From 7257aaafd3c0935146a57a74e5c3018cbb9627fa Mon Sep 17 00:00:00 2001 From: tarxvf Date: Sat, 8 May 2021 18:35:37 -0400 Subject: [PATCH] nonce-> meta field. Meta field possible values. fix phrasing in aes sections. Fix a few small bugs. --- docs/application_layer.rst | 123 +++++++++++++++++++-------- docs/data_link_layer.rst | 65 ++++++++------ docs/ip_encapsulation.rst | 2 +- docs/physical_layer.rst | 5 +- images/link_setup_frame_encoding.pdf | Bin 8249 -> 8446 bytes images/link_setup_frame_encoding.svg | 30 ++++--- 6 files changed, 148 insertions(+), 77 deletions(-) diff --git a/docs/application_layer.rst b/docs/application_layer.rst index 5ca1046..006a60e 100644 --- a/docs/application_layer.rst +++ b/docs/application_layer.rst @@ -42,8 +42,8 @@ The data type specifier is used to compute the CRC, along with the payload. Encryption Types ---------------- -Encryption is optional and disabled by default. The use of it is only -allowed if local laws allow to doso. +Encryption is optional. The use of it may be restricted within some radio +services and countries, and should only be used if legally permissible. Null Encryption ~~~~~~~~~~~~~~~ @@ -52,6 +52,54 @@ Encryption type = :math:`00_2` No encryption is performed, payload is sent in clear text. +The "Encryption SubType" bits in the Stream Type field then indicate +what data is stored in the 112 bits of the LSF META field. + +.. list-table:: + :header-rows: 1 + + * - Encryption SubType bits + - LSF META data contents + * - :math:`00_2` + - UTF-8 Text + * - :math:`01_2` + - GNSS Position Data + * - :math:`10_2` + - Reserved + * - :math:`11_2` + - Reserved + +All LSF META data must be stored in big endian byte order, as throughout +the rest of this specification. + +GNSS Position Data stores the 112 bit META field as follows: + +.. list-table:: + :header-rows: 1 + + * - Size, in bits + - Format + - Contents + * - 32 + - 32-bit fixed point degrees and decimal minutes (TBD) + - Latitude + * - 32 + - 32-bit fixed point degrees and decimal minutes (TBD) + - Longitude + * - 16 + - unsigned integer + - Altitude, in feet MSL. Stored +1500, so a stored value of 0 represents -1500 MSL. Subtract 1500 feet when parsing. + * - 10 + - unsigned integer + - Course in degrees true North + * - 10 + - unsigned integer + - Speed in miles per hour. + * - 12 + - Reserved values + - Transmitter/Object description field + + Scrambler ~~~~~~~~~ @@ -110,25 +158,46 @@ Advanced Encryption Standard (AES) Encryption type = :math:`10_2` -This method uses AES block cipher in counter (CTR) mode. 96-bit nonce -value is extracted from the NONCE field, as the 96 most significant -bits of it. The highest 16 bits of the counter are the remaining 16 -bits of the NONCE field. FN field value is then used as the -counter. The 16 bit frame counter and 40 ms frames can provide for -over 20 minutes of streaming without rolling over the counter [#fn_roll]_. This -method adapts 16-bit counter to the standard 32-bit CTR for the -encryption. FN counter