HDTenEightyP/NetNews huggingface dataset:
From: sommerfeld@apollo.hp.com (Bill Sommerfeld)
Subject: Re: Scalability issues with Kerberos
Date: Thu, 21 Jan 1993 23:40:08 GMT
Organization: Hewlett Packard

In article <9301211836.AA14955@shadow.secure.bellcore.com> lunt@CTT.BELLCORE.COM (Steve Lunt) writes:

   Database dumps and loads (via krb_util, which is used by kprop) are
   slow when the database is that big (apparently order n log n).  But
   ticket requests (kinit) and database updates (kadmin and kpasswd) are
   still very fast (apparently order log n).  Also, the ndbm files get
   really big (I think I tested it on a Sun with 10,000 principals, and
   the file was 5 meg in size), if this is a problem on your system.

Note that this is purely a function of the KDC implementation, and
fixing this requires no changes to clients, servers, or the main run
time library.

If you've got a better, more scaleable database (or even a better dbm
implementation -- that's all that kerberos needs), you can drop it in
place on the KDC and use it instead.

If you've got a better replication system, you can drop it in place on
your KDC and use it instead, and won't have to change the clients.

I'm aware of Kerberos v4 implementations that have used at least three
different databases underlying the MIT KDC implementation.

	ingres	(the old university ingres.  this was too slow and
		 flushed in favor of dbm).
	dbm	(both "dbm classic" and ndbm).
	Apollo registry (this was an internal project which
		was never released -- however it "evolved" into the
			DCE kerberos v5 support).

The database module is eminently replaceable.

In addition, Transarc's AFS3 includes has a v4-kerberos system (albeit
with a serious flaw: they use a completely incompatible string-to-key
algorithm) built over their "ubik" replication technology.

				- Bill

Newsgroups: comp.protocols.kerberos
From: ndp@unislc.uucp (Ned Plasson)
Subject: Intel SVR4 Kerberos V4 port location?
X-Newsreader: TIN [version 1.1 PL6]
Organization: Unisys Corporation SLC
Date: Thu, 21 Jan 1993 17:41:37 GMT

I am trying to locate the Kerberos V4 Intel SVR4 port mentioned in the
kerberos FAQ dated 11/4/92 in the kerberos port matrix under section 2.7.

I have looked on the athena-dist.mit.edu server as implied in the faq.
I have found a kerberos V4 source tree however, the osconf.h header
file has no mention of svr4, SVR4, Intel, or i386?

Any ideas?

Ned
ndp@unislc.slc.unisys.com
-- 

Ned D. Plasson					Phone: +1 801-594-3936
Unisys UNIX Systems				Fax  : +1 801-594-6708
Distributed Systems Management			ndp@unislc.slc.unisys.com
Newsgroups: comp.protocols.kerberos
From: warlord@ATHENA.MIT.EDU (Derek Atkins)
Subject: Re: What's the use of .klogin ?? (Conclusion)
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 28 Jan 1993 16:35:05 GMT

Uhh, I'm sorry to say, but you are still a little confused about
inter-realm authentication.  Here is how it works:

You have two realms, Realm1 and Realm2.  You then create a shared key...
	In Realm1: krbtgt.Realm2@Realm1
	In Realm2: krbtgt.Realm1@Realm2

Both of these should have the *SAME* password.

Now, you have two hosts, one in each realm, host1 and host2.  You create
a key for each host *only* in the realm of the host:
	In Realm1: rcmd.host1@Realm1
	In Realm2: rcmd.host2@Realm2

>    3) to connect:
>
>        - go to host1
>        - run kinit (local realm)
>        - run rlogin host2 -k realm_of_host1 and there you are logged in to
>          host2 using your local authentication.

The kinit part is fine.  However, to rlogin, you just need to make sure
that Realm2 is in krb.conf and host2 resolves to Realm2 in krb.realms.
Now, all you need to do is:
	rlogin host2

When you do this, you can then klist, and it should give you something
that looks like:

Ticket file:    /tmp/tkt_foo
Principal:      foo@Realm1

  Issued           Expires          Principal
Jan 28 10:14:01  Jan 28 20:14:01  krbtgt.Realm1@Realm1
Jan 28 10:17:39  Jan 28 18:17:39  krbtgt.Realm2@Realm1
Jan 28 10:17:41  Jan 28 18:17:41  rcmd.host2@Realm2

I hope this clears things up a little...

