<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE rfc [
  <!ENTITY nbsp    "&#160;">
  <!ENTITY zwsp   "&#8203;">
  <!ENTITY nbhy   "&#8209;">
  <!ENTITY wj     "&#8288;">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt" ?>
<!-- generated by https://github.com/cabo/kramdown-rfc version 1.7.4 (Ruby 3.0.2) -->
<rfc xmlns:xi="http://www.w3.org/2001/XInclude" ipr="trust200902" docName="draft-ietf-wish-whip-11" category="std" consensus="true" updates="8842, 8840" tocInclude="true" sortRefs="true" symRefs="true" version="3">
  <!-- xml2rfc v2v3 conversion 3.19.0 -->
  <front>
    <title abbrev="whip">WebRTC-HTTP ingestion protocol (WHIP)</title>
    <seriesInfo name="Internet-Draft" value="draft-ietf-wish-whip-11"/>
    <author initials="S." surname="Murillo" fullname="Sergio Garcia Murillo">
      <organization>Millicast</organization>
      <address>
        <email>sergio.garcia.murillo@cosmosoftware.io</email>
      </address>
    </author>
    <author initials="A." surname="Gouaillard" fullname="Alexandre Gouaillard">
      <organization>CoSMo Software</organization>
      <address>
        <email>alex.gouaillard@cosmosoftware.io</email>
      </address>
    </author>
    <date year="2024" month="January" day="08"/>
    <area>ART</area>
    <workgroup>wish</workgroup>
    <keyword>WebRTC</keyword>
    <abstract>
      <?line 35?>

<t>This document describes a simple HTTP-based protocol that will allow WebRTC-based ingestion of content into streaming services and/or CDNs.</t>
      <t>This document updates RFC 8842 and RFC 8840.</t>
    </abstract>
  </front>
  <middle>
    <?line 41?>

<section anchor="introduction">
      <name>Introduction</name>
      <t>The IETF RTCWEB working group standardized JSEP (<xref target="RFC8829"/>), a mechanism used to control the setup, management, and teardown of a multimedia session. It also describes how to negotiate media flows using the Offer/Answer Model with the Session Description Protocol (SDP) <xref target="RFC3264"/> including the formats for data sent over the wire (e.g., media types, codec parameters, and encryption). WebRTC intentionally does not specify a signaling transport protocol at application level.</t>
      <t>Unfortunately, the lack of a standardized signaling mechanism in WebRTC has been an obstacle to adoption as an ingestion protocol within the broadcast/streaming industry, where a streamlined production pipeline is taken for granted: plug in cables carrying raw media to hardware encoders, then push the encoded media to any streaming service or Content Delivery Network (CDN) ingest using an ingestion protocol.</t>
      <t>While WebRTC can be integrated with standard signaling protocols like SIP <xref target="RFC3261"/> or XMPP <xref target="RFC6120"/>, they are not designed to be used in broadcasting/streaming services, and there is also no sign of adoption in that industry. RTSP <xref target="RFC7826"/>, which is based on RTP, does not support the SDP offer/answer model <xref target="RFC3264"/> for negotiating the characteristics of the media session.</t>
      <t>This document proposes a simple protocol based on HTTP for supporting WebRTC as media ingestion method which:</t>
      <ul spacing="normal">
        <li>
          <t>Is easy to implement,</t>
        </li>
        <li>
          <t>Is as easy to use as popular IP-based broadcast protocols</t>
        </li>
        <li>
          <t>Is fully compliant with WebRTC and RTCWEB specs</t>
        </li>
        <li>
          <t>Enables ingestion on both traditional media platforms and WebRTC end-to-end platforms, achieving the lowest possible latency.</t>
        </li>
        <li>
          <t>Lowers the requirements on both hardware encoders and broadcasting services to support WebRTC.</t>
        </li>
        <li>
          <t>Is usable both in web browsers and in standalone encoders.</t>
        </li>
      </ul>
    </section>
    <section anchor="terminology">
      <name>Terminology</name>
      <t>The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>", "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>", "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
"<bcp14>MAY</bcp14>", and "<bcp14>OPTIONAL</bcp14>" in this document are to be interpreted as
described in BCP 14 <xref target="RFC2119"/> <xref target="RFC8174"/> when, and only when, they
appear in all capitals, as shown here.</t>
      <?line -18?>

</section>
    <section anchor="overview">
      <name>Overview</name>
      <t>The WebRTC-HTTP Ingest Protocol (WHIP) is designed to facilitate a one-time exchange of Session Description Protocol (SDP) offers and answers using HTTP POST requests. This exchange is a fundamental step in establishing an Interactive Connectivity Establishment (ICE) and Datagram Transport Layer Security (DTLS) session between the WHIP client, which represents the encoder or media producer, and the media server, the broadcasting ingestion endpoint.</t>
      <t>Upon successful establishment of the ICE/DTLS session, unidirectional media data transmission commences from the WHIP client to the media server. It is important to note that SDP renegotiations are not supported in WHIP, meaning that no modifications to the "m=" sections can be made after the initial SDP offer/answer exchange via HTTP POST is completed and only ICE related information can be updated via HTTP PATCH requests as defined in Section 4.1.</t>
      <t>The following diagram illustrates the core operation of the WHIP protocol for initiating and terminating an ingest session:</t>
      <figure anchor="whip-protocol-operation">
        <name>WHIP session setup and teardown</name>
        <artwork><![CDATA[
                                                                               
 +-------------+    +---------------+ +--------------+ +---------------+
 | WHIP client |    | WHIP endpoint | | Media Server | | WHIP session  |
 +--+----------+    +---------+-----+ +------+-------+ +--------|------+
    |                         |              |                  |       
    |                         |              |                  |       
    |HTTP POST (SDP Offer)    |              |                  |       
    +------------------------>+              |                  |       
    |201 Created (SDP answer) |              |                  |       
    +<------------------------+              |                  |       
    |          ICE REQUEST                   |                  |       
    +--------------------------------------->+                  |       
    |          ICE RESPONSE                  |                  |       
    |<---------------------------------------+                  |       
    |          DTLS SETUP                    |                  |       
    |<======================================>|                  |       
    |          RTP/RTCP FLOW                 |                  |       
    +<-------------------------------------->+                  |       
    | HTTP DELETE                                               |       
    +---------------------------------------------------------->+       
    | 200 OK                                                    |       
    <-----------------------------------------------------------x       
                                                                               
]]></artwork>
      </figure>
      <t>The elements in <xref target="whip-protocol-operation"/> are described as follows:</t>
      <ul spacing="normal">
        <li>
          <t>WHIP client: This represents the WebRTC media encoder or producer, which functions as a client of the WHIP protocol by encoding and delivering media to a remote media server.</t>
        </li>
        <li>
          <t>WHIP endpoint: This denotes the ingest server that receives the initial WHIP request.</t>
        </li>
        <li>
          <t>WHIP endpoint URL: Refers to the URL of the WHIP endpoint responsible for creating the WHIP session.</t>
        </li>
        <li>
          <t>media server: This is the WebRTC media server or consumer responsible for establishing the media session with the WHIP client and receiving the media content it produces.</t>
        </li>
        <li>
          <t>WHIP session:  Indicates the allocated HTTP resource by the WHIP endpoint for handling an ongoing ingest session.</t>
        </li>
        <li>
          <t>WHIP session URL:  Refers to the URL of the WHIP resource allocated by the WHIP endpoint for a specific media session. The WHIP client can send requests to the WHIP session using this URL to modify the session, such as ICE operations or termination.</t>
        </li>
      </ul>
    </section>
    <section anchor="protocol-operation">
      <name>Protocol Operation</name>
      <t>In order to set up an ingestion session, the WHIP client will generate an SDP offer according to the JSEP rules and perform an HTTP POST request as per <xref target="RFC9110"/> Section 9.3.3 to the configured WHIP endpoint URL.</t>
      <t>The HTTP POST request <bcp14>MUST</bcp14> have a content type of "application/sdp" and contain the SDP offer as the body. The WHIP endpoint will generate an SDP answer and return a "201 Created" response with a content type of "application/sdp", the SDP answer as the body, and a Location header field pointing to the newly created WHIP session.</t>
      <t>As the WHIP protocol only supports the ingestion use case with unidirectional media, the WHIP client <bcp14>SHOULD</bcp14> use "sendonly" attribute in the SDP offer but <bcp14>MAY</bcp14> use the "sendrecv" attribute instead, "inactive" and "recvonly" attributes <bcp14>MUST NOT</bcp14> be used. The WHIP endpoint <bcp14>MUST</bcp14> use "recvonly" attribute in the SDP answer.</t>
      <t>If the HTTP POST to the WHIP endpoint  has a content type different than "application/sdp", the WHIP endpoint  <bcp14>MUST</bcp14> reject the HTTP POST request with a "415 Unsupported Media Type" error response.</t>
      <t>If the SDP body is malformed, the WHIP session <bcp14>MUST</bcp14> reject the HTTP POST with a "400 Bad Request" error response.</t>
      <t>Following is an example of an HTTP POST sent from a WHIP client to a WHIP endpoint and the "201 Created" response from the WHIP endpoint containing the Location header pointing to the newly created WHIP session:</t>
      <figure>
        <name>Example of SDP offer/answer exchange done via an HTTP POST</name>
        <artwork><![CDATA[
POST /whip/endpoint HTTP/1.1
Host: whip.example.com
Content-Type: application/sdp
Content-Length: 1326

v=0
o=- 5228595038118931041 2 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0 1
a=extmap-allow-mixed
a=msid-semantic: WMS
m=audio 9 UDP/TLS/RTP/SAVPF 111
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:EsAw
a=ice-pwd:bP+XJMM09aR8AiX1jdukzR6Y
a=ice-options:trickle
a=fingerprint:sha-256 DA:7B:57:DC:28:CE:04:4F:31:79:85:C4:31:67:EB:27:58:29:ED:77:2A:0D:24:AE:ED:AD:30:BC:BD:F1:9C:02
a=setup:actpass
a=mid:0
a=bundle-only
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=sendonly
a=msid:- d46fb922-d52a-4e9c-aa87-444eadc1521b
a=rtcp-mux
a=rtcp-mux-only
a=rtpmap:111 opus/48000/2
a=fmtp:111 minptime=10;useinbandfec=1
m=video 9 UDP/TLS/RTP/SAVPF 96 97
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:EsAw
a=ice-pwd:bP+XJMM09aR8AiX1jdukzR6Y
a=ice-options:trickle
a=fingerprint:sha-256 DA:7B:57:DC:28:CE:04:4F:31:79:85:C4:31:67:EB:27:58:29:ED:77:2A:0D:24:AE:ED:AD:30:BC:BD:F1:9C:02
a=setup:actpass
a=mid:1
a=bundle-only
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=extmap:10 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
a=extmap:11 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
a=sendonly
a=msid:- d46fb922-d52a-4e9c-aa87-444eadc1521b
a=rtcp-mux
a=rtcp-mux-only
a=rtpmap:96 VP8/90000
a=rtcp-fb:96 ccm fir
a=rtcp-fb:96 nack
a=rtcp-fb:96 nack pli
a=rtpmap:97 rtx/90000
a=fmtp:97 apt=96

HTTP/1.1 201 Created
ETag: "xyzzy"
Content-Type: application/sdp
Content-Length: 1400
Location: https://whip.example.com/session/id

v=0
o=- 1657793490019 1 IN IP4 127.0.0.1
s=-
t=0 0
a=group:BUNDLE 0 1
a=extmap-allow-mixed
a=ice-lite
a=msid-semantic: WMS *
m=audio 9 UDP/TLS/RTP/SAVPF 111
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:38sdf4fdsf54
a=ice-pwd:2e13dde17c1cb009202f627fab90cbec358d766d049c9697
a=fingerprint:sha-256 F7:EB:F3:3E:AC:D2:EA:A7:C1:EC:79:D9:B3:8A:35:DA:70:86:4F:46:D9:2D:CC:D0:BC:81:9F:67:EF:34:2E:BD
a=candidate:1 1 UDP 2130706431 198.51.100.1 39132 typ host
a=setup:passive
a=mid:0
a=bundle-only
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=recvonly
a=rtcp-mux
a=rtcp-mux-only
a=rtpmap:111 opus/48000/2
a=fmtp:111 minptime=10;useinbandfec=1
m=video 9 UDP/TLS/RTP/SAVPF 96 97
c=IN IP4 0.0.0.0
a=rtcp:9 IN IP4 0.0.0.0
a=ice-ufrag:38sdf4fdsf54
a=ice-pwd:2e13dde17c1cb009202f627fab90cbec358d766d049c9697
a=fingerprint:sha-256 F7:EB:F3:3E:AC:D2:EA:A7:C1:EC:79:D9:B3:8A:35:DA:70:86:4F:46:D9:2D:CC:D0:BC:81:9F:67:EF:34:2E:BD
a=candidate:1 1 UDP 2130706431 198.51.100.1 39132 typ host
a=setup:passive
a=mid:1
a=bundle-only
a=extmap:4 urn:ietf:params:rtp-hdrext:sdes:mid
a=extmap:10 urn:ietf:params:rtp-hdrext:sdes:rtp-stream-id
a=extmap:11 urn:ietf:params:rtp-hdrext:sdes:repaired-rtp-stream-id
a=recvonly
a=rtcp-mux
a=rtcp-mux-only
a=rtpmap:96 VP8/90000
a=rtcp-fb:96 ccm fir
a=rtcp-fb:96 nack
a=rtcp-fb:96 nack pli
a=rtpmap:97 rtx/90000
a=fmtp:97 apt=96
]]></artwork>
      </figure>
      <t>Once a session is setup, consent freshness as per <xref target="RFC7675"/> <bcp14>SHALL</bcp14> be used to detect non-graceful disconnection and DTLS teardown for session termination by either side.</t>
      <t>To explicitly terminate a session, the WHIP client <bcp14>MUST</bcp14> perform an HTTP DELETE request to the resource URL returned in the Location header field of the initial HTTP POST. Upon receiving the HTTP DELETE request, the WHIP session will be removed and the resources freed on the media server, terminating the ICE and DTLS sessions.</t>
      <t>A media server terminating a session <bcp14>MUST</bcp14> follow the procedures in <xref target="RFC7675"/> Section 5.2 for immediate revocation of consent.</t>
      <t>The WHIP endpoints <bcp14>MUST</bcp14> return an "405 Method Not Allowed" response for any HTTP request method different than OPTIONS and POST on the endpoint URL in order to reserve their usage for future versions of this protocol specification.</t>
      <t>The WHIP endpoints <bcp14>MUST</bcp14> support OPTIONS requests for Cross-Origin Resource Sharing (CORS) as defined in <xref target="FETCH"/>. The "200 OK" response to any OPTIONS request <bcp14>SHOULD</bcp14> include an "Accept-Post" header with a media type value of "application/sdp" as per <xref target="W3C.REC-ldp-20150226"/>.</t>
      <t>The WHIP sessions <bcp14>MUST</bcp14> return an "405 Method Not Allowed" response for any HTTP request method different than PATCH and DELETE on the session URLs in order to reserve their usage for future versions of this protocol specification.</t>
      <section anchor="ice-support">
        <name>ICE support</name>
        <t>ICE  <xref target="RFC8838"/> is a protocol addressing the complexities of Network Address Translation (NAT) traversal, commonly encountered in Internet communication. NATs hinder direct communication between devices on different local networks, posing challenges for real-time applications. ICE facilitates seamless connectivity by employing techniques to discover and negotiate efficient communication paths.</t>
        <t>Trickle ICE optimizes the connectivity process by incrementally sharing potential communication paths, reducing latency, and facilitating quicker establishment.</t>
        <t>ICE Restarts are crucial for maintaining connectivity in dynamic network conditions or disruptions, allowing devices to re-establish communication paths without complete renegotiation. This ensures minimal latency and reliable real-time communication.</t>
        <t>Trickle ICE and ICE restart support are <bcp14>RECOMMENDED</bcp14> for both WHIP sessions and clients.</t>
        <section anchor="http-patch-request-usage">
          <name>HTTP PATCH request usage</name>
          <t>The WHIP client <bcp14>MAY</bcp14> perform trickle ICE or ICE restarts by sending an HTTP PATCH request as per <xref target="RFC5789"/> to the WHIP session URL, with a body containing a SDP fragment with media type "application/trickle-ice-sdpfrag" as specified in <xref target="RFC8840"/>. When used for trickle ICE, the body of this PATCH message will contain the new gathered set of ICE candidates and when used for ICE restarts, it will also contain the new ICE ufrag/pwd pair as defined in <xref target="RFC8838"/> Section 5.4.</t>
          <t>If the HTTP POST to the WHIP session has a content type different than "application/trickle-ice-sdpfrag", the WHIP session <bcp14>MUST</bcp14> reject the HTTP POST request with a "415 Unsupported Media Type" error response. If the SDP fragment is malformed, the WHIP session <bcp14>MUST</bcp14> reject the HTTP POST with a "400 Bad Request" error response.</t>
          <t>If the WHIP session supports either Trickle ICE or ICE restarts, but not both, it <bcp14>MUST</bcp14> return a "422 Unprocessable Content" response for the HTTP PATCH requests that are not supported as per <xref target="RFC9110"/> Section 15.5.21.</t>
          <t>The WHIP client <bcp14>MAY</bcp14> send overlapping HTTP PATCH requests to one WHIP session. Consequently, as those HTTP PATCH requests may be received out-of-order by the WHIP session, if WHIP session supports ICE restarts, it <bcp14>MUST</bcp14> generate a unique strong entity-tag identifying the ICE session as per <xref target="RFC9110"/> Section 8.8.3, being <bcp14>OPTIONAL</bcp14> otherwise. The initial value of the entity-tag identifying the initial ICE session <bcp14>MUST</bcp14> be returned in an ETag header field in the "201 Created" response to the initial POST request to the WHIP endpoint.</t>
          <t>WHIP clients <bcp14>SHOULD NOT</bcp14> use entity-tag validation when matching a specific ICE session is not required, such as for example when initiating a DELETE request to terminate a session. WHIP sessions <bcp14>MUST</bcp14> ignore any entity-tag value sent by the WHIP client when ICE session matching is not required, as in the HTTP DELETE request.</t>
        </section>
        <section anchor="trickle-ice">
          <name>Trickle ICE</name>
          <t>Depending on the Trickle  ICE support on the WHIP client, the initial offer by the WHIP client <bcp14>MAY</bcp14> be sent after the full ICE gathering is complete with the full list of ICE candidates, or it <bcp14>MAY</bcp14> only contain local candidates (or even an empty list of candidates) as per <xref target="RFC8863"/>. When using Trickle ICE, the WHIP client <bcp14>SHOULD</bcp14> send the SDP offer as soon as possible, containing either locally gathered ICE candidates or an empty list of candidates, in order to reduce setup times..</t>
          <t>Because the WHIP client needs to know the entity-tag associated with the ICE session in order to send a PATCH request containing new ICE candidates, it <bcp14>MUST</bcp14> wait and buffer any gathered candidates until it receives the HTTP response with the new entity-tag value to either the initial POST request or the last PATCH request performing an ICE restart. In order to lower the HTTP traffic and processing time required, the WHIP client <bcp14>SHOULD</bcp14> send a single aggregated HTTP PATCH request with all the buffered ICE candidates once it receives the new entity-tag value.</t>
          <t>In order to simplify the protocol, the WHIP session cannot signal additional ICE candidates to the WHIP client after the SDP answer has been sent. The WHIP endpoint <bcp14>SHALL</bcp14> gather all the ICE candidates for the media server before responding to the client request and the SDP answer <bcp14>SHALL</bcp14> contain the full list of ICE candidates of the media server.</t>
          <t>The media server <bcp14>SHOULD</bcp14> support full ICE, unless it is connected to the to the Internet with an IP address that is accessible by each WHIP client that is authorized to use it, in which case it <bcp14>MAY</bcp14> support only ICE lite. The WHIP client <bcp14>MUST</bcp14> implement and use full ICE.</t>
          <t>If the WHIP session is using entity-tags for identifying the ICE sessions in explained in Section 4.1.1, a WHIP client sending a PATCH request for performing trickle ICE <bcp14>MUST</bcp14> include an "If-Match" header field with the latest known entity-tag as per <xref target="RFC9110"/> Section 13.1.1.
When the PATCH request is received by the WHIP session, it <bcp14>MUST</bcp14> compare the indicated entity-tag value with the current entity-tag of the resource as per <xref target="RFC9110"/> Section 13.1.1 and return a "412 Precondition Failed" response if they do not match. If the HTTP PATCH request does not contain an "If-Match" header the WHIP session <bcp14>MUST</bcp14> return an "428 Precondition Required" response as per <xref target="RFC6585"/> Section 3.</t>
          <t>When a WHIP session receives a PATCH request that adds new ICE candidates without performing an ICE restart, it <bcp14>MUST</bcp14> return a "204 No Content" response without a body and <bcp14>MUST NOT</bcp14> include an ETag header in the response. If the WHIP session does not support a candidate transport or is not able to resolve the connection address, it <bcp14>MUST</bcp14> silently discard the candidate and continue processing the rest of the request normally.</t>
          <figure>
            <name>Example of a Trickle ICE request and response</name>
            <artwork><![CDATA[
PATCH /session/id HTTP/1.1
Host: whip.example.com
If-Match: "xyzzy"
Content-Type: application/trickle-ice-sdpfrag
Content-Length: 576

