Return-Path: X-Original-To: jose@ietfa.amsl.com Delivered-To: jose@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FDFA11E80F6 for ; Tue, 28 Aug 2012 08:09:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.493 X-Spam-Level: X-Spam-Status: No, score=-3.493 tagged_above=-999 required=5 tests=[AWL=0.105, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mK4OrG6rEMA2 for ; Tue, 28 Aug 2012 08:09:18 -0700 (PDT) Received: from mail-qc0-f172.google.com (mail-qc0-f172.google.com [209.85.216.172]) by ietfa.amsl.com (Postfix) with ESMTP id 466DF11E80F7 for ; Tue, 28 Aug 2012 08:09:18 -0700 (PDT) Received: by qcac10 with SMTP id c10so4018253qca.31 for ; Tue, 28 Aug 2012 08:09:17 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :message-id:references:to:x-mailer:x-gm-message-state; bh=K1L8KYSXvjzUiLx9k1+tO5oGyinXZN8BFWnf16trzD0=; b=dkD6RCGZmN9tQ6M4u3svB4w3N3Wz+3X8pEpBsV94BSFaRbfVggaa1a3vUUhVi3sPBb LywZt3wAdB+7wtANxkJ8p2sZl3BLJabgnYPUCwgQVvZd86yEpjcgDxL2OLhjdkTq+7Gg hDTrDNGN9z3EmsrVYOtWUUwrMAaRJFyoOszMj1otpqlrDWia16i5IRNT6PVD5RJKYiy0 lHyEX15jxJZOHSnCGgXkqXYx+4D6cOI9LCDxHcJK1eMbCBSpFJW5ehWHPDy9+jISnK9q PkveCURFEYt4OWDn4OHduJThTykqL82sqa47MRbtpdn5NdagCvczgWnIqLYQX8c7eg5B H6OA== Received: by 10.224.53.4 with SMTP id k4mr13931734qag.32.1346166557182; Tue, 28 Aug 2012 08:09:17 -0700 (PDT) Received: from [192.168.1.211] (190-20-54-75.baf.movistar.cl. [190.20.54.75]) by mx.google.com with ESMTPS id gd3sm12248941qab.13.2012.08.28.08.09.13 (version=TLSv1/SSLv3 cipher=OTHER); Tue, 28 Aug 2012 08:09:15 -0700 (PDT) Content-Type: multipart/signed; boundary="Apple-Mail=_6ED0C75A-1A0D-4CE5-8A9E-4E31AB188085"; protocol="application/pkcs7-signature"; micalg=sha1 Mime-Version: 1.0 (Mac OS X Mail 6.0 \(1486\)) From: John Bradley In-Reply-To: <503CD692.4020007@mitre.org> Date: Tue, 28 Aug 2012 11:09:07 -0400 Message-Id: References: <4E1F6AAD24975D4BA5B1680429673943667A93F8@TK5EX14MBXC284.redmond.corp.microsoft.com> <503CD692.4020007@mitre.org> To: Justin Richer X-Mailer: Apple Mail (2.1486) X-Gm-Message-State: ALoCoQnCwrUvvbzEFCXXvNoyExG7mJ6qmKYrpRvPuHq5NREr+cOSDDvQbrkR3bYWVVB6rfgeAybs Cc: Axel Nennker , Mike Jones , Jim Schaad , "jose@ietf.org" Subject: Re: [jose] DISCUSS: Nonce/Timestamp parameter X-BeenThere: jose@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Javascript Object Signing and Encryption List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Aug 2012 15:09:19 -0000 --Apple-Mail=_6ED0C75A-1A0D-4CE5-8A9E-4E31AB188085 Content-Type: multipart/alternative; boundary="Apple-Mail=_60255DDB-7CDF-4EDA-9844-3E2D3E810131" --Apple-Mail=_60255DDB-7CDF-4EDA-9844-3E2D3E810131 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=iso-8859-1 In OAuth 2 state gets overloaded with a bunch of things from preventing = XSRF to providing a handle to look up who the the authorization request = was sent to. In Connect we added a nonce sent by client that is returned inside the = signed id_token (JWT) to allow the client to detect replay, and = optionally reference a specific browser session that presents the = id_token. The nonce I suggested for JOSE is not ether of those. =20 I used nonce in the sense that it is used with stream cyphers when the = same key is used over multiple messages. JOSE will be used for more than OAuth and JWT. There are cases where = adding entropy to the header will be a security benefit. I would like = to have a standard claim for doing that. If people want to call it something else that is fine, but it is a nonce = by definition. If used it should be a random or pseudo random value that is time = variant with sufficient granularity to ensure a nonce is used only once. John B. On 2012-08-28, at 10:32 AM, Justin Richer wrote: > On 08/25/2012 03:37 AM, Axel Nennker wrote: >> To clarify: What is the base specification that Jim mentioned?