<?xmlversion='1.0' encoding='utf-8'?>version="1.0" encoding="UTF-8"?> <!-- draft submitted in xml v3 --> <!DOCTYPE rfc [ <!ENTITY nbsp " "> <!ENTITY zwsp "​"> <!ENTITY nbhy "‑"> <!ENTITY wj "⁠"> ]><?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?><!-- generated by https://github.com/cabo/kramdown-rfc version 1.6.17 (Ruby 3.1.2) --> <rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft-ietf-lamps-documentsigning-eku-06" number="9336" submissionType="IETF" category="std" consensus="true" tocInclude="true" sortRefs="true" symRefs="true" updates="" obsoletes="" xml:lang="en" version="3"> <!-- xml2rfc v2v3 conversion 3.14.2 --> <front> <title abbrev="EKU for DocumentSigning">General PurposeSigning">X.509 Certificate General-Purpose Extended Key Usage (EKU) for DocumentSigning X.509 Certificates</title>Signing</title> <seriesInfoname="Internet-Draft" value="draft-ietf-lamps-documentsigning-eku-06"/>name="RFC" value="9336"/> <author initials="T." surname="Ito" fullname="Tadahiko Ito"> <organization>SECOM CO., LTD.</organization> <address> <email>tadahiko.ito.public@gmail.com</email> </address> </author> <author initials="T." surname="Okubo" fullname="Tomofumi Okubo"> <organization>DigiCert, Inc.</organization> <address> <email>tomofumi.okubo+ietf@gmail.com</email> </address> </author> <author initials="S." surname="Turner" fullname="Sean Turner"> <organization>sn3rd</organization> <address> <email>sean@sn3rd.com</email> </address> </author> <date year="2022"month="September" day="29"/> <area>SEC</area> <workgroup>LAMPS Working Group</workgroup> <keyword>Internet-Draft</keyword>month="December"/> <area>sec</area> <workgroup>lamps</workgroup> <abstract> <t>RFC 5280 specifies several extended key purpose identifiers (KeyPurposeIds) for X.509 certificates. This document defines ageneral purpose document signinggeneral-purpose Document-Signing KeyPurposeId for inclusion in the Extended Key Usage (EKU) extension of X.509 public key certificates.Document SigningDocument-Signing applications may require that the EKU extension be present and that adocument signingDocument-Signing KeyPurposeId be indicated in order for the certificate to be acceptable to thatDocument SigningDocument-Signing application.</t> </abstract><note removeInRFC="true"> <name>About This Document</name> <t> Status information for this document may be found at <eref target="https://datatracker.ietf.org/doc/draft-ietf-lamps-documentsigning-eku/"/>. </t> <t> Discussion of this document takes place on the Limited Additional Mechanisms for PKIX and SMIME (LAMPS) Working Group mailing list (<eref target="mailto:spasm@ietf.org"/>), which is archived at <eref target="https://mailarchive.ietf.org/arch/browse/spasm/"/>. Subscribe at <eref target="https://www.ietf.org/mailman/listinfo/spasm/"/>. </t> <t>Source for this draft and an issue tracker can be found at <eref target="https://github.com/lamps-wg/documentsigning-eku"/>.