Feedback-ID: i0fe9450f:Fastmail
Date: Fri, 24 Apr 2026 13:20:50 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: ansh01072001@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19457: RE:  pgp_sym_encrypt silently accepts non-FIPS
 ciphers (bf, cast5, 3des) when OpenSSL is in FIPS mod
Message-ID: <aervokmPnxlO6Oqs@paquier.xyz>
References: <19457-4bab15c17aea36c7@postgresql.org>
 <3A2299BC-1684-4CEB-BD65-1DEBFB446F24@yesql.se>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="LztXASfV9s8m5Jxe"
Content-Disposition: inline
In-Reply-To: <3A2299BC-1684-4CEB-BD65-1DEBFB446F24@yesql.se>
Archived-At: <https://www.postgresql.org/message-id/aervokmPnxlO6Oqs%40paquier.xyz>
Precedence: bulk


--LztXASfV9s8m5Jxe
Content-Type: multipart/mixed; boundary="0jWNZP/XTmDxxgPf"
Content-Disposition: inline


--0jWNZP/XTmDxxgPf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Apr 21, 2026 at 04:04:40PM +0200, Daniel Gustafsson wrote:
> Not just FIPS, it should check CheckBuiltinCryptoMode() to be consistent with
> the other builtin checks.

I am interesting in getting that fixed for the next point release, so
I have given it a try, finishing with the attached.  This would cause
pgp_sym_encrypt() and pgp_sym_decrypt() to complain when the builtin
mode is disabled, making things more consistent with the surroundings.

I agree that this could break environments where builtin_crypto is
off, as the functions would now be blocked, but I am not sure that
this is worth worrying about as builtin_crypto=on is the default.

Daniel, what do you think?
--
Michael

--0jWNZP/XTmDxxgPf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment;
	filename=0001-pgcrypto-Respect-builtin_crypto_enabled-for-PGP-ciph.patch
Content-Transfer-Encoding: quoted-printable

=46rom f336e4e09f3d8dda9dd55b855f3eb2cd0913436a Mon Sep 17 00:00:00 2001
=46rom: Michael Paquier <michael@paquier.xyz>
Date: Fri, 24 Apr 2026 13:12:06 +0900
Subject: [PATCH] pgcrypto: Respect builtin_crypto_enabled for PGP ciphers

pgp_sym_encrypt() and pgp_pub_encrypt() silently accepted
non-FIPS-approved cipher algorithms even if OpenSSL was in FIPS mode and
pgcrypto.builtin_crypto_enabled was set to its 'fips' mode.  This causes
pgcrypto to be non-compliant.

A new flag is added to the information list of ciphers, upon which a
filtering is done should FIPS be enabled, depending on the builtin
crypto mode.

Reported-by: Shishir Sharma <ansh01072001@gmail.com>
Suggested-by: Daniel Gustafsson <daniel@yesql.se>
Discussion: https://postgr.es/m/19457-4bab15c17aea36c7@postgresql.org
Backpatch-through: 18
---
 doc/src/sgml/pgcrypto.sgml                    |  9 +-
 contrib/pgcrypto/Makefile                     |  2 +-
 contrib/pgcrypto/expected/pgp-fips-cipher.out | 77 +++++++++++++++
 .../pgcrypto/expected/pgp-fips-cipher_1.out   | 95 +++++++++++++++++++
 contrib/pgcrypto/meson.build                  |  3 +-
 contrib/pgcrypto/pgp.c                        | 32 +++++--
 contrib/pgcrypto/sql/pgp-fips-cipher.sql      | 46 +++++++++
 7 files changed, 250 insertions(+), 14 deletions(-)
 create mode 100644 contrib/pgcrypto/expected/pgp-fips-cipher.out
 create mode 100644 contrib/pgcrypto/expected/pgp-fips-cipher_1.out
 create mode 100644 contrib/pgcrypto/sql/pgp-fips-cipher.sql

