From 9c0d407b104009815bdfe2392731468d30cb0aa7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B8=BFtcDrak?= Date: Thu, 31 Mar 2016 15:39:33 +0100 Subject: [PATCH 01/13] Clarify what remains "to be decided" --- bip-0141.mediawiki | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/bip-0141.mediawiki b/bip-0141.mediawiki index 12b0ebac..dd17eaad 100644 --- a/bip-0141.mediawiki +++ b/bip-0141.mediawiki @@ -249,7 +249,11 @@ As a soft fork, older software will continue to operate without modification. N == Deployment == -This BIP is to be deployed by version-bits BIP9. Exact details TDB. +This BIP will be deployed by "version bits" BIP9 using bit TBD. + +For Bitcoin mainnet, the BIP9 starttime will be midnight TBD UTC (Epoch timestamp TBD) and BIP9 timeout will be midnight TBD UTC (Epoch timestamp TBD). + +For Bitcoin testnet, the BIP9 starttime will be midnight TBD UTC (Epoch timestamp TBD) and BIP9 timeout will be midnight TBD UTC (Epoch timestamp TBD). == Credits == From 735a55612949f5b0bcec6fe2e5f89e65bf0602c6 Mon Sep 17 00:00:00 2001 From: jl2012 Date: Fri, 1 Apr 2016 15:17:24 +0800 Subject: [PATCH 02/13] Create BIP MAST --- bip-mast.mediawiki | 192 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 192 insertions(+) create mode 100644 bip-mast.mediawiki diff --git a/bip-mast.mediawiki b/bip-mast.mediawiki new file mode 100644 index 00000000..a903235a --- /dev/null +++ b/bip-mast.mediawiki @@ -0,0 +1,192 @@ +
+  BIP: ?
+  Title: Merkelized Abstract Syntax Tree
+  Author: Johnson Lau 
+  Status: Draft
+  Type: Standards Track
+  Created: 2016-04-02
+
+ +==Abstract== +This BIP defines a new witness program type that uses a Merkle tree to encode mutually exclusive branches in a script. This enables complicated redemption conditions that are currently not possible, improves privacy by hiding unexecuted scripts, and allows inclusion of non-consensus enforced data with very low or no additional cost. + +==Motivation== +===Evolution of Bitcoin script system=== +Bitcoin uses a script system to specify the conditions for redemption of transaction outputs. In its original design, the conditions for redemption are directly recorded in the scriptPubKey by the sender of the funds. This model has several drawbacks, particularly for complicated scripts: +# It could be difficult for the receiver to specify the conditions; +# Large scripts take up more UTXO space; +# The sender will pay for the additional block space; +# To prevent DoS attack, scripts are limited to 10,000 bytes and 201 op codes; +# Any unexecuted branches and non-consensus enforced data in the script are visible to the public, consuming block space while damaging privacy. + +The [[bip-0016.mediawiki|BIP16]] (Pay-to-script-hash, "P2SH") fixes the first 3 problems by using a fixed-length 20-byte script hash in the scriptPubKey, and moving the responsibility for supplying the script to the redeemer. However, due to the data push size limit in script, a P2SH script may not be bigger than 520 bytes. Also, P2SH still requires the redeemer to publish all unexecuted branches of the script. + +The [[bip-0141.mediawiki|BIP141]] defines 2 new types of scripts that support segregated witness. The pay-to-witness-script-hash (P2WSH) is similar to P2SH is many ways. By supplying the script in witness, P2WSH restores the original 10,000 byte script limit. However, it still requires publishing of unexecuted branches. + +===Merkelized Abstract Syntax Tree=== +The idea of Merkelized Abstract Syntax Tree (MAST) is to use a Merkle tree to encode mutually exclusive branches in a script. When spending, the redeemer may provide only the branch they are executing, and hashes that connect the branch to the fixed size Merkel root. This reduces the size of redemption stack from O(n) to O(log n) (n as the number of mutually exclusive branches). This enables complicated redemption conditions that is currently not possible due to the script size and op code limit, improves privacy by hiding unexecuted branches, and allows inclusion of non-consensus enforced data with very low or no additional cost. + +==Specification== +In [[bip-0141.mediawiki|BIP141]], witness programs with a version byte of 1 or larger are considered to be anyone-can-spend scripts. The following new validation rules are applied if the witness program version byte is 1 and the program size is 32 bytes. The witness program is the MAST Root. + +To redeem an output of this kind, the witness must consist of an input stack to feed to the script, followed by a Postion value, a serialized Merkle path (Path), and a serialized script (MAST Script). + +The Position, Path, and MAST Script are popped off the initial witness stack. + +The double-SHA256 of the MAST Script (≤ TBD bytes) must be correctly connected to the MAST Root with the ComputeMerkleRootFromBranch function, with the specified Path and Position. + +Path is the serialized Merkle path for the MAST Script. Size of Path must be a multiple of 32 bytes, and not more than 1024 bytes (which allows 32 levels). If the size of Path is zero, the double-SHA256 of the MAST Script must match the MAST Root. + +Position indicates the location of the MAST Script in the Merkle tree, with zero means the leftmost position. It is an unsigned little-endian integer with not more than 4 bytes. It must be encoded in the most parsimonious way possible, with no leading zero and not larger than the maximum number of items allowed by the depth of the tree (as implied by the size of Path). + +The MAST Script is then deserialized, and executed after normal script evaluation with the remaining witness stack (≤ TBD bytes for each stack item). The script must not fail, and result in exactly a single TRUE on the stack. + +Sigops in MAST program are counted to the block sigop limit in the same way as the version 0 witness program (see BIP141). + +If the version byte is 1, but the witness program is not 32 bytes, the script must fail. + +== Examples == +=== Calculation of MAST Root === +To calculate the MAST Root for 4 branches, the double-SHA256 of each branch is first calculated: + <1> EQUAL (0x5187), HASH256=3b647cb856a965fa6feffb4621eb2a4f4c2453693b2f64e021383ccbd80a1abb + <2> EQUAL (0x5287), HASH256=37772654bdce9b3d59e1169ea16ddbaa8a2ae8ee265db64863d0b76f02c882fa + <3> EQUAL (0x5387), HASH256=2e972642436151cd96e4b0868077b6362ffb5eb30b420a6f1c5e1c6fff02bc33 + <4> EQUAL (0x5487), HASH256=4c954fc1e635ce8417341465f85b59d700806f6e57bb96b2a25bec5ca3f9f154 + +Serialize the hashes of the first pair and calculate the hash. Same for the other pair: + HASH256(HASH256(5187)|HASH256(5287)) = 64fbdfc0a82ecc3b33434bfea63440e9a5275fa5e533200d2eaf18281e8b28b6 + HASH256(HASH256(5387)|HASH256(5487)) = aeadea837d5e640a1444208f7aca3be63bc8ab3c6b28a19878a00cc9c631ac31 + +Serialize the 2 hashes from the previous step and calculate the