From 1ba6ee7746e5fad009d08a8842fb4dee0ad79da4 Mon Sep 17 00:00:00 2001 From: Nicolas Williams Date: Sat, 8 May 2021 16:21:18 -0500 Subject: [PATCH] Attestation: Add swimlane diagrams --- Attestation/Protocol-Four-Messages.png | Bin 0 -> 60782 bytes Attestation/Protocol-Four-Messages.puml | 20 ++ Attestation/Protocol-Three-Messages.png | Bin 0 -> 55368 bytes Attestation/Protocol-Three-Messages.puml | 19 ++ Attestation/Protocol-Two-Messages.png | Bin 0 -> 52365 bytes Attestation/Protocol-Two-Messages.puml | 18 ++ Attestation/README.md | 343 ++++++++++++++++++++--- Attestation/TPM2_Quote.md | 45 +++ 8 files changed, 406 insertions(+), 39 deletions(-) create mode 100644 Attestation/Protocol-Four-Messages.png create mode 100644 Attestation/Protocol-Four-Messages.puml create mode 100644 Attestation/Protocol-Three-Messages.png create mode 100644 Attestation/Protocol-Three-Messages.puml create mode 100644 Attestation/Protocol-Two-Messages.png create mode 100644 Attestation/Protocol-Two-Messages.puml create mode 100644 Attestation/TPM2_Quote.md diff --git a/Attestation/Protocol-Four-Messages.png b/Attestation/Protocol-Four-Messages.png new file mode 100644 index 0000000000000000000000000000000000000000..0102a5406f818e8e4964ea1349a331313645ab48 GIT binary patch literal 60782 zcmb4rbzD_lxAj2o z7|+=WA&{FGj`B*@fBqi=v5&ElA2S<$dEcevi`!RWmB!mxy=g(RAHJrb;(loIinyN` zs9b;7X=p;VFNyMUQkmeJ4CZm|>W>(1Mtv?tF|5p8CieUnT;F_jy^OyG2)}$F5tPGM zM_JX4LCE=vid7z8_$Y)-XBq9efIx@!t6vIpy^@)-I-<3MZipfwyNCv@FXkaVQKZZr zx4b3p(vrS^a1&zT2D!y!5FX{u7@knLt2j$FLEY@vF^7Z4*w+2Rb$f(lt z<)pTvpG#+_`IxB)7aOA1dhcHZx0c=;`P|o7!TC*HQ6NV`FEZ=}_Q1QT7(bPz`aado z9|)|TG;W49eI1XIWRnwB9_m$iB@nFXl7=&X6>?bj#a2-2@e?xcrcN>@XGHug^wo`F z7A5JS@13_r`bn zb}o`B3$DtvLOU*;;l4Kv!k1l20X?V2{iq8?_si#&2?ylw$TmKUZDx2o=-aVp{OtVo zqEd^4yh*^x=6ieZZ=cH?$7c7Ip5kg=V9)z&Nh;6YVr`!_xXngHaj!zJeBQ;_QUBm} z^@+oc9Jwv7YO95K+eb^1HAh747wp6yb(L5$O3yz;FOajMH07V@@J~Np)cfLG+C{l} zh~#v0uv$}g>j8ECNuLb%R?)0lVf{gLkXVeNXuI&;4u!tmDrY+q_4`zIDh}Ibtd+ZZ zS=x^S8c>@f?wf_BWuo&p?Ya%RC}~=M%hqe(=P<=}W1v#j**B2b5g<@*xKZe0A2VLI zIQVHxH)yOMxh)40kr}SC_hHbj7I8}w*Vpz11mX@672uP%S6iDvc?*S}@LqTtAj~7) zN92F-38RmRi1sdlpeQ+h|CdOb=&H_siL}7L%VkbE!xc&n=9!`Rz`?l(eh#e?sWRp4 zY-+to$n7r$<+p;wp3gkO#XjP#FPML~UU|T7u`$+lTBKez=z1_}oLAY!j()mrffkMg zHZ=Hg7s6q`{sbwZ`r>o_(Sk@!;QCW38ae6pr?=ji7}uY2`F(F+e;P^@xOMf(eN~zi zo+u!Y8XHOsgsV@}9RKO-&W6@T3TbiLeK5%8Q1$c;p9n|SU0}3q{i-+o^!+=NgJ*&ARQl{AVSn2tkBM4qXDY2I$vL3u6L_% ztvnf-hv)9`d!wb+=crY_nbZihjT;pyWH!v8usNWli~iA$b_>#Nay5(qa~RL*TH*Vf z$Vj(t9i5&wH#hfDO{Gl81bjO{CUM@Xxrsh**-QlE|7J$5m<#5(xLz{l+QofnGFjo! z8N(jSVUy(9n}|-xR>QeD{v-5m&R~v8iDBPDEiy?;oO9oDUwXXj$@12g1^$y4FLr#N z#tr9ddk;wJ)OsK?y~m+_)t!3rxqy|h}vS)~{(&t8)vA_FD-7&JcQ zH~CtKBz;Hk)yk}&t&0aE28&q7-&ymCG4o=u=gFW*!*6Sf+|oYkaGO&TzPnSwA?Hy2h*H5sho0E%PDNJ^39Tk0#7!|HE5?8-=8t;p|I|il@+@wmxwaSC??;=!otFlo?zCp%Zt;I@nMD8R*|HnB!kso_1+Ew zgnp4+4le{VSQ2c_%;;8MHa^ZtOHY?O1y6u^)$j}~FI#W22A4bdy2V>^? zS)Rz~X#*4Gc7;$5uhKk$a$mue5x)tg=&qPRso)1HV9BVdsST;QadwbUmm?p&eu>TC z%JWb{g7Zs;C}aM~w>SOhFdV$IsBK(AV+gJD)c%hHdjnESTJw%az@Nc!!(lP~wp8#jhwK2q)*7|LE{6Hc3z za%mFmRto_Gl8udxnVFf1iHWptzH7K-)UqHVA}TX2n&q3mz~trS^)JEi!hN@i%s@&YhSqp!aIgRhb7;tE!j(*# zXdo@?!po-(Bq1dHsenps@M+%jd!R&R9I1Q)`T|ouQL`aBhcRD+KM*ux7Zb1+K?j@vs1!hTGIR0wt-Lo zwzQ_i?{yp(yJnqNXDnx-Doq^$3Q{z&|dF1sD9#zsa<;Sr{~(E(XRV26;Bkb^$Tseq{oSp;p2Ny1aGC!V3{KF=0e0rPV8 zwVWukan8#1^SgWSxQTP4w0?!+fWUnXwamQgScr@8R8a21-=UX2YLpF6Z*4fg|9HY~ zY951xgoNioiN&v1;0lMwsGM?D?{BdY!CIUzv__FDD+Iyw(WNUf3EOj=i zGYzQSn&{N}R0OStv>K8a?120*kaSUo@2T$r>Wxoe7xH?;cYbC=iW!AjZ|GX4pM^>2 z3dib(fwT2G*w*NHFT4~A3kuBEwzy}BY!;Cq(=vZ%m~Z~k$NcO7;~)onhL!(YmwHDm z=OORqao5H9DMBcdcOw60#qR6Ni}R5|WMcbiPjntiI=bAP zoQVQmf59U%ETrg}nHieEsdUF*bsxM*T$R9Tl;Oi1mKuuG6}7qWMD_G2*4a#kpA#?l zXJQGW5pz-Q8L>GZJ?FeNAr;SQw{dp7yVev%$o|gDj?q>6$xICUEJoDHH$M#g2Cdzp z0RwsuGku1Z(V3ryHmid3MnM1z)^)!C|{bNt6rrgv)k4$;GFfNl;{PD(QbQ*-Jke z<$sPu#X6i_Fuk>% zdZAt20V|SFz{AJp?r8?L2rm`mY-1SpgDMdAm`*uv zLfoMuc@T)&T8J?5F(@G*-GU-D?A;;nc6|Ts%~XHmY4AsE=)KescigcGhg}d@5AWaa zPLqu0^F%To{>Ha~ko%#xk=Y^^0TP3}jD3X_A^&$w8SCn6KR*@GY2Lo?HQ&~F*%Epa zg1*2$Qm?_Mg|KC$7NVbmXo#FJQn5|GiS5s))=Q6J7|$Gj%BA^ZEBLL$JIHh`*Hfp5 zG$J$*wGQf?fbWmiAxzP%RdbbE3@ze9 zH;Ch|zP#r3T8NQQFj3s^*xSd2;G_^i zI30$>C#i9=99sLt8>Db)CMul{ht%Cvm6Yrkenx@}SD&j6<^&z~aBxlVYaBF5P*HP!nqZ>fpK3CnbnPP5tiG?1x*+ z)ppeKl{&=Z)JXL%cuYqMbeWuBmS9(?zI{v6g$?2IeX4`*iRg=1bBl|sO9Z7C%{{ha z6~4X$6?4nvGsuh!ef<&i>Q%PuZ>TI#P*DDVg9BZIJDJ0O9th|qYC_gpiE;b|L2dyL z_Bn#nPQWVe@8wi`6JsZ?-KE7$&zvLhJ;PVUy!yQO>sKGczPKOG4(L-1bQ{F$XB*Yk zxMPatO0n?A0zH@(hYlzf>Pc3dZcy@8kJZ(U^6s?MtgYD%Q^cXl8`d^8YS=x&fnYsv zVH_AxPfe9fyN7ju8kcy|a&5RFmUF7l)@t74`%R6fo)ONK`V}jv3mO(uNvie?spMuw z)%^ug5m5@He*OpcT(2UYvDytx*Ph3_T|9M`Gcg%59Siq6U#|M(F={!iWwQdAejiYX zOzw?Lvc{qqV*gN9!C%7BGco#WrndH6tHCo%p`$OT9w$o<8G^18!`<6U5sV*}5Loy@|0V;iG^)d9gdusPrsiu9h)3UeAy(Wsrh%Tt@k z*yTR7KHU))yIrWQMQX60=zT)WdB8dl1oPoe4F^G1hPgdjXA^~7Hp^)Wa3pXsg+ zR=+L#zPh*E6=zRsI9`g;yD@qd)%SKJbmmmcZFLQ1_Xl@GU)8zKHkU}B_6U@NFqRaZ&QGf31^*)weA z1=pSxf$f|A#fO>sGQ|)T@5S_w#U{UKg}e*0YHz2r?O(=&6}g;fD%r1zAY7j;54Lv8 zbF$Y+M%h#vnA-4teGeDsD!MqOS=I(~7&k+s%l*tb?97ZUEL05b*01srl7rs)$=<>G zSZW$ig~cy%b=MzjD+6xZl1;~6Q;IpNr%mgm8IcUY*rKTFhSiOf zJH*lGFp4HpBtgr4vfFj3Gt(ds8wxxu;IIMBW79}-X0?GB`Ftc}ys?v?%Xf@*imI#B zXc>nQ5k|duu!h$$TD%y#7)KBt&Ju}lwIGqi8J@O5M=Qb!u`M{i4ogckSTxowlz?nh zk|q3&!tUoRaRDm*&GI~4+6ps;b=^OkS9g-aMOD)ItWrF@B5D2EL66Xz;yrA)X8yNV zsg$tN`lFFl=;1kgich;(-nRS3^@bC)7 z#7km%FAqDSrzAukKHC3<5-cD%vETaCKUJMy_o^g;RC2nx85YUDxYSb(RdlmC+G?_# z72-PI3m!?Mm=7g6OAvQFxfH(K5ec=$y?z=MS5L$IIr4gCAZ-?lP*i2Bk=iT31O@3Z zJH4%{&~FM*Z)~!yJU9@b7Kqrp2_Z3y(MT&1;>Q_ zvQ=1lU+mDSPvMO6fErAp@k!ryz3r$~inwYu7Y*c+<_3X^vz@MEeVdi&&r*6_as4o; z_=)1Z(W>&&e@5`qc#eSH#n^k5(l;Gj zof<(of%96zJO8<;{;%rR|4_;SGd3*}_lf%+4t#%XZE=xZ1>a6?M1>-a!Y(GD-z=W| zX9RHvkaBFF|8p(&0#qGg>;DK>P;h>xpHCEZ_xvxQ4Ywx4S9tC0YQ2Uuio1T-1MXM| zgkzI?JD=fTY{rf5j4XmSo=&OER`0|wVi917K%{s3pF=XE;FqJfU0=?+8}$3~`7rq9 z{SKnl0uRWiqhHdF$Z?u+(`_d(*q>FnJSfNLY`LWgjLjTL$$fEBjdn&TpaXY6=ffQme*=#}X) z06MXH_s&2HMn6<`lPDtSwN*mom+gJ4UJ7|k3gfsVG6*`pyDUPv`IJOV5+9k|)IuDs6=FLm-k~5;q`po?bU02haJ? z_`udwgGAnfyhXZ$3|Z6kAoKuHQ2}{z2U2ujzl2xHT#X|0Bhl9^pfAR6zkLCHj}|O}bOHj|~||`=1AJ3k0$~f(|Cc z0`CbSLFV1&=MZ;&BU>8;OnvoMz~APoSE~iF7)>UE_GPTZTwO`2 zMFE|N;{hh7EEH;EMGvm}mc-8c5dp#_yxZoxU^$=v_9X`qZoFzViz(=%<_wY-I-W2x zGLn-E20S4rhf~J^;39Wu$1%e_$TWMD;%la0>fres8?+dxX!_q;Um6*$_+e8whzJQa zm0Hd=z!`LFH_FP>KP-EZG+h^!IZej$1L2;D-t= z?DlgDFI%TTaekqyycRyBL=7yAdZ8<3U|;}9zRcQ5_Ah9{ix+3RU41{3larT~&brGK zj}pC!F{cQ)EN29il!hDqammQYf{D4?W>da>`-C)?<*WqJhJnD;K!HEc%L=C2k}5D~ zJRQvCDs>u@&!M52dI@jHX=!r+7x3)aGjJ#EEKej7HW_0U0zGO5D?Xzdg63LqNAGgh5R$rQAa^9G55)H_tNyWd`w}Z*NdQ}H>k|u9m z)EC-K_iUdjkyMEu-gN`)fqaRaVB5*r3~u$&EXkz^Dog|PI%nsfE(IA=9;riBSs}iB zbqJ7eZSbwdOD|~=2&q}W_rjM?)9PSNc`&W*y@I%y*b!A8p_aBbXq%Nz$A4IuDsjUU;iU=sur zf0{FD&jCyB&OS0+n4jP7dw?#?mmj=ggOj)Aj&O5WrToK(4|WqaxLNnk&(2aXLlgjI z*>KyP7QX%6pYxaeq3qkedpeEs^B zR;5_PiNWb`gXo2hh=#_av7w~4vb4-E6_r<42UK)gceivg6%jQD zhvV_iJRtt%v%W+`ug27ht!sxec!moQDtN-Lp#nSY ztl}1AGdwPCGFO$;lsg%wlQK|NRtBDKV^b55u=X~mc&VxV8;A1Lr_!ZJ+}tj!Tu$}$ z^$QcMvpb?$!LF(Vv;hVN29t;!x~burP+v<+3n0#Xv7W*%L=x6B63*x8-S8eh6w#(r z`sPm2Gy}HN>t<2K&wBfHDD>7Q0;m@#sWWUdcKKENgDMJn&yTn2(LuJ(RjX_xlaDGk zpSl2|pGi?dg1g@&3`SK9ILh3kBl}4_kR9dCPDIfm5IVAfH$g>im#$O~<}-ZHj+)^R zA?!g6U>M1Qx#~vyzp|PWPks6HsYcudT=jgqf#3oBp8(A5MqG88XV2I{)&Oj$+ivt! zOSEKSZte!X+p&0_TIJDHCAa{B{O$}D*dB)K@W^MtbF8ng=d@nhS}W`lb3>?OS}Li_Swg=P1F1>bazutWeSPE& zub}kP2NE*}cOdTV)B9-uRiA6tBOBJSAdraKRigi@(e7i6zGJ{}LFYNd`KL}N-Qmf* z12J1XkkIn5Mu)Jxa{`GbPtSvJW)GD0np;=;YYpuUP*B~kCD>`4_we6btFRXSF99B) zkWo>vT#H48>Wj~#2DyV@Lm*}tpx8@Z&uCUcwrn?=-tA=NWZIklj7)KI;Sr!<%!r!c z5%u-XJNPum6%pLetr6=dAp*s=kb_GOF$qJck=B1R?1~5o=qHg zGv#Ci@DJ6gDuKYpEqPQV0aj#dBnnM2y2oSD|!m}2s5xww0foS<6sxeU9@ zBUw=YV}T&Lp9|yH(%dFWTdZzCLhF8i1z3unTk%7;ASK$7DJO47crW!2$~cj?3)XjC zdB+~U_=&hldZQ-iW(nP2zybn6vol&Bq~&hTF~kst&ZK4ZWMIPeYeGagG|3_`r#cxg z*$Cph{@*pY2wpLnS)@`z{@QkBN)Rr8mkPq4aA*c?7TZDRM_6I%Rj5F|MP9`OJXib! z1znAD>f|oO%=`a}*Zwm5ZikVnr>%Jwi5%^OOB|{hvy{_z?4O zs}OQnQ$Bf;0)vT7!mofNG%wrLbR1Qr2?jsh9L}HZay=;AtU3)ktUlc+UtL{2zTLmk zlZ-s(ucNPzPQp_G3bCf9X7y1c{Shby4i2KCqIQ!Gi$r$ge4HCo)#@9Xj6BHNk&%%A z56Euq52+vS@1OU@Upzr-M5sPLP~k{E-d#i)Ti2R3A-C29`qNy-W7kIm7|>uFe(jFk zVeMcbyA_#DaPaWB0)erYuC}%oB*~7f66mfaQUsBI+)tnqgQZBr10XfQ;V~|1{3tqxtl3^K!eHWH*k0#U$bO=4CfOIw&_`;o)(-ZWoHxCt=&0 zR>bV@o`4^2?#h%N4@8vF5_7ksEzKYCrY1Bum#h`Cl^zQLWf`c)lg_)6ClRAuoyg;b z`siU&z%DQsy`~Rl(lPA6nKY`nuO#A2)-KK=$p<=eazyB32wJ zvoQvNbbfyBw6|2dDmr0kpiiB@O(-b;CK!*Af|4==U{vruX;iU|4*C<7`2E4m-1n^( ze*TIUn4#OF?0Z&Nyn)@F%8i@<8z1+uaXTFV@bq**6-2SCtLvT)$lCW;)0{L3_7)Pj z!)uEQ=DYh%w`UpwX0pzqkc^U7QE8t+4YaYbwq{b_mpuUK+noXq*WfvNX)1y96ZeqM z6t}S=P`1Hforu#_tjY{8fW~2HGgfTcpXT$Ov(R$3$(z_wB5mYXU z$Hh@gYbI0Z&Ye5*P%)yfdwY9{{N6a&*kKV7!6dw{EB%=?uk9`YGmhg#K~7$IIO&8M zXpZ1(?$ql};<6_rARu67wh=gK1UAHPWc$XWIxHpX;|BJu374=8s6W7kkOhO$sa3E! z?9A!MIect9rh~aa!9sBWL@^sJ;2cp7G#%*9r%WzlqCkVffyCc7!nwkpV z3FPD-^y(ClQSlqfGU>862!R~@mRbc(a$>26{SQu-lTv%`MDGOJxtF1jenH&1B|h=* znRgSl#2KfQsq=z|G8@=%q<*o3dtg}w08I66C#RO18CbDjzkaE^ofkd8Jw7?<&8c{p zSbm_8^CrL8NDMpzWHdsJ^@<9vi?qOgUKW;OQ1XkqVmXIW#c>A@c6YHrV-0!r>eVpQ zlDd)HKrKs;JHVVNR3UaOgTNvHAWJNlgX}$6T4JRZDM6P^YEqI19gnep>QEr@jR9@R zMLKSd7{Qn1%9fT4{;O&T*oHhaTtK#KAKeq_F%lKMqdt%Lb){~llh0-YHOg4GJ@Hv5 zN$lB~^R_Af3eNreHHwvAxZ!C)^iLXSiX?oD*>7CwSo z0pPoZOgL!EtonT2ywPk9Ku)dbjC0^zK>`K=ZVU=mR=fTT8IY$yOsf=|Xz~p((L@z$ z55s5|Dc1`C9(&CH@fH$N!K1LLUOFxQ@sK>R;GzLL43J%y#r)I@U`~kgN4Kt#x2nox&c$OsSrJaFa&Jwh{daK}$*rS&pqu!!PI!Ll1L2bcmBH#}tF5mEa} z(F?WIrdm&A0wt}o0cVv@+f{V zq4ePJG4I9EEW%ABrg7&2rmokq9F^Nm1pSjm#t}!cx#K7Mt3VN--Q1iiF`rsnGr^IU z!;XPerJP7+% zrufq42Urc$hk3B;)TIm$?eHdZra(W3=p(^Ei9N!cJOHYFmZ~XScT*TJ3Bk5l#5;Q5v&k< zOsKB`{wRQU(@*|lu%;CJrcT}fY^|!TuC{vE4Nz&G>HhSIE&sR@$(y~FSV)D}a(pGl z(S-qI3+Hc_^)k|m ztEn_?gukq+~_)I5eNanvlWiUe8!-(JJ)9J_H#!=I| zQIKid|IPyrD*j97^=}A6IJ=Jc4?YvFBcnVD1?|`0CifriaW#6dy3(X&@r^S_!jEZb zY1!G8gC>7IZZ5L=1R}P%p<$T)w!ME!N{YkoLaWTxbf1(mmvoLG2Glp_{RNvJxSg(- zfQAy}@>T_+cW*h7K~PVFEis?L`faxXmCam7(Woa$5G0YyvqfJ2T2N>{czMY~p}u@q zUrMRw#<-Gky6lfje*rZAU|-+u!^3nABVcp^`|>jB$KYhTSkdXM#ZT zFa;bOaNlIcf*t+&^Sk7!Lk{buZ@{BhR>o0m)NYwmVD$;)V}NX1dW6C^Wm2~b+l&GkWdU@|!(8Jl>R;5s{EoJM8KiMgR_IZcfKEWG!;7;-lnDfp$-y31BAozJ$&I z&<+RD9`Mmlv&XnrFRgVMbF75h9c}&U;yI-YwIdNS71spd`fdo$x zO@FO{?O5~pH=3CvVDpx9Sv58_UEl5EC3*1R0TEH9PAjG>btaW|#=Gb%vXe3lxnIMa zTlrQt0aUtBziVT($XG*T+UpJ$6*cv-bko`SIlWp1r7(f7mHoz#MT1Ux7_C}`QVcN5 zE&v2ZbpQT+T-=C=h~^nsYeuK4ZeN-t=$?|B05NyOsfRixwdPM>mC(L(ycoZ0ucI>u zlHM_u)%qwipt=~6q7DGEY7W5T?=v1NUI*4y(6%W%gRBiWrBsxGWMOo*AQ)1}@X?lU z!!)Rv9-f}c(MFBHez+w`Y8e55eUH4diroSg(`|0bO2_@Ai{Ee=%6tu%tvvv%Iy0ff zZ?^@WpKKsL1_occgcLSTe`@7zt@`lDj5xhfU&G*3$81wBCY$8K%|}jZlV`a*3HLh}y;kqfx*?c6N5At-fU51&nLF!vY=-ItofMA1o^?^VPKZ zt<2v`D+yA%`BW9Rv0Mo7mN8U`HrPF*rcOp)tvb!+J+#)(edXCLn1&zSN%G&+LmF32K`=J?Jk{Hfsu^*J0W=zWoV=)aeUYwuzEoo%sxRV9oiJIA<1ak`b+BHGO|8(4CB;R#PJI9VBkTMyD$wAv z5&mv)1stlEC}G9|y7#Jk(m&d(I46gGquNi0X5Qpy&BNgX18c}B&dAD2j-CLn`lxF4 zr=9QJO8jW86eNXgHp()Tu#q3rSMFhs39JJb9xElK0WeF>(1nDA2nP{jkQEgb0ShR6 zE7KyS&h89=kU_(H@#OjQPeh$VLlKQuR#w7+_}GMmgjiUGy6rfI^oC(w;W?u_TcYJ# z1877XT*q^v06%J2W^IxV4h{7!`%i_zIIXZP#gMWp5;;rls}z*Ey|!Ujb2q#{piOHd zmm|x6s5!s%Oc(%eTxpF8fbKnNMa} zV`n%u03zkebtDiwaaIM~&asnl(rQT;{=4eU^V6wIvxzch<6SePP11so-(gV!E8|7O zV;^T8%|!c|G-qeilr>J3T9R#sMn#pGjJ&97lUGpK;kB#HNR#YSsd9EuRvsxb9%^fE zPc@TwHy!={jEU(>4oE;5#5~YTr2RC&kZ5g;|9JO3q_iC{76zZ;M-(s&7pR)_QyjZf zYcr_|&s7E1^#xKt!e`thavlEA=FbY5wehWcM@CbEDd{nL4%2Wb|Is2e1N5Kn^?x$< z-e#Su1_;4vxG>qr`F16<0NFAs>_fJ^+?d*tIiycedUOgQO|zEdfm zLAxf)>L(o=85){=T0&wy0ZvR%D`Y3!$Sy7pM?23_Kc{;3%-0liv4+=QB(%hlH|J_y zmRwJO-zUt230VPQhsbVi7z3~;Jb5BZY3k*Qo{n+7RAE?v1Ihpn?<@wrpAU&ie#3r_ z)X!uzG!moYc42bd&aeyA6-gk#Fx4ZX;B-r4V`E!ykO>87M5m}W1rePBH#;k(-ekgZ z9)WxgzIyog@83Z`(}(zl$3MeKV3|Gpuh>{tf;GRfp)m}@Ka1o7e%lKSxz|orfXPy* zX1F?sGcHo~-U@GfjBmDtoySz|VR;Doak6M#nm7pPaZos|Hj_ zUf>CyYCAeP@l&VIj5=88h%UF=e65cQD$efW_WtV7;c{Q|)KoP{v_Qn`RV&MiS@|Wm zZ~lB-K(G^(zGX}EiL!m5f5%?(AqA&_x#utkof`PQ@VWSughro(Pb>EX1oYadCF8tE)Sr=T)&; z3jA4=Lwr`lYSuo%%YEjSwVeh(oaJ6lxw%Ey*wkf=KW^;!1%&-aZ*RM$?q6WB!Y;mf z#nL#=y@td!e8Qt%&=2ep{M8zlzG%cMZiXb^noU1m0u)b7=2Pg`nUnhG98 zRh>N_!GTmD{$V7s$&(0gK)S7XoHo5(Z#uY?9uyy;5(yK2J*S%lM7rXu-w6)RrUzRj z^O#^9@?{;F`i3@kk&^xkb}vwWd=v8g<^HeHaCBL*d2<3WqJIGXD+5D-Dp>xq!8^TU zAK?o>jRS83Vqu-(#7_F22d2O>0U8gKe{)K$bD8|N-trHM-qO+6z{A`H5mLfWfdGm4 z!yR7fJMLf+|F7PQ|8Nhmsi|;KK7XsUKm|$!AquZDLQT1H)l>85{S}pjxtUm7pA1>; zhb89jgYgd|T>V-U`-ZwMA|N%S09@Jt1mo2Ch8-wB_niuOWCiL_9tSl$!~;Vo3k{9Q z#n~~J7N;elipY8DkL{d_9*wCzftjyOd^y05JTWwMDCKq%`p~-niD}GD_#JNlzJo`x z1S~uIXGh2RexBO|*yJ-aT9a~X$w@0UvrY$V%YgF-7~Xu+jC$aR3Kkm1X5>gZp}mYm zZewEuPzorg6zAfm#CG6|Bd@-=bD3B9xANpEkpzqS9#+2xazQW&z0h};ConXc3&0_R zGjFaJ$BSCdfXbCe0p5J6D5lKfVudw&+ga3!3o4l96WFq9rDGV~D*=I9jmxDpBD!PX z>>YrQ_zxelY1Z9>WgI^Oh!_2qmy;wd9h77_6Hg?OITTn7BfidBvm6zKz0R1{Sy|S}?)AJReBq?1$ryGkBy?iuy``SdpFe}zSfJtPcmniDe?LD^PcyyZ zIBcl=`yK&akjrY}p1Lk-h?(@~FJJa1oi=5Fi-L@uJ+c`ZDzAzKVD8CHrs%&61}9Q> zoRNP7a?dutfKZ?!d^Z{p3otkpp~2^xEYKAPy8On))DdvJC~<<5M;shc&F0o+4xh`; zq2Fgk?BCisg7Yu!?d_o+`T6-E6K1=BDo&?b_KgJR z1)_z#e}UxnVsV7q7nGeNM0J3s8lt4@L8vvKUVbj|m+N8vQ4<0Fl;AxS6fCk)9!w~* zA6yCojuc?IiI~YIG&0EcIXgSEKNCuiewsO^F321tz|4&wPZG3ycvy1#&3A*^nf~0o zyu}IY;8cPK=LaR#*vL<>K%0(?L~l|lMQ{EQ48{xcB*UBR z_WZN@81arP&lr-{$z*Iaw!ujeaJ&)t5B#>lVX}e)ur^1WZ{$nfRyju&0e41&=*oej zOl-CQbLH2s57*0mK*JwV)#x391fmB+5pUqu!-L{Pw$h`tB%{wTzLC~%h5B0a7Gt@!k`#(^>?4hfGl+v!_i45(Lg zT4%-y{wFKx$0j;)VS;6z-`@wCKmsoN=L3c_`WRqu17C&+6h}1!98rmiW4g_s zN|e{YHjDB#BxHLjIasU~^ikkg5_87W%rc6gvX2mjzgB5$77J1l4KpfW+S%Uz0SJ6R z(d|}Wo>qf?2Nz_F?0ooHp_gWpN9rc`F@kq_fcTX@vm3}dsj&^rJ;FjlfJBu+Rgjab zKbf1K2i7D+;3in=A!B5eBNQ&Fu60g<`W8pCRf34D*lD8%%>qz1%q#bCR;B;K9Z_oF z@DVuE^xcz*$u&z7>{sBS8HjxzSPbCwvm>Cjp+9_{z{f4>KNH2af)9=tyEDLs*E?4;O*IAkxp}*W6>6bqlYng9AN*G(7oK2pC)Co=xw*&OW^XC?IUU$O6!T_@lx1`b2 zFS=0nCh{Zu8E_V&F@^s8`4bRLoR1zo0=zRleJ~~iH|QfK+k*>@0;Fa z)y0hqh#73`BKvKvS;r;~XCoTrf)vF(HERsVgEc^TbOP@X*q|V*MNI+IunHEe;Krh)8nQSW5ZL zKxN%%p|mP+Y{Ctc8e!nM_L$y+xG!RD?!%9|3gR30(O%?hHy=@8Onne5{VlXzu7l?U z)&k8|6~x^t}Sb_pH{x}0%fJ53oy!R&f9{}#g9#q0r5W_%tPEKFeiIy%9pU_PtYtUS31qavaU*9PRYtv^8s{U}SY7gK zdi!_9&!LK7L)6^L9v1>{>0oo+d_B-J8#rtPPEThl{OFO=z>tRWW8?b+5bOXb%coLt z6`3WkOiWDp_z;Z2dB0qEi4BZ*4e;>+2ZpJNmZyN)HQOAV#lgzd2~v?)5#V8dPIbv+ zKmRW|umYT5CtlnvltI3p8=KPsjd7o|e4kuw&;}yYR|#L+S;L8orHhw8f8uLus`;mH)l-2JM*+IN`iHl&8NvK0bbZzz^W6Qc8yhUmtP6hqw`EWA}=P(=n?(4yolm*w*)`ffY<6WAnE-C2f;L<8h#!5DoytA{j^(^eL zH0p#d$;f#CB-w%G=e>wuf&{J9{@$cVI~o`f!l{8}2~!8$ki)L7uEkmDb-Uvo-9fr% z&+;8Vq!vD}0yz?#d}}lHI{)ow0vL?S`z{JfrkL_Kjaq>305fL`XfLgX+r^@zx`1 zvw2k~RF^5^pC0pr!+=e*XN5i>E8%(%#8&*7%vJR6C76I?`DtkjKnc@s3NTzr%;bC8 z!s8D=YkHv!42}kX38>)hh&=TDTeZaKm|DRO?|fwgT-$&1H%bG4F1@ImQ>HVzWc$WiZ@D7EHeBfUIbR~GN!{PcED<@~P=|qt+?j;VMjH)Wp zzulokWrQ}^Ix9U)c2xR!r!dier9s!IJ zfKQUgE-@PLYlMa>2IfTte}{1pO`uQ`8DFbk>3Bi{0^N@!xxc4w6G$#Id3tzIypCyc zt5mQ_o3X2e`{tZuDk>^UOWC5_fTi{YBV&%5<}!`EB7{qMV5AqW_0eX1Vl{a92LhR$ z;H}-GC=~*=%IxP8P$nxzx9`FW_+7uEO0yjW(Nr@1*+`hJw@SkYw>hAR*>@e`0fj82 z|DRN}*p)8BMTahx~DoUuqg&l|F9?t$}}7>vrh17)Y+a!m8!?n1pBR$L8*Z zl)04ScCsyhkvSFVZ?67oAXk02}%i#F?A(nbtRRuc>)L9PWH$i&sgL^!D zPKZOJ^o`9~*{(UE3;7J4na7BAZ|!OM{2F-Ek3ZZM4}p|~qg=MA+BFB8$@|jI3?fsw zo{wFopY{kq+*MGo{8FVKeD;4KSD`y&9PaL_&jEoBVx|e&N6oZ!Cv zd)LWUDZupafeIKT`1!v%_a#CxgBoYtRWj4idiyUR(_)fskK!m~_u%b~^-H=dSOW|!b zpU;Jt>$%K)_1C<@*VgF2{`y_Hxy}7AK6)Oj8jja@?vlZJOZG?VgVy~3@1Otxhm4dI zBurd-wVxi=g-t@zHS=#Ilt5&_=YdWM=!hocr6GudvUd_W4E~*g z=&(9}x8pn6uF$)8FFHceLc+rb%WPJ^eE9;}ll%d2T07qi)(4um-|z-%4dBhJb^((1 za~1ehF|n|uSd*H5Mlv3^5b`E%I1BV!&9#K+cgARD!FGFHj^tyZ=%EL{x`k@8GT-^& z)-nPX8&XpSsOas(RkpGp=|=D2m|zVKDgUMYEH?TCw=4h$N?U7d2n)mLtJjAKNq&BQ z;N3WbEEzAssG9)bRE|bVKxT$Ml`4QXY2f#on6fi9!e6s9dVGA`)6pq%*4Bs!=ySuyKKtZ?%4AXxF;o1S8i~od* zYGpn`J$xo+g|c^LveL=>9vo<|n9#;Fei0opBazn4fFH6sC%K~EW6CGC$PZkN(w6vx` zs{%rFpKHLU*(?-XItdAh6#Rvq`S$CYPGk1G1*lXR!(Tb==urHCSIeHgKY@o5oA);v zz76!s`q|zM(t#EjzX(_s@ahM+9R@C{Jpm|Ln-4JABd{Ry99eC!{nkMF|A^|eUNqET zR)KE3)G7RgNYF;D3_TuJXtXfu&A)PI+V-`Z(BD;hn3omkHx$(z$ho*;i~>p~9sLoZ zx-Y@DPZIP8M=HSihLgk1_^`0XnI=!^UtsS9^Pc@eHwn9Dy<-PRjX>3v*MYwRij>qN zsPpf`eOvA763^oTgk5;U9vj;MJp1y6P$Ka+MNF>AhB`Vr($e>##_~pf6ZRy7-Lb(U z9DXYm)+9Vo{ehpUtKUG&d?CrAfd(U-5w!mNLHn9S{nJKPc*wguHLiO&!+qx#gnbs|QI00wy!s-DP8oPg6TN{wladB|k2x5{mt%{wc zCa2%AbT%}ZVH)QBWl5MAN2#HZblQP$mzSQXAN&T;Y~QsUq2YmZP@$I$HAsmHzwBcU zkAbpLUst!#72icxjMbd~p*#L%;uh-_QNLdwTUB#dV$IdmP7S z9ZY3g+C;P;LazX9d{DL8M>I?KLm*J8XBw}E+xwE0T%U);q;7rS8z}o-E$x8&<=hNK zb@eBHem@Xpl%^ah4}c;gvepr|(1k%jzLs2b=gtrFs*TN{`94U@St}?gn3|4yY&$xU zIq{QuA3{9H17@)_5HrC;@&SCE7pWSLg#MAmepRraJ7B5mPc{79cE-8e6|npL1JQ2b zL(i+BZdfP*_jZ#z11w<{yP?u>F1PiZ_0V#;HfRnuwx#9myH5WbyS$E$7B-6wk!^{Z z|EgjC#MDjvCwdv){k+kA`#zg#i#@F4JGi*QI%4{_lP<{HKKlti%|BEzclgji!#)Pl za1dZdh?|;>!3~Oth@>O-sx{vkC#FsN6J0fpG`5r1*Ee$PFx>uKKa3&L_ttjH7;3p; z5cPZyULKhJT~8F(T($P5?_IU_G7*%O4@ECd@VGwi;0YO)n}?E47#cp?@QEoox=KOO zl}%C32u@5QvWY%5EDSd7dt5$&f#Rl}()s>*%(2JVF(#t<4M3-#+7?JW7jh!dnyl%lPiWsMm&!kTIrTzQ0Gz1 z^To69y5l#IBe5~Fob@JKMW2ae;s~yw`JeI8Fv`|7`GO#!j>Mjbf9q81$n0fjN77eiipq`9wH(vCn$J~*;tAOcAU)jFNc>v&I(Zem66XL!Mj*aPfU1lKb;#0oybIHT!LT{ znqJ{p|T+8vS{3nMI3;8ajQ} zzZKplq`d&9J7sAp8qs5*|Lmpc4Q);) zVDM*gqMu$>e#x46fdNRqnE&v!5D|t5Kbce7>D)uv@KG;Hc0{jx6rI+q0ahZ0W-5?Q znqK1uB~Q#sW8zc$V>DAfF1AhjtvIsU5ObHBK&^4eTQb9GTIHJHU%g^*!w}x#5x1Nn ztD*Apa(ILBiy1}C3}A;8WnQ-~cjqR1!_o+m+cEOdXd}ILD7$1= z?1j>7`s|6u3%B^9&@-7#UCUo^w9GS3irW}t`U9={U&Dk23nx+knv5aaebS8w@08S` zLtLj`ITcn_RW&5(>n5FkslFGo-=X2V8_#yuI?