Subject: [stir] I-D Action: draft-ietf-stir-problem-statement-01.txt

From: [email-masked]
Date: Fri, 06 Dec 2013 17:50:54 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Telephone Identity Revisited Working Group of the IETF.

	Title           : Secure Telephone Identity Problem Statement
	Author(s)       : Jon Peterson
                          Henning Schulzrinne
                          Hannes Tschofenig
	Filename        : draft-ietf-stir-problem-statement-01.txt
	Pages           : 23
	Date            : 2013-12-06

Abstract:
   Over the past decade, Voice over IP (VoIP) systems based on SIP have
   replaced many traditional telephony deployments.  Interworking VoIP
   systems with the traditional telephone network has reduced the
   overall security of calling party number and Caller ID assurances by
   granting attackers new and inexpensive tools to impersonate or
   obscure calling party numbers when orchestrating bulk commercial
   calling schemes, hacking voicemail boxes or even circumventing multi-
   factor authentication systems trusted by banks.  Despite previous
   attempts to provide a secure assurance of the origin of SIP
   communications, we still lack of effective standards for identifying
   the calling party in a VoIP session.  This document examines the
   reasons why providing identity for telephone numbers on the Internet
   has proven so difficult, and shows how changes in the last decade may
   provide us with new strategies for attaching a secure identity to SIP
   sessions.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-stir-problem-statement

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-stir-problem-statement-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-stir-problem-statement-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Fernando Mousinho (fmousinh)" <[email-masked]>
Date: Mon, 9 Dec 2013 21:53:26 +0000

Some feedback on this last draft:

Section 3, Out-of-Band Identity Verification:

We should remove the reference to E164, given some callers may advertise
toll-free numbers and other non E164 identities. (I do understand that
otherwise we would try to convert numbers to some canonical form).

I would also slightly change the last sentence in this same section, as it
gives the impression that out-of-band should only be used if inband is not
available. Correct me if I¹m wrong, but we would be ok if some entities
only support out-of-band even if technically they could handle inband.
Suggested text ³This approach is needed because the inband technique does
not work in all use cases, such as when intermediaries are involved or
interworking with PSTN is used.²

On 12/6/13, 8:50 PM, "[email-masked]" <[email-masked]>
wrote:

>_______________________________________________
>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir

---

From: Henning Schulzrinne <[email-masked]>
Date: Mon, 9 Dec 2013 22:02:03 +0000

As a minor matter, as far as I can tell, toll-free numbers, at least in the US, would be considered E.164, as they do not seem to fall into any of the Annex A exceptions, such as short codes, and follow the structure of the national numbering plan.

________________________________________
From: stir [[email-masked]] on behalf of Fernando Mousinho (fmousinh) [[email-masked]]
Sent: Monday, December 09, 2013 4:53 PM
To: [email-masked]
Subject: Re: [stir] I-D Action: draft-ietf-stir-problem-statement-01.txt

---

From: "Richard Shockey" <[email-masked]>
Date: Mon, 9 Dec 2013 21:54:32 -0500

+1  

800 numbers are technically part of the North American Numbering Plan and
are therefore  E.164 

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Henning Schulzrinne
Sent: Monday, December 09, 2013 5:02 PM
To: Fernando Mousinho (fmousinh); [email-masked]
Subject: Re: [stir] I-D Action: draft-ietf-stir-problem-statement-01.txt

As a minor matter, as far as I can tell, toll-free numbers, at least in the
US, would be considered E.164, as they do not seem to fall into any of the
Annex A exceptions, such as short codes, and follow the structure of the
national numbering plan.

________________________________________
From: stir [[email-masked]] on behalf of Fernando Mousinho (fmousinh)
[[email-masked]]
Sent: Monday, December 09, 2013 4:53 PM
To: [email-masked]
Subject: Re: [stir] I-D Action: draft-ietf-stir-problem-statement-01.txt

I would also slightly change the last sentence in this same section, as it
gives the impression that out-of-band should only be used if inband is not
available. Correct me if I¹m wrong, but we would be ok if some entities only
support out-of-band even if technically they could handle inband.
Suggested text ³This approach is needed because the inband technique does
not work in all use cases, such as when intermediaries are involved or
interworking with PSTN is used.²

On 12/6/13, 8:50 PM, "[email-masked]" <[email-masked]>
wrote:

>Please note that it may take a couple of minutes from the time of 
>submission until the htmlized version and diff are available at 
>tools.ietf.org.
>