</t> </note></front> <middle> <section anchor="introduction"> <name>Introduction</name> <t><xref target="RFC5280"/> specifies several extended key purpose identifiers (KeyPurposeIds) for X.509 certificates. In addition,several KeyPurposeIds have been added underthe IANA repository "SMI Security for PKIX Extended Key Purpose" <xreftarget="RFC7299"/>.target="RFC7299"/> includes a number of KeyPurposeIds. While usage of the"anyExtendedKeyUsage"anyExtendedKeyUsage KeyPurposeId is bad practice for publicly trusted certificates, there is no public and general KeyPurposeId explicitly assigned for Document Signing. The current practice is to use id-kp-emailProtection,id-kp-codeSigningid-kp-codeSigning, or a vendor-defined KeyPurposeId for generaldocument signingDocument-Signing purposes.</t> <t>In circumstances where code signing and S/MIME certificates are also used fordocument signing,Document Signing, technical or policy changes made to the code signing and S/MIME ecosystem may cause unexpected behaviors or have an adverse impact such as decreased cryptographic agility on thedocument signingDocument-Signing ecosystem and vice versa.</t> <t>Vendor-defined KeyPurposeIds that are used in a PKI governed by the vendor or a group of vendorsposespose no interoperability concern. Appropriating, or misappropriating as the case may be, KeyPurposeIDs for use outside of their originally intended vendor or group of vendors controlled environment can introduce problems, the impact of which is difficult to determine.</t> <t>Therefore, it is not favorable to use a vendor-defined KeyPurposeId for signing a document that is not governed by the vendor.</t> <t>This document defines an extended key purpose identifier for Document Signing.</t> </section> <section anchor="conventions-and-definitions"> <name>Conventions and Definitions</name><t>The<t> The key words"MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY","<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>", "<bcp14>MAY</bcp14>", and"OPTIONAL""<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as described inBCP 14BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they appear in all capitals, as shownhere.</t>here. </t> </section> <section anchor="extended-key-purpose-for-document-signing"> <name>Extended Key Purpose for Document Signing</name> <t>This specification defines the KeyPurposeId id-kp-documentSigning.</t> <t>As described in <xref target="RFC5280"/>, "[i]f the [Extended Key Usage] extension is present, then the certificateMUST<bcp14>MUST</bcp14> only be used for one of the purposes indicated." <xref target="RFC5280"/> alsodescribesnotes that "[i]f multiple [key] purposes are indicated the application need not recognize all purposes indicated, as long as the intended purpose is present."</t><t>Document Signing<t>Document-Signing applicationsMAY<bcp14>MAY</bcp14> require that theExtended Key UsageEKU extension be present and that the id-kp-documentSigning be indicated in order for the certificate to be acceptable to thatDocument SigningDocument-Signing application.</t> <t>The term "Document Signing" in this document refers to digitally signing contents that are consumed by people. To be more precise, contents are intended to be shown to a personwithin a printable or displayable form by means of services or software, rather thanprimarilyprocessed bymachines.