diff --git a/doc/src/sgml/pgcrypto.sgml b/doc/src/sgml/pgcrypto.sgml
index 6fc2069ad3ec..96b043097eaa 100644
--- a/doc/src/sgml/pgcrypto.sgml
+++ b/doc/src/sgml/pgcrypto.sgml
@@ -1236,12 +1236,17 @@ fips_mode() returns boolean
     <listitem>
      <para>
       <varname>pgcrypto.builtin_crypto_enabled</varname> determines if the
-      built in crypto functions <function>gen_salt()</function>, and
-      <function>crypt()</function> are available for use. Setting this to
+      built in crypto functions <function>gen_salt()</function>,
+      <function>crypt()</function>, <function>pgp_sym_encrypt()</function>
+      and <function>pgp_pub_encrypt()</function> are available for use.
+      Setting this to
       <literal>off</literal> disables these functions. <literal>on</litera=
l>
       (the default) enables these functions to work normally.
       <literal>fips</literal> disables these functions if
       <productname>OpenSSL</productname> is detected to operate in FIPS mo=
de.
+      <function>pgp_sym_encrypt()</function> and
+      <function>pgp_pub_encrypt()</function> are disabled for ciphers that
+      are not FIPS-approved.
      </para>
     </listitem>
    </varlistentry>
diff --git a/contrib/pgcrypto/Makefile b/contrib/pgcrypto/Makefile
index 17d2b0c5ed17..dde8933f706d 100644
--- a/contrib/pgcrypto/Makefile
+++ b/contrib/pgcrypto/Makefile
@@ -45,7 +45,7 @@ REGRESS =3D init md5 sha1 hmac-md5 hmac-sha1 blowfish rij=
ndael \
 	crypt-des crypt-md5 crypt-blowfish crypt-xdes \
 	pgp-armor pgp-decrypt pgp-encrypt pgp-encrypt-md5 $(CF_PGP_TESTS) \
 	pgp-pubkey-decrypt pgp-pubkey-encrypt pgp-pubkey-session \
-	pgp-info crypt-shacrypt
+	pgp-info crypt-shacrypt pgp-fips-cipher
=20
 ifdef USE_PGXS
 PG_CONFIG =3D pg_config
diff --git a/contrib/pgcrypto/expected/pgp-fips-cipher.out b/contrib/pgcryp=
to/expected/pgp-fips-cipher.out
new file mode 100644
index 000000000000..eed6db0a6490
--- /dev/null
+++ b/contrib/pgcrypto/expected/pgp-fips-cipher.out
@@ -0,0 +1,77 @@
+--
+-- PGP FIPS cipher restrictions
+--
+-- crypto functions disabled.  All PGP encryption are blocked.
+SET pgcrypto.builtin_crypto_enabled =3D off;
+SELECT pgp_sym_encrypt('data', 'key');
+ERROR:  use of built-in crypto functions is disabled
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Daes256');
+ERROR:  use of built-in crypto functions is disabled
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dbf');
+ERROR:  use of built-in crypto functions is disabled
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3D3des');
+ERROR:  use of built-in crypto functions is disabled
+RESET pgcrypto.builtin_crypto_enabled;
+-- crypto functions enabled.  All work.
+SET pgcrypto.builtin_crypto_enabled =3D on;
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s128'),
+	'key', 'expect-cipher-algo=3Daes128');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s192'),
+	'key', 'expect-cipher-algo=3Daes192');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s256'),
+	'key', 'expect-cipher-algo=3Daes256');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dbf=
'),
+	'key', 'expect-cipher-algo=3Dbf');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3D3d=
es'),
+	'key', 'expect-cipher-algo=3D3des');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dca=
st5'),
+	'key', 'expect-cipher-algo=3Dcast5');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+RESET pgcrypto.builtin_crypto_enabled;
+-- crypto functions with FIPS mode.
+SELECT fips_mode() AS is_fips \gset
+\if :is_fips
+SET pgcrypto.builtin_crypto_enabled =3D fips;
+-- non-AES ciphers must error
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dbf');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3D3des');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dcast5');
+-- AES ciphers work
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s128'),
+	'key', 'expect-cipher-algo=3Daes128');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s256'),
+	'key', 'expect-cipher-algo=3Daes256');
+-- AES round trip under FIPS
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('FIPS round trip test', 'key',
+	'cipher-algo=3Daes256'), 'key');
+RESET pgcrypto.builtin_crypto_enabled;
+\endif
diff --git a/contrib/pgcrypto/expected/pgp-fips-cipher_1.out b/contrib/pgcr=
ypto/expected/pgp-fips-cipher_1.out
new file mode 100644
index 000000000000..8ba974cb4c7a
--- /dev/null
+++ b/contrib/pgcrypto/expected/pgp-fips-cipher_1.out
@@ -0,0 +1,95 @@
+--
+-- PGP FIPS cipher restrictions
+--
+-- crypto functions disabled.  All PGP encryption are blocked.
+SET pgcrypto.builtin_crypto_enabled =3D off;
+SELECT pgp_sym_encrypt('data', 'key');
+ERROR:  use of built-in crypto functions is disabled
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Daes256');
+ERROR:  use of built-in crypto functions is disabled
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dbf');
+ERROR:  use of built-in crypto functions is disabled
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3D3des');
+ERROR:  use of built-in crypto functions is disabled
+RESET pgcrypto.builtin_crypto_enabled;
+-- crypto functions enabled.  All work.
+SET pgcrypto.builtin_crypto_enabled =3D on;
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s128'),
+	'key', 'expect-cipher-algo=3Daes128');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s192'),
+	'key', 'expect-cipher-algo=3Daes192');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s256'),
+	'key', 'expect-cipher-algo=3Daes256');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dbf=
'),
+	'key', 'expect-cipher-algo=3Dbf');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3D3d=
es'),
+	'key', 'expect-cipher-algo=3D3des');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dca=
st5'),
+	'key', 'expect-cipher-algo=3Dcast5');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+RESET pgcrypto.builtin_crypto_enabled;
+-- crypto functions with FIPS mode.
+SELECT fips_mode() AS is_fips \gset
+\if :is_fips
+SET pgcrypto.builtin_crypto_enabled =3D fips;
+-- non-AES ciphers must error
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dbf');
+ERROR:  cipher bf is not FIPS approved
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3D3des');
+ERROR:  cipher 3des is not FIPS approved
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dcast5');
+ERROR:  cipher cast5 is not FIPS approved
+-- AES ciphers work
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s128'),
+	'key', 'expect-cipher-algo=3Daes128');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s256'),
+	'key', 'expect-cipher-algo=3Daes256');
+ pgp_sym_decrypt=20
+-----------------
+ Secret.
+(1 row)
+
+-- AES round trip under FIPS
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('FIPS round trip test', 'key',
+	'cipher-algo=3Daes256'), 'key');
+   pgp_sym_decrypt   =20
+----------------------
+ FIPS round trip test
+(1 row)
+
+RESET pgcrypto.builtin_crypto_enabled;
+\endif
diff --git a/contrib/pgcrypto/meson.build b/contrib/pgcrypto/meson.build
index 4f255c8cb05d..f922c1fb8bdd 100644
--- a/contrib/pgcrypto/meson.build
+++ b/contrib/pgcrypto/meson.build
@@ -54,7 +54,8 @@ pgcrypto_regress =3D [
   'pgp-pubkey-encrypt',
   'pgp-pubkey-session',
   'pgp-info',
-  'crypt-shacrypt'
+  'crypt-shacrypt',
+  'pgp-fips-cipher',
 ]
=20
 pgcrypto_openssl_sources =3D files(
diff --git a/contrib/pgcrypto/pgp.c b/contrib/pgcrypto/pgp.c
index 8a6a6c2adf1f..2d5375910a9c 100644
--- a/contrib/pgcrypto/pgp.c
+++ b/contrib/pgcrypto/pgp.c
@@ -63,6 +63,7 @@ struct cipher_info
 	const char *int_name;
 	int			key_len;
 	int			block_len;
+	bool		fips_allowed;
 };
=20
 static const struct digest_info digest_list[] =3D {
@@ -77,16 +78,16 @@ static const struct digest_info digest_list[] =3D {
 };
=20
 static const struct cipher_info cipher_list[] =3D {
