Encrypted Signature on Purchase Order

[Alister Wm Macintyre <macwheel99@xxxxxxxxxxx>]

I wonder if anyone else already doing this and can tell us what software, 
what cost, how reliable, what kinds of hassles, and perhaps point me at a 
url for the vendor of that software.

   * Currently we create PUR520 form from BPCS 405 CD on AS/400 V5R1 mixed 
mode, which has been modified.  Some users on Green Screen (including me), 
but growing volume, including the Purchasing Manager, now on PCs with 
Client Server/400.  The 400 is not directly connected to the Internet, but 
people on the Internet can get to it via a variety of methods that I will 
not say in a public forum for security reasons.
   * Our 400 security (level 30 and I doing audit to see if 40 practical) 
is setup so that ANYONE can do anything with any other co-worker spool 
content, if they know how, or have dangerous software on their attached PCs.
   * We print out the Purchase Orders.
   * The Purchasing Manager adds his signature.
   * Some go into fax machine.
   * Some scanned back in, go to a Word document file which gets encrypted.
   * It is attached to e-mail and sent to a foreign nation such as China.
   * They also have Word and are able to unencrypt and process our PO no 
problem.

We now have 10-15 a day like this and anticipate growth.
The user question was whether the 400 can automate some of the steps to 
reduce the hassle and provide assurances that no co-worker can mess with 
the signature or content of POs or launch any unauthorized POs.

My reply ... I could further modify so that YOUR POs go to a spool file 
with security that blocks other users access, there is stuff, from IBM and 
Foxtrot and other places, that can do ANYTHING but probably costs in excess 
of $ 1,000.00 multiples, but with narrow focus needs there is share ware 
that can be very powerful for $ 50.00 to $ 250.00 which I will look into 
and get back to Y'all.

So long as we only need narrow slices of the total stuff available from IBM 
and other places, then the shareware solutions probably make economic sense.

A possible path is to do a PO run just for a particular vendor, import the 
400 spool entry to a Word document, have the signature in an encrypted 
file, combine the two overlaid into a new encrypted file, which is then 
attached to e-mail.  I opined that with decent software, the user ought to 
be able to point and click at the spool file entry containing the POs, and 
at the e-mail it is to be attached to, with the software doing all the in 
between work.

Meanwhile, I hope someone has a written opinion from company attorney that 
the encryption we are using is not in violation of either US law or laws of 
the nations we doing business with.  My idea of retirement does not include 
spending any time in a Chinese prison cell, and I suggest that co-workers 
get assurances they not at such risk either.  Ideal use of company lawyer 
is to have some explicit questions in which part of the answer is that 
insofar as they say some encryption is legal, that this be reviewed at time 
of software upgrades and new legislation, so that anything they told us was 
legal, we are told as soon as it becomes no longer legal.

-
Al Macintyre  http://www.ryze.com/go/Al9Mac
Find BPCS Documentation Suppliers 
http://radio.weblogs.com/0107846/stories/2002/11/08/bpcsDocSources.html
BPCS/400 Computer Janitor at http://www.globalwiretechnologies.com/