RFC 3504

Internet Open Trading Protocol (IOTP) Version 1, Errata

📅 published March 2003, from ietf

Internet Open Trading Protocol (IOTP) Version 1, Errata 💌

RFC number: 3504
Authors: D. Eastlake (Donald E. Eastlake 3rd), Motorola
Category: Informational
Date: March 2003
What it's about: Errata for the IOTP Version 1.0 RFCs, which are [RFC 2801], [RFC 2802] and [RFC 2803]. The title block doesn't list anything it obsoletes or updates, so I'm not inventing any.

Okay bestie, this is the RFC that says "oops, we messed up some stuff in the last one" 😭🫶

Status of This Memo ✨

This memo is for the Internet community to read as information. It is not an Internet standard of any kind. You can distribute it as much as you want. 🌈

Copyright Notice 💅

Abstract 🎀

Ever since Version 1.0 of the Internet Open Trading Protocol (IOTP) got its RFCs published, people have spotted some mistakes. This informational doc lists those mistakes and gives the fixes. 💖

Table of Contents 🦋

1. Introduction.................................................... 2
2. DTD Errata...................................................... 2
   2.1 PackagedContent Element..................................... 2
   2.2 The Element called Attribute................................ 3
3. Other Errata.................................................... 3
   3.1 Re: Combining Authentication Transactions with other
       Transactions................................................ 3
   3.2 Type attribute of Element called Attribute.................. 3
4. Security Considerations......................................... 4
5. References...................................................... 4
6. Acknowledgements................................................ 4
7. Author's Address................................................ 5
8. Full Copyright Statement........................................ 6

1. Introduction 🧚

So IOTP Version 1.0 is specified in [RFC 2801, 2802, 2803]. It's a payment-system-independent framework for Internet commerce, mainly for consumer-to-business transactions. Different parts of the business side, like fulfillment or payment handling, can be distributed or outsourced. And the consumer and business don't need any prior relationship. Iconic. 👑

BUT. Several errors have been spotted in the IOTP v1.0 spec, especially RFC 2801, which is the largest RFC ever issued 💀. This doc lists them along with their fixes.

2. DTD Errata 💅

2.1 PackagedContent Element

The attribute types got swapped. Oops 🙈

The wrong version:

!ELEMENT PackagedContent (#PCDATA) >
<!ATTLIST PackagedContent
         Name             CDATA     #IMPLIED
         Content          NMTOKEN   "PCDATA"
         Transform   (NONE|BASE64)  "NONE" >

The correct version:

<!ELEMENT PackagedContent (#PCDATA) >
<!ATTLIST PackagedContent
          Name           NMTOKEN     #IMPLIED
          Content        CDATA       "PCDATA"
          Transform   (NONE|BASE64)  "NONE" >

2.2 The Element called Attribute

This one's the element content specification syntax being wrong. Not it. 😤

The wrong version:

<!ELEMENT Attribute ( ANY ) >
<!ATTLIST Attribute
          type                NMTOKEN            #REQUIRED
          critical        ( true | false )       #REQUIRED
>

The correct version:

<!ELEMENT Attribute ANY >
<!ATTLIST Attribute
          type                NMTOKEN            #REQUIRED
          critical        ( true | false )       #REQUIRED
>

3. Other Errata 🔥

3.1 Re: Combining Authentication Transactions with other Transactions

Section 9.1.13, page 234: "restarted" should say "continued". Main character energy 💁‍♀️

The wrong version:

if the Authentication transaction is successful, then the original
IOTP Transaction is restarted

The correct version:

if the Authentication transaction is successful, then the original
IOTP Transaction is continued

3.2 Type attribute of Element called Attribute

Section 7.19.1, page 150: the list of signature types isn't complete. Lowkey a big miss 😬

The wrong version:

There must be one and only one Attribute Element that contains a
Type attribute with a value of IOTP Signature Type and with
content set to either: OfferResponse, PaymentResponse,
DeliveryResponse, AuthenticationRequest, AuthenticationResponse,
PingReq or PingResponse; depending on the type of the signature.

The correct version:

There must be one and only one Attribute Element that contains a
Type attribute with a value of IOTP Signature Type and with
content set to either: OfferResponse, PaymentResponse,
DeliveryResponse, AuthenticationRequest, AuthenticationResponse,
PingReq, PingResponse, AuthenticationStatus, InquiryRequest, or
InquiryResponse; depending on the type of the signature.

The same list of values also needs extending in Section 12.1, page 262. ✨

And in Section 6.1.2, page 82, add these:

AuthenticationStatus       any role

InquiryRequest             any role

InquiryResponse            any role

4. Security Considerations 🔐

The errata here aren't really security-related, ngl. BUT, and this is a big but 😳, if people implement things wrong because the errors were never fixed, security could still get compromised. Don't sleep on this one, bestie. 💀

5. References 📚

[RFC 2801] Burdett, D., "Internet Open Trading Protocol - IOTP
           Version 1.0", RFC 2801, April 2000.

[RFC 2802] Davidson, K. and Y. Kawatsura, "Digital Signatures for the
           v1.0 Internet Open Trading Protocol (IOTP)", RFC 2802,
           April 2000.

[RFC 2803] Maruyama, H., Tamura, K. and N. Uramoto, "Digest Values
           for DOM (DOMHASH)", RFC 2803, April 2000.

6. Acknowledgements 🫶

Huge thanks to these people for reporting these errata, or for responding to the reports:

Harald Barrera Dubois
Yoshiaki Kawatsura
Chun Ouyang

7. Author's Address 🌸

Donald E. Eastlake 3rd
Motorola
155 Beaver Street
Milford, MA 01757 USA

Phone:  +1-508-851-8280 (w)
        +1-508-634-2066 (h)
EMail:  Donald.Eastlake@motorola.com

8. Full Copyright Statement ⭐

Here's the legal bit, translated and kept complete. You can copy and share this document and translations of it. You can also make derivative works that comment on or explain it, or help people implement it, and publish and distribute those, in whole or in part, with no restriction at all. The only condition is that the copyright notice and this paragraph stay on every copy and derivative work. You can't modify this document itself in any way, like removing the copyright notice or the references to the Internet Society or other Internet organizations. The exception is when it's needed for developing Internet standards, in which case the Internet Standards process copyright procedures must be followed, or when you need to translate it into a language other than English. These permissions are perpetual, and the Internet Society and its successors or assigns won't revoke them.

This document and the information in it are provided "AS IS", and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED. That includes, but isn't limited to, any warranty that using the information won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose. 🙃

Acknowledgement 🌈

Funding for the RFC Editor function is currently provided by the Internet Society. Thank you, Internet Society 💜

📦 where this page comes from

ietf: rfc3504 2003-03
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms