Subject: multipart related vs. mixed

From: Gunther Schadow <[email-masked]>
Date: Wed, 24 Feb 1999 14:49:27 -0500 (EST)

Hi,

seems like this is an interesting issue. I like Carl's idea that we
would propose multipart/mixed for unrelated parts and
multipart/related for related :-) parts. I personally can't see a lot
of reason why I would bundle an MDN with an unrelated EDI message, but
I would not fight it either.

There was this issue whether or not you sign over the entire multipart
or if you sign each part separately. I believe that there is no
arbitrary choice, but rather clear decision rules that tell you to do
either one or the other.

1. If the parts are unrelated you SHOULD NOT sign over both. This is
because the receiver has no way to rip the unrelated messages apart
and keep them in his archive separately. The whole Idea about the
multipart/signed is that you can save it for the case of lawsuits.

Saving a couple of signature is not a good reason for signing over a
whole multipart/mixed od unrelated stuff.

2. If the parts are related there is one important reason why you MUST
sign MDN and response message together. The reason is the following
szenario:

  Alice sends a message to Bob requesting payment of $1500. 

     PAY*123@alice*PAY-ME*USD*1500*NOW*

  Bob explicitly agrees to this amount with a message that cites only
  the message identifier "123@alice" of Alice's message.

     ACK*987@bob*123@alice*I-AGREE-TO-PAY*

  But Bob pays only $15. 

  Now alice wants to sue Bob for not having payed the full amount
  due. Bob maintains that he has received a bill with $15 due and that
  he has payed the full amount. Of course he did not keep a record of
  this interchange. And he claims, if Alice now presents a bill of
  $1500, she must have fraudfully counterfit the bill to his
  acceptance message.

  Alice sues Bob, so Alice must proof her case, not Bob. But Alice can
  not produce enough evidence without Bob helping her; and Bob has no
  good reason to help Alice get more money (note that we could have
  turned the case around with Alice being the bad guy and Bob the
  poor one, the Judge does not know what really happened). Bob can
  maintain his counterfeit argument because the message identifier is
  not a secure link between both messages. If Bob would have been
  required to provided a secure hash value of Alice's message, Alice
  could have produced enough evidence.

END OF SCENARIO

You see, it is not an arbitrary choice whether or not you sign both
parts at once. If Bob would have been required to sign the MDN
together with his ACK message, the message digest in the MDN would
make the secure link. Now Alice could produce all necessary evidence
without reliance on Bob helping her producing the evidence. This is
quite important.

This is the reason why I would so much like to extend RFC 1767 to
include Content-ID, In-Reply-To, and Received-content-MIC
headers. This would give us a much simpler way to sign references to a
communication context. The point is that this secure transaction
tracking is a *security* feature not a feature that is up to the EDI
standard to implement or not. 

Our basic assumption is that EDI protocols do not have sufficient
security features so we are going to add them using MIME security. If
this is our intention, then we should do a complete and good job in
doing this. RFC1767, AS#1&2 do a good job in many things, but they
fail to implement secure references to communication context.

Remember that EDI protocols may also develop their unique security
features. X12 already did it and in HL7 we also think about doing
that. Those methods are independent from MIME. I was hoping that the
MIME stuff could be so powerfull and so leight weight that EDI
standard bodies would stay away from developing their own security
wrappers. But if we require too heavy things and too much nesting of
MIME elements we risk to turn off EDI standards organizations from
officially recommending IITF-EDIINT standards to their members.

regards
-Gunther

Gunther Schadow ----------------------------------- http://aurora.rg.iupui.edu
Regenstrief Institute for Health Care
1001 W 10th Street RG5, Indianapolis IN 46202, Phone: (317) 630 7960
[email-masked] ---------------------- #include <usual/disclaimer>