diff --git a/_posts/2025-10-10-ciphertrails-checkin.md b/_posts/2025-10-10-ciphertrails-checkin.md new file mode 100644 index 0000000..25e2ff6 --- /dev/null +++ b/_posts/2025-10-10-ciphertrails-checkin.md @@ -0,0 +1,26 @@ +--- +title: "How that ML-KEM is doing" +image: ciphertrails_4.webp +--- + +Hey all! Some time has passed already and I felt like giving you all an update about how the adoption of Encrypted Client Hello and ML-KEM is doing. There's not too much I need you tell in long sentences, so let's do bullet-points this time around instead: + +## Post-quantum adoption + +- today, close to 50% of human internet traffic that routes through Cloudflare is using ML-KEM or X25519Kyber768 (for HTTP3 traffic, this jumps to about 65%!) [^1] +- since last time, both Chrome and Firefox made the switch to the [now standardized ML-KEM](https://csrc.nist.gov/pubs/fips/203/final). If you're not into threat actors harvesting your pre-quantum Safari traffic, upgrade your software to `(mac|i|iPad|tv|watch/vision)OS` 26. +- OpenSSL 3.5.0 [shipped](https://github.com/openssl/openssl/releases/tag/openssl-3.5.0) with native support for ML-KEM +- from a dataset of 10 000 most popular domains according to Cloudflare Radar, about 52% of them connect using ML-KEM + +## Encrypted Client Hello + +- using ECH is now possible in `curl` when building from [DEfO's OpenSSL](https://github.com/defo-project/openssl) fork. Instructions are [on GitHub](https://github.com/sftcd/curl/blob/ECH-experimental/docs/ECH.md) +- even though Safari is [supportive of the idea of ECH](https://github.com/WebKit/standards-positions/issues/46#issuecomment-1334681742), the lack of first-party support of DOH in the browser is likely holding back any innovation on this front +- in Firefox, ECH's default enabled state can be tweaked by enterprises or parents using policies for content filtering +- the Russian government is taking an official stance against ECH, stating it's "circumventing restrictions on access to information" [[source](https://portal.noc.gov.ru/ru/news/2024/11/07/]%D1%80%D0%B5%D0%BA%D0%BE%D0%BC%D0%B5%D0%BD%D0%B4%D1%83%D0%B5%D0%BC-%D0%BE%D1%82%D0%BA%D0%B0%D0%B7%D0%B0%D1%82%D1%8C%D1%81%D1%8F-%D0%BE%D1%82-cdn-%D1%81%D0%B5%D1%80%D0%B2%D0%B8%D1%81%D0%B0-cloudflare/)] +- in June, we've