Subject: [stir] I-D Action: draft-ietf-stir-rfc4474bis-01.txt

From: [email-masked]
Date: Fri, 04 Jul 2014 11:02:13 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Telephone Identity Revisited Working Group of the IETF.

        Title           : Authenticated Identity Management in the Session Initiation Protocol (SIP)
        Authors         : Jon Peterson
                          Cullen Jennings
                          Eric Rescorla
	Filename        : draft-ietf-stir-rfc4474bis-01.txt
	Pages           : 33
	Date            : 2014-07-04

Abstract:
   The baseline security mechanisms in the Session Initiation Protocol
   (SIP) are inadequate for cryptographically assuring the identity of
   the end users that originate SIP requests, especially in an
   interdomain context.  This document defines a mechanism for securely
   identifying originators of SIP requests.  It does so by defining new
   SIP header fields for conveying a signature used for validating the
   identity, and for conveying a reference to the credentials of the
   signer.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rfc4474bis-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 04 Jul 2014 16:28:12 -0400

Just a couple of comments on the new version:

You revised to allow *leading* "*" or "#". But AFAIK these can also be 
embedded. Is there sufficient agreement on the use of service number 
formats to agree where "*" and "#" might be used in them?

I'm inclined to think that if the number can't be canonicalized as an 
E164, then it can be canonicalized how ever the entity doing so sees fit.

Also, what if the From can recognized as, and signed as, an E164 number, 
but the To-URI cannot - maybe it is an email-style sip URI. In that 
case, shouldn't the full URI be used as-is in the signature?

	Thanks,
	Paul