I2+n2WkPpsf2y2c2cbRwtEi3KO5Bibap2hmyrZ/Go
NV8OxQz2R/sq51zTY1m82yuLkXLeaxj2Sf6TJtwqpIPvZHmcD5mNZQoUJR5XK0rvtaySt16+thts
62ivPYfB+qLoOqpdF5dVma0RrhZhI08SQ2wnCeZlcyGKRSHAD4Xf8oGIJPCl4uk28FvpVzORPK9v
Z6klnLaRbljXM0MexUGVcqYdzDc7HJdkOiwVB/8AL5b/AKXvv8hcz7HoVpeQX0LTW0m9FlkiJwR8
6OUYc+jKR+FUdJ8R6Zre37DLMd8Qmj862lh82Pj508xV3ryuSuQNy56jNXw1pQ0qXVEfTUgnmvJp
3vUWPF0skskiDIO8lFcKdwGDnbkc1gad4X12z8PWtubqaS9bQzYQPJIkZ0yZoxnDRgbkLJGN3zOp
RSNwZisxw+HbmufZq2q2d/vtp1XpeyHd6aHfUV5tH4Umh0m4SLStW8l54nWwkTT9kjKsmTJAmyJo
zuTJ3+YSq427Far0Xh7UUvYfO0m2F8J7OSHUbXYsNlBGsIlt0LESqrbJgFVSpEoyRubDlgqKbtVX
4eXn5/gLmfY7uivNpPDusXdpoOlyaVcxR6XZw2k9yLmNFl23NmzNEVk3gbIJGBIVunAPFat54emF
3q0NppKLczwPHpOqR+Wq6cn2YRrGDkSRgOHOI1IHmZ6lsJ4Okv8Al6r69ujSXXrv39WPmfY7SqOp
axYaR9j+3T+V9suUtIPkZt8r52rwDjODyePeuEj8KTQ6TcJFpWreS88TrYSJp+yRlWTJkgTZE0Z3
Jk7/ADCVXG3YrV0d/oMuo6b4esLyztjDCxS/htCY4URrSaJggyGC7nCgDkAj0olhaFOa5ql1rta+
1+766BzN9DRbxJpKXWpWpu/3+m+V9qjEbkqZRmNRx87N0AXJJIGMkCoJ/Fml21rHczpqccUkvlKW
0q6B3kqACPLyMl1AyOTwMkGsSLwvf6drMN/Cv2s2cUE7MCqG8n/0zz8AnCMTc7wDhckLlRkrNDZ6
/faJPDfR3juur2ktuL024l+zpJbu5byfk4Kykd8Ae1aPDYXmVp3jpfVJ62vZW6b+S01abFzSOnl1
G2t9NF/MzxwFVYb4mDndgKuwjduJIAXG4kgYzxRYahDqUDTQJcoqtsIuLWSBs4B+7IqkjnrjH5VU
1qznnbT7y2j86XT7k3IgBCmYGKSMqCeA2JCRnglQCVB3DH1WC41ieyu77wvc3dlCs0T6ZcG2kYyM
Yyk20ymPACyLnduG/gYJNc1OjTmlra9+q030s7X9bpa+RTbR1tFeZ3PhufTfDl7NrNp/aN7LfaXE
xMgl+0oPsaSBd5AG+SNgd23dtXdwBjqdAtbzTVdYtJ+yWV1fFo7TzI1+ww+QATtQlPmlQnahP+t3
HncKurg6cafPGon9yvom7a+fbp30EpO9rHSY9jRj2NLz6Cjn0FcdihMexox7Gl59BRz6CiwCY9jR
j2NLz6Cjn0FFgEx7GjHsaXn0FHPoKLAJj2NGPY0vPoKOfQUWATHsaMexpefQUyWVIEDyvHGpZUBc
gAsxAUfUkgD1JosFx2PY0Y9jS8+go59BRYBMexox7Gl59BRz6CiwCY9jRj2NLz6Cjn0FFgEx7GjH
saXn0FHPoKLAJj2NGPY0vPoKOfQUWATHsaMexpefQUc+gosAmPY0Y9jS8+go59BRYBMexox7Gl59
BRz6CiwCY9jRj2NLz6Cjn0FFgEx7GjHsaXn0FHPoKLAJj2NGPY0vPoKOfQUWATHsaMexoC7RhUUD
OeBS8+gosAmPY0UvPoKKLALn2NGfY0nFHFFxGH4u1e50Tw7Je2e0T/aLeEGSB5woknSMny0IZyA5
IUHJIArOsPFFytvHFNb3Wq6hM8jRwWulvp7eUgTcxW6kGQGkQZDc7wAPlYjoNT06DVbRLeZnVUuI
LgFDg7opVlUcjpuQA+2enWq2qaKNRuLe6hv7qwvLdHjS5tRGW8typdCJEdcEohzjPyjBAJBTGZH/
AAsLRTZX18iXRsLNIWa7aMRxOZkieJVZyBlhMvXATBLlAVLR2nxF0nUYrVdOgnvb25lliSygnt2f
Maq74fzfKbCyRnCOx+bp8r7bn/CLaLpWhX1qsz2dgXhuvMaUAWpt44ljdWbIwgt42+fcCQd2QcUX
/hCPVdL/ALO1HV9RvLWVy12k/ksLofLhWHl4jACjHleWQctnd81GgFjw3rV3rMV81zYPALe9ubeO
fKeXOsc8kYKgOWBAQbtwXJPHFc34W8ePf6fHf6lqOlXdt/ZTajePpsTD+zioQmKUeZISxDPj7p/c
vwf4ev03SU0uW78i4nNvcStMts+0pC7szyFTt3fM7Mx3M2Oi7RxVBPB+lppVrpp89reHTxpkvz4N
1bCMoElIAzjJYEYKktggMwZAZdr8TNDvLdjAryXZuIraO0jubaRpXkDlAJElMQJ8uThnB+XGMsgb
UPiuBLwQS6dfRxpLDbXM7eUUtZ5QhSFwHLFj5sQygZBvHzYDEE3hma40+4tZ/EOqzNcYWWWVLZ90
WGHl+WYfK2ncSTs3HgFiAAK9n4S0hfKGnXk66ZFLEXsYZUeF5rbZGhZipkDIYIwQHAzF8wOWy9AC
48d6Xa6bpN/Jb3xh1O1S7hWOHe6o8kEYBVSSWzcpwu7o2MnANh/FcELXTTadfRW1jEZNQuW8opZs
IhMUcByzMEZf9Wrr8wwTg4pp4Cslmsy2p6jJb2CRx2Vqxi2W8aTQyqikRh2GbeNcuzHAPOTmrl/4
fsJr65FxqE8Vtq+6K60/fGI7xzCUPJXzA3loOEdeI84+8StAMu1+Jmh3luxgV5Ls3EVtHaR3NtI0
ryBygEiSmIE+XJwzg/LjGWQNc8UeINU0mx0a4sNP3zXV0BcWkqeZMIlglmkRAjYM2Iiq8lSxHODm
rE3hma40+4tZ/EOqzNcYWWWVLZ90WGHl+WYfK2ncSTs3HgFiAALa6BYxQ6LBArwwaO4a1jVsgAQv
CFYnJICyHvnIHPXJoBzFt411K+1+70+3gtRBdvAmjzOjcqwud8suGw6EWjvHsxvVo8ldxZZLnX9X
bQYb/SvEfhzUv+JhDaSS21k7xjzZYowPluThl8wseeQVGF6ncm8K6bJcPPCHtZBbwQW5t9qfZfJM
vltEMYUgTOpBypX5SCpYGODwpBHZ3UFzqN9eSXOoQahLPN5QcyQmIoMIiqF/cIDxnrzk5pgT6lqF
5YWunWimCXU7+UWscpjKwrII3kZym4ttCxuQu7JO1dwyXED6rqOk+TZ30f8AbOp3HmSxQ6ZbLb4h
TYGY+dMV4Z1H38neMLwTWnqWmw6nbrHIzxSRuJIJ4iBJBIAQHQkEZwSCCCCCVYFSQcx/DM0nkzN4
h1U38PmLHfbLbzBE+wtHt8ny9pMaNnbuyPvYJFICmPH+mz29xcWNjqN7BC9sgkiiVFla4EJhCGRl
BLCdSQcbdp3bcpu29J1ZNVin/wBHntbi2l8m4tp9u+J9quASjMpyjo3ysfvYOCCBgT+ErP8AsO80
jQLz7Mw1CxlfEoc2vkfZsKuVb5vKhQgODksCeDWvZeH0smjk/tC+luPtRu7iZ3VTdP5RhAkVFVdo
TZgKBzGpOTkkAqat4tttG1mSxnV5ZXS1W2t41RGllmacBRI8ipkiFuDt6YBYsFF/VNbj0jQG1e8t
3iRERnhkmhjZCxA2l3kEYIJ/v4PYnjMGqeGo9TuLyddQurV7y3itZxEkMiyRIZTsKyxuCD5zZ45w
OnOXz+HLNtK06wtJJ7FdN2fYZYGDPBtjMYx5gYN8jMvzBvvZ64IAIB4usJfCsPiC0inu7eaVII4o
DGXaVphDtBLBDiQ43BtpxkEjBMmneJ7bUNUXTDaXVtfhJmlgnCEwmPySVYozKSVuImG0kYJyQQRW
fd+Gw3hw+HbDVnN4l7DqEs8zR+cu6889pNoTaCSsm3KbSVx0BqwPCEcbi6h1fUYtULu0uor5JllD
rGrKymMxgYhhHyoD+7HPLbgDL0HxydQubu5msr7+yp7q1W1u2WEJAJ7a3ZI3AfeWMk3UKwG8fNgH
EfhfxvPfaJYpNbXWq6tJbwu8NrFFExH2W2lkcl5FQgNcJ02n5wApClq0NN8BWWmCKCLU9RksEe2k
NlIYvLeSCOJI3LCMPkeRG2AwBK9MEglj4CstKhhGmanqNncRIsa3SGJ38sQwRFMPGyYItomJ25yD
ggEinoBHpvjBIdP1I6l58lxay3jxBUUG5RLyaFIoRkb5BsiTHrLHyS9amo61d2XinSdLhsHuoLy3
nklaIoGh2PAoc7nUbAJWyAGbpgdar/8ACKwrqWmlQj2drcXd65lwZWmll81U6YMQZmfHUPFAckrm
tO90lLzULK/W4ntrm13KHh2nfExUvGwZSNrGNMkYYbeGGTlAYj+PtPTwtaeIWs7qKyu3RYBdS29s
zhk37h50qDHBHXJwSoZcMa+peNRdWtrJoMF1PbyXunxyagqRiKNZ5YG2MsjB8tFKvKoceYOQQdug
nhuyit9M07T9WurO80iyW2jmhaJphbsFXDq6MuGMCndtBzGcEDcDXg8BWVpb2dra6nqMNnbvaSSW
ymIrcSW4jEbuTGWBxDECEKg7egJJL0Ar2HxO8PamZltHeV1RXt0jkhka5DSJGmFVyYyXkjGJvLPz
842vtuaP4jla38TX+sRz2Ntpt0f3U6ozwQrawyNnyiwblnbgsfmx7CSLwdbRWH2E6lqL2kKRpZQt
IgWyEbq8ewBBvKtHHgy+Yflwchn3Sab4fsJNF1GKXUJ9YttbzLcXEzx/vkeFIvlMSoNpRFwQPfNL
QAfxNNH5MLeHtVF/N5jR2O+28wxJsDSbvO8vaDIi43bsn7uATVOLx7ZXcu3T9M1G9jkeOO2miESr
cyPAtwEQPIrA+U28lwo+UjO7ANx/DM0nkzN4h1U38PmLHfbLbzBE+wtHt8ny9pMaNnbuyPvYJFFh
4P0vTJLY2nnxx210t1DFvyqlbQWiryMlRGAeTndznHFAFe18c2F7OGt7K+fTjLbw/wBpbYxDvnSJ
4htL+b83nRD7nBbnABIry/EXSYr6+sFgnmvbWVYlt4J7eR5iZ0g42ynZ88icS7Dz0+VsV9E8Ewad
fXNg+sTy2UEtncRacHiOVhhhjikl/dhw3mWxI2sFOwcfeFXE8BWSzWZbU9Rkt7BI47K1YxbLeNJo
ZVRSIw7DNvGuXZjgHnJzT0AuQeLrBp/JvIp9OkTzRP8AbDGqQPGiSFHdWKbjFIJBtJ+VXJIKkDXs
Lr7dp9td+RPb+fEsvk3CbJI9wB2uvZhnBHY1iap4VhvpWACPBeakl7fCbBIVYBFsj4xhxGiOG6pJ
KM/MBWnb2t4uuX95NP8A6NJFDDBbhywXZvZpCDgKzGTaQM8Rqc84VAZFz480i1guZZBP/o8V7K6A
Ju/0Z3RlA3fefypWQfxLE542nGXH43nsdE1SfUra6jMNxqSWt80UUkUpgedlRUWQOSscLfeCA+Wf
myQTuXHg3SLn7Z5kOftd0ly/yp8u370a/LxG+Zd6/wAX2ib++aj1DwVpuo6MdLmnulgNxeXG5HUN
uuVnVxyuMAXD447LnPOXoBT1zxXdLp802ladfPHDqFvbC6XyNk7fbI4ZYUDvuDHMiZZVXgkNjBOv
B4js20rUb+7jnsV03f8Abop1DPBtjEhz5ZYN8jK3ylvvY65AoX+haZp1tcXF9rc9npAuo7xoJpIU
gimFyk+7eyb/AJpRyC5HzkAD5cabaBYyw61BOrzQaw5a6jZsAgwpCVUjBAKxjvnJPPTCAoDxnZQ3
UdrqdndaXcM43JdtFiOMxTSCVnR2QIRbyjrkFeQAQarnx7ZO9nDa6ZqN1d3SRFbaMRK6M63BKPvk
UK6fZZQ4J4IA5OcWH8GWV0kp1O8utRuJXh3XNysQcxxsxEWERU2ESSq3y5ZZXUnBAElv4c0g6zJf
W0n+kwah9pkSNkxHIYGTyyAMhSJ3l29d8rN/EcmgEdt4zsr7UrbTrOzuri8kQvcQq0StaKsrQuXD
ONwWRHUmPf8Ad9GTd02fY1zLeDLKSa1868upbS2vX1BLR1iKfaGmeYSbtnmAhpCBtYDAAOQW3dLx
TQC59jRn2NJxRxTuIXPsaM+xpOKOKLgLn2NGfY0nFHFFwFz7GjPsaTijii4C59jRn2NJxRxRcBc+
xoz7Gk4o4ouAufY0Z9jScUcUXAXPsaKTiii4C5ozRk+lGT6UwMLxfqF9pvhi6utOMa3AeJPMkO1Y
kaRVeQthgoRCzbirBduSpAIPLWHiHWho0c6ara6ldfaJI4VtUN4s8G1C8xaOKLzDCxY/uwFbiHmV
gw9BubiK1tpbi4kSGCJC8ksjBVRQMkkngADvXPWfjfQrmHULuXVdOg0+1vRZxXrXqeVOxhjl+Vsg
Z+dlwCfuE+wTGjlPEerrdaF4ntZ/E+fL0qdbC03W4/tOA2Qf7R9zc+XaT5oyqfu8Y4bNu88Y3duL
ewTWNOh1oalqKy2966J5dukd28DSqPmWLCQNvGCVwcndz3bX9mnmbruBfKlSCTMgGyRtu1D6Md6Y
HU7l9RWZe+KdNhilNldWt9Pb3ttZ3EMNwpaBpp1h+cDJUgsTg4ztI47IDjNP1jV9RurZtNu57+8i
tb2RJZxaSLdmKSyYxQTxoq+S+Xj3kAhiSyhowqv1fxLrb29jfQapa6bpepvPc29zdXMVqscSiJYE
EskMqkyqZJtjIHGSMjyyD27eJNCVL121rTglg4S7Y3SYt2LbQJOfkJYEYOORihfEmhMlk661pxS/
cpaMLpMXDBtpEfPzkMQMDPJxQBkarq99b+HdCnvL5NL+1vGupX8cflragwu+4eepEYMqon7xc/Pj
AYjHCWXiHWbO0SHS9bsVtvNvJ7S4urhE/tOVr65BAVIHM/CxnZD5bfvRg/Ou31KTxJoUOlxapLrW
nJp8z7IrtrpBE7c8K+cE/K3APY+lSf27pH9r/wBkf2rY/wBp/wDPn9oTzvu7vuZ3fd56dOaAOY1H
WPEtrPqtnaJ9oudMiudQVvLV/tUTI5tYfLXkZcuuVO4/ZOceaK5iXXtceG1uob+x12a0upJbI2s4
vN8/2C9Pll4oYUblY/kUFxuJJwyV6V4f8Qab4n0aDVNLuEmglRSyq6s0TFQ2x9pIVwGGRniszVvH
OkWelQX1hqOlXkdxdfZEnfUEjtkk8tpCJJQG2fKpxwSSyjAByADmLvxO8V9bW0Pjbfokl1Ckmubr
Q7WaG6Z4fMEflDBhtzjbuHmcnDLgj8Qa9dTSOuszpDF9jghMcMJW4juL+e2W4JKHLGJI5FK4Qtg7
Sp211fiDW9F0zX9Gg1qa1tU2XF5b3d1dCFY5UCRbRkgMWS4fqeNp4PUa8mrabDqkWly6hapqEyb4
rRplErrzyqZyR8rcgdj6UAea3vizxKLhYYtTsbb7P50Vu93KsR1CWO6nh27BBI0zbYYiyQ+W2ZeP
voFk1671u58LaiRf3V+dVuNX0tLAwRFUWNLvy/L2IHL/ALhF+ZmzubjJBHR23xJ8OXP9kz/2lYwW
WoWss/n3F5GnkyJ5J8lxkgSYmyRnI2985G3rXiDTfD4sn1S4S2gu7j7Os8rqkcbeW75dmIABEZA9
yB3oAyNR1KeHwXbXWia+l/LLe2sEepSLFMriS7SNsiMKjABmX5dp46g81hy6tNY+INRsL7xB/ZOn
rdMJNVZLaJ5JUtbLYju8fllnEkzfd3HywFIVSK68eKNEWUw3OqWNrcDzj5E13EHKRM6u+Ax+UeW5
PptO4AggZmoa9oGqazHod7qaW6S29teWU0GqtbNdmVpUCxmNlLj5AeCQd68cDIBynhXU9VOmS+In
1Wd5rnUNKjubUxReTM09tYo7nCbw2JSRtYKCq8EZBjsdYudE8DeHbePxG7GO3EN1aQTWg1FJ0iiU
WsETx7XKFiGjbEuSuGJ+VvRo9W0KxeXS4tQ063fT7ffLaLMiG2hVRyyZ+RApXkgAAirhv7NbOa7N
3ALaHf5sxkGyPYSH3N0G0qwOemDnpRcDkPG1/e2eu6RFY3P2WS4iMRuEhjeRA97YxNtLq2PlkbjG
CcEglRg1FtRvfBfjjSHln1G4s4p7SCQxr50++zSQArGoUtulKjao4C8E5J35vFnhy3s7a7m8QaVH
bXO7yJnvIwku04baxOGweDjpTNd8U6boc1raS3Vq2oXNxbxRWTXCpK6yzLFvVepAyzcDnaRkdQAc
ZdXc0F1r+u6T4nnvl07QILpZ1+zSR3pSS9YLIUjxtBUr+72HGec8i/o2va5d+OJLS4v7EQ/armKT
TfPDTRQIXEcnkrDvj3BY23vKUIk4ALoB193rukafeC0vdVsba5MTTiGa4RHMagln2k52gKxJ6Daf
Sq8/ijRLT95d6pY29s0UUsd1NdxLHIJN+zaS2eRGxBxgjoThsAGBqf8Awjn9val/wm39lbfNT+y/
7W8vy/I8pN3lb/l3eb5m7Hz42bvl8usDU/FniW3n8QSpqdjDJaxagVsPNV5oI4klMM3kCDcm7ZE2
+SVkYScDLoB6NJrukQ/YfN1WxT+0MfY91wg+05xjy+fnzuXpn7w9aJtd0i3guJ59VsYobbHnyPcI
qxZdoxuJPy/OjLz/ABKR1BoA4TX5Ly08Q2On33iK6js7C4t719WnW3R7YSwX0RDN5YiCFo41BZM5
kIzkri5Nreqw+Gr++udW8tp9VubO3nJitobKOK4mAaWVo5ANwTZuKEEmNQAxLnpP+Ep01L27We6t
YdPt7K1vBfvcKInWd5VX5jxj92MHPO8fjfm1bTbbSxqk+oWsWnlFcXbzKsRVsbTvJxg5GDnnIoA4
z4f6tca3rGoXt1NBPN/Z9vCZoJA6SiO7vo1cMAobIQHcFUHOQqjgYjeM9YutVazttZSNL54nEazw
TXenBr22iMbx+QoifZO6lZDKQyfe+UlvRn8SaFHcWlu+tacs94iPaxtdIGnVzhCgzlgx4BGc9qsa
lq2m6PbrcapqFrYwM4RZLqZYlLYJwCxAzgE49jQBxE+u3lrq1xpGp+JX07T7S4liOsSi3jkkcQ2s
kcTs6eVk+fNgBASIh6MWIYdNm+EvhQapqmnWEC2VoV/tQK9rO3kY2SxsyiQYJYDcMMitztwe31LV
tN0e3W41TULWxgZwiyXUyxKWwTgFiBnAJx7GiLVtNmeBItQtZHuER4VSZSZFdWZSvPIKxuQR1CMe
xpAec/8ACQz2GksllPa6MltZPLpNnZwRRw6xOJp12xoyksj+XC4WJg2LgfM25Wo8U+Iru88O3egJ
epLrVzcatbS6cgQ3DW4hvDAPLA3AELAQwGWBXk7ue6/4Szw5/Z/9of8ACQaV9i83yPtP2yPy/Mxu
2bs43Y5x1xViTXdIh+w+bqtin9oY+x7rhB9pzjHl8/PncvTP3h60wOBuruaC61/XdJ8Tz3y6doEF
0s6/ZpI70pJesFkKR42gqV/d7DjPOeRt+PQNTfS/DsmkXWq2l68lxfWtvJHGZLeJRxueRMETSW7c
EEhW7cHY1LxfoWkvbC71O1RJrg27SGdAkLbZTmQlhtG6CRP94Y7HGmt/Zv5e27gbzZXgjxIDvkXd
uQerDY+R1G1vQ0Aea2XiTxBfQQvNqV1aXFtb6dZ3cHlW5BupbyazuJCdrchoyybTtyBlSCVqO98W
eJRcLDFqdjbfZ/Oit3u5ViOoSx3U8O3YIJGmbbDEWSHy2zLx99AvpUmrabDqkWly6hapqEyb4rRp
lErrzyqZyR8rcgdj6VQ8K+I4fFOjDVLc2vkSP+7WC5EzIpVWCy4AEcoDfMmWx/eNAHH3+sa/DpsW
qJKmoXY1jU4bK0NmrbRBFfCNRgby5MaqSpUlQF6ly9jVPEKW+jW6aX4zS7Etw5bVri+s4YY9qr+4
Mq27pvO8OqbNxCudwC4PZ2Wu6RqcUcthqtjdxySmBHguEkDSBS5QEHlgoLY64GelE2u6Rby20U2q
2MclzK0ECPcIDLIrbGRQT8zBvlIHIPHWgDlLq5u/EejeAL1rp7C7v7iO4ea0VMxs1hcOQokDjHJH
IPB9eazNb8V6rZ2uqz2usf8AEzi/tFZdL2RH7DBDHO0Fxs2+YNxjgO5yUPncD5kx6Nb39ndyyRW1
3BNJF/rEjkDFPmZOQOnzI6/VGHUGq+m6xb6rPqMUCTq2n3RtJfOjKbnCI+VB5K4cYOOeoyMEoDE8
WWt2ngtUudQdp472zmnvY4kTyVW7jd5ApBVUjUE/NuwqZYtgk4dlcXVlfavq9jrk93btrWn2xjKw
NDdLNDZRmUsqBtxWTcNjKuQvy4yD1i+IpJtbutOttE1G4S1uEt57tGgESMyJJnDShyAsik4U98Zq
3d67pGn3gtL3VbG2uTE04hmuERzGoJZ9pOdoCsSeg2n0pgcj4C17XNW1E/2nf2M2+1825s4pxLJY
z5X92yrCnk4y4KSu7kpwTscn0HNcj4j8c22hWi3FtAl+jW7XKNHcoFdPs9xOpGNxwfsxGSADvyC2
0gbA8R6WhgS5v7W1lubiS2t4prmMNM6SGMhAGO47scDkZAIByA0wNbNGazbXX9JvtQn0+01axuL2
Dd51tDcI8ke07W3KDkYJAOehqSTV9Oh1SLS5dQtU1CZN8Vo0yiV155VM5I+VuQOx9KLisXs0ZrJ/
4SbQ99yn9t6dvtXZLhftUeYWCsxD8/KQschIPZGPY1Yj1fTptUl0uLULV9QhTfLaLMplReOWTOQP
mXkjuPWi4WL2aM1R03V9O1i3a40vULW+gVyjSWsyyqGwDglSRnBBx7ir2T6U0wDNGaMn0oyfSgAz
RmjJ9KMn0oAM0ZoyfSjJ9KADNGaMn0oyfSgAzRRk+lFACf8AfNH/AHzRn6UZ+lIZl+IdNm1TSDBb
tEJ47i3uYw5IV2hmSUKSASoYpt3YOM5wcYPHT+D9cu9WuNauIbUXctxKws7XWbm2UI8Nqm4zxxq5
INr9zZg7wc5UZ9Fz9KM/SgDkrPwatlf6X5ciLp9tbxfaLaPcscs8CbIX2NuyNrEksxbMFvg/Jzh6
d8Pr6ztrGAmDdp/2WKK4k1G5uDNHFcwSuRG/yQZWAfIoYZKjcoX5vSc/SjP0pAeZX/hjXbTR9HRb
e1nfREs7G0WGZ2N2ou7RjJJ+7/cgLbgkDzMBmOfl+a5feDNX1Jtau5XsYbnVdPv4GhSZ3SGSaK1i
jw+wFlxbFidoI3YAOMn0HP0oz9KAOC1TwZqE/iG71iApMZLiRo4F1O4sTseC1Qs0sKlshrY/Jggh
wcgrirFn4NubHRrjToZLUIdS065i2b1URW62isMNuIJ+zvgFm6rluprtc/SjP0oA5a18OXj/AA9n
8K3ckEWNPbTIbmFjJvj8ry1lZSF2seSUBIHTcarp4f1e98VWWv36WNtJDLEHt4Lh5h5ccN2oYOY0
yxa6Hy7QAEzuJOB2OfpRn6UAc9rNlq//AAkOnarpVvY3P2e1ubaSK6ung/1jwsGBWN848ojGB1FY
eneCtS0uyh0aKe1n0/7RYXMt4zskqtapbrtWLaQwb7MvzFxjzDwdvzd7n6UZ+lAHJeH/AA7qWmXG
iLdG18jSNNm01HilZmnUm22SFSoCEiF8rlsZGGbnBD4d1Ky8MeFraA2s2oaEkRMbyskUzLbPAw3h
SVH7wsDsOdoGBnI63P0qOFGigjjeVpmVQpkcAM5A6nAAyfYAe1AHDQeCtSinv3ae1xcXttcJh24W
PU57tgfl6+XKoH+0COnJrv4N11Rr1pENOa01u3ntpZ2uXV7dZLm7k3KnlkOQl0vyll5UjOOa9Fz9
KM/SgDzbUPh9fXUWrW0ZgZZ/t8ttczajcsBJcrMAPs3+qj2+eQXG8kKTtBfK9nqmmzPoDafpDJZl
ERIkjJiXy1IzEGUZjDKCm5RlN25RkCtbP0oz9KAOG8L+E9T0rxHLql55Eccn2n90L+a8dfMSzVcy
yqGb/j2cnPTcoGR0p6b4N13S9Gs9IQadNA1xptzdXDXLo0bWy2yuqJ5ZDgi2yGLL9/BAxk+i5+lG
fpQBy2seHLzUNYuruKSBY5f7L2h2II+zXbzSZ47qwA9T1wOay9O8FalZ+KYdUkntTAl7JcFVdt21
n1FgPu4zi9i7/wAL+gz3ufpRn6UAeZ3ngS5+13AmltZV1Vri3aN9TubZVV7m5nH7uLH2g7JzmNiu
PLbDYYkbf/CL39roM9rZNAk8+q3N9cpDcSWv2pJJZGVWnjXzEYBoiSoOfK2fdOa7HP0oz9KAPMrL
wJrFlE0/lWsl4HEluV1adGtpPPvZN/mmJjKQt0q4dSH+fcCOG6y/0nVJLHRJY7iC+1PS5Vmdp/8A
R0u38iSFiSqt5efNL8K3TbxnI6HP0oz9KAOCTwVqQ0nxNA09r5+s6bJAgDttimkmu5WBO3JRTdKo
bGTtJ2jpW54m0vU9R+ymxfzIY9/m2v8AaE1jvY42v50IL/KAw2Y2tvyeUFdDn6UZ+lAHDTaTq+k6
F4FsbS1gvb3TJY4pgZXSEbbKaNmLhGKrkgAleSVHGajtvAUzxa8LuW1SfVtNltBNGhka2aae6mkU
EgFkBnjGfl3eXkheK73P0oz9KAPPtT0zxG3iXS9d/s6xa9a6ih+yx3cjQpHHb3v7x5vJyuTcbcbC
Mhefm4r3Hw+vpnneQwT/ANoxSR3cf9o3NvHB5lxPM3yxY+0qPtJXa5jyI+q7zt9Jz9KM/SgDjovC
15YWcE1lHYtf2+tXeqGNnMSXHnGdVDyBCQwjmXna3+rC9PmFjTdG/wCKu1G7KTpZWspa2hlGI/tE
saGaWNcY24wAw53y3Wc7q6nP0oz9KAOSvPDupTapeRxG1/s++1K11KWdpWEsTQeR+7WPaQ4b7Ovz
F1xvPynb81iDw3M3w1i8LXFwkc50cadJPGC6q3k+WWAOCRnntn2rpc/SjP0oA4648P6vqMuoarcJ
Y2ermK3FikNw8scckDSurNIY0YK/nNG6qudm4bjvwM/U/h8zyiK0P2m2m0+OwuDc6jcW5+VpWaWR
YcC5ZzMzMrFMkH5vnJHoOfpRn6UAYvhzRv7FsbuJkgE1zqF1dyPCPv8AmzO6ljgZYIUU/wC7jJAF
VLGw12zl8UzpFpyT31wbjTy07uu4QJEolGxSozErHaW+8R2BPS5+lGfpQByWpeGZrzxIl9Bp2jwv
9ognOrIpS9RYypaLhDvDqhQtvX5JCNp2/PJrHhy81DWLq7ikgWOX+y9odiCPs1280meO6sAPU9cD
mupz9KM/SgDy/U/hzq97/aPl3NiPtP2rZud+PN/tLbn5f+n6LP8Auv1wN1+TwZq6W2t2sL2Lx63F
c2s8jzOptY3ubqRXVQh8xtt1ypKAFMbiGyPQc/SjP0oA5a18OXkH9k7pID9j1q91CTDHmOb7VtA4
+8PPTPbhuTxmnr/hrWNU12KdJUltFvbS4Rn1GeEW8cUkbtH9nRTHMSUdg7kHMgHRFNdrn6UZ+lAH
FWPhjUhaeGtNv7fTpLPQLiJopRM0jXCx28sSuYzGBG4Zo3ADNjn5sqM0z4Dla8vUuLaC8tHlvbhP
O1W6USm4EuY/IH7uHiZlMi7zgE7QXyvoOfpRn6UAc9oll4gsbWCO8uoJla6ZpI5JWma3tvLIWNJd
iGVt4U7pBnazAliAx6H/AL5oz9KM/SgA/wC+aP8AvmjP0oz9KYB/3zR/3zRn6UZ+lAB/3zR/3zRn
6UZ+lAB/3zR/3zRn6UZ+lAB/3zRRn6UUAG3/ADmjb/nNHHp+tHHp+tGgBt/zmjb/AJzRx6frRx6f
rRoAbf8AOaNv+c0cen60cen60aAG3/OaNv8AnNHHp+tHHp+tGgBt/wA5o2/5zRx6frRx6frRoAbf
85o2/wCc0cen60cen60aAG3/ADmjb/nNHHp+tHHp+tGgBt/zmjb/AJzRx6frRx6frRoAbf8AOaNv
+c0cen60cen60aAG3/OaNv8AnNHHp+tHHp+tGgBt/wA5o2/5zRx6frRx6frRoAbf85o2/wCc0cen
60cen60aAG3/ADmjb/nNHHp+tHHp+tGgBt/zmjb/AJzRx6frRx6frRoAbf8AOaNv+c0cen60cen6
0aAG3/OaNv8AnNHHp+tHHp+tGgBt/wA5o2/5zRx6frRx6frRoAbf85o2/wCc0cen60cen60aAG3/
ADmjb/nNHHp+tHHp+tGgBt/zmjb/AJzRx6frRx6frRoAbf8AOaNv+c0cen60cen60aAG3/OaNv8A
nNHHp+tHHp+tGgBt/wA5o2/5zTedw+UbcHJ3c5+n507j0/WjQQbf85o2/wCc0cen60cen60aDDb/
AJzRt/zmjj0/Wjj0/WjQA2/5zRt/zmjj0/WmllUqCD8xwMc9s8+nSjQQ7b/nNG3/ADmjj0/Wjj0/
WjQYbf8AOaNv+c0cen60cen60aAG3/OaNv8AnNHHp+tHHp+tGgBt/wA5o2/5zTCH81SCnl7TuUjk
njBBzwOvGOcjpjl/Hp+tGgBt/wA5oo49P1oo0AX8aPxo4/vfrRx/e/WmIyvEWsf2FosmobYX2SRR
4mn8qMb5FTcz4O1RuyTg8CsZvFeoPpEd/Z22i3ym7jtXNrq7SIrSPGifMIeuZMkYGAARnOB0Grae
NTs0g87y9lzBPnG7PlSpJjGe+zGe2c803VdP/tOzjg83y9lzBPu25z5UqSY699mM9s55qJXvoVG3
UyB4l1CO9nS5023S1tru3sp5Y7xncSyrERtQxgFQ0yjJYHAJx2rOvPiCbTS9XnOmbruyuZY4LX7R
j7TEjSgyb9uE4t7g7Tk/u8fxLnUk8J2rareaxGYU1WS5W4trswAvDiFYth5y6EK2RkffOMMAwJvC
cE+jX1k03+kXMd/ElztP7pbqQyMNucHB2/Xb2yan3ivdNG91ePT9RtoLnZDbSwTStdSybERo9p2H
PGSpkbr0jY9ASMS58ZTR6IL+305JZk0uTULqBrkr9nZCoMLkIcNnzgMgfNCwwMHbr69okGvWKWs5
2hZA2cE5UgpIvBH3o3kTPbfkcgVnXXhJZNO1+2tLlIJNWVohI8RcQxtuZlxuG4l5Z3ByMGQDkKBQ
+YS5epYl8RTW+ka9eT2aCbR1YvEk5ZZGFukxAYqMDL7c47ZxzgaGs6idJ0PUNS8vzfsltJP5e7bv
2KWxnBxnHXFYlx4a1S5h1q2fVrMW+rxsJwLFt6u1usJZT5uAuUDbSCeoz3rRutLv9S8Oajpmo31s
815BLAJ7e1aNUV0252NI2SCSfvDPTjrRdhZFX/hJLuC6fTbuwiXVW8v7PDBcmSKXzBKVzIyKVwIJ
Wb5ThVGNzELTLzxVNp0EkV5aW9vfxtH5gkuytrGjhykjT7PlUmNk5QHfgYwysbr+HLCG0ii0u2tt
Nkgn+0wNbwKqLLtKFmQYDAqSp6HB4IIBEa6VqkXm3ceo2Z1WfYk08lmxi8pN21EjEoIwXY5LMcs3
baFPeHoVrjX9ajGkmDTdLuBqTbEdNUcoG2SSAhhCdylI859WxjHNXdU8R2OjarZ2mo3NvaQ3ME0o
uLidY1DRtGNnzdSRIT1/h79o7fw/5Eelg3W57O9mvpCI8CV5Vm3gDPyrumJHLEAAEnrV6XT/ADNc
tdS83H2e2mg8vb97zGibOc8Y8rpjnd7cmotDP8P+J4/EFzdRwRIIYV3pMk29ZV8+eIEYHQiDdnJ+
/jtkwad4l1DXLC3udI023kJgikuBc3jRLE8kayCNSI2LkK6knCj5hjJ3BUt/Dd/plzPc6ZqdtHNc
tIZvtNm0q7TPNMoULImCDO4JJOcDhec0tR8AxT6E2j2VzbJayQJHJ9usxcsHSIQrNGQybJNigZ5H
yggD5txeQ/duXtH8UTaxrNxZRpparbzzxSRrqRa6VY5Gj3mHy+ASB/F0YdelXbjVdQlvbi20iyt7
k2rCO4e5umgVXKhwq4jcsdrKScAfMMEncFj0rStU0y4kj/tGzk097mefyvsbCUebI8mPM83HDP12
cgdutUvEfhD+27e+ghns4or/AOadbuz+07ZfL8sSxfOuxwgAzyPlBAB3bi8rB7ty9/wkJ/4Sf+yv
s3+jf6n7X5n/AC9bPN8nZjP+q+ffnb268Vl2/jS7+2adBfaXFAl3c3MEksV2ZBD5UyQKcGNS2+Z1
UAdAQx74m/4Qq3+0fbft15/aH9pfb/P+0zbf9Z9zy9+3/U/uc4+727UWXhFwrJqt5DeRPHfRSRxW
7Qh1upUkcZ3sRgqwGD0YdxknvB7ox/GMz3KW0FtYxTPPLCn9oX5t1mZJ5IQsREbb2zHllwNu9Oua
0fEHiA6J9nGLRPO3Hzr+7+zQLtx8pk2t853ZC45Cuc/LznQ+FtWXw+2iT63bT21ys63spsCsspmk
dpChEm1Dh8D5WAIzgjit7UItUk8v+zbyzt8Z8z7TatNu6YxtkTHf1z7dxc1g0uZ76vrUev2WmNpl
jtuIGnaUX7koqGMSAL5PJBl+XkbgMnb0qrP4xMH9tubHMFjbTz2knnf8fnkfLOMbcx7JMJk53ZyM
gVoWOgRafPpJgncw6bp72KK4BZ1JiwxIxyBD6c7u2KwZPh1bnSYbaHU7xbsW08FxcyTzSrP50TLI
fLaQqu6RllIHUoPqB8wLlNuDVtVlkvLJ9PtF1O3jimWMXrGF0kZ1GZPKDBv3b8bCPu88nFKy8Tar
dWfh+6fSrRE1iRQoF8zGJDCZQx/dDLbVcbeBkLzySunpuh2ujXUx0yOG0sp/nktIogqCXCqHXGNu
VXBGCDhSMHdupR+HLq3s/DNrBqEITRdm8yWxYz7YTFxhxs+V3P8AFzj0IJ7waFLT/HsNxoNhql5a
/ZBNIy3MfmmT7MotnuQ2Qvz5jVDgDjfjqCK3rC51eedje6db2tsV3IRdmSUHIwHQIFBxnOHYAjAJ
HNYDeA4JF0WKa7329jZCyu4vLI+2KIZIk5DZjwJpTxnO/k8Ai9p/hue18THWbm6s5pfsz25eKxEU
0wJjIaaQMQ7ARgcKo5OABxQnLqD5ehl3nxBNpperznTN13ZXMscFr9ox9piRpQZN+3CcW9wdpyf3
eP4lzsT+Ipokub9LNH0a0aRLm6M5Ei+WSsjLFt+ZVIIOWDHa21W+XdHN4Tgn0a+smm/0i5jv4kud
p/dLdSGRhtzg4O367e2TT5/D0sqXNgl6iaNdtI9zamEmRvMJaRVl3fKrEknKlhubay/LtPeD3Stb
eMTOl95lj5cttqUdmqednzInufs6zZ28fOsvy9fk64INTaL4ku7+30yfULCK0i1WNXs2huTNkmMy
bHyi7W2BiMbh8rAkHbugufB/npY+Xf8Aly22pSXjP5OfMie5+0NDjdx86xfN1+TpgkUy38JX40K3
0y51lCbG0NvYTW1s0LQv5RiErfvGLMFY4wVHzE4J2lS8g90ktvGJn0u+v5LHy4rby7lf32fMsHb5
bn7vHyLK3l/e+THUirqeITJeQRpbZguNSksIpvM+95cTs74xkYkiePB67dwOCMx6X4UstF1WK706
W5ihW0Nq9vJcyzKyhlMeN7naEAcAAf8ALQ9O89joS2emaDZtIkp0lUVZGQgsVhaLIAbgkMeu4YyM
ZwQe8D5Ta/Gj8aTj1NLx/e/WtTMPxo/Gjj+9+tHH979aAD8aPxo4/vfrRx/e/WgA/Gj8aOP7360c
f3v1oAPxo/Gjj+9+tHH979aAD8aPxo4/vfrRx/e/WgA/Gj8aOP7360cf3v1oAPxo/Gjj+9+tHH97
9aAD8aPxo4/vfrRx/e/WgA/Gj8aOP7360cf3v1oAPxo/Gjj+9+tHH979aAD8aPxo4/vfrRx/e/Wg
A/Gj8aOP7360cf3v1oAPxoo4/vfrRQAnzUfNRgUYFIZieLDL/Yaos00Xm3tnEzQytG+17mJWAZSC
MgkcHvWNPPcWer/2HDdXJ0lp4Iprp53eSAyJMzRecSSCWSADJLj7QApG6Pb02rLpraeY9VihmtJZ
IojHNGJEZnkVUBXB/jK/Tr2qosmhWenXGnJBbRWME6WUtslviMPNswm0DBDecue3zHPeoktSk9Dl
9YXUk1i10XSNQuVjiu4pIZJbmR/33kXMhglkyWaPMcLMpJbbJ1wUAu6JHbeKr7VdSlnv1WOc20cI
uGieBXgtHeMlDuRlePBUMMEuDnJrXtLrQIZrvTLK3hV9E2yyW1vaH/RzIjMCiqvLMpf7mT8xHema
ZrWg/Yr68sYntoFnLXDGwlg82YsUOAyAySFl2kDLbsDqQKmxVzItmmtfg9NfR3d413Lohu2nlupJ
JBKbfJZWZiV55AGAD0qA2+r/ANt6NZXt5eLaW1zJpwZJ5Ea8VraZ/MdhjewRYPnGMSCbH8JrpbO/
0i+gj0qK2dIZIJES0uLGSBTEgRWGx0HygSIMYwc4HQ4NQ1DRZtIe8vkS5s452tyGtmlPmFzbsoQK
SSWZk4HIY9jRYVzk4YbxPBek6zdT3l5YRaTHc3SjVbiCZTsMkrhkOZmYHhXZQuwAEBjjbSC50/xP
BJqDTTi8uZI7aePUJguSjyKj23EQVY0ZdwLElVYjLEiCSbwdZw2d6+g+SIZBFbOdBmVom3gqFHlZ
XLyDHTLE4yc1asr7wvBrcr2liltqEzKk9z/ZkkOXkCuEklKABm3J8rHJZgMZ4oQ2F7YI/jvTj9pv
1WW0uLh4kvpljLxvbhDsD7cYdsjGDk5BrF0q81y90nwbFqCpHa3iqslxBqMpnnBspT842LgkjdkO
SGAxnqOhn8T+HorK+1ma5QQ6XO9lcXBgctC+5AyD5ckFtmcZBwPSn6zc6HpVja2+o2W60/1MMcen
vPGmR5QXCIwXIfYBxkMQM8igWuxy8MN4ngvSdZup7y8sItJjubpRqtxBMp2GSVwyHMzMDwrsoXYA
CAxx1Grl7nWNO0yWaaCyuY5nd4ZWieSVNhSMSKQRlTI+FIY+X12hgc+A+DTqNtBHpFtFcWrRpDI+
ktGtu7YkRPMMYWNiZAQuQdzgY3HFa93daPqGpP4cvVhubh7YXb2k0O9GiD7QxyNp+YDjrxmhAzIj
Oq6f4nu7DSYku7aLT7Z9uoalMCjNLcZIJSQsTgAkkcKo5AGOXt/E862mjX0lzqrrpen2L3DRwTyQ
ytKqm5M7KpDGOEpIpJGCxPzdK67Sta8L2+nS3WnRJZWsVobjIsJLcPbrlyyAou9QXJ+XODJ/tDN7
S20i+tLm0tNNeG2Kqk0M+myW6SKV2AbZEUMNqhcDOAAOmKLX2Y723RyCalf2McqT3ty0eoa7/o0r
ysTGyaiIngBJ4UxBSqDOQJs8DFXbhJJ/AF94ie8v01Y6XPNIEvZUSCbymDIIgwRTG2VwRuBXJJYE
1vLdaBd30enfZ4XeK5aWEvaHyvtALMxjkK7DKDvJ2ksCHz0bFW1fwjrotNZhs7C6bVGe3hunsvnm
IRwyksu7GyNxzwQMdxRYLl7QNOnsIJjcxPFNIwG06pPertA4IMoG05JyAOw5Pbg7jxPO1prN9Hc6
qi6pp989u0kE8cMTRKxtjAzKApkhDyMQTkqD8vSuysrrwtos2txafb2dk+mxpLqItrTy9i7C6k7V
+f5dx4ziibVfDLabYxyRwyWD2yzQqLNnihgdCoZwFIhQoXGX2jaHHQNgYLcx9eSTTLiHSbK8vza3
LW7XO69leSEteQRjEpbegkRpRjdg+WduMPne0gvbaxqOmRTTT2VtHC6PNK0rxyvvLxmRiScKI3wx
LDzOu0qBVD+Eba01vSVs7CO101VuNStVssRqCu8MVC4c7UB4yflHtVrSdV0NJBpWmR/ZkjkkhjjW
zeCEujNvVGKhGYEOSFJPysexNC3E9jmzY58KpKb7VfMXXWtw41O4DeWdQEBUnfkjy1AGenJHJJO9
4utRD4H1Iw3F5E9lZSywSxXcqSBkjbaWcNuf1O4nJ5OaILrwtp0er2Ftb2dvFpOy7voYrTakR2+Y
r4C4ZsICCMkbR3xWvJLZ3k9zpcoSZhArTwOmVMchdRnIwQdjjHtz1oSBsxDYJNrJ0SW5v47GC0S4
twt9Msk7tI4kJl373CDy+N2B5oyD8mJLV9R1jwkzw3WL0SSG1uCdiziKY+S7lRykiohbaAGVztwC
KmurrQNbuhpV7bw3m2Q7FubQvC0qg5COy7GcDfkKSw2vx8rYnPiCw+1S26C8laLfueGxmkjygJYC
RUKlhgjAOdw243cU9A1MGynuNXfTjdXVzFY62s18oineIqAIvIgVwcoTFukZVOS6OQdm4F+k3l0f
GC6f9pmlsbeO8igd3LeaENpyzfxsjvLHuPPykEltxN6LVPDmp6DPEbXdpVtthaC406RIyVbasaI6
DewddoVQSGAGM4FR3l94XuNGtYruxSezWcW8Nk+mSSNHIsZYL5GwshEYJGVHykHoRlB8jkZb+/e8
1d/N1V5IFk+z3KXrLb2Tm9vEWSZPMG6NQkeflcBIzkYGD13i95c6LDHHfzLNqBSSCxuTBJKot5mx
v3pwCobG4fd79Kki1/w/ZyJHaQzF/s0Y22emzSGOJWdURhGh2bWWQbGwVIYYHNTWWq6Hc3UGn20e
02kjw226zeOJXjDIyxOyhCwAcYQ52huwNCXmNvrY5u71OSfw3pGnS3mqxnUZ5meWxSWS8traNmKg
lFYiRGMET7txyXBJOWp+lXo8R3Emo6hfXlgbfSbaWURXEttHaziS4WYtGx2na0WD5gYYTnI69XNL
pNjq9qsgtotRv2kWHCDzJSEBfkDONsaZJ4+VB/dFVfsPh261zy/7Ls5dQtf3vnfYg3ksW3483bhX
3Pv253fNuxzmiwrnI3fiq8N1ZajdrqVu+mW1pJeQW9pcfZw8wBulmAUj91CVdQSCpPO7pV3Q7m6b
xBFk6lGZdSv1kuLq7L29xEkkyrFEhdgrgiMgbEO2KTBIBz2FqNN1TTTcwxQzWmoxiVyYgBOjIACw
I5ygUc9gB2qf7FaeT5P2aLyvM87ZsXbv3792P72/5s9c89aai9wclsUJ/tX/AAlWn7PO+yfYrnzM
Z8vzN8GzPbdjfjPON2O9a3zVGYIWnScxoZkVkWQgblUkEgHsCVXI9h6URRmNCrSvKSzNufbkAkkD
gDgA4HfAGSTk1aViGyT5qPmowKMCmAfNR81GBRgUAHzUfNRgVWu723s9iuxaaTIigUjfKR2UZ56j
J6Ackgc0DScnZFn5qPmqK3MrQKbmOOOXncscm9Rz2JAzx7VLgUCas7B81HzUYFGBQAfNR81GBRgU
AHzUfNRgUYFAB81HzUYFGBQAfNR81GBRgUAHzUfNRgUYFAB81HzUYFGBQAfNR81GBRgUAHzUUYFF
AC/56Uf56U3A9aMD1ouBT1nT/wC1dGu7ES+S80ZWOYJkwv1SQcj5lbDDkEEDBFcxp3h7Uzqtld3r
OIbhjf3lu7h1jnDSFIjz85AmjAfGB9jj9V29ngetGB61LV3cadlY4nQtD8RWN9o1/eS2b7vtX2y3
jtyjW/2k+e/z+awbbKiIMDoxPvV2HSL6DT7WfyN1xY6teXy24dQZkke4AAbOAxSYMM8ZAUlckjqc
D1owPWlyj5jlp9On8Qa5p93eafqWn29vbXMbD7YIZNzNAV5glJKkK/Geq8jpmD/hHrr/AIQ/+yfK
m3f2t52PtJ8zyft/m7vM3bt3l/NnO7P+1XYYHrRgetHKHMYGoaIY9HjtLD7TMf7QtLhvtF28zBUn
iZzukYnAVCcA/QZNZ1xoOpNquqX3mTSWp1KG7XTgYwl0scMOGDY3K4kjBALBT5YBwGLV2GB60YHr
RygpHBXvg2e60bVJfK/0+SPUlig3D940kk5gbduwMJPKMH/nrzyox1Gv2k97p0MVum91vbSUjIHy
pcRux59FUn8K1cD1owPWjlDmOPuNB1JtV1S+8yaS1OpQ3a6cDGEuljhhwwbG5XEkYIBYKfLAOAxa
of7D8Rf2p/avm2f/ACG/tf2P7Od3lbfsu7zPNx/qP3mNud3HtXZiFBO8wZ9zKqkF2K4BJGFzgH5j
kgZPGegw/A9aOQOY87l0TWdU8C2WkPpU1ncabprxjzpYj9omNpJAETY5AXMhJZiuMKMHJK9ZoCtF
BNCdN1WzUMGB1G8FwzkjB2t5shAGBwSBzx3rYwPWjA9aFGwOVzk7bTNQ/sjTfDklm6Q6e1ru1Auh
jlSB0ddqht+5tigggBcthm2jfnaR4d1XTbnwqotf9Hjjil1D94v+jzx2bwZ65beGjX5eF8rP8RNd
7getGB60cgcxyw8Mfa9fu7+6XYq6ks8fOfOiEFvxwflxNBG2ev7rH3WOavhuw1fwzpEFt/Zb3c1z
Bbs2yeNFt5Ut4oWWQk/dzGDuQOeW+XgbuzwPWjA9aOUOY81u/Buq2PhnU7fT4vtV6sf2KD5lT7VA
9nBA/VsJh4lfnn91tBw2TtWun6lPbNpE2nTW0SatJfG8kkjMboLw3CBFVixZvlHzBQAWOSQFbsMD
1owPWlyBzs4nQtD8RWN9o1/eS2b7vtX2y3jtyjW/2k+e/wA/msG2yoiDA6MT71teF9I/sbS5YDB5
LG5lwu/d+6RvLg7npDHEPXjJ+YmtzA9aMD1pqNgcrnJ22mah/ZGm+HJLN0h09rXdqBdDHKkDo67V
Db9zbFBBAC5bDNtG+7oIvdKtLDQ5tMuWjs4Ftxfo8XkuqLhWwX3gkAZG04JIyQNx38D1owPWjlDm
OWh0i+g0+1n8jdcWOrXl8tuHUGZJHuAAGzgMUmDDPGQFJXJIztY0jUNT1K11qTSr8L58SPZW92kV
ykccVyN/mLKqgl5wNquflGSeSq91getGB60cocx5/YaPqGm6uLyfRtVuFMCGEWV8kewi4uJAkwMy
CVgske4neGbeSWySdDTdB1KzvILy4kmuIY9SvJlsWMYEHmzSBJkYAFvkkbcjMeJCR8yhT2GB60YH
rRyBzGHrcd3JqugPbWM1xFBetLPJG8YESmGSPJDMCeZAeAeFPfAOXpGj6jp+uYjhvI0N7dXFzO93
vtpoZGkdUjiLna4Z4iTsX7j/ADHPzdhgetGB60cocxn+H7JtO8OaZYuH3W1pFCfMUBsqgHIUsAeO
xI9z1rS/z0puB60YHrVLREvUd/npR/npTcD1owPWncB3+elH+elNwPWjA9aLgO/z0o/z0puB60YH
rRcCC7e7GyO0hjZmzullOFjHrgcsec44BwcsOMlpYxWm9laSSWTHmSykszY/kMknaMKMnAGanwPW
jA9aXW5XM+XlQ7/PSj/PSm4HrRgetO5I7/PSj/PSm4HrRgetFwHf56Uf56U3A9aMD1ouA7/PSj/P
Sm4HrRgetFwHf56Uf56U3A9aMD1ouA7/AD0o/wA9KbgetGB60XAd/npR/npTcD1owPWi4Dv89KP8
9KbgetGB60XAd/npR/npTcD1owPWi4Dv89KKbgetFFwFy3pRlvSjb7Gjb7GjUWgZb0oy3pRt9jRt
9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt
9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt
9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt
9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt
9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt
9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGgZb0oy3pRt9jRt9jRqGg1BsGBuIyTySep
z3/yKdlvSq13e2tlsE8hDvnZGql3fHXaq5ZsZ5wOBzVf+0Lmf/jz0y4cH7stwRCh9cg5kHcfc5+n
NUoyepDqQi7dfv8AyNHLelGW9KbGHMSGVQshA3KrbgD3AOBkfgKdt9jU6l6BlvSjLelG32NG32NG
oaBlvSjLelG32NG32NGoaBlvSjLelG32NG32NGoaBlvSijb7GijUNA/Cj8KXbRtoswuJ+FH4Uu2j
bRZhcT8KPwpdtG2izC4n4UfhS7aNtFmFxPwo/Cl20baLMLifhR+FLto20WYXE/Cj8KXbRtoswuJ+
FH4Uu2jbRZhcT8KPwpdtG2izC4n4UfhS7aNtFmFyOSNJoniljV43UqyMoIYHqCO4p/4Uu2jbRZju
J+FH4Uu2jbRZiuJ+FH4Uu2jbRZhcT8KPwpdtG2izC4n4UfhS7aNtFmFxPwo/Cl201VOPmAByehzx
2oswF/Cj8KXbRtoswuJ+FH4Uu2jbRZhcT8KPwpdtG2izC4n4UfhS7aNtFmFxPwo/Cl20baLMLifh
R+FLto20WYXE/Cj8KXbRtoswuJ+FH4Uu2jbRZhcT8KPwpdtG2izC4n4UfhS7aNtFmFxPwo/Cl20b
aLMLifhR+FLto20WYXE/Cj8KXbRtoswuJ+FH4Uu2jbRZhcT8KKXbRRZhcTn0FHPoKOKOKBhz6Cjn
0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6C
jn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz
6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFA
Bz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFH
FABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cjn0FHFHFABz6Cijiig
Ax7ijHuKKKBBj3FGPcUUUAGPcUY9xRRQAY9xRj3FFFABj3FGPcUUUAGPcUY9xRRQAY9xRj3FFFAB
j3FGPcUUUAGPcUY9xRRQAY9xRj3FFFABj3FGPcUUUAGPcUY9xRRQAY9xRj3FFFABj3FGPcUUUAGP
cUY9xRRQAY9xRj3FFFABj3FGPcUUUAGPcUY9xRRQAY9xRj3FFFABj3FGPcUUUAGPcUY9xRRQAY9x
Rj3FFFABj3FGPcUUUAGPcUY9xRRQAY9xRj3FFFABj3FGPcUUUANR0kjWSORXRgCrLggg9wadj3FF
FC2FF3imGPcUY9xRRQMMe4ox7iiigAx7ijHuKKKADHuKKKKAP//Z
------=_NextPart_000_0006_01C6E284.9A672810--

