Re: Message Service Specification Version 0.91, or PartyId revisited

["William J. Kammerer" <wkammerer@foresightcorp.com>]

David Burdett said "...if DUNS and EAN each allocate the number
123456789, but to different organizations, then there is confusion. You
therefore need to add a prefix such as DUNS or EAN to make it clear. But
just suppose [I] decided to use DUNS to represent David's unique
numbering scheme and I allocated 123456789, then there is still
confusion unless there is a registry we can use that stops me. We
**need** that registry, the id is only unique within a domain."

But I've been talking about prefixes, or qualifiers, or whatever, all
along.  That's why I brought up the business with OID URIs.
"urn:oid:1.3.60" uniquely says Dun & Bradstreet D-U-N-S.  Anybody in the
world who saw this would know that;  it's clear as mud!  And the OID can
be used today - the infrastructure for guaranteeing uniqueness already
exists.  Use "urn:oid:1.3.60" to qualify the code 081466849, and you
instantly know I'm talking about the Microsoft Corporation.
Alternatively, I could squash the qualifier together with the code to
form "urn:oid:1.3.60.081466849", which still unambiguously refers to
Microsoft.

It doesn't matter that there might be an EAN location code 081466849
(and there isn't, because they are always 13 digits long - but an EAN
GLN could be confused with a DUNS+4, which is also 13 digits) somewhere
in the world.  Saying "081466849" by itself to identify a Trading
Partner is meaningless - it has to be qualified by something that
unambiguously identifies the naming authority.  So I would say an ID,
say "5038996000006", is an EAN Location Code by qualifying it with
"urn:oid:1.3.88". Once I've qualified the ID with the authority, it's
somewhat obvious to anyone that I'm talking about FORESIGHT's
International Office in the UK, a huge industrial concern spewing out
copies of EDISIM with "Oxford" English spellings.  To make it more
obvious, you can verify the EAN GLN using the Global EAN Party
Information Register at http://www.gepir.org/.

David goes on to say "Usually organizations discover the ids of their
partners from those partners, or alternatively from registries of ids
such as Dun & Bradstreet or EAN. Generally these sources are trusted, so
you don't need to check the authority separately."

David is absolutely correct here.  As I said before, I more likely than
not already have a relationship with my trading partner, and probably
already have his D-U-N-S or EAN GLN in my translator TP database.  Even
if I didn't have the ID, I could find it from a trusted source like the
EAN or D&B.  But that's not the trust problem I was referring to.
Somewhere in the ebXML registry might be an entry for "Kroger Co."  I
might've found that entry by searching on "Kroger" or by searching on
its D-U-N-S - 006999528. Who's to say the information I find there is
*really* that of Kroger's?  Either ebXML has to do a perfect job of
ensuring that only authorized folks from Kroger submitted the TP
information, or I have to rely on a certificate found there that is
appropriately signed validating the expected D-U-N-S.  I don't know how
the ebXML RegRep or TA-Security folks are taking care of this.

David "[thinks] we need to separate registration of ids with an
authority, from the use of signatures to validate the [authenticity] of
a sender,"  and he's right here, too.

But registration of IDs with an authority has already been taken care
of.  So it's a non-problem, which I think I've been saying all along.
Every business in Christendom already has an ID -  probably many IDs -
one or more of a D-U-N-S, EAN GLN, SWIFT BIC, ABA Routing No., SCAC, and
on and on.  Don't worry about that - somebody important already knows
about you and has assigned a number to you.  And these numbers are
unique (though you may have more than one from a single authority to
identify divisions) within the authority's namespace.  This makes them
ideal for identifying Trading Partners, unlike the company name which
can be spelled ambiguously.

William J. Kammerer
FORESIGHT Corp.
4950 Blazer Memorial Pkwy.
Dublin, OH USA 43017-3305
+1 614 791-1600

Visit FORESIGHT Corp. at http://www.foresightcorp.com/
"Commerce for a New World"