=20 >> Is it: http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-03 = ? >>=20 >> Would somebody please present a use-case for either nonce or = timestamp? >> If a jwt is used with oauth2 then what is the difference between = nonce and state? Nonce would be signed while state is not? >>=20 >=20 > Nonce would generally be generated by the entity creating the token. = State in OAuth is generated by the client, and would only be protected = if the client had a means to make a signed request to the server, using = either a MAC binding or a JWT-based OIDC-style RequestObject. >=20 > -- Justin >=20 >> I guess I am missing some information that those in the room who = voted "yes" had? >>=20 >> Axel >>=20 >> 2012/8/25 Mike Jones >> I'll note for discussion purposes that a nonce and a timestamp are = not the same thing (although sometimes they are used to achieve = similar/related goals). A nonce tends to be an opaque value that must = be preserved across the communication. Whereas a timestamp typically = has defined semantics - sometimes simply a non-decreasing integer value = - and sometimes a representation of time, and then, sometimes with a = uniqueness requirement. >>=20 >> For discussion purposes, I'll say that the simplest thing for us to = do (should we decide to do anything in this regard) would be to define = the nonce as an opaque string value that must be preserved. >>=20 >> We could also define a timestamp parameter, but as I wrote above, = that would likely require us to specify additional semantics - starting = with whether it's a non-decreasing integer or a representation of a time = value. This seems much harder to define and possibly to use than a = nonce. >>=20 >> Would it make sense to define a nonce parameter now and hold off on = defining a timestamp parameter until there's a clear demonstrated use = case for which a nonce is not sufficient? That would be my personal = recommendation. >>=20 >> Best wishes, >> -- Mike >>=20 >> -----Original Message----- >> From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf = Of Jim Schaad >> Sent: Friday, August 17, 2012 12:05 AM >> To: jose@ietf.org >> Subject: [jose] POLL: Nonce/Timestamp parameter >>=20 >> >>=20 >> If you voted at the face-2-face please do not vote again. If you = want to provide comments please change the title from POLL to DISCUSS. >>=20 >> Do we need to define a nonce/timestamp parameter in the base = specification? >>=20 >>=20 >>=20 >> Room vote: 6 yes, 0 no, 1 discuss >>=20 >>=20 >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose >>=20 >>=20 >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose >>=20 >>=20 >>=20 >> _______________________________________________ >> jose mailing list >> jose@ietf.org >> https://www.ietf.org/mailman/listinfo/jose >=20 > _______________________________________________ > jose mailing list > jose@ietf.org > https://www.ietf.org/mailman/listinfo/jose --Apple-Mail=_60255DDB-7CDF-4EDA-9844-3E2D3E810131 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=iso-8859-1 In = OAuth 2 state gets overloaded with a bunch of things from preventing = XSRF to providing a handle to look up who the the authorization request = was sent to.

