Subject: [stir] Certificate Policy Documents

From: Eric Burger <[email-masked]>
Date: Thu, 7 Apr 2016 17:23:22 -0300

Currently the certificate policy document, draft-ietf-stir-certificates-03, has two approaches.  One approach says there is an entity that has a certificate that vouches for the veracity of the asserted Passport identity. The other approach has the caller or vouching entity hold a certificate that includes within it the attestation for the number being asserted by Passport.

The first approach is done today and is deployable today and addresses the needs of at least the U.S. spoofing problem.

The second approach is not fleshed out and is not clear will work in at least the U.S.

Since we know a’priori that certificate policy will be mandated by regulators and not the IETF, I propose we separate what is likely to be numerous certificate policy schemes. My expectation is there will be at least three:

  o   A certificate that cryptographically identifies who is vouching for a particular number
  o   A certificate that vouches for a particular number or range of numbers
  o   A certificate that is issued by a singular CA that vouches for a particular identity

Let us not hold up the early deployment of STIR, more especially since the first mechanism is already fully documented and requires no new protocol machinery (good work Jon!). Instead, let us publish STIR and today’s certificate policy mechanism today. Our work is not done! With actual experience, instead of theoretical hypothesis of what will and will not work, we can figure out how to make the second model work. We publish that when we have it. I would stay far, far away from the third certificate model, as I see that as a vehicle for repressive regimes that have high personal attestation needs.

---

From: Richard Shockey <[email-masked]>
Date: Thu, 07 Apr 2016 21:24:43 -0400

+1 only that the only deployable model,for now, is a transactional between authenticated service providers (AS) with access to E.164. I am Comcast and I assert that I vouch for this INVITE to you ATT or BT FT etc. This is actually how things work today. There are endless national rules on Voice interconnection that I will not go into. 

I can’t go to Congress or the EU and change those rules so I have to live with what exists for now or at least what exists in the US for the next 9 months or so. Oh and BTW rule changes at the FCC are at least a 5 year process. Believe me I know.  We are discussing National Geographic Number Portability right now and that process will take years. If you think the FCC or OFCOM, CRTC etc is going listen to Jon’s rants on per Number call validation I want to know what you are smoking and why are you not sharing. 

I’m really getting sick of the politically correct model of how some in the IETF wants things to work. Or how certain document authors are trying to create a business model based on a proposed RFC. 

Just tell how this works in the INVITE please and we’ll take care of the rest thank you very much. 

— 
Richard Shockey
Shockey Consulting LLC
Chairman of the Board SIP Forum
www.shockey.us
www.sipforum.org
richard<at>shockey.us
Skype-Linkedin-Facebook rshockey101
PSTN +1 703-593-2683

On 4/7/16, 4:23 PM, "stir on behalf of Eric Burger" <[email-masked] on behalf of [email-masked]> wrote:

>_______________________________________________
>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir

---

From: Richard Shockey <[email-masked]>
Date: Thu, 07 Apr 2016 21:35:54 -0400

Oh did I forget to mention that the validation authority is useless unless it relults can be transmitted to the UA in the last INVITE? 

And if you all think the industry is going to allow the IETF to define how that is done .. After the way we have been treated so far .. MODERN etc. Its not going to happen boys and girls. 

— 
Richard Shockey
Shockey Consulting LLC