a=ice-ufrag:EsAw
a=ice-pwd:P2uYro0UCOQ4zxjKXaWCBui1
a=group:BUNDLE 0 1
m=audio 9 UDP/TLS/RTP/SAVPF 111
a=mid:0
a=candidate:1387637174 1 udp 2122260223 192.0.2.1 61764 typ host generation 0 ufrag EsAw network-id 1
a=candidate:3471623853 1 udp 2122194687 198.51.100.1 61765 typ host generation 0 ufrag EsAw network-id 2
a=candidate:473322822 1 tcp 1518280447 192.0.2.1 9 typ host tcptype active generation 0 ufrag EsAw network-id 1
a=candidate:2154773085 1 tcp 1518214911 198.51.100.2 9 typ host tcptype active generation 0 ufrag EsAw network-id 2
a=end-of-candidates

HTTP/1.1 204 No Content
]]></artwork>
          </figure>
        </section>
        <section anchor="ice-restarts">
          <name>ICE Restarts</name>
          <t>A WHIP client sending a PATCH request for performing ICE restart <bcp14>MUST</bcp14> contain an "If-Match" header field with a field-value "*" as per <xref target="RFC9110"/> Section 13.1.1.</t>
          <t><xref target="RFC8840"/> states that an agent <bcp14>MUST</bcp14> discard any received requests containing "ice-pwd" and "ice-ufrag" attributes that do not match those of the current ICE Negotiation Session, howevever, any WHIP session receiving an updated "ice-pwd" and "ice-ufrag" attributes <bcp14>MUST</bcp14> consider the request as performing an ICE restart instead and, if supported, <bcp14>SHALL</bcp14> return a "200 OK" with an "application/trickle-ice-sdpfrag" body containing the new ICE username fragment and password and a new set of ICE candidates for the WHIP session. Also, the "200 OK" response for a successful ICE restart <bcp14>MUST</bcp14> contain the new entity-tag corresponding to the new ICE session in an ETag response header field and <bcp14>MAY</bcp14> contain a new set of ICE candidates for the media server. The WHIP client <bcp14>MUST</bcp14> discard any previous set of media server's ICE candidates when receiving a successful response for an ICE restart request.</t>
          <t>If the ICE restart request cannot be satisfied by the WHIP session, the resource <bcp14>MUST</bcp14> return an appropriate HTTP error code and <bcp14>MUST NOT</bcp14> terminate the session immediately and keep the existing ICE session. The WHIP client <bcp14>MAY</bcp14> retry performing a new ICE restart or terminate the session by issuing an HTTP DELETE request instead. In any case, the session <bcp14>MUST</bcp14> be terminated if the ICE consent expires as a consequence of the failed ICE restart as per <xref target="RFC7675"/> Section 5.1.</t>
          <t>In case of unstable network conditions, the ICE restart HTTP PATCH requests and responses might be received out of order. In order to mitigate this scenario, when the client performs an ICE restart, it <bcp14>MUST</bcp14> discard any previous ICE username and passwords fragments and ignore any further HTTP PATCH response received from a pending HTTP PATCH request. WHIP clients <bcp14>MUST</bcp14> apply only the ICE information received in the response to the last sent request. If there is a mismatch between the ICE information at the WHIP client and at the WHIP session (because of an out-of-order request), the STUN requests will contain invalid ICE information and will be dropped by the receiving side. If this situation is detected by the WHIP client, it <bcp14>MUST</bcp14> send a new ICE restart request to the server.</t>
          <figure>
            <name>Example of an ICE restart request and response</name>
            <artwork><![CDATA[
PATCH /session/id HTTP/1.1
Host: whip.example.com
If-Match: "*"
Content-Type: application/trickle-ice-sdpfrag
Content-Length: 54

a=ice-ufrag:ysXw
a=ice-pwd:vw5LmwG4y/e6dPP/zAP9Gp5k

HTTP/1.1 200 OK
ETag: "abccd"
Content-Type: application/trickle-ice-sdpfrag
Content-Length: 224