gotten our 25th revision of the [ECH draft](https://datatracker.ietf.org/doc/draft-ietf-tls-esni/), with reports pointing to an upcoming official RFC publication – is this perhaps the motivation that the Safari team needed? [[source](https://www.feistyduck.com/newsletter/issue_127_encrypted_client_hello_approved_for_publication)] +- from the same dataset of 10 000 most popular domains, only about 5,4% offered and accepted an ECH connection + +## Footnotes + +[^1]: Data from [Cloudflare Radar](https://radar.cloudflare.com/explorer?dataSet=http&groupBy=post_quantum&filters=botClass%253DLikely_Human&dt=1d) diff --git a/img/thumbnail/ciphertrails_4.webp b/img/thumbnail/ciphertrails_4.webp new file mode 100644 index 0000000000000000000000000000000000000000..fa3d7d0f6eea5ee44637f27c6e43f248621a37f5 GIT binary patch literal 20120 zcmWIYbaR{F$G{No>J$(bV4=|B$G~vm9n)M!tp;`r7Q2Zai+q+Y(ObIU;*87-LY(P& ze;95ay{PwS&-)o{cY;`t|H=RAf9L<)zlT4ryK{ZfAJw1TpBG=)U;6*>vzr(GfBN^N zuB!g{*O!0$e=q;n|2Cfa{>}Ys{~!JL@}K)-|CRAp_qXj^9{<_Cymt2fYriGyE&o@( z*8Fe(|NlPuuknBC&c|<^|Nrmu`uG1H{m!iRsXPAartSXEQjaT7f7O3qbMp71g?d-( zb3e-dy?$2m+phW-g75n8RDb_!_rZRH{7m_8d+h$b|9AU_{ZIMt_P6{i>Oa}%{k5s} z|LuEy;d2JwE~Y8T-bd5o^nKnPeEJs5^3@leS>b$VOP#jS$EwVVHK&ihT>5C*)OS(# zqBAS@n(PTnee~th$H?j3mto4=d^3(s?>e(5ZdRPO(Z>Y|3y^qusmnvKXaSkDY{sq# zV=u#{k2dRzFPlEwJR0Ncwt<<6znbjEzu>0!=G?Y!8s0(BlQ z&fn6^tg3L}q=$h~5D(9k{Lh=fZh^ZWYz5ef!9KA%l1n9^KDfGfhlbU@@A3S5uOEJ2 z`r-H88oTc?*YVi>cm9`~Rf-ww?teVzJAIK@*W3RxPi|KF`y7_gnVX|`=30aP;WOOD zk;3|!y`XT!3@@MenOl~KW`0<8K2mWXC*-hHXKO6NsZx0TeQb8Ra& zFI=VbBAM-r22xle`(~+T2h);fdymIUUw+%Th1FLr&Z_;7#`K_l3toXef#f5`r4^TY zU=fK32vA(*rEWMgb>p&6jQL{Ulp2#oZyUGpS??-U3f+IrtVu+Cvd7<0<)e$TuHG)G+IOP5XKu~Lh-=|{3|1cdwYjq9 z_ZJCCO*S?!$Hqw$5>gh|I~VMHpy`Gsd5Y{jcdUG?4bK#K3JKg1W~{<0&&T_L#r4?I zO0|8}9+rI1(tKI>UR!_^d9UUwO+n( zwA26gpyNf5{X-@TD(bEER)8-?pnZhj{FM}v9c+~wZ)w)4T#((~Yz0&Boo z88rofBEl%&toL~kN<_|Juc~@9QyKk0Aa(GlZjEfidIgsp3W z1QXx;)Hcq9;w5ICdcrY^2J@xO{#=h<@ZNZ#8SgQLdwKn97N#yu-|b*FRaNlbt3@m> zQ^5K5NOAq#DbTVBsW^lbeY3Kdvs(^qH{ej7!wzNIE z>qqUoz5g}Xw(kwzDez{ghIp^BSVzb!!9`kfi|(z56me`^;k$USM%0J*b0S(7?XEv= zX%^QJrM>-6v9{Y6*_m|(A$aQ8wePZFDZfN#R+OLhoeZiEvbrtLah5wpUYo6VNBl(M^sjnB z`bG;b_FU@oW48Ld;iaMVtqt#bK1R+KUXmxOF!!i8yW;ans$~~q{6Z~Pi5g4C?