From e9c45800136f8c4325b573bbdafea2dbcce1e5c9 Mon Sep 17 00:00:00 2001
From: "atul.jha" <s8atjhaa@stud.uni-saarland.de>
Date: Mon, 3 Aug 2020 18:06:57 +0200
Subject: [PATCH] Deterministic ECC rom Seed working

---
 trial3/defines.h |  37 +++++++++++++-
 trial3/layer1.c  | 130 +++++++++++++++++++++++++++++++++++++++++++----
 trial3/layer1.h  |   7 ++-
 trial3/layer2.c  |  42 +++++++--------
 trial3/layer2.h  |   6 +--
 trial3/links.txt |  11 ++--
 trial3/out/main  | Bin 19016 -> 19024 bytes
 7 files changed, 192 insertions(+), 41 deletions(-)

diff --git a/trial3/defines.h b/trial3/defines.h
index 32ba4a9..0a53aaa 100644
--- a/trial3/defines.h
+++ b/trial3/defines.h
@@ -31,4 +31,39 @@
 
 /* CONFIGURATIONS */
 
-#define USE_ECC			1
\ No newline at end of file
+#define USE_ECC			1
+#define USE_HW_TRNG		0
+
+
+
+#define SW_PRNG 	0
+#define HW_TRNG 	1
+#define DETERM 		2
+
+
+
+
+
+/* SPECIFIC AND SPECIAL VALUES */
+/* DO NOT CHANGE THIS BLOCK */
+
+#define ACCUM_BUFF_OFFSET	2
+#define ENTROPY_LEN			32
+
+
+/* typedes */
+
+typedef struct
+{
+	/*
+	Use this typedef to define settings and vlaues to be passed to deriveECCKeyPair()
+	To be used or exchanging data between ROM and FW
+	*/
+
+	mbedtls_mpi 			secret;			//Private key holder
+    mbedtls_ecp_point 		Public;			//Public key holder
+    int 					ENT_MODE;		//0 - SW_PRNG, 1 - HW_TRNG, 2 - DETERM, 
+    int 					PKC_MODE;		// isECC, 1 = ECC, 0= RSA
+    const uint8_t * 		seed;			//To seed
+    const char *			phrase;			//Session string
+} KeyDrv_context;
diff --git a/trial3/layer1.c b/trial3/layer1.c
index 5c979ed..5fd4c78 100644
--- a/trial3/layer1.c
+++ b/trial3/layer1.c
@@ -196,8 +196,85 @@ int _calcCDIKEY(uint8_t * CDIKEY)
   //gen keypair
 
 
+/* To use HW TRNG /dev/random as the source of entropy add source to entropy contxt -
+*/
 
-int deriveECCKeyPair(mbedtls_mpi * SK, mbedtls_ecp_point * PK)
+int use_dev_random(void *data, unsigned char *output,
+                             size_t len, size_t *olen )
+{
+    FILE *file;
+    size_t ret, left = len;
+    unsigned char *p = output;
+    ((void) data);
+
+    *olen = 0;
+
+    file = fopen( "/dev/random", "rb" );
+    if( file == NULL )
+        return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+
+    while( left > 0 )
+    {
+        /* /dev/random can return much less than requested. If so, try again */
+        ret = fread( p, 1, left, file );
+        if( ret == 0 && ferror( file ) )
+        {
+            fclose( file );
+            return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+        }
+
+        p += ret;
+        left -= ret;
+        sleep( 1 );
+    }
+    fclose( file );
+    *olen = len;
+
+    return( 0 );
+}
+
+
+int seedRNGSource(void *data, unsigned char *output, size_t len)
+{
+  //srand(); lib fun call //https://stackoverflow.com/questions/55927662/generate-every-time-same-rsa-key-with-c
+  //ctr_drbg    //programs/test/benchmark.c:705
+  //hmac_drbg
+
+	//Fill entropy accum with CDI and pass to DRBG
+
+
+  mbedtls_entropy_context * p_ent = data;
+  printf("manual update entropy with CDI\n");
+  printf("%d : len of buffer\n", (int)sizeof(p_ent -> accumulator.buffer) );
+    
+  if(memcpy(output, p_ent -> accumulator.buffer + ACCUM_BUFF_OFFSET , ENTROPY_LEN) < 0)
+  	return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
+
+  for(int i = 0; i < ENTROPY_LEN; i++)
+      printf("0x%hhx,",output[i]);
+  printf(" :  CDIKEY\n");
+  len = ENTROPY_LEN;
+  printf("%d\n", (int)len );
+
+  return 0;
+
+  //  ((void) data);
+  //  printf("Direct return CDI to drbg\n");
+  
+  // len = sizeof(CDI);
+  // memcpy(output, CDI, len);
+  //      for(int i = 0; i < len; i++)
+  //   printf("0x%hhx,",output[i]);
+  //  printf(" :  CDIKEY\n"); 
+  //  printf("%d\n", (int)len);
+  // return 0;
+
+}
+
+
+
+
+int deriveECCKeyPair(KeyDrv_context * KD_ctx)
 {
 
 	printf("inside deriveECCKeyPair layer1\n\n");
@@ -229,15 +306,48 @@ int deriveECCKeyPair(mbedtls_mpi * SK, mbedtls_ecp_point * PK)
     mbedtls_ctr_drbg_context drbgCtx;
     mbedtls_ctr_drbg_init(&drbgCtx);
 
