Message-ID: <a649b086-9c38-4e06-bf06-0b5f57e0e9cb@tu-dresden.de>
Date: Mon, 17 Nov 2025 19:01:17 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: H.Rafiee <ietf@rozanak.com>
References: <7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com>
Content-Language: en-US
From: Muhammad Usama Sardar <muhammad_usama.sardar@tu-dresden.de>
In-Reply-To: <7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com>
Content-Type: multipart/signed; protocol="application/pkcs7-signature";
	micalg=sha-512; boundary="------------ms040309070109090207010600"
Message-ID-Hash: KLGYT2TD3FDTJIKCHI2ZHXJMISLEJFOA
CC: tls@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BTLS=5D_Re=3A_Security_Concern_in_TLS_1=2E3_and_OpenSSL_Implemen?=
	=?utf-8?q?tation?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/tls/cqlteWfGcO4fxODZXfhm7sRengE>

--------------ms040309070109090207010600
Content-Type: multipart/alternative;
 boundary="------------l0rCmpaOUlAqtZdwMciXFN2H"

--------------l0rCmpaOUlAqtZdwMciXFN2H
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: base64

SGVsbG8gSG9zbmllaCwNCg0KSSBhbSBub3QgYW4gT3BlblNTTCBleHBlcnQgKGFuZCBpdCBt
YXkgYmUgdGhlIGNhc2UgdGhhdCB0aGUga2V5IG5hbWVzIA0KdXNlZCB0aGVyZSBhcmUgYSBz
b3VyY2Ugb2YgY29uZnVzaW9uKSBidXQgZnJvbSBzcGVjaWZpY2F0aW9uIA0KcGVyc3BlY3Rp
dmUsIEkgZmluZCB5b3VyIGV4cGxhbmF0aW9uIG9mIGtleXMgdmVyeSBjb25mdXNpbmcuIEFs
c28sIEkgYW0gDQpub3Qgc3VyZSB3aGF0IGtpbmQgb2YgL3JhbmRvbW5lc3MvIHlvdSBhcmUg
bG9va2luZyBmb3IuIFBsZWFzZSBzZWUgaW5saW5lOg0KDQpPbiAxNy4xMS4yNSAxNzo0MCwg
SC5SYWZpZWUgd3JvdGU6DQo+IEluIHNob3J0LCBUTFMgMS4zIHVzZXMgMC1SVFQgdG8gaW1w
cm92ZSBwZXJmb3JtYW5jZS4gVG8gYWNoaWV2ZSB0aGlzLCBpdCBkZXJpdmVzIGEga2V5IGZy
b20gdGhlIHByZS1zaGFyZWQga2V5IChQU0sgb3IgbWFzdGVyIGtleSkNCkkgYW0gbm90IHN1
cmUgd2h5IHlvdSBjYWxsIGl0ICJtYXN0ZXIga2V5Ii4gU3VjaCBhIGtleSBuYW1lIGRvZXMg
bm90IA0KZXhpc3QgaW4gVExTIDEuMyBzcGVjcyAobmVpdGhlciBSRkM4NDQ2IG5vciBSRkM4
NDQ2YmlzKS4gVGhlcmUgd2FzIA0KIk1hc3RlciBzZWNyZXQiIGluIFJGQzg0NDYgd2hpY2gg
aXMgbm93ICJNYWluIHNlY3JldCIgaW4gUkZDODQ0NmJpcyBidXQgDQp0aGF0J3MgYSBjb21w
bGV0ZWx5IGRpZmZlcmVudCBrZXkgY29tcGFyZWQgdG8gUFNLLiBBbmQgIk1haW4gc2VjcmV0
IiBpcyANCmdlbmVyYXRlZCB2ZXJ5IGxhdGUgaW4gdGhlIGtleSBzY2hlZHVsZSwgd2hpY2gg
c2VlbXMgaXJyZWxldmFudCB0byB5b3VyIA0KZXhwbGFuYXRpb24uDQo+ICwgY2FsbGVkIHRo
ZSBlYXJseSBzZWNyZXQgKGluIE9wZW5TU0wpLiBUaGlzIGVhcmx5IHNlY3JldCBpcyBkZXJp
dmVkIGluIGEgdmVyeSBzaW1wbGUgd2F5DQpXaGF0IGRvIHlvdSBtZWFuIGJ5ICJ2ZXJ5IHNp
