Date: 2018-10-11 and 2018-10-12

Time: 16:00-18:00 CEST

Type of meeting: Gotomeeting (https://www.gotomeet.me/peppoledelivery)

Participants and absents

Chair

Berg, Hans <hans.berg@tickstar.com> as eDelivery Community Leader

Elected members (with voting right)

Kristiansen, Olav Astad <Olav.AstadKristiansen@difi.no>

Collanus, Risto <risto.collanus@visma.com>

Helger, Philip <philip.helger@brz.gv.at>

Langøy, Bård <bard.langoy@pagero.com>

Agenda

1. Evaluate PEPPOL AS4 Profile v.2.0.0 comments

Background

The PEPPOL AS4 Profile was been sent out for member review on Aug 24 2018 as published on https://peppol.eu/member-review-of-the-peppol-as4-2-0-0-profile.

Specs: http://test-docs.peppol.eu/ticc/as4/specification

Review Period: Aug 24 - Sep 16

Comment Spreadsheet: https://docs.google.com/spreadsheets/d/1Dzg57i6-N-HhMnGrWwhoC7-k9hGGtd2kGmSxVjVR7yw/edit#gid=0

Discussion

Section 2: TICC CMB requests a ChangeLog from PEPPOL AS4 profile V1 to PEPPOL AS4 profile V2. And please remove the heading "Version 0.9.2". And please remove "Philip Helger" as contributor.

Section 4.2: Port numbers are not mentioned at all in CEF AS4 Profile. The limitation to port 443 should be removed. But avoid opening all ports for outgoing traffic, it was decided to limit the port to be 443 or in the range 44300 (incklusive) to 44399 (inclusive) so that a) outgoing ports can be limited and b) non-standard ports can be used.

Section 4.5 Party identification: Martin Forsberg has requested if "PMode.Initiator.Role and Responder. Role could be assigned more generic identifiers". It was decided that he should be contacted to elaborate on this.

Decisions

1. Version 0.9.2: remove it
2. 4.2. Configuration of Transport Level Security (TLS): Allow port 443 and port range 44300-44399.
3. 4.7. Use of PEPPOL PKI: Add the sentence "AS4 message level encryption MUST be used even though TLS is used."
4. Section 4.4 Feedback when receiver is not serviced: Explain what MSH means and that the meaning of "Payload" is the SBDH. Maybe find a better term for "custom validations" as it might be misinterpreted.
   
5. Section 4.4 Feedback when receiver is not serviced: Sentence number 2, change it to "If a MSH is able to validate the SBDH payload inside the AS4 User Message during the ebMS message processing, it is RECOMMENDED that the Access Point includes the check on the addressee."
6. Section 4.5 Party Identification: Ask Martin Forsberg to Elaborate on why he has requested if "PMode.Initiator.Role and Responder. Role could be assigned more generic identifiers".
7. Section 4.6 Service, action and role: Replace "PEPPOL BIS" with "business documents"
8. Section 4.10 Message packaging: Add sentence that "compress first, then encrypt"
9. Section 4.2 Configuration of Transport Level Security (TLS): Add sentence "TLS v1.2 MUST be supported. Older versions (SSL v2, SSL v3, TLS 1.0 and TLS 1.1) MUST NOT be used. Versions newer than TLS v1.2 might be used upon mutual agreement via the TLS handshake."

10. Feedback when receiver is not serviced

Proposal

-- EoD

Attachments