=asYj+paorUteYOJ%O4Y7NYl5Gtx zCMG5rY&X1n|NiSuF4uG0=r?UTyz$okZL>*HDlc9wShO!6(h&k0yZ)JWQf8TtpVm=>TovA%{0x4+0JIvdX8zi-oCw*Qvp)<+L&&&<~2k$?Ug%@ zQb01^`S8fb3W)w$EWc6fS^YUIil>K zPrd%f7WEhF`N!zR3n#V9$hrsBO;NAv-4B8L`tcihp10g`OHyeBxgAqo@_60v z&l3{!4rv$8mfE@No2}1PZ;r80Ry}b7&W@~v1O*gaOc(3sMsLr2TAMRM^vfnwM?e1c zK3Zs9L*JC%pXNL#B;MbI5FoMdpOw#^-JLHK8}2^CXz+I_EIzb3*0VSlj*OHSS=Dw=_3IC$tv!N13_IJfaWk@_C!;vxglx*vVS z)nd{}&9$_~bvqAOMnE@YWMuL_Ji&>H9{E3Q#`Oj=Uua)U0H~m*r=KDubraRGC-Go0 zLu5cO7B8Q6tL-hq5Z3h>GuSJ>tq^9Inpr2cv`(=Bt{I^6ehoTW z0*~isV`~FEe*w`1R=T>nCskF?WLTICe|?DxR$2d`uoC%R|rc&X}TkHc)HZ&c6E0@h=HRz2kGS zUP)73)s3;A3O_m0Dgiqu!6+@C#r2J~arad%XP zMuO&&fe4AK4uym+(#U9lsLs3K7~i&aYk9Eu0BiAsZM_g#(32BZf^ zA4xJgRoim$6Rek}IRRbqCEf`=^&YmrOL+2;*~;Se28|{9TXf?41O-!5Q`NG0zfy26 zMNnqfw{JAGw8`cJXPF=O1t%mJqxrKoF*bf!1AN5N!UEkRQYiiNqwm8+5*-_R!CC%> zg+G50NEv22x>U?kmkI4O;Y2`hzJEW-_5SsTOh;d@5BNf^udg3{skguX#CVH7aw*rc zusqjT{&YzqW9xnuj{qG#%?G5Megay$sJ&7q>aO%_fHxq+oE7~-_kdF(KOpXj^j|cK zRL}k~wjlmlTww2B9+^L1lTGxtJ#`LaZr=Wdt8j?_&;LuHc9axf*Tz0}qPIA=p43a2 zI}Hd@?tSnr#`9zIrdkp+8SNy6lCl|InIO2kd@8FHT^z1$qPSqExb*RSg;BGUy1Yi& zj2CAby72poG8c>0Pd8kmTjsJZ6$WMqKk~>8TeIhG)3HlPWCzWTM#5ahe@<0ddE}$= zaWuT3uy>1#&*J#W-Tvjv7eGN{V`J9q^Q3u1Z$|WLLsXQRnR)(WFnOdNezIRT-9)~o zea{MMD(|E72%+?rYCns-iR}nF1k+xD;is0hF||r=?kIOA0rfn1@L;6lLu5q6DnA9W zhZv?H@_H#1y71%QdWnbn8?Op&aZxGMELr%eZxZ(oW^E_c5{0hTg{x)s`}e9DLu2EF z?Cd$Dbf_n!q?qGa-4NWMb9qqawCUpvOmR3o)6>)OV20vV90D27%E}6s2HBG!1uX>X zRn^pdQc}M2eGsks^r^5dE?C15BuW3R*SL1)|+8-zP zeF}xFIo8X|&l=IBrmN;<4UoE>a)Epna@fj?0W)DH?)S$h zNA7|efG2U6MruNE@U30ID<7MOmKsq67l7cf^yj}LwdE|Xpuhj;+FIFd#i)QV`#;wx z;SiYYj(r}Lt92!2|0Pjt?{!Ugx`W`zotY?Xl9S!PKL<*c8#iu5Jq7+YsbxP<;Q%jz zoSdAgFDj6;o15+s)Ca)h`uqFASH%+q=6xEjXK9jk@?Ku-Qhgw2A3dT?zSPbh5++d@_I4s8Nbaeu*4_CS0e498_wSoX0d9{H|#OQb%1nOLJ@ua_>sWxW>fF5(usNU!QS+;T-tFbS#xWaAN^ykV8- zmtFhk&!LY4ed_z$;?4Y*+>>;c+a<`lYF*j=w(IOU6M_D(t*yj|PJ#&k2C_&HAfDGM z9kjF&tu=In3O44QXmk)sgSQ?qIhu=+oPCnD4pYv^MS)EtFfhTgBw+ql{mtsT>+O3n~!J*1Z-X5k+0JhNj4X*e1EkcU!vu{A+?wv+UZvl-;ITC znm=fFFE6RgVO(O@xCP3*(xP>gjh`rccC=Cje0Bav@W1+1HWTfp17E7E^Xuc|<1-|z z8XrJV`qk}{w#vYd>yiT=-#R*+E4CENp)j`$49t}ZG!2qBP64O5e_J&7oxEpRPxBl5 zD_5={=BBT&@1TH|V`4zj?Sm`$B&fI5jRuNYJ-WI4sD{Sp@S~5_6l&DXHn)U+HL07B zv%JsYr&~uCC6PV78`wnJ@#?2#!oRNg+{azA%Lb6Q^XqfVpFMjPSf-?;{qUK$L<+e; zA^La1t=O9AcU8-s9-4~YGjGuj4{iJa!$HcGh8pNjYHL#w|NEs0Qt+lK&yWySVPUDL zKq7@U(3*xlJs)InWWy-*v`?hJR8$N>P%Jj|cD;dj!aLj94%^v&^XyP*sAyCViHV7s zIqJWma7LGKO9)4Gi>ulTJD-(EloZ@eoGzz+$P)D=t_2gp&6c|x z;qK||$BdoHCHtMQbB{3`q?pyWBED{gUMGW`q@-kKMn+Wc*X+Y;pguQl>}YABW@0*{ zq?G#uAfdd!pgT7uC8bjEIvN@&G0e>B=*C))ko9LrA9{y@ndt$8fZ=#=UE;YhQB=1J zZer4|C~;*zd-56^#o+x#PF9_xdq6wRel+mFoEaDyk1cCAsb(rRV_m(9>HYK}uQkU8 zkY9}4(MuOy%pNhxPHW(b2HjyQ}zokI|m=D1B+Lrr79k_|a3>*QwaM zNIeSzbRA{GMqT@O6xo*e6U%EnN3nSXQ-N|YhcuJ&`ST&&bB(0&yKjlnPm_g%`i&{9 zN(TD+JrE;9d1E_Sa_)ZY60Q~Zh=CwST!Hm=7mhkyHn_+~VU=>R^`o}qR}Ma9Gri-TwXUF(rVN%Czh=X(44&ZHOy zWM^jw1+n17iszpx&kbC%KN3earA-3SWVoOXenU~3Jb&Q8o0lKNkGlRBWh2hs#uA#Z zM_`^nHSr4wuy5Z!oLV8qgCPwQwX3VE3hV@FrtnV{C%N>l&3!g;9%1`qM$89i1dP6L znQE?Kq~FGBx4mTrA+XMI^7Zw_$DWi&i(mmoy{4-Kq*xW+6mjQ(n(?aY2 zFipH#fu8*hPPR{0VNp>|$sy!4RuFXIz4{s}Shr>IAt=i*JOPW{WV#b743x*`O{%C$ z&6kt>Z!xxV#Le2r-y-DF=>)>yx96ep_(0P@YwJ~HVKEEcoHB*&4H^%7d;91cAD^$W zw7;K&a(=_o68F8YG5v9&jui(Nmp^>H=U}r5O9GtB%*>4Gn2VcR*JNAW7BEW)v$&Lp zvDd?69rHj}mwLKceA8O^9EACY${~?_+Ul9K#E$QwBqI@nVoaJJV|)(_*4Vs#?Bk=R zsJKOX3G)s5qAfM0Ou}-1T8xY99wZ$-L{bPRI{MGSw}h7d{1O$%av>qm+=zd2;sev7 z7wz8zfPv()*wna(%2;mDCAcd{9tJbDDyT2bd8 z(i)zB{|#WiK-jnFe1&BKaCb2|iB7YhDp+yRhn0S0Or(M^F!c2IGcz&WL`VrOF7aoi zUdYNiMMieO$uBG-LScG>V)%a4Lfbxz_sPcQ<5Q_G!N4o(U+Ljq06Ike7uU1<1ATb8 zSFc&a#mQNDm`q5wjPaX&5~{#I|NQeg-P}#a!I>-r@Ho2bgoFfO-Xm}hone>Y9yz{c z@7_^ZD@El&se&P&44G8ru$!Od;%3)}EP8z0w=r@`p!QT$RVhPv%5oU<<#u*<0o0R} z6iBFu#mdx_Cho7I{qGmZm^5Vsd%F64jrGB=qCaMNT2&RFs*a+U1)iIRA(94G& z@jk*`ql*wRBD&s2pvlBzZQ33@(npRS)!)PmH^&#bu}$_9tKM) zJmfBxUy{SBE%f%5+6?=lKW8&WcoaQ|9J4G(B6#U&XjG9uf<&06Kwh0y`mtuXv{$!r zarHtnABT6hH0Xw+V@=Hogv80HcXx)C0o=K)si~=>vyG~lOh~_mYnvR5ICtN)5jq7HZJ(4i4?YCMvYf;tPg!Wcw4JYR!S z9)W>n*(|b==9fq%9^clkxE(bAF1HbDG>|N4ZvMTtwiYH$;@#r{#&-Yy@Zg}2(6x(} zmape;$}@$oRPZg?Tad+I%DFRKWhe=~G*D42j|q_%mnED-PEJmEGnqH-p&$HUJA3W; z@eklU(0CHd5V&@Wr1fUJmsrlp2G|qWYwh_fSK{&9o0|)q&M@^?e%k|?W{i#|a9YAdd<9E!-6=SPkm`#L5>iXsAZ;qfougi{00 zG(d<+7FV7ooC2s?H}ERrSs@f~t(T9!EZ9M^TUaAymuI5HX2$C@g~^>Tx$k_hfCV2L zHtf}_41)t*_u}kI3T3sn4W#|L_UjZE_34CbUuZAn{byM(&wG;=?&w2fg8}S}x##4> zGrf5)w8mm$XIxIXw!ER!X>Skp%#`QcwM%YtUsq=&agHB9_2=!hzjJ{v)N+eIjxIOEV6ZF@EBl3hB5Bo9A~zaXHx~S0RxA4adxHn`6=^v zY|7`(9hVFdnZ-$s{>UG$p+MfefL9gDtjvPOo7vfA$RC_SKODMNg5+G4 z^TYQSyoL`3Z7H)=@1D!=eff`0l3W`rYzE(~K!F*^o)dS&EZx!GPPSr&vNgb5F4>fJ z*hQ#Tt{fU2)krqj)c9>A07R4o2S*X+u*0_ou4q4kH2gv#<(?_Ax=qo%39;@08}vEa zAfQqd=L$Ksck||E0Qf{B`0PxZNr3fNgP^IP<@sG~Pb-TW8h#)xw5z8_dHf{&MAfsr zAGH9}U?>EWjJB-h2f)b^c*Q4vcgwL>gI*M->p2R?o9UU(Ttvf0b9>5xUvJ9Z)Z_g- zDAOTCX>4pnHmaqiUY&DxR#xElN8FqzT@MmhgRXjHHQpSa8<1xZ(w?+nUHanZ^1%!> z*sA2$?|@K&2}z@X2diSB6^XfW>h$T8@u%`{|89jb3Y(sWT=fQRWB~LGP$vvZ)s#nO zIG$Mdg92o>{-sN6Lz_Ht3zwzS*Bu^``eHGV`911=GgT_`cCxN@$X`~N+%io=QCAeO z6<0x7Ny+dhTBOlgzz{Q|lWb6zJ0-Bth0j1dfaq0Ib93e3bV78t^F%_bv4*<9wwbQh zs7Db;j*)jWya`+B9CPiU&h!Fi1l(@orFhBNX_aG@{5c!PMC^35Z03i7(C#91mHqb7 za&t<4{ib!CX>NjdjB;1l0xZeG-yZiE%e^<&Xd4%wu zF6ASt;?|gjs;K21jJltAXfMyzI^6?9aGoTLe=B)B$+lyeq*5QZB$I{hRJp1|7GO;v zc{L~cayZg=M9Xg+!Hza`^e4zyN$=Ck4e9nrg6!+m)CpKIButY=^N$B*IXXJ7{ilao zf;c5f<=-JHsqZ=fjz}{$ittu{DJkgzz+5aBl~D0K8V$d<2pS_Tlgmxnwn66CD$|cL zZ(8OyyT+cM&4=V5^9$rtY+VK^-4uExlgdr&* z)OZJQF8~cgtbK58oXqt6x7eQ(n8uM!eQ5HSLu19G$B(OaiK_}`P&Mx9k&q3Zk{R=p zy3=qTaObxWkKyg75BCZnmUtV40Ovo}Zi@EkJ0ei&*{bi|7^UKL?_O{>h=e<~rCktV z5y5sf`$VrM@0|H?yLEnK!JQan*DUVvMCmHt5M`2|4#;bCFr z@%vP_W3HJt5+XN$XZoYesIXKK2cmf&clIfe>#{u? zbIrru{XpK+%aEwd@>C^mw7qd7ZMZ~l?6|RtV(FF#`Q0P2i&|t{03zx*`#@nPJY6uz zSBhEW5p-zP%oO35mNarA1nMy0nKosBnyJwOI1gbtCueb9p1s*=0>;TbW2B|k0{P9Z zt2>XGH-LhBl>&en$$x$UPAz;MijCfeVeH{enqUmUu2wWPePB~joS2ySSY6%a;;J#O zE=X~cLHE+7DA>?dxuz$z;r`UnV5ATc7ETKbJ0yh1nHbDsJd(Vl^3eQ7UsF?~yIEr` z0jlePiwmLCFgE6qqjp=Zyrm~X*>79q7Fv%1%7DtfvS~KMNZoQK5$+#rJrGA+&%Rf)~t!vPKg5`d`hNY(LMb$2_DFO z5egatfh=-C;%6ou8+YX@0fbN_Cc`i9vSJZXsk_}Iv;b!yw71Ep5l2@GGX(@{e;Ym z8is(P>D5UuUse?sMrLK5bz;aOFO}G>MkCHlyz*@h*Om1%%OZTxYynBs9x}349BYid zzv?{I&X+UPOm}ziT{yy$hxu|MNI+%X?t>##+QO%qkH+%Y6aTz`q9?2BMu42w5EH#- z$%W{|A0+8r$`=c~#2sLs>4c&6yo%9>c9tU3WYI?_)NhjUFXDnO=b9)rQ`dAt>04S# zffb(Lzc*!Cr6i31nHni(q#XZ6>3EK97&nNxb!!REp&CPdeK3W3Mn)a_J9zafx85&r z!AFIWq#fYo#*HU2K?#qJk3Tz|@}MmL!v{C|=?|eLMGm_fvJKJzJ0Ruf5L*!54kBmA z29PuL+O@_5U&JDVvm2OcY1{kyX5RCC7#$mXK_T~qSn-8~%juHAt5jak=gW3c=cp5g)kXhfR$`e7I` zZKj6`k$#9i-T2zI(2|IV2;2!K5BV#+V{XWY2GZO2?HfPV>H$4QGD2eNJx4R8^uaaC z#0y?7g#l^;p;tdqM)lklbN}2{6s&dY)^+ZFos@LFI!3iPY0*4O`)e*%a(#gy0brUt zMPik{3~=6?$&#VTN0HusJn%gmj%6Z0^BmU#DRW)Ys_gxHgUgpg())0D!H)KlQsp5m zQG2NlA3OFr!;-J*gtq}t;!H`zPBymC@bJ6!=qs2T`$x_xz&b0$ATbtvtC9YoE7V`Z zSJd-JoEI;h0)y0l3;DkrlLJ2+ zlR?7>##3f3n>J(ieLE3;Vf!MSm8+$w-vo1KF^jv&tMTfS=P1^!!R7w?1}Z9?6@;9B z90Dv0-7kg5UhUM??I2{sq6bsT@P?aydd84uPDMeHX)`0-b69mnk7UY(Y3PS~6jU(X zT33Xh6RPw_CY5<@F+U#5ZDgRCZ%htF{cKEV$j4firDO9Y3!OyB5|wAj!)nT~RNl0A z&}8sU(Zvs5S9Bcs>69amCdcpKYuoF;T6OH2$+c_ij~rspbbh#8bz}4pMCgh8`ee-N ziX6g(pODFCgod(la5yE&iN5O1<(p@zP04mi{h4ooJ|tRcq)GL6btyipq=*kcMJQ@c zl66H?9e#tA6Xqw(_^|S`3Bv)An4-h8YgZpC+eg70qn%)a)ylo9g2{HxmLGOC7>wu* z3Qa<;M~5>!o$xb(kO8iwLK+m0S>{Qxzw1Bxjb$v3S9xMy>b54w{Q6>^D}Q~n;KWJL zRTEkl-brz+ao{d)%?&Y-jq%*kizH#>vAnCQ^1Ra1-5paem)yDa_28O^7@W^fSMKrr zb9e*3x|32e!L+r}FGjpW&(IJadSa8Q#Y4mAe!jjoougvQ2I6m;%f!j_MwZvr?U)X~ zg$OTk!oZgj}Qhs3;iEff~F5SIPQsb9wr!4RyPJ!b0f)pJGRcAB+yp6W|8Hv{_eq;5T znJ9X;UQ2P`R%xGOEo!FG@Z%-K$GhG?Jx;sZx#Yn%uHxOI%LvrS=LVCT&!R2{I2Ts2 z+C)Yve?G9F(b&6pZ)di1ZDr-blw`DETxu#RULGC?MY?d6@C@5>?yr40Il9{WCqML{ zj4hF&m7ucBsXgbZtgt4T!~9WI&VIaSj(}|mZN^IAGPYMfzP`n0SE6ZQwmn?wRab&+ z_wHwrk&dhGLA^@rb(3+*z9LAhDy3Q=?u`%cnZzq{Po8L}kC69CkhW__3xFO$lTdicQ}o^XpukIHkN>C7{0J zAip2-HNc3u@#IQz{1|dS!~XNxWyC76DixC3ybi|4jQ6vo$l=|hb;s}Qqf5I)RL`82 z^7uiB-Pu*{T_hlsl;(YdUp&Fp8JsfV%Ve4P!pI4V+h~FJ*ICOWD$uS2R4lxto{rCN-y+|HdzQ7G=b5 zq9}Fy!Y18r9QNcV14;bsmlSZlBp4{PY$huSd`=t-pGwS_g%Du5mmJFNWF* zN3zdurmI6v`4KN$2?c@C%|nO>Dkc}*3S>xnn2(2R5!ASqu_3|e-lb+^vJ;yKgb+4{ z9c(DWMep7zN;hwTROjdK`U6bJ3bIu-G^GE9Qy;{dHDmZepfd%54li_1Z|_G6Z!P~> zR_DQ=WgZ%c*`IY@GyfmsF722RSxugrQ_sS2-97*ck}JUO;`u z!n6{m^K{(4d~9-g=8V37??oo9Ou`|0d*!=p;AeB zy1=NtH!q>r#&`YL0TD?Y)j68=>xs3gjg4|N%}7i|j`@K%h_L2HoXFgj9E@_rGIM&B zH)hwb-^?zt4WU+2*tEoW!vedNqk%d({p1U%9gAR0UVp*hC6^C^Vn^!KHhpCZX=hA` z*6yD)6GO|RF7eEx;w(Kou+&6{MQiIZ^kOjJ=zs9#??D1?T5!i5H_>78*fouxKi^sB zPAeuV>P1bG2_EJnt_z8WONDKS+Ya1I%UxPk6Zus*F}QZCoKKWe*HH6fx+^VZuXW{e zc}POA4NF$c@6yv(RbB0!50N4EYdiCmkXJ>UDkQ69dnpYfF$#N=qSb*`t8&gTIQS>>NBxn2y|-PO_;8;?zh5+1%f&BazbWiK;b}B zHVabYuz=>_!?kB=;uYkhNF=>ahYuZ4A(p^E388(Z{WqA+c=vB2&;AY{FYe&i0amn< z!?$CiqBxN2eL3N$;_vYm>zg+%wIZ?wKd)0X+dxlayKxU}HPAZcI-~`Er_swvaZu3B zDsF1Ze)Y=hevX5K19VT{wiAUR9|1rCGEqK+V({EnTsvZ;h}PGqTEtM3t+rSTNW3gn zRU;!obDyiK_;7vDqA-h?aXC{_QqpeR2(itd!#f}DFT^<)t!CF!%+|6XK2O zXbwhSl_(xK4^D{t9ASegDv}j;2XI;c`l=_=0}$X08QBQAcLWx{W0Ev@f$X;XU;6tE zlP&NJ&+iI(CAUmy5!tboapWcfgH$-~D^gfOf9J+1#QG2HeaJTXQ2&vGgQGbXk2#L} z3D!$~Wb+HBeiDQDPUG17k(``-Hrqx_NN5t7XW^-*)&q+qEa6}*XU(}u|KMWa(au>y zJP2B8yW}9BzrR03C3vjf(vX^}_EWyNaW85S6G2$F7>R58 zd(D<25h8_y-tqR>?C_yer+kNh=#dzGlWgRP$Bgt|yDp@R)#{pw2_QZzgxz_+@%5$u zcJ6ig;j|@!|E!+&pZ{wvHncmaSFBh;Br;>U)5;;hgM_F@N?pLN;=@u2c89+e3luM9 z@5y4;F35M6@qn1YWJE2Qg1F9wFM3`QzhAVaM+R*Y)CQ_hzJtip8iz-_RyP$^n{| z4VaG{2b~vDfzfq@oWidAwA5qU$^kN8Fbl+9HAZ5uS}lrXk-{z&4Grs&b~zm$PR8?ZSj~v@S z&=NW?O+dToza1S5VSGk%);veP&iP0o@-e3$wyzgV~w-l!&uoGo-yJLWaP7MH}38cO7k-d33i5W2QqP*80XXc?OW2X66( z)Z=e191|pqoJCDw|MHIBUdFX+2MZXC$W3nDYa~f;`L{Y*W|{v-r+_sfvuI=hBe$+1 zUBFxJ@V$z6>0)@{r-+Hj)c$!UdKvfr2ol^(GUlM4*dYzpkCNCaXi$)~vM@_#1!+XD zIg;)V(fngO;}2#g()-9;LFfPe2>1sw%LE>isDysBuXRqiG0z{8wi7&}8L?CcN~~AJ zilYDFzvzzr#R<~M3EsTIMDg6)%+~UxhSo})$&3LNjJ#9onTHNVEF+D~D--Et1d(Ldc4l3I3f4I>kY@iv*weMQ77EF)qS{3?zUKkejd%16t?n6AwZnS8fR zIeRloSwxs5NJ}xjAr$BH3L@lhU+A&ScCPLl`+2of^-wej zlC@cFs$O_DId~#Ww|LKE!4t^=t4g`Xp6J>~I+1=|uKkTCSyXJ+rcAp%b5r(KYybXF z%psBm-NMtt^VQMuewl=Li&mr2-sM1&77`D)Pj=fEONhNFiy^|Bg_8Kevd2tZ!}a)jzx3T^1Jmzj#ZTT3YOrZdsKBeB%X+}wF* z9KO)o&zl5}EF*$s7W^5ZzQ+C^IoiObO3ZW}&z_yq|6&VC3;~i@JvGCEnTGqI&B7ug z@al_i-mD2(iM6Dv^!M!-UfJ9AhY@*n(82&$2hIl1`KjJLjCo?h0-q@?=b$EoTadGD zX|Tj3$R&A}H_+q1Ws6YmFEq`bEH%^aGnUQJC2Ts`*37A zQxhZ%8R9X&eWhST%A!!C=L5=I0xw>=)QKZr?ewON2@@+=teYWOp8YYfvkj1KM60WK zA+eH2UZ(C`ovVP#4+dj|Hxx2kxzK}!Q4$YJ`t)$I;HtDosjefuUY) zj1_8ehW)Gzci#7lqr8E9x(|jGTQI9FUAh$RiAaVi+x?x1Ut{Bn7ql%x(6;=RrS0)I z)=p{vid%?4zZR3UyRJ@76X?y4IkVVIY)RU|YEb6o?OhQcPp8V0mhwx3X_&@v7M~A+ z`x6eM1BhjVQTV8g)*Ix_q8BVEC>S3fhq@a4YhZrY_AD3-l9s;;`YG+_Xvjm0w zwWX}!c+`vQJtqLw3^`o3T?T387Yk&1mP_vX7J9*o;vQ$zdUkn)slmQG=xC7m;b;=N zIX89zfyWLNqIY)R1K~D88N-svnJl2ZyA2bm8>i~5h1r6JOZ$rO+B3{?SFSi*bCOh; zd-r1VVlkv(OOat|wDl>`Lz}RegvE+~H$VRv-0sTb9cV5fNg4f=J*(=p^GTLKWktmS z5$!A8gD^}$k9h*g*p%q_ksJ^Q)VOblazw&7cDi&*2bn8}%pgS~fV+5n?H`e8d!FZ5 zM*9`r5Nl4&xw7_G9Ksw67<1X=dY)7*K-slCrVVry8YdMTqQ z%%SQ#zHbN99VzwCIeLlGcx?dby{RuwwS$>yW&q0aJ5M50uTGl^i_S_$t|*MIKi7_H z&Cei|qLoLMT>MU660voEi`9OAW%9>&Du!aO(wFIIoH#+dX_FB0*gZWZlXeaqr(x^6 z!+l%JK^!|HvA>RYsOC{2*gK+~v~7^9n*+KHn?0fJwm4MK`337$shCA;Yigv;3!tgM zW&!AS(YIpHgR>NQ<9-3?S)>eqlHR6H#=ePS%i0Pf|B z1qGUClDEkcXY71XPI_l+;+{V_@m%9|E{o+37I}=6oNlr8=V+`9qWo8Ulaxwdb1!si z4oxsrF9wR^mU|9ja$<4&sev=b7d%D?--7E!K&@v_MKMg3o}GQj;=(&>Nqjv!k9#S} z(rr+MUh!{3FqSbji9c)%U>W{RXJh=cDJ4VolVy>9;b|PS; z4<+2$$5Psun3%ACtO6nX!Jnzv8zkoqg`Bq34~(|;aQhwO^!MVs(5knNbMrk*O=W#Z^`)0a4^^s|I2#5tRYCC<6n7-e7TC%(!l>g?BiRs zJ4c9bPTIEK=!$DW!00qK@LD7cQ2D#`^#Oe~{VrQ#w>?K7b{elHd{I!@fl{Xz zE!8@F_}*2Cm>F0UpCWkPwAEVtH5MG|*2Jj`i%{J27qz^KhZFNOrfT3~TpT|#R77IQ zCM}{&HGa#ORRf>ThS)vlAL7OGV+%M5ZEYpoKGxJ=R7G<#QdDGWYng&3Ei0MQytLS#C9E0e&$ax!|Yc47>vC+((O~#8lZR@I4tGwK)(?=qmjjXoY zrkR#By3K8W_Jf%4basm@TkK7f6{OmAwE6<=-c^o!eL>~+L!1TJW_sYPnq-yVz--0X zkVM+_SJRInX>-?9=7K};Gpe~o7FBwt^$$GhU#wRv7Zx<;&yuOjhPfN{O_uJ-X>jhMV1DYSY3-t3fuSq6msy#0FNfo&BWo9?BXAupVFj1tI9 z)T2a+O#XJ06O7E}em5)mzBMLrjc-sS=z2^##2>qhgHwZH-!s~n=Vsrv%8_L?f20nc z2XFv9uB>*nHFXtfpI$#(tI*prF~6A=|A_AUhiqrTEr+e#D3&ikqwq&`&JG*q>4*DT z8*pGI`fo6zzj3z(`za9`NBaGd2{36fCbgiJBtqjBrW+!k_}V4pS!W*l_}94p+siut zy-3X*zdmh_`NDs4VU?HPmnO#dZNKynx<0H+T_I6T{M}He@cX+%f9$D0pnH%dlnD%n z+DzoBMbBQXSc^+)Cw;#|Mt0SA|9}9jpr++M3u`CWsQaG!H)o~$a`un(21>ry9b;i$ z?3ig>U*@Fm*J2pOMXi1T0+sOaZ&47$> z=XU)qFc4U+!-WQL94|c;Rntpdw?s|lzT^La zSKVeDD4+-W2*Kg2x!?ZKlbxGYl!4D*GdJIOV(h2(pp4KSyebkYpLDo;7uq8UgeaH- zdAa0S~B)=7eIjw7miIL3@Jr zAIKqF=+bB(uOufI#Nwsn$02u;!$!Q-#bqD;)ul|x$9WSOd1KUO9A*9x&@hYhUGG*I z-+TOCj2E(3NAmxs+SNovMW+evyPQZ%67f-=dfZC_CN>&05xtuibqT7LxOgsVZ&+&p z!EueQT)kSE(xc$L$e`er{5IZ2+IkKVBfU2p)X@9x{^$PEH8uTeENlt^>p{o4*9jj)dbZM?+;WN_;?RH*ObT z#vN?O;OBwHT>S^~3#@ml+iIm)yJz}EvP8~cfeTpSE1H^530`1~;XQ=xp>x`mIm(B` zExI*Fcd$zGfBA`~h4daPeWI$hkCbD&aD2S?Mz8VkA>`hhGx#HWl^5##a%f6U>gaq! z-ln=JWSmg+W|tMFc#J*vc0yP~#wq23=yiyDL(>!9qNA(ZbJC%h$p(V9y@9A(TGfk{ z@2yM|%^jtFg-wbohOu7m?j~K8;kc5V)CgKr!xP;8K8A;Zq$%vpa)vk)9(L*XT(XFN z^`m4UYoiwt1a{7%osv?GzgUFX$f|MyUr-s94l4OW zM#7oKElcN^nZo~NJG{MINB44B+^UyLND+B%6!^$?hx=`&QzYgFT-h_{+RB1<-|uNY zfW|9h=|7}Gl!nD3^iFpFtmFr2kKHoXXAJs`xVfd59=J(PBJ1o}>v)0qtBde~1&ru! z@7%zy6d`sSufdvHTM?l>o5r?~=pt_U(f&EUIa&q_9oP%DO;?PW+-EfRbDdgCIu`ub zUzt^3dt+K;CU)BG$Xnm0*_Pp&nU5E^bbn4nti$IhW8+A`s**$Ax|YsFaC*ir{DjZL-1dS(O%@%5sw9l zWL?<3Eo2c2^H(`a$@=BS{iX8%&$>kbSqtbJkqLi46xQb zwo0-KCGbVfb?od6+m0zyYQJ);pgc9K5CB1)T~dqfi6x|C=c9$+cG|d@l|LyjytJb5 z{DkS6=U9hrr}btoZYjw}`|b52V}Y+T0a*ZCdpkN(Ab)RfzZmT1Qb9R>zBT7qZ-Lr# z(2qHiMcs2pqZbGtY02%IO!W4Artsdzs=tPkGWpf3>F$%+zG7C%2}gjkSnV;<+-`Ou z?$ah_`Oq!!IkZ)RFPfTD`pLgY`yZbA@dI*H_~a0`h9$72w^g?OR=}$ZU?CF-hOJxQ zR#jcAOVk0R6?b~U%ZXVFV-DhaLb+;HekeNvS^^IUUJiMwI3-?gE=+$Ry}&>B*&?+a zVo&^d8e#JM_rQZ7i@2+bW*_`@=u7Ztp=7&;DNVERmO@(mL3CtIz-s3bLX(Anr*W2_ zE;6rxE+<`8+kGls=4}*p!Rl>)6n;;z8?(q&u!ThG-0LnGH=FG~U+~hYbv^#G)_pth z|5EFu?*6HDm$m<|wXQyRQLW27^uMol{4e%-%K7$|{{l-+pEyx)`ywTY`68PKm9U^9f8=k_zzkJkKEA*#_vmVM+wT3>SL>T!zuqM= zqmS+Z3N?1*C*!9CiV9VbrvH6#7WG_@>=VlKo*C{ zC{Q45K2cLwe`o*Sf3~;t1dt55lDqNT?9D9MBu4H$Xrop;?@S3N+9VY9iMS`X3YL>1^@CAH6!CtZDgOw`mS2(6{{3WyeZ z*{yx*?sn5Q=R`^6=;?VQ*?;j_=C#`lCfkE=%ZvqkUfuK4(5i)}_W9ybJBEJTFwn+- z+;(0so{TwueB6xrlMzpo^@!`N=iz0?sVAGG?JFXk)>K>kmTK|w>z=q<_YgAS-ttAB zGG8H*h0mYokT@P{6;XZ`QUGRS^)+y#uo0L>1+T_}?^T-!j{o>kWmcGFp*~^!8on&I zDe_1h7}k`O#|}_&B9VvFd;*@ZDhs5S+)-WN=&|k_sjTv$!sYzM4H z#A_T{Lr$)Fpzet;Uu>>H=jc9dZO@C%?4%Q#3}tC29>0Lj!}$%Ec!y3 zgi!y!6{wszi6{TC6k9w$&rBEvef`S(-RE@s<8hhCK^bD=)cAX9s|?TlCfI)tPh6fv znMI9%oBcj~bGIZZLGW|hqA}^|vEgrXGhZhZ)Sc!AS!VNWYi5tXKR_aF2YWwXYwUD9 zjJl0%{D*o{W>1P{yNXB{U8xIG5taIfv^qC_^&;M5i|5CU*<JpAF=^lxs2M4EW;Z^g($&74;u{4r$zs>1)9;`*N)4~F6YrljAgc>nI5 z^hUek{R`&j``&pM!uO0cp3<9}iZk8Z5Ja$Aq)RIeS$DmE(O{ z4T&|1^rad|`aCmr_UciumuaHBL&zz?< zWwJc4@!@yw9Xr$!?qR>PTKBZ26M!3SqmMEE5?R3`DN@hL#yDP(eU4`ir z;o4S+OvK82=U5hPcLtO7=1Op&eA`2VK)ugULkil?ih5_Ak8I%?N}X~@-!gEVtvcQnN5vw}^>$aubn%ho;JkqOODp<5&St${*$>}bv1eC@5Z{1;Ejn9s z+K5;(k_6BeE4EH%O3gy7T0kt@Vln-Tt%&IPdyGyo>?~*Ok#vPq2LKpO-mEQBNWwVe z{;$X+#p;-}^)X)m=3ZzcV=N#pvQ9bjst@j8EI0rfaD7+|V*B{BnZ9Iz$`R+w94Zq= z`6rV}Jsz1%2efiBf^Xa|rd;suUAQ8>uff2RN_@iZ;*Xi{O(zS+9K-l5E>+JaMmJN` z`4tyUJj{`P&CugZAY%L#0B;s0 zKh~I(UZ|Tfl2C_Ifl{+-a}|g(Y0g>ljZKF01GM&0xq3gNm|`fgZO|Jo@vm=CqCq=7 zqK9%A2p&v-xWlIx7!|M6Cciy2!3-J0sZ*zFLky^hIKIP& zkt%-zT^^1?iD!ShnY8l+jY4@+Og~^HduMnd6B* zZogHb*H}YuWOgwQ9+GCi21QCv!ml>?qtWGEMgBq_)mv1^cQJ>!3^b&;Wqy6+>pNAi z|9r=fYcL-H1)PGnjq|N{6xqnwSYKCH@IEYTOG~*JOXT#jG#ba)$6@QG$J6ZWbJ(e{ z2dXbX55g46+%zXM_}pSC4<8nMb=kH~g)U(ICU!B=el>Pp z;U}J0i|erbXWm-KRb3->+_db%Z_e+bzzT%L6}N^X9e51cKmQOv1g?YHN0SRjvQ5uI0}7%+)dr}vnC ze=e8>v;1mj2Alg))49xb%wCcEDIy2lcJ_P_f&MwQVtv?ULfNi)CE!h6#Q1>ioD~eo zEo^P+>u6n>PpNsyEjKD^KO`-J)wKWgNN0tK_1XH~&>6$x)GaaK;7P4Z!-RiW3`t z$=tVvz)3qkI9$RFRKwiV)Oxgn*pvIu>21eu8&E;wg`_4(8&_m`$7T1jJq$?d{RfdE zEaG_%x_(9nBhjFiemSX9a91kSk(O3RS<6)3>!z2Az3>WA_lkG^P`= zk+Cz|H}JA8ASkyQ+i0SDIF)bF*XJ zin)o25Vje)A-Gr=R!{U;Dv3&CMIx(3;FH9`o#$py8jG8VS0E`{vV<$bCLg^**jWxQQJ;j z-@p9DeDVz`C+}^yl>2`_#phnS_)<4Jg0bil@L=hCXpE8MyXW%B`OKByqK~Eo=+rd# zzEr8uF_nPN{aELPS9u(Yzd}!TJxgHuJ5I?+4dIJCzOD;cvV_$YZ$S|ebOG454xzPr zCmSRcnVnQzK(wF+KUn_YFHpSoW^g|A5Sn|do?kfz)xv)_gjcZCB6|?(!8=cx=5<5A z&ds+!4$iyRHBB&l;~_(%49X6q|HT6_N(;s^LXpS7ne*?uS3?9XEcTKs(i+6fL`z~D z_$$3Cbm*88kYJX|s0uO>b3C%&--F%$|ZNbqWZVT~-fF(`ezKoGz2*Vq5(TBT!K9P~wibRNW2o}RG z>pw^C|6kzc4|7dl8tqOhHvV8fPVx>@y|vbJzuj67$)~jUH+s<;EIYKv?&1F_?#sim zT-$eF)oNHpXf%`|No7dL7z&kyBttS(h{!xgsAP-^QRY;}B4f!^84^Mv^E^d{ka^nY zgVt)T{rmQJ9DDz<9p7=Zd|uw?dEWcJuj{7ESlxL{hhwoRTD9^iJS?uLW zd79TKZ0)m~Th@+5URb-f=nB=AE%rCxrDxqfvGyjF%lik-S;M}aoGGS)rD2b<{pu3; zx0LhTg`C{*^4FbVb0zb_k3!#|A2i1Pnss8;CnY`&@+0b;O4FzwMGPEp;#_r;5pELA zpLnR1ih-W03{auKl!2?^f)-I|bWUypm_nDq$8-VrIHUeTFS1A--vOv}%Y_{S;=jO~ z57uJ34XVtvR)dXGIH9AsabOin$2FK;a_-w^ZXjSjDq@;f!UVRApXx@;U0E$t|xF^<(M_jk9PksHJ^} zs-XqOyHag??pEepx3461_@H4X6ji6~CiOZ&PgRvxvd;|o2LyC?cA^}F_R^u+Bnj*K z>@)l-e8o>B;jy&sHfGJ@OsMA}ZeDz|NWetqop?|vFP=Z=9Y1k>`lq17r8iw~>k;#AH0Vbrpf`%{ut}*@v?%1p7C@OQG6K#V zpgU;99JBf{d~Oh1zq-T0fGcy@diNyY7c5?=cSjPO0^}Q z3v93BxQf=TVOi%K!DLE${rHHhs>8l9uEdtWf&3~XQE?`2Y#EH&=cK7a&t5OQS$gSc81;z1@zmcmh>D%MZ0 z?G>IjdVQKr^T=UUvU$x5(kn>wM_Wmz z61O(2)Ag_&%ocMJnEDv`+P*AD(V%&C>TVb@pWbpoU^}J;qRqcFo2ly_3#nCW6$Oc( zx9A>bHwBhyiA)ENHSn2a>gk`$S&`qQf6rNCZ$nO8~eaUQp)DV>LSZAa*S zf6?shr|e+kvdw&LhWxYQTivwMOz5pUGgR`sHW}Gb5$z5Qk2wfCxV5Ryf$s0?Y{VQ5 zCl{J4jK8@i%H)g9^?z({IA#IiBfj3BJaAI7*T85_%PB22=6iPX$;QyB14@g z^_eNb(bc5Mpc)o3lGE~F0F}yVhuW0*`)r~NMUX3S_E9NidDW7*7sE`oA0zP!}Em^DU zY8vVv#Z2@$V^)ywffwv<{?XkMS(bZz7`wcUfoy z_8;6ukg^t+VPoLDh<^Ii62m2n{rAFDELrQUz<%ZDC*D)UUAIZ>v(I_n+k|Hhv$# z_0>nH9&M6UXi`QF#2PH!e0`z`?4*h?VT}V6hE}9!ePl=9|LX%C2&+L)%#q8NyKw@@ zg^L~rwORKlFpwVuxzMGeg$`wC#j!W;%|*U{bl~DqwB4yaAg_$mhmh{9va+Xv9z1R_ z?