<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"ＭＳ ゴシック";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"ＭＳ Ｐゴシック";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:"Noto Sans CJK JP Medium";
panose-1:2 11 6 0 0 0 0 0 0 0;}
@font-face
{font-family:"Lucida Console";
panose-1:2 11 6 9 4 5 4 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@Noto Sans CJK JP Medium";
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"\@ＭＳ Ｐゴシック";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@ＭＳ ゴシック";
panose-1:2 11 6 9 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"ＭＳ Ｐゴシック";}
h3
{mso-style-priority:9;
mso-style-link:"見出し 3 \(文字\)";
mso-margin-top-alt:auto;
margin-right:0mm;
mso-margin-bottom-alt:auto;
margin-left:0mm;
font-size:13.5pt;
font-family:"ＭＳ Ｐゴシック";
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0mm;
mso-margin-bottom-alt:auto;
margin-left:0mm;
font-size:12.0pt;
font-family:"ＭＳ Ｐゴシック";}
pre
{mso-style-priority:99;
mso-style-link:"HTML 書式付き \(文字\)";
margin:0mm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"ＭＳ ゴシック";}
tt
{mso-style-priority:99;
font-family:"ＭＳ ゴシック";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0mm;
margin-right:0mm;
margin-bottom:0mm;
margin-left:42.0pt;
margin-bottom:.0001pt;
mso-para-margin-top:0mm;
mso-para-margin-right:0mm;
mso-para-margin-bottom:0mm;
mso-para-margin-left:4.0gd;
mso-para-margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"ＭＳ Ｐゴシック";}
span.17
{mso-style-type:personal-reply;
font-family:"Arial",sans-serif;
color:#1F497D;}
span.3
{mso-style-name:"見出し 3 \(文字\)";
mso-style-priority:9;
mso-style-link:"見出し 3";
font-family:"ＭＳ Ｐゴシック";
font-weight:bold;}
span.HTML
{mso-style-name:"HTML 書式付き \(文字\)";
mso-style-priority:99;
mso-style-link:"HTML 書式付き";
font-family:"ＭＳ ゴシック";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Arial",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1248465756;
mso-list-type:hybrid;
mso-list-template-ids:1326475918 1533020400 67698711 67698705 67698703 67698711 67698705 67698703 67698711 67698705;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:18.0pt;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Arial",sans-serif;
mso-fareast-font-family:"ＭＳ Ｐゴシック";
color:#222222;}
@list l0:level2
{mso-level-number-format:aiueo-full-width;
mso-level-text:"\(%2\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:42.0pt;
text-indent:-21.0pt;}
@list l0:level3
{mso-level-number-format:decimal-enclosed-circle;
mso-level-text:%3;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:63.0pt;
text-indent:-21.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:84.0pt;
text-indent:-21.0pt;}
@list l0:level5
{mso-level-number-format:aiueo-full-width;
mso-level-text:"\(%5\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:105.0pt;
text-indent:-21.0pt;}
@list l0:level6
{mso-level-number-format:decimal-enclosed-circle;
mso-level-text:%6;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:126.0pt;
text-indent:-21.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:147.0pt;
text-indent:-21.0pt;}
@list l0:level8
{mso-level-number-format:aiueo-full-width;
mso-level-text:"\(%8\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:168.0pt;
text-indent:-21.0pt;}
@list l0:level9
{mso-level-number-format:decimal-enclosed-circle;
mso-level-text:%9;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:189.0pt;
text-indent:-21.0pt;}
@list l1
{mso-list-id:1956132713;
mso-list-template-ids:-111408990;}
ol
{margin-bottom:0mm;}
ul
{margin-bottom:0mm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="JA" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">During the OpenID Connect standardization, many of us thought that allowing Unicode characters in the URI causes too much troubles like administrator
phisihing through look-alike characters. So, for the authority section at least, I would opt to ASCII strings but that is just a practice.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Spec-wise, only the provision that OpenID Connect has on Unicode is this:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<h3 style="margin-left:48.0pt"><span lang="EN-US" style="font-size:11.0pt;font-family:"Helvetica",sans-serif;color:#333333">14. String Operations<o:p></o:p></span></h3>
<p style="mso-margin-top-alt:5.0pt;margin-right:24.0pt;margin-bottom:5.0pt;margin-left:24.0pt;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">Processing some OpenID Connect messages requires comparing values in the messages to known values. For example, the Claim Names returned by the UserInfo Endpoint might
be compared to specific Claim Names such as </span><tt><span lang="EN-US" style="font-size:10.0pt;font-family:"Courier New";color:#003366">sub</span></tt><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">. Comparing Unicode
strings, however, has significant security implications.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:5.0pt;margin-right:24.0pt;margin-bottom:5.0pt;margin-left:24.0pt;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">Therefore, comparisons between JSON strings and other Unicode strings MUST be performed as specified below:<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-right:24.0pt;mso-margin-bottom-alt:auto;margin-left:60.0pt;text-indent:-18.0pt;mso-list:l1 level1 lfo1">
<![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">Remove any JSON applied escaping to produce an array of Unicode code points.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-right:24.0pt;mso-margin-bottom-alt:auto;margin-left:60.0pt;text-indent:-18.0pt;mso-list:l1 level1 lfo1">
<![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">Unicode Normalization <a href="http://openid.net/specs/openid-connect-core-1_0.html#USA15"><b><span style="color:#663333">[USA15]</span></b></a> MUST
NOT be applied at any point to either the JSON string or to the string it is to be compared against.<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-right:24.0pt;mso-margin-bottom-alt:auto;margin-left:60.0pt;text-indent:-18.0pt;mso-list:l1 level1 lfo1">
<![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black"><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">Comparisons between the two strings MUST be performed as a Unicode code point to code point equality comparison.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:5.0pt;margin-right:24.0pt;margin-bottom:5.0pt;margin-left:24.0pt;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;text-align:start;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span lang="EN-US" style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:black">In several places, this specification uses space delimited lists of strings. In all such cases, a single ASCII space character (0x20) MUST be used as the delimiter.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Unfortunately, it does not say anything about the encoding of the document, but per the RFC7159, the JSON document not confined within a closed environment,
