<?xml version='1.0' encoding='utf-8'?><?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?><!DOCTYPE rfc [ <!ENTITY nbsp " "> <!ENTITY zwsp "​"> <!ENTITY nbhy "‑"> <!ENTITY wj "⁠"> ]> <!-- generated byhttps://github.com/cabo/kramdown-rfc2629https://github.com/cabo/kramdown-rfc version1.4.141.6.35 (Ruby 3.0.2) --><!DOCTYPE rfc SYSTEM "rfc2629-xhtml.ent"> <?rfc toc="yes"?> <?rfc sortrefs="yes"?> <?rfc symrefs="yes"?><rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" number="9380" docName="draft-irtf-cfrg-hash-to-curve-16" category="info"obsoletes="" updates="" submissionType="IETF"submissionType="IRTF" consensus="true" xml:lang="en" tocInclude="true" sortRefs="true" symRefs="true" version="3"> <!-- xml2rfc v2v3 conversion2.42.03.17.4 --> <front><title abbrev="hash-to-curve">Hashing<title>Hashing to Elliptic Curves</title> <seriesInfoname="Internet-Draft" value="draft-irtf-cfrg-hash-to-curve-16"/>name="RFC" value="9380"/> <author initials="A." surname="Faz-Hernandez" fullname="Armando Faz-Hernandez"> <organization>Cloudflare, Inc.</organization> <address> <postal> <street>101 Townsend St</street> <city>San Francisco</city> <region>CA</region> <code>94107</code> <country>United States of America</country> </postal> <email>armfazh@cloudflare.com</email> </address> </author> <author initials="S." surname="Scott" fullname="Sam Scott"><organization>Cornell Tech</organization><organization>Oso Security, Inc.</organization> <address> <postal><street>2 West Loop Rd</street><street>335 Madison Ave</street> <city>NewYork, New York 10044</city>York</city> <region>NY</region> <code>10017</code> <country>United States of America</country> </postal><email>sam.scott@cornell.edu</email><email>sam.scott89@gmail.com</email> </address> </author> <author initials="N." surname="Sullivan" fullname="Nick Sullivan"> <organization>Cloudflare, Inc.</organization> <address> <postal> <street>101 Townsend St</street> <city>San Francisco</city> <region>CA</region> <code>94107</code> <country>United States of America</country> </postal><email>nick@cloudflare.com</email><email>nicholas.sullivan@gmail.com</email> </address> </author> <authorinitials="R.S."initials="R. S." surname="Wahby" fullname="Riad S. Wahby"> <organization>Stanford University</organization> <address> <email>rsw@cs.stanford.edu</email> </address> </author> <authorinitials="C.A."initials="C. A." surname="Wood" fullname="Christopher A. Wood"> <organization>Cloudflare, Inc.</organization> <address> <postal> <street>101 Townsend St</street> <city>San Francisco</city> <region>CA</region> <code>94107</code> <country>United States of America</country> </postal> <email>caw@heapingbits.net</email> </address> </author> <dateyear="2022" month="June" day="15"/> <workgroup>CFRG</workgroup> <keyword>Internet-Draft</keyword>year="2023" month="August"/> <workgroup>Crypto Forum</workgroup> <abstract> <?line 1121?> <t>This document specifies a number of algorithms for encoding or hashing an arbitrary string to a point on an elliptic curve. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.</t> </abstract><note removeInRFC="true"> <name>Discussion Venues</name> <t>Discussion of this document takes place on the Crypto Forum Research Group mailing list (cfrg@ietf.org), which is archived at <eref target="https://mailarchive.ietf.org/arch/search/?email_list=cfrg"/>.</t> <t>Source for this draft and an issue tracker can be found at <eref target="https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve"/>.</t> </note></front> <middle> <?line 1127?> <sectionanchor="introduction" numbered="true" toc="default">anchor="introduction"> <name>Introduction</name> <t>Many cryptographic protocols require a procedure that encodes an arbitrary input, e.g., a password, to a point on an elliptic curve. This procedure is known as hashing to an elliptic curve, where the hashing procedure provides collision resistance and does not reveal the discrete logarithm of the output point. Prominent examples of cryptosystems that hash to elliptic curves include password-authenticated key exchanges <xreftarget="BM92" format="default"/>target="BM92"/> <xreftarget="J96" format="default"/>target="J96"/> <xreftarget="BMP00" format="default"/>target="BMP00"/> <xreftarget="p1363.2" format="default"/>,target="p1363.2"/>, Identity-Based Encryption <xreftarget="BF01" format="default"/>,target="BF01"/>, Boneh-Lynn-Shacham signatures <xreftarget="BLS01" format="default"/>target="BLS01"/> <xreftarget="I-D.irtf-cfrg-bls-signature" format="default"/>,target="I-D.irtf-cfrg-bls-signature"/>, Verifiable Random Functions <xreftarget="MRV99" format="default"/>target="MRV99"/> <xreftarget="I-D.irtf-cfrg-vrf" format="default"/>,target="I-D.irtf-cfrg-vrf"/>, and Oblivious Pseudorandom Functions <xreftarget="NR97" format="default"/>target="NR97"/> <xreftarget="I-D.irtf-cfrg-voprf" format="default"/>.</t>target="I-D.irtf-cfrg-voprf"/>.</t> <t>Unfortunately for implementors, the precise hash function that is suitable for a given protocol implemented using a given elliptic curve is often unclear from the protocol's description. Meanwhile, an incorrect choice of hash function can have disastrous consequences for security.</t> <t>This document aims to bridge this gap by providing a comprehensive set of recommended algorithms for a range of curve types. Each algorithm conforms to a common interface: it takes as input an arbitrary-length byte string and produces as output a point on an elliptic curve. We provide implementation details for each algorithm, describe the security rationale behind each recommendation, and give guidance for elliptic curves that are not explicitly covered. We also present optimized implementations for internal functions used by these algorithms.</t> <t>Readers wishing to quickly specify or implement a conforming hash function should consult <xreftarget="suites" format="default"/>,target="suites"/>, which lists recommended hash-to-curve suites and describes both how to implement an existing suite and how to specify a new one.</t> <t>This document does notcoverspecify probabilistic rejection sampling methods, sometimes referred to as "try-and-increment" or "hunt-and-peck," because the goal is todescribespecify algorithms that can plausibly be computed in constant time. Use of these probabilistic rejection methods isNOT RECOMMENDED,<bcp14>NOT RECOMMENDED</bcp14>, because they have been a perennial cause of side-channel vulnerabilities. See Dragonblood <xreftarget="VR20" format="default"/>target="VR20"/> as one example of this problem in practice, and see <xreftarget="related" format="default"/>target="related"/> fora furtheran informal description of rejection samplingmethods.</t>methods and the timing side-channels they introduce.</t> <t>This document represents the consensus of the Crypto Forum Research Group (CFRG).</t> <sectionanchor="requirements-notation" numbered="true" toc="default">anchor="requirements-notation"> <name>Requirements Notation</name> <t>The key words"MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY","<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>", "<bcp14>MAY</bcp14>", and"OPTIONAL""<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as described inBCP 14BCP 14 <xreftarget="RFC2119" format="default"/>target="RFC2119"/> <xreftarget="RFC8174" format="default"/>target="RFC8174"/> when, and only when, they appear in all capitals, as shown here.</t> <?line -18?> </section> </section> <sectionanchor="background" numbered="true" toc="default">anchor="background"> <name>Background</name> <sectionanchor="bg-curves" numbered="true" toc="default">anchor="bg-curves"> <name>Ellipticcurves</name>Curves</name> <t>The following is a brief definition of elliptic curves, with an emphasis on important parameters and their relation to hashing to curves. For further reference on elliptic curves, consult <xreftarget="CFADLNV05" format="default"/>target="CFADLNV05"/> or <xreftarget="W08" format="default"/>.</t>target="W08"/>.</t> <t>Let F be the finite field GF(q) of prime characteristic p > 3. (This document does not consider elliptic curves over fields of characteristic 2 or 3.) In mostcasescases, F is a prime field, so q = p. Otherwise, F is an extension field, so q = p^m for an integer m > 1. This document writes elements of extension fields in a primitive element or polynomial basis, i.e., as a vector of m elements of GF(p) written in ascending order by degree. The entries of this vector are indexed in ascending order starting from 1, i.e., x = (x_1, x_2, ..., x_m). For example, if q = p^2 and the primitive element basis is (1, I), then x = (a, b) corresponds to the element a + b * I, where x_1 = a and x_2 = b. (Note that all choices of basis are isomorphic, but certain choices may result in a more efficient implementation; this document does not make any particular assumptions about choice of basis.)</t> <t>An elliptic curve E is specified by an equation in two variables and a finite field F. An elliptic curve equation takes one of several standard forms, including (but not limited to) Weierstrass, Montgomery, and Edwards.</t> <t>The curve E induces an algebraic group of order n, meaning that the group has n distinct elements. (This document uses additive notation for the elliptic curve group operation.) Elements of an elliptic curve group are points with affine coordinates (x, y) satisfying the curve equation, where x and y are elements of F. In addition, all elliptic curve groups have a distinguished element, the identity point, which acts as the identity element for the group operation. On certain curves (including Weierstrass and Montgomery curves), the identity point cannot be represented as an (x, y) coordinate pair.</t> <t>For security reasons, cryptographicusesapplications of elliptic curves generally require using a (sub)group of prime order. Let G be such a subgroup of the curve of prime order r, where n = h * r. In this equation, h is an integer called the cofactor. An algorithm that takes as input an arbitrary point on the curve E and produces as output a point in the subgroup G of E is said to "clear the cofactor." Such algorithms are discussed in <xreftarget="cofactor-clearing" format="default"/>.</t>target="cofactor-clearing"/>.</t> <t>Certain hash-to-curve algorithms restrict the form of the curve equation, the characteristic of the field, or the parameters of the curve. For each algorithm presented, this document lists the relevant restrictions.</t> <t>The table below summarizes quantities relevant to hashing to curves:</t> <tableanchor="definition-table" align="center">anchor="definition-table"> <name>Summary ofsymbolsSymbols andtheir definitions.</name>Their Definitions</name> <thead> <tr> <th align="center">Symbol</th> <th align="left">Meaning</th> <th align="left">Relevance</th> </tr> </thead> <tbody> <tr> <td align="center">F,q,p</td> <td align="left">A finite field F of characteristic p and #F = q = p^m.</td> <td align="left">For prime fields,q = p;q = p; otherwise,q = p^mq = p^m and m>1.</td> </tr> <tr> <td align="center">E</td> <td align="left">Elliptic curve.</td> <td align="left">E is specified by an equation and a field F.</td> </tr> <tr> <td align="center">n</td> <td align="left">Number of points on the elliptic curve E.</td> <td align="left">n = h * r, for h and r defined below.</td> </tr> <tr> <td align="center">G</td> <td align="left">A prime-order subgroup of the points on E.</td> <tdalign="left">Destinationalign="left">G is a destination group to which byte strings are encoded.</td> </tr> <tr> <td align="center">r</td> <td align="left">Order of G.</td> <td align="left">r is a prime factor of n (usually, the largest such factor).</td> </tr> <tr> <td align="center">h</td> <td align="left">Cofactor, h >= 1.</td> <tdalign="left">Analign="left">h is an integer satisfying n = h * r.</td> </tr> </tbody> </table> </section> <sectionanchor="terminology" numbered="true" toc="default">anchor="terminology"> <name>Terminology</name> <t>In this section, we define important terms used throughout the document.</t> <sectionanchor="term-mapping" numbered="true" toc="default">anchor="term-mapping"> <name>Mappings</name> <t>A mapping is a deterministic function from an element of the field F to a point on an elliptic curve E defined over F.</t> <t>In general, the set of all points that a mapping can produce over all possible inputs may be only a subset of the points on an elliptic curve (i.e., the mapping may not be surjective). In addition, a mapping may output the same point for two or more distinct inputs (i.e., the mapping may not be injective). For example, consider a mapping from F to an elliptic curve having n points: if the number of elements of F is not equal to n, then this mapping cannot be bijective (i.e., both injective andsurjective)surjective), since the mapping is defined to be deterministic.</t> <t>Mappings may also be invertible, meaning that there is an efficient algorithm that, for any point P output by the mapping, outputs an x in F such that applying the mapping to x outputs P. Some of the mappings given in <xreftarget="mappings" format="default"/>target="mappings"/> are invertible, but this document does not discuss inversion algorithms.</t> </section> <sectionanchor="term-encoding" numbered="true" toc="default">anchor="term-encoding"> <name>Encodings</name> <t>Encodings are closely related to mappings. Like a mapping, an encoding is a function that outputs a point on an elliptic curve. In contrast to a mapping, however, the input to an encoding is an arbitrary-length byte string.</t> <t>This document constructs deterministic encodings by composing a hash function Hf with a deterministic mapping. In particular, Hf takes as input an arbitrary string and outputs an element of F. The deterministic mapping takes that element as input and outputs a point on an elliptic curve E defined over F. Since Hf takes arbitrary-length byte strings as inputs, it cannot be injective: the set of inputs is larger than the set of outputs, so there must be distinct inputs that give the same output (i.e., there must be collisions). Thus, any encoding built from Hf is also not injective.</t> <t>Like mappings, encodings may be invertible, meaning that there is an efficient algorithm that, for any point P output by the encoding, outputs a string s such that applying the encoding to s outputs P.TheHowever, the instantiation of Hf used by all encodings specified in this document (<xreftarget="hashtofield" format="default"/>)target="hashtofield"/>) is notinvertible. Thus, theinvertible; thus, those encodings are also not invertible.</t> <t>In some applications of hashing to elliptic curves, it is important that encodings do not leak information through side channels. <xreftarget="VR20" format="default"/>target="VR20"/> is one example of this type of leakage leading to a security vulnerability. See <xreftarget="security-considerations-constant" format="default"/>target="security-considerations-constant"/> for further discussion.</t> </section> <sectionanchor="term-rom" numbered="true" toc="default">anchor="term-rom"> <name>Randomoracle encodings</name>Oracle Encodings</name> <t>A random-oracle encoding satisfies a strong property: it can be proved indifferentiable from a random oracle <xreftarget="MRH04" format="default"/>target="MRH04"/> under a suitable assumption.</t> <t>Both constructions described in <xreftarget="roadmap" format="default"/>target="roadmap"/> are indifferentiable from random oracles <xreftarget="MRH04" format="default"/>target="MRH04"/> when instantiated following the guidelines in this document. The constructions differ in their output distributions: one gives a uniformly random point on the curve, the other gives a point sampled from a nonuniform distribution.</t> <t>A random-oracle encoding with a uniform output distribution is suitable for use in many cryptographic protocols proven secure in therandom oraclerandom-oracle model. See <xreftarget="security-considerations-props" format="default"/>target="security-considerations-props"/> for further discussion.</t> </section> <sectionanchor="term-serialization" numbered="true" toc="default">anchor="term-serialization"> <name>Serialization</name> <t>A procedure related to encoding is the conversion of an elliptic curve point to a bit string. This is called serialization, and it is typically used for compactly storing or transmitting points. The inverse operation, deserialization, converts a bit string to an elliptic curve point. For example, <xreftarget="SEC1" format="default"/>target="SEC1"/> and <xreftarget="p1363a" format="default"/>target="p1363a"/> give standard methods for serialization and deserialization.</t> <t>Deserialization is different from encoding in that only certain strings (namely, those output by the serialization procedure) can be deserialized. In contrast, this document is concerned with encodings from arbitrary strings to elliptic curve points. This document does not cover serialization or deserialization.</t> </section> <sectionanchor="term-domain-separation" numbered="true" toc="default">anchor="term-domain-separation"> <name>Domainseparation</name>Separation</name> <t>Cryptographic protocols proven secure in therandom oraclerandom-oracle model are often analyzed under the assumption that the random oracle only answers queries associated with that protocol (including queries made by adversaries) <xreftarget="BR93" format="default"/>.target="BR93"/>. In practice, this assumption does not hold if two protocols use the same function to instantiate the random oracle. Concretely, consider protocols P1 and P2 that query arandom oraclerandom-oracle RO: if P1 and P2 both query RO on the same value x, the security analysis of one or both protocols may be invalidated.</t> <t>A common way of addressing this issue is called domain separation, which allows a single random oracle to simulate multiple, independent oracles. This is effected by ensuring that each simulated oracle sees queries that are distinct from those seen by all other simulated oracles. For example, to simulate two oracles RO1 and RO2 given a single oracle RO, one might define</t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ RO1(x) := RO("RO1" || x) RO2(x) := RO("RO2" || x) ]]></artwork> <t>where || is the concatenation operator. In this example, "RO1" and "RO2" are called domain separationtags;tags (DSTs); they ensure that queries to RO1 and RO2 cannot result in identical queries to RO, meaning that it is safe to treat RO1 and RO2 as independent oracles.</t> <t>In general, domain separation requires defining a distinct injective encoding for each oracle being simulated. In the above example, "RO1" and "RO2" have the same length and thus satisfy this requirement when used as prefixes. The algorithms specified in this document take a different approach to ensuring injectivity; see Sections <xreftarget="hashtofield-expand" format="default"/>format="counter" target="hashtofield-expand"/> and <xreftarget="security-considerations-domain-separation-expmsg-var" format="default"/>format="counter" target="security-considerations-domain-separation-expmsg-var"/> for more details.</t> </section> </section> </section> <sectionanchor="roadmap" numbered="true" toc="default">anchor="roadmap"> <name>Encodingbyte stringsByte Strings toelliptic curves</name>Elliptic Curves</name> <t>This section presents a general framework and interface for encoding byte strings to points on an elliptic curve. The constructions in this section rely on three basic functions:</t> <ul spacing="normal"> <li> <t>The function hash_to_field hashes arbitrary-length byte strings to a list of one or more elements of a finite field F; its implementation is defined in <xreftarget="hashtofield" format="default"/>.target="hashtofield"/>. </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ hash_to_field(msg, count)Inputs:Input: - msg, a byte string containing the message to hash. - count, the number of elements of F to output.Outputs:Output: - (u_0, ..., u_(count - 1)), a list of field elements. Steps: defined in Section 5.</sourcecode>]]></sourcecode> </li> <li> <t>The function map_to_curve calculates a point on the elliptic curve E from an element of the finite field F over which E is defined. <xreftarget="mappings" format="default"/>target="mappings"/> describes mappings for a range of curve families. </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve(u) Input: u, an element of field F. Output: Q, a point on the elliptic curve E. Steps: defined in Section 6.</sourcecode>]]></sourcecode> </li> <li> <t>The function clear_cofactor sends any point on the curve E to the subgroup G of E. <xreftarget="cofactor-clearing" format="default"/>target="cofactor-clearing"/> describes methods to perform this operation. </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ clear_cofactor(Q) Input: Q, a point on the elliptic curve E. Output: P, a point in G. Steps: defined in Section 7.</sourcecode>]]></sourcecode> </li> </ul> <t>The two encodings (<xreftarget="term-encoding" format="default"/>)target="term-encoding"/>) defined in this section have the same interface and are both random-oracle encodings (<xreftarget="term-rom" format="default"/>).target="term-rom"/>). Both are implemented as a composition of the three basic functions above. The difference between the two is that their outputs are sampled from different distributions:</t> <ul spacing="normal"> <li> <t>encode_to_curve is a nonuniform encoding from byte strings to points in G. That is, the distribution of its output is not uniformly random in G: the set of possible outputs of encode_to_curve is only a fraction of the points in G, and some points in this set are more likely to be output than others. <xreftarget="security-considerations-encode" format="default"/>target="security-considerations-encode"/> gives a more precise definition of encode_to_curve's output distribution. </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ encode_to_curve(msg) Input: msg, an arbitrary-length byte string. Output: P, a point in G. Steps: 1. u = hash_to_field(msg, 1) 2. Q = map_to_curve(u[0]) 3. P = clear_cofactor(Q) 4. return P</sourcecode>]]></sourcecode> </li> <li> <t>hash_to_curve is a uniform encoding from byte strings to points in G. That is, the distribution of its output is statistically close to uniform in G. </t> <t> This function is suitable for most applications requiring a random oracle returning points in G, when instantiated with any of the map_to_curve functions described in <xreftarget="mappings" format="default"/>.target="mappings"/>. See <xreftarget="security-considerations-props" format="default"/>target="security-considerations-props"/> for further discussion. </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ hash_to_curve(msg) Input: msg, an arbitrary-length byte string. Output: P, a point in G. Steps: 1. u = hash_to_field(msg, 2) 2. Q0 = map_to_curve(u[0]) 3. Q1 = map_to_curve(u[1]) 4. R = Q0 + Q1 # Point addition 5. P = clear_cofactor(R) 6. return P</sourcecode>]]></sourcecode> </li> </ul> <t>Each hash-to-curve suite in <xreftarget="suites" format="default"/>target="suites"/> instantiates one of these encoding functions for aspecifcspecific elliptic curve.</t> <sectionanchor="domain-separation" numbered="true" toc="default">anchor="domain-separation"> <name>Domainseparation requirements</name>Separation Requirements</name> <t>All uses of the encoding functions defined in this documentMUST<bcp14>MUST</bcp14> include domain separation (<xreftarget="term-domain-separation" format="default"/>)target="term-domain-separation"/>) to avoid interfering with other uses of similar functionality.</t> <t>Applications that instantiate multiple, independent instances of either hash_to_curve or encode_to_curveMUST<bcp14>MUST</bcp14> enforce domain separation between those instances. This requirement appliesbothin both the case of multiple instances targeting the same curve andinthe case of multiple instances targeting different curves. (This is because the internal hash_to_field primitive (<xreftarget="hashtofield" format="default"/>)target="hashtofield"/>) requires domain separation to guarantee independent outputs.)</t> <t>Domain separation is enforced with a domain separation tag (DST), which is a byte string constructed according to the following requirements:</t> <ol spacing="normal"type="1"> <li>Tags MUSTtype="1"><li>Tags <bcp14>MUST</bcp14> be supplied as the DST parameter to hash_to_field, as described in <xreftarget="hashtofield" format="default"/>.</li>target="hashtofield"/>.</li> <li>TagsMUST<bcp14>MUST</bcp14> have nonzero length. A minimum length of 16 bytes isRECOMMENDED<bcp14>RECOMMENDED</bcp14> to reduce the chance of collisions with other applications.</li> <li>TagsSHOULD<bcp14>SHOULD</bcp14> begin with a fixed identification string that is unique to the application.</li> <li>TagsSHOULD<bcp14>SHOULD</bcp14> include a version number.</li> <li>For applications that define multiple ciphersuites, each ciphersuite's tagMUST<bcp14>MUST</bcp14> be different. For this purpose, it isRECOMMENDED<bcp14>RECOMMENDED</bcp14> to include a ciphersuite identifier in each tag.</li> <li>For applications that use multiple encodings,eitherto either the same curve ortodifferent curves, each encodingMUST<bcp14>MUST</bcp14> use a different tag. For this purpose, it isRECOMMENDED<bcp14>RECOMMENDED</bcp14> to include the encoding's Suite ID (<xreftarget="suites" format="default"/>)target="suites"/>) in the domain separation tag. For independent encodings based on the same suite, each tagSHOULD<bcp14>SHOULD</bcp14> also include a distinct identifier, e.g., "ENC1" and "ENC2".</li> </ol> <t>As an example, consider a fictional application named Quux that defines several different ciphersuites, each for a different curve. A reasonable choice of tag is "QUUX-V<xx>-CS<yy>-<suiteID>", where <xx> and <yy> are two-digit numbers indicating the version and ciphersuite, respectively, and <suiteID> is the Suite ID of the encoding used in ciphersuite <yy>.</t> <t>As another example, consider a fictional application named Baz that requires two independent random oracles to the same curve. Reasonable choices of tags for these oracles are "BAZ-V<xx>-CS<yy>-<suiteID>-ENC1" and "BAZ-V<xx>-CS<yy>-<suiteID>-ENC2", respectively, where <xx>, <yy>, and <suiteID> are as described above.</t> <t>The example tags given above are assumed to be ASCII-encoded byte strings without null termination, which is theRECOMMENDED<bcp14>RECOMMENDED</bcp14> format. Other encodings can be used, but in all cases the encoding as a sequence of bytesMUST<bcp14>MUST</bcp14> be specified unambiguously.</t> </section> </section> <sectionanchor="utility" numbered="true" toc="default">anchor="utility"> <name>Utilityfunctions</name>Functions</name> <t>Algorithms in this document use the utility functions described below, plus standard arithmetic operations (addition, multiplication, modular reduction, etc.) and elliptic curve point operations (point addition and scalar multiplication).</t> <t>For security, implementations of these functionsSHOULD<bcp14>SHOULD</bcp14> be constant time: in brief, this means that execution time and memory access patternsSHOULD NOT<bcp14>SHOULD NOT</bcp14> depend on the values of secret inputs, intermediate values, or outputs. For such constant-time implementations, all arithmetic, comparisons, and assignmentsMUST<bcp14>MUST</bcp14> also be implemented in constant time. <xreftarget="security-considerations-constant" format="default"/>target="security-considerations-constant"/> briefly discusses constant-time security issues.</t> <t>Guidance on implementing low-level operations (in constant time or otherwise) is beyond the scope of this document; readers should consult standard reference material <xreftarget="MOV96" format="default"/>target="MOV96"/> <xreftarget="CFADLNV05" format="default"/>.</t>target="CFADLNV05"/>.</t> <ul spacing="normal"> <li>CMOV(a, b, c): If c is False, CMOV returnsa, otherwisea; otherwise, it returns b. For constant-time implementations, this operation must run in a time that is independent of the value of c.</li> <li>AND, OR, NOT, and XOR are standard bitwise logical operators. For constant-time implementations, short-circuit operatorsMUST<bcp14>MUST</bcp14> be avoided.</li> <li> <t>is_square(x): This function returns True whenever the value x is a square in the field F. By Euler's criterion, this function can be calculated in constant time as </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ is_square(x) := { True, if x^((q - 1) / 2) is 0 or 1 in F; { False, otherwise.</sourcecode>]]></sourcecode> <t> In certain extension fields, is_square can be computed in constant time more quickly than by the above exponentiation. <xreftarget="AR13" format="default"/>target="AR13"/> and <xreftarget="S85" format="default"/>target="S85"/> describe optimized methods for extension fields. <xreftarget="appx-sqrt-issq" format="default"/>target="appx-sqrt-issq"/> gives an optimized straight-line method for GF(p^2).</t> </li> <li> <t>sqrt(x): The sqrt operation is a multi-valued function, i.e., there exist two roots of x in the field F whenever x is square (except when x = 0). To maintain compatibility across implementations while allowing implementors leeway for optimizations, this document does not require sqrt() to return a particular value. Instead, as explained in <xreftarget="point-sign" format="default"/>,target="point-sign"/>, any function that calls sqrt also specifies how to determine the correct root. </t> <t> The preferred way of computing square roots is to fix a deterministic algorithm particular to F. We give several algorithms in <xreftarget="appx-sqrt" format="default"/>.</t>target="appx-sqrt"/>.</t> </li> <li>sgn0(x): This function returns either 0 or 1 indicating the "sign" of x, where sgn0(x) == 1 just when x is "negative". (In other words, this function always considers 0 to be positive.) <xreftarget="sgn0-function" format="default"/>target="sgn0-function"/> defines this function and discusses its implementation.</li> <li> <t>inv0(x): This function returns the multiplicative inverse of x in F, extended to all of F by fixing inv0(0) == 0. A straightforward way to implement inv0 in constant time is to compute </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ inv0(x) := x^(q - 2).</sourcecode>]]></sourcecode> <t> Notice that on input 0, the output is 0 as required. Certain fields may allow faster inversion methods; detailed discussion of such methods is beyond the scope of this document.</t> </li> <li>I2OSP and OS2IP: These functions are used to convert a byte string to and from a non-negative integer as described in <xreftarget="RFC8017" format="default"/>.target="RFC8017"/>. (Note that these functions operate on byte strings in big-endian byte order.)</li> <li>a || b: denotes the concatenation of byte strings a and b. For example, "ABC" || "DEF" == "ABCDEF".</li> <li>substr(str, sbegin, slen):forFor a byte string str, this function returns the slen-byte substring starting at position sbegin; positions are zero indexed. For example, substr("ABCDEFG", 2, 3) == "CDE".</li> <li>len(str):forFor a byte string str, this function returns the length of str in bytes. For example, len("ABC") == 3.</li> <li>strxor(str1, str2):forFor byte strings str1 and str2, strxor(str1, str2) returns the bitwise XOR of the two strings. For example, strxor("abc", "XYZ") == "9;9" (the strings in this example are ASCII literals, but strxor is defined for arbitrary byte strings). In this document, strxor is only applied to inputs of equal length.</li> </ul> <sectionanchor="sgn0-function" numbered="true" toc="default">anchor="sgn0-function"> <name>The sgn0function</name>Function</name> <t>This section defines a generic sgn0 implementation that applies to any field F = GF(p^m). It also gives simplified implementations for the cases F = GF(p) and F = GF(p^2).</t> <t>The definition of the sgn0 function for extension fields relies on the polynomial basis or vector representation of field elements, and iterates over the entire vector representation of the input element. As a result, sgn0 depends on the primitive polynomial used to define the polynomial basis; see <xreftarget="suites" format="default"/>target="suites"/> for more information about this basis, and see <xreftarget="bg-curves" format="default"/>target="bg-curves"/> for a discussion of representing elements of extension fields as vectors.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sgn0(x) Parameters: - F, a finite field of characteristic p and order q = p^m. - p, the characteristic of F (see immediately above). - m, the extension degree of F, m>=>= 1 (see immediately above). Input: x, an element of F. Output: 0 or 1. Steps: 1. sign = 0 2. zero = 1 3. for i in (1, 2, ..., m): 4. sign_i = x_i mod 2 5. zero_i = x_i == 0 6. sign = sign OR (zero AND sign_i) # Avoid short-circuit logic ops 7. zero = zero AND zero_i 8. return sign</sourcecode>]]></sourcecode> <t>When m == 1, sgn0 can be significantly simplified:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sgn0_m_eq_1(x) Input: x, an element of GF(p). Output: 0 or 1. Steps: 1. return x mod 2</sourcecode>]]></sourcecode> <t>The case m == 2 is only slightly more complicated:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sgn0_m_eq_2(x) Input: x, an element of GF(p^2). Output: 0 or 1. Steps: 1. sign_0 = x_0 mod 2 2. zero_0 = x_0 == 0 3. sign_1 = x_1 mod 2 4. s = sign_0 OR (zero_0 AND sign_1) # Avoid short-circuit logic ops 5. return s</sourcecode>]]></sourcecode> </section> </section> <sectionanchor="hashtofield" numbered="true" toc="default">anchor="hashtofield"> <name>Hashing to afinite field</name>Finite Field</name> <t>The hash_to_field function hashes a byte string msg of arbitrary length into one or more elements of a field F. This function works in two steps: it first hashes the input byte string to produce a uniformly random byte string, and then interprets this byte string as one or more elements of F.</t> <t>For the first step, hash_to_field calls an auxiliary function expand_message. This document defines two variants of expand_message: one appropriate for hash functions like SHA-2 <xreftarget="FIPS180-4" format="default"/>target="FIPS180-4"/> or SHA-3 <xreftarget="FIPS202" format="default"/>,target="FIPS202"/>, and another appropriate for extendable-output functions such as SHAKE128 <xreftarget="FIPS202" format="default"/>.target="FIPS202"/>. Security considerations for each expand_message variant are discussed below(<xref target="hashtofield-expand-xmd" format="default"/>,(Sections <xref format="counter" target="hashtofield-expand-xmd"/> and <xreftarget="hashtofield-expand-xof" format="default"/>).</t>format="counter" target="hashtofield-expand-xof"/>).</t> <t>ImplementorsMUST NOT<bcp14>MUST NOT</bcp14> use rejection sampling to generate a uniformly random element of F, to ensure that the hash_to_field function is amenable to constant-time implementation. The reason is that rejection sampling procedures are difficult to implement in constant time, and later well-meaning "optimizations" may silently render an implementation non-constant-time. This means that any hash_to_field function based on rejection sampling would be incompatible with constant-time implementation.</t> <t>The hash_to_field function is also suitable for securely hashing to scalars. For example, when hashing to the scalar field for an elliptic curve (sub)group with prime order r, it suffices to instantiate hash_to_field with target field GF(r).</t> <t>The hash_to_field function is designed to be indifferentiable from a random oracle <xreftarget="MRH04" format="default"/>target="MRH04"/> when expand_message (<xreftarget="hashtofield-expand" format="default"/>)target="hashtofield-expand"/>) is modeled as a random oracle (see <xreftarget="security-considerations-hash-to-field" format="default"/>target="security-considerations-hash-to-field"/> for details about its indifferentiability). Ensuring indifferentiability requires care; to see why, consider a prime p that is close to 3/4 * 2^256. Reducing a random 256-bit integer modulo this p yields a value that is in the range [0, p / 3] with probability roughly 1/2, meaning that this value is statistically far from uniform in [0, p - 1].</t> <t>To control bias, hash_to_field instead uses random integers whose length is at least ceil(log2(p)) + k bits, where k is the target security level for the suite in bits. Reducing such integers mod p gives bias at most 2^-k for any p; this bias is appropriate when targeting k-bit security. For each such integer, hash_to_field uses expand_message to obtain L uniform bytes, where</t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ L = ceil((ceil(log2(p)) + k) / 8) ]]></artwork> <t>These uniform bytes are then interpreted as an integer via OS2IP. For example, for a 255-bit prime p, and k = 128-bit security, L = ceil((255 + 128) / 8) = 48 bytes.</t> <t>Note that k is an upper bound on the security level for the corresponding curve. See <xreftarget="security-considerations-targets" format="default"/>target="security-considerations-targets"/> for moredetails,details and <xreftarget="new-suite" format="default"/>target="new-suite"/> for guidelines on choosing k for a given curve.</t> <sectionanchor="hashtofield-exteff" numbered="true" toc="default">anchor="hashtofield-exteff"> <name>EfficiencyconsiderationsConsiderations inextension fields</name>Extension Fields</name> <t>The hash_to_field function described in this section is inefficient for certain extension fields. Specifically, when hashing to an element of the extension field GF(p^m), hash_to_field requires expanding msg into m * L bytes (for L as defined above). For extension fields where log2(p) is significantly smaller than the security level k, this approach is inefficient: it requires expand_message to output roughly m * log2(p) + m * k bits, whereas m * log2(p) + k bytes suffices to generate an element of GF(p^m) with bias at most 2^-k. In such cases, applicationsMAY<bcp14>MAY</bcp14> use an alternative hash_to_field function, provided it meets the following security requirements:</t> <ul spacing="normal"> <li>The functionMUST<bcp14>MUST</bcp14> output one or more fieldelement(s)elements that are uniformly random except with bias at most 2^-k.</li> <li>The functionMUST NOT<bcp14>MUST NOT</bcp14> use rejection sampling.</li> <li>The functionSHOULD<bcp14>SHOULD</bcp14> be amenable tostraight linestraight-line implementations.</li> </ul> <t>For example, Pornin <xreftarget="P20" format="default"/>target="P20"/> describes a method for hashing to GF(9767^19) that meets these requirements while using fewer output bits from expand_message than hash_to_field would for that field.</t> </section> <sectionanchor="hashtofield-impl" numbered="true" toc="default">anchor="hashtofield-impl"> <name>hash_to_fieldimplementation</name>Implementation</name> <t>The following procedure implements hash_to_field.</t> <t>The expand_message parameter to this functionMUST<bcp14>MUST</bcp14> conform to the requirements given in <xreftarget="hashtofield-expand" format="default"/>.target="hashtofield-expand"/>. <xreftarget="domain-separation" format="default"/>target="domain-separation"/> discusses theREQUIRED<bcp14>REQUIRED</bcp14> method for constructing DST, the domain separation tag. Note that hash_to_field may fail(abort)(ABORT) if expand_message fails.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ hash_to_field(msg, count) Parameters: - DST, a domain separation tag (see Section 3.1). - F, a finite field of characteristic p and order q = p^m. - p, the characteristic of F (see immediately above). - m, the extension degree of F, m>=>= 1 (see immediately above). - L = ceil((ceil(log2(p)) + k) / 8), where k is the security parameter of the suite (e.g., k = 128). - expand_message, a function that expands a byte string and domain separation tag into a uniformly random byte string (see Section 5.3).Inputs:Input: - msg, a byte string containing the message to hash. - count, the number of elements of F to output.Outputs:Output: - (u_0, ..., u_(count - 1)), a list of field elements. Steps: 1. len_in_bytes = count * m * L 2. uniform_bytes = expand_message(msg, DST, len_in_bytes) 3. for i in (0, ..., count - 1): 4. for j in (0, ..., m - 1): 5. elm_offset = L * (j + i * m) 6. tv = substr(uniform_bytes, elm_offset, L) 7. e_j = OS2IP(tv) mod p 8. u_i = (e_0, ..., e_(m - 1)) 9. return (u_0, ..., u_(count - 1))</sourcecode>]]></sourcecode> </section> <sectionanchor="hashtofield-expand" numbered="true" toc="default">anchor="hashtofield-expand"> <name>expand_message</name> <t>expand_message is a function that generates a uniformly random byte string. It takes three arguments:</t> <ol spacing="normal"type="1"> <li>msg,type="1"><li>msg, a byte string containing the message to hash,</li> <li>DST, a byte string that acts as a domain separation tag, and</li> <li>len_in_bytes, the number of bytes to be generated.</li> </ol> <t>This document defines the following two variants of expand_message:</t> <ul spacing="normal"> <li>expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)target="hashtofield-expand-xmd"/>) is appropriate for use with a wide range of hash functions, including SHA-2 <xreftarget="FIPS180-4" format="default"/>,target="FIPS180-4"/>, SHA-3 <xreftarget="FIPS202" format="default"/>,target="FIPS202"/>, BLAKE2 <xreftarget="RFC7693" format="default"/>,target="RFC7693"/>, and others.</li> <li>expand_message_xof (<xreftarget="hashtofield-expand-xof" format="default"/>)target="hashtofield-expand-xof"/>) is appropriate for use with extendable-output functions(XOFs)(XOFs), including functions in the SHAKE <xreftarget="FIPS202" format="default"/>target="FIPS202"/> or BLAKE2X <xreftarget="BLAKE2X" format="default"/>target="BLAKE2X"/> families.</li> </ul> <t>These variants should suffice for the vast majority of use cases, but other variants are possible; <xreftarget="hashtofield-expand-other" format="default"/>target="hashtofield-expand-other"/> discusses requirements.</t> <sectionanchor="hashtofield-expand-xmd" numbered="true" toc="default">anchor="hashtofield-expand-xmd"> <name>expand_message_xmd</name> <t>The expand_message_xmd function produces a uniformly random byte string using a cryptographic hash function H that outputs b bits. For security, HMUST<bcp14>MUST</bcp14> meet the following requirements:</t> <ul spacing="normal"> <li>The number of bits output by HMUST<bcp14>MUST</bcp14> be b >= 2 * k,forwhere k is the target security level in bits, and bMUST<bcp14>MUST</bcp14> be divisible by 8. The first requirement ensures k-bit collision resistance; the second ensures uniformity of expand_message_xmd's output.</li> <li>HMAY<bcp14>MAY</bcp14> be a Merkle-Damgaard hash function like SHA-2. In this case, security holds when the underlying compression function is modeled as a random oracle <xreftarget="CDMP05" format="default"/>.target="CDMP05"/>. (See <xreftarget="security-considerations-expand-xmd" format="default"/>target="security-considerations-expand-xmd"/> for discussion.)</li> <li>HMAY<bcp14>MAY</bcp14> be a sponge-based hash function like SHA-3 or BLAKE2. In this case, security holds when the inner function is modeled as a random transformation or as a random permutation <xreftarget="BDPV08" format="default"/>.</li>target="BDPV08"/>.</li> <li>Otherwise, HMUST<bcp14>MUST</bcp14> be a hash function that has been proved indifferentiable from a random oracle <xreftarget="MRH04" format="default"/>target="MRH04"/> under a reasonable cryptographic assumption.</li> </ul> <t>SHA-2 <xreftarget="FIPS180-4" format="default"/>target="FIPS180-4"/> and SHA-3 <xreftarget="FIPS202" format="default"/>target="FIPS202"/> are typical andRECOMMENDED<bcp14>RECOMMENDED</bcp14> choices. As an example, for the 128-bit security level, b >= 256 bits and either SHA-256 or SHA3-256 would be an appropriate choice.</t> <t>The hash function H is assumed to work by repeatedly ingesting fixed-length blocks of data. The length in bits of these blocks is called the input block size (s). As examples, s = 1024 for SHA-512 <xreftarget="FIPS180-4" format="default"/>target="FIPS180-4"/> and s = 576 for SHA3-512 <xreftarget="FIPS202" format="default"/>.target="FIPS202"/>. For correctness, H requires b <= s.</t> <t>The following procedure implements expand_message_xmd.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ expand_message_xmd(msg, DST, len_in_bytes) Parameters: - H, a hash function (see requirements above). - b_in_bytes, b / 8 for b the output size of H in bits. For example, for b = 256, b_in_bytes = 32. - s_in_bytes, the input block size of H, measured in bytes (see discussion above). For example, for SHA-256, s_in_bytes = 64. Input: - msg, a byte string. - DST, a byte string of at most 255 bytes. See below for information on using longer DSTs. - len_in_bytes, the length of the requested output in bytes, not greater than the lesser of (255 * b_in_bytes) or 2^16-1. Output: - uniform_bytes, a byte string. Steps: 1. ell = ceil(len_in_bytes / b_in_bytes) 2. ABORT if ell>> 255 or len_in_bytes>> 65535 or len(DST)>> 255 3. DST_prime = DST || I2OSP(len(DST), 1) 4. Z_pad = I2OSP(0, s_in_bytes) 5. l_i_b_str = I2OSP(len_in_bytes, 2) 6. msg_prime = Z_pad || msg || l_i_b_str || I2OSP(0, 1) || DST_prime 7. b_0 = H(msg_prime) 8. b_1 = H(b_0 || I2OSP(1, 1) || DST_prime) 9. for i in (2, ..., ell): 10. b_i = H(strxor(b_0, b_(i - 1)) || I2OSP(i, 1) || DST_prime) 11. uniform_bytes = b_1 || ... || b_ell 12. return substr(uniform_bytes, 0, len_in_bytes)</sourcecode>]]></sourcecode> <t>Note that the string Z_pad (step 6) is prefixed to msg before computing b_0 (step 7). This is necessary for security when H is a Merkle-Damgaard hash, e.g., SHA-2 (see <xreftarget="security-considerations-expand-xmd" format="default"/>).target="security-considerations-expand-xmd"/>). Hashing this additional data means that the cost of computing b_0 is higher than the cost of simply computing H(msg). In mostsettingssettings, this overhead is negligible, because the cost of evaluating H is much less than the other costs involved in hashing to a curve.</t> <t>It is possible, however, to entirely avoid this overhead by taking advantage of the fact that Z_pad depends only on H, and not on the arguments to expand_message_xmd. To do so, first precompute and save the internal state of H after ingesting Z_pad. Then, when computing b_0, initialize H using the saved state. Further details are implementationdependent,dependent and are beyond the scope of this document.</t> </section> <sectionanchor="hashtofield-expand-xof" numbered="true" toc="default">anchor="hashtofield-expand-xof"> <name>expand_message_xof</name> <t>The expand_message_xof function produces a uniformly random byte string using an extendable-output function (XOF) H. For security, HMUST<bcp14>MUST</bcp14> meet the following criteria:</t> <ul spacing="normal"> <li>The collision resistance of HMUST<bcp14>MUST</bcp14> be at least k bits.</li> <li>HMUST<bcp14>MUST</bcp14> be an XOF that has been proved indifferentiable from a random oracle under a reasonable cryptographic assumption.</li> </ul> <t>The SHAKE<xref target="FIPS202" format="default"/>XOF family <xref target="FIPS202"/> is a typical andRECOMMENDED<bcp14>RECOMMENDED</bcp14> choice. As an example, for 128-bit security, SHAKE128 would be an appropriate choice.</t> <t>The following procedure implements expand_message_xof.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ expand_message_xof(msg, DST, len_in_bytes) Parameters: - H(m, d), an extendable-output function that processes input message m and returns d bytes. Input: - msg, a byte string. - DST, a byte string of at most 255 bytes. See below for information on using longer DSTs. - len_in_bytes, the length of the requested output in bytes. Output: - uniform_bytes, a byte string. Steps: 1. ABORT if len_in_bytes>> 65535 or len(DST)>> 255 2. DST_prime = DST || I2OSP(len(DST), 1) 3. msg_prime = msg || I2OSP(len_in_bytes, 2) || DST_prime 4. uniform_bytes = H(msg_prime, len_in_bytes) 5. return uniform_bytes</sourcecode>]]></sourcecode> </section> <sectionanchor="hashtofield-expand-dst" numbered="true" toc="default">anchor="hashtofield-expand-dst"> <name>Using DSTslongerLonger than 255bytes</name>Bytes</name> <t>The expand_message variants defined in this section accept domain separation tags of at most 255 bytes. If applications require a domain separation tag longer than 255 bytes, e.g., because of requirements imposed by an invoking protocol, implementorsMUST<bcp14>MUST</bcp14> compute a short domain separation tag by hashing, as follows:</t> <ul spacing="normal"> <li> <t>For expand_message_xmd using hash function H, DST is computed as </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ DST = H("H2C-OVERSIZE-DST-" || a_very_long_DST)</sourcecode>]]></sourcecode> </li> <li> <t>For expand_message_xof using extendable-output function H, DST is computed as </t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ DST = H("H2C-OVERSIZE-DST-" || a_very_long_DST, ceil(2 * k / 8))</sourcecode>]]></sourcecode> </li> </ul> <t>Here, a_very_long_DST is the DST whose length is greater than 255 bytes, "H2C-OVERSIZE-DST-" is a 17-byte ASCII string literal, and k is the target security level in bits.</t> </section> <sectionanchor="hashtofield-expand-other" numbered="true" toc="default">anchor="hashtofield-expand-other"> <name>DefiningotherOther expand_messagevariants</name>Variants</name> <t>When defining a new expand_message variant, the most important consideration is that hash_to_field models expand_message as a random oracle. Thus, implementorsSHOULD<bcp14>SHOULD</bcp14> prove indifferentiability from a random oracle under an appropriate assumption about the underlying cryptographic primitives; see <xreftarget="security-considerations-hash-to-field" format="default"/>target="security-considerations-hash-to-field"/> for more information.</t> <t>In addition, expand_message variants:</t> <ul spacing="normal"><li>MUST<li> <bcp14>MUST</bcp14> give collision resistance commensurate with the security level of the target elliptic curve.</li><li>MUST<li> <bcp14>MUST</bcp14> be built on primitives designed for use in applications requiring cryptographic randomness. As examples, a secure stream cipher is an appropriate primitive, whereas a Mersenne twister pseudorandom number generator <xreftarget="MT98" format="default"/>target="MT98"/> is not.</li><li>MUST NOT<li> <bcp14>MUST NOT</bcp14> use rejection sampling.</li><li>MUST<li> <bcp14>MUST</bcp14> give independent values for distinct (msg, DST, length) inputs. Meeting this requirement is subtle. As a simplified example, hashing msg || DST does not work, because in this case distinct (msg, DST) pairs whose concatenations are equal will return the same output (e.g., ("AB", "CDEF") and ("ABC", "DEF")). The variants defined in this document use a suffix-free encoding of DST to avoid this issue.</li><li>MUST<li> <bcp14>MUST</bcp14> use the domain separation tag DST to ensure that invocations of cryptographic primitives inside of expand_message aredomain separateddomain-separated from invocations outside of expand_message. For example, if the expand_message variant uses a hash function H, an encoding of DSTMUST<bcp14>MUST</bcp14> be added either as a prefix or a suffix of the input to each invocation of H. Adding DST as a suffix is theRECOMMENDED<bcp14>RECOMMENDED</bcp14> approach.</li><li>SHOULD<li> <bcp14>SHOULD</bcp14> read msg exactly once, for efficiency when msg is long.</li> </ul> <t>In addition, each expand_message variantMUST<bcp14>MUST</bcp14> specify a unique EXP_TAG that identifies that variant in a Suite ID. See <xreftarget="suiteIDformat" format="default"/>target="suiteIDformat"/> for more information.</t> </section> </section> </section> <sectionanchor="mappings" numbered="true" toc="default">anchor="mappings"> <name>Deterministicmappings</name>Mappings</name> <t>The mappings in this section are suitable for implementing either nonuniform or uniform encodings using the constructions in <xreftarget="roadmap" format="default"/>.target="roadmap"/>. Certain mappings restrict the form of the curve or its parameters. For each mapping presented, this document lists the relevant restrictions.</t> <t>Note that mappings in this section are not interchangeable: different mappings will almost certainly output different points when evaluated on the same input.</t> <sectionanchor="choosing-mapping" numbered="true" toc="default">anchor="choosing-mapping"> <name>Choosing amapping function</name>Mapping Function</name> <t>This section gives brief guidelines on choosing a mapping function for a given elliptic curve. Note that the suites given in <xreftarget="suites" format="default"/>target="suites"/> are recommended mappings for the respective curves.</t> <t>If the target elliptic curve is a Montgomery curve (<xreftarget="montgomery" format="default"/>),target="montgomery"/>), the Elligator 2 method (<xreftarget="elligator2" format="default"/>)target="elligator2"/>) is recommended. Similarly, if the target elliptic curve is a twisted Edwards curve (<xreftarget="twisted-edwards" format="default"/>),target="twisted-edwards"/>), the twisted Edwards Elligator 2 method (<xreftarget="ell2edwards" format="default"/>)target="ell2edwards"/>) is recommended.</t> <t>The remaining cases are Weierstrass curves. For curves supported by the SimplifiedSWUShallue-van de Woestijne-Ulas (SWU) method (<xreftarget="simple-swu" format="default"/>),target="simple-swu"/>), that mapping is the recommended one. Otherwise, the Simplified SWU method for AB == 0 (<xreftarget="simple-swu-AB0" format="default"/>)target="simple-swu-AB0"/>) is recommended if the goal is best performance, while the Shallue-van de Woestijne method (<xreftarget="svdw" format="default"/>)target="svdw"/>) is recommended if the goal is simplicity of implementation. (The reason for this distinction is that the Simplified SWU method for AB == 0 requires implementing an isogeny map in addition to the mapping function, while the Shallue-van de Woestijne method does not.)</t> <t>The Shallue-van de Woestijne method (<xreftarget="svdw" format="default"/>)target="svdw"/>) works with anycurve,curve and may be used in cases where a generic mapping is required. Note, however, that this mapping is almost always more computationally expensive than the curve-specific recommendations above.</t> </section> <sectionanchor="interface" numbered="true" toc="default">anchor="interface"> <name>Interface</name> <t>The generic interface shared by all mappings in this section is as follows:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ (x, y) = map_to_curve(u)</sourcecode>]]></sourcecode> <t>The input u and outputs x and y are elements of the field F. The affine coordinates (x, y) specify a point on an elliptic curve defined over F. Note, however, that the point (x, y) is not a uniformly random point.</t> </section> <sectionanchor="notation" numbered="true" toc="default">anchor="notation"> <name>Notation</name> <t>As a rough guide, the following conventions are used in pseudocode:</t> <ul spacing="normal"> <li>All arithmetic operations are performed over a field F, unless explicitly stated otherwise.</li> <li>u: the input to the mapping function. This is an element of F produced by the hash_to_field function.</li> <li>(x, y), (s, t), (v, w): the affine coordinates of the point output by the mapping. Indexed variables (e.g., x1, y2, ...) are used for candidate values.</li> <li>tv1, tv2, ...: reusable temporary variables.</li> <li>c1, c2, ...: constant values, which can be computed in advance.</li> </ul> </section> <sectionanchor="point-sign" numbered="true" toc="default">anchor="point-sign"> <name>Sign of theresulting point</name>Resulting Point</name> <t>In general, elliptic curves have equations of the form y^2 = g(x). The mappings in this section first identify an x such that g(x) is square, then take a square root to find y. Since there are two square roots when g(x) != 0, this may result in an ambiguity regarding the sign of y.</t> <t>When necessary, the mappings in this section resolve this ambiguity by specifying the sign of the y-coordinate in terms of the input to the mapping function. Two main reasons support this approach: first, this covers elliptic curves over any field in a uniform way, and second, it gives implementors leeway in optimizing square-root implementations.</t> </section> <sectionanchor="map-exceptions" numbered="true" toc="default">anchor="map-exceptions"> <name>Exceptionalcases</name>Cases</name> <t>Mappings may have exceptional cases, i.e., inputs u on which the mapping is undefined. These cases must be handled carefully, especially for constant-time implementations.</t> <t>For each mapping in this section, we discuss the exceptional cases and show how to handle them in constant time. Note that all implementationsSHOULD<bcp14>SHOULD</bcp14> use inv0 (<xreftarget="utility" format="default"/>)target="utility"/>) to compute multiplicative inverses, to avoid exceptional cases that result from attempting to compute the inverse of 0.</t> </section> <sectionanchor="weierstrass" numbered="true" toc="default">anchor="weierstrass"> <name>Mappings for Weierstrasscurves</name>Curves</name> <t>The mappings in this section apply to a target curve E defined by the equation</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ y^2 = g(x) = x^3 + A * x + B</sourcecode>]]></sourcecode> <t>where 4 * A^3 + 27 * B^2 != 0.</t> <sectionanchor="svdw" numbered="true" toc="default">anchor="svdw"> <name>Shallue-van de Woestijnemethod</name>Method</name> <t>Shallue and van de Woestijne <xreftarget="SW06" format="default"/>target="SW06"/> describe a mapping that applies to essentially any elliptic curve. (Note, however, that this mapping is more expensive to evaluate than the other mappings in this document.)</t> <t>The parameterization given below is for Weierstrass curves; its derivation is detailed in <xreftarget="W19" format="default"/>.target="W19"/>. This parameterization also works for Montgomery curves (<xreftarget="montgomery" format="default"/>)target="montgomery"/>) and twisted Edwards(<xref target="twisted-edwards" format="default"/>)curves (<xref target="twisted-edwards"/>) via the rational maps given in <xreftarget="appx-rational-map" format="default"/>: firsttarget="appx-rational-map"/>: first, evaluate the Shallue-van de Woestijne mapping to an equivalent Weierstrass curve, then map that point to the target Montgomery or twisted Edwards curve using the corresponding rational map.</t> <t>Preconditions: A Weierstrass curve y^2 = x^3 + A * x + B.</t> <t>Constants:</t> <ul spacing="normal"> <li>A and B, the parameter of the Weierstrass curve.</li> <li> <t>Z, a non-zero element of F meeting the below criteria. <xreftarget="svdw-z-code" format="default"/>target="svdw-z-code"/> gives a Sage<xref target="SAGE" format="default"/>script <xref target="SAGE"/> that outputs theRECOMMENDED<bcp14>RECOMMENDED</bcp14> Z. </t> <ol spacing="normal"type="1"> <li>g(Z)type="1"><li>g(Z) != 0 in F.</li> <li>-(3 * Z^2 + 4 * A) / (4 * g(Z)) != 0 in F.</li> <li>-(3 * Z^2 + 4 * A) / (4 * g(Z)) is square in F.</li> <li>At least one of g(Z) and g(-Z / 2) is square in F.</li> </ol> </li> </ul> <t>Sign of y: Inputs u and -u give the same x-coordinate for many values of u. Thus, we set sgn0(y) == sgn0(u).</t> <t>Exceptions: The exceptional cases for u occur when (1 + u^2 * g(Z)) * (1 - u^2 * g(Z)) == 0. The restrictions on Z given above ensure that implementations that use inv0 to invert this product are exception free.</t> <t>Operations:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ 1. tv1 = u^2 * g(Z) 2. tv2 = 1 + tv1 3. tv1 = 1 - tv1 4. tv3 = inv0(tv1 * tv2) 5. tv4 = sqrt(-g(Z) * (3 * Z^2 + 4 * A)) # can be precomputed 6. If sgn0(tv4) == 1, set tv4 = -tv4 # sgn0(tv4) MUST equal 0 7. tv5 = u * tv1 * tv3 * tv4 8. tv6 = -4 * g(Z) / (3 * Z^2 + 4 * A) # can be precomputed 9. x1 = -Z / 2 - tv5 10. x2 = -Z / 2 + tv5 11. x3 = Z + tv6 * (tv2^2 * tv3)^2 12. If is_square(g(x1)), set x = x1 and y = sqrt(g(x1)) 13. Else If is_square(g(x2)), set x = x2 and y = sqrt(g(x2)) 14. Else set x = x3 and y = sqrt(g(x3)) 15. If sgn0(u) != sgn0(y), set y = -y 16. return (x, y)</sourcecode>]]></sourcecode> <t><xreftarget="straightline-svdw" format="default"/>target="straightline-svdw"/> gives an example straight-line implementation of this mapping.</t> </section> <sectionanchor="simple-swu" numbered="true" toc="default">anchor="simple-swu"> <name>Simplified Shallue-van de Woestijne-Ulasmethod</name>Method</name> <t>The function map_to_curve_simple_swu(u) implements a simplification of the Shallue-van de Woestijne-Ulas mapping <xreftarget="U07" format="default"/>target="U07"/> described by Brier etal. <xref target="BCIMRT10" format="default"/>,al. <xref target="BCIMRT10"/>, which they call the "simplified SWU" map. Wahby and Boneh <xreftarget="WB19" format="default"/>target="WB19"/> generalize and optimize this mapping.</t> <t>Preconditions: A Weierstrass curve y^2 = x^3 + A * x + B where A != 0 and B != 0.</t> <t>Constants:</t> <ul spacing="normal"> <li>A and B, the parameters of the Weierstrass curve.</li> <li> <t>Z, an element of F meeting the below criteria. <xreftarget="sswu-z-code" format="default"/>target="sswu-z-code"/> gives a Sage<xref target="SAGE" format="default"/>script <xref target="SAGE"/> that outputs theRECOMMENDED<bcp14>RECOMMENDED</bcp14> Z. The criteriaare:are as follows: </t> <ol spacing="normal"type="1"> <li>Ztype="1"><li>Z is non-square in F,</li> <li>Z != -1 in F,</li> <li>the polynomial g(x) - Z is irreducible over F, and</li> <li>g(B / (Z * A)) is square in F.</li> </ol> </li> </ul> <t>Sign of y: Inputs u and -u give the same x-coordinate. Thus, we set sgn0(y) == sgn0(u).</t> <t>Exceptions: The exceptional cases are values of u such that Z^2 * u^4 + Z * u^2 == 0. This includes u ==0,0 and may include other valuesdependingthat depend on Z. Implementations must detect this case and set x1 = B / (Z * A), which guarantees that g(x1) is square by the condition on Z given above.</t> <t>Operations:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ 1. tv1 = inv0(Z^2 * u^4 + Z * u^2) 2. x1 = (-B / A) * (1 + tv1) 3. If tv1 == 0, set x1 = B / (Z * A) 4. gx1 = x1^3 + A * x1 + B 5. x2 = Z * u^2 * x1 6. gx2 = x2^3 + A * x2 + B 7. If is_square(gx1), set x = x1 and y = sqrt(gx1) 8. Else set x = x2 and y = sqrt(gx2) 9. If sgn0(u) != sgn0(y), set y = -y 10. return (x, y)</sourcecode>]]></sourcecode> <t><xreftarget="straightline-sswu" format="default"/>target="straightline-sswu"/> gives a general and optimized straight-line implementation of this mapping. For more information on optimizing this mapping, see<xref target="WB19" format="default"/>Section 4 of <xref target="WB19"/> or the example code found at <xreftarget="hash2curve-repo" format="default"/>.</t>target="hash2curve-repo"/>.</t> </section> <sectionanchor="simple-swu-AB0" numbered="true" toc="default">anchor="simple-swu-AB0"> <name>Simplified SWU for AB == 0</name> <t>Wahby and Boneh <xreftarget="WB19" format="default"/>target="WB19"/> show how to adapt thesimplifiedSimplified SWU mapping to Weierstrass curves having A == 0 or B == 0, which the mapping of <xreftarget="simple-swu" format="default"/>target="simple-swu"/> does not support. (The case A == B == 0 is excluded because y^2 = x^3 is not an elliptic curve.)</t> <t>This method applies to curves like secp256k1 <xreftarget="SEC2" format="default"/>target="SEC2"/> and to pairing-friendly curves in the Barreto-Lynn-Scott family <xreftarget="BLS03" format="default"/>,target="BLS03"/>, Barreto-Naehrig family <xreftarget="BN05" format="default"/>,target="BN05"/>, and other families.</t> <t>This method requires finding another elliptic curve E' given by the equation</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ y'^2 = g'(x') = x'^3 + A' * x' + B'</sourcecode>]]></sourcecode> <t>that is isogenous to E and has A' != 0 and B' != 0. (See <xreftarget="WB19" format="default"/>,target="WB19"/>, Appendix A, for one way of finding E' using <xreftarget="SAGE" format="default"/>.)target="SAGE"/>.) This isogeny defines a map iso_map(x', y') given by a pair of rational functions. iso_map takes as input a point on E' and produces as output a point on E.</t> <t>Once E' and iso_map are identified, this mapping works as follows: on input u, first apply thesimplifiedSimplified SWU mapping to get a point on E', then apply the isogeny map to that point to get a point on E.</t> <t>Note that iso_map is a group homomorphism, meaning that point addition commutes with iso_map. Thus, when using this mapping in the hash_to_curve constructionofdiscussed in <xreftarget="roadmap" format="default"/>,target="roadmap"/>, one can effect a small optimization by first mapping u0 and u1 to E', adding the resulting points on E', and then applying iso_map to the sum. This gives the same result while requiring only one evaluation of iso_map.</t> <t>Preconditions: An elliptic curve E' with A' != 0 and B' != 0 that is isogenous to the target curve E with isogeny map iso_map from E' to E.</t> <t>Helper functions:</t> <ul spacing="normal"> <li>map_to_curve_simple_swu is the mapping of <xreftarget="simple-swu" format="default"/>target="simple-swu"/> to E'</li> <li>iso_map is the isogeny map from E' to E</li> </ul> <t>Sign of y:forFor this map, the sign is determined by map_to_curve_simple_swu. No further sign adjustments are necessary.</t> <t>Exceptions: map_to_curve_simple_swu handles its exceptional cases. Exceptional cases of iso_map are inputs that cause the denominator of either rational function to evaluate to zero; such casesMUST<bcp14>MUST</bcp14> return the identity point on E.</t> <t>Operations:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ 1. (x', y') = map_to_curve_simple_swu(u) # (x', y') is on E' 2. (x, y) = iso_map(x', y') # (x, y) is on E 3. return (x, y)</sourcecode>]]></sourcecode> <t>See <xreftarget="hash2curve-repo" format="default"/>target="hash2curve-repo"/> or<xref target="WB19" format="default"/>Section 4.3 of <xref target="WB19"/> for details on implementing the isogeny map.</t> </section> </section> <sectionanchor="montgomery" numbered="true" toc="default">anchor="montgomery"> <name>Mappings for Montgomerycurves</name>Curves</name> <t>The mapping defined in this section applies to a target curve M defined by the equation</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ K * t^2 = s^3 + J * s^2 + s</sourcecode>]]></sourcecode> <sectionanchor="elligator2" numbered="true" toc="default">anchor="elligator2"> <name>Elligator 2method</name>Method</name> <t>Bernstein, Hamburg, Krasnova, and Lange give a mapping that applies to any curve with a point of order 2 <xreftarget="BHKL13" format="default"/>,target="BHKL13"/>, which they call Elligator 2.</t> <t>Preconditions: A Montgomery curve K * t^2 = s^3 + J * s^2 + s whereJ !=J != 0, K != 0, and (J^2 - 4) / K^2 is non-zero and non-square in F.</t> <t>Constants:</t> <ul spacing="normal"> <li>J and K, the parameters of the elliptic curve.</li> <li>Z, a non-square element of F. <xreftarget="elligator-z-code" format="default"/>target="elligator-z-code"/> gives a Sage<xref target="SAGE" format="default"/>script <xref target="SAGE"/> that outputs theRECOMMENDED<bcp14>RECOMMENDED</bcp14> Z.</li> </ul> <t>Sign of t:thisThis mapping fixes the sign of t as specified in <xreftarget="BHKL13" format="default"/>.target="BHKL13"/>. No additional adjustment is required.</t> <t>Exceptions: The exceptional case is Z * u^2 == -1, i.e., 1 + Z * u^2 == 0. Implementations must detect this case and set x1 = -(J / K). Note that this can only happen when q = 3 (mod 4).</t> <t>Operations:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ 1. x1 = -(J / K) * inv0(1 + Z * u^2) 2. If x1 == 0, set x1 = -(J / K) 3. gx1 = x1^3 + (J / K) * x1^2 + x1 / K^2 4. x2 = -x1 - (J / K) 5. gx2 = x2^3 + (J / K) * x2^2 + x2 / K^2 6. If is_square(gx1), set x = x1, y = sqrt(gx1) with sgn0(y) == 1. 7. Else set x = x2, y = sqrt(gx2) with sgn0(y) == 0. 8. s = x * K 9. t = y * K 10. return (s, t)</sourcecode>]]></sourcecode> <t><xreftarget="straightline-ell2" format="default"/>target="straightline-ell2"/> gives an example straight-line implementation of this mapping. <xreftarget="ell2-opt" format="default"/>target="ell2-opt"/> gives optimized straight-line procedures that apply to specific classes of curves and base fields.</t> </section> </section> <sectionanchor="twisted-edwards" numbered="true" toc="default">anchor="twisted-edwards"> <name>Mappings fortwistedTwisted Edwardscurves</name>Curves</name> <t>Twisted Edwards curves (a class of curves that includes Edwards curves) are given by the equation</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ a * v^2 + w^2 = 1 + d * v^2 * w^2</sourcecode>]]></sourcecode> <t>with a != 0, d != 0, and a != d <xreftarget="BBJLP08" format="default"/>.</t>target="BBJLP08"/>.</t> <t>These curves are closely related to Montgomery curves (<xreftarget="montgomery" format="default"/>):target="montgomery"/>): every twisted Edwards curve is birationally equivalent to a Montgomery curve (<xreftarget="BBJLP08" format="default"/>,target="BBJLP08"/>, Theorem 3.2). This equivalence yields an efficient way of hashing to a twisted Edwards curve: first, hash to an equivalent Montgomery curve, then transform the result into a point on the twisted Edwards curve via a rational map. This method of hashing to a twisted Edwards curve thus requires identifying a corresponding Montgomery curve and rational map. We describe how to identify such a curve and map immediately below.</t> <sectionanchor="rational-map" numbered="true" toc="default">anchor="rational-map"> <name>RationalmapsMaps from Montgomery totwistedTwisted Edwardscurves</name>Curves</name> <t>There are two ways to select a Montgomery curve and rational map for use when hashing to a given twisted Edwards curve. The selected Montgomery curve and rational mapMUST<bcp14>MUST</bcp14> be specified as part of the hash-to-curve suite for a given twisted Edwards curve; see <xreftarget="suites" format="default"/>.</t>target="suites"/>.</t> <ol spacing="normal"type="1"> <li>type="1"><li> <t>When hashing to a standardized twisted Edwards curve for which a corresponding Montgomery form and rational map are also standardized, the standard Montgomery form and rational mapSHOULD<bcp14>SHOULD</bcp14> be used to ensure compatibility with existing software. </t> <t> In certain cases, e.g., edwards25519 <xreftarget="RFC7748" format="default"/>,target="RFC7748"/>, the sign of the rational map from the twisted Edwards curve to its corresponding Montgomery curve is not given explicitly. In this case, the signMUST<bcp14>MUST</bcp14> be fixed such that applying the rational map to the twisted Edwards curve's base point yields the Montgomery curve's base point with correct sign. (For edwards25519, see <xreftarget="RFC7748" format="default"/>target="RFC7748"/> and <xreftarget="EID4730" format="default"/>.)target="Err4730"/>.) </t> <t> When defining new twisted Edwards curves, a Montgomery equivalent and rational mapSHOULD<bcp14>SHOULD</bcp14> also be specified, and the sign of the rational mapSHOULD<bcp14>SHOULD</bcp14> be stated explicitly.</t> </li> <li>When hashing to a twisted Edwards curve that does not have a standardized Montgomery form or rational map, the map given in <xreftarget="appx-rational-map" format="default"/> SHOULDtarget="appx-rational-map"/> <bcp14>SHOULD</bcp14> be used.</li> </ol> </section> <sectionanchor="ell2edwards" numbered="true" toc="default">anchor="ell2edwards"> <name>Elligator 2method</name>Method</name> <t>Preconditions: A twisted Edwards curve E and an equivalent Montgomery curve M meeting the requirements in <xreftarget="rational-map" format="default"/>.</t>target="rational-map"/>.</t> <t>Helper functions:</t> <ul spacing="normal"> <li>map_to_curve_elligator2 is the mapping of <xreftarget="elligator2" format="default"/>target="elligator2"/> to the curve M.</li> <li>rational_map is a function that takes a point (s, t) on M and returns a point (v, w) onE,E. This rational map should be chosen as defined in <xreftarget="rational-map" format="default"/>.</li>target="rational-map"/>.</li> </ul> <t>Sign of t (and v):forFor this map, the sign is determined by map_to_curve_elligator2. No further sign adjustments are required.</t> <t>Exceptions: The exceptions for the Elligator 2 mapping are as given in <xreftarget="elligator2" format="default"/>.target="elligator2"/>. The exceptions for the rational map are as given in <xreftarget="rational-map" format="default"/>.target="rational-map"/>. No other exceptions are possible.</t> <t>The following procedure implements the Elligator 2 mapping for a twisted Edwards curve. (Note that the output point is denoted (v, w) because it is a point on the target twisted Edwards curve.)</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_edwards(u) Input: u, an element of F. Output: (v, w), a point on E. 1. (s, t) = map_to_curve_elligator2(u) # (s, t) is on M 2. (v, w) = rational_map(s, t) # (v, w) is on E 3. return (v, w)</sourcecode>]]></sourcecode> </section> </section> </section> <sectionanchor="cofactor-clearing" numbered="true" toc="default">anchor="cofactor-clearing"> <name>Clearing thecofactor</name>Cofactor</name> <t>The mappings of <xreftarget="mappings" format="default"/>target="mappings"/> always output a point on the elliptic curve, i.e., a point in a group of order h * r (<xreftarget="bg-curves" format="default"/>).target="bg-curves"/>). Obtaining a point in G may require a final operation commonly called "clearing the cofactor," which takes as input any point on the curve and produces as output a point in the prime-order (sub)group G (<xreftarget="bg-curves" format="default"/>).</t>target="bg-curves"/>).</t> <t>The cofactor can always be cleared via scalar multiplication by h. For elliptic curves where h = 1, i.e., the curves with a prime number of points, no operation is required. This applies, for example, to the NIST curves P-256, P-384, and P-521 <xreftarget="FIPS186-4" format="default"/>.</t>target="FIPS186-4"/>.</t> <t>In some cases, it is possible to clear the cofactor via a faster method than scalar multiplication by h. These methods are equivalent to (but usually faster than) multiplication by some scalar h_eff whose value is determined by the method and the curve. Examples of fast cofactor clearing methods include the following:</t> <ul spacing="normal"> <li>For certain pairing-friendly curves having subgroup G2 over an extension field, Scott etal. <xref target="SBCDK09" format="default"/>al. <xref target="SBCDK09"/> describe a method for fast cofactor clearing that exploits anefficiently-computableefficiently computable endomorphism. Fuentes-Castaneda etal. <xref target="FKR11" format="default"/>al. <xref target="FKR11"/> propose an alternative method that is sometimes more efficient. Budroni and Pintore <xreftarget="BP17" format="default"/>target="BP17"/> give concrete instantiations of these methods for Barreto-Lynn-Scott pairing-friendly curves <xreftarget="BLS03" format="default"/>.target="BLS03"/>. This method is described for the specific case of BLS12-381 in <xreftarget="clear-cofactor-bls12381-g2" format="default"/>.</li>target="clear-cofactor-bls12381-g2"/>.</li> <li>Wahby and Boneh (<xreftarget="WB19" format="default"/>,target="WB19"/>, Section 5) describe a trick due to Scott for fast cofactor clearing on any elliptic curve for which the prime factorization of h and the structure of the elliptic curve group meet certain conditions.</li> </ul> <t>The clear_cofactor function is parameterized by a scalar h_eff. Specifically,</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ clear_cofactor(P) := h_eff * P</sourcecode>]]></sourcecode> <t>where * represents scalar multiplication. When a curve does not support a fast cofactor clearing method, h_eff = h and the cofactorMUST<bcp14>MUST</bcp14> be cleared via scalar multiplication.</t> <t>When a curve admits a fast cofactor clearing method, clear_cofactorMAY<bcp14>MAY</bcp14> be evaluated either via that method or via scalar multiplication by the equivalent h_eff; these two methods give the same result. Note that in this case scalar multiplication by the cofactor h does not generally give the same result as the fastmethod,method andMUST NOT<bcp14>MUST NOT</bcp14> be used.</t> </section> <sectionanchor="suites" numbered="true" toc="default">anchor="suites"> <name>Suites forhashing</name>Hashing</name> <t>This section lists recommended suites for hashing to standard elliptic curves.</t> <t>A hash-to-curve suite fully specifies the procedure for hashing byte strings to points on a specific elliptic curve group. <xreftarget="suites-howto" format="default"/>target="suites-howto"/> describes how to implement a suite. Applications that require hashing to an elliptic curve should use either an existing suite or a new suite specified as described in <xreftarget="new-suite" format="default"/>.</t>target="new-suite"/>.</t> <t>All applications using a hash-to-curve suiteMUST<bcp14>MUST</bcp14> choose a domain separation tag (DST) in accordance with the guidelines in <xreftarget="domain-separation" format="default"/>.target="domain-separation"/>. In addition, applications whose security requires a random oracle that returns uniformly random points on the target curveMUST<bcp14>MUST</bcp14> use a suite whose encoding type is hash_to_curve; see <xreftarget="roadmap" format="default"/>target="roadmap"/> and immediately below for more information.</t> <t>A hash-to-curve suite comprises the following parameters:</t> <ul spacing="normal"> <li>Suite ID, a short name used to refer to a given suite. <xreftarget="suiteIDformat" format="default"/>target="suiteIDformat"/> discusses the naming conventions forsuiteSuite IDs.</li> <li>encoding type, either uniform (hash_to_curve) or nonuniform (encode_to_curve). See <xreftarget="roadmap" format="default"/>target="roadmap"/> for definitions of these encoding types.</li> <li>E, the target elliptic curve over a field F.</li> <li>p, the characteristic of the field F.</li> <li>m, the extension degree of the field F. If m > 1, the suiteMUST<bcp14>MUST</bcp14> also specify the polynomial basis used to represent extension field elements.</li> <li>k, the target security level of the suite in bits. (See <xreftarget="security-considerations-targets" format="default"/>target="security-considerations-targets"/> for discussion.)</li> <li>L, the length parameter for hash_to_field (<xreftarget="hashtofield" format="default"/>).</li>target="hashtofield"/>).</li> <li>expand_message, one of the variants specified in <xreftarget="hashtofield-expand" format="default"/>target="hashtofield-expand"/> plus any parameters required for the specified variant (for example, H, the underlying hash function).</li> <li>f, a mapping function from <xreftarget="mappings" format="default"/>.</li>target="mappings"/>.</li> <li>h_eff, the scalar parameter for clear_cofactor (<xreftarget="cofactor-clearing" format="default"/>).</li>target="cofactor-clearing"/>).</li> </ul> <t>In addition to the above parameters, the mapping f may require additional parameters Z, M, rational_map, E', or iso_map. When applicable, theseMUST<bcp14>MUST</bcp14> be specified.</t> <t>Thebelowtable below lists suitesRECOMMENDED<bcp14>RECOMMENDED</bcp14> for some elliptic curves. The corresponding parameters are given in the following subsections. Applications instantiating cryptographic protocols whose security analysis relies on a random oracle that outputs points with a uniform distributionMUST NOT<bcp14>MUST NOT</bcp14> use a nonuniform encoding. Moreover, applications that use a nonuniform encodingSHOULD<bcp14>SHOULD</bcp14> carefully analyze the security implications of nonuniformity. When the required encoding is not clear, applicationsSHOULD<bcp14>SHOULD</bcp14> use a uniform encoding for security.</t> <tableanchor="suite-table" align="center">anchor="suite-table"> <name>Suites for hashing to elliptic curves.</name> <thead> <tr> <th align="left">E</th> <th align="left">Suites</th> <th align="left">Section</th> </tr> </thead> <tbody> <tr> <td align="left">NIST P-256</td> <td align="left">P256_XMD:SHA-256_SSWU_RO_ P256_XMD:SHA-256_SSWU_NU_</td> <td align="left"> <xreftarget="suites-p256" format="default"/></td>format="counter" target="suites-p256"/></td> </tr> <tr> <td align="left">NIST P-384</td> <td align="left">P384_XMD:SHA-384_SSWU_RO_ P384_XMD:SHA-384_SSWU_NU_</td> <td align="left"> <xreftarget="suites-p384" format="default"/></td>format="counter" target="suites-p384"/></td> </tr> <tr> <td align="left">NIST P-521</td> <td align="left">P521_XMD:SHA-512_SSWU_RO_ P521_XMD:SHA-512_SSWU_NU_</td> <td align="left"> <xreftarget="suites-p521" format="default"/></td>format="counter" target="suites-p521"/></td> </tr> <tr> <td align="left">curve25519</td> <td align="left">curve25519_XMD:SHA-512_ELL2_RO_ curve25519_XMD:SHA-512_ELL2_NU_</td> <td align="left"> <xreftarget="suites-25519" format="default"/></td>format="counter" target="suites-25519"/></td> </tr> <tr> <td align="left">edwards25519</td> <td align="left">edwards25519_XMD:SHA-512_ELL2_RO_ edwards25519_XMD:SHA-512_ELL2_NU_</td> <td align="left"> <xreftarget="suites-25519" format="default"/></td>format="counter" target="suites-25519"/></td> </tr> <tr> <td align="left">curve448</td> <td align="left">curve448_XOF:SHAKE256_ELL2_RO_ curve448_XOF:SHAKE256_ELL2_NU_</td> <td align="left"> <xreftarget="suites-448" format="default"/></td>format="counter" target="suites-448"/></td> </tr> <tr> <td align="left">edwards448</td> <td align="left">edwards448_XOF:SHAKE256_ELL2_RO_ edwards448_XOF:SHAKE256_ELL2_NU_</td> <td align="left"> <xreftarget="suites-448" format="default"/></td>format="counter" target="suites-448"/></td> </tr> <tr> <td align="left">secp256k1</td> <td align="left">secp256k1_XMD:SHA-256_SSWU_RO_ secp256k1_XMD:SHA-256_SSWU_NU_</td> <td align="left"> <xreftarget="suites-secp256k1" format="default"/></td>format="counter" target="suites-secp256k1"/></td> </tr> <tr> <td align="left">BLS12-381 G1</td> <td align="left">BLS12381G1_XMD:SHA-256_SSWU_RO_ BLS12381G1_XMD:SHA-256_SSWU_NU_</td> <td align="left"> <xreftarget="suites-bls12381" format="default"/></td>format="counter" target="suites-bls12381"/></td> </tr> <tr> <td align="left">BLS12-381 G2</td> <td align="left">BLS12381G2_XMD:SHA-256_SSWU_RO_ BLS12381G2_XMD:SHA-256_SSWU_NU_</td> <td align="left"> <xreftarget="suites-bls12381" format="default"/></td>format="counter" target="suites-bls12381"/></td> </tr> </tbody> </table> <sectionanchor="suites-howto" numbered="true" toc="default">anchor="suites-howto"> <name>Implementing ahash-to-curve suite</name>Hash-to-Curve Suite</name> <t>A hash-to-curve suite requires the following functions. Note that some of these require utility functions from <xreftarget="utility" format="default"/>.</t>target="utility"/>.</t> <ol spacing="normal"type="1"> <li>Basetype="1"><li>Base field arithmetic operations for the target elliptic curve, e.g., addition, multiplication, and square root.</li> <li>Elliptic curve point operations for the target curve, e.g., point addition and scalar multiplication.</li> <li>The hash_to_field function; see <xreftarget="hashtofield" format="default"/>.target="hashtofield"/>. This includes the expand_message variant (<xreftarget="hashtofield-expand" format="default"/>)target="hashtofield-expand"/>) and any constituent hash function or XOF.</li> <li>The suite-specified mapping function; see the corresponding subsection of <xreftarget="mappings" format="default"/>.</li>target="mappings"/>.</li> <li>A cofactor clearing function; see <xreftarget="cofactor-clearing" format="default"/>.target="cofactor-clearing"/>. This may be implemented as scalar multiplication by h_eff or as a faster equivalent method.</li> <li>The desired encoding function; see <xreftarget="roadmap" format="default"/>.target="roadmap"/>. This is either hash_to_curve or encode_to_curve.</li> </ol> </section> <sectionanchor="suites-p256" numbered="true" toc="default">anchor="suites-p256"> <name>Suites for NIST P-256</name> <t>This section defines ciphersuites for the NIST P-256 elliptic curve <xreftarget="FIPS186-4" format="default"/>.</t>target="FIPS186-4"/>.</t> <t>P256_XMD:SHA-256_SSWU_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li> <t>E: y^2 = x^3 + A * x + B, where </t> <ul spacing="normal"> <li>A = -3</li> <li>B = 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b</li> </ul> </li> <li>p: 2^256 - 2^224 + 2^192 + 2^96 - 1</li> <li>m: 1</li> <li>k: 128</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-256</li> <li>L: 48</li> <li>f: Simplified SWU method (<xreftarget="simple-swu" format="default"/>)</li>target="simple-swu"/>)</li> <li>Z: -10</li> <li>h_eff: 1</li> </ul> <t>P256_XMD:SHA-256_SSWU_NU_ is identical to P256_XMD:SHA-256_SSWU_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>An optimized example implementation of the Simplified SWU mapping to P-256 is given in <xreftarget="straightline-sswu" format="default"/>.</t>target="straightline-sswu"/>.</t> </section> <sectionanchor="suites-p384" numbered="true" toc="default">anchor="suites-p384"> <name>Suites for NIST P-384</name> <t>This section defines ciphersuites for the NIST P-384 elliptic curve <xreftarget="FIPS186-4" format="default"/>.</t>target="FIPS186-4"/>.</t> <t>P384_XMD:SHA-384_SSWU_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li> <t>E: y^2 = x^3 + A * x + B, where </t> <ul spacing="normal"> <li>A = -3</li><li>B = 0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef</li><li>B = 0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef</li> </ul> </li> <li>p: 2^384 - 2^128 - 2^96 + 2^32 - 1</li> <li>m: 1</li> <li>k: 192</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-384</li> <li>L: 72</li> <li>f: Simplified SWU method (<xreftarget="simple-swu" format="default"/>)</li>target="simple-swu"/>)</li> <li>Z: -12</li> <li>h_eff: 1</li> </ul> <t>P384_XMD:SHA-384_SSWU_NU_ is identical to P384_XMD:SHA-384_SSWU_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>An optimized example implementation of the Simplified SWU mapping to P-384 is given in <xreftarget="straightline-sswu" format="default"/>.</t>target="straightline-sswu"/>.</t> </section> <sectionanchor="suites-p521" numbered="true" toc="default">anchor="suites-p521"> <name>Suites for NIST P-521</name> <t>This section defines ciphersuites for the NIST P-521 elliptic curve <xreftarget="FIPS186-4" format="default"/>.</t>target="FIPS186-4"/>.</t> <t>P521_XMD:SHA-512_SSWU_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li> <t>E: y^2 = x^3 + A * x + B, where </t> <ul spacing="normal"> <li>A = -3</li><li>B = 0x51953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00</li><li>B = 0x51953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00</li> </ul> </li> <li>p: 2^521 - 1</li> <li>m: 1</li> <li>k: 256</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-512</li> <li>L: 98</li> <li>f: Simplified SWU method (<xreftarget="simple-swu" format="default"/>)</li>target="simple-swu"/>)</li> <li>Z: -4</li> <li>h_eff: 1</li> </ul> <t>P521_XMD:SHA-512_SSWU_NU_ is identical to P521_XMD:SHA-512_SSWU_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>An optimized example implementation of the Simplified SWU mapping to P-521 is given in <xreftarget="straightline-sswu" format="default"/>.</t>target="straightline-sswu"/>.</t> </section> <sectionanchor="suites-25519" numbered="true" toc="default">anchor="suites-25519"> <name>Suites for curve25519 and edwards25519</name> <t>This section defines ciphersuites for curve25519 and edwards25519 <xreftarget="RFC7748" format="default"/>.target="RFC7748"/>. Note that these ciphersuitesMUST NOT<bcp14>MUST NOT</bcp14> be used when hashing to ristretto255 <xreftarget="I-D.irtf-cfrg-ristretto255-decaf448" format="default"/>.target="I-D.irtf-cfrg-ristretto255-decaf448"/>. See <xreftarget="appx-ristretto255" format="default"/>target="appx-ristretto255"/> for information on how to hash to that group.</t> <t>curve25519_XMD:SHA-512_ELL2_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li> <t>E: K * t^2 = s^3 + J * s^2 + s, where </t> <ul spacing="normal"> <li>J = 486662</li> <li>K = 1</li> </ul> </li> <li>p: 2^255 - 19</li> <li>m: 1</li> <li>k: 128</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-512</li> <li>L: 48</li> <li>f: Elligator 2 method (<xreftarget="elligator2" format="default"/>)</li>target="elligator2"/>)</li> <li>Z: 2</li> <li>h_eff: 8</li> </ul> <t>edwards25519_XMD:SHA-512_ELL2_RO_ is identical to curve25519_XMD:SHA-512_ELL2_RO_, except for the following parameters:</t> <ul spacing="normal"> <li> <t>E: a * v^2 + w^2 = 1 + d * v^2 * w^2, where </t> <ul spacing="normal"> <li>a = -1</li> <li>d = 0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3</li> </ul> </li> <li>f: Twisted Edwards Elligator 2 method (<xreftarget="ell2edwards" format="default"/>)</li>target="ell2edwards"/>)</li> <li>M:curve25519curve25519, defined in <xreftarget="RFC7748" format="default"/>, Section 4.1</li>section="4.1" sectionFormat="comma" target="RFC7748"/></li> <li>rational_map: the birationalmapmaps defined in <xreftarget="RFC7748" format="default"/>, Section 4.1</li>section="4.1" sectionFormat="comma" target="RFC7748"/></li> </ul> <t>curve25519_XMD:SHA-512_ELL2_NU_ is identical to curve25519_XMD:SHA-512_ELL2_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>edwards25519_XMD:SHA-512_ELL2_NU_ is identical to edwards25519_XMD:SHA-512_ELL2_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>Optimized example implementations of the above mappings are given in <xreftarget="map-to-curve25519" format="default"/>target="map-to-curve25519"/> and <xreftarget="map-to-edwards25519" format="default"/>.</t>target="map-to-edwards25519"/>.</t> </section> <sectionanchor="suites-448" numbered="true" toc="default">anchor="suites-448"> <name>Suites for curve448 and edwards448</name> <t>This section defines ciphersuites for curve448 and edwards448 <xreftarget="RFC7748" format="default"/>.target="RFC7748"/>. Note that these ciphersuitesMUST NOT<bcp14>MUST NOT</bcp14> be used when hashing to decaf448 <xreftarget="I-D.irtf-cfrg-ristretto255-decaf448" format="default"/>.target="I-D.irtf-cfrg-ristretto255-decaf448"/>. See <xreftarget="appx-decaf448" format="default"/>target="appx-decaf448"/> for information on how to hash to that group.</t> <t>curve448_XOF:SHAKE256_ELL2_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li> <t>E: K * t^2 = s^3 + J * s^2 + s, where </t> <ul spacing="normal"> <li>J = 156326</li> <li>K = 1</li> </ul> </li> <li>p: 2^448 - 2^224 - 1</li> <li>m: 1</li> <li>k: 224</li> <li>expand_message: expand_message_xof (<xreftarget="hashtofield-expand-xof" format="default"/>)</li>target="hashtofield-expand-xof"/>)</li> <li>H: SHAKE256</li> <li>L: 84</li> <li>f: Elligator 2 method (<xreftarget="elligator2" format="default"/>)</li>target="elligator2"/>)</li> <li>Z: -1</li> <li>h_eff: 4</li> </ul> <t>edwards448_XOF:SHAKE256_ELL2_RO_ is identical to curve448_XOF:SHAKE256_ELL2_RO_, except for the following parameters:</t> <ul spacing="normal"> <li> <t>E: a * v^2 + w^2 = 1 + d * v^2 * w^2, where </t> <ul spacing="normal"> <li>a = 1</li> <li>d = -39081</li> </ul> </li> <li>f: Twisted Edwards Elligator 2 method (<xreftarget="ell2edwards" format="default"/>)</li>target="ell2edwards"/>)</li> <li>M: curve448, defined in <xreftarget="RFC7748" format="default"/>, Section 4.2</li>section="4.2" sectionFormat="comma" target="RFC7748"/></li> <li>rational_map: the 4-isogeny map defined in <xreftarget="RFC7748" format="default"/>, Section 4.2</li>section="4.2" sectionFormat="comma" target="RFC7748"/></li> </ul> <t>curve448_XOF:SHAKE256_ELL2_NU_ is identical to curve448_XOF:SHAKE256_ELL2_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>edwards448_XOF:SHAKE256_ELL2_NU_ is identical to edwards448_XOF:SHAKE256_ELL2_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>Optimized example implementations of the above mappings are given in <xreftarget="map-to-curve448" format="default"/>target="map-to-curve448"/> and <xreftarget="map-to-edwards448" format="default"/>.</t>target="map-to-edwards448"/>.</t> </section> <sectionanchor="suites-secp256k1" numbered="true" toc="default">anchor="suites-secp256k1"> <name>Suites for secp256k1</name> <t>This section defines ciphersuites for the secp256k1 elliptic curve <xreftarget="SEC2" format="default"/>.</t>target="SEC2"/>.</t> <t>secp256k1_XMD:SHA-256_SSWU_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li>E: y^2 = x^3 + 7</li> <li>p: 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1</li> <li>m: 1</li> <li>k: 128</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-256</li> <li>L: 48</li> <li>f: Simplified SWU for AB == 0 (<xreftarget="simple-swu-AB0" format="default"/>)</li>target="simple-swu-AB0"/>)</li> <li>Z: -11</li> <li> <t>E': y'^2 = x'^3 + A' * x' + B', where </t> <ul spacing="normal"> <li>A': 0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533</li> <li>B': 1771</li> </ul> </li> <li>iso_map: the 3-isogeny map from E' to E given in <xreftarget="appx-iso-secp256k1" format="default"/></li>target="appx-iso-secp256k1"/></li> <li>h_eff: 1</li> </ul> <t>secp256k1_XMD:SHA-256_SSWU_NU_ is identical to secp256k1_XMD:SHA-256_SSWU_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>An optimized example implementation of the Simplified SWU mapping to the curve E' isogenous to secp256k1 is given in <xreftarget="straightline-sswu" format="default"/>.</t>target="straightline-sswu"/>.</t> </section> <sectionanchor="suites-bls12381" numbered="true" toc="default">anchor="suites-bls12381"> <name>Suites for BLS12-381</name> <t>This section defines ciphersuites for groups G1 and G2 of the BLS12-381 elliptic curve <xreftarget="BLS12-381" format="default"/>. The curve parameters in this section match the ones listed in <xref target="I-D.irtf-cfrg-pairing-friendly-curves" format="default"/>, Appendix C.</t>target="BLS12-381"/>.</t> <sectionanchor="suites-bls12381-g1" numbered="true" toc="default">anchor="suites-bls12381-g1"> <name>BLS12-381 G1</name> <t>BLS12381G1_XMD:SHA-256_SSWU_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li>E: y^2 = x^3 + 4</li><li>p: 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab</li><li>p: 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab</li> <li>m: 1</li> <li>k: 128</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-256</li> <li>L: 64</li> <li>f: Simplified SWU for AB == 0 (<xreftarget="simple-swu-AB0" format="default"/>)</li>target="simple-swu-AB0"/>)</li> <li>Z: 11</li> <li> <t>E': y'^2 = x'^3 + A' * x' + B', where </t> <ul spacing="normal"><li>A' = 0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d</li> <li>B' = 0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0</li><li>A' = 0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d</li> <li>B' = 0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0</li> </ul> </li> <li>iso_map: the 11-isogeny map from E' to E given in <xreftarget="appx-iso-bls12381-g1" format="default"/></li>target="appx-iso-bls12381-g1"/></li> <li>h_eff: 0xd201000000010001</li> </ul> <t>BLS12381G1_XMD:SHA-256_SSWU_NU_ is identical to BLS12381G1_XMD:SHA-256_SSWU_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>Note that the h_eff values for these suites are chosen for compatibility with the fast cofactor clearing method described by Scott (<xreftarget="WB19" format="default"/>target="WB19"/>, Section 5).</t> <t>An optimized example implementation of the Simplified SWU mapping to the curve E' isogenous to BLS12-381 G1 is given in <xreftarget="straightline-sswu" format="default"/>.</t>target="straightline-sswu"/>.</t> </section> <sectionanchor="suites-bls12381-g2" numbered="true" toc="default">anchor="suites-bls12381-g2"> <name>BLS12-381 G2</name> <t>BLS12381G2_XMD:SHA-256_SSWU_RO_ is defined as follows:</t> <ul spacing="normal"> <li>encoding type: hash_to_curve (<xreftarget="roadmap" format="default"/>)</li>target="roadmap"/>)</li> <li>E: y^2 = x^3 + 4 * (1 + I)</li> <li> <t>base field F is GF(p^m), where </t> <ul spacing="normal"><li>p: 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab</li><li>p: 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab</li> <li>m: 2</li> <li>(1, I) is the basis for F, where I^2 + 1 == 0 in F</li> </ul> </li> <li>k: 128</li> <li>expand_message: expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)</li>target="hashtofield-expand-xmd"/>)</li> <li>H: SHA-256</li> <li>L: 64</li> <li>f: Simplified SWU for AB == 0 (<xreftarget="simple-swu-AB0" format="default"/>)</li>target="simple-swu-AB0"/>)</li> <li>Z: -(2 + I)</li> <li> <t>E': y'^2 = x'^3 + A' * x' + B', where </t> <ul spacing="normal"> <li>A' = 240 * I</li> <li>B' = 1012 * (1 + I)</li> </ul> </li> <li>iso_map: the isogeny map from E' to E given in <xreftarget="appx-iso-bls12381-g2" format="default"/></li> <li>h_eff: 0xbc69f08f2ee75b3584c6a0ea91b352888e2a8e9145ad7689986ff031508ffe1329c2f178731db956d82bf015d1212b02ec0ec69d7477c1ae954cbc06689f6a359894c0adebbf6b4e8020005aaa95551</li>target="appx-iso-bls12381-g2"/></li> <li>h_eff: 0xbc69f08f2ee75b3584c6a0ea91b352888e2a8e9145ad7689986ff031508ffe1329c2f178731db956d82bf015d1212b02ec0ec69d7477c1ae954cbc06689f6a359894c0adebbf6b4e8020005aaa95551</li> </ul> <t>BLS12381G2_XMD:SHA-256_SSWU_NU_ is identical to BLS12381G2_XMD:SHA-256_SSWU_RO_, except that the encoding type is encode_to_curve (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>Note that the h_eff values for these suites are chosen for compatibility with the fast cofactor clearing method described by Budroni and Pintore (<xreftarget="BP17" format="default"/>,target="BP17"/>, Section4.1),4.1) and are summarized in <xreftarget="clear-cofactor-bls12381-g2" format="default"/>.</t>target="clear-cofactor-bls12381-g2"/>.</t> <t>An optimized example implementation of the Simplified SWU mapping to the curve E' isogenous to BLS12-381 G2 is given in <xreftarget="straightline-sswu" format="default"/>.</t>target="straightline-sswu"/>.</t> </section> </section> <sectionanchor="new-suite" numbered="true" toc="default">anchor="new-suite"> <name>Defining anew hash-to-curve suite</name>New Hash-to-Curve Suite</name> <t>For elliptic curves not listed elsewhere in <xreftarget="suites" format="default"/>,target="suites"/>, a new hash-to-curve suite can be definedby:</t>by the following:</t> <ol spacing="normal"type="1"> <li>E,type="1"><li>E, F, p, and m are determined by the elliptic curve and its base field.</li> <li>k is an upper bound on the target security level of the suite (<xreftarget="security-considerations-targets" format="default"/>).target="security-considerations-targets"/>). A reasonable choice of k is ceil(log2(r) / 2), where r is the order of the subgroup G of the curve E (<xreftarget="bg-curves" format="default"/>).</li>target="bg-curves"/>).</li> <li>Choose encoding type, either hash_to_curve or encode_to_curve (<xreftarget="roadmap" format="default"/>).</li>target="roadmap"/>).</li> <li>Compute L as described in <xreftarget="hashtofield" format="default"/>.</li>target="hashtofield"/>.</li> <li>Choose an expand_message variant from <xreftarget="hashtofield-expand" format="default"/>target="hashtofield-expand"/> plus any underlying cryptographic primitives (e.g., a hash function H).</li> <li>Choose a mapping following the guidelines in <xreftarget="choosing-mapping" format="default"/>,target="choosing-mapping"/>, and select any required parameters for that mapping.</li> <li>Choose h_eff to be either the cofactor of E or, if a fast cofactor clearing method is to be used, a value appropriate to that method as discussed in <xreftarget="cofactor-clearing" format="default"/>.</li>target="cofactor-clearing"/>.</li> <li>Construct a Suite ID following the guidelines in <xreftarget="suiteIDformat" format="default"/>.</li>target="suiteIDformat"/>.</li> </ol> </section> <sectionanchor="suiteIDformat" numbered="true" toc="default">anchor="suiteIDformat"> <name>Suite IDnaming conventions</name>Naming Conventions</name> <t>Suite IDsMUST<bcp14>MUST</bcp14> be constructed as follows:</t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ CURVE_ID || "_" || HASH_ID || "_" || MAP_ID || "_" || ENC_VAR || "_" ]]></artwork> <t>The fields CURVE_ID, HASH_ID, MAP_ID, and ENC_VAR are ASCII-encoded strings of at most 64 characters each. FieldsMUST<bcp14>MUST</bcp14> contain only ASCII characters between 0x21 and 0x7E(inclusive)(inclusive), except that underscore (i.e.,0x5f)0x5F) is not allowed.</t> <t>As indicated above, each field (including the last) is followed by an underscore ("_", ASCII0x5f).0x5F). This helps to ensure that Suite IDs are prefix free. Suite IDsMUST<bcp14>MUST</bcp14> include the final underscore andMUST NOT<bcp14>MUST NOT</bcp14> include any characters after the final underscore.</t> <t>Suite ID fieldsMUST<bcp14>MUST</bcp14> be chosen as follows:</t> <ul spacing="normal"> <li>CURVE_ID: a human-readable representation of the target elliptic curve.</li> <li> <t>HASH_ID: a human-readable representation of the expand_message function and any underlying hash primitives used in hash_to_field (<xreftarget="hashtofield" format="default"/>).target="hashtofield"/>). This fieldMUST<bcp14>MUST</bcp14> be constructed as follows: </t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ EXP_TAG || ":" || HASH_NAME ]]></artwork> <t> EXP_TAG indicates the expand_message variant: </t> <ul spacing="normal"> <li>"XMD" for expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>).</li>target="hashtofield-expand-xmd"/>).</li> <li>"XOF" for expand_message_xof (<xreftarget="hashtofield-expand-xof" format="default"/>).</li>target="hashtofield-expand-xof"/>).</li> </ul> <t> HASH_NAME is a human-readable name for the underlying hash primitive. As examples: </t> <ol spacing="normal"type="1"> <li>Fortype="1"><li>For expand_message_xof (<xreftarget="hashtofield-expand-xof" format="default"/>)target="hashtofield-expand-xof"/>) with SHAKE128, HASH_ID is "XOF:SHAKE128".</li> <li>For expand_message_xmd (<xreftarget="hashtofield-expand-xmd" format="default"/>)target="hashtofield-expand-xmd"/>) with SHA3-256, HASH_ID is "XMD:SHA3-256".</li> </ol> <t> Suites that use an alternative hash_to_field function that meets the requirements in <xreftarget="hashtofield-exteff" format="default"/> MUSTtarget="hashtofield-exteff"/> <bcp14>MUST</bcp14> indicate this by appending a tag identifying that function to the HASH_ID field, separated by a colon (":", ASCII 0x3A).</t> </li> <li> <t>MAP_ID: a human-readable representation of the map_to_curve function as defined in <xreftarget="mappings" format="default"/>.target="mappings"/>. These are defined as follows: </t> <ul spacing="normal"> <li>"SVDW" fororShallue and van de Woestijne (<xreftarget="svdw" format="default"/>).</li>target="svdw"/>).</li> <li>"SSWU" for Simplified SWU(<xref target="simple-swu" format="default"/>,(Sections <xreftarget="simple-swu-AB0" format="default"/>).</li>format="counter" target="simple-swu"/> and <xref format="counter" target="simple-swu-AB0"/>).</li> <li>"ELL2" for Elligator 2(<xref target="elligator2" format="default"/>,(Sections <xref format="counter" target="elligator2"/> and <xreftarget="ell2edwards" format="default"/>).</li>format="counter" target="ell2edwards"/>).</li> </ul> </li> <li> <t>ENC_VAR: a string indicating the encoding type and other information. The first two characters of this string indicate whether the suite represents a hash_to_curve or an encode_to_curve operation (<xreftarget="roadmap" format="default"/>),target="roadmap"/>), as follows: </t> <ul spacing="normal"> <li>If ENC_VAR begins with "RO", the suite uses hash_to_curve.</li> <li>If ENC_VAR begins with "NU", the suite uses encode_to_curve.</li> <li>ENC_VARMUST NOT<bcp14>MUST NOT</bcp14> begin with any other string.</li> </ul> <t> ENC_VARMAY<bcp14>MAY</bcp14> also be used to encode other information used to identify variants, for example, a version number. TheRECOMMENDED<bcp14>RECOMMENDED</bcp14> way to do so is to add one or more subfields separated by colons. For example, "RO:V02" is an appropriate ENC_VAR value for the second version of a uniform encoding suite, while "RO:V02:FOO01:BAR17" might be used to indicate a variant of that suite.</t> </li> </ul> </section> </section> <sectionanchor="iana-considerations" numbered="true" toc="default">anchor="iana-considerations"> <name>IANAconsiderations</name>Considerations</name> <t>This document has no IANA actions.</t> </section> <sectionanchor="security-considerations" numbered="true" toc="default">anchor="security-considerations"> <name>Securityconsiderations</name>Considerations</name> <t>This section contains additional security considerations about the hash-to-curve mechanisms described in this document.</t> <sectionanchor="security-considerations-props" numbered="true" toc="default">anchor="security-considerations-props"> <name>Properties ofencodings</name>Encodings</name> <t>Each encoding type (<xreftarget="roadmap" format="default"/>)target="roadmap"/>) accepts an arbitrary byte string and maps it to a point on the curve sampled from a distribution that depends on the encoding type. It is important to note that using a nonuniform encoding or directly evaluating one of the mappings of <xreftarget="mappings" format="default"/>target="mappings"/> produces an output that is easily distinguished from a uniformly random point. Applications that use a nonuniform encodingSHOULD<bcp14>SHOULD</bcp14> carefully analyze the security implications of nonuniformity. When the required encoding is not clear, applicationsSHOULD<bcp14>SHOULD</bcp14> use a uniform encoding.</t> <t>Both encodings given in <xreftarget="roadmap" format="default"/>target="roadmap"/> can output the identity element of the group G. The probability that either encoding function outputs the identity element is roughly 1/r for a random input, which is negligible for cryptographically useful elliptic curves. Further, it is computationally infeasible to find an input to either encoding function whose corresponding output is the identity element. (Both of these properties hold when the encoding functions are instantiated with a hash_to_field function that follows all guidelines in <xreftarget="hashtofield" format="default"/>.)target="hashtofield"/>.) Protocols that use these encoding functionsSHOULD NOT<bcp14>SHOULD NOT</bcp14> add a special case to detect and "fix" the identity element.</t> <t>When the hash_to_curve function (<xreftarget="roadmap" format="default"/>)target="roadmap"/>) is instantiated with a hash_to_field function that is indifferentiable from a random oracle (<xreftarget="hashtofield" format="default"/>),target="hashtofield"/>), the resulting function is indifferentiable from a random oracle (<xreftarget="MRH04" format="default"/>,target="MRH04"/> <xreftarget="BCIMRT10" format="default"/>,target="BCIMRT10"/> <xreftarget="FFSTV13" format="default"/>,target="FFSTV13"/> <xreftarget="LBB19" format="default"/>,target="LBB19"/> <xreftarget="H20" format="default"/>).target="H20"/>). In manycasescases, such a function can be safely used in cryptographic protocols whose security analysis assumes a random oracle that outputs uniformly random points on an elliptic curve. As Ristenpart etal. discussal. discuss in <xreftarget="RSS11" format="default"/>,target="RSS11"/>, however, not all security proofs that rely on random oracles continue to hold when those oracles are replaced by indifferentiable functionalities. This limitation should be considered when analyzing the security of protocols relying on the hash_to_curve function.</t> </section> <sectionanchor="security-considerations-passwords" numbered="true" toc="default">anchor="security-considerations-passwords"> <name>Hashingpasswords</name>Passwords</name> <t>When hashing passwords using any function described in this document, an adversary who learns the output of the hash function (or potentially any intermediate value, e.g., the output of hash_to_field) may be able to carry out a dictionary attack. To mitigate such attacks, it is recommended to first execute a more costly key derivation function (e.g., PBKDF2 <xreftarget="RFC2898" format="default"/>,target="RFC8018"/>, scrypt <xreftarget="RFC7914" format="default"/>,target="RFC7914"/>, or Argon2 <xreftarget="I-D.irtf-cfrg-argon2" format="default"/>)target="RFC9106"/>) on the password, then hash the output of that function to the target elliptic curve. For collision resistance, the hash underlying the key derivation function should be chosen according to the guidelines listed in <xreftarget="hashtofield-expand-xmd" format="default"/>.</t>target="hashtofield-expand-xmd"/>.</t> </section> <sectionanchor="security-considerations-constant" numbered="true" toc="default"> <name>Constant-time requirements</name>anchor="security-considerations-constant"> <name>Constant-Time Requirements</name> <t>Constant-time implementations of all functions in this document are STRONGLYRECOMMENDED<bcp14>RECOMMENDED</bcp14> for all uses, to avoid leaking information via side channels. It is especially important to use a constant-time implementation when inputs to an encoding are secret values; in such cases, constant-time implementations areREQUIRED<bcp14>REQUIRED</bcp14> for security against timing attacks (e.g., <xreftarget="VR20" format="default"/>).target="VR20"/>). When constant-time implementations are required, all basic operations and utility functions must be implemented in constant time, as discussed in <xreftarget="utility" format="default"/>.target="utility"/>. In some applications (e.g., embedded systems), leakage through other side channels (e.g., power or electromagnetic side channels) may be pertinent. Defending against such leakage is outside the scope of this document, because the nature of the leakage and the appropriate defense depend on the application.</t> </section> <sectionanchor="security-considerations-encode" numbered="true" toc="default">anchor="security-considerations-encode"> <name>encode_to_curve:output distributionOutput Distribution andindifferentiability</name>Indifferentiability</name> <t>The encode_to_curve function (<xreftarget="roadmap" format="default"/>)target="roadmap"/>) returns points sampled from a distribution that is statistically far from uniform. This distribution is bounded roughly as follows: first, it includes at least one eighth of the points in G, and second, the probability of points in the distribution varies by at most a factor of four. These bounds hold when encode_to_curve is instantiated with any of the map_to_curve functions in <xreftarget="mappings" format="default"/>.</t>target="mappings"/>.</t> <t>The bounds above are derived from several works in the literature. Specifically:</t> <ul spacing="normal"> <li>Shallue and van de Woestijne <xreftarget="SW06" format="default"/>target="SW06"/> and Fouque and Tibouchi <xreftarget="FT12" format="default"/>target="FT12"/> derive bounds on the Shallue-van de Woestijne mapping (<xreftarget="svdw" format="default"/>).</li>target="svdw"/>).</li> <li>Fouque and Tibouchi <xreftarget="FT10" format="default"/>target="FT10"/> and Tibouchi <xreftarget="T14" format="default"/>target="T14"/> derive bounds for the Simplified SWU mapping(<xref target="simple-swu" format="default"/>,(Sections <xref format="counter" target="simple-swu"/> and <xreftarget="simple-swu-AB0" format="default"/>).</li>format="counter" target="simple-swu-AB0"/>).</li> <li>Bernstein etal. <xref target="BHKL13" format="default"/>al. <xref target="BHKL13"/> derive bounds for the Elligator 2 mapping(<xref target="elligator2" format="default"/>,(Sections <xref format="counter" target="elligator2"/> and <xreftarget="ell2edwards" format="default"/>).</li>format="counter" target="ell2edwards"/>).</li> </ul> <t>Indifferentiability of encode_to_curve follows from an argument similar to the one given by Brier etal. <xref target="BCIMRT10" format="default"/>;al. <xref target="BCIMRT10"/>; we brieflysketch.sketch this argument as follows. Consider an ideal random oracle Hc() that samples from the distribution induced by the map_to_curve function called by encode_to_curve, and assume for simplicity that the target elliptic curve has cofactor 1 (a similar argument applies for non-unity cofactors). Indifferentiability holds just if it is possible to efficiently simulate the "inner" random oracle in encode_to_curve, namely, hash_to_field. The simulator works as follows: on a fresh query msg, the simulator queries Hc(msg) and receives a point P in the image of map_to_curve (if msg is the same as a prior query, the simulator just returns the value it gave in response to that query). The simulator then computes the possible preimages of P under map_to_curve, i.e., elements u of F such that map_to_curve(u) == P (Tibouchi <xreftarget="T14" format="default"/>target="T14"/> shows that this can be done efficiently for the Shallue-van de Woestijne and Simplified SWU maps, and Bernstein etal. showal. show the same for Elligator 2). The simulator selects one such preimage at random and returns this value as the simulated output of the "inner" random oracle. By hypothesis, Hc() samples from the distribution induced by map_to_curve on a uniformly random input element of F, so this value is uniformly random and induces the correct point P when passed through map_to_curve.</t> </section> <sectionanchor="security-considerations-hash-to-field" numbered="true" toc="default">anchor="security-considerations-hash-to-field"> <name>hash_to_fieldsecurity</name>Security</name> <t>The hash_to_fieldfunctionfunction, defined in <xreftarget="hashtofield" format="default"/>target="hashtofield"/>, is indifferentiable from a random oracle <xreftarget="MRH04" format="default"/>target="MRH04"/> when expand_message (<xreftarget="hashtofield-expand" format="default"/>)target="hashtofield-expand"/>) is modeled as a random oracle.By composability ofSince indifferentiabilityproofs,proofs are composable, this also holds when expand_message is proved indifferentiable from a random oracle relative to an underlying primitive that is modeled as a random oracle. When following the guidelines in <xreftarget="hashtofield-expand" format="default"/>,target="hashtofield-expand"/>, both variants of expand_message defined in that section meet this requirement (see also <xreftarget="security-considerations-expand-xmd" format="default"/>).</t>target="security-considerations-expand-xmd"/>).</t> <t>We very briefly sketch the indifferentiability argument for hash_to_field. Notice that each integer mod p that hash_to_field returns (i.e., each element of the vector representation of F) is a member of an equivalence class of roughly 2^k integers of length log2(p) + k bits, all of which are equal modulo p. For each integer mod p that hash_to_field returns, the simulator samples one member of this equivalence class at random and outputs the byte string returned by I2OSP. (Notice that this is essentially the inverse of the hash_to_field procedure.)</t> </section> <sectionanchor="security-considerations-expand-xmd" numbered="true" toc="default">anchor="security-considerations-expand-xmd"> <name>expand_message_xmdsecurity</name>Security</name> <t>The expand_message_xmdfunctionfunction, defined in <xreftarget="hashtofield-expand-xmd" format="default"/>target="hashtofield-expand-xmd"/>, is indifferentiable from a random oracle <xreftarget="MRH04" format="default"/>target="MRH04"/> when one of the following holds:</t> <ol spacing="normal"type="1"> <li>Htype="1"><li>H is indifferentiable from a random oracle,</li> <li>H is a sponge-based hash function whose inner function is modeled as a random transformation or random permutation <xreftarget="BDPV08" format="default"/>,target="BDPV08"/>, or</li> <li>H is a Merkle-Damgaard hash function whose compression function is modeled as a random oracle <xreftarget="CDMP05" format="default"/>.</li>target="CDMP05"/>.</li> </ol> <t>For cases (1) and (2), the indifferentiability of expand_message_xmd follows directly from the indifferentiability of H.</t> <t>For case (3), i.e.,forwhere H is a Merkle-Damgaard hash function, indifferentiability follows from <xreftarget="CDMP05" format="default"/>,target="CDMP05"/>, Theorem3.5.5. In particular, expand_message_xmd computes b_0 by prefixing the message with one block of0-byteszeros plus auxiliary information (length, counter, and DST). Then, each of the output blocks b_i, i >= 1 in expand_message_xmd is the result of invoking H on a unique, prefix-free encoding of b_0. This is true,first,first because the length of the input to all such invocations is equal and fixed by the choice of H and DST, andsecond,second because each such input has a unique suffix (because of the inclusion of the counter byte I2OSP(i, 1)).</t> <t>The essential difference between the constructionofdiscussed in <xreftarget="CDMP05" format="default"/>target="CDMP05"/> and expand_message_xmd is that the latter hashes a counter appended to strxor(b_0, b_(i - 1))(step({#hashtofield-expand-xmd}, step 10) rather than to b_0. This approach increases the Hamming distance between inputs to different invocations of H, which reduces the likelihood that nonidealities in H affect the distribution of the b_i values.</t> <t>We note that expand_message_xmd can be used to instantiate a general-purpose indifferentiable functionality with variable-length output based on any hash function meeting one of the above criteria. Applications that use expand_message_xmd outside of hash_to_field should ensure domain separation by picking a distinct value for DST.</t> </section> <sectionanchor="security-considerations-domain-separation-expmsg-var" numbered="true" toc="default">anchor="security-considerations-domain-separation-expmsg-var"> <name>DomainseparationSeparation for expand_messagevariants</name>Variants</name> <t>As discussed in <xreftarget="term-domain-separation" format="default"/>,target="term-domain-separation"/>, the purpose of domain separation is to ensure that security analyses of cryptographic protocols that query multiple independent random oracles remain valid even if all of these random oracles are instantiated based on one underlying function H.</t> <t>The expand_message variants in this document (<xreftarget="hashtofield-expand" format="default"/>)target="hashtofield-expand"/>) ensure domain separation by appending a suffix-free-encoded domain separation tag DST_prime to all strings hashed by H, an underlying hash or extendable-output function. (Other expand_message variants that follow the guidelines in <xreftarget="hashtofield-expand-other" format="default"/>target="hashtofield-expand-other"/> are expected to behave similarly, but these should be analyzed on a case-by-case basis.) For security, applications that use the same function H outside of expand_message should enforce domain separation between those uses of H and expand_message, and they should separate all of these from uses of H in other applications.</t> <t>This section suggests four methods for enforcing domain separation from expand_message variants, explains how each method achieves domain separation, and lists the situations in which each is appropriate. These methods share a high-level structure: the application designer fixes a tag DST_ext distinct from DST_prime and augments calls to H with DST_ext. Each method augments calls to H differently, and each may impose additional requirements on DST_ext.</t> <t>These methods can be used to instantiate multipledomain separateddomain-separated functions (e.g., H1 and H2) by selecting distinct DST_ext values for each (e.g., DST_ext1, DST_ext2).</t> <ol spacing="normal"type="1"> <li>type="1"><li> <t>(Suffix-only domain separation.) This method is useful whendomain separatingdomain-separating invocations of H from expand_message_xmd or expand_message_xof. It is not appropriate fordomain separatingdomain-separating expand_message from HMAC-H <xreftarget="RFC2104" format="default"/>;target="RFC2104"/>; for that purpose, see method 4. </t> <t> To instantiate a suffix-onlydomain separateddomain-separated function Hso, compute </t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ Hso(msg) = H(msg || DST_ext) ]]></artwork> <t> DST_ext should be suffix-free encoded (e.g., by appending one byte encoding the length of DST_ext) to make it infeasible to find distinct (msg, DST_ext) pairs that hash to the same value. </t> <t> This method ensures domain separation because all distinct invocations of H have distinct suffixes, since DST_ext is distinct from DST_prime.</t> </li> <li> <t>(Prefix-suffix domain separation.) This method can be used in the same cases as the suffix-only method. </t> <t> To instantiate a prefix-suffixdomain separateddomain-separated function Hps, compute </t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ Hps(msg) = H(DST_ext || msg || I2OSP(0, 1)) ]]></artwork> <t> DST_ext should be prefix-free encoded (e.g., by adding a one-byte prefix that encodes the length of DST_ext) to make it infeasible to find distinct (msg, DST_ext) pairs that hash to the same value. </t> <t> This method ensures domain separation because appending the byte I2OSP(0, 1) ensures that inputs to H inside Hps are distinct from those inside expand_message. Specifically, the final byte of DST_prime encodes the length of DST, which is required to be nonzero (<xreftarget="domain-separation" format="default"/>,target="domain-separation"/>, requirement 2), and DST_prime is always appended to invocations of H inside expand_message.</t> </li> <li> <t>(Prefix-only domain separation.) This method is only useful fordomain separatingdomain-separating invocations of H from expand_message_xmd. It does not give domain separation for expand_message_xof or HMAC-H. </t> <t> To instantiate a prefix-onlydomain separateddomain-separated function Hpo, compute </t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ Hpo(msg) = H(DST_ext || msg) ]]></artwork> <t> In order for this method to give domain separation, DST_ext should be at least b bits long, where b is the number of bits output by the hash function H. In addition, at least one of the first b bits must be nonzero. Finally, DST_ext should be prefix-free encoded (e.g., by adding a one-byte prefix that encodes the length of DST_ext) to make it infeasible to find distinct (msg, DST_ext) pairs that hash to the same value. </t> <t> This method ensures domain separation as follows. First, since DST_ext contains at least one nonzero bit among its first b bits, it is guaranteed to be distinct from the value Z_pad (<xreftarget="hashtofield-expand-xmd" format="default"/>,target="hashtofield-expand-xmd"/>, step 4), which ensures that all inputs to H are distinct from the input used to generate b_0 in expand_message_xmd. Second, since DST_ext is at least b bits long, it is almost certainly distinct from the values b_0 and strxor(b_0, b_(i - 1)), and therefore all inputs to H are distinct from the inputs used to generate b_i, i >= 1, with high probability.</t> </li> <li> <t>(XMD-HMAC domain separation.) This method is useful fordomain separatingdomain-separating invocations of H inside HMAC-H (i.e., HMAC <xreftarget="RFC2104" format="default"/>target="RFC2104"/> instantiated with hash function H) from expand_message_xmd. It also applies to HKDF-H (i.e., HKDF <xreftarget="RFC5869" format="default"/>,target="RFC5869"/> instantiated with hash function H), as discussed below. </t> <t> Specifically, this method applies when HMAC-H is used with a non-secret key to instantiate a random oracle based on a hash function H (note that expand_message_xmd can also be used for this purpose; see <xreftarget="security-considerations-expand-xmd" format="default"/>).target="security-considerations-expand-xmd"/>). When using HMAC-H with a high-entropy secret key, domain separation is not necessary; see discussion below. </t> <t> To choose a non-secret HMAC key DST_key that ensures domain separation from expand_message_xmd, compute </t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ DST_key_preimage = "DERIVE-HMAC-KEY-" || DST_ext || I2OSP(0, 1) DST_key = H(DST_key_preimage) ]]></artwork> <t> Then, to instantiate the random oracle Hro using HMAC-H, compute </t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ Hro(msg) = HMAC-H(DST_key, msg) ]]></artwork> <t> The trailing zero byte in DST_key_preimage ensures that this value is distinct from inputs to H inside expand_message_xmd (because all such inputs have suffix DST_prime, which cannot end with a zero byte as discussed above). This ensures domain separation because, with overwhelming probability, all inputs to H inside of HMAC-H using key DST_key have prefixes that are distinct from the values Z_pad, b_0, and strxor(b_0, b_(i - 1)) inside of expand_message_xmd. </t> <t> For uses of HMAC-H that instantiate a private random oracle by fixing a high-entropy secret key, domain separation from expand_message_xmd is not necessary. This is because, similarly to the case above, all inputs to H inside HMAC-H using this secret key almost certainly have distinct prefixes from all inputs to H inside expand_message_xmd. </t> <t> Finally, this method can be used with HKDF-H <xreftarget="RFC5869" format="default"/>target="RFC5869"/> by fixing the salt input to HKDF-Extract to DST_key, computed as above. This ensures domain separation for HKDF-Extract by the same argument as for HMAC-H using DST_key. Moreover, assuming that theIKMinput keying material (IKM) supplied to HKDF-Extract has sufficiently high entropy (say, commensurate with the security parameter), the HKDF-Expand step isdomain separateddomain-separated by the same argument as for HMAC-H with a high-entropy secret key (sincePRKa pseudorandom key is exactly that).</t> </li> </ol> </section> <sectionanchor="security-considerations-targets" numbered="true" toc="default">anchor="security-considerations-targets"> <name>Targetsecurity levels</name>Security Levels</name> <t>Each ciphersuite specifies a target security level (in bits) for the underlying curve. This parameter ensures the corresponding hash_to_field instantiation is conservative and correct. We stress that this parameter is only an upper bound on the security level of thecurve,curve and is neither a guarantee nor endorsement of its suitability for a given application. Mathematical and cryptographic advancements may reduce the effective security level for any curve.</t> </section> </section><section anchor="acknowledgements" numbered="true" toc="default"> <name>Acknowledgements</name> <t>The authors would like to thank Adam Langley for his detailed writeup of Elligator 2 with Curve25519 <xref target="L13" format="default"/>; Dan Boneh, Christopher Patton, Benjamin Lipp, and Leonid Reyzin for educational discussions; and David Benjamin, Daniel Bourdrez, Frank Denis, Sean Devlin, Justin Drake, Bjoern Haase, Mike Hamburg, Dan Harkins, Daira Hopwood, Thomas Icart, Andy Polyakov, Thomas Pornin, Mamy Ratsimbazafy, Michael Scott, Filippo Valsorda, and Mathy Vanhoef for helpful reviews and feedback.</t> </section> <section anchor="contributors" numbered="true" toc="default"> <name>Contributors</name> <ul spacing="normal"> <li>Sharon Goldberg, Boston University (goldbe@cs.bu.edu)</li> <li>Ela Lee, Royal Holloway, University of London (Ela.Lee.2010@live.rhul.ac.uk)</li> <li>Michele Orru (michele.orru@ens.fr)</li> </ul> </section></middle> <back> <displayreference target="I-D.irtf-cfrg-bls-signature" to="BLS-SIG" /> <displayreference target="I-D.irtf-cfrg-vrf" to="VRF" /> <displayreference target="I-D.irtf-cfrg-voprf" to="OPRFs" /> <displayreference target="I-D.irtf-cfrg-ristretto255-decaf448" to="ristretto255-decaf448" /> <references> <name>References</name> <references> <name>Normative References</name> <referenceanchor="EID4730"anchor="Err4730" target="https://www.rfc-editor.org/errata/eid4730"> <front><title>RFC 7748, Errata<title>Erratum ID 4730</title><author initials="A." surname="Langley" fullname="Adam Langley"> <organization/><author> <organization>RFC Errata</organization> </author> <date year="2016" month="July"/> </front> <refcontent>RFC 7748</refcontent> </reference><reference anchor="RFC2119"> <front> <title>Key words for use in RFCs to Indicate Requirement Levels</title> <seriesInfo name="DOI" value="10.17487/RFC2119"/> <seriesInfo name="RFC" value="2119"/> <seriesInfo name="BCP" value="14"/> <author fullname="S. Bradner" initials="S." surname="Bradner"> <organization/> </author> <date month="March" year="1997"/> <abstract> <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t> </abstract> </front> </reference> <reference anchor="RFC8174"> <front> <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title> <seriesInfo name="DOI" value="10.17487/RFC8174"/> <seriesInfo name="RFC" value="8174"/> <seriesInfo name="BCP" value="14"/> <author fullname="B. Leiba" initials="B." surname="Leiba"> <organization/> </author> <date month="May" year="2017"/> <abstract> <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t> </abstract> </front> </reference> <reference anchor="RFC8017"> <front> <title>PKCS #1: RSA Cryptography Specifications Version 2.2</title> <seriesInfo name="DOI" value="10.17487/RFC8017"/> <seriesInfo name="RFC" value="8017"/> <author fullname="K. Moriarty" initials="K." role="editor" surname="Moriarty"> <organization/> </author> <author fullname="B. Kaliski" initials="B." surname="Kaliski"> <organization/> </author> <author fullname="J. Jonsson" initials="J." surname="Jonsson"> <organization/> </author> <author fullname="A. Rusch" initials="A." surname="Rusch"> <organization/> </author> <date month="November" year="2016"/> <abstract> <t>This document provides recommendations for the implementation of public-key cryptography based on the RSA algorithm, covering cryptographic primitives, encryption schemes, signature schemes with appendix, and ASN.1 syntax for representing keys and for identifying the schemes.</t> <t>This document represents a republication of PKCS #1 v2.2 from RSA Laboratories' Public-Key Cryptography Standards (PKCS) series. By publishing this RFC, change control is transferred to the IETF.</t> <t>This document also obsoletes RFC 3447.</t> </abstract> </front> </reference> <reference anchor="RFC7748"> <front> <title>Elliptic Curves for Security</title> <seriesInfo name="DOI" value="10.17487/RFC7748"/> <seriesInfo name="RFC" value="7748"/> <author fullname="A. Langley" initials="A." surname="Langley"> <organization/> </author> <author fullname="M. Hamburg" initials="M." surname="Hamburg"> <organization/> </author> <author fullname="S. Turner" initials="S." surname="Turner"> <organization/> </author> <date month="January" year="2016"/> <abstract> <t>This memo specifies two elliptic curves over prime fields that offer a high level of practical security in cryptographic applications, including Transport Layer Security (TLS). These curves are intended to operate at the ~128-bit and ~224-bit security level, respectively, and are generated deterministically based on a list of required properties.</t> </abstract> </front> </reference> <reference anchor="I-D.irtf-cfrg-pairing-friendly-curves"> <front> <title>Pairing-Friendly Curves</title> <seriesInfo name="Internet-Draft" value="draft-irtf-cfrg-pairing-friendly-curves-10"/> <author fullname="Yumi Sakemi"> <organization>Infours</organization> </author> <author fullname="Tetsutaro Kobayashi"> <organization>NTT</organization> </author> <author fullname="Tsunekazu Saito"> <organization>NTT</organization> </author> <author fullname="Riad S. Wahby"> <organization>Stanford University</organization> </author> <date day="30" month="July" year="2021"/> <abstract> <t> Pairing-based cryptography, a subfield of elliptic curve cryptography, has received attention due to its flexible and practical functionality. Pairings are special maps defined using elliptic curves and it can be applied to construct several cryptographic protocols such as identity-based encryption, attribute- based encryption, and so on. At CRYPTO 2016, Kim and Barbulescu proposed an efficient number field sieve algorithm named exTNFS for the discrete logarithm problem in a finite field. Several types of pairing-friendly curves such as Barreto-Naehrig curves are affected by the attack. In particular, a Barreto-Naehrig curve with a 254-bit characteristic was adopted by a lot of cryptographic libraries as a parameter of 128-bit security, however, it ensures no more than the 100-bit security level due to the effect of the attack. In this memo, we list the security levels of certain pairing-friendly curves, and motivate our choices of curves. First, we summarize the adoption status of pairing-friendly curves in standards, libraries and applications, and classify them in the 128-bit, 192-bit, and 256-bit security levels. Then, from the viewpoints of "security" and "widely used", we select the recommended pairing-friendly curves considering exTNFS. </t> </abstract> </front> </reference><xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8017.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7748.xml"/> </references> <references> <name>Informative References</name> <reference anchor="BLS12-381" target="https://electriccoin.co/blog/new-snark-curve/"> <front> <title>BLS12-381: New zk-SNARK Elliptic Curve Construction</title> <author initials="S." surname="Bowe" fullname="Sean Bowe"> <organization>Electric Coin Company</organization> </author> <date year="2017" month="March"/> </front> </reference> <reference anchor="BR93" target="https://doi.org/10.1145/168588.168596"> <front> <title>Random oracles are practical: a paradigm for designing efficient protocols</title><seriesInfo name="DOI" value="10.1145/168588.168596"/> <seriesInfo name="pages" value="62-73"/> <seriesInfo name="In" value="Proceedings of the 1993 ACM Conference on Computer and Communications Security"/><author initials="M." surname="Bellare" fullname="Mihir Bellare"> <organization>UC San Diego</organization> </author> <author initials="P." surname="Rogaway" fullname="Phillip Rogaway"> <organization>UC Davis</organization> </author> <date year="1993" month="December"/> </front> <refcontent>In Proceedings of the 1993 ACM Conference on Computer and Communications Security, pages 62-73</refcontent> <seriesInfo name="DOI" value="10.1145/168588.168596"/> </reference> <reference anchor="SEC1" target="http://www.secg.org/sec1-v2.pdf"> <front> <title>SEC 1: Elliptic Curve Cryptography</title> <author> <organization>Standards for Efficient Cryptography Group (SECG)</organization> </author> <date year="2009" month="May"/> </front> </reference> <reference anchor="SEC2" target="http://www.secg.org/sec2-v2.pdf"> <front> <title>SEC 2: Recommended Elliptic Curve Domain Parameters</title> <author> <organization>Standards for Efficient Cryptography Group (SECG)</organization> </author> <date year="2010" month="January"/> </front> </reference> <reference anchor="FIPS180-4" target="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf"> <front> <title>Secure Hash Standard (SHS)</title> <author> <organization>National Institute of Standards and Technology (NIST)</organization> </author> <date year="2015" month="August"/> </front> <seriesInfo name="FIPS" value="180-4"/> <seriesInfo name="DOI" value="10.6028/NIST.FIPS.180-4"/> </reference> <reference anchor="FIPS186-4" target="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.186-4.pdf"> <front><title>FIPS Publication 186-4: Digital<title>Digital SignatureStandard</title>Standard (DSS)</title> <author> <organization>National Institute of Standards and Technology (NIST)</organization> </author> <date year="2013" month="July"/> </front> <seriesInfo name="FIPS" value="186-4"/> <seriesInfo name="DOI" value="10.6028/NIST.FIPS.186-4"/> </reference> <reference anchor="FIPS202" target="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf"> <front> <title>SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions</title> <author> <organization>National Institute of Standards and Technology (NIST)</organization> </author> <date year="2015" month="August"/> </front> <seriesInfo name="FIPS" value="202"/> <seriesInfo name="DOI" value="10.6028/NIST.FIPS.202"/> </reference> <reference anchor="BDPV08" target="https://doi.org/10.1007/978-3-540-78967-3_11"> <front> <title>On the Indifferentiability of the Sponge Construction</title><seriesInfo name="DOI" value="10.1007/978-3-540-78967-3_11"/> <seriesInfo name="pages" value="181-197"/> <seriesInfo name="In" value="Advances in Cryptology - EUROCRYPT 2008"/><author initials="G."surname="Bertoni,"surname="Bertoni" fullname="Guido Bertoni"> <organization>STMicroelectronics</organization> </author> <author initials="J." surname="Daemen" fullname="Joan Daemen"> <organization>STMicroelectronics</organization> </author> <author initials="M." surname="Peeters" fullname="Michael Peeters"> <organization>NXP Semiconductors</organization> </author> <author initials="G." surname="Van Assche" fullname="Gilles Van Assche"> <organization>STMicroelectronics</organization> </author> <dateyear="2008"/>year="2008" month="April"/> </front> <refcontent>In Advances in Cryptology - EUROCRYPT 2008, pages 181-197</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-540-78967-3_11"/> </reference> <reference anchor="CDMP05" target="https://doi.org/10.1007/11535218_26"> <front><title>Merkle-Damgaard<title>Merkle-Damgård Revisited: How to Construct a Hash Function</title><seriesInfo name="DOI" value="10.1007/11535218_26"/> <seriesInfo name="pages" value="430-448"/> <seriesInfo name="In" value="Advances in Cryptology - CRYPTO 2005"/><authorinitials="J-S."initials="J.-S." surname="Coron" fullname="Jean-Sebastien Coron"> <organization>University of Luxembourg</organization> </author> <author initials="Y." surname="Dodis" fullname="Yevgeniy Dodis"> <organization>New York University</organization> </author> <author initials="C." surname="Malinaud" fullname="Cecile Malinaud"> <organization>University of Luxembourg</organization> </author> <author initials="P." surname="Puniya" fullname="Prashant Puniya"> <organization>New York University</organization> </author> <dateyear="2005"/>year="2005" month="August"/> </front> <refcontent>In Advances in Cryptology -- CRYPTO 2005, pages 430-448</refcontent> <seriesInfo name="DOI" value="10.1007/11535218_26"/> </reference> <reference anchor="BLAKE2X" target="https://blake2.net/blake2x.pdf"> <front> <title>BLAKE2X</title> <authorinitials="J-P."initials="J.-P." surname="Aumasson" fullname="Jean-Philippe Aumasson"> <organization/> </author> <author initials="S." surname="Neves" fullname="Samuel Neves"> <organization/> </author> <author initials="Z." surname="Wilcox-O'Hearn" fullname="Zooko Wilcox-O'Hearn"> <organization/> </author> <author initials="C." surname="Winnerlein" fullname="Christian Winnerlein"> <organization/> </author> <date year="2016" month="December"/> </front> </reference> <reference anchor="Icart09" target="https://doi.org/10.1007/978-3-642-03356-8_18"> <front> <title>How to Hash into Elliptic Curves</title><seriesInfo name="DOI" value="10.1007/978-3-642-03356-8_18"/> <seriesInfo name="pages" value="303-316"/> <seriesInfo name="In" value="Advances in Cryptology - CRYPTO 2009"/><author initials="T." surname="Icart" fullname="Thomas Icart"> <organization>Sagem Securite and Universite du Luxembourg</organization> </author> <dateyear="2009"/>year="2009" month="August"/> </front> <refcontent>In Advances in Cryptology - CRYPTO 2009, pages 303-316</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-03356-8_18"/> </reference> <reference anchor="BBJLP08" target="https://doi.org/10.1007/978-3-540-68164-9_26"> <front> <title>Twisted Edwardscurves</title> <seriesInfo name="DOI" value="10.1007/978-3-540-68164-9_26"/> <seriesInfo name="pages" value="389-405"/> <seriesInfo name="In" value="AFRICACRYPT 2008"/>Curves</title> <authorinitials="D.J."initials="D. J." surname="Bernstein" fullname="Daniel J. Bernstein"> <organization>Department of Computer Science, University of Illinois at Chicago, USA</organization> </author> <author initials="P." surname="Birkner" fullname="Peter Birkner"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <author initials="M." surname="Joye" fullname="Marc Joye"> <organization>Thomson R&D France</organization> </author> <author initials="T." surname="Lange" fullname="Tanja Lange"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <author initials="C." surname="Peters" fullname="Christiane Peters"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <dateyear="2008"/>year="2008" month="June"/> </front> <refcontent>In AFRICACRYPT 2008, pages 389-405</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-540-68164-9_26"/> </reference> <reference anchor="CK11" target="https://doi.org/10.1016/j.jsc.2011.11.003"> <front> <title>The geometry of flex tangents to a cubic curve and its parameterizations</title><seriesInfo name="DOI" value="10.1016/j.jsc.2011.11.003"/> <seriesInfo name="pages" value="266-281"/> <seriesInfo name="In" value="Journal of Symbolic Computation, vol 47 issue 3"/><authorinitials="J."initials="J.-M." surname="Couveignes" fullname="Jean-Marc Couveignes"> <organization>Universite Bordeaux</organization> </author> <authorinitials="J."initials="J.-G." surname="Kammerer" fullname="Jean-Gabriel Kammerer"> <organization>Universite de Rennes</organization> </author> <dateyear="2012"/>year="2012" month="March"/> </front> <refcontent>In Journal of Symbolic Computation, vol 47 issue 3, pages 266-281</refcontent> <seriesInfo name="DOI" value="10.1016/j.jsc.2011.11.003"/> </reference> <reference anchor="VR20" target="https://eprint.iacr.org/2019/383"> <front> <title>Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd</title><seriesInfo name="In" value="IEEE Symposium on Security & Privacy (SP)"/><author initials="M." surname="Vanhoef" fullname="Mathy Vanhoef"> <organization>New York University Abu Dhabi</organization> </author> <author initials="E." surname="Ronen" fullname="Eyal Ronen"> <organization>Tel Aviv University and KU Leuven</organization> </author> <dateyear="2020"/>year="2020" month="May"/> </front> <refcontent>In IEEE Symposium on Security & Privacy (SP)</refcontent> </reference> <reference anchor="F11" target="https://doi.org/10.1007/978-3-642-21969-6_17"> <front> <title>Hashing into Hessiancurves</title> <seriesInfo name="DOI" value="10.1007/978-3-642-21969-6_17"/> <seriesInfo name="pages" value="278-289"/> <seriesInfo name="In" value="AFRICACRYPT 2011"/>Curves</title> <authorinitials="R.R."initials="R. R." surname="Farashahi" fullname="Reza R. Farashahi"> <organization>Macquarie Universit</organization> </author> <dateyear="2011"/>year="2011" month="July"/> </front> <refcontent>In AFRICACRYPT 2011, pages 278-289</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-21969-6_17"/> </reference> <reference anchor="FSV09" target="https://doi.org/10.1515/JMC.2009.022"> <front> <title>On hashing into elliptic curves</title><seriesInfo name="DOI" value="10.1515/JMC.2009.022"/> <seriesInfo name="pages" value="353-360"/> <seriesInfo name="In" value="Journal of Mathematical Cryptology, vol 3 no 4"/><authorinitials="R.R."initials="R. R." surname="Farashahi" fullname="Reza R. Farashahi"> <organization>Macquarie Universit</organization> </author> <authorinitials="I.E."initials="I. E." surname="Shparlinski" fullname="Igor E. Shparlinski"> <organization>Macquarie Universit</organization> </author> <authorinitials="J.F."initials="J. F." surname="Voloch" fullname="J. Felipe Voloch"> <organization>University of Texas</organization> </author> <dateyear="2009"/>year="2009" month="March"/> </front> <refcontent>In Journal of Mathematical Cryptology, vol 3 no 4, pages 353-360</refcontent> <seriesInfo name="DOI" value="10.1515/JMC.2009.022"/> </reference> <reference anchor="FT10" target="https://doi.org/10.1007/978-3-642-14712-8_5"> <front> <title>Estimating thesizeSize of theimageImage ofdeterministic hash functionsDeterministic Hash Functions toelliptic curves.</title> <seriesInfo name="DOI" value="10.1007/978-3-642-14712-8_5"/> <seriesInfo name="pages" value="81-91"/> <seriesInfo name="In" value="Progress in Cryptology - LATINCRYPT 2010"/>Elliptic Curves</title> <authorinitials="P-A."initials="P.-A." surname="Fouque" fullname="Pierre-Alain Fouque"> <organization>Ecole Normale Superieure and INRIA Rennes</organization> </author> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>NTT Secure Platform Laboratories</organization> </author> <dateyear="2010"/>year="2010" month="August"/> </front> <refcontent>In Progress in Cryptology - LATINCRYPT 2010, pages 81-91</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-14712-8_5"/> </reference> <reference anchor="FT12" target="https://doi.org/10.1007/978-3-642-33481-8_1"> <front> <title>Indifferentiable Hashing toBarreto-NaehrigBarreto--Naehrig Curves</title><seriesInfo name="DOI" value="10.1007/978-3-642-33481-8_1"/> <seriesInfo name="pages" value="1-7"/> <seriesInfo name="In" value="Progress in Cryptology - LATINCRYPT 2012"/><authorinitials="P-A."initials="P.-A." surname="Fouque" fullname="Pierre-Alain Fouque"> <organization>Ecole Normale Superieure and INRIA Rennes</organization> </author> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>NTT Secure Platform Laboratories</organization> </author> <date year="2012"/> </front> <refcontent>In Progress in Cryptology - LATINCRYPT 2012, pages 1-17</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-33481-8_1"/> </reference> <reference anchor="FJT13" target="https://doi.org/10.1007/978-3-642-39059-3_14"> <front> <title>InjectiveencodingsEncodings toelliptic curves</title> <seriesInfo name="DOI" value="10.1007/978-3-642-39059-3_14"/> <seriesInfo name="pages" value="203-218"/> <seriesInfo name="In" value="ACISP 2013"/>Elliptic Curves</title> <authorinitials="P-A."initials="P.-A." surname="Fouque" fullname="Pierre-Alain Fouque"> <organization>Ecole Normale Superieure and INRIA Rennes</organization> </author> <author initials="A." surname="Joux" fullname="Antoine Joux"> <organization>Sorbonne Universite</organization> </author> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>NTT Secure Platform Laboratories</organization> </author> <date year="2013"/> </front> <refcontent>In ACISP 2013, pages 203-218</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-39059-3_14"/> </reference> <reference anchor="KLR10" target="https://doi.org/10.1007/978-3-642-17455-1_18"> <front> <title>EncodingpointsPoints onhyperelliptic curvesHyperelliptic Curves overfinite fieldsFinite Fields indeterministic polynomial time</title> <seriesInfo name="DOI" value="10.1007/978-3-642-17455-1_18"/> <seriesInfo name="pages" value="278-297"/> <seriesInfo name="In" value="PAIRING 2010"/>Deterministic Polynomial Time</title> <authorinitials="J."initials="J.-G." surname="Kammerer" fullname="Jean-Gabriel Kammerer"> <organization>Universite de Rennes</organization> </author> <author initials="R." surname="Lercier" fullname="Reynald Lercier"> <organization>Universite de Rennes</organization> </author> <author initials="G." surname="Renault" fullname="Guenael Renault"> <organization>Universite Pierre et Marie Curie</organization> </author> <date year="2010"/> </front> <refcontent>In Pairing-Based Cryptography - Pairing 2010, pages 278-297</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-17455-1_18"/> </reference> <reference anchor="AR13" target="https://doi.org/10.1109/TC.2013.145"> <front> <title>Square Root Computation over Even Extension Fields</title><seriesInfo name="DOI" value="10.1109/TC.2013.145"/> <seriesInfo name="pages" value="2829-2841"/> <seriesInfo name="In" value="IEEE Transactions on Computers. vol 63 issue 11"/><author initials="G." surname="Adj" fullname="Gora Adj"> <organization>ISFA, Universite Claude Bernard Lyon 1, Villeurbanne, France</organization> </author> <author initials="F."surname="Rodriguez-Henriquez"surname="Rodríguez-Henríquez" fullname="FranciscoRodriguez-Henriquez">Rodríguez-Henríquez"> <organization>CINVESTAV-IPN, San Pedro Zacatenco, Mexico City, Mexico.</organization> </author> <date year="2014" month="November"/> </front> <refcontent>In IEEE Transactions on Computers. vol 63 issue 11, pages 2829-2841</refcontent> <seriesInfo name="DOI" value="10.1109/TC.2013.145"/> </reference> <reference anchor="BN05" target="https://doi.org/10.1007/11693383_22"> <front> <title>Pairing-Friendly Elliptic Curves of Prime Order</title><seriesInfo name="DOI" value="10.1007/11693383_22"/> <seriesInfo name="pages" value="319-331"/> <seriesInfo name="In" value="Selected Areas in Cryptography 2005"/><authorinitials="P."initials="P. S. L. M." surname="Barreto" fullname="Paulo S. L. M. Barreto"> <organization>Escola Politecnica, Universidade de Sao Paulo, Sao Paulo, Brazil</organization> </author> <author initials="M." surname="Naehrig" fullname="Michael Naehrig"> <organization>Lehrstuhl fur Theoretische Informationstechnik, Rheinisch-Westfalische Technische Hochschule Aachen, Aachen, Germany</organization> </author> <date year="2006"/> </front> <refcontent>In Selected Areas in Cryptography 2005, pages 319-331</refcontent> <seriesInfo name="DOI" value="10.1007/11693383_22"/> </reference> <reference anchor="AFQTZ14" target="https://doi.org/10.1007/978-3-319-13051-4_2"> <front> <title>Binary Elligatorsquared</title> <seriesInfo name="DOI" value="10.1007/978-3-319-13051-4_2"/> <seriesInfo name="pages" value="20-37"/> <seriesInfo name="In" value="Selected Areas in Cryptography - SAC 2014"/>Squared</title> <authorinitials="D.F."initials="D. F." surname="Aranha" fullname="Diego F. Aranha"> <organization>Institute of Computing, University of Campinas</organization> </author> <authorinitials="P.A."initials="P.-A." surname="Fouque" fullname="Pierre-Alain Fouque"> <organization>Universite de Rennes 1 and Institut Universitaire de France</organization> </author> <author initials="C." surname="Qian" fullname="Chen Qian"> <organization>ENS Rennes</organization> </author> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>NTT Secure Platform Laboratories</organization> </author> <authorinitials="J.C."initials="J. C." surname="Zapalowicz" fullname="Jean-Christophe Zapalowicz"> <organization>INRIA</organization> </author> <dateyear="2014"/>year="2014" month="November"/> </front> <refcontent>In Selected Areas in Cryptography - SAC 2014, pages 20-37</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-319-13051-4_2"/> </reference> <reference anchor="T14" target="https://doi.org/10.1007/978-3-662-45472-5_10"> <front> <title>Elligatorsquared:Squared: UniformpointsPoints onelliptic curvesElliptic Curves ofprime orderPrime Order asuniform random strings</title> <seriesInfo name="DOI" value="10.1007/978-3-662-45472-5_10"/> <seriesInfo name="pages" value="139-156"/> <seriesInfo name="In" value="Financial Cryptography and Data Security - FC 2014"/>Uniform Random Strings</title> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>NTT Secure Platform Laboratories</organization> </author> <dateyear="2014"/>year="2014" month="November"/> </front> <refcontent>In Financial Cryptography and Data Security - FC 2014, pages 139-156</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-662-45472-5_10"/> </reference> <reference anchor="TK17" target="https://doi.org/10.1007/s10623-016-0288-2"> <front> <title>Improved elliptic curve hashing and point representation</title><seriesInfo name="DOI" value="10.1007/s10623-016-0288-2"/> <seriesInfo name="pages" value="161-177"/> <seriesInfo name="In" value="Designs, Codes, and Cryptography, vol 82"/><author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>NTT Secure Platform Laboratories</organization> </author> <author initials="T." surname="Kim" fullname="Taechan Kim"> <organization>NTT Secure Platform Laboratories</organization> </author> <dateyear="2017"/>year="2017" month="January"/> </front> <refcontent>In Designs, Codes, and Cryptography, vol 82, pages 161-177</refcontent> <seriesInfo name="DOI" value="10.1007/s10623-016-0288-2"/> </reference> <reference anchor="BF01" target="https://doi.org/10.1007/3-540-44647-8_13"> <front><title>Identity-based encryption<title>Identity-Based Encryption from the Weilpairing</title> <seriesInfo name="DOI" value="10.1007/3-540-44647-8_13"/> <seriesInfo name="pages" value="213-229"/> <seriesInfo name="In" value="Advances in Cryptology - CRYPTO 2001"/>Pairing</title> <author initials="D." surname="Boneh" fullname="Dan Boneh"> <organization>Stanford University</organization> </author> <author initials="M." surname="Franklin" fullname="Matthew Franklin"> <organization>UC Davis</organization> </author> <date year="2001" month="August"/> </front> <refcontent>In Advances in Cryptology - CRYPTO 2001, pages 213-229</refcontent> <seriesInfo name="DOI" value="10.1007/3-540-44647-8_13"/> </reference> <reference anchor="BLS01" target="https://doi.org/10.1007/s00145-004-0314-9"> <front> <title>ShortsignaturesSignatures from the Weilpairing</title> <seriesInfo name="DOI" value="10.1007/s00145-004-0314-9"/> <seriesInfo name="pages" value="297-319"/> <seriesInfo name="In" value="Journal of Cryptology, vol 17"/>Pairing</title> <author initials="D." surname="Boneh" fullname="Dan Boneh"> <organization>Stanford University</organization> </author> <author initials="B." surname="Lynn" fullname="Ben Lynn"> <organization>Stanford University</organization> </author> <author initials="H." surname="Shacham" fullname="Hovav Shacham"> <organization>Stanford University</organization> </author> <date year="2004" month="July"/> </front> <refcontent>In Journal of Cryptology, vol 17, pages 297-319</refcontent> <seriesInfo name="DOI" value="10.1007/s00145-004-0314-9"/> </reference> <reference anchor="BLS03" target="https://doi.org/10.1007/3-540-36413-7_19"> <front> <title>Constructing Elliptic Curves with Prescribed Embedding Degrees</title><seriesInfo name="DOI" value="10.1007/3-540-36413-7_19"/> <seriesInfo name="pages" value="257-267"/> <seriesInfo name="In" value="Security in Communication Networks"/><authorinitials="P."initials="P. S. L. M." surname="Barreto" fullname="Paulo S. L. M. Barreto"> <organization>Universidade de Sao Paulo, Brazil</organization> </author> <author initials="B." surname="Lynn" fullname="Ben Lynn"> <organization>Stanford University</organization> </author> <author initials="M." surname="Scott" fullname="Michael Scott"> <organization>Dublin City University, Ireland</organization> </author> <dateyear="2003"/>year="2002" month="September"/> </front> <refcontent>In Security in Communication Networks, pages 257-267</refcontent> <seriesInfo name="DOI" value="10.1007/3-540-36413-7_19"/> </reference> <reference anchor="BM92" target="https://doi.org/10.1109/RISP.1992.213269"> <front> <title>Encrypted key exchange:Password-basedpassword-based protocols secure against dictionary attacks</title><seriesInfo name="DOI" value="10.1109/RISP.1992.213269"/> <seriesInfo name="pages" value="72-84"/> <seriesInfo name="In" value="IEEE Symposium on Security and Privacy - Oakland 1992"/><authorinitials="S.M."initials="S. M." surname="Bellovin" fullname="Steven M. Bellovin"> <organization>AT&T Bell Laboratories</organization> </author> <author initials="M." surname="Merritt" fullname="Michael Merritt"> <organization>AT&T Bell Laboratories</organization> </author> <dateyear="1992"/>year="1992" month="May"/> </front> <refcontent>In IEEE Symposium on Security and Privacy - Oakland 1992, pages 72-84</refcontent> <seriesInfo name="DOI" value="10.1109/RISP.1992.213269"/> </reference> <reference anchor="BMP00" target="https://doi.org/10.1007/3-540-45539-6_12"> <front> <title>Provablysecure password-authenticated key exchange usingSecure Password-Authenticated Key Exchange Using Diffie-Hellman</title><seriesInfo name="DOI" value="10.1007/3-540-45539-6_12"/> <seriesInfo name="pages" value="156-171"/> <seriesInfo name="In" value="Advances in Cryptology - EUROCRYPT 2000"/><author initials="V." surname="Boyko" fullname="Victor Boyko"> <organization>MIT Laboratory for Computer Science</organization> </author> <authorinitials="P.D."initials="P." surname="MacKenzie" fullname="Philip D. MacKenzie"> <organization>Bell Laboratories, Lucent Technologies</organization> </author> <author initials="S." surname="Patel" fullname="Sarvar Patel"> <organization>Bell Laboratories, Lucent Technologies</organization> </author> <date year="2000" month="May"/> </front> <refcontent>In Advances in Cryptology - EUROCRYPT 2000, pages 156-171</refcontent> <seriesInfo name="DOI" value="10.1007/3-540-45539-6_12"/> </reference> <reference anchor="J96" target="https://doi.org/10.1145/242896.242897"> <front> <title>Strong password-only authenticated key exchange</title><seriesInfo name="DOI" value="10.1145/242896.242897"/> <seriesInfo name="pages" value="5-26"/> <seriesInfo name="In" value="SIGCOMM Computer Communication Review, vol 26 issue 5"/><authorinitials="D.P."initials="D. P." surname="Jablon" fullname="David P. Jablon"><organization>Integrity Sciences, Inc. Westboro, MA.</organization><organization></organization> </author> <dateyear="1996"/>year="1996" month="October"/> </front> <refcontent>In SIGCOMM Computer Communication Review, vol 26 issue 5, pages 5-26</refcontent> <seriesInfo name="DOI" value="10.1145/242896.242897"/> </reference> <reference anchor="hash2curve-repo" target="https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve"> <front> <title>Hashing to EllipticCurves - GitHub repository</title>Curves</title> <author> <organization/> </author> <dateyear="2019"/>year="2022" month="June"/> </front> <refcontent>commit 664b135</refcontent> </reference> <reference anchor="jubjub-fq"target="https://github.com/zkcrypto/jubjub/blob/master/src/fq.rs">target="https://github.com/zkcrypto/jubjub/pull/18"> <front> <title>zkcrypto/jubjub - fq.rs</title> <author> <organization/> </author> <date year="2019"/> </front> </reference> <reference anchor="L13" target="https://www.imperialviolet.org/2013/12/25/elligator.html"> <front> <title>Implementing Elligator for Curve25519</title> <author initials="A." surname="Langley" fullname="Adam Langley"> <organization/> </author> <dateyear="2013"/>year="2013" month="December"/> </front> </reference> <reference anchor="SBCDK09" target="https://doi.org/10.1007/978-3-642-03298-1_8"> <front> <title>Fast Hashing to G2 on Pairing-Friendly Curves</title><seriesInfo name="DOI" value="10.1007/978-3-642-03298-1_8"/> <seriesInfo name="pages" value="102-113"/> <seriesInfo name="In" value="Pairing-Based Cryptography - Pairing 2009"/><author initials="M." surname="Scott" fullname="Michael Scott"> <organization>School of Computing Dublin City University, Ballymun. Dublin, Ireland.</organization> </author> <author initials="N." surname="Benger" fullname="Naomi Benger"> <organization>School of Computing Dublin City University, Ballymun. Dublin, Ireland.</organization> </author> <author initials="M." surname="Charlemagne" fullname="Manuel Charlemagne"> <organization>School of Computing Dublin City University, Ballymun. Dublin, Ireland.</organization> </author> <authorinitials="L.J."initials="L. J." surname="Dominguez Perez" fullname="Luis J. Dominguez Perez"> <organization>School of Computing Dublin City University, Ballymun. Dublin, Ireland.</organization> </author> <authorinitials="E.J."initials="E. J." surname="Kachisa" fullname="Ezekiel J. Kachisa"> <organization>School of Computing Dublin City University, Ballymun. Dublin, Ireland.</organization> </author> <dateyear="2009"/>year="2009" month="August"/> </front> <refcontent>In Pairing-Based Cryptography - Pairing 2009, pages 102-113</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-03298-1_8"/> </reference> <reference anchor="FKR11" target="https://doi.org/10.1007/978-3-642-28496-0_25"> <front><title>Fast<title>Faster Hashing toG2 on Pairing-Friendly Curves</title> <seriesInfo name="DOI" value="10.1007/978-3-642-28496-0_25"/> <seriesInfo name="pages" value="412-430"/> <seriesInfo name="In" value="Selected Areas in Cryptography"/>G2</title> <author initials="L."surname="Fuentes-Castaneda"surname="Fuentes-Castañeda" fullname="LauraFuentes-Castaneda">Fuentes-Castañeda"> <organization>Computer Science Department, CINVESTAV-IPN. Mexico</organization> </author> <author initials="E." surname="Knapp" fullname="Edward Knapp"> <organization>Dept. Combinatorics & Optimization, University of Waterloo, Canada</organization> </author> <author initials="F." surname="Rodriguez-Henriquez" fullname="Francisco Rodriguez-Henriquez"> <organization>Computer Science Department, CINVESTAV-IPN. Mexico</organization> </author> <dateyear="2011"/>year="2011" month="August"/> </front> <refcontent>In Selected Areas in Cryptography, pages 412-430</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-28496-0_25"/> </reference> <reference anchor="BP17" target="https://eprint.iacr.org/2017/419"> <front> <title>Efficient hash maps toG2\mathbb{G}_2 on BLS curves</title><seriesInfo name="ePrint" value="2017/419"/><author initials="A." surname="Budroni" fullname="Alessandro Budroni"> <organization>University of Bergen, Norway and MIRACL Labs, London, England</organization> </author> <author initials="F." surname="Pintore" fullname="Federico Pintore"> <organization>University of Trento, Italy</organization> </author> <date year="2017" month="May"/> </front> <refcontent>Cryptology ePrint Archive, Paper 2017/419</refcontent> </reference> <reference anchor="BHKL13" target="https://doi.org/10.1145/2508859.2516734"> <front> <title>Elligator: elliptic-curve points indistinguishable from uniform random strings</title><seriesInfo name="DOI" value="10.1145/2508859.2516734"/> <seriesInfo name="pages" value="967-980"/> <seriesInfo name="In" value="Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security"/><authorinitials="D.J."initials="D. J." surname="Bernstein" fullname="Daniel J. Bernstein"> <organization>Department of Computer Science, University of Illinois at Chicago, USA</organization> </author> <author initials="M." surname="Hamburg" fullname="Mike Hamburg"> <organization>Cryptography Research, a division of Rambus, USA</organization> </author> <author initials="A." surname="Krasnova" fullname="Anna Krasnova"> <organization>Privacy & Identity lab, Institute for Computing and Information Sciences, Radboud University Nijmegen, The Netherlands</organization> </author> <author initials="T." surname="Lange" fullname="Tanja Lange"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <date year="2013" month="November"/> </front> <refcontent>In Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, pages 967-980</refcontent> <seriesInfo name="DOI" value="10.1145/2508859.2516734"/> </reference> <reference anchor="BLMP19"target="https://doi.org/10.1007/978-3-030-17656-3">target="https://doi.org/10.1007/978-3-030-17656-3_15"> <front> <title>QuantumcircuitsCircuits for the CSIDH:optimizing quantum evaluationOptimizing Quantum Evaluation ofisogenies</title> <seriesInfo name="DOI" value="10.1007/978-3-030-17656-3"/> <seriesInfo name="In" value="Advances in Cryptology - EUROCRYPT 2019"/>Isogenies</title> <authorinitials="D.J."initials="D. J." surname="Bernstein" fullname="Daniel J. Bernstein"> <organization>Department of Computer Science, University of Illinois at Chicago, USA</organization> </author> <author initials="T." surname="Lange" fullname="Tanja Lange"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <author initials="C." surname="Martindale" fullname="Chloe Martindale"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <author initials="L." surname="Panny" fullname="Lorenz Panny"> <organization>Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, The Netherlands</organization> </author> <dateyear="2019"/>year="2019" month="May"/> </front> <refcontent>In Advances in Cryptology - EUROCRYPT 2019, pages 409-441</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-030-17656-3"/> </reference> <reference anchor="SS04" target="https://doi.org/10.4064/ba52-3-1"> <front> <title>On equations y^2 = x^n + k in a finitefield.</title> <seriesInfo name="DOI" value="10.4064/ba52-3-1"/> <seriesInfo name="pages" value="223-226"/> <seriesInfo name="In" value="Bulletin Polish Acad. Sci. Math. vol 52, no 3"/>field</title> <author initials="A." surname="Schinzel" fullname="Andrzej Schinzel"> <organization>Department of Mathemetics, University of Warsaw</organization> </author> <author initials="M."surname="Skalba"surname="Skałba" fullname="MariuszSkalba">Skałba"> <organization>Department of Mathematics, University of Warsaw</organization> </author> <date year="2004"/> </front> <refcontent>In Bulletin Polish Academy of Sciences. Mathematics, vol 52 no 3, pages 223-226</refcontent> <seriesInfo name="DOI" value="10.4064/ba52-3-1"/> </reference> <reference anchor="S05" target="https://doi.org/10.4064/aa117-3-7"> <front> <title>Points on elliptic curves over finite fields</title><seriesInfo name="DOI" value="10.4064/aa117-3-7"/> <seriesInfo name="pages" value="293-301"/> <seriesInfo name="In" value="Acta Arithmetica, vol 117 no 3"/><author initials="M."surname="Skalba"surname="Skałba" fullname="MariuszSkalba">Skałba"> <organization>Department of Mathematics, University of Warsaw</organization> </author> <date year="2005"/> </front> <refcontent>In Acta Arithmetica, vol 117 no 3, pages 293-301</refcontent> <seriesInfo name="DOI" value="10.4064/aa117-3-7"/> </reference> <reference anchor="SW06" target="https://doi.org/10.1007/11792086_36"> <front> <title>Construction ofrational pointsRational Points onelliptic curvesElliptic Curves overfinite fields</title> <seriesInfo name="DOI" value="10.1007/11792086_36"/> <seriesInfo name="pages" value="510-524"/> <seriesInfo name="In" value="Algorithmic Number Theory. ANTS 2006."/>Finite Fields</title> <author initials="A." surname="Shallue" fullname="Andrew Shallue"> <organization>Mathematics Department, University of Wisconsin-Madison. Madison, USA.</organization> </author> <authorinitials="C."initials="C. E." surname="van de Woestijne" fullname="Christiaan van de Woestijne"> <organization>Mathematisch Instituut, Universiteit Leiden. Leiden, The Netherlands.</organization> </author> <dateyear="2006"/>year="2006" month="July"/> </front> <refcontent>In Algorithmic Number Theory - ANTS 2006, pages 510-524</refcontent> <seriesInfo name="DOI" value="10.1007/11792086_36"/> </reference> <reference anchor="U07" target="https://doi.org/10.4064/ba55-2-1"> <front> <title>RationalpointsPoints oncertain hyperelliptic curvesCertain Hyperelliptic Curves overfinite fields</title> <seriesInfo name="DOI" value="10.4064/ba55-2-1"/> <seriesInfo name="pages" value="97-104"/> <seriesInfo name="In" value="Bulletin Polish Acad. Sci. Math. vol 55, no 2"/>Finite Fields</title> <author initials="M." surname="Ulas" fullname="Maciej Ulas"> <organization>Institute of Mathematics, Jagiellonian University. Poland</organization> </author> <dateyear="2007"/>year="2007" month="July"/> </front> <refcontent>In Bulletin Polish Academy of Science. Mathematics, vol 55 no 2, pages 97-104</refcontent> <seriesInfo name="DOI" value="10.4064/ba55-2-1"/> </reference> <reference anchor="BCIMRT10" target="https://doi.org/10.1007/978-3-642-14623-7_13"> <front> <title>Efficient Indifferentiable Hashing into Ordinary Elliptic Curves</title><seriesInfo name="DOI" value="10.1007/978-3-642-14623-7_13"/> <seriesInfo name="pages" value="237-254"/> <seriesInfo name="In" value="Advances in Cryptology - CRYPTO 2010"/><author initials="E." surname="Brier" fullname="Eric Brier"> <organization>Ingenico</organization> </author> <authorinitials="J-S."initials="J.-S." surname="Coron" fullname="Jean-Sebastien Coron"> <organization>Universite du Luxembourg</organization> </author> <author initials="T." surname="Icart" fullname="Thomas Icart"> <organization>Universite du Luxembourg</organization> </author> <author initials="D." surname="Madore" fullname="David Madore"> <organization>TELECOM-ParisTech</organization> </author> <author initials="H." surname="Randriam" fullname="Hugues Randriam"> <organization>TELECOM-ParisTech</organization> </author> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>Universite du Luxembourg, Ecole normale superieure</organization> </author> <dateyear="2010"/>year="2010" month="August"/> </front> <refcontent>In Advances in Cryptology - CRYPTO 2010, pages 237-254</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-14623-7_13"/> </reference> <reference anchor="W08" target="https://www.crcpress.com/9781420071467"> <front> <title>Ellipticcurves:Curves: Numbertheory and cryptography</title> <seriesInfo name="ISBN" value="9781420071467"/> <seriesInfo name="publisher" value="ChapmanTheory andHall / CRC"/> <seriesInfo name="edition" value="2nd"/>Cryptography, Second Edition</title> <authorinitials="L.C."initials="L. C." surname="Washington" fullname="Lawrence C. Washington"> <organization/> </author> <dateyear="2008"/>year="2008" month="April"/> </front> <refcontent>Chapman and Hall / CRC</refcontent> <seriesInfo name="ISBN" value="9781420071467"/> </reference> <reference anchor="C93" target="https://doi.org/10.1007/978-3-662-02945-9"> <front> <title>A Course in Computational Algebraic Number Theory</title><seriesInfo name="ISBN" value="9783642081422"/> <seriesInfo name="publisher" value="Springer-Verlag"/><author initials="H." surname="Cohen" fullname="Henri Cohen"> <organization/> </author> <date year="1993"/> </front> <refcontent>Springer-Verlag</refcontent> <seriesInfo name="ISBN" value="9783642081422"/> <seriesInfo name="DOI" value="10.1007/978-3-662-02945-9"/> </reference> <reference anchor="CFADLNV05" target="https://www.crcpress.com/9781584885184"> <front> <title>Handbook of Elliptic and Hyperelliptic Curve Cryptography</title><seriesInfo name="ISBN" value="9781584885184"/> <seriesInfo name="publisher" value="Chapman and Hall / CRC"/><author initials="H." surname="Cohen" fullname="Henri Cohen"> <organization/> </author> <author initials="G." surname="Frey" fullname="Gerhard Frey"> <organization/> </author> <author initials="R." surname="Avanzi" fullname="Roberto Avanzi"> <organization/> </author> <author initials="C." surname="Doche" fullname="Christophe Doche"> <organization/> </author> <author initials="T." surname="Lange" fullname="Tanja Lange"> <organization/> </author> <author initials="K." surname="Nguyen" fullname="Kim Nguyen"> <organization/> </author> <author initials="F." surname="Vercauteren" fullname="Frederik Vercauteren"> <organization/> </author> <date year="2005"/> </front> <refcontent>Chapman and Hall / CRC</refcontent> <seriesInfo name="ISBN" value="9781584885184"/> </reference> <reference anchor="MOV96" target="http://cacr.uwaterloo.ca/hac/"> <front> <title>Handbook of Applied Cryptography</title><seriesInfo name="ISBN" value="9780849385230"/> <seriesInfo name="publisher" value="CRC Press"/><authorinitials="A.J."initials="A. J." surname="Menezes" fullname="Alfred J. Menezes"> <organization/> </author> <authorinitials="P.C."initials="P. C." surname="van Oorschot" fullname="Paul C. van Oorschot"> <organization/> </author> <authorinitials="S.A."initials="S. A." surname="Vanstone" fullname="Scott A. Vanstone"> <organization/> </author> <dateyear="1996"/>year="1996" month="October"/> </front> <refcontent>CRC Press</refcontent> <seriesInfo name="ISBN" value="9780849385230"/> </reference> <reference anchor="WB19" target="https://eprint.iacr.org/2019/403"> <front> <title>Fast and simple constant-time hashing to the BLS12-381 elliptic curve</title><seriesInfo name="ePrint" value="2019/403"/> <seriesInfo name="DOI" value="10.13154/tches.v2019.i4.154-179"/> <seriesInfo name="issue" value="4"/> <seriesInfo name="volume" value="2019"/> <seriesInfo name="In" value="IACR Trans. CHES"/><authorinitials="R.S."initials="R. S." surname="Wahby" fullname="Riad S. Wahby"> <organization>Stanford University</organization> </author> <author initials="D." surname="Boneh" fullname="Dan Boneh"> <organization>Stanford University</organization> </author> <date year="2019" month="August"/> </front> <refcontent>In IACR Transactions on Cryptographic Hardware and Embedded Systems, vol 2019 issue 4</refcontent> <refcontent>Cryptology ePrint Archive, Paper 2019/403</refcontent> <seriesInfo name="DOI" value="10.13154/tches.v2019.i4.154-179"/> </reference> <reference anchor="FFSTV13" target="https://doi.org/10.1090/S0025-5718-2012-02606-8"> <front> <title>Indifferentiable deterministic hashing to elliptic and hyperelliptic curves</title><seriesInfo name="DOI" value="10.1090/S0025-5718-2012-02606-8"/> <seriesInfo name="pages" value="491-512"/> <seriesInfo name="In" value="Math. Comp. vol 82"/><authorinitials="R.R."initials="R. R." surname="Farashahi" fullname="Reza R. Farashahi"> <organization>Macquarie Universit</organization> </author> <authorinitials="P.A."initials="P.-A." surname="Fouque" fullname="Pierre-Alain Fouque"> <organization>Ecole normale superieure</organization> </author> <authorinitials="I.E."initials="I. E." surname="Shparlinski" fullname="Igor E. Shparlinski"> <organization>Macquarie Universit</organization> </author> <author initials="M." surname="Tibouchi" fullname="Mehdi Tibouchi"> <organization>Ecole normale superieure</organization> </author> <authorinitials="J.F."initials="J. F." surname="Voloch" fullname="J. Felipe Voloch"> <organization>University of Texas</organization> </author> <date year="2013"/> </front> <refcontent>In Mathematics of Computation. vol 82, pages 491-512</refcontent> <seriesInfo name="DOI" value="10.1090/S0025-5718-2012-02606-8"/> </reference> <reference anchor="MRH04" target="https://doi.org/10.1007/978-3-540-24638-1_2"> <front> <title>Indifferentiability,impossibility resultsImpossibility Results onreductions,Reductions, andapplicationsApplications to therandom oracle methodology</title> <seriesInfo name="DOI" value="10.1007/978-3-540-24638-1_2"/> <seriesInfo name="pages" value="21-39"/> <seriesInfo name="In" value="TCC 2004: Theory of Cryptography"/>Random Oracle Methodology</title> <author initials="U." surname="Maurer" fullname="Ueli Maurer"> <organization>ETH Zurich</organization> </author> <author initials="R." surname="Renner" fullname="Renato Renner"> <organization>ETH Zurich</organization> </author> <author initials="C." surname="Holenstein" fullname="Clemens Holenstein"> <organization>ETH Zurich</organization> </author> <date year="2004" month="February"/> </front> <refcontent>In TCC 2004: Theory of Cryptography, pages 21-39</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-540-24638-1_2"/> </reference> <reference anchor="MRV99" target="https://doi.org/10.1109/SFFCS.1999.814584"> <front> <title>VerifiableRandom Functions</title> <seriesInfo name="DOI" value="10.1109/SFFCS.1999.814584"/> <seriesInfo name="In" value="Symposium on the Foundations of Computer Science"/>random functions</title> <author initials="S." surname="Micali" fullname="Silvio Micali"> <organization>MIT Laboratory for Computer Science</organization> </author> <author initials="M." surname="Rabin" fullname="Michael Rabin"> <organization>Harvard University Department of Applied Science</organization> </author> <author initials="S." surname="Vadhan" fullname="Salil Vadhan"> <organization>MIT Laboratory for Computer Science</organization> </author> <date year="1999" month="October"/> </front> <refcontent>40th Annual Symposium on Foundations of Computer Science (Cat. No.99CB37039), pages 120-130</refcontent> <seriesInfo name="DOI" value="10.1109/SFFCS.1999.814584"/> </reference> <reference anchor="NR97" target="https://doi.org/10.1109/SFCS.1997.646134"> <front> <title>Number-theoretic constructions of efficient pseudo-random functions</title><seriesInfo name="DOI" value="10.1109/SFCS.1997.646134"/> <seriesInfo name="In" value="Symposium on the Foundations of Computer Science"/><author initials="M." surname="Naor" fullname="Moni Naor"> <organization>Weizmann Institute</organization> </author> <author initials="O." surname="Reingold" fullname="Omer Reingold"> <organization>Weizmann Institute</organization> </author> <date year="1997" month="October"/> </front> <refcontent>In Proceedings 38th Annual Symposium on Foundations of Computer Science, pages 458-467</refcontent> <seriesInfo name="DOI" value="10.1109/SFCS.1997.646134"/> </reference> <reference anchor="S85" target="https://doi.org/10.1090/S0025-5718-1985-0777280-6"> <front> <title>EllipticCurves Over Finite Fieldscurves over finite fields and theComputationcomputation ofSquare Rootssquare roots mod p</title><seriesInfo name="DOI" value="10.1090/S0025-5718-1985-0777280-6"/> <seriesInfo name="pages" value="483-494"/> <seriesInfo name="In" value="Mathematics of Computation vol 44 issue 170"/><author initials="R." surname="Schoof" fullname="Rene Schoof"> <organization/> </author> <date year="1985" month="April"/> </front> <refcontent>In Mathematics of Computation, vol 44 issue 170, pages 483-494</refcontent> <seriesInfo name="DOI" value="10.1090/S0025-5718-1985-0777280-6"/> </reference> <reference anchor="SAGE" target="https://www.sagemath.org"> <front> <title>SageMath, the Sage Mathematics Software System</title> <author> <organization>The Sage Developers</organization> </author><date year="2019"/></front> </reference> <reference anchor="LBB19" target="https://hal.inria.fr/hal-02100345/"> <front> <title>A Mechanised Cryptographic Proof of the WireGuard Virtual Private Network Protocol</title><seriesInfo name="In" value="INRIA Research Report No. 9269"/><author initials="B." surname="Lipp" fullname="Benjamin Lipp"> <organization>INRIA Paris</organization> </author> <author initials="B." surname="Blanchet" fullname="Bruno Blanchet"> <organization>INRIA Paris</organization> </author> <author initials="K." surname="Bhargavan" fullname="Karthikeyan Bhargavan"> <organization>INRIA Paris</organization> </author> <date year="2019" month="April"/> </front> <refcontent>In INRIA Research Report 9269</refcontent> </reference> <reference anchor="RCB16" target="https://doi.org/10.1007/978-3-662-49890-3_16"> <front> <title>Completeaddition formulasAddition Formulas forprime order elliptic curves</title> <seriesInfo name="DOI" value="10.1007/978-3-662-49890-3_16"/> <seriesInfo name="pages" value="403-428"/> <seriesInfo name="In" value="Advances in Cryptology - EUROCRYPT 2016"/>Prime Order Elliptic Curves</title> <author initials="J." surname="Renes" fullname="Joost Renes"> <organization>Radboud University</organization> </author> <author initials="C." surname="Costello" fullname="Craig Costello"> <organization>Microsoft Research</organization> </author> <author initials="L." surname="Batina" fullname="Lejla Batina"> <organization>Radboud University</organization> </author> <date year="2016"month="May"/>month="April"/> </front> <refcontent>In Advances in Cryptology - EUROCRYPT 2016, pages 403-428</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-662-49890-3_16"/> </reference> <reference anchor="RSS11" target="https://doi.org/10.1007/978-3-642-20465-4_27"> <front> <title>Careful with Composition: Limitations of the Indifferentiability Framework</title><seriesInfo name="DOI" value="10.1007/978-3-642-20465-4_27"/> <seriesInfo name="pages" value="487-506"/> <seriesInfo name="In" value="Advances in Cryptology - EUROCRYPT 2011"/><author initials="T." surname="Ristenpart" fullname="Thomas Ristenpart"> <organization>University of Wisconsin-Madison</organization> </author> <author initials="H." surname="Shacham" fullname="Hovav Shacham"> <organization>UC San Diego</organization> </author> <author initials="T." surname="Shrimpton" fullname="Thomas Shrimpton"> <organization>Portland State University</organization> </author> <date year="2011" month="May"/> </front> <refcontent>In Advances in Cryptology - EUROCRYPT 2011, pages 487–506</refcontent> <seriesInfo name="DOI" value="10.1007/978-3-642-20465-4_27"/> </reference> <reference anchor="W19"target="https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/raw/master/doc/svdw_params.pdf">target="https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve/blob/draft-irtf-cfrg-hash-to-curve-14/doc/svdw_params.pdf"> <front> <title>An explicit, generic parameterization for the Shallue--van de Woestijne map</title> <authorinitials="R.S."initials="R. S." surname="Wahby" fullname="Riad S. Wahby"> <organization>Stanford University</organization> </author> <dateyear="2019"/>month="March" year="2020"/> </front> <refcontent>commit e2a625f</refcontent> </reference> <reference anchor="p1363.2" target="https://standards.ieee.org/standard/1363_2-2008.html"> <front> <title>IEEE Standard Specification for Password-Based Public-Key Cryptography Techniques</title> <author><organization>IEEE Computer Society</organization><organization>IEEE</organization> </author> <date year="2008" month="September"/> </front> <seriesInfo name="IEEE" value="1363.2-2008"/> </reference> <reference anchor="p1363a" target="https://standards.ieee.org/standard/1363a-2004.html"> <front> <title>IEEE Standard Specifications for Public-KeyCryptography---AmendmentCryptography - Amendment 1: Additional Techniques</title> <author><organization>IEEE Computer Society</organization><organization>IEEE</organization> </author> <date year="2004" month="March"/> </front> <seriesInfo name="IEEE" value="1363a-2004"/> </reference> <reference anchor="MT98" target="https://doi.org/10.1145/272991.272995"> <front> <title>Mersenne twister: A 623-dimensionally equidistributed uniform pseudo-random number generator</title><seriesInfo name="DOI" value="10.1145/272991.272995"/> <seriesInfo name="pages" value="3-30"/> <seriesInfo name="In" value="ACM Transactions on Modeling and Computer Simulation (TOMACS), Volume 8, Issue 1"/><author initials="M." surname="Matsumoto"> <organization/> </author> <author initials="T." surname="Nishimura"> <organization/> </author> <date year="1998" month="January"/> </front> <refcontent>In ACM Transactions on Modeling and Computer Simulation (TOMACS), vol 8 issue 1, pages 3-30</refcontent> <seriesInfo name="DOI" value="10.1145/272991.272995"/> </reference> <reference anchor="P20" target="https://eprint.iacr.org/2020/009"> <front> <title>Efficient Elliptic Curve Operations On Microcontrollers With Finite Field Extensions</title> <author initials="T." surname="Pornin" fullname="Thomas Pornin"> <organization>NCC Group</organization> </author> <date year="2020"/> </front> <refcontent>Cryptology ePrint Archive, Paper 2020/009</refcontent> </reference> <reference anchor="H20" target="https://eprint.iacr.org/2020/1513"> <front> <title>Indifferentiable hashing from Elligator 2</title> <author initials="M." surname="Hamburg" fullname="Mike Hamburg"> <organization>Rambus Inc</organization> </author> <date year="2020"/> </front> <refcontent>Cryptology ePrint Archive, Paper 2020/1513</refcontent> </reference><reference anchor="I-D.irtf-cfrg-bls-signature"> <front> <title>BLS Signatures</title> <seriesInfo name="Internet-Draft" value="draft-irtf-cfrg-bls-signature-04"/> <author fullname="Dan Boneh"> <organization>Stanford University</organization> </author> <author fullname="Sergey Gorbunov"> <organization>University of Waterloo</organization> </author> <author fullname="Riad S. Wahby"> <organization>Stanford University</organization> </author> <author fullname="Hoeteck Wee"> <organization>NTT Research and ENS</organization> </author> <author fullname="Zhenfei Zhang"> <organization>Algorand</organization> </author> <date day="10" month="September" year="2020"/> <abstract> <t> BLS is a digital signature scheme with aggregation properties. Given set of signatures (signature_1, ..., signature_n) anyone can produce an aggregated signature. Aggregation can also be done on secret keys and public keys. Furthermore, the BLS signature scheme is deterministic, non-malleable, and efficient. Its simplicity and cryptographic properties allows it to be useful in a variety of use- cases, specifically when minimal storage space or bandwidth are required. </t> </abstract> </front> </reference> <reference anchor="I-D.irtf-cfrg-vrf"> <front> <title>Verifiable Random Functions (VRFs)</title> <seriesInfo name="Internet-Draft" value="draft-irtf-cfrg-vrf-12"/> <author fullname="Sharon Goldberg"> <organization>Boston University</organization> </author> <author fullname="Leonid Reyzin"> <organization>Boston University and Algorand</organization> </author> <author fullname="Dimitrios Papadopoulos"> <organization>Hong Kong University of Science and Technology</organization> </author> <author fullname="Jan Vcelak"> <organization>NS1</organization> </author> <date day="26" month="May" year="2022"/> <abstract> <t> A Verifiable Random Function (VRF) is the public-key version of a keyed cryptographic hash. Only the holder of the private key can compute the hash, but anyone with the public key can verify the correctness of the hash. VRFs are useful for preventing enumeration of hash-based data structures. This document specifies several VRF constructions based on RSA and Elliptic Curves that are secure in the cryptographic random oracle model. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. </t> </abstract> </front> </reference> <reference anchor="I-D.irtf-cfrg-voprf"> <front> <title>Oblivious Pseudorandom Functions (OPRFs) using Prime-Order Groups</title> <seriesInfo name="Internet-Draft" value="draft-irtf-cfrg-voprf-09"/> <author fullname="Alex Davidson"> <organization>Brave Software</organization> </author> <author fullname="Armando Faz-Hernandez"> <organization>Cloudflare, Inc.</organization> </author> <author fullname="Nick Sullivan"> <organization>Cloudflare, Inc.</organization> </author> <author fullname="Christopher A. Wood"> <organization>Cloudflare, Inc.</organization> </author> <date day="8" month="February" year="2022"/> <abstract> <t> An Oblivious Pseudorandom Function (OPRF) is a two-party protocol between client and server for computing the output of a Pseudorandom Function (PRF). The server provides the PRF secret key, and the client provides the PRF input. At the end of the protocol, the client learns the PRF output without learning anything about the PRF secret key, and the server learns neither the PRF input nor output. An OPRF can also satisfy a notion of 'verifiability', called a VOPRF. A VOPRF ensures clients can verify that the server used a specific private key during the execution of the protocol. A VOPRF can also be partially-oblivious, called a POPRF. A POPRF allows clients and servers to provide public input to the PRF computation. This document specifies an OPRF, VOPRF, and POPRF instantiated within standard prime-order groups, including elliptic curves. </t> </abstract> </front> </reference> <reference anchor="RFC7693"> <front> <title>The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)</title> <seriesInfo name="DOI" value="10.17487/RFC7693"/> <seriesInfo name="RFC" value="7693"/> <author fullname="M-J. Saarinen" initials="M-J." role="editor" surname="Saarinen"> <organization/> </author> <author fullname="J-P. Aumasson" initials="J-P." surname="Aumasson"> <organization/> </author> <date month="November" year="2015"/> <abstract> <t>This document describes the cryptographic hash function BLAKE2 and makes the algorithm specification and C source code conveniently available to the Internet community. BLAKE2 comes in two main flavors: BLAKE2b is optimized for 64-bit platforms and BLAKE2s for smaller architectures. BLAKE2 can be directly keyed, making it functionally equivalent to a Message Authentication Code (MAC).</t> </abstract> </front> </reference> <reference anchor="I-D.irtf-cfrg-ristretto255-decaf448"> <front> <title>The ristretto255 and decaf448 Groups</title> <seriesInfo name="Internet-Draft" value="draft-irtf-cfrg-ristretto255-decaf448-03"/> <author fullname="Henry de Valence"> </author> <author fullname="Jack Grigg"> </author> <author fullname="Mike Hamburg"> </author> <author fullname="Isis Lovecruft"> </author> <author fullname="George Tankersley"> </author> <author fullname="Filippo Valsorda"> </author> <date day="25" month="February" year="2022"/> <abstract> <t> This memo specifies two prime-order groups, ristretto255 and decaf448, suitable for safely implementing higher-level and complex cryptographic protocols. The ristretto255 group can be implemented using Curve25519, allowing existing Curve25519 implementations to be reused and extended to provide a prime-order group. Likewise, the decaf448 group can be implemented using edwards448. </t> </abstract> </front> </reference> <reference anchor="RFC2898"> <front> <title>PKCS #5: Password-Based Cryptography Specification Version 2.0</title> <seriesInfo name="DOI" value="10.17487/RFC2898"/> <seriesInfo name="RFC" value="2898"/> <author fullname="B. Kaliski" initials="B." surname="Kaliski"> <organization/> </author> <date month="September" year="2000"/> <abstract> <t>This document provides recommendations for the implementation of password-based cryptography, covering key derivation functions, encryption schemes, message-authentication schemes, and ASN.1 syntax identifying the techniques. This memo provides information for the Internet community.</t> </abstract> </front> </reference> <reference anchor="RFC7914"> <front> <title>The scrypt Password-Based Key Derivation Function</title> <seriesInfo name="DOI" value="10.17487/RFC7914"/> <seriesInfo name="RFC" value="7914"/> <author fullname="C. Percival" initials="C." surname="Percival"> <organization/> </author> <author fullname="S. Josefsson" initials="S." surname="Josefsson"> <organization/> </author> <date month="August" year="2016"/> <abstract> <t>This document specifies the password-based key derivation function scrypt. The function derives one or more secret keys from a secret string. It is based on memory-hard functions, which offer added protection against attacks using custom hardware. The document also provides an ASN.1 schema.</t> </abstract> </front> </reference> <reference anchor="I-D.irtf-cfrg-argon2"> <front> <title>Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications</title> <seriesInfo name="Internet-Draft" value="draft-irtf-cfrg-argon2-13"/> <author fullname="Alex Biryukov"> <organization>University of Luxembourg</organization> </author> <author fullname="Daniel Dinu"> <organization>University of Luxembourg</organization> </author> <author fullname="Dmitry Khovratovich"> <organization>ABDK Consulting</organization> </author> <author fullname="Simon Josefsson"> <organization>SJD AB</organization> </author> <date day="11" month="March" year="2021"/> <abstract> <t>This document describes the Argon2 memory-hard function for password hashing and proof-of-work applications. We provide an implementer-oriented description with test vectors. The purpose is to simplify adoption of Argon2 for Internet protocols. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF. </t> </abstract> </front> </reference> <reference anchor="RFC2104"> <front> <title>HMAC: Keyed-Hashing for Message Authentication</title> <seriesInfo name="DOI" value="10.17487/RFC2104"/> <seriesInfo name="RFC" value="2104"/> <author fullname="H. Krawczyk" initials="H." surname="Krawczyk"> <organization/> </author> <author fullname="M. Bellare" initials="M." surname="Bellare"> <organization/> </author> <author fullname="R. Canetti" initials="R." surname="Canetti"> <organization/> </author> <date month="February" year="1997"/> <abstract> <t>This document describes HMAC, a mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. This memo provides information for the Internet community. This memo does not specify an Internet standard of any kind</t> </abstract> </front> </reference> <reference anchor="RFC5869"> <front> <title>HMAC-based Extract-and-Expand Key Derivation Function (HKDF)</title> <seriesInfo name="DOI" value="10.17487/RFC5869"/> <seriesInfo name="RFC" value="5869"/> <author fullname="H. Krawczyk" initials="H." surname="Krawczyk"> <organization/> </author> <author fullname="P. Eronen" initials="P." surname="Eronen"> <organization/> </author> <date month="May" year="2010"/> <abstract> <t>This document specifies a simple Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF), which can be used as a building block in various protocols and applications. The key derivation function (KDF) is intended to support a wide range of applications and requirements, and is conservative in its use of cryptographic hash functions. This document is not an Internet Standards Track specification; it is published for informational purposes.</t> </abstract> </front> </reference><xi:include href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.irtf-cfrg-bls-signature.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.irtf-cfrg-vrf.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.irtf-cfrg-voprf.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7693.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml3/reference.I-D.irtf-cfrg-ristretto255-decaf448.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.8018.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.7914.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.9106.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.2104.xml"/> <xi:include href="https://bib.ietf.org/public/rfc/bibxml/reference.RFC.5869.xml"/> </references> </references> <?line 3251?> <sectionanchor="related" numbered="true" toc="default">anchor="related"> <name>Relatedwork</name>Work</name> <t>The problem of mapping arbitrary bit strings to elliptic curve points has been the subject of both practical and theoretical research. This section briefly describes the background and research results thatunderlyunderlie the recommendations in this document. This section is provided for informational purposes only.</t> <t>A naive but generally insecure method of mapping a string msg to a point on an elliptic curve E having n points is to first fix a point P that generates the elliptic curve group, and a hash function Hn from bit strings to integers less than n; then compute Hn(msg) * P, where the * operator represents scalar multiplication. The reason this approach is insecure is that the resulting point has a known discrete log relationship to P. Thus, except in cases where this method is specified by the protocol, it must not be used; doing so risks catastrophic security failures.</t> <t>Boneh etal. <xref target="BLS01" format="default"/>al. <xref target="BLS01"/> describe an encoding method they call MapToGroup, which works roughly as follows: first, use the input string to initialize a pseudorandom number generator, then use the generator to produce a value x in F. If x is the x-coordinate of a point on the elliptic curve, output that point. Otherwise, generate a new value x in F and try again. Since a random value x in F has probability about 1/2 of corresponding to a point on the curve, the expected number of tries is just two. However, the running time of this method, which is generally referred to as a probabilistic try-and-increment algorithm, depends on the input string. As such, it is not safe to use in protocols sensitive to timing side channels, as was exemplified by the Dragonblood attack <xreftarget="VR20" format="default"/>.</t>target="VR20"/>.</t> <t>Schinzel and Skalba <xreftarget="SS04" format="default"/>target="SS04"/> introduce a method of constructing elliptic curve points deterministically, for a restricted class of curves and a very small number of points. Skalba <xreftarget="S05" format="default"/>target="S05"/> generalizes this construction to more curves and more points on those curves. Shallue and van de Woestijne <xreftarget="SW06" format="default"/>target="SW06"/> further generalize and simplify Skalba's construction, yielding concretely efficient maps to a constant fraction of the points on almost any curve. Fouque and Tibouchi <xreftarget="FT12" format="default"/>target="FT12"/> give a parameterization of this mapping for Barreto-Naehrig pairing-friendly curves <xreftarget="BN05" format="default"/>.</t>target="BN05"/>.</t> <t>Ulas <xreftarget="U07" format="default"/>target="U07"/> describes a simpler version of the Shallue-van de Woestijne map, and Brier etal. <xref target="BCIMRT10" format="default"/>al. <xref target="BCIMRT10"/> give a further simplification, which the authors call the"simplified"Simplified SWU" map. That simplified map applies only to fields of characteristic p = 3 (mod 4); Wahby and Boneh <xreftarget="WB19" format="default"/>target="WB19"/> generalize to fields of anycharacteristic,characteristic and give further optimizations.</t> <t>Boneh and Franklin give a deterministic algorithm mapping to certain supersingular curves over fields of characteristic p = 2 (mod 3) <xreftarget="BF01" format="default"/>.target="BF01"/>. Icart gives another deterministic algorithmwhichthat maps to any curve over a field of characteristic p = 2 (mod 3) <xreftarget="Icart09" format="default"/>.target="Icart09"/>. Several extensions and generalizations follow this work, including <xreftarget="FSV09" format="default"/>,target="FSV09"/>, <xreftarget="FT10" format="default"/>,target="FT10"/>, <xreftarget="KLR10" format="default"/>,target="KLR10"/>, <xreftarget="F11" format="default"/>,target="F11"/>, and <xreftarget="CK11" format="default"/>.</t>target="CK11"/>.</t> <t>Following the work of Farashahi <xreftarget="F11" format="default"/>,target="F11"/>, Fouque etal. <xref target="FJT13" format="default"/>al. <xref target="FJT13"/> describe a mapping to curves over fields of characteristic p = 3 (mod 4) having a number of points divisible by 4. Bernstein etal. <xref target="BHKL13" format="default"/>al. <xref target="BHKL13"/> optimize this mapping and describe a related mapping that they call "Elligator 2," which applies to any curve over a field of odd characteristic having a point of order 2. This includes Curve25519 and Curve448, both of which are CFRG-recommended curves <xreftarget="RFC7748" format="default"/>.target="RFC7748"/>. Bernstein etal. <xref target="BLMP19" format="default"/>al. <xref target="BLMP19"/> extend the Elligator 2 map to a class of supersingular curves over fields of characteristic p = 3 (mod 4).</t> <t>An important caveat regarding all of the above deterministic mapping functions is that none of them map to the entire curve, but rather to some fraction of the points. This means that they cannot be used directly to construct a random oracle that outputs points on the curve.</t> <t>Brier etal. <xref target="BCIMRT10" format="default"/>al. <xref target="BCIMRT10"/> give two solutions to this problem. The first, which Brier etal. proveal. prove applies to Icart's method, computes f(H0(msg)) + f(H1(msg)) for two distinct hash functions H0 and H1 from bit strings to F and a mapping f from F to the elliptic curve E. The second, which applies to essentially all deterministic mappings but is more costly, computes f(H0(msg)) + H2(msg) * P,forwhere P is a generator of the elliptic curvegroup andgroup, H2 is a hash from bit strings to integers modulo r, and r is the order of the elliptic curvegroup. Farashahigroup.</t> <t>Farashahi etal. <xref target="FFSTV13" format="default"/>al. <xref target="FFSTV13"/> improve the analysis of the first method, showing that it applies to essentially all deterministic mappings. Tibouchi and Kim <xreftarget="TK17" format="default"/>target="TK17"/> further refine the analysis and describe additional optimizations.</t> <t>Complementary to the problem of mapping from bit strings to elliptic curve points, Bernstein etal. <xref target="BHKL13" format="default"/>al. <xref target="BHKL13"/> study the problem of mapping from elliptic curve points to uniformly random bit strings, giving solutions for a class of curvesincludingthat includes Montgomery and twisted Edwards curves. Tibouchi <xreftarget="T14" format="default"/>target="T14"/> and Aranha etal. <xref target="AFQTZ14" format="default"/>al. <xref target="AFQTZ14"/> generalize these results. This document does not deal with this complementary problem.</t> </section> <sectionanchor="appx-ristretto255" numbered="true" toc="default">anchor="appx-ristretto255"> <name>Hashing to ristretto255</name> <t>ristretto255 <xreftarget="I-D.irtf-cfrg-ristretto255-decaf448" format="default"/>target="I-D.irtf-cfrg-ristretto255-decaf448"/> provides a prime-order group based onCurve25519curve25519 <xreftarget="RFC7748" format="default"/>.target="RFC7748"/>. This section describes hash_to_ristretto255, which implements a random-oracle encoding to this group that has a uniform output distribution (<xreftarget="term-rom" format="default"/>)target="term-rom"/>) and the same security properties and interface as the hash_to_curve function (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>The ristretto255 API defines a one-way map (<xreftarget="I-D.irtf-cfrg-ristretto255-decaf448" format="default"/>, Section 4.3.4);section="4.3.4" sectionFormat="comma" target="I-D.irtf-cfrg-ristretto255-decaf448"/>); this section refers to that map as ristretto255_map.</t> <t>The hash_to_ristretto255 functionMUST<bcp14>MUST</bcp14> be instantiated with an expand_message function that conforms to the requirements given in <xreftarget="hashtofield-expand" format="default"/>.target="hashtofield-expand"/>. In addition, itMUST<bcp14>MUST</bcp14> use a domain separation tag constructed as described in <xreftarget="domain-separation" format="default"/>,target="domain-separation"/>, and all domain separation recommendations given in <xreftarget="security-considerations-domain-separation-expmsg-var" format="default"/>target="security-considerations-domain-separation-expmsg-var"/> apply when implementing protocols that use hash_to_ristretto255.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ hash_to_ristretto255(msg) Parameters: - DST, a domain separation tag (see discussion above). - expand_message, a function that expands a byte string and domain separation tag into a uniformly random byte string (see discussion above). - ristretto255_map, the one-way map from the ristretto255 API. Input: msg, an arbitrary-length byte string. Output: P, an element of the ristretto255 group. Steps: 1. uniform_bytes = expand_message(msg, DST, 64) 2. P = ristretto255_map(uniform_bytes) 3. return P</sourcecode>]]></sourcecode> <t>Since hash_to_ristretto255 is not a hash-to-curve suite, it does not have a Suite ID. If a similar identifier is needed, itMUST<bcp14>MUST</bcp14> be constructed following the guidelines in <xreftarget="suiteIDformat" format="default"/>,target="suiteIDformat"/>, with the following parameters:</t> <ul spacing="normal"> <li>CURVE_ID: "ristretto255"</li> <li>HASH_ID: as described in <xreftarget="suiteIDformat" format="default"/></li>target="suiteIDformat"/></li> <li>MAP_ID: "R255MAP"</li> <li>ENC_VAR: "RO"</li> </ul> <t>For example, if expand_message is expand_message_xmd using SHA-512, theREQUIRED<bcp14>REQUIRED</bcp14> identifier is:</t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ ristretto255_XMD:SHA-512_R255MAP_RO_ ]]></artwork> </section> <sectionanchor="appx-decaf448" numbered="true" toc="default">anchor="appx-decaf448"> <name>Hashing to decaf448</name> <t>Similar to ristretto255, decaf448 <xreftarget="I-D.irtf-cfrg-ristretto255-decaf448" format="default"/>target="I-D.irtf-cfrg-ristretto255-decaf448"/> provides a prime-order group based onCurve448curve448 <xreftarget="RFC7748" format="default"/>.target="RFC7748"/>. This section describes hash_to_decaf448, which implements a random-oracle encoding to this group that has a uniform output distribution (<xreftarget="term-rom" format="default"/>)target="term-rom"/>) and the same security properties and interface as the hash_to_curve function (<xreftarget="roadmap" format="default"/>).</t>target="roadmap"/>).</t> <t>The decaf448 API defines a one-way map (<xreftarget="I-D.irtf-cfrg-ristretto255-decaf448" format="default"/>, Section 5.3.4);section="5.3.4" sectionFormat="comma" target="I-D.irtf-cfrg-ristretto255-decaf448"/>); this section refers to that map as decaf448_map.</t> <t>The hash_to_decaf448 functionMUST<bcp14>MUST</bcp14> be instantiated with an expand_message function that conforms to the requirements given in <xreftarget="hashtofield-expand" format="default"/>.target="hashtofield-expand"/>. In addition, itMUST<bcp14>MUST</bcp14> use a domain separation tag constructed as described in <xreftarget="domain-separation" format="default"/>,target="domain-separation"/>, and all domain separation recommendations given in <xreftarget="security-considerations-domain-separation-expmsg-var" format="default"/>target="security-considerations-domain-separation-expmsg-var"/> apply when implementing protocols that use hash_to_decaf448.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ hash_to_decaf448(msg) Parameters: - DST, a domain separation tag (see discussion above). - expand_message, a function that expands a byte string and domain separation tag into a uniformly random byte string (see discussion above). - decaf448_map, the one-way map from the decaf448 API. Input: msg, an arbitrary-length byte string. Output: P, an element of the decaf448 group. Steps: 1. uniform_bytes = expand_message(msg, DST, 112) 2. P = decaf448_map(uniform_bytes) 3. return P</sourcecode>]]></sourcecode> <t>Since hash_to_decaf448 is not a hash-to-curve suite, it does not have a Suite ID. If a similar identifier is needed, itMUST<bcp14>MUST</bcp14> be constructed following the guidelines in <xreftarget="suiteIDformat" format="default"/>,target="suiteIDformat"/>, with the following parameters:</t> <ul spacing="normal"> <li>CURVE_ID: "decaf448"</li> <li>HASH_ID: as described in <xreftarget="suiteIDformat" format="default"/></li>target="suiteIDformat"/></li> <li>MAP_ID: "D448MAP"</li> <li>ENC_VAR: "RO"</li> </ul> <t>For example, if expand_message is expand_message_xof using SHAKE256, theREQUIRED<bcp14>REQUIRED</bcp14> identifier is:</t><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ decaf448_XOF:SHAKE256_D448MAP_RO_ ]]></artwork> </section> <sectionanchor="appx-rational-map" numbered="true" toc="default">anchor="appx-rational-map"> <name>Rationalmaps</name>Maps</name> <t>This section gives rational maps that can be used when hashing to twisted Edwards or Montgomery curves.</t> <t>Given a twisted Edwards curve, <xreftarget="appx-rational-map-edw" format="default"/>target="appx-rational-map-edw"/> shows how to derive a corresponding Montgomery curve and how to map from that curve to the twisted Edwards curve. This mapping may be used when hashing to twisted Edwards curves as described in <xreftarget="twisted-edwards" format="default"/>.</t>target="twisted-edwards"/>.</t> <t>Given a Montgomery curve, <xreftarget="appx-rational-map-mont" format="default"/>target="appx-rational-map-mont"/> shows how to derive a corresponding Weierstrass curve and how to map from that curve to the Montgomery curve. This mapping can be used to hash to Montgomery or twisted Edwards curves via the Shallue-van de Woestijne method (<xreftarget="svdw" format="default"/>)target="svdw"/>) or Simplified SWU method (<xreftarget="simple-swu" format="default"/>) method,target="simple-swu"/>), as follows:</t> <ul spacing="normal"> <li>For Montgomery curves, first map to the Weierstrass curve, then convert to Montgomery coordinates via the mapping.</li> <li>For twisted Edwards curves, compose the mapping from Weierstrass to Montgomerymappingwith the mapping from Montgomery to twisted Edwardsmapping(<xreftarget="appx-rational-map-edw" format="default"/>)target="appx-rational-map-edw"/>) to obtain a Weierstrass curve and a mapping to the target twisted Edwards curve. Map to this Weierstrass curve, then convert to Edwards coordinates via the mapping.</li> </ul> <sectionanchor="appx-rational-map-edw" numbered="true" toc="default">anchor="appx-rational-map-edw"> <name>Generic Mapping from Montgomery totwisted Edwards map</name>Twisted Edwards</name> <t>This section gives a generic birational map between twisted Edwards and Montgomery curves.</t> <t>The map in this section is a simplified version of the map given in <xreftarget="BBJLP08" format="default"/>,target="BBJLP08"/>, Theorem 3.2. Specifically, this section's map handles exceptional cases in a simplified way that is geared towards hashing to a twisted Edwards curve's prime-order subgroup.</t> <t>The twisted Edwards curve</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ a * v^2 + w^2 = 1 + d * v^2 * w^2</sourcecode>]]></sourcecode> <t>is birationally equivalent to the Montgomery curve</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ K * t^2 = s^3 + J * s^2 + s</sourcecode>]]></sourcecode> <t>which has the form required by the Elligator 2 mapping of <xreftarget="elligator2" format="default"/>.target="elligator2"/>. The coefficients of the Montgomery curve are</t> <ul spacing="normal"> <li>J = 2 * (a + d) / (a - d)</li> <li>K = 4 / (a - d)</li> </ul> <t>The rational map from the point (s, t) on the above Montgomery curve to the point (v, w) on the twisted Edwards curve is given by</t> <ul spacing="normal"> <li>v = s / t</li> <li>w = (s - 1) / (s + 1)</li> </ul> <t>This mapping is undefined when t == 0 or s == -1, i.e., when the denominator of either of the above rational functions is zero. ImplementationsMUST<bcp14>MUST</bcp14> detect exceptional cases and return the value (v, w) = (0, 1), which is the identity point on all twisted Edwards curves.</t> <t>The following straight-line implementation of the above rational map handles the exceptional cases.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ monty_to_edw_generic(s, t) Input: (s, t), a point on the curve K * t^2 = s^3 + J * s^2 + s. Output: (v, w), a point on an equivalent twisted Edwards curve. 1. tv1 = s + 1 2. tv2 = tv1 * t # (s + 1) * t 3. tv2 = inv0(tv2) # 1 / ((s + 1) * t) 4. v = tv2 * tv1 # 1 / t 5. v = v * s # s / t 6. w = tv2 * t # 1 / (s + 1) 7. tv1 = s - 1 8. w = w * tv1 # (s - 1) / (s + 1) 9. e = tv2 == 0 10. w = CMOV(w, 1, e) # handle exceptional case 11. return (v, w)</sourcecode>]]></sourcecode> <t>For completeness, we also give the inverse relations. (Note that this map is not required when hashing to twisted Edwards curves.) The coefficients of the twisted Edwards curve corresponding to the above Montgomery curve are</t> <ul spacing="normal"> <li>a = (J + 2) / K</li> <li>d = (J - 2) / K</li> </ul> <t>The rational map from the point (v, w) on the twisted Edwards curve to the point (s, t) on the Montgomery curve is given by</t> <ul spacing="normal"> <li>s = (1 + w) / (1 - w)</li> <li>t = (1 + w) / (v * (1 - w))</li> </ul> <t>The mapping is undefined when v == 0 or w == 1. When the goal is to map into the prime-order subgroup of the Montgomery curve, it suffices to return the identity point on the Montgomery curve in the exceptional cases.</t> </section> <sectionanchor="appx-rational-map-mont" numbered="true" toc="default"> <name>Weierstrassanchor="appx-rational-map-mont"> <name>Mapping from Weierstrass toMontgomery map</name>Montgomery</name> <t>The rational map from the point (s, t) on the Montgomery curve</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ K * t^2 = s^3 + J * s^2 + s</sourcecode>]]></sourcecode> <t>to the point (x, y) on the equivalent Weierstrass curve</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ y^2 = x^3 + A * x + B</sourcecode>]]></sourcecode> <t>is givenby:</t>by</t> <ul spacing="normal"> <li>A = (3 - J^2) / (3 * K^2)</li> <li>B = (2 * J^3 - 9 * J) / (27 * K^3)</li> <li>x = (3 * s + J) / (3 * K)</li> <li>y = t / K</li> </ul> <t>The inverse map, from the point (x, y) to the point (s, t), is given by</t> <ul spacing="normal"> <li>s = (3 * K * x - J) / 3</li> <li>t = y * K</li> </ul> <t>This mapping can be used to apply the Shallue-van de Woestijne method (<xreftarget="svdw" format="default"/>)target="svdw"/>) or Simplified SWU(<xref target="simple-swu" format="default"/>)method (<xref target="simple-swu"/>) to Montgomery curves.</t> </section> </section> <sectionanchor="appx-iso" numbered="true" toc="default">anchor="appx-iso"> <name>IsogenymapsMaps forsuites</name>Suites</name> <t>This section specifies the isogeny maps for the secp256k1 and BLS12-381 suites listed in <xreftarget="suites" format="default"/>.</t>target="suites"/>.</t> <t>These maps are given in terms of affine coordinates. Wahby and Boneh (<xreftarget="WB19" format="default"/>,target="WB19"/>, Section 4.3) show how to evaluate these maps in a projective coordinate system (<xreftarget="projective-coords" format="default"/>),target="projective-coords"/>), which avoids modular inversions.</t> <t>Refer tothe draft repository<xreftarget="hash2curve-repo" format="default"/>target="hash2curve-repo"/> for a Sage <xreftarget="SAGE" format="default"/>target="SAGE"/> script that constructs these isogenies.</t> <sectionanchor="appx-iso-secp256k1" numbered="true" toc="default"> <name>3-isogeny mapanchor="appx-iso-secp256k1"> <name>3-Isogeny Map for secp256k1</name> <t>This section specifies the isogeny map for the secp256k1 suite listed in <xreftarget="suites-secp256k1" format="default"/>.</t>target="suites-secp256k1"/>.</t> <t>The 3-isogeny map from (x', y') on E' to (x, y) on E is given by the following rational functions:</t> <ul spacing="normal"> <li> <t>x = x_num / x_den, where </t> <ul spacing="normal"> <li>x_num = k_(1,3) * x'^3 + k_(1,2) * x'^2 + k_(1,1) * x' + k_(1,0)</li> <li>x_den = x'^2 + k_(2,1) * x' + k_(2,0)</li> </ul> </li> <li> <t>y = y' * y_num / y_den, where </t> <ul spacing="normal"> <li>y_num = k_(3,3) * x'^3 + k_(3,2) * x'^2 + k_(3,1) * x' + k_(3,0)</li> <li>y_den = x'^3 + k_(4,2) * x'^2 + k_(4,1) * x' + k_(4,0)</li> </ul> </li> </ul> <t>The constants used to compute x_num are as follows:</t> <ul spacing="normal"> <li>k_(1,0)= 0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7</li>=0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7</li> <li>k_(1,1) = 0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581</li> <li>k_(1,2) = 0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262</li> <li>k_(1,3) = 0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c</li> </ul> <t>The constants used to compute x_den are as follows:</t> <ul spacing="normal"> <li>k_(2,0) = 0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b</li> <li>k_(2,1) = 0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14</li> </ul> <t>The constants used to compute y_num are as follows:</t> <ul spacing="normal"> <li>k_(3,0) = 0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c</li> <li>k_(3,1) = 0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3</li> <li>k_(3,2) = 0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931</li> <li>k_(3,3) = 0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84</li> </ul> <t>The constants used to compute y_den are as follows:</t> <ul spacing="normal"> <li>k_(4,0) = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b</li> <li>k_(4,1) = 0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573</li> <li>k_(4,2) = 0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f</li> </ul> </section> <sectionanchor="appx-iso-bls12381-g1" numbered="true" toc="default"> <name>11-isogeny mapanchor="appx-iso-bls12381-g1"> <name>11-Isogeny Map for BLS12-381 G1</name> <t>The 11-isogeny map from (x', y') on E' to (x, y) on E is given by the following rational functions:</t> <ul spacing="normal"> <li> <t>x = x_num / x_den, where </t> <ul spacing="normal"> <li>x_num = k_(1,11) * x'^11 + k_(1,10) * x'^10 + k_(1,9) * x'^9 + ... + k_(1,0)</li> <li>x_den = x'^10 + k_(2,9) * x'^9 + k_(2,8) * x'^8 + ... + k_(2,0)</li> </ul> </li> <li> <t>y = y' * y_num / y_den, where </t> <ul spacing="normal"> <li>y_num = k_(3,15) * x'^15 + k_(3,14) * x'^14 + k_(3,13) * x'^13 + ... + k_(3,0)</li> <li>y_den = x'^15 + k_(4,14) * x'^14 + k_(4,13) * x'^13 + ... + k_(4,0)</li> </ul> </li> </ul> <t>The constants used to compute x_num are as follows:</t> <ul spacing="normal"><li>k_(1,0) = 0x11a05f2b1e833340b809101dd99815856b303e88a2d7005ff2627b56cdb4e2c85610c2d5f2e62d6eaeac1662734649b7</li> <li>k_(1,1) = 0x17294ed3e943ab2f0588bab22147a81c7c17e75b2f6a8417f565e33c70d1e86b4838f2a6f318c356e834eef1b3cb83bb</li> <li>k_(1,2) = 0xd54005db97678ec1d1048c5d10a9a1bce032473295983e56878e501ec68e25c958c3e3d2a09729fe0179f9dac9edcb0</li> <li>k_(1,3) = 0x1778e7166fcc6db74e0609d307e55412d7f5e4656a8dbf25f1b33289f1b330835336e25ce3107193c5b388641d9b6861</li> <li>k_(1,4) = 0xe99726a3199f4436642b4b3e4118e5499db995a1257fb3f086eeb65982fac18985a286f301e77c451154ce9ac8895d9</li> <li>k_(1,5) = 0x1630c3250d7313ff01d1201bf7a74ab5db3cb17dd952799b9ed3ab9097e68f90a0870d2dcae73d19cd13c1c66f652983</li> <li>k_(1,6) = 0xd6ed6553fe44d296a3726c38ae652bfb11586264f0f8ce19008e218f9c86b2a8da25128c1052ecaddd7f225a139ed84</li> <li>k_(1,7) = 0x17b81e7701abdbe2e8743884d1117e53356de5ab275b4db1a682c62ef0f2753339b7c8f8c8f475af9ccb5618e3f0c88e</li> <li>k_(1,8) = 0x80d3cf1f9a78fc47b90b33563be990dc43b756ce79f5574a2c596c928c5d1de4fa295f296b74e956d71986a8497e317</li> <li>k_(1,9) = 0x169b1f8e1bcfa7c42e0c37515d138f22dd2ecb803a0c5c99676314baf4bb1b7fa3190b2edc0327797f241067be390c9e</li> <li>k_(1,10) = 0x10321da079ce07e272d8ec09d2565b0dfa7dccdde6787f96d50af36003b14866f69b771f8c285decca67df3f1605fb7b</li> <li>k_(1,11) = 0x6e08c248e260e70bd1e962381edee3d31d79d7e22c837bc23c0bf1bc24c6b68c24b1b80b64d391fa9c8ba2e8ba2d229</li><li>k_(1,0) = 0x11a05f2b1e833340b809101dd99815856b303e88a2d7005ff2627b56cdb4e2c85610c2d5f2e62d6eaeac1662734649b7</li> <li>k_(1,1) = 0x17294ed3e943ab2f0588bab22147a81c7c17e75b2f6a8417f565e33c70d1e86b4838f2a6f318c356e834eef1b3cb83bb</li> <li>k_(1,2) = 0xd54005db97678ec1d1048c5d10a9a1bce032473295983e56878e501ec68e25c958c3e3d2a09729fe0179f9dac9edcb0</li> <li>k_(1,3) = 0x1778e7166fcc6db74e0609d307e55412d7f5e4656a8dbf25f1b33289f1b330835336e25ce3107193c5b388641d9b6861</li> <li>k_(1,4) = 0xe99726a3199f4436642b4b3e4118e5499db995a1257fb3f086eeb65982fac18985a286f301e77c451154ce9ac8895d9</li> <li>k_(1,5) = 0x1630c3250d7313ff01d1201bf7a74ab5db3cb17dd952799b9ed3ab9097e68f90a0870d2dcae73d19cd13c1c66f652983</li> <li>k_(1,6) = 0xd6ed6553fe44d296a3726c38ae652bfb11586264f0f8ce19008e218f9c86b2a8da25128c1052ecaddd7f225a139ed84</li> <li>k_(1,7) = 0x17b81e7701abdbe2e8743884d1117e53356de5ab275b4db1a682c62ef0f2753339b7c8f8c8f475af9ccb5618e3f0c88e</li> <li>k_(1,8) = 0x80d3cf1f9a78fc47b90b33563be990dc43b756ce79f5574a2c596c928c5d1de4fa295f296b74e956d71986a8497e317</li> <li>k_(1,9) = 0x169b1f8e1bcfa7c42e0c37515d138f22dd2ecb803a0c5c99676314baf4bb1b7fa3190b2edc0327797f241067be390c9e</li> <li>k_(1,10) = 0x10321da079ce07e272d8ec09d2565b0dfa7dccdde6787f96d50af36003b14866f69b771f8c285decca67df3f1605fb7b</li> <li>k_(1,11) = 0x6e08c248e260e70bd1e962381edee3d31d79d7e22c837bc23c0bf1bc24c6b68c24b1b80b64d391fa9c8ba2e8ba2d229</li> </ul> <t>The constants used to compute x_den are as follows:</t> <ul spacing="normal"><li>k_(2,0) = 0x8ca8d548cff19ae18b2e62f4bd3fa6f01d5ef4ba35b48ba9c9588617fc8ac62b558d681be343df8993cf9fa40d21b1c</li> <li>k_(2,1) = 0x12561a5deb559c4348b4711298e536367041e8ca0cf0800c0126c2588c48bf5713daa8846cb026e9e5c8276ec82b3bff</li> <li>k_(2,2) = 0xb2962fe57a3225e8137e629bff2991f6f89416f5a718cd1fca64e00b11aceacd6a3d0967c94fedcfcc239ba5cb83e19</li> <li>k_(2,3) = 0x3425581a58ae2fec83aafef7c40eb545b08243f16b1655154cca8abc28d6fd04976d5243eecf5c4130de8938dc62cd8</li> <li>k_(2,4) = 0x13a8e162022914a80a6f1d5f43e7a07dffdfc759a12062bb8d6b44e833b306da9bd29ba81f35781d539d395b3532a21e</li> <li>k_(2,5) = 0xe7355f8e4e667b955390f7f0506c6e9395735e9ce9cad4d0a43bcef24b8982f7400d24bc4228f11c02df9a29f6304a5</li> <li>k_(2,6) = 0x772caacf16936190f3e0c63e0596721570f5799af53a1894e2e073062aede9cea73b3538f0de06cec2574496ee84a3a</li> <li>k_(2,7) = 0x14a7ac2a9d64a8b230b3f5b074cf01996e7f63c21bca68a81996e1cdf9822c580fa5b9489d11e2d311f7d99bbdcc5a5e</li> <li>k_(2,8) = 0xa10ecf6ada54f825e920b3dafc7a3cce07f8d1d7161366b74100da67f39883503826692abba43704776ec3a79a1d641</li> <li>k_(2,9) = 0x95fc13ab9e92ad4476d6e3eb3a56680f682b4ee96f7d03776df533978f31c1593174e4b4b7865002d6384d168ecdd0a</li><li>k_(2,0) = 0x8ca8d548cff19ae18b2e62f4bd3fa6f01d5ef4ba35b48ba9c9588617fc8ac62b558d681be343df8993cf9fa40d21b1c</li> <li>k_(2,1) = 0x12561a5deb559c4348b4711298e536367041e8ca0cf0800c0126c2588c48bf5713daa8846cb026e9e5c8276ec82b3bff</li> <li>k_(2,2) = 0xb2962fe57a3225e8137e629bff2991f6f89416f5a718cd1fca64e00b11aceacd6a3d0967c94fedcfcc239ba5cb83e19</li> <li>k_(2,3) = 0x3425581a58ae2fec83aafef7c40eb545b08243f16b1655154cca8abc28d6fd04976d5243eecf5c4130de8938dc62cd8</li> <li>k_(2,4) = 0x13a8e162022914a80a6f1d5f43e7a07dffdfc759a12062bb8d6b44e833b306da9bd29ba81f35781d539d395b3532a21e</li> <li>k_(2,5) = 0xe7355f8e4e667b955390f7f0506c6e9395735e9ce9cad4d0a43bcef24b8982f7400d24bc4228f11c02df9a29f6304a5</li> <li>k_(2,6) = 0x772caacf16936190f3e0c63e0596721570f5799af53a1894e2e073062aede9cea73b3538f0de06cec2574496ee84a3a</li> <li>k_(2,7) = 0x14a7ac2a9d64a8b230b3f5b074cf01996e7f63c21bca68a81996e1cdf9822c580fa5b9489d11e2d311f7d99bbdcc5a5e</li> <li>k_(2,8) = 0xa10ecf6ada54f825e920b3dafc7a3cce07f8d1d7161366b74100da67f39883503826692abba43704776ec3a79a1d641</li> <li>k_(2,9) = 0x95fc13ab9e92ad4476d6e3eb3a56680f682b4ee96f7d03776df533978f31c1593174e4b4b7865002d6384d168ecdd0a</li> </ul> <t>The constants used to compute y_num are as follows:</t> <ul spacing="normal"><li>k_(3,0) = 0x90d97c81ba24ee0259d1f094980dcfa11ad138e48a869522b52af6c956543d3cd0c7aee9b3ba3c2be9845719707bb33</li> <li>k_(3,1) = 0x134996a104ee5811d51036d776fb46831223e96c254f383d0f906343eb67ad34d6c56711962fa8bfe097e75a2e41c696</li> <li>k_(3,2) = 0xcc786baa966e66f4a384c86a3b49942552e2d658a31ce2c344be4b91400da7d26d521628b00523b8dfe240c72de1f6</li> <li>k_(3,3) = 0x1f86376e8981c217898751ad8746757d42aa7b90eeb791c09e4a3ec03251cf9de405aba9ec61deca6355c77b0e5f4cb</li> <li>k_(3,4) = 0x8cc03fdefe0ff135caf4fe2a21529c4195536fbe3ce50b879833fd221351adc2ee7f8dc099040a841b6daecf2e8fedb</li> <li>k_(3,5) = 0x16603fca40634b6a2211e11db8f0a6a074a7d0d4afadb7bd76505c3d3ad5544e203f6326c95a807299b23ab13633a5f0</li> <li>k_(3,6) = 0x4ab0b9bcfac1bbcb2c977d027796b3ce75bb8ca2be184cb5231413c4d634f3747a87ac2460f415ec961f8855fe9d6f2</li> <li>k_(3,7) = 0x987c8d5333ab86fde9926bd2ca6c674170a05bfe3bdd81ffd038da6c26c842642f64550fedfe935a15e4ca31870fb29</li> <li>k_(3,8) = 0x9fc4018bd96684be88c9e221e4da1bb8f3abd16679dc26c1e8b6e6a1f20cabe69d65201c78607a360370e577bdba587</li> <li>k_(3,9) = 0xe1bba7a1186bdb5223abde7ada14a23c42a0ca7915af6fe06985e7ed1e4d43b9b3f7055dd4eba6f2bafaaebca731c30</li> <li>k_(3,10) = 0x19713e47937cd1be0dfd0b8f1d43fb93cd2fcbcb6caf493fd1183e416389e61031bf3a5cce3fbafce813711ad011c132</li> <li>k_(3,11) = 0x18b46a908f36f6deb918c143fed2edcc523559b8aaf0c2462e6bfe7f911f643249d9cdf41b44d606ce07c8a4d0074d8e</li> <li>k_(3,12) = 0xb182cac101b9399d155096004f53f447aa7b12a3426b08ec02710e807b4633f06c851c1919211f20d4c04f00b971ef8</li> <li>k_(3,13) = 0x245a394ad1eca9b72fc00ae7be315dc757b3b080d4c158013e6632d3c40659cc6cf90ad1c232a6442d9d3f5db980133</li> <li>k_(3,14) = 0x5c129645e44cf1102a159f748c4a3fc5e673d81d7e86568d9ab0f5d396a7ce46ba1049b6579afb7866b1e715475224b</li> <li>k_(3,15) = 0x15e6be4e990f03ce4ea50b3b42df2eb5cb181d8f84965a3957add4fa95af01b2b665027efec01c7704b456be69c8b604</li><li>k_(3,0) = 0x90d97c81ba24ee0259d1f094980dcfa11ad138e48a869522b52af6c956543d3cd0c7aee9b3ba3c2be9845719707bb33</li> <li>k_(3,1) = 0x134996a104ee5811d51036d776fb46831223e96c254f383d0f906343eb67ad34d6c56711962fa8bfe097e75a2e41c696</li> <li>k_(3,2) = 0xcc786baa966e66f4a384c86a3b49942552e2d658a31ce2c344be4b91400da7d26d521628b00523b8dfe240c72de1f6</li> <li>k_(3,3) = 0x1f86376e8981c217898751ad8746757d42aa7b90eeb791c09e4a3ec03251cf9de405aba9ec61deca6355c77b0e5f4cb</li> <li>k_(3,4) = 0x8cc03fdefe0ff135caf4fe2a21529c4195536fbe3ce50b879833fd221351adc2ee7f8dc099040a841b6daecf2e8fedb</li> <li>k_(3,5) = 0x16603fca40634b6a2211e11db8f0a6a074a7d0d4afadb7bd76505c3d3ad5544e203f6326c95a807299b23ab13633a5f0</li> <li>k_(3,6) = 0x4ab0b9bcfac1bbcb2c977d027796b3ce75bb8ca2be184cb5231413c4d634f3747a87ac2460f415ec961f8855fe9d6f2</li> <li>k_(3,7) = 0x987c8d5333ab86fde9926bd2ca6c674170a05bfe3bdd81ffd038da6c26c842642f64550fedfe935a15e4ca31870fb29</li> <li>k_(3,8) = 0x9fc4018bd96684be88c9e221e4da1bb8f3abd16679dc26c1e8b6e6a1f20cabe69d65201c78607a360370e577bdba587</li> <li>k_(3,9) = 0xe1bba7a1186bdb5223abde7ada14a23c42a0ca7915af6fe06985e7ed1e4d43b9b3f7055dd4eba6f2bafaaebca731c30</li> <li>k_(3,10) = 0x19713e47937cd1be0dfd0b8f1d43fb93cd2fcbcb6caf493fd1183e416389e61031bf3a5cce3fbafce813711ad011c132</li> <li>k_(3,11) = 0x18b46a908f36f6deb918c143fed2edcc523559b8aaf0c2462e6bfe7f911f643249d9cdf41b44d606ce07c8a4d0074d8e</li> <li>k_(3,12) = 0xb182cac101b9399d155096004f53f447aa7b12a3426b08ec02710e807b4633f06c851c1919211f20d4c04f00b971ef8</li> <li>k_(3,13) = 0x245a394ad1eca9b72fc00ae7be315dc757b3b080d4c158013e6632d3c40659cc6cf90ad1c232a6442d9d3f5db980133</li> <li>k_(3,14) = 0x5c129645e44cf1102a159f748c4a3fc5e673d81d7e86568d9ab0f5d396a7ce46ba1049b6579afb7866b1e715475224b</li> <li>k_(3,15) = 0x15e6be4e990f03ce4ea50b3b42df2eb5cb181d8f84965a3957add4fa95af01b2b665027efec01c7704b456be69c8b604</li> </ul> <t>The constants used to compute y_den are as follows:</t> <ul spacing="normal"><li>k_(4,0) = 0x16112c4c3a9c98b252181140fad0eae9601a6de578980be6eec3232b5be72e7a07f3688ef60c206d01479253b03663c1</li> <li>k_(4,1) = 0x1962d75c2381201e1a0cbd6c43c348b885c84ff731c4d59ca4a10356f453e01f78a4260763529e3532f6102c2e49a03d</li> <li>k_(4,2) = 0x58df3306640da276faaae7d6e8eb15778c4855551ae7f310c35a5dd279cd2eca6757cd636f96f891e2538b53dbf67f2</li> <li>k_(4,3) = 0x16b7d288798e5395f20d23bf89edb4d1d115c5dbddbcd30e123da489e726af41727364f2c28297ada8d26d98445f5416</li> <li>k_(4,4) = 0xbe0e079545f43e4b00cc912f8228ddcc6d19c9f0f69bbb0542eda0fc9dec916a20b15dc0fd2ededda39142311a5001d</li> <li>k_(4,5) = 0x8d9e5297186db2d9fb266eaac783182b70152c65550d881c5ecd87b6f0f5a6449f38db9dfa9cce202c6477faaf9b7ac</li> <li>k_(4,6) = 0x166007c08a99db2fc3ba8734ace9824b5eecfdfa8d0cf8ef5dd365bc400a0051d5fa9c01a58b1fb93d1a1399126a775c</li> <li>k_(4,7) = 0x16a3ef08be3ea7ea03bcddfabba6ff6ee5a4375efa1f4fd7feb34fd206357132b920f5b00801dee460ee415a15812ed9</li> <li>k_(4,8) = 0x1866c8ed336c61231a1be54fd1d74cc4f9fb0ce4c6af5920abc5750c4bf39b4852cfe2f7bb9248836b233d9d55535d4a</li> <li>k_(4,9) = 0x167a55cda70a6e1cea820597d94a84903216f763e13d87bb5308592e7ea7d4fbc7385ea3d529b35e346ef48bb8913f55</li> <li>k_(4,10) = 0x4d2f259eea405bd48f010a01ad2911d9c6dd039bb61a6290e591b36e636a5c871a5c29f4f83060400f8b49cba8f6aa8</li> <li>k_(4,11) = 0xaccbb67481d033ff5852c1e48c50c477f94ff8aefce42d28c0f9a88cea7913516f968986f7ebbea9684b529e2561092</li> <li>k_(4,12) = 0xad6b9514c767fe3c3613144b45f1496543346d98adf02267d5ceef9a00d9b8693000763e3b90ac11e99b138573345cc</li> <li>k_(4,13) = 0x2660400eb2e4f3b628bdd0d53cd76f2bf565b94e72927c1cb748df27942480e420517bd8714cc80d1fadc1326ed06f7</li> <li>k_(4,14) = 0xe0fa1d816ddc03e6b24255e0d7819c171c40f65e273b853324efcd6356caa205ca2f570f13497804415473a1d634b8f</li><li>k_(4,0) = 0x16112c4c3a9c98b252181140fad0eae9601a6de578980be6eec3232b5be72e7a07f3688ef60c206d01479253b03663c1</li> <li>k_(4,1) = 0x1962d75c2381201e1a0cbd6c43c348b885c84ff731c4d59ca4a10356f453e01f78a4260763529e3532f6102c2e49a03d</li> <li>k_(4,2) = 0x58df3306640da276faaae7d6e8eb15778c4855551ae7f310c35a5dd279cd2eca6757cd636f96f891e2538b53dbf67f2</li> <li>k_(4,3) = 0x16b7d288798e5395f20d23bf89edb4d1d115c5dbddbcd30e123da489e726af41727364f2c28297ada8d26d98445f5416</li> <li>k_(4,4) = 0xbe0e079545f43e4b00cc912f8228ddcc6d19c9f0f69bbb0542eda0fc9dec916a20b15dc0fd2ededda39142311a5001d</li> <li>k_(4,5) = 0x8d9e5297186db2d9fb266eaac783182b70152c65550d881c5ecd87b6f0f5a6449f38db9dfa9cce202c6477faaf9b7ac</li> <li>k_(4,6) = 0x166007c08a99db2fc3ba8734ace9824b5eecfdfa8d0cf8ef5dd365bc400a0051d5fa9c01a58b1fb93d1a1399126a775c</li> <li>k_(4,7) = 0x16a3ef08be3ea7ea03bcddfabba6ff6ee5a4375efa1f4fd7feb34fd206357132b920f5b00801dee460ee415a15812ed9</li> <li>k_(4,8) = 0x1866c8ed336c61231a1be54fd1d74cc4f9fb0ce4c6af5920abc5750c4bf39b4852cfe2f7bb9248836b233d9d55535d4a</li> <li>k_(4,9) = 0x167a55cda70a6e1cea820597d94a84903216f763e13d87bb5308592e7ea7d4fbc7385ea3d529b35e346ef48bb8913f55</li> <li>k_(4,10) = 0x4d2f259eea405bd48f010a01ad2911d9c6dd039bb61a6290e591b36e636a5c871a5c29f4f83060400f8b49cba8f6aa8</li> <li>k_(4,11) = 0xaccbb67481d033ff5852c1e48c50c477f94ff8aefce42d28c0f9a88cea7913516f968986f7ebbea9684b529e2561092</li> <li>k_(4,12) = 0xad6b9514c767fe3c3613144b45f1496543346d98adf02267d5ceef9a00d9b8693000763e3b90ac11e99b138573345cc</li> <li>k_(4,13) = 0x2660400eb2e4f3b628bdd0d53cd76f2bf565b94e72927c1cb748df27942480e420517bd8714cc80d1fadc1326ed06f7</li> <li>k_(4,14) = 0xe0fa1d816ddc03e6b24255e0d7819c171c40f65e273b853324efcd6356caa205ca2f570f13497804415473a1d634b8f</li> </ul> </section> <sectionanchor="appx-iso-bls12381-g2" numbered="true" toc="default"> <name>3-isogeny mapanchor="appx-iso-bls12381-g2"> <name>3-Isogeny Map for BLS12-381 G2</name> <t>The 3-isogeny map from (x', y') on E' to (x, y) on E is given by the following rational functions:</t> <ul spacing="normal"> <li> <t>x = x_num / x_den, where </t> <ul spacing="normal"> <li>x_num = k_(1,3) * x'^3 + k_(1,2) * x'^2 + k_(1,1) * x' + k_(1,0)</li> <li>x_den = x'^2 + k_(2,1) * x' + k_(2,0)</li> </ul> </li> <li> <t>y = y' * y_num / y_den, where </t> <ul spacing="normal"> <li>y_num = k_(3,3) * x'^3 + k_(3,2) * x'^2 + k_(3,1) * x' + k_(3,0)</li> <li>y_den = x'^3 + k_(4,2) * x'^2 + k_(4,1) * x' + k_(4,0)</li> </ul> </li> </ul> <t>The constants used to compute x_num are as follows:</t> <ul spacing="normal"><li>k_(1,0) = 0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6 + 0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6 * I</li> <li>k_(1,1) = 0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71a * I</li> <li>k_(1,2) = 0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71e + 0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38d * I</li> <li>k_(1,3) = 0x171d6541fa38ccfaed6dea691f5fb614cb14b4e7f4e810aa22d6108f142b85757098e38d0f671c7188e2aaaaaaaa5ed1</li><li>k_(1,0) = 0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6 + 0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97d6 * I</li> <li>k_(1,1) = 0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71a * I</li> <li>k_(1,2) = 0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71e + 0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38d * I</li> <li>k_(1,3) = 0x171d6541fa38ccfaed6dea691f5fb614cb14b4e7f4e810aa22d6108f142b85757098e38d0f671c7188e2aaaaaaaa5ed1</li> </ul> <t>The constants used to compute x_den are as follows:</t> <ul spacing="normal"><li>k_(2,0) = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa63 * I</li> <li>k_(2,1) = 0xc + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa9f * I</li><li>k_(2,0) = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa63 * I</li> <li>k_(2,1) = 0xc + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa9f * I</li> </ul> <t>The constants used to compute y_num are as follows:</t> <ul spacing="normal"><li>k_(3,0) = 0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706 + 0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706 * I</li> <li>k_(3,1) = 0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97be * I</li> <li>k_(3,2) = 0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71c + 0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38f * I</li> <li>k_(3,3) = 0x124c9ad43b6cf79bfbf7043de3811ad0761b0f37a1e26286b0e977c69aa274524e79097a56dc4bd9e1b371c71c718b10</li><li>k_(3,0) = 0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706 + 0x1530477c7ab4113b59a4c18b076d11930f7da5d4a07f649bf54439d87d27e500fc8c25ebf8c92f6812cfc71c71c6d706 * I</li> <li>k_(3,1) = 0x5c759507e8e333ebb5b7a9a47d7ed8532c52d39fd3a042a88b58423c50ae15d5c2638e343d9c71c6238aaaaaaaa97be * I</li> <li>k_(3,2) = 0x11560bf17baa99bc32126fced787c88f984f87adf7ae0c7f9a208c6b4f20a4181472aaa9cb8d555526a9ffffffffc71c + 0x8ab05f8bdd54cde190937e76bc3e447cc27c3d6fbd7063fcd104635a790520c0a395554e5c6aaaa9354ffffffffe38f * I</li> <li>k_(3,3) = 0x124c9ad43b6cf79bfbf7043de3811ad0761b0f37a1e26286b0e977c69aa274524e79097a56dc4bd9e1b371c71c718b10</li> </ul> <t>The constants used to compute y_den are as follows:</t> <ul spacing="normal"><li>k_(4,0) = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb * I</li> <li>k_(4,1) = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa9d3 * I</li> <li>k_(4,2) = 0x12 + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa99 * I</li><li>k_(4,0) = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa8fb * I</li> <li>k_(4,1) = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffa9d3 * I</li> <li>k_(4,2) = 0x12 + 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaa99 * I</li> </ul> </section> </section> <sectionanchor="straightline" numbered="true" toc="default"> <name>Straight-line implementationsanchor="straightline"> <name>Straight-Line Implementations ofdeterministic mappings</name>Deterministic Mappings</name> <t>This section gives straight-line implementations of the mappings of <xreftarget="mappings" format="default"/>.target="mappings"/>. These implementations are generic, i.e., they are defined for any curve and field. <xreftarget="samplecode" format="default"/>target="samplecode"/> gives further implementations that are optimized for specific classes of curves and fields.</t> <sectionanchor="straightline-svdw" numbered="true" toc="default">anchor="straightline-svdw"> <name>Shallue-van de Woestijnemethod</name>Method</name> <t>This section gives a straight-line implementation of theShallue and vanShallue-van de Woestijne method for any Weierstrass curve of the form given in <xreftarget="weierstrass" format="default"/>.target="weierstrass"/>. See <xreftarget="svdw" format="default"/>target="svdw"/> for information on the constants used in this mapping.</t> <t>Note that the constant c3 belowMUST<bcp14>MUST</bcp14> be chosen such that sgn0(c3) = 0. In other words, if the square-root computation returns a value cx such that sgn0(cx) = 1, set c3 = -cx; otherwise, set c3 = cx.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_svdw(u) Input: u, an element of F. Output: (x, y), a point on E. Constants: 1. c1 = g(Z) 2. c2 = -Z / 2 3. c3 = sqrt(-g(Z) * (3 * Z^2 + 4 * A)) # sgn0(c3) MUST equal 0 4. c4 = -4 * g(Z) / (3 * Z^2 + 4 * A) Steps: 1. tv1 = u^2 2. tv1 = tv1 * c1 3. tv2 = 1 + tv1 4. tv1 = 1 - tv1 5. tv3 = tv1 * tv2 6. tv3 = inv0(tv3) 7. tv4 = u * tv1 8. tv4 = tv4 * tv3 9. tv4 = tv4 * c3 10. x1 = c2 - tv4 11. gx1 = x1^2 12. gx1 = gx1 + A 13. gx1 = gx1 * x1 14. gx1 = gx1 + B 15. e1 = is_square(gx1) 16. x2 = c2 + tv4 17. gx2 = x2^2 18. gx2 = gx2 + A 19. gx2 = gx2 * x2 20. gx2 = gx2 + B 21. e2 = is_square(gx2) AND NOT e1 # Avoid short-circuit logic ops 22. x3 = tv2^2 23. x3 = x3 * tv3 24. x3 = x3^2 25. x3 = x3 * c4 26. x3 = x3 + Z 27. x = CMOV(x3, x1, e1) # x = x1 if gx1 is square, else x = x3 28. x = CMOV(x, x2, e2) # x = x2 if gx2 is square and gx1 is not 29. gx = x^2 30. gx = gx + A 31. gx = gx * x 32. gx = gx + B 33. y = sqrt(gx) 34. e3 = sgn0(u) == sgn0(y) 35. y = CMOV(-y, y, e3) # Select correct sign of y 36. return (x, y)</sourcecode>]]></sourcecode> </section> <sectionanchor="straightline-sswu" numbered="true" toc="default">anchor="straightline-sswu"> <name>Simplified SWUmethod</name>Method</name> <t>This section gives a straight-line implementation of thesimplifiedSimplified SWU method for any Weierstrass curve of the form given in <xreftarget="weierstrass" format="default"/>.target="weierstrass"/>. See <xreftarget="simple-swu" format="default"/>target="simple-swu"/> for information on the constants used in this mapping.</t> <t>This optimized, straight-line procedure applies to any base field. The sqrt_ratio subroutine is defined in <xreftarget="straightline-sswu-sqrt-ratio" format="default"/>.</t>target="straightline-sswu-sqrt-ratio"/>.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_simple_swu(u) Input: u, an element of F. Output: (x, y), a point on E. Steps: 1. tv1 = u^2 2. tv1 = Z * tv1 3. tv2 = tv1^2 4. tv2 = tv2 + tv1 5. tv3 = tv2 + 1 6. tv3 = B * tv3 7. tv4 = CMOV(Z, -tv2, tv2 != 0) 8. tv4 = A * tv4 9. tv2 = tv3^2 10. tv6 = tv4^2 11. tv5 = A * tv6 12. tv2 = tv2 + tv5 13. tv2 = tv2 * tv3 14. tv6 = tv6 * tv4 15. tv5 = B * tv6 16. tv2 = tv2 + tv5 17. x = tv1 * tv3 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6) 19. y = tv1 * u 20. y = y * y1 21. x = CMOV(x, tv3, is_gx1_square) 22. y = CMOV(y, y1, is_gx1_square) 23. e1 = sgn0(u) == sgn0(y) 24. y = CMOV(-y, y, e1) 25. x = x / tv4 26. return (x, y)</sourcecode>]]></sourcecode> <sectionanchor="straightline-sswu-sqrt-ratio" numbered="true" toc="default">anchor="straightline-sswu-sqrt-ratio"> <name>sqrt_ratiosubroutines</name>Subroutine</name> <t>This section defines three variants of the sqrt_ratio subroutine used by the above procedure. The first variant can be used with any field; the others are optimized versions for specific fields.</t> <t>The routines given in this section depend on the constant Z from thesimplifiedSimplified SWU map. For correctness, sqrt_ratio and map_to_curve_simple_swuMUST<bcp14>MUST</bcp14> use the same value for Z.</t> <sectionanchor="sqrtratio-for-any-field" numbered="true" toc="default">anchor="sqrtratio-for-any-field"> <name>sqrt_ratio forany field</name>Any Field</name> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_ratio(u, v) Parameters: - F, a finite field of characteristic p and order q = p^m. - Z, the constant from thesimplifiedSimplified SWU map. Input: u and v, elements of F, where v != 0. Output: (b, y), where b = True and y = sqrt(u / v) if (u / v) is square in F, and b = False and y = sqrt(Z * (u / v)) otherwise. Constants: 1. c1, the largest integer such that 2^c1 divides q - 1. 2. c2 = (q - 1) / (2^c1) # Integer arithmetic 3. c3 = (c2 - 1) / 2 # Integer arithmetic 4. c4 = 2^c1 - 1 # Integer arithmetic 5. c5 = 2^(c1 - 1) # Integer arithmetic 6. c6 = Z^c2 7. c7 = Z^((c2 + 1) / 2) Procedure: 1. tv1 = c6 2. tv2 = v^c4 3. tv3 = tv2^2 4. tv3 = tv3 * v 5. tv5 = u * tv3 6. tv5 = tv5^c3 7. tv5 = tv5 * tv2 8. tv2 = tv5 * v 9. tv3 = tv5 * u 10. tv4 = tv3 * tv2 11. tv5 = tv4^c5 12. isQR = tv5 == 1 13. tv2 = tv3 * c7 14. tv5 = tv4 * tv1 15. tv3 = CMOV(tv2, tv3, isQR) 16. tv4 = CMOV(tv5, tv4, isQR) 17. for i in (c1, c1 - 1, ..., 2): 18. tv5 = i - 2 19. tv5 = 2^tv5 20. tv5 = tv4^tv5 21. e1 = tv5 == 1 22. tv2 = tv3 * tv1 23. tv1 = tv1 * tv1 24. tv5 = tv4 * tv1 25. tv3 = CMOV(tv2, tv3, e1) 26. tv4 = CMOV(tv5, tv4, e1) 27. return (isQR, tv3)</sourcecode>]]></sourcecode> </section> <sectionanchor="optimized-sqrtratio-for-q-3-mod-4" numbered="true" toc="default"> <name>optimizedanchor="optimized-sqrtratio-for-q-3-mod-4"> <name>Optimized sqrt_ratio for q = 3 mod 4</name> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_ratio_3mod4(u, v) Parameters: - F, a finite field of characteristic p and order q = p^m, where q = 3 mod 4. - Z, the constant from thesimplifiedSimplified SWU map. Input: u and v, elements of F, where v != 0. Output: (b, y), where b = True and y = sqrt(u / v) if (u / v) is square in F, and b = False and y = sqrt(Z * (u / v)) otherwise. Constants: 1. c1 = (q - 3) / 4 # Integer arithmetic 2. c2 = sqrt(-Z) Procedure: 1. tv1 = v^2 2. tv2 = u * v 3. tv1 = tv1 * tv2 4. y1 = tv1^c1 5. y1 = y1 * tv2 6. y2 = y1 * c2 7. tv3 = y1^2 8. tv3 = tv3 * v 9. isQR = tv3 == u 10. y = CMOV(y2, y1, isQR) 11. return (isQR, y)</sourcecode>]]></sourcecode> </section> <sectionanchor="optimized-sqrtratio-for-q-5-mod-8" numbered="true" toc="default"> <name>optimizedanchor="optimized-sqrtratio-for-q-5-mod-8"> <name>Optimized sqrt_ratio for q = 5 mod 8</name> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_ratio_5mod8(u, v) Parameters: - F, a finite field of characteristic p and order q = p^m, where q = 5 mod 8. - Z, the constant from thesimplifiedSimplified SWU map. Input: u and v, elements of F, where v != 0. Output: (b, y), where b = True and y = sqrt(u / v) if (u / v) is square in F, and b = False and y = sqrt(Z * (u / v)) otherwise. Constants: 1. c1 = (q - 5) / 8 2. c2 = sqrt(-1) 3. c3 = sqrt(Z / c2) Steps: 1. tv1 = v^2 2. tv2 = tv1 * v 3. tv1 = tv1^2 4. tv2 = tv2 * u 5. tv1 = tv1 * tv2 6. y1 = tv1^c1 7. y1 = y1 * tv2 8. tv1 = y1 * c2 9. tv2 = tv1^2 10. tv2 = tv2 * v 11. e1 = tv2 == u 12. y1 = CMOV(y1, tv1, e1) 13. tv2 = y1^2 14. tv2 = tv2 * v 15. isQR = tv2 == u 16. y2 = y1 * c3 17. tv1 = y2 * c2 18. tv2 = tv1^2 19. tv2 = tv2 * v 20. tv3 = Z * u 21. e2 = tv2 == tv3 22. y2 = CMOV(y2, tv1, e2) 23. y = CMOV(y2, y1, isQR) 24. return (isQR, y)</sourcecode>]]></sourcecode> </section> </section> </section> <sectionanchor="straightline-ell2" numbered="true" toc="default">anchor="straightline-ell2"> <name>Elligator 2method</name>Method</name> <t>This section gives a straight-line implementation of the Elligator 2 method for any Montgomery curve of the form given in <xreftarget="montgomery" format="default"/>.target="montgomery"/>. See <xreftarget="elligator2" format="default"/>target="elligator2"/> for information on the constants used in this mapping.</t> <t><xreftarget="ell2-opt" format="default"/>target="ell2-opt"/> gives optimized straight-line procedures that apply to specific classes of curves and base fields, including curve25519 and curve448 <xreftarget="RFC7748" format="default"/>.</t>target="RFC7748"/>.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2(u) Input: u, an element of F. Output: (s, t), a point on M. Constants: 1. c1 = J / K 2. c2 = 1 / K^2 Steps: 1. tv1 = u^2 2. tv1 = Z * tv1 # Z * u^2 3. e1 = tv1 == -1 # exceptional case: Z * u^2 == -1 4. tv1 = CMOV(tv1, 0, e1) # if tv1 == -1, set tv1 = 0 5. x1 = tv1 + 1 6. x1 = inv0(x1) 7. x1 = -c1 * x1 # x1 = -(J / K) / (1 + Z * u^2) 8. gx1 = x1 + c1 9. gx1 = gx1 * x1 10. gx1 = gx1 + c2 11. gx1 = gx1 * x1 # gx1 = x1^3 + (J / K) * x1^2 + x1 / K^2 12. x2 = -x1 - c1 13. gx2 = tv1 * gx1 14. e2 = is_square(gx1) # If is_square(gx1) 15. x = CMOV(x2, x1, e2) # then x = x1, else x = x2 16. y2 = CMOV(gx2, gx1, e2) # then y2 = gx1, else y2 = gx2 17. y = sqrt(y2) 18. e3 = sgn0(y) == 1 19. y = CMOV(y, -y, e2 XOR e3) # fix sign of y 20. s = x * K 21. t = y * K 22. return (s, t)</sourcecode>]]></sourcecode> </section> </section> <sectionanchor="samplecode" numbered="true" toc="default"> <name>Curve-specific optimized sample code</name>anchor="samplecode"> <name>Curve-Specific Optimized Sample Code</name> <t>This section gives sample implementations optimized for some of the elliptic curves listed in <xreftarget="suites" format="default"/>.target="suites"/>. Sample Sage<xref target="SAGE" format="default"/>code <xref target="SAGE"/> for each algorithm can also be found inthe draft repository<xreftarget="hash2curve-repo" format="default"/>.</t>target="hash2curve-repo"/>.</t> <sectionanchor="projective-coords" numbered="true" toc="default">anchor="projective-coords"> <name>Interface andprojective coordinate systems</name>Projective Coordinate Systems</name> <t>The sample code in this section uses a different interface than the mappings of <xreftarget="mappings" format="default"/>.target="mappings"/>. Specifically, each mapping function in this section has the following signature:</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ (xn, xd, yn, yd) = map_to_curve(u)</sourcecode>]]></sourcecode> <t>The resulting affine point (x, y) is given by (xn / xd, yn / yd).</t> <t>The reason for this modified interface is that it enables further optimizations when working with points in a projective coordinate system. This is desirable, for example, when the resulting point will be immediately multiplied by a scalar, since most scalar multiplication algorithms operate on projective points.</t> <t>Projective coordinates are also useful when implementingrandom oraclerandom-oracle encodings (<xreftarget="roadmap" format="default"/>).target="roadmap"/>). One reason is that, in general, point addition is faster using projective coordinates. Another reason is that, for Weierstrass curves, projective coordinates allow using complete addition formulas <xreftarget="RCB16" format="default"/>.target="RCB16"/>. This is especially convenient when implementing a constant-time encoding, because it eliminates the need for a special case when Q0 == Q1, which incomplete addition formulas usually do not handle.</t> <t>The following are two commonly used projective coordinate systems and the corresponding conversions:</t> <ul spacing="normal"> <li>A point (X, Y, Z) in homogeneous projective coordinates corresponds to the affine point (x, y) = (X / Z, Y / Z); the inverse conversion is given by (X, Y, Z) = (x, y, 1). To convert (xn, xd, yn, yd) to homogeneous projective coordinates, compute (X, Y, Z) = (xn * yd, yn * xd, xd * yd).</li> <li>A point (X', Y', Z') in Jacobian projective coordinates corresponds to the affine point (x, y) =(X' / Z'^2,(X' / Z'^2, Y' / Z'^3); the inverse conversion is given by (X', Y', Z') = (x, y, 1). To convert (xn, xd, yn, yd) to Jacobian projective coordinates, compute (X', Y', Z') = (xn * xd * yd^2, yn * yd^2 * xd^3, xd * yd).</li> </ul> </section> <sectionanchor="ell2-opt" numbered="true" toc="default">anchor="ell2-opt"> <name>Elligator 2</name> <sectionanchor="map-to-curve25519" numbered="true" toc="default">anchor="map-to-curve25519"> <name>curve25519 (q = 5 (mod 8), K = 1)</name> <t>The following is a straight-line implementation of Elligator 2 for curve25519 <xreftarget="RFC7748" format="default"/>target="RFC7748"/> as specified in <xreftarget="suites-25519" format="default"/>.</t>target="suites-25519"/>.</t> <t>This implementation can also be used for any Montgomery curve with K = 1 over GF(q) where q = 5 (mod 8).</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_curve25519(u) Input: u, an element of F. Output: (xn, xd, yn, yd) such that (xn / xd, yn / yd) is a point on curve25519. Constants: 1. c1 = (q + 3) / 8 # Integer arithmetic 2. c2 = 2^c1 3. c3 = sqrt(-1) 4. c4 = (q - 5) / 8 # Integer arithmetic Steps: 1. tv1 = u^2 2. tv1 = 2 * tv1 3. xd = tv1 + 1 # Nonzero: -1 is square (mod p), tv1 is not 4. x1n = -J # x1 = x1n / xd = -J / (1 + 2 * u^2) 5. tv2 = xd^2 6. gxd = tv2 * xd # gxd = xd^3 7. gx1 = J * tv1 # x1n + J * xd 8. gx1 = gx1 * x1n # x1n^2 + J * x1n * xd 9. gx1 = gx1 + tv2 # x1n^2 + J * x1n * xd + xd^2 10. gx1 = gx1 * x1n # x1n^3 + J * x1n^2 * xd + x1n * xd^2 11. tv3 = gxd^2 12. tv2 = tv3^2 # gxd^4 13. tv3 = tv3 * gxd # gxd^3 14. tv3 = tv3 * gx1 # gx1 * gxd^3 15. tv2 = tv2 * tv3 # gx1 * gxd^7 16. y11 = tv2^c4 # (gx1 * gxd^7)^((p - 5) / 8) 17. y11 = y11 * tv3 # gx1 * gxd^3 * (gx1 * gxd^7)^((p - 5) / 8) 18. y12 = y11 * c3 19. tv2 = y11^2 20. tv2 = tv2 * gxd 21. e1 = tv2 == gx1 22. y1 = CMOV(y12, y11, e1) # If g(x1) is square, this is its sqrt 23. x2n = x1n * tv1 # x2 = x2n / xd = 2 * u^2 * x1n / xd 24. y21 = y11 * u 25. y21 = y21 * c2 26. y22 = y21 * c3 27. gx2 = gx1 * tv1 # g(x2) = gx2 / gxd = 2 * u^2 * g(x1) 28. tv2 = y21^2 29. tv2 = tv2 * gxd 30. e2 = tv2 == gx2 31. y2 = CMOV(y22, y21, e2) # If g(x2) is square, this is its sqrt 32. tv2 = y1^2 33. tv2 = tv2 * gxd 34. e3 = tv2 == gx1 35. xn = CMOV(x2n, x1n, e3) # If e3, x = x1, else x = x2 36. y = CMOV(y2, y1, e3) # If e3, y = y1, else y = y2 37. e4 = sgn0(y) == 1 # Fix sign of y 38. y = CMOV(y, -y, e3 XOR e4) 39. return (xn, xd, y, 1)</sourcecode>]]></sourcecode> </section> <sectionanchor="map-to-edwards25519" numbered="true" toc="default">anchor="map-to-edwards25519"> <name>edwards25519</name> <t>The following is a straight-line implementation of Elligator 2 for edwards25519 <xreftarget="RFC7748" format="default"/>target="RFC7748"/> as specified in <xreftarget="suites-25519" format="default"/>.target="suites-25519"/>. The subroutine map_to_curve_elligator2_curve25519 is defined in <xreftarget="map-to-curve25519" format="default"/>.</t>target="map-to-curve25519"/>.</t> <t>Note that the sign of the constant c1 below is chosen as specified in <xreftarget="rational-map" format="default"/>,target="rational-map"/>, i.e., applying the rational map to the edwards25519 base point yields the curve25519 base point (see erratum <xreftarget="EID4730" format="default"/>).</t>target="Err4730"/>).</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_edwards25519(u) Input: u, an element of F. Output: (xn, xd, yn, yd) such that (xn / xd, yn / yd) is a point on edwards25519. Constants: 1. c1 = sqrt(-486664) # sgn0(c1) MUST equal 0 Steps: 1. (xMn, xMd, yMn, yMd) = map_to_curve_elligator2_curve25519(u) 2. xn = xMn * yMd 3. xn = xn * c1 4. xd = xMd * yMn # xn / xd = c1 * xM / yM 5. yn = xMn - xMd 6. yd = xMn + xMd # (n / d - 1) / (n / d + 1) = (n - d) / (n + d) 7. tv1 = xd * yd 8. e = tv1 == 0 9. xn = CMOV(xn, 0, e) 10. xd = CMOV(xd, 1, e) 11. yn = CMOV(yn, 1, e) 12. yd = CMOV(yd, 1, e) 13. return (xn, xd, yn, yd)</sourcecode>]]></sourcecode> </section> <sectionanchor="map-to-curve448" numbered="true" toc="default">anchor="map-to-curve448"> <name>curve448 (q = 3 (mod 4), K = 1)</name> <t>The following is a straight-line implementation of Elligator 2 for curve448 <xreftarget="RFC7748" format="default"/>target="RFC7748"/> as specified in <xreftarget="suites-448" format="default"/>.</t>target="suites-448"/>.</t> <t>This implementation can also be used for any Montgomery curve with K = 1 over GF(q) where q = 3 (mod 4).</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_curve448(u) Input: u, an element of F. Output: (xn, xd, yn, yd) such that (xn / xd, yn / yd) is a point on curve448. Constants: 1. c1 = (q - 3) / 4 # Integer arithmetic Steps: 1. tv1 = u^2 2. e1 = tv1 == 1 3. tv1 = CMOV(tv1, 0, e1) # If Z * u^2 == -1, set tv1 = 0 4. xd = 1 - tv1 5. x1n = -J 6. tv2 = xd^2 7. gxd = tv2 * xd # gxd = xd^3 8. gx1 = -J * tv1 # x1n + J * xd 9. gx1 = gx1 * x1n # x1n^2 + J * x1n * xd 10. gx1 = gx1 + tv2 # x1n^2 + J * x1n * xd + xd^2 11. gx1 = gx1 * x1n # x1n^3 + J * x1n^2 * xd + x1n * xd^2 12. tv3 = gxd^2 13. tv2 = gx1 * gxd # gx1 * gxd 14. tv3 = tv3 * tv2 # gx1 * gxd^3 15. y1 = tv3^c1 # (gx1 * gxd^3)^((p - 3) / 4) 16. y1 = y1 * tv2 # gx1 * gxd * (gx1 * gxd^3)^((p - 3) / 4) 17. x2n = -tv1 * x1n # x2 = x2n / xd = -1 * u^2 * x1n / xd 18. y2 = y1 * u 19. y2 = CMOV(y2, 0, e1) 20. tv2 = y1^2 21. tv2 = tv2 * gxd 22. e2 = tv2 == gx1 23. xn = CMOV(x2n, x1n, e2) # If e2, x = x1, else x = x2 24. y = CMOV(y2, y1, e2) # If e2, y = y1, else y = y2 25. e3 = sgn0(y) == 1 # Fix sign of y 26. y = CMOV(y, -y, e2 XOR e3) 27. return (xn, xd, y, 1)</sourcecode>]]></sourcecode> </section> <sectionanchor="map-to-edwards448" numbered="true" toc="default">anchor="map-to-edwards448"> <name>edwards448</name> <t>The following is a straight-line implementation of Elligator 2 for edwards448 <xreftarget="RFC7748" format="default"/>target="RFC7748"/> as specified in <xreftarget="suites-448" format="default"/>.target="suites-448"/>. The subroutine map_to_curve_elligator2_curve448 is defined in <xreftarget="map-to-curve448" format="default"/>.</t>target="map-to-curve448"/>.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_edwards448(u) Input: u, an element of F. Output: (xn, xd, yn, yd) such that (xn / xd, yn / yd) is a point on edwards448. Steps: 1. (xn, xd, yn, yd) = map_to_curve_elligator2_curve448(u) 2. xn2 = xn^2 3. xd2 = xd^2 4. xd4 = xd2^2 5. yn2 = yn^2 6. yd2 = yd^2 7. xEn = xn2 - xd2 8. tv2 = xEn - xd2 9. xEn = xEn * xd2 10. xEn = xEn * yd 11. xEn = xEn * yn 12. xEn = xEn * 4 13. tv2 = tv2 * xn2 14. tv2 = tv2 * yd2 15. tv3 = 4 * yn2 16. tv1 = tv3 + yd2 17. tv1 = tv1 * xd4 18. xEd = tv1 + tv2 19. tv2 = tv2 * xn 20. tv4 = xn * xd4 21. yEn = tv3 - yd2 22. yEn = yEn * tv4 23. yEn = yEn - tv2 24. tv1 = xn2 + xd2 25. tv1 = tv1 * xd2 26. tv1 = tv1 * xd 27. tv1 = tv1 * yn2 28. tv1 = -2 * tv1 29. yEd = tv2 + tv1 30. tv4 = tv4 * yd2 31. yEd = yEd + tv4 32. tv1 = xEd * yEd 33. e = tv1 == 0 34. xEn = CMOV(xEn, 0, e) 35. xEd = CMOV(xEd, 1, e) 36. yEn = CMOV(yEn, 1, e) 37. yEd = CMOV(yEd, 1, e) 38. return (xEn, xEd, yEn, yEd)</sourcecode>]]></sourcecode> </section> <sectionanchor="ell2-map-to-3mod4" numbered="true" toc="default">anchor="ell2-map-to-3mod4"> <name>MontgomerycurvesCurves with q = 3 (mod 4)</name> <t>The following is a straight-line implementation of Elligator 2 that applies to any Montgomery curve defined over GF(q) where q = 3 (mod 4).</t> <t>For curves where K = 1, the implementation given in <xreftarget="map-to-curve448" format="default"/>target="map-to-curve448"/> gives identical results with slightly reduced cost.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_3mod4(u) Input: u, an element of F. Output: (xn, xd, yn, yd) such that (xn / xd, yn / yd) is a point on the target curve. Constants: 1. c1 = (q - 3) / 4 # Integer arithmetic 2. c2 = K^2 Steps: 1. tv1 = u^2 2. e1 = tv1 == 1 3. tv1 = CMOV(tv1, 0, e1) # If Z * u^2 == -1, set tv1 = 0 4. xd = 1 - tv1 5. xd = xd * K 6. x1n = -J # x1 = x1n / xd = -J / (K * (1 + 2 * u^2)) 7. tv2 = xd^2 8. gxd = tv2 * xd 9. gxd = gxd * c2 # gxd = xd^3 * K^2 10. gx1 = x1n * K 11. tv3 = xd * J 12. tv3 = gx1 + tv3 # x1n * K + xd * J 13. gx1 = gx1 * tv3 # K^2 * x1n^2 + J * K * x1n * xd 14. gx1 = gx1 + tv2 # K^2 * x1n^2 + J * K * x1n * xd + xd^2 15. gx1 = gx1 * x1n # K^2 * x1n^3 + J * K * x1n^2 * xd + x1n * xd^2 16. tv3 = gxd^2 17. tv2 = gx1 * gxd # gx1 * gxd 18. tv3 = tv3 * tv2 # gx1 * gxd^3 19. y1 = tv3^c1 # (gx1 * gxd^3)^((q - 3) / 4) 20. y1 = y1 * tv2 # gx1 * gxd * (gx1 * gxd^3)^((q - 3) / 4) 21. x2n = -tv1 * x1n # x2 = x2n / xd = -1 * u^2 * x1n / xd 22. y2 = y1 * u 23. y2 = CMOV(y2, 0, e1) 24. tv2 = y1^2 25. tv2 = tv2 * gxd 26. e2 = tv2 == gx1 27. xn = CMOV(x2n, x1n, e2) # If e2, x = x1, else x = x2 28. xn = xn * K 29. y = CMOV(y2, y1, e2) # If e2, y = y1, else y = y2 30. e3 = sgn0(y) == 1 # Fix sign of y 31. y = CMOV(y, -y, e2 XOR e3) 32. y = y * K 33. return (xn, xd, y, 1)</sourcecode>]]></sourcecode> </section> <sectionanchor="ell2-map-to-5mod8" numbered="true" toc="default">anchor="ell2-map-to-5mod8"> <name>MontgomerycurvesCurves with q = 5 (mod 8)</name> <t>The following is a straight-line implementation of Elligator 2 that applies to any Montgomery curve defined over GF(q) where q = 5 (mod 8).</t> <t>For curves where K = 1, the implementation given in <xreftarget="map-to-curve25519" format="default"/>target="map-to-curve25519"/> gives identical results with slightly reduced cost.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ map_to_curve_elligator2_5mod8(u) Input: u, an element of F. Output: (xn, xd, yn, yd) such that (xn / xd, yn / yd) is a point on the target curve. Constants: 1. c1 = (q + 3) / 8 # Integer arithmetic 2. c2 = 2^c1 3. c3 = sqrt(-1) 4. c4 = (q - 5) / 8 # Integer arithmetic 5. c5 = K^2 Steps: 1. tv1 = u^2 2. tv1 = 2 * tv1 3. xd = tv1 + 1 # Nonzero: -1 is square (mod p), tv1 is not 4. xd = xd * K 5. x1n = -J # x1 = x1n / xd = -J / (K * (1 + 2 * u^2)) 6. tv2 = xd^2 7. gxd = tv2 * xd 8. gxd = gxd * c5 # gxd = xd^3 * K^2 9. gx1 = x1n * K 10. tv3 = xd * J 11. tv3 = gx1 + tv3 # x1n * K + xd * J 12. gx1 = gx1 * tv3 # K^2 * x1n^2 + J * K * x1n * xd 13. gx1 = gx1 + tv2 # K^2 * x1n^2 + J * K * x1n * xd + xd^2 14. gx1 = gx1 * x1n # K^2 * x1n^3 + J * K * x1n^2 * xd + x1n * xd^2 15. tv3 = gxd^2 16. tv2 = tv3^2 # gxd^4 17. tv3 = tv3 * gxd # gxd^3 18. tv3 = tv3 * gx1 # gx1 * gxd^3 19. tv2 = tv2 * tv3 # gx1 * gxd^7 20. y11 = tv2^c4 # (gx1 * gxd^7)^((q - 5) / 8) 21. y11 = y11 * tv3 # gx1 * gxd^3 * (gx1 * gxd^7)^((q - 5) / 8) 22. y12 = y11 * c3 23. tv2 = y11^2 24. tv2 = tv2 * gxd 25. e1 = tv2 == gx1 26. y1 = CMOV(y12, y11, e1) # If g(x1) is square, this is its sqrt 27. x2n = x1n * tv1 # x2 = x2n / xd = 2 * u^2 * x1n / xd 28. y21 = y11 * u 29. y21 = y21 * c2 30. y22 = y21 * c3 31. gx2 = gx1 * tv1 # g(x2) = gx2 / gxd = 2 * u^2 * g(x1) 32. tv2 = y21^2 33. tv2 = tv2 * gxd 34. e2 = tv2 == gx2 35. y2 = CMOV(y22, y21, e2) # If g(x2) is square, this is its sqrt 36. tv2 = y1^2 37. tv2 = tv2 * gxd 38. e3 = tv2 == gx1 39. xn = CMOV(x2n, x1n, e3) # If e3, x = x1, else x = x2 40. xn = xn * K 41. y = CMOV(y2, y1, e3) # If e3, y = y1, else y = y2 42. e4 = sgn0(y) == 1 # Fix sign of y 43. y = CMOV(y, -y, e3 XOR e4) 44. y = y * K 45. return (xn, xd, y, 1)</sourcecode>]]></sourcecode> </section> </section> <sectionanchor="clear-cofactor-bls12381-g2" numbered="true" toc="default">anchor="clear-cofactor-bls12381-g2"> <name>CofactorclearingClearing for BLS12-381 G2</name> <t>The curve BLS12-381, whose parameters are defined in <xreftarget="suites-bls12381-g2" format="default"/>,target="suites-bls12381-g2"/>, admits anefficiently-computable endomorphism psiefficiently computable endomorphism, psi, that can be used to speed up cofactor clearing for G2 <xreftarget="SBCDK09" format="default"/>target="SBCDK09"/> <xreftarget="FKR11" format="default"/>target="FKR11"/> <xreftarget="BP17" format="default"/>target="BP17"/> (see also <xreftarget="cofactor-clearing" format="default"/>).target="cofactor-clearing"/>). This section implements the endomorphism psi and a fast cofactor clearing method described by Budroni and Pintore <xreftarget="BP17" format="default"/>.</t>target="BP17"/>.