From 8a63f19a47c0610c9d180ab9625d932b21ccc8e4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 5 Apr 2024 12:47:10 +0000 Subject: [PATCH] Deploy to GitHub pages --- .../en/.doctrees/defined-terms.doctree | Bin 48929 -> 54582 bytes .../en/.doctrees/environment.pickle | Bin 101406 -> 100691 bytes .../en/.doctrees/standards.doctree | Bin 49646 -> 49829 bytes .../en/.doctrees/wallet-attestation.doctree | Bin 92731 -> 158378 bytes .../en/.doctrees/wallet-solution.doctree | Bin 75609 -> 76121 bytes ...tatic_view_wallet_instance_attestation.svg | 2 +- .../_images/wallet_instance_acquisition.svg | 1 + .../wallet_instance_initialization.svg | 1 + .../en/_sources/defined-terms.rst.txt | 18 +- .../en/_sources/wallet-attestation.rst.txt | 622 +++++++----- .../en/_sources/wallet-solution.rst.txt | 25 +- versione-corrente/en/algorithms.html | 26 +- versione-corrente/en/backup-restore.html | 26 +- versione-corrente/en/contribute.html | 26 +- versione-corrente/en/defined-terms.html | 79 +- versione-corrente/en/genindex.html | 60 +- versione-corrente/en/index.html | 39 +- versione-corrente/en/objects.inv | Bin 1622 -> 1675 bytes versione-corrente/en/pid-eaa-data-model.html | 26 +- versione-corrente/en/pid-eaa-issuance.html | 26 +- versione-corrente/en/proximity-flow.html | 26 +- versione-corrente/en/pseudonyms.html | 26 +- .../en/relying-party-solution.html | 26 +- versione-corrente/en/remote-flow.html | 26 +- versione-corrente/en/revocation-lists.html | 26 +- versione-corrente/en/search.html | 26 +- versione-corrente/en/searchindex.js | 2 +- versione-corrente/en/ssi-introduction.html | 26 +- versione-corrente/en/standards.html | 92 +- versione-corrente/en/trust.html | 26 +- versione-corrente/en/wallet-attestation.html | 897 +++++++++--------- versione-corrente/en/wallet-solution.html | 45 +- .../it/.doctrees/environment.pickle | Bin 57403 -> 57403 bytes 33 files changed, 1159 insertions(+), 1062 deletions(-) create mode 100644 versione-corrente/en/_images/wallet_instance_acquisition.svg create mode 100644 versione-corrente/en/_images/wallet_instance_initialization.svg diff --git a/versione-corrente/en/.doctrees/defined-terms.doctree b/versione-corrente/en/.doctrees/defined-terms.doctree index 35ee9bb0875d57583e1b05037e7e1aa4df066240..34bd315ac053b63488d9124c30cb1fa158a59fda 100644 GIT binary patch delta 7603 zcmeI1e{fXQ702^#NJt1xV8ZVJd7A`CLVkd)%8v*x36u;85J?~qaCzB%yYDTVeam}q z6QaO^1rjV;!-=AzAP6cd4e6pNph%rDj-8Q8r&?MlWl-DB*p_LjooOBEx%Xx_`y(P) z>0ka6l6yY)d(S=hoO|vr`@STvzL=P_De2M4zwSLP)J^4<;{PA;8vU zJus7reiB~$gf zibTWIboPtnb(Er|N%BfA96%(}r8RP^AtE9=BvUF8t>UsJN^np5L^*VG-b%>#Oi*o`z;0rKN7*Yl< zF)`+@Ioi73qr9aj6!`ihx}_%+pb2sPBf6z0R4IP#5nbNVA6 zN_G=#U#F=inPRi7t4>w!O}y}eSaUn2;Q`6#!-O_W$&0h|doPd5-hqN5ny@Xh$3y?M z%etvLTWJl`Ozph^Xi`cpOiL&Fqc%%eJ1k*bvRBseFXkQPdp&GXO$AF=H4Pkb1XMd? zLS<4SR+^IxTCAFmKAEDaiC$WdY%5d-Yp+T5Y97tiD*6qSN5UZ+c3o|x6kY(K@H9(0 z-L}+(wGthel2F~$R(}`JZzrIkG>0S7yLV?rx1I1^M(?mt_qiSepEY9J>B6(A@Y5#3 z@{MPzYO0b)y^meuMQl7KXT?zB;mM0WN!4j)(u^#^P9Tduf1?LGA?-NqPoA_1>#IWmAr>QS9?i8#;iwbN1RCKib#R!atk zRK&f81$)yq?y`hiWup)m)g0Qyf6tPPs|s*7Uu zlBB;fSM)~J)Fr(YW6kWB%JttwF>ui1oy(g@uDdQp0S_?TII}T;a&OnzHW6{To zPF-ta`{wrw-bst*R^tG6ec7wfmTrixnjepa-XvJl*yDR6MQ=pjKXHID;o9zf3^dB@ z+}JxGpVQdq13E^!w|~=UhgS`SJ@ny#iqp4h=z7@k?KmD_d;KP!-@N0Ye&(JvFd@Nc zl$4PhIw9MA64o_tglq2h;70o}0Zy&yf#q@|d2}Fs+reKwb-_8#3<2C)4~$YupuyK3 zd|#O-z#+W{e&^1ECyh4Pwq`o~rnv{UdG3IZTH1o;O_K-gg zbnpF3gO`2p2=L+ho$!|JcC;6g7nm*SZhTiBgb#3Fe+pcx&kI`2V}zXIMk^XmhKwCH z2kdQ`MlN#O9JHNhwsUmigrIHR`vUo#8_Uu7kC2g0yn5d>VFXOwk_)SA(vvFCoC%iA zg~AZ%-Zn9K^!^+{C=Q$FqPdWo$&gg&u$6+c;V;6y%)DXhz|4l!gal=xlBi5_zfADg zf(7#dHoAzG3SVrTL;txuu!j636%GfogbtimC_IE}eCdU#{UBSqjV=xAD{@I!D(tJs z7P=XFIE*er^hM@I8+D^V*g{PiB?EBH5pE5=@He`*!`fAuaB}lK!X?OfAWOK+L@tI! z79)C|iU{Y}dKVt37p}3b&_L9n^$WJdIljb)@W}SN;M$KyWmyK{GW=t9;^NAR&Tu;A z4uaF03P|=KsM$6p`5sglI|wWb3dra|^c>*wmic7%AesxwOVC&rHqtFn{TcB0tz(EZ z2-3HWAa<^1<7%}yVI`lioU47bZ59b|wK_De4;%Z`&bN&jv#-xvvUG8uv(Iw*y9m$~*uu3eAQ&-3Z$xOVr0OUX5^ zy&R2SgpDEXyWoQ#W1!Re0$rt9`}A|uc%ai*pjV*8*fbvKG!|%D471Z%pc~Lw7B+_T zXAx@^TxuJhB}FV@wN~{lVdqQO_!28oWhGZx&Xx%1*drABkiusaKFzF#fiFmU2Up3> zGW$s7kof}-@8H#CifQ_c8KtFmL${ZBRl_WCY0afBk7gM7UMr>V^inBO(S~1&a7CMk zD$ZJMW9=g!zuYOZ`U5weMS@8VDv71Jy#j>@9qa26F~76oKar=(=z z7lh+b>svS}Ny$br3yLM{vJ*efb%vs%>~jyn4zNH7M@Cjg!sE6q+GUbg;pqBsIfaUH zMsiAFA%1BG!j=(ZPtl|2m+S!gMP6SPpXQbM2CvL}QR+CCI>st<#SMJ*8G4A_2pYcK zFYpV+h70~Syde5cKBNsI2cCXtAnkA+w()Ry!!W^v%_B3>y(|^}_Rtv8kP2xJuM*}5 z)rZ#-QZ_hv{*h0UvPKS0NN^9MKQic#!Su&I+_-yB8vN?9t3#=MJF{(P^wG2kq8I3RdI9-2 zNBp%fJHdM=);k8x}`tyxx#x4?TJEj;?WBSe<*y+&`VKhZhvS#TzxKE_>$rOiNf>Z z@e|LNlTqm`^@fAx^-w;gPl!k9_TGEJLT=-DX#@_oL$SfQa4-*!9m*wDoUV+Z(*@R@U1G*MLrkBKu&V;Lo zj%6qroe^1;rSa@9yR*q1oc(?jJ0+G~K^AkaI+BCg!B|h*gW1H*QCB3Iep{^ML|Alm zCfUN-%~9+R;@Ps3nK1X2JhF%LyQBEqLOgza?gn&p7+%NESA|7At-9H7iLTLeGyR4v9RJ>G85pzkWLrIXfW5$ y?A9oDRy<4IoJ00=b}wTsr?J27NH*~65d1Gt_StjC01tk>+PR>DPlunsY5Onk4a$cA delta 3366 zcmciDdr(wW90%~uu>}@v8&cls-enQobu_ji1Of`OjECZjg(%YnF6^$b%kJKdffS@H zumIEFDoWX84`wQx#A}GD0iiD96Vt4wrms~f8=9IGz&c@aGtbr?i*3j0`N|026&-1n* zH(1uiWN@6@R_f(g594MlShw5esAM=NQ*H5ZteYvfa2Cc=3QB>2ViTNMT*y1~=OAz`^@C+`I@p&r^Kk`> zFkD`72JT&EL|xQ{n$7&L%dR6BDDuNwg?B=KaSLB*EES|H z_|Of0)~d)U$Ss{tPnmrhez$Zv3mA^6npht*suTwBw^ z=Xx~=j#m3YTRRUY1kyFW>M-*cY9Bz*TjPgIb#eGn@%|ldGql&Izz&Ze+8$4a_qk?1 zcWnZO;>Y}u(rCmdMb}ts=C3p!Ll9HvhuSBM5K!OD&wg@0hGX@9IP`o93_jk>v(0D7 zv1sta9~)Dkw6TRh_)IK_o0NqV`Sl<>nttaTFo2>EHDb@u0ZcIKJ^0J|` ztr8Ch!R72^NNt}gd|cSRX66+^iZ4!JR+-!BsH^rpiD6gZ zLEI^ZEh4oJsV0S`!Ee6ks6%7zV)K1tt-eRo-<8rAlZ5>=VV{`(`PNMQiI`qMY8R#2 zSo+u7qVb<<_8ZIH)u+} zGiz+h4Ptmb4PQY5YH0u`hLaPFJH_xqQtOavBpjQBZeyXXH4qJxbE1X5SEfh#>FKao zBi8w5TcgM?d(29oeJ{BQKea~Uo*)Q#btTH?%U^Y2{97=8vFoxb^gQX!J|bLB3YX)- z@X_w;A;R5_^v*{9v$r@DO2rrCy&!^IdV=_>w}%k6g}}%@1FC?fJGF3iFchBaj#8J0 z&_l|Gz|wc(p=M+ntUeM1*ScroCq=&gUw#{I2!UUYglQtZ)>(G>uxz-n*MN75ymLH{ z8qedQi_gRRMZRx5kDkcWj!uK!`}BB39CCX6keKm9*5L0&`rSARi9IUCjB}x-M~78Y zg@wU*Dwu{6rD@Jkrn>rb!Mk6FwW7UUVP{UXrM)_wD%xa))lRep2XuJ3XqPA~Gts8M ztHafzwJWS{qBR`U;bzfpP}o?d6?Xp7!8iy%q{q8N|DwX{C-ka|%04X24!A|Wg$YXT>R*HOlreG! zO9teJLTKQP0WHd)GEFWuhVg;<(DA+&6;ZlEL5)f(wz?3xD0L|493>SR@Ep;iXDMxw z(P+iljfb?O$>=qzUY4ma&0J-m@a(hxFqnHxi~1-(Bb&d|*YZsCqGvS(NCharG0$+nOz3rWTXBM-eZz1uySmu7la zT7#327;KSFP{I%bftxRn?}JM&BmqJoeQ)6fB%X%En9NK68g_yU#mE7>GG6ans=+^QqeAX z4S(dmx?9K{3njg=vHdlTry7&~GOJQ)obuP?%2}^!+c~$|@Xt>><)S@Zt(Qu6b^21d zdSTkG=iKxqt5C4LwCkmjyVf?%@rs4%dAnM3%OyLVEmx~xz@D~C(^ImBTEkyit7f^P z!{!wU4oV=FEth89xrRR^TdsbuJR%+hO?S}0S6s*!*ol7mX(b{#MU91!=Fp{ZQo&(PPHJKo-VF875y_&T%wfgL=d%5AS z&6XjwtjF#2*FId$*;PAt)XjPg0CNTnUp`eut4{gLri!`7sXAIADA=WJIp>yu?25WK zn?8t|idGHH%`h}8+)~a)1*mqcTdpir-8lz^?>_2Qtg7cywsNXsS5pNmb*^gFX3N#0^(3iN>Zm(M@Sx-> zsbauf{&g?%3-PR~+6CLH*$ro>KVo0b7V0^hzyjw|)T^hCp3R)~%2iNWdFI&RqYoVe zGvW^d!CyHwkN&d*EvJ6819DhbS(qc%YMGk1Kpd=8LSI8FFXiQI^@sJ(KtlITmn$Ar z9pL4>a=DPTvW`7{dckwbrRhCW2d8!&oW8t&?{vYPnXYgu5~pjfXQwMx_5!3|gJjo- zD1#mglzQ-nY`x}{ix~+-Ei+@~NXwR=tJd)~Mhak6YIde%&AW3ff`)Tn-5+6kH4;iT zV0Cb6Y8wAUDk|N;nF^45re4Vb;aq062yqSEk(<7wIDN;<8vZC{aqL0`71!*N1-29Nk)@C}gLIqKW*v#?at0z|IH@NNizGa*i!^jcXNSMJ9gQgzZaDWiQ~t`LRjONs zh6gTJ<8L&9a1v$5+m%JR^9^UpI&lM)83iS`G+QQZ4%h3PBl7tF9)IW|x0bbmUdb-k zYh2UHQoTsl=2?Gjtq6U+ST95C8dv;vcBMX($<}Ha(rx0yU&q)*l7=`bAIdZ&2xeH# zJvPa!YNEfQ!<`j>rS2fBiF)g#va9ZQ=cYJmg=fu>G7g-hZ%$f+PHU%U3gzqtlt1a# zJal1tQukNRTZKAUgVH#6qj}4q+l^DtfHLfzQ-V4-FkUsWxay{D#LrJgWWB>Sm38=d~Lmw^>3U&_qZpL}v5 z<5jIv4GPEI=Ze2d=HcdScXo&>2Z$`2Iho?5oZAK4cR7>dkKN85k$Es@&sz0@m#LN^ z3(-1%vz0?nsh8OBLN#d^bnF_?e^!(lp$x@xu8x*dV}b`ac~!Rvbtro!s8*(G&%$7r z$fCm**o`Z)(wc)N3AsW21WSjUds!SX6)>s=GOPh=5U%7?30LRQ)`$+=n38CD}p zW(MOXjLIpIK6JshE164HwFKo-)%&BhdZkje(FKAh=x?k^8_`l8FQ7`rVi}zk?ZWVc z=cGUW8Vo@hyW$qga|%IDf&zw;)-yEduVm;mvjq!vOE}k6fSOfZfY6GTi-B@!1D z50>E8z;3f&)HrpD>KhShAs65&Ji&uOSQ0iQnR*pEE+`C?T(9D0FDx{!aHe(gcgCG7 z(I9eOlpT*ILv(X6R^p-axMXxp_ILDg{FTYs6^!C1ZVsuFCS1eG;jp+>`kJG-E8T1!b7f9$GPQ_WjbuTd>?P*IuWyh5tk z`jC;!Sggzqf7!*O7+e|K@$hpw*0O=|SF0|`eR^r$g2^42AvYBM5J6sCsQIJC+{E4VLp}YwpJ}$4Eg9lzTz)tZJe>tVIty{x6gnQ+D-uXNU zeZ5Z0g!%$Mllff_eH()Ur>*7u(r7wWktkSKt!}`&ab7Vlp!R}WbL?tEWtZbc-~hpr za{gha4JWnaxwCGlfT*+v&jAChqB6j_>u!!xSR#U7_B9*Z!%1_R-72FcYhC~1*&j^?GS&=-#G%*{DZD=uMRwUnFOm5Ua#bgGZxGUMtZJDc&Qjs zA(wK=Do9^YJsx8|#K=H8;AVNa<)Y#l4aS&r6fyTIU4R0O%XynJSW`p+zBIgl^0Z*u zE7eSShUYyzzYI4ZMCe(OKF$p2^b7;yFa7Ng$OZ^kF|49tVO9#RCw2FVASk3vZdpdm z*3hrGgs6$Tf_Oj;QV%yW8#+ChBrc!wV1xw)0SK{zj#;YNRyFI88y8}Tdc7(uMJ*Vj z%9u>gn`oZC ziWZ1j6uc04Q}B-9ACnKkjT2fV24)&})f9T^R7zqa(Pd1uXC)z!Efo(#!wAzB)v8t^ zE<%>Q&SRF83i-e}VfMh57Mf@(4T<5K&ZVhpd z1@;`4zT$DpbY5i&2+2^26o@Lj8%`&Oh?>&(G^eZig47P^#k1@zs&tx|kbzMT2GxT) zjlfq#?)55>f=C%QAjr>S^VZ;zwp5-~MJjnjBF`q3hv(dCwnCG$E%!fi@?`4N;fIc; zo`3A2!^cm)=&1J5b1dW*>Kl@TnOw+k={>~B&8N^mhQGBn$9=10;D`2b5x7>7uF zW1<*8BG(?iGyDpA)Oc*Xb}-b|gcZ&Cet_;+YK7@dFwB zz_^`-cxn8S`O)9u*kvy?%_z2!ArKFg$EC)6(ikor%ER+q7!d^c+$zuuDp;rKkk_h; zZqdnA`yxUEUdFL4cF-kfqv0IzhA?iPxPhw;J)xi-jINYY=mABJ$=g4%qPd7w%ECi| z<>d#PbuIFN#=&3u#H|gBv)!n(RiUG>c}0wis`dw7RQ(8h`;^x?y_!+rN!8jSr!HF*>E$6L~@l#Ar zE+bTmslVq16Vl;q#?56Aon==W)hR=`o`RAXvf4cx$!3I?c)?zPlI6sNauvL{xspW< z;=jtX;C%-1RwR%~FHpF8HBBts5;+tf6|K%pmRlrfj7m{I}Nd2NNFU3~gZ;r$-%tz*G1D z^*L}_zJU4F6?he7^r)D4z=}j`JL=h%8o;h(Y6KQqZzFD-y?~fl%~377RYajPWTNY( ziwLvQTr`*Q7Ah)QB`0PZp!nz~9R01Aax$3J@ULOw?ynAL@C z91OpPF@!Q!4=SP;IX4DGLOhCiEFv1g!(m;6oMY~}#;NRs&=?KKHcgLQTGC8d1qy+{ zP-vb*G7YkcDByWbYon&c0Kt(LuI%u1y;hx`aZA&VTld_8E)v2tpexFZ24&O(T`Hw3 zf^*8#LKr11GGYEnt2}Tr0>DO~s!dBI*V01}y5-^=r9SSwSoCq8jWE?V6EgjfMol%B zQ6BI`_$HABn`_`kIOZdg1jnv9GA(Hj$_MQIpkJ0SA)iYcz&>V#`Y*TblEtyS3eKaj;-ZfiTbioX+g4l~5$GBC*G#O7U&Et{3TGJ4G+^(t# zGQoHUfvJp`Bp~uiq2MMg*e1h3V}i&55oUXHD?Pcu~0W+IAAY5VWGU+R4PAGKX@{WiR0U( zhO6|sLU{(=s)o_JLUUjq<2E)u&0^WN6nefvJy*gNw&KKgQG6`4b`Ni`QlXg!LJ2}K z!Vh`9R=At+W!sciKIkd&?51#GX&cBZpCwt5X85aWUhZD7r`EXElU~C`5R29HgW%)H z!8(4#ow!^oz(EzsqJ&KzaIo4UA8k@Q4Wt(>mzh{48MrOY8Pr0R&eB4I`;l71}s5V^Y^>XE&Hcqf}OkUOyx)QL?rOBxPg^{W~FM}d! z5liz&6frYV z8dgPY)EI$;(&$*i5o4ckShA=It_G*2oJBJNUu{sq(qQ>AO%)de>8te_XPU$~A`uny zu-a6%abl^zxjE6n1{_#6kL0we`60HWa7*w^?H>xLVPDmWl|dv~C9_XLw6-+S%3Jf6 zu=vD=+Bl?&QK*d4H#C(Jj(X$7vX=Tu=}@4VEf^joI~%d&xC!6)o;X$qQFI)|}jQV!-Pme@_S zoNO6XhsJPBBWXJgR>lDE6>Mcet_v9(OSpv$CYiLD4BPOmKUl$fGsQsJ8}<=67Ewtg z*QNvp6xEuB-cZiatoM{ZSe?y=%HFBUlCmSdmPLqS%C)^&CV-wZO|yQYMCBrs*14rf zWZ6NJQGi|G%w-y22{ei+)aoC5#POnl_Lw=1~}SzdrTFujT(X`1Ra@H|D<_{QBGJcjiAG{QA<5 zOy)lu{QAaI59R+M`1QZu|E2sVgJ0ji`|14OsbBA1{;uu$&jr8MmNw=;6Z{&V{AT_O z!LJSX+W9X9zcwBH+5F!GzixWsL;2@|U$_0oTk>BFe%VKtUfSAS#UwGC{IW1Pr@?hw18#G2&vv2rHsR^e@A=3xFy84l3V z7%^3wpKJIjWESIw{34IY#ohqOw8new{JUc4A#ewEpq*;z%S`Ml3+KDc0%^o|nFUhA z?=lOd``=|2sKb4iS)g7{EcBq{`y)#JAa*0APf}n%eLn{H^zn0IGe`RL@uTVE(p3;0 z=-x=dlgJ!b?j^?#A8smqOF@D$saR)(&!DJ00E&59*)n&we*t8DuC*@t^I zDp%RcewWpQOgphK9P;Ia$?HL3)<+#RQSR0V@Nh_YS4`$&mB%^(PC_!Dic~G)=?KJN zwTn02!SBC_g#&A@Y8Bfl?zKtyDi4JJ-(q)_M}Fhx?}>=28Tqq3(MliIGZ`VTwh9+D zTTRyIjGpeaP>X6|Y{4W|_9}Z!#wfPMBigJkzE95v^(uRF|1WUrZ-Q<~e=e9^vTeG` zKB#dUZj9(GPsP);g}By1Ig=4arzVnPO-;Nf!mXHiBdkJ*kUh*^th+d{02fzqZ!`cL zjMM?rbTVPywJ#yWMJJC!_4U-16GDp)NZ_BG4K%aHo<8ESPjX~HpwU5vXsTkYLf5gw zcF+;bE@k90*T`>Lwq!|uD?Xw#sK@#|=@mPnYUn9al69y#P?B}1Nlub=s98*sb*O1d zl69zgNRo9>)PlNZl65GDIU4*-u13VinxdhB->$&p_6}!5D0I!rEZ| zy-fZb_7YHNa`TbuLd7d%l8Ft_*;Hux=Cutv!R@c)%|Tux|H~*>o3XIOqc>AgRDPMu z`=hW2iuN3W8LU695X(dOYXFBb^bcBeLCBl()csYSg&jgTZIXWWoqGO*_yXS_#+Sc7x@^OKvS2j-5j@ZT5kA0V{&4=hzPr88>dDvXQvJp=Vx>5BnpTQaXVpq^SP}O3$p$Srbzx)e8Qyx=DuE+?)=kS> zUFse`f>j{05>_E~(w()l3s`B2sKMzznIK203lp2pVwn=~Bi?FbGhXVr+Kd+##Q8q? zAZMxzALHljtW%|i%X+bDk_ts1BP=}KCky0abzxyxve343{%C*o*ZnnxGIpwxv!vZAc5Q_B zLH+|TQRitK=jG`<4WGO;ou`qCm!R%j4&69?6pfXQt#(s33gv{P#fd2^cv&56W{AtiE?hT{Q}`_J zN0YD3jiM-#*dB`=4J*M*z3MiEySzqhVrFO4sY{RVy#y~ijlV$fnmCQ`4oLi0Qxfk8 zNc@~BiJ#$uLVtf2f45bFcg8%J%)ck*N&bCt4|?*%pF`=z5FqUy!JLB+^u!79Q>d#? z0e*r>l zWBN@~61r1-U5I6|!5=(>^JqAeCGGBoYUF z4IBz}0xJyn(Zt|hI}wUgw19os6e(@;Utmfiaj>JhezHQxb`bWZOx1rfSgvSB})sKFUz(rmG4=v(&#uQ5}j;BpYBrcAzWAY?bD)3pOVt99AVi=!Lr?{~9T;9Ef z+tWl8Qv0OuGR02A{|-|U&G6gT9!@2nR5;hdu`(c`x%ewnKSFxO9Mp~T>|z}|W6!ut zfcSHZq*~OfZjSM1O;tc^(Q`~9)-jHS&(tp-Ih>_C0&!W%TpRan`O3v{&sxCqM<=j0 z5v{nTQ{I5u`*hL1V=58d9lm8sLU&3b)V@09r~2Uni#@!~5!Wdff4X(8YbMWMBt@fU zcI%~w`d6#{rX;jl?O_tJ{n^+Y4jmO|x>D!(Ojp?1c_Jy0{dE)3lVmMj`EgUgv}Jru z02Zgiu}GR)#(~4wBh1I_!We#UVi>N5MU)k`!1t>D;k#@~LaS`ul!Uf~LWq4?LeX&y zNJ#gDmshV@i;VkYKTEYASR`emCU>)n?=uyy?xDZPBw~G+#UEt`kB1MChP&xsCWRd0 zN|95mEnW4``p5B)O-bmk`Y|DjxImtEumyM4Hat^%HXDcAYN7w6q$?tq4f-8A0scDN+dn9GCae40CiAIPnEBpDAGg!To%AtDA3Nyd z9{QM~kDc_fn?Cl^$A0=aNFVp&121O4Wwh#=TWqbe#0|2i{N;321&#r)ble;k&GFZe zWFbfx5cgx@5|R@zvSO`MTn<4`enhP+Ie}q{wj^NREM5N?cC&slF*t9Wpwa0f-(ynCrSq3Ox^6`A&@%SFyMLJ9 zWlBODnRf_D#aRPWd8~mvQb!7wi#uAv=>K_Q=&xn;vBQ|EYytaEOp(&o;Nzww5(j%L zfqkl6O6y&}$1Yp6!WRYq-xC9W8-tIF*3u=l@i=WO7FvYyuck<9VSLq;MB>7@Np2#J zfRPHo2zQ1pcsWEO!=ZoEgfK%9COSxDBRDZ~yR<~cOi46L#K33LZkHH%3`l4$o?+FB zjm;U4?W-R;`tXtTk^3G#6S0U7CZ+^yCW^QlD4m_bb$Ts*@R+H%w8ZaY5(e&(@t{Jx zyUx;8k5RkkBnIKy396Fcd(>u7vHQnx#*~EC*NhOuVvpb(A1cq_Eeol$b{5+tu@(Md z@v@1q0sEoEfZsGx)sttpAbg|I%b8L74-`g;-+z?e23 z9mb8HH$_f^|4vg9&EOjteLZdnTV_B)b0NkJ0}`4GG2t{Ip}BBO9U~bu;6qB+FKE#9 zz|+4hl7>^ex`hn>*;Ey^Hvc1&xQ=7un7(QzMbiMjyE1H}M^`V7li32GKR)5mm0Emz zV49}BTz89sUIzyH^exw#lFi%t zW>1-tNL&WkK0vRauyd`a9*bEbG{$X{YgqG!mBCo^}PuH(woTCMJtJCo0TM8n?e{Zm@Zhxk=;VO~FlzX}V+z zu$Ga>B(9^u-_a5I$j zx-n`|1KSmL>HaY>_1H8KHK9TEExPa}Q$cE7_&k%ij;3=%6k9o3MXcoDnxwqtjZM(X z(W%uWt_BNz`pYX#Nof6E#v~TsUv3sb8|ycnm<*cL8yDRQ9k74P6fF(-Z#;&uEdvso zi=@VivCy4FZ3m2hO-%gb6WQQCqzqDrv8#>0;Cglx}g+YxS zKSof0pRVwbDG9C9Yna5MyTW0WZaawVPYnHtO2>~RdrYy@D!tQ`MB?z@d5mA~NmnA` z#b|v(5!TOugyuqwJ_aN-7h(a=fQ07aOQy?+#0Ad1@*R!WZwa>3eUEQnB!#CY zbz6OXtEm=hMSe4rxQ+wp=uv(f3l==)EO8h;VlRFzDfs;LSbn1Sz`!91YHl$NAL<{` z515kB-Qj&gD2qM)8Y~_yXWOoHJeL^iLt;}*tiSRpQ?#@Sf5MbR;(!lHz}rOZmJTkC zpV(q1a7vr^Fvj~R|7nVshWy*6Boc>w>@238xRHqu#=9k6WQ`b@I}!tad;%ABQ{DWc zRaJM3iMb67^y#7BVoIVJeuF_mK|llemuK{`xLgGrl@0{Cd2aaiM=q=S@lI4p9?gS@e;gLKVR+iQ)O#PbCI> zx2qZ7W{Q?p;5yyI7z>Va0J^Gw3P zJ2u|L7W?*+A4m#0e{dr7!spf~`SG z{GRR95y#G65cg=S$P;2nc|DJ)uGnbKJ+zLDDhGKyG`NK-C&YQ#Cko8zMW%R7}jI*$WiK8wOVev zfap|W=-wDXS8bC@+k%Id@%lvnAU|kILaX^PQxbZXB1GNSETxOrVBFbmZgv~Q>RDUU z_f%qvaZ8KeAlQgEflr!BMR&kUOyc@=z!ncpLfxhdzCAIdTRk+1bX+HVYyUvM*_4Ft zgbh;?x)Ta>QR0vK~#OB7We<64L`(FA$ZcG19gAdB1N8xb9#7-IRnD zdl#!`3iwzU@ODGsKPQI!cm(&@q3<6}vD5H>$&^Im@ZT1Fg>Acij*(ulemE(YdjirZ zEV!jPx(E@Q8{6%1Z0#Gv;HOXbd(f0bvv3UTnKp?cVq`!F;o2 z`Y=3!_X&!3OUK-r@B&l8>5ln4CK2m*EdG`5T{Zz)iNV>^Ccr29NAz)15?YTR6GB<+ zs9gLez^4;Kz1t?h*O;QERrq^NNhA(Q*g;<%>No^C6xYf)F9Zs!1#hy`x(U5{Ru2-8X7=wI6s;g0?>zRQ$^ z?j5%aF)g+;(h`7*Um`r6m^@koP+|c$c8TyIQ#`ftez7Tu#6@DhL|98qLj5igR!q^> z0xO!5NL*mOED`>AVxsANiSUi42x=i*H6_ur5R9V(-IoYIl$Z>9T_XH|DSTQ2?_(0N z!*#5mV;UFjd5Q27iJ^OqON4*bKgfS>NTz-U7L zuz&4Kge$;HpZ@YvCUN~bV2g(qzeG5h7}BjCT9+llJNgIuHd7M16W(G* zsb!8|B78J4J?OSXc+M1XJ;1%hl!O+07prFqc-JMuClkZH$0fo`rr2rtJyQ~i!+)(y zgl|tw8fHs`Z#6|$3+K(IB$|a|V9&Hk6cHl>5}Jz@{dh-+^?m00#`?yO1h;9WPP(&p zb|G7c-hTX-i==GSux>%WKQq+=tw?{&Bx0SI#Si*zez;x!%bUx3l}EbPA}g`&S@ zqO2Lsz>PiHOK9D#YcDQp_~N0~&dg^!IB8RL0J z2v4=Gd}bl_s8uM~Ug~%WCrV1$=%D#jVj$lc2DvKFgUu|YFEKZ1S8>y#^H27V{H4yw zFaFqiTgW>J34ssZNl8R3%i9x!eIj~8W?*Fa0G<>>>)yGy_K*3SO-X1w(-2}??D2M@ zqi{qNB_f@VBqp8PJ4;9M($Xb<-4t7GjDFRWM6-AdCLMa-B08o43C)FP+7Qi!FwA{% z(Zw}1HsPD)QN+WZXVU>dy2Yz?X#7@U3c6)N9y_!&1H9+5%@FxbQ%Pv8{5q3}9U|im zwK2fyHURfHR&E{IQq?>t%_ z>>urYrX;i>+${vQ*rTO73>~&WQY>wT$|n+&%dH*c5;smhZi=e5NROG4XcmmY@S;a3 z(HRX$XfD<#qaHik^xD%nk&81LVzlzgDbKM}FSV=gtZO$NV*TO7)MZyYb*Y3H!)qAQ zU@Sc!FxKK`z1~#zT78}|CDAN61KDf!5yPqh3C%?p2glUt-yHJAPgl$3*%bbr#?=Sn z*3gI>{%eUT%PnCy9A`_)vuXUp^(2ao7S;HWsa&;ce87}M;zC*9+NUFecrGzPjJ4^t zt+UflnIfmb|AZ-tX7CLTDTS*LLSh zspC0um@lGVo5mN%v8J|lTe%rWU444Wqf8>!Q;v=6ncB>;<0Y?J&eeI%AcgVu?Ahpf z{_+Q) zGPArr2pi@0gO%dSsiDkS6wTj3j6r(b#ql?)LH0Y}KlH zRTznS)h4IvT(yqd*232uzh#jmN$u+<$saexP)qWSOd{6I#>a+C`$A9avL8$e#A{iX z{pJ4AeXl7A-A{f&2xzeb5F_{7Ik{0Gb*5ZsGDn|G4FA!I*`VTdl`C$U2K==tYFe%T z(v(Evz<0Zy{yT|5KQ=LEmmu>(8j~?>67gI}y#@SlnIfmb|E4L4#KGUp_B!=YIcIm+ zopbAk#TkrSOgMJuVDPAU=^`=EWn0M2;G$0-dYdVUiG`}hw{Vt@^6X0YY)B+1sJuMB2La+ zVuDFcL|?Lph!MpTwX|9-R?ZY$Eg#F2M9=auc09+sUJ>;A#DuY-?TZgvCGdJ9 z5?cR%S_p8l{nT6AiAhYmQin@fryP9==*JTi&~0r6losPTc6<>hEu#4YQ(Se&_^2s~ z#6^>CE1HwGHE)aSoe@#9t3_P3XJMN~Wc>JQVq%(VFQx)>#rHdN*d*YpMPy$w#aoN) z%cdj}7umXpaI169@~qUkg-Vl5#x^G9^)8=qbGuqQ#|SFy)4?4wCDDwuK`>IsGsW0t zKtglTWtMO3J&ejeN^4Jc(Jpz>et2JEGGDLyVNKWE($`*SDn8xUp3fv={f0$fCKzc3 zG-B6g62o(}1<%$FmFXYOSD2E}s{Arj61qbPq5falp|*+$!m)X)P#0S<9zty2D!H{{ zL=%2AF-_PeV+eM@Lb@2R(9*?z#8eu(i~SIji0xvFA0ploy(2ZWM=ApGFC_-?R_v+| zUyT~trrFx--qSzAKW|Dx_qulqAuYE1yx?oHqr4Jkvg8$whHCtrif~T^{6R{W}z7Pv)UyVozj4W=0dm#1|&2W!WA?ip}FWX z(>2{zu=7;8gax$<`m8nM7F=(Ewr9{1#>sMN4wo6s+qqQ8nndmRPb8+YyCzD_jL|Mw zTGJ?iv2=kLONV@%Ha7iDrW&Y~_{U61Brdq&(^Yrg$}ZrtgrZfw5S7b^6O+pbZoB7t zp){i27H8*!rkH8if7z5o;;`R=<-VG$wtygBJ5#QEc=J&fF(PacaG&JKZN#pBIx%6~ zNsE3VZqm#RUVzlZO^b*=X^O8F(O;XAXcm!yRn&%6Y{N1jp}Dwfy6b|tz?R78uJ4Ar zZZpe`n-|Bmre<~9M>mGL`gEE{n8bB-ng{7TWpKAkcn9LXq>%IJR4LY+xmM}smgLw)K76YO?& zJvVR#QdTJkA8pRX{^wTT;3pFUeW!{8s=G{ZsY#eGUem3H`D*DCKheK5-egKb_lX}9 z0$psgw5>Hln>t>r)mtv1`HjRxbfXecXd07t6%Q@q_^>IKx^sNcltkj<*xE)M^5%oc zQ1O|>q_M4?G~_i0t>eX~O_9{X_@pU`#D&q#$6UT8As-VrHhb1g!B*kJaL33NEVtMy zh#SC5pFZe!7E2HY^AJ6i5d)V239SyogEJtZxe)%i0SV2;kSUyULiNS#JE0numgj7_ zP^TMhBIf47MbdO?Q@7dFvHmsrJ|=M;ouByG)Lc@?b)8M+`p3~SC82x46G9Y=?Y1aw zRo-SqTVJ0T<|ArwRNiE(A%4abGd&_cZAzkN*o|jUTbjN6_SgKrJ244tZI%E+;Oe5` z7FY3Ira)?0yn{(xM^mz~Y2JhjIB?oG8rS}KV(@OlS@OvA2xq;x`W9^epnq&XYDz-u z`R@wxEVg;sa;|D2qRcnD;Vl14F^$cocq?MW(0ny9Ic&v73dI4P=*MO)H zrZ{Rf|FS8G#6^J@>)^C>iLO)#-;LcWjIphYC+V- zG9{6?I0lc}7Vfy1Z;j#XPYnN|iCnnS7X9C2ik8;@ou(w30XLX3=vjvtYz#aQLkH>QrFb!VBM&r8aXd#-RNrO05oL z%n7!CW1g<%)+X6RE%UFLlF)tYp9C_CH-(zaGs*+9Z>1t)-LZ{8&VLJ)hE-+kmHLQ& z28-j^fY+ofqb(UCbaydb11#IC3$a;GL>IOy8xXpb0Im$RxHXt`7qel|Dy<>6o03RS zLxh5KTV8qmnnl`cf9&mW$YZ9+Y49I0CD9E2wOA!-B(#?!1_lEXnu{(2u&I|bcI>ja zgf10~A<_B7>l4#~@d;bjjV+wPrFt#n@-wCq)JpKQDT!wI4J4?QK&*)vkkDMb&@@Oy zT-0ak@E6M2OsQTZ3ty${qsUeG6xM`J+>rk~eXYv>J$)_B|1Etj%YRvXeVV@3+}CWUn}yTq_0)^zY~d{qpv}J;oXU0zCaaJ=$b~5ri+wLY~~$`CkFB~Jf9e;`|F6A znwYG& z=`VM4dk!^DEPZW*{@lB>ablVLb64ZU^4B)%jw`e6734VE9xhR@`x~R@6KZNnPB1Y^ zTp;fXki=hm8z)wRBKQftuBw22Hq@kmon7EzmEd6)co>j>qW0BPxbBYt4zFt48Ml-z z)N?Ex#{WEIl!7Cbzl}a_r;j`7W0F30(8oRWF-0Fc>0>v2?4^(W^l^|r?!|`<7H3`D z6_@eK@EK?7ZXw4SK-AxWT1eVgxf=b8>eIidV*QIa(7%Wk{fl_gzlb^gi@4Okh+X}Q z_}0Iu0s0rUME{~D1;6V4&|INBgO)LfwZnpvL<*Wch0? zF1YqGwT0qLxzNae1xWZS&x&7xQ%#QSDSxo$&fu8Y+~FBq*xS&*@3ZleEc{-9@Jz|W zA8WAzx`2yccs2KwzbaSGV)q-02*21Lc57#FnV!yb#b2GtI*Xa1|eBL5xy6~!UH^hR>=m(i!cn%n$v_2CNIy$)9uR0_DTfN$Zc z5kxBGaCHv9^DDUMO8yjcgjM+aN`3&JxHfeSe_>BEU7RZ0;p|ZCuWB}4=Nprg{>mCe zf|p(TLuc+k^1Kv2QU~_!I@s`6LDu%=^v;G;KjooKcY%0Zrd_>c+8v*1e^A|?_)MCo zz44herG4?4G^PFVnKY#X@tHKGgE5)*?T0~CU>=IeBoN2VwuCq=UMI*^uFjaNTpd6M z?AQC+v4i>}?+W(eY^T#}^I$_@dze zUo`kr7i-gVv_^EOPiG3MBS)eg$wRw#Yjuq!xqpw&6sJ8AO0milrWB_;hxQ!O)y1h! zq`ElGIkao%uAmFWDNck^oZdtz#i>n%Qk>QZN=gIcAQz-muFjaNTydaBX~m+>nxJUK z!H%8*?NYfql zHv(fbf$0u;gXz6fy8}7wiOM0i#2#HDDwA!xj(xkrb?lnb8oehfp-sBX{yhg3Uzt!H zak7f&YT^(7B>`#bJMN_dcyr__ICs5l!FU6ZZR~*lQa@v{dg; z@1D~Ae}7MM*dLXH)>N{I0o}b*yF&JEe^e^Hm5Iveroei&))TUM`{QI5vDo|LWEL6W z_Q%OAN-IugkpI3wOAf@z?BIdjpC(6_rdRSBO?r7Li;b zzT&Wt^p^v1*hl)yfjI0B?ZPBe^}Pde*hg|5jKe-smGVA4*Q5s9E`(0nkx?b zXs#&sx*t=npug=4^|pg?a)`D!P7aYia4=R5JJCIq91h0HA)M<_PjWaECx=53T5)oS zwDC}!9HO-1Myh44j-LOQ^shj^6M z?gqI9Iv^6KlA=Nx#q9tEfR&jf5O$u{q`v!Hd?vz0CzIVaRNX^?C@MV^h^k5t1)@sR zLxHIJ^iUw$oqN)lXxHwkNVJ>BPm-i0;<~%=z-6Wmom~$Fv3)(_%y;VQAzD%K>A@#T zD=IUcOLQm|oQeuc=ZeybN=N64(uxX1=Zd&|FuSqlEY!w0=usnVqvE~;_S#{M4Xs6J z#fH|9D?}@beY^%q4&#Gt;VJ0uI4MN%#oVAhauHb}rr17LlvbP+qO>|lLCb2ll!DF6 z{;>YE?62*v)`Q){4oquxkLwc=N*(%yrWDsFB9uDx2~8=kPeds7*C!&{9tFR% zyi`Ams!hDWRQ@<&h&HKQancZKt#ZYQBT6ey9#L9x0*TU!lSq_SoJgXyV(nCTAuoQs z4ofa}ygs-W21R)YYAMX-ZD;2j*xa==PrFzrsuAS9rzz3h$P?!tH8g%wDPU1|H{qn%VrvZVooY_{*wzb*+9TcKa-=dAz5~UyD8e zbL9%HHWACJwJQtOj9uVH_yc&KBv0Y7;t#qG_E6O-j$67sRVd?K$Jk3Vn&ES}*vkVl zI2d(#0VfP5^PfR(e>hXHo?OWAFj@+CUjt8)_zqd9vP7pdpc^a7}w;D9!TG(8X` zZaY=3qRZeS+|)_zM5_Z)zHAIPl+M$>dQw2p+=$(p8SK`~(9XLIL~R!YVcK89PkApV zJtak;_iIw~Hk>|wbb9h7+m9VSoH|NxJ_6)+fe4OaF*QwFKiEc68+I zVr2KMV2w(|vlcDk-zz0!z#egzChiEUIM|}q2?nVUE?@4okU!BzXn^r3E*-~a*c@X; z%xvZ>pE8c;Rj?KEVjbNt!&)U}CZ4D1Ir=6)7h2cwx1BzGCPfdhjh-K*LNELS=~YnG z43Z=z`bn<@Z1{JduGbv8*}4vMQkA#%;+j4|WD;bz<5vw=M%HZNag+#o z100XX1H~J5LY|}FiW(KaMKm#6#kN!QOsfDYf_S8*B3oK#BU{8gs0L3Q2}r1RiwsQ- zzmuxLUEVM+kXl{rg-vO~De4zEWho>pbK`o(Q0_1rGPi%{F+mn4CPX&G6X_$!qRHzq z4qkSPU?M}Ef;OCs@MP$T=&$s|Uq_=HXHVUa>_mZ;G`_C_8Z?qeNNhweOX94gy%+Mg zJV@5#Bw3GCD+}u?HN4HBTv|}Zn8K`nC{>uJP=Xo;;&!sLFA}@Y-QO5}Pe5=d72p`g zh1+G%4xve5R+SuraxHEIN5%lhanfDAMIQUyy(-|M@TgDEpk(v#J9vMLc;=6XM5-^k z0TWxAXjzbVk)0h$kTQe`hBEk@!}nNFUkk3`1?6o`l&M1p&jquTB}_Y##ou&)y~LY* ztfp5~gZRxRLiZ2K5a$vfo=({ECvhCgy9K#I}j;Vjie`;rTU=_(m=Mo9G~b;=i} ze#wTQt$)Y zrBotNqwP)Yq)R~RwM^)WK5ZIVx2Qn4!J)gNwd?mZ^o`G@$HfsyzaCv_YV? z28je^ZbqU_X8)EBY$&sIOA`*Is)cjD+8D_yDOd{gb(q-QGSiV}QN-8xg6GWj=$x;Km-Uig52r^~e(?puP}NcD{4FX$&M zMXt`hN;qj>5JscvnXrPJ&f109)L9(PsM^Zxa}NT zdAu}RwQxr+Y9qf244tD_zEk0i(w_^dnxMpYl(%^*$hJFX32JwWu~;6#4$)NVtA=Ez zE^@cKk5cNc8ksv?V2WCAj;&R?I$WE`)vh*?%a3W(m_$e&m=f^tdFc)bya20vZIK_D_eVs@tHEHMvXr@S^%3`Ohw9?(_-(raVtZL@);O~ew-aPpg( zrTn%a;YN{gOOTKf2@^rW?IPi>AYqad{H;Q#q#|a-0VSoqJe?9bl$lM798zP^z)?XU zf5}t2ue@3T7#^sy2psrBIy>7Mu0kZHDJvzSt#=1}-Xr+jBFaezKkE1LNFg#P4?p7Z zg5GpMZzt2s?+Ft2ii86}!ad!V80h7m0);ltA8G{-{WJAjt8cNH{?W z z+VvVK!(7llM>P0CkWdf_T zFcoSr=s;SUXQnI%gASBMZnXOnHG)RV{AJOqS5X2Defd|5gzuvSvikY&=L9v(rIZm* z)v^xWvD4s8>So2IPW%zR-%wHwil$}J zG>WS6M-^?lIi3_NDA%sakYrL;7H+(_P_UOOLq*f!qCoTq1H7IV06r5WJS!4@h!SYf z%ln+baa^2ZrdS$6v2}mBSI(6wbj!yvSI{pVR>t}%9mU31htpVW!;yuKV&f~a>qc&S z;l6=qBz$~{HCefKCReF~n0Vb^=@t>Ut2O+!G6ak}hzpo$+>a0m9a?>)%B?xo26h0U!oIZ)lI8e~0-nQkxN0w(9kj7l~ z)3F?cJ^%Favk$8lyjT+9k%%Z=^>58q;j3qI_Pm?5GZsQvh^}1B$R4Z;KG0fl9IiP} zB{CPQnJnVDD(}l>UecSZ{!L9S)ssP$|ItYPJDVFNCN}BA`n8X$;L9Qfx5rl0u53}3 zC0)OYD-~#Zkgk@ogrum?%N*1ZuKIV=4A0GG=!GvC>Fz6&7M`}M(oaT8-_~3rYClz> zTBOh|&4ofXOqQrq?;T8`->s*QTj^s5eWdAQ1AT0!kDKY^cKTRJAFJtO8GUS{k74?_ z3m;c;GCfz|+XWi=@4)Q&Lr2S(N_4junUI>W8~%C(Ip^FG0*`EOGWDtpJBVo+PK@)y z0R38vgXmC;l7|aI==Uh*f0%ai(o`mE!5~oThH$FOOAY1f0zKIlenQ48he!x5MTqD1 HnW_H+CFIr?V9eI=_>W+?y8Z- z#C+lN!+4U)vw|CkEj$w52M8he2=^&??30(ty|UI zHQl=1CBN_ale?#H-Fxo2|2g;EbI)DsS5~}Y+mfr6(0|@Yt&+D&7st)goK-ECie|~F zdqdB0twQc-DCvp%j+fLQu5b628I?-?l(!~V&N@}o%vsgCcWxqIE}9cnw^TB#6Bo+W z^Ao0mXk*ATFbP&Q!Gr(nbn$AE}7|UxmpDS=7d?A824+a)xDLqYL+WH zq+gNXpaf#sa%skzt$PE0%jNHthsA@SsjJIitZL=V8d~nHF)uo1iTJG5&jE-4xQouX z;W}khP>&=M|7HznZj=xsr-jy4#qYYeF7$v1)VtySvu=8;3Px$xOVf>Xf%^yqK$>a?uJw!7OFVIjaO@SGdkh z`T%Mw8Z|UG!_cg-N;wl1^i`^58x_>O@w0g|b&UBhrH$YHQDKTE9DGBszOI9Mr#zJ^rZmsftPw@&>GB=nq#a>aqF z1H7D5E*G*!Hg8Uxo_F%)(!}oZ1LKniCNA#VGf}XnCn}tZ#EF{anCXgxW@bvpoHffLsOO*KdP7XFMncI3 ztoDzOPvDJGSEjlaNLiovY`^jpJ8QnPE_}N;75B=5W3FvqT>MKhqmHY1OhO&?}i` zx5hQCEV)IpHjjC0YenemgKimGS6}c3&5Apn$<}Ha(rx0y8)WPvNduf@hcXQaf*DqG zhfQ){P4riExGC{h>PE7fsMjTx?YqO89p|JKjxkNjxaur@bJ7}gS~EReC}+>3{0Xb( zpbOIz*IPMf6kM&MsJEug>ZTYLkqqX1_ojQXNfnnyf_(acvxqF`ONx(@5cdBwPZ+6z`KZ&vFvyFXq8 z4iGFU=U>OP;iQ%vYsLx{5S7;8IbeX5R910r*UC`}OGNO?zGi(#IB6ESOqt|!RW*ar zN@NwaSKz5cALP&FUnuw!SV^}^j&-86fWRqdeXU+5k_G3K>{g^623czuThN}@hUWlC8CsQ4O>L?S{f>?Qo$;LY)Ax9@{Dj<9}~$#OcS$# zY}I0SDnL~{fnN@LGmWW$lG-qrxlpxeR3-C`!FLUYPU|6LhBLyH^Uum}WwVz5x%{)m zAHR^l-8XdX0645p-iga|m{Sd|Zc2JCzE8)N)c5MZlaooX8sYT{U)UcMR&&!}uFJ3@ z%u7F~%)spgmVRPBlYc;9V&tdAA4l>>MSkHs!yZ%(>5z&XcjoUBIfVaIgC~8Kl&cO0m4-bt7ur5m4fB?y1O6< z3MrFYmJzcx^eZkQYT~XS9#Dhi!;Q>_N)IN9%f}rUVL?FvLad-;mTIO^&F0CC3o%5! zUY7MmEf}K88XgF8%#iXTeP%Zce#ny%^`LB#Msdk-pv=f1hHt;5&@AeqG)^7Km9CybyR(@Q&aglMlg-6Ivt&W*T?p6ng1+%E!h>moZVEl@Ed6Qt>b} zj4*9ct!yRYB4pWJ9Qf1`RF<<-dn2Mj z;r6m~05_5*|5Z8eGvz%QvSvv1H46@qleb}LIlSOKEAKd!+HDgP*<5MduI0>vHCG)k zna)J1Qk?Mf-oAUntnHnEEYihdA)O`Okl6=~eHo(Ih{>R=%D2|!6fC`eJAAkMchpV6 zeo#1P)e!fXXU}2j{l7$+&dE#xAwQJj3q+RP1*elkL=EY?8`I@{!PgGx#bfL&%5<8T zkb#j8`sD+cM&JdJdqgHu5Glh31o?Sv-WohomdY`zNF|R*B{bnL|KhmIUMb98Fz=j)>84XUV!86hxa6k*Ix96EL9J%{c@xf3UD zFIeN{>Z~l&?@z}|vov0Mt13CT)et0mwE2^H;V!QcxrA+Jr5zF}2p&SI*q-`M@HX*) z?1%WPh^Z0GUBNAueD~R(?^71cz;n{8-XiilWdw`n%mPdT`7uFqoNo;BG(?iGyDpAls}$7!C5wnETI8JIyU@xtKQL}*Azm84{QT(eaO|?@8)g*S$PkDJ(&Lh2K4}aW4&~u_E{q5Qd{!0c z1r-b`I^?y=qFYpQ)qD`40Vk6;4R+9d&W6J|;0luX;t(0<)6poN6=L` zh}7H>hUBAAsEf;Nln+`eauAkMOna+jG(bpvgCtNw@XB-ytAMbX>vO(YKFn6jn287B z1Bo@!cVxS>dGeyXzFVH1e(^JIeZV(C1DvH~UI5+@xVPLbVX7|7(ad zF`?{(_cmKHs6qT!c?P^sBi@PxGU){hSFfgtg;gRa!&^nOcgL+_8af~%o*DE?OpOr- zaPn1jg$&1{FwQXhgIPb6geGL>cFW1h<}3$1G6-wP9_VNA?f#~0r6T;d=I{p-9_9=! zVOUR(76AfJ;RCp{;Iw=m^Q#4T6=d|Nn0Ua7L~A?p*_Il>u4HNi7Fus2Zks)im{=_@ zTXemMLTAWCyQK#aW~I4kF5}EsWVFhkm~DXKqn~i}*DdAzU{>9`jETFqI-tQb^wHoa zMo%V*!S$5AYw40D)Ux&Jan78hAPbGi-U_pnMvOMdwpnHKsmQ2+ch#iIHmI_RNlHK< zRL}WoC@n&Dw8(J~bGFVR66uENnyPe2RSMD^Xlhk$)htp3F#3FxDk}nN(v&U)B(|t5 zMXLlSpjyln%+f3jzk)G@GFA^Nq8H__4v2(!6!BO@G=higR1N+dbN6LVW$%Kg@f?zAkWEAZ&na3P6)gq`j=XSX*G;&!>cq5Fn#fzOV--}95T*fL zQD!(OBOjQG7JC zb`Ni`QlXg!LJ2}K!Vh`9R=At+Wm}Y%KIkd&?3!?4-!_m}K0~r1&G7naPVP3aC)c<} zNUz}{h{bC9LGW?pV2~eiCoY!?a8O0EC}ENZ9IUqZk2cAj2EG^VFEg=9GH_cOGsuN1 zm8FRW_aot+wWd*-7x6GfV_i^9u)Zwt83{e$MG~R8Ot-mWY>6<7tlAA3IB>x;7IIXf zv;6#;fOzdZyc~EC=zACj{WzKLA8k{)DEw5kYUJ_zRY@NTa{^wiLP+Yoj1^$<)Z0Kh z4;zm@4Yx`<)9@z`3$ukDz77lF6eu*Y=9;1X6_1G(4%eOb21Gc5Vu=o1mg85^8a)Ll z{1oBaLe0IEmIF-NE8}vhx{+cXw=(NA_LT+%$ugb5cg-UM~nk?279|yOqQBNsn zkeBR@_{;IM8-hJva-9ayKLB7ZO`ZZW$(u5lC%i2c|#Q|mo^O}4Xj;wEeJQP^Vw15))<9Z zgwvfo)ing6q|ujz@5OH3h$Mo&2u7L$@bK;j$$@n%X;>h!sROHl<%={socH;}s<HGwVamYth%)@Hq+4}LN-sZ-{JT~CKvNN;vBE&+AcWpCI+;8;W@kz5-W7*JGe0=hssL$lsfUVn8a8!CH~EK3@M_*xbrigC+yW|#na z&IHZ+i4v8IP#UyKk;rl$O-2EBfio9rfF;ll8($Znj4m^=1CVKOO9NDj>(4KK6G?GZFl&M(V9x!?`RRYyn@ z=6b8(Iq>LBg0jDXxzwG9{`SRh9(~Ij4%puge*NwrztsM2@awH#HSE6+e!cDc|6xBB z{CfKjH`?C{e!cH+KWKkF`1OguK5Bm_`1L94i2aYjuTRhZiT%~!*BAc$llE7FUtfCi z5&LVwudf|1+TRR*ece86e>wQ|jpzS@{SU#f?`7X(|6TCwhqWE{KLx*j^m)(qutS5w zlvoj<09O8bZ>{eUAaY6D;Kaf-^cXg08Flq1>MyNhYaHW5CiG^pD@v?MP8=;~vQ`z| z2DAea0`vg0n!Y$*o13kBDdZG`hW|zGkcEu_5NM4z+IhFc5SztVQp#|&j|Lp3cZr4b zG_yb&@ienQYWOs>K)U}lvp^m0X=Z_XIk9j#O6=Vh(fAYP3+WRS;ZNTIA0mD1tk~6& zK7H&+`ng9B9ZDbb{ezBs)cy$lyRh%6Wd$vW@9V52u@>d3V~cQ!O(8)RMIn~U(=?Cr zx5}oEP2Jro3YXZ*KF#VuroHR7UY2fkU~tDHLKbmx1XQqU#T)40zdwit0Asdl6b0BL zQTI`p?du~{;2H7uoXmq&9&|;)bs^_il)4N(p@HzSyVn0d&8Lx{njh_w4aVY(npGT9 zQy2mMWvNXxb8Ic0c0O-+L^~Qg_Y}|c(oHP4RJ5*?h&-kwl&JTdk~c@3ZUS#PRBV8^{N}vTe9JqGvooPt(5R+9H;#D}^G*nwoeZQZdI4vY9!{ynyf%oeDyT zg~UfTwXtJ9%@Tf2g!9}yA|p8Pz^udayS%r$Z5z76kftM7R!w@Y>XB?qO+vub$OaAcHUH1)1V~lkn@}*>yQ(fB!8R4bT%E5tWlTV^ z$vK+}ErGnWPNck*yaC9m+rN);wQ0j!11C#vn4-x0GK=>>VV@K2D+DuGV_YGYfbiEU z9K29JXt4xgZOY?%eU5=$KsZrizZ0b0X^uDA@50}r5%zoVXWq5ni!bo~etdZ&(d8C) z)&-;XhwTtP4YjzawMG%>!CqVgTmn_ks z-iD>iJ%1f$?#}-sXxde;)^nTs?)EOLCts&c^&8KKHRIH2 zS~E^f$u;A!BJAyw4f1!|u(9?GZ?9{Xz;n8+oBW_Qb+12+l_RneMj>^=nlZEUSWSwk z!QEXlL5@-zCN@oBDH8A_lxbqaUFw+Ja2FQD{ax}w&Qu#d)}J-A`4a8jN}Z91oujtX z>XHfajoL7=jrT8>W^myIf+|_s7Mm*1-~tNT0TBjdu1j9Xhib#ih*%Iwg~Ejq79Q!6 z1#+?4u&~Z&p=Ia1)Ls3qx290WZd5u0soW`cZG`th{sS*V+cb{z60}XjCoezSG*a=> zvrVG~FFV_0vw5AxCiBS)AvReuUTU_QOR`h{TsC&$+IgJ9XL%Qze0gpZMTx`~SnOI@30~Z)RTu8^ z8nIECoz1-KdwlO8c-d)u8^NpNG`=+;@jrA)yfGm023-=r%>{-2{to_b={>(G=D~LR z_hO#d?~HrUkthBXO7}v5v_k}Q4nDLKC%`YGt}X@mMJ8d#;kVt615g{kJ5Ahhg@FeS z8BXUqv^^wj?EgI}{JhaIT(>|~r?J*3t8VHPKkFXTpX!oOo#H1#EWHN5{|utgoT3Tr+jWsr zCjZ&GBoYVvnq$#R&k(7gYYT92u_-h#lNkQjjz#ZE!G(MgE}BG=)x}eZ>ci)X-kZRIOy;2s5@=hdabVVgk8(40pT<9@2;wK_0lQE8w9?9FOW^sl@S! zE{Vj&F?!TLEtLv<)~FcXnwS{YkI9o-*fZ|muZ0`ZL=;l_q;J;6PQm|1T@sD(o0lI> zC7)C{*TS*VAfdSUD_uXr_l!BH8|T@@I(FKgahm|~*L$Q|)T(xl@mF+JKxxraOd{4X zj)hOxFCIFSrF#HzA<1kD_iWk9-neH?;CaJiSeuAe+|((Tp!P0Zw13x?i0TeM(dG(B1x#7S`vhQdIvk6nu4PXZmBwQH7hZDna zH7ufEVH120br0VKT@p%V9bFR25(*)9WeG*c(IDZwC%n9R*;=ICAG=wqeRq$Pjhfuf zD!x-!xT=S~ok_&{F1;UR`j3TAjE1}EUnYed;!2TYs!d(>FS^I^v$`ZySN*gQMO+|H zTbqZD(N*xYUPk*du&x=IP5(48)Q5pODo&SYD6qj5HzEHMUD%Wc|BHYv);jzyrbgIE zgM*-S$&TFq)35;4`DPfk+lPB-AMoUhx6akKpK5U=`cYin-*AGPlKjKl^k>s4Yf5Z& z5}eap9I&SJ=F{7h8h8GiOEet;r_}Iaa{AqPcAN8rc0loOlCFqc*6DZXMEj$-o4?=R znJn*Y+iqXihnes7^f5*sH`2$=^s$3JZl#YjeN52DBz^3rkG=GyybKq1&;cz%v(7un&YnlpM@Y{mAC^77mXZ;kriv5;`#>Mb!}WwGW8X9 z7!~530{rHMx_7+Gt%rEs2KNkcj)D$coAu+*5V3$k)TA|kQscGg5E_GRqbbrLp|}tO ziv|hB#anfagYPx)uBTYL&~rQ6!49elq}z)XKWbS!=b)&oNy@a^OhUss&>pK+P8~`A z;(cc$Bh=$bf#xkAvvQNofkm%-w1niroD;~pc*4q<<^Xf4g zogU;{L~6OTeZirNMk{3*#Dp6LAELQ~*Y}Gi=5SAQBl4y=%sV8HzBmh(tDk6D_w( zNn}KqM59DBd?w{~iGfFhgyP~+R;}3Boc7qh`s9(j52p`5=k7BRi+E>ZO0Z_Ei2Hxi z*=byv*VG4(=!#28{1B7SaF4VH724f3Mb|k-?b>W&5Uw4gD*4?;Ee4fb_ZS+wB$U3s zP>7+|BlyOX5HxcapJK8q$rewi+U zN|FDIE{Vj2FcR2|RLc?l_YxDps4^alj2my!MNWbLCS4MZ;A0?yK6uE4g+}Qr_~$259}!so5m10t;RG%PVwADE(f_Bzo^JH;SNz^&3x2 z294^C%WQ@5ZBp-BbrDqRyW5OoxTw*$~ zZp@)-7x4;Tper~f`}>&06*O%F0?Sq=?cv0r9Q2`#HDwQVkK_ei5=ws^A&g#ocfR_b zkv1f(zOPRVbE&@Zrt7zK5mV~>YF!eEgWi8Ai`Ac6iq$}Zv?|; za>Y(MWO*#XPSZ@~9$kc$kk06mXcUsh(4j^jVf{2nC@#e4qd`J(Ar|m7NGLA8rMrws zT;SX*-_dyGmS7jV@A0)gQg~`oyVciM>1v@;FCHmpTds6Gl^E&+VpB}4zw%{W zw3G^eQI|yGfDib9w}{wX)!!RGvB^x}ls4~SjQ3IgLl-Xv`M>FsNF4IfDNH+YBNHEt zw@Tt|o?(aNhQxqhKZc9CscwGns;s-o#9R*sy7bVm)g{pgzs8`g#(gn#Xpm4`JfW*c z{vzv{vFGKniV?vJ#&n(;+R;n(5Sj2FAd)YT=S zIz&~7rRO6*g(`wu62s>3b&0{=?rO%@=%S^R_?5aO5(hl)YQ{fG4DQ9RX8e#YQVQ%3 z=#oer?8~^C@#~41(50on1&m=UwW9?0Bv2QPVNm9sp{bQlG8#k}fzPNiBU!)78?%9H^ z{*qkko-@Z%7c3{Ay6f!O)2Y*UPem_?`0d0%-3Cy_9%`JyOA`y}yyH~Tl``HX(G&}K zUH2HjMwf)LH?I_8>h+}Kn#PT5VyC+}dJsL1`tii%ac%28glTaUp~VT+KhnihS&t9t zl1N-6&pcc$V=IUsg1-ars!C1qtE^Lp^JezExJO$aUya1&znPeX(pc99Q;-Np=jk*~ znqEij*3wyKiZ9ldhgzHa(ARa*Rs#EqE{VhihOt%j8gY~ulA{we(ay7Gus1Gr)7a{5 z3XGXJN*v#7`oKe%-t%%@5*-UcdvIPar9i_<%Z&%=#AL7`kO2)S@lpL-bm3Fo;ASQf z>-F?}JIA&#tVjJLN2#OLYPsP8qLYcCdvyd|xlJl<3Lcuq>tF015NyPozXJ~M@CjWKsuK!vC)o*g=TZG<%p8^rvJOq8B7Wef6Vn4) zFA$ZcG14{rd7sn;T=lO%)+M3D-p15@ns z{%1sAVcTk-W26@huS?419)mOr^Hyn=E<(iS##VbAoBPHf`03L9UaL!@Q8*g*OqoOx zG14HRxVXrZxmaga+b>yc)8Flh>BG7)yiZWPTRP^}glFptPIb)Nm_)4K(fcdi+iU`S zATc;Q+5~v6dqiKLOG4@KeL^U`j>^Sv0(>Mf)Z1+W{1sialnOtrOCoW=7uf{(#>5bB zy9w|Ox_BwbU$09damd?l0{qj&fbVb<;3sskQ}BOGmqa7{8l$Zmu*J}!K|*mM25b!y ziVLw`r$It-@qFDFFmZt+2w%aMWtH?AqQr`<~H8r0RL+u6q?Vu9(S{F;WLxM(Yw4Q!X4dXe3LE-)jP(7n0oDuGzFmImk94pOdibvD6xPWyF_?G7f)rp zkLi*~TqOESgw@0()a?>sSr=_3u!1g$#0A#L65%Tn6HVt!gfG`cPzm92T@oD&K|4Co zeu?mXiOHbTCBk>>!lxwgP9_mMT*vx3x^dBtmk7U@7`m6aMEF@7mCBmB%L%P{RYqLan zL-#;muS-I8!fSO&s7@%von$A}waoELg!d+<2kn*!r*r{V1Kep{5=!iCte!65ZI=k= z6T`j3CBivf>=gVpT@s1If4NJ9uT4xEdP{__(nVGY=Sf`>jl$8eXUZgsh>->f#l`Y& zyd%W=zIJ6}ed`Ygw`rwLSTkmJK3j<1e*Bj`QZ{N>yP)4+=xTvdq|Y*mSSP0ULBGv+ zS4?qTkx}3aFj}64{c%z#dRxZIiUGdbJ7Az`kKqry$M>IgNvJOJ9U-D#2mChO;g+%v z?nqcn4jV^$|tb`LKrEGN2{N=gcaQws;>h=YY<)(^I|&Ja58nBbh**}_CIG-@fb%{UJ#a0=kKhP!7C?1VT zhnlyDj;TRHaZ%H4h~h#R=B~JC;~Hw4@Xh{F#6yl_(g8ra#jAN}{8?fOx@F8ic4#OD zc+X{vA@ZlXl2BUt6DAQmM8+FxZGh7)0Pb+C+&Y?+OFrHT^~)JEH-WV-9rg80LPHd~ zvApYANFsK?ye%>8Q?0OHe6-x(J=%M8Nhm`&DFoK*(NZ3U4qG5!EG>r0bBW32`bFdt zH%`7l7gc4E?$agFC>V|5MU7CRGis1fTns0p9y?p~+S53Zi!&Nxv~tQRCvT?iHLKQ) zWi}jQ^%7H;$yVx82{DG(Fr>j)dM;qB$<12OmAz7*M|DXw3Qj}zN`1tzszE|=(Z<2i zHTu_veDTxOa(O0&f2VQvfw(m^;)Z`9F=e?f?1tlPNqHuXf4H7RveBd(@6(m5QjK@( zl1N-ABh7s}B8aCF6U1nXUfVo7{jx4{3j8nXl4t~9qf@DVDPsN_Bor5))(vYD7g)CW z=9OKx*)(MqW>QmSSY6YaEv1g-#9_XOer;Ue8^@a3)^6oy6m@m!DGxD;SWh`NuBU4= zM~{`9YB}ffnn4QV>(o^AJo4V8@WZ>h@jBk1ZW=;yxpQ*|-PJv)6S^c+*LbEb3DrS` zXuIm51Kn_e4*F%S4yvnL>(83me96l4Qq&AODFVdNFnkg1sZAU9N0u#F@^F2-{ZV|M ztJ@zJU!M?PpA=u8;xBI%l*X)Ld8_`Ix3X%^&{1}7SG&$>>td%2{j4qtrAIkk626K3 z2Q3L|M>Mvbg}Z&MG*dNdP8CMNt(xRiovpgKZ7qDw@hf{INorp^NxniCLnXF-_Z_+P)%NV2-|&82-a! zGeO1aDp%Yz4fq>f)RbEPr7nrYfp2#^{l6y${pi@NS%S<9X-vkjNyM=r^(OFtri+{c z|EIbn5(j@X+w0WHa?V_2cTQ?UZwBKg6OP?E7(8lDx=0MP*%opQxaiV{-l|I?c|nBC z&!N-Dg7*wZy`sYj3L<2NjEWV!JF-QOxLp@T)gzv*OCoVWTo--C9$XrVD=O)*Z}W;D z{Mr)!@8P=rVR)bROk#pbjYVIwhlmly6P2`@Eml?+TqU0ebV+n9A8p5TecLO777`Q2 zhL$frY?i>Iy6`CpJi;WdpdWg3D_m=M<7Baj)!@@c)hL>nUqubln-hb2drPQsF)i~$ zS2Rg}nnvt5c8~rWbV(@vf4vZ3ul>~PTZu_byHbZr*?c+r641{iCZK1u6i`}>=h*Q@ zoHU8%Pjzus9pe+aBoY@*x}|7Nn8utbu6IU6&8!x2)t-TE7LiHv4-ym8cxy2gm@B^D znZqUlS4|@Oo-W=>WZ%{$k+{ePPvTbRoZ%R$v-6b(nT%{q%IjS|X5}WEJI6Xy*rkKp zuS=p4X^mi{if4+kOM`^sqRlK{+j|)H`zWnFnMJeYMEl{P#AH4q`(aJh+|<{8URQjo zuRV)N#QF_AUnUr81T5@<#N(lA;$quzuL=cY7 z83k8t#W;!BzEQGj#fTixcPfk{K1P1fYcx>zZ=f2d2MW4N`Q zr5o;^nJHK$Q%*0{=Im5pZTX%?3m%$d1V$eKj$ z_-`hrvXf(_M#g9tEUjr2z*xFKjHN?9P79k}*VRC!#J{0SB5}d3J6*NrjO;uvODG!E z^HI6HKQXxs;kJ9O7fK`QZE|+rtBaX}{r7cABo6zHSof=0atjFJwbNzS!JCh=h!J6n zfb|ehZXkOS@Vm7r?7XJ#1%9k8)!|)%F>R9O1Xq# zKXtEVUWlOj>cmjp$VZZ_EbVU)wWsH(_9kS1vwLLgx+IiV|Ar7wug%EDBl9JrxVQ{H zn3xPUjpao3ZH4fDT?CbSzgL$;qYyNFB;{s_PNqRZanWW((Kc}F#0!@(OKoA^zL%I1 z42_AG4`31+XWYK6D>^0pZ!ifB#mB{1OXI zc5XHJ=+XsU$s{yD){VIg9l}vwY$L~hxw}jQbIAy@&rA&2;W0y2oX(4ioABJxJ)Sq| zl2FECOo*h{yy5@^>eO{74A-ieGaR^e1$2Q}*JRE{R6yHB7x4EkuXX zAfdQewzvXlo40ne=NBiY0x_GpUZg8ACG?8|tKUI5V#iDBbPDo4*lV75?f3G5$KLNV zSlPmAy)H4}`o`jH)oZ%P?v=VEl&Zc$z~5_I)z`{G{ZV2luNsTBOCQq3NU7)tbV)SA ztYK7?T@oEdgM{Kj*d+}TiVNY>X^>D{2wz%*gyKTP-84ujF8X!-TjBzN(|@|Mfzx%q zXFF9cxa509hW_ELy>Vx$P3@wlgQ%-Zmvt?ZxPmTgeBf?pQpkDj0(a@|alA#Bgz5!1 z3sLmi{7Y?Zc`xo%Vwexf$yfXhxTke7Q^UbYT@oF`uI(Uh@vVf!J?1+9xx^%}wNV0C z>Xt7QXqqzAbb(Z|s4$5uXi7F7D_M>eES08k(H3s?h^}8hnHapAaA!=odOFk1)i+`L zMEBTU(j}qv{MUtedTm~|oUIyIIp!Dy?(Df2;>e}=$U$US{DZ{guoW97B?okK4>o06 zxwPP*NfhtV#ZjsGyL3q;E(*Lr54WO}=<1~KJ20As@pp*{gI=IVJdhy5ufd2B$KUE= zsl@Tux+D@8NBvx;a0HG+$a4y-SybQuU*{BvgkJLQb;7=`Mn_3L-w7 znDFC+h!5$4tZeHAT@p&vNm;d)QN-6L2J<3O#NW~dN#XozCJ}3~dKu{6ZodP;b8nqv zIR!I=TLQ)9gY_rsp%A+_{D4@h%t({+K-~|z+wbS%4UZ$f^&elh6nwwnV<>3f(YIvD zDf=$|kfme>^J@?sV@KFB;>&h3nT6P3*0uS-Jp zt@jFKdN+mIE~LB4kI<(gV*N3LY=0bIVO1G@KwZU?!KNW>v~N(B;ie1`x<6yO8d$bg z7h=;*L>IQom4wjcLvUrN#m&q2KV&vETBS7PpLIzjs3Af@+ATKTaCK6?WM_v!uSfk| zI+54vl4u0~a;%bXB$SsU1_lihiiBp1zjZPl>N@(bpRL>-05Ze}}$S*#AghefC#H;#cUapI>Zy zd>vnu4k~mVGf2~giN`ndNrdAAysmb9$n^$^nVOjeKhty}*TZ#@G=ojRLDF__1)tHx z)BG%QEVFXE>c_8oX}wnShAIfjnTClA!z6fE<^PG=S5slv8v-0o)ig6!DO+%{X%D3t|8tPhb#SEY>*-^R zK5nFso9SZ*ecVbPY5JI;k4gI2O&@#dV?TWy#D@tMXDr+an{mqU8K+&VkV7Sc`s4T} zX7HTyHg9 zQ!SE+*pJ_G$!?OgU7Y#c%twT=aANDdq@& zj=vY|zrZK1NB;tUVF{itNcY>3zeTd&*J!-X)wgf=R@NXAywutoICID0XQl9w+P`=5 zK;7$utj&w*o%OtX%0Zic2;y;>COgTrD?Zb{pt{}hnG{cZ;xj2qd*d@HO8eq7DN6g} zGbu_3VlwUB2ZJiXJQ$NnAdVaC32|7w#UPit7ROxXS_E|PE^{r8y3Dl*>>*l<<1T3} z4!q2@IPx-A9Q09CJHmcfN7(Q3u{U|}N5`YVA73>1 z9XS%MNFJQrrPMW+n%Qk>QZN>T&kAQz-$uEjBzx#B>N(uzf$H9^vfgB?8s+9h)>j=Rhi4?Ian z=88w2G*sqV9D1269{Uij*d80fOZM2N&bV*?9)-lNSnPN1+8=PgD;E1bVOnw6AB^OR z!#>Ja9QM&%vDimyjKw~ZD;E23uHA8ZAK`0voZd%sMX}$ayb&0iF-&*J8%*yR-xbJV zcT^6sC3dS4QJHL0b?luC*D*P+G&thdbhVDne2_qL`iPXB+RWG z5%xx?64j#9<$)@xUV3s~&nF4*Q5s9Eig{nkx?bXs#&ssvlFXpug=6^|k|X za)`D!P7aYia3EF=JJCI)91g_FA)M=AM{+nACx?R(T5)oSwDDk^9HO-1P-BOf60Xs1znGptgt%!qnn~&_HbwDTFFrEI<~j6w3vzwJ3_)WSkVD zyiG151!%4WWHL?)pcc;NOTpwtAq0zPQ3zkOD5L^BYKTW^7YPVeL5%*?am!(Otfov zR3zHX<0nbJB;vZe@WA~{i*$B16vX!Rh%>)fR}ayOicbwbQCd-%sa&E%$>3B}P%2lH zR#ZAFSCm#%ASzeH<%8LcHD{qV#zBu7VH+j)i(s!D*4WTmgjQ^54Y@+JqS(i4kk4U! zkS#m~-4!Q=2)>vbv_>u>E5sCA=ZeyblR}i%B2rMY+T}~Z5eQUjrOi`daoXg}*C#{rFbORr^o;w{)f%%9meK<_s3WJV9J5|rsvEgK?O)Kx) z?Z3j}GY`H=aaAH}uc4fhsHVfPcZx!BU%hQUwJqx;d?CYpi z@>c2Mc%h8AxAVyDt;-aQhvqYUbdNS5;7R^Aug`x! zZrxjPjAkr#r~Z<&@X*QF{2U@&!6>sB#kv!#Q&X zFLB7F>E&}Z!2vB)H#`s|o^h&NMVG-P+^G}T9peJglu^pzQpD06?e!%E1kH`uL6*S| zvJCA8%0Sd+K@g@jZ+^=A%jhX70=?Upnz!Nfu_F`PpS$Dep+l)7^wu>%ZWf5(C>D6q zv@OlW4O(gJ?6H6!_r2DSyfq+|IxO;`{Cdfd+|nl4q4jcp7TNA5m>CT*b4+f81F0R@ zN0$lRaXEwCNomUwTmG3xSx24C0vAYkR=_(zY|GkG>C~O#4b&;paLd6Wms=Hp6TOtU z-jf&@Cy;Jgl(PpTJNg7`R3e_WXbJB&Uosl(5qD|gj<8~`)6K9&s}l@TAzb|4X(4Z{ zh0p+Fa91GJO3Z9_jAL^R5gPnpA!9~*OAt}TTi>SJl(4A!kkq78^h%#d#UXpy92*!xZbm75|6_~ z$SI#UOOi#OBt5{9T|AJyVRzP9`YowZ@#{nrvsG+`L(en{pdyGzS}L-oRW`Ck%!6$3 z*x`VLY`4hJ(D0k68fTu&3#8_X{dp-xI7R&em);4<`nhqJW+-=<4L`Sc(@{YdCMHBS z#1rWw$fC(37zZy}MKF;eLDME!5i$uq5sF7oyg?e}ID6_2UoTimurp_ zqa?T|2Y{}_W&dTz453M(ADJA2axLCQfQ$i->q&Rjwq5MKb*g}iLN*>fgObg`@8C6i z@yuHv66uNH>I*QjrGXYMGjxmW?DzyJLzrMFgSR<+wmxzTH7IXupd7g{S};pl!n7k< zyiIqwCEj>o6u9dJS6qYmwGG5cK{9On7*3ye$`z*Hphk6X=uChVqs!xKs)6EqCoh4A$ZD-#DFx#)WUB$ zk@hnNfg4*O&|HI$1Z8eSqD5x!x<%NKX6d>H97~tsxxrg);n0w8tHDl4~0TO&e?aHKQD&>k4d_&zTQ<^e)*M_<`j2>P#gMX*XxR|t7 zgWE{;tjAx_Pgsha%e_iCY2Oq^qv4sbf}5ty!c1xk8^)_9jyI%^@mPlwXCSwl4>$-K zbW*}k5CylLMJtb$W~xRF*@RyOhR#-9IHD-L(f8*$Zd0itX~01;1!Al z3?j~#$RSNqTIBHkE;Mjh5U?*e%FOYUMLbC3fh>zjwl|=%bHC)QB9XIFBHH@SfX{ac zKDUT+zB3&45!tGW4AL8pc!!|(o`BwanV$XrAmIZd;X^^fheg6iDS_6q?2n0rPXq~n zA`(7D3FP_MpB4$94RU-=Bz&F{$Q`l2AQJwX5{O^>Z$!eEf`l)Ngr|ape-H^@4HCX4 z621{6d{ZQRCrJ1%CwL);HtgU?AtMUn54|A+s0KhOt~ByNVjEN@GNl=kbU-2WkW46x zP!#iBdqq~N2hBSSni;d$e8pGUg4+FT5Z?EL_WeLK_(ws)k43`21_?hE2|o)G{*4p7 zn}z#5$|AQJqBa8i? zqE$;%_?w0adl~*hj+Kj#Y-BYq2JYr=XaS6kAJB7nbbUuy9iZO|$ zM5ii*#bBerqGS`pBOTjzHV!OwhKPqR9`>lYm%M9^mNQwannhq>76%4PI5TEu&(qt^ z#%pu41n;#;RlQYJjmb8q33zj6HGNUmdz)V`wc?VuL(L!4VpI{+k*bCH(C4A@v4SS@51n!5y&`wJKZk%aU?m!l`5OR@2ooRx~8_nxBKZ z#3k=mns8Xz481ERBMc5Eib#Yp3eTcs>5Gxld;RyFh~md8 z>EplC$HVmTa{73jK0Nw(C4Ib(J{IWX74-2Md|bl8%v^yF*VgTeNbm-ZlrNO%3V$*W zHDMFH5yaDGtrB8fY)dk3)q;(K!;b@#9D}A`YjF+}A}={OA5XuBG1b5fhgU%|Sp%J& fQa6NCEskoJtMl|^TlfhXrW~-OsJD3TPLKaz(1z8*g2WK3sBRK3jE4$(r*JWU2AFjLWo_lY9$u9|vqx;WE ze!t)M-19m2p8NRyZf*&Ap({k$q1^TCyZy?7Y?2Jl?4+vY5j$-}ugWW)%l-ll^mEc3&=JglMG7-wY&+@5ZN4y%GL3<2Zx6wQ3p;e&Z0K=$Yh z)r_I-S1yOg9oFu0Ax*uj*6wkuTrG~3b?ZE}Dz~b&eI@(rCYc_$vbD|L(&j0RZm%8h zEMp-%ttZKoV72MVQ?S@(iS@Adk2x!ljcLBYUktY$HcZV`MdH703?rRvfpSZ{aW0Cb z3`EY(1+rW2La^i(kM&RVI13oMmj|NOq-`He!ytHSXL<~M<4 zLw|mjuLAg`Hq+xBo*y}}DhmDnE%_a{u7cZBlBrPvQB#v?sshYYbK)`-Jgm(>tX=^d zr%oY>&_6AM#w(!0GM@1iXS1;l&^^a?3ac#~Tnyt(D#GL3n4Cn68B`4vZ_ou0caU!9k zM33|LU`Zm4RC1UNv%=^F1=P=qhu&E+WHLm}@p7eud2TfM94h9N!vn=S=F)FXLBvR9 z9L5dD$78xnW2sunMrh!AaU~%OSOZ)VkCJkkq~BTtuJTX_FNq)$TSbYNt(CKF;cTs( zEj&9rJC7&hyZ~R8m`JxA?l)dI2SvREHWs70q^J!X3<^r`kkekS1XR2(Qw(!;m-(=Y z%e+{hbF3kb^||P>OJ!l?0(@3xBL9#Bedh(LfZcPWDXJx?L=5?v6!H@eMY5oAp4nGZ z{8B!Ll2mMoQzoJ7ScrNkgQA~6RY#aDd48ij`Xm;TTRXqFXo>-i!DhC=N98e66;4y} zDlAj6DkRh3T4g*WEz+=Yk608Bg^OZn6^oW46=Wp_97COAGz>^|fD=8((}3j<-K2jO zv_^dPmGn%a)mPn{*6O9T2GfRy^4^aP<-H#YA6GHj@2X5>0#rPlsu^AcQbNJLWX$kv zJNbx?;I-YXNjdITfjDG8 zO#0E&tQwEcUK5xr<(N>t;@;hv>+R0mVCq3ZeT`F7yo#zZVt;1Wn8+QN#6OgiVu$)qw!2hoo);L`tH5fts`>aAtN9*) zSA$h!;oK_G&pTJe!~3gZ=pqJ@BGp2LT2>47wK`&j3MXGxRTB|2n`2Uwn%9G-?rXYU zrudKl7WzEJOR*UInHU$&!6U0Y2G1&*M)vRJ+wTZsvhj~hlxv*Y` zQVBByN%jcLT^y5?L3u-7(jPnaPckfUxbWn++|gplGMO#jgCtkz@2c>gEWU(Wbr$-C z$Z;1$HQp=7T$9O{qd7Ro5gI-!qcnV0jsQ~=%W*-IiRv}-p-9lkh9cUfBO{=qMGVCx z%<(@W$A9r02l`zFgv^5D4Hi06!%OL3*dz6DwqG1OyY27f6}Z)Gp)U!_Y7{p_*s?4^E618d zU3M_lB|&vnP+dZ*c-X&I%~uZB+IVT#8_nzRpvF-vH z3C$bKN;5u-0Q33`@*YGz+L34u!(){=BrE0=&MzB2a`H(5M;|rC% zkO9d>N}{LZ9!cco$dkCsHhWnl@wG_eGA0oh&Yjo@;E}AY(?tFzPv^Eg9m{4N#TKM= zteDQHob6+lPTWtvBRvgQHt#fu#ling$q?=>0xpuDno`2qVy?7dv}EYqoT?svFHFD- zedbTTDk)^IN^$6tL6Nq3>vl2^e%Lw=YsJu&A6v=dA9Eh?udy;{?#fl>V&FO4adtQ> zF;d;VZK-e2*p(c&iQ~eItqR;rF&vpaV1B$egnTgY>8~w>ygHz9PYcO-3g6A_ZjGa^ z#@;&F-m=nz-G5EoYjQan>uPe=xY#{>r*iFxPj}#9(C$_^?JW)LZZ=K{yE{@+u9#eF zujBHHffG9(C8|D52aiHoPv0PY1BuZqL(#-Dvw@k%n7PKxpO`6Dqj`XtBg`CSW|RiaXw5{l?dBHh2KH^iz+dPMYwY#y4nt#8o1v+trmoRm zKiQmbNLiR-m^gfmJ5ajxA>)^~p~XhLTT~Go+?zpWbnh|2!e^pj-|2{GURDJWST%k z$N4JL<68zBsNoSRg455WljGdusEE?PKSrAnAWMVoyGwCPV*`KDCrb>HCA~ZbcI-(d zUvcR*pEM~zItMoHO(Fl~vLAf1G8DWiW^l4(W zsR51ElV`bTw_G$XK$Heg9vTPVA4tWQ8rEXJObj~@`sFLMLkCmIM_l`%T)U|^Ks(S| zM25KTx=g1{3jipEcl(T#Mndo2bo!&DEIj0wGmAW%CUOyee(F8UCKM~1^q|&yo;Omf z5N6AS89~A)Uog^gAuRI=!SJGA9;LAEMI&_z-723>J1L++hByIMy=0_Yg}75Do*W=9 zg@uQWv_}Z{$%L5!!Zb*F*-B3f;p>v{<$%uF@v06+y`ra|FkObE!tOBzHOHjiqV!wQ z3+(=H)g=O6MA}CC_j~yxH)KJf|Pv&dU{JJ|0-9;1u45u z>PZ-wPiNp4jsCO4+l_W?kgoQ1J%09OI-^YIzp66E(o=d;z;#n(I{&qj=`!EYlS-~z zB-8n?e}ivSlNPRNl4(+c*zTOx6Fj~n+jg%m*|+ksa97^clNY({RYJ7HCsJ8?e?a&7 Gs{a8Ce6~~o delta 6696 zcmb`Mc~n%_8Nj_4W?+Cp5C>3@8AN0WkQo+dkN`#n3oa~ziAh{W7?zQp!4QprMHAy8 z$K{(uZPcJyTw+{85|_BdG+WQf(VCp5CuvNKO+7VHqph}Sw)VUC@!q?`%%A<|!hP@e z-TS-S$9?+JI=`F!ewsebGk-mIR8x>eCcyHn2|9N}z#?};_yDgBJ(cw}*)ly;v#jco z3={0jsR_ha%c@54%97x9?ltb!?uJO`TtBcplLUh{9nnL%^>xw;8k>={L!vDws@reW zsD{JN3OZ_3S3{!nTl|S3&CqVUk2?KecYO-2_k*wd6E#I;tec43V%AMj8SADqcQ)Oq zv<|m&{po-bvw2+{gyr}{`NHY&%TyCN3UPTxG6V&AIZ-F2Uc)?lJ&e8Dv|-r)L8+Df zyl0XLViExt3vx&pv=^mPY)0&VYhe<} zfwP5^i50FE-WOfq&!>H{=LBT=!;)^RW-Qv6St}$Rc2Ap(fgeuGQO3_}!Rq*{u~&=6 zfH9T4=X8Ie=MpeX@76uWdW&>+`NNu?IJ({+cK5_ktexqJg3uX3aA$fh*^bR51a6f` zz?LGQX+{I1q;ZVVL}C*iT&tC9)xn~f#Uu^Fi%fyT8&iFhLf+O24yz2&fLmVqKK z+eTx@m$>cc%yua6HxCk;sF9C?b{xK+sNoy@b2*Be>9ex3a+mVuPIk(MdrK9=A`PF# zYK+BM#2PcaXLbwkJj>~FlyOSkkPQFa$Ft@VY|_} z4ckg#DKNP~GZ3gWH@s8T2g>oyfFlc(6Oal==gV6wig{!-xSE^XLXO1FhbKo9ha(KZ zfK;l}vNi0jnbTTZ>*(loIci;LrmBoI)69<6mPUJ;X+Hiwzox6h<>;*GN;A#H>Xp77 zW%qZv8cdlPW>Zz`az~4)(y^ko#_notZArV*x0B5UQ%E!2-&Nn$=`v-SEm;|ILh{kq zqW^zq$}ClB-Zss+~)<@UgiP-i0MA=kWBH)> zA)Z-V9x~HK0W4?9e*qR^FJp&O*1ZoKDDtx8B$UWgBy0gZYkl0&VD5HEi%bLg{D#!5pmPJ2jgW#&smREpE^E zM%6A2nUZDm*cf;*Slti{B~8jv`&d%FBB^4Hsm3+(Db_cd>1_|!8-nZkMgv7&c1=T% z3yQ}_+?7;AlQTDwC0v$o(FQZMqs`@LUgqdvDK|$+xtt6ZNchzmL!)%c@}y(?W1*r; zT0(4J9H-4}9y!kRrdW8YO&O@ZECc-nUsZ zbGEFC3>>~c5a{bMl5iO8i6sP1_e8_DF1GLQy3E7`;l0XjAQr+`%C`Y{v&%q9kYbyO zCci2sKS{RpSG-S(Sql(W5UR;SWCk{oO7XQSIvp-Q8bcc3=SRmACq#9dquPV`XTfsM z&w@Hw+-=ijV& ze(~Ex;sV+~iL8L6{;AQcgZYv^@42KM!R$*#8#6q-Z@{g88AyC1nR^u_udLM{%C*^uwo+m0XH_5q!vvDV(1Zttjb;{|z0 zde++JXlbm?UeU&$-Q~~1+BzJajusccfjYWt8rUl<-ly#Y{!V*GGpjmrtJ()b<>;F9 z274oKVg(M^-Zh}@aMU%{cH;eeAfRRF{L}SB`vJajz6*I9uaOUi5;xV8-gnuPJvcSa z_1L;|11oN^;vcN2)?o1fD^9ZF6f2BcEaF+QmK9I1;umy|89~B;4Aj3G_fGZJ$kcaqKx2)5nfzaw??$E`c29+#3QnVFbszPJrm= zCX$aidqH61e6nGo{-E0tN3L`Jn!p=<@I_Rs#}kr5{9xM7;W6n=KETOvWv7vvBzS@V z$NPjY>@w1+5^NRVi9X>|&l_o#1XrjqlnsuU+6y}-!QR1m+9I*bRaQUAtKqiYv*>yW zTql5uKEPyna*vVjk>KYAc(NBf?}Zuklmwm-z$7p5`@NH4$%{t%sRVx_z{y^4+wMtF z`ceYDCBZiYIK>NQE$6*##6M@@2U2N3DBQo(ENw=8s!uq1uaQjRaJ&fL;{z@t1su#1 z!89)reYfmSAP;i3T4iHAj{-Bjz28VWIM=Fjk@}1gZ7w1M9C}KG?i~Ro!Ms-u@X9Mj z@-l~C5Mi@V_{oDt{8ueDQKv=N;seempL6ifBADp|G(h1YBe}!j+ajFh6OK7-q@knP zA)~>gg~iJDqOTmb(qxHD6iKTOaxDDmNCKTM(S;(N>qQS9&83e>xWT6*%g`o8C0iFD3dfB0b(G?RU&be~{?ADjny!cbUXh1jmH&^oaOzmL5@9@11v#9JkRl z2~1HzSaQP0$PS(`(qf67p|X1K%*YHjo;1>>61+%&y|W#IJKi$Vl@k1@0DC7f23Mal zQnv(e7GUq(Gjp~SzZ@_O%NG90kwtchNc z_^$+hWTL?T6d4x!1_OSU0{$Zec;^8*;KR2~BogA!rqYP;;d98A)BA|a0SC{Sh?xhZ givd%-cGYkIwM>DE?Qx`($IKF9v^E|CCGR})KZ)H%Am9Qbf&wathzklIvM7p(3nG4~D59Sa-{a%=_w)Pz&b!_F-n#eJt)$X3 zVDr$Er0U(y@}6_v^PY3wR~&rfO*cL5Ci-9H_F_J1Wj9-lL?W9@n8lsSkwh+D&Y0QK z&Kq`4zjEh^ol}*g1!JR_D;MJCPUR-Fh$pRdqF`os9>`eMTsd4a)~Lr$vMG5Yd7yGMrqG1H4oU2s#HYnp0ydWw zKVk`U)yi5WE0-;{6pE#t%FSsjYwnC4EUy6QyNl(OV#z82g}JPwt-?OA_drWa^4}-yW}szc}&$LI<#xyc?)W-V5a4 zkADx~-*fQqxj@yS)m$NC&{}D-o#cbb=arMsPqrl=N}fud9y^2q&Xhd{s62h8uw%$! zs7te>%Yozzk_Q0w!dh3KXS5d;+`6`dcgf&1X`LLvSZCjg$Pf5->*?#XwOu_tzt zM)G9})k%TsTRl;|;fd;7NlsLu`enrM8%7~(W!IvRMn$lD)GA?XoB1@P4p@J#Tq;?S zwX_w1^vUF{2sTE^%tAm!tZd|3*({cfh?G9YHpGS*Ddw`dNWwq^v`m!Q-atAXDJ9K_xoKqbX|u?X zXF%R22zjNXRkTq@5;p=R63LiGwiGGlA}b7IQHe3LNig#9%4A~)-cg8peK zoeo4DtsE*Dg*DUG+>o#%z*%f+WN0vYet3vif#XpFG z*Rp236kRpJMc|rTHrgI*YvEde)U*_Tl_NPT5vO)om{1?uXG)bowKB=~$X@0qq4!p3 zo_i#`v?D7`7~6yu5XUOUo(9eGHYITkC)^LtOvf^2$$%s^_Jo56XMr3-N>@v}E|n_J zl=z4i^4QsYG6!zd_YW5GYB4rZlkcfq*aL#Jg-K-H>qM4@oiz_GFH4a}rI}%^_`Qj@{_!_?u9T>1tv$3(!Vys~k zt>xBREbJo-YPuEHo>5MhT30PdpH>K_96rw#wqpE)bb4(qrfk)iQ7$EO1sI2B5xXp( zSal)nV0tZT7!KU14{S6%F4<;(79^2#zb|t1ttNIzti7ef#?>ywjpAqwrZ7dp8V&{SS zutUG^;n<-;<<2_kiyc!l4~0gLcDFQ4Yq6nR7&@VhLn)cNqq^o& zEu>!OOVY43BCVmlm>hh05>F5A0#6N+(6kV@^`o$$_8H;HY5%Ae8lH4H-7q}alKOeR zczWEEpBf~I+;Zs7Dn4>bA@!}ojV^-igKQ3yJ z{OPTdK3-hpls)Qu2ZnUX(-0eo7ACQCs&4FbHpT|(ZRrfL$2!3s(n02h9s0h(HV`dL zV&`<-*y(B%cDh1fr>h2b==+9ar%Pd{*%v#05~yKk)83Zq)2Wg#4hf{6PgM)Y{-SZ5 zSZa_2a-LBi_QjK*1ZvPJtQRLJc0a5f&uR}ja1?wBqcNQLX^;f6Phn?#v9n5+&+y35 zz^uKg%yJ=`HaA=FGnY5;qcv@=8ENvpa1OB6!Uo#Xq`&etze`)M(3i ztfix^9f#xY-j=rZmbSLuPWm}KdBKIEgC;Hwi;kV8KCrjaOQfN*AIp)#C+drs8A8nH zg2SIm&iPUSckyPS#WG8)ExE#4EAF{k>GGj9Q7~3ZQTjZZ$`#FM3Rhmy4Ra-Gq}RxU zn#>ekNH~z%aC%O~pEd&2F4_CU65JMFa3?vqb2b-*o;62KVjJF4?kX;W^eq9{N)Bp^ zKW$KzQMTuGZHk{|=_6Z>!ouH>)>eXFNkun| zG(sU-jRL}=O1O^zkWqwfMAhA7bhUuUp^aSOstfp|OiV|O!m5MP+J`nGW+WmSxEhI) zPG6K+;};jT1lbN>_B0~O6Cbc^ zJ#IO0p?_*4Lv8ZCFGJ#>%NGaCc`-W_9bIrpZ@Oz!N{W$w-E6fILQSnAG$zXBcF|1J z9o4!C#wo_rxgxO##C5c-!|PW4P%%N@I&ffrV#9w)GDG8*A@R`diw7p#B`-|Z$qFo# zE(-+@iC*+$f}@fN@(%d54{a0-N)&`*0iWq5&^^9DGYLOCGBv$k$B7y=Uu7I`CZg*d ze$XB&TDknX^XzPYV#E2OT5!sU4ZlexjJ>`v4$&s(3?98aXcJarF2&o3`C2JQIh#h; z<34h zl&Fd3Mt03)Au_G&9W8AwZ7vahhqD8M^mldj+falyLAV4? z~q`C#DEc>*}%L&5~;@ca@{ZVU3Ukqdum{Q?xI61`j6Vv3smcd-yudE zP5P-%>RK@yTdw#~-xVj=il>JsnI#jwI56T+Ve9c?sl2+{B5W%w*NQs?*do!SVdZUE zC$zigcV64(HmT3}Kn`ZB{>FxRT2iTDtCHAx%!!@kFS{bXHiB?>bokw`J? zXLaI9cc$DYm4mQ#t;9~{M0NKlg}loJ4A~2)EVd>Qq1sv~BjB*mO4c!~>x3oDX~e`v zSuDNRXZ(w7YxQg_z@Ej`9~PI0jtKDNA!5N(2)aLrh_kfm_^NW}0<+>H12*6s=Hs4U z$?(n8`=5T(OgF*;@T{8*^L=>~oR{##LQE4lZHrLH`B)7^wO_=Le+>9i1NH!1+ z#qc9pP#UIrOJt-J$rli*U9i$yk+@kX!H`D?EydF|H?<6G(7IG87fT>BVsNvFdv0!~l^GELk1@+>qY$ZD&m1Q9z`?})?3_dd zMsRhD~HF$jCsJ1hl-^_F1zNSf8`E0 z#w9!6;v|GU)~DH6{wW>Ah@T|3JHe&}=N+#+{Y=CjfG;NXDYQ{Rw6|(RmMb`_2ygfP z(tb>TOLMc$RC4ws@*{ilf7_4Ak2NQOy z6Qmx3h^HV(C40QG*I^WNFA4#jj%y^Xq$HqBIUQRmlXokYwxGskLSXWstxAv5H!(QA zGLEk+7lK50xoC1l1)m`DGDc^oCL;^xN@R{a+mTc7vz#V$A!+3i#_<}GQ5( zxLFj&7VE~??ZDU^dU<9B38Rj9dWM#LA~i)noJPPTm}nLsDw+G%Ak?kFkraWY!thss zYiXS_SDdy0vRJtBCiS)w*3h_I6H5WgRd5MBD~yAUB$6qdTq;e22-0StDdF}^n+dK} zb)sYlEM{CCuS_%)09&@@Fh_A^w+d>V^$w*UX(FZ{54z;E*9yYws8{b|{vMa{7M4DW zo%w?65w>@LN3SyYgHaWlo!=6~4am15$1sEdaVGid@$1SK{)!lJ@*YF3@bAFu%%?1^ zz3D=39sZlb8DiIhi9UJu3CUf>@oZG5xkNc$#P81IjfaSN2M{1c%u|2)irDWA!C|_z zN0wdc=Nd`u-*6CHQYgaAbu&wjZ-#tD9+*LnGX*z_){y9k^8uX@B=fuM`!k?44mLQ6 zfYe47%z`6ZCSNMzmq^CQT6r8M=-?WG#$7eiMI2({`~z@FIZJcm!gw2ug`-Fz!A~G& z(Mzm-#AbwVZqO8y{C3?;f(*mdha1Tx?{+YWLq;ZfUaevVn>oS~W0?U3 z!so8~9ACjd((s}!F1SW`f*HybdD5&jG?)N)+t(&8Clgg-&AhFLmGL5u*^!0Z$gu80-#&r8|u5(g18 zpM!Vkd%S18rFT%=ptNCxSO7ILK- zyCXds&LdKy5UA@$+JXv(ZpEE$F5%c=v~iHzXks%#KT9djr7Wp(DP;L48x}-v85!2t zmsyhpZ;l;~;9|tz8%}jxj8NlFCw49r~Sq3`8C{+M&>-rDz(55^kk2RnJ9u7Ag37i>HvIG694xNmH=UD#UPPBWZ!a zvlpl4$A?g$Ad-gn3m;=hc;$*@*kMG*eqQqTew*@7i4`i6Jy18vPJm?hHj-q&7DTei zDMmJ7bHf~>9qHDT7Izq{T@3+n#30AiX75fm>U<$z@ot18I zoS1}&PFSm~_Cm>11H&3G7ISfnDF}Y*%Cto0sQ!k-EhY|axMRRY0KYJZvI}*XXV5{Y z%R#3GupD=0*q;5!gj8W9d8j*!9A&0qE|-={j2O>(K_AH{!H|(tMH8T=i~KN{&*4N8 zAvYGrS~20gJMATOMie*RKqPGPu!vL}V65&9fLb4^3k}==m1Hg1D6WK<@vk}6k~k5d z78AFcz$W161YFGV60B1d=f~vSJkAzg?6a)c=Q=J!A%CTA->f0KL{MR^;FSS6C zANshVk4-EDlk-%_HaGS#lNwZFgL~4UY48V5`FzVW)K9@oWd#n1r&DEcBPD)lOY>R^R^ z8e|hzZf2$JQm>`<@2RNFfN-Iv?1mm!@`z&%5dllS@K?}0CsG7kr|c}uDw>I$qZo^PV)%6nQ?dQPz4{LoBk+09y#b4;&#_1YI6IOE89+HMY?5Lb zHi1yFvlKjFMuxMfn}{wL$(ouK_XF_A@jI-GqHE+FWoslNW55f+Pv6h7o9va`CiNZ2 zCJKm_k^Ng7@C|Re;3Hkl@J29Z)$(wR5DmE%5g`E!m^g6u;^D?Y-~vf$xbzUJork{| zYMq@XV;9o76(c{}IV`DMqzWMv0g?a$2=!oQj+&w$ zVnP6sW=u?U;LFWen_v`14TU!0g=^tO)=p{eno9C|Z8|ACuiu19E58GRs=gCGiZG>q zhKaY-Bm|SZG?e$?+C}1DeM^fH4~Ni)fEacOsoxRa?SltN_-A+sTw4YGRtOr20FMtd z!oY&~{cjCvZ6kpoE3VX|hf(n<^+AS@Q1^(x%9`pI;Xftm_7qhW9vt{3fDy!jE=XJ) zsC{cA|0@jn!Dtj5_+^GhaNw)YG7I3z*QYiZw6^+q2z9YiUt|yk1268Py?AJ*xw+BG zyqfHlOAVieO>#qZnl?t7U?dCPh%$OWqP)u~ zQJ(6?stqcwzdkNR&9KyI26Zrk0;J9rwNoAFr;~)2xnIAftQ*RU`!$)D3_9UGnPj>< zg(z}>ZIj}1c&?j~TnCA?SDe`kpi%4N1yo2&P1ef`{$^6;5RazZsXQ%8IT5J|*zk6s zE7?rkxc48z(|0kMJdH3y|4ylGz>sOKeDLYHig{sD_=M`sNgM*=}0P*juD*f;U{8`OW0@3ToxV+BC-@`F3(3xTFXMN!t5tk4N_yh;W zm%Utq6`+erT?oI#^?=`I)YoBZcckOqPBCv}BL)jJA@ON)W(~yl8S`#<;pDuX<>kaY zU7ZIRrKF@e0J7Nw{Co)T-i|ilbp@W&&&Uz(zkz7m=)o|k>y~;g!&ER*U(IKgJ4|hM zZNFA-aomYH%OSWwcf=F_BE`siB^6Ordd(R5yJl&h#v_BuL37zMHzaa>zEysU&xSy^ zh?@Tl!S9TB9y`V2$`7qtYuMBdA;WzbsaL|_mu`&;yE9-%yaOHP_;;M!u z4haPJB{sRST-TiZ-covKdAiqZF3lcZIYW_ykZJ6ifN325y$m1Y0wSp%v{MP}h3&KT@@6TB>fcOf7n zpAxuWOX4pL*h#sR{E0xlY^j_{vr-xIk5+updU?7pJGwQP>FOIV#mZ|5y!10QxY5xu zHF%}%!hm^UsyH!g78c5B>q>NWcrDhSDGX1~4P4uZUM@|JZw{A?(Tf*ml05?x#jdu( zOxl?38yH?2IM?0Td9gEkZMI{s+_AkmJ-je`zHcsGxUwG2jBd|OU6@?mzMNfL9Btbe z8yw0NHn$Q3^Qno+$tx2Rm-FSd{;9dbOt00^F`hQe;$nJWXxf@87<0L$g{^bNwZY=~ z=xDNZKDl*aYiV?CGQF~Rd8R$L*gey6Wi~gTxO8QByKrf$y=acdSLe+Oi^W*3)E&FL zeeKFbPx?}NW^rP>Cs~|}$46E!Tufdlcf^v()#>)qxs8kErE7_)`HMXZ<>5?WY{a}) zn#^U_7n9ez=8{)BhvNO4=O#zjV};p`OXk+9v5|}~73Zc$@?+y;}{IV-(xe1XK4Dgw@~U}Sn)VY>VK0AfLx@fXi{IHU9J*# z0xw@GhalY%Vz#sRJqSmTsjfG;=gH(AW{ZkTxi5p1&dW2E(~Da=CMu&vCYKz^%p&U- zkI?WI5!J$>uf9Yqaw1iw4|GL%7w1HjLK7DUQ4*q#xkLlUMTltNn95f*LiN;EjVFe- zAdh`@quBR_+;aBTt zMCe{F4#OX&I2rFEVwBXT=p9KL^cs`A?{q2R$SEEKC^CxJM5p=65DAdOj6Avo*ZDj_ zSKRy|6ts*BQNsbZxKORej!@XgZy*p@rYk?9PJIYe932V4(Ykev8e1vJ++p@ytD8ec z=)pXl3uhc$C=J!R`ze^(L%<{xKdW|WH(>f3$TMlDdYP^nzR}3Yt+HK*|xSxYR}9< zt#zw(R<3o(u~yge5Uk)Nmu|9h6ZtyeU>9cT()js{GpV7ruHIZMS-7&&xp{FS+Sj#Z z4)l#&TU%}G8cAf*=cY>eE6L%+%tWcv97#`aMdOzya?=@eaOqNUJ3bemx|%jO2F$C) z=v-=XZEN^iw7=9nb8f*X_Dw9zUrw%0E?wv;m)kCF51aGd?Pl+E;o3s3t(?D5G_B1G zTbTe{poof#Y$>=?c{wYe1^@6AtLots^s=t`Nr3mduNYonJtGE-B=z)au9;FVdk z*s++taBgIL>6|fMj?K=@cc(hWyQa5?%jfzMJy+Y-+UI9GFB#G7dM36sZKS(96APV} zGgjA3uQ8nKoQw~R8j16(i#@~rZH76Mm|mQ+&d+V6XR_N9lk1lUMmM69J#Ayxu5@2+ zH=;|WX{#^Vo;F7=3~cuG4qYAE9J`Xecx~L6D~-$~=GUUd=}cGh+Ey+%wVEEgJT^YP zy_i`mOw63`m|yI_wzODoyE?YLdSSJv&^LN@IJ+>n(s}X1`SJ0>*wWrCS?L|<%`J3omqrFBCZ?w+W>$@{so|~8zPa9HPd1UxTqvAdXdfTAWX?@auMg(u zyH^%Qu1>BEZm(WTFQ)pphsS67%2&qM*9UTav5a*-TP|E(x-`GI*^{^y%blCe#_rLGTE3ogTx)|Jm`cDC(XBZD47o&ybjtR{A*-Wc6C< zZzey3cr-59O24t0ZfvF}V>3BVFE0X%Yp0h^scTVwk?GnfBEVFQAyN4zs%t>UaYJ?2 zR5e$iFm`cTAvIpr-EkNZ=bjeYdrm(X<^5~LBc__0XQA68?Puwxh^z;S>mpZs0jXG| z`rTSLlUpGdJKWqnCKgS&WpC##x~`B>(?rc7ZK%WI6Wg1bB%x8`1S6cq35IWY$nmsf z1D34JGa9$Ps~XfQOGzZVQTtp0c85Z(3zfXSl@GG0myWECvo^B6D?GAZA(3^0Bdcl= z3Vdo=ANVNkJ(Z;r5cej`Zp8R9je=)#57af-kP$MRw+ z1asZ6(iDZ*(jYV%vQYgr>1VMAKNHEVkne3B_k-;hTLG9lv^F;nBQ_mEVKA3v=RxN4K?`y(5n#>Day|G^cj`ESManU+ z<|<-|#bpk>My%k&vcRJ1BA?;)PWt$tL_sQAqsLhxuEs{BqLSPM$E&`xb-`CLU`WOJ zcZ|azqdxG>N`4z`g2jDZ4V7DiJ0wCM2yAE1^8f7uxlJ|;+5>ql_Z~kEm8*QF7X#a4 z-g>xx${$tSZ;#`(HdGk0H-}u$5&4nb_c^;*!`a<$HhW^RXzk|q{(!wGVYtU{yNaPH zg{d7tA%)4msngo8y7uCEO#!`;?IaHa^7euia(!