From owner-ietf-ediint@mail.imc.org Sat Jun 1 01:34:45 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA12933 for ; Sat, 1 Jun 2002 01:34:45 -0400 (EDT) Received: by above.proper.com (8.11.6/8.11.3) id g515FNi17324 for ietf-ediint-bks; Fri, 31 May 2002 22:15:23 -0700 (PDT) Received: from joy.songbird.com (IDENT:root@songbird.com [208.184.79.7]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g515FMg17320 for ; Fri, 31 May 2002 22:15:22 -0700 (PDT) Received: from BBFUJIP.dcrocker.net (208.184.79.252.songbird.com [208.184.79.252] (may be forged)) by joy.songbird.com (8.9.3/8.9.3) with ESMTP id WAA10284; Fri, 31 May 2002 22:18:13 -0700 Message-Id: <5.1.0.14.2.20020601000750.02be2e50@jay.songbird.com> X-Sender: dhc2@jay.songbird.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Sat, 01 Jun 2002 00:13:20 -0500 To: ned.freed@mrochek.com From: Dave Crocker Subject: Re: How do I send EDI file securely over Internet via FTP or HTTP S? Cc: Carl Hage , ietf-ediint@imc.org In-Reply-To: <01KIDVXOUCDO0001B1@mauve.mrochek.com> References: <"Your message dated Fri, 31 May 2002 15:16:41 -0700" <20020531221645.XSDH13253.rwcrmhc54.attbi.com@sv> <00fd01c20905$81af7000$0b01a8c0@dev1> <20020531221645.XSDH13253.rwcrmhc54.attbi.com@sv> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; format=flowed Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: At 04:54 PM 5/31/2002 -0700, ned.freed@mrochek.com wrote: >General network-wide email facilities need store and forward. But nothing >prevents you from setting up a special SMTP link just for EDI that bypasses >general email facilities. Such a system is only constrained by the >characteristics of single-hop SMTP, not by the characteristics of what's >deployed elsewhere. > >Lots of email software exists that can be configured this way. Ned is making a key point that is frequently missed, when worrying about the performance of a serice. The underlying technology, like the protocol, is of course a major factor, but the way the service provisioned and equally important. The fact that current email service gives a certain range of performance does not prevent configuring a collection of servers for much better performance. It is possible to sub-second delivery times, if configuration, MTA hardware and network packet service permit it. >I've always found the notion of a delivery guarantee somewhat amusing. in the >final analysis nothing can actually make such a guarantee. Hence the term really means that the provider will guarantee to a percentage likelihood that service will match the specified performance. What is significant, to me, is not that they cannot agree to perfection but that whatever they agree to be better than the non-guaranteed average that folks are already experiencing. d/ ---------- Dave Crocker TribalWise, Inc. tel +1.408.246.8253; fax +1.408.850.1850 From owner-ietf-ediint@mail.imc.org Sat Jun 1 14:35:43 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA26192 for ; Sat, 1 Jun 2002 14:35:43 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g51IHEB14619 for ietf-ediint-bks; Sat, 1 Jun 2002 11:17:14 -0700 (PDT) Received: from puma.ent.gartner.com (puma.gartner.com [207.140.148.100]) by above.proper.com (8.11.6/8.11.3) with SMTP id g51IHCg14612 for ; Sat, 1 Jun 2002 11:17:12 -0700 (PDT) content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" X-MimeOLE: Produced By Microsoft Exchange V6.0.5762.3 Subject: RE: How do I send EDI file securely over Internet via FTP or HTTPS? Date: Sat, 1 Jun 2002 14:16:27 -0400 Message-ID: <8647AD35DEC2D411A4DD0002A513481A155EDE0F@mammoth.gartner.com> Thread-Topic: How do I send EDI file securely over Internet via FTP or HTTP S? Thread-Index: AcII8fs1OxL5BXTiEdaJJgBQi7KOfQAoI/Lg From: "Rishel,Wes" To: Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by above.proper.com id g51IHCg14614 Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 8bit A lot of people confuse the theoretical characteristics of SMTP when used entirely in well-configured, well built SMTP servers and the general state of e-mail, with a lot of corporate mail servers coming from products that are not solely SMTP servers and for which administration is a high art sometime practiced in less than perfect human beings. Real e-mail service has occasional failure to delivery, for which a notification is usually, but not always sent back to the sender, occasional duplication, and very inconsistent