RE: Secrecy and authentication

[NAD+FR+EDI ENGINEERING:"PSE:DEC+GRAHAM HELLIAR:830-3173++REO2-F/D2'" <helliar@xxxxxxxxxxxxxxxxxxx>]

ISSUE - Dont duplicate what is already provided within the EDI standards.

Both X12 and EDIFACT have security solutions of their own. We should understand 
these solutions, and decide if any meet the requirements we need for EDI over 
the Internet. Where there are no instant solutions we should provide solutions 
which do not clash with the existing EDI standards.

To set the ball rolling, X12.58, X12 Security Structures defines security at two 
levels, where security covers authentification and encrytion. The levels are at 
the functional group and transaction set levels. If both levels were applied you 
would see a sequence of segments as...

	ISA-Interchange Header
	   GS-Functional group Header
	   S1S-Security Header Level 1
		ST-Transaction Set Header
		S2S-Security Header Level 2
		    ...transaction set segments
		S2E-Security Trailer Level 2
		SE-Transaction Set Trailer
		...other transaction sets (either secured or unsecured)
	    S1E-Security Trailer Level 1
	    GE-Functional Group Trailer
	    ...other functional groups (either secured or unsecured)
	IEA-Interchange trailer.

Either level 1 or level 2 security can be used or both together. Note that the
security does not kick in until after the GS so ALL addressing information is 
visible.

	The security offered is:
		o Authentification of content via the use of MAC codes.
		o Confidentiality of content through encryption.

Regards,

Graham