From e03a8ad1a9bde6aba240951d1bcbe3e1cc554dc2 Mon Sep 17 00:00:00 2001 From: Bruce Davie <3101026+drbruced12@users.noreply.github.com> Date: Thu, 21 Nov 2024 16:43:33 +1100 Subject: [PATCH 1/2] first pass on QUIC/TLS --- tls.rst | 108 +++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 107 insertions(+), 1 deletion(-) diff --git a/tls.rst b/tls.rst index 2af9673..262b7c6 100644 --- a/tls.rst +++ b/tls.rst @@ -375,6 +375,112 @@ discuss below. 6.4 QUIC, HTTP/3 and TLS ------------------------ -6.5 User Experience with HTTPS +Since the invention of the World Wide Web in the 1990s, HTTP has run +over TCP. HTTP/1.0, the original version, had quite a number of +performance problems due to the way it used TCP, such as the fact that +every request for an object required a new TCP connection to be set up +and then closed after the reply was returned. HTTP/1.1 was proposed at +an early stage to make better use of TCP. TCP continued to be the +protocol used by HTTP for another twenty-plus years. + +Adding security to HTTP-over-TCP in the form of SSL and TLS further +exacerbated performance issues, even as advancements to HTTP mitigated +some of the orginal problems. As noted in the preceding section, it +takes at least one round trip time to establish a secure TLS +session. The relatively recent introduction of 0-RTT data reduces the +latency before the first data can be sent; it also comes with some +security drawbacks as we observed above. + +Of course, the time required to set up a secure session with TLS in +*in addition* to the time need to set up a TCP connection. TCP needs +to complete its 3-way handshake before the first TLS handshake +message-which is just data as far as TCP is concerned-can be sent. So +the sequence of events was: + +- Client initiates TCP 3-way handshake to establish TCP session. + +- TLS handshake establishes security parameters for client-server + communication. + +- First HTTP message gets sent from client to server. + +In other words, in the original TLS-over-TCP model it would take at +least three RTTs to get a response to a single HTTPS request. In fact +up until TLS 1.3 arrived it was at least four RTTs due to the use of +two RTTs to complete the TLS handshake. + +This is not the only problem with running HTTP over TCP. A reliable, +ordered byte stream as provided by TCP isn't exactly the right model +for Web traffic. In particular, since most web pages contain many +objects, it makes sense to be able to request many objects in +parallel, but TCP only provides a single byte stream. If one packet is +lost, TCP waits for its retransmission and successful delivery before +continuing, while HTTP would have been happy to receive other objects +that were not affected by that single lost packet. Opening multiple +TCP connections would appear to be a solution to this, but that has +its own set of drawbacks including a lack of shared information about +congestion across connections. + +Other factors such as the rise of high-latency wireless networks and +the availability of multiple networks for a single device (e.g., Wi-Fi +and cellular) contributed to the realization that the transport layer +for HTTP would benefit from a new approach. The protocol that emerged +to fill this need was QUIC. + +In this section we will focus on how QUIC particularly improves the +performance of TLS compared to running over TCP. QUIC is quite a +comprehensive re-working of the transport layer that could fill its +own book-indeed the set of RFCs that define it run to the hundreds of +pages. + + + +QUIC originated at Google in 2012 and was subsequently developed as a +proposed standard at the IETF. It has already seen a solid amount of +deployment—it is in most Web browsers, many popular websites, and is +even starting to be used for non-HTTP applications. Deployability was +a key consideration for the designers of the protocol. There are a lot +of moving parts to QUIC—its specification spans three RFCs—but we +focus here on how it changes the relationship between TLS and the +underlying transport. + +The single most important change in QUIC from the perspective of TLS +performance is that it doesn't treat the transport and security +handshakes as two distinct layers. Insteady, QUIC has build a +cryptographic handshake based on TLS into the transport. This is +illustrated by Figure foo. + + + + +.. more to come + + + +QUIC is a most interesting development in the world of transport +protocols. Many of the limitations of TCP have been known for decades, +but QUIC represents one of the most successful efforts to date to +stake out a different point in the design space. Because QUIC was +inspired by experience with HTTP, TLS, and the Web—which arose long after +TCP was well established in the Internet—it presents a fascinating +case study in the unforeseen consequences of layered designs and in +the evolution of the Internet. There is a lot more to it that we can +cover here. The definitive reference for QUIC is RFC 9000, while a +more readable overview of the protocol and its deployment is reported +in this paper from SIGCOMM 2017. + + +.. _reading_quic: +.. admonition:: Further Reading + + A. Langley *et al.* + `The QUIC Transport Protocol: Design and Internet-Scale Deployment + `__. + SIGCOMM 2017. + + + +6.5 A Systems View of TLS ------------------------------ +.. talk about how user sees things from browser From fa361f2341c098907b536c8489a4c70d0db6c4eb Mon Sep 17 00:00:00 2001 From: Bruce Davie <3101026+drbruced12@users.noreply.github.com> Date: Mon, 25 Nov 2024 16:32:19 +1100 Subject: [PATCH 2/2] QUIC coverage in TLS --- figures/QUIC-TLS.png | Bin 0 -> 26112 bytes figures/SecurityFigs.pptx | Bin 168475 -> 171506 bytes tls.rst | 84 ++++++++++++++++++++++++++++---------- 3 files changed, 62 insertions(+), 22 deletions(-) create mode 100644 figures/QUIC-TLS.png diff --git a/figures/QUIC-TLS.png b/figures/QUIC-TLS.png new file mode 100644 index 0000000000000000000000000000000000000000..b7fa8e480d23c1b01a2fdd95e94bbf78a6ad8de6 GIT binary patch literal 26112 zcmeGEc{r8r8wLtTt5PY1NTw*6rIdLniOiX2BFda`u}rOcUlk!4GlzxDGL^a47((WZ zWu9f8+1I0qeeAve`Mz)e^ZowlIK*1d^W67y-`91X=XGB9b47W{6UV5I9XN2{#BHgY zN(T-cY&~!Qub$vA{D!CDn>PICqN%vJqPe)FxV43~t@6XWM#k6gSsNNFN#5Y*=jS_c zfZ5;3z(7fgow?