MUST be represented in UTF-8. (Note: it was not until December 2017! We need to update the reference in the Discovery spec.) <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">On the other hand, RFC3986 states:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black">The reg-name syntax allows percent-encoded octets in order to<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> represent non-ASCII registered names in a uniform way that is<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> independent of the underlying name resolution technology. Non-ASCII<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> characters must first be encoded according to UTF-8 [<a href="https://tools.ietf.org/html/rfc3986#ref-STD63" title=""UTF-8, a transformation format of ISO 10646"">STD63</a>], and then<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> each octet of the corresponding UTF-8 sequence must be percent-<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> encoded to be represented as URI characters. URI producing<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> applications must not use percent-encoding in host unless it is used<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> to represent a UTF-8 character sequence. When a non-ASCII registered<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> name represents an internationalized domain name intended for<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> resolution via the DNS, the name must be transformed to the IDNA<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> encoding [<a href="https://tools.ietf.org/html/rfc3490" title=""Internationalizing Domain Names in Applications (IDNA)"">RFC3490</a>] prior to name lookup. URI producers should<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> provide these registered names in the IDNA encoding, rather than a<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> percent-encoding, if they wish to maximize interoperability with<o:p></o:p></span></pre>
<pre><span lang="EN-US" style="font-size:10.0pt;color:black"> legacy URI resolvers.<o:p></o:p></span></pre>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">This makes it clear that URL can actually contain UTF-8 encoded characters.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">So,
</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#1F497D"><a href="https://müsik.example.com/">https://m<span style="background:white">üsik.example.com/</span></a></span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white">
is a valid URL. The requirement is that the user-agent must transform the hostname to punnycode before submitting to the name resolver.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white">So the RFC 3986 compliant client must be able to cope with UTF-8 URI as long as the encoding is clear from the underlying context.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white">My personal conclusion is then:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222;background:white"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;mso-para-margin-left:0gd;text-indent:-18.0pt;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"><span style="mso-list:Ignore">1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Since discovery document is UTF-8, it should use UTF-8 encoded authority section.
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;mso-para-margin-left:0gd;text-indent:-18.0pt;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"><span style="mso-list:Ignore">2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Since JWT header and body is JSON, it MUST be UTF-8.
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:18.0pt;mso-para-margin-left:0gd;text-indent:-18.0pt;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#222222"><span style="mso-list:Ignore">3)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">The client library SHOULD transform the UTF-8 authority section to punnycode before submitting to the DNS resolver. A client MUST make sure
that the library that it is using does so unless it is using a IDN enabled modern DNS resolver.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Punnycoded string is extremely user-unfriendly for Asian and other characters. I would advocate for using UTF-8 in the JSON document and tell the client
developer of the 3) above if they get an error with it, but YMMV. <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Best,
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D">Nat<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Openid-specs-ab [mailto:openid-specs-ab-bounces@lists.openid.net]
<b>On Behalf Of </b>Brock Allen via Openid-specs-ab<br>
<b>Sent:</b> Monday, April 02, 2018 9:57 AM<br>
<b>To:</b> Mike via Openid-specs-ab <openid-specs-ab@lists.openid.net><br>
<b>Subject:</b> [Openid-specs-ab] unicode host names, issuer, and URLs in the discovery document<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div id="__MailbirdStyleContent">
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black">A question came up recently in our implementation of IdentityServer around unicode host names and punycode encoding of those host names. I looked thru
the discovery spec and couldn't parse it well enough to know the answer to my question, so I thought I'd ask here.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black">Should the issuer in the discovery document be punycode for host names with unicode characters? The issuer is a URI but, AFAICT, the URI spec says that
encoding is context-dependent. So in URLs unicode host names need to be punycode, but in a JSON document (either in discovery or a JWT) they don't seem like they need to be.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black">Should the URLs in the document document (e.g. authorize and token endpoints) be punycode for host names with unicode characters? From what I've seen client/RP
libraries don't do well with non-punycode URLs from discovery (meaning they don't encode them before trying to use them). But often pen-testers dislike the URLs not matching the original authority URL. Maybe this last point is pedantic.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black">It'd be best if there were simply a directive in the spec that simply tells me which way to do it, but in the absence of that, any insight would be appreciated. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black">Thanks.<o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black">-Brock<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Lucida Console";color:black"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>