Inter-realm authentication works fine.  I use it all the time!

-derek

PGP 2 key available upon request, or via AFS:
	/afs/athena.mit.edu/user/w/a/warlord/pgp-pubkey.asc
Newsgroups: comp.protocols.kerberos
From: DEEngert@anl.gov ("Doug Engert")
Subject: Kerberos V4 Patch level 10 and Rlogin
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 28 Jan 1993 21:50:22 GMT

I am running Kerberos V4 at patch level 10 on SunOS 4.1.2. When I
run rlogin with the -x option to get encrypted transmissions, and I
change the size of a window, rlogin uses sendwindow() to send the
window size information "via the magic escape",
0377,0377,s,s,..... this appears on my screen as ^?^?ss..... and
it goes in as standard input.

If I use rlogin at patch level 9 with the rlogind at patch level
10, window size events work correctly.

It appears that some one (kstream-des.c?) has converter the 0377
to 0177 or has divided up the message so the control() routine in
rlogind does not see the full message in a buffer.

Any ideas?

           Douglas E. Engert
           Systems Programming
           Argonne National Laboratory
           9700 South Cass Avenue
           Argonne, Illinois  60439
           (708) 252-5444

           Internet: DEEngert@anl.gov
Newsgroups: comp.protocols.kerberos
From: john@iastate.edu (John Hascall)
Subject: Re: Scalability issues with Kerberos
Organization: Iowa State University, Ames, IA
Date: Sat, 23 Jan 1993 16:14:43 GMT

lunt@CTT.BELLCORE.COM (Steve Lunt) writes:
}Database dumps and loads (via krb_util, which is used by kprop) are
}slow when the database is that big (apparently order n log n).  But
}ticket requests (kinit) and database updates (kadmin and kpasswd) are
}still very fast (apparently order log n).  Also, the ndbm files get
}really big (I think I tested it on a Sun with 10,000 principals, and
}the file was 5 meg in size), if this is a problem on your system.

Our kerberosDB has 12580 principals and is just under 13MB in size
(although ls -l would have you think it was 160MB).  We have close to
900 client machines and our load in 24hrs (Thursday 4am - Friday 4am)
was:
       Initial Requests:  21901   avg of 0.25 /sec
       APPL Requests:     57532   avg of 0.67 /sec
       New Principals:      169
       Password Changes:     60

Although the load isn't constant over 24 hours, it doesn't vary as much
as you might think:

                         (Total Requests per Hour)
    7000+           * *
        |           * *       *
    6000+           * *       * *
        |           * * *   * * *
    5000+         * * * * * * * *
        |         * * * * * * * * *
    4000+         * * * * * * * * *
        |---------*-*-*-*-*-*-*-*-*----------------------- average
    3000+       * * * * * * * * * * *
        |       * * * * * * * * * * * *           *
    2000+       * * * * * * * * * * * * * * * *   *
        |     * * * * * * * * * * * * * * * * * * * * * *
    1000+ * * * * * * * * * * * * * * * * * * * * * * * *
        | * * * * * * * * * * * * * * * * * * * * * * * *
       0+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
          4 5 6 7 8 9 1 1 N 1 2 3 4 5 6 7 8 9 1 1 M 1 2 3
                      0 1                     0 1

}A kprop/kpropd that sends only updates is critical for realms that
}have # of principals in the tens of K.  In this case, kdb_util should
}only be used in emergencies.

While we also would like to see a more `fully distributed' KDB (for load
sharing, fault tolerance, etc.), it appears not to be critical at our size
-- our little DS2100 keeps up with no problem.

One thing we didn't really understand when we brought in Kerberos was that
your slave-kerberos server(s) will basically do nothing almost all of the
time.  As an experiment we tried having some machines use the slave as their
primary server, but it was just too confusing for people who had recently
changed their password (we only kprop every 12hrs).  With a more-or-less
instantaneous master-to-slave propagation scheme you could load balance
between multiple kerberii.