}&$-Qc@!bjb3qe?o_+NY}?nRNl!&ZWrf+P^C%oar7$)jVG!pwoEm*Yt-12eU+P8+ zg*Lf7xvKemw_PfnyLX9-=D=y&T20Oz1ZCuzE!9uxM=K;Y5^nuk46E1DWa87v-L-r; z1s*GpF;WWP&6t4grOxRwu}QfU9S0oY^km8y==s9f*m4^!dI zkE^c|Lcs*h#i&uB`v@k^_kKNupp+(;0X%~wCI28|`bScwu`jypa6Tf~^a1%v4j43o zt06fzhxBF%=>-X#$6C zHWns>S4DlrYI%>c2wI*cZv^`Lvmo-jcU>rv;O%gnkii+I5y?0=c9K@PB zxR#I0q2&*K;!#NLMsG)|%jL+nsgeW^rL$*wf!81p#U8@YgYyV{lqK&1LJi8SH>KMr z1ym_3+?)7bGt?U$Zk!zc^d$t$kY_?Q6|<8uwcmFYY1U`yOld!>GI@J-%XIzfCZ~lt z6vlWaR*;>ZnaV(fBLZ#wtz|E7qo_4EY1$Ug>^9CadwAkbjWI3f)=F8a z-!5eZ490$Bu{yV&R*FFHb|}9E!)Z)#{^pj?wRT`c@{N{5~;qaz*s`sKu5Ne*5g-e-4P}yjJ}0 zC-dLFKk*huqG2_wD9wLMdl08_`6QC$pG)=Uw|q-o1ZdD`&e0jGIrAYvh*3kCVgQ#abX&X-6xUuYaBa<9_Us-7Ls~` zP(kF!e)?Fj<*7AWwo%yx*)Yoq98oHNypModtsO}vcls+tK~F;0sf zX{DOcXEF^6SkIsrFgteBv>BGbkCV4Ha4*b`3X>;LIp4E5K|Llok3Sp?S&Y2XbmjL~ z!D*IRDq*)>k`#F{`zH$}y|gQ^1d9CdS_Q7knAHHrhH-v>eOzukZMvu)xihFIi zy#TW@Y%qt?z|bW*OPzyxz8ahPiSl_%@xWU!nGl5IiQ=B09oR6f4_4D$f(X}!7V|Ng zdhW3lmJg%c?BV6*Hvn1+wQShudhV0KaXLDwJj%{;Cp2;xH9m|%I%PzQK5_^=yzSBW zHsB*XNa@Wa;ktcjljn%lyPJO)RL28Ikkj(Av9d;K5uv2z98ShyW;F2E`4jrG93hDebjoVL|h^WCXX2yz*<-KA}JL1$-8X|k4;r)!M( zm&!`9$<~!g(>PVU(!X&JK7b63s2}mQJU!^R-YX^_6OOCmR3dL8jaJ0qHOL{WJ|)1g z4@07Nh&j$eLjy1t#;xs|N1Vt?ZZbiBev0SL?e&a@Avn$Vi}EA-CRxMBFqj!b8~am3 zI)TKcp2Zo*i~g*T07rgD-~G>Y&<*u%A_=)_TdJ+#!O6xdzm!09C~K7^tfuqW##UzB z=i*4eVht(l3!_9S7KPj`jG%W3k?@TvABF~d;~~FzfJGSb`4Yn%V}ix3JI=qzuuY9f z_gu)CZ1)-&&VaEEbW-YL>m%20?(&Q&mOMYJk}CCrncwPL#gXxu7!)>9SH#`$T3^=D zK{vq1ap++YJ9jrMhV-*LIAhuJbk1)!DUanp7$cV{O+j-|vbhwH5M{2+ z=Nk~0zsY#OWUJdwEJaF>e@8~_R5c89f`lG3xVKIx~ieyM_Mf;+Bn~0ViGxmV)1-2W zNQ9n;KJ$#!M{eUrfyyZKai3cOQJ9y|02K9Uw(Fo*Yebrj99NI_>N2YJ8acDs7MX4` z560%GyI}-(O;r_oUSh>Lul71+cU}g-jgSZSNw2XL!idRD{&E#J}OE^I+8cDgGjL!6Ny$CUv(j;q)SuX_2uP{ z_$P01Z6ZaiX&ze6^vEPhJuHH+dO8kw%s*ip3_}7F^lHjubQS5F%Y^V^F#)KRRwQv9 zV<)>`=a(t3H9gs>Q|X`SB8M8c&*Z(Wc9T`hKTKjcx0-@9c>?7M;x-*^jLSb{9v2Y`ayos^_M`^+&JQN-jQ*4R{>)+eY~(ijxnV z^|CvPltw5LXq=lfG}pG(qboSGdB(tPs3h6Q@D=yF3@<#wiepHAsuq`p-bvq-p?;_D z$2anedD*Hc^svWCk{t7oZ(A&QAP1ZpU?&ZpWA%6w`OOdmb#u-wZd=|Euf#^O7sGpo@*ZjbHKXpN_470<^XJwtXJQ!>*F?j*0?r%9 zCMHf?UFrC_?=6`#E62h7Xof;#eIi@GXK3X+scODTu4qpy*PvDrOaW@1pVJ=94!f(z zO)+Y=?XArV3VM?M7iNjckAI5mS&!ZN#s%+f7<68}+7ItK3=w6V!AWt@X0Q?7ZLF-U zU~JElYbITi0w(|!OOs6t?7yyAg~*G|@h&AZo3-;N(V2#5gNnjW6!6TCOAWMNK@N-K z%G1N6wX1)nYCeMlrCvta7Gq92j)xz}NY3Af^QfK6 zO2=+IE~J!-xa##r>MU0>obtQvcw{$-nzg&A?Kr68p7mWxQxhdDn{(st+(Zhrk^+re z(eey+%6gU+zm?1}sU7n=b!I@*p(fyKL?Bm$-`H3KmoO=i7>|Na0QD)0D6b@~Gr-s0x4lJ1m`?GSZP zP2Y$H+`%fTb!iY(1U=0 zbadBMU*VT7k>NFK&sU09))1=@(W~q_*la5TwYAsDd^WmnGiNvDH54S?EBBem7B0rV zgGhHRwx@@N^o2f^c;GrX%tG=IrAL)ZQ-2kOt;o@5ftqIyU$O#-89A2^uPc?qLomHg zJb7Gr6YHtkTqh^67Hk2~pz7#hZ7VAW)T&gS0L$K2F11*ptHj1jzqZv3%MN80ZgO1m z{qq>FAxWrlj@Dh_|Hv9IgAtZ}s5-amoBk4_q8-3VuxOwcO6)?Sk5$_R4Zee^5hcF#2Eec~0a=`H! z20vN4C0my^cH{=QGN~Qq`FuLp(!hp_J@!SU?I4bWN_jDu9TWG#Qd|VWb|(fyC#aRx zS!TfQ;(+D1(`Ke-h40@VEpdXa-O3jg%Lg3`u_j(0BOT>z^zB5`u@+onliZFL6%{`Kmzp6K?7J&;!r$GqY4-|dsmWCo&L^H8 zaa}db0yT>JJNoS60qddZ;IOwiXZF1uv{whP0s2lK(T&Yw5zUqxbbl(~p((yGDe)j(a! zho66l5VLwv^9i>f6x5DR%9LoQ{ZJ-Sy;fW zDH|E^m8Z2Mm@x|9H}J&ON8r14AL(itoo06kY0CD zEd=5LXQUHtcJ0_D)^>)^wZxFw1mC0&?#nmnqkx+v@VM`)$IPCOFgFeZh4ZSy|ANGgDtNo0OY#8h_+YnE z%euPPF*gpvURv%;F7<|QoykDJC%kw;fO)53FD+s!RN!1x zUOhR_!9ivN5wkanpYnT&>N;PcfSpW$io_0eKKcZCIXO99-DhmH=xO1_x)^|KSxHn`_ER`7Zg-*?#xMjGCvGWAAi)V}w290aM&Oloa6baBijxv3( z1R{DbGQLg)oUV3xs!U zvG11?Rfh_1AwJ2Cds%C1KcR&pX6oT~c_vzeMAX#1=>?O~3O2$HLx#T|>?NU4RVD2^ zix*h+PARW#y2$lPbycFflj!hWw)wqEm`a(!W=1ZNfWi&IBqmWPihWszPmC^D!`@DV zN1G49c=hbz!eGzjlW14)ib;dRTJ=LDk>xX&@z#7hk8?i|qS!b_GuB(#1E;s->pxnL zSW$k?#nF#VL6FO+%fz)Ncgps9zvg}B`Kc<4J73US#^CVd zi1uBo<6fZ5^T<~s2cKkAaEhy!PiD^pg$3V@Z{`$z)LDJ!@=;iVtKSEU#S69D%8+=sY5y6KXkN4|=Q`A}lk`8*2azZr z19PY*IamzzbSGY1)o9p~lRbU16ihLw`HtxUSxm=5LUf{Xth$Jpt%3RsL@=tUDEll? z&7H981(f|r2IPra59Xv}v9!O0zVQBBlrQU2B#Rp*q?1||mssL5-54B+fm2A4+BX}_ zLbZpp$v%%9+P*r)5V^5n3Pb+qALDEd4RV5omUx24j%HOUJ4cBnifMRbN%m5{lWsh7 zU#>z4!N!Wotlps{QUM;d_(S2}L7w`=4qxY7_qZ!KlA^>yDEEO+t_7se*ruE>_9&*O zKrB4T0%K*NpFKE^zE~8ICF8)L?hKju(%o>3DC%qXZ;ahYB>+;rw>my>*aI3kC}f{L zWf}XPLn3MYj>#;pOH96lMD`Wl_j?xC28{1 ztqqH;tquWqhu>~0;kU`2sHSKMWavn@rbEs}nlD(!fe4e#&U+VO-V27qjkE0S8d9Mt zG1O#}RA`(dLIzxa{=#sd8N=l`7*2%2mfatsU! zfns^h=;~S^K#ikE-@{$F6ui9nc`1*z;+tMISvMf>qot+26Z(5#*E?Iq|9OJ&g#g%s zF&Y0=6Y>u3yc>5%sRF-4sIe)qEDO*!RY~-^E6Mps&$-PW(|cgyfl>FA3w!}S2Ax>j z5AWT3iSapUvDG5wJJoW^qmz<8PrSo>+mkJ*MnGIbI$CDv3n3)Dy6USkP!ks(d@aH2 zx`8J7`iylo*ZxRo|L$UM6T^^)Pr*P!IztaTsb5@)@&$NS*v<0&{_ z|E8nmA4FM4zYMuMoMk<8t?a`{mZyOKYv(Arh)*N5DC>*g+AutFrSLF$&e#_5BEdZ# zY|nths-7I*sOV&EJ&x)*J1x=#n3f^1-mWA9>&e9bhro()dn{3Ef5SYvOhwhQ50;vl z*JVeOL=u@fLu>bOK8elkoi?Z}5}~MYw?NT?hx{Ot(eA}$v`kQ1vVeNWj=AFfiQ9$Y zr-;FDQVJ~f?YWU0eQbO=VCf@I^7?GUH6pvc&{tYi#I}FG-vDa6Kl`d>(hH8D#q+W2 zlq#RcrRNb5tr)rrVDyiRNWT1u){d(xi%j1y1Sx&Um3u%V;t`lyPibBzZH^oW7Q&Cg z^c0rCY^T(;^85b9%CY3kMDD_Mq(-3kH99zf$NYCcQ@|AMVMb^I{N^H?YHMR$rKXg% zfQSAifC_zYE*dpjKR{*)Eq^Y%=lA%2Z{-HVKxLa7* z9@g)&uJoG$X*g|*t}j>|qg zaB*RN4*G#-YG=;)_NNNp?s7Qgmex?i%TO}9FF^5+dUh=^68#YFIIxoz+hKgdU=7D_f%?NjR#YDoUWr&p8fLBhSyJ`1<)tQKen2J17_dH8IusUU31o;znl3m23WVgW;v)) z&8p?>eFei*SHn3JxIsG@4jN^kBN7;~WG_tv(gq?--91*jtXZ0DJ08okxFB{(^L7VD z%9%N(!UhD826iLC{Hcw|V!S*(MH=9<11&%z64%RY@7FEoB?EWQB=QpIPOgK+!(b~K zDN8tBISkpi%ye-%*jMZ`SSFfowTrMnAB`AjDGCXgM&<1;LoJ_ zg88{Vy#VPZaf3O{0!Zjs$8te?P0mUyzj)-^=BLn_gmnClJ(I()=Vms|3$+-p5)WIX zGL^3H)gCw{)AIE}!vUs;(y9Ya;W`V@vcup?YPSVI7y9yx<;-H1u!_exLH$YZI=L&O z_p#f~Yu%6ZIv*m_MSfVQD1Z3b_yh7a|KJ&S9LS_mBa}(eTcr{oeu=$|jL5d#V^5Vc z>PW@KCl%@eQcP-JUQBNB6{)8)$)W-#R##^i=Gb$^#zT@1b0RGUOq;v=vkdzAy{QtV zLW*ivlEfeWn12NQfk0SV9T*Oi*KMoo%KmlmV%)QcNtA~~sDRng7mL*1*uEudkKI21 zA&%{jWTJRk*w(5r!{elCdO^Ht!t?xAAa_gXJTT$K zs$TZX2(?vz?PpbHq4GMr>c^6sqai}!LtaP8n&rewBCYb#Gh%h>P)L^&+^k!Xpdnnx zRs0a^)MWe$>uTWYxN2yl!PY}SY6Wy1S)`y{MJhw!!dqv6C=^DvhkqAdl)FM3)fDUH;}bxh zn12xtvQds(z8bsw{$JGEQn_}w|AHyY*YiSasi0jcAbqxr(clgcIWT+Eq<7S^@HJ-B zd6|ga!gcd1G3JO?4i*#xwyNc`*>$jCt{q<>rO8wYJjUKIQjjzoN zs?E!yO86i@0`raLaRxC*b^69YYBNZ?`qtZ18vi;k1m+^f)-NS7S3+16J^?xBVn!Y+ z>_3R%J-L(Z>(kPH3k%lh>0Lx9@YM=~xj391+0-CbilTUC?SII)@nKjPF|N0IQ}wKO z6b@lXWxZlJs$Zm_EG-u*WVe%;;c=q$04wWd92?l|0io7Bsq|OtV&(P~zx>5K%0$0l zqY4fh>c%*fW%-hhU-fQkT^(el5V-AA;pn;gMjZz6+l4G+1YQehU%dFZhB^t7xy_GY z^%l40qEyFQGRjquBUElw11q>#{&;FNn7c3!Z9a{C$oKd|MZXo~D(~jMTO>zAUZHVGsgg3zt4iSL5*=Blx$xFhq!n?G=fAw$6F9V!J8hXVkHvWS5B320i=nxxypQt6)7IT|dj%7%Cq*GN7W*A=z6BtaEl_D_N=xc6 zCHTaPG{6VD2;Cc%_$pI5YCA>l2za)NH?$$-w*rX%B@Zt9k9^_cgT!Y~xtI8`@l^vx zkNEfh6H-(SbPrsB5x#9EFMU9X*1XtgC&?x0hxA6b+ZV`~)g(LbTw$_yR`$w&X-F0FKQUJ%e8V7aD2vw3mr>~-i>UeNZ zuC2WUth}_uhD5AL7uo2)l|9^gX^rXL;G4 z991WC@iRTKcLW3)IFaQ_p52Kw^1ga?=F`*q*P!y3i_qI_y4K>U*Cp(R%s9} zboqEWF0mO|#DD!2hp~@61yvBs%t0gOvEo%$R-=dtsg317J}xlF^P4Gp+g?(#JFk8( zqIYV2(#qGH&zVfQt7dgmV^cbr`|X5-LX>OEwwr%cI0uKUn_qs0&8e#fcXgP zm%Nj#*LbZ`7R1X$2v1KBA0I>94mXOqgr3>KH{Y!@5_{UM`bh8ZXSeQv9XC*Hn$_==iX&>faOQvpaTf*=9A+z}+Mc)&5eRhrM$$?kV9`9P_jO*7h zxQjmw4{KI@4$K|l>B--3o%-EO(ZKH0Gc-`BBsx~*I`xGw%*ORkO?HsCOvy2P?)~j< z4sJR;({<^NLLH`+2Cms~V%x%tgy!>_IbF^6xw#kKJu$fB?yr%lIXlzRve2KhFx@Mk zvPbq!d1_|Q(WNI1#txDAWcmCt6T5?#@=V;;`v!mx+%P@$&TJcj1S$_4a)U%#`z``Fk5M--oV z=RG%u`8^#`W8cFS!rOK_nErGnFIW3}WgP$D!yhKL;G>tTeusM>9qe=-_-93~cIQ1M z^Zjw5e?Wp_a9K#*mTfliS8U30&Jl|igEAnx3=$X)o1J~c;PA4q_`%&O)*cas@OVvo zqv6978~6s(%sMP`h6Xbzg`H(6Or{Ed*wzS_zMHH&w%H|_Lv;NkWvPM~Ywm$>bsagx z5_06EdIrGoSU$W{YtFzkCd2!d6qB%NtJvAISxj3$Ll~YW;-j7=w?llpx!m1=0C#3n zxH#_F$|NMD_R}k!b{BJj-SYKeYnEka8&p^3P8P@yzTWl3W@wPXQI%~bbX3xz(|6#_ z8!?aj?I{i2R5dHN>D^=%B><*hAZFTx+Y_@F{~3UvqS zZxairZv3$PPRGe`a|$=!7_@y(XjnL#4#sE^Dot)>p_;fBfNKJB|b ztPC<7h!*|SpDmIaIv39|i)&S1=dXOL7!v(?y6oMpU`~yFf_5YEV%LVT-Y%Y8Sv}do z;8cVCwqKZ;sQ zqYkZ8tGs6Alc?^zJ>j!rG&Fnpn=G|2U21&Dore*joc!kszcrX7QhLn3Fe$JcbSS}s zY)bnsRn8q1CL0_!)Rbut(m><`5e?|gyXPiU=10X^Dzj&dxVibCMNc@)4lg_ltG;qo zI;=E&;Tt)>CF--*(>a-Dzny>v8xpmRc015+BR`v4Feo2#Ltae?XHN}AjM;o_G02Ovc->iix)o|vQ^ci;20oXOd;%m!6an$S_@l=| zG)j+@K21*kA|gg=+lS{)wtR;!*dL22&CAl=L%Z9NG_e;KqpsmKr{Z=~AWQYIV? z+ev}Fy0I;UhZSo;a~0OWO$|;vE-I-bd&j9BbU|m+^5-9Bnr7DAYqsSE C: timestamp = gettimeofday(); +C --> T: TPM2_Quote(AK, set-of-all-PCRs, timestamp) +T --> C: quote=Signed_AK({hash-of-PCRs, misc, timestamp}) +C -> S: [ID], EKpub, [EKcert], AKpub,\nPCRs, eventlog, timestamp, quote +S -> S: check that timestamp is recent;\ndata = Lookup(EKpub, [EKcert], [ID]);\n[Validate(EKcert)];\ncompute PCRs hash from eventlog and PCRs;\nvalidate quote;\nsession_key = genkey();\nAKcert = CA_Certify(AKpub, data.ID, AKtbscert);\nticket = {vno, Encrypt_server_secret_key({timestamp,\n\t\t\tgettimeofday(),\n\t\t\tsession_key})} +S --> ST: TPM2_MakeCredential(EKpub, AKpub, session_key) +ST --> S: credentialBlob, secret +S -> C: credentialBlob, secret, ticket +C --> T: TPM2_ActivateCredential(AKhandle, EKhandle,\n\t\t\t\t\tcredentialBlob, secret) +T --> C: certInfo = session_key +C -> C: PoP = HMAC_session_key(ticket) +S -> C: Encrypt_session_key(stuff =\n\t\t\t\t\t\t{AKcert, data.for_client}) +C -> C: {AKcert, secrets} =\n\t\tDecrypt_session_key(stuff) +@enduml diff --git a/Attestation/Protocol-Three-Messages.png b/Attestation/Protocol-Three-Messages.png new file mode 100644 index 0000000000000000000000000000000000000000..42c4ef7d67f81c4ddddcf822fe53434e79253fc2 GIT binary patch literal 55368 zcmb5WbwHHcw?00Af|8QbhzKYt(k&t)DIi0KfOJbYf=Yu(ch}HJgOr5Q3@IJb-3{M8 zsOOw}e)n_l@6JDt!^D2~UVE))JG1cD5^fec=W zeih~l{&`?4redpSY2{?5Z(s`%*SFArqhqW8`i`#C9V1&?D?V0MD>EGnTRU?z7ClRI z+=sm6;2Tbz6;*8iybggl#@i{5S&Tlu4vMt34Fd!lKE-+)*oR~|VIlL7AxDcv0It?OYgO`{+A ziD^pc-tSFU6sWx?+ zbkBcD?Ys2bbhZU;q223!*EosMi&@^BPGo!t@YZ?p^3$Wh4Ey;vTD`;pOspK&zuu63 z|M7V!MK)5S5DC=>3;Sh4F^;v^N9z6NKahjb#>NMjxBH0f4XG1VO3HHKjaK^`&d<;V zm1(iO(*y1`9;s7ym=_pwzCJB`B08A3f1#Xu?@9OU8`+>E`N1lqsV!X9emVH{Y7&V< z*qX|~mdr}JNp;`JN9!>EN4J%RFIe-4&k}1j zc1NsAHqY9hY}%UR+BgIi&$V!3r{4LZO0cQIJ@m;crmOH$JencJ4Hx`}?rkL=!9K}P zsrAq?GOegPF+QV_=f2>&Mu~1gC**k=zvFIM#62Bv7EK@^8k2WnYm0dVx3(P7k&+Q7 z>@H0uymP&9{`exxa$}A>1-$|q-c!D)?U*0@{vqCNT!p&RkMAgC;p0Y+k_aM*wfZKU%wQ6c*lyN;fy3_@xF4mbUc-{1+W+$9S}_an7YstUPI;h3CK6MdG2q|%2>D3_l8mo37L{?s0d(}!B!_5z79 z?1#vQZ#EN7orM-=<~m)v<9XR_7Ob$Ns+CcXBh!eNVF`|j-tl^EVDRkeQx4OiyvD4d zBRmbS2b)5kL~6X1#6$e1e(IJJC}w%JwE}nUH1zkgv$BSu)gR3UyhTA%vpGLz#{V7@ z|3PFQlglr!(}0PaJBo!z)4uv>hfAuIu=g2ho|c#~yD3d~&i57LuPB1s&G^EnKYD&H z<>MrWguDo$6r6NFU5||=4eNj?WBsYH2h(;x_)qvtKZjCnOw%DD(@yX&xiGHq9 zKBencqf8vv1XCYe=_Y@(KOtka-KzcRdc~AYk6^e5hz1Hi+pYcm_2I%PFm;Xw-k*Bn zd3Oh1zIgxcogB4}j!uZ+!ALL#Ka<5>3?imvbg&#u_wO&o7$#P|nMa@6yExqxfBIC8 z)A?}Yi`kDyO3=E&Qd+Thsot~z; ztp32|ow%Xb3sEF|NvN+cIbt>T>m!8+hwEeFad&BGoE8LK4&+|1 z4&@6pN%$mF`YD0GGgy>e%&LsHqyK!DVA1ytFI@&MF-RI&XfoLvXF|63jo9*2cT;jV zQ&vO>is$D(k3gjOqyd?L#za9E_zNS_?V@2kR7~PK78%wM^DowOs2CPw<@rv#3j^L% zg3hJs=|BDG6SuO-%2Yl>11NNVehU>o+d?@%Gsq1Q*m-Vky$yrr-j@;XQvhyVwS=oz~+`^yI!a6Y->d%C|jWs&D=YM_= z3r~hxr!OrpJAL+5H*JB#h<1(_llmFXqlHy{@Mi1q*6D~sO&AUIjFom@X2}-sEDsgs zw>lhb&3rA5Kus37D?i~}j12R&MtPVWU7kJqVW@f5d|z&g=jPQ?nYxihwB>VhcPAwz z$jr5X2!k(Owo!ScS0Q1s<^Pa(xnluOmnijHunX`0{#}PR=e3%Qj7-KJ)x{QCqSMMi z&Ymw63f;azPvK>OpAUy9kE<01=+#CP5@$r=MNOwoMt<%kV!`#~}8p+TL z2Y9P`*$6c@1)rk&q1L-f=kpUgQv80;xOoninDbWawqS};VO6e?d#Tna`WRSP`nlHD z)}_^^!z|^JHJ_`Cp>yrejpW4C3$?y5Aoha9<;A&jo{ETYQAc|_V&i9L->+r@IWBZ} zQ0Ka2MIaV!{n?IGxg@<5y76hb1)!%ib-u8!r0#hZ_@S5!lol zjC~fmxH;vzT#*Z$hV%XTI=QV5kt|W-6H_G}WE|=0tV)jw*(@Nag#ARcFl8C0NhO^9 zps=D&*lK6_P=&nHxSGw}*_x$$a}OWS97P%0ESLG{)3^^fRI6nwxFT5z98}9bS+ZuSM#*0n{tW|n7H0lKwVA`?BF(1B4S8a(@l`rV#tEde=2`v2dw8l>? zeboPliW-CPojacSq~oejZpWL?;)XWn8|La7m^W7<5i16^SP~8R#;VljQ?8KF>%=Jz z$C&3^rhN+5k5AI<`Sj^i9RFFfqxkyU%AK7z&UNGPbK78BJV>vE)|LM30` zJaf6xoxm@?d+adfb~uE5AtliKJ&Zm>nPz0jS(AJ&zbrOPH&?f4o7UHOU4kUavbPqC zi}NUyZKQdY$y~!QvcJ6zso_U*hF30p-K0!}EpsCib#@^{$sJX4Q zNqlxDXGhx<{PwSF9BFZagr?0J6TS^&p$03*unar?8&SFP(tb>Rm8Q5xGjhEYp9gh6A zgGW*PMwFQi_4WI9A7x_GjyMS1yLWHPOe&Hor3$U<@jFdRU7uIkj}FIedekkyw0NKu zsw2(uky+*shJROTc{L|>i)J+J5zADv6PcOG7L8t!Uw%ocbwW!#?1pFm6RGRU8DoPc z-nvg~$_}!GKdaW*=MxwPR+vcmJX9$w`3Z+B9Hf4ua2VII#y{mqIzQR1*{s9IX}ehP z_jty7-W3rMq4O++QYOaEBbOo4nEYqS=g-Ebii+X2DZv|caBZ5R7qUk^mZU*WH>f&X z!IbJ!k0Q6+IDKixc)8&J!2wll8C6wnzv6NHLH8$*vpFit6^AY?i!bGgqrMSXkJZ`C z<@aHJm4ip+{=87!U~>gc!wHI@kb?Xw>kAQY)IJjfgM}^%ciq}Fi;2q8QjU=7!_cLv zy}i8*sVD_6nFAsgjc=cW$a!}bg)gg$rkDe9QfdY(yTRTg)b|JZ&Kfmfo_%z|yeOwJ zB(RZgn<;RWX+cp85>KSYP{}Y+phQMMGn!v!=ONyq<(z5Fi=~1?!ME4Vzqz;E-xiy% z2B*eU3X*c4ev2k_H0?dt7NQJ=norjL5IvGr_m*K}W23a2DzV$1ZSkRWel9@nG92GJ zlqH)0uQRm(rRCW()ODWM-)=d1FSy!yb1*oA`nr6JL*RTN&eHi{O#-E6FjpDFWjtN| zjtd5R`9_e{0bTJC5#1^O8ptviM{^;khnt&&xlvbP_vF2!%6Wm44>pBSf1@{=(^Kxx z#IKEu7bu&ea7o5hn=F>vBN(s3uWWzdSsGFa}f0kAaG(J)*;HlcyY zVlWeGL|7>2V)^5)D;aD~egV}P^Tv(jBwEdCTc?$rED%lk;|!tLI<+QpI{+8722)7s zMS;TeMXxQm{sQ3P!ND?BK|%fKCo!js_>DY25VALQIT%+he(8|PX#>84t&?D zaB*<~zhwRvO#6vz8+syt-i-gEm)gkc+5QVj$=Uj`{!a(a?oW0n+4NdVO^1V7#K2sXO%>h=?8<79APu~g#+#VaA1K|AW?1XbO7im7 z07_X4iGW^uqmB6Shxo;P;@4he(X19Y{u%a$0McOm>jR(|?oE5+fD%=1GHBA^iL^Rg z7-i#`P_-Lf`Cx_*1;WF;*ZqHNfv(38udhYwYHi#@w|o#LX11dt(jhn?Lub&E&7 z^PG;)^T}LA;<#d1O$F;& zidEKL$GdG5pUqb>Di>(fy9*8`(!JoY`Lv1->24-*#__&RfiV&vR^epaNCUa^CLb|T z0SSShdjua{#FyAEE5HP062Um#&W^0B3Lw+c|MNw8lkDcKbVM?%e>TACibqFB|5=Uf z$!`50XU!Wlx+9<1e=is>z2(({J^rcIQz*qm#7_d+--bxieiuha$LBZWSP|Dp+P@Iz z{(G>>YHNp|OV|QhWHa4uaBw)SR}s@mLc(Xa(yv^&F~i^5Jf4<6b$;kzcxrMx0Ez~o zPhSx{QqZ~>%u~hRsN)|WJ1w7{F2@lbXJuTaDEB)=g;_MVx4d#d%s;AmUFvLZc(}yC zsGHjt(I=xJloa(gi!P&PGF2c_ZjlJob9QgvARB0$_DQgxNwa0PHl1tRBI1uZ=@M)f za}l6S=?D+|{ARjAs7LUSvF-t1^=`SjRP!0fbaHYzdAUj+AB2Z`Zql322aRft*WFb? zYjU)`z3@fi+3T+#E?1}OZ;!!NuvTh_!@WU-b|-fUZ$F(a^bq{n@HWJ#T~npf`gn(T zuU{=L|G{lUczG{YwDMBwxD1G#zJ!0!a|8>ixj<>gYqt`1u#R$+NyxZBcdyx>>I@^*x|_vg<^mo$s|^YX2&nv0#N#RAQ-j@{P= znSxu7Lx%D<&4#-@#w&eTHAh=#?=Ig$EDPpnZAi~LE$vvDbvbeAy2E4)5gvRJPzraF zIWN~~n8ObaE!}3C>hs1mUF7~TSZ}_qBtjKPa@ z7YhD^7lXmD=X$M(iOr028L!;#nsD&(IGjLZ+F7s2t+5OEud})DH_D^lY!Oatzu{Ua z9`gL8BG1f0L}cM3HBM&?d+1^ci~j0RMWMzIyM<1}5W&cY_G=G~9o7*^08FvZ`-w7B zdDNR(l@FLEF*Q{8@4r2AB^@~r%p?OP-w$Yp!ZjF4TZ%Dl`|EXKzTj#GVntVF~ zyu6IZnY)V>sMks(?T1-@&HY)mU5@!!ISKnhN@;17(U9Bu3AbyQ_1J>&+;E=LdWw&3 z^B1ABt<9m$0!>8L!c3eZU37ehwQ}d8H$4Vbsvk$yI3n||>uqCk^Yrbj$O&4c>@=?^ z^Yy)Pyqnb4|5~aEVrvPjU=vP4u7Ed~au~1^Fdsk&@#@^=92h>DJ8{6V|I-@_O7w zu1CGlp-WG1Q?vGn&|H=+gbQ9<6?K$TTA8ee6vu9{JFB2^_C86QF|xeQyx&%k0me?d zq|6J7kymm|T`0m(LaA$|QIyAyIyI$*NS{nb9`>DBz2olkyWuy66q+Ez=8-q^|uoku-lXnL)emlV-p-+z2IoIgSG{QSo8*9X1XE1VD? z^uquUNM!K4N}>w^0l{lS!~R4LYt^|MwiH5+#%C>xYAJqM6caHOcqhRgB{6LA%SiP~|WU;4blfyuV+jHiVvxs22M zKp-nO1#ea|bAStw?xjYA7YpQndSS$EBb3|5j~p42O}}?H2A zA02|@ztJITdIY7nWHBK;PBafhL~j0qSNuO*QTzcLa==juZ&zv2X&WPbyYBaR8v}|ml z8Tfd33te#ztM(9xRT1jJCIr%*)A&{Cq5vUdZLn zOT8%#4GnjjY+#sBM{KZAr$;d zfk2hg1HVvs8^0DG1%jQmA|Y^1pa~z)O&gP6YJfUYVKHI9F)l&V2Y$uUax*$QTGR)- z*lcic@Uvmh#(34|q@*dZBLKgt;tH7bFV6d^Zh%Iw)@?yoO18~AJ3IUN^R{QM5+!1b|;tZS!vqI~2Dr$E*a=M3@nP1f5MUDcYoI6nJ%6V%AIl0Hzcc5B%rt+Nb5Gzrz`fHQ8anm&okcJsdXFTJ_4}zod z@$roxN_tO+hlhj4fR2_HaBG42*u)P#^`&HFCz}HDge6O^g%ao33n&pVstg$y2 z6T2Rif4te9p|`)(N5jaNTU#5CS{Ftq<9xE5<-}!*E%Re`Zmwq_r5S)ar|;ukxF`8P zUF|Yu6JkGpv?}lZNG$;;475zh2G+E7hydPA^j8YZGa zo*^5eG*1B=EPvIqqc)rl#JlYxha->+AEup)y$BUF<<{CK>$pYn4_r zO$dS?+WKlsO-+py53dQXL>W7ahE4uz8PLGn+L!laKP>S~^ z87{H9yb6?c5_a#o%|>n!657qR1{LeI!3jdIe{E_)&_Qs_E@`6$nr9lJB6DaE2R$$B znMf+?gI9kh5FkeXT-Ol>Y;!Cn;~OrZ)3grD&df9bUj)L^49chU^l5X6eusZRfblI2 z1qFpE(U-H+jowUd(+x-yJ%S_A>Qddx;`>!TDy%)4%omFj0&>e_Z9)e^#~k63IZ6&XFD!Lf)NBe-jh)=hvap zlaT0sI2^=U&bwUYLIXp?T~=cXHr?hrw^J}XMjN=~YIGWpC6I zgvVGaXzG+W@0+Nd1KF>UhC_-($dyN%*3Zvx?Zs!}oP~m>}aM8+4^Hu&Zm(|xw#0vg_we3eRXvV&~Kfc(nQ)77MeYYf^M#^&igBXpltzz1&j;< zA>klM6}`Q34C!?~2id2IxkW_}K|Z;OPnUi18Dq6idfB1=G$AR8Dx&IDBQlIQAh%nd zkAh!Q0yenYBRo}yO?xz@S}O10XipI>o=0|NtV-Ou?#dgHS|KXQD0Y_<j(5O;C2Q2>~pw|qH zB|GD|LoC6n&)GZ&S)PFZ;wO;IQ4XSAYPXs&#KgqtW#fqj9Jc~k>+V}}y}P(2)yzDhNd7E2T|HX=&-lk00&VM+J8~+2OalV^K9L!0&8M)F@8^DoM8I zK=}CHua(FCM-c@zQ^#u)83p2#me@QKph53R_qH4j5`UBL8iJX)&QnWo?RXtjtaT(r z#X_k3R!G>J669J)ph&u06-k87ui^RC1;cK!h+AVJtCxlE&RK{ygEUMN5{V(VYc zx1~tr3T~eE*3_TVQI`3mLpYF11^)&Zk5?pE*3T@4m!gIp54Bwu8#tLMHHHm7YSL4d z#ez4J{PWG8`}fYggUj+~g|?hMy{McIO}+fYnX4aJk^h%>Ie)TATFdmHsQhM!Y=rlF z(yoxjW;4X|YjI-wtn2phCA-Ud0?Lu=E2&L-?rYe_UOj>k^6SFS{>Ct#T?tyB?QANF zbK_ci_w@9R?n?`UrPV;#E2d!||LKMQgs6VGLXwHD zzz+msL>leF698&wbMsT)6?8zwQIL=<&&Y?AH?t3$vKo25d-o2g;NRuJkRjp?-+CT| zM?{o?y_cN)cyb#3WPcR^4L)9zZ_ouwSuH_Raz5Mp4<8oQ)@mREAJY4CO{mnQfuD`i zx!LjbU_Hro=R1}A(c8uP(~TNa6BEaq;Txl6jAH?>_4TnR_)38Vqp`8E{(Rl?IGCZT zstRBuhe@YJAPI@^Z%ox|ck6I!q3My3kVr^KC~R4JoW?~(4NqNOII!I(Iyyg`>L=++ z64oA>ystE*^yGGVNr^%*=`5N8g}hy%=_+bJ(CU5b>pcL2sHdmLZ9aN$9q-nykI~U1 zMSk%xp@ZJnZKd!6$_XAA&i0tX{{0+S#I z0=%0A~Vo8V1PDN&FoyRT7rU3}~LKxz|oR3u&FJk#_ZEZYuG z(6JH6!F-f9d1zOJlT>gz(RpU2PN0sdgmp8}( z0=C54)&#W;$bZgLZkOhcV6w#QJRXQRyj4S%p$8~Ot=udoJp3uAPA)J+z51beTd4vY zUW{1~!ReD}X6w-X2l|GG^)zcJ>p9~=qCWgiN9UnQSey%_IjCNSJ&A6m!NeXwO8miy z4>}CD#RP}uvvGi4o;-O{cYdJ$fCT`hRJK&&l$lonM9eB`(2T9EEfh5DB3pnuFF8Ml z3-j@vfFjQ1c5!wro4{9G3g9NsVRESct5ai`fclYLd5;GFsTqyU39Tzhv4(ZD21_Cl_CUpj6d3M9+S{kGtx$ zG0q#A$uE`*YP)Mh$Ql%J$uOJ3K@CQL_pRL>z(|{M`0mFQ7P4yF$p^pD z=hAXXCXp~SA-c?K`I02Wqz`sJ-|33w)Y~p9DgqMZmKj2cZZZ3r5v8RYcmEu?gHBFQ z)dg_r{)M3pM4+4k9ENR0P}6StQGKwryiu`sc6aqeVuvMad~aHd*D*|(1|+!*3=H%} z5Y#(Mf$QEvf1V4gEQM7URoi_;FLuliRDO`+;$X50H1&lb*FiDPe`bhEeeyXo#ji{^ zLwe%43qjuZIA7Jy;8FeJYzKtix{DK2N_nTX;FO5PZWfaT@M%YY^G7c5n`idQd5q zPkhjgI@}OA;aXZ+xGl!-KX`zP)~@g*)xUothToxpJfCLc&CX8=z8`?h+48l$u9(i4 z49hZs+UbzwfQV(%Vw{6Yk_$L~%vk2~OL74n@-9v=qWF+M_jtE>4_uC4i=&B&iILHL zsu+@vo*v7w@^!E47)OU1$ET;e!s&iNK?$6upp8`pouYyQo^bOOn0`;pVbnX2^HMc_ z0dv+Gfb{!hVn)be2?