@v`N)ur%F7Jd4|V@=JEslF%GM<+>F z8E6Du6GsDikC4HoKFg}iLb4~Ucu8g;Q*sE-HvHtnZZHr^gepS#Yz>MHy`T)z1}p!A zEF^KWu|f$+SR@-(W@s@Dqh_YE0%bb0VL7<;M-mslM|upeP=q>XsHcY5B4|#$U{I#{ zFdi#Kz;8Q9sj<#Vl``R7Fjqr>XrT?Zi~{i1b<D zcC@Rl2P z@vR4Lx~ZL2%-73X!jSam2MT{@rIL&^*e|gKR|^7bP+W;sToQk(Q=#B!*pR}_pSU9NB0}8ngcjwjg(!yze`E*m2oxd#wKR1p+TggiZsp2wO;Y(Kh*-qQ6d|LFU=>sv#8VUu zExfKo2t>0ZnI>q(r30lEpr|aBh{V?LDP*oY;(tWWuBz5PHMTVq`TA|g(IYT1_-)5i zcGXG*AH!m6`A2o9$Pz^GVe|?zlS!Y6Ta}wxQ=OQWB&L)qV0NkV8!HGs$P=;2a~;>A z5Pq_5gues`fA*dbzW5L#Mu77h`T$zhX-3}A2g#tkny%Zv^dru;-a#a|d*UhNWjDSk&`b{rSo!4_pMce7RY5O>6J6KS?|9)ALHtTZ?8q#6I;O@7{)-*6gRgb;a00S>>~MnA z-#Cw+zryZy=;-AaJV2???B>F8Ok)QY9Pgw}&rUd5S(y#T2AH^_?iV{lL{{M-LGXG@ zWU8u;+ZjidHylrAh6kr6CWa@6hKJ5X=IEI>T+a`0;&j4}7sJ_g3$L58OwChs!^5Yg zX@DYnSY<+7tKe}teONrzpkk0B=W)JpRHDNQM4>vKbY6^{nynhRC2|3mR8$L(u6J-i zicAepz}17YwdDB0d(3bN#bK!ojWO)t$q_s|L5Dj!Z`dbXUi*!nZ!Y6&B#=`bHBrYJ zX{jizmcW6HTth%cDVK-dXQvTvaHi=nRzej!9;C1B+|&j!NOcIp(dK4BU%B57vcGL7 z&&xw>1>xk`V*H;xzW6RMj%T#N4Sr#a_>|)pCHRPh_4%$02#_)(e6ZLFdz)N&tMEMb z`Z!z(gWNmn7gb0Px6o}m_qsT*hRMkh;)sunX_os1PXV=tXV&>#C*NK^{!*-3?j-In z?X|bko5OFV9~WDx@*|%9(x(6p6wA<3>tmTjfX;dL0SaF8qb%v65mE77#$pkL{Myq6 zyYx^&{^OG0VwdhtCzA{?HL~SZ%3DJPV0Ookt`r(TueTuDAh*GJ4z)q-XMR}V8mYP! zlX#7}$*3$U^Cj^jl)|IRCqXq)RbW%z8o(jOU!%&cq!3+(D7ge)!hrC{q*M-{V(yq8 zAvpQ$EOG%Lu<$i#91I~JmT_H9uviHBXvP_OlPHZFaB_RmPQcp8M~OFz*62NMiU3EA zQBh5nk4c$vK%7{js;QDOQ2T^CCJ9Y(IO$M)bPg-DQHG-DPslF_V-&&P%GrUuBjWZ|@j-mhd zT*UH3uoorMk6NW5v^>+xGzvz|ZMx+oadOOIPdSj$bd>Rn_H76(r0%4C@2PZqK#d?O z7Bki=4Q3utm0i9XvF%| zZCXF&PU2uIgL*ux=wBODkzy|4hSLB}c@URrD@(6nsB9;7jP>$yINq?*^PJ>Wp_iL* zoS2&5@;?ddQP`dgL2CW}J_~G*GO7o=p~U_D1%lI^C9OSb@aTy1@alY{3G6L1-b4li z-`F_aOS$ib+PIC{J&vu=WY&$Q9MEJm5>08V7X>pUiVJOV<&9xZ729ER^Oao5>t-rHjUT*O(@uY zsbJmCJf1(rTtm(jD6S9OI)mI^{#%3H>g}$@ z*&}@>JXg@9%zAxRAY=;de3A8_eI023D4QkNS_(QGIMYfN?}kHTdLCId8$6v=RjiTe zCN=YG!X=`pygW)qX5lgGwe>~&+j|pwcsprC_OQ9Cc@28seuq*(c%YwQwAkE$cF zXDdLwlo2|LGZj53oi!;Q199WbYNfPZhnkberHHM!aNidOfb>Y*kmML5Zkq}7I?4N^BFQFPlS1Ufogl8c5C;Fd-Z)ujP9pR0PEB zDASIuS$=FSM%vq=?H#VOt2$J&x)v-BgjB0mbb$#W4_(RpM=Uhd;V|;_9^=6}UX(&C zL0aR-9G}{H?_3C+iNoV#Qd>PwJ3RV8WlurxXDP79ul(ol|P(o_o>NqsM5f;_U^I)T(HRNafOhnhbGYQCGz9=y;1YQ9!sl%j_n zn(6urbPw8p0l*RM;SPN&EmYYGe-VO9bQ|~eAlc{lMzS~aOt+`1*7G3azuIJcsxMxV z_TTCz?HfSaukVete}vsAa>l=<%mwXK_J`kUKr)Vpi2Bw8OznoF$4IdTYZ+b8?O-itl54bG0N3Tv~w z>>IC_&5jo0QiJuiWBE`F98ZZNmq>>5VP}%oc?tt*+kpLy@F>@F#LUnGa8}V-9q`U- zY)F2)!;L3<%)uJWMEhp|ZNMZnJu_t=W~bedSXOMySMR@xt1sDqLg!4U>!k9d(MU7n z%4W_q>~}Cp0tsF6t60LsJpxtl%4Mk;Qj959Ia!7m0~Mr<1iPQ0gSsQ}5>Ib}-N5A{ z?F*;&c-j!=uNlcQ$DTYK^I7TkzKqCVT*1mCaLuU6d;C`KVId_5|11ak9Db80>&js< zgrxF8wi=tX78=(Q%YwA4lC;OGuxXD+jp_>}eG>?{!iEl34&n$BV@>q~<;ysbPa-Kb zfw=wTEr*f$R7zukXLu|}vcqx44o<|`r2GL!%3z`h*7!a~6o|>S>$HRHRnpY;G2ENM zaNo-o91NSraQ-5Rg~O#@Mi0J13{D^t+AdZ~y#108Q|T53^>SDg8gI?0+knn!dzb4% zLiqy8d&<1Js@Ng?e&m$H-F_~Ei%tp zgA5zsltJy%VV5gcdV_|oj|<+SBiR|8wb%!jdvo(#lI*p}1m)-wqBoNCP869LP74MV z&&5j~i5w7XM_gDe;h1cOc-q1pam0|h%FGYS+{?JlE*h&Qs^B6PkpeU9Vyk4*z`I%% z5Y`gG1r4IKc`VwYPz}cT;`#Km| z0b#B7bQO0jtLyQ`D1;q*yG|1Co;20^2By;gJvo6i-+8p{W)oGWK)sw-H~$ z>JcMDimiwrDOX?)ke=~aGQam_m`dWwc}FW1ePIDA3}A_ZSFo7&bqkq~&%{dDgD zV@ebOFO7fF8<-$-LcQnhAU^VEt-7A{Ht^6;=qJ5douncwSkn^zJ#WYIc%>yi!XDo9 z-U|YD@t*hP@zM6tRI07(Tq!+X&M%DhEscz9Ococ0E(~1kSh=vaV78yTIBQ%gX3lRf zjSeT1*5=&mYV`8N+)&q*%RTwou94j4`uf)P=1hD#({o`YHk9r>H+ALQ`JwY2g~*48K3TLOO21m z!JeM=#DyT0TVCAHQ0jxH>yo)n#1j@358za>epMv0Pqk z-`JjQpU+=jIM>&kNeuTdbat6b^YQWMc5WciJ3f`~UKzC3rmtB2-QB6Nc%L~mo*A6& z-7aij-P~T>7#u2PN7wq-t|7L(oSL>SFOBx5=0`hM(xv(0==nr$JsRH{xq7b6TpF3* zj%Jp!bDbB*2F>yAl~Ob}FxQ_LZ5uhabfIHxw(VT^h}9k67~JmY>xfyCOM~O)Jwkuo7#JO?MAYZI6~_FJFqS8r#va-p<06t-|?{wAt0S z)Egb2i`W*=$ey<prD>yFSS(J@$1V)EHE~UJ_Y*s(lK0~3`F{L+ z0RMy*tQe7Z&a>V@>VkIS#cwLXHb0;Hz2PkW9*v>^5ws4^F1QF&A;|8$<4sy|W z*>#>y$#Czkzk=jqjRU1{M!uYp0;YA0J0n@h;Yat?>-K~aw zTZK_qJ{z+oUr>@SC-G!KXQE&MML%)yVI?vh=Tr735}P zpQk;R%IbM%zWf8c%C^)H?&CJMUR4ct!yFEhEm=seMNivjqd-D z8^a#n7Fk3FB7W+57@KiyzK~0l#UqsB5mAa9@_P>(*QfAeir2730y5sv!YV1$42ev% zTzUeWzk$t|*i}1MnNJ+)lFx8cii7tEnzAU-Zf|i@YlRA}G*Epz>f<`*oCmAQ$C^cq zHfb!R8M3&Y7@ZlGmr-j!GCDgoNiUa{*-HxCyCFh|xgxP6Rb-HfeR>w>pXKG$#?|HJ zmL|-F+WTehHqj=FA$%)|SQKQ{QcNy;V3n>2XD<$PboU^GbPcZ>l#&_JZak1hTWRR< zQp+yNsmm8U1a>YNPZM*cEApgJ5)tGn&Pk>Sweo z`^?Uoj9c8V$rwRSfhUhSX0R#q3yd;4QzG)k!G2=%O2XdZ{>mQfec`E0(=zrv9a<>Z z^LVYfzK!&IyI84{ANdOE;m1D!Kfav-T?aqXF^_&WqFz2{qe}NV)KTAn zvdH2E>MYOiN3|ex)5xH3w#*68SO(favEB1Sb+?K8FN`!gL)J&!e-BSwnvAiblel~Z z{4UC|lljs}bhFTrPi@VNj$N3@Zg(wY64^^bvGVBbwXT`|?#Wbt-%3}P-IEP9 zKC+aZJ=fX4ettB0Wo@?eYHwG<|Ml=30I-U0AbwUbPZ5>-vhh zIC`}>(bc_~PnHHIvxC-!p3LA@dA=*PdSP-qm%mURThFbn^~X;#xSnWwLWq|e=n9E0 zWiZ};Tkx^C>fn+p=CV7fKSZ_EC)h3Chw+=bAshRQ&dQpOdQ7@V`l9V^ev$f4e+E6o zMS)Iu`7tk3&r({*uyO$KA*GTL4gmVlmJAQpfYf1*KL<_OzHak2#{(9r5KCj!XNmu% zjytC%&fe*1j?nw{!pp+0qEr;A9g__knf{RB=9*lUcC-o+6K*D1^bqAv97VnHOc%W< zMS*5y{$pM^m+=354%J}zi^$f=wfFvY~0&-p<;g zlGkG&xB;)nK=>jg!#TF@U=YP=twJn$vQo|Tab;$90qe&rn%c^ ze@n&i3=fH7kGRf83`ViwBAT3W(d{mAWRK>xzTNWot9P+7r%lS&QV+}hHCXN{12PyN z0W6nd6uyoUShF^)>oz-ME;=GpEu{j226UBUbHqCt6?KWXH;#R8c)p;?8OJ_~3zZyv zWzgHZPfxy`fv0}1UY_!w!1oYK;_{IY^XP|I>g71ZIujr(zu+TRSoz%u9`G&! zqj_VCUL)1(4f>;4SR^nc65Jf3M^(s8T2Z~%Q z_$>3ZBUg#s_S_y9_K!1BV}{%7bb(8f!oFM{U6>Qs(D)5s$J1q`_Xxkchk7OFxg!-$ zomBYe%B#Wu++Yt1z=|&+ z>_q$)Ds9V9Eo?Ov%clbPfSp;E)>{)b;s7F$C*!Yhh*~k?S9x7|JAJv7!$&GNTAUe9 zfvz{xWw(QlmFLT2av%}8($P=Dc9J?LzqEQ}k~)2A%kMjHuf2c8_0(->%5=vG&-1Y3 zmYrJG+CjIVjoJWXe}^4(gpYr;(quEa10{S9q-vE1S-c-RU@&)svne6ngR>bs=!&6> zNI^wXAe%4m59(}&>tVdnNEP%b8!=e&3Kc|?GZudO8OKAUUQ0UREv@8cx>E@!CCY3N zr}kq(;U6P1_G9|{mzRCTvP8<=J}qp_6nC+-LtMh!gLskaHeD&m6*bwK!tVdwyI92K z{ZTXaqBv0gW^VO;!B-$MI{=C^Yr-7{N4><^td%v@-2sW~rsFh$Q;A=Pc_j;6m${Vf z`1TOIrN;r2=KJY-$>`4~zQ-YAmop*eX+|5RjQ!^!&N@U*ReBu(av;P6PvaBVM(||v zbX87GT3q;LgD(t))#YWfl3hwJ?p(RV&r-~XO+k*TatSN#W+r$}26W%`omBD69|Iw^ zj!-(!`~y%e@rNi>?W*t_2gFq&0%F*8-mJXjJGqOSHTIMi>ITwCu*DxvZItl7RZ~k7 zyNyIPK7FCGCHX^OxFcA{`!9tSal6}+E3D!9XI>VewVr!DHap7egq?(4BI3~Zqt@BGx4%4<7J9!58;j^86T_+#s zv(b1@*uMhN7&^b}p%X*11D->(IoN+rT1E-0Ztv;q>FMfjZ|`Q*HaBTYvJbmEI@`PL zyYCzOUwIRNp_4cE|F>+s$Bq53?SExY{7nse!X3PvKmUqv= z)h6sP>0IPVn28+S-&3t;dG9Ynb47E9vus)Sj4j8`G}(?kq$nnH@cT_q&CW$$D6I_& zKrR)?$yR8w%+e||GZMLYYqFF{w-#38J-uE14~pVL(ax5R$ChI;JEUy5A?vmeaQ};8 zJ@rad(otn*k5_>uPbIhM@QPth0nh(I=JCObyFt(?uX1x1m6>;{`Xt{|d59m$qsUY# zQ{Y4kA?HEyp(736nTk)4q}~8H#-7G}CC~7nMKIh$jUbgo)y+h92ZCS{^>m^R$;4aId)oRd2z?JSNZNH$JNsEva`PRW^`j?BTCj(v|K=KN%pcbVr{s6 zC34qsP`a5GXtO{w5R5x`Ehg)zTEC>@K?aZAtAq6lcH0ThGflvdey=Yw>~Y0vw2gR| zC$8km?yN?ngWraTeGXQ<8in9K&wk*>Zpn?ncngG8)J#~VT!9HO{7LeQNXz%D6k=UY zP9!*;+qAV#(pOP@Ew#_}rRYWY4w~g6_gytLT12v7pj&oXqv?x#O-qSL-IB za(;PvtzcwJF)EyoZ6HeLFE674|5;KwXIV}B;@KQUg`H(>qtx~+js?*b6L(jI<>f~h zk~9ZcYJ+%+l_l4Z4lky2LW$ib`$HRzFAtB#Ei`4@=ZFNs9)`Yi$IrCZ387r)!*$@r zUcu{j0m#!HvHNof>S2Uu5+jruQi8>gaGe&=RI7AI?y6b%S(Kt5!)|fJCenioNS>A9 zm*QrUJW`09EZO#whu=!Z5o$KpXyb-wv^u3wh-J19*TbHx&B z68rnl0$xY)RN74rneiyL(* zAcLqQdYzA+3t6F%XrAa(z)LeIL|a_7q=Vg+wQq+h@a0REkzoq-slEBXRs*q)u>F5v z8yQ%g}P`6KfF{S7<2$kK^3tco&z~2MSg>Qa&R<9Q=>UYd0~nA#JHe~InJLkkr@zUHT54uB5((LFD7JdIG`YY2hw=CP^#)gfTV{maKN5a;@+h()3`Cj9f>1N3eppM8Mj3vNgW7 zSRt!o$pU#94&)2E47)&{jFu7cTaM&R46|+-@^c5^GLu_m>^kaL;qfZ<@PYQ6fFhe? zQ2(3}$A~!6Qps%wGtKL!o`bz5np&EAY{a_WZ1%XVA#BzE#As8mV~!{Nna`#^do?;M zMdoM5DTEKZb+ipEBj&0B`-?qO1+N$q%Oj=w?-c-3Ik8nbqDPo%tzmCAT z%F6!BW3HW#Rt{NNBwm@0*;DrkqyQ%!^{WIM&Sx_?bwmABB&9!~->}YokEBik!V*$!Mdv@?#_O7|gD4=hB=pyFZVxwWO1Nh7CQ4B#d zp^Is7wzVJKlbg(*o3FN>J${<_WvyO*@t+}FE$o{^=nE}Xo;xcX_naE%WJd6?2K>#8 zU*Xro!6HvLP>C~cmm-{yzL!nh#ZAv`Z04;3f7mc>A@v>JZ@4Twx+2K$D2Qx#ko`K( zs)WLuLNJ&v6doob`yp?6*V!+1X1whGL<&W}P&bOAE);2LF2lIzim-GCis7e7Zx*r7 zQ#nMUOLwXJ%9Z@NbMTr70;rRvn&dbSPO7{byyIMoI&Q;Q zn$4Nr{%dPmbHEFFS`4lYO1PF2_oG^Ux558rC z&H*D&%b<`i6dc}WLMbL6^d|I~<%G3ymZPa)(&OGmlZBAEa!fdTA$x=cgHRDe&K9aq z25+o;_Mv#p7%H%pS`e>ccdU^Kb8X(em~~`0;||0To*?_HzhYe>c9A zxZ(AbPNm-G_^fiD*!dnoI+96(nkWJ{J)^c){k?pphtX79=|m2BXIkJ*WpEBriKA1q z!;z$EptL~kIQj@h+w%Y<9*nQ5JTzo11?W8?0M$?a*N7z~(2!n7D+d{aI$~;6xwk{5 zH53oaSA9h#!w$!D>0;iDSACiEW8umXblI>HrR2`oGf9lL5$aE*qWA%fx8sM-9KIu^ z9zol&7dBvw>UA)L5Sgn1JBl!z+(y;sgpGqZ92B;yzS7wUF~<%j5=uzRTT8_VCEWdd z%+c0XPX-#)x-SxGYmcL8P&5*uPv?yd;*F&c-4_aM1zoUKfzWNd_SSXy-9Fyhv-%x+_yG2&mdq6g)!r%C)7V>Lw!`W zv|)a0c$nW5V(~i6TLkluhv=rkY^x5hT2HeC4=x)*j5^7i^1aXY+)6G{y@5`p=Fm`Q zu2VG`?r?K6PWPTD|6`h$Gui>Pv61~bd=Zkt{s>L$+gRI#>`#a2CXoFHtZ6Mc7h6zk zZ~)a;*YJ*a+F4mhJw}B>I5L{HSjIDq2s4Hu9T^#z9EhA`FJ~>7E0I~dCJ}7v;cUFH z#kOi>Kn_$qDWaeYTXvW)9&yZN)$1v$`icD(RuOfn5jag|I*Z|+6^X*j`n|P1OXP*1 z34cec$Z}7SG|%jOrb;KL=IG%_l?RE(TqrLR_5Y15UL4rUAXC3!#qIecrzQplPe*Jd z*!lPG|7OIS&8`27ajTy0AFT_m(w@4MP)6$G#z0VW`+v^_|sh!l99tN97*I!8zoXLoLeAYlZN;3^BK`n9j==ZfEb1Vc)3Cr;%3`(7} zuzgqK*cuNYHbQQXBjkQ5WR3LBYt&Y$yjb4f)U1#~gmzUJAZk1JzQFhKinHDYeORA& zOu<#5rIop9)3d4QJbTUNFRB`x#3va8VQ%#qtIE`rI6Mi zg!~Ze5ljjpqiJyFDZB-ykOH;lSxkvfO@^aDgVWs#ah$I9KdqR@s{N}|15Nqn6_Xd5hU zCGlVQ-d9QR&bpG|#b5OKs}+P_D<}uAuM{0`y{opZAwC_1Vy}C}I59`wj-$BgyPmEM`Fk>*gH$*2OF2hqNoCETuPCy%577T?a;EO#7 z=vE*4o_z(O>Cq6~#GXCNn%2|_56Eyk=YejWmv|L2kD~JKtZrt*z0Ba&MfS1fWqlM3 za#(y~_e`>$!DJVrnvdyfeF>^XgAfukYu9Ee z*{4d;ht8V9p^a2zc34#ddyBi zXmQUS%+WeEUq{qTvr&T=P#-m)#ZP_x?HxV5*o^WX_BZJ4cdI)4(Io1`*HL}q`%#WF z<)U_<_}+oQ4l*yg&1CciY8>qC=x&n_j>djPzRvo|_r+b2kIm{sKJ}d>ANxR& z@1Mhy@2l5^e6&1&@;RNeoOJcbhaVvM@J0_X+^SfU55Y4CoqC>)x+_zY?vTsg&e@Z9 zD+A;J+SqLSJbV#y*G15@KGWj|2~7`#=qAu~A8T4uDfU&Luqj;8zB6?lxumL8MHY8I zfMWL-hrpYzQ+|k$@o2-5@ucaLu4ytKRG zG!4>IErL$m!%lL(r;-=odtVL0J2zH?bYsGh_E9@qyMA80P8vj@ty+W77yG3_dg~|O zOLs*+r6uauAXmeaZ|%B}&r^da@;NmKCta|7*X6?-Nj^No0}LMx!bM~73=PpBNG$c# zAaB81r3OJ8TZ6nUJlWnH0$v?WKTK%)i4fg{2KiCew5A4$`e_iUI_Q>1CaNg?QD-lu zJ$^F;hIFuhguwn#!@+*iv`1gH`1u@z&j0-J6@2fjJ$UEFYL9P(pprO${Hq6Lu9Nl< zXsgy9^u>N@kN*0}cmKV+A>SUfM>8f2sr+Anrf%m*%6^PcwiKe9&?F12 zX-!SiIw;G=M<^gQl3Ss-agdX+TF7NklN@o^ampf)B{W#L9fh7e5ZKXHuTL@gpu|XaaU2bJSj>QeAxZV8+q${Nse@Z8m1`^tJFDCOm}` zDR_B%=j#*A&FU3nN~$(W<$`y{)vp6?!QgjRcd^Oy8zIOebj=4spi-y6PZ9-wB}6wt zf%meeH938Wf@Bog5xm}7 zGz_zgI0FPPZ|}S4?&fAyP9a9c(h9!mns?o&w$U>@`q(^iHyVai`p-a9x6*e@M4bjd zMKri0L^nZ$TUpbZ`=~%XuAoB7oWO+5XiRm`EeVC_tXpw2GJ-^iHCB~k)-2E`csP?i z?Lw`Rxilq>uOO?0-ejxZnD+i^4nMbzzT;K>FZne_5ZG9yd5 z-}ZeTWv~5v2rB5P{W(JIHyV!GV2q_}LYOc>JGJI&Uv3zB{C@L+jWQA-^1 zVA-Pc&fAH1j(M!uZJuh|GI$0}ZwEIOIT<|Y*T1P(PR9E@Vv195#fMrRZ$KJ`?f$Ji z7+A}SrE7+&VfAcQZpf>K6&r)%16l2=erT)u-wQ^T-U?ch5$5{-cU!^P5k4mCQK;>Rs<5Rs+ln~%0U=p#FtytE`m^)AG zq_)6Lsc%pnvdZ0_4UzPVW&{Oq7N&gGoz-bE($x3*N^RWl3bAoTxvW>Bsa`JYT~+0> z9-%{wqk56N>aSj1#5Y-IPh%*+ULOK5eXqZpxK09jopN=48mruE0j%AQ;mp+$V>BpN zCq%WYPZBfnVm#i}u09=te!`;t1Vf^(QQY!bC-wV@)E^7cO^Ef6vZghytq^%TU&BZe zZqK}(ucJXoP5O@^0MOz76@vTkLv*VT?wWZ!w>(Qh?UlE48@>(+a}%1@=PLSDrc6R~ z(_r>jwvN1=-wuIEk+&l@SOfERP}#=w{PLKMYrV|Xi^F62g(1+TbJnjBmit3=6IkwH zO>6C_8)dHk+m^X{DdSfCl(K(it`eB-$t!b3u)=++j&qgTWv&ibi4J5`-;a_!qWprZ z@|9lI3WlpH(~~OGbdHKvV){@Otpr&#&uy)WR^Q7=8LXd$uU0K(w-v4U`hummF1bEH zlIseiK=2all3cYbTJ6zW5M0Je`VKrwl)S^mZ0>}$58!)^vBar|)v@B8^m^I*!}>~=e2}>GXFY(D+h3kdH7*U_ z2f`82$wu96rj%b9tN+BP!q7dSm9hFS27B;U6GZ$!A>h?F^RE+{{yjuDfu?V;rnStF zZ;mon_dP&NrC-7azm$2B^#~?~5X>|l| z@RE=zc@N@+RSXTQVDx!j`rA7(;_D!tbjw zC>c)Pv)b1)pJC$$qgM!eT0(u-!@o)B{V3}eJVSlxJ-$3OJv=!w)OC3g$+RFw|{&a{)ZnF#cC+bg<%X5adP@m5WpVPF>%V`YAjZL4F@mmiTM< zH1!6oV+;=PV3>7I{0O1ytLR;;n}(|W-mq|6I^G}jbSmBZY=!4zj1u8E3@=+3SxlimSPyi(($s;EFO9@GYFid_lk@XuFNxd z?#|?|7tPTtjS&O~qXtaDOtVTccnp*Ry=Khx7Tv2)<1&3qU5oGI3`+O)hQPdz&fg|< zb~PNGXP2i&h6bbOhlfzPUDkVV?riBmW#5Psbr<o97Q->eaPlha zh@8Q(yJr9hcDMai5O2wSy+obfll&#erk=z{YEwg~9#t^dTuyB$k>i*xf-27s1)_xD z!4UYc=UZj-1xuI#EC%$Xr7;8D8Rf>;8!SI`-uNBjjWIS>@U+@i3!XtUDT14d3vcc% z_iyTT;r$j5XMEs=x4i1}t~=O8H<>l+4*FhU?yj@i(r*eucAab=C9+9?uG8J+yBU}4 ztcdogI@?iGhxAgjv+31d+Fr;1d;c%A-aiO`5D%< zrUDFcU-|DCNkHsfXYfDJAf)2|-ys0d;r;`H``6zjcdKm;8=JpUkHIN z9m}60EDwd~Ca^rfn%3M=&#hVdPZ|OtS}J|876KDGc%LTl5)B9M`X?z%AC*Vxwr^+P z*|%nHAJyydy|0goch)UVyO zak-|R2vv_(gjH6B){^aQpkJ4}d$-wj1A-6m?K!@z@5WzDvM2Gm5?)x5~T z-GmPLcGk3}4ym&UpMbm0UP^!bOb86=V1J&#erv&LDs4L7MBNKLpyU^#^^iU;3lNBelC0{hoGmH}u?M!Fiqm2I|zz`42S-ET^ZLXVXS7`(zn_x|;?hf8L=cVUR zct<=p2ieY_@K&*f*K0bpYyKewO>{*66(Ra74M235!cm+``_0Vv(c4g^WUgRsGg`)E z@mNp(e#V1}zfX8~vswNwv<+!z9Y<5Qo#o!*Iwk&^C~;eeZi3~Hv8FXy{_OnBxQmYm zoY+BBZ6cpTLB+@^6k1z13q>Ox8Mm@mPb)Uw%Mgk++e6?^N6425AuSC+NEp`S*xYZ{ zMBT@NS*>uRlDJHAt%4=Cu*}hh02(Wsn#WV7ORF>~$LAh~W2!>ln-42HzWk5W)ob&Jf7gY4%S1BUft?Xuaki4Hc~)?# zU}TFZ^hyUxAB<7?Y*h@lB{DHTI~Q5Oi!CNBQrqflAttBdm zUu^)n!fY!}>pHeoa8r?l%2S~Hn|dXo{(?t_Rb5G_wh3N&gjHS6T{W}n@u#y9QR$(W zOP6UwGmG@W>hcfVlW;c~eD|XC+ifKpCMtcEcHubjjhX=8JO?G^P%aKt51Q_PVJ%8B zcRd~SlnJJyBs0}I*2>l`(~8Aj87P(L31H^$p5ZE3t=_P|;{b5ODVkf2V#|5ehn6Ln znPgI6p$J~54NK}}$N+Y%zw+X0ywo|JgudGYdJXbvZ^(BKv5SC!w9AIHawmt(S*6-Z zxk}$|Ay*~1dul;EK@iWJAB^;NcXUFM#Tli$&PI}@QoeY$wRK}-qouGKkD3Xqlq~Q5DMcITP1n>;B&5zAwgpkY2Sil_WrAo7H)#$j zWK%Oi*KfJJS!ltfTOns9T2SSqHD9pSjrdj+pAn^CDV4Tb{uI?<(u`mA1SFqNn~X$>T)a%R zS(sL71sU<$R-C%IfH>y-%3i(eV|&^6IhOsxFw0({W!o1Alk||Jy6bYlfIS53Fn$%R zW|^f`CIkUQYocJRmZAwWV-(`KXpS7DQT9rtQqiq0knZ7)I-+f^h7RiRHtZ^c4d$)Y z-|N^+kA?v@LBI~ooVVdx!$GgS!boD4qX`Rt8|f%S2dkkY^mnUSPFPVu8wHR_s{{>! zry1GyQl@Zpl}f;DoxHpO0lv(0Fa`2u0vZl_X37zY)o(e@qtX$bxv zMU2a-m}7g#_=2R!w>!o zJ5)S~7ae1^Z0KH7{w-i{Xh(-f3m!k&VSO9oWJTTlOU)SP}Wt@_sMBJMS(iW^t#BUZ=4q-Xd#gs2o5py%_F5HgNY-lAc|d9pThl)b5o4CyB<}Ln+nn}u_Vx(XjcuY*RJT06|L}S!XLo5K1$A~ZIGW^4#;z?+b0jyA z3YLrxN|gjQr|ATG`MAw2NpZ&vQ1qiosSGO2WN>JJwlo{xoMG9qVEL6|A=p)BFqUCN z&3gqSu}r8hP9lY0Ilbr%;wMfM_+;P#(qiI@=0eV3G!_RxbPeZI!gC5cU7~<_!w5=z zW;(R9bO;M=rBlIh68*5lcx(W%L(lAGPD{#2jqY?qK21#N3*qO}F`Q$HAuN(J9jRf= zo=Hecn0Mwer~Clq3}WFmlu#BWG6U&>lh$-Xr7Z~d$K9SOqqkpLygeh>udoq4x;YtET7CNJNpNM>hpUpjAY zcN!&dc>dGivdDVHcu*vVE(swVU_G8ym=Fl^mbnG8QR@6Pe3M@OF_u>)GFYY{Sp zoI`gwkYz1GBV>_Kt6CU^EZ>wY6+u1Dyo6XjR5e1z$#>=Cm;e;1jfgu#6+?b@;c#7}>;W@%} zM(8DU6D}oOOfU%sAxB6Pt|eSe*hO#%cMQX&Rt` zFqJTg@CdU!OxVx_SVsu)#O0C?afmgEFw7H!1lfa(JB)d5cxH9-o^$5{S_u-xO5nPZ zC)x?;5qb!h5k5nR5u$_~Ax*f3a24T8gqsL=5^g8lOV|U*ISsTsnZG9W$v)eB%r>92 z&4af2ifz7Sn;+O>a<-V8Ev9CRnb~4uwwRYKre%v+*GPanDEv90Nnb=|?wwQ-4reTX&*kTg4n1d~*V2c^pVgj}lzb!>?OR?Kho)MQTfNj!03CNHN;hRFvL`6rU|cXIp2=wJaK2ip92AB(@ZXEk$8V zG2k~yI@NEB>TOXwxHBbZE?}j-*ZdZo`yn{@0XX;5aPAl2+^?DMoA0=uT}KBI&u*q9 zo_#DO@$6-k#IrjoiDz%6B%a+%Nj&>fO5)ijCGqSWCGqTQDT!zAq9mSu7bWrRy_CeW ze?Un*`*BL**}tYFp8X;v@$5G!iD$n@Nj!Th9Zo#Em6CY&@sz}~S5gws-b_h6`wU9r z+2>Od&kj-&&yG_P&mN{Eo_!-F@$B7{=-C!KV%CqKaaR&g?wEo@@#JUfA&DoyLP66&xCq;=nX!2N`m z2rm=*j|RjDUnkr{Sb7Ygop2f9a>A>G*9pfh04ySK$5E?|AoT;^6j=9@uSi!egfvLt z?jqI?30y+n>L+laF6$Nomwd9GAoSoHUh7=Kb%YxT{Pf*wA$*LmjljYD)mXg$8aY|Bu4N;Q%>v~F3 zf89cf^_O)QAm=of2bOGio#rqGNhI7tbmFG43sKDHhE(M#40I4DGtb3G{`9*bQUhk(&)+3e5w64K*RaMzNtxS{d9#6iS z+cK&-Wz)mUeVJr5s=LFyOG$fs)U|hypY~Yu9ZGuz(|dQ)SUr}hZ~V*OQi*y{9eMKyQ<7L`Y5G&GXiQPWSuhw8F8g*kVzK{$5+sN!MAZB+~5D7i+!6#a`W# zbP9TQ-_I>>!|ZAdE{@JEiFAxk$9Z0z=E1|GX|@-tuI>djkUialEV{8AiRCDT`*OjX z^54`czom=vu{BU$SxGtG9|(oK*)=UwZk8I5)vH4B^(K3|I@v9{$S#@~vVl%NvX`iny+{|?<0p))j~Qpx$zGw0>_;Yy z>;`W${<1pRn{|Y}@{2D)lq>k}bAp-%R3U1V3) zK(@*N1?B>TGTxT^vO2pLb+HT7z;1bE9AWMB8GQMtI=A<9aqG~OKxb5)fc9uG~GjwrVtBadYUDBt{EvSpzx*E8xuB=O> zro^oGsCVgIsm^d%7sK^6FkDl~ur&89=1uW-b&9)nQS7XN;;KrDnMeQ|cYD+Ot~$L3 zbkW;T1HCFXS}ehoH^ZN+GyIt@h8t^OSginK$<&}vC+bh?^!}iW-liJpRVhH%J_Cbc z?*jZ#o#DT9G2C1O!;O_5SpF@&F%&kvi5{~;Ifj{stXg82lWQQlqLQc;N)LFGTc=KL zwJvg9HIVD5B*!_-CwF$9>`m|-b%JN>B6x~Ef?Sf^n_yI(U|1KyQ)?htr6QH-@IDpk z7u4x}UKhPBHPEXvW>Gm?B!JJ`yi4<|>U6(ycy!&*c-+}J-P>wld`_iH;yakQ*D4DE z`TEgY1K(HI!1wfNpyz?o)VTj)Hcg;X1^A%F7z(WM=J+dhj=#{z@k*^6eP$l~S)Jpn z8aZCAm7`DPG(ypV3J2+qD$rw#s1cknyZS9Q&p^^}lGO{zfg-4_&@K zLEf}g$^p<6WYrZMJgS$ZPn6fDPI8e(lKb_N^a=C2)JbmANb(uIBz@w%3)M+}^2jCW z6X+$>N$$`{@>#tl=@aSM>LhPCa!LAxdVADK-lLJ^LA@pE6YK3)C;8}+OVTIUdrqC? zZ#0s8UTaCN^9lCeRwwz_BbTI4#M2m1j(DactFDOWw|Yy`C*nC#o#Y7`NxohS$toZD zRer%;`i$0dM$c*Lv`^7Ud&A@!M&GN3J*&nD_g!^PbU_daAo?x~isM z+mCsH954Z9amOU4ZNfERAbusWEfd?2U0D0Q&1Z_am|QO1gBCGGO~!L_y8Ij-UZnN~ zHJJ|>9h`|}QnvS%w$kg2dusdUvw=Y1xy?xXx8C_-{P&S>z4N1G<;-(sC%2m15gDd5g6bQC8ZOE6T~zxriVW{yNR6 za}{^<9fWKqZTu67%Ufz%EvT7vK9I{7%B53DH7%E?+KN#i{ZPIb%@@=HNSH}m+6wA} zdXEMIzIQ}(@9=>Sw{H2ALMqwb?(_NH9L;sSrJa-SB%WH|YGaS}r&jD8r_sU9qC*Fz zd!xCs#JizaZdhJ9sXU>a1lCXMas|w86J{|*j&1wZSSI}rpPG^qGH?t8I`Dt?SH5E; z6N#z0SW=E8a3~k zI+MnKq{`}!%1y!g@r@wN%e$S-OX+eo=FZmQk|XhQPQ;U8HB90SB$K{^BKzb$DV0si zc}6@5_BKw$D=2E-Bpq2?ADoCUB}?gouaNOY8O8jZVsg77$d^j9t?jrh2=!y$2nA>B zC}o!|ggRF`U667K+4S77uoIwJWNu=3$UizVOunO#&EM+i$YkZT8V{u9LPtI;!)NI? z{E)S@94q*@WJnRDCX@CDBb@==3y_=U=C5=%qsC*@4uBc%!*)-&61Y}o`QCJtvB~It z0-onJ9ADB%xROr_6C+s>y|yqPNy!BXrc*i+($^M24WdGKAZRy3rB`zT_;XpPvObuF z7~=W0Tvh;Ma#4A)GU_ zqfR+>Ue_RXx&p!0PzN2=rB0VW=t>>xL%5SxDHe6gsq<)K)FJEI8tS;2X)Zh6?$lwX zzU9;*z&LeY-!OGrq*>h_G^^WPvp}6=&@AedQ|Ap0QzzUi*$LOxtZskUO|w89dT!e4 z7Ph!dVI+e~{SY2V2yZt?Ns6)?NP94*sKh_|1!mYA9=%}vjgzMNH>Z9e< zp-#DGU9CwS*%lre9^D@fw9IR?)=-_cW zU2B3)Ewa!ANM-aRs37!==wyw5L<<|8>~^|kbTTdV8*9?(IY)VFktM3MLzk=M$ZCbe zQ$ZWM4H{{M{FoN#@tQPojGFzut+GJqs6xN0?Q?G(3q*ai+yYUjT(h32NgZbkgm+s= zpDGFoy%CxP3fX8RS_tW3AlazY63x=P<#c+oCY@?YQH$(PZObib!no1=XbN-~f7r?)ntb~6$ zl5#>y(qcQdYYH7BvmHxoOC4{;GWj$3kM^7&?;4n!3`|D?q0S&C$Kl>UXE4y&+1o|` zj?9i#kf=?@E@9rHS>lGNO3(5@=QzOO#>ZciFbhPO$yLjGDlN_za@c&Aa{*N@Yy~p8 zLyCtO*9Rzjx>R$ zovU&>mfO$LR!cRivK>|W(?s>CT(u0$(e12>?v&2esUxGiE$>(3xoyXj{xtC%?frU|%rwLe>Vl;pq^bWb`kE{3_)>@70TT=dADT&;N4k?E`r~>vQfTSOJ8h&ha z%1B9y$^NYzQiXOix$O$%&oMLYmvUPcPTOvpgjnE&XdyJ5BwaO0vQGS;!{+eBaQDj4 zgh`WHt1I399XY3NsZum4`(sF@AR-a9^7*1fw5YLt+^%=ny%SR{w6Nbbi6NBy=wNUf zbl0Q-TfA5t_D`-_tT*ko2`9x^zaw|3al=h*As5E4+wHuZq&=z~8G@6KB{O*v514Cz zXUJ(A{d7J~Pc1Ys@0j@C=EBfAFgP8;HR-@?JC}v|21SA8&ZXhtVbSxogy0+(f~*C9 z+f9=ML!1PjM4-m-9O<5#NHYt+I59WB)4+@xJl|pxFUS2mp<39U&a0X1j&<&A-ZAlf zYdt)9ibkzLIgY(GaU3Qk*9F|aGGsE=CR{?ck>nLE`gJk&@5E}z@j21J%1Y}^6U8t` zv9SR;Vtq9cTO`EhDQnY^ypg>a(gOK#+=2(TGQ~9f8bq_hDky##&82igW;rn(JE1^l zptHh+KVW@<+FQ_ddS+t%%+bK$*!S1O{!Pqx4=l`>7+32Gi!C9env_fVk(eqaovhL+ zdThar|7~IuB8*WcaUZ(`v&1ko*UJe$c@aP4evE9R$8EjZCV zHW2Qac!?~fW(MULzNsdL-NYlpus0mEU`UEUAj)yd9bpq8{Mmv3sGSos?7q3q#E>!W znaDiBnN+8L4)>dD!W|;G=LVLS#w}*CcCS6XAhkX4JI$D5vwq@ELlCpRImFM@ggDM1 zo*$WIk&J(QV8Y_Uc4GNLace7J#8zsi1A7RFMf{4SW=&gXcz4HVPHJ#*fTxuCqoH}o@Qm51|0@QeU>Vz$M?hzuE9@qMjtVAiMWF0AA{g$1Nd}WiXOsNgM zs_}B^O7-i0N_Xe544bf&);bhqr*`CuNH)xMP@s%JJFXg$HS%HoERWvlp8g=+Q9T+< zu4g&*XN>(sOZK;NnxyeM67JiOe3q0gk4l$USwQa_FcH^rzU26br*3M$dhb2=IAw2g z(g1VqpP`L%MSGF{LGruur1lH+6Djlz(sMY(ASH5AR_h17!=!}WkIOr1Onx%&16{DbRM__=qfAsxC1M1S$mMQd@$6MmTxR^$h3zr}rLgA0)89OX7Kj4GRgqRJ!-3&+I@4M*BUq5qY;4Y%J#xoD*VTzWwiyWBBtoZkQs* zM?cGNnS+1-I0nD(#tk9SeC#vE9dqbYC+pjZO0u86$+Xw(#EJChg#Pfs+n7F?Z(V6( zXzBQsQJ7F2D_LZfS9%wc$S;sY3cGpMVoi%t?UyW~XxMn|S1k8Rm&bI=<(tRayPTuM zTTU#eM*^~-2g(`7J%FZm<9;6?`%Nnp4>?;M!?#{4)qF1Cd8-F_?3BU*6pe$%oXvgF zA}w4+k}BLXKisFZnXd61J&9mVD`k0H3NtHEgL4#QxcMzwZNshTKDWJ~@(!k1 zxi>K)+lZj85S?f-@KUpV3Tmu1OpW_NjU~M0c!I}>#Yox~2*@ki9Q|W;*t1~iB5n%1 z_alr32`u#Z;1`)Y%wg$ghmMk{Y5n{hLMS>`Vt1LsGQ#cYPLNwG-4DW{!nc#h_UfSZ zQz|xMm)`&K0gs6S`QD!9U^2~F1`NnYoAp1t>}^l(j|O7yudTuiJ3-*p1>J38{2nsK zjY~u&$r`b+4?z648UF61a?zC9!rPr~+AO<7rxAuCF2(UA zIyRTv_d&;evJ_Le?GbSwR4x;xXwD~MLQ8CqQ(kxzN5l}Q<|y7H^3K6Guqls}^wH!; z)+0s;?MpqZuyHSX5Er|}$6+uF^-Ly|E*s&yKWjQcbM1gX_1T_UY~nAH2X>moke{pT zfzL0LK0^)1nkv+p|gKb|5w;q<7k4K{t$zC#Sq-FeGK5v2Oh4U-CI-?YEL zTOJ+!eX!;>L}qoJjt#L2`;tZnqo|(+fYs=xh&Mt~kRf zW+&B1nEhS#z&B$`Nki*1c~C$wUI)l@5%nitI1Z>i#QO3S7Sz|TkJq8MWx8QbGbH%* z7;Q6SmZDEZ5OlN6XKv-Vs@^0y$;p_Sz^!3ULdqyYZx+>A7fHBW>7ly5_~|f(83X|g zoA>euUod;vgS6PS9H$$#x3!YlKj+45IZd17Os`!yWCX$$nt#*B@(=cPTPq<%EckXM ztcu34)Co5U!vS$2f5~{R%Yr^-g?v;BjgyU7H+lX8gN0!IvkkKzM>nEhxUYO3oLdq-Av%+|K7S zF_m#ycMvIBGsbMe67v~$0RCCRPqq$?c$iiAA>lz02$DjqyXkA&=Hjt$W?-G5M7RVY zqSsm0B9pjGCh3b~P2HGAST~1#Sw%vCbv-ZB3PE1?TiFaG+=m!03jY-Byy>GLj>J($ zkm~57vO@e`p=2YJ6e^HwSOsuCS4+201xmkH!}^&TP|PzO5Q1M&Q5=R#mRiXBcBCYH z7`AROQB^Z>h$)}e&@>oj2Mim>_hXpO2sej>*#rF!DG}ctbmi6 zX1pLRg>Ts*zgJ9C;7S?|PSF(JIWP(s#fxl{_R>%PAVAKiKtCA33c>tL!-9$9>e{ay zO)zUu;Yw#|t*Ee{MJdD6NHd74F{+wK=^A@wwkpY9Br4s?R68mSgB4RE#nTxUy z7o+AVrSq1M%9_btdEd+WA+6ZeT|c}ut|kCUXy%G4?{e5`JQeVL-#dKYtAdXzUm+u4OHCkRwd~dD zTX}eNPNe!+o|f*C|6rB)e6apVyr2n^9_NA zs;nfEm3T2os?&LkqrgG(Euy?(N@CR_QK%7R_FgWuU?Ay*+su?lO07ddz;vOQO0t6p z{ErUY=vbTYPEQsWQ{CMwg%w#DjPFI$^VyKPu)f!GXK8#wTj*VsR&ICtNA4U*6GOv^ z+3ttGCelhxiQ<{HN3x)@7i0*=ajkS-cDsm?Tk$3mEG~R(aEfTA<-S5D2@ze`g>BD z;od!Y@OE^0YH%bv(m66evRfQk-RqeR9cYo_+MVUT-KerMqYQTywCKQEaBzJh8A;vg zG)naG(}I-?StVAMQ#;p&Vz+t)&OTci$OeSVs0*n*guZxbNbL;%FioZFvS{fvv=Vd0 z@>&Q}VxIK(3a7ntnt7=}#bsU#4*qfi5S|0Z$Uq{jql1a;uag$D=#C zDleR;^)JfYjH{FtnzHRAIqhZN)EC9b#bOyLo2R*7QZIMPR+Oq7Z7+hnnvOQEi_l98lAf4ec?A6z&X@9gTEP3~v3p~>A`ce?k^Xd*Ya zIItBO>+bB|-CdmSS9&^g`(vr)?45;$+2Veo=g#1y9G*!YBu5K-T}#74=|aHK=rS$4dlo7I{Vbgd8zYuIDIg!B`22T%t7zI$2emd zs&2#?gSI%MDc#}`M~sXTvSq05x3-8s8jd(_Pzr}p`?q$)@rta!BI_jU)<|m};%1Aq zI=E-R0axaw{BY;|=!RuJhV#&DH^&kdiC1k7ZkLW36l_ai=Bt)~$%xIkuN68#nH#h4 zYj&@D-JS^Z?2Q{UdbxF9@Wu^&`nQaX4a)Y)VSU{)OBIWCsZ10_eSK0k%R&`Y*2dBNbB&mYP17AW{y!8viy+@SwEr1B15Sg;;0F?RUh!8n8n zX|}~^iJ*u^$Xf#7%1Ksrnl?@;YI_VWPuT)RG_{48RoOUMlX4->KO?jd{L)XN+rv)2 z#+Qv{_eQvq5PQ$r?G zf11(JogxNPKf#Cxrp9!p9xtwf(==>joW^NR?V}7>cf5>r(fXV&o1E_Qch}-|PR93M zuqJ5JT+VE4=IZ6xZzAO*mc-FAV}F)*TUn}BF`I=TK!eR{GB>R|%KGsOd`p3C*gB?b z{T7gRkcRs!z~}OCA6If9WlF@C7`@#oXGp}qVMK;RyvJE0UTTU6nIXU$lNp?k)xN;c zamU=V%)HqodbpOv=sB>o;3*-Ac$aP2WFuD5B$2L$^%)X)W14luseH$ql|% z?$J7loY%r;^qKsg_P}q$W=t?1z-IgtXK{R4l1#`QLEo6U!a;UzgyGyG zx%-qUcm4igS1r-Y>c`n^L59^rE$CAmng>`W5IhXQ>KseAU|aZXs||@4bmR-Jx|mCo zL>qEynKo7Q#e-WXiA#ba4iblB!93Q`apOXF-g?`VyE}{>?u0euF3orVx%-5(+`XLW zCB%(@ZcN>WR3vLuKS=PprgOvZ`An(}5QLOX~X6D_2N(dxS8tUn2y znO3XMkzy^Hw*T?#ZgEF2OaR%&6Rp>?FgA`rCSpL>17X)8kD^s zP3@GOsHE)wyX1Z#S4;qP=-YYxM0u)Y)x?Qkgjp!G7n5sTdkmCV$0su12;Ng_NgB@GMJXs#{@!q z0&2vU*-Q0ju-83^kuig%0oVjP+!V>(Aw6SogzLab@W*`PRufR3;mj2(qf^KNL$T;drq_hEv{a8xc)Jrsmy6E^Z z%W3M~j6B5@4wVe_>6uwrfQq<5oABA?c4Y5l;zl2v*f>P}F*eoe*z;rCopwr7{$eg^ zG^52&cD`OO1Vm2a6ai>rUjltAE1po#4!6c zps{J=gO0S~kX^1Oq|qH|<8^#V-8-wM8;6(T59PG@r?Dz{)) zxw^aYqnn$^Z%Y>AT!#fqfhNet=&T1tZ3$_tC%g+hCO@>@K>sh}q zqbZZjP~${12c%vg!#0Ees4Go5`1PlmecQ#$FtO+xu_`Z>x^XbmOl(Uw>xH z51DaGVY2uJB8k;ESYs8PT#YEq3W#u#v8ri>sXZK9Z&IY{#U@hIS~HK(ARR@=6dSvd z{xpkDsK%YVC#C2_enu}xW}ScN(LZ9BW?mIeXP$|gI~DAUBWpG+u+4hG*k+AHlbP7I zWwUkdy;yT&^PCQShCtwV;M0Qb<2a0Y3k4%61C6RKe|W559ZVGZ-P7^^J@6R^lR-;2+e;+-k(&WV=;A3og7_0 zmTT8!-s_Bw&-6_1_jj$Y z?&UYuZWm(XlRNQLa(iQKqPVf9DABdS{KjHs^x}Hdb<=FrzJpCe&SwTj-S8`;()$b$q&68*O1? zDLvS^xESn?X_LEBI=Q>^L_l4fo8B#tR!`;f00K{@`MAc5ilcB0ReszB7ko5VOO# z8D2)8Gm9(P;&SK2!Q9%$*kVfA*a*%XNC)vdt0T*uF>R)BJJdhEkR0t=O)uQOy`5Z) ztqsma$0ySUY&xrlCPV9~mG#9`;b3X$c2FK4%*01V=c3!Q*@c6R!tJhPaAj%X&c=3p zPEPgjE_AI-$5Z|3jf12%kq-7VI*1ND+ud`++o2hT|4Mg^#A$dWG`BR; zIk&XFH>*wd2Zj@o{ZUEX=}E3^6&AWiNB25+!jr3^aA#^Tu{OOjAJjVKgN@ku!oFI# zv$)>7Hu;iciFN~~=Bn!LCp-Fx|@)eDIMI&F)$d`vk z3KzUt#|10blsA^z5H!W)^4-!|98XOYamu$`Iz`Jr<4+Q zJ(Qf6ma}6kYZ;0#Ldyq(gY=H`^YER;?LD{W6LYKau8Cx@-x7jNW`Nvo>>#r<-6as- zjivfS(khTv!%2B;v=9R!rc?d<8x*FbXM^i1+;)0H-B?kkq^{Z7*J-0eT#OsvT29pR2)RoX^K03D2xwslW zh>wjH*F!6Vc7oHGgFDf&q$aQQ2V<#i5WP{j`+-w3w7xnUUh6XYTBLp#c4EP%`^-jD z8#}iCQhNwb`?un2lN4I24Thz_u|FN%2OU_5ittt!yyV7c|G~!UEO1YDf(9Bw&rXE2 z6jn7n#?n~-;B;tGiG>iNL73J<;nakd72ztBLW`v-gq^%Sy(A)kJyhLZ8K!q+3fqnp zrcQ|s!z=h%^V~{3)|Vu>S}yxCY0}zlFI1p_{72V^6bt+=f*-jnC)C1nVeis zkM1s|_H;Sqvymgn;nrFwW;LV1_?UueL9%CkZ6OQVZf&fFw_{`d*=U*+d@>ndUC71{ zG9XmhZ!($8cV@^cVh8{Ca{O?GaOL4X3s(}P>_vHsi!6nbqDN{+ubpg&QB z!d2~2{0Ny+ooihiyKABBK{Ny-fP0w6q;XG)j;|!E-oY3PD>M7EOY7l{ zR(z?myL&kt&Mu_8!jqv`vU7T4568tvhI3ns0|%jOGPxUCP8dG;6_@ggOL1|9uecOr zHD%`&mtuxCuecPfZoT4Cs$7bg^?Zm;1#2%i(_B|eqtRV0gR3#c)$ZW8)3jE$Pl;?F z|A`ta>L_uHtU^{9MgJ}v?OQ2G*G1w0%N(QWZdTe)W~8_;hB6+he7mvSZrKFW%g`Ei zw~XT{X8z6K(Z@2U%Rk3xgoX9{**Ehdjzz`pv%tn@%}#q)pJJWWCOAzqUql-alE!6w zR}VTPE10MQ*vQm1W#?1fgvtj7`0k@`oN*RnqeWZ}e z!CH1OL}j%vL?3PaB?zWs>v_y{d;bzpqs~i&qdB7nJhUHR8aZ=^XebN>a`&FP3+$VFHUB?G)C`Xs8e#gFQbmqnlRNpj?R@si*YxkW4 zd65i&m7$YpV@mb~JgAo_VI;_$LsPfKoa*I~0%Yv8hqq1+9d>68JxL3A_iL+o^KB zE~QZMjn5sZ`dh-J#exS~*b&?Tf^*&xoMuhyLfAc!OrU^kLBYA#j8VXzEq1cq$#zO> zkZ?i_#lz)%z&ElO3ilYb!6C`by)3Mg+7u188l}OpGkF^yofW!`-vYtA4I{V@CcoD^ zg70Qc>oU2IK0l(y`Hs0I$DDtV00k(>wG{ z+4Nf=_^%p9@Eu_Gzx0maXIay_%=XRTlO*^s0Fnf7_?Tt0wQp`>8722L*0?t}%?RyP z4lPZ5zQXXa=Lem)cErhWmiKMG`==ggVPyZ&Ff78dX0PaDyYtd+9f_7-W?i{E4a5BF zv~(Z9X8zrq{tw+#=&?%erlnI97L}*&B~SgQ`a54|-o+j0Kh~R8g=qFtkPnDt4Zj}B zTh2?F&x|l1&#I40@kAVRj|?$j{i8mY%*b?JpEGdLaCjp0<+1kq(SQ+~z8+2OvFW=2 z*VjN5yF=Fgebue&%|?!AEiq^a<72=kW6)=+d-`h!IGc$tTmsG|qM1{`x#EHDM!>ni z@OGC?yBhvo3Q|10WvJmaYg*T&xdxmC^id<=+`%J{0cXww(AB7BJiKK?wYF^_Au%k@ z1nX7vCJ>mkv?ozTsw&e=pCw^ZqdaAPVYhS=)l9i|vfn}%Y88*gUipFn*_{Fuo3HB1ZWOig7K6qLA3Z!E3fTiunU262 zOJ{Oi#M{*m1O#X9I~xByiSJi{W<%oZ-fJ^dqWsmfJk~MA0T)d7_l8nh8PJY=HRw#mNBSGSIfYE>%SwZvK zBrcuf=d6VWSnh~16Gt4=6Dt-OecfXo!*c7aaPRe)M4wI#^XSfYg81(@Mx(#y$`_BK zPn|f4zRg)3u`hQj8*21^@4R~-Yuc0=1(wq)%E@9u1%Z&drJ{1H;ROvtj*5-3SSF{J zddzS>HTs$m`!4|022}0yXzrqFZ=yqzz2RVg0|%|CISyAFD+l(Z#aqqy$0>8hfXFc5 zl+O5NLZYoCp12uD<8-w4b$aK;lHc~eDI_uI?LR9JsveV8B1?*p0eM9M(=ElMlZN>&7+D?Cr&ETOz81a z^ySVmLk&rwnoKJR+SX^2NrvEwsXh2o}IhwnuY99+G`Z_I+ zmp&0uqjCb;vBR?nO_)Spw?!t}@6cHK3Mh*s(A*MX{2o0uA`E)sW-EDw@nw4F#nRI} z!tel_HNN-~Ubn>;0W-ev(A8UxhKwoW7;s++>B-{d6q*jf;M9)LBVC^KkY zo9LyB^qn+`J{d+|c^1J{k4Y_1*OBw^B>fgNdS7ES z`n#?i@~9TnNz-caF7NdIA=b1hwRl~HTIA$}WGuHRGN+__BSGR{1{e(}!7rk@ixNBt z_EmlHTjl=R*uOP*n&(ZUG8FP}sMZF3 z-34KUL}hVPl3rmA>2og&ScLHXRej;BIDGp_EKqT3gU%64Qo~w5R*?>p8j6H)Z5b&?+f?h7@(xTz*a`C`tVMG{-@u>1RA{%;2?&!yDk2}pRwEyjWF*= zo+WF|8f_Q$>F&sod25eubdS$w3lsjmTqvvUFHBC2&7=>yS5xuy?cqpqa`8_0LVtKx z>+g$pcbjjruBIn8(u;##{X3(R%6ek4Yr9ul8|lt<`G+!NqqlcA3iE>#3wN@!$y~yG zvkAsABwxVw1;%>Be1JRH)7R6}9S#P=>?TYmzZnj71;gzx7$*D`A!77-MTkfV8W$pA z+5V=EWve`3)2>N75}l687Roh`+5C*%_}QGy7gv=G%0^%hNG~D5c7n)Fppb9e>xF;2S3TlT+Y;KKgU*pR$dhLol%7V7zDZRQ0Mc(wK zaN5TQL{&O*joqv?duBQ_W48x>>SHf&bj)!1{)-gLX}@f7M5Q){Ee{G$Qm(cTjE7iz z_fW_<2t-}8G}Wsf2qy;60jeG9&@9oORrYzCSeb8@E}7Y#Mu1^i_c0&xQ(GSMJCR3e z8RNCPx(Bq(F{?kFNqM6sqow0)R8k&$jxBo`MfiEucr$FCFgCalG}Jxz08m%o?iOJ%CK>p_BpDfLLaMx9W|=5=TR9_FStv`>GXw=x!qLU2@iBP5`%w?;q7iX?LzYJAS55~@RqS9 zSz=9{76)vO)-^HsSJ4OG&8;|z_Gvt-GwIh1RR5U=psP`R(ZgFdR81>fS^S-RgfYp! z%X;;g7;K;S);@{$H4n6~Bl!E^jaJ zrsziKwl&hZe1Cm`w=?>TOJp=&$Fg=6?T&RCvqbCp25i?!X(kXSv($l)GN7~WDBEB66f;4SyUF;3Z& z^jjE)p9QG(A_qHyUk8H!$UA}`XHDzs&DKCJC+$}jR9_2(JNw&X^woH(*Ab&?^;`7a z4}2(u*;p7;-G;W)LV$S?m}ju+##emyN*LLfYB)jXf7ukBKiepsk6V!LE98p#LWFUI z3zY4iK=@A@M)+G0tUvaS@K;#Vx`H+BC|IL1O2e?v$FwgIM!q4EF`QgU;wF93o_%$; z(sv8-X>F&1X8*M*n*CLyG;2Ue+?yI3VEU}Fc2lPfu#AUT)7Sv3niOLb45tK7r85O< z9hcH4=hC8xzOfduX%W{=RtRVl)^F2knIq6X!Rqg0TMG*q(M&-RpQh74T*qVsVV!AY z+WBe;*&bSuq(w*eW{q)m`LR!Aeo&yMDCBZAg-uWL{tGyc zYfL2ErROoUK~pDtVh&e2T~%zrykjIG5(vg(FkdJ%7lUcVuI?)EnTo;!;&0&#e$)dQ zja9=RA-rs*uD*NhtA>vd4UCdjKgDR@?5bgBbx$wBs^PyTnmMf+{-y`I8%t@QXL!5I zoIQ5_D~R83czDa09Q+H`v~Gywx@!1M^kE=cS-eoHIWkc0e zLzh*aH^x*-LGB%WdjP%3+Y`Ue?q} z8tUQrIIU6{aZA-fSs!1S;x5u-YhkILZj4UXo1)X>jne5Q5v7Xy1t;^xD5oO(EoijV z7>#aM(#R&W9ups_6Q{(-mup|{95eJ~*1H@`v8LYirGk;w^(G7xTKzz<_yZWOjy1KK zixQgK%!Q3D$5e>oqb-Hey~cz=G51D-djGVgkX_IVQBVfAr3yvGT`~5*IO5oz1otim z@o4CE!FBJ|SQ9*|FRYMzc8Gz8MYaPC-)f9Te~RX{rQ4$cqfVR*m^)<*L-BR*^!_8( zv?)XJXhr6>{Xhfv1$9~pLA>vBLnh=bn%5?B!v`21KH}(}*wThUJgR}t7WZC{NeyZq zU>IzSMsIcHkViG3PMp-h<}m)2_T|ofL)G8xU8ee3)23A2{rm;@b`|!(ev(5d`g;LJ z1F^!p(cDGRYaGKcK&tUnz*250ERPNN5}6EENplju?oNlNutT$x!S*;l2VO*B-hFNq zJ+u@sezK)7K8mlAB1JTnXCFe#Aj=eAVU>`ymQsQQi8dqr<4WBf{}KH6DE>3o4_T=|>aA6ly;fiD(w!ia}24K9r@- zK4yUJAvMhf&HD=i;wM`Q@kOF6PUq-fybzn0mAA#{;UkXjNz`72K|I*n=(1q@Y(1*&Jg6VJ6k|u zGoz$~ac*Q2r`0w$nZDBYCh7^+Zfv@Y4+9*W%6I~w;}n&(&TLxxLRTlzv-!p+*cfCyU!O?YaVYs6G1e({DuhKbzIX6m{J3{Y&tv-0xm8&{q-q=;KcTT3q+$rb5 zjA1)@J$?>UBd-Xkf3u}fKc1Fjay~ER_UWJl1Ajb|M3RVa3I=`WwI;@<1=sL5;ix4I+r-HUuAU(9ARIm_&{ zb^}4pjmD_C>dIY@szRMKttw02IdhveZAw+%z-A#*Wx6TN|B(ln5yjx@wiASYH-Kqi zHRqjZ?xIFdlIxr!UGjwjoxaUYn<#8<>V*mOx>`}#!s2=J1vBjU2MjKIpmM3IKW->4 z*v2t?`EY&gG$VMS0a;$wSplRVk`9ckE?I+&Dk8bQ$*V@azyNR$w2a+!U4qDaXZ|L)ZC;uR)_oWtHNd)` zK=azHD?Me@<=&(TuK@h8MvV{cdiws~SnIK%?Gj+<9r3ov-3$j}r2StZ7qb=bDFLkn`J9TS4##uQX(M zE~B{%^RH3uBt!mukOTd*x_RGq{5FEXr%X6Kv=wk(Ybl)VVsS(m8tW}FYVe4odJ>`g zF-Suq(Nj?E63C=7J{H) zC|0Q0773RZZ;b`}{@2FX_aQWQ5uWQ6n@T($()aiZIVqjr0=VYFp7$37#6RCsh+n_C zSwjJ_x);?Gq^{eS?H+M?g>#|4)_%4=8hk15(`d?;@=g*&f)I4Oflu|+Vci>YGFT&{ z#&$qIRH=X7*|)hRCG)c7%gztgXlMfVzcaw>B{0qy{cr-cv2M+G{@4RKj1#BSJtK$p zq@q5itI}F0x>dw*eUmR~mf6UzvuS=nNLP3FUTqG=y{U1!TR+`byQ$OZ?vHpl_+^~# zHV-d4l{dbjmp8_?JWP?ihnn#y?TADiL+1wys05+AF;RuMkynIVKlD)D$jM&VaOQFP zoD~Ni$1Nk4B8_W9r|MM;4j01f>)AnN)<2S%7#W!etIG$uo?Pe5LT6|?y>h#AE+ucL zW~XA>IxARv)pC*@)n%X6tL@7BlS*_frp~F8qss@V$lJ5nIbamHy;}89o1CuwaJ)aU z%iesB6=~(giK_}IQso-7tE^Ql7LV%H9L5nTD)rlNwPa-N(R+LxMh-u1*#zWb2Of4P zYC_RT#R?LGK-QAPj9&VUzx`#2ZR??8kDbUT7vt*gEuBnaS+`<~(G)K%UllUja{4N$ zr;CMnr($Qqe23P%BH0Z1LV_Y*bXp0+OM)Xiv8VHKKfPk!WVNF8yOw#V7>XY2|Fcx% z=C|ly-0te@CK&kto-=-%#dn>j+m_+Xuv83e3@31_;mqwpE#7AC$6hzOH`Esl_E*%6 z#?8L2eoNixSIkK+vx8-@T)=Pvfs9ed`|2y^gwOOC=vJ)$u0j6(CES1*^6%}hz->4TRt8Lx_oF3Z`gM$yDQ+oOdsN-j{ST; zv)hUeo>mNNL+3LVq57#t(XsCbdqKx(^VKdv3>|7F(6I+B3$p})=*z;7`LW$mBhEt#irmmI2Y26Fj=&I#>@V3#Y( z%_}GEL!LG;D?N-us>mmZh^3KuB)T7=9nA6zW$o{wC+*`HI$wIou_3DIq8S0FH?v~G zq2=bMbUL3Y=3;VL`vtToAvsaHh|_#nx+z4AN3*5#{7zC$%jMb9S*+$zF}-}bbSa*R z!OAD|0enU`U4Zp2mrk!pNf^@d2g`aEy++lHW=rQ1a+*r>Wpe1^T%1Zh(x>9^$9?)p z5p=(eKiiEzQP2c`T_|K?k*E~grloe0%?1?n2PL?sV?Kr z#XJrrWh3-CBcPN=e~;*QWE>NuI}zF*j-aX>j``5z3&soL#`&B~37Qf8Yo zq|!ybUx)GS4=P?RJwWj1K_ms_Ndlj8=|WOUCyG)+2DRh(`(8O+F1;#;Z%^gok+__N zY+x9bQTa5EYiy}RpL1$Ff@#*4x>r_Cmo6eA%|y&wrF$XGr3>+5DjN|(2cohY$S#+2 zX)GwBoBP=veN7mwH*aP0m>FjxdnuBo2cR(c-buvzCX*0o+m4!7b=kZ>5?Ax|sSzMz zKzW8M1JjezdEk?W2C!`w^n1Z*8QFpn%9ruki7WIA;~-^;VjwV>I*fzk_vNHr@h2qo z5-Ak~C!K&CvXiRinFpRMUChc^(*h7a=jl#V0{EmDrPpvjiQD-=b|1<2X_`HCluHj% zO9lX1MhY_4)}U?W(plX1Ki=65l3s+*sOX;VnB70YyN9AmB(d9=q^WXYi;V%T?@$V< zBnCTIkfKncctI&ooh>~Iu}mQ~#?Ve-!Xo)B3CZ2k1NnVyPwho$Q74K2Ai}4T8It_- z`4m3D8o5)1TIWHiSFykKKO@OZOfpFOC~B0_8Du%9s~f1yNQk$$i&+eD5zrOX0_d-s zfx8f(OiWF0K@7NExJ;G;Q_PBXYKr7HnUQp5JjE;$#3mJ$Ff#gqYx=bxr7Ys z1i`rkpdeZW7CJ-Bw(_v%*OgJ_rm~?-D7%WHd_Z}(@-gMdilxi8w&WmKui%?wyz)g4Qf4duJa zca*V3`L0!lCln zL*=&*l`kJE-#k>ld#L>NArq=YCQye=m=2jB9Wo(0WCC=^gy)b6&LI<;LnbhXOjr(? zpd2zGIb;HI$b{pN3C1B4ibEz4hfEj_nIIf8Avk0LaLAZ{$QXafn109@e#n@8$QXUd zn0&|>e8`x4$QXObn0lz)_nLd|Ib_Vc%NTc;G3_p6*j>gfzyKcIWlTC`47#hGXKxV$ z?lR)vWrROuL_cH%zsrbyml67q5&4i2_^_xvOh)k^EB^?}`Y9;u=b)^=17-axl=a)n ze^c|?=@(Pezo1`CP5&GH zVrqJlw1=tb1N4ij>7(?Esp$>+#niNyelay2re91=Z__WPrq9zarl#BUi>c`z{bFkR z9{R=9^vCEIsi{VjBJKSo&+Hdd%K+&nQ_C;XFQ%5?AT4ET`91o@)bd`^L#CENp_cRX zi_}u1?`&!Pq-yuWE9mO?C0KV|{pdrTy83;abdagvpO6k7(7RNYRaZo+_Npr)ZPw|E z7^Wsnu?OfEGb+>ciz(+C{UYVm;Dief9xi5+tZ2VaMU1He4WAy$_{jEQSE|~RUk&h0`zGHOOP!stA9a#(^_|@- znjcNwGHaMqq|(|6f! z;vqjr?nJ(4njjwv*|SATlZ;2~MUZpaJ2@xnk&`sAnw;7w-ZRKI^S_+1lhr~^zV|Lt zgU}d@7^TZ%ddKCHiETYP8);ydN{Ioe@*?(^p&eWMw|pH+21(($Vj9a59lM#_b_Z>u z@^xLc;K!^X?|4stknX5n0%l7-f~Kl>nr_vhX_av5)U=5vr(u2B6Eq2oL(p?H&EcAR z6(yZw{w+Cvm5L}~jRhiS91S()I#;>ZG=bo)+6Z3DWg$ofiDtO& z$bQ5-vL9|0vJW?b?Au(B1xJk!V_@|G6U=>glt1kqf|sQP)|4MS51O!3i{V ziwf$PT+=Q+dOXPbyXztQdhf_S(kf(Me{9Is5#v7Z$c9^m>>G{^*|579FL+0Gu2snT zjt$u!cVv^^kyTrT>|@7-Y`C7zzSldl?`{>cSDQfgⅅTM~32%a5zxc9)H|Bx*u&7 zy6khs4SHIy=+-e(pY@LJXIh2s8=K&6p9k*N(b_M2NA(X{h3ex?pz0y4@b}i!+V6Tt z_B*XY_K7Bt^&-YVwjR1?U+X!FYD3eOL{U#Rfvz{+*3sFk-jRJntB}2ZY{+)G``R~q zN4CFJ$Ub#!$acFUyW$<$#a1DEqX}faX>Hx+i}J=` z{;*ZJb+igMlz?(u^8LPd+`iW;+}Jk+8w}+gWpdjcxATv94tUO?X-fj0V5|66$Cf}mqT&T0%rI+N;-;)Zt=S6hW*cM~Yy ztVYo|{^x323f|GX(<=1BO`zu>qnv|TcLx5bcMN}|RT%a(fuR!v)l7D$&LryRy`%Rt ztwOK23G^HosLQ8+C+5z;FL=lB^R2?LuL%r$sx{Dhj#b`^Dej1V-8-Ux)G9>#n?UqN zHKLl7OSvQW-@GIDUs{FSttOCj*qEndKK9~t=EQF4C I6{CUwA5@P@hyVZp diff --git a/versione-corrente/en/.doctrees/wallet-solution.doctree b/versione-corrente/en/.doctrees/wallet-solution.doctree index 79ed225ae1afb986ddb4716f8fdfe41610145aff..b095846d52d4a85e9bf0542e05d11a21cf4bae99 100644 GIT binary patch delta 11346 zcmeHNdstM}+IMXSnBgjN(GYMmfCv(o6cjWK@s2181ZtQAY@8W~i!%d+nuuD0(#5l| zF&<6ycsVEYQsb$#i(1<4@$_Y@V3nLpvKJGb(Wk7#7+m^q z(UuZ=A#;v1Y{Fv#eSLhs&|XIC?hB2}FD@(+Ypbdxt7s7CPc1B}s<((X$qs$+$J$`3 zkZkm&39){*lnyTYZxV@(c1`@CIk>*u{E9GOKw?YB{T(BXUhT(yt};d+d&)*A}LGhXEpCAWc844~pk_J;R$v&`VRk@+-hTn9n24sq~|%PYJ~;)AME1 zEtE_iM$b*FBlDTnaIiY3Z>xu=|LRw-uzGC9YGH-SYNKrRAhS9?hf>Q`U((1d4*|9wwA-1C1fhPYVYTpSpT$U9C-`a|@dw4t;c6fvFR|!?2}!4~K!vMh?*ZB@?|_ zT`H$nN}?i53UjB3jYd<2QOwU-fGgirW0$No28%e7YD-hY6O%>hKHifo!l;Z*8riiA3wlPm}d%)_W9~l{9Sbt*MyPhZ7?~%uF+?xKO8uP>Qpy@+m_7 zOqrw;?1p=n4ujmZfMsgYpcv6<}94V6orVOnaW zQO2Ru#nFju;<8DrAVXPZyCiN3#@b4p&xQ)4NotT_j>A4PyEaE;+l>V_9I28XHik8q z8*Eag2%8UXI3~99+MC2WYi(_nsb;BcNrK&>wh4fhuxCIwf&tTDvVkUcz($FEQ%p<2 zU5n`6#L)?Sg1)AR)9S5oW38^WO3C=d7H@}31~62x-J!A%8yJm<=1Qp=wjH|_gXA)* zkeO+-)#LVEBN{4UvqX@*!znj6AXXb-<-q?;Rbc@(Rdm#5sFqly;GVBH6I>WqVKywUiHu64b^yYi_2t^-Vy=*G2vJ57l(E4R1{01kJGI zk{@W3WgNN5pqT*uu5V~Wbr$!9+N*QeRSZ2>J%(K+34va0GZ_nfUoVuBH{5Ow-Pszg zH=hD8&8MNMH^!UQTQB9j51ON3%((rY4^oI(w2LusY0v=57SGK=3qeca!`EiUu0IN4cdpCbsX zxW!zsxQto+dqZ{~7AMo(MjMF(yYckn#;IgG741nOogP-FJMX^;?ldUS#y69`t-_Tk(eWE$FwE!x=AkF-_1`)4)kW}H12HowMy_BBf&wwvLlax zoy*j@X0C9V8=fZ{4yOez=V5b=c`%kH0R(@lOryVlnRr7D(-d6hR^zHbOwjke{O zte}Pm(!CadrAD}l4XWp6t=wz_HEbGA$NynaqRP-V1hH4ccCWh)mU^k9XT3k6G~U@` z+=0fmvT@qg8XHu{m8!YYa(cESgmAsV8zRW7Jz-k}zMW9|_L9=KBO5lt8?PK<#GX@1 zz0{ACS6c-6sfS($^qWel@0C*f+Unpyy!la{O~eM$vyb$Q>id4AKG_&S(tGIl0zC!k za>PgZutZ`6Y-9#~f73ni0s>;u1@HjCGuU%@_aQ0nXwUG$x$K3;rlK*OE5f6EpbqJ^ za){A0-7+5U`QGqOFiKm%@A7f9x;%c9?M)9Ji=ulUx(g0^c<}doSWh~b%P41%^i%+LdyB5ZCqpC}_%TD+rL-rUUetsN^v*CE9iZ`^4PhV{%gH8Wk% z`=XS;k2e^mpfc>P(!+i=5X~nKp+Ed)YdGyk*$-)_=>62ZB z4m_gUSxka&@}W}|71i~?qi{yvqHr#vb^C@2Wo!&O*Jq>!zBp0wl;Zs` zgz9c~EALE&T)n4!CaLQ1N*r6?<@0`(Mw42jf!)dzzR*`W;S0E;vWnt_--Y(lydMP* zcc?tvru0zvA=`^-~mz+=I^&A;FD|L!=xwU%y*~ZRg=KVLB&n2ZBth{QSQ|) zAU~w^YNOJt!GBsW>~jNmD^)i3r&9K8gYY^h?*WxlN|lpJl||335k7GPKT@ikWGZrv zC}1g-k5O5^c#P7yj!~H``Er#Aqc@&!i4F4S3u7dl*)&D))x%vCg5ePaJBmJbbQT#( zFC2~4x{66K^*=UA2=-^MC{Kdt0sgo$wSH(U+#E&^99tCPc@W#gj%$-%7^lsVO*g+V zh0H|LI+y7jf1E4$jV@^-T2s}d1O3*c&=5u4Spo)tfhW1~a*=ZNdDNm?9pcvdvqRi^ z=BKL`tzjc(wdgPm`F?gQ*P<0%xThAW-%EDkxcaU|yOk1MYKiUaR$fypSe)d8RwEZw zmZIF_ndD70$9#MSe0)vi-A6lys6c~DuVR52=5?l?U|c)$%@t5h-er;_tpoUn(JkAccArOFOj<-%5x zUVW`vc+m|!s#Mv*ROE%<$l@n2{3ZU%gvd~hFzk0ZvPee$0EVNo9o`v6 zSsxXU3g*c1kFteD+>ufbNBo>)KR!f+)jU*WBY?>Zc!&4b=O> zCHVl_On-JB{VZfee(U$(Pgye^St3EG%f#@#UIGtKv6O~Km2?g zA$2tPqF#7e<;*eXy%!G<-I*R|!Y*AP@6nr=(zG9=%|q=@I`0c-K!+k`XXv+I{+jfK zr+a9{V_Q7q@-`5?Jx1qTPELLvaOR_&Z&tg`P)gV7-piffdCnERpbf$>>Re&e1kp#Y ze5nf$lC#|Mbt;LbPk()fb_Dc+=i_MmwXD$!#}R9ef(ejEn422>#mc=0xlNUPGl`6* zj&FV^|6s(KH1q0RLU<6LCWCN1;KZS;qhf9`AOS;=(QWa zl6vR0?`9D4vNP+4GL5$%cx}F&Zu>E6lpZb(?cR1P{40Q_jZ~&37bc-X~$+Pypx&7V3UeXGByF&_+s-gd~+~w@@a;)80Xr2Y#xHQCi6yY#=|~g z9*0dZJ_y7nADda&w4;}8*!&4^pTTAqHaoB(_}~}3x{A#eY>KdN9yUv`DZ|DBO}N>F zm-k^)kIi~)TIia8e8oc3%EHpdLej><(Z)gnEkvM=g`kZMzl{yOjSahv4Y`dCx0MaG zjg7L6jj)xCu8obXjg6{}ji`-{rj?DP)l6{qw6Y#fY~R_1Xl^L9&4;sE&1 z8SqOrX=eF5i0Nec!+)^A^M}8I^ZenDpge#0t0&JN{-nY4hacj3{_q1j&mVr!=J~_# z*F1k3OyVX?B7W=T>D$cG$?~@zlgRRiuaP`|c!1;i!~KBg57!sZ-!i;n`Fk9%SpJUT z70cg6ykhy&V1iiwO7M!MuL7?yeg5WJyllZ{<(7xY!~V=Hv!e-eBoJaDXB-`b{FRJx zoYavdA$<@WRihn;14*#s&jPtkn>q+9q&dxz<4Y18kHnG?hZsb(j0j6ZuaqIxs(9Y?feIJwLj zmwGdXsYagf*r@}s#xXC5BoX4+97xjTzz*+i*+QZ@ZkP%u_QvHqR{DX_aU7hX0>|_Q z=Q*nUNer3K!E;q$eQ$7rBQ=0bCl(Gisle>hv2q?T@JPqBK=9>3&RC~n#Ce(z2qL+p zi-WhT!0{^Z*&vwD$2jge6>fwI$EGs)9Ouvl!&G^XGtMd*j;>(kECI{;j-P_T=c^oi zMF|cVsWQ*Nmj(k^>v$&&GU(;lJk*`RL{IR0Apq8M@NgMCFO;aK1q)pqJrU*QI28)3 zZvrP|$pp6WMtNF490u0!=HNmVI9UZ|VSyEtN$NPbS_Qt{6C7|G33Hf-fccG_u|dU1 z`3=Ujp}^S989P;s)IJ$w$jco3f(o40CpgUU%WYu(L(X_##Yq1R#`y?f+~ACFRg614 z8Qvn)m?OhT0`Yg`h)^?iA#%->%b#Ozq;mGKz^;oVt*`5s8qJ}t5>!Cb<%xT@8wDEn?vdG^#<2z5r1WyJ8 zY^*RS)NwY9Bnkncz2`u{ot~7r@nn*a G{C@!Iz-V&- delta 10833 zcmeHMeOOf0x@Rq5nBiMMP!!n=Dj$-9CMs%(AS#HU$MOR)2N;+cVFqUglat@3f|90- z+BZ+nO}nP$w~g7U%#(eeI;XPRJs!W#&A!aCv@CmWR^InrYxb}=L-IW5dG7h^^2cKK z-tX`I{nq=w>s@R1ocSQ=%)3E{*XEFZ%r@c=l|^Qkwcc*7mD~=g$>~^Ptu;#~$z?V* zHke&5>28qYH-nv- zon6wux4Ev)T;sMbF*mdf?XZMYby#}M`Ij(%C&M zx2Mokl&!AGX77#ZPxC3;InvD{hlj9~+_<5&)_SYk)F7E$F0#6;H?qj&Hc9CfQ;RBdsxq=XqjSyV|HA76!j_J^$MfYFnbNPl z`o}*?Vp#r!B=V)FY69FWEj$A$A5_#%jBLi_RJ{}!5MYV7C9w-dHj>18P07*4!FAt2 zmh+4;DnUGrgMZD{wm$6eq|0Fw@g8I_-Il_374IjL)qaZDvdJB!i2LacekOG9r)A2m zuzHoBwNqD+2DKk6yQAbJv4WqG)XaVK@1h0J8LK;%ccfc_+mEoT)3VvTX{%W8X@4Op z?Bi+6$TqdR&1_>CBb!kclS+f=M()z!bIDHbPG*l!kB*B$QE9e)6#iwDVk9EDXkZ4pOKZ7-xV_O4Fn9f1a^8$gb=<0juqK+qS>$I+jC&4 z+1*xmi&W=u;(Fn$C`+sV&TSBuOo608R3Bh@WTGRMUXm1bGYR;Sd|>}+zlK)s8NyW45-F1mje;r%ROW-j5A zBum-Lv+trNCo8!piH)B#jJk<4xkNEVBjn@q0kGjJLtV)OqQK>u}|&w*4H)X3d*Q;@H2>tB>$m1O(WkSWIOaxsIh6 zoXkVtR9Qz7c?I39ET&_F*pc##*wH~<%g5+hIe$B01@i|oOj{~oN3)6ri|9OonC*uc z%>HM=Y;vDx#=S2R{;!d+XBOPS;b{P$%_0{kuv66s+1lz{Iy;Eh^V>DkyCEOU^_ABa z(=CFn-H$EH^Pjc*346Gf>(ku<1nohrd}e&)C=w7b)h;=lwXlo0*)>a2q$v8j7O`cp z8Fle1O|_0Dw@Wff(_r&xz)~x4xtg6Oti$waj)Dwngk)-l)c~udhIiR4={_hri&Woi z0yDQ6b|8~vvDRDo{=;3=IP7)E1wO2H-|9+pNy@6@1&V%GsvJvD+!jYIRI5~DfwHwj zIdd?yaH&FUk4~x1>1dQpjSjI!CA-6It+PVuo54ug8bOhpBkf!WHu(0y&d>z? ze{7W4tn0wW4)wDSip*7Qvak(xLrFWY*13y1SlFW6aHamBr$(@04ZBGV3vZIrLiyps z77L3|X|ooc*sc1g?y(h(lUSWShP=<38)uUb*s7Ww-3VZOH%Ptjy#xGw-y3N!B$rr= zeKfhuP45KL&$>5Fbc_*NnA=gnKc%qKjyw6MOd1f3#|qs@!2itg${zGi5Zk$NfYEjg zRN9_{q1iIXrrnKD-f2LmJ4y-oInO+6%ISIG zc)D;LwK$$ttUXI2SxRdv@6r|c0Af@Z>p$%hcJ=`m9JMe$&UF$Q#!+zeh|SV<&E+ii z{<;-WlktAMtqA@>RZn3%Pvk}vV4W!s*pBs%s1(&YvDtNO@zV*U34JRuX<()eIl=dU zCo6nPjj9)JYlT}2Gd-Bh#_o;I&^X$RM*Q609(<3fq1oKwTjdX_owxg(x1n>r;+*Z+ zm>N|rnC=x!HSE+Qu|)92v?Y>fePNpe+MZEsJEYcjv~45#i^lfPYN|s$Pz7&FBv*X! zc|dhpP4&5&YR{%763Di06WK)D0CsAtZ&si8K=qIIM3U-*&j+}Ka3$hNAv}>70T;<* z|MlQ}CD5k#c1Ald1Zz1MosB|g25*FuLZAT|^-73QnW0L=yGRG; z<01Nq;wm3!YZxysvUKd=@g%l;%LFouS7O*hMzWquhDyv_i$XMq;Du0mcL7%0oo$6Y zm%Jq7QdK1>iz)u*g9RL?s)VGF%*;}AOJ=6n2sAbLd>i#(G)(MNJj~DJ)rO8Xr;Jv^uFRsX2>(W)3Q{((qUmo(=Ljx=oMGH})a8*ZI8(G41Tpe{<3&g_A{a;|U>Q2U@~oE+KBC zA8vy%TPMucXmne8(!F4NB0bG1S%n-#Kh)?x1umhME$rg<2kAGRR$pm2PW8kw^0DDG z(!k#}?D#_v4Kwibhj&ft4V^jgTzzaCp@TY2joeg8w%*V~5~e)fpHAXv-BO6yL=92C zn&`^olo;m29q~2h#~oFqmfgLxQQ6z(v$uENAJ>c!+}mt{u$=jxHlNLXLMHRsw@>77 zj=36z`8_Fo?mq_7$A!XGpztw`!bepKS0l;MiABCXr)YKPvEO^gqh=8@vtjplFxg4k@#jcV{UL zvICc^-rFG8vgAEa)96stHz+ccS8FKz6Z-IrhN%|b4t44aWxbxt%nU(GP2+6sv2n6P zPX#M`{18qd_V~C-s)p));MX_%-==Stv8Jc{&~iQpgZG6|X($#d9#V9hAXHQMrP4bl z33gxi%+$2uMx0ys-P57rSfu5!@JprOCxxmDexhJhH&HD3j!=Hweh?IH)hOJoR%qCN zknZcWd`iQ!xhI|#2eRoq0=*S@-qP^AuI9--xQ2e*Y5Ct8p4WTgS$Sw2rD42Nd~_g) z-qP^=tm5$$9zI5BU!N(7XD5&O_W7T0$FuX9DmsP(gSW$6auKK`bwpTaGh*vKU+F90 z2DFGm)^c<&ofC!?uADsZ5wCFd$)h5SpFGfUnOf0^upTm*d2AtFBUC*O;FW4s%hal3 zo_l~k+G+TRnq^r}ELDG8LZ27lCxGRcn#H4LseFDFeZSN2uWA+#XHlBOL>_D97&Rmm zk5LBiF)E$sPiYe&?7J6Mr;>27GSZ=U1;L9msk1Ev!XpTF6no^w5)#TTzL=`_c9TFB zemtKBhV$U=0p+()kp35t3>P8n!12mh|8rO?Kdt4zG+IAG@x1b-A~F^|8@!%Jgkxgx zZDwXRD%13%y*>7$xL8%+nF$U6F$KPKj8&SH_nu!by4@Mh9nQ~iOSn#NFLH+adeH%x zvV&hLW!oT#eZ5HgwWI^*)qO8|L`|_xOR#rGUh5&m2JQ%@B%u^#&t-|s8G&-TvaJ-r&HA21gyNTSIH`3`s0e%)( zs?;p=)GWi_oI>yGG<2(3=Jmu<@YX;o3-EKm(xGPAs<2$#F0pUkYNQ7{4fm;8wsIC_ z>05dHl%+p2T)p(mc}kR}pUs?aKTXdGuP*?7wrA!$&Pe)I1a#B^?9(&j;x2=R&hzkb zw1H&+KR!%8JFAC1xfO@=O#OZoPEvA-1HDY;NV7IHy=CCVUR*_QZS?M-7YNO2{1c@!v=b(|vMDIg2i4KYa3i+(t0y zau!|8e))6^UCf1slo?QH6|;X`0e>R$sYS!zLksj8F+3&gc z(g9*P;S_|O@wq3WLlv_V?CO`dGXLf;554$pkSDxq!%*#h zHvLLg)?To)?Gt#LRywy*OJ}>UYzO59UmNL9T)Dv;#v76Bp|8I%=%bV{uKs2i{D5@i zo8kICa1WG^X6@gN8KDx6wzeoJfKtL`2Ep5V)o#@3YWCH9GKk4nw<$kz2qeqBHi7D+ zM43e3d_csZYeQ0QGa+tP!fsyMU>qb$&$82!QC5LyWuD&5*#gvw&hF;`{wyY9`txZXhY?C$TklMU?J_qRyB=h_cb2s!K-^J7&I z|6RzI%pSX$G$altU~1R7oy{(HOGj0QEgGDg+9O@&nr5dNe#@(AFfB3TgF&88Z?=+^ z8!+H|;nzXidi=B&hgb1k@XI)i1b4RKIJChlMcaBD+VFBc4kPd~8;5x~%*J6g4l8iT zfUjq^!8oMgFaU>J_~2(8R>A88+wzc=Fiyr=E5czVe1Wnp!{H9tFKn4O1mc4L9P)7( zhro;W`f2aQFy^3pf;`aUl*faVW=O0SxiBO8jWUp&o}NIJnrV zUoZ2}wDPdD@sPCfaJ2DIzz7j&;~{9{({JNbZ{yQ$<5O$QEiJy4d z@Yi6GHvC~vqz!+t6KTUAGep|(HM~e0zCIUe!&ko|ZTJFPr0oWNT8_EHm%SouYk3xV z+LmDMc-rubeHgQiBqDQQkbzN7{^XK{!d1w+te&veb*{{S1 z3*{Ic5X_5~S4$)lI-i$ELCA-6B)ALRCpuC}-CmN#evpX7t|V#leSJXTE2K<58cLGsc`xKlS4cn2 z^vmR(VPJj3Ykj?|b$mo}SAqr-EuRd7=tjs}qe+gE3#qGJnS6f)NhX=XI89@m($%jeBl}6@@w&A z02wL(LlgjCgG2niA5H-8Q-tv(jd7O7n1=<{QZA_$#`kKB@9;N{=tp|Xw!YwgnLxB? z5JP_hQJe^fM+Aat5W~7f+(`}#;{zJw>~4*F%fI#m_iqctn;JyUZy?V02gIiWaZ!U9 z?vKzJq1zlyB5CATfw-wg$mIjng~MaIb^sYm`p5-Fl1Y2Vc5Q+YclvWQ4F-;uWHOKp z7qDUeu#x^SE^Uqk(xwU6RDW2mKa8{Gr2t!(Hg`_Be9U} z!dUh<9-}elQ9G4NMv|ifal{{y=Z}D$DnWjIATg461?(Mv*w}7iW5^c*@tHqjoIe5r zHj2_Xv3=h1hm7}!l&6t=+TRQ58|PO9clkqd(@7D{^+HByAb(GX^`9dDm`UserWallet providerWallet solutionWallet instanceWallet backendIs part ofProvides wallet assertionscontrol / activateIs an instance ofProvide \ No newline at end of file +UserWallet ProviderDevice OEMWallet SolutionWallet InstanceWallet BackendDevice Integrity ServiceUseUseIs part ofProvides Wallet Attestationcontrol / activateIs an instance ofProvideProvide \ No newline at end of file diff --git a/versione-corrente/en/_images/wallet_instance_acquisition.svg b/versione-corrente/en/_images/wallet_instance_acquisition.svg new file mode 100644 index 000000000..040a35eb4 --- /dev/null +++ b/versione-corrente/en/_images/wallet_instance_acquisition.svg @@ -0,0 +1 @@ +UserWallet InstanceDevice Integrity ServiceWallet Provider backend1Request a new operation thatrequires aWallet Attestation2Check ifCryptographic Hardware Keysis available3Generates an ephemeral key pairJWKCheck Wallet Provider is part of the Federation and obtain its metadata4Getchallenge5Generate one time usechallenge6challenge7Generateclient_data_hashas SHA256(challenge, public_jwk)8GenerateCryptographic Hardware KeyPoPhardware_signature= sign(client_data_hash, wallet_hardware_key_tag)9generateIntegrityAssertion(client_data_hash)10integrity_assertion11Generate Wallet Attestation Request withintegrity_assertion,hardware_signature,challenge,Cryptographic Hardware Key Tag,public_jwksigned with ephemeralJWK12Send Wallet Attestation RequestCheck if Wallet Instance is initialized and validusing Cryptographic Hardware Key Tag andhardware_signature13Validatechallenge14Validateintegrity_assertion15Validatehardware_signature16ValidateJWKPoP17CreateWallet Attestation18Wallet Attestation \ No newline at end of file diff --git a/versione-corrente/en/_images/wallet_instance_initialization.svg b/versione-corrente/en/_images/wallet_instance_initialization.svg new file mode 100644 index 000000000..5f5237a06 --- /dev/null +++ b/versione-corrente/en/_images/wallet_instance_initialization.svg @@ -0,0 +1 @@ +UserWallet InstanceDevice Integrity ServiceWallet Provider backendonly upon first installation of the app1starts the app (first use)2Check if Device Integrity Service is availableCheck Wallet Provider is part of the Federation and obtain its metadata3Getchallenge4Generate one time usechallenge5challenge6GenerateCryptographic Hardware Keyspair and storeCryptographic Hardware Key Tag7attestKey(challenge, Cryptographic Hardware Key Tag)8Key Attestationsigned by OEM9Sendchallenge,Key AttestationandCryptographic Hardware Key Tag10Validatechallenge11ValidateKey Attestation12StoreCryptographic Hardware Keys13OK14Wallet Instance Initialized \ No newline at end of file diff --git a/versione-corrente/en/_sources/defined-terms.rst.txt b/versione-corrente/en/_sources/defined-terms.rst.txt index 882588a08..66f729518 100644 --- a/versione-corrente/en/_sources/defined-terms.rst.txt +++ b/versione-corrente/en/_sources/defined-terms.rst.txt @@ -27,8 +27,6 @@ Below are the description of acronyms and definitions which are useful for furth - An entity accredited by the Federation Authority, responsible for managing the process of verification and certification of accreditation requirements for ecosystem roles. * - Digital Identity Provider - An entity, recognized and accredited by the State, responsible for identifying citizens for the issuance of an Electronic Identity Certificate. - * - Electronic Attestation of Identity - - Electronic attestation of attributes referring to master data already present in Italian digital identity systems. * - Digital Credential - An signed Credential whose integrity can be cryptographically verified using the public keys of its Issuer. It is also known as Credential. * - Federation Authority @@ -39,10 +37,18 @@ Below are the description of acronyms and definitions which are useful for furth - All public and/or private entities, conforming to a technical profile and accredited by the Federation Authority, that provide citizens with an IT Wallet Instance. * - Wallet Attestation - Verifiable Attestation, issued by the Wallet Provider, that proves the security compliace of the Wallet Instance. + * - Wallet Secure Cryptographic Device + - Hardware-backed secure environment for creating, storing, and/or managing cryptographic keys and data. A WSCD MAY implement an association proof in different ways. This largely depends on the implementation of the WSCD for example: remote HSM, external smart card, internal UICC, internal native cryptographic hardware, such as the iOS Secure Enclave or the Android Hardware Backed Keystore or StrongBox * - Credential Status Attestation - Verifiable Attestation proving that a related Digital Credential is not revoked. - * - Wallet Attestation Service - - Device manufacturer service that allows you to certify the authenticity of the mobile app (Wallet Instance). + * - Device Integrity Service + - A service provided by device manufacturers that verifies the integrity and authenticity of the app instance (Wallet Instance), as well as certifying the secure storage of private keys generated by the device within its dedicated hardware. It's important to note that the terminology used to describe this service varies among manufacturers. + * - Cryptographic Hardware Keys + - During the app initialization, the Wallet Instance generates a pair of keys, one public and one private, which remain valid for the entire duration of the Wallet Instance's life. Functioning as a Master Key for the personal device, these Cryptographic Hardware Keys are confined to the OS domain and are not designed for signing arbitrary payloads. Their primary role is to provide a unique identification for each Wallet Instance. + * - Cryptographic Hardware Key Tag + - A unique identifier created by the operating system for the Cryptographic Hardware Keys, utilized to gain access to the private key stored in the hardware. + * - Key Attestation + - An attestation from the device's OEM that enhances your confidence in the keys used in your Wallet Instance being securely stored within the device's hardware-backed keystore. * - Qualified Electronic Attestation of Attributes (QEAA) - A digitally verifiable attestation in electronic form, issued by a QTSP, that substantiates a person's possession of attributes. * - Qualified Electronic Signature Provider @@ -83,3 +89,7 @@ Acronyms - Application Programming Interface * - **LoA** - Level of Assurance + * - **AAL** + - Authenticator Assurance Level as defined in ``_ + * - **WSCD** + - Wallet Secure Cryptographic Device diff --git a/versione-corrente/en/_sources/wallet-attestation.rst.txt b/versione-corrente/en/_sources/wallet-attestation.rst.txt index abfde0b54..3448b4504 100644 --- a/versione-corrente/en/_sources/wallet-attestation.rst.txt +++ b/versione-corrente/en/_sources/wallet-attestation.rst.txt @@ -5,176 +5,247 @@ Wallet Attestation ++++++++++++++++++ -The Wallet Attestation containing details about the Wallet Instance and the device's security level where the Wallet Instance is installed. It generally attests the **authenticity**, **integrity**, **security**, **privacy**, and **trust** of a specific Wallet Instance. The Wallet Attestation MUST contain a Wallet Instance public key. - -General Properties ------------------- - -The Wallet Attestation: - -- MUST be issued and MUST be signed by Wallet Provider; -- MUST give all the relevant information to attests the **integrity** and **security** of the device where the Wallet Instance is installed. - -It is necessary for each Wallet Instance to obtain a Wallet Attestation before entering the Operational state. +Wallet Attestation contains information regarding the security level of the device hosting the Wallet Instance. It primarily certifies the **authenticity**, **integrity**, **security**, **privacy**, and **trustworthiness** of a particular Wallet Instance. The Wallet Attestation MUST contain a Wallet Instance public key. Requirements ------------ The following requirements for the Wallet Attestation are met: -1. The Wallet Attestation MUST use the signed JSON Web Token (JWT) format. -2. The Wallet Provider MUST offer a RESTful set of services for issuing the Wallet Attestations. -3. The Wallet Attestation MUST be securely bound to the Wallet Instance public key (**Holder Key Binding**). -4. The Wallet Attestation MUST be issued and signed by an accredited and reliable Wallet Provider, thereby providing integrity and authenticity to the attestation. -5. The Wallet Attestation MUST ensure the integrity and authenticity of the Wallet Instance, verifying that it was accurately created and provided by the Wallet Provider. -6. Each Wallet Instance SHOULD be able to request multiple attestations with different public keys associated to them. This requirement provides a privacy-preserving measure, as the public key MAY be used as a tracking tool during the presentation phase (see also the point number 10, listed below). -7. The Wallet Attestation SHOULD be usable multiple times during its validity period, allowing for repeated authentication and authorization without the need to request new attestations with each interaction. -8. The Wallet Attestation SHOULD have an expiration date time, after which it will no longer be considered valid. -9. When the private key associated with the Wallet Instance is lost or deleted, the attestation MUST become invalid to prevent unauthorized use of the Wallet Instance. - - -High-level Design ------------------ +- The Wallet