Subject: Re: [Iptel] Summary of +1-800 for tel URI discussion - context

From: [email-masked]
Date: Wed, 4 Dec 2002 10:15:57 EST

In a message dated 12/3/2002 8:12:31 AM Eastern Standard Time, 
[email-masked] writes:

> The context is meant to lead to a binary decision: Either you know 
> you're in the context or you know you're not. Each node knows its 
> context (a set of E.164-style numbers or a domain name) and simply 
> checks if the tel URI context matches one of them, exactly.
> 
> Again, based on the discussion, this is not useful or necessary for 800 
> numbers or service routing - this is effectively to prevent a PBX 
> extension that 'escaped' its context to be used somewhere out of scope 
> (a Harvard extension within Columbia, say, or the internal 
> Belgian/Japanese NNI service number that a few people mentioned).
> 

[MAP] Now I think we are getting to the point. The "context" only provides 
the result of a comparison - yes or no - as a form of security. It does not 
provide any routing information or anything else about the identity of the 
originator. As such, it can be anything that the receiver can use for a 
comparison to verify that a call got to the right place. Presuming that the 
routing works, a call should get to the correct place, so this comparision is 
just an extra check for the somewhat paranoid. (The real paranoid would use 
real security measures.)

Therefore, it would be nice if the "context" could be guaranteed to be 
globally unique, but not absolutely essential. Using E.164 number to do this 
is one way. There are many others that would be more applicable, since we're 
talking about cases (private numbering plans, etc) which do not have a E.164 
number. I would suggest the Private Enterprise Number, administered by IANA, 
which itself nicely fits under the ISO scheme for unique identifiers.

This use of a part of an E.164 number for the "context" has lead this 
discussion down all kinds of wrong path, including a lot of my comments.

Mike Pierce
Artel

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 04 Dec 2002 10:26:03 -0500

> globally unique, but not absolutely essential. Using E.164 number to do 
> this is one way. There are many others that would be more applicable, 
> since we're talking about cases (private numbering plans, etc) which do 
> not have a E.164 number. I would suggest the Private Enterprise Number, 
> administered by IANA, which itself nicely fits under the ISO scheme for 
> unique identifiers.

I'm trying to find discriminators that
(1) are globally unique
(2) do not require additional assignment authorities
(3) are readily known to members of the organization
(4) make it easy to detect mis-spellings

I agree that the Enterprise Number could be used, but it is not clear 
that it adds much value beyond the domain name and probably fails 
criteria (3) and (4). Unlike the EN, the domain name and global-number 
string more readily deal with enterprises that have multiple local 
dialing plans ("local numbers in Hong Kong office" = hongkong.acme.com, 
"local numbers in London office" = london.acme.com).

The more identifiers, the more (random) choices and configuration.

Since the context check is effectively a string comparison, we can add 
another namespace later, if the two existing ones prove to be insufficient.

> discussion down all kinds of wrong path, including a lot of my comments.

_______________________________________________
Iptel mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/iptel

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 04 Dec 2002 10:37:15 -0500

inline.

[email-masked] wrote:
> [MAP] Now I think we are getting to the point. The "context" only 
> provides the result of a comparison - yes or no - as a form of security.

Security?? It has nothign to do with security.

> It does not provide any routing information or anything else about the 
> identity of the originator.

That has been the point Henning has been trying to make in the last 
dozen emails he has sent.

> As such, it can be anything that the 
> receiver can use for a comparison to verify that a call got to the right 
> place.

No.

The context is used by the originator, not the receiver. If the 
originator gets a URI that it determines is outside of its context, it 
discards the URI as invalid.

> Presuming that the routing works, a call should get to the 
> correct place, so this comparision is just an extra check for the 
> somewhat paranoid. (The real paranoid would use real security measures.)

Security has nothing to do with it. I can securely call a wrong number, 
happily verifying that the person on the other end does indeed have 
extension 5150. Its just that the URI was pointed to a different someone 
with extensions 5150.

-Jonathan R.
-- 
Jonathan D. Rosenberg, Ph.D.                72 Eagle Rock Ave.
Chief Scientist                             First Floor
dynamicsoft                                 East Hanover, NJ 07936
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com