always start from 0 (zero). +This method uses AES block cipher in counter (CTR) mode, with a 96-bit +nonce that should never be used for more than one separate stream and a 32 bit CTR. + +The 96-bit AES nonce value is extracted from the 96 most significant +bits of the META field, and the remaining 16 bits of the META field +form the highest 16 bits of the 32 bit counter. The FN (Frame Number) +field value is then used to fill out the lower 16 bits of the counter, +and always starts from 0 (zero) in a new voice stream. + +The 16 bit frame number and 40 ms frames can provide for over 20 minutes +of streaming without rolling over the counter [#fn_roll]_. .. [#fn_roll] The effective capacity of the counter is 15 bits, as the - MSB is used for transmission end signalling + MSB is used for transmission end signalling. At 40ms per + frame, or 25 frames per second, and 2**15 frames, we get + 2**15 frames / 25 frames per second = 1310 seconds, or 21 + minutes and some change. -The nonce value should be generated with a hardware random number -generator or any other method of generating non-repeating -values. Nonce values must be used only once. It is obvious that with a -finite number of nonce bits, the probability of nonce collision -approaches 1. We assume that the transmission is secure for 237 frames -using a single key. It is recommended to change keys after that -period. +The random part of the nonce value should be generated with a hardware +random number generator or any other method of generating non-repeating +values. + +To combat replay attacks, a 32-bit timestamp shall be embedded into the +cryptographic nonce field. The field structure of the 96 bit nonce is +shown in Table 9. Timestamp is 32 LSB portion of the number of seconds +that elapsed since the beginning of 1970-01-01, 00:00:00 UTC, minus leap +seconds (a.k.a. “unix time”). + +.. list-table:: 96 bit nonce field structure + :header-rows: 1 + + * - TIMESTAMP + - RANDOM DATA + - CTR_HIGH + * - 32 + - 64 + - 16 + +**CTR_HIGH** field initializes the highest 16 bits of the CTR, with +the rest of the counter being equal to the FN counter. .. warning:: In CTR mode, AES encryption is malleable [CTR]_ [CRYPTO]_. @@ -140,24 +209,6 @@ period. In the future, use of a different mode, such as Galois/Counter Mode, could alleviate this issue [CRYPTO]_. -To combat replay attacks, a 32-bit timestamp shall be embedded into -the NONCE field. The field structure is shown in Table 9. Timestamp is 32 LSB portion of -the number of seconds that elapsed since the beginning of 1970-01-01, -00:00:00 UTC, minus leap seconds (a.k.a. “unix time”). - -.. list-table:: NONCE field structure - :header-rows: 1 - - * - TIMESTAMP - - NONCE - - CTR_HIGH - * - 32 - - 64 - - 16 - -**CTR_HIGH** field initializes the highest 16 bits of the CTR, with -the rest of the counter being equal to the FN counter. - .. [CTR] McGrew, David A. "Counter mode security: Analysis and recommendations." Cisco Systems, November 2, no. 4 (2002). .. [CRYPTO] Rogaway, Phillip. "Evaluation of some blockcipher modes of operation." Cryptography Research and Evaluation Committees (CRYPTREC) for the Government of Japan (2011). diff --git a/docs/data_link_layer.rst b/docs/data_link_layer.rst index 4458abc..d885daa 100644 --- a/docs/data_link_layer.rst +++ b/docs/data_link_layer.rst @@ -2,22 +2,28 @@ Data Link Layer =============== The Data Link layer is split into two modes: -* Packet mode: data are sent in small bursts, on the order of 100s to 1000s of bytes at a time, after -which the physical layer stops sending data. eg: messages, beacons, etc. -* Stream mode: data are sent in a continuous stream for an indefinite amount of time, with no -break in physical layer output, until the stream ends. eg: voice data, bulk data transfers, etc. +* Packet mode + Data are sent in small bursts, on the order of 100s to 1000s of bytes + at a time, after which the physical layer stops sending data. e.g. messages, beacons, etc. + +* Stream mode + Data are sent in a continuous stream for an indefinite amount of time, + with no break in physical layer output, until the stream ends. e.g. voice data, + bulk data transfers, etc. When the physical layer is idle (no RF being transmitted or received), -the data link defaults to packet mode. ~~To switch to stream mode, a -start stream packet (detailed later) is sent, immediately followed by -the switch to stream mode; the Stream of data immediately follows the -Start Stream packet without disabling the Physical layer. To switch -out of Stream mode, the stream simply ends and returns the Physical -layer to the idle state, and the Data Link defaults back to Packet -mode.~~ +the data link defaults to packet mode. -As is the convention with networking protocols, all quantities -larger than 8 bits are encoded in bigendian. +.. ~~To switch to stream mode, a +.. start stream packet (detailed later) is sent, immediately followed by +.. the switch to stream mode; the Stream of data immediately follows the +.. Start Stream packet without disabling the Physical layer. To switch +.. out of Stream mode, the stream simply ends and returns the Physical +.. layer to the idle state, and the Data Link defaults back to Packet +.. mode.~~ + +As is the convention with other networking protocols, all values are +encoded in big endian byte order. Stream Mode ----------- @@ -53,7 +59,7 @@ the **Link Setup Frame (LSF)**, and is not part of any superframes. * - DST - 48 bits - - Destination address - Encoded callsign or a special number (eg. a group) + - Destination address - Encoded callsign or a special number (eg. a group) * - SRC - 48 bits - Source address - Encoded callsign of the originator or a @@ -61,9 +67,9 @@ the **Link Setup Frame (LSF)**, and is not part of any superframes. * - TYPE - 16 bits - Information about the incoming data stream - * - NONCE + * - META - 112 bits - - Nonce for encryption + - Metadata field, suitable for cryptographic metadata like IVs or single-use numbers, or non-crypto metadata