Subject: AW: [Ecrit] requirements

From: Tschofenig Hannes <[email-masked]>
Date: Wed, 23 Mar 2005 20:50:51 +0100

hi henning, 

> I'm afraid that we're using the terms authentication, 
> authorization and 
> lcoation verification far too loosely. 

certainly true. 

> They encompass many different 
> questions, such as, for identity:
> 
> - Did the IP address (in the UDP-based SIP request) actually 
> place this 
> request, and, if not, which one did?
> 
> - Did the SIP URI claimed in the From header actually place the call?
> 
> - What is the legal name and address of the person using that SIP 
> address (so that I can send a cop to that residence to arrest 
> the prank 
> caller)?
> 
> - Did the domain in the SIP From header authorize the caller 
> to use that 
> user name?
> 
> Similarly, location verification can mean several things, all useful, 
> but increasingly hard:
> 
> - Does this address or geo coordinate exist in real life or is a 
> probable or possible calling location?
> 
> - Who provided this particular location information? (Which 
> does not, by 
> the way, imply that the information was provided for this particular 
> call. I could have gotten this information from a friend or another 
> location that I'm logged in.)
.. or eavesdropped another protocol exchange or reused from a previous
network access authentication session. 

yes. binding the different context together is quite difficult. we noticed
this in other places already. 

> 
> - Did the call originate from that particular geo or civic 
> address and 
> who says so and how do they know?
> 
> This will all be in more detail in the next iteration of the 
> requirements draft. I'm sure there are more such questions 
> and it might 
> be more helpful to state, say, authentication or verification 
> requirements as such questions.

i like this level of detail. 

ciao
hannes

> 
> 
> Stastny Richard wrote:
> >>Are you authorized to place a 911 call with your IP phone 
> when you're in
> >>the US?
> > 
> > 
> > This is the wrong question.
> > 
> > You MUST be able to provide an emergency call in any case, 
> or you will get
> > sued the first time something happens, as Brian always said:
> > 
> > 
> https://mail.oefeg.at/exchweb/bin/redir.asp?URL=http://news.co
m.com/Texas%2Bsues%2BVonage%2Bover%2B911%2Bproblem/2100-7352_3-5630118.html?
tag=nefd.top
> 
> Authorizazion, authentication. identification, etc is only a nice to have
> 
> Richard
> 
> 

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit