Subject: RE: Question for IOTP Authentication

From: Yoshiaki KAWATSURA <[email-masked]>
Date: Tue, 30 Mar 1999 14:45:54 +0900 (JST)

David,
I agree with your suggestion.
But I also want to add the Merchant Authenticaton by Consumer 
prior to IOTP Purchase Transaction.

These are the same flow as follows,

Consumer             Merchant
   <-------------------
         TPO

   ------------------->
      Auth Req

   <------------------
      Auth Res

and Status Block is not sent to the Merchant.

After Consumer receives the Auth Response,
1. If prior to IOTP purchase transaction
Success: Consumer sends the message to the Success NetLocation.
Fail: Stop

2. If in the IOTP Purchase Transaction
Success: Continue the transaction
Fail: Stop.

Make sense?

This is minor change and I think there is no affect in the IOTP protocol.
Regards,
----
Yoshiaki Kawatsura : E-mail [email-masked]
 Business & Information Systems Development Devision, Hitachi,Ltd.
Voice: +81-44-549-1713(direct) Fax: +81-44-549-1721

 >>>>> Fri, 26 Mar 1999 18:20:48 -0000,
	 David Burdett <[email-masked]> said:

 >Yoshiaki
 >
 >The current version of IOTP does not support authentication of the Merchant
 >by the Consumer. Part of the reasoning behind this is that the Merchant will
 >include a signature in the offer which can be used for this purpose.
 >HOwever, as you say, the consumer might not want to give address information
 >until they have authenticated the Merchant.
 >
 >You could actually do this although section 8.1.13 does not specifically
 >state this. What would be requried is that, after the Consumer has received
 >the TPO, he authenticates the merchant with a separate Authentication
 >transaction and then if its  OK continues with the original transaction.
 >
 >Would this make sense? If you think it does then please post the idea to the
 >list. I don't know though if we want to include this in v1.0 although it
 >could easily go into v 2.0
 >
 >David
 >
 >> ----------
 >> From: 	Yoshiaki KAWATSURA[SMTP:[email-masked]]
 >> Sent: 	25 March 1999 22:46
 >> To: 	[email-masked]; [email-masked]; [email-masked]
 >> Cc: 	[email-masked]
 >> Subject: 	Question for IOTP Authentication
 >> 
 >> Don and David,
 >> I have a couple of question for IOTP Authentication.
 >> 
 >> Consumer wants to send private information such as home address to
 >> authenticated merchants only for Offer. In fact, SET is attempting to
 >> support simliar functionality. I believe that IOTP should support this.
 >> 
 >> IOTP version 1.0 cannot do this function in Offer Exchange, since the
 >> Offer Exchange is simplified. The idea would be that initially IOTP
 >> processes an Authentication, then a Web browser sends a private
 >> information for Offer, and finally IOTP does Purchase Transaction. In
 >> IOTP version 1.0, IOTP supports a Consumer Authentication by Merchant,
 >> however, IOTP does not support a Merchant Authentication by
 >> Consumer. Is this correct?
 >> 
 >> If this is correct, will IOTP version 2.0 support the Merchant
 >> Authentication by Consumer?
 >> 
 >> Regards,
 >> 
 >> --
 >> Yoshiaki Kawatsura
 >> Hitachi, Ltd.
 >> 
 >

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]