like the sender's GNSS position. * - CRC - 16 bits - CRC for the link setup data @@ -95,11 +101,12 @@ the **Link Setup Frame (LSF)**, and is not part of any superframes. The fields in Table 3 (except tail) form initial LSF. It contains all information needed to establish M17 link. Later in the transmission, the initial LSF is divided into 6 "chunks" and transmitted -interleaved with data. The purpose of that is to allow late-joiners to -receive the LICH at any point of the transmission. The process of -collecting full LSF takes 6 frames or 6*40 ms = 240 ms. Four TAIL -bits are needed for the convolutional coder to go back to state 0, so -also the ending trellis position is known. +beside the payload data. This allows late-joiners to +reconstruct the LICH after collecting all the pieces, and start decoding +the stream even though they missed the beginning of the transmission. +The process of collecting full LSF takes 6 frames or 6*40 ms = 240 +ms. Four TAIL bits are needed for the convolutional coder to go back to +state 0, so the ending trellis position is also known. Voice coder rate is inferred from TYPE field, bits 1 and 2. @@ -137,7 +144,7 @@ Subsequent frames The most significant bit in the FN counter is used for transmission end signalling. When transmitting the last frame, it shall be set to 1 -(one). +(one), and 0 (zero) in all other frames. The payload is used so that earlier data in the voice stream is sent first. For mixed voice and data payloads, the voice data is stored first, then the data. @@ -233,8 +240,8 @@ detecting all errors up to hamming distance of 5 with payloads up to As M17’s native bit order is most significant bit first, neither the input nor the output of the CRC algorithm gets reflected. -The input to the CRC algorithm consists of DST, SRC (each 48 bits), 16 bits of TYPE field and 128 -bits NONCE, and then depending on whether the CRC is being computed +The input to the CRC algorithm consists of DST, SRC (each 48 bits), 16 bits of TYPE field and 112 +bits META, and then depending on whether the CRC is being computed or verified either 16 zero bits or the received CRC. The test vectors in Table 6 are calculated by feeding the given @@ -293,6 +300,16 @@ Raw packet frames have no packet type metadata associated with them. Encapsulat format is discussed in :ref:`packet-superframes` in the Application Layer section. This provides data type information and is the preferred format for use on M17. +When encryption type is :math:`00_2`, meaning no encryption, the +encryption subtype bits are used to indicate the contents of the +META field in the LSF. Since that space would otherwise go be unused, +we can store small bits of data in that field such as free text or the +sender's GNSS position. + +Encryption type and subtype bits, including the plaintext data formats +when not using encryption, are described in more detail in the Application +Layer section of this document. + Currently the contents of the source and destination fields are