Attestation MUST use the signed JSON Web Token (JWT) format; +- The Wallet Attestation MUST give all the relevant information to attests the **integrity** and **security** of the device where the Wallet Instance is installed. +- The Wallet Attestation MUST be issued and signed by an accredited and reliable Wallet Provider, thereby providing integrity and authenticity to the attestation. +- The Wallet Provider MUST ensure the integrity, authenticity, and genuineness of the Wallet Instance, preventing any attempts at manipulation or falsification by unauthorized third parties. +- The Wallet Attestation MUST have a mechanism in place for revoking the Wallet Instance, allowing the Wallet Provider to terminate service for a specific instance at any time. +- The Wallet Attestation MUST be securely bound to the Wallet Instance ephemeral public key. +- The Wallet Attestation MAY be usable multiple times during its validity period, allowing for repeated authentication and authorization without the need to request new attestations with each interaction. +- The Wallet Attestation MUST be short-lived and MUST have an expiration date time, after which SHOULD no longer be considered valid. +- The Wallet Attestation MUST NOT be issued by the Wallet Provider if the authenticity, integrity, and genuineness are not guaranteed. In this case, the Wallet Instance MUST be revoked. +- Each Wallet Instance SHOULD be able to request multiple attestations with different ephemeral public keys associated to them. This requirement provides a privacy-preserving measure, as the public key MAY be used as a tracking tool during the presentation phase (see also the point listed below). +- The Wallet Attestation MUST NOT contain any information that can be used to directly reference the User. +- The Wallet Instances MUST secure a Wallet Attestation as a prerequisite for transitioning to the Operational state, as defined by `ARF`_. +- Private keys MUST be generated and stored in the WSCD using at least one of the approaches listed below: + + - **Local Internal WSCD**: in this approach, the WSCD relies entirely on the device's native cryptographic hardware, such as the Secure Enclave on iOS devices or the Hardware Backed Keystore or Strongbox on Android devices. + - **Local External WSCD**: the WSCD is an hardware external to the User's device, such as a smart card compliant with _GlobalPlatform_ and supporting _JavaCard_. + - **Remote WSCD**: Here, the WSCD utilizes a remote Hardware Security Module (HSM). + + - **Local Hybrid WSCD**: the WSCD involves a pluggable internal hardware component within the User's device, such as an _eUICC_ that adheres to _GlobalPlatform_ standards and supports _JavaCard_. + - **Remote Hybrid WSCD**: the WSCD involves a local component mixed with a remote service. + +.. warning:: + At the current stage, the current implementation profile defined in this document supports only the **Local Internal WSCD**. Future versions of this specification MAY include other approaches depending on the required `AAL`. Static Component View -~~~~~~~~~~~~~~~~~~~~~ +--------------------- .. figure:: ../../images/static_view_wallet_instance_attestation.svg :name: Wallet Solution Schema :alt: The image illustrates the containment of Wallet Provider and Wallet Instances within the Wallet Solution, managed by the Wallet Provider. - :target: https://www.plantuml.com/plantuml/uml/XP4nJuSm44VtVehBdxbnPp2iRYx6qTHIjR7SaVQ0-EqzaICDgN4ZBxpqzTUXiCkyJCaupvJXzbH2le4hiCW7A7rsAGM6ETCQn-E7RMSloi0OJzDC691FeL1QE1BMWZBeraW2Mbv4wK8VQayPT5yX9TgCQPclpdy676lnGF0ZN93DyVs3xVsrhOU70hCi0_JshwHXFJp-Rg4dIuECo96moD7xeBQbUKBEbE0EPEwuEWx6N2zj_uXqU8wbhVMhD3tjbAX1BYIl_mq0 + :target: https://www.plantuml.com/plantuml/uml/VP8nJyCm48Lt_ugdTexOCw22OCY0GAeGOsMSerWuliY-fEg_9mrEPTAqw-VtNLxEtaJHGRh6AMs40rRlaS8AEgAB533H3-qS2Tu2zxPEWSF8TcrYv-mJzTOGNfzVnXXJ0wKCDorxydAUjMNNYMMVpug9OTrR7i22LlaesXlADPiOraToZWyBsgCsF-JhtFhyGyZJgNlbXVR1oX5R2YSoUdQYEzrQO1seLcfUeGXs_ot5_VzqYM6lQlRXMz6hsTccIbGHhGu2_hhfP1tBwHuZqdOUH6WuEmrKIeqtNonvXhq4ThY3Dc9xBNJv_rSwQeyfawhcZsTPIpKLKuFYSa_JyOPytJNk5m00 Dynamic Component View -~~~~~~~~~~~~~~~~~~~~~~ +---------------------- -This section describes the Wallet Attestation format and how the Wallet Provider issues it. +The Wallet Attestation acquisition flow can be divided into two main phases. The first phase involves device initialization and registration, which occurs only during the initial launch of the Wallet Instance (after installation). The second phase pertains to the actual acquisition of the Wallet Attestation. -.. figure:: ../../images/dynamic_view_sequence_wallet_instance_attestation.svg - :name: Sequence Diagram for Wallet Attestation Request - :alt: The figure illustrates the sequence diagram for issuing a Wallet Attestation, with the steps explained below. - :target: https://www.plantuml.com/plantuml/ZP91RzH038NlyojCJwr4n7qFgrOSAf2G409wwSL9h60ryGmUpqRRNuyt6qBJe5MlzlFtx3TpcmtLoj27Tqcn6n2CuZEO5WfOB4ePQj8GagkuuOHYSFKZaru1PYZh-WFsFHby4eTAGvDavFzglceyS3jZndgjkKi9q8mSOnm5tEx0Cy_h8HIezaxUkHKROy_F1A_C7oKgAFqkJlcGb38vkL5gIKuJEOnSxSTw1_S-z6ef6CYmHSCmrfMhtEZBN84cYY4BI_U21dPCbD_34nqdJrOQlECLaZP55flzdFJJrtKIRKnDIpQN_RtjdeJKXHCr8MkUcsYsWs_dqq2Y7nky1DLvRguiVX-Lq3RnmDs_V1VMvuVl0HlZmsbWh5SHuGlzzHjWDwVizZwrlNWPwqWA2mdb3DVJsZUdIwh9rML6dR8TeVb5pHCevTAROy_jXPgv4xIYjBIMv53QgNtf-kMDBuishtT1tD8wHUUNBPwNlzi-YXAsHx08iJPa0Q5nzLjlITeoz7y0 +Wallet Instance Initialization and Registration +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- **Message 1**: The User starts the Wallet Instance mobile app and gets authenticated to it. -- **Message 2**: The Wallet Instance verifies the Wallet Provider's trustworthiness by evaluating its Trust Chain. -- **Message 3-4**: The Wallet Instance retrieves the Wallet Provider metadata, including the list of supported algorithms, public keys, and endpoints. -- **Message 5**: The Wallet Instance generates a new key pair. -- **Message 6-7**: The Wallet Instance requests a ``nonce`` from the App Attestation Service. -- **Message 8**: The Wallet Instance creates a Wallet Attestation Request in JWS format, signed with the private key associated with the public key for which it request the attestation. -- **Message 9-13**: The Wallet Instance provides the Wallet Attestation Request to the Wallet Provider, which validates it and returns a signed attestation to the Wallet Instance. -- **Message 13-14**: The Wallet Instance receives the Wallet Attestation signed by the Wallet Provider and performs security and integrity verifications. -- **Message 15**: The Wallet Attestation is now ready for use. +.. figure:: ../../images/wallet_instance_initialization.svg + :name: Sequence Diagram for Wallet Instance Initialization + :alt: The figure illustrates the sequence diagram for initializa a Wallet Instance, with the steps explained below. + :target: https://www.plantuml.com/plantuml/uml/ZLFHRjD047o_hrYb3xHM-84yeA8Iqgf04IdmlBOtpYhEdRMt3eIlPy-cQMoPmeCZQszcTcOklewAeks-TjXgyEq-9t5RBWas8MWUVhfNZG6uu0QzEeU51e7PrqWo0upGseixGy3iEzOrATnvK_O5TIXi6XYYtj612pAKKYMiHrYJf4aFHurm4HjXNrL2v2StV9PmCAC2EHOxycL7pOkTSvM4je7WwoEqJV2mOOaAR8wCYSes2XlGBILZBaLu_SRU5j2L4PzEuB8d6k0g1US3Qa-nvm_ZPal53dW3Vmi4R7aEo3NcDJadFfX6E90aeRdPXOiFTwlRnzMNvVAJw-N60KqY5V1a-ZtPi8-1leIGAx87DkDxKYnHqLaTtIRdUg-sPm4hqyooOflKVKLPzXmgrMRF2UX9qZXu0kKzfGf6r8JkEnWTb3HGFLLrKZNyZHmR3PLWi-K2Rb7A7oW4ztICMMPPMRfaKOEy38T7h6ndlmGrBW1LAQeTNPvCpU5bWIkNgCzfqlXj9zELR8uYLvvAo8_miFnurkZQUXx6dq_oBSn_nPY-ZczOSuawke59m7Zt0BR-PvrnUB4FznEtQOVfYrd0w4Et5rOs9x-eFASP9VqTtRNzjFlwDm00 -Detailed Design ---------------- +**Step 1:**: The User starts the Wallet Instance mobile app for the first time. -The detailed design is explained below. +**Step 2:**: The Wallet Instance: -Wallet Attestation Request -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -To obtain a Wallet Attestation from the Wallet -Provider it is necessary to send a Wallet Attestation -Request from the Wallet Instance containing the associated public key -, the ``nonce`` value provided by the App Attestation Service and a ``jti`` value. + * check if Device Integrity Service is available. + * check whether the device meets the minimum security requirements. -The Wallet Instance MUST do an HTTP request to the Wallet Provider's `token endpoint`_, -using the method `POST `__. +.. note:: -The **token** endpoint (as defined in `RFC 7523 section 4`_) requires the following parameters -encoded in ``application/x-www-form-urlencoded`` format: + **Federation Check:** The Wallet Instance needs to check if the Wallet Provider is part of the Federation, obtaining its protocol specific Metadata. A non-normative example of a response from the endpoint **.well-known/openid-federation** with the **Entity Configuration** and the **Metadata** of the Wallet Provider is represented within the section `Wallet Provider metadata`_. -* ``grant_type`` set to ``urn:ietf:params:oauth:grant-type:jwt-bearer``; -* ``assertion`` containing the signed JWT defined in the Section `Wallet Attestation Request`_. +**Steps 3-5:**: The Wallet Instance sends a request to the Wallet Provider Backend and receives a one-time ``challenge``. This "challenge" is a ``nonce``, which must be unpredictable to serve as the main defense against replay attacks. The backend must generate the ``nonce`` value in a manner that ensures it is single-use and valid only within a specific time frame. This endpoint is compliant with the specification `OAuth 2.0 Nonce Endpoint`_. -Below a non-normative example of the HTTP request. .. code-block:: http - POST /token HTTP/1.1 - Host: wallet-provider.example.org - Content-Type: application/x-www-form-urlencoded + GET /nonce HTTP/1.1 + Host: walletprovider.example.com - grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer - &assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6ImtoakZWTE9nRjNHeGRxd2xVTl9LWl83NTVUT1ZEbmJIaDg2TW1KcHh2a1UifQ.eyJpc3MiOiAidmJlWEprc000NXhwaHRBTm5DaUc2bUN5dVU0amZHTnpvcEd1S3ZvZ2c5YyIsICJhdWQiOiAiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmciLCAianRpIjogImY1NjUyMDcyLWFiZWYtNDU5OS1iODYzLTlhNjkwNjA3MzJjYyIsICJub25jZSI6ICIuLi4uLiIsICJjbmYiOiB7Imp3ayI6IHsiY3J2IjogIlAtMjU2IiwgImt0eSI6ICJFQyIsICJ4IjogIjRITnB0SS14cjJwanlSSktHTW56NFdtZG5RRF91SlNxNFI5NU5qOThiNDQiLCAieSI6ICJMSVpuU0IzOXZGSmhZZ1MzazdqWEU0cjMtQ29HRlF3WnRQQklScXBObHJnIiwgImtpZCI6ICJ2YmVYSmtzTTQ1eHBodEFObkNpRzZtQ3l1VTRqZkdOem9wR3VLdm9nZzljIn19LCAiaWF0IjogMTY5MTQ4ODk2MiwgImV4cCI6IDE2OTE0OTYxNjJ9.Dg_yFaiv6lVftR3FFx0v5JW250mBgXLVP1j0ezZcHRyitqSY7xGmx4y-MGur93FAS85vf_Da-L-REVEltwU2Jw +.. code-block:: http + + HTTP/1.1 200 OK + Content-Type: application/json + + { + "nonce": "d2JhY2NhbG91cmVqdWFuZGFt" + } + +**Step 6**: The Wallet Instance, through the operating system, creates a pair of Cryptographic Hardware Keys and stores the corresponding Cryptographic Hardware Key Tag in local storage once the following requirements are met: + + 1. It MUST ensure that Cryptographic Hardware Keys do not already exist, if they exist and the Wallet is in the initialization phase they MUST be deleted. + 2. It MUST generate a pair of asymmetric Elliptic Curve keys (Cryptographic Hardware Keys) via a local WSCD. + 3. It SHOULD obtain a unique identifier (Cryptographic Hardware Key Tag) for the generated Cryptographic Hardware Keys from the operating system. If the operating system permits specifying a tag during the creation of keys, then a random string for the Cryptographic Hardware Key Tag MUST be selected. This random value MUST be collision-resistant and unpredictable to ensure security. To achieve this, consider using a cryptographic hash function or a secure random number generator provided by the operating system or a reputable cryptographic library. + 4. If the previous points are satisfied, It MUST store the Cryptographic Hardware Key Tag in a local storage. + +.. note:: + + **WSCD:** The Wallet Instance MAY use a local WSCD for key generation on devices that support this feature. On Android devices, Strongbox is RECOMMENDED, Trusted Execution Environment (TEE) SHOULD be used only when Strongbox is unavailable. For iOS devices, Secure Elements (SE) SHOULD be used. Given that each OEM offers a distinct SDK for accessing the local WSCD, the discussion hereafter will address this topic in a general context. + + +**Step 7**: The Wallet Instance uses the Device Integrity Service, providing a "challenge" and the Cryptographic Hardware Key Tag to acquire the Key Attestation. + +.. note:: + + **Device Integrity Service:** In this section the Device Integrity Service is considered as it is provided by device manufacturers. This service allows the verification of a key being securely stored within the device's hardware through a signed object. Additionally, it offers the verifiable proof that a specific Wallet Instance is authentic, unaltered, and in its original state using a specialized signed document made for this scope. + + The service also incorporates details in the signed object, such as the device type, model, app version, operating system version, bootloader status, and other relevant information to assess the device has not been compromised. For Android the service used is `Key Attestation`_ in addition to `Play Integrity API`_, while for iOS the `DeviceCheck`_ service. + +**Step 8**: The Device Integrity Service performs the following actions: + +* Creates a Key Attestation that is linked with the provided "challenge" and the public key of the Wallet Hardware. +* Incorporates information pertaining to the device's security. +* Uses an OEM private key to sign the Key Attestation, therefore verifieable with the related OEM certificate, confirming that the Cryptographic Hardware Keys are securely managed by the operating system. + +**Step 9**: The Wallet Instance sends the ``challenge`` with Key Attestation and Cryptographic Hardware Key Tag to the Wallet Provider Backend in order to register the Wallet Instance identified with the Cryptographic Hardware Key public key. + +.. note:: + + The Key Attestation (``key_attestation``) MUST be encoded in base64. -The response is the `Wallet Attestation`_ in JWT format: .. code-block:: http - HTTP/1.1 201 OK - Content-Type: application/jwt + PUT /wallet-instance HTTP/1.1 + Host: walletprovider.example.com + Content-Type: application/json + + { + "challenge": "0fe3cbe0-646d-44b5-8808-917dd5391bd9", + "key_attestation": "o2NmbXRvYXBwbGUtYXBw... redacted", + "hardware_key_tag": "WQhyDymFKsP95iFqpzdEDWW4l7aVna2Fn4JCeWHYtbU=" + } + +.. note:: + It is not necessary to send the Wallet Hardware public key because it is already included in the ``key_attestation``. + +.. warning:: + During the registration phase of the Wallet Instance with the Wallet Provider it is also necessary to associate it with a specific user + uniquely identifiable by the Wallet Provider. This association is at the discretion of the Wallet PRovider and will not be addressed + within these guidelines as each Wallet Provider may or may not have a user identification system already implemented. + + +**Steps 10-12**: The Wallet Provider validates the ``challenge`` and ``key_attestation`` signature, therefore: + + 1. It MUST verify that the ``challenge`` was generated by Wallet Provider and has not already been used. + 2. It MUST validate the ``key_attestation`` as defined by the device manufacturers' guidelines. + 3. It MUST verify that the device in use has no security flaws and reflects the minimum security requirements defined by the Wallet Provider. + 4. If these checks are passed, it MUST register the Wallet Instance, keeping the Cryptographic Hardware Key Tag and all useful information related to the device. + 5. It SHOULD associate the Wallet Instance with a specific User uniquely identified within the Wallet Provider's systems. This will be useful for the lifecycle of the Wallet Instance and for a future revocation. + +.. code-block:: http + + HTTP/1.1 201 Created + Content-Type: application/json + +If any errors occur during the Wallet Instance registration, the Wallet Provider MUST return an error response. The response MUST use the content type set to *application/json* and MUST include the following parameters: + + - *error*. The error code. + - *error_description*. Text in human-readable form providing further details to clarify the nature of the error encountered. + +**Steps 13-14**: The Wallet Instance has been initialized and becomes operational. + +.. note:: **Threat Model**: while the registration endpoint does not necessitate any client authentication, it is safeguarded through the use of `key_attestation`. Proper validation of this attestation permits the registration of authentic and unaltered app instances. Any other claims submitted will not undergo validation, leading the endpoint to respond with an error. Additionally, the inclusion of a challenge helps prevent replay attacks. The authenticity of both the challenge and the ``hardware_key_tag`` is ensured by the signature found within the ``key_attestation``. + + +Wallet Attestation Issuance +~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +This section describes the Wallet Attestation format and how the Wallet Provider issues it. + +.. figure:: ../../images/wallet_instance_acquisition.svg + :name: Sequence Diagram for Wallet Attestation acquisition + :alt: The figure illustrates the sequence diagram for issuing a Wallet Attestation, with the steps explained below. + :target: https://www.plantuml.com/plantuml/uml/VLJ1Jjj04BtlLupWK8ZIIwNsWDGAH2bGgWe1BHSaQsmFzZJEhhixTff-VMTD4YV6pS4IoxvvyzxRcPm6GI_Dl3BOYBFDF2LlIiu9dfsJrFqnRse5SCOrMZ46Ct4U3du4yWU00PgW-2q473nYLP70jLLccr67mhg6NTHdQZaZHGaLdcK9z-HRNiDH0Xo6shCj2azaHplSUjUgK0yfPZEoULUQPZDZJ5JrzfDsFO4x-jrG442mj01NaqTXPq5Ab2VhzPOzQKkOJ5QyPo9QqA4casYOMnIA7en-Azhpah8PyBEMdVjbBQxmM9USmHNwV86Uu8QMOJ81LkuMkSAq8hD5S4asIecjBL1TqboF5Sne2JMoLzwlZpVQttZhXC2rvAE4gHg4ms_NbrSFbtSN5z_DYv1X9DerHWRkMOqIVA5yxHjj3YuLP0ii0UOacAEWqG2xJcObKlj4aQ92iZAosuAsuuX1wzS1UpVWB87mdE9W34eZUcL-zoAd7LOp5bCigPYi955jKc8eDLmCS7zrzkxzXwCDtnJg9gquItujPiVZJ7jUJ3bltUsJFdov-cyIkB0eZIUz-mZnT3HKCeL5bt-oAT9dJ0IBZG2KS0B5Ii5cwCz282_iNZCUcrZInyNhaWJNDIfdrDxhATxim8Ab_1_P5COzJtSVQ_faz-K73rYyrFIle48Z7-LT_txMDoFUpzizsNoFWTtfwnSZ7iSN8sxeu0SfxWPR5iQA_rBUBKIhV-Uc2MmBs6DEiEZWuqdrAzJlnSz8Z39OXH70-BECGyVRZoDZmjrCzzVga5ukNoSzMDDnn61VjyzQPaurXsPU_GC0 + +**Step 1:**: The User initiates a new operation that necessitates the acquisition of a Wallet Attestation. + +**Steps 2-3:**: The Wallet Instance checks if a Cryptographic Hardware Key exists and generates an ephemeral asymmetric key pair. The Wallet Instance also: - eyJhbGciOiJFUzI1NiIsInR5cCI6IndhbGxldC1hdHRlc3RhdGlvbitqd3QiLCJraWQiOiI1dDVZWXBCaE4tRWdJRUVJNWlVenI2cjBNUjAyTG5WUTBPbWVrbU5LY2pZIiwidHJ1c3RfY2hhaW4iOlsiZXlKaGJHY2lPaUpGVXouLi42UzBBIiwiZXlKaGJHY2lPaUpGVXouLi5qSkxBIiwiZXlKaGJHY2lPaUpGVXouLi5IOWd3Il19.eyJpc3MiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZyIsInN1YiI6InZiZVhKa3NNNDV4cGh0QU5uQ2lHNm1DeXVVNGpmR056b3BHdUt2b2dnOWMiLCJ0eXBlIjoiV2FsbGV0SW5zdGFuY2VBdHRlc3RhdGlvbiIsInBvbGljeV91cmkiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9wcml2YWN5X3BvbGljeSIsInRvc191cmkiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9pbmZvX3BvbGljeSIsImxvZ29fdXJpIjoiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmcvbG9nby5zdmciLCJhdHRlc3RlZF9zZWN1cml0eV9jb250ZXh0IjoiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmcvTG9BL2Jhc2ljIiwiY25mIjp7Imp3ayI6eyJjcnYiOiJQLTI1NiIsImt0eSI6IkVDIiwieCI6IjRITnB0SS14cjJwanlSSktHTW56NFdtZG5RRF91SlNxNFI5NU5qOThiNDQiLCJ5IjoiTElablNCMzl2RkpoWWdTM2s3alhFNHIzLUNvR0ZRd1p0UEJJUnFwTmxyZyIsImtpZCI6InZiZVhKa3NNNDV4cGh0QU5uQ2lHNm1DeXVVNGpmR056b3BHdUt2b2dnOWMifX0sImF1dGhvcml6YXRpb25fZW5kcG9pbnQiOiJldWRpdzoiLCJyZXNwb25zZV90eXBlc19zdXBwb3J0ZWQiOlsidnBfdG9rZW4iXSwidnBfZm9ybWF0c19zdXBwb3J0ZWQiOnsiand0X3ZwX2pzb24iOnsiYWxnX3ZhbHVlc19zdXBwb3J0ZWQiOlsiRVMyNTYiXX0sImp3dF92Y19qc29uIjp7ImFsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2Il19fSwicmVxdWVzdF9vYmplY3Rfc2lnbmluZ19hbGdfdmFsdWVzX3N1cHBvcnRlZCI6WyJFUzI1NiJdLCJwcmVzZW50YXRpb25fZGVmaW5pdGlvbl91cmlfc3VwcG9ydGVkIjpmYWxzZSwiaWF0IjoxNjg3MjgxMTk1LCJleHAiOjE2ODcyODgzOTV9.tNvCyFPCL5tUi2NakKwdaG9xbrtWWl4djSRYRfHrF8NdmffdT044U55pRn35J2cl0LZxbesEDrfSAz2pllw2Ug - - -Below are described the JWT headers and the payload claims -of the `assertion` used in the request. - - -Assertion Header -^^^^^^^^^^^^^^^^ -+-----------------------------------+-----------------------------------+ -| **key** | **value** | -+-----------------------------------+-----------------------------------+ -| alg | Algorithm to verify the token | -| | signature (es. ES256). | -+-----------------------------------+-----------------------------------+ -| kid | Key id of the public key | -| | created by the Wallet Instance. | -+-----------------------------------+-----------------------------------+ -| typ | Media type, set to | -| | ``wiar+jwt``. | -+-----------------------------------+-----------------------------------+ - -Assertion Payload -^^^^^^^^^^^^^^^^^ - -+--------+-------------------------------------------------------------+ -| **key**| **value** | -+--------+-------------------------------------------------------------+ -|| iss || Thumbprint value | -|| || of the JWK of the Wallet Instance | -|| || for which the attestation is | -|| || being requested. | -+--------+-------------------------------------------------------------+ -|| aud || The public url of the Wallet | -|| || Provider. | -+--------+-------------------------------------------------------------+ -|| jti || Unique identifier of the request, according to | -|| || `RFC7519 `_.| -|| || | -+--------+-------------------------------------------------------------+ -|| nonce || The nonce value obtained from the | -|| || App Attestation Service. | -+--------+-------------------------------------------------------------+ -|| cnf || JSON object, according to | -|| || `RFC7800 `_ | -|| || containing the public part of an asymmetric key pair owned | -|| || by the Wallet Instance. | -+--------+-------------------------------------------------------------+ -|| iat || Unix timestamp of attestation request | -|| || issuance time. | -+--------+-------------------------------------------------------------+ -|| exp || Unix timestamp regarding the | -|| || expiration date time. | -+--------+-------------------------------------------------------------+ - - -Below a non-normative example of the Wallet Attestation -request where the decoded JWS headers and payload are separated by a comma: - -.. code-block:: javascript + 1. MUST ensure that Cryptographic Hardware Keys exist. If they do not exist, it is necessary to reinitialize the Wallet. + 2. MUST generates an ephemeral asymmetric key pair whose public key will be linked with the Wallet Attestation. + 3. MUST check if Wallet Provider is part of the federation and obtain its metadata. + + +**Steps 4-6:**: The Wallet Instance solicits a one-time "challenge" from the Wallet Provider Backend. This "challenge" takes the form of a "nonce," which is required to be unpredictable and serves as the main defense against replay attacks. The backend MUST produce the "nonce" in a manner that ensures its single-use within a predetermined time frame. + +.. code-block:: http + + GET /nonce HTTP/1.1 + Host: walletprovider.example.com + +.. code-block:: http + + HTTP/1.1 200 OK + Content-Type: application/json + + { + "nonce": "d2JhY2NhbG91cmVqdWFuZGFt" + } + +**Step 7**: The Wallet Instance performs the following actions: + + * Creates a ``client_data``, a JSON structure that includes the challenge and the ephemeral public ``jwk``. + * Computes a ``client_data_hash`` by applying the SHA256 algorithm to the ``client_data``. + +Below a non-normative example of the ``client_data``. + +.. code-block:: json + + { + "challenge": "0fe3cbe0-646d-44b5-8808-917dd5391bd9", + "jwk": { + "crv": "P-256", + "kty": "EC", + "x": "4HNptI-xr2pjyRJKGMnz4WmdnQD_uJSq4R95Nj98b44", + "y": "LIZnSB39vFJhYgS3k7jXE4r3-CoGFQwZtPBIRqpNlrg", + "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c" + } + } + +**Steps 8-10**: The Wallet Instance takes the following steps: + + * It produces an hardware_signature by signing the ``client_data_hash`` with the Wallet Hardware's private key, serving as a proof of possession for the Cryptographic Hardware Keys. + * It requests the Device Integrity Service to create an ``integrity_assertion`` linked to the ``client_data_hash``. + * It receives a signed ``integrity_assertion`` from the Device Integrity Service, authenticated by the OEM. + +.. note:: ``integrity_assertion`` is a custom payload generated by Device Integrity Service, signed by device OEM and encoded in base64 to have uniformity between different devices. + +**Steps 11-12**: The Wallet Instance: + * Constructs the Wallet Attestation Request in the form of a JWT. This JWT includes the ``integrity_assertion``, ``hardware_signature``, ``challenge``, ``wallet_hardware_key_tag``, and ``public_jwk``, and is signed using the private key from the initially generated ephemeral key pair. + * Submits the Wallet Attestation Request to the Wallet Provider's backend through the token endpoint. + +Below an non-normative example of the Wallet Attestation Request JWT without encoding and signature applied: + +.. code-block:: { "alg": "ES256", "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c", - "typ": "wiar+jwt" + "typ": "war+jwt" } . { - "iss": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c", - "aud": "https://wallet-provider.example.org", - "jti": "6ec69324-60a8-4e5b-a697-a766d85790ea", - "nonce" : ".....", + "iss": "https://wallet-provider.example.org/instance/vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c", + "sub": "https://wallet-provider.example.org/", + "challenge": "6ec69324-60a8-4e5b-a697-a766d85790ea", + "hardware_signature": "KoZIhvcNAQcCoIAwgAIB...redacted", + "integrity_assertion": "o2NmbXRvYXBwbGUtYXBwYX...redacted", + "hardware_key_tag": "WQhyDymFKsP95iFqpzdEDWW4l7aVna2Fn4JCeWHYtbU=", "cnf": { "jwk": { "crv": "P-256", @@ -182,119 +253,56 @@ request where the decoded JWS headers and payload are separated by a comma: "x": "4HNptI-xr2pjyRJKGMnz4WmdnQD_uJSq4R95Nj98b44", "y": "LIZnSB39vFJhYgS3k7jXE4r3-CoGFQwZtPBIRqpNlrg", "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c" - } + }, + "vp_formats_supported": { + "jwt_vc_json": { + "alg_values_supported": ["ES256K", "ES384"], + }, + "jwt_vp_json": { + "alg_values_supported": ["ES256K", "EdDSA"], + }, + }, }, "iat": 1686645115, "exp": 1686652315 } -Whose corresponding JWS is verifiable using the public part of an asymmetric -key pair owned by the Wallet Instance that has a key id which is the same -as the `kid` made available in the JWS header. +The Wallet Instance MUST do an HTTP request to the Wallet Provider's `token endpoint`_, +using the method `POST `__. +The **token** endpoint (as defined in `RFC 7523 section 4`_) requires the following parameters +encoded in ``application/x-www-form-urlencoded`` format: -Wallet Attestation -~~~~~~~~~~~~~~~~~~ +* ``grant_type`` set to ``urn:ietf:params:oauth:grant-type:jwt-bearer``; +* ``assertion`` containing the signed JWT of the Wallet Attestation Request. -The Wallet Attestation MUST be provisioned in JWT format, with -headers and payload claims are listed below. - -Header -^^^^^^ - -+-----------------------------------+-----------------------------------+ -| **key** | **value** | -+-----------------------------------+-----------------------------------+ -| alg | Algorithm to verify the token | -| | signature (es. ES256). | -+-----------------------------------+-----------------------------------+ -| kid | The key id of the key used by the | -| | Wallet Provider to sign the | -| | attestation. | -+-----------------------------------+-----------------------------------+ -| typ | Media type, set to | -| | `wallet-attestation+jwt`, | -| | according to | -| | [`OPENID4VC-HAIP`_] | -+-----------------------------------+-----------------------------------+ -| x5c | Array containing the X.509 | -| | chain | -| | of certificates used to attest | -| | the public key of the Wallet | -| | Provider. | -+-----------------------------------+-----------------------------------+ -| trust_chain | Array containing the Federation | -| | Trust Chain relating to the | -| | Wallet Provider. | -+-----------------------------------+-----------------------------------+ +.. code-block:: http -.. note:: + POST /token HTTP/1.1 + Host: wallet-provider.example.org + Content-Type: application/x-www-form-urlencoded + + grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer + &assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6ImtoakZWTE9nRjNHeG... - One of the claims `trust_chain` and `x5c` MUST be provisioned. - If they are both provided, the related public key - MUST be the same in both `trust_chain` and `x5c`. - -Payload -^^^^^^^ - -+---------------------------+------------------------------------------------+ -| **key** | **value** | -+---------------------------+------------------------------------------------+ -|| iss || The public url of the Wallet Provider | -+---------------------------+------------------------------------------------+ -|| sub || Thumbprint value | -|| || of the JWK of the Wallet Instance | -|| || for which the attestation is | -|| || being issued. | -+---------------------------+------------------------------------------------+ -|| iat || Unix timestamp of attestation | -|| || issuance time. | -+---------------------------+------------------------------------------------+ -|| exp || Unix timestamp regarding the | -|| || expiration date time. | -|| || A good practice to avoid security | -|| || problems is to have a limited | -|| || duration of the attestation. | -+---------------------------+------------------------------------------------+ -|| aal || JSON String asserting the authentication level| -|| || of the Wallet and the key as asserted in | -|| || the cnf claim. | -+---------------------------+------------------------------------------------+ -|| cnf || This parameter contains the ``jwk`` | -|| || parameter | -|| || with the public key of the Wallet Instance | -|| || necessary for the Holder Key Binding. | -+---------------------------+------------------------------------------------+ -|| authorization_endpoint || URL of the SIOPv2 | -|| || Authorization Endpoint. | -+---------------------------+------------------------------------------------+ -|| response_types_supported || JSON array containing a list of | -|| || the OAuth 2.0 ``response_type`` values. | -+---------------------------+------------------------------------------------+ -|| response_modes_supported || JSON array containing a list of the OAuth 2.0 | -|| || "response_mode" values that this | -|| || authorization server supports. | -|| || `RFC 8414 section 2`_ | -+---------------------------+------------------------------------------------+ -|| vp_formats_supported || JSON object with name/value pairs, | -|| || identifying a Credential format supported | -|| || by the Wallet. | -+---------------------------+------------------------------------------------+ -|| request_object_signing || JSON array containing a list of the | -|| _alg_values_supported || JWS signing algorithms (alg values) | -|| || supported. | -+---------------------------+------------------------------------------------+ -|| presentation_definition || Boolean value specifying whether the | -|| _uri_supported || Wallet Instance supports the transfer of | -|| || ``presentation_definition`` by | -|| || reference. MUST set to `false`. | -+---------------------------+------------------------------------------------+ - -Below is an example of Wallet Attestation: - -.. code-block:: javascript +**Steps 13-17**: The Wallet Provider's backend assesses the Wallet Attestation Request and issues a Wallet Attestation, if the requirements described below are satisfied: - { + 1. It MUST check the Wallet Attestation Request contains all the defined parameters according to :ref:`Table of the Wallet Attestation Request parameters `. + 2. It MUST verify that the signature of the received Wallet Attestation Request is valid and associated with public ``jwk``. + 3. It MUST verify that the ``challenge`` was generated by Wallet Provider and has not already been used. + 4. It MUST check that there is a Wallet Instance registered with that ``hardware_key_tag`` and that it is still valid. + 5. It MUST reconstruct the ``client_data`` via the ``challenge`` and the ``jwk`` public key, to validate ``hardware_signature`` via the Cryptographic Hardware Key public key registered and associated with the Wallet Instance. + 6. It MUST validate the ``integrity_assertion`` as defined by the device manufacturers' guidelines. + 7. It MUST verify that the device in use has no security flaws and reflects the minimum security requirements defined by the Wallet Provider. + 8. It MUST check that the URL in ``iss`` parameter is equal to the URL identifier of Wallet Provider. + +If all checks are passed, Wallet Provider issues a Wallet Attestation with an expiration limited to 24 hours. + +Below an non-normative example of the Wallet Attestation without encoding and signature applied: + +.. code-block:: + + { "alg": "ES256", "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY", "trust_chain": [ @@ -343,9 +351,159 @@ Below is an example of Wallet Attestation: "exp": 1687288395 } +**Step 18**: The Wallet Instance receives the Wallet Attestation signed by the Wallet Provider and performs security and integrity verifications. + +.. code-block:: http + + HTTP/1.1 201 OK + Content-Type: application/jwt + + eyJhbGciOiJFUzI1NiIsInR5cCI6IndhbGx... redacted + + +.. _table_wallet_attestation_request_claim: + +Wallet Attestation Request +~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The JOSE header of the Wallet Attestation Request JWT MUST contain: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **JOSE header** + - **Description** + - **Reference** + * - **alg** + - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms listed in the Section `Cryptographic Algorithms `_ and MUST NOT be set to ``none`` or any symmetric algorithm (MAC) identifier. + - :rfc:`7516#section-4.1.1`. + * - **kid** + - Unique identifier of the ``jwk`` inside the ``cnf`` claim of Wallet Instance as base64url-encoded JWK Thumbprint value. + - :rfc:`7638#section_3`. + * - **typ** + - It MUST be set to ``var+jwt`` + - + +The body of the Wallet Attestation Request JWT MUST contain: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Reference** + * - **iss** + - Identifier of the Wallet Provider concatenated with thumbprint of the JWK in the ``cnf`` parameter. + - :rfc:`9126` and :rfc:`7519`. + * - **aud** + - It MUST be set to the identifier of the Wallet Provider. + - :rfc:`9126` and :rfc:`7519`. + * - **exp** + - UNIX Timestamp with the expiry time of the JWT. + - :rfc:`9126` and :rfc:`7519`. + * - **iat** + - UNIX Timestamp with the time of JWT issuance. + - :rfc:`9126` and :rfc:`7519`. + * - **challenge** + - Challenge data obtained from ``nonce`` endpoint + - + * - **hardware_signature** + - The signature of ``client_data`` obtained using Cryptographic Hardware Key base64 encoded. + - + * - **integrity_assertion** + - The integrity assertion obtained from the **Device Integrity Service** with the holder binding of ``client_data``. + - + * - **hardware_key_tag** + - Unique identifier of the **Cryptographic Hardware Keys** + - + * - **cnf** + - JSON object, containing the public part of an asymmetric key pair owned by the Wallet Instance. + - :rfc:`7800` + +.. _table_wallet_attestation_claim: + +Wallet Attestation +~~~~~~~~~~~~~~~~~~ + +The JOSE header of the Wallet Attestation JWT MUST contain: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **JOSE header** + - **Description** + - **Reference** + * - **alg** + - A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms listed in the Section `Cryptographic Algorithms `_ and MUST NOT be set to ``none`` or any symmetric algorithm (MAC) identifier. + - :rfc:`7516#section-4.1.1`. + * - **kid** + - Unique identifier of the ``jwk`` inside the ``cnf`` claim of Wallet Instance as base64url-encoded JWK Thumbprint value. + - :rfc:`7638#section_3`. + * - **typ** + - It MUST be set to ``wallet-attestation+jwt`` + - `OPENID4VC-HAIP`_ + * - **trust_chain** + - Sequence of Entity Statements that composes the Trust Chain related to the Relying Party. + - `OIDC-FED`_ Section *3.2.1. Trust Chain Header Parameter*. + +The body of the Wallet Attestation JWT MUST contain: + +.. list-table:: + :widths: 20 60 20 + :header-rows: 1 + + * - **Claim** + - **Description** + - **Reference** + * - **iss** + - Identifier of the Wallet Provider + - :rfc:`9126` and :rfc:`7519`. + * - **aud** + - Identifier of the Wallet Provider concatenated with thumbprint of the Wallet Instance. + - :rfc:`9126` and :rfc:`7519`. + * - **exp** + - UNIX Timestamp with the expiry time of the JWT. + - :rfc:`9126` and :rfc:`7519`. + * - **iat** + - UNIX Timestamp with the time of JWT issuance. + - :rfc:`9126` and :rfc:`7519`. + * - **cnf** + - JSON object, containing the public part of an asymmetric key pair owned by the Wallet Instance. + - :rfc:`7800` + * - **aal** + - JSON String asserting the authentication level of the Wallet and the key as asserted in the cnf claim. + - + * - **authorization_endpoint** + - URL of the Wallet Authorization Endpoint (Universal Link). + - + * - **response_types_supported** + - JSON array containing a list of the OAuth 2.0 ``response_type`` values. + - + * - **response_modes_supported** + - JSON array containing a list of the OAuth 2.0 "response_mode" values that this authorization server supports. + - :rfc:`8414` + * - **vp_formats_supported** + - JSON object with name/value pairs, identifying a Credential format supported by the Wallet. + - + * - **request_object_signing_alg_values_supported** + - JSON array containing a list of the JWS signing algorithms (alg values) supported. + - + * - **presentation_definition_uri_supported** + - Boolean value specifying whether the Wallet Instance supports the transfer of presentation_definition by reference. MUST be set to false. + - + .. _token endpoint: wallet-solution.html#wallet-attestation .. _Wallet Attestation Request: wallet-attestation.html#format-of-the-wallet-attestation-request .. _Wallet Attestation: wallet-attestation.html#format-of-the-wallet-attestation .. _RFC 7523 section 4: https://www.rfc-editor.org/rfc/rfc7523.html#section-4 .. _RFC 8414 section 2: https://www.rfc-editor.org/rfc/rfc8414.html#section-2 +.. _Wallet Provider metadata: wallet-solution.html#wallet-provider-metadata +.. _Key Attestation: https://developer.android.com/privacy-and-security/security-key-attestation +.. _Play Integrity API: https://developer.android.com/google/play/integrity?hl=it +.. _DeviceCheck: https://developer.apple.com/documentation/devicecheck +.. _OAuth 2.0 Nonce Endpoint: https://datatracker.ietf.org/doc/draft-demarco-oauth-nonce-endpoint/ +.. _ARF: https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework diff --git a/versione-corrente/en/_sources/wallet-solution.rst.txt b/versione-corrente/en/_sources/wallet-solution.rst.txt index 4a2036b1f..31fd4893c 100644 --- a/versione-corrente/en/_sources/wallet-solution.rst.txt +++ b/versione-corrente/en/_sources/wallet-solution.rst.txt @@ -5,30 +5,32 @@ Wallet Solution ------------------- -The Wallet Solution is a comprehensive product offered by the Wallet Provider to cater to the needs of Users in managing their digital assets securely. Designed to provide a seamless User experience, this solution enables Users to leverage the capabilities of the Wallet effectively. +The Wallet Solution is a comprehensive product offered by the Wallet Provider to cater to the needs of Users in managing their digital assets securely. It is issued by the Wallet Provider in the form of a mobile app, it also consists of services and web interfaces for the exchange of data between the Wallet Provider and its Wallet Instances for the requirements of the trust model and in total respect of the User's privacy, in accordance with national and EU legislation. -The Wallet Solution is issued by the Wallet Provider in the form of a mobile app, it also consists of services and web interfaces for the exchange of data between the Wallet Provider and its Wallet Instances for the requirements of the trust model and in total respect of the user's privacy, in accordance with national and EU legislation. - -The mobile app serves as the primary interface for Users, allowing them to access and interact with their digital assets conveniently. These digital assets, known as Attestations, include Personal Identification Data (PID[1]), a set of data that can uniquely identify a natural or a legal person, along with other Qualified and non-qualified Electronic Attestations of Attributes, also known as QEAAs and EAAs respectively, or (Q)EAAs for short[1]. Once a User installs the mobile app on their device, it is referred to such an installation as a Wallet Instance for the User. +The mobile app serves as the primary interface for Users, allowing them to access and interact with their digital Credentials conveniently. These are a set of data that can uniquely identify a natural or a legal person, along with other Qualified and non-qualified Electronic Attestations of Attributes, also known as QEAAs and EAAs respectively, or (Q)EAAs for short[1]. Once a User installs the mobile app on their device, it is referred to such an installation as a Wallet Instance for the User. By supporting the mobile app, the Wallet Provider plays a vital role in ensuring the security and reliability of the entire Wallet Solution, since it is responsible for issuing the Wallet Attestation, that is a cryptographic proof that allow the evaluation of the authenticity and the integrity of the Wallet Instance. +The Wallet Provider MUST offer a RESTful set of services for issuing the Wallet Attestations. Requirements -^^^^^^^^^^^^^^^^^^^^ +^^^^^^^^^^^^ + +This section lists below the essential requirements that must be met by the Wallet Solution to ensure its functionality, security, and compliance with relevant standards and regulations. - **Trustworthiness within the Wallet ecosystem**: the Wallet Instance MUST establish trust and reliability within the Wallet ecosystem. - **Compliance with Provider specifications for obtaining PID and (Q)EAA**: the Wallet Instance MUST adhere to the specifications set by Providers for obtaining Personal Identification (PID) and (Q)EAAs. - **Support for Android and iOS operating systems**: the Wallet Instance MUST be compatible and functional at least on both Android and iOS operating systems, as well as available on the Play Store and App Store respectively. - **Verification of device ownership by the User**: the Wallet Instance MUST provide a mechanism to verify the User's actual possession and full control of their personal device. + Wallet Instance ^^^^^^^^^^^^^^^ -The Wallet Instance serves as a unique and secure device for authenticating the User within the Wallet ecosystem. It establishes a strong and reliable identity for the User, enabling them to engage in various digital transactions in a secure and privacy-preserving manner. +The Wallet Instance serves as a unique and secure device for authenticating the User within the Wallet ecosystem. It establishes a strong and reliable mechanismm for the User to engage various digital transactions in a secure and privacy-preserving manner. -The Wallet Instance establishes the trust within the Wallet ecosystem by consistently presenting a Wallet Attestation during interactions with other ecosystem actors such as PID Providers, (Q)EAA Providers, and Relying Parties. These verifiable attestations, provided by the Wallet Provider, reference the public part of the asymmetric cryptographic key owned by the Wallet Instance. Their purpose is to authenticate the Wallet Instance itself, ensuring its realiability when engaging with other ecosystem actors. +The Wallet Instance establishes the trust within the Wallet ecosystem by consistently presenting a Wallet Attestation during interactions with other ecosystem actors such as PID Providers, (Q)EAA Providers, and Relying Parties. These verifiable attestations, provided by the Wallet Provider, purpose to authenticate the Wallet Instance itself, ensuring its realiability when engaging with other ecosystem actors. -To guarantee the utmost security, these cryptographic keys are securely stored within the device's Trusted Execution Environment (TEE)[3]. This ensures that only the User is allowed to access them, thus preventing unauthorized usage or tampering. For more detailed information, please refer to the `Wallet Attestation section`_ and the `Trust Model section`_ of this document. +To guarantee the utmost security, these cryptographic keys MUST be securely stored within the WSCD which MAY be internal (device's Trusted Execution Environment (TEE)[3]), external, or hybrid. This ensures that only the User is allowed to access them, thus preventing unauthorized usage or tampering. For more detailed information please refer to the `Wallet Attestation section`_ and the `Trust Model section`_ of this document. Wallet Instance Lifecycle ^^^^^^^^^^^^^^^^^^^^^^^^^ @@ -36,7 +38,7 @@ The Wallet Instance has three distinct states: Operational, Valid, and Deactivat Initialization Process ~~~~~~~~~~~~~~~~~~~~~~ -To activate the Wallet Instance, the Users MUST install the mobile wallet application on their device and open it. Furthermore, Users will be asked to set their preferred method of unlocking their device; this can be accomplished by entering a personal identification number (PIN) or by utilizing biometric authentication, such as fingerprint or facial recognition, according to their personal preferences and device's capabilities. +To activate the Wallet Instance, the Users MUST install the mobile Wallet application on their device and open it. Furthermore, Users will be asked to set their preferred method of unlocking their device; this can be accomplished by entering a personal identification number (PIN) or by utilizing biometric authentication, such as fingerprint or facial recognition, according to their personal preferences and device's capabilities. After completing these steps, the Wallet Instance sets the Operational state. @@ -44,16 +46,17 @@ Transition to Valid state ~~~~~~~~~~~~~~~~~~~~~~~~~ To transition from the Operational state to the Valid state, the Wallet Instance MUST obtain a valid Personal Identification (PID). Once a valid PID is acquired, the Wallet Instance becomes Valid. -In order to securely and unambiguously identify Users, the Wallet Instance adopts a Level of Assurance (LoA) 3 authentication, which guarantees a high level of confidence in the User's identity. The authentication method is chosen by the PID Provider from among the notified eID solutions at the national level. +To securely and unambiguously authenticate Users, the Wallet Instance necessitates a High Level of Assurance (LoA 3) for User authentication. The method to achieve this LoA is selected by the PID Provider based on the identity proofing method employed during the provisioning of the Digital Credential to the User. Furthermore, to store the acquired Digital Credential, the Wallet Instance MUST demonstrate to the Credential Issuer an adequate security compliance to maintain the Credential at the same LoA at which it was issued. Once the Wallet Instance is in the Operational state, Users can: - Obtain, view, and manage (Q)EAAs from trusted (Q)EAA Providers[1]; - Authenticate to Relying Parties[1]; - - Authorize the presentation of their digital credentials with Relying Parties. + - Authorize the presentation of their digital Credentials with Relying Parties. Please refer to the relative sections for further information about PID and (Q)EAAs issuance and presentation. + Return to Operational state ~~~~~~~~~~~~~~~~~~~~~~~~~~~ A Valid Wallet Instance may revert to the Operational state under specific circumstances. These circumstances include the expiration or the revocation of the associated PID by its PID Provider. diff --git a/versione-corrente/en/algorithms.html b/versione-corrente/en/algorithms.html index 4e9f83c2a..e16661e84 100644 --- a/versione-corrente/en/algorithms.html +++ b/versione-corrente/en/algorithms.html @@ -639,16 +639,13 @@

{{ item.title }}
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
  • Wallet Attestation
    • diff --git a/versione-corrente/en/index.html b/versione-corrente/en/index.html index 07f6c41b9..334eb432c 100644 --- a/versione-corrente/en/index.html +++ b/versione-corrente/en/index.html @@ -638,16 +638,13 @@

    {{ item.title }}

  • Wallet Attestation
  • Wallet Attestation
      -
    • General Properties
    • Requirements
      • -
    • High-level Design -
      • -
    • Detailed Design @@ -1154,16 +1148,13 @@

      Index of contentWallet Attestation
        -
      • General Properties
      • Requirements
        • -
      • High-level Design -
        • -
      • Detailed Design diff --git a/versione-corrente/en/objects.inv b/versione-corrente/en/objects.inv index 0d53a385955b6a72e1aa3de34b01c4e5f24b8928..bd48fc7e2100eea2b42112dae8e64766703341f3 100644 GIT binary patch delta 1520 zcmV0PT1&QTb;M#Abqv0V zH>5={9LSB8C(`TT+bW#^leD0GbEdTFkb6N4f*1rb z2;vZM5QLvUS}^`{>|jBM;nWm#&uUs=O=TPi(S&p1A3|0D@k-GHsShnVP(>qIwTw+ z;lOVl(if-jHd1&yDBRd(E11kmb|^8Yuax6G7jKy9H^Mp9*bwl_mrw&RybNr+xw8!H z2S#6MO(l>bGB25?xo)L%p+Q3y4H>l0XZXS~1M{3qn12#!#PK7m54a%`{HFwO&AKJb zQ`m22<%4ClmEtF>jHmBG<}|$@p~v3s&lv6FU!T6*++5>R%h@2$ZQ50|mjgm5{4!>L zM>S!b7PAzG^spqaOi&5{{Gu$t0D7`R z=q4C?bbq-JW!lC{yik8z(y$_UvXkylZOu%J4>mY*AxPvJJN%<-bx+$b6Ag4mi zpk%NzGdeS;bCmpNc&*3dwhYYDwTgO5vuff~lz)zgrZqVNikPLrc5wGxD&#w z#%D4cjgeEMna-tg-s_iSW=W=KzC8EF@Yu+v=!&+5sE={IA4VOe;M;U-@n_RRBf$eF2%poZ$YU*6f!;LwiCpW)^-VD~}whpz5 zN}O}Ty0|)fXg=7!<7zn!cBw2E%pfhZG}=)DHDT< zcGIF{wlrpaSYD<+X`9kQKC+j=y+~Z4$H~ovWTc^%BnvyqE0h65)QnE`2itHSZhRVw z`#)5&J)?4DwG1NQ3OPuU4}ij7(<>E>93-jGUP$Cxauhb4B!`_- zY#g6m`yQ%*8N&+*UrAGX|m%KSHQyThI?CDTuyN)4*y%5GOh>8qBkg4Ni$pF zmmDI;C3=E#5UxoGvwW#_gZwmt+D=M>Ic zJe{&4jghV1q2^g|)Bv2KZ=M5aP7DmMOv z%Bj27l{)(ym{aP*M(kc_esT2pz;V)vJrmEeHj>nGJ0@ObI|#4DW!rQ6Gnc@fmWcx5 zFuGzHRP}kSC(hr++T-&$W@*tES}ofy(7U{B2ZDE&dM}BBLH8a9UGTG6;N-^DVvt_j zpSCWX!s&|Wa6QaRT9IYecjI0bcd~dj76>hzft%W^iKQcx&#;Sj1!U*7Ox?SasfcKQ WAx;;~QH<}`srLeMJ@Ws45$7}1bQ*m^wPPLH-Me35} z!RTs7@^4Lz71c&68bZV)9ww0~ZB}EE1L0&x`3%fDmSL-dSAV$_MzLLEA}a=|x8SQh zA|nHFpf@H@wAaJ8Bb@+Kw4lN;!n0b|+3V3{^hb=T=$p)mVNzhuw9zecuZTergCYh+ z90CrC@bh~Ei@zK@n9yQ)nu6|`panKm#eonFco+U5RRs`l6g?7gXvl#gA_{aX#hYc3 zLdS4pw~j&Ak$=cJcL9z4Yfjexdv<7)TNfHuid$d{M~V0anWc5~+}a32_b zp@J$fim1F~hUTVG-h~zoIW%O^KEGox95Yy+cL~!njej_PV&Z^nqQHMz^2W|vVtESt z)y{l$R&AC1!7A(N2hcfh-uKXBKkd&L?c-mc?r(0c@u{=fBF}BwRc0>-gi!cpZ2cWI zgmGHTnmD9~C3$7SqyXSwXB*lGZ5;hZFgPOy*q??;4>N{Z>6=D`8 zgPED-%sl5P`Onz39?M-Bm^IfC^(M{I#HT2grhgRCN?xU=SxHGTS3{PK`!dm&SRopOV=rnWp*j+#ADVtDB;0+7wcp;(9+wy-C5h?bhPY#4EAtdiZWT zv>=+_3G?mAlyEqrXrEqfX!{v|zzKI_XluvNb31kpbdj4s%mY^vy2NzX194}U75E+T zgMYJ|9c!)wf!p2~DNc{E2@|O^Y+@eSp5~_U~cZ}P@}2B zIVY@*t9K902iLdUIt`1GfuENgWk(28w~a2LsN6IVGK&2dC-jfoo2O6krEBOHosnT1 zO#rZ}msS@`7>oqUf7aCZf`mI}rd)>CDSuylJGg=~z9od428Ubj5&YXqt*O>F1`~GM zqGYZ#W_?&*MxV4zX(1o2m%+VAUcuw_WxRDZAy$Kl3jpt%1- z727kaMypmq1YBWHr2f!|d_iFOE+-4RobHNvg#qK1skmP9z*DV~X!~e#e&Fg`(=&{F_tjv|tCDH0_iQalVgs;Y7IxUT^77 z>zR1}bdjW&uVdo*vxNW>)wG-3<|HQwF7slqhz6m5^nq6E#ZK^g<4ieduia0V6VKta zg=4sbXn*TU VC(W4{U*b~l1;+Kr{{vrdQ9r2y(kK7` diff --git a/versione-corrente/en/pid-eaa-data-model.html b/versione-corrente/en/pid-eaa-data-model.html index ede677521..2fcb2624f 100644 --- a/versione-corrente/en/pid-eaa-data-model.html +++ b/versione-corrente/en/pid-eaa-data-model.html @@ -639,16 +639,13 @@