@jDFcI=&ulEmY|%>3p1n{q@c3Bvnf_B*V@#F7>rfq?ZoruhTxtxURKMwDN=*0#LG09VK3?L({CJn`8fn-as@jzAoDcykeEeMF+KfQ=&R_! z@U(-TN5u}O>N*tuUfzGH&9_53m8rFbQBp@mmV_GB*zU&vBYihVzM zXN#YhI_ibtePTm`N5tWbAIrX#24bC^~Wv`(IEqs z+Fs=7r#If<6ptN}KEbRPQ>4gTIsETw<{3q1wH^+|o^!#o`C?+P>dypq&|M&6ma!U{Xy)$yrm?QZ3 z6SOfO{@M3TaGNcfU(fgR)_C~B#Kej#2R>ie|9vsB>Dm2XB_6{*dQ@=a0q42>1I0J< zIP&{iKd&K1ghI6ni`gCBKXhWn4Z;0iMPXo!Gk9S#`@jF_QCI)|uhKUi#KUtSYSOu} ze?DL;PwtbWo7Y}sj-`9VM z7M@j5EWgKAM&SEDq+R^5-|&4{GdE@mk0+hYwQ2MIHL;2p;DZ-46QeL@S`R-S667yG zhmV@jHK=$-Vj80B_;$sNS@icjh>60x6TGf(_7>MXU&qz|>C8zIdc|4%7I{I-V)g55 zM}JSl`t7p#dt0d4ynXLeu^*Phx|JyI;@&rabw35~p0ud@)ZR5A=60MQX|ixDFlyfd zSicQRPvM7^%)VE!#6cgEKD(@p*|&7ZF2cw}KNfQQe*E1lwdTVDD(O}j|MRfBD>WKc z%l{r2X6k=4{A;qNPDWa;bCuO^n0@o`pP zB~IV2<0^H<%oeXy@n=l?E_LXO>Y{rcEYW@o?(5@;3M+js)|i)kts_d-CsJG+ z9^oBqCR3L657xts=QN6J#7j`<+DDjA@7X~y+YsZI`aR{epLFPZ2p7Y~A8%0*wd{zQ zo>LH6JMTly|IU7cyD=rmzRGJZnP%A_T-%RG%*XEwJ(kL9ub^S=QBTLqzmSIs3^&WE60XrX?*XrZAF z=R6vTwk2}(A(P|Y6Vj7j!oI)p^4+;6HG`@%_hl8Az&?5 zsW3hqqAyQUlqWaGZs(CO8toxMj$L$J_}mdKVPm}~%p^ndNXJiR-%vBCra@12pYN%IeOj{4)g&6u!$HbxQ{9zE^Lrh& zO&wr6h2Y)qNLDw40`EVSsdYZPv&AXU)$SXkq==VDqU z#EKo#GR%^_$JrrujJIoBr)^-8{(b@vUzhY!9l9eTLSkP8Mrj=-NYb`(65s#Z0wzeU zVFB5D-UBRAF*XRyY$vTJZqqa2dGkDIigEPToucE*+Y;6%;VV9pz`6YX(-)F*?Q zX4w2s`hmw-;%IV@ztiuaw9Z8G9yUhH*q6AL_yGAXE1#XE3=ap4P;eX76%*O8d#`SH z6_<2=7zr~U!DR{@E8^`mc;f2nx<8W4l6%$<0r3NTm<>{%cdYyK-!N?7Al@LxJ*yK%0MGEK;3$wt9R^O=91ZB^ANl<`Zo94}uAx8t-++6o!3I zrlKb%rt7TCzkd*pRfoD9Qd0Ken|84!}0M-U2vb{QJv;6h?pFJPL2AfSj(5hfOLEcy3=AYjqKYV7t zWMCm3z?edmc6-u3ho;{%wC2LPRf5 z(Bu7knFAuc`P-|3|L%)26SrXB^UC33_D2~Rm?SN;6UO^!8nysQFLKH(%=njK| z|F1r>fkAJe%JoUDZwSip*y!%pYWx0~w_jG@W6MEcJU&2cy5BT05Xp|4T?~@3o_*d=0tIJb)-BzZ6x@I!-z6cgCcbTJ| zdj7BGF79L9%MzjJ`<|ZpQL^mIziF$ygk$rE|w_axKYT`K%(qg-PttydT-@vKQ$QCmq47 zGYQIV?#wc3sie@?$*VTWMIo@wzR!7dcuHN|HiIWyne>Mnx(`$Hsn#d2M zQG(N@JKNLLSt+mZ(LFYjVX!@$A0Ow`_+&BMCV@o&Fpb;d7hR!l(>-r9hn!e3pWM`$ zu5o21yHVul*9&J$T&Q>+C|<}8ROdy}x=eB7Iq()m{M|S(X}3Rhc{%mp$A3I766eUc zXY>3tIca_;=7-0O2kKC9%eX5eSI;?>Q;>CA*Lv&fn-^WjV5s-93b){ z(Ug%s6qS}iZkw8nT?7C9j0xtL8S-fFpO?kv;U`8qY8A}avUSfaM~RgmBRqR8l@)J^ zTwUjGNr2~;cAQ}@J+aKnu_W_17Xp7RElSC6tAlhmBO;Y$zX&g1E0OzZw z*f(82g23kdl&*A-dwDw6~hBlUvG~jvF&-yC;}B(2pZhdXGr$&l}BP% zAi#vb&20rSl; zT3zn8Zi%pKczs&W={u)>OAzVKYPD#>Ym+dRtzj;Y@!Ii*y#Y|H6z;k4$o=`gmB^rN2)p&%*M_V4 z^`=(G;{2Lv&^`VGv@Nn%`4qY^io@^-sUTT<(LRz>nhz@K}QR##Ea3cm)$@~+oj(!>{&O%3?A>eC#v=Z-^n-6 zD86=rMu5jMtMatztJ_Sb4n)>_R^ONhtdX7kk9-#>ubQcJJ&5yZPRsA>n$SSKs;0J+ zUH_!uuGHnxu6ZBVzrCD4-f83~mql~kz@H(rc&1=d>yWD?jf0B7d<~;A%E_N0rW-^6 zZyD(f5-Dqd6yxPYqU_V&25W1h(Oid~+k6YRF1ZaP+iCr?wYzfdmB*_P4=!3}f4;WX zHPf1CpZ(59c)62tYpu~kzTERfU85ynj-m1Yj&sSnOy{bz(%llhSM$;y)>R^nW9OTx zi5Y80T+v;pr8f0MaUx-!j^a&DPzJ2mH~M#?AavNc z$ByO-RXQUvuj^ibTr;GHh=Y?)P6{yloVmh8V_S1>9C9zasIYbQ+*sR-K_sVo#Vqu> z%*t__JNh%!2o5}BYzD={R?!_2XF}y^ZFXHqCY3C>4gy2QP?7bqxE7eUh=ZND5IupA zH}*<(w-)oZVdcu3r++XxX~Ns{u)HT=GmdU6iEL^)UZhg^q~KI0wXDL`HkI*&a4Xg} z^KQ%h&mUb|zpqbbD9nktIzrZ3Y*khu4_O(@WgGU<8my0fgw!tQ!)@5GD zKKg<1i+gT_7A=~x`|{Qs zpv$YCbzdoTjQ-c>ZU=XkhO^nY|L4YA{cbD0&dlhwtmQmL0(J$GXSX0~XUv-u_HR#R zH_o3omN1AS%GtbwDzDsd@)>moZE|ok;-L^*5g<1lvxn@aYE)NY-gNQc=1hB{1|z0{ ze^i!3xE7~fMb$>~;?~528@cnN$ubmxR&VahaPBiHIy^mzGI)rR)(>b1U zfR4p;rdq+}t);WkXWPGA zS7UjwckHMSS-`W()UTEYf8;q=O|^ZoqY5ypY~;xAd3Arz_dsc!SYA!sbg_$4v{N1* z#$|AA`XG_er6Z~S9*a?uUM@ON)|hrbllkMn}1f;JJ=jL>cyth(WLTWB7>CZJ&J(jbhagZJabZsih`IG4M#d@!0M77=r zj8IGJUa6#;7-1{Dt#r;)BVULuiYeUUT~Bw(f5+J34MWl0F3Tfs=-RUZo|WvQ+*5^= zUUa1Kd~>QH^}?o)$91gqObH-)VH8>*p1u5 z$%K>r<@vt7QuMc2 z`>mh?bQ|<#i$34J1u2_UOJ}b)(`*0GZhwiKza>UfJj^{M7|id@bxw=PnXQ+<{iGjR zbu^%u=IzdBcMfKG=I!CfVs6LA-lTtY^rlZWK0LWeT3pTT%7_0><8%tI>CVthjXJvT9a0lV) zF7n<*M*6675=uJPA0PRpd>oREEXN7@7@x7vYZyMiFmG3k;GFeQ(Va6P3Bkkkpu9&0 zmh5cJj;`EE2>o98o@sV-$AfIc%Vi}&q%yntPQ%!DAFhLjr>B@*>gF}p&P*Coy7ur! z@%k0m2Wtgq)&`X2vg=-LFrC9m40WsS)X?KEWO}KH^a##ASQ|vd@tf)4f(xOOKHFlo1= z8?d(2-WT2(#=e`k69th)=sf>S$GbfHlg)JtEGEQUrA)rn758ms^Xjlm2_h0vcY+Dt zd6NzMe*Xc3VZVC1PE(cD0as*`k&<4(s&MnP@HPTh6Z8H0#t6CwHGdE!)hXY%)O6Rw z<jc+q;xj!}%lt-aZ^ zU%q}>&{%BG3%M>?%_!xY8|+Pnz2|(1X2VEd5{r@C7%UjWaVSh5isjCB%0j8FeW-No z7AxqaD;~6bGS1f?zHT3QKd`VTiCO%DUZGOo`^MMzqh4Eg=*`-9+g5}y&b8=Gq;hl% z_KWPHo$KmIxpi`O#(|SKzzaccA5QBYO`0q!@KX58=EYt=qMf)*7>+7nBNi_*>Ydb( zPPNSNKrh&e>_Ko#7l3bNEGuHr9DpO}Byg3V)x8_4isjVXuAZXY_VovC`E*0Lz-H{IM zw*g(a7j_f_h#Ie9^po}2+30UUI8euRJwT)_ct@yTVhZ&%3VCw^4q)BMoq%XGgGkVw zOgLxUCCA$v*l~^PWW_7XtZVnz!iFljGyc+~b?F#Gyd`ygw;(`unyf2OMv$3J1mf1b zZD=_Jbtt}Ks4naRQyRAZXGC9s6gXl4e$Izg!Gbe8nT%}VoXPaUV@Y*c7Nie|vER#| zCJy=va#qfII2QncR^B8tg(01mrJ&UNGhOR)F^1wL=q}SlYI@0+)S@AJ7}NCDV{EBS zW;=s^qJ6m9Z2;gk9~Y4br3diY9^i2N{U~RqUf^J+E4}DhC0cm~v6vDR0M~+?4m}qK zt+D4!VazM?Xw0i8dqyY*BXq#ktq%n#jIft3M9#*8rj-}C^{$RHTwZ9dVpqZ82`;;S zgeK6F@J#bvoFjk^9)L^s`$Q(U3yRrz4s+PGk#KAIjN)Z2edqT?c=%iFO`3?L_U#8IpY@R(d>V z8rLq^J1ZA^;LoI4qRa$heBV|5bMIor!yAY~qf~#MmZcpB$SZpxPZR_KS?n0D50IeU z@S;4g$=Q_O_m1g1WF`{B`N)W4a+jgye7WV^0a#LvdS3dG*pp*qSKKEft(p$2ao{^J z{Q!2C2&^HYLAuw*1_2>|M1{eCF6!qbj}g^J%jx^S-PGf2-DX2y7n#l< zm3iu&Tn0U;HJaA4B&KR@UuF`Eu|{zM^H_wsqHPhcH_4?rkFDwa{;0f8L+_jhfywxV zM$yvVNdz9-5BW=ue6iuaGl8VCU>(~}n|xhr+LmoIS1TJr4VLy6x4nCD9RsTfK0B>> z&%b%Qq-%AtMPZ?I=ip(&v3U;0RT^%?n^YiYhh&`Tf8JJO=elAaQMT&7<2^W;QR*(R z(qq>G{*q|m9L010ZGl8kC$s6e)U(R_pmb|l1{S>~%Pa!UznX+|SQgDyu?UbG#z(0X z;$JH;onBuTfiy#20M zDit^qcQ!{wRXO@VDAaA+1PN5EpTHG3vguHbKQ6p-g1&NN)izyWJI0GA0k5$DrVXWbU&G$%j-)lrFA=6)$aG#s4hou%`xc1GP ztAwu<*|j*A&Lj@3J5drHgu5JgO}R?XqheRR?V+X}9~$}qF$0mxUb?=`#J@e?0O=Ta zpG{l0vyS)Rk!?E3%~59nsVkRxLr9Z|u&e(iuNLalT}anqfq7W4|9rJWg;SiLguW>Q zpSwevyI-1Y$n&g~)MQ$|o))Ouwtn{L<12n1n~XHKG-R&%R$iJ!F+|~U z-H2IYjrV#QXL?!qdxfhD8Db>H*B^-;LJfEeAUTWXs1O($))ZaKI3AC8W=*}T8;SN! zpPb&N&~rMsHL1TNJzKit9)_8CyKrR6$?AhpF|ebxg%;M7)K{^i6TlB{&tXNQEcF1n zchfMegAO+gSnHVs>L3lyPh_3B*QT0=WrigBQ^`i}>_}Aha)X~|@P!?7 zdB%490i8mqth z)J`c0o}H^d2_vZo%z0w@NkMj^=>EG;Y36I5%r8I!Ub2TmSUkuu>8|;f_zql`VDpa( zRLs7D-K;tt^%@HK7@7l6j_2Wc|Lrl$_Kl+n<||yUUhQ%->@Ct~x62JHw1hlQ)8Ijx z9B~pn*mdQZUJr%7t4&079?fwZy;Q?@pP0gj&JB}jRGS@{ix@fgl)8B)yU#{wB=q^N z+{9@u`+m7vbURBWP{V2w>L60wYZ|EGi&0L7?me7LHs;|_w)3NwrGpy6I1IkQuH$B} zx3h`YLL8b8zjsWGe`~R&1-444rTbzWT~O4S+1qXmJ7Z`3o)0jD_Q5)7LF6FU?&-X4 z&Lb^0jg$=@z`RELCPRf-nH*jbEZ(Hwj>=uxSOdew()mI!J<`%A{)T~`$Q*zI-^qoBqo^c8%2Up$N9L z=C(<4-FDGl@@b8N$9hYTKS}x9e2|`-`G?PPW2XQ}1k*TzW>yrTwm4KBZ+T}Xs`aAh z2gyq`q?HoZi;#LFpW5|fP_w}cko0Y9!V`xhUg5}tK>(j5ggZpU>^R(RgW~EZ#LUu$B_4Nog7(Lg< z-7lja)vF6RZ6UkHGUXKZA@^}-YVV@jC*y{}^BN)-@h6spzw>{4bWr-E{ZLl3G+U*N z*Kmo~BH+oP&jc86vhw!;_ExDQPH!+s`IIquqN_7!Ddqd_G-`m%Bith4b?2Wtj(inA3lQlX^($fxKn<~_)a#TkR%qnd9 zf_(@lFDup=VjAajtv2OsW&fzu+=}Q(pq6EB+q{cMYXS`PTDQd8UjwBgd8YSmY}kjk zkJ4}}q;&H_24JPc;p=9Sl|G+T2A#jySOTg#7V2BHp z%KAqm-s!Xerf^_wgrL4o*+qD2PRKFU%>^>qX!PohbG3AA>4AyM>6R|De5Hj;&lecC zz8w)|KGZTN;yHB7>uZ}}*xll|;ZO7bZqqkm%VNDb!