transit times. There is no guarantee that batches sent in separate e-mails would arrive in order. And very few servers configured to support real e-mail users can swallow a large batch without choking. You could achieve reliable transmission of batches using dedicated, well-built, well-administered SMTP servers, and AS1 but that is beyond the skill and organizational complexities of many users. There are a few vendors that help here, but not enough that you can be assured that a trading partner has a compatible product. Even if you are lucky and have the skills or common products with your trading partner to do AS1, there is still a problem for large batches. In order to transmit an encrypted or compressed batch using real-email you have to expand it to 133% or more of its original size depending on the scheme you use to represent binary data as a stream of printable characters. If you are going to set up a special server, as you must for e-mail, why not set up a special HTTP server instead, and use AS2 or ebXML? Even without AS2 there is certainly a lot of EDI being sent over HTTPS now, using ad hoc specs prepared by channel master trading partners and consortia such as the GISB and AIAG. It seems to take less technical skills to submit batches using HTTPS than using SMTP. -----Original Message----- From: Carl Hage [mailto:carl@chage.com] Sent: Friday, May 31, 2002 3:17 PM To: ietf-ediint@imc.org Subject: Re: How do I send EDI file securely over Internet via FTP or HTTP S? From: "Pae Choi" [RE: SMTP/email] > Of course, that is why it's called "Store-&-Forward" mechanism. > But it does not guarantee "How soon it will get there!" Store-and-Forward comes from the old days when people had dialup modems. The best guarantee is to deliver directly without forwarding. Of course, if you want to send a message but can't reach another server you have a problem-- same as if you used http/ftp I wonder why spammers are the only ones to figure this out. The tragedy is that a good way to get rid of junk mail is to delete mail that doesn't appear to be store-and-forward. > Maybe we need new email service that guarantee the delivery > within a given time, e.g., Fedex or UPS style guarantee delivery. :-) You can use Fedex to send a package to your neighbor, but it's more reliable to walk over and give it to them personally. Same for smtp email. I suppose there could be a business that runs high availabliity, geographically isolated redundant servers that can perform an assured delivery with store and forward if needed, plus archiving. In theory it could be more reliable than your own computer, which could crash and corrupt it's files. But a backup-only service is just as good and maybe better in some ways. ... > > Ever received an email 30 days later than sent? No, but I've received very delayed email, as have friends. At least I've received it! Ever tried accessing a web site and got a connection timed out? The real issue is how do you deal with the situation when a direct delivery can't be made. From owner-ietf-ediint@mail.imc.org Sun Jun 2 19:18:49 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA20226 for ; Sun, 2 Jun 2002 19:18:48 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g52MvAI00625 for ietf-ediint-bks; Sun, 2 Jun 2002 15:57:10 -0700 (PDT) Received: from www.tech-comm.com (ns3.tech-comm.com [209.149.125.161]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g52Mv8g00621 for ; Sun, 2 Jun 2002 15:57:08 -0700 (PDT) Received: from LAW2KN008 ([24.196.13.18]) by www.tech-comm.com (8.11.6/8.11.6) with SMTP id g52NNrE18729; Sun, 2 Jun 2002 18:23:53 -0500 From: "Dick Brooks" To: "Rishel,Wes" , Subject: RE: How do I send EDI file securely over Internet via FTP or HTTPS? Date: Sun, 2 Jun 2002 17:55:21 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Importance: Normal In-Reply-To: <8647AD35DEC2D411A4DD0002A513481A155EDE0F@mammoth.gartner.