Received: from botanicals.com (adsl-ull-79-118.49-151.net24.it [151.49.118.79]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k9FGQoNS041370 for ; Sun, 15 Oct 2006 09:26:53 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000001c6f076$99d973d0$6f0ea8c0@xrxl>
Reply-To: "Sara Corona"
From: "Sara Corona"
To: [email-masked]
Subject: Re: VlkAGRA
Date: Sun, 15 Oct 2006 09:26:00 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C6F03B.ED7A9BD0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-Antivirus: avast! (VPS 0641-4, 13/10/2006), Outbound message
X-Antivirus-Status: Clean

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C6F03B.ED7A9BD0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VlkAGRA for LESS http://www.sabderionkadesinpion.com

=20
can discuss it . . .
About this. It was brought here. I examined it myself. Not

------=_NextPart_000_0001_01C6F03B.ED7A9BD0
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VlkAGRA for LESS http://www.sabderionkadesinp=
ion.com

can discuss it . . .

About this. It was brought here. I examined it myself. =
Not

------=_NextPart_000_0001_01C6F03B.ED7A9BD0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9D9YZAo001608; Fri, 13 Oct 2006 02:34:35 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9D9YZiF001607; Fri, 13 Oct 2006 02:34:35 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mallaury.nerim.net (smtp-105-friday.noc.nerim.net [62.4.17.105]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9D9YXRk001600 for ; Fri, 13 Oct 2006 02:34:34 -0700 (MST) (envelope-from [email-masked])
Received: from uranus.cry.pto (cryptolog.net8.nerim.net [62.212.120.81]) by mallaury.nerim.net (Postfix) with ESMTP id 32BF84FCEA for ; Fri, 13 Oct 2006 11:34:26 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1]) by uranus.cry.pto (Postfix) with ESMTP id 98CC74415B for ; Fri, 13 Oct 2006 11:34:52 +0200 (CEST)
Received: from uranus.cry.pto ([127.0.0.1]) by localhost (uranus [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 12997-01 for ; Fri, 13 Oct 2006 11:34:46 +0200 (CEST)
Received: from callisto.cry.pto (callisto.cry.pto [10.0.1.4]) by uranus.cry.pto (Postfix) with SMTP id 4CA8544159 for ; Fri, 13 Oct 2006 11:34:45 +0200 (CEST)
Received: by callisto.cry.pto (sSMTP sendmail emulation); Fri, 13 Oct 2006 11:34:24 +0200
From: "Julien Stern"
Date: Fri, 13 Oct 2006 11:34:24 +0200
To: [email-masked]
Subject: Son of RFC3280 path validation rules
Message-ID: <[email-masked]>
Mail-Followup-To: Julien Stern , [email-masked]
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at cryptolog.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Folks,

a fairly major difference came up between RFC3280 and son-of-RFC3280
regarding path validation, namely:

RFC3280:

(f) Obtain and validate the certification path for the complete CRL
issuer. If a key usage extension is present in the CRL issuer's
certificate, verify that the cRLSign bit is set.

son-of-RFC3280:
(f) Obtain and validate the certification path for the issuer of
the complete CRL. The trust anchor for the certification path
MUST be the same as the trust anchor used to validate the target
certificate. If a key usage extension is present in the CRL
issuer's certificate, verify that the cRLSign bit is set.

So, son-of-RFC3280 adds the additional constraint of having both
paths ending at the same trust anchor.

I'm a bit surprised that this modification does not come with more
details and explaination. As a matter of fact, it breaks compatibility
with previous versions of the standard, with X509, and the advantages
of this additional constraint are not clear.

X509 specifically allows the certificate issuer and the CRL issuer to be
two different trust anchors, as indicated in section 8.1.5 of X509 v5:

X509.v5 8.1.5
If an authority uses the same key to sign certificates and CRLs, a
single self-issued certificate of category a) shall be used. If an
authority uses a different key to sign CRLs than that used to sign
certificates, the authority may choose to issue two self-issued
certificates of category a), one for each of the keys. In this
situation, certificate users would need access to both self-issued
certificates to establish separate trust anchors for certificates and
CRLs signed by that authority. Alternatively, an authority may issue
one self-issued certificate of category a) for certificate signing and
one self-issued certificate of category b) for CRL signing. In this
situation, certificate users use the key certified in the certificate of
category a) as their single trust anchor for both certificates and CRLs
signed by that authority. In this case, if the self-issued certificate
of category b) were to be used to verify signatures on CRLs, there
is no means defined in this standard to check the validity of that
certificate.

Also, this additional constraint can make indirect CRLs much harder
to implement in practice, if not impossible in some cases. It means
that if two different CAs wish to delegate CRL issuance to the same
CRL issuer, the CRL issuer needs to have two (cross) certificates
with the same key, or all three need to chain to the same root.

It will also make key-rollover more complex when the CA has issued
a certificate to itself for CRL signing.

Finally, this constraint does not add security. It merely helps
path builders to speed up the reconstruction process, and possibly
to detect an ambiguity if two CAs with the same name happen to exist.
It does not however prevent a rogue CA from issuing a bogus CRL.

So, all in all, is a "MUST" really what we want? Or should we simply
say that an implementation may check this additional constraint, but
risks in that case to refuse perfectly valid CRLs from a PKI following
an older version of the PKIX standard or X509 ?

Regards,

--
Julien Stern

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9AB7doO087223; Tue, 10 Oct 2006 04:07:39 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9AB7dgh087222; Tue, 10 Oct 2006 04:07:39 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from edelweb.fr (edelweb.fr [212.234.46.16]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9AB7bfH087212 for ; Tue, 10 Oct 2006 04:07:38 -0700 (MST) (envelope-from [email-masked])
Received: from [193.51.14.5] (localhost [127.0.0.1]) by edelweb.fr (8.11.7p1+Sun/8.11.7) with ESMTP id k9AB7Sl06692; Tue, 10 Oct 2006 13:07:28 +0200 (MEST)
Received: from [193.51.14.5] (emeriau.edelweb.fr [193.51.14.5]) by edelweb.fr (nospam/2.4); Tue, 10 Oct 2006 13:07:29 +0200 (MET DST)
Message-ID: <[email-masked]>
Date: Tue, 10 Oct 2006 13:05:32 +0200
From: Peter Sylvester
User-Agent: Thunderbird 1.5 (X11/20051025)
MIME-Version: 1.0
To: "David A. Cooper"
CC: pkix
Subject: Re: 3280 Bis: Initial Values for Permitted and Excluded Subtrees
References: <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms020600010701060608010609"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a cryptographically signed message in MIME format.

--------------ms020600010701060608010609
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

There is a current mismatch between x509 and 3280bis concerning the
input of the path validation algorithm.
I think that the difference should be removed, i.e. the text from X509
should be translated into
equivalent PKIX-speak (MUST, MAY, etc).

I think it is out of scope to talk about user interfaces, there
may be no user interface at all, since all the trust environment may be
hard coded or preinstalled or
whatever. The API is the borderline IMO. I think conforming APIs SHOULD
permit applications
to set all input values.

For your proposed text it is not clear whether you talk about a user
interface or the API or
the algorithm or some mixture, or.. What means "The implementation"

I think it is out of scope to talk about user interfaces, there may be
no user interface at all, since
all the trust environment may be hard coded or preinstalled or whatever.
The API is the borderline IMO. I think conforming APIs SHOULD permit
applications
to set all input values.

Does your comment mean that a comforming implementation of the algorithm
may permit other default values than the defined one to be effective if
the application
does not specify them. This should not be a normative remark but a hint to
some implementors.

David A. Cooper wrote:
>
> While section 6.1.1 of RFC 3280 indicates that the path validation
> "algorithm assumes the following seven inputs are provided to the path
> processing logic", I do not believe that was intended to be a
> requirement to allow applications (or users) to set all of these
> values. So, even if we add initial-permitted-subtrees and
> initial-excluded-subtrees to the set of inputs listed in section
> 6.1.1, I do not believe that this would require a conforming
> implementation to be able to validate paths using initial values for
> permitted_subtrees and excluded_subtrees other than "permit all" and
> "exclude none". This would just be an example of an implementation
> that hard coded the values for the initial-permitted-subtrees and
> initial-excluded-subtrees inputs.
>
> However, in order to avoid confusion, I propose adding a paragraph to
> the end of section 6.1.1 that explicitly states that conforming
> implementations may "hard code" the values for some of the inputs and
> are not required to be able to accept user/application supplied values
> for every input mentioned in the section. Here is the text that I
> propose to add:
>
> Conforming implementations are not required to support the
> setting of
> all of these inputs. For example, a conforming implementation
> may be
> designed to validate all certification paths using a value of FALSE
> for initial-any-policy-inhibit.
>
> While I would have preferred to use initial-permitted-subtrees and
> initial-excluded-subtrees as the examples, since they are the two new
> inputs, I chose initial-any-policy-inhibit for the example since it is
> a simple boolean and thus much easier to describe.
>
> Dave
>
> Peter Sylvester wrote:
>> Doesn't the MAY in the sentence permit an implementation to be
>> conformant
>> if it does not provide the possibility? This deosn't seem to be the
>> same in X.509 where
>> the possibility of adding the constraints is part of the input of the
>> path validation algorithm.
>>
>> The inputs to the certification path processing procedure are:
>> ...
>>
>> h) an initial-permitted-subtrees-set containing an initial set of
>> subtree specifications defining subtrees within which subject names
>> (of the name form used to specify the subtrees) are permitted. In the
>> certificates in the certification path all subject names of a given
>> name form, for which initial permitted subtrees are defined, shall
>> fall within the permitted subtrees set for that given name form. This
>> input may also contain the special value unbounded to indicate that
>> initially all subject names are acceptable. For clause 10, subject
>> names are those name values appearing in the subject field or the
>> subjectAltName extension;
>>
>> David A. Cooper wrote:
>>> Russ Housley wrote:
>>>> I have been thinking about this, and I think it would be a very
>>>> good idea to add these. The algorithm in section 6 already has
>>>> state variables for permitted and excluded subtrees. This is a
>>>> minor change to permit them to be initialized to algorithm input
>>>> values.
>>> 3280bis already permits setting initial values for name constraints,
>>> just not in section 6.1. The following text appears in section 6.2
>>> (Using the Path Validation Algorithm) and is basically unchanged
>>> from RFC 3280:
>>>
>>> An implementation MAY augment the algorithm presented in
>>> section 6.1
>>> to further limit the set of valid certification paths that
>>> begin with
>>> a particular trust anchor. For example, an implementation
>>> MAY modify
>>> the algorithm to apply name constraints to a specific trust
>>> anchor
>>> during the initialization phase, ....
>>>
>>> Of course, 3280bis could formally add the initialization of
>>> permitted and excluded subtrees to the path validation algorithm by
>>> adding it to section 6.1. Since RFC 3280 and 3280bis already permit
>>> this it wouldn't really be a change, it would just make the option
>>> more visible. So, I would have no objection to moving this option
>>> to section 6.1.
>>>
>>> Dave
>>>
>>>> At 07:00 PM 8/24/2006, Santosh Chokhani wrote:
>>>>> All,
>>>>>
>>>>> The new version of X.509 (2005 Edition) permits initial values
>>>>> other than infinity and null for permitted and excluded subtrees
>>>>> respectively.
>>>>>
>>>>> Should we also revise 3280Bis to include these options so that the
>>>>> relying parties can constrain the trust anchors?
>>>>>
>>>>> I would consider infinity and null values only for the two
>>>>> respective fields still compliant with the applicable standard.
>>>>>
>>>>> Thanks in advance for your opinion.
>>>>>
>>>>> Santosh Chokhani
>>>>> Orion Security Solutions, Inc.
>>>>> 1489 Chain Bridge Road, Suite 300
>>>>> McLean, Virginia 22101
>>>>> (703) 917-0060 Ext. 35 (voice)
>>>>> (703) 917-0260 (Fax)
>>>>> [email-masked]
>>>>> Visit our Web site
>>>>> http://www.orionsec.com
>
>
>

--
To verify the signature, see http://edelpki.edelweb.fr/
Cela vous permet de charger le certificat de l'autorité;
die Liste mit zurückgerufenen Zertifikaten finden Sie da auch.

--------------ms020600010701060608010609
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIOpDCC
BHIwggLfoAMCAQICBgoMz+gAPzANBgkqhkiG9w0BAQUFADBbMQswCQYDVQQGEwJGUjEQMA4G
A1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVs
UEtJIEVkZWxXZWIgUGVyc0dFTjAeFw0wNTAxMDYxMjI3MTlaFw0wNzAzMTcxMjI3MTlaMHAx
CzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQLDA9TZXJ2aWNlIEVkZWxQ
S0kxNTAzBgNVBAMMLFBldGVyIFNZTFZFU1RFUiA8UGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIu
ZnI+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDn/izyem7Z1pUP/gpQDSzeGA/ZP4vo
VaCxcPWyssTYTAl6csAql2IIcYNVb6funaMNOY1q5oSNtlguFpOK3atQElBIMsfSh0CTuvUq
q2QDz1nHWOB96aU8G81+ZmC+iQOCAdG3qKWvMOzC0SzxKGbhTqDsjBvfYYk1Jk/Rb5TK0wID
AQABo4IBLjCCASowYgYDVR0RBFswWYEaUGV0ZXIuU3lsdmVzdGVyQGVkZWx3ZWIuZnKkOzA5
MQswCQYDVQQGEwJGUjEQMA4GA1UECgwHRWRlbFdlYjEYMBYGA1UEAwwPUGV0ZXIgU1lMVkVT
VEVSMA4GA1UdDwEB/wQEAwIF4DAdBgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwSgYD
VR0fBEMwQTA/oD2gO4Y5aHR0cDovL2VkZWxwa2kuZWRlbHdlYi5mci9jcmwvRWRlbFBLSS1F
ZGVsV2ViLVBlcnNHRU4uY3JsMB0GA1UdDgQWBBSSHP6djxj58tIi5VvjJbMZMXC/fDAfBgNV
HSMEGDAWgBSe5Q/BFJVJHN1aXV6crs0Bby+UeTAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBBQUA
A4IBfAANZYiEkyDqsT43U83wHLSYMGcEfmisT+WQrAAoHdlcIsnlHnufGnfmdpg5yvCQpl2U
TI7/w3LdaItoWq5oMZitqdoPW8Z+jy2pkd/DqYG1MkpEyZ0PA37Zn5yigQXAk4Nox7Lgiom8
1WDNgPesNRX7PRNa+RkQcD8MasfbHcZ2ycs1SxUxiCy6BUzhgSB8cNb2t9LVWWynvWuK1Wa5
V2ZCd3PlbKsrbWH8pafpFWUQm0S2BfKUWLDG9cje5bL7p5EpV4a8gFpbD5dq+PPJglT0Dvs9
F0EcrfL2l3JxGIkZmW7sfiUoefB9hTS9m3/TGvXcne4RYpVpEHFV5TathMuHfKAti6PhSely
LCqdPq/T9DHLJekBY0EA2yiVcKQnRZk7/pz0HImCPADOHSOWffJtc9b+Ak6HSDD1PlOSDfT+
udnrqwSAiuNN3hx1olPNxzVDu3jgiTSJFf2XJ1TnmGMT4pJmx7vkJkdE9sZvpiZwdVws37Nr
LqhH5fMZMIIEcjCCAt+gAwIBAgIGCgzP6AA/MA0GCSqGSIb3DQEBBQUAMFsxCzAJBgNVBAYT
AkZSMRAwDgYDVQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNV
BAMTF0VkZWxQS0kgRWRlbFdlYiBQZXJzR0VOMB4XDTA1MDEwNjEyMjcxOVoXDTA3MDMxNzEy
MjcxOVowcDELMAkGA1UEBhMCRlIxEDAOBgNVBAoMB0VkZWxXZWIxGDAWBgNVBAsMD1NlcnZp
Y2UgRWRlbFBLSTE1MDMGA1UEAwwsUGV0ZXIgU1lMVkVTVEVSIDxQZXRlci5TeWx2ZXN0ZXJA
ZWRlbHdlYi5mcj4wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOf+LPJ6btnWlQ/+ClAN
LN4YD9k/i+hVoLFw9bKyxNhMCXpywCqXYghxg1Vvp+6dow05jWrmhI22WC4Wk4rdq1ASUEgy
x9KHQJO69SqrZAPPWcdY4H3ppTwbzX5mYL6JA4IB0beopa8w7MLRLPEoZuFOoOyMG99hiTUm
T9FvlMrTAgMBAAGjggEuMIIBKjBiBgNVHREEWzBZgRpQZXRlci5TeWx2ZXN0ZXJAZWRlbHdl
Yi5mcqQ7MDkxCzAJBgNVBAYTAkZSMRAwDgYDVQQKDAdFZGVsV2ViMRgwFgYDVQQDDA9QZXRl
ciBTWUxWRVNURVIwDgYDVR0PAQH/BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEF
BQcDAjBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vZWRlbHBraS5lZGVsd2ViLmZyL2NybC9F
ZGVsUEtJLUVkZWxXZWItUGVyc0dFTi5jcmwwHQYDVR0OBBYEFJIc/p2PGPny0iLlW+Mlsxkx
cL98MB8GA1UdIwQYMBaAFJ7lD8EUlUkc3VpdXpyuzQFvL5R5MAkGA1UdEwQCMAAwDQYJKoZI
hvcNAQEFBQADggF8AA1liISTIOqxPjdTzfActJgwZwR+aKxP5ZCsACgd2VwiyeUee58ad+Z2
mDnK8JCmXZRMjv/Dct1oi2harmgxmK2p2g9bxn6PLamR38OpgbUySkTJnQ8DftmfnKKBBcCT
g2jHsuCKibzVYM2A96w1Ffs9E1r5GRBwPwxqx9sdxnbJyzVLFTGILLoFTOGBIHxw1va30tVZ
bKe9a4rVZrlXZkJ3c+VsqyttYfylp+kVZRCbRLYF8pRYsMb1yN7lsvunkSlXhryAWlsPl2r4
88mCVPQO+z0XQRyt8vaXcnEYiRmZbux+JSh58H2FNL2bf9Ma9dyd7hFilWkQcVXlNq2Ey4d8
oC2Lo+FJ6XIsKp0+r9P0Mcsl6QFjQQDbKJVwpCdFmTv+nPQciYI8AM4dI5Z98m1z1v4CTodI
MPU+U5IN9P652eurBICK403eHHWiU83HNUO7eOCJNIkV/ZcnVOeYYxPikmbHu+QmR0T2xm+m
JnB1XCzfs2suqEfl8xkwggW0MIIDT6ADAgECAgYJ+oiVOzEwDQYJKoZIhvcNAQEFBQAwUjEL
MAkGA1UEBhMCRlIxEDAOBgNVBAoTB0VkZWxXZWIxGDAWBgNVBAsTD1NlcnZpY2UgRWRlbFBL
STEXMBUGA1UEAxMOUmFjaW5lIEVkZWxQS0kwHhcNMDQxMDA3MTU0MzMwWhcNMTEwODEyMTU0
MzMwWjBbMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHRWRlbFdlYjEYMBYGA1UECxMPU2Vydmlj
ZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJIEVkZWxXZWIgUGVyc0dFTjCCAZwwDQYJKoZI
hvcNAQEBBQADggGJADCCAYQCggF7FyeP4kRrFG9y51CeWmJIxBSMD2bcrJKIlnAPn6eH8V1M
ORWTPivMNQYq32XcEi9xrxjyREvvnhABrVcW+1VLyLH8WgRY6n5A5JfuDjU6Aq0RzmjqTWDe
1+ecbgAtN8FYjVk35vdQbgfYzpGHPT0NuxiHi8NB8lNFi8rG0t2hP7WLwHLA+sIKFzA/CCRt
qeGPvQkB1pRamU2IAActykfzJb6Qc50uRobWUBJtVjEBy/lgIXU0rMnQNHeCgbUvebvAT9Hd
UGIPbEiX7dKHxL5/AxzHK/rA5siMzNPk8nSckDeLvpf8c/gqQRpPqufy4DazzXfZosKeJATH
pyONnairmwfzMTi63PvNovrbTgzUiyH+g5zvcNoci9cke0RiLQc1pI38psgnVLtPPITgOZrS
cV9zs4+sD7x7vjRco7a9H2ErfAU+8/Ui2OkR1X0z8DpyBHD/fcaDXTD+EiISL7aJHQcJRoNB
CdCFgZeomsXULIYoFTa1hH//TN0z9wIDAQABo4G/MIG8MDoGA1UdHwQzMDEwL6AtoCuGKWh0
dHA6Ly9lZGVscGtpLmVkZWx3ZWIuZnIvY3JsL0VkZWxQS0kuY3JsMA8GA1UdEwQIMAYBAf8C
AQAwDgYDVR0PAQH/BAQDAgEGMB0GA1UdJQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjAdBgNV
HQ4EFgQUnuUPwRSVSRzdWl1enK7NAW8vlHkwHwYDVR0jBBgwFoAUqNkrj9SwZ7q9SVy8M/x3
UhG5Z50wDQYJKoZIhvcNAQEFBQADggJOAFZV+1m/H+Qud9iUQJnvZR8R/adID02c2B3aOUUy
4/4dxBb4UU1kW8DTUpD57Pjuocfvdg4AfQi7zgSQ8/NUGxNU4CPxtADZVrZtmrpKCjBh1tNz
QbNbdP91KtP+Di0BpidqNwG00CC9j2EnBY88AsqKE28Rmw4eQ9/M/q/GbXsAfEsHV0IQjM7u
US+usowZwm3Mwa5oF+6gmShSc/Wz8iIURxg4lTQto3AoBsiLJelq83I4XRQ0goXYGcM8xXYj
PDioidvY5pSfT4qBR1Bx/vh+xD2evWyFbpuB99iuuewoELX8db7P74QEHhw6Bv1yxLYXGamq
Uxo60WT/UCFjVSy3C/dLrraUZA4gh7Q5G+3/Fal62Qx+1rUEC2YbogEKggonklzUXA+sUbCf
Ad5nZQ0eSszwKt8jmYoHfQ6rUMde0ZJD08n5HAot9hpl9R65j9fdPz9uTeANcRocftHfgM7Y
rQyruWuFxgMUV80fD4RC9ej5KbLyO8jtgESjOCGXeJ95kXXP8vmW73xCYkJ9Pg7Op30o43l6
PV7vej3gdmSQISY+s+J3arz+bccljJCrKHBad3918/LjJ55sRtSb7mfQGti2UcxtJAa2NmUL
d+BIv0MUuC6+k2yIIQKcLbDuuk8lLJmwWuYt1OLHEskZxOm7D7nRwe7ZNlTIZvR/VFWxlY18
k488tH9qcusIw8+7uXeHOZHyFUOHMINJZO9mq9HwGMC4v1xiPwoAJkzFtHf3D9VAholjhEFg
d28aJSs6qN15PXDgDjptAl34eoUxggKuMIICqgIBATBlMFsxCzAJBgNVBAYTAkZSMRAwDgYD
VQQKEwdFZGVsV2ViMRgwFgYDVQQLEw9TZXJ2aWNlIEVkZWxQS0kxIDAeBgNVBAMTF0VkZWxQ
S0kgRWRlbFdlYiBQZXJzR0VOAgYKDM/oAD8wCQYFKw4DAhoFAKCCAZ8wGAYJKoZIhvcNAQkD
MQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDYxMDEwMTEwNTMyWjAjBgkqhkiG9w0B
CQQxFgQUBM1ILNtgNsxhYDvteVcS3k6QYh8wUgYJKoZIhvcNAQkPMUUwQzAKBggqhkiG9w0D
BzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwIC
ASgwdAYJKwYBBAGCNxAEMWcwZTBbMQswCQYDVQQGEwJGUjEQMA4GA1UEChMHRWRlbFdlYjEY
MBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJIEVkZWxXZWIgUGVy
c0dFTgIGCgzP6AA/MHYGCyqGSIb3DQEJEAILMWegZTBbMQswCQYDVQQGEwJGUjEQMA4GA1UE
ChMHRWRlbFdlYjEYMBYGA1UECxMPU2VydmljZSBFZGVsUEtJMSAwHgYDVQQDExdFZGVsUEtJ
IEVkZWxXZWIgUGVyc0dFTgIGCgzP6AA/MA0GCSqGSIb3DQEBAQUABIGAFp0F8bgxuVNlxHp2
MYTHHIHMv3NlV3BHnBA9oJXaiyWJyRd9to5PqiZiZppDBBGlDYGSaPk1NQ6AKh+voDgcGX23
8uZP26fSUDZcKped3z8YwT04OasV8dFGM850ddo/l06/do+1YOfAgJ0Udp4EX8+/fUK4EgpY
lR9AtmGBJKgAAAAAAAA=
--------------ms020600010701060608010609--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9A7fM0P060151; Tue, 10 Oct 2006 00:41:22 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9A7fMfb060150; Tue, 10 Oct 2006 00:41:22 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from DS580.ds580.dedicated.turbodns.co.uk (ds580.dedicated.turbodns.co.uk [81.21.72.161]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9A7fJTl060140 for ; Tue, 10 Oct 2006 00:41:20 -0700 (MST) (envelope-from [email-masked])
Message-Id: <[email-masked]>
Received: from LKNew ([80.229.241.129]) by ds580.dedicated.turbodns.co.uk with MailEnable ESMTP; Tue, 10 Oct 2006 07:49:32 +0000
From: "Liaquat Khan"
To: "'Peter Hesse'" , "'Peter Rybar'" ,
Subject: RE: The time mark can be used as a simple time stamp substitute
Date: Tue, 10 Oct 2006 08:41:13 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0162_01C6EC47.D85A7D80"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Thread-Index: Acbrj/fUp3Dif2K0RbW4QfQnWAmYDwAQseewAAYyXCAAFK1/cA==
In-Reply-To: <[email-masked]>
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_0162_01C6EC47.D85A7D80
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Yes I agree fully with your points. Of course I did not mean to imply this
is the only approach used by SAFE.