hash, which is the MAST Root: + MAST Root = 6746003b5c9d342b2c210d406802c351e7eb5943412dcfc4718be625a8a59c0e + +The scriptPubKey with native witness program is: + <1> <0x6746003b5c9d342b2c210d406802c351e7eb5943412dcfc4718be625a8a59c0e> + (0x51206746003b5c9d342b2c210d406802c351e7eb5943412dcfc4718be625a8a59c0e) + +To redeem with the <4> EQUAL branch, the witness is + 04 (Stack for evaluation) + 03 (Position) + 2e972642436151cd96e4b0868077b6362ffb5eb30b420a6f1c5e1c6fff02bc3364fbdfc0a82ecc3b33434bfea63440e9a5275fa5e533200d2eaf18281e8b28b6 (Path) + 5487 (MAST Script) + +=== Imbalance MAST === +When constructing a MAST, if the user believes that some of the branches are more likely to be executed, they may put them closer to the MAST Root. It will save some witness space when the preferred branches are actually executed. + +=== Escrow with Timeout === +The following is the "Escrow with Timeout" example in [[bip-0112.mediawiki|BIP112]]: + IF + 2 3 CHECKMULTISIGVERIFY + ELSE + "30d" CHECKSEQUENCEVERIFY DROP + CHECKSIGVERIFY + ENDIF + +Using compressed public key, the size of this script is 150 bytes. + +With MAST, this script could be broken down into 2 mutually exclusive branches: + 2 3 CHECKMULTISIGVERIFY (105 bytes) + "30d" CHECKSEQUENCEVERIFY DROP CHECKSIGVERIFY (42 bytes) + +With 2 branches, the Path will be 32 bytes (as the hash of the unexecuted branch), and the Position will be 1 byte as either 0 or 1. Since only one branch will be published, it is more difficult for a blockchain analyst to determine the details of the escrow. + +=== Hashed Time-Lock Contract === +The following is the "Hashed TIme-Lock Contract" example in [[bip-0112.mediawiki|BIP112]]: + HASH160 DUP EQUAL + IF + "24h" CHECKSEQUENCEVERIFY + 2DROP + + ELSE + EQUAL + NOTIF + "Timestamp" CHECKLOCKTIMEVERIFY DROP + ENDIF + + ENDIF + CHECKSIG + +To create a MAST Root, it is flattened to 3 mutually exclusive branches: + HASH160 EQUALVERIFY "24h" CHECKSEQUENCEVERIFY DROP CHECKSIG + HASH160 EQUALVERIFY CHECKSIG + "Timestamp" CHECKLOCKTIMEVERIFY DROP CHECKSIG + +which significantly improves readability and reduces the witness size when it is redeemed. + +=== Large multi-signature constructs === +The current CHECKMULTISIG supports up to 20 public keys. Although it is possible to extend it beyond 20 keys by using multiple CHECKSIGs and IF/ELSE conditions, the construction could be very complicated and soon use up the 10,000 bytes and 201 op codes limit. + +With MAST, large and complex multi-signature constructs could be flattened to many simple CHECKMULTISIG conditions. For example, a 3-of-2000 multi-signature scheme could be expressed as 1,331,334,000 3-of-3 CHECKMULTISIGs, which forms a 31-level MAST. The scriptPubKey still maintains a fixed size of 34 bytes, and the redemption witness will be very compact, with less than 1,500 bytes. + +=== Commitment of non-consensus enforced data === +Currently, committing non-consensus enforced data in the scriptPubKey requires the use of OP_RETURN which occupies additional block space. With MAST, users may commit such data as a branch. Depends on the number of executable branches, inclusion of such a commitment may incur no extra witness space, or 32 bytes at most. + +An useful case would be specifying "message-signing keys", which are not valid for spending, but allow users to sign any message without touching the cold storage "funding key". + +== Backward compatibility == +As a soft fork, older software will continue to operate without modification. Non-upgraded nodes, however, will consider MAST programs as anyone-can-spend scripts. Wallets should always be wary of anyone-can-spend scripts and treat them with suspicion. + +== Deployment == +This BIP depends on [[bip-0141.mediawiki|BIP141]] and will be deployed by version-bits [[bip-0009.mediawiki|BIP9]] after BIP141 is enforced. Exact details TBD. + +== Credits == +The idea of MAST originates from Russell O’Connor, Pieter Wuille, and [https://bitcointalk.org/index.php?topic=255145.msg2757327#msg2757327 Peter Todd]. + +== Reference Implementation == +https://github.com/jl2012/bitcoin/commit/f335cab76eb95d4f7754a718df201216a4975d8c + + +if (witversion == 1) { + if (program.size() == 32) { + if (witness.stack.size() < 3) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + + //Script: the last witness stack item + scriptPubKey = CScript(witness.stack.back().begin(), witness.stack.back().end()); + uint256 hashScriptPubKey; + CHash256().Write(&scriptPubKey[0], scriptPubKey.size()).Finalize(hashScriptPubKey.begin()); + + //Path: the second last witness stack item; size = 32N, 0 <= N < 33 + std::vector pathdata = witness.stack.at(witness.stack.size() - 2); + if (pathdata.size() & 0x1F) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + unsigned int depth = pathdata.size() >> 5; + if (depth > 32) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + std::vector path; + path.resize(depth); + for (unsigned int i = 0; i < depth; i++) + memcpy(path[i].begin(), &pathdata[32 * i], 32); + + //Position: the third last witness stack item; unsigned int with smallest possible value and no leading zero + std::vector positiondata = witness.stack.at(witness.stack.size() - 3); + if (positiondata.size() > 4) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + uint32_t position = 0; + if (positiondata.size() > 0) { + if (positiondata.back() == 0x00) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + for (size_t i = 0; i != positiondata.size(); ++i) + position |= static_cast(positiondata[i]) << 8 * i; + } + if (depth < 32) { + if (position >= (1U << depth)) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + } + + uint256 root = ComputeMerkleRootFromBranch(hashScriptPubKey, path, position); + if (memcmp(root.begin(), &program[0], 32)) + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH); + + stack = std::vector >(witness.stack.begin(), witness.stack.end() - 3); + } else { + return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH); + } +} + + +== References == +*[[bip-0141.mediawiki|BIP141 Segregated Witness (Consensus layer)]] + +== Copyright == +This document is placed in the public domain. \ No newline at end of file From ee744caca9dce9717b221a60c92f0d0e414db625 Mon Sep 17 00:00:00 2001 From: jl2012 Date: Fri, 8 Apr 2016 23:45:54 +0800 Subject: [PATCH 03/13] BIP141: commitment clarification. BIP144: new diagram --- bip-0141.mediawiki | 2 ++ bip-0144/witnesstx.png | Bin 18923 -> 21335 bytes 2 files changed, 2 insertions(+) diff --git a/bip-0141.mediawiki b/bip-0141.mediawiki index dd17eaad..f9881be4 100644 --- a/bip-0141.mediawiki +++ b/bip-0141.mediawiki @@ -75,6 +75,8 @@ and the coinbase's input's witness must consist of a single 32-byte array for th If there are more than one scriptPubKey matching the pattern, the one with highest output index is assumed to be the commitment. +If all