$f)GwTS^1=%{&*u#9HXr{~x$u~jU4zNq*$%n0HUBRS zxA}is@Iw5{Cx<1DUEuRzUU{y;XPL`~eJP+CIB@^DQ&>~j$Er+ULxzwE>BaAx&+NJK zo<*tQVCKAx+~w(O_X>L%E>pD)z0ou4sdtC}ybqHmt!+-`&b<0POhJ3{LFPwxJnWW} zf`YisBiDWZQTt9BPc})BJc@|{~fLsr){(%Wm74veKQla*<*dj()~y6>mT|? z%#H^%blA#v^Dwzyna>YyF0Ezf+>@SH*uHCu;fB3AvIZ7fauF;R`%;PpI)SyK}*jJ3$vVyN1;qEIts_lUcEro%8&bz55qk z`1E7t>dTAwI`ZZ9*er?Iy3O8FH>Rp->bquab@iD&*3U1+zf%5V_dV`E&x-SkkLEas z-w&9Pr|bxC%+)YI?Rz1ex%Gzpyj(F>u2(Zn_Jm2A8=*D#;K8xfpa$F+oY-U)egCJd zll^n$9E%&!796O^`aA7pw2<@0FeR3*U1wLVpVT0bm--Ug-b2f&FTIi&kNZLj?SGZC zw@A%({>6D{A+y|4FDt)!h$iQ;jFs-+=jLoX&++Z2$?KgQ9sjH~p>0(3iml{b-vdPx zQ`fn?fu^tCclAwtv9N#nw}#R_-hAYiY=n#5fvuYEr`&H|=>U5N9vu2`ufPH!CW>_l|q>EGB^C z_T0qU8U7bKq<>A{@yg(srq}ypDJpdQLnb`||O znk~Ewjl%z}X?*vu)2em$x8_}-yyh&+Affx~Z_DSEaVA*X$!GRN&&+X#^e=4H<>p-9 z@A+S}k#W;CdwE+Sse`iud-cVZJMU{2G_XJGr#LN}^YntVzfxD62gl6ETqE;+QzN0S zi^Gz#tZyA_We*26+ILufI(9lGbbGIbU%0@h^Hab{*>>v7T{;Ww_~g}lk4;Ri5C(PB zCQC~Tn^}c@yK`wzrW^JOVY|^Y_bqYumbxL+ygoKv3UCNAbC{x4-(kLl{}reKajJE? z)b+)|4bQu>Jwp$$%<*Z9at5WO506g0J^#AHNa4QoP9~)2)Qp9EF-yTn<`JS7lnn&lp zPBx5mI`j4KCL2i>ldoA@M2yn6-_hH~IsbvR|2<2N2oZ@(ALFZ7_NHbmH=lZGHox9Y z?Y|Fn|MGoX`e?J3SfkuY$ENr{#&yWuUZf&LENy8@u-oP*rCAni7m9q2w@z3s_o6~Q z_(Rh4^_M>_RW19)a__*kO4G@p;EnTB&Y?J62}O$z7RP-hA&U!%n%+KldX_t#kczC0D;(AuO=v6^=gD zl*^%eJx%)0EPAz&^Rg>G!@v93|p+Ncto4%jA za_nMN+w6-tI#Qx-9=BQA4#%6cm4H7oyrL|63oKg*Mw?tVJk>UZqz6u;#L zzdoDKSF(OQDdFKHW}E7rdK;{^>}#3su;%TRIV&M!4po^ITP-U#FSM8zTXFOfI71-< z3zl9|zvwzO9c#(}b+M<_`24M9xpmW8zw@IT!%DgO3l7Sw3=Oi{ezn`M_`EQYGB8p% z@tm*j53bbLoPMG)ck2&Px!g;YH_=KBcwwTsY(bdit1L)w{=>2*^R1t&C@hiiFk+g& z_3+t#{q}^1d7;M(PB*zSYV9<97<1Nuf5vXGD|a=l_ zjc+$UDb3lReM?`a>-OzBz8jC61Rd=9kDL&>WgZ;$&obP-r0O0+jThV5otZXj2d`S* zQTXfFt1r6WED`qG98Pr3SOAQ z_q)fXF`&KoR%gGD_Lo^bdwyI!CiJkuX<X1zp_o3>!YTTKL?SXI;X{?Q5q; zmzY+qEdrHISi*1TbR*kEAAg?AdREi7cKX|D*QO+$&QnGco`A=uv=c0jTWB>FDcv;bTakzPii=b$xWM{~1UH_wWq%*tD98p=T zygK!F+{KDNPqr4@xpSP4d!jfMHn;*GC;PDU8lD2g+^rBkZ0PfWztn5Sl~<)!bN!YF zuf)!nmGm;RCHJ?SGJccCl347yS6^%E>04N96DG z|DV-rH~$C~t^faQ$uHp-p6?33D!1tW3cGf|{?92s1+jGF8^6#0TmRE0>-aBb2K&j! z);P*O-!IM(ot^G~Pu+5n18;4>EI+LU-#r-WZz)~)trWOOe$sOBTw!^h$aVjY-@Lzp zfnm?f4n_?I1_nl<*zGOShjJt(fq`MWr%@VvD61V|Lvi-~DxJ z_xB6u-|yW1{>W`q3GI@~TP&}f8WenNJMe1XtBoq3zS{4h@AT`zLX4bCqbFfcG)?a5DK zU|>jo`GBK=fr0T{qRwxjt8&NKiWnGX^d>McFz8I>5Pnvuv^LxRx#p!9Z>O^_9d=A> zoqegXP?y_$Dbu4Uv3xK78f_b&g4QQag|=&=o==);)3SlN@8W3&1_pa(!