arbitrary as no behavior is defined which depends on the content of these fields. The only requirement is that the content is base-40 encoded. diff --git a/docs/ip_encapsulation.rst b/docs/ip_encapsulation.rst index ae0d0a9..736be06 100644 --- a/docs/ip_encapsulation.rst +++ b/docs/ip_encapsulation.rst @@ -40,7 +40,7 @@ Later specifications may require this port. - Random bits, changed for each PTT or stream, but consistent from frame to frame within a stream * - LICH - sizeof(LICH)*8 bits - - A full LICH frame (dst, src, streamtype, nonce) as defined earlier + - A full LICH frame (dst, src, streamtype, META field) as defined earlier * - FN - 16 bits - Frame number (exactly as would be transmitted as an RF stream frame, including the last frame indicator at (FN & 0x8000) diff --git a/docs/physical_layer.rst b/docs/physical_layer.rst index 723d310..e5ee2af 100644 --- a/docs/physical_layer.rst +++ b/docs/physical_layer.rst @@ -101,7 +101,7 @@ Link setup frame (LSF) ECC stages for the link setup frame -240 DST, SRC, TYPE, NONCE and CRC type 1 bits are convolutionally +240 DST, SRC, TYPE, META and CRC type 1 bits are convolutionally coded using rate 1/2 coder with constraint K=5. 4 tail bits are used to flush the encoder's state register, giving a total of 244 bits being encoded. Resulting 488 type 2 bits are retained for type 3 bits @@ -241,8 +241,7 @@ The puncturing schemes are defined by their partial puncturing matrices: .. math:: :nowrap: - .. only:: latex - \setcounter{MaxMatrixCols}{32} + \setcounter{MaxMatrixCols}{32} \begin{align} P_1 = & \begin{bmatrix} diff --git a/images/link_setup_frame_encoding.pdf b/images/link_setup_frame_encoding.pdf index e9bd3e9d1db0a30b5a3da5a0f6fca10cd8358ea1..8ccd18af802faeea161f8d17f08ef0bd1ef1815e 100644 GIT binary patch delta 6646 zcmZX2XEYpax3(6&j@}7_sDr`iM2p^Ql;|RQZ!toY(HXr4A&fFg^cKDM9wm$x(OVF~ zdET?mTIc)Dvw!S;t$kl>m+RlYTjd_*leMAR^zwvVr^qwUo8%s*V9Oywkj;RUt>?{EL^z6FM!tQf1CXD&hk5@e}2cO}+=$W$rooe0b^FWjs z$|ChJGK~AIi4f|0U;v$3K@m^0tT|%rpJ5mTgSCmss)}$$X?=*6(R zTZs2VhvXrA!i}!Aintpwj{DM(1owPj9sY)rAv`U_?XGRclskW!(p}!fDCIOC)@S#) z4-$mxKRL`n;Z&gsA6Uq)FVtQ|KVN2zR|=I9h{Jjx1t%xI#mB2*i0WW&lH({C=INs_sDh1myPqDp9ZbF!qP zX8*jZJ)TUELOr4l`|c4v_^C+({M;?o+o}IU&JzAvK56u`4k}Mfo9-VE=q-n5aW=1# z5^m-TFqOZ=3kLt$JYOm{DebdM2;Tl{J3s%iW0{O4?(a_V-;clO%k4BpUHNg0nTaue zlhdP%wRmtGaQdZPDJ)*#$|p@ju>`Y!Ml97p){0j1+~S<$<`-yHKguI)Eva1^st-n9@1$6=gD31B@P4ss;7OsWXt7+AW4QUa66DF0&e4P(!!JfxduB~q! zYgU6#7d7MC>#ozWgOGkwC!g=jeVe?Thv>B=uh`YdZM@9hv)#ZBe7AJm$=pT7j`O&+ zEhA>NT;8;fK4MZtVHUx0Fqtp}!3~_4x#&<~Fa%#l2H)Gq%ih`*KOk?{BshdZso=@* zp{>m^$Z{Q?