In fact my company only supports RFC3161 currently, mainly because of the
cost reasons you state in your other email (for the OCSP responder it will
be no extra effort, but for end-entity applications to request and validate
this special value for the nonce is where the extra work comes in).

Regards,

LK

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Hesse
Sent: 09 October 2006 22:44
To: 'Liaquat Khan'; 'Peter Rybar'; [email-masked]
Subject: RE: The time mark can be used as a simple time stamp substitute

Liaquat,

While SAFE allows for the "hash as nonce" approach, it is an unfair
characterization to say that "SAFE uses" this approach. SAFE also allows
for the traditional RFC3161 method of time stamping, and in fact several
SAFE member companies prefer the RFC3161 compliant method. The comment I
made earlier about the 3161 method potentially being less expensive in the
long run is as a result of our experience with SAFE and SAFE members.

--Peter

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Liaquat Khan
Sent: Monday, October 09, 2006 2:43 PM
To: 'Peter Rybar'; [email-masked]
Subject: RE: The time mark can be used as a simple time stamp substitute

I believe SAFE uses the approach you describe.

Regards,

LK

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Rybar
Sent: 09 October 2006 11:45
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute
Importance: High

A time mark can be used as a simple time stamp substitute when we specify
content of OCSP nonce as a hash value of MessageImprint type as result of
some asymmetric operation.

If someone has a demand for retrieval of an approximate time when asymmetric
operation has happened and he wants that implementation will not to have
an impact on the present solutions to the future, then I suggest to use the
present widely used protocol which already contains trusted time inside and
attribute like nonce which can encapsulate useful information.

For example OCSP protocol (RFC2560) contains the attribute "producedAt"
(trusted time at which the OCSP responder signed OCSP response) and some
OCSP can also contain useful extension "nonce".

In RFC2560 the nonce is defined as:" the nonce is included as one of the
requestExtensions in requests, while in responses it would be included as
one of the responseExtensions. In both, the request and the response, the
nonce will be identified by the object identifier id-pkix-ocsp-nonce, while
the extnValue is the value of the nonce".

As we can see in RFC2560 the value of nonce is not limited and it can
contain anything. If we will describe one alternative of the value of nonce,
in some RFC2560 update, which can contain value of type MessageImprint which
is defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string as result of signing or encryption) where X509
certificate can be used, can be time marked with OCSP which contains:

1. validity status of X509 certificate,

2. HASH from the result of asymmetric operation which is included in
nonce as a MessageImprint type,

3. Time of the time mark in the attribute producedAt of time before
which the asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

MessageImprint ::= SEQUENCE {

hashAlgorithm AlgorithmIdentifier,

hashedMessage OCTET STRING }.

Proposed solution has not negative impacts on the present implementation
because present implementation will work with nonce as it does today. New
application will test the value of nonce and if it contains ASN.1 structure
of MessageImprint type then they will test the Hash value of asymmetric
operation and the hash value in MessageImprint and if they have identical
Hash value, then application can declare that the asymmetric operation was
realized before OCSP.ProducedAt time.

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol
(RFC2560)?

Can somebody give an advice how to include this solution into RFC document,
in the easiest way?

Best regards

Peter Rybar

[email-masked]

------=_NextPart_000_0162_01C6EC47.D85A7D80
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Yes I agree fully with your =
points.
Of course I did not mean to imply this is the only approach used by =
SAFE.

In fact my company only supports =
RFC3161
currently, mainly because of the cost reasons you state in your other =
email
(for the OCSP responder it will be no extra effort, but for end-entity
applications to request and validate this special value for the nonce is =
where
the extra work comes in). =

Regards,

LK

From:
[email-masked] [mailto:[email-masked]] =
On Behalf Of Peter Hesse

Sent: 09 October 2006 =
22:44

To: 'Liaquat Khan'; =
'Peter Rybar';
[email-masked]

Subject: RE: The time =
mark can be
used as a simple time stamp substitute

Liaquat,

While SAFE
allows for the "hash as nonce" approach, it is an unfair
characterization to say that "SAFE uses" this approach.
SAFE also allows for the traditional RFC3161 method of =
time stamping,
and in fact several SAFE member companies prefer the RFC3161 compliant
method.  The comment I made earlier about the 3161 method =
potentially
being less expensive in the long run is as a result of our experience =
with SAFE
and SAFE members.

--Peter

From:
[email-masked] [mailto:[email-masked]] =
On Behalf Of Liaquat Khan

Sent: Monday, October 09, =
2006
2:43 PM

To: 'Peter Rybar';
[email-masked]

Subject: RE: The time =
mark can be
used as a simple time stamp substitute

I believe SAFE uses the approach =
you
describe.

Regards,

LK

From:
[email-masked] [mailto:[email-masked]] =
On Behalf Of Peter Rybar

Sent: 09 October 2006 =
11:45

To: [email-masked]

Subject: The time mark =
can be used
as a simple time stamp substitute

Importance: =
High

A time mark can be used as a simple time stamp substitute when =
we
specify content of OCSP nonce as a hash value of MessageImprint type as =
result
of some asymmetric operation.

If someone has a demand for retrieval of an approximate time =
when asymmetric operation has happened =
and
he wants that implementation will not to have an impact on =
the
present solutions to the future, then I suggest to use the present =
widely used
protocol which already contains trusted time inside and attribute like =
nonce
which can encapsulate useful information.  =

For example OCSP protocol (RFC2560) contains the attribute
“producedAt” (trusted time at which the OCSP responder =
signed OCSP
response) and some OCSP can also contain useful extension =
“nonce”.

In RFC2560 the nonce is defined as:“ the nonce is included =
as one
of the requestExtensions in requests, while in responses it would be =
included
as one of the responseExtensions. In both, the request and the response, =
the
nonce will be identified by the object identifier id-pkix-ocsp-nonce, =
while the
extnValue is the value of the nonce”.

As we can see in RFC2560 the value of nonce is not limited and =
it can
contain anything. If we will describe one alternative of the value of =
nonce, in
some RFC2560 update, which can contain value of type MessageImprint =
which is
defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string =
as result
of signing or encryption) where X509 certificate =
can be
used, can be time marked with OCSP which =
contains:

1.      =
validity
status of X509 certificate,

2.      =
HASH
from the result of asymmetric operation which is included in nonce as a
MessageImprint type,

3.      =
Time
of the time mark in the attribute producedAt of time before which the
asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp =
Protocol):

MessageImprint ::=3D SEQUENCE  =
{

hashAlgorithm          =

AlgorithmIdentifier,

hashedMessage          =

OCTET STRING  }.

Proposed =
solution has not
negative impacts on the present implementation because present =
implementation
will work with nonce as it does today. New application will test the =
value of
nonce and if it contains ASN.1 structure of MessageImprint type then =
they will
test the Hash value of asymmetric operation and the hash value in
MessageImprint and if they have identical Hash value, then application =
can
declare that the asymmetric operation was realized before =
OCSP.ProducedAt time.

What do you think about this =
solution?

Is it possible to add such additional information to the OCSP =
protocol
(RFC2560)?

Can somebody give an advice how to include this solution into =
RFC
document, in the easiest way?

Best regards

Peter Rybar

[email-masked]<=
/p>

------=_NextPart_000_0162_01C6EC47.D85A7D80--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9A22Vmn024448; Mon, 9 Oct 2006 19:02:31 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k9A22VJs024446; Mon, 9 Oct 2006 19:02:31 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail-eur1.microsoft.com (mail-eur1.microsoft.com [213.199.128.139]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k9A22RIA024431 for ; Mon, 9 Oct 2006 19:02:30 -0700 (MST) (envelope-from [email-masked])
Received: from EUR-MSG-11.europe.corp.microsoft.com ([65.53.193.196]) by mail-eur1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 10 Oct 2006 03:02:27 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6EC0F.BCCFD922"
Subject: RE: Call for volunteers for a ECC subject public key info design team
Date: Tue, 10 Oct 2006 02:59:35 +0100
Message-ID:
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Call for volunteers for a ECC subject public key info design team
thread-index: AcbjcdGl3cRdAeZlRz6gim6fXhsBwwInWeoQ
From: "Stefan Santesson"
To:
X-OriginalArrivalTime: 10 Oct 2006 02:02:27.0195 (UTC) FILETIME=[22ABBCB0:01C6EC10]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6EC0F.BCCFD922
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

We have received three volunteers to make up this Design Team.

=20

These are:

=20

Tim Polk, NIST (chair)

Brian Minard, Certicom

Tolga Acar, Microsoft

=20

I have asked them to form the design team and immediately start to seek
a resolution that can be presented to this wg at San Diego, and if
possible posted to the list before San Diego for the group to consider.

=20

=20

Stefan Santesson

Senior Program Manager

Windows Security, Standards

From: Stefan Santesson=20
Sent: den 29 september 2006 04:49
To: [email-masked]
Cc: 'Stephen Kent'
Subject: Call for volunteers for a ECC subject public key info design
team

=20

We have since quite some time had two diverse positions on how to
specify subject public key info for ECC public keys in X.509
certificates.

=20

On one hand the current proposal embracing the ANSI solution with a
structured subject public key info that has the capacity to specify
algorithm modes, and the RFC 4055 approach on the other hand using a
single OID to specify algorithm and parameters.

=20

As other groups are dependent on our progress on this issue, in
particular the Kerberos group, the Security ADs has requested us to form
a design team to prepare a decision for the WG.

=20

The design team shall;

=20

(1) be made up of no more than five people.

(2) interview (via the phone and/or e-mail) concerned parties.

(3) document the pros and cons of each proposal, and make a
recommendation to the WG.

=20

The authors of RFC 4055 and authors of draft-ietf-pkix-ecc-pkalgs should
be excluded from design team membership.

=20

The selected design team should be prepared to make their recommendation
at the PKIX meeting in San Diego (or before on the mail list, which
would be even better). Then, the PKIX WG can have a straw poll to see
if the design team recommendation is accepted. Of course, it needs to
be followed up by WG mail list confirmation.

=20

If you are interested to be part of this design team, please send me and
Steve Kent an e-mail no later than Friday next week (October 6). =20

=20

=20

Stefan Santesson

Senior Program Manager

Windows Security, Standards

------_=_NextPart_001_01C6EC0F.BCCFD922
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

We have received three volunteers to make up this Design =
Team.

These =
are:

Tim =
Polk, NIST
(chair)

Brian =
Minard,
Certicom

Tolga =
Acar, Microsoft

I have =
asked them to
form the design team and immediately start to seek a resolution that can =
be
presented to this wg at San Diego, and if possible posted to the list =
before
San Diego for the group to consider.

Stefan Santesson

Senior Program Manager

Windows Security, =
Standards

From: Stefan Santesson

Sent: den 29 september 2006 04:49

To: [email-masked]

Cc: 'Stephen Kent'

Subject: Call for volunteers for a ECC subject public key info =
design
team

We have since quite some time =
had two
diverse positions on how to specify subject public key info for ECC =
public keys
in X.509 certificates.

On one hand the current =
proposal
embracing the ANSI solution with a structured subject public key info =
that has
the capacity to specify algorithm modes, and the RFC 4055 approach on =
the other
hand using a single OID to specify algorithm and =
parameters.

As other groups are dependent =
on our
progress on this issue, in particular the Kerberos group, the Security =
ADs has
requested us to form a design team to prepare a decision for the =
WG.

The design team =
shall;

(1) be made up of no more =
than five
people.

(2) interview (via the phone =
and/or
e-mail) concerned parties.

(3) document the pros and =
cons of each
proposal, and make a recommendation to the WG.

The authors of RFC 4055 and =
authors of
draft-ietf-pkix-ecc-pkalgs should be excluded from design team =
membership.

The selected design team =
should be
prepared to make their recommendation at the PKIX meeting in San Diego =
(or
before on the mail list, which would be even better).  Then, the =
PKIX WG
can have a straw poll to see if the design team recommendation is
accepted.  Of course, it needs to be followed up by WG mail list =
confirmation.

If you are interested to be =
part of this
design team, please send me and Steve Kent an e-mail no later than =
Friday next
week (October 6).

Stefan Santesson

Senior Program Manager

Windows Security, =
Standards

------_=_NextPart_001_01C6EC0F.BCCFD922--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99Li41U003277; Mon, 9 Oct 2006 14:44:04 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99Li4GB003276; Mon, 9 Oct 2006 14:44:04 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from nelson.textdrive.com (nelson.textdrive.com [207.7.108.85]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99Li3R7003256 for ; Mon, 9 Oct 2006 14:44:03 -0700 (MST) (envelope-from [email-masked])
Received: from petert43 (pool-70-18-247-112.res.east.verizon.net [70.18.247.112]) by nelson.textdrive.com (Postfix) with ESMTP id 9E24E45135; Mon, 9 Oct 2006 21:43:56 +0000 (GMT)
From: "Peter Hesse"
To: "'Liaquat Khan'" , "'Peter Rybar'" ,
Subject: RE: The time mark can be used as a simple time stamp substitute
Date: Mon, 9 Oct 2006 17:43:54 -0400
Message-ID: <[email-masked]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0025_01C6EBCA.7EED7450"
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Thread-Index: Acbrj/fUp3Dif2K0RbW4QfQnWAmYDwAQseewAAYyXCA=
In-Reply-To: <[email-masked]>
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_0025_01C6EBCA.7EED7450
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Liaquat,

While SAFE allows for the "hash as nonce" approach, it is an unfair
characterization to say that "SAFE uses" this approach. SAFE also allows
for the traditional RFC3161 method of time stamping, and in fact several
SAFE member companies prefer the RFC3161 compliant method. The comment I
made earlier about the 3161 method potentially being less expensive in the
long run is as a result of our experience with SAFE and SAFE members.

--Peter

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Liaquat Khan
Sent: Monday, October 09, 2006 2:43 PM
To: 'Peter Rybar'; [email-masked]
Subject: RE: The time mark can be used as a simple time stamp substitute

I believe SAFE uses the approach you describe.

Regards,

LK

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Rybar
Sent: 09 October 2006 11:45
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute
Importance: High

A time mark can be used as a simple time stamp substitute when we specify
content of OCSP nonce as a hash value of MessageImprint type as result of
some asymmetric operation.

If someone has a demand for retrieval of an approximate time when asymmetric
operation has happened and he wants that implementation will not to have
an impact on the present solutions to the future, then I suggest to use the
present widely used protocol which already contains trusted time inside and
attribute like nonce which can encapsulate useful information.

For example OCSP protocol (RFC2560) contains the attribute "producedAt"
(trusted time at which the OCSP responder signed OCSP response) and some
OCSP can also contain useful extension "nonce".

In RFC2560 the nonce is defined as:" the nonce is included as one of the
requestExtensions in requests, while in responses it would be included as
one of the responseExtensions. In both, the request and the response, the
nonce will be identified by the object identifier id-pkix-ocsp-nonce, while
the extnValue is the value of the nonce".

As we can see in RFC2560 the value of nonce is not limited and it can
contain anything. If we will describe one alternative of the value of nonce,
in some RFC2560 update, which can contain value of type MessageImprint which
is defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string as result of signing or encryption) where X509
certificate can be used, can be time marked with OCSP which contains:

1. validity status of X509 certificate,

2. HASH from the result of asymmetric operation which is included in
nonce as a MessageImprint type,

3. Time of the time mark in the attribute producedAt of time before
which the asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

MessageImprint ::= SEQUENCE {

hashAlgorithm AlgorithmIdentifier,

hashedMessage OCTET STRING }.

Proposed solution has not negative impacts on the present implementation
because present implementation will work with nonce as it does today. New
application will test the value of nonce and if it contains ASN.1 structure
of MessageImprint type then they will test the Hash value of asymmetric
operation and the hash value in MessageImprint and if they have identical
Hash value, then application can declare that the asymmetric operation was
realized before OCSP.ProducedAt time.

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol
(RFC2560)?

Can somebody give an advice how to include this solution into RFC document,
in the easiest way?

Best regards

Peter Rybar

[email-masked]

------=_NextPart_000_0025_01C6EBCA.7EED7450
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Liaquat,

While SAFE allows for =
the "hash as=20
nonce" approach, it is an unfair characterization to say that "SAFE =
uses" this=20
approach.  SAFE also allows for the traditional RFC3161 method =
of=20
time stamping, and in fact several SAFE member companies prefer the =
RFC3161=20
compliant method.  The comment I made earlier about the 3161 method =

potentially being less expensive in the long run is as a result of our=20
experience with SAFE and SAFE members.

--Peter

From: [email-masked]=20
[mailto:[email-masked]] On Behalf Of Liaquat=20
Khan
Sent: Monday, October 09, 2006 2:43 PM
To: =
'Peter=20
Rybar'; [email-masked]
Subject: RE: The time mark can be =
used as a=20
simple time stamp substitute

I believe =
SAFE uses the=20
approach you describe.

Regards,

LK

From:=20
[email-masked] [mailto:[email-masked]] =
On Behalf Of Peter =
Rybar
Sent: 09 October 2006 =
11:45
To: [email-masked]
Subject: The time mark can be =
used as a=20
simple time stamp substitute
Importance:=20
High

A time mark can be used as a simple time stamp =

substitute when we specify content of OCSP nonce as a hash value of=20
MessageImprint type as result of some asymmetric=20
operation.

If someone has a demand for retrieval of an =
approximate=20
time when asymmetric operation has =
happened=20
and   he wants that implementation will not to have =
an=20
impact on the present solutions to the future, then I suggest to use the =
present=20
widely used protocol which already contains trusted time inside and =
attribute=20
like nonce which can encapsulate useful information. =20

For example OCSP protocol (RFC2560) contains =
the=20
attribute “producedAt” (trusted time at which the OCSP =
responder signed OCSP=20
response) and some OCSP can also contain useful extension =
“nonce”.=20

In RFC2560 the nonce is defined as:“ the =
nonce is=20
included as one of the requestExtensions in requests, while in responses =
it=20
would be included as one of the responseExtensions. In both, the request =
and the=20
response, the nonce will be identified by the object identifier=20
id-pkix-ocsp-nonce, while the extnValue is the value of the=20
nonce”.

As we can see in RFC2560 the value of nonce is =
not=20
limited and it can contain anything. If we will describe one alternative =
of the=20
value of nonce, in some RFC2560 update, which can contain value of type=20
MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then =
any result=20
of asymmetric operation (binary string=20
as result of =
signing or=20
encryption) where X509 =
certificate=20
can be used, can be time marked with OCSP which=20
contains:

1.     =20
validity status of X509=20
certificate,

2.     =20
HASH from the result of =
asymmetric=20
operation which is included in nonce as a MessageImprint =
type,

3.     =20
Time of the time mark in =
the=20
attribute producedAt of time before which the asymmetric operation could =

happen.

A definition of MessageImprint is from RFC3161 =

(Time-Stamp Protocol):

MessageImprint ::=3D SEQUENCE =20
{

=20
hashAlgorithm          =
=20
AlgorithmIdentifier,

=20
hashedMessage          =
=20
OCTET STRING  }.

Proposed solution has not =
negative impacts=20
on the present implementation because present implementation will work =
with=20
nonce as it does today. New application will test the value of nonce and =
if it=20
contains ASN.1 structure of MessageImprint type then they will test the =
Hash=20
value of asymmetric operation and the hash value in MessageImprint and =
if they=20
have identical Hash value, then application can declare that the =
asymmetric=20
operation was realized before OCSP.ProducedAt =
time.

What do you think about this=20
solution?

Is it possible to add such additional =
information to the=20
OCSP protocol (RFC2560)?

Can somebody give an advice how to include =
this solution=20
into RFC document, in the easiest way?

Best regards

Peter Rybar

[email-masked]<=
/P>

------=_NextPart_000_0025_01C6EBCA.7EED7450--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99KWHtG095870; Mon, 9 Oct 2006 13:32:17 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99KWH4L095869; Mon, 9 Oct 2006 13:32:17 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from postman.ripe.net (postman.ripe.net [193.0.0.199]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99KWGZr095852 for ; Mon, 9 Oct 2006 13:32:16 -0700 (MST) (envelope-from [email-masked])
Received: by postman.ripe.net (Postfix, from userid 4008) id 6B4A7241ED; Mon, 9 Oct 2006 22:32:10 +0200 (CEST)
Received: from herring.ripe.net (herring.ripe.net [193.0.1.203]) by postman.ripe.net (Postfix) with ESMTP id 3210C24150 for ; Mon, 9 Oct 2006 22:32:10 +0200 (CEST)
Received: from [127.0.0.1] (cow.ripe.net [193.0.1.239]) by herring.ripe.net (Postfix) with ESMTP id 24B5B2F583 for ; Mon, 9 Oct 2006 22:32:10 +0200 (CEST)
Message-ID: <[email-masked]>
Date: Mon, 09 Oct 2006 22:32:08 +0200
From: =?windows-1252?Q?R=F3bert_Kisteleki?=
Organization: RIPE NCC
User-Agent: Thunderbird 1.5.0.7 (Windows/20060909)
MIME-Version: 1.0
To: [email-masked]
Subject: Re: The time mark can be used as a simple time stamp substitute
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
X-RIPE-Spam-Level:
X-RIPE-Spam-Tests: ALL_TRUSTED,BAYES_00
X-RIPE-Spam-Status: U 0.243286 / -4.4
X-RIPE-Signature: 40c6b6826fd36c2e2b8e8ebc87095f3d
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Also, if I remember correctly, the openxades.org guys tried something
similar back in 2003.

Cheers,
Robert

Liaquat Khan wrote:
> I believe SAFE uses the approach you describe.
>
>
>
> Regards,
>
> LK
>
>
>
> ------------------------------------------------------------------------
>
> *From:* [email-masked]
> [mailto:[email-masked]] *On Behalf Of *Peter Rybar
> *Sent:* 09 October 2006 11:45
> *To:* [email-masked]
> *Subject:* The time mark can be used as a simple time stamp substitute
> *Importance:* High
>
>
>
> A time mark can be used as a simple time stamp substitute when we
> specify content of OCSP nonce as a hash value of MessageImprint type as
> result of some asymmetric operation.
>
>
>
> If someone has a demand for retrieval of an approximate time *when
> asymmetric operation has happened *and he wants that implementation
> will not to have an impact on the present solutions to the future, then
> I suggest to use the present widely used protocol which already contains
> trusted time inside and attribute like nonce which can encapsulate
> useful information.
>
>
>
> For example OCSP protocol (RFC2560) contains the attribute “producedAt”
> (trusted time at which the OCSP responder signed OCSP response) and some
> OCSP can also contain useful extension “nonce”.
>
>
>
> In RFC2560 the nonce is defined as:“ the nonce is included as one of the
> requestExtensions in requests, while in responses it would be included
> as one of the responseExtensions. In both, the request and the response,
> the nonce will be identified by the object identifier
> id-pkix-ocsp-nonce, while the extnValue is the value of the nonce”.
>
>
>
> As we can see in RFC2560 the value of nonce is not limited and it can
> contain anything. If we will describe one alternative of the value of
> nonce, in some RFC2560 update, which can contain value of type
> MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then
> any result of asymmetric operation (binary string* *as result of*
> signing* or *encryption*) where X509 certificate can be used, can be
> time marked with OCSP which contains:
>
> 1. validity status of X509 certificate,
>
> 2. HASH from the result of asymmetric operation which is included
> in nonce as a MessageImprint type,
>
> 3. Time of the time mark in the attribute producedAt of time before
> which the asymmetric operation could happen.
>
>
>
> A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):
>
>
>
> MessageImprint ::= SEQUENCE {
>
> hashAlgorithm AlgorithmIdentifier,
>
> hashedMessage OCTET STRING }.
>
>
>
> Proposed solution has not negative impacts on the present implementation
> because present implementation will work with nonce as it does today.
> New application will test the value of nonce and if it contains ASN.1
> structure of MessageImprint type then they will test the Hash value of
> asymmetric operation and the hash value in MessageImprint and if they
> have identical Hash value, then application can declare that the
> asymmetric operation was realized before OCSP.ProducedAt time.
>
>
>
> What do you think about this solution?
>
> Is it possible to add such additional information to the OCSP protocol
> (RFC2560)?
>
> Can somebody give an advice how to include this solution into RFC
> document, in the easiest way?
>
>
>
> Best regards
>
> Peter Rybar
>
> [email-masked]
>
>
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99IhkME082255; Mon, 9 Oct 2006 11:43:46 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99Ihk1o082254; Mon, 9 Oct 2006 11:43:46 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from DS580.ds580.dedicated.turbodns.co.uk (ds580.dedicated.turbodns.co.uk [81.21.72.161]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99Ihi2f082246 for ; Mon, 9 Oct 2006 11:43:45 -0700 (MST) (envelope-from [email-masked])
Message-Id: <[email-masked]>
Received: from LKNew ([80.229.241.129]) by ds580.dedicated.turbodns.co.uk with MailEnable ESMTP; Mon, 09 Oct 2006 18:51:56 +0000
From: "Liaquat Khan"
To: "'Peter Rybar'" ,
Subject: RE: The time mark can be used as a simple time stamp substitute
Date: Mon, 9 Oct 2006 19:43:28 +0100
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_002C_01C6EBDB.35CB7810"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Thread-Index: Acbrj/fUp3Dif2K0RbW4QfQnWAmYDwAQseew
In-Reply-To:
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_002C_01C6EBDB.35CB7810
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

I believe SAFE uses the approach you describe.

Regards,

LK

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Rybar
Sent: 09 October 2006 11:45
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute
Importance: High

A time mark can be used as a simple time stamp substitute when we specify
content of OCSP nonce as a hash value of MessageImprint type as result of
some asymmetric operation.

If someone has a demand for retrieval of an approximate time when asymmetric
operation has happened and he wants that implementation will not to have
an impact on the present solutions to the future, then I suggest to use the
present widely used protocol which already contains trusted time inside and
attribute like nonce which can encapsulate useful information.

For example OCSP protocol (RFC2560) contains the attribute "producedAt"
(trusted time at which the OCSP responder signed OCSP response) and some
OCSP can also contain useful extension "nonce".

In RFC2560 the nonce is defined as:" the nonce is included as one of the
requestExtensions in requests, while in responses it would be included as
one of the responseExtensions. In both, the request and the response, the
nonce will be identified by the object identifier id-pkix-ocsp-nonce, while
the extnValue is the value of the nonce".

As we can see in RFC2560 the value of nonce is not limited and it can
contain anything. If we will describe one alternative of the value of nonce,
in some RFC2560 update, which can contain value of type MessageImprint which
is defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string as result of signing or encryption) where X509
certificate can be used, can be time marked with OCSP which contains:

1. validity status of X509 certificate,

2. HASH from the result of asymmetric operation which is included in
nonce as a MessageImprint type,

3. Time of the time mark in the attribute producedAt of time before
which the asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

MessageImprint ::= SEQUENCE {

hashAlgorithm AlgorithmIdentifier,

hashedMessage OCTET STRING }.

Proposed solution has not negative impacts on the present implementation
because present implementation will work with nonce as it does today. New
application will test the value of nonce and if it contains ASN.1 structure
of MessageImprint type then they will test the Hash value of asymmetric
operation and the hash value in MessageImprint and if they have identical
Hash value, then application can declare that the asymmetric operation was
realized before OCSP.ProducedAt time.

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol
(RFC2560)?

Can somebody give an advice how to include this solution into RFC document,
in the easiest way?

Best regards

Peter Rybar

[email-masked]

------=_NextPart_000_002C_01C6EBDB.35CB7810
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I believe SAFE uses the approach =
you
describe.

Regards,

LK

From: =
[email-masked]
[mailto:[email-masked]] On
Behalf Of Peter Rybar

Sent: 09 October 2006 =
11:45

To: [email-masked]

Subject: The time mark =
can be used
as a simple time stamp substitute

Importance: =
High

A time mark can be used as a simple time stamp substitute when =
we
specify content of OCSP nonce as a hash value of MessageImprint type as =
result
of some asymmetric operation.

If someone has a demand for retrieval of an approximate time =
when asymmetric operation has happened =
and
he wants that implementation will not to have an impact on =
the
present solutions to the future, then I suggest to use the present =
widely used
protocol which already contains trusted time inside and attribute like =
nonce
which can encapsulate useful information.  =

For example OCSP protocol (RFC2560) contains the attribute =
“producedAt”
(trusted time at which the OCSP responder signed OCSP response) and some =
OCSP
can also contain useful extension “nonce”. =

In RFC2560 the nonce is defined as:“ the nonce is included =
as one of
the requestExtensions in requests, while in responses it would be =
included as
one of the responseExtensions. In both, the request and the response, =
the nonce
will be identified by the object identifier id-pkix-ocsp-nonce, while =
the
extnValue is the value of the nonce”.

As we can see in RFC2560 the value of nonce is not limited and =
it can
contain anything. If we will describe one alternative of the value of =
nonce, in
some RFC2560 update, which can contain value of type MessageImprint =
which is
defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string =
as result
of signing or encryption) where X509 certificate =
can be
used, can be time marked with OCSP which =
contains:

1.      =
validity
status of X509 certificate,

2.      =
HASH
from the result of asymmetric operation which is included in nonce as a
MessageImprint type,

3.      =
Time
of the time mark in the attribute producedAt of time before which the
asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp =
Protocol):

MessageImprint ::=3D SEQUENCE  =
{

hashAlgorithm          =

AlgorithmIdentifier,

hashedMessage          =

OCTET STRING  }.

Proposed =
solution has not
negative impacts on the present implementation because present =
implementation
will work with nonce as it does today. New application will test the =
value of
nonce and if it contains ASN.1 structure of MessageImprint type then =
they will
test the Hash value of asymmetric operation and the hash value in
MessageImprint and if they have identical Hash value, then application =
can
declare that the asymmetric operation was realized before =
OCSP.ProducedAt time.

What do you think about this =
solution?

Is it possible to add such additional information to the OCSP =
protocol
(RFC2560)?

Can somebody give an advice how to include this solution into =
RFC
document, in the easiest way?

Best regards

Peter Rybar

[email-masked]<=
/p>

------=_NextPart_000_002C_01C6EBDB.35CB7810--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99IKhZW079936; Mon, 9 Oct 2006 11:20:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99IKhav079935; Mon, 9 Oct 2006 11:20:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from nelson.textdrive.com (nelson.textdrive.com [207.7.108.85]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99IKf7v079916 for ; Mon, 9 Oct 2006 11:20:42 -0700 (MST) (envelope-from [email-masked])
Received: from petert43 (pool-70-18-247-112.res.east.verizon.net [70.18.247.112]) by nelson.textdrive.com (Postfix) with ESMTP id A70E0450FE; Mon, 9 Oct 2006 18:20:34 +0000 (GMT)
From: "Peter Hesse"
To: "'Santosh Chokhani'" , "'Peter Rybar'"
Cc:
Subject: RE: The time mark can be used as a simple time stamp substitute
Date: Mon, 9 Oct 2006 14:20:33 -0400
Message-ID: <[email-masked]>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_00DD_01C6EBAE.15FC2200"
X-Mailer: Microsoft Office Outlook 11
In-Reply-To: <[email-masked]>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Thread-Index: Acbrj/fUp3Dif2K0RbW4QfQnWAmYDwANbZugAAHuvkA=
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_00DD_01C6EBAE.15FC2200
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit

Peter,

There is another issue with your proposal. The nonce is contained within
the OCSP request and response to protect against replay attacks. By
replacing the nonce with a known value, such as the messageImprint of the
thing you would like to time stamp, you provide an opening for certain
classes of replay attacks.

Using OCSP as a time stamp substitute may be technically possible and may
meet your goal of a third party notarization... If you want to do this in a
standard, extensible, and commonly accepted way, RFC 3161 time stamping is
the way to go. In my opinion, the cost of a 3161 time stamp server or
service is not high enough to justify the additional development /
customization work that you would need to retrofit OCSP for this purpose.

--Peter

+----------------------------------------------------------------+
| Peter Hesse [email-masked] |
| Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
| New! Visit our InfoSecurity industry blog: securitymusings.com
|
+----------------------------------------------------------------+
"Security is mostly a superstition. It does not exist in nature...
Life is either a daring adventure or nothing." --Helen Keller

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Santosh Chokhani
Sent: Monday, October 09, 2006 1:13 PM
To: [email-masked]
Subject: RE: The time mark can be used as a simple time stamp substitute

Peter,

What you propose is doable, how ever the trust will be limited by the trust
in the OCSP Responder. In other words, who can establish trust in this
Responder will be a factor. Also, the period for which the Responder key
and associated certificate can be trusted will be another factor.

To illustrate, many implementation trust OCSP Responder as a trust anchor.
This will limit the time stamp to those. Also, as a trust anchor, there
will not be a mechanism to tell that the Responder had been revoked and
previous time stamp may not be acceptable.

Another example implementation has been CA-Delegated model with short
certificate life. For this OCSP Responders, time stamp will parish as the
OCSP Responder certificate expires in days, weeks, or months.

_____

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Rybar
Sent: Monday, October 09, 2006 6:45 AM
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute
Importance: High

A time mark can be used as a simple time stamp substitute when we specify
content of OCSP nonce as a hash value of MessageImprint type as result of
some asymmetric operation.

If someone has a demand for retrieval of an approximate time when asymmetric
operation has happened and he wants that implementation will not to have
an impact on the present solutions to the future, then I suggest to use the
present widely used protocol which already contains trusted time inside and
attribute like nonce which can encapsulate useful information.

For example OCSP protocol (RFC2560) contains the attribute "producedAt"
(trusted time at which the OCSP responder signed OCSP response) and some
OCSP can also contain useful extension "nonce".

In RFC2560 the nonce is defined as:" the nonce is included as one of the
requestExtensions in requests, while in responses it would be included as
one of the responseExtensions. In both, the request and the response, the
nonce will be identified by the object identifier id-pkix-ocsp-nonce, while
the extnValue is the value of the nonce".

As we can see in RFC2560 the value of nonce is not limited and it can
contain anything. If we will describe one alternative of the value of nonce,
in some RFC2560 update, which can contain value of type MessageImprint which
is defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string as result of signing or encryption) where X509
certificate can be used, can be time marked with OCSP which contains:

1. validity status of X509 certificate,

2. HASH from the result of asymmetric operation which is included in
nonce as a MessageImprint type,

3. Time of the time mark in the attribute producedAt of time before
which the asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

MessageImprint ::= SEQUENCE {

hashAlgorithm AlgorithmIdentifier,

hashedMessage OCTET STRING }.

Proposed solution has not negative impacts on the present implementation
because present implementation will work with nonce as it does today. New
application will test the value of nonce and if it contains ASN.1 structure
of MessageImprint type then they will test the Hash value of asymmetric
operation and the hash value in MessageImprint and if they have identical
Hash value, then application can declare that the asymmetric operation was
realized before OCSP.ProducedAt time.

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol
(RFC2560)?

Can somebody give an advice how to include this solution into RFC document,
in the easiest way?

Best regards

Peter Rybar

[email-masked]

------=_NextPart_000_00DD_01C6EBAE.15FC2200
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Peter,

There is another issue =
with your=20
proposal.  The nonce is contained within the OCSP request and =
response to=20
protect against replay attacks.  By replacing the nonce with a =
known value,=20
such as the messageImprint of the thing you would like to time stamp, =
you=20
provide an opening for certain classes of replay =
attacks.

Using OCSP as a time =
stamp substitute=20
may be technically possible and may meet your goal of a third party=20
notarization... If you want to do this in a standard, =
extensible, and=20
commonly accepted way, RFC 3161 time stamping is the way to go.  In =
my=20
opinion, the cost of a 3161 time stamp server or service is not =
high enough=20
to justify the additional development / customization work that you =
would need=20
to retrofit OCSP for this purpose.

--Peter

+-----------------------------------------------------------=
-----+
| Peter=20
Hesse          &=
nbsp;          [email-masked]    &nb=
sp;|
| Phone: =
703-378-5808=20
x105      Gemini=20
Security Solutions, Inc.  |
| New! Visit our InfoSecurity industry blog: securitymusings.com&n=
bsp;|
+------------------------------------------------------=
----------+
"Security is mostly a superstition. It does not exist in=20
nature...
Life is either a daring adventure or nothing." =
--Helen=20
Keller

From: [email-masked]=20
[mailto:[email-masked]] On Behalf Of Santosh=20
Chokhani
Sent: Monday, October 09, 2006 1:13 PM
To:=20
[email-masked]
Subject: RE: The time mark can be used as a =
simple=20
time stamp substitute

Peter,

What you =
propose is=20
doable, how ever the trust will be limited by the trust in the OCSP =
Responder.=20
In other words, who can establish trust in this Responder will be =
a=20
factor.  Also, the period for which the Responder key and =
associated=20
certificate can be trusted will be another =
factor.

To =
illustrate, many=20
implementation trust OCSP Responder as a trust anchor.  This will =
limit the=20
time stamp to those.  Also, as a trust anchor, there will not be a=20
mechanism to tell that the Responder had been revoked and previous time =
stamp=20
may not be acceptable.

Another =
example=20
implementation has been CA-Delegated model with short certificate life.=20
For this OCSP Responders, time stamp will parish as the OCSP =
Responder=20
certificate expires in days, weeks, or =
months.

From:=20
[email-masked] [mailto:[email-masked]] =
On Behalf Of Peter =
Rybar
Sent: Monday, October 09, 2006 =
6:45=20
AM
To:=20
[email-masked]
Subject: The=20
time mark can be used as a simple time stamp substitute
Importance:=20
High

A time mark can be used as a simple time stamp =

substitute when we specify content of OCSP nonce as a hash value of=20
MessageImprint type as result of some asymmetric=20
operation.

If someone has a demand for retrieval of an =
approximate=20
time when asymmetric operation has =
happened=20
and   he wants that implementation will not to have =
an=20
impact on the present solutions to the future, then I suggest to use the =
present=20
widely used protocol which already contains trusted time inside and =
attribute=20
like nonce which can encapsulate useful information. =20

For example OCSP protocol (RFC2560) contains =
the=20
attribute “producedAt” (trusted time at which the OCSP =
responder signed OCSP=20
response) and some OCSP can also contain useful extension =
“nonce”.=20

In RFC2560 the nonce is defined as:“ the =
nonce is=20
included as one of the requestExtensions in requests, while in responses =
it=20
would be included as one of the responseExtensions. In both, the request =
and the=20
response, the nonce will be identified by the object identifier=20
id-pkix-ocsp-nonce, while the extnValue is the value of the=20
nonce”.

As we can see in RFC2560 the value of nonce is =
not=20
limited and it can contain anything. If we will describe one alternative =
of the=20
value of nonce, in some RFC2560 update, which can contain value of type=20
MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then =
any result=20
of asymmetric operation (binary string=20
as result of =
signing or=20
encryption) where X509 =
certificate=20
can be used, can be time marked with OCSP which=20
contains:

1.     =20
validity status of X509=20
certificate,

2.     =20
HASH from the result of =
asymmetric=20
operation which is included in nonce as a MessageImprint =
type,

3.     =20
Time of the time mark in =
the=20
attribute producedAt of time before which the asymmetric operation could =

happen.

A definition of MessageImprint is from RFC3161 =

(Time-Stamp Protocol):

MessageImprint ::=3D SEQUENCE =20
{

=20
hashAlgorithm          =
=20
AlgorithmIdentifier,

=20
hashedMessage          =
=20
OCTET STRING  }.

Proposed solution has not =
negative impacts=20
on the present implementation because present implementation will work =
with=20
nonce as it does today. New application will test the value of nonce and =
if it=20
contains ASN.1 structure of MessageImprint type then they will test the =
Hash=20
value of asymmetric operation and the hash value in MessageImprint and =
if they=20
have identical Hash value, then application can declare that the =
asymmetric=20
operation was realized before OCSP.ProducedAt =
time.

What do you think about this=20
solution?

Is it possible to add such additional =
information to the=20
OCSP protocol (RFC2560)?

Can somebody give an advice how to include =
this solution=20
into RFC document, in the easiest way?

Best regards

Peter Rybar

[email-masked]<=
/P>

------=_NextPart_000_00DD_01C6EBAE.15FC2200--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99HD1Qn071685; Mon, 9 Oct 2006 10:13:01 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99HD1Ra071684; Mon, 9 Oct 2006 10:13:01 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from EXVS01.ex.dslextreme.net (exbe04.ex.dslextreme.net [66.51.199.86]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99HD0a3071666 for ; Mon, 9 Oct 2006 10:13:00 -0700 (MST) (envelope-from [email-masked])
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6EBC6.261854BF"
Subject: RE: The time mark can be used as a simple time stamp substitute
Date: Mon, 9 Oct 2006 10:13:28 -0700
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: The time mark can be used as a simple time stamp substitute
Thread-Index: Acbrj/fUp3Dif2K0RbW4QfQnWAmYDwANbZug
From: "Santosh Chokhani"
To:
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6EBC6.261854BF
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Peter,

=20

What you propose is doable, how ever the trust will be limited by the
trust in the OCSP Responder. In other words, who can establish trust in
this Responder will be a factor. Also, the period for which the
Responder key and associated certificate can be trusted will be another
factor.

=20

To illustrate, many implementation trust OCSP Responder as a trust
anchor. This will limit the time stamp to those. Also, as a trust
anchor, there will not be a mechanism to tell that the Responder had
been revoked and previous time stamp may not be acceptable.

=20

Another example implementation has been CA-Delegated model with short
certificate life. For this OCSP Responders, time stamp will parish as
the OCSP Responder certificate expires in days, weeks, or months.

=20

________________________________

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Peter Rybar
Sent: Monday, October 09, 2006 6:45 AM
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute=20
Importance: High

=20

A time mark can be used as a simple time stamp substitute when we
specify content of OCSP nonce as a hash value of MessageImprint type as
result of some asymmetric operation.

=20

If someone has a demand for retrieval of an approximate time when
asymmetric operation has happened and he wants that implementation
will not to have an impact on the present solutions to the future, then
I suggest to use the present widely used protocol which already contains
trusted time inside and attribute like nonce which can encapsulate
useful information. =20

=20

For example OCSP protocol (RFC2560) contains the attribute "producedAt"
(trusted time at which the OCSP responder signed OCSP response) and some
OCSP can also contain useful extension "nonce".=20

=20

In RFC2560 the nonce is defined as:" the nonce is included as one of the
requestExtensions in requests, while in responses it would be included
as one of the responseExtensions. In both, the request and the response,
the nonce will be identified by the object identifier
id-pkix-ocsp-nonce, while the extnValue is the value of the nonce".

=20

As we can see in RFC2560 the value of nonce is not limited and it can
contain anything. If we will describe one alternative of the value of
nonce, in some RFC2560 update, which can contain value of type
MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then
any result of asymmetric operation (binary string as result of signing
or encryption) where X509 certificate can be used, can be time marked
with OCSP which contains:

1. validity status of X509 certificate,

2. HASH from the result of asymmetric operation which is included
in nonce as a MessageImprint type,

3. Time of the time mark in the attribute producedAt of time before
which the asymmetric operation could happen.

=20

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

=20

MessageImprint ::=3D SEQUENCE {

hashAlgorithm AlgorithmIdentifier,

hashedMessage OCTET STRING }. =20

=20

Proposed solution has not negative impacts on the present implementation
because present implementation will work with nonce as it does today.
New application will test the value of nonce and if it contains ASN.1
structure of MessageImprint type then they will test the Hash value of
asymmetric operation and the hash value in MessageImprint and if they
have identical Hash value, then application can declare that the
asymmetric operation was realized before OCSP.ProducedAt time.

=20

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol
(RFC2560)?

Can somebody give an advice how to include this solution into RFC
document, in the easiest way?

=20

Best regards

Peter Rybar

[email-masked]

=20

------_=_NextPart_001_01C6EBC6.261854BF
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Peter,

What you propose is doable, how =
ever the
trust will be limited by the trust in the OCSP Responder.  In other =
words, who
can establish trust in this Responder will be a factor.  Also, the =
period for which
the Responder key and associated certificate can be trusted will be =
another
factor.

To illustrate, many implementation =
trust
OCSP Responder as a trust anchor.  This will limit the time stamp =
to those.
Also, as a trust anchor, there will not be a mechanism to tell that the
Responder had been revoked and previous time stamp may not be =
acceptable.

Another example implementation has =
been
CA-Delegated model with short certificate life.  For this OCSP =
Responders, time
stamp will parish as the OCSP Responder certificate expires in days, =
weeks, or
months.

From:
[email-masked] [mailto:[email-masked]] =
On Behalf Of Peter Rybar

Sent: Monday, October 09, =
2006
6:45 AM

To: [email-masked]

Subject: The time mark =
can be used
as a simple time stamp substitute

Importance: =
High

A time mark can be used as a simple time stamp substitute when =
we
specify content of OCSP nonce as a hash value of MessageImprint type as =
result
of some asymmetric operation.

If someone has a demand for retrieval of an approximate time =
when asymmetric operation has happened =
and
he wants that implementation will not to have an impact on =
the
present solutions to the future, then I suggest to use the present =
widely used
protocol which already contains trusted time inside and attribute like =
nonce
which can encapsulate useful information.  =

For example OCSP protocol (RFC2560) contains the attribute =
“producedAt”
(trusted time at which the OCSP responder signed OCSP response) and some =
OCSP
can also contain useful extension “nonce”. =

In RFC2560 the nonce is defined as:“ the nonce is included =
as one of
the requestExtensions in requests, while in responses it would be =
included as
one of the responseExtensions. In both, the request and the response, =
the nonce
will be identified by the object identifier id-pkix-ocsp-nonce, while =
the
extnValue is the value of the nonce”.

As we can see in RFC2560 the value of nonce is not limited and =
it can
contain anything. If we will describe one alternative of the value of =
nonce, in
some RFC2560 update, which can contain value of type MessageImprint =
which is
defined in RFC3161 (Time-Stamp Protocol) then any result of asymmetric
operation (binary string =
as result
of signing or encryption) where X509 certificate =
can be
used, can be time marked with OCSP which =
contains:

1.      =
validity
status of X509 certificate,

2.      =
HASH
from the result of asymmetric operation which is included in nonce as a
MessageImprint type,

3.      =
Time
of the time mark in the attribute producedAt of time before which the
asymmetric operation could happen.

A definition of MessageImprint is from RFC3161 (Time-Stamp =
Protocol):

MessageImprint ::=3D SEQUENCE  =
{

hashAlgorithm          =

AlgorithmIdentifier,

hashedMessage          =

OCTET STRING  }.

Proposed =
solution has not
negative impacts on the present implementation because present =
implementation
will work with nonce as it does today. New application will test the =
value of
nonce and if it contains ASN.1 structure of MessageImprint type then =
they will
test the Hash value of asymmetric operation and the hash value in
MessageImprint and if they have identical Hash value, then application =
can
declare that the asymmetric operation was realized before =
OCSP.ProducedAt time.

What do you think about this =
solution?

Is it possible to add such additional information to the OCSP =
protocol
(RFC2560)?

Can somebody give an advice how to include this solution into =
RFC
document, in the easiest way?

Best regards

Peter Rybar

[email-masked]<=
/p>

------_=_NextPart_001_01C6EBC6.261854BF--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99BC02g026675; Mon, 9 Oct 2006 04:12:00 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99BC0eS026673; Mon, 9 Oct 2006 04:12:00 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from miram.origin-it.net (mail.de.atosorigin.com [194.8.96.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99BBvIA026654 for ; Mon, 9 Oct 2006 04:11:58 -0700 (MST) (envelope-from [email-masked])
Received: from markab.hbg.de.int.atosorigin.com (dehsfw3e.origin-it.net [194.8.96.68]) by miram.origin-it.net (8.13.8/8.13.8/hmo020206) with ESMTP id k99BBkTP077403 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 9 Oct 2006 13:11:48 +0200 (CEST) (envelope-from [email-masked])
Received: from DEHHX001.deuser.de.intra (dehhx001.hbg.de.int.atosorigin.com [161.90.164.119]) by markab.hbg.de.int.atosorigin.com (8.13.8/8.13.8/hmo020206) with ESMTP id k99BBjvB072657 for ; Mon, 9 Oct 2006 13:11:45 +0200 (CEST) (envelope-from [email-masked])
Received: from DEFMX001.deuser.de.intra ([156.150.130.154]) by DEHHX001.deuser.de.intra with Microsoft SMTPSVC(6.0.3790.1830); Mon, 9 Oct 2006 13:11:45 +0200
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6EB93.B4C1F089"
Subject: RFC4210 questions
Date: Mon, 9 Oct 2006 13:11:45 +0200
Message-ID: <[email-masked]>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: RFC4210 questions
Thread-Index: Acbrk7TfCazSjqP6TDSY2il/kqlFIQ==
From:
To:
X-OriginalArrivalTime: 09 Oct 2006 11:11:45.0796 (UTC) FILETIME=[B51D6440:01C6EB93]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6EB93.B4C1F089
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi all,
=20
I've got some questions dealing with RFC 4210.
=20
First: In 4.4.1 CA Operator Actions the following is stated:
=20
"The "old with new" certificate must have a validity period starting
at the generation time of the old key pair and ending at the expiry
date of the old public key."
=20
This sound prettey wrong to me, because at geneartion time of the OLD
key pair no NEW key exists to create the certificate (and the new
certificate doesn't exist either). Is this just a "typo" or is there
something I didn't understand the rigt way?
=20
Second: Why is the proof of possession fpr encryption keys (4.3.2)
defined so comlicated? Wouldn't it be easier to encrypt something (e. g.
the hash of the ToBeSigned ;-) ) at the time the request ist generated?
In other words: Why is it not allowed to use the encryption key pair as
a signature key pair for that single time???
=20
Best regards
=20
Thomas Beckmann
=20

------_=_NextPart_001_01C6EB93.B4C1F089
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi=20
all,

I've =
got some=20
questions dealing with RFC 4210.

First: =
In 4.4.1 CA=20
Operator Actions the following is stated:

"The=20
"old with new" certificate must have a validity period =
starting
=20
at the generation time of the old key pair and ending at the=20
expiry
date of the old public key."

This =
sound prettey=20
wrong to me, because at geneartion time of the OLD key pair no NEW key =
exists to=20
create the certificate (and the new certificate doesn't exist either). =
Is this=20
just a "typo" or is there something I didn't understand the rigt=20
way?

Second: Why is the=20
proof of possession fpr encryption keys (4.3.2) defined so comlicated? =
Wouldn't=20
it be easier to encrypt something (e. g. the hash of the ToBeSigned ;-) =
) at the=20
time the request ist generated? In other words: Why is it not allowed to =
use the=20
encryption key pair as a signature key pair for that single=20
time???

Best=20
regards

Thomas =
Beckmann

------_=_NextPart_001_01C6EB93.B4C1F089--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99AjOJ6023221; Mon, 9 Oct 2006 03:45:24 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k99AjOQ8023220; Mon, 9 Oct 2006 03:45:24 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail.nbusr.sk (mail.nbusr.sk [84.245.65.227]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k99AjIlu023163 for ; Mon, 9 Oct 2006 03:45:20 -0700 (MST) (envelope-from [email-masked])
Received: from IBM5E1D7F233E3 ([10.0.250.204]) by mail.nbusr.sk with esmtp; Mon, 09 Oct 2006 12:45:11 +0200 id 0001CCB2.452A283C.00015644
From: "Peter Rybar"
To: [email-masked]
Subject: The time mark can be used as a simple time stamp substitute
Date: Mon, 9 Oct 2006 12:45:00 +0200
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_001B_01C6EBA0.BEE289D0"
X-Priority: 1 (Highest)
X-MSMail-Priority: High
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Importance: High
Thread-Index: Acbrj/fUp3Dif2K0RbW4QfQnWAmYDw==
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_001B_01C6EBA0.BEE289D0
Content-Type: text/plain;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable

A time mark can be used as a simple time stamp substitute when we =
specify content of OCSP nonce as a hash value of MessageImprint type as =
result of some asymmetric operation.

=20

If someone has a demand for retrieval of an approximate time when =
asymmetric operation has happened and he wants that implementation =
will not to have an impact on the present solutions to the future, then =
I suggest to use the present widely used protocol which already contains =
trusted time inside and attribute like nonce which can encapsulate =
useful information. =20

=20

For example OCSP protocol (RFC2560) contains the attribute =
=E2=80=9CproducedAt=E2=80=9D (trusted time at which the OCSP responder =
signed OCSP response) and some OCSP can also contain useful extension =
=E2=80=9Cnonce=E2=80=9D.=20

=20

In RFC2560 the nonce is defined as:=E2=80=9C the nonce is included as =
one of the requestExtensions in requests, while in responses it would be =
included as one of the responseExtensions. In both, the request and the =
response, the nonce will be identified by the object identifier =
id-pkix-ocsp-nonce, while the extnValue is the value of the =
nonce=E2=80=9D.

=20

As we can see in RFC2560 the value of nonce is not limited and it can =
contain anything. If we will describe one alternative of the value of =
nonce, in some RFC2560 update, which can contain value of type =
MessageImprint which is defined in RFC3161 (Time-Stamp Protocol) then =
any result of asymmetric operation (binary string as result of signing =
or encryption) where X509 certificate can be used, can be time marked =
with OCSP which contains:

1. validity status of X509 certificate,

2. HASH from the result of asymmetric operation which is included =
in nonce as a MessageImprint type,

3. Time of the time mark in the attribute producedAt of time before =
which the asymmetric operation could happen.

=20

A definition of MessageImprint is from RFC3161 (Time-Stamp Protocol):

=20

MessageImprint ::=3D SEQUENCE {

hashAlgorithm AlgorithmIdentifier,

hashedMessage OCTET STRING }. =20

=20

Proposed solution has not negative impacts on the present implementation =
because present implementation will work with nonce as it does today. =
New application will test the value of nonce and if it contains ASN.1 =
structure of MessageImprint type then they will test the Hash value of =
asymmetric operation and the hash value in MessageImprint and if they =
have identical Hash value, then application can declare that the =
asymmetric operation was realized before OCSP.ProducedAt time.

=20

What do you think about this solution?

Is it possible to add such additional information to the OCSP protocol =
(RFC2560)?

Can somebody give an advice how to include this solution into RFC =
document, in the easiest way?

=20

Best regards

Peter Rybar

[email-masked]

=20

------=_NextPart_000_001B_01C6EBA0.BEE289D0
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: quoted-printable

A time mark can be used as a simple time =
stamp
substitute when we specify content of OCSP nonce as a hash value of =
MessageImprint
type as result of some asymmetric =
operation.

If someone has a demand for retrieval of an =
approximate
time when asymmetric operation has =
happened and
=C2=A0=C2=A0he wants that implementation will not to have an impact on =
the present
solutions to the future, then I suggest to use the present widely used =
protocol
which already contains trusted time inside and attribute like nonce =
which can encapsulate
useful information.=C2=A0

For example OCSP protocol (RFC2560) contains =
the attribute
=E2=80=9CproducedAt=E2=80=9D (trusted time at which the OCSP responder =
signed OCSP response)
and some OCSP can also contain useful extension =E2=80=9Cnonce=E2=80=9D. =

In RFC2560 the nonce is defined as:=E2=80=9C =
the nonce is
included as one of the requestExtensions in requests, while in responses =
it
would be included as one of the responseExtensions. In both, the request =
and
the response, the nonce will be identified by the object identifier
id-pkix-ocsp-nonce, while the extnValue is the value of the =
nonce=E2=80=9D.

As we can see in RFC2560 the value of nonce =
is not
limited and it can contain anything. If we will describe one alternative =
of the
value of nonce, in some RFC2560 update, which can contain value of type =
MessageImprint
which is defined in RFC3161 (Time-Stamp Protocol) then any result of =
asymmetric
operation (binary string =
as result
of signing or encryption) where X509 certificate =
can be
used, can be time marked with OCSP which =
contains:

1.      =
validity status of X509 certificate,

2.      =
HASH from the result of asymmetric operation which is =
included in
nonce as a MessageImprint type,

3.      =
Time of the time mark in the attribute producedAt of time =
before
which the asymmetric operation could happen.

A definition of MessageImprint is from =
RFC3161 (Time-Stamp
Protocol):

MessageImprint ::=3D SEQUENCE=C2=A0 =
{

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
hashAlgorithm=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
AlgorithmIdentifier,

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
hashedMessage=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 OCTET STRING=C2=A0 }.=C2=A0

Proposed
solution has not negative impacts on the present implementation because =
present
implementation will work with nonce as it does today. New application =
will test
the value of nonce and if it contains ASN.1 structure of MessageImprint =
type then
they will test the Hash value of asymmetric operation and the hash value =
in MessageImprint
and if they have identical Hash value, then application can declare that =
the asymmetric
operation was realized before OCSP.ProducedAt =
time.

What do you think about this =
solution?

Is it possible to add such additional =
information to the
OCSP protocol (RFC2560)?

Can somebody give an advice how to include =
this
solution into RFC document, in the easiest =
way?

Best regards

Peter Rybar

[email-masked]<=
/p>

------=_NextPart_000_001B_01C6EBA0.BEE289D0--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k98MtmSr041405; Sun, 8 Oct 2006 15:55:48 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k98MtmbN041404; Sun, 8 Oct 2006 15:55:48 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from srv1.int.stroeder.com (52-30-124-83.dsl.3u.net [83.124.30.52]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k98Mtktu041392 for ; Sun, 8 Oct 2006 15:55:47 -0700 (MST) (envelope-from [email-masked])
Received: from localhost (localhost [127.0.0.1]) by srv1.int.stroeder.com (Postfix) with ESMTP id 5359756A4; Mon, 9 Oct 2006 00:55:39 +0200 (CEST)
Received: from srv1.int.stroeder.com ([127.0.0.1]) by localhost (srv1 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 04550-01; Mon, 9 Oct 2006 00:55:21 +0200 (CEST)
Received: from [10.1.1.5] (unknown [10.1.1.5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "Michael Stroeder", Issuer "Thawte Personal Freemail Issuing CA" (not verified)) by srv1.int.stroeder.com (Postfix) with ESMTP id 331A1567A; Mon, 9 Oct 2006 00:55:21 +0200 (CEST)
Message-ID: <[email-masked]>
Date: Mon, 09 Oct 2006 00:55:18 +0200
From: =?ISO-8859-1?Q?Michael_Str=F6der?=
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060417
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: "David A. Cooper"
CC: pkix
Subject: Re: Complete CRLs with expired certs?
References: <[email-masked]> <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: amavisd-new at int.stroeder.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

David,

David A. Cooper wrote:
> So, the closest one could come would be to issue one CRL that only
> covers unexpired certificates and one that covers both expired and
> unexpired certificates. While it would not be necessary to issue two
> CRLs, there is the risk that the CRL that covers expired certificates
> would grow very large and issuing two CRLs would ensure that most
> relying parties could use the smaller CRL that only covered unexpired
> certificates.

This is exactly what I was planning to do. The large CRL would only be
used for validating archived digital signatures. But a product vendor
refused implementing that since he claimed it would not be compliant
with RFC 3280.

> (Note that in order to be able to issue two CRLs where
> one CRL only covered expired certificates, it would be necessary to
> define a new CRL extension, and that extension would have to be marked
> as critical.)

This is not what I was after.

> The first is to use CRL distribution points, with
> each distribution point covering a limited number of certificates.

But even in the ideal case this would divide the CRL by the reasons
flags. If the revocation reason is most times the same this does not
solve the problem. If you put different DistributionPointNames in there
client applications will likely retrieve and examine all CRLs => you win
nothing.

> The
> other option is to create a new CA every so often so that the number of
> certificates issued by any given CA is limited (one could continue to
> use the same hardware and software, but just issue under a different CA
> name and key pair).

Interesting point.

Ciao, Michael.

Received: from capa.net ([84.7.62.163]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k98B0ngM071741 for ; Sun, 8 Oct 2006 04:00:54 -0700 (MST) (envelope-from [email-masked])
Message-ID: <000001c6eac9$0bfb6a30$e0cba8c0@qzjkaqr>
Reply-To: "Ceres Sellars"
From: "Ceres Sellars"
To: [email-masked]
Subject: Re: Hi
Date: Sun, 8 Oct 2006 04:01:03 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C6EA8E.5F9C9230"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106

This is a multi-part message in MIME format.

------=_NextPart_000_0001_01C6EA8E.5F9C9230
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VrAGRA for less

http://www.juidefinkderionmadesa.com
=20
_____ =20

understood?
The answer. It is just the glimmering of an idea now-but I know that
Her face must be covered to conceal impurity, her ankles covered

------=_NextPart_000_0001_01C6EA8E.5F9C9230
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Hi,

VrAGRA for less

http://www.juidefinkderionm=
adesa.com

understood?

The answer. It is just the glimmering of an idea now-but I know =
that

Her face must be covered to conceal impurity, her ankles =
covered

------=_NextPart_000_0001_01C6EA8E.5F9C9230--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k987Tacr052799; Sun, 8 Oct 2006 00:29:36 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k987TaTc052798; Sun, 8 Oct 2006 00:29:36 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from pne-smtpout2-sn1.fre.skanova.net (pne-smtpout2-sn1.fre.skanova.net [81.228.11.159]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k987TZxM052789 for ; Sun, 8 Oct 2006 00:29:36 -0700 (MST) (envelope-from [email-masked])
Received: from arport2v (81.232.45.80) by pne-smtpout2-sn1.fre.skanova.net (7.2.075) (authenticated as u18116613) id 451BA3C70025519F for [email-masked]; Sun, 8 Oct 2006 09:29:29 +0200
Message-ID: <003e01c6eaab$7121de30$82c5a8c0@arport2v>
From: "Anders Rundgren"
To:
Subject: The NR-bit - Time to put it at rest?
Date: Sun, 8 Oct 2006 09:29:07 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

https://bugzilla.mozilla.org/show_bug.cgi?id=328346

The NR-bit concept was probably a good idea some 10 years ago.
Today it creates interoperability issues.

In addition, people are nowadays convicted based on IP address logs
and similar, making the legal significance of a specific NR bit, very limited.

To make it even worse, the creators of the NR-bit stuff never thought
of how software should handle the situation where a specific entity had
multiple certificates for different purposes. In fact, I have a collection
of genuine EU eID certificates, where not even the subject DN is identical
for the different certificates although they all came in the same package.

If there actually is any point is continuing having different certificates
for authentication and signatures, it seems that there are [still] things
missing in terms of standards in order to maintain interoperability.

Anders Rundgren

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96Jo8M5089309; Fri, 6 Oct 2006 12:50:08 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96Jo8IU089307; Fri, 6 Oct 2006 12:50:08 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from ns1.neustar.com (ns1.neustar.com [156.154.16.138]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96Jo7oH089290 for ; Fri, 6 Oct 2006 12:50:08 -0700 (MST) (envelope-from [email-masked])
Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns1.neustar.com (Postfix) with ESMTP id 2038C26E68; Fri, 6 Oct 2006 19:50:02 +0000 (GMT)
Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1GVvhp-00021d-TY; Fri, 06 Oct 2006 15:50:01 -0400
Content-Type: Multipart/Mixed; Boundary="NextPart"
Mime-Version: 1.0
To: [email-masked]
Cc: [email-masked]
From: [email-masked]
Subject: I-D ACTION:draft-ietf-pkix-ecc-pkalgs-03.txt
Message-Id:
Date: Fri, 06 Oct 2006 15:50:01 -0400
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

Title : Additional Algorithms and Identifiers for use of Elliptic Curve Cryptography with PKIX
Author(s) : D. Brown
Filename : draft-ietf-pkix-ecc-pkalgs-03.txt,.pdf
Pages : 21
Date : 2006-10-5

This document gives additional algorithms and associated ASN.1
identifiers for elliptic curve cryptography (ECC) used with the
Internet X.509 Public Key Infrastructure Certificate and
Certificate Revocation List (CRL) Profile (PKIX). The algorithms
and identifiers here are consistent with both ANSI X9.62-2005 and
X9.63-2001, and shall be consistent with the forthcoming revisions
of these documents. Consistency shall also be maintained with SEC1
and SEC2, and any revisions or successors of such documents.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-ecc-pkalgs-03.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username "anonymous" and a password of your e-mail address. After
logging in, type "cd internet-drafts" and then
"get draft-ietf-pkix-ecc-pkalgs-03.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
[email-masked].
In the body type:
"FILE /internet-drafts/draft-ietf-pkix-ecc-pkalgs-03.txt".

NOTE: The mail server at ietf.org can return the document in
MIME-encoded form by using the "mpack" utility. To use this
feature, insert the command "ENCODING mime" before the "FILE"
command. To decode the response(s), you will need "munpack" or
a MIME-compliant mail reader. Different MIME-compliant mail readers
exhibit different behavior, especially when dealing with
"multipart" MIME messages (i.e. documents which have been split
up into multiple messages), so check your local documentation on
how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
access-type="mail-server";
server="[email-masked]"

Content-Type: text/plain
Content-ID: <[email-masked]>

ENCODING mime
FILE /internet-drafts/draft-ietf-pkix-ecc-pkalgs-03.txt

--OtherAccess
Content-Type: Message/External-body;
name="draft-ietf-pkix-ecc-pkalgs-03.txt";
site="ftp.ietf.org";
access-type="anon-ftp";
directory="internet-drafts"

Content-Type: text/plain
Content-ID: <[email-masked]>

--OtherAccess--

--NextPart--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96GbLku069112; Fri, 6 Oct 2006 09:37:21 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96GbLG4069111; Fri, 6 Oct 2006 09:37:21 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp2.bestweb.net (smtp2-3.bestweb.net [209.94.103.47]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96GbJFi069097 for ; Fri, 6 Oct 2006 09:37:20 -0700 (MST) (envelope-from [email-masked])
Received: from [127.0.0.1] (pool-70-107-55-149.ny325.east.verizon.net [70.107.55.149]) by smtp2.bestweb.net (Postfix) with ESMTP id F08D71D070; Fri, 6 Oct 2006 12:37:18 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Fri, 06 Oct 2006 12:38:44 -0400
From: Joel Kazin
User-Agent: Mozilla Thunderbird 1.0.5 (Windows/20050711)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Arshad Noor
CC: Denis Pinkas , "[email-masked]"
Subject: Re: Key Compromise, Rollover and Loss (was Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions)
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

I am also volunteering for this topic as it is part of CP and CPS
development.

Arshad Noor wrote:

>
> Denis,
>
> I will volunteer to be your co-editor on this topic; please
> contact me off-line to discuss this. Thanks.
>
> Arshad Noor
> StrongAuth, Inc.
>
>
> Denis Pinkas wrote:
>
>>
>> A few year ago (december 2001), I proposed to work on the topic and
>> even drafted a document.
>> I asked for a co-editor, but none volunteered.
>>
>> Should there now be an interrest, a volonteer co-editor and should a
>> work item be adopted on the topic by the WG, then (and only then) I
>> would be happy to re-issue the draft.
>>
>> The title was: Key Compromise, Rollover and Loss
>>
>> The abstract was:
>>
>> This document presents a framework to assist the writers of policy
>> or practice statements and the designers of a Public Key
>> Infrastructure to prepare disaster recovery plans in case of a
>> private key compromise or a private key loss. This may happen to
>> end-user keys, Certification Authorities, Revocation Authorities,
>> Attribute Authorities, Time Stamping Authorities. Since keys do
>> not last for ever, key rollover is should be planned in advance
>> and some guidance is necessary. In addition, the case of the
>> denial of service attacks on Repositories holding certificates
>> and/or CRLs has also to be considered. The framework provides a
>> comprehensive list of potential key compromise or key loss
>> conditions that (at the writer's discretion) should be addressed
>> so that it is possible to nicely recover from situations which
>> normally should not happen, but might happen.
>>
>
>
>
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96FDiQY059354; Fri, 6 Oct 2006 08:13:44 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96FDfIm059341; Fri, 6 Oct 2006 08:13:41 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from brendan.brad.office.comodo.net (brad.comodogroup.com [82.109.38.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96FDcLA059300 for ; Fri, 6 Oct 2006 08:13:39 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 2945 invoked by uid 1000); 6 Oct 2006 16:13:32 +0100
Received: from Unknown (HELO nigel.comodo.net) (192.168.0.58) by brendan.brad.office.comodo.net (qpsmtpd/0.31.1) with ESMTP; Fri, 06 Oct 2006 16:13:32 +0100
From: Rob Stradling
Organization: Comodo CA Limited
To: "[email-masked]"
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Fri, 6 Oct 2006 16:13:29 +0100
User-Agent: KMail/1.9.1
Cc: Daniel Brown
References:
In-Reply-To:
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <[email-masked]>
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

On Friday 06 October 2006 15:37, Daniel Brown wrote:
> ...
> ...
> As I understand your proposal (please correct me as necessary), if M is
> the ToBeSigned - before your new SHA256 extension - a CA with RSA private
> key (n,d) would generate a signature essentially like
>
> S = PKCS1(SHA1(M | SHA256(M)))^d mod n

In essence, yes, that's my proposal.

> That's a clever idea if it stops the known SHA1 attacks, but has it been
> carefully scrutinized against other attacks?

Not by me.

> In particular, is some of
> the benefit of using SHA256 lost once it has gone through the SHA1 output
> (since 256 bits has been crunched to 160 bits). For example, birthday
> attacks on SHA256 should take about 2^128 hashes, but with your
> construction birthday attacks should take about 2^81 hashes, which is
> certainly better than the 2^63 (the current SHA1 strength), but much worse
> than 2^128 (the current SHA256 strength).

Thanks for your assessment on this.
It had occurred to me that this might be the case, but I'm a programmer rather
than a cryptographer...and I'm not going to make any more wild
speculations. :-)

> Admittedly, these are rather
> theoretically high levels of security, which the very pragmatic PKIX group
> may not be terribly concerned about, but it leads me to question whether
> your objective 2 will be fully met.

I guess the obvious alteration to my proposal would be to define
an "Additional Signatures" Certificate Extension rather than (or in addition
to) an "Additional Hashes" extension.
Each additional signature would be generated by a different hash algorithm,
but the same CA Private Key and asymmetric algorithm would be used for all of
them.

> Aside: Does the PKIX group feel that the paper "Colliding X.509
> Certificates" http://eprint.iacr.org/2005/067 is of no concern (assuming
> that it can eventually be extended to SHA1)? (I've been getting that
> impression from various comments.) If so, why? Some possible reasons
> are: (1) pre-existing certs (issued before collision attack) are not
> affected and are still verifiable and usable, (2) when a collision attack
> is discovered, CAs can halt issuing certs and upgrade to a better hash. In
> particular, these reasons make it seems that PKIX can afford to wait until
> the very last minute, i.e. when SHA1 is actually broken, rather than to
> upgrade to some fix like SHA256 before SHA1 is broken. If new hashes such
> as SHA256 are ready to go, then that should be enough preparation for the
> least amount of downtime during the upgrade. Older implementations will
> not be able to process the new certs, though. My concern with a
> last-minute approach is that perhaps somebody will use the collision
> attacks before a CA becomes aware of it? Is there some other good reason
> that I should not have this concern? For example, is there something else
> about the "Colliding X.509 Certs" paper that means it will not be useful
> for a realistic attack.
>
> Thanks,
>
> Dan Brown
> (905) 501-3857
> http://www.certicom.com

--
Rob Stradling
Digital Certification and Identity Management Solutions Manager - Comodo
Comodo - Creating Trust Online
Office Tel Europe: +44 (0) 1274 730505
Office Tel US: +1 888 COMODO 1 (1 888 266 6361)
Fax Europe: +44 (0) 1274 730909
Fax US: +1 201 963 9003
www.comodo.com, www.trustix.com, www.enterprisessl.com,
www.contentverification.com
Join the online fax revolution! Send your faxes online with TrustFax
www.TrustFax.com !

This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender by replying
to the e-mail containing this attachment. Replies to this email may be
monitored by Comodo for operational or business reasons. Whilst every
endeavour is taken to ensure that e-mails are free from viruses, no liability
can be accepted and the recipient is requested to use their own virus checking
software.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96Ecduj055014; Fri, 6 Oct 2006 07:38:39 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96EcdXR055013; Fri, 6 Oct 2006 07:38:39 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail.ca.certicom.com (nat194.certicom.com [66.48.18.194]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96Eccfi054995 for ; Fri, 6 Oct 2006 07:38:38 -0700 (MST) (envelope-from [email-masked])
Received: from spamfilter.certicom.com (localhost.localdomain [127.0.0.1]) by mail.ca.certicom.com (Postfix) with ESMTP id BC2C9100DE507; Fri, 6 Oct 2006 10:38:32 -0400 (EDT)
Received: from mail.ca.certicom.com ([127.0.0.1]) by spamfilter.certicom.com (storm [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 01822-71; Fri, 6 Oct 2006 10:38:29 -0400 (EDT)
Received: from certicom1.certicom.com (domino1.certicom.com [10.0.1.24]) by mail.ca.certicom.com (Postfix) with ESMTP id A22D8100D9F95; Fri, 6 Oct 2006 10:38:29 -0400 (EDT)
In-Reply-To: <[email-masked]>
To: Rob Stradling
Cc: "[email-masked]"
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.5.5 November 30, 2005
Message-ID:
From: Daniel Brown
Date: Fri, 6 Oct 2006 10:37:06 -0400
X-MIMETrack: Serialize by Router on Certicom1/Certicom(Release 7.0.1|January 17, 2006) at 10/06/2006 10:37:04 AM, Serialize complete at 10/06/2006 10:37:04 AM
Content-Type: multipart/alternative; boundary="=_alternative 0050CF8C852571FF_="
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multipart message in MIME format.
--=_alternative 0050CF8C852571FF_=
Content-Type: text/plain; charset="US-ASCII"

Rob Stradling wrote on 10/05/2006 11:24:43 AM:

> Most currently valid X.509 certificates rely on the SHA-1 algorithm.
If/when
> SHA-1 gets sufficiently "broken", the signatures on those certificates
will
> become worthless. Some experts believe that SHA-1 might get broken
really
> quite soon.
> X.509 allows us to stop using SHA-1 and start using SHA-256 (or SHA-384,
or
> SHA-512, etc) instead. However, if we were to do this today, most
existing
> software (including all versions of Windows prior to Vista...which isn't
even
> launched yet) would not be able to verify the signatures on the
certificates
> at all.
>
> I want to be able to do *all* of the following (in no particular
order)...
> 1. Start using SHA-256/384/512/etc in X.509 certificates ASAP, so that
the
> latest software can take advantage of these (hopefully) more secure hash

> algorithms.
> 2. Avoid keeping SHA-1 as a single point of failure until such
> time as there
> is widespread support for SHA-256/384/512/etc.
> 3. Stop having to rely on any single hash algorithm when verifying the

> signature of an X.509 Certificate.
>
> I hope this explains my aims more clearly.

As I understand your proposal (please correct me as necessary), if M is
the ToBeSigned - before your new SHA256 extension - a CA with RSA private
key (n,d) would generate a signature essentially like

S = PKCS1(SHA1(M | SHA256(M)))^d mod n

That's a clever idea if it stops the known SHA1 attacks, but has it been
carefully scrutinized against other attacks? In particular, is some of
the benefit of using SHA256 lost once it has gone through the SHA1 output
(since 256 bits has been crunched to 160 bits). For example, birthday
attacks on SHA256 should take about 2^128 hashes, but with your
construction birthday attacks should take about 2^81 hashes, which is
certainly better than the 2^63 (the current SHA1 strength), but much worse
than 2^128 (the current SHA256 strength). Admittedly, these are rather
theoretically high levels of security, which the very pragmatic PKIX group
may not be terribly concerned about, but it leads me to question whether
your objective 2 will be fully met.

Aside: Does the PKIX group feel that the paper "Colliding X.509
Certificates" http://eprint.iacr.org/2005/067 is of no concern (assuming
that it can eventually be extended to SHA1)? (I've been getting that
impression from various comments.) If so, why? Some possible reasons
are: (1) pre-existing certs (issued before collision attack) are not
affected and are still verifiable and usable, (2) when a collision attack
is discovered, CAs can halt issuing certs and upgrade to a better hash. In
particular, these reasons make it seems that PKIX can afford to wait until
the very last minute, i.e. when SHA1 is actually broken, rather than to
upgrade to some fix like SHA256 before SHA1 is broken. If new hashes such
as SHA256 are ready to go, then that should be enough preparation for the
least amount of downtime during the upgrade. Older implementations will
not be able to process the new certs, though. My concern with a
last-minute approach is that perhaps somebody will use the collision
attacks before a CA becomes aware of it? Is there some other good reason
that I should not have this concern? For example, is there something else
about the "Colliding X.509 Certs" paper that means it will not be useful
for a realistic attack.

Thanks,

Dan Brown
(905) 501-3857
http://www.certicom.com

--=_alternative 0050CF8C852571FF_=
Content-Type: text/html; charset="US-ASCII"

Rob Stradling wrote on 10/05/2006 11:24:43 AM:

> Most currently valid X.509 certificates rely on the SHA-1 algorithm.
If/when

> SHA-1 gets sufficiently "broken", the signatures on those
certificates will

> become worthless.  Some experts believe that SHA-1 might get
broken really

> quite soon.

> X.509 allows us to stop using SHA-1 and start using SHA-256 (or SHA-384,
or

> SHA-512, etc) instead.  However, if we were to do this today,
most existing

> software (including all versions of Windows prior to Vista...which
isn't even

> launched yet) would not be able to verify the signatures on the certificates

> at all.

> I want to be able to do *all* of the following (in no particular order)...

>   1. Start using SHA-256/384/512/etc in X.509 certificates ASAP,
so that the

> latest software can take advantage of these (hopefully) more secure
hash

> algorithms.

>   2. Avoid keeping SHA-1 as a single point of failure until such

> time as there

> is widespread support for SHA-256/384/512/etc.

>   3. Stop having to rely on any single hash algorithm when verifying
the

> signature of an X.509 Certificate.

> I hope this explains my aims more clearly.

As I understand your proposal (please correct me as
necessary), if M is the ToBeSigned - before your new SHA256 extension -
a CA with RSA private key (n,d) would generate a signature essentially
like

S = PKCS1(SHA1(M | SHA256(M)))^d mod n

That's a clever idea if it stops the known SHA1 attacks,
but has it been carefully scrutinized against other attacks?  In particular,
is some of the benefit of using SHA256 lost once it has gone through the
SHA1 output (since 256 bits has been crunched to 160 bits).  For example,
birthday attacks on SHA256 should take about 2^128 hashes, but with your
construction birthday attacks should take about 2^81 hashes, which is certainly
better than the 2^63 (the current SHA1 strength), but much worse than 2^128
(the current SHA256 strength).  Admittedly, these are rather theoretically
high levels of security, which the very pragmatic PKIX group may not be
terribly concerned about, but it leads me to question whether your objective
2 will be fully met.

Aside: Does the PKIX group feel that the paper "Colliding
X.509 Certificates" http://eprint.iacr.org/2005/067 is of no concern
(assuming that it can eventually be extended to SHA1)?  (I've been
getting that impression from various comments.)  If so, why?  Some
possible reasons are: (1) pre-existing certs (issued before collision attack)
are not affected and are still verifiable and usable, (2) when a collision
attack is discovered, CAs can halt issuing certs and upgrade to a better
hash.  In particular, these reasons make it seems that PKIX can afford
to wait until the very last minute, i.e. when SHA1 is actually broken,
rather than to upgrade to some fix like SHA256 before SHA1 is broken.  If
new hashes such as SHA256 are ready to go, then that should be enough preparation
for the least amount of downtime during the upgrade.  Older implementations
will not be able to process the new certs, though.   My concern with
a last-minute approach is that perhaps somebody will use the collision
attacks before a CA becomes aware of it?  Is there some other good
reason that I should not have this concern?  For example, is there
something else about the "Colliding X.509 Certs" paper that means
it will not be useful for a realistic attack.

Thanks,

Dan Brown

(905) 501-3857

http://www.certicom.com

--=_alternative 0050CF8C852571FF_=--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96CRBil038641; Fri, 6 Oct 2006 05:27:11 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96CRBC4038640; Fri, 6 Oct 2006 05:27:11 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96CR9ec038632 for ; Fri, 6 Oct 2006 05:27:10 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-mcl1.frcl.bull.fr [129.184.87.20]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id OAA11184; Fri, 6 Oct 2006 14:28:52 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006100614264100:70933 ; Fri, 6 Oct 2006 14:26:41 +0200
Date: Fri, 6 Oct 2006 14:26:39 +0200
From: "Denis Pinkas"
To: "Rob Stradling"
Cc: "[email-masked]"
Subject: Re: Key Compromise, Rollover and Loss (was Re: Hash Algorithm Agility viaCertificate/CRL/OCSP Extensions)
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 06/10/2006 14:26:41, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 06/10/2006 14:26:42, Serialize complete at 06/10/2006 14:26:42
Message-ID:
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by balder-227.proper.com id k96CRBec038635
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Rob and the co-chairs,

(...)°

>That's where my idea comes in. By putting additional hashes (generated by a
>variety of hash algorithms) into a non-critical Certificate Extension, and by
>requiring (or at least recommending) new software to check *all* of these
>additional hashes, I believe that we could accomplish all of these goals.

>Each certificate's signature would continue to be generated using
>sha1WithRSAEncryption, allowing current applications to continue to work
>without any code changes. These current applications would simply ignore the
>non-critical "Additional Hashes" Certificate Extension.

>If SHA-1 is ever sufficiently compromised, then we can expect attackers to
>create fake certificates using sha1WithRSAEncryption signatures from valid
>certificates. My hope is that new software would be able to detect and
>reject these fake certificates, simply by checking all of the hashes in
>the "Additional Hashes" extension.

>Do you think my idea is worth considering at all?

Since you asked ....

This would mandate to develop a new piece of software that is likely to be never used
(and tested). This is not a good idea.

Since every PKI should have a Disaster Recovey Plan ready, in particular in case
a given algorithm or key length is broken, it would be much better to rely on that plan
which will address wider concerns.

The remaining of my reponse is that is would be more beneficial, if the WG agrees,
to develop an RFC to address: Key Compromise, Rollover and Loss. See my previous
e-mail for the abstract.

Now a message to the co-chairs. Do you think it would be appropriate at this time
to start a work-item adressing "Key Compromise, Rollover and Loss". The original title was
"Planning for PKI Disaster" but was thought to be too frightening, so why it has been changed.
A more appropriate title would be: "PKI Disaster Recovery Plan".

Denis

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96C0VRL035357; Fri, 6 Oct 2006 05:00:31 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96C0Vds035356; Fri, 6 Oct 2006 05:00:31 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from brendan.brad.office.comodo.net (brad.comodogroup.com [82.109.38.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96C0Svc035348 for ; Fri, 6 Oct 2006 05:00:29 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 22748 invoked by uid 1000); 6 Oct 2006 13:00:27 +0100
Received: from Unknown (HELO nigel.comodo.net) (192.168.0.58) by brendan.brad.office.comodo.net (qpsmtpd/0.31.1) with ESMTP; Fri, 06 Oct 2006 13:00:27 +0100
From: Rob Stradling
Organization: Comodo CA Limited
To: "Denis Pinkas"
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Fri, 6 Oct 2006 13:00:25 +0100
User-Agent: KMail/1.9.1
Cc: "[email-masked]"
References:
In-Reply-To:
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Message-Id: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k96C0Vvc035351
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

On Thursday 05 October 2006 16:55, Denis Pinkas wrote:
> >Hi Denis. I'll try again... :-)
>
> Thanks for the explanations.
>
> >Most currently valid X.509 certificates rely on the SHA-1 algorithm.
> > If/when SHA-1 gets sufficiently "broken", the signatures on those
> > certificates will become worthless. Some experts believe that SHA-1
> > might get broken really quite soon.
> >
> >X.509 allows us to stop using SHA-1 and start using SHA-256 (or SHA-384,
> > or SHA-512, etc) instead. However, if we were to do this today, most
> > existing software (including all versions of Windows prior to
> > Vista...which isn't even launched yet) would not be able to verify the
> > signatures on the certificates at all.
> >
> >I want to be able to do *all* of the following (in no particular order)...
> > 1. Start using SHA-256/384/512/etc in X.509 certificates ASAP, so that
> > the latest software can take advantage of these (hopefully) more secure
> > hash algorithms.
> > 2. Avoid keeping SHA-1 as a single point of failure until such time as
> > there is widespread support for SHA-256/384/512/etc.
> > 3. Stop having to rely on any single hash algorithm when verifying the
> >signature of an X.509 Certificate.
> >
> >I hope this explains my aims more clearly.
>
> Some of the goals you mention are incompatibe with the following
> requirement: "current applications shall continue to work without any
> change".

That's where my idea comes in. By putting additional hashes (generated by a
variety of hash algorithms) into a non-critical Certificate Extension, and by
requiring (or at least recommending) new software to check *all* of these
additional hashes, I believe that we could accomplish all of these goals.

Each certificate's signature would continue to be generated using
sha1WithRSAEncryption, allowing current applications to continue to work
without any code changes. These current applications would simply ignore the
non-critical "Additional Hashes" Certificate Extension.

If SHA-1 is ever sufficiently compromised, then we can expect attackers to
create fake certificates using sha1WithRSAEncryption signatures from valid
certificates. My hope is that new software would be able to detect and
reject these fake certificates, simply by checking all of the hashes in
the "Additional Hashes" extension.

Do you think my idea is worth considering at all?

> If the definition of a certificate had been based on CMS, the last
> requirement could have been met. However, this is not the case.

Agreed. If CMS (PKCS#7) had been used as the basis of X.509, my idea would be
completely redundant.

> Every PKI should have a Disaster Recovey Plan ready, in particular in case
> a given algorithm or key length is broken. This does not mean that this can
> only be obtained by changing the format of certificates, CRLs and so on.
>
> A few year ago (december 2001), I proposed to work on the topic and even
> drafted a document. I asked for a co-editor, but none volunteered.
>
> Should there now be an interrest, a volonteer co-editor and should a work
> item be adopted on the topic by the WG, then (and only then) I would be
> happy to re-issue the draft.
>
> The title was: Key Compromise, Rollover and Loss
>
> The abstract was:
>
> This document presents a framework to assist the writers of policy
> or practice statements and the designers of a Public Key
> Infrastructure to prepare disaster recovery plans in case of a
> private key compromise or a private key loss. This may happen to
> end-user keys, Certification Authorities, Revocation Authorities,
> Attribute Authorities, Time Stamping Authorities. Since keys do not
> last for ever, key rollover is should be planned in advance and
> some guidance is necessary. In addition, the case of the denial of
> service attacks on Repositories holding certificates and/or CRLs
> has also to be considered. The framework provides a comprehensive
> list of potential key compromise or key loss conditions that
> (at the writer's discretion) should be addressed so that it is
> possible to nicely recover from situations which normally should
> not happen, but might happen.
>
> Denis
>
> >On Wednesday 04 October 2006 16:14, Denis Pinkas wrote:
> >> Rob,
> >>
> >> Before describing a technical solution, it would be nice to explain in
> >> details what the problem you want to solve is.
> >>
> >> Denis
> >>
> >> >Hi Hoyt.
> >> >
> >> >Maybe I'm not using the word "agility" correctly. My aim was to find a
> >> > way to include *multiple* hashes (with each hash generated by a
> >> > different hash algorithm) in a *single* Certificate/CRL/etc, so that
> >> > we no longer have to rely on the strength of a single hash algorithm.
> >> >
> >> >PKCS#1 defines various AlgorithmIdentifiers for digital
> >> >signatures: "sha1WithRSAEncryption", "sha256WithRSAEncryption", etc.
> >> > Each of these is for 1 hash algorithm and 1 encryption algorithm.
> >> >PKCS#1 does not define anything like "sha1AndSha256WithRSAEncryption"
> >> > (i.e. 2 or more hash algorithms and 1 encryption algorithm).
> >> >
> >> >We could of course define new {SupportedAlgorithms} OIDs
> >> >for "sha1AndSha256WithRSAEncryption", "sha1AndSha512WithRSAEncryption",
> >> > etc, but no existing software would recognize these.
> >> >
> >> >I'm not saying that my "Additional Hashes" Extension idea is a
> >> > particularly clean solution from a purist's point of view. It would
> >> > be best if there was a way for all of the algorithm
> >> > identifiers/signatures/hashes to continue to be stored in the
> >> > "standard" X.509 places (Certificate->signature, etc).
> >> >
> >> >But the problem is...
> >> >
> >> >The definition of Certificate->signature, which we can't change, is...
> >> > signature AlgorithmIdentifier,
> >> >...rather than...
> >> > signature SEQUENCE OF
> >> > AlgorithmIdentifier,
> >> >
> >> >...and the definition of SIGNED, which we can't change, is...
> >> >SIGNED { ToBeSigned } ::= SEQUENCE {
> >> > toBeSigned ToBeSigned,
> >> > COMPONENTS OF SIGNATURE { ToBeSigned }}
> >> >...rather than something like...
> >> >SIGNED { ToBeSigned } ::= SEQUENCE {
> >> > toBeSigned ToBeSigned,
> >> > SEQUENCE OF SIGNATURE { ToBeSigned }}
> >> >
> >> >I hope this post clarifies where I was coming from with the "Advantages
> >> >(IMHO)" from my previous post.
> >> >
> >> >--
> >> >Rob Stradling
> >> >Comodo CA Limited
> >> >
> >> >On Tuesday 03 October 2006 16:49, you wrote:
> >> >> i'd consider the signature algorithm OID before I would state that
> >> >> x.509 has no algorithm agility
> >> >>
> >> >>         Certificate   ::=       SIGNED { SEQUENCE {
> >> >>         version                 [0]     Version DEFAULT v1,
> >> >>         serialNumber                    CertificateSerialNumber,
> >> >>         signature                               AlgorithmIdentifier,
> >> >>         issuer                          Name,
> >> >>         validity                                Validity,
> >> >>         subject                         Name,
> >> >>         subjectPublicKeyInfo            SubjectPublicKeyInfo,
> >> >>    issuerUniqueIdentifier  [1]     IMPLICIT UniqueIdentifier
> >> >> OPTIONAL, -- if present, version shall be v2 or v3
> >> >> subjectUniqueIdentifier [2]     IMPLICIT UniqueIdentifier OPTIONAL,
> >> >> -- if present, version shall be v2 or v3 extensions
> >> >> [3]     Extensions OPTIONAL -- If present, version shall be v3 -- }
> >> >> }
> >> >>
> >> >>         Version                 ::=             INTEGER { v1(0),
> >> >> v2(1), v3(2) } CertificateSerialNumber ::=             INTEGER
> >> >>         AlgorithmIdentifier             ::=             SEQUENCE {
> >> >>         algorithm               ALGORITHM.&id
> >> >> ({SupportedAlgorithms}), parameters   ALGORITHM.&Type
> >> >> ({SupportedAlgorithms}{ @algorithm}) OPTIONAL }
> >> >>
> >> >> I assume you meant to say that the list of OIDs for agreed
> >> >> combinations of hash algorithms, encryption algorithms, and key
> >> >> lengths needs to be expanded.
> >> >>
> >> >> Note that although 509 allows parameters to be associated with an
> >> >> algorithm OID, the practice from the days of PKCS has been that each
> >> >> OID identifies a specific combination.
> >> >>
> >> >>      hoyt
> >> >>
> >> >>
> >> >> Hi.  I'm new to this list, so please forgive me if the following idea
> >> >> has been aired before, or if better ideas are already under
> >> >> discussion...
> >> >>
> >> >> As http://www3.ietf.org/proceedings/06mar/slides/pkix-1/sld3.htm
> >> >> points out, X.509 certificates have no algorithm agility.  This
> >> >> breaks down into 3 areas: 1. A certificate only contains 1 public key
> >> >> (which will almost certainly only be useable with 1 particular
> >> >> asymmetric encryption algorithm). 2. Only 1 CA private key (and 1
> >> >> asymmetric encryption algorithm) is used to generate a certificate's
> >> >> signature.
> >> >>   3. Only 1 hash algorithm is used to generate a certificate's
> >> >> signature.
> >> >>
> >> >> I don't want to address areas 1 and 2 here, but I have an idea for
> >> >> adding some agility to area 3...
> >> >>
> >> >> I suggest that we define an "Additional Hashes" Certificate
> >> >> Extension.  This Extension would contain 1 or more hashes, generated
> >> >> using different hash algorithm(s) to the hash algorithm used in the
> >> >> generation of the certificate's signature.
> >> >> To issue a certificate, a CA would need to do something like this:
> >> >>     A. Create the "to be signed" certificate (as per the CA's
> >> >> existing process).
> >> >>     B. Generate the SHA-256 hash of the "to be signed" certificate.
> >> >>     C. Put the SHA-256 hash from Step B into an "Additional Hashes"
> >> >> extension, and add that extension to the "to be signed" certificate
> >> >> from step A. D. Sign the "to be signed" certificate from step C using
> >> >> SHA-1 as the hash algorithm for the signature.
> >> >> Relying parties would then be able to verify all (or as many as they
> >> >> can) of the hashes.  Future software could choose to reject
> >> >> certificates that don't contain an "Additional Hashes" extension with
> >> >> enough different hash algorithms represented.
> >> >>
> >> >> Advantages (IMHO):
> >> >>   - We would be able to start using SHA-256/384/512 immediately.
> >> >> :-) - Various bodies are recommending phasing out SHA-1 in the very
> >> >> near future (NIST say 2010, IIRC, but I'm sure I've also seen a
> >> >> reference to 2008).  I think that my idea might be the only approach
> >> >> that could at least "phase in" newer hash algorithms before these
> >> >> deadlines.  The "phase out" of SHA-1 would become arguably less
> >> >> urgent and could take place at a later time. - Backwards
> >> >> compatibility: new software would be able to take advantage of
> >> >> multiple hashes to enhance their security; existing software would
> >> >> continue to work as it does today (i.e. it would simply ignore the
> >> >> "Additional Hashes" extension").  This is potentially a very useful
> >> >> property, given that (IIRC) Microsoft have said that support for
> >> >> SHA-256/384/512 will be added in Windows Vista, but not backported to
> >> >> older versions of Windows.  I expect that many, many users will
> >> >> continue to use Windows 2000/XP/etc well beyond 2008/2010, and will
> >> >> be quite happy to rely on SHA-1 until such time as it is
> >> >> definitely "broken".
> >> >>   - This same idea could also be used in CRLs, OCSP Requests and
> >> >> OCSP Responses, because they can all contain Extensions.
> >> >>
> >> >> --
> >> >> Rob Stradling
> >> >> Comodo CA Limited
> >>
> >> Regards,
> >>
> >> Denis Pinkas
> >
> >--
> >Rob Stradling
> >Digital Certification and Identity Management Solutions Manager - Comodo
> >Comodo - Creating Trust Online
> >Office Tel Europe: +44 (0) 1274 730505
> >Office Tel US: +1 888 COMODO 1 (1 888 266 6361)
> >Fax Europe: +44 (0) 1274 730909
> >Fax US: +1 201 963 9003
> >www.comodo.com, www.trustix.com, www.enterprisessl.com,
> >www.contentverification.com
> >Join the online fax revolution! Send your faxes online with TrustFax
> >www.TrustFax.com !
> >
> >This e-mail and any files transmitted with it are confidential and
> > intended solely for the use of the individual or entity to whom they are
> > addressed. If you have received this email in error please notify the
> > sender by replying to the e-mail containing this attachment. Replies to
> > this email may be monitored by Comodo for operational or business
> > reasons. Whilst every endeavour is taken to ensure that e-mails are free
> > from viruses, no liability can be accepted and the recipient is requested
> > to use their own virus checking software.
>
> Regards,
>
> Denis Pinkas

--
Rob Stradling
Digital Certification and Identity Management Solutions Manager - Comodo
Comodo - Creating Trust Online
Office Tel Europe: +44 (0) 1274 730505
Office Tel US: +1 888 COMODO 1 (1 888 266 6361)
Fax Europe: +44 (0) 1274 730909
Fax US: +1 201 963 9003
www.comodo.com, www.trustix.com, www.enterprisessl.com,
www.contentverification.com
Join the online fax revolution! Send your faxes online with TrustFax
www.TrustFax.com !

This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender by replying
to the e-mail containing this attachment. Replies to this email may be
monitored by Comodo for operational or business reasons. Whilst every
endeavour is taken to ensure that e-mails are free from viruses, no liability
can be accepted and the recipient is requested to use their own virus checking
software.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96Basdt032722; Fri, 6 Oct 2006 04:36:54 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k96BasMS032721; Fri, 6 Oct 2006 04:36:54 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from brendan.brad.office.comodo.net (brad.comodogroup.com [82.109.38.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k96BapWl032708 for ; Fri, 6 Oct 2006 04:36:53 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 21270 invoked by uid 1000); 6 Oct 2006 12:36:48 +0100
Received: from Unknown (HELO nigel.comodo.net) (192.168.0.58) by brendan.brad.office.comodo.net (qpsmtpd/0.31.1) with ESMTP; Fri, 06 Oct 2006 12:36:48 +0100
From: Rob Stradling
Organization: Comodo CA Limited
To: Paul Hoffman
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Fri, 6 Oct 2006 12:36:45 +0100
User-Agent: KMail/1.9.1
Cc: "[email-masked]"
References: <[email-masked]>
In-Reply-To:
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <[email-masked]>
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

On Thursday 05 October 2006 20:19, Paul Hoffman wrote:
> At 4:24 PM +0100 10/5/06, Rob Stradling wrote:
> >Most currently valid X.509 certificates rely on the SHA-1 algorithm.
> > If/when SHA-1 gets sufficiently "broken", the signatures on those
> > certificates will become worthless. Some experts believe that SHA-1
> > might get broken really quite soon.
>
> Sorry, but this is silly FUD. Please name one "expert" who believes
> that.

Sorry Paul. I completely withdraw my comments on how "broken" SHA-1 is, might
soon be, or might ever be. I am not an "expert" cryptographer. I guess I
was basing my comments on other peoples' FUD and my own assumptions /
lack-of-understanding. Please accept my apologies.

> None of the "experts" with whom I spoke at the second NIST hash
> workshop about a month ago expressed any such belief, and many of
> them said the opposite.

I'm very glad to hear this. :-)

> So far, the attacks on SHA-1 have been to reduce the collision
> resistance. No one has shown useful attacks on PKIX certs that can
> use the current attack methods, even if they get much better.

I hadn't fully appreciated this before. Thanks.

> Everyone agrees that if the pre-image resistance of SHA-1 were to
> weaken to be within the work effort of an attacker, things would be
> quite grim for PKIX certificates. There have been literally zero
> published attacks that even suggest this is possible.

My purpose in starting this thread was definitely not to inadvertently spread
FUD, but rather to propose a solution to a "quite grim" problem that *might*
arise at some point in the future.
My proposed solution could be introduced without breaking compatibility with
existing software (although existing software would not see any benefit),
unlike all other proposed solutions I've seen. This "backwards
compatibility" angle is the primary reason I started this thread, because I
thought there was some merit to it.

If SHA-1 will *definitely* remain suitable for digital signatures until such
time as there is widespread support for SHA-256/512/etc, then my idea is
arguably redundant.
But unless we can say "definitely", then I still think that my idea is worth
considering.

> --Paul Hoffman, Director
> --VPN Consortium

--
Rob Stradling
Digital Certification and Identity Management Solutions Manager - Comodo
Comodo - Creating Trust Online
Office Tel Europe: +44 (0) 1274 730505
Office Tel US: +1 888 COMODO 1 (1 888 266 6361)
Fax Europe: +44 (0) 1274 730909
Fax US: +1 201 963 9003
www.comodo.com, www.trustix.com, www.enterprisessl.com,
www.contentverification.com
Join the online fax revolution! Send your faxes online with TrustFax
www.TrustFax.com !

This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender by replying
to the e-mail containing this attachment. Replies to this email may be
monitored by Comodo for operational or business reasons. Whilst every
endeavour is taken to ensure that e-mails are free from viruses, no liability
can be accepted and the recipient is requested to use their own virus checking
software.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k961kZnu078287; Thu, 5 Oct 2006 18:46:35 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k961kZ8a078286; Thu, 5 Oct 2006 18:46:35 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from [10.20.30.177] (dsl-63-249-108-169.cruzio.com [63.249.108.169]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k961kXcN078279 for ; Thu, 5 Oct 2006 18:46:34 -0700 (MST) (envelope-from [email-masked])
Mime-Version: 1.0
Message-Id:
In-Reply-To:
References:
Date: Thu, 5 Oct 2006 18:46:29 -0700
To:
From: Paul Hoffman
Subject: RE: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

At 4:50 PM -0800 10/5/06, Michael Myers wrote:
>What I am reading is:
>
>1) These vulnerabilities continue to be theoretical;
>
>2) Modification to extant standards impacts the
> installed base for no apparent value; and thus
>
>3) Until or unless theory proves true, let us not
> as a standards body change the status quo.
>
>A fair reading?

Kind of, but missing some important points.

1) There are no known practical attacks on PKIX certificates based on
collision-reduction attacks on hashes;

2) Modification to extant standards impacts the installed base and
therefore should, if undertaken, get the most long-term value for the
least disruption (yes, that is weighing two orthogonal and
unmeasurable quantities...); and thus

3) Until or unless practical attacks can be specified, implement the
things with essentially-zero costs and continue to try to measure and
weigh long-term value and cost of disruption.

That's more long-winded, but over-simplifying could easily cause us
to lurch or do too little.

--Paul Hoffman, Director
--VPN Consortium

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k961QsfG076498; Thu, 5 Oct 2006 18:26:54 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k961QsSl076497; Thu, 5 Oct 2006 18:26:54 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mailout.fastq.com (mailout.fastq.com [204.62.193.66]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k961Qrin076488 for ; Thu, 5 Oct 2006 18:26:54 -0700 (MST) (envelope-from [email-masked])
Received: from mmyerslaptop (dslstat-bvi4-403.fastq.com [65.39.91.150]) by mailout.fastq.com (8.11.6-2003091800/8.11.3.FastQ-MailOut) with SMTP id k961QqN61900; Thu, 5 Oct 2006 18:26:52 -0700 (MST) (envelope-from [email-masked])
From: "Michael Myers"
To: "Paul Hoffman" ,
Subject: RE: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Thu, 5 Oct 2006 16:50:20 -0800
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
In-Reply-To:
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
Importance: Normal
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Paul,

What I am reading is:

1) These vulnerabilities continue to be theoretical;

2) Modification to extant standards impacts the
installed base for no apparent value; and thus

3) Until or unless theory proves true, let us not
as a standards body change the status quo.

A fair reading?

Mike

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Paul Hoffman
Sent: Thursday, October 05, 2006 1:45 PM
To: Michael Myers; [email-masked]
Subject: RE: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions

At 11:27 AM -0800 10/5/06, Michael Myers wrote:
>Is it then your opinion that we should not take action with respect this
>thread's subject?

Not at all. However, it is unclear what action we should take in
light of the recent attacks on the collision-resistance of popular
hash functions. Four major routes that have been proposed are:

- to allow more than one hash algorithm (as proposed at the beginning
of the thread)
- to use different signing algorithms that are immune to collision attacks
- to use a different hash function that is provably collision-resistant
- to do nothing but to encourage CAs to add randomness to their
serial numbers to make collision attacks infeasible

Each proposal has its own value; each has its own cost. The first,
second, and third require major retooling of the I part of PKI. The
first is PKIX-specific; the second and third could be used in other
protocols such as S/MIME. The third will require a fair amount of
cryptographic research and publishing. The fourth costs nothing for
retooling PKIX receivers and only a trivial amount for CAs, but it
doesn't feel substantial.

Given that there are no viable attacks today, we might go with the
least-cost option (the fourth) but consider the other three for the
future.

--Paul Hoffman, Director
--VPN Consortium

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95LkkoH059834; Thu, 5 Oct 2006 14:46:46 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95LkkDb059833; Thu, 5 Oct 2006 14:46:46 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from [10.20.30.177] (dsl-63-249-108-169.cruzio.com [63.249.108.169]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95LkBBG059785; Thu, 5 Oct 2006 14:46:12 -0700 (MST) (envelope-from [email-masked])
Mime-Version: 1.0
Message-Id:
In-Reply-To:
References:
Date: Thu, 5 Oct 2006 14:45:20 -0700
To: "Michael Myers" ,
From: Paul Hoffman
Subject: RE: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

At 11:27 AM -0800 10/5/06, Michael Myers wrote:
>Is it then your opinion that we should not take action with respect this
>thread's subject?

Not at all. However, it is unclear what action we should take in
light of the recent attacks on the collision-resistance of popular
hash functions. Four major routes that have been proposed are:

- to allow more than one hash algorithm (as proposed at the beginning
of the thread)
- to use different signing algorithms that are immune to collision attacks
- to use a different hash function that is provably collision-resistant
- to do nothing but to encourage CAs to add randomness to their
serial numbers to make collision attacks infeasible

Each proposal has its own value; each has its own cost. The first,
second, and third require major retooling of the I part of PKI. The
first is PKIX-specific; the second and third could be used in other
protocols such as S/MIME. The third will require a fair amount of
cryptographic research and publishing. The fourth costs nothing for
retooling PKIX receivers and only a trivial amount for CAs, but it
doesn't feel substantial.

Given that there are no viable attacks today, we might go with the
least-cost option (the fourth) but consider the other three for the
future.

--Paul Hoffman, Director
--VPN Consortium

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95K4Vk8050024; Thu, 5 Oct 2006 13:04:31 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95K4ViN050023; Thu, 5 Oct 2006 13:04:31 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mailout.fastq.com (mailout.fastq.com [204.62.193.66]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95K4Uft050015 for ; Thu, 5 Oct 2006 13:04:30 -0700 (MST) (envelope-from [email-masked])
Received: from mmyerslaptop (dslstat-bvi4-403.fastq.com [65.39.91.150]) by mailout.fastq.com (8.11.6-2003091800/8.11.3.FastQ-MailOut) with SMTP id k95K4SN32019; Thu, 5 Oct 2006 13:04:28 -0700 (MST) (envelope-from [email-masked])
From: "Michael Myers"
To: "Paul Hoffman" ,
Subject: RE: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Thu, 5 Oct 2006 11:27:57 -0800
Message-ID:
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
In-Reply-To:
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Paul,

Is it then your opinion that we should not take action with respect this
thread's subject? In particular amending RFC2560, as I had some time ago
proposed.

Mike

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Paul Hoffman
Sent: Thursday, October 05, 2006 11:19 AM
To: [email-masked]
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions

At 4:24 PM +0100 10/5/06, Rob Stradling wrote:

>Most currently valid X.509 certificates rely on the SHA-1 algorithm.
If/when
>SHA-1 gets sufficiently "broken", the signatures on those certificates will
>become worthless. Some experts believe that SHA-1 might get broken really
>quite soon.

Sorry, but this is silly FUD. Please name one "expert" who believes
that. None of the "experts" with whom I spoke at the second NIST hash
workshop about a month ago expressed any such belief, and many of
them said the opposite.

So far, the attacks on SHA-1 have been to reduce the collision
resistance. No one has shown useful attacks on PKIX certs that can
use the current attack methods, even if they get much better.

Everyone agrees that if the pre-image resistance of SHA-1 were to
weaken to be within the work effort of an attacker, things would be
quite grim for PKIX certificates. There have been literally zero
published attacks that even suggest this is possible.

--Paul Hoffman, Director
--VPN Consortium

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95JJMQ2044636; Thu, 5 Oct 2006 12:19:22 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95JJMql044632; Thu, 5 Oct 2006 12:19:22 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from [10.20.30.177] (dsl-63-249-108-169.cruzio.com [63.249.108.169]) (authenticated bits=0) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95JJL9F044604 for ; Thu, 5 Oct 2006 12:19:21 -0700 (MST) (envelope-from [email-masked])
Mime-Version: 1.0
Message-Id:
In-Reply-To: <[email-masked]>
References: <[email-masked]>
Date: Thu, 5 Oct 2006 12:19:17 -0700
To: "[email-masked]"
From: Paul Hoffman
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

At 4:24 PM +0100 10/5/06, Rob Stradling wrote:

>Most currently valid X.509 certificates rely on the SHA-1 algorithm. If/when
>SHA-1 gets sufficiently "broken", the signatures on those certificates will
>become worthless. Some experts believe that SHA-1 might get broken really
>quite soon.

Sorry, but this is silly FUD. Please name one "expert" who believes
that. None of the "experts" with whom I spoke at the second NIST hash
workshop about a month ago expressed any such belief, and many of
them said the opposite.

So far, the attacks on SHA-1 have been to reduce the collision
resistance. No one has shown useful attacks on PKIX certs that can
use the current attack methods, even if they get much better.

Everyone agrees that if the pre-image resistance of SHA-1 were to
weaken to be within the work effort of an attacker, things would be
quite grim for PKIX certificates. There have been literally zero
published attacks that even suggest this is possible.

--Paul Hoffman, Director
--VPN Consortium

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95IchmA040682; Thu, 5 Oct 2006 11:38:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95IchOK040681; Thu, 5 Oct 2006 11:38:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from igw (adsl-63-194-79-229.dsl.snfc21.pacbell.net [63.194.79.229]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95IcenY040671 for ; Thu, 5 Oct 2006 11:38:41 -0700 (MST) (envelope-from [email-masked])
Received: from [10.0.4.10] ([69.232.142.170]) by igw.noorhome.net (iPlanet Messaging Server 5.2 Patch 1 (built Aug 19 2002)) with ESMTPSA id <[email-masked]> for [email-masked]; Thu, 05 Oct 2006 10:55:07 -0700 (PDT)
Date: Thu, 05 Oct 2006 11:39:20 -0700
From: Arshad Noor
Subject: Key Compromise, Rollover and Loss (was Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions)
In-reply-to:
To: Denis Pinkas
Cc: "[email-masked]"
Message-id: <[email-masked]>
Organization: StrongAuth, Inc.
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7BIT
X-Accept-Language: en-us, en
User-Agent: Mozilla Thunderbird 1.0.7 (X11/20050923)
References:
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Denis,

I will volunteer to be your co-editor on this topic; please
contact me off-line to discuss this. Thanks.

Arshad Noor
StrongAuth, Inc.

Denis Pinkas wrote:
>
> A few year ago (december 2001), I proposed to work on the topic and even drafted a document.
> I asked for a co-editor, but none volunteered.
>
> Should there now be an interrest, a volonteer co-editor and should a work item be adopted on the topic
> by the WG, then (and only then) I would be happy to re-issue the draft.
>
> The title was: Key Compromise, Rollover and Loss
>
> The abstract was:
>
> This document presents a framework to assist the writers of policy
> or practice statements and the designers of a Public Key
> Infrastructure to prepare disaster recovery plans in case of a
> private key compromise or a private key loss. This may happen to
> end-user keys, Certification Authorities, Revocation Authorities,
> Attribute Authorities, Time Stamping Authorities. Since keys do not
> last for ever, key rollover is should be planned in advance and
> some guidance is necessary. In addition, the case of the denial of
> service attacks on Repositories holding certificates and/or CRLs
> has also to be considered. The framework provides a comprehensive
> list of potential key compromise or key loss conditions that
> (at the writer's discretion) should be addressed so that it is
> possible to nicely recover from situations which normally should
> not happen, but might happen.
>

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95FuRUM021382; Thu, 5 Oct 2006 08:56:27 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95FuRrl021381; Thu, 5 Oct 2006 08:56:27 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95FuPr5021374 for ; Thu, 5 Oct 2006 08:56:26 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-mcl1.frcl.bull.fr [129.184.87.20]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id RAA11698; Thu, 5 Oct 2006 17:58:02 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006100517555114:55924 ; Thu, 5 Oct 2006 17:55:51 +0200
Date: Thu, 5 Oct 2006 17:55:48 +0200
From: "Denis Pinkas"
To: "Rob Stradling"
Cc: "[email-masked]"
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 05/10/2006 17:55:51, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 05/10/2006 17:55:53, Serialize complete at 05/10/2006 17:55:53
Message-ID:
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by balder-227.proper.com id k95FuRr5021376
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

>Hi Denis. I'll try again... :-)

Thanks for the explanations.

>Most currently valid X.509 certificates rely on the SHA-1 algorithm. If/when
>SHA-1 gets sufficiently "broken", the signatures on those certificates will
>become worthless. Some experts believe that SHA-1 might get broken really
>quite soon.

>X.509 allows us to stop using SHA-1 and start using SHA-256 (or SHA-384, or
>SHA-512, etc) instead. However, if we were to do this today, most existing
>software (including all versions of Windows prior to Vista...which isn't even
>launched yet) would not be able to verify the signatures on the certificates
>at all.

>I want to be able to do *all* of the following (in no particular order)...
> 1. Start using SHA-256/384/512/etc in X.509 certificates ASAP, so that the
>latest software can take advantage of these (hopefully) more secure hash
>algorithms.
> 2. Avoid keeping SHA-1 as a single point of failure until such time as there
>is widespread support for SHA-256/384/512/etc.
> 3. Stop having to rely on any single hash algorithm when verifying the
>signature of an X.509 Certificate.