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 7bit I concur with Wes. Additionally, standard SMTP(RFC821) implementations also lack other key features, such as an access control mechanism. Energy industry organizations I've worked with require access control, authentication, authorization, confidentiality and deterministic, auditable delivery of business transactions. EDIINT AS2 and ebXML's Message Service come closer to meeting all of these requirements than standard SMTP or AS1. Dick Brooks Systrends, Inc 7855 South River Parkway, Suite 111 Tempe, Arizona 85284 Web: www.systrends.com Phone:480.756.6777,Mobile:205-790-1542,eFax:240-352-0714 -----Original Message----- From: owner-ietf-ediint@mail.imc.org [mailto:owner-ietf-ediint@mail.imc.org]On Behalf Of Rishel,Wes Sent: Saturday, June 01, 2002 1:16 PM To: ietf-ediint@imc.org Subject: RE: How do I send EDI file securely over Internet via FTP or HTTPS? A lot of people confuse the theoretical characteristics of SMTP when used entirely in well-configured, well built SMTP servers and the general state of e-mail, with a lot of corporate mail servers coming from products that are not solely SMTP servers and for which administration is a high art sometime practiced in less than perfect human beings. Real e-mail service has occasional failure to delivery, for which a notification is usually, but not always sent back to the sender, occasional duplication, and very inconsistent transit times. There is no guarantee that batches sent in separate e-mails would arrive in order. And very few servers configured to support real e-mail users can swallow a large batch without choking. You could achieve reliable transmission of batches using dedicated, well-built, well-administered SMTP servers, and AS1 but that is beyond the skill and organizational complexities of many users. There are a few vendors that help here, but not enough that you can be assured that a trading partner has a compatible product. Even if you are lucky and have the skills or common products with your trading partner to do AS1, there is still a problem for large batches. In order to transmit an encrypted or compressed batch using real-email you have to expand it to 133% or more of its original size depending on the scheme you use to represent binary data as a stream of printable characters. If you are going to set up a special server, as you must for e-mail, why not set up a special HTTP server instead, and use AS2 or ebXML? Even without AS2 there is certainly a lot of EDI being sent over HTTPS now, using ad hoc specs prepared by channel master trading partners and consortia such as the GISB and AIAG. It seems to take less technical skills to submit batches using HTTPS than using SMTP. -----Original Message----- From: Carl Hage [mailto:carl@chage.com] Sent: Friday, May 31, 2002 3:17 PM To: ietf-ediint@imc.org Subject: Re: How do I send EDI file securely over Internet via FTP or HTTP S? From: "Pae Choi" [RE: SMTP/email] > Of course, that is why it's called "Store-&-Forward" mechanism. > But it does not guarantee "How soon it will get there!" Store-and-Forward comes from the old days when people had dialup modems. The best guarantee is to deliver directly without forwarding. Of course, if you want to send a message but can't reach another server you have a problem-- same as if you used http/ftp I wonder why spammers are the only ones to figure this out. The tragedy is that a good way to get rid of junk mail is to delete mail that doesn't appear to be store-and-forward. > Maybe we need new email service that guarantee the delivery > within a given time, e.g., Fedex or UPS style guarantee delivery. :-) You can use Fedex to send a package to your neighbor, but it's more reliable to walk over and give it to them personally. Same for smtp email. I suppose there could be a business that runs high availabliity, geographically isolated redundant servers that can perform an assured delivery with store and forward if needed, plus archiving. In theory it could be more reliable than your own computer, which could crash and corrupt it's files. But a backup-only service is just as good and maybe better in some ways. ... > > Ever received an email 30 days later than sent? No, but I've received very delayed email, as have friends. At least I've received it! Ever tried accessing a web site and got a connection timed out? The real issue is how do you deal with the situation when a direct delivery can't be made. From owner-ietf-ediint@mail.imc.org Mon Jun 3 00:44:24 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id AAA24887 for ; Mon, 3 Jun 2002 00:44:23 -0400 (EDT) Received: by above.proper.com (8.11.6/8.11.3) id g534REF05820 for ietf-ediint-bks; Sun, 2 Jun 2002 21:27:14 -0700 (PDT) Received: from spare227-236.raqport.com ([207.207.190.227]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g534RDg05816 for ; Sun, 2 Jun 2002 21:27:13 -0700 (PDT) Received: from earth (12-232-15-65.client.attbi.com [12.232.15.65]) by ableserve.com (8.10.2/8.10.2) with SMTP id g534e0t21539; Mon, 3 Jun 2002 00:40:00 -0400 Message-ID: <000401c20ab7$f17eb0e0$0201a8c0@earth> From: "Robert E. Frank" To: "Dick Brooks" , "Rishel,Wes" , References: Subject: Re: How do I send EDI file securely over Internet? Date: Sun, 2 Jun 2002 21:34:13 -0700 Organization: Open Commerce, Inc. MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 7bit From1984 to 1994, my teams used standard SMTP over the open Arpanet, Milnet and Internet . We moved many millions of EDI logistics and procurement transactions between (up to10,000) military and commercial trading parties. Theoretically, we could have had some losses; but, we had none. We avoided problems by using quality hardware, quality software, trained administrators, SMTP experience, and common sense. From 1995 until today, we have been using SMIME and EDIINT products (such as Templar and Softshare Vista) to provide such features as "access control, authentication, authorization, confidentiality and deterministic, auditable delivery of business transactions." Other products also support these capabilities. Of course, work on improving the standards should continue. But, I could not lurk any longer without encouraging people to move ahead with one of the excellent SMIME/EDIINT options available today. Robert Frank Open Commerce, Inc. SAFExchange Services 925-846-1970 From owner-ietf-ediint@mail.imc.org Mon Jun 3 07:00:13 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA07813 for ; Mon, 3 Jun 2002 07:00:13 -0400 (EDT) Received: by above.proper.com (8.11.6/8.11.3) id g53Agfr13874 for ietf-ediint-bks; Mon, 3 Jun 2002 03:42:41 -0700 (PDT) Received: from puma.ent.gartner.com (puma.gartner.com [207.140.148.100]) by above.proper.com (8.11.6/8.11.3) with SMTP id g53Agdg13870 for ; Mon, 3 Jun 2002 03:42:39 -0700 (PDT) Subject: RE: How do I send EDI file securely over Internet? Date: Mon, 3 Jun 2002 00:43:41 -0400 Message-ID: <8647AD35DEC2D411A4DD0002A513481A155EE00B@mammoth.gartner.com> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Thread-Topic: How do I send EDI file securely over Internet? Thread-Index: AcIKttdJ9kjTm3apEdaJJgBQi7KOfQAATqog content-class: urn:content-classes:message From: "Rishel,Wes" X-MimeOLE: Produced By Microsoft Exchange V6.0.5762.3 To: "Robert E. Frank" , "Dick Brooks" , Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by above.proper.com id g53Agdg13871 Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 8bit Robert, That is quite an accomplishment. Did you do it by requiring the trading partners to use your software? -----Original Message----- From: Robert E. Frank [mailto:bobfrank@opencommerce.com] Sent: Sunday, June 02, 2002 9:34 PM To: Dick Brooks; Rishel,Wes; ietf-ediint@imc.org Subject: Re: How do I send EDI file securely over Internet? From1984 to 1994, my teams used standard SMTP over the open Arpanet, Milnet and Internet . We moved many millions of EDI logistics and procurement transactions between (up to10,000) military and commercial trading parties. Theoretically, we could have had some losses; but, we had none. We avoided problems by using quality hardware, quality software, trained administrators, SMTP experience, and common sense. From 1995 until today, we have been using SMIME and EDIINT products (such as Templar and Softshare Vista) to provide such features as "access control, authentication, authorization, confidentiality and deterministic, auditable delivery of business transactions." Other products also support these capabilities. Of course, work on improving the standards should continue. But, I could not lurk any longer without encouraging people to move ahead with one of the excellent SMIME/EDIINT options available today. Robert Frank Open Commerce, Inc. SAFExchange Services 925-846-1970 From owner-ietf-ediint@mail.imc.org Mon Jun 3 13:19:48 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA24602 for ; Mon, 3 Jun 2002 13:19:47 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g53H0He08129 for ietf-ediint-bks; Mon, 3 Jun 2002 10:00:17 -0700 (PDT) Received: from www.tech-comm.com (ns3.tech-comm.com [209.149.125.161]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g53H0Gg08125 for ; Mon, 3 Jun 2002 10:00:16 -0700 (PDT) Received: from LAW2KN008 ([24.196.13.18]) by www.tech-comm.com (8.11.6/8.11.6) with SMTP id g53HQvE20059; Mon, 3 Jun 2002 