</t> <t>The functions in this section operate on points whose coordinates are represented as ratios, i.e., (xn, xd, yn, yd) corresponds to the point (xn / xd, yn / yd); see <xreftarget="projective-coords" format="default"/>target="projective-coords"/> for further discussion of projective coordinates. When points are represented in affine coordinates, one can simply ignore the denominators (xd == 1 andyd ==yd == 1).</t> <t>The following function computes the Frobenius endomorphism for an element of F = GF(p^2) with basis (1, I), where I^2 + 1 == 0 in F. (This is the base field of the elliptic curve E defined in <xreftarget="suites-bls12381-g2" format="default"/>.)</t>target="suites-bls12381-g2"/>.)</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ frobenius(x) Input: x, an element of GF(p^2). Output: a, an element of GF(p^2). Notation: x = x0 + I * x1, where x0 and x1 are elements of GF(p). Steps: 1. a = x0 - I * x1 2. return a</sourcecode>]]></sourcecode> <t>The following function computes the endomorphism psi for points on the elliptic curve E defined in <xreftarget="suites-bls12381-g2" format="default"/>.</t>target="suites-bls12381-g2"/>.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ psi(xn, xd, yn, yd) Input: P, a point (xn / xd, yn / yd) on the curve E (see above). Output: Q, a point on the same curve. Constants: 1. c1 = 1 / (1 + I)^((p - 1) / 3) # in GF(p^2) 2. c2 = 1 / (1 + I)^((p - 1) / 2) # in GF(p^2) Steps: 1. qxn = c1 * frobenius(xn) 2. qxd = frobenius(xd) 3. qyn = c2 * frobenius(yn) 4. qyd = frobenius(yd) 5. return (qxn, qxd, qyn, qyd)</sourcecode>]]></sourcecode> <t>The following function efficiently computes psi(psi(P)).</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ psi2(xn, xd, yn, yd) Input: P, a point (xn / xd, yn / yd) on the curve E (see above). Output: Q, a point on the same curve. Constants: 1. c1 = 1 / 2^((p - 1) / 3) # in GF(p^2) Steps: 1. qxn = c1 * xn 2. qyn = -yn 3. return (qxn, xd, qyn, yd)</sourcecode>]]></sourcecode> <t>The following function maps any point on the elliptic curve E (<xreftarget="suites-bls12381-g2" format="default"/>)target="suites-bls12381-g2"/>) into the prime-order subgroup G2. This function returns a point equal to h_eff * P, where h_eff is the parameter given in <xreftarget="suites-bls12381-g2" format="default"/>.</t>target="suites-bls12381-g2"/>.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ clear_cofactor_bls12381_g2(P) Input: P, a point (xn / xd, yn / yd) on the curve E (see above). Output: Q, a point in the subgroup G2 of BLS12-381. Constants: 1. c1 = -15132376222941642752 # the BLS parameter for BLS12-381 # i.e., -0xd201000000010000 Notation: in this procedure, + and - represent elliptic curve point addition and subtraction, respectively, and * represents scalar multiplication. Steps: 1. t1 = c1 * P 2. t2 = psi(P) 3. t3 = 2 * P 4. t3 = psi2(t3) 5. t3 = t3 - t2 6. t2 = t1 + t2 7. t2 = c1 * t2 8. t3 = t3 + t2 9. t3 = t3 - t1 10. Q = t3 - P 11. return Q</sourcecode>]]></sourcecode> </section> </section> <sectionanchor="paramgen" numbered="true" toc="default">anchor="paramgen"> <name>Scripts forparameter generation</name>Parameter Generation</name> <t>This section gives Sage<xref target="SAGE" format="default"/>scripts <xref target="SAGE"/> used to generate parameters for the mappings of <xreftarget="mappings" format="default"/>.</t>target="mappings"/>.</t> <sectionanchor="svdw-z-code" numbered="true" toc="default">anchor="svdw-z-code"> <name>Finding Z for the Shallue-van de Woestijnemap</name>Map</name> <t>The below function outputs an appropriate Z for theShallue and vanShallue-van de Woestijne map (<xreftarget="svdw" format="default"/>).</t>target="svdw"/>).</t> <sourcecodetype="sage">type=""><![CDATA[ # Arguments: # - F, a field object, e.g., F = GF(2^521 - 1) # - A and B, the coefficients of the curve y^2 = x^3 + A * x + B def find_z_svdw(F, A, B, init_ctr=1): g = lambda x: F(x)^3 + F(A) * F(x) + F(B) h = lambda Z: -(F(3) * Z^2 + F(4) * A) / (F(4) * g(Z)) # NOTE: if init_ctr=1 fails to find Z, try setting it to F.gen() ctr = init_ctr while True: for Z_cand in (F(ctr), F(-ctr)): # Criterion 1: # g(Z) != 0 in F. if g(Z_cand) == F(0): continue # Criterion 2: # -(3 * Z^2 + 4 * A) / (4 * g(Z)) != 0 in F. if h(Z_cand) == F(0): continue # Criterion 3: # -(3 * Z^2 + 4 * A) / (4 * g(Z)) is square in F. if not is_square(h(Z_cand)): continue # Criterion 4: # At least one of g(Z) and g(-Z / 2) is square in F. if is_square(g(Z_cand)) or is_square(g(-Z_cand / F(2))): return Z_cand ctr += 1</sourcecode>]]></sourcecode> </section> <sectionanchor="sswu-z-code" numbered="true" toc="default">anchor="sswu-z-code"> <name>Finding Z for Simplified SWU</name> <t>The below function outputs an appropriate Z for the Simplified SWU map (<xreftarget="simple-swu" format="default"/>).</t>target="simple-swu"/>).</t> <sourcecodetype="sage">type=""><![CDATA[ # Arguments: # - F, a field object, e.g., F = GF(2^521 - 1) # - A and B, the coefficients of the curve y^2 = x^3 + A * x + B def find_z_sswu(F, A, B):R.<xx>R.<xx> = F[] # Polynomial ring over F g = xx^3 + F(A) * xx + F(B) # y^2 = g(x) = x^3 + A * x + B ctr = F.gen() while True: for Z_cand in (F(ctr), F(-ctr)): # Criterion 1: Z is non-square in F. if is_square(Z_cand): continue # Criterion 2: Z != -1 in F. if Z_cand == F(-1): continue # Criterion 3: g(x) - Z is irreducible over F. if not (g - Z_cand).is_irreducible(): continue # Criterion 4: g(B / (Z * A)) is square in F. if is_square(g(B / (Z_cand * A))): return Z_cand ctr += 1</sourcecode>]]></sourcecode> </section> <sectionanchor="elligator-z-code" numbered="true" toc="default">anchor="elligator-z-code"> <name>Finding Z for Elligator 2</name> <t>The below function outputs an appropriate Z for the Elligator 2 map (<xreftarget="elligator2" format="default"/>).</t>target="elligator2"/>).</t> <sourcecodetype="sage">type=""><![CDATA[ # Argument: # - F, a field object, e.g., F = GF(2^255 - 19) def find_z_ell2(F): ctr = F.gen() while True: for Z_cand in (F(ctr), F(-ctr)): # Z must be a non-square in F. if is_square(Z_cand): continue return Z_cand ctr += 1</sourcecode>]]></sourcecode> </section> </section> <sectionanchor="appx-sqrt" numbered="true" toc="default">anchor="appx-sqrt"> <name>sqrt and is_squarefunctions</name>Functions</name> <t>This section defines special-purpose sqrt functions for the three most common cases, q = 3 (mod 4), q = 5 (mod 8), and q = 9 (mod 16), plus a generic constant-time algorithm that works for any prime modulus.</t> <t>In addition, it gives an optimized is_square method for GF(p^2).</t> <sectionanchor="sqrt-3mod4" numbered="true" toc="default">anchor="sqrt-3mod4"> <name>sqrt for q = 3 (mod 4)</name> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_3mod4(x) Parameters: - F, a finite field of characteristic p and order q = p^m. Input: x, an element of F. Output: z, an element of F such that (z^2) == x, if x is square in F. Constants: 1. c1 = (q + 1) / 4 # Integer arithmetic Procedure: 1. return x^c1</sourcecode>]]></sourcecode> </section> <sectionanchor="sqrt-5mod8" numbered="true" toc="default">anchor="sqrt-5mod8"> <name>sqrt for q = 5 (mod 8)</name> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_5mod8(x) Parameters: - F, a finite field of characteristic p and order q = p^m. Input: x, an element of F. Output: z, an element of F such that (z^2) == x, if x is square in F. Constants: 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F 2. c2 = (q + 3) / 8 # Integer arithmetic Procedure: 1. tv1 = x^c2 2. tv2 = tv1 * c1 3. e = (tv1^2) == x 4. z = CMOV(tv2, tv1, e) 5. return z</sourcecode>]]></sourcecode> </section> <sectionanchor="sqrt-9mod16" numbered="true" toc="default">anchor="sqrt-9mod16"> <name>sqrt for q = 9 (mod 16)</name> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_9mod16(x) Parameters: - F, a finite field of characteristic p and order q = p^m. Input: x, an element of F. Output: z, an element of F such that (z^2) == x, if x is square in F. Constants: 1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F 2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F 3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F 4. c4 = (q + 7) / 16 # Integer arithmetic Procedure: 1. tv1 = x^c4 2. tv2 = c1 * tv1 3. tv3 = c2 * tv1 4. tv4 = c3 * tv1 5. e1 = (tv2^2) == x 6. e2 = (tv3^2) == x 7. tv1 = CMOV(tv1, tv2, e1) # Select tv2 if (tv2^2) == x 8. tv2 = CMOV(tv4, tv3, e2) # Select tv3 if (tv3^2) == x 9. e3 = (tv2^2) == x 10. z = CMOV(tv1, tv2, e3) # Select the sqrt from tv1 and tv2 11. return z</sourcecode>]]></sourcecode> </section> <sectionanchor="sqrt-ts" numbered="true" toc="default"> <name>Constant-timeanchor="sqrt-ts"> <name>Constant-Time Tonelli-Shanksalgorithm</name>Algorithm</name> <t>This algorithm is a constant-time version of the classic Tonelli-Shanks algorithm (<xreftarget="C93" format="default"/>,target="C93"/>, Algorithm 1.5.1) due to Sean Bowe, Jack Grigg, and Eirik Ogilvie-Wigley <xreftarget="jubjub-fq" format="default"/>,target="jubjub-fq"/>, adapted and optimized by Michael Scott.</t> <t>This algorithm applies to GF(p) for any p. Note, however, that the special-purpose algorithms given in the prior sections are faster, when they apply.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ sqrt_ts_ct(x) Parameters: - F, a finite field of characteristic p and order q = p^m. Input x, an element of F. Output: z, an element of F such that z^2 == x, if x is square in F. Constants: 1. c1, the largest integer such that 2^c1 divides q - 1. 2. c2 = (q - 1) / (2^c1) # Integer arithmetic 3. c3 = (c2 - 1) / 2 # Integer arithmetic 4. c4, a non-square value in F 5. c5 = c4^c2 in F Procedure: 1. z = x^c3 2. t = z * z 3. t = t * x 4. z = z * x 5. b = t 6. c = c5 7. for i in (c1, c1 - 1, ..., 2): 8. for j in (1, 2, ..., i - 2): 9. b = b * b 10. e = b == 1 11. zt = z * c 12. z = CMOV(zt, z, e) 13. c = c * c 14. tt = t * c 15. t = CMOV(tt, t, e) 16. b = t 17. return z</sourcecode>]]></sourcecode> </section> <sectionanchor="appx-sqrt-issq" numbered="true" toc="default">anchor="appx-sqrt-issq"> <name>is_square for F = GF(p^2)</name> <t>The following is_square method applies to any field F = GF(p^2) with basis (1, I) represented as described in <xreftarget="bg-curves" format="default"/>,target="bg-curves"/>, i.e., an element x = (x_1, x_2) = x_1 + x_2 * I.</t> <t>Other optimizations of this type are possible in other extension fields; see,e.g.,for example, <xreftarget="AR13" format="default"/>target="AR13"/> for more information.</t> <sourcecodetype="pseudocode">type="pseudocode"><![CDATA[ is_square(x) Parameters: - F, an extension field of characteristic p and order q = p^2 with basis (1, I). Input: x, an element of F. Output: True if x is square in F, and False otherwise. Constants: 1. c1 = (p - 1) / 2 # Integer arithmetic Procedure: 1. tv1 = x_1^2 2. tv2 = I * x_2 3. tv2 = tv2^2 4. tv1 = tv1 - tv2 5. tv1 = tv1^c1 6. e1 = tv1 != -1 # Note: -1 in F 7. return e1</sourcecode>]]></sourcecode> </section> </section> <sectionanchor="testvectors" numbered="true" toc="default">anchor="testvectors"> <name>Suitetest vectors</name>Test Vectors</name> <t>This section gives test vectors for each suite defined in <xreftarget="suites" format="default"/>.target="suites"/>. The test vectors in this section were generated using code that is available from <xreftarget="hash2curve-repo" format="default"/>.</t>target="hash2curve-repo"/>.</t> <t>Each test vector in this section lists values computed by the appropriate encoding function, with variable names defined as in <xreftarget="roadmap" format="default"/>.target="roadmap"/>. For example, for a suite whose encoding type is random oracle, the test vector gives the value for msg, u, Q0, Q1, and the output point P.</t> <sectionanchor="nist-p-256" numbered="true" toc="default">anchor="nist-p-256"> <name>NIST P-256</name> <sectionanchor="p256xmdsha-256sswuro" numbered="true" toc="default">anchor="p256xmdsha-256sswuro"> <name>P256_XMD:SHA-256_SSWU_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = P256_XMD:SHA-256_SSWU_RO_ dst = QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_RO_ msg = P.x = 2c15230b26dbc6fc9a37051158c95b79656e17a1a920b11394ca91 c44247d3e4 P.y = 8a7a74985cc5c776cdfe4b1f19884970453912e9d31528c060be9a b5c43e8415 u[0] = ad5342c66a6dd0ff080df1da0ea1c04b96e0330dd89406465eeba1 1582515009 u[1] = 8c0f1d43204bd6f6ea70ae8013070a1518b43873bcd850aafa0a9e 220e2eea5a Q0.x = ab640a12220d3ff283510ff3f4b1953d09fad35795140b1c5d64f3 13967934d5 Q0.y = dccb558863804a881d4fff3455716c836cef230e5209594ddd33d8 5c565b19b1 Q1.x = 51cce63c50d972a6e51c61334f0f4875c9ac1cd2d3238412f84e31 da7d980ef5 Q1.y = b45d1a36d00ad90e5ec7840a60a4de411917fbe7c82c3949a6e699 e5a1b66aac msg = abc P.x = 0bb8b87485551aa43ed54f009230450b492fead5f1cc91658775da c4a3388a0f P.y = 5c41b3d0731a27a7b14bc0bf0ccded2d8751f83493404c84a88e71 ffd424212e u[0] = afe47f2ea2b10465cc26ac403194dfb68b7f5ee865cda61e9f3e07 a537220af1 u[1] = 379a27833b0bfe6f7bdca08e1e83c760bf9a338ab335542704edcd 69ce9e46e0 Q0.x = 5219ad0ddef3cc49b714145e91b2f7de6ce0a7a7dc7406c7726c7e 373c58cb48 Q0.y = 7950144e52d30acbec7b624c203b1996c99617d0b61c2442354301 b191d93ecf Q1.x = 019b7cb4efcfeaf39f738fe638e31d375ad6837f58a852d032ff60 c69ee3875f Q1.y = 589a62d2b22357fed5449bc38065b760095ebe6aeac84b01156ee4 252715446e msg = abcdef0123456789 P.x = 65038ac8f2b1def042a5df0b33b1f4eca6bff7cb0f9c6c15268118 64e544ed80 P.y = cad44d40a656e7aff4002a8de287abc8ae0482b5ae825822bb870d 6df9b56ca3 u[0] = 0fad9d125a9477d55cf9357105b0eb3a5c4259809bf87180aa01d6 51f53d312c u[1] = b68597377392cd3419d8fcc7d7660948c8403b19ea78bbca4b133c 9d2196c0fb Q0.x = a17bdf2965eb88074bc01157e644ed409dac97cfcf0c61c998ed0f a45e79e4a2 Q0.y = 4f1bc80c70d411a3cc1d67aeae6e726f0f311639fee560c7f5a664 554e3c9c2e Q1.x = 7da48bb67225c1a17d452c983798113f47e438e4202219dd0715f8 419b274d66 Q1.y = b765696b2913e36db3016c47edb99e24b1da30e761a8a3215dc0ec 4d8f96e6f9 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 4be61ee205094282ba8a2042bcb48d88dfbb609301c49aa8b07853 3dc65a0b5d P.y = 98f8df449a072c4721d241a3b1236d3caccba603f916ca680f4539 d2bfb3c29e u[0] = 3bbc30446f39a7befad080f4d5f32ed116b9534626993d2cc5033f 6f8d805919 u[1] = 76bb02db019ca9d3c1e02f0c17f8baf617bbdae5c393a81d9ce11e 3be1bf1d33 Q0.x = c76aaa823aeadeb3f356909cb08f97eee46ecb157c1f56699b5efe bddf0e6398 Q0.y = 776a6f45f528a0e8d289a4be12c4fab80762386ec644abf2bffb9b 627e4352b1 Q1.x = 418ac3d85a5ccc4ea8dec14f750a3a9ec8b85176c95a7022f39182 6794eb5a75 Q1.y = fd6604f69e9d9d2b74b072d14ea13050db72c932815523305cb9e8 07cc900aff msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 457ae2981f70ca85d8e24c308b14db22f3e3862c5ea0f652ca38b5 e49cd64bc5 P.y = ecb9f0eadc9aeed232dabc53235368c1394c78de05dd96893eefa6 2b0f4757dc u[0] = 4ebc95a6e839b1ae3c63b847798e85cb3c12d3817ec6ebc10af6ee 51adb29fec u[1] = 4e21af88e22ea80156aff790750121035b3eefaa96b425a8716e0d 20b4e269ee Q0.x = d88b989ee9d1295df413d4456c5c850b8b2fb0f5402cc5c4c7e815 412e926db8 Q0.y = bb4a1edeff506cf16def96afff41b16fc74f6dbd55c2210e5b8f01 1ba32f4f40 Q1.x = a281e34e628f3a4d2a53fa87ff973537d68ad4fbc28d3be5e8d9f6 a2571c5a4b Q1.y = f6ed88a7aab56a488100e6f1174fa9810b47db13e86be999644922 961206e184 ]]></artwork> </section> <sectionanchor="p256xmdsha-256sswunu" numbered="true" toc="default">anchor="p256xmdsha-256sswunu"> <name>P256_XMD:SHA-256_SSWU_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = P256_XMD:SHA-256_SSWU_NU_ dst = QUUX-V01-CS02-with-P256_XMD:SHA-256_SSWU_NU_ msg = P.x = f871caad25ea3b59c16cf87c1894902f7e7b2c822c3d3f73596c5a ce8ddd14d1 P.y = 87b9ae23335bee057b99bac1e68588b18b5691af476234b8971bc4 f011ddc99b u[0] = b22d487045f80e9edcb0ecc8d4bf77833e2bf1f3a54004d7df1d57 f4802d311f Q.x = f871caad25ea3b59c16cf87c1894902f7e7b2c822c3d3f73596c5a ce8ddd14d1 Q.y = 87b9ae23335bee057b99bac1e68588b18b5691af476234b8971bc4 f011ddc99b msg = abc P.x = fc3f5d734e8dce41ddac49f47dd2b8a57257522a865c124ed02b92 b5237befa4 P.y = fe4d197ecf5a62645b9690599e1d80e82c500b22ac705a0b421fac 7b47157866 u[0] = c7f96eadac763e176629b09ed0c11992225b3a5ae99479760601cb d69c221e58 Q.x = fc3f5d734e8dce41ddac49f47dd2b8a57257522a865c124ed02b92 b5237befa4 Q.y = fe4d197ecf5a62645b9690599e1d80e82c500b22ac705a0b421fac 7b47157866 msg = abcdef0123456789 P.x = f164c6674a02207e414c257ce759d35eddc7f55be6d7f415e2cc17 7e5d8faa84 P.y = 3aa274881d30db70485368c0467e97da0e73c18c1d00f34775d012 b6fcee7f97 u[0] = 314e8585fa92068b3ea2c3bab452d4257b38be1c097d58a2189045 6c2929614d Q.x = f164c6674a02207e414c257ce759d35eddc7f55be6d7f415e2cc17 7e5d8faa84 Q.y = 3aa274881d30db70485368c0467e97da0e73c18c1d00f34775d012 b6fcee7f97 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 324532006312be4f162614076460315f7a54a6f85544da773dc659 aca0311853 P.y = 8d8197374bcd52de2acfefc8a54fe2c8d8bebd2a39f16be9b710e4 b1af6ef883 u[0] = 752d8eaa38cd785a799a31d63d99c2ae4261823b4a367b133b2c66 27f48858ab Q.x = 324532006312be4f162614076460315f7a54a6f85544da773dc659 aca0311853 Q.y = 8d8197374bcd52de2acfefc8a54fe2c8d8bebd2a39f16be9b710e4 b1af6ef883 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 5c4bad52f81f39c8e8de1260e9a06d72b8b00a0829a8ea004a610b 0691bea5d9 P.y = c801e7c0782af1f74f24fc385a8555da0582032a3ce038de637ccd cb16f7ef7b u[0] = 0e1527840b9df2dfbef966678ff167140f2b27c4dccd884c25014d ce0e41dfa3 Q.x = 5c4bad52f81f39c8e8de1260e9a06d72b8b00a0829a8ea004a610b 0691bea5d9 Q.y = c801e7c0782af1f74f24fc385a8555da0582032a3ce038de637ccd cb16f7ef7b ]]></artwork> </section> </section> <sectionanchor="nist-p-384" numbered="true" toc="default">anchor="nist-p-384"> <name>NIST P-384</name> <sectionanchor="p384xmdsha-384sswuro" numbered="true" toc="default">anchor="p384xmdsha-384sswuro"> <name>P384_XMD:SHA-384_SSWU_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = P384_XMD:SHA-384_SSWU_RO_ dst = QUUX-V01-CS02-with-P384_XMD:SHA-384_SSWU_RO_ msg = P.x = eb9fe1b4f4e14e7140803c1d99d0a93cd823d2b024040f9c067a8e ca1f5a2eeac9ad604973527a356f3fa3aeff0e4d83 P.y = 0c21708cff382b7f4643c07b105c2eaec2cead93a917d825601e63 c8f21f6abd9abc22c93c2bed6f235954b25048bb1a u[0] = 25c8d7dc1acd4ee617766693f7f8829396065d1b447eedb155871f effd9c6653279ac7e5c46edb7010a0e4ff64c9f3b4 u[1] = 59428be4ed69131df59a0c6a8e188d2d4ece3f1b2a3a02602962b4 7efa4d7905945b1e2cc80b36aa35c99451073521ac Q0.x = e4717e29eef38d862bee4902a7d21b44efb58c464e3e1f0d03894d 94de310f8ffc6de86786dd3e15a1541b18d4eb2846 Q0.y = 6b95a6e639822312298a47526bb77d9cd7bcf76244c991c8cd7007 5e2ee6e8b9a135c4a37e3c0768c7ca871c0ceb53d4 Q1.x = 509527cfc0750eedc53147e6d5f78596c8a3b7360e0608e2fab056 3a1670d58d8ae107c9f04bcf90e89489ace5650efd Q1.y = 33337b13cb35e173fdea4cb9e8cce915d836ff57803dbbeb7998aa 49d17df2ff09b67031773039d09fbd9305a1566bc4 msg = abc P.x = e02fc1a5f44a7519419dd314e29863f30df55a514da2d655775a81 d413003c4d4e7fd59af0826dfaad4200ac6f60abe1 P.y = 01f638d04d98677d65bef99aef1a12a70a4cbb9270ec55248c0453 0d8bc1f8f90f8a6a859a7c1f1ddccedf8f96d675f6 u[0] = 53350214cb6bef0b51abb791b1c4209a2b4c16a0c67e1ab1401017 fad774cd3b3f9a8bcdf7f6229dd8dd5a075cb149a0 u[1] = c0473083898f63e03f26f14877a2407bd60c75ad491e7d26cbc6cc 5ce815654075ec6b6898c7a41d74ceaf720a10c02e Q0.x = fc853b69437aee9a19d5acf96a4ee4c5e04cf7b53406dfaa2afbdd 7ad2351b7f554e4bbc6f5db4177d4d44f933a8f6ee Q0.y = 7e042547e01834c9043b10f3a8221c4a879cb156f04f72bfccab0c 047a304e30f2aa8b2e260d34c4592c0c33dd0c6482 Q1.x = 57912293709b3556b43a2dfb137a315d256d573b82ded120ef8c78 2d607c05d930d958e50cb6dc1cc480b9afc38c45f1 Q1.y = de9387dab0eef0bda219c6f168a92645a84665c4f2137c14270fb4 24b7532ff84843c3da383ceea24c47fa343c227bb8 msg = abcdef0123456789 P.x = bdecc1c1d870624965f19505be50459d363c71a699a496ab672f9a 5d6b78676400926fbceee6fcd1780fe86e62b2aa89 P.y = 57cf1f99b5ee00f3c201139b3bfe4dd30a653193778d89a0accc5e 0f47e46e4e4b85a0595da29c9494c1814acafe183c u[0] = aab7fb87238cf6b2ab56cdcca7e028959bb2ea599d34f68484139d de85ec6548a6e48771d17956421bdb7790598ea52e u[1] = 26e8d833552d7844d167833ca5a87c35bcfaa5a0d86023479fb28e 5cd6075c18b168bf1f5d2a0ea146d057971336d8d1 Q0.x = 0ceece45b73f89844671df962ad2932122e878ad2259e650626924 e4e7f132589341dec1480ebcbbbe3509d11fb570b7 Q0.y = fafd71a3115298f6be4ae5c6dfc96c400cfb55760f185b7b03f3fa 45f3f91eb65d27628b3c705cafd0466fafa54883ce Q1.x = dea1be8d3f9be4cbf4fab9d71d549dde76875b5d9b876832313a08 3ec81e528cbc2a0a1d0596b3bcb0ba77866b129776 Q1.y = eb15fe71662214fb03b65541f40d3eb0f4cf5c3b559f647da138c9 f9b7484c48a08760e02c16f1992762cb7298fa52cf msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 03c3a9f401b78c6c36a52f07eeee0ec1289f178adf78448f43a385 0e0456f5dd7f7633dd31676d990eda32882ab486c0 P.y = cc183d0d7bdfd0a3af05f50e16a3f2de4abbc523215bf57c848d5e a662482b8c1f43dc453a93b94a8026db58f3f5d878 u[0] = 04c00051b0de6e726d228c85bf243bf5f4789efb512b22b498cde3 821db9da667199b74bd5a09a79583c6d353a3bb41c u[1] = 97580f218255f899f9204db64cd15e6a312cb4d8182375d1e5157c 8f80f41d6a1a4b77fb1ded9dce56c32058b8d5202b Q0.x = 051a22105e0817a35d66196338c8d85bd52690d79bba373ead8a86 dd9899411513bb9f75273f6483395a7847fb21edb4 Q0.y = f168295c1bbcff5f8b01248e9dbc885335d6d6a04aea960f7384f7 46ba6502ce477e624151cc1d1392b00df0f5400c06 Q1.x = 6ad7bc8ed8b841efd8ad0765c8a23d0b968ec9aa360a558ff33500 f164faa02bee6c704f5f91507c4c5aad2b0dc5b943 Q1.y = 47313cc0a873ade774048338fc34ca5313f96bbf6ae22ac6ef475d 85f03d24792dc6afba8d0b4a70170c1b4f0f716629 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 7b18d210b1f090ac701f65f606f6ca18fb8d081e3bc6cbd937c560 4325f1cdea4c15c10a54ef303aabf2ea58bd9947a4 P.y = ea857285a33abb516732915c353c75c576bf82ccc96adb63c094dd e580021eddeafd91f8c0bfee6f636528f3d0c47fd2 u[0] = 480cb3ac2c389db7f9dac9c396d2647ae946db844598971c26d1af d53912a1491199c0a5902811e4b809c26fcd37a014 u[1] = d28435eb34680e148bf3908536e42231cba9e1f73ae2c6902a222a 89db5c49c97db2f8fa4d4cd6e424b17ac60bdb9bb6 Q0.x = 42e6666f505e854187186bad3011598d9278b9d6e3e4d2503c3d23 6381a56748dec5d139c223129b324df53fa147c4df Q0.y = 8ee51dbda46413bf621838cc935d18d617881c6f33f3838a79c767 a1e5618e34b22f79142df708d2432f75c7366c8512 Q1.x = 4ff01ceeba60484fa1bc0d825fe1e5e383d8f79f1e5bb78e5fb26b 7a7ef758153e31e78b9d60ce75c5e32e43869d4e12 Q1.y = 0f84b978fac8ceda7304b47e229d6037d32062e597dc7a9b95bcd9 af441f3c56c619a901d21635f9ec6ab4710b9fcd0e ]]></artwork> </section> <sectionanchor="p384xmdsha-384sswunu" numbered="true" toc="default">anchor="p384xmdsha-384sswunu"> <name>P384_XMD:SHA-384_SSWU_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = P384_XMD:SHA-384_SSWU_NU_ dst = QUUX-V01-CS02-with-P384_XMD:SHA-384_SSWU_NU_ msg = P.x = de5a893c83061b2d7ce6a0d8b049f0326f2ada4b966dc7e7292725 6b033ef61058029a3bfb13c1c7ececd6641881ae20 P.y = 63f46da6139785674da315c1947e06e9a0867f5608cf24724eb379 3a1f5b3809ee28eb21a0c64be3be169afc6cdb38ca u[0] = bc7dc1b2cdc5d588a66de3276b0f24310d4aca4977efda7d6272e1 be25187b001493d267dc53b56183c9e28282368e60 Q.x = de5a893c83061b2d7ce6a0d8b049f0326f2ada4b966dc7e7292725 6b033ef61058029a3bfb13c1c7ececd6641881ae20 Q.y = 63f46da6139785674da315c1947e06e9a0867f5608cf24724eb379 3a1f5b3809ee28eb21a0c64be3be169afc6cdb38ca msg = abc P.x = 1f08108b87e703c86c872ab3eb198a19f2b708237ac4be53d7929f b4bd5194583f40d052f32df66afe5249c9915d139b P.y = 1369dc8d5bf038032336b989994874a2270adadb67a7fcc32f0f88 24bc5118613f0ac8de04a1041d90ff8a5ad555f96c u[0] = 9de6cf41e6e41c03e4a7784ac5c885b4d1e49d6de390b3cdd5a1ac 5dd8c40afb3dfd7bb2686923bab644134483fc1926 Q.x = 1f08108b87e703c86c872ab3eb198a19f2b708237ac4be53d7929f b4bd5194583f40d052f32df66afe5249c9915d139b Q.y = 1369dc8d5bf038032336b989994874a2270adadb67a7fcc32f0f88 24bc5118613f0ac8de04a1041d90ff8a5ad555f96c msg = abcdef0123456789 P.x = 4dac31ec8a82ee3c02ba2d7c9fa431f1e59ffe65bf977b948c59e1 d813c2d7963c7be81aa6db39e78ff315a10115c0d0 P.y = 845333cdb5702ad5c525e603f302904d6fc84879f0ef2ee2014a6b 13edd39131bfd66f7bd7cdc2d9ccf778f0c8892c3f u[0] = 84e2d430a5e2543573e58e368af41821ca3ccc97baba7e9aab51a8 4543d5a0298638a22ceee6090d9d642921112af5b7 Q.x = 4dac31ec8a82ee3c02ba2d7c9fa431f1e59ffe65bf977b948c59e1 d813c2d7963c7be81aa6db39e78ff315a10115c0d0 Q.y = 845333cdb5702ad5c525e603f302904d6fc84879f0ef2ee2014a6b 13edd39131bfd66f7bd7cdc2d9ccf778f0c8892c3f msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 13c1f8c52a492183f7c28e379b0475486718a7e3ac1dfef39283b9 ce5fb02b73f70c6c1f3dfe0c286b03e2af1af12d1d P.y = 57e101887e73e40eab8963324ed16c177d55eb89f804ec9df06801 579820420b5546b579008df2145fd770f584a1a54c u[0] = 504e4d5a529333b9205acaa283107bd1bffde753898f7744161f7d d19ba57fbb6a64214a2e00ddd2613d76cd508ddb30 Q.x = 13c1f8c52a492183f7c28e379b0475486718a7e3ac1dfef39283b9 ce5fb02b73f70c6c1f3dfe0c286b03e2af1af12d1d Q.y = 57e101887e73e40eab8963324ed16c177d55eb89f804ec9df06801 579820420b5546b579008df2145fd770f584a1a54c msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = af129727a4207a8cb9e9dce656d88f79fce25edbcea350499d65e9 bf1204537bdde73c7cefb752a6ed5ebcd44e183302 P.y = ce68a3d5e161b2e6a968e4ddaa9e51504ad1516ec170c7eef3ca6b 5327943eca95d90b23b009ba45f58b72906f2a99e2 u[0] = 7b01ce9b8c5a60d9fbc202d6dde92822e46915d8c17e03fcb92ece 1ed6074d01e149fc9236def40d673de903c1d4c166 Q.x = af129727a4207a8cb9e9dce656d88f79fce25edbcea350499d65e9 bf1204537bdde73c7cefb752a6ed5ebcd44e183302 Q.y = ce68a3d5e161b2e6a968e4ddaa9e51504ad1516ec170c7eef3ca6b 5327943eca95d90b23b009ba45f58b72906f2a99e2 ]]></artwork> </section> </section> <sectionanchor="nist-p-521" numbered="true" toc="default">anchor="nist-p-521"> <name>NIST P-521</name> <sectionanchor="p521xmdsha-512sswuro" numbered="true" toc="default">anchor="p521xmdsha-512sswuro"> <name>P521_XMD:SHA-512_SSWU_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = P521_XMD:SHA-512_SSWU_RO_ dst = QUUX-V01-CS02-with-P521_XMD:SHA-512_SSWU_RO_ msg = P.x = 00fd767cebb2452030358d0e9cf907f525f50920c8f607889a6a35 680727f64f4d66b161fafeb2654bea0d35086bec0a10b30b14adef 3556ed9f7f1bc23cecc9c088 P.y = 0169ba78d8d851e930680322596e39c78f4fe31b97e57629ef6460 ddd68f8763fd7bd767a4e94a80d3d21a3c2ee98347e024fc73ee1c 27166dc3fe5eeef782be411d u[0] = 01e5f09974e5724f25286763f00ce76238c7a6e03dc396600350ee 2c4135fb17dc555be99a4a4bae0fd303d4f66d984ed7b6a3ba3860 93752a855d26d559d69e7e9e u[1] = 00ae593b42ca2ef93ac488e9e09a5fe5a2f6fb330d18913734ff60 2f2a761fcaaf5f596e790bcc572c9140ec03f6cccc38f767f1c197 5a0b4d70b392d95a0c7278aa Q0.x = 00b70ae99b6339fffac19cb9bfde2098b84f75e50ac1e80d6acb95 4e4534af5f0e9c4a5b8a9c10317b8e6421574bae2b133b4f2b8c6c e4b3063da1d91d34fa2b3a3c Q0.y = 007f368d98a4ddbf381fb354de40e44b19e43bb11a1278759f4ea7 b485e1b6db33e750507c071250e3e443c1aaed61f2c28541bb54b1 b456843eda1eb15ec2a9b36e Q1.x = 01143d0e9cddcdacd6a9aafe1bcf8d218c0afc45d4451239e821f5 d2a56df92be942660b532b2aa59a9c635ae6b30e803c45a6ac8714 32452e685d661cd41cf67214 Q1.y = 00ff75515df265e996d702a5380defffab1a6d2bc232234c7bcffa 433cd8aa791fbc8dcf667f08818bffa739ae25773b32073213cae9 a0f2a917a0b1301a242dda0c msg = abc P.x = 002f89a1677b28054b50d15e1f81ed6669b5a2158211118ebdef8a 6efc77f8ccaa528f698214e4340155abc1fa08f8f613ef14a04371 7503d57e267d57155cf784a4 P.y = 010e0be5dc8e753da8ce51091908b72396d3deed14ae166f66d8eb f0a4e7059ead169ea4bead0232e9b700dd380b316e9361cfdba55a 08c73545563a80966ecbb86d u[0] = 003d00c37e95f19f358adeeaa47288ec39998039c3256e13c2a4c0 0a7cb61a34c8969472960150a27276f2390eb5e53e47ab193351c2 d2d9f164a85c6a5696d94fe8 u[1] = 01f3cbd3df3893a45a2f1fecdac4d525eb16f345b03e2820d69bc5 80f5cbe9cb89196fdf720ef933c4c0361fcfe29940fd0db0a5da6b afb0bee8876b589c41365f15 Q0.x = 01b254e1c99c835836f0aceebba7d77750c48366ecb07fb658e4f5 b76e229ae6ca5d271bb0006ffcc42324e15a6d3daae587f9049de2 dbb0494378ffb60279406f56 Q0.y = 01845f4af72fc2b1a5a2fe966f6a97298614288b456cfc385a425b 686048b25c952fbb5674057e1eb055d04568c0679a8e2dda3158dc 16ac598dbb1d006f5ad915b0 Q1.x = 007f08e813c620e527c961b717ffc74aac7afccb9158cebc347d57 15d5c2214f952c97e194f11d114d80d3481ed766ac0a3dba3eb73f 6ff9ccb9304ad10bbd7b4a36 Q1.y = 0022468f92041f9970a7cc025d71d5b647f822784d29ca7b3bc3b0 829d6bb8581e745f8d0cc9dc6279d0450e779ac2275c4c3608064a d6779108a7828ebd9954caeb msg = abcdef0123456789 P.x = 006e200e276a4a81760099677814d7f8794a4a5f3658442de63c18 d2244dcc957c645e94cb0754f95fcf103b2aeaf94411847c24187b 89fb7462ad3679066337cbc4 P.y = 001dd8dfa9775b60b1614f6f169089d8140d4b3e4012949b52f98d b2deff3e1d97bf73a1fa4d437d1dcdf39b6360cc518d8ebcc0f899 018206fded7617b654f6b168 u[0] = 00183ee1a9bbdc37181b09ec336bcaa34095f91ef14b66b1485c16 6720523dfb81d5c470d44afcb52a87b704dbc5c9bc9d0ef524dec2 9884a4795f55c1359945baf3 u[1] = 00504064fd137f06c81a7cf0f84aa7e92b6b3d56c2368f0a08f447 76aa8930480da1582d01d7f52df31dca35ee0a7876500ece3d8fe0 293cd285f790c9881c998d5e Q0.x = 0021482e8622aac14da60e656043f79a6a110cbae5012268a62dd6 a152c41594549f373910ebed170ade892dd5a19f5d687fae7095a4 61d583f8c4295f7aaf8cd7da Q0.y = 0177e2d8c6356b7de06e0b5712d8387d529b848748e54a8bc0ef5f 1475aa569f8f492fa85c3ad1c5edc51faf7911f11359bfa2a12d2e f0bd73df9cb5abd1b101c8b1 Q1.x = 00abeafb16fdbb5eb95095678d5a65c1f293291dfd20a3751dbe05 d0a9bfe2d2eef19449fe59ec32cdd4a4adc3411177c0f2dffd0159 438706159a1bbd0567d9b3d0 Q1.y = 007cc657f847db9db651d91c801741060d63dab4056d0a1d3524e2 eb0e819954d8f677aa353bd056244a88f00017e00c3ce8beeedb43 82d83d74418bd48930c6c182 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 01b264a630bd6555be537b000b99a06761a9325c53322b65bdc41b f196711f9708d58d34b3b90faf12640c27b91c70a507998e559406 48caa8e71098bf2bc8d24664 P.y = 01ea9f445bee198b3ee4c812dcf7b0f91e0881f0251aab272a1220 1fd89b1a95733fd2a699c162b639e9acdcc54fdc2f6536129b6beb 0432be01aa8da02df5e59aaa u[0] = 0159871e222689aad7694dc4c3480a49807b1eedd9c8cb4ae1b219 d5ba51655ea5b38e2e4f56b36bf3e3da44a7b139849d28f598c816 fe1bc7ed15893b22f63363c3 u[1] = 004ef0cffd475152f3858c0a8ccbdf7902d8261da92744e98df9b7 fadb0a5502f29c5086e76e2cf498f47321434a40b1504911552ce4 4ad7356a04e08729ad9411f5 Q0.x = 0005eac7b0b81e38727efcab1e375f6779aea949c3e409b53a1d37 aa2acbac87a7e6ad24aafbf3c52f82f7f0e21b872e88c55e17b7fa 21ce08a94ea2121c42c2eb73 Q0.y = 00a173b6a53a7420dbd61d4a21a7c0a52de7a5c6ce05f31403bef7 47d16cc8604a039a73bdd6e114340e55dacd6bea8e217ffbadfb8c 292afa3e1b2afc839a6ce7bb Q1.x = 01881e3c193a69e4d88d8180a6879b74782a0bc7e529233e9f84bf 7f17d2f319c36920ffba26f9e57a1e045cc7822c834c239593b6e1 42a694aa00c757b0db79e5e8 Q1.y = 01558b16d396d866e476e001f2dd0758927655450b84e12f154032 c7c2a6db837942cd9f44b814f79b4d729996ced61eec61d85c6751 39cbffe3fbf071d2c21cfecb msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 00c12bc3e28db07b6b4d2a2b1167ab9e26fc2fa85c7b0498a17b03 47edf52392856d7e28b8fa7a2dd004611159505835b687ecf1a764 857e27e9745848c436ef3925 P.y = 01cd287df9a50c22a9231beb452346720bb163344a41c5f5a24e83 35b6ccc595fd436aea89737b1281aecb411eb835f0b939073fdd1d d4d5a2492e91ef4a3c55bcbd u[0] = 0033d06d17bc3b9a3efc081a05d65805a14a3050a0dd4dfb488461 8eb5c73980a59c5a246b18f58ad022dd3630faa22889fbb8ba1593 466515e6ab4aeb7381c26334 u[1] = 0092290ab99c3fea1a5b8fb2ca49f859994a04faee3301cefab312 d34227f6a2d0c3322cf76861c6a3683bdaa2dd2a6daa5d6906c663 e065338b2344d20e313f1114 Q0.x = 00041f6eb92af8777260718e4c22328a7d74203350c6c8f5794d99 d5789766698f459b83d5068276716f01429934e40af3d1111a2278 0b1e07e72238d2207e5386be Q0.y = 001c712f0182813942b87cab8e72337db017126f52ed797dd23458 4ac9ae7e80dfe7abea11db02cf1855312eae1447dbaecc9d7e8c88 0a5e76a39f6258074e1bc2e0 Q1.x = 0125c0b69bcf55eab49280b14f707883405028e05c927cd7625d4e 04115bd0e0e6323b12f5d43d0d6d2eff16dbcf244542f84ec05891 1260dc3bb6512ab5db285fbd Q1.y = 008bddfb803b3f4c761458eb5f8a0aee3e1f7f68e9d7424405fa69 172919899317fb6ac1d6903a432d967d14e0f80af63e7035aaae0c 123e56862ce969456f99f102 ]]></artwork> </section> <sectionanchor="p521xmdsha-512sswunu" numbered="true" toc="default">anchor="p521xmdsha-512sswunu"> <name>P521_XMD:SHA-512_SSWU_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = P521_XMD:SHA-512_SSWU_NU_ dst = QUUX-V01-CS02-with-P521_XMD:SHA-512_SSWU_NU_ msg = P.x = 01ec604b4e1e3e4c7449b7a41e366e876655538acf51fd40d08b97 be066f7d020634e906b1b6942f9174b417027c953d75fb6ec64b8c ee2a3672d4f1987d13974705 P.y = 00944fc439b4aad2463e5c9cfa0b0707af3c9a42e37c5a57bb4ecd 12fef9fb21508568aedcdd8d2490472df4bbafd79081c81e99f4da 3286eddf19be47e9c4cf0e91 u[0] = 01e4947fe62a4e47792cee2798912f672fff820b2556282d9843b4 b465940d7683a986f93ccb0e9a191fbc09a6e770a564490d2a4ae5 1b287ca39f69c3d910ba6a4f Q.x = 01ec604b4e1e3e4c7449b7a41e366e876655538acf51fd40d08b97 be066f7d020634e906b1b6942f9174b417027c953d75fb6ec64b8c ee2a3672d4f1987d13974705 Q.y = 00944fc439b4aad2463e5c9cfa0b0707af3c9a42e37c5a57bb4ecd 12fef9fb21508568aedcdd8d2490472df4bbafd79081c81e99f4da 3286eddf19be47e9c4cf0e91 msg = abc P.x = 00c720ab56aa5a7a4c07a7732a0a4e1b909e32d063ae1b58db5f0e b5e09f08a9884bff55a2bef4668f715788e692c18c1915cd034a6b 998311fcf46924ce66a2be9a P.y = 003570e87f91a4f3c7a56be2cb2a078ffc153862a53d5e03e5dad5 bccc6c529b8bab0b7dbb157499e1949e4edab21cf5d10b782bc1e9 45e13d7421ad8121dbc72b1d u[0] = 0019b85ef78596efc84783d42799e80d787591fe7432dee1d9fa2b 7651891321be732ddf653fa8fefa34d86fb728db569d36b5b6ed39 83945854b2fc2dc6a75aa25b Q.x = 00c720ab56aa5a7a4c07a7732a0a4e1b909e32d063ae1b58db5f0e b5e09f08a9884bff55a2bef4668f715788e692c18c1915cd034a6b 998311fcf46924ce66a2be9a Q.y = 003570e87f91a4f3c7a56be2cb2a078ffc153862a53d5e03e5dad5 bccc6c529b8bab0b7dbb157499e1949e4edab21cf5d10b782bc1e9 45e13d7421ad8121dbc72b1d msg = abcdef0123456789 P.x = 00bcaf32a968ff7971b3bbd9ce8edfbee1309e2019d7ff373c3838 7a782b005dce6ceffccfeda5c6511c8f7f312f343f3a891029c585 8f45ee0bf370aba25fc990cc P.y = 00923517e767532d82cb8a0b59705eec2b7779ce05f9181c7d5d5e 25694ef8ebd4696343f0bc27006834d2517215ecf79482a84111f5 0c1bae25044fe1dd77744bbd u[0] = 01dba0d7fa26a562ee8a9014ebc2cca4d66fd9de036176aca8fc11 ef254cd1bc208847ab7701dbca7af328b3f601b11a1737a899575a 5c14f4dca5aaca45e9935e07 Q.x = 00bcaf32a968ff7971b3bbd9ce8edfbee1309e2019d7ff373c3838 7a782b005dce6ceffccfeda5c6511c8f7f312f343f3a891029c585 8f45ee0bf370aba25fc990cc Q.y = 00923517e767532d82cb8a0b59705eec2b7779ce05f9181c7d5d5e 25694ef8ebd4696343f0bc27006834d2517215ecf79482a84111f5 0c1bae25044fe1dd77744bbd msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 001ac69014869b6c4ad7aa8c443c255439d36b0e48a0f57b03d6fe 9c40a66b4e2eaed2a93390679a5cc44b3a91862b34b673f0e92c83 187da02bf3db967d867ce748 P.y = 00d5603d530e4d62b30fccfa1d90c2206654d74291c1db1c25b86a 051ee3fffc294e5d56f2e776853406bd09206c63d40f37ad882952 4cf89ad70b5d6e0b4a3b7341 u[0] = 00844da980675e1244cb209dcf3ea0aabec23bd54b2cda69fff86e b3acc318bf3d01bae96e9cd6f4c5ceb5539df9a7ad7fcc5e9d5469 6081ba9782f3a0f6d14987e3 Q.x = 001ac69014869b6c4ad7aa8c443c255439d36b0e48a0f57b03d6fe 9c40a66b4e2eaed2a93390679a5cc44b3a91862b34b673f0e92c83 187da02bf3db967d867ce748 Q.y = 00d5603d530e4d62b30fccfa1d90c2206654d74291c1db1c25b86a 051ee3fffc294e5d56f2e776853406bd09206c63d40f37ad882952 4cf89ad70b5d6e0b4a3b7341 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 01801de044c517a80443d2bd4f503a9e6866750d2f94a22970f62d 721f96e4310e4a828206d9cdeaa8f2d476705cc3bbc490a6165c68 7668f15ec178a17e3d27349b P.y = 0068889ea2e1442245fe42bfda9e58266828c0263119f35a61631a 3358330f3bb84443fcb54fcd53a1d097fccbe310489b74ee143fc2 938959a83a1f7dd4a6fd395b u[0] = 01aab1fb7e5cd44ba4d9f32353a383cb1bb9eb763ed40b32bdd5f6 66988970205998c0e44af6e2b5f6f8e48e969b3f649cae3c6ab463 e1b274d968d91c02f00cce91 Q.x = 01801de044c517a80443d2bd4f503a9e6866750d2f94a22970f62d 721f96e4310e4a828206d9cdeaa8f2d476705cc3bbc490a6165c68 7668f15ec178a17e3d27349b Q.y = 0068889ea2e1442245fe42bfda9e58266828c0263119f35a61631a 3358330f3bb84443fcb54fcd53a1d097fccbe310489b74ee143fc2 938959a83a1f7dd4a6fd395b ]]></artwork> </section> </section> <sectionanchor="curve25519" numbered="true" toc="default">anchor="curve25519"> <name>curve25519</name> <sectionanchor="curve25519xmdsha-512ell2ro" numbered="true" toc="default">anchor="curve25519xmdsha-512ell2ro"> <name>curve25519_XMD:SHA-512_ELL2_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = curve25519_XMD:SHA-512_ELL2_RO_ dst = QUUX-V01-CS02-with-curve25519_XMD:SHA-512_ELL2_RO_ msg = P.x = 2de3780abb67e861289f5749d16d3e217ffa722192d16bbd9d1bfb 9d112b98c0 P.y = 3b5dc2a498941a1033d176567d457845637554a2fe7a3507d21abd 1c1bd6e878 u[0] = 005fe8a7b8fef0a16c105e6cadf5a6740b3365e18692a9c05bfbb4 d97f645a6a u[1] = 1347edbec6a2b5d8c02e058819819bee177077c9d10a4ce165aab0 fd0252261a Q0.x = 36b4df0c864c64707cbf6cf36e9ee2c09a6cb93b28313c169be295 61bb904f98 Q0.y = 6cd59d664fb58c66c892883cd0eb792e52055284dac3907dd756b4 5d15c3983d Q1.x = 3fa114783a505c0b2b2fbeef0102853c0b494e7757f2a089d0daae 7ed9a0db2b Q1.y = 76c0fe7fec932aaafb8eefb42d9cbb32eb931158f469ff3050af15 cfdbbeff94 msg = abc P.x = 2b4419f1f2d48f5872de692b0aca72cc7b0a60915dd70bde432e82 6b6abc526d P.y = 1b8235f255a268f0a6fa8763e97eb3d22d149343d495da1160eff9 703f2d07dd u[0] = 49bed021c7a3748f09fa8cdfcac044089f7829d3531066ac9e74e0 994e05bc7d u[1] = 5c36525b663e63389d886105cee7ed712325d5a97e60e140aba7e2 ce5ae851b6 Q0.x = 16b3d86e056b7970fa00165f6f48d90b619ad618791661b7b5e1ec 78be10eac1 Q0.y = 4ab256422d84c5120b278cbdfc4e1facc5baadffeccecf8ee9bf39 46106d50ca Q1.x = 7ec29ddbf34539c40adfa98fcb39ec36368f47f30e8f888cc7e86f 4d46e0c264 Q1.y = 10d1abc1cae2d34c06e247f2141ba897657fb39f1080d54f09ce0a f128067c74 msg = abcdef0123456789 P.x = 68ca1ea5a6acf4e9956daa101709b1eee6c1bb0df1de3b90d46023 82a104c036 P.y = 2a375b656207123d10766e68b938b1812a4a6625ff83cb8d5e86f5 8a4be08353 u[0] = 6412b7485ba26d3d1b6c290a8e1435b2959f03721874939b21782d f17323d160 u[1] = 24c7b46c1c6d9a21d32f5707be1380ab82db1054fde82865d5c9e3 d968f287b2 Q0.x = 71de3dadfe268872326c35ac512164850860567aea0e7325e6b91a 98f86533ad Q0.y = 26a08b6e9a18084c56f2147bf515414b9b63f1522e1b6c5649f7d4 b0324296ec Q1.x = 5704069021f61e41779e2ba6b932268316d6d2a6f064f997a22fef 16d1eaeaca Q1.y = 50483c7540f64fb4497619c050f2c7fe55454ec0f0e79870bb4430 2e34232210 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 096e9c8bae6c06b554c1ee69383bb0e82267e064236b3a30608d4e d20b73ac5a P.y = 1eb5a62612cafb32b16c3329794645b5b948d9f8ffe501d4e26b07 3fef6de355 u[0] = 5e123990f11bbb5586613ffabdb58d47f64bb5f2fa115f8ea8df01 88e0c9e1b5 u[1] = 5e8553eb00438a0bb1e7faa59dec6d8087f9c8011e5fb8ed9df31c b6c0d4ac19 Q0.x = 7a94d45a198fb5daa381f45f2619ab279744efdd8bd8ed587fc5b6 5d6cea1df0 Q0.y = 67d44f85d376e64bb7d713585230cdbfafc8e2676f7568e0b6ee59 361116a6e1 Q1.x = 30506fb7a32136694abd61b6113770270debe593027a968a01f271 e146e60c18 Q1.y = 7eeee0e706b40c6b5174e551426a67f975ad5a977ee2f01e8e20a6 d612458c3b msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 1bc61845a138e912f047b5e70ba9606ba2a447a4dade024c8ef3dd 42b7bbc5fe P.y = 623d05e47b70e25f7f1d51dda6d7c23c9a18ce015fe3548df596ea 9e38c69bf1 u[0] = 20f481e85da7a3bf60ac0fb11ed1d0558fc6f941b3ac5469aa8b56 ec883d6d7d u[1] = 017d57fd257e9a78913999a23b52ca988157a81b09c5442501d07f ed20869465 Q0.x = 02d606e2699b918ee36f2818f2bc5013e437e673c9f9b9cdc15fd0 c5ee913970 Q0.y = 29e9dc92297231ef211245db9e31767996c5625dfbf92e1c8107ef 887365de1e Q1.x = 38920e9b988d1ab7449c0fa9a6058192c0c797bb3d42ac34572434 1a1aa98745 Q1.y = 24dcc1be7c4d591d307e89049fd2ed30aae8911245a9d8554bf603 2e5aa40d3d ]]></artwork> </section> <sectionanchor="curve25519xmdsha-512ell2nu" numbered="true" toc="default">anchor="curve25519xmdsha-512ell2nu"> <name>curve25519_XMD:SHA-512_ELL2_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = curve25519_XMD:SHA-512_ELL2_NU_ dst = QUUX-V01-CS02-with-curve25519_XMD:SHA-512_ELL2_NU_ msg = P.x = 1bb913f0c9daefa0b3375378ffa534bda5526c97391952a7789eb9 76edfe4d08 P.y = 4548368f4f983243e747b62a600840ae7c1dab5c723991f85d3a97 68479f3ec4 u[0] = 608d892b641f0328523802a6603427c26e55e6f27e71a91a478148 d45b5093cd Q.x = 51125222da5e763d97f3c10fcc92ea6860b9ccbbd2eb1285728f56 6721c1e65b Q.y = 343d2204f812d3dfc5304a5808c6c0d81a903a5d228b342442aa3c 9ba5520a3d msg = abc P.x = 7c22950b7d900fa866334262fcaea47a441a578df43b894b4625c9 b450f9a026 P.y = 5547bc00e4c09685dcbc6cb6765288b386d8bdcb595fa5a6e3969e 08097f0541 u[0] = 46f5b22494bfeaa7f232cc8d054be68561af50230234d7d1d63d1d 9abeca8da5 Q.x = 7d56d1e08cb0ccb92baf069c18c49bb5a0dcd927eff8dcf75ca921 ef7f3e6eeb Q.y = 404d9a7dc25c9c05c44ab9a94590e7c3fe2dcec74533a0b24b188a 5d5dacf429 msg = abcdef0123456789 P.x = 31ad08a8b0deeb2a4d8b0206ca25f567ab4e042746f792f4b7973f 3ae2096c52 P.y = 405070c28e78b4fa269427c82827261991b9718bd6c6e95d627d70 1a53c30db1 u[0] = 235fe40c443766ce7e18111c33862d66c3b33267efa50d50f9e8e5 d252a40aaa Q.x = 3fbe66b9c9883d79e8407150e7c2a1c8680bee496c62fabe4619a7 2b3cabe90f Q.y = 08ec476147c9a0a3ff312d303dbbd076abb7551e5fce82b48ab14b 433f8d0a7b msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 027877759d155b1997d0d84683a313eb78bdb493271d935b622900 459d52ceaa P.y = 54d691731a53baa30707f4a87121d5169fb5d587d70fb0292b5830 dedbec4c18 u[0] = 001e92a544463bda9bd04ddbe3d6eed248f82de32f522669efc5dd ce95f46f5b Q.x = 227e0bb89de700385d19ec40e857db6e6a3e634b1c32962f370d26 f84ff19683 Q.y = 5f86ff3851d262727326a32c1bf7655a03665830fa7f1b8b1e5a09 d85bc66e4a msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 5fd892c0958d1a75f54c3182a18d286efab784e774d1e017ba2fb2 52998b5dc1 P.y = 750af3c66101737423a4519ac792fb93337bd74ee751f19da4cf1e 94f4d6d0b8 u[0] = 1a68a1af9f663592291af987203393f707305c7bac9c8d63d6a729 bdc553dc19 Q.x = 3bcd651ee54d5f7b6013898aab251ee8ecc0688166fce6e9548d38 472f6bd196 Q.y = 1bb36ad9197299f111b4ef21271c41f4b7ecf5543db8bb5931307e bdb2eaa465 ]]></artwork> </section> </section> <sectionanchor="edwards25519" numbered="true" toc="default">anchor="edwards25519"> <name>edwards25519</name> <sectionanchor="edwards25519xmdsha-512ell2ro" numbered="true" toc="default">anchor="edwards25519xmdsha-512ell2ro"> <name>edwards25519_XMD:SHA-512_ELL2_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = edwards25519_XMD:SHA-512_ELL2_RO_ dst = QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_RO_ msg = P.x = 3c3da6925a3c3c268448dcabb47ccde5439559d9599646a8260e47 b1e4822fc6 P.y = 09a6c8561a0b22bef63124c588ce4c62ea83a3c899763af26d7953 02e115dc21 u[0] = 03fef4813c8cb5f98c6eef88fae174e6e7d5380de2b007799ac7ee 712d203f3a u[1] = 780bdddd137290c8f589dc687795aafae35f6b674668d92bf92ae7 93e6a60c75 Q0.x = 6549118f65bb617b9e8b438decedc73c496eaed496806d3b2eb9ee 60b88e09a7 Q0.y = 7315bcc8cf47ed68048d22bad602c6680b3382a08c7c5d3f439a97 3fb4cf9feb Q1.x = 31dcfc5c58aa1bee6e760bf78cbe71c2bead8cebb2e397ece0f37a 3da19c9ed2 Q1.y = 7876d81474828d8a5928b50c82420b2bd0898d819e9550c5c82c39 fc9bafa196 msg = abc P.x = 608040b42285cc0d72cbb3985c6b04c935370c7361f4b7fbdb1ae7 f8c1a8ecad P.y = 1a8395b88338f22e435bbd301183e7f20a5f9de643f11882fb237f 88268a5531 u[0] = 5081955c4141e4e7d02ec0e36becffaa1934df4d7a270f70679c78 f9bd57c227 u[1] = 005bdc17a9b378b6272573a31b04361f21c371b256252ae5463119 aa0b925b76 Q0.x = 5c1525bd5d4b4e034512949d187c39d48e8cd84242aa4758956e4a dc7d445573 Q0.y = 2bf426cf7122d1a90abc7f2d108befc2ef415ce8c2d09695a74072 40faa01f29 Q1.x = 37b03bba828860c6b459ddad476c83e0f9285787a269df2156219b 7e5c86210c Q1.y = 285ebf5412f84d0ad7bb4e136729a9ffd2195d5b8e73c0dc85110c e06958f432 msg = abcdef0123456789 P.x = 6d7fabf47a2dc03fe7d47f7dddd21082c5fb8f86743cd020f3fb14 7d57161472 P.y = 53060a3d140e7fbcda641ed3cf42c88a75411e648a1add71217f70 ea8ec561a6 u[0] = 285ebaa3be701b79871bcb6e225ecc9b0b32dff2d60424b4c50642 636a78d5b3 u[1] = 2e253e6a0ef658fedb8e4bd6a62d1544fd6547922acb3598ec6b36 9760b81b31 Q0.x = 3ac463dd7fddb773b069c5b2b01c0f6b340638f54ee3bd92d452fc ec3015b52d Q0.y = 7b03ba1e8db9ec0b390d5c90168a6a0b7107156c994c674b61fe69 6cbeb46baf Q1.x = 0757e7e904f5e86d2d2f4acf7e01c63827fde2d363985aa7432106 f1b3a444ec Q1.y = 50026c96930a24961e9d86aa91ea1465398ff8e42015e2ec1fa397 d416f6a1c0 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 5fb0b92acedd16f3bcb0ef83f5c7b7a9466b5f1e0d8d217421878e a3686f8524 P.y = 2eca15e355fcfa39d2982f67ddb0eea138e2994f5956ed37b7f72e ea5e89d2f7 u[0] = 4fedd25431c41f2a606952e2945ef5e3ac905a42cf64b8b4d4a83c 533bf321af u[1] = 02f20716a5801b843987097a8276b6d869295b2e11253751ca72c1 09d37485a9 Q0.x = 703e69787ea7524541933edf41f94010a201cc841c1cce60205ec3 8513458872 Q0.y = 32bb192c4f89106466f0874f5fd56a0d6b6f101cb714777983336c 159a9bec75 Q1.x = 0c9077c5c31720ed9413abe59bf49ce768506128d810cb882435aa 90f713ef6b Q1.y = 7d5aec5210db638c53f050597964b74d6dda4be5b54fa73041bf90 9ccb3826cb msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 0efcfde5898a839b00997fbe40d2ebe950bc81181afbd5cd6b9618 aa336c1e8c P.y = 6dc2fc04f266c5c27f236a80b14f92ccd051ef1ff027f26a07f8c0 f327d8f995 u[0] = 6e34e04a5106e9bd59f64aba49601bf09d23b27f7b594e56d5de06 df4a4ea33b u[1] = 1c1c2cb59fc053f44b86c5d5eb8c1954b64976d0302d3729ff66e8 4068f5fd96 Q0.x = 21091b2e3f9258c7dfa075e7ae513325a94a3d8a28e1b1cb3b5b6f 5d65675592 Q0.y = 41a33d324c89f570e0682cdf7bdb78852295daf8084c669f2cc969 2896ab5026 Q1.x = 4c07ec48c373e39a23bd7954f9e9b66eeab9e5ee1279b867b3d531 5aa815454f Q1.y = 67ccac7c3cb8d1381242d8d6585c57eabaddbb5dca5243a68a8aeb 5477d94b3a ]]></artwork> </section> <sectionanchor="edwards25519xmdsha-512ell2nu" numbered="true" toc="default">anchor="edwards25519xmdsha-512ell2nu"> <name>edwards25519_XMD:SHA-512_ELL2_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = edwards25519_XMD:SHA-512_ELL2_NU_ dst = QUUX-V01-CS02-with-edwards25519_XMD:SHA-512_ELL2_NU_ msg = P.x = 1ff2b70ecf862799e11b7ae744e3489aa058ce805dd323a936375a 84695e76da P.y = 222e314d04a4d5725e9f2aff9fb2a6b69ef375a1214eb19021ceab 2d687f0f9b u[0] = 7f3e7fb9428103ad7f52db32f9df32505d7b427d894c5093f7a0f0 374a30641d Q.x = 42836f691d05211ebc65ef8fcf01e0fb6328ec9c4737c26050471e 50803022eb Q.y = 22cb4aaa555e23bd460262d2130d6a3c9207aa8bbb85060928beb2 63d6d42a95 msg = abc P.x = 5f13cc69c891d86927eb37bd4afc6672360007c63f68a33ab423a3 aa040fd2a8 P.y = 67732d50f9a26f73111dd1ed5dba225614e538599db58ba30aaea1 f5c827fa42 u[0] = 09cfa30ad79bd59456594a0f5d3a76f6b71c6787b04de98be5cd20 1a556e253b Q.x = 333e41b61c6dd43af220c1ac34a3663e1cf537f996bab50ab66e33 c4bd8e4e19 Q.y = 51b6f178eb08c4a782c820e306b82c6e273ab22e258d972cd0c511 787b2a3443 msg = abcdef0123456789 P.x = 1dd2fefce934ecfd7aae6ec998de088d7dd03316aa1847198aecf6 99ba6613f1 P.y = 2f8a6c24dd1adde73909cada6a4a137577b0f179d336685c4a955a 0a8e1a86fb u[0] = 475ccff99225ef90d78cc9338e9f6a6bb7b17607c0c4428937de75 d33edba941 Q.x = 55186c242c78e7d0ec5b6c9553f04c6aeef64e69ec2e824472394d a32647cfc6 Q.y = 5b9ea3c265ee42256a8f724f616307ef38496ef7eba391c08f99f3 bea6fa88f0 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 35fbdc5143e8a97afd3096f2b843e07df72e15bfca2eaf6879bf97 c5d3362f73 P.y = 2af6ff6ef5ebba128b0774f4296cb4c2279a074658b083b8dcca91 f57a603450 u[0] = 049a1c8bd51bcb2aec339f387d1ff51428b88d0763a91bcdf69298 14ac95d03d Q.x = 024b6e1621606dca8071aa97b43dce4040ca78284f2a527dcf5d0f bfac2b07e7 Q.y = 5102353883d739bdc9f8a3af650342b171217167dcce34f8db5720 8ec1dfdbf2 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 6e5e1f37e99345887fc12111575fc1c3e36df4b289b8759d23af14 d774b66bff P.y = 2c90c3d39eb18ff291d33441b35f3262cdd307162cc97c31bfcc7a 4245891a37 u[0] = 3cb0178a8137cefa5b79a3a57c858d7eeeaa787b2781be4a362a2f 0750d24fa0 Q.x = 3e6368cff6e88a58e250c54bd27d2c989ae9b3acb6067f2651ad28 2ab8c21cd9 Q.y = 38fb39f1566ca118ae6c7af42810c0bb9767ae5960abb5a8ca7925 30bfb9447d ]]></artwork> </section> </section> <sectionanchor="curve448" numbered="true" toc="default">anchor="curve448"> <name>curve448</name> <sectionanchor="curve448xofshake256ell2ro" numbered="true" toc="default">anchor="curve448xofshake256ell2ro"> <name>curve448_XOF:SHAKE256_ELL2_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = curve448_XOF:SHAKE256_ELL2_RO_ dst = QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_RO_ msg = P.x = 5ea5ff623d27c75e73717514134e73e419f831a875ca9e82915fdf c7069d0a9f8b532cfb32b1d8dd04ddeedbe3fa1d0d681c01e825d6 a9ea P.y = afadd8de789f8f8e3516efbbe313a7eba364c939ecba00dabf4ced 5c563b18e70a284c17d8f46b564c4e6ce11784a3825d9411166221 28c1 u[0] = c704c7b3d3b36614cf3eedd0324fe6fe7d1402c50efd16cff89ff6 3f50938506280d3843478c08e24f7842f4e3ef45f6e3c4897f9d97 6148 u[1] = c25427dc97fff7a5ad0a78654e2c6c27b1c1127b5b53c7950cd1fd 6edd2703646b25f341e73deedfebf022d1d3cecd02b93b4d585ead 3ed7 Q0.x = 3ba318806f89c19cc019f51e33eb6b8c038dab892e858ce7c7f2c2 ac58618d06146a5fef31e49af49588d4d3db1bcf02bd4e4a733e37 065d Q0.y = b30b4cfc2fd14d9d4b70456c0f5c6f6070be551788893d570e7955 675a20f6c286d01d6e90d2fb500d2efb8f4e18db7f8268bb9b7fbc 5975 Q1.x = f03a48cf003f63be61ca055fec87c750434da07a15f8aa6210389f f85943b5166484339c8bea1af9fc571313d35ed2fbb779408b760c 4cbd Q1.y = 23943a33b2954dc54b76a8222faf5b7e18405a41f5ecc61bf1b8df 1f9cbfad057307ed0c7b721f19c0390b8ee3a2dec223671f9ff905 fda7 msg = abc P.x = 9b2f7ce34878d7cebf34c582db14958308ea09366d1ec71f646411 d3de0ae564d082b06f40cd30dfc08d9fb7cb21df390cf207806ad9 d0e4 P.y = 138a0eef0a4993ea696152ed7db61f7ddb4e8100573591e7466d61 c0c568ecaec939e36a84d276f34c402526d8989a96e99760c4869e d633 u[0] = 2dd95593dfee26fe0d218d3d9a0a23d9e1a262fd1d0b602483d084 15213e75e2db3c69b0a5bc89e71bcefc8c723d2b6a0cf263f02ad2 aa70 u[1] = 272e4c79a1290cc6d2bc4f4f9d31bf7fbe956ca303c04518f117d7 7c0e9d850796fc3e1e2bcb9c75e8eaaded5e150333cae993186804 7c9d Q0.x = 26714783887ec444fbade9ae350dc13e8d5a64150679232560726a 73d36e28bd56766d7d0b0899d79c8d1c889ae333f601c57532ff3c 4f09 Q0.y = 080e486f8f5740dbbe82305160cab9fac247b0b22a54d961de6750 37c3036fa68464c8756478c322ae0aeb9ba386fe626cebb0bcca46 840c Q1.x = 0d9741d10421691a8ebc7778b5f623260fdf8b28ae28d776efcb8e 0d5fbb65139a2f828617835f527cb2ca24a8f5fc8e84378343c43d 096d Q1.y = 54f4c499bf3d5b154511913f9615bd914969b65cfb74508d7ae5a1 69e9595b7cbcab9a1485e07b2ce426e4fbed052f03842c4313b7db e39a msg = abcdef0123456789 P.x = f54ecd14b85a50eeeee0618452df3a75be7bfba11da5118774ae4e a55ac204e153f77285d780c4acee6c96abe3577a0c0b00be6e790c f194 P.y = 935247a64bf78c107069943c7e3ecc52acb27ce4a3230407c83573 41685ea2152e8c3da93f8cd77da1bddb5bb759c6e7ae7d516dced4 2850 u[0] = 6aab71a38391639f27e49eae8b1cb6b7172a1f478190ece293957e 7cdb2391e7cc1c4261970d9c1bbf9c3915438f74fbd7eb5cd4d4d1 7ace u[1] = c80b8380ca47a3bcbf76caa75cef0e09f3d270d5ee8f676cde11ae df41aaca6741bd81a86232bd336ccb42efad39f06542bc06a67b65 909e Q0.x = 946d91bd50c90ef70743e0dd194bddd68bb630f4e67e5b93e15a9b 94e62cb85134467993501759525c1f4fdbf06f10ddaf817847d735 e062 Q0.y = 185cf511262ec1e9b3c3cbdc015ab93df4e71cbe87766917d81c9f 3419d480407c1462385122c84982d4dae60c3ae4acce0089e37ad6 5934 Q1.x = 01778f4797b717cd6f83c193b2dfb92a1606a36ede941b0f6ab0ac 71ad0eac756d17604bf054398887da907e41065d3595f178ae802f 2087 Q1.y = b4ca727d0bda895e0eee7eb3cbc28710fa2e90a73b568cae26bd7c 2e73b70a9fa0affe1096f0810198890ed65d8935886b6e60dc4c56 9dc6 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 5bd67c4f88adf6beb10f7e0d0054659776a55c97b809ec8b310172 9e104fd0f684e103792f267fd87cc4afc25a073956ef4f268fb028 24d5 P.y = da1f5cb16a352719e4cb064cf47ba72aeba7752d03e8ca2c56229f 419b4ef378785a5af1a53dd7ab4d467c1f92f7b139b3752faf29c9 6432 u[0] = cb5c27e51f9c18ee8ffdb6be230f4eb4f2c2481963b2293484f08d a2241c1ff59f80978e6defe9d70e34abba2fcbe12dc3a1eb2c5d3d 2e4a u[1] = c895e8afecec5466e126fa70fc4aa784b8009063afb10e3ee06a9b 22318256aa8693b0c85b955cf2d6540b8ed71e729af1b8d5ca3b11 6cd7 Q0.x = c2d275826d6ad55e41a22318f6b6240f1f862a2e231120ff41eadb ec319756032e8cef2a7ac6c10214fa0608c17fcaf61ec2694a8a2b 358b Q0.y = 93d2e092762b135509840e609d413200df800d99da91d8b8284066 6cac30e7a3520adbaa4b089bfdc86132e42729f651d022f4782502 f12c Q1.x = 3c0880ece7244036e9a45944a85599f9809d772f770cc237ac41b2 1aa71615e4f3bb08f64fca618896e4f6cf5bd92e16b89d2cf6e195 6bfb Q1.y = 45cce4beb96505cac5976b3d2673641e9bcd18d3462bbb453d293e 5282740a6389cfeae610adc7bd425c728541ceec83fcc999164af4 3fb5 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = ea441c10b3636ecedd5c0dfcae96384cc40de8390a0ab648765b45 08da12c586d55dc981275776507ebca0e4d1bcaa302bb69dcfa31b 3451 P.y = fee0192d49bcc0c28d954763c2cbe739b9265c4bebe3883803c649 71220cfda60b9ac99ad986cd908c0534b260b5cfca46f6c2b0f3f2 1bda u[0] = 8cba93a007bb2c801b1769e026b1fa1640b14a34cf3029db3c7fd6 392745d6fec0f7870b5071d6da4402cedbbde28ae4e50ab30e1049 a238 u[1] = 4223746145069e4b8a981acc3404259d1a2c3ecfed5d864798a89d 45f81a2c59e2d40eb1d5f0fe11478cbb2bb30246dd388cb932ad7b b330 Q0.x = 4321ab02a9849128691e9b80a5c5576793a218de14885fddccb91f 17ceb1646ea00a28b69ad211e1f14f17739612dbde3782319bdf00 9689 Q0.y = 1b8a7b539519eec0ea9f7a46a43822e16cba39a439733d6847ac44 a806b8adb3e1a75ea48a1228b8937ba85c6cb6ee01046e10cad895 3b1e Q1.x = 126d744da6a14fddec0f78a9cee4571c1320ac7645b600187812e4 d7021f98fc4703732c54daec787206e1f34d9dbbf4b292c68160b8 bfbd Q1.y = 136eebe6020f2389d448923899a1a38a4c8ad74254e0686e91c4f9 3c1f8f8e1bd619ffb7c1281467882a9c957d22d50f65c5b72b2aee 11af ]]></artwork> </section> <sectionanchor="curve448xofshake256ell2nu" numbered="true" toc="default">anchor="curve448xofshake256ell2nu"> <name>curve448_XOF:SHAKE256_ELL2_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = curve448_XOF:SHAKE256_ELL2_NU_ dst = QUUX-V01-CS02-with-curve448_XOF:SHAKE256_ELL2_NU_ msg = P.x = b65e8dbb279fd656f926f68d463b13ca7a982b32f5da9c7cc58afc f6199e4729863fb75ca9ae3c95c6887d95a5102637a1c5c40ff0aa fadc P.y = ea1ea211cf29eca11c057fe8248181591a19f6ac51d45843a65d4b b8b71bc83a64c771ed7686218a278ef1c5d620f3d26b5316218864 5453 u[0] = 242c70f74eac8184116c71630d284cf8a742fc463e710545847ff6 4d8e9161cb9f599728a18a32dbd8b67c3bec5d64c9b1d2f2cde7b5 888d Q.x = e6304424de5af3f556d3e645600530c53ad949891c3e60ba041dd5 f68a93901beff8440164477d348c13d28e27bfcd360c44c80b4c7d 4cea Q.y = 4160a8f2043a347185406a6a7e50973b98b82edbdfa3209b0e1c90 118e10eeb45045b0990d4b2b0708a30eca17df40ad53c9100f20c1 0b44 msg = abc P.x = 51aceca4fa95854bbaba58d8a5e17a86c07acadef32e1188cafda2 6232131800002cc2f27c7aec454e5e0c615bddffb7df6a5f7f0f14 793f P.y = c590c9246eb28b08dee816d608ef233ea5d76e305dc458774a1e1b d880387e6734219e2018e4aa50a49486dce0ba8740065da37e6cf5 212c u[0] = ef6dcb75b696d325fb36d66b104700df1480c4c17ea9190d447eee 1e7e4c9b7f36bbfb8ba7ba7c4cb6b07fed16531c1ac7a26a3618b4 0b34 Q.x = de0dc93df9ce7953452f20e270699c1e7dacd5d571c226d77f53b7 e3053d16f8a81b1601efb362054e973c8e733b663af93f00cb81ba f130 Q.y = 8c5bdec6fa6690905f6eff966b0f98f5a8161493bd04976684d4ec 1f4512fa8743d86860b2ff2c5d67e9c145fd906f2cb89ff812c6b9 883f msg = abcdef0123456789 P.x = c6d65987f146b8d0cb5d2c44e1872ac3af1f458f6a8bd8c232ffe8 b9d09496229a5a27f350eb7d97305bcc4e0f38328718352e8e3129 ed71 P.y = 4d2f901bf333fdc4135b954f20d59207e9f6a4ecf88ce5af11c892 b44f79766ec4ecc9f60d669b95ca8940f39b1b7044140ac2040c1b f659 u[0] = 3012ba5d9b3bb648e4613833a26ecaeadb3e8c8bba07fc90ac3da0 375769289c44d3dc87474b23df7f45f9a4030892cda689e343aeee a6ad Q.x = dc29532761f03c24d57f530da4c24acc4c676d185becaa89fcc083 266541fb7f10ecec91dac64a34cd988274633ae25c4d784aee52de 47a8 Q.y = a5f6da11259c69f2e07fce6a7b6afec4c25bd2df83426765f9c070 4111da24c6a0550d5c7aac7d648d55f7640d50be99c926195e852a daac msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 9b8d008863beb4a02fb9e4efefd2eba867307fb1c7ce01746115d3 2e1db551bb254e8e3e4532d5c74a83949a69a60519ecc9178083cb e943 P.y = 346a1fca454d1e67c628437c270ec0f0c4256bb774fe6c0e49de70 04ff6d9199e2cd99d8f7575a96aafc4dc8db1811ba0a44317581f4 1371 u[0] = fe952ac0149f92436bba12ea2e542aa226f4fc074d79ff462c41b3 27968a649a495a8a93b6c3044af2273456abb5e166ce4fb8c9b10c 8c2e Q.x = 512803d89f59c57376e6570cd54c4e901643e089cd9456f549daa4 372b8b52679860b68aa8bedfaa88970f15ab6098d5f252083ac98a 58c9 Q.y = 3d9b6593c7941a20d76161c9a171f1e507495a08f03dfcae33a2ac 3602698e46a74d1039b583c984036f590eaa43d20ba5aada3ffb55 2f77 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 8746dc34799112d1f20acda9d7f722c9abb29b1fb6b7e9e5669838 43c20bd7c9bfad21b45c5166b808d2f5d44e188f1fdaf29cdee8a7 2e4c P.y = 7c1293484c9287c298a1a0600c64347eee8530acf563cd8705e057 28274d8cd8101835f8003b6f3b78b5beb28f5be188a3d7bce1ec5a 36b1 u[0] = afd3d7ad9d819be7561706e050d4f30b634b203387ab682739365f 62cd7393ca2cf18cd07a3d3af8dd163f043ac7457c2eb145b4a561 70a9 Q.x = 08aed6480793218034fd3b3b0867943d7e0bd1b6f76b4929e0885b d082b84d4449341da6038bb08229ad9eb7d518dff2c7ea50148e70 a4db Q.y = e00d32244561ebd4b5f4ef70fcac75a06416be0a1c1b304e7bd361 a6a6586915bb902a323eaf73cf7738e70d34282f61485395ab2833 d2c1 ]]></artwork> </section> </section> <sectionanchor="edwards448" numbered="true" toc="default">anchor="edwards448"> <name>edwards448</name> <sectionanchor="edwards448xofshake256ell2ro" numbered="true" toc="default">anchor="edwards448xofshake256ell2ro"> <name>edwards448_XOF:SHAKE256_ELL2_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = edwards448_XOF:SHAKE256_ELL2_RO_ dst = QUUX-V01-CS02-with-edwards448_XOF:SHAKE256_ELL2_RO_ msg = P.x = 73036d4a88949c032f01507005c133884e2f0d81f9a950826245dd a9e844fc78186c39daaa7147ead3e462cff60e9c6340b58134480b 4d17 P.y = 94c1d61b43728e5d784ef4fcb1f38e1075f3aef5e99866911de5a2 34f1aafdc26b554344742e6ba0420b71b298671bbeb2b773661863 4610 u[0] = 0847c5ebf957d3370b1f98fde499fb3e659996d9fc9b5707176ade 785ba72cd84b8a5597c12b1024be5f510fa5ba99642c4cec7f3f69 d3e7 u[1] = f8cbd8a7ae8c8deed071f3ac4b93e7cfcb8f1eac1645d699fd6d38 81cb295a5d3006d9449ed7cad412a77a1fe61e84a9e41d59ef384d 6f9a Q0.x = c08177330869db17fb81a5e6e53b36d29086d806269760f2e4caba a4015f5dbadb7ca2ba594d96a89d0ca4f0944489e1ef393d53db85 096f Q0.y = 02e894598c050eeb7195f5791f1a5f65da3776b7534be37640bcbf 95d4b915bd22333c50387583507169708fbd7bea0d7aa385dcc614 be9c Q1.x = 770877fd3b6c5503398157b68a9d3609f585f40e1ebebdd69bb0e4 d3d9aa811995ce75333fdadfa50db886a35959cc59cffd5c9710da ca25 Q1.y = b27fef77aa6231fbbc27538fa90eaca8abd03eb1e62fdae4ec5e82 8117c3b8b3ff8c34d0a6e6d79fff16d339b94ae8ede33331d5b464 c792 msg = abc P.x = 4e0158acacffa545adb818a6ed8e0b870e6abc24dfc1dc45cf9a05 2e98469275d9ff0c168d6a5ac7ec05b742412ee090581f12aa398f 9f8c P.y = 894d3fa437b2d2e28cdc3bfaade035430f350ec5239b6b406b5501 da6f6d6210ff26719cad83b63e97ab26a12df6dec851d6bf38e294 af9a u[0] = 04d975cd938ab49be3e81703d6a57cca84ed80d2ff6d4756d3f229 47fb5b70ab0231f0087cbfb4b7cae73b41b0c9396b356a4831d9a1 4322 u[1] = 2547ca887ac3db7b5fad3a098aa476e90078afe1358af6c63d677d 6edfd2100bc004e0f5db94dd2560fc5b308e223241d00488c9ca6b 0ef2 Q0.x = 7544612a97f4419c94ab0f621a1ee8ccf46c6657b8e0778ec9718b f4b41bc774487ad87d9b1e617aa49d3a4dd35a3cf57cd390ebf042 9952 Q0.y = d3ab703e60267d796b485bb58a28f934bd0133a6d1bbdfeda5277f a293310be262d7f653a5adffa608c37ed45c0e6008e54a16e1a342 e4df Q1.x = 6262f18d064bc131ade1b8bbcf1cbdf984f4f88153fcc9f94c888a f35d5e41aae84c12f169a55d8abf06e6de6c5b23079e587a58cf73 303e Q1.y = 6d57589e901abe7d947c93ab02c307ad9093ed9a83eb0b6e829fb7 318d590381ca25f3cc628a36a924a9ddfcf3cbedf94edf3b338ea7 7403 msg = abcdef0123456789 P.x = 2c25b4503fadc94b27391933b557abdecc601c13ed51c5de683894 84f93dbd6c22e5f962d9babf7a39f39f994312f8ca23344847e1fb f176 P.y = d5e6f5350f430e53a110f5ac7fcc82a96cb865aeca982029522d32 601e41c042a9dfbdfbefa2b0bdcdc3bc58cca8a7cd546803083d3a 8548 u[0] = 10659ce25588db4e4be6f7c791a79eb21a7f24aaaca76a6ca3b83b 80aaf95aa328fe7d569a1ac99f9cd216edf3915d72632f1a8b990e 250c u[1] = 9243e5b6c480683fd533e81f4a778349a309ce00bd163a29eb9fa8 dbc8f549242bef33e030db21cffacd408d2c4264b93e476c6a8590 e7aa Q0.x = 1457b60c12e00e47ceb3ce64b57e7c3c61636475443d704a8e2b2a b0a5ac7e4b3909435416784e16e19929c653b1bdcd9478a8e5331c a9ae Q0.y = 935d9f75f7a0babbc39c0a1c3b412518ed8a24bc2c4886722fb4b7 d4a747af98e4e2528c75221e2dffd3424abb436e10539a74caaafa 3ea3 Q1.x = b44d9e34211b4028f24117e856585ed81448f3c8b934987a1c5939 c86048737a08d85934fec6b3c2ef9f09cbd365cf22744f2e4ce697 62a4 Q1.y = dc996c1736f4319868f897d9a27c45b02dd3bc6b7ca356a039606e 5406e131a0bbe8238208b327b00853e8af84b58b13443e70542556 3323 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = a1861a9464ae31249a0e60bf38791f3663049a3f5378998499a832 92e159a2fecff838eb9bc6939e5c6ae76eb074ad4aae39b55b72ca 0b9a P.y = 580a2798c5b904f8adfec5bd29fb49b4633cd9f8c2935eb4a0f12e 5dfa0285680880296bb729c6405337525fb5ed3dff930c137314f6 0401 u[0] = c80390020e578f009ead417029eff6cd0926110922db63ab98395e 3bdfdd5d8a65b1a2b8d495dc8c5e59b7f3518731f7dfc0f93ace5d ee4b u[1] = 1c4dc6653a445bbef2add81d8e90a6c8591a788deb91d0d3f1519a 2e4a460313041b77c1b0817f2e80b388e5c3e49f37d787dc1f85e4 324a Q0.x = 9d355251e245e4b13ed4ea3e5a3c55bf9b7211f1704771f2e1d8f1 a65610c468b1cf70c6c2ce30dcaad54ad9e5439471ec554b862ec8 875a Q0.y = 6689ba36a242af69ac2aadb955d15e982d9b04f5d77f7609ebf742 9587feb7e5ce27490b9c72114509f89565122074e46a614d7fd7c8 00bd Q1.x = c4b3d3ad4d2d62739a62989532992c1081e9474a201085b4616da5 706cab824693b9fb428a201bcd1639a4588cc43b9eb841dbca7421 9b1f Q1.y = 265286f5dee8f3d894b5649da8565b58e96b4cfd44b462a2883ea6 4dbcda21a00706ea3fea53fc2d769084b0b74589e91d0384d71189 09fb msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 987c5ac19dd4b47835466a50b2d9feba7c8491b8885a04edf577e1 5a9f2c98b203ec2cd3e5390b3d20bba0fa6fc3eecefb5029a31723 4401 P.y = 5e273fcfff6b007bb6771e90509275a71ff1480c459ded26fc7b10 664db0a68aaa98bc7ecb07e49cf05b80ae5ac653fbdd14276bbd35 ccbc u[0] = 163c79ab0210a4b5e4f44fb19437ea965bf5431ab233ef16606f0b 03c5f16a3feb7d46a5a675ce8f606e9c2bf74ee5336c54a1e54919 f13f u[1] = f99666bde4995c4088333d6c2734687e815f80a99c6da02c47df4b 51f6c9d9ed466b4fecf7d9884990a8e0d0be6907fa437e0b1a27f4 9265 Q0.x = d1a5eba4a332514b69760948af09ceaeddbbb9fd4cb1f19b78349c 2ee4cf9ee86dbcf9064659a4a0566fe9c34d90aec86f0801edc131 ad9b Q0.y = 5d0a75a3014c3269c33b1b5da80706a4f097893461df286353484d 8031cd607c98edc2a846c77a841f057c7251eb45077853c7b20595 7e52 Q1.x = 69583b00dc6b2aced6ffa44630cc8c8cd0dd0649f57588dd0fb1da ad2ce132e281d01e3f25ccd3f405be759975c6484268bfe8f5e5f2 3c30 Q1.y = 8418484035f60bdccf48cb488634c2dfb40272123435f7e654fb6f 254c6c42e7e38f1fa79a637a168a28de6c275232b704f9ded0ff76 dd94 ]]></artwork> </section> <sectionanchor="edwards448xofshake256ell2nu" numbered="true" toc="default">anchor="edwards448xofshake256ell2nu"> <name>edwards448_XOF:SHAKE256_ELL2_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = edwards448_XOF:SHAKE256_ELL2_NU_ dst = QUUX-V01-CS02-with-edwards448_XOF:SHAKE256_ELL2_NU_ msg = P.x = eb5a1fc376fd73230af2de0f3374087cc7f279f0460114cf0a6c12 d6d044c16de34ec2350c34b26bf110377655ab77936869d085406a f71e P.y = df5dcea6d42e8f494b279a500d09e895d26ac703d75ca6d118e8ca 58bf6f608a2a383f292fce1563ff995dce75aede1fdc8e7c0c737a e9ad u[0] = 1368aefc0416867ea2cfc515416bcbeecc9ec81c4ecbd52ccdb91e 06996b3f359bc930eef6743c7a2dd7adb785bc7093ed044efed950 86d7 Q.x = 4b2abf8c0fca49d027c2a81bf73bb5990e05f3e76c7ba137cc0b89 415ccd55ce7f191cc0c11b0560c1cdc2a8085dd56996079e05a3cd 8dde Q.y = 82532f5b0cb3bfb8542d3228d055bfe61129dbeae8bace80cf61f1 7725e8ec8226a24f0e687f78f01da88e3b2715194a03dca7c0a96b bf04 msg = abc P.x = 4623a64bceaba3202df76cd8b6e3daf70164f3fcbda6d6e340f7fa b5cdf89140d955f722524f5fe4d968fef6ba2853ff4ea086c2f67d 8110 P.y = abaac321a169761a8802ab5b5d10061fec1a83c670ac6bc9595470 0317ee5f82870120e0e2c5a21b12a0c7ad17ebd343363604c4bcec afd1 u[0] = cda3b0ecfe054c4077007d7300969ec24f4c741300b630ec9188eb ab31a5ae0065612ee22d9f793733179ffc2e10c53ca5b539057aaf dc2f Q.x = b1ca5bef2f157673a210f56c9b0039db8399e4749585abac64f831 f74ed1ec5f591928976c687c06d57686bacb98440e77af878349cd f2d2 Q.y = 5bbfd6a3730d517b03c3cd9e2eed94af12891334ec090e0495c2ed c588e9e10b6f63b03a62076808cbcd6da95adfb5af76c136b2d42e 0dac msg = abcdef0123456789 P.x = e9eb562e76db093baa43a31b7edd04ec4aadcef3389a7b9c58a19c f87f8ae3d154e134b6b3ed45847a741e33df51903da681629a4b8b cc2e P.y = 0cf6606927ad7eb15dbc193993bc7e4dda744b311a8ec4274c8f73 8f74f605934582474c79260f60280fe35bd37d4347e59184cbfa12 cbc4 u[0] = d36bae98351512c382c7a3e1eba22497574f11fef9867901b1a270 0b39fa2cd0d38ed4380387a99162b7ba0240c743f0532ef60d577c 413d Q.x = 958a51e2f02e0dfd3930709010d5d16f869adb9d8a8f7c01139911 d206c20cdb7bfb40ee33ba30536a99f49362fa7633d0f417fc3914 fe21 Q.y = f4307a36ab6612fa97501497f01afa109733ce85875935551c3ca9 0f0fa7e0097a8640bb7e5dbcc38ab32b23b748790f2261f2c44c3b f3ba msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 122a3234d34b26c69749f23356452bf9501efa2d94859d5ef741fe f024156d9d191a03a2ad24c38186f93e02d05572575968b083d8a3 9738 P.y = ddf55e74eb4414c2c1fa4aa6bc37c4ab470a3fed6bb5af1e435703 09b162fb61879bb15f9ea49c712efd42d0a71666430f9f0d4a2050 5050 u[0] = 5945744d27122f89da3daf76ab4db9616053df64e25d30ec9a0066 7ee6710240579c1db8f8ef3386f3f4f413cfb325ac14094d582026 a971 Q.x = e7e1f2d13548ac2c8fcd346e4c63606545bf93652011721e83ac3b 64226f77a8823d3881e164bc6ca45505b236e8e3721c028052fcc9 ade5 Q.y = 7e0f340501bf25f018b9d374c2acbdd43c07261d85a6ef3c855113 d4e023634db59a87b8fab9efe04ed1fee302c8a4994e83bdda32bd 9c0b msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 221704949b1ce1ab8dd174dc9b8c56fcffa27179569ce9219c0c2f e183d3d23343a4c42a0e2e9d6b9d0feb1df3883ec489b6671d1fa6 4089 P.y = ebdecfdc87142d1a919034bf22ecfad934c9a85effff14b594ae2c 00943ca62a39d6ee3be9df0bb504ce8a9e1669bc6959c42ad6a1d3 b686 u[0] = 1192e378043f01cedc7ea0209321519213b0184ea0d8575816bcd9 182a367823e1eecc2faf1df8f79b24027a4b9bfa208cd320e79bef 06ea Q.x = 0fd3bb833c1d7a5b319d1d4117406a23b9aece976186ecb18a11a6 35e6fbdb920d47e04762b1f2a8c59d2f8435d0fdefe501f544cda2 