Subject: Comments on draft-ietf-trade-iotp-v1.0-protocol-05.txt Part 2

From: Rudolf Hornig <[email-masked]>
Date: Thu, 2 Sep 1999 17:10:35 +0200

Again some additional comments on IOTP draft,

====================================================================
7.4 Trading Role Information Request Component

 <!ELEMENT TradingRoleInfoReq EMPTY>
 <!ATTLIST TradingRoleInfoReq
  ID                 ID      #REQUIRED
  TradingRoleList    NMTOKENS #REQUIRED >
                     ^^^^^^^^       
RH> Please correct the separate DTD file according to this
RH> definition.
====================================================================
7.6.1.1 Organisation IDs
RH> ComsumerOrgId is case sensitive however NonConsumerOrgId is
RH> case insensitive. This may cause confusion... and in this 
RH> case the third example should be:
RH> "Consumer:1000247ABH/newjerseybooks.com"
RH> starting with a capital letter...
====================================================================
7.6.2 Trading Role Element
RH> CancelNetLocn and ErrorNetLocn are IMPLIED according
RH> to the separate DTD file.
...
RH> ErrorLogNetLocn is mandatory for non consumer roles.
RH> Because there are no mechanisms defined for authenication
RH> on this channel and it is not secured, this type
RH> of logging may introduce security holes. (maybe the
RH> error component, the Consumer is sending, contains also
RH> some previous XML message, which contains sensitive information)
RH> Because all the error components should be sent back to the
RH> counterparty, I would suggest to let the server roles implement
RH> their own logging facility. Or I would make the ErrorLogNetLocn
RH> optional... Hints on this ???
====================================================================
RH> About DTD in general:
RH> PackagedContent, ContactInfo, PersonName, PostalAddress,
RH> ProtocolBrand, DeliveryData, ErrorLocation, Manifest,
RH> Digest, Attribute, OriginatorInfo, RecipientInfo,
RH> Parameter, IssuerAndSerialNumber and Locator Elements
RH> doesn't have ID attribute. As even for IOTP extensions
RH> it is a requirement to have ID attribute, it would be nice
RH> to have also on all element in IOTP DTD.
...
RH> The digital signature part is not consistent regarding
RH> capitalisation in attribuite naming.
====================================================================
7.9 Payment Component
RH> As it contains element references, I would suggest to change
RH> from StartAfter to StartAfterRefs just to be consistent
RH> in naming...
====================================================================
7.13.1 Delivery Data Element
...
 <!ATTLIST DeliveryData
  xml:lang           NMTOKEN #IMPLIED
  OkFrom             CDATA   #REQUIRED
  OkTo               CDATA   #REQUIRED
  DelivMethod        NMTOKEN #REQUIRED
  DelivToRef         NMTOKEN #REQUIRED
  DelivReqNetLocn    CDATA   #REQUIRED
  SecDelivReqNetLocn CDATA   #REQUIRED
  ContentSoftwareId  CDATA   #IMPLIED >
RH> DelivReqNetLocn and SecDelivReqNetLocn should be IMPLIED as
RH> only one of them is mandatory

Rudi
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rudolf Hornig ([email-masked]), Project Manager 
MeTechnology Ltd. Hungary - a Brokat Company
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-----------------------------------------------------------------------
Message addressed to: [email-masked]
Archive available at: http://www.elistx.com/archives/ietf-trade/
To (un)subscribe send a message with "subscribe" or "unsubscribe" in the
body to: [email-masked]