-    //Seed drbg with secret data now?
-    //move "private" string to n param
-    if(mbedtls_ctr_drbg_seed(&drbgCtx, mbedtls_entropy_func, &entropyCtx,
-    				(const unsigned char *) "Private", sizeof("Private")) < 0)
+   
+    if (KD_ctx->ENT_MODE == HW_TRNG)		//HW RNG
     {
-    	perror("drbg seed failed\v");
-    	return RIOTFAILURE;
+    	printf("using /dev/random.... this may take a moment\n");
+    	mbedtls_entropy_add_source( &entropyCtx, use_dev_random,
+                                 NULL, ENTROPY_LEN, MBEDTLS_ENTROPY_SOURCE_STRONG );
+    	
+    	mbedtls_ctr_drbg_seed(&drbgCtx, mbedtls_entropy_func,
+                               &entropyCtx,
+                               (const unsigned char *) KD_ctx->phrase ,
+                               strlen(KD_ctx->phrase)
+                               );
     }
 
+    else if (KD_ctx->ENT_MODE == DETERM)			// Deterministic derviation with seed
+    {	
+    	printf("Seeding entropy accumulator....\n");
+	    if(mbedtls_entropy_update_manual(&entropyCtx, KD_ctx->seed, ENTROPY_LEN) < 0)
+	    {
+	    	perror("Accumulator seed failed\n");
+	    	return RIOTFAILURE;
+	    }
+
+	    if(mbedtls_ctr_drbg_seed(&drbgCtx, seedRNGSource, &entropyCtx,
+	    				(const unsigned char *) KD_ctx->phrase, sizeof(&KD_ctx->phrase)) < 0)
+	    {
+	    	perror("drbg seed failed\v");
+	    	return RIOTFAILURE;
+	    }
+	}
+
+	else 						//regular key derivation
+	{
+		printf("Accumulating entropy ...\n");
+		mbedtls_entropy_update_manual(&entropyCtx, KD_ctx->seed, ENTROPY_LEN);
+		mbedtls_ctr_drbg_seed(&drbgCtx, mbedtls_entropy_func,
+                               &entropyCtx,
+                               (const unsigned char *) KD_ctx->phrase ,
+                               strlen(KD_ctx->phrase)
+                               );
+	}
+
     if(mbedtls_ecp_gen_keypair(&ecpGrp, &secret, &Public, 
     				mbedtls_ctr_drbg_random, &drbgCtx) <0)
     {
@@ -270,8 +380,10 @@ int deriveECCKeyPair(mbedtls_mpi * SK, mbedtls_ecp_point * PK)
 	printf("%s :  PrivKey\n",privkeybuf);
 
 	//copy keys to parent function
-    mbedtls_ecp_copy(PK, &Public);
-    mbedtls_mpi_copy(SK, &secret);
+    mbedtls_ecp_copy(&KD_ctx->Public, &Public);
+    mbedtls_mpi_copy(&KD_ctx->secret, &secret);		/* Make SK NULL for Identitiy key generation */
+
+
 
     //what now? how to obtain the keys in PEM/DER/bin format?
 
diff --git a/trial3/layer1.h b/trial3/layer1.h
index 597c0b0..fc2329a 100644
--- a/trial3/layer1.h
+++ b/trial3/layer1.h
@@ -1,6 +1,8 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
+
 
 #include <mbedtls/bignum.h>
 #include <mbedtls/entropy.h>
@@ -30,7 +32,10 @@ int _calcCDID(uint8_t * CDID);
 
 int _calcCDIKEY(uint8_t * CDIKEY);
 
-int deriveECCKeyPair(mbedtls_mpi * SK, mbedtls_ecp_point * PK);
+
+int seedRNGSource(void *data, unsigned char *output, size_t len);
+
+int deriveECCKeyPair(KeyDrv_context * KD_ctx);
 
 int deriveRSAKeyPair(void);
 
diff --git a/trial3/layer2.c b/trial3/layer2.c
index 16f0907..1a379d1 100644
--- a/trial3/layer2.c
+++ b/trial3/layer2.c
@@ -16,8 +16,10 @@ void ROMprotocol(void)
     printf(" : CDIKEY main\n");
 
   printf("USE_ECC %d\n", USE_ECC);
+
+
+  deriveDeviceIDKeyPair(CDIKEY, USE_ECC);
   deriveDeviceIDKeyPair(CDIKEY, USE_ECC);
-  deriveDeviceIDKeyPair(CDIKEY, !USE_ECC);
 
 
 printf("pass 100\n");
@@ -25,23 +27,6 @@ printf("pass 100\n");
   return;
 }
 
-void seedRNGSource(uint8_t * CDIKEY)
-{
-  //srand(); lib fun call //https://stackoverflow.com/questions/55927662/generate-every-time-same-rsa-key-with-c
-  //ctr_drbg    //programs/test/benchmark.c:705
-  //hmac_drbg
-
-  //seed rng with CDIKEY
-  //init
-  //drbg seed
-
-
-
-
-  return;
-}
-
-
 
 void deriveDeviceIDKeyPair(uint8_t * CDIKEY, int isECC)
 {
@@ -61,22 +46,31 @@ void deriveDeviceIDKeyPair(uint8_t * CDIKEY, int isECC)
   //return pubkey and privkey both to L2?
 