a=ice-lite
a=ice-ufrag:289b31b754eaa438
a=ice-pwd:0b66f472495ef0ccac7bda653ab6be49ea13114472a5d10a
a=group:BUNDLE 0 1
m=audio 9 UDP/TLS/RTP/SAVPF 111
a=mid:0
a=candidate:1 1 UDP 2130706431 198.51.100.1 39132 typ host
a=end-of-candidates
]]></artwork>
          </figure>
        </section>
      </section>
      <section anchor="webrtc-constraints">
        <name>WebRTC constraints</name>
        <t>In order to reduce the complexity of implementing WHIP in both clients and media servers, WHIP imposes the following restrictions regarding WebRTC usage:</t>
        <section anchor="sdp-bundle">
          <name>SDP Bundle</name>
          <t>Both the WHIP client and the WHIP endpoint <bcp14>SHALL</bcp14> support and use SDP bundle <xref target="RFC9143"/>. Each "m=" section <bcp14>MUST</bcp14> be part of a single BUNDLE group. Hence, when a WHIP client sends an SDP offer, it <bcp14>MUST</bcp14> include a "bundle-only" attribute in each bundled "m=" section. The WHIP client and the media server <bcp14>MUST</bcp14> support multiplexed media associated with the BUNDLE group as per <xref target="RFC9143"/> Section 9. In addition, per <xref target="RFC9143"/> the WHIP client and media server <bcp14>SHALL</bcp14> use RTP/RTCP multiplexing for all bundled media. In order to reduce the network resources required at the media server, both The WHIP client and WHIP endpoints <bcp14>MUST</bcp14> include the "rtcp-mux-only" attribute in each bundled "m=" sections as per <xref target="RFC8858"/> Section 3.</t>
        </section>
        <section anchor="single-mediastream">
          <name>Single MediaStream</name>
          <t>WHIP only supports a single MediaStream as defined in <xref target="RFC8830"/> and therefore all "m=" sections <bcp14>MUST</bcp14> contain an "msid" attribute with the same value. The MediaStream <bcp14>MUST</bcp14> contain at least one MediaStreamTrack of any media kind and it <bcp14>MUST NOT</bcp14> have two or more than MediaStreamTracks for the same media (audio or video). However, it would be possible for future revisions of this spec to allow more than a single MediaStream or MediaStreamTrack of each media kind, so in order to ensure forward compatibility, if the number of audio and or video MediaStreamTracks or number of MediaStreams are not supported by the WHIP endpoint, it <bcp14>MUST</bcp14> reject the HTTP POST request with a "406 Not Acceptable" error response.</t>
        </section>
        <section anchor="no-partially-successful-answers">
          <name>No partially successful answers</name>
          <t>The WHIP endpoint <bcp14>SHOULD NOT</bcp14> reject individual "m=" sections as per <xref target="RFC8829"/> Section 5.3.1 in case there is any error processing the "m=" section, but reject the HTTP POST request with a "406 Not Acceptable" error response to prevent having partially successful ingest sessions which can be misleading to end users.</t>
        </section>
        <section anchor="dtls-setup-role-and-sdp-setup-attribute">
          <name>DTLS setup role and SDP "setup" attribute</name>
          <t>When a WHIP client sends an SDP offer, it <bcp14>SHOULD</bcp14> insert an SDP "setup" attribute with an "actpass" attribute value, as defined in <xref target="RFC8842"/>. However, if the WHIP client only implements the DTLS client role, it <bcp14>MAY</bcp14> use an SDP "setup" attribute with an "active" attribute value. If the WHIP endpoint does not support an SDP offer with an SDP "setup" attribute with an "active" attribute value, it <bcp14>SHOULD</bcp14> reject the request with a "422 Unprocessable Entity" response.</t>
          <t>NOTE: <xref target="RFC8842"/> defines that the offerer must insert an SDP "setup" attribute with an "actpass" attribute value. However, the WHIP client will always communicate with a media server that is expected to support the DTLS server role, in which case the client might choose to only implement support for the DTLS client role.</t>
        </section>
        <section anchor="trickle-ice-and-ice-restarts">
          <name>Trickle ICE and ICE restarts</name>
          <t>Trickle ICE and ICE restarts support is <bcp14>OPTIONAL</bcp14> for both the WHIP clients and media servers as explained in section 4.1.</t>
        </section>
      </section>
      <section anchor="load-balancing-and-redirections">
        <name>Load balancing and redirections</name>
        <t>WHIP endpoints and media servers might not be colocated on the same server, so it is possible to load balance incoming requests to different media servers.</t>
        <t>WHIP clients <bcp14>SHALL</bcp14> support HTTP redirections as per <xref target="RFC9110"/> Section 15.4. In order to avoid POST requests to be redirected as GET requests, status codes 301 and 302 <bcp14>MUST NOT</bcp14> be used and the preferred method for performing load balancing is via the "307 Temporary Redirect" response status code as described in <xref target="RFC9110"/> Section 15.4.8. Redirections are not required to be supported for the PATCH and DELETE requests.</t>
        <t>In case of high load, the WHIP endpoints <bcp14>MAY</bcp14> return a "503 Service Unavailable" response indicating that the server is currently unable to handle the request due to a temporary overload or scheduled maintenance as described in <xref target="RFC9110"/> Section 15.6.4, which will likely be alleviated after some delay. The WHIP endpoint might send a Retry-After header field indicating the minimum time that the user agent ought to wait before making a follow-up request as described in <xref target="RFC9110"/> Section 10.2.3.</t>
      </section>
      <section anchor="stunturn-server-configuration">
        <name>STUN/TURN server configuration</name>
        <t>The WHIP endpoint <bcp14>MAY</bcp14> return STUN/TURN server configuration URLs and credentials usable by the client in the "201 Created" response to the HTTP POST request to the WHIP endpoint URL.</t>
        <t>A reference to each STUN/TURN server will be returned using the "Link" header field <xref target="RFC8288"/> with a "rel" attribute value of "ice-server". The Link target URI is the server URI as defined in <xref target="RFC7064"/> and <xref target="RFC7065"/>. The credentials are encoded in the Link target attributes as follows:</t>
        <ul spacing="normal">
          <li>
            <t>username: If the Link header field represents a TURN server, and credential-type is "password", then this attribute specifies the username to use with that TURN server.</t>
          </li>
          <li>
            <t>credential: If the "credential-type" attribute is missing or has a "password" value, the credential attribute represents a long-term authentication password, as described in <xref target="RFC8489"/>, Section 10.2.</t>
          </li>
          <li>
            <t>credential-type: If the Link header field represents a TURN server, then this attribute specifies how the credential attribute value should be used when that TURN server requests authorization. The default value if the attribute is not present is "password".</t>
          </li>
        </ul>
        <figure>
          <name>Example of a STUN/TURN servers configuration</name>
          <artwork><![CDATA[
     Link: <stun:stun.example.net>; rel="ice-server"
     Link: <turn:turn.example.net?transport=udp>; rel="ice-server";
           username="user"; credential="myPassword"; credential-type="password"
     Link: <turn:turn.example.net?transport=tcp>; rel="ice-server";
           username="user"; credential="myPassword"; credential-type="password"
     Link: <turns:turn.example.net?transport=tcp>; rel="ice-server";
           username="user"; credential="myPassword"; credential-type="password"
]]></artwork>
        </figure>
        <t>NOTE: The naming of both the "rel" attribute value of "ice-server" and the target attributes follows the one used on the W3C WebRTC recommendation <xref target="W3C.REC-webrtc-20210126"/> RTCConfiguration dictionary in section 4.2.1. "rel" attribute value of "ice-server" is not prepended with the "urn:ietf:params:whip:" so it can be reused by other specifications which may use this mechanism to configure the usage of STUN/TURN servers.</t>
        <t>NOTE: Depending on the ICE Agent implementation, the WHIP client may need to call the setConfiguration method before calling the setLocalDescription method with the local SDP offer in order to avoid having to perform an ICE restart for applying the updated STUN/TURN server configuration on the next ICE gathering phase.</t>
        <t>There are some WebRTC implementations that do not support updating the STUN/TURN server configuration after the local offer has been created as specified in <xref target="RFC8829"/> Section 4.1.18. In order to support these clients, the WHIP endpoint <bcp14>MAY</bcp14> also include the STUN/TURN server configuration on the responses to OPTIONS request sent to the WHIP endpoint URL before the POST request is sent. However, this method is not <bcp14>NOT RECOMMENDED</bcp14> to be used by the WHIP clients and, if supported by the underlying WHIP client's webrtc implementation, the WHIP client <bcp14>SHOULD</bcp14> wait for the information to be returned by the WHIP endpoint on the response of the HTTP POST request instead.</t>
        <t>The generation of the TURN server credentials may require performing a request to an external provider, which can both add latency to the OPTIONS request processing and increase the processing required to handle that request. In order to prevent this, the WHIP endpoint <bcp14>SHOULD NOT</bcp14> return the STUN/TURN server configuration if the OPTIONS request is a preflight request for CORS as defined in <xref target="FETCH"/>, that is, if The OPTIONS request does not contain an Access-Control-Request-Method with "POST" value and the the Access-Control-Request-Headers HTTP header does not contain the "Link" value.</t>
        <t>The WHIP clients <bcp14>MAY</bcp14> also support configuring the STUN/TURN server URIs with long term credentials provided by either the broadcasting service or an external TURN provider, overriding the values provided by the WHIP endpoint.</t>
      </section>
      <section anchor="authentication-and-authorization">
        <name>Authentication and authorization</name>
        <t>All WHIP endpoints, sessions and clients <bcp14>MUST</bcp14> support HTTP Authentication as per <xref target="RFC9110"/> Section 11 and in order to ensure interoperability, bearer token authentication as defined in the next section <bcp14>MUST</bcp14> be supported by all WHIP entities. However this does not preclude the support of additional HTTP authentication schemes as defined in <xref target="RFC8819"/> Section 11.6.</t>
        <section anchor="bearer-token-authentication">
          <name>Bearer token authentication</name>
          <t>WHIP endpoints and sessions <bcp14>MAY</bcp14> require the HTTP request to be authenticated using an HTTP Authorization header field with a Bearer token as specified in <xref target="RFC6750"/> Section 2.1. WHIP clients <bcp14>MUST</bcp14> implement this authentication and authorization mechanism and send the HTTP Authorization header field in all HTTP requests sent to either the WHIP endpoint or session except the preflight OPTIONS requests for CORS.</t>
          <t>The nature, syntax, and semantics of the bearer token, as well as how to distribute it to the client, is outside the scope of this document. Some examples of the kind of tokens that could be used are, but are not limited to, JWT tokens as per <xref target="RFC6750"/> and <xref target="RFC8725"/> or a shared secret stored on a database. The tokens are typically made available to the end user alongside the WHIP endpoint URL and configured on the WHIP clients (similar to the way RTMP URLs and Stream Keys are distributed).</t>
          <t>WHIP endpoints and sessions could perform the authentication and authorization by encoding an authentication token within the URLs for the WHIP endpoints or sessions instead. In case the WHIP client is not configured to use a bearer token, the HTTP Authorization header field must not be sent in any request.</t>
        </section>
      </section>
      <section anchor="simulcast-and-scalable-video-coding">
        <name>Simulcast and scalable video coding</name>
        <t>Simulcast as per <xref target="RFC8853"/> <bcp14>MAY</bcp14> be supported by both the media servers and WHIP clients through negotiation in the SDP offer/answer.</t>
        <t>If the client supports simulcast and wants to enable it for ingesting, it <bcp14>MUST</bcp14> negotiate the support in the SDP offer according to the procedures in <xref target="RFC8853"/> Section 5.3. A server accepting a simulcast offer <bcp14>MUST</bcp14> create an answer according to the procedures <xref target="RFC8853"/> Section 5.3.2.</t>
        <t>It is possible for both media servers and WHIP clients to support Scalable Video Coding (SVC). However, as there is no universal negotiation mechanism in SDP for SVC, the encoder must consider the negotiated codec(s), intended usage, and SVC support in available decoders when configuring SVC.</t>
      </section>
      <section anchor="protocol-extensions">
        <name>Protocol extensions</name>
        <t>In order to support future extensions to be defined for the WHIP protocol, a common procedure for registering and announcing the new extensions is defined.</t>
        <t>Protocol extensions supported by the WHIP sessions <bcp14>MUST</bcp14> be advertised to the WHIP client in the "201 Created" response to the initial HTTP POST request sent to the WHIP endpoint.
The WHIP endpoint <bcp14>MUST</bcp14> return one "Link" header field for each extension that it supports, with the extension "rel" attribute value containing the extension URN and the URL for the HTTP resource that will be available for receiving requests related to that extension.</t>
        <t>Protocol extensions are optional for both WHIP clients and servers. WHIP clients <bcp14>MUST</bcp14> ignore any Link attribute with an unknown "rel" attribute value and WHIP session <bcp14>MUST NOT</bcp14> require the usage of any of the extensions.</t>
        <t>Each protocol extension <bcp14>MUST</bcp14> register a unique "rel" attribute value at IANA starting with the prefix: "urn:ietf:params:whip:ext" as defined in <xref target="urn-whip-subspace"/>.</t>
        <t>For example, considering a potential extension of server-to-client communication using server-sent events as specified in https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events, the URL for connecting to the server-sent event resource for the ingested stream could be returned in the initial HTTP "201 Created" response with a "Link" header field and a "rel" attribute of "urn:ietf:params:whip:ext:example:server-sent-events" (this document does not specify such an extension, and uses it only as an example).</t>
        <t>In this theoretical case, the "201 Created" response to the HTTP POST request would look like:</t>
        <figure>
          <name>Example of a WHIP protocol extension</name>
          <artwork><![CDATA[
HTTP/1.1 201 Created
Content-Type: application/sdp
Location: https://whip.example.com/session/id
Link: <https://whip.ietf.org/publications/213786HF/sse>;
      rel="urn:ietf:params:whip:ext:example:server-sent-events"
]]></artwork>
        </figure>
      </section>
    </section>
    <section anchor="security-considerations">
      <name>Security Considerations</name>
      <t>This document specifies a new protocol on top of HTTP and WebRTC, thus, security protocols and considerations from related specifications apply to the WHIP specification. These include:</t>
      <ul spacing="normal">
        <li>
          <t>WebRTC security considerations: <xref target="RFC8826"/>. HTTPS <bcp14>SHALL</bcp14> be used in order to preserve the WebRTC security model.</t>
        </li>
        <li>
          <t>Transport Layer Security (TLS): <xref target="RFC8446"/> and <xref target="RFC9147"/>.</t>
        </li>
        <li>
          <t>HTTP security: Section 11 of <xref target="RFC9112"/> and Section 17 of <xref target="RFC9110"/>.</t>
        </li>
        <li>
          <t>URI security: Section 7 of <xref target="RFC3986"/>.</t>
        </li>
      </ul>
      <t>On top of that, the WHIP protocol exposes a thin new attack surface specific of the REST API methods used within it:</t>
      <ul spacing="normal">
        <li>
          <t>HTTP POST flooding and resource exhaustion:
It would be possible for an attacker in possession of authentication credentials valid for ingesting a WHIP stream to make multiple HTTP POST to the WHIP endpoint.
This will force the WHIP endpoint to process the incoming SDP and allocate resources for being able to setup the DTLS/ICE connection.
While the malicious client does not need to initiate the DTLS/ICE connection at all, the WHIP session will have to wait for the DTLS/ICE connection timeout in order to release the associated resources.
If the connection rate is high enough, this could lead to resource exhaustion on the servers handling the requests and it will not be able to process legitimate incoming ingests.
In order to prevent this scenario, WHIP endpoints <bcp14>SHOULD</bcp14> implement a rate limit and avalanche control mechanism for incoming initial HTTP POST requests.</t>
        </li>
        <li>
          <t>Insecure direct object references (IDOR) on the WHIP session locations:
If the URLs returned by the WHIP endpoint for the WHIP sessions location are easy to guess, it would be possible for an attacker to send multiple HTTP DELETE requests and terminate all the WHIP sessions currently running.
In order to prevent this scenario, WHIP endpoints <bcp14>SHOULD</bcp14> generate URLs with enough randomness, using a cryptographically secure pseudorandom number generator following the best practices in Randomness Requirements for Security <xref target="RFC4086"/>, and implement a rate limit and avalanche control mechanism for HTTP DELETE requests.
The security considerations for Universally Unique IDentifier (UUID) <xref target="RFC4122"/> Section 6 are applicable for generating the WHIP sessions location URL.</t>
        </li>
        <li>
          <t>HTTP PATCH flooding: 
Similar to the HTTP POST flooding, a malicious client could also create a resource exhaustion by sending multiple HTTP PATCH request to the WHIP session, although the WHIP sessions can limit the impact by not allocating new ICE candidates and reusing the existing ICE candidates when doing ICE restarts.
In order to prevent this scenario, WHIP endpoints <bcp14>SHOULD</bcp14> implement a rate limit and avalanche control mechanism for incoming HTTP PATCH requests.</t>
        </li>
      </ul>
    </section>
    <section anchor="iana-considerations">
      <name>IANA Considerations</name>
      <t>This specification adds a new link relation type and a registry for URN sub-namespaces for WHIP protocol extensions.</t>
      <section anchor="link-relation-type-ice-server">
        <name>Link Relation Type: ice-server</name>
        <t>The link relation type below has been registered by IANA per Section 4.2 of <xref target="RFC8288"/>.</t>
        <t>Relation Name: ice-server</t>