</t>machines. </t> <section anchor="ext"> <name>Including the Extended Key Purpose for Document Signing in Certificates</name> <t><xref target="RFC5280"/> specifies the EKU X.509 certificate extension for use on the Internet. The extension indicates one or more purposes for which the certified public key is valid. The EKU extension can be used in conjunction with the key usage extension, which indicates the set of basic cryptographic operations for which the certified key may be used.</t> <t>The EKU extension syntax is repeated here for convenience:</t><artwork><![CDATA[<sourcecode type=""><![CDATA[ ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId KeyPurposeId ::= OBJECT IDENTIFIER]]></artwork>]]></sourcecode> <t>As described in <xref target="RFC5280"/>, the EKU extension may, at the option of the certificate issuer, be either critical or non-critical.</t> <t>This specification defines the KeyPurposeId id-kp-documentSigning. Inclusion of this KeyPurposeId in a certificate indicates that the public key encoded in the certificate has been certified to be used for cryptographic operations on contents that are consumed by people.</t><artwork><![CDATA[<sourcecode type=""><![CDATA[ id-kp OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) 3 } id-kp-documentSigning OBJECT IDENTIFIER ::= { id-kp 36 }]]></artwork>]]></sourcecode> </section> </section> <section anchor="using-the-extended-key-purpose-for-document-signing-in-a-certificate"> <name>Using the Extended Key Purpose for Document Signing in a Certificate</name> <t>Our intended use case is people consuming the contents of signed documents. To be more precise, contents are intended to be shown to a person in a printable or displayable form by means of services or software, rather than processed by machines. The digital signature on the contents is to indicate to the recipient of the contents that the content has not changed since it was signed by the identity indicated as the subject of the certificate. To validate the digital signaturewhichthat is signed on contents intended to be consumed by people, implementationsMAY<bcp14>MAY</bcp14> perform the steps below during certificatevalidation:</t>validation.</t> <t>The following procedure is used to examine the KeyPurposeId(s) included in theExtended Key UsageEKU extension. Restrictions onExtended Key UsageEKU is derived and implemented from (or configured with) the policy to which the implementation conforms.</t> <ul spacing="normal"> <li>If there are no restrictions set for the relying party and the relying party software, the certificate is acceptable.</li> <li> <t>If there are restrictions set for the relying party and relying party software, then process the KeyPurposeId(s) as described below. </t> <t> This procedure is intended to permit or prohibit the presence of a certain KeyPurposeId or the complete absence of KeyPurposeIds. It is outside the scope of this document, but the relying party can permit or prohibit combinations of KeyPurposeIds, instead of a single KeyPurposeId. A consideration on prohibiting combinations of KeyPurposeIds is described in the Security Considerations section of this document. If both"Excluded KeyPurposeId"Excluded KeyPurposeId and"Permitted KeyPurposeId" exists,Permitted KeyPurposeId exist, the relying party or the relying party