        {{ item.title }}

    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
        -
      • General Properties
      • Requirements
        • -
      • High-level Design -
        • -
      • Detailed Design diff --git a/versione-corrente/en/searchindex.js b/versione-corrente/en/searchindex.js index 2bac105e1..bc3e3ee59 100644 --- a/versione-corrente/en/searchindex.js +++ b/versione-corrente/en/searchindex.js @@ -1 +1 @@ -Search.setIndex({"docnames": ["algorithms", "backup-restore", "contribute", "defined-terms", "index", "pid-eaa-data-model", "pid-eaa-issuance", "proximity-flow", "pseudonyms", "relying-party-solution", "remote-flow", "revocation-lists", "ssi-introduction", "standards", "trust", "wallet-attestation", "wallet-solution"], "filenames": ["algorithms.rst", "backup-restore.rst", "contribute.rst", "defined-terms.rst", "index.rst", "pid-eaa-data-model.rst", "pid-eaa-issuance.rst", "proximity-flow.rst", "pseudonyms.rst", "relying-party-solution.rst", "remote-flow.rst", "revocation-lists.rst", "ssi-introduction.rst", "standards.rst", "trust.rst", "wallet-attestation.rst", "wallet-solution.rst"], "titles": ["Cryptographic algorithms", "backup-restore.rst", "How to contribute", "Normative Language and Conventions", "The Italian EUDI Wallet implementation profile", "PID/(Q)EAA Data Model", "PID/(Q)EAA Issuance", "Proximity Flow", "pseudonyms.rst", "Relying Party Solution", "Remote Flow", "Credential Lifecycle", "Self Sovereign Identity", "Technical References", "The Infrastructure of Trust", "Wallet Attestation", "Wallet Solution"], "terms": {"tutti": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "gli": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "esempi": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "contenuti": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "questa": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "documentazion": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "sono": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "da": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "intendersi": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "come": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "non": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 15, 16], "normativi": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "all": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "exampl": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "contain": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "thi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "document": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "ar": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "meant": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "norm": [0, 1, 2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "The": [0, 2, 3, 5, 6, 7, 9, 10, 11, 12, 13, 15, 16], "follow": [0, 2, 4, 5, 6, 7, 9, 10, 11, 12, 14, 15], "must": [0, 3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "support": [0, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "alg": [0, 5, 6, 9, 10, 11, 14, 15, 16], "paramet": [0, 1, 4, 8, 9, 10, 11, 15, 16], "valu": [0, 1, 5, 6, 7, 8, 9, 10, 11, 14, 15, 16], "descript": [0, 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 14], "oper": [0, 4, 6, 9, 10, 14, 15], "refer": [0, 3, 4, 5, 6, 7, 9, 11, 12, 14, 15], "es256": [0, 5, 6, 9, 10, 11, 14, 15, 16], "ellipt": [0, 7, 9], "curv": [0, 5, 7, 9], "digit": [0, 3, 4, 5, 6, 9, 10, 11, 12, 14, 16], "signatur": [0, 3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "ecdsa": [0, 9, 10], "us": [0, 3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16], "one": [0, 5, 6, 7, 9, 10, 11, 12, 14], "enabl": [0, 3, 9, 10, 12, 14, 16], "list": [0, 2, 3, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "section": [0, 5, 6, 7, 9, 10, 11, 14, 15, 16], "below": [0, 2, 3, 4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "sha256": 0, "rfc": [0, 5, 6, 9, 10, 11, 13, 14, 15, 16], "7518": [0, 13], "sog": 0, "IS": 0, "etsi": [0, 5], "es384": [0, 6, 9, 10, 14, 15, 16], "sha384": 0, "es512": [0, 6, 16], "sha521": 0, "rsa": [0, 6, 9, 10], "oaep": [0, 9, 10], "256": [0, 5, 6, 7, 9, 10, 11, 14, 15, 16], "encrypt": [0, 5, 6, 7, 9, 10, 11, 13, 14], "scheme": [0, 4, 6, 9, 10, 12], "optim": 0, "asymmetr": [0, 6, 15, 16], "pad": 0, "hash": [0, 5, 6, 7, 9, 11], "function": [0, 3, 4, 5, 7, 9, 16], "mgf1": 0, "sha": [0, 5, 6, 7, 9, 10, 11], "mask": 0, "gener": [0, 4, 5, 6, 7, 9, 10, 13], "kei": [0, 1, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "7516": [0, 6, 9, 10, 11, 13], "a128cbc": [0, 9, 10], "hs256": [0, 9, 10], "ae": 0, "cipher": [0, 7, 9], "block": [0, 7, 9, 11], "chain": [0, 4, 5, 6, 9, 10, 15], "mode": [0, 7, 9, 10, 13], "128": [0, 6, 9, 10], "bit": [0, 6, 9, 10], "initi": [0, 2, 4, 6, 7, 9, 11], "vector": 0, "plu": 0, "hmac": 0, "authent": [0, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "truncat": 0, "content": [0, 5, 6, 9, 10, 11, 15], "a256cbc": [0, 9, 10], "hs512": [0, 9, 10], "512": [0, 6], "famili": [0, 5, 6], "short": [0, 6, 7, 9, 14, 16], "name": [0, 5, 6, 7, 9, 10, 14, 15, 16], "brainpool": 0, "brainpoolp256r1": 0, "brainpoolp384r1": 0, "brainpoolp512r1": 0, "5639": 0, "nist": 0, "p": [0, 5, 6, 9, 10, 13, 14, 15, 16], "384": 0, "521": 0, "fip": 0, "186": 0, "4": [0, 5, 6, 7, 9, 10, 11, 14, 15], "iso": [0, 5, 7, 9, 10], "iec": [0, 5], "14888": 0, "3": [0, 5, 6, 7, 9, 10, 11, 14, 15, 16], "recommend": [0, 3, 5, 6, 9, 10, 11, 14], "ps256": 0, "rsassa": 0, "appendix": [0, 6], "pss": 0, "probabilist": 0, "ps384": 0, "ps512": 0, "sha512": 0, "ecdh": 0, "es": [0, 15], "diffi": 0, "hellman": 0, "ephemer": [0, 7, 9], "static": [0, 4, 9, 10, 14], "agreement": [0, 7, 9], "concat": 0, "deriv": [0, 6, 7, 9, 11, 14], "kdf": 0, "a128kw": 0, "cek": 0, "wrap": 0, "length": [0, 5, 6, 7, 9, 10], "a256kw": 0, "NOT": [0, 3, 5, 6, 9, 10, 11, 14], "none": [0, 6, 9, 10, 11], "rsa_1_5": 0, "rsae": 0, "pkcs1": 0, "v1_5": 0, "secur": [0, 3, 4, 6, 7, 11, 12, 13, 14, 15, 16], "vulner": 0, "default": [0, 9, 10, 14], "hs384": [0, 9, 10], "what": [1, 8, 12, 14], "useful": [1, 8], "todo": [1, 8], "req": [1, 8, 9, 10], "1": [1, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16], "2": [1, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16], "tabl": [1, 5, 6, 7, 8, 9, 10, 11, 14], "claim": [1, 3, 4, 6, 8, 9, 10, 11, 14, 15, 16], "IT": [2, 3, 4, 5, 6, 7, 9, 16], "wallet": [2, 3, 5, 6, 7, 9, 10, 12, 13], "project": [2, 4], "includ": [2, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "an": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "open": [2, 16], "develop": [2, 4, 14], "process": [2, 3, 4, 5, 6, 9, 10, 11, 12, 14], "approach": [2, 5, 12, 14], "ensur": [2, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "access": [2, 4, 5, 9, 10, 11, 12, 14, 16], "invit": 2, "interest": 2, "parti": [2, 3, 4, 5, 6, 11, 12, 16], "particip": [2, 3, 4, 14], "consequ": 2, "stakehold": [2, 14], "nation": [2, 3, 4, 5, 6, 11, 12, 16], "intern": [2, 9, 10, 11], "commun": [2, 4, 6, 7, 9, 10, 11], "member": [2, 4, 5, 6, 9, 10, 11, 12, 14], "onli": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 16], "encourag": 2, "also": [2, 3, 5, 6, 9, 10, 11, 12, 14, 15, 16], "heartili": 2, "welcom": 2, "refin": 2, "technic": [2, 3, 4, 6, 7, 9, 10, 11, 14], "rule": [2, 3, 4, 5, 14], "sever": [2, 9, 10, 14], "method": [2, 6, 7, 9, 10, 11, 15, 16], "avail": [2, 9, 10, 14, 15, 16], "github": 2, "issu": [2, 3, 5, 6, 9, 10, 11, 12, 14, 15, 16], "By": [2, 5, 16], "you": [2, 3], "can": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 16], "seek": 2, "clarif": 2, "propos": 2, "enhanc": [2, 4, 9, 10, 12, 14], "report": [2, 11, 14], "editori": 2, "typo": 2, "If": [2, 5, 6, 7, 9, 10, 11, 14, 15], "work": 2, "we": [2, 5], "draft": [2, 5, 6, 11, 13, 14], "pull": 2, "request": [2, 4, 12, 14, 16], "link": [2, 6, 9, 10, 11], "repres": [2, 5, 6, 7, 9, 10, 14, 16], "activ": [2, 7, 9, 11, 12, 14, 16], "typic": [2, 6, 12], "alwai": [2, 3, 12, 14], "base": [2, 5, 6, 7, 9, 10, 11, 12, 13, 14], "discuss": [2, 6], "onc": [2, 6, 9, 10, 16], "facilit": [2, 14], "review": [2, 16], "chang": [2, 5, 9, 10, 11, 14], "befor": [2, 3, 6, 14, 15], "thei": [2, 3, 9, 10, 11, 12, 14, 15], "merg": 2, "main": [2, 5, 6, 11, 12, 14], "branch": 2, "version": [2, 5, 7, 9, 16], "corrent": 2, "italia": 2, "slack": 2, "channel": [2, 7, 9, 11], "messag": [2, 6, 7, 9, 10, 11, 15], "applic": [2, 3, 6, 9, 10, 11, 12, 13, 14, 15, 16], "design": [2, 4, 12, 14, 16], "busi": 2, "connect": [2, 5, 6, 7, 9, 11, 13, 16], "peopl": [2, 12], "inform": [2, 3, 5, 7, 9, 10, 11, 12, 14, 15, 16], "need": [2, 6, 9, 10, 11, 12, 14, 15, 16], "from": [2, 5, 6, 7, 9, 10, 11, 14, 15, 16], "public": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "administr": [2, 5, 11, 12, 14], "technician": 2, "student": 2, "citizen": [2, 3, 5, 12], "ha": [2, 4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "everyon": 2, "join": 2, "free": 2, "http": [2, 4, 5, 7, 13, 14, 15, 16], "where": [2, 5, 6, 9, 10, 11, 12, 14, 15], "learn": 2, "about": [2, 4, 9, 10, 11, 12, 15, 16], "partak": 2, "would": [2, 6, 12], "like": [2, 3, 14], "thank": [2, 14], "individu": [2, 12, 14], "comment": 2, "concern": [2, 4, 14], "idea": 2, "some": [2, 5, 6, 9, 10, 11, 14], "which": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "substanti": [2, 3], "implement": [2, 3, 5, 6, 7, 9, 10, 11, 14], "profil": [2, 3, 5, 6, 7, 9, 11, 13, 14], "set": [2, 4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "alen": 2, "horvat": 2, "amir": 2, "sharif": 2, "andrea": 2, "prosseda": 2, "emanuel": 2, "de": 2, "cupi": 2, "emiliano": 2, "vernini": 2, "francesco": 2, "grauso": 2, "marino": 2, "ventola": 2, "giada": 2, "sciarretta": 2, "giusepp": 2, "marco": 2, "klaa": 2, "wierenga": 2, "kristina": 2, "yasuda": [2, 13], "leif": 2, "johansson": 2, "lorenzo": 2, "cerini": 2, "marta": 2, "sciunnach": 2, "michel": 2, "silletti": 2, "nicola": 2, "saitto": 2, "niel": 2, "van": 2, "dijk": 2, "oliv": 2, "terbu": [2, 5, 13], "paul": 2, "bastien": 2, "pasqual": 2, "rose": 2, "peter": 2, "altmann": 2, "riccardo": 2, "iaconelli": 2, "roland": 2, "hedberg": 2, "salvator": 2, "laiso": 2, "manfredi": 2, "stefano": 2, "alifuoco": 2, "takahiko": 2, "kawasaki": 2, "torsten": 2, "lodderstedt": [2, 13], "vladimir": 2, "duzhinov": 2, "anyon": 2, "been": [2, 6, 11], "forgotten": 2, "pleas": [2, 4, 14, 16], "accept": [2, 6, 7, 9, 10, 11], "our": 2, "apolog": 2, "modif": [2, 14], "page": [2, 9, 10, 16], "via": [2, 6, 7, 9, 14], "com": [2, 9, 10], "eudi": [2, 6, 7, 9, 10, 13, 16], "doc": [2, 6], "brief": 2, "offer": [2, 6, 9, 10, 15, 16], "dure": [2, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "event": 2, "period": [2, 9, 10, 11, 14, 15], "have": [2, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "opportun": 2, "again": [2, 9, 10], "make": [2, 5, 6, 14], "amend": 2, "soon": 2, "possibl": [2, 5, 7, 9, 10, 14], "word": [3, 13], "requir": [3, 4, 5, 6, 7, 9, 10, 13], "shall": [3, 5, 6, 7, 9, 11], "should": [3, 5, 6, 7, 9, 10, 11, 14, 15], "mai": [3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "option": [3, 5, 7, 9, 10, 12], "interpret": 3, "describ": [3, 5, 6, 7, 9, 10, 11, 14, 15], "bcp": [3, 13], "14": [3, 6, 9, 10, 13, 14, 15], "rfc2119": 3, "rfc8174": [3, 13], "when": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "appear": 3, "capit": 3, "shown": [3, 6, 9, 10], "here": [3, 16], "user": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "trust": [3, 4, 5, 6, 9, 10, 12, 15, 16], "servic": [3, 4, 5, 6, 11, 12, 14, 15, 16], "model": [3, 4, 6, 7, 9, 10, 12, 16], "framework": [3, 4, 6, 9, 10, 13, 14, 16], "attribut": [3, 4, 5, 7, 9, 10, 11, 14, 16], "electron": [3, 4, 14, 16], "attest": [3, 4, 5, 6, 9, 10, 12], "provid": [3, 4, 5, 6, 7, 9, 10, 11, 12, 14, 15], "tsp": [3, 14], "person": [3, 5, 6, 9, 10, 11, 12, 14, 16], "identif": [3, 4, 5, 6, 9, 10, 11, 12, 14, 16], "data": [3, 4, 6, 7, 9, 10, 11, 12, 13, 14, 16], "pid": [3, 4, 9, 10, 11, 14, 16], "revoc": [3, 4, 6, 9, 10, 13, 14, 16], "qualifi": [3, 14, 16], "qtsp": [3, 14], "eaa": [3, 4, 9, 14, 16], "eida": [3, 4, 5, 6, 7, 9, 12, 13, 14], "arf": [3, 4, 5, 6, 13, 14], "definit": [3, 9, 10, 11, 12, 13, 14, 16], "further": [3, 4, 6, 7, 9, 11, 14, 16], "insight": 3, "topic": 3, "complement": [3, 14], "interact": [3, 6, 9, 10, 12, 14, 15, 16], "compon": [3, 4, 6, 7, 9, 10, 14], "accredit": [3, 14, 15], "bodi": [3, 6, 9, 10, 11, 14], "entiti": [3, 4, 11, 16], "feder": [3, 4, 6, 9, 10, 13, 15, 16], "author": [3, 4, 5, 11, 12, 13, 14, 15, 16], "respons": [3, 4, 13, 14, 15, 16], "manag": [3, 6, 11, 12, 14, 16], "verif": [3, 6, 7, 9, 11, 12, 14, 15, 16], "certif": [3, 5, 11, 12, 14, 15], "ecosystem": [3, 4, 12, 14, 16], "role": [3, 4, 11, 12, 16], "ident": [3, 4, 6, 9, 10, 11, 14, 16], "recogn": [3, 12], "state": [3, 4, 6, 9, 10, 12, 14, 15], "identifi": [3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "issuanc": [3, 4, 5, 9, 10, 11, 13, 14, 15, 16], "master": 3, "alreadi": [3, 6], "present": [3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16], "italian": [3, 5, 6, 14], "system": [3, 6, 12, 14, 16], "credenti": [3, 4, 5, 7, 9, 10, 12, 13, 14, 15, 16], "sign": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "whose": [3, 9, 10, 15], "integr": [3, 5, 6, 12, 14, 15, 16], "cryptograph": [3, 4, 5, 6, 9, 10, 11, 12, 14, 16], "verifi": [3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16], "its": [3, 6, 7, 9, 10, 11, 14, 15, 16], "issuer": [3, 4, 5, 7, 9, 10, 11, 12, 14], "It": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "known": [3, 4, 6, 7, 9, 10, 14, 16], "A": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "govern": [3, 12, 14], "guidelin": [3, 4], "administ": 3, "directli": [3, 6, 9, 10], "through": [3, 5, 6, 7, 9, 10, 11, 14], "intermediari": [3, 9, 10, 14], "statu": [3, 4, 5, 6, 7, 14, 16], "elig": [3, 4], "evalu": [3, 4, 6, 9, 10, 15, 16], "perform": [3, 6, 7, 9, 10, 15, 16], "oversight": 3, "instanc": [3, 4, 5, 6, 7, 9, 10, 14, 15], "solut": [3, 4, 6, 10, 14], "instal": [3, 6, 15, 16], "mobil": [3, 4, 6, 7, 9, 10, 12, 15, 16], "devic": [3, 4, 6, 11, 12, 14, 15, 16], "control": [3, 5, 6, 12, 14, 16], "specif": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "who": [3, 6, 11, 12, 14], "sole": 3, "owner": [3, 5, 12, 14], "fulli": 3, "autonom": [3, 14], "privat": [3, 5, 6, 7, 9, 10, 11, 14, 15], "conform": [3, 6], "prove": [3, 5, 12, 14], "compliac": 3, "relat": [3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "revok": [3, 6, 11, 12, 14], "manufactur": 3, "allow": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "certifi": [3, 6, 14, 16], "app": [3, 6, 7, 9, 15, 16], "qeaa": [3, 16], "form": [3, 5, 6, 9, 10, 11, 12, 14, 15, 16], "s": [3, 4, 5, 7, 9, 10, 11, 12, 13, 14, 15, 16], "possess": [3, 4, 5, 6, 9, 10, 12, 13, 14, 16], "reli": [3, 4, 5, 6, 11, 12, 16], "natur": [3, 5, 6, 11, 16], "legal": [3, 11, 12, 14, 16], "submiss": [3, 9, 10], "mechan": [3, 4, 5, 9, 10, 11, 16], "see": [3, 5, 6, 7, 9, 11, 14, 15], "complianc": [3, 5, 6, 9, 10, 14, 16], "regulatori": [3, 14], "cannot": [3, 9, 10, 11, 14], "repudi": [3, 4, 11], "over": [3, 5, 7, 9, 11, 12, 14, 16], "time": [3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "particular": [3, 6, 11, 14], "layer": [3, 13], "architectur": [3, 4, 6, 13, 14, 16], "establish": [3, 6, 7, 9, 10, 12, 14, 16], "reliabl": [3, 5, 11, 14, 15, 16], "how": [3, 4, 5, 7, 9, 11, 14, 15], "maintain": [3, 9, 10, 12, 14], "outlin": [3, 5, 6, 7, 9, 10, 11, 14, 16], "procedur": [3, 11, 12, 14], "valid": [3, 4, 5, 6, 7, 9, 10, 11, 12, 14, 15], "each": [3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "other": [3, 4, 5, 6, 9, 10, 11, 12, 14, 16], "level": [3, 4, 7, 9, 10, 11, 12, 13, 16], "exchang": [3, 6, 7, 9, 10, 11, 12, 13, 14, 16], "assur": [3, 9, 10, 13, 16], "degre": 3, "confid": [3, 7, 9, 16], "vet": 3, "same": [3, 5, 6, 9, 10, 11, 14, 15], "whom": [3, 12], "wa": [3, 5, 6, 9, 10, 11, 15], "holder": [3, 5, 11, 12, 15], "bind": [3, 6, 9, 10, 14, 15], "abil": [3, 12, 14, 16], "legitim": [3, 5], "part": [3, 6, 7, 9, 10, 14, 15, 16], "third": [3, 11, 14], "oid4vp": [3, 9, 10], "openid": [3, 5, 6, 9, 10, 13, 14, 16], "vc": [3, 5, 6, 9, 10, 13, 14, 15], "vp": [3, 9, 10], "api": [3, 4, 6, 9, 10, 16], "program": 3, "interfac": [3, 6, 11, 14, 16], "loa": [3, 6, 16], "european": [4, 12], "parliament": 4, "adopt": [4, 16], "revis": 4, "regul": [4, 11, 12, 14], "introduc": 4, "signific": [4, 12, 14], "innov": 4, "updat": [4, 5, 9, 10, 11, 14], "mark": [4, 5, 6, 9, 10, 14], "pivot": 4, "advanc": [4, 12, 14], "eu": [4, 5, 9, 10, 14, 15, 16], "strategi": [4, 9, 10, 14], "aim": [4, 5], "interoper": [4, 6, 9, 10, 12, 13, 14], "usabl": [4, 15], "across": [4, 12], "For": [4, 5, 6, 7, 9, 10, 11, 14, 16], "detail": [4, 5, 7, 11, 12, 14, 16], "resourc": [4, 5, 6, 9, 10, 13, 14], "note": [4, 6, 14], "legisl": [4, 16], "offici": 4, "commiss": 4, "websit": [4, 14, 16], "itali": 4, "launch": 4, "direct": 4, "full": [4, 5, 12, 16], "align": [4, 14], "complet": [4, 9, 10, 12, 16], "purpos": [4, 5, 9, 10, 11, 12, 16], "defin": [4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "involv": [4, 6, 9, 10, 11, 12, 14], "accord": [4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "infrastructur": [4, 12], "realiabl": [4, 16], "mdl": [4, 5, 7, 9, 10], "cbor": [4, 6, 7, 9, 10, 11], "format": [4, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "sd": [4, 6, 9, 10, 11, 13, 14, 15], "jwt": [4, 6, 9, 10, 11, 13, 14, 15, 16], "openid4vci": [4, 6, 13, 14], "openid4vp": [4, 6, 9, 10, 13, 14], "pseudonym": 4, "siopv2": [4, 9, 10, 15], "backup": 4, "restor": 4, "self": [4, 5], "sovereign": 4, "ssi": 4, "languag": [4, 14], "convent": 4, "term": [4, 14, 16], "acronym": 4, "properti": [4, 5], "endpoint": [4, 11, 15], "configur": [4, 16], "common": 4, "anchor": [4, 6, 16], "leav": 4, "intermedi": [4, 6, 12, 16], "metadata": [4, 5, 6, 9, 10, 11, 12, 15], "type": [4, 5, 6, 7, 9, 10, 11, 15, 16], "statement": [4, 6, 9, 10, 16], "offlin": [4, 7, 9, 11], "long": [4, 6, 11], "live": 4, "privaci": [4, 6, 9, 10, 11, 12, 15, 16], "remark": 4, "consider": 4, "decentr": 4, "lifecycl": 4, "transit": [4, 14], "return": [4, 5, 6, 7, 9, 10, 11, 14, 15], "deactiv": 4, "header": [4, 5, 6, 9, 10, 11, 14], "payload": [4, 5, 6, 9, 10, 11], "wallet_provid": [4, 14], "federation_ent": [4, 6, 9, 10, 14], "extern": [4, 14], "high": [4, 7, 9, 10, 11, 13, 16], "view": [4, 6, 16], "dynam": [4, 6, 14], "q": [4, 9, 10, 14, 16], "mdoc": [4, 6, 10, 11], "namespac": [4, 7, 9, 10], "object": [4, 6, 7, 11, 13, 14, 15], "flow": [4, 14], "push": [4, 9, 10], "par": 4, "token": [4, 9, 10, 13, 15, 16], "remot": [4, 14], "uri": [4, 6, 13], "post": [4, 6, 11, 14, 15], "cross": [4, 14], "check": [4, 6, 7, 11, 14], "redirect": [4, 6], "error": [4, 6, 11], "proxim": 4, "engag": [4, 16], "session": [4, 6, 10], "termin": [4, 10], "case": [4, 5, 6, 9, 10, 14], "proof": [4, 5, 6, 9, 10, 12, 13, 14, 16], "rst": 4, "librari": 4, "code": [4, 5, 6, 7, 9, 10, 11, 14], "snippet": 4, "algorithm": [4, 5, 6, 9, 10, 11, 13, 14, 15, 16], "contribut": 4, "acknowledg": 4, "law": [5, 11], "scope": [5, 6, 9, 10, 11, 14], "protect": [5, 6, 9, 10, 14], "within": [5, 6, 7, 9, 10, 11, 14, 16], "ones": 5, "current": [5, 6, 9, 10, 11, 13, 14], "first": [5, 6, 9, 10], "date": [5, 6, 11, 13, 14, 15], "birth": [5, 6], "uniqu": [5, 6, 9, 10, 11, 14, 15, 16], "taxpay": 5, "number": [5, 6, 9, 10, 11, 14, 15, 16], "select": [5, 6, 9, 10], "disclosur": [5, 9, 10, 14], "specifi": [5, 6, 7, 9, 10, 15, 16], "02": [5, 7, 9], "_sd_alg": 5, "5": [5, 6, 7, 9, 10, 11, 14, 15], "them": [5, 9, 10, 11, 12, 14, 15, 16], "disclos": [5, 6, 7, 9, 12, 14], "indic": [5, 6, 7, 9, 10, 13, 14], "digest": 5, "salt": [5, 7, 9], "omit": [5, 6], "instead": [5, 12, 14], "respect": [5, 6, 14, 16], "decoi": 5, "arrai": [5, 6, 7, 9, 10, 11, 14, 15, 16], "new": [5, 6, 7, 9, 10, 11, 12, 14, 15], "_sd": [5, 9, 10], "map": [5, 6, 9, 10, 14], "calcul": [5, 6, 7, 9], "random": [5, 6, 7, 9, 10], "sent": [5, 6, 9, 10], "togeth": [5, 6, 7, 9, 11], "combin": [5, 14], "order": [5, 9, 10, 16], "seri": 5, "base64url": [5, 6, 11], "encod": [5, 6, 7, 9, 10, 11, 15], "separ": [5, 6, 9, 10, 15], "next": 5, "singl": [5, 6, 14], "tild": 5, "charact": [5, 6], "n": [5, 6, 9, 10, 13], "more": [5, 6, 7, 9, 10, 11, 14, 16], "jose": [5, 6, 11], "mandatori": [5, 6, 7, 9, 11], "typ": [5, 6, 9, 10, 11, 14, 15, 16], "latest": [5, 14], "rfc7515": [5, 6, 13], "9": [5, 6, 7, 9, 10, 14, 15], "kid": [5, 6, 9, 10, 11, 14, 15, 16], "8": [5, 6, 7, 9, 10, 11, 14, 15], "trust_chain": [5, 9, 10, 14, 15], "json": [5, 6, 9, 10, 11, 13, 14, 15, 16], "oidc": [5, 6, 9, 10, 12, 13, 14], "fed": [5, 9, 10, 13, 14], "whether": [5, 6, 9, 10, 14, 15], "nsd": 5, "iss": [5, 6, 9, 10, 11, 14, 15, 16], "url": [5, 6, 9, 10, 14, 15, 16], "string": [5, 6, 7, 9, 10, 14, 15, 16], "rfc7519": [5, 6, 13, 15], "sub": [5, 6, 7, 9, 10, 14, 15, 16], "thumbprint": [5, 6, 11, 13, 15, 16], "jwk": [5, 6, 9, 10, 11, 13, 14, 15, 16], "cnf": [5, 6, 9, 10, 11, 15], "iat": [5, 6, 9, 10, 11, 14, 15, 16], "unix": [5, 6, 9, 10, 11, 14, 15, 16], "timestamp": [5, 6, 9, 10, 11, 13, 14, 15, 16], "numericd": [5, 6, 14], "7519": [5, 6, 9, 10, 11, 13, 14], "6": [5, 6, 7, 9, 10, 14, 15], "exp": [5, 6, 9, 10, 11, 14, 15, 16], "expiri": [5, 6, 11, 14], "read": 5, "status_attest": [5, 11], "credential_hash_alg": [5, 11], "bound": [5, 6, 11, 14, 15], "oauth": [5, 6, 9, 10, 11, 13, 15, 16], "01": [5, 7, 9, 11], "materi": [5, 6, 7, 9, 11], "confirm": [5, 6], "declar": 5, "recipi": 5, "rfc7800": [5, 11, 13, 15], "vct": 5, "obtain": [5, 6, 7, 9, 10, 11, 14, 15, 16], "personidentificationdata": [5, 6], "depend": [5, 6, 9, 10, 11, 16], "addit": [5, 6, 11, 14], "ad": [5, 6, 9, 10], "given_nam": [5, 6, 7, 9, 10, 14], "core": [5, 6, 14], "0": [5, 6, 7, 9, 10, 13, 14, 15, 16], "family_nam": [5, 6, 7, 9, 10, 14], "birth_dat": [5, 6, 7, 9], "unique_id": [5, 6, 9, 10], "id": [5, 6, 9, 10, 14, 15, 16], "anpr": 5, "given": [5, 6, 9, 10, 11, 14], "regist": [5, 6], "resid": [5, 9, 10, 11], "popul": [5, 9, 10], "tax_id_cod": [5, 6], "tax": [5, 6], "en": [5, 6], "319": 5, "412": 5, "tinit": 5, "italiantaxidentificationnumb": 5, "In": [5, 6, 7, 9, 10, 11, 12, 14, 16], "org": [5, 6, 7, 9, 10, 11, 14, 15, 16], "nzblsxh8udccd7nowxfzafhkxzsrgc9x": 5, "1683000000": 5, "1883000000": 5, "xxxxxxxx": 5, "xxxx": 5, "xxxxxxxxxxxx": 5, "mario": 5, "rossi": 5, "1980": 5, "10": [5, 6, 7, 9, 10, 13, 14, 15], "xxxxxxxxxxxxxxxx": 5, "correspond": [5, 6, 7, 9, 10, 11, 14, 15], "verson": 5, "db67gl7ck3tfiiaf7n6_7shvqk0mdymeqcogglkuaaw": 5, "nehrderpynlhy3m5wldwtwz2auhm": 5, "eyjhbgcioijsuzi1niisimtpzci6": 5, "ikjydmzybg5oqu11sfiwn2fqvw1b": 5, "7wg4nt6k26_r3975zcwnvwgoha7b988_3": 5, "vjzbzf6yc": 5, "noxvzjujg667ibdedwmr6tz46x": 5, "jchkwivxmafv43yc": 5, "tk2rgupyoxzcx0vv5hbn9u5m2mhlwbt41qgwllxcnu8": 5, "uhchpgtnf2bj1fvafbby1rnf7wxkxelfj5a4vsj2fo4": 5, "q6tqnxau97tu": 5, "mqudg0fsamlgzdsumumk6a2s3bcsc0": 5, "wyfxvqq9bospt7tn4shoi4e48p19ava1ktw5zf0": 5, "fc": 5, "pidprovid": 5, "kty": [5, 6, 7, 9, 10, 14, 15, 16], "ec": [5, 6, 7, 9, 10, 14, 15, 16], "crv": [5, 6, 7, 9, 10, 14, 15, 16], "x": [5, 6, 7, 9, 10, 11, 14, 15, 16], "tcaer19zvu3ohf4j4w4vfsvohip1ilildls7vcegemc": 5, "y": [5, 6, 7, 9, 10, 13, 14, 15, 16], "zxjiwwbzmqghvwkvq4hbsiirsvfuecce6t4jt9f2hzq": 5, "wyi1n212ewnuadv5wknys0xanxhuzlv3iiwgimlhdciside2odmwmdawmdbd": 5, "57mvycth5yzcrklz5xnfuw": 5, "wyjrdwnyqm1sb19otwfjrky1odvsemfriiwginvuaxf1zv9pzcisicj4ehh4": 5, "ehh4ec14ehh4lxh4ehgtehh4ec14ehh4ehh4ehh4ehgixq": 5, "kucrbmlo_hmaiff585rzaq": 5, "wyjove5sb09pdvzwunrgnknfenrkovp3iiwgimdpdmvux25hbwuilcaitwfi": 5, "aw8ixq": 5, "ntnrooiuvvrtf6ceztd9zw": 5, "wyjgrfntugdnekdcvxdrteheu0u2d1friiwgimzhbwlsev9uyw1liiwgiljv": 5, "c3npil0": 5, "fdsspggzgbuwqlhdse6wqq": 5, "wyjlwjhlnxdwrxredmixemltuee0rhpbiiwgimjpcnrox2rhdguilcaimtk4": 5, "mc0wms0xmcjd": 5, "kz8e5wvetdvb1zispa4dza": 5, "wyjwwjvnunlpehbwv1p1sexvsi15aljniiwginrhef9pzf9jb2rliiwgilrj": 5, "tklulvhywfhywfhywfhywfhywfgixq": 5, "pz5mryoxpvwzuhloj": 5, "yjrg": 5, "eyjhbgcioiairvmyntyilcaidhlwijogimv4yw1wbgurc2qtand0in0": 5, "eyjfc2qioibb": 5, "ijdxrzruvdzlmjzfujm5nzv6y3duvndnb0hbn2i5odhfmy12snpiwmy2wwmilcaitk94": 5, "vnpqvupnnjy3aujkzur3bxi2dfo0nlgtamnos3djvnhnqwz2ndn5yyisicjuszjsz3vq": 5, "ww9yekn4mhz2nwhitjl1nu0ybuhsv0j0ndfxr1dstfhdtnu4iiwgilviq2hwr3rorjji": 5, "ajfgdkfmqmj5mxjuzjdxwgt4zwxgsjvhnhztajjgtzqilcaictzucw54yxu5n3r1lu1x": 5, "vurnmgztqw1mr1pku3vnvu1rnmeyczniy3ndmcisicj3ewz4vnfxoujvc1bun3ronfni": 5, "t0k0rtq4ude5yvzbmwt0vzvazjbflwzjil0sicjlehaioiaxodgzmdawmdawlcaiaxnz": 5, "ijogimh0dhbzoi8vcglkchjvdmlkzxiuzxhhbxbszs5vcmcilcaic3viijogik56ykxz": 5, "wgg4durdy2q3bm9xwezaqwzia3hac1jhqzlycyisicjzdgf0dxmioib7inn0yxr1c19h": 5, "dhrlc3rhdglvbii6ihsiy3jlzgvudglhbf9oyxnox2fszyi6icjzagetmju2in19lcai": 5, "dmn0ijogilblcnnvbklkzw50awzpy2f0aw9urgf0ysisicjfc2rfywxnijoginnoys0i": 5, "ntyilcaiy25mijogeyjqd2sioib7imt0esi6icjfqyisicjjcnyioiaiuc0yntyilcai": 5, "eci6icjuq0ffuje5wnz1m09irjrqnfc0dmztvm9isvaxsuxpbersczd2q2vhzw1jiiwg": 5, "inkioiaiwnhqavdxylpnuudivldlvle0agjtswlyc1zmdwvjq0u2ddrqvdlgmkhausj9": 5, "fx0": 5, "a36ovweqpcppkyhx75dg": 5, "hiib7zqklfmmcaixlpocmel1cxlx": 5, "ntzbfn_kdn0nlj": 5, "ymlay4xseetmic_scltxdg": 5, "wyi1n212ewnuadv5wknys0xanxhuzlv3iiwgimlhdcisi": 5, "de2odmwmdawmdbd": 5, "wyjrdwnyqm1sb19otwfjrky1odvsemfriiwginvuaxf1zv9pzci": 5, "icj4ehh4ehh4ec14ehh4lxh4ehgtehh4ec14ehh4ehh4ehh4ehgixq": 5, "wyjove5sb09pd": 5, "vzwunrgnknfenrkovp3iiwgimdpdmvux25hbwuilcaitwfyaw8ixq": 5, "wyjgrfntugdnek": 5, "dcvxdrteheu0u2d1friiwgimzhbwlsev9uyw1liiwgiljvc3npil0": 5, "wyjlwjhlnxdwrx": 5, "redmixemltuee0rhpbiiwgimjpcnrox2rhdguilcaimtk4mc0wms0xmcjd": 5, "wyjwwjvnu": 5, "nlpehbwv1p1sexvsi15aljniiwginrhef9pzf9jb2rliiwgilrjtklulvhywfhywfhyw": 5, "fhywfhywfgixq": 5, "disabilitycard": 5, "document_numb": [5, 7, 9], "xxxxxxxxxx": 5, "expiry_d": [5, 7, 9], "2024": [5, 7, 9], "constant_attendance_allow": 5, "true": [5, 6, 7, 9, 10], "previou": [5, 6, 9, 10, 11], "decod": [5, 6, 9, 10, 11, 15], "both": [5, 7, 9, 10, 11, 12, 14, 15, 16], "d126a6a856f7724560484fa9dc59d195": 5, "lla7mch": 5, "ywwynzffwzsjbggie096fn8d60a": 5, "ml3sgo": 5, "afrjarpztmanxyu5iiwpifoaxjcnk": 5, "_h1ejt7mymcgm": 5, "i9xhlephyv8om35l3nf1mkqfpwud7ofpramsasx0": 5, "5g": 5, "rhpkitz7bggpjnwx2sgvh_ov9vhrjz9hx_inxwbbz6o": 5, "wyjrdwnyqm1sb19otwfjrky1odvsemfriiwgimrvy3vtzw50x251bwjlcii": 5, "icjywfhywfhywfhyil0": 5, "wyjwwjvnunlpehbwv1p1sexvsi15aljniiwgimv4cglyev9kyxrliiwgijiw": 5, "mjqtmdetmdeixq": 5, "wyjqdfz1s0nwbjdivgnickfnx3nlvwjriiwginrhef9pzf9jb2rliiwgilrj": 5, "jtvukcpn7btchrag_seubq": 5, "wyjxrgtknkpztmhernzmudrzmwhrzhlbiiwgimnvbnn0yw50x2f0dgvuzgfu": 5, "y2vfywxsb3dhbmnliiwgdhj1zv0": 5, "wdkd6jsnhdfvlp4s1hqdya": 5, "ii1mtee3tunolvlxv1loekzmd1pzskjhr2lfmdk2zk44zdywys1tbdnzz28ilcain1dh": 5, "ng5unksynl9smzk3nxpjd25wd2dvsee3yjk4of8zlxzkemjazjzzyyisicjbrljkyvjq": 5, "wlrnyu54wxu1sulxuglmt0fysknusy1fadflsnq3txlty2dniiwgilrlmljndvbzb1h6": 5, "q3gwdny1agjooxu1ttjtsgxxqnq0mxfhv2xmwenodtgilcaivuhdahbhde5gmmjqmuz2": 5, "qwzcynkxcm5mn1dya3hlbezknwe0dlnqmkzpncisicjpovhitgvqshlwoe9nmzvsm25m": 5, "mu1lcwzwv3ven09gcfjhbvnbc1gwltvniiwginjougtjdho3qkdhcgpuv1gyu0dwsf9p": 5, "vjlwafjqejlief9jtlh3qmj6nm8ilcaid3lmefzxctlcb3nqvdd0tjrtse9jneu0ofax": 5, "owfwqtfrdfc1wmywrs1myyjdlcaizxhwijogmtg4mzawmdawmcwgimlzcyi6icjodhrw": 5, "czovl2lzc3vlci5legftcgxllm9yzyisicjzdwiioiaitnpithnyadh1renjzddub1di": 5, "rlpbzkhrefpzukddovhziiwginn0yxr1cyi6ihsic3rhdhvzx2f0dgvzdgf0aw9uijog": 5, "eyjjcmvkzw50awfsx2hhc2hfywxnijoginnoys0yntyifx0sicj2y3qioiairglzywjp": 5, "bgl0eunhcmqilcaix3nkx2fszyi6icjzagetmju2iiwgimnuzii6ihsiandrijogeyjr": 5, "dhkioiairumilcaiy3j2ijogilatmju2iiwgingioiaivenbrvixovp2dtnpsey0ajrx": 5, "nhzmu1zvselqmulmawxebhm3dknlr2vtyyisicj5ijogilp4amlxv2jatvfhsfzxs1zr": 5, "nghiu0lpcnnwznvly0nfnnq0alq5rjjiwleifx19": 5, "1koe6igfxgbb_jtaluhm_bgjmbi": 5, "j6b63rm_wjaowpobsipskjy7hbhd2a83eusi8jqbskvhjs3wcr0kd9ppzrw": 5, "wyi1n212": 5, "ewnuadv5wknys0xanxhuzlv3iiwgimlhdciside2odmwmdawmdbd": 5, "wyjrdwnyqm1sb19": 5, "otwfjrky1odvsemfriiwgimrvy3vtzw50x251bwjlciisicjywfhywfhywfhyil0": 5, "wyj": 5, "ove5sb09pdvzwunrgnknfenrkovp3iiwgimdpdmvux25hbwuilcaitwfyaw8ixq": 5, "wyjg": 5, "rfntugdnekdcvxdrteheu0u2d1friiwgimzhbwlsev9uyw1liiwgiljvc3npil0": 5, "wyjl": 5, "wjhlnxdwrxredmixemltuee0rhpbiiwgimjpcnrox2rhdguilcaimtk4mc0wms0xmcjd": 5, "wyjwwjvnunlpehbwv1p1sexvsi15aljniiwgimv4cglyev9kyxrliiwgijiwmjqtmd": 5, "tmdeixq": 5, "wyjxrgtknkpztmhernzmudrzmwhrzhlbiiwgi": 5, "mnvbnn0yw50x2f0dgvuzgfuy2vfywxsb3dhbmnliiwgdhj1zv0": 5, "18013": [5, 7, 9, 10], "standard": [5, 9, 10, 14], "born": 5, "drive": 5, "licens": [5, 11], "element": [5, 7, 9, 12], "8949": 5, "concis": 5, "binari": 5, "represent": [5, 14], "europa": [5, 9, 10, 14], "eudiw": [5, 6, 9, 10, 14, 15], "revers": 5, "domain": [5, 11, 14], "util": [5, 7, 9, 10, 16], "consist": [5, 6, 16], "while": [5, 9, 10, 12, 14], "domest": [5, 7, 9], "tstr": [5, 7, 9], "text": [5, 6, 9, 10, 11], "structur": [5, 7, 9, 10, 16], "being": [5, 6, 7, 9, 12, 15], "wai": [5, 6], "track": [5, 11, 15], "backward": 5, "compat": [5, 14, 16], "understand": 5, "evolv": [5, 14], "uint": [5, 7, 9], "unsign": 5, "int": 5, "mean": [5, 6, 11, 14], "ok": [5, 6, 9, 10, 15], "normal": 5, "bstr": [5, 7, 9], "byte": [5, 7, 9], "collect": [5, 9, 10, 14], "doctyp": [5, 6, 7, 9, 10], "issuersign": [5, 7, 9], "tag": 5, "24": [5, 7, 9, 10, 11, 14], "major": 5, "howev": [5, 6, 9, 10], "issuerauth": [5, 7, 9], "mso": [5, 11], "cose": 5, "sign1": 5, "abov": [5, 6, 7, 9, 12, 14], "devicesign": [5, 7, 9], "phase": [5, 6, 7, 9, 11, 12, 14, 15], "deviceauth": [5, 7, 9], "either": [5, 6, 9, 10], "devicesignatur": [5, 7, 9], "devicemac": 5, "two": [5, 6, 7, 9, 10, 11], "empti": [5, 7, 9], "latter": [5, 6, 11], "issuersigneditembyt": [5, 7, 9], "bitsr": 5, "diagnost": [5, 7, 9], "digestid": [5, 7, 9], "integ": [5, 6], "valuedigest": [5, 7, 9], "differ": [5, 6, 7, 9, 10, 11, 12, 14, 15], "issuersigneditem": [5, 7, 9], "minimum": [5, 6, 7, 9, 10, 11], "16": [5, 6, 7, 9, 10, 14], "elementidentifi": [5, 7, 9], "elementvalu": [5, 7, 9], "issue_d": [5, 7, 9], "cbortag": 5, "1004": [5, 7, 9], "expir": [5, 6, 9, 10, 11, 14, 15, 16], "issuing_author": [5, 7, 9], "issuing_countri": [5, 7, 9], "alpha": 5, "countri": 5, "3166": 5, "field": [5, 6, 7, 9, 10, 11, 12, 13], "9052": 5, "unprotect": 5, "7": [5, 6, 7, 9, 10, 11, 14, 15], "rfc8152": 5, "x5chain": 5, "label": [5, 9, 10], "33": [5, 7, 9], "9360": 5, "carri": [5, 6, 9, 10, 12, 14], "referenc": [5, 6, 9, 10], "509": [5, 14, 15], "abl": [5, 6, 11, 14, 15], "without": [5, 6, 11, 12, 14, 15], "invalid": [5, 6, 7, 9, 10, 11, 14, 15], "mobilesecurityobject": 5, "mobilesecurityobjectbyt": 5, "validityinfo": [5, 7, 9], "datetim": [5, 11, 16], "validfrom": [5, 7, 9], "validuntil": [5, 7, 9], "digestalgorithm": [5, 7, 9], "group": 5, "devicekeyinfo": [5, 7, 9], "devicekei": [5, 7, 9], "keyauthor": 5, "keyinfo": 5, "store": [5, 6, 7, 9, 11, 12, 14, 16], "devicesigneditem": 5, "af": 5, "a366737461747573006776657273696f6e63312e3069646f63756d656e747381a267646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316c6973737565725369676e6564a26a697373756572417574688443a10126a1182159021930820215308201bca003020102021404ad06a30c1a6dc6e93be0e2e8f78dcafa7907c2300a06082a8648ce3d040302305b310b3009060355040613025a45312e302c060355040a0c25465053204d6f62696c69747920616e64205472616e73706f7274206f66205a65746f706961311c301a06035504030c1349414341205a65746573436f6e666964656e73301e170d3231303932393033333034355a170d3232313130333033333034345a3050311a301806035504030c114453205a65746573436f6e666964656e7331253023060355040a0c1c5a65746f70696120436974792044657074206f662054726166666963310b3009060355040613025a453059301306072a8648ce3d020106082a8648ce3d030107034200047c5545e9a0b15f4ff3ce5015121e8ad3257c28d541c1cd0d604fc9d1e352ccc38adef5f7902d44b7a6fc1f99f06eedf7b0018fd9da716aec2f1ffac173356c7da3693067301f0603551d23041830168014bba2a53201700d3c97542ef42889556d15b7ac4630150603551d250101ff040b3009060728818c5d050102301d0603551d0e04160414ce5fd758a8e88563e625cf056bfe9f692f4296fd300e0603551d0f0101ff040403020780300a06082a8648ce3d0403020347003044022012b06a3813ffec5679f3b8cddb51eaa4b95b0cbb1786b09405e2000e9c46618c02202c1f778ad252285ed05d9b55469f1cb78d773671f30fe7ab815371942328317c59032ad818590325a667646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316776657273696f6e63312e306c76616c6964697479496e666fa3667369676e6564c074323032332d30322d32325430363a32333a35365a6976616c696446726f6dc074323032332d30322d32325430363a32333a35365a6a76616c6964556e74696cc074323032342d30322d32325430303a30303a30305a6c76616c756544696765737473a2781865752e6575726f70612e65632e65756469772e7069642e31ac015820a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a025820cd372fb85148700fa88095e3492d3f9f5beb43e555e5ff26d95f5a6adc36f8e6035820e67e72111b363d80c8124d28193926000980e1211c7986cacbd26aacc5528d48045820f7d062d662826ed95869851db06bb539b402047baee53a00e0aa35bfbe98265d0658202a132dbfe4784627b86aa3807cd19cfeff487aab3dd7a60d0ab119a72e736936075820bdca9e8dbca354e824e67bfe1533fa4a238b9ea832f23fb4271ebeb3a5a8f7200858202c0eaec2f05b6c7fe7982683e3773b5d8d7a01e33d04dfcb162add8bd99bee9a095820bfe220d85657ccec3c67e7db1df747e9148a152334bb6d4b65b273279bcc36ec0a582018e38144f5044301d6a0b4ec9d5f98d4cd950e6ea2c29b849cbd457da29b6ad30b58203c71d2f0efa09d9e3fbbdffd29204f6b292c9f79570aef72dd86c91f7a3aa5c50c582065743d58d89d45e52044758f546034fd13a4f994bc270cdfa7844f74eb3f4b6e0d5820b4a8eb5d523bffa17b41bda12ddc7da32ae1e5f7ff3dcc394a35401f16919bbf781b65752e6575726f70612e65632e65756469772e7069642e69742e31a10e58209d6c11644651126c94acdaf0803e86d4c71d15d3b2712a14295416734efd514d6d6465766963654b6579496e666fa1696465766963654b6579a401022001215820ba01aea44eee1e338eb2f04e279dbd51b34655783ee185150838c9a7a7c4db7122582025ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96f646967657374416c676f726974686d675348412d32353658400813c28fd62f2602cbc14724e5865733c44a0fca589b55c085ec9d5c725d6cce25ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96a6e616d65537061636573a2781865752e6575726f70612e65632e65756469772e7069642e3188d818586da4686469676573744944016672616e646f6d5820156df9227ad341eaa61aabd301106fd21bdc18820e01dfc16bcf5fecc447111b71656c656d656e744964656e7469666965726b6578706972795f646174656c656c656d656e7456616c7565d903ec6a323032342d30322d3232d818586fa4686469676573744944026672616e646f6d5820a3a1f13f05544d03a5b50b5fdb78465808393bcf3b7953a345fe28f820c7be0d71656c656d656e744964656e7469666965726d69737375616e63655f646174656c656c656d656e7456616c7565d903ec6a323032332d30322d3232d8185866a4686469676573744944036672616e646f6d5820852591f90f2c9ded57a03632e2c1322ab52a082a431e71a4149a6830c8f1ad0c71656c656d656e744964656e7469666965726f69737375696e675f636f756e7472796c656c656d656e7456616c7565624954d818587ca4686469676573744944046672616e646f6d5820d1d587b3512acce15c4f6b20944ceb002a464e4a158389788563408873c3fce571656c656d656e744964656e7469666965727169737375696e675f617574686f726974796c656c656d656e7456616c7565764d696e69737465726f2064656c6c27496e7465726e6fd8185864a4686469676573744944056672616e646f6d582094fdd7609c0e73dc8589b5cab11e1d9058cf8bff8a336da5f81fcba055396a0f71656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c7565654d6172696fd8185865a4686469676573744944066672616e646f6d5820660c0a7bf79e0e0261ca1547a4294fb808aa70738f424b13ab1b9440b566ae1371656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756565526f737369d818586ba4686469676573744944076672616e646f6d5820315c53491286488fa07f5c2ce67135ef5c9959c3469c99a14e9b6dc924f9eba571656c656d656e744964656e746966696572696269727468646174656c656c656d656e7456616c7565d903ec6a313935362d30312d3132d818587da4686469676573744944086672616e646f6d5820764ef39c9d01f3aa6a87f441603cfe853fba3cee3bc2c168bcc9e96271d6e06371656c656d656e744964656e74696669657269756e697175655f69646c656c656d656e7456616c7565781e78787878787878782d7878782d787878782d787878787878787878787878781b65752e6575726f70612e65632e65756469772e7069642e69742e3181d8185877a46864696765737449440d6672616e646f6d5820717df3f583b1484366c33a1f869f2b5d201d466a8b589c79ab1a2d85e595432571656c656d656e744964656e7469666965726d7461785f69645f6e756d6265726c656c656d656e7456616c75657554494e49542d585858585858585858585858585858": 5, "notat": [5, 7, 9, 13], "h": [5, 7, 9, 13], "30820215308201bca003020102021404ad30c": 5, "x_509": 5, "2023": [5, 7, 9, 13], "22t06": 5, "23": [5, 7, 9, 10, 14], "56z": 5, "22t00": 5, "00": 5, "00z": 5, "0f1571a97ffb799cc8fcdf2ba4fc2909929": 5, "0cdfe077400432c055a2b69596c90": 5, "e2382149255ae8e955af9b8984395": 5, "bbc77e6cca981a3ad0c3e544edf86": 5, "bb6e6c68d1b4b4ec5a2ae9206f5t4": 5, "f8a5966e6dac9970e0334d8f75e25": 5, "defdf1aa746718016ef1b94bfe5r6": 5, "f9ee4d36f67dbd75e23311ac1c29": 5, "ec2": [5, 7, 9], "elipt": 5, "coordin": [5, 7, 9], "pair": [5, 6, 7, 9, 15], "p256": [5, 7, 9], "b820963964e53af064686dd9218303494a": 5, "coordiant": 5, "0a6da0af437e2943f1836f31c678d89298e9": 5, "ccordiant": 5, "1ad0d6a7313efdc38fcd765852fa2bd43debf48bf5a580d": 5, "e0b70bcefbd43686f345c9ed429343aa": 5, "22": [5, 7, 9, 10], "ae84834f389ee69888665b90a3e4fcc": 5, "960cb15a2ea9b68e5233ce902807aa95": 5, "9d3774bd5994ccfed248674b32a4f76a": 5, "ministero": [5, 6], "dell": [5, 6], "interno": [5, 6], "eb12193dc66c6174530cdc29b274381f": 5, "db143143538f3c8d41dc024f9cb25c9d": 5, "6059ff1ce27b4997b4ade1de7b01dc60": 5, "1956": [5, 7, 9], "12": [5, 6, 7, 9, 10, 14], "53c15c57b3b076e788795829190220b4": 5, "xxx": 5, "11aa7273a2d2daa973f5951f0c34c2fba": 5, "tax_id_numb": 5, "xxxxxxxxxxxxxxx": 5, "relev": [6, 7, 9, 12, 14, 15], "releas": [6, 9, 10, 12], "genuin": 6, "entir": [6, 9, 10, 14, 16], "product": [6, 16], "own": [6, 7, 9, 11, 12, 14, 15, 16], "compliant": [6, 7, 9, 10], "assess": [6, 14], "cab": 6, "graphic": 6, "compos": [6, 9, 10], "oidc4vci": [6, 11], "13": [6, 7, 9, 10, 11, 14, 15], "net": 6, "spec": [6, 14], "1_0": 6, "html": 6, "_": 6, "eid": [6, 16], "saml2": [6, 12], "preexist": 6, "eg": [6, 9, 10, 14], "spid": [6, 9, 10, 14], "cie": 6, "notifi": [6, 9, 10, 11, 14, 16], "act": [6, 9, 10, 14], "send": [6, 7, 9, 10, 11, 15], "get": [6, 9, 10, 14, 15, 16], "fig": 6, "show": [6, 9, 10, 11], "highlight": 6, "step": [6, 7, 9, 10, 11, 16], "pictur": [6, 9, 10], "setup": [6, 7, 9], "start": [6, 11, 14, 15], "preliminari": 6, "out": [6, 7, 9, 11, 14], "assert": [6, 14, 16], "share": [6, 14], "discoveri": [6, 9, 10, 14], "discov": 6, "e": [6, 7, 9, 11, 12, 14, 16], "g": [6, 11, 12, 13, 14, 16], "subordin": [6, 9, 10, 14], "inspect": 6, "filter": [6, 9, 10], "ani": [6, 7, 9, 10, 11, 12, 14], "proxi": [6, 9, 10], "held": 6, "expand": 6, "assumpt": 6, "most": 6, "look": 6, "capabl": [6, 9, 10, 14, 16], "9126": [6, 11], "pkce": 6, "7636": 6, "receiv": [6, 7, 9, 10, 14, 15], "protocol": [6, 7, 9, 10, 11, 13, 14], "well": [6, 9, 10, 11, 14, 16], "creat": [6, 7, 9, 10, 11, 15], "fresh": [6, 9, 10, 14], "previous": [6, 9, 10, 14], "hereaft": 6, "prevent": [6, 9, 10, 15, 16], "swap": 6, "attack": 6, "code_verifi": 6, "enough": 6, "entropi": [6, 9, 10], "unreserv": 6, "43": 6, "maximum": [6, 14], "impract": 6, "guess": 6, "client_assert": 6, "client": [6, 7, 9, 10, 14, 16], "sinc": [6, 9, 10, 12, 14, 16], "less": [6, 7, 9, 14], "than": [6, 7, 9, 11, 14], "precis": 6, "second": [6, 7, 9, 10], "authorization_detail": 6, "rar": 6, "9396": 6, "upon": [6, 9, 10, 14], "receipt": 6, "9101": [6, 9, 10], "retriev": [6, 7, 9, 10, 15, 16], "jw": [6, 9, 10, 13, 14, 15, 16], "client_id": [6, 9, 10], "match": [6, 9, 10, 11], "aud": [6, 9, 10, 11, 15], "equal": [6, 9, 10, 14], "reject": [6, 9, 10, 11], "request_uri": [6, 9, 10], "expos": [6, 9, 10, 14], "far": [6, 11], "minut": 6, "jti": [6, 9, 10, 11, 15], "mitig": 6, "replai": 6, "host": [6, 9, 10, 11, 15], "www": [6, 9, 10, 11, 15], "urlencod": [6, 9, 10, 11, 15], "response_typ": [6, 9, 10, 15], "thumprint": 6, "code_challeng": 6, "e9melhoa2owvfremtjguchaoek1t8urwbugjsstw": 6, "cm": 6, "code_challenge_method": 6, "s256": [6, 11], "client_assertion_typ": 6, "urn": [6, 15, 16], "ietf": [6, 15, 16], "param": [6, 15, 16], "wia": 6, "pop": [6, 11], "appli": [6, 9, 10, 14], "vbexjksm45xphtanncig6mcyuu4jfgnzopgukvogg9c": [6, 9, 10, 15], "ad25868c": 6, "8377": 6, "479b": 6, "8094": 6, "46fb1e797625": 6, "1686645115": [6, 15], "1686652315": [6, 15], "fifyx03bnosd8m6gyqifnhnp9cm_sam9tc5nlloiirc": [6, 14], "1672422065": [6, 9, 10], "1672418465": [6, 9, 10], "ac80df576e7109686717bf50b869e882": 6, "fyziol9lf2cekunt2jzxilrdink0upcd": 6, "openid_credenti": 6, "credential_configuration_id": 6, "redirect_uri": [6, 9, 10], "suffici": [6, 9, 10], "larg": 6, "adequ": 6, "risk": [6, 12], "exce": 6, "ascii": 6, "due": [6, 9, 10, 11], "reason": [6, 11], "mani": 6, "phone": [6, 12], "market": 6, "still": [6, 14], "do": [6, 14, 15], "restrict": [6, 9, 10, 12, 14], "1024": 6, "On": 6, "slow": 6, "2g": 6, "caus": 6, "therefor": [6, 9, 10, 11, 12], "advis": [6, 9, 10], "experi": [6, 9, 10, 12, 16], "point": [6, 7, 9, 10, 15], "201": [6, 9, 10, 11, 15], "cach": 6, "bwc4jk": 6, "esc0w8acc191": 6, "y1ltc2": 6, "expires_in": 6, "60": 6, "treat": 6, "duplic": 6, "reload": 6, "refresh": 6, "agent": [6, 9, 10], "result": [6, 7, 9, 10, 11, 14], "submit": 6, "pass": [6, 7, 9], "3aietf": [6, 15], "3aparam": [6, 15], "3aoauth": [6, 15], "3arequest_uri": 6, "3abwc4jk": 6, "consent": [6, 7, 9, 10, 14], "perspect": [6, 9, 10, 14], "prior": 6, "transact": [6, 9, 10, 14, 16], "11": [6, 7, 9, 10, 14], "6749": [6, 11, 13], "intend": [6, 7, 9, 10, 14], "9027": 6, "univers": 6, "local": [6, 11, 14], "so": [6, 7, 9, 11], "resolv": [6, 14], "302": [6, 9, 10], "found": [6, 9, 10, 11], "locat": [6, 7, 9, 10], "splxlobezqqybys6wxsbia": 6, "3a": [6, 9, 10], "2f": [6, 9, 10], "2fpid": 6, "dpop": [6, 13], "instruct": 6, "9449": [6, 13], "certain": [6, 7, 9, 10], "misus": [6, 9, 10], "leak": 6, "stolen": 6, "repli": 6, "tokenrequest": 6, "eyj0exaioijkcg9wk2p3dcisimfszyi6ikvtmju2iiwiandrijp7imt0esi6ik": 6, "vdiiwieci6imw4dezyahgtmzr0vjnoukldukrzoxpda0rscejorjqyvvfvzldwqvdcr": 6, "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r1j": 6, "qsisimnydii6ilatmju2in19": 6, "eyjqdgkioiitqnddm0vtyzzhy2mybfrjiiwiahrtij": 6, "oiue9tvcisimh0dsi6imh0dhbzoi8vc2vydmvylmv4yw1wbguuy29tl3rva2vuiiwia": 6, "wf0ijoxntyymjyynje2fq": 6, "gxa6t8lp4vfrg8v": 6, "fdwp0a0zdrj8igimlvqrmuvwnqg": 6, "4ptflbdlxiossx0x7nvi": 6, "fnyjk70nfbv37xrzt3lg": 6, "grant_typ": [6, 15], "authorization_cod": 6, "dbjftjez4cvp": 6, "mb92k27uhbuju1p1r_ww1gfwfoejxk": 6, "cb": [6, 9, 10], "15": [6, 9, 10, 14, 15], "success": [6, 9, 10, 11, 14], "c_nonc": 6, "unpredict": 6, "later": [6, 9, 10], "18": [6, 9, 10, 14], "primari": [6, 7, 9, 16], "countermeasur": 6, "against": [6, 14], "200": [6, 9, 10], "access_token": 6, "kz": 6, "8mxk1ealyznwh": 6, "lc": 6, "1fbao": 6, "4ljp": 6, "zspe_neo": 6, "gxu": 6, "token_typ": 6, "2677": 6, "tzign": 6, "snfbp": 6, "c_nonce_expires_in": 6, "86400": 6, "17": [6, 9, 10, 14], "demonstr": [6, 7, 9, 13, 14], "evid": [6, 7, 9, 11], "To": [6, 9, 10, 11, 15, 16], "conduct": 6, "explicitli": 6, "server": [6, 7, 9, 10, 11, 15], "nonc": [6, 9, 10, 15], "furthermor": [6, 11, 14, 16], "creation": [6, 9, 10, 11, 14], "window": 6, "determin": [6, 9, 10, 12, 14, 16], "schema": [6, 14], "registr": [6, 14], "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r": 6, "1jeqsisimnydii6ilatmju2in19": 6, "eyjqdgkioijlmwozvl9is2ljoc1mquvciiwiahrtij": 6, "oir0vuiiwiahr1ijoiahr0chm6ly9yzxnvdxjjzs5legftcgxllm9yzy9wcm90zwn0z": 6, "wryzxnvdxjjzsisimlhdci6mtu2mji2mjyxocwiyxroijoizlvieu8ycjjam0rantnf": 6, "c05yv0jimhhxwg9htnk1oulps0nbcwtzbvffbyj9": 6, "2ow9rp35yrqzhrtnp86l": 6, "ey71": 6, "optxrimpptoa1plemagr6pxhf8y6": 6, "yqyvnmcw6fy1dqd": 6, "jfxsyomxhajplja": 6, "credential_definit": 6, "proof_typ": 6, "eyjrawqioijkawq6zxhhbxbsztplym": 6, "l8tfrhx": 6, "34tv3hricrdy9zckdlpbhf42uqufwvawbf": 6, "9ve4jf_ok_o64zbttlcunjajhmt6v9tdvru0cdvgrda": 6, "And": 6, "0b434530": [6, 11], "e151": [6, 11], "4c40": [6, 11], "98b7": [6, 11], "74c75a5ef760": [6, 11], "1504699136": [6, 9, 10, 11], "19": [6, 9, 10, 13, 14], "21": [6, 9, 10, 14], "suitabl": 6, "succe": 6, "proceed": 6, "storag": [6, 11, 14], "proce": 6, "pragma": 6, "lupixvcwjk0eot4cxqe1nxk": 6, "wzwmhmn9oqp6yxx0a2l": 6, "fgff7": 6, "ukhla": 6, "insid": [6, 11], "challeng": 6, "per": [6, 11], "iana": [6, 11], "web": [6, 9, 10, 11, 13, 14, 15, 16], "registri": [6, 9, 10, 11, 12, 14, 16], "symmetr": [6, 9, 10, 11], "mac": [6, 9, 10, 11], "7638": [6, 11, 13], "section_3": [6, 11], "assum": [6, 14], "implicit": 6, "side": [6, 9, 10], "end": [6, 7, 9, 10, 14], "alphanumer": 6, "32": [6, 9, 10], "authrequest": 6, "credential_configurations_support": 6, "reus": 6, "alon": 6, "collis": 6, "resist": 6, "under": [6, 9, 10, 11, 12, 14, 16], "uuid": [6, 7, 9, 11], "v4": [6, 11], "4122": [6, 11], "top": 6, "media": [6, 9, 10, 14, 15, 16], "8259": 6, "strong": [6, 16], "pseudorandom": 6, "lifetim": 6, "posit": 6, "occur": [6, 7, 9, 10, 11], "error_descript": [6, 9, 10, 11], "human": [6, 11], "readabl": [6, 9, 10, 11], "clarifi": [6, 9, 10, 11], "encount": [6, 9, 10, 11], "400": [6, 9, 10, 11], "bad": [6, 9, 10, 11], "invalid_request": [6, 9, 10, 11], "grant": [6, 9, 10, 12, 15, 16], "browser": 6, "serial": 6, "queri": 6, "invalid_dpop_proof": 6, "least": [6, 7, 9, 10, 16], "7515": [6, 11, 13], "8725": [6, 13], "chosen": [6, 9, 10, 16], "7517": [6, 9, 10, 11, 13, 14, 16], "htm": 6, "attach": [6, 14], "9110": 6, "htu": 6, "target": [6, 9, 10], "fragment": [6, 9, 10], "successfulli": [6, 9, 10, 11], "claimset": 6, "simplifi": 6, "even": [6, 9, 10, 11, 12, 14], "charset": [6, 9, 10, 11], "utf": [6, 9, 10, 11], "invalid_cli": 6, "fail": [6, 9, 10, 14], "accomplish": [6, 16], "methodolog": 6, "9068": 6, "subject": [6, 9, 10, 14, 16], "subjectidtyp": 6, "uuid4": 6, "rp": [6, 9, 10, 14], "jkt": 6, "ath": 6, "denot": 6, "mso_mdoc": [6, 9, 10], "renew": [6, 14], "invalid_proof": 6, "oauth_authorization_serv": 6, "openid_credential_issu": [6, 14], "openid_relying_parti": [6, 14], "fanfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 6, "1649610249": 6, "1649437449": 6, "sig": 6, "1ta": 6, "se": 6, "aqab": [6, 9, 10], "authority_hint": [6, 9, 10, 14, 16], "superior": [6, 14, 16], "organization_nam": [6, 7, 9, 10, 14, 16], "organ": [6, 9, 10, 12, 16], "homepage_uri": [6, 9, 10, 14, 16], "policy_uri": [6, 9, 10, 16], "privacy_polici": [6, 16], "tos_uri": [6, 16], "info_polici": [6, 16], "logo_uri": [6, 9, 10, 14, 16], "logo": [6, 9, 10, 14, 16], "svg": [6, 9, 10, 14, 16], "contact": [6, 9, 10, 14], "op": [6, 9, 10], "federation_resolve_endpoint": [6, 14], "authorization_endpoint": [6, 9, 10, 15], "pushed_authorization_request_endpoint": 6, "dpop_signing_alg_values_support": 6, "token_endpoint": [6, 16], "introspection_endpoint": 6, "introspect": 6, "client_registration_types_support": 6, "automat": [6, 14], "code_challenge_methods_support": 6, "authorization_details_types_support": 6, "acr_values_support": 6, "gov": [6, 7, 9, 10], "spidl2": [6, 9, 10], "spidl3": [6, 9, 10], "grant_types_support": [6, 16], "scopes_support": 6, "request_parameter_support": 6, "request_uri_parameter_support": 6, "fals": [6, 7, 9, 10, 15], "response_types_support": [6, 9, 10, 15], "subject_types_support": 6, "pairwis": [6, 9, 10], "token_endpoint_auth_methods_support": [6, 16], "attest_jwt_client_auth": 6, "token_endpoint_auth_signing_alg_values_support": [6, 16], "request_object_signing_alg_values_support": [6, 9, 10, 15], "credential_issu": 6, "credential_endpoint": 6, "revocation_endpoint": 6, "status_attestation_endpoint": 6, "displai": [6, 7, 9, 10], "italiano": 6, "di": 6, "esempio": 6, "alt_text": 6, "questo": 6, "newk5qdymekrcppo": 6, "yeytdjvwjmtzasmavt2vm1mb": 6, "vizxalo6dzeeszpxfpgzabtk3ctxtbubiiqpmiyrts": 6, "ff0bded045fe63fe5d1d64dd83b567e0": 6, "cryptographic_binding_methods_support": 6, "credential_signing_alg_values_support": 6, "proof_types_support": 6, "proof_signing_alg_values_support": 6, "credenzial": 6, "background_color": 6, "12107c": 6, "text_color": 6, "ffffff": 6, "trust_framework": [6, 7, 9], "assurance_level": [6, 7, 9], "electronic_record": [6, 7, 9], "record": [6, 7, 9], "sourc": [6, 7, 9, 11, 12], "organization_id": [6, 7, 9], "ipa_cod": 6, "m_it": 6, "country_cod": [6, 7, 9], "credentialsubject": [6, 9, 10], "nome": 6, "cognom": 6, "nascita": 6, "identificativo": 6, "univoco": 6, "codic": 6, "fiscal": 6, "supervis": [7, 9], "divid": [7, 9, 11], "three": [7, 9, 16], "subphas": [7, 9], "begin": [7, 9], "prompt": [7, 9, 10], "between": [7, 9, 10, 11, 12, 14, 16], "transmit": [7, 9, 10], "rang": [7, 9], "technolog": [7, 9, 14], "limit": [7, 9, 15], "intercept": [7, 9, 10], "eavesdrop": [7, 9], "exclus": [7, 9], "qr": [7, 9, 10], "up": [7, 9, 10, 11, 14], "stage": [7, 9], "condit": [7, 9, 10, 11], "iso18013": [7, 9], "appropri": [7, 9, 10, 11], "decrypt": [7, 9, 10], "bluetooth": [7, 9], "low": [7, 9, 16], "energi": [7, 9], "ble": [7, 9], "figur": [7, 9], "illustr": [7, 9], "diagram": [7, 9, 10, 11], "reveal": [7, 9, 11, 12], "temporari": [7, 9, 11], "edevicekei": [7, 9], "priv": [7, 9], "pub": [7, 9], "incorpor": [7, 9, 14], "suit": [7, 9], "immedi": [7, 9, 14, 16], "after": [7, 9, 10, 11, 15, 16], "final": [7, 9, 10, 14], "a30063312e30018201d818584ba4010220012158205a88d182bce5f42efa59943f33359d2e8a968ff289d93e5fa444b624343167fe225820b16e8cf858ddc7690407ba61d4c338237a8cfcf3de6aa672fc60a557aa32fc670281830201a300f401f50b5045efef742b2c4837a9a3b0e1d05a6917": [7, 9], "embed": [7, 9], "item": [7, 9, 12], "5a88d182bce5f42efa59943f33359d2e8a968ff289d93e5fa444b624343": [7, 9], "167fe": [7, 9], "b16e8cf858ddc7690407ba61d4c338237a8cfcf3de6aa672fc60a557aa32fc67": [7, 9], "deviceretrievalmethod": [7, 9], "peripher": [7, 9], "central": [7, 9, 12, 14], "45efef742b2c4837a9a3b0e1d05a6917": [7, 9], "scan": [7, 9, 10], "ereaderkei": [7, 9], "newli": [7, 9], "independ": [7, 9, 14], "along": [7, 9, 10, 11, 16], "a26776657273696f6e63312e306b646f63526571756573747381a26c6974656d7352657175657374d818590152a267646f6354797065756f72672e69736f2e31383031332e352e312e6d444c6a6e616d65537061636573a2746f72672e69736f2e31383031332e352e312e4954a375766572696669636174696f6e2e65766964656e6365f4781c766572696669636174696f6e2e6173737572616e63655f6c6576656cf4781c766572696669636174696f6e2e74727573745f6672616d65776f726bf4716f72672e69736f2e31383031332e352e31ab76756e5f64697374696e6775697368696e675f7369676ef47264726976696e675f70726976696c65676573f46f646f63756d656e745f6e756d626572f46a69737375655f64617465f46f69737375696e675f636f756e747279f47169737375696e675f617574686f72697479f46a62697274685f64617465f46b6578706972795f64617465f46a676976656e5f6e616d65f468706f727472616974f46b66616d696c795f6e616d65f46a726561646572417574688443a10126a11821590129308201253081cda00302010202012a300a06082a8648ce3d0403023020311e301c06035504030c15536f6d652052656164657220417574686f72697479301e170d3233313132343130323832325a170d3238313132323130323832325a301a3118301606035504030c0f536f6d6520526561646572204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004aa1092fb59e26ddd182cfdbc85f1aa8217a4f0fae6a6a5536b57c5ef7be2fb6d0dfd319839e6c24d087cd26499ec4f87c8c766200ba4c6218c74de50cd1243b1300a06082a8648ce3d0403020347003044022048466e92226e042add073b8cdc43df5a19401e1d95ab226e142947e435af9db30220043af7a8e7d31646a424e02ea0c853ec9c293791f930bf589bee557370a4c97bf6584058a0d421a7e53b7db0412a196fea50ca6d4c8a530a47dd84d88588ab145374bd0ab2a724cf2ed2facf32c7184591c5969efd53f5aba63194105440bc1904e1b9": [7, 9], "docrequest": [7, 9], "itemsrequest": [7, 9], "un_distinguishing_sign": [7, 9], "driving_privileg": [7, 9, 10], "portrait": [7, 9, 10], "readerauth": [7, 9], "a10126": [7, 9], "308201253081cda00302010202012a300a06082a8648ce3d0403023020311e301c06035504030c15536f6d652052656164657220417574686f72697479301e170d3233313132343130323832325a170d3238313132323130323832325a301a3118301606035504030c0f536f6d6520526561646572204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004aa1092fb59e26ddd182cfdbc85f1aa8217a4f0fae6a6a5536b57c5ef7be2fb6d0dfd319839e6c24d087cd26499ec4f87c8c766200ba4c6218c74de50cd1243b1300a06082a8648ce3d0403020347003044022048466e92226e042add073b8cdc43df5a19401e1d95ab226e142947e435af9db30220043af7a8e7d31646a424e02ea0c853ec9c293791f930bf589bee557370a4c97b": [7, 9], "null": [7, 9], "58a0d421a7e53b7db0412a196fea50ca6d4c8a530a47dd84d88588ab145374bd0ab2a724cf2ed2facf32c7184591c5969efd53f5aba63194105440bc1904e1b9": [7, 9], "comput": [7, 9, 11], "ask": [7, 9, 10, 11, 12, 16], "permiss": [7, 9], "agre": [7, 9, 14], "give": [7, 9, 10, 14, 15], "a36776657273696f6e63312e3069646f63756d656e747381a367646f6354797065756f72672e69736f2e31383031332e352e312e6d444c6c6973737565725369676e6564a26a6e616d65537061636573a2746f72672e69736f2e31383031332e352e312e495483d81858f7a46864696765737449440b6672616e646f6d506d44f21ee875f2c1d502b43198e5a15271656c656d656e744964656e74696669657275766572696669636174696f6e2e65766964656e63656c656c656d656e7456616c756581a2647479706571656c656374726f6e69635f7265636f7264667265636f7264bf6474797065781f68747470733a2f2f657564692e77616c6c65742e70646e642e676f762e697466736f75726365bf716f7267616e697a6174696f6e5f6e616d65754d6f746f72697a7a617a696f6e6520436976696c656f6f7267616e697a6174696f6e5f6964656d5f696e666c636f756e7472795f636f6465626974ffffd8185866a4686469676573744944046672616e646f6d50185d84dfb71ce9b173010ddd62174fbe71656c656d656e744964656e746966696572781c766572696669636174696f6e2e74727573745f6672616d65776f726b6c656c656d656e7456616c7565656569646173d8185865a4686469676573744944006672616e646f6d50137f903174253c4585358267aae2ea4e71656c656d656e744964656e746966696572781c766572696669636174696f6e2e6173737572616e63655f6c6576656c6c656c656d656e7456616c75656468696768716f72672e69736f2e31383031332e352e318bd8185852a46864696765737449440c6672616e646f6d5053e29d0ddbbc7d2306a32bdbe2e56e5171656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756563446f65d8185855a4686469676573744944036672616e646f6d50990cba2069fa1b33b8d6ae910b6549dc71656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c756567416e746f6e696fd818585ba46864696765737449440a6672616e646f6d504086c1379975f805f1b1f4975e6a126571656c656d656e744964656e7469666965726a69737375655f646174656c656c656d656e7456616c7565d903ec6a323031392d31302d3230d818585ca4686469676573744944016672616e646f6d50ab4ca30c918dd2fd0bf35242c15fa2d871656c656d656e744964656e7469666965726b6578706972795f646174656c656c656d656e7456616c7565d903ec6a323032342d31302d3230d8185855a4686469676573744944076672616e646f6d508d9066f6c8da16619867cd4e2fab0c8871656c656d656e744964656e7469666965726f69737375696e675f636f756e7472796c656c656d656e7456616c7565624954d818587ea4686469676573744944056672616e646f6d5059fe68db795dee4c20976380ea24770571656c656d656e744964656e7469666965727169737375696e675f617574686f726974796c656c656d656e7456616c75657828497374697475746f20506f6c696772616669636f2065205a656363612064656c6c6f20537461746fd818585ba4686469676573744944026672616e646f6d5008b3f1ca5517019767be3dee3bb0614571656c656d656e744964656e7469666965726a62697274685f646174656c656c656d656e7456616c7565d903ec6a313935362d30312d3230d818585ca4686469676573744944096672616e646f6d50a2395ec214350c26066306e23279b3ae71656c656d656e744964656e7469666965726f646f63756d656e745f6e756d6265726c656c656d656e7456616c756569393837363534333231d8185850a4686469676573744944066672616e646f6d50a25e1a5b915d2d6eafee9674e023293971656c656d656e744964656e74696669657268706f7274726169746c656c656d656e7456616c75654420212223d81858eea46864696765737449440d6672616e646f6d50eeed6a3b856563627589a360939d12f771656c656d656e744964656e7469666965727264726976696e675f70726976696c656765736c656c656d656e7456616c756582a37576656869636c655f63617465676f72795f636f646561416a69737375655f64617465d903ec6a323031382d30382d30396b6578706972795f64617465d903ec6a323032342d31302d3230a37576656869636c655f63617465676f72795f636f646561426a69737375655f64617465d903ec6a323031372d30322d32336b6578706972795f64617465d903ec6a323032342d31302d3230d818585ba4686469676573744944086672616e646f6d50c0ef486b2a194ed3cbf7f354fd40092171656c656d656e744964656e74696669657276756e5f64697374696e6775697368696e675f7369676e6c656c656d656e7456616c756561496a697373756572417574688443a10126a118215901423082013e3081e5a00302010202012a300a06082a8648ce3d040302301a3118301606035504030c0f5374617465204f662055746f706961301e170d3233313132343134353430345a170d3238313132323134353430345a30383136303406035504030c2d5374617465204f662055746f7069612049737375696e6720417574686f72697479205369676e696e67204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004c338ec1000b351ce8bcdfc167450aeceb": [7, 