bXBsZSB3YXkiPyBXaGF0IGluIGFkZGl0aW9uIHRvIEhLREYtRXh0cmFjdCANCndlcmUgeW91
IGV4cGVjdGluZyB0byBnZW5lcmF0ZSBFYXJseSBTZWNyZXQgZnJvbSBQU0s/DQo+IGFuZCBp
cyB1c2VkIGZvciBlbmNyeXB0aW5nIGFuZCBhdXRoZW50aWNhdGluZyB0aGUgZmlyc3QgY29t
bXVuaWNhdGlvbnMuDQoNClRoYXQncyBhY3R1YWxseSBub3QgY29ycmVjdC4gRWFybHkgU2Vj
cmV0IGl0c2VsZiBpcyBuZXZlciB1c2VkIGV4Y2VwdCANCmZvciBnZW5lcmF0aW5nIHRocmVl
IG90aGVyIGtleXMgdmlhIGFwcGxpY2F0aW9uIG9mIERlcml2ZS1TZWNyZXQgaW4gdGhlIA0K
Zmlyc3Qgc3RhZ2Ugb2YgZGVyaXZhdGlvbi4gT25lIG9mIHRob3NlIHRocmVlIGtleXMgaXMg
DQpjbGllbnRfZWFybHlfdHJhZmZpY19zZWNyZXQsIHdoaWNoIGlzIHRoZW4gdXNlZCB0byBn
ZW5lcmF0ZSANCmNsaWVudF93cml0ZV9rZXkgdmlhIGFwcGxpY2F0aW9uIG9mIEhLREYtRXhw
YW5kLUxhYmVsIGluIHRoZSBzZWNvbmQgDQpzdGFnZSBvZiBkZXJpdmF0aW9uLiBjbGllbnRf
d3JpdGVfa2V5IGlzIHRoZSBvbmUgdXNlZCBmb3IgZW5jcnlwdGluZyANCjAtUlRUIGRhdGEu
DQoNCj4gVGhlIG1haW4gY29uY2VybiBpcyB0aGF0IHRoaXMgZWFybHkgc2VjcmV0IGlzIG5l
aXRoZXIgcmFuZG9taXplZCBub3IgY2hhbmdlZCBhZnRlciBzeXN0ZW0gc3RhcnR1cC4NClRo
aXMgaXMgYmVjYXVzZSB0aGUgYXNzdW1wdGlvbiBpcyB0aGF0IFBTSyByZW1haW5zIHNlY3Jl
dC4gQ291bGQgeW91IA0KcGxlYXNlIGNsYXJpZnkgd2hhdCBkbyB5b3UgbWVhbiBieSAic3lz
dGVtIHN0YXJ0dXAiPyBBcmUgeW91IHJlc3VtaW5nIA0KY29ubmVjdGlvbnMgbXVsdGlwbGUg
dGltZXMgd2l0aCB0aGUgc2FtZSBQU0s/DQo+IEZvciBzdWJzZXF1ZW50IHNlc3Npb24ga2V5
cywgYSBzdGF0aWMgdmFsdWUgaXMgYWxzbyB1c2VkIGFzIGlucHV0IHRvIHRoZSBzZXNzaW9u
IGtleSBnZW5lcmF0aW9uIGZ1bmN0aW9uLCBhbG9uZyB3aXRoIGEgZmV3IHJhbmRvbSB2YWx1
ZXMuDQoNCkkgYW0gYSBiaXQgbG9zdCBpbiB5b3VyIHRlcm1pbm9sb2d5IGhlcmUuIFdoaWNo
ICJzdGF0aWMgdmFsdWUiPyBBcmUgeW91IA0KcmVmZXJyaW5nIHRvIHRoZSAvbGFiZWwvIGlu
cHV0cyBmb3IgRGVyaXZlLVNlY3JldD8NCg0KV2hpY2ggImZldyByYW5kb20gdmFsdWVzIj8g
QXJlIHlvdSByZWZlcnJpbmcgdG8gdGhlIHN0YXRlIG9mIHRoZSANCmhhbmRzaGFrZSB1c2Vk
IGFzIGlucHV0IGluIERlcml2ZS1TZWNyZXQ/IElmIHNvLCB0aGVyZSBpcyBub3RoaW5nIG1v
cmUgDQp0aGFuIENsaWVudEhlbGxvIGF2YWlsYWJsZSBhdCB0aGUgdGltZSB3aGVuIHRoaXMg
a2V5IGlzIGdlbmVyYXRlZCwgc28gSSANCmFtIG5vdCBzdXJlIGhvdyBvbmUgY2FuIGFkZCBt
b3JlICJyYW5kb21uZXNzIi4NCg0KPiBBcyBhIHJlc3VsdCwgdGhlIHNlc3Npb24ga2V5IG1h
eSBub3QgYmUgc3VmZmljaWVudGx5IHJhbmRvbS4NCldoaWNoICJzZXNzaW9uIGtleSIgZXhh
Y3RseT8NCj4gUXVlc3Rpb25zIHRvIHRoZSBjb21tdW5pdHk6DQo+DQo+IElzIHRoaXMgYW4g
T3BlblNTTCBpbXBsZW1lbnRhdGlvbiBpc3N1ZSwgb3IgYSBwcm90b2NvbC1sZXZlbCBzZWN1
cml0eSBwcm9ibGVtPw0KPiBXZXJlIHRoZXJlIGFueSB0ZXN0cyBjb25kdWN0ZWQgZm9yIHRo
ZSBwcm90b2NvbCBiZWZvcmUgaXRzIHJlbGVhc2U/DQo+IElzIHRoaXMgaXNzdWUgYWxyZWFk