<^G%2B8ZUwv>4jlp7aM1B0&Ku3S(3%alyH*UPzeD|<=Sf|++ z7v$$OCyXFxZ*Ol^IVe_6Io=@e3T0G^^#Q1w2(!mYczk>w#f#hnXbT29dbV`+14SQT zfvCO#l8Rnjx+btXoDZp64l)!x&ZiTm(L{m@LUUmlx$0=kDnx}5+YGe8kJ&zXNc`ya z4G%J(dvtW9^{){|&|VJP585($u*$s={?(42^FwvFr!bw!X5DeoIS{$EoSV!Cn^Qd( z9ysk_+B-JuPJ=DmySjq>{I-F~aJ0M8K}Fo~m;*wG>o^8G?w>a#`n;+#D^FI?H4QZW}w` z+uPgTUIsn`;C#b?{a$~ldkK&^nALj6LxR8AnBe0<<9i+52D0T9UsQ7fi`C2X zoBf7KZmo6qr9o7)MA=?1y*URRd_S1)ZOare-0nD-w&79$JTpcx0iC967s3U-r6iXX zcff4$+?>BrcvEBacp|Fa-A=PX^mcvG3S(TX7D)d9yeJiFF2{-2m`(81+K~VL?Ga zU^~-v-3i5$UA{|DT68Q7QhDUP)d)NK;NJhfcI_dci>E?y$CV6FMi}&g%=9}r} zuc9IGHygyF>-J-()vqIwq6Sd`p%wsWs={8*St{E+bHc;7!zcvDy){XC^Z;+FN%xK+ zb09i#1S1x!yRn_J$-1O%ol@17QeU6MZF4i@hmZJknjj8%>#`c8;@z*r{Vp@wMKPZB z;>5$C@QY2uO40(Qy0dTS_odkF>fP!&9hzi=fIlN14%5J5{2TtpA76qmM?BQ6e~x>z9eH$Jxt1F^$c2CZ z!2z&@J~t=*kRU#yFOV%T{#<^NOY|?Ur#H-V?8&dfe1*4>|4%P?{nfMltNFSb2ShHQ z%7=YxtLR+wIY5=t(&1?pCEu;dRKEemkcNhaO!Y>k|36T$6&dlas=;PxaaRW`Bcth9 zIgljY5_qiUSAdEa%Wc`MWd3IS84BtzSM{Ib6aX6nz=Y$RyX~lvQ1DyyG zQAXCE{@%SjwK7R`;70e1D>{ALJh|CCV#35}yVPr#==9-PE(d{-``HojWO{&cb$|iS zKInbOA|PSZ$?|<{nNv#(eNVjB&7Ht& z^PzjGxQ$XT*EVG7wQ-~!pbp`1IG_&uzl8l0>8||5Wbx|aoG%7>z0^nQ#S1Ea`#gfu z4_{pHAX$I9Ca2f0Y+#$nxiFaXM%Cik`8mzqyF{#7oo)AF+iWs7>3)IPIa$df?MRm! zDqN(oV1PA%#&LId2j(iUx^rSAyW87UuE!;y3JuNtFigte>nDHJmnx>4!2ambM%}4} zw)Pa@R>#LRh?Jqv>^2z4xGmNuYPe}n4%Rz7+O$t!wg_FG*;F&Bmz&KXDn1~KcAyKO z0463T>OO_8{~}spT7ZKU4ogQd3r)3 zGbO&o^V%HIg;sU|Q+qayDPP@&kl~$$B(R%4@c7O9ex1MKeJ%MAk+yBdl%jsLzdCHZ zgHK8-nI$dr{<@tpt5N)Ja{LmK=c^&MlAm= z^4&74J_-hnUH!>mA)rh$&h=~)&4E`qeBCU8TJ*yf5ACyHawkC3ksbh;#K^@J*#eD_ zPpCns*!yxgnVWx_P<({SyMELsPSpqDrl(&t*r;|I05zrM2G)DfOpF!liL+(H?7{hf zl9G}ozTVenz@!WqSdIWRG_;r0goK0~dq3-|l?d+^?;Q9w%K%QxXsn!Bs()>Mq*%{2 z%y&~kLqnQ-weIv{?7-Hv;K}=5vCQve3G$MXlAv`A`}Aqa*USzWjReS~mWX6OrvXpC z0yO}Y_;k{*L>qMD-Tl${*-9nr-u3#$3#!ykOkO_`@o4(0ChRne$eU?|-LMN}oW`?;N0t#kEz zhh@0fKJLdzTihd91gAVF`-Hzl8=l|cXuIgk_^Ba4O0T1lg5v{OALuE=?GN|&2}@L@ z{>yxz;DY&}A*I^Iy+_-;J=7)L1Pf16%D}`7@)x)UVgtWIEv>pb_L=+(!F__ucOrQx z9&Dqre7V1_76T81n)S;b-q_P+;OQNnn(_dMY?cKfE(DX~(tzq;2zu@bhbd;%jJch` zFD{4Jq#WORdO|3=J30bdY~H*9aY%CO)-4i}DyLloV^-sc;mCY7o6~g7BNHH%Py&Gw z=q)9cEj@xD4K3}pSoXs6tNc}Hy`hP{%o+mP0Zf!lj?lqQTShv<)aqdc1m$gO$tW%p zOqzI9p>qBDbq?HrU$g~@!ie`uLNtg1Z#0||j-dTxqi1IcZu0WDA-V3>EML9?61>G@ zjQM1;SaT-ob1nF(Y8#3Uz8}M)H1GF zez)}~OLCD53!AKxeDPwDN@p+tMvwGR@Hc)~!r6>%00agC%3dnOhZyMU=^1v#ip@m; zFqfWwkJ4j*Q27`G1@t}PtRf^+kRuWc8$0p8!6H;3oGqd>Pwq)Ud>k%>oVm$w)2KT=Q@A^{gKu5<7!X%DP^^I_-N6=t=3$S zb=BFHLDtRZi!7DAIr+&4lcY&|Zl-iGE;`z1+s*@kf`^PwuX|rNZw5N=c5xpQ({gij z)6umK4_5%H8!%u3vZC3GNgj1>6p~x@d(UNL%=rX%Xv zn!W8dDxd{b91P6?@~s|JlENLxZdPYrqjztoKNB#^QsUT1k{Wn}dE_1rcsoJVsD zxsa>MsRu@6QjP6e!alSmL-!V#QE3U@T2o#4bn9`SO40|7Hv`6kzak|XxQ_rPFlM1ehxmztB8?Ya4z$yz7fcU4DX-GJ{t2#m8fUUb;uLM#;S zd~b>$38rp*I|gg5oT8#F;Ff?V8gbHX$6&GC^>_#H8WNUn5RT|Zz18Jq5}@f^V)v$s z7V762Z%?CXvBhm(*j-%aH?`dX-`2K* zv43zaRRw8M&QN*(gHT3v2E9!N#(S)A&^45boP=%YDG%F`n*AW&zHxpEzByO3{vX`| zN6WYSNiV=%%~tZ1F<*$o{$yMf5of=p`KfFhvL%>H_$ssr=&y|MwRV#)1EqxCf&l#KEy`3VLsP12X-j zS0BaGboa=wwo&fuK}pq#QiB9cbM-Z6s3=ef@~-|G_94+VA}CN$P*AJy@8StHEjY$69)r_+fI|Q^zlUZBzoYm=xHgPzsvW;9C^zvrQ$J7kentIx zS4YR{rpILsaVeBGKM%|j4~p#%$nN|yZ@a4AHFh3)zXpQV63+!jK$$lD^o0K*ih z1N_~=`WT>^XNT5@6e0>!`BeS#Vf1jpNDDayO-%|)O2A4N_Sc6mSgS+fv3vmihZVU* znR_|t{*vGatu*-WB>=$>$m`9%Tp>>*-nIx|p6w3(E2lH1g0*z=PQ0J`ojtAls%d5{uLMPxPIYL(2O4`zKmzYHEO#DUr2EJ7@}4 zz|Z{Ql&3(;vRw)LMCosu%2&!zZ;a?%t++uy%yclGhf)G{EukoW|U>L~eWk!8Z0*!W`3vf8r z0@4lW;hd))f28|bV3DM(k69j)Tv<@=i=>&co>)P&3EbSu=-~7em5^(6Mo*IPRL)EK z$jm3Q@jQ*6x0}SOMf!kBj*NoB$iQ%4=29V+j@K;gYO?N9NC~J;oMr0#k)?~a^wPGa zt%80ns5f;Eabf=HI1LYv3Svx(B=;|VQIeK`)%5>tZErpy2hMNBwOJZemwl=}hAPfK zR~$^+IiBGG=OBK`|M756PELWijbdBxRN;&55Z#$y?4|%g#Gaf6{<4ZIG-B$CzqoP| z5V@OiB;G8*{d>L2?0zwfx=-W8Q`;M6K^+5485x(^tvNuXzg`9ad26b%-}7i?FqcVF zQSqLV0(ZUt%4=HKirBMfCc=ll{{Ek|8V%E%z}{+sK7%5CaO<8!>4sIZ&@F%wk3DCt0)PnJhG`-k3RFFHaf?=@&Z zd5;lt;|pkOZS9Wb%+1To0}A(p2NHSd7VhPKSx}J)fwGmAjP!I&a-NTL5Rmzdjg3LP zakyq-Ak6iHVdy$W-3>lR@!Qv>K?f`3T1f!J0F`Q60OK<*iTNo@wAvGlA ze3+xO6A%>KtljMf?!^mW9Nv77al1L52}f#ev@GC5d4#1jRf zdKSo#Vhv+VakH?nFfy(V1!46?xBDvY7ekNBb$2mTOlxdPbs`{;1|_rp7I0pp-NSuM zTYU0WwvLPH>s@48dzd}SNFm+9eS8Qc{#vyo1QOR+S+#A2g#?lA+|aE3pQxkpTKYzD zq>aulpi29K9XN8n81pOC;tuZ}B)W{$xEf({Tb@DgJVLnDlDPlu&YK>~Rc@yTFNBVN z;s~ELaDyY*OQGVF+lPmifHXBTTLX@tbWLPrWITL)K;Is*$Uce19C5XHwTq0!F<-pa z_SW$4E#_iq^2d&{B{Bn&3+SA8NAyC9p|SG4X0JhK52Q6FX66YXoPg-c&@@VY1Vkh> zN=MIpKAcX$_#l*?zpNRr4!Z}gU8&c=cr%;4b#}Z9j5bU%VIO&I7Pe&WT1Nq<9OzF) zd%(N}j)RKj0uD(N&@Me`xnL#1vHk>phlAZ+GH_HAklq0A01`_|QqqyqA8{V&?r0|y z%HTa3nmMrV5BB!~EezsCUnJO2&kr;X;8Y~q_3M45{&;7XeQC{~dxTauH>oHo>x}yD z&b=)WISyB;b+iUt#PZ$Wf*d%*1YAIqlaq>HK=~;)gZ1}mJzg&c(nVNUSPm>-y@Ha{ zWB|Bk!0~NSmx1#aUbeBeX~2DP84o=t^J1|3!!=Fn_3pnrHAEc+H&Cu_N1l*!6 z$&VFJBoq~{!Q~~b$IB{$&U@e5+Zk9{LGQAYE)kaKege97!ij0GV6=l5CGYf2R z8o(8n^D@igd;Tp73b&&zok$^%3s)csnygMfyorVN1z2e^mZv~X!>5O zn*q3|cHy`3L4jYte#If@X@CPE9v2r^pj((E856#t2HSaHeI=!xWW%!fC?+tBLd8+J0FF=m`;><~_ zl&{vJEhMjhAQ$KfwYIdh6iP|GmcPSudCKT7Rb!gduH2FVy_)HqkAFA!>#Otg8F4aY zk~b$9lkaM>701WL#OttHpw@o!Id2#ka{>Vo9?wP zB7}u(i5#>W>`Rn)nVFe|gc4iJINo)2cguoFI|L zd&86QUvIi#l014>A40u=3u;5qViw=70Jw_;V7?iE;>E<2exi=Js_X(!!N1^|t+UD4 zqsA-G3&>~HG_oH)d`Np1WCA+MKOG`tGUyQV95yGzRsL-^D+m6OfO=#WSV2MN&1bf@ zrGPUzl*XaLXKm_i9;N5Be9y_mr3r(o zj3n=z_}U+l28`m5bNeA%tb4DcSL6#9frI(zC~mP3Twzp%DHCC+03r+o!qtdss8ST| zuIkd}$?SINg9pCMbt7zICk*sN?FiQt#3~&ep3M6)cbhwls!Mn1xW(hN?K1211P$UT zg|MhW8g!cd+R(IcTq$?sFp>;AVn9cTeANWDCHu9-5*2f-HlR^Jrs@86!GZqH^lO#29L}iVP#uV?{`@W zo<^+QqT{Eq@^!Ym(fxfRxw6sko1AfxOsFwEZGXj9-+ZUOkuJ`(U5}St18rEL z5WA80$Ct)m{#`_u41U-$%sRd0$-~2k`2X!YGEB~f3$>HD%+-vHjO65cfxT1ZV{0g& zq5!>G0k)mAG`OJ)OMtSn^1pQyc9wUvbzqZ#8+4>+WE4Z|BIa->ycZT1>FMcDPfvkn z;S8kSC>BllL_)s>-v7tO9s@c+U`qoWx43}q(yfk6zAk_o4ps&O4nVlBf*asdqib)l;XtT@9s<}d}6JuHJYbg$KrNeKp zJCVi*!9=a7?Jc!_c^j{ELg-u)yJ2_3TNEH9s3|IP09lzRU49OfsSqk*S(=LdOHfFVM5R5((wtf>M-%ZW6$)`T6-MR_#O% zV|f1y;jZ1O@nfaYPfmBip@S6(AD}=Q19S<*Jdn{xeuD*L)W2Lnndl(h&g++4)00#G zw?~~^IMu@KX}Ha=o>V^+TFW%Rn(e8vel_@=LM{1 zuW3UQqBhoF>T_lDNF;Y&r@ng=0d?l+nFsNt!3WtNt2rLdrDL-cMLv-BZu@WaJmOT$*=Gc{dy7Eve}Eyn zBRysqK5;WV`1f-OWT~SgIi*HyA~;n=Jo$BE7n<&$52_`_e?Y^r;a!}GN&hrAsicQ{GR!%CA1ie}1@9 zEFXs$ZM2X(9(4HUrV)hkoR%pcPxvz(W@cu(O#CSL`0=!5%RZC+wdl69rrP+-ePP4^ zI(;|q%TEkVCZnZu%5ZUUPsKML>f4^tZ9-RZ@qhFo3i+z#nl?P9zoi{ua81|my~wbC}1Rl)!FTWPsBpZ;E3{F7H=Kr1+owvHc6J_}}07Q`P?3GPqf?cDweU zf0p=LNicfinRt-izI|_j>$GnF8tTh>MerRJidfUo$6X7P3v~Wc(;BjmJWtG5Ze4NY zQ(>TXz>&?pHh)=)F7F{5C=yw4oTn{KOm@j`sSbAzTI==TLC&n2hwh1$9|y%s2<{FP zC(xi!xmZrWQ!934sf%X%a-L<;l6;^YX{oZ+XrB=EDV2d+vo5V3vw()WtivD7Fr3V9#vCUYYrBJB!YxXF*h%VwneVw%(MTV(#cz9a!%%Sn~OmZM{h zKd;@mLA_|v;b5@`yh}Z9T)W09>8KuL@U}VBZDzN|DKwKOkEK*iXv!YYxVK*;12GZG zK_WYagnXK{Km zlVULQs$rP^RP@U07oE@R6K$9q$cajdI*F0(rl+SgqAohiqFT`19g6#}&A+)+McMa= z^~G36?%f8g^0dBM%QHn%@nx2k@9{SiY+qGA83M0Se&N^qQ^FV~F~zfFv$mK9rQIuuT7uzCIft0-*E) zoes^RotYiG9gd}FXNDz_3*(>elzZEfR^DA2vHbY19nAk6TeSmecB6WfykE}Lx#WQA zl9$&{1|LI)5a6wo`#;Kx=2cc|RV`idq-*7|n|0^SKh3|!8ZA+)Y~lG*RJ%eyH19+b zxj!;Abkfo^Ji4&Lu;ziu^GL6xvm2uJndlA;74ao%uzfuqarOMBIm-Biso&kG18b2C zV2A!6_#khdjmL8fVRZ@sx`vOnqorjy^v$@padF^Fu?RxlE>eFAUzAK^W+&k=bo#=D z7jvuTb1{R+KG|sTMNFGhSb_v|gcr^UpRmC~q5_!tL#cy*>-xCv)j+-0Rusd}I%mHJM151h4_-VlZ%p8e+PDH;{i^!tQy z@OYX}gpNoE<4b$UFpp%9H`={SJ^ym#`SsiCp%a>X0s^X&ujLS<^utSZ3j^<~1%OMH zG*0y1!vyBke2X*p=0i?N$!X{<{*PbVG+5O7yUI-90`^w0+RqKL05c9jOi@r!Ai;*Y z^2UcH)$0$ZT-7pg@y)8-W%BtkaEbN#I-7u=N96pddwo%dUqr;VB38%9$Oup+z>?-F ze}l_}9>o8kiITAM_ys@XYJ1(>mN^`jkWAZCmc0A9W>XCnQRU}pjyrbj05BZ>h9k58 zfuG;OO7A|t;(MToe`?VxUQ;}GY1Qy|&4U^zLLR&K)uvcLTlBv1qVL0p+gm z{29AseR@EG&BlPAfsyeb z)8&KTriv0ww%5)11453xZQ+rDNK?7Rc=UwFji=bQPGPVVI)1|Rf&H;$t}n)Go`Ed= z#gA?k6MNXVr%2`a@gt(U#Ki;2mDoby&N{d0RiH@rfJQg>$2Dv=vsw9%>>A)^E}5Nf zoCQsM1vJx%TWI<`W>X$_X&XKun&7*=X4s%ffgwU1jK#m`(XfhL+mrP%rb1BD8r@r% z!l2LYr2ep9G369cGKn~G##Hy~DV)Ub$(eq9Sas>q?Y64?#iLTUg=1rH`BraTQMr=azNZZB_BICITYentv5^RpFWUSw%%-8VpZwS8Ac_2EqxD7PYkx@M^PYhRDqN zg+jY1PkbhQehR|g?VKAN8tMk&_Ta4Ml}U*0T#&8;gUlhzPt6bC46b{4=ML>mR((0m z7T0?~+559*rNqPtZI(nS|H**EsP*vpf(oO*R7SKSxqT%;^CKDgJ>R{DCy1W0u<1-PF@JBt*)#M|;=PVydPjb=E7( zUrr7i&#`dCO;Z(iwag6$$CrqB1xRA#$Ye4q7ahCQF}<;zLsnJ^u)WMn%>3jgFH`jr z1^DPE2u<=ln1)l&FJoKicbAJFVj@`ACV&3C%PyT68+#{@uvxN67M7aJVFww9_mLJDjGrxDg*_VcWx;{=3=Z%hA;g^u6Yl)fkgLh^&o&Qk!)vB|MAG3B=~D*mUN zBGuEg1QIX@k@E47W_Fh!tBQA-aBX|v0rxJ%7l9c7M~*z?zr0u@|LMMicbF|ldvr1j zS8pg*jg~sO=py~4$g5{)0WFLi3TuVA38J84>G!D}Ax@bSUEC)o-F*H0u3x?SBFVN7 zK&T~rp?;r=i_2MWcKc=Tmy=6W*8T8%Y68q%S||Iqg}`GwsY?p1J4>%|ZJ~VbFK%u( z`Br>qPnTeOm z(W5z~K24S$+xU^s%0pE~0HXBEm+!G^U0TA?n|E{yUwve33?l3|%uHr^G4~F1A|N;9 zh*Rv9D^~^vE)WZdH0s{5g1A@{xsM>$pf(R%RJ_JyBBuoxhc1bmmp9Y0<)FO$vc{u9 zkAo?M8`N66;`FY7*;M3*&I24W(-y=$Qe^&GuY}KN2YjWW7mKqe9>R~8eUdgTaj7){7vJ$|{1t5$TGMvZjwUIGGD? z+hznJ*V<&zg}(e{_}hr}UU0f~vLxjmSGS?Mu$oMlbFFH6o!}h)_^W+O3v0z&C~DC# zg@&5RJxJu-?c2A{LiK54@*U#$S88-2kE`?kFdsAUr-JRhI#&k<%Hb594b5;`aJ#E; zEU!eigyGY8(>6oh)=i5a`mm`6%JMoc{BY>=e*O*J3hxCq8pH(8{&;BVXh53pbC>ipCZcT8-$}AF?Z} zcXE^VO{kdZeKn@n<$J@5-n*WjV`F2X5)M`n2zrzaZ4?trO-}YZ=cv zWuzR>F2rrdfeXFGskTC24(}Zj62ZE8T+wmcLUPT&yv3>+v{)|S+z$s0Xqvp^q`rf~ zo9tKK4JdkP{aKFGWc5%!`-Qr@fkHxk9i}?tPr*Cns99f~09>znf9y0AaXLEHy?Yka zd7Rxhuu&=W^*?^gv5d5Y#RLOvnZ%r$8!}%duniJjNesgnkx3i8kcBxEuCRAcn`UE@jdDD%p z@zc8tAX@||(;Cg$U2=R+(4M3P!3*NK@$a;`q=a|up?#w?D^^Um@wxrPa~?j9Yy=|A z*U+#Db|hRgq?SCatJkh2!mZQN#9eRNP?>~8%mfpx|MBC;t-gjGN~sQgV=GcDGLXZ+ zw1ql&e~Zmx{P`F1f_swgu_FK^g0K}#d=E4C7T8zFVcCkgELYLZgx=Q3H)bfkvQ<~`P!mF?6Y>;l+x<3Bdsm`VVX3~Y-AGaE6lXDu& z%4Bb;@87>4PCGDsIxn6*Gy6Hzw)Tm{9hxcsK_6G_V7(zueS^cpZ(y?|3=ED$;k;AA3HF;l`CHu=3E&awH@4k zP@){KL+8HO!}6`ySFnupKCu4)N_1~Zb|FgHk;8|>i?3c?)T!(%Xl)2!qCnt*l; zXvIyZO!O;VqB$1PH~*L^r@YWbCpZ?oQ(fU&m;}Qcz?0g#x^(-&lZ@fzha4RpPle)* zg$443ScDoFil>D>?(pVWjt_i8izH>&x1rVZT(Np7_wsdQYJ8f};Fd)x zV+)U}vqRbE){I>_CeXYIv9YWXpJETk?0j{jfAyg3_Luqy)o>Y`4wD6jHP+wQSY0h2 z;E2d;W$LM$bRR!`I&Wg~xb|a7NrzjaGvqPod~xryAc;oU1~kbZngco2AMM}Tu+}#* zAt5j@uqyIV{LMp&PNoZ9p#18e!JDQmF?f}npyRTK?5|z!>bMECN6-ZJWm!Q3t&v3X z3W!UL-gzEZ91eEpcNL27mQr7Hh1$|_w(HO97PDj)F(5nLsM#@VP5dy`jLd)=H1=@k zSGe7a3RziMljOM>GYj0-9JX||*U<2_7vnw@q$(jLl^Gd%-IvcGQ{sG`m?hsk`X|9Q z`s~TO!G9JmbR%;PtX9c9w42)laV5#o(cj^gODSiJKCkw*qQY1pKwD?{>h$hgRrKnh zBqbV?h8b3w+VZs(qXJ>dY0pe~`}FD4s&ZlOpz@S04OdcQ&PwO~3=&kA5wG*ADj|z} zF32-84e_R?J~5TbS$?%iMo3>Pzf^{O!KGi%eCEWv>pC2IC-2iF6%>*`s@8UADQ{ezF&jX#W2WompP1o z^I2T=icH|T039F&S5SMP4gmyE$X_H=r+_?q zwU5Z|+h?C}h-Ufn&aSmjt|>S;>@IJ8Bc{=(t)(URvr&;RWB*PIGqXtq%@Fac$%^8w zjhJExrLWp1Zf+0NUQn8atYED3#P4*8bnZj&$@i|Vrwv5~1>Y=-|GHq!v@z%!c)7Tq zW{7Y<iRUPfybLP_q@oy+Xcp&77uVrYU ztTFGZJ_!#$4J!lSZv=K=yEw^u&?X2;F!ww>Sj4SO_U~UL{4ifwIa>S{*LIB;c%^hY z8&GK=1yL!fij7UX|3h`?3Kruy@@H6AuG|}TO~AG5Fe6jUgiiUA!8eH}hsVGkMX@&p_ z0)v8pJxXI6X`C5N89Gl|{80cuFkq+cw09O`Zs6fa(9^SBT3O8o2S|qAWoOp?XNmt# zaeYy`f!(JEYMo`@880SXpr#90d90}O;$6ClrKDqYg3FlwWS3-habFkH*g&egEz7Z} z(rV&Zn7h=%xh2_lKgZ&t=?S;R9hToB7S!FH`+<_gfBbs!kNO#!Pc3g1sZv>P99|mN z_9OJn{C6s{8c0b>T0~8qlAL_|0lvFh_zoFq%^XBqx;jb1o_H=dWW;#2-6Aoi4LzRI@dYGc(nI)guiJnsxPzp+dz&LEOeJDyleps_D!^DNLQcJ56{hgJS6_5Xh z^!o@kdhoz9hW^pze2p_pmo59Ye3`1Y_93~WS2b6G^dok;H)7@6kZv$MJdB>FySuw{ zFPp)uvkYzxTXya|H_}zk(=e+zthV60ukW%PHL>X^b!sC1jM4!Y6*e^@MiFB!t~Phe zKi>MCio_S#`^*EN6kLT+g+iBbUW{=PM`rEyp1$>_sM>8g*i7Qgk-QJUKQ3Opn78zjW!2;w zBkzAyxw($_$MCS?p+i*}PNK_4M@QofvZMqAAXh@iycl0clgn(01G&Du{1x5_sH=z+ zq|Y4j_yUAC86ikGLZ`4$fw3~Tgou;4w@xq;KNM@y3N$4*Wg!e#E7{mwduxQ*UaK`5 zh}5OopqMV(8Gl~0(SJIH2*Cn;!N!S8MyuvrHq*9(`37akV($~DKxV%N1!ad`M3U^; zvj@RVKl#1@0E<)()rVuTrbgUtW(pLJc1-NLR)-7VQvd3Q2WYCRt5>X8;d228*yzow zHTRgaqvjqu^Z^`#j!NPKWQADNgC-Ar1rwkCT6e5f zD2QWm``Rp9-oH#RHY(m&;tu;8JS~*1XKL(+`jgkM1AKQxFkUoKRR8I#rN2(l_%Qkg zdh+_+;NV9`6^|dUKWE6Y{iPqhRsa0A4DDk8!7e#dv8U3g!x zNtvjTAHUx5BqM2wJybKfkI4^!m)!C2cmvBA)DSyw=gKa*wEm+s=fU2NUiIUTwC;;! z^kiOx+a2^(dzAa6CWp1su7#hK$;)!wwSxpU?4x#B^y`(MXd*1cz&@Z)s^Zv|iD!~h zzVeW-u)9P@@=zuzyU>3A&y)E0$zM9`%k9vd3BE* z&FF`Q*P1P}(`alb;dyzU(y;njFJN~7ki_-JDlcV|ndGdvY&~$8mXx|-?klT6Tr3UC4a1J+=?NrnSLy2C+`Zw zYs7kH?!)UD67{dHho=hc5!83=?EU@y(hft!u@T(FJ)w^jE`XbP-=xZAw;2WBFtcW- zpr9ZmIfl55>LjK;I1N+`Vl>Pb5(0)_o1pTngl-lU4lcn`z`{DmY;4M1un{ClEu*80 zd;Z)g2#c_}kx>HO&`8I~0_*oRK7^2m--Hbz^#~@CyI0eTtca%!H#gYO73)>u{l(4E z37|oz-Tnq$($BZ_*-MG76PcCWy}iI)wEACnu+6Z(8vU<^N$%qNouu#d6;Mi%44L?L zT5Wq4?Rxq&m`~0&R@?17JVF77F&EF2$GaMJh>nil5InzNuUnt_S!U9F)AAQq@>e5u zVt_sqDo@1y=(=?i*>||vUSUe7GIohnJES^Ul^-!OHomRgLn}bQEN<2FXbt~3^@5XOy*c(LserO*sPJr4EuDHLOxZ1R;wZU49^~b7Ti=5j%D{cH?^_ zdT`7*1~Kl&5fgX`J#OC?cN*pK3@YDwrX$ID=XNE&1#NZ6NW^E_+u5aP8^pd}9yp>A z{T9499v3=6uvPC%)b#X%yuD=yA;9?*AlQK|puN_jT0!_$RdVgvL(_*uBo~ctT9{Iz zdAR>mWlY_H4%s6`u{%j(AT zv1!Z7*#`Ewt>IAmw#b#4Xk z19aKhn}O$6LBOH7N=_jmf@-w-AxGX*db&-W>dlVKg5^XtYm1-K8X^u+gB><{ufy{n z5gBAZrycssZ-dG(=#ssLeRwcc{VtPG_p{jJZ~V$F%*_uUInve<0L3M6PQqKi_!WWm zFK0?fwLY#P{J_Z0GU-s*T3q@1y;1T(fiC;H-@%fBs-dZ+HEhSZVb8d!@4i!)EOa$V z+@E!D$sspN`yirLcoBVgRy9C%d$NbX6A+*(qqemRjEAwu15t}Gbar+=a%2U!0cHpE zN3n-FcLP9)Z;$S|z5acTc|jqoX@V8`a=nkSfFw}`-wdavrM>A(^Vqo?3xFd|GB)Yh zh_1>MbU(4jkl*Td>wJVf@lY4WEAyqb7ghd(XA&1~(OhF{%XAT21=ga1OhLBzk(#eP z-cTqpGB6wmjuu6}$2Rq&3j#hxneUvhMX@zzPfKE%>Zds2IF%}1uB^fLEYQGVEv}(| za;I8AXKZ+QjWT5O@0!)Iav9^>jUKqJxZ^9z9b5N+gF9+{)sev?yIdh*O-)TD_R#ir z)q_P>utmd%vLgOeM4SHY$}7!NuO2VV5R#Zti>M6>*D*NY{5&SRgczZb!-#~03MKHX zjQ(-Y$Q-L{Z6`zAoW+jNC@iTkEsZn|RaaMso(;$+w0ms3t*$O+#dFxSo|Sdy;wPc4 z4Fp9gn(wO2BlU@UhA|*Q0aLlp9@Vao-6~whFwrW+3bQZw8`=rExux1xV~fqN^+SpA z15~-y*9uls)klRApM#p6^3M9WgYS7z+6+2mrcI0JEfEo-UF}#@9m8X={B|g^E_{h@ z#_bGWW>{%m9gm27VkV77(+Kh^#vQh2QU(}C-6OA(lZR5jGLX-1F77*tw|=HYdPbJ! zHZI36-rra12@}C+PK6oZJ=z28Mbsi>?NwK=8yX;HDp%cBS$O8%8S9&Zj2Kt*xyClq)uVuHU@4s~5Sp zJCS`n5yD->NEchiW58D|RZv*?)cCW&^$NDBUZ#Ay8Hh1&8R!^0xPO9O*Pb!T&W|p0 zIqff)puGu9h`=oWvN2dGl>-FwoSis+K<0jQ^Ejybph>A~S#x;KvT6d)xrXTwgWmYK zJ+W>%c68|Sz)eIhe##~dc4dSd3D0^l1&O$qPWwCPD|s|n#s6GgvxzMoSR9)|*XzGNo6%N%2wxm^BW zwN&yB%{8}#`+d4D+-728Qhvyv1EC5S9(ern{`3eK9+J=37jpMky?l3Cz`@B0s<(4c zXirIiWLQd159}yVt1;9&?AUIc846QQe_x+5^=Jn#kJHCGe>YGP|1;eFJn$wh&5zGO z$!`Boafb0X@?@pY|C(jP$sTxzz_}E)d;}LBqZQHgS4-1|mq+4L%|HQX=;sV)1ocbA z{UniMXewJl_8m5)pZtTLoD zn}5x%UQm_~OV6fb#`E!6tMC9*0H(^1+&I?`4gJxdSmxnVA+rKA2)3wAFk1c$Va={F z^b8==@;!|fa|=1e{@qU?VhN!|*L({DWn4`Qi(=&Ox}deMjMaI^ZDM2^=HVL-2ty0 zdX`&XxHvh$!cDlEgZt8>xhq%s{1=zus;~{c8IBvOySjWUb z9{D4{bx^CRxVTticFh_Y4b|-&K14g<`u-178VFBK--oKV|WfcE=24c z4UXNTx7}u&j}O+`RI{))@6Jn+(O#~os0e6zyd(4DZQ`qUicHQfylhj!xyaM7mpXgX ze~j~Mw|V$bBX2fwV}z%KFy|Z*<6~D*S&2O%D9Zh$zKJA5A7{C|y6G6~3~H*X+Z%mD z#>QjLLens&I)FT{j#V`uiOTMT%I+?$wy8dqqnHiuF1VPZPMJQ?)Yt!%^++=jIEkoJ zIay=Mfe6TkI!BQ~NOYUIg__!$wjbDoz%^|t);$g@U>tgrn-*5hHn>nz9Zo?(@145# z#qfOL6yuwcYffsWpCu>DrNQ{HaM;-$go~W9 z`4{IR!5is9C%+(rX8>J1!#sntZVDAYB7+DlMeq#vO#9qt{Z4V%x-j7Em~PAJ@jrje z+t_ntbQE20UVgqB-;ofB*GWlV74Xcmwm+B0#K2f{gJ!CQvI&l-0$g3Qj9|ve8K6BL%g>N2@rNv2|b&M#6+l~6mo#nqiEmflRm~REbPnIkZm#` z2qhD#F9NSAdYlZ1n8LH(-F-zJ)wS6d^~VWQL$ew?iT85o3H;mzzNGgz@7w{i8E$m! zw)Rjd>ay@_7nfEAO@|$6OS6mXtM{`1KR_4UU%Oe1*Tu|14B{;xjXQ+2)qwWnlG~zP zI|(HC!~CB1wuw6NqUz7NV*TML^|uwahDC_HgO<#|p^ageHu}xgtF3U1@2==m;tyAD z5ZS2yHzJW!=SkaOyjXF|!8=U`sy!E|OgwXkXfbO82K$K+o(L#i+o9(Uf2@y>zHgv) zqwLRqN_@8FX5N=NIi)1JPU%VIIEU+So$9>D;tL20;$A$WK)vS5)Wq)KdEob2j>Tcf zBybKYV*Bshx>cQgjzu{Y%^gyrwo6&Het_Z{lI-$2|HzA)sFD+oJQ$^hTG^Bd80Vv593Brvh?Xuo)zk?}}tJ1;M> zVL`hG{eqFvw&k~r*Bn(0&r($dE1I$Op!H$mo8AU%L%L-4{P-IYpmPup+`W4jdD9Y$ zL;nn?M2PV3>C`9e8TnSOtjXYBf3qH0f8s2?cyC|d@~>ZW&2(#CoRC#eD1=D#SJAvO z)tauNqQVbS4<{^ER8&CdMnqF<0Usp<4CRMhU8QE7I{co|83Vw@5ur@8K6_X(-gBxi zNQs*5aNu>x&mQHX1}P zJbz@8BEBJMtrIcV24=~vb~&mBw)(@0ip!TS9q4N5?k;Lpjf}%oNdJIWE-3vIJY@F5 zN19)5klxJ)21xiiVCM&1P&Whz@t=5G#Ftf9UthchFnf~iYO?c4b}EUao-e;&M*Wgr znd@=l&CJ$7O-1}2g;K0uC1w?XW4 zdASWxr{LfXZ1kX-%ow=KKk7bPnD93cyR$nQ6w0n`+ph7Ro_6qr%ROz8Z~}^adb%@0 z08|&7s-@wNs?L~{t^nfu)mAB~286QBG2e4vhS)7i zJMy6&8%S9!>CwB%h;zPepmil(XJkWm+mmu1W+WgIKb&_n6YqESALJfC^S-ur&zx4< z$By|H9mgV&gxOSv5CY-F7yTA-Aa0Qo1*CL8I8X24pGZo0m&z&$=oSANQ>ewdYW?`h zW0RqE8%d-+hB$?RL_&TSiIo2qpGYDloxuOP*Y@MpjrpCTt%kyJ=~?z(ZCVMrnqkdC z(j*~6vg&QJ>n&ff_o+L({GYG%|JnbHikJMWum`zky@}|pGoy}kbJA$|wp9F(HR(rg z`_-nI;7khgd}chZr|6WRo8Ial!`yDM_s4cG1;X5<4bB%6lUJW#a=h00uxCy?+7e`~m!U?w`kOIbbk76(2g|T+ME>xY=pe z>7Ck(DH8vB)~Uvo_}~E&p-tqWmUd$~9Y5wWITbu9sYPni3rT__Y(xbDau+Pk=&{9am0Vj zw3NGv9l`LzKZxVMR@OgWD^m8q7j6@1QDTj;k%-%|1lhhQeDk!cvU_7uQK!xg26tPV z!F_}UN!ZNqMcJ(-y-OxbRs@}vp0wZ+6eN@aR!MI7Q&qJtB7f~8j_apJInRw=_*#B0 zZ8;46bzlR6j z4X3CO!L#WzQ28OzIj>}I8?=A6Yj<#S7k&7E(1HE-_T#5KCEwG3Jw0sBCBl7Z`+@&K z_g}w%lv?)eqMhT$cmr^vPNU|#cpr3mBaSgp{|eCe2XYh263VlZIA$D{LL!8N+4`J! zU9jwV;tJ8GT76~S@Yw~oy=k@T`dm@I<7q^T3>?lU9~=G@P@dsH2!I|hjhBXa7@k$| zlCJRW5QjL&x*h(|UafAfxe|KMFEqDR8~#W#?`X>p_0 zdu;=B22E74OXvUSNV-11HHCCLmgmVZ>h9cRA5?zkdtaYEH2A_>I5>=9dYI}WPpAW7 zvVVJZ8MsbsIrPOm9|q6H8V-wu&CTb9Cy&7*=R712IVsY?dER60Qh2t|k(EgEPGfzU zsZGG%dX{kWVQBTI!FaiD z&bi_|F7?Qp)?yb2nq&$CTBEbutN*BAY!niaGoOYC3)hX)lYk@%W2y$4r@z>Mx#@ke zhnlTDLQ6FLK0Cm~LQzw8(PHvAqO6QVjtN*3D3?VDSxVzqW0SiJ0f&5X>W|E)MV1+5 zgYk^zdB1I~8-!ROUV!9Fd4ek`DXb^JMqpaeNa0a6ua>asU%dYBHNuIOZ^P=7lfnj$NA&Fk?nL2awg%T2 z>_^>kZ^rE(qve(6Zd}#9=8D|s@t>AFtVEjI94+1L-YC#ov|i{u&yuAKf%^YFK^50SyvEid9f76c>ap^hE-*zsl5I(T1h8v_6g@%_k>2 zZSAL`6jD;u5;F_o+$hlfgkw(C%#rFHsQym{=_*F`4E;dh6zP(s_g_@IQm&ewO@f(; z$qrjK@}qUv4o)Pked0Y(Jd-H3$$pX9qwbaB-?#iyeOFMsNnhk(YlM#&N6(E@OXp7D zBq~-IhC*kj&afSQ>5vTN8FHRpB_*j8mJ`jVx{0~@25DEI2+}2+uL>kyzrG~1KoVkf zjNV>hF5$K6k1hvVwtrlw8HdLw7t{4j+*?xP7gyRN zbGwzU?|O9_GUuddk2`l-J^dd}O0~Xk^h@7D0V|$gWc`Qmq5sUM(}Mb7C|0e?Dcj#| z9&*3+%OZ9-?BwI?Fi_CLXw>1*8R5UZ z1oPQ%!RVkwa2G91l~A@%ouG2{A!m{WcWhyDiVRJWH!&LeEKC0qPj^79{uDmbiR7N= zFnI>&_pvJ>2lf+=jIgjE1mEvHD$8R_YzGBoU&mL8a1c0!