 
-  if(isECC)
+  KeyDrv_context DID_ctx;
+  DID_ctx.ENT_MODE = DETERM;	//deterministec
+  DID_ctx.PKC_MODE = isECC;
+  DID_ctx.seed = CDIKEY;
+  DID_ctx.phrase = IDENTITY;
+
+
+  if(DID_ctx.PKC_MODE == isECC)
   { 
 
-  	mbedtls_mpi secret;
-    mbedtls_mpi_init(&secret);
+  	//mbedtls_mpi secret;
+    mbedtls_mpi_init(&DID_ctx.secret);
 
-    mbedtls_ecp_point Public;
-    mbedtls_ecp_point_init(&Public);
+    //mbedtls_ecp_point Public;
+    mbedtls_ecp_point_init(&DID_ctx.Public);
 
     //return pubkey and privkey both to L2?
-    deriveECCKeyPair(&secret, &Public);		
+    deriveECCKeyPair(&DID_ctx);		
 
     //secret and Public contain raw key inormation of generated keys
     //Public also needs group and context to handle ECP
     //Converting raw info to PEM is not easible like this
 
+    //free(DID_ctx);
+
     return;
   }
 
diff --git a/trial3/layer2.h b/trial3/layer2.h
index 9453b8c..5f59e65 100644
--- a/trial3/layer2.h
+++ b/trial3/layer2.h
@@ -16,15 +16,15 @@
 #include <mbedtls/sha256.h>
 
 
-#include "defines.h"
+//#include "defines.h"
 
 
+#define IDENTITY	"Identity"
+#define ALIAS 		"ALIAS"
 
 
 void ROMprotocol(void);
 
-void seedRNGSource(uint8_t * CDIKEY);
-
 void deriveDeviceIDKeyPair(uint8_t * CDIKEY, int isECC);
 
 void deriveAliasKeyPair(uint8_t * ALIKEY, int isECC);
diff --git a/trial3/links.txt b/trial3/links.txt
index fad64b9..f4573f1 100644
--- a/trial3/links.txt
+++ b/trial3/links.txt
@@ -8,14 +8,19 @@ https://www.cryptopp.com/wiki/
 
 
 
+https://forums.mbed.com/t/ecc-raw-byte-stream-to-pem/4540/3
+https://github.com/ARMmbed/mbedtls/issues/2560
 
 
+ENTROPY
 
-
-
+gen_key.c
 adding /dev/random to entropy - 
 mbedtls_entropy_add_source( &entropy, dev_random_entropy_poll,
                                         NULL, DEV_RANDOM_THRESHOLD,
                                         MBEDTLS_ENTROPY_SOURCE_STRONG ) ) != 0 )
 
-                                        
\ No newline at end of file
+https://forums.mbed.com/t/mbedtls-porting-into-new-environment-help-with-networking-and-entropy/4969
+https://os.mbed.com/docs/mbed-os/v6.2/porting/entropy-sources.html
+
+https://tls.mbed.org/discussions/crypto-and-ssl/deterministic-random-bit-generator-help
\ No newline at end of file
diff --git a/trial3/out/main b/trial3/out/main
index 1f933d99acdd31428786616940cc6d0d64824b3f..553fea7fe04338079e52bf14b1fb2616a036e7e8 100755
GIT binary patch
delta 7104
zcmai34O~>$m49zW6b6tlVHnWxKtMp`%MbiQ2X*w}YO0AQY1Hx|L!|+wz@(aNG8&|t
z37rjkHPv*Jn$%5gVq3RFf9NWXH4T_%T}-=)T9cqZ)66J|V`39DNoW7(yf-)|>F)FA
zz4w3a|D1d7x#!;ZxYM^o?%yGICdWyM5<gb0l47^z{?fE@qJ}n3+;+Yven*amZr9>v
z`TQ7j-#`7?e&T4Zea?!}bukADt$UQO#4f`!*&}45S<d0|OHphziy~vP{EWDcRux(k
z#5VLl%Vi^%&oQ@-+b!I_huafLN6zQ=L9!&5aeD!kLWQlLu{4f(?Od*6{U@0bJ}OzZ
zF#a)@;atALymV1qnk=ee^IgUtvZYG4-_Pwy%w9#kqG)8Y{9W#w$LtH-H=oO!Ty7y9
zQB;~Nr!cRJq+%I7_?$IbSh`7U8D*A#ND|8nMoEg5%u;NTq6c5AUKJNdnP=|f-sEre
z9+o93UW$~4;_gtAJ~fa$MykycCE=UJ$?zp{>sy;QG;OM^uC1+X+2CkiYZsr*Rm5NB
zMvIb&Qn4!1BwmVmD$%af98I;=t@g^s>h+H52Jy<=R58yqM<iL3#1(6@=rKJYN+N%n
z-O}3JU|%oQwb<<sNsac#wN0C(y0r}(TI^C?v%R`jYH6_Bo5ZEajFENr=H?B}!Wflq
zD4rrxqjD4Aq7?j(>7i{9TcQ%h528$wBZj9#GIIs-<l%qRHcBRriALP9?U|91G(tM8
z%f{5#M@!(mrejA+eFTkgTAYb8TcjjS%bKrnBV2<Lay5Fs#jGQ$&K4?+U|dQTYog7T
zG{#!t4e3o6?&v~!a@Vow_hmUzJQrh@lf=Q8r!9AdC`{KCMnR@@t%-HYa*231F3<Vy
zI7L$1J*|d7zuNX%_(>@+b>>(_3S`Yj8Ixv3i|{(K<r@g#$tod?<(GW@jPnRnoO~X}
z8H6dWz5|R?2vb~rdl<(P4kO$da6*!0A^}a*x0wkB!sMy1iSeyeU<#G5it#6e5mm{z
zjPVu1Cc;+6mk37^E@FJ1a1>#M@mqwkN|G<u$$~dXFq#As<KGjGA?*J<1X)K2#}Xc3
z{5!&w_`ZI|FB6U@>|y*O;RM157(YvR4B<VDw-crl&*$u9!BZrl-0*E?`~+c22VWE8
zM+hequ43Fw*g|+2;~x-CA#7z_LpYUi5#t95k0q=yzK8HQV5cvZ1&c{Q3FDI(&m&A3
z=ktF>5tvC>Aw0migm60He#Uu(GYESaXAmAw_yFS+!kL8kFpejjh4GODEHIHEn+Tg3
z8wgJz+{E}+3NXC^d{vA;A)HHi8RIL2^9WlRUm{HJ4_^`E^MvyWD~!p0U8i&pB=i)2
zRN*@FJ=JwdZM*DWwql7pY%$hbbw~dRX`s5x{t8YY@i#DXBPMMDi_QV8RNY}`P^&YB
