Subject: [Sip] REFER security options - removing Referred-By

From: Robert Sparks <[email-masked]>
Date: 04 Apr 2002 10:41:52 -0600

I want to explore the option of removing Referred-By a little.

As the refer-sec-options draft points out, traditional phone
systems don't provide the kind of information Referred-By is
trying to provide during a transfer. We've set our goals higher
for SIP transfer, which is a good thing to do, but is it necessary
for a base version of the application? Would a transfer application
that didn't tell the transfer target who initiated the transfer be
sufficient?

Perhaps the Referred-By functionality should be an extension (Requires:)
to REFER instead of part of its base definition?

This would remove the security issue with base REFER (B's triggered
request would be indistinguishable from a request that B initiated on
its own - there is no claim in the request that the request exits
because A asked for it to happen). 

The current work on securing Referred-By would continue in an extension
draft, but advancement of REFER would not be blocked on its completion.

RjS

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Cullen Jennings" <[email-masked]>
Date: Thu, 4 Apr 2002 19:55:02 -0800

Sounds reasonable to me. I think it would be possible to phrase the draft in
a way that when we add in a Referred-By that it does not need a Requires and
that REFERs without a Referred-By are just treaded as the Referred-By as
unknown or anonymous.

Cullen

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Robert
> Sparks
> Sent: Thursday, April 04, 2002 8:42 AM
> To: [email-masked]
> Subject: [Sip] REFER security options - removing Referred-By
>
>

---

From: Alan Johnston <[email-masked]>
Date: Fri, 05 Apr 2002 14:36:39 -0600

Robert,

I have two big problems with this proposal.

The first is that a UA can treat a Referred-By header the same as it can
a From header, since both are equally unverified and authenticated.  If
a UA is doing call screening, it can't possibly use From headers, and it
can't use Referred-By - it must use some other mechanism.  If
Referred-By is "bad" then so is "From" - which of course is ridiculous.
I would support work on an extension to REFER to allow authenticated
Referred-By, but this doesn't preclude the use of an authenticated
Referred-By.

I agree that we are all working to provide "better than PSTN" services
and features.  If we strip the Referred-By header now, and instead add
it back as an extension, there will always be implementations that don't
include it, and as a result very useful "better than PSTN" functionality
will be lost.

I would suggest a explanation in the document that basically says that
Referred-By is about as trustworthy as From - no more, no less.

Thanks,
Alan Johnston
sip:[email-masked]
WorldCom

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Robert Sparks
> Sent: Thursday, April 04, 2002 10:42 AM
> To: [email-masked]
> trying to provide during a transfer. We've set our goals 
> higher for SIP transfer, which is a good thing to do, but is 
> it necessary for a base version of the application? Would a 
> transfer application that didn't tell the transfer target who 
> initiated the transfer be sufficient?
> 
> Perhaps the Referred-By functionality should be an extension 
> (Requires:) to REFER instead of part of its base definition?
> 
> This would remove the security issue with base REFER (B's 
> triggered request would be indistinguishable from a request 
> that B initiated on its own - there is no claim in the 
> request that the request exits because A asked for it to happen). 
> 
> The current work on securing Referred-By would continue in an 
> extension draft, but advancement of REFER would not be 
> blocked on its completion.
> 
> 
> RjS
> 
> 
> Use [email-masked] for questions on current 
> sip Use [email-masked] for new developments on the 
> application of sip
>

---

From: Robert Sparks <[email-masked]>
Date: 05 Apr 2002 14:55:23 -0600

> Referred-By, but this doesn't preclude the use of an authenticated

You meant unauthenticated in the last phrase, right?

This is an interesting point. The basic set of "bad things" that
someone could do by providing bogus Referred-By headers can be done
by providing bogus From headers. These things are only bad if something
is basing a processing decision based on the contents of the respective
headers.

Of course, there have been people arguing that using any information
in From: to make decisions without something some proof of identity
(either PKIish or trusted-3rd-party introduction-ish) is bad...