12:26:57 -0500 From: "Dick Brooks" To: "Robert E. Frank" , "Dick Brooks" , "Rishel,Wes" , Subject: RE: How do I send EDI file securely over Internet? Date: Mon, 3 Jun 2002 11:58:28 -0500 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 In-Reply-To: <000401c20ab7$f17eb0e0$0201a8c0@earth> Importance: Normal Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 7bit Hello Bob, It's been quite awhile since we last communicated (1992 I believe). I was working at DEC and I believe you were working for the Government at one of the National Labs (was it Sandia?). I recall we were both working with Dave Crocker on what eventually became RFC 1767. We've been at this a long time... I find it troubling to see such deep division within the EDIINT workgroup. We continue to experience skirmishes over SMTP and HTTP, S/MIME and OpenPGP. I also expect a confrontation to breakout within the AS2 camp over the two available packaging options, RFC2388 compliant versus the AS2 specific email like packaging with AS2-To and AS2-From extension headers (as synonyms for the RFC 822 To and From headers) at the HTTP level to identify sender/recipient. Now, we have a fairly well defined reliable, secure ebXML Message Service (supported by DISA and UN/CEFACT) that, IMO, is a more cohesive, elegant and better engineered framework for E-Commerce than either AS1 or AS2. ebXML's Message Service is built on SOAP and supports a full range of web services functionality as well as the standard EDI transport function. Also, let's not forget the imminent competition coming from some of the other alternatives, such as WS-Security [1] (Microsoft) and HTTPR [2] (IBM). IMO, competition between these various "standards" is creating a difficult situation for implementers. A recent letter from Tim Thomasma of Ford Motor Company and Co-Chair, XML/EDI Work Group, Automotive Industry Action Group, to David Berlind at Cnet.com sums it up better than I, he states: "The last thing we need is some sort of new "Sun + allies / ebXML" vs. "Microsoft + allies / Web services" technology war. Competition is wonderful, but can each vendor please implement reliable, secure XML messaging over HTTP in such a way that it interoperates with everyone else's implementation?" In closing, I refer you to an article I wrote describing E-Commerce standardization in the Energy industry that expresses concerns similar to those expressed by Tim, ref: "The Struggle for B2B Standards: A Tale of e-Commerce Standardization in the Energy Industry" http://b2b.ebizq.net/std/brooks_1.html Tim, if you're listening - good letter. [1] http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnglobspec/ html/wssecurspecindex.asp [2] http://www-106.ibm.com/developerworks/webservices/library/ws-phtt/ Dick Brooks Systrends, Inc 7855 South River Parkway, Suite 111 Tempe, Arizona 85284 Web: www.systrends.com Phone:480.756.6777,Mobile:205-790-1542,eFax:240-352-0714 From owner-ietf-ediint@mail.imc.org Mon Jun 3 15:12:37 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA28027 for ; Mon, 3 Jun 2002 15:12:37 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g53Ivpc13829 for ietf-ediint-bks; Mon, 3 Jun 2002 11:57:51 -0700 (PDT) Received: from df-inet1.exchange.microsoft.com (df-inet1.exchange.microsoft.com [131.107.8.8]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g53Ivog13825 for ; Mon, 3 Jun 2002 11:57:50 -0700 (PDT) Received: from DF-VRS-01.redmond.corp.microsoft.com ([157.54.4.14]) by df-inet1.exchange.microsoft.com with Microsoft SMTPSVC(5.0.2195.5255); Mon, 3 Jun 2002 11:58:22 -0700 Received: from 10.197.0.60 by DF-VRS-01.redmond.corp.microsoft.com (InterScan E-Mail VirusWall NT); Mon, 03 Jun 2002 11:57:43 -0700 Received: from DF-BOWWOW.platinum.corp.microsoft.com ([10.197.1.8]) by DF-YURI.platinum.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.5329); Mon, 3 Jun 2002 11:57:43 -0700 X-MimeOLE: Produced By Microsoft Exchange V6.0.6232.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Subject: RE: How do I send EDI file securely over Internet? Date: Mon, 3 Jun 2002 11:57:42 -0700 Message-ID: Thread-Topic: How do I send EDI file securely over Internet? Thread-Index: AcILIgqXRjYmoOsBTcWmzfIJwCEB9gADasHA From: "Bob Atkinson" To: "Dick Brooks" Cc: "Robert E. Frank" , "Dick Brooks" , "Rishel,Wes" , X-OriginalArrivalTime: 03 Jun 2002 18:57:43.0109 (UTC) FILETIME=[8A940F50:01C20B30] Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by above.proper.com id g53Ivog13826 Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 8bit Perhaps you have the wrong Bob. I apologize, but I don't recall working on RFC1767, nor have I worked for the government. Bob -----Original Message----- From: Dick Brooks [mailto:dick@tech-comm.com] Sent: Monday, June 03, 2002 9:58 AM To: Robert E. Frank; Dick Brooks; Rishel,Wes; ietf-ediint@imc.org Subject: RE: How do I send EDI file securely over Internet? Hello Bob, It's been quite awhile since we last communicated (1992 I believe). I was working at DEC and I believe you were working for the Government at one of the National Labs (was it Sandia?). I recall we were both working with Dave Crocker on what eventually became RFC 1767. We've been at this a long time... I find it troubling to see such deep division within the EDIINT workgroup. We continue to experience skirmishes over SMTP and HTTP, S/MIME and OpenPGP. I also expect a confrontation to breakout within the AS2 camp over the two available packaging options, RFC2388 compliant versus the AS2 specific email like packaging with AS2-To and AS2-From extension headers (as synonyms for the RFC 822 To and From headers) at the HTTP level to identify sender/recipient. Now, we have a fairly well defined reliable, secure ebXML Message Service (supported by DISA and UN/CEFACT) that, IMO, is a more cohesive, elegant and better engineered framework for E-Commerce than either AS1 or AS2. ebXML's Message Service is built on SOAP and supports a full range of web services functionality as well as the standard EDI transport function. Also, let's not forget the imminent competition coming from some of the other alternatives, such as WS-Security [1] (Microsoft) and HTTPR [2] (IBM). IMO, competition between these various "standards" is creating a difficult situation for implementers. A recent letter from Tim Thomasma of Ford Motor Company and Co-Chair, XML/EDI Work Group, Automotive Industry Action Group, to David Berlind at Cnet.com sums it up better than I, he states: "The last thing we need is some sort of new "Sun + allies / ebXML" vs. "Microsoft + allies / Web services" technology war. Competition is wonderful, but can each vendor please implement reliable, secure XML messaging over HTTP in such a way that it interoperates with everyone else's implementation?" In closing, I refer you to an article I wrote describing E-Commerce standardization in the Energy industry that expresses concerns similar to those expressed by Tim, ref: "The Struggle for B2B Standards: A Tale of e-Commerce Standardization in the Energy Industry" http://b2b.ebizq.net/std/brooks_1.html Tim, if you're listening - good letter. [1] http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnglobs pec/ html/wssecurspecindex.asp [2] http://www-106.ibm.com/developerworks/webservices/library/ws-phtt/ Dick Brooks Systrends, Inc 7855 South River Parkway, Suite 111 Tempe, Arizona 85284 Web: www.systrends.com Phone:480.756.6777,Mobile:205-790-1542,eFax:240-352-0714 From owner-ietf-ediint@mail.imc.org Wed Jun 5 16:15:32 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA16974 for ; Wed, 5 Jun 2002 16:15:32 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g55Jsu001628 for ietf-ediint-bks; Wed, 5 Jun 2002 12:54:56 -0700 (PDT) Received: from mtiwmhc21.worldnet.att.net (mtiwmhc21.worldnet.att.net [204.127.131.46]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g55Jssn01624 for ; Wed, 5 Jun 2002 12:54:54 -0700 (PDT) Received: from webmail.worldnet.att.net ([204.127.135.42]) by mtiwmhc21.worldnet.att.net (InterMail vM.4.01.03.27 201-229-121-127-20010626) with SMTP id <20020605195451.EGML19182.mtiwmhc21.worldnet.att.net@webmail.worldnet.att.net>; Wed, 5 Jun 2002 19:54:51 +0000 Received: from [68.15.0.249] by webmail.worldnet.att.net; Wed, 05 Jun 2002 19:54:51 +0000 From: ricardo.johnson@att.net To: pcumming@yahoo.com Cc: ietf-ediint@imc.org Subject: Re: How do I send EDI file securely over Internet via FTP or HTTPS? Date: Wed, 05 Jun 2002 19:54:51 +0000 X-Mailer: AT&T Message Center Version 1 (May 28 2002) Message-Id: <20020605195451.EGML19182.mtiwmhc21.worldnet.att.net@webmail.worldnet.att.net> Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: The best may to exchange secure messages over any communications or messaging platform including FTP, SMTP, HTTP, X25, X400, etc. is to incorporate ANSI X 12.58 security. This powerful security standard