-	{"3des", PGP_SYM_DES3, "3des-ecb", 192 / 8, 64 / 8},
-	{"cast5", PGP_SYM_CAST5, "cast5-ecb", 128 / 8, 64 / 8},
-	{"bf", PGP_SYM_BLOWFISH, "bf-ecb", 128 / 8, 64 / 8},
-	{"blowfish", PGP_SYM_BLOWFISH, "bf-ecb", 128 / 8, 64 / 8},
-	{"aes", PGP_SYM_AES_128, "aes-ecb", 128 / 8, 128 / 8},
-	{"aes128", PGP_SYM_AES_128, "aes-ecb", 128 / 8, 128 / 8},
-	{"aes192", PGP_SYM_AES_192, "aes-ecb", 192 / 8, 128 / 8},
-	{"aes256", PGP_SYM_AES_256, "aes-ecb", 256 / 8, 128 / 8},
-	{"twofish", PGP_SYM_TWOFISH, "twofish-ecb", 256 / 8, 128 / 8},
-	{NULL, 0, NULL}
+	{"3des", PGP_SYM_DES3, "3des-ecb", 192 / 8, 64 / 8, false},
+	{"cast5", PGP_SYM_CAST5, "cast5-ecb", 128 / 8, 64 / 8, false},
+	{"bf", PGP_SYM_BLOWFISH, "bf-ecb", 128 / 8, 64 / 8, false},
+	{"blowfish", PGP_SYM_BLOWFISH, "bf-ecb", 128 / 8, 64 / 8, false},
+	{"aes", PGP_SYM_AES_128, "aes-ecb", 128 / 8, 128 / 8, true},
+	{"aes128", PGP_SYM_AES_128, "aes-ecb", 128 / 8, 128 / 8, true},
+	{"aes192", PGP_SYM_AES_192, "aes-ecb", 192 / 8, 128 / 8, true},
+	{"aes256", PGP_SYM_AES_256, "aes-ecb", 256 / 8, 128 / 8, true},
+	{"twofish", PGP_SYM_TWOFISH, "twofish-ecb", 256 / 8, 128 / 8, false},
+	{NULL, 0, NULL, 0, 0, false}
 };
=20
 static const struct cipher_info *
@@ -162,6 +163,17 @@ pgp_load_cipher(int code, PX_Cipher **res)
 	if (i =3D=3D NULL)
 		return PXE_PGP_CORRUPT_DATA;
=20
+	CheckBuiltinCryptoMode();
+
+	/*
+	 * In FIPS mode, only allow ciphers that are FIPS approved.
+	 */
+	if (builtin_crypto_enabled =3D=3D BC_FIPS &&
+		CheckFIPSMode() &&
+		!i->fips_allowed)
+		ereport(ERROR,
+				errmsg("cipher %s is not FIPS approved", i->name));
+
 	err =3D px_find_cipher(i->int_name, res);
 	if (err =3D=3D 0)
 		return 0;
diff --git a/contrib/pgcrypto/sql/pgp-fips-cipher.sql b/contrib/pgcrypto/sq=
l/pgp-fips-cipher.sql
new file mode 100644
index 000000000000..cb425a9ccdf9
--- /dev/null
+++ b/contrib/pgcrypto/sql/pgp-fips-cipher.sql
@@ -0,0 +1,46 @@
+--
+-- PGP FIPS cipher restrictions
+--
+
+-- crypto functions disabled.  All PGP encryption are blocked.
+SET pgcrypto.builtin_crypto_enabled =3D off;
+SELECT pgp_sym_encrypt('data', 'key');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Daes256');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dbf');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3D3des');
+RESET pgcrypto.builtin_crypto_enabled;
+
+-- crypto functions enabled.  All work.
+SET pgcrypto.builtin_crypto_enabled =3D on;
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s128'),
+	'key', 'expect-cipher-algo=3Daes128');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s192'),
+	'key', 'expect-cipher-algo=3Daes192');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s256'),
+	'key', 'expect-cipher-algo=3Daes256');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dbf=
'),
+	'key', 'expect-cipher-algo=3Dbf');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3D3d=
es'),
+	'key', 'expect-cipher-algo=3D3des');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dca=
st5'),
+	'key', 'expect-cipher-algo=3Dcast5');
+RESET pgcrypto.builtin_crypto_enabled;
+
+-- crypto functions with FIPS mode.
+SELECT fips_mode() AS is_fips \gset
+\if :is_fips
+SET pgcrypto.builtin_crypto_enabled =3D fips;
+-- non-AES ciphers must error
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dbf');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3D3des');
+SELECT pgp_sym_encrypt('data', 'key', 'cipher-algo=3Dcast5');
+-- AES ciphers work
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s128'),
+	'key', 'expect-cipher-algo=3Daes128');
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('Secret.', 'key', 'cipher-algo=3Dae=
s256'),
+	'key', 'expect-cipher-algo=3Daes256');
+-- AES round trip under FIPS
+SELECT pgp_sym_decrypt(pgp_sym_encrypt('FIPS round trip test', 'key',
+	'cipher-algo=3Daes256'), 'key');
+RESET pgcrypto.builtin_crypto_enabled;
+\endif
--=20
2.53.0