$86=^|9kwt{kLrdz}zwmdx|@ zUH}dkti`HOL7~rHnWxeX;J?d?4)-hmnBAnuyo>GNdEAN+GosuXX|dk6f$Entl&mz^ z?~ohAUBVfqkoX&RuqAz{p`5=CDZ_TGg zO|}vmQz-I^v!(p<&?s_aoznU6Cm1x+RI0u#P<^x~WbwnZ|J;eN7`! zG2&YS79SMynl;^LIIBy><}*N>uqWM4?gE~9l8T}wj|wdHgx@OE-=rb_uh*Gz=zJ+|!VLtNScd?T zGDJ)084YAhNmyH0P)rI{J1Qv8xjx|L*BrWHSn-T3+ax3rvFv4d=uUa-^{cAuUM=&;BmPoOLI znV_OVd``#?#GLjl9W_E1-@7$)gf=LbteeX0*`xvJO4+YLvLrlJc3^Oz&yMIX%~BbH`FY>l8@9y{cBKY{UpUv8w)e>s!`v@A@=C#@z--3$%0 zLVNi z{Iwsn$eu;@g}N0KRYRyjD1*r90LR=&YWAoQ-!~21PIVkfa$u9nGxhF0_UVz07 z=xF0?oGf=a+D5K#ZD)shnS5o&%&n{LN-eqhT?C)49rqzfY6Qxgf<=FlF{Cz%P|s^h`cpv`rAE**;$?Ck*9+4L z#ZP|HXYYa1GYiv;09H2QQuR4>N?iYVXbZi2b=UUEn=At>==xA@=icSHAT!rd0Nx*0 z=N*bh@#iXagp^MCg)Tbk9TsjCwmzc%t7dzZ^U|mD0gDCykZ5oMV(4wSh`|X=7Eg>h zxjxc=@aA9X6>r*}c>{ry6(zp-OTNq14oHeB3RH3tA*rZVkbG-NuNy&eU9#Iiz}EpM zLNomJj_yF6=c+%!;w}1M*wVRM#cZPaasB=Cc3#tSk%A?I5+Zu$${@kye&v+j?~A<3 z32MsRVI`qGY7GH#k{px}E%UsU_6W=%i}--q!n_De=C@BrF;j+OdH8g!$` zV6u2CUxc0dO?r_J3xE$6ecs3;5kITXsGdw~vmOAwDTI9mkJWOz`OCDCdOCwgjBfiQ z*tZyJGm*hO?Mo4$)Gma*iHsVf-*d4OEZ_yKF-ddBfm<|c5i;KB5|hz%5rN3;`$6Ab ztAKHc?zPzrcb4^)lL)!iE9Glv4*a=gcQ5on1je_J>nvgJ3Up(aT#bXeArHn}J+GzB zD8SrENm6}L+IF4`+@HOATtbTv0t$J^&Gi$fx459Fz z7wxpfY0dK-Srw;DA0MsSk{?CpBAv(tid5-Xb^|5)gGK zNL|l4LI{)1IA03zV}W>{+o&p@l8SEW4Bw9(_odjAUs{T5SySR!5<+9!(hNPQk@{y# zYIZ}I-!2jTc!aKgDbzIKb@Syq_5eh`QR_fR$5(;*7YhiPYh8&jf>4%H)ZnTc!eoFRn9}iIsg-OzD$H$IhfV0+LU;1=0I>N=w8p3@J zNIc|;!!c`R2Z>}6E75u-m%IOyX})dv%uv(_A9qx5AC#eOFBL=1z=5}dM}nC4qbaJF zx?~`h4kBP*cwVn#w}l-Dh$BXGA|*VX zh&BAu#{8s_pib;XA$HLHH<~F36|K9VMLlYMjpS!vkM%=DksvNtme;VThWWddJq$vuXgAJ-0$_h+dMpeM0E9f!GIT=w0OOB;dGv> z9^sMF;b3iBnt{z(w^=2-oDUa zZL1ISy?K8`QwW$ZLApM6{hIkTm`pv)R8}?MdBQ|r+SV~mAA1ouITuA`9q*LDkEvy> zd^y7)(dZIC)=L!U)F7y&@sIx86`oVY2a&M;eM+TADbvtYP!aVKQYF_slaWc9uMQ-Cf6M7saq%Nj6aJ7r&orhD(Xk)HyVx6> zxCG(M7_%{*zi{vFoa+)|&zhvZK7&Y=ceji*lL+dKn4N?abO?<(OAWw<_z4fgF0oX9 zr7`}{X^oi8hvOfHmNAjqk)87~LD?>uBR;!&E8VDpuipqRF;-?yX(;n6p(1S9m4tX{#A}QO(g@_eHyIvs zVd4jiG&m>UCPvkMyg$e8Fg43eJ}Fmy)08BFg2hv@`bAH%97!O>FdJr^u@N-n#NJfK z7~iPThh7(Q2Q()knrGNsrLxelSPVEX%#(>%Fm~>JwJ?pst!|UOKhWMsD-CPVva#d= zL6!IJagVE^yhtut=Y2I{iE{AOnzU$$Y@K6Q_#Q8YUfBGXLXTN4w*70a zrQdW;i@dXQ>ipJIYFnw9+rE9v8aLQIbF1%}W~penuy{VHrogM53+*iuBKAA;InMVk zsXjF#yskM7oxyXe|3M>Oe_;>KT9=0g2z2`iheX5WiTM~VR=!4|g`scUkBe5HUya&@ zD zs!OvPX#U`0R;8(EFuvK%qO&qKuVNCx3Q|X1af`@_{SCSKwQ7_}7OmrA7&_Q+WRCJO zt+{%>9F&Z%Z=X76GVW_PaFOYP_vNZ)_32?6tTTxsMR~Ees}cUY(CseX}_rGN%;B>`eqa@<93nAi9j@^7nQCv4Ici=RsdF7P~2?ZNe z?iV|1(JyCdKAH$o^z_O0g0JAVS9EA7TZ4Dsl#}~=p-QdKBr#ROu}AnYXm6LGXbSNP zqqoVvN`xuCUvrG!+t(9{%oZ(-;BpP$J1;I*tv5yDfb6}?E??6iwDS{?)MVTtm}g}6 z?Z|ukUf-3UxKTP^?n^nH@WdS98g#QogbaC&)*8*{gDPTJO@S}&NyyS~x!1RH3^5iH zcCmkz;Cj&AHy%4fQgiy_-K-2JpHF38M?ZSGO&8zF?A0sNb+UU^SaV50jUli*_V$xU%YZoC#+C~$Z zKV>2mL2C&_@#Su*qv2u(K3CgovSWF#tM2J?5i2KvZGK7aEyJEK0f-9$t)!&Yk!#N? zg_;s21g~-)oYx+>2W&w97??$sx{LROIWWH71uN=_mO$41J;-i=*=J-dSN4D=5Fk9k zZqF;LoJ_C>-J=K=aq#S1xxK#|fPdP-sldno|M3G8PSu6C)fI~XAVPRUhm1`SRAy<9 zRm>LrHG;$>!X!8j%>bD|JcPM+6`cE~gC5Wh{=~b|qoi^?cYYbcEly)sPZ^gz!ZU4C zRksXgO}YQN3~66mZeaQ|Hf%b$YwIEa8oxq#-#g)J;SvTQddooJ@Aa~E@L_cY=x)9F z4KZW_e>aWpsgqMex-ON3YA-{5Z*WW;yVCDbI)N61|Fr<0&{^7ee|;7;;QxgsG2$|m zBva96J`_ygBgWIpnRC0g4Vo1vd3sII&PIPOrxK=$xCu3EohZ!HN9JlA9-|W7aVhW9W{t}qz=hOup4}m}> z01~>E2F-K5CGCfDS%?FM!kF`~bte=nRYtIX(Q`l2-D29~*8aw-Cr>ro3R&wX*b@={ zEhcxYVkqn|ZTr0zW|aVfirH^~Y`f3rs(!u!ELO_N(hM?;T<<0;B9M6^on$w!B;TYt zzDkoiST!l}ou}ZVp8x$>d~sT&ZuO@Z|F>c^xUYFM+NQLQfuos%U;fk+;v1Q zNt_h>h-g8zBIqiXlYsI<^P%{|LK0%Vk9?A)dnv%+uwjyp*fp_Tr=C6P`bR3ajY+yi z2fw7%EPa{Nj4g)qe9^UBq!;kdFn-)EITv>4!h}ZItN{(L9+wwq%*>%EnX{5`&ni=y zt6%~b%RaVxsXvt?qc4{Mo=i*s4u~4L_l9L+%<k+KD?>O5fA=-uQ2~FqZdx}1M8Xr#@^`O>>#&hDheFJp5KBz>;OStHNMy4l%@BJJGv#!WIKeUuk9`3-;Bc{*R|5lr3S@$sbg&p{jgo z!V!am%_U#pQe>hMAf*+fS`T@u@6MAmJcD`3bF$2jhX&A@V@akzl9Tn2_7cK!6FY*` zoMvg$AXT;7(3h?Ll-##(912;f<%2)ZeZX#$JtLY9(RX*={z0oxR^4diCmf78&KJQv zf3=irnG3Li>6?E~Pc#k`@M1kloxoYp4D7gL0{tUELFBfA@RCYO|HoC`UgI;_t& zi2b{*U?5f}nrC#E_`x+SfN1Wt!kGdZwGD(Rr}RynRIvY2|$ zxUnhh{>eq5BjA*XDgz5@G-5nO$}$d^@8ARQw}QAR-)NIra!6KMt$#XkQJ75QexyUQ zk_<=NOq=-AlX6IVQn#?l#oh3lM2=sCB&vPKzIA6ji~iq8G|?btJsi&I5JXe$3+ia z$&OBiM`9g^P73`fBctJ_!6EW?rC)0&B!Ma`{oKi$1_et+*`9G7% z#Px58Er?XMX}kIZ&^(b7bRtEx$!}huCY0z!cxNE;&;;ww+CSwv;SjUsfjyh-#VQ`- zhNWae*PMHrBj5z)fJ9IQirPee`uoMwjpVc(({=3*a>z=>ZcgyIw#) z4j)CO`|ZByh9=V8c(yofLh_LqDM7{gd!RPn#emS)f;7&fu0nfpF5@NJp&Fs1-=GC7 z?n%017*0X@a;CzJ(tX|!ux@1<+uAk1kcS+=avl?ciy`)(v4OAhpc0BrA17z1zcH6bJDSnisixNyfk_P#H-Lnf~oRO};mi806El9Z(IpIX58ri!@qtTH<$h6L; zJ0QzO<|D#<4w%Pq)wC|`rF7RUG{S6aS(K+lft56aZXOBlpAW864T7_>T&0_~Co>tH z+@W|ep9Sq${D?xwq6eDdK(nyLo>4bZ<9oXDN(%D2azsPdNRK#8aqC<*(g`A<4<)9w zWkgP8@kAp|9R5(>s1d{wGmdn!Ayys?RBKwG-P9jxwzH|{EZv-6jNaM2DDi_9Yrm+1 z^m0J=)p`rxXxDE&iJ9V=zs=m4c+mjKo^|E^;q5~;Ru_%UY}ta!xZ`Ika?$%MtOqtQCOGCB0J><0H0> zcxjLp!4i)bdEpQ*TN=RvDm0O9AA16dz2~7L+OJbbr4fHL!cLxZ8``p7M*nM-!3hY& z5|FVQXoF~XQIJX1Hj00BQif^MGYJSok5UVFHFbas&Pb&j>gW+jXC{*OMxzni!4`eJR#;Lr4;$3(j=o92%o&`S$3p=CK)6;QoZf+59O z%%6u2;;1)P@$D)hbH`+bmsjZiVUBrFuLsLbht27t|-Ns?^j{- zfdv+P&n)T>0glVfeSH&0re9MXZ%pE<&Zs&;l5Z9$7looi4*HTxd&{YNDipf-nxTdf zMvGV;!If%19>zBgUM0EywFY#7YYFMEzUUEBClIggaEK2~o(rNg9UTh(tW!NYg8Hd;_d~EO#oje2|8or*)=5@;Se^ z=>tgvfa7&8b)xz?c3R^L)o`Fg6@QQBOI_5!ppHsjoKppdV%RCL>r2IfY!hO4Z^ z;;Hh`$;ksj4p%r^BKR3fh6sg_Movo7s~P~envIvW<8QrF41LJ!(K-@Hxd+jb;{eiY zo+4nVnFY*N#(nP4>MFBQ%gfN@4i@r-bi*2_wYm9exUrJZ024qYVOTRu7Q;P$_)iX> zkUn_ir0iUm9&&z>a_Ye|q>n4uBaoKl0yvbY8BDazU{i}kN~6ujBu6Bl?PJoh=a-VI~o$T38JkoZl20p=)GFd~fWOh3Q+`v4yCYlCy zIu17=gu8`BZf~@|;hMLGi$J^2pIUU}(TbXUD1ov>zeDgUI5D!@#ubF-ZfZeytTJJ* zZ{z9VXw`u(4eWU)a`3bD&fkAMFo0MnfKRxuO+!PL($vh4HbyI&WsfUHu85glncUbcZo2hCk-37Ang43@5K6HRe5;y*c=X|(*Ke`kATu#%nDrW@$0 zwBLJ)rys#D992giNl;0=FlRD?g6con>a4Z((?q_#fKdHVY~mVx8{Gv(zlEELS%GS) z{4^gIL1Pck1F3rRK^J1a72*-36=wruTv}kXi*E-=TlBiX5D>uMDBLwy(}hGgdHS9& zgQmUC6>0BFfi4$Zgh1({*YMlcL`;844|`7Bb0|pMaOtHJ;WT7Wxi99_jiQoX=X#OK zrI%!#nvP8+(hD%+W@GUd7c7l9t{0kSkwAbnTPws;Rd>mpwaC04rRebE+s8p_PFfr9 zb0bjGb@Y1v8EH`BDKRdt`c!igAJv5%+)!uulbr5KHMIm4mnOjx5U*;2)UBh)mVhux z-H))jMFmaTDT8xNn5e)phDBa15BO+83`WY4XD=O)2`Z&_+C?bn@? z;ch9lY<7E}i}-;G3^**-q6&BW-}K`DZ+dt4%>Ui$CA4VuT1wCZ*NruD0+RK+ zhj6IpRZb9a=vtkQlK(MG#k9k6n$BrL4rFN10}WsgJ9t#)0e{@dl|p)Z)~BsKwDYQ= zdf>x(2~0xQFyw81K=EEs^ItweEA+m9W)?O-d_6`O3vKnW#l6B^7h^b$!l7eUc~k1= zE)bhN1Q4>M?>@tk-KDNr4%>msidy2QscDHh6G>Ro?i>1khiiA?TrSroIP_wv;N`)p zym-A)hJ*XI2z}E%{NT@K?+&Z$?)