transactions in a block do not have witness data, the commitment is optional. + === Witness program === A scriptPubKey (or redeemScript as defined in BIP16/P2SH) that consists of a 1-byte push opcode (for 0 to 16) followed by a data push between 2 and 32 bytes gets a new special meaning. The value of the first push is called the "version byte". The following byte vector pushed is called the "witness program". diff --git a/bip-0144/witnesstx.png b/bip-0144/witnesstx.png index 5fd8afcb01ce0cf08b7de1003c8be0539f226ba6..cb02a63c9c2bcd7551e96d8caf915555c9f64375 100644 GIT binary patch literal 21335 zcmeF(W0)k(qA&VtThq2}W7@WDPTRIUZBBdIwrzJ$+qP}qe&4nCIeYE3?z!jQulIbZ zr}Bx)$f(SyjEwmIy2IsV#o(Z^paB2?oP@ZrA^-r={Po@g68!5m>H5 zMG*W6CWnqVQj(8@K%od$q(IR$JKiXiStWV=2cC+mYaT zIG*uq+An4{t9$c8XY1-V@Sq-I8VUd^Ky1bWTz3ijKy&j11qloq6|#vrBo}Ms0uEH! zlqrB~$3gIRw{q^2Nt{{01Vm=X^=&FMI{1L84Vhq{jqV)BRj%^{5jgleyBRNx<{DwG zIwZ0gHLw!xqGhijpGDao2QJwZA?PTz?aWV_cd^i6Lqa;>Q)1mMS#5N97e*kmDIm~h zu?i4^I!Ll^&{P1jKCrYO6a&ydHq3m1%eNZ&jFSJgNFNxN-w$;S-fx`fzwh-`Mb0}^ zb-?P!PYvLIuJG^Lod7_pcHaR^k^gk8e{A?akat7dyfXiQ`Y+A+&(D3eRlVmNFiaEh zKU(;oMctq)*#PS1^FOJi|JnHeS(M5Tfv6AG^#AQk@*ffs&+o3R769?X`+3;1x8>*& z_^|-AfR?zby+-Q@7M!N)uxQ$%07q4j{AhsCvp?kj<4kU$km-xJBOGRA2GpKY$F{r| zDK(R1IR917e~2hg-OQ5KwmM`r4tA9jV;~o-ZvYUFqrHmPP$cjKa)a(p(7k91O?lBU zGXZP-?$?!u#0J+bHnDc9e3|dhbJhRrw_gLa9L>m(Pt2N`VO})>F*vyTbx*GL+f1|$ zBvt}umEJt=?70s|T8-|HWX1EofHzAhj~FqH65 zz2LUOXnyO3SGVK+(3K97!jF`lcKbkmsYXu~JL17lzqUenYaV=7EymAhJ_hSaSWqp; zYO@21J*e}iIBOm;oWHNjS9hBu8)bnOk0^VQ8|m*-{>TQ(IjwZ)2cZCA==cRp8~^^f zIR5@{h1O28Qheiy0eDv#_Q3~!Qg;5#x4&3b3YHv=V#GinEGtV-9AGs65i8+W(OjyN zq@|EHg8zH(ik%>2uOgIRrlyoT}XXIzt!)Awz#CV0%*!>Kl!m5&Wqz# zf7EUrWI}D3EQe0k0ouXzOEcsK@|S59i*(efYid~VjELXtL^UDhbB^{Bi9sgMWlw0U zjZEF!OcgjBP#(Rl1zat08#PvSaA3@W{i+|`6FZy0G{-Kh=iN?c%}M>)+N=Y3TOa^1 zIqh&OG}f|VP~xBghA+gj2y;v6N}4Ot%3`AyZQ72Ko!=;Qc#z~OU4m6boh)6uVp6hf zxq7)DgMWpUzX7@Lzim4z7@>dtDs_JO6$PwnYnbPV{5pJw_S*(j0;(0*HVfR0CDQ?0 zZ~*i%s5myq?9k^k3P2=K#&5-OiYH&7pGp(w1?}E6)HY7pDBl&keG_NN>b4h*M+6wb zx`6>dmUsC8KLAJITM)~(@P1H$;)3s3{H%U@d!8&;>}cHz&uJm<8(?lUAX$-FDwfs9J}YvWxIfZw4cZUe869k{o#D^|qixbUT zy`O%S@VoD(;6&@CFrDIB-4?|%gg`dnQyf{psYkUQiZz@2OgZ^Jg--Y?)=j;u6+Kyc z@eJm@AQF+AMDwAk&uIvI>Xh=BAob!6T!5iBs|_(p&kH_vkoc)}^>+*u$omm)1F6~4 zH5|<*t*B|~o=#^#hA`DYuiq^*Z-0Hy^-|*v zZ+mUjk9zT;XUs@OYrCIEpEU=X?Wv5y?FN#q@R#eZV6d%NG~S+6sv2iucy~Al(ilKm zBfQEO-(qnH=Z|NIeYbZD5O!T7b$+g*)v^>qxgDKgVjv=u(e3G%&=-(=_H5ec6VSvCiXwp#7%7`4FzuX$qJ4#r;6Hk2uscf(2b6Pl8 zzu6MT`IgT$&5}PxZanTVp5Z}uLd%x(!cF64NM*rt7-15<+=Ri03OBI#6A2RW)&pg= z)9st@Ty)RA5}kl?F;caLz40u$`rQSw%`<|mFJ6isI~dfo!BlTZ$f%%|);st|-HCUK z-Csj%Hz-#ezf$`20<%zF>mhIslAI#baZX86KHOeOqSg(0aC{<-B3;t16(?Q;yxE)r z=1d+-423`7Oo6fqB}6nnrR?IBC^BGnM?T+7Q5QucANB&kz+Z4T<9$QUN$9tfRlq%s z{|q)#i)x~$V3TBCpe!pwSjd19BdW?%D_rr`N%e|kr1zaEnvBDwXxzS_)D~lhwFfDut!b7E? zq5*~dK@!yog78NJI^iaHR{JOQ;fKG(u4ve(wX+7J#W@$~5L|chh?4fUvSE}dT~AaB zoQPd4e48rwc7lV{^gEmYBm-z44j#CpGz&1RqIVwCP;@iMqBa}w%ZtO@GN6JGTBy<+ zhPg;DJXJoYbq2a(GVBSdX{S+3d(gXPS8dz>)mF^V2}7S!%((#WWeOBF{f6nH{J8b+#(XzwngRK+RJHjAJQB;W5d1LQB4gJQ zk>T-uRHJp@LeMl?6_My-h?>YE$6X~j3j%i%XhzYarpQK!$HH&C(`F?fk7Cf$bAhlN z61ra8Bsz0$62Qf-lim^(zspCL^(z#Wjq4P;Pg=WE1jhACZ3Jf-Yg_n9q*F#6aniB3?QZ{wOuS($&|^WW%ipdDC-QpoQYHJqVhr-r ztE$12>S2f0rjX~{bvzeqyxQKY|D+N+JCg)u*>2h?tcxF5JUqC(9IS7u?A58tiX6}g zHq72my++7sdkU9V(PszHeeR5hUTrNJUxCh@JwwjweqdMra^&o!bqz+cP5z9~a2zx` zcnfc~*kE4Lk?9H(mmbNH!^FkgHqmSFm8xY4xt&(?iqX6pz}{tepSMqa=sA5lC_<&+ zl(B3OWce&Qyxu#Pa68X3^GcV%Mgc(e4Hu6$87*ZZR@ zfH++n#W5xig8T6{@y2{?fB4bjZ}M;gJ6>K!wls^HFGngVVY$I$kf%-}R%J$gOnZ}7KmCbt#a87o=-*r2PHg4y57qp_wzr@q0){JQ? zavrjL>^HckD)HrYcmfr+e9M7qMOP|}Mm#lms15CJcDxMldwc9eGYNug1IqKDGy>u^ zO#u0t#C=UxGW>F3apijFR+Pz*DGy};!^X*p${y)b$TS^AAHIIGl8Ktt#sSh09k{5g z@~wq-5i=#J4pU_0B7|x-6nO*} zRjDiH!c7~bqDYCLSJTzOwj~wi3n%_r_W+HIlwFpTx;mjNfCee^<%G59C8B^dZK3s< z^WfwWzS_4(Dh|3|tjc6OT`Wh^gY;p1&+K4#n)Pu?DWg=c!=zhtp4v(-!1Rk6~>4Stw>1#cH{GqgitrN;Gc*#8QC}cFP*b6scKk)d2-z%+LIy;r-w+}h= zsrVRFZ!wH1;WsRGc<*RAwyHbFI6cj81Q8jg6A7&zpjle*lr6FRBMlEy{f&!L${Dy%J~l-VG2NlCOEVSDVyE-CS4DFH&>i(M(v-9VdW`< zXEv)3+MFRzT{@rC>bBvG(G`_OgYtViU7<6?FF5J`nrP>c0#mKFCkME9G%ZHbSBOg& zc8xM*rVz-||FPj!)J>XJg%*~iw2l;lCVih~y{RXYs%W=$k>p_vWeK7vuwNpk zw1`U(^ri(gC`#EUa;FU2_Xh{_>|_rY^u}{R&1Hg26uXcUjcRE}acqjW5HI1xA5_hA zcya_0?+@3C8pTeBO_zWN-6f7EL_Q>jKb#-BCZw>!!wl#cV zy)iO?5|0C=W=umMmswVybcJ5cBR$$lj)JsFkOe2nplz6SE0p z^JYT=F|8{P*v6{)D58MwCr|1qAVxe2cB`AgZcmLCW=l>jOr8{-L8nKq%y;qgJ#!z; z6cX(mkC-jJkd}VFH)>Vb1)Hj=5yfsK@G|o6Pir?BLiOsREJB6Bn1!;Aa3|_*o6*r= zM9K?s#K+XgwwbKB#|6qQyafQILFRDL%+pn9z|dEOv;npx|YY)tKb)Ldr;O#@ZGU4#PzUXUK^ zAnMwGV$RYR0=GN^XrbiCf-0#h?v3F@OZnZ9q2*hF58WRkBt=Zd)?P=1-8LE4w|B=7 z1fI^onMeO^@zNgq_dTe-rCG)E4rbr(N<{|V<5TT9q}yfDRea~Pj=;mWUN!pHWZ&HK zE6G%{O@L4a=1Y$fQe0w0t=h%?%kCqq4!r9LVzq|O0%c~3C2@fGtVJL(pCel#ehc)Y zwgU+GP%xp%m2!J#V#IRQdX)A>t35eQ`hBUg-s7uG<;j%#rl4b=S?qW3Q+c(^isva3 z0hUBmknQO(d_HW`_czK9?sA&uB^E2sSB$^{+3k=W+NbwNo%pC!$zs_ev1?VV-L1gC z7MiA7KxKt{?#DSRBBUXrh_cArjuYvrn`ztcRerB$vXotX1I#5=Qq=PdNJuDh=$VL= zs`9&}Y_%$i3h40Cwwe8uSl{cEhOazJUv)U!?Ks<%q?(n1 zgoBRdy_r{0*CAAiEDzw)M!H0p)2O!cJccqB?QWd_Q*U~PtZb#gMBcr}$iVZj)(MvN zbR)gyF;OK@KybvkS6rmn0NjPeV<&vj?W)XsyJRJT_8JxxspwHu=37lkWD;U!wiyyE zX}O`g9|wGkNX~m%-><&&Mm(^j3)CBy2hDd5H7UB0^FG)yNdxAQbrl%A~BS(HAO49PN}h z$Ytz$@=<=WR@-I*OvxbAs{W?H5q*Xvre+;Hv!ndsJ!vn(svY4+;z3&y!*AB#B!pNG zbx}pRzNM9upl0H7<^gt38o!VWr=}}&;nRGZLEi6z> zKA|ATYUJSAcMe2sZarDUnPV3YrA@UR=I};P&@)%A4|WMa$aJK^E3-I8Xr;w;QA|w3 z3l~E6%IufjXL2+A9GSYlqB#4{*d##YvsWNw0MofGDyVAG~_mnA#-x^;XpG zu_1z>hnRvu6fMOQl;A{7dPoN+S3C>fIm(ybG6mnq%76EgTD+ZXjZ#R=E#MBMl3217vI+UG-ML~&rRik-+ zu0!~5_c!=$eItntnSEIH?Vk55Vq#bJMDH2cKI)^0QiZCsrh#4Bz<0)01 z1b(zp8^A#gPT9<~=aol^ZLRRAM4Vf4X4WoEa{=jX3gT_oODuMC8zEXHeM}VxA-ncdp(y?fD%U$Q#dOAmSa}+BHGT*m*<*iW92a`xv}yZ?8>K*?BOVDk*NVha8A5!Su3sd(ju?ZEc|AJ%hE zG6*g!SS;&1_V-6t0{4CmhFR*o1Nyha(*napXBaet;S5a3Xv{!Qv;!h~ONg@`332I& zz(zwJ-Ihm1(;4{%OvGfPR zhw~@iTVP{Y=%HBiu~>&5cpMH30p%Tn{vhl)d=-C$PA>PCIi85#l&>5kLljg~slWaA z6-%5-Z!Bj`tvSxbFVg*F6v+X(;{|0j&G-22nVUv*C|jGJrf0W z&5p1G(AnQ-j#4%z^G2FT0ciEPfh_b`_78=ARL?}q_0Zp}yM&$<6Wy?ARYOAN(y~@) zBja4k6zDWLJtM2m4yD|4st74hvXC8BhmRXi*#zQYA!yj>m+N6BO&XJ!&<+wMsbiB> zx6orYuIBmnxALr$3^S&V^kHQfBS)=G%u#*#aE~PRS7xOjSC0^;#e{50JQg?=F!kDVrWd-#U5G=}S~qc^4e0_V?=$K&>iGse>y6 zwAotbHbYa+mt7Ql&AP8O`XQtwTije*W&1w~nTh zsHgJ*x<^$e4Aehjhvaf}eIg&|RuJT4#dU%T%!$cU(1IyHJ!mn0lIMnZIQjPEwjHJ3 z68U2}$gn#HhGc(1Hym!0@2BZrQW9?H!Bz#FR{!+I)Da7;ghX(M9daYuOi?duj0lBR zn7bu=#C8CMwjo0Q1I}3uS1mk}eIP@7RsPz_$<5XBtD1pE%^fzUy#{}hc9D?>te{?t ztnIT&meOF!YrQPVp>uJa$1!^&>!{W##U%x9JvebaSLSI z+g-0_yl%jBtrL!qf-Prwo677&leH9`7bcCYk|s`iae}&5QsIKszMW|SRSVY0x0o3W z0FaQZueG)LV6E6+=bZ%UR9N4?hRCnrPSOu0uaTER#@-_SWL1_){MW+`n7K+jlg;k= zyf;m)cxUbudkPw6p(3951o^%U%MYFqjtaD9IFKp%{8N}^>0b1WF8(knrC;`J$dwiC zebOEn6>uD9=agZB_2MXP9bn3HEZvS}!wWY8$4X9R4M?FCGN=Ys*HK&~Y4v_G-Ek4% zMaT7v)z(KE&5j^{<(46oF7NsErk(!Pkq~`Zw|Jv`&qzKz-*U_;f;-G&9(zxBx6l&+ z>b2VxmX*G;5hv)xw(Hi*2x3v~&4>f&6YQr1DCgTIZo@Q#4m@AE=gnjr%!@_93&8*m zp{y1K#YTiCeFJ~qWprXOXbu~;=V(&JNP6$oky4x?JTR7&yu6RNblKrl)0M*@qVkzW z*eb79;Knu76nipZnVZ@yXtCHWsIfwTp%=6B(%kPHx2DA#H&m|(&t$cYptyohvq!