Subject: RE: How do I send EDI file securely over Internet via FTP or HTTP S?

From: "Huestis, Paul" <[email-masked]>
Date: Fri, 31 May 2002 15:01:37 -0400

A possible solution is using SSL to send documents via FTP. You could get an
SSL server, about $450-600US, generate the SSL certificate needed per
Trading Partner and send the certificate to the Trading Partner. This allows
you to control the certificates and reduces security risks. The Trading
Partner would need to get an FTP Server with SSL capabilities, about $40. 

-----Original Message-----
From: Shan Harter [mailto:[email-masked]]
Sent: Friday, May 31, 2002 2:19 PM
To: 'Dean Pierson'; [email-masked]; [email-masked]
Subject: RE: How do I send EDI file securely over Internet via FTP or HTTPS?

You could try some of the EDIINT products out there. One would be Cyclone or
IPnet. Systrends also has some industry compatible solutions.
all of them require that they have a product that is compatible and all of
them are secure transports. Some offer non-repudiation of receipt which
removes any denial of send or receive.
 
----Original Message-----
From: Dean Pierson [mailto:[email-masked]]
Sent: Friday, May 31, 2002 10:04 AM
To: [email-masked]; [email-masked]
Subject: Re: How do I send EDI file securely over Internet via FTP or HTTPS?

We do not support FTP over the internet for EDI.  To use that, you have to
have an ANX connection - $$$$.

If you want to use the Internet, you will have to use HTTP/S and to use that
you
can write or buy software.  See our site at
http://extranet.daimlerchrysler.com/general/ebmx/
<http://extranet.daimlerchrysler.com/general/ebmx/>  
then navigate to the section on internet protocols. 

At 09:23 AM 5/31/2002 -0700, Peter Cumming wrote:

We have a few (3-5) clients who would like to receive
EDI via FTP or HTTPS

We would send the file to them (from Unix or
Windows), they would receive it.

Of course we could use standard FTP. However is
there some way to send an encrpyted FTP?
I have heard of Kermit, SSH, and PGP. Not sure
which if any is the correct, low cost and easiest
approach for us to first encrpyt and then FTP/HTTPS
(not sure how) over the Internet to our 2-4 customers.

1. What is the best approach and how would one
set-up  to run unattended?
What software is needed on both ends?
Note that we are the sender so we will not need much.

2. Supposedly the SAP Business Connector has the
ability to send via SSL over the Internet. How
does this work? We could then send our ship notice to
the customer through this. Not sure of the mechanices,
what is needed on each end, how we would send it,
etc..

Thanks for any guidance.
Peter
[email-masked]

__________________________________________________
Do You Yahoo!?
Yahoo! - Official partner of 2002 FIFA World Cup
http://fifaworldcup.yahoo.com <http://fifaworldcup.yahoo.com/>

---

From: "Carl Hage" <[email-masked]>
Date: Fri, 31 May 2002 13:50:59 -0700

From:           	"Huestis, Paul" <[email-masked]>
> A possible solution is using SSL to send documents via FTP. 

Don't forget about good old email. You can exchange signed and 
encrypted messages with manual email programs like Netscape and 
Outlook-Express, or by software using the openssl package.

If you add signed receipts and are careful about the way messages are 
sent, you end up following the EDIINT specification.

This is more secure than SSL-FTP/HTTP, adding non-repudiation 
instead of just authenticating logins. Data can be stored securely, not 
just transmitted securely.

There isn't a big difference transmitting EDIINT MIME wrapped data via 
SMTP or HTTP, but there is a big difference between these and 
transmitting base data by S-FTP and HTTPS.

--------------------------------------------------------------------------
Carl Hage                                              C. Hage Associates
<mailto:[email-masked]> Voice/Fax: 1-408-244-8410      1180 Reed Ave #51
<http://www.chage.com/chage/>                          Sunnyvale, CA 94086

---

From: "Shan Harter" <[email-masked]>
Date: Fri, 31 May 2002 14:13:27 -0700

Ever received an email 30 days later than sent?

-----Original Message-----
From: Carl Hage [mailto:[email-masked]]
Sent: Friday, May 31, 2002 1:51 PM
To: [email-masked]; [email-masked]
Subject: RE: How do I send EDI file securely over Internet via FTP or HTTP
S?

-------------------------------------------------------------------------- 
Carl Hage                                              C. Hage Associates 
< mailto:[email-masked] <mailto:[email-masked]> > Voice/Fax: 1-408-244-8410
1180 Reed Ave #51 
< http://www.chage.com/chage/ <http://www.chage.com/chage/> >
Sunnyvale, CA 94086

---

From: "Pae Choi" <[email-masked]>
Date: Fri, 31 May 2002 17:44:35 -0700

Of course, that is why it's called "Store-&-Forward" mechanism.
But it does not guarantee "How soon it will get there!"

Maybe we need new email service that guarantee the delivery
within a given time, e.g., Fedex or UPS style guarantee delivery. :-)

So the business folks can make new marketing slogan, "We
guarantee to deliver your email within 30 days!" :-)

Pae

----- Original Message -----
From: "Shan Harter" <[email-masked]>
To: "'Carl Hage'" <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Friday, May 31, 2002 2:13 PM
Subject: RE: How do I send EDI file securely over Internet via FTP or HTTP
S?

---

From: "Shan Harter" <[email-masked]>
Date: Fri, 31 May 2002 15:07:41 -0700

That's a good idea, ebizMail? SBMP (Simple Business Mail Protocol?)
baselined by TCP/IP routed by ebXML messages?

-----Original Message-----
From: Pae Choi [mailto:[email-masked]]
Sent: Friday, May 31, 2002 5:45 PM
To: Harter, Shan; Carl Hage; [email-masked]; [email-masked]
Subject: Re: How do I send EDI file securely over Internet via FTP or HTTP
S?

Pae 

----- Original Message ----- 
From: "Shan Harter" <[email-masked]> 
To: "'Carl Hage'" <[email-masked]>; <[email-masked]>; 
<[email-masked]> 

> From: Carl Hage [ mailto:[email-masked] <mailto:[email-masked]> ] 

> < mailto:[email-masked] <mailto:[email-masked]>  < mailto:[email-masked]
<mailto:[email-masked]> > > Voice/Fax: 
1-408-244-8410 
> 1180 Reed Ave #51 
> < http://www.chage.com/chage/ <http://www.chage.com/chage/>  <
http://www.chage.com/chage/ <http://www.chage.com/chage/> > >

---

From: "Carl Hage" <[email-masked]>
Date: Fri, 31 May 2002 15:16:41 -0700

From:           	"Pae Choi" <[email-masked]>
[RE: SMTP/email]
> But it does not guarantee "How soon it will get there!"

Store-and-Forward comes from the old days when people had dialup 
modems. The best guarantee is to deliver directly without forwarding. 
Of course, if you want to send a message but can't reach another 
server you have a problem-- same as if you used http/ftp

I wonder why spammers are the only ones to figure this out. The 
tragedy is that a good way to get rid of junk mail is to delete mail that 
doesn't appear to be store-and-forward.

> within a given time, e.g., Fedex or UPS style guarantee delivery. :-)

You can use Fedex to send a package to your neighbor, but it's more 
reliable to walk over and give it to them personally. Same for smtp 
email.

I suppose there could be a business that runs high availabliity, 
geographically isolated redundant servers that can perform an assured 
delivery with store and forward if needed, plus archiving. In theory it 
could be more reliable than your own computer, which could crash and 
corrupt it's files. But a backup-only service is just as good and maybe 
better in some ways.
...
> > Ever received an email 30 days later than sent?

No, but I've received very delayed email, as have friends. At least I've 
received it!

Ever tried accessing a web site and got a connection timed out?

The real issue is how do you deal with the situation when a direct 
delivery can't be made.

---

From: [email-masked]
Date: Fri, 31 May 2002 16:54:58 -0700 (PDT)

> doesn't appear to be store-and-forward.

More generally, just because a protocol has a capability doesn't mean you have
to use it.

General network-wide email facilities need store and forward. But nothing
prevents you from setting up a special SMTP link just for EDI that bypasses
general email facilities. Such a system is only constrained by the
characteristics of single-hop SMTP, not by the characteristics of what's
deployed elsewhere.

Lots of email software exists that can be configured this way.

> reliable to walk over and give it to them personally. Same for smtp

I've always found the notion of a delivery guarantee somewhat amusing. in the
final analysis nothing can actually make such a guarantee. No amount of
protocol shopping changes the fact that the bits don't get through when the
network is down. You can try harder and you can lower the number of
intermediaries and you can guard against various failure cases, but in the
limit the various protocols tend to coalesce in this regard.

				Ned