Subject: Re: [Sip] Anonymous URI for From header in ua-privacy-01

From: Dean Willis <[email-masked]>
Date: Mon, 03 Mar 2008 23:09:29 -0600

Mayumi Munakata wrote:

> One profound open issue we have is on how to get an
> anonymous URI for a From header.  While we can use a
> temp-gruu for a Contact header, there is no mechanism
> to obtain a functional anonymous URI for the From
> header or any other headers that houses URIs.
> 
> RFC3323 recommends to use "[email-masked]"
> for an anonymous URI in a From header.  However, this
> impedes the use of SIP-Identity, as SIP-Identity
> mandates the domain portion of the "From" URI and
> that of "Identity-Info" to match.
> 
> One of the expired draft written by Jonathan, attempted
> to use the GRUU to get this functional yet anonymous URI
> to address this issue.
> http://ietfreport.isoc.org/idref/draft-rosenberg-sip-identity-privacy/
> 
> I can see few ways forward.
> 
> 1. Suggest the use of anonymous@{user's domain name}, which
>    verifier then can verify the signature's validity as
>    domain portion of the URI and that of Identity-Info matches.
>     >> If SIP-Identity is used, the domain is given away anyhow
>        in the Identity-Info, so what is the point of hiding the
>        domain in the From header?
> 
> 2. Make a note that SIP-Identity will not function when
>    [email-masked] is used.
>     >> Describe the caveat that verifier is likely to fail the
>        request or suggest that Authentication Service does not
>        add Identity-Info/signature.
> 
> 3. Extend GRUU to support mechanism that Rosenberg suggested.
> 
> Does anybody has any preferences or any other suggestions?

Do we get anything from #3 that we wouldn't get by just using the
temp-GRUU that we're using as the Contact: value as the from: value too?

in other words, what happens if we make the From: header field of the
ua-anonymized request the same as the Contact: header field?

If an identity server is willing to assert on this identity, it can
later use the GRUU to reverse back out to the authenticated identity it
was anonymizing.

--
dean
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Mayumi Munakata <[email-masked]>
Date: Wed, 05 Mar 2008 13:46:32 +0900

John,

Thank you for your wrap-up of the discussion.
Sorry for the belated reply.

See inline.

 > Mayumi,
 >
 > I would note that RFC 4474 already allows option 1. I see various emails
 > discussing the usefulness of this. I can see it as beneficial where a
 > domain wishes to assert that the request originated in that domain, but
 > does not wish to disclose the particular user ID, e.g., in call centres.
 >
 > Given that this is already allowed in RFC 4474, I would prefer that the
 > ua-privacy draft does nothing to deprecate that.
 >
 > Of course, we also need to allow the use of option 2.
 >
 > I don't see a need for option 3, and I haven't heard anyone else
 > speaking in its favour.
 >
 > John

So, the conclusion here, in my understanding, is that
"anonymous@{user's domain name}" can be used for the
 From header to have an anonymity and the SIP-Identity
(RFC 4474) go together.  If the UA does not have an
intent to use the SIP-Identity, it can set
"[email-masked]" as an anonymous From URI.

 > later use the GRUU to reverse back out to the authenticated identity it

I would like to hear people's opinion on these
questions that Dean is asking.

The draft-ietf-sip-gruu-15 allows a temp-GRUU
to be set in the Contact header only, but does
not allow it in the From header.

Is it reasonable to use the temp-GRUU as the
authenticated anonymous From address?

Regards,
Mayumi

 >> -----Original Message-----
 >> From: [email-masked] [mailto:[email-masked]] On
 >> Behalf Of Mayumi Munakata
 >> Sent: 19 February 2008 05:45
 >> To: [email-masked]
 >> Subject: [Sip] Anonymous URI for From header in ua-privacy-01
 >>
 >> All;
 >>
 >> I have just submitted a new version of ua-privacy draft.
 >> http://www.ietf.org/internet-drafts/draft-ietf-sip-ua-privacy-01.txt
 >>
 >> Thanks to John Elwell for his comprehensive review,
 >> we managed to make a lot of editorial corrections
 >> and some technical.
 >>
 >> Regards,
 >> Mayumi
 >> Sip mailing list  http://www.ietf.org/mailman/listinfo/sip