9], "6d44f21ee875f2c1d502b43198e5a152": [7, 9], "pdnd": [7, 9], "motorizzazion": [7, 9], "civil": [7, 9], "m_inf": [7, 9], "185d84dfb71ce9b173010ddd62174fb": [7, 9], "137f903174253c4585358267aae2ea4": [7, 9], "53e29d0ddbbc7d2306a32bdbe2e56e51": [7, 9], "doe": [7, 9, 10], "990cba2069fa1b33b8d6ae910b6549dc": [7, 9], "antonio": [7, 9], "4086c1379975f805f1b1f4975e6a1265": [7, 9], "2019": [7, 9], "20": [7, 9, 10, 14], "ab4ca30c918dd2fd0bf35242c15fa2d8": [7, 9], "8d9066f6c8da16619867cd4e2fab0c88": [7, 9], "59fe68db795dee4c20976380ea247705": [7, 9], "istituto": [7, 9], "poligrafico": [7, 9], "zecca": [7, 9], "dello": [7, 9], "stato": [7, 9], "08b3f1ca5517019767be3dee3bb06145": [7, 9], "a2395ec214350c26066306e23279b3a": [7, 9], "987654321": [7, 9], "a25e1a5b915d2d6eafee9674e0232939": [7, 9], "20212223": [7, 9], "eeed6a3b856563627589a360939d12f7": [7, 9], "vehicle_category_cod": [7, 9], "2018": [7, 9], "08": [7, 9], "09": [7, 9], "b": [7, 9, 13], "2017": [7, 9, 13], "c0ef486b2a194ed3cbf7f354fd400921": [7, 9], "i": [7, 9], "3082013e3081e5a00302010202012a300a06082a8648ce3d040302301a3118301606035504030c0f5374617465204f662055746f706961301e170d3233313132343134353430345a170d3238313132323134353430345a30383136303406035504030c2d5374617465204f662055746f7069612049737375696e6720417574686f72697479205369676e696e67204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004c338ec1000b351ce8bcdfc167450aeceb7d518bd9a519583e082d67effff06565804fc09abf0e4a08e699c9dba3796285a15f68e40ac7f9fc7700a15153a4065300a06082a8648ce3d040302034800304502210099b7d62e6bf7b1823db3713df889bf73e70bb4d9c58c21e92c58d2f1beffe932022058d039747a00d70e6d66be4797e6142b3608a014ee09b7b79af2cae2aaf27788": [7, 9], "0e5f0b6b33418e508740771e82f893372eaf5b2445bc4c84dcf08b005e9493fc": [7, 9], "de21bb62ff2897d8b986d2cda9f9bc5865c02807f7b4d9dd1fa4a79df4c0d37f": [7, 9], "bc5568239e35ce9ff8798c27ffdcd757b134b679f0fe05729aa3491381912e65": [7, 9], "e6048bdc7fd6454296f1e3f54536107c9c5b24c4064de46a98121e3630eecca2": [7, 9], "73690d92dcaa61b0203870f67c6aa9fdfea889b6f0c720de757b4b0a8516a206": [7, 9], "e353ea0b0fd92b6be90c64cc3b2ee1284153a8f0f5066b99aac599200e6eeeb2": [7, 9], "29227872ceb49923d267b5f4bade6d387b42ac2dc4b2ae26c9013067fee7018a": [7, 9], "a6a119f7cacac0b8c6aacac747fd3fe7e50b6d9bb8a507fda79f0df6646f285d": [7, 9], "6d8025d2f02a5e7e1406fb6aaeb67f9ede9b07191a53f3e23b77c528223a94e2": [7, 9], "b0d43e4e2ea534e4d5304e64bcf7a0f13e2c8ee8304b9cd23aba4909652a4647": [7, 9], "fbf4de318982f2dbad43c601caeb22628b301ac18aa8264c5831b2aaac89c486": [7, 9], "cf57377b675f64f37314739592c1e8a911a7ddaf341ce2902fe877c5a835e4c1": [7, 9], "4a4b4cc64ec9299c1a2501ea449f577005e9f7a60408057c07a7c67fb151e5f5": [7, 9], "78824fbd6fbba88a2aab44df8b6f5e9759126d87d1f4415995e658fd9239e1f": [7, 9], "afd09e720b918cedc2b8a881950bab6a1051e18ae16a814d51e609938663d5e1": [7, 9], "61fbc6c8ad24ec86a78bb4e9ac377dd2b7c711d9f2eb9afd4aa0963662847a": [7, 9], "24t14": [7, 9], "54": [7, 9], "05z": [7, 9], "f2461e4fab69e9f7bcffe552395424514524d1679440036213173101448d1b1ab4a293859b389ffa8b47aeed10e9b0c1545412ac37c51a76482cd9bbbe110152": [7, 9], "1fed7190d2975ab79c072e6f1d9d52436059d1fc959d55baf74f057d89b10fcc0dc77a50d433d4c76ddf26223c5560c4ab123b5cb5eb805a90036aa147493076": [7, 9], "subsequ": [7, 9, 11], "consid": [7, 9, 10, 11, 14, 15], "transfermethod": [7, 9], "hold": [7, 9, 11], "bleoption": [7, 9], "datael": [7, 9], "intent": [7, 9], "retain": [7, 9, 14], "intenttoretain": [7, 9], "bool": [7, 9], "cose_sign1": [7, 9], "unless": [7, 9], "responsedata": [7, 9], "respond": [7, 9], "devicenamespac": [7, 9], "dataitemnam": [7, 9], "dataitemvalu": [7, 9], "action": [7, 9, 10, 11, 12, 16], "responsestatu": [7, 9], "300": [7, 9], "doesn": [7, 9, 11, 14], "t": [7, 9, 11, 13, 14], "dispatch": [7, 9], "command": [7, 9], "destruct": [7, 9], "closur": [7, 9], "scenario": [9, 10, 11, 12, 14], "download": [9, 10], "workstat": [9, 10], "frame": [9, 10], "extract": [9, 10], "request_uri_method": [9, 10], "client_id_schem": [9, 10], "entity_id": [9, 10], "assign": [9, 10, 14], "altern": [9, 10], "mandat": [9, 10], "fetch": [9, 10, 14], "eleg": [9, 10], "polici": [9, 10, 11, 14, 16], "successful": [9, 10], "continu": [9, 10], "navig": [9, 10], "sequenc": [9, 10, 14], "summar": [9, 10], "convers": [9, 10], "suppli": [9, 10], "deselect": [9, 10], "direct_post": [9, 10], "25": [9, 10, 14], "26": [9, 10, 14], "27": [9, 10, 14], "28": [9, 10, 14], "29": [9, 10, 14], "autent": [9, 10], "succed": [9, 10], "made": [9, 10, 14, 15, 16], "featur": [9, 10, 11, 14], "deem": [9, 10], "necessari": [9, 10, 11, 12, 14, 15], "better": [9, 10, 11], "explicit": [9, 10], "regard": [9, 10, 14, 15], "hardwar": [9, 10, 14], "usag": [9, 10, 14, 16], "prefer": [9, 10, 16], "vp_token": [9, 10, 11, 15], "response_modes_support": [9, 10, 15], "form_post": [9, 10, 15], "vp_formats_support": [9, 10, 15], "jwt_alg_valu": [9, 10, 14, 15], "presentation_definition_uri_support": [9, 10, 15], "opaqu": [9, 10], "otherwis": [9, 10, 11], "jar": [9, 10], "2freli": [9, 10], "2fcb": [9, 10], "2frequest_uri": [9, 10], "raw": [9, 10], "correct": [9, 10], "quartili": [9, 10], "good": [9, 10, 12, 15], "balanc": [9, 10], "densiti": [9, 10], "space": [9, 10], "qualiti": [9, 10], "remain": [9, 10, 12, 14], "damag": [9, 10], "partial": [9, 10], "obscur": [9, 10], "javascript": [9, 10, 13], "qrcode": [9, 10], "poll": [9, 10], "socket": [9, 10], "cooki": [9, 10], "httponli": [9, 10], "special": [9, 10], "wait": [9, 10, 13], "202": [9, 10], "response_uri": [9, 10], "401": [9, 10], "unauthor": [9, 10, 12, 15, 16], "3be39b69": [9, 10], "6ac1": [9, 10], "41aa": [9, 10], "921b": [9, 10], "3e6c07ddcb03": [9, 10], "e0bbf2f1": [9, 10], "8c3a": [9, 10], "4eab": [9, 10], "a8ac": [9, 10], "2e8f34db8a47": [9, 10], "miicajccadogawibag": [9, 10], "awz": [9, 10], "2w3": [9, 10], "sf2": [9, 10], "walletattest": [9, 10], "response_mod": [9, 10, 15], "2c128e4d": [9, 10], "fc91": [9, 10], "4cd3": [9, 10], "86b8": [9, 10], "18bdea0988cb": [9, 10], "herein": [9, 10], "alias": [9, 10], "anymor": [9, 10, 11], "insensit": [9, 10], "rfc9101": [9, 10], "presentation_definit": [9, 10, 15], "input_descriptor": [9, 10], "constraint": [9, 10, 14], "path": [9, 10, 14], "limit_disclosur": [9, 10], "aal": [9, 10, 15], "mention": [9, 10], "futur": [9, 10, 14], "presentation_definition_uri": [9, 10], "Not": [9, 10, 11], "client_metadata": [9, 10], "taken": [9, 10], "client_metadata_uri": [9, 10], "miss": [9, 10], "webpath": [9, 10], "urlparam": [9, 10], "server_error": [9, 10], "unexpect": [9, 10], "fulfil": [9, 10, 11], "unabl": [9, 10, 11], "malfunct": [9, 10], "mainten": [9, 10], "try": [9, 10], "malform": [9, 10], "anoth": [9, 10, 12], "500": [9, 10, 11], "There": [9, 10, 14], "could": [9, 10, 12], "incorrect": [9, 10, 11], "failur": [9, 10, 11], "manner": [9, 10, 11, 16], "addition": [9, 10], "log": [9, 10, 14], "attempt": [9, 10], "recov": [9, 10], "feasibl": [9, 10], "re": [9, 10], "enter": [9, 10, 14, 15, 16], "crucial": [9, 10, 11, 12], "robust": [9, 10, 11, 14], "handl": [9, 10, 14], "friendli": [9, 10], "adher": [9, 10, 14, 16], "help": [9, 10], "diagnos": [9, 10], "variou": [9, 10, 14, 16], "faulti": [9, 10], "potenti": [9, 10, 11, 14], "lead": [9, 10, 11], "gather": [9, 10], "exploit": [9, 10], "why": [9, 10], "malici": [9, 10], "gain": [9, 10], "plaintext": [9, 10], "network": [9, 10], "environ": [9, 10, 16], "emploi": [9, 10, 14], "tl": [9, 10, 14], "Such": [9, 10], "techniqu": [9, 10, 12], "webserv": [9, 10], "deciph": [9, 10], "transmiss": [9, 10, 14], "forward": [9, 10], "negoti": [9, 10], "actual": [9, 10, 16], "actor": [9, 10, 12, 16], "segment": [9, 10], "sensit": [9, 10], "unencrypt": [9, 10], "snif": [9, 10], "eyjhbgcioijfuzi1nii": [9, 10], "9t2lq": [9, 10], "pt0ixx0": [9, 10], "presentation_submiss": [9, 10], "definition_id": [9, 10], "32f54163": [9, 10], "7166": [9, 10], "48f1": [9, 10], "93d8": [9, 10], "ff217bdb0653": [9, 10], "04a98be3": [9, 10], "7fb0": [9, 10], "4cf5": [9, 10], "af9a": [9, 10], "31579c8b0e7d": [9, 10], "descriptor_map": [9, 10], "verified_claim": [9, 10], "find": [9, 10], "3978344f": [9, 10], "8596": [9, 10], "4c3a": [9, 10], "a978": [9, 10], "8fcaba3903c5": [9, 10], "1541493724": [9, 10], "1573029723": [9, 10], "origin": [9, 10, 14], "beyond": [9, 10, 11, 14], "longer": [9, 10, 11, 14, 15], "audienc": [9, 10], "becaus": [9, 10, 11], "aris": [9, 10], "403": [9, 10], "forbidden": [9, 10], "happen": [9, 10], "occour": [9, 10], "meet": [9, 10, 14], "criteria": [9, 10, 14], "stem": [9, 10], "aspect": [9, 10], "clariti": [9, 10], "proper": [9, 10], "credentialx": [9, 10], "write": [9, 10, 16], "response_cod": [9, 10], "091535f699ea575c7937fa5f0f454ae": [9, 10], "These": [9, 10, 11, 14, 16], "critic": [9, 10], "impact": [9, 10], "hinder": [9, 10], "seamless": [9, 10, 12, 14, 16], "implic": [9, 10], "mismatch": [9, 10], "incur": [9, 10], "rais": [9, 10], "refus": [9, 10], "precaut": [9, 10], "clear": [9, 10, 14], "2hnofs3ync9tjicaivhwlvuj3axwggz_98urfaqme": [9, 10, 14], "1649590602": [9, 10], "1649417862": [9, 10], "5s4qi": [9, 10], "wallet_relying_parti": [9, 10, 14], "application_typ": [9, 10], "client_nam": [9, 10], "9tjicaivhwlvuj3axwggz_9": [9, 10], "default_acr_valu": [9, 10], "vp_format": [9, 10, 14], "kb": [9, 10, 14], "identitycredenti": [9, 10], "const": [9, 10], "intent_to_retain": [9, 10], "enum": [9, 10], "issuer2": [9, 10], "issuer3": [9, 10], "1504700136": [9, 10, 11], "sampl": [9, 10], "eddsa": [9, 10], "default_max_ag": [9, 10], "1111": [9, 10], "jarm": [9, 10, 13], "authorization_signed_response_alg": [9, 10], "authorization_encrypted_response_alg": [9, 10], "authorization_encrypted_response_enc": [9, 10], "a192cbc": [9, 10], "a128gcm": [9, 10], "a192gcm": [9, 10], "a256gcm": [9, 10], "subject_typ": [9, 10], "require_auth_tim": [9, 10], "id_token_signed_response_alg": [9, 10], "id_token_encrypted_response_alg": [9, 10], "id_token_encrypted_response_enc": [9, 10], "home": [9, 10], "tech": [9, 10, 14], "princip": [9, 10], "acr": [9, 10], "hint": [9, 10], "verifieng": [9, 10], "confgiur": [9, 10], "inaccuraci": 11, "compromis": [11, 14], "valueless": 11, "harm": 11, "life": 11, "cycl": 11, "serv": [11, 14, 16], "autom": [11, 14], "provis": [11, 14, 15], "onlin": [11, 14], "preserv": [11, 15, 16], "internet": [11, 13], "becom": [11, 15, 16], "conjunct": 11, "greater": 11, "hour": [11, 14], "rotat": 11, "kept": 11, "circumst": [11, 16], "whenev": 11, "delet": [11, 15], "band": 11, "databas": 11, "trigger": 11, "touchpoint": 11, "enforc": [11, 14], "judici": 11, "polic": 11, "loss": 11, "theft": [11, 12], "physic": [11, 12], "impli": 11, "address": 11, "lose": 11, "awar": 11, "behalf": [11, 14], "entitl": 11, "etc": [11, 14], "turn": 11, "death": 11, "decid": 11, "Then": 11, "credential_pop": 11, "credentialpopjwt": 11, "jwkid": 11, "1698744039": 11, "1698744139": 11, "6f204f7e": 11, "e453": 11, "4dfd": 11, "814e": 11, "9d155319408c": 11, "credential_hash": 11, "associ": [11, 14, 15, 16], "notif": 11, "email": [11, 14], "telephon": 11, "back": 11, "204": 11, "No": [11, 14], "404": 11, "problem": [11, 15], "503": 11, "unavail": [11, 14], "registerd": 11, "take": 11, "lack": 11, "interv": 11, "suspens": 11, "itself": [11, 14, 16], "eyjhbgcioijfuzi1niisinr5cci6indhbgxldc1": 11, "among": [11, 14, 16], "credential_revok": 11, "credential_upd": 11, "One": [11, 15], "defer": 11, "paradigm": 12, "iam": 12, "improv": 12, "ownership": [12, 16], "said": 12, "histori": 12, "tradit": [12, 14], "know": [12, 14], "fact": 12, "envis": 12, "login": 12, "compani": 12, "want": 12, "acquir": [12, 16], "publish": [12, 14], "educ": 12, "institut": 12, "portabl": 12, "principl": [12, 14], "character": 12, "choos": 12, "leverag": [12, 14, 16], "avoid": [12, 15], "fraud": 12, "promot": [12, 14], "border": [12, 14], "effici": [12, 14], "cost": [12, 14], "reduct": 12, "elimin": 12, "multipl": [12, 14, 15], "repetit": 12, "streamlin": [12, 14], "reduc": [12, 14], "purchas": 12, "ag": 12, "k": 13, "looker": 13, "februari": 13, "o": 13, "d": 13, "fett": 13, "presentationexch": 13, "2119": 13, "bradner": 13, "march": 13, "1997": 13, "2616": 13, "r": 13, "getti": 13, "j": 13, "mogul": 13, "frystyk": 13, "masint": 13, "l": [13, 15], "leach": 13, "berner": 13, "lee": 13, "hypertext": 13, "transfer": [13, 15], "june": 13, "1999": 13, "3339": 13, "klyne": 13, "c": 13, "newman": 13, "doi": 13, "17487": 13, "rfc3339": 13, "juli": 13, "2002": 13, "3986": 13, "uniform": 13, "syntax": 13, "7009": 13, "dronia": 13, "scurtescu": 13, "m": 13, "rfc7009": 13, "august": 13, "2013": 13, "7159": 13, "brai": 13, "interchang": 13, "2014": 13, "jone": 13, "bradlei": 13, "sakimura": 13, "2015": 13, "hildebrand": 13, "jwe": 13, "rfc7517": 13, "jwa": 13, "rfc7638": 13, "septemb": 13, "7800": 13, "tschofenig": 13, "semant": 13, "april": 13, "2016": 13, "8174": 13, "leiba": 13, "ambigu": 13, "uppercas": 13, "vs": 13, "lowercas": 13, "hardt": 13, "sheffer": 13, "best": 13, "practic": [13, 15], "2020": 13, "campbel": 13, "novemb": 13, "2022": 13, "openid4vc": [13, 15], "haip": [13, 15], "legitimaci": 14, "compli": 14, "rest": [14, 15, 16], "distribut": 14, "call": 14, "overse": 14, "fr": 14, "stamp": 14, "artifact": 14, "confidenti": 14, "measur": [14, 15], "gdpr": 14, "empow": 14, "audit": 14, "minim": 14, "anonym": 14, "retent": 14, "account": 14, "disput": 14, "resolut": 14, "liabil": 14, "those": 14, "disabl": 14, "emerg": 14, "breach": 14, "scalabl": 14, "deleg": 14, "relationship": 14, "grow": 14, "remov": [14, 16], "might": 14, "scale": 14, "horizont": 14, "accommod": 14, "increas": 14, "volum": 14, "histor": 14, "extens": 14, "behavior": 14, "relianc": 14, "adapt": 14, "load": 14, "vari": 14, "particularli": 14, "peak": 14, "complex": 14, "task": 14, "cryptographi": 14, "flexibl": 14, "threat": 14, "research": 14, "pre": 14, "candid": 14, "monitor": 14, "ongo": 14, "similar": 14, "thereof": 14, "reflect": 14, "transpar": 14, "status": 14, "foster": 14, "tool": [14, 15], "aid": 14, "earli": 14, "detect": 14, "30": 14, "tamper": [14, 16], "except": 14, "dedic": 14, "summari": 14, "pki": 14, "leaf": 14, "built": 14, "p1": 14, "p2": 14, "p3": 14, "divers": 14, "p4": 14, "indirectli": 14, "p6": 14, "p5": 14, "p7": 14, "organiz": 14, "adjust": 14, "p8": 14, "autonomi": 14, "p9": 14, "unlik": 14, "coverag": 14, "satisfi": 14, "recognis": 14, "publicli": 14, "summaris": 14, "trust_mark_id": 14, "motiv": 14, "plain": 14, "keep": 14, "max_path_length": 14, "1649375259": 14, "1649373279": 14, "x2zomhngsdc4zlbrcxhmt3mzrmrzog9jd3o2qjzdam51cuhhufruowd0wq": 14, "1knr9ar3mzmokyty8brvriue85nixryx4xd3k4jw7vi": 14, "slt14644zbyxyf": 14, "xmw7apdlbmuw3t1urwi4nafmtkri": 14, "ta": 14, "federation_fetch_endpoint": 14, "federation_list_endpoint": 14, "federation_trust_mark_status_endpoint": 14, "trust_mark_statu": 14, "trust_mark_issu": 14, "cryptograf": 14, "x5c": [14, 15], "entity_typ": 14, "trustworthi": [14, 15, 16], "trust_mark_own": 14, "trust_mark": 14, "entri": 14, "don": 14, "em3cmnzghiyfsq090n6b3op7laaqj8rghmhxgmjstqg": 14, "1649623546": 14, "1649450746": 14, "metadata_polici": 14, "subset_of": 14, "allowed_leaf_entity_typ": 14, "real": 14, "concaten": 14, "convei": 14, "pertain": 14, "earliest": 14, "forc": 14, "higher": 14, "abstract": 14, "entityconfigur": 14, "signedjwt": 14, "selfissu": 14, "byleaf": 14, "entitystat": 14, "bytrustanchor": 14, "eyjhbgcioijfuzi1niisimtpzci6ik5gttfxvvzpvwxzelvxcexhbwxmy0vwufjwwtjwwfpjumpcblfywm1ssghlwvvwwvvszfrrbkeytkeilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 14, "eyjlehaioje2ndk1ota2mdisimlhdci6mty0otqxnzg2miwiaxnzijoiahr0chm6ly9ycc5legftcgxllm9yzyisinn1yii6imh0dhbzoi8vcnauzxhhbxbszs5vcmcilcjqd2tzijp7imtlexmiolt7imt0esi6ikvdiiwia2lkijoitkznmvdvvmlvbfl6vvdwtgftbgzjrxbqulzzmlzywklsakjuuvhabvjiaetzvvzzvwxkvffuqtjoqsisimnydii6ilatmju2iiwieci6invzbemzd2qtcfgzd3o0yljzbnd5m2x6cgjhwkzotjk2aewyquhbm01rnlkilcj5ijoivkxdqlhgv2xktlnosxo4a0gyoxzmujromthca3dht1gynnprb3j1utfnncj9xx0sim1ldgfkyxrhijp7im9wzw5pzf9yzwx5aw5nx3bhcnr5ijp7imfwcgxpy2f0aw9ux3r5cguioij3zwiilcjjbgllbnrfawqioijodhrwczovl3jwlmv4yw1wbguub3jnlyisimnsawvudf9yzwdpc3ryyxrpb25fdhlwzxmiolsiyxv0b21hdgljil0simp3a3mionsia2v5cyi6w3sia3r5ijoirumilcjrawqioijork0xv1vwavvswxpvv3bmyw1szmnfcfbsvlkyvlhasvjqqm5rwfptukhos1lvvllvbgruuw5bmk5biiwiy3j2ijoiuc0yntyilcj4ijoidxnsqzn3zc1wwdn3ejriullud3kzbhpwykdarmhootzotdjbseeztve2wsisinkioijwtencwezxbgrou05jejhrsdi5dkxsne4xoejrd0dpwdi2elfvcnvrmu00in1dfswiy2xpzw50x25hbwuioijoyw1lig9migfuigv4yw1wbgugb3jnyw5pemf0aw9uiiwiy29udgfjdhmiolsib3bzqhjwlmv4yw1wbguuaxqixswiz3jhbnrfdhlwzxmiolsicmvmcmvzaf90b2tlbiisimf1dghvcml6yxrpb25fy29kzsjdlcjyzwrpcmvjdf91cmlzijpbimh0dhbzoi8vcnauzxhhbxbszs5vcmcvb2lkyy9ycc9jywxsymfjay8ixswicmvzcg9uc2vfdhlwzxmiolsiy29kzsjdlcjzy29wzsi6imv1lmv1cm9wys5lyy5ldwrpdy5wawqumsblds5ldxjvcgeuzwmuzxvkaxcucglklml0ljegzw1hawwilcjzdwjqzwn0x3r5cguioijwywlyd2lzzsj9lcjmzwrlcmf0aw9ux2vudgl0esi6eyjmzwrlcmf0aw9ux3jlc29sdmvfzw5kcg9pbnqioijodhrwczovl3jwlmv4yw1wbguub3jnl3jlc29sdmuviiwib3jnyw5pemf0aw9ux25hbwuioijfegftcgxlifjqiiwiag9tzxbhz2vfdxjpijoiahr0chm6ly9ycc5legftcgxllml0iiwicg9sawn5x3vyasi6imh0dhbzoi8vcnauzxhhbxbszs5pdc9wb2xpy3kilcjsb2dvx3vyasi6imh0dhbzoi8vcnauzxhhbxbszs5pdc9zdgf0awmvbg9nby5zdmcilcjjb250ywn0cyi6wyj0zwnoqgv4yw1wbguuaxqixx19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3jlz2lzdhj5lmvpzgfzlnrydxn0lwfuy2hvci5legftcgxllmv1l29wzw5pzf9yzwx5aw5nx3bhcnr5l3b1ymxpyy8ilcj0cnvzdf9tyxjrijoizxlkacbcdtiwmjyifv0simf1dghvcml0ev9oaw50cyi6wyjodhrwczovl2ludgvybwvkawf0zs5lawrhcy5legftcgxllm9yzyjdfq": 14, "un315hdckvhya": 14, "irregzaml7pnfjqh2apz82blqo5s0sl1jr0tefp5e1t913g8gnuwggtmquqhpzwv6bvtla8g": 14, "eyjhbgcioijfuzi1niisimtpzci6ilnurkrxv2hky0dwwfgzqjnsvmraywtsq0xutnvna000wtngnlfutk9krxryzfhgwvlywjjjwgn0uveilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 14, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly9pbnrlcm1lzglhdguuzwlkyxmuzxhhbxbszs5vcmcilcjzdwiioijodhrwczovl3jwlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6ik5gttfxvvzpvwxzelvxcexhbwxmy0vwufjwwtjwwfpjumpcblfywm1ssghlwvvwwvvszfrrbkeytkeilcjjcnyioijqlti1niisingioij1c2xdm3dklxbym3d6ngjsww53etnsenbir1pgae45nmhmmkfiqtnnutzziiwiesi6ilzmq0jyrldsze5ttkl6ogtimjl2tfi0tje4qmt3r09ymjz6uw9ydvexttqifv19lcjtzxrhzgf0yv9wb2xpy3kionsib3blbmlkx3jlbhlpbmdfcgfydhkionsic2nvcguionsic3vic2v0x29mijpbimv1lmv1cm9wys5lyy5ldwrpdy5wawqumswgigv1lmv1cm9wys5lyy5ldwrpdy5wawquaxqumsjdfswicmvxdwvzdf9hdxrozw50awnhdglvbl9tzxrob2rzx3n1chbvcnrlzci6eyjvbmvfb2yiolsicmvxdwvzdf9vymply3qixx0sinjlcxvlc3rfyxv0agvudgljyxrpb25fc2lnbmluz19hbgdfdmfsdwvzx3n1chbvcnrlzci6eyjzdwjzzxrfb2yiolsiulmyntyilcjsuzuxmiisikvtmju2iiwirvm1mtiilcjquzi1niisilbtnteyil19fx0sinrydxn0x21hcmtzijpbeyjpzci6imh0dhbzoi8vdhj1c3qtyw5jag9ylmv4yw1wbguuzxuvb3blbmlkx3jlbhlpbmdfcgfydhkvchvibgljlyisinrydxn0x21hcmsioijleupoyibcdtiwmjyifv19": 14, "_qt5": 14, "t6dahp3tuwa_27kle8i9z_spk2ftqlky6pgmpchbsi2ahxy3aaxdurobpo4chtqgg3j2xcrghdfucfgeq": 14, "eyjhbgcioijfuzi1niisimtpzci6imvxa3pubwt0ww5kblzhmwxhmju1zdjkq2rvzersazqwuwt0wvlvmwfhrfzyt1robfphdfdxsgq1wncilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 14, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly90cnvzdc1hbmnob3iuzxhhbxbszs5ldsisinn1yii6imh0dhbzoi8vaw50zxjtzwrpyxrllmvpzgfzlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6ilnurkrxv2hky0dwwfgzqjnsvmraywtsq0xutnvna000wtngnlfutk9krxryzfhgwvlywjjjwgn0uveilcjjcnyioijqlti1niisingioijyql9bogdcunh5njhvtkxzrkzlr0zmr2vmwu5xymgtszh1os1gylqyzkzjiiwiesi6ilnuwvk2y3njznkxcjbisfhltgjuvfzsamfndzhozznrues2wfvoc2uzdkuifv19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3rydxn0lwfuy2hvci5legftcgxllmv1l2zlzgvyyxrpb25fzw50axr5l3royxqtchjvzmlszsisinrydxn0x21hcmsioijleupoyibcdtiwmjyifv19": 14, "r3uoi": 14, "u0tx0gdflndditbcwznupy7m2tnh08jld": 14, "ej9vmzwmcxoccuwin0zt0js4m_shneig6tlxrqj": 14, "hti70g": 14, "At": 14, "attain": 14, "propag": 14, "thu": [14, 16], "build": 14, "inquir": 14, "amount": 14, "matter": 14, "especi": 14, "perimet": 14, "jurisdict": 14, "snapshot": 14, "overload": 14, "met": 15, "therebi": 15, "accur": 15, "repeat": 15, "lost": 15, "now": 15, "readi": 15, "explain": 15, "7523": 15, "bearer": 15, "3agrant": 15, "3ajwt": 15, "eyjhbgcioijfuzi1niisimtpzci6imtoakzwte9nrjnhegrxd2xvtl9lwl83ntvut1zebmjiadg2tw1kchh2a1uifq": 15, "eyjpc3mioiaidmjlweprc000nxhwahrbtm5dauc2bun5dvu0amzhtnpvced1s3zvz2c5yyisicjhdwqioiaiahr0chm6ly93ywxszxqtchjvdmlkzxiuzxhhbxbszs5vcmcilcaianrpijogimy1njuymdcylwfizwytndu5os1iodyzltlhnjkwnja3mzjjyyisicjub25jzsi6iciuli4uliisicjjbmyioib7imp3ayi6ihsiy3j2ijogilatmju2iiwgimt0esi6icjfqyisicj4ijogijritnb0ss14cjjwanlsskthtw56nfdtzg5rrf91slnxnfi5nu5qothindqilcaiesi6icjmsvpuu0izoxzgsmhzz1mzazdqweu0cjmtq29hrlf3wnrqqklscxbobhjniiwgimtpzci6icj2ymvysmtzttq1ehbodefobknprzztq3l1vtrqzkdoem9wr3vldm9nzzljin19lcaiawf0ijogmty5mtq4odk2miwgimv4cci6ide2ote0otyxnjj9": 15, "dg_yfaiv6lvftr3ffx0v5jw250mbgxlvp1j0ezzchryitqsy7xgmx4i": 15, "mgur93fas85vf_da": 15, "reveltwu2jw": 15, "eyjhbgcioijfuzi1niisinr5cci6indhbgxldc1hdhrlc3rhdglvbitqd3qilcjrawqioii1ddvzwxbcae4trwdjruvjnwlveni2cjbnujaytg5wutbpbwvrbu5ly2pziiwidhj1c3rfy2hhaw4iolsizxlkagjhy2lpaupgvxouli42uzbbiiwizxlkagjhy2lpaupgvxouli5qskxbiiwizxlkagjhy2lpaupgvxouli5iowd3il19": 15, "eyjpc3mioijodhrwczovl3dhbgxldc1wcm92awrlci5legftcgxllm9yzyisinn1yii6inzizvhka3nnndv4cgh0qu5uq2lhnm1dexvvngpmr056b3bhdut2b2dnowmilcj0exblijoiv2fsbgv0sw5zdgfuy2vbdhrlc3rhdglvbiisinbvbgljev91cmkioijodhrwczovl3dhbgxldc1wcm92awrlci5legftcgxllm9yzy9wcml2ywn5x3bvbgljesisinrvc191cmkioijodhrwczovl3dhbgxldc1wcm92awrlci5legftcgxllm9yzy9pbmzvx3bvbgljesisimxvz29fdxjpijoiahr0chm6ly93ywxszxqtchjvdmlkzxiuzxhhbxbszs5vcmcvbg9nby5zdmcilcjhdhrlc3rlzf9zzwn1cml0ev9jb250zxh0ijoiahr0chm6ly93ywxszxqtchjvdmlkzxiuzxhhbxbszs5vcmcvtg9bl2jhc2ljiiwiy25mijp7imp3ayi6eyjjcnyioijqlti1niisimt0esi6ikvdiiwieci6ijritnb0ss14cjjwanlsskthtw56nfdtzg5rrf91slnxnfi5nu5qothindqilcj5ijoitelablncmzl2rkpowwdtm2s3alhfnhizlunvr0zrd1p0uejjunfwtmxyzyisimtpzci6inzizvhka3nnndv4cgh0qu5uq2lhnm1dexvvngpmr056b3bhdut2b2dnowmifx0simf1dghvcml6yxrpb25fzw5kcg9pbnqioijldwrpdzoilcjyzxnwb25zzv90exblc19zdxbwb3j0zwqiolsidnbfdg9rzw4ixswidnbfzm9ybwf0c19zdxbwb3j0zwqionsiand0x3zwx2pzb24ionsiywxnx3zhbhvlc19zdxbwb3j0zwqiolsirvmyntyixx0simp3df92y19qc29uijp7imfsz192ywx1zxnfc3vwcg9ydgvkijpbikvtmju2il19fswicmvxdwvzdf9vymply3rfc2lnbmluz19hbgdfdmfsdwvzx3n1chbvcnrlzci6wyjfuzi1nijdlcjwcmvzzw50yxrpb25fzgvmaw5pdglvbl91cmlfc3vwcg9ydgvkijpmywxzzswiawf0ijoxnjg3mjgxmtk1lcjlehaioje2odcyodgzotv9": 15, "tnvcyfpcl5tui2nakkwdag9xbrtwwl4djsryrfhrf8ndmffdt044u55prn35j2cl0lzxbesedrfsaz2pllw2ug": 15, "wiar": 15, "comma": 15, "6ec69324": 15, "60a8": 15, "4e5b": 15, "a697": 15, "a766d85790ea": 15, "4hnpti": 15, "xr2pjyrjkgmnz4wmdnqd_ujsq4r95nj98b44": 15, "liznsb39vfjhygs3k7jxe4r3": 15, "cogfqwztpbirqpnlrg": 15, "durat": 15, "8414": 15, "request_object_sign": 15, "_alg_values_support": 15, "_uri_support": 15, "boolean": 15, "5t5yypbhn": [15, 16], "egieei5iuzr6r0mr02lnvq0omekmnkcji": [15, 16], "eyjhbgcioijfuz": 15, "6s0a": 15, "jjla": 15, "h9gw": 15, "1687281195": 15, "1687288395": 15, "comprehens": 16, "cater": 16, "asset": 16, "effect": 16, "total": 16, "conveni": 16, "plai": 16, "vital": 16, "android": 16, "io": 16, "Their": 16, "guarante": 16, "utmost": 16, "execut": 16, "tee": 16, "distinct": 16, "unlock": 16, "pin": 16, "biometr": 16, "fingerprint": 16, "facial": 16, "recognit": 16, "unambigu": 16, "rel": 16, "revert": 16, "voluntarili": 16, "aal_values_support": 16, "context": 16, "medium": 16, "token_endpoint_auth_methods_suppor": 16, "ted": 16, "token_endpoint_auth_signing_alg_va": 16, "lues_support": 16, "experiment": 16, "qrjrj3af_b57sboirrcbm7br7woc8ynj7lhfpteffuk": 16, "1h0cwdyggvu8w": 16, "kpku_xycocunt2o0bwsliqtnpu6im": 16, "basic": 16, "private_key_jwt": 16, "1687171759": 16, "1709290159": 16, "inherit": 16, "extend": 16, "trusti": 16, "enclav": 16}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"cryptograph": 0, "algorithm": 0, "backup": 1, "restor": 1, "rst": [1, 8], "gener": [1, 8, 14, 15], "properti": [1, 8, 14, 15], "requir": [1, 8, 11, 14, 15, 16], "attribut": [1, 8], "implement": [1, 4, 8], "consider": [1, 8, 14], "librari": [1, 8], "code": [1, 8], "snippet": [1, 8], "extern": [1, 8, 16], "refer": [1, 8, 13, 16], "how": 2, "contribut": 2, "acknowledg": 2, "norm": [3, 5], "languag": 3, "convent": 3, "defin": 3, "term": 3, "acronym": 3, "The": [4, 14], "italian": 4, "eudi": [4, 14], "wallet": [4, 11, 14, 15, 16], "profil": 4, "introduct": [4, 12], "index": 4, "content": 4, "pid": [5, 6], "q": [5, 6], "eaa": [5, 6], "data": 5, "model": [5, 14], "sd": 5, "jwt": 5, "paramet": [5, 6, 14], "claim": 5, "non": [5, 14], "exampl": 5, "mdoc": [5, 7, 9], "cbor": 5, "namespac": 5, "mobil": 5, "secur": [5, 9, 10], "object": [5, 9, 10], "issuanc": 6, "high": [6, 15], "level": [6, 15], "flow": [6, 7, 9, 10, 11], "detail": [6, 9, 10, 15], "push": 6, "author": [6, 9, 10], "request": [6, 7, 9, 10, 11, 15], "endpoint": [6, 9, 10, 14, 16], "par": 6, "http": [6, 9, 10, 11], "respons": [6, 7, 9, 10, 11], "token": 6, "access": 6, "credenti": [6, 11], "entiti": [6, 9, 10, 14], "configur": [6, 9, 10, 14], "issuer": 6, "proxim": [7, 9], "devic": [7, 9, 10], "engag": [7, 9], "session": [7, 9], "termin": [7, 9], "pseudonym": 8, "reli": [9, 10, 14], "parti": [9, 10, 14], "solut": [9, 16], "remot": [9, 10], "uri": [9, 10], "post": [9, 10], "cross": [9, 10], "statu": [9, 10, 11], "check": [9, 10], "error": [9, 10], "redirect": [9, 10], "lifecycl": [11, 16], "oper": [11, 16], "function": [11, 14], "revoc": 11, "us": 11, "case": 11, "instanc": [11, 16], "attest": [11, 14, 15, 16], "present": 11, "verifi": 11, "proof": 11, "possess": 11, "self": 12, "sovereign": 12, "ident": 12, "ssi": 12, "technic": 13, "infrastructur": 14, "trust": 14, "feder": 14, "role": 14, "api": 14, "common": 14, "anchor": 14, "leav": 14, "intermedi": 14, "metadata": [14, 16], "type": 14, "statement": 14, "evalu": 14, "mechan": 14, "chain": 14, "offlin": 14, "repudi": 14, "long": 14, "live": 14, "privaci": 14, "remark": 14, "about": 14, "decentr": 14, "design": 15, "static": 15, "compon": 15, "view": 15, "dynam": 15, "assert": 15, "header": [15, 16], "payload": [15, 16], "initi": 16, "process": 16, "transit": 16, "valid": 16, "state": 16, "return": 16, "deactiv": 16, "provid": 16, "wallet_provid": 16, "federation_ent": 16}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1, "sphinx.ext.todo": 2, "sphinx": 56}}) \ No newline at end of file +Search.setIndex({"docnames": ["algorithms", "backup-restore", "contribute", "defined-terms", "index", "pid-eaa-data-model", "pid-eaa-issuance", "proximity-flow", "pseudonyms", "relying-party-solution", "remote-flow", "revocation-lists", "ssi-introduction", "standards", "trust", "wallet-attestation", "wallet-solution"], "filenames": ["algorithms.rst", "backup-restore.rst", "contribute.rst", "defined-terms.rst", "index.rst", "pid-eaa-data-model.rst", "pid-eaa-issuance.rst", "proximity-flow.rst", "pseudonyms.rst", "relying-party-solution.rst", "remote-flow.rst", "revocation-lists.rst", "ssi-introduction.rst", "standards.rst", "trust.rst", "wallet-attestation.rst", "wallet-solution.rst"], "titles": ["Cryptographic algorithms", "backup-restore.rst", "How to contribute", "Normative Language and Conventions", "The Italian EUDI Wallet implementation profile", "PID/(Q)EAA Data Model", "PID/(Q)EAA Issuance", "Proximity Flow", "pseudonyms.rst", "Relying Party Solution", "Remote Flow", "Credential Lifecycle", "Self Sovereign Identity", "Technical References", "The Infrastructure of Trust", "Wallet Attestation", "Wallet Solution"], "terms": {"tutti": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "gli": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "esempi": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "contenuti": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "questa": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "documentazion": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "sono": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "da": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "intendersi": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "come": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "non": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 15, 16], "normativi": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "all": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "exampl": [0, 1, 2, 3, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "contain": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "thi": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "document": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "ar": [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "meant": [0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 12, 13, 14, 15, 16], "norm": [0, 1, 2, 4, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "The": [0, 2, 3, 5, 6, 7, 9, 10, 11, 12, 13, 15, 16], "follow": [0, 2, 4, 5, 6, 7, 9, 10, 11, 12, 14, 15], "must": [0, 3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "support": [0, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "alg": [0, 5, 6, 9, 10, 11, 14, 15, 16], "paramet": [0, 1, 4, 8, 9, 10, 11, 15, 16], "valu": [0, 1, 5, 6, 7, 8, 9, 10, 11, 14, 15, 16], "descript": [0, 1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 14, 15], "oper": [0, 3, 4, 6, 9, 10, 14, 15], "refer": [0, 4, 5, 6, 7, 9, 11, 12, 14, 15], "es256": [0, 5, 6, 9, 10, 11, 14, 15, 16], "ellipt": [0, 7, 9, 15], "curv": [0, 5, 7, 9, 15], "digit": [0, 3, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "signatur": [0, 3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "ecdsa": [0, 9, 10], "us": [0, 3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16], "one": [0, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15], "enabl": [0, 3, 9, 10, 12, 14], "list": [0, 2, 3, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "section": [0, 5, 6, 7, 9, 10, 11, 14, 15, 16], "below": [0, 2, 3, 4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "sha256": [0, 15], "rfc": [0, 5, 6, 9, 10, 11, 13, 14, 15, 16], "7518": [0, 13], "sog": 0, "IS": 0, "etsi": [0, 5], "es384": [0, 6, 9, 10, 14, 15, 16], "sha384": 0, "es512": [0, 6, 16], "sha521": 0, "rsa": [0, 6, 9, 10], "oaep": [0, 9, 10], "256": [0, 5, 6, 7, 9, 10, 11, 14, 15, 16], "encrypt": [0, 5, 6, 7, 9, 10, 11, 13, 14, 15], "scheme": [0, 4, 6, 9, 10, 12], "optim": 0, "asymmetr": [0, 6, 15], "pad": 0, "hash": [0, 5, 6, 7, 9, 11, 15], "function": [0, 3, 4, 5, 7, 9, 15, 16], "mgf1": 0, "sha": [0, 5, 6, 7, 9, 10, 11], "mask": 0, "gener": [0, 3, 4, 5, 6, 7, 9, 10, 13, 15], "kei": [0, 1, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16], "7516": [0, 6, 9, 10, 11, 13, 15], "a128cbc": [0, 9, 10], "hs256": [0, 9, 10], "ae": 0, "cipher": [0, 7, 9], "block": [0, 7, 9, 11], "chain": [0, 4, 5, 6, 9, 10, 15], "mode": [0, 7, 9, 10, 13], "128": [0, 6, 9, 10], "bit": [0, 6, 9, 10], "initi": [0, 2, 3, 4, 6, 7, 9, 11], "vector": 0, "plu": 0, "hmac": 0, "authent": [0, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "truncat": 0, "content": [0, 5, 6, 9, 10, 11, 15], "a256cbc": [0, 9, 10], "hs512": [0, 9, 10], "512": [0, 6], "famili": [0, 5, 6], "short": [0, 6, 7, 9, 14, 15, 16], "name": [0, 5, 6, 7, 9, 10, 14, 15, 16], "brainpool": 0, "brainpoolp256r1": 0, "brainpoolp384r1": 0, "brainpoolp512r1": 0, "5639": 0, "nist": [0, 3], "p": [0, 5, 6, 9, 10, 13, 14, 15, 16], "384": 0, "521": 0, "fip": 0, "186": 0, "4": [0, 5, 6, 7, 9, 10, 11, 14, 15], "iso": [0, 5, 7, 9, 10], "iec": [0, 5], "14888": 0, "3": [0, 5, 6, 7, 9, 10, 11, 14, 15, 16], "recommend": [0, 3, 5, 6, 9, 10, 11, 14, 15], "ps256": 0, "rsassa": 0, "appendix": [0, 6], "pss": 0, "probabilist": 0, "ps384": 0, "ps512": 0, "sha512": 0, "ecdh": 0, "es": 0, "diffi": 0, "hellman": 0, "ephemer": [0, 7, 9, 15], "static": [0, 4, 9, 10, 14], "agreement": [0, 7, 9], "concat": 0, "deriv": [0, 6, 7, 9, 11, 14], "kdf": 0, "a128kw": 0, "cek": 0, "wrap": 0, "length": [0, 5, 6, 7, 9, 10], "a256kw": 0, "NOT": [0, 3, 5, 6, 9, 10, 11, 14, 15], "none": [0, 6, 9, 10, 11, 15], "rsa_1_5": 0, "rsae": 0, "pkcs1": 0, "v1_5": 0, "secur": [0, 3, 4, 6, 7, 11, 12, 13, 14, 15, 16], "vulner": 0, "default": [0, 9, 10, 14], "hs384": [0, 9, 10], "what": [1, 8, 12, 14], "useful": [1, 8], "todo": [1, 8], "req": [1, 8, 9, 10], "1": [1, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16], "2": [1, 5, 6, 7, 8, 9, 10, 11, 13, 14, 15, 16], "tabl": [1, 5, 6, 7, 8, 9, 10, 11, 14, 15], "claim": [1, 3, 4, 6, 8, 9, 10, 11, 14, 15, 16], "IT": [2, 3, 4, 5, 6, 7, 9, 16], "wallet": [2, 3, 5, 6, 7, 9, 10, 12, 13], "project": [2, 4], "includ": [2, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "an": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "open": [2, 16], "develop": [2, 4, 14], "process": [2, 3, 4, 5, 6, 9, 10, 11, 12, 14], "approach": [2, 5, 12, 14, 15], "ensur": [2, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "access": [2, 3, 4, 5, 9, 10, 11, 12, 14, 15, 16], "invit": 2, "interest": 2, "parti": [2, 3, 4, 5, 6, 11, 12, 15, 16], "particip": [2, 3, 4, 14], "consequ": 2, "stakehold": [2, 14], "nation": [2, 3, 4, 5, 6, 11, 12, 16], "intern": [2, 3, 9, 10, 11, 15, 16], "commun": [2, 4, 6, 7, 9, 10, 11], "member": [2, 4, 5, 6, 9, 10, 11, 12, 14], "onli": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "encourag": 2, "also": [2, 3, 5, 6, 9, 10, 11, 12, 14, 15, 16], "heartili": 2, "welcom": 2, "refin": 2, "technic": [2, 3, 4, 6, 7, 9, 10, 11, 14], "rule": [2, 3, 4, 5, 14], "sever": [2, 9, 10, 14], "method": [2, 6, 7, 9, 10, 11, 15, 16], "avail": [2, 9, 10, 14, 15, 16], "github": 2, "issu": [2, 3, 5, 6, 9, 10, 11, 12, 14, 15, 16], "By": [2, 5, 16], "you": 2, "can": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "seek": 2, "clarif": 2, "propos": 2, "enhanc": [2, 3, 4, 9, 10, 12, 14], "report": [2, 11, 14], "editori": 2, "typo": 2, "If": [2, 5, 6, 7, 9, 10, 11, 14, 15], "work": 2, "we": [2, 5], "draft": [2, 5, 6, 11, 14], "pull": 2, "request": [2, 4, 12, 14, 16], "link": [2, 6, 9, 10, 11, 15], "repres": [2, 5, 6, 7, 9, 10, 14, 15, 16], "activ": [2, 7, 9, 11, 12, 14, 16], "typic": [2, 6, 12], "alwai": [2, 3, 12, 14], "base": [2, 5, 6, 7, 9, 10, 11, 12, 13, 14, 16], "discuss": [2, 6, 15], "onc": [2, 6, 9, 10, 15, 16], "facilit": [2, 14], "review": [2, 16], "chang": [2, 5, 9, 10, 11, 14], "befor": [2, 3, 6, 14], "thei": [2, 3, 9, 10, 11, 12, 14, 15], "merg": 2, "main": [2, 5, 6, 11, 12, 14, 15], "branch": 2, "version": [2, 5, 7, 9, 15, 16], "corrent": 2, "italia": 2, "slack": 2, "channel": [2, 7, 9, 11], "messag": [2, 6, 7, 9, 10, 11], "applic": [2, 3, 6, 9, 10, 11, 12, 13, 14, 15, 16], "design": [2, 3, 12, 14], "busi": 2, "connect": [2, 5, 6, 7, 9, 11, 13, 16], "peopl": [2, 12], "inform": [2, 3, 5, 7, 9, 10, 11, 12, 14, 15, 16], "need": [2, 6, 9, 10, 11, 12, 14, 15, 16], "from": [2, 3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "public": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "administr": [2, 5, 11, 12, 14], "technician": 2, "student": 2, "citizen": [2, 3, 5, 12], "ha": [2, 4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "everyon": 2, "join": 2, "free": 2, "http": [2, 3, 4, 5, 7, 13, 14, 15, 16], "where": [2, 5, 6, 9, 10, 11, 12, 14, 15], "learn": 2, "about": [2, 4, 9, 10, 11, 12, 16], "partak": 2, "would": [2, 6, 12], "like": [2, 3, 14], "thank": [2, 14], "individu": [2, 12, 14], "comment": 2, "concern": [2, 4, 14], "idea": 2, "some": [2, 5, 6, 9, 10, 11, 14], "which": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "substanti": [2, 3], "implement": [2, 3, 5, 6, 7, 9, 10, 11, 14, 15], "profil": [2, 3, 5, 6, 7, 9, 11, 13, 14, 15], "set": [2, 4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "alen": 2, "horvat": 2, "amir": 2, "sharif": 2, "andrea": 2, "prosseda": 2, "emanuel": 2, "de": 2, "cupi": 2, "emiliano": 2, "vernini": 2, "francesco": 2, "grauso": 2, "marino": 2, "ventola": 2, "giada": 2, "sciarretta": 2, "giusepp": 2, "marco": 2, "klaa": 2, "wierenga": 2, "kristina": 2, "yasuda": [2, 13], "leif": 2, "johansson": 2, "lorenzo": 2, "cerini": 2, "marta": 2, "sciunnach": 2, "michel": 2, "silletti": 2, "nicola": 2, "saitto": 2, "niel": 2, "van": 2, "dijk": 2, "oliv": 2, "terbu": [2, 5, 13], "paul": 2, "bastien": 2, "pasqual": 2, "rose": 2, "peter": 2, "altmann": 2, "riccardo": 2, "iaconelli": 2, "roland": 2, "hedberg": 2, "salvator": 2, "laiso": 2, "manfredi": 2, "stefano": 2, "alifuoco": 2, "takahiko": 2, "kawasaki": 2, "torsten": 2, "lodderstedt": [2, 13], "vladimir": 2, "duzhinov": 2, "anyon": 2, "been": [2, 6, 11, 15], "forgotten": 2, "pleas": [2, 4, 14, 16], "accept": [2, 6, 7, 9, 10, 11], "our": 2, "apolog": 2, "modif": [2, 14], "page": [2, 9, 10, 16], "via": [2, 6, 7, 9, 14, 15], "com": [2, 9, 10, 15], "eudi": [2, 6, 7, 9, 10, 13, 16], "doc": [2, 6], "brief": 2, "offer": [2, 6, 9, 10, 15, 16], "dure": [2, 3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "event": 2, "period": [2, 9, 10, 11, 14, 15], "have": [2, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "opportun": 2, "again": [2, 9, 10], "make": [2, 5, 6, 14], "amend": 2, "soon": 2, "possibl": [2, 5, 7, 9, 10, 14], "word": [3, 13], "requir": [3, 4, 5, 6, 7, 9, 10, 13], "shall": [3, 5, 6, 7, 9, 11], "should": [3, 5, 6, 7, 9, 10, 11, 14, 15], "mai": [3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "option": [3, 5, 7, 9, 10, 12], "interpret": 3, "describ": [3, 5, 6, 7, 9, 10, 11, 14, 15], "bcp": [3, 13], "14": [3, 6, 9, 10, 13, 14, 15], "rfc2119": 3, "rfc8174": [3, 13], "when": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "appear": 3, "capit": 3, "shown": [3, 6, 9, 10], "here": [3, 15, 16], "user": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "trust": [3, 4, 5, 6, 9, 10, 12, 15, 16], "servic": [3, 4, 5, 6, 11, 12, 14, 15, 16], "model": [3, 4, 6, 7, 9, 10, 12, 15, 16], "framework": [3, 4, 6, 9, 10, 13, 14, 16], "attribut": [3, 4, 5, 7, 9, 10, 11, 14, 16], "electron": [3, 4, 14, 16], "attest": [3, 4, 5, 6, 9, 10, 12], "provid": [3, 4, 5, 6, 7, 9, 10, 11, 12, 14, 15], "tsp": [3, 14], "person": [3, 5, 6, 9, 10, 11, 12, 14, 16], "identif": [3, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "data": [3, 4, 6, 7, 9, 10, 11, 12, 13, 14, 15, 16], "pid": [3, 4, 9, 10, 11, 14, 16], "revoc": [3, 4, 6, 9, 10, 14, 15, 16], "qualifi": [3, 14, 16], "qtsp": [3, 14], "eaa": [3, 4, 9, 14, 16], "eida": [3, 4, 5, 6, 7, 9, 12, 13, 14], "arf": [3, 4, 5, 6, 13, 14, 15], "definit": [3, 9, 10, 11, 12, 13, 14, 16], "further": [3, 4, 6, 7, 9, 11, 14, 15, 16], "insight": 3, "topic": [3, 15], "complement": [3, 14], "interact": [3, 6, 9, 10, 12, 14, 15, 16], "compon": [3, 4, 6, 7, 9, 10, 14], "accredit": [3, 14, 15], "bodi": [3, 6, 9, 10, 11, 14, 15], "entiti": [3, 4, 11, 15, 16], "feder": [3, 4, 6, 9, 10, 13, 15, 16], "author": [3, 4, 5, 11, 12, 13, 14, 15, 16], "respons": [3, 4, 13, 14, 15, 16], "manag": [3, 6, 11, 12, 14, 15, 16], "verif": [3, 6, 7, 9, 11, 12, 14, 15, 16], "certif": [3, 5, 11, 12, 14, 15], "ecosystem": [3, 4, 12, 14, 16], "role": [3, 4, 11, 12, 16], "ident": [3, 4, 6, 9, 10, 11, 14, 16], "recogn": [3, 12], "state": [3, 4, 6, 9, 10, 12, 14, 15], "identifi": [3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "issuanc": [3, 4, 5, 9, 10, 11, 13, 14, 16], "credenti": [3, 4, 5, 7, 9, 10, 12, 13, 14, 15, 16], "sign": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "whose": [3, 9, 10, 15], "integr": [3, 5, 6, 12, 14, 15, 16], "cryptograph": [3, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "verifi": [3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16], "its": [3, 6, 7, 9, 10, 11, 14, 15, 16], "issuer": [3, 4, 5, 7, 9, 10, 11, 12, 14, 16], "It": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "known": [3, 4, 6, 7, 9, 10, 14, 15, 16], "A": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "govern": [3, 12, 14], "guidelin": [3, 4, 15], "administ": 3, "directli": [3, 6, 9, 10, 15], "through": [3, 5, 6, 7, 9, 10, 11, 14, 15], "intermediari": [3, 9, 10, 14], "statu": [3, 4, 5, 6, 7, 14, 15, 16], "elig": [3, 4], "evalu": [3, 4, 6, 9, 10, 16], "perform": [3, 6, 7, 9, 10, 15, 16], "oversight": 3, "instanc": [3, 4, 5, 6, 7, 9, 10, 14], "solut": [3, 4, 6, 10, 14], "instal": [3, 6, 15, 16], "mobil": [3, 4, 6, 7, 9, 10, 12, 15, 16], "devic": [3, 4, 6, 11, 12, 14, 15, 16], "control": [3, 5, 6, 12, 14, 16], "specif": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "who": [3, 6, 11, 12, 14], "sole": 3, "owner": [3, 5, 12, 14], "fulli": 3, "autonom": [3, 14], "privat": [3, 5, 6, 7, 9, 10, 11, 14, 15], "conform": [3, 6], "prove": [3, 5, 12, 14], "compliac": 3, "hardwar": [3, 9, 10, 14, 15], "back": [3, 11, 15], "environ": [3, 9, 10, 15, 16], "creat": [3, 6, 7, 9, 10, 11, 15], "store": [3, 5, 6, 7, 9, 11, 12, 14, 15, 16], "wscd": [3, 15, 16], "associ": [3, 11, 14, 15, 16], "proof": [3, 4, 5, 6, 9, 10, 12, 13, 14, 15, 16], "differ": [3, 5, 6, 7, 9, 10, 11, 12, 14, 15], "wai": [3, 5, 6], "larg": [3, 6], "depend": [3, 5, 6, 9, 10, 11, 15, 16], "remot": [3, 4, 14, 15], "hsm": [3, 15], "extern": [3, 4, 14, 15], "smart": [3, 15], "card": [3, 15], "uicc": 3, "nativ": [3, 15], "io": [3, 15, 16], "enclav": [3, 15, 16], "android": [3, 15, 16], "keystor": [3, 15], "strongbox": [3, 15], "relat": [3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "revok": [3, 6, 11, 12, 14, 15], "manufactur": [3, 15], "app": [3, 6, 7, 9, 15, 16], "well": [3, 6, 9, 10, 11, 14, 15, 16], "certifi": [3, 6, 14, 15, 16], "storag": [3, 6, 11, 14, 15], "within": [3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "dedic": [3, 14], "s": [3, 4, 5, 7, 9, 10, 11, 12, 13, 14, 15, 16], "import": 3, "note": [3, 4, 6, 14], "terminolog": 3, "vari": [3, 14], "among": [3, 11, 14], "pair": [3, 5, 6, 7, 9, 15], "remain": [3, 9, 10, 12, 14], "valid": [3, 4, 5, 6, 7, 9, 10, 11, 12, 14, 15], "entir": [3, 6, 9, 10, 14, 15, 16], "durat": 3, "life": [3, 11], "master": 3, "confin": 3, "os": 3, "domain": [3, 5, 11, 14], "arbitrari": 3, "payload": [3, 4, 5, 6, 9, 10, 11, 15], "Their": 3, "primari": [3, 6, 7, 9, 16], "uniqu": [3, 5, 6, 9, 10, 11, 14, 15, 16], "each": [3, 5, 6, 7, 9, 10, 11, 14, 15, 16], "tag": [3, 5, 15], "system": [3, 6, 12, 14, 15, 16], "util": [3, 5, 7, 9, 10, 15, 16], "gain": [3, 9, 10], "oem": [3, 15], "your": 3, "confid": [3, 7, 9], "being": [3, 5, 6, 7, 9, 12, 15], "qeaa": [3, 16], "form": [3, 5, 6, 9, 10, 11, 12, 14, 15, 16], "possess": [3, 4, 5, 6, 9, 10, 12, 13, 14, 15, 16], "reli": [3, 4, 5, 6, 11, 12, 15, 16], "natur": [3, 5, 6, 11, 15, 16], "legal": [3, 11, 12, 14, 16], "submiss": [3, 9, 10], "mechan": [3, 4, 5, 9, 10, 11, 15, 16], "see": [3, 5, 6, 7, 9, 11, 14, 15], "complianc": [3, 5, 6, 9, 10, 14, 16], "regulatori": [3, 14], "cannot": [3, 9, 10, 11, 14], "repudi": [3, 4, 11], "over": [3, 5, 7, 9, 11, 12, 14, 16], "time": [3, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "particular": [3, 6, 11, 14, 15], "layer": [3, 13], "architectur": [3, 4, 6, 13, 14, 16], "establish": [3, 6, 7, 9, 10, 12, 14, 16], "reliabl": [3, 5, 11, 14, 15, 16], "how": [3, 4, 5, 7, 9, 11, 14, 15], "maintain": [3, 9, 10, 12, 14, 16], "outlin": [3, 5, 6, 7, 9, 10, 11, 14, 16], "procedur": [3, 11, 12, 14], "other": [3, 4, 5, 6, 9, 10, 11, 12, 14, 15, 16], "level": [3, 4, 7, 9, 10, 11, 12, 13, 15, 16], "exchang": [3, 6, 7, 9, 10, 11, 12, 13, 14, 16], "assur": [3, 9, 10, 13, 16], "degre": 3, "vet": 3, "present": [3, 4, 5, 6, 7, 9, 10, 12, 13, 14, 15, 16], "same": [3, 5, 6, 9, 10, 11, 14, 16], "whom": [3, 12], "wa": [3, 5, 6, 9, 10, 11, 15, 16], "holder": [3, 5, 11, 12, 15], "bind": [3, 6, 9, 10, 14, 15], "abil": [3, 12, 14, 16], "legitim": [3, 5], "part": [3, 6, 7, 9, 10, 14, 15, 16], "third": [3, 11, 14, 15], "oid4vp": [3, 9, 10], "openid": [3, 5, 6, 9, 10, 13, 14, 15, 16], "vc": [3, 5, 6, 9, 10, 13, 14, 15], "vp": [3, 9, 10], "api": [3, 4, 6, 9, 10, 15, 16], "program": 3, "interfac": [3, 6, 11, 14, 16], "loa": [3, 6, 16], "aal": [3, 9, 10, 15], "csrc": 3, "gov": [3, 6, 7, 9, 10], "glossari": 3, "authenticator_assurance_level": 3, "european": [4, 12], "parliament": 4, "adopt": 4, "revis": 4, "regul": [4, 11, 12, 14, 16], "introduc": 4, "signific": [4, 12, 14], "innov": 4, "updat": [4, 5, 9, 10, 11, 14], "mark": [4, 5, 6, 9, 10, 14], "pivot": 4, "advanc": [4, 12, 14], "eu": [4, 5, 9, 10, 14, 15, 16], "strategi": [4, 9, 10, 14], "aim": [4, 5], "interoper": [4, 6, 9, 10, 12, 13, 14], "usabl": [4, 15], "across": [4, 12], "For": [4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "detail": [4, 5, 7, 11, 12, 14, 15, 16], "resourc": [4, 5, 6, 9, 10, 13, 14], "legisl": [4, 16], "offici": 4, "commiss": 4, "websit": [4, 14, 16], "itali": 4, "launch": [4, 15], "direct": 4, "full": [4, 5, 12, 16], "align": [4, 14], "complet": [4, 9, 10, 12, 16], "purpos": [4, 5, 9, 10, 11, 12, 16], "defin": [4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "involv": [4, 6, 9, 10, 11, 12, 14, 15], "accord": [4, 5, 6, 7, 9, 10, 11, 14, 15, 16], "infrastructur": [4, 12], "realiabl": [4, 16], "mdl": [4, 5, 7, 9, 10], "cbor": [4, 6, 7, 9, 10, 11], "format": [4, 5, 6, 7, 9, 10, 11, 13, 14, 15, 16], "sd": [4, 6, 9, 10, 11, 13, 14, 15], "jwt": [4, 6, 9, 10, 11, 13, 14, 15, 16], "openid4vci": [4, 6, 13, 14], "openid4vp": [4, 6, 9, 10, 13, 14], "pseudonym": 4, "siopv2": [4, 9, 10], "backup": 4, "restor": 4, "self": [4, 5], "sovereign": 4, "ssi": 4, "languag": [4, 14], "convent": 4, "term": [4, 14, 16], "acronym": 4, "properti": [4, 5], "endpoint": [4, 11, 15], "configur": [4, 15, 16], "common": 4, "anchor": [4, 6, 16], "leav": 4, "intermedi": [4, 6, 12, 16], "metadata": [4, 5, 6, 9, 10, 11, 12, 15], "type": [4, 5, 6, 7, 9, 10, 11, 15, 16], "statement": [4, 6, 9, 10, 15, 16], "offlin": [4, 7, 9, 11], "long": [4, 6, 11], "live": [4, 15], "privaci": [4, 6, 9, 10, 11, 12, 15, 16], "remark": 4, "consider": 4, "decentr": 4, "lifecycl": [4, 15], "transit": [4, 14, 15], "return": [4, 5, 6, 7, 9, 10, 11, 14, 15], "deactiv": 4, "header": [4, 5, 6, 9, 10, 11, 14, 15], "wallet_provid": [4, 14], "federation_ent": [4, 6, 9, 10, 14], "view": [4, 6, 16], "dynam": [4, 6, 14], "registr": [4, 6, 14], "q": [4, 9, 10, 14, 16], "mdoc": [4, 6, 10, 11], "namespac": [4, 7, 9, 10], "object": [4, 6, 7, 11, 13, 14, 15], "high": [4, 7, 9, 10, 11, 13, 15, 16], "flow": [4, 14, 15], "push": [4, 9, 10], "par": 4, "token": [4, 9, 10, 13, 15, 16], "uri": [4, 6, 13], "post": [4, 6, 11, 14, 15], "cross": [4, 14], "check": [4, 6, 7, 11, 14, 15], "redirect": [4, 6], "error": [4, 6, 11, 15], "proxim": 4, "engag": [4, 16], "session": [4, 6, 10], "termin": [4, 10, 15], "case": [4, 5, 6, 9, 10, 14, 15], "rst": 4, "librari": [4, 15], "code": [4, 5, 6, 7, 9, 10, 11, 14, 15], "snippet": 4, "algorithm": [4, 5, 6, 9, 10, 11, 13, 14, 15, 16], "contribut": 4, "acknowledg": 4, "law": [5, 11], "scope": [5, 6, 9, 10, 11, 14, 15], "allow": [5, 6, 7, 9, 10, 11, 12, 14, 15, 16], "protect": [5, 6, 9, 10, 14], "italian": [5, 6, 14], "ones": 5, "current": [5, 6, 9, 10, 11, 13, 14, 15], "first": [5, 6, 9, 10, 15], "date": [5, 6, 11, 13, 14, 15], "birth": [5, 6], "taxpay": 5, "number": [5, 6, 9, 10, 11, 14, 15, 16], "select": [5, 6, 9, 10, 15, 16], "disclosur": [5, 9, 10, 14], "specifi": [5, 6, 7, 9, 10, 15, 16], "02": [5, 7, 9], "_sd_alg": 5, "5": [5, 6, 7, 9, 10, 11, 14, 15], "them": [5, 9, 10, 11, 12, 14, 15, 16], "disclos": [5, 6, 7, 9, 12, 14], "indic": [5, 6, 7, 9, 10, 13, 14], "digest": 5, "salt": [5, 7, 9], "omit": [5, 6], "instead": [5, 12, 14], "respect": [5, 6, 14, 16], "decoi": 5, "arrai": [5, 6, 7, 9, 10, 11, 14, 15, 16], "new": [5, 6, 7, 9, 10, 11, 12, 14, 15], "_sd": [5, 9, 10], "map": [5, 6, 9, 10, 14], "calcul": [5, 6, 7, 9], "random": [5, 6, 7, 9, 10, 15], "sent": [5, 6, 9, 10], "togeth": [5, 6, 7, 9, 11], "combin": [5, 14], "order": [5, 9, 10, 15], "seri": 5, "base64url": [5, 6, 11, 15], "encod": [5, 6, 7, 9, 10, 11, 15], "separ": [5, 6, 9, 10], "next": 5, "singl": [5, 6, 14, 15], "tild": 5, "charact": [5, 6], "n": [5, 6, 9, 10, 13], "more": [5, 6, 7, 9, 10, 11, 14, 16], "jose": [5, 6, 11, 15], "mandatori": [5, 6, 7, 9, 11], "typ": [5, 6, 9, 10, 11, 14, 15, 16], "latest": [5, 14], "rfc7515": [5, 6, 13], "9": [5, 6, 7, 9, 10, 14, 15], "kid": [5, 6, 9, 10, 11, 14, 15, 16], "8": [5, 6, 7, 9, 10, 11, 14, 15], "trust_chain": [5, 9, 10, 14, 15], "json": [5, 6, 9, 10, 11, 13, 14, 15, 16], "oidc": [5, 6, 9, 10, 12, 13, 14, 15], "fed": [5, 9, 10, 13, 14, 15], "whether": [5, 6, 9, 10, 14, 15], "nsd": 5, "iss": [5, 6, 9, 10, 11, 14, 15, 16], "url": [5, 6, 9, 10, 14, 15, 16], "string": [5, 6, 7, 9, 10, 14, 15, 16], "rfc7519": [5, 6, 13], "sub": [5, 6, 7, 9, 10, 14, 15, 16], "thumbprint": [5, 6, 11, 13, 15, 16], "jwk": [5, 6, 9, 10, 11, 13, 14, 15, 16], "cnf": [5, 6, 9, 10, 11, 15], "iat": [5, 6, 9, 10, 11, 14, 15, 16], "unix": [5, 6, 9, 10, 11, 14, 15, 16], "timestamp": [5, 6, 9, 10, 11, 13, 14, 15, 16], "numericd": [5, 6, 14], "7519": [5, 6, 9, 10, 11, 13, 14, 15], "6": [5, 6, 7, 9, 10, 14, 15], "exp": [5, 6, 9, 10, 11, 14, 15, 16], "expiri": [5, 6, 11, 14, 15], "read": 5, "status_attest": [5, 11], "credential_hash_alg": [5, 11], "bound": [5, 6, 11, 14, 15], "oauth": [5, 6, 9, 10, 11, 13, 15, 16], "01": [5, 7, 9, 11], "materi": [5, 6, 7, 9, 11], "confirm": [5, 6, 15], "declar": 5, "recipi": 5, "rfc7800": [5, 11, 13], "vct": 5, "obtain": [5, 6, 7, 9, 10, 11, 14, 15, 16], "personidentificationdata": [5, 6], "addit": [5, 6, 11, 14, 15], "ad": [5, 6, 9, 10], "given_nam": [5, 6, 7, 9, 10, 14], "core": [5, 6, 14], "0": [5, 6, 7, 9, 10, 13, 14, 15, 16], "family_nam": [5, 6, 7, 9, 10, 14], "birth_dat": [5, 6, 7, 9], "unique_id": [5, 6, 9, 10], "id": [5, 6, 9, 10, 14, 16], "anpr": 5, "given": [5, 6, 9, 10, 11, 14, 15], "regist": [5, 6, 15], "resid": [5, 9, 10, 11], "popul": [5, 9, 10], "tax_id_cod": [5, 6], "tax": [5, 6], "en": [5, 6], "319": 5, "412": 5, "tinit": 5, "italiantaxidentificationnumb": 5, "In": [5, 6, 7, 9, 10, 11, 12, 14, 15], "org": [5, 6, 7, 9, 10, 11, 14, 15, 16], "nzblsxh8udccd7nowxfzafhkxzsrgc9x": 5, "1683000000": 5, "1883000000": 5, "xxxxxxxx": 5, "xxxx": 5, "xxxxxxxxxxxx": 5, "mario": 5, "rossi": 5, "1980": 5, "10": [5, 6, 7, 9, 10, 13, 14, 15], "xxxxxxxxxxxxxxxx": 5, "correspond": [5, 6, 7, 9, 10, 11, 14, 15], "verson": 5, "db67gl7ck3tfiiaf7n6_7shvqk0mdymeqcogglkuaaw": 5, "nehrderpynlhy3m5wldwtwz2auhm": 5, "eyjhbgcioijsuzi1niisimtpzci6": 5, "ikjydmzybg5oqu11sfiwn2fqvw1b": 5, "7wg4nt6k26_r3975zcwnvwgoha7b988_3": 5, "vjzbzf6yc": 5, "noxvzjujg667ibdedwmr6tz46x": 5, "jchkwivxmafv43yc": 5, "tk2rgupyoxzcx0vv5hbn9u5m2mhlwbt41qgwllxcnu8": 5, "uhchpgtnf2bj1fvafbby1rnf7wxkxelfj5a4vsj2fo4": 5, "q6tqnxau97tu": 5, "mqudg0fsamlgzdsumumk6a2s3bcsc0": 5, "wyfxvqq9bospt7tn4shoi4e48p19ava1ktw5zf0": 5, "fc": 5, "pidprovid": 5, "kty": [5, 6, 7, 9, 10, 14, 15, 16], "ec": [5, 6, 7, 9, 10, 14, 15, 16], "crv": [5, 6, 7, 9, 10, 14, 15, 16], "x": [5, 6, 7, 9, 10, 11, 14, 15, 16], "tcaer19zvu3ohf4j4w4vfsvohip1ilildls7vcegemc": 5, "y": [5, 6, 7, 9, 10, 13, 14, 15, 16], "zxjiwwbzmqghvwkvq4hbsiirsvfuecce6t4jt9f2hzq": 5, "wyi1n212ewnuadv5wknys0xanxhuzlv3iiwgimlhdciside2odmwmdawmdbd": 5, "57mvycth5yzcrklz5xnfuw": 5, "wyjrdwnyqm1sb19otwfjrky1odvsemfriiwginvuaxf1zv9pzcisicj4ehh4": 5, "ehh4ec14ehh4lxh4ehgtehh4ec14ehh4ehh4ehh4ehgixq": 5, "kucrbmlo_hmaiff585rzaq": 5, "wyjove5sb09pdvzwunrgnknfenrkovp3iiwgimdpdmvux25hbwuilcaitwfi": 5, "aw8ixq": 5, "ntnrooiuvvrtf6ceztd9zw": 5, "wyjgrfntugdnekdcvxdrteheu0u2d1friiwgimzhbwlsev9uyw1liiwgiljv": 5, "c3npil0": 5, "fdsspggzgbuwqlhdse6wqq": 5, "wyjlwjhlnxdwrxredmixemltuee0rhpbiiwgimjpcnrox2rhdguilcaimtk4": 5, "mc0wms0xmcjd": 5, "kz8e5wvetdvb1zispa4dza": 5, "wyjwwjvnunlpehbwv1p1sexvsi15aljniiwginrhef9pzf9jb2rliiwgilrj": 5, "tklulvhywfhywfhywfhywfhywfgixq": 5, "pz5mryoxpvwzuhloj": 5, "yjrg": 5, "eyjhbgcioiairvmyntyilcaidhlwijogimv4yw1wbgurc2qtand0in0": 5, "eyjfc2qioibb": 5, "ijdxrzruvdzlmjzfujm5nzv6y3duvndnb0hbn2i5odhfmy12snpiwmy2wwmilcaitk94": 5, "vnpqvupnnjy3aujkzur3bxi2dfo0nlgtamnos3djvnhnqwz2ndn5yyisicjuszjsz3vq": 5, "ww9yekn4mhz2nwhitjl1nu0ybuhsv0j0ndfxr1dstfhdtnu4iiwgilviq2hwr3rorjji": 5, "ajfgdkfmqmj5mxjuzjdxwgt4zwxgsjvhnhztajjgtzqilcaictzucw54yxu5n3r1lu1x": 5, "vurnmgztqw1mr1pku3vnvu1rnmeyczniy3ndmcisicj3ewz4vnfxoujvc1bun3ronfni": 5, "t0k0rtq4ude5yvzbmwt0vzvazjbflwzjil0sicjlehaioiaxodgzmdawmdawlcaiaxnz": 5, "ijogimh0dhbzoi8vcglkchjvdmlkzxiuzxhhbxbszs5vcmcilcaic3viijogik56ykxz": 5, "wgg4durdy2q3bm9xwezaqwzia3hac1jhqzlycyisicjzdgf0dxmioib7inn0yxr1c19h": 5, "dhrlc3rhdglvbii6ihsiy3jlzgvudglhbf9oyxnox2fszyi6icjzagetmju2in19lcai": 5, "dmn0ijogilblcnnvbklkzw50awzpy2f0aw9urgf0ysisicjfc2rfywxnijoginnoys0i": 5, "ntyilcaiy25mijogeyjqd2sioib7imt0esi6icjfqyisicjjcnyioiaiuc0yntyilcai": 5, "eci6icjuq0ffuje5wnz1m09irjrqnfc0dmztvm9isvaxsuxpbersczd2q2vhzw1jiiwg": 5, "inkioiaiwnhqavdxylpnuudivldlvle0agjtswlyc1zmdwvjq0u2ddrqvdlgmkhausj9": 5, "fx0": 5, "a36ovweqpcppkyhx75dg": 5, "hiib7zqklfmmcaixlpocmel1cxlx": 5, "ntzbfn_kdn0nlj": 5, "ymlay4xseetmic_scltxdg": 5, "wyi1n212ewnuadv5wknys0xanxhuzlv3iiwgimlhdcisi": 5, "de2odmwmdawmdbd": 5, "wyjrdwnyqm1sb19otwfjrky1odvsemfriiwginvuaxf1zv9pzci": 5, "icj4ehh4ehh4ec14ehh4lxh4ehgtehh4ec14ehh4ehh4ehh4ehgixq": 5, "wyjove5sb09pd": 5, "vzwunrgnknfenrkovp3iiwgimdpdmvux25hbwuilcaitwfyaw8ixq": 5, "wyjgrfntugdnek": 5, "dcvxdrteheu0u2d1friiwgimzhbwlsev9uyw1liiwgiljvc3npil0": 5, "wyjlwjhlnxdwrx": 5, "redmixemltuee0rhpbiiwgimjpcnrox2rhdguilcaimtk4mc0wms0xmcjd": 5, "wyjwwjvnu": 5, "nlpehbwv1p1sexvsi15aljniiwginrhef9pzf9jb2rliiwgilrjtklulvhywfhywfhyw": 5, "fhywfhywfgixq": 5, "disabilitycard": 5, "document_numb": [5, 7, 9], "xxxxxxxxxx": 5, "expiry_d": [5, 7, 9], "2024": [5, 7, 9], "constant_attendance_allow": 5, "true": [5, 6, 7, 9, 10], "previou": [5, 6, 9, 10, 11, 15], "decod": [5, 6, 9, 10, 11], "both": [5, 7, 9, 10, 11, 12, 14, 15, 16], "d126a6a856f7724560484fa9dc59d195": 5, "lla7mch": 5, "ywwynzffwzsjbggie096fn8d60a": 5, "ml3sgo": 5, "afrjarpztmanxyu5iiwpifoaxjcnk": 5, "_h1ejt7mymcgm": 5, "i9xhlephyv8om35l3nf1mkqfpwud7ofpramsasx0": 5, "5g": 5, "rhpkitz7bggpjnwx2sgvh_ov9vhrjz9hx_inxwbbz6o": 5, "wyjrdwnyqm1sb19otwfjrky1odvsemfriiwgimrvy3vtzw50x251bwjlcii": 5, "icjywfhywfhywfhyil0": 5, "wyjwwjvnunlpehbwv1p1sexvsi15aljniiwgimv4cglyev9kyxrliiwgijiw": 5, "mjqtmdetmdeixq": 