        <t>Description: Conveys the STUN and TURN servers that can be used by an ICE Agent to establish a connection with a peer.</t>
        <t>Reference: TBD</t>
      </section>
      <section anchor="registration-of-whip-urn-sub-namespace-and-whip-registry">
        <name>Registration of WHIP URN Sub-namespace and WHIP Registry</name>
        <t>IANA is asked to add an entry to the "IETF URN Sub-namespace for Registered Protocol Parameter Identifiers" registry and create a sub-namespace for the Registered Parameter Identifier as per <xref target="RFC3553"/>: "urn:ietf:params:whip".</t>
        <t>To manage this sub-namespace, IANA is asked to create the "WebRTC-HTTP ingestion protocol (WHIP) URNs" registry, which is used to manage entries within the "urn:ietf:params:whip" namespace. The registry description is as follows:</t>
        <ul spacing="normal">
          <li>
            <t>Registry name: WebRTC-HTTP ingestion protocol (WHIP) URNs</t>
          </li>
          <li>
            <t>Specification: this document (RFC TBD)</t>
          </li>
          <li>
            <t>Registration policy: Specification Required</t>
          </li>
          <li>
            <t>Repository: See Section <xref target="urn-whip-subspace"/></t>
          </li>
          <li>
            <t>Index value: See Section <xref target="urn-whip-subspace"/></t>
          </li>
        </ul>
      </section>
      <section anchor="urn-whip-subspace">
        <name>URN Sub-namespace for WHIP</name>
        <t>WHIP endpoint utilizes URNs to identify the supported WHIP protocol extensions on the "rel" attribute of the Link header as defined in <xref target="protocol-extensions"/>.</t>
        <t>This section creates and registers an IETF URN Sub-namespace for use in the WHIP specifications and future extensions.</t>
        <section anchor="specification-template">
          <name>Specification Template</name>
          <t>Namespace ID:</t>
          <ul spacing="normal">
            <li>
              <t>The Namespace ID "whip" has been assigned.</t>
            </li>
          </ul>
          <t>Registration Information:</t>
          <ul spacing="normal">
            <li>
              <t>Version: 1</t>
            </li>
            <li>
              <t>Date: TBD</t>
            </li>
          </ul>
          <t>Declared registrant of the namespace:</t>
          <ul spacing="normal">
            <li>
              <t>Registering organization: The Internet Engineering Task Force.</t>
            </li>
            <li>
              <t>Designated contact: A designated expert will monitor the WHIP public mailing list, "wish@ietf.org".</t>
            </li>
          </ul>
          <t>Declaration of Syntactic Structure:</t>
          <ul spacing="normal">
            <li>
              <t>The Namespace Specific String (NSS) of all URNs that use the "whip" Namespace ID shall have the following structure: urn:ietf:params:whip:{type}:{name}:{other}.</t>
            </li>
            <li>
              <t>The keywords have the following meaning:  </t>
              <ul spacing="normal">
                <li>
                  <t>type: The entity type. This specification only defines the "ext" type.</t>
                </li>
                <li>
                  <t>name: A required US-ASCII string that conforms to the URN syntax requirements (see <xref target="RFC8141"/>) and defines a major namespace of a WHIP protocol extension. The value <bcp14>MAY</bcp14> also be an industry name or organization name.</t>
                </li>
                <li>
                  <t>other: Any US-ASCII string that conforms to the URN syntax requirements (see <xref target="RFC8141"/>) and defines the sub-namespace (which <bcp14>MAY</bcp14> be further broken down in namespaces delimited by colons) as needed to uniquely identify an WHIP protocol extension.</t>
                </li>
              </ul>
            </li>
          </ul>
          <t>Relevant Ancillary Documentation:</t>
          <ul spacing="normal">
            <li>
              <t>None</t>
            </li>
          </ul>
          <t>Identifier Uniqueness Considerations:</t>
          <ul spacing="normal">
            <li>
              <t>The designated contact shall be responsible for reviewing and enforcing uniqueness.</t>
            </li>
          </ul>
          <t>Identifier Persistence Considerations:</t>
          <ul spacing="normal">
            <li>
              <t>Once a name has been allocated, it <bcp14>MUST NOT</bcp14> be reallocated for a different purpose.</t>
            </li>
            <li>
              <t>The rules provided for assignments of values within a sub-namespace <bcp14>MUST</bcp14> be constructed so that the meanings of values cannot change.</t>
            </li>
            <li>
              <t>This registration mechanism is not appropriate for naming values whose meanings may change over time.</t>
            </li>
          </ul>
          <t>Process of Identifier Assignment:</t>
          <ul spacing="normal">
            <li>
              <t>Namespace with type "ext" (e.g., "urn:ietf:params:whip:ext") is reserved for IETF-approved WHIP specifications.</t>
            </li>
          </ul>
          <t>Process of Identifier Resolution:</t>
          <ul spacing="normal">
            <li>
              <t>None specified.</t>
            </li>
          </ul>
          <t>Rules for Lexical Equivalence:</t>
          <ul spacing="normal">
            <li>
              <t>No special considerations; the rules for lexical equivalence specified in <xref target="RFC8141"/> apply.</t>
            </li>
          </ul>
          <t>Conformance with URN Syntax:</t>
          <ul spacing="normal">
            <li>
              <t>No special considerations.</t>
            </li>
          </ul>
          <t>Validation Mechanism:</t>
          <ul spacing="normal">
            <li>
              <t>None specified.</t>
            </li>
          </ul>
          <t>Scope:</t>
          <ul spacing="normal">
            <li>
              <t>Global.</t>
            </li>
          </ul>
        </section>
      </section>
      <section anchor="registering-whip-protocol-extensions-urns">
        <name>Registering WHIP Protocol Extensions URNs</name>
        <t>This section defines the process for registering new WHIP protocol extensions URNs with IANA in the "WebRTC-HTTP ingestion protocol (WHIP) URNs" registry (see <xref target="urn-whip-subspace"/>).</t>
        <t>A WHIP Protocol Extension URNs is used as a value in the "rel" attribute of the Link header as defined in <xref target="protocol-extensions"/> for the purpose of signaling the WHIP protocol extensions supported by the WHIP endpoints.</t>
        <t>WHIP Protocol Extensions URNs have a "ext" type as defined in <xref target="urn-whip-subspace"/>.</t>
        <section anchor="registration-procedure">
          <name>Registration Procedure</name>
          <t>The IETF has created a mailing list, "wish@ietf.org", which can be used
   for public discussion of WHIP protocol extensions proposals prior to registration.
   Use of the mailing list is strongly encouraged.  The IESG has
   appointed a designated expert <xref target="RFC8126"/> who will monitor the
   wish@ietf.org mailing list and review registrations.</t>
          <t>Registration of new "ext" type URNs (in the namespace "urn:ietf:params:whip:ext") belonging to a WHIP Protocol Extension <bcp14>MUST</bcp14> be documented in a permanent and readily available public specification, in sufficient detail so that interoperability between independent implementations is possible and reviewed by the designated expert as per <xref target="BCP26"/> Section 4.6.
   An RFC is <bcp14>REQUIRED</bcp14> for the registration of new value data types that modify existing properties.
   An RFC is also <bcp14>REQUIRED</bcp14> for registration of WHIP Protocol Extensions URNs that modify WHIP Protocol Extensions previously documented in an existing RFC.</t>
          <t>The registration procedure begins when a completed registration template, defined in the sections below, is sent to iana@iana.org.
   Decisions made by the designated expert can be appealed to an Applications and Real Time (ART) Area Director, then to the IESG.
   The normal appeals procedure described in <xref target="BCP9"/> is to be followed.</t>
          <t>Once the registration procedure concludes successfully, IANA creates
   or modifies the corresponding record in the WHIP Protocol Extension registry.</t>
          <t>An RFC specifying one or more new WHIP Protocol Extension URNs <bcp14>MUST</bcp14> include the
   completed registration templates, which <bcp14>MAY</bcp14> be expanded with
   additional information. These completed templates are intended to go
   in the body of the document, not in the IANA Considerations section.
   The RFC <bcp14>MUST</bcp14> include the syntax and semantics of any extension-specific attributes that may be provided in a Link header
   field advertising the extension.</t>
        </section>
        <section anchor="guidance-for-designated-experts">
          <name>Guidance for Designated Experts</name>
          <t>The Designated Expert (DE) is expected to ascertain the existence of suitable documentation (a specification) as described in <xref target="RFC8126"/> and to verify that the document is permanently and publicly available.</t>
          <t>The DE is also expected to check the clarity of purpose and use of the requested registration.</t>
          <t>Additionally, the DE must verify that any request for one of these registrations has been made available for review and comment within the IETF: the DE will post the request to the WebRTC Ingest Signaling over HTTPS (wish) Working Group mailing list (or a successor mailing list designated by the IESG).</t>
          <t>If the request comes from within the IETF, it should be documented in an Internet-Draft. Lastly, the DE must ensure that any other request for a code point does not conflict with work that is active or already published within the IETF.</t>
        </section>
        <section anchor="whip-protocol-extension-registration-template">
          <name>WHIP Protocol Extension Registration Template</name>
          <t>A WHIP Protocol Extension URNs is defined by completing the following template:</t>
          <ul spacing="normal">
            <li>
              <t>URN: A unique URN for the WHIP Protocol Extension (e.g., "urn:ietf:params:whip:ext:example:server-sent-events").</t>
            </li>
            <li>
              <t>Reference: A formal reference to the publicly available specification</t>
            </li>
            <li>
              <t>Name: A descriptive name of the WHIP Protocol Extension extension (e.g., "Sender Side events").</t>
            </li>
            <li>
              <t>Description: A brief description of the function of the extension, in a short paragraph or two</t>
            </li>
            <li>
              <t>Contact information: Contact information for the organization or person making the registration</t>
            </li>
          </ul>
        </section>
      </section>
    </section>
    <section anchor="acknowledgements">
      <name>Acknowledgements</name>
      <t>The authors wish to thank Lorenzo Miniero, Juliusz Chroboczek, Adam Roach, Nils Ohlmeier, Christer Holmberg, Cameron Elliott, Gustavo Garcia, Jonas Birme, Sandro Gauci and everyone else in the WebRTC community that have provided comments, feedback, text and improvement proposals on the document and contributed early implementations of the spec.</t>
    </section>
  </middle>
  <back>
    <references>
      <name>References</name>
      <references anchor="sec-normative-references">
        <name>Normative References</name>
        <reference anchor="FETCH" target="https://fetch.spec.whatwg.org">
          <front>
            <title>Fetch - Living Standard</title>
            <author>
              <organization>WHATWG</organization>
            </author>
            <date>n.d.</date>
          </front>
        </reference>
        <reference anchor="RFC8829">
          <front>
            <title>JavaScript Session Establishment Protocol (JSEP)</title>
            <author fullname="J. Uberti" initials="J." surname="Uberti"/>
            <author fullname="C. Jennings" initials="C." surname="Jennings"/>
            <author fullname="E. Rescorla" initials="E." role="editor" surname="Rescorla"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>This document describes the mechanisms for allowing a JavaScript application to control the signaling plane of a multimedia session via the interface specified in the W3C RTCPeerConnection API and discusses how this relates to existing signaling protocols.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8829"/>
          <seriesInfo name="DOI" value="10.17487/RFC8829"/>
        </reference>
        <reference anchor="RFC3264">
          <front>
            <title>An Offer/Answer Model with Session Description Protocol (SDP)</title>
            <author fullname="J. Rosenberg" initials="J." surname="Rosenberg"/>
            <author fullname="H. Schulzrinne" initials="H." surname="Schulzrinne"/>
            <date month="June" year="2002"/>
            <abstract>
              <t>This document defines a mechanism by which two entities can make use of the Session Description Protocol (SDP) to arrive at a common view of a multimedia session between them. In the model, one participant offers the other a description of the desired session from their perspective, and the other participant answers with the desired session from their perspective. This offer/answer model is most useful in unicast sessions where information from both participants is needed for the complete view of the session. The offer/answer model is used by protocols like the Session Initiation Protocol (SIP). [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="3264"/>
          <seriesInfo name="DOI" value="10.17487/RFC3264"/>
        </reference>
        <reference anchor="RFC2119">
          <front>
            <title>Key words for use in RFCs to Indicate Requirement Levels</title>
            <author fullname="S. Bradner" initials="S." surname="Bradner"/>
            <date month="March" year="1997"/>
            <abstract>
              <t>In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="2119"/>
          <seriesInfo name="DOI" value="10.17487/RFC2119"/>
        </reference>
        <reference anchor="RFC8174">
          <front>
            <title>Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words</title>
            <author fullname="B. Leiba" initials="B." surname="Leiba"/>
            <date month="May" year="2017"/>
            <abstract>
              <t>RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="14"/>
          <seriesInfo name="RFC" value="8174"/>
          <seriesInfo name="DOI" value="10.17487/RFC8174"/>
        </reference>
        <reference anchor="RFC9110">
          <front>
            <title>HTTP Semantics</title>
            <author fullname="R. Fielding" initials="R." role="editor" surname="Fielding"/>
            <author fullname="M. Nottingham" initials="M." role="editor" surname="Nottingham"/>
            <author fullname="J. Reschke" initials="J." role="editor" surname="Reschke"/>
            <date month="June" year="2022"/>
            <abstract>
              <t>The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes.</t>
              <t>This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230.</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="97"/>
          <seriesInfo name="RFC" value="9110"/>
          <seriesInfo name="DOI" value="10.17487/RFC9110"/>
        </reference>
        <reference anchor="RFC7675">
          <front>
            <title>Session Traversal Utilities for NAT (STUN) Usage for Consent Freshness</title>
            <author fullname="M. Perumal" initials="M." surname="Perumal"/>
            <author fullname="D. Wing" initials="D." surname="Wing"/>
            <author fullname="R. Ravindranath" initials="R." surname="Ravindranath"/>
            <author fullname="T. Reddy" initials="T." surname="Reddy"/>
            <author fullname="M. Thomson" initials="M." surname="Thomson"/>
            <date month="October" year="2015"/>
            <abstract>
              <t>To prevent WebRTC applications, such as browsers, from launching attacks by sending traffic to unwilling victims, periodic consent to send needs to be obtained from remote endpoints.</t>
              <t>This document describes a consent mechanism using a new Session Traversal Utilities for NAT (STUN) usage.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7675"/>
          <seriesInfo name="DOI" value="10.17487/RFC7675"/>
        </reference>
        <reference anchor="W3C.REC-ldp-20150226" target="https://www.w3.org/TR/2015/REC-ldp-20150226/">
          <front>
            <title>Linked Data Platform 1.0</title>
            <author fullname="Ashok Malhotra" role="editor"/>
            <author fullname="John Arwe" role="editor"/>
            <author fullname="Steve Speicher" role="editor"/>
            <date day="26" month="February" year="2015"/>
          </front>
          <seriesInfo name="W3C REC" value="REC-ldp-20150226"/>
          <seriesInfo name="W3C" value="REC-ldp-20150226"/>
        </reference>
        <reference anchor="RFC8838">
          <front>
            <title>Trickle ICE: Incremental Provisioning of Candidates for the Interactive Connectivity Establishment (ICE) Protocol</title>
            <author fullname="E. Ivov" initials="E." surname="Ivov"/>
            <author fullname="J. Uberti" initials="J." surname="Uberti"/>
            <author fullname="P. Saint-Andre" initials="P." surname="Saint-Andre"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>This document describes "Trickle ICE", an extension to the Interactive Connectivity Establishment (ICE) protocol that enables ICE agents to begin connectivity checks while they are still gathering candidates, by incrementally exchanging candidates over time instead of all at once. This method can considerably accelerate the process of establishing a communication session.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8838"/>
          <seriesInfo name="DOI" value="10.17487/RFC8838"/>
        </reference>
        <reference anchor="RFC5789">
          <front>
            <title>PATCH Method for HTTP</title>
            <author fullname="L. Dusseault" initials="L." surname="Dusseault"/>
            <author fullname="J. Snell" initials="J." surname="Snell"/>
            <date month="March" year="2010"/>
            <abstract>
              <t>Several applications extending the Hypertext Transfer Protocol (HTTP) require a feature to do partial resource modification. The existing HTTP PUT method only allows a complete replacement of a document. This proposal adds a new HTTP method, PATCH, to modify an existing HTTP resource. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="5789"/>
          <seriesInfo name="DOI" value="10.17487/RFC5789"/>
        </reference>
        <reference anchor="RFC8840">
          <front>
            <title>A Session Initiation Protocol (SIP) Usage for Incremental Provisioning of Candidates for the Interactive Connectivity Establishment (Trickle ICE)</title>