{&_}J7l*; zrC6;sk`0^5x7w#YbeZ!y>HY1xS&54e&eLb?wEK6^@2h8+rPZIuuc9TUICcuiS@((G zc$eVa8ud=pU+$#Weg9X+bL9*#Ccpe<_Hr4k_9c}=+kMJkUUcnr^j%dQU>vvi_N>l? z?epRbRavqOK3lEbddWA&UuFYK_2F;DCc63MLMxhT`aj>|xu3@yn_#!{-NSQfmOF1~ z{wS9I;;LYs8jSKUD0!mM>kn zXL`Xc{_a<+Ufg?JBKqf1^si}ZvpxQ|TT3sus%#LMEp^vVclWB;;MJS$*LT1C6gEfq zl}=#LmHbznYJVm7Jl&!@S>m^Sq>G+JP_ESK^mlh^XIQ@I@i0EuxpBW^YwD^1d;5A5 zaq(wTyQQKcP3?<Kjpr>h;F&VymXieQ7rCJM-2y&VTDCzTjDr;faRW!UvUS zpJZ(|txZ%(>1>T*}1ZN!^X<6DK~swNtd?ujm0YkwLEhz1E#pvt~|>EGv1E+49f5^i!*S$ld<-c1Olj@$N!j zj(^?NB3UQDLqQ}q{kGPr&8CeB_a3~eYY%Vm*|xlNqUPL!Iqg{+&nBJL{}9c1?pwTU zGHa0)|NcE|ymnmUZL=yq{{Od1`?_sGwyt&^nzNLu{AX19-#+v&#qosb%j11Uxpyze zl*M&9c|T3$`LXSz^|TL8zTr!E8*44#=I-gfnz>&3YTlB##Rml1xb9U%+8=a5XSY23 zP^I3$z@Q`kXG6oKEbS|AG%WlyBv>S*{%YH#-p$JSGV`Bb$L)vZVM=SaUs}uB5}Wri zaY4kc{&Ufeiys!IExAAQ+9@Be3he_yKjBx+s&F4C2V`^n5^S5Yx^d%1=7!-pPSAR@p-F( ziMV95%8|!Sfd^{VBtA}M{bZZIZ00{UUh`RVqporjC(d8`*yVJS$RRkgmB~CO-Gt`&b=e1B6{ZCgN-g{^*l{I#pR0i9rw@X zTy1|a=U(T+mPu75x(iZQS$v7ixzd};yER2+^5Q$;A3sW;Ro(x>Ncl)pr@No}|MP8g zCq*}LrkwQn_)P!DYst4ouafzecfOc-^1D^$nUYz-K|;cp&N6(z_Gk9)-&5Azxc0eb z-+S3vb#v?GCmvXEK_KR-z=lbOj#~+*PyK&FwbpHG5l7AH&v)A%H`w@>tFAehn3KuP z*Q$Q#aYbjGbE@6>e__><|Lh#tuNycB9`NU^)D={$xVNJ}f8NeD8<=yq-)v@Olb%v| zYk5KH;RD~-$yr}Kkl5gS=|U01J?8yi)rzjfpVl|oVPf#Z=J8h9KD8~HzkYpMInO)c zO5+6v2FA1>$q`9uU!^U3Gi^@!n`$2RlPb8}wp)6lpVXVK1A^pI2N}e5IL?b?x&St5acv4{?99ryL4LY%yHEJ7~12^k@w=VEGoE%%Gh|DiL1`O{11-d(HA=B}1H)Y#2! zC@Fid?W~T~McH}FKRs4At=<}WKP5S8UDT9I{)%`0F`GvJp2GKSmXTaFN70qrWr{oJ zznPm{W3^^Azvb4=T3=^(p6HnxSJRdC$xP=?>DA>zje>XQ^<24jq~Y$wQ}o}u z>ae)i1zTP`@LT);LiInqZr}P`dVXGYzhfz!-uP&HT1dYHvrOc1rgM7^y1YF#>$`ws zj$f#cVpZ+#Ncw(Z{7KYf9R@h1ywEP)#|?v3VieApHZGp3w3D_|N%ZfE#kw1TLqPBfr zU8-4h#vhMZ8N1&WoX3{2PC3RQI%i{AQBAhh!?1H7Z?LJvH=ULajZ2uNWY@8*qw2^T zQFs0bwX6n~)((q@9_nGW)7X=jS!Wkn-D$h^^St?Vl|1p=``?>c9$x#u?p2i|>!Fl8 z-}thkt7g|HU-eRoK3;!y_Kl}15j_#@C;hB$xRu$Kd`vseT;qEvlJ)Mcy0dN8rc+b+ z_<44JXK7a5uk!uTf#V+*x^+}d=9|eqWl!gE=8KhQpDd0vN_tTE>GHawh`&F-L_gNn zm~HP7cud;h-|vz&DzU4AB-qV@8_H&#W7_EZ^?c;+nxw4HKbHUUZ}SjTI>zQ(*)-eU z^6jVV`RBH5R(*UtDE`|4zL{THV|M8YFO6b*AsjYogVl*^|JB7-hy^bbylU0!P`)j1 z*7Bk~(?w^v2qrKvux^{hIIH8CX~ojHTg-g-3uwBid|NZkU+74&0zbe;Co-IqhD^Z}hqwUL~{pF|T?1)h14PU%Fdat9$!WqYw z99zlnUE5(R8@XWJfAx;j2gK{1JnA~Z-%;8xHD?Bom3!W`xQz6ZHI~l~UCgx5`5-I5 zP5ZmI$7{vBCdFG;Ul)h|%swWarklU~d&2dbuM&0LuWOjI1X%6(;K0DZbcK0pbH}1* zISdS-{>t*0!