— May 16, 2026 · 9 min read

AS2 vs AS4 vs OFTP2: which to pick for a new partnership?

Three EDI transport protocols coexist in 2026: AS2 (RFC 4130, historical majority), AS4 (OASIS ebMS 3.0, adopted by the PEPPOL Network) and OFTP2 (RFC 5024, still dominant in automotive). The choice between them is no longer a technical detail but an ecosystem decision.

Three origins, three ecosystems

The three protocols share a common intent — securely transport EDI messages with non-repudiation receipts — but were born from different contexts.

AS2 was published by the IETF in July 2002 as RFC 4130 (updated 2005). Its goal: replace proprietary VANs with a direct HTTP transport using S/MIME — signing, encryption, signed MDN receipt. Massively adopted by Walmart in 2002-2003 for its suppliers (the famous September 2003 "AS2 deadline" mandate), AS2 became the de facto standard in North America for X12 flows.

AS4 was published by OASIS in 2013 inside the ebMS 3.0 profile. Its motivation is to go beyond AS2 on three key points: native WS-Security support (XML signing, asymmetric encryption), Reliable Messaging with application-level acknowledgment, and ServiceProfile flexibility (multi-payload, varied MEPs). The European Commission's e-SENS project (then CEF eDelivery) chose it as the standard protocol for cross-border EU exchanges; OpenPEPPOL adopted it in 2020 to replace its historical AS2.

OFTP2 (Odette File Transfer Protocol 2), published as RFC 5024 in 2007, evolves the original OFTP (1986) born in the European automotive industry to exchange bulky files (CAD/CAM, technical drawings) over X.25 then TCP/IP. OFTP2 adds TLS, signing, compression, and remains majority among European automakers — Volkswagen, BMW, Renault, Stellantis, Volvo — for EDIFACT logistics flows and technical file transfers.

Comparative security posture

On strict cryptographic grounds, the three protocols are now equivalent: all support TLS 1.2/1.3, AES-256, SHA-256 signatures (SHA-1 deprecated everywhere) and cryptographically signed non-repudiation receipts. The differences lie elsewhere.

• AS2 encrypts and signs at the S/MIME level (RFC 1847) over HTTP. The signed MDN is asynchronous or synchronous, returned by the recipient after reception. Strength: maturity, broad vendor support. Limits: no native Reliable Messaging (retry is implementation-handled), no native multi-payload support (one AS2 = one payload), and a fixed HTTP timeout (typically 30 minutes) that makes very large files problematic.
• AS4 rests on SOAP 1.2 with WS-Security 1.1, WSRM (Reliable Messaging) and MTOM/XOP for binary attachments. Strength: application-level Reliable Messaging (positive/negative receipt, retransmission), native multi-payload, eIDAS-compliant for qualified signing. Limits: implementation complexity (open-source libraries — Holodeck, Apache ebMS 3 — are scarcer than for AS2), and SOAP overhead that weighs on latency for small messages.
• OFTP2 is a binary protocol (not HTTP) over TCP/IP with its own security layer: mandatory TLS 1.2, separate payload encryption, session-level and file-level signing. Strength: efficient for large files (automotive CAD, multi-GB), native interrupt resume, no HTTP timeout. Limits: dedicated TCP port (typically 6619) which complicates firewalls and NAT, concentrated vendor ecosystem (Axway, T-Systems, OpenText, and a few specialised German solutions).

Operational constraints

Choosing a protocol is more than an RFC choice; it has strong operational implications.

• Partner onboarding: AS2 requires X.509 certificate exchange and bilateral URL configuration — typically 2-3 days when everything goes well. AS4 PEPPOL automates that step via SMP: the partner publishes its capabilities and endpoint in the PEPPOL registry, and the sender discovers them dynamically. OFTP2 has a bilateral onboarding similar to AS2 but also requires TCP configuration on the dedicated port.
• Volume and size: for messages <10 MB, AS2 and AS4 both fit. For very large files (>1 GB), OFTP2 remains preferable thanks to its native interrupt resume. PEPPOL AS4 has an indicative 100 MB cap per message, sufficient for invoices and orders but not for CAD drawings.
• Reliable Messaging: AS4 and OFTP2 have native retry/resume. AS2 delegates to the application (retry handled by the EDI integrator).
• Infrastructure cost: AS2 and AS4 run over HTTPS (port 443) — no specific firewall configuration. OFTP2 requires a dedicated TCP port opening and NAT handling on the ops side.

When context dictates the choice

In many cases, the partner or the regulation imposes the protocol:

• OpenPEPPOL Network: AS4 exclusive since 2020 (PEPPOL AS4 Profile published by OpenPEPPOL Authority, based on ebMS 3.0 AS4 Profile). Access points must pass the PEPPOL conformance tests.
• CEF eDelivery (European Commission for cross-border administrative flows — eHealth, eJustice, e-Procurement): AS4 conforming to the e-SENS AS4 profile.
• European automotive (VDA, ODETTE): OFTP2 remains majority among automakers and their Tier 1 suppliers. Volkswagen, BMW, Mercedes, Renault, Stellantis typically require OFTP2 for their direct suppliers, sometimes as an alternative to AS2.
• North American retail: AS2 remains the de facto standard. Walmart, Target, Kroger, Home Depot accept AS2 exclusively for EDI flows.
• US healthcare (HIPAA): AS2 is the most used protocol. AS4 progresses slowly.

The PEPPOL AS4 pivot and its consequences

The OpenPEPPOL pivot from AS2 to AS4, started in 2017 and finalised in February 2020, deserves particular attention. At the time, OpenPEPPOL justified the choice with three reasons: (1) alignment with CEF eDelivery to leverage the European open-source ecosystem (Holodeck, Domibus), (2) application-level Reliable Messaging that simplifies retry schemes for access points, (3) native multi-payload capability for future business services.

In 2026, the bet seems technically successful: PEPPOL-certified access points handle more than 200 million AS4 messages per month (cumulative OpenPEPPOL 2025 figure). The open-source ecosystem around Domibus (European Commission) and Holodeck B2B (NLnet) eases adoption.

Consequence for new projects: if PEPPOL is in the target channel, mastering AS4 is required. Implementations that relied on AS2 must add AS4 to their stack, or lean on a third-party access point (Pagero, Tradeshift, ediCom, Comarch, OpenText) that will expose a simple REST API over AS4.

Decision matrix for a new partnership

1. The partner imposes a protocol? → comply with their choice. This is the most frequent case in practice.
2. The target channel is PEPPOL? → AS4 (at least via a third-party access point).
3. European automotive industry? → OFTP2 remains preferred.
4. North American retail? → AS2.
5. EU administrative flow (health, justice, public procurement)? → AS4 under the CEF eDelivery profile.
6. No strong constraint? → AS2 remains relevant for ecosystem maturity and onboarding simplicity. AS4 if PEPPOL or EU cross-border is on the horizon.

Three protocols, three ecosystems

In 2026, AS2 remains the de facto standard of North American retail and healthcare, AS4 is establishing itself as the EU administrative and PEPPOL protocol, OFTP2 keeps a dominant position in European automotive. The choice between them is no longer a feature question — all three are secure and mature — but one of ecosystem, partner and mandate. To dig further, the AS2, AS4 and OFTP2 pages detail each protocol, and the Protocols overview page provides the broader landscape.