            <author fullname="E. Ivov" initials="E." surname="Ivov"/>
            <author fullname="T. Stach" initials="T." surname="Stach"/>
            <author fullname="E. Marocco" initials="E." surname="Marocco"/>
            <author fullname="C. Holmberg" initials="C." surname="Holmberg"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>The Interactive Connectivity Establishment (ICE) protocol describes a Network Address Translator (NAT) traversal mechanism for UDP-based multimedia sessions established with the Offer/Answer model. The ICE extension for Incremental Provisioning of Candidates (Trickle ICE) defines a mechanism that allows ICE Agents to shorten session establishment delays by making the candidate gathering and connectivity checking phases of ICE non-blocking and by executing them in parallel.</t>
              <t>This document defines usage semantics for Trickle ICE with the Session Initiation Protocol (SIP). The document also defines a new SIP Info Package to support this usage together with the corresponding media type. Additionally, a new Session Description Protocol (SDP) "end-of-candidates" attribute and a new SIP option tag "trickle-ice" are defined.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8840"/>
          <seriesInfo name="DOI" value="10.17487/RFC8840"/>
        </reference>
        <reference anchor="RFC8863">
          <front>
            <title>Interactive Connectivity Establishment Patiently Awaiting Connectivity (ICE PAC)</title>
            <author fullname="C. Holmberg" initials="C." surname="Holmberg"/>
            <author fullname="J. Uberti" initials="J." surname="Uberti"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>During the process of establishing peer-to-peer connectivity, Interactive Connectivity Establishment (ICE) agents can encounter situations where they have no candidate pairs to check, and, as a result, conclude that ICE processing has failed. However, because additional candidate pairs can be discovered during ICE processing, declaring failure at this point may be premature. This document discusses when these situations can occur.</t>
              <t>This document updates RFCs 8445 and 8838 by requiring that an ICE agent wait a minimum amount of time before declaring ICE failure, even if there are no candidate pairs left to check.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8863"/>
          <seriesInfo name="DOI" value="10.17487/RFC8863"/>
        </reference>
        <reference anchor="RFC6585">
          <front>
            <title>Additional HTTP Status Codes</title>
            <author fullname="M. Nottingham" initials="M." surname="Nottingham"/>
            <author fullname="R. Fielding" initials="R." surname="Fielding"/>
            <date month="April" year="2012"/>
            <abstract>
              <t>This document specifies additional HyperText Transfer Protocol (HTTP) status codes for a variety of common situations. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6585"/>
          <seriesInfo name="DOI" value="10.17487/RFC6585"/>
        </reference>
        <reference anchor="RFC9143">
          <front>
            <title>Negotiating Media Multiplexing Using the Session Description Protocol (SDP)</title>
            <author fullname="C. Holmberg" initials="C." surname="Holmberg"/>
            <author fullname="H. Alvestrand" initials="H." surname="Alvestrand"/>
            <author fullname="C. Jennings" initials="C." surname="Jennings"/>
            <date month="February" year="2022"/>
            <abstract>
              <t>This specification defines a new Session Description Protocol (SDP) Grouping Framework extension called 'BUNDLE'. The extension can be used with the SDP offer/answer mechanism to negotiate the usage of a single transport (5-tuple) for sending and receiving media described by multiple SDP media descriptions ("m=" sections). Such transport is referred to as a "BUNDLE transport", and the media is referred to as "bundled media". The "m=" sections that use the BUNDLE transport form a BUNDLE group.</t>
              <t>This specification defines a new RTP Control Protocol (RTCP) Source Description (SDES) item and a new RTP header extension.</t>
              <t>This specification updates RFCs 3264, 5888, and 7941.</t>
              <t>This specification obsoletes RFC 8843.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="9143"/>
          <seriesInfo name="DOI" value="10.17487/RFC9143"/>
        </reference>
        <reference anchor="RFC8858">
          <front>
            <title>Indicating Exclusive Support of RTP and RTP Control Protocol (RTCP) Multiplexing Using the Session Description Protocol (SDP)</title>
            <author fullname="C. Holmberg" initials="C." surname="Holmberg"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>This document defines a new Session Description Protocol (SDP) media-level attribute, 'rtcp-mux-only', that can be used by an endpoint to indicate exclusive support of RTP and RTP Control Protocol (RTCP) multiplexing. The document also updates RFC 5761 by clarifying that an offerer can use a mechanism to indicate that it is not able to send and receive RTCP on separate ports.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8858"/>
          <seriesInfo name="DOI" value="10.17487/RFC8858"/>
        </reference>
        <reference anchor="RFC8830">
          <front>
            <title>WebRTC MediaStream Identification in the Session Description Protocol</title>
            <author fullname="H. Alvestrand" initials="H." surname="Alvestrand"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>This document specifies a Session Description Protocol (SDP) grouping mechanism for RTP media streams that can be used to specify relations between media streams.</t>
              <t>This mechanism is used to signal the association between the SDP concept of "media description" and the Web Real-Time Communication (WebRTC) concept of MediaStream/MediaStreamTrack using SDP signaling.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8830"/>
          <seriesInfo name="DOI" value="10.17487/RFC8830"/>
        </reference>
        <reference anchor="RFC8842">
          <front>
            <title>Session Description Protocol (SDP) Offer/Answer Considerations for Datagram Transport Layer Security (DTLS) and Transport Layer Security (TLS)</title>
            <author fullname="C. Holmberg" initials="C." surname="Holmberg"/>
            <author fullname="R. Shpount" initials="R." surname="Shpount"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>This document defines the Session Description Protocol (SDP) offer/answer procedures for negotiating and establishing a Datagram Transport Layer Security (DTLS) association. The document also defines the criteria for when a new DTLS association must be established. The document updates RFCs 5763 and 7345 by replacing common SDP offer/answer procedures with a reference to this specification.</t>
              <t>This document defines a new SDP media-level attribute, "tls-id".</t>
              <t>This document also defines how the "tls-id" attribute can be used for negotiating and establishing a Transport Layer Security (TLS) connection, in conjunction with the procedures in RFCs 4145 and 8122.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8842"/>
          <seriesInfo name="DOI" value="10.17487/RFC8842"/>
        </reference>
        <reference anchor="RFC8288">
          <front>
            <title>Web Linking</title>
            <author fullname="M. Nottingham" initials="M." surname="Nottingham"/>
            <date month="October" year="2017"/>
            <abstract>
              <t>This specification defines a model for the relationships between resources on the Web ("links") and the type of those relationships ("link relation types").</t>
              <t>It also defines the serialisation of such links in HTTP headers with the Link header field.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8288"/>
          <seriesInfo name="DOI" value="10.17487/RFC8288"/>
        </reference>
        <reference anchor="RFC7064">
          <front>
            <title>URI Scheme for the Session Traversal Utilities for NAT (STUN) Protocol</title>
            <author fullname="S. Nandakumar" initials="S." surname="Nandakumar"/>
            <author fullname="G. Salgueiro" initials="G." surname="Salgueiro"/>
            <author fullname="P. Jones" initials="P." surname="Jones"/>
            <author fullname="M. Petit-Huguenin" initials="M." surname="Petit-Huguenin"/>
            <date month="November" year="2013"/>
            <abstract>
              <t>This document specifies the syntax and semantics of the Uniform Resource Identifier (URI) scheme for the Session Traversal Utilities for NAT (STUN) protocol.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7064"/>
          <seriesInfo name="DOI" value="10.17487/RFC7064"/>
        </reference>
        <reference anchor="RFC7065">
          <front>
            <title>Traversal Using Relays around NAT (TURN) Uniform Resource Identifiers</title>
            <author fullname="M. Petit-Huguenin" initials="M." surname="Petit-Huguenin"/>
            <author fullname="S. Nandakumar" initials="S." surname="Nandakumar"/>
            <author fullname="G. Salgueiro" initials="G." surname="Salgueiro"/>
            <author fullname="P. Jones" initials="P." surname="Jones"/>
            <date month="November" year="2013"/>
            <abstract>
              <t>This document specifies the syntax of Uniform Resource Identifier (URI) schemes for the Traversal Using Relays around NAT (TURN) protocol. It defines two URI schemes to provision the TURN Resolution Mechanism (RFC 5928).</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7065"/>
          <seriesInfo name="DOI" value="10.17487/RFC7065"/>
        </reference>
        <reference anchor="RFC8489">
          <front>
            <title>Session Traversal Utilities for NAT (STUN)</title>
            <author fullname="M. Petit-Huguenin" initials="M." surname="Petit-Huguenin"/>
            <author fullname="G. Salgueiro" initials="G." surname="Salgueiro"/>
            <author fullname="J. Rosenberg" initials="J." surname="Rosenberg"/>
            <author fullname="D. Wing" initials="D." surname="Wing"/>
            <author fullname="R. Mahy" initials="R." surname="Mahy"/>
            <author fullname="P. Matthews" initials="P." surname="Matthews"/>
            <date month="February" year="2020"/>
            <abstract>
              <t>Session Traversal Utilities for NAT (STUN) is a protocol that serves as a tool for other protocols in dealing with NAT traversal. It can be used by an endpoint to determine the IP address and port allocated to it by a NAT. It can also be used to check connectivity between two endpoints and as a keep-alive protocol to maintain NAT bindings. STUN works with many existing NATs and does not require any special behavior from them.</t>
              <t>STUN is not a NAT traversal solution by itself. Rather, it is a tool to be used in the context of a NAT traversal solution.</t>
              <t>This document obsoletes RFC 5389.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8489"/>
          <seriesInfo name="DOI" value="10.17487/RFC8489"/>
        </reference>
        <reference anchor="RFC8819">
          <front>
            <title>YANG Module Tags</title>
            <author fullname="C. Hopps" initials="C." surname="Hopps"/>
            <author fullname="L. Berger" initials="L." surname="Berger"/>
            <author fullname="D. Bogdanovic" initials="D." surname="Bogdanovic"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>This document provides for the association of tags with YANG modules. The expectation is for such tags to be used to help classify and organize modules. A method for defining, reading, and writing modules tags is provided. Tags may be registered and assigned during module definition, assigned by implementations, or dynamically defined and set by users. This document also provides guidance to future model writers; as such, this document updates RFC 8407.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8819"/>
          <seriesInfo name="DOI" value="10.17487/RFC8819"/>
        </reference>
        <reference anchor="RFC6750">
          <front>
            <title>The OAuth 2.0 Authorization Framework: Bearer Token Usage</title>
            <author fullname="M. Jones" initials="M." surname="Jones"/>
            <author fullname="D. Hardt" initials="D." surname="Hardt"/>
            <date month="October" year="2012"/>
            <abstract>
              <t>This specification describes how to use bearer tokens in HTTP requests to access OAuth 2.0 protected resources. Any party in possession of a bearer token (a "bearer") can use it to get access to the associated resources (without demonstrating possession of a cryptographic key). To prevent misuse, bearer tokens need to be protected from disclosure in storage and in transport. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6750"/>
          <seriesInfo name="DOI" value="10.17487/RFC6750"/>
        </reference>
        <reference anchor="RFC8725">
          <front>
            <title>JSON Web Token Best Current Practices</title>
            <author fullname="Y. Sheffer" initials="Y." surname="Sheffer"/>
            <author fullname="D. Hardt" initials="D." surname="Hardt"/>
            <author fullname="M. Jones" initials="M." surname="Jones"/>
            <date month="February" year="2020"/>
            <abstract>
              <t>JSON Web Tokens, also known as JWTs, are URL-safe JSON-based security tokens that contain a set of claims that can be signed and/or encrypted. JWTs are being widely used and deployed as a simple security token format in numerous protocols and applications, both in the area of digital identity and in other application areas. This Best Current Practices document updates RFC 7519 to provide actionable guidance leading to secure implementation and deployment of JWTs.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="225"/>
          <seriesInfo name="RFC" value="8725"/>
          <seriesInfo name="DOI" value="10.17487/RFC8725"/>
        </reference>
        <reference anchor="RFC8853">
          <front>
            <title>Using Simulcast in Session Description Protocol (SDP) and RTP Sessions</title>
            <author fullname="B. Burman" initials="B." surname="Burman"/>
            <author fullname="M. Westerlund" initials="M." surname="Westerlund"/>
            <author fullname="S. Nandakumar" initials="S." surname="Nandakumar"/>
            <author fullname="M. Zanaty" initials="M." surname="Zanaty"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>In some application scenarios, it may be desirable to send multiple differently encoded versions of the same media source in different RTP streams. This is called simulcast. This document describes how to accomplish simulcast in RTP and how to signal it in the Session Description Protocol (SDP). The described solution uses an RTP/RTCP identification method to identify RTP streams belonging to the same media source and makes an extension to SDP to indicate that those RTP streams are different simulcast formats of that media source. The SDP extension consists of a new media-level SDP attribute that expresses capability to send and/or receive simulcast RTP streams.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8853"/>
          <seriesInfo name="DOI" value="10.17487/RFC8853"/>
        </reference>
        <reference anchor="RFC8826">
          <front>
            <title>Security Considerations for WebRTC</title>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <date month="January" year="2021"/>
            <abstract>
              <t>WebRTC is a protocol suite for use with real-time applications that can be deployed in browsers -- "real-time communication on the Web". This document defines the WebRTC threat model and analyzes the security threats of WebRTC in that model.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8826"/>
          <seriesInfo name="DOI" value="10.17487/RFC8826"/>
        </reference>
        <reference anchor="RFC8446">
          <front>
            <title>The Transport Layer Security (TLS) Protocol Version 1.3</title>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <date month="August" year="2018"/>
            <abstract>
              <t>This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.</t>
              <t>This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8446"/>
          <seriesInfo name="DOI" value="10.17487/RFC8446"/>
        </reference>
        <reference anchor="RFC9147">
          <front>
            <title>The Datagram Transport Layer Security (DTLS) Protocol Version 1.3</title>
            <author fullname="E. Rescorla" initials="E." surname="Rescorla"/>
            <author fullname="H. Tschofenig" initials="H." surname="Tschofenig"/>
            <author fullname="N. Modadugu" initials="N." surname="Modadugu"/>
            <date month="April" year="2022"/>
            <abstract>
              <t>This document specifies version 1.3 of the Datagram Transport Layer Security (DTLS) protocol. DTLS 1.3 allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery.</t>
              <t>The DTLS 1.3 protocol is based on the Transport Layer Security (TLS) 1.3 protocol and provides equivalent security guarantees with the exception of order protection / non-replayability. Datagram semantics of the underlying transport are preserved by the DTLS protocol.</t>
              <t>This document obsoletes RFC 6347.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="9147"/>
          <seriesInfo name="DOI" value="10.17487/RFC9147"/>
        </reference>
        <reference anchor="RFC9112">
          <front>
            <title>HTTP/1.1</title>
            <author fullname="R. Fielding" initials="R." role="editor" surname="Fielding"/>
            <author fullname="M. Nottingham" initials="M." role="editor" surname="Nottingham"/>
            <author fullname="J. Reschke" initials="J." role="editor" surname="Reschke"/>
            <date month="June" year="2022"/>
            <abstract>
              <t>The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document specifies the HTTP/1.1 message syntax, message parsing, connection management, and related security concerns.</t>
              <t>This document obsoletes portions of RFC 7230.</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="99"/>
          <seriesInfo name="RFC" value="9112"/>
          <seriesInfo name="DOI" value="10.17487/RFC9112"/>
        </reference>
        <reference anchor="RFC3986">
          <front>
            <title>Uniform Resource Identifier (URI): Generic Syntax</title>
            <author fullname="T. Berners-Lee" initials="T." surname="Berners-Lee"/>
            <author fullname="R. Fielding" initials="R." surname="Fielding"/>
            <author fullname="L. Masinter" initials="L." surname="Masinter"/>
            <date month="January" year="2005"/>
            <abstract>
