RFC 2935

Internet Open Trading Protocol (IOTP) HTTP Supplement

📅 published September 2000, from ietf

RFC 2935: Internet Open Trading Protocol (IOTP) HTTP Supplement 🎀

okay bestie, let's start with the header facts 💅 This is RFC 2935, a Standards Track doc from September 2000, from the Network Working Group. The authors are D. Eastlake (Motorola) and C. Smith (Royal Bank of Canada). The header doesn't say that it obsoletes or updates any other RFCs, so it doesn't claim to replace anything 🦋

Status of This Memo ✨

This doc specifies an Internet standards track protocol for the Internet community, and it's asking everyone for discussion and suggestions for improvements 🫶 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 💜

Copyright Notice 🌸

Abstract 🔥

So, IOTP messages are going to travel as Extensible Markup Language (XML) documents 📄 The whole point of mapping them to the transport layer is making sure those XML documents actually get delivered to all the parties 🚚

This doc describes that mapping for the Hyper Text Transport Protocol (HTTP), Versions 1.0 and 1.1 🌈

Table of Contents 📚

1.  Introduction................................................... 2
2.  HTTP Servers and Clients....................................... 2
3.  HTTP Net Locations............................................. 2
4.  Consumer Clients............................................... 2
4.1 Starting the IOTP Client and the Merchant IOTP Server.......... 3
4.2 Ongoing IOTP Messages.......................................... 3
4.3 Stopping an IOTP Transaction................................... 4
5.  Starting the Payment handler and Deliverer IOTP Servers........ 5
6.  Security Considerations........................................ 5
7.  IANA Considerations............................................ 5
8.  References..................................................... 6
9.  Authors' Addresses............................................. 7
10. Full Copyright Statement....................................... 9

1. Introduction 🦋

Okay so, IOTP [RFC2801] messages are going to be carried as XML [XML] documents 📄 The goal of mapping them to the transport layer is the same as before: make sure those XML documents get carried successfully between everyone involved ✨

This document describes that mapping for HTTP, Versions 1.0 and 1.1 [RFCs 1945, 2616] 💖

There may be future documents describing IOTP over email (SMTP), TCP, cable TV, or other transports 🧚

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. These are the official requirement words, so read them carefully 🍓

2. HTTP Servers and Clients 🌸

Here's how IOTP lines up with HTTP 💅

The merchant, payment handler, delivery handler, and customer care roles are all HTTP servers. Each one could have its own separate server, or they can be combined in any way 🎀

The consumer role is an HTTP client 🫶

Note: A Merchant might act in the role of a consumer, for example to deposit electronic cash. In that case, the Merchant, as an organization rather than as a role, would need to be supported by an HTTP client 👑

3. HTTP Net Locations 🔥

All the Net Locations inside the IOTP specification are URIs [RFC 2396]. If a secure connection is required or desired, the HTTP Server and Client MUST use a secure channel that both of them support 🔒 Examples of those channels are SSL version 3 or TLS [RFC 2246] 💜

4. Consumer Clients 🦋

In most environments, the consumer agent starts out as an HTML browser 🌈 The problem is that current browsers can't really act as the consumer's agent for an IOTP transaction 💀 So we need two things:

a method of starting and passing control to the IOTP client, and
a method of closing down the IOTP client cleanly and passing control back to the HTML browser once the IOTP Transaction has finished ✨

4.1 Starting the IOTP Client and the Merchant IOTP Server 🧚

At some point, the HTTP client at the consumer sends an HTTP request. The Merchant HTTP server reads that as an "IOTP Startup Request" 🛍️ This could happen when someone clicks a "pay" button, for example. The request stands in for some kind of request message, and the Merchant Server answers with the first IOTP Message, which comes as an XML document 📄

The MIME type for all IOTP messages is "APPLICATION/IOTP". Heads up though: "APPLICATION/X-IOTP" was used for experimentation and development, and it SHOULD also be recognized 🙈 The MIME type registration template for APPLICATION/IOTP is in Section 7 below. Since HTTP is binary clean, no content-transfer-encoding is required 🌸 (See [RFC 2376] for the application/xml type, which has some similar considerations.)

