Subject: Digitally Signing Inquiry Requests

From: David Burdett <[email-masked]>
Date: Wed, 9 Jun 1999 01:26:33 +0100

Looking through the Transaction Status Inquiry part of the spec says ...

IOTP aware software that supports the Consumer Trading Role may not:
		*	digitally sign a response if requested, since it may
not have the capability, or
		*	respond to an Inquiry Request at all since it may
not be on-line, or may consider that the request is not reasonable since,
for example, the Request was not digitally signed.

However the rest of the transaction doesn't include any references to
digital signatures. Therefore propose to add the relevant text to allow
signatures on Inquiry Requests. Specifically ...

1. Adding Signature Block to the lists of blocks at the start of the section

2. Adding Signature Block to the Message containing the Inquiry Request
Block (see revised message flow below)

3. Adding processing rules for the Signature Block - see  below.

4. Also added the following:
	[Note]	Inquiries on Baseline Ping IOTP Transactions (see section
9.2.2) are ignored.
	[Note End]	 

SIGNATURE BLOCK
If a signature block is present on the message containing the Inquiry
Request Block then it may be checked to determine if the Inquiry Request is
authorised.

Inquiry Response Blocks should only be generated if the Transaction is
authorised.

[Note]	Determining if an Inquiry Request is authorised is at user
discretion. For example, if the original transaction was processed over a
secure link then it may be reasonable to presume that if the sender of the
Inquiry knows the Transaction Id component of the original message
(including for example the timestamp) then the inquiry is likely to be
genuine.

			Checking for a digital signature is an optional
additional check that may be used.
[Note End]	 

REVISED MESSAGE FLOW
View in fixed font ...
*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*+*
     1st Role 
      |  2nd Role
STEP  |     |
 1.            The first role decides to inquire on an IOTP 
               Transaction by, for example, clicking on the inquiry 
               button of an IOTP Aware Application. This will then 
               generate an Inquiry Request Block and send it to the 
               appropriate Trading Role.

      1 --> 2  INQUIRY REQUEST. IotpMsg: TransRef Block; Signature 
               Block (optional); Inquiry Request Block

 2.            The Trading Role checks the digital signature (if 
               present). If the recipient wants to respond then the
               Trading Role checks the transaction status of the 
               transaction that is being inquired upon by using the 
               IotpTransId in the Transaction ID Component of the 
               Transaction Reference Block, then generates the 
               appropriate Inquiry Response Block, sends the message
               back to the 1st Role and stops

      1 <-- 2  INQUIRY RESPONSE. IotpMsg: TransRef Block; Inquiry
               Response Block

3.             First role checks the Inquiry Response Block and takes 
               whatever action is appropriate or perhaps stops. This 
               may include displaying status information to the end 
               user.

*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*-*

> mailto:<[email-masked]>
> Mondex International, US Advanced Technology Office
> 111 Pine St, 6th Floor, San Francisco, CA 94111
> Tel/Voicemail: +1 415 645 6973	Fax: +1 415 956 9370
> 

**********************************************************************************************

This Email and any attached files are confidential and may also be privileged. 
If you are not the intended recipient, please notify the postmaster using email 
address [email-masked] or call +44 171 557 5000 and ask for the 
IT Helpdesk.  You should not copy this email and any attached files, use them 
for any purpose or disclose the contents to any other person; all copies of the 
Email and associated files in your possession should be destroyed.

Mondex International Limited
47-53 Cannon Street
London EC4M 5SQ
United Kingdom
Registered No: 3122085, England

Phone:          +44 171 557 5000
Fax:            +44 171 557 5200
Email:          [email-masked]
WebSite:        http://www.mondexinternational.com

*********************************************************************************************
-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]