3dbf Q.y = f13b0dad4d5eeb120f2443ac4392f8096a1396f5014ec2a3506a34 7fef8076a7282035cf619599b1919cf29df5ce87711c11688aab77 00a6 ]]></artwork> </section> </section> <sectionanchor="secp256k1" numbered="true" toc="default">anchor="secp256k1"> <name>secp256k1</name> <sectionanchor="secp256k1xmdsha-256sswuro" numbered="true" toc="default">anchor="secp256k1xmdsha-256sswuro"> <name>secp256k1_XMD:SHA-256_SSWU_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = secp256k1_XMD:SHA-256_SSWU_RO_ dst = QUUX-V01-CS02-with-secp256k1_XMD:SHA-256_SSWU_RO_ msg = P.x = c1cae290e291aee617ebaef1be6d73861479c48b841eaba9b7b585 2ddfeb1346 P.y = 64fa678e07ae116126f08b022a94af6de15985c996c3a91b64c406 a960e51067 u[0] = 6b0f9910dd2ba71c78f2ee9f04d73b5f4c5f7fc773a701abea1e57 3cab002fb3 u[1] = 1ae6c212e08fe1a5937f6202f929a2cc8ef4ee5b9782db68b0d579 9fd8f09e16 Q0.x = 74519ef88b32b425a095e4ebcc84d81b64e9e2c2675340a720bb1a 1857b99f1e Q0.y = c174fa322ab7c192e11748beed45b508e9fdb1ce046dee9c2cd3a2 a86b410936 Q1.x = 44548adb1b399263ded3510554d28b4bead34b8cf9a37b4bd0bd2b a4db87ae63 Q1.y = 96eb8e2faf05e368efe5957c6167001760233e6dd2487516b46ae7 25c4cce0c6 msg = abc P.x = 3377e01eab42db296b512293120c6cee72b6ecf9f9205760bd9ff1 1fb3cb2c4b P.y = 7f95890f33efebd1044d382a01b1bee0900fb6116f94688d487c6c 7b9c8371f6 u[0] = 128aab5d3679a1f7601e3bdf94ced1f43e491f544767e18a4873f3 97b08a2b61 u[1] = 5897b65da3b595a813d0fdcc75c895dc531be76a03518b044daaa0 f2e4689e00 Q0.x = 07dd9432d426845fb19857d1b3a91722436604ccbbbadad8523b8f c38a5322d7 Q0.y = 604588ef5138cffe3277bbd590b8550bcbe0e523bbaf1bed4014a4 67122eb33f Q1.x = e9ef9794d15d4e77dde751e06c182782046b8dac05f8491eb88764 fc65321f78 Q1.y = cb07ce53670d5314bf236ee2c871455c562dd76314aa41f012919f e8e7f717b3 msg = abcdef0123456789 P.x = bac54083f293f1fe08e4a70137260aa90783a5cb84d3f35848b324 d0674b0e3a P.y = 4436476085d4c3c4508b60fcf4389c40176adce756b398bdee27bc a19758d828 u[0] = ea67a7c02f2cd5d8b87715c169d055a22520f74daeb080e6180958 380e2f98b9 u[1] = 7434d0d1a500d38380d1f9615c021857ac8d546925f5f2355319d8 23a478da18 Q0.x = 576d43ab0260275adf11af990d130a5752704f7947862876172080 8862544b5d Q0.y = 643c4a7fb68ae6cff55edd66b809087434bbaff0c07f3f9ec4d49b b3c16623c3 Q1.x = f89d6d261a5e00fe5cf45e827b507643e67c2a947a20fd9ad71039 f8b0e29ff8 Q1.y = b33855e0cc34a9176ead91c6c3acb1aacb1ce936d563bc1cee1dcf fc806caf57 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = e2167bc785333a37aa562f021f1e881defb853839babf52a7f72b1 02e41890e9 P.y = f2401dd95cc35867ffed4f367cd564763719fbc6a53e969fb8496a 1e6685d873 u[0] = eda89a5024fac0a8207a87e8cc4e85aa3bce10745d501a30deb873 41b05bcdf5 u[1] = dfe78cd116818fc2c16f3837fedbe2639fab012c407eac9dfe9245 bf650ac51d Q0.x = 9c91513ccfe9520c9c645588dff5f9b4e92eaf6ad4ab6f1cd720d1 92eb58247a Q0.y = c7371dcd0134412f221e386f8d68f49e7fa36f9037676e163d4a06 3fbf8a1fb8 Q1.x = 10fee3284d7be6bd5912503b972fc52bf4761f47141a0015f1c6ae 36848d869b Q1.y = 0b163d9b4bf21887364332be3eff3c870fa053cf508732900fc69a 6eb0e1b672 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = e3c8d35aaaf0b9b647e88a0a0a7ee5d5bed5ad38238152e4e6fd8c 1f8cb7c998 P.y = 8446eeb6181bf12f56a9d24e262221cc2f0c4725c7e3803024b588 8ee5823aa6 u[0] = 8d862e7e7e23d7843fe16d811d46d7e6480127a6b78838c277bca1 7df6900e9f u[1] = 68071d2530f040f081ba818d3c7188a94c900586761e9115efa47a e9bd847938 Q0.x = b32b0ab55977b936f1e93fdc68cec775e13245e161dbfe556bbb1f 72799b4181 Q0.y = 2f5317098360b722f132d7156a94822641b615c91f8663be691698 70a12af9e8 Q1.x = 148f98780f19388b9fa93e7dc567b5a673e5fca7079cd9cdafd719 82ec4c5e12 Q1.y = 3989645d83a433bc0c001f3dac29af861f33a6fd1e04f4b36873f5 bff497298a ]]></artwork> </section> <sectionanchor="secp256k1xmdsha-256sswunu" numbered="true" toc="default">anchor="secp256k1xmdsha-256sswunu"> <name>secp256k1_XMD:SHA-256_SSWU_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = secp256k1_XMD:SHA-256_SSWU_NU_ dst = QUUX-V01-CS02-with-secp256k1_XMD:SHA-256_SSWU_NU_ msg = P.x = a4792346075feae77ac3b30026f99c1441b4ecf666ded19b7522cf 65c4c55c5b P.y = 62c59e2a6aeed1b23be5883e833912b08ba06be7f57c0e9cdc663f 31639ff3a7 u[0] = 0137fcd23bc3da962e8808f97474d097a6c8aa2881fceef4514173 635872cf3b Q.x = a4792346075feae77ac3b30026f99c1441b4ecf666ded19b7522cf 65c4c55c5b Q.y = 62c59e2a6aeed1b23be5883e833912b08ba06be7f57c0e9cdc663f 31639ff3a7 msg = abc P.x = 3f3b5842033fff837d504bb4ce2a372bfeadbdbd84a1d2b678b6e1 d7ee426b9d P.y = 902910d1fef15d8ae2006fc84f2a5a7bda0e0407dc913062c3a493 c4f5d876a5 u[0] = e03f894b4d7caf1a50d6aa45cac27412c8867a25489e32c5ddeb50 3229f63a2e Q.x = 3f3b5842033fff837d504bb4ce2a372bfeadbdbd84a1d2b678b6e1 d7ee426b9d Q.y = 902910d1fef15d8ae2006fc84f2a5a7bda0e0407dc913062c3a493 c4f5d876a5 msg = abcdef0123456789 P.x = 07644fa6281c694709f53bdd21bed94dab995671e4a8cd1904ec4a a50c59bfdf P.y = c79f8d1dad79b6540426922f7fbc9579c3018dafeffcd4552b1626 b506c21e7b u[0] = e7a6525ae7069ff43498f7f508b41c57f80563c1fe4283510b3224 46f32af41b Q.x = 07644fa6281c694709f53bdd21bed94dab995671e4a8cd1904ec4a a50c59bfdf Q.y = c79f8d1dad79b6540426922f7fbc9579c3018dafeffcd4552b1626 b506c21e7b msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = b734f05e9b9709ab631d960fa26d669c4aeaea64ae62004b9d34f4 83aa9acc33 P.y = 03fc8a4a5a78632e2eb4d8460d69ff33c1d72574b79a35e402e801 f2d0b1d6ee u[0] = d97cf3d176a2f26b9614a704d7d434739d194226a706c886c5c3c3 9806bc323c Q.x = b734f05e9b9709ab631d960fa26d669c4aeaea64ae62004b9d34f4 83aa9acc33 Q.y = 03fc8a4a5a78632e2eb4d8460d69ff33c1d72574b79a35e402e801 f2d0b1d6ee msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 17d22b867658977b5002dbe8d0ee70a8cfddec3eec50fb93f36136 070fd9fa6c P.y = e9178ff02f4dab73480f8dd590328aea99856a7b6cc8e5a6cdf289 ecc2a51718 u[0] = a9ffbeee1d6e41ac33c248fb3364612ff591b502386c1bf6ac4aaf 1ea51f8c3b Q.x = 17d22b867658977b5002dbe8d0ee70a8cfddec3eec50fb93f36136 070fd9fa6c Q.y = e9178ff02f4dab73480f8dd590328aea99856a7b6cc8e5a6cdf289 ecc2a51718 ]]></artwork> </section> </section> <sectionanchor="bls12-381-g1" numbered="true" toc="default">anchor="bls12-381-g1"> <name>BLS12-381 G1</name> <sectionanchor="bls12381g1xmdsha-256sswuro" numbered="true" toc="default">anchor="bls12381g1xmdsha-256sswuro"> <name>BLS12381G1_XMD:SHA-256_SSWU_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = BLS12381G1_XMD:SHA-256_SSWU_RO_ dst = QUUX-V01-CS02-with-BLS12381G1_XMD:SHA-256_SSWU_RO_ msg = P.x = 052926add2207b76ca4fa57a8734416c8dc95e24501772c8142787 00eed6d1e4e8cf62d9c09db0fac349612b759e79a1 P.y = 08ba738453bfed09cb546dbb0783dbb3a5f1f566ed67bb6be0e8c6 7e2e81a4cc68ee29813bb7994998f3eae0c9c6a265 u[0] = 0ba14bd907ad64a016293ee7c2d276b8eae71f25a4b941eece7b0d 89f17f75cb3ae5438a614fb61d6835ad59f29c564f u[1] = 019b9bd7979f12657976de2884c7cce192b82c177c80e0ec604436 a7f538d231552f0d96d9f7babe5fa3b19b3ff25ac9 Q0.x = 11a3cce7e1d90975990066b2f2643b9540fa40d6137780df4e753a 8054d07580db3b7f1f03396333d4a359d1fe3766fe Q0.y = 0eeaf6d794e479e270da10fdaf768db4c96b650a74518fc67b04b0 3927754bac66f3ac720404f339ecdcc028afa091b7 Q1.x = 160003aaf1632b13396dbad518effa00fff532f604de1a7fc2082f f4cb0afa2d63b2c32da1bef2bf6c5ca62dc6b72f9c Q1.y = 0d8bb2d14e20cf9f6036152ed386d79189415b6d015a20133acb4e 019139b94e9c146aaad5817f866c95d609a361735e msg = abc P.x = 03567bc5ef9c690c2ab2ecdf6a96ef1c139cc0b2f284dca0a9a794 3388a49a3aee664ba5379a7655d3c68900be2f6903 P.y = 0b9c15f3fe6e5cf4211f346271d7b01c8f3b28be689c8429c85b67 af215533311f0b8dfaaa154fa6b88176c229f2885d u[0] = 0d921c33f2bad966478a03ca35d05719bdf92d347557ea166e5bba 579eea9b83e9afa5c088573c2281410369fbd32951 u[1] = 003574a00b109ada2f26a37a91f9d1e740dffd8d69ec0c35e1e9f4 652c7dba61123e9dd2e76c655d956e2b3462611139 Q0.x = 125435adce8e1cbd1c803e7123f45392dc6e326d292499c2c45c58 65985fd74fe8f042ecdeeec5ecac80680d04317d80 Q0.y = 0e8828948c989126595ee30e4f7c931cbd6f4570735624fd25aef2 fa41d3f79cfb4b4ee7b7e55a8ce013af2a5ba20bf2 Q1.x = 11def93719829ecda3b46aa8c31fc3ac9c34b428982b898369608e 4f042babee6c77ab9218aad5c87ba785481eff8ae4 Q1.y = 0007c9cef122ccf2efd233d6eb9bfc680aa276652b0661f4f820a6 53cec1db7ff69899f8e52b8e92b025a12c822a6ce6 msg = abcdef0123456789 P.x = 11e0b079dea29a68f0383ee94fed1b940995272407e3bb916bbf26 8c263ddd57a6a27200a784cbc248e84f357ce82d98 P.y = 03a87ae2caf14e8ee52e51fa2ed8eefe80f02457004ba4d486d6aa 1f517c0889501dc7413753f9599b099ebcbbd2d709 u[0] = 062d1865eb80ebfa73dcfc45db1ad4266b9f3a93219976a3790ab8 d52d3e5f1e62f3b01795e36834b17b70e7b76246d4 u[1] = 0cdc3e2f271f29c4ff75020857ce6c5d36008c9b48385ea2f2bf6f 96f428a3deb798aa033cd482d1cdc8b30178b08e3a Q0.x = 08834484878c217682f6d09a4b51444802fdba3d7f2df9903a0dda db92130ebbfa807fffa0eabf257d7b48272410afff Q0.y = 0b318f7ecf77f45a0f038e62d7098221d2dbbca2a394164e2e3fe9 53dc714ac2cde412d8f2d7f0c03b259e6795a2508e Q1.x = 158418ed6b27e2549f05531a8281b5822b31c3bf3144277fbb977f 8d6e2694fedceb7011b3c2b192f23e2a44b2bd106e Q1.y = 1879074f344471fac5f839e2b4920789643c075792bec5af4282c7 3f7941cda5aa77b00085eb10e206171b9787c4169f msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 15f68eaa693b95ccb85215dc65fa81038d69629f70aeee0d0f677c f22285e7bf58d7cb86eefe8f2e9bc3f8cb84fac488 P.y = 1807a1d50c29f430b8cafc4f8638dfeeadf51211e1602a5f184443 076715f91bb90a48ba1e370edce6ae1062f5e6dd38 u[0] = 010476f6a060453c0b1ad0b628f3e57c23039ee16eea5e71bb87c3 b5419b1255dc0e5883322e563b84a29543823c0e86 u[1] = 0b1a912064fb0554b180e07af7e787f1f883a0470759c03c1b6509 eb8ce980d1670305ae7b928226bb58fdc0a419f46e Q0.x = 0cbd7f84ad2c99643fea7a7ac8f52d63d66cefa06d9a56148e58b9 84b3dd25e1f41ff47154543343949c64f88d48a710 Q0.y = 052c00e4ed52d000d94881a5638ae9274d3efc8bc77bc0e5c650de 04a000b2c334a9e80b85282a00f3148dfdface0865 Q1.x = 06493fb68f0d513af08be0372f849436a787e7b701ae31cb964d96 8021d6ba6bd7d26a38aaa5a68e8c21a6b17dc8b579 Q1.y = 02e98f2ccf5802b05ffaac7c20018bc0c0b2fd580216c4aa2275d2 909dc0c92d0d0bdc979226adeb57a29933536b6bb4 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 082aabae8b7dedb0e78aeb619ad3bfd9277a2f77ba7fad20ef6aab dc6c31d19ba5a6d12283553294c1825c4b3ca2dcfe P.y = 05b84ae5a942248eea39e1d91030458c40153f3b654ab7872d779a d1e942856a20c438e8d99bc8abfbf74729ce1f7ac8 u[0] = 0a8ffa7447f6be1c5a2ea4b959c9454b431e29ccc0802bc052413a 9c5b4f9aac67a93431bd480d15be1e057c8a08e8c6 u[1] = 05d487032f602c90fa7625dbafe0f4a49ef4a6b0b33d7bb349ff4c f5410d297fd6241876e3e77b651cfc8191e40a68b7 Q0.x = 0cf97e6dbd0947857f3e578231d07b309c622ade08f2c08b32ff37 2bd90db19467b2563cc997d4407968d4ac80e154f8 Q0.y = 127f0cddf2613058101a5701f4cb9d0861fd6c2a1b8e0afe194fcc f586a3201a53874a2761a9ab6d7220c68661a35ab3 Q1.x = 092f1acfa62b05f95884c6791fba989bbe58044ee6355d100973bf 9553ade52b47929264e6ae770fb264582d8dce512a Q1.y = 028e6d0169a72cfedb737be45db6c401d3adfb12c58c619c82b93a 5dfcccef12290de530b0480575ddc8397cda0bbebf ]]></artwork> </section> <sectionanchor="bls12381g1xmdsha-256sswunu" numbered="true" toc="default">anchor="bls12381g1xmdsha-256sswunu"> <name>BLS12381G1_XMD:SHA-256_SSWU_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = BLS12381G1_XMD:SHA-256_SSWU_NU_ dst = QUUX-V01-CS02-with-BLS12381G1_XMD:SHA-256_SSWU_NU_ msg = P.x = 184bb665c37ff561a89ec2122dd343f20e0f4cbcaec84e3c3052ea 81d1834e192c426074b02ed3dca4e7676ce4ce48ba P.y = 04407b8d35af4dacc809927071fc0405218f1401a6d15af775810e 4e460064bcc9468beeba82fdc751be70476c888bf3 u[0] = 156c8a6a2c184569d69a76be144b5cdc5141d2d2ca4fe341f011e2 5e3969c55ad9e9b9ce2eb833c81a908e5fa4ac5f03 Q.x = 11398d3b324810a1b093f8e35aa8571cced95858207e7f49c4fd74 656096d61d8a2f9a23cdb18a4dd11cd1d66f41f709 Q.y = 19316b6fb2ba7717355d5d66a361899057e1e84a6823039efc7bec cefe09d023fb2713b1c415fcf278eb0c39a89b4f72 msg = abc P.x = 009769f3ab59bfd551d53a5f846b9984c59b97d6842b20a2c565ba a167945e3d026a3755b6345df8ec7e6acb6868ae6d P.y = 1532c00cf61aa3d0ce3e5aa20c3b531a2abd2c770a790a26138183 03c6b830ffc0ecf6c357af3317b9575c567f11cd2c u[0] = 147e1ed29f06e4c5079b9d14fc89d2820d32419b990c1c7bb7dbea 2a36a045124b31ffbde7c99329c05c559af1c6cc82 Q.x = 1998321bc27ff6d71df3051b5aec12ff47363d81a5e9d2dff55f44 4f6ca7e7d6af45c56fd029c58237c266ef5cda5254 Q.y = 034d274476c6307ae584f951c82e7ea85b84f72d28f4d647173235 6121af8d62a49bc263e8eb913a6cf6f125995514ee msg = abcdef0123456789 P.x = 1974dbb8e6b5d20b84df7e625e2fbfecb2cdb5f77d5eae5fb2955e 5ce7313cae8364bc2fff520a6c25619739c6bdcb6a P.y = 15f9897e11c6441eaa676de141c8d83c37aab8667173cbe1dfd6de 74d11861b961dccebcd9d289ac633455dfcc7013a3 u[0] = 04090815ad598a06897dd89bcda860f25837d54e897298ce31e694 7378134d3761dc59a572154963e8c954919ecfa82d Q.x = 17d502fa43bd6a4cad2859049a0c3ecefd60240d129be65da271a4 c03a9c38fa78163b9d2a919d2beb57df7d609b4919 Q.y = 109019902ae93a8732abecf2ff7fecd2e4e305eb91f41c9c3267f1 6b6c19de138c7272947f25512745da6c466cdfd1ac msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 0a7a047c4a8397b3446450642c2ac64d7239b61872c9ae7a59707a 8f4f950f101e766afe58223b3bff3a19a7f754027c P.y = 1383aebba1e4327ccff7cf9912bda0dbc77de048b71ef8c8a81111 d71dc33c5e3aa6edee9cf6f5fe525d50cc50b77cc9 u[0] = 08dccd088ca55b8bfbc96fb50bb25c592faa867a8bb78d4e94a8cc 2c92306190244532e91feba2b7fed977e3c3bb5a1f Q.x = 112eb92dd2b3aa9cd38b08de4bef603f2f9fb0ca226030626a9a2e 47ad1e9847fe0a5ed13766c339e38f514bba143b21 Q.y = 17542ce2f8d0a54f2c5ba8c4b14e10b22d5bcd7bae2af3c965c8c8 72b571058c720eac448276c99967ded2bf124490e1 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 0e7a16a975904f131682edbb03d9560d3e48214c9986bd50417a77 108d13dc957500edf96462a3d01e62dc6cd468ef11 P.y = 0ae89e677711d05c30a48d6d75e76ca9fb70fe06c6dd6ff988683d 89ccde29ac7d46c53bb97a59b1901abf1db66052db u[0] = 0dd824886d2123a96447f6c56e3a3fa992fbfefdba17b6673f9f63 0ff19e4d326529db37e1c1be43f905bf9202e0278d Q.x = 1775d400a1bacc1c39c355da7e96d2d1c97baa9430c4a3476881f8 521c09a01f921f592607961efc99c4cd46bd78ca19 Q.y = 1109b5d59f65964315de65a7a143e86eabc053104ed289cf480949 317a5685fad7254ff8e7fe6d24d3104e5d55ad6370 ]]></artwork> </section> </section> <sectionanchor="bls12-381-g2" numbered="true" toc="default">anchor="bls12-381-g2"> <name>BLS12-381 G2</name> <sectionanchor="bls12381g2xmdsha-256sswuro" numbered="true" toc="default">anchor="bls12381g2xmdsha-256sswuro"> <name>BLS12381G2_XMD:SHA-256_SSWU_RO_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = BLS12381G2_XMD:SHA-256_SSWU_RO_ dst = QUUX-V01-CS02-with-BLS12381G2_XMD:SHA-256_SSWU_RO_ msg = P.x = 0141ebfbdca40eb85b87142e130ab689c673cf60f1a3e98d693352 66f30d9b8d4ac44c1038e9dcdd5393faf5c41fb78a + I * 05cb8437535e20ecffaef7752baddf98034139c38452458baeefab 379ba13dff5bf5dd71b72418717047f5b0f37da03d P.y = 0503921d7f6a12805e72940b963c0cf3471c7b2a524950ca195d11 062ee75ec076daf2d4bc358c4b190c0c98064fdd92 + I * 12424ac32561493f3fe3c260708a12b7c620e7be00099a974e259d dc7d1f6395c3c811cdd19f1e8dbf3e9ecfdcbab8d6 u[0] = 03dbc2cce174e91ba93cbb08f26b917f98194a2ea08d1cce75b2b9 cc9f21689d80bd79b594a613d0a68eb807dfdc1cf8 + I * 05a2acec64114845711a54199ea339abd125ba38253b70a92c876d f10598bd1986b739cad67961eb94f7076511b3b39a u[1] = 02f99798e8a5acdeed60d7e18e9120521ba1f47ec090984662846b c825de191b5b7641148c0dbc237726a334473eee94 + I * 145a81e418d4010cc027a68f14391b30074e89e60ee7a22f87217b 2f6eb0c4b94c9115b436e6fa4607e95a98de30a435 Q0.x = 019ad3fc9c72425a998d7ab1ea0e646a1f6093444fc6965f1cad5a 3195a7b1e099c050d57f45e3fa191cc6d75ed7458c + I * 171c88b0b0efb5eb2b88913a9e74fe111a4f68867b59db252ce586 8af4d1254bfab77ebde5d61cd1a86fb2fe4a5a1c1d Q0.y = 0ba10604e62bdd9eeeb4156652066167b72c8d743b050fb4c1016c 31b505129374f76e03fa127d6a156213576910fef3 + I * 0eb22c7a543d3d376e9716a49b72e79a89c9bfe9feee8533ed931c bb5373dde1fbcd7411d8052e02693654f71e15410a Q1.x = 113d2b9cd4bd98aee53470b27abc658d91b47a78a51584f3d4b950 677cfb8a3e99c24222c406128c91296ef6b45608be + I * 13855912321c5cb793e9d1e88f6f8d342d49c0b0dbac613ee9e17e 3c0b3c97dfbb5a49cc3fb45102fdbaf65e0efe2632 Q1.y = 0fd3def0b7574a1d801be44fde617162aa2e89da47f464317d9bb5 abc3a7071763ce74180883ad7ad9a723a9afafcdca + I * 056f617902b3c0d0f78a9a8cbda43a26b65f602f8786540b9469b0 60db7b38417915b413ca65f875c130bebfaa59790c msg = abc P.x = 02c2d18e033b960562aae3cab37a27ce00d80ccd5ba4b7fe0e7a21 0245129dbec7780ccc7954725f4168aff2787776e6 + I * 139cddbccdc5e91b9623efd38c49f81a6f83f175e80b06fc374de9 eb4b41dfe4ca3a230ed250fbe3a2acf73a41177fd8 P.y = 1787327b68159716a37440985269cf584bcb1e621d3a7202be6ea0 5c4cfe244aeb197642555a0645fb87bf7466b2ba48 + I * 00aa65dae3c8d732d10ecd2c50f8a1baf3001578f71c694e03866e 9f3d49ac1e1ce70dd94a733534f106d4cec0eddd16 u[0] = 15f7c0aa8f6b296ab5ff9c2c7581ade64f4ee6f1bf18f55179ff44 a2cf355fa53dd2a2158c5ecb17d7c52f63e7195771 + I * 01c8067bf4c0ba709aa8b9abc3d1cef589a4758e09ef53732d670f d8739a7274e111ba2fcaa71b3d33df2a3a0c8529dd u[1] = 187111d5e088b6b9acfdfad078c4dacf72dcd17ca17c82be35e79f 8c372a693f60a033b461d81b025864a0ad051a06e4 + I * 08b852331c96ed983e497ebc6dee9b75e373d923b729194af8e72a 051ea586f3538a6ebb1e80881a082fa2b24df9f566 Q0.x = 12b2e525281b5f4d2276954e84ac4f42cf4e13b6ac4228624e1776 0faf94ce5706d53f0ca1952f1c5ef75239aeed55ad + I * 05d8a724db78e570e34100c0bc4a5fa84ad5839359b40398151f37 cff5a51de945c563463c9efbdda569850ee5a53e77 Q0.y = 02eacdc556d0bdb5d18d22f23dcb086dd106cad713777c7e640794 3edbe0b3d1efe391eedf11e977fac55f9b94f2489c + I * 04bbe48bfd5814648d0b9e30f0717b34015d45a861425fabc1ee06 fdfce36384ae2c808185e693ae97dcde118f34de41 Q1.x = 19f18cc5ec0c2f055e47c802acc3b0e40c337256a208001dde14b2 5afced146f37ea3d3ce16834c78175b3ed61f3c537 + I * 15b0dadc256a258b4c68ea43605dffa6d312eef215c19e6474b3e1 01d33b661dfee43b51abbf96fee68fc6043ac56a58 Q1.y = 05e47c1781286e61c7ade887512bd9c2cb9f640d3be9cf87ea0bad 24bd0ebfe946497b48a581ab6c7d4ca74b5147287f + I * 19f98db2f4a1fcdf56a9ced7b320ea9deecf57c8e59236b0dc21f6 ee7229aa9705ce9ac7fe7a31c72edca0d92370c096 msg = abcdef0123456789 P.x = 121982811d2491fde9ba7ed31ef9ca474f0e1501297f68c298e9f4 c0028add35aea8bb83d53c08cfc007c1e005723cd0 + I * 190d119345b94fbd15497bcba94ecf7db2cbfd1e1fe7da034d26cb ba169fb3968288b3fafb265f9ebd380512a71c3f2c P.y = 05571a0f8d3c08d094576981f4a3b8eda0a8e771fcdcc8ecceaf13 56a6acf17574518acb506e435b639353c2e14827c8 + I * 0bb5e7572275c567462d91807de765611490205a941a5a6af3b169 1bfe596c31225d3aabdf15faff860cb4ef17c7c3be u[0] = 0313d9325081b415bfd4e5364efaef392ecf69b087496973b22930 3e1816d2080971470f7da112c4eb43053130b785e1 + I * 062f84cb21ed89406890c051a0e8b9cf6c575cf6e8e18ecf63ba86 826b0ae02548d83b483b79e48512b82a6c0686df8f u[1] = 1739123845406baa7be5c5dc74492051b6d42504de008c635f3535 bb831d478a341420e67dcc7b46b2e8cba5379cca97 + I * 01897665d9cb5db16a27657760bbea7951f67ad68f8d55f7113f24 ba6ddd82caef240a9bfa627972279974894701d975 Q0.x = 0f48f1ea1318ddb713697708f7327781fb39718971d72a9245b973 1faaca4dbaa7cca433d6c434a820c28b18e20ea208 + I * 06051467c8f85da5ba2540974758f7a1e0239a5981de441fdd8768 0a995649c211054869c50edbac1f3a86c561ba3162 Q0.y = 168b3d6df80069dbbedb714d41b32961ad064c227355e1ce5fac8e 105de5e49d77f0c64867f3834848f152497eb76333 + I * 134e0e8331cee8cb12f9c2d0742714ed9eee78a84d634c9a95f6a7 391b37125ed48bfc6e90bf3546e99930ff67cc97bc Q1.x = 004fd03968cd1c99a0dd84551f44c206c84dcbdb78076c5bfee24e 89a92c8508b52b88b68a92258403cbe1ea2da3495f + I * 1674338ea298281b636b2eb0fe593008d03171195fd6dcd4531e8a 1ed1f02a72da238a17a635de307d7d24aa2d969a47 Q1.y = 0dc7fa13fff6b12558419e0a1e94bfc3cfaf67238009991c5f24ee 94b632c3d09e27eca329989aee348a67b50d5e236c + I * 169585e164c131103d85324f2d7747b23b91d66ae5d947c449c819 4a347969fc6bbd967729768da485ba71868df8aed2 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 19a84dd7248a1066f737cc34502ee5555bd3c19f2ecdb3c7d9e24d c65d4e25e50d83f0f77105e955d78f4762d33c17da + I * 0934aba516a52d8ae479939a91998299c76d39cc0c035cd18813be c433f587e2d7a4fef038260eef0cef4d02aae3eb91 P.y = 14f81cd421617428bc3b9fe25afbb751d934a00493524bc4e06563 5b0555084dd54679df1536101b2c979c0152d09192 + I * 09bcccfa036b4847c9950780733633f13619994394c23ff0b32fa6 b795844f4a0673e20282d07bc69641cee04f5e5662 u[0] = 025820cefc7d06fd38de7d8e370e0da8a52498be9b53cba9927b2e f5c6de1e12e12f188bbc7bc923864883c57e49e253 + I * 034147b77ce337a52e5948f66db0bab47a8d038e712123bb381899 b6ab5ad20f02805601e6104c29df18c254b8618c7b u[1] = 0930315cae1f9a6017c3f0c8f2314baa130e1cf13f6532bff0a8a1 790cd70af918088c3db94bda214e896e1543629795 + I * 10c4df2cacf67ea3cb3108b00d4cbd0b3968031ebc8eac4b1ebcef e84d6b715fde66bef0219951ece29d1facc8a520ef Q0.x = 09eccbc53df677f0e5814e3f86e41e146422834854a224bf5a83a5 0e4cc0a77bfc56718e8166ad180f53526ea9194b57 + I * 0c3633943f91daee715277bd644fba585168a72f96ded64fc5a384 cce4ec884a4c3c30f08e09cd2129335dc8f67840ec Q0.y = 0eb6186a0457d5b12d132902d4468bfeb7315d83320b6c32f1c875 f344efcba979952b4aa418589cb01af712f98cc555 + I * 119e3cf167e69eb16c1c7830e8df88856d48be12e3ff0a40791a5c d2f7221311d4bf13b1847f371f467357b3f3c0b4c7 Q1.x = 0eb3aabc1ddfce17ff18455fcc7167d15ce6b60ddc9eb9b59f8d40 ab49420d35558686293d046fc1e42f864b7f60e381 + I * 198bdfb19d7441ebcca61e8ff774b29d17da16547d2c10c273227a 635cacea3f16826322ae85717630f0867539b5ed8b Q1.y = 0aaf1dee3adf3ed4c80e481c09b57ea4c705e1b8d25b897f0ceeec 3990748716575f92abff22a1c8f4582aff7b872d52 + I * 0d058d9061ed27d4259848a06c96c5ca68921a5d269b078650c882 cb3c2bd424a8702b7a6ee4e0ead9982baf6843e924 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 01a6ba2f9a11fa5598b2d8ace0fbe0a0eacb65deceb476fbbcb64f d24557c2f4b18ecfc5663e54ae16a84f5ab7f62534 + I * 11fca2ff525572795a801eed17eb12785887c7b63fb77a42be46ce 4a34131d71f7a73e95fee3f812aea3de78b4d01569 P.y = 0b6798718c8aed24bc19cb27f866f1c9effcdbf92397ad6448b5c9 db90d2b9da6cbabf48adc1adf59a1a28344e79d57e + I * 03a47f8e6d1763ba0cad63d6114c0accbef65707825a511b251a66 0a9b3994249ae4e63fac38b23da0c398689ee2ab52 u[0] = 190b513da3e66fc9a3587b78c76d1d132b1152174d0b83e3c11140 66392579a45824c5fa17649ab89299ddd4bda54935 + I * 12ab625b0fe0ebd1367fe9fac57bb1168891846039b4216b9d9400 7b674de2d79126870e88aeef54b2ec717a887dcf39 u[1] = 0e6a42010cf435fb5bacc156a585e1ea3294cc81d0ceb81924d950 40298380b164f702275892cedd81b62de3aba3f6b5 + I * 117d9a0defc57a33ed208428cb84e54c85a6840e7648480ae42883 8989d25d97a0af8e3255be62b25c2a85630d2dddd8 Q0.x = 17cadf8d04a1a170f8347d42856526a24cc466cb2ddfd506cff011 91666b7f944e31244d662c904de5440516a2b09004 + I * 0d13ba91f2a8b0051cf3279ea0ee63a9f19bc9cb8bfcc7d78b3cbd 8cc4fc43ba726774b28038213acf2b0095391c523e Q0.y = 17ef19497d6d9246fa94d35575c0f8d06ee02f21a284dbeaa78768 cb1e25abd564e3381de87bda26acd04f41181610c5 + I * 12c3c913ba4ed03c24f0721a81a6be7430f2971ffca8fd1729aafe 496bb725807531b44b34b59b3ae5495e5a2dcbd5c8 Q1.x = 16ec57b7fe04c71dfe34fb5ad84dbce5a2dbbd6ee085f1d8cd17f4 5e8868976fc3c51ad9eeda682c7869024d24579bfd + I * 13103f7aace1ae1420d208a537f7d3a9679c287208026e4e3439ab 8cd534c12856284d95e27f5e1f33eec2ce656533b0 Q1.y = 0958b2c4c2c10fcef5a6c59b9e92c4a67b0fae3e2e0f1b6b5edad9 c940b8f3524ba9ebbc3f2ceb3cfe377655b3163bd7 + I * 0ccb594ed8bd14ca64ed9cb4e0aba221be540f25dd0d6ba15a4a4b e5d67bcf35df7853b2d8dad3ba245f1ea3697f66aa ]]></artwork> </section> <sectionanchor="bls12381g2xmdsha-256sswunu" numbered="true" toc="default">anchor="bls12381g2xmdsha-256sswunu"> <name>BLS12381G2_XMD:SHA-256_SSWU_NU_</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ suite = BLS12381G2_XMD:SHA-256_SSWU_NU_ dst = QUUX-V01-CS02-with-BLS12381G2_XMD:SHA-256_SSWU_NU_ msg = P.x = 00e7f4568a82b4b7dc1f14c6aaa055edf51502319c723c4dc2688c 7fe5944c213f510328082396515734b6612c4e7bb7 + I * 126b855e9e69b1f691f816e48ac6977664d24d99f8724868a18418 6469ddfd4617367e94527d4b74fc86413483afb35b P.y = 0caead0fd7b6176c01436833c79d305c78be307da5f6af6c133c47 311def6ff1e0babf57a0fb5539fce7ee12407b0a42 + I * 1498aadcf7ae2b345243e281ae076df6de84455d766ab6fcdaad71 fab60abb2e8b980a440043cd305db09d283c895e3d u[0] = 07355d25caf6e7f2f0cb2812ca0e513bd026ed09dda65b177500fa 31714e09ea0ded3a078b526bed3307f804d4b93b04 + I * 02829ce3c021339ccb5caf3e187f6370e1e2a311dec9b753631170 63ab2015603ff52c3d3b98f19c2f65575e99e8b78c Q.x = 18ed3794ad43c781816c523776188deafba67ab773189b8f18c49b c7aa841cd81525171f7a5203b2a340579192403bef + I * 0727d90785d179e7b5732c8a34b660335fed03b913710b60903cf4 954b651ed3466dc3728e21855ae822d4a0f1d06587 Q.y = 00764a5cf6c5f61c52c838523460eb2168b5a5b43705e19cb612e0 06f29b717897facfd15dd1c8874c915f6d53d0342d + I * 19290bb9797c12c1d275817aa2605ebe42275b66860f0e4d04487e bc2e47c50b36edd86c685a60c20a2bd584a82b011a msg = abc P.x = 108ed59fd9fae381abfd1d6bce2fd2fa220990f0f837fa30e0f279 14ed6e1454db0d1ee957b219f61da6ff8be0d6441f + I * 0296238ea82c6d4adb3c838ee3cb2346049c90b96d602d7bb1b469 b905c9228be25c627bffee872def773d5b2a2eb57d P.y = 033f90f6057aadacae7963b0a0b379dd46750c1c94a6357c99b65f 63b79e321ff50fe3053330911c56b6ceea08fee656 + I * 153606c417e59fb331b7ae6bce4fbf7c5190c33ce9402b5ebe2b70 e44fca614f3f1382a3625ed5493843d0b0a652fc3f u[0] = 138879a9559e24cecee8697b8b4ad32cced053138ab913b9987277 2dc753a2967ed50aabc907937aefb2439ba06cc50c + I * 0a1ae7999ea9bab1dcc9ef8887a6cb6e8f1e22566015428d220b7e ec90ffa70ad1f624018a9ad11e78d588bd3617f9f2 Q.x = 0f40e1d5025ecef0d850aa0bb7bbeceab21a3d4e85e6bee857805b 09693051f5b25428c6be343edba5f14317fcc30143 + I * 02e0d261f2b9fee88b82804ec83db330caa75fbb12719cfa71ccce 1c532dc4e1e79b0a6a281ed8d3817524286c8bc04c Q.y = 0cf4a4adc5c66da0bca4caddc6a57ecd97c8252d7526a8ff478e0d fed816c4d321b5c3039c6683ae9b1e6a3a38c9c0ae + I * 11cad1646bb3768c04be2ab2bbe1f80263b7ff6f8f9488f5bc3b68 50e5a3e97e20acc583613c69cf3d2bfe8489744ebb msg = abcdef0123456789 P.x = 038af300ef34c7759a6caaa4e69363cafeed218a1f207e93b2c70d 91a1263d375d6730bd6b6509dcac3ba5b567e85bf3 + I * 0da75be60fb6aa0e9e3143e40c42796edf15685cafe0279afd2a67 c3dff1c82341f17effd402e4f1af240ea90f4b659b P.y = 19b148cbdf163cf0894f29660d2e7bfb2b68e37d54cc83fd4e6e62 c020eaa48709302ef8e746736c0e19342cc1ce3df4 + I * 0492f4fed741b073e5a82580f7c663f9b79e036b70ab3e51162359 cec4e77c78086fe879b65ca7a47d34374c8315ac5e u[0] = 18c16fe362b7dbdfa102e42bdfd3e2f4e6191d479437a59db4eb71 6986bf08ee1f42634db66bde97d6c16bbfd342b3b8 + I * 0e37812ce1b146d998d5f92bdd5ada2a31bfd63dfe18311aa91637 b5f279dd045763166aa1615e46a50d8d8f475f184e Q.x = 13a9d4a738a85c9f917c7be36b240915434b58679980010499b9ae 8d7a1bf7fbe617a15b3cd6060093f40d18e0f19456 + I * 16fa88754e7670366a859d6f6899ad765bf5a177abedb2740aacc9 252c43f90cd0421373fbd5b2b76bb8f5c4886b5d37 Q.y = 0a7fa7d82c46797039398253e8765a4194100b330dfed6d7fbb46d 6fbf01e222088779ac336e3675c7a7a0ee05bbb6e3 + I * 0c6ee170ab766d11fa9457cef53253f2628010b2cffc102b3b2835 1eb9df6c281d3cfc78e9934769d661b72a5265338d msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq P.x = 0c5ae723be00e6c3f0efe184fdc0702b64588fe77dda152ab13099 a3bacd3876767fa7bbad6d6fd90b3642e902b208f9 + I * 12c8c05c1d5fc7bfa847f4d7d81e294e66b9a78bc9953990c35894 5e1f042eedafce608b67fdd3ab0cb2e6e263b9b1ad P.y = 04e77ddb3ede41b5ec4396b7421dd916efc68a358a0d7425bddd25 3547f2fb4830522358491827265dfc5bcc1928a569 + I * 11c624c56dbe154d759d021eec60fab3d8b852395a89de497e4850 4366feedd4662d023af447d66926a28076813dd646 u[0] = 08d4a0997b9d52fecf99427abb721f0fa779479963315fe21c6445 250de7183e3f63bfdf86570da8929489e421d4ee95 + I * 16cb4ccad91ec95aab070f22043916cd6a59c4ca94097f7f510043 d48515526dc8eaaea27e586f09151ae613688d5a89 Q.x = 0a08b2f639855dfdeaaed972702b109e2241a54de198b2b4cd12ad 9f88fa419a6086a58d91fc805de812ea29bee427c2 + I * 04a7442e4cb8b42ef0f41dac9ee74e65ecad3ce0851f0746dc4756 8b0e7a8134121ed09ba054509232c49148aef62cda Q.y = 05d60b1f04212b2c87607458f71d770f43973511c260f0540eef3a 565f42c7ce59aa1cea684bb2a7bcab84acd2f36c8c + I * 1017aa5747ba15505ece266a86b0ca9c712f41a254b76ca04094ca 442ce45ecd224bd5544cd16685d0d1b9d156dd0531 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa P.x = 0ea4e7c33d43e17cc516a72f76437c4bf81d8f4eac69ac355d3bf9 b71b8138d55dc10fd458be115afa798b55dac34be1 + I * 1565c2f625032d232f13121d3cfb476f45275c303a037faa255f9d a62000c2c864ea881e2bcddd111edc4a3c0da3e88d P.y = 043b6f5fe4e52c839148dc66f2b3751e69a0f6ebb3d056d6465d50 d4108543ecd956e10fa1640dfd9bc0030cc2558d28 + I * 0f8991d2a1ad662e7b6f58ab787947f1fa607fce12dde171bc1790 3b012091b657e15333e11701edcf5b63ba2a561247 u[0] = 03f80ce4ff0ca2f576d797a3660e3f65b274285c054feccc3215c8 79e2c0589d376e83ede13f93c32f05da0f68fd6a10 + I * 006488a837c5413746d868d1efb7232724da10eca410b07d8b505b 9363bdccf0a1fc0029bad07d65b15ccfe6dd25e20d Q.x = 19592c812d5a50c5601062faba14c7d670711745311c879de1235a 0a11c75aab61327bf2d1725db07ec4d6996a682886 + I * 0eef4fa41ddc17ed47baf447a2c498548f3c72a02381313d13bef9 16e240b61ce125539090d62d9fbb14a900bf1b8e90 Q.y = 1260d6e0987eae96af9ebe551e08de22b37791d53f4db9e0d59da7 36e66699735793e853e26362531fe4adf99c1883e3 + I * 0dbace5df0a4ac4ac2f45d8fdf8aee45484576fdd6efc4f98ab9b9 f4112309e628255e183022d98ea5ed6e47ca00306c ]]></artwork> </section> </section> </section> <sectionanchor="expand-testvectors" numbered="true" toc="default">anchor="expand-testvectors"> <name>Expandtest vectors</name>Test Vectors</name> <t>This section gives test vectors for expand_message variants specified in <xreftarget="hashtofield-expand" format="default"/>.target="hashtofield-expand"/>. The test vectors in this section were generated using code that is available from <xreftarget="hash2curve-repo" format="default"/>.</t>target="hash2curve-repo"/>.</t> <t>Each test vector in this section lists the expand_message name, hash function, and DST, along with a series of tuples of the function inputs (msg and len_in_bytes), output (uniform_bytes), and intermediate values (dst_prime and msg_prime). DST and msg are represented as ASCII strings. Intermediate and output values are represented as byte strings in hexadecimal.</t> <sectionanchor="expandmessagexmdsha-256" numbered="true" toc="default">anchor="expandmessagexmdsha-256"> <name>expand_message_xmd(SHA-256)</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ name = expand_message_xmd DST = QUUX-V01-CS02-with-expander-SHA256-128 hash = SHA256 k = 128 msg = len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000002000515555582d5630312d43533032 2d776974682d657870616e6465722d5348413235362d31323826 uniform_bytes = 68a985b87eb6b46952128911f2a4412bbc302a9d759667f8 7f7a21d803f07235 msg = abc len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000616263002000515555582d5630312d43 5330322d776974682d657870616e6465722d5348413235362d3132 3826 uniform_bytes = d8ccab23b5985ccea865c6c97b6e5b8350e794e603b4b979 02f53a8a0d605615 msg = abcdef0123456789 len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000061626364656630313233343536373839 002000515555582d5630312d435330322d776974682d657870616e 6465722d5348413235362d31323826 uniform_bytes = eff31487c770a893cfb36f912fbfcbff40d5661771ca4b2c b4eafe524333f5c1 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000713132385f7171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171002000515555582d5630312d435330322d77 6974682d657870616e6465722d5348413235362d31323826 uniform_bytes = b23a1d2b4d97b2ef7785562a7e8bac7eed54ed6e97e29aa5 1bfe3f12ddad1ff9 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000613531325f6161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161002000515555582d5630312d 435330322d776974682d657870616e6465722d5348413235362d31 323826 uniform_bytes = 4623227bcc01293b8c130bf771da8c298dede7383243dc09 93d2d94823958c4c msg = len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000008000515555582d5630312d43533032 2d776974682d657870616e6465722d5348413235362d31323826 uniform_bytes = af84c27ccfd45d41914fdff5df25293e221afc53d8ad2ac0 6d5e3e29485dadbee0d121587713a3e0dd4d5e69e93eb7cd4f5df4 cd103e188cf60cb02edc3edf18eda8576c412b18ffb658e3dd6ec8 49469b979d444cf7b26911a08e63cf31f9dcc541708d3491184472 c2c29bb749d4286b004ceb5ee6b9a7fa5b646c993f0ced msg = abc len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000616263008000515555582d5630312d43 5330322d776974682d657870616e6465722d5348413235362d3132 3826 uniform_bytes = abba86a6129e366fc877aab32fc4ffc70120d8996c88aee2 fe4b32d6c7b6437a647e6c3163d40b76a73cf6a5674ef1d890f95b 664ee0afa5359a5c4e07985635bbecbac65d747d3d2da7ec2b8221 b17b0ca9dc8a1ac1c07ea6a1e60583e2cb00058e77b7b72a298425 cd1b941ad4ec65e8afc50303a22c0f99b0509b4c895f40 msg = abcdef0123456789 len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000061626364656630313233343536373839 008000515555582d5630312d435330322d776974682d657870616e 6465722d5348413235362d31323826 uniform_bytes = ef904a29bffc4cf9ee82832451c946ac3c8f8058ae97d8d6 29831a74c6572bd9ebd0df635cd1f208e2038e760c4994984ce73f 0d55ea9f22af83ba4734569d4bc95e18350f740c07eef653cbb9f8 7910d833751825f0ebefa1abe5420bb52be14cf489b37fe1a72f7d e2d10be453b2c9d9eb20c7e3f6edc5a60629178d9478df msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000713132385f7171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171008000515555582d5630312d435330322d77 6974682d657870616e6465722d5348413235362d31323826 uniform_bytes = 80be107d0884f0d881bb460322f0443d38bd222db8bd0b0a 5312a6fedb49c1bbd88fd75d8b9a09486c60123dfa1d73c1cc3169 761b17476d3c6b7cbbd727acd0e2c942f4dd96ae3da5de368d26b3 2286e32de7e5a8cb2949f866a0b80c58116b29fa7fabb3ea7d520e e603e0c25bcaf0b9a5e92ec6a1fe4e0391d1cdbce8c68a msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413235362d31323826 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000613531325f6161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161008000515555582d5630312d 435330322d776974682d657870616e6465722d5348413235362d31 323826 uniform_bytes = 546aff5444b5b79aa6148bd81728704c32decb73a3ba76e9 e75885cad9def1d06d6792f8a7d12794e90efed817d96920d72889 6a4510864370c207f99bd4a608ea121700ef01ed879745ee3e4cee f777eda6d9e5e38b90c86ea6fb0b36504ba4a45d22e86f6db5dd43 d98a294bebb9125d5b794e9d2a81181066eb954966a487 ]]></artwork> </section> <sectionanchor="expandmessagexmdsha-256-long-dst" numbered="true" toc="default">anchor="expandmessagexmdsha-256-long-dst"> <name>expand_message_xmd(SHA-256)(long(Long DST)</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ name = expand_message_xmd DST = QUUX-V01-CS02-with-expander-SHA256-128-long-DST-111111 111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111111111111 1111111111111111111111111111111111111111 hash = SHA256 k = 128 msg = len_in_bytes = 0x20 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000002000412717974da474d0f8c420f320 ff81e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = e8dc0c8b686b7ef2074086fbdd2f30e3f8bfbd3bdf177f73 f04b97ce618a3ed3 msg = abc len_in_bytes = 0x20 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000616263002000412717974da474d0f8c4 20f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = 52dbf4f36cf560fca57dedec2ad924ee9c266341d8f3d6af e5171733b16bbb12 msg = abcdef0123456789 len_in_bytes = 0x20 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000061626364656630313233343536373839 002000412717974da474d0f8c420f320ff81e8432adb7c927d9bd0 82b4fb4d16c0a23620 uniform_bytes = 35387dcf22618f3728e6c686490f8b431f76550b0b2c61cb c1ce7001536f4521 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x20 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000713132385f7171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171002000412717974da474d0f8c420f320ff81 e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = 01b637612bb18e840028be900a833a74414140dde0c4754c 198532c3a0ba42bc msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x20 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000613531325f6161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161002000412717974da474d0f8 c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = 20cce7033cabc5460743180be6fa8aac5a103f56d481cf36 9a8accc0c374431b msg = len_in_bytes = 0x80 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000008000412717974da474d0f8c420f320 ff81e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = 14604d85432c68b757e485c8894db3117992fc57e0e136f7 1ad987f789a0abc287c47876978e2388a02af86b1e8d1342e5ce4f 7aaa07a87321e691f6fba7e0072eecc1218aebb89fb14a0662322d 5edbd873f0eb35260145cd4e64f748c5dfe60567e126604bcab1a3 ee2dc0778102ae8a5cfd1429ebc0fa6bf1a53c36f55dfc msg = abc len_in_bytes = 0x80 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000616263008000412717974da474d0f8c4 20f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = 1a30a5e36fbdb87077552b9d18b9f0aee16e80181d5b951d 0471d55b66684914aef87dbb3626eaabf5ded8cd0686567e503853 e5c84c259ba0efc37f71c839da2129fe81afdaec7fbdc0ccd4c794 727a17c0d20ff0ea55e1389d6982d1241cb8d165762dbc39fb0cee 4474d2cbbd468a835ae5b2f20e4f959f56ab24cd6fe267 msg = abcdef0123456789 len_in_bytes = 0x80 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000061626364656630313233343536373839 008000412717974da474d0f8c420f320ff81e8432adb7c927d9bd0 82b4fb4d16c0a23620 uniform_bytes = d2ecef3635d2397f34a9f86438d772db19ffe9924e28a1ca f6f1c8f15603d4028f40891044e5c7e39ebb9b31339979ff33a424 9206f67d4a1e7c765410bcd249ad78d407e303675918f20f26ce6d 7027ed3774512ef5b00d816e51bfcc96c3539601fa48ef1c07e494 bdc37054ba96ecb9dbd666417e3de289d4f424f502a982 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x80 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000713132385f7171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171008000412717974da474d0f8c420f320ff81 e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = ed6e8c036df90111410431431a232d41a32c86e296c05d42 6e5f44e75b9a50d335b2412bc6c91e0a6dc131de09c43110d9180d 0a70f0d6289cb4e43b05f7ee5e9b3f42a1fad0f31bac6a625b3b5c 50e3a83316783b649e5ecc9d3b1d9471cb5024b7ccf40d41d1751a 04ca0356548bc6e703fca02ab521b505e8e45600508d32 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x80 DST_prime = 412717974da474d0f8c420f320ff81e8432adb7c927d9bd082b4 fb4d16c0a23620 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 0000000000000000000000613531325f6161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161008000412717974da474d0f8 c420f320ff81e8432adb7c927d9bd082b4fb4d16c0a23620 uniform_bytes = 78b53f2413f3c688f07732c10e5ced29a17c6a16f717179f fbe38d92d6c9ec296502eb9889af83a1928cd162e845b0d3c5424e 83280fed3d10cffb2f8431f14e7a23f4c68819d40617589e4c4116 9d0b56e0e3535be1fd71fbb08bb70c5b5ffed953d6c14bf7618b35 fc1f4c4b30538236b4b08c9fbf90462447a8ada60be495 ]]></artwork> </section> <sectionanchor="expandmessagexmdsha-512" numbered="true" toc="default">anchor="expandmessagexmdsha-512"> <name>expand_message_xmd(SHA-512)</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ name = expand_message_xmd DST = QUUX-V01-CS02-with-expander-SHA512-256 hash = SHA512 k = 256 msg = len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000002000515555 582d5630312d435330322d776974682d657870616e6465722d5348 413531322d32353626 uniform_bytes = 6b9a7312411d92f921c6f68ca0b6380730a1a4d982c50721 1a90964c394179ba msg = abc len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000616263002000 515555582d5630312d435330322d776974682d657870616e646572 2d5348413531322d32353626 uniform_bytes = 0da749f12fbe5483eb066a5f595055679b976e93abe9be6f 0f6318bce7aca8dc msg = abcdef0123456789 len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000616263646566 30313233343536373839002000515555582d5630312d435330322d 776974682d657870616e6465722d5348413531322d32353626 uniform_bytes = 087e45a86e2939ee8b91100af1583c4938e0f5fc6c9db4b1 07b83346bc967f58 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000713132385f71 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 71717171717171717171717171717171717171002000515555582d 5630312d435330322d776974682d657870616e6465722d53484135 31322d32353626 uniform_bytes = 7336234ee9983902440f6bc35b348352013becd88938d2af ec44311caf8356b3 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000613531325f61 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161610020 00515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 uniform_bytes = 57b5f7e766d5be68a6bfe1768e3c2b7f1228b3e4b3134956 dd73a59b954c66f4 msg = len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000008000515555 582d5630312d435330322d776974682d657870616e6465722d5348 413531322d32353626 uniform_bytes = 41b037d1734a5f8df225dd8c7de38f851efdb45c372887be 655212d07251b921b052b62eaed99b46f72f2ef4cc96bfaf254ebb bec091e1a3b9e4fb5e5b619d2e0c5414800a1d882b62bb5cd1778f 098b8eb6cb399d5d9d18f5d5842cf5d13d7eb00a7cff859b605da6 78b318bd0e65ebff70bec88c753b159a805d2c89c55961 msg = abc len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000616263008000 515555582d5630312d435330322d776974682d657870616e646572 2d5348413531322d32353626 uniform_bytes = 7f1dddd13c08b543f2e2037b14cefb255b44c83cc397c178 6d975653e36a6b11bdd7732d8b38adb4a0edc26a0cef4bb4521713 5456e58fbca1703cd6032cb1347ee720b87972d63fbf232587043e d2901bce7f22610c0419751c065922b488431851041310ad659e4b 23520e1772ab29dcdeb2002222a363f0c2b1c972b3efe1 msg = abcdef0123456789 len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000616263646566 30313233343536373839008000515555582d5630312d435330322d 776974682d657870616e6465722d5348413531322d32353626 uniform_bytes = 3f721f208e6199fe903545abc26c837ce59ac6fa45733f1b aaf0222f8b7acb0424814fcb5eecf6c1d38f06e9d0a6ccfbf85ae6 12ab8735dfdf9ce84c372a77c8f9e1c1e952c3a61b7567dd069301 6af51d2745822663d0c2367e3f4f0bed827feecc2aaf98c949b5ed 0d35c3f1023d64ad1407924288d366ea159f46287e61ac msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000713132385f71 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 71717171717171717171717171717171717171008000515555582d 5630312d435330322d776974682d657870616e6465722d53484135 31322d32353626 uniform_bytes = b799b045a58c8d2b4334cf54b78260b45eec544f9f2fb5bd 12fb603eaee70db7317bf807c406e26373922b7b8920fa29142703 dd52bdf280084fb7ef69da78afdf80b3586395b433dc66cde048a2 58e476a561e9deba7060af40adf30c64249ca7ddea79806ee5beb9 a1422949471d267b21bc88e688e4014087a0b592b695ed msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 msg_prime = 0000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000613531325f61 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161610080 00515555582d5630312d435330322d776974682d657870616e6465 722d5348413531322d32353626 uniform_bytes = 05b0bfef265dcee87654372777b7c44177e2ae4c13a27f10 3340d9cd11c86cb2426ffcad5bd964080c2aee97f03be1ca18e30a 1f14e27bc11ebbd650f305269cc9fb1db08bf90bfc79b42a952b46 daf810359e7bc36452684784a64952c343c52e5124cd1f71d474d5 197fefc571a92929c9084ffe1112cf5eea5192ebff330b ]]></artwork> </section> <sectionanchor="expandmessagexofshake128" numbered="true" toc="default">anchor="expandmessagexofshake128"> <name>expand_message_xof(SHAKE128)</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ name = expand_message_xof DST = QUUX-V01-CS02-with-expander-SHAKE128 hash = SHAKE128 k = 128 msg = len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 0020515555582d5630312d435330322d776974682d657870616e 6465722d5348414b4531323824 uniform_bytes = 86518c9cd86581486e9485aa74ab35ba150d1c75c88e26b7 043e44e2acd735a2 msg = abc len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 6162630020515555582d5630312d435330322d776974682d6578 70616e6465722d5348414b4531323824 uniform_bytes = 8696af52a4d862417c0763556073f47bc9b9ba43c99b5053 05cb1ec04a9ab468 msg = abcdef0123456789 len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 616263646566303132333435363738390020515555582d563031 2d435330322d776974682d657870616e6465722d5348414b453132 3824 uniform_bytes = 912c58deac4821c3509dbefa094df54b34b8f5d01a191d1d 3108a2c89077acca msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 713132385f717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717100 20515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 uniform_bytes = 1adbcc448aef2a0cebc71dac9f756b22e51839d348e031e6 3b33ebb50faeaf3f msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 613531325f616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 61616161610020515555582d5630312d435330322d776974682d65 7870616e6465722d5348414b4531323824 uniform_bytes = df3447cc5f3e9a77da10f819218ddf31342c310778e0e4ef 72bbaecee786a4fe msg = len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 0080515555582d5630312d435330322d776974682d657870616e 6465722d5348414b4531323824 uniform_bytes = 7314ff1a155a2fb99a0171dc71b89ab6e3b2b7d59e38e644 19b8b6294d03ffee42491f11370261f436220ef787f8f76f5b26bd cd850071920ce023f3ac46847744f4612b8714db8f5db83205b2e6 25d95afd7d7b4d3094d3bdde815f52850bb41ead9822e08f22cf41 d615a303b0d9dde73263c049a7b9898208003a739a2e57 msg = abc len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 6162630080515555582d5630312d435330322d776974682d6578 70616e6465722d5348414b4531323824 uniform_bytes = c952f0c8e529ca8824acc6a4cab0e782fc3648c563ddb00d a7399f2ae35654f4860ec671db2356ba7baa55a34a9d7f79197b60 ddae6e64768a37d699a78323496db3878c8d64d909d0f8a7de4927 dcab0d3dbbc26cb20a49eceb0530b431cdf47bc8c0fa3e0d88f53b 318b6739fbed7d7634974f1b5c386d6230c76260d5337a msg = abcdef0123456789 len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 616263646566303132333435363738390080515555582d563031 2d435330322d776974682d657870616e6465722d5348414b453132 3824 uniform_bytes = 19b65ee7afec6ac06a144f2d6134f08eeec185f1a890fe34 e68f0e377b7d0312883c048d9b8a1d6ecc3b541cb4987c26f45e0c 82691ea299b5e6889bbfe589153016d8131717ba26f07c3c14ffbe f1f3eff9752e5b6183f43871a78219a75e7000fbac6a7072e2b83c 790a3a5aecd9d14be79f9fd4fb180960a3772e08680495 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 713132385f717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717100 80515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 uniform_bytes = ca1b56861482b16eae0f4a26212112362fcc2d76dcc80c93 c4182ed66c5113fe41733ed68be2942a3487394317f3379856f482 2a611735e50528a60e7ade8ec8c71670fec6661e2c59a09ed36386 513221688b35dc47e3c3111ee8c67ff49579089d661caa29db1ef1 0eb6eace575bf3dc9806e7c4016bd50f3c0e2a6481ee6d msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4531323824 msg_prime = 613531325f616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 61616161610080515555582d5630312d435330322d776974682d65 7870616e6465722d5348414b4531323824 uniform_bytes = 9d763a5ce58f65c91531b4100c7266d479a5d9777ba76169 3d052acd37d149e7ac91c796a10b919cd74a591a1e38719fb91b72 03e2af31eac3bff7ead2c195af7d88b8bc0a8adf3d1e90ab9bed6d dc2b7f655dd86c730bdeaea884e73741097142c92f0e3fc1811b69 9ba593c7fbd81da288a29d423df831652e3a01a9374999 ]]></artwork> </section> <sectionanchor="expandmessagexofshake128-long-dst" numbered="true" toc="default">anchor="expandmessagexofshake128-long-dst"> <name>expand_message_xof(SHAKE128)(long(Long DST)</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ name = expand_message_xof DST = QUUX-V01-CS02-with-expander-SHAKE128-long-DST-11111111 111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111111111111 111111111111111111111111111111111111111111111111111111 1111111111111111111111111111111111111111 hash = SHAKE128 k = 128 msg = len_in_bytes = 0x20 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 0020acb9736c0867fdfbd6385519b90fc8c034b5af04a9589732 12950132d035792f20 uniform_bytes = 827c6216330a122352312bccc0c8d6e7a146c5257a776dbd 9ad9d75cd880fc53 msg = abc len_in_bytes = 0x20 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 6162630020acb9736c0867fdfbd6385519b90fc8c034b5af04a9 58973212950132d035792f20 uniform_bytes = 690c8d82c7213b4282c6cb41c00e31ea1d3e2005f93ad19b bf6da40f15790c5c msg = abcdef0123456789 len_in_bytes = 0x20 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 616263646566303132333435363738390020acb9736c0867fdfb d6385519b90fc8c034b5af04a958973212950132d035792f20 uniform_bytes = 979e3a15064afbbcf99f62cc09fa9c85028afcf3f825eb07 11894dcfc2f57057 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x20 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 713132385f717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717100 20acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 uniform_bytes = c5a9220962d9edc212c063f4f65b609755a1ed96e62f9db5 d1fd6adb5a8dc52b msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x20 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 613531325f616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 61616161610020acb9736c0867fdfbd6385519b90fc8c034b5af04 a958973212950132d035792f20 uniform_bytes = f7b96a5901af5d78ce1d071d9c383cac66a1dfadb508300e c6aeaea0d62d5d62 msg = len_in_bytes = 0x80 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 0080acb9736c0867fdfbd6385519b90fc8c034b5af04a9589732 12950132d035792f20 uniform_bytes = 3890dbab00a2830be398524b71c2713bbef5f4884ac2e6f0 70b092effdb19208c7df943dc5dcbaee3094a78c267ef276632ee2 c8ea0c05363c94b6348500fae4208345dd3475fe0c834c2beac7fa 7bc181692fb728c0a53d809fc8111495222ce0f38468b11becb15b 32060218e285c57a60162c2c8bb5b6bded13973cd41819 msg = abc len_in_bytes = 0x80 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 6162630080acb9736c0867fdfbd6385519b90fc8c034b5af04a9 58973212950132d035792f20 uniform_bytes = 41b7ffa7a301b5c1441495ebb9774e2a53dbbf4e54b9a1af 6a20fd41eafd69ef7b9418599c5545b1ee422f363642b01d4a5344 9313f68da3e49dddb9cd25b97465170537d45dcbdf92391b5bdff3 44db4bd06311a05bca7dcd360b6caec849c299133e5c9194f4e15e 3e23cfaab4003fab776f6ac0bfae9144c6e2e1c62e7d57 msg = abcdef0123456789 len_in_bytes = 0x80 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 616263646566303132333435363738390080acb9736c0867fdfb d6385519b90fc8c034b5af04a958973212950132d035792f20 uniform_bytes = 55317e4a21318472cd2290c3082957e1242241d9e0d04f47 026f03401643131401071f01aa03038b2783e795bdfa8a3541c194 ad5de7cb9c225133e24af6c86e748deb52e560569bd54ef4dac034 65111a3a44b0ea490fb36777ff8ea9f1a8a3e8e0de3cf0880b4b2f 8dd37d3a85a8b82375aee4fa0e909f9763319b55778e71 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x80 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 713132385f717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717100 80acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 uniform_bytes = 19fdd2639f082e31c77717ac9bb032a22ff0958382b2dbb3 9020cdc78f0da43305414806abf9a561cb2d0067eb2f7bc544482f 75623438ed4b4e39dd9e6e2909dd858bd8f1d57cd0fce2d3150d90 aa67b4498bdf2df98c0100dd1a173436ba5d0df6be1defb0b2ce55 ccd2f4fc05eb7cb2c019c35d5398b85adc676da4238bc7 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x80 DST_prime = acb9736c0867fdfbd6385519b90fc8c034b5af04a95897321295 0132d035792f20 msg_prime = 613531325f616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 61616161610080acb9736c0867fdfbd6385519b90fc8c034b5af04 a958973212950132d035792f20 uniform_bytes = 945373f0b3431a103333ba6a0a34f1efab2702efde41754c 4cb1d5216d5b0a92a67458d968562bde7fa6310a83f53dda138368 0a276a283438d58ceebfa7ab7ba72499d4a3eddc860595f63c93b1 c5e823ea41fc490d938398a26db28f61857698553e93f0574eb8c5 017bfed6249491f9976aaa8d23d9485339cc85ca329308 ]]></artwork> </section> <sectionanchor="expandmessagexofshake256" numbered="true" toc="default">anchor="expandmessagexofshake256"> <name>expand_message_xof(SHAKE256)</name><artwork name="" type="" align="left" alt=""><![CDATA[<artwork><![CDATA[ name = expand_message_xof DST = QUUX-V01-CS02-with-expander-SHAKE256 hash = SHAKE256 k = 256 msg = len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 0020515555582d5630312d435330322d776974682d657870616e 6465722d5348414b4532353624 uniform_bytes = 2ffc05c48ed32b95d72e807f6eab9f7530dd1c2f013914c8 fed38c5ccc15ad76 msg = abc len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 6162630020515555582d5630312d435330322d776974682d6578 70616e6465722d5348414b4532353624 uniform_bytes = b39e493867e2767216792abce1f2676c197c0692aed06156 0ead251821808e07 msg = abcdef0123456789 len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 616263646566303132333435363738390020515555582d563031 2d435330322d776974682d657870616e6465722d5348414b453235 3624 uniform_bytes = 245389cf44a13f0e70af8665fe5337ec2dcd138890bb7901 c4ad9cfceb054b65 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 713132385f717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717100 20515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 uniform_bytes = 719b3911821e6428a5ed9b8e600f2866bcf23c8f0515e52d 6c6c019a03f16f0e msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x20 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 613531325f616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 61616161610020515555582d5630312d435330322d776974682d65 7870616e6465722d5348414b4532353624 uniform_bytes = 9181ead5220b1963f1b5951f35547a5ea86a820562287d6c a4723633d17ccbbc msg = len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 0080515555582d5630312d435330322d776974682d657870616e 6465722d5348414b4532353624 uniform_bytes = 7a1361d2d7d82d79e035b8880c5a3c86c5afa719478c007d 96e6c88737a3f631dd74a2c88df79a4cb5e5d9f7504957c70d669e c6bfedc31e01e2bacc4ff3fdf9b6a00b17cc18d9d72ace7d6b81c2 e481b4f73f34f9a7505dccbe8f5485f3d20c5409b0310093d5d649 2dea4e18aa6979c23c8ea5de01582e9689612afbb353df msg = abc len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 6162630080515555582d5630312d435330322d776974682d6578 70616e6465722d5348414b4532353624 uniform_bytes = a54303e6b172909783353ab05ef08dd435a558c3197db0c1 32134649708e0b9b4e34fb99b92a9e9e28fc1f1d8860d85897a8e0 21e6382f3eea10577f968ff6df6c45fe624ce65ca25932f679a42a 404bc3681efe03fcd45ef73bb3a8f79ba784f80f55ea8a3c367408 f30381299617f50c8cf8fbb21d0f1e1d70b0131a7b6fbe msg = abcdef0123456789 len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 616263646566303132333435363738390080515555582d563031 2d435330322d776974682d657870616e6465722d5348414b453235 3624 uniform_bytes = e42e4d9538a189316e3154b821c1bafb390f78b2f010ea40 4e6ac063deb8c0852fcd412e098e231e43427bd2be1330bb47b403 9ad57b30ae1fc94e34993b162ff4d695e42d59d9777ea18d3848d9 d336c25d2acb93adcad009bcfb9cde12286df267ada283063de0bb 1505565b2eb6c90e31c48798ecdc71a71756a9110ff373 msg = q128_qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq qqqqqqqqqqqqqqqqqqqqqqqqq len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 713132385f717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717171 717171717171717171717171717171717171717171717171717100 80515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 uniform_bytes = 4ac054dda0a38a65d0ecf7afd3c2812300027c8789655e47 aecf1ecc1a2426b17444c7482c99e5907afd9c25b991990490bb9c 686f43e79b4471a23a703d4b02f23c669737a886a7ec28bddb92c3 a98de63ebf878aa363a501a60055c048bea11840c4717beae7eee2 8c3cfa42857b3d130188571943a7bd747de831bd6444e0 msg = a512_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa len_in_bytes = 0x80 DST_prime = 515555582d5630312d435330322d776974682d657870616e6465 722d5348414b4532353624 msg_prime = 613531325f616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 616161616161616161616161616161616161616161616161616161 61616161610080515555582d5630312d435330322d776974682d65 7870616e6465722d5348414b4532353624 uniform_bytes = 09afc76d51c2cccbc129c2315df66c2be7295a231203b8ab 2dd7f95c2772c68e500bc72e20c602abc9964663b7a03a389be128 c56971ce81001a0b875e7fd17822db9d69792ddf6a23a151bf4700 79c518279aef3e75611f8f828994a9988f4a8a256ddb8bae161e65 8d5a2a09bcfe839c6396dc06ee5c8ff3c22d3b1f9deb7e ]]></artwork> </section> </section> <section anchor="acknowledgements" numbered="false"> <name>Acknowledgements</name> <t>The authors would like to thank <contact fullname="Adam Langley"/> for his detailed writeup of Elligator 2 with Curve25519 <xref target="L13"/>; <contact fullname="Dan Boneh"/>, <contact fullname="Benjamin Lipp"/>, <contact fullname="Christopher Patton"/>, and <contact fullname="Leonid Reyzin"/> for educational discussions; and <contact fullname="David Benjamin"/>, <contact fullname="Daniel Bourdrez"/>, <contact fullname="Frank Denis"/>, <contact fullname="Sean Devlin"/>, <contact fullname="Justin Drake"/>, <contact fullname="Bjoern Haase"/>, <contact fullname="Mike Hamburg"/>, <contact fullname="Dan Harkins"/>, <contact fullname="Daira Hopwood"/>, <contact fullname="Thomas Icart"/>, <contact fullname="Andy Polyakov"/>, <contact fullname="Thomas Pornin"/>, <contact fullname="Mamy Ratsimbazafy"/>, <contact fullname="Michael Scott"/>, <contact fullname="Filippo Valsorda"/>, and <contact fullname="Mathy Vanhoef"/> for helpful reviews and feedback.</t> </section> <section anchor="contributors" numbered="false"> <name>Contributors</name> <contact fullname="Sharon Goldberg"> <organization>Boston University</organization> <address> <email>goldbe@cs.bu.edu</email> </address> </contact> <contact fullname="Ela Lee"> <organization>Royal Holloway, University of London</organization> <address> <email>Ela.Lee.2010@live.rhul.ac.uk</email> </address> </contact> <contact fullname="Michele Orru"> <address> <email>michele.orru@ens.fr)</email> </address> </contact> </section> </back><!-- ##markdown-source: H4sIALnTqWIAA9y96XbbSJIw+h9PgU8+Z0qqJmgu2muqv6E2W7ZkqUW53O3x lA5IghRKJMACQEm0quZZ7rPcJ7ux5A6QomrpnrmenhJJJHKJjIw9IoMg8Iq4 GEf7/tswv42TkV+k/vF4HE+LuO8fzrL7KPfCXi+L7vf9W2gSFGnQx5+9QdpP wgm8OcjCYRHEWTEM+sNsFFjNgua2NwiLaN/rw39HaTbf9+NkmHoPaXY3ytLZ dN8/PLl643nxNNv3i2yWF61GY6/R8u6iOTQa7PunSRFlSVQERziS5+VFmAxu wnGawOhzmOA03vf/s0j7NT9PsyKLhjl8mk/ww395XjgrbtNs3/MDz4d/cZLv +526fxJ+Dd5Cv9BX9JWe8HI62QR+Siuep9kIJjtOZ4PhOMyiGkysX6cnOQwa Fft+s9H0r9OHJI+Sgd8t6Fk/LmDN3TDxT7Iw6cd5P+Xf01lSIDg+JnERYXMA UO6nQ78zibK4H1KraBLG430/zCbD8Ovtf/TV6PV+OrGW1K373X5aFMZSuuHE +I2nnwIkx2P/OurfWlNv+Z+ivPDP0nTqXw2MmX+IHvx/wGbV1CdYZmNz8+WL yMNJPcfp/EefZ1GPBjNrDR9gDTPAvvswMZbxIe7f2b//C3cigcks24arOu7E p/C2NzeWcBWHA/t3WgKMBGchG+DI91GWwwTNsbL84T/6eT0XrUrgOqwjIn9K 04Ex1OFtFudFOr2NMuvpvxBm/fDhP26jcAr0pRcXeR3OsuclKRy0ApYNJ9M/ Pj3a3Gk39umtIsxGOJ/bopjm+69fPzw81LNhP4gGcZFmdVjI6yjLwiJ8HcUD fI3fYjq2dnVy6O/sbO7W/GNq5J8e+dhojVoRLfLfzcbzmt9qAHHCHxWFoH+B +KtJxVmYjMbRXP0uCMUAjpd85CFRMxZ0cNZttoL2brN6SdE46hcApn4aJ4BC r3vjdPQ6iR6CPAmzOyadr61l6Q7pHH69C7ofOlfvHWIN5zuB7Zz1izhNzBWf hxkteOf5BQOaHqQPkbPabgQ4YP1OCHUsFgIDxwn8ZzINEwTUwdVee9/eF6Sq E3gr7I8BUwAF/Sl8hqmHSOD8aZiFg3g08QGO/iDK41GC/CgaDuN+HCUFtE6B xqfjnNeVA5pBKwC7XMfaabK2719maT8CVElGhI7FbeQ39/bafufwHKEzjLIo 6Ud+yrOdAWvxYWb4ZTKDwx0i5HJYLuyBPI7Q9TQcRTn0vt0Kdtrix6OLUzw0 9WZzc+t1c3t3a3e3jn/2tiv3fJDGhLuL3+CtOoqAkeGUn9+qc9gqoKMAS2e3 zuPbOCs9ox37eEjH+SgGblzd62Xdv0pH4UPoYvzlbYzYVnoq+z0K7+Mcfu0e HzbtzYdf/OZ+CVmz+bRIR1k4vZ2vlWAmTn4e9UcEN/jQDO5b9elgaCE2neTG 3lJoKWo7CLNBTih2rBDLnIb/BmUSfx0m/GaDl9IqL6UFFD0Cyj8BSgnEz1nW UQpkL/EvAaEnEeBXvtLaWuW1vQsTOrSNP2dtJ6eX3eZuI9h0FoioH5FAqLqF l952N8rrQLxO7sfTWQ+oOrCd+ii9f40f8JfXOMDrD6fd6zp+qtNYzhI7sxEt cev5JX6goxmOgXHlMFc4uXi+9cLxFKNYk6RATOf+Og6sl7ntLhN/9i9nvbE4 8z63gYMxigsYpQsEKCwQEnKI37387dLygRHR8pef9d+9/FbDReK3naCtXoaT HWWTWUEjBAdhDjhN2499Hj8WgOVhbxwFFzNYWOGfzBLiLxV4/SKAwKz++dhw cHT5Q2PXgsZFQlziNBnEQ2IPRRz24jFQf8lAutM0GdnMdQEPklyoMwBZtQ98 DrkinUGaRuAff7y6OLz6x+U1Eq1d/ZZkMM3dZtDc21EPFJNpNHZe7+3sBu1g a7MR7Ozube8E7Ztm81les/RFhruaylJu8wa5TVakSVxzGMObWQwak3joEKbr 87ifpSzwwNN+Xt35uzqwjwgIqtP1uxSZlf3kRR0Dj7yMiAyXeGT/NozGpaeM Xn+/BBlgEvfTZAAbnmYLegeY/AAT7OR5/9Zlwm+AWwIGVDxfvIDDo/PLxpZ9 WM+j7A5O31E4GYVIi68iYLModYPWnj6gxq4QE+QoOrjyiC4SlZ5FU0LRC0SM rTKObraBkG/uVuNos7nV3mo1d29az4tBVe0VRi4nAow0AQiroNKmJawBaTXo Rr0QaEOUOE1YXFEaFx7ys9ljNOmls2xUPdA/ADvTQeyi0D+i+1GUxHPnIWOQ 1JYd3a7UN2hx5+E4TsLZwOn+MOrH46j89DcsAGS6SxBv56Er0mWALiEICs7T JUs4OOu8P2793cJR8VvlhvfG4V3UQqVPfHx0qD4JvKspY+8CWEhnNgnzvHrP UUSNp9PIbVTWcT5EaNuyu+iGkxlQBPOR8+Jn0KjjcT99DC6+eRuFmTuJz2l6 l1Y3KW/7pzhJomwcxW4vrMPHQDisJqf9MCsaexbkBQWgUx8nFdY7bPu7CMBe mQC0G+2gLfYL/1Uwqe3NVtBot7e2g92b5u4LmFTFi4okLBfyCazXdQaTA9Hr WxDKc+cRk2FY00TqexHJDQrdI38ws4/WwcG7s0tHfrh+gM1CNWDwQKJHfyXA n1ydHnaWSQLt3b1g0yC/CySB7d3m9mawtyq5XfjiSySBozrya+D3wHbK2HsU JjGcosoWBPKjCJT9YoL6CZAupYZ3UWXpRzWHtJ0CQidpDCIdqDO3IK2PUmjS 7SwkdAdxdgeHxqV0yOVLzyrmcx6CyIeWnH4uLQPO/EiujJGjG6gSF/5xnAxu 0/sItLZrePYhgo6yMfSxWDR5l85LunuY9e3faZKIwUDP/Kt/O2JbXLTwAKBR yu31Okx+Cp0n/9LFH9Z5S1warGhf5D7/50338H3TNmBgk1GUgjqfEU4Ox9Ej HDUAZlLkSH9DOPU9ILp09mkqMTyYShNA/JXtSs8QhXdAZVCnQU1mDjRnTIY1 XBK9XvPv07G/uePHeT6L/HaZZrS2t4PWbrOCZjS3X/9U/ynvg9bVbNbhf41G +3mCsfAtSS2arRWYNspos/sIFOoSxyWmTRhf0cSWcyL/IM0GUTh7XDjM+3Ay AQXOPfo0yJuwlyFZKrVxRxlEIGEnPI8frloNWxg/yoD+JL1xmoL43YHNmn8l txkgCD8ajufAjQGPbkHWwZ38dNlpsybduQymD4PnZPLT4+Nj3P5pmsezCRoq pTHS/zeQ1+L7sA/6bPdyo3L7omkGYkA9DvtsKYct2nvd3rV3rbXcoiSJE2gu t2k0LNGn4nZeerZIYPQ7vZl/dAsKdfUwx2hsTEpq3/EcjoH9gKkg7GDnPr43 R0DYvv/on0WAQNj8xDm80rVJ4tHbKM9RsPoNTLrZrDhwwE5bu3sVB84SaFrN ve29YPtG2N9Xl4ScF9Wxaz6/gVd1/N9JSBL+bewA+Cr6GlY/Jzifh/2fZyHA RQMaIdv9wRE/LxJyCyvwRlL6XAm+Br3TlBy+a0mUSV7bT1J/s0JE2gI5dLtR hv5Wc+v1u/PDOsqM9Uar9SzUK194idz5J0C7YpTTOh6Y7i0wFhCK8jt3nNMR Wn+rW7xsJKCmJ0ABYBOEo1gPgo8i2ObIfVyhl15HjyFiwcl10yakx8DjcbsF 7czjr5G0tsHvI/oyQNY5idF+CBiFeOYPpe3RLyNb/Rlsu8zSUQbHv6TrnHWu Tz+oU94o49luM9irYqrWUW1u7jRboLRsvfCI2++pE74Cib4MMI4hnf08c6W9 yzjKsijojNER4bRgv10/HYPUgy5L+NudTRFqaOxGYnr64eq0o5lgxcjAHK5j 0In6JUw/j24Hcfkhs4fra194Fy7HYYEOU5BIe2kWFiluGuOJbaq2rbLjyAxU OQhhkUUafAgjEBpHq2m8K2JBq4wFzWCpWRb3st3eBFwBxfWFOGC/9xLh6v+P OPDuutl2kOCnqI+udR+E+pR9uy9mNp3D0+6ldrZYW9tqtIHVLrBoGtu019ja Q+P55kv3135RbfAKPt5/3QZ3UD1V0rYKewA2H4NyZj1iS0qa9VLozhCm/8mY 8/7symUzAl/8KUwaNDKQpm/nAAcHdXzQBDN/GGMwC/yJxgOiDzYDmqbjeZJO YhBQgHdFz9GZzunV6Yc3CzgKyY3L3TzEG3Y2t7aC5sstaM6LL+Eqf4YeVTEM SENnUQZqujvKVTQHmXBQevrC/t/U8XE4G7umwDcz+BkW4D51++fj5UcFWmRA YALuEuOmd64c6tRFiQomk6aFqa0zTh2DTsI+1Bx/OyHcWkUDvM7CJA+FsGNE q+R1Eom328IKUKmV7Lb2QC3ZrJBZmo2919co5zbb9ebm87JKVXvGpg/pPZnt N8soVd6KzuAndxvg4Fo/E/xPuyedmrkLh+NwBjuNlkT0fZ3N0VNf839A39os 64WAADXLHuaMfYL65QCkg1mE8ZxJFgOZ/OrMRcW2LW3LEXSnH3447l53fghO Lz/UKJTmMhpkqf85xAhXIDc1oGKPMfR1CDKw/IKy6cEHx7N3GcagrI+CE0CE ZDCeu7Z7lIFB4Z9E/kU2ECdhMdZ0yZMYDfxOFoWGeCOCP6pdee0msKX2Atm2 2dzea7d32zcrKFBV7ZX+tIJnB+22LM65XA4OaYoOm7M6xTs5jZjRwdaNQ/8y HQPK9DGKS+PQIBwQreiGKfdVMz8eZOHXeLyQTQnJ0uVSwnPsPqW5nMFveTG7 HYOukqHhMIX5sgHyVMYIoruW7JJ3Nf/qNorJQBlgAO4wHHNbw275FnQs+DAD Ht4J4Yekpv6+iTBaGb1ynZO/XX9u2jEuBzGcGcaqETJJPydKNfh9iBT43c6h PvgWOrUaQXspU0N8a7YbW81g82Y1pFr0nmJpFfSnwl8BdKADp/zWdYBSHFzF U6ZGZmwJE2A4r66D4jCcTAHSC/jQJQXp/jYBrorb+U0W38TUdBsgJtRsmXPg sO7/LQ7L7kbgUdbvfKo+dP81CkDFWGhDrgONnYbj9CHuuwScJBMd+VzVkDcU hV746do5KWulM0LAp8lpybEkNA79KZFntEtnPpyVmXgn42DXvED6vjBgVR64 E8Ae4D/K8CUOGm7zEUYwK/tv4J8sOnnNNhyQreUu2e1WsLm1udMKtm6EILii QFl+8SWn70/Dk+v3zR1bT5xMM5C6Bs5OKRMlQpS208+iaRblUcKi2jP7c0TR yHkNSMAggj/kaTJ2io2Uu1Umg+0miOILKGLebGy32kGjuR00WrugD6y0JdVv qf1YIcD7n3lur0GZiCfOMNchMDcQnMwnq45xcNKwrfunAzQNFfOgR3GLIIHh zqCsPczgCKJB8VMUj/0pC1vPbPUK8RBV8nazHbRaC7wA7G3f3Nze3EELzwpe t0UvWUGSjRVcAEcYyp9ErgH3iEL5zd+XZqNUIRAymbtxyfV/HhYA8IfyYzdE /OCs6+xjF5ZR+LmMus1/0/YZDgXXh9Dcqdi3vR2ULBYcTwDx5lbQaGwGjXZz M9hb7XhWvmVF+zZWk1j+jJ07ADF6nri7dgDs3/r5ZZ2+RX8DCKShe87fpvfh fenZks4RK2zdWofcAvl21aOHuLgFBSnK+1ncwwCcCfyXrD1H0SiLnrUIKr7K qSs6/wPDATBBMa9Ama2doLW9gKLzqW1vbwI92LlproYxlS8p1WkVC+HvUZ2W qEnLdKM/BZHOzRRG3atUt+xnHA2C8fsJadpG7zX/NIswlgNR6nzPiX0/Zg4B +HIXzf3oEVnRiKCV55hwKhiJSjcCBCKOFI5ATM8LfxCTUQY1K6B2Yf/uWflu iUcfRQnp0w/8i/AOp43ZPxXCBMhfu5tlxEMLzdVp97KOb9WBFbW2n0e8hS8x 4qkJPJcpJjKQ0vsSK+gWEZq+qhrQ1nWu/+2aHq0gRUAn56AqxQtRw326fISD 88uGbSa+BLEx7I3ncq+nEhdw/ShfoG3HRhh/lhOliYfDOArewjCT8I/JCqgw F4NkD3LkAjONkBW2ttoUKbCaGFn5kp1StYKt+AdkU/M7l/D8EGPIvPOI/c+n 13o35pSs5MZsLSRyRxgo3X8fJV/jkiZNYb/VLWjcEhrU/LNZH6PIVJLIQuwD NL8EwIxdBA+z+zBzHr1ssHd727YMhIkAI419aQIouRgFn2Nvp28OL87PNYBt HodpBNEDC0etbWFNrjARbgWtCrUSMxhbm63dve06/Xk+sKX6DUVvVrARwvYC GryDg1oK/ka5clDxVJhxCpAHkNwKFMs5+5lS3mGX0GTbQQst6oktrlsACmJa GUVUDrGG8/smLt7OeqhVAolHzK6ExgjklVkPU8ZfY6WE10srJ9hqHRLnn2Y9 +F8w/Nma19c7Ymfpa34Mkxn+XBdRk0sm4LyGGci915MwBzx5nWf917oTaw5n rmd2Mh1jbo6Sz9iIQucaV9Ha2logBmH+YzxBl2Q4vo/TcVTIeLX262brdWvr dSS7q98Wk7E9lxXEotUSt32/e3B49N4JazoBQJg7/qaFXLtkr18t4EC8xXl1 jilVPFwQZ99stIKm4a9eGGff2tsNmjcvD7M333tJtNPLJbVu/zZNx5YddaH0 dhCOx3OgVHXRQslz9erZfEAZA+ih60n8EKaT2H30p88GYHN4G2ZwLMJRUg7u TjDDpKrBnz6xM4raPwKYJOjhwqTPkifsbBbny1r96ZM8rrMDun8b566t/vhr dCcyC9wGf+y8Tt5fOTGkfyRBWO5fKVOBzWYr2GxXRDk6oaK7m3vbQeOm9dIA NOfF1WJMJUadzID4R3lwGGKZkmigtkTgUzjLwsWNRE0aWwA0Yvxrtr+1Lryp C1HnfRJOpy7WUFqO80jmEhQYmz7pxQlJav3c/zf/Alj7RATsu66eTwCbbJyC wHAYJqFahw2V5S7n37fkFR3WB5eOZVxXBKAwykk4zTUaH5x1nw2hii4xrnyN bcyvNxcw9Yroc93Y0i6WG6olAz+YDTIjpVjw73GU53BSs9R9XhGAehDBDGEf P6TZQ8j69vnpVefwDAV0FMzTZID7fAziAFsMKjALdvQSw5tLdTZOogFWu0lL j6tCYTGGETDntAjHZOx6+96VprQbal+5MFgalF6oOBlgMBKQ5ji/pXhIMpP+ Nr9TRakUFK2oVAooD+jm/c0VUwz6hQnne7sV9Is0gq3G7u7WXr211dzeaT8f V7foHTsmZQXx8H9wDhtIEG/DSU8n82r56i4qPWKCYoqVV1EehVn/tuaH/iDG ZHGMRhr6V/hmvmRgOHHvszBP0nuX9XaSJCw/o6Gl+erflCvGH4e9muE811q+ dMIZkRCGTnYVDnrpzLQT+h/inybRaOWksv+RyW8HZ+eXTVu/WPvbLEyK2cTv x1l/hqliCCM8gIfd06O3+37KTAjh9bNoGt2H45mILBuCup5i6nn07CFfyea0 yAfCQkKj3QiaO9tb28Fqzqvqtyw98n/v4fwfiWIV86SyAhmcuEE4did7eDtO o6rH/9IZn6GdLUlcdf0M+Gry1Xn0z5tot9uwY0UuEj/6eSa43vzHlv+9//hj 4v/Fv8MjFlpRxM+lpBzMxuOowGJR6RgYut/phwNUreM6LYdDPbdaNcx/qgpb b6HfuWyd22xsb77uhVstOIbPpiKUGytLwAqOyg5OF7SiryX7aAcktK/RT+XH C/cuwr0ri9xZHj4sNkPcheOey60wYHeWf3UfLkeahQN33bDNxQFBpSjy54hz vwhBDYyLW1p8KFzVzZ1FG77XDtqNsh+A9jAM4UXYxGdNsRWtX1J15Z8E9U8N 2zhuVl/ClpmsALUkQOvF+zEepbQb0MeH2aQXiQjOed3vfLjuUixrvbwtW81G sNWq8M1xVOzOXquxu33TXrUgjt3+JVG0HXLFj8elUEM8jNFD6aHICdSE09RD nY1BdTMBqAXnIeggaYIkij4Qs1xgzgEuBOIHOpY/pRHIgz+VLGIy3x9aLWxp TxMIuBQuZ+Y0kZSfRTEIoXXxt0TPcZYfG7ZqfFXGo36UFRiTuWKqyB9C5LeI yFe4ffd2gmajjFuSbG8FrdVpvG6ssGq1gLGP4zAvHXfgqz/ZT8pRs9ZRfxeO YnQGJ5iBrdGrjpAR7vrD0/OrUq6oMl4szAak5OOLbKAjnv/IGjiVGTztnaC1 teDMm9mdGK23s2rc18IXX5LBcwyCcVZOrDnGOq32A7FfqEkssqr9ETW2ynV0 KgZ6ceWel3VPvuFB2YTDnkPnEdcaOD47Prw4Dy6Br+WqYHZV+BPWts3icvzT bDQDtCo9fUnvvy1YcxFoaiInMBE5gbnKCYT3Pzl1jdaObcq3L1liQSyRhOx+ qYRr1TnDys1AYwF/E13FbIp29xwoM/KAcDoBkoA9vgUO5b+Gs3eoWp52Dz4g HdxtbiLBgpNRLeKgS7Gf9TGyNycnZ/mVl1Q5OqOY809MYYoS/p+FD2wYcxsd uqWPO1jcJMsjEWcmE8SA5YC8EfWy0JU2FkPSAFoXba2jKAt+QOY2KkOrDWSk gQB4SaIFxno3WnubW4ETD7SCSe0tEorbUi0PMkyrJ4cnnaOzDz84MjVWTOml 6R2yDIV2hA4WCy7XDV4FUiuj19bu5u7uVnO32gxZiV72Ky8Ro1eCVsV7bzD6 tuTUfhNlt+jmMB6VEy47wOi+lmpTpD0s3Gk/LItxR2m5wqWRcWE+/q0WE+e9 93X/w2g2L0HofTyxH5St9XAk+iEq/6WXAT5osr9zmpxf/ODE4pgY2ZlOx7Hj vF8J8a4OKT41L+NaY3dzr7271WqXEzEA1froQJk9CG9TvR++vg37r+0DuZo6 8A4dSEn0tVR5qTMeAijKz8txV0KGv0gzkLxTlz9jsOiCJuU4qg4VFQKUKakB FDLgPP900KwIy8BTnMcYd+KjQlKESRFgPrbK8gBcRkuqqpjvqIXPSIOnncMr Tr6Flb897urHIKbPJtHavm0vXaPAKXTTlkXBdnNr83UBByOv3+NL9XizDj8F oOHp903P2t7rzQVluSrrOm1a1bhk9eTVqtVYt1HofSjfVIH/XhbH+0cEr5+c dK9/KJWBcKT/coEYsf+RyUKqtLhnkID1MuTV9YW5PZt7zWDLqBOiFYC9xutu o9HaCrZ2mrsB1vEAlrrd2A5WCNB55t2XBED9c0oS/Z78xiXCaMVI/7ziR79N 6H7Zav7gAkvnV28dO/VaRUHzmh9jFHoei/rmwJtmY7Z5ADNg25pIcAuR50nn riCpmXmHhz+JAPkGpCwvv5Jj7frwkMzJ+0K+1fk5puZgJVQFbUkiF9Q9bW1u tzF47SXCbfk9Pk8nUW/VxJyPqEbOyrUxPsKGuU8YK67f+p9noHovUPCu6pxk Wy6DgTEp7rOVugRu/BZQsdJ3dkjhmnlVg3Lf51c/7NkcGKSmeMjEV1zoom4D WIoCVvYDohKQg2QgsKvCR2fuvcpy6J6cHHYxY2GvDmrN1gIx3U1zqH6LN/6i X6D0S/etrMA2MeEBC9S5VKEbYwir++z3Bbyfo1mhV86wEyGW9jMa6i0FpFvu c9vsLsXYpeN2UQQb3JaSxLuwtLH76AVL/HC1Z9td11jlDQpRIqHP4pyw8BNW GJf/5NFskAaCAA3tGyj+DKTT2MPIs1Pf3txurhKgsuilMsatZnr9EKYubThP k9j+nTbiUxR/BT030RbY6k4vkOSApJSO3YrzFxOARunZ4s67u7Ya70bGX6Ct /IRt5Vz6hngLBTqYlXKGZhGd3J+kA3+6gogmvRZqL7k7qpK7Kevj7FQYbzd3 28HmXpXx1pa/mnu7W0FjZ2entdsIVnDfPPu2kNSnhAC7K1gJruoc1upWYQW+ EOkn3c6bYzuTBBaKEKrx/SVYUNEEWDcdFg8I7+4ceMBk6TTYWil7OYruo3E6 jRZkGNCtRlhRHQXoVNhi7QyCA1er64BUhQktMcbHX2awIhmN9inOojczpGk/ xFkxC8ccbFREMkETm1OW3nNKnSh2xnFR8GGKycYf0rq/tyhb7jYc1+Mki8P6 MMMvIIaDJNHe3HrtbuRqKhdmTMal4NSDKPkpBA3GfqZrVfhkHl7Y48E4TEC9 dHXyg2yWpOWHq3X7Hrq9BWCE9yUe8B6YyW18F81Rkyu1qej+6vCgaZtV1vCg jiOstD9gqzAyjMlsHHIMlFlQw9HZlhP71eKcZKyEpgQNoAQtWflvUdWMvd29 Bpbve0mN/YoX7QjYVe67IOGwXDU7TfPCeULQL0fQLZQQD6EL9MW58mEWYiVN 9yEzeryvJgfSoU5Sde9nmGtcxIkbIHAW/TQO3UeL533V7TpR+GuHQLOGszFn fiMmYboVeRbO4klcaNa+6EKnEyzIjpTjj0CmZgmZdneCrcb2EmTCcPvG5vYW ljF6cS1o+0UbmVaoBnENyIQ3VSTThV62iucVOmcpFKB6vN9SF+D52wmvsVcg EtOyR0YsovyY41SB5FN2Nd1VaqPaJ5clJX70iPpvXNT8EZwzdJ261fxVzKaI qggCN4AB4+wrN/lFmYCvs/BBpuYN0v7r/H7wcEOTyZ2bdP7pxr9ps73drjsJ 9pzuLm8O7E6jPqiMfQ0ylWjPGXF8B1/wPprbUcwcrffzLFpwz1wu73qrx1EU 8TWK4qfXOK0bPDGNXTd5sBtNQeIhEfxZNyBzNFyOVhVS0BX02sOVl87sbcFi gyDo4GWSpKk1kf4wbwzHvxsMIUJh04XCOceHP2vzWAqB8+s9x2N8DpiBBgu/ oDtxMhTuMIxhEE+4ACZmXWH4ZIxpDFncm2EelMxesJW8hD2idPpQs3yGYh+e l0pmnqeDaCxDzvX8Y5Q2CBvXry/OO4fdjRoa2mYgd+zW/FPWGlzSjnF3Jf0Q cxF2Wnt7zTr9MfOn3oUJCK5z0vMqkUxXNgiLfDZJVWGOQNG5D3F+C5PNwueV zoqZXLpXV+gwGufC0otplAkcvUiYywN9L7J0PIb9BHIPzNZU4nQ90wU4WXZW tBqvZWLpSy6huMbQoCwpWUEEpXeecQ2pw0O+6BR+fuuCoORBkD4DyqLR+cut F6yrueWE6Kx4u8ZLUzw4ewMT1z0P6IUf9uAEAbZ73vVtnPvAGWZEPnKmOnjH sjxDwLNDGdnIdEjW0YaujepoXpj1Yug0m4sUIr7ahkumpehAd2Tyum+PjUH0 WDkFTcmeEMOYzvknaTabaBVM3EV7eHL1ZgOlLBLYrq5P6ry4STwYjCPPe4XJ +9wfHtinV7Hx9VfPOw+TuRmEgmxaFW7JkNBg5Rb8rR8NsLJHcRsWvHoEECxJ rThOgD7UvKg+qtfoPmrmUrUVYaCHgC93SfoA0MxNn1TpxZr/cBvRlDQe6l6w kl2Mk4SljCmFx8uA8CFt73MF7wGIGX6SYjG7+wiLUkM/QFb7GWpXIK+GtN9S Gk758lZaR90DvRm0Ttyy6DFEhYykZgZkTjaBnEFF6YLlWusArf54Noi8FSql 5P7TE5bh+fVX+PBub5v+Ug0W+iRkiF9/relabiQZeMe6lhu8cNJoYhvyIAZY ZSgQEqRZNAzaYWUx6vj/ngZHdS1T9cZ5oFpCT94SWza8Tbbvqn7usyHOA3fg Apj5fZzCqbwk1sWcyzO7QbNnZS/pFPsBdP+IclUxS7COCFtPY1lUIc1yNuBM MzjTeWTfgcEbBNiWz0D1gWV4+HLoj2IsvCOPge4NOS3VrJFNnCqJMeIAEHbg x/0xnFJPVWCTfX2T483s/SymTcHIgTB5uI3HEYIDUSLNYKKF379N4z6Ff+KE PTXhfojXxdwTmoI8myHkUJOAc0opYLT6XCQS1l3CFsYT8kT1sngwwmMDD0fh 1O/NxWHhtYFQDeC6RQYFI+URmr7h6Ojruh1SGKJbiy8cYTgU8yleJnIMyKXb 4jxRSJG3fUFvKS4ZJIph2AfCHRfALu6QqORMSizqEoyjZFTcer05nE1BW6ka JREzfkuc0KW0xvukKIPeWBZmBlERxmNB3q2518Su9SKP7lqRxadkBH3k9yKg PgN+TYFKZEDjNBFf/BFIbUR8YATPpQeEi2hRRIIkdSfA5z6GS0cDrLUCE8pT X9TdlBlucMztdfACCLAo/uoLX2aoLMBewxLyyNhEwJOrKBygpPIQK2oLlL9/ hwWdiBvOffNY0f7RbmJj60x5+W06AwkHsXI2LuDc4uGKcjzxgOkAHqDFRe6b +GQpaz6394hAC6jnfi8FEeqWr+o0poFaJqfz8mscrsDNxMQ9YOLRAyBDVDoP iv4TjGFKdEkGYEKOFB07ZQ8t0JAcr64DGRwnPkSn/ACGQP60VgBuwqgBHN6M ZrWGoFq7nSUF/Q6zuKutAYL0Q9gAogajFPYlpoOg8Mo4U4QJeNKnY3glxqpa vYhOJQn7wOtl2A5do1D3P+by6h/4oFbhicnjSB8urv0rjJY9P/5wdHxUM6cz Z4rSiyJMvsJIjyTBUrrcAI5+DmclQE6URGP/fjZGdYKsQSAigSYcyYvb6E43 2HC88w0oNh5IUGQEe+QJxrkHhw8o7QSXMUXpK+5HfERy6OjpCWtIwCrhfSYt w1mGyQcm2WRytGivSrusKtXmBHwil4Cbysr1vHgFXb56BY9IGJpQTx9SUfjW Q8M+Mmvk4YAO5x+712s1/otgx89Xx3/7eHp1fISfu287Z2fqgydadN9efDw7 0p/0m2rP8KuzjWs1b+288481ht/axeX16cWHztkai4MW5UcpKUU0IrowRQkH 6HjuDVTtR3jn4PDy//1/mpuwC//n6uSw1Wwy+8Yvu82dTfjyQEXTcTSqrMVf EYe8cDoFwFEC3xhxZwocdYyREMBd4UAC2wLEAkCCQHoQ9u9GGXoSQRztqS+/ EpSdkGlsMWLCkP/KwB6COJc+UM4CCst4mQbedEUJJcIX5tDWGps7kVpMpkBs kE8nSDVBbMBTpOxSyrkWIzUQOi7AzRBC5U1ZJ1ikSeAmkQSZ4l8aW1NCFbkL kITXn54+NXZJgjkDHnuCu4P4aGbG+G9O1n/e0HWy4RTimYkycaGK/1e/XffW F5K1BM9uyQ8gM3DInYhc2+61hZNr1ze808SfoJ28D8JkDhMUyglOhF5Gsuj/ 7H/vT+veBUIC2AdeJkENkTTLSzuc1j9O+HAz+x/BXCawkGbdObgPeJ9wDpMX Zw431u4y9yhhFKcU8+1GgjGgH0RfNtPDLa/5cT2qE0KG/n2E9fVQwZpY/QO4 pxs0MIpx2HneBx7Feh5CEtjngEqj1gkX4T20pkjiJvql4wbiQPTI58rtBGh3 ViiluVnzeGaPAJv1xy83Tfj45aZV8+v1On2cbDC+CVIKKxkKQLaUN7gMA1o1 bsU6dHi6UUPRJeFBQmAAGz4Jm/k0TQYqPilS/P0vfs//1j8VKpaH04I3QxoP ZwdfeoB5QAeFSkjHnsRWAgePToAA3plmqFnCqCCeydww2XgSzj0Oo+L0X2gc GYELtnDznUPYFK5PQHT0UJdF23vcn41DrCefzyZTFn7CXjoz5WqaH+C41ymJ 8cekEggjAElMoc5YJtr6kPr3oByiysAkI/SsU4u3IZS6VT2wlIu8EeaRg+qZ AY5KkyM583JACVIPEUnWEWi4xDHuMAkeGxhMAOQKJOMcEPs8TYoRCChoLaN7 Uvke7TrTS7WoRAjKSKJl1sSI2Bw6jAkzgZpPQCXhSwVhU0laIVsQkEA/8bl2 Cigo8tCUiM8MSQV7Ju9JlrUt/Q5MxPDSfAb7cWycxpL0LtojVolcQybsgCwJ cvaU8teQaKw/1vz5hpdjtuNwLi9JtDdCmg8eCWhz6tYkBid1pIDSy1ojDK+a T84CVOgblWWohH7EaaB0JaNQzD2atxSFgeiS4mK2UGdQgsyFkXeh8ysFPV/X 2GIgBtfqUbghGm9UTQjFTUSxXqTFJRIQcA8YlgZ4qZY4YNeJoWz6WIqLYh9t YxLhQ5klC6s0GrOFkcmTqvV6PuttKLw03Nl14pNvcJL5DKEHf3qqod5f51aJ TO5zAjTrFohaRvtKdESjwq1gWpIj9WFu0UBIjKCgYhVFpBVan+UDslhj1Vpo YZxCzNJcorMKQ55a2BvK5yGCFMZ49P01Ni1YE1vzuzNTX2XCi6asWZ4zD3p6 kq0D6gBgTaLHoczUtXQwoydABuBxfaYF5GWwgK0hCL95jiQhWgr2L/DZkLbM njAEmvVurQv5ChVrDt1nJZJCauG83Ick5/NEkdwL0kdGHcAXkBcBpJMJLPsr gJ0KwpD6ot+ukvL2Pe8XcY+4/wvZavDxL6AJ0EvASH7xftkP6N/+L4H8pz/B Z+jhpPZzbQqvdWzR7qRC9JrSmX11ApgqJKU6vHiiwjpY6qnxw+/8VAtdUrDC 9yd/bdZxaoA4vzgCNXa3nL8RO9N8DLtJ4KUPyhCus7wrCPoxDqAOWo2I2C31 mbGMjgPifnDPbwgstLZAyEbOkdajUddH6BhOeKbcDnaLialhGWL8ZyP1gEfK 4GW6BIzEPOwqs+RZOhr4DOjdLJ8hZWJCOUYXBgjBRHK42QZ3eQudHIpDhQTk r9/7CHdk/ZKKGPxHUx94+Wnff6VVloDxlHws3691CVEpTiAn3DO1Ev1SXl9j jemaMjgovsJThC1n7RhIXyTg7mt9B3M+hDmouAUgjm5RNiLrtzhfpPG+8s9B qyNwPr3Cd4IJf4dxO774zEC080iUuZLkW+LikQyhVfQA8F/7BbwqWx0gqkQZ UljQtQHrE5yDd4etk8SaBaawMKqmR3YUprfcCzT1OIJ/HDHVJhEUuQpXi0YU FN3aCFiaoLfOgjs2k+NhV4KT5rNM3Lq64UoSVnPBAmg5QBkFJyD2D4Im/CGJ WIlePOdnxo4TPbSlOiidUM+Bdumk0sOCkg0jL4Nh34sZKtovZklMiA1kv/wZ Yw2hx0SoHYSUxp6IafZieS+tWA7Z+dTk2S6kweiBiNCPrDUjUxBIwgYOCxXr 6OASOIzQIQMqgQdQoUAUKAu87IBCUCgdRDEkDxvVhPYqOfyl3EG2rcqp1cTP 1Ncj8uATJiLYB9pLxkoulYuBFTyqty7rXjedqEu9J3Id7Hogli5/Q2tbZq+q RxgV515ZVRJyATcnZdqyBePBP1a3BIuTL92dcPT1MxyzP07ziKQ4stvhEuSs QF5DX2yoAYJAlX5Tohu2J0bBa6kB/5TsnyjhFkxBVPe36QNqU0LAJYFMILU5 6HKnQsl8qGLqc4fK6ZuUe3OyzqZCgLV9TG+HHispzuti1rQerbPWoP1SodJw fRjoZRDYE7ZMVA4memYXrlT19TCD6h3wniXLXTqWeuYOfB3WLAZEi4ypeKhT v+8ZlF1QaNgRYsQoQoaJSfrFlMm6xKd3MssLr1eimLxscsQoUisOrqal4nU2 uAu3cb6BIJ1RWtdc41JvFo8LJp5vh4RZSFxwMWolaNrDIyBPRM1AGsFzXkaJ PFv9eI4SydEMUiQRKPcULfItWqTWhy4Ukxhd06Eiv0Ossg5g5dKtROqxWp6W L0vG6PWnJzwiRUpywK+/bniCa2hYYEjATLhuI4veGEBWjUksQA+NnXMnvKdu Rqu0y8bk+jWkIiTLerABDwO6Epal09U2hcTkIxf1hVcESJ1ye8SVbg/yieIX 7A/TAOCvhHKolWjTuzKHc0UuEfk0kLyb1xdIL5DwlShPCZN3MhUQMb+ykg4j l7QDApNAx773wGkmRFiOhsnF9RoZWiOK+b44wIjHfG+gF7vxQSwCOomPGBzw toEOhVnCsoj0wBs2O5j9AUoDdlKT5bB4esrScACnSzHAitE9a+zcGBzdFwZK RwPDt0CWl1lM8W8cxmwhMR8HZ2o0tlDhQVYXZ1EF6mGjfUIOJEIITxG3h+yT Ax/KJgM+A6Toqde4FTm+cM4M4SRNZBigOWJ9ydYKviRfq5ivGRxBSAaHHW3u k2VRQ4QKibwJSFg0nMxXDCx8Dr8RzfLnkLtL91/IgGKB0rn5IyG3DgsyBBVT LBCuQSkRVVofGe50YoHBKYGB5AX4nzAZWYOzQZbPPyY3wlYTvcQ1ocwAyiP6 2LF2OseSFRiCOYkL8g+w0C1JL84t0oZACkqwx+IFEJnXE6wW7EUYk6UbPD11 jw8x9AfnLOKKQvhKPFMZqKVbmUNNTOgLl735G+zSkf0LSezylDLy6n2QgiAq YtLGKeQGbx3j+1grT/PI4XT2EGq3NyR50tOKBpYI6RqWYgqogbFRvqEDogkm nzRHFMu9EnMx9m1JuIE95TSrAB0i+FE6IShgIqqF5AN6EOgHgOiHv/NIEhXl GKYwCcdzjC5hEo0vaNqsvQN2J6xBJ/kDWvd+nlGoMb6W9om+siRM76roKsN2 LV+Y4FV6KFEMEOWx3kC+gYFpV3tttFmempEDtHvGxBSQb9PxAB1lqENrQIiY B4+kP619pCYbKK+r7h2mCYUFIv4pFVp3e8l3Sl+2eHG4kHmJ611dkPqs25Ky y22vLiTVp5lhperIf5Q2DnXXHWwJea+HHrmPMu5Cz0MLlYBGGE47IPovgq2w fj8StsEAS+owlyPShQHbmoANXIyrecJdgcyR5IAY7/5xlofyIkeGoww9LmJ2 VQL2TDHMh7yyxIE1xQS5li/y6KFcDYq+kn4pkEp2N5BD5FGk0UoGTHlKzhfh dkgdcoxmEUIpM0+3s9whfub02e7C4sLVBe/X1UVLqN5q/Wpfa7Qdk3h0Wwjd yKPQY3h3/XHD3/8ePq2vwbc1/5df/McN8bBlPWzJhx67K7788uUXgzNhWKgw fDILSE0/hlwFD0LhINQjqegLthW0tVH+nUchQAT9SGMvATi1Fi80Ne2qZRcS 9O5Zbzh6DIvZeTgkDCmyCH4zuw3RiV+BI5aprzx34TUS1h9WvA2FTyhgSp7X QX1i03oRCbcSKQQoI/QT30eL4UmePnVMhXrL5tlZLt2NvCeZjhdiSZMYf4jE GKb8GAm+brhaluhMqFjTCiXjBE0HZN8+hxaLo+PJdQOx+E7EUxmaVhA9TmGq ir8vkrtKjAVfnOSj4D7Mfv2VYmTZIsnxksinlMHIVvUrwp6fXkmRXRhahKXa V0Faodx2OM8i15CFKBkqasffmwMiK15ir637ZaE9tg3mKB7OmRRnUeRhlIC2 Z6NDKICTS1FIkncggL/cFOmXGzZr4/dnbSAkQ6IPiygBWjGYnHPsg+kCd3xG 3/l414ETuGrYQEUyh6Nh15kc/fd//7dIEULHCP2EzWDyPPd12GRkb7Ok2OA3 TslywikYgU+PQ3MlJEaFcaIMmXixzCiS3rS6eJG6rC01HMMbLNGJuV6w4UEO vT67aYiAmNnNOvUHvzY3NmoCkNgLw0iHJtC73SKagtqlAYQXrRDYtuoSKhXb ChjKu8oSHVC5PlEKyzZW5QCjPhc6Pmz/H4qBzFqPjU2siy00rLs6EFaZgSsj r4fhJB7HUb54w+F93G9qvj4zt3nfn9WcOUsvoLEj+/7fas+BoP4M4LeXAZ68 0wB24ViDg5lQ0YsF/nSR9VXhNK9X+7xNWApNBqkGkBbQgUVfKGLpeItFoKQ+ 1UTX/2YDc1UwSbBe6vYAqjfPwXDHgCG5uh9SQ1NZf3qyzfa/bpidWBRPsjSW iTWVJUcwkCMSMastCHogNCL9ulFniw2ZYoykCQq56+tkc3kciMb6Do1lDiyM 2ILd9ZFfFw9RxIDEtca50kGUqYUthKZdxNMM0zbDIOKxf9g85eSTMAwpWnrA 8+xScHWjFO/WNSeTMJmzjChoxi5UqIcwdrq2H+oHyZ1h21Z+Srk+JJtVsxae y2EW9g0AY46tnqOIsk4nxl1YEhM4Qpi4zzi+QxbIzjTlmgS6QGI0FYBfLDrw 5ITJIJfBfDL5xgrShX5KS/kmrzJC0QksnT9+WdMyYE50AMXxY15V9vX4lq9n yfHz5OmDD826P0P3fZlZNlGWb9X9v8Fjm7T+Z+O/8Fm77l/CszKt8P3NOkgb xSxL/EtPUUMtThgo+WfjY46CRF4IAxW59LBDOawCCAlsilK7tkGKFbYs8CwC s3BuKYvQFy9dW7kEjpZtsiJ2e244Qg0AQU+adDjGYc1AER6/09hYgYISH/6V CNiSCNhYgoF/a5YfNv9L4OAVPIO3/4KtrH+v+KIWFbcAzbcqsfkKe9ouYzMl gFUk9/DuyLwgc7dVWCznskh89/QWs9jDmlK/5Bv2Kg1mmZm58fSqynDWGY9V qKLlBTORy+afSjejVA+ZzlnWVCWLLA8LTBkVgfs0ltpNlEm7vMdWCzknUFRj DGmW0wnZQeR1rCKTdOINQ1a1GYZbiDjtKMZxPJfsSA3LYjS00Ah9Yf2orJJ7 mkWneaRHEeYeUx0mIiGzuoQ1EpMMcEJyzsY0OYsc8UBp3iJMMRm85HVDfZZp HOvSFGXmZ6ncOVe300H2ZR+mNkiU7SypP5rBF+g2sg1izNYxDL2MtWjWYVhL GlhtwvHXj7rXG9JGxzkxtobG6i4KYv0+xfCqEs/a32WeEZCOgOBch8BWaMsp lkmUPhTRyjCkDuSU6p4BKsyzQAHVociuVtoyhyFBFKSvr1GWCtNK3e/4GMQw mU2ksQX2uLlNK6QBYL1GRhTOhOqw8kaie5bD/bUzn2FJpwvfN/kVTKgtJiTS sHrRCOYtoI9Gm4Gweql6LAxlj9QGTiaeUbERCWGjf+h+0+5eEA1KSGG/E6vH 0HKL42HD0vkW0XwKz/vxFOUyIqY1NnEZP31DQEIskTupzgAPQKRsOstA1Iyk T9wGKEFZTdToW4GCnZ40NIwEk99eNHk8YWrmSouoCSokYaZPuEe1GyhR0jm6 YqmKTtPysHvTSEazgS5WW6hapckAGIBdWu/pEZ57ybdU1YXKU6nGNc+7ETJE lXtMkz91W1NQFChCKIohD3oHtJVTgR9eo6ILa8cfDqW5Ej621pBDiFyscvzf MBasxNwoqqIx8P82mz16Br7lKlHF2Igy5jF3dvaqjh5oyg4gUVHn4OAyYRfW /vbx49+DH778++Pjl78Gh90v/z6fw4cv/05dnx59+euaTEPiNrRAbsWZjQ9p MIhHsKd8fPiWX1yPMEupOLdk4BmzrqExe8qW4rHInTFGlcZ3tflCq1I4NxOx 9eaZ4GlJuDMTfynwD8KvfFwkT/FI4zUQyQlpKJ2bOmZ02wDPBcTVTal5pN5H L8raQefz0k0IDORapW1rrebZ8BV+DXqtJiBVhjpF+ZiyvDAIcMKdCKuhhQh3 DFns+a18NlGBoJ3u4emp0EgHtpkYCTqGPCczEPs4Tk5lBAkmivA0yQMHANX9 C95ReZA94V9GVOCgS5UBm0e5LUqSGUSWaqAcNGRikjB72vo/AzToxaNZOsvH czKvfyy4+p6WRp9ezfg3El6VC6EknEqZZlbqQQOYAvJr3nQ8y7WbP1SXKmpb WO6v6yBmQccF6tbQgYwRjJ6qgw40oejXN2iDKyMpzH6nlqpBJzUHdRREXnuc DSfvqOa71Q+U9qCXqri5nTm/j6EslD8s/MjouJLhkY8wABNzzA+gtIpoQrc2 9eEwASsJC5QSVecfLq49PqCSrJMTl6X3CJ3HOuwR5UtAVJLRuRVlx0hxkBeI 4Xn2/RzOSjkjTe9TjSNKsjiXNeg9OBHxKGHFh/BMBUAb5rlSQQFvpZgzAtx4 rtKMcme2ym1N/mUUrt7I+hco3coJ4MkA9APtGIiEhRLuvAhEMuOFggZ70TwV +a95P53qaDuJ/t8h46HKFk5ZCoXmKnfbm+BlMZgu/PREl9lQ7ruRsl1nY/Uh PKQEWgD3xr5/CrIl0osTgCxQeHwq9GA47TU9X5Q45O89tt2eUAzQ0g22TdEc mprNEunm4ZdMhWKoMY/EXjHpzoejmn9xVUMsZYr794srtpZKQPTiguY5Tkdo B1JO5nzlyQKIsyIQF3Lr95XkSYouRSQEJLh/ucmpZvX648a+Y1qSkLrOYB1o EkLhw1jaI+k5XM+O614LWUzlLR3M/ePZOMq+AbTEPPJM5KiZozDtZlu+9O+U jwNqMotcAHGu14Ce/Ceacc3HwJPHH9fXfyYnlf/ab23gjBuIwk1KBfhO1SYz /z1JPFJ4Y5j52bmg4qLcXPiaAVIZ9lRVNERjDhlnZZ0XsvGKaCrpBJ+mSSSj faVXqnPVbCsXcnd3y/Co6JI0VpCYO1HZEwg+j0H+M+AMUIiftdE4MfrBTFYM qwjGpPRQr9QpZur/2NoQyIS9CDSK6ItxaEgjJiYSEPIMFALIkgAcak2VZBg4 IG1lVEcdjtCjg1oaHQkJBbzXo8d+NBWOfsyxb2zwMq8xHyJOOFsXyXMhrw4J sRaw68vNfSoHxaE2FBJnlLKiDsdRhHE8CAMBJotYlKPNZBE3gtEGa8hkp+Pz Y+TLE3jqVJ8eqCaVSsBCRKE0ez09EZemImBcwWtuZ3DIozTOeROI2+hyeqIw j0xNEDq6KHmFABe+tmsu2CXq7IioJUZlCtpgkPMOcRkdUM3dBAsuIagzSfUy sdgLlVPiuEah14SWEGVgp6L8+ShpLKFVQodVZ9zSQNYQZmuETzWaGcvCokv/ ++/hlZ+QugsEQrUoiUYhis5rjEnrp8IHw6VmXGIWjgFQuVIxkNiwHMxeN5Cg N8S5w0ED+R4dX9bwnP4wmFOx9nLUgSTjyf0yoJDB3hDg7o1AVnG2ThggRCUG LL1T1BZGBQA9gq3l0FAYp0GQajA8Ooo4wFnAggeEKVZ9KHypTM8ZZQRpXEza eWFI1YGSIyFvbTjE+EOKMYgyZFWk0TRExLZyrjTwHIlDKHz7MulalGDhzDRM Uh5SkWIjM0vQ0e9EsE00MJwSMnaEJEWj2NOzUpHYutPWRfeSy/B1W6eXRDwt sRlPGWeJpjK02DEuCu879qHD0AOJuCoNNiy5ZqimUKO5w64ZQG5dSMQV3pmS k9BoebxQdo9HAVZWCfkRA4RKBWzwEkOOouuhCx1oYVQZTTd08pNoOT2Rjy5U d+p6rXNwuMY9rh0dn6whMuJv+FnSiBkWFV2H/wd5iKyH8HccJXBA2DZiQo9a FVXnRsc0wLsBv0M982uifAyG0UqXOg/2nfqBdw9NqQKbqRqNluWUTULMWKzj zVrNb9X8Nh20NfhFLgzmgat64TpoDdpwCw3FbFj3tWFMYxCMafS2BGmRPaYE 0mYNv7TEHKxNw6fs34YGtYp3aFxzVlLeRUFYxiMA3xcdVgGK+1wLe32sxfX3 f3zmea7tfbe35q/TbmnUNMMy+YxkwiThj1EcpeJYaC/gbs0YLgKwijI3lykI 0Kmj5NeMTjgSQBjryaapAgcoJ1fY1Tlz/JY5kN62p1c2c3Bi9CSnCFVJd3rd CUdTOWUiJJTEBCE8fc+CG1Y0OhXyAUt9dCGlCH6sKGcoXTy56oPtCqpHEgU5 8dGsBFaUllglkWLUH5VxSsjD5JaOQo4uKjup6iiKdthBZ6x20wYXstAWG4EK lMEW9qIzVkVPdTIgimjbGq+B9TxVekF7o4wJS3otwpCrliNDQ5UDVkV0mnlu XDCJUohF/SxdpE+XZPtVmXwlV8LVqPUhdZCg8SrqdyFnYJigfcDhwkI48rxL VTFkHyjCSc2NilxUR4MrSshCGvDqtCbdQk6VkhN/HVcWT4RVBs8Q6kAb+NZE 5CGquXMFMHqvhqXLUHhb+L4n4gEe3eC6k7onff8sM0Jb4fBv1qkkL6oR6CIj hxgMgt4pqu2JBAareskaYZONfXQt+fTWTQxtH+G/eAlUCx1JPvWgfkcRCl00 vhyE/gAZXKeBOh+ORD8b/iu/Q95pW7UnEwHw5dzbkZ1DL+plHszbVQEB2JtH UtMnlG4nJO4KnBaKKjYhp1pC+VCKGOxXYsXN5Cb6+aZJyLEIvEQjloJYzO5R AEqF0pErmSbZUhQ1H6OgCR/onKDsOOZCzcsm2Hp2gkS2nsGCmwbtW0NMU+CD +pV2sy2aNunHpmgKKJGL7YWGcoPho9ri5vNbvKW3kUH0yn9r1OS2T+LTK9PD y+B0nehW5HTkuqsn+YjinhX/E9IDiJKptyxKWkSq2moIBo/nsmRbzsGUsLph nOWFHF+TXmMeFEkuyoaU8zTNljVZnUUUM8bamkKXMvsT1VCrZn8iTNpsZMCZ 4UxrJcCxYo0hRbPHeBwjcNRCObT/y40IwC6lnkkVT1auU/UUrdc4O5VSC4C5 AHpTsL9VzyCnAEG/+7YTtIATnJxedpu7jWCTS1riz23xc6vRkmW+hSPMM3rW fHiATqpA6Et6GC7xheb1zvvjZmvX7BUzR4Vx2bZP6zQPZ2Vy1XZhLI9LQ61X pUkEj5MBzr/6WTqkcFfv1DDP+LLmKzldKirUYhwIX8ZRhVSeyRtqKq9Da0WL TxKauOBVriKUesvstBxYy+5YFURbMVeVQilriWEJArScmwq25+rWvN1oR838 h2g8DmQq0Jplq1ojlTcHfZbIfYaKP2BH4kqSqExaixF4bfhpULhcCBflZS8v 0HsgfwAly0m7HECPQj2Ww285UZN1IKzISM67HM/NegTs3XKz0Mj849zDLvxg YiAunOr403TNPE6xdOrfYS7wDDeQBXIzRMxdCGdoUsQUj+gBn8o2Vlg2aPjA UpT7dUElAG9RJQBauXtqK0+mqBhBCasyutzudT1fGuspQxJFHBIROVn8ncVe MneVbz8DMBzLNMWKxzoprQ9n5jva5Qj9F3PL9U+b401VwJCKt22/3vS/9Vs/ tra20YEPzMcKnYWfA0zrVkVz0eGaisAWfy4EauEhkZ3HrNJwnsiX/2zUoOlr v/3lv3yBKGlPzR7rWgCSNl+3SrVIsLYt9uuVooWHiJq4tUa0sBgn8Jtf/gsx J/XFdTigdYd5mbPFbHHmaEcVDk+rRIM4gMeTYkCOVo9xhMV/+lE8XgdBpQWC 3ob/F/8OdfpchhncSS++QGaJDB47GqVSqQJS8V0D6sR+1BzoPlWhqeIScBIU 7tz6MbjTRVhEdVpsgYAy2R2ht45EvKOd1Dc1yNqH1rhlQBGA3EOCqVM9tCd6 Z2oTyLwio2ZIbjvDuF2E2HoJbuig2t1QAjAgo9UNx9hYAo6qDSpx8T4O2Yro 0DPWDltbW7ReJktT5hJ3qNK0di1A1IxpwkswOWjB04PfN3eF2cjztLnwTtTI mU2nWJ+ZyorLuCopJFhb7um6xxQfyfEyy6PDeeMsXVkQDFb4n56S6CEgXBJt jNohKdU65upQAllE6IoRtSzvluqXRJoKV58tZwf4eDh8Tty2LLBWBhCRCV3t jGpTsIXaK/nu9J1sYxHSY/Grcs6b6sFTFc3R/lPGbUU8Gb+lMoCCP2hj3/pn AhvXcX5nbFNmg5lUtU+qTDtMDQS6k8fOVjUnmB1tlZWy6MSdLDEg821tYO2z X9+auX0ySa71JG3Fhci5/IW+WVQLFmW3uBOLNti3p2XIsj452WC6XiJS6NYT MSVoRqt5VnDmeecfHDyJfiQKfia70iJcqskrVACXCm8SRaIWqw4nNsoCW3HF gZ3sRxKzFP1NQ9p6vuGrG1FK6pd0tlavtHqUxXJ5+QUdL2SI1crd5I9FOU3T Sil0OEX4+GY1ICmXVBVKJx2GphfbODmwfXs72zs/NvfEygmsXiEu9TAyGNhD zOWSh9FDpCoNISKJiiouIuKd8yVRjyRgpoqhgD8ToxJ/tsVym/rgw9LVDMZl XvLd3O1WhfTZc7XCym2vAm2kuHlGSscmaDyjNmKV3IgpoRVpGIafk8P++LoO z9gonTQOizvqXteWRP76mjk5K/ZQ7RkC2/DXgWZlxQbGibjrH4qkesestCRT 27aP0uwW5gqgQCpzSNv1Jhk4/5dZVAP/WVmmJAQqqu4b+CX9AyQCrnMItZBK aBjeGbkxtVK9Sn7uWrBQHvAXgJ+Y2XJ7ErxrbdJWva2syLS/vyEL/8UZ+Cr7 /rdm3msTJgjuN3Fyw2zse54IsDji6GjMFLBQDWygM6ITSpsdbdimcDlBPTth D8cmP1lNJuIxmcV9mPLkJh0OMQP2e0Crb/31nwCLYpzgBtvIfb+4RyMqu0mt 2daM12v+2Qabw6HTm5/gDRKH14v7DdYe0B7uAwjRCr8eKZhGN+s8pQ1vT1la F8JcWGBflYiGKxASvfM8t1lF0VUpTVTVo7NzFU8LVT8UDyuIxDMjXejFaFnD 3RfEyoopILYvbkZYQMdY6m4Tdn0BrPgiN8RGcMYptkfIdQ7K14Cp+BeTgz1n KvUUgVC/fbl5nAyWWRNJ/nSNoFhST2QYPWBNSVXSwba71nxdKKvC+lpj26tn 2V4Pzjrvj7Hh/706OdzZxvJZ4vYmkctduQYYesEayOq5dA3LLLrrf784yTeM ZehHIsSObL3mEtCmzIv4O91MSZ9Qw9J1LlhhVTsl4nyFvKzU/Hs0GEzCn9JM XMGOoiBLwuSFZ/u06oVvGOHk+++qTcD0hiU7mJKIKN5WiSBVZ5Xwo1Ie4nfU mdV3Ryw9rSweeqFTpNEpTexbZZd7bAPx7fD6tyx1oTTqLU0ZZBnaOHxGjnlv LvvBot/I31uo+rB94M4w03iOzi4MM4y1PSOJ7T7mygjQ8y7btNl1YqaZsv08 F8YWlQLo62tgv5PCQQrkRDYXcBWIUrUdqk4BnaC3pD6hsuCfR9kdoP5ROBmF GJFmw1t7TnTlLsTBmlaXsGpdLoxFmLWBhnGuzcu3crKL3TC7ekvMoE9Ph0fn lxS77q93o2hJXL9JpWhTjNz3DWeRaDoZRQEb1xessK1P7qprjZMkyiyLsrk0 aTem+pg6SiHNrIVPo2wyk1rK08HR5Q/ihrXANy4o06joFuuWQjvfhsg1bUuW bG/FmrZmzpt1Cq0at1WeNET2kiuNzXBcRpSrpxnpSSLHq+6m+0n65xra+HjV xFnc2ubTSpk6HMZK04Lf0wxn2KbPymWCZgKDA/DghovAJDGyPCM7BqiaVw/N AtMImfEYr40eRXyFJyXYqprs47R/R5x3EBYhl+5SvmBBXGSmj2irSxgaPl18 5OXxV/QKbNT9jorKwowFFPYbrU0CE654q1m1Fdhsa2ebrm0lYOhm7I4U2REU yAySRI4opoxCPf/fQXysr6QhVxGbsipoi8jYZqGY7OiGb2sllCdlw7IvaD2r p3pCTAHFigPvzABXgiwWAtc2dCdujl8hLKsZPcIv7RYOkhuDOPumeyeHBJLn gQoepJmjpqVDj8TMy+MLbK4Zg8H425sqPKdSr6prbdpkrRhwIO1NW1vSJM0F RtihTJqJEUuVJsJcM0bKmWGnOXZu7lXNiZWUtg04G9FAhROLtWM8Ksb2j7Cc omm9BLTOmf2S/fxbA+AbSCxbPza3g6bS8HDdjkrjQMDQ5NDpKBVvS6t7bY6C Ur3fObi4uibjBrzyVwITDG699Fd/e2urLX+nGgbcEsV6hNANewu+p1oDv/zC 4crrsi2V3kEd7/PNNBxAK37cMLd4g7S88U1807uB9ahGNthbrOjB9qsRuU8Y Ew3Q8Ed3oebRwAngVzVT0v56FJfzdl31tkF6X48ic96u42PVRbPUBemAhl4r 47sAiqCyNhukXvZIhXy7LuJRe6gq9m7WY9YQdfdxRffNZlnhxrlBKxgI//Ru YDCv2dJRP5WKb8MlNKSYWkHc8rh8/kLQXMegFn+b1AdRAZNvCwEQ96KhDKvi FI/eFwAUv7GzoevFJhGmXlLgi3n1HIkQzGkqJTCZHk9UwHvGOWzpa3VPxTqR E0Ckp2IaPDAlMw6B48rZGuKsA168jUeoX6hjKltSoNvceIEwh68LIgKTR1QJ XAQUYTjpLTpKCRajcTwSl70YxUtk1xH6aykBxSPQTND2j+RBEwvOJsEX6DKY dMzSjuXPUT6qU3InS6XIvGwlFdGtaKKjUDJ7rphTFt6RZWyAV60By/JkPcSw z/cuSCTREa5chfMtC/5I6oRPT1kd0BNSzS6vU7y8IU9rQiWY0l3jmOzB3FyW cFVlXtChLZhYOOT8CyGSeDwvkj4S4e2ydxfVcsAJqiwO789yae3AYQbcdd07 UbdYiyiDzHUg+CqJU+g6KyRxVGuY0LBaw0yHCzVMNOG9UMOU9zUmS3R+Uvk3 /Ld1b6FO6VhdRK5mqPTJKq2Nt0rJ8DIe4E7IH6ytyKeJD3NYTbCvvKzCe5k4 fy3NGJbojlMgm8WcqdRyMb5Sii+5ynVk3Epy+Yslz3T4vOSZDleWPNcnNX+w UXsGYWRteKTzXOBH/mOxUNoQ+aJDmc8xUHEB/yulud8mjikZa0Wxiq2tK0hV 7bolDAkZqFp0siWgzbJ0YYhCLoboyGLrJWnjfuV/zIW3LZegJtaltqmazg3y oprOaSPholKoWNphWlSUNqNyI9WYcjqsqnkYLfTAVa5ESiiCkXuUQ2GoZHhL kbxmKSFefSdOMhX+r1lpwtJNKlgeR3ZXFKbD2fRUTCKl+zKRYGseK1EVtkhG fkfPJxrAt2eIlHNOmy9lVmIzRIu1t63D4OKH46vu6efjAH4NqP59eANyw/wG oXSDGKkrY1bPh0y5lGaymKj8WZOrsS5EpkxyO6rZvgWmAgD9Qu2/0AtfbsQc ClE+jeLafB3XZulyGjO8qrkQE2nucGYgZ5UJciaSy9hBsigGzjauyotGZCF9 WbRoweGpPHRsDRcJHkZJ/iR6WNSTuLsSj5O+hMsSxj0Zn+zGI5BhsBxuUzaB yovbrOMhojtICKgM41wmBtgc1rh4ROZL2UZb5z4WkbCVf+e9KEK1MkOLr0jQ 9XgWbRgdZiIJlO9eKVDhBSFk/qZQRb6kpRQ/lw49A5dKpTcDbeCnm/FIlJQL 1tHBwl1EdZIqa8V6NtB4F9Cq5hjvQnmdTY6XSkxEFS55xaORw6BmoYOsSE/M owRrEDzElHPNdEDsufBiCJ8hzPjp6fx6b5evd0vSQi/3mbAiDXezTIuoDCTs 7FzNzRakgCZsiNzNunceRYXSQU0HB1Xg7RVjITGaSZRKdpTKHLJxSl1G2qOK Q6A9tuZJ/TE2DPUVM9ugi99FRK6dRS1uXMYUU+8hHo8lZy9kWTJ50yLzOUzz xSRaSp3mTE7O/K1xZvXGBvt0FnJsq75VyO6+x2CIfmlVbwtYA0zaUyVW9WU3 emuk1lzNHRFUTh4G8l59waC36IBjSDM6c8sOJE6nsIaLBuxSsPqGna/uwImw jWWYZXW+C0UMl+4kta5i9RhQWmUaYGCf8AOEfEc22mt8Lr1LoLZzVhFGFBup FoB9voUDOxgIEU5UP+OXK+qryfhK2hpBobF2E+EtLJbuScOLuVgbinS4LCnl FCnKYmKJLi5LB6I1c4WSOSu8WLvz+O+XX26uO2+4AqKqsyi4kXwXKZgqDliX 9aW5jh1T6cWUG9ltxQWtyF1V1WoWYtWTkrCaRXaWiVVSS2yfLmbvId116ojn hr2idC2Kcbli3ZMVK9RsgHmAwNGX+jteH8gYoeoHo4dGxVrlRoi7vIxW5Ahj 4Tz7TGNUUS5UJmA9CGs5nAi11IbGpeDhe0JheCwEO4oQUvtGdUr5LlOscEyy iIh8Hs91KXrZXhQq50wVNq85RTzpOMD8METnUMZ8Gzdt6zx7GRFu3KlupdqL XAOssbYolrzcr2cGl7sM2jHOUvK3eZm0Sgen4joRiwRICRSYpDNRV3VUdZRR DVooHAjLbJoUo3SCt52JpKWnp4n67ddfN+iqcP8YXh0Rz23JSFloGMlfWyIC xZgg3j9M1bExID1+dh7M8Af+8QCLxuR6MuJBEPEDNSP3hYUzbOk3S1MUaXcT EQ/FtQwQ0p+iGI4H3kWYK2iSO5HvS8LCyyAbs+5HMTKax3c/fTQmQMw/CvKH mZi5Ph2S4Jq7miaAE4ZTfHHfuO2dA0o0tscJOgcNkYxl9iy2YJSGYy5HgzZY vl8lJAJOAcwE2u5tOAZRKIAzDize/5Si2fUnXekLh7sfPJQB6jmDsOTTFzEb bsreupHzOJS1gKV8ExuJkCsBQZf6tiguKuZ5CiLjHMFO3EFWsxShyu5xfQkk pMSG0RjXL4McJ0GraxT4WlmPKlrydYGqji0hJUfO6hIfBg7pKkZITKwL12WW mNFaEFRRmGqiPTwh+1DGc7QnYgTwfaSdEjS9QBQN6+s9l2KmKAaLFPZU3lXD IJET1lfY5Ldhpi+nXsgqKETBsH1UVINaf6z5843SLQo6aUpIQjPrGvVH+jZn 2dgItuVMb5WxDtAeUlHvfkrl2SkaU4yoZRPjRnaXrgnp2BP3sfvVuyPLroqe WZOpsvKLu2ERxNATy3OiHAldfU38qOZa7rFAVOIUjgJIa0CSItqxSpaa9T4p 5o7JhLxaXuX112CS6LvCe18e+aDTtbnMgAtVKxHtp/u2YFp18OryLhNWFs3E a+n+UPR2UQ4MDcagBH0GDb749x7O9AbPoGJPxdaLnbQusBVTrNMFIlSrieXM HtZnFlrTYxNGY5/whoYxpSdgwtRAl5OlyRX30L645xf24STNck5lidDcgl5U NQK170Pzvmyt0rplfVqujFxRV5K8en15JrtYS0QZvLF4TSyveAGpx6gfaF/w 6F4TSHcBoDopNS0tZ85/bME5HK0/Ch1x4bFm75+Q3slw+uirS+897EAXcCRs TuQ1i0aFQa4uiKcYJPw44YsFssgTdcftYoQkGVLH/+d7LgQXc3U3fWkm2iao uDMmI2TRKBT3MdxyDRRcKZZ8JjuacnfXTBSpurMwR9+t8FHL3gGzRE3puTsC fkabk8RM6hG0kbyk1hnjehrzrx+4qqXgqUpK8a1UuX3eAQEGuvQ4dzeaSZau EEU6lVRTgG/IqkMYoEl57CwXW/Y8roiJtQhEkYFYFYkMaAvLqVqYcEk5ZOzM Z8ZHqlcQyd9RATuXIMdNZJx0X5NFREWhrZmHZUforJiUJ87JLMj3+4lCezwq 1fTtIZ1JBmOg4Zg6PpxRciWJ2TFnWT9Xflfmn5kKloMncIZV7QthM3BBQMAG vuGJUp08KWw8KZeJNvKckL26ZbuEEs83xt+T6ChLlvPFN9JDUV0fMq/py3GM iXqysHqorqJlc22BZK0QYQuya8ZlVW+ywVuvdhWhWpa/AREe9I/PquHTKV+X FkqlQ15NKG1WgsJLalYpX2iihhV8fmz7f/E7/rdAsP7iH7CMwWIZFgjo0OPW Dnw8gNf+z/diXa+eFQqfXpFM6HmiIe13qfHTU/dTY9us66s1Tae2m4duWrSc j+ne73lJ6VxfRVDkijhaFEyVdk1ioadjVUq7oKIhhFisDA7yXnVWcNmRGy/a 8e+8mGyMWXxv3KgqCm6ScvypuYdmEBIaSmNQwQ+WsrF/Q9F1VVzyyrj6ZKXq KXERE+uJlwqhGUFg5TlSnVr5NCBzzb7HrM+A4jKFQW4tZ2+DhA+voThkwMlj pYGZJGo37Kcnri64hEB+Y/GoaFXp2p5pdDJT8c01AkZfZkT2uZzlPpyH0saJ Y+OcF3j1UBAqdn50CM8PmIuW0v9KvZIw9LkmiplSWTNLQpwoc7yMEJBRK+Jy RDhjwdfAuQmxS2laT93Om2P4FQ/WVMQ+SW3BNYl+rvPNb6P1zyxQULXcOt/3 Fqy3Yb2fYf1/YaKAiY/r+AmbO+3bz7fXpazlS5t1vyNDa8StbDQThOVoPfis qppb73lSAJzvi9uDhU4UzNgPomxlj6YAQmZSJCD60oSZdN498H2YVA5wTiU3 6eMM0yIVF8+59neZpZG/yU/7sLUkn3nrTQDB7MeWWvq3PvwUWD9xlWG2GmjD Iypfn61bRyzPgMP/1IVHyP08KrtDFXS5XgtpGZzerubso/8Cg0GUUlRWRgEf QK4HpNfTxcgOEPMxlh1WBk8xgoMb4brwh038oQ0/UFVjfPYtvkIxGMX9JuY3 YnXwgDYY4OHiygbyqFdS+tcBdQMMnT0d8oZARxuytB8GdlG/Af4R/14Z7fgu OSpJ2sDI2eJ+CxdF8+LZtem/mxg/W9xvY1cSWxFzS9jsL5wixtQ+IjQYZwkk WxRN+9jSv/6FfwX4PiKgPtMP2wgMABTBGqa08WOLYmNhybr0P3BtSofFRWPp 98emUPsFVPm514RdOR4DPrgvt6yXW6WXW/jypnhZtWuX2rWx3ZbejxlRAXFs eARsHsy9pr6skTVYFjGAdIkSB2hsDth+pKvyy7t37Jr8ThijCFP0lD7Lgolh U1vAh4KP4zA3BBVtzRTxa9U3c3+54Zbw92GGSzZi2rRDVDullrFCMQXBD5+e PjZ2DCmIBLmDDG87iwovHGMxgYPD0/Or62YD8yqV0D+nLBQaaS23jIlrxNn8 T+EtBfIATwLCegtw/3SA8oVUhzGUlMxI4hoES2D6HYxRmPY6zBxofCk9rsIw 8+c5ZvJCTolG5D+KU1K0qOge6aq4N/UzG7qSwGBTNeahn3H1QVP9hGTz1qqX SwJ5wH3EGd1sxPcxk6GtJnL9N5FHHyBV+iyo5R/DFf8YBoizMLiqYQL5TGRt 9uMmIMdn+tRizieMY3zlHE71ezJnSJOxvOuUZXLRN0c3kN8duCRQIYcdkp6L NzT0MY9UBhmwdl8wfTZAKI+TujdT8FOipZ4Gr9Ct1HEosehV2SkxxgqAcD4L TW89wAl2hMBAnJaCJZHgUicEpKrVIP8d0Y+PTX0km6TcYYoK8SG5A/gE2eqI fn1s6Rda9MIOj2iwEADJEu6DAMMcFJt9uGwGuAwxyhWYR2Ml5kF+KHWmBWWz yJp7u0uJk3gW3aMAwFKZ6tSy+pgv1ESxakFbRT0Nb9MXXkzJzhAPQErEumGA YJzr3WIvRBZNU0ofdXnYp4+WV8xkV+QU8zyHxut5oHlF3oQSDsKpcMc6Tiel k3kV9onb8B4fdnhwTLQVuFe2OwEQbc+gDv0RNjvhHaPTSD2KNVH5ejrnA5Vf ormKdB6U3MwbnizRSYzcKAMvJk8pwnnUn7a2tu+aSOePD1si0RKL7oYUBBYM gdEmg/HcE6+JCgEHIVDhIg3O5kkSdPtpUVBdgG6DShvIpx/C6DaLkYUffMD0 Z6PogV06QE9U+fTQ2MvuPBEHabtajr+RJoVVrDrfsFnnm/XHb8iw8w0f5m/w NH+Dp/kbPjyqWiM5ENMZAeyYZo1JC/CCZtnfCJ693jXQu+Z3pkR/H/0OR8ig yiauzpFLgrmz6i2ZK+yWcIOw31LX9ycPZg5CFnyAycMxhwWohYe0TVTpXars qpZD3ZPviWohYS7MyYYLC2aCa9GpJqpSgNkIaTda3EVr1S/xVRmUM6hZp17Y YQx/nrqaxZvJjCBhs1t27nw0ZlgzFtYPepdMUqa3l4wgpknEfd0KWlEroYAE qtsKJGEC/5dNYS0Tp/ymfTeihw7RGbqTyKUr+1LCAk5SWlhMO1viuLMYn82w H9xQI+qnRvW2UaGKhkO8oinkannWvVN8RU+W61iDGePprEk4DGALKQjMq/AI 5RKyoSyhTdBls6BEIlEEdzYR5jdmKUpgEkZgLoqmgkhlBlmk8uB4eRpaJSm6 5FUFtCMIV5w+uY2edWANM5i0Acst0mEBcl1otfZgCARSHSPGx1Oj/AHL4UtU HRnSoQm97xB6gj50YiKbi7ZkOheTsIRUFSUBrWrad8R2Ub69i/ShJTPEIAFY Dye+0dvhAK+4EroZhmdJ/5Yjxy5bNnsk+EKqkqxb98peHWPTmXAkQoWADdRZ k3g9EN0Ci5Rz6InouRJ1s23TKVXi/84oq8hmDR376jGZKuYOVVsukSqCa4cb CDhIRZfMHappLM4Sias6XAGWbpFw+98rIxYA30ZptkK0Y0ZTkot8iou2xSvQ hdq+WU85da76dDCwwiHjxomRY04b0S13zOJMHuP6GftMnr/IL/Me7T7ExHNi 3e/ge05mJyNPqSIg7OmVEbHmeQd4U2wR4W1Qb8NJb5aBdPoeRLokvQ+Z+p1R 1SfSBRd6W9DDwvKQvJJeYNVQFObDqhQHb9+fNdtVBgljmlVGhFJ83pK1i8LC 74Sf+734S3Hc735EE9smWune/9iS2jeZ0TmX11LFS7aHd9Tq/SLbQ0XagTLV i27tO1bQzqD24g8yNihKWezbTBaz2nPb1Y6iiL7amVw2couIQho55Zo+2sFW zyr52NxQ4IOmdEo3Xc3eW6KW+wvU8mD9He7lhh1CSk0T5rO3IQqfLHpgcci2 v4417zY3nqd19hAwVVLEm64CDmrpY0nDlm8h2bLUa90b/IAICw8JG6liBFt9 H9E2LjvYctRto4MWd9ASHWw/p33XbNWbT6phumnWSYN3tPGarYqX3oKdo/qB mFL5CNN6T8q6j1UL5/TV1MopGKlSK8cg1d9v0uVg1wDEQNXXIp3euEZCETPy lssAP68/DnPBpwW5p/R3xEJ5XWyJRVS6FZFPuH5UYBbVTddDnwY2hhXpHcLm ZbffoHif1RW/EPbknhDn4UfpmBmI377F34RPn6k4E8+BQUTpN7xg9+Dg3dml qGElokYEkDCaEi8OoPsz+OZiAKsm4lJxdl3Q+z564ucLwqCper0Ue6Br7Q6m PJrKIG41xxoSpzSLJn673pJlO1QPoMjJOwoSX1cbFzqqVXOicm7Cq80ZTWVv tTszGdEl64WROKbisGgYJZNVRXnz8tD9HjqOadNssNLMof9Zri0MMiKNrAxO NfoSfCnN3Rr+U6QDM4QdScW48aU5xqsk9xs1dMkKLwxaV2ZIAasCxvCozyw6 Zla4ASFmxnlNGBFH0b509cWYlcZn1+TJnMBSNXlx5Conwv5ZHgWePTuKym/S 3DikYI5CZjbKrEt+n8sCmxkVldNwb9OrUzXUT6WVyIvWiUhWowmOxUJbaEdG eMbiCJdLa0Pg870zxjBCcRO/PN+JLnsubxEU/m3r4mpZ6DPmom15OixgEVG9 dEG5CI/j2FVBkVtbW809cf/rzs4mEQ03MlHOifpTWuriM4oHoMj95QdJXNfO VbM4P0YFEtu3anKVQjUpiTVcsEg5T7Slwo3O4btb08UT/iZn9sbkR9BEbO3O +RsugGE0FtcT8Y3ZOD1xey6F/hkQlrZvDWZxYfvx6dHmTrtBpj961U7YxnTt 6lNfsw+yQXhNNFJbJlCJUNI8csrUU7njDhZyfLe4HVpvFgqE5fO1iPKGxlXo FMFpH8XSqUgzazoq9NZfHnPl2YenvlwzbGkBpaSHVS/kWFykVs3yPKnbmh5X u4IEJfRZU17V6qQ12Uqjk5maJfFeTAerosgxDYOnXe1FWIllcgIJr8iUz4V3 VRZ5US0oxp7sFTXzFpDqFSpNDUQ+DHbc+O22Lb3Q501bqyhv+mZbC00EbImi 6wQ9zwZ03VvQVZkrWEl+LnxgHbLcg+rKLH68WvGgRWtg5ikQ2nO4t33lt7T/ 8x7TXuCF3QO53SpFvWAckrKbWZKgWkzYKEnollFNQ/VGHEpM65G3ds6W3NrK M6u5Zn404DESO+Y7PZIw35EBjpuyAe4cSZtY8PdqK8mAx81c6x03rbDe0QN5 X+fhOAozHXKJVdfQdPdKfgz6ooEb60znW+Uj/ypTucqumrJlpuaxBUI2osB+ 9nQoc9Ut6EIZahDGfcIbdf+iJ6vGGy+/8TiPQhbXgTMfjnX6EFWwIFuEqAC7 1q9adG2NBSzPdU0lc3sxWoRc4qNilwrVl4gCXpK+iM9/U1qZuF5WbkCfbtsh iGJKDc4Xs35A4xA3/pmB8expuRVp1E62DMf13PoUe8dwV4vIla2Q6jnp+tzs gal5SWqA0bQ7cRSIMD+KtHtZdUDQ+Q+nWGmIh7mkCqveZdDe3WQ2fxlstZqq nu421tPl5PwcmJbKnrDqCpKjGCFh4yqrYcOQKnUIRkqh4csgxfoyt1b1KSTv hHHWsfD7LJ+Ja+xyWXxno9ydRzMWg90CKxgORRUMvm2vxDuISwoXuBB4BNk7 FgVMyDFL19gpfJAYK6csjBF+YVJgVZtJitmux9yJEgCEFPjYEkl1xn1iwF7J yFLz2ZeOTksKbOseHB69b+w5SQA6FbZ65tCdvBhlnHJBaa3pjzHjiNI/cZ8j zDQU7s66fzLDQgB5cBiibBYNQkz0k3M5eX/VbMJMsKJLWr6kSqMDF0RJMbNw Esm0Ajk8SsoHs0GWJjEjJxoBMhSSDy6bO8KQRUVN8H47445MIwFNo5PHZVor whEWbYcKU1DJh2LihDsyxFBdSyjzX8kcC6PDy80WHC2MViObNsE8UCS8N86b LXgcjFqi4LkbgbKuYwXU3TIb5vZinPOdP5jRIeTFYMVrfxGaUiqqm/JhKLFk wKe6cL7P70qfMVpNtCJA7meUKCpN/IJp0P0DvtYtlcgsqSrOCkQ1OUuzjryR sCGyge2jXPesS+0qLXrUv+p+/XLD3//evyVC8K1/aabofPkWq5tzbYu8mpTX Ob9PGmrckBxB6hZShpokQTADT5EX2VgqrM8yFJlmqOxFgwmd2ecGd0DtiYsB dEUM4T3l1BW6yYxtZdniuXjaqiopNK/xO3Hu0LIk6aIdMck2PdM5YZUxWsgh LKDdqk0Q1+shT6gaB8UAosd0oYiACO6BqgZlaIBcHSa3rnp7eiUsRU7BDy56 YtZRyMsvF9rA4woBMF6n2oKFyYRKA8/FsZRSvNm7UWkypwvQVYxGqAlS1elE lwDPNrhNH4rUuvBO2iilukBlgGKMbu2Y9b9ERh/Ld+6NktaQ4ooX1AYY0zxi adIeRYsmxQOtGfzVMvlZF2FaN3ciDDE/3ZyXKHNbCVoutIj1WHS9R8+9cY0K Z8VUXBJkRCq3piqsGZVdaC4Vl9PV7WpG1txYBHHvWixfBCJgS3q0V53unys7 uOUslzWyxJ6JEVWJrWI+pSuBnagiaRNVoUQcv+XaoRcVR6rGY7oAJZaX9Bka qVFnFmtHiYJMNVn50k/w9EqLZhYN+WZBadQVuOhX1G6yrwWEbtw6B1SFXIxH JWAtwNQkIZT5zOsOmKgiv67Q5K/T65HZQlaiNWHJ4RV0X58tm1ij03yOa+ae OufILrGw9DY/grhut+T+PrMlOkon/l9RKeEQLnVm2FTNyekkNFpR970wx3xp tWOCmbp3uxr3zQV8T+uiQpfWRX/GPRXrL7n117oRJ/DPrBK/OqtQElSzZoR9 nRapgqWLt2oyyQ571ddZ2ZEDVZda4pWG41nOOqyOl5BqnCtSysISaEmzVLq3 NbETRv1Kq2wczXpYq6pnRRZ601SATZmBi71nLmyDyZXZAExlk8SvG3ZBN6l6 cgKeXrBVI8Ef+oa5wDNiLAwIfa755zXbPlmjaEQsXqbiBD/JsESgulT4ns9a yZkk5FAmbKzjMEsXbNwMISG6gRpliYdfl5JijQlrH7QI5jTu2531hCCRO3zV UGQqCpJy/eASJwkBIHM4hF4WUewRiQAVPEXGyMjKaGxpkPQMKywBo53RtlnV MkPPIHuSbNW9c+AFKeWJhyXRgLlQxWvSYaAKJ3g0+69CdJNL4gJRWp3TPdEF 7J/kNVTq3Kj+hdeIMNKZma5xAEsqTcy8pALLo/ziH5v2u1+kePiLUsh+8X4J rH+/lD4E0IbtLmRwoX4u4cOXm7+fH+2Li26+3HS7nz5+ubm6+HKz+OkH+H94 W8luGJIPxM4YoL27yQPAB90FfTEHWPS0NAA8swdAAxENAB90F1vNlj3Aoqel AaChGIBOFLsbcQD91eno+OysJYZ5po07GLUUo1nuTfvr4vGebbVsRJrs5uau QCX5Ffq5ONmnqwFop93lLWzijrVJXkNjbTyW+XXJWM81WjyaTg2h0dTXxfi9 vIk7kmotxtOGlTdNX3yFb2+WDPhMG3dEaZopD9gyB2ytMGB1m6UDPu37rHEG zJSKuBhH369VaKbo73f40dqvXGjNqnNXKZ1LtVYogIuEeKWi2OzLyB7Rajxx SCXcStVQ1JAxLg8VwocqLsM+mAMVQbag3piUiyqFYxG2gKYfrXvZNgRRmkjX f2LP9LEtZAuvwsJh3dHsXA8eYoHxps2X4i0qUCaVMEvydFM7WYy3BFGchZIQ q0XODeGMnnP6SFzMyGBj1RiGZcLBh2lu8jQZB7UQ6sqQPN2iJP9oycZ1R0Hf W3W/U2GpckFQIVUKQIgKiMo4wVcDYKDlQscCm97kxZPCb2DYrdgoBJPb5oVj 5XNLnnBnp8vsqqJ0QnF0k3XIGuuXtESOkDROtCEeqHNJzN2xOcl8Ly6dbtib lG+HO3EUR9ejs1z8iLWL3rlhwtJX90urXTdAgxrX8X51Wrso646gwdT17/2g zZ8P4HPjcSvsb7e3Brth2A732tFOrx31eoOtrZ3tvd3d7V5/e6s5aGz3Gv3+ VrvXGG63e/2o3W9HrZ1Ba7ux2UO9eN9v/YiACPBvC9ODWz8291r0dw9/bqJW vE9/7vbxrp6ygrf/8uui8d6cfXl5Ieqc+/4m9jzcX7EMLEbH7/tBs6HUMZzj 4g0jThLLEEW8oQiYwtLtrXkcOaAd+dauEjK7+GrvLBp8EiOAWMYkV0Uhl6uz itp0OE1C1diuaVxOSV50WFDU1YcFBdXfcFiwk+cOy1JR+p94WIyzIo9Kr91u tobhTtRqR9FOtAkHJGpsbfei9nC3NWjuNXebg73+djSMdpubzWar0W5uNnZ3 h1uNZnt3Bw/a1nZ7bxfOWiuC5oNWuLvV340Gg3bUb4XR/8feu7fHUWR5wv/n p6iBPyhBlTrvF/OyOzbY2IAbY9N0D8viJy+Rco2lKlFVsiW8zGd/f+eciMjI S0myMUzPzvLMuKVUZlxOnHucS2tIicBEpETNq5ZCQkRJUTimpCJ8z5SEuYWS svBdKCkcUNK1ps+Ikq47+38mSqIDemdK4kv/D12L7B0oiQa5iZKutRn/cykJ dloCOVOkQa6CuiiDtgiLMgxKv0rzJPaVKsOmzMKkKooqCpI2qvIqzguQmGoD v1BBkgZFVCSBqjNVRFkVpElY+1UTVVVQtX4WJVnUtHkeNWEdxW2g2jgJ2iZO q8SPWt83tEaAHFKVSJP3SVUJEwaoqngX+RQPiOpac39EVNehwT8TUdFJvD1R OX4Mbs/di6P+sOcYuC2ZXTukEzM86BlAySfuUMMbz1H4Pt0fbNV+v6H2c2/e /M9Hyy+OV9t9u6zb7cnS/euyUXXZxjKpOOUlxtZ5R7vhB8U/bKFSyQmRIjFy J+ndxufzPtnENQmTLrP4Ci/EeZqmIf/6NYVtdUpmQtRa/MHqpCVXo07eouuC 0Kor/3LPu52ja0iytzgYS7hGLhy88APgb0y3csFfEq8O+MdGeDX0mLRWKqzS tlVZlNd1FvtZkWVZofIi9/3M98u4iaHzQLWpskRVcVOXQZQUWV5GAsFhotlt ukRQF6I7Ljn2YpndHIkuvToYxlRLtfEua4sjf2810E0EMslu3+bsfg/TvZ1z dLi6W+Hje1nftzdIBJuxLBdVNqbWvcTx2J1hfWTGvSupGvov7o4OiQdyzTqc nH61ooGY6lsJhqnB3qNQMJwee397edA9fidZcL3P+j9JFEDTi8J0LAoI8Mbf MFLgwvh2EgE4eEAibFpXIjA0RCSwffQ2ImEZODIhtpR7I7DHbOXaT/5YidAJ hGVU+HnwXpg69rO4DSsOp3l6vHRrtdxqnBvw/DBHvx3o3wNDf7u13QaX/lnZ eezk3fWZuWZsA1buFEX7cHRZ9TYmdDfQyIKWYmuY+hb3an+UBZ0NPars9wl/ LvhfYXoZ/yt/HrO/P9+/emMPLM0JaYH3P7pjKr9NFHzruQ3wpn8ZtXkWBWXV NGkalFAs/bxMkiRv/TZpwixURRI1URrV0E99lTSxn8RxVvtBGcdxEmm3A4YK sixwCj4JE4mWhwo+jTIa8aJ7Pdo3ym9xyzok3ptx7J/HPO+SfgCdXlWvjpre 3njv7notSdvL2dtSNGswO7qdJlZCWRySrd6NPaJy+yeTKKjvIrtQomG9JChR OmJ/s+YijTvp7gOW9i99NW2Y32Dzm5wShJ/r9Nfe3foIAssTAsJtLtz/KE4U CyfyL4PSD4JAlVGRtSotyrgKqjKr0jiKq7JusjSGsK3yuI1y2BJVm2aR34Sl 36Z0YxTG+LRqYTxWQRLhf9uqaFWr/yvLsvqzuFca/w7u9dbMi63nII7TAlZw lasijqImLaLSD+sibeIiDytflUWeRHmkVJqWeZOTRR2Uqm1y/E9d5EWUtnlT +spvAfykbuMw9/OwSfK4DhrN22SmUIVQzZogSPPcj3w/yCs8y7MEg6uoCv0g rQNwzTBuYb/7pV8VdRC3tWqjRLVJUoZRGCRlhNdUWSZNUNcxVp2rIAsr5Y9Y ZxC8He90Edvlnv5lg7X58h/9b3Aj2k/y01uQynthqP3EXH3h7fSsFrNPsygu REPRg2vdpGhUKsKmSxxKKemXWJfMo/moslzyJ/D6HsO6Hbv/sB/QM8HlQpfL XRPl84dxOVOw+hH9sausNHtAU375YH7+89mRS9l/Dkukmc7IoUg/zIMFlmfq C0gAOKHTA72u2SM25gJdm3g9e/DPzUuX89AA/C05ahj7+OujjvEFfhD2TrDP pN6RQ4UDDlXVadH6eRsqlSVVRNw3LYl5B/glzPNchSV4ZRAnJc4+L4o8bVs/ ChJ806ogCos6bIOMNNmmKpK0Ae9v/QBMNgR2+KGqfYUpmgxoU4P/F0lcV7Wf Yqg2LaMEgiCu/bJRFVCpilXuh2CUCTClgC4c3EhB1zPMw1T3X59helNZrXOT 1trz+B7pmLWLs7NSkiEZPW5IJf3zeG54WxX7C1OwRpK8pgMSu8QubzJrnoK6 taKrTndK+EyvFfZianxPpyNJo5mumOgdDju8vyCeda6bJfBhjzPDBwo7J0ft dw5rllDCl7o/6cU5FWmpuER9P0vrmjwXCoGa3yK3hVOMZnd1K0cOEQV2rmoO veQV1Gp1Oj/dnITz7RE3fTI8mdIk6GM2G7j8gV2AyTnvd4W/P1ESITqWTukD wlscjoG7BUHGGFS3APxmIuWvHxLJYYR6DZxJ2JMdNhZSh5lOxUPaBByChpM+ M8y2AA3tuVyibuhaDmImHx5J2KBZjFNIxbg6p7IGR73kf5PAVS7iKUXY1ldd YoNjBgpz6hqFY/rMTq/52J4rOOnT6CXN4mzv4zy46foga9gzKdMO01rt9Fh0 L0Cbl9oJ3C4UsNEllZ2MYd7EzqbhGW41EczpUXXMz00pcyrrqrPyboDcIOPP sd/p24mMP63e2U88z7y96xKvzTqGihxFtH/+t6c/3H+Owf/P/5l98PwD+p+H d5897D95fPdJ/8H9v37+/Ie7T/UTXZNHCofxgD89p4RHGkh+wgDyA+EAPv6J vwYz8u4++/zRo6VQUGOSfekkCerUrjuNu/y/HfcTPfYeyFSS7rpZcwY+F1vh 0dz3K7V/rcC+/ctQ/BX+ZQaq53hjau541BO3TCq7mgWWlC3xL5O2a01NgOPM qrt0Xg1F4RJMyQO7kFanOr9O4pnNKZ8CE4+k26OMwDn/a2c6b/7BT88/WOj1 86S6ruMLdXq+c0rf8Tq7M+baSFvw/EvdrG1w/L2SHVyixtljL03cvMlR1BaA XtnuNZkNPz/ucM2cvcU4UScGVoPFDLoOeXFxVq6XYPINs3ibVNkT35Oh8FxM wqDWrYcaclHD47yZjR0f5hk6/NE0D79FIqUupiF/vxUJ0n/3//Hk+fd3v2SC utNR4V/vPr5PL+HPP/HfDdZNRsob0aDHXc4+gJL5gS6U85YGyLEd4tsHh4a4 4TKPKzDKQdE+pE7W4LA4F9rcExw8AFrM3Z3R9QzcAmnB89brkrRAvrmBubYw Z2BQitb5gb3bwRsf6FKS4aH5bgClnS+SikST84k1wG/IfNpr2+Ua9qvMHMqy MPJK6TJobtE9jDqRtbuHUIXKoNmFoJc4Y4lLnZsuWiVXD3BrxfJMDh1prdru S1fy0cUDTKWTenOKVc6B5R27i+4eMVVrMXFrou5XxOvR9KAOn5OlobtdiyY8 4d7QeP/shy/+LoiP/7u2P/FcWqy6RPOMm+vRxwMLZBBwuJhNWOx2FLpSlFHc e97BpfdiNrzwZVAaIXuH60uy2qMP10ilvl3ZNSTq1T6QNnbSUIVKnjiiVZfh HozORXOtamY0f6cATTmlQZOaO1KibZKSN+sr1IupA3vUdopFpU5Wa53++8HT bz9w8/0vdmpUH+L4pjH++rfxGBNpLzKKHcKJPcFYOhsZgkbgLHDTvKX75u6/ 2SqlXdVb7gk2Oh77gqFKHsrk6g8qpEG9xanRV1JyTVZLp+tmglP1awqK2cyw BFGQy6aRUgC6NgaMKS3uLWVLWdgroe2djPzAnRyHcOcHH8gsBqSrYtudi/bt 3Blv1jKwWTcphbNRUjOfyEL329Hz3Hnw7bd+cOfe3adB9sHsjEx2wJMHsyAz 6Fpag4oRmvL8pAKH9+Hs0d2/3p31DVV9S2b6fHM7rPVG3ixNziBV2jGWcP9z UtinLeDh/ZvWa3duQ4bdgUGhgV5oX0/P83CmQK/r1e5s5/Uszn6rcjYynmyJ 3PYrKQRnoHvNepd0hLTq+6T39plJj1qp0Aw0bDn4bbXab8vtlVvbxxQG33mr /WxcCF07URiTGrF6y34qvxTV5X6PpmyM11vQsfdI2pmdUTmrUsrtra2TzJTU mUrm50IbVN749MozrZu41phyhNB0dcquUuPaVGo0bZpUuVvBXGmkRtDFavei 29p0PZyp6kS3L0EwmypB4P3hJQjMXuxpANfubfYvHPxya8HaijK1CzHTW21/ 5dY9ZetZfDpypQxoV6V4LQU62kMwSnPsNVIZDU01JjYXJy8As+AvW10xVh8E 1+Y0fWwIBOoEcpjLRLLn1PWucMEuAAHg90ZVNR5IqV5TbFKXIRQiP6V+pi0h iC4/Sd3yCIWkMiiJgwMb86RoRj9dVYNxNb3dY2/O52Gzms87NvBic6qjJXva QpfnLC1zTDUPCq1kAeddr5pquU3G9Mj90feDHXlPbD0Qi++DykLdajTekbgl iaUrhOmGNB4Heu7F9dTMPoC9/MEBgHRoP9RT7D767G21ewcorMSB0LZqSwtg HVfTf6+siTeyMBeaJE3jOrew4PVDerpSCoZ8/PShH4vu6LaMfvPmwYNn3/8g 7ZrevPnmnq7P+ObNw1A000cUmkEeAu4upts72CVoH/SubJVgP0ubAzVevAM1 XqDc7S7ODlUNM8Q75JKeUxxu1ASU/DVPybO+5vYKupKn9uMJ6j199oyKei4o aFdxyRft8ekWiJVv2p2ni5dxO7/+CncstFdrqVjp0g9t1Lwj5bjPT8sailN1 NXFoGpwleNlKivCsKAQGXFnUPl1wTvsVSCSbuGZh80bDtyun6roW7LR0XS7z OiwXteChDpQ+x6G83lDI6TUKgXnnN01EL0Yfa0m77solzA4rJlzqumxI/YPG QOgyI3mzFlamGZsWBX2/9Rzc+BzinSAq0o/ATLceUvBNdM2FJ17v/mgDuj0y KfmlqQZcbqG+bLjsMlRIPig8KPf7sn6Js9rMyGdxQrMIefAfbGFht6AiM3ey rNQlQMq6KGvY9WYHdWP2Ul1BbduuXsmpd7uTZT+59/UXD6jD2v98+uDzMC84 9nbHxKYfZkXARE43xNuTzTocJz2V/JzYmEYHc1a6XY3Erg/AXe49twHhNZ46 rgsMhr9iBR5Ma0WMstb9LHhwx+lDz7Dp2cSmPQfntXORyxfqIP6BL92Gi03e j4hbRvDb9HpbUonefoeCw4he649+63rFyfcTIbrEQTohNURxZgbPvn/67V+/ /ObfvGFJLvr2gotSk1b8arNqiABeirXdWYFcxBTLI+N8vVanO6PuKi0CT6/6 mq/oZvU1SxduYlpTbjxjn690IwBAZovjlivlT2lbXc/JxbUj77hz1dP73/3t 0VNTecxKgBMyeLDEFd9zaMox+P7mzQ9PtRRi7nLtLL2mBwuGJAVx9AquUDuH cfUWbkA3KMGx6majxanF8BrI65V7MRXFe3qx3oWC7d3wVccVcPRsB3lOZ0re 2/0L1jyNewAn6pkTNV+fQzixQ4qv0SDcy5M115Hpnb/lWazKrVmt+UK1xpGn ocwnZuZecTF5HoUlRw04WQ9Px5B11wOO91yXbpFkM5Ap/+ua+A3NvVPaRDOc xoGO0OLIoXLHcJ2etce30z2ZKUd4mF5lYN1MYOxnOqDXmT4fWrHoG6De2ABl Vxhm3O219t+WW3lb6ypakPe+JC8r3aNjYGN2uL4t3WFs5TSCw0yA9W4vzYTJ tWHUd7NS6k6gAyvYicLM1nPtI1tt3xTu662J/CFKvL/6Dq6cdTes7eZia2rZ 89JdS2EM3GnteH2l1+wdcOHuRm5bXc5QZpSkB3HhQlaYY9mR5gaVX3pu671h x4QJF3Rj5dbVluqs1zl237x59nc/1TkTDzYXv+gXv19hGfWLFenL3wchl7yU dZj1aRTXoy9HI5t7dNd1zGX0D8zh60U4T78n2T6YVjvP6PZguo/47dzPWIlt ENuVvTddQqfnnOq3In7bG53VjyaI2fig+oSqTUchQfImnYgUxR5Wp+XWxPUQ ZdjeiPeAzFtnF9bc+XT2GpvAX1sqR/1S7elm+XPNOdjgbhRwqW+DPKznR9pL qNsm2GZgfbpek+unMWXED2C5aQ6Ct0a71Y0X2RbiuvfSGr62/o2Dahf7JG1Q REC9JTWALMQ808S3lYq/S7AodivKRzu29ManQoS+m1FnIQqxGHfKcHor0JQX 1AaSZcUHKwim7QcDYK4mGMaCrwRPrxZDRVy315NRqaY/07jLLLkoaAsl88UM VASd/Gx3Yvopma/oD7RvnCP+KnXDoJIr3X2XuaL3xLCO1RmJtE07PL85do/P jVeFy7Fz9S0IPD3J1cLrz8xQMzKF/qQ7dexnJ9QFbMXq8fmG5KSJOuFxjoYb 34vyw9FEunq6OYLzreIls+b5RFTrwdpNHxxTq3h2wV2EnEZy/fepNdBnn82e ePMR74FK/npncFG336UINBZMDiYYDuFwQ6/HDekQxgxrJxQw4kQ7Tqs1YCfK cFjPCFoScLRjnsB7NDAi4abRUZDAnAx2wkfjlTsXebCwvsk5idPH3j2QydU5 6XAwdhbCMG7FK8YtvgSjR/5gcQS6PaAWdFvTrZzwcuQf0WoTO6T3pqpdbRpc PRH5TdYfGaZaE+0vR7S0oV/Lau+H9S9zKSEuLBHkB91jvWvbnutrysPlTTnN ZtbBpbWSQZjEoSqCVDn+DOzoVK6Ey4mjJbrb7BwpNaWJiqNoISfCl3nCOGkx 3nAxxEK3m1dqqNQecAhKc12wK096ETjmsw2XsProdZthG+r6aLQpIMEGIIex uWT0SFAPduScoEhKk9OllOYUjp3tzanoIAPpcHDoIDKFWs5yz+C+9BaWPXEe Vk+YqIXO5QMoulTuDOguizxFJ8Q4N83sXJ4PsdVwCx0lxp9pgvRMyXTF4ncc uPDgSCJhzpTpfOV2UaxV1whaWwRe+PNLsyh+rmu8cwjs+dHsk9lLriAvZu6m NT1bpcEUFeDYNBenm9m5btb1dnscSlDNyzxiqN0W9sPWyrKJPo91L16c+z9P ZhIO+Cj89tkTacZnT2VvqlDudtalJ2dNvkHl+gDdDdimItRyj+zLqcCdW7Av B/u0CTk10I0MrIfFdM90O3of8DLn4rEjXmYvEu/98NZXCwsK6X4ouEiKx4la UsB3M/ClipeeZZ0bYHOIvdj+1qWpumpuMdX2TF9ykRr+xZMfpEU35Hdk1/FY bV/CGPmiPDspqafM1FK474ba7Xo+UQn8PszvMOXnXzx+4idsSbJbkm8w5oHo gPNQX6xM8Y8xj9NHLpqnZy6IO/l+YJSHztyzeXRkmuMRX3p40/YXU6N6PZuo 26Tb+jxhjxTdfKxqEPF2Mb0bq1JWPz33iRQlrtQIB1ONlw14wsLqdFO/pF35 SyLmnQ46v7jEwsgj7roo58KyyDV4QX54Ue2oEw3ra2vNQjViaz2LJ+DlrLD3 2f+gqhmrkTSXxYsmbvqps1x+tWFP6cOZ0aKgTi/0ppYULOtc8re8ae2gobG2 9K72vphWn+LmYtarF2qvZPme6IL56quN9vh5whHBf2mv0q7ZtHmyCQ0PDSAY Ip5x2JgpGSp6YJrqBWO27AXPW4r7nZuX7aI4thlUanIdBObCcpm/zgHQ4Mg0 gLRsdWbQq1Y2cFoG0NGrtuixQTNe9OED0VYqBMdeZ06wlWUWJMGFfBHiYYLL zXZOx7Cgw5ivqMrC0dFsDuX/fBb4R1SR5IVuiciB+92JsbNRxFpNeSNaxX1Y nrEjudG3DnZT1rFtd7z3nJPjgzH3/FvV6cynq5fQj15sTHs/WM7sJOB7OsLN h16J8er9WMnXZ0HIrN3mosd0USjTRCk2VRe1ZF1p1DBIOoMtzy+21IhwQqA4 N4lX4npjxQ1/WxpM1rTGnF930KOD6m54TAtnR/KI+63ekmdtVR4KTZnckPEy j2/a9LWmpwPdpfXUzOleRSxpVb+UWB0Jnan3TtgYqEhnY40+nYhf7nraHJb8 o/ZXJMNh+MOE3f7GWQCDXBC6Yhx/ZZrK63OivY92561GUf6Dm3Gx6g81TOkc Bp6uEc5SiD3upPoOLqohGWh+AG/VzBSH4LRGfZQQi17MwESwh8UYwgvHCumS h44ntaUO7qPLsIPV3QUq3iRKuBHKwhGZuduUkvFH+/LEA6789Fw60Br2rVNP mEsxp364GBhYLI6hr3DfJ45LXmry6S7N599KcM6hTTsxMGOby5tUGPk+iHjt loGpOIuAM5e4f7z27VGjyOrC1EDrrkt15JcQN2seENdL1kA4rRnK8QPnEu5Q q5vO4WLP16XlYc1+Pb8iHaCeJGYrX4giLjR2izgcdqJi34Ue0cSc9pFVrlns IJQOxMfg7uV4EGC5uzg5UdQQiW40bC9H5hS8apYcIzLlmQ6dLmtWpxy1SU4q lt6m6279YqXIyTjqyie6kPRmElNrf2F7JWkhJDbbzr1VG/YT3r3g7uqzF6uT F0tJv7SdTO8ML9y4CcAJq/TQS3YS3C9EAeTumCvv1qEVdklfnIjnkJzXzLQe imgxnx9LSKjZ+MTrVkyRn5dPnD8o5Z5612uQ1buTx8q7WQYAuEZUWo7YP0/V WW07T9+wPpQ0sYfhEbEA8R4aHYJBYoHk5FPT8s0A5u9B9yN5Jck2m82fCYPi XLURboESJSS714tXYgjF+Bt8wnEAfa2FR5jCUS19p9NlJGJbggY47Mm5vOVW c6N5R+lUNOXDx3c/X8oSdFRKQIbrp11ap5aAC+40ofcY6xD474fqze4gsJyD mz3cbRbGdunyqfBUHPyfzR7SD5RRheOg0ziSt+w5dqzSER8zIz70qfYEDVs/ V5LS7EQ+98wDM/wR4eJZ+VLJJe4osNPgFY815xuL7lOqbbTrvDMm0oX5MKOf AZ2DMiIrd5MsV+wE4pwWnfsIxKM9nLFcsa8IWCiwY7ciLdpCTl9mT3EKSRif zZ+IuaVNldugvEvG+hqG9yv2uvHJO6hh+5tMItH5NQvoodH5bgqNzncdGmn8 IVTSGCXGlM/G1EGsGlmcfaxqtO4CpGI7Wr/Po4ldwN/s/svgF3/REYt19jnA soPo9sjGGiPJzRoF4C7DbNUAxfbaHcWvDbiQsLFe72xxlHHmKi/CQE7E2UHQ auOPx1s5vSslXxxm369quyF9dVLXd0QWVycodSKLMzNfDLwur3auETzi5gf3 SS4zS1xvI034XS1Spjn720kUKzlsz3BuUj1GjoMZpOT6YrlxAwXfJAbOJ8XA +eYQ/WqCfbTWpSJERnXAwnFMb2UxJHLJflJdZE7F7vjZ6WZ9YkpTVOauWJKv 2ONE7xjz+0rHbcyGFRiOzSqdlstuBJBtcbvtJjYhbBpPdT7Wai0U8c4siocZ sKnfx6IEt1w29QezqC5cwACFPXwDudalXrmQNlQPEM/Ksw2RChkPDuAltVfC Ik4uMOd6ryzTGLIxEwDwI1hCKTh0TRIx1khusPjIuKV6HJQkusNFD7JO47E0 OrI4kPZKXL4HfKuaq2rP5FgFmEZ7gUJ5yvFjtdoSQE8lQfEAJLTjmW29A87A hQkvBO5ttlrS9Pd+3b53kxu3zmU5PjZlyIhyM4qkhMts/o/HXyyJW72l8n47 Tqu5vehgzBLN/SJP6arUEzF1w8otvHfRUK/j23zzaqKBCIBff/EAE8tkSZ5y /kcv2pU7CmuqG8rabvNmSLZb9G5W+gB0W16KO5JAYh6LIr9HLs7+JU7npRxu V+jnFs7UXm6t5fnaLuEOeNp+ueVdNL3MV+mS2qB3qnfItji0ABhTVyZmGttc THAmsbx4uLWqadXbK2nI1/X57oH+e0rG1mV5OkgKqhAomUQZpsKhD7DE68X7 hEglKYphn9s4ms9mH3xx/+mjH+4zZSy/vv9vyw8cc2ugJw/HsZLZHfPI8HS6 GRrgBGc/9WPytpse9Kf0gG2nB/A7ZsqFowqQs5IKfJ3SUMLqr6Q/u4HlT92u e/zXCRrSGmOfA01ouNNVJBwTjUfqrn52YpRpO6bTJI08AG6T9kXx1Rr57A6E TbokzP77o+OOY92o1C9kVGqGDYo+PZN4E8sfF5OsWG+VeJuQhZxSDzt5V6JL aGheI720nBCRyZLBX1wrMOQ41ge8lJoT2nR160CU1WrjpK+LUmLKEAGhI8lF qSz9bcj+IOUZRKJDtQzBOTEKHDdHYz3ARjti764uSzR9KK6QkVMx5Zf1Ykei e+AUMEfW8Y8Dp38dzI1Kuj9g/zPOTUikAcRFITzdd/ex/M39yz3VqqDfDbpZ 1iAxAgShW1EBX9C7Y+qLXIn8NEG1ms5aa9Jo0JrZZSqnqTwF99pKKjTeo68f H9gE3fwy8euoSrEVSE0xiDbflbK/M94Hl+Iw1Ru7HEZTa03CHQQNZJ5zISRo mashCLqb696G9WZdXLpe8GGNrD4+efo1x/Nclhw2Qds/kqu776fqCF53RWfq Buo6BE618pnp7Svu7an6hHNskXTWo4kSRNK5QrfAtWBz+P4w03p4ndlxDh2g QitX21dSv4eArUMwj2d/51AoEIgjTropjdk+qrzo9Y62V3LRCSHnRHVJGS87 swSMhTbTbLY7G0cKSHAxSROxIsnvEknvZuvMHtNNPIV21Dq6oX8rWTav6Lpd ag6RV1/u0Hlhiu/HCQKDhfNklFlsQk1nd+uX683rU9Wc6KH4OrG8AJuASfia jVe6kdfx0uuXs7tNeTb7plyfnCpZPV8vKjAwigp6TffVF+dcJtBJViCU9T7v el69ecNpDp96XwDg92D5vVjMPn9B3YA2hFuzJ+V+T2b4PbX+dyrIN/tmda7r a36jKCBg9lRRDq64PLBx0werU+R2n7JP6Ivy1aqx48DqLdfAHMx5sW226tfF 7MGWdvWFWlMk8TOF9XyhXp3Sq19dEB+efbGFWY2l/PtGbaEFlyWJg8cEk4fl WXWxPVnwLh6W25crCuX7AtZ0OXu4OX+92TQUIwQy380e1eUWVvDddXM1e7I5 vSpfbl7ZPz7ZbNc04+Py7Gr2tNxD2FTlr2V7RRPVL0osmCtkL7wHwJrz883s B9Kxt00pMCFcucKz9YuNauVQ1Ok5WUVb9WqlXu8kPAaGcsUJtB4nZUrgBM7Z 8z4mO+NFuQURfbk5bSqFXQFGOI717G/rFVeHARbNT/iP/1rvjquLY8D9iL+8 f1riWACVp5srnMFDtv6JUTqfAiG+ARFTnBJeP8brx1Qf/V9PqfTY9sXF6XFZ H1+8lAFp0wpC/9vt9mI2P5PfjkHJF/8K3nDcbqFNLpdU17p+6dFuniqJHqeE BTCyrfyqQwlJhzpVZzrH4FzyK22NFBjR5lqaYgMmOrnvqM4A5KWO1NldVP9O 4SfkXqIw3XOSHZZK9xwSJr9TUGq5pZSX3qWoiag1Wdmm/nX9koptcCGKxn6r qxDolHjNOkVBN1nO3UXmoOZMb1YdA71qtE3mhI5hqdo4Ey5IxRdn65ITkCAm dQgMF81ghmKvlVyImkIz5LanbNauwMyoVsDsPik69PLa5sjtukxtUr5LGzPP 6qrxJeiSfP3RuESJTuUZ2qxa+3NO2WNbRwf6nmp5sJ6tP525SR/4UoyZj2dP jH+Rpv5YJ7dCIjv1tiYbx0sneCmxq8PUbQjVrgPlSh/tvldxQnYvoWjEodfM 2YBYikKSdYA6Tv3F6pz7odJhX/DdOFfapGRavssxK+95TIzQthqHCXFZUHUg 9mySSqw1xE+BUVwEipt7vqRL4H25I7WD5JCVMC0EAEltLj8Dhu6kg33zzA84 p03wfeZmOhtP8At1xbfX4GXn32++5CP1xOySLKSJ1E0TPGhiJ0Sr03jIx7yi kLvVr5jSO9+pC0hiMSq0h1ijFZWz3Yt/QQayz2kUXWIIQ4gz8ZKg++DYe9TS j4KRl1CZOFO+lPuPQXmlPsIu3EpFUlPjeMYhLa9XJFus40wKUbuzCovZ6jTu Y+8Zq3rWhdN7lZDHTUiVAlbBX0IOceqpVX16dXSb/QsnHKZzq+85v2ul09T2 rzfH3kNT0oPx+GLNlbo5a9xErstJO6V9Or4CO0dhPQ3nW0iOl143JfrShpfk D+LIQ1GKT082wLoXZ4tBTaoeDnBNEjLvjauUsJoKp5gEfcCpi+4CKe90asdG p8d7vZRv9tG9LkmnVjaRSlMQlISTzbo6pbBFyam3ufRUw7V+sVr/qkRCPHtZ nlYlJb4+027GvcEwh6928aBYxqRUsjXGbTb0wpRSUrR/PjOb5yBlkTxhkpzY sTsjcusOVUYFTtn1cfSpPiUQkU7c6kWq0q0Dl9OQ8upcZYx+14JzY4KPTFWm 2+UCt1K7yZlbPBCSv3all/hRfy2L2RXZBLp6M/NKoJZNkuN0Nyl9ZuoMeO22 tAG3+y65m2SWWOaOsnxdbrLcYpWdPbH61amhSbivk3W5P1QJVN9vln8tFTTe k9mwuZKBJRjnX3Us/d9wivj9b37msFHOKeDE4q1bvm+QBTjKiZZIr4MZu2Yr 5gg0zLVMM9S774wEj7k2J+vtevmFH9BsJJfK/cz5C/WsMI5rNrlY7nOtQ0JT U/tSKP989tksggZIISxHn3p/L19wVedGbIaZ7RfjIEpvuF6hZR5Sbop5k2aL utGBjWCTsTkfnWwD2AIGKD2K65iQVYKodI34cmDjndOZrE8oG8AcKbkkrt9s KJuNjuhQHvjczItNB14CEZgE3R1aiRyPRXWDvh7PXOqKyTdPzVP6hXRilXx/ DsjcmaIeHcS19mnDLVc7FtiLma3P7YFMnv3g6ypXD2wdrK+/eWpLYkldqJL7 Jn7+dRDoFBI3c451e8rtwsp3L0ohP/lO06ZF5wdffa+z6I3G4blHdNvDsJhn 1NVyxC69ZvVqJVetwEy6v7ouq9+01OgxBUbIbqUzbbx0SKW1Q60ffeDY1YsP TB6avVzy7JnPhme+aZrhLu2+tPBv9UV9aNI0TEUMx3anQ/rcdjqtdGm7Lh/u 8wdPv1w6JZg8y8+chsKTYPrm8ROmZon95UMfVDzwhH8bofaORGbPVRqddHV7 6vKV4sJjJ6WUPeoCYHU8fp/uLFvvKmrsbNaCiRtg9mC8xpQ2sLXqFVlXJuNi w/VsDoikY3PpWa53PYRYO4q6LaJJaGAl4/Ul3jqJZ7U+4oDXSwcqUrzbnF7o 8GWdFq3N7GPdqIA1c8GK3nCciOvehjKv+cjqh57NkWrnD302wij9Er8E+hf2 I77edH7yns238x7KBffDYGT70XQPtKFo22zIWw/sCQ1MVZ3srq/mh+TWy5fk oL8pBNnRSUvmsy09tphNb/Rh6BietNUnNgtFV4chn/KUCayDaq0RPLF5a/jq dNWtVFDoNXKZGhrqj+W6HZc1dQyJgvhUmU5MicFe1Iw5XCosYJnaav/2kMRx GO2Ltvv1ijLyvv+a2h5Zgb7l7ND+aujljsna0GdvKPyphYwucrW1dz0THqQp 6PYhp6slLq6VCLv9RXN17RxmUK+n+5MBM6xZ4KxmQYQqRrshUzENDOs0TLlr ovF4s96fgANtRcHaD7pgGwV+VKGCXr6LFbwou+3dffDd9z/yX13FTFJexJ11 PCjxbEPbuB6MvlPRZVu747AsxuuqJu7ZLWG7yM/efMidz9xnv3le/5XbdaE3 /jJddORMLZlOPCE2GyfRc2s7Im7Y6tVo7d0dhjuvtYvNfrv02qUuU9pFQWuO KwsxcVtO4e6pkl5znTkFnKIyDNpXKZdNbvlNU5pWalngk7aslYkJPlTI0hs2 Y2LXlwvzu08e2Xa3EohLZdBJMs5veRwLr+tqFh3DHLDXqfyQfQi7rpsQmRm7 3hq4gd7xsDRGb5XWcWiaikzV1Rol4vTLzkJQ0CHsDPPoJVc4pZin0rA4i7iL QgRB80KkmOBkltWw7Ykt9enxJJOxsywAicOOBhz6lHm5MtI75e/9xgz+Spc6 NKhNKtP5uOzw9JngwP7jP/5jJu47CoHkqr94rffWXEJMntg2V3e8pU75PQC3 +SDux8RrmM6SNjPKLb7rxD0RGg8KrFOJssm5qEHfVJUZt0DD7JoVuTslJNb1 VB0isuEbQ6Lj2l9gBnekUpNbH96kpzqrOPa+ZdZxh5QP9tv3ioH3BteKgfds r84B7uDY7O+5pKp/NgCkjTpdzNL4iFIXnuCd4dbmvUGOKAhbSlfMnhAeeNrl eYB+TW7NVHdAJicjZzyOtOh6hrE7t6vhpZs9rORmeK1UQxUuDTkOmg3ZGhHe KNlw3G5s0QUMdLUlzh207Tdx+sDd3gf9pkyjFneDqdxmLx88xff47YNe2xLq 26H7JJouEqtxrRmOIpiIpJLAC+qvmQShhDrYmqM9AOr+Ib2jNq058elzvbbn T799PpDshvsbqW6lAeGBHNVA/i+cb95SzHs9MT+bEvMy7FsJeTPR/4UC3kL6 fQr35PbC3Xw+Ldjt6v6fUP+nEOrmPA4LdPPG/93C3OzyBkHuEtd7FeJ24N8h wIMgtBLc3c9bS2+7mHeX3LN3ltzeWzUKfVvJbbb2e6T2F/j+fUptoICV2l/f p055N4tte762Xx++e65XZmT2UxNIwlcPxgbXD6lH7bD1klxnbHufCad1Y1Pd Dgf7jTd0SgAEjtvCuCi8LyWabtqHsTC90d3VLRUVCPak2ibXvtyYErzl4K68 m9DrOjnrTxwCpp3wn03x/qm1aPXB+Ht0RfGprR/wx3hjdNIvLm35XwcgQ2BN w+IMb5nSo971wPi7AqpQx+7dbnY9NLweNIYLGQBiUGbAJKU5X7ELeBIiVKn/ 2jvQrh707MbegUeeiVoY9Fl9MIV6C+Ps7Pz9IwAtTJgR1dXbe/1ddUEku5nZ R9elWWad3vZCV81Uo1n7M5gbC8vKnL9NYJl5fX6QZjjxcFNxe+DyAD5YZ7sp Hq0jhQ/QxGMDPmDEDfCj9+zXHfC8MfA+/HD2JfkiV/XNW57iX7zbSR6mvfMY uFq5/Kwrv9KfgTXzKbb1vSzYBvI5kXule4M+uOynT4wG6r15c+/eV988kbJ/ 39vydGG/LPuiN8FHsukXWBdVIZIQMtmGBJHR0XrOAriBoS5/eqJKSdoW6Dkc a8R/hQV8tOtZWaZtvN7/JEqMFEZJAfl49urncPbJ7DX+pbp1n8wa/exjeiYK B+Vw2GOheBBTP3N/iBdNzvY1xtzzPLufI8z0FX7f8ew7mUeMuxfajGIjzWa0 6xihiertUunNrd4u1031xsat2IuU4Tq5tTeYwld8d/8xlSAHBI5mf6GfoGYe 4W9f42+x80T8si6SWn1TboDnVIvUNqqRO88RgMytiHzxCoqR/WLy/BhPdK14 WvErAiNWtcfPr/HzfMeZRLTOHfYQHHl9ccCllk3JT+n2RPWyfeLfO/ppGZgq j1z+V7Tc9eaMuIHcmeng/N5droVD7/pWsrkfDVqdsPaou5uNCaS0xa1nNoXK 04DB9jgpzwl84zg10xStC5OlMJoDty5yp2q1TmKI1JViSdrqsK3M9B7p8txQ uET1DTYxNstID7giuwys77nmcYIf1hyRXxfT7SSvoZnORBEo9UZwS/UeFBJk ruxfBYxJQBkyRvavaC56iHlNVuKHBqfoIdkj8tZq/cqf48cj81ZA2Oe8esTJ yIyq9MXHPK7z7t5LzN9f0b5ms25Gwe2U/v66+777e+BgetZtAzTg5eaj1+6U ehsDIinoXaUnIHrwAv9Yvv788bc/zF8D7RYzdURfy9GPTt0LAmuhyUkIN5Oe UoRXe5z7Dqf8WheQlgCAF11hYBuKLAWF3XLCLMzErrO88HZ67fHRQTY4zWFG 8ayH2ZfhmyWR5lcAZUhA/Zosc3myNE9u5pbX8b6+xjvFXkcrG/BJMsHnJNde 87EHWNlr4ur7/nPCP/3HI6tFHGCcryzjfE0/BU4H0pMNNilx+KKF2MvvsbQe yyRPa2crXcuolkt9hyuOOd6k9NX1iKb4E3S4azXbSb2NrZm3FXzvRyfoH/3l YnZlJ3AY3EjFnZzsiie65InuYqJL/O89q+IYrGHb5C6hRwR8+OpnRmT8/PHs a/xMPWfob8SOvvqZ3ijoJ34nzPiliF66lAE+Ztb6VTcE/Y2SyfcddRguwL6s IUhlxxMEsJjEdJ6Dt7aUWSON61f0B+9aE1E8ktfZfd5b2X1dhRpvSlX/cPZo t4FIvBLHBXdYIzeOdX2sdpuhtdClSjI1DL/fS5TReZikL6U+3r1vngXhMsoD T4/tttyTR6Znk5yAVBC13mi6DZAo2JbjYRwD6XgUSjs3sbSUBGev2Y+kE4g2 6HVvZhPKIe2k1xKu/+8649DJg5DuazRy93fJk9hxj1UdS0U993YeBySR/26t zRsC81Ny+xsEarZlS4IEVu4KWt2V9raHfChLek4hQBzl8owcYG/ePLv75X1y ZNTb1fneM3588f7t9CbkHFaGv0RL52BM5zx9Jt3RLu3DWx/yxBlLBu34UJ3R TUuuwbKIzuaXH4G8PmKOcv8jAlLHYe679DXwWI61XmYaRPOXPz1fX5yB8C7J MbvWeU9gP0vzp89mL396Pg8WEelIlx8xN5InoX4S2ieBPLG/+0dmJIxNs3Uv h4OXQ3pZM5urj/CXK7Oyq9HKrtyVRaOVRaOVRYPJIrOyK2dl5vN49Hk8+Dzm tYq2IvdKXQkck0ymocfFQ/t+JAMazOpf5ip6l/9rSvovrzM7XiDjZU3UxHXu V3UUBk1SFW0UJLUqs7aJ4zppkiJpwrb2qzaNqiJs2rYN/Dhug6xOE7CdZXe2 NFwSxRgob8KoDaNYpSos4yAi93CY1KWqVZz4aRDHfpTV+CeIVV01fpVETdE0 YRra8aL3sd28vgXU6TwPQD00UG+iJMuCoMAy4yLIy6IusdG6qrIqjf2mydO6 if0iicM2j/OsKVqVVlmcZHmgqrio7Hga6qopmzpt0zjKo6YOmhbQqMImCSoM ESaxnzZRiqGDNlFxUFV1EpZJmgYhjjBtgvimbV1di0yR2VZcNWUQtmn+lj8w lMOotuPpbdVZonycf5PUVVb7bVk0fpnEFdbtl2mTpHFWVn6cNmmeNmXaApvq wm/r0A+aLCgjO57GprAo06CI0yJoi6DMoixIQr9QbZoEoUqyNAvDPPJLfF4p /JOXWZqoPCkLIJoqosCOp7HpHbbKPwhO5bcB+zXYFBuwt+/2n+J/i6iy4xka Lv0UhFdVedUA29omUYVK0ygEfOqwyAHBrA6qts5V3hRZ3rRVHIKs0zypwySL 7Hga7Gmcx2WZBWkSg2jDuo3KDMfalnmroihTfhk1YRCkYes3aVgUZVa1eVCE VduEOIKWpWQQjMSkVVZmX/YkZXW6C0I8Xp4EWgsffvyfLswCzdB/DoJOePnm mW+fFfpRgSfHx8fXCTb7Vdj7Sp7k+kneG+d3yLwgMYtNOhkXm2dx98wIxyDq TT0pAe1Y8cRY8cGx3qM4DILST9qwClQeRVHsV7lfBOAmTVHkQZInaRX5kcrz MmwyH2+2kDFZlYBdV7EKa7wQ+DX4VRuqNGxSVaqyDlK8E8Up+PZIXAZZWMSq iVQRR2UFAkjyvMIPYQDWlgc16CxTWYK/pGUeB1mbgCNFUZ35DZaYVnEe5W0I 1hcFeR0lKZYdK9UGVVRXeVRVQ3naQBb4SVMVYHa5gqSA8M0hlgO/LMqgqpUf hXEWhUVS5JFK0hxvJX6g6hQMOqmLBLMoUGvpF1h5q/wgK9qiKetCNXXlD8Vt kOF7EH7a1pAzkGDKT/2iifxMJUkcAIgkkNIEm2uqNkxo4RD3Bf+vn0dJFKU0 r4oCP4O4rJMqynPIsaaowPM7dSHWcrDAstIyCoqijeMoTeOwiqsIMi/APuKi wM6LBCw4ydoqav08VapKsdewxTnlBXh9mAOY2HEGEZoEQRLXqijrPIfeUtjp Er29NCLxlPhNFgVR2wJRAhIebVZmcVkBzjiGIAP2JGFWFBWAhFMuADuV5m3h l36OgwwbaDJZ1ARF3QRRHdQAV5qAz0Z2vlSfXqqaNEmiVsVxExbYKHZbR3mp 8H7VVlhunoZp3PptXqug8H2cWoCZaqAKZH0DrSkI8zrwkxAqVNMA/lAPyiDC yiCOzHSZOb0qJ0D4QQlBoEKVZ1Aw8rgJAmAlziZJG5UAW4GgcVMFZZqHdRoq TI9HoB8gfJ1jKXkbZ0mJZdQgFZwEIA+IKjtfrpUzv4nqFrK5zPK2jjNAqqJJ ogrn6jd1HFUZSE0B5ZIEAA7rpEjrImQEblTclsDbFnAhRCuwOKBMTnQDeEdB R3uFOb2iCtpcAe3bEqcdkq6RJQEGI6IKoUBCm8z9qPRroH6RZikUzKpsIRmD KmsJzfwqBOKDaLKsACzjwE+zSkWFD4LoaN0wF5904tLPCtBZpiBOG9Ag6AGG V1L5DVbR1HXTKNBm1hZQcPyyjVLfj6ogzgkrANAMS67DPIEOXJdp1rRRG6Tg RFAduwk1d0mVj3djIEHqq8yvwDOKlCSjahSoOIKWVDRYCBhXlFU1NDDo5QBH GNfQFulTbBS6fBo3EXQmqKlgTkAD/NOEYfGelOG8BmYmYEMwBYpSBXlFzBNQ bqAipERUicJvZQQsw9QFcSHQfgb9owS6VUmSQwGEyhbFUdPmBdhEW7Ql9Ogw qIJ6qCuD+NOgBPzwYQGcwpgxdHHQG1A6jdLMj8Faaxw6+IPv134AGgsxZY03 2ySD+UGmQJyC34UpNKOkzsMsVfi3iqq2tfNpllsBIcMW6mUZgdZUHkDjgZaD N6HqBG2KFcdB2iZQkHIwgBanCjbpg5hL2E11AypvfCBfXcQtcA2cNARhlQkx eNC4nU6z3AiqGAypMgFXwLQ42bKEqkfmEXYcA8/yMCacqaCPJcTfAP4SZw4g to0PWgHe4Q2l6japYWz5jcoLqKsAdd3kdjrNcYOoBAWloQ98COIyh17e4sBa DAA1EugJpRxqPIRL6OOsKsxSxTFJV0hSKO1FBUZWQdS1EVk3TRJBPBRg80kU lmGg7Hya5YJRJgmIFrYgKK0AM4TCn0Fu+mmNw8CneEGBwGBSNTHMBTCNWoEy q5y4fAbx1+AXUHuYt0FQ+zBBC/ANmKN+XCZ2Os1xsyysyxJMKS0imA5+G4FJ pPgHnCcLgyTzgRHQWNskKiE/oAOAsrGxsASJFWT3RrSVHJotRF+tSD+O4wJi BypxVNrpDMeNy6ysQ9g5KWBZhREYYIsjy2IgI4RaqjIstAZeA0tyQI0eBTW2 kIOIkxwmEkzuOC/AolUIAg9aGI9FVYGvJGXSQVNz3DLwccxp2cCqanNgZxFi xqbEkZVRTVyqzRuypdIAwhRsNQD4wHXaqMghnf0oD9O0CMuqApxBOBnRAbR7 HDd2ENjpNMcFd64DkoCYB6cTA9VSFakqImMUi4f8gBoFHoVVw6LHnwHXCBYG 1Js6SGCBgbHHkOhZniY+ji6NSBpBNwHX9Mv3ZMVC1BSQWwG4HBbjhwmg2fow 1CGfIClAlyQgVAz4pxDsYEBh2UIOgYmDAUV14wN62AW4AYAYQnjlsNyDIvOz CvJsaOQGEfSSFCeByUC4IAHICcguGD5VnOZREIZQD4kFxS2Z9z4UhxSsDopL VjZR3KR1kpIzAVwGOAOdrCCVEXw6hipRpEMjuK4BvaosizQFDbVAwzyGflBG MPUKYh4hMCcF+wDModJGcVwB5iBuOvoMVh7YAwg+r6BIhhEIulVhjC2HjQI3 G5rIkFZpBKwA9QXA2wz/CxFbNlAl0izJmjiEZQhBDz0sK0COhcKCFEnUJAAb h1T3oWGQBZ4G5PZJQf51llW+Ao+pKztdbGQJPm0bBShAmkQJhRFifeAkUKjA zYhhAK4qqqHWVnkGJQuvQ92OaFF1qBRhPJZR+LFPGncFHgUSgdAD8+2mswpg iulqyBqcSJWWGChQOMIKBF+m4H+g58Zv4rItof1WTQa0TWogSdlA/wW3wNew qwl5wDqhUReg+bICsUWgida382l2BKXSrwrSV2ry4lRhXWSYgLQPWCY1WQoV RBdwLsChAjGhsEClBI5EQJ6MbAriL3Hqt3GQqLpIcT45GKoCx2lDO51mRzir GqIZmlxZQS0GRyvCFAwbx1CnYAYZNNgEGBdVTQMODvFBrjKgalrnMfRQWC1x kviAHCaIoGdC2a+BV9B6W4hFO53mRgWUPh/ivwFq5sA6iNwCykmg4ga2CWCK ZYDaUygtNAWkdAUULoM29OuyUin2kED9Jvz2wb9wNBnQBMjSQFzmmZ1OcyMo fhXYLUwD7AmwIsg3kFqYDLoloAYrpwYvC6C6pkCoFOaBylRD64FUAX23mZ8k TROrClIvhGZYlgqcGcZAHXVnZ9W/ArqDirMiyiDnKwWFrwEOQlxCHlfQWsgx ikNNCWkLoCVWRqYLmFyhYFdGMCyAFWDLeB0smlUJ4kY+5FgQdadn1D+AMk7L wgfgoDtC4SmgYQSYTDWktdZAD6hAVQ4FwSekgNqFw4TmCbGRxjAEiwYmCTAF ErtJSXz5wIcSUhWI3Vj9HRMaVSeAAQDUhAkESQy2icMvoL/GYOOwxzIi9SAs oaKkUENA5WEGAQTExzpBh5ghB9UHRVCAjnCqTVzjW+hCgJxq824+43+LkzIq YvBjcAboxuRY9mFLgb6hxUPtyMCDocRhHFhGPqBPXiywaNArdL86rckIa8CY oGykcRw2UD5aMo/pZYdTa+6S1FATgdIwv6ASBH4IjC6gU0A1LMEGEijuEQgB KjXkU5o3BcgVw0Vg71kNO7ciLg/LFSpD2ZIQgxIG8ziBdRRCKenmM+wFI4L5 kvXT+iDvWJXgWmDUUFpCaHMwLjEbLCxoFAQJ6JjARujpwFicQVil4DdhBm5Y E1lAQFdxkhKlQJFP/fflf4R2EIR1DMEP3RxaC+QD5FgMZaTxVQnZBQOSLEVi /j5mh2oZAeJVUqksZDURCAp7sE2BhlAK/QBEEiY4OigdMIiH/kkSdU2W1GTJ gN5VADqtIAbjqCZtHgwN7KdtiQzjBudcxoA77Mg2TqC5QSUCDsMigjkHoaBI 02xBXiG4f1yUftQM/ZewL9oISh255kuo+iBzIBlUl1xVUAEzsgwS/BfgKTQV WJHQtWA9ws4jE7IkQQc9HkRYkLYPzQwaId1RVC1UqdBOZ0QmFK0mzEk4wSIh ixYqKywLcIEGdnYAvpDA4gXPreom8lUQQmODzqfI9QFqzcIsSuMW+8nDgthZ TkIbSkictAnYiZ1PYzU4EQi7gG1AWnsMuV7XRRBCH4RN0JDjJsC5wqiH+VlV fgJDGUZsW0M44z0IPdgqoDa/Ja6imgaIGMSQPLBBfBhvdjqN1CALBbjD2kmb ChQHSQBNBEp2Bl0HCmDmQ1bXsE0Sv8mhNEBMQVuoYAjCRgKRFtCCQKENmaNQ UHBuKfROnEkLDlDWdrq0E9FgW35ekvcHHAJaWZ5FMYwrKM1xlZChg8FyqG2w K0CuTQRrHCwCws1PyJbBRD4ZVFVAbLoJyF8CAIGogYR2PqPCQ5NSsBzBg6D9 K+ATTgnjVyQjWuB+QqoyLFrIrbhtshbqL/4XeB+RbRlWUMFJ5QfbgsIDpgHV CLIanAbIrqwPKjZCE2AE21RNFEEmAxWwukpBVSS1HbZdDFO48sE6auBGgrFh 6iVZ4tcxhEkBgxqwhoLUQjUtwhhKfQoNhG7PAP8ogeZi57Nek6yECgZVEBoO bA9V5iGsIZgZMXlayMUB9R0mEuxkHBvQ3M8xLwQnVKG4reosghiFTQscgGkE oz2FdZ9DvBcBeG/SEbu5VIJYhA6uFLSspGpiqFYBjgZyDxZnAAmVQvfHVipY 9bCrIfGLoIqgGEQphGWe4eRq2Hewb0DC0Or8FmKxqIEFMHzKvJtPc5eS7uGg 3YCz+hBKbUIggszPa4IaMA12eAvjGgIYfDjMgfgFXQ0qUhWgRhKVg9EBCKqq FNRsqDLEZ8jt4BcdtRuhWcIiLpIgrjMwAyimsDOhtRGnbgPi63EEEIF8y6aF kZ1mTVIrhSmhjkN2wy71fWJlUMIgy2ron1AiYZ/ADo5iKAvdfEZopgwFVYHd tVFFmjwACC2vhnoKLYZczLAhwU2KMKuDGlYf+B+YWQz88LFnEAVUKgAW6AXZ GoDNk/qRqsbHprv5jE8WcgBCKsAxQTeHQAvJyID2A3O/qIMMTBqsJVHgWlUO XRNGV0vcMoEeBN5CN0Yt2dlkJ2W5H8ckLyMyMKFy5+2BEArnbiicvhsKf/t/ cQ7/feIcEnJCJT40MwVzBpSZQFgUZZxBWWuAdiG0YShqLUwzH4p/DvkMEyYC zZcK0g0sJKVbWxj4RQ2UJS9qqf8D70ux4D9+jo9nj0b3R0GSks82I4O+4KCL MAVnAnFBVc9bSP0WJl/TZqWCjU6uLj+v0wrqgV/GUNPiLKTha9jxpMJAqBXm fhhrKHtzhn/KnIphmUN1TlpiTUlcN3SXAbNJZSmmg/ad1TV4UwSbFTY1JCcY BjRr8AzwYB82YO2TNgwTWyWQezRZBJFo7r2hP/T2ZS+rwFOgILVllNcwsVUD pbWkYIGkhXCBPR2AK0PFi2F5+eBNYQOODvstDsG4oOP5Bd/rg5vh9KDf5Co0 55fAbHxP7nJouwG4PDYIcZECvaoAZmwFgy2uSuLhkFFgjOQsSoKQVMzIpwu7 FjZXm4YxPq0IClDaIgJHVehIAPxXlmnkgMb6zGs+kz925qLlmd+PDw8zkDey zsoqDoKoSrDaGvYwJGVDcTd+mzUlqTewPehiFopxHBUQatDaFdTWts7rMFFQ uuuCAjdg3xBuMlkSxgk8/uhJupOw3sI/lMdUqjfln0Pv9Z9A721vX4bew7gu SnLlpHWb4XiqFhZy1OB99qpkaQC8jbISBhu0JCCxKnDaQHwYgXECPSWjq9wy SRto07BqoHbK6YH2q8B/X9b1H0l1eVv98aRNk3Tw78z4P3LOool6cxpcDv8M TlYIJ/M+nD27JmuK46QP1G5886HJt6IPp5NAr8vI2jmZmjIiZ/2Z33TO3278 GUdzS96VyW/jsp/cuEtndfRaukibDyo+cuy9ebPj4gCUQaALd+5shcThTNLh EsOaCrUysI5mrj0uG6icQuLdTDpw+nDJaQmk7wNxyZH4B9Jpb5PdNqgj7k1N aUAzTko2pSkpS9NJnX3dvSiVjymIXHIGhi0zbKZbn6OY1N0u79hNiepen9WR NBrsylJQmfS1NKPj13cna39eC3vkCjJS+Pk1hc9zwQcOJv/lAqe23G42e83K TMkXSrshYEpLgPqyG9mTkS9p5IC6xPNqPpst68tPZRJpQ2D/UF9O5AaW55QZ yOB8TiCaX3RZgRfDsiMPnHw/Nt56+X73ueymhiPXIakpIe5k/iPXGKkp8WX5 I4yikPL3eEm7X7b7+ZLeoNwn4i4/suES46e7R0cmD8+AkIGsAKvTmU95fXVM Q9LLPMRfxkO4VVF0gt7FzyH3W5ffJM2wDrhLtOQUUvQgHnPioLxESVn0JOEn kf0M73N6oDzTuYgRJwPiGS3uQtL/OB9QntC/9CzivD/3WR1J4t8lTQlo0Zwx Z/ad8KPLACsPQvMr/fvJ7K4XRO4TWHqBF8T9l+55AS1d0ZPV7rlg2xx/O/IC Wv9lKDN+IjNm9DWnKYU0Y25+pX95xsJ9ghkBUL//0j0vJIircDAjRMbdv34x ++u339Nq6HDvUt4Ipads98t6ta0vVntqjQLGvTnfeSGd1KVAnBYTRub3y0iD MYy7R/RG0nujjr0wdZ58MvvRC+l82IPA+ZWX0QJAW2BBR7widi0ERJoEPWJs vHq8cLpT8lfMmvfHwBAh3pBEVD1GKGOE3RhScl1GpRo4IeHACb+MpUe++e3k kgEdBc4DwNmLwt4b97yI4MF+Byalk8sjLyJ4KKYuopuLI0oQ5B+v8MfEvM/L Xl6BirHs6Mjmpz4Dvdd7029ttludMLO+8qK0SzFl4pesNZIZ/RysA5KCErJ+ h6To6hZ4ziRvJxtmh2SDkzL2zhKCd2bl7mKwqfPtBto9NQpySiXTyqkwnZH1 37Mo2O6fs9OLsjS3m4s9w2RnNQXJMBqCdknfScYkZxtdy+d5u8/x1e/k9jfw 1h818+tYK37DG7Hze6iZrctaQ84E7xjrPU3pHVtl5P1xMVvi5QV/8S8Qr0cO m73L38SaycpcxB6Iw+5fpcJ06XfOP0/sFylz2P7qEuax3TNZDTFZM1KqZyM2 K6PdM6OlE6NZ/mPESMRcdg5OCebw3PCbK1bqO4SY692mR8yChY5liAvmwPKE 0iyvAmHAPQ6FeShj05njSBhsxxCIHwTjlyIjPSZYCvPfMUuBbGFWLKyQMulf CSue5CEfTuP9UGkfofqAoZjihfsXW0X1G7ar0kk5nyYtJmdxO3uSaW5p1amB bwYb91wlImb6/VSKwJHmtRso4SYX0nO18U7v5qRms+Mu77O/M2qPNGRGIDGb rLsbcGEqpSj5/8zJJf3fAQH3+JlmC11hQ1t5UvRPWv6PbCj0T8ywYd7RiPk4 GAwm82pUEvABl/OjLl/qms4mtF7JXv8FGHX+8xkV4ftx0YfHtdCwnE7MjYVh dowgD0x7uFfMSxzeVwnvMy78CrN/v9U2i5W8F8DwV0ck8O2PVuhTG6+FrkVI Xz8oSZHofU6sUn941CnvEwq17PeUCi/t9qYPgGNuhD9D6aZmJlTv/BcqNXFs le/5L7b0BL1mZD6E/iM9TsndZ6jtoVXR56yJ8lfhzPlv8iOjk/Mq8NVs8N/k R+ASdcIfzeWro1t8BEZSE+/98ec6JMFQZ/zLfM5qrCyXEM2Q8p2u0EiddlVG Xv0MBZGZe6djxt2vpEG+8ixTv9DMOjUP8O/PdSTFP/Tv2izIO7af8CBFN2rC DFskUWznoa86aUTSqU5YGK123z3V31Gph54wYhU307IoccyLQMuiyPBlLTtY Anz39EgLprj7c0J/ju2fsSfWhAh754R3cjYLyhFaALZ3WGTNZnpeaiIearGk H4U/k7ATueTsih+ybBKRYvcloqi3NdoHC5++ucaP4/645nGiH09snGVSqv8+ sXP+e9ZJKIIEf9qJqQ8dpj7gf8SVohk3pLmGAz6P8Eb8XvkgNZQX1uUs4b8l czQ8LiLyjw8zD8MQxf3w4wE+8UqUWcHHCybi6HiAh8wtrvQTMD3iFfzrleMf uArNA+FVgpxXpArnQ15TOPQeEV0Io+gUtNBoaEylwRBbr26NqwkjSn4driZ4 I/8DcVUv4b81riaEq/kAJYOjvouMvGZ12PNmTeCoIGUfS40862yXC5FnfSxO +1icDbE4N58YNC6cSa1Z1U3yilFT8/dQ43GoRxVEJlXmlbhdHJHGVBHEo9ES hy7MeH3Silhm6VWGssogHyyzGA4c+oYCfxQzipYddtOwhynUE1kKlIWHYhkd oE0SUIdos19DcNJfok5Pw9/jL3Fm8AbOklG9qgO+kjP7XucqcWscvrOrhIcJ l2BP9kbDYVXTfhNzuSEFgjY33Wl0bpWd08JQ3uj639XTzQCu9Z50ELi192Rc Xe/xiCPMhCd8xTWZWBOqxRn9F6r5dFtfS19vZpT+md3tVtkKpNCi+9qwRtcd 86G86jjCtcIEHPc7fyndYZhh5bpBXvaltN6lmdc4deQJe8svpXKefrSsxX/d 24P8Zc5w0eXTPjHrE4eP8Y7jOVhXYZ907nC/7w6vQ8erbt7qTWod7uQwNnN/ zB54PLg0hxKExnm+vCTtuA60N77jxifaHT92hQfmeuNRO3LKJ33XTagd1KEA fCa1c7WjejETx7T2OYtHv2NXJ/T1ifncfnwlvvpAe7X1r6H2TVlxdgUYs57f OZSvjrQZUgw9R+T6wTb/8e1T41H+kJvAdz5kMQZ27BGiWmBiB3S1wYjTGp4p FSqFYUrXjqX1nDjcgi9HZ0SmxEG7q9Lp6115e3Sv278t3Zhu18P+fIdKdz2T YfvlqnhJNJ6iVvFda1dyIHEJxor+fLHWDFJ5tymMJZe0j7p2H/j8uqpd5EAb V+0Sj5MLuqG76YLLoc6aVdtCWVrvnQ4jYMNSmvXwNXi/RjHv3/bCM10bhjN2 JXdNFx5Cm3LPOvlUJb355Rpk0UCsUsvohlylLp8m5szIw8417lbHHSGkhlqv sp0bfIpRKaCUh6X4zcZ2QVPlDsuU8l/cArIRrbSDjGkautrP1LqsTruL+n57 QinhSH1waUXsRNTtAA9XYfPkPE0/Vy4Xv9rSJNJd0rYQeG3qQHZ7ls2+Xp2e Aue81dmZaqhnCuToGb1B1xHsAYVigSMrt2Di3N6BW2fLI/um9I/2LDoT8UiX +83aXbnpQk6W1Xg34h9lKgCmtRen4yYk/W6ntqfObjboYPPt2p6Nhj/Je9Ow cKE3b9q20DttCUhudQOFbsler67eXd2geTg0wXp02QRWNXloO8CJggNkKlOI tVsMaU4X0hP86ef3gtQ2IqKmD8zsuNY1F0lfc/PzMZi6NuhLoBh1phVALbxK 1SX5cAkdT1dnGvCEGtROQ5fY07Ow3JfRv/OJv38X6MJ+HlDh8MIvdhe8xGbD 5WGlPO2ozjEdNnV6pf413Cuc9cJr+Zbte9SvCCv14nc2DPyuoeR/LGb/tpj9 eERn/2JzRsHnanOxO3Auzqg7MBNdmXCKN8BK+wf4AMzTf6P/OfrUm/XK5nYL 6rMRu57PZCQqHX2Mb7/f2Jr3IwZGLRJuXDpZ0CbarT/Lmu59hHF9zONeNvzk 6LgPqY/wEf7/x48YWF+V9aZalev3AqmPCEYf/RzSDPJjdHuIOet6O6DdsIU+ xAazCKwYTrTsq7X+kR//HPWAOLDb3nxorRi5wnKMi7m4N7g/dQ7Vnwq4Q+F7 8yGVsjVdcfjV34bEsrqNhedad0TIztSuKUNBkKaUZb82pcz9m7m3Hszg6ihM q4dMR2lAwbuTht1fPpj/ctRz8WgY3Nqqet7t5fbX0wOk6O5DxvKcAewZXd9a ZN2sB501n4hjMb/uXsL4cegGZBDmFBzZ+xHH83PdYDcZfaFzwU6Iau0sx5T5 62ZNpfDvkM3XebL4UM6P2JNhglE4jiaghJLlV8MbGG0PCSzlDW2KhcYUS+xN OwhH4qJO9JqEmlzzqpHX5E5frK2vBhbshzyflGO+bBxLz1hsa/dFNsy+0s/5 g74h+Akv47oPyLBrtCvruomi7jvNJtgklEFsREHE3zfaSHQiEAZ2ZvNzrL1f nRf4xMJK3jCxBu4bgfOG2Jn8XjKKU5h4LxPXWaC9cz/XsbumufPi0c/z+blF VbkVku/o30Pj0wqvHSWnUUI7Crnuis4BSI66cOBPxDg6osxxKZJtzZdGrleR fXAmmouN6xNyM7hxXHutYq32OyZN9uJdhmuN4kNHyoczHQxnsV/jvEYOesje vquwg8wF30TpJ6F2mobssQy7RxHfN5nAuWBiaiyew6zpnb9owumm561xLJoG XsjAK8bA49gy17FJxj7Hl7meTQJeaDwNBnjh9cCLwp7vNoomJrchac7JcSja 5bpzchAPD9Y6Go0nVyR/tZOjC74LORRtNva7WqeD/pSDYayHg8HjRcRwVDxw ZnTwftDzV0T5pI8jEh9HfORFhRPQYoQQqS1dYItu4KWFs1EA3KfvRwXoz/N2 SgC7A7qQGKzRaR76kyOcf3KkszcMShvrNr+NIqcNbPtR1IGOoqZO8RJA7a5Z elz2utD9ZgLp2R9sOv/1GgNoVdUFi8deYRH5V+wb7tqcCNycF7jzo9pizIsz TH//0RdxFvnSNfWWmow795+py7jzTmszopFQAbw0PrIh1sEgxNrVP+aXj2lh j2l2+unq8cjlcliJCw2pYxBSpx83rLPIo7UEYLP6wXrBY1a5H68187VsV9zD j2nrj1nduDJDLukjVjmuGv3oEx5HJBqN0NjYF/mNg0Q+o9+WutvSmvsudZ1c tOYvvVxU5zz3WbVwONda3OFHrDrwSuV5oxu3sEpwZd+ng9XP6WLJvn/VvR9N cBVBh46v2LuLuVz7s0oXH7I1pNny+7I0hlcmh1lMrG9U/lgrw+7+La0MalL7 Z9sY0jr3FqELWpa9jVnQu+QxgbfTFzcsJXv3PP27m9jaFG72g7EPdHSu1faz g9r+QN/v1PjlUOEfavzjm5x1/9Wxzj+86el0/hu1/tGF0HCyG/X+cKD3W0XI qsI9kOhnI92+v+ahdm+u6SOKsOtpio7GHRmNW7BJZ3n0bvRnU3P09fbxKJlR k5dyueUAaawkL4OxlsxXSd2d/YVcIvXv1n0diOX31MowmDAIwpFOq8PFJtVK q9OqcFqtHEQyW7UydNTKcFqt5LCz0R3ZIbUyTCfVSnt11otCu16tZE48UCrf G69353gbbv+26iQ+u1aZjN/qWv55t+z/BKVL2HvHoW+4pjokkkRjYpJa6xv8 y8ayW9GVYv6VQlZFGWJiWWvfyxW/fWWY8+V90bUomBff6EwJHvD+Wj8ruvfu C1sTb4j7DPoQscreozXzPvdRPMqYwMyjsJ4rGt9GqcY8VKgDUzWXA4vlt7Lu GTOeJmZecnm/c3px/GwxnFXzkdgomvQl8ZIrXi3NsOQZOMaHn13dFxdALME9 9tmSZwhjqx6uORagEeLvr05M/f4zJmr3EW02tIFVS+PMI+v96r4RpZIdEzmx wrGGXBSY9+hfSd0TW5xXd5+11/uNThHr6a9kj8txCY+8bzVYMsoFqPovVicl m/uq++bqvtViyaS+6r65cr7JHTZGH/B4/CnecpjZqDeX3Ir2VDvjb9eMgeNo fz+bs0FFTkrWKD7KMKYbdc8HRkHe6RdYZ5XQxsE63DirIavzJFpBOu3VMMXk LldDZXfKQWJXeNpc1FhWvdntb88ddQDyn8cY912naNP083ba77UO9uuDom6v CL+bHqwt1YajVtJJx/khpzm1xut5zk2+sOXu+UiZ1rpwI8olOxOHmvXsYwlJ 8rt04TWvrvNH85df9RRVYZyRVb6pc98n9sVBZrF58Wuj1Flt+uueEh5PKeE3 fWYV8WRKEXe/jvpfTyvj6UAZz6aU8Z4ank+p4QMFvJhSwMeq9y+O0swhTyPV +3qlu/d9MKV0307dFue4o26zcjytbsd9dTuZULfTKXU7e3d1O++5gL6WbOh3 07/FvX1b/Zv93tfp35HNipS4tGjKIdPXx6+TYfYSdCDDOL7+n0GGube0v1+G ad/vHyrFdGrCP6EUG9wS3yjI3vam+OCAJo/uNuHC198cv+2tcU8aJr9XGt7o WnIEpJaGyQFp2LmQrDT0h9IwuK00DN9NGka/SxrG70UaJgNp6CSld1fS9jo6 60vCTlayDMyHfw0m5eT4Grp/BU1ycXwFPb5+/sW5OGbDbXT9fNPVc2+EcHT1 HDq5Jyz64gnRZ8unuKLPOtV+z9Vz9vuvnvPR1XMxunomATm4eo6C33/17Fz+ htff/g6vnpP3cfWc9pSWKJuY3Aavu1fPxSGl5car59gfKC1xMK203OIuOg7f 5i46jiaVlu4uOo77Skuc3KC0zD7ftGVNOkR9qiBIKDx7XOaX/7as9asTxX5F v7BfUdzohm5Rbb5gr9CZ6y50x/pt4ZXNGR0tiXHqPE8Br6dXS10Pqzql2NZm c7bZngMPzqAkrESE91uIe7tzim69OJ/Vk7ujPb15du/zL772oaPg5wdfPw0C /unekyDDD3zxS/dS3ps3dttmDL7/7WUWWJ1ILpNHa6RA1pKDjscrMplZjaLm 1pWEYd+7aLabtXz4BNrHZqvs4kxoramFPAqjd6OxJaZcTmMQe+1t1TnUMawa c5Y7uTnfmUv1kb7kBIH2+sB7Y/Xp09mOE8UmeoUz/E3puma1qy92O1FnvenI zWPv7xSRrDdCWOQum4LlRx3RF9i5YpTgxNGrGegHAOSEBSiiGw6D3gAn58TP iNw4fVN+PhpFLtt0BR1AKmf8YLup1Hp1seuftlxfGh3UIx0UxAhd+xx6jWi9 VbnDYc1BJI9MJursEWsA4prjFNNjb26iwGm2LpXNBE70s1Jm928mruOjkWbd mk3MLzst+nKoRevVd7p0efANivRgu+COMEvqnfqIBZXZKR4RtCFt6CzdpF0a 5KjnNy9liKUewusyg8our+OmgxoRIx2RRifR6b13gOUIlBh5dE9vIPqky/ub sDVMxqSeW1gPFaFxIP5dL3PQVmS5xgoJTHDmI3OFx5EP0VFPvmOD+uysLXLg w/Dgh86B/cJSkWM0HNRa8+C/sPLgPG44wfkXDoqow94nV2u2fn656n9CMHUE 2i8E718Ilr8QxH+xoREH0MKRKB2K0LnR/z85mggcwB/Cf7pTDQ+e560Ph+5E DOiXV2svGgDVwvQmkMI037GvobeLET3Np6noyCPRJqJkuzpTS6kTsLuoTrYb SO8vQy1n7XxdMUyZUKKUKGnip+c4XmztiWE0+olmoFYT8RyHxe0omwX1cyO3 n5u3n5+EQJo/BhtWGhs6QBCDtOrVNG4sgySIwihLwzCk1pdxmCWdXUfjYYAO EH09zxuh0cR/H2rdYOlfNqEf+PIf/6/L+Y0+YvO2F+AmxPSXnewe4oioEja5 iN7G7vdUSgK/L8hvdC7KAaUT0p8/7gbb6Qw1r5+hNqhOFxjsfyJOEGJ2Qvly NxBp2+aJJDtH8udwvo90YDtbEHRZuNclP9nMYINeXBT8gKfY69tV/Qm/UfTH kJzk2XfmwRO3ksd3Jun1GXTC8/1OhJY9OslsY0i9+ZAf48l0ums/IXWnhzM1 s/VAPU1d0huvy+0ku+HBSrKxfrTvHy4bXJ5TXu6r5vXy16VNzFU63tPS9obp gHV/zLXdgCXQykYTmELB40nmpsSvZuU77B0wvLs9uWAt4w5+sWVLWJeqSOOE BXV8ArTWmlr4cxJKDSp+/S7Pd8/UJrFCxJaUEwS++pmtdPbFUBlBqc0JRYIq pDTPf5XKupj77oIGo6opz+v99rPg6A7T3gm+Pi3PqqacXd6ZPYBCxkM9mN+l rHP6nX+7d8Rvv+je/vHObDl/MOcmIlL29sGcm7zf5YhG/QsVx5VPP6TKq/fv UMp+twjYJqtT1utptVyJZXtFd2CcX7ja018eHANb5jIIPpp9Zr/nR69frGCe UTGVO5aZcK2453UpCc5YC16GzvtgvqQfju54fe7y+XZFhWOAC8HwTzMp7/sv nX7s/p1qrM5lIjagH8z9weC86A2lS16og7OG41mXo3LCBFRTbvi6Bb14DwuK 3n5B/Uo1o1VRhmZXacCu8V0WF48Xd3c/g7Dc7dkA27RyZlzvdi5Vn29cn1MF wa5tRiVGnOdLjVJ/AVjDo6m1ay4q79m/EtJ+QlfBxvfR52GDErbgWFRo8vdx rFHhIuZRTqnZf0pORVVhNafSwH16/P9dXv4PfPbgf/3vIbDt+T/ZnF6RdU3X PARWvmZ6YLnb5aXL0S4vNT/rvpeFncy5nPlwfeYAP+vxoffMdHB0fKWxXt4O RzWGvhOrwVz/wle2k3PoDTDrWAbvxjsElEvZ1GrLl2wr8qHJwUzyhvkJfSDb OsZGnc/m78YksIp7xKJ+nEk997dgAPKdQII/fl+kPkrhld9+H7H36jkJpbuV kqYp/baEHiYJEXpx5BIq3SPPH2ig/CHE8ePs7ALsvILS9YeRxa1OkJ39zN9W u5/0PI4LVHeio5cO1QPWVQ6W5xfbc/KG8oDdCOYUpWwwl72QUgVcFmG38AYZ FoPkbloZPSrkUZAeLbzz0wuyVHXbj0GNhq4YDDuwqRLIziY/sDVM5UUuMATX urN1FxakjekiYGunao0DFqfUV+eY08V6nTKVXUwdF1M2wXRTpQAlXuzy/VXt PehrdG7sfx39zb2z/5X8qWCPl9xA43LEVg7ezAc3FIYc1IHU2HlJN/SGmfQA 6QZ2MCBNRMcUICVk4b88IE2Igq6GqG8M6kAPpYWaW3S4FxFxG7jrEFYq7Tso bqgbdXA465xr+sn6JQzh15kN8LNF+lyv4a/Tp9jRrTnGAr8H6YFzlD/+tztI fr0evR7q12v9ej+SZfx+ZIY3HziRLp/MMkKUIHWk0FtgS9xhS23KBNvU+tqE vMQmlLo2FYbt5f6cC0BrjLLRbnMOktBPbQx3F0jKyKbv/HX3DFoEVRB1x7NJ 2vrL2FQlDvtfRvrLbs7CXGH3xmMP0q8TK4l6470w0o4Lqr6S+y5Ta3pEF5/3 5NT3MOWgxSyfvSjXkFCd2NJkst8Zgdv9iaPX+uLOlHsxlggVbAQpHBrdg/L0 eRFRju9dO2xwnBwDxM2FInfEMwVauLd5rRZU/OXl7Mvt6uREBPH91Xb1cvbt yer01Uot/746OVVUSe3fLyr837L9RS6ay3O++CRStFK0upo9XoFc1ensWb3Z 749He3Ni7PjCqpPZx5zmvJi9wJqw3YWT8DxQPZzKWU6lf3aCU+05VdueYZ4U qupKel1JtvPYS81sab97Xu/fP1d6d6b0qwRU35ol/Rcobb/oq8LSFIG5mAm+ q2NILXk0YFNMq5dULp490PjlV/CfX8X/TAKOzF2WY7/qv10yZ6JCw3vmRjWN n7C3+YbS7FKZnV76d34Jfwv1n7lQO16RSu0yPLUSrIShsGStdIVHDm351Sy1 lnqXHc/5FabKrzZhWa9PXmRxvDfbqnVFy73lVvhyL19yKpzsMcgmOJKr8mM/ 7o26o/gvV7vdLxORtEO9eBAlK/TgjOmNbulng0iJLlSDr5GqE4l53dmSBJ5D EXQPPr/86TlGwr8cTUW/UXQefgVkHoEOvuV4iH6FQGaVdH11da74shy8Y8f2 +8p0kFOXe7UmvupJmVsOvDC245s3d58GkQ65ONsw0dk6vWMG0plv0/xj3c32 FjwkpGLfQ3jeTtvhutwTbEN4vNTdvqm69vmYuN9CnXgeuKW1OQjheei54W2m tLbJNJEEMTcXjOyG9NhJRvmXYeldkhp3rKrV4b/SBgfdAtFF5WxPPPGVqjl2 5c2H9Kv+bfrqp/e+rULKl55TEQ4ma7P32TC26LUyjSxLIgZT1bDR5T1WO698 Va5OOVSL1Y3pAqb3aSXORKN5qMjqTpjrzlzWdy16HP+LqXVoTfmF4Bv36qFV rIHHXV5pudOVREz5SGmQY0tn6oqIDCOJmrITMB2udv2ilAuOKnJ3omH/wu2X c7aDZnKxmH3nL7iqoi5s6IlPSV/6PhEr/a+Pnn0/e7IMk1SSCp7gp5+e/+Px F3eePby75F+ePfv73356/vTbn54zFXuy3BkQjF523+VX8eZzr8EKZ/zOd3/7 2z+WP/jB8vNnfrgkYC0Pf+Zh6fKd9+T4Uo8Q1kESRn4Vpk1Vp21dlFHmJ0GQ 5HWRVFmRJqkKsjIoi9CvgiAq4ros3CvmOo7DOGsiFWPUKz1qXmZlFhd5UtdJ nWVp3bQqroI2KPI8LjI/TqIiCFXRRJg9r/3Ur1RROqNWSR1HKo+DxLv4X/7/ llHLJonisE7TMm0av2393G/aoCl9VQa1H1dFqvwo8psmL2I/jdNEqap014pd hUmQ+H6BUQM9KqbHIHEUYoQmbVNVZn6pcj+IfPwQJEFexVGeRVXd5Ilflm3p l4Xr9gpDX4VKlUnpfecLYLHWKo3xdYg/NlHbhnmUBFhy1AIMRRI1ftGWTZRk RRLEAGydNGncRu5aoyLNiihuEhr1SkZt6rpKkjxPo9yPyzzHulsMGidJFqR1 HqW1anGaKgn9IinipmmiqMmdUZM6SROsoAq87wKz1iSoa5VSA+ymyMIyVXiQ BlEUt34b51kCpKiDugmbKIxwJGGbxypy4dqUWVPkvmoTGlWvtYqTJiijtPH9 simwJlVnOWCS+mXcqDgIiiBrK5XVeVgDrQrMmxaFM6pKyqDCYZe1g7oAbO2g r19VeZVncZ4kSVCWwJkmwbL9AlCIE7+Ki7BVwJsWWyyCNMmzLGnKHvqWUZTn pd866AvkCyqcURYFZQhMpq72tV+1fl03CnAATII2j2Icjx/XOZ2EylyAtG0D qgiB4i76ggayNlRlWFFnbtBGmJZ17EcBTqqt0rzKWqBsjr80ZRqooo2Unzmj lkmUAZ/KNnDQN8oKrDGPogoLVGmbVU1d+rkKVB7VGXUlL2iHZRVFSRKHoD3V 1I0zalrUqlAxaMdB3yQMirIBKak2quu4qLIgDuJEFUEVtlmjgGg+0XhTZyA1 kHiIf1yiiDLgU15Xce6gL7DdD+JYUf91v6wrYESVhnEd+hFwskhr/H+QNX6V BnUIvhIlceS7cMVbQVNEqm4d9PWBzhlmUm2Ns26jos2iHKCgJu5BE2VJ2aR5 BNjmZY6Z/Shs29R3cSAtlAKJJ62DvkkOjAybsAqxjKwlvIqps3vug4AAVxCY qlRaQhDnceVTB3gFHuiwhSTMAnyUqgH6AqZ+EIJo0ywvHFxOEx/nVOct8IPe icMyaVofBwfOGau6TKu2xUb9tqhTYttpHgQucaeALKDb5L6Dy3XZxHFDdIcF ZmXbxr4flnmjwjzDYvJS+XEeVglYXgj2GIKgMr+HH01bVElal5GDyz64V9EE YVIWcZY1SVK3BcAU+EnlqyoqQUFhApZQVG2eBTnYph80qcuIghZcMArC2sFl 0EBSZFGWRUVYN1EcFE3e1nXWZGnqF3EOSDOmgEXnVVVTT/Ioqp1RiwZ4m4Kh Vy4rDkATbQhRpqo89zOiZRxXplICVuwXTVkXWQ3s8cH2gIO5gnRx6Q6In4FE ytDB5bj9/9l7l2XNbi0775Um7sADyB0r5GBDbQWufdkNv76/sVglAgzykFVR hyWG80gKMTP3/v+1gHkZY14dp2eTw8KWdbSEFyyIw+aYfcZ0Bucywrh3yvzY ST3nWz7Qxh1mm9iIX2S5rB55tYyep+l48hWTnw3xbVw23qNsnNGO3jxvihdE xM4tA5zZ8CWunG9TXLj8lodvLmws8kCr8uSz1mhte45xdbxGya7XHrxLa9q+ zzVyD3jXfNoty//T+fo//ue/9X/Xx/6bf/dPf8ClVhEtdXt7S4iQR9R5R3y9 HzJOq1ZM70C6OBLsXO91WKnp9sRhzZy6jbQutWr18JuYhG7Fc5TeLR8Rg4Fm 5xVmx1Pj6sLB66C5FU8K5rl9ph9nhOnb7SICUo3jihkrhtvZaJnpV3Fgwe+F