|MyPu1<{kQpKp^BO0p79riBa(W6rPxZU;)Qpx+CJ)E7*Vv@0=^5nVR zzh+uXMGrk%CDc9P^?Vl^L^=XM}77QN0~yaTS8uc zWI4~AvU`g6mCrAkUag$xwCKd`l)}HNXN+bZwEMM_^QM3MhkHNSUsTTd?tF5>Mdgnl z!&ze8_D+&=a#Oq3QqY*ON`EV-?#9C}qF(P4ntr)ORAJYt9WP?H81Fh}JkNVsa_meV zlW&R^8v;z_96suD^OtC_2p)R5c$q>&GRwy7-|qyU6oqALUa~IaU3;)9A}V}x_~)&1 z1+9;{ zj@+E*Z~V@{bVdL6aF6N5O!dAyk~AMoI=uBrLhG&lhl6&`S--^uXVF<*6m#fo*mPckNI%>hW0&{ zr2Ihn`*R#PRO(rDkIt#ob68<@f}x~0IPkydYtDxS3=I5V>W#Y=csXTAFbH@X3UUkU zPEp^_%5it?LaALr?!8N`-31e*`ffF*NBzv3?jevJD}KCT$HGp>G_&Qm&hqS7wVd@$ zd;0Bl&GR=M>HlW^+m}n0J5NZ!aU*NC@P(DnDsOSmXgt{BqtH;kY?5i#tqCseEKPjM zQw~37?2Hk4)e*L?;_lOKPhV-Z)w!unXTN@{ob~YazK|2lpUR>bU;ntxawj`M(q64! zK6}Zsm2>Jc>i9qT&dqzupVC#bSjtdyz2yGJ_txnppMHMIk1GBw8II);%igH&3lH)x7JGMB z$3-V+<@1)Fx&P|fEaCaBy_%8$R?g2{etcSn|MF04 zEs>w6d#3;W`q})oCGWqhyS4n>Y`FG5w+U7$(f1SG?RU=UAM4c|=Zy28>-x$>UweH& zXdpSSVqT@YzEk*y7S}uMw_3HQuF|_v{BP%8fq1q+h1(JG%#AUV56yR1|F`w`B;P4b zs|s@#PGNpDdu`t7v}Ye;=Wi9;e60IR-0LdI!(vBg7k4Mv)=$`UZCPt&-g&nP6^Yl% zwDVL>H5Xfc?VJ3pGfFVH++y$UlZRH%R;oN@|1hZCs_j2x^JgccR}0)9oW2~`EGhbI zTeq8J#DV1;+`-2MQ(B&CRTj3i&RN}AIbnMCum1-lcR8%CUUyW}CN_k(_t5LpbKLqW zC){@F&X72_Y`WLu8w_4&%2(ZueDbo!+$7a+wO8mxtNH!b$$_4qN}?yY2_64-;?Lx~ z=I(VJmrq%~IO{Jw(O#*}NVQ;ebYdmK$74B{M`0k*X z?}?adm%vhms}Wg2n!B{qv(JA!p?-V4$Jc3Pr&v$g&l1qFQ!l#lm)+slyfZJ~s;^kX zv~BN?ui`Ch-P7!BBTl5Vo3Bn>a;VtCplQ#e!k6Z`Y_|0+T)%m@w%pOUyMaM{-hS5e z$4n-azBGxHGkbH6=F#NymPv8H*gx@-QQInJVM>)c~_cZCYfjAYs$}>US(JIjCE~|PqX5kmk9-*Calr=rR^E@Igx++&ew+)1TeR) zxVCoUp+bkqS3d+5{#z8wsEaVyl!VWHV8Fn@IAKFF8=#Qxm>1X<9|2m!d`&hut`EKPaSKL^C@rI8C_uG;t0X^N5 zzBjK)Tz>DucH)W5t?ybz*{-*r{5;XRJLbDE>%*5yDTc?Lv%S2omKv?@7H4WaddVTM z;nx;!)=0&j(-Zax9ZU;9S>(WR@|FL2xzo+Nr27NE)x`(Jn!TMjN38tb2V~W_ewhB^EL&w@c1P)O+Gdv<2P}_l ze%^MoqAJW&M1%Lf+`7J*EKQ4M?4RDooe|o2=G*uA2PNjm_b=lzei)k5uW84rpZ)E^ z`CNM@C6mDDc@4Vf=le`b?PR@`nPPn;T;OHgkcQbhccV|qH-Y&3CYStM} z#msffqU)urw^fTV&Zy4X)aluI^~qa}SXVdss=HC5Au-FW8H&Ei-{ebA3ZyB4D7`qmD9)9~PUhm1#0H;L-?TddgB&6$XJAUe=-`QG`tgjqt=k=yD?Q+Oi zcRQIOF~#e5I@5*|6Yby3%saNMuv_#-3wIQsxAvNx`s-g$wLO=MI1Z8cp4N)>RR%vVtm)!jl%Zq!_)4#_ zMdu)$I8>`^8zP?hMDjF6rIrKa)qI7W^7q_$$RbC_*U+l zU#_f?V#ru|>;MCU;lm_Go2~yC4qaKluk@UCY}&s-{((-}Wu9>E9iBK<2Tk zW&fV=k^NCoNI0uAlVLC|2OL6qmNbk9Dh+1wB<}t(v=WS+VMYTYWiK=Pc#> z!r_rq<|}=tCB(z$tK_#i?dd))reBO}&wZJ9tI12y`J8jo`Hi)cZfv?akBvd(Bz;u zV((8F@3xte6C3{b*e!SC5ARp{i_RAR_42@zYs+sg`q6Idp{#4ij2O;k-u73F<{qKVGj{!