zRM!Ws7PTYn5wR*UCww;v-BY)VjzmRXF7_v8=T<-@ISSRbvI*2$NeWSFM_C?_HyT0q
zswiF$OBY`xW~WwST<?8fLfV2%g$JuhV1uAj+@F+FX4U+fP11ZUnd-86)V9Ywk|PP^
z0upCI+zpcfUmSL84{f01v~9f?#L*-r`Y&HVs{>lDUhg&GOPV47L5w$Nrayy?&<&d8
z{VN!4wr;uYvF=fi_rvUFba{)!I&<d2<-@EOm~|AaqiM`qOsuQ7*m@sX|2f*-G_u;U
zbf{LH9F;{2*&60uDBd#9%=Bv$yo$>Eb4(CZ*@vm@)28wQiFb*j<g{_&)Y*Yf*!&53
z@3I{T;tQf7xiR~_o3|OCaN9u)kJ_<v*I}9ysrp19IkW5t4g_tQCb-vT+lvY8)h2KX
zUEUQ?*PM1;fZu(ges_y1ORiz`Ezw~aCtnl4vZOX7X!9NF36An2^xHj~G7z?@Wbcwr
zAP)|aZC;r%2n(!x;pET}g&jOi3>sb69z)uDL$o)FqLlP;Nw*nq<E-=6g)nA{^(kZT
zYSb8M@ZdROObTJhH^sh`ycv;@Ye85wL_xTWAY9ghP(>>L{yE3fOD=s^Yx}9aR79p0
z$*aZe)G6~Daq?<5j)9@)i)Q1G=<<$&^f;aF-e@?4HS5FT_GydTO@ySIqAT?!^LVt&
zyR{gc(PPo;T_>8x<~VIQ?X@v>enw-2WZPTl^1lB!_LFm2p#81cHWR9+PSU<p+Xk(w
z>#?({%h9j8Rw7B4B1Pbs%Qk=-G8?UkN9~2%SRki+>Py%@2xJqDww)s3viUI&zvOtR
z`!(8QTZ!1Q)Q?mn8{QsHc*Lrfd~?}`z#ftu<I%?<EQ1*D-Gm@sLvE9$t7Q-ksWQ7T
zq~_WNjyrkVuBKtz9vhGxyMju&WLwK`I3LR)8lGYirihhu3}A|9!9p8$-DO8H74L6v
z1Oh#q$!B-j8xUyGouS!-ubu}~w`zda0G7fDnv3(&2STsy2K1z>c^$SJ>e_zdsB(YI
zAt~mN$MrhwJw0si3Px$O-9T2|&@y5IjXecYwbyo5q2W7hXIZIcSm_|TLuayO(CNq5
zfa*Gyj3lj9J4W#NL9;3LV7LOZdGS*?)}9Xn`KG$t51>h@>ZQRn*h3#BB+JxfR-Lj_
zgH<|QNI`J7$MOl&>%ITefRin7_V#+iIY#Z|ONX_pZAf-(q!_|O?;1FvYnF2g9#$~o
z5&VZoQ~w1o9vZ!uSRHIY?XWhHXe)^jhM-h!Qr$b*0eF5B<5#$lSW_R4RoMS$;IJ==
zkB-}Z7-HIY@IYl7$d|W12^mFQr@Iw;#x!A2oH6viSVJ29u*z}wy^gQBP+y#(&IHQ4
z5pbH&Zhb=GP;B?axZ1Vh^T^oNVPlVwF?U%uN$32(PF)CPXu+xf#QA?lM-R@b7%e!D
z@*=nqHmt=?UR3u%UTQ51DqMYPM|7gje(rV<p2s2O{V!lG2q!7NZZ~~0I$@}Yvcr8)
zv&Y$0ez+DBCUdSc+8SdeM_&&FT%3n($2c1~zN^V}%dqKsnC@-QfkhaQu1@OUwz@0k
z(AF>-FSwEJAE9kbr{w)5?6xsY*4ec4+S#iazi;kAgyU$C_x<Fidpdi&vJ=ZrQ-_o6
zY!7|JQo=onFyHBBVF!E7d+}X;T)gZttm<}_oxu0H_f;rqv3Z%yxNV)3v+lB9bh6xQ
zAiAE!?q$gso#O?T>m9Env~wq~i0f@~CW?J#M+r7k3IsKKz5jYWFr9F4L%+{14R6nZ
zYs}{5hH@O+DqBqc{?9ehlwmf^_KRPqr_U)S(GHDmMRFXWchc}F{itTuuW$O<8n2UH
znXvkiUqoeC;%*@>*oIwE3J38|elaa0GpSLBJU@3?4@lmdAJfpKRWLJr9>*e72dMLn
zk8$=Y7+w1u`%fB+j%GUcF<92;q9<d#^GCyrFcyS6PSHxTQb$(k#Q?KwhPi%7$<Xk`
zXq-C)_%tMyX=Eb<>`vXmErXrZ<2tqx8R$CbY(@38!?xEpK!4|Tv{RqUb{R`eWH|4|
zhw#TZUeWY-*e=gth9eI-vYDpz3VB8CHcv9)RUBTeZyVO)>PYW<I7~XpQG9680Y8hs
z5RFhgb+WVk{_^`OT<?^xEXSvL*0fRl<voe&d&^y4Rk%J|l1nf3aP`DjM(;a=T~B8&
zmX{XR+8-`#u3lfep%G3?+Kqyu-7hHmb%XMw`qp*I`~?+KR;@Bq!JUG#p-!oB)Zx~^
zBo%GUTDNXvKKe}Jy{rtUqoscR_mvR41$dO!b@eSuWA!GbwfZ5uQmr&@XoPhd@?N{W
zmNbHcRj*y^Xmm7Gw{B=AO{x4gR&bM1tJGE3H`r@UQf+h1_d_L-OdZ3zp$1_@ShCAR
zRdxv$Mhs>z*`6IPrcX#0RTD~`6}1?+zI7A1BBvT>J&BqQfPeM{0)IxmdN2_95_JRW
zy{I4lC=j3z(q~amL7j|MT7kL?dulW4`>-+hpr+TS2Xz?UgafEgqoxa$4D1#K_1{r1
zFyKn*7<N-F1gr7kz7_SGsNXb*x||Gy=c;%rr@*ksD~{x3r#x^q5TKVz@S#6dSL6SK
zgW^`sU54)sikZ17BmWJOqaTR}bF-a&XikKCzrgTP`RLdm8|FukG(Im!jS81Y*^B?b
zf!n9==sz{w9}f9yOy?qa!}^8`q|W*|=pTpk`qUl$uLb+FB^89%L0ExpG;F~5oe{)P
zAX<n1TjGP<w6LF`^*a%fmzuR7t>wt}=kGAOn~g4j>`nCdi~77pBZj~d)kO)SKkrDm
zerMzn<@sqDboWFL{wUxlc>jjKlK8>B+Y|YZ%jbnWsWQ%^OY!REr(gVV(s$%eabi*$
zt_LqpavHMZyB;j4le_u~b7Y9F7n#w0y(rNb0Z-D4&BZ|zx&^L`-*WFq9Y%N+E0z~0
z8lxq@I8m5jG)kj|v)H_Z?gK+DXl*01vFTgoaZ>P>H&n}rn?)s8+$w%sE)r)-%$6qo
z);LH?N5deErt7rHi)2YuOkO2kEg2&Ylq6gJ1AQ_Kv`!4N^;(>noC-S$Qt(nP*pKVi
zDdy^P3=^d3`AV>Z>p?ER=_tL@W!&?r1qw5QMIshA9==uS6UKJnCyOs(%k|#<`W@iU
zfazJxm$s|9<m+1b32KM^6#a@gBPYmv#PX?Txr-Tp;PM=m#e=%V0zG{m*Dc=A<;yd*
z5jYvqH1YMZA}+$(1a8lw(vrsfZ!X~7%&FmW6P3j~F(sPeZn{{)!+QtyFLe1L3yUS*
zvuOUBb^Ex~F0%dH9?e(OIr=sCHe8M0E2>8(Gk%In%k$U-bY(3SDVj;We1$p3xqO?;
z54rq;%COPcs#?s(iRIJHmQvt2gINmynw16Ai)(h`G!Q2wO#%6NlsVhE+{a9M?bGc2
znHs~cGfy+;kD`2r*|HaY6DRm<M=%vXU<*UKg)1qVDxY0wju7%pvpi0mfrZ>K&4Ni^
zRedn2fH^iU*KoO>O3RZvzlQGi@bGbkdN*_SGsmNIwvT6ubX=>XH@Wv5dMQd@|9Rj8
zaUJ#px^6cex_B;X6}J8IS!Own%My`3%WU}@&;6S}7~D;qxEg$nQDhEfXa+8bZL@yc
zb@%MM<S^~}eoa|h7+?Ae{~WXMmd#ITtg+X&HnddgFW1oD7xLy5|AXHXu7-~njyVb9
zT12wQw?>F_bFzhH?tjN?KOtDHi<VT(n_pQ{fL{teocoYiYh5IcSTB`0TI`khnyA#j
zCW1pZHq}?+=LWm>Yr}2rl7gvXfBC$wQS-`WF(8lVQs-C6IFo<1pfDmuKe=)KE+~!b
z)KRduid<V^M87WW7uB}Xh~N?I5ii(EO~C_yC{A3mO^b-7YiB&MB7I@0$v;Lz{xPCv
z;WY8U!dOF1tay20fhl<Y;{9-G;k5YRu^X(@jUsPRfhl<E?#K}}i>8^BT+N)4+x6n2
Xc!NAi9ITiuw+LTFsT?WN7f<+K&fwY4