is cerified by ANSI and ISO and has been implemented ans used by banks for years. When you implement in X 12.58 security software (i.e. www.primefactors.com)you won't need to invest in and manage several weaker security systems including: S/MIME, PGP, SSL, and even Firewalls. Your transactions will be protected at the lowest level possible, no need to protect the channel (SSL) or the envelope (S/MIME). Plus, your secured (wraped) transactions will be able travel freely between VANs, e-mail, and FTP exchanges. Ricardo Johnson Interdata, LLC > > We have a few (3-5) clients who would like to receive > EDI via FTP or HTTPS > > We would send the file to them (from Unix or > Windows), they would receive it. > > Of course we could use standard FTP. However is > there some way to send an encrpyted FTP? > I have heard of Kermit, SSH, and PGP. Not sure > which if any is the correct, low cost and easiest > approach for us to first encrpyt and then FTP/HTTPS > (not sure how) over the Internet to our 2-4 customers. > > > 1. What is the best approach and how would one > set-up to run unattended? > What software is needed on both ends? > Note that we are the sender so we will not need much. > > > 2. Supposedly the SAP Business Connector has the > ability to send via SSL over the Internet. How > does this work? We could then send our ship notice to > the customer through this. Not sure of the mechanices, > what is needed on each end, how we would send it, > etc.. > > Thanks for any guidance. > Peter > pcumming@yahoo.com > > > __________________________________________________ > Do You Yahoo!? > Yahoo! - Official partner of 2002 FIFA World Cup > http://fifaworldcup.yahoo.com From owner-ietf-ediint@mail.imc.org Wed Jun 5 17:13:47 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA20279 for ; Wed, 5 Jun 2002 17:13:46 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g55KwRC04613 for ietf-ediint-bks; Wed, 5 Jun 2002 13:58:27 -0700 (PDT) Received: from swan.mail.pas.earthlink.net (swan.mail.pas.earthlink.net [207.217.120.123]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g55KwQn04609 for ; Wed, 5 Jun 2002 13:58:26 -0700 (PDT) Received: from 1cust97.tnt5.williamsburg.va.da.uu.net ([63.39.69.97] helo=dev1) by swan.prod.itd.earthlink.net with smtp (Exim 3.33 #2) id 17FhrO-0000Wd-00; Wed, 05 Jun 2002 13:58:27 -0700 Message-ID: <001501c20cec$e6398660$0b01a8c0@dev1> From: "Pae Choi" To: Cc: References: <20020605195451.EGML19182.mtiwmhc21.worldnet.att.net@webmail.worldnet.att.net> Subject: Re: How do I send EDI file securely over Internet via FTP or HTTPS? Date: Wed, 5 Jun 2002 16:58:31 -0700 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Content-Transfer-Encoding: 7bit My appologies for being ignorant. But I am not familiar with X12.58. So I'd like to ask some questions related to your previous message. 1) Where can I can learn more about X12.58? Any URLs? 2) What are the security strengths of X12.58 over SSL v3 or TLS v1.0? 3) What are the security strength does X12.58 has over ebXML and/or SOAP with W3C/XML Signature? 4) What is the lowest level possible in an OSI 7-layer style? Thank you, Pae ----- Original Message ----- From: To: Cc: Sent: Wednesday, June 05, 2002 12:54 PM Subject: Re: How do I send EDI file securely over Internet via FTP or HTTPS? > > The best may to exchange secure messages over any > communications or messaging platform including FTP, > SMTP, HTTP, X25, X400, etc. is to incorporate ANSI X > 12.58 security. This powerful security standard is > cerified by ANSI and ISO and has been implemented ans > used by banks for years. When you implement in X 12.58 > security software (i.e. www.primefactors.com)you won't > need to invest in and manage several weaker security > systems including: S/MIME, PGP, SSL, and even Firewalls. > Your transactions will be protected at the lowest level > possible, no need to protect the channel (SSL) or the > envelope (S/MIME). > Plus, your secured (wraped) transactions will be able > travel freely between VANs, e-mail, and FTP exchanges. > > Ricardo Johnson > Interdata, LLC > > > > We have a few (3-5) clients who would like to receive > > EDI via FTP or HTTPS > > > > We would send the file to them (from Unix or > > Windows), they would receive it. > > > > Of course we could use standard FTP. However is > > there some way to send an encrpyted FTP? > > I have heard of Kermit, SSH, and PGP. Not sure > > which if any