The HTML browser reads this HTTP response as a request to start the application tied to the MIME type "APPLICATION/IOTP", and to pass the content of the message over to that application 🚀

At this point, the IOTP client starts up and already has the first message 🎉

IOTP messages are short-lived, so the HTTP server SHOULD avoid having its responses cached 💅 In HTTP V1.0, the nocache pragma can be used. You can skip this on SSL/TLS secured connections that aren't cached, and on HTTP POST requests in HTTP v1.1, since v1.1 POST responses aren't cached anyway 🫶

4.2 Ongoing IOTP Messages 💌

Data from earlier IOTP Messages in a transaction MUST be retained by the IOTP Client, because it might (1) be copied to make up part of later IOTP messages, (2) get used in calculations to verify signatures in later IOTP messages, (3) need to be resent in some cases where a request timed out without a response, or (4) be used as input to the Customer Care role in later versions of IOTP, etc. 🧠 How the data gets copied depends on the IOTP Transaction. The data MUST be retained until the end of the transaction, whether it ends in success, failure, or cancelation, and for as long after that as any of the parties might want to look into it 🗂️

The IOTP messages contain Net Locations (e.g. the PayReqNetLocn). For HTTP, those will contain the URIs where the IOTP client MUST send IOTP messages 📮

Later IOTP messages (XML documents) are sent using the POST function of HTTP. The HTTP client MUST perform full HTTP POST requests 💪

The XML documents MUST be sent in a manner compatible with the external encodings that the XML [XML] specification allows 🌈

4.3 Stopping an IOTP Transaction 🛑

Read this one alongside [RFC 2801] 📖

An IOTP Transaction is complete when:

the IOTP client decides to fail the IOTP Transaction for some reason, either by canceling the transaction or because it found an error in an IOTP message it received, or
a "time out" happens or a connection fails. For example, a response to an IOTP Message hasn't come back after some user-defined period of time (including retransmissions) 🥲

An IOTP Client that processes an IOTP Transaction and:

completes successfully (meaning it hasn't received an Error Block with a HardError or a Cancel Block) MUST direct the browser to the Net Location specified in SuccessNetLocn in the Protocol Options Component, which means making the browser do an HTTP GET with that URL 🎉
does not complete successfully because it received some Error Trading Block MUST display the information in the Error Message, stop the transaction, and pass control to the browser so that it does a GET on the Error Net Location specified for the role the error came from 🚨
is cancelled because a Cancel Block was received MUST stop the IOTP Transaction and hand control to the browser so that it does a GET on the Cancel Net Location specified for the role the Cancel Block came from 🙅‍♀️
is in error because an IOTP Message doesn't conform to this specification MUST send an IOTP Message containing an Error Trading Block to the role the erroneous message came from, and to the ErrorLogNetLoc specified for that role. Then it stops the IOTP Transaction and hands control to the browser so that it does a GET from the Error Net Location specified for the role the bad message came from 🧯
has a "time out" MUST display a message describing the time out. It May give the user the option of canceling or retrying, and/or may automatically retry. On failure due to time out, treat it as an error above ⏰

Each implementation of an IOTP client may decide whether or not to terminate the IOTP Client application right after completing an IOTP Transaction, or whether to wait until it's closed down as a result of, for example, a user shutting down or the browser shutting down 🌙

5. Starting the Payment handler and Deliverer IOTP Servers 💸

Payment Handler and Deliverer IOTP Servers get started when they receive an IOTP Message that contains:

for a Payment handler, a Payment Request Block, and
for a Delivery Handler, a Delivery Request Block 📦

6. Security Considerations 🔐

Okay, this part is serious bestie 😭 Security of Internet Open Trade Protocol messages mainly depends on the signatures inside IOTP, as described in [RFC 2801] and [RFC 2802] 🛡️ You can get privacy protection for IOTP interactions by using a secure channel for IOTP messages, such as SSL/TLS [RFC 2246] 🔒