-?7rIUcSCIU0-+T&VDZ3 z1Q*3(jd*`Tu##0ls9=YQ*f-Q4KQ5>>sv2DBPF-vyhtSPYB_EM;VA#lJ?6PlQX@z*@ zrui8+mVU;y{jf-jJ|m=*S@rs3ochV1Y(b4H6d@{Cp*sL)0kU;m14D*AkFY4#jV+c@ z=lr{;j-`8Y_&kOagz2o8avp~=Zm0CVchR5rKD+XdhMqlw%=gI8qV(;Z8bb#r5ex6q z&rspl)abJL9~vq64Nok$iO=M_1;FyD9s<60%|3VdMPYndg5$8>+{N4yZ2cAaQ#S@q4Y-zV`4e@P}SNnTA_#1Fu z5KJA)%JiPl=WEZL%js^^mmI6P+~+5<%cOwd@MCS_WWUc_BABPx5HD~9_?l1H^eIWI zzO1ib)kCh;7OV(ro%t=*xbyjb6+-HmPsB~VY|eOK%E?yzX5yzon~QWQSciwZ2;P$memnv$KtCK^E@zo9}GGFMV#J3>7Wc zGkUKdv0`)hKK6iH=fDV5pHMgM=znqBkG;Qi=v{ZF`;&mlDfSmLA~!kH5|t<)Nb2}j zL_c9MTcWCP#WgM}MTXLJUog<u_L9B*E3$-lM5@VonsmYGLT|4N3=8780|= zf?rM@=G?~F%>3xiQWn+UWT7^MCiJ=zdsY44~&e-6gkI_d1FkSfAzl!m{?sqyRp9& z7#wkngu2zP!4rVP6~`wh5jdxzshO}b|JloZ=gyr|Qlfk0_Q!rhR+mvI0~|zz@AN|H z3k~w_`s0KI*~DAx@#Nim_n>-n1S8X_uYIfyP#UD>)-%{+U`R}S+@(Za_slP2fuZ&| zPFf^=4nnRt#Eij`PRXxdI}A4G@f^Bkp{c0}h_@El?L#RSM;8|tGqdhF{c%q7zdJ5v ze~poteYUo?va(cd)vyE*j`2@4rR}-5h`j>JN+plmFt$)0W`iC*tlAdYm zRS{Vfy5wJ4L#toyPk_=}Z(|J?^4`~C+;-O1+L>}sUKjk5K{HmeJ-u}45}C{uqXeOI z)uFS3@!2ibYdxRc`QvuM8P~+eTI{}*vwNCTW*%!;U)97;L8zkEhW{7?=j80oxa{QZ zenJ(|{8GJ1K9MXHzwsQod9H5>V_3Y$6U9eeMq&Wn4vq?bI#J3S^B}2!+vL3l`cN3$ zk&6NJ+7pMNULo&!6{VGd7fOz~>S~i_@QnB4`8P)RMUHYnQoF_XykZC}&=Bl;O8|3( z6oF7393@Ybn*QW)n#mDR>S%mrrlqJ@1ny2xPtTz)A$tn_sb7DDwnL-4Xb4x8bEEr{ zymx=KOw+p@)7S|G<$wOs4DB=pGR0(GcJzztUfA!o0qJ_x3NYyULaQP?00jhsl)RnN6>|QyjeH14$qYD<_v&Xb|6%M?eyCD$`B<6>gk1RcZ zprzyUU;agNIs$dL7|)tI(<`01^Y&|~O>vWtaI9%7LqxzCnH`FKy}if)zWq-_C7Cz_ z1j-h$xYj(<3K|BlM(4EFK5e&~!EGW_6H%843wpdpR})Ss!R;>6PNT8vH#C<+&%eA^ zcJa*7?eUrYuZem}W$KWfHQNP&&(tRSqyJMaiDg9o%0i+#b#dPXH>KHi^DsJ8>G7^J zl_iO@&$fQ=(3;WS)bCy!0r`K#;!7O~5L40oa~mznX{;}`H6D(0{}$ks(O=s!W}$6Q zV!qLKwaM}qSac&5MbXoU*KI7+3y{yu^z4)c^}@2310+((6=HY3q}O6$oxaDs3((m2 zEUE>j_zRafDS%kEi_4@m=jhK_7Cozh+0hk2n$vIHw4T?>7>%x@^*MU5TFl7v`rO~> zK5shNt#)ABf=(wFuhG%xl5_`**q4S}CV-e0$~Hf;?pMQaIp8)X|C3YRb2?|tRo8U` zt;@)_s!P1p!7J<7|E_WWw{BDt>ETNX(1rqb`A-3(0Em!r@>8zn zzZ4CB4K=^&8wLK!W;I^T#}}pi@UR>2>BM`*G~%{sn{l{p1=Y!F+1Kv?RfId|?fMq~ICpIV?4J&&RD)pW0EJ^c%b7fS@DB0uzXt zxw%hQbX9B<*QiizX#PFsT~D7qD@y2jQir;IDF{%|=Xi&@U)UHv(#w@2)35LUT;Y05 zwWU27o{bEzv}>n>d$;Z?Dz#@Q^s}+wJ39+-!Ul4!moKkPv*BK@DwTFBpU%6WwYT?N zUs2D$9jKbm-@I``6gb{D=-mNotkGH+h^q0&YYMFk;w5$Nx0Gu?q4;xde3Jgd$!L%_ zwiQF&2-AhPEwFq@iGurhk@`b3WjCdMxeww`@j2Z?l+y`IUr0STI5ZpB zuwIDQ9ld_r$ce|(SLv-t-r3DBIe=HtM4lpjPW<2c7hv-Lrv8-}{Qs%`ot5@q5ZHTk zBs^)y`$>o0KrA;r^jWaC1W`vN4Q?xsN;wkK|GIw?F5Ga}QfQmbtr8v@S02541q`lQjW8;pw=EkdA^yv@_Fu)Kq+K@N-AqQdNt8T~!@6J^Pv=y{pB zr*$l-{;^>zqVeP3L3Jqv_b@gwQH@4b%CWm*XQsTzRra#UEF8Ra!g5fXYk)^nBNVE6 zjX_vfBH{YKedQ6XLR#dFZ1&LlBD3nKi>d$DLp7}oLM>c4+y^2MXjUQg232rEruCEcFW5RB-eCOZ)G6Z1(AP`=VqK_m>QpDSy zpVUQSkBDebs_;jRZ;OVIxEfd=g(L4h_c2?E|D0A za+}i9s#eU2Tvpg~RKtu9_6??@aLzTk;t0Y)cCt^5+Gag{eJQ}Cj3toeefZGid3Yd9 zeMG~|6LQf^+LbLnsz};<{Op-Wpue~GsQ_^gP67jsk%a58G!A!YutO3cC}G9q9(Z3u zkoMG@*|-tj`b*y5HUVaaCpt~d$x)+gMPlCNJH}4or(l7fcPdQ7Jk{ zy1Wx8+fSUdpuC-8?dwXqW3!{|jf{EVm*)}%ZVgoe>P&p>;|Y(<9D5F}C}twi=RSF+ z8ZS(~Jk8F|##treewabyb)Ar?Mes-hf*4mX96MGAWg`NSzF+lYNMH1oRv{kHFL(Kq z9_QavBTZX54*!5W)OzDi`tdOXR%zE@=|y~8|5gQ%`@V+g`#QGV!;{d{(UJGqCGJLX zJ-w{5h~4NbsqO~2otfC7qLd5gK$mX80)icgnoT7Cv$U!=u%_xc)!iS#jkx~Qec1vE z;SfmN1ifCx{&e?qMO>tt7zG%c;@VE28N zcbzcna{ABQQx-H4){oqH)K_IXS%$LJo$~FTPR+vl7ZgY;Hr*Ui=>8Z zxA78{*#csk2%#mu4fFBFS2I6n;~HlZsqJ+~2Qy|Z`A;utAktL_C^K4zX`R-n^jK@( zi2PF=%KhD(hd9exf}p?V$PcB996vkHtpp)7J4~hRdWqMR&XvT^F_*y5lt?BSN_Pv& zw`3+Lm-#pMJ6+-hC`mHh{+qD)92&5nsHXO5GpIlOOaC<*{^!&-|KWtS^EdzTt1J2c zhH_yY9WV77f&PwEV@KgWD0qh=)K^_1AoR{Z0pxg6aj=q zu0zKNf`Tt#TXS8)MI1>Kb_k;Mg9qOunh}l~cBh_Qu8$cIFccgg-;cv%Huk^Bjz8%+ z6B?eDHi5Kxs10zGjlGrC5DqSCTW|Mtw$ir_+=MG?A6jRN#+drr=526Pm^t?9Lxs4b zZ|_tRmDH^C!Kh354y>N3tHy+2+S|+i$6?o#8zSZ9#hK|aA5I}51rrTg>(ELGC~yzh zPeWURz#AgI0IbDiv4!iYVJc~ivFLUwnngt;hq2xbUf)KBw-V%d-_wu8nV=XoA@mLt z_C40A^kX=UXb$v4^-~GSV_ihoIoA(hc4X|JAv(XKPkS_~hfF2ecd*V|QgGQNx%peT z#wq01120a?VH^*LZCrvld;%xo4rgF5gSfWrV+O1@Hz3&j@THcBYvS?N508)lmO) zy3EUc>gr!1q|gaCIwG>C75MOz2Bd9x=A{~Wf7IlAu47Qnkp8%94TJ0B+?MmXlGTFV zBzvJ>ouJ7X#q;|V+H;EuS?`b&TT~C%zZel?UL@D&;87KPsfBfih}TtzsU&KgV_DlY zbWuKt=M&{avf^T4me<&6VbdFE0%aa*-@J?q8Hq1rV|yl`IEg#1H+NupURWwJf`I&2 zR#ui-8O=po7!H2^{24mGTf)1=Wq&m`>W@w!c?^{a*{Emdd=QmHbMQ-j`GQbiE)How z9yDp`4zD`FoP3OS45D)Ybz%~M?Rrq{oQ-$vG2O&WGPn8Yt=sMPf=*3$u>+CBZrLWc za;PukHL4n(xH(9~#YrBz|KP!3jamGyk=Iay2ON$hGDTI7?Jsb_xk%7?_;wm_sg=IB zMP60NY(hYp`DxHCZGn^+2|GnXgc>T%r?~~o^DDEapVI1owK(($EEoQ``jJff)h=4} zmxNf-D2>VWI5GP#->DfXO!a(&eK4eJ>xx-6h?qZ29eq(+YrV9d&!{(Dz|%}be(Ui+ zSK_~zZ7i0B;Il5QzU%YFWuWzzg#e)*&f{~nY%64Vsf%=E;1hfL(`9E>tA_@V{^e7e zicsHMGKx5AVr$mQ;je1SFOU0(>P60!YK%j#KOZPzLL9z;Oa&Y|Q567OB_fPjf%{sw z)6d@wMpUoHnUxloY4oM_wdR^8%OKH1MK6e?Oy6Qnr=UWM^udFMhL3-E4XVipiSX?_ zM^3xKr0()`^YNR*LrK5Bd9QiFk!Y`-%RDUraS;NQcSK`bAQRh}n#wS_Cbl;iRB+1_! zeIPDpv*c_xlx*6s$>iHa7vQ)|-R^msjQ&Ho8T2eN@(L@Qf>??3y>-T6KXqW$@HW@i ztx>nRRxEY&0dKBD-TcDYJ1VgzOd)xzNDHj*z|$n86Hh`|19Rd1wQv)i?i~6hXq09Q z9eaFCM5wR2Ue(IMM1_`t*=`}v`_t$*-{ zh*v9jD%#^AU@uP+rBDT-f$F-tg(Z8}wE_i-9{S~J(BsyxjFqA?O2UzFG!VSqyBDeV z!r?$?5_!q+m98ZYmrEPx7=py-4UBx#kQv^^+W6TK>fhWPS*)lSM2>q=%}IoWWvSmC zPRMRazb99B(<$K$$ASS9<|&HyA$4bv<{Q6z~zM7UO<@ZZl6-Z5Nb+#M}E{OcvH^n4tEB@10eo1Xb%^QvB*Y}IXMYvOM zVL1TVDmqGRI+OMXITk%`jy7*-cQDuF9}C0Geg5gZ5Q2{Qp*@rz5@<4?QKD}hsScAt zhUx!+zzHXQdku+S8NI)Tj#P3oKxnM&5!?1SN$n>%**+$w6G!gVgN%td4tYfCZKHR; zbOVctZKG!s=LWhcfaclX{#DKjulUUL{UQ1%1#ooUKh=U7-4yCy-q6qx5GI^?xxSZ- zUC96AI&ZZX){K7sytts?$uJ;8D=G|zk#$OBVyG_Ge=HGFLlD8z1KCuiyt-5>TUaJlwop|2FW#@ASO zpa=V7DJX8drcxgxnZY%(|K(FGTf0re{@OS+XU#1+0!G2*|b8Ow0FDHJoU2Eqk`{k@V=5!MqIOO=@;<&3P zxBO&Ts(v}Yb9;~l&wrrDaxQKC{d|j$Fa4`2ZoT^M8+z2H3($Xb_w@K+Wgs=#!=iMv z%;7<(Xtj??_|Zt1YL<5}gdfqEf_)eiWYSZ^4$$AeTsNupUt1YLm#uD4vrX7b#9?u9 zssfDn0O29@#KA`JacWb*YqEb{O&Hv-nkuTFul<$HCZi;_K?!yqI=TO!g2^9UN&-uQ zM3rgMRuX>n-)}g<0TJ&9ygv`UysRMV=qyL&nsM5)X<&v>-f{;j)Q z^yqWK75__tGM$s?F(bs2bctMg6Lziv&wUOfE+rap$g>_QqMDi3A`bkc&+$N7J;#y2 zR`_loKE(U-{x>on9TSt&$Vjk}H!il-v~+d2O*b={fsS--^JEy3B5jd}(N%G|9Y6Bh z=J(80!`?6TrJ9qoqZ|IO-o87Y>NfoU7*R>I2xXJ3qEIrkRicdSgp6a$&Q4S$E7`L5 z7Lk!6d-Pak9LdT$Hd*I)ebBR?-}j&I>+7FhFDIXK-}mRfulpMB>;0z2)$3s02L#Nh zDR$A5(&y9Afthi*Wl4)c5ghU1$M?72kLzM+f}Z*yxG0o|IOIf?iYApKR= z+)3U4xm^3NSK%KS?7eaQ140OkXyt2k54us0(9nST(NdJ1rgWu4JF&wnIg}Rup3m`E z7NP%w7Jo*Wfhc`7lIOxS$iS;njt27VhM)P5O+n1{z|O8gi7Ee!6!HC9qy3 zdu?HTcQ2iewzhK&40=Er3i+xdEl5w+?F=IHVAes=KG300!Zx=Ip0C5eF z>MDD-djU0eMgC0?0f8#y8ux5!ZR5;{v+JLrUv@wPLXu%2iGbsD6}s-8t8Fp8XS6Zo zO$I3_gzVcZG61QqnH-R8I;uLp+mqH5n2Kjb)pZ>|-evC|ZEsCIExW9J7urNiHdVmN z|FsP~eG!29PJAX*)dJ~a98?HQehxC;>@Psp1Lz71dHLvBSs!DmU;W;{t#oK_P$lYJ zce`3l6B={hEi?k)u(7GhNwKRQ+EemMbfH8%TQ;s+zSj-ru<>=3L<^7ngM%luxl&Gk|?!gySW zd%y$oAfIg5Zk+yCOt?&?7Lqu^bZWYKlpxp^5{;&U0$kdY00vfxt!-i zcc`5ng6tMT?ewsx+Q85-M$j&!urNgR@NT|!Xa5e~SMgR6$b2$mZfcsaTnFCp9mOu$ z0tc*);K)w16{_dfKL!)~_C@srXQ5k8kF6;joKEY`|!RcBzVL!`IV2V@I? zQ>wSO7ihs~@vON1yfgD&=6UG}!xjcr%IBx{S$X||*KtDZ{lwvJTB|4+9)$DDz)Si~ zw~%DW462p+?vAGFUxPE_wxkA$aqcdw_@|}9xSfSsB;@KcAI%*kl*JFKzQo9>DBa26 zan}Q{TacIOaO-6)Z1V}-W-Cbi=+ic(a4%OYjP` z%|K^-L?wY=QV5NRuJZWGKI;;0bpQC2wdFkjen_w?7yFz=N%|$xVQVoAKR$VBXj67q z#FU6bYBknxoR+rq43SvN+S#o%&S1~95^+CfKXo`SPl@rbezYaiC)LwB`?Hb1&#chA zup(v4k}|D7QMISb92*wEvh2cbg-bn%uLiqLY+g((?Mc5xEg4{}7 zIh|(M{LSE}(;HKpB$zmcVEX$!Yj|w5`}dE~qE5Y+6;j1GVn0szN0HYz1o&JF zne85&XeXB=F9ZX0oQ&`h%no(e8wY53v1xb^{3sr)M+n$ZorE?!D0n{P3BP6q<`Dkhp0M-O*OI|Ky6(ats0f1E z>xT(d0Sy5@&Aau<%=N>Uq}jab#Qf*P#QYpVZ;LMx!ef9sLS^uRTIJH`YY^N3pgO!I z%-UMir!u#4o&EAYDPiM#>=B_PfK?YBbE`UQm;sHT~8Hidw$2m<#LzQ{ifvVYeA zB61BBVGz~JMBetZn=3L`U^vCwYr?sV;R-8_hMkifIoI`@m+VofNA$zFbUO#6^NY+; z^@AG^D?vG|N6QId9sp5nFx7lBnrYUAuU(vbJN0=I-PlS3@DM;6s1soS7vRQ6o6(87 zy@PsI-5a3>NQkQxl81jUXaq^JufWaN66UG!twi*z6T#`s>`a6{Gx!bC`Rf{w?a*3XZ}ZoYE6flCD88LDyvAc4bJw8y_c z6Zi0*ND}11rE~64(9v1C1#1+WQY{x~>*(Y}*804$I>*U*>Y}kCxDk-jhx^~ZQ7m;eP? z5ot8jW=rprQwzY$#>~pf4U`wfL3VGKT^~a%9~mdpL9yChe#1<5AI zOZTEhBEfFtA9kA`oi|viZSU!)lt_FeJiUp!=ZlyfT~Q&B36#`k3;Otuz7=%BF;!J2 zhEm6 z#q}hhh^J>wJ06rltso&Ej4yZiMRc^8GLfJUX508C&BUE-Wa4Wx?57w*-;>cxJJQoj zZZ6jm^z0Yw^f@YL+LMzll9diQE)2{I%!f7=wKHXS3MBhW)^ufZzw)a)9)U6TdI1$ud*fv=k(?nG2rSTfgqj2w43 zvx&`*rPEgaibSFwC%<`mkk5k%p{X=DfM9%@9bDT}1mt$K z&zY^m9*SVVb#QOuDiH!eIsnN!X{211`ZCM&X!eDN_F#-J(-XTBkeloU+!%Eq zyj1XJZvr~<`gJ6;K5|BS3$T7k>foe+R?@IihS zY^Zlp&G`6^ZzX<4DOb5z}?frCVX*W?Bjj);S=8;g6X)&Rc#=ptl(|*v%c&8gv zXAf0>s9b|3bp(QKIav@BHt7Vij@N+TFOY;bgQKw5%=lCo(9gfR@WInfsS zJ>EbqG5qWtwYl^1OQZ*gxTD3ZzAJchgQ=a%pM(|I!xEO7%wICLjlD6h}JS+uNh(cA66POJYI0sW-VDY>j?tkQ;to(BiR2(yZnxC0 z3Y+YN7n)(YFc7i9diG^L7skh_!Ga|KQ7iyir4z@Gr!|VjEV(=Zk};!J;pq)CTs!OP zi`yW*{0fafKQ~0Ir~-EWy{;Jw6{N4dMB~1xZ`LGur8NnLCtZ;h2-lUnU`p^sNa(AP z!9_g?wiQyHPy~`xZOaG{ROBCVQm)9?OU%o&0;NINTF@~7{Qo@czYlQCvN6SSMLVn_ z_=C{a(r;tC0|I;nl;CLWvRvb4=pv_z`GaR@`vuf(0m3(8a1FAgnlol1sFQ$fuxtuaB#ZdRcG$EN0HyyF>gR^(gQ{WuIL4T z3Y%I22^+940{=Y#w*(z#-`%S{n79q@4{R<4Ik}*&IdpDCO04{8V?;R$$XcOoEXj13 zU38qCiz^$BNpMk`?#lSsSa+^2X8q88KpcnBLUtE~!mWW@Pueh^cHJD-K1R8F6?o$A zgvb}X-rk;Mw+VdOxJm~Hb`=zOl?i7Je5$T7|CEEo?CMOPkqUkEXlEr!>FJSyU&&UHJesT=C^ZO5xJi#inFZa z_El}Z-i1pGI+yeVvvaT?0dHBxr z9z>P`0-*PF?6A~TL6Q}u1=S8y!~5M^PmpuD5sP~Cj{LC{4FP?kKLmIaa2NtViVg7A zQhu$iBBPunF84Ay*DpuO6DC6P*Klyxm;WQI+X)eoxKMmY?>PQGGEI2n2VkP`V~T{p zWINZ$U&CUuhZHCOWs41yLVg|&-*4zdhAUTGfcf4zo9T~mSBpMWc42)g7x-bJnkIws zd{J8~H75lm`AHBxK|y2vxp8ly(M`DQfY3SB6ujmx2;3kE(bd^_k7P7i|$Rmw}CHM|yctIrOnLyFJ>>=Mc zbH*s#R|Ypk9cHzPr!v&rX2VTaK=Fx`R%i_h?^QNcITm9$h7Nrf^+8CJkbE9&+TDd^oB2040z zhMZV~UFXea@Y1nmGq(sDXh;+~d$yq$R6jNW12yulpz|fElQCvHL*0c9vj9U4FfUdU zoP&luKI3+=0{pkfGep|E5ZQMC7eRs%L}iVV4tAr1cU?05KJo!NP{mS$(6~#&`{K*| zBo%yAjgm%a6YWz$e10zVTy*IZ4`)@b~DOzl6W#S%Lo={T5|){4@BCh>E#n zjZk9Mz2QuE0q@K_IV&p*X~e6nh;Y&~PbtYX$OaU$ALl5{$N`v=Y?hyLEYA*Tb`h6R zga5j~#Ky%nP-qnBd_nw5xB)8!+k8EetHjLePanu-hAJ^*{QTLnX;I`9&YVQ3o+p{_ zJio!K=2N2us3*j!1=KIif3o)#2&v3Wb*3|AYTCMVKvW1yKc-kzfprP3{x=!qOg5oOEZa1BGj``5kU-#xK$5s$$ zP4CO+>FZ)@5-+DA^t$4_ls4ZUACn2;@K`_7q$vFl(7N+djfji0e0MXUivU&QHFvOj z85(sEt{8wLL~#Jr=t(I@06-FYS^A)t-rk#t6liRZEix2b;(u9lA3ATw&ZMhkzEnEb z2RkxDUCTIAWmyPHW!nQ-x7681{x}W(k=L#pnfGVLp(+W~`8&HKetY)Xdg3I3b^t&& z;O>Sv$ra+GihHcjBzF z_#m(pA2)xL)nPkYN))5qn=CjbKqLVK8cRX!woAIZrCT=>N%vs0d%tRQJC{7s?LLvm zFtI_)-^^iop+cJly#?7AI>#YAea#utrAnFjOuZMy+dJNxl}V2Q;In{Rh4)R&90BCi z3o8Se6J-Z@hRMYdD-5AzeARxRnBCkM1jfzi8|tbc`3Pb-G61Ej`>IylUt|LOTfx>% z;!>mTl~aQi<(ytECCC0An|rQ@-Z3}fn7VJGpOc@nK%nx}DAq}O01HWxK+yj@x$OB> zmv8ye!i*U(V1szoSlioMF3F;kZh<1M>uK1B?cJ}q4R7Xw&KnuIbY7dCU zgYTs-D$X%Y`ELDpgZa@rYsV!3^VA98G1sd~kP+|F-DU%hmuZNle4qF0zxvMHOxR_%TOtPMU5*bxNRKBY^MPDHwTEi z*h|(m?|OP)9NwG{bO-r)p!#tc4O8nRW$?_YgQ1Lm0j^mHH%r~NoD*-Avj)>#H0!m3 zML2PI4R2AcT!3(6KL8~} zaX;JEE!yUPJ_Lg?i7hv+3v$9$=Gpi76kBMzeuspeAO_n<|I2*;Dg7E8DF7|WAX^E} zH0~Rjd;9h|;u_gxIu6Z4j##6rf=W^#CfRWcg^-K|zyFfHcz^aSa3eIjO9NZ_=utza zhPJ|L$zM{Xf0c4cjH|}PN979#NAby-*N+OA<#u6|ZalU0htA7~Gr=`SUL>0`~4qXdE8)P4<(AxY~wbY7dm3Lm6%r^Z#bH_o?eR{`V z^W@4q5?3j`!uMeKyeKfuauko@Xf12~TAQ$fvYVv>+Zh3h$rys6yRA=X`F*Or&fCN$8Db-vVkyDXuXkgB|2AFG=h-J3_RVTk3pJzajd+B2G5*bI64_#98}i4@e`v7Db% zPmf-#?;WMJdFb?W#W?Ky6lJf&X%B+S49>mB@kwf0zv=66T*s?!)?Vy6!D9Tv+IcpA zB`g9+(14^&1};-T7Xu`3sS@An=ov|}sH=CydoMq1MnmP})mt=-gpib1p-q@VIIi4g zv=P|BOXK6koZSKPSCNZ~{&=9{LkjsFa{I${iyC?dQTJyft8&=Hz5Rc)4ctsU(+a%K zfZzY@A{WbS`+4JFwcLMA;F9p_tHtnWp!Su+vN(N(vnK1whT-J^SF!=cYyfa;URwe}nWt9Y>vi7*fgJS|}1xUuqMc~Uzh zx8D8ti%ZIpNXNsK`uXNw% zQ%45SvdQI8cl^x{@0MpV#c3*KVNRCIJ#*sT*Sl=UZ1ZDpcGVlQb4K@6xQzSKZ3lb> zccD!0!*yF1bt~EAWheimMN_C#^&-x)R;61jhar>&n%mm(HXK~Rbey`|Jy)>P#?z$7 zNi#IeVtseVLnhRYEvcHRK=&M#drL;E6&5Edt^*h|(}MH+P#2wfJ@rK7jxNiG z(#K@f28_WjC!x8REb^kQ^7U zn9r2-e_nyLl)GuUT|+{q`))15wD4YSCxGq8Xe>%|tiKaU_^t@snR+W(ro?#d4sL$F zCst(Z2|R>ff1^d*`|5z&+B=Tr$fW?xa~=hXtH!0AB(y$f|hIOPDnUW;exZNc_gDu zbKvY$cLiK!WB5zoHCEgEBJ0`yRPFNZ;rGPEu3O8)B$NlA({9aQu*a5VhER}p*2&OS4934F zb#nTy5cAb)_~WNcwVQ2?lL^I2Qe8=@0=OY>s;{~RRB+oNhOK14{QLbTT(nu6F`#@M}yo~3fDey~HdYee{1_p5QI*Kl6Y4mEdr==teMplF6+9GV?!pCJJo)+QdU* z|K;c4-hQg3+nyS!yPBBgYB-iKZo3#4dujaK6G`d066Y(`vm+HSHlYI_>e*7O>1VhTmZNHy${}tarCsHss$YsB; zN}Sbk7IC{9)Sv{&`l;8^qP=3ADmya8?f}&@NJ^pyI7NHtl@G zkiSv_7ei5zUPgYnfQ@?OosInu@1+sQM>*qAmsC0veM#|27~ePO>wGwly2uTV5II{t zVVf}X?I3+-!!O{{eCnVd4=cPzmvjaaL>>R%uVTn%Q4jh6g<|F7q&7O2%a_ERZJ>Nt z;f{)CpX~TR C: timestamp = gettimeofday(); +C --> T: TPM2_Quote(AK, set-of-all-PCRs, timestamp) +T --> C: quote=Signed_AK({hash-of-PCRs, misc, timestamp}) +C -> S: [ID], EKpub, [EKcert], AKpub,\nPCRs, eventlog, timestamp, quote +S -> S: check that timestamp is recent;\ndata = Lookup(EKpub, [EKcert], [ID]);\n[Validate(EKcert)];\ncompute PCRs hash from eventlog and PCRs;\nvalidate quote;\nsession_key = genkey();\nAKcert = CA_Certify(AKpub, data.ID, AKtbscert);\nstuff = Encrypt_session_key({AKcert,\n\t\t\t\t\tdata.for_client}) +S --> ST: TPM2_MakeCredential(EKpub, AKpub, session_key) +ST --> S: credentialBlob, secret +S -> C: credentialBlob, secret, stuff +C --> T: TPM2_ActivateCredential(AKhandle, EKhandle,\n\t\t\t\t\tcredentialBlob, secret) +T --> C: certInfo = session_key +C -> C: {AKcert, secrets} =\n\t\tDecrypt_session_key(stuff); +C -> S: {AKcert, PoP = Digest(AKcert)} +@enduml diff --git a/Attestation/Protocol-Two-Messages.png b/Attestation/Protocol-Two-Messages.png new file mode 100644 index 0000000000000000000000000000000000000000..8957dca41b0c486173e968632c06a9e5017fa2c3 GIT binary patch literal 52365 zcmc$`Wn7hO_bxgS1(8yaE|ro7DQS@g>F(~5?hsTO1nKUWv~;7C(jn3<-Q95RiMrmk z-v3_v?ET^V4qw(>Q+Vd{-1oT0xW;u|V+P1biJ;!YzXyRpP{l+AS9@?~tpmLSzGEPc;N?ZEcO{U8Ha}OxV<{GW z)reT$qOH&8L?m2p4RkWSdp%*GA!yNNT8kUJ8N-_QgQDykwMtaEt#%T8)l+Z3ggJS{ zqK+&r$Jsg8M47yP#$42}`ZuWr3eRxzv0vqI9JL0bseFs4=u7<}SRrnNB^s}DbxJB7 z@Fe%Mpue%^_%<4=1|f=D?8ii1+6sc0{kQFc53`gWqL4CTy`&J@6-K>#)N;aTUnXJw zG(GLh4_znhK6~{l?}c_YN>nrV@^`*M{#?!4<=8W%-u#&je(FmNFICF`u17J}rGm`D!&nzqJ4#>NoV%wuSjke1#cD zEwS5__Q|d(+aC-Z3MsZ?+F>uax_)Eu?p?GwoKA zeYO!V`#zhJe9=W|-&Q&58@o-NX87{4A=dO#7F*S5sjz{-tdt#dJKSV+WZ3(K2DpSK zUAdiG=2gP`tB+?TW*YRY(YxKpXS)g1;N*5{lefLjmZljVh}UUq7W4G+?bmuB>yq)3 zy5AY7lqR!Z=mKGGnHI7+AQzYT(TA* zYHLk>lIx7Fbqg!#7WK|`v}wCdZ(JGj#-}=CzU>j0)A)TJyQS{9B7(Ac_Gm}4uA7X?bZ+Cn-~2UB}X?e zyraDHo5&QfLnsttJjEwzVUF)--efOBkm{)`l`~=yINblUa^Zo1h@84(l zn9R$S2ZZAbWQ9zb%}I;$+SbPOaBe}2KVzcJ^6%J9ZT%=v6_AYo@Zk~34g_K9+pNq- zR1)6APK`RpLic8TOT+ST3UdY7kj@P`wSpx&$H$P@*xYjvV!`8OR|SQKcbYEtB*aIC zhwmUFI&F-GW0co>ZcI!}Jl$V*+M0|LPqjrO;%sH!9Yj#5G9*oeZ1!zQ8daYX~)xUVOELIfhMnO@c-g; z`Z9Rm7Q*Lo-~-hE59}l`jo)@i|>VCesR+0d{VtQ#gK2IT z;LFBN6+XW@ZfbJbH}d>CE4YdQ(cuMK%V+43yf94>o5^W<}$^4B4Bp(}kKE!A(jJW`KeDVgdZb}J|-u-F{0h|I=N z>D`>Dsz&C8A+q@Y?%ENr%cz>1hA;!{hQg)1hqhks=}S9O6cJn zc1!(x*-+?OlGAjW#Zb1S{_f;wKlFY_bmHI>zcW- zY!fF&wCZr|hKasg=;Bd4!E#?$SB8U7483Nh<;2mp*L6ZWrdr9EZTitmh|aS=>zSBH zcrTQgCw>qan^wmKn_fe-?qTLZ2Z>j=?I*l$9Buc{j!xUtl64?xuZqa}- z59YT*2-r<9+&hSzN)lO?GX%7~E?FlUUeDdy^xSrv(XZQ3F5`0AGT3hSM?niP@evyP z($X?!Jb{FlYc{Zs^@g|Q)7Ek=GMx9fStP`rN40z-ri!x*3qwVkT=A5sc+WCD&X0&V?Nd$fZOX-GyIu@6SR_k+ zB(8K@?8FLU#4&gm6r*FRX5?QtQml>Rq&nW$7q%IALL0Y4PWy6ftLgd*kJ%`Z%c*xQ z4UEBk_DVn=VTUE?sVVV^mk6$Tar;4px7gEc@ z)j9F8)YT#199?lLm_Ra}r}c@PWt#;pT@(o}?pJ1cQgwVS6XFMW^^^083J(^d*;kBc zJ@ZqIzW<2}N73JLVNbVkQNYvH)n%QuL$rWd0kYo5o2;k6H!_A3yR@`4ZPP(Sh5EGA zP#bD-}%cZEkJF0W@i`YX@f154>duB^n$)bSak=|Ji zB(6-eS5ue-ZVs@=xjroRn&O<}YNs?~xDBE3r6g?j&GjrYHZV}Zzluz`>gn#*DAl_| zKKjt?TLd|G!a)bd20BNHo5g5z*cvo9SBKSFtbRW?Ytuh?%U&cVCW+X3!VXL8r%uO~p(fOlO^T@LfH| zPN$OzF6rYQJz-bY($Yc@T18M*J2Zazv(M|QOz2Y8&NoI~9nZ40J$l3uJW>cW!1?=0 z1*RSJ3E{7&3Mnostg*QQ*?7Rp(ebDdvr*qY-D(Qb{A%Ydyz~9xzQgqNCyxF`xXXPh zP2jvGn0?3)3EQ*S5JNp*5O|j60`unFILVALck&$OS&o|-V z5lS+A5l~?{T{`i(th{`g!@5$?PEsX;pPs%x9qP;{hu!%$5n>m?dcyMp4$16Q`tlT3 z_M%`i8k!&}LMFZ2;IKwGKeo)2jroDCXuY|%A&&~O$H{TiwFgL)o|k6dp&%z3~Cc$Dyq{tbT3gXtC>a~qO)0F z^i~k-;^E!h-JnGLFxlu~qT&^Ym%zs#F*;&rkSD-5Eztv+qw&AuR8AGe5@1g!ZQJY4bu{ zg9$Jp%>j&TaNd-z2LmEaC-Xs_ot>m2p(Ra+%9rf;{m&RRD@j=>Al0;s)sbU!%dxijG4s&6*OP8LZ0nm}@#^ zG>As*dN45p0RnajY1PX9;Cm5>w@t_L2pyX*zp&RP|8hYY_w2oiwx-3dD0m3Y5@&|r z=l5^!Y<#6Vt1q8>0MVJ;J#`4`(fPon=0PD}GG z$K`nst?`|^5dX<_*srfW(l0+s-Ctij;xgw-sq3v?gUtG9=pHbRGM0Ex)i|fbuyNml zJUMptoYE`f{91iBzVNZF>v&^qe=$ZI8wV$a%c&?m{bdmiq#8pRmj{Ing;vLjetJ0z zH4NhYwINx%YP10DSyAJW3LoWVMi}qey7qN^OpHiHll^LhhBD+ec@d*4t_7}2^Oi<^ zp9BFh93KDW3zN^@s9bAg0XT_%;98g>2lkM^?Q(_RxDw3UsQPH(WIbb z7tQ7%0riYv@vEk--=XI1eq28-#^slSWxa7jdGDj zlP6DMVqj3vV(l$&8k>JzHD7@1M?cd1-Y_nl?VAmI@l&g>SlvPi5f7mK=Hz&0R~1@p zD&1q)y=vN>xp!GR--ZZo9bSkhEO;uh8G{vNvD(y?#SEJU`F3DnuFQzX?r=@ZQ_o_< zWBiQgM912($gxb#0rHw3I^b(PQgrFDHJNujO|ZIPCt_mKpAm-E+vAZyG@tRtOr^wz z`8g46Rrphip=WMtJW+3 z+QYBtg<1`dn3$xx8O^>6nE#;t9^Jy0uZRf2G2nL1%#tMGV$&ipCLlp=)qR6ac|0?- z0J58ZaQ$*slgHKBp$E6Lqhot2zsGo0Q=NW?_qUHE4fdv7K|z@kIy!K5%q#nijZV=q z+x_ihM*USYo?NW71s`K#ly!96t|mmrpAy~gzxwj7Y23N?C>^$a2z}N`=Gel4FIUs&q#ns&4P zsjS`5_e9&XrbxN?={>V9-GpJ-0ewcyGa8#4QYJ|#tg1Is! z7)i`?Hg`NNv0z-N#>&Ux;=h?=&JH`yzROj;ti-y$oc??)rXe;bJHlsgPQb~O_CvGu z+VQ<|k6BCQl*KabC7fP+wD6%q#Nm)HSFPnes{2+A(tKKlxmO1zVi+H4@Dj(Q=-#69WkeeQB|wgSp>iw80H0nUc>7mCyd_qO!U9XmEA>=KS)f%v3Y+ zJk1pl?;V;F#*w}*J`3AB48TnB46T^))L2VnJqvcfm&S?dTp=+B%z*EJR%u;u!m z2z*q+ry`3tO#G~n=3?n=BVYy=rlP%K~25E-W2yTh=Yl_@Wa{B<@D}? zS6T>0Ma60DVo8tLFkJH;yfESrO}BpU_06e3w)w?HAsg|1Zk9~kl%gqE`olXum58Y< zR@nuC=r!5o^-8dn$L-jtwAyASo8+2SQ}NKLQ*1w?_Wc-A*4SeL=@Bbfe6;_H4=7mN z!_iE&3YzHbK*pXFSWs`&AN3o3L~FRd+D`Gh5|Piz?tj^TLi;C{S&poWObTtcCXL4v z^@uG6-TbX#i81)Rz8ai>R1h!Gl?~Q>$CGc%%U2^~`MmHi4=grTVWr}Q!TG-WGJaTz z3gWOd&w?fa>9_z}FKjvJ8jeyO2I0{UvO^fYDj2I4azd&fEe!YyPYZke;HKZYGVIbC zSbDf`LRzTq7PKuMbQ4btybM-`hF<%})*XYD$CheE$14LN7zYg39yyyiztZ&PujkYw zD(7Rd9IIeT=P_7-#mms3Ir?Tcr$Gg*lmv@}nU7o%6S&PtdvPAkenw?wb;*&wUgmOy z#o3@qGbUIFr57*GySr;*=q&-%E9T&^ZtXyi+}jBec|y87Ibhoye9CZ?WQ?2bj^1bBZBWxTm84pLhzmcTwo{~EQ=(s zfy0N-fU(*5wzgt(xHdgj=0%J-v63Y4>usfRZrHA%oLzw9#&XP7k}lA{>wB|hmm&CkLaMt#Wxg*>6OT7t`5<{9|}%0v*25C2|tGb;ROED&IY;pe}iqXBI< zji!t3Ag?at3Cf_D;*^h#0Ar{&iDmexxpsBSDZ)MiIph}*BRT#B#8Tg=^8!qghlqDs z;b+p9%tPXFFc8mbuJjyTGimJwD~HYeTMa(QYem>9HUCCgKHyZ|;DLT3gMwn7M!