eSBrbm93bj8NCkkgZG9uJ3QgdGhpbmsgaXQncyBhbiBpc3N1ZSBidXQgSSBtYXkgYmUgbWlz
c2luZyBzb21ldGhpbmcuIFBsZWFzZSANCnByb3ZpZGUgYW5zd2VycyB0byBteSBxdWVzdGlv
bnMuDQo+IFNlY3VyaXR5IHJpc2tzOg0KPiBJZiB0aGVyZSBpcyBhIGJ1ZyBpbiB0aGUgc3lz
dGVtIG9yIHRoZSBlYXJseSBzZWNyZXQgaXMgbm90IHdlbGwgcHJvdGVjdGVkIGluIG1lbW9y
eSAoaXQgY2Fubm90IGJlIHN0b3JlZCBpbiBhbiBIU00gb3IgdHJ1c3RlZCBlbnZpcm9ubWVu
dCBiZWNhdXNlIGl0IG5lZWRzIHRvIGJlIHJlYWRpbHkgYXZhaWxhYmxlIHRvIFRMUyBsaWJy
YXJ5KSwgYW4gYXR0YWNrZXIgY291bGQgcmVwcm9kdWNlIG9yIGRlY3J5cHQgY29tbXVuaWNh
dGlvbiBpbiBjYXNlIG9mIHZ1bG5lcmFiaWxpdGllcyBpbiBvbmUgb2YgdGhlIGNvbW11bmlj
YXRpbmcgc3lzdGVtcy4NClN1cmUsIGlmIEVhcmx5IFNlY3JldCBpcyBub3QgcHJvdGVjdGVk
LCB0aGVyZSBpcyBub3RoaW5nIHByZXZlbnRpbmcgDQowLVJUVCBkYXRhLiBUaGF0IGlzIGJ5
IGRlc2lnbi4NCj4gRXZlbiBpZiB0aGUgVExTIGxpYnJhcnkgdXNlcyBpc29sYXRlZCBtZW1v
cnkgc3BhY2UsIGFueSBidWcgaW4gT3BlblNTTCBjb3VsZCBleHBvc2UgdGhlIHNlY3JldC4N
ClNhbWUgYXBwbGllcyBoZXJlLg0KPiBTaW5jZSB0aGUgZWFybHkgc2VjcmV0IGxhY2tzIHN1
ZmZpY2llbnQgcmFuZG9tbmVzcywgaXQgc2VlbXMgbmVjZXNzYXJ5IHRvIGNoYW5nZSB0aGUg
UFNLIHRvIHByZXZlbnQgYXR0YWNrZXJzIGZyb20gZXN0YWJsaXNoaW5nIHNlY3VyZSBjb21t
dW5pY2F0aW9uLg0KDQpBZ2FpbiwgcGxlYXNlIGNsYXJpZnkgInJhbmRvbW5lc3MiLiBXaGVy
ZSB3b3VsZCB0aGF0IHJhbmRvbSB2YWx1ZSBiZSANCnN0b3JlZD8gSW1hZ2luZSBzb21laG93
IHRoZSByYW5kb21uZXNzIGlzIHRoZXJlLCBpZiBhdHRhY2tlciBoYXMgYWNjZXNzIA0KdG8g
bWVtb3J5LCBjYW4ndCBpdCBnZXQgdGhhdCByYW5kb20gdmFsdWUgdG9vPw0KDQo+IEdlbmVy
YWxseSBzcGVha2luZywgdGhlIHJvbGUgb2YgdGhlIFBTSyBpcyB3ZWFrIGhlcmUuIEV2ZW4g
aWYgaXQgaXMgd2VsbCBwcm90ZWN0ZWQsIGFzIGxvbmcgYXMgdGhlIGVhcmx5IHNlY3JldCBp
cyBwb29ybHkgcHJvdGVjdGVkLCBrbm93aW5nIHRoZSBlYXJseSBzZWNyZXQgY29tcHJvbWlz
ZXMgdGhlIGVudGlyZSBzeXN0ZW0uDQoNClllcywgdGhhdCBpcyBieSBkZXNpZ24uIFBTSy1v
bmx5IGRvZXMgbm90IGhhdmUgdGhlIHNhbWUgcHJvcGVydGllcyBhcyANCnRoZSBmdWxsIGhh
bmRzaGFrZSB3aXRoIEVDREhFLiBJbiBwYXJ0aWN1bGFyLCBsb3NpbmcgRWFybHkgU2VjcmV0
IGluIA0KUFNLLW9ubHkgYnJlYWtzIGFsbCBndWFyYW50ZWVzIGZvciAwLVJUVCBkYXRhLg0K
DQpJbiBnZW5lcmFsLCB5b3UgbWF5IGZpbmQgU2VjdGlvbiAxLjMgaW4gWzBdIGhlbHBmdWwg
Zm9yIGdlbmVyYWwgDQp1bmRlcnN0YW5kaW5nIG9mIFRMUyBrZXkgc2NoZWR1bGUuDQoNCi1V
c2FtYQ0KDQpbMF0gDQpodHRwczovL3d3dy5yZXNlYXJjaGdhdGUubmV0L3B1YmxpY2F0aW9u
LzM5NjI0NTcyNl9QZXJzcGljdWl0eV9vZl9BdHRlc3RhdGlvbl9NZWNoYW5pc21zX2luX0Nv
bmZpZGVudGlhbF9Db21wdXRpbmdfVmFsaWRhdGlvbl9vZl9UTFNfMTNfS2V5X1NjaGVkdWxl
DQoNCg==
--------------l0rCmpaOUlAqtZdwMciXFN2H
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF=
-8">
  </head>
