Subject: Re: Apparently RFC 3693 is incomplete; was RE: [Geopriv] Re: [Sip] teasing apart:

From: "James M. Polk" <[email-masked]>
Date: Fri, 28 Jul 2006 12:14:26 -0500

At 06:59 PM 7/28/2006 +0200, Drage, Keith \(Keith\) wrote:
>See below (limiting this to Geopriv)
>
>Keith
>
> > -----Original Message-----
> > From: Hannes Tschofenig [mailto:[email-masked]]
> > Sent: 27 July 2006 20:27
> > To: Henning Schulzrinne
> > Cc: IETF SIP List; GEOPRIV
> > Subject: Re: [Geopriv] Re: [Sip] teasing apart: http asa
> > GEOPRIV using protocol
> >
><snipped>
>
> > > We've been trying to get at some of these distinctions with the
> > > sighting vs. using protocol terminology, but that distinction also
> > > seems to degenerate into discussions more suited for a law
> > school or
> > > theology department than an engineering organization.
> > >
> > > For example, by strict definition, LoST would be a 'Using Protocol'
> > > since it "carries a Location Object", but I hope we all agree that
> > > this is silly. We had earlier agreed that the location-by-DHCP also
> > > were not Using Protocol, even though they obviously carry a
> > location
> > > object of some form.
> >
> > Currently LoST is not a using protocol since it does not
> > carry a PIDF-LO although some folks would like to use a
> > PIDF-LO; HELD was a using protocol before we turned the
> > problem into a Location Configuration problem; RELO never was
> > a using protocol;
> >
> > Isn't this confusing?
> >
>
>OK, I'11 bite.
>
>Firstly I read the definition of a using protocol in RFC 3693 to be
>anything that carries a location object. PIDF-LO is just a coding scheme
>for said location object. So the current definition still applies to
>LoST.

here's part of your answer

There is a feeling that if identity information does not accompany the 
location information, carrying location information doesn't mean it has to 
be a using protocol.  This is not explicitly written into 3693 though

>Now what specific change do you need to make to RFC 3693 that covers
>your apparently special categorisation of DHCP (RFC 3825)

that was more or less forced upon the WG with the above logic (no 
identifying info)

you have to close your eyes a bit, and turn you head in just a certain way 
to see it that way wrt 3693 - and have attended all the Geopriv meetings to 
understand (and I am one of the authors of 3825)

>, LoST

LoST carries what's in the DHCP-civic response, or the geo from 3825, 
because that is what populates the PIDF-LO, so if there is no added user 
identifying info in the LoST packet, therefore most believe it isn't a 
using protocol.

>and so
>on such that they are not using protocols?

SIP carries user identifying info, therefore it is (going to be) a using 
protocol.

>And if so what are they and what requirements actually apply to them,
>particularly in respect of location privacy?
>
><snipped>
> >
>
>_______________________________________________
>Geopriv mailing list
>[email-masked]
>https://www1.ietf.org/mailman/listinfo/geopriv

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: "Brian Rosen" <[email-masked]>
Date: Fri, 28 Jul 2006 13:50:46 -0400

I don't agree with the definition, but I think the privacy concerns between
a protocol that does link identity and location are much different from one
that doesn't.  In that way, LoST has much less of a privacy concern than
does a SIP with a location body, and an opaque URI that returns a PIDF with
an anonymized identity has less concern that an AoR returning a full
presence PIDF.

I think there are significant privacy concerns with even LoST and anonymous
PIDFs, especially if an attacker can observe traffic in and out of a node
and the traffic is in the clear.  If you see a sip message with an AoR going
into a proxy, and a short time later a LoST request goes out, you can be
pretty sure of the relationship between the AoR and the location, even if a
dereference operation was fully protected.

So, as usual, we don't have a one size fits all situation, there are no hard
and fast rules, and the privacy issues, and required normative text have to
be reviewed on a case by case basis to see what the concerns are.

I think in general a dereference protocol is pretty hard to restrict to
opaque URIs returning PIDFs with anonymized identity.  Thus, I think that
any dereference protocol needs a fairly strong privacy controls and
stringent review.  I think LoST only has the "collateral damage" issue of
being able to observe LoST queries as well as others, and thus privacy IS an
issue, but probably less than a dereference protocol.  It does say that LoST
SHOULD protect the location with TLS, and maybe that is a MUST, with the
emergency case fallback exception as usual.

This discussion does lead me to wonder if we should have some text in
location-conveyance that suggests that the URI in a Location header SHOULD
be opaque, and certainly should suggest that the URI returned SHOULD NOT
have identity information.  I think SHOULD is appropriate, because you can
easily imagine scenarios where a real SIP presence URI IS appropriate (that
is you get a full PIDF with identity).

