RE: EDI over http

["Carl Hage" <carl@xxxxxxxxx>]

> From:          "Shih,Chuck" <Chuck.Shih@xxxxxxxxxxx>

> I agree with your comments except that SSL can provide "non-repudiation"
> of origin.

To elaborate: SSL would prove that I initiated a connection at a 
certain time. The same login ID might be used to send several 
transactions back and forth. The connection-signature applies to 
only the initiation of the session or session sequenc, not the 
content of subsequent transactions.

In other words, an SSL signature log couldn't distinguish between me 
downloading the home page, and sending a purchase order.

Signatures sent at the end of a session which include the MIC MD5/SHA 
codes of the content would provide non-repudiation of the 
transactions, but SSL has no provisions for exchanging such 
signatures. (It's a simple extension, though, which would be good for 
AS#3-- SSL EDI. :-)
--------------------------------------------------------------------------
Carl Hage                                              C. Hage Associates
<mailto:carl@xxxxxxxxx> Voice/Fax: 1-408-244-8410      1180 Reed Ave #51
<http://www.chage.com/chage/>                          Sunnyvale, CA 94086