              <t>A Uniform Resource Identifier (URI) is a compact sequence of characters that identifies an abstract or physical resource. This specification defines the generic URI syntax and a process for resolving URI references that might be in relative form, along with guidelines and security considerations for the use of URIs on the Internet. The URI syntax defines a grammar that is a superset of all valid URIs, allowing an implementation to parse the common components of a URI reference without knowing the scheme-specific requirements of every possible identifier. This specification does not define a generative grammar for URIs; that task is performed by the individual specifications of each URI scheme. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="STD" value="66"/>
          <seriesInfo name="RFC" value="3986"/>
          <seriesInfo name="DOI" value="10.17487/RFC3986"/>
        </reference>
        <reference anchor="RFC4086">
          <front>
            <title>Randomness Requirements for Security</title>
            <author fullname="D. Eastlake 3rd" initials="D." surname="Eastlake 3rd"/>
            <author fullname="J. Schiller" initials="J." surname="Schiller"/>
            <author fullname="S. Crocker" initials="S." surname="Crocker"/>
            <date month="June" year="2005"/>
            <abstract>
              <t>Security systems are built on strong cryptographic algorithms that foil pattern analysis attempts. However, the security of these systems is dependent on generating secret quantities for passwords, cryptographic keys, and similar quantities. The use of pseudo-random processes to generate secret quantities can result in pseudo-security. A sophisticated attacker may find it easier to reproduce the environment that produced the secret quantities and to search the resulting small set of possibilities than to locate the quantities in the whole of the potential number space.</t>
              <t>Choosing random quantities to foil a resourceful and motivated adversary is surprisingly difficult. This document points out many pitfalls in using poor entropy sources or traditional pseudo-random number generation techniques for generating such quantities. It recommends the use of truly random hardware techniques and shows that the existing hardware on many systems can be used for this purpose. It provides suggestions to ameliorate the problem when a hardware solution is not available, and it gives examples of how large such quantities need to be for some applications. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="106"/>
          <seriesInfo name="RFC" value="4086"/>
          <seriesInfo name="DOI" value="10.17487/RFC4086"/>
        </reference>
        <reference anchor="RFC4122">
          <front>
            <title>A Universally Unique IDentifier (UUID) URN Namespace</title>
            <author fullname="P. Leach" initials="P." surname="Leach"/>
            <author fullname="M. Mealling" initials="M." surname="Mealling"/>
            <author fullname="R. Salz" initials="R." surname="Salz"/>
            <date month="July" year="2005"/>
            <abstract>
              <t>This specification defines a Uniform Resource Name namespace for UUIDs (Universally Unique IDentifier), also known as GUIDs (Globally Unique IDentifier). A UUID is 128 bits long, and can guarantee uniqueness across space and time. UUIDs were originally used in the Apollo Network Computing System and later in the Open Software Foundation\'s (OSF) Distributed Computing Environment (DCE), and then in Microsoft Windows platforms.</t>
              <t>This specification is derived from the DCE specification with the kind permission of the OSF (now known as The Open Group). Information from earlier versions of the DCE specification have been incorporated into this document. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="4122"/>
          <seriesInfo name="DOI" value="10.17487/RFC4122"/>
        </reference>
        <reference anchor="RFC3553">
          <front>
            <title>An IETF URN Sub-namespace for Registered Protocol Parameters</title>
            <author fullname="M. Mealling" initials="M." surname="Mealling"/>
            <author fullname="L. Masinter" initials="L." surname="Masinter"/>
            <author fullname="T. Hardie" initials="T." surname="Hardie"/>
            <author fullname="G. Klyne" initials="G." surname="Klyne"/>
            <date month="June" year="2003"/>
            <abstract>
              <t>This document describes a new sub-delegation for the 'ietf' URN namespace for registered protocol items. The 'ietf' URN namespace is defined in RFC 2648 as a root for persistent URIs that refer to IETF- defined resources. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
            </abstract>
          </front>
          <seriesInfo name="BCP" value="73"/>
          <seriesInfo name="RFC" value="3553"/>
          <seriesInfo name="DOI" value="10.17487/RFC3553"/>
        </reference>
        <referencegroup anchor="BCP26" target="https://www.rfc-editor.org/info/bcp26">
          <reference anchor="RFC8126" target="https://www.rfc-editor.org/info/rfc8126">
            <front>
              <title>Guidelines for Writing an IANA Considerations Section in RFCs</title>
              <author fullname="M. Cotton" initials="M." surname="Cotton"/>
              <author fullname="B. Leiba" initials="B." surname="Leiba"/>
              <author fullname="T. Narten" initials="T." surname="Narten"/>
              <date month="June" year="2017"/>
              <abstract>
                <t>Many protocols make use of points of extensibility that use constants to identify various protocol parameters. To ensure that the values in these fields do not have conflicting uses and to promote interoperability, their allocations are often coordinated by a central record keeper. For IETF protocols, that role is filled by the Internet Assigned Numbers Authority (IANA).</t>
                <t>To make assignments in a given registry prudently, guidance describing the conditions under which new values should be assigned, as well as when and how modifications to existing values can be made, is needed. This document defines a framework for the documentation of these guidelines by specification authors, in order to assure that the provided guidance for the IANA Considerations is clear and addresses the various issues that are likely in the operation of a registry.</t>
                <t>This is the third edition of this document; it obsoletes RFC 5226.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="26"/>
            <seriesInfo name="RFC" value="8126"/>
            <seriesInfo name="DOI" value="10.17487/RFC8126"/>
          </reference>
        </referencegroup>
        <referencegroup anchor="BCP9" target="https://www.rfc-editor.org/info/bcp9">
          <reference anchor="RFC2026" target="https://www.rfc-editor.org/info/rfc2026">
            <front>
              <title>The Internet Standards Process -- Revision 3</title>
              <author fullname="S. Bradner" initials="S." surname="Bradner"/>
              <date month="October" year="1996"/>
              <abstract>
                <t>This memo documents the process used by the Internet community for the standardization of protocols and procedures. It defines the stages in the standardization process, the requirements for moving a document between stages and the types of documents used during this process. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="2026"/>
            <seriesInfo name="DOI" value="10.17487/RFC2026"/>
          </reference>
          <reference anchor="RFC5657" target="https://www.rfc-editor.org/info/rfc5657">
            <front>
              <title>Guidance on Interoperation and Implementation Reports for Advancement to Draft Standard</title>
              <author fullname="L. Dusseault" initials="L." surname="Dusseault"/>
              <author fullname="R. Sparks" initials="R." surname="Sparks"/>
              <date month="September" year="2009"/>
              <abstract>
                <t>Advancing a protocol to Draft Standard requires documentation of the interoperation and implementation of the protocol. Historic reports have varied widely in form and level of content and there is little guidance available to new report preparers. This document updates the existing processes and provides more detail on what is appropriate in an interoperability and implementation report. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="5657"/>
            <seriesInfo name="DOI" value="10.17487/RFC5657"/>
          </reference>
          <reference anchor="RFC6410" target="https://www.rfc-editor.org/info/rfc6410">
            <front>
              <title>Reducing the Standards Track to Two Maturity Levels</title>
              <author fullname="R. Housley" initials="R." surname="Housley"/>
              <author fullname="D. Crocker" initials="D." surname="Crocker"/>
              <author fullname="E. Burger" initials="E." surname="Burger"/>
              <date month="October" year="2011"/>
              <abstract>
                <t>This document updates the Internet Engineering Task Force (IETF) Standards Process defined in RFC 2026. Primarily, it reduces the Standards Process from three Standards Track maturity levels to two. This memo documents an Internet Best Current Practice.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="6410"/>
            <seriesInfo name="DOI" value="10.17487/RFC6410"/>
          </reference>
          <reference anchor="RFC7100" target="https://www.rfc-editor.org/info/rfc7100">
            <front>
              <title>Retirement of the "Internet Official Protocol Standards" Summary Document</title>
              <author fullname="P. Resnick" initials="P." surname="Resnick"/>
              <date month="December" year="2013"/>
              <abstract>
                <t>This document updates RFC 2026 to no longer use STD 1 as a summary of "Internet Official Protocol Standards". It obsoletes RFC 5000 and requests the IESG to move RFC 5000 (and therefore STD 1) to Historic status.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="7100"/>
            <seriesInfo name="DOI" value="10.17487/RFC7100"/>
          </reference>
          <reference anchor="RFC7127" target="https://www.rfc-editor.org/info/rfc7127">
            <front>
              <title>Characterization of Proposed Standards</title>
              <author fullname="O. Kolkman" initials="O." surname="Kolkman"/>
              <author fullname="S. Bradner" initials="S." surname="Bradner"/>
              <author fullname="S. Turner" initials="S." surname="Turner"/>
              <date month="January" year="2014"/>
              <abstract>
                <t>RFC 2026 describes the review performed by the Internet Engineering Steering Group (IESG) on IETF Proposed Standard RFCs and characterizes the maturity level of those documents. This document updates RFC 2026 by providing a current and more accurate characterization of Proposed Standards.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="7127"/>
            <seriesInfo name="DOI" value="10.17487/RFC7127"/>
          </reference>
          <reference anchor="RFC7475" target="https://www.rfc-editor.org/info/rfc7475">
            <front>
              <title>Increasing the Number of Area Directors in an IETF Area</title>
              <author fullname="S. Dawkins" initials="S." surname="Dawkins"/>
              <date month="March" year="2015"/>
              <abstract>
                <t>This document removes a limit on the number of Area Directors who manage an Area in the definition of "IETF Area". This document updates RFC 2026 (BCP 9) and RFC 2418 (BCP 25).</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="7475"/>
            <seriesInfo name="DOI" value="10.17487/RFC7475"/>
          </reference>
          <reference anchor="RFC8789" target="https://www.rfc-editor.org/info/rfc8789">
            <front>
              <title>IETF Stream Documents Require IETF Rough Consensus</title>
              <author fullname="J. Halpern" initials="J." role="editor" surname="Halpern"/>
              <author fullname="E. Rescorla" initials="E." role="editor" surname="Rescorla"/>
              <date month="June" year="2020"/>
              <abstract>
                <t>This document requires that the IETF never publish any IETF Stream RFCs without IETF rough consensus. This updates RFC 2026.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="8789"/>
            <seriesInfo name="DOI" value="10.17487/RFC8789"/>
          </reference>
          <reference anchor="RFC9282" target="https://www.rfc-editor.org/info/rfc9282">
            <front>
              <title>Responsibility Change for the RFC Series</title>
              <author fullname="B. Rosen" initials="B." surname="Rosen"/>
              <date month="June" year="2022"/>
              <abstract>
                <t>In RFC 9280, responsibility for the RFC Series moved to the RFC Series Working Group and the RFC Series Approval Board. It is no longer the responsibility of the RFC Editor, and the role of the IAB in the RFC Series is altered. Accordingly, in Section 2.1 of RFC 2026, the sentence "RFC publication is the direct responsibility of the RFC Editor, under the general direction of the IAB" is deleted.</t>
              </abstract>
            </front>
            <seriesInfo name="BCP" value="9"/>
            <seriesInfo name="RFC" value="9282"/>
            <seriesInfo name="DOI" value="10.17487/RFC9282"/>
          </reference>
        </referencegroup>
      </references>
      <references anchor="sec-informative-references">
        <name>Informative References</name>
        <reference anchor="RFC3261">
          <front>
            <title>SIP: Session Initiation Protocol</title>
            <author fullname="J. Rosenberg" initials="J." surname="Rosenberg"/>
            <author fullname="H. Schulzrinne" initials="H." surname="Schulzrinne"/>
            <author fullname="G. Camarillo" initials="G." surname="Camarillo"/>
            <author fullname="A. Johnston" initials="A." surname="Johnston"/>
            <author fullname="J. Peterson" initials="J." surname="Peterson"/>
            <author fullname="R. Sparks" initials="R." surname="Sparks"/>
            <author fullname="M. Handley" initials="M." surname="Handley"/>
            <author fullname="E. Schooler" initials="E." surname="Schooler"/>
            <date month="June" year="2002"/>
            <abstract>
              <t>This document describes Session Initiation Protocol (SIP), an application-layer control (signaling) protocol for creating, modifying, and terminating sessions with one or more participants. These sessions include Internet telephone calls, multimedia distribution, and multimedia conferences. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="3261"/>
          <seriesInfo name="DOI" value="10.17487/RFC3261"/>
        </reference>
        <reference anchor="RFC6120">
          <front>
            <title>Extensible Messaging and Presence Protocol (XMPP): Core</title>
            <author fullname="P. Saint-Andre" initials="P." surname="Saint-Andre"/>
            <date month="March" year="2011"/>
            <abstract>
              <t>The Extensible Messaging and Presence Protocol (XMPP) is an application profile of the Extensible Markup Language (XML) that enables the near-real-time exchange of structured yet extensible data between any two or more network entities. This document defines XMPP's core protocol methods: setup and teardown of XML streams, channel encryption, authentication, error handling, and communication primitives for messaging, network availability ("presence"), and request-response interactions. This document obsoletes RFC 3920. [STANDARDS-TRACK]</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="6120"/>
          <seriesInfo name="DOI" value="10.17487/RFC6120"/>
        </reference>
        <reference anchor="RFC7826">
          <front>
            <title>Real-Time Streaming Protocol Version 2.0</title>
            <author fullname="H. Schulzrinne" initials="H." surname="Schulzrinne"/>
            <author fullname="A. Rao" initials="A." surname="Rao"/>
            <author fullname="R. Lanphier" initials="R." surname="Lanphier"/>
            <author fullname="M. Westerlund" initials="M." surname="Westerlund"/>
            <author fullname="M. Stiemerling" initials="M." role="editor" surname="Stiemerling"/>
            <date month="December" year="2016"/>
            <abstract>
              <t>This memorandum defines the Real-Time Streaming Protocol (RTSP) version 2.0, which obsoletes RTSP version 1.0 defined in RFC 2326.</t>
              <t>RTSP is an application-layer protocol for the setup and control of the delivery of data with real-time properties. RTSP provides an extensible framework to enable controlled, on-demand delivery of real-time data, such as audio and video. Sources of data can include both live data feeds and stored clips. This protocol is intended to control multiple data delivery sessions; provide a means for choosing delivery channels such as UDP, multicast UDP, and TCP; and provide a means for choosing delivery mechanisms based upon RTP (RFC 3550).</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="7826"/>
          <seriesInfo name="DOI" value="10.17487/RFC7826"/>
        </reference>
        <reference anchor="W3C.REC-webrtc-20210126" target="https://www.w3.org/TR/2021/REC-webrtc-20210126/">
          <front>
            <title>WebRTC 1.0: Real-Time Communication Between Browsers</title>
            <author fullname="Cullen Jennings" role="editor"/>
            <author fullname="Henrik Boström" role="editor"/>
            <author fullname="Jan-Ivar Bruaroey" role="editor"/>
            <date day="26" month="January" year="2021"/>
          </front>
          <seriesInfo name="W3C REC" value="REC-webrtc-20210126"/>
          <seriesInfo name="W3C" value="REC-webrtc-20210126"/>
        </reference>
        <reference anchor="RFC8141">
          <front>
            <title>Uniform Resource Names (URNs)</title>
            <author fullname="P. Saint-Andre" initials="P." surname="Saint-Andre"/>
            <author fullname="J. Klensin" initials="J." surname="Klensin"/>
            <date month="April" year="2017"/>
            <abstract>
              <t>A Uniform Resource Name (URN) is a Uniform Resource Identifier (URI) that is assigned under the "urn" URI scheme and a particular URN namespace, with the intent that the URN will be a persistent, location-independent resource identifier. With regard to URN syntax, this document defines the canonical syntax for URNs (in a way that is consistent with URI syntax), specifies methods for determining URN-equivalence, and discusses URI conformance. With regard to URN namespaces, this document specifies a method for defining a URN namespace and associating it with a namespace identifier, and it describes procedures for registering namespace identifiers with the Internet Assigned Numbers Authority (IANA). This document obsoletes both RFCs 2141 and 3406.</t>
            </abstract>
          </front>
          <seriesInfo name="RFC" value="8141"/>
          <seriesInfo name="DOI" value="10.17487/RFC8141"/>
        </reference>
      </references>
    </references>
    <?line 656?>