software processes each restriction on"Excluded KeyPurposeId" first,Excluded KeyPurposeId first and then processes each restriction on"Permitted KeyPurposeId".Permitted KeyPurposeId. </t><dl><dl newline="true"> <dt>Excluded KeyPurposeId procedure:</dt> <dd><t>"Excluded KeyPurposeId"<t>Excluded KeyPurposeId is a KeyPurposeIdwhichthat the relying party or the relying party software prohibits. Examples of"Excluded KeyPurposeId" are,Excluded KeyPurposeId include the presence of the anyExtendedKeyUsage KeyPurposeId or the complete absence of the EKU extension in a certificate. If a KeyPurposeId of the certificate meets the conditions set by the"Excluded KeyPurposeId"Excluded KeyPurposeId restriction, the relying party or the relying party software rejects the certificate.</t> </dd> <dt>Permitted KeyPurposeId procedure:</dt> <dd><t>"Permitted KeyPurposeId"<t>Permitted KeyPurposeId is a KeyPurposeIdwhichthat the relying party or the relying party software accepts. Examples of"Permitted KeyPurposeId" are,Permitted KeyPurposeId include the presence of thisgeneral document signinggeneral-purpose Document-Signing KeyPurposeId and/orprotocol specific document signing-type KeyPurposeIds.the protocol-specific KeyPurposeIds that are relevant to Document Signing. If a KeyPurposeId of the certificate meets the condition set by a"Permitted KeyPurposeId"Permitted KeyPurposeId restriction, the certificate is acceptable. Otherwise, the relying party or the relying party software rejects the certificate.</t> </dd> </dl> </li> </ul> <t>When a single application has the capability to process various data formats, the software may choose to make the excluded and permitted decisions separately in accordance with the format it is handling (e.g.,TEXT,TEXT and PDF).</t> </section> <section anchor="implications-for-a-certification-authority"> <name>Implications for a Certification Authority</name> <t>The procedures and practices employed by a certification authorityMUST<bcp14>MUST</bcp14> ensure that the correct values for the EKU extension are inserted in each certificate that is issued. Unless certificates are governed by avendor(s) specificvendor-specific PKI, certificates that indicate usage fordocument signing MAYDocument Signing <bcp14>MAY</bcp14> include the id-kp-documentSigning KeyPurposeId. The inclusion of the id-kp-documentSigning KeyPurposeId does not preclude the inclusion of other KeyPurposeIds.</t> </section> <section anchor="security-considerations"> <name>Security Considerations</name> <t>The usage of the id-kp-documentSigning KeyPurposeId is to provide an alternative to id-kp-emailProtection being used for non-email purposes and id-kp-codeSigning being used to sign objects other than binary code. This extended key purpose does not introduce new security risks but instead reduces existing security risks by providing means to separate other extended key purposes used for communicationprotocols namely,protocols, which include TLS (id-kp-clientAuth)or S/MIME (id-kp-emailProtection) etc.and S/&wj;MIME (id-kp-emailProtection), in order to minimize the risk of cross-protocol attacks.</t> <t>To reduce the risk of specific cross-protocol attacks, the relying party or the relying party software may additionally prohibit use of specific combinations of KeyPurposeIds.</t> <t>While a specific protocol or signing scheme may choose to come up with their own KeyPurposeIds, some may not have significant motive or resources to set up and manage their own KeyPurposeIds. Thisgeneral document signinggeneral-purpose Document-Signing KeyPurposeId may be used as a stop-gap for those that intend to define their owndocument signingDocument-Signing KeyPurposeId or those who do not intend to set up a KeyPurposeId but still would like to distinguishdocument signingDocument Signing from other usages.</t> <t>Introduction of this id-kp-documentSigning KeyPurposeId does not introduce any new security or privacy concerns.</t> </section> <section anchor="iana-considerations"> <name>IANA Considerations</name> <t>IANAmade one assignment forhas registered theid-kp- documentSigning object identifier (OID), as defined in Section 3.1,following OID in the "SMI Security for PKIX Extended Key Purpose"(1.3.6.1.5.5.7.3) registry. The other assignment was made forregistry (1.3.6.1.5.5.7.3). This OID is defined in <xref target="ext"/>. </t> <table anchor="iana_table1"> <name></name> <thead> <tr> <th>Decimal</th> <th>Description</th> <th>References</th> </tr> </thead> <tbody> <tr> <td>36</td> <td>id-kp-documentSigning</td> <td>RFC 9336</td> </tr> </tbody> </table> <t>IANA has also registered theid-mod-docsign-ekufollowing ASN.1module<xref target="X.680"/>object identifier (OID), as defined in Appendix A,module OID in the "SMI Security for PKIX Module Identifier"(1.3.6.1.5.5.7.0) registry.</t>registry (1.3.6.1.5.5.7.0). This OID is defined in <xref target="asn1-module"/>.</t> <table anchor="iana_table2"> <name></name> <thead> <tr> <th>Decimal</th> <th>Description</th> <th>References</th> </tr> </thead> <tbody> <tr> <td>104</td> <td>id-mod-docsign-eku</td> <td>RFC 9336</td> </tr> </tbody> </table> </section> </middle> <back> <references> <name>References</name> <references> <name>Normative References</name> <reference anchor="X.680"> <front> <title>Information technology - Abstract Syntax Notation One (ASN.1): Specification of basic notation</title> <author> <organization>ITU-T</organization> </author> <dateyear="2015" month="November"/> </front> <seriesInfo name="ISO/IEC" value="8824-1:2015"/> </reference> <reference anchor="RFC5280"> <front> <title>Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile</title> <author fullname="D. Cooper" initials="D." surname="Cooper"> <organization/> </author> <author fullname="S. Santesson" initials="S." surname="Santesson"> <organization/> </author> <author fullname="S. Farrell" initials="S." surname="Farrell"> <organization/> </author> <author fullname="S. Boeyen" initials="S." surname="Boeyen"> <organization/> </author> <author fullname="R. Housley" initials="R." surname="Housley"> <organization/> </author> <author fullname="W. Polk" initials="W." surname="Polk"> <organization/> </author> <date month="May" year="2008"/> <abstract> <t>This memo profiles the X.509 v3 certificate and X.509 v2 certificate revocation list (CRL) for use in the Internet. An overview of this approach and model is provided as an