Subject: [Sip] Privacy draft and Call trace requirements.

From: "Dean Willis" <[email-masked]>
Date: Fri, 29 Mar 2002 21:03:30 -0600

Here's the "other" usage of Privacy mechanisms as I understand it.

There exists a requirement that messages forwarded outside of a domain
of trust may be "traced" back to their original sender with the explicit
cooperation of the domain of trust. I can't say where this requirement
is documented, but it's certainly floating around there somewhere.

So let's say I'm on L3's network, and I place a call. L3 inserts an RPID
saying "[email-masked]" This call is delivered to my Badcom 3GPP
mobile, and we assume that we don't have explicit trust between L3 and
Badcom (hey, they MIGHT actually have it, I don't know.) So L3's proxy
encrypts the RPID using a key known to the L3 domain and kicks it on
over to Badcom. 

The fugitive executive who ran off with my pension fund that I'm
harassing (right) calls Badcom and complains. They pull their logs, find
the INVITE, and call their buds at L3 and request a check. Ahah, says
L3, that's Dean, he's a known troublemaker . . .

So far so good. But please check my logic, I think I'm getting nervous.

Assume the evil executive wants revenge . . . And remember, we don't
really trust Badcom.

So somebody in his employee makes a new call, replaying the L3-encrypted
RPID header from my call, and sends it to Col. BadAttitude in a nearby
third-world datahaven, along with a really unpleasant message payload.
So BadAttitude sends out the hit squad, they get my name from L3, and
Pow! -- no more working group chair.

In other words, where's the replay protection? It's not in the "trust",
because we've explicity described the trace requirements as ACROSS trust
boundaries.

Then again, maybe I just need to head out for supper -- it IS 2100 on
Friday night, after all . . .

--
Dean

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: William Marshall <[email-masked]>
Date: Fri, 29 Mar 2002 23:50:30 -0500 (EST)

Dean Willis wrote:
<long story, quoted below>

Replay protection is not a necessary part of the story.  The
employee of the fugitive executive simply reads the RPID header
to Col BadAttitude, or includes it in the text of a email
message, or whatever.  

The problem is that L3 gave away your identity information 
outside the trust boundary.  (At least I don't think you were
saying that Col BadAttitude worked for L3).  If L3 was going
to do that then there is no point in encrypting the RPID header
in the first place - if anyone walking in off the street with
an encrypted header gets it decrypted free, not even 
a "make by bottom line positive this quarter" fee.

If you've ever had experience with harassing phone calls (as I
have recently), dialing *57 does not tell you the caller, it
tells the police the identity of the caller.  You never find out.
In some sense, that is keeping the information within their
trust boundary.  As Henning pointed out, giving this information
out is, in some countries, actionable.

Bill Marshall
[email-masked]

-----original story-----
From: "Dean Willis" <[email-masked]>
To: <[email-masked]>
Date: Fri, 29 Mar 2002 21:03:30 -0600
Subject: [Sip] Privacy draft and Call trace requirements.

--
Dean