delta 6929
zcmZ`;4Rlo1wZ1ohBw<1(fiN?Pm^&eXBtU+R5O~2P5ORaq#;3ub_i7T%&;;QTLr?)>
zfG}?{jw6Go^igfQz-mEPbpd&>;twGp60nsOd@7V$1hl*veiTx~h>y<u_C9we0qkYv
zob&DdoxS(j=jYxz^!-9T{0r4*O){q_{FKW|iQSm9ExspLqMqE1C%cnRjF)Jz7H_C0
zN4>Vo-uU#JbE5v<?v2n(hdZZVNLem6N7Sm{2{qE97IWDz8e^=YFw!D6M_ENfq*Z-P
zY=rhVTy`<%m)w4V+YbtRltq1<CGA|U;PMY-LmkFiH%s2)_EGNj6qmbLZWmYXvT`ev
zrCYfi$>k^9=V7rmI$!m3`>$;G5SKc0){$H^#8}l8EcJ=T$yVl0F)UI1k8!(z{k%v#
zksWPS?`M3TbfR{cRgIul^zR}SB|{ujN2)KeooQ6s4nk^HEQ+~6Gg2?B<KoOP%hW%z
z)_R-vtg0x<%5W-fdUC-}RuYv@GDT7B>e$vN>X$g$m$r)6W9x)1?$KNbTK;4H;`;e*
zix<_mFKcxui{?3++7~XVhvw<FmUc(|6OLu|t&T-vLELXdR($O+?$XjO7RGNF878$Z
zofqQu$8WJMax8)$W&RR};|XQ{;|muraVYcK9F0w)Yj}n@Gh7oUla{V15gcqJYT1&d
zlt+kqQ;OJ96C;{UCZU^54@j-5g#IaLMJN@V5;^KoEiDO(5~+M{$d;zI#F4dg!1PR+
zsBs<3B@!*pm@I0a_}(-_O%Y`Y7Tah;L)GbgjZqBBJH?^|i>e7%LcUtmxjW$t)n;L(
zQ5e)=fL8Hl;s!Ncl$kB6y|d2jRI%tkP0DqCI!04;S5JFHuutze82f&>f3PI?4owMW
zO+=ZPUXB*wX3_^v2k~TO5XKxUfj-8mgef0^9>&RpX^?>(jN=JM5#GW$0@&FcO#&Ya
zuBU-O0}HHX+)tRI5418qPngmaXkdJnFmkB`Y8js-98b8M@yCR*{**ug;|~d&2y2WF
zq-jp28Iz*~%q)0^2qOq9jCT=EBz*ZF5M;eU*i85|<5vhL5$<FB5@A~HfgZ*$5*|r-
z2jk}mk0QK<@!B*e1azted@NW_1e)%^YQ}AZX-)&Jj295L5^i8TkFbq!E#pTCrxGq_
z{I7)52p2G(P52JN8skbQ3C57X%z~+e?<A}+E+ULgfehTB4CE5l2%l!0LD){Xk8vvD
z48lE(lL?O{yn}H(;Y`9?7&{|KkVOI?3$CXEk0ZRAaX(=?)B~-I&lAoj+`#xO;T*!X
zj877#S3;ni@yCQG5H4W+A>oOHHNuZ(k%Rd@2>2<yRO3GOnC?EScYJlZ_Q5&c=r=I`
zx;LSitFm)o1yg>DK35adXOgDu2tb|gjoy!1FCEa`e`~ktp6CVQ-jwWEHwnEZYsHEb
zO|1~WP8pX|3X!rjU+*ZhP^*qQm~>BBDv&<`G5K{AhoY0jg_Lo3@56HR&;370AH&Lp
zyLU-Y1%dBp?^9ph4VPDR_lLT>>ay;x8_+#f17hOn>@pXa=&*)5Bw;o|=+Qe?_9#n7
zL%f8<@ep^xTQHD>joeLpYai`s|4y-Sw3e{r2lVowm%G=0P;`$j#am%ubf*0;*fU+A
zDgKwi=&0&aJ63iLTh#}%A3){Dv1Q4e^vf`7F0<YP>%DYlZ6H?Pb+&$(tgjO<Sgh)B
zvCT3yvjj?5Dj?1}3>0y1N8H<G+~<%6|4I>UO&{}D8Qyj>&`51})eeNqc%!JWE*jVQ
zJ-c8@FSnNxqeu7DZGM{uKwZ1VC)P}R5C?@E(>@S8s$NC3ugYjgkjqkGv!$skMTspZ
z;>+(vgKdm@P^_}0<@u$Lf$osKY6x6C%Q7&A<uK~+mE*)T_4+-c*JdB{{Xm%U2r=A4
z825?jRQp5k4l>e+aqkdDBJ9ga+e{<y)SaLy*WI6ygG%W<9nR0<DD)=}>G;`zSecqz
zS_`=xsTp26s=mTVzmg+;jk-Md9Vg9C=BCRw7FMsnNSsbBPzyy;+Fdht;n<Zn+Q2YY
zfV5#I8yBwygZt<x_xHmGCgw0^@UWc08|dr*VL+@;`+Y=noG7?sRP233>Nu#0a*I9h
zIV?kIdp4|eR1H}-7V3KNTaJ%c<ul)k4Hk<t2+<L_9oAgj;-Y!o+q|3{?`}ZVq<f;W
z=+HnQ1BE@v%~AO9x1d+A>sb(Z>b$Ok71X8I-vGb5gx&N4BiZxh)$8hEtG)h95}s!0
z#3GVid@H4eFRn@p&q~<J+D)v5T}UgsXtUv9aiG>cC9{$>b~6`DEFRjS4^WKPfH@g~
z<A_A}da1MS-NcT)yEz=MlOwNjAJ#ny=aQtMRfC4ckfFE2hBin;Th_3l)ieU{ZfTG0
zRJ`4U(8!wm*gKpV4F8+I2ZL_TRmWb=7>D>5yq*0IUUP<GEP?4>*E2>&FHG`qTi=|x
zXI(V;OWf1rK7^rd#?p{e{4f&L!7SAvKi;Q%TpU&DfwpdtedMGE{xSOX9PK9aT0%S-
zi1Tf+&7R<#iy65&!h8=0%pQLNBhuq3wp3P4R$oLPncXG$aDhcO%pGQjJG{vqWX3(N
z2A*-=YcqM0H}#Oj<8;Xd$C?ZM9N!M+_WJ(>;y(H^@_$UW+y~%E>X^NV?07b@#N+DX
zPRDikA^%#;neKLNW(TtJ`ph_>(Vr&_k-Crj_mWYkCqx+Fg=MT%Cj5-T3F*6}ev^-^
zdR?oL${Kec&p9INrq3I{iATmd#DO`uFFaveVe6(%bD8GC?Q(9B_6WYSdOF@Fp{27!
zCZlyf^R`PGp_^%Lrg_<%Ob_dI_fgt@6A+P{-650u89pB6q?-D%1~D2LOt0U2g`k&x
z-frw3xVp{Q>tSO(+}R}q?)6tl$kU8S*79;N^55(4kfSSb8fV8<i9-j$x0g9C-nHmF
znr)TU!<YX&R2;qTxo@CJFE;TJ)gJ9H1Sx!)^&#`OpI@`c!0Xa>Igb2yV(6Quo8H}&
zEuReHGQSji{r5|v?>fyuum9{7ku=tp#0QF}q$@!l7>BQjX=5{;Z3bM<Cd&R81xF+P
zS)_GP7?E~dG-I6{B>ETM1cTigLXqDRJ>(q+ug-6&UVj}9``)Un&?^^mJylnA+VN1U
zeTjP%acXR=(*rAVURCt%sJe<b)K&R*Swaq0kOLm8x9rI<_fts8P&f+{;DH6?iUyua
zwYO|G*_aHr&xqZ<av=0IwdSItI*GkE7N14#-BBoSNq@&)5-N%7-ehww`Y}P)e^36s
zF8b|3@M#*hcN0UeLE`Oh$9!RJT8Zba^Pvk_pmVGV2C)IfTlN^|L+I{yje@3QFO|x&
zEDuB8k3Jl<GDBZ{O=im0L*N(evdSm-?B+1%U2uFCV*Ks+<n>WTu-fDc5v%P5D3829
zKQA$T9o#GU7_NAzV(x?*_wkCl3VZ=)9U8_TxRa=Upu&Bl#(iy0&foNoi?RCt8<GCS
zmpaq4W~)NY9wj~)H_}$y*78(iyF+PeoA+}KKen5+`Hd|L9Zkc<6XVO`vYPODK#$lq
zzWC9sCE8R?d%CT$wG}+-d9P!cK~NO_t*^C0s^Q1J*5+u}o@!jU)S;DWWX4c0o%dr}
z@%i{Uq9EIj-NW8$v!}#{e8Y92Gk;DIJ5tjkr#%k}oqPKEVDJR$>`TZu*4Gr&+kq>Q
zA}jEG)KgHeLH#i5AZGj-)GuMfzKXgGN5etX!|_`A3iY2c(@{A0cVpvaqi(1Dh}!u>
z&=RDd%IooYyB_rb>ORy+%bhtH5$i9C%ACB2=74C+8Ryh427`EmhadX=_V4)1Ky;ZT
ztr%hc&xjcbG4-Zl#3TK)_!|d(8tSlq?x6nH5Zj?&g($=N$Ym-qvLSj8e@=|@WmOU1
z<=CVBz+a0oxoI)6=<(zgF+DdmD;v#p4EZSb)1Z+fQDj7eNQeF-u{Sq8dLddaaV9sd
z>Up#>krsT^4)&Qf7}y`6rw`m4L-i2@OqdDTpP(NQ_6gNd8j>m+3r3376W+#OSDe|n
zC+QOv6Vo&33Wgq&tircY_*KCVZlBgpT&4C4by9uOVMB^{K0hbKlaqd`ZWsF}rK?5a
z%p_-Lb6$h0UhCYSpRYo4rN9F1m4cMWIOT+}7h0Sl3x)x%B7fxaixiOvO1tG!Ov(|4
zamUF9j3QDQp@i-}Z<f;~8cQmN%HhDQoR*4P<Vi~CW^||`68CY<;!I(R7*TXUEf>d%
zEVk9R1Y$>r2n5n6)Z%K@ENY7XErsxOBkR1<z}X|V7Uv6Jbxc&U@?NeuSv*etNT_#N
zY^R`9F+6>uhSuQozoPIiOU-o_+#X&6=37-pD|((b*afYzkS9|(#xQyFKwiujmOnML
z$Bp|iEMtBi=1a{5Tspb*arv6Cmso87g(aimnp3&unsYyM{)fuKbB5(djA8Qzg6*#j
z`9ou+Ctkm3M)BoqsyI`Ei#KkUP-&aQ{P6tAPAKKYZar}dS71;y#yN&f-ZS914S5^g
z{NVW=Y|$gw{x&Y(<?>T5zu_{HE__8Su6pHFu+A62Kj(4{m9|Y7KV9?QI{sIfvxm!%
zxID#WKb6tZQOFu!8IKb8PqEnYfRiFDO6)CJoW|N((hgakfc(^xR(*=g=b8BmR5bdA
zOv!K<%w5cRpUXdsic*X1WyDR)&>o@pK0PPd&LzW6im^hE8rk}uEhLMrrIx}Bd`_8_
z+pn<mAScVI#%vp*V3nblI-ARRTrQ!~<~8_V(ix10Pe#<gWzJ6Kd|+_A8B9_3$x1oK
zoKs@|R7>=EaAZ!SgngPNIt8yWzLvLL<gsEU+;V;t63<oz9>u%UE{%R}*q%#Tv3c5d
z(~zrlN9Xi^(Nxh^)-DdkCkxZ`QqeHIKztdSDjta&c@JNgmzP)1si~Y%UzAsrR}#L5
zU)0)yEBco9u;9n;+|N&+VjJS^<|}<+zo$<`l`j~){dbhtCf-EHb^d>se<^+yYl^}(
zy+a(SsI(3t-1Hv-o$-~GYG>^XoYDPa=gj=LBIDRE5`meMleQZuR2PWCs{FVUhV+DJ
zshS)YI=~N$*Q+MShtr!Z&R5+Xry1GSM9!?qV#_SEXq{D%99nOo`aq)CH7hUPIFjlA
zH_p$xJ1KM!hw5*|&gyhgTWyXH9mOZciv`tp$Mdx&CagKT^Ns4{2sKaattnO)iz_vg
Q<Aznrnf!-%az^_91HEaA!vFvP