introduction. The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms. Standard certificate extensions are described and two Internet-specific extensions are defined. A set of required certificate extensions is specified. The X.509 v2 CRL format is described in detail along with standard and Internet-specific extensions. An algorithm for X.509 certification path validation is described. An ASN.1 module and examples are provided in the appendices. [STANDARDS-TRACK]</t> </abstract>year="2021" month="February"/> </front> <seriesInfoname="RFC" value="5280"/> <seriesInfo name="DOI" value="10.17487/RFC5280"/> </reference> <reference anchor="RFC2119"> <front> <title>Key words for use in RFCs to Indicate Requirement Levels</title> <author fullname="S. Bradner" initials="S." surname="Bradner"> <organization/> </author> <date month="March" year="1997"/> <abstract> <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t> </abstract> </front> <seriesInfo name="BCP" value="14"/> <seriesInfo name="RFC" value="2119"/> <seriesInfo name="DOI" value="10.17487/RFC2119"/> </reference> <reference anchor="RFC8174"> <front> <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title> <author fullname="B. Leiba" initials="B." surname="Leiba"> <organization/> </author> <date month="May" year="2017"/> <abstract> <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t> </abstract> </front> <seriesInfo name="BCP" value="14"/> <seriesInfo name="RFC" value="8174"/> <seriesInfo name="DOI" value="10.17487/RFC8174"/>name="ITU-T Recommendation" value="X.680"/> </reference> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.5280.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/> <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/> </references> <references> <name>Informative References</name><reference anchor="RFC7299"> <front> <title>Object Identifier Registry for the PKIX Working Group</title> <author fullname="R. Housley" initials="R." surname="Housley"> <organization/> </author> <date month="July" year="2014"/> <abstract> <t>When the Public-Key Infrastructure using X.509 (PKIX) Working Group was chartered, an object identifier arc was allocated by IANA for use by that working group. This document describes the object identifiers that were assigned in that arc, returns control of that arc to IANA, and establishes IANA allocation policies for any future assignments within that arc.</t> </abstract> </front> <seriesInfo name="RFC" value="7299"/> <seriesInfo name="DOI" value="10.17487/RFC7299"/> </reference><xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7299.xml"/> </references> </references> <sectionnumbered="false" anchor="appendix-a-asn1-module"> <name>Appendix A. ASN.1numbered="true" anchor="asn1-module"> <name>ASN.1 Module</name> <t>The following ASN.1 <xref target="X.680"/> module provides the complete definition of theDocument SigningDocument-Signing KeyPurposeId.