[Fwd: Re: [pki-tc] Re: Transaction PKI. Was:PKI-TC@PKI Workshop]

[Arshad Noor <arshad.noor@strongauth.com>]

Forwarding, per Dale's request.

--- Begin Message ---

• From: Dale Moberg <dmoberg@cyclonecommerce.com>
• To: Arshad Noor <arshad.noor@strongauth.com>
• Date: Fri, 16 Dec 2005 06:24:57 -0700

EDIIINT started well before XML was specified.

EDI itself is an established syntax with several variants (edifact, x12
etc) and versions and with much investment in integration middleware. It
works, and lacks economic incentive to incur the costs to convert to XML
(though there are several ways specified for those conversions).

XMLDsig and XMLEncryption were not complete as standards when EDIINT
began.
Though the standards are only recently RFCs, they have been in use since
mid to late 90s, a long story there...

If you could, please forward my comment and yours to the list as I think
the PKI group should know that a PKI infrastructure of sorts does exist
commercially for EDIINT collaboration protocols. (The mailserver must be
set so that observers are not allowed to post.)


-----Original Message-----
From: Arshad Noor [mailto:arshad.noor@strongauth.com] 
Sent: Thursday, December 15, 2005 11:33 PM
To: Dale Moberg
Subject: Re: [pki-tc] Re: Transaction PKI. Was:PKI-TC@PKI Workshop

Thank you for bringing this to my attention, Dale; I was
completely unaware of the use of S/MIME within EDI.

Not being too familiar with the EDI arena, and based on
some cursory reading of the EDIINT charter, I am curious:
if EDI can be sent as XML, and if security is desired at
the message level, why not just use the security protocols
defined within XML instead of creating new "variants" of
SMTP, FTP and HTTP?

Arshad Noor
StrongAuth, Inc.

Dale Moberg wrote:
> Arshad Noor [mailto:arshad.noor@strongauth.com] writes:
> 
> While I would like to say that we're nowhere near making a decision
> about S/MIME vs. XML, I think the market has already made its position
> patently clear: S/MIME definitely works, but has had limited success
> in moving beyond e-mail.  Even when deployed in  the two most popular
> MUA's (Outlook & Thunderbird), it is hardly used by many corporations
> even in e-mail (I can only speak of my own experiences in the US and
> in one fairly large telecom company in a neighboring country of
yours).
> ===
> 
> S/MIME is utilized in the IETF EDIINT applicability statements AS1,
AS2
> and AS3 (SMTP/POP, HTTP/HTTPS, and FTP/FTPS transfer protocol
variants).
> Many large communities (with 100s to > 10,000 participants) daily send
> in the aggregate millions of messages, with estimated annual
> transactional values estimated in the trillions of dollars. 
> 
> 

--- End Message ---