`3_V2q<{QTrJ zbH9!r?cJBVOrm!O{j*wp$>_sA=LxD=d)Ba)y^WW7*7T@Twd|AUnFG_gwaBjsW6LeX`DUrarCMwayZ0n1_p8hC<+D!Z7)UbT-e4zd zyX4lZ=Navs>Ri25?q@zZyJu*mFfcH58ftkdw^ueWFjgk^ehMzsub+B!m5st}U(<;UC-aDpPD%FldZm+e8ctV{yVD_B+qO;P~YTGsGeZ9 zUGVq3IOE2yrRfuPWL;k9wdKbC{|yZDSg$B5Y`(FfCGOBMjkOWFmv?;(jw<%&KJ{wn zs{Ia~e@q|PT5SA1J^b&NgzcN>E`A_pTqa-^{%2vo@!zU@bs>db+I5aMekt7E&vTdW zxXV-izTK8*x0@eJzJBSYVCaIN31MOnB3=Y*8OI!BYkn=$#po3^@i6E1V##*i1O4YW zoRR0q7mmGXx40t2O}jUA)}2?u5BB|7+@gHg~iQX`E(F+YySBoBAS{b1%!*^44=}iL$2Iff@^)#Q&yY`aVo_oe# zC*Pu9!LO~#INfi@xV(O~etk59{KAm7yH~Rtem*GKHHFFI#3t@_+k=YkF$kV5%;ea0 zWb!5ny)S2zC;Tv<_9N_@)z{6=jU{W%PNhm;=>8OOew#4^)AkSNW4ep~Uf=U%ru)3b zoYwBbtNm&>p1AEklU4bcrdpi#vq?Ype~bO*E^}OFZqD?kOl?P|Z&FOFaaMr$CTqq`)<{EPEh2H772Dd81co*?20h0fBZaDfZ zRpm%srm9VZ%5sT~OS6w8)rRivSYN5M!}d4Vteyo73LO)7X3n{L`DmrFepzUiM>bLE=J`P@G?p>@r9i{)80IV&3vo;veGx%BHam$Vf&$%&j_ zZf%)y@5J>+!4+l9F6A%xSlaYj-AHJX(L8eU{6_tY$@MBKcRwdQW?*0_sQ-KYZ39CR z?*vx%6A2ckA(m@DZj*R5f9cH(?YWj_HzK)bgfdC~iS~8%_qhGK`ZN1J@rpc!IEIL& zSGL_fvEcTRO^ZYCwHMw!aku+EEUJa?noqE zSv>!$lv}r*0dMXT?Z^Y&J`*k`SHG7GU}Mex{Pwe(k&BKMn@W>Rih4;l`|(ukgoBlD zO{`(1w^;f%_2x*4hbWVU_@|Klsm7c@%GC|G=ec~;P>GpY%jHnrWIYH;OvKHG2ORm)7y z9p(Hu?bYk_I)QIu8x4Fn%(gszw&g`y>6E|=+tt@}O!O7VURa;!zG9Kb#h7Vt6?;=k zuCHIBvXv<|kF`&DsnVOg#CEg)Nk#iV#Geqeh*OtsoV$&6+mf$+DGf0_Pi3167#P^M z?CW(oHBV@h+7tn{^yKq*PqdURWSP9s)@5(9Y}JL^tgV}W{8qUy?Z|EQ=thIesy0D} zWy+E6@n)-=(hg^f-`IWV!c$gf9p>rV+9tiM+Gy=K^OUx(l)QrJ6upwnvK;nDI!6R1 z8*4x9U|{O+o@WyL>E_hif`@-htyo`o&{ij$QQ!`D<>b4IY$s>R-TrleLuBto9p=r7 zrQBP5J63LFIXA2JZ^P%)*UxWt`gvkCU-3uPX9tu87#JACxMJrC3pi*7Cmg z)}7m1gnmA0Ev^2$n<>|APTRLR?mF9z()R~&EMNXazSF*Zx#D*Jgo00{RSTpp{dqb) zXw?~xEAauE$DC^7f0nldM|2h^++g7E(u#=IyFdT<*DvNhv#O7GE!@Py@U(oxtA*Cv z*li<(qR*^Y<*k2IX6>B5m6>nyGjqHP7#P@I^zGp~(DAXomvbhM@{z#Eh#&I=*?uhl zx5e<$Y1PmBOh1TKESRwB=EiFOEeY3RiYt!%IAAdI&4;O8oIXz(cFo*oEqoAliDK|1dtIrCiTiV#HvD|@plaKz z(6hmdKeO+5nVR{Cp|Eu7rTWhzC#Guu@O1IpeCJc1(Yu?kqq5WH&E_y@bk*==Px~Uc zvC&gGqUV0^ih3af1}4j0vrLLO%J=L)#3!gx`Q=yFeBWPNCVgf6&g$*2VWD$q#m0nZ zN(>APz3MqU_kE)No8){w)PLmhVcjIY+y|fbhBvZ(G~S_S$snc7bNg$GYtzODQ{26( zZt%8>$@eFMkW+n;poO^eLeSA9P$9eVCW<0NT!`3~(5VJ3d9o$ig2nR}%E zZrLWr@wg~!W5a*B3s+|`aBf_q^SxkpWpIfeXmF14-W7e7aLHW@_;}T_Z)fIzX|Alc z{81tEA7w6LLyVPYT=xbLT zQ?