</t><artwork><![CDATA[<sourcecode type="asn.1"><![CDATA[ DocSignEKU { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-docsign-eku(104) } DEFINITIONS EXPLICIT TAGS ::= BEGIN -- EXPORTS ALL -- -- IMPORTS NOTHING -- -- OID Arc -- id-kp OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) kp(3) } --Document SigningDocument-Signing Extended Key Usage -- id-kp-documentSigning OBJECT IDENTIFIER ::= { id-kp 36 } END]]></artwork>]]></sourcecode> </section> <section numbered="false" anchor="acknowledgments"> <name>Acknowledgments</name> <t>We would like to thankRuss Housley<contact fullname="Russ Housley"/> for verifying the ASN.1 module. Additionally, we would like to thankCorey Bonnell, Wendy Brown, Russ Housley, Prachi Jain, and Stefan Santesson<contact fullname="Corey Bonnell"/>, <contact fullname="Wendy Brown"/>, <contact fullname="Russ Housley"/>, <contact fullname="Prachi Jain"/>, and <contact fullname="Stefan Santesson"/> for their comments.</t> </section> </back><!-- ##markdown-source: H4sIAAAAAAAAA7Va63IbN5b+j6fAKn+kGpKS7NhxWDW1YSTZ4US3NeW1d5PU FNgNkhg1Gz1At2SOyql5kN2qfZZ9lHmS/c4ButlNUrKzu4l/ROwGDs71Oxd0 v98XpSkzPZRvdK6dyuR15QrrtTz7WOo81an8Ua/kO6/mWu6f/fjuQM6sk6c2 qZY6L+XEzHOTz+WHwYujb+WJdqWZmUSV2gs1nTp9N5TYtHOPoGVz61ZD6ctU iNQmuVqCk9SpWdk3upz1M7UsfD+NO33Y2Ne3Vf/opTCFG8rSVb58dnT07dEz catX99alQznOS+1yXfZPiZRQTquhnJydCLy+nTtbFUN5Prq4nsj3eED8v6GH 4k7nlR4KKeOavXOzNCV0MEpTUxqbQz8XOlmo3PilZ6mufxx/kCpP5eRifHEm 95nswR5olKsCwux1TqDnS2UyPPeF8svvSMqBdXN6oVyywItFWRZ+eHhI6+iR udODetkhPTicOnvv9SFTOKSdc1MuqulQBnXdzw93aEwIX4LPP6vM5uBrBQv5 pXLln/9aWZhrKHMrCjOUP5U26UlvXen0zOOv1ZL++EUIVZUL66CePo6U0uTY dDOQ49Ly72C8G5Wqhbm1zWNwDXX9TZH62AhXF/LkatCT5zenA16hg0bKuHNg Sjsoqmlmku/m9GqQ2OXmoVe31bRzrF3aWbU0rRfdg0/N3JB79uAcSffcuHVg aesfSNWPnDsZyJsKfuVaB0+0yttPu6f6/LlL24d5LP+OnzJ1kVu3xNo79roP g5evjoa8HO4TwnJvnM/CGpvLEr6X28zOV7IvR1NfOpUgnlZ5qT7KS1uGVVc5 QnU0uRwcH4C/QichJOmVncmp8iaBscPivXhailgcgsSdXk61k8+Ojl/EN43V 438QEAF2865/Ex957Yz2BmyuF40nV4fjs5OhfPXq2df94yHTE/1+X6rItRBv X5/IF89eHUkfWNQepO4Yg3SNPYhoWURAMikcmtY5L/YBShGoxqkPmBQgKGlB EMy1MF7WwSBTPTM5jlFyHsBO1LSbJTFgZJs+Uzd5klWedGhgh0UXH0UbH5l5 H7UdmArezNJ0+BNbOKqKIovG8kCKlXT6r5VxGkeqMpwLOG2OEFMtC6c9kSAQ 4lXqM+Jgj8lTZiEVkAaQCZOTkES/xSBCgxarJNFFqaaZFnjARzzF9yAYemnS FDvEV4TGzqZVQi+FeHj4J1ieDP/p0+9p+nEuVUTtXk1ddPbKhbrTEFDzShxZ 5aQIUsJ4dDmC6rEQYORWcg/oLiY6qZwpV2vc7+TISHhPPjz8MyT85tm33376 NJDvFybTsmIHgUOAuthT+areip3sPHtdG8FtpyqFbREqJtF8ZPCibBVyHmzX FrhHlOEn2Jjb2uHIJaKrd8nrj2QuIMxKKE9OotOdOZoiCC5ROUcPG25wCNC9 Ysv0b4s+g9u1Qx5Jgr7D48SmunYQEFcS+TW1rh/iMBVbQVbzuuW/0REQMQJ2 TYzDe0pnCTznnuWms5rlnI8POSG3dYQMC2/OPLMeTtw8qRcwFuszYrmwUBOC Fhl/rikgUw4KMuJjB+rE+hXMs+TwTRRpqcqhcOhGU/DB64x1HuQFO6Ai94N7 kjaXBQG6r5KFVAAunaByIVYTtypKO3eqWJhEqLnJyA9tQKItba1ZIL7uyGJE X0F7/9qxgOzGQ0APR96Kd0AGRW4u58gKjlZPVyx5sGKwKBdK5NfhoZdsJnJB QzWYLWDPaeA2sTCXAzyMigIvnAFakMJBZ2m8aj8k4RmLIDyrcap7bV5PvSDj kWpthSInrUPLEFvI9CjUECfEAofnmuNNfmFGQqcswyqd3xlnc1ZlogjoA24R xFqg3zIEWW0lELmHNRaIBpGaGXysykryjlRD8iX0C33fkHOCV/BvyhCcpZyp O+sIT2k1CbEZGVvpRzSOtrY2WytS3DBRJMfn70yA+edwtoMGokYDQvMTm9/R KkpQ5F6nRJNh1rO4TJDKcC/3Lt5NbvZ64f/y8or/fnv2L+/Gb89O6e/JD6Pz 8+YPEVdMfrh6d366/mu9E7XjxdnladiMp7LzSOxdjP4Nb4irvavrm/HV5eh8 L+TrthbIw0NmYx9F/qTAVLCi9okz0+D7359c//d/HX8tQ756dnwMNI8/Xh1/ 8zV+AHjycJrN4W3hJ7QPTC0KrRxHUJbBlwpTAnZ65NZ+Ye9zSV4BbUKdu1LI 7nYp2NJ36rnaoGTzbv5gAK5FXttvRKjSkvLhoUnGUOnPP5mff+FAkj//tN0A /vxLq7gBL7Hy6AlsyLeKBzY6a2YaEYXEQvMRY7UB9XU1MtgTLYYYqht2IzzV PC4RbKbIiFE4HDhrqJF51/UNHdQqTmSuwQiFjANKQit/02yjbV56yIwSvVID Rg2aNNHSaAB8f6aUg2fuKOW2W+y1fteVnWgqO2Zjl2U7NZ38XWo6Cm3CNbm3 uXBHiAHzkHAYDIHGJaOxr9t+S4osW+kGTzz2MXoV2sKqqDuYzSWQk9SQGA8E