{gE9${t@)yOikleKnzG(o{2wPk-e=0toX(kPdQMDCG2B#?J%2e34tzK zy}V$36}J4+0xpKvA%A~5rFIHSkaEVg$r6F;ZsUze|tFJh`AkmU2_Eu6QhdGj3*%FhD>F&;Wn*CG~<%k7g?yyJu~C6VPmkJ-AX9)L`Xo zZ$)0kwx;uZva}|y3+G8*@IhR2gR~k8oF@{6=f<6KvW<%6f@wLL3o{pTZgP<)hQc3u zzE66O>Z1TxQM+|pOky`}0nU(xt(~07zO8wT^>jL;aKdnH?53M?p>*zLrgf-|+Yubm z-aA5frJ;32JPp8l+F0t+H>OSzg>mb+i z0_-(bB!vs^u8S?yW$)mBbu6J-H<_^)i@}AmUz^JQ!fkoC+`XT8e{Im^S=F6Qu59&( zezB5x@bp`3FHuIme!Rr#mB#Mq+V@b$ZbiaF5ay&4n_Y+Y5y_I@dNj~f z&{YEDcXI&btTAu3whh#S;|jlyIZqrcs)kh1CZ0U+Vy~9tthVWUMsfy~Dwt?cYO)0< zooB^}bDXQ%q}qx?lijzKrPO@wSBh>B-9z$S%qjcrz-6~TvM z`r{pjIWLVxkJQfB0lQH3%H(P5OrVdS40Cb9mY9=wAk3&oBwc)gMO{y&q3&0;3qm4y z!Z5S^-7_WMu1vVaC=HR$FJajfmD8g85M4j<6NAWVf)~l(y(CfEa)(-EX6lW0m zAb?diV<&L7-54pf0>oBd{4ej zWZ1G_u0?35FA*L1M%=tnAHiF-Dat&SZWAL8+w@nx70A>qK_L$7hRbW#y-il7I*3P9 z4@*O|NFS|thJ?RF{v3!eOSwf=KfT+>Tx!Ep7rfLg0*wp(@$2=g!vT3*%lKV!M!H`J z7(TwfZmpalON?6WC~f&gmCuWpN^^Kc0mx}`a!PMIIg-|NiZRt=&1#AshfK{VD~`l- zlE#x$wwFH90lW*nhCQfN* z$aZ3U0;P^aEmj4(jAGu}+2 zgol<_3BMcrS7pAgL^NF}oRbJ-dN0TRl9X7C+q>ELafRPqv5oq^P`Tu@s<>ij%R(GA z5S0AHM{`TGF3+pRMf27SguCqg+H6&ZRWG461lr@_VdtTI7Wt|6d>Z%)%%{S7QEz9r zx>J^uqv?eke2;Hie;F&qQ7;kN?d!U`Xt6JIdj?Njw-Bt7Qao(u#X=ayMq;R>Uv%(i z>9g^2xxG8k*VLr?d(<+#LH#?~aGO`wKeJ?cI;B5}R5)Z#CY*s^WywFU@+pID9yD

}9r)~=}pu3ZIoV9QM)8yrO3ly(%d7Gv-dvJu;uE8hQ1-sVX?RsgCq1pSBGR2|JBHul5|~B5P(uliAyr8H0jA zlvFQYxL|!5WS}6{0u}%-Ubt`<{^W2##jU)2MBAw3ou!gotoQBcec*x;R;FVKp;c%H zzmzDmmXKu^xG3k9or-?+v>1x_o#FE%nkY~@FPt)WS5-}Cp$uFCKP9A9@!ojq=)l=s{bWy?h9a2w<$xF|=rRxQ03}{NRp;Uez)D z9tixs7)fwM6m0puF3oeNkMtgBAHC^R6D-GNRK(1S zH!1tc-rM&t<_v^47r0}x*Y-Kwqg?B%{}7L<4}LOo8Nc8@%NgM2y-_wbw-m%JwJH_L z_zE}EqrHRQ3WEUZr68yn&gAiIO?89a%Khg+(0L4iEW3YDw==Ucv%UEXvKc90LmVZg zOk17G7xnY5Cgg^6O6OF^swt4KpJun2ri53#Z18JV$v1Je?jGSq$wg{m0&75Szk3gC zR8df=Qz;kKvJhAq8h1$LpVB-mHp6QT3`vw(l3Ws-K2m~lAKuCaoH+$VM%J*NQpP475*V=eUG_%(p3i% z)3kix$ek?f7T-TE6|vl-CSj!^Q`eF}+xUjQ<#gp{heQ=o z%$>He%A-SZm|YzuchJYk`1mq&%@WGu6#a$udGy}t%W47J;%1}L=)aOGV-3s&JAmkY zd}3LPOjbT%_F3{maU>*vynv>V1o|B=I#$=W+aeK5)KjU^J7PY}IRjmg(5+riZi@@P zPr@tssRC#tI&_Chcc~4tby`@^fqrx`$>r^^?ipyOU>d_t;wQ{O?{0U4VJ-dKqpbQ@ zUk6%V-R#EAr!bB&Wb5VV^$u1e+>G2??8nU``$|R||=(CE{$CMo4m*R=WM8DP^^jwe0(u-@hvPKpH>ClfO0k%G`BY|8T7=%9(9- zwz-@>LfdgL8ij@lD~gXH>y=xsa4-V{tZw-tAnm=|Y3Ui9%jS#D%p$U#PKPd)<2IA1 zdDAV^6cl(sivb#tcZ4xPf`_5v7HHPRBMZ$9wX@t>z3K4V`6e7}h4_AcRRXtaZ$5IG z`7-`M5FeGx^mtb3bTv`wg%Fc9X?&;q)-(_q|By1w{9C$q=)ywq+%7-gJK&8yZ)D)K zf_PN45Pqf+PgP!ct1oT^@qp{87{A`QEze#Pg{1wy36*eDUU9_tW@{uvsfVnyQXtfd z`YKXT2g}=<%mt0F;5veEk>qj(%MX6fF-2k2d*Z0>Np$H`N|>dNrr9jCCuIP16w($I zV?NH}FFxKsQw%GEN!n41A+cg78pr1_wqg{TRS2_F ztY_^sboBL6488HlK@>ii=?hI7nz@}m9fbb1`8r5z)K~CH;e^;|^*wXhz3Xq$ zgkb1d7y2XfRaROvr(6=VMUPS>AW(wM-@@&FN#R~FJgGkP(;PMCb^Fa-(m46kkKfo& z6`W@!sefg=OqjsEo^4Q^>ocrXrE0)0OF8Mr5ay~6_Z9n^etAv%==044{5??BAa6c~ zp`d5Wkl|9xu(|L)dn4TYw~0l(-=g%~h)1#PyS*A_%guGPzP%~c5HA`x7&YOS0hYyB z7(}67uW1Lm(9o@@=wKr^_p{=n(+(*GLOycVGEL5LFFyTD>~koO@Ja=K+v~%(oOCZM zU_)WePfHgLYLlvIr}`jk7p9?vNyWWG--s7Af*7Nb)*@6FlxSIF>aQNzz)N_4y0Axa z!zMIvM(%Z)Rkh!(TR)X;qRqJc$mALwEh7CjuPpMZbdEb?z^_isw6cxJd5is#f_f9j zB_Xxu$Y}7}9zVgR#3ABm&*&VY0U3&Pl9HTItx^|cx%@{u&@U&Q;sZyh%h^%b<2I*O0@x?Mtt)s@R~Y%F zYefHG##vYFI;m}gse#IsRQC_PWCN?$e%>&)t-_yLqQN6;%x?~IGM(o&RqGqHU0cwI z+P=ZF?9sr(?&_yU%lm|l=litI5;1}%)Wai|H^UUq`R;CRzHD*XtxIcM3kS-DIO6LZavBlX?~^ zzKveEHAQ!px@OksjfJ1|);brj*{9F=CAQn~;DX#pa!QA}?5sgW@`>d*_QYg-R_?2O zTYqCu;$l6VPw-2qk6O05fs{gdhjyE^it35q;nQl9AIt>z;SF&e!uNaVI7%Nlyj@{L z7pPQq8Qb54_NYS9J<`){yuD=kH@ANb@FX2;6?l$Z2zU_-UGb>Cjq8tFxV0B)YTBZ9 zy>$o3GDj6sZa#w*?rq*>jG#h9nx^CU;OA?crYLjz&{SxoBQTWryoBNJ5?ZK9f+KtA z=8&vF-yF{Qd)VpB;VEC=p1xSjo_)YCY^l2;J5N0nGyI$c@FV>;820r1Tv4RUTgtG5 z?L2^+X{@INK!Ow;*dpzsOwt7WNV|>d|DhUUfpQ0Sahw~%qS=|!Zew9M+$E^6{=rO= zSY?