May 2015 - tor-dev - lists.torproject.org

Relay Database: Existing Schemas?
by nusenu 26 Feb '16

26 Feb '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I'm planing to store relay data in a database for analysis. I assume others have done so as well, so before going ahead and designing a db schema I'd like to make sure I didn't miss pre-existing db schemas one could build on. Data to be stored: - - (most) descriptor fields - - everything that onionoo provides in a details record (geoip, asn, rdns, tordnsel, cw, ...) - - historic records I didn't find something matching so far, so I'll go ahead, but if you know of other existing relay db schemas I'd like to hear about it. thanks, nusenu "GSoC2013: Searchable Tor descriptor archive" (Kostas Jakeliunas) https://www.google-melange.com/gsoc/project/details/google/gsoc2013/wfn/ 5866452879933440 https://lists.torproject.org/pipermail/tor-dev/2013-May/004923.html https://lists.torproject.org/pipermail/tor-dev/2013-September/005357.htm l https://github.com/wfn/torsearch (btw, someone knows the license of this?) > This is true: the summary/details documents (just like in Onionoo > proper) deal with the *last* known info about relays. ernie https://gitweb.torproject.org/metrics-db.git/plain/doc/manual.pdf (didn't find db/tordir.sql mentioned in the pdf) "Instructions for setting up relay descriptor database" https://lists.torproject.org/pipermail/tor-dev/2010-March/001783.html "Set up descriptor database for other researchers" https://trac.torproject.org/projects/tor/ticket/1643 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVLrmVAAoJEFv7XvVCELh0+ycP/0VkRWMGAhx7YwWhixtOPB0q ouitosse3SdLCMd1W7cps7nnQhcGv8E1xeUPYeizNQ+RIK9ldvnwgxhVt9ETOI3e oL6bcx3B/NSbTcGfZhIU6XCCX7+39CXz3/+/gXg4c1a5Cd9rYKuwTn7ZApPUNAK2 9yfckCwHaqh67ZDHB1A7nrHX1BJAjwhri5JRGomHSUXPwNZOyMzpgPkB+I92esqc Z4ajQo2D+Vyk42qF7apqp5ApVBLdt5ycUtW1j4s4KvyJH2BjeP4tCXvvYLKv9IvN TGHMJ111NQXbuk6H1OdaDmMZhhW6utPk8YAbNc7RZHqCdH7No40zFVlikLDrV2Xl uLt8FMlck7hGQv/4udA59Dw3PGHfrSiCbvJXb0S2jarnWOH2O+zSSuMs8jQM/x7k 6tIOlwtRDVGw3VuvNbb4MJnLzdHRxq3qy6ueDYuhmhHslxjD1Cbr3eE1RA7Da9aX kNDgjfXtdah52HWUZbIIxHQYzyCg5G3M5yy51GhUlA2Fe1sbPpNcEBeyEDK/jH3Y +7G+tgR+CdMvSFraCiYKHa1drVPJHeqNvZAqPNHKxpKwOwOoJEYrsW4wb/mJ7ybe o8xNYK691hcaMvHqwI47tw4hZfrI0f0+gQKKzENQQk8/8yUZ/0jgMRlW/Cz0yYIa FZEg+OJ/yEs8vKfYerIN =Rfn4 -----END PGP SIGNATURE-----

3 2

[Patch] or/config.c for MSVC
by Gisle Vanem 23 Jul '15

23 Jul '15

This gcc-centric macro in or/config.c doesn't work well in MSVC v16/18: #define COMPLAIN(args...) \ STMT_BEGIN log_warn(LD_CONFIG, args); STMT_END I suggest it should be patched like this: --- a/config.c 2015-05-06 22:22:09 +0000 +++ b/config.c 2015-05-06 23:15:57 +0000 @@ -2571,8 +2571,8 @@ #define REJECT(arg) \ STMT_BEGIN *msg = tor_strdup(arg); return -1; STMT_END -#define COMPLAIN(args...) \ - STMT_BEGIN log_warn(LD_CONFIG, args); STMT_END +#define COMPLAIN(args, ...) \ + STMT_BEGIN log_warn(LD_CONFIG, args, ## __VA_ARGS__); STMT_END /** Log a warning message iff <b>filepath</b> is not absolute. * Warning message must contain option name <b>option</b> and ------- All recent compilers supports '__VA_ARGS__'? -- --gv