=V; z6+bJRI`A^_ah z`k=3Pio@i^>)XSR^gTBDYfMXD<|IA0Nw40$(oVRt%?)3vwReER4`yI-CAu+f)P2q2D}W#;C#O`XMlSq}nVC{5@u@Hb(p(e&tdTtsi5C+dB9((L zMth5RF2JxW`fzJ%Vq~OBxmXK)R(c$es>;K{q%ABgbafwhDXFV-Sx?tnP1T;BpG(I* z%lh;wqOHnu;zzMIA7_3vC$pz5o&5`d_GV27a->!ZFYnZIIRwnV^{4CMp~{8 zW`&1`zj^ZpG+Ft1dAhq4`9(#ZTQ$qMyb2Ui-RpU7VS}5Zb+lhFD4aB-k@O&mGnjOiWf5yJAS6JP9S@ zYG25#u8zI;v#ws{IDPE`GW+HxoF1`#c6tNnJ%krbHuzR9k%^L=e83=*;S>wdBm5fQPsxA*NMWnUu4$2L>WIzVVZq15r}`!h)rBWpuB z(pFYmVBbvUxjfDejFVm78<#B(M$$cgJZAwf-W|v67t=izpEe`aJE8;l_<(?bW&B`V zCLd$@sSJfsvk|?C&D^4h_;_(Ar)++A_Y3plhV~#sq-SnN7C#=+qVr`=d`WTNL!!HD zn%A;-agf7zIkoL6f~1D83HZjkC)d7aqWq2dX6!h|{ikrvL$Nw9UZ1?M@L{_J$zjG7 zLow=}aobN^1hIKapAymD+Dgb_`!=gDg>R<9Tse9RkOUFr5>hF=J&t(3-^_)C zgj7^;B_^Cr14%gT{j<=Cxu0IWZ!~>EN_tv%U*TDC;To}`B<1F~GZ!>prtriP`{Bc# ziH8g#{7hk1TtRf)uV-Hz87bJwnP*1^70Oj`#N4;T(tUgJzD`=VG6clC3ySD z@NainYhxOd-HXkiuT-eQ&By1pFt@WAF^MK;>V#PB5z3DbNi3MU`L86TvGs>{1Jw=v5fK%OUk76p)z zd~44%|9J)LXcpB5pjKK1(rasL>C`I$^;x31swOKd3%W{L8k!8T*C31QGe`!s_@S2_ zqzU-h&m8O6StWRFuwZ7Nc4ZGt4^{Px*T+{kw&7!ePWcPGWL$80SN@!qA#J#y{Izz4!tJ(wvo(}L7F5@FEu7oyrtI1KIEof`c0J?2)Y3Wm{eIbyIh&DaUVQdN#AZ^&&9{{%B`RxyGetv!s=N896iSy`0Q$%G((FnFCxoR(01|MBB$RoZK9s*e3SUK9KQ&e8QZ zP|+%1w~mv7A6nW1{fRg#1ggOc2ri}AkA?)FJKzxr1y{rMvgLs8~cnH z@|ptoJ`CBh&mM%gu3|yL-ZdiLlxt9oU+u)ji5BL$(m z<$-Z}Ip%>R-r*C5^Jf0DW>ZP3O_t`x z0qbgQgM0cCKcCa`0sJs|bLT}?4XE>n&F|~p>zo1+dUhVRT2)R)mzA4HLquoSFd6#S z3RBGWUys1F>-fI^|3DAG8m@m(n4!+*9QEMfASjbRbGb&#jHLl&XdCozY-MI&qc!pQ zg@ig~!7W3Ko4fnS6_k_^?%ct`!RbPr{0yXRkO7{Gpw@Jax3uLO2YvbSWp;KJ2$rzO zhd|U4TXK{nPhJHJh2d_0&l{4L<~iJ~n%TPmI)xEjKe1W4`O1oP?hz4rNN-I1f+E)&X_H`YQs$tOS-W6ckkB^S7T1c)QA++6U zx;itj%@7L0M(RjtYabWS)y)T3EBCSI<6$htVh4{FgR{~OV&uDbO#tt&p`jrq6>2Z8 zqoV`B)eyEV^z8Y|Ak84o{qYL(#oRj6FQT_}&_FhXoxIm48#x>^cPJ!#PqxO&jOFFz zC?w-s7vK?4PF6C)oO>k`*ks=>djTX`09spMn`(y3xr{q(;P{sUKQA%2icoyC@D| zn&K-rfK(gb}cZMtjlrGOs5q7JC-1z5{d$FCQ6( zbeeLURUCkhFJg|gT3bIEcDWvJNiH6&4THGTWJwDP4L#c3P3u)sQTh65mCd3-i>Q3$ znF)I7grkOLDFbH?L%>g>I?T9Ea3 znKvY!C%Vqg&YqrEg_CA!X=wy(7P(Mpx)}BKVigp>macuwIV>GOj-N|QFoeIi*aZNr z*HWCZN@7Ynr}ClNP`=&8iH)adt27l2O#-X=4|w#8s)f}`@4&UgtlJIuzGIqjghxmJ z09yRdp9WB*UsyTYOl68w^v@!#40B9)V*uC99J#zyBZi%J51trg5+C3zSjjms_H_IX zB1!UgUlP}`Gd$B3IIjU726{ighFdpXR>r1GGoI{2e<&P#adGiWAQTo6v7V}px}!K;VzL#gTUR-mVc*&4asD2aU}<~1&!@cTqtpY; z`2cri*TTZaZCPby5jrZ*!)Pny+?{)(H(2^+d*7*8(ky6-uQYNVqI%g0tqcG6Q%oHkx7>RTEHTc4hJ%@6<9%-2r$0Z^(lzqSs;PA{ zq`68rcXb7k#{$^5Gt&_SYgY?YJ`Zk$pfM$!u-&cGb97{rlmigHdmlFg?=+fD{X{!7 z5BhjmDZN%?c>U$mzRoC`uFg(iM^V+%qL+%ydMk*Pqip=y=ZEQfe2MxvZ*INk-BN%4frPBee$H;0Ldi=Qn3!YpZ?$cfdy_!Jv%&m0 z*orF{m@Gi@E4NBhwKg$%iVXezs8j3DSo)^RP30XNSm{#Q!$^vgr1N_f+k%3E@?N>h z=Ayv@`EG`Ah@M}jJP`SJeyCdy)2O9teM|{gd!Z;jTm;p1SbwD1Wu}g|EeAVr8~enh z!ojmC?T^L8#M((d!K$ta9_LUowvxP(&BdnVNaN{t)tSG-5N*J4wa@}^wj6J|SOX&w z+|jk0OfN_So`=KA7cwBlSy&XLq-X=`tnAY#+8Irs>?nr%otHTXk+WWxFT0X~0c^*j zqM||~nie#{X&4A7xF3>|dgfUa7iWG-*leaC0LD!OROy1IOQXExBrYe<%fk_>2Df9Y z-Gs(!0Nlap7y;yjc9UmKO$}`>^u2<50O&|e&%W;mX{v_DcE8C$2UYm z9S~_i`OGD(PzBDQl$W+9xzAp0*q1()$=Ug=Zb5Iv8J{ckK=xADdITUQq{ z5>n0UIUjdOb5!mR;_NgcF$nkV-zk%jSNlN|@&>@m{}bHKe`!e<>AgKm@oL6Ra;MM- zBI)~^b@S^}&J8&sAR-uVYue`Ve?oGC;<)t%Gyy?K!s_1H{L6?i==@TmfQNVI9PX0F zs{H8bMT;BaGHniv+x}hC%y8lH=bGrV;h+VD;n;o*^DyYX;q^(13jo)jw(2T6j4xBh z3At}=15z#I7326V7Sum?+<2tZRB6y#FjEOb0EK#abCrUjEqm|~3$jo$2=SfYg%TiX zlPOn%*7Y~2PN<*3KZBoU%;&nBpJ8y>?Tfwg)%7ofX0uje&5;hum9`!1cOZ1vw{LI=d2dK>sqni}#7vtcNJZeAA)ByBo>v4yRVz*;z?Ri!MBnx{LS z?k&z-EU|-+ZES30;ZI@I{jxPxxA-blw~OxLA7~d7pxyQU{(b;=WjSx~@TpScw*AH^ zEDwQ0YB3VMt~T8L5};XSO-(ux0+mJq`O%zY*R=`jrbR!Kd*`G2VRvrdF1MUuqo=2* zq!i&KXJllgq7th+vz6?zXc0CoHJ4?ds4&NI;Gjy5jjeXvRHM2JZkG7V9OeTNFN$_8 zyF38d0iG*kQP0ZT0nEy@+jav$k}|zNah0s!WZM9$(7JvX;j&8^?eI$g4A&x^0bDy~ zB`)3xpszEVRPBf1_3`w$ceshY=t(?o(OV{|(Cu4*q;$DD zU53APD?L3O)SdR_r_fU-IwZicJix$sxi2MNq8+Ucu&iXy@_%93z4YMIvoozmchyj~ z`|CTCc73u*rl=+Mt8%5is;a7>gDD2-5>TuB{BS|})ETu-QGirB*q%wj07>v?(?aoe zksgrFI9R)kQ#{%i009CXWudOSCxN}8zP{BTIu0m|g^sYCwF>JQ&&g^VV3E|@1vKX2 z`bZc)6!5X`Ng33FdJA2Y7{0({g^q$^V5;`EJB2TW1S23vqsI0fv~#eQRXOeDiqI-x zCKk7c^8o^`GpQvcBHCP75MWmU5V)-Lt<@ap(o)-`ot>XgJ#)aq{+?xdn@LwfQeoy&vxco0Hfa7)dlzzZo8#d z$&xsHOrWh30kRy3?Fz5p-m;!})}T*G=8Sr+cZqXafl(GHhWtZ~penbwwUt&wpF!P} z(}Eh$x9Sd2o0zfr_@yX4L9@m3xu>tMDXLDF$l-8Jk?E!U94Y~u{pz3)3KTk(Bb@>~ zv1W*B!ICMwmvP3)y1V`TGSrz+Xkd2oh4KjWB^g_z`;*;%!1Md~_^8AyF?58HEc*#w zM1K18%(ax*dA7+zx@w79;V$bly6Kfr&?ApmS|%hWzEU=*6L^m@H>UEk>a`jXDiLSo zJt{gn5Ute6P|=V_M>OhY>1#%{SRaeBTnjDhSq$}g;$-xC6FKS)-q#Wizo{h&lR%y%-h{z+wCIu0#r- zS0iY2=4IglT43SZny4xc3q#jjS8h7P@*)r{fWHo5P!uj;mSj?mr?_-C%Yp{4O*;&{ zWqAHP*62fIHh|P+uN?iQenDz0uC&HvD}FUM87T&aVi45Q_tuou1$!{CvD*h(!Zdzk zZIsG~a@PA@l=FTjSpf4_N>p{L33NS4jbktLSJ42=WWU8exCbI@}S&kZc+qXg-$EEaqrZ!3&f<34+q0BwB?kgZAO2G zS(4z&tX^nm?v^G_p-=0}uM!Lmt!T1mz$J}z_bv!4KWA~!o(^P)w24Ye_JEGtX1n1y zkbkw--3d790Nw+9q;bst(UH;ae}QjBPKoiw3d6d}diOypcL4B1rMY)o+k$XZC)du2 z9UL6&&*#}qR)1&+6-0cdmtMi9pDtEZV$iM6zX^nUvJF4vV3fDLwo+&btzDd zOdnGllt!76!7=juZqg^&vVfvztOpAN65j4XmXYN$yj`awz(;Zyowd~*;Jv@W*p5M0 zTns}W_C1!hug{bLpP?FW%p)Hc0xANj!yf-a?zvGLHP&Hhpkw=_70 zfmk#r^zy2z-iOhy5Wwp40ZH=vB7?@;dXY;+r+>8iz&|%adma|LnCso{EMTPK?3yD*WO+uoBT#V zXp>y7h#XJag#j@T909=115f4X<5D!f^Rd2*%S$Tw9*>D~Q&PhZj*3yTQ+3!$S(gN9 z01=x2Bkf_8_HpwY_}_qjo!}~y_vzEz++2SW!}^AXHU=U&MJ`Ip9FZ_$d#Aa%IR!7` znQ9w-aH7D^`Qds@LIO=vR$W(~7O&!!Yl{Gj8!@{TVZ#@Rg{S!WvD zsLbm<4@!7jT8Ps-Jj4CN%j6WEX==Ooqh@w9lK0D#wZLRs3W%Z~XdD zq(o?K@Ev4q?z5E)xerS*K%@&eNXj9m;pI*4`>HP7r9Ci!Lae@KR8EmePl=ExO|MZc z6U>Nn9o@vV6W;LASbO|1${htDqE~_(4ko$?A8}*$=7SibqoV=GV|%hQ*L1PSu-H;$ zISf?<%5N0!AzZ%!LRca2t%08Kn(IaWJ?%cVnWePj2K}n(^M&+l^`I(#*!9FX97=Eq z_%QVu18k`9@bCayB;s;(KN>U6+Ag)E2qNad^rk7b#sP{;*0wtFC2#svv#=qCjPh=r(oK;pSo{7>(0?1P;@01;WO~3b zC`uYq&VRNrjXA=Kf^RW_afo|)uIo3qKIv6{#{~a(o+@u07eIr9tkis{+lEj1>^@g| z6WF>yxw!({(w0PJ58 z|NrNH0+~`3#=Gn|)Y`s`OKmdnMt(CMAv#a!7 zq&Ad*uM_jICqG$~cIbKT;rYz6 zl5!oSeUT1$9N-|B}a7OP0=W;sI1ZK6h#|ikdUpbQ zF;I)a+?RaztF$b91_RI!f!GJr3)pZBA&U>394yB^WqDm+MdChxts^Cc7M4$KDq9|~ zHVD1Q*8L;2mR#v)#J$?N=^PPA13pJ81b+mL*8q!hu*trt0^ZXr;5Zm0rKJQvFDb#(#cUt%uDg7R|vweNYfv41lY*s3M;z`O)`A3%Ws zvoxXGpWceHKNWlR%KdoCi7GrUE-o^%bpa|49T#-i{-3wjFARFxKX%PxR{uB zKfgYR=JmRA2e@A~{vMb)BkOBN##u!W0%#T;4Xp@}$1Il;rfNS+1fb$-4=tZ)O4O@P z{e8Li^fOLh{r#Rs*z30+;Nw#Zm%ETbQ673NCpq1^b<1&M^l{r5cU_|{6tosC3suji zw8W+^sG+uG&^6i93){rv;$oqGs3Hw^jy;fe`m){Vrcze`DveTk?y{N{Gx|6vJpx-O zL3Cuk?jMWtzqkSS>4k5UDGy1Rrlk`P@$!C1AFOYqVsFR-l<1 zt^zu@G@|xYQGuOCR*`{|Q|-JFlp>zYuvuogIS@PZ^che{3k(q9%pk}r$_-N-nF&=i1qr|>l!9c=t)KUkvoFvIQfYQ^eaRf!PW)tzBllQCW`wYca)tBW=R0D z8SJ5nt+u9S&mNd>Y;A8pJ3T$z7-OcPk)Rb}Z{qjJ)C^!tP-y@G*|gV51I`_g9{^`g z(IumwK45|cvL6CrGx~5Y_#zT za6`PyE|#ktIvtTyw{|pY&ETrR)2q_`xPDntvybICMLnE1& z{3UepQZ4tq!$C~}dT@Uo{ueafSTD+3uQbT~`&h1WSb1>dA zuqa^X>V{V8o9O!Jh3C8Uf9)L_$t%g<=L;$2VKR>!8#y_QMz@GjdRUIHT5d7`_-!Byf)mCB zaPaCwwcO0?Y&3ip|IJ!Z-84clx4)!<`_Ey5Y0;m*|8f!lb5N_;+%GLpH6Hu%{&FAa zUgxR6fW+?Mq2cOp9>Ea^Y&EWjX2~MTmX@19umZF`P!0GDJ0k%E1lT_{HFa;#Hrek9 zfEbznY|LFRSig04)`CtDIDWt&7V^D&DjyccRDfy5wLKUQ4D*&3q~E^wI(WJZC=oy* z2?`6-Yu0{uPPdTZB?lDCk2)u7v$t9eu3)~EhMAd}lXJYI!w;$qQ{(ciL?*n)%|YWD zLc*5}9S14~AbEkN6VPT^U!FDRg^@XtiQ@{GU?8H=7QMtv_PTPZ)d0iHQN<00rpi_C zDxA{H;6(oNso-9^--5jMm?zr<=YZwh*fgGtn9nnj1Y=j;#F7!rr63ZYY!`>W6c7OR zBN;_SA?7Ioc@h?l=_sc2VtdSxB~BIT0Q_k$xPU#gjk}!a&{hXQ$rSLK43V8E@xBpyF=QBj zR^|+Nq-a`I+p~k!30oQ<;Q!4oHgfh}I`*xfA3*57g9p~27XZ#U#kh3>GdZB-41$EZ zxZRv<)DBV==qL160X34F`;>Tj8$||T)t*lAH1cFA!CEDLEd!do=4emQpZW}JCP)^v zmJ2{cQ=bKnfciTMPkl%A=98v74FvwW>qtHfV3+V&1B2cklI8;QS!ytM(LaOqCtDYEhqJeFAfK!0`tRk7afZ4Gj)ud5%&mH8SCh)tF05`mQ`xeHuiI_+Np&9$$o_`Un1809FnBsXx zb-v>Y)N?TDrYaMq$_jt9w>KD)?@2Q=dd#D+n7>B43AOSI$Cs(a9(Gymj50Jd1R5AE z1B3NO78Mxj(2dUKs#x?uPrin&8ljqkMuTfq7O?phR+iY~w8J)=TFH}_HRYGh)0iz#K&#KMvWuqT5tI!94X!!K`Ef4_%P8}k)R z`iY9By3k4L?(gkIeEfKt2F@p)>ZiA%YCQ$E~`*>xzUO)*t&3OQHMK&VL9GqrN3fB&wK zoU+!v-`dvJlf+d8vJ4nBUbC)vmsKZI;Z2GQx`-VXASK%io1NdZCpU)9T4t&D+3y$H zL)QD#1OTUjh)!H^Mw1FABg4pTa+Zqb$>JrGopge&YKrmHmU~IfE z&=tdAJq*RdGG{F_d!Lk?EH(V2x64%R`U^6Hz1a(--C|$Qqp}nb6(WLy{kHkQ!9iOD zt%tfRf-*R~xx)6BjZFp>j9lh@XxADa+~HBSPXJ#@0D@xC%QU-IewUzm+I?SAOX@~E zqaAJnlr3O}mDE*gkrk0gxBk<9@}~X;Ppd6oJNCvAhb))QSEMKQNjcpD9U7bbN86`;LcVV9E0L6banWs6qJvnhf zen!b#cU|~SH_x@u-PvYWi2@irM|G=@Ebss2D0#^C*;o%0Q_!#l4D9(XVU~Lg8V}-7 zF)X)c`v2{dU{>ooosY~GqpzAQtIfX}!(aPhkT~LA^>n!Xqy%L>3FbZnj&WFbJy%3B zspeT8IJJ_pvsiqUvef~MR+IQQ&NL}fdhY3C;scirX?pi$O5rmUGD;{uz*NSd1feX zXqaX5n06O7aSj?!5M&lHB#X|1$LYU>4|L$gnrXbOwpjoGBGZjChlh;fH-G?!(*H&f zMKCb~AP75<8h~{v!|pe-QA)L^n;QR=cvC##g@IC!fFPB?R+ydrzD?*tZTw91=`!%i zw0!weUthmAe4KT@m-kHlK#RhXtK^ZiZ@w(*U8~l)sjk1`g;-+v6v!=n_AC9M6h%cx zgBCgJj_Hr*0HA>{P3RA{19%@er)ZP^))fABm=9IoKRbqbM!_%uFh{A%ko8C^;%xrq zGN;#W2Os1^^o~m6q{XXA>QjU;1O?6Ap>dl(tdk7 zsi~!TpddUujn)I`CcwKJ9r{mcfwqwPXPDQ8K9CYYxyTdB;SCrwWTBGAt| z==q?>sX`p8SuX~J4xR{5I?b0SCnpMuiemi3lSvfuzg*-RilV?5*Tv98+r}}hm^lUP zw4g9`&&;G~exI07?@Z027RQQlRICEr1|Qg(=H}*=l@;K-6*p#L`=L}JfixWvnfksV zYL$z-%*sPBvaF~mbQ`)Qal9yRSea{1-wsEJ`s>sC%N5VLtcNc?fyNQgBlppnpf7=5 zGX(nV5p6F`&ejt2$FHG5!a_oY8a1B^3O2yjE-o%|(edZbC{!qFN{nZ<0^gVF8K`FM+ir|<9)faG!yc=R?$B;%JV8AnB=ohq2+X2T_2Gsj z?gtxh&IkRxI~5!p{PykbctY(4S5^iF1`dw6Hq?6@PFsXMdN{Ny%|7X~vpT$eMatTd zM#BkgmQe6L7ki-J?^_sLeWLgcDgjJC6NJo0-2j;6L!l-`B>4E9KL5EZz>bbB^9Tpy z?v4XP>zFffbbn!(Xl>wHqrEn-qLE@x1%qECW^*Iqbi;2SF)XzyBwe2!t{2zuiG%S1 zNi8szAc?Ke!(eW19z&}NTrdmE%j`PM-WwYh*zELgjmiN}eX(in)#X?N3~)fyQb|f$ z{`s?iEejM|Koi?L5XVU2+2K6+D$;Y!;UPyM*gmr~eJ}hNU+CZbM?RxzB0RSF^SGln_ZQw7e(Fr+Q)y+HT#_KE6cH8pyOigRBt3DF|lF$(b{f-v0Ct#m3Ar_nOkjU`SqpK9P@5mo@LOWcNi<_=ESy=1`(uKJ7xJn7tMNhM8 zcQd$UXX@7iTAzjZKB4ke5dh;5!$2WE-)_1d0mHjM!D>sSMVF@hHHGy2E^(*0A7Bq5 zBO{}DnNwp~?sX4=Gx(F)Fm+=-^~VnIMIIBNSsl(-27D^zp zPcYIVafmAaqW6)y-HH^<$7}pcuP-we-?_Gt##(-Nv7d6C8DJqS{2n)Q4}8B0R}%oa zAO!$qD(hSF+lE?xN=^&Z{}g#vnC+CQNZmp|KkYB>@mD>Ak&mB&Y~r%N1ne6~LR0KisHlKI zP7AU;EiJi}84M1|dl~p3fk092JMFg$Xkqj+V|h`l&b4tjU*CM-rh0g={0GazuTj*C zg__Ch8W#U*l|=ob2jJX70MX5G00Wl#=5y0uT;SE!DFP2o$1phRY#&R=QMvSI4N<>F zWvf{izL@trG3l&gWo0$&-tw)Fm|Q1A+P~w~kKHPd=g4zU-?Y@TOEm%P@n;>yU2JRw zlf&gOJvoM(HhB+&dH;8*kUQ&m%2&FFtr>IzOk;zet%g>duR<~`TZ4Q(~g zOWH@V05Kn>C#y$)kmvu2fyggnap-r%ZJEIt1DN^3KV9A3rOoBXPx!_ar}BTgBD>wN zdavB|kICN=ouT(a^w|rUrS%dxdpz7*!@r2P9C0!b!vN;$UY`csyefu zALfsnxoeAv8p5;nc8BfSGnwYP8XC0_jNmS`ts^v+w^MHA29}h3w_j=55!UirgXMIOchzRl^L3d7yTe0VEntcy!-0i@_Kr0NNMBQbS;8tB@XupUDl^~ zzX)e0x+TL9A%ei&y=Z?iWN?TAfxvO7uce4mlL`t7?AGnXgI9eUsV#8u1U@t;V;AY=ijuof@2$_^!0HG<{y2%!sD8FLB@e z`(Y0CTUjPHatc;R^dbZit8XqWEWGEE8Hi#Vn^E}gY#=TrkWf|J{zsnXelxqLW%KR2 z+)DN>(4bd*PAkK!bNu)U6|;Qj1+}%cUnDvO9Gt(sNLPEXgKOnXUQxYuV||8MATs}Pc*l*SXfxJKAS4Z zSf|A*sr(>RhPMc)o9!tpZt`N;UU}l@K9mOuCoQ01c$bv1e3Jvi$r|-F8&jkLE;HIJ z90bHmx+qQ?P%ZLIouo~6rs(eu$ow^{&HH?Ro1=&lZGNgfW4!2yDt`?RH#av_YIoD0 zzkYqVZ%rA=wCK_z36G?&iBEL?yd?u?G_)M!qgSb9C;d@nx#JTP6(%F9+cLHsSgu5A z{L2F8reL_1RodJ6+n~L$>&bMR$)K-8g-n3zC?Pxhl)Hs$dtGT+{&`*9zM1ZLtp|M; zq8|qA@z4P#_h961z8|sr-FdV@AYwSdoRCiW&E8K9e~wXkd(VYH)CUb7_ohitz>NC` z-t#LeoVWT=Ke^)gtSoLczLSfk5g;m*tgmMly(mttE}7N1F@0)Va8VaTWu9WgOfnR*C1L_?%1)t81zuHaR1rX87=*9qB6#jp&=r@uPh>< zQE3vEj4%Oe?(o;6lVbxwF{NYtA>KmUl8n1t`R&}0WUb-yRApJEI>B#q?fUhk)XUwg85peQ+zTIrZ+7|R171zE)+9VN zuw#^zQ_Ql5UbbKiiD;!MD<;M*j;&NG)lVekLPU#G`d$j-cnS?AK1xzi!2mT-564vg zwwfAs&8rH{IAmEwEZIGKf7hrdy+n;_4h!9Ga3276VYyG!rI_uzAQ0tRR6($9#3yuR zkiCp8xbVc}Z>V&G(Jmt0b!}fs%v=Wg?{P>#ZT@6& z+!}+if|hwF>p9p*uL`ds92y4WpdU_1d>Mk9ho)!@{+9lp-43XlL8xtq| zs@ZZ~>Rb3>_&p^hC5;`uq>E^x&1RXlxvHEHyc=~A zp7lVzF-*m)Tfi>N&NHxa6HeDO8QKusWXur0)l#FW5{>8B0vTI^$}x=j!AI^xz}?o` z+SgkdZuRcRr>C}pCZ+3H8Z#~Q!8pS=_U>{;dHD_80sf5Qy^pi}l%Fdf@`A9)!PU>k zJ=&DSBO$Q)`D!=ubAL<=%E4!>{jwp}MRSq|7DQ*)thUAEOX^ZOx--e=Z(S}fSd*G% z1J^q!HMpvYNr*+w_g+Xy!{b9VxhHW9OPe-7x-!&WLl~!1nUkIgXRdAOa-}gWSUP*E#DvI6p7gv><^KUw?4#G+RRYT0R?c z6Of~l6V`g~5McTH>wAu@(Q|8b$ofh=m-DjZWy_bd+Wky|{R^xK8iLmE-;YHurlw}w zz8!|c0j1jlkFRK^uPsM2*x6|$+^HJ&HMKRKSvG?GRw-KczO}-lYy)+{<8o) zWy*^lAh;7YMU1exTXCG~761x|;X~nC+gYEcyxWl-)w7l~OtW8cgF^eGtEUGO&&22` zXjhc${tL>=(6G&`B5Z=Tzdr5ZTxdMwG~7eQ5xupMRg6wdZEwq>RSPQqq04mk4tL`! z-6ARWO@LnKAEq}${@dx;>+RLo%`}?1+?`{rw$As=r<}ls z21u>|h@-#dQcryJ^ywi{_to-N-(FH>t>RRo&pi8zI#*^JOFs_SkKBp)^U)VhLMU0Hb#jEC^}XO)(eNHZqH#Jv0Pfp*0T@K4`^ge`!5y>AZKp&We8d;IEj zJ@lBx=lh3;1;0+Y-{g9ck(Oo!4jgXCY}z9Pg|YfwNvum-_pyxpe_|gQ<&EmI8@?xx z|Dz&qoPPDA&B^5RODo~@i}>(KG?K}(eDqUx{Dgw+5|-B;Q!%bYY>5A>;|p(uZX&uEf=vLTs`=~vzMeJ^-2Sd`0k{s2M`IlG6pw?w)gAPZ6OZr zH?kZZ+pnyiVan{8;*z?v5P8W;N=h3yY+xS=7I&J4p7M3hZJW24qjy^A=}MbKiP`(# zWR%{+_~+azKCZ*4pk8LVGwL;21d2_^pGif^zNMXC zPvpFg9{KFoyyV_DImDkka(px)^CQ!}7_)3v^*wx>rP2domkSuvqT9tT-zv8D^3f4iz=p;Pn@GQC3XF=0**I5^R8 zk(fBl^I(bT%Jc6i5HFq@+%({sq?BSix&J?Txe_<;!Q(ycJld-%4KKDsTIjOL0kyUMwED_Zb!Eis z4lXfPc;jiOhRZnOn9=po`hk~MD}!qY~XhT*1mgiUJAlG?Z)cZw7O&`=Eq|P zS-vS}NR5CijjyVz+9+h2nwBP28MY=`?#VJ~hM%~dqI;&uujpzAD&Xe=GJF1@if-lg zFn_NimG0g$1YS6*rd{nE_=Y5ka9g?3N43H&MPgBGi|L+B(Tm)p4MCp4uV)Ou9o?&l zMceJs>>^k@Mk5E{l2%2eMRW88`7dD-SFVWIHJroEIr(Y|qZ7v2t{*=P3=H5h7EEA8 z7>4%|MFoWeYLQF0m0=c$VrwjnGA|k*zfv-Taf-^w*3NDMZb+EH_ovH);W#y5~bL#33)ZI?hvz<18^{&3Y{<9sr8_{@MiApKugHbNQ2{+$Lk4z)@ zf|rXcEJu(thG$!jk7zt`a}BWU(c7~zwo_kaqq&8}82PD(QHT=1!Q~&LCr-bVeTKK( zTr~ywoD>j$CNCE*Y4760h84i7H15$yK{0)O@bSW##U31Ay#;f|bK5!i`1p41x>v=1ZRBq0Axh$a3b7IlQBz37tF`G zp1Km;Ve2k$=d)+YNO^KyTF_xk$85ijY3^}wTj3aJW>6DLBK72NS>s|X>=6HH{wX(q z+oa}DxGK_pk@Lw*Z?83J%7q$Rev~9NnLm)qPu#>eYQn?)GoeY8Cwq_ci`j3Ov90>^ z$1@)0emzrQd&&JG#etd!i7L>LV3-lfIm=GhXr zeN@lddIXddRGnbcp5;#`e=|9)DZ=kOtuD8Og+@Fa7mh^_KrRS{Z-H}1{j*($;S)BLIA}AmpkM9f$FTr3KEJjumF?Q=xDZh=KUCP2W8#jKfsbN3L6~%MVW7)KR z;z>99*_+*$;O2j~q|3v+Yq5?AJwR5xRRAh($z1Hf-4N z;{eMUtSE45*a|fm+6AtL8JPj41wVX!mli1Por+YZAwbt(ub>g#lBZ`GPJ_2w|9a}V zWw`t|Wgm#~fD@34ni})GNn>tsk&6D?vNBcyqqU7cySu}4aL&xiYGG8;y>!2me)d?h z)V8;`KXGEUr?r(8+6t~PI)>5qgmK#rFi{oJH+&ZimXus;+DTk%I%lF`5OQs-HIs%h z!{67p_yoz}Q^B>Sx?B0N9{U&0)q=o+-k)hS&Z~cDOI#d3{K)l>FCYTWdCGFvmc0)D zd@LaH*eH+cu2Bf?@M{Js0dY*;v<+Ps-*R7o9S&(*u|fCmCjps1IkJf9<|4-@xRDO9 zZt^m+xGNSYQ{%LpnVA`(Q1J-~`hgIP;lktL$Vp>#K2bBV1~F`;N5#{x>sx>3T?eSv z(Hn}U8)18rw@FNHIpUN^lYpP{b*Dc}pL~EF0f6^*9)+Ifp||(eqomuf8ba9vEy)OM z`c<990dh)6xWM&?oG+NyG!ip1tU*QN5r-@U(c|DB6BRZ1-zs(Y^z=a31^La5Yu6O6 z3fkfYJi*XBJ~08R1?^w*b2i6x-rP|g0LgH6=pES#hGR=E0~zTkH?ChlO(>2`{YU** zVlxECw4ubin83;r-5G9(?Z6)d6iLBbVQIOiG1bX-(VN-E&g}&)p?N$-%fFP#&xov~ zMMR9p$HybWe_Cb`4-8e5eT;DL2&KmXsJ> zxDa-2A1`m&cqqNTz8!SwuCA_hoA&0r1l*ZKfVjcZ!@^=Q18=u_UZ_oOEvlGw^>45SZN>3+8zMnp0ZwCTTb4}>3@XsBmf*&n92r!893Fn%cV{@G zg@KInSh&B|hJBYW0I{Hp-XM&Kso`N62Zt$U>$)wiT^Sx<A`nl6&f-U*%4=L`h_q2r(rgcw@a!3`0Ulp>u;P##FIRjs*%G+GslBD;TzInH zz4jkIyYajv@i7=EML){i`8X$)+6Fq&*N>v_L&tOT&Yhe~Ek~hF=XQU6h}wC>d+{Ad zyW6{!PY0{r6U_OUdmY#`bhT}ft`n+kmU6onew2@1THvZ4$hS#izBPY0-h{OyZP0(C zM%1!x&%JZ!PR8d|$9x4`McdQ+b7?pYOr;IX;9!u=kJ9axO8DyADfIiwoI`;V1h!g6q8N7dE8?)9?w z??s{MS5sRTw+UDx#=%FMxw*Sx0K-@S?t3!kH06W&kOOXTI$ILhB}Sg`WdVWo=^2@s z550y!^Csbv5HWtVwgCQZ&*wjznzZ#C9JFkZtE^NZZs(t0(z>qFurvjp$HPAP%`v4g zd_gQR#Vvlt42Ws~F0kVvqP1mZyj!+Bj*Y!dWoKuH{Q)h_%`h!R9)AeYq7mgYDM)40 zNWY+QjFp32b|%W)Qr6xKIyyY274qUHszP2rVUJ~Fi-?SLlcc`AVe)I^wBY8=oB8B$HB-1 zr8S=O6ssyPH%DE-LrG*Z^qWdrK=Aj2jv^P*UdPLAzCGrdBlMX#HNG=nW@l&L_3${d z6vs-<9M8224G+8Vn=UxuWNK!_MEYH;mb)S)llk}(xifY@nuutzx%P@K7tv%~Y;14F zPYR(|4-zo;+hnz&>rPVfhgbF9F{T__w;r#1>y!aJVY=eSm2Y^ z4NsmvJ%=HEXlSUPHZqC7EPdeO$oJ^L=%}dGc~KYscdbMSegzC;Wb!wz?{{lbM;BvhrsS-rQp|?u~J;mBMGuD~Bif zFE7%2=(zH@gM*mBEyZFY*d`}u3K%2y{MaXS-rb`iuHy8}RGOi^?L+VcG_mfhRo*cV zY1UluvJ#}r&?ul6zqSsQ9um#z0r43Nobv%rBd5(@1h?%s_Jo(N4cJye!C74i@>+8< zk)Yq>l&&tBRn&$Y|Dxx~OFV9cXU0;LI{*yRu3R}q#7$*KMuJQhLY_%8+%mccOU97j zIp1b3lx7{1f*R&5-$R)5au!csSTukk4~*x*yVJ+4Bm-iDjI@Ocm+9C8V`+x>)_=;#7i4Y2dj=z4>LichxSRXjCjiSDjYrfrYj-Ov}b}lcC?OPSArn? z!ZmOoh*t^*?o@)A^+{Of9HR38fO!?Eq&%oj8Ue4bJ`;tP0cUA z;2)Vvn}aF2CE)NirhpkDJjpRc%9{=K2tl5{stP~?Pd~r7#Y3iAMP-e~<#m!Cd!+lq zAB8Wl3`mWt-I2P#4mpWxYHFZNoUC6axrVCl+(SJYp-YvxFc_^$lP!BUEiG-tVvmwR zUf-S9bzZQq*?<^RU9*f$+Jf>Ac0ESZy$qOWWmQ#jKbRxPCCW-Hy+D!l8{I95e|9#u z)GxN~J{xD`h8kHzwhE|Jb@TSYlatqScVCSc5eC`(<(2e1l?19nN)rz!{0x1)wD+E_ z7zHY=P%X<+|Ad^J`ty8A$$C^rW7*1o^0Yzl18URP#p|jS zF|?VCl+F;8O38H})l|9~+Kyv#=gytz!eWC7W`yUonu_eU^zJILnbC^@YkgM4R)oox z?vMI+X&1Rnu8`Qn!6Cg&LcBPKASg}mPKBu32dPbR^U3&vN#AK5_W5D;W99e#YI#2D z#`_t$T2D4KG&DyXd*5)_JZC>0G#CU1^DJ&(d6Cxr}SYDf5V$+CXEiNAEMBkvC<_V-qA8Y^ESmaAa}Enzfj;G+$LE zprN8XR@b8gj-|YKfQ-DEQO}usE>G}jw07x+%m28(&xX8t=7;||ni&uZNU+#J^*HqV zx8{o?Hi%Q6Z3Ww!B0smI$lh~-0F!G=+rtU~DbV%TNOqPwIMHH1%q=g`zOB7zLy@BE z^Xf#&NiD4pc_OOPdF;I3Z9~L5ySjEV+kd;h4#VM>uV16CgBc60tztG*3@#D<7^t|t z0-E%-loEff-@HMyi(4&+ajm?(ynY$Sd*Hr^ci`F&`ULFJ-Me>h+@Ll}uh~{QeqkN2 zh0oN$_-BS}+Myaq)eKi3c}0YZ7KO(vsPG#P(eo;pg~Cb;Qn7sGlt%hR?O?sJD~7{T zdU|XEu70~yhnvju_Fg8J1qjGYmhfRU6HDpRf|R{EDV7xXA7#AQLo?&EQ)$#q>N&U^ zGsrO7PVzra$Q^g5F93^KRX4J85~ypyaW?69e zuHJH*Dnq{nf4xw&O$z+z_yNzuBEhVpja4N3^j%Fm=TDS5@MHBn@ba=rpS9!uTi+m8p0!Bu#p)MZw|eSs z#sm74$?!*46A@fWDbGwuU!*i7XwIPkFTv-$*Ag3QaDG z*}C2Sf>JCSy>SCi<+ruCivo~=lb7eDqoaehR30OPgGdOx;pT=36mj3aY7M{GmJlFW zKww5~VQc$}9eN0Juo;>X7B2Bck~s?!yZ~k;Et;@c=O?Du^Dgh-2o@&>kjW=NS7ES- z-1o#jc-dtAHkBO)&H5AYzQ4K4d{RL{TXm0O)SMK@xM(*XAQpel_A6bccXs^SnKU&x*YVqv>gg~^j z6U`>5o3jUZW+<7sUs4faZ}a#kQ;U_e4?7j#yg4c@1HreMe;9zL`r|`&0EE>45=}Tj2#gFLcDg%K$R0 z4V8@)%!a5W^$kdu(Wvxhm5K|2V^wP2CdmtHqy)Cutcs+g`im1#PM+mZbQDU+%7Hp{ zTcjTQQ?W#f`ugtN5|R4Am%`z6IYk3z(#WNZzYP+z<8MK~VYCvaW)5hpk4Q?U@Z~+h z+rv(%KTtbSPGi-o75y@h_4TEHs=sAY@pG~4zh>&F+9OCu@vdUAl*1r1GZs3t+ExEU z(BsyXaZjHepHX~RMVCE&Z_6Qru`N|XoLT}ZU&GW=#CcZ@x*183HxoDXe9s+SaOQ7* z>}p*f-iK=hkpD%N}~%xA3lW3QA(O|Cmrqb<>wAcv)UTTp>aX(i=?gop+m0# zjM?H@x?ZL9%~3JkN1)Q2GF=I)qHVympB` z8jzM{0J#*MD4Epw{dE`KXhpIdgdHbS$pMJUg1}U#?An95_okV9plV`)G6k(!4nI+o zE!a3V`H-LO?f&=fDX6Nxae;RbYL;e=(*!