Subject: [Sip] Anonymization of To & revisiting tags alone for dialog ID

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 08 Feb 2002 22:13:59 -0500

The spec has generally assumed that the r-uri equals the To field for
new requests. The exceptions are register, and pre-loaded routes, both
of which are mentioned in bis-07. 

However, I think there might be some implications for privacy if you 
always make the To equal to the request URI. 

Lets say I have a group dialing application, and I have a group called
"[email-masked]", which expands to a set of folks I unfortunately
need to have a conference call with. Now, it is arguable that I don't
want to put that in the To field. Putting in the r-uri is fine, it will
be expanded by the group dialing (in this case, group conferencing) app,
and thus never seen by these people I need to call.

More generally, the To field represents the identity of the target as
you wish them to know. I see no reason not to do things like:

INVITE sip:[email-masked]
To: Unknown <sip:[email-masked]>

or:

INVITE sip:[email-masked]
To: My Best Friends! <sip:[email-masked]>

I think a sentence or two about this in 8.1.1.1 and in the security
sections would be a fine idea. The strength of To = R-URI would remain
SHOULD there, but some text on these issues would help motivate when
a UA would have good reason to do something else.

Basically, To and From URI are really in the cateory of "informational"
data; only the tags should have meaning to SIP machinery. 

Now, that leads to another issue. We've now had a couple of cases come
up where we needed a proxy to modify the To/From URL (Juha's privacy
example). 3gpp also has such a need, also because of privacy reasons. I
wonder if we should think harder about the decision not to move towards
tags as the sole dialog identifier (rather than the URI and tags). We
had already discussed this as open issue #140, and it was rejected. This
idea was
rejected primarily because one could use the tags as identifiers anyway,
so long as you didn't muck with the URL. Furthermore, there was a real
backwards compatibility issue. I would suggest that bis move us towards
the right destination, without arriving there yet. It should specify
ONLY
the tags as dialog
identifiers (so that finally, no sip identifiers include urls), but
mandate that the To and From URL be reflected in the response, noting
that elements shouldn't depend on it, however. This gives us a path to
removing the requirement for reflecting the To/From URLs in subsequent
requests when we go to draft. It will then also codify the preferred
mechanism of dialog ID using tags and Call-ID only.

Comments? Silence is consensus.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.            72 Eagle Rock Avenue
Chief Scientist                         First Floor
dynamicsoft                             East Hanover, NJ 07936
[email-masked]                 FAX: (973) 952-5050
http://www.jdrosen.net                  PH:  (973) 952-5000
http://www.dynamicsoft.com

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip