CECID Hermes Celebrates its 15th Anniversary with Launch of Version 2.1
Thomas Lee
Hong Kong, China - 15 February 2017 - Center for E-Commerce Infrastructure Development (CECID), University of Hong Kong is pleased to announce the new version 2.1 of our open-source Hermes Business Messaging Gateway (also known as Hermes 2+). Thanks to the project funding from the Hong Kong Government’s Innovation and Technology Commission, Hermes is available as free and open-source to users and developers for implementing business-to-business (B2B) or Electronic Data Interchange (EDI) applications.
Hermes is a proven and extensible solution for organizations to exchange business transaction data over standardized, reliable, and secure protocols. Since its versions 1.0 and 2.0 were released in 2002 and 2007 respectively, Hermes has been adopted by organizations all over the world to implement large-scale EDI applications over the Internet. The Hong Kong Government has extensively used Hermes to implement various business-to-government electronic document submission gateways. For example, the Hong Kong Office of Government CIO has adopted Hermes as the messaging engine for the Government Electronic Trading Services (GETS) since 2007. The GETS gateway has been handling over 18 million trade-related documents (e.g., Import and Export Declaration) from businesses each year.
Like its predecessors, this updated version supports both ebXML Message Service (ebMS) 2.0 and Applicability Statement 2 (AS2). (The development of the ebMS 3.0 / AS4 plugin is in progress.) Hermes 2+ supports Java 8 and has upgraded its dependent third-party libraries to their latest versions. New to version 2.1, Hermes 2+ officially supports running on Docker containers. With Docker, you can bring Hermes up and running with just two Docker commands. Now, you can deploy Hermes on-premises as well as on any clouds consistently and painlessly. Added to the existing SOAP API, a new RESTful API is provided for ebMS invocation to simplify application integration. (The RESTful API for AS2 is under development and will be available soon.)
We have published a new documentation website for Hermes 2+ at http://hermes.cecid.org, where its user’s guide and developer’s guide are available. The source code of Hermes 2+ is published on GitHub at https://github.com/cecid/hermes and the Docker images are shared on Docker Hub at https://hub.docker.com/u/cecid.
We regularly visit the Hermes community forum on Google Groups at https://groups.google.com/group/cecid-hermes2 to answer usage questions, review feature requests, and announce new releases. For more information, please contact us at her...@cecid.org.
About CECID (www.cecid.org)
Established in January 2002, Center for E-Commerce Infrastructure Development (CECID) at the University of Hong Kong conducts e-commerce research and development with the vision of helping organizations increase their competitiveness in the global economy. CECID develops e-commerce enabling technologies, participates in important international e-commerce initiatives, as well as supports e-commerce standardization for Hong Kong and the Asia Pacific Region. With projects primarily funded by the Hong Kong Government's Innovation and Technology Commission, CECID also takes on the mission to transfer knowledge and technology to the community. Besides organizing forums and seminars, the Center licenses its R&D results through the University of Hong Kong to IT industry. Its acclaimed e-commerce technology, Hermes, has penetrated over 80 economies and won the Best Infrastructure and Communication Application of the Linux Business Award 2005 as well as Certificate of Merit of the Asia-Pacific ICT Awards 2004 and Hong Kong Computer Society IT Excellence Award 2004.
PR Contacts for Press and Analysts
Dr. Thomas Lee (thom...@cecid.org)
Project Manager
Center for E-Commerce Infrastructure Development (CECID)
Department of Computer Science
The University of Hong Kong
URL: http://www.cecid.org
sigbj
A question: I notice there are choice options between algorithms sha1 and possibly sha256 as to MIC and Signing in the AS2.plugin.
Will there be similar options for the ebms plugin or are the sha1 there to remain fixed like in Hermes2?
sigbj:
have followed this thread, and I would like to ask: Will the question of SHA-256 implementation also concern EBMS in the same way as AS2, i
.e. would it be worth while to ask jentrata about this?
Jean-François:
Nov 23, 2013
Other recipients:
I personally really don't know about EBMS as we're not currently using this.But SHA2 implementation seems to be realized in nearly all AS2
products, so implementation in H2O is "mandatory" for future use of this solution.
I personally really don't know about EBMS as we're not currently using this.
But SHA2 implementation seems to be realized in nearly all AS2 products, so implementation in H2O is "mandatory" for future use of this sol
ution.
sigbj:
This is about the answer I expected.
I use Hermes2-ebms in production and as payload signed xml-files are applied. So far I can stick with SHA-1 both for the xml-files and the
soap-envelope, since there is per date no mandatory claim for only SHA-256 in the production environment.
With the pkcs11-tool from the opensc-0.12.2 package I may easily choose SHA-256 for the signed payload part when the claim comes, but for t
he soap-envelope this will probably be too tricky for me, except I get help.
T.K. :
Nov 24
There are two issues here, given the way that H2O has implemented this in hk.hku.cecid.ebms.pkg.pki.ApacheXMLDSigner: 1. Supporting the new
http://www.google.com/url?q=http%3A%2F%2Fwww.w3.org%2FTR%2Fxmldsig-core1%2F&sa=D&sntz=1&usg=AFQjCNEgNCPFR5nA2_
There are two issues here, given the way that H2O has implemented this in hk.hku.cecid.ebms.pkg.pki.ApacheXMLDSigner:
1. Supporting the new http://www.w3.org/TR/xmldsig-core1/ for its namespaces and algorithm values, e.g. DIGEST_METHOD = "http://www.w3.org/
2001/04/xmlenc#sha256";
2. Make it backwards compatible to support both SHA-1 and SHA-2.
#2 will be trickier than #1, but definitely necessary.
There might even be 3., enforcing the values upon message or signal reception. I don't recall whether H2O does anything here................................
(excerpt from old posts)