is the correct, low cost and easiest > > approach for us to first encrpyt and then FTP/HTTPS > > (not sure how) over the Internet to our 2-4 customers. > > > > > > 1. What is the best approach and how would one > > set-up to run unattended? > > What software is needed on both ends? > > Note that we are the sender so we will not need much. > > > > > > 2. Supposedly the SAP Business Connector has the > > ability to send via SSL over the Internet. How > > does this work? We could then send our ship notice to > > the customer through this. Not sure of the mechanices, > > what is needed on each end, how we would send it, > > etc.. > > > > Thanks for any guidance. > > Peter > > pcumming@yahoo.com > > > > > > __________________________________________________ > > Do You Yahoo!? > > Yahoo! - Official partner of 2002 FIFA World Cup > > http://fifaworldcup.yahoo.com From owner-ietf-ediint@mail.imc.org Thu Jun 6 19:39:02 2002 Received: from above.proper.com (mail.proper.com [208.184.76.45]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA15831 for ; Thu, 6 Jun 2002 19:39:01 -0400 (EDT) Received: from localhost (localhost [[UNIX: localhost]]) by above.proper.com (8.11.6/8.11.3) id g56KkTQ06634 for ietf-ediint-bks; Thu, 6 Jun 2002 13:46:29 -0700 (PDT) Received: from d06lmsgate-4.uk.ibm.COM (d06lmsgate-4.uk.ibm.com [195.212.29.4]) by above.proper.com (8.11.6/8.11.3) with ESMTP id g56KkRn06630 for ; Thu, 6 Jun 2002 13:46:27 -0700 (PDT) Received: from d06relay02.portsmouth.uk.ibm.com (d06relay02.portsmouth.uk.ibm.com [9.166.84.148]) by d06lmsgate-4.uk.ibm.COM (1.0.0) with ESMTP id VAA165834; Thu, 6 Jun 2002 21:30:38 +0100 Received: from d06ml035.portsmouth.uk.ibm.com (d06ml035_cs0 [9.180.35.16]) by d06relay02.portsmouth.uk.ibm.com (8.11.1m3/NCO/VER6.1) with ESMTP id g56KkMm21238; Thu, 6 Jun 2002 21:46:22 +0100 Subject: Re: How do I send EDI file securely over Internet via FTP or HTTPS? To: pcumming@yahoo.com Cc: ietf-ediint@imc.org X-Mailer: Lotus Notes Release 5.0.7 March 21, 2001 Message-ID: From: "Paul V Ford-Hutchinson" Date: Thu, 6 Jun 2002 21:41:12 +0100 X-MIMETrack: Serialize by Router on D06ML035/06/M/IBM(Release 5.0.9a |January 7, 2002) at 06/06/2002 21:46:22 MIME-Version: 1.0 Content-type: text/plain; charset=us-ascii Sender: owner-ietf-ediint@mail.imc.org Precedence: bulk List-Archive: List-ID: List-Unsubscribe: Well, this being the EDI-INT w/g - you'll get pointed at AS1 (SMTP) and AS2 (HTTPS). There are, no doubt, many interoperable implementations out there (see the drummond group web site) but trying to get one of the vendors to interoperate with a RYO implementation will cost you $$$. FTP is an unfavoured backwater of the Internet (mainly due to firewall issues) but there are a significant number of secure ftp implementations that use FTP and SSL (or TLS if you want to get IETF-picky). See my "state of ftps" page at http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html . There's also sftp (which usually means ftp over SSH) if you like the SSH model. Paul -- Paul Ford-Hutchinson : eCommerce application security : paulfordh@uk.ibm.com MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 462005 http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html Peter Cumming cc: Sent by: Subject: How do I send EDI file securely over Internet via FTP or HTTPS? owner-ietf-ediint@m ail.imc.org 31/05/2002 05:23 PM Please respond to pcumming We have a few (3-5) clients who would like to receive EDI via FTP or HTTPS We would send the file to them (from Unix or Windows), they would receive it. Of course we could use standard FTP. However is there some way to send an encrpyted FTP? I have heard of Kermit, SSH, and PGP. Not sure which if any is the correct, low cost and easiest approach for us to first encrpyt and then FTP/HTTPS (not sure how) over the Internet to our 2-4 customers. 1. What is the best approach and how would one set-up to run unattended? What software is needed on both ends? Note that we are the sender so we will not need much. 2. Supposedly the SAP Business Connector has the ability to send via SSL over the Internet. How does this work? We could then send our ship notice to the customer through this. Not sure of the mechanices, what is needed on each end, how we would send it, etc.. Thanks for any guidance. Peter pcumming@yahoo.com __________________________________________________ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com