Subject: Re: [stir] I-D Action: draft-ietf-stir-problem-statement-01.txt

From: "PFAUTZ, PENN L" <[email-masked]>
Date: Tue, 10 Dec 2013 13:37:51 +0000

A few comments:
1. In the terminology section:
Out-of-Band Identity Verification:
 Out-of-band verification
      determines whether the E.164 number used by the calling party
      actually exists, whether the calling entity is entitled to use the
      number and whether a call has recently been made from this phone
      number.  This approach is needed when the in-band technique does
      not work due to intermediaries or due to interworking with PSTN
      networks.

Delete the last sentence - not part of a definition

2. Section  4.4  replace
"The gateway must verify that Alice can claim the
   E.164 number she is using before it populates the corresponding
   calling party number field in telephone network signaling."

With
"It is desirable that the  gateway verify that Alice can claim the
   E.164 number she is using before it populates the corresponding
   calling party number field in telephone network signaling."

3. Section 5.1
"Since [5] was written, the whole notion of P- headers intended for
   use in private SIP domains has also been deprecated, largely because
   of overwhelming evidence that these headers were being used outside
   of private contexts and leaking into the public Internet."

Reference for this deprecation?
Also, who's to say that the majority of applications of the stir work won't be in private contexts?

4.  Section 6.2
"6.2.  Failure of Public ENUM

   At the time [1] was written, the hopes for establishing a certificate
   authority for telephone numbers on the Internet largely rested on
   public ENUM deployment.  The e164.arpa DNS tree established for ENUM
   could have grown to include certificates for telephone numbers or at
   least for number ranges.  It is now clear however that public ENUM as
   originally envisioned has little prospect for adoption.  That said,
   some national authorities for telephone numbers are migrating their
   provisioning services to the Internet, and issuing credentials that
   express authority for telephone numbers to secure those services.
   These new authorities for numbers could provide to the public
   Internet the necessary signatory authority for securing calling
   partys' numbers.  While these systems are far from universal, the
   authors of this draft believe that a solution devised for the North
   American Numbering Plan could have applicability to other country."

I'm not sure how to interpret this.  Which national authorities are migrating provisioning to the Internet? Not the US AFAICT.
On the other hand folks are discussing approaches like using the NPAC (US portability database) as ENUM registry that could support
the capabilities needed by stir.  If the latter kind of effort is meant a better title might be "Evolution of ENUM."

5. Section 7 Requirements
"Generation:  Intermediaries as well as end system must be able to generate the source identity information."
What kinds of intermediaries? Have we agreed to this?

Penn Pfautz
AT&T Access Management
+1-732-420-4962
-----Original Message-----
From: stir [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, December 06, 2013 8:51 PM
To: [email-masked]
Cc: [email-masked]
Subject: [stir] I-D Action: draft-ietf-stir-problem-statement-01.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Secure Telephone Identity Revisited Working Group of the IETF.

        Title           : Secure Telephone Identity Problem Statement
        Author(s)       : Jon Peterson
                          Henning Schulzrinne
                          Hannes Tschofenig
        Filename        : draft-ietf-stir-problem-statement-01.txt
        Pages           : 23
        Date            : 2013-12-06

Abstract:
   Over the past decade, Voice over IP (VoIP) systems based on SIP have
   replaced many traditional telephony deployments.  Interworking VoIP
   systems with the traditional telephone network has reduced the
   overall security of calling party number and Caller ID assurances by
   granting attackers new and inexpensive tools to impersonate or
   obscure calling party numbers when orchestrating bulk commercial
   calling schemes, hacking voicemail boxes or even circumventing multi-
   factor authentication systems trusted by banks.  Despite previous
   attempts to provide a secure assurance of the origin of SIP
   communications, we still lack of effective standards for identifying
   the calling party in a VoIP session.  This document examines the
   reasons why providing identity for telephone numbers on the Internet
   has proven so difficult, and shows how changes in the last decade may
   provide us with new strategies for attaching a secure identity to SIP
   sessions.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-stir-problem-statement

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-stir-problem-statement-01

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-ietf-stir-problem-statement-01

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
stir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/stir

---

From: Brian Rosen <[email-masked]>
Date: Tue, 10 Dec 2013 09:18:30 -0500

Inline

> Delete the last sentence - not part of a definition
Move it maybe

>   calling party number field in telephone network signaling.”
These are all use cases, and they all have statements like this.  I’d prefer to leave it as is.

> Reference for this deprecation?
RFC5757
> Also, who's to say that the majority of applications of the stir work won't be in private contexts?
Explanation of why P-headers aren’t allowed any more, not saying whether stir is used in private contexts

> the capabilities needed by stir.  If the latter kind of effort is meant a better title might be "Evolution of ENUM.”
This is referring to Public ENUM, which clearly failed.  To make stir work in some contexts, at least some aspects of the database have to be public.  There is relevance to private, or infrastructure ENUM, which is why the text refers to it. 

> What kinds of intermediaries? Have we agreed to this?
How about the service provider that serves the end point?
I think we also would allow a service provider who delegated the number to the SP that serves the endpoint the ability to do it.
Those are intermediaries in this context

Brian