!bx3)ugceQo!iC2|1E1XzJr^GOQl{{4Ro_Wv2l z5Bo+g761t~JoTe$$iB$L$_V@aMV!vQX^Qy-BucLRTk`%RR)e6Hq+WH0bN~Lohae&I zhi!YhkU=-Eg;U?y2AL`L4dTIN*#7}n-%tF4S-+;x815Ei6L@^zAb1er^%Iqj!~V#0 z8SYlgSG)fJsxUZ9ruW{7^n!g)rg#SKW=uW2zf2|v!iUxWruYAUr}yglOF$+U0YN1I zuYaeF+dUA$0eFsPe!AV>Q?frJF31K)>oKiaK!Ur+#DIt|lRx1MIBj^+eRGfwJt=T; zPnvCtz(;oVNNRx=Z)_Q0_HdBp^N`am$+`n%FW(MH;m0hFA+kmy;u}Ojrrfo!_jF6z zpZ{9A*c>U=1<89qZJyeWX7${Eh$s%IY%(SHb1Sj5>W4A!vmF!S`=XRY4f&Cf1`-kfGo4+7MnchDZ_19}5P@hiN1 z=4k4B@PTscblhlc{yH?Njgi$n`ylU3eO}QHs!(tZvZO?OZdt*{<46fL4Lpu%@18?r zo`wjRJ(>~Qp4I#BooK}0MOzxWIX#hJ6* z9V{77P-fum(6y6`6%*cV`<=%f=g3jqZcM5fg@b5sBONj`&f8!7+yj^UJ$7=Sa|MSS z8-uhGSDLOld@IA6!f9lmyAgPvV)VynS#|M8Dahq(fzXI$>ze53RP=rs{6phEsNrz& zq!SQQEOVYHsfc|;aCL(*n1@V*w1tR-A%P_HZ;tSO2odN5HGOj&cz45wR%Fk7!uxGF zNY=`w=Fd2u;z#-fvz0Q7JVETY1SZ^#N$# zg&?jRICHQ%9?sfH;^QD^9I*m}BpKs~S0fXS6qGB)E66)aU?Gdo$ER~&z1sloFCmGD zZmoK03$aU%#t%k-9FVcuTBN&~cp--NX%(RF-Ly!G9q?Ws$iCUF47T)1p^!SH=@;~} zq8zA<4Jn@#S^Y+q?Glp6Kol)mt7<`-gfPtM+~=p36zPNOym;VLA~pVs`Y`0o7-b=C znr!o`cw-rkT$L2N+J3SQ52zXp7h3+_UIOG}4{~(YB#zKJ8R+@k1079<8~YX5*(;)G z;7`MeK^WYj)-;WxbFl6_UBS%Atf+7ZPH~AJ5Y1+Y2Ja=u&eN;N)`OjO1vv_r1@qQp zDMg<=F$cqu?l+qLhe)d*5}@Kx*AbnoAWa1Bljjt!4_@SMdnnlnABbkRd)z5fmfrj0d7F%(x=zhBC(avnx zUiu56jeTyXMX&Qq7$_X|uLO;2e!3m8f0vD{F*y4KShH;qJ&es!%|+6^Cpv=Rh`k^1x{GgjyX2|9>Bmog0Zs89{K z4T|L5wNutfGl34evil8O#;+ACdUz@LFdCJkpsal@rugg^;K5wWW|(eX9AdLN|^BSLOj1Xx_>eR(-Yb z0BCV@8=vf~=I6j|7ptb61}#UuKDQ1ua|_%oJ3|h*6uSh-Sq@xM{XA9EOMP38i-BCW z^RewmKs&8|D#DK1X!K+4x|r)~aOc~T8BeYEJ&?C7O0g4Jzp*8332=Y6_I|N?kxG$D zvEO@v3oD{Qo?LA^WtljW;l<;iop^e{3D^?gaM1I}y~?{mJ15ys8kT776P*Vfh5Y>4 z8@RLhyTy6KqoospV;Or*fI9}BJwZ6n(NQq+J5OvPy*7T$&L7+t~bNDPCG<*T()Fl-ny3=lUrLTCr*}YP0ooUj# zn4@Nmw?u%mKxw-*Lit%ANk0JXb9oC~sPhsyivK1|545g!pWeLGuKbDc`~n_5zpU zF9V&%_Fo5hNYdR^E~|i`*a;j> zT5x;u(?d%n47URpD03~7{;Jy%5GRPJQ><}tgvHn>|8)^fbv3=L1X{cvrhcoegy*lRIE$#&h6ew_MpL@-0>msGo8e*r(EjLPBkosnCRESSeY6k{fw(0qCn^vAcApXxHq7=CmvM@o zux;OabZ~K8rV?im&om=;53`oyb)-Wg)c!qJzX7#nXycTwz-nc2OEo2xHOVgS+@mU% zE16`oJ71s9eLPR^7<3ryw;!c)^l^sq8v;Ly#w`bSRj|u!ctGq_KpK-0D)@1ma(`|l zP4e3>F_LU1vwK}X4{uD@7* zO-G&5+a7KkOFV_s!FXww_+eor8?um?|BGikZli>!&{yY24BxV?jbAccT~1dBugNE;I15g>ue zssn6DQI~SRqZxd%n!~U1i#y1Qh*QuKNK=|FqUAtzDB&*w1;`c6SrjO91750AFV zSrygkh^oa&LlKYY*{56-Yn1FRMV0_dvT#W|VX~;l(z5Dc$7nyzmRJosDJ%om9e*Xa zR8%yF$Z7|Alby%nEVLWAMr|yZ;qynxvM1)^=a=H+kmIX0?#FyXd#U({`kjYrusgB_ zw{T+tHbwke+{!j9!iU)2HO4jxX98)TPKBdWZ#+eB4Ppw1OHL#vI|WTczxRRCN#;A% zfME71=W})>>UWVN`fq}eF3q@X2D5U%q4GhJA7B6S_Kle@2wxVBAASKKAX-pB6Nn_h zH8!k}OWJc{ift9HJ#YvdcB5t1f_zyc>JAM|fq=J_AeO-SrjHX*+ML755Q_))`r&e( zDn{P%ZGO?zCpdlA42nyK7@~fTPqWa3F$nfsaUG8&##7{=4x!5?)%3TX0~ z{Rm3Lt^<3}rFNxS+-}An&*ftGv1{OfP^(e#7>t>5)!B%@0T+rVj|1js8LeicYw^=7 zHhH&cUg{e~0UuBne!=U!J zAjLS9A0#vf>%?f8T`R?b(BYGSqGXPbl<7na3Erz0~BL z05y)!VKyrmjtpwvowflTC%U^CkE!GhO&cENYEC=%k3H4Yi{%$HW= zeIT%%=(N-kE&`A9UfMi`DNcG;EQ_qWWMsn#nliBpw`;z2fxwAg-yNs#ZTAN!u@6gw zm|?8Y(0R}wJJGD_humu1T5U;i61NNB3sY5E4=q3IiHMJvhR)o~sxjr&0{3^{QLBM3NDMZ?zYqmRemM5pod>B+s@=$AMf-f*8g+GD(3O0TL5TemUH z_^9DT*SFuv7ciZ2+abUOX`o84{CtYAt>VQSLZ$sFb|ga-f}A`a8^J8J zmWlcUFmHWD$|JQ*Ph%%0kWB0|?#`CSBg^LGWp_`vQNovccW&0}d3L|ZkwT_CoCd#_ zE6?BGn8f{s47BY<6mg|L1Hu+003IG=)}7g(pJ59gT}O7d75Ivoh; z8>9{TKs77}*C|UG*3DryCu^ocbB?|Z$4^5{M7rY*9OM1^!MBoafjxnSOD(Sf zx6MGJNn5g-D>_wHai(4QfI?=S*NK`F(3s3^@}|ANdyt7q6lLf7(W56)e-HdN$d$R{ zi_HAN_n&tsKffOmTbJTqCC!1pgpV1No*xsl4t0PZ^O;1LWt}!eCbP8{g_ld+g9ToM z<;yVL`qcrpF_t5#@onPp)&eCASLtJ-67PW&swLJsVCnEkT^IOb<9uKJ}#Dw7BcAaMdEAj2?=pTaTMj%jR|u3FLpx^(;LL6Et!p%Pk0KH zNSqb=)hJ?U%BGcBN!)mJ=gmu^#lHT4J6`FH86?7GSJw#${v77xaId46T(N9IeLPlgq%CSSv`?3l zlcb2|$9(z|fux>(4I3VOL-COn$BQ&xD6l4OC=ln%qG%WrXAhmM?(ug|BV$l=OOpnu z(d$iDum5F391M-ZV+*iv(n691FGr8|1=? zC*7??Lx`V|_ap<{SWXX*+H1VLd42RpHaSB+Gk%dxq=+6dsP%cO7zr&k0_ z|BH_Qm*y^a?c%8MnkqKeZ1YAsP!!L{Ys{VXM5e({fAbM(@sxCWYAec_;2l@h7W~(# z)(vFUw)X~uVvt#C1Rk^)MRNUULQ!HF2q>aWNx3m)_uuK25xLVj)d$i5BJ8t1nK(4a zmOt$bl1lcEmEza9nB6~5cwuRt_G0f%S?tmKj5^>@lE6bc7o=!p+Ojie0r4rb$r3P> z45GF)GVxgko^kE@oDA*^%Utl6LpZ z^n#7q6q;~yt!K^nj%0Yu)%wa-@9=)AH6U-%s4${-!M2bez`INFOHs;yh|VV~*uzU8 z5st#$Wk>5g=Ew}y&?P(%1X|&_FBwATGVW>pAcM0_8rf)H5!U2#NS|{6a(#`}(dg02 z>l3wMQ+Tv%45!6+VEYQKk_oHDLC&0(rdULNAelC#!%*L(NJHpH84~1a*LCy$U8k?A1Ki2zsPqq#!Yf>B`BbjW#+4JrrQy|rps=kh$QRoOT0 zL<(%n%M|K0at!g23?P0|1nmMriPv79HHTsL(2U$CBx2O2`|Oa(HZutZ!_;TPezM+^4>qGhGLYIa=nl>C z6H^wFMdc?U7M-@jAXWwT7Y(4w?~??@6rx@wKA{=fI}0puwRp0#Pa#ralBXcUyOdgm zS$xDJn5Fvun;ghlX1Xt_Hb0emX@V8Qt$P;vi1zyQ0|XrO!&@u;x->Da2C`1Y$&%5d zB!G{n=(8+Bo*#8U9O&w+!%($1St5?!9E-k{x}WVNnj8mZgGGQV+2DK|v}#aPM~b*o zx^!A3w%&qY5jjbES{fhCnf?T#ZkXnL`>T{g{vb>|JW$=Jg()~z5lS|w{;8Mi{-?mD zgchkv3y;jtkLmZ?AE!i3v?vWTh7MC%uZbdb(?%_s; z{WIV~Zu0GCb$ARzj6tg;6Jesztc--?g*!osYi;oAaBv~*b?;FPbgL2kS9zg+lAOKB zH$c_O9|Gg~@)9eusgJrC4x3zNGlY7nh|PGs*R!FNhCSA^4bjhQc_FEYffv*oJ;JV{ zsZs65DPq4|ikD&_JkSb>hJ#5Bv7n-r`jHNWg7H#MA{6<8G?jqH+)f5PPih&VstgOAQ_kJWU~q_gTr1;Z>3=ry?Z#<&;h4n*cAs1Od=YFg0fJj3F3x31ObEm>ADP zQlKae3WCxbxyByu*^6I?G1WpOgbpOru7sHK_!b%F=?fj?wb-NVJ6OD*9)8W}|E?L| zg@?L}<@!PfwOc+Y(>NTVage?7?P(@wvj-UbaIbsmyJPq?w4$cV0Js*SHkU-XC6MN+ zB1dO{r{|X__Ei6#XD^vFiv)YIgfzzN!3=OZjy%$vnE6FB|6n2~cwA`#hf2)tk ze3$^;B(MjE=SYGd=|u5Pf$Yovmi?(d(dQggk_-Xw%rh{A3Mf8n=N)q;| zSRV4Ky&@Aqj`F-}!8pbju)Cu8U9PtN@u}i?$a=}q`_vy7YL{=yjT@H? zh>UIr1m>m%F*E$hpFm_B9N?`O073%;-3DYDJq<{MW8n`G#L2kOK*Q+<_(KzAUO>J$ z@-v%)f`Fhyf`Fg^=Z!AD}}$IY7$}q_nDYl&eupX#L(TyctZyK?2(k zNkum&x6M{|k`YCn1o{`s(-K8reN`%>Q*WL5TPzXfBP)qGO;S^vDChizUmi+zZ`JC5 z<6QnSAnz^PLrbobDEB|&<6wN#f{<(E-+3^yC{*p}3h}k|l0tS^B`u!t(#7V zxKAG(q&YeESKFyRIEX=;>xI77e{MRPIdPnE5U1+RTue6B=pa~;Fk47tkfG7;-Y^(l ziASDjUBZ({Vb)7xFzW9mHB;c6NU4)WV{fD~w4Si)!iqRDX?oCJh<`N6Ty){R2h183 zHqm9wt2Ejiw5(+&c{Kh8=AVB5=1r}zDd9QeZ50|L`0Vu)k1w>|hD|WRW@rtuECb4*ClSG?fcU6R=hK2kDSJ9ZH*xVc znF4QZO9ug1(rFmFi-5k*%WC(9Gq?RCb=MTEJU0R`=4b77q@=P1z|b$z4%t5fOLcpq zaVS0u6X-)bUL!Ms9P+&rGV=_837UWe{3X~#t-B6s%gSN;!d2KJJ_>&ABjk)YI4ivY zd1$QjNRDp1W|$fNR&${areq*PGEMNbs|>=F`^r=Re6gocQbgEuOZ1Q`+C*{}qW|qv z@Xl+V|Dr(!@;Yfcu=KRlnEQH+^O5+{0^sQfemBOq!Jgm**8!M?^T&77S925o{A$_D zZ;GgGl!#{(DyNGJk>`yNc7df-N0FSitrp;XeVB4~jVUCNS>4{~;yizO(6xHYC)@){ zVf6Loitp(^{w(T2x&4VIeCCsX-$Ih+kzcB4ZgH%j>hq2V@cz@jnD%Vi#PNVZN=H-h zCzbF-t8xt)*CtgTZg1leL}FIH2x1{N+1js{b-g`#2zRDZ@Pg_GIj5F4)l4*^pBTp# zVr9Uh%X+;ixm=>HX`d)2$7QHaDC*6)Xphd@1A$n$9=IaBENT;wKUZfmD|aIsyfNOz z5=NBgN*yoU0clg3!c918F@ZZz4XaEahrWq87TcJF`Yh9&F0%q(uW!diSyL)Yj^lV+ z`(2710_>RS(B#v^_ln&tpmN)Yd(9hZZ|E8i^GTuYF;q2xclx-Y&TJFV>>mzX{B#T3 z`{X|u%qh8!