In Connect we added a nonce sent by = client that is returned inside the signed id_token (JWT) to allow the = client to detect replay, and optionally reference a specific browser = session that presents the id_token.

The nonce I = suggested for JOSE is not ether of those. =  

I used nonce in the sense that it is = used with stream cyphers when the same key is used over multiple = messages.

JOSE will be used for more than OAuth = and JWT.   There are cases where adding entropy to the header will = be a security benefit.  I would like to have a standard claim for = doing that.
If people want to call it something else that is = fine, but it is a nonce by definition.
If used it should be a = random or pseudo random value that is time variant with sufficient = granularity to ensure a nonce is used only = once.

John = B.

On 2012-08-28, at 10:32 AM, Justin = Richer <jricher@mitre.org> = wrote:

=20 =20
On 08/25/2012 03:37 AM, Axel Nennker wrote:
To clarify: What is the base specification that Jim mentioned? =
Is it: htt= p://tools.ietf.org/html/draft-ietf-oauth-json-web-token-03 ?

Would somebody please present a use-case for either nonce or timestamp?
If a jwt is used with oauth2 then what is the difference between nonce and state? Nonce would be signed while state is not?


Nonce would generally be generated by the entity creating the token. State in OAuth is generated by the client, and would only be protected if the client had a means to make a signed request to the server, using either a MAC binding or a JWT-based OIDC-style RequestObject.

 -- Justin

I guess I am missing some information that those in the room who voted "yes" had?

Axel

2012/8/25 Mike Jones <Michael.Jones@microsoft.com>
I'll note for discussion purposes that a nonce and a timestamp are not the same thing (although sometimes they are used to achieve similar/related goals).  A nonce tends to be an = opaque value that must be preserved across the communication.  Whereas a timestamp typically has defined semantics - sometimes simply a non-decreasing integer value - and sometimes a representation of time, and then, sometimes with a uniqueness requirement.

For discussion purposes, I'll say that the simplest thing for us to do (should we decide to do anything in this regard) would be to define the nonce as an opaque string value that must be preserved.

We could also define a timestamp parameter, but as I wrote above, that would likely require us to specify additional semantics - starting with whether it's a non-decreasing integer or a representation of a time value.  This seems = much harder to define and possibly to use than a nonce.

Would it make sense to define a nonce parameter now and hold off on defining a timestamp parameter until there's a clear demonstrated use case for which a nonce is not sufficient?  That would be my personal recommendation.

                  =               Best wishes,
                  =               -- Mike

-----Original Message-----
From: jose-bounces@ietf.org [mailto:jose-bounces@ietf.org] On Behalf Of Jim Schaad
Sent: Friday, August 17, 2012 12:05 AM
To: jose@ietf.org
Subject: [jose] POLL: Nonce/Timestamp parameter

<CHAIR>

If you voted at the face-2-face please do not vote again. =  If you want to provide comments please change the title from POLL to DISCUSS.

Do we need to define a nonce/timestamp parameter in the base specification?



Room vote:  6 yes, 0 no, 1 discuss


_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose


_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/mailman/listinfo/jose



_______________________________________________
jose mailing list
jose@ietf.org
https://www.ietf.org/m=
ailman/listinfo/jose

_______________________________________________
jose mailing = list
jose@ietf.org
https://www.ietf.org/ma= ilman/listinfo/jose