%}$Ym)525nTUus;1VjNncsTS-Ykk{gkvqZu?xug=P!FQvSqDWs%b}QMj->rpSMV zqC(ZOpug|LmaTidYp$qlz{Oj2(-myi$Fefto@`X-DHm+RI5T6Wz?m28>oSiCZFD@a zfiK%2H)QYofOJQ%`==kubUuAE(Kz~zWuY?*0|V0!^_rXJd!BLXh);W+sJ1sZ&tXR4 zY{%bC1+G;SO>ay7zN1_G&9d$Hf?3-=fgIu52+KGcd#`%Tvo_0pA#Bbz%blG`XK&k)q z1qp>G?|funV3@k`f`Qw;ooDy)E{<&#{g5?ljU?x!4;v>5bvXT>e&l`!qfYx|L*X?? z6uxvC?>qcl-mGN%G8TJ2kq;~9YOa;pE@*LJpD5oSCVxo*OW zxW)e_8OChguCj%b>FEAzZ@-xRd$7p!f9r(vD?;Sh@|Ek~&T8y!m#+W%kYfjngJzAP zNcVmR1_s9F=y@3%Pnw*!eWdCk)0T68P2XzA%Nq;0?eAan<`hxLn%wTSXUX4&H@>oe zZ*_{z*`BKP>iYbTmtJ+hJ)CLbd1+R79k=@QWgD69N-KPrIr(GA;@K>XzphOc@VR*D zsLl3+=iduEf4s}-9?@!I&a%1g%Tt3UzUA3Rj%<{69QN_gXOT+qDxHxOD~Sm*jdK48QMvM62(k*}0OhhkGtg)hb=keXCYq_Qba+Q=ZWuM!?Qv+4@_s67BD-`l(|Mhr|4O({;G3(p2+`Xrnpt*FTD|{HzE4=K z!cjN<3@)d~>*aV_!&y75%eb~{ebQ#ytW#iQJV`x;@le8%DU)|<|9ksj-8=t@}%w7p-~UWrIjezz!C8Jr+~U*b zzJ?N4!@L+*-3v{+m$LH9>=Nru*P>o2T%Y!S%E<-4Sht>vesz|$VNN1@F~h9f#Fek+ z`ZsKUqqJFZqt9-;>lv44ulx7g=C1eI?#cOoA67>hY~1mG@h#Syvls5r+Szii^Y4Ne zHz(D*oY;5Q)mmZ7G##dH`?s83mhl`Mf4`aMXC8>S`hCV8lLH|NuHGuq886tD{cKLW zva7kPsH*tLgc_a~$5y`&w@H3f)|YxMFjmCH`=wtrXUcJ5`9E!!4W>-w*wO#$M$w;! zjj|49PZ@aoD-U{wt>IF>_2~Is*;N7ZKMll6j_Lo)yfycw!vSjs1_q9+q92u|nY5nk zJS#u*e&&7Sed#r?CNYU1%&?i z6)BFX7}MVlhdZa=uj*7(|9=XJ-oyV+mW6Wadv)boDUU@aHj#JSApK0IUI`69a6Ysd6b zFcqboC@yP`HGEn0d+UzBdD}Pg*yVb} z7g$uvANqQ3b;Gty(=SiV4=+BYG_BR8Xx9I`9@Se=NdzS{NL-DuQ#4G>sF2#D z%*59^_5FMi-JJ`kr%k_qF;uv3on-FC-{px{gi zxxgrK^ppGlJxw$A?=SP<(|T%It-I)oNI_&^VHNkTqbY$6!LEHfKK|`+ImMQh;<0kw zbCo{Onm0-NeSY($)iRn9O?+v`FHb$3 z(<8KY@(-bsEZ(W{$4wYaez9@cJbo%U)gb%2QLwggSan=P^&PSI+L>_?O7|jn9GiP8 zrs2vB#pyllJ(tszbQ3zfCAO;1{hRWC|JE2bR-L^b|F*8TI3sX;9`h8l#q+#UtC}8O zTfgREo|Kh?>u*O<;pG2wwsCGtU$XI{USsqWGa=WF0u=&pS=S!8Y$y0l@XdbCP9NR? z1_qu@=e{jE%90ep?xJqk`AB>2n%64LD({|E3ut+L3OFkLwJ37clec+_)(r2~bvU1{ zuzGg3UCdZCY5IXUCF?hOS(?QT%|YvDIm^nPE*4kd*qd+79&7oh<9wUTgsEH1_x2sx z9+X~gxl|-5XpQ}DzwM`g95=RKd~Lq;S~+F@05R`L{}(O#mzu!9@GP*Q;QYji%2!P{ zti1lTF6a;6wV7L`%VPudE?qdy9|u~3nDaBna+Z}=r@Z2?b{)`=WGs<5nevsH^cjrj? zK9_jGel-R|T|3JvFD0JNCnjQSH@V~r9i5{zIr-Ic=5M?4_2$*{O~+*g>zXWIF5t`0 z%$O!xrUN872?sm#zvF>9IYOEFS@1(x@ z(ZIm4U)H|w{@uRC0t`%ViZHCab6+#uW%nB^ zrtOU3kA+Ls+%Gp7^L~{ru`JX#;lB52ds0q*Rvzb+*?lLEzOrTTl3cA-es->{*+of* z1A&i}E4hzLviD5uvYUDH+9u7H>$ul#>^H3YlJcDUot)Y7jn)0TqB1n1w>DbXsLUu+ zb6~jl&NiqcNGZ6~Yr%KEX{TQ-xBTZiPohGXk#EPD3Dz$rb0|GowSG(d&+J>1ZYz9X zU|?9gr_j3~=mSHSx8of9oVh8CUbA$5Z1^AN$9Q?wffM%k!