>I hope this explains my aims more clearly.

Some of the goals you mention are incompatibe with the following requirement:
"current applications shall continue to work without any change".

If the definition of a certificate had been based on CMS, the last requirement
could have been met. However, this is not the case.

Every PKI should have a Disaster Recovey Plan ready, in particular in case
a given algorithm or key length is broken. This does not mean that this can only be obtained
by changing the format of certificates, CRLs and so on.

A few year ago (december 2001), I proposed to work on the topic and even drafted a document.
I asked for a co-editor, but none volunteered.

Should there now be an interrest, a volonteer co-editor and should a work item be adopted on the topic
by the WG, then (and only then) I would be happy to re-issue the draft.

The title was: Key Compromise, Rollover and Loss

The abstract was:

This document presents a framework to assist the writers of policy
or practice statements and the designers of a Public Key
Infrastructure to prepare disaster recovery plans in case of a
private key compromise or a private key loss. This may happen to
end-user keys, Certification Authorities, Revocation Authorities,
Attribute Authorities, Time Stamping Authorities. Since keys do not
last for ever, key rollover is should be planned in advance and
some guidance is necessary. In addition, the case of the denial of
service attacks on Repositories holding certificates and/or CRLs
has also to be considered. The framework provides a comprehensive
list of potential key compromise or key loss conditions that
(at the writer's discretion) should be addressed so that it is
possible to nicely recover from situations which normally should
not happen, but might happen.

Denis

>
>On Wednesday 04 October 2006 16:14, Denis Pinkas wrote:
>> Rob,
>>
>> Before describing a technical solution, it would be nice to explain in
>> details what the problem you want to solve is.
>>
>> Denis
>>
>> >Hi Hoyt.
>> >
>> >Maybe I'm not using the word "agility" correctly. My aim was to find a
>> > way to include *multiple* hashes (with each hash generated by a different
>> > hash algorithm) in a *single* Certificate/CRL/etc, so that we no longer
>> > have to rely on the strength of a single hash algorithm.
>> >
>> >PKCS#1 defines various AlgorithmIdentifiers for digital
>> >signatures: "sha1WithRSAEncryption", "sha256WithRSAEncryption", etc. Each
>> > of these is for 1 hash algorithm and 1 encryption algorithm.
>> >PKCS#1 does not define anything like "sha1AndSha256WithRSAEncryption"
>> > (i.e. 2 or more hash algorithms and 1 encryption algorithm).
>> >
>> >We could of course define new {SupportedAlgorithms} OIDs
>> >for "sha1AndSha256WithRSAEncryption", "sha1AndSha512WithRSAEncryption",
>> > etc, but no existing software would recognize these.
>> >
>> >I'm not saying that my "Additional Hashes" Extension idea is a
>> > particularly clean solution from a purist's point of view. It would be
>> > best if there was a way for all of the algorithm
>> > identifiers/signatures/hashes to continue to be stored in the "standard"
>> > X.509 places (Certificate->signature, etc).
>> >
>> >But the problem is...
>> >
>> >The definition of Certificate->signature, which we can't change, is...
>> > signature AlgorithmIdentifier,
>> >...rather than...
>> > signature SEQUENCE OF
>> > AlgorithmIdentifier,
>> >
>> >...and the definition of SIGNED, which we can't change, is...
>> >SIGNED { ToBeSigned } ::= SEQUENCE {
>> > toBeSigned ToBeSigned,
>> > COMPONENTS OF SIGNATURE { ToBeSigned }}
>> >...rather than something like...
>> >SIGNED { ToBeSigned } ::= SEQUENCE {
>> > toBeSigned ToBeSigned,
>> > SEQUENCE OF SIGNATURE { ToBeSigned }}
>> >
>> >I hope this post clarifies where I was coming from with the "Advantages
>> >(IMHO)" from my previous post.
>> >
>> >--
>> >Rob Stradling
>> >Comodo CA Limited
>> >
>> >On Tuesday 03 October 2006 16:49, you wrote:
>> >> i'd consider the signature algorithm OID before I would state that x.509
>> >> has no algorithm agility
>> >>
>> >>         Certificate   ::=       SIGNED { SEQUENCE {
>> >>         version                 [0]     Version DEFAULT v1,
>> >>         serialNumber                    CertificateSerialNumber,
>> >>         signature                               AlgorithmIdentifier,
>> >>         issuer                          Name,
>> >>         validity                                Validity,
>> >>         subject                         Name,
>> >>         subjectPublicKeyInfo            SubjectPublicKeyInfo,
>> >>    issuerUniqueIdentifier  [1]     IMPLICIT UniqueIdentifier OPTIONAL,
>> >>
>> >>         -- if present, version shall be v2 or v3 subjectUniqueIdentifier
>> >> [2]     IMPLICIT UniqueIdentifier OPTIONAL, -- if present, version shall
>> >> be v2 or v3 extensions              [3]     Extensions OPTIONAL
>> >>
>> >>         -- If present, version shall be v3 -- } }
>> >>
>> >>         Version                 ::=             INTEGER { v1(0), v2(1),
>> >> v3(2) } CertificateSerialNumber ::=             INTEGER
>> >>         AlgorithmIdentifier             ::=             SEQUENCE {
>> >>         algorithm               ALGORITHM.&id ({SupportedAlgorithms}),
>> >>         parameters   ALGORITHM.&Type ({SupportedAlgorithms}{
>> >> @algorithm}) OPTIONAL }
>> >>
>> >> I assume you meant to say that the list of OIDs for agreed combinations
>> >> of hash algorithms, encryption algorithms, and key lengths needs to be
>> >> expanded.
>> >>
>> >> Note that although 509 allows parameters to be associated with an
>> >> algorithm OID, the practice from the days of PKCS has been that each OID
>> >> identifies a specific combination.
>> >>
>> >>      hoyt
>> >>
>> >>
>> >> Hi.  I'm new to this list, so please forgive me if the following idea
>> >> has been aired before, or if better ideas are already under
>> >> discussion...
>> >>
>> >> As http://www3.ietf.org/proceedings/06mar/slides/pkix-1/sld3.htm points
>> >> out, X.509 certificates have no algorithm agility.  This breaks down
>> >> into 3 areas: 1. A certificate only contains 1 public key (which will
>> >> almost certainly only be useable with 1 particular asymmetric encryption
>> >> algorithm). 2. Only 1 CA private key (and 1 asymmetric encryption
>> >> algorithm) is used to generate a certificate's signature.
>> >>   3. Only 1 hash algorithm is used to generate a certificate's
>> >> signature.
>> >>
>> >> I don't want to address areas 1 and 2 here, but I have an idea for
>> >> adding some agility to area 3...
>> >>
>> >> I suggest that we define an "Additional Hashes" Certificate Extension.
>> >> This Extension would contain 1 or more hashes, generated using different
>> >> hash algorithm(s) to the hash algorithm used in the generation of the
>> >> certificate's signature.
>> >> To issue a certificate, a CA would need to do something like this:
>> >>     A. Create the "to be signed" certificate (as per the CA's existing
>> >> process).
>> >>     B. Generate the SHA-256 hash of the "to be signed" certificate.
>> >>     C. Put the SHA-256 hash from Step B into an "Additional Hashes"
>> >> extension, and add that extension to the "to be signed" certificate from
>> >> step A. D. Sign the "to be signed" certificate from step C using SHA-1
>> >> as the hash algorithm for the signature.
>> >> Relying parties would then be able to verify all (or as many as they
>> >> can) of the hashes.  Future software could choose to reject certificates
>> >> that don't contain an "Additional Hashes" extension with enough
>> >> different hash algorithms represented.
>> >>
>> >> Advantages (IMHO):
>> >>   - We would be able to start using SHA-256/384/512 immediately.  :-)
>> >>   - Various bodies are recommending phasing out SHA-1 in the very near
>> >> future (NIST say 2010, IIRC, but I'm sure I've also seen a reference to
>> >> 2008).  I think that my idea might be the only approach that could at
>> >> least "phase in" newer hash algorithms before these deadlines.  The
>> >> "phase out" of SHA-1 would become arguably less urgent and could take
>> >> place at a later time. - Backwards compatibility: new software would be
>> >> able to take advantage of multiple hashes to enhance their security;
>> >> existing software would continue to work as it does today (i.e. it would
>> >> simply ignore the "Additional Hashes" extension").  This is potentially
>> >> a very useful property, given that (IIRC) Microsoft have said that
>> >> support for SHA-256/384/512 will be added in Windows Vista, but not
>> >> backported to older versions of Windows.  I expect that many, many users
>> >> will continue to use Windows 2000/XP/etc well beyond 2008/2010, and will
>> >> be quite happy to rely on SHA-1 until such time as it is
>> >> definitely "broken".
>> >>   - This same idea could also be used in CRLs, OCSP Requests and OCSP
>> >> Responses, because they can all contain Extensions.
>> >>
>> >> --
>> >> Rob Stradling
>> >> Comodo CA Limited
>>
>> Regards,
>>
>> Denis Pinkas
>
>--
>Rob Stradling
>Digital Certification and Identity Management Solutions Manager - Comodo
>Comodo - Creating Trust Online
>Office Tel Europe: +44 (0) 1274 730505
>Office Tel US: +1 888 COMODO 1 (1 888 266 6361)
>Fax Europe: +44 (0) 1274 730909
>Fax US: +1 201 963 9003
>www.comodo.com, www.trustix.com, www.enterprisessl.com,
>www.contentverification.com
>Join the online fax revolution! Send your faxes online with TrustFax
>www.TrustFax.com !
>
>This e-mail and any files transmitted with it are confidential and intended
>solely for the use of the individual or entity to whom they are addressed.
>If you have received this email in error please notify the sender by replying
>to the e-mail containing this attachment. Replies to this email may be
>monitored by Comodo for operational or business reasons. Whilst every
>endeavour is taken to ensure that e-mails are free from viruses, no liability
>can be accepted and the recipient is requested to use their own virus checking
>software.

Regards,

Denis Pinkas

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95FOrQR017840; Thu, 5 Oct 2006 08:24:53 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95FOrJp017839; Thu, 5 Oct 2006 08:24:53 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from brendan.brad.office.comodo.net (brad.comodogroup.com [82.109.38.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95FOlvS017828 for ; Thu, 5 Oct 2006 08:24:48 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 30585 invoked by uid 1000); 5 Oct 2006 16:24:45 +0100
Received: from Unknown (HELO nigel.comodo.net) (192.168.0.58) by brendan.brad.office.comodo.net (qpsmtpd/0.31.1) with ESMTP; Thu, 05 Oct 2006 16:24:45 +0100
From: Rob Stradling
Organization: Comodo CA Limited
To: "Denis Pinkas"
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Thu, 5 Oct 2006 16:24:43 +0100
User-Agent: KMail/1.9.1
Cc: "[email-masked]"
References:
In-Reply-To:
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Message-Id: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k95FOovS017831
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Denis. I'll try again... :-)

Most currently valid X.509 certificates rely on the SHA-1 algorithm. If/when
SHA-1 gets sufficiently "broken", the signatures on those certificates will
become worthless. Some experts believe that SHA-1 might get broken really
quite soon.
X.509 allows us to stop using SHA-1 and start using SHA-256 (or SHA-384, or
SHA-512, etc) instead. However, if we were to do this today, most existing
software (including all versions of Windows prior to Vista...which isn't even
launched yet) would not be able to verify the signatures on the certificates
at all.

I want to be able to do *all* of the following (in no particular order)...
1. Start using SHA-256/384/512/etc in X.509 certificates ASAP, so that the
latest software can take advantage of these (hopefully) more secure hash
algorithms.
2. Avoid keeping SHA-1 as a single point of failure until such time as there
is widespread support for SHA-256/384/512/etc.
3. Stop having to rely on any single hash algorithm when verifying the
signature of an X.509 Certificate.

I hope this explains my aims more clearly.

On Wednesday 04 October 2006 16:14, Denis Pinkas wrote:
> Rob,
>
> Before describing a technical solution, it would be nice to explain in
> details what the problem you want to solve is.
>
> Denis
>
> >Hi Hoyt.
> >
> >Maybe I'm not using the word "agility" correctly. My aim was to find a
> > way to include *multiple* hashes (with each hash generated by a different
> > hash algorithm) in a *single* Certificate/CRL/etc, so that we no longer
> > have to rely on the strength of a single hash algorithm.
> >
> >PKCS#1 defines various AlgorithmIdentifiers for digital
> >signatures: "sha1WithRSAEncryption", "sha256WithRSAEncryption", etc. Each
> > of these is for 1 hash algorithm and 1 encryption algorithm.
> >PKCS#1 does not define anything like "sha1AndSha256WithRSAEncryption"
> > (i.e. 2 or more hash algorithms and 1 encryption algorithm).
> >
> >We could of course define new {SupportedAlgorithms} OIDs
> >for "sha1AndSha256WithRSAEncryption", "sha1AndSha512WithRSAEncryption",
> > etc, but no existing software would recognize these.
> >
> >I'm not saying that my "Additional Hashes" Extension idea is a
> > particularly clean solution from a purist's point of view. It would be
> > best if there was a way for all of the algorithm
> > identifiers/signatures/hashes to continue to be stored in the "standard"
> > X.509 places (Certificate->signature, etc).
> >
> >But the problem is...
> >
> >The definition of Certificate->signature, which we can't change, is...
> > signature AlgorithmIdentifier,
> >...rather than...
> > signature SEQUENCE OF
> > AlgorithmIdentifier,
> >
> >...and the definition of SIGNED, which we can't change, is...
> >SIGNED { ToBeSigned } ::= SEQUENCE {
> > toBeSigned ToBeSigned,
> > COMPONENTS OF SIGNATURE { ToBeSigned }}
> >...rather than something like...
> >SIGNED { ToBeSigned } ::= SEQUENCE {
> > toBeSigned ToBeSigned,
> > SEQUENCE OF SIGNATURE { ToBeSigned }}
> >
> >I hope this post clarifies where I was coming from with the "Advantages
> >(IMHO)" from my previous post.
> >
> >--
> >Rob Stradling
> >Comodo CA Limited
> >
> >On Tuesday 03 October 2006 16:49, you wrote:
> >> i'd consider the signature algorithm OID before I would state that x.509
> >> has no algorithm agility
> >>
> >>         Certificate   ::=       SIGNED { SEQUENCE {
> >>         version                 [0]     Version DEFAULT v1,
> >>         serialNumber                    CertificateSerialNumber,
> >>         signature                               AlgorithmIdentifier,
> >>         issuer                          Name,
> >>         validity                                Validity,
> >>         subject                         Name,
> >>         subjectPublicKeyInfo            SubjectPublicKeyInfo,
> >>    issuerUniqueIdentifier  [1]     IMPLICIT UniqueIdentifier OPTIONAL,
> >>
> >>         -- if present, version shall be v2 or v3 subjectUniqueIdentifier
> >> [2]     IMPLICIT UniqueIdentifier OPTIONAL, -- if present, version shall
> >> be v2 or v3 extensions              [3]     Extensions OPTIONAL
> >>
> >>         -- If present, version shall be v3 -- } }
> >>
> >>         Version                 ::=             INTEGER { v1(0), v2(1),
> >> v3(2) } CertificateSerialNumber ::=             INTEGER
> >>         AlgorithmIdentifier             ::=             SEQUENCE {
> >>         algorithm               ALGORITHM.&id ({SupportedAlgorithms}),
> >>         parameters   ALGORITHM.&Type ({SupportedAlgorithms}{
> >> @algorithm}) OPTIONAL }
> >>
> >> I assume you meant to say that the list of OIDs for agreed combinations
> >> of hash algorithms, encryption algorithms, and key lengths needs to be
> >> expanded.
> >>
> >> Note that although 509 allows parameters to be associated with an
> >> algorithm OID, the practice from the days of PKCS has been that each OID
> >> identifies a specific combination.
> >>
> >>      hoyt
> >>
> >>
> >> Hi.  I'm new to this list, so please forgive me if the following idea
> >> has been aired before, or if better ideas are already under
> >> discussion...
> >>
> >> As http://www3.ietf.org/proceedings/06mar/slides/pkix-1/sld3.htm points
> >> out, X.509 certificates have no algorithm agility.  This breaks down
> >> into 3 areas: 1. A certificate only contains 1 public key (which will
> >> almost certainly only be useable with 1 particular asymmetric encryption
> >> algorithm). 2. Only 1 CA private key (and 1 asymmetric encryption
> >> algorithm) is used to generate a certificate's signature.
> >>   3. Only 1 hash algorithm is used to generate a certificate's
> >> signature.
> >>
> >> I don't want to address areas 1 and 2 here, but I have an idea for
> >> adding some agility to area 3...
> >>
> >> I suggest that we define an "Additional Hashes" Certificate Extension.
> >> This Extension would contain 1 or more hashes, generated using different
> >> hash algorithm(s) to the hash algorithm used in the generation of the
> >> certificate's signature.
> >> To issue a certificate, a CA would need to do something like this:
> >>     A. Create the "to be signed" certificate (as per the CA's existing
> >> process).
> >>     B. Generate the SHA-256 hash of the "to be signed" certificate.
> >>     C. Put the SHA-256 hash from Step B into an "Additional Hashes"
> >> extension, and add that extension to the "to be signed" certificate from
> >> step A. D. Sign the "to be signed" certificate from step C using SHA-1
> >> as the hash algorithm for the signature.
> >> Relying parties would then be able to verify all (or as many as they
> >> can) of the hashes.  Future software could choose to reject certificates
> >> that don't contain an "Additional Hashes" extension with enough
> >> different hash algorithms represented.
> >>
> >> Advantages (IMHO):
> >>   - We would be able to start using SHA-256/384/512 immediately.  :-)
> >>   - Various bodies are recommending phasing out SHA-1 in the very near
> >> future (NIST say 2010, IIRC, but I'm sure I've also seen a reference to
> >> 2008).  I think that my idea might be the only approach that could at
> >> least "phase in" newer hash algorithms before these deadlines.  The
> >> "phase out" of SHA-1 would become arguably less urgent and could take
> >> place at a later time. - Backwards compatibility: new software would be
> >> able to take advantage of multiple hashes to enhance their security;
> >> existing software would continue to work as it does today (i.e. it would
> >> simply ignore the "Additional Hashes" extension").  This is potentially
> >> a very useful property, given that (IIRC) Microsoft have said that
> >> support for SHA-256/384/512 will be added in Windows Vista, but not
> >> backported to older versions of Windows.  I expect that many, many users
> >> will continue to use Windows 2000/XP/etc well beyond 2008/2010, and will
> >> be quite happy to rely on SHA-1 until such time as it is
> >> definitely "broken".
> >>   - This same idea could also be used in CRLs, OCSP Requests and OCSP
> >> Responses, because they can all contain Extensions.
> >>
> >> --
> >> Rob Stradling
> >> Comodo CA Limited
>
> Regards,
>
> Denis Pinkas

--
Rob Stradling
Digital Certification and Identity Management Solutions Manager - Comodo
Comodo - Creating Trust Online
Office Tel Europe: +44 (0) 1274 730505
Office Tel US: +1 888 COMODO 1 (1 888 266 6361)
Fax Europe: +44 (0) 1274 730909
Fax US: +1 201 963 9003
www.comodo.com, www.trustix.com, www.enterprisessl.com,
www.contentverification.com
Join the online fax revolution! Send your faxes online with TrustFax
www.TrustFax.com !

This e-mail and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify the sender by replying
to the e-mail containing this attachment. Replies to this email may be
monitored by Comodo for operational or business reasons. Whilst every
endeavour is taken to ensure that e-mails are free from viruses, no liability
can be accepted and the recipient is requested to use their own virus checking
software.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95CeYQj098642; Thu, 5 Oct 2006 05:40:34 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k95CeYnS098641; Thu, 5 Oct 2006 05:40:34 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail-eur1.microsoft.com (mail-eur1.microsoft.com [213.199.128.139]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k95CeUmq098630 for ; Thu, 5 Oct 2006 05:40:33 -0700 (MST) (envelope-from [email-masked])
Received: from EUR-MSG-11.europe.corp.microsoft.com ([65.53.193.197]) by mail-eur1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 5 Oct 2006 13:40:09 +0100
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C6E87B.61591F7F"
Subject: REMINDER RE: Call for agenda items for pkix at IETF-67
Date: Thu, 5 Oct 2006 13:40:01 +0100
Message-ID:
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: REMINDER RE: Call for agenda items for pkix at IETF-67
Thread-Index: AcbjbMMZDt1ozeF1S/efy1JHatGZcgFCpCLA
From: "Stefan Santesson"
To: "Stefan Santesson" ,
X-OriginalArrivalTime: 05 Oct 2006 12:40:09.0473 (UTC) FILETIME=[64B34710:01C6E87B]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------_=_NextPart_001_01C6E87B.61591F7F
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I've had very few replies on this call.

=20

I need at least all document lead editors to respond whether they need a
time slot or not.

=20

Stefan Santesson

Senior Program Manager

Windows Security, Standards

From: Stefan Santesson=20
Sent: den 29 september 2006 04:13
To: [email-masked]
Subject: Call for agenda items for pkix at IETF-67

=20

All,

=20

I'm requesting proposals on agenda items for IETF-67.

=20

All, lead editors of current pkix drafts are required to respond,
stating to what extent they whish to present latest issues and progress
and how much time, if any, they need.

In addition to this I would like input on other presentations on
proposed new work and liaison presentations.

=20

I will need your input no later than end of next week, Friday October
6th, in order to post the agenda well in time for the next meeting.

=20

Stefan Santesson

Senior Program Manager

Windows Security, Standards

------_=_NextPart_001_01C6E87B.61591F7F
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I’ve had very few replies on this =
call.

I need =
at least all
document lead editors to respond whether they need a time slot or =
not.

Stefan Santesson

Senior Program Manager

Windows Security, =
Standards

From: Stefan Santesson

Sent: den 29 september 2006 04:13

To: [email-masked]

Subject: Call for agenda items for pkix at =
IETF-67

All,

I’m requesting proposals =
on agenda
items for IETF-67.

All, lead editors of current =
pkix drafts are
required to respond, stating to what extent they whish to  present =
latest
issues and progress and how much time, if any, they =
need.

In addition to this I would like =
input on
other presentations on proposed new work and liaison =
presentations.

I will need your input no later =
than end of
next week, Friday October 6th, in order to post the agenda =
well in
time for the next meeting.

Stefan Santesson

Senior Program Manager

Windows Security, =
Standards

------_=_NextPart_001_01C6E87B.61591F7F--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94JF5w3075606; Wed, 4 Oct 2006 12:15:06 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k94JF5wQ075605; Wed, 4 Oct 2006 12:15:05 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp1.nist.gov [129.6.16.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94JF4lf075597 for ; Wed, 4 Oct 2006 12:15:04 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k94JF0Dd027756 for ; Wed, 4 Oct 2006 15:15:00 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k94JESNZ011109 for ; Wed, 4 Oct 2006 15:14:28 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Wed, 04 Oct 2006 15:15:28 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: pkix
Subject: Re: 3280 Bis: Initial Values for Permitted and Excluded Subtrees
References:
In-Reply-To:
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

While I can see that it may be useful in some circumstances to impose a
path length constraint as an input, I would be inclined to vote against
including it in section 6.1.1. Up until now, section 6.1.1 has not
included any inputs that were not already in X.509's path validation
algorithm.

What I have done for the moment is to replace the text in section 6.2
that indicates that it is acceptable for an implementation to apply name
constraints to a trust anchor with text that says that an implementation
may apply a path length constraint. The second paragraph of section 6.2
now begins as follows:

An implementation MAY augment the algorithm presented in section 6.1
to further limit the set of valid certification paths that begin with
a particular trust anchor. For example, an implementation MAY modify
the algorithm to apply a path length constraint to a specific trust
anchor during the initialization phase, ....

Dave

Tom Gindin wrote:
> Santosh:
>
> I see uses for a general RP in setting max_path_length to 0. It
> trusts a given CA to issue EE certificates, but refuses to accept cross
> certificates. The most obvious scenario where this is useful is if you
> are trusting an organization's internal CA to issue certificates to
> employees or members, but you don't have any use for its cross
> certificates.
> I suppose there might be some conditions under which setting it to
> 1 makes sense, since that effectively sets a path length constraint on a
> CA which doesn't use them itself, but I have never come up with a good
> scenario for it.
>
> Tom Gindin
>
>
>
>
> "Santosh Chokhani"
> 09/16/2006 10:01 PM
>
> To
> Tom Gindin/Watson/IBM@IBMUS
> cc
> "David A. Cooper" , "pkix"
> Subject
> RE: 3280 Bis: Initial Values for Permitted and Excluded Subtrees
>
>
>
>
>
>
> Tom,
>
> I can see the path length usefulness (specifically path length = 0)when
> a CA is validating one of its trusted operator certificates.
>
> Do you see other usage of setting the value (to 0 or some non-zero)
> value.
>
> -----Original Message-----
> From: Tom Gindin [mailto:[email-masked]]
> Sent: Saturday, September 16, 2006 5:57 PM
> To: Santosh Chokhani
> Cc: David A. Cooper; pkix
> Subject: RE: 3280 Bis: Initial Values for Permitted and Excluded
> Subtrees
>
> I'm for this too. Does including max_path_length make sense as
> well? I believe that it does. Setting it to 0, in particular, trusts a
>
> CA to issue end-entity certificates without trusting it to issue cross
> certificates.
>
> Tom Gindin

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94J3BpY074114; Wed, 4 Oct 2006 12:03:11 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k94J3B5q074113; Wed, 4 Oct 2006 12:03:11 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp1.nist.gov [129.6.16.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94J3AoL074106 for ; Wed, 4 Oct 2006 12:03:10 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k94J30AT009479 for ; Wed, 4 Oct 2006 15:03:03 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k94J2l4f006386 for ; Wed, 4 Oct 2006 15:02:47 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Wed, 04 Oct 2006 15:03:48 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: pkix
Subject: Re: 3280 Bis: Initial Values for Permitted and Excluded Subtrees
References: <[email-masked]> <[email-masked]> <[email-masked]> <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

While section 6.1.1 of RFC 3280 indicates that the path validation
"algorithm assumes the following seven inputs are provided to the path
processing logic", I do not believe that was intended to be a
requirement to allow applications (or users) to set all of these
values. So, even if we add initial-permitted-subtrees and
initial-excluded-subtrees to the set of inputs listed in section 6.1.1,
I do not believe that this would require a conforming implementation to
be able to validate paths using initial values for permitted_subtrees
and excluded_subtrees other than "permit all" and "exclude none". This
would just be an example of an implementation that hard coded the values
for the initial-permitted-subtrees and initial-excluded-subtrees inputs.

However, in order to avoid confusion, I propose adding a paragraph to
the end of section 6.1.1 that explicitly states that conforming
implementations may "hard code" the values for some of the inputs and
are not required to be able to accept user/application supplied values
for every input mentioned in the section. Here is the text that I
propose to add:

Conforming implementations are not required to support the setting of
all of these inputs. For example, a conforming implementation may be
designed to validate all certification paths using a value of FALSE
for initial-any-policy-inhibit.

While I would have preferred to use initial-permitted-subtrees and
initial-excluded-subtrees as the examples, since they are the two new
inputs, I chose initial-any-policy-inhibit for the example since it is a
simple boolean and thus much easier to describe.

Dave

Peter Sylvester wrote:
> Doesn't the MAY in the sentence permit an implementation to be conformant
> if it does not provide the possibility? This deosn't seem to be the
> same in X.509 where
> the possibility of adding the constraints is part of the input of the
> path validation algorithm.
>
> The inputs to the certification path processing procedure are:
> ...
>
> h) an initial-permitted-subtrees-set containing an initial set of
> subtree specifications defining subtrees within which subject names
> (of the name form used to specify the subtrees) are permitted. In the
> certificates in the certification path all subject names of a given
> name form, for which initial permitted subtrees are defined, shall
> fall within the permitted subtrees set for that given name form. This
> input may also contain the special value unbounded to indicate that
> initially all subject names are acceptable. For clause 10, subject
> names are those name values appearing in the subject field or the
> subjectAltName extension;
>
> David A. Cooper wrote:
>> Russ Housley wrote:
>>> I have been thinking about this, and I think it would be a very good
>>> idea to add these. The algorithm in section 6 already has state
>>> variables for permitted and excluded subtrees. This is a minor
>>> change to permit them to be initialized to algorithm input values.
>> 3280bis already permits setting initial values for name constraints,
>> just not in section 6.1. The following text appears in section 6.2
>> (Using the Path Validation Algorithm) and is basically unchanged from
>> RFC 3280:
>>
>> An implementation MAY augment the algorithm presented in
>> section 6.1
>> to further limit the set of valid certification paths that
>> begin with
>> a particular trust anchor. For example, an implementation
>> MAY modify
>> the algorithm to apply name constraints to a specific trust
>> anchor
>> during the initialization phase, ....
>>
>> Of course, 3280bis could formally add the initialization of permitted
>> and excluded subtrees to the path validation algorithm by adding it
>> to section 6.1. Since RFC 3280 and 3280bis already permit this it
>> wouldn't really be a change, it would just make the option more
>> visible. So, I would have no objection to moving this option to
>> section 6.1.
>>
>> Dave
>>
>>> At 07:00 PM 8/24/2006, Santosh Chokhani wrote:
>>>> All,
>>>>
>>>> The new version of X.509 (2005 Edition) permits initial values
>>>> other than infinity and null for permitted and excluded subtrees
>>>> respectively.
>>>>
>>>> Should we also revise 3280Bis to include these options so that the
>>>> relying parties can constrain the trust anchors?
>>>>
>>>> I would consider infinity and null values only for the two
>>>> respective fields still compliant with the applicable standard.
>>>>
>>>> Thanks in advance for your opinion.
>>>>
>>>> Santosh Chokhani
>>>> Orion Security Solutions, Inc.
>>>> 1489 Chain Bridge Road, Suite 300
>>>> McLean, Virginia 22101
>>>> (703) 917-0060 Ext. 35 (voice)
>>>> (703) 917-0260 (Fax)
>>>> [email-masked]
>>>> Visit our Web site
>>>> http://www.orionsec.com

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94II8eD066714; Wed, 4 Oct 2006 11:18:08 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k94II8MD066713; Wed, 4 Oct 2006 11:18:08 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp1.nist.gov [129.6.16.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94II7fJ066695 for ; Wed, 4 Oct 2006 11:18:07 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k94IHxiu009512 for ; Wed, 4 Oct 2006 14:18:00 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k94IHGvR016254 for ; Wed, 4 Oct 2006 14:17:17 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Wed, 04 Oct 2006 14:18:17 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: pkix
Subject: Re: Inconsistencies between RFC 3280 and X.509/X.520
References: <[email-masked]> <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Steven,

Thanks for pointing this out. It does appear that while X.509 and X.520
include ASN.1 in normative annexes that make use of the upper bounds
that are defined in the UpperBounds module from annex C in X.520, annex
C is informative. Annex C in X.520 begins with the following sentence:

This annex includes all of the suggested upper bound value
constraints used in
these Directory Specifications, in the form of the ASN.1 module
UpperBounds.

So, the upper bounds in X.520 are only suggested values.

I still do not understand why RFCs 2459 and 3280 use a value of 32768
for ub-name instead of 64 when all of the other upper bounds are the
same as in X.520, although I have found that RFC 2256 (Lightweight
Directory Access Protocol (LDAP): Schema for User Applications) also
specifies an upper bound of 32768 for name. In RFC 4519, which
obsoleted RFC 2256, all upper bounds were removed.

In any case, given that the upper bounds in X.520 are not normative, I
will not change the upper bounds in 3280bis.

Dave

Steven Legg wrote:
>
> David,
>
> The annex of X.520 in which ub-name and the other upper bounds are
> defined has
> always been non-normative. The particular values to which the upper
> bounds are
> set are merely suggestions, and implementations are free to set
> whatever upper
> bounds they like. Thus RFC 3280 is not incorrect in setting ub-name to
> something other than 64.
>
> Regards,
> Steven
>
> David A. Cooper wrote:
>>
>> All,
>>
>> In researching the confusion related to RFC 3280's description of the
>> encoding of attributes that use the DirectoryString type, I
>> encountered two places in the ASN.1 modules in RFC 3280 (and 3280bis)
>> that are inconsistent with either X.509 or X.520. (I have not
>> thoroughly compared these documents, so I cannot guarantee that there
>> are not any other inconsistencies.)
>>
>> First, in X.520 the value of ub-name is 64 whereas in RFC 3280 the
>> value of ub-name is 32768. ub-name is used to specify the maximum
>> length of the following attributes: name, surname, givenName,
>> initial, and generationQualifier.
>>
>> Second, X.509 defines EDIParty as:
>>
>> EDIPartyName ::= SEQUENCE {
>> nameAssigner [0] DirectoryString {ub-name} OPTIONAL,
>> partyName [1] DirectoryString {ub-name} }
>>
>> whereas RFC 3280 defines EDIParty as
>>
>> EDIPartyName ::= SEQUENCE {
>> nameAssigner [0] DirectoryString OPTIONAL,
>> partyName [1] DirectoryString }
>>
>> So, in X.509 there is a size constraint on both the nameAssigner and
>> partyName strings (they must be between 1 and 64 characters). In RFC
>> 3280, there is no constraint on the length of the strings.
>>
>> I would like to modify 3280bis so that it is consistent with X.509
>> and X.520. However, since the ASN.1 that appears in 3280bis is the
>> same as the ASN.1 in RFC 3280 and RFC 2459, I want to ensure that
>> changing these items to be consistent with X.509 and X.520 will not
>> cause any backwards compatibility issues.
>>
>> So, I would like to know if changing the ASN.1 in 3280bis would cause
>> problems for any existing implementations. For example, if there are
>> systems that use the attributes mentioned above with string lengths
>> that violate length constraints in X.520.
>>
>> Thanks,
>>
>> Dave

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94FEICD040707; Wed, 4 Oct 2006 08:14:18 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k94FEIM3040706; Wed, 4 Oct 2006 08:14:18 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94FEFku040697 for ; Wed, 4 Oct 2006 08:14:17 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-mcl1.frcl.bull.fr [129.184.87.20]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id RAA41404 for ; Wed, 4 Oct 2006 17:16:22 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006100417141372:34307 ; Wed, 4 Oct 2006 17:14:13 +0200
Date: Wed, 4 Oct 2006 17:14:12 +0200
From: "Denis Pinkas"
To: "[email-masked]"
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 04/10/2006 17:14:13, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 04/10/2006 17:14:14, Serialize complete at 04/10/2006 17:14:14
Message-ID:
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by balder-227.proper.com id k94FEHku040701
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Rob,

Before describing a technical solution, it would be nice to explain in details
what the problem you want to solve is.

Denis

>Hi Hoyt.
>
>Maybe I'm not using the word "agility" correctly. My aim was to find a way to
>include *multiple* hashes (with each hash generated by a different hash
>algorithm) in a *single* Certificate/CRL/etc, so that we no longer have to
>rely on the strength of a single hash algorithm.
>
>PKCS#1 defines various AlgorithmIdentifiers for digital
>signatures: "sha1WithRSAEncryption", "sha256WithRSAEncryption", etc. Each of
>these is for 1 hash algorithm and 1 encryption algorithm.
>PKCS#1 does not define anything like "sha1AndSha256WithRSAEncryption" (i.e. 2
>or more hash algorithms and 1 encryption algorithm).
>
>We could of course define new {SupportedAlgorithms} OIDs
>for "sha1AndSha256WithRSAEncryption", "sha1AndSha512WithRSAEncryption", etc,
>but no existing software would recognize these.
>
>I'm not saying that my "Additional Hashes" Extension idea is a particularly
>clean solution from a purist's point of view. It would be best if there was
>a way for all of the algorithm identifiers/signatures/hashes to continue to
>be stored in the "standard" X.509 places (Certificate->signature, etc).
>
>But the problem is...
>
>The definition of Certificate->signature, which we can't change, is...
> signature AlgorithmIdentifier,
>...rather than...
> signature SEQUENCE OF AlgorithmIdentifier,
>
>...and the definition of SIGNED, which we can't change, is...
>SIGNED { ToBeSigned } ::= SEQUENCE {
> toBeSigned ToBeSigned,
> COMPONENTS OF SIGNATURE { ToBeSigned }}
>...rather than something like...
>SIGNED { ToBeSigned } ::= SEQUENCE {
> toBeSigned ToBeSigned,
> SEQUENCE OF SIGNATURE { ToBeSigned }}
>
>I hope this post clarifies where I was coming from with the "Advantages
>(IMHO)" from my previous post.
>
>--
>Rob Stradling
>Comodo CA Limited
>
>On Tuesday 03 October 2006 16:49, you wrote:
>> i'd consider the signature algorithm OID before I would state that x.509
>> has no algorithm agility
>>
>>         Certificate   ::=       SIGNED { SEQUENCE {
>>         version                 [0]     Version DEFAULT v1,
>>         serialNumber                    CertificateSerialNumber,
>>         signature                               AlgorithmIdentifier,
>>         issuer                          Name,
>>         validity                                Validity,
>>         subject                         Name,
>>         subjectPublicKeyInfo            SubjectPublicKeyInfo,
>>    issuerUniqueIdentifier  [1]     IMPLICIT UniqueIdentifier OPTIONAL,
>>
>>         -- if present, version shall be v2 or v3 subjectUniqueIdentifier
>> [2]     IMPLICIT UniqueIdentifier OPTIONAL, -- if present, version shall be
>> v2 or v3 extensions              [3]     Extensions OPTIONAL
>>
>>         -- If present, version shall be v3 -- } }
>>
>>         Version                 ::=             INTEGER { v1(0), v2(1),
>> v3(2) } CertificateSerialNumber ::=             INTEGER
>>         AlgorithmIdentifier             ::=             SEQUENCE {
>>         algorithm               ALGORITHM.&id ({SupportedAlgorithms}),
>>         parameters   ALGORITHM.&Type ({SupportedAlgorithms}{ @algorithm})
>> OPTIONAL }
>>
>> I assume you meant to say that the list of OIDs for agreed combinations of
>> hash algorithms, encryption algorithms, and key lengths needs to be
>> expanded.
>>
>> Note that although 509 allows parameters to be associated with an algorithm
>> OID, the practice from the days of PKCS has been that each OID identifies a
>> specific combination.
>>
>>      hoyt
>>
>>
>> Hi.  I'm new to this list, so please forgive me if the following idea has
>> been aired before, or if better ideas are already under discussion...
>>
>> As http://www3.ietf.org/proceedings/06mar/slides/pkix-1/sld3.htm points
>> out, X.509 certificates have no algorithm agility.  This breaks down into 3
>> areas: 1. A certificate only contains 1 public key (which will almost
>> certainly only be useable with 1 particular asymmetric encryption
>> algorithm). 2. Only 1 CA private key (and 1 asymmetric encryption
>> algorithm) is used to generate a certificate's signature.
>>   3. Only 1 hash algorithm is used to generate a certificate's signature.
>>
>> I don't want to address areas 1 and 2 here, but I have an idea for adding
>> some agility to area 3...
>>
>> I suggest that we define an "Additional Hashes" Certificate Extension.
>> This Extension would contain 1 or more hashes, generated using different
>> hash algorithm(s) to the hash algorithm used in the generation of the
>> certificate's signature.
>> To issue a certificate, a CA would need to do something like this:
>>     A. Create the "to be signed" certificate (as per the CA's existing
>> process).
>>     B. Generate the SHA-256 hash of the "to be signed" certificate.
>>     C. Put the SHA-256 hash from Step B into an "Additional Hashes"
>> extension, and add that extension to the "to be signed" certificate from
>> step A. D. Sign the "to be signed" certificate from step C using SHA-1 as
>> the hash algorithm for the signature.
>> Relying parties would then be able to verify all (or as many as they can)
>> of the hashes.  Future software could choose to reject certificates that
>> don't contain an "Additional Hashes" extension with enough different hash
>> algorithms represented.
>>
>> Advantages (IMHO):
>>   - We would be able to start using SHA-256/384/512 immediately.  :-)
>>   - Various bodies are recommending phasing out SHA-1 in the very near
>> future (NIST say 2010, IIRC, but I'm sure I've also seen a reference to
>> 2008).  I think that my idea might be the only approach that could at least
>> "phase in" newer hash algorithms before these deadlines.  The "phase out"
>> of SHA-1 would become arguably less urgent and could take place at a later
>> time. - Backwards compatibility: new software would be able to take
>> advantage of multiple hashes to enhance their security; existing software
>> would continue to work as it does today (i.e. it would simply ignore the
>> "Additional Hashes" extension").  This is potentially a very useful
>> property, given that (IIRC) Microsoft have said that support for
>> SHA-256/384/512 will be added in Windows Vista, but not backported to older
>> versions of Windows.  I expect that many, many users will continue to use
>> Windows 2000/XP/etc well beyond 2008/2010, and will be quite happy to rely
>> on SHA-1 until such time as it is
>> definitely "broken".
>>   - This same idea could also be used in CRLs, OCSP Requests and OCSP
>> Responses, because they can all contain Extensions.
>>
>> --
>> Rob Stradling
>> Comodo CA Limited
>

Regards,

Denis Pinkas

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94AQGKI079157; Wed, 4 Oct 2006 03:26:16 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k94AQGc6079156; Wed, 4 Oct 2006 03:26:16 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from brendan.brad.office.comodo.net (brad.comodogroup.com [82.109.38.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k94AQAJl079143 for ; Wed, 4 Oct 2006 03:26:14 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 16274 invoked by uid 1000); 4 Oct 2006 11:26:08 +0100
Received: from Unknown (HELO nigel.comodo.net) (192.168.0.58) by brendan.brad.office.comodo.net (qpsmtpd/0.31.1) with ESMTP; Wed, 04 Oct 2006 11:26:08 +0100
From: Rob Stradling
Organization: Comodo CA Limited
To: Hoyt L Kesterson II
Subject: Re: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Wed, 4 Oct 2006 11:26:02 +0100
User-Agent: KMail/1.9.1
References: <[email-masked]>
In-Reply-To:
Cc: [email-masked]
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Message-Id: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k94AQFJl079151
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi Hoyt.