= --Apple-Mail=_60255DDB-7CDF-4EDA-9844-3E2D3E810131-- --Apple-Mail=_6ED0C75A-1A0D-4CE5-8A9E-4E31AB188085 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPnzCCB7Uw ggadoAMCAQICAh5cMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3Rh cnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0Ew HhcNMTIwMzE4MDQzMjQ4WhcNMTQwMzE5MTEwNzMyWjCBmzEZMBcGA1UEDRMQR3JUTTZMUzdYMzU3 NzhzOTELMAkGA1UEBhMCQ0wxIjAgBgNVBAgTGU1ldHJvcG9saXRhbmEgZGUgU2FudGlhZ28xFjAU BgNVBAcTDUlzbGEgZGUgTWFpcG8xFTATBgNVBAMTDEpvaG4gQnJhZGxleTEeMBwGCSqGSIb3DQEJ ARYPamJyYWRsZXlAbWUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAskrlBI93 rBTLOQGSwIT6co6dAw/rwDPrRXl6/F2oc4KDn+QN6CdFeHo08H846VJS9CDjLKvnK9jbxxs4wYqe nKdPb3jgzt8oc7b9ZXtWkOgsxgMf6dBZ/IPm4lWBpCbSr3seDGDXEpiE2lTZXno7c25OguR4E6Qa hcpHABZjeEWK65mMH25gmoRf5MY1k3quu5y+FCYCHE2iwU5jzq+mI3HmG59+UMFLx1fjV+zTslRw 26cQDC/uepwjeYSp8S26hfWipVWwQj4js/C7RoPtvt2iyeU+LSH81jG4wlAWntiOG1WtoXUuXWSc ExhciKeKWCnemy9qqmxRfJqBROeGlQIDAQABo4IEDjCCBAowCQYDVR0TBAIwADALBgNVHQ8EBAMC BLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMB0GA1UdDgQWBBQ/A7/CxKEnzpqmZlLz 9iaQMy24eTAfBgNVHSMEGDAWgBSuVYNv7DHKufcd+q9rMfPIHeOsuzB+BgNVHREEdzB1gQ9qYnJh ZGxleUBtZS5jb22BD2picmFkbGV5QG1lLmNvbYEQamJyYWRsZXlAbWFjLmNvbYERdmU3anRiQHZl N2p0Yi5jb22BE2picmFkbGV5QHdpbmdhYS5jb22BF2pvaG4uYnJhZGxleUB3aW5nYWEuY29tMIIC IQYDVR0gBIICGDCCAhQwggIQBgsrBgEEAYG1NwECAjCCAf8wLgYIKwYBBQUHAgEWImh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cuc3RhcnRz c2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBpc3N1ZWQgYWNj b3JkaW5nIHRvIHRoZSBDbGFzcyAyIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9mIHRoZSBTdGFy dENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBwdXJwb3NlIGlu IGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMIGcBggrBgEFBQcC AjCBjzAnFiBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTADAgECGmRMaWFiaWxpdHkg YW5kIHdhcnJhbnRpZXMgYXJlIGxpbWl0ZWQhIFNlZSBzZWN0aW9uICJMZWdhbCBhbmQgTGltaXRh dGlvbnMiIG9mIHRoZSBTdGFydENvbSBDQSBwb2xpY3kuMDYGA1UdHwQvMC0wK6ApoCeGJWh0dHA6 Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUyLWNybC5jcmwwgY4GCCsGAQUFBwEBBIGBMH8wOQYIKwYB BQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIvY2xhc3MyL2NsaWVudC9jYTBCBggr BgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2VydHMvc3ViLmNsYXNzMi5jbGllbnQu Y2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tLzANBgkqhkiG9w0BAQUF AAOCAQEAEcfD4PmHrX+W3zaP/KsR4gwLAL0UTaMz14SIng6a9F3kb8ZDbTUneS9ubgpqeJQP2IFc 0U5gQnJ3XeCH6p9I88mvm1NqKQw8WvfglS0aIS19vfpTgXJSPdIO2JJPRqaBtXf3zkdXJwckX9/d NMrLGeGvaFT9fUNdQdHU4BI1pVUpgKr796T7LTc/ERfH8iFp1+CmdVkJ6Y2iJdWUp4h17XmbxbIT 0CdS4SSk/VW8LFsn/mVz6hB73VthwjGsIku54Wp4pRuq1KX+pATnRk3pHRa1z3mxJMmq7OEXENcC Vm+bAnyUrYbUilNS9UVTYS8/3dVsKiNupBaOZO+vOgJqVDCCB+IwggXKoAMCAQICAQ4wDQYJKoZI hvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsT IlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDI1NFoXDTEyMTAyMjIxMDI1NFowgYwx CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGln aXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAyIFByaW1h cnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AMsohUWcASz7GfKrpTOMKqANy9BV7V0igWdGxA8IU77L3aTxErQ+fcxtDYZ36Z6GH0YFn7fq5RAD teP0AYzrCA+EQTfi8q1+kA3m0nwtwXG94M5sIqsvs7lRP1aycBke/s5g9hJHryZ2acScnzczjBCA