Subject: RE: profiles in AS2

From: "Kyle Meadors" <[email-masked]>
Date: Thu, 15 Dec 2005 16:20:54 -0600

Not a lot of comments on this thread. But to summarize…

3 in favor of Option 2 (Features header) and use of AS2–Version 1.2 

1 in favor Option 3 where filtering is done on a message

Still does not fully address the initial start–up conditions as Richard
pointed out, but perhaps that just can not be done without some manual
setup.

Since this EDIINT WG will likely be closing relatively soon, I hope we can
get some more to weigh in on this. Do others object to Option 2 (with
AS2–Version 1.2)?

For those AS2 vendors supporting Option 2, would this impact your product,
including those deployed in existing supply chains? Are their significant
backward compatibility problems with this choice?

Kyle Meadors

DGI

   _____  

From: Tim McCarthy [mailto:[email-masked]] 
Sent: Wednesday, December 07, 2005 9:14 AM
To: Kyle Meadors; [email-masked]
Subject: RE: profiles in AS2

Seems to me that a combination of features 2 and 4 would provide everything
we’d need.

   _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Richard Bigelow
Sent: Tuesday, December 06, 2005 5:07 PM
To: Kyle Meadors; [email-masked]
Subject: RE: profiles in AS2

These are my comments.  Option 2 is preferred.  This memo essentially
supports John Duker's memo of Dec. 5, Features Profile in AS2.

1. This option requires that implementers of feature 1.n also implement all
earlier features.  Is that reasonable?  What if 1.5 is difficult and many
vendors don't want to do it, but many want to support 1.6?  Not recommended.

2.  The features header allows the partner A receiving the message to know
the other partner's (B's) capabilities.  So when A sends to B, A knows what
is allowed.  A can also check B's AS2-version; 1.1 does not allow any of the
controlled features, but does allow compression.  A should update some state
for every message received from B.  B might stop supporting some feature.
Recommended.

A possible variant of (2) is that a partner could send some message to all
its trading partners when its capabilities change.  This message would have
headers only, no content.  It might be useful to send this capabilities
message to partners that would rarely receive normal messages.

3. This option allows receivers to ignore messages they don't understand,
and to detect those messages without looking for unknown headers.  But it
does not provide a mechanism for the sender to know whether a receiver can
receive the message.  Suppose we had done compression this way.  A could
send a compressed file to B, and B could ignore it based on the feature
header, but then the file is lost.  B could return a new MDN code indicating
unsupported-feature, and A could then send the uncompressed file, in this
example.  In other cases, A would have to use some other mechanism.  A could
remember that B rejected the file and not try that feature again, but how
would A know if B upgraded and can now support the feature?  The original
intent of the features header was that the sender could know in advance if
the receiver supports the feature.  3 is not recommended.

4. Before sending a message to B, A should ask B for B's capabilities, and
check if B supports the feature.  Since B might stop supporting a feature, A
should ask each time.  This is ok for rare messages, like CEM, but not for
common ones, like Multiple Attachments.  Not recommended.

None of these protocols fully addresses the initial case.  Before any
messages are exchanged, how do the partners know each other's capabilities?
Each partner must assume that the other supports only the basic 1.0 AS2
protocol.   Hopefully, they will be able to exchange normal messages, which
will contain at least the 1.2 version header.  They can then use option 2 to
discover each other capabilities.  This probably works for most features.
For CEM, either they must first exchange test messages that are unencrypted
and unsigned to establish CEM capability, or exchange initial certificates
manually.

Alternatively, the partners would configure each other manually the first
time.  Thereafter, they would be automatically updated on each other's
capabilities.

Richard Bigelow
Inovis
HYPERLINK "mailto:[email-masked]"[email-masked]

   _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Kyle Meadors
Sent: Thursday, December 01, 2005 9:04 AM
To: [email-masked]
Subject: profiles in AS2

I am needing the opinion of the AS2 community on the use of a feature
profiles within AS2. Back in 2002, compression was added as an extra
feature. Using "AS2–Version: 1.1" in a message indicated the UA could
support compression even if the actual message did not contain the
compressed envelope. This assisted implementers in knowing if their trading
partners could support compression. 
  
Moving to the present, users are requesting new features. These include I–Ds
for Reliability (from GS1), Multiple–Attachments (oil & gas users) and
Certificate Exchange Messaging (Wal–mart, P&G and others GS1 companies).
Given AS2's adoption, I am sure there will be others in the future. 
  
My question to those on this elist is how to do move forward with new
features. What do we do to insure only those who support a feature receive
it (e.g., only sending CEM message to trading partners who support that
profile)? Also, can anything be done to insure backward compatibility to
keep new Feature Header messages from being sent to & breaking older,
existing implementations (e.g. older implementation errors gracefully when
getting an unrecognized MA message). 
  
Here are some options. I would like to hear your thoughts on what is best or
other ideas. 

1. Use AS2–Version header to indicate UA support of profiles (e.g. 1.2
indicates CEM, 1.3 indicates CEM, Reliability). Works like compression (e.g.
“1.2” indicates capability of CEM but not an actual CEM message).

2. Use a new header, e.g. EDIINT–Features. The features header shows all
features supported by UA (e.g. EDIINT–Features: CEM, multiple–attachment)
but like AS2–Version does not indicate every message contains profile.

3. Use a new header for each feature which is present ONLY in the message
using that feature. For example, “CEM–Profile” for CEM messages. This could
allow receiving UA to filter in only profiles it recognizes.

4. Create a “Capability Query” AS2 Message which returns a Capability MDN.
MDN indicates what features receiving UA can support.

Kyle Meadors

Principal, Test Process

Drummond Group Inc.

615.212.0826

--
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.362 / Virus Database: 267.13.10/189 - Release Date: 11/30/2005

--
No virus found in this incoming message.
Checked by AVG Free Edition.
Version: 7.1.371 / Virus Database: 267.13.12/193 - Release Date: 12/6/2005

-- 
No virus found in this outgoing message.
Checked by AVG Free Edition.
Version: 7.1.371 / Virus Database: 267.14.0/203 - Release Date: 12/15/2005

---

From: "Dominique Danvoye" <[email-masked]>
Date: Wed, 21 Dec 2005 14:21:53 -0500

First, we understand and agree that AS2 partnerships management 

could be enhanced. Unfortunately right now major hubs need to deploy a lot
of effort to 

manage their great number of trading partners. 

At this point our reading of the actual comments from this list, we do not
see 

the real added value of this draft. We think that a use case for this "AS2
Software Features 

Profiles" should be presented to the group for clearer understanding and
further discussion.

Actually it seems that comments are in favor of Option #2, but we think that
this Option 

suffer from major drawbacks.

Our concerns are related to:

  - Statement #5 in the "EDI-INT Features Header" draft.

        5. Security Considerations     
        Because headers are often un-encrypted, it may be possible for the 
        feature header to be altered. Trading partners MAY consult out-of-
        band to confirm feature support. 

  - We think it does not provide solid and secure foundation to build future
protocol's 

    extensions. We think that it is unsafe to take any manual or automated
decisions 

    based on unsigned informations.  May be this aspect is solved by Option
4.

We think that industry would benefit to consider "AS2 Software Features
Profiles" as an 

extension to all AS protocols (AS1, AS2, AS3) than only AS2.  

Regarding Option #2. our point of view at this point of the discussion is
that those headers 

are not modifying the AS2 transport protocol (RFC 4130). So upgrade of the
AS2 version 

number from 1.1 to 1.2 should not be done since no change to the AS2 envelop
is achieved. 

We think if we would advertise the features through the the use of specific
headers, it should 

be done consistently across all AS protocols.  Given that AS1 obviously
require the header 

to be preceded by the prefix "X-". We think the header should be the same
for AS2 and AS3 

and we do not expect interoperability problem. 

So we do not see the requirement to increment the protocol version number
since the 

addition of this extension header would just be considered by software which
support it and 

just being ignored by software which don't.

Regarding Option #4. the Capability MDN should be signed to address security
concern 

we expressed above. In that case the signaling of this capability would be
done using 

an X-... header which open the possibility to upgrade specifically the AS2
(for example) 

protocol without require all vendors to support this Capability MDN.

Regarding the future of this group:

~> The closing of WG is decision to be made by Rik Drummond and 
~> Scott Hollenbeck. Discussion on EDIINT-Features, CEM and the 
~> like are peripheral to EDIINT but not part of the charter. 
~> When EDIINT charter is complete, and only a decision on AS3 
~> is remaining, the elist will be closed as well. 

This group discuss the change of AS2 protocol version number. 
How this could be outside the scope of this EDIINT group ? 

If it is not discuss here, where it will be discuss ? It will become a
proprietary protocol ?

From my point of view, since AS2 is born from an IETF group, it should
remain to 

IETF and in the public domain.

Dominique Danvoye
Vice-president, Internet Solutions
 <mailto:[email-masked]> [email-masked]
Alligacom Inc.

  _____  

From: [email-masked] [mailto:[email-masked]]
On Behalf Of Kyle Meadors
Sent: Thursday, December 15, 2005 5:21 PM
To: [email-masked]
Subject: RE: profiles in AS2

Not a lot of comments on this thread. But to summarize.

3 in favor of Option 2 (Features header) and use of AS2-Version 1.2 

Still does not fully address the initial start-up conditions as Richard
pointed out, but perhaps that just can not be done without some manual
setup.

AS2-Version 1.2)?

Kyle Meadors

DGI

  _____  

we'd need.

  _____  

Richard Bigelow
Inovis
[email-masked]

  _____  

feature. Using "AS2-Version: 1.1" in a message indicated the UA could
  
Moving to the present, users are requesting new features. These include I-Ds
for Reliability (from GS1), Multiple-Attachments (oil & gas users) and
Certificate Exchange Messaging (Wal-mart, P&G and others GS1 companies).
Given AS2's adoption, I am sure there will be others in the future. 

1. Use AS2-Version header to indicate UA support of profiles (e.g. 1.2
indicates CEM, 1.3 indicates CEM, Reliability). Works like compression (e.g.
"1.2" indicates capability of CEM but not an actual CEM message).

2. Use a new header, e.g. EDIINT-Features. The features header shows all
features supported by UA (e.g. EDIINT-Features: CEM, multiple-attachment)
but like AS2-Version does not indicate every message contains profile.

3. Use a new header for each feature which is present ONLY in the message
using that feature. For example, "CEM-Profile" for CEM messages. This could
allow receiving UA to filter in only profiles it recognizes.

4. Create a "Capability Query" AS2 Message which returns a Capability MDN.
MDN indicates what features receiving UA can support.

Kyle Meadors

Principal, Test Process

Drummond Group Inc.

615.212.0826