Subject: [stir] Link for the latest and greatest draft of the STIR charter?

From: Dan York <[email-masked]>
Date: Tue, 23 Jul 2013 15:43:29 +0000

I'm looking for a link to the latest draft of the STIR charter to pass along to some folks interested in this work.  Russ and Brian sent a revised draft to the list on July 11:

http://www.ietf.org/mail-archive/web/stir/current/msg00785.html

which generated a lengthy discussion whose offshoots are still ongoing.    Russ and Brian, will you be updating the draft charter before the meeting?

And is there a URL I can pass along that points to the latest draft charter for a BOF?  I.e. a static link as there is for a working group charter?  Or do BOF charters only live in email lists?   (My apologies for my ignorance on this but with the BOFs with which I have been involved in the past the charters have not been under such vigorous discussion and so the link to an email message *could* be sent around or posted on a web page as "the" charter for the upcoming BOF.)

Thanks,
Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked] <mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked] <mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/deploy360/

---

From: Mary Barnes <[email-masked]>
Date: Tue, 23 Jul 2013 10:53:37 -0500

In general, you should be able to find all the Bof information here:
http://tools.ietf.org/bof/trac/

Some of the bof charters are on that webpage and others just point to the
charter in the WG mailing list.  I would assume that the Bof chairs would
ensure that the link is pointing to the latest and greatest charter for the
Bof, but it doesn't look like it.  So, the link you have probably is the
latest, although clearly there have been lots of comments since that was
posted.

Mary.

On Tue, Jul 23, 2013 at 10:43 AM, Dan York <[email-masked]> wrote:

>   I'm looking for a link to the latest draft of the STIR charter to pass
> along to some folks interested in this work.  Russ and Brian sent a revised
> draft to the list on July 11:
>
>  which generated a lengthy discussion whose offshoots are still ongoing.
>    Russ and Brian, will you be updating the draft charter before the
> meeting?
>
>  And is there a URL I can pass along that points to the latest draft
> charter for a BOF?  I.e. a static link as there is for a working group
> charter?  Or do BOF charters only live in email lists?   (My apologies for
> my ignorance on this but with the BOFs with which I have been involved in
> the past the charters have not been under such vigorous discussion and so
> the link to an email message *could* be sent around or posted on a web page
> as "the" charter for the upcoming BOF.)
>
>  Thanks,
> Dan
>
>  --
> Dan York
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir
>
>

---

From: Russ Housley <[email-masked]>
Date: Tue, 23 Jul 2013 17:22:45 -0400

Here is the latest charter text.  I have asked Richard Barnes if he will put it in the datatracker -- a lowly BOF Chair does not have the privilege to take this action.

Since this was posted, Cullen had asked for the in-band and out-of-band mechanisms to be worked on in parallel (instead of in series).  There was clearly push back on this idea.  I expect this will be discussed further at the BOF.

Russ

= = = = = = = = =

Name: Secure Telephone Identity Revisited (stir)
Area: RAI

Chairs: TBD
Area Advisor: Richard Barnes

Mailing list: [email-masked]
To Subscribe: https://www.ietf.org/mailman/listinfo/stir

Over the last decade, a growing set of problems have resulted from the
lack of security mechanisms for attesting the origins of real-time
communications.  As with email, the claimed source identity of a SIP
request is not verified, and this permits unauthorized use of source
identities as part of deceptive and coercive activities, such as
robocalling (bulk unsolicited commercial communications), vishing
(voicemail hacking, and impersonating banks) and swatting (impersonating
callers to emergency services to stimulate unwarranted large scale law
enforcement deployments).  This working group will define a deployable
mechanism that verifies the authorization of the calling party to use
a particular telephone number.

SIP is one of the main VoIP technologies used by parties that want to
present an incorrect origin, in this context an origin telephone number.
Several previous efforts have tried to secure the origins of SIP
communications, including RFC 3325, RFC 4474, and the VIPR working group.
To date, however, true validation of the source of SIP calls has not seen
any appreciable deployment.  Several factors contributed to this lack of
success, including: failure of the problem to be seen as critical at the
time; lack of any technical means of producing a proof of authority over
telephone numbers; misalignment of the mechanisms proposed by RFC 4474
with the complex deployment environment that has emerged for SIP; lack of
end-to-end SIP session establishment; and inherent operational problems
with a transitive trust model.  To make deployment of this solution more
likely, consideration must be given to latency, real-time performance,
computational overhead, and administrative overhead for the legitimate
call source and all verifiers.

As its first work item, the working group will specify a SIP header-based
authorization mechanism to verify the originator of a SIP session is
authorized to use the claimed source telephone number, where the session
is established with SIP end to end.  This is called an in-band mechanism.
The mechanism will use a canonical telephone number representation
specified by the working group, including any mappings that might be
needed between the SIP header fields and the canonical telephone number
representation.  The working group will consider choices for protecting
identity information and credentials used, but will likely be based on a
digital signature mechanism that covers a set of information in the SIP
header fields, and verification will employ a credential that contains
the public key and is associated with the one or more telephone numbers.
In order to be authoritative, credentials used with this mechanism will
be derived from existing telephone number assignment and delegation
models.  That is, when a telephone number or range of telephone numbers
is delegated to an entity, relevant credentials will be generated (or
modified) to reflect such delegation.  The mechanism must allow a
telephone number holder to further delegate and revoke use of a 
telephone number without compromising the global delegation scheme.

The mechanism must allow parties
who are not delegated a telephone number, but are authorized by the
entity who is delegated the number, to place calls using the identity.

After completing the in-band mechanism, the working group will consider
session establishment where there are one or more non-SIP hops, most
likely using an out-of-band authorization mechanism.  However, the
in-band and the out-of-band mechanisms should share as much in common as
possible, especially the credentials.

Expansion of the authorization mechanism to identities using the
user@domain form deferred since the main focus of the working group is to
develop a solution for telephone numbers.

The working group will coordinate with the Security Area on credential
management.

The working group will coordinate with other working groups in the RAI
Area regarding signaling through existing deployments.

Authentication and authorization of identity is closely linked to
privacy, and these security features frequently come at the cost of
privacy.  This working group is not chartered to mandate the presence of
identity in SIP requests, and to the extent feasible it will find
privacy-friendly solutions that leak minimal information about calls to
third parties.

Input to working group discussions shall include:

  Private Extensions to the Session Initiation Protocol (SIP)
  for Asserted Identity within Trusted Networks
  RFC 3325

  Enhancements for Authenticated Identity Management in the
  Session Initiation Protocol (SIP)
  RFC 4474

  Secure Call Origin Identification
  http://tools.ietf.org/html/draft-cooper-iab-secure-origin-00

  Secure Origin Identification: Problem Statement, Requirements,
  and Roadmap
  http://tools.ietf.org/html/draft-peterson-secure-origin-ps-00

  Authenticated Identity Management in the Session Initiation
  Protocol (SIP)
  http://tools.ietf.org/html/draft-jennings-dispatch-rfc4474bis-00

The working group will deliver the following:

  - A problem statement detailing the deployment environment and
    situation that motivate work on secure telephone identity

  - A mechanism document describing the SIP end-to-end with telephone
     number-based identities 

  - A document describing the credentials required to support
    telephone number identity authentication

  - A fallback mechanism to allow out-of-band identity establishment
    during call setup

Milestones

Sep 2013   Submit problem statement for Informational
Nov 2013   Submit in-band mechanism for Proposed Standard
Feb 2014   Submit credential specification for Proposed Standard
Jun 2014   Submit fallback for Proposed Standard