3 5

Update: Proposal 237 - All relays are directory servers
by Matthew Finkel 09 Jul '15

09 Jul '15

Hi All, Here's an updated version of prop 237. I rewrote some parts for clarity and brought it inline with the current implementation for #12538. Updated branch on prop237_update in my torspec repo. Thanks! Matt

2 1

Hidden Services and IP address changes
by Martin Florian 16 Jun '15

16 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everyone, I think I've found one or more bugs that appear when Tor clients hosting HSes change their IP address during operation. I'm slightly overwhelmed from reading the Tor source code and not sure how to best fix them. The central issue that I discovered can be reproduced like this (assuming Tor clients A, B and C): 1. (Setup) A hosts the HS X and A, B and C are all booted up. 2. B connects to X - it works! 3. A changes its IP address. 4. B tries to talk to X again - doesn't work! 5. C tries to talk to X (for the first time) - works like a charm (so X IS working) I digged through the Tor log and source code and have now arrived at following hypothesis for why this particular error happens: - - after A changes its IP addresses, it never establishes a circuit to the old RP with B again. - - B, on the other hand, keeps trying to talk with A through that RP, saying that it is an "Active rendezvous point". B never stops trying to use that RP. So, they appear to be two sides to this: a) A not notifying B or the RP about its IP address change. b) B not considering the possibility that the RP might not be active anymore. b) seems easier to fix. Some logic needs to be included for forgetting about RPs that have failed once. I identified connection_ap_expire_beginning() as one potential place to do this. Am I on the right track? Is this a good idea? And how do I forget about RPs? These are some of the questions I'm struggling with... I should also probably open a bug report, but I thought I might first ask for some advice here. Thanks, Martin PS: Why this is important: HSes/Onion services running on mobile devices will very often have to deal with IP address changes. I'm thinking about applications like Briar or our own hacky attempts to enable generic P2P application development on top of Tor hidden services (https://github.com/kit-tm/PTP) -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJVXb5wAAoJEK5sDRyGnIFfbbYP/1gi6A/wZFhQfr6IRG4F1jBT c2/euGqiLG1rrqh5inTzrSIrHU0cm6FBxrtfB4egUO8+saVouhDrsgVQIF/y7nK0 f754Bcx9w3/a9hDK3L0iUtsYguMMTPOeWeCCdAxblYZWhKF3bxu9qwVsNqtVUUIm Oz1WLl4N++Pf9v09LRaDR7JaL9Ts7aJ3sEIWLjuntgEoS9sJaWmUjdVZZCjdWAOF S2FM6O1SE2V8xiMFjFOEmabWYUigrVZu2qk9/XpWeMDeNNIT57URZ2R0gKxjxLEl c5/+KawvSFGVKeoyTM+xys3UcO2IvnKxL43M2pocO5UX9TZv0iyrx1YRoTPEq3D5 HoOEX3Q0wlk6aJ3qqGFb2nNwr4n18k4IvdopCPkGvMBUuflcD77ug42k7TDEgXWD yJqBfxQE8l+p7QZ+kpHajdSmMtKzdjbYyuA4l1/FUskHQfX1fg2WyHQSdZR9Dxni GZJdnHOdN6f5T2lUVCuP4ZWlkHJ/HEPYWT7BOxRwyCbI6ViHZUIqJA8q1EPYGwP5 MOkSsx4diFS+RxAxb/vcudalOT8gIuszYsUImM1o2yzSpZ1faBuv1WCbdQ4qVcm8 XUrxSJCrX6qaY/ZxovWWnggYK9w2CgLDEHfeY39VRwLjDiOi85JWhGBvvtyGb84v WJvzKA4thqQ+JQEsR24+ =JxdI -----END PGP SIGNATURE-----

2 1

Re: [tor-dev] Hidden Services and IP address changes
by Nathan Freitas 15 Jun '15