Maybe I'm not using the word "agility" correctly. My aim was to find a way to
include *multiple* hashes (with each hash generated by a different hash
algorithm) in a *single* Certificate/CRL/etc, so that we no longer have to
rely on the strength of a single hash algorithm.

PKCS#1 defines various AlgorithmIdentifiers for digital
signatures: "sha1WithRSAEncryption", "sha256WithRSAEncryption", etc. Each of
these is for 1 hash algorithm and 1 encryption algorithm.
PKCS#1 does not define anything like "sha1AndSha256WithRSAEncryption" (i.e. 2
or more hash algorithms and 1 encryption algorithm).

We could of course define new {SupportedAlgorithms} OIDs
for "sha1AndSha256WithRSAEncryption", "sha1AndSha512WithRSAEncryption", etc,
but no existing software would recognize these.

I'm not saying that my "Additional Hashes" Extension idea is a particularly
clean solution from a purist's point of view. It would be best if there was
a way for all of the algorithm identifiers/signatures/hashes to continue to
be stored in the "standard" X.509 places (Certificate->signature, etc).

But the problem is...

The definition of Certificate->signature, which we can't change, is...
signature AlgorithmIdentifier,
...rather than...
signature SEQUENCE OF AlgorithmIdentifier,

...and the definition of SIGNED, which we can't change, is...
SIGNED { ToBeSigned } ::= SEQUENCE {
toBeSigned ToBeSigned,
COMPONENTS OF SIGNATURE { ToBeSigned }}
...rather than something like...
SIGNED { ToBeSigned } ::= SEQUENCE {
toBeSigned ToBeSigned,
SEQUENCE OF SIGNATURE { ToBeSigned }}

I hope this post clarifies where I was coming from with the "Advantages
(IMHO)" from my previous post.

--
Rob Stradling
Comodo CA Limited

On Tuesday 03 October 2006 16:49, you wrote:
> i'd consider the signature algorithm OID before I would state that x.509
> has no algorithm agility
>
>         Certificate   ::=       SIGNED { SEQUENCE {
>         version                 [0]     Version DEFAULT v1,
>         serialNumber                    CertificateSerialNumber,
>         signature                               AlgorithmIdentifier,
>         issuer                          Name,
>         validity                                Validity,
>         subject                         Name,
>         subjectPublicKeyInfo            SubjectPublicKeyInfo,
>    issuerUniqueIdentifier  [1]     IMPLICIT UniqueIdentifier OPTIONAL,
>
>         -- if present, version shall be v2 or v3 subjectUniqueIdentifier
> [2]     IMPLICIT UniqueIdentifier OPTIONAL, -- if present, version shall be
> v2 or v3 extensions              [3]     Extensions OPTIONAL
>
>         -- If present, version shall be v3 -- } }
>
>         Version                 ::=             INTEGER { v1(0), v2(1),
> v3(2) } CertificateSerialNumber ::=             INTEGER
>         AlgorithmIdentifier             ::=             SEQUENCE {
>         algorithm               ALGORITHM.&id ({SupportedAlgorithms}),
>         parameters   ALGORITHM.&Type ({SupportedAlgorithms}{ @algorithm})
> OPTIONAL }
>
> I assume you meant to say that the list of OIDs for agreed combinations of
> hash algorithms, encryption algorithms, and key lengths needs to be
> expanded.
>
> Note that although 509 allows parameters to be associated with an algorithm
> OID, the practice from the days of PKCS has been that each OID identifies a
> specific combination.
>
>      hoyt
>
>
> Hi.  I'm new to this list, so please forgive me if the following idea has
> been aired before, or if better ideas are already under discussion...
>
> As http://www3.ietf.org/proceedings/06mar/slides/pkix-1/sld3.htm points
> out, X.509 certificates have no algorithm agility.  This breaks down into 3
> areas: 1. A certificate only contains 1 public key (which will almost
> certainly only be useable with 1 particular asymmetric encryption
> algorithm). 2. Only 1 CA private key (and 1 asymmetric encryption
> algorithm) is used to generate a certificate's signature.
>   3. Only 1 hash algorithm is used to generate a certificate's signature.
>
> I don't want to address areas 1 and 2 here, but I have an idea for adding
> some agility to area 3...
>
> I suggest that we define an "Additional Hashes" Certificate Extension.
> This Extension would contain 1 or more hashes, generated using different
> hash algorithm(s) to the hash algorithm used in the generation of the
> certificate's signature.
> To issue a certificate, a CA would need to do something like this:
>     A. Create the "to be signed" certificate (as per the CA's existing
> process).
>     B. Generate the SHA-256 hash of the "to be signed" certificate.
>     C. Put the SHA-256 hash from Step B into an "Additional Hashes"
> extension, and add that extension to the "to be signed" certificate from
> step A. D. Sign the "to be signed" certificate from step C using SHA-1 as
> the hash algorithm for the signature.
> Relying parties would then be able to verify all (or as many as they can)
> of the hashes.  Future software could choose to reject certificates that
> don't contain an "Additional Hashes" extension with enough different hash
> algorithms represented.
>
> Advantages (IMHO):
>   - We would be able to start using SHA-256/384/512 immediately.  :-)
>   - Various bodies are recommending phasing out SHA-1 in the very near
> future (NIST say 2010, IIRC, but I'm sure I've also seen a reference to
> 2008).  I think that my idea might be the only approach that could at least
> "phase in" newer hash algorithms before these deadlines.  The "phase out"
> of SHA-1 would become arguably less urgent and could take place at a later
> time. - Backwards compatibility: new software would be able to take
> advantage of multiple hashes to enhance their security; existing software
> would continue to work as it does today (i.e. it would simply ignore the
> "Additional Hashes" extension").  This is potentially a very useful
> property, given that (IIRC) Microsoft have said that support for
> SHA-256/384/512 will be added in Windows Vista, but not backported to older
> versions of Windows.  I expect that many, many users will continue to use
> Windows 2000/XP/etc well beyond 2008/2010, and will be quite happy to rely
> on SHA-1 until such time as it is
> definitely "broken".
>   - This same idea could also be used in CRLs, OCSP Requests and OCSP
> Responses, because they can all contain Extensions.
>
> --
> Rob Stradling
> Comodo CA Limited

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k93FXEO4033118; Tue, 3 Oct 2006 08:33:14 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k93FXCJp033112; Tue, 3 Oct 2006 08:33:12 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from citi.umich.edu (citi.umich.edu [141.211.133.111]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k93FXAT4033072 for ; Tue, 3 Oct 2006 08:33:10 -0700 (MST) (envelope-from [email-masked])
Received: from [141.211.133.26] (yoga.citi.umich.edu [141.211.133.26]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "aglo", Issuer "CITI Production KCA" (verified OK)) by citi.umich.edu (Postfix) with ESMTP id E28F71BDE1; Tue, 3 Oct 2006 11:33:09 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Tue, 03 Oct 2006 11:33:09 -0400
From: Olga Kornievskaia
User-Agent: Thunderbird 1.5.0.7 (X11/20060913)
MIME-Version: 1.0
To: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]
Subject: [67th IETF] SPKM3 BOF announcement
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

We would like to announce the following BOF for the 67th IETF meeting.

BOF name: NFSv4 and Low Infrastructure Public Key Based GSS Security
Mechanisms
Area: Security Area
Chair: Jeffrey Hutzelman

If this topic is of interest to you please email your questions and
concerns to the mail list ([email-masked]).

Problem Statement:

The NFSv4 protocol has a need for low infrastructure PKI based GSS
security mechanism(s) that provide for the creation of a secure channel
using mutual authentication where
1) both user and server authenticate with public key certificates
2) server authenticates with public key certificates, and the user
authenticates with a username and password.

Current State:
RFC3530 "Network File System (NFS) version 4 Protocol" mandates the
use of RFC2847 "LIPKEY - A Low Infrastructure Public Key Mechanism Using
SPKM". While RFC2847 fulfills the requirements of the problem
statement, there are areas where RFC2847 is outdated and/or
underspecified. Futhermore, RFC2847 both replaces and refers to portions
of RFC2025 "The Simple Public-Key GSS-API Mechanism (SPKM)" and is
confusing to implementers. None the less, there are two implementations
(Hummingbird and Linux) based upon RFC2847.
draft-adamson-rfc2847-bis-01.txt, an update of RFC2847, is intended to
address RFC2847 shortcomings and provide a complete specification that
doesn't need [RFC2025] and that replaces [RFC2847].

Agenda:
1) Need for a low infrastructure PK based GSS security mechanism for
NFSV4
- what is low infrastructure
- existing markets
- current implementations
2) draft-adamson-rfc2847-bis-01.txt
- issues brought up by IESG review
- naming
- algorithms
- which diffie-hellman
- clarify protocol security claims
- whole document review
- backwards compatibility with RFC2847 based implementations
3) moving forward
- finish draft-adamson-rfc2847-bis-01.txt
- get draft into shape to submit to for IESG comments.
- find reviewers
- explore alternative GSS mechanisms

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k93Ea2gd004331; Tue, 3 Oct 2006 07:36:02 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k93Ea2ou004322; Tue, 3 Oct 2006 07:36:02 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from brendan.brad.office.comodo.net (brad.comodogroup.com [82.109.38.202]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k93EZubh004166 for ; Tue, 3 Oct 2006 07:36:00 -0700 (MST) (envelope-from [email-masked])
Received: (qmail 4342 invoked by uid 1000); 3 Oct 2006 15:35:53 +0100
Received: from Unknown (HELO nigel.comodo.net) (192.168.0.58) by brendan.brad.office.comodo.net (qpsmtpd/0.31.1) with ESMTP; Tue, 03 Oct 2006 15:35:53 +0100
From: Rob Stradling
Organization: Comodo CA Limited
To: [email-masked]
Subject: Hash Algorithm Agility via Certificate/CRL/OCSP Extensions
Date: Tue, 3 Oct 2006 15:35:51 +0100
User-Agent: KMail/1.9.1
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Message-Id: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k93Ea1bh004307
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi. I'm new to this list, so please forgive me if the following idea has been
aired before, or if better ideas are already under discussion...

As http://www3.ietf.org/proceedings/06mar/slides/pkix-1/sld3.htm points out,
X.509 certificates have no algorithm agility. This breaks down into 3 areas:
1. A certificate only contains 1 public key (which will almost certainly
only be useable with 1 particular asymmetric encryption algorithm).
2. Only 1 CA private key (and 1 asymmetric encryption algorithm) is used to
generate a certificate's signature.
3. Only 1 hash algorithm is used to generate a certificate's signature.

I don't want to address areas 1 and 2 here, but I have an idea for adding some
agility to area 3...

I suggest that we define an "Additional Hashes" Certificate Extension. This
Extension would contain 1 or more hashes, generated using different hash
algorithm(s) to the hash algorithm used in the generation of the
certificate's signature.
To issue a certificate, a CA would need to do something like this:
A. Create the "to be signed" certificate (as per the CA's existing
process).
B. Generate the SHA-256 hash of the "to be signed" certificate.
C. Put the SHA-256 hash from Step B into an "Additional Hashes" extension,
and add that extension to the "to be signed" certificate from step A.
D. Sign the "to be signed" certificate from step C using SHA-1 as the hash
algorithm for the signature.
Relying parties would then be able to verify all (or as many as they can) of
the hashes. Future software could choose to reject certificates that don't
contain an "Additional Hashes" extension with enough different hash
algorithms represented.

Advantages (IMHO):
- We would be able to start using SHA-256/384/512 immediately. :-)
- Various bodies are recommending phasing out SHA-1 in the very near future
(NIST say 2010, IIRC, but I'm sure I've also seen a reference to 2008). I
think that my idea might be the only approach that could at least "phase in"
newer hash algorithms before these deadlines. The "phase out" of SHA-1 would
become arguably less urgent and could take place at a later time.
- Backwards compatibility: new software would be able to take advantage of
multiple hashes to enhance their security; existing software would continue
to work as it does today (i.e. it would simply ignore the "Additional Hashes"
extension"). This is potentially a very useful property, given that (IIRC)
Microsoft have said that support for SHA-256/384/512 will be added in Windows
Vista, but not backported to older versions of Windows. I expect that many,
many users will continue to use Windows 2000/XP/etc well beyond 2008/2010,
and will be quite happy to rely on SHA-1 until such time as it is
definitely "broken".
- This same idea could also be used in CRLs, OCSP Requests and OCSP
Responses, because they can all contain Extensions.

--
Rob Stradling
Comodo CA Limited

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k93CISWq040775; Tue, 3 Oct 2006 05:18:28 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k93CISSX040774; Tue, 3 Oct 2006 05:18:28 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mail.primekey.se (walter.primekey.se [213.212.2.98]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k93CIQQV040766 for ; Tue, 3 Oct 2006 05:18:27 -0700 (MST) (envelope-from [email-masked])
Received: from [10.8.0.10] (localhost [127.0.0.1]) by mail.primekey.se (Postfix) with ESMTP id 52BFBC3A9F for ; Tue, 3 Oct 2006 14:18:25 +0200 (CEST)
Message-ID: <[email-masked]>
Date: Tue, 03 Oct 2006 14:18:25 +0200
From: Tomas Gustavsson
User-Agent: Thunderbird 1.5.0.7 (X11/20060922)
MIME-Version: 1.0
To: [email-masked]
Subject: Certificate Policies in Root CA certificates
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Hi,
I'm an old aquantance, but a new comer to the list this time around.
I don't know if this has been up recently, but I couldn't find anything
in the archives at least.

I am studying the enhanced wording in RFC3280 and the cert validation
protocol regarding the Certificate Policy extension.
I come to the conclusion that a RootCA certificate better have anyPolicy
or no extension at all. This because you usually don't want to limit the
possible policies that sub CAs can use to issue certificates to end
users. You can always find good use for another sub CA, right.

Basically I want to know what the consensus is among the list, should a
root CA have anyPolicy in the Certificate Policy extension, or no
extension at all?

From the validation protocol both (or none) would work find depending
on the input parameters given from the validating application.

Regards,
Tomas Gustavsson
http://www.ejbca.org/

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92L7h89050203; Mon, 2 Oct 2006 14:07:43 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92L7hOa050202; Mon, 2 Oct 2006 14:07:43 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp1.nist.gov [129.6.16.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92L7gBa050196 for ; Mon, 2 Oct 2006 14:07:42 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k92L7VuU006950; Mon, 2 Oct 2006 17:07:31 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k92L6cqo017250; Mon, 2 Oct 2006 17:06:39 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Mon, 02 Oct 2006 17:07:34 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: Vittek Robert
CC: pkix
Subject: Re: Complete CRLs with expired certs?
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

There is no need to incorporate the ArchiveCutOff extension in the CRL
profile. The expiredCertsOnCRL extension has already been defined in
X.509 achieves the same goal.

As Peter Hesse noted, the expiredCertsOnCRL extension is a non-critical
CRL extension that consists of a GeneralizedTime value. The semantics
are that the CRL lists all revoked certificates within the scope of the
CRL that are either unexpired or that expired at the time specified in
the extension or later. So, if CRLs cover all expired certificates,
each CRL can specify the same time (any time that is earlier than when
the first certificate expired). If the retention period is limited,
each CRL can specify a different time (e.g., expiredCertsOnCRL =
thisUpdate - 1 year if CRLs continue to cover certificates for one year
after they expire).

I would also like to see this extension profiled within the IETF. In
fact, there are other extensions that I would like to see either defined
or profiled within the IETF. However, it has generally been agreed that
it would not be appropriate to include new extensions in 3280bis. Any
new extensions would have to appear in a new I-D. While I would be
willing to participate in the development of such an I-D, I would not be
able to do so until after 3280bis is complete.

Dave

P.S. I would technically disagree with the statements about "PKIX
compliant CRLs". RFC 3280 (section 5.2) says:

The following subsections present those extensions used within Internet
CRLs. Communities may elect to include extensions in CRLs which
are not defined in this specification. However, caution should be
exercised in adopting any critical extensions in CRLs which might be
used in a general context.

So, while it is true that no IETF document mentions the
expiredCertsOnCRL extension, RFC 3280 does not prevent a conforming CRL
issuer from including this extension in CRLs nor does it prevent
conforming clients from processing the extension. But, I would agree
that without the expiredCertsOnCRLs extension there is very little
benefit to including expired certificates on CRLs except in environments
where clients can rely on out of band knowledge that CRLs cover expired
certificates.

Vittek Robert wrote:
> I do not think that "listing expired certificates on a PKIX compliant CRL is useless".
>
> rfc 3280 states in chapter 3.3: An entry MUST NOT be removed
> from the CRL until it appears on one regularly scheduled CRL issued
> beyond the revoked certificate's validity period.
>
> on the contrary to obsoleted rfc 2459 which stated just: An entry may be removed from
> the CRL after appearing on one regularly scheduled CRL issued beyond
> the revoked certificate's validity period.
>
> and thus allowing CAs to remove revoked certificates entries from CRLs sooner.
>
> Assume a signature made at time T (as claimed by an attached time stamp). Assume the signing certificate was revoked at time T-X (this value should appear in revocationDate on next CRL), e.g. for key compromise reason. And assume the certificate expired soon after the time T, let's say T+M. At time T+M+N new regular CRL_n is issued. CRL_n conformant with rfc 3280 allows to correctly reject such a signature, while CRL_n conformant with (obsoleted) rfc 2459 might not even list such cerificate.
>
> IMHO, there is still a problem if a signature validation application is temporarily unable to fetch CRL_n (e.g. for troubles with connectivity) and fetches only the next CRL_n+1 which though not issued on a regular basis was still issued before the nextUpdate of the last CRL in application's CRL cache. If CRL_n+1 does not list the certificate in question any more then the application is not able to say if the certificate was valid at time T or not. Unfortunately, the same is applicable to CRL_n, if n > the number of last cached CRL (CRL numbers do not have to be increased by 1).
>
> I think that incorporating ArchiveCutOff extension from OCSP protocol (rfc 2560) to CRL profile could help solve this issue. This still gives CAs possibility to decide on the length of the retention period.
>
>
> Robert Vittek
>
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
> Sent: Monday, October 02, 2006 4:44 PM
> To: [email-masked]
> Subject: Re: Complete CRLs with expired certs?
>
>
>
> In order to complement, but correct the sentence : "listing expired certificates on a CRL is OK".
>
> PKIX does not currently support the new X.509 extension mentionned hereafter.
>
> PKIX compliant CRLs shall include the serial number of expired certificates one time more after the expiration date of the certificate (placing delta CRL aside for simplicity).
>
> They might last it longer, but then there is no garantee that the revoked certificates serial numbers are present, (unless the new X.509 extension is being used), so if maintained longer, PKIX compliant CRLs cannot be used to know whether a given certificate was revoked or not, once that certificate has expired.
>
> As a conclusion: "listing expired certificates on a PKIX compliant CRL is useless".
>
> Denis
>
>
>
>> Michael,
>>
>> My impression has always been that listing expired certificates on a
>> CRL is OK; in fact the section on Delta CRLs (5.2.4) makes this clear:
>>
>> If a certificate revocation notice first appears on a delta CRL, then
>> it is possible for the certificate validity period to expire before
>> the next complete CRL for the same scope is issued. In this case,
>> the revocation notice MUST be included in all subsequent delta CRLs
>> until the revocation notice is included on at least one explicitly
>> issued complete CRL for this scope.
>>
>> The "at least one" at the end of that paragraph seems to make it
>> permissible. If it read "exactly one" then I think having expired
>> certificates on your CRL would be against the standard.
>>
>> The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:
>>
>> 8.5.2.12 Expired certificates on CRL extension
>> This CRL extension field indicates that the CRL includes revocation
>> notices for expired certificates.
>>
>> expiredCertsOnCRL EXTENSION ::= {
>> SYNTAX ExpiredCertsOnCRL
>> IDENTIFIED BY id-ce-expiredCertsOnCRL }
>>
>> ExpiredCertsOnCRL :: = GeneralizedTime
>>
>> This all being said, including expired certificates on the CRL makes
>> your CRL larger. A lot of organizations are doing everything they can
>> to fight this trend, including adopting OCSP. Having two CRLs as you
>> said -- perhaps one with the above referenced extension -- would probably be your best bet.
>>
>> --Peter
>>
>> +----------------------------------------------------------------+
>> | Peter Hesse [email-masked] |
>> | Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
>> | New! Visit our InfoSecurity industry blog: securitymusings.com |
>> +----------------------------------------------------------------+
>> "Security is mostly a superstition. It does not exist in nature...
>> Life is either a daring adventure or nothing." --Helen Keller
>>
>> -----Original Message-----
>> From: [email-masked]
>> [mailto:[email-masked]] On Behalf Of Michael Ströder
>> Sent: Monday, October 02, 2006 5:49 AM
>> To: [email-masked]
>> Subject: Complete CRLs with expired certs?
>>
>>
>> HI!
>>
>> Hope this hasn't discussed before:
>>
>> Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:
>>
>> A complete CRL lists all unexpired certificates, within its scope,
>> that have been revoked for one of the revocation reasons covered by
>> the CRL scope. A full and complete CRL lists all unexpired
>> certificates issued by a CA that have been revoked for any reason.
>>
>> What I'm looking at is "lists all unexpired certificates". Is this a
>> MUST, SHOULD or a "MUST at least list all unexpired certificates"? Is
>> it compliant with PKIX to also list expired certificates in the complete CRL?
>>
>> Would it be possible to generate two complete CRL lists, 1. one
>> containing only unexpired and revoked certificates and 2. another
>> containing expired and revoked certificates?
>>
>> CRL 2. would preserve the time a particular cert was revoked even after
>> expiration of this cert.
>>
>> Ciao, Michael.
>>
>>
>>
>>
>
> Regards,
>
> Denis Pinkas

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Irisb028049; Mon, 2 Oct 2006 11:53:44 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92IriaK028048; Mon, 2 Oct 2006 11:53:44 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from mx.ditec.sk (mx.ditec.sk [82.119.228.4]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Irhxf028021 for ; Mon, 2 Oct 2006 11:53:43 -0700 (MST) (envelope-from [email-masked])
Received: from apps.intra.ditec.sk ([172.24.31.11]) by mx.ditec.sk with Microsoft SMTPSVC(6.0.3790.1830); Mon, 2 Oct 2006 20:53:23 +0200
Subject: RE: Complete CRLs with expired certs?
Date: Mon, 2 Oct 2006 20:53:23 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Message-ID: <[email-masked]>
In-reply-to:
Content-class: urn:content-classes:message
X-MimeOLE: Produced By Microsoft Exchange V6.5
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: Complete CRLs with expired certs?
Thread-Index: AcbmNI40xb6uxeJqQeSPVfFE6MW3BAAHTbbw
From: "Vittek Robert"
To:
Cc: "Denis Pinkas"
X-OriginalArrivalTime: 02 Oct 2006 18:53:23.0487 (UTC) FILETIME=[095562F0:01C6E654]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k92Irixf028043
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

I do not think that "listing expired certificates on a PKIX compliant CRL is useless".

rfc 3280 states in chapter 3.3: An entry MUST NOT be removed
from the CRL until it appears on one regularly scheduled CRL issued
beyond the revoked certificate's validity period.

on the contrary to obsoleted rfc 2459 which stated just: An entry may be removed from
the CRL after appearing on one regularly scheduled CRL issued beyond
the revoked certificate's validity period.

and thus allowing CAs to remove revoked certificates entries from CRLs sooner.

Assume a signature made at time T (as claimed by an attached time stamp). Assume the signing certificate was revoked at time T-X (this value should appear in revocationDate on next CRL), e.g. for key compromise reason. And assume the certificate expired soon after the time T, let's say T+M. At time T+M+N new regular CRL_n is issued. CRL_n conformant with rfc 3280 allows to correctly reject such a signature, while CRL_n conformant with (obsoleted) rfc 2459 might not even list such cerificate.

IMHO, there is still a problem if a signature validation application is temporarily unable to fetch CRL_n (e.g. for troubles with connectivity) and fetches only the next CRL_n+1 which though not issued on a regular basis was still issued before the nextUpdate of the last CRL in application's CRL cache. If CRL_n+1 does not list the certificate in question any more then the application is not able to say if the certificate was valid at time T or not. Unfortunately, the same is applicable to CRL_n, if n > the number of last cached CRL (CRL numbers do not have to be increased by 1).

I think that incorporating ArchiveCutOff extension from OCSP protocol (rfc 2560) to CRL profile could help solve this issue. This still gives CAs possibility to decide on the length of the retention period.

Robert Vittek

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Denis Pinkas
Sent: Monday, October 02, 2006 4:44 PM
To: [email-masked]
Subject: Re: Complete CRLs with expired certs?

In order to complement, but correct the sentence : "listing expired certificates on a CRL is OK".

PKIX does not currently support the new X.509 extension mentionned hereafter.

PKIX compliant CRLs shall include the serial number of expired certificates one time more after the expiration date of the certificate (placing delta CRL aside for simplicity).

They might last it longer, but then there is no garantee that the revoked certificates serial numbers are present, (unless the new X.509 extension is being used), so if maintained longer, PKIX compliant CRLs cannot be used to know whether a given certificate was revoked or not, once that certificate has expired.

As a conclusion: "listing expired certificates on a PKIX compliant CRL is useless".

Denis

>Michael,
>
>My impression has always been that listing expired certificates on a
>CRL is OK; in fact the section on Delta CRLs (5.2.4) makes this clear:
>
> If a certificate revocation notice first appears on a delta CRL, then
> it is possible for the certificate validity period to expire before
> the next complete CRL for the same scope is issued. In this case,
> the revocation notice MUST be included in all subsequent delta CRLs
> until the revocation notice is included on at least one explicitly
> issued complete CRL for this scope.
>
>The "at least one" at the end of that paragraph seems to make it
>permissible. If it read "exactly one" then I think having expired
>certificates on your CRL would be against the standard.
>
>The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:
>
> 8.5.2.12 Expired certificates on CRL extension
> This CRL extension field indicates that the CRL includes revocation
> notices for expired certificates.
>
> expiredCertsOnCRL EXTENSION ::= {
> SYNTAX ExpiredCertsOnCRL
> IDENTIFIED BY id-ce-expiredCertsOnCRL }
>
> ExpiredCertsOnCRL :: = GeneralizedTime
>
>This all being said, including expired certificates on the CRL makes
>your CRL larger. A lot of organizations are doing everything they can
>to fight this trend, including adopting OCSP. Having two CRLs as you
>said -- perhaps one with the above referenced extension -- would probably be your best bet.
>
>--Peter
>
>+----------------------------------------------------------------+
>| Peter Hesse [email-masked] |
>| Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
>| New! Visit our InfoSecurity industry blog: securitymusings.com |
>+----------------------------------------------------------------+
>"Security is mostly a superstition. It does not exist in nature...
> Life is either a daring adventure or nothing." --Helen Keller
>
>-----Original Message-----
>From: [email-masked]
>[mailto:[email-masked]] On Behalf Of Michael Ströder
>Sent: Monday, October 02, 2006 5:49 AM
>To: [email-masked]
>Subject: Complete CRLs with expired certs?
>
>
>HI!
>
>Hope this hasn't discussed before:
>
>Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:
>
> A complete CRL lists all unexpired certificates, within its scope,
> that have been revoked for one of the revocation reasons covered by
> the CRL scope. A full and complete CRL lists all unexpired
> certificates issued by a CA that have been revoked for any reason.
>
>What I'm looking at is "lists all unexpired certificates". Is this a
>MUST, SHOULD or a "MUST at least list all unexpired certificates"? Is
>it compliant with PKIX to also list expired certificates in the complete CRL?
>
>Would it be possible to generate two complete CRL lists, 1. one
>containing only unexpired and revoked certificates and 2. another
>containing expired and revoked certificates?
>
>CRL 2. would preserve the time a particular cert was revoked even after
>expiration of this cert.
>
>Ciao, Michael.
>
>
>

Regards,

Denis Pinkas

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92G9cS5077566; Mon, 2 Oct 2006 09:09:38 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92G9c2F077565; Mon, 2 Oct 2006 09:09:38 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp1.nist.gov [129.6.16.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92G9bhi077551 for ; Mon, 2 Oct 2006 09:09:38 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k92G9SKE019721 for ; Mon, 2 Oct 2006 12:09:29 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k92G9He3010627 for ; Mon, 2 Oct 2006 12:09:18 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Mon, 02 Oct 2006 12:10:10 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: pkix
Subject: Use of authorityInfoAccess extension (id-ad-caIssuers accessMethod) in an attribute certificate
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

All,

At the previous IETF meeting there was a question about the use of the
id-ad-caIssuers access method of the authorityInfoAccess extension in
attribute certificates.  After some discussion, it seemed to have been
generally agreed that it would be acceptable to use this access method
to aid relying parties in locating the public key certificate needed to
verify the signature on the attribute certificate.  In order to help
ensure that this access method is used in a consistent manner when
included in an attribute certificate, I wrote a very short Internet
Draft describing its use.  The Internet Draft is now available at
http://www.ietf.org/internet-drafts/draft-cooper-pkix-aiaac-00.txt.
The I-D is written as an update to RFC 3281 and it was created by
liberally copying from RFC 4325 (Internet X.509 Public Key
Infrastructure Authority Information Access Certificate Revocation List
(CRL) Extension).

You may notice that the description of the rules for HTTP URIs is the
same as in RFC 4325 and in the latest draft of 3280bis.  There is no
need to comment on that.  I intend to align the text in this document
to align with whatever is agreed to for the text in 3280bis.

Dave

-------- Original Message --------

Subject:

Re: draft-ietf-pkix-rfc3280bis-04.txt

Date:

Fri, 14 Jul 2006 11:31:30 -0400

From:

David A. Cooper <[email-masked]>

To:

David Chadwick <[email-masked]>

CC:

pkix <[email-masked]>

References:

<[email-masked]>
<[email-masked]>

David,

The AKI extension cannot be used as a pointer to the certificate needed
to verify the signature on the certificate containing the extension.
This is the reason that we need the id-ad-caIssuers access method of the
AIA extension in addition to the AKI extension in both public key
certificates and CRLs even though the AKI extension is also defined for
inclusion in these as well.

The problem with using the AKI extension is that the GeneralNames field
in AKI is not defined as a pointer to the certificate of interest. The
authorityCertIssuer field is used in combination with the
authorityCertSerialNumber field to identify a certificate by issuer name
and serial number. Thus, the authorityCertIssuer field specifies the
name(s) of the issuer of the certificate whose subject public key can be
used to verify the signature on the object (e.g., certificate or CRL)
that contains the AKI extension. So, I don't see how the
authorityCertIssuer field could point to the certificate of interest
when the field is the identifier of a certificate issuer, an issuer that
has most likely issued more than one certificate.

I believe that the correct solution is to specify the use of the AIA
extension in an attribute certificate. Since the PKIX profile for
attribute certificates (RFC 3281) does not support delegation, I do not
see the PKIX WG specifying an access method for pointing to other
attribute certificates, but I think it would be appropriate for PKIX to
specify an access method for inclusion in an attribute certificate that
points to the public key certificate(s) that can be used to verify the
signature on the attribute certificate. Of course, any such work should
be written as a separate I-D that updates RFC 3281 rather than being
done as part of any current I-D.

Since an AIA access method that points to the public key certificate(s)
needed to verify the signature on an attribute certificate that includes
the extension seems consistent with the use of the id-ad-caIssuers
access method in public key certificates and CRLs, I think it would be
acceptable to use the id-ad-caIssuers OID for this purpose in attribute
certificates as well, but one could just as easily define a new OID.

If the id-ad-caIssuers access method is to be used, then I think that
PKIX should specify its use since PKIX "owns" the OID. In order to help
things progress in this area, I put together a very short I-D that that
specifies the use of the id-ad-caIssuers access point to point to the
public key certificate(s) whose subject public key(s) can be used to
verify the signature on the attribute certificate that includes the
extension. I simply took RFC 4325 (Internet X.509 Public Key
Infrastructure Authority Information Access Certificate Revocation List
(CRL) Extension) and replaced "CRL" with "attribute certificate". It
would, of course, be very easy to change the draft to specify a
different OID for the access method. If anyone is interested in seeing
this, I can send a copy.

Dave

David Chadwick wrote:
> Carl Wallace wrote:
>> Identifying a public key is not the same as pointing to a PKC. The AKID
>> extension will not do what you seem to want.
>
> Carl
>
> since the syntax of AKID and AIA are both GeneralNames, then it seems
> obvious to me that a url can be used in both to point to the location
> where the issuer's cert can be found, as the text in AIA describes.
> (In fact AIA caIssuers is not really needed is it?)
>
>> It is easy enough to use
>> id-caIssuers to point to a PKC used to verify an attribute certificate
>> signature and to define a new access method to point to an attribute
>> certificate that precedes the attribute certificate containing the
>> extension in a PMI chain.
>
> Sure, this is an alternative way of doing it. We can do this if
> concensus is that this is the best way
>
>
> Further overloading id-caIssuers, which can
>> already point to a PKCS7 blob or a cert, to point to attribute
>> certificates is a bad idea, in my opinion.
>>
>
> It all depends upon the semantics of caIssuers. Can it only point to
> the CA issuer or can it point to the issuer (as is used in CRLs). This
> is the point that I am trying to clarify
>
>
> thanks
>
> David

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Ffso2065375; Mon, 2 Oct 2006 08:41:54 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92FfsRq065374; Mon, 2 Oct 2006 08:41:54 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from DS580.ds580.dedicated.turbodns.co.uk (ds580.dedicated.turbodns.co.uk [81.21.72.161]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Ffi2t065313 for ; Mon, 2 Oct 2006 08:41:53 -0700 (MST) (envelope-from [email-masked])
Message-Id: <[email-masked]>
Received: from LKNew ([80.229.241.129]) by ds580.dedicated.turbodns.co.uk with MailEnable ESMTP; Mon, 02 Oct 2006 15:49:44 +0000
From: "Liaquat Khan"
To: "'Peter Hesse'" , "=?iso-8859-1?Q?'Michael_Str=F6der'?=" ,
Subject: RE: Complete CRLs with expired certs?
Date: Mon, 2 Oct 2006 16:41:39 +0100
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
Thread-Index: AcbmDjwqN9FJJk2hTcO91ARBb2PhBAAF/7YQAAIyBLA=
In-Reply-To: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k92Ffr2t065366
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

If a CA is continuing to list expired certificates this leads to some
ambiguity I think, i.e.:

- will it only continue to list those certificates which were revoked during
their lifetime and subsequently expired, or
- will it also list those certificates which were only revoked subsequent to
their expiry?

I would have thought generally CAs will want to avoid the second case above
(i.e. having to process revocation requests for certificates which have
expired)...I am not sure if there is a use case for wanting to revoke
already expired certificates?

Regards,
LK

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Peter Hesse
Sent: 02 October 2006 14:34
To: 'Michael Ströder'; [email-masked]
Subject: RE: Complete CRLs with expired certs?

Michael,

My impression has always been that listing expired certificates on a CRL is
OK; in fact the section on Delta CRLs (5.2.4) makes this clear:

If a certificate revocation notice first appears on a delta CRL, then
it is possible for the certificate validity period to expire before
the next complete CRL for the same scope is issued. In this case,
the revocation notice MUST be included in all subsequent delta CRLs
until the revocation notice is included on at least one explicitly
issued complete CRL for this scope.

The "at least one" at the end of that paragraph seems to make it
permissible. If it read "exactly one" then I think having expired
certificates on your CRL would be against the standard.

The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:

8.5.2.12 Expired certificates on CRL extension
This CRL extension field indicates that the CRL includes revocation
notices for expired certificates.

expiredCertsOnCRL EXTENSION ::= {
SYNTAX ExpiredCertsOnCRL
IDENTIFIED BY id-ce-expiredCertsOnCRL }

ExpiredCertsOnCRL :: = GeneralizedTime

This all being said, including expired certificates on the CRL makes your
CRL larger. A lot of organizations are doing everything they can to fight
this trend, including adopting OCSP. Having two CRLs as you said -- perhaps
one with the above referenced extension -- would probably be your best bet.

--Peter

+----------------------------------------------------------------+
| Peter Hesse [email-masked] |
| Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
| New! Visit our InfoSecurity industry blog: securitymusings.com |
+----------------------------------------------------------------+
"Security is mostly a superstition. It does not exist in nature...
Life is either a daring adventure or nothing." --Helen Keller

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Michael Ströder
Sent: Monday, October 02, 2006 5:49 AM
To: [email-masked]
Subject: Complete CRLs with expired certs?