<%Hx#Vd5khKJqht9;)1U*)w+Is$Nc*Aa+1+ntye$J0P;*JX4e#$9xb2`WTqUQR zqTDVB>Ru)v2$Fq_{rG4|f0A)q)o%ePJh#p7|5A7n`^Ee0g@BA{eB+gxtH?=O%XX$) zodQZ={kDG_hJx9IbPSRvaoQw&NIJMJ?^i)cLs4X~1*WRvBm~0qUKF{!fzur5`HtQ# z@b=U4^Yg8Vx&A(!^DTV)OMzmWOYj|6JY!&ag@i^A~k5QTVXB$=$IG*e)QGuMa1-t^>q1TG9eF zKmlNJoh`!&1il?ssQ0cWi%~aCTj8R-=@2W_6mTOyN)`^8;w8Q0*fxiGXKY!_bEQCD z+tl?-0ykJa7eRR|QFH4MP1G^K9c}_Pq*ii;7!JMOCLgF4hbW==zFzP>Gok4p87GAY zZ%&}+f%&yGQXw;uVyby(@}N3{*dpmR%EKjAC0@iM9>+Zy(nhCZ zxP1*kZe#ZQx|(>9A{mneVQj#}mO%k!th1ag8P5dfXsctgKHGemj_(nD?8NC1I}bU+ zw|zZ#Q8WzS{z_#Ii-D#hBlHB9BE*eb6%+d_&9m}%0V_=7UR&SLwFIZ3|M;WAh=)JQ zO5HX`xd+tmOR^4zWI9WVry7?fV`+6WhtI6%BRkp4)Q=AOz_Y>=Nhvmj&DPu%$!75{ zmVQULqloXRX5DA4~0!`tciF(INt4J8cb=x`h+A3_ljL=Yk@ECk^Lf#K0i zZ+S$;{t^5?#^T0;|K9)v5*HTxR}LZsfzvYsp%9Sh|9uk^`Zr%tP*nW?@$mpW=d5+!&ZA6=bb=P#bqPSwdH44CHA8+Bvx3S1A8#0i>1_nR!eU>I z|&))O{g``Z?> zy@K`bhjPwpyk_>^Q(+n^q@Iu-FU<8AZ^4)6H#M_=G;UxMALicLtA$uW0XxEBf8AS-71Fu+4^7mKZ@S>yQP5XrJ?2uv#4nYEH8YtT?bBR zxFsPnlo*L1R*NHA29eH zjJ@B>e^(jLdl`V+#@2M*D*TVg`EX96HQ#I96Hbt;>q{q*6c#YKx*_hz?Z_Y1z@vD=*bR!(A#lC+| zLJvvn>Y_)Zahc`*^^tF8Ps-`l^$!dEfp7bvHA0)TD#j9eyZx#`7%l{td416^oCvE* zK0KrEs?n8IBVHfIEo=>JD!2t&*zXq6G~CvH(od#jQmhmO^P^f#KUoT&>TY*Wl^+m^ z?TD6*8)`bk`|On@Yp4F05SDd*(h57#pvr>1ZZ}?T@Nn>-qE7O$z!>p9Au45g_=IQU zV(sbWVPon1k8*`N;DH$djQ?~-Mn+)(uwD=&6Ac|8f|$f4gEvXe7MBGSZO=-is|K z))Ufoi`~tb=K)`txrxWLRD_y8JHmLTPBG@^Hn(hcW`}-VLKr|F_+DpnM`l3KACB9N z5Dr@WBfDL^FY&A^)>?F0Wp%MMSyw{+LUYYgRUn6>%tgv6>ZLJl0}xN7JE5gh4zl^NATU9u1c#w=b75Sr~E+_DB3e>VB5< zN45Mg?iQK%tpc(Ps|(2u*?PPT--5=tcJhpXufCg0R1~3w%vPped#=Cn3LEHsFxBio z&`v~G5o*idQDsa>Di=#cU!LfGs&F+97eJ);H2t*oluKnry^NU8wF<0g3#ZuITj+1r zo?lpAuz>sDO)2OJFTZ~;SQQjBCSv>JeC(B|PrGe%^_1fsOV@^^7PS>AA?DQ7^r31W z?&u1l&`bZJ^Y1e?D2zetFl|v(EYiki%lb-H!%hO?Q>_U}pA0lQ5kr_=j|H1XOWj1@ zYn!FtY}O_I2sf9kYt8?I(Bs)U0zGn-{XWdDcY;68*ne7Z*(S<*5@C5jG0Dw~Uq&lo z(D}EwY#YgOwNy7!eKdc0VG-iI#`oT%haAD#>z@n7paG#dwczz~m*t<-D1WT66&?o* z3j5-k`ditGvAY|9oDLLB*z|Kr%iQ33*GW!nazn&aO?j$DxY0GvF#?J)wHkW#Z=1Lj z1>wObLP2C|54~Eam z4Velt2-S9CXbap9l71W_mJsLSXy+*3og}<;8qxzM8(BAiM>gC<6 zyoiPDL=D66{s<)9QjdU6zJi;SWPe#r6;(q(38d?=-RF*AHh%e6h+KB)3x|&1-iwqm z^wWHCUQhd+pb8Vs)PhaxFECHEJ-GD!!8p`sh+|XWCXMI&{rsXl?S0nPyoLNiC6`T2 zRy}}ZI+V9pFylng$`+djQm`Eh&z>Pb03$OiT`z$FS3^WfpCq1Pr%U8gUDgD}1r?(t z(GU+q$V}^G_%DwGuMx10IZB_uH7Hy-ek(c{(-)lO{N28!oZW-$zb{k{_c&&`O8pgN zQ?*IRr!RPrKzu;q@5Ceg{PrA^L#rWc#$;ZZd%>w*<%x#Osy(RkE}WccG1XUOXx-p& z{WZHZAg`pvUFterEAq!H`e0&w&e8>l#;mS$>7|7(;fPLHUEZ)4Fn)p*KYy;ovEg9X zhgVv?poEw-IamTB>}bjge_rq)nY>JlOT^jiu08Y-v<(-AKJ?-jFW_R2aU0JK^V--L zC$UUwiL)2i7jEjkn~S==`n__U;qi8)ahCgSO4CxPYm6Hs-tA|xgeP8V-xnxFog^c` z&xZG_(cMkjN`bO6;QixkjK@!pDvxjPnR~;96l90evw~9#S(dnj;fDH7NkI#dnK46i znWst0t~VPgv*k_ut>-=AUmNyajQav5#*S)Um87^wV>Jmp*72p8vhcYTgD+ZI-$cW{ zcz>zoUu7;=guq<*Ickg8G(|PPtSxP!{c#g*Xx-HH4&9hr6w`8?Km#U_#OaQ-Yi}*@ zqki_#?+x`Dbxksnz^NBg=w6J!dFM4g+yE2%t|NXLoy|W;5k|>pq|8?XbILPei68pD z>CmLS%;~skb5mMj(`Q5*ZP!