o7X1v5G3yw8MDP2m2RCye0KfgZ4nODerZJVzhAlOD9YejvAXZqHksw56HzElVIoYSZ3q4+RJuPXX fIoyby+Y2m1E+YzX5iCZXBx05gk6MKAW1vaw4/v2OOLy6FZH3XHHtOkzUreG//CsFnB9+uaYSlR6 5cdGzTsmoIK8WH1ygoXhRBm98SD7Hf/r3FELNvUCAwEAAaOCA1swggNXMAwGA1UdEwQFMAMBAf8w CwYDVR0PBAQDAgGmMB0GA1UdDgQWBBSuVYNv7DHKufcd+q9rMfPIHeOsuzCBqAYDVR0jBIGgMIGd gBROC+8apEBbpRdphzDKNGhD0EGu8qGBgaR/MH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFy dENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkw JwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eYIBATAJBgNVHRIEAjAAMD0G CCsGAQUFBwEBBDEwLzAtBggrBgEFBQcwAoYhaHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2Eu Y3J0MGAGA1UdHwRZMFcwLKAqoCiGJmh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9zZnNjYS1jcmwu Y3JsMCegJaAjhiFodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9zZnNjYS5jcmwwggFdBgNVHSAEggFU MIIBUDCCAUwGCysGAQQBgbU3AQEEMIIBOzAvBggrBgEFBQcCARYjaHR0cDovL2NlcnQuc3RhcnRj b20ub3JnL3BvbGljeS5wZGYwNQYIKwYBBQUHAgEWKWh0dHA6Ly9jZXJ0LnN0YXJ0Y29tLm9yZy9p bnRlcm1lZGlhdGUucGRmMIHQBggrBgEFBQcCAjCBwzAnFiBTdGFydCBDb21tZXJjaWFsIChTdGFy dENvbSkgTHRkLjADAgEBGoGXTGltaXRlZCBMaWFiaWxpdHksIHJlYWQgdGhlIHNlY3Rpb24gKkxl Z2FsIExpbWl0YXRpb25zKiBvZiB0aGUgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkg UG9saWN5IGF2YWlsYWJsZSBhdCBodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvcG9saWN5LnBkZjAR BglghkgBhvhCAQEEBAMCAAcwUAYJYIZIAYb4QgENBEMWQVN0YXJ0Q29tIENsYXNzIDIgUHJpbWFy eSBJbnRlcm1lZGlhdGUgRnJlZSBTU0wgRW1haWwgQ2VydGlmaWNhdGVzMA0GCSqGSIb3DQEBBQUA A4ICAQAe9xAX/vbphHkvkDdNrslXWdO7fD3JaqnTT3jmmDu55r7UpW1H/v/J40UBXsw9DKU8TylE 4RwZT5HDAMW42f1x498AzM4FOnL/pUTTvr6BiRlrify5ZovkDYVWjy1GYTJ+hPiBEv0HmHnDxjhn JIIkEvJ+niMHLLEdpNMhZnxMiTFRAtIF4WeYcpgXBjAxsEDRKBvw40K+r3N4lykySQNp2ElIJ8H1 z2BmhxtppUdWpOVJ4Q1Gvn9jfV1qnMhFCDY+X1X8DrkKrTcpDExcGlefweQs7+DYUK3spiQkJpN7 qpPYlfy2GYHedv7lGa1ZAghMI/4882QVAK2zq6M60nHpOUMtYD61XtAs3ZD5L3yn9LCdeK2j4ZbQ 3uRdwvxAMFWwXyUK/ALP4lCu9QhxbnETOkBWT3FJul4/FUgzM0RRCEGhuQWiOFSoa35XJTcYf/4E /ZuvOXhK04nUpe7DYTMWzRqL04yyoJQVHKHKSboytueydKuqFZKdJA9gi77OnPBYL/yxkXGgkLC9 tsi77oT4AgZry0/6lgX56ak+f/umQihNPgtKSQQjEYq9S8MlOHzpUM0vxsghATYsdUPBw6r6ZxDH jXoUAD03DUMEbKsWvqFB7nJNVesngbu8miw1EYLA+fHfTaCidoV3CL75jKqM/KE87qrh9Fqti9bK qnkvpTGCA2wwggNoAgEBMIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAh5cMAkGBSsO AwIaBQCgggGtMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTEyMDgy ODE1MDkwN1owIwYJKoZIhvcNAQkEMRYEFBFWANsrJMWsZm0LDhUbF0q3w1L9MIGkBgkrBgEEAYI3 EAQxgZYwgZMwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQL EyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBD bGFzcyAyIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQICHlwwgaYGCyqGSIb3DQEJEAIL MYGWoIGTMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMi U2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xh c3MgMiBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAh5cMA0GCSqGSIb3DQEBAQUABIIB ACvVPAkRgtLsI4OFXyjn9IVV0DnCvERDM20YSK1sqYFCdFBD9bGdukph9X+IJry2Y5ETkzl16CFX 3ZXCc8FmfhBHeGPT4Loe0zMnANvMRUir0jO3phrSzLU7pNGx9VIAzS7/8sbItl2gZao1jcU90V3n P6ePnqmqhGpds4TwGNr0y6qfqbwPgxsSWR5rUn99ECidPdFLaNS6hrAqrNA5Vu95Z7q0vKaVDoDv 6JmvAVkprBqXfHG2+mrrVeRNQ278Et0NB+h6E04l/lpLvSCFjD8bH4VJrmoJ1IvC2+4VQcZvgNFb Q1cRvs7B5jaIFv13HbEyl4txtzebYdm6X23cTFEAAAAAAAA= --Apple-Mail=_6ED0C75A-1A0D-4CE5-8A9E-4E31AB188085--