ediverse

Type to search across standards, messages, tools and glossary.

ediverse Explore the platform

Spotlight PEPPOL BIS Billing 3.0 The EU e-invoicing mandate is here — France Sept 2026, Belgium Jan 2026, Germany 2025.

— 01

Foundations

— 02

Standards

— 03

Flagship messages

— 04

Tools

OFTP2

Odette File Transfer Protocol 2.0. The modern IP-native OFTP version — TCP/TLS, signature and encryption, signed EERP. Standard RFC 5024.

Definition

OFTP2 is defined by RFC 5024 (October 2007). It is a full rework of OFTP 1.x designed to run over the internet, with a suite of strong security mechanisms:

  • Transport: TCP/IP, port 3305 (clear) or 6619 (TLS). TLS is strongly recommended.
  • Authentication: ODETTE-ID + password, plus mutual TLS authentication with X.509 certificates when TLS is used.
  • Session security: session signature (NDA), session encryption (OFTP2 CipherSuite), with algorithms defined by the RFC.
  • File-by-file encryption and signature: each file can be signed and/or encrypted independently of TLS, enabling proof archival.
  • Compression: integrated ZLIB, streamed.
  • EERP: signed End-to-End Response, which is the non-repudiable proof of receipt.
  • NERP: Negative End-to-End Response, signed negative acknowledgment that says why the receiver refused.
  • Restart on failure: restart-at-offset is still present, useful for large files (CAD, simulations).

Origin

OFTP2 emerges from a joint Odette / IETF effort between 2003 and 2007. RFC 5024 was published in October 2007. Odette's version 2.1 (practical extensions, e.g. file priority handling, sliding window) remains backward-compatible and widely implemented. OFTP2 is the reference transport in European automotive (Renault, Stellantis, Volkswagen Group, BMW, Daimler, Volvo, JLR) and is also gaining ground in aerospace and defence.

Example in context

A French Tier-1 sends its DESADV to Renault. Its OFTP2 station opens a mutual TLS session with Renault's server on port 6619, authenticates with its ODETTE-ID and X.509 certificate. The DESADV is ZLIB-compressed, S/MIME-signed, AES-encrypted, transmitted in the session. Renault's server returns a signed EERP containing the hash of the received file. The archive {`sent DESADV, signed EERP`} serves as legal proof.

  • OFTP — the 1.x predecessor version.
  • AS2 — the competing web alternative.
  • Non-repudiation — the property provided by signed EERP.
  • EDIFACT — the typical payload.

Last updated: May 14, 2026