>7LN+S{q&naKFk)O_rDYZkiYtI@fk{vla$p$+*pQ`V2RH;hu8X#LW_E zRO;-z-5lPNv)?LSKw4BwZJ~E(n_cKY0RCqEYu`YYGhx>M__mYf5&!Q_Zs_KT0|2-0 zqf&X1P#eQxn~|0ukTZUryY&ZC)2rvDQy(6z{m#UxOx{*j%(u=4ClfODN#tdjmJ^A} zPx|4<2FU0n96)!iYF%DlVdRG6+Id4fiaR(R^EEiI?y_AC(0PIQay$B{%e;l;hMh4I z!p-XRsN&Tdb*nj2mv=VHEuQagw}FS--7h{c)ob}K?w=z}={F~5WHjKYHhPV`i`NpW~a#u|Kwg(=*spIO-D!C6K2BltAIKm3| ziK5fKmibD^YkPslz1=k)S9uH!p3kE!ctS;@@%vqP^ajmhujA1q`9^KYC#Et$VoU3&E z1|C6~jrc~?!zcg{zqy}g1K8ut&vuhA`z%l!^0{t#jT&z^*H8VQAj z5*7aGS$9YwK9=;0(DHLod=&X^K#$$z#I<=WQIp-2a9TCzCXmR^J{Y; z;#ol>O@yA2{H*Cggjt1jT3OLvD;q4zs}~w6!cAL+U21IwT;Qy?X(T&3FX`?YQFKQz z`RoXJBwOxQygOLYg*Rl6NBc1^sXmg_IK+WA-1B?sELB{_xOF=bZNQ=fAwTS868766 z@!I+Oaeo`rZV@?X9YFnCBilKOCr*OQUH~7t!R53gz~}-YQw;%a+S+p_M+;T{{TY}0iiPE6!0H3<-(vy+TXLxp5$OzcM+}S zk(8)d7#j7qhh#3;*mw=xIUGbnBm=0SiCbBwb<4tj$Ej(J z`ylo+(CwKvdm_U0$azN^Z{Jw7gjv7meO^_31Pv8T%x3PLA}scc;q|MH{(7h=>MWiG z&(KL4S$JOVrVJ)2G!@X5ZZxJ=HV!_j&g*+@@oizmIPI=~xFK>I?u|r>jr0x~DR7TB*w}G7>jvb&ym)Gh(5#NcJ=G3~jlbv^AC~ipE7d2(lnpgS z%+ziRwb@tUC7U4C&jYhQejB74uzp#^7?hBvuR={h9AxT}*hl$*_701{aYt+1-rCN3 z8W@1zXfn0rF>uRjPHQ@ynCp&aJ*VFcQ+F63ew|QFmQ-L;MG1_p7QL+xJCkuqs%NoE zni;YL9-bP0#N^)Tb-+F?Uu-|}SztSPVAxtNNY+XH&VBS*GP})}n}90XZpd-QJQ_wE zwG8>j!MkOgz-%B1WhFMR3~kDi@vSTfY`&!Rf6X1y>5bYHG`sKLVb&pOz^*l?B{mG* z-rGkvge3HS4I!2lc=&@sq~_Q<$Qj?Oubs5Eq)YKiHc!%l#&suqmgnOw#qM94uM6{? zJ>ceK6;*cfU$AXRekrtdA)m%o7!sXr-Odi-a~-x9bsrAq^G;LB_|1o>S`WlhY9RZ) z^hpPSUOOE-D`T8n(#J7BNQk@d`-f4su-g|pG8u^0;Jrt4-g6E>uKDSA5{|MBQTA)* z5~*r>O^Niw=;jD;tu^`bm%IH-ZY%eQr7Y7x4-?BtYg?)iJDn<7fD>j_3f^0&CCuGaOd3fXTN&QtKa$8@zF9qz zv7)HmCiplr5_;4Th6(j*ZY_9cU>JTAU9;XnkTu>Ogcl7AVoiWa3>M;ZfR0vc5v&d_ zokbN8cMS~O5LGF#-u$Aq=N6OnlyN$p_wsyxQ~FAhZ?HSmJc%X}(v8pWks40^987x$ zE8hcofJ8{nB%3&3PQ)FhjusUj?9K<5BwC@eh1gO4d1Wup>dv}NC z&ca58Aj_KV>Qh|(=v8f><3~)y2s*gk-uU&{D0uA#T`iscTz*NpkG|3hwp>?c*5H|Q zsGV8{5T}v?`AvYipi&s$nb?UZwsekF$@=ynVL4YrXUXCE=;@;Gqzvej5*cJXs7Hwy zx)hSo2ehMv4NYr$@)Pu+M9F>jKG#cM9^6p)a2j?h(xOwWPtJZRPR0<0BJbywfKZDe3D(zN)^ zy`)EmGZ1#qAErgS>}A6C!B&PfR2n=C>=c%k^gwIQdZtund-*~A%^8It!-Y;N4djQe z4<6U@t1KV)SG>(W6qO~Y z+7sB+{jF@YPp;HSZ!=m&3AM86LJ#)jJ_ww^gJ>dASrE!&DVf?FX^MDoBvVk8I}x?& zSYUYV@E}SD;s=DfpX60SqO|4?`uwe?!D;rqS%Jt{4sO5zM22YZ-V@5o-aH6nsLTH<-olXnP`L})Zs6!u zJSA4$G*Y*_dTy)UK#_-?a12Q#z-3KT4X?S{8R{X4uB}y{3;#^c>)n5DS8I98D6B-j z=>=2tiBteByl|(#p7k9ro44yGq;mpLIA&Gd)$M1PE2JgtGU1K|@1Vd?Qa@rEYb36i zx9_uXXDX)nf(fY!#OgO>n9d~3V~^|GZ|_oww_H(Oj@o2hT5yLD$pkxRLvVXZdbUk4 zSVPW!3i8TGB%X&RPm1MfESzTuobj+f znqh@E{2AGmxbMT*VRAcmT?s3Yj_B0@!}@Yf>&7<}>Zp>o!b_XP%U-B;o70=CG!H$k zvHY~Lz2LE5!K5I-c%hqPQd30pI|Y(T;UkAa1+n@yk>&Um^9W)87qlZmnGf4&DrEC0 zdcQ@BehJezw8Qk@+h3`Ok4s!<0KuX<5tZ2f4llcNx0DMxJQU)jscma+SjN>~JHlIk zmBz&TmoUsHN6BovsOB``hJwweRVS(BXiEa}>v@_%D@q$HUZwN)9Erb;mk@q*Y8)jg zFV&d7yzHNXfhsAL?ZQD2rS<@-yF@qXo7bUE_zdwm?<;=R1AAN6HEi4+K|!fiknjPg>MadltRW^zhJf18?hQeIMa(LsbS)qDRk9e)D^rJ!IV z5Y7Xh`rfoM-M_MFL#9>@0C*~3a^&0h$@@pIlR(C{S?H^f(n>NF^+_7Xu8~W&%e;m6 zgX4U?R>9c#HX~E71USo9Wer?((3$X4Q0Aa<0^Yx;!kP51{@VHo^;6y9(}Uz|iUVsQ znOitp6NoN%<>gI*ol%7G{*D?56v(BS=i4aPIT^+G^{LS734Q?Hx4bb-FkDA@-uU$! zZZNg>x+J5z1erWXOedF$6P&FLY%TuzxIWfe!whN|S1hY0@KGO({#V=g8YA`7oo($C zSJwRSaVL#+QF^$tna|xJSXF9LQIoW-tGPhmGDz#^Q|MvT?B}Pp5Eo;|&c)cg(_i_; z--*A}EXz=Rz~Il+;M9_YTz0S$l^)r`j@W(u%c}kk9_8b=!fDJnwIiD!9)&fCZK&#jQC`!>8`b$Q(%r4RmLyub)R4Q#N)q3*#a6 zi|>3X$Y7jAq&HqSdwx03+wKMepYDW)Vh0Ua#AR)_= z$n5$bwGGcS5z``spN^6QYWob19uFn-4&9K-dsrvt*n*e*2spnUOBoGv)wuLbriq~I z%we(gs+V@xf3nnO*rQE9T+Kk1o`GJ?!YR^DBBg(}&aOjk?aY=;*;C8Jpul68|6Z4r zdW%&Y;IRw5CH+U^N#e`;o$9l8&h(8@rg0>JwFyr*jOzW#NfJ7R!~UbH&Sa$_O@~R1%g2mjKrvc-`HPy( zb)C_8+(Xfmq~Xx+WEgfqM2uaw2Qfwqc29{NCE*upWy`rHn(=I?<}r8w-Zdv!wtEHd~U7t%NzTTkXhexP}_herEobrJg z6+rN3xLEs9tH@p>DW+f}^Y|U1X(}%PeSA=TK?4=nIlTE9e>OQzrC zVPH06QXN0m$(ODIE3GQcQxbExiIwD-kaF6rTvv&Zt6gLNWWEBPBNnEI$uDkm!9s5Q@} zk;8fE&_peXfnFb`mOM4ohm4qdr83N4&C7a3pc!y|8Fr@e7;)+cdb)_RuO^j_DdMZA zAE?GF7V{T0gyL-9JqZCJ)rC5CBS+nm4&cX$RmHHTk9|k)hHUsS_|{+%;sEUdy}bw# zq_hz4-W(xN?DRuvCsZKb=#K$n+o>M~A?fH4@I1xD1x4tEKYyk(YlZ!3^g37s_tm_d z+}b}LA7}GZ%q0EVw=+-Evyq^0wb5uOb;@4HTNsCk#pD`kDnUS6J<4U>r*DzqFk-U3 zuv^wew6+JB1+<0r8<%CYh51%UE@Jw*I7YWM*I5WHmguXE6zGbG`IFJjqN*bDz0scSUqB+jYjkC z?X?3)Q9xGT_Zl|oaS@lL(j?PcSsCwal}%nu%wZ@S%l-C49yrVKc_@MjQ~f>_OLdrF z->ZKAj*O1`iwX8;-%RKAmXQ6TiN8t&5s;UMg7p*L9d*^3D^{cobd6SkK(5Su?`HLy zfv-vbS(0(pcF*(E$i2%ea;=W_Y;aomFQY}H#YXJ$-c&jSVMY`RsEv>KC{8lF?gwqd z6K|V5DQtY@Q!sYk-6%e7!l+<)&)i)zB>(gUVH}frV+mq##*BoqQ6_c}RaL>qPQeZ_ zO0V_WVY1@U+aTVbMv5dkO8hO&=?&Pid5Ew16RWUBn^pT1^hHI(_2pl`!ZyhWV15e- z(D%4{lVJZ?^hVsb#QNWMIW5Lt=~dPW4G+o!sM*geHJ^kaufyoI<}l|6ftwRWTnlos zq6B`G$hOouOgB1Nl2%=2lef4CSV{_Z;dX(A!tc83LV{^B;UL5hEN{jN$e zK;YvZJ;{uxjzvEqMik176V z_GGAcfVt-&HY~nLxdAvXF)(s(wYTRVFB?!|U85iK9#^9&PklE~UcdGbU;LgWYF$e* zv8529f)$akGZr0@eJB6!s9DGl!yi%)A%u6X3 z6#hC#dew32c&*JX)deo^n(3;wW|5&rT+ocQgd_#<*I4VkTVu5$;Btlad@w745NPcI zwOz_p0I?(D0S1VO7xuRz9?_rTx4%W=0iKW`#X^iq3zI6O({n{>C4x4M6JbT`7F>Q^ z)O(I$dg_llJNzsHY+tcGGq23E8ZIKH-1^aT*;i8AIogTwZpI+{Tkw-Q)|eu=vYjb4 z1%0;B#*M%pPH}OuTR`6wt#1p7gBO0{9ZsgJ@;Nj0LSlKx;s&uRi5qbqX`$HhYRy@j z{ZC-0rn-p1yW0xsCarUll|+~EEN`c({dgwb&+S+5^^cMkn*uX1N4eV3Nvb5h~YQ1pxQ)C$>fZK>FSo=WE>lXc#QYO0) zzO8z)IflArK?l#2YJsA#D}qFZDLQ5lzb;e6K#q30+GY@wrf zxqWQ0)#~3{w-*kTV9KvM2Md4O5C7OqP*nH9o;gXQeJ5i@jnz}nG=HbGZVV=tA?r%9 zx{o1e$M)6|0!m|<#&Q&B!FAKe2X+bSX29DfvH&O1!b#G(WKGnzDJGwEsMN6Was8s2 z*7YA+HE~~sPXOE3VqGmIoO%{BFGN+X%*X6S7fJ7LvyQ3{2HXgFv)NlP3Twi3n zZ4-n>-rh7iRdT-Zx{;W*J*S)d&HRupNup!AA0n6jSemfp+0UwB&|FGvBb~=yX~%*p zRAmw%#V%`BY=YG${<&LZZ)QOoMdwHa=XjvWEKkjg7wl1#o|H8ztF7{BjlMoAW?>O> zdQlYu0+fb=iQuEJiE#Gjj%o+{SBN7rUxfsQlHNVDEeSCW@MxK(7w!Y#e?Chm>7YBS z8OU{i*nKUK(n;sHL@4rQQS?R9XP`DP4t7cj!K~uqxr3V{0;jHU)KhuI=Ef^~+=PLT z@H%_hA{JaUEPX}Ym#1LdFb1C&6k+TSq&bh))LHTUhyjl8F1i%&R{DkUIDOC8#{hpb=5VjXXKREpx9zI`AKB*Ixj=5&Y zJam1k5f@^C<^erA+S>-A^<-Tu8^h7)7povFc`ipzuM*?rEFKKQ`EMp{Qvj}!c7rz% z`&%{P6&fn(bxyk%ewb5#C;SdJoTtQc#j(pFz>FrWc1)$kMc&*>neX{~z{5)=U5^pJ zDFxRH6>X$p6p;vTj?*b)0-mso@YJo^5L}o_g?wYy? zI28h)JLtKbjMNNEE0y@1&!=8~_i^A~Se;_a5X-XVb<5udwFR9<H}QrL`0t-fBydY1cYvKfL-R@p$snf6qa<J_5+sU9jlWgGNBjehM5CH3#P0aqrd z#>OI+pIkdO_l987=K&v>n@84VIVU&pjtLR#ERP zo6`5sn^VZ~^HkFq?b~G&qAY^VA+c$HPLXMk0 z`iv{6C%)*meFKsigyeM_$^}_D*?lp6iEIZO_;;y4&!N<%mC^+w6l{WOi&JgRE$yMv zVC)~s66?w24B{`#2%LHJ7bVNQ9TAa7gS9y#?c^%Hucc1(SyL0wUn{(eS5p}(5o`L; zkZWd((*;7E=IDD@SSQe@PQwtnmH*{~~TPZxa*A>!ffF%kx zEV1U9A5JJIUQ=oMNw4vq=H7pbXWlb2`AFD9u9c3f_BCi^_Tlw#rM*I>2V~RO5OC0= zzcer0Z>1`Z$G6;f89yNYs~yM?hW93)Jv|K=-% z0NFF|wGL#!VyAQ3%HKQzPXm8n@89I9&QzU5cd>+QMozM)HSA$SbKrS4*kz)2if1Nt z?NzN`sf_5KB+m26M}`0P#7h<_Crn^F#wI!)PrR8kiH{h|jZbZ7;KOvH$-}PV;bjUQ z5HZ`TRWPlO2yH8$%{5vWyZ%f_`1^M5Op{foI1<<b*r}Y&A_?)}Vt%rF=C_0|6fsPEo;fNTh%3R6?q5 zb-%*D;iHevu`h7j|7A4~6b|vrA(!