[Pqc] Re: [EXT] Re: [IPsec] Re: [EXTERNAL] P QC integration in IPsec/IKEv2 - implementation experience and int erop

--000000000000129b5706550a472a
Content-Type: multipart/alternative; boundary="000000000000129b5406550a4728"

--000000000000129b5406550a4728
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Nick, Paul, Uri, all,

I took a first pass at the starter matrix I mentioned and attached it as
Markdown.

It is deliberately lightweight: not an interop claim, and not a
standards-status statement. The goal is just to give implementers a common
row format for recording what was actually tested, against which peer, and
with what evidence. I also split KEM-based authentication into its own
bucket after Uri=E2=80=99s note, rather than folding it into RFC 9370 or PQ=
C
signature authentication.

The seed rows are only placeholders based on the public discussion so far.
They should be replaced or corrected by the actual implementers if the
group wants to use this around IETF 126 / hackathon coordination.

Best,
Songbo

On Tue, 23 Jun 2026 02:27:19 +0000, =E2=80=9CBlumenthal, Uri - 0553 - MITLL=
=E2=80=9D
[email protected] wrote:

Please add this draft to the list of mechanisms:

https://datatracker.ietf.org/doc/draft-wang-ipsecme-kem-auth-ikev2/

=E2=80=93

V/R,

Uri Blumenthal

There are two ways to design a system. One is to make it so simple there
are obviously no deficiencies.

The other is to make it so complex there are no obvious deficiencies.

   - C. A. R. Hoare

I was a shepherd to fools

Causelessly bold or afraid.

They would not abide by my rules.

Yet they escaped. For I stayed.

R. Kipling =E2=80=9CEpitaphs of the War. Convoy Escort=E2=80=9D

From: Songbo Bu [email protected]
Date: Monday, June 22, 2026 at 21:23
To: [email protected] [email protected]; [email protected] [email protected]
Cc: [email protected] [email protected]; [email protected] [email protected]
Subject: [EXT] [Pqc] Re: [IPsec] Re: [EXTERNAL] PQC integration in
IPsec/IKEv2 - implementation experience and interop

This Message Is From an External Sender

This message came from outside the Laboratory.

Hi Nick, Paul, all,

This thread is useful.

I agree with Paul that IPsec/IKEv2 interop probably does not need a
QUIC-style continuous public test harness to be useful.

A lower-friction artifact may be enough for the first pass: a public
interop checklist and results matrix that records exactly what was tested,
against which peer, and what evidence was observed.

For PQC-in-IKEv2 I would split the first matrix along a few axes:

   -

   implementation and version;
   -

   peer implementation and version;
   -

   deployment shape: site-to-site, remote access, or point-to-point;
   -

   mechanism: RFC 8784 PPK, RFC 9867 PPK with IKE_INTERMEDIATE, RFC 9370
   multiple key exchange, PQC authentication, reliable IKEv2 transport,
   downgrade prevention;
   -

   algorithm set: ML-KEM and ML-DSA parameter sets actually exercised;
   -

   path conditions: fragmentation, retransmission, NAT traversal,
   rekey/CREATE_CHILD_SA, and failure diagnostics;
   -

   result evidence: packet trace summary, logs, negotiated transforms, and
   failure reason where applicable.

That would let vendors and open-source implementations participate at
different disclosure levels while still producing useful compatibility data=
.

If there is interest, I can help turn this into a starter checklist or
markdown matrix for the IETF 126 hackathon discussion.

Best,
Songbo

On Mon, 22 Jun 2026 19:26:21 -0400 (EDT), Paul Wouters [email protected] wrote=
:

On Mon, 22 Jun 2026, Nick Grifka wrote:

Also, I see in the past there have been PQC-related interop events (ex:
https://github.com/IETF-Hackathon/pqc-certificates). Is there any appetite
for an interop
event for PQC in IPsec/IKEv2 amongst the community? I realize the nature of
many IPsec/IKEv2 products might not be suitable for a robust and efficient
interop
framework (ex: https://github.com/quic-interop), so maybe that makes such
an event less practical.

Traditionally these were held in the past (called =E2=80=9Cbake offs=E2=80=
=9D but then
IPR got into the way of that name). But since IKEv2/IPsec has strong
opensource releases (libreswan and strongswan), interop testing usually
happens against those implementations (and recently elvis-plus) and doesn=
=E2=80=99t
require much gathering. Although if you will be at IETF-126, there will
be *swan people and elvis-plus people who will gladly do some interop
testing with you - especially during the hackathon days (Sat+Sun)

Paul

--000000000000129b5406550a4728
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p>Hi Nick, Paul, Uri, all,</p>
<p>I took a first pass at the starter matrix I mentioned and attached it as=
 Markdown.</p>
<p>It is deliberately lightweight: not an interop claim, and not a standard=
s-status statement. The goal is just to give implementers a common row form=
at for recording what was actually tested, against which peer, and with wha=
t evidence. I also split KEM-based authentication into its own bucket after=
 Uri=E2=80=99s note, rather than folding it into RFC 9370 or PQC signature =
authentication.</p>
<p>The seed rows are only placeholders based on the public discussion so fa=
r. They should be replaced or corrected by the actual implementers if the g=
roup wants to use this around IETF 126 / hackathon coordination.</p>
<p>Best,<br>
Songbo</p>
<p>On Tue, 23 Jun 2026 02:27:19 +0000, =E2=80=9CBlumenthal, Uri - 0553 - MI=
TLL=E2=80=9D <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]=
.edu</a> wrote:</p>
<blockquote>
<p>Please add this draft to the list of mechanisms:</p>
<p><a href=3D"https://datatracker.ietf.org/doc/draft-wang-ipsecme-kem-auth-=
ikev2/" target=3D"_blank">https://datatracker.ietf.org/doc/draft-wang-ipsec=
me-kem-auth-ikev2/</a></p>
<p>=E2=80=93</p>
<p>V/R,</p>
<p>Uri Blumenthal</p>
<p>There are two ways to design a system. One is to make it so simple there=
 are obviously no deficiencies.</p>
<p>The other is to make it so complex there are no obvious deficiencies.</p=
>
<ul>
<li>C. A. R. Hoare</li>
</ul>
<p>I was a shepherd to fools</p>
<p>Causelessly bold or afraid.</p>
<p>They would not abide by my rules.</p>
<p>Yet they escaped. For I stayed.</p>
<p>R. Kipling =E2=80=9CEpitaphs of the War. Convoy Escort=E2=80=9D</p>
<p>From: Songbo Bu <a href=3D"mailto:[email protected]" target=3D"_blank=
">[email protected]</a><br>
Date: Monday, June 22, 2026 at 21:23<br>
To: <a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a> =
<a href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a>; <a =
href=3D"mailto:[email protected]" target=3D"_blank">[email protected]</a> <a href=3D"=
mailto:[email protected]" target=3D"_blank">[email protected]</a><br>
Cc: <a href=3D"mailto:[email protected]" target=3D"_blank">nigri@microsof=
t.com</a> <a href=3D"mailto:[email protected]" target=3D"_blank">nigri@mi=
crosoft.com</a>; <a href=3D"mailto:[email protected]" target=3D"_blank">paul@n=
ohats.ca</a> <a href=3D"mailto:[email protected]" target=3D"_blank">paul@nohat=
s.ca</a><br>
Subject: [EXT] [Pqc] Re: [IPsec] Re: [EXTERNAL] PQC integration in IPsec/IK=
Ev2 - implementation experience and interop</p>
<p>This Message Is From an External Sender</p>
<p>This message came from outside the Laboratory.</p>
<p>Hi Nick, Paul, all,</p>
<p>This thread is useful.</p>
<p>I agree with Paul that IPsec/IKEv2 interop probably does not need a QUIC=
-style continuous public test harness to be useful.</p>
<p>A lower-friction artifact may be enough for the first pass: a public int=
erop checklist and results matrix that records exactly what was tested, aga=
inst which peer, and what evidence was observed.</p>
<p>For PQC-in-IKEv2 I would split the first matrix along a few axes:</p>
<ul>
<li>
<p>implementation and version;</p>
</li>
<li>
<p>peer implementation and version;</p>
</li>
<li>
<p>deployment shape: site-to-site, remote access, or point-to-point;</p>
</li>
<li>
<p>mechanism: RFC 8784 PPK, RFC 9867 PPK with IKE_INTERMEDIATE, RFC 9370 mu=
ltiple key exchange, PQC authentication, reliable IKEv2 transport, downgrad=
e prevention;</p>
</li>
<li>
<p>algorithm set: ML-KEM and ML-DSA parameter sets actually exercised;</p>
</li>
<li>
<p>path conditions: fragmentation, retransmission, NAT traversal, rekey/CRE=
ATE_CHILD_SA, and failure diagnostics;</p>
</li>
<li>
<p>result evidence: packet trace summary, logs, negotiated transforms, and =
failure reason where applicable.</p>
</li>
</ul>
<p>That would let vendors and open-source implementations participate at di=
fferent disclosure levels while still producing useful compatibility data.<=
/p>
<p>If there is interest, I can help turn this into a starter checklist or m=
arkdown matrix for the IETF 126 hackathon discussion.</p>
<p>Best,<br>
Songbo</p>
<p>On Mon, 22 Jun 2026 19:26:21 -0400 (EDT), Paul Wouters <a href=3D"mailto=
:[email protected]" target=3D"_blank">[email protected]</a> wrote:</p>
<p>On Mon, 22 Jun 2026, Nick Grifka wrote:</p>
<p>Also, I see in the past there have been PQC-related interop events (ex: =
<a href=3D"https://github.com/IETF-Hackathon/pqc-certificates" target=3D"_b=
lank">https://github.com/IETF-Hackathon/pqc-certificates</a>). Is there any=
 appetite for an interop<br>
event for PQC in IPsec/IKEv2 amongst the community? I realize the nature of=
 many IPsec/IKEv2 products might not be suitable for a robust and efficient=
 interop<br>
framework (ex: <a href=3D"https://github.com/quic-interop" target=3D"_blank=
">https://github.com/quic-interop</a>), so maybe that makes such an event l=
ess practical.</p>
<p>Traditionally these were held in the past (called =E2=80=9Cbake offs=E2=
=80=9D but then<br>
IPR got into the way of that name). But since IKEv2/IPsec has strong<br>
opensource releases (libreswan and strongswan), interop testing usually<br>
happens against those implementations (and recently elvis-plus) and doesn=
=E2=80=99t<br>
require much gathering. Although if you will be at IETF-126, there will<br>
be *swan people and elvis-plus people who will gladly do some interop<br>
testing with you - especially during the hackathon days (Sat+Sun)</p>
<p>Paul</p>
</blockquote>
</div>

--000000000000129b5406550a4728--

--000000000000129b5706550a472a
Content-Type: text/x-markdown; charset="US-ASCII";
 name="ipsec-pqc-interop-starter-matrix.md"
Content-Disposition: attachment;
	filename="ipsec-pqc-interop-starter-matrix.md"
Content-Transfer-Encoding: base64
Content-ID: <>
X-Attachment-Id: 

IyBJUHNlYy9JS0V2MiBQUUMgSW50ZXJvcCBTdGFydGVyIE1hdHJpeAoKRGF0ZTogMjAyNi0wNi0y
MwoKQ29udGV4dDogZm9sbG93LXVwIHRvIHRoZSBJUHNlYy9QUUMgZGlzY3Vzc2lvbiBvbiB3aGV0
aGVyIGEgbG93LWZyaWN0aW9uIGludGVyb3AgYXJ0aWZhY3QgaXMgdXNlZnVsIGZvciBJRVRGIDEy
NiBoYWNrYXRob24gYW5kIHZlbmRvci9vcGVuLXNvdXJjZSB0ZXN0aW5nLiBVcmkgQmx1bWVudGhh
bCBhc2tlZCB0byBhZGQgYGRyYWZ0LXdhbmctaXBzZWNtZS1rZW0tYXV0aC1pa2V2MmAgdG8gdGhl
IG1lY2hhbmlzbSBsaXN0LgoKIyMgTWVjaGFuaXNtIGJ1Y2tldHMKCnwgQnVja2V0IHwgTWVjaGFu
aXNtL2RvY3VtZW50IHwgV2h5IGl0IGJlbG9uZ3MgaW4gdGhlIG1hdHJpeCB8IEZpcnN0IGV2aWRl
bmNlIHRvIGNvbGxlY3QgfAp8IC0tLSB8IC0tLSB8IC0tLSB8IC0tLSB8CnwgUFNLIG1peGluZyB8
IFJGQyA4Nzg0IFBQSyB8IEV4aXN0aW5nIHBvc3QtcXVhbnR1bSBwcmVzaGFyZWQta2V5IHN0eWxl
IG1pdGlnYXRpb24gfCBOZWdvdGlhdGVkIFBQSyB1c2UsIGZhaWx1cmUgcmVhc29uIHdoZW4gUFBL
IGlzIHJlcXVpcmVkIGJ1dCB1bmF2YWlsYWJsZSB8CnwgUFNLIG1peGluZyB3aXRoIGludGVybWVk
aWF0ZSBleGNoYW5nZSB8IFJGQyA5ODY3IFBQSyB3aXRoIGBJS0VfSU5URVJNRURJQVRFYCB8IFJl
bGV2YW50IHRvIGxhcmdlciBQUUMgcGF5bG9hZCBwYXRocyBhbmQgaW50ZXJtZWRpYXRlIGV4Y2hh
bmdlIGJlaGF2aW9yIHwgVHJhbnNjcmlwdCBzdW1tYXJ5LCBmcmFnbWVudGF0aW9uL3JldHJhbnNt
aXNzaW9uIGJlaGF2aW9yLCBuZWdvdGlhdGVkIHRyYW5zZm9ybXMgfAp8IE11bHRpcGxlIGtleSBl
eGNoYW5nZSB8IFJGQyA5MzcwIG11bHRpcGxlIGtleSBleGNoYW5nZSB8IENvcmUgaHlicmlkIGtl
eS1lc3RhYmxpc2htZW50IHBhdGggZm9yIElLRXYyIHwgQURES0UgdHJhbnNmb3JtIHNldCwgc2Vs
ZWN0ZWQgS0VNcywgcmVrZXkvQ1JFQVRFX0NISUxEX1NBIGJlaGF2aW9yIHwKfCBQUUMgYXV0aGVu
dGljYXRpb24gYnkgc2lnbmF0dXJlcyB8IGBkcmFmdC1pZXRmLWlwc2VjbWUtaWtldjItcHFjLWF1
dGhgIHwgUFEgc2lnbmF0dXJlIGF1dGhlbnRpY2F0aW9uIHBhdGggZGlzdGluY3QgZnJvbSBLRU0g
YXV0aCB8IE1MLURTQS9zaWduYXR1cmUgYWxnb3JpdGhtIHVzZWQsIGNlcnRpZmljYXRlIG9yIHJh
dy1rZXkgcGF0aCwgZmFpbHVyZSBkaWFnbm9zdGljcyB8CnwgUFFDIGF1dGhlbnRpY2F0aW9uIGJ5
IEtFTSB8IGBkcmFmdC13YW5nLWlwc2VjbWUta2VtLWF1dGgtaWtldjJgIHwgVXJpJ3MgcmVxdWVz
dGVkIGFkZGl0aW9uOyBkaXN0aW5jdCBLRU0tYmFzZWQgYXV0aGVudGljYXRpb24gbWVjaGFuaXNt
IHwgS0VNLWF1dGggZXhjaGFuZ2UgcGF0aCwgcHVibGljLWtleSBiaW5kaW5nLCBjZXJ0aWZpY2F0
ZSBwcm90ZWN0aW9uIHBhdGgsIGRvd25ncmFkZS9lcnJvciBiZWhhdmlvciB8CnwgTXVsdGktYXV0
aGVudGljYXRpb24gfCBgZHJhZnQtd2FuZy1pcHNlY21lLW11bHRpLWF1dGgtaWtldjItcHFgIHwg
UmVsYXRlZCBkZXNpZ24gc3VyZmFjZSBmb3IgY29tYmluaW5nIGF1dGhlbnRpY2F0aW9uIG1ldGhv
ZHMgfCBOZWdvdGlhdGVkIGF1dGggbWV0aG9kcywgaW50ZXJhY3Rpb24gd2l0aCBSRkMgOTU5MyBh
bm5vdW5jZW1lbnRzLCBzdHJpY3QgZmFpbHVyZSBiZWhhdmlvciB8CnwgVHJhbnNwb3J0IHJvYnVz
dG5lc3MgfCByZWxpYWJsZSBJS0V2MiB0cmFuc3BvcnQgZHJhZnRzIHwgSW1wb3J0YW50IGZvciBs
YXJnZSBQUUMgcGF5bG9hZHMsIHJldHJhbnNtaXNzaW9uLCBhbmQgZmFpbHVyZSByZWNvdmVyeSB8
IFRDUC9VRFAgYmVoYXZpb3IsIGZhbGxiYWNrLCBOQVQgdHJhdmVyc2FsLCBsb2dnaW5nIHwKfCBE
b3duZ3JhZGUgcHJldmVudGlvbiB8IElQc2VjTUUgZG93bmdyYWRlLXByZXZlbnRpb24gd29yayB8
IENyb3NzLWN1dHRpbmcgc2VjdXJpdHkgcHJvcGVydHkgZm9yIGh5YnJpZC9QUUMgbmVnb3RpYXRp
b24gfCBEb3duZ3JhZGUgZGV0ZWN0aW9uIHBhdGgsIGF1dGhlbnRpY2F0ZWQgZmFpbHVyZSwgbG9n
cyBhbmQgcGVlciBkaWFnbm9zdGljcyB8CnwgRGVwbG95bWVudCBwcm9maWxlIHwgQ05TQSAyLjAv
SVBzZWMgcHJvZmlsZSB3b3JrIHwgT3BlcmF0aW9uYWwgcHJvZmlsZSB0YXJnZXQgZm9yIHJlYWwg
ZGVwbG95bWVudHMgfCBQYXJhbWV0ZXIgc2V0LCBjb21wbGlhbmNlIHByb2ZpbGUsIGltcGxlbWVu
dGF0aW9uIHZlcnNpb25zIHwKCiMjIFJlc3VsdCBjb2x1bW5zIGZvciBhbiBpbnRlcm9wIHRhYmxl
CgpSZWNvbW1lbmRlZCBtaW5pbWFsIGNvbHVtbnM6CgotIGltcGxlbWVudGF0aW9uIGFuZCB2ZXJz
aW9uOwotIHBlZXIgaW1wbGVtZW50YXRpb24gYW5kIHZlcnNpb247Ci0gZGVwbG95bWVudCBzaGFw
ZTogc2l0ZS10by1zaXRlLCByZW1vdGUgYWNjZXNzLCBwb2ludC10by1wb2ludCwgbGFiLW9ubHk7
Ci0gbWVjaGFuaXNtIGJ1Y2tldCBhbmQgZXhhY3QgZHJhZnQvUkZDIHJldmlzaW9uOwotIGFsZ29y
aXRobSBzZXQgYWN0dWFsbHkgZXhlcmNpc2VkOwotIHBhdGggY29uZGl0aW9uczogZnJhZ21lbnRh
dGlvbiwgcmV0cmFuc21pc3Npb24sIE5BVCB0cmF2ZXJzYWwsIHJla2V5L0NSRUFURV9DSElMRF9T
QTsKLSBzdWNjZXNzL2ZhaWx1cmUgcmVzdWx0OwotIGV2aWRlbmNlIHR5cGU6IHBhY2tldCB0cmFj