Since that cannot be a MUST, SIP is a real full blown "using" protocol, and
needs the obvious full protections for the headers (TLS) and the body
(S/MIME), and its review should be a full review.

Brian

> From: James M. Polk [mailto:[email-masked]]
> Sent: Friday, July 28, 2006 1:14 PM
> To: Drage, Keith (Keith); Hannes Tschofenig; Henning Schulzrinne
> Cc: GEOPRIV
> Subject: Re: Apparently RFC 3693 is incomplete; was RE: [Geopriv] Re:[Sip]
> teasing apart:
>

---

From: Randall Gellens <[email-masked]>
Date: Fri, 28 Jul 2006 12:02:43 -0700

At 12:14 PM -0500 7/28/06, James M. Polk wrote:

>  There is a feeling that if identity information does not accompany 
> the location information, carrying location information doesn't 
> mean it has to be a using protocol.  This is not explicitly written 
> into 3693 though

>  you have to close your eyes a bit, and turn you head in just a 
> certain way to see it that way wrt 3693 - and have attended all the 
> Geopriv meetings to understand (and I am one of the authors of 3825)

Likely I'm confused (not unusual) but I thought the distinction was 
between transporting location to provision the target and disclosing 
location to an entity other than the target.  As has been noted 
frequently here, an IP address can be considered identification.
-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly-selected tag: ---------------
Two things are infinite: the universe and human stupidity;
and I'm not even sure about the universe.
                                        --Albert Einstein

---

From: "Thomson, Martin" <[email-masked]>
Date: Sun, 30 Jul 2006 19:12:05 -0500

> is you get a full PIDF with identity).

I suspect that there are two things that need to be balanced here.  I don't want to suggest that the problem is unsolvable, but you need to balance this against the theft of a URI.  If both the URI and the identity in the PIDF(-LO) are unlinked, then you have a hard time working out if the URI was stolen or not.

I'd recommend that you try to limit what is in location-conveyance.  I am seeing a tendency in these discussions to draw in all sorts of requirements, some of them purely peripheral.  It is clear that we haven't got a solid consensus on how a reference works, so why prolong the process.  I hear that this document is needed urgently.

Cheers,
Martin

..

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: "Brian Rosen" <[email-masked]>
Date: Mon, 31 Jul 2006 09:32:13 -0400

I agree that limiting what is in location conveyance is a Good Thing.

I'm not sure I understand your worry about URI theft.  The fact that a URI
is anonymized doesn't mean the LIS doesn't understand who the identity that
goes with the location is, and certainly, if it demands identity of the
entity requesting dereferencing, it can apply any rules relating target to
watcher that apply.  If I steal pres:[email-masked], then "I" know
more than I do about "pres:[email-masked]", but example.com
doesn't.  Similarly, if I get a PIDF with identity, I know more than I do if
the PIDF has an unlinked identity, but I don't see how that relates to
stolen URIs.

Brian 

> From: Thomson, Martin [mailto:[email-masked]]
> Sent: Sunday, July 30, 2006 8:12 PM
> To: Brian Rosen; James M. Polk; Drage, Keith (Keith); Hannes Tschofenig;
> Henning Schulzrinne
> Cc: GEOPRIV
> Subject: RE: Apparently RFC 3693 is incomplete;was RE: [Geopriv] Re:[Sip]
> teasing apart:
> 
> I suspect that there are two things that need to be balanced here.  I
> don't want to suggest that the problem is unsolvable, but you need to
> balance this against the theft of a URI.  If both the URI and the identity
> in the PIDF(-LO) are unlinked, then you have a hard time working out if
> the URI was stolen or not.
> 
> I'd recommend that you try to limit what is in location-conveyance.  I am
> seeing a tendency in these discussions to draw in all sorts of
> requirements, some of them purely peripheral.  It is clear that we haven't
> got a solid consensus on how a reference works, so why prolong the
> process.  I hear that this document is needed urgently.
> 
> Cheers,
> Martin
> 
> ..
>

---

From: "Thomson, Martin" <[email-masked]>
Date: Mon, 31 Jul 2006 17:04:37 -0500

Without identity, I can take your pres:[email-masked] and use it.  People then think that I am where you are.  I believe that this issue has been raised in the past, by you and others.

I'm just suggesting that you need to examine the whole picture when you talk about these things.  I'm also suggesting that location-conveyance doesn't need this part of the picture.

> From: Brian Rosen [mailto:[email-masked]]
> Sent: Monday, 31 July 2006 11:32 PM
> To: Thomson, Martin; 'James M. Polk'; 'Drage, Keith (Keith)'; 'Hannes
> Tschofenig'; 'Henning Schulzrinne'
> Cc: 'GEOPRIV'
> > ------------------------------------------------------------------------
> --
> > ----------------------
> > ------------------------------------------------------------------------
> --
> > ----------------------
> > [mf2]
> 
>