}s za@_!aAp)!jw%^Tbt0BmWXaT!)0%qa_Smgu7OP`KK6BRsk1Zm8O>t#(#O}d`Os1_${ zDn`y}Us-H-%&m=W%tN6jY}?=0M;18Z=IG801i~C;BauokN%Rj5OBwixqqKL@eADZyunB|=J+(zzloZ9r;(2N#r1Af7#*R3M1;(p^w ztSQeg`~s?~vqZ?S1J7VP928etn=Hvd1cSY$Xd;u404mN1y}1Zj6+0If9^e2I_6N6% zunPt0-`j`}DD|CJsZ+6mJTvt=F(`n{W*Pa@e#`P;sICA~V=4m)4Rsb>XRsVwS!o$GHz8#re4hbQD;y~#r&rQpp)~HNo;!~J^=nlW&bq|mqqxB!n5%H{F3^6HS@oO%U?^I zH-F{QH!-O&!~YVYbMQb`2Y7mLo6?c~$07eCTmNgiK8F0&*fBmsI)Z;G+qxs@hQ2ty z&S**emn7VuPL6+eUuqc4D(OEo0mx#oszie~Kwt_IE2{f!6_2)PDH;?MC_uFD@~4aN zxI`1k7biFe%!iWT!b9?PxO_(_e(H`0{5M(ofBn+`CfWa=IN+a7!T;I#Kj-aV`u_jv z6#xJ06#mhKImZ}`H2cP6S52Pi9B*&k&cBiI;t9+^qePG5&%i=Or=FZAY86zDPxeoP zvOyxx0KfqNfxPWUZ-|^9NY>)~cKlOz-wWWv9Taf|{7$XKw*7J}PbPSauz?h9 zc4sCz*CV_Y6PxS~!6%p(?h=UTtuw=iey*|{yzj1ZEhmt5MCg{WW`oi4n&0$c8US}9 zrdqVMC&sR5$ArMo z7~lysHwu<>BMQtg>bv*lV2(=E`6q8{kf&0k81Cml;9TZRwE87|&q@HDg~+j10bLRx zp1)9&1EYqBPnLFsUyRgC@q@sDUfEf5?v@PO1e;X2Dp8jI%Ng{i6YGw3!=L2*4ra2d zM&S4=r<3bNo)C~ujx6&i?_i$z>mmyLDm|iA^ntwUqV|*Rxg2aOcKu6KY0$)0$tBI= z0(60|Q2faErEP)q9~1$KN8#9%kL2@lEY%QM9Ly-ys@vhD&oUl(EHw)1u}B~w?XDi@6AL8+4i7ZzV1sGd0K2WQYw#O&Foso zjr?WGX}8%RW?w9UpLY4ocP=Qp_VdcKu&2rgf$Ct*Yb}$u2$!Ai@9y^1O{BfR169ZU zHd?X2_lflpxkZCD6fnq^5kvlW!=;m7@>#%PyGF1Sf3AzV7Iw|IRaqjW^+#+%b=>y@ zK{}loq-Oz#CXEx?UGO{GnbvSz+5L)O4t%Rf1P-q2sOkQko(p%b+wdXBJS$}tX{qJ@ zA}&G>Y`4>Vhthy~9CK;LalB~FagM^OIe<5z%G|gK8bEnVK3`)ihe|~$HmI+Sv02|5 zCBfXs-*-8na$dR?Aus&_NgCP(#K;2f1C0xWtT-*FY=c|8tQ2y>^c}#nQ&d1q_v^*O z>${hv7;@N#+#`CDmRJ&)Ns9`Bc}PD;K40<2@-x|NihPL@v3*tX8Z^a{N+bv=i9%$J z>!9HZ|K^yh)v?*tqnIJ%Eq9>Vr+tJ9lwNhCB}Npd=!q4haNnQ3S7wV>>ELdTdnIAs zcOKa7%wI8$^q56%4v3H^yf9VoMj*V+Hb2@-i-}DdJPp+OhY*kE;XLAvfBJ7*wL~se zk>~n8!}OirAUemnH5uLXDz1cmsj}#@p{}SIYqDRW5>VFFtnB(ka4bvKY+=5o#u+|| zK@~`0XJl!+y%wTdFg7*=tU%u{Hch7E^5KO-i@~h zRaOPINp*>OlCGLvbkamTAFv%YKm=+7mf$*{DyQKaw$v^oTQ7oXelP$Gwe$?r&c;>I z)*tu#n99fbE=n}cfVZC3)VgM<^}<8kG+l{BK%9epvst42n*`azJ6(sL;U#u}E+u%s z?zgDk#RyIGb0aQ7rEf@hpd1mA)z2l|_QtXaIFZa3mtdd$HenIGKl27g|5Q8IRD@3L zMpFm$XFm)+!td^17N8%`aoRVxSMg1DtOOx6y&7h0d2)69K^Xj*-W!`k@q=qix%68F zv-Kxp@5Z6R%LbYmZC9V_Z1VlK`mN2EYYV-@Qr>tPN&^iw1*S!Wj5vJT zzTUG?gEbLua(VocjL(I{MKLx-BXn#*{7l0d5AHxrSkHHZj4dAaJU~(>8xSgE^hb6EJkh<0g)gNZAFHIW2{TF) zS<0gkCFDkkY|WyR7si4!2cG#e>t}y1k(b?)pGICDVkwx_gXr0k17y_?NsmXl@6?Pg zP8b0@eR0vygM=`!E&r$Kx1{ zsL@lkIj%jL1@7m|0`(5StYH`VE#?6@seLdSdX=096!x-kFABSdkSjF3>8y~ z%;_hjF6UO=Wd11X-5{nIjuNUu;pv@?;&?GyzeXP>{xK&)7Pi|<%IYSiYC}0Z<66e> z(Eyq10k(Al0c?Mb>4CGZ8vUwUZeM6OLd@7qr4y5vK6a&@{CnO>Q9e-H%zi9$Tig$~ z@m{3R3Ejl&&ul}FquF!NAt(a$TW_&J zdmue81eJZRIrXt(woYwAdC8>TQaLQ7rmA{eUykdUPx zFxixo5A^5N5O&9aU$lV_O})a*19xkz_r2Xrw36%I4oztW>w6e;KZnvRuMGzgud^tR zx!PSfQ5lXbs_)KA)JuSra0jZs7ZDXx<%63-f?4%Qx4K@D;I1!D)0l6T+R)t|?1l z&{0)ep(C*4YPDqoqTi0!mJ5|x{B6bH|%d!wjyRd#=rWjRa| zbCYH-UjO*Fs1RBGAE?kl(Ik2svi%$KWoA^51kdjxrxR*B{oQXg-kh+U^FvN9C(Edp+SCB;uD$kMb94ght6m z2Xo8{wlzTWhX&ioU&@42jmB}jbKt4OjDpPcC%<3nV&2ljK*Cd=3oKo>0~C=^l;1=I zaXN2Lt}DL%n6KT-ZSz|zrFa;8AQ~HsGMeG)3Hw#H%4M4=zw`Xu4`t^%nkf01 zX(e9jA_!xMi4v8A+>5xwZ1{N8sje{t@Zw&1bu6Gl2Ew_)_`c5l-)o9u%#CBDX86ZnJEv}_o^q>m5eivesO^$1~&-nh^ty8y;0@Ilz%N6bLc}tcOS(`q`GD)qQLbEy%{j1*;$Lq<%2^N*8?}6SXjk` z4P=`B#nn0*knX1l$+%EJi0T=RcONxc!z#v&6 zj7Ck~?JVWgbiFA}kvXjQkd}z~rAvO-Pre7r({t$QC2gYi*i7|0i86V>=l=P+ttSNS z5t5m~-BUcZqIBkifD$l-y(D2Nc&aO06$C6Iz)!7sq;r=t^4(P+J&LrjAaqZI{r1QDhFQ(-L99sAVdCt}%F-6&WPc?&`M zd7ik;!J=hv?*kz%82%?E{|Of{VE!2{X8#ws=<|OM7l*~we6w^qz2G)`G%EtLYp@Ng zS_V|sj@gNr=-?S$*A8!BGNMxzI<|`HdL7hZe2o}>P8&dmMTV#nV>7*skyWxN?o|aQ zf85OoJex}va$c5CTV#(bDlwp>fii=#Ki!5x)<(^=M0mM4pB7~5^~0U>uV)6 z97mkjB&sybq@z=kXCM+=^VhOT^V9bPqoT5&IvGDoxn`-vEi2}$n4JQh>^{Fm-x{CG zn#uzf2@dw_`I$fMy0y(IWuVwOo)&4pzsAR4z6Pn#Qb9*8TA>rV)eMBe>K;LzA(?+Y zPTG83`x_E|#$Yjm+)L4hvbBp45-3DJwXaVALKy`@M;nkqfpuF|Tz7+}jK|M8+NS zaqYSMTlvVdv65XHelFGjd8Ky>8`AZ z4{JoZX>R@z1uR`O_?UnE($pR3N{s(eZV_%i$X%>3pUr&YnC!je!H;=Q3wI8E|IHSI==hxq3VKNjOf zx`#E8Fs6tBF>4g_Rrj`NyP+B18uF3VMQ&Ot*sh4+J(GR=Fchg%N19y^+H7aP0@y&V6s=dD8B!=??s z-|TL9rf$Jp&}KyXWUdUP)zaJhdg{Z1O7rQwV+}`{Jc|t$^9PUfY4G)0pv?59Rt*ZnJtWEM8cJ4J8L@I89=% zWZmgLla0+`5A&*?;Oe&`*#`|?%61vf0~fC+=&MS0ax6vPkjAy;qJYQZ)&N>Oc5IVKb9YDUHxC@I~>eFk-WD2zsGt;4_ z_tA^>&|%$%3;rq6^*aveGz@68zBF=lqG}X{6}l*jwA-tj;O`nk{3dfAf_0Xi@pHVH z3QJr^Nu^Kod>FF9XZODxxoAfRNvt9xWPXtYIf4UrKk^r zj1~V+6xDaB6woEcV6*^QV?_VC`g(OA!sj)K{ELb2zPoKEqKPd>!3Kq6to_BF+fj^3 zH^YaJ4PDY&Q)}9zou}fvZW}p#q?*K7mneL;pIH<>i@>Ad=p52c8@K1Okl|X(ms9=l z)Qe>54O#b7=t#8Zd9=#1g1&&~^kkWljFG{t@fOil54TA`%cp3iFOAr>en=9F)IeR? z&#zC~HD8V+$o`{X19%DmAJ{|vWnNjv^eb_J_C*I?EU(d+NIE7l(FP0H@;Hm?naz>v z*1lv!%oc41uid(1?gy~M`)g*R^0Rtfjc^8vRT!iLRhXqqawI*AP(7w82;_;mDDZxH z4Hh4sJptVatO9Ns-O$V#mlN}Gf7cC&$&#WZhO>CW;VG4a%cn}1^-WcXN8n9F0hN9j zd|$r$Ne9Y5)Tv(bHw9kTQzRNXE)#0np0YM$M*_g#>=c~vi=9$BvJ7xkq|6EluWFAz z+m_#z?_inI7e7HglR*TBp8FBPg5X~gKb$ODZv?)l?`8YbA4A?0S2Q5OMKltn2<9c| zqFaB=#MY_l9Gia-Q8&*~ix;Bdrx>0SLg>SGBUgz;-WM1fLFsB0p-7LKSsvF<2yH8; zk;_A!R_T4WU98d|?u2|deEEJ#y{#Tiw5rt7qi=TotE=;JYl!!n718WFB2cu(+8% z=N%{Sa(kya(V3&OO(Td%VeLU_!~6p$1v|^9 zd|mp7p40TgCm9d0i?MZRDiNGFr9<-Vfh+c8pxJ!TSNKuI26Gu;lAFG`$zhH;T}RqS zq4@pNavvz0$E_Qt-Eq#suz6Crk;RxsfFYp7%^QLfmu3G9+G6A+E9BhI>wu+VR~ipY zkr(8DQ-ECPf#ID@;c__J+x2!5Me?f6Km08V zF=Ke5$%H$HQFT3s*~8ASC&w}w{2GviL_RsX98$m6M~<_ilYnK8N-!nWzgnE1aG-DhR}`927rql9E!B z6!d2X5(70im665$Nt&2YBxI;oI>i~0cu8#a5~;+jjuM7#^1a^q9fc%=XEOfzs#-ki}gXWm~7xHRgAi9i!LHHQB>nXL|z3vPDc7E%dImC zzUabhX{NEa#Ly18H%g#1B&w&bPC>O6DOml2Bgr!A-jlY&Dx-alHbkOwIedxO@(-a4 zfg6;oi?cj=X=E$0((6CyNgp^GFl2R6sx)_`3Bq2k%RRkeT5EktnA;0PkT&nw@{wb(k(wHD?1qv>sv6#eGj$rl znMh4BN$z>m_gi_N;JlWZlb8@Y5_}_Xm$CX=B8cqrXA$KzqgS1%CVaifL%I$rWv5Jm zC3_3xYM+3-Rdc7gpet&+fbB|Z{))tvbFKati_SZbC(J4#Vf-7OpYg8dl)nxT_B)oW zh^IE+ajjC+X6~6&{g4g``Pq6SeXKA;KA&u1UmU=|E8bxOvoi^tRZsjvmL27#BSIK~ zI&^iSnc?3;iZNO0V!#=E27ZHCikNU*m7g-^Ul1sEWuD?>+VCD0_2J?=i6%k+s7MiQ zaQ?Vbvm~9!nF>M>segLxsDHhGz%TD*cYgTG_A zWr{nMmzxXrIXXA*zl5>EDSgE&kxuL4NRYBQy1Gn1#@g*R+1l+J^tJ6nDBsRFN6Gb) zHgy-L@8<351L0S9ZY@ciUj0lE5vNXUM$62ta9Cr_K>ibXi1=&9qi|Z2>8DzvrpUJr zlZO#>V|X4B-R20gr>Rm3ltZy)<<=HYNlkKxLM%e(<4kcXYg{!pu;loLe-g$ehAY*C zT7p*4u^zLh)TLKO(IQMYs{2EFr=h^tVrz<3ZE%<6!-JK~I}DsWu)llAq$iIe`|my1 zM9ox2B4o7!4~Ku7hN)Jrk1k6t?KbN)ltCY1Q!cZ(^`mbFvZY(r&u<-KkP7>c@zvN@Vf0yewc)E7cSeg+r6YFakZza$aMG|Ak|2npDUCwo5=x>VJc(70a;) z44UbS?{Pf*)&v|Xstvk(@GgGD3>;2vBvP=L{7zhImRR2rtslt!xE4`s+Zi;_(3nS~ zfFRRn!xGQwbXlixf2}3nd`5GW_nNa3U`9vhNacW7t}vgM9j?z``fn- zNC^7HKnwGt+his14If&OeEGvODA|9bq0aCj6X|H)3m4dyg)tq_@l}AR^g2%)VhTQ zc)^;kdmZ1zNX36nkCB6?_Y}OxbChHj)-lyH2I-t0o0MJrO)lUXPb}|Fab_r3(sO+T z;1nn%GOOdMk*N&D%5~>KAfm045bzW%_WLuFQC7RNVArot_D?_lffFiv6y9&1qZOd9 zzc~GM1;tffOIu&!>6cEaH@6J5!<{!6FPa!0#m=|(Xq9MIDM;iTC*Zb2srD!P@;F03 zgwx{{5i&B#$ND~aM{?AMtAtsKSPPFr5Uj?BN)6BS51k~|BfVzyi7UOpa*>{tr1f7= zTcV>EujaWn5^Kfs)2BrI7>X=IqcibnoGVF+tZ&zUvBXo*bR=z^?5 zQ%^6<8ci&Hq!z_H`Vj5MR&;@$gr#H<>;Q@TG>xaG@TZ4M=DcK(bmi!t4B z$xsl|NZ$|;(V&?4gLc*OyUv@6MMeBSYyy@|xvGu270*|MI4%1&FT!R5LU?JF&=vyidPsdk1c&CK-Kza(XP#a#E)JQ+gH%7!u;`P0TR;Wy8sa83L4h&CFFD(UXUofGpRbNBA!?DMBR~LTgGyVh=o6%VZOwMJ$i`@nt zQv_Jh2~GLy4Sc!Q!N+4?(QI5x_5zlT$J2(y6pM}L^Hfo=sOd35uf~ezh7E>;D z@ZE<}LF}Xa#48mtn3>HvDPB+h@@hOeWdnQ31+}C5NLhhrDaFv<&qSfwQptQ{ zYAwoXG_g?uR$jUK)5HTX>W@sf_?7c^$;7u7J7{WB;wrCn|8-bOpS_?>MJJ#7dC$UD1iF$=S8uvOr0+ z!z6B~29^6A2X%-$R!?u^RBVR)`{Ie#sOMR+C5%#o7_*$E*{aw@W>&y+*QKfZ75@_F zh9F)4UYwVk_x2`|2~aQZtdjHjzo1eq=bu^H3Qc#JaiVwge)1$HjS)Kw;zeXTP0&7S zQba*vT{~I`Zef_u+f{9+-InY5W7#7S5btch^*7Wq1!vpw2-;v!4M@L!C(=zPY&qAm zf9m5CX(A($)Sl+NIyOb}io4Tkn#c@xu-_obxfDqMc{NQ1)Bv6jPeUW-g9HbQ$#_R) zqN5x3H+T2g5LxyG?sYgz=!pRV5=$ zRdp^@P=3kd?4OYYbf>9aux1A)Us6ziFB6(Boj7^-G!GMWFPml)7)=&E;rM#e6XoI= zC#jz))wUqyJ1_5Dn!e+}x{^xfwvf_vlYmOz58h1^=9$Esg)ldtAFik+W+TJ6?$JDZ zccjnSAPiPhCU9=ui$2ATqW%Llu-Bt{MrXrsn#!G7*LNPHit%MUEKJ6jh zQi||$SsBDif+5r=up)Rz_*RNDOe# z9MjsIx1M9pUEjr2S+Tu$h1wt@7KzLrDiNpOTk)uC{ViUr!Y@=1X*q8ua<2HlI;QN0 zo&p{hiN=(!%Cd9|kAOUWus-UZN$KPKJX#+l^4r(JkW(kMI0%X|AFE(&Z^rAY1+?Wx z0+w634h1z9R{=$fRoHN>Y7%3ME%n~c1MzZKL9k@N`84{s(9{ItS__ z9f7@Tt&@~mgRBRt;s;@#gY0un;%q?(1=JNi68~NuVUDpm4 zf<@Cy6{DK-x_gH$!~_h7e-HBNvx6_}SlIiK1;yF)>hyKpSa7h4OjgFSOS)Y*6rGL& zXo@6gbH!$Rf=ET+?RRE*;CJ)Gg3CZrI|GE{x&vlTyNc;^dF@{BcB_yzm`-h!pJ7lK zd7Nsheqx+Ts+{~V?#{37$5G4<*3VYo1tMJe$%8o7LHx z!n=_|$q;L8F3Cp%x_aw)qfqQCv=&qwY8fy)j*IM_y;CP>Ou0qLVC)uuX8Jb`z@k z&>e0l(yW#P$8GFphHSgtEZEmPho+@_yLfycZusn^JKNb+(064SS>n;2+(B-fqyPhx z?U)Ko@f@TQoccZRay17iz08k|Fl!-$FZ8VYP=Y3uc7&&68#W28AZx#Y&cOUu|TU=+;8!k}q|@k5Zr`;I%S zmiAs!D}C{Xp{oZw9^Nu*HR*U=lC>Fzf<$*P+nmc~|hNGqhL#zR2YwfKA_+vM1 z{+gJ@O@(PbuFWt7;J?Dty@ki|1;^HAMP25(f*HTaLRWQ*gp>IG7C;kwZeTtAP?Ehm z$r=_$)oBp@KVqTI?*GJs?~bMqgpIfyCu@rn{h}ns0-(0!xzH2Zu7_tfilDmcZ*o#J z9&XdOQugCD%51c>!QbLu*0&g}-!+56Rc2HMk#FGiY-(7h5FRuEg%M&k9=WwdZ4+pH zudQVQhiy8j>uI!IJMda+j0CqqKkl)|c6o<=B@HN+C4W8&3aDs|Xw>3*SMkHS!JLrM zh#*>nEjmrA4`DmrcV)*KvulZSquokTk_~4$DCh<~rTT%|_U$b7WEgjl*rOt=@Q<~@ z^f_7GvHiBfsO0FQYIp(Xu$E<;Vy<=1K|2b_LgEx%zt5LB7jr86?22#-Nz zbYU(wNXgzi(v{zi|;e@n>tY=GVdiAYlI6uqc z!1-A8v&UjW;kU+ZU^iIy#uahRz9R&Bt_QG^xgng{?^``5Y(Ouk+N`e<{c`w48v&){ zNop>488ZvML`wq-urtSE+dRsJLMSZJy+vlJzJtTt#S1mgJ6cTTN|9nLC8t}4d=d~% zP8;C<_Rgelp3!LbcVKdU3EgHrmv3i6s2=R{stY9kX4I!Oa-@^UdZs8Bcbt;_9QE$m z4mAFGjQYBG{!4C@AL?VSy|C7X6WRnKqE)%t!f}z6bmyg9AZc8DjKv9j6Da;oo>=hX z88>zcME)Y)a5|}Dq$mn{Ib7mWBtK`0q(@k&s8F~B$>Wbk?i7xoSJ6vJ0^9|d6x=JC}_mR8L2R}mTc>iGaX#D38#LPX_CWU(sjU}*Q**kHK?!om za4krRv?mGl+|>YR!g<%bJ=!_M=BKCu(X!XWXx@vbqAM$umq`x>LUeEt)~%sjX&R8u z`REpcLBE4CDjp`q;-=zt^wl0m_0cl=Qz}f#JPF=#?jRKy#4W?w*5u(h4D+q~+FUE= z{Ips{_w^g+>fx`)Kqn-)W#Nw%_gcS=^<0t?hNY}+FI2zeyOdUio8HF7zkv-aSo0pV zN!wF(`zo6OmktJEdC{MWBed7#(H_2Z@1;j!V3M+FlFSNXwlGoZSvY499VK4#q7?PplPw%0XloQytxyQueU9UM)Hn=7%@4FWyD%*iUi5K7Vlz zr?eGOV{y@br+cv4k^bnxGJb%l)SqeFMLtk|_FV46nWb;P^a9L`k0;|sWDOrRI&5g< z^;#khFX^XC@sAG~vE04nQ*n`sm1DgK*oJ_i(!)P7=^_jNg$FSX%*zc-e4fx024T+M z4Bi@$e|^bw=4U)tkegfv4n4}fL`e869{ctjV@)GVA0y5J^U~N*vn(4RRpo{>-HQIi z`SzWn0vt+CK?!8!f#vh^EXsV!xR^zf{k0VNHk^WDEBwyr)xQ^hR-`B?=cr#W{c8Jb z^Rzzf?YxHoFRQ@^eqW|O)u=Qj}P4nlae^)*+mTNpoe@|&e9Otu&CS3<~n^`F{m8rQfWo53kn|o?$xK@hhxRCpTKuyzPSyV2hrc|bm zxu9SYE>P2AipnIpAR^_O0umyqAn^U6nR#ZObKdWLzwbNmIqx~&aE_%NxX zegCdM8OPimzh1Us83+XW+Ue*aFA!+49QfJt)tA6Kh5UCbfPWUndpRBeRd;Th0Dk!* ze81a%5U3WreBrbf@cYtpM`7_G(5eLW&!WLFa0&?Ibl&OE{^Kb@0uHLi432`NDQl0O zNzd?{*%183bNk@^`$sZ2>YPwMI5G)x)^fIYTC;ZVq{Lt*cW~p^aXF8+TF?2cm;C&d z;n_9u#bwoyO`g`&QEHb+V>zE1p*mo6LmnKOJ34Np!>(#96+Eo z&Ma-v`2!}v!jBpMZLrUj31%8U`30Gi#1_1-XOm)yIOT zm0Jub73spdGHR^;c%OR_~^5=_{?9` zLLSnscqe_TpJtflTg%{v^NGcLrfnNFK@Se@DF|5u z=*hGdy~dlyY`%Wv_Ib(J`b%n!58)6!wUq&}t6{qWrwTwdF&g0q*3#S7THQX(9HlM= z@s6;{lCx10JKG#8ty+u$qm(5N-GKTI99nl{^CDiyj%8}|WLR)3LtvDlZN#$;16GSp zaWuj&ZO_e7&sa)Ftp@enAbJRm)Jeom&yzQSUtey-s8_M!@Z#Tss-DpeC*KCD+z6P(Q(8hdme&ma%SxJ6T>Ij8CBqFH(n&Y} zZV*8Dy2t-!x8`EL3(iw|y4m{3Y3nwJ=GBM=%_`O`{as0hbHaR>zSyRbD{Qnr)IoR1Q)BH)dN+Hl0z)g>*JGQNEtJNd!I(`{j(S8FU(ey{uVRVNA`8tzAGE`(O$E{T|Kv~FZrv$ytMWvjZmHS!2^E;MZ@{~>#rVKLxO(U`u z-RsxNPT#YRso%|B70w|)y40rp=5))_mvk}x=(JUpv! zJW}iuyKP+0UfMTVTosX=KE9axWh9o6yi zU}vR#<=JIFnyzN#Wmfs3E~6h1F{h9uI`_=Y#K*x`-p*yJ+>a#9ckuQ^QkR4<)0B53 z3R(~^b)O_3LxIf=7>=AHfn1RNt%~BxeAl=#K;YSlZMI0^3vcK z7aw0~!GT?~hFj+6<1bYNPVSNWcz4~j-@{3MzvR~#JBKk&za(t!Grifv7Z6-s9x<`R zXe<)Z($vdGSd?{M5Dc6dO#HF5yS36+{y|b#cvEmW6-?W)Tjd9N>L!Wm2-z0ImfAI* zN^CLCcKRc+Jm;fQcJra!5d>Cd){ruOA#9I#>b(awgt%t(24J5IO7d)$Qe zWY*?IB8hN2K#c~s;wx4J<~@RkuTOI3fxN%um$g}AT?HKn9MDPVGevLnl(HB5?Cr-2 z7jE6>BY;pGi;7=I?XP@j2dh4E>D)qQ4E63SBH*E&VA_*!F2mSA2&fZSy{eF?cv1`n z?qMsp!}&~b2c}YcBMvHTGHExr#IGGHheK)YOXG2h!{mu)eeTtavoKp^^Mw<~)IRz- z?%SN=^W43uMxC7=?OAPUYZl(lG_)g3ly2Dyb0FE>i}p+H%nN#bXNazR_i_*8q|^(J z37wI>mbN##Z(L_4FYZO9r;0N>-q>LoG@t7+-jPuSy;iwak&5$@`#@fNVJzQR?vmQz zY80PDZ5=DIix?ESB=5N!=BpgU5}X}LRG_Ju?5x5-@t%5ScIfbRn4rwv>2#mf24L(^J2t%)|+>h zQ*KV&yGF=T^uns5>?juZsMr=H5sw=9sx$U@*P4>nhr73*Dgf%>^ZOtU)1`08Y0l*jen+TGE0`WuPu5p9fF_o&_bg3dJdIXH|%k=hlzy=i8JsT$70+O%?sKKvi8$ zpIqqZDpaC>LyY&--Uq7H&T|({iw_rq{^GvZoV*))$C91{t{VFOvX|61WvNb$ z9gyMm4zX}KhgnyCuf{X(O`>si0r%W`>i2SF`gXJ+@!v{c&PU?0SAVaN6Z-JrhD@T) z@74JCDscPo|4)$NP{RsP_E8p4_sx!%(L@S==lnNB>-iHHCO;5#Y#o5ePWp=;Z0Z95 z5%9k@2LQ-~8#cj~fGUfCDs2oPM*!UcSdQMh8Gt4_ph|N%7(h*=RfCm_Kt3M8U;xkk zr{GXP#7tKxOOBpqYoiiP)&8{BBtZqrFUUT(m zYDS2|EGg)6PM>b>1HNwddTapfo7>85Hw6JE-`t*F)sj9H-n_!J7Gidg1u@=XKp}p& zS>d*cP4W6}^Qhs?`2j|np3j-!lb4CX$IjTr!S^4M73{5#FWGmf&1I9Af|u;9d`YcY z0jJ%6nKIJ$)72TP*r;*m3spo^!^Odn;flgClEt@ojHrYHG%xI z;Qu*0EPF6IDK0vxANOW;1#PZnK~Z7^c-qW;KBiuF-3UzF@f(9+K_A3-wTnl3eSO1) z!ac?M!dsJf#SR6{s#6+&eAIMLoX@SCeZfU{FiEp6)_?O(+DaIFQLvQK^Muq<0C?it z>z48z#~^c878I&!EP-$n_F-Q&@8)W?-+KjhdP=pk{^n%7Tkz#`n_+(ufTgG8@5H=` z&SS*D%AuLj~QEv`dZ>5}S$ zT*|O9`ddhqIJ z3y&wQu@PXB3FdfV?P#q0ac`jrIS;3Pz)rUCQx77kqS4Ww!#z7R5hnCoHxiQOD}FN~HNtW%te^b?2MurI9KTYvNIlHqH2wq>CpaCtTBFc9poH)Jc`E>E~$ z*|Hp3f6$eZ9e&2>O-HYthkVI?-0g|%s>7IS*N{tqGAFE_KB z_i3_3T6XD6kAUmYpsBK4#an9Pdyxl0`RSKk(KFwliVvD_)1(2|@Gh-|PnOkf?$|R_ zm=Y|$JegQE9|vAHW-c$@OXBuwG8-)tcE7-N-6xURV8%8ZKjtuShIY6bYTI|xu`+8S zinVe*Pc)Liy&&kQ7T*gbT?f)p<`ZN2FdW%G^LF{*;D`LenkSZSoy`2fe8`t+amT{= zKiqDYxgiJnD{1eO7zOH-c*~*0WZcod+NNwbDxs8mqAwgkoy;&dT+ruDNOX^{ckmz5 zx%UK2Lw%P8UYxBsy;YqZWr6g?oX|!h6l0Xnj~$MH_MW9s#yKz+x1oyUv4<=lYWiKL z-Ny2~{q&}q#MjzUXQ&ew?Kku-Sz;OKsQ>jDv~}XPqV zFRMG=A|Kwx5-*P5`xwRS!Srim-x8C%b~hdc9Q&g$3yi#A6#Q;XS)NDWgP&riV-vGc zEWxhPbkdt~=O!ZbuBHqT$L85q$FCqZAqxzfEJg*yYCb(w6C~Uxm5D6O8Ocw~Bh67f z*4&%S@qsELbazN$Y^!=RigFZE_pTLfxfcqXFFqj!vbe4!i!68`3&(Ktb(b(OX5IXxw*{Fm{sh~#X6o|YYxHO+%Y>kY#(TUdg~T-!a-EVc0saustg z_s(wy9|d9;JqWY?k)NV{$CMXh8&=pZcISxJai;_tywSyoLi?iA$!Oa)<*8L_^l%iq z(*{YqT^`OVSjFwEyJG-exj7YJ>e z_=s&8qncX{enY(}__x`WE#=`passVZHb9Okr>c5X0Sex?*uV-l1~bSF@AY4a)|f(Q zLspDhcNYdz(h?rV4l^3TqMCBD5G_%8aumVP9lcF4!GW}TN^kmY_1;|cks{`YS}JU@ zY;TTeO#C=_;jKvwBHng(!_B`{q)?QYy4(TAnfp1U0u`=;OFGK%4N2s9o*D19#zz}F zJFL>18-|~jy)#-TAS^Ms##MVSck3iD^sn701tFl+(J6_Tz%j z8~+E;Bn~=h$txHRsAvQ|?Q_g=j&3iRczGt92_uJd#-$?yxVmz#oPvCGF8f=>{Rh$g zgW3OeNJ;RL9zF!TLX(M^C2h(HL^>wvlKPE9q4W0^9@8Q|pN$rQ&P)D_l)^9WZAzs= zUa{Qb>HP*ik^UI3oGI%#4g#GrfG&K{skjcIKAn2!8<=>)GBFi6Xpx&n&AU%u(f6^R zr7)^|*MLBGxjDW;F#Xh#+ug+ml3ykjLJa2fSSzaNMtAd6B4P69)$YH}Nja5opvrfB$J6TPI&#KRM^hjl*%qECDS0k}Q$?~$EKv^CmJ7ohh~2?cMMe#=^9^1bGqOdlyY-hXH$0Q&@nYQl{RT-~y9imQOYo z<|yJB_T-@FGv!|ZDloczgPUQ}*(na&Rd6I6u6lUgqCcRuAf};Qvy*o^$I4bJDrmBb z?qsUCFziPw8&f%cVZ_LauEbGiN;I2Cw;sReo&50%;Dm)rA;k$0(;rEwnnH5rJ*Kj$ zWLl$ImTUYhCmDf$+aYQJ2Xj(}Z*-J9N;WF3Oh2 zcwIqvR|K6&=k_KqL>69sgN>WG^sC4acq9*sGoRTG77;^DB2*f+p^Qny`}|OK)}|5DA5pg38;I!Gi8MvRVb_KgN;m`wlUxs8ct|O;EzDJnRFXO$ z`_4JcQar}Fs{yN&r11Q?ehL{umBuMlN3oT6V|OZxrj+q`Yu)E>aOZAJMtC6euU_5s zbJM~ogg}*4A$AKp{eigyyB!^-Z%?uq=p<<^aOKiyE$s`baI~NFObkaa3bK}`L>Q?LpAF`Wo^%z{(e@7Yqx*o4u81LTEvdNn}8%dK!O7uzxcB)fd zJmB_IGOLqQ02BKDJ@Uiy;FFja2W=WvPY9^0JiimTfH)_~d2PG<7ILcf*Y~5^9QHk^ zZkleJ{9Y&ZXrfBarKPdigFYTEDs#EGXtqgqa35e+!IRz|<|5-PqRz2j5EwbT8@%uw z{4V^Hhr|5HWT&mLlB!Y&5$FzfWU#znMsxwS0U348c2uyK7c|?@&@y$`ihU zCpbd%Yz1vna1bmzW@!W}0m$2B(!p6OxnZ_h7^t7rce;CbZ-966xV^BPj*;Oz%TVS< zpwVOMVV5B3r^UEfX5NA>ZSIwX3l`sP;kT*Yef2C2;8vH_14%>1PVssUmGemz#aM?1 zr5p&>ckPSzwPvHv|HJ_Tue-<|Ir$T2D8tAHm=DFH(PZ6(m@&}(P{0x&f@U7-c56X9 zKa~ZfO_X#rgR)&&+QtKb2RFi|w;*SyqNlVzk8}XMHp)ac!A`AioN5>g0y&ogE1ufO zoqL^2#LRuT;%hZ;8&-Q}7a!XR2j4$e-UpSv#SWUu zjqvGliQ*0`t3Ut3he~U)95XpEK@4Ry_m2rI*2;&mP&A2OrV8No_#^(*$BP9W&Gz0y zSI&>)gB8;_TGSt!YQiSdva=5m27T8c?zAmHE;0tn$FZjg>r@f~MgdUU&wc=IJ}&{P zUUpG0SU~0m6($d+CccI8YhFAyt$zBDqJ6##V7r%`Yc<3HW0ySQFIjP(sPltso5M2@ z@Wu=E8~Ymhm@!LyMCsyVHgNDM&_lke2chtJk}Mnq@=6IH|I6>%l;1jT@(hgc*bNj5 zXW*`N#WOju|C7HR)HwnC{Rm5Y{dqcs)|B?~AlT1dDZ&z@LN3=;>wbcICO(@?NE^51 z!ca0MzIy8E@Xg-^|EC=Qz%A*2yak0sl@Ff5{A% zs8e$W=trnf54j8M=3`*IDd3Pb+X0(h6C7cA(4FXRw3&i2IZ$o)&O&C;3SKZ_9NSXD zwx$rd=%_U147~+ZsRQiVs|GW9ZxAwC(uJcY#21O~r3__wFHgxYn!-z;#tMjd1EiD{ z?qO$P7!3yT_OrB4)>_cf*^=XP%sB6Pk8rlysbd^0der;YBFfFmD|k zYVT{e$IXRN&^gsoHxROD?_MA<*GA$L3FU6vUz1je$J&&Y^q4Nl)%Tv&AeqKA6UBv$ZN3XxWr5|!3jFSTi}2$Ytgo?XSPy(=Xw1yur0 zU2}$aOv(ZnU5xh z4?{EN!-1=m`bFnHrCNPyyl?yXMDS9txWlO2lmR{^gkr3|3fv* z1EpNa1BS21e3t4n3DbB>O#_vtLSiO}c>nLeRlg=IY`bAB6%L>7xH9gHnUa?rV`fuZ z7~C|?x#-sPrEa>ydS}hcKAL1$9{N55_2DL?IWROH^G32{BKb^Iva^~sSx5OP!0U`{ zykUxQM(=mNUzYG+_KmmU)wIgUHT()lEp$Y7Va9exy={q_g1H{B-@>G}kh01y`(@-U z(~Dk7XZZ1>9%_yz?v=-7Tpu`2u}@aGo?Ymr=5r2Le}~KN>kL?G;5@YZP0oH3+Z|HM zw2_+dp$r+laN+Av(BCQCGX?G@YI10^?=2VSsPO79bPPosM%wOY7p|8F%x9_DqX1FX z2Se$V0O&2W(d(o#HPaMw+w_g0VZEjAPgm}wd>scr*5;mxs$OUXsHg+gbFH6N$q!b8 zkJ46$GdV8n^DU# zQBy)EN0!AoWeD1H-aptHbTL3Lo47gzZ;DZKMz>7SJDXlAZ}GIdgfIK1veo>OS)3N- z(aWSU=TFC05%yQFaAsxHGIF450_x3Ls9w;Sf6V@m+5ZD?XW)E~8|lX#O+1>F)yck_ zG)S}mG|La^G5rsNz<7r*e)i=JJlmsEIRqBZ;VxB2?ip>8Ql^W!h1J$+y&rr07jJqY9lIvT0D3 zRU*w+ZMuv8Qq_m~jZ1cK|AZ^dT^1Y~_vy&Rd`h+va;b;q)2d8pOkLB=Kvk+$^5wa6 z-|ES4c@mPRhz~_AaDxKkvn0qJ_1XvTjK$@1Q3{;V)W$#`@uNv-y7XE4a5yJk+}>Cj zJ-)FKf>S5xq8u4;o=uD~tmfc-qy-a#5r=OAq|+G79l?bi+^JT@y%hif zR;)X;4~ErEiF#ia&}O-#k20S>9)bDptniEBi^qiR0*uK~dK9;l|6RdFTPb8k@sg0J zmf+Av-J|Lvh-iI<@q*6I458j{kcrrzVI@~9b7XNHua#Sp(mZ9vmAhlp7&V7==_}yv2LiwM=DOMWG<$# zZ2pID#4l$=sV!~F+!h-WG*8Qh9=Zt37z&Jd*tlB}12nZ>JX&9HBeBIM&jKg7Tx;Or zKC9n1$hTpz_UpO<)w}923k+d1OR+(H(wp7v}54`jIfK_8I z`Q7+QM1KT61047(X*5dpj)Zb7Hui4?#E#u{g7DIKWFG@wJ8T+_et%OKFbqJtYyd6h&_`&-CG?P z(=YRozu(~}b+`HK;OHDht!~`(tH>#Q{(PJAg4_t~TPB2Kw0jv?bVkyaVcIEnaio-I zc2Zgvc%6%0sH3O6#)t5T0VJBCn>E*LnzD+(?^Rm5w zcbSQ;TI#fJZz>lQK1dajSG?!zmlq1!lwtXad1gF&3;A`lrTe`c%$cbb=@jnktVRdS zWS*ify2{mzRv4y7U!zn*!y0^q#b^Xtk4*hJoKG}>W3n~wLfeI#-gT+bLg;V7^OWM8 z)Tp#qwF@_~YZN)eUwCO(Ug`K8>_(t3=TSz#(KSdzc--HlyXeQ;kI$e&p{bxShLrbmBC zus0`N9Kl}%JS?6;cGH|D*zJMR;Y^gAj}$LD zMIY92-N@+C`9d%{lG}VzvnFNO@o9XTbGEWpo};kQtf@#ZXUd*&4Pclt@#TyjFN5G$ z)(#l&_eSW52Ylc=&JKuu`+n8GoXN z59!J|Lf^piiwMkbakuj|L%OhvJfB$xTF{it+#Tw*aHwIF5av23Ael*O_$@{+T6M+y z`oUjKi#z+j57D;06#xUX7x6-ik|$Tz&m|#n>f+j2YQojtIXYcf%j1)1#~L}rb%lr{ zf3DyAHRP>R_>d#B-p;{3X(1StKl&;?t5?|=2E}y<+pxkOgd>ZfIacuQEVoc8bJ^jF z4+_WO{xvdyFvido!logjX9glpB}cS#w@>(wap%sRJKg{t z>BSD3idSWIoU9lMQ&Zo){Hd>n)5I7hrduE3z!2z> zF$+1WT$DchFXzCD&X1X>DKpe8w~Fijmm^`1Avj&E@)yXtsyf+Za!eKa)04=G0x)XC zkD~+|QNL>(L;;;uK(6Q=NEBIj+jA8@flr0X=j6x8pj6rZX4LE@Oi>^s(N%+pvmOoJ zmN`y-UygkgG?bJ~_SWfao}vH;$9MZp<>clMs>-Roa@FH08NT;KvH`hFHct=cOEcNf zhN($Duh0Eor|6*6e0t(*7nHOh-NyB=3Y#ERii*c5ND55Ca0L4|k3VdVOtvL={;6i_ zL}UdLEyPq!QAC#~i?Z-A4yvEDa#GOPnYus8zITTvRNU{RIZlGhuRLd7zsh8SRTWOMK=EBlzj1y@q#~bVD~)R@Gr+@UM{0hgh80} z@RAyZnuE6No-J3LKUt(2wW??YdZP)i1k|nSgMD9wm+GkfR>`;IMw&fBy_@fqKTREp zp?=`SK+Yk3{`W_0+Ti%`cvY{!KqKqqw!qo-Wb$BO;XyWkW|?wpdpEaNKhdNZx*nBOIQ1zcaM8zca7=fCpI3z~Q&3yQY zx+$gCwa{YBzR%E~rR_XcrdLzn#hNw#nbf(4Oh-DW4VX>1#urjY2gFxfxWya6q1@PP#S)>c77Mv-J&~Ve7#C{5ilqb09BFZ%RW?+ zB(ZxOEaXml&=BrAar7(%WL=vM$J_xr7|_|MQ&k<}<)qkVbYqlzWBWGLS65TxRDQRd zfAs5o(i_Bf)eGE~UHSxvzjoTyCBg;k#_R|0?TRna(G@*~fsgc`L3Ire)r!|lNW~@4 za0UG+@#BJZ1ZPMx@tEHtEyLW%NGzCL^*EJm!huo^1T7XjgVf*kpxxuwxNmHkuRKjL zGi$75R#Onc1bmh$T99}*H)+ug_#vk#)$}>r31viA{mZzx2tu%b8dXX=SC=J!R`+p% zR2N(Zr=w-hb_o()oOpYx&I1pai)_lE%#h(FV<}-bbe}bNNiRIfZS&2p8qnhy3u6nF zjzH%~$9(+5zLEntrUm-@wTuMYDHkV(F4N1)T4zVF?Af;^mToTa9fjsGx^E*&_Fjw0 zw~F@8hZx#B7!>4MTjUnjLkbJsu}+xRLX%7=_o0~41!rL;&V+-0F&i${1qnoM;t{h3 zw;e$fl%d+|H-Fbc7jBwd@31UjJKSmeCDJw6fR(^3dJQdLky|}7eHH!cqlc^>B`Aws zYCIFs7#~hxPRG$>5J>q8$MwNI55P|&5VrU++KjJVn+U;Y`7$)b!IY1S(P!IU3*{o>pEK_PoGxj7rwz#fe7>LE=TM=q>e@k9E86UKJ+z0n%grt+eNz(Ajh+cu zKwPagb6`!ClqD1KBnRa?vGvC@nRPJ3bB#l~bWRnKTU4ZUFc)na#$uygoe1kHkTSbgh3VlY3qfjFmGGh1gBdhy(T3ho_B0^Eue54> zGrO)GSh%gwZy#i&&1d_$iKOZ#N2g4k#R9r*7^`~j)y~qjEuneSeMLpf#7V7+RX^Tw z`1B|m+iP5+*dH^nj#l9e;a<*8+M&HU6wPOP!DZ`$xhuGbHQ+{H^ulaoXI2Ql3Y`xbU8D#)$Jtr z=1mws7LKhIe8NxUy=s?}<} zb?^sYO6g$<_ZEPiz^m#>>cvGvA{XKc;PenV_4u*)uB0+~KRBpMToN(N%NmPNRUAE; zpcK^gB7wFggYg;2-slKQZHx)yE;+aRkHOK>b8>dfRMo8R|+c&@{{sb9++UNqDY zC<3}bIqr?wNuCBFdbbm7yNU)ax&`ts?ZSjc#Ra1rPSVmKKytzfX_l1yDU;yuN0`GE z0?#o?pQiBV_Ph#-<9(Zrx=&Cm-enO_YJ+uA2e!bA7H=?&>mjz#dScUAVzZEbmDX>$ z%fcFG>a&*dQ{K9<3;fC1yX=$ek+#jAX|Hy-bOmZRbz?SH4&1zqPZ;>x4p8 a_XyRdy1QZ%@C8jEr^D`tst=s{>3;#p)Md^9 From 952ba4ad16fe567995c54f44f1e6f1690bfff0db Mon Sep 17 00:00:00 2001 From: Luke Dashjr Date: Tue, 12 Apr 2016 20:20:06 +0000 Subject: [PATCH 04/13] Assign BIP 114: Merkelized Abstract Syntax Tree --- README.mediawiki | 6 ++++++ bip-mast.mediawiki => bip-0114.mediawiki | 6 +++--- 2 files changed, 9 insertions(+), 3 deletions(-) rename bip-mast.mediawiki => bip-0114.mediawiki (99%) diff --git a/README.mediawiki b/README.mediawiki index 92ca9f92..974870e0 100644 --- a/README.mediawiki +++ b/README.mediawiki @@ -404,6 +404,12 @@ Those proposing changes should consider that ultimately consent may rest with th | Standard | Draft |- +| [[bip-0114.mediawiki|114]] +| Merkelized Abstract Syntax Tree +| Johnson Lau +| Standard +| Draft +|- | [[bip-0120.mediawiki|120]] | Proof of Payment | Kalle Rosenbaum diff --git a/bip-mast.mediawiki b/bip-0114.mediawiki similarity index 99% rename from bip-mast.mediawiki rename to bip-0114.mediawiki index a903235a..4ad593f2 100644 --- a/bip-mast.mediawiki +++ b/bip-0114.mediawiki @@ -1,5 +1,5 @@ 
-  BIP: ?
+  BIP: 114
   Title: Merkelized Abstract Syntax Tree
   Author: Johnson Lau 
   Status: Draft
@@ -135,7 +135,7 @@ The idea of MAST originates from Russell O’Connor, Pieter Wuille, and [https:/
 == Reference Implementation ==
 https://github.com/jl2012/bitcoin/commit/f335cab76eb95d4f7754a718df201216a4975d8c
 