@FLmY>5@TP}h=pn@eyvs#-RL)(8!5LAK z<>&cMQ0F1Z)sQy>DF_c9z~Rrr($_f=5`#%7KmUNV(-`kW_{Qq6+H;tru3x_n4E3`N zk_iBzrV$_?ue7n(FYd?2D|*eIz8s&%ikRWS3i-gwJ9~_+R>v)XZt=95TG7_q2?@Q> zL8w2JdnwNUCI_tu+H--%FE7!F7-2O0Da%xT-?qf_466?Aknz~e^yU!@VIzUGy;sl{IrKce-!7AuYK zt5dhT7|o+-J5VYFMJ6wTNSf$J*Aw*2h=lR&n>TO5)uR3;{N{E7bx`yES}hrW-q-($ z2dS>Ed*$GQ{|eT+{RSHusl^{mjNB;e9{-tAh5{6HNiW4>L+sA2ThAeP$Xq#(QrXY{ zevrqz5DoVInJbxkUt%jBW#}n*a|XSbV&Si)rOmxE6wUN`H_!~)jjK3* zpCC+=+C7rgW+^V=tG6B{^X|O-d_k(Dj_nO}<-`)j_YZa}isDa0a;d10fIs~;!MB?jVLxR+K!$c8-#m6~3B%~bmQ-up z&uresXxsc+sK9a~0F&@Qj6!6jaWCWAy8l8JX+3`S%m53-08@fN#GJ{+E+~JP`~I{v zz+bT;FQ!k#wdv<1*4UHc(_kgWAORP+kbuB;Bqy!4hs7KZ0)dDl{@DC#!YW)19bUf%CLAOX%1f?wDlVkBtg@zyELTKl1Ih6#{4h{^giFQ6&;Yd;A%;==Hn4jMdLRKucsRAiIX`xVD+;k2V6b0!p_d5 zg#DDMP`5MM=%2n-9p=MEd2Y~n1>Wlj6Za%?(V6Q72&y|#x%F4@& zH}2r(zN7#BUyPHWCt=r3bN4mUi&I&k@h6AmXQeD?TKB-m=kU5@V6q4%JngapEI2}S zA+@+byu13<`n6$*(&}!=Ik~LUmzHhu*pS8EKUi1%`6s%so*ePO?2haaVklbEgAt_g z%^R3__K1pRCnnx2f(`}~k#0(WhOvrv&qPoqBu^6K3Rj(Ol<le%-qE+2{decFevQiGJH>_*BB1diOeoo-%laS!C0{ z_`x(+R=k{y<}XVNwglx4=ciJUh6(La>z9JwFENXp57UTy5o?QR^8cUzlY-~Y4@QDC zGig=B{0Tqv#_M%$-M0SN{At0*HGykfCM?D&vr^DEo!WJhy)zC{A9;DEq9hvHHxn=5 z+^ox1Dn2dUDaU*xx3GIoZ$tY`?}w8%ly@&lygO1p|0%AC=C^}b7yG@@Kq}E`koSjp zB#-EO;#WMK{S{Sb4!0VTNK!mfhYuE+_pYlt>=b#5?L-nZUXvvp3i&;7!#crC+aZi=2Wx z7LT;g5|n_s*5lJA{xNOB6(RoRYtP;(BoejjUvHYYgD>KSr2JlDZ_!*ip&`l9tf6d< zSn!AZ;jf#T;6w@Xz=lL1)mJu5!n#u?63dht%ye& zn%tPuM_TG!;mv-^iqcv0)d6pB*W2vWn|)Z~gsj2pMyDCE1aZvm_*?z_3c{F4nU4Tu zD6goHyv?+lk#QJ6DtVDWt!SWo=`wohPyYe$o8S3*>4jRm>Bs@CJXAQK^E#*gsoX*A zZO>Uu!0(=ep*A7Yb_lh{et=NB9^u_TzOZEqyVWTJ6vpiO{n_rlk0yxgzCCQuO|uYj zCr7l70OEFeVyRUtx~moe7(C=xYdHbqhO`EzD}-t__d1U3>tbD#Y%9nR$Z!}OMyksb zpAl&BP0Y;1p`ebt`yDH2(&Kru>KEBMTvG$#*>T; zAr6kt!gXiDoTA>h@Lcekuy`vAMvWgax_39YF3KYAk5f=WY(~k2^0&Fqy1`Z-p(gfb zND^+yu@gvnMg;vs1#hmbJ#Yc_3Wqet5O^_y`1NVI4M(rWlJWa*Gw(}(^eDg1e;T@@ z{h;+WZzhte!FtEiat9F$!%OHz%CIf#IGZ=NDrq>}n3JLetY&7;LA0-KKNI_AdB9NI zUMP7_Th|}C4!y3s8E0m+)L%&ca+b=ja1C_DUn}bCbL_{=vvz7KoB;7n_0C`GdT43e zu88e9qixi2PvFCjKb5J|b5gS+@%xJvM<$AJu}F2H9PL}N322kpl|7zHrjXtZAja{b zp!nGLH5}Nr5F~uDiPUrXmhZhTMNtLuh=^{npF z;2r$@Dc~nfqCX`5yJc#N>QuTuhazkuP=sdb%Hk?BZw2bQ+S=k0ol_Eh5JrM|$;Liq z_mtr^9KUHJEi7jsFALz!VY{3@y`lw8zO&zf$(7;Qcz*t!A9w8Wbx*z(lpK9Jb*|~a?{m~| zs34(ajGZ^MTJm<@WdFOLeXg+As%hCCi7g8jwZ&L7g*EiP%}=I7??AXyu~g$B2eF?D z2o^UlZ#x5g07k~f8e=f-K;)s{iclH_>f)GNKSZJRX$_3#$2L5SsVU}wk<3D(_p2Bf z8lKhF+uZ@xAH7=`>9BKc(M-F}mQn6bz> zRAHe5c7yFUC~m7I)`fX_(XU#SzoDh8>m6O#_g+8*<9)}SByCyD1R={id#S6}?xuWJ z%!dO};%9Oc3c8ALCk!krkKizE71Y=QmKg2kSv)9@N3q?Fk%@_YNVKqUxT2dpD(`D* z5~=6l3s4~_Ey#`nD)6ooh=Se(soY>~VPS-rkL%f$oIRY-G1!G|Ih!&?dDpCaFK!kT z90oiFM_DR+^N`_Ai5=epr}P~p$V;k3s<-@>v&GU)JGLDc%|*kA&x=gwcykCV129rd zKnQtVQu#s%H>Q%=PSnR7%~aoB27vX%1_6v@$x9x;k4;LtZ)X0BtT15h5LD5Bq!%P& zEBI~_HVISY#iLR>i2wCMdKuH!4^nF@RG?FL)bL+2QK&wbR&qBk6T(F z8+Hnhf36#`-6j2bH0udPm2ihgw%8czj~T@;XxBx`mh)yGu+{pl80`}c>Rf?|3)Jo8 z*+q^%(Yew5JGZX0iwMn-GSKbMUqqLf%;ZnrTYpYLVU-=pwa|6~hea`~+yg-qO)V`g zSXvGpS|p&A9k1t*?%}__#Gx>KH<4zM^xcc?{`>dup*$-ecT=S$a**ae>9I6yY%B~N zIVL3qVN9CxK?|jq!^0L#ffK4jmTxII3ZZ#eG%>uZYmJL!VpS&X<9XU0y!i-By6Z=h z$r*W5-BnrQeaTkoXu?lu5@E8MWouy~*vpG~4|JON)L=zhF7J{jB7dp8td{7SL!`J~ z!07X=n$&b`^@gKX)S3)jnyKuVV>vjC0H{u~t2lI|+IutVeWrf*0%gJH2F$Kmh)O8h zuISKTsdnZL^FF^RiTapcnJ3U?cQ7*YYQ1+d)|%xo?nLhA0)FoGtdJV&m3`apul%b`!$4;V|Ebv8kfs z)mGfceoiOJo!0(k*~v4S#xIys&(A*_zjawF96i(F`i7tl<%_^b@?Y;Mu-hsya z6?t}p@zyu?$vBulBuU(}RzLF2)7oI{o7KqGd$)6@M>L%_zFt$WwF7)9TFC)& zE6r3!ufEjwgLxk-z7kzJY-kD5R{Pjzv|0O)uGjThsklGs$HV5_G@6Ot?kyu9^Lp<} zPxUy7^V{u>Ob}C7TS%%|1jQFxP3KQR4g=(``)5j2nQ2@q=&sdSvk&|KbfB9Rgsioj z{<8($wKkn>WA|39_sIF435{~J=k8^8U~7n0cDB!6;Yey3op||5=zbN;{57tByZ z{LLb5sO(=h(d@dJH{;-WBC32NGd=zUF&*eu(M5m1pufB7Onb7Ot+1Gi_PE8CK&uO? zB(ecd=&GOXgRCch!|VQZj*_|qf@SAYTryez^-aGOpslV>`L&bXEN{E)rrv)2x^LUI z^AJzT%E~G-qm?{WXtI$yq_B03%M{t0cyH2+GJsKz~D(Xej7L|&%NRw9D z&y}QCFU#=Sof{C!y#+~k!0~1|7QKVg_OmQYt=@kDjhfM%%7SY_S}8m<=H`6z{whOJ z60>HQ)>;^~fory0QoSd*LpA_G5|@#3psCD-bU+|Lid0&UL_@yJz>rRyF6BI$ixjp7 zjw@`fj@5X@nfPY57b{eORt>s*xC&L2l)SyYU%5o@ON&%X>V)B#_-q~t5%^NC_)YdH z#c{@`9S7gPV38;HFG5&XBN-tpc$)Kp1`37_$NvZjZDokBmRW^ z7R$AsF}LUKE;OwOG}ebizX9=y|q|CscWdd35ZDI?+uSb>Bw>5mNZxF%%*; z7rSWs^@8v>dP#b^UrNn(}^Ur&G?(q&xZe`X)V^zqD`Kt~E^uP4oX&R6{35!9h}{W48TR=Rd8yrPuW& zf&7M3IkzYCZLwMQ_c8jez$q?m>T}y^nwNY8@Y6NYt8N1&G=Yl%puodHa(fO;M3Ubx zZ$Q4HfyKNm*J*lW>Z&2W%~_xLSV{SDeL^A)>jiUax=hE-oDM8w#NN(ZloR~onZ~JJ zeY>fdU~b`2Cp)*&XSO{~(N*1#_$F3Rm#{y*5R^QJFU6fUHks+a_0r2ZRVVZ{DqB&( z+t{h6`pwwRN#099UD^(F%6FMflk3EJX7={o&v58{+*)+?-bCUgY1ank$;OWz#-2K5 zGepV{Wis${or%mim<>S7vo~|$u2t`r7PJs+PFYBV9@@9SsjsD9ygp--Q{$riy|Kra zge;uL5CQa*<{8tHvd&vbTy*-gj!{a?-a!?XU`wekn@Q<42S4m@1_;);faljkv&R_zWO>=^>hf+D_INS%$G{yjGsloU z{t9&<{4|Fk=W};y2CP8ftWi|m9)Y+}SRq=@%*aSuPOfb%2J`it-d+@Xdow^pAh*lgz#9Wn zi`UAL_Hc(mk=Q&Coxj|tNNEBZ*J6}EwJ%4ENk-?DSdG312pHQ?RoO^fM|x4xb7XVX zAXFC%u0h$Do13ds3Xzex|AK(-6GLICJKs#$3KP)f1D^#4$}k}2H#n_2vHuDo9a#S_ zT>!=&0tw&?zNViPJ+6G!{E}+V&!4IGo)Q+`hO;CNSKG(`>spv;70`YEu8N6!pQ9Es z->7NWba4%5=^CknC6W}z-|#;9+?5$?kbzu0EHYFfh0(KvxFdziS*v*>abR?OT$}^0i5jkPWB`&RUCT)1uu;inwXOF;ibSS8#5HM9N z<>s_m`fRH@ ze$uY)-ViRtjVHf&r~t}E$XeHMh1dRa(nvjuU;fKQmQoft`gYGM*yheoDgI(iouVOA zGr9a1-sFaE&*2|zls+1+^KHSE>oa#2{&GQ*NRr>oEPrkc8BFgL10&VTEXcf^K$YdM z5}d$|-szE)oaq_4u9cH+Gb@HdC(+wB6%%F0^OHkTH}6c@xP$l$|43cd`XN>t7fNZx z*C;h6BqB$5#!g=@N&X*haoVH0XDKVISO4Zd@OI?QTx}Y2dP92)`~Q9)i$YbXND~^N zQUSw$4qoYNQB5t2$D3$KhhPPx{Cel<_uB%TsyF3V4C&+jAN==7Nfgidy8IVG^1rc! z{r@m79S{8dD`-etwG5ykO3^E&zudsGBkf^ml~jAi_ps&YPgl?q{K_w>;g!ozT=!>j zhxn3(qtgV-UU6DlTHXd6lAAkSHI-4&mPV~dR=T|7v;o=d{6!`cwgpY|_O+kqNe48eDmjzDnF(rQ3Y0mx^2RKs7a4^zL9*Vg&jAsZOIv#k(fl~?*ZyU%t-U4Yux-1%{Qziu@XrodqGoFk z`!SLZSQ0XwW*ptgvs9(Ht5?i*4PknHV*|&HZ%re0ikuTR%u-q9FRx_ zyS6E(64OU-Ru>P)@n8`Z`*V+fxgtc7fe0yITds^nEG+|!pwM>JS5>{C3nP+$*cCB) z1qU-TG3}jg5nMBu@xzo>hSe zCLCixbRm*ifAsds=V)THmW!gR?ZE-+!ezhsm7|qkf8GPZ^5Dt@g^s^_4h zMs|soS024e@A+c&$oaD43!6U8-A#{zxigpUe7Hu4S1bG2n3$*1WrlwdBK+$_FE-@^ z2mk&f4i*=Cgi7(8q)0ste@mKdetA=h+7S&jXXsAFw!kuibm?Ty7yClIPC?6gi>TH*H^`#4)pW8j8MKg zAH-=)%J+PID{E?wEj31_#hE6J^HCLsh7_BwU~? zChMhM=re=6LMb#2#AZonZv%Z9QwiTD#T#M?o=i?-t^T#HivijqbJSfubf0a1Sn>Js zt}`IjrK zG|1gKtJ|^dZ%s)`KSYb_ued&~e=YOu!zyOx(}cy)l6NwT=yw=3V~-nCYYLP1!feME zAhh>F&8|z`XTvi(R%M+j`C_ZfQhmYeSQh1@togZy0s68Y4Iu*9YudJ9=hKO%;x&!u z!9WhgoSEvx^sbWzS12BQn8!S(!;@RTp_yA6eu>Z?y85v=O1iJivTj&2m`}e(4VO8|Bj9#otb{QHJ~P;fsnHto-DLKe*AXp1k2B{Wp~dE zA`~XOJ;d(416^p4sI3WtA^Sa~|e^xnGPj)?|6Hy=MgMMg(#EY^~&+!pBXC#Z7zY>K>c z*z!v()?0}eE%yX7=RL8q*U!ATZ`tp zS=cVduEto#CD;av(H5A!rsf9EYd3E6H0I^Kco8V)g{{V%GCOv%vp;&uUQSWZe8}@j z&&>__Kt_K29sz;0j0{$+g}_G2b1%Z=6oR)PxDvp`lVGgW$yB*sbL&0>sEi>%7HqNK3v#5rrzirGlT%E_eBH z-wRR~-sEr*3A!)Rdc==|*anQRNCvwdh)t6W^Fb7#0@5L4O!sFLg!r*P`Pk@N5W)~X z?ngK%i!kT{Y$$+{z>xd!J9^?nK=4HO9ZEMA$%cebkoeTX2%U%)wI3y8t@=Qfd$mAJ z*@5-lzflgx3tA^c;-U+(A7vfXdNgPa3m|w+y^}fITH~NHV7>*-w4bxEPAq_Sxj+;0%ggv5^LR_V znB(~Q+XvzolX?nF^yx|Z^VcrLgetwVGJ@Vn~I zpSM+>AYfgtjeanz>zA=m*5qo_34bGzx%{Lo#8C^Izqm3$;s^ct4B1WmcG(FCfnn{GTF0K;*NSzx+nA?re(xS2^Q4*3mo9^Jns=V28HD;lqay9LUG23fK(Q ziI|ta1d7el2U7N{u>Z>$u-rU*1Lx<;N?ojl90S0MPd*4zei??aJyYo0@#vJtnW=cv$zu2-;*@!u3-Sgp9SeZja zom&yY$D{p1tDY_NtT-XqsLmv0dg|=iZ#c7F&%%BU=6A zvWhMn8*-t`ewLdmW3V0D3L0v=l-WPe>yai&ba;=#9xW$wmB9E= z4yd4udxJ3iZMw^6Slal}BM=THnA3Hx-MV{s|6I;S-&5tG@QQxf;YnBBpbvStHRltE z`kw1v9m4`Pu11+8h$PKKRT9T?X%2a~Az~2e1j({{C}7O!lvU3>$B0p`&(SRY zw@}!H+Um|!_D=ViNN6vHiw04?;l<~l*k1wX%Ehi*3}R?jQ~pOT#~;+J``uQe9#*l; zYTA=eo!A7Ix}e}?%*KRpSmNC>t%XL^;l0r6`gMLZI$N8pyT##IzWB1%$`LU&^q!WR zx#>nn&M;#elK5g?j-5LnirOY4x&myEhQ@k4w4Xz?e6KuBPiJ&GNgO_#KKL4Y5>xM3 zLY2?rspj%fj_(enqh9cT`7`!3VVofru+5#B%d1$bHNSRE+m#h8rDL$0>1sI3pGYQ- zO42TugQx9IL7-P=Zay;JXt#M=i%F=HgY{uPV8z5g>TiQ-l9gG^lXvcVJv#GqqTS9T zr{@j!+M9aNhQu#oV)}h_9OS%{09xrzH!>P;K$3?J<(%G@R;KK4+yx!t9}iN<6m4I zPMuV8__j~CScW_TR+NnsRXq2PB%?sGbtwfRzMVfbrx@I|kg}`K{v?*&I)|;TGd2m(2c9NY7Lb}Qusrl? z==t(WkE;Fe_+jtGG^FVwgn%><{k!v z_6pjtah^nM7*?N--v4(3pK8Qsf=kN|NL|qssQk!x1;JTjy`L1rF)+Fi?QkkBf&_mo z{_6TaYs^uKA}LU1rD}aFTl8eP3@@Y}>7XBIRPI0-#9=oP4&3AJzMey zUjM7rdRN7QO9(rjmy6GVnHKIFm_zn+$+Z%)P@`r|iMpTir?Pn%47~qWZ&w}<^&0Mn zoM>StS)v+SyO0XmWnWrImaJt1+VPB2?+*c-Vhfz5SX>y%Y0Z45OoI^4meGx2#MaCtyXkj2D zT4UfM6j~Kwwy$mHr)GLnF(@-Q>3a%AT-=!d&*+hc^a?25Lmk)$b_GVaRny@;B-~Sc z$YG(OEX%1_23MBWGmMY?Hulu>xaTsra-!CO_16JWGl_{>^Ebu7;qmnH0tOXuO%kg! zs$@W#c6j1!rBUpi@JZ-UK3Plmy>t~kZ`L!vN|OVqwbJDJ`gJyxF!p?ruttnBadGM> z4*Sg@avu3dh+O&Yo$m(9MtW;6lM%7pe=v3h+`|A!xF8E6n`tfGno@mkA%v9QfWMnn-8z}|yia`6FhIYKGuXD;*D zsX&v!nH3FT6it%lZ!r|ufH&?eB>fpNC`?8a#ZL8wt!6$bkoRXtR?}j(0>VaQj_Sh6 z^p`K%UbEKk*nSbpmZi&vdou)hf|ja_Ld3rmb7U`%%fr)(|I)Fe+iBNrPJM3QS7`&Q z-s5TB8X18KK@>>+_WS+wdld;H<=s3o6z3jQnmYC(!#bAdCv5z3YX4@0E*-Q4zETsK zBmWIAPWK!Lgz&nXiP*H^V|Hy{0}+9#`#(pe|8j;K>FwF82Nu8at=b=d_{Vl0!EuBH zA73iq#^Wt~wYnL8PgjIRynU@6*#@CNh&52P0K*797&t>d%1zTbavrNee%^dZYMx@Q za>#M5iYay!BSVamwi3q`CA}&}#y`W~@>ykswA9Zwn(3Kdwa-?r#-X0yH{PsWfs?q) zA}Hu0=pHL|d-HDA;(=BU7At*=iL*-Wlq}9Yu-kB zsB|d);Q6V(sK!_R#yBu*qw-l zR7{Bo7YQJMAX3G#nj;og)}j_Y|B=Rqz)KekR$U37ziX-Z5yq<<)xcr2VJYS=^n#(kr^8e0|$I9PU761DyX=J3Ao8HDwi--?9xV z9_iSdIPsNcY+=M+dag?eX2Eyi#?L{h&OXnJM0E)v+=h6yKm@h5C*Sc^lir03f{vd{ zPe*tz!l~5+??mvTn0!&st8W-T0g3Lj@=;Gj#u`#3-S}fbK2fsRv8~bPuL&m=DR$5& zydQh!q=Qv@bEklv8M9*Wk`NPvz~INIwVQFD-KWQ01;s@WzB2R*v<6m!PTbM#3nqb6 z?+*ggzUHd(tMtwV*Agq~HWnonQkSZncQUgI2P0(zH48dZ3 z!qObYk@h|fl&I%{sXJV*LjkQg#gO_xFq3js1|Uf}Sie8FfD7mygzqAqXOuD;4nQ0C6UhJYaRfXb4l#5p4fC(8HIA#oo;@+7m%N!4?R@>}6%Ek(dZJHP3g#^90Q(P< zG21bYn>ylff^ruWYyjw#E8(Rqx4`iEBE0{LO)n&sU84|H=AlAi7*4v<7=*aHI_c>j zX%9P4l?5sUVBro;?M$aZf-3D2a4!J^S!&-Tn0_J2VciTyYudna94>98Ga}&l4k}|N z#XBgF_5~;~9WntJ3La+dDbx#~`htm+1&}1P7=lZmI70EY|I%J`!D0q9ROqcn7jPYT zXJN_ya;CJ?fc=K57J#yr=EsRpe@gF;k?VxM8KOlmK||5#%k}0lu8hn~u#U#0#AT;S z^NxTM7C8+U)f0hc0YcvPSmUjeU}E$ISXl6H8im)FdR27QtM44)mkVit2?%M}uOmg@t^W1ok%gOdqmsBdLoUq#tif(40nhVRN zRl6K*B8kttAKzG4cQ;_CWpam9v=vV$IafD+)GlojXkFz1`2v zqKUhToOW$0AtYGEUY&gbNb7e~8S0}e!?^`zUKD!Q>Py$!wCYVy!fSypjsB&NyRTBb zvRz^!#1>5G5`rcX(HdyIU*ox_bD_}ZD_BX;PJBj7$%Unk+$(d@W}B4@G=-;rEda7w z$Yxd<_x{j14ANS~q|oYi7QGB@8|j1T37F@BzQGFqFR5qLpw44+&I*)G#nZ454_I-E z_B<>cd2DN4ulSLJiAmIep2me}mk%lOoms^rHnFWDCS})u z09SE9r(VIa)DhYm(aY0fVlZ1-r!Xf8wIHS4pGnC*U6MDp;22s`_TriZ#6#rJ~aN>)@tA|Cf~ypi8=6T}EYWd+~QVtQ{d$B9|ylTL|sjR;JOu-icx z2D-G*npMdC5GF>8LDY5h1@8%r z%U3}n9Ifeo!it94`bM4+<*gc%z%H#0%6EV~w99XE_`sg`J(7HO+)|<my87FU<7~6qi(B>tETwf>IGm2`J5{I4%cs{GYSlzH){{A z4~@W#xP^fK5G5L842UthL(GzQhqDv?qY@<=2nDk65#b;(F(p*?@ zrN>#p=Iqg)$zykc>7nb_k47-6R5neXB}KcIA9C#Mwqy>|;G|E91%1HVR~H_=u9G4g z%&;*af_VkuSG(dHlRB5Fj*ceCpz@|vs@v3!RwE{ z5zwptwKSAJc&z0Kv*0o40gx2^eZ#1KqrYMV!c*X{mmIn;s}#B^B?tbcW9~GE9iCsv@zBR?aTlEpTzd6!2r@h?F1M9R%oO){sxOWRsA9!0FD3S1>z-j)=uF zvGs?|jcu0~cGNcuIn&@C#pE~K4SGj5c3!??gjKnqz<9amL93=8R?5HKNvSCuBzJfs z6l}QVZ3wP?Ej%X<%zlq<%DZ&${(X{=MmJb_#~M){*3q}h_pAF{8Mny|9UBxrqR`M7 zs2wr)PW6) zo~M|4PLfkAsZ${(jzO}nmtCw2%ui-rb328EIrG>x9i<>Mj8)uI8MIn1IH2HrT_uoq zbh21dDz_e1?M1ff(q=yWQ(OVZ6!*)Uy({1R@IgOX9eO>4;GORcT1{G zJaP47RNzS~>cVo#yN27Z89z!#EJ7b+5bjMF5&l{;*ZXGW&fd;Lc!2LL3?_b=%A!&) z0f#%}J5q}KDdLg)17a-g!CSTfUA_dt+EcEVOMLjD*&ngge$r*Wt3{)dBjCC0r~Idq z^fj^bUe`BrwPM)stUS%*leK&oyeno&I__>0bwcycj3*uIr*~DCj3E5$q&oZ$T{1Iw-oBNx-L!)h!s|nw9GoKY<>ykml3;3OyUf7OCB1uKSs|0@Il=`> zD}Y4D)s+>PEt-wFqdTW~i0%VjSKckD^e`qK+2esxA&_VZUe&Qy$gjsT>04RDil}aR@f7QL`!FIaEp_dEI`ECA_%@2A z=ZTNw-0625mYGLknkl989BKz_yfg^wn+CZ9<2Z9^nqkxL%PZrV4^4BNKS)IKN?h!T zHT-!?INkcy$4T*aHbpr{=X;OD9gwUdPAw-l@#S;E`oRURy@p)auP4(nJhqV-qx);- zqm6(iv{T$EG6+8RJ7{iE{|@4+NR+&!S5KuuyeKDHk=8KYUNMxSU~=;AZoYt-o@XW! z9~+YO4Dle|E;3Fex=!>4n(V%0a~3u*Qo;DiifWwR`a%Jv;1mqz1sh*rK^nP5tkPIE zkh%i8nVV|zc_S&~K}3&pjUTIsMNieSx%4^NGw70``1H97-v?xay@mQEkFVusA=@E( z5hJKaO%Hjm3>&RNMvPQ^?VcAU#vFoLymPpkDy@5--4y@It^GMIQHtpBdwOf0iG&z5 zQH6ri2j}&n^bk(W_hGS~-(B^stXg2l>u1ui)E&crCPYvko=64h&*%lCXAv~l67Ynv z@2JmaYB{{VhYYB+%-Y_UXsf7~s51*1+cC1f3bEh&bm`aqSo_KlmiQ6lX(?2-L>1IT6J(75=6tNabsGx=*l2Ex@ z*eEX=v{C?pPejp=fofsPy7#Fvvg2Qz+|tTK2^cSP=3W&A+}f0kGg+@q$;EB`@YsdO z<0Jw$=h36fz~2ElktMq#c{mN3b`Xk8zN?6ZSeWEZ8*}wD*m=JF_!yxUvL33HMbL@H zjoR#kYU4EG4nWC69=Uay`E>yqEx!k4jM^56p5}!a-tvjc%2dw(Eya(6n;VY%I3YE1 z(Q$N@XLYL@pXzyF%*@ajCUReDAeouCs&1y%zWU=Z!k+PD(55${buWj|g8DmZL+@w6 zD0SpQM{v2}3ZW@Uvfk&$`4B{$-;Ar$<rVwbC7=Jt@zLYiwet)7%-RMk0{#uZU1fN><(qUqqv8<#vzFR9)qLg4H~#}> Cclcib literal 0 HcmV?d00001 diff --git a/Attestation/Protocol-Two-Messages.puml b/Attestation/Protocol-Two-Messages.puml new file mode 100644 index 0000000..05d20f2 --- /dev/null +++ b/Attestation/Protocol-Two-Messages.puml @@ -0,0 +1,18 @@ +@startuml +participant TPM as T +participant Client as C +participant Server as S +participant ServerSimTPM as ST +title Two-message (one round trip) attestation protocol +C -> C: timestamp = gettimeofday(); +C --> T: TPM2_Quote(AK, set-of-all-PCRs, timestamp) +T --> C: quote=Signed_AK({hash-of-PCRs, misc, timestamp}) +C -> S: [ID], EKpub, [EKcert], AKpub,\nPCRs, eventlog, timestamp, quote +S -> S: check that timestamp is recent;\ndata = Lookup(EKpub, [EKcert], [ID]);\n[Validate(EKcert)];\ncompute PCRs hash from eventlog and PCRs;\nvalidate quote;\nsession_key = genkey();\nAKcert = CA_Certify(AKpub, data.ID, AKtbscert);\nstuff = Encrypt_session_key({AKcert,\n\t\t\t\t\tdata.for_client}) +S --> ST: TPM2_MakeCredential(EKpub, AKpub, session_key) +ST --> S: credentialBlob, secret +S -> C: credentialBlob, secret, stuff +C --> T: TPM2_ActivateCredential(AKhandle, EKhandle,\n\t\t\t\t\tcredentialBlob, secret) +T --> C: certInfo = session_key +C -> C: {AKcert, secrets} =\n\t\tDecrypt_session_key(stuff); +@enduml diff --git a/Attestation/README.md b/Attestation/README.md index 0f214ec..0a6691b 100644 --- a/Attestation/README.md +++ b/Attestation/README.md @@ -12,29 +12,55 @@ A computer can use a TPM to demonstrate: Possible outputs of succesful attestation: - - encrypted filesystems getting unlocked with the help of an - attestation server + - authorize client to join its network - - other secrets (e.g., credentials for various authentication systems) + - delivery of configuration metadata to the client - - issuance of X.509 certificate(s) for TPM-resident public keys + - unlocking of storage / filesystems on the client - For servers these certificates would have `dNSName` subject - alternative names (SANs). + - delivery of various secrets, such credentials for various authentication systems: - For a user device such a certificate might have a subject name and/or - SANs identifying the user. + - issuance of X.509 certificate(s) for TPM-resident attestaion + public keys + + For servers these certificates would have `dNSName` subject + alternative names (SANs). + + For a user device such a certificate might have a subject name + and/or SANs identifying the user or device. + + - issuance of non-PKIX certificates (e.g., OpenSSH-style certificates) + + - issuance of Kerberos host-based service principal long-term keys + ("keytabs") + + - service account tokens + + - etc. + + - client state tracking + + - etc. Possible outputs of unsuccessful attestation: - alerting - diagnostics (e.g., which PCR extensions in the PCR quote and eventlog - are not recognized) + are not recognized, which then might be used to determine what + firmware / OS updates a client has installed, or that it has been + compromised) + +In this tutorial we'll focus on attestion of servers in an enterprise +environment. However, the concepts described here are applicable to +other environments, such as IoTs and personal devices, where the +attestation database could be hosted on a user's personal devices for +use in joining new devices to the user's set of devices, or for joining +new IoTs to the user's SOHO network. # Attestation Protocols -Attestation is done by a computer with a TPM interacting with an +Attestation is done by a client computer with a TPM interacting with an attestation service over a network. This requires a network protocol for attestation. @@ -91,6 +117,27 @@ EKpub and AKpub will happen via [`TPM2_MakeCredential()`](TPM2_MakeCredential.md) / [`TPM2_ActivateCredential()`](TPM2_ActivateCredential.md). +Note that the [`TPM2_Quote()`](TPM2_Quote.md) function produces a signed +message -- signed with a TPM-resident AK named by the caller (and to +which they have access), which would be the AK used in the attestation +protocol. + +The output of [`TPM2_Quote()`](TPM2_Quote.md) might be the only part of +a client's messages to the attestation service that include a signature +made with the AK, but integrity protection of everything else can be +implied (e.g., the eventlog and PCR values are used to reconstruct the +PCR digest signed in the quote). `TPM2_Quote()` signs more than just a +digest of the selected PCRs. `TPM2_Quote()` signs all of: + + - digest of selected PCRs + - caller-provided extra data (e.g., a cookie/nonce/timestamp/...), + - the TPM's firmware version number, + - `clock` (the TPM's time since startup), + - `resetCount` (an indirect indicator of reboots), + - `restartCount` (an indirect indicator of suspend/resume events) + - and `safe` (a boolean indicating whether the `clock` might have ever + gone backwards). + ## Binding of Other Keys to EKpub The semantics of [`TPM2_MakeCredential()`](TPM2_MakeCredential.md) / @@ -143,7 +190,9 @@ Let's start with few observations and security considerations: - Some replay protection or freshness indication for client requests is needed. A stateful method of doing this is to use a server-generated - nonce. A stateless method is to use a timestamp. + nonce (as an encrypted state cookie embedding a timestamp). A + stateless method is to use a timestamp and reject requests with old + timestamps. - Replay protection of server to client responses is mostly either not needed or implicitly provided by [`TPM2_MakeCredential()`](TMP2_MakeCredential.md) @@ -176,6 +225,33 @@ Let's start with few observations and security considerations: have to be sent may not fit on a URI local part or URI query parameters, therefore HTTP `POST` is the better option. +### Error Cases Not Shown + +Note that error cases are not shown in the protocols described below. + +Naturally, in case of error the attestation server will send a suitable +error message back to the client. + +### Databases, Log Sinks, and Dashboarding / Alerting Systems Not Shown + +In order to simplify the protocol diagrams below, interactions with +databases, log sinks, and alerting systems are not shown. + +A typical attestation service will, however, have interactions with +those components, some or all of which might even be remote: + + - attestation database + - log sinks + - dashboarding / alerting + +If an attestation service must be on the critical path for booting an +entire datacenter, it may be desirable for the attestation service to be +able to run with no remote dependencies, at least for some time. This +means, for example, that the attestation database should be locally +available and replicated/synchronized only during normal operation. It +also means that there should be a local log sink that can be sent to +upstream collectors during normal operation. + ### Single Round Trip Attestation Protocol Patterns An attestation protocol need not complete proof-of-possession @@ -195,11 +271,13 @@ protocol: ``` - CS0: Signed_AK({timestamp, [ID], EKpub, [EKcert], - AKpub, PCR_quote, eventlog}) + CS0: [ID], EKpub, [EKcert], AKpub, PCRs, eventlog, timestamp, + TPM2_Quote(AK, PCRs, extra_data)=Signed_AK({hash-of-PCRs, misc, extra_data}) SC0: {TPM2_MakeCredential(EKpub, AKpub, session_key), Encrypt_session_key({AKcert, filesystem_keys, etc.