ZSBzdW1tYXJ5LCBuZWdvdGlhdGVkIHRyYW5zZm9ybXMsIGltcGxlbWVudGF0aW9uIGxvZ3MsIGZh
aWx1cmUgY29kZTsKLSBkaXNjbG9zdXJlIGxldmVsOiBwdWJsaWMsIHJlZGFjdGVkIHZlbmRvci1w
cml2YXRlLCBvciBjaGFpci1vbmx5IGlmIG5lZWRlZC4KCiMjIFN0YXJ0ZXIgdGFibGUKClRoaXMg
dGFibGUgaXMgaW50ZW50aW9uYWxseSBzbWFsbC4gIEl0IGlzIG5vdCBhIGNsYWltIG9mIGludGVy
b3BlcmFiaWxpdHk7IGl0IGlzCmEgcGxhY2UgdG8gY29sbGVjdCBjYW5kaWRhdGUgcm93cyBhbmQg
dGhlbiByZXBsYWNlIGludGVudCB3aXRoIG9ic2VydmVkCmV2aWRlbmNlLgoKfCBTdGF0dXMgfCBJ
bXBsZW1lbnRhdGlvbiAvIHBhcnR5IHwgUGVlciB8IERlcGxveW1lbnQgc2hhcGUgfCBNZWNoYW5p
c20gYnVja2V0IHwgQWxnb3JpdGhtIHNldCB8IFBhdGggY29uZGl0aW9ucyB8IEV2aWRlbmNlIHRv
IGF0dGFjaCB8IERpc2Nsb3N1cmUgbGV2ZWwgfAp8IC0tLSB8IC0tLSB8IC0tLSB8IC0tLSB8IC0t
LSB8IC0tLSB8IC0tLSB8IC0tLSB8IC0tLSB8CnwgQ2FuZGlkYXRlIHwgTWljcm9zb2Z0IGltcGxl
bWVudGF0aW9uIHwgVEJEIHwgSVBzZWMgLyBJUHNlYy1iYXNlZCBWUE4gfCBSRkMgOTM3MCwgUFFD
IGF1dGgsIHJlbGlhYmxlIHRyYW5zcG9ydCwgZG93bmdyYWRlIHByZXZlbnRpb24gYXMgYXBwbGlj
YWJsZSB8IFRCRCB8IFRCRCB8IG5lZ290aWF0ZWQgdHJhbnNmb3JtcywgbG9ncywgZmFpbHVyZSBk
aWFnbm9zdGljcyB8IFRCRCB8CnwgQ2FuZGlkYXRlIHwgTkNQIFZQTiBjbGllbnQvc2VydmVyIHwg
VEJEIHwgQ2xpZW50L3NlcnZlciBWUE4gfCBSRkMgOTM3MCwgUkZDIDQ3MzksIFBRIEtFTS9zaWdu
YXR1cmUgYWxnb3JpdGhtcyBhdmFpbGFibGUgdGhyb3VnaCBPcGVuU1NMIHwgTklTVCBQUSBLRU0v
c2lnbmF0dXJlIGFsZ29yaXRobXMsIGV4YWN0IHNldHMgVEJEIHwgUTMgcHJvdG90eXBlOyB0b3Bv
bG9neSBUQkQgfCBpbXBsZW1lbnRhdGlvbiB2ZXJzaW9uLCBwZWVyIHZlcnNpb24sIG5lZ290aWF0
ZWQgdHJhbnNmb3JtcyB8IFB1YmxpYyBzdW1tYXJ5IG9yIHJlZGFjdGVkIHwKfCBDYW5kaWRhdGUg
fCBsaWJyZXN3YW4gLyBzdHJvbmdTd2FuIC8gZWx2aXMtcGx1cyBjb21tdW5pdHkgdGVzdGluZyB8
IE1pY3Jvc29mdC9OQ1Avb3RoZXIgdmVuZG9ycyB8IEhhY2thdGhvbiBvciBiaWxhdGVyYWwgbGFi
IHRlc3QgfCBNZWNoYW5pc20tc3BlY2lmaWMgfCBUQkQgfCBmcmFnbWVudGF0aW9uLCBOQVQgdHJh
dmVyc2FsLCByZWtleSwgZmFpbHVyZSBiZWhhdmlvciB8IHRyYW5zY3JpcHQgc3VtbWFyeSBhbmQg
aW1wbGVtZW50YXRpb24gbG9ncyB8IFB1YmxpYyBzdW1tYXJ5IHdoZXJlIHBvc3NpYmxlIHwKfCBD
YW5kaWRhdGUgfCBQb3N0LVF1YW50dW0gY2xpZW50IHZpYSBOSVNUIE5DQ29FIGNvbnRleHQgfCBN
aWNyb3NvZnQgb3Igb3RoZXIgY29uc29ydGl1bSBwYXJ0aWNpcGFudCB8IFJlbW90ZS1hY2Nlc3Mg