5, "wyjqdfz1s0nwbjdivgnickfnx3nlvwjriiwginrhef9pzf9jb2rliiwgilrj": 5, "jtvukcpn7btchrag_seubq": 5, "wyjxrgtknkpztmhernzmudrzmwhrzhlbiiwgimnvbnn0yw50x2f0dgvuzgfu": 5, "y2vfywxsb3dhbmnliiwgdhj1zv0": 5, "wdkd6jsnhdfvlp4s1hqdya": 5, "ii1mtee3tunolvlxv1loekzmd1pzskjhr2lfmdk2zk44zdywys1tbdnzz28ilcain1dh": 5, "ng5unksynl9smzk3nxpjd25wd2dvsee3yjk4of8zlxzkemjazjzzyyisicjbrljkyvjq": 5, "wlrnyu54wxu1sulxuglmt0fysknusy1fadflsnq3txlty2dniiwgilrlmljndvbzb1h6": 5, "q3gwdny1agjooxu1ttjtsgxxqnq0mxfhv2xmwenodtgilcaivuhdahbhde5gmmjqmuz2": 5, "qwzcynkxcm5mn1dya3hlbezknwe0dlnqmkzpncisicjpovhitgvqshlwoe9nmzvsm25m": 5, "mu1lcwzwv3ven09gcfjhbvnbc1gwltvniiwginjougtjdho3qkdhcgpuv1gyu0dwsf9p": 5, "vjlwafjqejlief9jtlh3qmj6nm8ilcaid3lmefzxctlcb3nqvdd0tjrtse9jneu0ofax": 5, "owfwqtfrdfc1wmywrs1myyjdlcaizxhwijogmtg4mzawmdawmcwgimlzcyi6icjodhrw": 5, "czovl2lzc3vlci5legftcgxllm9yzyisicjzdwiioiaitnpithnyadh1renjzddub1di": 5, "rlpbzkhrefpzukddovhziiwginn0yxr1cyi6ihsic3rhdhvzx2f0dgvzdgf0aw9uijog": 5, "eyjjcmvkzw50awfsx2hhc2hfywxnijoginnoys0yntyifx0sicj2y3qioiairglzywjp": 5, "bgl0eunhcmqilcaix3nkx2fszyi6icjzagetmju2iiwgimnuzii6ihsiandrijogeyjr": 5, "dhkioiairumilcaiy3j2ijogilatmju2iiwgingioiaivenbrvixovp2dtnpsey0ajrx": 5, "nhzmu1zvselqmulmawxebhm3dknlr2vtyyisicj5ijogilp4amlxv2jatvfhsfzxs1zr": 5, "nghiu0lpcnnwznvly0nfnnq0alq5rjjiwleifx19": 5, "1koe6igfxgbb_jtaluhm_bgjmbi": 5, "j6b63rm_wjaowpobsipskjy7hbhd2a83eusi8jqbskvhjs3wcr0kd9ppzrw": 5, "wyi1n212": 5, "ewnuadv5wknys0xanxhuzlv3iiwgimlhdciside2odmwmdawmdbd": 5, "wyjrdwnyqm1sb19": 5, "otwfjrky1odvsemfriiwgimrvy3vtzw50x251bwjlciisicjywfhywfhywfhyil0": 5, "wyj": 5, "ove5sb09pdvzwunrgnknfenrkovp3iiwgimdpdmvux25hbwuilcaitwfyaw8ixq": 5, "wyjg": 5, "rfntugdnekdcvxdrteheu0u2d1friiwgimzhbwlsev9uyw1liiwgiljvc3npil0": 5, "wyjl": 5, "wjhlnxdwrxredmixemltuee0rhpbiiwgimjpcnrox2rhdguilcaimtk4mc0wms0xmcjd": 5, "wyjwwjvnunlpehbwv1p1sexvsi15aljniiwgimv4cglyev9kyxrliiwgijiwmjqtmd": 5, "tmdeixq": 5, "wyjxrgtknkpztmhernzmudrzmwhrzhlbiiwgi": 5, "mnvbnn0yw50x2f0dgvuzgfuy2vfywxsb3dhbmnliiwgdhj1zv0": 5, "18013": [5, 7, 9, 10], "standard": [5, 9, 10, 14, 15, 16], "born": 5, "drive": 5, "licens": [5, 11], "element": [5, 7, 9, 12, 15], "8949": 5, "concis": 5, "binari": 5, "represent": [5, 14], "europa": [5, 9, 10, 14], "eudiw": [5, 6, 9, 10, 14, 15], "revers": 5, "consist": [5, 6, 16], "while": [5, 9, 10, 12, 14, 15], "domest": [5, 7, 9], "tstr": [5, 7, 9], "text": [5, 6, 9, 10, 11, 15], "structur": [5, 7, 9, 10, 15, 16], "track": [5, 11, 15], "backward": 5, "compat": [5, 14, 16], "understand": 5, "evolv": [5, 14], "uint": [5, 7, 9], "unsign": 5, "int": 5, "mean": [5, 6, 11, 14], "ok": [5, 6, 9, 10, 15], "normal": 5, "bstr": [5, 7, 9], "byte": [5, 7, 9], "collect": [5, 9, 10, 14], "doctyp": [5, 6, 7, 9, 10], "issuersign": [5, 7, 9], "24": [5, 7, 9, 10, 11, 14, 15], "major": 5, "howev": [5, 6, 9, 10], "issuerauth": [5, 7, 9], "mso": [5, 11], "cose": 5, "sign1": 5, "abov": [5, 6, 7, 9, 12, 14], "devicesign": [5, 7, 9], "phase": [5, 6, 7, 9, 11, 12, 14, 15], "deviceauth": [5, 7, 9], "either": [5, 6, 9, 10], "devicesignatur": [5, 7, 9], "devicemac": 5, "two": [5, 6, 7, 9, 10, 11, 15], "empti": [5, 7, 9], "latter": [5, 6, 11], "issuersigneditembyt": [5, 7, 9], "bitsr": 5, "diagnost": [5, 7, 9], "digestid": [5, 7, 9], "integ": [5, 6], "valuedigest": [5, 7, 9], "issuersigneditem": [5, 7, 9], "minimum": [5, 6, 7, 9, 10, 11, 15], "16": [5, 6, 7, 9, 10, 14], "elementidentifi": [5, 7, 9], "elementvalu": [5, 7, 9], "issue_d": [5, 7, 9], "cbortag": 5, "1004": [5, 7, 9], "expir": [5, 6, 9, 10, 11, 14, 15, 16], "issuing_author": [5, 7, 9], "issuing_countri": [5, 7, 9], "alpha": 5, "countri": 5, "3166": 5, "field": [5, 6, 7, 9, 10, 11, 12, 13], "9052": 5, "unprotect": 5, "7": [5, 6, 7, 9, 10, 11, 14, 15], "rfc8152": 5, "x5chain": 5, "label": [5, 9, 10], "33": [5, 7, 9], "9360": 5, "carri": [5, 6, 9, 10, 12, 14], "referenc": [5, 6, 9, 10], "509": [5, 14], "abl": [5, 6, 11, 14, 15], "without": [5, 6, 11, 12, 14, 15], "invalid": [5, 6, 7, 9, 10, 11, 14], "mobilesecurityobject": 5, "mobilesecurityobjectbyt": 5, "validityinfo": [5, 7, 9], "datetim": [5, 11, 16], "validfrom": [5, 7, 9], "validuntil": [5, 7, 9], "digestalgorithm": [5, 7, 9], "group": 5, "devicekeyinfo": [5, 7, 9], "devicekei": [5, 7, 9], "keyauthor": 5, "keyinfo": 5, "devicesigneditem": 5, "af": 5, "a366737461747573006776657273696f6e63312e3069646f63756d656e747381a267646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316c6973737565725369676e6564a26a697373756572417574688443a10126a1182159021930820215308201bca003020102021404ad06a30c1a6dc6e93be0e2e8f78dcafa7907c2300a06082a8648ce3d040302305b310b3009060355040613025a45312e302c060355040a0c25465053204d6f62696c69747920616e64205472616e73706f7274206f66205a65746f706961311c301a06035504030c1349414341205a65746573436f6e666964656e73301e170d3231303932393033333034355a170d3232313130333033333034345a3050311a301806035504030c114453205a65746573436f6e666964656e7331253023060355040a0c1c5a65746f70696120436974792044657074206f662054726166666963310b3009060355040613025a453059301306072a8648ce3d020106082a8648ce3d030107034200047c5545e9a0b15f4ff3ce5015121e8ad3257c28d541c1cd0d604fc9d1e352ccc38adef5f7902d44b7a6fc1f99f06eedf7b0018fd9da716aec2f1ffac173356c7da3693067301f0603551d23041830168014bba2a53201700d3c97542ef42889556d15b7ac4630150603551d250101ff040b3009060728818c5d050102301d0603551d0e04160414ce5fd758a8e88563e625cf056bfe9f692f4296fd300e0603551d0f0101ff040403020780300a06082a8648ce3d0403020347003044022012b06a3813ffec5679f3b8cddb51eaa4b95b0cbb1786b09405e2000e9c46618c02202c1f778ad252285ed05d9b55469f1cb78d773671f30fe7ab815371942328317c59032ad818590325a667646f6354797065781865752e6575726f70612e65632e65756469772e7069642e316776657273696f6e63312e306c76616c6964697479496e666fa3667369676e6564c074323032332d30322d32325430363a32333a35365a6976616c696446726f6dc074323032332d30322d32325430363a32333a35365a6a76616c6964556e74696cc074323032342d30322d32325430303a30303a30305a6c76616c756544696765737473a2781865752e6575726f70612e65632e65756469772e7069642e31ac015820a7ffc6f8bf1ed76651c14756a061d662f580ff4de43b49fa82d80a4b80f8434a025820cd372fb85148700fa88095e3492d3f9f5beb43e555e5ff26d95f5a6adc36f8e6035820e67e72111b363d80c8124d28193926000980e1211c7986cacbd26aacc5528d48045820f7d062d662826ed95869851db06bb539b402047baee53a00e0aa35bfbe98265d0658202a132dbfe4784627b86aa3807cd19cfeff487aab3dd7a60d0ab119a72e736936075820bdca9e8dbca354e824e67bfe1533fa4a238b9ea832f23fb4271ebeb3a5a8f7200858202c0eaec2f05b6c7fe7982683e3773b5d8d7a01e33d04dfcb162add8bd99bee9a095820bfe220d85657ccec3c67e7db1df747e9148a152334bb6d4b65b273279bcc36ec0a582018e38144f5044301d6a0b4ec9d5f98d4cd950e6ea2c29b849cbd457da29b6ad30b58203c71d2f0efa09d9e3fbbdffd29204f6b292c9f79570aef72dd86c91f7a3aa5c50c582065743d58d89d45e52044758f546034fd13a4f994bc270cdfa7844f74eb3f4b6e0d5820b4a8eb5d523bffa17b41bda12ddc7da32ae1e5f7ff3dcc394a35401f16919bbf781b65752e6575726f70612e65632e65756469772e7069642e69742e31a10e58209d6c11644651126c94acdaf0803e86d4c71d15d3b2712a14295416734efd514d6d6465766963654b6579496e666fa1696465766963654b6579a401022001215820ba01aea44eee1e338eb2f04e279dbd51b34655783ee185150838c9a7a7c4db7122582025ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96f646967657374416c676f726974686d675348412d32353658400813c28fd62f2602cbc14724e5865733c44a0fca589b55c085ec9d5c725d6cce25ba0044439a3871a7b975a0994a85e79b705a9ac263b3fe899b0a93412ee8c96a6e616d65537061636573a2781865752e6575726f70612e65632e65756469772e7069642e3188d818586da4686469676573744944016672616e646f6d5820156df9227ad341eaa61aabd301106fd21bdc18820e01dfc16bcf5fecc447111b71656c656d656e744964656e7469666965726b6578706972795f646174656c656c656d656e7456616c7565d903ec6a323032342d30322d3232d818586fa4686469676573744944026672616e646f6d5820a3a1f13f05544d03a5b50b5fdb78465808393bcf3b7953a345fe28f820c7be0d71656c656d656e744964656e7469666965726d69737375616e63655f646174656c656c656d656e7456616c7565d903ec6a323032332d30322d3232d8185866a4686469676573744944036672616e646f6d5820852591f90f2c9ded57a03632e2c1322ab52a082a431e71a4149a6830c8f1ad0c71656c656d656e744964656e7469666965726f69737375696e675f636f756e7472796c656c656d656e7456616c7565624954d818587ca4686469676573744944046672616e646f6d5820d1d587b3512acce15c4f6b20944ceb002a464e4a158389788563408873c3fce571656c656d656e744964656e7469666965727169737375696e675f617574686f726974796c656c656d656e7456616c7565764d696e69737465726f2064656c6c27496e7465726e6fd8185864a4686469676573744944056672616e646f6d582094fdd7609c0e73dc8589b5cab11e1d9058cf8bff8a336da5f81fcba055396a0f71656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c7565654d6172696fd8185865a4686469676573744944066672616e646f6d5820660c0a7bf79e0e0261ca1547a4294fb808aa70738f424b13ab1b9440b566ae1371656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756565526f737369d818586ba4686469676573744944076672616e646f6d5820315c53491286488fa07f5c2ce67135ef5c9959c3469c99a14e9b6dc924f9eba571656c656d656e744964656e746966696572696269727468646174656c656c656d656e7456616c7565d903ec6a313935362d30312d3132d818587da4686469676573744944086672616e646f6d5820764ef39c9d01f3aa6a87f441603cfe853fba3cee3bc2c168bcc9e96271d6e06371656c656d656e744964656e74696669657269756e697175655f69646c656c656d656e7456616c7565781e78787878787878782d7878782d787878782d787878787878787878787878781b65752e6575726f70612e65632e65756469772e7069642e69742e3181d8185877a46864696765737449440d6672616e646f6d5820717df3f583b1484366c33a1f869f2b5d201d466a8b589c79ab1a2d85e595432571656c656d656e744964656e7469666965726d7461785f69645f6e756d6265726c656c656d656e7456616c75657554494e49542d585858585858585858585858585858": 5, "notat": [5, 7, 9, 13], "h": [5, 7, 9, 13], "30820215308201bca003020102021404ad30c": 5, "x_509": 5, "2023": [5, 7, 9, 13], "22t06": 5, "23": [5, 7, 9, 10, 14], "56z": 5, "22t00": 5, "00": 5, "00z": 5, "0f1571a97ffb799cc8fcdf2ba4fc2909929": 5, "0cdfe077400432c055a2b69596c90": 5, "e2382149255ae8e955af9b8984395": 5, "bbc77e6cca981a3ad0c3e544edf86": 5, "bb6e6c68d1b4b4ec5a2ae9206f5t4": 5, "f8a5966e6dac9970e0334d8f75e25": 5, "defdf1aa746718016ef1b94bfe5r6": 5, "f9ee4d36f67dbd75e23311ac1c29": 5, "ec2": [5, 7, 9], "elipt": 5, "coordin": [5, 7, 9], "p256": [5, 7, 9], "b820963964e53af064686dd9218303494a": 5, "coordiant": 5, "0a6da0af437e2943f1836f31c678d89298e9": 5, "ccordiant": 5, "1ad0d6a7313efdc38fcd765852fa2bd43debf48bf5a580d": 5, "e0b70bcefbd43686f345c9ed429343aa": 5, "22": [5, 7, 9, 10], "ae84834f389ee69888665b90a3e4fcc": 5, "960cb15a2ea9b68e5233ce902807aa95": 5, "9d3774bd5994ccfed248674b32a4f76a": 5, "ministero": [5, 6], "dell": [5, 6], "interno": [5, 6], "eb12193dc66c6174530cdc29b274381f": 5, "db143143538f3c8d41dc024f9cb25c9d": 5, "6059ff1ce27b4997b4ade1de7b01dc60": 5, "1956": [5, 7, 9], "12": [5, 6, 7, 9, 10, 14, 15], "53c15c57b3b076e788795829190220b4": 5, "xxx": 5, "11aa7273a2d2daa973f5951f0c34c2fba": 5, "tax_id_numb": 5, "xxxxxxxxxxxxxxx": 5, "relev": [6, 7, 9, 12, 14, 15, 16], "releas": [6, 9, 10, 12], "genuin": [6, 15], "product": [6, 16], "own": [6, 7, 9, 11, 12, 14, 15], "compliant": [6, 7, 9, 10, 15], "assess": [6, 14, 15], "cab": 6, "graphic": 6, "compos": [6, 9, 10, 15], "oidc4vci": [6, 11], "13": [6, 7, 9, 10, 11, 14, 15], "net": 6, "spec": [6, 14], "1_0": 6, "html": 6, "_": 6, "eid": 6, "saml2": [6, 12], "preexist": 6, "alreadi": [6, 15], "eg": [6, 9, 10, 14], "spid": [6, 9, 10, 14], "cie": 6, "notifi": [6, 9, 10, 11, 14], "act": [6, 9, 10, 14], "send": [6, 7, 9, 10, 11, 15], "get": [6, 9, 10, 14, 15, 16], "fig": 6, "show": [6, 9, 10, 11], "highlight": 6, "step": [6, 7, 9, 10, 11, 15, 16], "pictur": [6, 9, 10], "setup": [6, 7, 9], "start": [6, 11, 14, 15], "preliminari": 6, "out": [6, 7, 9, 11, 14], "assert": [6, 14, 15, 16], "share": [6, 14], "discoveri": [6, 9, 10, 14], "discov": 6, "e": [6, 7, 9, 11, 12, 14, 16], "g": [6, 11, 12, 13, 14, 16], "subordin": [6, 9, 10, 14], "inspect": 6, "filter": [6, 9, 10], "ani": [6, 7, 9, 10, 11, 12, 14, 15], "proxi": [6, 9, 10], "held": 6, "expand": 6, "assumpt": 6, "most": 6, "look": 6, "capabl": [6, 9, 10, 14, 16], "9126": [6, 11, 15], "pkce": 6, "7636": 6, "receiv": [6, 7, 9, 10, 14, 15], "protocol": [6, 7, 9, 10, 11, 13, 14, 15], "fresh": [6, 9, 10, 14], "previous": [6, 9, 10, 14], "hereaft": [6, 15], "prevent": [6, 9, 10, 15, 16], "swap": 6, "attack": [6, 15], "code_verifi": 6, "enough": 6, "entropi": [6, 9, 10], "unreserv": 6, "43": 6, "maximum": [6, 14], "impract": 6, "guess": 6, "client_assert": 6, "client": [6, 7, 9, 10, 14, 15, 16], "sinc": [6, 9, 10, 12, 14, 16], "less": [6, 7, 9, 14], "than": [6, 7, 9, 11, 14], "precis": 6, "second": [6, 7, 9, 10, 15], "authorization_detail": 6, "rar": 6, "9396": 6, "upon": [6, 9, 10, 14], "receipt": 6, "9101": [6, 9, 10], "retriev": [6, 7, 9, 10, 16], "jw": [6, 9, 10, 13, 14, 15, 16], "client_id": [6, 9, 10], "match": [6, 9, 10, 11], "aud": [6, 9, 10, 11, 15], "equal": [6, 9, 10, 14, 15], "reject": [6, 9, 10, 11], "request_uri": [6, 9, 10], "expos": [6, 9, 10, 14], "far": [6, 11], "minut": 6, "jti": [6, 9, 10, 11], "mitig": 6, "replai": [6, 15], "host": [6, 9, 10, 11, 15], "www": [6, 9, 10, 11, 15], "urlencod": [6, 9, 10, 11, 15], "response_typ": [6, 9, 10, 15], "thumprint": 6, "code_challeng": 6, "e9melhoa2owvfremtjguchaoek1t8urwbugjsstw": 6, "cm": 6, "code_challenge_method": 6, "s256": [6, 11], "client_assertion_typ": 6, "urn": [6, 15, 16], "ietf": [6, 15, 16], "param": [6, 15, 16], "wia": 6, "pop": [6, 11], "appli": [6, 9, 10, 14, 15], "vbexjksm45xphtanncig6mcyuu4jfgnzopgukvogg9c": [6, 9, 10, 15], "ad25868c": 6, "8377": 6, "479b": 6, "8094": 6, "46fb1e797625": 6, "1686645115": [6, 15], "1686652315": [6, 15], "fifyx03bnosd8m6gyqifnhnp9cm_sam9tc5nlloiirc": [6, 14], "1672422065": [6, 9, 10], "1672418465": [6, 9, 10], "ac80df576e7109686717bf50b869e882": 6, "fyziol9lf2cekunt2jzxilrdink0upcd": 6, "openid_credenti": 6, "credential_configuration_id": 6, "redirect_uri": [6, 9, 10], "suffici": [6, 9, 10], "adequ": [6, 16], "risk": [6, 12], "exce": 6, "ascii": 6, "due": [6, 9, 10, 11], "reason": [6, 11], "mani": 6, "phone": [6, 12], "market": 6, "still": [6, 14, 15], "do": [6, 14, 15], "restrict": [6, 9, 10, 12, 14], "1024": 6, "On": [6, 15], "slow": 6, "2g": 6, "caus": 6, "therefor": [6, 9, 10, 11, 12, 15], "advis": [6, 9, 10], "experi": [6, 9, 10, 12], "point": [6, 7, 9, 10, 15], "201": [6, 9, 10, 11, 15], "cach": 6, "bwc4jk": 6, "esc0w8acc191": 6, "y1ltc2": 6, "expires_in": 6, "60": 6, "treat": 6, "duplic": 6, "reload": 6, "refresh": 6, "agent": [6, 9, 10], "result": [6, 7, 9, 10, 11, 14], "submit": [6, 15], "pass": [6, 7, 9, 15], "3aietf": [6, 15], "3aparam": [6, 15], "3aoauth": [6, 15], "3arequest_uri": 6, "3abwc4jk": 6, "consent": [6, 7, 9, 10, 14], "perspect": [6, 9, 10, 14], "prior": 6, "transact": [6, 9, 10, 14, 16], "11": [6, 7, 9, 10, 14, 15], "6749": [6, 11, 13], "intend": [6, 7, 9, 10, 14], "9027": 6, "univers": [6, 15], "local": [6, 11, 14, 15], "so": [6, 7, 9, 11], "resolv": [6, 14], "302": [6, 9, 10], "found": [6, 9, 10, 11, 15], "locat": [6, 7, 9, 10], "splxlobezqqybys6wxsbia": 6, "3a": [6, 9, 10], "2f": [6, 9, 10], "2fpid": 6, "dpop": [6, 13], "instruct": 6, "9449": [6, 13], "certain": [6, 7, 9, 10], "misus": [6, 9, 10], "leak": 6, "stolen": 6, "repli": 6, "tokenrequest": 6, "eyj0exaioijkcg9wk2p3dcisimfszyi6ikvtmju2iiwiandrijp7imt0esi6ik": 6, "vdiiwieci6imw4dezyahgtmzr0vjnoukldukrzoxpda0rscejorjqyvvfvzldwqvdcr": 6, "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r1j": 6, "qsisimnydii6ilatmju2in19": 6, "eyjqdgkioiitqnddm0vtyzzhy2mybfrjiiwiahrtij": 6, "oiue9tvcisimh0dsi6imh0dhbzoi8vc2vydmvylmv4yw1wbguuy29tl3rva2vuiiwia": 6, "wf0ijoxntyymjyynje2fq": 6, "gxa6t8lp4vfrg8v": 6, "fdwp0a0zdrj8igimlvqrmuvwnqg": 6, "4ptflbdlxiossx0x7nvi": 6, "fnyjk70nfbv37xrzt3lg": 6, "grant_typ": [6, 15], "authorization_cod": 6, "dbjftjez4cvp": 6, "mb92k27uhbuju1p1r_ww1gfwfoejxk": 6, "cb": [6, 9, 10], "15": [6, 9, 10, 14], "success": [6, 9, 10, 11, 14], "c_nonc": 6, "unpredict": [6, 15], "later": [6, 9, 10], "18": [6, 9, 10, 14, 15], "countermeasur": 6, "against": [6, 14, 15], "200": [6, 9, 10, 15], "access_token": 6, "kz": 6, "8mxk1ealyznwh": 6, "lc": 6, "1fbao": 6, "4ljp": 6, "zspe_neo": 6, "gxu": 6, "token_typ": 6, "2677": 6, "tzign": 6, "snfbp": 6, "c_nonce_expires_in": 6, "86400": 6, "17": [6, 9, 10, 14, 15], "demonstr": [6, 7, 9, 13, 14, 16], "evid": [6, 7, 9, 11], "To": [6, 9, 10, 11, 15, 16], "conduct": 6, "explicitli": 6, "server": [6, 7, 9, 10, 11, 15], "nonc": [6, 9, 10, 15], "furthermor": [6, 11, 14, 16], "creation": [6, 9, 10, 11, 14, 15], "window": 6, "determin": [6, 9, 10, 12, 14, 16], "schema": [6, 14], "nmilcj5ijoiovzfngpmx09rx282nhpivfrsy3vosmfqsg10nny5verwcluwq2r2r": 6, "1jeqsisimnydii6ilatmju2in19": 6, "eyjqdgkioijlmwozvl9is2ljoc1mquvciiwiahrtij": 6, "oir0vuiiwiahr1ijoiahr0chm6ly9yzxnvdxjjzs5legftcgxllm9yzy9wcm90zwn0z": 6, "wryzxnvdxjjzsisimlhdci6mtu2mji2mjyxocwiyxroijoizlvieu8ycjjam0rantnf": 6, "c05yv0jimhhxwg9htnk1oulps0nbcwtzbvffbyj9": 6, "2ow9rp35yrqzhrtnp86l": 6, "ey71": 6, "optxrimpptoa1plemagr6pxhf8y6": 6, "yqyvnmcw6fy1dqd": 6, "jfxsyomxhajplja": 6, "credential_definit": 6, "proof_typ": 6, "eyjrawqioijkawq6zxhhbxbsztplym": 6, "l8tfrhx": 6, "34tv3hricrdy9zckdlpbhf42uqufwvawbf": 6, "9ve4jf_ok_o64zbttlcunjajhmt6v9tdvru0cdvgrda": 6, "And": 6, "0b434530": [6, 11], "e151": [6, 11], "4c40": [6, 11], "98b7": [6, 11], "74c75a5ef760": [6, 11], "1504699136": [6, 9, 10, 11], "19": [6, 9, 10, 14], "21": [6, 9, 10, 14], "suitabl": 6, "succe": 6, "proceed": 6, "proce": 6, "pragma": 6, "lupixvcwjk0eot4cxqe1nxk": 6, "wzwmhmn9oqp6yxx0a2l": 6, "fgff7": 6, "ukhla": 6, "insid": [6, 11, 15], "challeng": [6, 15], "per": [6, 11, 15], "iana": [6, 11, 15], "web": [6, 9, 10, 11, 13, 14, 15, 16], "registri": [6, 9, 10, 11, 12, 14, 15, 16], "symmetr": [6, 9, 10, 11, 15], "mac": [6, 9, 10, 11, 15], "7638": [6, 11, 13, 15], "section_3": [6, 11, 15], "assum": [6, 14], "implicit": 6, "side": [6, 9, 10], "end": [6, 7, 9, 10, 14], "alphanumer": 6, "32": [6, 9, 10], "authrequest": 6, "credential_configurations_support": 6, "reus": 6, "alon": 6, "collis": [6, 15], "resist": [6, 15], "under": [6, 9, 10, 11, 12, 14, 16], "uuid": [6, 7, 9, 11], "v4": [6, 11], "4122": [6, 11], "top": 6, "media": [6, 9, 10, 14, 16], "8259": 6, "strong": [6, 16], "pseudorandom": 6, "lifetim": 6, "posit": 6, "occur": [6, 7, 9, 10, 11, 15], "error_descript": [6, 9, 10, 11, 15], "human": [6, 11, 15], "readabl": [6, 9, 10, 11, 15], "clarifi": [6, 9, 10, 11, 15], "encount": [6, 9, 10, 11, 15], "400": [6, 9, 10, 11], "bad": [6, 9, 10, 11], "invalid_request": [6, 9, 10, 11], "grant": [6, 9, 10, 12, 15, 16], "browser": 6, "serial": 6, "queri": 6, "invalid_dpop_proof": 6, "least": [6, 7, 9, 10, 15, 16], "7515": [6, 11, 13], "8725": [6, 13], "chosen": [6, 9, 10], "7517": [6, 9, 10, 11, 13, 14, 16], "htm": 6, "attach": [6, 14], "9110": 6, "htu": 6, "target": [6, 9, 10], "fragment": [6, 9, 10], "successfulli": [6, 9, 10, 11], "claimset": 6, "simplifi": 6, "even": [6, 9, 10, 11, 12, 14], "charset": [6, 9, 10, 11], "utf": [6, 9, 10, 11], "invalid_cli": 6, "fail": [6, 9, 10, 14], "accomplish": [6, 16], "methodolog": 6, "9068": 6, "subject": [6, 9, 10, 14, 16], "subjectidtyp": 6, "uuid4": 6, "rp": [6, 9, 10, 14], "jkt": 6, "ath": 6, "denot": 6, "mso_mdoc": [6, 9, 10], "renew": [6, 14], "invalid_proof": 6, "oauth_authorization_serv": 6, "openid_credential_issu": [6, 14], "openid_relying_parti": [6, 14], "fanfs3ync9tjicaivhwlvuj3axwggz_98urfaqme": 6, "1649610249": 6, "1649437449": 6, "sig": 6, "1ta": 6, "se": [6, 15], "aqab": [6, 9, 10], "authority_hint": [6, 9, 10, 14, 16], "superior": [6, 14, 16], "organization_nam": [6, 7, 9, 10, 14, 16], "organ": [6, 9, 10, 12, 16], "homepage_uri": [6, 9, 10, 14, 16], "policy_uri": [6, 9, 10, 16], "privacy_polici": [6, 16], "tos_uri": [6, 16], "info_polici": [6, 16], "logo_uri": [6, 9, 10, 14, 16], "logo": [6, 9, 10, 14, 16], "svg": [6, 9, 10, 14, 16], "contact": [6, 9, 10, 14], "op": [6, 9, 10], "federation_resolve_endpoint": [6, 14], "authorization_endpoint": [6, 9, 10, 15], "pushed_authorization_request_endpoint": 6, "dpop_signing_alg_values_support": 6, "token_endpoint": [6, 16], "introspection_endpoint": 6, "introspect": 6, "client_registration_types_support": 6, "automat": [6, 14], "code_challenge_methods_support": 6, "authorization_details_types_support": 6, "acr_values_support": 6, "spidl2": [6, 9, 10], "spidl3": [6, 9, 10], "grant_types_support": [6, 16], "scopes_support": 6, "request_parameter_support": 6, "request_uri_parameter_support": 6, "fals": [6, 7, 9, 10, 15], "response_types_support": [6, 9, 10, 15], "subject_types_support": 6, "pairwis": [6, 9, 10], "token_endpoint_auth_methods_support": [6, 16], "attest_jwt_client_auth": 6, "token_endpoint_auth_signing_alg_values_support": [6, 16], "request_object_signing_alg_values_support": [6, 9, 10, 15], "credential_issu": 6, "credential_endpoint": 6, "revocation_endpoint": 6, "status_attestation_endpoint": 6, "displai": [6, 7, 9, 10], "italiano": 6, "di": 6, "esempio": 6, "alt_text": 6, "questo": 6, "newk5qdymekrcppo": 6, "yeytdjvwjmtzasmavt2vm1mb": 6, "vizxalo6dzeeszpxfpgzabtk3ctxtbubiiqpmiyrts": 6, "ff0bded045fe63fe5d1d64dd83b567e0": 6, "cryptographic_binding_methods_support": 6, "credential_signing_alg_values_support": 6, "proof_types_support": 6, "proof_signing_alg_values_support": 6, "credenzial": 6, "background_color": 6, "12107c": 6, "text_color": 6, "ffffff": 6, "trust_framework": [6, 7, 9], "assurance_level": [6, 7, 9], "electronic_record": [6, 7, 9], "record": [6, 7, 9], "sourc": [6, 7, 9, 11, 12], "organization_id": [6, 7, 9], "ipa_cod": 6, "m_it": 6, "country_cod": [6, 7, 9], "credentialsubject": [6, 9, 10], "nome": 6, "cognom": 6, "nascita": 6, "identificativo": 6, "univoco": 6, "codic": 6, "fiscal": 6, "supervis": [7, 9], "divid": [7, 9, 11, 15], "three": [7, 9, 16], "subphas": [7, 9], "begin": [7, 9], "prompt": [7, 9, 10], "between": [7, 9, 10, 11, 12, 14, 15, 16], "transmit": [7, 9, 10], "rang": [7, 9], "technolog": [7, 9, 14], "limit": [7, 9, 15], "intercept": [7, 9, 10], "eavesdrop": [7, 9], "exclus": [7, 9], "qr": [7, 9, 10], "up": [7, 9, 10, 11, 14], "stage": [7, 9, 15], "condit": [7, 9, 10, 11], "iso18013": [7, 9], "appropri": [7, 9, 10, 11], "decrypt": [7, 9, 10], "bluetooth": [7, 9], "low": [7, 9, 16], "energi": [7, 9], "ble": [7, 9], "figur": [7, 9], "illustr": [7, 9], "diagram": [7, 9, 10, 11], "reveal": [7, 9, 11, 12], "temporari": [7, 9, 11], "edevicekei": [7, 9], "priv": [7, 9], "pub": [7, 9], "incorpor": [7, 9, 14, 15], "suit": [7, 9], "immedi": [7, 9, 14, 16], "after": [7, 9, 10, 11, 15, 16], "final": [7, 9, 10, 14], "a30063312e30018201d818584ba4010220012158205a88d182bce5f42efa59943f33359d2e8a968ff289d93e5fa444b624343167fe225820b16e8cf858ddc7690407ba61d4c338237a8cfcf3de6aa672fc60a557aa32fc670281830201a300f401f50b5045efef742b2c4837a9a3b0e1d05a6917": [7, 9], "embed": [7, 9], "item": [7, 9, 12], "5a88d182bce5f42efa59943f33359d2e8a968ff289d93e5fa444b624343": [7, 9], "167fe": [7, 9], "b16e8cf858ddc7690407ba61d4c338237a8cfcf3de6aa672fc60a557aa32fc67": [7, 9], "deviceretrievalmethod": [7, 9], "peripher": [7, 9], "central": [7, 9, 12, 14], "45efef742b2c4837a9a3b0e1d05a6917": [7, 9], "scan": [7, 9, 10], "ereaderkei": [7, 9], "newli": [7, 9], "independ": [7, 9, 14], "along": [7, 9, 10, 11, 16], "a26776657273696f6e63312e306b646f63526571756573747381a26c6974656d7352657175657374d818590152a267646f6354797065756f72672e69736f2e31383031332e352e312e6d444c6a6e616d65537061636573a2746f72672e69736f2e31383031332e352e312e4954a375766572696669636174696f6e2e65766964656e6365f4781c766572696669636174696f6e2e6173737572616e63655f6c6576656cf4781c766572696669636174696f6e2e74727573745f6672616d65776f726bf4716f72672e69736f2e31383031332e352e31ab76756e5f64697374696e6775697368696e675f7369676ef47264726976696e675f70726976696c65676573f46f646f63756d656e745f6e756d626572f46a69737375655f64617465f46f69737375696e675f636f756e747279f47169737375696e675f617574686f72697479f46a62697274685f64617465f46b6578706972795f64617465f46a676976656e5f6e616d65f468706f727472616974f46b66616d696c795f6e616d65f46a726561646572417574688443a10126a11821590129308201253081cda00302010202012a300a06082a8648ce3d0403023020311e301c06035504030c15536f6d652052656164657220417574686f72697479301e170d3233313132343130323832325a170d3238313132323130323832325a301a3118301606035504030c0f536f6d6520526561646572204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004aa1092fb59e26ddd182cfdbc85f1aa8217a4f0fae6a6a5536b57c5ef7be2fb6d0dfd319839e6c24d087cd26499ec4f87c8c766200ba4c6218c74de50cd1243b1300a06082a8648ce3d0403020347003044022048466e92226e042add073b8cdc43df5a19401e1d95ab226e142947e435af9db30220043af7a8e7d31646a424e02ea0c853ec9c293791f930bf589bee557370a4c97bf6584058a0d421a7e53b7db0412a196fea50ca6d4c8a530a47dd84d88588ab145374bd0ab2a724cf2ed2facf32c7184591c5969efd53f5aba63194105440bc1904e1b9": [7, 9], "docrequest": [7, 9], "itemsrequest": [7, 9], "un_distinguishing_sign": [7, 9], "driving_privileg": [7, 9, 10], "portrait": [7, 9, 10], "readerauth": [7, 9], "a10126": [7, 9], "308201253081cda00302010202012a300a06082a8648ce3d0403023020311e301c06035504030c15536f6d652052656164657220417574686f72697479301e170d3233313132343130323832325a170d3238313132323130323832325a301a3118301606035504030c0f536f6d6520526561646572204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004aa1092fb59e26ddd182cfdbc85f1aa8217a4f0fae6a6a5536b57c5ef7be2fb6d0dfd319839e6c24d087cd26499ec4f87c8c766200ba4c6218c74de50cd1243b1300a06082a8648ce3d0403020347003044022048466e92226e042add073b8cdc43df5a19401e1d95ab226e142947e435af9db30220043af7a8e7d31646a424e02ea0c853ec9c293791f930bf589bee557370a4c97b": [7, 9], "null": [7, 9], "58a0d421a7e53b7db0412a196fea50ca6d4c8a530a47dd84d88588ab145374bd0ab2a724cf2ed2facf32c7184591c5969efd53f5aba63194105440bc1904e1b9": [7, 9], "comput": [7, 9, 11, 15], "ask": [7, 9, 10, 11, 12, 16], "permiss": [7, 9], "agre": [7, 9, 14], "give": [7, 9, 10, 14, 15], "a36776657273696f6e63312e3069646f63756d656e747381a367646f6354797065756f72672e69736f2e31383031332e352e312e6d444c6c6973737565725369676e6564a26a6e616d65537061636573a2746f72672e69736f2e31383031332e352e312e495483d81858f7a46864696765737449440b6672616e646f6d506d44f21ee875f2c1d502b43198e5a15271656c656d656e744964656e74696669657275766572696669636174696f6e2e65766964656e63656c656c656d656e7456616c756581a2647479706571656c656374726f6e69635f7265636f7264667265636f7264bf6474797065781f68747470733a2f2f657564692e77616c6c65742e70646e642e676f762e697466736f75726365bf716f7267616e697a6174696f6e5f6e616d65754d6f746f72697a7a617a696f6e6520436976696c656f6f7267616e697a6174696f6e5f6964656d5f696e666c636f756e7472795f636f6465626974ffffd8185866a4686469676573744944046672616e646f6d50185d84dfb71ce9b173010ddd62174fbe71656c656d656e744964656e746966696572781c766572696669636174696f6e2e74727573745f6672616d65776f726b6c656c656d656e7456616c7565656569646173d8185865a4686469676573744944006672616e646f6d50137f903174253c4585358267aae2ea4e71656c656d656e744964656e746966696572781c766572696669636174696f6e2e6173737572616e63655f6c6576656c6c656c656d656e7456616c75656468696768716f72672e69736f2e31383031332e352e318bd8185852a46864696765737449440c6672616e646f6d5053e29d0ddbbc7d2306a32bdbe2e56e5171656c656d656e744964656e7469666965726b66616d696c795f6e616d656c656c656d656e7456616c756563446f65d8185855a4686469676573744944036672616e646f6d50990cba2069fa1b33b8d6ae910b6549dc71656c656d656e744964656e7469666965726a676976656e5f6e616d656c656c656d656e7456616c756567416e746f6e696fd818585ba46864696765737449440a6672616e646f6d504086c1379975f805f1b1f4975e6a126571656c656d656e744964656e7469666965726a69737375655f646174656c656c656d656e7456616c7565d903ec6a323031392d31302d3230d818585ca4686469676573744944016672616e646f6d50ab4ca30c918dd2fd0bf35242c15fa2d871656c656d656e744964656e7469666965726b6578706972795f646174656c656c656d656e7456616c7565d903ec6a323032342d31302d3230d8185855a4686469676573744944076672616e646f6d508d9066f6c8da16619867cd4e2fab0c8871656c656d656e744964656e7469666965726f69737375696e675f636f756e7472796c656c656d656e7456616c7565624954d818587ea4686469676573744944056672616e646f6d5059fe68db795dee4c20976380ea24770571656c656d656e744964656e7469666965727169737375696e675f617574686f726974796c656c656d656e7456616c75657828497374697475746f20506f6c696772616669636f2065205a656363612064656c6c6f20537461746fd818585ba4686469676573744944026672616e646f6d5008b3f1ca5517019767be3dee3bb0614571656c656d656e744964656e7469666965726a62697274685f646174656c656c656d656e7456616c7565d903ec6a313935362d30312d3230d818585ca4686469676573744944096672616e646f6d50a2395ec214350c26066306e23279b3ae71656c656d656e744964656e7469666965726f646f63756d656e745f6e756d6265726c656c656d656e7456616c756569393837363534333231d8185850a4686469676573744944066672616e646f6d50a25e1a5b915d2d6eafee9674e023293971656c656d656e744964656e74696669657268706f7274726169746c656c656d656e7456616c75654420212223d81858eea46864696765737449440d6672616e646f6d50eeed6a3b856563627589a360939d12f771656c656d656e744964656e7469666965727264726976696e675f70726976696c656765736c656c656d656e7456616c756582a37576656869636c655f63617465676f72795f636f646561416a69737375655f64617465d903ec6a323031382d30382d30396b6578706972795f64617465d903ec6a323032342d31302d3230a37576656869636c655f63617465676f72795f636f646561426a69737375655f64617465d903ec6a323031372d30322d32336b6578706972795f64617465d903ec6a323032342d31302d3230d818585ba4686469676573744944086672616e646f6d50c0ef486b2a194ed3cbf7f354fd40092171656c656d656e744964656e74696669657276756e5f64697374696e6775697368696e675f7369676e6c656c656d656e7456616c756561496a697373756572417574688443a10126a118215901423082013e3081e5a00302010202012a300a06082a8648ce3d040302301a3118301606035504030c0f5374617465204f662055746f706961301e170d3233313132343134353430345a170d3238313132323134353430345a30383136303406035504030c2d5374617465204f662055746f7069612049737375696e6720417574686f72697479205369676e696e67204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004c338ec1000b351ce8bcdfc167450aeceb": [7, 9], "6d44f21ee875f2c1d502b43198e5a152": [7, 9], "pdnd": [7, 9], "motorizzazion": [7, 9], "civil": [7, 9], "m_inf": [7, 9], "185d84dfb71ce9b173010ddd62174fb": [7, 9], "137f903174253c4585358267aae2ea4": [7, 9], "53e29d0ddbbc7d2306a32bdbe2e56e51": [7, 9], "doe": [7, 9, 10, 15], "990cba2069fa1b33b8d6ae910b6549dc": [7, 9], "antonio": [7, 9], "4086c1379975f805f1b1f4975e6a1265": [7, 9], "2019": [7, 9], "20": [7, 9, 10, 14], "ab4ca30c918dd2fd0bf35242c15fa2d8": [7, 9], "8d9066f6c8da16619867cd4e2fab0c88": [7, 9], "59fe68db795dee4c20976380ea247705": [7, 9], "istituto": [7, 9], "poligrafico": [7, 9], "zecca": [7, 9], "dello": [7, 9], "stato": [7, 9], "08b3f1ca5517019767be3dee3bb06145": [7, 9], "a2395ec214350c26066306e23279b3a": [7, 9], "987654321": [7, 9], "a25e1a5b915d2d6eafee9674e0232939": [7, 9], "20212223": [7, 9], "eeed6a3b856563627589a360939d12f7": [7, 9], "vehicle_category_cod": [7, 9], "2018": [7, 9], "08": [7, 9], "09": [7, 9], "b": [7, 9, 13], "2017": [7, 9, 13], "c0ef486b2a194ed3cbf7f354fd400921": [7, 9], "i": [7, 9], "3082013e3081e5a00302010202012a300a06082a8648ce3d040302301a3118301606035504030c0f5374617465204f662055746f706961301e170d3233313132343134353430345a170d3238313132323134353430345a30383136303406035504030c2d5374617465204f662055746f7069612049737375696e6720417574686f72697479205369676e696e67204b65793059301306072a8648ce3d020106082a8648ce3d03010703420004c338ec1000b351ce8bcdfc167450aeceb7d518bd9a519583e082d67effff06565804fc09abf0e4a08e699c9dba3796285a15f68e40ac7f9fc7700a15153a4065300a06082a8648ce3d040302034800304502210099b7d62e6bf7b1823db3713df889bf73e70bb4d9c58c21e92c58d2f1beffe932022058d039747a00d70e6d66be4797e6142b3608a014ee09b7b79af2cae2aaf27788": [7, 9], "0e5f0b6b33418e508740771e82f893372eaf5b2445bc4c84dcf08b005e9493fc": [7, 9], "de21bb62ff2897d8b986d2cda9f9bc5865c02807f7b4d9dd1fa4a79df4c0d37f": [7, 9], "bc5568239e35ce9ff8798c27ffdcd757b134b679f0fe05729aa3491381912e65": [7, 9], "e6048bdc7fd6454296f1e3f54536107c9c5b24c4064de46a98121e3630eecca2": [7, 9], "73690d92dcaa61b0203870f67c6aa9fdfea889b6f0c720de757b4b0a8516a206": [7, 9], "e353ea0b0fd92b6be90c64cc3b2ee1284153a8f0f5066b99aac599200e6eeeb2": [7, 9], "29227872ceb49923d267b5f4bade6d387b42ac2dc4b2ae26c9013067fee7018a": [7, 9], "a6a119f7cacac0b8c6aacac747fd3fe7e50b6d9bb8a507fda79f0df6646f285d": [7, 9], "6d8025d2f02a5e7e1406fb6aaeb67f9ede9b07191a53f3e23b77c528223a94e2": [7, 9], "b0d43e4e2ea534e4d5304e64bcf7a0f13e2c8ee8304b9cd23aba4909652a4647": [7, 9], "fbf4de318982f2dbad43c601caeb22628b301ac18aa8264c5831b2aaac89c486": [7, 9], "cf57377b675f64f37314739592c1e8a911a7ddaf341ce2902fe877c5a835e4c1": [7, 9], "4a4b4cc64ec9299c1a2501ea449f577005e9f7a60408057c07a7c67fb151e5f5": [7, 9], "78824fbd6fbba88a2aab44df8b6f5e9759126d87d1f4415995e658fd9239e1f": [7, 9], "afd09e720b918cedc2b8a881950bab6a1051e18ae16a814d51e609938663d5e1": [7, 9], "61fbc6c8ad24ec86a78bb4e9ac377dd2b7c711d9f2eb9afd4aa0963662847a": [7, 9], "24t14": [7, 9], "54": [7, 9], "05z": [7, 9], "f2461e4fab69e9f7bcffe552395424514524d1679440036213173101448d1b1ab4a293859b389ffa8b47aeed10e9b0c1545412ac37c51a76482cd9bbbe110152": [7, 9], "1fed7190d2975ab79c072e6f1d9d52436059d1fc959d55baf74f057d89b10fcc0dc77a50d433d4c76ddf26223c5560c4ab123b5cb5eb805a90036aa147493076": [7, 9], "subsequ": [7, 9, 11], "consid": [7, 9, 10, 11, 14, 15], "transfermethod": [7, 9], "hold": [7, 9, 11], "bleoption": [7, 9], "datael": [7, 9], "intent": [7, 9], "retain": [7, 9, 14], "intenttoretain": [7, 9], "bool": [7, 9], "cose_sign1": [7, 9], "unless": [7, 9], "responsedata": [7, 9], "respond": [7, 9, 15], "devicenamespac": [7, 9], "dataitemnam": [7, 9], "dataitemvalu": [7, 9], "action": [7, 9, 10, 11, 12, 15, 16], "responsestatu": [7, 9], "300": [7, 9], "doesn": [7, 9, 11, 14], "t": [7, 9, 11, 13, 14], "dispatch": [7, 9], "command": [7, 9], "destruct": [7, 9], "closur": [7, 9], "scenario": [9, 10, 11, 12, 14], "download": [9, 10], "workstat": [9, 10], "frame": [9, 10, 15], "extract": [9, 10], "request_uri_method": [9, 10], "client_id_schem": [9, 10], "entity_id": [9, 10], "assign": [9, 10, 14], "altern": [9, 10], "mandat": [9, 10], "fetch": [9, 10, 14], "eleg": [9, 10], "polici": [9, 10, 11, 14, 16], "successful": [9, 10], "continu": [9, 10], "navig": [9, 10], "sequenc": [9, 10, 14, 15], "summar": [9, 10], "convers": [9, 10], "suppli": [9, 10], "deselect": [9, 10], "direct_post": [9, 10], "25": [9, 10, 14], "26": [9, 10, 14], "27": [9, 10, 14], "28": [9, 10, 14], "29": [9, 10, 14], "autent": [9, 10], "succed": [9, 10], "made": [9, 10, 14, 15, 16], "featur": [9, 10, 11, 14, 15], "deem": [9, 10], "necessari": [9, 10, 11, 12, 14, 15], "better": [9, 10, 11], "explicit": [9, 10], "regard": [9, 10, 14, 15], "usag": [9, 10, 14, 16], "prefer": [9, 10, 16], "vp_token": [9, 10, 11, 15], "response_modes_support": [9, 10, 15], "form_post": [9, 10, 15], "vp_formats_support": [9, 10, 15], "jwt_alg_valu": [9, 10, 14, 15], "presentation_definition_uri_support": [9, 10, 15], "opaqu": [9, 10], "otherwis": [9, 10, 11], "jar": [9, 10], "2freli": [9, 10], "2fcb": [9, 10], "2frequest_uri": [9, 10], "raw": [9, 10], "correct": [9, 10], "quartili": [9, 10], "good": [9, 10, 12], "balanc": [9, 10], "densiti": [9, 10], "space": [9, 10], "qualiti": [9, 10], "damag": [9, 10], "partial": [9, 10], "obscur": [9, 10], "javascript": [9, 10, 13], "qrcode": [9, 10], "poll": [9, 10], "socket": [9, 10], "cooki": [9, 10], "httponli": [9, 10], "special": [9, 10, 15], "wait": [9, 10, 13], "202": [9, 10], "response_uri": [9, 10], "401": [9, 10], "unauthor": [9, 10, 12, 15, 16], "3be39b69": [9, 10], "6ac1": [9, 10], "41aa": [9, 10], "921b": [9, 10], "3e6c07ddcb03": [9, 10], "e0bbf2f1": [9, 10], "8c3a": [9, 10], "4eab": [9, 10], "a8ac": [9, 10], "2e8f34db8a47": [9, 10], "miicajccadogawibag": [9, 10], "awz": [9, 10], "2w3": [9, 10], "sf2": [9, 10], "walletattest": [9, 10], "response_mod": [9, 10, 15], "2c128e4d": [9, 10], "fc91": [9, 10], "4cd3": [9, 10], "86b8": [9, 10], "18bdea0988cb": [9, 10], "herein": [9, 10], "alias": [9, 10], "anymor": [9, 10, 11], "insensit": [9, 10], "rfc9101": [9, 10], "presentation_definit": [9, 10, 15], "input_descriptor": [9, 10], "constraint": [9, 10, 14], "path": [9, 10, 14], "limit_disclosur": [9, 10], "mention": [9, 10], "futur": [9, 10, 14, 15], "presentation_definition_uri": [9, 10], "Not": [9, 10, 11], "client_metadata": [9, 10], "taken": [9, 10], "client_metadata_uri": [9, 10], "miss": [9, 10], "webpath": [9, 10], "urlparam": [9, 10], "server_error": [9, 10], "unexpect": [9, 10], "fulfil": [9, 10, 11], "unabl": [9, 10, 11], "malfunct": [9, 10], "mainten": [9, 10], "try": [9, 10], "malform": [9, 10], "anoth": [9, 10, 12], "500": [9, 10, 11], "There": [9, 10, 14], "could": [9, 10, 12], "incorrect": [9, 10, 11], "failur": [9, 10, 11], "manner": [9, 10, 11, 15, 16], "addition": [9, 10, 15], "log": [9, 10, 14], "attempt": [9, 10, 15], "recov": [9, 10], "feasibl": [9, 10], "re": [9, 10], "enter": [9, 10, 14, 16], "crucial": [9, 10, 11, 12], "robust": [9, 10, 11, 14], "handl": [9, 10, 14], "friendli": [9, 10], "adher": [9, 10, 14, 15, 16], "help": [9, 10, 15], "diagnos": [9, 10], "variou": [9, 10, 14, 16], "faulti": [9, 10], "potenti": [9, 10, 11, 14], "lead": [9, 10, 11, 15], "gather": [9, 10], "exploit": [9, 10], "why": [9, 10], "malici": [9, 10], "plaintext": [9, 10], "network": [9, 10], "emploi": [9, 10, 14, 16], "tl": [9, 10, 14], "Such": [9, 10], "techniqu": [9, 10, 12], "webserv": [9, 10], "deciph": [9, 10], "transmiss": [9, 10, 14], "forward": [9, 10], "negoti": [9, 10], "actual": [9, 10, 15, 16], "actor": [9, 10, 12, 16], "segment": [9, 10], "sensit": [9, 10], "unencrypt": [9, 10], "snif": [9, 10], "eyjhbgcioijfuzi1nii": [9, 10], "9t2lq": [9, 10], "pt0ixx0": [9, 10], "presentation_submiss": [9, 10], "definition_id": [9, 10], "32f54163": [9, 10], "7166": [9, 10], "48f1": [9, 10], "93d8": [9, 10], "ff217bdb0653": [9, 10], "04a98be3": [9, 10], "7fb0": [9, 10], "4cf5": [9, 10], "af9a": [9, 10], "31579c8b0e7d": [9, 10], "descriptor_map": [9, 10], "verified_claim": [9, 10], "find": [9, 10], "3978344f": [9, 10], "8596": [9, 10], "4c3a": [9, 10], "a978": [9, 10], "8fcaba3903c5": [9, 10], "1541493724": [9, 10], "1573029723": [9, 10], "origin": [9, 10, 14, 15], "beyond": [9, 10, 11, 14], "longer": [9, 10, 11, 14, 15], "audienc": [9, 10], "becaus": [9, 10, 11, 15], "aris": [9, 10], "403": [9, 10], "forbidden": [9, 10], "happen": [9, 10], "occour": [9, 10], "meet": [9, 10, 14, 15], "criteria": [9, 10, 14], "stem": [9, 10], "aspect": [9, 10], "clariti": [9, 10], "proper": [9, 10, 15], "credentialx": [9, 10], "write": [9, 10, 16], "response_cod": [9, 10], "091535f699ea575c7937fa5f0f454ae": [9, 10], "These": [9, 10, 11, 14, 16], "critic": [9, 10], "impact": [9, 10], "hinder": [9, 10], "seamless": [9, 10, 12, 14], "implic": [9, 10], "mismatch": [9, 10], "incur": [9, 10], "rais": [9, 10], "refus": [9, 10], "precaut": [9, 10], "clear": [9, 10, 14], "2hnofs3ync9tjicaivhwlvuj3axwggz_98urfaqme": [9, 10, 14], "1649590602": [9, 10], "1649417862": [9, 10], "5s4qi": [9, 10], "wallet_relying_parti": [9, 10, 14], "application_typ": [9, 10], "client_nam": [9, 10], "9tjicaivhwlvuj3axwggz_9": [9, 10], "default_acr_valu": [9, 10], "vp_format": [9, 10, 14], "kb": [9, 10, 14], "identitycredenti": [9, 10], "const": [9, 10], "intent_to_retain": [9, 10], "enum": [9, 10], "issuer2": [9, 10], "issuer3": [9, 10], "1504700136": [9, 10, 11], "sampl": [9, 10], "eddsa": [9, 10, 15], "default_max_ag": [9, 10], "1111": [9, 10], "jarm": [9, 10, 13], "authorization_signed_response_alg": [9, 10], "authorization_encrypted_response_alg": [9, 10], "authorization_encrypted_response_enc": [9, 10], "a192cbc": [9, 10], "a128gcm": [9, 10], "a192gcm": [9, 10], "a256gcm": [9, 10], "subject_typ": [9, 10], "require_auth_tim": [9, 10], "id_token_signed_response_alg": [9, 10], "id_token_encrypted_response_alg": [9, 10], "id_token_encrypted_response_enc": [9, 10], "home": [9, 10], "tech": [9, 10, 14], "princip": [9, 10], "acr": [9, 10], "hint": [9, 10], "verifieng": [9, 10], "confgiur": [9, 10], "inaccuraci": 11, "compromis": [11, 14, 15], "valueless": 11, "harm": 11, "cycl": 11, "serv": [11, 14, 15, 16], "autom": [11, 14], "provis": [11, 14, 16], "onlin": [11, 14], "preserv": [11, 15, 16], "internet": [11, 13], "becom": [11, 15, 16], "conjunct": 11, "greater": 11, "hour": [11, 14, 15], "rotat": 11, "kept": 11, "circumst": [11, 16], "whenev": 11, "delet": [11, 15], "band": 11, "databas": 11, "trigger": 11, "touchpoint": 11, "enforc": [11, 14], "judici": 11, "polic": 11, "loss": 11, "theft": [11, 12], "physic": [11, 12], "impli": 11, "address": [11, 15], "lose": 11, "awar": 11, "behalf": [11, 14], "entitl": 11, "etc": [11, 14], "turn": 11, "death": 11, "decid": 11, "Then": 11, "credential_pop": 11, "credentialpopjwt": 11, "jwkid": 11, "1698744039": 11, "1698744139": 11, "6f204f7e": 11, "e453": 11, "4dfd": 11, "814e": 11, "9d155319408c": 11, "credential_hash": 11, "notif": 11, "email": [11, 14], "telephon": 11, "204": 11, "No": [11, 14], "404": 11, "problem": 11, "503": 11, "unavail": [11, 14, 15], "registerd": 11, "take": [11, 15], "lack": 11, "interv": 11, "suspens": 11, "itself": [11, 14, 16], "eyjhbgcioijfuzi1niisinr5cci6indhbgxldc1": 11, "credential_revok": 11, "credential_upd": 11, "One": 11, "defer": 11, "paradigm": 12, "iam": 12, "improv": 12, "ownership": [12, 16], "said": 12, "histori": 12, "tradit": [12, 14], "know": [12, 14], "fact": 12, "envis": 12, "login": 12, "compani": 12, "want": 12, "acquir": [12, 15, 16], "publish": [12, 14], "educ": 12, "institut": 12, "portabl": 12, "principl": [12, 14], "character": 12, "choos": 12, "leverag": [12, 14], "avoid": 12, "fraud": 12, "promot": [12, 14], "border": [12, 14], "effici": [12, 14], "cost": [12, 14], "reduct": 12, "elimin": 12, "multipl": [12, 14, 15], "repetit": 12, "streamlin": [12, 14], "reduc": [12, 14], "purchas": 12, "ag": 12, "k": 13, "looker": 13, "februari": 13, "d": 13, "fett": 13, "presentationexch": 13, "2119": 13, "bradner": 13, "march": 13, "1997": 13, "2616": 13, "r": 13, "getti": 13, "j": 13, "mogul": 13, "frystyk": 13, "masint": 13, "l": 13, "leach": 13, "berner": 13, "lee": 13, "hypertext": 13, "transfer": [13, 15], "june": 13, "1999": 13, "3339": 13, "klyne": 13, "c": 13, "newman": 13, "doi": 13, "17487": 13, "rfc3339": 13, "juli": 13, "2002": 13, "3986": 13, "uniform": [13, 15], "syntax": 13, "7159": 13, "brai": 13, "interchang": 13, "2014": 13, "jone": 13, "m": 13, "bradlei": 13, "sakimura": 13, "2015": 13, "hildebrand": 13, "jwe": 13, "rfc7517": 13, "jwa": 13, "septemb": 13, "7800": [13, 15], "tschofenig": 13, "semant": 13, "april": 13, "2016": 13, "8174": 13, "leiba": 13, "ambigu": 13, "uppercas": 13, "vs": 13, "lowercas": 13, "hardt": 13, "sheffer": 13, "best": 13, "practic": 13, "2020": 13, "campbel": 13, "novemb": 13, "2022": 13, "openid4vc": [13, 15], "haip": [13, 15], "legitimaci": 14, "compli": 14, "rest": [14, 16], "distribut": 14, "call": 14, "overse": 14, "fr": 14, "stamp": 14, "artifact": 14, "confidenti": 14, "measur": [14, 15], "gdpr": 14, "empow": 14, "audit": 14, "minim": 14, "anonym": 14, "retent": 14, "account": 14, "disput": 14, "resolut": 14, "liabil": 14, "those": 14, "disabl": 14, "emerg": 14, "breach": 14, "scalabl": 14, "deleg": 14, "relationship": 14, "grow": 14, "remov": [14, 16], "might": 14, "scale": 14, "horizont": 14, "accommod": 14, "increas": 14, "volum": 14, "histor": 14, "extens": 14, "behavior": 14, "relianc": 14, "adapt": 14, "load": 14, "particularli": 14, "peak": 14, "complex": 14, "task": 14, "cryptographi": 14, "flexibl": 14, "threat": [14, 15], "research": 14, "pre": 14, "candid": 14, "monitor": 14, "ongo": 14, "similar": 14, "thereof": 14, "reflect": [14, 15], "transpar": 14, "status": 14, "foster": 14, "tool": [14, 15], "aid": 14, "earli": 14, "detect": 14, "30": 14, "tamper": [14, 16], "except": 14, "summari": 14, "pki": 14, "leaf": 14, "built": 14, "p1": 14, "p2": 14, "p3": 14, "divers": 14, "p4": 14, "indirectli": 14, "p6": 14, "p5": 14, "p7": 14, "organiz": 14, "adjust": 14, "p8": 14, "autonomi": 14, "p9": 14, "unlik": 14, "coverag": 14, "satisfi": [14, 15], "recognis": 14, "publicli": 14, "summaris": 14, "trust_mark_id": 14, "motiv": 14, "plain": 14, "keep": [14, 15], "max_path_length": 14, "1649375259": 14, "1649373279": 14, "x2zomhngsdc4zlbrcxhmt3mzrmrzog9jd3o2qjzdam51cuhhufruowd0wq": 14, "1knr9ar3mzmokyty8brvriue85nixryx4xd3k4jw7vi": 14, "slt14644zbyxyf": 14, "xmw7apdlbmuw3t1urwi4nafmtkri": 14, "ta": 14, "federation_fetch_endpoint": 14, "federation_list_endpoint": 14, "federation_trust_mark_status_endpoint": 14, "trust_mark_statu": 14, "trust_mark_issu": 14, "cryptograf": 14, "x5c": 14, "entity_typ": 14, "trustworthi": [14, 15, 16], "trust_mark_own": 14, "trust_mark": 14, "entri": 14, "don": 14, "em3cmnzghiyfsq090n6b3op7laaqj8rghmhxgmjstqg": 14, "1649623546": 14, "1649450746": 14, "metadata_polici": 14, "subset_of": 14, "allowed_leaf_entity_typ": 14, "real": 14, "concaten": [14, 15], "convei": 14, "pertain": [14, 15], "earliest": 14, "forc": 14, "higher": 14, "abstract": 14, "entityconfigur": 14, "signedjwt": 14, "selfissu": 14, "byleaf": 14, "entitystat": 14, "bytrustanchor": 14, "eyjhbgcioijfuzi1niisimtpzci6ik5gttfxvvzpvwxzelvxcexhbwxmy0vwufjwwtjwwfpjumpcblfywm1ssghlwvvwwvvszfrrbkeytkeilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 14, "eyjlehaioje2ndk1ota2mdisimlhdci6mty0otqxnzg2miwiaxnzijoiahr0chm6ly9ycc5legftcgxllm9yzyisinn1yii6imh0dhbzoi8vcnauzxhhbxbszs5vcmcilcjqd2tzijp7imtlexmiolt7imt0esi6ikvdiiwia2lkijoitkznmvdvvmlvbfl6vvdwtgftbgzjrxbqulzzmlzywklsakjuuvhabvjiaetzvvzzvwxkvffuqtjoqsisimnydii6ilatmju2iiwieci6invzbemzd2qtcfgzd3o0yljzbnd5m2x6cgjhwkzotjk2aewyquhbm01rnlkilcj5ijoivkxdqlhgv2xktlnosxo4a0gyoxzmujromthca3dht1gynnprb3j1utfnncj9xx0sim1ldgfkyxrhijp7im9wzw5pzf9yzwx5aw5nx3bhcnr5ijp7imfwcgxpy2f0aw9ux3r5cguioij3zwiilcjjbgllbnrfawqioijodhrwczovl3jwlmv4yw1wbguub3jnlyisimnsawvudf9yzwdpc3ryyxrpb25fdhlwzxmiolsiyxv0b21hdgljil0simp3a3mionsia2v5cyi6w3sia3r5ijoirumilcjrawqioijork0xv1vwavvswxpvv3bmyw1szmnfcfbsvlkyvlhasvjqqm5rwfptukhos1lvvllvbgruuw5bmk5biiwiy3j2ijoiuc0yntyilcj4ijoidxnsqzn3zc1wwdn3ejriullud3kzbhpwykdarmhootzotdjbseeztve2wsisinkioijwtencwezxbgrou05jejhrsdi5dkxsne4xoejrd0dpwdi2elfvcnvrmu00in1dfswiy2xpzw50x25hbwuioijoyw1lig9migfuigv4yw1wbgugb3jnyw5pemf0aw9uiiwiy29udgfjdhmiolsib3bzqhjwlmv4yw1wbguuaxqixswiz3jhbnrfdhlwzxmiolsicmvmcmvzaf90b2tlbiisimf1dghvcml6yxrpb25fy29kzsjdlcjyzwrpcmvjdf91cmlzijpbimh0dhbzoi8vcnauzxhhbxbszs5vcmcvb2lkyy9ycc9jywxsymfjay8ixswicmvzcg9uc2vfdhlwzxmiolsiy29kzsjdlcjzy29wzsi6imv1lmv1cm9wys5lyy5ldwrpdy5wawqumsblds5ldxjvcgeuzwmuzxvkaxcucglklml0ljegzw1hawwilcjzdwjqzwn0x3r5cguioijwywlyd2lzzsj9lcjmzwrlcmf0aw9ux2vudgl0esi6eyjmzwrlcmf0aw9ux3jlc29sdmvfzw5kcg9pbnqioijodhrwczovl3jwlmv4yw1wbguub3jnl3jlc29sdmuviiwib3jnyw5pemf0aw9ux25hbwuioijfegftcgxlifjqiiwiag9tzxbhz2vfdxjpijoiahr0chm6ly9ycc5legftcgxllml0iiwicg9sawn5x3vyasi6imh0dhbzoi8vcnauzxhhbxbszs5pdc9wb2xpy3kilcjsb2dvx3vyasi6imh0dhbzoi8vcnauzxhhbxbszs5pdc9zdgf0awmvbg9nby5zdmcilcjjb250ywn0cyi6wyj0zwnoqgv4yw1wbguuaxqixx19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3jlz2lzdhj5lmvpzgfzlnrydxn0lwfuy2hvci5legftcgxllmv1l29wzw5pzf9yzwx5aw5nx3bhcnr5l3b1ymxpyy8ilcj0cnvzdf9tyxjrijoizxlkacbcdtiwmjyifv0simf1dghvcml0ev9oaw50cyi6wyjodhrwczovl2ludgvybwvkawf0zs5lawrhcy5legftcgxllm9yzyjdfq": 14, "un315hdckvhya": 14, "irregzaml7pnfjqh2apz82blqo5s0sl1jr0tefp5e1t913g8gnuwggtmquqhpzwv6bvtla8g": 14, "eyjhbgcioijfuzi1niisimtpzci6ilnurkrxv2hky0dwwfgzqjnsvmraywtsq0xutnvna000wtngnlfutk9krxryzfhgwvlywjjjwgn0uveilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 14, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly9pbnrlcm1lzglhdguuzwlkyxmuzxhhbxbszs5vcmcilcjzdwiioijodhrwczovl3jwlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6ik5gttfxvvzpvwxzelvxcexhbwxmy0vwufjwwtjwwfpjumpcblfywm1ssghlwvvwwvvszfrrbkeytkeilcjjcnyioijqlti1niisingioij1c2xdm3dklxbym3d6ngjsww53etnsenbir1pgae45nmhmmkfiqtnnutzziiwiesi6ilzmq0jyrldsze5ttkl6ogtimjl2tfi0tje4qmt3r09ymjz6uw9ydvexttqifv19lcjtzxrhzgf0yv9wb2xpy3kionsib3blbmlkx3jlbhlpbmdfcgfydhkionsic2nvcguionsic3vic2v0x29mijpbimv1lmv1cm9wys5lyy5ldwrpdy5wawqumswgigv1lmv1cm9wys5lyy5ldwrpdy5wawquaxqumsjdfswicmvxdwvzdf9hdxrozw50awnhdglvbl9tzxrob2rzx3n1chbvcnrlzci6eyjvbmvfb2yiolsicmvxdwvzdf9vymply3qixx0sinjlcxvlc3rfyxv0agvudgljyxrpb25fc2lnbmluz19hbgdfdmfsdwvzx3n1chbvcnrlzci6eyjzdwjzzxrfb2yiolsiulmyntyilcjsuzuxmiisikvtmju2iiwirvm1mtiilcjquzi1niisilbtnteyil19fx0sinrydxn0x21hcmtzijpbeyjpzci6imh0dhbzoi8vdhj1c3qtyw5jag9ylmv4yw1wbguuzxuvb3blbmlkx3jlbhlpbmdfcgfydhkvchvibgljlyisinrydxn0x21hcmsioijleupoyibcdtiwmjyifv19": 14, "_qt5": 14, "t6dahp3tuwa_27kle8i9z_spk2ftqlky6pgmpchbsi2ahxy3aaxdurobpo4chtqgg3j2xcrghdfucfgeq": 14, "eyjhbgcioijfuzi1niisimtpzci6imvxa3pubwt0ww5kblzhmwxhmju1zdjkq2rvzersazqwuwt0wvlvmwfhrfzyt1robfphdfdxsgq1wncilcj0exaioijhchbsawnhdglvbi9lbnrpdhktc3rhdgvtzw50k2p3dcj9": 14, "eyjlehaioje2ndk2mjm1ndysimlhdci6mty0otq1mdc0niwiaxnzijoiahr0chm6ly90cnvzdc1hbmnob3iuzxhhbxbszs5ldsisinn1yii6imh0dhbzoi8vaw50zxjtzwrpyxrllmvpzgfzlmv4yw1wbguub3jniiwiandrcyi6eyjrzxlzijpbeyjrdhkioijfqyisimtpzci6ilnurkrxv2hky0dwwfgzqjnsvmraywtsq0xutnvna000wtngnlfutk9krxryzfhgwvlywjjjwgn0uveilcjjcnyioijqlti1niisingioijyql9bogdcunh5njhvtkxzrkzlr0zmr2vmwu5xymgtszh1os1gylqyzkzjiiwiesi6ilnuwvk2y3njznkxcjbisfhltgjuvfzsamfndzhozznrues2wfvoc2uzdkuifv19lcj0cnvzdf9tyxjrcyi6w3siawqioijodhrwczovl3rydxn0lwfuy2hvci5legftcgxllmv1l2zlzgvyyxrpb25fzw50axr5l3royxqtchjvzmlszsisinrydxn0x21hcmsioijleupoyibcdtiwmjyifv19": 14, "r3uoi": 14, "u0tx0gdflndditbcwznupy7m2tnh08jld": 14, "ej9vmzwmcxoccuwin0zt0js4m_shneig6tlxrqj": 14, "hti70g": 14, "At": [14, 15], "attain": 14, "propag": 14, "thu": [14, 16], "build": 14, "inquir": 14, "amount": 14, "matter": 14, "especi": 14, "perimet": 14, "jurisdict": 14, "snapshot": 14, "overload": 14, "primarili": 15, "met": [15, 16], "therebi": 15, "manipul": 15, "falsif": 15, "place": 15, "repeat": 15, "guarante": [15, 16], "prerequisit": 15, "_globalplatform_": 15, "_javacard_": 15, "modul": 15, "hybrid": [15, 16], "pluggabl": 15, "_euicc_": 15, "mix": 15, "acquisit": 15, "backend": 15, "defens": 15, "walletprovid": 15, "d2jhy2nhbg91cmvqdwfuzgft": 15, "exist": 15, "permit": 15, "achiev": [15, 16], "reput": 15, "execut": [15, 16], "tee": [15, 16], "distinct": [15, 16], "sdk": 15, "context": [15, 16], "unalt": 15, "bootload": 15, "plai": [15, 16], "devicecheck": 15, "key_attest": 15, "base64": 15, "put": 15, "0fe3cbe0": 15, "646d": 15, "44b5": 15, "8808": 15, "917dd5391bd9": 15, "o2nmbxrvyxbwbgutyxbw": 15, "redact": 15, "hardware_key_tag": 15, "wqhydymfksp95ifqpzdedww4l7avna2fn4jcewhytbu": 15, "discret": 15, "flaw": 15, "necessit": [15, 16], "safeguard": 15, "undergo": 15, "inclus": 15, "reiniti": 15, "solicit": 15, "produc": 15, "predetermin": 15, "client_data": 15, "client_data_hash": 15, "4hnpti": 15, "xr2pjyrjkgmnz4wmdnqd_ujsq4r95nj98b44": 15, "liznsb39vfjhygs3k7jxe4r3": 15, "cogfqwztpbirqpnlrg": 15, "hardware_signatur": 15, "integrity_assert": 15, "custom": 15, "construct": 15, "wallet_hardware_key_tag": 15, "public_jwk": 15, "war": 15, "6ec69324": 15, "60a8": 15, "4e5b": 15, "a697": 15, "a766d85790ea": 15, "kozihvcnaqccoiawgaib": 15, "o2nmbxrvyxbwbgutyxbwyx": 15, "jwt_vc_json": 15, "alg_values_support": 15, "es256k": 15, "jwt_vp_json": 15, "7523": 15, "bearer": 15, "3agrant": 15, "3ajwt": 15, "eyjhbgcioijfuzi1niisimtpzci6imtoakzwte9nrjnheg": 15, "reconstruct": 15, "5t5yypbhn": [15, 16], "egieei5iuzr6r0mr02lnvq0omekmnkcji": [15, 16], "eyjhbgcioijfuz": 15, "6s0a": 15, "jjla": 15, "h9gw": 15, "1687281195": 15, "1687288395": 15, "eyjhbgcioijfuzi1niisinr5cci6indhbgx": 15, "var": 15, "8414": 15, "boolean": 15, "comprehens": 16, "cater": 16, "asset": 16, "total": 16, "conveni": 16, "vital": 16, "essenti": 16, "mechanismm": 16, "utmost": 16, "unlock": 16, "pin": 16, "biometr": 16, "fingerprint": 16, "facial": 16, "recognit": 16, "unambigu": 16, "rel": 16, "revert": 16, "voluntarili": 16, "aal_values_support": 16, "medium": 16, "token_endpoint_auth_methods_suppor": 16, "ted": 16, "token_endpoint_auth_signing_alg_va": 16, "lues_support": 16, "experiment": 16, "qrjrj3af_b57sboirrcbm7br7woc8ynj7lhfpteffuk": 16, "1h0cwdyggvu8w": 16, "kpku_xycocunt2o0bwsliqtnpu6im": 16, "basic": 16, "private_key_jwt": 16, "1687171759": 16, "1709290159": 16, "inherit": 16, "extend": 16, "trusti": 16}, "objects": {}, "objtypes": {}, "objnames": {}, "titleterms": {"cryptograph": 0, "algorithm": 0, "backup": 1, "restor": 1, "rst": [1, 8], "gener": [1, 8, 14], "properti": [1, 8, 14], "requir": [1, 8, 11, 14, 15, 16], "attribut": [1, 8], "implement": [1, 4, 8], "consider": [1, 8, 14], "librari": [1, 8], "code": [1, 8], "snippet": [1, 8], "extern": [1, 8, 16], "refer": [1, 8, 13, 16], "how": 2, "contribut": 2, "acknowledg": 2, "norm": [3, 5], "languag": 3, "convent": 3, "defin": 3, "term": 3, "acronym": 3, "The": [4, 14], "italian": 4, "eudi": [4, 14], "wallet": [4, 11, 14, 15, 16], "profil": 4, "introduct": [4, 12], "index": 4, "content": 4, "pid": [5, 6], "q": [5, 6], "eaa": [5, 6], "data": 5, "model": [5, 14], "sd": 5, "jwt": 5, "paramet": [5, 6, 14], "claim": 5, "non": [5, 14], "exampl": 5, "mdoc": [5, 7, 9], "cbor": 5, "namespac": 5, "mobil": 5, "secur": [5, 9, 10], "object": [5, 9, 10], "issuanc": [6, 15], "high": 6, "level": 6, "flow": [6, 7, 9, 10, 11], "detail": [6, 9, 10], "push": 6, "author": [6, 9, 10], "request": [6, 7, 9, 10, 11, 15], "endpoint": [6, 9, 10, 14, 16], "par": 6, "http": [6, 9, 10, 11], "respons": [6, 7, 9, 10, 11], "token": 6, "access": 6, "credenti": [6, 11], "entiti": [6, 9, 10, 14], "configur": [6, 9, 10, 14], "issuer": 6, "proxim": [7, 9], "devic": [7, 9, 10], "engag": [7, 9], "session": [7, 9], "termin": [7, 9], "pseudonym": 8, "reli": [9, 10, 14], "parti": [9, 10, 14], "solut": [9, 16], "remot": [9, 10], "uri": [9, 10], "post": [9, 10], "cross": [9, 10], "statu": [9, 10, 11], "check": [9, 10], "error": [9, 10], "redirect": [9, 10], "lifecycl": [11, 16], "oper": [11, 16], "function": [11, 14], "revoc": 11, "us": 11, "case": 11, "instanc": [11, 15, 16], "attest": [11, 14, 15, 16], "present": 11, "verifi": 11, "proof": 11, "possess": 11, "self": 12, "sovereign": 12, "ident": 12, "ssi": 12, "technic": 13, "infrastructur": 14, "trust": 14, "feder": 14, "role": 14, "api": 14, "common": 14, "anchor": 14, "leav": 14, "intermedi": 14, "metadata": [14, 16], "type": 14, "statement": 14, "evalu": 14, "mechan": 14, "chain": 14, "offlin": 14, "repudi": 14, "long": 14, "live": 14, "privaci": 14, "remark": 14, "about": 14, "decentr": 14, "static": 15, "compon": 15, "view": 15, "dynam": 15, "initi": [15, 16], "registr": 15, "process": 16, "transit": 16, "valid": 16, "state": 16, "return": 16, "deactiv": 16, "provid": 16, "header": 16, "payload": 16, "wallet_provid": 16, "federation_ent": 16}, "envversion": {"sphinx.domains.c": 2, "sphinx.domains.changeset": 1, "sphinx.domains.citation": 1, "sphinx.domains.cpp": 6, "sphinx.domains.index": 1, "sphinx.domains.javascript": 2, "sphinx.domains.math": 2, "sphinx.domains.python": 3, "sphinx.domains.rst": 2, "sphinx.domains.std": 2, "sphinx.ext.intersphinx": 1, "sphinx.ext.todo": 2, "sphinx": 56}}) \ No newline at end of file diff --git a/versione-corrente/en/ssi-introduction.html b/versione-corrente/en/ssi-introduction.html index 9a781139c..5baebff42 100644 --- a/versione-corrente/en/ssi-introduction.html +++ b/versione-corrente/en/ssi-introduction.html @@ -639,16 +639,13 @@