  </back>
  <!-- ##markdown-source:
H4sIAAAAAAAAA+1923bbSJLgO78il/UwUhdJkRQlUah2VdOS7FK3L2pJLned
OXP2gECSRJsEOAAomXZ5v2W/Zb9s45JXAJTkuszl7HrOdNkgkBkZGfeIjOx2
u604i9JwJQMR5+Gs7CaynHXvk2LRvV8k6+5g0CqTcgk/v5fT69uz7o+3t1ci
SeeyKJMsFes8K7MoW4q99z9eXu23wuk0l3eBwI9bUVjKeZZvA1GUcStZ54Eo
801RDvv90/6wFeYyDMTk+rZ1n+Uf5nm2WcOHMHVrs47h0yIQ4/Fo2MH/7bda
H+QW3os1JK1WUYZp/D/DZZYCeFtZtNZJIP4VwOmIIsvLXM4K+Nt2hX/5t1Yr
3JSLLA9aotsS8CdJYfybnni9yZPlMqNnjIgbmc+TTLwM8ygJvd+zfB6myacQ
lx6I1/A8icKipN/kKkyWsFL6uDenj3sr/vgvUVassiKblfew6F6SeUBMeuJl
toGvl2EeO3BMlvIjrDCX1Z99MM6ym9eZuFGDu7CEMEBvbr6tQ9FKs3wFw9xJ
QIt4cXF79mNAAxhcCTUfYP3Hye37l/REUcQLWUYL0RWvkjsgCHGD26FBLMN8
LstALMpyXQQHBzN8t1esZdS7X4Tl/bwHg6rhW91uV4TToszDqGy1bhdJIYAq
NyuZliKWRZQnU1mIUBTJar2UAkmwOw0LGVvyK2FQoJ3lEha9zO41tfJbllyz
mYiytMSBk7TMgC6BBlcIPezbXRLhNGl8kOXi7PxN0asCo+hSXL84I9LEl/U/
+vA2LmSVxPFStlrfiMu0zLN4E+HMOJIUlxe3LwTA9f7iuUCax4mJ7kWhkJd8
Anj/enNxJfY+f/4fMPR4PDz98mW/A8tfyWgB+16sxAZXBeDjWnJavYQFlJt1
R6zCNJxLhLZD0JUSRs3uaekwxGZZJisZA10XsigAsJ64LAFnReZgegEIhNFT
YN4ygQUL/mIGiC1gboQaZ3w7m8n8YJIW9zIXr7NYLmEHygX9dsOji3MadE3I
vzKy4ub8al/w+g6Hx6MvX2A3ouUm1iPPiCwL/K8AjCOwgP3sDubBn+8T4Ik9
2Zv3Ogq0cruWwOwRABGJdZgD/5QyLxgFMo3yLYGw31OEgbsPQ8IjIJctbDCs
Os1KgQSazLZEa3P4jQDKw7RYg0Cx1Aa0Fq7XyPy0sKW8k0vY/ncpAFxuUkDZ
ctshUJdh9IFR7+2wHd1uapJq4BZhIaZSpgC9yIAvwgioHjYkjDPGZIhk2iSF
Ef8wDs48zbMwRul0YIk8SWMQvznAdr+QgMNQMQBAwsykqFWsk7XEhwKovww/
ACi4FXPARClBAq+XGxxMROF0CZiLwjzf4vh5eK83JINV5DEKGsQ/7AvuBsAF
Y28KphF+HtsvwnRb50iBzKh49hyAAiLYijeyRP4Re8Cm+woRijIbEQOb836R
ABYVhiN4ayqJCmBRsCamXL1Hzv7oEQqxTD4AXV9eAeH+wIQ7AMIF6P7x+ko/
PB4M+1++0EKBiGDtSFTAWDAccyxMumGRZDcIpjmoCyLFvrRPsAvEomlGkBFB
aVqg7Q5Ls7c9EDA3Gp6T8fAY4QF1DKIahmGBCJ9d3151HLrfrInCiXXPr2AC
ZO2QWXtFrO2xK1KDFg+aaYGOUYDLPIElRQUCiY99aVOVqIDedVa40t3QsgGV
TA6cUUGJE6p9BEbg8e2WA+cvsphXHIBIFpeFkGGxRezTDCQb+Xlof4JdwX+u
s/UGdKW41BrG7JKlBP52tkHJEWUwZAJswQSkwUK1wGIeJQp+cZEyrzi6CEgg
Q3GZh3HCokgtZr0MSxSBpIz0mDKNu2XWhf/Y34FGokUi7/QWgIBGRgCMFgnM
BtIH2Cba9mD+V/BTXtBbufz3DUhQxENhoKhxK83t0qhVkag4FcEwcD1GyabA
NfJ4QJb3cooD3Bd6NHjGHIYmm5moh7ryVuZA/dkym29ZVYK1hyoyLkT79bub
23aH/yvevKW/X1/8/d3l9cU5/v3mx8mrV+YvLfXGzY9v3706t3+zX569ff36
4s05fwxPhfeo1X49+bnN3Nd+e3V7+fbN5FWb2cylXMQVMzRKkXydSxQjYdHS
epTW+/zs6v/878FIcc9wMABlrv4xHpwgK4EkTnm2LAWC4n+i/GiBigHljaOA
kgKRtU5KkAIdJNNigSodZQNg70//ipj5t0D8eRqtB6Pv1QNcsPdQ48x7SDir
P6l9zEhseNQwjcGm97yCaR/eyc/evzXenYd//oEUUncw/uH7FpLM2zukR3nP
9OK6J5esD6583wTFnyuKZ2GULAGlJepBIMguWkZCfkR9PJcovp5gxJCgZOpm
aakNJALk6i1sA7IbgFP0BIk+MwEKdZAiwA5IT8D8RSnXuNvwMvAR+EFKnV0i
fYFkBdWHmjCV+Nek3IoL/SIR5N7l2cU+QXIOJhOotZW4NabLq3ALkvxGRuCQ
wJd757evbva1VAYiLu/R3kDpgLgS0TIhC5L1Ri6BugsSF1Zv56j6lLwiw0Hm
RmUZoZ/f4VPPHGE7RAtBEGfrDBgIrac1/LvYRCBhChCuFg20OqVNYI0HCLsG
vSM2aRKDNIs8CUpGIxluq4SXCIIaxkHpNcuzVXWlSA9VuMkyhk0CpQEYDPkl
UJaS9S2qyVwaJZilhVH4SjiyBMBZ0EwFI4+kNHwKahx0ajJT9mOhZ2+vnrVh
8ogfKhtlFcZAoLNS2b5JCroC1lnT0oau7mAFlvpgAaSjWDppKQNoBOCXIcPI
5jZhiedkPyd2hpqAa2goGSVQLGdkNMIKbxhiMeoNesyMswydMFwvoJMoETwz
tE7IeyJjIQNcZWuga+2XmR0xBgCqfF5uyZyA3gyqCf1vbfgpWgBt/7/wj3Ir
f7c/LfFt1/3zLT70H+HDbx950P22JX7xiO4XHEg90owA//5FvCYyvCEypAf0
iuZW8QtB9K07lwfRtz4A35q3zCu/GIgIgl1/fnnwn+6j33kgS78oZtnT3P8V
A1W3wPz5/tuvhGjYH4gzsNGRLQgmZrv9r4boz7tA+lqI7HPkZlTuF4Cv3V/t
hGgXQI+g7HGIbq7evrm5+HqIftmJo4dR9hBEpDRuLm7fXdW/eQpEz5705/uv
2DXwwA7AZLkSL169ff/VEO2mo6/eNWK284tXF7cNe/Xgn19FRw8BqSAa9vvi
7d++Epg6RE8lo6Y/H92Bfsc/SkV9DjiK+qztiXYK4nlxu7b4hgLxWit2jdL8
wrpWLpUnB5r48+dd734h48S6JmGhlHRBPrKjlQI2Uys2n3JC2T5yDEBr+rGp
CPasMl8wRqUVXaN6n255IK3bYw7ucFBMR4QAjlVWVgwzDbDWmQrkWKJ1Vigz
SVkGOQcNweoCG1HCBIVnRtE4yq6pjSveXb8KxLUkE1/ZaPDIW455F7AFBiz7
3Wi5RKgstGPubjJO4y5HQZ80IFqBj6PB0OB35rVpPGehFm+xAVnX7kBsMzb8
j0xovNT7WhicaBsLZHsao+GqEInh9oi0IokRAC/b5JHE3a3jCAEGIzVeKvst
S+eZ9QdcBHlcQdvwyD6YiS1AO0EIVZw3iSrRKXFbwRTaw4UkdCnTV03vwadD
4rCFCFapzPutissrRwVcmwVyBepGw5gFbq6xahEEdG2Nk/lWv9dqXQK6cuQ6
jL5IzEX4oU4zT3W3KSsyB08lJ1c3ta6DCCOwwznqzsuizEO+WXIeRMDs6Bvg
RzV/lqJlMAYHM04Hgz4IGe0KnPYOe4d6UCCrWTLf5LAlNfZSDkN9dIpgLMI7
dM41XWKUHze97QTfD4p43SZg8a1QBb+dJTKZTrN462yvAaEROcqjYjYpN3kK
MLQdA7CtuVAyfz0Bwo4BSw9u4WK3ORSvMpVPWMgQN3qWyCXsAcLpbFEq7zHu
qExRX7C0JkWDoCWPT/mkrnRk0oX9CfVCmnzpOkGpuA9+2kbmwPFhC8oSVMum
lKK2B/BUvJ78TF+Qn4tfwTR3/lcF6Ly4I9rAChTs4G1t44uVKQqhA1w6oN60
t/QOQdkwhAslbwmy3iVLFEuOLrubgSlBU9l04HdYKv0TJNwuAqiMQxDm8p+A
8cq8mg0UfbVHgyPxLrWBBfYQb2HmtpB5nhnFIJ1l4NqQwFC3rMIlsrKMO3X5
tRsMMz0YZM/DGGQwgdU05wvj8yeUnZIfQ4rnY67CFR+UyqMYTFiNwIQV/Oho
0g7e8wM55islB7Rqq3LV0/nJxBMI7gM0rQ7MLLigg0Fv0PoxK0qud+ipJfei
bNVSKasublEgKtRgfn0l03m5CMTgcHjcat0967eyZ11xNByOj06P+ofjwWB8
ejjojwZiKC7fiMurkRgMT3p9+L9Bq3jWbZXP+qLfCp9x9cTzd2/OX12IvhjA
I/mxXIXrLuXDu6vko4zh4apI4m4hVyHgIArE+9c3rdWzcBMnmTgV786vDsBN
OkDP5Gby09ULMRgMWtEzNXOf5sXZ8jJaB6ei9jyJZHczy8N5cFFM7tWD9X0c
TK++/cdfX7/un4bX40nyj8E/482HT9fHP6tXOJVVBMCb0YelhKczFFH5Okfr
rliE3eHRsTifBCfPg6OT4PwsGI6Ds4ugPwpGL4LDQXByGoyPgrMR/v34JLh4
HgxPgqNxMDwNLs6Dk5NgOAn658FwFEwu8MnkPDjsB8/PgufnwYtBcHoWYD3K
MzK/A5A+67AoEFtJHOC6phuwWQBMECEGscFIgGYIsF4moIxzEeTlursAwfYR
YAZTO4DPaVAWkQr7QVfEo+PZ9HQ47MZHw7A7kqdRNwzHJ93RaAQ0Gg2OhoOp
wnJ3tfno/FWDADMhCLA9YEpsioPRuN/vH+ASZquSn4NFscaI9rNB/zsQgkk6
BXaayejZAHb8Loll846fHovTk//X93zwW/dcvT7oP/o+/puTv13vy8HjX8p1
CMo67laH+AMJDqjjp6vxwSlQm6aJ7myKj6NoBQZL7j8ERf6h/kSALHSGPBF5
+dEMSfQLz8J1+ewUZKKWs8LRAa2LWyA30f64/fRp2/5aUQu6rKWVgi1Qqgrw
A6UEDgClRjAPjo9OTk4PRwDs4FQMfh+RjMywTErZKJ3Fn/4Y+Xw4LuLZaBYX
s6ORw7NDOTiMYzk4iQbRtN8/HfaHs+PhySycnvajqYwOj8bxyfFx3B+dRqfH
ICiaufYFseOLw+DwIpicBefD4GISTE6Cs0FwcYaMe34aPD8MxpPg8ChAFu8H
42Nk69Ex/jQ8D87gK2LWMXDqC+JvYPpRMLwA9oVZwTGLE0xSBAPYB0CMGA4O
+yf949EhPDgd946AZvqwJeLwFJQr2mhiAZraMDxyO9iYv5eQ1xbmf0Ox/f9J
wSOF/96y/6vo8D9cmldjnxfWR9idz4yxWAQzka4b0f7Sar1NIyphU14MuB2q
BhKDZexlyGKRws9+rOLk+OQIYxVU56ALskosgCzRA0qztDvPw0hiEjpOikil
3LHuDpPrmEgwVZVUlqQAcMI4FNxMsHhLgEjHIo3bDFaEmglWvjWvOvDX/Wxy
y6ohGBWn1/6hcmJM9AvjTxyz4NxskwfEcQUVPNOBUIPZnqBEvB8fbJi6wY+k
YMpUUsz2TqWbXegw9y65pquhSMBJ7apMv8W3mgFrhSZ+bNTLCPseLQe4abB1
nkUy3uRShcldMlB7e9QbcsZ5ReOXCPadxhzXDSNRqYCV53IW2oPmWFGK/vIR
uOhUiPYmK8UEAfF9VwxDplsdNOXNVKVrlVAC18LcEDLIE1Xoc8NouCoTHcS4
PeAGX0pyLMqa83yzDcAHrCTzgiOPM45ZmkCRjopyJHL3QnXxl4bMBEdxlrM8
K4ru2zyZA0zXmi5vFiFF9vfO3l7f7FcKCD5/ptLzL184itPm9I+DLVUbWplP
B6K4dpiid+1JFMl12b3KMEih6F0FMWylsLgLl5tdkUQjKd4fnvWuL866y3jd
BePzqD/EWkoXLZoq/9Dt59IL4gTmP7X9TnC8+GO2/5tviAnVbrda+A9duzY+
HGPVNobBbFV0DBqqMOXhXHbyEcSLpMl0ze6EX+PipCXz196bye0+FuwgdOGy
Q+U6FLfEFNEGC6CYVKgWKpUlvbBJNbACvi/EIkkRBxzC9N8wJU6x5BpGeGQR
jRmDpUgZwKKDBZS4ClBAy6XEWCkhELTskovEHKopeoQkW0yGWihcLXGFkVus
hRoBEJJRoTQomkWa4LaT4kElc6cizrbqXs5gMzgN4S1lHZaLAkNut+w6q4wC
QJZ8MuU1zswk/AAcgABYhQs/qey9UEy5zqgYHlDQMFEH1h1vInxPlZNyvNqs
GH/59w1AInO/ZosikVgIgE8x9IwpyCiHsUIu7lmFiQnVeRDDRsfbNFwlkd4U
/J2rZCljAhjLNxxA6PCJDyo2kqY+NZddA0vTqkgoZJvSFEf5tVy6Vi8tSGeA
hklWALRCgMoMLBMqd7Vk4dOkvz/4CVddETKMDEWcOFWRhBcqoPUlDCU4yCyg
ellgzXpdFvO6I5+0HTH52ZgRpUsyuQsR0QeGDlRurmF8z4o6OhljLWtTPgxE
UkdLXYo/OyHZkCw9dDxWUldNO5LZE8gK2C66JCCc8SMS0EpQaeXBAmnUR/3x
Hk8YkEGHiHRW2zHpFiP4eHErABpFJBkvbg4plfdiHlIBfkwZN/gO8WX8Dd6V
e29GF6EdTKSqM0lFVhsbXyUP7ADcLYH2fE0tOqLWmimj3iN5Cr0NX5mlaML2
VyULfkvOwslYGNr4w7MWBo9+DYbOlCkD/nY3y3QotYUln8iytN+eKQAgDIeA
AyWBSVyoeFTFGLAL8CstqXKhXlf6UO51cNQDW3ZACqJBElA6G7XNEjbfVipX
ps2wItrPLiLkBb6Qlni6iRKYWdEM9ircsiNAJRcw36bsZrMu2yhuXt44P8ls
xy7UOIowbFO2mLSEWfHgUAarQUVWbrtlOBfgeME/ZlvXo9DDP4TAcW/cO4St
lfihrkQXGRLDfYLEeuv4TcaUZJN85+T6fRcIWgmhyTpswJUY3fR9NSU1duTB
FO/rGTxebMpf4mEoSxSFsHX8lC11FgGLQ0lHvh2KuVVYRgvlaekKCndBCZ8m
UgdMYlvzQJUqytmnkdy63iaftu4f95ps7mSeYiExmtI+2EgQSPEurel6CJzf
hdqsqgZ+WGjUNzjASg874qHVOpdrpUGVla5/dS1p/ZtXae/uoMqa10FH/p2q
ldmScDyJROOztlIrMYaNKQGi98AgatBkHZRsCU9AZrdWVmwZOypvD3fyjs8m
gj0Lxpoe0b6077PXeHx86OhmhO+2qpgb6gtIUNWKOYpMca8649RxjQslsQlo
WITR3hW1Tc7XTug7FW8K66BUYR5aeUUPNv65jEJdzeCCnkoZk/T8kKrIg0OW
YVFkUWJPG1ZlUuJV+FBJiG9/OSvVBoQHtpKN92HCufPphrGWOqhw0ABuVbLE
r7zKOF3G5dS3aIulxmIAqEL5TgGkdNsST9D5q1EmqT7kYsU8WAMOJtB1dvQj
+IjoFnF5EqtVErFof1vGfYik8KRhOgfiC+fzXM5t7ZoPHhsRSz5czZhsoCQM
QVYx2ISqXqWAC08i6gox7UA32DgwFSl+Oo6KDrY+KFiBwxXzusjPyAen6sic
LKZQVkPNDAdFmVrM6iuTaXvFi8NN5QwlMROOW1KmwDE+hMPUCiie0zWPH5BU
1WOlXBBKlo4Hj95xJXK1jMTzQuSbJyULSfI6Of6Lw6r/mDADUwGQ55UOb7BJ
hpEPOqlEhZjo24fRwq9n0a9RKwU69a2OmSYliRgumKXiKyV5rX5QR3QwLVgv
SmTNp4+yEkZxWL3EHWZtok+mWdLkrXzATCL1h2HrsOmsz6BTKeEx3mOFlXAW
h9tdH5TX4gTwLmfd16iP274FZOQQuuAwJMrX1BeuD1jEhwhtr0UKCAfxwaNq
Z2WoNtumCueoUunYJwk7roKN61LRwBptcvK1nDcU9dpq1UfBrpQhjgZDcQXg
6nCIeBEmS88cTGgKbGpA1gxZN8bBahB05hC45sDGbdjlftmY53DsA3atpLED
mrfa46OxG38/pDP6aFj48xjRWqUqdo1i0Ld1ZWjCOzuVTJOzNuyPxJuswUPT
o6lwBu6IKUB0iNc13JUkq3m43tpq5+9Duwan7wQyKb9HHiTHeLMlx3iFm59i
EWXXVgBtoLtGIUZsbEAfmCl02WySbqSnTRny0pIro5zaxYBl1TOVcbQjTq3E
o3VxmrCeUr7REJGolXMcnRy3HqpCuhpufs6z/ruzt38fffr4z7/9I3x/9nyT
DJoKNB6rtLC1Ak7O+XB8cnx4MjgZiYHYxGsxHAyHw+P+cHgoBqfDXr83BB4+
Hpwcj0zmWXuvuGV9jgEJBFsHO7uAx4E3y+HoZHA8PBwfHTqzDE5Hx+MTP8WN
Ex191URDb6LRyeHhcDgeDmGeMlqLwdFgPBz3R6MTZzWndgJ4hwJL6njyVy9s
ODganZwc9sdH7oSDEYhCd2HD3zYnrhH7J2SzrpURXm2Ry/gPpalDLxzkGjWa
0zEz/Y1KnejIN2Ytf4WidOPFSgE9IKEdRRnyP7qsj9p/aj9JPbbcUCp2auAz
HihlYcq5MT20LEG/wihOE/pxnJS2YkJVyG141KvkpglcXaXCSkr0aB2KuHhj
A/T6bH4HmxWBP3rHp8+3TbpDCX99qPlJUGl0Y/Y+92QgY7JZqegidhyZQlom
YtdRVq6rbDjJqS3MxyPf1VC6F0gGsxe7htnoKTlI4HJiEw11wABfbg5ka5Pe
D/hNlkXW0ZGnSkpWnaOxx/V3EmuDSxRled1R0Etx3GGtU82sHqmTGgaz2XDF
ExboH/BvtKxd8l7n8i7JNoUe1f38X4qa0YHmi0NzLnoqqV8PXTagdGm6HFR/
1K4ghn+ARgpKfzRaq559WbHSgMbybJ1TepFMQY6I43E+36qxATg312xqI5Zs
BH2Qcs1Rjo8Jd3ZwNrABvbBZAEu+9TjIbLxesXMiyp8eE5hFsXETVJXQoeI/
iiDg/qF31fHG0DFXM0OsDGbeTFU5BD5Pgok/nUHhuHdkpNKMjG4P6sYSI5O0
GXAAgLw9GGOTUnJSNqQ3OzUKaOzA4GgczE/OF2U14I7zUMDBj6esYJo5YxYr
piKZhnmSdZh4HYddbVGx025u5BNPFrkiqDCSSfUCspHb2SancIO3TsUtZkHq
xIgOr9Zx0hNeUJtARJG6ZXdaI9XtdmEGrxjrWiJR0KpwohfailctuQCXBass
t4FKdZawrMdmUByXNd4Ve1MVV+RDM17WRIGwr06S3b57Y6nBy10mKYXt63Bg