John
-- 
John Hascall                   ``An ill-chosen word is the fool's messenger.''
Systems Software Engineer
Project Vincent
Iowa State University Computation Center  +  Ames, IA  50011  +  515/294-9551
Newsgroups: comp.protocols.kerberos
From: katz@tss.com (Greg Katz)
Subject: How to get Kerberos.
Reply-To: katz@tss.COM
Organization: Teknekron Software Systems, Inc.
Date: Fri, 22 Jan 1993 00:58:55 GMT

I joined the group, hence the question.
How to get Kerberos software?



-- 
Gregory Katz
Teknekron Software Systems, Inc
530 Lytton Ave, ste 301 
Palo Alto, Ca 
tel 415-6172423 
Newsgroups: comp.protocols.kerberos
From: marc@ATHENA.MIT.EDU (Marc Horowitz)
Subject: Re: Scalability issues with Kerberos
Reply-To: Marc Horowitz <marc@MIT.EDU>
Organization: Internet-USENET Gateway at Stanford University
Date: Sat, 23 Jan 1993 22:42:38 GMT

>> Although the load isn't constant over 24 hours, it doesn't vary as much
>> as you might think:

I see a peak when 9-5'ers get in in the morning, and another peak when
students get out of class.  And the fact that students have no
discernible daily cycle accounts of the 1000+ requests at every hour
of the day.  I doubt intel would have such a distribution.  Most
people would kinit once when they got there and get most of the keys
they need first thing in the morning, leading to a large spike at the
time work starts, and not much elsewhere (except engineers, who also
don't have any discernible daily cycle :-).

		Marc
From: dmills@accvio.intel.com (Dave Mills)
Newsgroups: comp.protocols.kerberos
Subject: Scalability issues with Kerberos
Date: 21 Jan 93 16:40:00 GMT
Organization: Intel Corporation
News-Software: VAX/VMS VNEWS 1.41

Hi,

In pushing for Kerberos within my organization, I've received some vague
negative comments regarding the scalability of Kerberos to a large (~20K node)
network.  Can anyone address the issue more clearly, or provide input on
whether this is, in fact, a real issue?  I assume other large organizations
(MIT...) must handle this, if it is a problem. 

Any feedback would be helpful.

Thanks,
Dave
-----------------
David Mills
Intel Corporation
dmills@intel.com 
Newsgroups: comp.protocols.kerberos
From: lunt@CTT.BELLCORE.COM (Steve Lunt)
Subject: Re: Scalability issues with Kerberos
Organization: Internet-USENET Gateway at Stanford University
Date: Thu, 21 Jan 1993 18:36:58 GMT

Database dumps and loads (via krb_util, which is used by kprop) are
slow when the database is that big (apparently order n log n).  But
ticket requests (kinit) and database updates (kadmin and kpasswd) are
still very fast (apparently order log n).  Also, the ndbm files get
really big (I think I tested it on a Sun with 10,000 principals, and
the file was 5 meg in size), if this is a problem on your system.

A kprop/kpropd that sends only updates is critical for realms that
have # of principals in the tens of K.  In this case, kdb_util should
only be used in emergencies.

-- Steve

Newsgroups: comp.protocols.kerberos
From: john@iastate.edu (John Hascall)
Subject: Re: Scalability issues with Kerberos
Organization: Iowa State University, Ames, IA
Date: Sat, 23 Jan 1993 21:41:54 GMT

sommerfeld@apollo.hp.com (Bill Sommerfeld) writes:

}In addition, Transarc's AFS3 includes has a v4-kerberos system (albeit
}with a serious flaw: they use a completely incompatible string-to-key
}algorithm)

There is a rather simple work-around which allows you to make
AFSkerberos & MITkerberos play nice together...

John
-- 
John Hascall                   ``An ill-chosen word is the fool's messenger.''
Systems Software Engineer
Project Vincent
Iowa State University Computation Center  +  Ames, IA  50011  +  515/294-9551
From: charles@OIT.PeachNet.EDU (Charles D. Menser)
Newsgroups: comp.protocols.kerberos
Subject: Help wanted: Kerberos' entries in config files
Date: 28 Jan 1993 15:54:07 -0500
Organization: PeachNet
Distribution: world
NNTP-Posting-Host: oit.peachnet.edu

Our organization needs to run a Kerberos key server to service some of
our remote (net) access equipment's authentication system.