Note that the security of payment protocols transported by IOTP is the responsibility of those payment protocols, NOT of IOTP. IOTP can't rescue a payment protocol that isn't secure on its own 🚨

7. IANA Considerations 📝

This specification defines the APPLICATION/IOTP MIME type. The registration template goes like this [RFC 2048]:

   To: ietf-types@iana.org

   Subject: Registration of MIME media type APPLICATION/IOTP

   MIME media type name: APPLICATION

   MIME subtype name: IOTP

   Required parameters: (none)
   Optional parameters: charset - see RFC 2376

   Encoding considerations: Content is XML and may in some cases
   require quoted printable or base64 encoding.  However, no encoding
   is required for HTTP transport which is expected to be common.

   Security considerations: IOTP includes provisions for digital
   authentication but for confidentiality, other mechanisms such as
   TLS should be used.  See RFC 2801 and RFC 2802.

   Interoperability considerations: See RFC 2801.

   Published specification: See RFC 2801 and RFC 2802.

   Applications which use this media type:  Internet Open Trading
   Protocol applications.

   Additional information: (none)

   Person & email address to contact for further information:
      Name: Donald E. Eastlake 3rd
      Email: Donald.Eastlake@motorola.com

   Intended usage: COMMON

   Author/Change controller: IETF

💖 That's part 1 done! Part 2 picks up with the References, Authors' Addresses, and Full Copyright Statement 🧚

8. References ✨

okay bestie, this is where all the receipts live 🧾💅 every doc on this list is something the spec leans on, so here they are, all of them, no cap:

[RFC 1945] Berners-Lee, T., Fielding, R. and H. Frystyk, "Hypertext
           Transfer Protocol -- HTTP/1.0", RFC 1945, May 1996.

[RFC 2048] Freed, N., Klensin, J. and J. Postel, "Multipurpose
           Internet Mail Extensions (MIME) Part Four: Registration
           Procedure", RFC 2048, November 1996.

[RFC 2119] Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC 2246] Dierks, T. and C. Allen, "The TLS Protocol Version 1.0",
           RFC 2246, January 1999.

[RFC 2376] Whitehead, E. and M. Murata, "XML Media Types", RFC 2376,
           July 1998.

[RFC 2396] Berners-Lee, T., Rielding, R. and L. Masinter, "Uniform
           Resource Identifiers (URI): Generic Syntax", RFC 2396,
           August 1998.

[RFC 2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
           Masinter, L., Leach, P. and T. Berners-Lee, "Hypertext
           Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.

[RFC 2801] Burdett, D., "Internet Open Trading Protocol - IOTP
           Version 1.0", RFC 2801, April 2000.

[RFC 2802] Davidson, K. and Y. Kawatsura, "Digital Signatures for the
           v1.0 Internet Open Trading Protocol (IOTP)", RFC 2802,
           April 2000

[XML]      Bray, T., Paoli, J. and C. Sperberg-McQueen, "Extensible
           Markup Language (XML) 1.0" <http://www.w3.org/TR/REC-xml>,
           February 1998.

9. Authors' Addresses 💖

and now the people behind the spec 🫶 here's how to reach them:

Donald E. Eastlake 3rd
Motorola
140 Forest Avenue
Hudson, MA 01749 USA

Phone: +1 978-562-2827(h)
       +1 508-261-5434(w)
Fax:   +1 508-261-4447(w)
EMail: Donald.Eastlake@motorola.com


Chris J. Smith
Royal Bank of Canada
277 Front Street West
Toronto, Ontario M5V 3A4 CANADA

Phone: +1 416-348-6090
Fax:   +1 416-348-2210
EMail: chris.smith@royalbank.com

10. Full Copyright Statement 🎀

okay this part is the legal stuff, so I'm keeping it exactly as written 🙈 it's the rules for copying and sharing, and it matters 💜

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.

The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.

This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement 🌸

last bit, and it's a sweet one 🥹 funding for the RFC Editor function is currently provided by the Internet Society.

📦 where this page comes from

ietf: rfc2935 2000-09
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms