Subject: Minutes for Oslo TRADE WG Meeting

From: "Donald E. Eastlake 3rd" <[email-masked]>
Date: Tue, 27 Jul 1999 09:34:56 -0400

[Recorded by Donald Eastlake and corrected by Dave Burdett.  Please
send me any further corrections.  Slides will be made available and/or
sent out separately.  Donald]

*   Agenda Bashing 5 min
*   Implementation Reports
*   SMILE - Hitachi 15 min
*   Royal Bank of Canada, SIZ, ...
*   IOTP specifications
     *   IOTP version 1.0 - David Burdett 20 min
*   Digital Signatures for IOTP - Kent Davidson 5 min
    *   Supplements:
    *   Arch & API supplement - Hans Werner 5 min
    *   SET supplement - Hitahci 5 min
    *   SCCD supplement - Tom Arnold (Jason Eaton) 5 min
    *   HTTP supplement - Don Eastlake 5 min
    *   eCheck, ACH, ...
*   XML Messaging - David Burdett 30 min
*   Related topic reports
*   ECML - Donald Eastlake 5 min
*   What's Next for Internet Commerce - Ko Fujimura 15 min
*   OECD and Taxation on the Internet - David Burdett 10 min
*   Possible Charter revisions... 5 min

Minutes, taken by Donald Eastlake

There were no suggested changes to the agenda.

Yoshiaki Kawatsura of Hitachi presented an update on the status of the
SMILE project.  (see separate slides)

David Burdett mentioned that there was an IOTP 1.0 implementation by
the Royal Bank of Canada and that one was planned this year by SIZ.

Donald Eastlake and David Burdett mentioned that a company is
advertising that they are developing an IOTP toolkit in Java.  Info on
this was on the mailing list but will be reposted.

Dave Burdett presented the changes in the main IOTP v1.0 Protocol
document made in version 3 to produce version 4 of the protocol draft.
There was some discussion of the change which permitted optional
authentication at the beginning of most transactions.

Steve Crocker wanted to know why that was needed, whether
authentication would be manually or automatically initiated, and if
manual how the user could tell if they should do so.  Dave Burdett
indicated he primarily thought of it as user initiated.  Tony Lewis
gave some business to business examples where it could reasonably be
automatic.

Kent Davidson, author of the companion IOTP v1.0 Digital Signature
document could not be here.  Donald Eastlake indicated that the
digital signature document needed a little more polishing.  The main
protocol document and the digital signature document together are
needed to implement IOTP.

A straw poll was taken and indicated overwhelming support by those in
the room to advance these two IOTP v1.0 protocol specification
documents to the IESG for Informational RFC within a few weeks.  (The
IESG may choose to do an IETF wide last call on them.)  It was
suggested that the XML DTD in these two documents be tried with
various XML processing tools to be sure it will work with them,

The existing supplemental documents were discussed briefly.

The plan is to finalize the Architecture and API supplement shortly
after the main protocol documents are final and publish it as an
informational RFC.

Hitachi presented some slides on the SET supplement.  (see separate
slides)

Jason Easton spoke briefly on the SCCD supplement which Tom Arnold is
authoring.  Tom had planned to be present but got called away from the
IETF meeting due to business considerations.  SCCD (Secure Channel
Credit Debit) is a payment protocol intended to be used via an SSL or
similar secure channel and provide the equivalent of SSL secured plain
text forms for credit card charges.  This should be out as an I-D
within three weeks.

Donald Eastlake spoke briefly on the HTTP supplement.  He feels it
needs more input from the WG and requests comments.

Possible additional payment system supplements covering eCheck and ACH
we listed by Donald Eastlake.  Tony Lewis questioned the presence of
ACH as it normally requires prior written authorization but Steve
Crocker thought it should be there.

David Burdett gave a presentation on the messaging layer of IOTP.
Because commerce examples were used in the presentation there was also
some discussion of future additions to IOTP such as split payments.

There was strong consensus to split off the XML Messaging layer of
IOTP as a separate specification to be developed in the TRADE WG.
Comments on this will be sought on the mailing list.

Donald Eastlake gave a presentation on ECML (www.ecml.org).  David
Burdett said that it was largely complementary to IOTP and could be
used to detect the presence of an IOTP wallet.

Ko Fujimura of NTT gave a presentation on "What's Next in Internet
Commerce" which concentrated on Digital Right, such as sale of
memberships, use of coupons, sale of subscriptions, loyalty systems,
etc.  There appeared to be a consensus at the meeting to have a BoF
like meeting on this topic at the next IETF meeting assuming at a
minimum, that a draft requirements document can be prepared in time.
This needs discussion on the mailing list.

Finally, David Burdett gave an informational presentation on the OECD
and Taxation.  (See separate slides.)

Due to lack of time, charter revision was not discussed at the WG
meeting but will be persuaded on the list.

Donald E. Eastlake, 3rd
-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]

---

From: "Smith, Chris " <[email-masked]>
Date: Wed, 28 Jul 1999 10:12:34 -0400

Comments below - I've stripped out items I have no comments
on. Overall, it sounds like it was a good meeting.

------------------------------------------------------------
 Chris Smith                                +1.416.348.6090
 Royal Bank                       [email-masked]

> -----Original Message-----
> From: Donald E. Eastlake 3rd [mailto:[email-masked]]
> Sent: July 27, 1999 09:35 AM
> To: [email-masked]
> Subject: Minutes for Oslo TRADE WG Meeting

> SMILE project.  (see separate slides)
Are these coming to the list as well? Please? Perhaps a URL?

> the Royal Bank of Canada and that one was planned this year by SIZ.
Yes - for those that wish more detail, a starting point is the press
release at http://www.newse

> ... There was some discussion of the change which permitted optional
Sorry I couldn't be in on this - we used this feature in our 
implementation. Completely authenticating the client (using a payment-
specific auth mechanism) allowed us to report useful client-specific 
information if problems arose during the creation of the OfferResponse.

In the past, with payment-based authentication buried in the Payment 
exchange, we had to provide generic responses (such as "Failed.") when a 
more useful response was desired. It was not permissable to send 
potentially detailed error information to a customer who was not 
authenticated.

More particularly, it ensured that we only generated an OfferResponse 
when the customer actually had the payment instrument in question. From 
both a security and a usability point of view, this was a definite 
improvement.

> various XML processing tools to be sure it will work with them,
Would this be draft-04, or (based on a final few items
on the list) draft-05?

> Hitachi presented some slides on the SET supplement.  (see separate
Are these coming to the list as well? Please? Perhaps a URL?

> text forms for credit card charges.  This should be out as an I-D
Good! Congrats to Tom - this is long overdue. Looking forward
to reviewing this.

> Crocker thought it should be there.
We should soon see the outlines of legal acceptance of digital 
signatures. When that heppens, an online digital signature on the 
relevant request may become equivalent to the prior written 
authorization.

> This needs discussion on the mailing list.
Will Mr. Fujimara be starting this discussion? 

> and Taxation.  (See separate slides.)
Are these coming to the list as well? Please? Perhaps a URL?