Subject: [Sip] z9hG4bK forever ???

From: William Marshall <[email-masked]>
Date: Tue, 16 Apr 2002 22:47:35 -0400 (EDT)

Subject: was Re: Screened FromL and Privacy
Subject: was Re: Summary of RE: [Sip] Comment, SIP Privacy draft
Subject: was lots of others, too

All this discussion of proxy modification of the From and To headers,
and the need for a B2BUA, seems to me to be a short-term problem only.

RFC3261 (2543bis-09) specifies matching of dialog-ids based only
on Call-ID and tags, not on display-name or on addr-spec.  So
when all endpoints are compliant with RFC3261, there will be no
problem with a proxy modifying the display-name or addr-spec in
the From header.

It is only during a transition period, when endpoints that conform
to RFC2543 are supported as well as newer ones.  How long will
this be?  How long will a proxy need to handle a UAC that doesn't
supply a Contact header?  How long will a proxy need to handle
a Record-Route header without the "lr" tag?  How long will a
UAS need to handle a BYE received prior to sending 2xx?  How long 
will the comparison be coded into the proxies and UAs looking 
for "z9hG4bK"?

In all cases, my hope is not too long.  And, at the point when
these "conversion aids" no longer need to be present in SIP
implementations, it will be safe for proxies to modify the From
header to provide anonymity, if the subscriber, or the user, or the
regulator, (or others?), says that it should.

In cases like 3GPP, where (IIRC) release 5 does not include
IMS connections outside of the wireless operator's network, the
problem is even simpler.  Since 3GPP required RFC3261 everywhere,
modification of the From header can be done immediately.  I would
hope this transition period and the need for "conversion aids" would
be over before 3GPP release 6 is deployed.

My conclusion from all of this is that 3GPP can require the UE to
insert a valid user identifier in the From header, and the S-CSCF can
change it if privacy is desired, on a session-by-session basis,
based on whatever rules the S-CSCF wants to follow.

Comments?

Bill Marshall
[email-masked]

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Miguel A. Garcia" <[email-masked]>
Date: Wed, 17 Apr 2002 12:50:07 +0300

Hi Bill:

This is just to state that you made a very good summary of the situation
with 3GPP and I agree with your final conclusion.

If we don't go for such a solution we may risk the case when neither the
user nor the network (or regulator) required privacy. If we require the
endpoints to start sessions anonymously, just in case...  then the 
session will be anonymous even when not needed.

Therefore, I would like to see a consensus on Bill's proposal: Users
identify theirselves in the From (UAC), the proxy MAY anonymize the 
From if the policy (or the regulator) requires it.

/Miguel

-- 
Miguel-Angel Garcia                     Oy LM Ericsson AB
                                        Jorvas, Finland
mailto:[email-masked]     Phone:  +358 9 299 3553
mailto:[email-masked]        Mobile: +358 40 5140002

---

From: "Dean Willis" <[email-masked]>
Date: Wed, 17 Apr 2002 11:35:38 -0500

> problem with a proxy modifying the display-name or addr-spec in

I disagree. I don't want the network mangling my user-to-user headers
unless I've specifically requested it to do so. Specifically, the
non-authenticated, non-mangled, non-protected From: field offers utility
which is DIFFERENT than that provided by network authenticated calling
party ID, and I don't want to sacrifice that utility just because this
is a capability the widely-deployed PSTN (as opposed to say Q.SIG)
didn't have . . .

--
Dean