Subject: RE: [Sipping] Privacy comment (was Re: calling number blocking at sip/isup gate way)

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 22 Feb 2002 12:26:28 -0600

Actually, I have a few slight confusions about the text below (it seems to
use UA and user interchangeably a bit, which is worrisome when we're talking
about proving identity). One question would probably clear things up:
 
If the proxy still needs to authenticate the user (through whichever
mechanism) to ensure that the identity that has been asserted in the RPID is
valid for the user in question, why does the user need to supply an RPID at
all? Why doesn't the user just authenticate itself to the proxy (however
that happens) and let the proxy insert the RPID corresponding to the
identity that the user has proven? This works fine for cases in which a
single UA is used by multiple users, or when a single user has multiple
provable identities. It assumes that you have a one-to-one mapping between
credentials and identities, but that's usually par for the course.
 
Again, if the proxy server holds a mapping between credentials and valid
identities itself, as you suggest below, it doesn't seem at all unreasonable
to adopt this model.
 
Jon Peterson
NeuStar, Inc.

-----Original Message-----
From: Mark Watson [mailto:[email-masked]]
Sent: Tuesday, February 19, 2002 12:29 PM
To: [email-masked]
Subject: [Sipping] Privacy comment (was Re: calling number blocking at
sip/isup gate way)

As presently described in privacy-03, the Remote-Party-ID header is only
ever inserted by proxies, based on the proxy's knowledge of the identity of
the UA (which it determines from some authentication mechanism out of scope
of the privacy draft).

Privacy-02 allowed the UA to insert Remote-Party-ID too. I think this should
be reintroduced for the *specific case* of a UA with multiple identities, to
allow the UA to choose which identity it wishes to be known by. The Proxy
would still be responsible for ensuring that this identity was valid for the
user and would still use some other authentication scheme to authenticate
the user. The proxy would need knowledge of which identities were valid for
which users.

I believe this is a requirement for 3GPP, where a UA can have multiple
'public identities' and chooses which of these it wishes to be known by for
each call. The proxy authenticates the UA by some other means and then
checks the subscription data to ensure it is really allowed to use the
public Identity it has included. 

I've suggested this a few times, and there has not been much comment for or
against. It would be good if we could get a resolution before the next
version of privacy is published.

So, comments ? 

Regards...Mark 

> -----Original Message----- 
> From: Dean Willis [ mailto:[email-masked]
<mailto:[email-masked]> ] 
> Sent: 18 February 2002 23:12 
> To: Watson, Mark [MDN05:EP10:EXCH]; [email-masked]; 
> [email-masked]; [email-masked] 
> Subject: Re: [Sipping] RE: [Sip] calling number blocking at sip/isup 
> gateway 
> 
> 
> Mark said: 
> 
> > Your example below needs only a small extension to 
> illustrate Mike's point 
> > and show why something like Remote-Party-ID as defined in 
> the privacy 
> draft 
> > is needed, and how it works despite the lack of a signature. 
> 
> Yep. And what happens when my misconfigured proxy forwards 
> the call without 
> paying attention to the Privacy header, because for some reason it's 
> forwarding to the outside world instead of a PSTN gateway 
> under my control? 
> We get a privacy leak. 
> 
> But other than that, I'd say you've precisely described a 
> "sunny day" use 
> case for RPID. 
> 
> It still has a lot of security issues based on transitive 
> trust, which make 
> it a lot more palatable in a two-party case than in three or 
> more party 
> transitivity. 
> 
> I believe we're approaching a general consensus that the Privacy draft 
> provides a reasonable approach to solving a specific class of problem 
> wherein interoperator-transitive trust is couple to 
> transport-layer message 
> protection. That's not a general privacy mechanism, but it 
> does seem to have 
> enough constituency to justify publication as long as it has a REALLY 
> serious applicability statement explaining the particular 
> requirements and 
> environments for which it is useful. 
> 
> How does that sound? 
> 
> -- 
> Dean 
> 
>

---

From: [email-masked]
Date: Fri, 22 Feb 2002 21:02:34 +0200

Peterson, Jon writes:

 > Why doesn't the user just authenticate itself to the proxy (however
 > identity that the user has proven? 

this should be allowed,

-- juha

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: "Dean Willis" <[email-masked]>
Date: Sun, 24 Feb 2002 14:57:26 -0600

Privacy comment (was Re: calling number blocking at sip/isup gateway)
Your approach will generally work wherever the identity being used has authentication credentials.

However, 3GPP has posited (as usual) a slightly odd case.

Each UA has a "private identity" which can authenticate using the smart-card mechanisms in the SIM card.

The home service proxy has a a table listing a number of public identities that have been (via out-of-band mechanisms) associated with the "private identity".

The user may choose to use any of these associated public identities as the originating identity for a call. However, proxy-authentication has to be based on the private user identity, because we only have key management for one identity in the SIM.

So, the 3GPP proxy can accept a "hint" from the mobile supplied RPID as to which of the known public identities the user ias asserting for this specific dialog.

I suppose that one could also do the same by appearing to authenticate on the public identity, then using that to back-index into the private identity for the actual authentication, but the mobile-supplied RPID seems tidier to me.

--
Dean

  ----- Original Message ----- 
  From: Peterson, Jon 
  To: 'Mark Watson' ; [email-masked] 
  Sent: Friday, February 22, 2002 12:26 PM
  Subject: RE: [Sipping] Privacy comment (was Re: calling number blocking at sip/isup gate way)

  Actually, I have a few slight confusions about the text below (it seems to use UA and user interchangeably a bit, which is worrisome when we're talking about proving identity). One question would probably clear things up:

  If the proxy still needs to authenticate the user (through whichever mechanism) to ensure that the identity that has been asserted in the RPID is valid for the user in question, why does the user need to supply an RPID at all? Why doesn't the user just authenticate itself to the proxy (however that happens) and let the proxy insert the RPID corresponding to the identity that the user has proven? This works fine for cases in which a single UA is used by multiple users, or when a single user has multiple provable identities. It assumes that you have a one-to-one mapping between credentials and identities, but that's usually par for the course.

  Again, if the proxy server holds a mapping between credentials and valid identities itself, as you suggest below, it doesn't seem at all unreasonable to adopt this model.

  Jon Peterson
  NeuStar, Inc.
    -----Original Message-----
    From: Mark Watson [mailto:[email-masked]]
    Sent: Tuesday, February 19, 2002 12:29 PM
    To: [email-masked]
    Subject: [Sipping] Privacy comment (was Re: calling number blocking at sip/isup gate way)

    As presently described in privacy-03, the Remote-Party-ID header is only ever inserted by proxies, based on the proxy's knowledge of the identity of the UA (which it determines from some authentication mechanism out of scope of the privacy draft).

    Privacy-02 allowed the UA to insert Remote-Party-ID too. I think this should be reintroduced for the *specific case* of a UA with multiple identities, to allow the UA to choose which identity it wishes to be known by. The Proxy would still be responsible for ensuring that this identity was valid for the user and would still use some other authentication scheme to authenticate the user. The proxy would need knowledge of which identities were valid for which users.

    I believe this is a requirement for 3GPP, where a UA can have multiple 'public identities' and chooses which of these it wishes to be known by for each call. The proxy authenticates the UA by some other means and then checks the subscription data to ensure it is really allowed to use the public Identity it has included. 

    I've suggested this a few times, and there has not been much comment for or against. It would be good if we could get a resolution before the next version of privacy is published.

    So, comments ? 

    Regards...Mark 

    > From: Dean Willis [mailto:[email-masked]]