*5@0JMpSx51*`;=(GP$ zYu8+M@kqLM<4qDWH=R$KZCF^Oog}Gm zwIsP?0b{e}br|!zU6cv`7cJ4L-=UY3a=7oLZUnyvE3u)bKBZ1CKW|G|r1L*uQgd?`zIdL%VHYj2r$-11`A%CLy~ z>)xryY$O;M7*kelmEHUIeE`Gb^3pj^Ym~1su^f0`H7&-(?ns86n}kf^hE?{*1Lt$H zp8REJiBXw-g3|6VBubk#7yC> z-%Asd^RpQ;Qhz)M zP+H;Y_`zsmwjuvl{#LzeF{kG@53Y`V5Y6^+kNtPoLzyB|*1bK!n-!ZD$e*<;wr&Rl z17rUMY1iP!&y1g~5q1B$d(3Y|+e6acF0#~8`P?tKh4bUK&GMHF7_J}6U45uiFk`1m z*rSYm?LSuzCpo|N*mvs4we}UKR^Qa0v9S2cIhQ@xm4e^R2-|+GIN?<5%@18RQ{S$S zs!WJmp`|3ZcUwj1Ry@|@1^v1zVI=6R+U&jr{H3m*ylqmZ%qVNhD5 z@+K*sh6DHa8h?|RW_0)I75&zQS$dL2{}a-_H?T7NNam_aKAf~~_2Z8Z*S&eX>1f!} z-O^!Oa(qOrEefWbyqFM}v+LWP)h`m}aXy$Q=CjA+^B+kM1_q|15?Oky9{oSTz`!8e zYTkD*#9)nvRAtsLA(q)|pTD-uTd-m#dwcb-*k;?8i8}=LpOEgmH)nUJ>fcMpC!fA@ zNTgPBZoNgR+QNWK0f!hg*9nUGKi(LpRsJMU@;P7Tn-JCH9Zt`~KWep9oilaWy-q@& z#am})sa=w>rsu||eaA2C&(Q1Dh^||c$@hC9+vJ+53IPd{@}~#|$Q}dfTi_Q+q=8rGCKWpA& z>FxXybs=7<*lD5Nwr6sd-KRxDde10z8wguZ{Jz{Pp?802ve()b9{VB{!{5(YYg5e2 z(8yY|_`( z=~pIAaOrp0yrb$Ck^pmOIYzIU_c8?cNFHI}9i9TW@J<^60lvdZt-szhv;9sFitl@_y`EzVFy| zW&4#0cYcJ;Xc4(>5{C*F1nRk&61s=z?=*3#a!oi{z>PP#H>AG&91IeE(e-@U?m zXXee@%h-C=Z{{hJUBU~+TmJGoq&4TH@cm!4z#{Ck~;9^=jF@3 ze@ySs$~?~(rN#X3N)WH(?)p<-UCS2StP$V2Cud%xjQaiWuXLX$cQDzUw_jIcwR*kk zx1dc&OL`N&6@vPnlUDzGc>dBp*$F25`A$g1x2N#xAKt_^{oze!?+{d7WeyI9**X1y=Vzb%=jxaH={DEEGa z2T3dqLW*5AI@x+*$&o+jJNho=+bk^CpLVR3$-z5*>wA6ee={aAojLx;=?eetzlP^h z|8m_fUuV5oh;N!i!mK2(hpitNmzQwQ*($1QoZ@4wH0gGvtq%9Zdv`YSEMFx3?$L`2 z4^&pxoNWtyv1FxnMv>5yi0=>Q8$OrHb4e9dzIGwwi%%~f|LTgosZ%b#krpfRS+It? z?9JvI>o*E!&X6pNoL%@iXqxcnOv$hh`lr>+X1`uIW1Fe&nHU?r#SJ|#SofS-u4&jO z`RYk}gTU#lQXY|ErjZ?~Z}KOJwa6V#s|rh zb&?1J1A}(xr4`fpuH5^40JK+#fpy;5&ynkWuG(n_z1da!*zNLfx2Uaco}WBA7oDEw za_5)E45O1-X|>Y3vlxy|PX8s#?Y-ouk9Bk1#M@yP&E`f(Sg+GrWEwVAQuo~QKk5@s z9Vwi&?t1Ilf9ocknSITHfkB9weHY*RG~NT!4dx7a40jlJFc+{rfOCZ(eBV5A0;k8B zH=--MP8%>VFg%Kzm7;dlZ@*5A!~zBehA-QXU$AarU|=xgk2K|ENx5wHsC#ePf@MqX z>{piSh4Znu_3*%lvnz~J>sGDg0WE@N;5l{w)XVlcX?ypGCdG>LG|#TkIXlF@`5nt|u)j}_Jq{!Sp7^Zr$;DqJ&rZwJ+9!@B>czMp+^NP8~R{^0_t`82L zOzU7^U}6^6Qk%r8M*#)~7Ul^T&TG%^J)`LH$pJK|$*qv!R1tbf#^B7x z)eQ^`2J&ZCe~5Dd$w-|2rR09gUjKXk^R=DnY=+--{5mF<%=j&)?&7h_r?y*okxHzZ z%xC#4RsMSV1q=+#(+nKg^pBK(pR^?EM2@?%AXm$}^GnNWwKudwPVhG&hz-8X-?7`>}*LAUaYQg-r)lv>zPG7>h@2qb5V;XUZAxM1D zmbj-e{F9~`tezwQ@(RbgAKA$~AQl5_klbypP09Yx85kHOOb$4yFi*O*Z_Q2vMlX;w E0HjCM8UO$Q literal 0 HcmV?d00001