Subject: RE: MIC calculation discrepancy?

From: "Phil Arcuri" <[email-masked]>
Date: Wed, 27 Aug 2003 11:05:47 -0500

Michael,

We have many customers who trade with Walmart, and might be
able to help.  Walmart's AS2 vendor chose not to support MD5,
and we have seen very peculiar behaviour when messages signed
with MD5 are sent to Walmart.  Are you using MD5 in your test 
messages?  If not, someone in our Support group who regularly
handles issues with Walmart/AS2 communications can work with
you (at least for a little while...).  Can you provide a
copy of the test message sent to Walmart?

- Phil

Phil Arcuri, D.Phil.
Director, Desktop Applications Development
bTrade, Inc.
2324 Gateway Drive
Irving, TX 75063
972-580-2916 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Michael Milner
Sent: Wednesday, August 27, 2003 10:24 AM
To: [email-masked]
Subject: MIC calculation discrepancy?

Hello, I am hoping someone can help me... we are
testing some in-house software to do AS2
communications, and we have had problems connecting to
Walmart. We can send signed and encrypted messages
just fine and we receive a proper MDN; however we are
not able to verify the Message Integrity Check
returned in Walmart's MDN. In particular if we sign,
encrypt, and send the same test message repeatedly we
get a different value for the MIC each time!

I am a bit confused as to how this could be, as RFC
3335 and the AS2 spec indicate that the MIC should be
calculated over the original EDI data and MIME header.
Moreover we have not had this issue connecting with
other servers. Is this a known issue with Wal-Mart's
EDI solution? Or am I doing something wrong?

Thank you!

Best regards,

Michael Milner

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

---

From: Michael Milner <[email-masked]>
Date: Wed, 27 Aug 2003 12:00:53 -0700 (PDT)

Thanks for your help.

I'm attaching wmrequest.bin which is the signed,
encrypted request to Walmart. I'm also attaching
testcase.bin which is the signed data that was
encrypted with Walmart's certificate.

The MIC returned is always different -- even though I
am encrypting the same data each time. (I suppose
Walmart is somehow calculating the MIC on the
encrypted data?!)

p.s. Am using SHA1.

Thanks.

Michael

POST / HTTP/1.0
Host: gem.wal-mart.com:5080
User-Agent: Test Agent
AS2-To: *****
AS2-From: *****
AS2-Version: 1.0
Date: Wed, 27 Aug 2003 14:25:04 GMT
Subject: TEST IGNORE TEST
Message-Id: x@y
Disposition-Notification-To: *****
Disposition-Notification-Options: signed-receipt-protocol=optional, pkcs7-signature; signed-receipt-micalg=optional, sha1
Content-Type: application/pkcs7-mime; smime-type=enveloped-data; name="smime.p7m"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7m"
Content-Length: 2512

MIME-Version: 1.0
Content-Type: multipart/signed;
 protocol="application/pkcs7-signature";  
	boundary="abcdeabcdeabcde"; micalg=sha1

--abcdeabcdeabcde
Content-Type: application/edi-x12
Content-Disposition: Attachment; filename=rfc1767.edi

TEST - IGNORE
--abcdeabcdeabcde
Content-Type: application/pkcs7-signature;  	name="smime.p7s"
Content-Disposition: attachment; filename="smime.p7s"
Content-Transfer-Encoding: base64

--abcdeabcdeabcde--