  <body>
    <p>Hello Hosnieh,</p>
    <p>I am not an OpenSSL expert (and it may be the case that the key
      names used there are a source of confusion) but from specification
      perspective, I find your explanation of keys very confusing. Also,
      I am not sure what kind of <i>randomness</i> you are looking for.
      Please see inline:<br>
    </p>
    <div class=3D"moz-cite-prefix">On 17.11.25 17:40, H.Rafiee wrote:<br>=

    </div>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DU=
TF-8">
      <pre>In short, TLS 1.3 uses 0-RTT to improve performance. To achiev=
e this, it derives a key from the pre-shared key (PSK or master key)</pre=
>
    </blockquote>
    I am not sure why you call it "master key". Such a key name does not
    exist in TLS 1.3 specs (neither RFC8446 nor RFC8446bis). There was
    "Master secret" in RFC8446 which is now "Main secret" in RFC8446bis
    but that's a completely different key compared to PSK. And "Main
    secret" is generated very late in the key schedule, which seems
    irrelevant to your explanation.<br>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>, called the early secret (in OpenSSL). This early secret is d=
erived in a very simple way </pre>
    </blockquote>
    What do you mean by "very simple way"? What in addition to
    HKDF-Extract were you expecting to generate Early Secret from PSK?<br=
>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>and is used for encrypting and authenticating the first commun=
ications. </pre>
    </blockquote>
    <p>That's actually not correct. Early Secret itself is never used
      except for generating three other keys via application of
      Derive-Secret in the first stage of derivation. One of those three
      keys is client_early_traffic_secret, which is then used to
      generate client_write_key via application of HKDF-Expand-Label in
      the second stage of derivation. client_write_key is the one used
      for encrypting 0-RTT data. </p>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>The main concern is that this early secret is neither randomiz=
ed nor changed after system startup.</pre>
    </blockquote>
    This is because the assumption is that PSK remains secret. Could you
    please clarify what do you mean by "system startup"? Are you
    resuming connections multiple times with the same PSK?
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>For subsequent session keys, a static value is also used as in=
put to the session key generation function, along with a few random value=
s. </pre>
    </blockquote>
    <p>I am a bit lost in your terminology here. Which "static value"?
      Are you referring to the <i>label</i> inputs for Derive-Secret?</p>=

    <p>Which "few random values"? Are you referring to the state of the
      handshake used as input in Derive-Secret? If so, there is nothing
      more than ClientHello available at the time when this key is
      generated, so I am not sure how one can add more "randomness".<br>
    </p>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>As a result, the session key may not be sufficiently random.</=
pre>
    </blockquote>
    Which "session key" exactly?
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>Questions to the community:

Is this an OpenSSL implementation issue, or a protocol-level security pro=
blem?
Were there any tests conducted for the protocol before its release?
Is this issue already known?</pre>
    </blockquote>
    I don't think it's an issue but I may be missing something. Please
    provide answers to my questions.
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>Security risks:
If there is a bug in the system or the early secret is not well protected=
 in memory (it cannot be stored in an HSM or trusted environment because =
it needs to be readily available to TLS library), an attacker could repro=
duce or decrypt communication in case of vulnerabilities in one of the co=
mmunicating systems.</pre>
    </blockquote>
    Sure, if Early Secret is not protected, there is nothing preventing
    0-RTT data. That is by design.
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>Even if the TLS library uses isolated memory space, any bug in=
 OpenSSL could expose the secret. </pre>
    </blockquote>
    Same applies here.<br>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>Since the early secret lacks sufficient randomness, it seems n=
ecessary to change the PSK to prevent attackers from establishing secure =
communication.</pre>
    </blockquote>
    <p>Again, please clarify "randomness". Where would that random value
      be stored? Imagine somehow the randomness is there, if attacker
      has access to memory, can't it get that random value too?</p>
    <blockquote type=3D"cite"
      cite=3D"mid:7f563479-c1ac-4678-9d96-f8a0d8fb0e69@rozanak.com">
      <pre>Generally speaking, the role of the PSK is weak here. Even if =