15 Jun '15

On Thu, May 21, 2015, at 07:16 AM, Martin Florian wrote: > I think I've found one or more bugs that appear when Tor clients > hosting HSes change their IP address during operation. I'm slightly > overwhelmed from reading the Tor source code and not sure how to best > fix them. Thanks for bringing this up. I know Michael from Briar has definitely focused on solving this at some point, and Yaron from the Thali Project (who build this library: https://github.com/thaliproject/Tor_Onion_Proxy_Library) as well. I've been implementing an OnionShare-type app myself, and had hoped this was solved by some recent changes, but it seems not, from your experience. > The central issue that I discovered can be reproduced like this > (assuming Tor clients A, B and C): > 1. (Setup) A hosts the HS X and A, B and C are all booted up. > 2. B connects to X - it works! > 3. A changes its IP address. > 4. B tries to talk to X again - doesn't work! > 5. C tries to talk to X (for the first time) - works like a charm (so > X IS working) > > I digged through the Tor log and source code and have now arrived at > following hypothesis for why this particular error happens: > - - after A changes its IP addresses, it never establishes a circuit to > the old RP with B again. > - - B, on the other hand, keeps trying to talk with A through that RP, > saying that it is an "Active rendezvous point". B never stops trying > to use that RP. I wonder if B also was running a hidden service, if it would be possible at the application level for A to tell B that it has changed IP addresses, and then through some interaction with the Tor Control Port, to fresh the RP? > So, they appear to be two sides to this: > a) A not notifying B or the RP about its IP address change. > b) B not considering the possibility that the RP might not be active > anymore. > > b) seems easier to fix. Some logic needs to be included for forgetting > about RPs that have failed once. I identified > connection_ap_expire_beginning() as one potential place to do this. Am > I on the right track? Is this a good idea? And how do I forget about > RPs? These are some of the questions I'm struggling with... > > I should also probably open a bug report, but I thought I might first > ask for some advice here. I think there is a bug report somewhere, but I am not sure the exact number or state of it. > PS: Why this is important: HSes/Onion services running on mobile > devices will very often have to deal with IP address changes. I'm > thinking about applications like Briar or our own hacky attempts to > enable generic P2P application development on top of Tor hidden > services (https://github.com/kit-tm/PTP) Definitely an important topic. +n

3 2

Sanitizing bridge descriptors containing ed25519 fields
by Karsten Loesing 13 Jun '15

13 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Forwarding from a private thread with Nick. - -------- Forwarded Message -------- Subject: Re: Whoops Date: Fri, 29 May 2015 21:20:57 +0200 From: Karsten Loesing <karsten(a)torproject.org> To: Nick Mathewson <nickm(a)torproject.org> Ugh, long mail ahead. This turns out to be more difficult than expected... On 29/05/15 19:29, Nick Mathewson wrote: > On Fri, May 29, 2015 at 11:04 AM, Karsten Loesing > <karsten(a)torproject.org> wrote: >> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> >> Sure! >> >> My main question is which of these new fields we'll have to >> sanitize in bridge descriptors. >> >> The current idea of sanitizing bridge identities is that Tonga >> would give out server descriptors if you give it a bridge >> identity. We want to avoid that, which is why we're SHA1()'ing >> fingerprints and removing cryptographic material. >> >> What about the new identity? Would we have to sanitize that in >> any way? And if so, would we want to SHA1() it, or is there a >> more ed25519y way to do this? >> >> I guess the better question might be: are there plans for Tonga >> to give out descriptors if you tell it an ed25519 identity? If >> not, do you see any potential trouble in leaving it unchanged in >> sanitized bridge descriptors? >> > > I would suggest that we sanitize all the crosscert stuff, and the > ed25519 identity, and the ed25519 signing cert. Does this need to > be done using some language I know? If so I'll be happy to hack > it up for you if you point me to the current code that does it. Thanks for the offer, really, but if I can, I'd rather want to write this code myself once I know what it's supposed to do. The reason is that setting up this code and providing you with sample data might be more effort than writing it myself. Hope that's okay, too. Only if you're curious, here's the current code that sanitizes bridge descriptors: https://gitweb.torproject.org/metrics-db.git/tree/src/org/torproject/ernie/… But feel free to ignore that code, and let's talk conceptually or by example. > (The authority might someday give out bridges based on this > information. Who knows? Not me. Better to be safe than sorry > IMO.) Okay. > To sanitize an ed25519 identity, i'd suggest SHA256. Best avoid > SHA1. Sure, that would work. By the way, here's how we're currently sanitizing bridge descriptors: https://collector.torproject.org/formats.html#bridge-descriptors Following those steps, I'd do the following things (quoting an actual bridge descriptor as input here; edit: scrubbed potentially sensitive fields, sorry for the linebreaks!): > router euler [scrubbed] 8000 0 0 identity-ed25519 -----BEGIN > ED25519 CERT----- [scrubbed] -----END ED25519 CERT----- Base64-decode that block, throw it into SHA256(), base64-encode the result, format as block. But wouldn't the result be much shorter? There's no new "fingerprint" equivalent, like "fingerprint-ed25519", is there? Whatever we do here, we should make it simple enough for bridge operators to do, too, if they want to look up their bridge in Atlas or Globe. hex-encode(SHA1(hex-decode(fingerprint))) seemed okay. We should try to find something similar for ed25519 identities. (We could also have tor log its "hashed ed25519 identity", but that only works for people looking at logs.) > platform Tor 0.2.7.1-alpha-dev on Linux protocols Link 1 2 Circuit > 1 published 2015-05-29 17:53:38 fingerprint [scrubbed] uptime 2 > bandwidth 14971520 104857600 63488 extra-info-digest [scrubbed] > [scrubbed] IIRC (and it's been a while...), I'd replace E07A... with its SHA1. So, I guess I'd replace YZpo... with its SHA256. Note that the extra-info descriptor would contain a "router-digest" line with the SHA1 of E07A... and be stored in a file using that identifier. In the distant future, we'd probably store extra-info descriptors under their SHA256. > onion-key -----BEGIN RSA PUBLIC KEY----- [scrubbed] -----END RSA > PUBLIC KEY----- signing-key -----BEGIN RSA PUBLIC KEY----- > [scrubbed] -----END RSA PUBLIC KEY----- onion-key-crosscert > -----BEGIN CROSSCERT----- [scrubbed] -----END CROSSCERT----- I'd remove the last six lines starting at "onion-key-crosscert". (The "onion-key" and "signing-key" lines/blocks would also be removed in the current code.) > ntor-onion-key-crosscert 0 -----BEGIN ED25519 CERT----- [scrubbed] > -----END ED25519 CERT----- That block would go away, too. > hidden-service-dir contact [scrubbed] ntor-onion-key [scrubbed] > reject *:* router-sig-ed25519 [scrubbed] I > guess that can go away, too. We'll probably want to put in a "router-dig-ed25519" with the SHA256 of that value. > router-signature -----BEGIN SIGNATURE----- [scrubbed] -----END > SIGNATURE----- And here's the corresponding extra-info descriptor: > extra-info euler [scrubbed] identity-ed25519 -----BEGIN ED25519 > CERT----- [scrubbed] -----END ED25519 CERT----- Same as above, whatever that will be. > published 2015-05-29 17:53:38 write-history 2015-05-29 15:36:42 > (14400 s) 2461696,2649088,1583104,1612800,1871872,2102272 > read-history 2015-05-29 15:36:42 (14400 s) > 7444480,6047744,5960704,8019968,4823040,6364160 > dirreq-write-history 2015-05-29 13:36:18 (14400 s) > 1180672,28672,618496,28672,14336,589824 dirreq-read-history > 2015-05-29 13:36:18 (14400 s) 0,0,0,0,0,0 geoip-db-digest > 0A1F9C09E08F6F2490E8880664D4E863D1680A12 geoip6-db-digest > A6E9B5DE6F887315749B29F9C9F698215BE5240A dirreq-stats-end > 2015-05-28 19:28:08 (86400 s) dirreq-v3-ips co=8,tw=8 > dirreq-v3-reqs tw=16,co=8 dirreq-v3-resp > ok=16,not-enough-sigs=0,unavailable=0,not-found=0,not-modified=0,busy=0 > > dirreq-v3-direct-dl > complete=0,timeout=0,running=0 > dirreq-v3-tunneled-dl complete=12,timeout=0,running=0 transport > obfs3 [scrubbed]:54997 transport scramblesuit [scrubbed]:55749 > password=[scrubbed] transport fte [scrubbed]:7331 bridge-stats-end > 2015-05-28 19:28:17 (86400 s) bridge-ips co=8,tw=8 > bridge-ip-versions v4=8,v6=0 bridge-ip-transports <OR>=8,obfs3=8 > router-sig-ed25519 [scrubbed] Same > as above, whatever that will be. > router-signature -----BEGIN SIGNATURE----- [scrubbed] -----END > SIGNATURE----- So, uhm, I realize there are quite some open questions above. Hope you have some ideas, otherwise I'll think more about this tomorrow. Thanks! All the best, Karsten -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJVaMrAAAoJEJD5dJfVqbCrJC8H/j279ZhNydUoYA6aWEuZVD9P 5ERo5C+93UMhBBJLtyOmKXSBFso/wUgo1i1XwU79n6wyxxu3D8GfVnSJGhiLdEtn S6eDKkf4S/iPs+cBD8FYY/cMaj+lIehepRvzwlwV1BGSTubJXNMQTKgdh11urRTq lcxrQQNheQlQwx2ekqnTzFNDRvBVwuEGNH6GneG/0aQi4Jv4F3vkPVvOnXJz3z0u OrlhVPFp71BqkciIzv4yBEdxepXarX2zugxnLiKj0hmb6aCrM7NhjElfeoRkqeq4 ws6f997AJD6PJK97fTTTk+IaLAD6u0TtwXZv0v49On/ISSr61VU0CrJ39sCmY04= =JdbV -----END PGP SIGNATURE-----

2 7

design for a Tor router without anonymity compromises
by coderman 12 Jun '15

12 Jun '15

a friend and i are working on a Tor router design that doesn't compromise anonymity for convenience. [0][1][2][3][4] we're soliciting feedback as part of a go / no-go decision on continuing this effort. in particular, the design is intended to meet the scrutiny of Nick M., Roger, and Mike P. as the focus on support for Tor Browser and Tor on each client indicates. --- the design and prototype code is marked "copyright Tor Project Inc. by assignment", which means that we're using a notary public to formally assign copyright ownership to the corporate entity "Tor Project, Inc.". your comments will be taken into consideration, however, please defer patches / code contributions under other owners (you) until assignment complete. --- last but not least, we're trying to eat our own dog food. all of our planning, development, and operations use hidden services, called Onion services in the document, and this bootstrap is more difficult than expected. [5] please provide feedback in reply on this thread or to me directly.[6] assuming the project continues, we will have Onion services to support collaborative development up soon. best regards, and my thanks in advance for your scrutiny! 0. "Tor Enforcing Privacy Router" http://serqet345qt265xp.onion/ 1. "Op-ed: Why the entire premise of Tor-enabled routers is ridiculous" http://arstechnica.com/security/2015/04/18/op-ed-why-the-entire-premise-of-… 2. "[tor-relays] Anonbox Project - Mike Perry" https://lists.torproject.org/pipermail/tor-relays/2014-October/005541.html 3. "[tor-relays] Anonbox Project - Roger Dingledine" https://lists.torproject.org/pipermail/tor-relays/2014-October/005544.html 4. "[tor-talk] Cloak Tor Router (thread)" https://lists.torproject.org/pipermail/tor-talk/2014-November/035436.html 5. "Onion services" came in behind "Tor sites" because sites felt too web browser focused. we're trying to avoid the legacy "hidden services" nomenclature. 6. i have a long history of extreme dislike for encrypted email, key servers, web of trust, and other moral hazards. however, if you encrypt to my key you can send private mail, if desired. note that some encrypted email clients will fail insecure if the intended recipient doesn't match a keyring identifier! https://peertech.org/keys/0x65A847E7C2B9380C-pub.txt

