Clarification: Native Support for Drummond AS2 Profiles

[nivfteradata]

Hi @phax ,
We are using as2-lib (5.1.5) and as2-servlet (5.1.7) and are currently evaluating our compatibility against the Drummond Group AS2 Interoperability Features.

We would like to clarify if the core library supports the following features natively, or if they require custom external logic to meet the certification requirements:
Adv: Supports AES and SHA2 over SSL
Adv-AES: Supports AES and SHA2 over SSL
Adv-CTE: Chunked Transfer Encoding over SSL, inbound and outbound with AES/SHA2
Adv-FN: Filename Preservation of Payload over SSL with AES/SHA2
Adv-FN-MA: Filename Preservation for Multiple Payloads over SSL with AES/SHA2
Adv-MA: Supports Multiple Attachments (Payloads) over SSL with AES/SHA2
Adv-SHA2: Supports SHA2 with AES over SSL
BA: Basic Authentication required to establish AS2 connectivity in both directions
BA-AES: Basic Authentication with AES
BA-CTE: Basic Authentication with Chunked Transfer Encoding, inbound and outbound
BA-FN: Basic Authentication with Filename Preservation of Payload, inbound and outbound
BA-FN-MA: Basic Authentication with Filename Preservation for Multiple Payloads, inbound and outbound
BA-MA: Basic Authentication with Multiple Attachments (Payloads), inbound and outbound
BA-SHA2: Basic Authentication with SHA-2, inbound and outbound
SSL: Secure Sockets Layer (SSL), requires encrypted transmission
Non-SSL: Supported Transmission without SSL
AES: Advanced Encryption Standard
CEM: Certificate Exchange Messaging
CTE: Chunked Transfer Encoding, inbound and outbound
FN: Filename Preservation of Payload
FN-MA: Filename Preservation for Multiple Payloads
FN-MDN: Filename Preservation with MDN Error Reporting
MA: AS2 message supports Multiple Attachments (Payloads)
Reliability: AS2 messages and MDN delivery retried after network failure, retry or resend
Restart: AS2 message restarts transmission from point of failure for very large payloads
SHA-1: Secure Hash Algorithm 1, all participants are required to support SHA-1
SHA-2: Secure Hash Algorithm 2, optional

Thank you for your time and for maintaining this library!

Best regards,
Niv.

[phax]

Hi Niv,
here are my thoughts on this:

• Adv: Supports AES and SHA2 over SSL
  • phase2 does support AES for encryption
  • phase2 does support SHA2 for signing
  • phase2 can easily be operated behind a reverse proxy doing TLS/SSL
• Adv-AES: Supports AES and SHA2 over SSL
  • Looks identical to Adv
• Adv-CTE: Chunked Transfer Encoding over SSL, inbound and outbound with AES/SHA2
  • HTTP Chunked Transfer Encoding is supported over TLS with AES and SHA2 - but only inbound
  • Currently there is no easy way to enable outbound chunked encoding - but a new setting can be done quite easily. If you need it, just create an issue
• Adv-FN: Filename Preservation of Payload over SSL with AES/SHA2
  • The Filename is stored as part of the Content-Disposition header, so yes
• Adv-FN-MA: Filename Preservation for Multiple Payloads over SSL with AES/SHA2
  • Currently phase2 only supports a single payload
• Adv-MA: Supports Multiple Attachments (Payloads) over SSL with AES/SHA2
  • Currently phase2 only supports a single payload
• Adv-SHA2: Supports SHA2 with AES over SSL
  • Looks identical to Adv
  • Looks identical to Adv-AES
• BA: Basic Authentication required to establish AS2 connectivity in both directions
  • Basic-Auth is supported in both directions
• BA-AES: Basic Authentication with AES
  • Basic-Auth is supported in both directions
• BA-CTE: Basic Authentication with Chunked Transfer Encoding, inbound and outbound
  • Basic-Auth is supported in both directions, it is limited to the non-existence of chunked transfer encoding outbound
• BA-FN: Basic Authentication with Filename Preservation of Payload, inbound and outbound
  • Basic-Auth is supported in both directions
• BA-FN-MA: Basic Authentication with Filename Preservation for Multiple Payloads, inbound and outbound
  • Multiple Payloads are not supported
• BA-MA: Basic Authentication with Multiple Attachments (Payloads), inbound and outbound
  • Multiple Payloads are not supported
• BA-SHA2: Basic Authentication with SHA-2, inbound and outbound
  • Basic-Auth is supported in both directions
• SSL: Secure Sockets Layer (SSL), requires encrypted transmission
  • phase2 can easily operated behind a reverse proxy doing TLS/SSL
• Non-SSL: Supported Transmission without SSL
  • phase2 can easily be operated without SSL/TLS
• AES: Advanced Encryption Standard
  • phase2 supports AES (AES-128, -192 and -256 with CBC and GCM padding)
• CEM: Certificate Exchange Messaging
  *
• CTE: Chunked Transfer Encoding, inbound and outbound
  • Chunked Transfer Encoding is only supported inbound - see above
• FN: Filename Preservation of Payload
  • is supported
• FN-MA: Filename Preservation for Multiple Payloads
  • Multiple payloads are not supported
• FN-MDN: Filename Preservation with MDN Error Reporting.
  • Please specify what exactly is meant? Whether the filename of the source message is part of the MDN message somehow?
• MA: AS2 message supports Multiple Attachments (Payloads)
  • phase2 does not support multiple attachments
• Reliability: AS2 messages and MDN delivery retried after network failure, retry or resend
  • Retries are supported
• Restart: AS2 message restarts transmission from point of failure for very large payloads
  • That is currently not supported
• SHA-1: Secure Hash Algorithm 1, all participants are required to support SHA-1
  • This is supported
• SHA-2: Secure Hash Algorithm 2, optional
  • This is supported