slJVaMUgBdZWgFiZRdVqvEqkjqTc8Md0vLbkUEk9MO04HNJomiYhphBrwja/
gxfxp9/sQYx8B2Jb/MN1IO7uj16t7l+OtgfyOL66Ovg0uTp9uT764JmPqBx1
VXo4jaL4twI1HBqoVG24BXA4Pp0eDqYnRyMZhqPDsQNsf3p8PBudDEenR3LW
j6IwOpnG4fHRYTg9nsrRqQwHh4MBWPPD8Cge9MPfzQv62srbujX+kNHdqC4b
rG7T3g8egfuMFWt+3FVF873yJCoIMOE0ai6HlJ2oxmhaoOBsrvoHQc3vrbiB
HakFcwYOYYVt5oIVjDLzMVsFHxVqBOwnYCD0OdUbt1rPsx2ntWs5PGVOmriB
igHSiT8azJj6I8q9XGB40u0vZBThmlTuzIbFFSkQXfTEj6j2lHaoR/sK7zyx
FQMmKCLaTi115fglhUz559iDrW45NPWV8msRqbMpbqhpKNmUbnHXVvWJEFHO
AWYyIVTAvVN/sWmXKgFo3CDcFNPow8CIpEB2IEpjhQD62FfVDrVqO8GW0upk
h1YkfjUtkW4TFpvqOfVukaXv1Yo/dceKasbvaFwJ7RGpM4FRHcgNFa2rTLR/
QtlQovPirtIY9FRNn0zKQCBOfdBqrjMes3FXZsijQKuF8zWEPBcAf5RSLCVa
B1gl4bx1m+t+r2DX8I58SFJ2VTRvoHlNB9thR6mHWkYhZQCsOpB1WwgwHm+P
pTP8QKdB9oFFyQNm7rvPNuAZIVvrHpBO6ScaaX7tJ2bxqbqWKqUtJI1bAAM1
LZWIwq4Vm297qUwuokM47tFcpCB6mUyxeHDb0cZ3ullNsdMFYI6WR53K1BIb
8ILtR80Xzs9NPdia2kC40d+nVDL1j7mQl6qL0XBvqCVCCn+TkTxNuLzSen+q
N2BDSbVbfaFgwdQCLHwTVgm5wmPYGNpxMQ5BzybKxbA2KlZGEKSV8K47Mpcx
/U6YwC1HdwAFDpA51Zc2ocTv+VGYdBg3vUsK4C8dHZCs3XJd+qiOBGBGPs+W
7GegEmrTM4ez/YzCw3rLFJPDRKX+uTaiE67hE6PubyQ5OjtE1WiIetjy6qym
QkgKGkOELQpaqk6hZljukNheCk8Ckhsp+DD62QhDivV0hNssRA/666Z0cexQ
Wo2+avVyFxQ2arucBrxyEXiIVQhX0UQcmGDG5sUbDgv8tk11Nq5WTsQFnvfh
tnAKgKV/6sDtQ0Q9QNcm6+y2XlaETe+q3fbyxI57zi5/tMgyZjmfeGzeWymQ
Kh3Vi5eqFcrFg/XLhZkBlmNq5EzxcgVJDdYz9V52M8uFk1kmW/5VFoLwDpdh
GukWUWDu6PYkhTIdrClTn4JxpKJmUab7AukDFKhTtb2EOovWYvQmlZ4YCND8
gd1l094WSdp6Wm9mrL2slNi51roqsbFreayec+TbheFdlsR+c1nVilgPyiWi
Ly/sCx0K6G8KivUV4rDPieXD/rDWS8VY2yDGYXU5Gad0NKWSn1j6OwTYw2N6
pF3ADRS3EjunhvlWXCuwnPixAw0LTKdp8m40jHtmrMTtuGqMYUaDVf6a/mun
aExXXi8utwCKoWU1tGspdPxSBfCP+ofUohN71L9Lw7swWbI+tJl4rhEwfV9t
6INqTzizAWy7SXVel5pjSU8yxlxnBXg16KTqXcQ9Hj6MFuAlkAMR0qUGRKxP
xehxb6Q7t5Ecwx73SyrdxZMvd+w9cSVRka2wgdwybOyjxKymoj/XGOPtTuiz
Sh2rgxDJxyo2Ky7eMhhCTa/STdkGR4XVU0mbKjFahR84bszedhetAJubecKy
MYnJLgmF0Q5u312/0fuie1WF9tKOSlMhSwMPf8wHsyjDDoTJ52tsi/StK8uf
VN5bt8kaexNxT62JINalkDUaUGii18C1xzVV+bG92qP9Kkk/VDKLSt8Ox+ja
aX2dy2VNWdLBOgpu0TxtphccUV0LA0Be6n53ChZ80mQ3YTBJuXjmwZE+KOgi
1raut+denRmd1F6l9aGOVgfaJqLPvJU7vRBD4WCwU9neLqWlYWFtHfVuqzsv
yNmyaNIHWApD8BQvV/Vhyh0FdnDmwqZ4diYDbLsyu+ewowZkiz/L1WkQC5k2
y0oPkc7n3qqXWTrvYs6E6tnwXXOaisfr7GC+8QiPCXV87vPWQnD/Kuw/jNqF
qsBtXJwqEV9od5n0nkqB+Ih3ci6qki+0MSqg13CzLNVwyqb3dgC1k4Lfp4ye
160alx2IPxflJg3wf0y0O5Xl998BDMtnLkt5HyH3Bvg/7kc/mPKhZ5t43TDE
d25nU02Cz9r4t/Z3DtKetVfbKw30d9V9e2YX9FUwldF/DkzFfwWgHqwvqYrp
wlcrGOhm/wfpL+U7Y+BDY3Y/SSQbE68uHpVsZCcqVZyhTywcnukQNlb6YUd9
dTzk8+cf9HnpeznNy6g77A8H/QEemcarUM481RhzZBxtGc/yH4Lt/8QFWNbC
lKAb421Xm2dg9ihoKxNfBRhySesCPUznevyzzzoYgaeYuMofRam5qIkv3uKW
lkqAh+rCiOreGWe1djAEfakJGTnGaQvLxjYQCAWeK6B5dUk2uLA+SpWFrmwk
fE/rcngVO0As3Vss9CU5pqqWjnlYXz+peRsqlIPBHduRws3KUDwb8616Xl1v
84iZlOkKkY9l5RDLGlSW5NpujOvC/5MNqm/w8tDm1xFpR4tA0PA8Aoetl2dk
MCJMwbxuELjr+KkXjKPq6LHvtDl+fqEtv6KpKyRamHRg1A3LPw2JtiIAJqx2
Syhkuttm1IRDvpJrZFJXFTwr4ARAiBuIgBQXVq52cS+6qieLi3p1lH5rg+f3
mYKcD/6lECxTHmUVFV8ib0F7fm4KXDvJyt5tbBBcQaWu+Kib37rWhL0EpwpR
feHtlmOpIj8rf9Wvg3HseuqfiUcQgBDXeYZhcNNimyQYSvswjs2JdLWv1T13
gr58AROSsQokOb+57rNxQUO37MEhZB3cRTpool8voE2O0hMIWJlOVfhVgwk5
W5J/6dZJYiORXX1EOjrSRmR22zBwU9H7hGLT3TO+VLGrTg13Xzuysk29h5RK
MjoU/n/Htz+SIVsw9Sirtja143CpYGPt5G5hpYKWIxp/O8UbuFRcB0/GOxU8
eXSo6Cp2ehXhOE1XfukTc5okaRpLlxiPyBNzeyMtwh+/RiXsfk98X4LKYlwj
GxzZ5bIShek0NkXwk8GE7urgD4XYBoo9alkrutuLunXrhNVUhjm9grcihrU5
HHI0aq2acvfkXmhXWFKvFCNqhbpwTBpTx+oDc1Ro5p4Ko3VXYMIA0UpW7+zR
amtw6qGhd6wCw893r7Ix8GqP5VJ8hKWbkZuOZMPQkh3OBB10Pd/E3f7GymYf
skZtfHxy5O4uWZX14jAbLGcX8hFadAxAXrDi/sfAVte3uXgojC52+K6ihWxb
MfkRU20mIMuSsLn1EohEpY7SEDO+eP0xyJiPHQUyN5Y0Z+hcUib//V5iLsNc
ABsnhfFkjelgKr4KrE/DejEmyChbS5NX1rfk9cRNRpeqkYNjJqacOP4dZ1am
W+S54iECj1lJHeFdJquEMyYd8df3t/pT/0QR77sNFo1Phkd8R2dIzW6okQfI
QGDJMsvZr+HLwvCyR3bp9cBIv9t1wieJ+RIuHeLVqNB5SYEXGs4NKurGlTpn
o7vg189/F2KvgAXizZNq7HuwEq5vX1/ZMKLKwv9Nbhk6uzvxfu9hpmTcmh4w
C/k4tfu3c1TfZ+5zbpslKL0qcguKpeXCK9A1KS3XhEuMbtTY0pdzVsj1KbxH
yT9dNa0irXxqQRdcUxA4WW2WdMUnIQ12nDaZaw8YBa2W81Kl0gWrgfTBfFew
G4+8kvfSRTh658tFjnFu4bQfqrXQV00RbYW4zmXrmpnCW8N9mHJKSHJmQZnD
qu1/OrflD7bblKtV6rcoVC+KaGqop3DhViSIibZGQioYUGXxBlgenUtryMEi
WlM3JDww584Jh4giP5FnkpKP7YO1rW40DfxENHDGbLB389OZW27DVzjkKsyH
fUi4e5m3k979ztTeBsCBgTpKgvBNOkSo3nETszEx32q9V+x3+NbqmJRmOJcs
1WEsd9+skIKP+CJXCmu65iJ8wvaXuWcELbuUOfTzN+b6IPv0S+X4ujlVTXVF
ztes4bWh4QkEe8w9VO3d7I6q/mpzEGns+/OFmmm24dQiY+TenSkx9gyspWkh
zRVAfv8QtEZi2LUyKewZcE8cfU3nlbqPuNPn7jWllpyzGhh5a0rCUCMVzOaY
hSpXx8qCjg3r2Jeag2qVw0T2dbTvtXuDCsxrUWQOl9DMOotkCY/3UleUGwtF
3zdJ6AhLO9uO/Qvphkhl2fpt0dyqApNyb7Dw7BkDSivUCz42KR8kb0aPERHe
4RF2bK2Fa6J/OI9uBGSWAYuj2tt1bYV6v5nobSOjHbCU4nLyZiIo2IZ4NZuM
RmHyMdgR94Tp2jXbH97s0k1hxWZarMNIUl/LF7ZJT8cII5bYtkOgBR+WyrjH
a6n1fUlepz027dVLfK7mjvetYrbrJuyLcrXs4S+9e6CQ+3kvy+cHXDULOD5w
RurySD384pv6845HufqEtFUlNZgsUdu4ESpLtBjZ7jL2abW9rsf9D18T1MTR
fDSvuukY7t61n4HapKC+7rbY82+ptiVdhO+t6siU2n3s6OJx6olBZUShe4HL
PldI0LCwXGAotAKXztGqr81bc43qMss+UL2BuWalsdX/w839v66Pv8oDea8i
gonM1pup6el5MBwcnoyPf3xxUBTye50AosTQr9mUhxM+/mVNZl/oRIO9sflM
8WOoip9uvW22WU8+e+Pc/QT7sMaJODZg7pPHrdtQMEVNYK63196KMx2fvtIC
vJIr4UNWXgNCr5EselVUDEPRC75ukEP4Zm5/NlvaRw13CfKbSrvuxA9Imo63
taFXYAMtMeG8+y5svArbzDkaHXsu5OlgdILSscsI1OMGbuwIsGvCSkP1tfn5
xPu5z2NhuUN9KOfVw9MxNxt+azYQlWanbk5hFR0dQMHKK0ALbj/IESzOLjb5
LIyk7dWmtNM1XhQ7ubpUUfxCZb/Zm0tK2iLLtjPgVHNJoxGT8uMi3NAdYgGw
x+WuynM05wkYTirhb0qXUqm351S6wUk+wuY5LaYxCMtjPMoYfpDmUMUjl3b1
AEriGbJXYOCoyVknauJuuSzaVc0fdyuKzeWCzjkMskyoVaAODaheYQuuujxQ
50pVjw6E4/0iUUVeqxA7wuPBSaVAjbzWGT/VKE/uGg8NA4BqVzd2PmiQ+SmR
pmGwBgsPjfq9z5YmW+CcpjFrx7Vof9SORG0Zk4Jr6WSKvq1KGrEKxcJu3cOk
Qkq2tzX7aOauSM7IOGdfdWdV5dxr1OvNW4JVBSsiSPQeMiEx0DvSGc5x2EoM
Q1eH265LvE4KSzFp3FEhJOMCkwCO68d0bODY4S2grdgF2EgwSN3GOptSsbSp
5yrE3uX52+t9L4qk93yp9GER2K2h0MzDOa+m4/+FGYxrq8KChPx8oxvMPM7w
uo+dz6KVAkz2M2y/R5Xg9kGxtZL5JkV/5TftomkeSqgh24zpFPY0jbNVSktU
gWkQS9t1mc3zcL1Q0UC1QetCbuKMP9HHUdTQeObGnAXkUCtl47A4PuKYybWZ
SndK4qp/ig9o3cTKYNRHZcCG2m+gwCbss1iUu1QxffdOBzZg6e/YR7k8R0EN
Bkcu9t69uzzf15AOhkMnInNMpKOMNk0hOlPacDWuQ3Ncx9h1D3prRRQIjMa5
wdK6ssIgQ024svzhZswq2tQohZxG2BXt4jegqvdcxmbk2CpqvmgiYuAN3i3S
LStwvKhBKTV2YsXS3NpRaV5bnum1W6g2oIizSu8Y2OT/VIHX0L8Aw0/szzba
tZ4ByT2+2K5dohtPdijpLOoCRP4Tu9H5lgkWk6CbaRcLtci9ZTreYWgX6rgB
Dn2th2Z3wxYccValYfqpxJNzpkxEu/MsaWmFazY2dYmTtfG4lBZmN7O+oTpU
d1anaCdAXN1h9F+ne2ntXqkYZ1K4xEmXX6g6HS42wpiw6YsfumpbuahrSWHm
a61uAnH7/JwQdM0oNjUOhE6c/MZFtQ2aqPe34D4iGjDFVnxgowYrF0Jq35cb
z6F9eXH7omE83Llri1UTKbpC/0ti5OQy1sKoaFtCUKW5qodwbUiyg51hG0bz
I/2HRxhs3hFmafMNP6swxVgQc5Y7ZUfUcKBgo6Wz09IlRknM3byGVPcQn/uI
G2eBuhwkKcwFRmp6RGuieuDp+GUj0MLAx6kvg7vYKRVLKhXT4Ah3zd4Krpx+
Ovzq+xuXwQM/Zyj2ANtIdfv+ZKreOAOhjj6TJyJ0r0HzBd7gAVqYnCtp2K8x
8qW+uUxj+ZGDbU/5iCICxBfNJEss8Pmb+qeVTJ3YlMmS7u1A9JDFr/pxuhkZ
fTNtg/TSdmBDBAkfu/XU1TBgU6CfL7ihqq9Ie2WODmKG4aYwu/mVupy65mkl
YoDXh1RTB/qMuLeveIQIgw6t1hszweU5OahIsO5D0WaaNqIYb3Wbc3rAo6BL
WxBGA/3EF+IEYoD/Osd2FizzzmW0pJyx4oswNQ0RzXJphGsncZHlc1CBnxRh
I5Cml+xFOgfc82u3IAfEC/RCycoBMY8tfjnbk4L5XAZigmyon+KJwVz5PKss
Rdp2QgEUusIDQOQsYePcDqADRPxfdHgLBRSvx8jvmy1NBB/elPkmwu1oQKze
D3yJkmBvbm72yXkHSJhkUeeYq715E7yNKfAaHeWJLtwmGYWZt3bhHYXVPqOG
/RJ8RmzDf6hSF+lTMJAf5JY7CzUMvZIhugksr5C9+ZDB7UJ35KYH6poX39yg
EKg9Twprohg6vW+GY7k3sZVz7266k5uzy0tclDnwhUk36qGkdBypaqrI0B+u
VPJfYsOOH9AoGIwGX77sE49oINCU/SceeTdYfShwyLKcswamamxKmdUkjTdG
bGNe3qVWemhXSNiGJabbP3RtLORcAbLHek2l1HVzqGlOJQd06V6SCse0i6Wu
DZlu6ZRnyg3oMYKiygfIacHzsVq0Ai52YY/MMXmHzD5JI+A3rFI/V7pJSw3A
z5ssBbHkWAvsGpFD5xu1hqviGpcr3piaetPEJtDuEnmvw24ScU2Z0I2ZpefN
foVSrCjpxFdtegBXXZZIG29FpApnxR2vO8WULzXS52W51Z896rre5Bhx7Gk+
zDdLt9yPXifZywQAtKoqApVBUjXHdCaWu/Zs6PRqoZKEXD9BvOyOpJrh8Q2R
ChBq4+zIeSfzrprnOs3vZsxOiFENHHWdNHNhla66gJKu5sL4GCcqKcCEHQYt
8idmubTXVvpxko4uNiIhsid7817ngVTdPnejJnte3SgEarZLoN+Z++k9dboT
Krx8b7nxKdbm3ZDQaeNwklfgUWJS5wIYF/BBhr/6hr+gu8FcqvqOY3JmhKUa
QdoRqqV5VgRwzgAgOGMhQmdWCVdkT5AUeWR++PgnezvJa73XO1Z6g9Vp/NvL
ZTYNlz3HpWGNTJg13sWFta/YbPVsIld46ZBjtYIB3dWdNhspTlow+wXpr/cD
tIBtMFL3ewKluW4+W18cw6E9CDogqE6y/b42pfG4lOig3DHdaeBFgZow9XAf
F4pfidaDe8fmQeio8Sfmw9Ec9Z2PK12vQlqSjDs0glGemvMhD5thHb/PCeId
h6KD9WzFYVvFjUmR7MQLirKs4DruJFPhegsq4eWdPb7gAkVnOui2JH2/Yg5u
Y9zTK7p5iSvCAYBNEcu0rLox+vkzMTQd8QLpWTNOcQRv9T4U7FCglvMgL9gE
qUYbkJ2cHaSN3dNF1kbePiRYMVKDFvicj9PvYgmtjbQ7qq5lwkgAyCndRivH
7jSYKjdVL2r7PNlM/TuKjbnHMZYlvG6UW7W43LSRxHss6Vhb7XhY4ZW2WRRa
/qjvkw1jPD+7ot2y4ahjIpQJeNDgc8PQ1xd/f3d5re4hLG1MwNsHlhFYNkub
oVyAVRajaWVik2taGlW0+3OQQepNVJ3kYX52Z9v5pu5Iira8v5OpBREA6hlW
9oCwlWlTeJwWugGevlUp9l8vlZ/aqdb/m95NFCfs6ONU5OeHafgX/B9kDUIR
OGiqPxfVG+/cUCU8gDvBSlMRtVRMnEtJiTKuJR7VwN4Ke5Pr230xAaIV55RV
yszpaXXfCTB9TyOCu/yr4QsHFdXj3UBOp3wLLJf9sfuFkoSkMvw/WZ01MrIj
gk6nqoDC6QyFl8uRVlSRBxyH2qTF9si830Aaz6LmsRdxaGBsrTB5xxU5qrIY
PpgpTTs2o7x36cxq3zwc8hHaKLTsV54NbGZoTq6StLUHOZxDa7p+wo5uBqTs
iqkJxeRchuMoPNi7Lq0w65AhrF5oiL+bDoyaFhBHtR6Bys2rnSmgZmMaT11T
dVBt9q4uBzQOA4lXx6Yghci1Uao2s1agqLTzyw0YgKkKOjkxlAviE9VurfZc
7J1f7FfbMIVFBD/p41gkIXTD52KTcLPm2PUCxV7oC/v9hg4IVkFSljPD25c5
tKd8GxP0TAqrYVR3bdYorpLRJ8POL4wcddcQLWT0QZWHh7nqbKpNLt0i1L/S
o0Ks2DrEUCEyYsmzUX2yC7tTRU/IJ+ahkQuf2QvrbVYOUVgvV1UcrcyNsJpA
wbgKNAhkXazp/gcLvsnBcdXPJfeUuzGmJbluXD+0h6bIvnif5dQ+5iW1APUM
kj23pT1fT2x/dKSwkssoM/fpjmP/khRYiFQVU5W1kJdte07U9JKOFHbP83BW
9sSrsCirm6DOpZlN4OPr7laE3FSp0tINwzVATarTGvUStRdZ0T0a1I8U7Zot
U16xsEVBegXaKt4lGz2rzQZvH3dAtNqkEA4JOs3zTh5djcd+nMBvMQSnymbR
c/TqGBpme8z9fqiIb7/HszqZsYmYsar0mu2wn1NlXV9W8FBvVBDRpFvupIrM
zR5chqwt6EbSzec3eASpAq+XQZyIaZ7ImZfg0S3tN2nk/tspEOWYzQJr5xBh
VApBXfrvM57jTEWzHLUVND00G+TFHbmpWIEhG27tVDUYMFk8ibBSG6ydOccV
WRDymaWC3AxVWA5q5BWo8PRTJl4naQIGdkf8dbNMNsUncbbIs2kWfZIfOmIS
hytxnYXRoiPeJGDnvF0sVzLBgx3wGtdk/5gtsapjDo9gW8BjEhfLZZKVoEdf
AjOGd5l4GeZREsIUIDEL8TzJV2AE3oBAy/G3TZRw/A6oaYsyUi6d1IhuVk01
06WSrOStGt2opCLYDjMp42kYAeQlnilVtSAYFSKxaf1BlQ8ymkVf8qTOigkZ
5m6rQCWl1a5T8TXItG63K3C2Vqv1fwED96VwJbIAAA==

-->

</rfc>
