Subject: Re: [Sip] Asserted-Identity: A P- Header?

From: Rohan Mahy <[email-masked]>
Date: Sun, 19 May 2002 08:21:15 -0700

Hi,

I believe a P- header is consistent with the applicability
scope built into the draft.

I also feel that the cryptographic identity draft should use
the Asserted-Identity header (without the P- ).

thanks,
-rohan

---- Original message ----
>Date: Fri, 17 May 2002 17:03:25 -0500
>From: "Peterson, Jon" <[email-masked]>  
>Subject: [Sip] Asserted-Identity: A P- Header?  
>To: "[email-masked]'" <[email-masked]>
>
>
>There has been some substantial discussion in this working
group about the
>naming of the new header for the short-term network asserted
identity work.
>Although it took us some time to arrive on an agreeable name,
I'd like to
>suggest a slight modification to 'Asserted-Identity' - namely
that it become
>a P- header.
>
>P- headers are defined in the 'sipchange' draft that
discusses how
>extensions to SIP should be created. The P- is short for
'preliminary',
>'private', or 'proprietary' - and in fact, I think the
Asserted-Identity
>header for the short-term work is in fact compatible with all
three of those
>adjectives. More substantially, there are also specific
criteria for P-
>headers provided in the sipchange draft (in section 6.1) and
I believe
>Asserted-Identity is a good match for nearly all of those
criteria.
>
>sipchange says that P- headers may be appropriate when
extensions "are
>private or proprietary in nature, because a characteristic
motivating them
>is usage that is known not to fit the Internet architecture
for SIP." As an
>extension, short-term asserted identity does not define new
methods,
>responses codes, or option tags (criterion 2). The header is
purely
>informational in nature (criterion 4). Asserted-Identity also
bears a
>significant applicability statement (criterion 7). The
current draft also
>meets the constraints identified by criteria 2 and 3. I'm
sure we could get
>Expert Review as specified in criterion 1, and that the
document could be
>passed as described by criterion 6. 
>
>What do we gain by making Asserted-Identity a P- header?
Really only
>political leeway; this doesn't entail any changes to how the
header works.
>But the underlying Trust Domain model of the short-term
identity work is not
>very compatible with the Internet model, and this may very
well cause us
>some consternation moving forward this document (some
discomfiture along
>these lines was previously expressed over sip-privacy-04). By
making this
>header a P- header we can deflect this sort of criticism by
identifying this
>as work that is known to be specific to private networks that
do not adhere
>to the Internet model as such. sipchange introduced this concept
>specifically so that we could get this sort of header passed.
If we aren't
>using the P- header for this, I'm not sure what we'd use it for.
>
>One thing that I know we lose by making Asserted-Identity a
P- header is
>that the long-term identity story would no longer use the
same header name
>as the short-term identity work. However, since the interface
between
>long-term, certificate-based identity and short-term,
trust-based identity
>will be defined as a gatewaying process, we really don't
incur any cost from
>using different headers. Personally, I still feel there is
something to be
>gained by using 'From' as the header in the long-term story
(specifically,
>this jibes in certain ways with existing S/MIME behavior in
rfc3261). So I
>suppose I don't find this loss to be troubling.
>
>Thoughts?
>
>Jon Peterson
>NeuStar, Inc.
>
>_______________________________________________
>Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
>This list is for NEW development of the core SIP Protocol
>Use [email-masked] for questions on current sip
>Use [email-masked] for new developments on the application
of sip

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: [email-masked]
Date: Sun, 19 May 2002 19:27:41 +0300

> the Asserted-Identity header (without the P- ).

i don't see the point of having two headers for the same purpose, one
with P and one without just in order to meet some 3gpp deadline.

-- juha

---

From: "Cullen Jennings" <[email-masked]>
Date: Sun, 19 May 2002 19:44:02 -0700

I don't think the P-Header issue has much to do with 3GPP.

The non cryptographic (AKA short term) Asserted-Identity work has a limited
scope of applicability - It is not usable in the circumstances we might call
the general internet. The way the requirements draft limits where it can be
used, and the other agreements that it have to be in place for it to work,
is what makes it seem like it lines up with the intent of a P-Header.

The cryptographic solution (AKA long term) stuff does not have these
limitations and thus would not require a P-Header.

It's not clear to me yet, but having it this way might turn out to be very
advantageous when building nodes that understand both the crypto and non
crypto solutions and need to pass information from one type of domain to
another.

Cullen

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> [email-masked]
> Sent: Sunday, May 19, 2002 9:28 AM
> To: Rohan Mahy
> Cc: Peterson, Jon; [email-masked]
> Subject: Re: [Sip] Asserted-Identity: A P- Header?
>
>
> Rohan Mahy writes:
>

---

From: "Dean Willis" <[email-masked]>
Date: Mon, 20 May 2002 10:31:27 -0500

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Rohan Mahy
> Sent: Sunday, May 19, 2002 10:21 AM
> To: Peterson, Jon; Peterson, Jon
> Cc: [email-masked]; [email-masked]

I tend to disagree. It would appear that privacy requirements indicate
that removal of the P-Hint header would be required by a proxy in the
domain of trust before forwarding something out. This probably indicates
a requirement for a Proxy-Require so that UA's "know" that this
protection is provided by the proxy network. We can't do Proxy-Requires
for a P-header as far as I know.

--
Dean