it is well protected, as long as the early secret is poorly protected, kn=
owing the early secret compromises the entire system.</pre>
    </blockquote>
    <p>Yes, that is by design. PSK-only does not have the same
      properties as the full handshake with ECDHE. In particular, losing
      Early Secret in PSK-only breaks all guarantees for 0-RTT data.</p>
    <p>In general, you may find Section 1.3 in [0] helpful for general
      understanding of TLS key schedule. <br>
    </p>
    <p>-Usama</p>
    <p>[0]
<a class=3D"moz-txt-link-freetext" href=3D"https://www.researchgate.net/p=
ublication/396245726_Perspicuity_of_Attestation_Mechanisms_in_Confidentia=
l_Computing_Validation_of_TLS_13_Key_Schedule">https://www.researchgate.n=
et/publication/396245726_Perspicuity_of_Attestation_Mechanisms_in_Confide=
ntial_Computing_Validation_of_TLS_13_Key_Schedule</a><br>
    </p>
  </body>
</html>

--------------l0rCmpaOUlAqtZdwMciXFN2H--

--------------ms040309070109090207010600
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgMFADCABgkqhkiG9w0BBwEAAKCC
DlwwggbmMIIEzqADAgECAhAxAnDUNb6bJJr4VtDh4oVJMA0GCSqGSIb3DQEBDAUAMIGIMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKTmV3IEplcnNleTEUMBIGA1UEBxMLSmVyc2V5IENpdHkx
HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEuMCwGA1UEAxMlVVNFUlRydXN0IFJT
QSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0yMDAyMTgwMDAwMDBaFw0zMzA1MDEyMzU5
NTlaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQD
ExNHRUFOVCBQZXJzb25hbCBDQSA0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
s0riIl4nW+kEWxQENTIgFK600jFAxs1QwB6hRMqvnkphfy2Q3mKbM2otpELKlgE8/3AQPYBo
7p7yeORuPMnAuA+oMGRb2wbeSaLcZbpwXgfCvnKxmq97/kQkOFX706F9O7/h0yehHhDjUdyM
yT0zMs4AMBDRrAFn/b2vR3j0BSYgoQs16oSqadM3p+d0vvH/YrRMtOhkvGpLuzL8m+LTAQWv
QJ92NwCyKiHspoP4mLPJvVpEpDMnpDbRUQdftSpZzVKTNORvPrGPRLnJ0EEVCHR82LL6oz91
5WkrgeCY9ImuulBn4uVsd9ZpubCgM/EXvVBlViKqusChSsZEn7juIsGIiDyaIhhLsd3amm8B
S3bgK6AxdSMROND6hiHT182Lmf8C+gRHxQG9McvG35uUvRu8v7bPZiJRaT7ZC2f50P4lTlnb
LvWpXv5yv7hheO8bMXltiyLweLB+VNvg+GnfL6TW3Aq1yF1yrZAZzR4MbpjTWdEdSLKvz8+0
wCwscQ81nbDOwDt9vyZ+0eJXbRkWZiqScnwAg5/B1NUD4TrYlrI4n6zFp2pyYUOiuzP+as/A
Znz63GvjFK69WODR2W/TK4D7VikEMhg18vhuRf4hxnWZOy0vhfDR/g3aJbdsGac+diahjEwz
yB+UKJOCyzvecG8bZ/u/U8PsEMZg07iIPi8CAwEAAaOCAYswggGHMB8GA1UdIwQYMBaAFFN5
v1qqK0rPVIDh2JvAnfKyA2bLMB0GA1UdDgQWBBRpAKHHIVj44MUbILAK3adRvxPZ5DAOBgNV
HQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHSUEFjAUBggrBgEFBQcDAgYI
KwYBBQUHAwQwOAYDVR0gBDEwLzAtBgRVHSAAMCUwIwYIKwYBBQUHAgEWF2h0dHBzOi8vc2Vj
dGlnby5jb20vQ1BTMFAGA1UdHwRJMEcwRaBDoEGGP2h0dHA6Ly9jcmwudXNlcnRydXN0LmNv
