Subject: [stir] I-D Action: draft-ietf-stir-problem-statement-00.txt

From: [email-masked]
Date: Fri, 04 Oct 2013 15:23:46 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Telephone Identity Revisited Working Group of the IETF.

	Title           : Secure Telephone Identity Problem Statement
	Author(s)       : Jon Peterson
                          Henning Schulzrinne
                          Hannes Tschofenig
	Filename        : draft-ietf-stir-problem-statement-00.txt
	Pages           : 23
	Date            : 2013-10-04

Abstract:
   Over the past decade, Voice over IP (VoIP) systems based on SIP have
   replaced many traditional telephony deployments.  Interworking VoIP
   systems with the traditional telephone network has reduced the
   overall security of calling party number and Caller ID assurances by
   granting attackers new and inexpensive tools to impersonate or
   obscure calling party numbers when orchestrating bulk commercial
   calling schemes, hacking voicemail boxes or even circumventing multi-
   factor authentication systems trusted by banks.  Despite previous
   attempts to provide a secure assurance of the origin of SIP
   communications, we still lack of effective standards for identifying
   the calling party in a VoIP session.  This document examines the
   reasons why providing identity for telephone numbers on the Internet
   has proven so difficult, and shows how changes in the last decade may
   provide us with new strategies for attaching a secure identity to SIP
   sessions.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-stir-problem-statement

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-stir-problem-statement-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: <[email-masked]>
Date: Tue, 15 Oct 2013 15:46:54 +0000

This draft looks good to me.

A few typos & nitpicking:

> 1.  Introduction
[...]
> conceptional 

"functionally" (?)

> 2.  Problem Statement
[...] 
> through the concept of certificated 
>   carriers

"Certified" doesn't read well to me here. "licensed"? 

> 3.  Terminology
[...]
> telephoone

telephone

> 4.  Use Cases
[...]
> We generally assume that the PSTN component of any call path cannot
>   be altered.

Not quite clear to me what we mean by this (or equally unclear what the consequence would be for the document should we make the opposite assumption...) Maybe remove or clarify.   

> 4.2.  IP-PSTN-IP Call
> Frequently, two VoIP-based service providers

Would suggest inserting "(VSP)" after that.

> 4.4.  VoIP-to-PSTN Call Call

Probably too many calls here...

> 4.5.  PSTN-VoIP-PSTN Call
> Consequenly

Consequently

> That said,
>   national authorities for telephone numbers are increasingly migrating
>   their provisioning services to the Internet, and issuing credentials
>   that express authority for telephone numbers to secure those
>   services.  

The use of plural and "increasingly" seems a bit exaggerated to me. Maybe say "some... are..."

Regards,

Philippe Fouquart
Orange Labs Networks
+33 (0) 1 45 29 58 13

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Saturday, October 05, 2013 12:24 AM
To: [email-masked]
Cc: [email-masked]
Subject: [stir] I-D Action: draft-ietf-stir-problem-statement-00.txt

Abstract:

_______________________________________________
stir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/stir

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Brian Rosen <[email-masked]>
Date: Wed, 16 Oct 2013 15:14:39 -0400

Minor detail but in 2, "certificated" is a U.S.-centric term that means a government authorized carrier.  The term of art is "certificated" because a state government entity issues an operating certificate to the carrier that lets other entities know that it is authorized to provide service.

"Licensed" is pretty close, but not actually what happens in the U.S.  I could deal with "licensed" though - it's clear what it means.

Brian

---

From: <[email-masked]>
Date: Thu, 17 Oct 2013 08:31:31 +0000

Thanks for the background on this, Brian. 

FWIW this makes me think that people familiar with the EU framework may also argue for the use of "authorization" since the individual licensing regime has moved to what's called authorizations there (and it's generally more of a lightweight registration really). Given the context of stir, I just thought readers might infer that such carriers always get digital certificates if they're "certificated"/registered/authorized/licensed, when they don't always do - and probably don't in general. 

But I don't feel strongly one way or another, either. 

Regards,

Philippe Fouquart
Orange Labs Networks
+33 (0) 1 45 29 58 13

-----Original Message-----
From: Brian Rosen [mailto:[email-masked]] 
Sent: Wednesday, October 16, 2013 9:15 PM
To: FOUQUART Philippe IMT/OLN
Cc: [email-masked]
Subject: Re: [stir] I-D Action: draft-ietf-stir-problem-statement-00.txt

Brian