--0jWNZP/XTmDxxgPf--

--LztXASfV9s8m5Jxe
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmnq76IACgkQnvQgOdby
QH1w1BAAmjDUQZ4djZuIupv5uPqq6Qd4GADXRDTlYRkZjyBMiRnnKFgu0b/2Hwyx
aZCh95GH95iJkK9rZ4kdvkAmSLtAqJfGlpR2zhk9H0VXib/KyB1GbOHptMiT6ZtZ
hgOAq3PJj9bWEoDpkzYcOga6m9gP6Zs7ZjGUASvpqC3nDJSTeU1ULVnxm9Ykj7WJ
Is8gAZn7YjjVMFosMZvA+mucmf0ZZdpKbBR1WyToEcf87sLoR4Y/5oRKFIrE/vkN
GAbvmcy+kblVPcw/3XUAJ90kHx8WV11547txOWgVy3yFLxtCYktxSYbir+bytWdS
rThlf9eGjNVzFShOplXA/jA4VRFFrruF71Nmeag+bt4wUf4ML+oPsHf1Df8rLwic
nejTVR9zfnsvdoxW9m6vo2lmEiZmxdu6CFFbNESDbKTDmpOsv1AUrIRW1UaV1QaO
tLwFJNmKub6z/2r4OhFOmbihuBd3kaJDdX1guyDwMkgNd0mAGrKlHNOu2om5L40s
DKPS7UCA7axdyMnTglhlLsT1kAY1PiBdDdT0y1kTvzNCBoloHm4kqR0B+yJpUzhN
onym+6ZuHtQIwudGJRJcAenOLznjTVFas/CEa5Pbh+c7dfJ977am1oE/XNAvEssQ
j7UX8K4IThSD5Nhkdqolf6Jj555y0I90PAN1MrfYs6XDK6hILIQ=
=tKWk
-----END PGP SIGNATURE-----

--LztXASfV9s8m5Jxe--