$W|XhC%vXDZOi}|>@Sxu2Aauonj$k>un7~&DJxHE zaJwDG-<%KZ+1JDhIiF*aA%}J_U4GP&5nZW&#tTeC7BSy|Z=e*z!G=<6f2T&W|JW)D zC{kmGuqF&CpqpOM9z`chjDsv|c&A1io6Jq)|Mo$*4N)}1k8{k;0Q30*M@)b1Z~2_G ztvYzNyIEI;_OIn3oH?z9IStbL2tFE_RW{+xOIib5t^s4*qZ{7| zl+hWLoQE~aTXxu%(|=r}Qs}=~o_?=O7bd@9A^1Y#&5?UK9_G|1P_C^o5G)2ym(N*# zogU0$>Tju#bI7n8sgp7X#V3#_ETW`b|DiUZ1sXD4(N|%4D?5Unc1g{Bc^L+4NoOr% z!_v+pL%&-RxKnSYjy71er!m_T9H81`Qe6~c%gjSfw;iHK*D8DE%$(>rJ0Wa09449B z{v)ZN0D%@qt7aeK=u`pb=?CZgEAiOgRfihj+6dN3ajS{JI(Q5fL z)!J7hhI&^b}v49fi?dJ4s0RRD{kibr@zd=#Kd5y1T z`(1pEgwms}6=i6s*3uM>(_ezfmxu)Gg>~*uedHD37%LW(*EG93p04+=9|F$~in**{ zMeJeOOtDAT?2?;D6_+2I?kZ{Ca6!2wGXG?phFiK3VKgwQXP*0f- zxjsZA0y2YH$Ndnfh|d1g@Z{P^vDM>R7M^EroQqi9H`WZhEWQF$$zW)V<)ymJz5aq# z$mR**mT%k$i)Nns$9TpeKw26X=zn5GgM_R7lS=j1Mw7+UJn0~37!7__9IRo%hv zwwUDfS)AHP9fUJS?0H&tLl#>ZUFB~Os|E;AoQ+Y3{m^2^EPXg+Czhu0=c#S+AmY&@ zA^1mJlHYXX(-dOwkGNLhYa$cn6&=H2vKgeN52uF3cp$L~jq5{$oJmhvZ-LD_#uk+y zzH#-!Hb#>IXPnO{KPJKS_q1$7Cnm?J5<81trR;tj;fyl9M|SbIJ9l1hlMb49sgdL~ z|Jks7xj5Rjg>%KUo8P9qm)J)vfFgQ4ee=5W$@d{TfKyke|DtXtKj3{&wDN~GLG*8I zm!p6Nu3U2S=4(|^l3%)?qR)qc zAaqXbcf01VYjG{|VE`IP;H<+s8&=dMYyfOwfNV3!v)ondNTCMDM(^wJMTBQg+*%sH zKw@@F-r2Bo`v>E=o7`m69<8m;MrC(sq@@n#aa?@GUVE1+L8sM$7m>|csuXt_?ybIz zT(VlihX>7a!F*wf$ZjYqMDkb~+=z?jv(z%o9N1^LYJ_;XR=z4>U~}Aebkt7GM|t89 zTz&5$Lo#bDdJ(vJXP)|oxg-5mVM|Vggo7C|#3aBpE{w3-{g6+Bk4&n z^;5BybLIZIz%>Cn+Vo(r z1GF^B{*=SdzUA~lV2xuXxgT5zr69WGO(H^Le6p4yTMMmU{B&xkrYs`$tB;Tq8PWNV z;cEfH)CZwsh6MP&Q3^&K`%k4q{(03>b?8I4m-+(Y`)voyYG!GA$-c}US-*{fyVkcG zj>dVzSv%Ga9qWu@Z+D&?UzJxrS-vj&esq11uHwZVmM0sTp}OoT`~4=r{S$uz31Ei! z|HLjl7~Zkb87mZBn!@q1mJ^Q;1IxQQ2?~Jz%H~m z=f(d?hH&7|kpMhMPVh`L0H5$b1Lyt+^e5K`3q}Dr{;Tx};-A(WME?pDgLoU}zo#K2 z&%T&2ARw^+y%7W-Jp_cSt0$|6lf9L-$3Gb- zm^>Q50zlvdt49MAz@2db6i76%TO5EI#KeFIUX6bH2VCwyl~mv#aR5SaZ5#jztQG@6 z0g&+gLwo5%Wg={Z{0&74>fw0@ zR*Zi`{>uaFPk`&crx@usBnfyg9)L~sFK?CqMoG#4=?~160Kg*p- ze^Fz9Q2#PY|2JyO@-OPcpXvY0sP*5d2D`tg=A<{&ztqV8Mm4_wi?aQL`d|I&Eu{EA z8NTiM2LjuhQvnpxe{X>|q3-fc wV))PAfr$VJD;G;OcNbR=R!bLm>p$*LYKre*{`ABA_RB$rfDlW0YX|Xv03ka3N&o-= delta 13059 zcmZv?Wk4LwwlxfcySoN=2=49{+%>pMkf1}5U_l3%;O_1OcXtUM2=4Csk(_(abI*Cd z{xMU#W_4Fjbyw}Z*IpMbh^cvqcq$4|(AW^L5bzKX5bq#fq^+eUA>W$ScvJx3h;k1b zy40=glf)LY?aBo#mqnLZUoPeuBu#Py>_EejO*U|X%0^X`9&#zno*_!;c08HCVf$rK zza)@=mo+L{hxMoi!p$DDcmTu4x9NbmwljA!Tt!-28O6+~OZmRq5L-E6)pD1tC%mXCtsx!qvCCxT_N!^#D~x#diE}KQXH@F4 zqS&!Ama56sDFAP>C>u7ala##fir&`GFSLdkME<85Uu>l*2_!yl*vQ8NtL&3XKA3(- zECwr;1)fL1It9x-=nRWF&6rc4lD%iPPWgR@(sj~-ZXL7^K2$^GegP)59)4%vo+LO- zy|ewa$sd>;JTDC|{Ou4vc3hm!f8ID^rJy0_vzl|vCm5pBX7lG<5*Owj%ZNxnRp_y! ziSEZr#j&G>>+d&ugLP}-3I##9>?94b`$Zv&1I*_9Ht*Ccm!*qd1&0(G4<152kIUtg z?+rh&;=*;XHu^G|A4F4AI@5J@h>0-7UoSn2-Jr^m7Z;6P-Y&0`fW+XiYu`b0LV;}H zX+V!i3*g~c0D7$j95f_iU3%js`P)N3g06KzV1)#B$@j9Me?1L6MR#qqDXpMLJ&_6) zg3q~z{3zfMWP{1>Qt#xnkhsL6aE>lGo|z169}Oa#}aHfme;Z#tQ7u7CEYTmx8 z_ibv*hi;p!SCNJ)gd$(X-nBZkQt1w*ILed4G~jey@^U)G?hb5mE9mt+5&a0a1$rT16%Wrm|rVoYEeX#5xrwoDpD#XebF3$faX*9YZy(a~AbW zH^_mMd~QhuXkzP99v}=%AJZ;x&(X|$cjg}>_ys7;hjb%aOW(V~k9eupfU$*yEOVjx z)J(NZh6&`RzR0?@-91vD)!!KW?zd(9APv9V!<|`;NfUZ z;;=ftJ0lv@p1mH}Tqt)QijBg{4Bt&vN(KpJ@Zcx{u`z;E1h*Q>EK0S2(&ZfymkCtA z;@mHp!iRa)G55&fcp}y=m#tXx><`oh$4=`Y%xF=@nz z0UGaTC{4~|TfVoDg>X~=!=Bc3XfgHTV#G!7TKz_;Z+ztL_+M6tuSUhdX2!P9%R{%F zeYXXjC=JT~vZ`s4;V1ZFpcr>MlzzK|kl#b47a@Thw~HiSW;To!wD}u6nq-a>e_5&(e;?&K~%d>W`ZW?Pu(@ z{0AyM7oYAL+BNMZ6K{Gs0$Guv$xwc@vTfD$oM*W-(URgutz{$RhAV$wH_Ory78@uG zVLO{rValx9+=RgbvXVm7YcORM!O@*#fu12`)vE(GP-9PNtM8GJ12}Pztf!$k5rTey z6IQJbh)0br;2@r+Wx$=RgQJV4>3Qdu^U<;5wDS8k^3n|p5_2JjMZ}Bmgkw!U8Fa1- zv3c&Kv2-r9zjyAwA+C8`W9xZ85AfQ3E%FNGPDULUT5>6ZsVDN+9I<9H63e}`;dX0H zU!?ve4~4B!%0u5}49>uLG|G><51@1(BOB%y$iKV5GnyO$NSKcutOx=ig1q^L{}>>1 zp7mM=PB=(Vr2q}cnQ!(_XRQ%8EF@@Ia25q=ntgT*3Ic)_83KX=G^IxdS{9-KM$**e z%Lj_`ClA@x$AD<}|27K91++)=GwZUv`1C3vQu=%BSR_{va1CD~4se2Dh zv8iL1MF`i^FkEHA9i@r(C=!1>x3$yw;>=4I>j=e{qEcMa4+%D0Hk9&*n1P~8OG zxs(M`$sV_ci={pI6BZ1_Sp&1AjGfqx9LElBC&i(^$v}mgNVI>kke|3p!g!<{9pI<# z`fmDZQueq#m8-$~JBOaHXbPp8TGTI-{BX%6t~5!}_eR!-k*0Q#Z9zmoYez1E3or0D zZjtfc_9TR57}o5B@PRm$s@I*WJA}Xx8)vafN1kupuj;I(d3v?aVqU;z|9(xzO#a-p za~5t0JlJ;y=eqK3Lexh<4&}H=)5aaZi zA@&x-jHdP4`EbehumWtiqE?x!qfmdSir;dy$S9mKq14<@!!S6VF+_Wg#`6|)3*+ZC z`CwxB%PbryGI!WvjoFx@$j4K-qpxZ2EvTIsk`%=Rtf&em(X;S(rWBG&21m(GOPlvw z%S|q8Ucb<>+%Wh$8e}Cw?bT*i^9&%-9@B-hi$r|lQMjlkiUyL~_@tNZTAH#V(}Lu< znB@#PfNR0@mHnn4kKfyTouZX&PfQmsOoOjhhaPge7W761&2< z9$YM+HOPr}s6YEB!dZ+8brLiL#0BV`79}_<82|$!G3SRz_)7eG^eK7*WNfYp*$ApP zmjnumKEQm=7`@bBbb&;3tPQTjpCaXGpZ#cn5MNhZDj*$Zop>ms%T?)^eB|BMZlRZi zm>|Aa@F0;qwCu`Ev;#UpbHIw>LDC9il$2afJB)2AzvJrTsQIloEvVRBICQZS;82rB zTE)E#Ioc)`qCK{i(PCDAvSJ}fOSt4UHx6v9sIb2H@lzi01^$-k)&nmBE-3-WFmtw+6mXa(Uqbdi9q7wSr2T*l<)bWX`f+( zhvK`%+nm08jqUoTVl5i&$|})ON5+^K0KZJ}Ka7jk-STT~$lRDs(huZZ$lCa(@R$M5 zB6%m`CkP7(ry+;#_k)Gn{om)>&^Am~mDhI}b| z$Bqz^*Q1g;{&45pOji{rZ;gK!y?ujq@NNxLH3`8Tuy#WjX@>crhFcG)Wz@ycO%4$leh9yX7Gm@*Z*CUZzoo+ zQNf;Eg@V;0f8vFtqeI+t7ac(qH1z=d>0g6-h#p-*5EWDH%z{E(I+xprgpq>m5z5+q zprw&gK~+GZpV1$!+PjgoSDr$(Dtyc#y$$Ih73Y;qKA3K!9>lAIv>1b3tEoIzpg`N!ZDf@dkXo`T}MBe;Ri+U*QGukGSJR zI{YvaX+2r5QyWSssfR$rBz6(83cOM_};` z-@vmrUnExe$_i$N*krax&Jj0v69}##fUVXQuox>jVx`=aXI{QVa3j2FZskx zaVe+}?$O3@lG)owM8R^ViMkh*?X_L+HJ#ITl?Kn}2(*_p5`2H8pi}po4lxS;SJ90d ze^kMj7X7;Vv)156k`}EF;Nxw~>DmjCN%^qCqZI1WC(TcD(^^bWGC6ctWxQd?&Q_MZ zDv|x$qo1OZ?F5vGVZhZw&kXHHaU9C{aWb&L{9{un*9;OKY~5~aCA=r5>=6D&HpT~8 z9VrekH-5;(1!C^9_jL5GerqT~^YM=~>f_~Y!;2BU6Ctn8V~cPGt7Y31^m#e`7pjSg zXtq&qG~Ks1Wjh-{kSH7uf&}s1rSIFWhylu!GKaCfv)nlc!AqL~mn)+eS%>3y%->xo zDK*)MVVf?9J~ij4-CAGZa~6le;x|4H#EvS9H*DMlg{H;Xu5(@O#Co<{!fZ5s4I#3{ z7wbeFhUN*_Lau974PGE{^4E4{u1s9MZTO)ThKpOcd_ok03UI~VgWJL`SrPZyK|I7`Z8t^UJ}uElBf(tb?_bzxD6FS-OHVODG(}tY?o#LrX5N7fsjz9-P3kg4z2#6NB!#78&_u!)h0g z)MWCFGnnMd-kmSuc|p#>=gz%XNbQfgitd~reW59sGa;V%?)%!Fa2I09>UPz9PL!CD zpWeL$+D7W`1Kqvt4+rI-b;Yaeb)V9iXm&@OvF{_@;_o6&Th9gvM!)7-SC39RCrX{~ zwmaj+mSl73PPIf)XcOswCyS4Ab6}TdTN_y&?GZzV>ACCVhh9HmV6CX`J|)eVuS}Dh z&K#15_pxgi!J&=W&5*az@L>WvRsqnShtjGv(vsp-ffIu%Q-N8HsSh`#tV8slzZAe^ zk>&SmMq@?Ze8es^O*8lBAI9}}gUm@so(|8H2GQxUfcIU~j-*N*c8GHXv`URTo-Qxm zqJs}vnmkvANE&Af4$TBhbco@3`{taZ{l#eeWl#7gIlyW{>KBIa4PJ!-Jl(n{`<6_$ zjGc%k?dXG;oYTJUJ24)u83P1n`Ap+U$@=k=-X4T}-xpRMwLD(_mE4M6Fz~UyIX4(o zP?i)0$X^Z)xE8&{i`{>!z2q5IGoSo~28mN57ceJ3ldPI793Y1*>Aq3sKlZK7fCU(J_)FOtbhW@(P-C8f znUB-5Svy(6kNK3%!9_)*1tLCjz-Aq60@4|K!wq?B_#SA4u*}Mcl*YOT>bewDRQ$O| zUaIO+v2r@-u7d28Y7~v89ry$*j(8#*hU^Wo1~$vQ!D{cmL%6TiOq!`8xNLD%!g-M_{kNc%}e&~ zx01{DTwXc#tEeVq$PAkM>!c&+dVJm#D{Up*Mn-FsM;ts1h~9a=%uZ|Kc1aW7bEDog z-*dQ>u6;E3HoRQfS0<5&Wk%c#CoU;pKYx4xI%W~cc4d&=QtZark5#~ZOr7+l^_lpM z;HsKfPRBI;!xEFl@}o=@gHxFP2#vXJ@tu-x>Smuz(Ux(jC6&w^6qkeheSqo+S$>2V zZQvGcZ{oF0K`2&k0`{VngbLJd2%9iD3meBQVh9N$Is!Ig>F@gZnPHXTjN56awzTqH zV9KFkw{m-ioq#F2&9rXAL)<2x|I@c}N9?a{vQjUY`oIH=@P())VyQ%lXq7%Q;O?RR zU^t?)N&UC$SzFC3ep~b#L4s4eDVb8)3&Og!