I am attempting to build and install kerberos (921209), on a Sun running
SunOS 4.1.3. I have followed the Operation Notes (Draft), and I am stalled
trying to run the admin server. When I run the server, I see:

---- cut here ----
KADM Server KADM0.0A initializing
Please do not use 'kill -9' to kill this job, use a
regular kill instead
 
KADM Server starting in fascist mode for the purposes for password changing
 
error:  Could not find service name in services database
Admin Server (kadm server) has completed operation.
---- and here ----

I have RTFM, and I can find no mention of a /etc/services entry needed for
the admin server. BTW, does the choice of UDP port effect kerberos? Is
there a standard port?

TFM has some sample inetd.conf entries for a sample server, are these needed
for a key server?


Regards,
Charles
-- 
Charles Menser			charles@peachnet.edu
News Administrator		"Why did you pour ink on my head?"
PeachNet				-Yosemite Sam
Newsgroups: comp.protocols.kerberos
From: hilary@SNLL-ARPAGW.LLNL.GOV (Hilary Jones)
Subject: Re:  KryptoKnight Network Security Service -- reports available by FTP
Organization: Internet-USENET Gateway at Stanford University
Date: Fri, 22 Jan 1993 00:02:36 GMT

Gene,

I saw your mail announcing the availability of some papers on
KryptoKnight.  I read the papers and think the protocol might be
perfect for a project I have in mind.  Is KryptoKnight in the public
domain?  Who would I contact to get a copy of the source code?  How
much effort would be involved to convert KryptoKnight to run on a
different platform -- say, compared to converting Kerberos?

By the way, I had a problem printing your papers.  Our DEC LPS20 and
LPS40 printers don't have the ISILGothic font.  That would be okay, but
the printers refuse to substitute fonts.  I thought you might want to 
know that.

Hilary

Newsgroups: comp.protocols.iso
From: danielh@hpber199.swiss.hp.com (Daniel Huber)
Subject: Re: What is Q3?
Date: Wed, 27 Jan 1993 09:24:24 GMT
Organization: Swiss Response Center
X-Newsreader: TIN [version 1.1 PL8.1]


Thanks a lot to all who responded to my question in this thread.
Also thanks a lot to all who sent me email directly.

I think I now know what Q3 is!

Daniel

--
Daniel Huber, RCO, HP Niederwangen (8700), Switzerland
SMTP: danielh@hpber199.swiss.hp.com (or Daniel_Huber@hp8700.desk.hp.com)
X.400: /G=Daniel/S=Huber/OU=HP8700/O=HP/P=HP/A=ArCom/C=CH/
UNIX is the answer. What was the question?
From: S.Kille@isode.com (Steve Hardcastle-Kille)
Subject: Re: Seeking info on ISODE Message switch
In-reply-to: Your message of 21 Jan 1993 20:24:52 +0000. <9301211224.aa03105@q2.ics.uci.edu>
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Newsgroups: comp.protocols.iso.x400
Date: 26 Jan 93 19:09:58 GMT
Phone: +44-71-223-4062

Information on the ISODE Consortium may be obtained by email from
<ic-info@isode.com>.   I'll send you some information privately.


Steve
From: MTCMTKH%OAB.mmdsh@ibmh1.orl.mmc.com
Subject: Differences bewtween a msg switch and gateway
Newsgroups: comp.protocols.iso.x400
Date: 25 Jan 93 15:23:03 GMT

From: Tom Hinders
Subject: Differences bewtween a msg switch and gateway

What is the difference between a message switch and a message gateway.

Who offers which?

Thanks in advance........

Please reply directly to:

Internet: MTCMTKH@IBMH1.ORL.MMC.COM
X.400:    C=US,A=TELEMAIL,P=MMC,O=OVVM,S=HINDERS,G=TOM
From: eskovgaa@cue.bc.ca (Erik Skovgaard)
Subject: Re: Differences bewtween a msg switch and gateway
Newsgroups: comp.protocols.iso.x400
Date: 27 Jan 93 15:52:49 GMT

I think the differences are much more distinct.

A message switch will not translate the message or address.  It will merely
pass it on as fast as possible.  Commercial message switches are able to
handle incredible throughputs and are typically based on proprietary
message formats.

A gateway will typically translate:

    1. the message encoding
    2. the address(es) of recipients(s) and originator
    3. facilities and specific features

In addition, a gateway has to "talk" both communications protocols used
on the two sides of the gateway.

A gateway is very complex (it has to know both message formats intimately)
whereas a message switch can be quite simple and typically only would
have to know about one message format.

An X.400 MTA is a message switch - except it can also add value in some
cases.

Gateways are the scourge of the industry, but they also allow implementations
based on proprietary and de facto standards to exchange messages with other
systems.  In the ideal world every implementation would be able to speak
a common protocol which would eliminate gateways.  Alas, the world is not
ideal and users will have to spend a lot of time managing gateways for many
years in the future.

Cheers,                             ....Erik.
From: stari@romeppc.VNET.IBM.COM (Mauro Starinieri)
Date: Thu, 28 Jan 93 09:55:01 CET
Newsgroups: comp.protocols.iso.x400
Subject: Electronic copy of ASN.1 definition of '88 P22 protocol
Organization: IBM Semea - RNSL
Disclaimer: This posting represents the poster's views, not those of IBM
News-Software: Usenet 3.0

Can anyone tell me where I can find an electronic copy of the ASN.1
definition of the 1988 X.400 P22 protocol?
Any information will be useful for me.

Regards,
   Mauro Starinieri
   Rome Networking Systems Laboratory
   via Paolo di Dono, 44 - 00143 Rome (Italy)
   Tel: +39-6-5187.2331
   FAX: +39-6-5187.2596
   E-MAIL: IBMMAIL(ITIBMP4L)
   X.400: c=IT/a=IBMX400/p=IBMMAIL/s=Starinieri/g=Mauro
From: ablum@world.std.com (Adam S Blum)
Newsgroups: comp.protocols.iso.x400
Subject: XAPIA specs (88) in Electronic Form
Date: 21 Jan 93 16:08:59 GMT
Organization: The World Public Access UNIX, Brookline, MA

Are the 88 XAPIA specs available in electronic form anywhere?
Thanks in advanced for any information.

Adam Blum
From: MTCMTKH%OAB.mmdsh@ibmh1.orl.mmc.com
Subject: Seeking info on ISODE Message switch
Newsgroups: comp.protocols.iso.x400
Date: 21 Jan 93 20:24:52 GMT

From: Tom Hinders
Subject: Seeking info on ISODE Message switch

I am seeking infomation on the topic/product called ISODE Message Switch.


Please reply directly to MTCMTKH@IBMH1.ORL.MMC.COM

Thanks in advance........

Internet: MTCMTKH@IBMH1.ORL.MMC.COM
X.400:    C=US,A=TELEMAIL,P=MMC,O=OVVM,S=HINDERS,G=TOM
From: mws@sitman.ssw.com (Mark Sitler)
Subject: X.400 Implementors Guide
Newsgroups: comp.protocols.iso.x400
Date: 25 Jan 93 20:27:57 GMT


I am trying to get the latest version of the X.400 implementors guide.

The latest version OMNICOM has available is version 5.  OMNICOM claims
they have been trying to get version 8 from the ITU for months and have
been unable to get a copy.  Is there anyone out there with the latest
version, and if so, how did you go about getting it.

Thanks,

Mark Sitler
Soft-Switch Inc.
Newsgroups: comp.protocols.iso.x400
From: hta@boheme.er.sintef.no (Harald Tveit Alvestrand)
Subject: Re: Differences bewtween a msg switch and gateway
Reply-To: harald.alvestrand@delab.sintef.no
Organization: SINTEF DELAB, Norway
Date: Tue, 26 Jan 93 08:35:29 GMT

Those terms are slippery at best..

I REGARD THEM AS MEANING:

- A message switch uses at least 1 mail protocol
- A message gateway uses at least 2 mail protocols

Also, I sometimes see "message switch" used in opposition to 
"end-user mailer", in the meaning that

- A message switch talks to at least 2 other mail systems
- An end-user mailer talks to at least 1 other mail system (probably
  a message switch).

Still confused? You're not alone!

-- 
                   Harald Tveit Alvestrand
Harald.Alvestrand@delab.sintef.no
C=no;PRMD=uninett;O=sintef;OU=delab;S=alvestrand;G=harald
+47 7 59 70 94
Newsgroups: comp.protocols.iso.dev-environ
From: brian@mel.dit.csiro.au (Brian May)
Subject: X/Open API specs (was Re: FTAM API conforms to what industrial standards?
Organization: CSIRO DIT (Melb.)
Date: Mon, 25 Jan 93 23:39:29 GMT


In article <1993Jan21.155247.24031@cenaath.cena.dgac.fr>, melennec@stna.dgac.fr (Ronan Melennec STNA 7C p8240 BD22) writes:
|> Hello,
|> 
|> Are the X/Open OSI API specs available via the net
|> (anonymous ftp or equivalent) ?
|> Or does one necessarily have to buy them, like any ISO standard ?

You have to purchase them from X/Open. Their address is:

X/Open company ltd,
apex plaza,
forbury road,
reading
berkshire RG1 1AX
UK

email XoSpecs@xopen.co.uk

--
You can join the OSI API mailing list by mailing api-request@mel.dit.csiro.au

brian
--
| Brian.May@mel.dit.csiro.au |           Open Systems Program           |
| CSIRO/DIT, 723 Swanston st | TEL +61 3 282 2613 -- FAX +61 3 282 2600 |
|Carlton, VIC 3053, Australia|          Experimental Scientist          |
From: sthomas@mitchell.hac.com (Scott Thomas)
Newsgroups: comp.protocols.iso.dev-environ
Subject: HELP! Problem with dased and/or quipu
Date: 22 Jan 93 21:23:03 GMT
Organization: Hughes Aircraft Company

I'm getting a 'service not found' error when I run my application,
despite the fact that the service is indeed defined in the DIT,
and that iaed and the dish dua see it.  The errors I get are:

TAsynConnRequest: Normal disconnect initiated by session entity [ OSI 
service tsap/#1053 not found]

SAsynConnRequest(pseudo): Transport disconnect [ OSI service tsap/#1053 not 
found (Normal disconnect initiated by session entity at transport)]

ppktlose [Session disconnect]  OSI service tsap/#1053 not found (Normal disconnect initiated by session entity at transport)

PAsynConnRequest(pseudo): Session disconnect [ OSI service tsap/#1053 not 
found (Normal disconnect initiated by session entity at transport)] failed


Since iaed and dua's contact quipu directly, I suspected the ufnrc file,
but that is correct.  I've check the log files, all that dased.log has is:

1/22 15:37:34 dased    00632 (quipu   )  T-CONNECT.INDICATION: <4, ...
1/22 15:37:35 dased    00632 (quipu   )  T-DISCONNECT.INDICATION

and all that quipu.log has is the following repeatedly entered:

 1/22 15:37:35 ros.quip 00627 (quipu   )  Listening on ads:  4.


I'm at my wit's end trying to figure out why the app's do not see the 
service.  Does anyone out there have any suggestions?

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scott Thomas                        ||
Hughes Information Technology Co.   || The corporate principal:
e-mail: sthomas@mitchell.hac.com    ||   Of course there's no reason
 phone: (703) 759-1382              ||   for it, it's just our policy!
   fax: (703) 438-8430              ||
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Newsgroups: comp.protocols.iso.dev-environ
From: melennec@stna.dgac.fr (Ronan Melennec STNA 7C p8240 BD22)
Subject: Re: FTAM API conforms to what industrial standards?
Organization: Service Technique de la Navigation Aerienne, France
Date: Thu, 21 Jan 1993 15:52:47 GMT

Hello,

Are the X/Open OSI API specs available via the net
(anonymous ftp or equivalent) ?
Or does one necessarily have to buy them, like any ISO standard ?

Regards,
-- 
Ronan Melennec        | Service Technique de la Navigation Aerienne
+33 1 60 79 82 40     | Departement 7
melennec@stna.dgac.fr | 95, rue Henri Rochefort, 91025 EVRY CEDEX, FRANCE