bS9VU0VSVHJ1c3RSU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDB2BggrBgEFBQcBAQRq
MGgwPwYIKwYBBQUHMAKGM2h0dHA6Ly9jcnQudXNlcnRydXN0LmNvbS9VU0VSVHJ1c3RSU0FB
ZGRUcnVzdENBLmNydDAlBggrBgEFBQcwAYYZaHR0cDovL29jc3AudXNlcnRydXN0LmNvbTAN
BgkqhkiG9w0BAQwFAAOCAgEACgVOew2PHxM5AP1v7GLGw+3tF6rjAcx43D9Hl110Q+BABABg
lkrPkES/VyMZsfuds8fcDGvGE3o5UfjSno4sij0xdKut8zMazv8/4VMKPCA3EUS0tDUoL01u
gDdqwlyXuYizeXyH2ICAQfXMtS+raz7mf741CZvO50OxMUMxqljeRfVPDJQJNHOYi2pxuxgj
KDYx4hdZ9G2o+oLlHhu5+anMDkE8g0tffjRKn8I1D1BmrDdWR/IdbBOj6870abYvqys1qYlP
otv5N5dm+XxQ8vlrvY7+kfQaAYeO3rP1DM8BGdpEqyFVa+I0rpJPhaZkeWW7cImDQFerHW9b
KzBrCC815a3WrEhNpxh72ZJZNs1HYJ+29NTB6uu4NJjaMxpk+g2puNSm4b9uVjBbPO9V6sFS
G+IBqE9ckX/1XjzJtY8Grqoo4SiRb6zcHhp3mxj3oqWi8SKNohAOKnUc7RIP6ss1hqIFyv0x
XZor4N9tnzD0Fo0JDIURjDPEgo5WTdti/MdGTmKFQNqxyZuT9uSI2Xvhz8p+4pCYkiZqpahZ
lHqMFxdw9XRZQgrP+cgtOkWEaiNkRBbvtvLdp7MCL2OsQhQEdEbUvDM9slzZXdI7NjJokVBq
3O4pls3VD2z3L/bHVBe0rBERjyM2C/HSIh84rfmAqBgklzIOqXhd+4RzadUwggduMIIFVqAD
AgECAhA/YCOTOabjcS/HTP8f2MRxMA0GCSqGSIb3DQEBDAUAMEYxCzAJBgNVBAYTAk5MMRkw
FwYDVQQKExBHRUFOVCBWZXJlbmlnaW5nMRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0
MB4XDTI0MTExOTAwMDAwMFoXDTI2MTExOTIzNTk1OVowgdoxCzAJBgNVBAYTAkRFMRAwDgYD
VQQIEwdTYWNoc2VuMSgwJgYDVQQKEx9UZWNobmlzY2hlIFVuaXZlcnNpdGFldCBEcmVzZGVu
MREwDwYDVQRhEwhHT1ZERStTTjEyMDAGCSqGSIb3DQEJARYjbXVoYW1tYWRfdXNhbWEuc2Fy
ZGFyQHR1LWRyZXNkZW4uZGUxDzANBgNVBAQTBlNhcmRhcjEXMBUGA1UEKhMOTXVoYW1tYWQg
VXNhbWExHjAcBgNVBAMTFU11aGFtbWFkIFVzYW1hIFNhcmRhcjCCAiIwDQYJKoZIhvcNAQEB
BQADggIPADCCAgoCggIBAKhTeUVDqbjfDFmkVrgQMFC3S4O0vjW9zjlrkD8FrZ2ipCLuiNE2
XHibuTw57N2lrcWMRqjw/Tv7WqpasIHjIlvE5SJ+VuOzu5P0xLqfroT4MSlKIq1LyXkL1u09
A9EuCUxhf4Uc3Ir17VYzjS7meqv4+4yoVhnL9zepze8f0FG3EJmGJlBSJ8sD6dVxGQkDLWMf
NNt/I8wkaQSFkzvd+KppPOjc4t4JtQWIHKPMKS3lbXv8RLO1jaPO9Fdfg4D/dq5I8fsnfg6y
gmCL+nTsHWAXqgX8vcDVG5tz5ONzHgODtItrQWO+m4d8W16JWCbMMCFIqscZ5weRfS5dSFZk
sptipqIm5tzUL3y2/VOFCiL/tofo7yA1bHnFXUGm2LkJVNx6pDZFh1G9OYPqmrjjSxL9E/ed
xQ1lIe3GmBJGBUFldlP8STm3WapaatgNcuQ6HXX1HexWF14NBIguNajgOR17JxX0JS4t9o5f
3Po+Nqa/Als1Mm9Q6PACcVRhm7yH4vj3UqGcjAps6YM/HDkNoA2qsHmqZ/ya15eIORADN+ZQ
O7hJYBH5TJprVdGXL7aTLNJh6xEn5V9TFcsT017ocQ5bJteN6caUay/0zPenwtabuSLR6y7e
gmx8gTF4oPDUlgkaNcKAmkyzwM+IzPNIJvyxq/NI1pQRyTGUQJYyExO7AgMBAAGjggHBMIIB
vTAfBgNVHSMEGDAWgBRpAKHHIVj44MUbILAK3adRvxPZ5DAdBgNVHQ4EFgQU4R79RPVSVexS
+el1ZxCchmYs1akwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYI
KwYBBQUHAwQGCCsGAQUFBwMCMFAGA1UdIARJMEcwOgYMKwYBBAGyMQECAQoEMCowKAYIKwYB
BQUHAgEWHGh0dHBzOi8vc2VjdGlnby5jb20vU01JTUVDUFMwCQYHZ4EMAQUDAjBCBgNVHR8E
OzA5MDegNaAzhjFodHRwOi8vR0VBTlQuY3JsLnNlY3RpZ28uY29tL0dFQU5UUGVyc29uYWxD