})} + + @@ -207,6 +285,11 @@ protocol: (`ID` might be, e.g., a hostname.) +![Protocol Diagram](Protocol-Two-Messages.png) + +(In this diagram we show the use of a TPM simulator on the server side +for implementing [`TPM2_MakeCredential()`](TPM2_MakeCredential.md).) + The server will validate that the `timestamp` is near the current time, the EKcert (if provided, else the EKpub), the signature using the asserted (but not yet bound to the EKpub) AKpub, then it will validate @@ -218,26 +301,67 @@ The client obtains those items IFF (if and only if) the AK is resident in the same TPM as the EK, courtesy of `TPM2_ActivateCredential()`'s semantics. -NOTE well that in this example it is *essential* that the AKcert not be -logged in any public place since otherwise an attacker can make and send -`CS0` using a non-TPM-resident AK and any TPM's EKpub/EKcert known to -the attacker, and then it may recover the AK certificate from the log in -spite of being unable to recover the AK certificate from `SC1`! +NOTE well that in single round trip attestation protocols using only +decrypt-only EKs it is *essential* that the AKcert not be logged in any +public place since otherwise an attacker can make and send `CS0` using a +non-TPM-resident AK and any TPM's EKpub/EKcert known to the attacker, +and then it may recover the AK certificate from the log in spite of +being unable to recover the AK certificate from `SC1`! Alternatively, a single round trip attestation protocol can be implemented as an optimization to a two round trip protocol when the AK is persisted both, in the client TPM and in the attestation service's database: - ``` - CS0: Signed_AK({timestamp, AKpub, PCR_quote, eventlog}) + CS0: timestamp, AKpub, PCRs, eventlog, + TPM2_Quote(AK, PCRs, extra_data)=Signed_AK({hash-of-PCRs, misc, extra_data}) SC0: {TPM2_MakeCredential(EKpub, AKpub, session_key), Encrypt_session_key({AKcert, filesystem_keys, etc.})} ``` +### Three-Message Attestation Protocol Patterns + +A single round trip protocol using encrypt-only EKpub will not +demonstrate proof of possession immediately, but later on when the +certified AK is used elsewhere. A proof-of-possession (PoP) may be +desirable anyways for monitoring and alerting purposes. + +``` + CS0: [ID], EKpub, [EKcert], AKpub, PCRs, eventlog, timestamp, + TPM2_Quote(AK, PCRs, extra_data)=Signed_AK({hash-of-PCRs, misc, extra_data}) + SC0: {TPM2_MakeCredential(EKpub, AKpub, session_key), + Encrypt_session_key({AKcert, filesystem_keys, etc.})} + CS1: AKcert, Signed_AK(AKcert) +``` + +![Protocol Diagram](Protocol-Three-Messages.png) + +(In this diagram we show the use of a TPM simulator on the server side +for implementing [`TPM2_MakeCredential()`](TPM2_MakeCredential.md).) + +NOTE well that in this protocol, like single round trip attestation +protocols using only decrypt-only EKs, it is *essential* that the AKcert +not be logged in any public place since otherwise an attacker can make +and send `CS0` using a non-TPM-resident AK and any TPM's EKpub/EKcert +known to the attacker, and then it may recover the AK certificate from +the log in spite of being unable to recover the AK certificate from +`SC1`! + +If such a protocol is instantiated over HTTP or TCP, it will really be +more like a two round trip protocol: + +``` + CS0: [ID], EKpub, [EKcert], AKpub, PCRs, eventlog, timestamp, + TPM2_Quote(AK, PCRs, extra_data)=Signed_AK({hash-of-PCRs, misc, extra_data}) + SC0: {TPM2_MakeCredential(EKpub, AKpub, session_key), + Encrypt_session_key({AKcert, filesystem_keys, etc.})} + CS1: AKcert, Signed_AK(AKcert) + SC1: +``` + ### Two Round Trip Stateless Attestation Protocol Patterns We can add a round trip to the protocol in the previous section to make @@ -252,11 +376,13 @@ back to the server rather than a secret key possesion of which is proven with symmetriclly-keyed cryptographic algorithms. ``` - CS0: Signed_AK({timestamp, [ID], EKpub, [EKcert], - AKpub, PCR_quote, eventlog}) + CS0: [ID], EKpub, [EKcert], AKpub, PCRs, eventlog, timestamp, + TPM2_Quote(AK, PCRs, extra_data)=Signed_AK({hash-of-PCRs, misc, extra_data}) SC0: {TPM2_MakeCredential(EKpub, AKpub, session_key), ticket} CS1: {ticket, MAC_session_key(CS0), CS0} SC1: Encrypt_session_key({AKcert, filesystem_keys, etc.}) + + ``` where `session_key` is an ephemeral secret symmetric authenticated @@ -267,6 +393,8 @@ encryption key, and `ticket` is an authenticated encrypted state cookie: MAC_session_key(CS0)})} ``` +![Protocol Diagram](Protocol-Four-Messages.png) + where `server_secret_key` is a key known only to the attestation service and `vno` identifies that key (in order to support key rotation without having to try authenticated decryption twice near key rotation events). @@ -309,6 +437,10 @@ An HTTP API binding for this protocol could look like: Response: SC1 ``` +Here the attestation happens in the first round trip, but the proof of +possession is completed in the second, and the delivery of secrets and +AKcert also happens in the second round trip. + ### Actual Protocols: ibmacs The [`IBM TPM Attestation Client Server`](https://sourceforge.net/projects/ibmtpm20acs/) @@ -358,7 +490,20 @@ to two round trips. ### Actual Protocols: safeboot.dev -(TBD) +``` + CS0: + SC0: nonce, PCR_list + CS1: [ID], EKpub, [EKcert], AKpub, PCRs, eventlog, nonce, + TPM2_Quote(AK, PCRs, extra_data)=Signed_AK({hash-of-PCRs, misc, extra_data}) + SC1: {TPM2_MakeCredential(EKpub, AKpub, session_key), + Encrypt_session_key({filesystem_keys})} +``` + +Nonce validation is currently not well-developed in Safeboot. +If a timestamp is used instead of a nonce, and if the client assumes all +PCRs are desired, then this becomes a one round trip protocol. + +An AKcert will be added to the Safeboot protocol soon. ### Actual Protocols: ... @@ -383,9 +528,8 @@ proof of possession non-interactively, whereas asymmetric encryption requires interaction to prove possession: ``` - CS0: Signed_AK({timestamp, [ID], EKpub, [EKcert], - AKpub, TPM2_Certify(EKpub, AKpub), - PCR_quote, eventlog}) + CS0: timestamp, [ID], EKpub, [EKcert], AKpub, PCRs, eventlog, + TPM2_Certify(EKpub, AKpub), TPM2_Quote() SC0: AKcert ``` @@ -393,11 +537,9 @@ If secrets need to be sent back, then a decrypt-only EK also neds to be used: ``` - CS0: Signed_AK({timestamp, [ID], - EKpub_signing, EKpub_encrypt, - [EKcert_signing], [EKcert_encrypt], - AKpub, TPM2_Certify(EKpub, AKpub), - PCR_quote, eventlog}) + CS0: timestamp, [ID], EKpub_signing, EKpub_encrypt, + [EKcert_signing], [EKcert_encrypt], AKpub, PCRs, eventlog, + TPM2_Certify(EKpub, AKpub), TPM2_Quote() SC0: {TPM2_MakeCredential(EKpub_encrypt, AKpub, session_key), Encrypt_session_key({AKcert, filesystem_keys, etc.})} ``` @@ -408,6 +550,7 @@ Attestation servers need to keep some long-term state: - binding of `EKpub` and `ID` - PCR validation profile(s) for each identified client + - resetCount (for reboot detection) Log-like attestation state: @@ -431,16 +574,138 @@ Things to log: attestation protocols above -- do not log AKcerts in public places when using single round trip attestation protocols!) -## Long-Term State Created by Attestation Services +## Long-Term State Created or Updated by Attestation Services -An attestation service might support creation of host<->EKpub -bindings on a first-come-first-served basis. + - An attestation service might support creation of host<->EKpub + bindings on a first-come-first-served basis. In this mode the + attestation server might validate an EKcert and that the desired + hostname has not been bound to an EK, then create the binding. -An attestation service might support deletion of host PCR validation -profiles that represent past states upon validation of PCR quotes using -newer profiles. This could be used to permit firmware and/or operating -system upgrades and then disallow downgrades after evidence of -successful upgrade. + - An attestation service might support deletion of host PCR validation + profiles that represent past states upon validation of PCR quotes + using newer profiles. This could be used to permit firmware and/or + operating system upgrades and then disallow downgrades after evidence + of successful upgrade. + + - An attestation service might keep track of client reboots so as to: + - revoke old AKcerts when the client reboots (but note that this is + really not necessary if we trust the client's TPM, since then the + previous AKs will never be usable again) + - alert if the reboot count ever goes backwards + +## Schema for Attestation Server Database + +A schema for the attestation server's database entries might look like: + +```JSON +{ + "EKpub": "", + "hostname": "", + "EKcert": "", + "previous_firmware_profile": "FWProfile0", + "current_firmware_profiles": ["FWProfile1", "FWProfile2", "..."], + "previous_operating_system_profiles": "OSProfile0", + "current_operating_system_profiles": ["OSProfile1", "OSProfile2", "..."], + "previous_PCRs": "<...>", + "proposed_PCRs": "<...>", + "ak_cert_template": "", + "secrets": "", + "resetCount": "" +} +``` + +The attestation server's database should have two lookup keys: + + - EKpub + - hostname + +The attestation server's database's entry for any client should provide, +de minimis: + + - a way to validate the root of trust measurements in the client's + quoted PCRs, for which two methods are possible: + - save the PCRs quoted last as the ones expected next time + - or, name profiles for validating firmware RTM PCRs and profiles + for validating operating system RTM PCRs + +A profile for validating PCRs should contain a set of expected extension +values for each of a set of PCRs. The attestation server can then check +that the eventlog submitted by the client lists exactly those extension +values and no others. PCR extension order in the eventlog probably +doesn't matter here. If multiple profiles are named, then one of those +must match -- this allows for upgrades and downgrades. + +```JSON +{ + "profile_name":"SomeProfile", + "values":[ + { + "PCR":0, + "values":["aaaaaaa","bbbbbb","..."] + }, + { + "PCR":1, + "values":["ccccccc","dddddd","..."] + } + ] +} +``` + +Using the PCR values from the previous attestation makes upgrades +tricky, probably requiring an authenticated and authorized administrator +to bless new PCR values after an upgrade. A client that presents a PCR +quote that does not match the previous one would cause the +`proposed_PCRs` field to be updated but otherwise could not continue, +then an administrator would confirm that the client just did a +firmware/OS upgrade and if so replace the `previous_PCRs` with the +`proposed_PCRs`, then the client could attempt attestation again. + +## Dealing with Secrets + +An attestation server might want to return storage/filesystem decryption +key-encryption-keys to a client. But one might not want to store those +keys in the clear on the attestation server. As well, one might want a +break-glass way to recover those secrets. + +For break-glass recover, the simplest thing to do is to store +`Encrypt_backupKey({EKpub, hostname, secrets})`, where `backupKey` is an +asymmetric key whose private key is stored offline (e.g., in a safe, or +in an offline HSM). To break the glass and recover the key, just bring +the ciphertext to the offline system where the private backup key is +kept, decrypt it, and then use the secrets manually to recover the +affected system. + +Here are some ideas for how to make an attestation client depend on the +attestation server giving it keys needed to continue booting after +successful attestation: + + - Store `TPM2_MakeCredential(EKpub, someObjectName, key0), Encrypt_key0(secrets)`. + + In this mode the server sends the client the stored data, then client + gets to recreate `someObject` (possibly by loading a saved object) on + its TPM so that the corresponding call to `TPM2_ActivateCredential()` + can succeed, then the client recovers `key0` and decrypts the + encrypted secrets. Here `someObject` can be trivial and need only + exist to make the `{Make,Activate}Credential` machinery work. + + TPM replacement and/or migration of a host from one physical system + to another can be implemented by learning the new system's TPM's + EKpub and using the offline `backupKey` to compute + `TPM2_MakeCredential(EKpub_new, someObjectName, key0)` and update the + host's entry. + + - Store a secret value that will be extended into an application PCR + that is used as a policy PCR for unsealing a persistent object stored + on the client's TPM. + + In this mode the server sends the client the secret PCR extension + value, and the client uses it to extend a PCR such that it can then + unseal the real storage / filesystem decryption keys. + + - A hybrid of the previous two options, where the server stores a + secret PCR extension value wrapped with `TPM2_MakeCredential()`. + +Other ideas? # References diff --git a/Attestation/TPM2_Quote.md b/Attestation/TPM2_Quote.md new file mode 100644 index 0000000..0059fb7 --- /dev/null +++ b/Attestation/TPM2_Quote.md @@ -0,0 +1,45 @@ +# `TPM2_Quote()` + +`TPM2_Quote()` computes a hash of the PCRs selected by the caller, and +signs that hash, some additional metadata, and any extra data provided +by the caller, with a signing key named by the caller. The caller must +have access to that key, naturally. + +The PCRs' values are NOT included in the quote produced by +`TPM2_Quote()`. Instead, an attestation service can review an unsigned +eventlog to ensure it leads to the same values as unsigned PCR values +also provided by the attestation client, and then the attestation +service can verify that the hash of the PCR values is indeed signed by +the quote supplied by the client. + +## Inputs + + - `TPMI_DH_OBJECT sigHandle` (handle for an AK) + - `TPM2B_DATA qualifyingData` (extra data) + - `TPMT_SIG_SCHEME inScheme` ("signing scheme to use if the schemefor signHandleis `TPM_ALG_NULL`") + - `TPML_PCR_SELECTION PCRselect` (set of PCRs to quote) + +## Outputs (success case) + + - `TPM2B_ATTEST quoted` + - `TPMT_SIGNATURE signature` + +Where `TPM2B_ATTEST` is basically a `TPMS_ATTEST`, which contains the +following fields: + + - `TPM_GENERATED magic` + - `TPMI_ST_ATTEST type` + - `TPM2B_NAME signer` (name of AK) + - `TPM2B_DATA extraData` ("external information supplied by caller") + - `TPMS_CLOCK_INFO clockInfo` ("Clock, resetCount, restartCount, and Safe") + - `UINT64 firmwareVersion` + - `TPMU_ATTEST attested`, a discriminated union with the + `TPMS_QUOTE_INFO` arm (indicated by the `TPM_ST_ATTEST_QUOTE` + discriminant value), which contains: + - `TPML_PCR_SELECTION pcrSelect` (the set of PCRs digested by `pcrDigest`) + - `TPM2B_DIGEST pcrDigest` (the digest of the PCRs indicated by `pcrSelect`) + +## References + + - [TCG TPM Library part 3: Commands, section 18.4](https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part3_Commands_pub.pdf) +