>}!Ko!sGr>>mj>Iu~3ia3`U;O(#2I4 zy8sjcL6ZR^CJEjc<}WA$2MZZ^rO%$EKz#s_$7#SS(o>_3*Jx7bR}xQq1b+}%#vZ|b z;Tg&UyJX9gR3E^aF!(w36ANf0kQ*Eo*V!*5Mqs2G-y?bea&}Z62`Mfx3mMEAv-39c zPg$5Pny@6hmKpm67{^oV6Zze=mf95O6b16Pj%qWp@1sv>9VGiO-J4$Ee^xF8EZ-v6 z#HP-`9pUQnw9EDt+yiD|Tjr06Ot!pHR> z;I$~_Ljn^{6kMDrxxa8xX*zWSOwV(o_FubwOEK8Pd!BQ))x2P)+T6-t?p{vGMA~0H zztoqI9=ni?WAYeqQk#t-qQ_G`4=QZ-0{GM!1KO+&KjcoPeDz1qlk-h~06ASOoWcfu zGj)%;V{~FAcRbreRKq36O=IcRlpfh(F`K_avgBf(b%*uHX%DbRCrEK&!G`rex>}wE zWY>SdDZBEc+3o>Vp%t|+7jdbTq@|RU5LW1qVeY5M?jK(}T#5YgoG2(kJegQ<5D@FE zZ=^Cvl^+}Y3Vvf7&z0<;fb}V2GicgkB3do%@X#6Q7-9*Yj(H>Vd6MSpA9b)xtmi<0 z+Dm=VN8~WdZ@{te0G{u?laG<1RMHEGm_zKh`=KQ3}bz!ui1k*?QN>y73W%T*b*CeSh zrzoP@Hwl;H)8r&mB-^bg8>N)_%t6jCr9{AOq5a`;yS&01{@t?hI^aoOb0Qu0=u z=O(7$$s?%sDmqYvn*6&9A5#IvK;9$K12-J0H1mSRwO*oP&f3<3?d8G4xzA(5plda9 zf$){?<%)BU_RiGV>Q3I(?pD||Lq10+*2=0H4PLEKNFtspRO~_|cK%lr#4?r=9aVb1 zZ9kWAIOBsekcv7b-kw9cyRIC#HuwH8@Q}MvtE@gAtWi`8iclwkJOUM||AssTMQAv| z_RzMH2(fZBPnYRBLoy{bJ@T74!~Pt!~|THM)zZ#1d=aUrQD{X^RdwvqpUAT zZ~Jzp80bnSfln&1i=_gdv>y5HbzYqXI4BIU;x+h8-K7Q|k`SMd?`HOWHgdhXtCNWB%(h0D2onBIJ88avWoizR5ya7W?8IODmu6RoeK~`BdE;8t z<>q$5>e5u}cq2I&ZS_0&b|{5_QM%*M*sTUgCzvt+T&j64>cM$7i^JV@A8xB3T5*^( zJDd{kC@}Qe#!{a~==+T7UlMsPcfK;_mjbU*<|Bxs+=iPM{q}litMp2vy|Vn*Jcq1n z*Qp!OQ5-maeyL-AN#T{@Q5#trvj0AoG#@i)IkHbVZP^jDb#Xaw_IST zST*z74OHpn&v0K_w;qX1{pB%P$9Vp=oClJ+b;jZv3ltmgc|r^E@$DqlIb)8NpoE#e zQ*x#k;=?L6vZ-{4n_Fz6Csl9a1pF>P8OF_?Rzr!5!m>eO+nS%&MzY6381b%3QgGZf z_+mk7$qrFG!=a=tuDdojD*LQ9>Zv0bLN_5>f`qr!#tD+|BPQbZ+vJz6i>|K zbB|DK_AY7Lsu4D8;L({hlo7PglfRE#D|}54(dloLr!)5x9_ahekTO@~RV_NtpT!0u z3J!jJ_7J;$2o!!7FHE;r;w{_=%-U7c&Njwu*hBIm8adVSs6PO0Yoln;;W^hzv%Xx= zy71OR&3~t=c2XpE`Y1_%mDZWAIMbVvUvc}Rqj-0{gh`&C@kBe#s4|b@DHc*Gf!!iO zLm+4CheLA3{%46<$bjaL8uuu_p|OqwdS83O*FLeA+HLt{;+$faF;O|$0PoGDc*`a^ zF3CJA$V_+YFc2QXMooKEk8L%7k@WV7NExgrA{LOLL^c1);I&}|uvQC+aK)3S_z{>YAMH-mh2lBJKq=}E?(E+uy)2#g+tLsVM47W z6ObNBZGObP>$e^C6k=7%iJVRM@1L(Yj$&7y!+J3MCDQJ2n!4+$Yu<``EuLZFzSy=o zR`4R}rH*$%k0wy<=UYm-gxb9j+TvH%5L#SyT`nHkJ23^cCIEg&IjonDS4%G{PO*(R zXdj6agZ4XpZQ*^z`&*R}dqlwNdP~-{{sykKXL^+Y;PNNm0i>IL*yFr(M%_ ze=1s4FoU&@4aCas|zw>ufhVZKhErPCinkVu2Yj4?`%=8f4Cm$ z0CxC2U;H7kQciBrfM<-wOQd??m;kwWv8{ZUj}p8b0&niwcsyq^Bjm4pPJWn~XpV3W zGNlQlS9lq03G7Efl}{-dg$DZ;v#=Z0*T<<}`uw5xFW@~ss!x_x3)4S5cYf-zo_yBt zY^>n=b8$P>I1<3VLoFO4go%}WuAju{u>wG9y&E1x}Z6mXX5v%LQPduB< zz@xRFW4B(mv3ihB0V`*9{34X3MbuVcjzv&`%Dd9W|IF#2D68!z4V}-?JlJTK=g5wr zZdG}KOT5KyIjD=A82W_4`p0x@>~ww9+*|U0fBe`81WurrPI79uum`ORWGv)$?k@v?sMw+HMe_Di#liobDFPR40I&)}Qj9~m3Ke0Y z+wvY+;pw@`>Jh%?#Q@yfqg-VIR`S5K?P*VqgJBaQv!2qA%wnUZ;6Fb$VaZ2s`# z1c&wfPs#{c5u;}2)Ds@*u@DVnbIkXjR+jPS49+>`j<3j+T%{w785nAsS;8x4A0#lp z{iWyU|8Tv3zkiDWw4Fn(aOmWDQrq|b`m+XtTyENdXGVDgDlMF>$M7l?D-9ZeF^Xki?Yr}`j-NKt9q zV}s7Im!yz=Yezb@9K+x7tVebm2X`ilIeyw-RlS8O>w2CG-j(hB!fIvjI!FW#7jfxJ zO32Y$Ez}C`?*yGVEJ6Z>L@s)CX3CHkRRS=glaQz;Z}I5$#F`*&Fz&UYUhOb-m3F?- zt8DyW`2Aj^IKkTDzFG{RTs6F~KuPz>K>FjzVEin#2MhPu7?M$r*%_b~U9Ced>i6@Y zk^oV!9Qv&~D?wf|-dL86Oq=-@^%Pyih2Vz^)7Qy5HOfMjRUaSV_4)7H!hui`nLW+g zg=%vJ3;L{r!p>SG(Eb6+qd4Wu;)$a3&;nR z`6TCJPqu?R?(e>vC-T$l%&g)HTY2g@Yo#JVz4UtYI$=P1eRUBzfiYbvhR$D{!!C6< zw!N#uJV!YnDc{Gy;zia^-%l57%Hc&5rRIqSic)=z!d^$2+xDSEFl` zT;+ni&TE)*S%g<5I!3lo{TuT_YK`ErMe=DI?VT+*AXv4o-blIWI= z=KI!>VX0ZZP{IPV$D!n!9Q?T~u`z;JlOF>VX5yqWwMRu$JVs>y(C-x?Z_pX^J&729 z@>72yU4NoU{P$*Wli;wTwAb+x7xxMCndN&S30;OFJ;X8VS8LOYhP08+1)G;V@fBl5 zop%)~7vT4xG>3&lSB_}h$*8wkD05$c)lVx=(xgVN#g5T*9>7vD-HD_00k$}4-chnk>GD5 z@{iuJjp=xbKl1(#8^=GAH6%z!{kFIT@p~D0K-U3RJVmK7t~kBLDa@i`h>yGPUeXRI zC|lxuApP;$pu@1C@`%dAB!wkw;)-0u#DlVNqfD_YLW)j*%<=cLLc@}d_{T@@xg5O` z545BHMhhhY?w=PS1(YhQcMVK#0|$D-GdC85tMF*|*%ZiSq6_B;!2$(~n0i|42n%n` z@e+7H8Aldc^pgcA1-gaiNY}w!oNVA5@g8x}L2$p!G^mNo*_mdq8++CLiJ5Mj6?xD; z;;IB{$O!ErxHT?6trIS6aD&Vf{Xt@;_F4?P`JvMl)*D^I-0Q{!UuK7{A>HZV6HSPQ zmsYIm4X4?bV}E{83u0FDx{I>&56lSTWT75zCM!dC{D8V{_O=1!$mA-@4SHb8XL%4t zzWAw<=GOA+j}k>*JM(+HuLM_F349m+54aY;8Y$XK26-pc0v)aTHkA!qZ;Oz8hoP>2 zO%pG2e@LmD&%jEKCOVA6Lvwp1q;Xh?6c-94nIlCFonmv=1~uR&gV~xZK3xyozSX?W zpF2FimtN!uZ+7`O+WwNZ?q>(eQbmYQL|bF?Z}Ihz74v7arQ=y)OC_=C%^-BhT2GOB;N$qwl;tD~o(3c?q^XR)=Pf4s8hu(C zgT}|{o*0DF93%DcMuyWGtd4CH)8}RXCBr`)W9v#t9vt}Y9?(KSfH1kp{*(@DecX;H z5ITpb@akY7ARKC)!Sw)OXUsF5s$HD76o+PXW(qibdplTz+GE^~b1mQM$=y5fDq4;b z1+R+Emw_;=+jIpdPq1?LYX?73dw7R#hHW%Js)sE+$b*N6N*N@mz!bhoKGA*cFA~uQ zAN}GYB|E}#;H!dt5bz-i1qy#o`_SVPFQ8!F@)t8>ALoN{{?{O&HKhN8w4=f+Ns)-;z+f7!^^^ibi^S zNGox1L{_qCMte|!1NKAP8zwO+YsTj~W2DY^4#`Q2ibNa*9@YYL(}lA2$t!kz%Zf9m z!a3KY?|$b@cD~%A$n3smnjMz#KP!7rjh`gHTIzndg$D`2n64YZ&EL96U!G4X9mEW# z0e{u+Z2Gd{qkLk8-{>XkmzyU_i^6o`9R9j_P6z#@Ja1SERO!vC@(SfHH5Pt79|2DQ zg~e)1$Zi@SJn*;&WXI#R(FaW?$8t=C&tOg2Z{lkm2Lwp0ig}bbsR&RnW=sVi@>tlq z^R%7IPPxYwd>AolJWr$!O4b#tl6|$RmJF)yP#y!kdKml$0Og;3RC5J>6oIzIc)0Hl z^A`(^%H)xNpWM~ZUkJIz-AKhR6!v1aQDnEdWM{nc+~TIC@EA>JWmk_g@ew;YhNI&IlSJK;|vRxu7 z(UPHT>L=M@ePh`RFg^sr9i&90Xy4_%&}+E)|HwNA8izd6ofw!^RO}@97Iyt=0Ro&) zxfiNzxk_nnkQoftp6d%p;|hGU+R*TmBgw08v(fuKTe??AXFk?_k+yokAcKnNqW!gQ zCdRvwEBgM9ipaOS3CmI@fQbP%%MB?@aQNB<2rZla5n`AdLP|BGxHOhhln@6>#R@4) z8I#P8_Uez(4k?@ciD}wS16g#HIiRNQZ+l6^RsT81&!O_0@(TbIm&+04mEP!;4ynBd z{59J&;_{}sL;X`t1V)^V~|4psSv6~IK?Zc9YHXsPM_p~|#V^(3L&30SnV7K#7UH-F z&pIM8I|(`i=Kb>2@3K*JniWq^aru7%5f(ZK0s+(gOxZ-cZbx28PFWv4$~a|vT`d@P z*f>ML1PwC3ORi|z$-Ho|;z{pzaNCDJb^Vq*cYv9`rht{-nQUE!cZjilz~yr2%uyT= zu1(l*u3=^pX~9^=w@YV_EhqQveOWIlP(@dB3M)@M$r@lw8Py+bnXS$rTxZ<^o?85r z>6I^-Kj;f%%KjW8?ECxxd&1OkXmI`o-HJL733oYVeY<=A8>TsI`9os=k)1DXSAJfz3ZD;oYpdyq}Rc^%KMhEMtg!A`l+GnWSDS+qJ3wz7kO}E0;4} z+8r+@daHtcJ$oALUBJy56mV%uIKDWm3%DLObx-*b-A~f@z}ctQ z?~5nti`D0&?D`gmUD#{)jyBY>5Umf&ZQ7Kcw%T87zdhci3=#ziT=75UiA-c}XWU)J zP=3;%>n5(6%oecle{e`&)W=xo?J1ONpbvoxN6Jn;XX#4XE0{q68X?v~d2O{abK0$E z8)AO*(EUjW&+~+{ z*uW}CgH50zK27GJbf^SUN6w~m&RT0mXT_nVA$Qh$k-nH^pl6S!y2C>S6?q2ZP#`MT zS+~bJVyTiWBAhS{?z^P)&G0?leNpJcJ1qsPwsLV-puVP_xa(;b%8~5V*nD@WgKwUE zP_y8f!Y$#DUG;qIX6B}UPnXfH)98F8Wb$}!h4cG&bi%ZkQu1>0HSuK&u6;F^g>wAj z_tiVMDp~P5Xg;i;(ge-5=eJQJgqxM=m4-_46q1-1YHt0OU(vY-7J!5?2ov(`R*`q* zA_Ov!v}EGIXQ_MO+cx_83I(B}0104*`2W$ggLPv8YLE!vvRDA=n+zKLP0RSdhY%ci zA`Za*M-)v65P<(<;DcY@45EL;(GU=1{|o>7{Q>;t?G)mF)ly z-a5uWZyiVUe>y-aoJe58L;wTelHsrI%!l|d`=0TyZN&XQ_AAq0ds*~Z`iT;zhEtYVE<8%`j0{NWkBOflwh>)Z*y9%{P*9y)iVf*|6R-Ye{Qq( z!@n+E`~B_0|FDk#J-(5~Ul{024+aeP_689D!