Subject: [stir] STIR Virtual Interim in October 2015

From: Russ Housley <[email-masked]>
Date: Tue, 15 Sep 2015 15:01:01 -0400

Robert and I would like to schedule a virtual interim meeting in October 2015.  We have looked at our calendars to come up with a list of possible times for an online meeting.  Please use this doodle poll to tell us which times work for you.

	http://doodle.com/poll/9rmvk4ztd27k6ip7

I think the most important topic for the virtual interim is progress on RFC4474bis, especially the scope of the signature.  At the Prague meeting, some people felt the scope of the signature has become too complicated. However, if the signature only covers the telephone number in PAI, then a cut-and-paste attack is possible.  The signature needed to cover some other parts of the header to prevent such an attack.  Again, at the Prague meeting, some people spoke for an extension mechanism so that future standards-track RFCs could include other things in the signature.  Of course, this add to the complexity.  We need to figure out an acceptable way forward.

If we can nail down RFC4474bis, then it should be much easier to figure out what credentials are needed.  If time permits, we can begin that discussion.  If time does not allow, then we can have that discussion in Yokohama.

Russ

---

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 15 Sep 2015 20:05:24 +0000

I did issue a new version of rfc4474bis yesterday which removes the Identity-Reliance header entirely in favor of an extension mechanism and cleans up related elements. I do agree we want to get the signature down to the bare number of fields necessary to protect the calling identity, provide basic reference integrity (i.e. is this signature for this INVITE?) and prevent cut-and-paste attacks. I added some text to clarify how the current scope of protection satisfies those goals, and in particular the threat model articulated in RFC7375. 

Jon Peterson
Neustar, Inc.

> On Sep 15, 2015, at 12:01 PM, Russ Housley <[email-masked]> wrote:
> 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: Russ Housley <[email-masked]>
Date: Wed, 16 Sep 2015 09:58:35 -0400

It is clear that many people cannot make an online session on Oct 6th or 7th, so I have removed those from the doodle poll.

We are planning for a 90 minute session.

Russ

---

From: Russ Housley <[email-masked]>
Date: Fri, 18 Sep 2015 15:23:06 -0400

We will hold the STIR virtual interim on Friday, 9 October 2015.  With 17 participants responding, 14 can join (either yes or if-need-be) at 10:00 AM Eastern or 1:00 PM Eastern.  So, I have eliminated all of the other choices from the poll.  We are hoping that a few more people will respond to the poll to help us pick between these two remaining choices.

Russ

---

From: Russ Housley <[email-masked]>
Date: Wed, 23 Sep 2015 10:45:02 -0400

The STIR Virtual Interim will take place at 10:00AM Eastern on 9 October 2015.  Please plan on 90 minutes.  Expect an announcement for the Secretariat soon.

Russ