-
+
 if (witversion == 1) {
     if (program.size() == 32) {
         if (witness.stack.size() < 3)
@@ -189,4 +189,4 @@ if (witversion == 1) {
 *[[bip-0141.mediawiki|BIP141 Segregated Witness (Consensus layer)]]
 
 == Copyright ==
-This document is placed in the public domain.
\ No newline at end of file
+This document is placed in the public domain.

From 58409dd0e8b487bd3a4a42d6de41bc0631fe95ed Mon Sep 17 00:00:00 2001
From: instagibbs 
Date: Wed, 13 Apr 2016 11:46:17 -0400
Subject: [PATCH 05/13] Some clarification on path meaning and structure

---
 bip-0114.mediawiki | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bip-0114.mediawiki b/bip-0114.mediawiki
index 4ad593f2..f2a960ed 100644
--- a/bip-0114.mediawiki
+++ b/bip-0114.mediawiki
@@ -35,9 +35,9 @@ The Position, Path, and MAST Script are p
 
 The double-SHA256 of the MAST Script (≤ TBD bytes) must be correctly connected to the MAST Root with the ComputeMerkleRootFromBranch function, with the specified Path and Position.
 
-Path is the serialized Merkle path for the MAST Script. Size of Path must be a multiple of 32 bytes, and not more than 1024 bytes (which allows 32 levels). If the size of Path is zero, the double-SHA256 of the MAST Script must match the MAST Root.
+Path is the serialized Merkle path for the MAST Script. Size of Path must be a multiple of 32 bytes, and not more than 1024 bytes (which allows 32 levels). Each 32 byte word is a double-SHA256 merkle node in the merkle branch connecting to the  MAST Root. If the size of Path is zero, the double-SHA256 of the MAST Script must match the MAST Root.
 
-Position indicates the location of the MAST Script in the Merkle tree, with zero means the leftmost position. It is an unsigned little-endian integer with not more than 4 bytes. It must be encoded in the most parsimonious way possible, with no leading zero and not larger than the maximum number of items allowed by the depth of the tree (as implied by the size of Path).
+Position indicates the location of the MAST Script in the Merkle tree, with zero indicating the leftmost position. It is an unsigned little-endian integer with not more than 4 bytes. It must be encoded in the most parsimonious way possible, with no leading zero and not larger than the maximum number of items allowed by the depth of the tree (as implied by the size of Path).
 
 The MAST Script is then deserialized, and executed after normal script evaluation with the remaining witness stack (≤ TBD bytes for each stack item). The script must not fail, and result in exactly a single TRUE on the stack.
 

From 3ef07340b42f3abee4b01d30d7a53315d0b30fa1 Mon Sep 17 00:00:00 2001
From: jl2012 
Date: Thu, 14 Apr 2016 00:43:16 +0800
Subject: [PATCH 06/13] BIP114: Clarifying reference implementation

---
 bip-0114.mediawiki | 48 +++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 43 insertions(+), 5 deletions(-)

diff --git a/bip-0114.mediawiki b/bip-0114.mediawiki
index 4ad593f2..36883518 100644
--- a/bip-0114.mediawiki
+++ b/bip-0114.mediawiki
@@ -133,24 +133,33 @@ This BIP depends on [[bip-0141.mediawiki|BIP141]] and will be deployed by versio
 The idea of MAST originates from Russell O’Connor, Pieter Wuille, and [https://bitcointalk.org/index.php?topic=255145.msg2757327#msg2757327 Peter Todd].
 
 == Reference Implementation ==
-https://github.com/jl2012/bitcoin/commit/f335cab76eb95d4f7754a718df201216a4975d8c
+https://github.com/jl2012/bitcoin/tree/segwit_mast
 
 
+//New rules apply if version byte is 1 and witness program size is 32 bytes
 if (witversion == 1) {
     if (program.size() == 32) {
+
+        //Witness stack must have at least 3 items
         if (witness.stack.size() < 3)
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
 
-        //Script: the last witness stack item
+        //Script is the last witness stack item
         scriptPubKey = CScript(witness.stack.back().begin(), witness.stack.back().end());
         uint256 hashScriptPubKey;
         CHash256().Write(&scriptPubKey[0], scriptPubKey.size()).Finalize(hashScriptPubKey.begin());
 
-        //Path: the second last witness stack item; size = 32N, 0 <= N < 33
+        //Path is the second last witness stack item
         std::vector pathdata = witness.stack.at(witness.stack.size() - 2);
+
+        // Size of Path must be a multiple of 32 bytes (0 byte is allowed)
         if (pathdata.size() & 0x1F)
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
+
+        // Depth of the tree is size of Path divided by 32
         unsigned int depth = pathdata.size() >> 5;
+
+        // Maximum allowed depth is 32
         if (depth > 32)
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
         std::vector path;
@@ -158,33 +167,62 @@ if (witversion == 1) {
         for (unsigned int i = 0; i < depth; i++)
             memcpy(path[i].begin(), &pathdata[32 * i], 32);
 
-        //Position: the third last witness stack item; unsigned int with smallest possible value and no leading zero
+        //Position is the third last witness stack item
         std::vector positiondata = witness.stack.at(witness.stack.size() - 3);
+
+        //Position may have 4 bytes at most
         if (positiondata.size() > 4)
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
+
         uint32_t position = 0;
+
+        //Position is an unsigned little-endian integer with no leading zero byte
         if (positiondata.size() > 0) {
             if (positiondata.back() == 0x00)
                 return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
             for (size_t i = 0; i != positiondata.size(); ++i)
                 position |= static_cast(positiondata[i]) << 8 * i;
         }
+
+        //Position must not be larger than the maximum number of items allowed by the depth of tree
         if (depth < 32) {
             if (position >= (1U << depth))
                 return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
         }
 
+        //Calculate the Merkle Root and compare with the witness program
         uint256 root = ComputeMerkleRootFromBranch(hashScriptPubKey, path, position);
         if (memcmp(root.begin(), &program[0], 32))
             return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_MISMATCH);
 
+        //Remaining stack items used for evaluation
         stack = std::vector >(witness.stack.begin(), witness.stack.end() - 3);
-    } else {
+    }
+
+    else {
+        //Invalid if version byte is 1 but witness program size is not 32 bytes
         return set_error(serror, SCRIPT_ERR_WITNESS_PROGRAM_WRONG_LENGTH);
     }
 }
 
 
+Copying from src/consensus/merkle.cpp:
+
+uint256 ComputeMerkleRootFromBranch(const uint256& leaf, const std::vector& vMerkleBranch, uint32_t nIndex) {
+    uint256 hash = leaf;
+    for (std::vector::const_iterator it = vMerkleBranch.begin(); it != vMerkleBranch.end(); ++it) {
+        if (nIndex & 1) {
+            hash = Hash(BEGIN(*it), END(*it), BEGIN(hash), END(hash));
+        } else {
+            hash = Hash(BEGIN(hash), END(hash), BEGIN(*it), END(*it));
+        }
+        nIndex >>= 1;
+    }
+    return hash;
+}
+
+
+
 == References ==
 *[[bip-0141.mediawiki|BIP141 Segregated Witness (Consensus layer)]]
 

From 97dafa75b32249adce8c6d02fdb56b3f28f0e24d Mon Sep 17 00:00:00 2001
From: Justus Ranvier 
Date: Sun, 17 Apr 2016 09:20:46 -0500
Subject: [PATCH 07/13] BIP-0047: Clarify usage and format of outpoints

Introduce the terms 'designated input' and 'designated pubkey' for clarity

Update reference link for outpoint to a more canonical source
---
 bip-0047.mediawiki | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/bip-0047.mediawiki b/bip-0047.mediawiki
index bdac681e..0720eb40 100644
--- a/bip-0047.mediawiki
+++ b/bip-0047.mediawiki
@@ -1,7 +1,7 @@
 RECENT CHANGES:
+* (17 Apr 2016) Clarify usage of outpoints in notification transactions
 * (18 Dec 2015) Update explanations to resolve FAQs
 * (12 Oct 2015) Revise blinding method for notification transactions
-* (21 Sep 2015) Correct base58check version byte
 
 
   BIP: 47
@@ -119,6 +119,9 @@ It is assumed that Alice can easily obtain Bob's payment code via a suitable met
 * Payment code: an extended public key and associated metadata which is associated with a particular identity/account
 * Notification address: the P2PKH address associated with the 0th public key derived from a payment code
 * Notification transaction: a transaction which sends an output to a notification address which includes an embedded payment code
+* Designated input: the first input in the notification transaction which exposes an secp256k1 pubkey in either its signature script, or in the redeem script or pubkey script of the output being spent
+* Designated pubkey: the first secp256k1 pubkey pushed to the stack during script execution for the designated input
+* Outpoint: the specific output of a previous transaction which is being spent. See the Reference section for the binary serialization
 
 ====Notification Transaction====
 
@@ -127,12 +130,12 @@ Prior to the first time Alice initiates a transaction to Bob, Alice MUST inform
 # Alice constructs a transaction which sends a small quantity of bitcoins to Bob's notification address (notification transaction)
 ## The inputs selected for this transaction MUST NOT be easily associated with Alice's notification address
 # Alice derives a unique shared secret using ECDH:
-## Alice selects the private key corresponding to the first exposed public key, of the first pubkey-exposing input, of the transaction: 
a

+## Alice selects the private key corresponding to the designated pubkey: 
a

 ## Alice selects the public key associated with Bob's notification address: 
B, where B = bG

 ## Alice calculates a secret point: 
S = aB

 ## Alice calculates a 64 byte blinding factor: 
s = HMAC-SHA512(x, o)

 ### "x" is the x value of the secret point
-### "o" is the outpoint being spent by the first pubkey-exposing input of the transaction.
+### "o" is the outpoint being spent by the designated input
 # Alice serializes her payment code in binary form.
 # Alice renders her payment code (P) unreadable to anyone except Bob:
 ## Replace the x value with x': 
x' = x XOR (first 32 bytes of s)

@@ -143,12 +146,12 @@ Prior to the first time Alice initiates a transaction to Bob, Alice MUST inform
 # Bob watches for any transactions which create an output at his notification address.
 # When a transaction is received, the client examines it to determine if it contains a standard OP_RETURN output with an 80 byte payload (notification transactions).
 # If the first byte of the payload in a notification transaction is 0x01:
-## Bob selects the first exposed public key, of the first pubkey-exposing input, of the transaction: 
A, where A = aG

+## Bob selects the designated pubkey: 
A, where A = aG

 ## Bob selects the private key associated with his notification address: 
b

 ## Bob calculates a secret point: 
S = bA

 ## Bob calculates the binding factor: 
s = HMAC-SHA512(x, o)

 ### "x" is the x value of the secret point
-### "o" is the outpoint being spent by the first pubkey-exposing input of the transaction.
+### "o" is the outpoint being spent by the designated input.
 ## Bob interprets the 80 byte payload as a payment code, except:
 ### Replace the x value with x': 
x' = x XOR (first 32 bytes of s)

 ### Replace the chain code with c': 
c' = c XOR (last 32 bytes of s)

@@ -300,7 +303,7 @@ In order to use Bitmessage notification, the recipient must have a Bitmessage cl
 * [[bip-0032.mediawiki|BIP32 - Hierarchical Deterministic Wallets]]
 * [[bip-0043.mediawiki|BIP43 - Purpose Field for Deterministic Wallets]]
 * [[bip-0044.mediawiki|BIP44 - Multi-Account Hierarchy for Deterministic Wallets]]
-* [[https://bitcoin.org/en/glossary/outpoint|Outpoint]]
+* [[https://bitcoin.org/en/developer-reference#outpoint|Outpoint]]
 * [[https://github.com/petertodd/dust-b-gone|dust-b-gone]]
 * [[https://en.bitcoin.it/wiki/Base58Check_encoding|Base58Check encoding]]
 * [[https://bitmessage.org/bitmessage.pdf|Bitmessage]]

From 4cb4534fd918653975709a3cf4877ed77ec576c4 Mon Sep 17 00:00:00 2001
From: Bryan Bishop 
Date: Wed, 20 Apr 2016 12:29:44 -0500
Subject: [PATCH 08/13] BIP143: fix typo ("including")

---
 bip-0143.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bip-0143.mediawiki b/bip-0143.mediawiki
index 4c6503b3..ed5cfecd 100644
--- a/bip-0143.mediawiki
+++ b/bip-0143.mediawiki
@@ -191,7 +191,7 @@ This proposal is deployed with Segregated Witness softfork (BIP 141)
 
 == Backward compatibility ==
 
-As a soft fork, older software will continue to operate without modification. Non-upgraded nodes, however, will not see nor validate the witness data and will consider all witness programs, inculding the redefined sigops, as anyone-can-spend scripts.
+As a soft fork, older software will continue to operate without modification. Non-upgraded nodes, however, will not see nor validate the witness data and will consider all witness programs, including the redefined sigops, as anyone-can-spend scripts.
 
 == Reference Implementation ==
 

From c1ef3a05e32bf477ebc4b05db9eba5d85ac24b49 Mon Sep 17 00:00:00 2001
From: Johnson Lau 
Date: Wed, 20 Apr 2016 13:16:39 +0800
Subject: [PATCH 09/13] BIP143 clarifying semantics of ACP|SINGLE

---
 bip-0143.mediawiki | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/bip-0143.mediawiki b/bip-0143.mediawiki
index 4c6503b3..d39fdd8e 100644
--- a/bip-0143.mediawiki
+++ b/bip-0143.mediawiki
@@ -1,4 +1,4 @@
-
+
   BIP: 143
   Title: Transaction Signature Verification for Version 0 Witness Program
   Author: Johnson Lau 
@@ -28,37 +28,41 @@ A new transaction digest algorithm is defined, but only applicable to sigops in
      2. hashPrevouts (32-byte hash)
      3. hashSequence (32-byte hash)
      4. outpoint (32-byte hash + 4-byte little endian) 
-     5. scriptCode of the input (varInt for the length + script)
+     5. scriptCode of the input (serialized as scripts inside CTxOuts)
      6. value of the output spent by this input (8-byte little endian)
      7. nSequence of the input (4-byte little endian)
      8. hashOutputs (32-byte hash)
      9. nLocktime of the transaction (4-byte little endian)
     10. sighash type of the signature (4-byte little endian)
 
-All components in the original algorithm, including the behavior OP_CODESEPERATOR, remains unchanged. The only difference is the way of serialization and the inclusion of amount being spent.
+Semantics of the original sighash types remain unchanged, except the followings:
+# The way of serialization is changed;
+# All sighash types commit to the amount being spent by the signed input;
+# FindAndDelete of the signature is not applied to the scriptCode;
+# SINGLE does not commit to the input index. When ANYONECANPAY is not set, the semantics are unchanged since hashPrevouts and outpoint together implictly commit to the input index. When SINGLE is used with ANYONECANPAY, omission of the index commitment allows permutation of the input-output pairs, as long as each pair is located at an equivalent index.
 