5 11

Tor Browser IsolateSOCKSAuth behavior questions.
by Yawning Angel 01 Jun '15

01 Jun '15

Hello, I've been working on a dumb hack that lets me do things like this: https://imgur.com/3mah244 (Yes, that's a single Tor Browser instance, separate windows used for illustrative purposes.) It's still very raw and doesn't do everything I want it to do, so I'm not really releasing the code yet, but I have some questions regarding how Tor Browser behaves when setting the SOCKS username for isolation purposes. Ideally I want my shim to enforce isolation between the various upstreams (Tor, I2P, whatever) correctly to avoid cross-protocol probing (and to shield the I2P administration interface from eeevil websites). This appears to be straight forward if the application is Tor Browser because IsolateSOCKSAuth is always used at first glance (I will assume for now that if users decide to use things like torsocks that do not use isolation this way that they know what they are doing). My question is, what causes Tor Browser to set the SOCKS username to "--unknown--" and what the behavior should be in that case if: * The destination is a ".onion" address. * The destination is a ".i2p" address. * The destination is the I2P management console. I'm fairly sure this should be "deny". * The destination is any other address (will be dispatched over Tor if running, I don't think I will attempt to support I2P outproxies because they suck). (I think allow because things break otherwise?) For destinations that are ".onion"/".i2p", I plan to be fairly strict about making sure the SOCKS5 target and the username matches (I need to be more relaxed for sites on the regular intertubes since cross-site resources are loaded (I may make this behavior configurable...). Is this dumb? Is it common for "foo.onion" to load resources off "bar.onion"? How about in I2P land? The final form of my shim will support running with any combination of "nothing" (Tor Browser just for the "privacy benefits", probably unsafe, I may reconsider this), I2P, and Tor (Though the most useful configuration is probably I2P + Tor). Thanks in advance, -- Yawning Angel

2 2

Re: [tor-dev] valid MyFamily syntax variations ('$FP=nick' ?)
by l.m 31 May '15

31 May '15

Hi again, Although, as you've noticed, the the node you mention, Konata lists *itself* in the Family Members. That would be a bug. At least compared to the other possibilities. Onionoo checks for the bidirectional relationship and, in other cases, excludes the current node being viewed. If the current node being viewed lists itself... --leeroy

1 0

valid MyFamily syntax variations ('$FP=nick' ?)
by nusenu 31 May '15

31 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, according to the spec [1] relay ops can choose between fingerprint (with and without $ prefix) and nicknames when constructing their MyFamily configs. The man page recommends fingerprints. Now I'm faced with [2][3] families that use a combination: $fp=nick Are they actually valid or is this a bug or can one actually specify arbitrary strings there? (dir auths and onionoo apparently accept them) thanks [1] https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt#n504 [2] https://atlas.torproject.org/#details/2B76359D3AAA94CA107F447D2D14E481A99EB… (search for KosakaKirino) [3] https://collector.torproject.org/recent/relay-descriptors/server-descriptor… (this url has a lifetime) -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVa2WkAAoJEFv7XvVCELh0jEwQAJqdeZaFpRWPfI9/17o7aEKI Jx8Lp811GGwr4STO41ixwOIQ69hjNuav47apcmR4AsUVAq8zkSnzljKyYtVnp7qH 4EHx0kqIop92s9de1AFKg2XDnZ3u4eSN6z53VXeO2+/jFl2CgMVarzLYPHNBBF/x ev3zMk8gYsGA7K5TowZ+HnMalXhHLpTvO+iPPzNF6eY3/pG31hImFfHvhkJ5nrzB gex9wmCTXigM6I1mcT8mK8OH/2+MkNFra2h4tcEmqzmzRdWx1UWDTgl97Jp2injL UxuHL1RkoGLqlZ/MDiMiZPa4JurNRKgBXdZNsASOvcX8ZiPiCzqbbCm4hN4Rsidi ROWR8AcadA/9a5Ovi0z8IhxUiF8Ks2Wadeovp4w+E2NuYvFNmUpvkH0jVSViSE8n v+XClj0DX8oHirRqp80M0o5GpOB2hsRzT0+QhRFKYbikW2CRziM1ECWknw3aj3/z VPohoo6bkkLLBfrrXdgqclvgtoG/zPl8Ef203pmyTjPCFEdx4mJTLzq+hmjoaPsI h+RweF+HvDc0qM+6fiYeHExQl7YMNuT6GbG58lK6V8c+r++FIrPwfyOepAddoE0p dTAHfqYMYhDL952z916tmNNPnHXsUu8hVaIVuB9RvYjAU9FpPAz5Q5CDaIu+F4TY kb9dxHK1c8IHOGamYMOD =tbZE -----END PGP SIGNATURE-----

3 3