VlBOIHwgTm9uLVBQSyBQUUMgZGVwbG95bWVudDsgZXhhY3QgbWVjaGFuaXNtIFRCRCB8IFRCRCB8
IFRCRCB8IE5DQ29FLWNvbXBhdGlibGUgdGVzdCBub3RlcyBpZiBhdmFpbGFibGUgfCBDb25zb3J0
aXVtL3B1YmxpYyBib3VuZGFyeSBUQkQgfAoKIyMgUm93LWZpbGxpbmcgZGlzY2lwbGluZQoKRWFj
aCByb3cgc2hvdWxkIGlkZW50aWZ5IGV4YWN0bHkgb25lIG1lY2hhbmlzbSBidWNrZXQgb3Igb25l
IGNsZWFybHkgbmFtZWQKcHJvZmlsZSBjb21iaW5hdGlvbi4gIElmIGEgdGVzdCBleGVyY2lzZXMg
Ym90aCBrZXkgZXN0YWJsaXNobWVudCBhbmQKYXV0aGVudGljYXRpb24gY2hhbmdlcywgc3BsaXQg
aXQgaW50byBzZXBhcmF0ZSByb3dzIHVubGVzcyB0aGUgcG9pbnQgb2YgdGhlIHRlc3QKaXMgdGhl
IGludGVyYWN0aW9uIGJldHdlZW4gdGhlbS4KClVzZWZ1bCBldmlkZW5jZSBpcyBtb2Rlc3QgYnV0
IHNwZWNpZmljOgoKLSBuZWdvdGlhdGVkIElLRSB0cmFuc2Zvcm1zIGFuZCByZWxldmFudCBub3Rp
ZnkgcGF5bG9hZHM7Ci0gaW1wbGVtZW50YXRpb24gYW5kIHBlZXIgdmVyc2lvbjsKLSB3aGV0aGVy
IGZyYWdtZW50YXRpb24sIHJldHJhbnNtaXNzaW9uLCBOQVQgdHJhdmVyc2FsLCBhbmQgcmVrZXkg
d2VyZSBleGVyY2lzZWQ7Ci0gcGFzcy9mYWlsIHJlc3VsdCBhbmQgdGhlIGZpcnN0IGRpYWdub3Nh
YmxlIGZhaWx1cmUgcmVhc29uOwotIHdoZXRoZXIgcGFja2V0IGNhcHR1cmVzLCBsb2dzLCBvciBv
bmx5IGEgcHVibGljIHN1bW1hcnkgY2FuIGJlIHNoYXJlZC4KCkF2b2lkIHVzaW5nIHRoZSB0YWJs
ZSBhcyBhIHN0YW5kYXJkcy1zdGF0dXMgY2xhaW0uICBJdCBzaG91bGQgc2hvdyB3aGF0IHdhcwp0
ZXN0ZWQsIG5vdCBpbXBseSB0aGF0IGEgbWVjaGFuaXNtIGlzIGNvbXBsZXRlLCByZWNvbW1lbmRl
ZCwgb3IgaW50ZXJvcGVyYWJsZSBpbgpnZW5lcmFsLgoKIyMgSW1tZWRpYXRlIHJlcGx5IHBvc2l0
aW9uCgpSZXBseSBuYXJyb3dseTogYWNjZXB0IFVyaSdzIGNvcnJlY3Rpb24sIGFkZCB0aGUgS0VN
LWF1dGggZHJhZnQgYXMgYSBzZXBhcmF0ZSBhdXRoZW50aWNhdGlvbiBidWNrZXQsIGFuZCBhdm9p
ZCBpbXBseWluZyB0aGF0IG9uZSBpbnRlcm9wIG1hdHJpeCBjYW4gdmFsaWRhdGUgYWxsIG1lY2hh
bmlzbXMgYXQgb25jZS4gVGhlIHVzZWZ1bCBmaXJzdCBkZWxpdmVyYWJsZSBpcyBhIHN0YXJ0ZXIg
dGFibGUgdGhhdCBsZXRzIGltcGxlbWVudGVycyBhZGQgcm93cyB3aXRob3V0IGV4cG9zaW5nIHNl
bnNpdGl2ZSBkZXBsb3ltZW50IGRldGFpbHMuCg==
--000000000000129b5706550a472a
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gClBxYyBtYWlsaW5nIGxpc3QgLS0gcHFjQGlldGYub3JnClRvIHVuc3Vic2NyaWJlIHNlbmQg
YW4gZW1haWwgdG8gcHFjLWxlYXZlQGlldGYub3JnCg==

--000000000000129b5706550a472a--