 The items 1, 4, 7, 9, 10 have the same meaning as the original algorithm. 
 
 The item 5:
 *For P2WPKH witness program, the scriptCode is 0x1976a914{20-byte-pubkey-hash}88ac.
 *For P2WSH witness program,
-**if the witnessScript does not contain any OP_CODESEPERATOR, the scriptCode is a varInt for the length of the witnessScript, followed by the witnessScript.
-**if the witnessScript contains any OP_CODESEPERATOR, the scriptCode is the evaluated script, with all OP_CODESEPARATOR and everything up to the last OP_CODESEPARATOR before the signature checking opcode being executed removed, and prepended by a varInt for the length of the truncated script.
+**if the witnessScript does not contain any OP_CODESEPERATOR, the scriptCode is the witnessScript serialized as scripts inside CTxOuts.
+**if the witnessScript contains any OP_CODESEPERATOR, the scriptCode is the evaluated script, with all OP_CODESEPARATOR and everything up to the last OP_CODESEPARATOR before the signature checking opcode being executed removed, serialized as scripts inside CTxOuts.
 
 The item 6 is a 8-byte value of the amount of bitcoin spent in this input.
 
 hashPrevouts:
-*If the ANYONECANPAY flag is not set, hashPrevouts is the double SHA256 of the serialization of all input outpoints;
+*If the ANYONECANPAY flag is not set, hashPrevouts is the double SHA256 of the serialization of all input outpoints;
 *Otherwise, hashPrevouts is a uint256 of 0x0000......0000.
 
 hashSequence:
-*If none of the ANYONECANPAY, SINGLE, NONE sighash type is set, hashSequence is the double SHA256 of the serialization of nSequence of all inputs;
+*If none of the ANYONECANPAY, SINGLE, NONE sighash type is set, hashSequence is the double SHA256 of the serialization of nSequence of all inputs;
 *Otherwise, hashSequence is a uint256 of 0x0000......0000.
 
 hashOutputs:
-*If the sighash type is neither SINGLE nor NONE, hashOutputs is the double SHA256 of the serialization of all output value (8-byte little endian) with scriptPubKey (varInt for the length + script);
-*If sighash type is SINGLE and the input index is not greater than the number of outputs, hashOutputs is the double SHA256 of the output value with scriptPubKey of the same index as the input;
-*Otherwise, hashOutputs is a uint256 of 0x0000......0000.
+*If the sighash type is neither SINGLE nor NONE, hashOutputs is the double SHA256 of the serialization of all output value (8-byte little endian) with scriptPubKey (serialized as scripts inside CTxOuts);
+*If sighash type is SINGLE and the input index is not greater than the number of outputs, hashOutputs is the double SHA256 of the output value with scriptPubKey of the same index as the input;
+*Otherwise, hashOutputs is a uint256 of 0x0000......0000.In the original algorithm, a uint256 of 0x0000......0001 is commited if the input index for a SINGLE signature is greater than the number of outputs. In this BIP a 0x0000......0000 is commited, without changing the semantics.
 
 The hashPrevouts, hashSequence, and hashOutputs calculated in an earlier verification may be reused in other inputs of the same transaction, so that the time complexity of the whole hashing process reduces from O(n2) to O(n).
 
@@ -195,7 +199,7 @@ As a soft fork, older software will continue to operate without modification. No
 
 == Reference Implementation ==
 
-https://github.com/sipa/bitcoin/commits/segwit
+https://github.com/bitcoin/bitcoin/pull/7910
 
 == References ==
 

From a488367502f9b3187c0e993588894a8b24807e11 Mon Sep 17 00:00:00 2001
From: Bryan Bishop 
Date: Wed, 20 Apr 2016 12:45:48 -0500
Subject: [PATCH 10/13] BIP143: explicitly mention the SignatureHash function

The purpose of BIP143 is to propose an updated SignatureHash function
but "sighash" only appears near the end buried in the text. By
explicitly mentioning the SignatureHash function, readers can more
readily understand the context of the proposal.
---
 bip-0143.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bip-0143.mediawiki b/bip-0143.mediawiki
index 4c6503b3..1f921c0e 100644
--- a/bip-0143.mediawiki
+++ b/bip-0143.mediawiki
@@ -14,7 +14,7 @@ This proposal defines a new transaction digest algorithm for signature verificat
 == Motivation ==
 There are 4 ECDSA signature verification codes in the original Bitcoin script system: CHECKSIG, CHECKSIGVERIFY, CHECKMULTISIG, CHECKMULTISIGVERIFY (“sigops”). According to the sighash type (ALL, NONE, SINGLE, ANYONECANPAY), a transaction digest is generated with a double SHA256 of a serialized subset of the transaction, and the signature is verified against this digest with a given public key. The detailed procedure is described in a Bitcoin Wiki article. [https://en.bitcoin.it/wiki/OP_CHECKSIG]
 
-Unfortunately, there are at least 2 weaknesses in the original transaction digest algorithm:
+Unfortunately, there are at least 2 weaknesses in the original SignatureHash transaction digest algorithm:
 
 * For the verification of each signature, the amount of data hashing is proportional to the size of the transaction. Therefore, data hashing grows in O(n2) as the number of sigops in a transaction increases. While a 1 MB block would normally take 2 seconds to verify with an average computer in 2015, a 1MB transaction with 5569 sigops may take 25 seconds to verify. This could be fixed by optimizing the digest algorithm by introducing some reusable “midstate”, so the time complexity becomes O(n). [https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2292 CVE-2013-2292][https://bitcointalk.org/?topic=140078 New Bitcoin vulnerability: A transaction that takes at least 3 minutes to verify][http://rusty.ozlabs.org/?p=522 The Megatransaction: Why Does It Take 25 Seconds?]
 * The algorithm does not involve the amount of Bitcoin being spent by the input. This is usually not a problem for online network nodes as they could request for the specified transaction to acquire the output value. For an offline transaction signing device ("cold wallet"), however, the unknowing of input amount makes it impossible to calculate the exact amount being spent and the transaction fee. To cope with this problem a cold wallet must also acquire the full transaction being spent, which could be a big obstacle in the implementation of lightweight, air-gapped wallet. By including the input value of part of the transaction digest, a cold wallet may safely sign a transaction by learning the value from an untrusted source. In the case that a wrong value is provided and signed, the signature would be invalid and no funding might be lost. [https://bitcointalk.org/index.php?topic=181734.0 SIGHASH_WITHINPUTVALUE: Super-lightweight HW wallets and offline data]

From d72c1bfc71993b85e9d6f2aa3ac6e405a371bb39 Mon Sep 17 00:00:00 2001
From: Aaron Voisine 
Date: Fri, 22 Apr 2016 08:44:29 -0700
Subject: [PATCH 11/13] Update bip-0141.mediawiki

The byte representation of "<0 <32-byte-hash>>" is "0x220020{32-byte-hash}"

What was listed here would be the byte representation of "0 <32-byte-hash>". The text explains that there is only one item in scriptSig, so I'm guessing the byte representation is wrong. Also the corrected byte representation would produce the same sig/pubkey described in P2WSH after following the bip16 rules.
---
 bip-0141.mediawiki | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bip-0141.mediawiki b/bip-0141.mediawiki
index f9881be4..afb5a2a6 100644
--- a/bip-0141.mediawiki
+++ b/bip-0141.mediawiki
@@ -166,7 +166,7 @@ The following example is the same 1-of-2 multi-signature P2WSH witness program,
 
     witness:      0  <1   2 CHECKMULTISIG>
     scriptSig:    <0 <32-byte-hash>>
-                  (0x0020{32-byte-hash})
+                  (0x220020{32-byte-hash})
     scriptPubKey: HASH160 <20-byte-hash> EQUAL
                   (0xA914{20-byte-hash}87)
 

From 43c34e846be227780a954905de7543654a1e840c Mon Sep 17 00:00:00 2001
From: jl2012 
Date: Sat, 23 Apr 2016 08:26:48 +0200
Subject: [PATCH 12/13] Add P2SH-P2WPKH example

---
 bip-0141.mediawiki | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/bip-0141.mediawiki b/bip-0141.mediawiki
index afb5a2a6..a760d7dd 100644
--- a/bip-0141.mediawiki
+++ b/bip-0141.mediawiki
@@ -128,8 +128,8 @@ The following example is a version 0 pay-to-witness-public-key-hash (P2WPKH) wit
 
     witness:       
     scriptSig:    (empty)
-    scriptPubKey: 0 <20-byte-hash>
-                  (0x0014{20-byte-hash})
+    scriptPubKey: 0 <20-byte-key-hash>
+                  (0x0014{20-byte-key-hash})
 
 The '0' in scriptPubKey indicates the following push is a version 0 witness program. The length of the witness program indicates that it is a P2WPKH type. The witness must consist of exactly 2 items. The HASH160 of the pubkey in witness must match the witness program.
 
@@ -139,6 +139,24 @@ The signature is verified as
 
 Comparing with a traditional P2PKH output, the P2WPKH equivalent occupies 3 less bytes in the scriptPubKey, and moves the signature and public key from scriptSig to witness.
 
+=== P2WPKH nested in BIP16 P2SH ===
+
+The following example is the same P2WPKH witness program, but nested in a BIP16 P2SH output.
+
+    witness:       
+    scriptSig:    <0 <20-byte-key-hash>>
+                  (0x160014{20-byte-key-hash})
+    scriptPubKey: HASH160 <20-byte-script-hash> EQUAL
+                  (0xA914{20-byte-script-hash}87)
+
+The only item in scriptSig is hashed with HASH160, compared against the 20-byte-script-hash in scriptPubKey, and interpreted as:
+
+    0 <20-byte-key-hash>
+
+The P2WPKH witness program is then executed as described in the previous example.
+
+Comparing with the previous example, the scriptPubKey is 1 byte bigger and the scriptSig is 23 bytes bigger. Although a nested witness program is less efficient, its payment address is fully transparent and backward compatible for all Bitcoin reference client since version 0.6.0.
+
 === P2WSH witness program ===
 
 The following example is an 1-of-2 multi-signature version 0 pay-to-witness-script-hash (P2WSH) witness program.
@@ -160,7 +178,7 @@ A P2WSH witness program allows arbitrarily large script as the 520-byte push lim
 
 The scriptPubKey occupies 34 bytes, as opposed to 23 bytes of BIP16 P2SH. The increased size improves security against possible collision attacks, as 280 work is not infeasible anymore (By the end of 2015, 284 hashes have been calculated in Bitcoin mining since the creation of Bitcoin). The spending script is same as the one for an equivalent BIP16 P2SH output but is moved to witness.
 
-=== Witness program nested in BIP16 P2SH ===
+=== P2WSH nested in BIP16 P2SH ===
 
 The following example is the same 1-of-2 multi-signature P2WSH witness program, but nested in a BIP16 P2SH output.
 
@@ -176,7 +194,7 @@ The only item in scriptSig is hashed with HASH160, compared against the 20-byte-
 
 The P2WSH witness program is then executed as described in the previous example.
 
-Comparing with the previous example, the scriptPubKey is 11 bytes smaller (with reduced security) while witness is the same. However, it also requires 35 bytes in scriptSig, which is not prunable in transmission. Although a nested witness program is less efficient in many ways, its payment address is fully transparent and backward compatible for all Bitcoin reference client since version 0.6.0.
+Comparing with the previous example, the scriptPubKey is 11 bytes smaller (with reduced security) while witness is the same. However, it also requires 35 bytes in scriptSig.
 
 === Extensible commitment structure ===
 

From f245646f8b53ee9a82f8053c0ea06048e4fd0278 Mon Sep 17 00:00:00 2001
From: jl2012 
Date: Sat, 23 Apr 2016 16:25:53 +0200
Subject: [PATCH 13/13] BIP141: Block cost clrification

---
 bip-0141.mediawiki | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/bip-0141.mediawiki b/bip-0141.mediawiki
index a760d7dd..09676f8f 100644
--- a/bip-0141.mediawiki
+++ b/bip-0141.mediawiki
@@ -108,9 +108,13 @@ If the version byte is 1 to 16, no further interpretation of the witness program
 
 Blocks are currently limited to 1,000,000 bytes (1MB) total size. We change this restriction as follows:
 
-''Block cost'' is defined. The cost of each byte in the existing header and transactions is 4, while the cost of each byte in witness data is 1.
+''Block cost'' is defined as ''Base size'' * 3 + ''Total size''.
 
-The new rule is total ''block cost'' ≤ 4,000,000.
+''Base size'' is the block size in bytes with the original transaction serialization without any witness-related data, as seen by a non-upgraded node.
+
+''Total size'' is the block size in bytes with transactions serialized as described in [[bip-0144.mediawiki|BIP144]], including base data and witness data.
+
+The new rule is ''block cost'' ≤ 4,000,000.
 
 ==== Sigops ====