@B)HP@VsQ8o_|I{y_hso&Fp8)$m_~ zN2R?mnf5C+R!2aPK{u_p3{s+eKucwY`^Y@MMaYFX_VyqD zI{^CUsU&)XN7Dd804`rJQaV5cfawQTOb1XB|JyOYr5@=2z~5Sj{@}=T00r^iJ^3xD jI(>8Be}bxi4(>qkP&$AJl@Wpw0tp2I;vx7A0`dO=rs^U8 diff --git a/tls.rst b/tls.rst index 262b7c6..ec8c41e 100644 --- a/tls.rst +++ b/tls.rst @@ -385,7 +385,7 @@ protocol used by HTTP for another twenty-plus years. Adding security to HTTP-over-TCP in the form of SSL and TLS further exacerbated performance issues, even as advancements to HTTP mitigated -some of the orginal problems. As noted in the preceding section, it +some of the original problems. As noted in the preceding section, it takes at least one round trip time to establish a secure TLS session. The relatively recent introduction of 0-RTT data reduces the latency before the first data can be sent; it also comes with some @@ -397,7 +397,7 @@ to complete its 3-way handshake before the first TLS handshake message-which is just data as far as TCP is concerned-can be sent. So the sequence of events was: -- Client initiates TCP 3-way handshake to establish TCP session. +- Client initiates TCP 3-way handshake to establish TCP session. - TLS handshake establishes security parameters for client-server communication. @@ -407,7 +407,7 @@ the sequence of events was: In other words, in the original TLS-over-TCP model it would take at least three RTTs to get a response to a single HTTPS request. In fact up until TLS 1.3 arrived it was at least four RTTs due to the use of -two RTTs to complete the TLS handshake. +two RTTs to complete the TLS handshake. This is not the only problem with running HTTP over TCP. A reliable, ordered byte stream as provided by TCP isn't exactly the right model @@ -431,9 +431,7 @@ In this section we will focus on how QUIC particularly improves the performance of TLS compared to running over TCP. QUIC is quite a comprehensive re-working of the transport layer that could fill its own book-indeed the set of RFCs that define it run to the hundreds of -pages. - - +pages. QUIC originated at Google in 2012 and was subsequently developed as a proposed standard at the IETF. It has already seen a solid amount of @@ -446,28 +444,67 @@ underlying transport. The single most important change in QUIC from the perspective of TLS performance is that it doesn't treat the transport and security -handshakes as two distinct layers. Insteady, QUIC has build a +handshakes as two distinct layers. Instead, QUIC has build a cryptographic handshake based on TLS into the transport. This is -illustrated by Figure foo. +illustrated by Figure foo. As RFC 9001 puts it: +*Rather than a strict layering, these two protocols cooperate: QUIC +uses the TLS handshake; TLS uses the reliability, ordered delivery, +and record layer provided by QUIC.* -.. more to come - - +.. _fig-quic-tls: +.. figure:: figures/QUIC-TLS.png + :width: 500px + :align: center -QUIC is a most interesting development in the world of transport -protocols. Many of the limitations of TCP have been known for decades, -but QUIC represents one of the most successful efforts to date to -stake out a different point in the design space. Because QUIC was -inspired by experience with HTTP, TLS, and the Web—which arose long after -TCP was well established in the Internet—it presents a fascinating -case study in the unforeseen consequences of layered designs and in -the evolution of the Internet. There is a lot more to it that we can -cover here. The definitive reference for QUIC is RFC 9000, while a -more readable overview of the protocol and its deployment is reported -in this paper from SIGCOMM 2017. + Protocol stacks compared. (a) HTTP over TLS over TCP. (b) HTTP and + TLS Handshake over QUIC. + +This rearrangement of layers takes a bit of work to understand. The +central idea is that QUIC has the ability to provide encryption and +authentication to the data it transmits once it has a set of keys to +work with. So the TLS handshake operates pretty much as it did over +TCP, but instead of wrapping up TLS handshake messages in the TLS +record layer before sending them out over TCP, we can send the TLS +handshake messages over QUIC directly. QUIC also provides the +reliability, congestion control, etc. that TCP provides. Once the TLS +handshake is complete, the keying material for the connection is +passed to QUIC, which now is able to encrypt and authenticate the data +that is sent by HTTP. + +The most obvious practical impact of this is that the establishment of +a QUIC connection takes place at the same time as the transmission of TLS +handshake messages, rather than taking place prior to the TLS +handshake as with TCP. By the time the TLS handshake completes, the +two ends of the QUIC connection have all the state needed to transmit +data such as HTTP messages. Furthermore, in the cases where 0-RTT data +can be sent (because there are shared secrets cached from a +previous connection), the first HTTP request can actually be sent at +the same time as the client Hello message. + +A final detail of note is that QUIC runs on top of UDP rather than +directly over IP. The reason behind this is that there are plenty of +middleboxes in the Internet that assume that the only acceptable +transport protocols are TCP and UDP and block anything else. So while +UDP doesn't add much in the way of useful functionality to QUIC, it +was an expedient step to run QUIC over UDP to ease deployment +of QUIC in the Internet. + +QUIC is an interesting development in the world of transport protocols +and not just for its impact on security. Many of the limitations of +TCP have been known for decades, but QUIC represents one of the most +successful efforts to date to stake out a different point in the +design space. Because QUIC was inspired by experience with HTTP, TLS, +and the Web—which arose long after TCP was well established in the +Internet—it presents a fascinating case study in the unforeseen +consequences of layered designs and in the evolution of the +Internet. There is a lot more to it that we can cover here. The +definitive reference for QUIC is RFC 9000, while RFC 9001 covers the +relationship of TLS to QUIC. A more readable overview of the +protocol's design and deployment appears in the following paper from +SIGCOMM 2017. .. _reading_quic: @@ -478,6 +515,9 @@ in this paper from SIGCOMM 2017. `__. SIGCOMM 2017. + We also covered the impact of QUIC on congestion control in our book + on TCP Congestion Control. + `TCP Congestion Control: A Systems Approach `__. 6.5 A Systems View of TLS