Subject: [stir] WG Last Call on draft-ietf-stir-problem-statement-01.txt

From: Russ Housley <[email-masked]>
Date: Mon, 9 Dec 2013 14:12:48 -0500

The authors have posted an updated Internet-Draft on the STIR problem statement.  It can be found here: http://www.ietf.org/id/draft-ietf-stir-problem-statement-01.txt.

Is this document ready for the STIR WG to pass to the IESG, requesting publication as an Informational RFC?  Please provide your input on this mail list by end-of-business on 23 December 2013.  If you have issues or concerns, please tell us what changes to the document are necessary to resolve them.

Russ

---

From: Robert Sparks <[email-masked]>
Date: Mon, 16 Dec 2013 09:48:24 -0600

One week remains in this LC. Please send any input you wish to have 
reflected as soon as you can.

Thanks,
RjS

On 12/9/13 1:12 PM, Russ Housley wrote:
> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir

---

From: "David Frankel" <[email-masked]>
Date: Mon, 16 Dec 2013 12:21:55 -0800

Here are four comments on the Problem Statement draft:

A) In section 2 there is the statement: "...the Federal Communications
Commission (FCC) recently organized a robocall competition..." This is
erroneous; the robocall competition was organized (or at least sponsored) by
the Federal TRADE Commission (FTC). The same error is in footnote 18.

B) In section 2, there is a comment that "[a]nonymization facilitates
automated illegal telemarketing or telephone denial-of-service attacks, as
described above, as it makes it difficult to blacklist numbers." I suggest
augmenting this to indicate that it makes it easy for the perpetrators to
evade detection and enforcement (which is the implication in the next
sentence.) My point is that blacklisting is not really a desirable solution
(blacklists are administratively quite challenging), so "enabling"
blacklisting is not such a great outcome. Improved tracing, tracking and
enforcement by means of a verifiable originating address will serve as a
significant deterrent.

C) There is a lot of discussion throughout the document of B2BUAs. Typically
these relays are set up by the "network" as a call is handed off from one
provider/carrier to another. There is another type of relay, "Call
Forwarding," that is end-user controlled; Brian Rosen and others contributed
some discussion of that earlier on the list. It might be worth adding a
reference to this type of relay. Its use is pervasive in legacy voice-mail
systems (referenced elsewhere in the document as a hacking target), and is
also common in "Find-Me/Follow-Me" or "One-Number" services. Calls that are
forwarded this way retain the FROM telephone number of the originating
caller; the forwarded-to number becomes the destination (TO header) and the
intermediary (forwarding) number is most often (in my experience) captured
in the DIVERSION header, which is interworked with the ISUP REDIRECTING
NUMBER information element. Under what circumstances, if any, the STIR
effort would address these relays remains to be seen, but it probably ought
to be mentioned as part of the Problem Statement to insure that it gets
dealt with explicitly.

D) Other telephone numbers also show up in call signaling. There is an ISUP
CHARGE NUMBER (sometimes called ANI) that is often interworked with SIP
P-CHARGE-INFO. The authenticity of this number might or might not be
validated by the mechanisms contemplated in STIR; again, it might be worth a
mention in the Problem Statement. Spoofing or other manipulation of this
value occurs frequently in the USA to arbitrage intercarrier compensation
(which admittedly may be completely gone by the time STIR sees the light of
day).

David Frankel
ZipDXR LLC
Los Gatos CA USA
Tel: 1-800-FRANKEL (1-800-372-6535)

-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of Robert Sparks
Sent: Monday, December 16, 2013 7:48 AM
To: [email-masked]
Subject: Re: [stir] WG Last Call on draft-ietf-stir-problem-statement-01.txt

Thanks,
RjS

On 12/9/13 1:12 PM, Russ Housley wrote:
> The authors have posted an updated Internet-Draft on the STIR problem
statement.  It can be found here:
http://www.ietf.org/id/draft-ietf-stir-problem-statement-01.txt.
>
> Is this document ready for the STIR WG to pass to the IESG, requesting
publication as an Informational RFC?  Please provide your input on this mail
list by end-of-business on 23 December 2013.  If you have issues or
concerns, please tell us what changes to the document are necessary to
resolve them.

---

From: "Peterson, Jon" <[email-masked]>
Date: Tue, 17 Dec 2013 21:45:08 +0000

>the Federal TRADE Commission (FTC). The same error is in footnote 18.

Right, will fix that.

>enforcement by means of a verifiable originating address will serve as a

I'd certainly be willing to change to that to "as it makes it difficult to
identity perpetrators and craft policies to block them."

>to be mentioned as part of the Problem Statement to insure that it gets

We did add some text about call forwarding in the last version of the
draft, see the last paragraph of Section 2 (before the bullet points). It
explicitly mentions the fact that calls forwarded in this fashion retain
their original" From" number. It doesn't explicitly call out "Fine
Me/Follow Me" or similar services, but it notes the core problem.

>(which admittedly may be completely gone by the time STIR sees the light

I think the current scope of STIR is to identify the calling telephone
number. Securing other information signaled within the call, except where
necessary for reference integrity to bind the calling telephone number to
a particular call, is out of scope.

Jon Peterson
Neustar, Inc.

---

From: Russ Housley <[email-masked]>
Date: Mon, 23 Dec 2013 11:47:15 -0500

WG Last Call ends today.  Based on the messages that I have seen so far, a few changes are needed to the document, and Jon has agreed to make them.

Russ

---

From: Russ Housley <[email-masked]>
Date: Tue, 24 Dec 2013 11:03:58 -0500

I did not see any new comments by yesterday, so once Jon makes the changes to the problem statement document, it  will be ready for the IESG.

Please enjoy the holidays.  We will begin WG Last Call on the threats document shortly after the holidays.

Russ