bXZik2jMEQQKcYW/FUg4DwXeoynGXqxjqKVkb3yRqRX/pKYK54klGjJPHok2 hjIl5WV0v7PyXhFoO0VlFbGaEy00zAaiIB9gpWeOxVKhR8+5NvmKil30CSmp b8vCT0U3qbA9PZEPX8EVPolOPKyr5boR2Cp8Ww7UZEgOTVHPREJJ14rj6DY+ hKaLOq/jgaiENMdFTziJg6BpaWD4O5WZNFDu9CecR6dNQUG2/0uVc5EY7FPG hFF1vb9Xp9aGOVroNWVdETrYTkkkudAIodbhWK45pmNCLcHsRJfusutDKw2J UPxrDiauLolmwonPaFQxQyF+/fVXdLuwb13Axy5cDod/lHKCJHd2eXImJ+N/ P5P7x4PBxejDgbx63UFpEOiAdth79f2fzk5u5Pj07PJm/Hp89pbPehK4u0JA SIBXQAtb1H3/Jg4Y7yvteqQObdjJQbysC9/c5v369+D/JfWMmwaamQG97i6q Njv8tUwfhBEtn4MVbBo0sSnYAnjNTd3a9AEi6hwkHnUdctgvQafa/CzqDoux JeMw5AGatvvHB+viKu23h0T7zw+Am+n+y4NQjiBEsbqZpPjYdO6/OJDLZvRI v4pb83H/mwP5XH6qWdlKC4+wxlwx789fYjcJg1Lknf9fwZZqA5cQV5Vbp0rC Hy7iKVey7qI665MadRMCcx8qmtnl55OA7CYBsZ0EmL/PJQG5lQTEE0lgDf2y gX5GvpjqWA5VVo6gV3SE5L658ezYSVIlYgpDWq3DtOODodnkJ+zbVLyEhjTF UTm146W8p9Iy9PGxBQjuVq5adQFKXIbRavoXnZQ7QIE1zljO7O2UiaFVmOa4 dsxs5OTtyOlR84ROCqtDyAkqjGArtgQzV+qC4jez9zKF58NP2sEdmaPhasDv GXo3e88zArJMWoUZCMc6uNAfFXViWyi17w/CSG8NIuKpcmwg3mpfOpM0QLFj NVVA2pk7UjVKtkZUgh1nl2I/ZJGZmYPLlBPgQaiEw5gB/K4TV1dRvA86oiqj L8ezOO2hGECv7dq8UZasCz+nsxXrRjl4Qqgjteg+Xfv5dopo1YnbB/+GU+MT sePEJqR22ki10x57BfggXOSM1DF52/kKasBLnuA4uzBTU8ZiOuHuQ3Eho2D3 Tg5i85DaIbuaNqs7QxK676COv547sM8myCFNWqvxC6m1Knfog0qiwJ9o84eT pyavE9HGqT26gCi1Spl7Cvs5Kvf2koEYcbyBJxdn/bmoiXMUPUU/uG6rvCA3 aeadJ226ZOqkbOfxWmDk+JmcWlR1//j7f5x9jMHVPucff/9Pdge8v2YNlDsW 6I/Gl56byg3N7XSv2pkaZPZSA5bb3inA7FMszYzzZa8Oj/wJSqTUp5iPzrnz pLW3DsOq4ZNMUfB1J6RrbPgNaml8AJ57BjCEd7P593YevCc5LNuxQp6wY179 RZET2xTR7ja6Zd6AIEVtENvKS+jSdOnr3BiG+gFyYrJ7SpEt8/12p3KaUqVv Nz/MdrDgbj/YbejHHZ4sLb/Q0jsEaHgNWL1h5/bJYisWt40NZh6bwne9EdFy GPCrtInNmu5ga1ufLsLFJoh+gdVlY3XRWL02unpapW2bb9puI63JK8po91xb PuUZ4nHPkF3PeE8YUoN0Z/i0aObaRT0Vp2QV89+dcsZWnu5ilQiXvnHi3BzK VwoLS+U4Ni7VbUhAuvZ9grCiMXdKJXMMFXAP7ngoTtJbl9LtyboJD+fFITWq yzQjRezrwXzQEzdnH2568vr09QGPgMfL1mRrxvcA6xaA5BzxnTHECzVaEw9h YlxfIwFeQciuQoHYhgWioWoaPEgUwI+qPTuDBI6KWBSEVRxTbN2OxhYBRX2Y igmG884wLM7QuRlOB/JdnpElti6N2vN1FS9AqDxpnP76x3Gvuy2Qrkt9nm+I XTdOPBqMpegTA75urr/heWSnof6SjTicL2dKQe3U+sQ2Jcu9TjdcyeiPVAPB ws315hfwEJog+MQd1U8qFyqjtpe/guD2aNeVImo/ItSMkWk+wUuaSRVPSbfv HVv7QJt0Lu00RK5dd3VUGbkVXyIOwrBj5/1Irb7W1VCu75seXTrjbz2VfaIu 11DnV+zpVNQQJ5trV1ET9C60ocRmDFcRWNzFi1/rApl3WeV13NSA7PkDlWyF 6D2fyP2omYz6TArPA4K3eGW5v1PlB1KXyWD9gQABjsnNkkbmjIsQgEyeOOt9 v8kDqixVcks+c2Oj+J3lTcjs3tfbTntUJj+S8ggPVfNtVpjMhnKaJ5/r08ST 5S+DNl3TqzV7DWM0CojO5JMFWrINFAZlBEDBUCriHeR9vlm/exs3kvvwvS8T JbQAFiwtez/yO0DSVo5chv2gJMrk2UuVU4g9Qj9+6VJ/1vL09x+tISj1V5C5 tEV/roqIoiwX0CuO2MOV5ix20fH0p09oyNwvsNfWIROIiVqqja9S0CwhRLJM 3tsqS2VmbnW4QODAqYxfNKc216HUVsc4ZggKHwisPzdpaprfgo3r4Ebd2w1w LnjMnUqa6+wAjvy9yCYw8kP+ZIAm6+E7C9ZZnawCU2KTq4BP7cvY/avx6UEv NMPhghhROYnI+Hxw3KvnoL/pO5X948HzwcvB8eAF/n0zeH6AKJtD224V5lms V9Him4ZMLE9LgKVNSa20hr4ylPzdmcDTCuH0E3/R9suXSjQqCrBpPsrR5wS6 CPTHDcEtaY5a0oQPkqaAF7LV+pRB4DZSEw/DvKKv33T6x72ZyqCiT5szprA+ ShdTWN2XxPYnbe7D6+5pa2jazeVxloxV9J4KmP/DyPjz4+Jgs/2jsH7bgvvH R18fyE/UuZyevR5fjukefSLPPlyfj0/GN/Jm9GbC420s+P7szfiS/oB6seDq 7c1Ejs7P8TM+HF+Eh5dXNz+ML9+sX8D8cuSS+ODJObp8CJz+fiq5LWj7p8ja lrl2TPpabG+ByrYULER74E43R5en9dx9lNzm9j7T6ZzH3rv98L3ewEWqW27l 2wrl6g/oGjIdwgN1qpmt6vF6218HYtTKlD15v5viiXUg9b3Nc51lPfkeouOn A+j3+DQRT0M/4Gj8Lf+kTPwMYlLqGYqpCTIaquh4BRlyBtUoPNMX/wMPiXWS cy4AAA== --></rfc>