        {{ item.title }}

    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
        -
      • General Properties
      • Requirements
        • -
      • High-level Design -
        • -
      • Detailed Design @@ -1074,25 +1068,31 @@

        Technical References

        OIDC-FED

        -

        OpenID Connect Federation 1.0

        +

        OpenID Connect Federation 1.0.

        OPENID4VCI

        -

        T. Lodderstedt, K. Yasuda, T. Looker, "OpenID for Verifiable Credential Issuance", February 2023.

        +
          +

        1. Lodderstedt, K. Yasuda, T. Looker, "OpenID for Verifiable Credential Issuance", February 2023.

          2. +
        +

        SD-JWT-VC

        -

        O. Terbu, D.Fett, "SD-JWT-based Verifiable Credentials (SD-JWT VC)".

        +
          +

        1. Terbu, D.Fett, "SD-JWT-based Verifiable Credentials (SD-JWT VC)".

          2. +
        +

        EIDAS-ARF

        -

        EUDI Wallet - Architecture and Reference Framework

        +

        EUDI Wallet - Architecture and Reference Framework.

        OPENID4VP

        -

        OpenID for Verifiable Presentations - draft 19

        +

        OpenID for Verifiable Presentations.

        PresentationExch

        -

        Presentation Exchange 2.0 for Presentation Definition

        +

        Presentation Exchange 2.0 for Presentation Definition.

        RFC 2119

        -

        Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels," BCP 14, RFC 2119, March 1997.

        +

        Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels" BCP 14, RFC 2119, March 1997.

        RFC 2616

        Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., and T. Berners-Lee, “Hypertext Transfer Protocol -- HTTP/1.1,” RFC 2616, June 1999.

        @@ -1101,52 +1101,52 @@

        Technical References

        Klyne, G. and C. Newman, "Date and Time on the Internet: Timestamps", RFC 3339, DOI 10.17487/RFC3339, July 2002.

        RFC 3986

        -

        Uniform Resource Identifier (URI): Generic Syntax

        - -

        RFC 7009

        -

        Lodderstedt, T., Dronia, S., Scurtescu, M., “OAuth 2.0 Token Revocation,” RFC7009, August 2013.

        +

        Uniform Resource Identifier (URI): Generic Syntax.

        -

        RFC 7159

        -

        Bray, T., “The JavaScript Object Notation (JSON) Data Interchange Format,” RFC 7159, March 2014.

        +

        RFC 7159

        +

        Bray, T., “The JavaScript Object Notation (JSON) Data Interchange Format” RFC 7159, March 2014.

        -

        RFC 7515

        +

        RFC 7515

        Jones, M., Bradley, J. and N. Sakimura, "JSON Web Signature (JWS)", RFC 7515, DOI 10.17487/RFC7515, May 2015.

        -

        RFC 7516

        +

        RFC 7516

        Jones, M., Hildebrand, J., "JSON Web Encryption (JWE)", May 2015.

        -

        RFC 7517

        +

        RFC 7517

        Jones, M., "JSON Web Key (JWK)", RFC 7517, DOI 10.17487/RFC7517, May 2015.

        -

        RFC 7518

        +

        RFC 7518

        Jones, M., "JSON Web Algorithms (JWA)", May 2015.

        -

        RFC 7519

        +

        RFC 7519

        Jones, M., Bradley, J. and N. Sakimura, "JSON Web Token (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015.

        -

        RFC 7638

        -

        Jones, M., Sakimura, N., “JSON Web Key (JWK) Thumbprint,”RFC7638, September 2015.

        +

        RFC 7638

        +

        Jones, M., Sakimura, N., “JSON Web Key (JWK) Thumbprint”, September 2015.

        -

        RFC 7800

        +

        RFC 7800

        Jones, M., Bradley, J. and H. Tschofenig, "Proof-of-Possession Key Semantics for JSON Web Tokens (JWTs)", RFC 7800, DOI 10.17487/RFC7800, April 2016.

        -

        RFC 8174

        +

        RFC 8174

        Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", RFC 8174, DOI 10.17487/RFC8174, May 2017.

        -

        RFC 8725

        +

        RFC 8725

        Jones, M., D. Hardt, Sheffer, Y., "JSON Web Token Best Current Practices", February 2020.

        -

        JARM

        +

        JARM

        Lodderstedt, T., Campbell, B., "JWT Secured Authorization Response Mode for OAuth 2.0 (JARM)", November 2022.

        -

        RFC 6749

        -

        The OAuth 2.0 Authorization Framework

        +

        RFC 6749

        +

        The OAuth 2.0 Authorization Framework.

        -

        RFC 9449

        -

        D. Fett, B. Campbell, J. Bradley, T. Lodderstedt, M. Jones, D. Waite, "OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)"

        +

        RFC 9449

        +
          +

        1. Fett, B. Campbell, J. Bradley, T. Lodderstedt, M. Jones, D. Waite, "OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)".

          2. +
        + -

        OPENID4VC-HAIP

        -

        Lodderstedt, T., K. Yasuda, "OpenID4VC High Assurance Interoperability Profile with SD-JWT VC"

        +

        OPENID4VC-HAIP

        +

        Lodderstedt, T., K. Yasuda, "OpenID4VC High Assurance Interoperability Profile with SD-JWT VC".

        diff --git a/versione-corrente/en/trust.html b/versione-corrente/en/trust.html index 33d0fa1e8..1c27bf227 100644 --- a/versione-corrente/en/trust.html +++ b/versione-corrente/en/trust.html @@ -639,16 +639,13 @@

        {{ item.title }}

    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
    • Wallet Attestation
        -
      • General Properties
      • Requirements
        • -
      • High-level Design -
        • -
      • Detailed Design @@ -1068,509 +1062,528 @@

        {{ item.title }}

        Wallet Attestation

        -

        The Wallet Attestation containing details about the Wallet Instance and the device's security level where the Wallet Instance is installed. It generally attests the authenticity, integrity, security, privacy, and trust of a specific Wallet Instance. The Wallet Attestation MUST contain a Wallet Instance public key.

        -
        -

        General Properties

        -

        The Wallet Attestation:

        -
          -

        • MUST be issued and MUST be signed by Wallet Provider;

          • -

        • MUST give all the relevant information to attests the integrity and security of the device where the Wallet Instance is installed.

          • -
        -

        It is necessary for each Wallet Instance to obtain a Wallet Attestation before entering the Operational state.

        -
        +

        Wallet Attestation contains information regarding the security level of the device hosting the Wallet Instance. It primarily certifies the authenticity, integrity, security, privacy, and trustworthiness of a particular Wallet Instance. The Wallet Attestation MUST contain a Wallet Instance public key.

        Requirements

        The following requirements for the Wallet Attestation are met:

        -
          -

        1. The Wallet Attestation MUST use the signed JSON Web Token (JWT) format.

          2. -

        2. The Wallet Provider MUST offer a RESTful set of services for issuing the Wallet Attestations.

          3. -

        3. The Wallet Attestation MUST be securely bound to the Wallet Instance public key (Holder Key Binding).

          4. +
            +

          • The Wallet Attestation MUST use the signed JSON Web Token (JWT) format;

            • +

          • The Wallet Attestation MUST give all the relevant information to attests the integrity and security of the device where the Wallet Instance is installed.

          • The Wallet Attestation MUST be issued and signed by an accredited and reliable Wallet Provider, thereby providing integrity and authenticity to the attestation.

            • -

          • The Wallet Attestation MUST ensure the integrity and authenticity of the Wallet Instance, verifying that it was accurately created and provided by the Wallet Provider.

            • -

          • Each Wallet Instance SHOULD be able to request multiple attestations with different public keys associated to them. This requirement provides a privacy-preserving measure, as the public key MAY be used as a tracking tool during the presentation phase (see also the point number 10, listed below).

            • -

          • The Wallet Attestation SHOULD be usable multiple times during its validity period, allowing for repeated authentication and authorization without the need to request new attestations with each interaction.

            • -

          • The Wallet Attestation SHOULD have an expiration date time, after which it will no longer be considered valid.

            • -

          • When the private key associated with the Wallet Instance is lost or deleted, the attestation MUST become invalid to prevent unauthorized use of the Wallet Instance.

            • -
        +

      • The Wallet Provider MUST ensure the integrity, authenticity, and genuineness of the Wallet Instance, preventing any attempts at manipulation or falsification by unauthorized third parties.

        • +

      • The Wallet Attestation MUST have a mechanism in place for revoking the Wallet Instance, allowing the Wallet Provider to terminate service for a specific instance at any time.

        • +

      • The Wallet Attestation MUST be securely bound to the Wallet Instance ephemeral public key.

        • +

      • The Wallet Attestation MAY be usable multiple times during its validity period, allowing for repeated authentication and authorization without the need to request new attestations with each interaction.

        • +

      • The Wallet Attestation MUST be short-lived and MUST have an expiration date time, after which SHOULD no longer be considered valid.

        • +

      • The Wallet Attestation MUST NOT be issued by the Wallet Provider if the authenticity, integrity, and genuineness are not guaranteed. In this case, the Wallet Instance MUST be revoked.

        • +

      • Each Wallet Instance SHOULD be able to request multiple attestations with different ephemeral public keys associated to them. This requirement provides a privacy-preserving measure, as the public key MAY be used as a tracking tool during the presentation phase (see also the point listed below).

        • +

      • The Wallet Attestation MUST NOT contain any information that can be used to directly reference the User.

        • +

      • The Wallet Instances MUST secure a Wallet Attestation as a prerequisite for transitioning to the Operational state, as defined by ARF.

        • +

      • Private keys MUST be generated and stored in the WSCD using at least one of the approaches listed below:

        +
          +

        • Local Internal WSCD: in this approach, the WSCD relies entirely on the device's native cryptographic hardware, such as the Secure Enclave on iOS devices or the Hardware Backed Keystore or Strongbox on Android devices.

          • +

        • Local External WSCD: the WSCD is an hardware external to the User's device, such as a smart card compliant with _GlobalPlatform_ and supporting _JavaCard_.

          • +

        • Remote WSCD: Here, the WSCD utilizes a remote Hardware Security Module (HSM).

          • +

        • Local Hybrid WSCD: the WSCD involves a pluggable internal hardware component within the User's device, such as an _eUICC_ that adheres to _GlobalPlatform_ standards and supports _JavaCard_.

          • +

        • Remote Hybrid WSCD: the WSCD involves a local component mixed with a remote service.

          • +
        +
        • +
      +
      +

      Warning

      +

      At the current stage, the current implementation profile defined in this document supports only the Local Internal WSCD. Future versions of this specification MAY include other approaches depending on the required AAL.

      +
      -
      -

      High-level Design

      -

      Static Component View

      +

      Static Component View

      -The image illustrates the containment of Wallet Provider and Wallet Instances within the Wallet Solution, managed by the Wallet Provider. +The image illustrates the containment of Wallet Provider and Wallet Instances within the Wallet Solution, managed by the Wallet Provider.
      -

      Dynamic Component View

      -

      This section describes the Wallet Attestation format and how the Wallet Provider issues it.

      -
      -The figure illustrates the sequence diagram for issuing a Wallet Attestation, with the steps explained below. +

      Dynamic Component View

      +

      The Wallet Attestation acquisition flow can be divided into two main phases. The first phase involves device initialization and registration, which occurs only during the initial launch of the Wallet Instance (after installation). The second phase pertains to the actual acquisition of the Wallet Attestation.

      +
      +

      Wallet Instance Initialization and Registration

      +
      +The figure illustrates the sequence diagram for initializa a Wallet Instance, with the steps explained below.
      +

      Step 1:: The User starts the Wallet Instance mobile app for the first time.

      +

      Step 2:: The Wallet Instance:

      +
      +
        +

      • check if Device Integrity Service is available.

        • +

      • check whether the device meets the minimum security requirements.

        • +
      +
      +
      +

      Note

      +

      Federation Check: The Wallet Instance needs to check if the Wallet Provider is part of the Federation, obtaining its protocol specific Metadata. A non-normative example of a response from the endpoint .well-known/openid-federation with the Entity Configuration and the Metadata of the Wallet Provider is represented within the section Wallet Provider metadata.

      +
      +

      Steps 3-5:: The Wallet Instance sends a request to the Wallet Provider Backend and receives a one-time challenge. This "challenge" is a nonce, which must be unpredictable to serve as the main defense against replay attacks. The backend must generate the nonce value in a manner that ensures it is single-use and valid only within a specific time frame. This endpoint is compliant with the specification OAuth 2.0 Nonce Endpoint.

      +
      GET /nonce HTTP/1.1
+Host: walletprovider.example.com
+
      +
      +
      HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+  "nonce": "d2JhY2NhbG91cmVqdWFuZGFt"
+}
+
      +
      +

      Step 6: The Wallet Instance, through the operating system, creates a pair of Cryptographic Hardware Keys and stores the corresponding Cryptographic Hardware Key Tag in local storage once the following requirements are met:

      +
      +
        +

      1. It MUST ensure that Cryptographic Hardware Keys do not already exist, if they exist and the Wallet is in the initialization phase they MUST be deleted.

        2. +

      2. It MUST generate a pair of asymmetric Elliptic Curve keys (Cryptographic Hardware Keys) via a local WSCD.

        3. +

      3. It SHOULD obtain a unique identifier (Cryptographic Hardware Key Tag) for the generated Cryptographic Hardware Keys from the operating system. If the operating system permits specifying a tag during the creation of keys, then a random string for the Cryptographic Hardware Key Tag MUST be selected. This random value MUST be collision-resistant and unpredictable to ensure security. To achieve this, consider using a cryptographic hash function or a secure random number generator provided by the operating system or a reputable cryptographic library.

        4. +

      4. If the previous points are satisfied, It MUST store the Cryptographic Hardware Key Tag in a local storage.

        5. +
      +
      +
      +

      Note

      +

      WSCD: The Wallet Instance MAY use a local WSCD for key generation on devices that support this feature. On Android devices, Strongbox is RECOMMENDED, Trusted Execution Environment (TEE) SHOULD be used only when Strongbox is unavailable. For iOS devices, Secure Elements (SE) SHOULD be used. Given that each OEM offers a distinct SDK for accessing the local WSCD, the discussion hereafter will address this topic in a general context.

      +
      +

      Step 7: The Wallet Instance uses the Device Integrity Service, providing a "challenge" and the Cryptographic Hardware Key Tag to acquire the Key Attestation.

      +
      +

      Note

      +

      Device Integrity Service: In this section the Device Integrity Service is considered as it is provided by device manufacturers. This service allows the verification of a key being securely stored within the device's hardware through a signed object. Additionally, it offers the verifiable proof that a specific Wallet Instance is authentic, unaltered, and in its original state using a specialized signed document made for this scope.

      +

      The service also incorporates details in the signed object, such as the device type, model, app version, operating system version, bootloader status, and other relevant information to assess the device has not been compromised. For Android the service used is Key Attestation in addition to Play Integrity API, while for iOS the DeviceCheck service.

      +
      +

      Step 8: The Device Integrity Service performs the following actions:

        -

      • Message 1: The User starts the Wallet Instance mobile app and gets authenticated to it.

        • -

      • Message 2: The Wallet Instance verifies the Wallet Provider's trustworthiness by evaluating its Trust Chain.

        • -

      • Message 3-4: The Wallet Instance retrieves the Wallet Provider metadata, including the list of supported algorithms, public keys, and endpoints.

        • -

      • Message 5: The Wallet Instance generates a new key pair.

        • -

      • Message 6-7: The Wallet Instance requests a nonce from the App Attestation Service.

        • -

      • Message 8: The Wallet Instance creates a Wallet Attestation Request in JWS format, signed with the private key associated with the public key for which it request the attestation.

        • -

      • Message 9-13: The Wallet Instance provides the Wallet Attestation Request to the Wallet Provider, which validates it and returns a signed attestation to the Wallet Instance.

        • -

      • Message 13-14: The Wallet Instance receives the Wallet Attestation signed by the Wallet Provider and performs security and integrity verifications.

        • -

      • Message 15: The Wallet Attestation is now ready for use.

        • +

      • Creates a Key Attestation that is linked with the provided "challenge" and the public key of the Wallet Hardware.

        • +

      • Incorporates information pertaining to the device's security.

        • +

      • Uses an OEM private key to sign the Key Attestation, therefore verifieable with the related OEM certificate, confirming that the Cryptographic Hardware Keys are securely managed by the operating system.

      +

      Step 9: The Wallet Instance sends the challenge with Key Attestation and Cryptographic Hardware Key Tag to the Wallet Provider Backend in order to register the Wallet Instance identified with the Cryptographic Hardware Key public key.

      +
      +

      Note

      +

      The Key Attestation (key_attestation) MUST be encoded in base64.

      +
      +
      PUT /wallet-instance HTTP/1.1
+Host: walletprovider.example.com
+Content-Type: application/json
+
+{
+  "challenge": "0fe3cbe0-646d-44b5-8808-917dd5391bd9",
+  "key_attestation": "o2NmbXRvYXBwbGUtYXBw... redacted",
+  "hardware_key_tag": "WQhyDymFKsP95iFqpzdEDWW4l7aVna2Fn4JCeWHYtbU="
+}
+
      +
      +
      +

      Note

      +

      It is not necessary to send the Wallet Hardware public key because it is already included in the key_attestation.

      +
      +
      +

      Warning

      +

      During the registration phase of the Wallet Instance with the Wallet Provider it is also necessary to associate it with a specific user +uniquely identifiable by the Wallet Provider. This association is at the discretion of the Wallet PRovider and will not be addressed +within these guidelines as each Wallet Provider may or may not have a user identification system already implemented.

      +
      +

      Steps 10-12: The Wallet Provider validates the challenge and key_attestation signature, therefore:

      +
      +
        +

      1. It MUST verify that the challenge was generated by Wallet Provider and has not already been used.

        2. +

      2. It MUST validate the key_attestation as defined by the device manufacturers' guidelines.

        3. +

      3. It MUST verify that the device in use has no security flaws and reflects the minimum security requirements defined by the Wallet Provider.

        4. +

      4. If these checks are passed, it MUST register the Wallet Instance, keeping the Cryptographic Hardware Key Tag and all useful information related to the device.

        5. +

      5. It SHOULD associate the Wallet Instance with a specific User uniquely identified within the Wallet Provider's systems. This will be useful for the lifecycle of the Wallet Instance and for a future revocation.

        6. +
      +
      +
      HTTP/1.1 201 Created
+Content-Type: application/json
+
      +
      +

      If any errors occur during the Wallet Instance registration, the Wallet Provider MUST return an error response. The response MUST use the content type set to application/json and MUST include the following parameters:

      +
      +
        +

      • error. The error code.

        • +

      • error_description. Text in human-readable form providing further details to clarify the nature of the error encountered.

        • +
      +
      +

      Steps 13-14: The Wallet Instance has been initialized and becomes operational.

      +
      +

      Note

      +

      Threat Model: while the registration endpoint does not necessitate any client authentication, it is safeguarded through the use of key_attestation. Proper validation of this attestation permits the registration of authentic and unaltered app instances. Any other claims submitted will not undergo validation, leading the endpoint to respond with an error. Additionally, the inclusion of a challenge helps prevent replay attacks. The authenticity of both the challenge and the hardware_key_tag is ensured by the signature found within the key_attestation.

      +
      -
      -
      -

      Detailed Design

      -

      The detailed design is explained below.

      -
      -

      Wallet Attestation Request

      -

      To obtain a Wallet Attestation from the Wallet -Provider it is necessary to send a Wallet Attestation -Request from the Wallet Instance containing the associated public key -, the nonce value provided by the App Attestation Service and a jti value.

      +
      +

      Wallet Attestation Issuance

      +

      This section describes the Wallet Attestation format and how the Wallet Provider issues it.

      +
      +The figure illustrates the sequence diagram for issuing a Wallet Attestation, with the steps explained below. +
      +

      Step 1:: The User initiates a new operation that necessitates the acquisition of a Wallet Attestation.

      +

      Steps 2-3:: The Wallet Instance checks if a Cryptographic Hardware Key exists and generates an ephemeral asymmetric key pair. The Wallet Instance also:

      +
      +
        +

      1. MUST ensure that Cryptographic Hardware Keys exist. If they do not exist, it is necessary to reinitialize the Wallet.

        2. +

      2. MUST generates an ephemeral asymmetric key pair whose public key will be linked with the Wallet Attestation.

        3. +

      3. MUST check if Wallet Provider is part of the federation and obtain its metadata.

        4. +
      +
      +

      Steps 4-6:: The Wallet Instance solicits a one-time "challenge" from the Wallet Provider Backend. This "challenge" takes the form of a "nonce," which is required to be unpredictable and serves as the main defense against replay attacks. The backend MUST produce the "nonce" in a manner that ensures its single-use within a predetermined time frame.

      +
      GET /nonce HTTP/1.1
+Host: walletprovider.example.com
+
      +
      +
      HTTP/1.1 200 OK
+Content-Type: application/json
+
+{
+  "nonce": "d2JhY2NhbG91cmVqdWFuZGFt"
+}
+
      +
      +

      Step 7: The Wallet Instance performs the following actions:

      +
      +
        +

      • Creates a client_data, a JSON structure that includes the challenge and the ephemeral public jwk.

        • +

      • Computes a client_data_hash by applying the SHA256 algorithm to the client_data.

        • +
      +
      +

      Below a non-normative example of the client_data.

      +
      {
+  "challenge": "0fe3cbe0-646d-44b5-8808-917dd5391bd9",
+  "jwk": {
+      "crv": "P-256",
+      "kty": "EC",
+      "x": "4HNptI-xr2pjyRJKGMnz4WmdnQD_uJSq4R95Nj98b44",
+      "y": "LIZnSB39vFJhYgS3k7jXE4r3-CoGFQwZtPBIRqpNlrg",
+      "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c"
+    }
+}
+
      +
      +

      Steps 8-10: The Wallet Instance takes the following steps:

      +
      +
        +

      • It produces an hardware_signature by signing the client_data_hash with the Wallet Hardware's private key, serving as a proof of possession for the Cryptographic Hardware Keys.

        • +

      • It requests the Device Integrity Service to create an integrity_assertion linked to the client_data_hash.

        • +

      • It receives a signed integrity_assertion from the Device Integrity Service, authenticated by the OEM.

        • +
      +
      +
      +

      Note

      +

      integrity_assertion is a custom payload generated by Device Integrity Service, signed by device OEM and encoded in base64 to have uniformity between different devices.

      +
      +
      +
      Steps 11-12: The Wallet Instance:
        +

      • Constructs the Wallet Attestation Request in the form of a JWT. This JWT includes the integrity_assertion, hardware_signature, challenge, wallet_hardware_key_tag, and public_jwk, and is signed using the private key from the initially generated ephemeral key pair.

        • +

      • Submits the Wallet Attestation Request to the Wallet Provider's backend through the token endpoint.

        • +
      +
      +
      +

      Below an non-normative example of the Wallet Attestation Request JWT without encoding and signature applied:

      +
      {
+  "alg": "ES256",
+  "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c",
+  "typ": "war+jwt"
+}
+.
+{
+  "iss": "https://wallet-provider.example.org/instance/vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c",
+  "sub": "https://wallet-provider.example.org/",
+  "challenge": "6ec69324-60a8-4e5b-a697-a766d85790ea",
+  "hardware_signature": "KoZIhvcNAQcCoIAwgAIB...redacted",
+  "integrity_assertion": "o2NmbXRvYXBwbGUtYXBwYX...redacted",
+  "hardware_key_tag": "WQhyDymFKsP95iFqpzdEDWW4l7aVna2Fn4JCeWHYtbU=",
+  "cnf": {
+    "jwk": {
+      "crv": "P-256",
+      "kty": "EC",
+      "x": "4HNptI-xr2pjyRJKGMnz4WmdnQD_uJSq4R95Nj98b44",
+      "y": "LIZnSB39vFJhYgS3k7jXE4r3-CoGFQwZtPBIRqpNlrg",
+      "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c"
+    },
+    "vp_formats_supported": {
+        "jwt_vc_json": {
+          "alg_values_supported": ["ES256K", "ES384"],
+        },
+        "jwt_vp_json": {
+          "alg_values_supported": ["ES256K", "EdDSA"],
+        },
+      },
+  },
+  "iat": 1686645115,
+  "exp": 1686652315
+}
+
      +

      The Wallet Instance MUST do an HTTP request to the Wallet Provider's token endpoint, using the method POST.

      The token endpoint (as defined in RFC 7523 section 4) requires the following parameters encoded in application/x-www-form-urlencoded format:

      • grant_type set to urn:ietf:params:oauth:grant-type:jwt-bearer;

        • -

      • assertion containing the signed JWT defined in the Section Wallet Attestation Request.

        • +

      • assertion containing the signed JWT of the Wallet Attestation Request.

      -

      Below a non-normative example of the HTTP request.

      POST /token HTTP/1.1
 Host: wallet-provider.example.org
 Content-Type: application/x-www-form-urlencoded
 
 grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer
-&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6ImtoakZWTE9nRjNHeGRxd2xVTl9LWl83NTVUT1ZEbmJIaDg2TW1KcHh2a1UifQ.eyJpc3MiOiAidmJlWEprc000NXhwaHRBTm5DaUc2bUN5dVU0amZHTnpvcEd1S3ZvZ2c5YyIsICJhdWQiOiAiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmciLCAianRpIjogImY1NjUyMDcyLWFiZWYtNDU5OS1iODYzLTlhNjkwNjA3MzJjYyIsICJub25jZSI6ICIuLi4uLiIsICJjbmYiOiB7Imp3ayI6IHsiY3J2IjogIlAtMjU2IiwgImt0eSI6ICJFQyIsICJ4IjogIjRITnB0SS14cjJwanlSSktHTW56NFdtZG5RRF91SlNxNFI5NU5qOThiNDQiLCAieSI6ICJMSVpuU0IzOXZGSmhZZ1MzazdqWEU0cjMtQ29HRlF3WnRQQklScXBObHJnIiwgImtpZCI6ICJ2YmVYSmtzTTQ1eHBodEFObkNpRzZtQ3l1VTRqZkdOem9wR3VLdm9nZzljIn19LCAiaWF0IjogMTY5MTQ4ODk2MiwgImV4cCI6IDE2OTE0OTYxNjJ9.Dg_yFaiv6lVftR3FFx0v5JW250mBgXLVP1j0ezZcHRyitqSY7xGmx4y-MGur93FAS85vf_Da-L-REVEltwU2Jw
+&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6ImtoakZWTE9nRjNHeG...
      -

      The response is the Wallet Attestation in JWT format:

      +

      Steps 13-17: The Wallet Provider's backend assesses the Wallet Attestation Request and issues a Wallet Attestation, if the requirements described below are satisfied:

      +
      +
        +

      1. It MUST check the Wallet Attestation Request contains all the defined parameters according to Table of the Wallet Attestation Request parameters.

        2. +

      2. It MUST verify that the signature of the received Wallet Attestation Request is valid and associated with public jwk.

        3. +

      3. It MUST verify that the challenge was generated by Wallet Provider and has not already been used.

        4. +

      4. It MUST check that there is a Wallet Instance registered with that hardware_key_tag and that it is still valid.

        5. +

      5. It MUST reconstruct the client_data via the challenge and the jwk public key, to validate hardware_signature via the Cryptographic Hardware Key public key registered and associated with the Wallet Instance.

        6. +

      6. It MUST validate the integrity_assertion as defined by the device manufacturers' guidelines.

        7. +

      7. It MUST verify that the device in use has no security flaws and reflects the minimum security requirements defined by the Wallet Provider.

        8. +

      8. It MUST check that the URL in iss parameter is equal to the URL identifier of Wallet Provider.

        9. +
      +
      +

      If all checks are passed, Wallet Provider issues a Wallet Attestation with an expiration limited to 24 hours.

      +

      Below an non-normative example of the Wallet Attestation without encoding and signature applied:

      +
        {
+  "alg": "ES256",
+  "kid": "5t5YYpBhN-EgIEEI5iUzr6r0MR02LnVQ0OmekmNKcjY",
+  "trust_chain": [
+    "eyJhbGciOiJFUz...6S0A",
+    "eyJhbGciOiJFUz...jJLA",
+    "eyJhbGciOiJFUz...H9gw",
+  ],
+  "typ": "wallet-attestation+jwt",
+}
+.
+{
+  "iss": "https://wallet-provider.example.org",
+  "sub": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c",
+  "aal": "https://trust-list.eu/aal/high",
+  "cnf":
+  {
+    "jwk":
+    {
+      "crv": "P-256",
+      "kty": "EC",
+      "x": "4HNptI-xr2pjyRJKGMnz4WmdnQD_uJSq4R95Nj98b44",
+      "y": "LIZnSB39vFJhYgS3k7jXE4r3-CoGFQwZtPBIRqpNlrg",
+      "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c"
+    }
+  },
+  "authorization_endpoint": "eudiw:",
+  "response_types_supported": [
+    "vp_token"
+  ],
+  "response_modes_supported": [
+    "form_post.jwt"
+  ],
+  "vp_formats_supported": {
+      "vc+sd-jwt": {
+          "sd-jwt_alg_values": [
+              "ES256",
+              "ES384"
+          ]
+      }
+  },
+  "request_object_signing_alg_values_supported": [
+    "ES256"
+  ],
+  "presentation_definition_uri_supported": false,
+  "iat": 1687281195,
+  "exp": 1687288395
+}
+
      +
      +

      Step 18: The Wallet Instance receives the Wallet Attestation signed by the Wallet Provider and performs security and integrity verifications.

      HTTP/1.1 201 OK
 Content-Type: application/jwt
 
-eyJhbGciOiJFUzI1NiIsInR5cCI6IndhbGxldC1hdHRlc3RhdGlvbitqd3QiLCJraWQiOiI1dDVZWXBCaE4tRWdJRUVJNWlVenI2cjBNUjAyTG5WUTBPbWVrbU5LY2pZIiwidHJ1c3RfY2hhaW4iOlsiZXlKaGJHY2lPaUpGVXouLi42UzBBIiwiZXlKaGJHY2lPaUpGVXouLi5qSkxBIiwiZXlKaGJHY2lPaUpGVXouLi5IOWd3Il19.eyJpc3MiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZyIsInN1YiI6InZiZVhKa3NNNDV4cGh0QU5uQ2lHNm1DeXVVNGpmR056b3BHdUt2b2dnOWMiLCJ0eXBlIjoiV2FsbGV0SW5zdGFuY2VBdHRlc3RhdGlvbiIsInBvbGljeV91cmkiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9wcml2YWN5X3BvbGljeSIsInRvc191cmkiOiJodHRwczovL3dhbGxldC1wcm92aWRlci5leGFtcGxlLm9yZy9pbmZvX3BvbGljeSIsImxvZ29fdXJpIjoiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmcvbG9nby5zdmciLCJhdHRlc3RlZF9zZWN1cml0eV9jb250ZXh0IjoiaHR0cHM6Ly93YWxsZXQtcHJvdmlkZXIuZXhhbXBsZS5vcmcvTG9BL2Jhc2ljIiwiY25mIjp7Imp3ayI6eyJjcnYiOiJQLTI1NiIsImt0eSI6IkVDIiwieCI6IjRITnB0SS14cjJwanlSSktHTW56NFdtZG5RRF91SlNxNFI5NU5qOThiNDQiLCJ5IjoiTElablNCMzl2RkpoWWdTM2s3alhFNHIzLUNvR0ZRd1p0UEJJUnFwTmxyZyIsImtpZCI6InZiZVhKa3NNNDV4cGh0QU5uQ2lHNm1DeXVVNGpmR056b3BHdUt2b2dnOWMifX0sImF1dGhvcml6YXRpb25fZW5kcG9pbnQiOiJldWRpdzoiLCJyZXNwb25zZV90eXBlc19zdXBwb3J0ZWQiOlsidnBfdG9rZW4iXSwidnBfZm9ybWF0c19zdXBwb3J0ZWQiOnsiand0X3ZwX2pzb24iOnsiYWxnX3ZhbHVlc19zdXBwb3J0ZWQiOlsiRVMyNTYiXX0sImp3dF92Y19qc29uIjp7ImFsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2Il19fSwicmVxdWVzdF9vYmplY3Rfc2lnbmluZ19hbGdfdmFsdWVzX3N1cHBvcnRlZCI6WyJFUzI1NiJdLCJwcmVzZW50YXRpb25fZGVmaW5pdGlvbl91cmlfc3VwcG9ydGVkIjpmYWxzZSwiaWF0IjoxNjg3MjgxMTk1LCJleHAiOjE2ODcyODgzOTV9.tNvCyFPCL5tUi2NakKwdaG9xbrtWWl4djSRYRfHrF8NdmffdT044U55pRn35J2cl0LZxbesEDrfSAz2pllw2Ug
+eyJhbGciOiJFUzI1NiIsInR5cCI6IndhbGx... redacted
      -

      Below are described the JWT headers and the payload claims -of the assertion used in the request.

      -
      -

      Assertion Header

      +
      +
      +

      Wallet Attestation Request

      +

      The JOSE header of the Wallet Attestation Request JWT MUST contain:

      - - - +++++ + + + + - - + + + + + - - + + + - - + + +

      key

      value

      JOSE header

      Description

      Reference

      alg

      Algorithm to verify the token -signature (es. ES256).

      alg

      A digital signature algorithm identifier such as per IANA "JSON Web Signature and Encryption Algorithms" registry. It MUST be one of the supported algorithms listed in the Section Cryptographic Algorithms and MUST NOT be set to none or any symmetric algorithm (MAC) identifier.

      RFC 7516#section-4.1.1.

      kid

      Key id of the public key -created by the Wallet Instance.

      kid

      Unique identifier of the jwk inside the cnf claim of Wallet Instance as base64url-encoded JWK Thumbprint value.

      RFC 7638#section_3.

      typ

      Media type, set to -wiar+jwt.

      typ

      It MUST be set to var+jwt
      -
      -
      -

      Assertion Payload

      +

      The body of the Wallet Attestation Request JWT MUST contain:

      +++++ + + + + + + - - + + + - - + + + - - + + + - - + + + - - + + + - - + + + - - + + + - - + + + + + + +

      Claim

      Description

      Reference

      key

      value

      iss

      Identifier of the Wallet Provider concatenated with thumbprint of the JWK in the cnf parameter.

      RFC 9126 and RFC 7519.
      -
      iss
      -

      -

      -

      -
      -
      -
      Thumbprint value
      -
      of the JWK of the Wallet Instance
      -
      for which the attestation is
      -
      being requested.
      -
      -

      aud

      It MUST be set to the identifier of the Wallet Provider.

      RFC 9126 and RFC 7519.
      -
      aud
      -

      -
      -
      -
      The public url of the Wallet
      -
      Provider.
      -
      -

      exp

      UNIX Timestamp with the expiry time of the JWT.

      RFC 9126 and RFC 7519.
      -
      jti
      -

      -

      -
      -
      -
      Unique identifier of the request, according to
      -
      RFC7519.
      -

      -
      -

      iat

      UNIX Timestamp with the time of JWT issuance.

      RFC 9126 and RFC 7519.
      -
      nonce
      -

      -
      -
      -
      The nonce value obtained from the
      -
      App Attestation Service.
      -
      -

      challenge

      Challenge data obtained from nonce endpoint
      -
      cnf
      -

      -

      -

      -
      -
      -
      JSON object, according to
      -
      RFC7800
      -
      containing the public part of an asymmetric key pair owned
      -
      by the Wallet Instance.
      -
      -

      hardware_signature

      The signature of client_data obtained using Cryptographic Hardware Key base64 encoded.
      -
      iat
      -

      -
      -
      -
      Unix timestamp of attestation request
      -
      issuance time.
      -
      -

      integrity_assertion

      The integrity assertion obtained from the Device Integrity Service with the holder binding of client_data.
      -
      exp
      -

      -
      -
      -
      Unix timestamp regarding the
      -
      expiration date time.
      -
      -

      hardware_key_tag

      Unique identifier of the Cryptographic Hardware Keys

      cnf

      JSON object, containing the public part of an asymmetric key pair owned by the Wallet Instance.

      RFC 7800
      -

      Below a non-normative example of the Wallet Attestation -request where the decoded JWS headers and payload are separated by a comma:

      -
      {
-  "alg": "ES256",
-  "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c",
-  "typ": "wiar+jwt"
-}
-.
-{
-  "iss": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c",
-  "aud": "https://wallet-provider.example.org",
-  "jti": "6ec69324-60a8-4e5b-a697-a766d85790ea",
-  "nonce" : ".....",
-  "cnf": {
-    "jwk": {
-      "crv": "P-256",
-      "kty": "EC",
-      "x": "4HNptI-xr2pjyRJKGMnz4WmdnQD_uJSq4R95Nj98b44",
-      "y": "LIZnSB39vFJhYgS3k7jXE4r3-CoGFQwZtPBIRqpNlrg",
-      "kid": "vbeXJksM45xphtANnCiG6mCyuU4jfGNzopGuKvogg9c"
-    }
-  },
-  "iat": 1686645115,
-  "exp": 1686652315
-}
-
      -
      -

      Whose corresponding JWS is verifiable using the public part of an asymmetric -key pair owned by the Wallet Instance that has a key id which is the same -as the kid made available in the JWS header.

      -
      -
      -

      Wallet Attestation

      -

      The Wallet Attestation MUST be provisioned in JWT format, with -headers and payload claims are listed below.

      -
      diff --git a/versione-corrente/en/wallet-solution.html b/versione-corrente/en/wallet-solution.html index 3def62227..d64feeb11 100644 --- a/versione-corrente/en/wallet-solution.html +++ b/versione-corrente/en/wallet-solution.html @@ -639,16 +639,13 @@

      {{ item.title }}

  • Wallet Attestation
  • Wallet Attestation
      -
    • General Properties
    • Requirements
      • -
    • High-level Design -
      • -
    • Detailed Design @@ -1068,12 +1062,13 @@

      {{ item.title }}

      Wallet Solution

      -

      The Wallet Solution is a comprehensive product offered by the Wallet Provider to cater to the needs of Users in managing their digital assets securely. Designed to provide a seamless User experience, this solution enables Users to leverage the capabilities of the Wallet effectively.

      -

      The Wallet Solution is issued by the Wallet Provider in the form of a mobile app, it also consists of services and web interfaces for the exchange of data between the Wallet Provider and its Wallet Instances for the requirements of the trust model and in total respect of the user's privacy, in accordance with national and EU legislation.

      -

      The mobile app serves as the primary interface for Users, allowing them to access and interact with their digital assets conveniently. These digital assets, known as Attestations, include Personal Identification Data (PID[1]), a set of data that can uniquely identify a natural or a legal person, along with other Qualified and non-qualified Electronic Attestations of Attributes, also known as QEAAs and EAAs respectively, or (Q)EAAs for short[1]. Once a User installs the mobile app on their device, it is referred to such an installation as a Wallet Instance for the User.

      +

      The Wallet Solution is a comprehensive product offered by the Wallet Provider to cater to the needs of Users in managing their digital assets securely. It is issued by the Wallet Provider in the form of a mobile app, it also consists of services and web interfaces for the exchange of data between the Wallet Provider and its Wallet Instances for the requirements of the trust model and in total respect of the User's privacy, in accordance with national and EU legislation.

      +

      The mobile app serves as the primary interface for Users, allowing them to access and interact with their digital Credentials conveniently. These are a set of data that can uniquely identify a natural or a legal person, along with other Qualified and non-qualified Electronic Attestations of Attributes, also known as QEAAs and EAAs respectively, or (Q)EAAs for short[1]. Once a User installs the mobile app on their device, it is referred to such an installation as a Wallet Instance for the User.

      By supporting the mobile app, the Wallet Provider plays a vital role in ensuring the security and reliability of the entire Wallet Solution, since it is responsible for issuing the Wallet Attestation, that is a cryptographic proof that allow the evaluation of the authenticity and the integrity of the Wallet Instance.

      +

      The Wallet Provider MUST offer a RESTful set of services for issuing the Wallet Attestations.

      Requirements

      +

      This section lists below the essential requirements that must be met by the Wallet Solution to ensure its functionality, security, and compliance with relevant standards and regulations.

      • Trustworthiness within the Wallet ecosystem: the Wallet Instance MUST establish trust and reliability within the Wallet ecosystem.

        • @@ -1085,28 +1080,28 @@

        Requirements

        Wallet Instance

        -

        The Wallet Instance serves as a unique and secure device for authenticating the User within the Wallet ecosystem. It establishes a strong and reliable identity for the User, enabling them to engage in various digital transactions in a secure and privacy-preserving manner.

        -

        The Wallet Instance establishes the trust within the Wallet ecosystem by consistently presenting a Wallet Attestation during interactions with other ecosystem actors such as PID Providers, (Q)EAA Providers, and Relying Parties. These verifiable attestations, provided by the Wallet Provider, reference the public part of the asymmetric cryptographic key owned by the Wallet Instance. Their purpose is to authenticate the Wallet Instance itself, ensuring its realiability when engaging with other ecosystem actors.

        -

        To guarantee the utmost security, these cryptographic keys are securely stored within the device's Trusted Execution Environment (TEE)[3]. This ensures that only the User is allowed to access them, thus preventing unauthorized usage or tampering. For more detailed information, please refer to the Wallet Attestation section and the Trust Model section of this document.

        +

        The Wallet Instance serves as a unique and secure device for authenticating the User within the Wallet ecosystem. It establishes a strong and reliable mechanismm for the User to engage various digital transactions in a secure and privacy-preserving manner.

        +

        The Wallet Instance establishes the trust within the Wallet ecosystem by consistently presenting a Wallet Attestation during interactions with other ecosystem actors such as PID Providers, (Q)EAA Providers, and Relying Parties. These verifiable attestations, provided by the Wallet Provider, purpose to authenticate the Wallet Instance itself, ensuring its realiability when engaging with other ecosystem actors.

        +

        To guarantee the utmost security, these cryptographic keys MUST be securely stored within the WSCD which MAY be internal (device's Trusted Execution Environment (TEE)[3]), external, or hybrid. This ensures that only the User is allowed to access them, thus preventing unauthorized usage or tampering. For more detailed information please refer to the Wallet Attestation section and the Trust Model section of this document.

      Wallet Instance Lifecycle

      The Wallet Instance has three distinct states: Operational, Valid, and Deactivated. Each state represents a specific functional status and determines the actions that can be performed[2].

      Initialization Process

      -

      To activate the Wallet Instance, the Users MUST install the mobile wallet application on their device and open it. Furthermore, Users will be asked to set their preferred method of unlocking their device; this can be accomplished by entering a personal identification number (PIN) or by utilizing biometric authentication, such as fingerprint or facial recognition, according to their personal preferences and device's capabilities.

      +

      To activate the Wallet Instance, the Users MUST install the mobile Wallet application on their device and open it. Furthermore, Users will be asked to set their preferred method of unlocking their device; this can be accomplished by entering a personal identification number (PIN) or by utilizing biometric authentication, such as fingerprint or facial recognition, according to their personal preferences and device's capabilities.

      After completing these steps, the Wallet Instance sets the Operational state.

      Transition to Valid state

      To transition from the Operational state to the Valid state, the Wallet Instance MUST obtain a valid Personal Identification (PID). Once a valid PID is acquired, the Wallet Instance becomes Valid.

      -

      In order to securely and unambiguously identify Users, the Wallet Instance adopts a Level of Assurance (LoA) 3 authentication, which guarantees a high level of confidence in the User's identity. The authentication method is chosen by the PID Provider from among the notified eID solutions at the national level.

      +

      To securely and unambiguously authenticate Users, the Wallet Instance necessitates a High Level of Assurance (LoA 3) for User authentication. The method to achieve this LoA is selected by the PID Provider based on the identity proofing method employed during the provisioning of the Digital Credential to the User. Furthermore, to store the acquired Digital Credential, the Wallet Instance MUST demonstrate to the Credential Issuer an adequate security compliance to maintain the Credential at the same LoA at which it was issued.

      Once the Wallet Instance is in the Operational state, Users can:

      • Obtain, view, and manage (Q)EAAs from trusted (Q)EAA Providers[1];

      • Authenticate to Relying Parties[1];

        • -

      • Authorize the presentation of their digital credentials with Relying Parties.

        • +

      • Authorize the presentation of their digital Credentials with Relying Parties.

      Please refer to the relative sections for further information about PID and (Q)EAAs issuance and presentation.

      diff --git a/versione-corrente/it/.doctrees/environment.pickle b/versione-corrente/it/.doctrees/environment.pickle index 1b2b2089cc658cd5abe2644e0a90233954905db7..8adad33b16238bcbac6b1d8c835c3307218772a2 100644 GIT binary patch delta 3238 zcmcImeNa@_72gMb#LhtCR+`kWUD>sDZdad_Zo8OsgreLyNRJ9ch{t`C3ubOgg5SrX8lEvFF@Zx2!Y$ zvwyJX{C@Yn-#Pc(^UmeW2gzqXNbWJ1zf$j4g0kvsuJcF33;Y3>Pj)rPewZ|WRayco zikGxR!zr>->+vbFC7?9WV-GbbjjG!f@TfkE*W(W$_23Sd*Q*39e$^W!J{nG~ak-xh z)>|4Be?V7KNYwB7FAw`hRf_%Aw_&SG)2 z-{D}>anzA%XE)>MKz0`!kE2N5a&|qA4q8vKkK^c&EyhOU2(oXnE1TjlnsbOrvV~eU_d{u#T6|yba;D0OwHm^1%N7#+~aO^%j zeILF#8$9pd z8UJ3-9)vTwY0@-Y%FV&5&CUA|{+Vxr+j-xIJ4GhgY13R`UWesLXKM%z=|AR3eHq3uyqvJ>P{L$Wu>qh@69kw=Zl z2FRl(WS7XJ24oZDQS-4+$fL$%Gvr+%Z|)rYp?+g}@~GFCfjsInmNCbKztm(bpGayj zwgJ6hcuqid`=h(5*nFU5r35FM%sj=uRD$tl8+ScXLXI9<+l_p==q_b&wF`7iUSr}X$jzn;&l*s3`Vm9lW))8?=7)J>Sr>3%D3c^Y%U=YVqg>vu30 z0+dV3GnmWj0Xt9Kf{74IiR}L#CK7u|#gi|DJyj0ywQB+YR<&3{pogW~V$w9fv+Y$Vmx_H>3kF4te6kKz4T@fDY{rMm2F1!f^{7fLZS14xabpB%V;(e7nC6J}8;C%-%VFJc- z12+LG6X@Px<$Y09CeY)_;^nVm(gZ3RSMh(aBvXjX-qrYjlLTK#9kGjLMF8DDiy!@EN4_nEBU#g6e5KTJpPp ziV+A<^0!W51Ok+N)z2^j0ZRVX8yJBACBOSk3_*aBzx@`~=A`zqWE4FN7vFKf*;C>` zA-@Mdn4>Drm+jEqsU7lXy%@f`Q_l^Y4!IL6^K%S~jM$i|55p3mjrF~UVU4fZdHFBs zkddWb4g3;A-rR_XTx@|i&pM#GQj>n@McNj=x7uhSjC$*H021eBA2 z)+V651eBkE3KCFJ0xG$OY$Ck<9u%l70hK49C+{I{{qVL{t8GzHD>QTqp`lHnq5B67 z)d~&O3Jui?4b=(_)d~&O3Jui?4b=(_)e6lN9Qq(H=lm-=-*GeD5-ph7r6b3JsNLOI~s8hNIPmivb#^A{4(2tN_x>JDhc4kE<8-J}sai4fQKE{$j*Lfqo58qr3C zxXkxx#LGm8JN*^CZac-@M~t}J!`dSUh!9tNL?eI*annaN;xG~7!at%B$B7Wvey2us z5itdW<7>nRgC|A*jiCAeG{Fxh@}*^vI=M1UY()IqK~14;V;Y7hT>oRmF-}&zTe&_z~x!t&U0&Oz~`wC2H>dm`#DJ-zdz_w-AW|9z^628 zZdbsgsWz|2AMi)Q$+FVmQ5D%1P<)Mu?}tTY_qRvF-)r(KL0MDVs5slB%1Ub_oZ94( zZHmifYm_y&&0VkgBH?-dfJ>EKJ{hk|nO^tHHr5irLcPoVY_Q4ZQ~UwVhaKECeTD1_ zxR5yD3;OZ8`7JK5R|(ksnm35uNh(iTJS(yNYJ$P=sC{Vrdv`x`GnWm=(1v%i*mw;6 zZ0T)wDTX%QvxJSt(58F7Vb@})Ha(ABj-k4=G4^E)xy%jhVhq)%SF*A7G3d_th>gUM zvMGsOiJ^wnDt0}Fem?&yi^kCAxh-rWhCE3vFq%~?U4=Yb9<(gUgu#bw@UU(9be`D7 z#^cs1a%ZlM&RoN5uYCt!o{8bmL$TjNU!2C+%jaUI+#wt#0}I-D%7fE~!t{#qui zDXD;Ym>)cx31=|hSz>|g(w{;bGOB&|!pEf*@HG9ttP!SGS)jMfCx(;lq+6uHWUo_3 zL&@H!j0Tc@NEr!*wck)5ZEhLDX>Mgz#cqKt-*O;R>S+3Z>PMKi~Yl+nB~6J<1O zEPIv(ziH4|5fy33SS4n`@T`F5_D8mn;k>_mu>`NTT6wZPU4qfJLhgE`oDw5+bej3# z>QWu_G-UAdwbeQ>Z_eX`l}`xp%AOqVa#ZRI)y)s`=nvOP@SnXa!K@a-t%7to=5)Zh zeOAa^_bDtmq2U8DLG$AdIC3%-%%|_>mmW7t2#kDA)doHBRm&oQuiGBrDeJMHBPa8D z`;*uUUI*06KYon85TIV#e}cU%?YHxkr?C;LQX_kx!A1%OG<@oy)lt93%ngbG!?ZxL+99s)K)#`wr)w-9Tw4zAQ zY9s%;O`#;8cWyy)tO(csy%os`kZYaWk=*RC^Rx~mrYiLwc@BFY+MwZ^U;JzJyqp0f*kCqTXTbRsOJ`dq$fbV_k@t10QH`;2PFtpHD~ePgi&I_YZ|^} zGW2xoo&Reeb>3~{rY`EdJD(qWnL6**JGTIJj(|Ep7NO4HwDYyUq|UKQo%ioY+B>}( zzOM|<_2Eb#K+0r}BYhA%PUhc^bT`rx5F`Bt(h?9OeF$k0h>?C1nQ4KTqi-Rzy$8aN=Fz4HWf$3j19eZZx%EQoi-859Lh?`o+;NlY)Nz7G<#_Zp?BF zWeEtsK1A6=9`x&XC`nb}*GDLMeH}jOG8=qw!U1*FI`w@YBXwQ1QM`WM-{YMTpzUDv zBuWqkP&Qxwbog-nQE9^dl z3TkIQpZpWDQ*eA~+`;8aveD`0FnyN%S=X|~7rhfp=xnhTPN@9C;&J%m9 zGeK;uxJJ7w2HH|F(0+=6Hd73=lVYH46a(#{$U++^BHBDLOu(N9AHm}#<+H|i+O)e^ z&Rm1xCEPxBloyAV#i12(s2~m%#i8OjR2qlMr%|Dhw@*WXR>z^Wap=)$#PdJDrF*q8 zBD}&tM-c|P2@G@yVIZ$CkXIPUD-7fn2J#96d4++z!a!bOAg?e?z{_8(dy1Y(NXUeQ zN=S%=ghoh6goHv!2!sTGNYIA_dq|Ln1b0YKhu8$q|Jzv!&-Xijw@brdA1aZ?Vf#?2 zGzuq%3Z!drb7)P%0Uy>cd5H?*obS>LKm~E!NA$ve zDu`46RlRVK3gYbV)(eNIFaZOj%f$
  • Wallet Attestation