Subject: [stir] DNS for STIR: draft-kaplan-stir-cider-00.txt

From: Hadriel Kaplan <[email-masked]>
Date: Mon, 15 Jul 2013 20:04:05 -0400

Howdy,
I've submitted a draft for how a DNS model could work for STIR, named "CIDER".
It still needs to ferment a bit, but it should provide the general flavor of a DNS solution.

Comments/questions/flames welcomed.

-hadriel

Begin forwarded message:

> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
> 	Title           : A proposal for Caller Identity in a DNS-based Entrusted Registry (CIDER)
> 	Author(s)       : Hadriel Kaplan
> 	Filename        : draft-kaplan-stir-cider-00.txt
> 	Pages           : 25
> 	Date            : 2013-07-15
> 
> Abstract:
>   This document describes a proposal for providing a database service
>   for authentication information for Caller-ID E.164 numbers,
>   nationally-specific number codes, and email-style names used in
>   communication requests (such as call setup, instant messages). The
>   model proposed uses a DNS service as a Registry for cryptographic
>   public-keys.  The database service solution is called CIDER.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-kaplan-stir-cider
> 
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-kaplan-stir-cider-00
> 
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: David Hancock <[email-masked]>
Date: Tue, 30 Jul 2013 14:53:33 +0000

Hi Hadriel,

I read your draft today, oh boy.

Generally looks good. I do have one question - how would it support the
case where the same caller-ID needs to be signed by multiple service
providers? For example, say an enterprise has multiple branch offices
across multiple service providers, and it wants calls initiated by all
branches to deliver the same 800 number. Would you distribute the private
key to all service providers (not particularly private)?

Thanks
David

On 7/15/13 6:04 PM, "Hadriel Kaplan" <[email-masked]> wrote:

>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir

---

From: Hadriel Kaplan <[email-masked]>
Date: Tue, 30 Jul 2013 15:29:59 -0400

> key to all service providers (not particularly private)?

Just to be clear, the *private* key isn't distributed in CIDER - the *public* key is uploaded to the DNS admin, but the private key remains private; and there can be multiple public keys for the same E.164 phone number.  Even in the case of an Enterprise PBX wanting to sign its own SIP messages, the PBX generates its own private/public key combo, keeps its private key to itself, and uploads the public key to the service provider who then uploads it into the DNS admin for the E.164 - in such a case there might be two or more public keys in the DNS for the same E.164 phone number, but under different "key index" names and thus separate TXT RR entries.

So in the case of an Enterprise with multiple branch offices connected to different service providers: one service provider is the "CIDER Assignee" for the 1-800 number - likely whichever one is the DID terminating carrier for it.  It's the assigned entity that can upload public keys into the DNS admin's entry space for that 1-800 number.  How the other entities upload their public keys through the Assignee for the same number into CIDER is basically an administrative decision and not constrained by the CIDER solution.  The branches could upload their public keys to the Enterprise HQ, which uploads it to the Assignee service provider, which uploads them to CIDER; or the other branch's service providers could upload public keys to the Enterprise, or to the Assignee service provider, etc.  It's not something we have to dictate, as the service provider can choose for itself (or the national regulators can, or whatever).  Even the physical process of uploading it isn't actually defined in CIDER draft - you could use email, fax, a web-portal, or whatever.  The CIDER draft does however recommend a new protocol be created for that purpose, called CAPP, and gives some requirements for such in Appendix B.

-hadriel