QA3AQ8weTxmWB10BeG5RzTxVtdTcjXBKHsP8wkg1wBsP57Z5hB3/W0c/mNwx Vt8JNxw6mAKH4NxjzMd2A5AUwqVWOJfOcfmAzC90/gRkzBr2CVkpe8ulzIGe TVQ988Aj7XN/6lhYN8x0e1wEn5o5qwMuBNjV5bHDXCGGIp4+UN8MCOGTUd4+ MJXnjDbuE/BSkeQfhBMdhhUklDBMuLMt+zddPAVAF0BzExCRHDi1JdCf9xy/ q/7+1NLixkiWG+EctMziwXs0jKEfWBaEYTk+H/AImhqIRgu+ugTG5m/maPtW ViugEuDROY+LSM7/j/5v/d9tr/5d//vxAf8/+4DbRiY8l8fFnGITlLQqXgFL VEG+a0gfwEfZz7QByhmP1EMd6cbqsU0YzJjpspGof0PD+4JAbHBz8AvEkWAR KeQ6PzJZ0ERLa7VcwXUYvBskeLBOLAmUedlI9FBqmsG30JiOD81hVFAIfhvC iU11wMvqCjaCH3WoF8jsgR6dd8Ix39Ajbu/6Acd7ADrkL2W0sjTDQjjvLKTx PV3Hi4JsOqAGwHzDJOgxnyEkedlI3Mtolb8TVmqguegCcAw0lSZkEu7iD++Y osmWT45jYywedw5LFje/beQYsbsNRDwJ7H1c5j+bnpePHw4SXzBKawiVgRJg XqOeB0a7gZc/ESh42ciOndoh7uzrCVA00Gc4vOjBmnNhBRANlDxj+rpwCAnb 3M59W90DAGfCWt82MoNHFQ7oYEiwTXWGzT/O8YwdgePUygLGQXvGbuB/XKq/ LS+MwFversZfhjP8bhzlv/33PxtH+W///d8VR9Gv/WYcRTB39r48KhJGahO3 z99NV6G2eNuyy/BQXbjuChCUBExNDxHlPBe+Y7k7jlIGqoPvQP42esIf24CM b4AyouVQwtyQ2yivGEdtBVB6g0zu3S30Dxf5iwah0AteD0E+kPYGHwS0z1lX HKeISm7cqkMIkEuLqyjIkm4iemIFT4BvIUz/lBP46Z9yAr8bRTgznLQKwl/X 3JGfh5c3PnPh1WtPBclOHtYENXce0mB+tFtIB/79g2t3EAy6vxxIaAr6+xzT aACkBOJ2YDToFujNuIsOhxC+jN6dfqPugm6AnypY/pfLg0mAxDtPWHLYYJbs 2zAuETwHh/YQB/GvjjLF0iCqGWB7A6QF4ccs7FTvy/sPPIGf/ikn8Oc4NMYw zpxL7KA4Awm6OHn0uUsC+KaNJMDEEKW8CtYybeyuu0W7bJwfdr7eNxl6h1Mp 3BYE6iDMnwOzmMtuRQHIgtfBoy2D9kXFmHi6+3Qwyntzc+UG+wBFhDgdxVZz xcF0dGP0AeVbOJkycLLbTeMrEpwFRUJlb1AKe4DWojH3Tf4HnsBP/5QT+Nsx yODhbt4sB+fHhvgjyy7CRCIED/5dMJSQlgqjj6uX8hHGm+v12flBJ1p52fZV nYIdgKbFhW+04OwzUbZ4uBT+eeyBFw6NL8Q3joIrvy0b4AfvCma5AzNoKeCt g8/mgsf20loPbuWwGmrfd+TR4WwgiJCLwidDAfUbxyAVFbHs4xKq/8gT+Omf cgI/+NOPD/iLP+CyEED30ZHhA4MKbUJE1nY+A666YWdxoQOab9W3jnICqnoG +d6RAEDM2D2tdodu4SG7TCvVd/AYiNlHHDVarXQHRjdVbwH9mNsC35hDmU9o f4oNlH3Kjf5su+SViRltHb/OEHnAYdSDlhW0+vjhy4yLz6pVzsPkYa5P3SaE cHq4LMR/5An89E85gX+tQPmXpGzAv/1MJvivX8jE94d/kJTl3++f/bNJ2d/9 td8kExvevN2AoG0wgu6kGu4VE76st8C9+AAuMx8tKhtguXCq92t3B+RSUhLq vbJFUThfekj5QOpChztyiaveDsmmd8XqPCdUP3ADOQaOfjiDR+6+p5/gzhZ6 c4UnSABLDvz+1noAcLmP1YBoXrGvibtY+cD4W4oDUVJ02/VLHD1MGIoxXZ8r 7p1dAdLmBkPArvsWGgg2LQ4jlr1hiinBM+6QJ6+yGj4MB1UaSHIjipBOQArU n5c8B0DUDi7vovtJoWA8GQ/XHP7xJOR0Zk7R1bqAX3vucNxAtMBR2YBZfsQH JQF1VxGaBdY6oahqI2Q8b4JsxORMR85bXeGADZot27e9OeJV+ci9xY16WV5v uM9IlaePG2R/bCHT7VE9/rSDs4OuTlh/RWvzWvxw6i6J/MPh9vA15itcoJix kquhQb5w4L7VHsEJeYxSOLpVxjzQp8gxNTcFHOzJOyalt/OuMDHH2wEdypZk AADLVChk2twjhRXvpLI1JG6eqRAKNzcTeLeAOkELVdyvwhJLwELAUOr2pw9L NxAJHXNkIN9V++Y0uUMDKZwGcWixctU7ZT76rCvcAE8MgjVzAHVdCWftHr+w 65y7OZBtyOfAKCysAboAHtXH5se2kO7j0Y82+P6APAYLTQl75DqYTjpncczf pZOKriPP6cTYS3JNeawltM/J53BA0ABwUApQya+cEmi5P237K7pgaHzkNstZ yObBcmZMbocYYEdnPtk65OBWX1QPqYKw8y1cbE6y7JDn47rzKmrgICBtBa6f ko9C70+ew8Bb0yFbDQHr6ALfq+C96PPcS/+QVy7p3HQ0QczNwzEGCO3YSK4j VphyN3nS1tGa6bJ0q2z+CVPm7KEbp69S4lxhhINvAAqi+RkhXauuBSssCSOu PMulvjw6t1JRj8pLY/uPz8fFWkrHJpaxlHFLHFbDfSyf55h53sQyTQXacuKH 0555ZD5plo5b41l2P8VbdzbN39E8oGkKI7cYSt84Nq41AVlb7hiuONO2iCKh CNG+u8JnjXWrb+kLS+iU509xx6GKm7RGRMYWdx1PC6HXL1x5ZUT4WJ9QHXM1 oKIWAyb58IOweJSxlqY0S0Y7eOxx5kST7nflrHowbAqeXfktvzFoi4+KqXlU N4S1uJ9Y/a2+3CGXEApqEFLKI4YusOB4dxD/wvyvVMKo4PblPGrI+d25DSQb nbUknVkt1Z0MGcHOzxmxlIg0fpxHOO5S37VbqNDJgcVAmNAPh2kHl1Q4co6o ScTQT2AAzzGdyhnOY5Z9HCUpwV9jxXuFBRECHMCsed2C5+MvvS9j1D8ZUBhr w4/xvbUYJrJlHrglQ7fwZWLUOcziekbR+MeuzO15KpnSygMrDVVSVUo+g6fZ kGHMTLWDCd+4Ad3Ljfzg68CdL2W2RainN9VejTAUUlHxBO7OcTsF64hq9DkR v/vOv0xx3pIy0BJeCrTk22yxoY/VRQgZEIOzuQtUOpI5avFczMk8lNL+6H5H 9nxtqQ1kpydQSIgn64R5plu+8UjSphQxH1va6HjLlnLEu+GQP28J+ktfWcy/ 6rLHs2CWETIPY4U/Yvb54+yKss+QMPmd/8Y64YZDLNhh/4CdNCVqidcC7FVF LhHPrygs5mUIcoHmZqyJu3QZj4WLx3XjI9D9GIG+C1X2qGgLHtnftVT+4FPb uBmlXP0taVum2QWfaguYDaUTq+2BiR0bk4gbcXjzYqNcunz6WUgLTDh5mS4Q iPKuWIuJR0RCJr+TSrYDVR5lYNiAa7d7Skcp5T3ARB6fXUdQ7IzLxPDnzOdD nqtE/tJlfCDQui5+ky+c4yiT2niQlXB3a+PISxpoKnefawAjAHpuXQ57VrdV qQesQ9ocx9oy0jiHDeh+xSE630Buly5vjNIBvGaMuYuHd+GhASknYny2Mjvz pBl43wZCQ+kdYnfHDHjagoxhLniaIqDgcSVHQU7efI6iI0SY5vn7hZRw7uBo jgJnUPFNAEe4kyltDruavEM7TvJ3pBL1YH1hPbeC4xWSvMcqYDeZ8IDeZCiC bYyeBzv3EWueTy0QOhKWLdXDLGW+j6UDhMJB40EXwohLSl4VIAOQNFHx9ZiV zmWqWqgCC2JYmG/eIoyGFzJlqVI9iiOjOTfhjNPMcHu2fq6NQakqrnRA5jBo wCRMrqCvU7HViHhiUO71rdW7hbzy5YXLV5pduABwglsJKE/gKcLAjd4JvVYS 9tU7iEpCw9tpHmg04ALLpc0LO0QIBqRoWIFg7KRShftbjyov3MrddbwKlhEt X20Jds7goZ6D0/Hm71ojXrMr5wYWqE58a+XsGvdTFc5KPDh2hAvAlIKiA3yq 9nqj3gV6gz44DYACrR1wOhYK5xyCahMqTmx4B72Jt1nB7vmGBeT6QLcHru24 p93WmLUKoi2QW4d07w6fUn0cWOE2K3ngUdAvGAoY3UenmlCsd2jQTPDql6ME D+XLrOQu5lA3sBFPAA5HXCEF8LkOPcXF57qhnx2M32Ft0Ers4l13p1A1tt1E gzJmLPLoYHRgA2BKmSQkZiakK1xmBeAHvJ+Gcwgd21XgwBxOBU5EfAb/iBUf Axq6lVjIWxnk20nVdAD/HkfiF4zvjA5oHiB1cKlNsW4OSFar/Qgq/viAv/oD Lh9RROexJcPBRU05Mhge7Msgf7O7ClRbppy9yI24aZnpqWuNoJPj5keBXVIl BKwD+hm6KqfAYZXfarCDO9e14X3FgxmhIgObnEvwKCVADKSRJuBknOrBm6Bd zGmYpjrzp2y7mslE8b1nNQilSqeFeXPIScUFsA3M2PJ3UUeFHYQ+PaQAq1XO V5Q5A4wT3A/dalFFEBHIrRTvxIm4fkeB1tdRAORryoJiHlIDszon/GuNnwdx Q13M3VGg5SEJaY8QM9gNADdOaKbU1o4KlczR23aYS2zJzArUeGzKbUt4VugI uLqs4WHIHRoHHOXX48D+zwyJGRj7fPmI6HfmfzjeBF6OTgWy2F9QPVa/1QW8 qbi7vANY3ydBBWjjnfcL1XWISlQVW5KRnl9gB37g4zoq23BREdxz+Yi68XAL ShUzsB37iGvEK82Gc0DOMmijOrhWAHLyDzjXWfJTfY6LzK7uEFUQBD2M8MFi iChyhp+aJeSMW3c3jYwHWjXVh5Ex01h7N6YpeAj52GnzTavyWYc/DJDQTni3 fIeFS1f0NkHWww6Q+e9kTNlMCE/wqobNbcX987f+y7sa9G+0wnXMOoFDBfo7 IESKKmQLZeG+s9+pqX69t9EgGetJV50IUA3o08R992YORcwB9wS96UpK496Q KNtXUcrvxZF/syjlNwPCf1yU8ru/9ptx5LXhUC3MGiy7Ab2aAB+FeSw2nCBK Ad3papyBmBegGaLnnwwzqD3skwE0ALwGylIEAD5cIE/IOaKE1KAdN8rM4aCs PSOXpUpMlyIG0zXFMLISAtDhg6mCZeKGfUQBy336QdHrEdDbvaF64B3FjyK8 agBVFTmAlvLv844jj6kg8vAQ1rRShYFmUCRMAaaBhDpb4rwRkgJS6WVlXnU/ vQXbJ3QRuIMRQeNyUcxySObDbDwI/ycAaTCxP/2nnPBP/ykn/LtRTrxSdabu m12wUVCNWuAcUDvXanft+IF1AFz3yQenAOj17TbZQzieZwbEixMaBChgUjKY DK4po6qArcIel3C5gLqDpWEPxvNDVkNWiR1+rJaIfS7GgeOYMBxngtNBc/WJ S6lI0WFxAYo4VZUfxu4MoN/snNpTXwnGAB2/hKup4wUyAH+BZRiGWawXgUrC 19AI/AymBYFrBiNX3NI9hSzwtAq/B20GqFcZWDnslle1R8bUBDheOFygz5dw /ZUn/NN/ygn/uRgc4j2x/fCK6rcyD350qVrD3QYn39HO2ZkHRruH+kRSe1Qb lhcmv9EUrBsbfepqgmhbSc+g5IlcL47pNmMVchu4SwVxUGL8jYc3KiKDnkIl QRTw46IKV8AUCupif1yXC2CgoPTSUKW4OrMK1smvNqfq7I4hPA3Ecy5Jq3H7 FQP4BXMEOIEjJnxurrgkqKqb6jQBbiA4eMamskrXnwYQfkv0+Ms1wMT8F28E QEJdc8T+OAdOQvvLJWl/5Qn/9J9ywn+7CJGcANA5eXyWoNopE0uNGce1lBQx 8A6QtsHMbh1QffM1jNvGT4EpLrIEFXVnPg3Ts41Pkc/ZSqjzf/1y6wk8b26q yuJg5Gz3URW9UMWf4yO+Vq/N351qEXK/joGcb0FIpVV119hIKWZuthkQ8XgX E3av2EmYTdBrvM1r4sMiQpt8QyBG85bw1Z03ckrmcLsHpp++dA+EP7oMKH8C z66Nnoo6ebqizZipbbYWXtxhFnFmiadQ39NtXv/CE/7pP+WEf8QvfnzAX/wB lwWT7LfiS0dWS6/Kwit6mlNe9SN9Exe315i7ByxAwz+lfevX4AOUo8YELNWX Aq7PKEkd6gsdmStGpbDwFneMe+Mr8YDgWAA5aFxhyLhWh8qr9z/25ZLLeyra V1SJMV+n8tWRxLBnbwnEMgBpZpgX9aRVJR1MoF59k3fZ5RDNbQNzAtNdTW0S 5kGEa2M2PDw1f9UHfKuy1ZyFB9/frmwriRWXuQ39OLOpjXALteUS+JCv/kep 9Bsg/pUn/NN/ygn/qmgrefcvZJv/+oVsY9v+YdEWP3z/7J8t2vrdX/tNsm2G +c2cIOA+Jm/BQqrLdlPJCmzMK9WCa5v1cNNV7eXcyk0Fq3GXJ8ej9t0hJwdO hykk0D2kkitUk8xUZQKebODlkJCb1aXEvbVT1JrsA/xxtmlg87tIJHPQyhqv mtxuQd4lKMmZ4S4TyBTPBk61slPJvsFM4xNTxKfmemqBgiqNxAv3uL/8z4Iz qw8apNZqEBNVrR5ObrubCXnF1heQbCeA6SlVBcUOF3kljMCbx1orkYfgQ3zy SqDDJhT4Uf/nLF2zPpYChNk4aHs6vPyEUuGbnSi8at2VnYeF980dcS8rwoFW A2vzDtzC6KE+b9mClKCmBIDAH6M3INnd7rS1WQcVhxH9BGycBkyItfIz1nri 5bo/GbYXbLkKQi0h/mrqgEfGC3cM0DmIBheAJx9zJjWNOpABPPNkwP4M6DJ8 3sEPn7IsdUysgiw0EC9/moiPqpmudJQNDTNpbQAxgPAHLNMwE8Bl4HRT4uaU tJOpo4YrzJ1/fPrPNtYh6gElyLGnUXubTmVRo25BrVR0rv4rJeeqhrKZT5oc Uc1hddifU91A9yMgJVdk0tAOCM5SWRoY7YTqOLikISG2o+al7BjGcCpjKrVA ReLu90GMWDFGQ4QjABNNGSQrziMVQKyI5ewd8+qOB5qpTG6gUU/oB8pZNTuk O2Wt98T6jJD3M2TCwat0CGtN2BJHBflSleY8itJX1PLMmNTdB4dtG6527pNU P51GKSDuLXqkdmAGVfiRGieaQ+o7c1RblZ4RJwJxLu4uOFANvlfbk1KKWGY3 Ty6gvjvuCb8uCRsMHJSlb3mJWQGcTd2Cpw8HLfMyDh6ePVX495YXiI4hQqVx BTB3vgLBw4S4CgbvJagXK5USRsDjBA+E7o9D6aoxaq4gmi6Y6z56HIP9owku 5g+20GWIpa/GzSRThhZoLp+YsVfokib3QFxd3YM3qfcz542VKQB5FEnphQw8 dshtiOZS6ipp64bJOlCBfTCaFsMzrAWJwZuVrYhfKk6zLBTbiY/ZtG1jpzWr eMjC1+LqrLlmclhKU+CkQfCx4xWzrAtPeqc6DTNZDNaMc8SYqKW9L+Me1NYg qhJUPorXbIHbPQs68zTHGTYPncDCB2wtVm/PMWp+zCavgYUMGCoVKR3cDw5i 9x6LxzJhK1tDutoMXkOdsNQ9ztsiWS9zZGx4nHCSxq+1zBla9xgWFfE22wNr gVIVRAmultz0j4wvtWrgDdLMXSMnVsOf1NtsKqw+OC3UHJsZZSfd2VIpGCBo RQXbIaaPQMFzsLxqKv7lOyoEZ6JDE47kWj5LtXqyv6gNFlMG9WzfWsTU2xrW 03rRR4ezjb1hYJCn2uQqVNSVbrMJrkkgn9narBxjyApkbTx7L1AsBAZbH747 wHaNnMA/j7KPkpVsQKVnV6EOJscMVHPmjF5cz6HhHAJ2KdUCPogNg3yf5FAE GUGth8834SV+Pd1lvZBIAFNUreKZ2N+uo9xN0tebamOyi9y7bNv8uWY++vRM SqjKyfCmsyUPdVYg2URP9zA8n+pLNJqrqGJfWhxQwnXbdoeRUsIK27z0dqlj 47m522yazMdWdCh7zaUqs4EaiytHbcq948k5lNE0cAzACW54W02xZV8XczxN g1B4OiQKuIA5XsIcUVaiZJ7EwKQ48i06fr/lOU1fED5cagPM8jU/PWbT+wiq UYWIqu6KFGGaT1+J1MgR6+LVMrF8m72o7gnE+hSogBBQx8TDFHXVLgN6LV65 NJ2j7aLSdD5DPd4hWzWU5L5urF9zVkFmCsev1qDvff+6ZfX3AqQcPu7cNloK zqnuG0/U+MzKKfHwSA9/n/CyqUYssoZ9PZODFgegho+Wyswa8xQl2UmHjjrh 7nFUu58WQWo1lumVtbxlqcJ4SlT1XEBgLAM3sCXzsaHmVNJ7EM7CoZoALjgM e4ERbYtHtQVYwOlDaiJW3x9k61YqLycWNkiiDCVl3ZduDWU5XPIJAjmZg0+u yvpyg6r7ue2bw6BgMSQw4Bdw9RHMfmqVVGQLYsX/D9BlcdWpuXYqBo5/wac0 1ajIjwxhdJAHnOwWN6xR8pi3UZGdGTUeCB2dQ3iyqHMSOobGDeRDA9M8MOex oZqQh8Xma3BEoFj1Eox+wgM9IVlI0FngymN5VofAKgyPQmH9/QBJLNRe+aqj rpsT49PimVVvikagQV2uFdq5RFE4Rc4SWrI13gsLmZCquZWk3Q92VRMKWEoT EmZT4hjXolKxG3qitNXvmj0gZ6rYPZuoKe6XXwPgOGcT6KgBCx5GmbExzzgB l4Tj1V8BIQZAoyB74GOVf9gVzKssSzvgIUxox7uCgW/AlLmAGgAG0Te1KPaj 1obVHxta8PvQcvBXHmUpewYwAzuuqkLk5KH0SnvUnaKK03Vlt3VxsaQuTwe+ 0Kw5eb6AnZlJHQ8icOi1w2BxkQPsC4Rdfj/AAIOEuODPwCrLDWdu1md4janS H6+FY8TU4iGbeiswAby/2rGPClYB12d5bGBRln/bAz0NccYp8s0ILkrc4CcS ag+YlWVA0lFszgKVQQZwnO7p3tT8Q8v8XceRLeO7V9N8vMeGYjJzwthonkNb aJcQvxq4SnSWTS2ofeBg8lIBaUDyH4+H08FNyPAhbJguNdKE78swTb0ix+gm pBKAM3fFgasG7q0S5M6WosN1rCjxVki2+r9f6F/wA/+Q4fhqD1GteVBe2kZT N53GdHHjaaYAjOegsVSQmqewDuOP2DWVZ+C0A3Z1NDuKF+Vo0xcc7kSPYEoa dwbDxZ7cF14xdpppKI4IqZuq8tD4shsSbxWwRo1lcE3d6xvYiHirBcJkI0Ub Dl4U9jVAkBqGedsQd1bVABd8TgjIrmrosaW8EOwJb4k7wkCvCY9OwDo0MY8H U2NIIFOQjF6hGMgt0LQpBHlHEsAnxYHFsDD8G4a/4efwwZi+HoHDZTgkaYHz 5hB4H949U7qwvclxCbsrX769gB7WNQ+NxFldHT4wnVYBcHAPvo0zuE/yY4gF q6U6cRXO4Bnxvq85j/j1qZmRKK9ytAAJFTgCW5YsLILtMWa9eaR7Y2hVGX1/ R/9wboJJAVAUJdrCnxOLhFUSTYMMdY0ZVRDQaRrVfPqosQCQCxWIcmlAR3Ac 9uA8kBins0FrYGeVnPFTBd4FC9hBHUHCN8hDhFzgwHHeQTr+lA9h/DD3sFpc VO7IEwZ5qMYG/ucPfmx7p+YDkPlMat4a5eGm3k2eju/Y0EF1vsDmBfaeSEJ3 cFOoR+glQh7QH4eF8/KPnBAAonSoCR8EGHIaJrjfOtiiJMwUMO6mEWxYoAVX 0gGCXtNH/DHGCIIQ7Ojy8090q/l+AKHqHDxwB/zc3GWMJ5JQdYIT/oTIqwlT ffCII25Mxc3qdTXJDM7Hh7Cbiplun1OOKwspcRx2BrPqOXw+bafSncrC5ywa s6JuITibglT5SdZG6RrHb2qS4kbXKE3zfG5zrj5LPM4Sta0wnYhEYYBxDwtg WFWCn5ImrFbVXkGfOMzbnE9AolLAmlzITS2ZCiQnIs8KWnmN+pkKyuw9uSMR RoT/DnfgEc/ZARkxYDiXDS2GcP1Iav34gL/6Ax6qNR3+UMEJjC4kYmhSFvTb 5dJH2yo0/RkGFjH4quGjFh4Ts/FUXtlkoBDos456eulSLIvZqQY0GcAVjlQ1 Ogfb9cwNrQpVaepKhMwBbkP+ctPp8c1C5wU/gYeHduI5gsN5Rr43iqHA2PFD OK8IUlWneNz1GXnJl6ulDNwMwdKQ26pBHQP45DpKiHfYqHYCvbbQTH22ynL/ 8gFL6XwPIt4iS/BtTPrAnb3hKiBkBs+LTjeM5pnGxxuAPlX12fJrMJ1ugFTs bIQY5dtCwPFUdIoT7wm3x9dByKrG/C4I/VJrnqkL01ex01EHjKI9V5EBqeoF kefHk1TVFXMsj29u3jcAONgknK28Otc1vCoJT00qisJrwj520ADRffoIz9wb sJdXUof7VaclZvmUXLObuUPOcC9dNy9TCY1YUOE889NUDyUB59XBzSFpttXg gJDE1zdHdzLEAKdTi4YxYzIreMz74KtiVjhDdV/g+jggLPJqL8op3K9ireAF iAo4Olmu2PgC6TAHgWohbtWvhaUwrKrAnkGW4ABTeaMPIEWNHUpBuarHN4M4 8RQi4VWj/zzOHgABysTLFU0n5Z8zqgE9b5o7FRDwB6RojGBRmuLgxvHCDqZj HKirKXHqG/gWxT66El+oFljseciewEWaJpN90hxgQTO/n3CVA1bbUMzxCPNp fnhVpu0UpewAAYCsCnqYOEDIJB+04tN3qc4dWMvWYFOvabDwUyUOVoZ9acIG 9P/AaFL8xqhPNP0Zp6+ZGdCxIf6kBsw1RLPHeqhW1ejUUU0903HCBzgplOHU bpJElayfrPYf7j3yzAd/f38H7tepoi9oAntWfQuCFzp4ekEcNMDUTtXcxKDC Qwhu309HsfNhp6yBkFtx4gT4aMeZv4qhfy8/+5vF0L+ZaP3jYujf/bXfzs86 kIbqwLdTWmgWzfNWy/dWJLci/lAtDeA+8Palcsk6nnwbXEM1ZhgXy2gDqjqc usE9ZKdEdXGbwpuqw+TGvhG1Lzjc22vqkl9RixCKCi+Be/ZYboOeH4w6KEkd UJErQNjmARIaMogCogXRbzV7dMAbr/MMPEHg9lGLLFgfB1O7pr0v0bdmka8+ cQw1oTZMrZo6ubj4DMTHYGQIEU84AH1K+k3l/tybn40tlrOz71EdY01Fhr4g Uny9OqAPkN6GT5B3aDnsKDxd2iNmMc6lbtPeKuITpmYQqqVeiSfTMoAifqpx kIZ5VJvs/ZZoBcZDqoxdXs3Z6LnHexzh/8bX/dPf4br/QcJuajqCxnn2BHCJ k+cssMyuHJcbzdrGkHBootMJmKTk8X2waVs7onJVzEazMODxB29czzftr25o zTdNTo1Hy8Kvyj5bq5o9Cb9VT/bcOesDWn/0KKRiW7kVh1yECe/DH/kJLzMl VaaTh1JudPE4nPrq68ngAH/y/OJ/o0N6i7IcqUTNLoTmanJMH6IkSUkFVTFM 92RCIxRW4Si4J/ROHawc23jrHLS5oKb980AUTT6D/IUV0aQmN/clux3OToZ5 K+6t7PkTx01fcQHEeXMBXGP+ZrYiEz1ALPMZRTg1ZQ0qGIC6vZ4h5BBUXIcm 84Ba1Q2paKayRD/9Ha77p7/Ddf/ZDM6YKLtXLZXmDhc3wACaxF63RnTx4Zyz R2BWOQqGTzVp3aKg1NEwwPPUcg5lGg/PDK1ODs0HEICQTohBg0OwlwoUPQ3l Qn572+DDuW2E4MzWbM7XOWl8CTgva8jGqpxv1WD8hlWDx/sB9mxfcKU57E1Z 6W0f9whi3EcZLu4y62l4b18MsBnU6wYyUfkFBxCr71VB6Sevqv5cVSAYVhN9 UC42YuHe4iEAILqDqigF7feu6t/S1Gg/ge2qE19tbaWKQYMTbZnuRmD7+KQm cVXwIbEgTTyR7rPLHGviwsnmvnIUKBGH2VJ5UvVJk+Xj0gALdRypDiMkbXL5 6e9w3T/9Ha777xfSN9fVQepihVzkqYhr77B3zaNJCQAgA21bsy6OYnJh5WdZ QlP3UM6aMQ7PARG1APFWcj5NPmVoKpsGioU4MnQcF64A4I0UNFfHPBe+hkB+ ValiiU9xoK2UVQsTNBtOH2aSK5VuKYoAHEpRJq5pHs6ALMOF81Okkhz0A/Q3 PRePNOTjwXG5fiORoEUadDszLs6QOwylphbcbBnwUVtXTRtceKsrXzPC4gM+ TTNicCa8PDZXU8uGt7bmCRuXBC+c8K4ln6Y1Sip6A+Hcpj70OYMKmqBlki9c r4bXw6SSxpgl7uI0lH2pvQnt5bMe+pTBUqM3FBDlspPhS8C7HR79/t/2un/6 O1z3jxjvjw/4iz/giRRUHP7G60xcVK/8h8ZtwuOSaVtMrhnbAy09Tf2QuMOT /TPnzTsNaVfX8Y5djcOWNWhxYwMOfBCHauixtv3A03p2Gcf9uHeBY7lGzQDC A/P16MXTCCsnWmvb3Svq5X1MZ0f0fakKv3o+QIsVfQY6qxRQXxLcw/xU2IbK 8xRY1KimhAQXXV/qzpqM39CwyViVlQKS6EeeSpWgmWC9qhCnqJAAYBVaembN KvcLo9dQzoXZAn7xMP4b2FPDhFCPtocG2WMjRuCMV3p2SigkWTlgr6nxvM9W MU3eHpKRARaacYOB1YCcNr9VIH3EN3zqvnVYTfXFbmrtkX2TIJ9Iwf+21/3T 3+G6/7VH49sLi3dz7ecY4C9//lUk8L/81//qf7tT45dfeQJ7+oU/7tf4o1/+ 7f2na4dSgcD40V3zN3hLvG8p9/lzlrcX7Vrz/I0guroRH3a6nPNDsnkvDMCh qby21RbhCcp0OO1g0zq3UmF/oYACVK+pGVGm8a99PHEdkO9SmOotTuPSay9D BN+62gUB4nn2pf0KRRoUMphIneW9TUs86RN3W03tJSouv1IcLnyL4DTYArVa kiIgfa2uVQWFtoP+lDJ5T00Q3QgvOv2McVrmk/fZ3Z0HQYkx9d9qG0HkE+Y4 GYwG1trwckX4VJQ51OMZprpStn86D7Jsg8XzbAdTI2fTUIRvUK7GjTSvaXfL NMrVa+9pSr5+7cyNY11FkytvbrY0yqbVsK6ov+alOIVeejKF/7228mgAJbwJ LDO1RjQCbFI5vqtW0VS4e+vvXg3OOfy9+aZoD+EuZ2sFWFexQ+UzR1R38sDW bV5fe3YV1oDjKdN1nt0/qgIfULv2D0bN+hEjCq+8fFTqq6i4UzO7YJ4Fvgu0 7NnUeiaUtbBRfr+LzUbWTiaf7y5gNyo2Gh6cINGqIMxaBISVbmUPjJN2nDXo 3IoaK+lcNj3mfSCayLp0AfeMH+4YUYEo9gASPVqBW+c6s09MLueqZiDtqMAK qaC3gVefqsPGLSDUEM17kvPUVKE0Mo+nOWsNmKlpGto2sVdxPniQKXB9Z434 sa9v/qlU2Np9mdwzo8epghLeYCoLlMXvQHoNXzqxqmVNU2FWBmQ3l1XPPFC7 Z2Ni0eoO2326e2dkH17TMOHS8jUKkZeqIp8ZtzafzDQ6yozITFgx4tI0kOjJ WHI0K9ns985IGE/7Gme0YlDEQUW2FQMfVOSXVQQay1FvycGHTC2ZyndBSVza /jp9vntJnC2n5gncqtewWJUYa32ti5AfZQvVbq3NDNrCrJ27igTcDudgS2Es s/xafH93/2md3WmNMnd/4m4tKSmqccHWVKWFpVMdvbYRbZWz8dTm3wpAjZlQ E8Aly14lkQPb69UShB02vC0+He3T+iCn3ELOPkETASQqYuVwnkiJejWsIpaX LOfotO+vJpXeLD51aBmLaX54DGlgyjT+BWBQ8SWhDRxJfTDDcSXoafI91tir JSfymhP80L1bweOMrCBKQT6Kj9A09ngWSlyzSuPbMylROOf4Woa/ZLnovBZC sVFmTXf1eYIQJIAu8wpWs0o6+/62uGgEw2gPdNCuSyWh+7pk2WdM4dCwGeCT xDlLNso4SZPI41A1NvbMe3Vm8a8R9V5PEsiCh1xm1OYeO6zK5maaI++2BiM3 wF7niYJK+AJeOStbflT+3FoBj52nB5IfQIbQu37v8tWIwFkSPFSuI0bE18lB 2vETC61KJuVi4dEFKm94zRieeucd1Lfhnf0NQ09ffKMONaPAynnXiTJlxB8o qCVMPmtqEO+X1ZmnaexvTnthp0roWtZ1uQhtw9QWGD811MYP0EgIgOMWtedJ Uxu1H65izBLoWqvxxjNUPnBvGpiT7g3vCuiE1uw4NF2bzrOGyBywkTILUeiF vz5eDjthIHtd72a7WjFkTYmI20VsFQjsYRaDApgYk6KZwm0BehbSW05TobLa TnHSYLwTnp5VBPgbHwWyvdSqNwynStAraGRp5Y7T4lIv34BhbyrWPGvVsfhM tflg3p8VyCvPDfg+diOcojngNa1QsFK8bcGHAd2TDzax8aoqVKdaPkAbXhYN 3E+tdlAJUe6q+LsQDqKuZJCW+4as4j9VRuLFXChKY9raQ92s/KdC0l2Ffk+P HGaNxzF1jVwI5+dptQWpijYRLaeO3eQitiFr1ZMm/ajdA8THNW0e3J79jjwD RKbCjH5EfH58wF/9AfewnTGz2uk0g3qriMGiIB2eQPNyM06+R83JxIuqrR0V POEZegkVL5qdfPY9CE9jcNOOavuBmKovfyWt1surqD9frhPQpDHZIWEuvybw x/HuAMsBBN4BcG9HTW+YiF40Li6D9e0MrNfSXG4IxcxwBqc4tyLXGvn/LNbY E8qEG31gNChrJQ3lTJoqVZRVbg0MApPFwqvFJ5X+NUPxoVE7gYD3zxoW3ATE M+analxbALLWojYwBYA2gBKq04r7yUcE+Ai4vHAUhx+Ya3IW63a8MwGCVThx 20j/jblQYR5gxm1wh8zIGhwXLLuosjipMuuMAydU3YOVBySAgiANC8h+20i4 pIG4eVchX9WLcK4dogobdt+mBGw6zG1FD72MGk0QbkAD0e+cVIn3jmivtjql 59Xeqg54HkV7/BpHvTXIH+7RvufvMBecsy40PNADvq2R6euX6qo/iKz8Vo3V PwqO/GGl1R/98m9GVsTfNQFuttW3CloCQPxraO0pxLE6TD3Ppr6ulrzm6bX9 jFfCAS6tO7A7RwVQqx+hOZB4LgCOWEYGESovZJ1zdqurLlQ4wn2OtD9lPblq hUDYM95w3rRHwQ9gvaY2yttW40O5iujR1Yxb24hu2cV1lRios/JpoBTmMXXF 3TuxuFcAsF9f4WFQ9CVMpyQLYtnVfjvUmjqQBFXWauzuSb9qJnRadZruSKB4 t/cGSNCeY7hjUmtrAsZMwZTKA1pQ17FS1ar/813zFi6rot5ytYr9ujjhnj08 0a6kOohmKEFVQydu3UPWd5cljK6ngsmKYdQWIS1qI35KvADXTbuT7uliicua ZhuS1jTJ4NvLMkAzSZ3KoWahpTlUdyweuEPL7SmvrIpUwoBugxjha8P7yGOc 3TscNWgb09IsAc1LyK6fBFPU9oilZlGu4ilWbkoaqokoXZeHORSV4FSHqX8Y FgLpaKpTiQ0Q2m1NjerdEEf1PCWspH/rCLjuDTy7Ly9qPU8va+q4ICBTW+wb SDI1gJRKjP2C+xdNxkNlNEW4PtMO4HxL9PhX08l/n1UH19EgfAAYbw/8mIaT Ki+nnL9o34haMFM4xdL8iQp3PA3UGn5sMqn3lCUVwhZNOtNEXg31UGFcmYp9 FwHgphEyasTLE/aRNG11laf7CyMwtUv0cW1BUW1TmhSSPnfZEHTnIBY140lg GBgR0RWkw5YEDEz5DtnQNDeTc7+WVx7EAAapRlXNyNwYiuLUlD19xzvkat8e Lh5VW6h2FIC/TYYfYfL30JI7IF8xISq9LVMLWILGHPpvuIxaJEvWGiQsJpRi wrFGrFp+dAeOYwhqFO9l/A05pQaxFG2UdSkNrrssLE9UOWdwasHn5keEsxe3 mpoJVET/jCbnV9WF1m9OmaK2sZUg2RgYLVVAHi04Uj1VcrmJZ0Gklrb+mEcl U31o+vri2Fpw81bZ7eY7qCVm1du3oR1Z/CAYSFvpYz1aYqRQC1QYe4NFXe++ Q8zRZ2QuofJoPkyywiGLWcCWucZXw6dTWZCy3BWORH1n0O44ldks/zQG1njU p1nvjahw2qz1e6BErwHFBWmHswEgjvqtukHe9M6na8ZThchqEcZ9AjVhUvOO /Qej+vEBf/UH3BtR1d2rPE8Smi64mqiiGwxuXSo5xtCWqqSKZidDPqBYZ9xh +eRbq0qj3TvuipIkAQFXVDiU6DVBxmnrI65rtG/531L2siSHcq0e53FPXc03 XG3ZuC2EA4uB3U87wJwkXqE/1KKeGS2itBJM/VzaSFCFHnIv/gE7GjMW1hcf +sXt4JOzKmQwa3C/keE7VdsGh9ff4j6mcroaFzS3nCQM8Knxi8WfPLAr+Z7O PLRkcoGZ1UOpTiD8NwwISzu1W2l829Y1AxjzAJDCHMM4nmfVEq8unvavidu9 /t/+f6//50rd3n/zp5O39y/9O9K3f/zrv0kzviVvufkEyA0gda1LWrjrEbUK dqvWSgPcWoIWxtyrdtI+wzAworF6kO2NVL/85AcdtZ9+7KPN13GmCmGP4ISt PHiYFc+XQz8eNt3eZYoQT6ck8FO7pqBn1DAcUGVCxABHWl99+lboLG9A5zer S6WdRau7NT/xpkQaH6EByXcCt4BfFv9zQaMT1eBVNXsGB92gjnw2qCoDslVx DWIVKYYnPZl93NW3MfGi7jmpVbweyMfQtBRg04jasTv3mjD2qFjFXvx/1fIK Q/nM51lhN4rGCkpdywyDw0Hx+tpPt/jVqH6xoR212kOuGVhB/c/aLAp1g160 l74B5tDpdvbdUq2hJXhtrqdr05kOkm8/yq1tLQvRrK36DWaEUWiw/lePdn/q 6g58CBq4w5u1ZI2lKYiHlpBiGTBIHLDX8F0PjECdtcIc3eWvE/8wn2zdmVCt 06XAv0u0NAso2oiwtYRBWMUrOdzUDz0sajtH0BRNzbWK2s4HYH4v79TpOsak PwlcxLMlzl+LkTR9FAw2vgUjFcZ8IH9I39o5qpewVpneUN4IiUayqK3uGdPM yyY4i4tO6+8WQj5tBw2lhNXzohAs7Gvp2stYVK747oQ8YK8kalneaTbYT6c9 HAHcKNiTinAk76/XhgKHooFcWeAehf5qXB6nBI/2aZQ7gZumU1YYtqQWIGh8 +qYKLaedgm3FuusEsXqx46iG9vSBpl8+FSHXLL/0DBhAeWDBsD2nHHhXY+jk OJem9IMbPdrttFp0+gVl0sIuqMZT8aiOVEXX2y2+KgAdQ5VDNSuQLnS8ugqH JvcFzVFwoBaxLA165iRce/pANsLHX9q8I0817YHbdWo0hGesr3vIqSMJnTpn 8SHAaTVgBgRPm1vc0+W3obsqTwj+zyZwVXXPCamZWcMrkZBYVCu0tMYI7VB6 BYRboio2PEp4xjPi8Ju/J0p1U82klFSHsgOuUQAV9SJ+K4gET8hxSepGzlEu fCnh7/jOmxVoXMOUKb/31n6nA8fAQGgHn6aEjDk0tS2pe3SoGm2do/ildvlg +pUiu80bblgjeMY9ysNvn2RMDYfB0UFH6o6QYA03cjCQAyLQ4jGNwgjahTk1 S+Q2xTJc1Y1w76rUaFFQB6e7tEUzDMUhEhbI3DRMu6pt0fME7oHgNL9iwp09 EV9UP43k7wTuJ3Td7arA6dQUUVM+2bRslTcYxYklZy2znlwZTuDstw56qqU8 Y+LuDtqSikalapnbrnnhr6BwaAwgb/KUvmj0qHqzsXG9q7XJPaNnjgLXcLU9 nwSuKVaYWzB1lWcY3aq59+a+LZ+JDzsqB/S85sYoudPD4zZWdJqLx3n9/ci2 hsyrtRvHuzQcUVs3QQ3hCJMqC5kzYAIUrb4/pxakWp4Fqeo0z6cmf8/v4ZQ6 hxWSJrxxWsu3quZNRMz2/hIhmqJ4kizjCprGUp7JVbtzwfzaKXcsDplfWlzx oVGFZbEhaEWLaSMQSHIzDSKcyuQCKBb0/glOphDGQSb6uV2EP6reyIpyQnsB BbVYK10d6kPzSZrH2wlxoX5A/6/26Y7FWVsqOUr9SeAaqtqwqxsb4iNmBAKx cWDuNK2p7kgTUCU67SzeWTWoKNLtJJNTjzpE4VKr4MdQtiAe9d1kLWW1WrTa cGnCzuKBj2Z8oV9R/TO46PBMzNWYrYZHLelWK86tAIngUBp3qfk8oStli7lt GopcsU9OMEVD1fDeUW3bt2HRUkMtGnpK1FbqmEY0UJvc6kzhWLLUClB5FBEl 7S7aSZWi3xItB3h8KrImdqxqv/aPcMOPD/irP+AOSIK+cCxJBBvoq3nyDbCw oym5spXKmBWo67SSXQujB06kPl8lNcQb3g2PWdPHJq7M54zueaUWoJDfQAhU HBCTNAryHNM/od0aQ/yUxgZfVj2t3UUueQeF3NES7ericbT/uA/tD8e6HWyV h04VbZJXW00Gw+7HRWKietw88LjLeLFSXqkTHhg91rSlrE1oW8t6W8J/q+pp WTC8LxDwHLXBP9A0V1mpdsNoryHHok28b4KUrcNLpl3A4S4ESHeLQLPafd1u YNSCmoxvIqFhLrnAwG8bGR0Pv4IS6aq2tq1hI3Npf88oFUflVVd6vrqynNvx 2jZ5Qw9ftWs9Kbt07RqcBreLdWqxbvhy12LlXBWnzMtuzedJeztfGodTNCMz PJtVeq9OpWDnspG5zAkNn19xIF7RaaR11YgaLcPkMwGdQ3Gqjg8JiiTV/oyp A/AV7DWo5pcE7h/GV34rhfuPAyR/mMT941//7TTu+daMqR41f43pDrgMBQWh haiZeqbJvdXS4kK1DVq17c+OzAgEwEOtO9TvIaXBQUuQZEA/oJtb7ucbZdBx kW0ffYzTJG/cqaqGOepbAr6pn1Cju91ECTe0vkWPGwz955GmAPmjii6PZ9Ps X2lkE55XaK/bufUVkKAKuOjuNC6fFgCPTdUVXoOPZgbMVAyOAboOntNr0fGM JShVrOGs5Qk6wpuldv7JBHqtn8aIpQRiDeMrZoUleBc0hj/MppUevQ6NFYYA Kfawx0tA8M/QV2zL70YXgIVhTtgCWOSDSarfRss0kTZDBEM2De7M4WilB4hC EdXwmEXTIG3f7xx8Vvv/l37T3LkCHXcg042dGh3+BIHT+J/UtBy1jv4VOfRb 0Y5iJXDFeK9QMY29COKpn02EXSYNVzrK4BfOH8AED9GCxrh24zQw4/5XKUWg KgjwztOArnZUpdsEzESF6rxNp/oNUHEOWy39oWCh4TEYlC5DEe4TmFH1exDn dudpnFAcKHtYnVG92LyQbURn8J88ROEsvdhgXQ0sukwb8W6mqxrdHmIMf5Jb c8KqdJ1bg5hwdcjGzvsbu6tBmwvcbiEAkbsGNGs/ID/1MMs2+ldNecfT/YHr TR+5vv5tgGncQl+apQIDgMpplKcroGcOC4MXkbZ3LL0qnrsGTdwkoKQ50eUm Mn207vzbM6vSKjhYHqMMjaguU5leTHko2u51Ozjh8IFvudu0sFtVz+on514W FklDyngeQCtuom/tKgHQ76kWhxhVARLvPF4PWiU8Fei9bhKfoKUlqLR2/gLR 69HOEfVPqWooVAU6oa/IsRrI5MzPLR9jf90R9fwNmaV2pGhMcQwaklC6lqO0 rCUe/I0VjdbfLo2jDSf9fPMpz0OrFaMNGQoYnor7k0EX4ntjYMLrgLpElSzA EzSTrDRABKydf6gBr4qDba95KF2VN8lu8xCbkvVaaDk01kMzubkJzdU5RzWn FdqjxLtao9GjI1J44xunAWIJLbltu/mo4ZjZO5gqPrxCMztHMWJYE/QYbX4z 2YGA+PeyNADEnhWbp08/NPvsMQ+mHsev3AAwumZDz7A9OameaLgvSOW0YHbi RI9mppTHlOFPNM95HP+DV/34gL/6A+6Q7tYmFq0UaT+HOs50WsSSSuK/Jjg7 a8YURnxoWBHMpZ8npLtK+Sbln3NbiNlsQgDa1sDGo+HlmkbpBgYJI62x5EHx HuF+kDekaM4nXxNVNt5gEXfsCYRuaqCteC5NYkwDQxN6KrPihlWs3vvnd0t1 MEP8v+/+1mX7unwjFOcGEFsNVFMGrdaeqsaRTOjUwhrwHiBg2EXoc2BARAIT ntQ/63A7DAz8um4AEerPzVMJYtnhpWrOwP5+wHXaGE2LtXaCEXbVmlWsUHv2 RgcbArqxrLf/NsZ61YjyJ+jF//V/COv/n/8F7/aHzbf8xvML/5be29//3d9k FpqpzbF6dTtPkcpQXMGSOxCOdmM6rGYAXHyldbj0puLg+75msdw03P5ULVOa P/ehQM6+Ah8NiN9q7dTwxYrrhtz79K4YwPdfYtlP1+y0XbR989QdtMXuDLVF A0GFALIyciCM0c2WUh1z3wgDRpgDIr2LwYjjdCL/2tHJ70XN6XFOm4WCnkMT tl3O/qkZ9HD1S6J5QXWEoSkD/OWiZpxsAT2EdGflV1w0D5XZR3Orz6mi9U+2 VDRHBMJrWQpuPYLFDCGO2nHkDyRuq2kF0AtzbgDh9VbLqsz1lyDD9En8Ca08 B/KUuurXak5xg3o1Vt5NB70eifuYcG+beOf7hDRrzhfjIPPwKHt0u3ybk84e R1NbsQTae25ezcFQw4qU3B8AMCx3aoRLcbVa5tW12oxbbqABIPweYPFpoS5t WAUSiqYWZeuervY+U80O4MCbZi1uO0HTDVHFhrlbcYU1tOPLNBBAa7/55Geu ueV0Z1W0mI97mp4biautqJUfSa3AaWYt/tMaqYQYVHDvUuyDY3r6nqG93k7W Flmt5chbAxAP3EShLCXQtJJxDe2kydDDpqzwE0FvT+T4aLAn9su0TS6MDROC svOis0rrDJFYwLGufqrelUQM9VkirjG3MQx0IUcEKKiXbP9cLjNTcejGCmnr EUfRmqI6wPb3A8X5jC8VLA8KXnntepApLSrL8P58W6l5uagUgTtKxGVsvwMi Pi1+WpaBqloqguhwqzI0gkEdfdq/rjaD7rVWBX5b+GmoyLMP46xefp8ztwGe FS6rBa8xt/pqZ/paLyUTAe3pKFVWdfDk4xHl+HA7rQLTcsCs0nWwYT6gSBza 0nxjrQYt4FenhTU2lddAevt6ivhs35kap6Y1taP3iBeGbrTsvim5a3x7kNeI G7eh40hNC4h4tGdQMjxLvWKz7896KYQZlzZ68WJRvft5VTkyNQoqATk1tejp AMzhbn71a6mmRsuONe96m/bf8daqg8WaNxihSsXVjqLdVREYbPXplEjeaVPf VnRGDS6Gs561bSVhNQdR5fvLj9x1Qlr86HGqD4ApT98sPAVDCUFQAcz8VtxF tQgsYQfFgRsq2IOFiTICObDD61mIM00ZRa3DyAdU4zafMJq8Erfdl7ahOsB7 +PbdNUyOSleeD2jrDpvm8g0U0JpnOG7UpoDdVIlja/Lq3+qWyCdm3LrWsVnx z2gljGLImg2+Ui5ZvToGWWptFZWgOa0159PCN4oOLcT7nfPk0dSQfU9frho2 hZXUcAvTXIHqg6HT8JvRxGGiVjt41cku5GttjTx5ImOT44Pp5oq8YzsQb1xJ 4Dck7Jgh7dDUSNisQhstsuzxdkVo9d3oa/iZ6JazCPVqqmAZs5RSNdhFHcqG q6/gyq5B66VoOuZ4kpq20vmmJCvSe9QOjVEFP2rFmOZz+9gVzp51V61RCxEH F25PAtO9zVJCYCYKpolZaSgM7Jz6V6RsYzV0X5O80tSeKy0TFzx7glpZdUAt Sbt1pl27oSDRQ7s2fN7IwFYAEXuM4+VZXNCUyTuhypv8yWiQcv241jhq6tp9 qj7Mr4FNG5x6SWMX4KEGZMMZXQWD9/309Gq74PSmRXThlOJrWtihGbXlTon2 DuhJpXSBUcNlfctJb/nSHqHLRjXt84G1x6/qypmQGWZ+FvDF1Ip17gRbCvZB 7KIVrdUrzyx2l+XqvSxbVUlfC9+6prK6G5i4pHL6NrNSD0XF4NDzp52cV7jD Bbn3AZUPNTSXQdq+4NV331VZCsUStZDmqI+nacOVxzCmp06yzDVwVdjTObVs JLtWEFqNIMD/8A8pai8r1wq1GBpvxP95Qnyc5Q2dKp4pcMZqn1EO/xRMEneF wTNNSBUMRqj31vqjzNU79wwZUWJaAyUzejPU5lOlKEMBmDlHBBt0GNUBj0SM l6kFF3l9UsDtXtDVYkash6ZJcASqclXQZy0udnxbftGuYKCNXHYCjWln4VN1 1PgnjYRUFjyq7Q7rBoBvyWspVVT4wpTrXkrlCPgWbZl5C4zurJCrScOYHb5j a7rqUEHnWEC6hD7hbaKK+bBcmAP1CSytHXs6VaAMK9ZPvkBzXnX02oMSG94b lKMG5oAi9Dm3YU23htI9HdmQ3GcafNFCZHX9IS8aEVi/tS0DLVNBhmJGcIKN aedKwGxdc1duEVDvjbbmqJWoaBq1epdCA/wh1w3wotVYCfykjZ1Q113tYaTe arlsFMiyFy9fsHptWJetISec0wAtFmene9CittZodWNXzz0I5v480LY2AmPx rZ+zncJ9BnhwGrNle/Ew4FKQb1YPg2lV0tORpsLSv1+cEwOeiyoyal9HW6Q4 qoKsg5k0iRx5wh5CakbVrr86gsrLn9lXnBQCzRVr3Y0FlZvj488CQ08lU3wC QweVyhxli6v6U54gAFTmMpcYNW0xddoA7osWHE9wYlRV7OCG8ae9FIy5ARVw ZWpn9Y+oI+mq+8axFbmAftQzs5a6uRa6iP7xhN9mqqFV1kBr357+vKyyvotp DqW3dxK2Vp9uPaivJih/FkCLnUEI2MqsHVZoSQVfPMsZu/cqlDknwZ2tlbq1 vl4rCAwo3Yfq+9Fd7QcL2rLsFTpej2jG/phL5Lt2aMpWF3Pe2g0B6jtTOw4r ns+saej04TJxMtiS1zoB/l1VPB87icrarBgx7fb1qsETS1gF4+6heiIYCXg4 HhiPCb6Z5vTYZ01aW6D1lNDc/n2FSqt9tOOUH0X/+DunnUww2/669xlwIZq4 KQ+3tf27a0Od9iSijtnwm+XMrsEnU/10vb7TvlHLcZlLLKLHb4DjtXw7QfSB WOgsJtAFD1vkHnBYDUPjVh0KYlt+uktnB9N9E8i88ay9R2HMcdYETPGUUH2k Tov8YObylT6ZfzCAvyFd0K55OdOipROa9NUj1FHbgFNrpyEW+HPEsoDRPbZX W+vuz8O9qfyTs9WUOqsa1oK/g99rup7GhwmJ+e2y+q5UQ7bdOzNMo9l+MZfa hLUj6t6yBntpWW3RXCc0N6iGtAGwRFxwFWOMiAIh2k/iVu2MGsQKJZ4H9JAd BzWVQPVqMdYycQATYEY9va1p9fF5dnbD239E8H98wF/9AZfv2+rVxsoMDQJT 8wamTqEIzT2GieC+bG1QsnUlv6N2vqIKN0+qeCuvMBlmb81WnVdiGJUCesyu 2cHu241raFHWIGbV7j+wLN0554Ot1jjF2LSiF+CyWoolB1UvKQMNsoJmSW23 MmgV0p7jMxdAiyTn0T5ZaBZ611erWOuGBTWNFoA94s6OCKjiaEOF5o+dAT5d vq/OAdvoBlfDLanCFKzWtoGe3AHkaXFi1FL0wys2RSxw/E+UVYsZkyY4T3CF 5kclrazLWg9p0D91BG9R2bhVYYDNBU08HQxA1cv3RRxLidrqY1oQOLQ6wWlo dYQtq+cWRACtOqq4qNBw1by1ZxpJAnALNrTNORt4B7JsZ39TDidvOXgID/5f nLDGMHp1B9xZzRDs8n0q0gbb+q49lyA+0DfGU3u3ZkqauBG6IkAbylvTWetb 6P2E7BRH4yTz5pi7r8hJX6qlcQfnB8wO0Gy/xjeMEw/axjpPv3DL9Q5n4LF7 GQnABXZSDwqItnDdHU6miWN5Kl3Pn1oJYWnkA87mNsy9qlQDpwetgYOhJFX7 SXGTLQDB1H6jbgAk1XhoB2sDFz/5l/EMD3HqANNc8gzv5wR+loTe8A4xwVrk keEBGo2VtWMa3un3myfTzDNN7YsFfBm4PDGWWdSGmJWDUzQZ7ol4Nz9zdWoU eBLRT5TVBU0e+KqWj9dUxBhr03+0Llbc4+TtS9Sae8sVXw3HfUY4wnS+JIjm kLp2FLXU9jfAZa2aLgpd1iDIBCZGCkbxysnfztOphvsdWfK76ajfnVjy2yml Pzew5Pd/9zfTUZBl9UJocpfaNDIIGvNRl7rGXdD2B2ikiskSiGqC+xPw9AmJ aO7BjmCmmnH8X9pKM4mbpv1C+FpSyafPIB83sXCARHuMOgT+rj7dmoaIkgBZ m4r1HdatHNW2VFddak7br7Pm+C2tAgw9q9npFok6FFCt/EucBbSrhUsZTe0e fH54iJXVhQMgQpdUBAHve6alxmfo4Vd7g1xHKC2PEB16VlQns5TsOlU7V49a VbQ4OOmZypuOikvTlTIkvsETGgCq8zBBio9JKDOMrWeKs2GxYFhzbbT8DiLW eldvbL47Rq1QhwGFk5Jm9qJjqFgKNlPQIlttpcJcoi7dolvP2heVvWmBodOc 1Yq1xkapXBOCg8ryWtuXcebSXvkYFcKJmj56vdHc9x6aiFZq5rMpwxGLAyAq ENNhVnCiMJpwOP5g4SO9tYEnmE9BvYN8wWe0qtGwFdY05lKdPsU4KJMYlHU0 4jMhWM5Qbns7HUb8B+NiE26Ez4BvtG/tz+ijp6+3cWvyddZuH0wdxFLNFPiG jpt9ig69Jsg5mIXh2SZ3VGbBTGl+Yto2v2DpkrWAaHeNvLK3HgBfcVcC4KJs NlwRjFDlQAvqqRmPhnxq+W1PyOwO2nOCPCmOic+4ZXxBOUL9hkhF776dKRUm 2ZOyJbEqTMjFV1C8Ai1d46bmM97Ti8T8IuMaSjiHJoY2hMmnA25aGSRg2GXN Ho0Kk8LUcDlOlxNVWHDf4C5bAlxOyJhr7RMSp+d3hiYg4rRdRtlUg6iGvh7g N8+IYpBavGR8bQN0fRvilSoM6u3yhlzaty97F+0kTmqcm15OqJwUnu3QOj0N Gj2qjMAJm9t6KY+GbmRyqv8vaHxuP9yNqX3EjXeQq8DA/7qyirXX4MTTc25w cCWPz2mckcl/Jb4lazywxmxoqWSNKz6jcTUl0WlHaomasasxSP4cBQSyFpAB ew5YLh/FFnE8eMqZn8FQoMLzJwPlk8vTCnDuDX+/eLkEcYxKoRZN8YL88zQw za4xjbBSnuSpih9tGTZE8ZeesJsnJM2aXk0zAQCwWpUYalD4rQbFrndwz2wA hRnuwTkaI68yfyVvtLc9KCwRudKVVPL7lUiqwlOd5orrOM24vh8oaoeyZtjy 3bDOkw35BDXjbmrTpg2Mp5LOUcOOFePXFp3H5qV2V81wbhiB1bSBCPyv8Te8 EIguK2P4QaQ6K6YC4cVYdQXn38wQELB5GHJUtnxyrQWThcQWVRaAwiyYZkEA jhRzxTS+GoN9vI36mh4x9yVrFJdqU5NE2jTLwSt0q27EDG9PGtrEK0O97Vl9 4rW4REsHjlM0AjOJiuQPwUMUxOhz0FAjXPBSOcbeWgx+G3VM4SXwmLGsKdde +Yd2/NZBbIz6yIpPRS1GWX6dqglZ8CI01Z4GVFV6YEZVpGpJg4vQfLQfR1eh VAdUqGFGY6PPTXkGzSv1Ty8yP/73i7o2KZwBKYL6RLtpQgcU6GyNvsMmZ6Xv z3BgKU0A0e7jtN7Rd26NlByYDFtVtcZRe6g4PnUNopU9f9P5NHmHWy7VNML5 1r0W78LUAEFwooVJQ0fAG9krN6iNVN/w3wkcVnVyUXWNdk18w31u0xzBM5q9 gZ+ZCq3VU7T8q+UOFIzI/tJIacwn3icGV5JGwt6mL5S7vudsTb6bhrkEbUY5 jK49tn4n9aVjz088CBNyiiGM2Sti9pxQ0bRW6DHODsPbtep9ChOpzr3IHKp8 DD6UpxKQVcDqSeNh8vYzsc7jTpe6ctpM5ZtBm4rhYFTApN5g5YhQ9fVtfU2c UO9PwAseUEdCD5rsOg+HYd3Anf6t8ThK5WRryP3xyXNf8Pd3vhnPeNfJLSVd m4qJFHDVylDhR0hMgTqCqope3Cqm4otpyG49KZigtoomq9Y1asawjgkpUaw0 8ALNNAslaMSx1rUtzfEaTz2O4pU/Qng/PuCv/oDLkOJRAaXwiaZJoctpfgfe VLsBi/coAwayac1OHuCHnbQ0550khB81pQKb6qa8g11M1XMNLOb6NlQLEFWw 0PoSRULh7wQ8IO09hmm6n5NA+KuK/dSae2UwwP+qMMS9Vzy2VuvmMFfVukCo 65Os11IeTeBwJtykVAWm6wRNjktqdAJIDj1TD6uMqeUKT98JpvI2pOpcWAW2 t76dJSVlBz7mSwHoJ2CHFBW0AFHA/PDdoQX89MNrpkr1g5Jtx/FgEKGwgIdV PffqMMFSlajhJXuAUPFn6amxUlL17ivQJl78u8F3oNUW4lERJwwHy4i90fA4 LQ3A+WvHeFMPT3p4jUrHBJ2jNm04BTtDVVJEQHRpadJKrmpCxYSKJG2ae31V j+tuN9uQl+C1eDw77WMc6UQl/bV9Aw+mnrc8tnUtnsGBwLshvfcLgtJyUuQv aS+LVyHH7gf+gH0M+m5tutcEAdW9BIyyVrs8uwnUkv+rkVP/q1r5lz//+Xrl X37n31Ox/Ie//ZtBoqIiKA0tAGqr3FBzzTUJ09J0iFeNmnSOEAJ7W+KysgYT P3lSjZ/EqZeqbqYg/9lVKwbQBt4ghiAMgwUhsYanUmlFtWds5HLlLryJ2t6O RuN561YVT1QKemIOgkIJJR2w7tES0qqqCadYyc0nkEwHegF1f7sB+L4S/c4K lmjuvxsKZ/H/SSk1fCTDV58NW9pJcvfp1FimJs8oQBhCsfGFNRdoqsE7wROt Qa2bhiNpt4WWsD7ou2iphnrmlOTtKTVZG2CL1ySCk1TlwA9omhdwSLNSTzhP czAHec8XOtqwgjnrojEqNeY7j0aqqKZF7WADw6dFLVkx/Kbg3zuHrbqpWlU4 UjAt9kIjIXWzr+g0trhrLorjVrlaFDW1r2nsKXo+7V6NBF1RxDtoXDZ4EQhc XU8776Qy7+WbaQ6uZXBLyXZke/tDyGFUjpNYA3LGc4i+NVXtKQug+qKjreIR rgXTD6oy1jC4J6XT8rmLA6GtmkCr9IliTwUKclJpTlUF5+ewCXaqKLeyg+iK ypfu6LwCj7IMy3vVSCaFZIBZSoPwEsAznM/YWsurNQlpqbD32QWCxN8bbfiV UmQx80wqu2waPy40qb2ZBjqtmC/j/ZDKxaVpkcUTTVcxageJN2gx7uAj21qL g0MYMJKuips2J//vHE29Kc6eteiajnsX3kD8sZZFBdIBR6sttinU04Uf4d19 qFRjQCo83wPJQQOeNUs8isKbWh6MPAbNYwJaf7D+aNOY0l4w0bqXqjoDYjTi E4rVhMPfj+tFTZGvPInmcKWYEAzsC1+xtCICB7y15QkufbAWE++v0cwPyt1N fdq8FZoJE3K5rgwixrlojxgmAWHfW+EejJvTSGmU+haB80xOQJ5WOCDrMjxs z+NRef2jUloLWBn74igzeV5c2yNke55FHjg8qJbK0Y8qbZzaUivyoB1UuBaI HIw7r62xVSuP842reTI8Urq7fXC1kuAtgcvSJqqw0ULtXVWDEFcYOSsV2vOh UfVaAQb1rF5CT5Nqp4ZJBCC2Wmk2ojRQVVWqAFN5dR4B1hUrd9ie+tCI+71r lhN2Ej9SFFDRAimV73XTgMhYVPRvReUv2v3Rz7dFNZfyq1YKzfDSKmkzhaE0 AT9q+g5GY6ahQnXUkYuDhccKr5rvXnXb51kTlCKm3PdWjnaKTS0J0aZD1zWt cmr9+sywwYFIlaKOdw14vgNLUYcwtaO5attrWVrbBBLjjdBbAMkKmtKIaZkr oDkDWPVUWWk77C9miV8Z34weGFxBVZATXANOsYMOm0bIGz63Z3DUWN/2a1+e IXYdkBqcja3G+oIhC+pYQUNUaxPKXiiCKmY4qBS7y9v18DzQRmEus5RV1f71 isSBu3cIs4bwDhCjlnihQUc1ZiqpVWAO11zf4d0I/foqh9B0/DYflhseDu+k UklVTGXN9Qqgxp04Q8jweapkQR/7nk2xkkbXiZh3UC+uCYgfJKGTzwAmGi5u aWfjHtoUU726D+7P423gwAEXp3HgmhXggdy5N487W5gL/k78vaEeR9O3636I QYFG/8lQrFecLGLNleZq4PFv8n8IaD4avdTsYUqUboDtTBwFHObRaI4XZ6aR 4t6DBBqX2gYnB1Jv+LmjgmMNu+NV1E0IDtnuWdV4wBp3EZ5G+ifs0MEebe3B xNjI5HF7SnFmkEHWgCQl/kyriz0Q+tZA04qqaRrCsHBxZ+yDNwbZf9Zucn3y DUXhk6wREFWU4n6jFJ85tAY4mlq0UKuaOjS+/hQsv+sIxEATy/GaGTE7oEkN DQOTeH+egeQ09DOgISqTzsr2ThVfTUyFLIYKl1fxGeTqeh0NNbzdQLJ52SjF pLa67MGgXAeeMshsnqhtDSG2Hr6tb6IyOaBtW60Ez1qEoXGkEJyoGar8smnk u3dyU3NFsU+VVn9QTNMOgTDpyYft0m/oBPPSIF1UZ2uLgKoKwtSaJA2dm2Gq az9HWTIolgHTt9LSN9Cwn51a1Lg75CVBewSZpfwNHjYxEsPpAtGlyu/zxs8q KKV0nyI8OUxAdumGLA4Q/RSJkj/wELSt2ThYC14T2AFb/zzGfUKcZSwaNwxq 8AlHWZAztzV8UIxKpZMxqAQBUsWPzq6RrrcK7x4uGzUijk7byjQY2BAD7L8r 8HENrNkaZxorOq31d9parkx0e4aWzprxFiXwQnVVVUSfb0qhhls2bfkTMVQZ JQw+fuBUQ9QeKt3vPYLoOprkIA6omYNL1FNb0Xq7MpXh9HiFwRfgDOU4LWjh zlOEF1X/EDSJ9+taQReBUb4M7HbS4IIDUUh1iCoB6C1FFOgpz4Gq/v2i5x2a 5TTcD1io2cMANuWwNfEAYK7ZJZqIEDS9pDbV5cjMP95UsxvUG6PhrNhS9ejM rAawpGkZYIxhJcJi8EaKiqqGYz6zPUZ7pvNjXXxpSv9puqNKqTWCY8mnAKiU VJna+DbxuukL+IMT/z/2zqXXkuO60nP+igI8kbtNId6PQQ/6YRhC90SQGz0U 4mkVTJECSandMPzfe315i2RGsR4ssVhiSYeEreKte/JkRkbsvVbE3msdLxLx KKeZWKgTdZWtdlZc0NSmSDkKYC0cTRTmtcR99jYc5QNGvOdes1xo9zNOsTsX AbK6oGRZV15CcQP7+aSQXhW2hRtbr2ji3m/IK2RPaqhait0qcpfL0HToEVHW 46zPaiXQY7eH0V21IYZ9j06KI4cEV5hAJPQrI9atjn5iS9GDueSkCeQK7XoT NCVjj2jrfcSpgQ7JoNktJJVFfDtcUasMYeSiaDQUJ5XsBIcEr6jQiQfvEdq7 h0vMVCNq4y7o9zq5Fd2wBQrT+96VvknBeYXKLFLMeYu48LHpE8Xuh7JXV8zO hibfsRTDFYaU1NiIop8BvaOBd1GhdePgzmhB3dztUqFRLDV0d8Xa2xCTmNRl TxsXbRq1oxzKMba4rxLKzidExEdvXX7iSwGo4qDDMwhXaOpVRTmKA3Ngv18U E8nUfNwQyeoWLkegu1rzZjo8ShRik6uF80dlg2E1+ktPF5CCVLTRJBdZa3fi lHFS6cUFisxZCcJP+mUqixMVaCiGj+CxOS9C4n1QJHMfYjZu792xWOEIlrAF uzmJCXSP19mI4ApzCxg8NmbqgXrzUugIPfaHkMgVVjA0Yelt79UApELAqRqF SkMDG6BRc5CNimxtuScADeRDzfFxgQ9+gfvJsbh1xG5zot5NW2dI4ummKz5s emPo6RL1KiU2AzOJWVj/nmoaooG1sOm/FLKmYh6t4ddBX1dmaleb7xqLxnqn PGrzYSVMKdg996HoJTKkvNKvOuFEOV01kf6L2BQ7XxQG4Sk6nS6eu73j2JS0 Lg3qgFjEdbZVEA0KdWwTqaRVTAZ7ikVMG5C1Fcw6zMBHv5cpKbjQ7yz4hCt7 p2WCLmNbMdQTdYkofwszdYqoRDOFqfaxjWyUATb9R0TTifRBS/Qilg38qsMR eRfwV5SUqivsAA5xe+vvEr0oqKXUr21eahuRnvdQteyVPQRA0RcwrSrfT6GA EShjO2QSrXJ2VUKZ6BkDOpV2awHYIDJmJl2o1eRrU2kZ8nU+ztYpG7/lvsme am+hIVNpQ782U2sQXISztIVqowL2DGyVW2VCCM3ZK7dwGlioWIviV7R8haeE a2JKW0NERa5enADzNkVUkM7uI3kqmd1yX0QrQ5nX2DC8S/o8TCNONKdMunZt heQ0WnZupQAfOWC7ow3BHTsmumkiC1OZs4Q0ctb/WE0i8UQyPQxb5Az5DU3+ eNQsK2u6+3YGagaazsIs/VKXTmJlmCQZDBo4A5tsdaDQCSGdmEwem6RN7G3R KOQEcjQAfrs4Bq4Nhg5kKjwFNfUUCFVsTS3BqqMQHwewW+7Tg5TAwXzUJBQH GzuU0SFOPgx6LkVolOydF2/beaWoGX+IjboYhFCCW3l5TjNFm9tVbpvYM2J3 RauVplkBHvwP9EiCGXc2Jtr3PZXOd6pafuOx0g/V6HzHymWsmK3iWU5COzRY t+0mdWk+B7YpET3J4m6ClhYRGcCovb8HHHFCGBY/5qB46aMZVx9F35Zux8t7 CnUPhMTrNE9lrfdggODlbWdF+EVrDHlKvfVwbfbUhoKJIJ3QlSKkSLgRR4+D /TuLG8NZBdI3ail6bbRwb1fd1lSLySMryMW1ktZcll61hZBgPg09Vm3zHi51 420h5aupkBQhHX4hGJWnPvqifEjr2FJR1/ElG8Kkh4QnxZYiwWIEIlGiJ4gN YmOA1QEHz51TKz0S+20G3+c166GfoCCS75qiWnEdsWDKkTSimExSnrmzx7Wn mmUiYqYJ2yH0rIbpB0rDZ2LMyOmGopelk0aMX6FJ/zuu4KC3NNkBEp/OVZdr mFPebmjOda/qdGhIiI+j4bu73jCbXQ4XReWSJSJF68vVQN+Qex072YMqZERc i0bROeD9FlsVVIeYKWiIuiBpDN9R/PSiD3pnSlNHtbom6BtOOJKjjL0jA0vt tMIBTfI40PvZRE1sClspuuOui8Ky2fnYJ6FFH0n2YBAvoXAiOlTZFydnBTPy rhihDLxFkQxKk4jhn0c45i4W1Vsb9MVwwiWmDqVtCB9NawxeCdiy+JGyUWLX nIl0OR3FZMIcSrBIV+juxWLNckI9znbrmiZ0m/p7oYDg6dwyYfDwx1bUngcd nk3RnLYgQ7WWsoCQiuKBwYlEixp9ixxELSmHMJRF6q3cX0DrOO+1RaV04rTH Abe06LPXrdaNv4mlqn409J2EfnJr9/CLWvZtjosy6hfFgsVzc8r0CJmNoYRy jtdkEh2nXQJRHUUXSjTR+zqiirAdzHKLOVNhyg6h4plh31vrWJ8RqQ/4guS2 y1MGv78yhUF3aH32jbauxmRGi//FYMti6VEV99u2DttjIqBhAerG9MSHE6Dy 4KIXXGknabA1I0U22c8YmH3NVjlfUDRmbirmCK8Gd4qWnIWcb9gu1/eI+TmE k7vCCt25lylORgBMtxhEnAd7qqW2LBYcCxZG94fX8lPQ8xiPKEsLAXX4P10Z 4qBIZClM22qwzypWtLfhyHBATncP6ix57BycZqYmpo1CRbbqHXrgbJhTVxWb tpcbEYaio5yHF5daRjLxUhJ0evGcaSajH7lisMDWZBcUpYBI77sERJ6ONKVB vpv2Tg1wW1XsQHHFDV+cFg3aPagQB2EPfZ3VQtwUMFBzDWQ8ViASfA113umF qIK/WgkafbzYeQumBq3DgCmCQA6F1uIZh8iOPcRENZEbmy3bOOHVPX3FwlLf rA9eBfh0vfU6CxqzQ7kYi+Lj0BNfVmcG54GgnaWXhH5y5ESmKpGitdpy0qsz O9At7utxjr6Xs7cJz8FGZrulp0TFvcaEWtOsGYcvFS0pfqCMJqzmY4xW66Ed ewEbq0lFBMw2OPdn50XvfXCKKhzlfM+haHC3or7dVNaP40Ri6/4/vr1X6676 pjAvEDQU4IWCxaRiChH/tEgPhTK/6AQ+pksTW/Ps/tiaOkIrs07lZiW8hn6V hoainy2MoPSlvIrRVVTyQQZXk+K+VvRm7orbU0s1rowSQxCCcxjcKAAorwga hCaOjAOtEDxikdvi95UPF3FTuya14LJFxFeLV8RGwGNkxXlxIAc3EUtMnMwL KU52vA78Es0hr4M+N/2OjmZcpVXlHrJwQn8Ca4VEzwl6zI6qmYVF7ik+oNSX MkU9yiJ12Ikx1BXNkrK4UpX1l5wjuwBBtG1GjuBO7cZ8V4fGKxgjLh9F8TRA ha6tkDDrU/IUVWC706fotOzEIRaVx8dMTYFya+hUcZ6+WLsseCNRL66n11xP 1KBjyU3AwmLpUNRoc8Xb2ssAcGySBepc1Ior/TKhGWghIUU+0Pyys+BzzYmM lp896uWCpolSvwZUtLNkjRAGBkrvZMWt2CAaXdCEC3oaXbKhBnSfQ8KMj428 xwU+9AXuZ/6Os4UaFH1E31qnmjaHKQhYRkxsqCklC1uKpoxVHQqO4xBAWpYz 88mBvm9CtULGgmsV/xalQBrbNyIB2H7g8ZGtVsa5HW4uVPVtGSyFBpDGbMPl 4AcACh2PxLHbFDRRqCqK6NRlBQxYmlD5cX6ArJlwH5ZZCcM13c1WYoxC6Kio 02xxHbTFyu0Kb9qjqaULuN6ZqYAtTe8GmGEvb03RD2coGxY6c1YwU1iI2rnC PgyE9RCLxFPXJ7rmhXwWLZlKAGI6Au7dsWEiWEfZtxNIFaNDb1SY/KC26+6W bii7Ezb3CspZ+N1bJbHJITKcXwm/tqV3lSkDFVu2gp32GHFPWUVXFnBKI4qC 4RKo2WKkA4HoXZSc9O5QB1Jw3FGQ4ewx9bPfjdY3Q4AbItpoHW0dF6jGDr46 pIY0wL6mDbIRy2k+Isp1tJwKAhYc2bNTEvER6oodbFdurjRXK7kOVMUs6rWp YNGbD4lXowf8pnL5qzX+4GL6V/u0R/Ttf35n43LtEP3mN//nf7+6bPnbT9w/ cP3+24uW3/LZV+4ODYsSmAgNtsaLeiwB5LVtp/5Q+dYGJeBQOJ6CW1dq0Y5q UTdR5xWDuBfPiKw1zbolfLk0aKgzGQEZASeYVJqcPZd4nf1fgvwoIJszfyez sEC6S3hfPaQVyTjXBUhGLlvkjK2riaiZGCwtxSOLTOar5omN6aOgaTSxSwGd uyujRV3bUTMini+KK0a7RdzcriI9bgwBD7a6e82ovILHBPTva6zuWbZhad/r 5XCexr0XIBwQAKtxCaFhGTcLT7xoE3OJulnBK04ebDtWbhRxqxhUf7dLPLTO aA53DcEFzvD1g9IXzE0xBguNSTA1QWPMPr0W9bF6hNN7sAjU3q2RArAIJWNR Dpf8XFOsSRBUCK70gD+uomChLNTnTmVdn4f2FN0EokYr+dt+bU2rl0XAMXH5 VFjRNWaqcLIxCN5x+pD0MsURoiJXSKd3LS2YaPGNNxjkep/xjlx408xO1QBH vNUrEAibrZVdVxzaNNAJSrJvXPexMWU3AnmiJv3ewSIQXypbpLrpjgypwD7G w2KJ/apzxdhHE3vXkNCBLnqsQ9pPlLt45H/vwdwRO4R4E1q0nGBbHDmpBASy BQ7vr4iXEzrHjTqbfcL+zp6nvvk2fXWjKDmyvRPp8rOwvzlGjoikzRG9bjlT OhMFMnkSJeHDhcytQOutuWu6mMxmt2eHIpUQOTvSfJy4b1YhZLoR2XQavfem 6FuiQv9R8QsHFC928+7vrI+wR7Kj9WjmL+9y7tj5mC6AS9340qp3uN0SgWZQ 1D4aCBOEYnXv74WXWki7ZrEAGyee8VjViGiLLCv7adGaq7m7DRM3B4OalSUf 1dObszWnN1Ju05cTuLHErZHd9BYUgGiKu8BBRMudvd2kv2nIURurAHqI8IkO 5C340n9oCWRvIwqQsJ/ttyC8QapAgUykIpmGIKRoSRz0/bDVXAKx5ahrNzix muXvhTnKhkkziv1eUcyBOm2nBFjzjaZsc3VYsGOeMJYWAELU4thIRJeuzOLu xYhL4Z1d2kuGIyIgpwQZh2X/P0Z8nhxSILPhgWSUVpSK473SwuunCrGiPXev cuTGDWdz9COh7qR1gcSuvoh42EahWLKKMUW9Dgyo6zyEFAUDM4pU5W72nBPe Tko/CjmZPTjEZ9DOsN40wSbHgU+mpC85TQ08NMuxO6+fa1n2Q8o9IRnc8qbv ANUIKPicV9dcxdLTo59BsbyhBaUKg6JpdYd6wlApOT/uBXqQ5TTF/FrUglTE 1HuiWSAjGkV7beIooGKirFVe28w0rR77ep1cvvd9LlOZGxHgwNhK61eYblY7 SL7CaI3/h3VUmhgUDETrsEw/VkihkmXH/PFt1yynhNMHp57eK4G1pqW70VMS zy92opofUQKmWji6RttkP0RTFCAt+qd3qiCYaSxK5xrTWFJWNKOZMFHOy3pT 8K9bQF9BcNWkP+IUdeT3hWfWVIy/LyuUWzX7sRkZphVc3jgeR0kCQ2RPs6NB TkyAtnkzFcxeEkruCE8Is96WlQBaFrwHvdqy2R9KqFKgNkL1O9ucohGOU4HV hgCvyNYh8tbxJrqkhO7lY6OKg/gxrj51M6jVu2qTtRQ2+qP1soWihBA7tDG1 rA4JZP19v7Z67zVgHNVp8lG8HzAnp9qVbZ8yE2eFCqniM1u0TEkSayavy5vT 1KJvsQ4N+F2Ay7Aj4qhnErAl41gXjdhKdnuwaRcQlAiK7FRG2ajbTYe8svBL KHjk3RUkTef79ajKDVZJRYHWC+1hmsGWTTa7mUhHg+KBd4AGEb/7HKDIcgkL 5oeR0+MCH/wC9xip6Ur7TRNY71XkJGNnhOgjh5AzCospb3rqq5FgD+Lws5yq PWWIktR635cuISAzp+SPT4fbMTVR/EDDjZY1mxFmhIxW6vKXByaV2kd9qL5c 39naHUazDKnhyMt5Glq9WFsSpbJTpCcv2qqtyy3hFSuYCcQcR6sV4lNajOJK txiZ8HabLnqz8bQ0qBwV5F9Hps9cGF0fIdDjLm9tXBul9qOmoM8isuzv0APy Z4T5UZHuSrBKORVhn1RoTc2R+piAAoedXckefZF+SCNmTFXF2Iq9xUiNpLfZ 1OJFaOga0FUEBBjewAH75Wgpdo3o8GXqUoXL7uOaTbNOEGgdMTIU4bFczLZ6 iEKzBi2wYhBKn9R/+RX3ECDNCHyM2ba+8xBecsjd6GncLUYKU1ZaZwVdFRz7 EB4ydnvBcbSVi6IuTVp7Cq+HHbrirEjPmXsU9lHNuxnkvnlb5VWFN2/YGnlr 2c1bPvvKbRVNjiqIn+iwXo0T6OG7N4KgG10u3MyQcUpJPH1SXxadOxAXIqcD mnHnpelJtLNhZykuJqKk9VH8Kt4roQlpd+VCsT166GgTp97cHxr4l9sBJhD3 5kcxjD2wlb6cFbS4SsHJEqWmydleGiKuTlhpCxkizxXsATqSEFDW7R/Wqu9z BH79k4zA6zcV9CSiV0hCbJojstCW0LxoumtI2Gx0r1AlDM3iQ5OpMzlOajN2 oexC33vxjWPviiNnS1fBcsYkAevLPLLlPhtVBQb/LPESPahWTD29Zjd4UZDy jhiN35SBB3rO6cjGH7gF9KxdFoAaNBY10RfEtVBRE2Q8rVvQjqc/66708z5H 4Nc/yQj8MEoNZ2Ir0hUBOrEmmsM5DHPsLlTR016rPmNFtAHI9al04p5CsfND 9PyQJcxVeNTOy4wYuXg9aVUYxmqrcmDpjTJH02NqWQkTO05X7xhVb4Atx5Xv vrhLCy26qKViEnpOdGDpkvD1gIvPLgbBFI0eltMRzWZ30P8gVK+oroV137B/ jyPw659kBD46QtmzD+xpVtEHU0VuaOZO2GugBVk1fIp3jc6spAkeONgNRy2y cmGrKDbf5ce0jjmvZSGURNXs0pouAf0+4tV14OJiDpdtZVwBWYajJ367KULC qdO9CqZmxWXsRRqeFBy+s6ekaHGV0nhKEDjabnSqKFSMONiQ+O6qFSnk4Z0f 99qt9zgCv/5JRuBBpx4X+MAXuFcIIX7dIQvszrN3Z9zsq0yzMP8s49IAp8Mk mi1esH2y/uhlzOzuKWwfis+IGO5t3CZsawkKqpd5degjH99EvuKlO8mZlQD7 oFPgEBsV5dJqEKG5i2Oh3r3Y8UtoD2hJ4uWyu8eFU6SN6kq6YLyCg2hcatQW HurtS9dEtuSedt7nCPz6JxmBb05s/9v/+o11n4rXPvunF4e210/0g3/64ae2 333kzzi2fduHX0kwTHRVYVuJ3JncMQtTlo/sFrJvplguEBXp7MSmSiiQtqFy HlsLQeNSGZbeBmoJw9TZFcSHkIfePI5qi5Oqe5JCr9iXIAix16TdO4p0987R hP7Ht7itaH7SlWmD4jinjLOwS0HbtjBEgdcSq7O+K57XoFe3vbLGtY/YaNa5 EZTebOizIlqhpGIoR9XUyZfpTuoFemG3oJMyTaDMQbDCHMXZddu8cxy6Q1pS C92fnODNJCTVNIHQtYsp3HcEjEiJOH2uwjpWN4SsLkYNJSDvvmzV/HZDozsK 1dkjGY5a7vECZdoiXmUjxn7z0rXKvSFUhZ1QRe6HGrZ61zCwzevqWeuxintR 7G9S6iRv+kQFtXYLyojibKLql+tZPFUjTBRry1F/2T0qtxuFpES/VUDYCPjt Mz1Kd42nxVatnjUs0Tbko2ezZl9Fe4hNjJo6W8D58sccernK6geLqC7nGKjT TshnZZSFg5J2XeJglMS13YwiSb7vOCRjjJDAFifDpUi3iWoVwghbv21EPWg7 0MBOfBj2cKYc9T8bY6xGrSXOU0Ip2AGuLX4CkBHopXkpu/0kH/XNs87Su5s2 LHxCUEj2T46pni6MasWmbOy462K1i4bM6Ic7osH5EUWmS45abEu3TB92SUlr biYhIl0xC6K8nmIaz67KiGujGmwUlbrTSCm81oT2vr6Apg699hLmaEZoKR9y J8jJNVr8KdpIGvjotVZpxZlea6tiy+jY5zowZtcdx+03cmJjIwOx8TfKQlbd 2KEliND60ufFyrQkigbiHjTadprMSFBpWmG8q4e3EX7Ri4YA7RUtpVLivb1G M99Z5RW9l6ZFgDNoMx5BB0x6LzeP6oQQc4x5NavoEfuhaKalp/lZu3h+1duO OEnFrDyF44TV66u7T+9qvJ+La2YJK2oWdasXMi/4y+lPtVtrYOFzuvcsk+4H M/Sy7KoHRhUZG1nzkeYWfbEiLQ03DDBGbq4zcPo7van78hXTJqKMVRayPxYZ AkUn57eCZmVCioYj4+YU8hD+iOM4F0WPPO6JyHBBAGkht4lgmAg9MitmGqSD ZzHH8i1FiS4UHOeJVQr9y5sVNoo/3EfS12ejOZlc2BOWebTaKabY6beIGwok QbGVUm6c5ZdWQIOfdy2Gvu8dgqgF7spBV8GCggoEVoOQAO1mCmt0iYmrYoxR 2KysCPffCSsPSDxcV6dir5hPaDGNgiY+8jcW44W27oohChl6qKFF4twYmwJl Ry8pAhaKTIjcKCno5XXFTYwmizNHBVrEQtxika3lUaqI7NIvl6V4bjQwbJk4 J+ywXi47ed0mg7XLKAPWuZqrLaE2rJm6akDNX2HCoFyVHadrSnbVIvx/kOEy KLoRjslNqU+hE9v0gG1jwJ92ayJrPilDl4MvNkpuHLs+yF/rITDoaw5Vt6XZ Yygz10tXpG5hYnaQDjirRG0zS4mC9Xk1/yiV7Kv2Tbe8+ugIl4vg3deyYqot Ka5eUOgSGJhjaxLPbhu1ImKYCv+UJ+IVrfVWTTuMaGZ0tFvvSwyP6sVcr+og TRWrSWeYeQnzoXBfyygmLewkLIk6bOVyo2TAuCSsAlHpGrWH4i+b2CsDHPpz mv9IV83V8UNS+PFDQ6Jn0ZVL97oN6uypnLjVwJRyCUWVrBek4IZ8qTAPDdUW BUXBUIUHP7N4J+UEvmFmen9WZrSWod43bbybpLYaBd9Z8VZfr0lhcdo85BY7 toGZBmcU8pthOq10vQhNTKtX0vug81F5ihL6pXBej/mtlymWT/GXEL2bZaNv ZoZRcBekSxrx5igWu6/lSHstLQJOEC2GKnofvW0KK5ZDWoU7ZIu215Ojo6Z5 fKqpKZAubAk154cG2ViLKJBAjl6GXl0L+JRMi3jPzYaI5hCFOg1z0KttI+4i xOAQvRWkrOmqg1f4d1i/NN6hYvJx2Ivyt0JPbC2j+aM5gX+nUrsysKVmLw8N U90f3zaTEnXCXvySDokDK10lXyUQoceirEfqEhDeolMYPGM/evYfbacEGfF6 jljVi41dcUEhs/aBf3IvlBmEcg8rVhO1WWx/dengleQH4vUCN/rCrTRMW9jl zZWMA+4XvbujlySnTAOJRQi4BREGK7xpmBapLU0At+O6vMWOIwgKgYV+DCVi eumEE9OTgxQgq+yN5gU6XCKb+MB3vdejbjriearsqwEy15GARwZOsLAERWUw v9Nl11Vd/W1Y6ZR4a6qIC1Dt2C1IPgv0rowpyNZlGs4ueEsLsVgw8EEnNTqr UqWUsvGGvVsteY7gECLcuhXlVQ1jujsrG6VjgcVAfzw6tUiwZNw+y44A2Ykc P5afs6IirRQQy2lwgiqNcvhSdrObqoUY9IAeqZ169UlSkdiyPSCC0AyiaIsA bLD+1Hu3+gKRoYVDnaLyHmhPCJYaRKCiOYR3DVjKgLKpIUJyqGCACUxXUNDc EBgUWigp3j2SUxC37+REwXoBCRHIZXymzruKLSnPZSK+schYja7hEEI82IxD wLNhVUxfuEciQ8yelnBn9WNBId01Bbk3iIBe6QYdiAUpq0cFXlES0Qf6bDiC FLCe/J2IcsBJIcd56AiJCQ+chybCEmLSikCQ7aUv0myq3kcvQtR7eGw0Pi7w oS9wp5FagK3Tdp/nml3oSau5JyvCo2Q9IeUNiwrBaaT9zVKIbYeQPEWAlvNX VtXE5JCySodweKEAuyN6L4x39PpGouqKjaMDxaclLMJ+hZISBb4UlUZOEFMM rWNROHM+6p4mullovYlTDIXmVaZA50DoFGEZdN8U3AiJ9xzRitZxFlLApNvS DL/Y8YmI0Sp4ixYtfRC/H4PFfRS4OnZG6og97KpQkEQDFS5txw9+WrwEsCDQ DZhybVjdckSkuttc2xCK1zS8Joe49l5mBzHwpf+fulAbVgQihRzdHVlYmcmI 7+EKqjsqGJatTMm2FXIuttqFh3Dp+cgRu2ZlyY69lJhQvtIg3pfT5I6uZhJH mbQsKKxTB7y3P2rn2S6bKP6kLNSXPA7EeQaRkIprIWRywdzL3TfTARPnFDsR bI24LzQRCMs2C7oeolNo9jSLyC/qw4J743xWxLMdH/MFXTSkDzgfmhlT1lTE yET7W7+XvJqK2OjgjJJQXSM7bAkZw97Ezzon/IhmrOTjJZ+AVd6pL46VHySO koPqBIrpJMhmd/1Z4FUsf4gbuXbkCDzIDRK7lC5o8WSf+4LJJCYwsm+7X862 Q+tJnLDXYzbFqWd/oqEa6RUFlYxmU1QqUUbyNQuVoknZbzaXb9lZflXhyps2 h99aufK2D79yZ1mIrncR6OHFWCLaFehD6DEnahO4yxkmxEDbKCxEesQ8jx1I xRMxJ3ZIkW811KSzvTZHC4uyzYEsKMjwHlOYmv0qQmNzf2h+VoUv1PiHCfoK kSKr90KQQkGBZrdDnBZRP3NpLw+aMvrCREppfuRIAwT4EsFlUZh7S0aktkVh SNFOvL5OpgPRhWpvUUNKXUS4HLvry19l/goy91mwfE0KLBGxw9rR511Xe5yw VUU5mk5s0Rrj74cj1teC4QdenUbLyQgkiXyKxBSc+gbyMIWeZoGjHSC8M59b U8lU8XmLfqwimqAt1lJoaFuxISGmBDSEun93eGKrtwItWhTKBpn9yTijfvPy GKzodazLp0A890LbqJQdiiKD7mLUaIToxMR9t6JWcY+NX2g3w1dNFUXY/AYp elZvYougXzUFMYpqcGpQQurolFJqoDiVSnDdGUyKUzzdDSwWKRp23Qf7CzFi 36LFWNZQxGyDDkoq8u+lN0pHoF9a+5oIuxkLlUuSj8faVGS66x0rYjT2K4h+ xR6mcbhM67WarclI0dLwAoLbeyu8rxVPiRxefPMwi8S3wy4UUA2d5lGhV2HU KmbiT6+3O5Ffr6gsD6vBVg7vx0KidVP8Q5EL5Yy9+1yUWCo7K7tpztVGnTJy 1PfJpWH0zuJBgFp9pgfWaAkgVc1xXsheHOPylKj40u0Y92F+HPR4TRNvJq1E Hm1rqFEQcZihpbR2hHC7GI6ze7r9w6XSjKqEYrZSrVJcoVRT0xquKSAgQhdm Ckw/dyjYJZFK/HTQBxYUcMkvNGmVwZPGe2Ovpzhvw3p5U/21u3JVnEY8cSVM HQ1dM6iCiTY5gYxFz9fsUYFkxqXb3Zh4HPqviCd5rH1X8YQVx3EEe4lDMVRX 90rC4gY9tWOmbeUsvXe9mEDLZMOOUPFEIzGLgmUW/iq0Imek0/VyZjr9TQKC V8lSqTEVCejn1ahVgRYRr3hlHXqC2j2MKUAq2NjrJEsYJiGhPLUW9Z4KHiHx quAKq1yFlJr9dqXjNEG5DzOZ6TPfqokVsxM6qLyFUS9xPzqglUrPM95oHIp7 XXMlDAFM9LnRIsaAfOnRUHAQqKx90aGmoHF0c4lTtzowytC3i6rrQWm5nq5D tPS6OEvpl7LgLYwhmVLxGFqVLVCvxat709vJequT4mTNd6aOQiB70I61eZ9p SvD6kkUPWnYaEAFKp6l1ubTr7YbEufG0H6OpogIYGxbjckAUUAwhYRMfHLoS 4tb5ctTA3XRUQaQWqzLskbs3y9ZsQT+lahws2fzDm4qaSfEKjlHpG78XJuAI KtrBTk/w+quhdzHo1HWU9E32FARVA37Ta5eB06w9lW1o+cAZZlHrva7WVS36 qG93tLoMBU8Ej8exFS1UN4RKy2hKAkrsfdSEYCeGkJrDDltBIf2iwCrEK8bR yoFWNQbKdFrKBuMr75amDOpAncaYmjPYpl/ieUfuVoKvjhZkapjG9E/GxKEj ASR4tOtWLsSd0VDDmIR/3Uv2odAf3K8FouOaltPYwUmpVgJalJx2+35I9VgN uhO2UIDUZwJ2uEI3YmcKiNZ0nNa12EXzllNa0jhENBqPOnKtKCtMz8nswu6+ CJwPzJZgjo76/BCqOMFjR+NxgQ99gXsEWwhyokWFjLwVZL0s0bvxHLsabNCK s4FOE/q4TLC5HXIMVqvReqpfcjQGc5KEFLZHgvQqCBgz0Ixuj7oWJXlORlB5 mMJWnp1rZeYcOfNt+KKYTUdxmuig1iKM6c8KE8Wi5SrGvSGNyEEf4VUMHCWC bUUrk1jM7MfB+CwOAdOJbGmr6drbEOJSGPS7if+AVDhkEs4UZvBUKxywdG8l ZqVtdMHr7F7AY4jtiKYJz3ea3t1SsC5n2hZFDQbeIZpl8aSACgjyiVJwIqbE ocgWvBm4IudE4f89lkQ0jpTkra5vd0SlLQutiDBUURWGt8+sqHymbeVtAbFY MZhOwVs8XKLSlWLdKmk1dmy8Rb0Is+gtKl3DfddbWLvFVDBCysKee9NeLZjv 9Ph8TNcW/kk+m1eVdrmXCLh799Iu92NKu17z4VeXdgktLqUz+LIRm1RyQ49m 0a3cKc1I+CoK19nmlUjEWb2Ph/NMEuSfGCwHIv3gsEhgf0xxLTHNJgB/OWC/ cB/6z89+9ew/PTNXZzlHwELIkJzd8DSLFG3gXiSET1EKxV8uRJH3tfaxlehF b5rFoAF56amc3vO14XUZCCAeijMB+p7HVqKoprP4LzXchbXeBMiM0K8f4mua fjAjJ7oRBEuYU3Ee0EEpdi0t02GEs1G2FVL38UqNolVmUL8s+jxfuKQ/Paty HWbhHiDPAYUXuR9MY1MahW8joYTTlxFdrYpFCJXV+3KfWuZWa7FSLl1gftMi 1VFm33onl4hQR9Do3rimJ8fqZSyrC1atvioK0NnCE/e1WWOM/qlDX3SyCZCj qPphvjLqdgqIdRb8WuslQJQQfOBApBcjzDy1ol+s1m/eK57HS+jP2qCXpwjX OCyrqwlziPiKWvXmUXjFv6wicJAOmUzBBoQBcGfpsB6tsmu99ypKp2GPnPV2 fxmqfbttKhxUcy2r4KiDr6JiN6oWiwM3RRBNFVHRS0sTbzm8tg+9VxFHRQhL 7WnPT/c+gJIioRnijxOlX1RZ3N9rQACDbm2kIwx1Z5mCDMWYinEp1g/EeYpQ G8p0Yjn5/q1u05KL+aMyjLXxMtdJG9sNhcfYtNoWucHftcTNtd2u6CdshdKL UtPMrYv8mZUuU3HRGI64af9N9BaLpx0mPZrVLesDmm2YLOJpzxbHbpd275WG JrYM4/6sWhlF2LMbVOqx3yzok7a6qB0Svm4i8jT/aJZMIWLBx1iOozU22qhX 6htFI7Sv4kxsHwk2iw7vRSm+8sk8qhOa5YxWqbRrUekFdKQMUc5LCLvgEqOn F341FPYSe+yhjOIpJo4YBOs2c6J9SUuOzQZdxlkfc6p0a78QPnkxh/V4yHfG gNwXvuM1CyQEHEooUVVMrMqUdT95C+NqdvoyCcb77CeS0OBkTaeJRt/C/duj FC5mgt6zaUd9kxcwFsSn9rQ05O5DFtjWux0plqkphVgqqp7sdnhcLo/WKs7j dy9E6To0NRwt9klhTnPLUeeXehCmKX3d3ytSDfp7ryyrkJwrtWcoFWya4H1Q hEO6T2tBjM5SZ6R4crSq629FARQLIC/65eH1IqJ9KldR+l2aMbT939s00fVi J6Wji9oYHWCEAieKUDZhN7/QcVQgD+kqQKu6+h3hKey2J8NWr9ClJUj5TLts l1sG3TQlnjHHmXPS1vVFwHTHVDBoMPU2kWkOvjlqTjl2QbyXJiOtylSPslMF lS6aW4QCMRhFF7LpMyVjuGvYfG9wXGWCN2xJihxPBSbjvdKObslheTSa0BQu VFgjF4Oadm8BaghCdac+BFt06F8PanLHGBk1Zxc3euJtsz8qZKlAcrxmTSy0 UqdYb2W7x3lBPa/MVXexTS/bb9E+DtppktNymeusPcBQcW78XzVWXlDXseTW 5XG/s2+osuU9j+qOzIYJXqk2XktIlw0KwBHHga1Z3MdlU8rxh4ii60vI7BD6 FMDT5AlBfN9WBWYX4+UPHTXRM4d3FCtrpI4UZMTqhTCvLnN9/7SGnRpK/wso VGjFWFya8tWjpjdR0mHyVVlcwtZapAMvafSYM4fwYggmTXx+9fh4cR97+8jo tqaFgzBU61HAXfmXk4OmeR2Q9Uqb1nTx7nhpWB8bocjACxnvFim30DuPWD8N Sg7yiEoVFHaKZmR7f1YqPhUHd9AybHRH4aPH6lBOXxriqjUUNdvqwpxLg5FE Le7QouAzlJ1SlYJ4b24PPKAxIhK2EpFpZhTQ/rxrmAllKaZFjMK70IQmwBRQ NoLhHKaw86q4noWfMidZSxgvH2JFOF46So203qiOw8sImTLjlDRCM7pWxMR9 3dOtIhfCTwq1CmYKkQhYKY+MS3tMkWQRcysqwGgjhQZkP/z2dM3VIqKukZr8 1TX5iBv6puIwS8STttJQcJTYdse+0FWZphTmnFIGm5uA3R300hC07jSqOFeS 03/lw8bBKBChuRUzUuF+P8FKp7yMVi+mszQXwyaOUIVLtO5HsJlPchpkqCQR SaIgK1AELnQtyhfM5UhszxNZFIKUKbSIr011HxQnNQdQZo1JK1CYJCIWk/Pp vdyIEDFRh4J6fNHzbid+i1n8pKBuIAIkVJQ5/+B89ygTR+IFZxvRsyUQpAcT 810U7zVddlPGvsVB6x1a0OrL+Rw1MlbhvujL60IZ4ZKz4nh/grQEnhXkNLd1 2UODRZNvLJ98ufQx9UZtiUuTq+mLNRE1sYugPdWJ93QrAF0GKwyVTxMjDo7I 5iuBYeBshtccvWoGikF7Z9nQj7M45Zc1LW2wWeB2Kg9ZCktxUxeW1lCgNiBu nu9xOF7ykeO6sGhNoDFF2UeJ4PKCFbkUwaDsfYhqp5CDLnREf8VKj4I21XHC PVomXcw76b8SrRIGNUpdPN4Fmcz1cIrGAgPKCxY9f6X4HNkyJUh18eRgJvqh gvOIfvZ2B+UOFb4F5tH7qRSTNsJaT+w/4CJGjWp25UWN5otnreIYwoI7YAgy Lz0OjZheKXuCVav2ct/V/NaiTRqX4exhsYeenlNEq1lscbHZsZUMtf4Fw+hS YLFnLYr6g0unHcXjaHc4tO+0OBQzl8acvggFSowibERbTQQR78DyUpH+MLSW XNbBi53egp/5MGXsQZ24ILWJmeNRc4yDEYlEaJ7Z35HA1xCKsNVw+Qp1jT+K FBaX1HYdbaVxSHdh67BFeZJuHtfuRqkBqtldGRx4izyl324cVFfcq9Gwxg1S 2AHWvfxSfS9LX9QUHznvnrSviQC2fUg+63UpqAEKrjacNmiiRsy7JwIPHpyW bd1x5F7BNDHJTI0bx5SBTi+KPOfKGDmI/xoRMj067g5Jubjr2e77aQiToNNp HWrdTYxxK7UK1pRk6IzRDQ3cy9dBdYWdq6fK2EIQNJwBLT39dsN1Hj1doFzJ oSbqOdBsPPqJRBVtmix14RTBbr2WZtGoEu5B8h54lxVVjtybqCsc3dmFNR7n YJqM5K2lHMyxLWe1G6Fu4b2BSUM7KZEgp2liBRGxJ089uQC4QiHrstAUoGsm 5HPvuRenYse+CEblytV9aaQpqKeKOdqO0U2kh4ki9eQj2e5QOOnYgdMVo5wS tBRTRr9RKViJTmD4au0Zo9V84AwML4Sq6MGbemcU2wiLJGpOmgCoVi7tckXz DUMTkZl9qAV0xTb2HwetIEHEv1OBkyszRdRdKUGjbrFFv1PdHcSmV7NYQysV Wq+3lw1WDk7YFzFNfL8rDUUOm2hkU+9z2FKJiVyoxkmPFC4XsOADUmfDla73 QizSez/eq4YxJE3sXQQjaUXRWKNPEvXNzaKEXoXzEXMLQWEEjYjD1rEhciAq 5Kw1erdUbAgwikEpITS63pOQlhfPuVdDJa3syds2Jgndd2qEbJhBWEx4kgLl FIZGSxgRXKo1MY72Fn2VKLUwEX6VBqurlNFdo6VAS8hdYAm7hjvVtT7QNAmo wle9W7rXnJBccPrydVFurIfDTJcadRVDOjy3r52OLF6/Jil8YBbfNx55YqGV EobEQRoaj7caLCOqh7kuGhCjVjoZNKE1iYIeEWmAIMQB9jEZE3IlN3f0xAnW snOEWAXNNAVVxKqAgV8X59x6pVPTW3d7f1ZMkvAMd1cSUBhjxndkD3WjxEgR TQXqyCE5OhLKC4djukU3VQhB8FYMSFwiN60vtmgy5cKU9k7FFyWSo/9PaUsz +LLro2Jc7LEu06hJ1Hj5odiWlDMKm39VoFDLYx1sJOhOnQC9oVNyiX65Wgug Ua+2seFihMSVQY/tGvzUUHoK+MBZ42eJ3gVaMzSPEbKplO20FS+fdsUOagPv 54bsxaMkOHD/qykLVNOc2bC9V7op+jO9UtN9fMfWtjKhFTI0fkK0SeEko1UZ hX+XCCbeL4Jfm2647gVxNPCH+d1ISL9qzmvoxZuVLTjsXDjHilaiMT7Rj8jz 2H0QAmiKroqd0SFHo/GtCiSVEhq90pGF/mjDHMiCC3rTrHyfCApcXowuL71E CsTo1HFsLmq1LzETc+0kUIpwp+BB9F6T2dlktaiLmKHAnu5dGEKcyaIy37Qe ldGxBlc0UJo+YAC9ClpoGjAt6lxJxz5ZYwVbqhKF0LniBZZIx7P2MTSzjZaY 4g9lRNGwmrGP8sIZSQ9d6SAYTisDbZlTKV95UAtF/EokMHsFaVeISkjZp0Cs wph3iam5OwxwFLENSskULNndEOqY5eoHEeou17Z+EcbtQi+dAy+thMMpJUIm hcQEbUTQFFe6EiPn9mKlpQjM45KpwTt2C0mjmXqBJcbQ6IurirgJq6SOG0oj shS6Mi1awxR71ftS62wWUC69LysPdJo1vhoZxloo9LIy1h/y3d5Zs0nhKiqd 2l2bPiNMpHlQRNbEU1qjEcwOfDERG+4aYz3/IUsnsDKzETe99s4UX4ROO2a9 bFon9id90pp/Ydr4IqwYEXzhTOFCjOs0it6itG5wrpzmgqi6LZHywql/50/r VClWJul07MyVUl8Io2pu2DWWo1ecSkwNoVn7DgPqwnH0MnEhty144vJChKJ0 C8pIHbkCU8BrqYv4olx8T8graF3RsrUBpTj8WQU/rTGzBY5cWqxCkZgD8gzm auVw005FW9004n4TgSMtY4G0BEUX95qiekFXbkJlx/nJEsAvYqUoIcNn2YcZ nL5yhDb1ssRPglnj6K2lYOaqw8szKmFMi5anmyFcvpU9c5ZJv5ER+/JsI4jH 3eewx/GP6Z1pBO2XXnSJotwdo6VMhof3xuO9KiUpEylDijcvwTsqBIumEEG+ lJhI7iwLFmuD9Qu+33e8p8PEjlQz9QIo1qTiBElyxQwfM26Fw4ju3hvy9awA /CFyjaFi3rR3CT0KjepOxJPGSj0JG4xKu21EBCrcYbtWVw0UNupplJDQaZhG hFxELAibJzZQFSC14g46Vjq11sJJlMwpULWkRL8VxEXwNQmB/ikGZfSh+S7A JdB1yKh65M4ws6ZaICGPvyikFbbiHSOxXzGPL4d4K7oDorzUeeN8RkF8KJxs d9rQNTBKILaX6WIvmGIN+rAPoEXvYtHIiFXsimPj1jfTRU/RuQhS7vQ+xCMO T8PJgUkUhmaIQRUaVEwd9UmyoFSnNynCWRHVSFERpJwuZ7RVTs4vSzauC/Gs BWRsk6zFBn8JHgHfRyHP4wIf+gJHFUPDM1O50CqLRI6QAVljcUZhaIQe2BYo z3RaP5XYO/or9wim0JOH2/RlLhxZU/JLKUUgWnBx4zm7k1L/cQJs92iIFjkM 1Oh0xnt5XWaZ1mWF3ZKVt5PfwgctuL5CGkd5HiRcdDzTfySgI/KxyGxWMYX+ 8Vx6QBok1UNXQzhMkYDaRq3rgPXh6O6SBFE+qJcMHuU4YsdI2Ch2x8MdTKne cNZI/Sky5NhxDEuvrYavkUvDEtKLeR04h+M42liIdL0ZTubFWHHxNcrbVCQi +lAcG8+Ch1Gv5NgIF+lXFFMsEXkJS4PShtdr8pMK3lpwhVjYlt4xnRWdjFa/ 4oUX9kCKrQhsFdCyJTd2q7yMj5NBsEOoW/dzmp376mIWK0P8W/RKtE3cvCnK CnRPTN3F8cG/R8VG63rXcEODI4cXlV6VPezc+2XLgydkEoXtIGuNZA3m/q16 55ygORReXFLoROBYSF1YTqxCuaJpZsyx/d2PwKykOUIlwcZUuserYurazEUv pF19cgN7a81i0TWRkvMEOBhRWzHJjv+swrXLyvturHlZwDgxVfxqxUPP3C+C IwYu0BBz4zTbCe27q19b83/gCQdKyZhnYw6vvzu6FUqlwUBEMjfDoYvXYuic 2LuI9a/ohCbbZPfnfqySNX2oLw2acTabrUlHgtKvx8uzd1yV0R2/n4l646YZ 5k6LcQjUkqyaq55qUtFZOuY06jEEA81yHeuU4whJr7KjyaL7EmqlJ85r2VI6 ofnYKt7rQ2uJnQyRCK0+Qdyj8E63tUXERIFdugADNp0CPkLE+jpTlfvF4Z2/ yx0pGujCgUaTqZeWdqsBzJLjYH/WKKXibMHKC/Rk0KZ8bChxSqpV1dH6F8lg 46mgX4pz9UTI2LJ9iR3uMYeFOivPG5YICJ67JutLOO3tK2OuKHhvFSta2VrT 7LQfvpGhivpncSqTcXXBTxUTsidRqyr2RadmRz/lEFlaLBIOroVpOKXwARPa yaON6zO9o5loShQgYgMoH1vscVHtWDOH0EMhhC0oTGGdAGmidppAnenmObax rPGKoA1jt8WuJpOYncydJ6WOIqquXEYbAvsaw0At0vFepyL7sMw/3gJiZnnT 8+5RjdMaEi2O3ve7RTweI3j5YHFgNsetiqd0FC1a0diaMRtG7pSEtP7AhO2w SxvUnpV9Ue8mjNuvTXyh4oFoFupKHQHhPk9eMqjEAl9Ohd6W2KZjZ9w0vGZt X6h2aT1OQyu7jU0E5P6s1N2I1epr58amgkQ56eDVqkMppbHLKv7a2itaCV9d yfjGVsJXFCP+8FbC13z41ZWMhv61KFomZCrsr5y2NUJIZnG+h5QEyoKWyikv IjsUmQ9Z+cxWIFuQos3RovJnipJo0ucynsXpOhGgdepYZwk7oVVFnbrdCR10 rQKcP9mtTokZOxH+YcNJN2fRPrlnqJAqUS6g4iUGVkMEq/dM61YSPAiis7v7 Q5tb2VcY3OypTIMSlrEBWRs/lLe9iVos/dqXbGzYbgyg9cTHxu2lp5TEuZa5 rEgUvbVQFb82enAie3RIiuwdlYwBORvlLaSAFA40cTW9FVEW9ZA4rZVA1xC9 HF0reDZOi+/sVD/WPOWkoVclE0VqE/zglnGWnsIe+Egtfyh6Xc2DyiZ6EL1h dPwVd/UuGqZtWh4s6qlPK06IMmcqsQ+7dfZ1AzUQpDnFA4EUoQxFwek1Rrso aYRetbiPXOEKjeEeMyDPxlznBjgp0uJgS8miTs0oDqoPfNKfD0dnJZTuwG4K TUKIw2uJ1aJMgJs70X/VSit9uWvdoorjcw0NU9ZciOukk4zFYZlL8wArJKFJ b0tV7LBU8ByVjIqCBZEarBPQntzsSSHG0/zlbwtu0H+u+9a4EkNG8LBEheOq Ga75jp/rNemNFxghhdAfl/EbV1pViLpH7Spgo2WysLlNk+qOsvBQiqLGzmGa omBvkrDbvYsPtegWr5OynUibA0WlS8Z9dUpPlTgoiry4sWIcRvCHZ3ZSCutC UzBmilCsoh51ipl6Sl1TQV33HdyRK4T7DPXyNSveDztBSQJkyqY0cgne6Ad6 bFrZxNGVX8W673mxD8dxejTdJ6AVPvCK/GbQQap8WDhe6kIr7fVVYNboPcd6 aY6yP9E4AVa4pulmUovijPj+BhZhQUMTtDtcADmcScp0UWlVqGaJOWQNWdU4 ahXsjfAJ0N8er9lR91WW7m8kvRR2tzXiYhxaUIx6qEJQnV5f49AXUNY/TmfF G8QkHKJ9Wo7J5b7FV9h2oHjbz6hZ5q5uukM6jP4AzNY1yLMpcOWKYX3TACpa Ke5pwQ7xlsBxCnvFFOIdC4ljUSzTdsSb3SAJaKrVjKG7blHCTP1DPCreIlbL I1gM3NGXtR3LQI1wQPVh4DZPE5jCrXFUtCqgHcuXesRxKXeyYX0Zm3LKBVUo QdNKD5DwXfb7Tle8Jh/HZNgGUCim0VEWEKDUaHuqsed1mlwai4keZK28Q0mB DnLf9KKyvsuwPaZ1Wb3ufXdF24rjAA1qRwWNMLQGlSJrbKXo5LzMIAtmCj0t DlGd8mdSNBLERsS1H1N6ITWxWzaNOnO8pqiMnNaKgGpCC2kgMbnrdoc5q1gB 2k0aFoEfPGF1v9iy964fKPhZUVicpDTsVMrmYuI9VJmaKs3CW9OG+xr6NSEz TkojRdR4yiPtHo7tduzsL393zjEEFntRmmaj1Ws6e0P5mrgT9BtDVSojxkG5 NWu8RjkofgtGGtrxCyf401O343QfCWEiwdd7qBqobyjzadYnlBbG1YE6cdzK a6B7Lt6rNQN5KbQ9l3VowiqAEsppnrGdjh/6eRONjJUSyOabL2Ieph3FudRu i8sJh3sxAt1ThyA7ja9AhrKev2QFd9nIK2kYh+8HcYhKkNQD5+Wg6LGgezwo vqTWeCtbK3KKQPX+Qx0ONHOpn1ybQqccqyaY4FWg3Cp55UeBdWQV9XooYUcm NR/jUMX2kB/0GRTqjbjAJXM1B4Ydivb6Rk2VfhZkT71TUUpsMDXDBLU8fTzB jKComCgyo1eHrzf6QVMIbYeQ6KBPhO5wRBWgY0Jb+Kxt26hG0LLRZNZ91DvE QuErUB2MYOzYplC7VrWIkObsCBskzpYUEUTKPSUnSaz3qBaiuABjTU5r3KIg ke1wobVFPZCjH0pQZx+wI1S30bXLmKvhgqNoLQ6mkIW3SCUUcqymtdr1l9Yq oseDVCwwahZ4MCXpFV+WCaPlJn6t1aXUWLxIwYj3ChrBCKtfVohDFmDuZhke ZbM9UULUo9lK0UgNHHHVKbrRD2CXaNfghAOZMHcZxYueTyrwBD7RoKSYvPt+ VFpgNq0cvKxGOrGjPNna7hP7JzQHrT6mybJx3lY+FXNPR5Vjj6RFMR2Kmzxn Ok08OK6QcCYpk8PYSzTu7jZC18Kkolc8QdlsVyqKFHkSFtWVcy+MoUQZK4V/ eh8Vm+k7WZy56c7y7pSri2EpjSpjJoOwBh3oBcInGH/kI9F+Su4uTRK9QIUJ jWPa4rr4Kia6mJpFl1Txz+WgUDqOTTt6Kq5OOyi/IGn2u5Nwe9boFpqsRJzx ez0gFkpMmbobzm71vdVXem80LVJELY6yUsKmxpgGRAXOcLTjJCVLQ/YQdy7o KilnJo1VFsWg+1tEPvauHHOs1yGCb5mhIgKTDVmqzyDIXt+9nSi2oY947C3m zKxAB+qotOhVdEKc3U4tPc1lYWWaAzViiUYvQVroeJkfX/WBGQj3YSWkMJo4 tV3M74B+H0csaAgJzmAsq6mlcG+Fde4ToSlO0giOtg1vF09cITZhSRBpcIsG B4el0rkbVJDxUL5GaYUSYnHlqamBjFXgMLY20SJO6jlqoqutnvsy9hIIXpO6 V9pI9OVzYnQq8LiQ4xSeQUjxkNm5noNi2KVwJpwgBKPYpfk7pxbzQkKXLV0R M/0wauWL592ZW0QuYVMaZ6Jz2NBWbHb19uceSnjYUhdKms+0mdjqTbNzjK2k jIwMSu2YhnQ/nwrJ2a2v8yoiD+XcR/UIli+gaXIo0LQdFD1TQgPfUZSE77Hg dToFAkRzqsBencKF2EDXQPeOpquGTi8Kz9eKNrqoidgRkh2HtTkSiNmyi02t 4J67sKGOR6feUKmLUQsg/SOsjK78g8GqQFwUXsTKQKuVHrSksKRoPQRV0AXO +PtYCPf9LIByw6jlNDmzb6u5TOfWJhLiVW49ltMM1R36CXF3WhJqQSNk8kFh IMf8tdQpOeo70VHnHEY3OK07Coqr0Ckq0JQuFDa4df+4vsa5lBAo0eo4OuVx nGYG9NiUl9ig1f9qUIPYjrCu8qrg/9IweEQhBSmNMq1AXo5HwSWSdXhWB0vR pgFMxyD04QTNNbFCEcpObsx2D6ForPdr8tMLQL8ilqi0j0xUvzTQ2SsP09G5 dTkKck7pLrEZ5Xrsnavyk5BxQvPKNZwCkbYbYnwCBWe/nYGSRoq1FAWiAWI7 kkZC7qEOzvE1xhSH0DKOJEsY928NKDiESOcL1dsxBt7CZQJr0IkWV07zIiOP k9vHBT70BQ4JBnTaBoYRXqBBLMUm6mrwn84j9C0MIBy32E5tl3aAYuOxKZFt 15qm8HiyET/pF18W3baWFX9QG0Ab/ije1uyP7MPhy+umo5DGW3ehjeuAmD3Y i6Y1ww6MFpqQ6T2CNbymzHBs0S4hO6VR0SYU0RRZkDIYhkNLxc4jH4qgITQT 1rXZRcjBM1Bk1mMiryc09AQrRxktTyUY9GiOaG0V3jRQ47IF0NMK8OItMKso qxH9HZSYTnfA7C2MacWJlJwTZqbcQ7m0MlEjEjxTRKMCx9HlotEcNEneszB+ zdhpJFTb2H1Z7HXyoJt2gC6sHpN14fB59KKo7LbQ8eQ2tuhCoE2p1ZDgIiDX CYArZCpZiujT9HKIyCiP6G+Vo2nBLWAIK/zrqXpSUGakyqaT995sgSZfEbDX 1IlIzCsLUKpq11Ya9kigYzWiTKGBVKoUFIjnpgQ8ts8hvkfXijHKRHS2TXaW I+7T6RJDduYQuaiRemQNYLwM7JK5lKcb2joj03OXNWBUFFOuhRqUoMzRmtb0 N5n0rYTLtprjRI498YyVexJsaFf3x51SkGnC5aWgeZ/XJFcAVBrJDD+D7Yeg MmZKlg4J6kmPlSMAJsqjr+Tds/Vvqpl0bLB/EhquHhv1TU2Gm7SGwyJtmUqf 0NJ90YeyomYvwkRItwvooLMneNnFVafQ11kyLposKEXWpN24iI0IO1Jagdlg m5dhJy6b5xaAQO8S1jAoHCI3v7F53VcRsvLcpTUgDDzBlGFXNtgONQMOSZ2Q tCi6CFCEURqHyQES35hRZWVRNJTG06nXJ3/37B//7Q/t8/ns6/XV18/+tMbX X3z51bN//7t1/fRTfvrih//xySf//LvnX+H6+vXzLz5/9i/P/7S+Oj+2v/jy 2dMHf/v79dVX7V/Wsz+1L5+3z7/Wx/6wxvP9fM1nzz9/9u///rv21e++/kL/ /dn89Okj//Efv9QXrPOK+t2v71/6f9eX69m/rM/Xl+1rXeqPXz3//F+ejS+m Pva79vWz51990v7Unn/W+mfr2f7yi9+/+CY3/vjln9anX64/fMHXfPKPbfzu /kXf+57Pnn+le/5at/PS83zefr/+4RnXfLb/+Pn1y//wjPH7H7/553/4pH32 he6Hs71nTdf68rlG6Iv97Os//uGzF3/SFb/5nL70D3/Ut/wCYMIlPluf//b5 57/t/0939vf/8MkXf/xaf//sF3/8/LkG9vff/Pz61eeff72+/P2azzUMGuPP /qjL/2J+9fVv//Dl89+v61d01af/+vtffqKb++Znz5pGUAPx5fpqfc4Ytq+e /dff/Pdf/erZV19/qdH86pef/Op+cT724k5efM8rLsCtffN5xvJ369/a1Pv+ ffvsl5dqzDmKv/23389fvDjt/PunE9VPGNinpff9373u/+kvX3GK+vT768tP dUVd8FPx40+uF3R94OmHn/zriwXCyi73g9X7oBPP/80Zvu7FQP6XZ9AGCi8V 9BLFyE4JXLlB+ZQug1QVe/V3Shklm6RQQza7h3dkxOhOsWgzemrm+VNx6ZNv X9B1SPTu/9wD65/1zw+4ANn/9SNw7Oi/bjDeMALHzH6GX3irlzLP6okzmSgu UqqlkCWIzFA5YFyrUN0kXn6k0Y2AwCzKxyajgvnSodTjNb/+AgkfWf/6l31n eW8ZklePwz0tvuq9zyJuT7sOPk30aBbB1kQ/FbZVxUcRWnZvjO+BI837E+Hb 3thZQWXCvtnD+DEJ3jYJeKJ0PbtuHPcLTvyzF4Y/LvDmsPDqwTprQd4lLKx9 uWHkS0y4VMiLT7talNwGVvZCXynZnK0Ab3eHRo1YC4KXwdNVNOzHspH6mKmv v0C2TzdLA+6r/r0/5yt/4W3//rVf4Ies3+PQ60emdUX2y9E+zEor2s65RBSB 8iqiOxldkKvOgwPc2o6eJhrl/Yayc2YvWvfYxXtc4ANf4BGM33CBZD2VPo7S tlf9e48jr/yFt/37uMDjAo8LPC7w4S/wOph0HKH/OYT4TodfjZhCcvTj9jGQ afK9XMqLCDDMdik2zTUXtEzEZo7DPrH66fAh5OS/jDDeuNdVHonsu3/KK9/2 T7XX1VBVunwdZogz2GrDRuZ5bhf1ypfDugU1gNKma+MouZ+Rfhu95ChY3PEp tQgpanr45vVfM0yk4ZYu0/OYgasePfvTGkr8C4rX4zKSGp76QhSzSswUFLtu y949xbIoAlnHoVW4RENrrjOEMLZQfaoWgcFFDaHHDXxwMpUN6qr6qxJCPooG nWZx7zlUuuFSNyaM1eNaV4HObrFrOLHloUV8vnUz7zGPv/0nvdjMe91s/sk3 81pHAKwlBa5FhdHQvGwN7RM8pvHZcWaWWnEOa+sw/tordMQ7aSamBDOFTO2Y TX4G03Nql0Z7Q3Ft0VZXza7HsWZKYeGi16LHbwehl1zpzYwUayPuG2emQlQx UvRzIEB2yM7il03lyRyl2TbsMHm11OxKJhatuYEdckRSriPLjMhSOEq5xuVO jm/30petwho2HLA7N3S3FQnn2gPtPzuYd9utfMzyl2b5D9ytfHNgf/+7ldVg j9w12RUb61rFkagjvR+poW2/i+bQpduJmP1330Rfs205DL6wT5QPzdzpEkra ziDjhsSOYnaoNeDsJhBw7yExM8bVKpIZu9ATm/3lwBf6qNdhcDQ7B8Ospo8d qfx6HqNUi9gTZRpFnM6svrYWAt2WDtVDh40fRhK1+7yXvUpY7ohoIUSM5SNF 8ZVHcGZkSiGUY+gfSq7aXNDjKvOjMRB/LMXXX+CxHfujt2PfHqDe53Zs0fq0 JuPyFehnKpZyeL5om4AZQOnT6XK99Kv/60AM1rWEsWuoQx/Th/fMcaLGbYRH 00gkMDorpnK1HSTvezDOySrFBkTgRhI21SWyy/T3K7fW4HaYs6YmyNmQHExl utTvmAX16SWMsDItI6MLBVcUQZrpxYxYrEWYfIMhe/er5YnO1j1A6UmXGS72 0bbRfceFciqOEkj++GqnHTTxF4q2H/vNjwt86As8ss0bLvDYb35c4HGBxwX+ Ci/wOhz4Afabo4jp3jHg0N5zbQgCCP0Vi9uBCQPANXr2NOVhFHXHUzkWmpJn netSv8DIzO0i5GUdVVuVzj8uhWq0M8J7pdwvkBo+SoUNH8QlMpskM9AxtZp1 NtOGTRF+yXrguJbH6P7Qs805I54kshmXwGs1A+/DtDudgtGEjjZQFKZdJe2E 48e5D4YRlXBkX2LDFm/cft33dHjqFrSTV8evWSgzlPzJt1aIbyhqffaLqxJY WfsnqW/9lKt/qk99au1Ltr/2z/rno7zAe6zyDQgpMMFw4wrT7DKCM9vr/3ax qwTv2hRfqSjIiBYhvXSfgj1Mm4ZpTivOfAQw6uls6/VPfX+21w7AS0/9vY2w MoeWYk9YHC6kEgK9+n3SCEh3DPbS06M8kPM+HA1ERHvNYyWL0dv071rN+7f2 OtOtgvdVz34n0G8Zhre8VNx2d6CRc8dk9mgRq+s1dKGKpH8dLiUfaGbzU0nl ninQacoeL5SOcsmPKtX923zD71Ce+64DdLvAD5gGeIuh7OlcwnYKISwEolKo +qIevN3o+pmO/EGyh8/PuOzmDMpF9B/+1ZTk/q3NyMe+74+8wA9Zp/fw+eeE a4MBTE70zuAHEHD26oLkphXv0Rmw+tfMuQwqAuFeOm8rZirD45IWXB+PrdDH BT70BR5B96V/Htufjws8LvC4wF/hBV4Hh+7U4a2x/S1wyJkB+fA4kY8YkDjy lvNwZOtaG7GhsH4ZASGaf6/NqfqFgW8Z7t7e9nepq/1by1JPO9k/7e6SRch3 ohIjhll6jpe+2SilhtkRqa7V4fWwzLJimvcKCuT2S9651GY0D1zJAr+FDfWy RGhKM5RPJXyzp/XBrYjAyx3LC5qY3LB9R83G7rSx2BUncmuNYdEGXb2XuhEY Memq5r7v48c1O57kFFjhzGVsiANpzbBzKCPOTcFhysu6pMdEQcu2+wbZWg4h vVyswZcJeelpg6urD7Nb6tu26IeeG+Gy8a71s39r8zXdamZ/2u0zvUXT4vJs g/aS9QZjxKLGll63aWvZtIqxxc7Ya7T3OWNC1k/R7E7IA4a2dsmzd31PWg1t +7lwmsBNl6kTjbj5MWe0OsJwET24tQeuERZ1JtzwXN2r2LZnWyPr3hTnNB/H 6XtOpY7NA9eJrZnb0Jfxpc5Ui5vWBTu6FkyKOEP24TX7zXlSExhRR9FPwL4A f+nY3XZGy6tGPOlbd2HMtJdL+UcVx/5tTuF3KIj9afcHp0Ms22Mciz/T9qFR phV8mTlrdti696rsGLvS7CHpt3F3wss3Gcq+XdnBlGpNCJrAeXkcRKoivPe1 Zl3G+xYOE+bqTNopz9DsyiOniAjWwAy9zYy3ni5i0HattmjubZfGOtRgs3H4 pWccwd3aEedHzC6ixTAH2+7oq2L2bqGsfdWIh2OhdLwBTMTuJK2h5d2nVi0i 7X7qgesMW7e8I2Im5aOxln0sufOfxwboj7zADwlEP3YDFF2BMrTc567GWqtY EJBVt/p9N4PyMdqGy2lVmzjDvRtFC35jERcpEjXTe+Uq+qJQprHLtDRxnZ64 nQbcpyces0fGbtlspObK5VwUfDeaK2vFpfilCNAUQfS8IhNtpIYTm++H32g0 y7NRa5XyfE+BAgcFoOm7pYBe+VYhJHSayILRw0yboz0E98JoxkeFwKLbhvns AbrtEX1+E1dZyqfGRPq03GOH93GBD32BR1Z56Z/HDu/jAo8LPC7wV3iB1+G9 97nDi+ed38JpWLGnUrbJmLxZwybedJUNjNRsesLsdR+pYomeVvqP6xpChAJX q9dSKs2UDQsGtOWd7kuUcPoRReIOxxSsFLeY48Tcdne3C5UwVhhSd7sD92NF /hTjsaxdYQRrjz3maXpMS6gvCmwuu3FM7t2U3rMZsUeR5lmjx2wm9I1bXj8c Rfaw+prQMQ8rGqAe9OFRd6cnNTlUk0ubLdGhWeNbK1mFAd9v+aouSHnsWbip H94KN/nrv4g865V13XxRNv0x9ML8XC/wnWzKncu80yv65r3cNw+//4q+px+L eAQ2yVb8yO2K+8hORZSnJ19M9ljIhVmLGxGX4ONMoJqawvA1KCz075kaPubh x3aBdKuJvc/DP+NF5VP95TUv6nu1V7PlUDcypUsE3K9uUmpxxyrmHVNGQCWt 6ltflRPI+1Pu5BXbhxLHaGW+fIDzl1K1fUzN93OBdNusv13gVfv2b9fqvL+q tzcFvXXSlrxCbNeWmEe7olcr4Na2jcUPXEGX2XGzBzaFLu4h1ORedO+pj5ry juWj3dd+rJ+f+QXuO+8/8z3un+cFXo4q9/z4zhiNiX2PYm8OMNnrx55OkUp4 EydRsutDfAcH+OgM/i1jinWJjLmzgWRQeWMHdCwiC/HYr35c4ANf4JEtProL 3HfUP6LdsscFHhd4XOBxgTf9C447YuJPl32+1wicO8UMWF9jWl8oOl02YxY/ XM/bOle6R9DT+lAPg9o5s2+xoqmAK2T4y0gUP9Lr+7rAd7IlH3i/N9hufJ42 +9DiLnM7F+csI8/lyy7Rrj17iIP+5JL7IeoZMRebJrtoe3W6UHQ9uYXDc+0h 7ey2WztQ79d32y6G1e9tzCIpptplm+91hd3jij3ZOt0yKB8HDUqzojFctXcU PHMuxx5fLb2snkb3tc44KQLeccYS3ND/Wj/z6rpIHluPUnvCDfS+jLLWl0Wj D1Povnc2uqeip4++21gbPtNulDpirMn+5TSUHwvt/Vwg3arU/yIb2grqE+9f P0zpMXgtEKf1120Ya3cXYw9hFD+Gr3nYfF/MadYcU/TLJyUKa7tyQPZuagqX pjXazJrDpWZ0pdA7ugDZHlrVIaYVy+6j2Wz8mAhWjq7cktfKznTkgfSYfvft hPWRLfL3BT9dNZYd9UuzwAwTrG7JDpNida6HwlmtQoZ+7q1pGjAt6/uCd2xO KMNl17qrc0ykbY3TP80ndMpdt0P3oKSnRPgzUXZ+rL33c4H0Ljv2b5Nzfb87 9l6p6kkdWumn7lWN12KhrykNDKKXUsFIu4WYvd/2PqVb20zgXXpuo5vgQrFh D3T4x07DTmVRk1adpqUxtLJKbOv+/FZroWQf5567jlUCqbblPMquyw67akRB INmu1Z/nNKl6c0DetqOdLgeNFMIxU8vIJ/Siw1Y6m8XlTUuV063WMmqourmj xnZ65fdtjfMzhTZtMLm6oHw/fUqrKRHukFzJGp02PtojiUeA+Jlf4HEk8aOP JM6w+QGPJHrGl0ExM5ZR8ClUPBcEDz0Xl0xHdFCQPuy6nXB+n0cA3B1B6SYQ YmbP3mZFSZNHUNx0ZATARe6lOrObqzY4oZeDC4t3iLjo4YtYRF47YSRfGp7v pvtYkq+RW5riysIRJpR2R2+xrJDxxFCwFSRpGgzTdhCC2d6MpJheR1PoXS3X opsSTVmHZXzTPaGiTXuhS7mLC4lFiNHrwkbhtORmujBSTzW+ZMXyOHN5XOAD XOCRDj+6CzzOXB4XeFzgcYG/wgsAVP9CZy4mdtP32i7FOdYq9LaLcGfcyEYI Nufl2grD+ibebO+3KUhrZh3T2lHS6GLIae/RpuBsTQJ54t3CsDVv47uYe7Nl +cP65epjwJLS2tW7HscIX0aX6qC/wE66FHbV7Y1ce3BNzL+H49Sn7WKNj3Xp Ij4FfbaEXEJL4dolCH5EtwQpA25XAqN0hxxe4Lq7haSLbdXp31GBzHtZa9kx X0t4tDp2wjX4/fXNDV9smhv+5z+K/7+9u+GL/cO7G65Lnr0NTz/6s2Wp39vU CmIxL1w+wkugxr0/b7TjW75nO5SiLUNTUH8oNpS0MLBsLYcmmtObjWbakZHw EXPqd8EetnKDZl8bM/vYXlYO/hkMY/q22PyHf9f9G17BYN8ymJWtM9eChtMF VFly8jEmk/0OWmC11960pMRsozlkYEwc3a5hQqtNK7T8PGrL3zKyrxc2edWY H4cb77Jr8M1d3APnq4a/KuLEIk49QnF2+GjqxCnP1DDZOPChc5ZnbLP4Sd13 DLw1IvCjVJNzG6N9tFuSH3wmvE1v4+exj/Vzu8BB4N491v+w1/R9mavZhxBJ aQIrHOr1gXW1kEKOqTvSPMJTutDSPRxHCr57L4AheNFW234/NpweF/jQF/gZ BLu3yUD8/HjR4wKPCzwu8LjAWy/wLizpHjTfiNhfCUPm9iHkMeL2q7acZ7Nm F1udLVN/h7brEB7PWTBkhXVIvLre2xpr5ZJa2OsvUqP6BtZePhBrz96GvcVj onj37rU2I1A5Bed6EX9My3fX84x1+aIHuUsv2dpLT06UyPi91+Io0m5rfTYu 2R18cs6srfvbZee0Yxftv1OlMUvkZL06IUjj/PbiW2wa5RB2wNSiZBvmRbV6 8ZpV3R1Y0sVZY9szz9zD9LAz3+dcxUZxZ12892AXasCCpKZs58YO90k7k41N Q9rNrPpc9qKiYs6aS70WfYoza9+yr02Q9mXB0p/BPEnflgx+mG2JUaPbZpQV XR2t6FdEcbV+RutGK8ltNv7K0C3MiarmHZJpFKvIwrrk6nYoyayRNNW6o9lP I96a5iBCojPvXG3NPd25zZxtcbM5lebzTJqqWZPCh5pm9yVztp/CrKLq5rIn XKG6+y7T5C6nn/0qnerOtFAVAbqJ3mBpNOa1s1JQWPYL4+wd/b2cimrclNG9 XUy5pK/OYdsehy9pJufNyHofRiPp88sKE3+hCsEfse/y/Un1k++7KKSkqJjc No7dw6RmFQp0XYXybcpaa9gSFa5KNXv5ezRaqWyzPFvlkwErhZVcpoJUszOt MXyPSBiHWrImwA5xmbsYY3GpKlg4dtSojqi97xVLtZoeNs1iPXy7N33U5OEH cfMoOd9WaWjvmtnm7kkMWDFQEUzT1FlN1ogtltmXGGRGSlzxzd/vIFfTfItK SxSLh75y3XXPsLstpib9Zc7EsVTMpe7zkW4sffCp/thY+tEbS+8OR/68jaXR FE5TwZ7WdV2lLbODlpyzzloUwfYY+r40xyhm1Pu+9wi2uDVTGlEYZK+AF6H+ u/QljOKUWYpit+J83grPtUSFgHLUybdk9Zm4ohF4aMpPuQlLLGWEbFM2xKSU 7HIjCiXVNRUqyx2ORE73rEJH93GOkJcX+rR2raJEt7fWrFY4eurJjqZAM7td +1DYWAJcbQhqxL79HFdBF7VmVsCJA7lhlu4yFF0z/f/2rmRJjtyG/socfZkI EtyAz8FC+uKw///mh5Y9kTWaHqmlXiRF9kFRqqhEMkEQfA8JAneq1i3g3QX8 AN78jpzdAm4Bt4BfUMBLiPz3Rc4k6asOzyN3c3iSnGodA/BFc0ZfoiMkE490 QfQ1n7wF4JF65MFcEOiluNqXgKoVA2v3WF2HVK07yQ/IslR7OI9YGkDMaeBa oGTnrK1BXjOQs8C5jc1LVjEFAKobjMgEdPuhf0c8HUCfI88CT19g7wGgqMx9 r7bwFLJqJxdKQnjAGGu1h0cQwwjbUyMcrqHgionGOrU43OoEf2taqgqEicjX ZRr99o9//eff//wNe+EbJB39nrJ/xzW/1//9XeNw3/T3Uwp41eQrdZPVpoNQ rxOwBcD5MaqYlJNRoNYNNpl5NIMlW4GRXFddwdqK0oDps8PRZ0lXL5V+1QZu 9Cfpn+UH0XKQotmy5Cnl0dWWnSuyfx0HOIPWDh5EYyl8RjxEXUUDq39kCS6M ZLSXJlu9ndrmH0lWX3+PK/3643ZfUN6U1BITfF1t1gmfpsP7eYG/gFuqAQ9V yjjSNHDTyz3szNBeTk0q5+P7Cne+tSb/Pqnqz3d/CIt/eSBf0LEsgROto8yu x8yPyJkE+5Sj4jwKGPbx0w7T2FYe2vfV7PHnx+mMVR7D7j9VoOvdpvsOcH13 gOvlDvvvp+ezwNZQISoyKSRLIVTyMvMU9Bw2AVjGAGAKAYijI2FXyVFPTMV3 WSl4kN1xn1vAewv40L3sjvfcAm4Bt4BfTsBLqM7VV389DD/LZOqQUvWMWOy7 Rlk1xEEDXH1OsJ2T4KIwmNf1dbZPzahK9jeMgX9ekiH1ltSa35haN5YSplma jaAT2014ZBfG6gSgbbbPOFlOSp32PFcQuYoVoX1ONsClkoXqjvQG1BZuundm KCkmgebahxa4Ge19HZ4zFO4leZpLt9l6Zkgd3R3SQCsjWl/jbPDX1p1sq69z 3cbz/B7XiSezRVCFjhYMzuVca81zeES+y2ncJ2eZru1Wx0OOC5VZqPImHj6W zgIq6eRsBqBqsaM26NSj4z7y0oyot48dvMQ6viV20Kutc3RpK5n4U3tPtWbL 4rXyBNvI/KLT9+gmWh/Km0+lciIT0oDnZefShBKHZAG/PqxmBh1lT+XZyUqN DmEPCXcCGHQmh7bdJSJMPGhYhoRHBVNuK3paGoyOmtQsZXLO9RV579nTIUA8 atUyLAuHeLRZbLpu5y5OIrW1nSFh6XiOOq4+oW1qflStl9KO2lrzZJ6OwUQF uvC5aVeftFd8li/3sgyojwyOfG5ErxscGQC0a3cl8HbuizCNJMVbYVy7diUY QoeT3iUKJuHhqGSmH7XMCOgYecUHuHPoVbXgWdhocdtLcuqVtWXGU33oXa1w 5nvh8Zxo5FRT1zOzR+7qHNsyeWmWMcVi9H16aD7i1YwHXIk27d3K1g4tWJtr YVXAeUnmZsE+GUPfMJXCXGBydF0HHPnuoCmD0BpTWwOusR8tW+CpZM3WoN0x Mm131Z82+vNu9nxHf747+vNyTPGy6E+VEwGnI1gQtFt1rJeab87MSiOF2z8F ghuTEfaPq88WYEQPX3xKaG+tfCo+O9WOZFUoxxWlAFBgkWH3H713flhua2Q/ jsY7unWAmYBfye4/BZ94sAWfCmftgQfdFC3PactVOapzWe/CWccqskwfnE6J qJqFeds0HVHiTAO23MeKAWI8lAp2+LfTD3DNNngewvXAnyNGyxK5Q8PnyrA6 bNh83eGtW8B7C/hQNHKHt24Bt4BbwC8n4CVs/NvCW9JBetspBhwCOFJA5Jrp 1KKtn7rBUGkV2icyG3z062GL7gbYQzXbWxQVAsjpg0MmAy8ZKNLRmYXCuR1w +tAKajivh6eK0poZIgK2isG+t2VcwDJliroI+HvbEWBWZQi8e3NpD/0UfWyw H1Coehw0KiTJJyvNMGLsBjzWFCirbcEjjtW3sT/uKsvOjom75ck7AXXCXsZB LbL0TmvizsO1kYBafjmNicZ87dylz5pBf/rq49tBP2XHfarD9dYFk/5/lz8b L0A/ILF3IPNGJiMWbS7rzK2WhTRaYmwnkPsmtfvV9rIJOWzB3Svg85ofWzDp r9Q436hg0nPKtCY7u5eCCGFZLqxruAyoYtdDYBdeZXmZ+GoHRD+0qymZgDgq U+XCu7wwbPVBmn3Pgkn0WGz5L20ZP2Px0zsc5Sl7FT085zg7z0Jup/CAB2Up ZkseSsR718CVTwcxu82f91zbu1vCHfj57sDPaxdMes49LSAeePF0MpBArGPn ydQ9SzmEhWJ+qDmfHM4eD9XRp88MmGhpp04srTs+cgt4bwE/gLO74yS3gFvA LeAXFPD6BZOegyFSOevhDKJiVWa2ixoy6mlj9AVMojyVMZhJxCvmNV6ifREo Rou63M384wom/TVrf+2CSc8iORCcWQMiA9KW7NKGMXPxoS1rbw89CrjXF3sp 6+HkDZ7MmVdb2s5sNfKoHOGbOEu0Z1+uEcn8s7zH8lViTnlMycp4j7e6S91k 6t7Padmby6YWTCmmpnIe7yH1jQk0rn7NL9qdq/Wz2mn9ZEmSMgKzufmMDhrR grK5ZRGD+kqRlolf/ZonQ7G178qq0Kd4YtatIzAe6H3LZJmV8sAHtBfnYwsm /V1Y4rULJj1nLTo6RO6Jqck3rosbfqhguvsUjrylYgyYUVlhxa/+oVFtHdpf GZQwyXe3PQt0mZDKlk18vJ5sQTpLvsiVpfjhda5ANRrTaXtrLWOtg/k5Z8aZ 3sHMMV7fc7jSkEZnpg3SFRT20rOSO1zGgZUfj45hr4bJVYbFmi7uh8sZ6Thg /G2uXh7CVJmSUklgFOuM4uyHYRtUo5y6a2S+HDisLptZSufHKZj0bXGX1y6Y 9BVxl91p95DRWCtLg5xWR7csWl0N6xDDOostg4iZrHM1j76fKiy1yLBy4UE5 wZV2Ed4EF9Nbp2VBtmvW27e+rD+0thJsJMta0V2PS5qnZIR70jk9splUx9PI 0yliGCBH4yzHdM2kam06jaB8SdA0XANOB1Q4E9t2NpiGrdJcGk+ZmDnU8tCj t8J/jZlV4Wy65OE977ww/kyYgFnVNaaCdRd4ydV+2sDSu5v6HVj67sDSaxdM em6D6VjDo0fkKy/WOaJsP0tPNCe4Xmx1hZYzXOiEm35IJVT8sm4gBs1uIdih eu++OpOL7CElpWCLH9hzqggwCRafXCHh5Hl6Zhta71hu1HSVFt0KZTAL2CWR DrYnzQAwWyaskl89iAoH9qhtBwPUbLOro1SdBcs6i7cZ/EblXhziF/6z137M l8bO6Qe7FqcjitpKZXwE+MJQDOhqxeZWDSCmd+yNd+TsFvDOAn4Ab35Hzm4B t4BbwC8o4PULJj2Hs4ro8TVjVCd3NwetddCkATY98yQW+P3QrMJSmrFeWQpF gHoPp7XIJ+9RinmWfy0+S+YogB93cEpbWhpQnIBx0ZVG+8BTVN+M561ajLOU 7Im6GGM3iQzF4CZnJgSro9rp6wGMLvHMbwDB3wd4bcxaQcSZWKSrCPPpIPA0 JiAaG/jcrPtBYRx4Nn3iZgBU4rPJDH/qNuwMcuXZ1c7qyQ7Fa3/KIfovvgmS Ij5GBQA= --></rfc>