=!=fNXK&BDl{9a>krN zUg_Mlz19dNc*7EU4v1f$6c-|j3BLh67y4*wC6r&BtyFJhLrYT~gco1*S!xZoOK zp3B=%Y3rC|Gk!3vXEbgVk>Hb}4t#@!04j(wS93B!JRm!F+hAVA+zkE)HJ(G~-5)8# zn=AbeP02MZ@N;pT>en&iBe7dwz>2@G&`HlXT*HvR~N)iQ7doiiF}p*C0WsB>}c>Z;AdYlZU;i+3tf~&qEl#K zl!jP8Tv70?!P&ZHV;_%KN^BX<%05n~^g;pTS`eF%KfVraZ4bWjoK^=iY1XARsq4}H zt0RdkSliGH(&|yT>zwo;b!&8aw=NKHH%xwMXl)X;7>HR}h`I3ckd}rro{l7<%t8k| z?>o1=Rd(*YrL7`APhP}Pfp);9H1Lfbe^rK;&)T}@hLjb& zlj&+;m}Yi%7Jp$2R-Z%LnJa#E`N3uAe!ud$SsLPXSHxrPSw)+#{ru+rWO**e5gDzjc~aMZ_#~h5u`&P>OchAY^sT>VqOqm-T?4a?^)9r zBY6l%E>dDEt|B6LnNQ~44>pL~K90b#t?r8Zo$H+_5ccVNt$4jfi<9J)1I+|)qqvvA zCS7U_o2?VDuabJ^2k*8PcTabvRYgLl*L-}TY39IYCaBlfzU>�lznL9CIqTr@6}Y z-nHT9nsJ)r<5g9MRXMr8XzHkJyv60tCp~FJ$0e&e4?A-RJc&c8Hho_esRQ8^VU0Ds z^OEviec)w@Wm2It3j&&g<&c7#_dv}KB^tZ7c~~_peuLhwQ)~sa$OBav_6iCM2rKU9 zspa+JKd<=geW|Nd>RIVn8Bn>+8IWEu3R$Z<))y_y3Rn&h2X8Tq#g7_#Qi~cl+bfM0 z9oR8i8P1hB(KQ}SRuZAoQ{l-xt`fuSb&*QNUyV$FP6qT0v+XY!f|Yq-v4N0&wb$$% z-5=comzmt|2yu-o126*U;#o7y2IzpaPQyP3^&1DITkmdcJ^rko$d#!qGz{LzZ>VKniB8aF`2`Noe1P-0 z4sP&N-jEi}a`9J`iu^HT|9$o2#H{1e=V1I6kgZU=v>EQLb-2>j_fBepxCk1>V2Y!o zb*!{gzW>Rfr$n`@e5%txqlCak<5z{tvD8KC^tX6!RudN@8M{m>!uy%8I%%taEYP8UFS1F!( z=vn=GDbYG`N|z0{^E0si`l094joC9V`qG>7V4bj1*XT~fb2lM(u^CjiB7&2~jXr9R zCN|$y1)OeRw(1joQxW)m|3>BAAxEXb?^!fc%U6H;2#lWXNk`kF7?ZvGXoaFso9!du zIPzLQCt!-e+a;k`i2P47ZpTqY11@#jk=t7YFR4Pw4M`5%eteOa8`7imUd({W=n2aW z{jK68DAEuom?lM*n`VT){_{StNkO#81g8ia6#Nj(&-TH|xp913d+5*>Yo_yCheXuk z9c<-snzBHYuLkdufbQI>gV^vN3dNF?L6z0@kr-X z(5YHpM#2u<;^BiV3-8R)9k&!P?x`#J_A#1umjiqQ53F@6`8@6QL|?W>)fDZZz?!3$ zsA|KI)GMAyYg23=a41t}>P9!NJ2C4ry->#+G_&(U6%K){DSC133F zHG#2S`}^q{+_KzIuanweHTs-7hwMY{?$}&^b2JX@A`0zP+U6HjOTrHZlPzmPW=X52 zkHHm4aU0H;+-jW65AoARc7N~iUbCamf#|+X#ae%p7z4ANW=2TJ2mR^PEU&;k%~h>5 z2zrMHAA>@iD8+`UXDhXF?M~3Lq8Vy*b9z6VS=N+}p&LERe7}#kN7ER=%e+5l3XQGe zS;eZLmfXf#B%{7_#(z21V&0NTOy2X73tvA3fEreH=e2ieWbdVN#?&f4vd47B&BIQM z{RKe$R<+>Y51}_A%zXb1$E@-Dbw+1km^texJaa*D(@`WOgy}`pHMp*^QTnx~cu6U< zhsO@RphMEn<-M?+iy+4-g3 zbwR^*=vUm6=YJZ9>i~3DwL{@gRK2dClT45M#aMW%uiQF3^q5=tv68kr{CEWJ9fC|H zsZQRQ^>A|P< z-wQLqjN&L+VXOUJd_8C3Cqa=%I#*XI77s0A@((29AD-ttc(#jhpG=%wb3`7g-WMRH zl*RSpjxHt*dI#hIvPK8}=7^~-mtGW!c~Z05I=)#&;`P0!%LzP?U2^+}9e!oq&B$bK^;+F^JknG(6L$Afq}!gAT1vzKD<32{ zo&u_pW1bZ1R*O_1p=@>kM7q5vqP5PVVYD1dB)qoFp2gzcgfv$Ud`$)Cb1zEgwvFqj zA}QwYd0wi^>Yjm=jnre){36oAKq0s$&!L&%+l9Pi-HM-AfWt`R=1+eAHF9@lk3;wp zjRk7)ZQZ!@fRGD>zTb%kVj@VaSmS(FO-Ym=##N&KD>E0 z)qGRs+yhFJE ztB=p0dZ8~41*$ckPxxyXVLIKO?}#(qzEJ3?>_rutEtf{^5ur~MM!TQ_jY7uJtFvbf znGsMxb8!(kvbs#{t$OIO3d$MN}?Ym zz>KU&Ay09!Mm_SI9CuZAKl!pfViaGXS0W%(^cVoJ2*RJr6HDzhD9#FTO2q-sxO0YB z?zU$tOb_m32&aNwJg%&_LE<=^HkTB<$Vu}*hkG+;y6_ik&)JX5M-`S-@d^7n2-dvQ zq-}@Vk9ZE__nMTJzOH-XGa6)2W+kTc@>l|hpTp56|M+p!Y`;VM{kWu;!E0yN8U8v$ zwLoyfU0PCr;ftDb42FQC>QoY(%~QpHi>nrDh!pkIyp6gbueI_)VtLApZl~;+^f@Jv z59p97NeD10e&;nrc@-lx+2+2B>$VGeJX>NA%MN5P*OJ08xM_Sdbe4M5r^^a|;TC7y0)~%w_%Giwc85 b{|Xcq0Ra#tjB5D8A|fC>HZ}z + @@ -219,15 +224,15 @@ style="font-size:6.35px;stroke-width:0.264583">TYPE NONCE + style="font-size:6.3499999px;stroke-width:0.26458299">META -