QTQuY3JsMHgGCCsGAQUFBwEBBGwwajA9BggrBgEFBQcwAoYxaHR0cDovL0dFQU5ULmNydC5z
ZWN0aWdvLmNvbS9HRUFOVFBlcnNvbmFsQ0E0LmNydDApBggrBgEFBQcwAYYdaHR0cDovL0dF
QU5ULm9jc3Auc2VjdGlnby5jb20wLgYDVR0RBCcwJYEjbXVoYW1tYWRfdXNhbWEuc2FyZGFy
QHR1LWRyZXNkZW4uZGUwDQYJKoZIhvcNAQEMBQADggIBAIxymCHDahevSfae44bVKxAKDRLh
ZVraNygdRQ2RQOkz8v8b/cl5yuWR/l3yMpIrwiDWT37UQibNuoPxaZeRBjDh8ItcUP51sOAV
7zd3GwfyUJNYKmgd6LjfE8+mkXrVU2JffVjRUgiyy7eBTzvTz5PFUQh2oqWfTh/Oz3pFXV+/
0K3eP+fNkr0gljmEZi/h0ici5cJ+Q9J/Zx6Vg9ke2qb6PIh+zeb5oL40i7FR875NX/WGKMib
ojTopS5xPbo0KmN64FqgasfJW03t0wyTtcYOap6tw2RcfVpjfsXQqEfjdjyrNHH6l/TDxUoL
cNlu0zkYHMYmJ6MJ6VwaHWB5hou9N0WWrcQotsfkpf7lGZSlum9jG5/uB+d3FLK00QM99XN7
RhLbLOKKuw2Xri3MEcN/LvIRDIHef4uoONAI+4bOW+1wFmGwqpHYxA/JoUXoRjojuAon8lCF
uVf3tFAkQ/V8zuPxCX36gEOsyQuK3IAeS8R8qhV5Cc+dcYDKid61AluluBcUSxfKxmoK19Mm
f39FTD+bJpBCiEAdJuZfP6TD0dtBVcgJ4dBLZ4H13WBeVZRDXcxghYJcNWFHPa/qi20jmuUs
CvcD4z2+LBFnVrwhOeBefYjm6zy7+9IbuomR11B4+AnLkjzTBZxcX17UMWyqVe4hZN2CsVS0
7doWTJJYMYIEWDCCBFQCAQEwWjBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQgVmVy
ZW5pZ2luZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIQP2Ajkzmm43Evx0z/H9jE
cTANBglghkgBZQMEAgMFAKCCAc8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG
9w0BCQUxDxcNMjUxMTE3MTgwMTE3WjBPBgkqhkiG9w0BCQQxQgRAymvWECcw++sTzVj2hTq+
VQLqc90mLKJ3E/9Y09JuhorvP4SFzWPs31OVKivK0Fz+zeRbzteJ3khMZ3QL4TAkxDBpBgkr
BgEEAYI3EAQxXDBaMEYxCzAJBgNVBAYTAk5MMRkwFwYDVQQKExBHRUFOVCBWZXJlbmlnaW5n
MRwwGgYDVQQDExNHRUFOVCBQZXJzb25hbCBDQSA0AhA/YCOTOabjcS/HTP8f2MRxMGsGCyqG
SIb3DQEJEAILMVygWjBGMQswCQYDVQQGEwJOTDEZMBcGA1UEChMQR0VBTlQgVmVyZW5pZ2lu
ZzEcMBoGA1UEAxMTR0VBTlQgUGVyc29uYWwgQ0EgNAIQP2Ajkzmm43Evx0z/H9jEcTBsBgkq
hkiG9w0BCQ8xXzBdMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYI
KoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsOAwIHMA0GCCqGSIb3DQMCAgEoMA0G
CSqGSIb3DQEBAQUABIICABE1Fhlo4+tmTaVZe9IlYxw8LFKKRoQcDRR91/CTqLy2GSqARrn4
VGxrwCpyml1aQY56mo+Sxi51/bCqx05/bjLpl+pfdiA0Im+xGwCfozaOPSbfXTRgDLPFa+dS
Y2GMUvjCm1+IDmQhbdCnWSmkjLZFYnek4ff4zTik3jaH/rWRad+h3hJjLaewzaalm4euZ+oW
rS1rlGKo5dG5mz5L2Uq6V3SzMpUl+cMlU/JntXOOjDDWlbcRYCCYK/ca+IUweYJKLLpsbaOI
IbA/hlx8btIoTe/8kXne488JmUsJgwMAUnLvBv5rmwgKAcesVhD3d8MkbmrkF5Ptc3D6xXdY
2tU/paZD5RXCyfSxSnai7UPPZBCGFLqZ9zkfamgB2/fW2zlgcJDBkgjse7siTeFaPjS2fkwQ
KZDml275YucgBg86WCv2vwq/9NOL9X0ygLjr0+Xb37s/j6/u/10rPEQxq5jZp0n0g735Doj3
BdmyCeeWrbMNgamM7XG4YKp2MzAEKYnXm8CdZH+DCxt27siw/4tQoMJruSFc2Eoa/0h7hvxz
qjmF9oKYWvcdRtVjIlmAW6vM7QroQEOa7PeXQkwbD8h6lzxT0rt62I6//OhNRDnKwJEHT+AB
7S+bKCz6/FBtOSsz8YYUeVzF1URsxzEWDx1Corp9jR4xshpz3ZghJJjvAAAAAAAA
--------------ms040309070109090207010600--