HI!

Hope this hasn't discussed before:

Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:

A complete CRL lists all unexpired certificates, within its scope,
that have been revoked for one of the revocation reasons covered by
the CRL scope. A full and complete CRL lists all unexpired
certificates issued by a CA that have been revoked for any reason.

What I'm looking at is "lists all unexpired certificates". Is this a MUST,
SHOULD or a "MUST at least list all unexpired certificates"? Is it compliant
with PKIX to also list expired certificates in the complete CRL?

Would it be possible to generate two complete CRL lists, 1. one containing
only unexpired and revoked certificates and 2. another containing expired
and revoked certificates?

CRL 2. would preserve the time a particular cert was revoked even after
expiration of this cert.

Ciao, Michael.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92FUdsX061671; Mon, 2 Oct 2006 08:30:39 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92FUdRr061670; Mon, 2 Oct 2006 08:30:39 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from nelson.textdrive.com (nelson.textdrive.com [207.7.108.85]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92FUcHC061622 for ; Mon, 2 Oct 2006 08:30:38 -0700 (MST) (envelope-from [email-masked])
Received: from petert43 (72-254-20-27.client.stsn.net [72.254.20.27]) by nelson.textdrive.com (Postfix) with ESMTP id BECFE450FA; Mon, 2 Oct 2006 15:30:32 +0000 (GMT)
From: "Peter Hesse"
To: "'David A. Cooper'"
Cc: "=?iso-8859-1?Q?'Michael_Str=F6der'?=" , "'pkix'"
Subject: RE: Complete CRLs with expired certs?
Date: Mon, 2 Oct 2006 11:30:10 -0400
Message-ID: <[email-masked]>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Thread-Index: AcbmNzAHCTFrYdOKRMWm8VmmtjiLfQAACfSA
In-Reply-To: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k92FUcHC061665
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

You know, I mis-read what Michael had written. I agree that you would need
two CRLs: one with all revoked un-expired certificates, and the optional
second one with all revoked certificates including those that have expired.
And, as a general rule, I would point relying parties at the first one.

I did not mean to imply it was acceptable to issue a CRL containing only
expired certificates, I agree that there wouldn't be a safe way to
distinguish it from the "real" CRL.

--Peter

-----Original Message-----
From: David A. Cooper [mailto:[email-masked]]
Sent: Monday, October 02, 2006 11:27 AM
To: Peter Hesse
Cc: 'Michael Ströder'; pkix
Subject: Re: Complete CRLs with expired certs?

Peter,

I agree that a compliant CRL issuer may include expired certificates on a
CRL. Expired certificates may be included in a CRL whether or not the
expiredCertsOnCRL extension is included in the CRL. The expiredCertsOnCRL
extension simply provides a way to inform relying parties that the scope of
the CRL includes expired certificates.

I do not believe that there is currently a way to issue CRLs in the way that
Michael suggested: one that only covers unexpired certificates and one that
only covers expired certificates. A CRL MUST list "all unexpired
certificates certificates, within its scope, that have been revoked for one
of the revocation reasons covered by the CRL scope".
So, the closest one could come would be to issue one CRL that only covers
unexpired certificates and one that covers both expired and unexpired
certificates. While it would not be necessary to issue two CRLs, there is
the risk that the CRL that covers expired certificates would grow very large
and issuing two CRLs would ensure that most relying parties could use the
smaller CRL that only covered unexpired certificates. (Note that in order
to be able to issue two CRLs where one CRL only covered expired
certificates, it would be necessary to define a new CRL extension, and that
extension would have to be marked as critical.)

There are a couple of ways that one could avoid the problem of CRLs becoming
too large. The first is to use CRL distribution points, with each
distribution point covering a limited number of certificates. The other
option is to create a new CA every so often so that the number of
certificates issued by any given CA is limited (one could continue to use
the same hardware and software, but just issue under a different CA name and
key pair). In either case a CRL would initially cover only unexpired
certificates, but over time all of the certificates covered by the CRL would
expire at which point the CRL would only cover expired certificates. Since
these options would prevent CRLs from becoming too large, there would be no
need to issue two CRLs during the transition period during which some
certificates within the scope of a CRL are expired while others are still
unexpired.

Dave

Peter Hesse wrote:
> Michael,
>
> My impression has always been that listing expired certificates on a
> CRL is OK; in fact the section on Delta CRLs (5.2.4) makes this clear:
>
> If a certificate revocation notice first appears on a delta CRL, then
> it is possible for the certificate validity period to expire before
> the next complete CRL for the same scope is issued. In this case,
> the revocation notice MUST be included in all subsequent delta CRLs
> until the revocation notice is included on at least one explicitly
> issued complete CRL for this scope.
>
> The "at least one" at the end of that paragraph seems to make it
> permissible. If it read "exactly one" then I think having expired
> certificates on your CRL would be against the standard.
>
> The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:
>
> 8.5.2.12 Expired certificates on CRL extension
> This CRL extension field indicates that the CRL includes revocation
> notices for expired certificates.
>
> expiredCertsOnCRL EXTENSION ::= {
> SYNTAX ExpiredCertsOnCRL
> IDENTIFIED BY id-ce-expiredCertsOnCRL }
>
> ExpiredCertsOnCRL :: = GeneralizedTime
>
> This all being said, including expired certificates on the CRL makes
> your CRL larger. A lot of organizations are doing everything they can
> to fight this trend, including adopting OCSP. Having two CRLs as you
> said -- perhaps one with the above referenced extension -- would probably
be your best bet.
>
> --Peter
>
> +----------------------------------------------------------------+
> | Peter Hesse [email-masked] |
> | Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
> | New! Visit our InfoSecurity industry blog: securitymusings.com |
> +----------------------------------------------------------------+
> "Security is mostly a superstition. It does not exist in nature...
> Life is either a daring adventure or nothing." --Helen Keller
>
> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Michael Ströder
> Sent: Monday, October 02, 2006 5:49 AM
> To: [email-masked]
> Subject: Complete CRLs with expired certs?
>
>
> HI!
>
> Hope this hasn't discussed before:
>
> Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:
>
> A complete CRL lists all unexpired certificates, within its scope,
> that have been revoked for one of the revocation reasons covered by
> the CRL scope. A full and complete CRL lists all unexpired
> certificates issued by a CA that have been revoked for any reason.
>
> What I'm looking at is "lists all unexpired certificates". Is this a
> MUST, SHOULD or a "MUST at least list all unexpired certificates"? Is
> it compliant with PKIX to also list expired certificates in the complete
CRL?
>
> Would it be possible to generate two complete CRL lists, 1. one
> containing only unexpired and revoked certificates and 2. another
> containing expired and revoked certificates?
>
> CRL 2. would preserve the time a particular cert was revoked even
> after expiration of this cert.
>
> Ciao, Michael.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92FQsDm057897; Mon, 2 Oct 2006 08:26:54 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92FQsnT057896; Mon, 2 Oct 2006 08:26:54 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from smtp.nist.gov (rimp1.nist.gov [129.6.16.226]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92FQreV057882 for ; Mon, 2 Oct 2006 08:26:54 -0700 (MST) (envelope-from [email-masked])
Received: from postmark.nist.gov (pushme.nist.gov [129.6.16.92]) by smtp.nist.gov (8.13.1/8.13.1) with ESMTP id k92FQRJS019526; Mon, 2 Oct 2006 11:26:28 -0400
Received: from [129.6.54.72] (st26.ncsl.nist.gov [129.6.54.72]) by postmark.nist.gov (8.13.7/8.13.7) with ESMTP id k92FPqB6018182; Mon, 2 Oct 2006 11:25:52 -0400 (EDT)
Message-ID: <[email-masked]>
Date: Mon, 02 Oct 2006 11:26:46 -0400
From: "David A. Cooper"
User-Agent: Thunderbird 1.5.0.7 (X11/20060921)
MIME-Version: 1.0
To: Peter Hesse
CC: =?ISO-8859-1?Q?=27Michael_Str=F6der=27?= , pkix
Subject: Re: Complete CRLs with expired certs?
References: <[email-masked]>
In-Reply-To: <[email-masked]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
X-NIST-MailScanner: Found to be clean
X-NIST-MailScanner-From: [email-masked]
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Peter,

I agree that a compliant CRL issuer may include expired certificates on
a CRL. Expired certificates may be included in a CRL whether or not the
expiredCertsOnCRL extension is included in the CRL. The
expiredCertsOnCRL extension simply provides a way to inform relying
parties that the scope of the CRL includes expired certificates.

I do not believe that there is currently a way to issue CRLs in the way
that Michael suggested: one that only covers unexpired certificates and
one that only covers expired certificates. A CRL MUST list "all
unexpired certificates certificates, within its scope, that have been
revoked for one of the revocation reasons covered by the CRL scope".
So, the closest one could come would be to issue one CRL that only
covers unexpired certificates and one that covers both expired and
unexpired certificates. While it would not be necessary to issue two
CRLs, there is the risk that the CRL that covers expired certificates
would grow very large and issuing two CRLs would ensure that most
relying parties could use the smaller CRL that only covered unexpired
certificates. (Note that in order to be able to issue two CRLs where
one CRL only covered expired certificates, it would be necessary to
define a new CRL extension, and that extension would have to be marked
as critical.)

There are a couple of ways that one could avoid the problem of CRLs
becoming too large. The first is to use CRL distribution points, with
each distribution point covering a limited number of certificates. The
other option is to create a new CA every so often so that the number of
certificates issued by any given CA is limited (one could continue to
use the same hardware and software, but just issue under a different CA
name and key pair). In either case a CRL would initially cover only
unexpired certificates, but over time all of the certificates covered by
the CRL would expire at which point the CRL would only cover expired
certificates. Since these options would prevent CRLs from becoming too
large, there would be no need to issue two CRLs during the transition
period during which some certificates within the scope of a CRL are
expired while others are still unexpired.

Dave

Peter Hesse wrote:
> Michael,
>
> My impression has always been that listing expired certificates on a CRL is
> OK; in fact the section on Delta CRLs (5.2.4) makes this clear:
>
> If a certificate revocation notice first appears on a delta CRL, then
> it is possible for the certificate validity period to expire before
> the next complete CRL for the same scope is issued. In this case,
> the revocation notice MUST be included in all subsequent delta CRLs
> until the revocation notice is included on at least one explicitly
> issued complete CRL for this scope.
>
> The "at least one" at the end of that paragraph seems to make it
> permissible. If it read "exactly one" then I think having expired
> certificates on your CRL would be against the standard.
>
> The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:
>
> 8.5.2.12 Expired certificates on CRL extension
> This CRL extension field indicates that the CRL includes revocation
> notices for expired certificates.
>
> expiredCertsOnCRL EXTENSION ::= {
> SYNTAX ExpiredCertsOnCRL
> IDENTIFIED BY id-ce-expiredCertsOnCRL }
>
> ExpiredCertsOnCRL :: = GeneralizedTime
>
> This all being said, including expired certificates on the CRL makes your
> CRL larger. A lot of organizations are doing everything they can to fight
> this trend, including adopting OCSP. Having two CRLs as you said -- perhaps
> one with the above referenced extension -- would probably be your best bet.
>
> --Peter
>
> +----------------------------------------------------------------+
> | Peter Hesse [email-masked] |
> | Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
> | New! Visit our InfoSecurity industry blog: securitymusings.com |
> +----------------------------------------------------------------+
> "Security is mostly a superstition. It does not exist in nature...
> Life is either a daring adventure or nothing." --Helen Keller
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Michael Ströder
> Sent: Monday, October 02, 2006 5:49 AM
> To: [email-masked]
> Subject: Complete CRLs with expired certs?
>
>
> HI!
>
> Hope this hasn't discussed before:
>
> Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:
>
> A complete CRL lists all unexpired certificates, within its scope,
> that have been revoked for one of the revocation reasons covered by
> the CRL scope. A full and complete CRL lists all unexpired
> certificates issued by a CA that have been revoked for any reason.
>
> What I'm looking at is "lists all unexpired certificates". Is this a MUST,
> SHOULD or a "MUST at least list all unexpired certificates"? Is it compliant
> with PKIX to also list expired certificates in the complete CRL?
>
> Would it be possible to generate two complete CRL lists, 1. one containing
> only unexpired and revoked certificates and 2. another containing expired
> and revoked certificates?
>
> CRL 2. would preserve the time a particular cert was revoked even after
> expiration of this cert.
>
> Ciao, Michael.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Eo8rm040112; Mon, 2 Oct 2006 07:50:08 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92Eo8Ef040111; Mon, 2 Oct 2006 07:50:08 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from ns0.neustar.com (ns0.neustar.com [156.154.16.158]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Eo7hO040096 for ; Mon, 2 Oct 2006 07:50:07 -0700 (MST) (envelope-from [email-masked])
Received: from stiedprstage1.ietf.org (stiedprstage1.va.neustar.com [10.31.47.10]) by ns0.neustar.com (Postfix) with ESMTP id D421D3287D; Mon, 2 Oct 2006 14:50:01 +0000 (GMT)
Received: from ietf by stiedprstage1.ietf.org with local (Exim 4.43) id 1GUP7J-0005xc-M8; Mon, 02 Oct 2006 10:50:01 -0400
Content-Type: Multipart/Mixed; Boundary="NextPart"
Mime-Version: 1.0
To: [email-masked]
Cc: [email-masked]
From: [email-masked]
Subject: I-D ACTION:draft-ietf-pkix-lightweight-ocsp-profile-07.txt
Message-Id:
Date: Mon, 02 Oct 2006 10:50:01 -0400
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the Public-Key Infrastructure (X.509) Working Group of the IETF.

Title : Lightweight OCSP Profile for High Volume Environments
Author(s) : R. Hurst, A. Deacon
Filename : draft-ietf-pkix-lightweight-ocsp-profile-07.txt
Pages : 20
Date : 2006-10-2

This specification defines a profile of the Online Certificate
Status Protocol (OCSP) that addresses the scalability issues
inherent when using OCSP in large scale (high volume) PKI
environments and/or in PKI environments that require a lightweight
solution to minimize communication bandwidth and client side
processing.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-pkix-lightweight-ocsp-profile-07.txt

To remove yourself from the I-D Announcement list, send a message to
[email-masked] with the word unsubscribe in the body of
the message.
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the
username "anonymous" and a password of your e-mail address. After
logging in, type "cd internet-drafts" and then
"get draft-ietf-pkix-lightweight-ocsp-profile-07.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
[email-masked].
In the body type:
"FILE /internet-drafts/draft-ietf-pkix-lightweight-ocsp-profile-07.txt".

NOTE: The mail server at ietf.org can return the document in
MIME-encoded form by using the "mpack" utility. To use this
feature, insert the command "ENCODING mime" before the "FILE"
command. To decode the response(s), you will need "munpack" or
a MIME-compliant mail reader. Different MIME-compliant mail readers
exhibit different behavior, especially when dealing with
"multipart" MIME messages (i.e. documents which have been split
up into multiple messages), so check your local documentation on
how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
access-type="mail-server";
server="[email-masked]"

Content-Type: text/plain
Content-ID: <[email-masked]>

ENCODING mime
FILE /internet-drafts/draft-ietf-pkix-lightweight-ocsp-profile-07.txt

--OtherAccess
Content-Type: Message/External-body;
name="draft-ietf-pkix-lightweight-ocsp-profile-07.txt";
site="ftp.ietf.org";
access-type="anon-ftp";
directory="internet-drafts"

Content-Type: text/plain
Content-ID: <[email-masked]>

--OtherAccess--

--NextPart--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92EiC68038312; Mon, 2 Oct 2006 07:44:12 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92EiC7v038310; Mon, 2 Oct 2006 07:44:12 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from odin2.bull.net (odin2.bull.net [129.184.85.11]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92Ei8et038272 for ; Mon, 2 Oct 2006 07:44:11 -0700 (MST) (envelope-from [email-masked])
Received: from MSGA-001.frcl.bull.fr (msga-mcl1.frcl.bull.fr [129.184.87.20]) by odin2.bull.net (8.9.3/8.9.3) with ESMTP id QAA37148 for ; Mon, 2 Oct 2006 16:46:13 +0200
Received: from frcls4013 ([129.182.108.120]) by MSGA-001.frcl.bull.fr (Lotus Domino Release 5.0.11) with SMTP id 2006100216440601:109702 ; Mon, 2 Oct 2006 16:44:06 +0200
Date: Mon, 2 Oct 2006 16:44:04 +0200
From: "Denis Pinkas"
To: "[email-masked]"
Subject: Re: Complete CRLs with expired certs?
X-mailer: Foxmail 5.0 [-fr-]
Mime-Version: 1.0
X-MIMETrack: Itemize by SMTP Server on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 02/10/2006 16:44:06, Serialize by Router on MSGA-001/FR/BULL(Release 5.0.11 |July 24, 2002) at 02/10/2006 16:44:07, Serialize complete at 02/10/2006 16:44:07
Message-ID:
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from base64 to 8bit by balder-227.proper.com id k92EiCet038304
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

In order to complement, but correct the sentence : "listing expired certificates on a CRL is OK".

PKIX does not currently support the new X.509 extension mentionned hereafter.

PKIX compliant CRLs shall include the serial number of expired certificates
one time more after the expiration date of the certificate (placing delta CRL
aside for simplicity).

They might last it longer, but then there is no garantee that the revoked certificates
serial numbers are present, (unless the new X.509 extension is being used),
so if maintained longer, PKIX compliant CRLs cannot be used to know whether
a given certificate was revoked or not, once that certificate has expired.

As a conclusion: "listing expired certificates on a PKIX compliant CRL is useless".

Denis

>Michael,
>
>My impression has always been that listing expired certificates on a CRL is
>OK; in fact the section on Delta CRLs (5.2.4) makes this clear:
>
> If a certificate revocation notice first appears on a delta CRL, then
> it is possible for the certificate validity period to expire before
> the next complete CRL for the same scope is issued. In this case,
> the revocation notice MUST be included in all subsequent delta CRLs
> until the revocation notice is included on at least one explicitly
> issued complete CRL for this scope.
>
>The "at least one" at the end of that paragraph seems to make it
>permissible. If it read "exactly one" then I think having expired
>certificates on your CRL would be against the standard.
>
>The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:
>
> 8.5.2.12 Expired certificates on CRL extension
> This CRL extension field indicates that the CRL includes revocation
> notices for expired certificates.
>
> expiredCertsOnCRL EXTENSION ::= {
> SYNTAX ExpiredCertsOnCRL
> IDENTIFIED BY id-ce-expiredCertsOnCRL }
>
> ExpiredCertsOnCRL :: = GeneralizedTime
>
>This all being said, including expired certificates on the CRL makes your
>CRL larger. A lot of organizations are doing everything they can to fight
>this trend, including adopting OCSP. Having two CRLs as you said -- perhaps
>one with the above referenced extension -- would probably be your best bet.
>
>--Peter
>
>+----------------------------------------------------------------+
>| Peter Hesse [email-masked] |
>| Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
>| New! Visit our InfoSecurity industry blog: securitymusings.com |
>+----------------------------------------------------------------+
>"Security is mostly a superstition. It does not exist in nature...
> Life is either a daring adventure or nothing." --Helen Keller
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On
>Behalf Of Michael Ströder
>Sent: Monday, October 02, 2006 5:49 AM
>To: [email-masked]
>Subject: Complete CRLs with expired certs?
>
>
>HI!
>
>Hope this hasn't discussed before:
>
>Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:
>
> A complete CRL lists all unexpired certificates, within its scope,
> that have been revoked for one of the revocation reasons covered by
> the CRL scope. A full and complete CRL lists all unexpired
> certificates issued by a CA that have been revoked for any reason.
>
>What I'm looking at is "lists all unexpired certificates". Is this a MUST,
>SHOULD or a "MUST at least list all unexpired certificates"? Is it compliant
>with PKIX to also list expired certificates in the complete CRL?
>
>Would it be possible to generate two complete CRL lists, 1. one containing
>only unexpired and revoked certificates and 2. another containing expired
>and revoked certificates?
>
>CRL 2. would preserve the time a particular cert was revoked even after
>expiration of this cert.
>
>Ciao, Michael.
>
>
>

Regards,

Denis Pinkas

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92DYkem025063; Mon, 2 Oct 2006 06:34:46 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k92DYk6D025062; Mon, 2 Oct 2006 06:34:46 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from nelson.textdrive.com (nelson.textdrive.com [207.7.108.85]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k92DYjwZ025046 for ; Mon, 2 Oct 2006 06:34:45 -0700 (MST) (envelope-from [email-masked])
Received: from petert43 (72-254-20-27.client.stsn.net [72.254.20.27]) by nelson.textdrive.com (Postfix) with ESMTP id E8586451E8; Mon, 2 Oct 2006 13:34:38 +0000 (GMT)
From: "Peter Hesse"
To: "=?iso-8859-1?Q?'Michael_Str=F6der'?=" ,
Subject: RE: Complete CRLs with expired certs?
Date: Mon, 2 Oct 2006 09:34:16 -0400
Message-ID: <[email-masked]>
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2962
Thread-Index: AcbmDjwqN9FJJk2hTcO91ARBb2PhBAAF/7YQ
In-Reply-To: <[email-masked]>
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by balder-227.proper.com id k92DYjwZ025051
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Michael,

My impression has always been that listing expired certificates on a CRL is
OK; in fact the section on Delta CRLs (5.2.4) makes this clear:

If a certificate revocation notice first appears on a delta CRL, then
it is possible for the certificate validity period to expire before
the next complete CRL for the same scope is issued. In this case,
the revocation notice MUST be included in all subsequent delta CRLs
until the revocation notice is included on at least one explicitly
issued complete CRL for this scope.

The "at least one" at the end of that paragraph seems to make it
permissible. If it read "exactly one" then I think having expired
certificates on your CRL would be against the standard.

The 2005 edition of X.509 includes an extension called expiredCertsOnCRL:

8.5.2.12 Expired certificates on CRL extension
This CRL extension field indicates that the CRL includes revocation
notices for expired certificates.

expiredCertsOnCRL EXTENSION ::= {
SYNTAX ExpiredCertsOnCRL
IDENTIFIED BY id-ce-expiredCertsOnCRL }

ExpiredCertsOnCRL :: = GeneralizedTime

This all being said, including expired certificates on the CRL makes your
CRL larger. A lot of organizations are doing everything they can to fight
this trend, including adopting OCSP. Having two CRLs as you said -- perhaps
one with the above referenced extension -- would probably be your best bet.

--Peter

+----------------------------------------------------------------+
| Peter Hesse [email-masked] |
| Phone: 703-378-5808 x105 Gemini Security Solutions, Inc. |
| New! Visit our InfoSecurity industry blog: securitymusings.com |
+----------------------------------------------------------------+
"Security is mostly a superstition. It does not exist in nature...
Life is either a daring adventure or nothing." --Helen Keller

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On
Behalf Of Michael Ströder
Sent: Monday, October 02, 2006 5:49 AM
To: [email-masked]
Subject: Complete CRLs with expired certs?

HI!

Hope this hasn't discussed before:

Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:

A complete CRL lists all unexpired certificates, within its scope,
that have been revoked for one of the revocation reasons covered by
the CRL scope. A full and complete CRL lists all unexpired
certificates issued by a CA that have been revoked for any reason.

What I'm looking at is "lists all unexpired certificates". Is this a MUST,
SHOULD or a "MUST at least list all unexpired certificates"? Is it compliant
with PKIX to also list expired certificates in the complete CRL?

Would it be possible to generate two complete CRL lists, 1. one containing
only unexpired and revoked certificates and 2. another containing expired
and revoked certificates?

CRL 2. would preserve the time a particular cert was revoked even after
expiration of this cert.

Ciao, Michael.

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k929naQA076502; Mon, 2 Oct 2006 02:49:36 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k929naC8076500; Mon, 2 Oct 2006 02:49:36 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from srv1.int.stroeder.com (14-0-124-83.dsl.3u.net [83.124.0.14]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k929nYQi076489 for ; Mon, 2 Oct 2006 02:49:35 -0700 (MST) (envelope-from [email-masked])
Received: from localhost (localhost [127.0.0.1]) by srv1.int.stroeder.com (Postfix) with ESMTP id 86DA15356 for ; Mon, 2 Oct 2006 11:49:27 +0200 (CEST)
Received: from srv1.int.stroeder.com ([127.0.0.1]) by localhost (srv1 [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 18720-07 for ; Mon, 2 Oct 2006 11:49:10 +0200 (CEST)
Received: from [10.1.1.5] (unknown [10.1.1.5]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "Michael Stroeder", Issuer "Thawte Personal Freemail Issuing CA" (not verified)) by srv1.int.stroeder.com (Postfix) with ESMTP id 8D71D533E for ; Mon, 2 Oct 2006 11:49:10 +0200 (CEST)
Message-ID: <[email-masked]>
Date: Mon, 02 Oct 2006 11:49:08 +0200
From: =?ISO-8859-1?Q?Michael_Str=F6der?=
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060417
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: [email-masked]
Subject: Complete CRLs with expired certs?
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: amavisd-new at int.stroeder.com
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

HI!

Hope this hasn't discussed before:

Section 5 of RFC 3280 (and draft-ietf-pkix-rfc3280bis-04) states:

A complete CRL lists all unexpired certificates, within its scope,
that have been revoked for one of the revocation reasons covered by
the CRL scope. A full and complete CRL lists all unexpired
certificates issued by a CA that have been revoked for any reason.

What I'm looking at is "lists all unexpired certificates". Is this a
MUST, SHOULD or a "MUST at least list all unexpired certificates"? Is it
compliant with PKIX to also list expired certificates in the complete CRL?

Would it be possible to generate two complete CRL lists,
1. one containing only unexpired and revoked certificates and
2. another containing expired and revoked certificates?

CRL 2. would preserve the time a particular cert was revoked even after
expiration of this cert.

Ciao, Michael.

Received: from acsworldwide.com ([201.19.148.162]) by balder-227.proper.com (8.13.5/8.13.5) with SMTP id k91K9CMc067301 for ; Sun, 1 Oct 2006 13:09:15 -0700 (MST) (envelope-from [email-masked])
Message-ID: <01c6e595$650c98d0$03fea8c0@funaba>
Date: Sun, 1 Oct 2006 17:08:43 -0300
X-MSMail-Priority: Normal
X-Priority: 3
Reply-To: "Conlaoch Pitman"
From: "Conlaoch Pitman"
To:
Subject: PHfqdARMA
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_D2CF_01C6E57C.3FCECA20"
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

This is a multi-part message in MIME format.

------=_NextPart_000_D2CF_01C6E57C.3FCECA20
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Good day,

VIAttGRA

VALttIUM

AMBttIEN

CIAttLIS

Save 50 % with http://www.kotiondefunjasde.com
=20
_____ =20

We did many an encore this day. Finished finally with the feeling of
your own.
exhibition.

------=_NextPart_000_D2CF_01C6E57C.3FCECA20
Content-Type: text/html;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Good day,

VIAttGRA

VALttIUM

AMBttIEN

CIAttLIS

Save 50 % with http://www.kotiondefunjasde.com<=
/A>

We did many an encore this day. Finished finally with the =
feeling of

your own.

exhibition.

------=_NextPart_000_D2CF_01C6E57C.3FCECA20--

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k91ImN1T060369; Sun, 1 Oct 2006 11:48:23 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k91ImN3E060368; Sun, 1 Oct 2006 11:48:23 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from pne-smtpout1-sn1.fre.skanova.net (pne-smtpout1-sn1.fre.skanova.net [81.228.11.98]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k91ImMnf060358 for ; Sun, 1 Oct 2006 11:48:23 -0700 (MST) (envelope-from [email-masked])
Received: from arport2v (81.232.45.80) by pne-smtpout1-sn1.fre.skanova.net (7.2.076) (authenticated as u18116613) id 451ECC1B00023050 for [email-masked]; Sun, 1 Oct 2006 20:48:16 +0200
Message-ID: <001901c6e58a$4785dac0$82c5a8c0@arport2v>
From: "Anders Rundgren"
To:
References: <003701c6e543$d0262c50$82c5a8c0@arport2v>
Subject: NOT Re: Bug in VeriSign's PKIX Logotype Implementation?
Date: Sun, 1 Oct 2006 20:49:08 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

Error,

A friendly person off-list showed me that the DEFAULT IMPLICIT
directive is the reason why there are only 3 sequeces in a row.

thanx
Anders

----- Original Message -----
From: Anders Rundgren
To: [email-masked]
Sent: Sunday, October 01, 2006 12:24
Subject: Bug in VeriSign's PKIX Logotype Implementation?

Dear list;

Source of certificate: https://www.verisign.com

It seems that there may be a bug in VeriSign's logotype implementation.
Although there is a virtual orgie in SEQUENCEs here, there should possibly be yet one more.

Anders Rundgren

DumpASN1 extract:

037F 30 6D: SEQUENCE {
0381 06 8: OBJECT IDENTIFIER '1 3 6 1 5 5 7 1 12'
038B 04 61: OCTET STRING, encapsulates {
038D 30 5F: SEQUENCE {
038F A1 5D: [1] {
0391 A0 5B: [0] {
0393 30 59: SEQUENCE {
0395 30 57: SEQUENCE {
0397 30 55: SEQUENCE {
0399 16 9: IA5String 'image/gif'
03A4 30 21: SEQUENCE {
03A6 30 1F: SEQUENCE {
03A8 30 7: SEQUENCE {
03AA 06 5: OBJECT IDENTIFIER
: sha1 (1 3 14 3 2 26)
: }
03B1 04 14: OCTET STRING
: 8F E5 D3 1A 86 AC 8D 8E 6B C3 CF 80 6A D4 48 18
: 2C 7B 19 2E
: }
: }
03C7 30 25: SEQUENCE {
03C9 16 23: IA5String 'http://logo.verisign.com/vslogo.gif'
: }

Extract of RFC 3709:

LogotypeExtn ::= SEQUENCE {
communityLogos [0] EXPLICIT SEQUENCE OF LogotypeInfo OPTIONAL,
issuerLogo [1] EXPLICIT LogotypeInfo OPTIONAL,
subjectLogo [2] EXPLICIT LogotypeInfo OPTIONAL,
otherLogos [3] EXPLICIT SEQUENCE OF OtherLogotypeInfo OPTIONAL }

LogotypeInfo ::= CHOICE {
direct [0] LogotypeData,
indirect [1] LogotypeReference }

LogotypeData ::= SEQUENCE {
image SEQUENCE OF LogotypeImage OPTIONAL,
audio [1] SEQUENCE OF LogotypeAudio OPTIONAL }

LogotypeImage ::= SEQUENCE {
imageDetails LogotypeDetails,
imageInfo LogotypeImageInfo OPTIONAL }

LogotypeDetails ::= SEQUENCE {
mediaType IA5String, -- MIME media type name and optional
-- parameters
logotypeHash SEQUENCE SIZE (1..MAX) OF HashAlgAndValue,
logotypeURI SEQUENCE SIZE (1..MAX) OF IA5String }

HashAlgAndValue ::= SEQUENCE {
hashAlg AlgorithmIdentifier,
hashValue OCTET STRING }

Received: from balder-227.proper.com (localhost [127.0.0.1]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k91AOr1k009447; Sun, 1 Oct 2006 03:24:53 -0700 (MST) (envelope-from [email-masked])
Received: (from majordom@localhost) by balder-227.proper.com (8.13.5/8.13.5/Submit) id k91AOr45009446; Sun, 1 Oct 2006 03:24:53 -0700 (MST) (envelope-from [email-masked])
X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f
Received: from pne-smtpout1-sn2.hy.skanova.net (pne-smtpout1-sn2.hy.skanova.net [81.228.8.83]) by balder-227.proper.com (8.13.5/8.13.5) with ESMTP id k91AOqd6009437 for ; Sun, 1 Oct 2006 03:24:52 -0700 (MST) (envelope-from [email-masked])
Received: from arport2v (81.232.45.80) by pne-smtpout1-sn2.hy.skanova.net (7.2.075) (authenticated as u18116613) id 4516FC41001BD8C2 for [email-masked]; Sun, 1 Oct 2006 12:24:46 +0200
Message-ID: <003701c6e543$d0262c50$82c5a8c0@arport2v>
From: "Anders Rundgren"
To:
Subject: Bug in VeriSign's PKIX Logotype Implementation?
Date: Sun, 1 Oct 2006 12:24:43 +0200
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_NextPart_000_0034_01C6E554.93462860"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Sender: [email-masked]
Precedence: bulk
List-Archive:
List-ID:
List-Unsubscribe:

This is a multi-part message in MIME format.

------=_NextPart_000_0034_01C6E554.93462860
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear list;

Source of certificate: https://www.verisign.com

It seems that there may be a bug in VeriSign's logotype implementation.
Although there is a virtual orgie in SEQUENCEs here, there should =
possibly be yet one more.

Anders Rundgren

DumpASN1 extract:

037F 30 6D: SEQUENCE {
0381 06 8: OBJECT IDENTIFIER '1 3 6 1 5 5 7 1 12'
038B 04 61: OCTET STRING, encapsulates {
038D 30 5F: SEQUENCE {
038F A1 5D: [1] {
0391 A0 5B: [0] {
0393 30 59: SEQUENCE {
0395 30 57: SEQUENCE {
0397 30 55: SEQUENCE {
0399 16 9: IA5String 'image/gif'
03A4 30 21: SEQUENCE {
03A6 30 1F: SEQUENCE {
03A8 30 7: SEQUENCE {
03AA 06 5: OBJECT IDENTIFIER
: sha1 (1 3 14 3 2 26)
: }
03B1 04 14: OCTET STRING
: 8F E5 D3 1A 86 AC 8D 8E 6B C3 CF 80 6A =
D4 48 18
: 2C 7B 19 2E
: }
: }
03C7 30 25: SEQUENCE {
03C9 16 23: IA5String =
'http://logo.verisign.com/vslogo.gif'
: }

Extract of RFC 3709:

LogotypeExtn ::=3D SEQUENCE {
communityLogos [0] EXPLICIT SEQUENCE OF LogotypeInfo OPTIONAL,
issuerLogo [1] EXPLICIT LogotypeInfo OPTIONAL,
subjectLogo [2] EXPLICIT LogotypeInfo OPTIONAL,
otherLogos [3] EXPLICIT SEQUENCE OF OtherLogotypeInfo OPTIONAL }

LogotypeInfo ::=3D CHOICE {
direct [0] LogotypeData,
indirect [1] LogotypeReference }

LogotypeData ::=3D SEQUENCE {
image SEQUENCE OF LogotypeImage OPTIONAL,
audio [1] SEQUENCE OF LogotypeAudio OPTIONAL }

LogotypeImage ::=3D SEQUENCE {
imageDetails LogotypeDetails,
imageInfo LogotypeImageInfo OPTIONAL }

LogotypeDetails ::=3D SEQUENCE {
mediaType IA5String, -- MIME media type name and optional
-- parameters
logotypeHash SEQUENCE SIZE (1..MAX) OF HashAlgAndValue,
logotypeURI SEQUENCE SIZE (1..MAX) OF IA5String }

HashAlgAndValue ::=3D SEQUENCE {
hashAlg AlgorithmIdentifier,
hashValue OCTET STRING }

------=_NextPart_000_0034_01C6E554.93462860
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Dear list;

Source of certificate: https://www.verisign.com

It seems that there may be a =
bug in=20
VeriSign's logotype implementation.

Although there is a virtual orgie in =
SEQUENCEs=20
here, there should possibly be yet one more.

Anders Rundgren

DumpASN1 extract:

037F 30  =20
6D:         SEQUENCE {
0381=20
06   =20
8:           OBJECT =
IDENTIFIER=20
'1 3 6 1 5 5 7 1 12'
038B 04  =20
61:           OCTET =
STRING,=20
encapsulates {
038D 30  =20
5F:           &nbs=
p;  =20
SEQUENCE {
038F A1  =20
5D:           &nbs=
p;    =20
[1] {
0391 A0  =20
5B:           &nbs=
p;      =20
[0] {
0393 30  =20
59:           &nbs=
p;        =20
SEQUENCE {
0395 =
30  =20
57:           &nbs=
p;          =20
SEQUENCE {
0397 =
30  =20
55:           &nbs=
p;            =
;=20
SEQUENCE {
0399=20
16   =20
9:            =
;            =
=20
IA5String 'image/gif'
03A4 30  =20
21:           &nbs=
p;            =
;  =20
SEQUENCE {
03A6 30  =20
1F:           &nbs=
p;            =
;    =20
SEQUENCE {
03A8 30   =20
7:            =
;            =
=20
SEQUENCE {
03AA 06   =20
5:            =
;            =
=20
OBJECT=20
IDENTIFIER
=
; =20
:            =
&=
nbsp;         =20
sha1 (1 3 14 3 2=20
26)
=
=20
:            =
&=
nbsp;       =20
}
03B1 04  =20
14:           &nbs=
p;            =
;      =20
OCTET=20
STRING
&nb=
sp;=20
:            =
=20
8F E5 D3 1A 86 AC 8D 8E 6B C3 CF 80 6A D4 48=20
18
=

:            =
=20
2C 7B 19=20
2E
=

:            =
&=
nbsp;     =20
}
=20
:            =
&=
nbsp;   =20
}
03C7 30  =20
25:           &nbs=
p;            =
;  =20
SEQUENCE {
03C9 16  =20
23:           &nbs=
p;            =
;    =20
IA5String=20
'http://logo.verisign.com/vslogo.gif'
&n=
bsp;     =20
:            =
&=
nbsp;   =20
}

Extract of =
RFC=20
3709:

LogotypeExtn ::=3D=20
SEQUENCE {
communityLogos  [0] EXPLICIT SEQUENCE OF =

LogotypeInfo OPTIONAL,
=
issuerLogo     =20
[1] EXPLICIT LogotypeInfo OPTIONAL,
=20
subjectLogo     [2] EXPLICIT LogotypeInfo=20
OPTIONAL,
otherLogos      [3] =
EXPLICIT=20
SEQUENCE OF OtherLogotypeInfo OPTIONAL =
}

LogotypeInfo=20
::=3D CHOICE {
=20
direct          [0] =

LogotypeData,
=20
indirect        [1] LogotypeReference =

}

LogotypeData ::=3D SEQUENCE {
=20
image           =
SEQUENCE OF =
LogotypeImage=20
OPTIONAL,
=20
audio           [1] =
SEQUENCE=20
OF LogotypeAudio OPTIONAL }

LogotypeImage ::=3D=20
SEQUENCE {
=

imageDetails    =
LogotypeDetails,
=20
imageInfo       LogotypeImageInfo OPTIONAL =

}

LogotypeDetails ::=3D SEQUENCE {
=20
mediaType       IA5String, -- MIME media =
type name=20
and=20
optional
&=
nbsp;           &n=
bsp;      =20
-- parameters
logotypeHash    SEQUENCE =
SIZE=20
(1..MAX) OF HashAlgAndValue,
=
logotypeURI    =20
SEQUENCE SIZE (1..MAX) OF IA5String }

HashAlgAndValue ::=3D =
SEQUENCE=20
{
=
hashAlg        =20
AlgorithmIdentifier,
=20
hashValue       OCTET STRING=20
}

------=_NextPart_000_0034_01C6E554.93462860--