Subject: RE: [Sip] REFER security options - removing Referred-By

From: "Rosen, Brian" <[email-masked]>
Date: Mon, 22 Apr 2002 10:20:56 -0400

Y'know, sometimes I (personally, not as chair) think we take
the security argument just a little too far.

Sure, I can finagle the From, but Referred-By is the header
I want to use in my GUI.  I'll attach no more credence to it
then I get from FROM unless it's authenticated, but it's damn
useful to display to a user.

We have it implemented, we like it, and I'm keeping it.

Let's leave it in and define it, like FROM, as informational
only.

Or shall we remove FROM on the same basis?

Brian

> -----Original Message-----
> From: Ben Campbell [mailto:[email-masked]]
> Sent: Monday, April 22, 2002 9:48 AM
> To: [email-masked]; Adam Roach
> Cc: 'Elwell, John'; [email-masked]; Robert Sparks;
> [email-masked]
> Subject: RE: [Sip] REFER security options - removing Referred-By
> 
> 
> 
> 
> > -----Original Message-----
> > From: [email-masked] [mailto:[email-masked]]On Behalf Of
> > [email-masked]
> > Sent: Friday, April 19, 2002 1:50 PM
> > To: Adam Roach
> > Cc: 'Elwell, John'; [email-masked]'; Robert Sparks;
> > [email-masked]
> > Subject: RE: [Sip] REFER security options - removing Referred-By
> >
> >
> >
> >  The information could be useful because C could 
> authenticate the identity
> > outside of the SIP protocol if that is felt necesary. In 
> many cases such
> > authentication is not required. There can be other means
> > extra-protocol  of
> > dealing with abusive callers.
> >
> 
> I'm not sure I see the connection between the last two 
> sentences? How would
> one make use of an unauthenticated referred-by in dealing with abusive
> callers? I would tend to expect that abusive callers would be 
> very likely
> spoof refered-by headers if it is allowed.
> 
> I can accept the idea of referred-by being useful _if_ the 
> endpoint has
> another channel of authentication. I am skeptical about any 
> real use of it
> without authentication.
> 
> Considering that Robert's original question was not, "is 
> there a use for an
> unauthenticated refered-by?" but was instead "Is there use 
> for refer if it
> is published without referred-by?" with the understanding that a solid
> referred-by header would be the subject of future work. From that
> perspective, I have to agree with Adam's belief that 
> referred-by should be
> removed from the current draft.
> 
> 
> >
> >
> >
> >
> >
> > Adam Roach <[email-masked]>@ietf.org on 04/19/2002 02:37:38 PM
> >
> > Sent by:  [email-masked]
> >
> >
> > To:   "'Elwell, John'" <[email-masked]>,
> >       "[email-masked]'" 
> <[email-masked]>, Robert
> >       Sparks    <[email-masked]>, [email-masked]
> > cc:
> >
> > Subject:  RE: [Sip] REFER security options - removing Referred-By
> >
> >
> > Why is such information useful if it's unauthenticated?
> >
> > Are you planning to use it to implement policy? If so,
> > inclusion of such a header only sets a trap for naive
> > implementors.
> >
> > If not, are you envisioning this information will be presented
> > to users? If that's your goal, you'll want to do something
> > that works with deployed phones. As a convention (and I'm not
> > proposing that this be standardized), you could obtain the
> > desired effect with something like:
> >
> > INVITE sip:[email-masked] SIP/2.0
> > From: "Adam Roach forwarded by Robert Sparks"
> > <sip:[email-masked]>;tag=12397
> > ...
> >
> > Right?
> >
> > I feel quite strongly that we should *not* include this sort of
> > information
> > in the current REFER draft, and work on providing an *authenticated*
> > version of this draft at a later date.
> >
> > /a
> >
> > > -----Original Message-----
> > > From: Elwell, John [mailto:[email-masked]]
> > > Sent: Wednesday, April 10, 2002 1:51
> > > To: [email-masked]'; [email-masked]; 
> [email-masked]
> > > Subject: RE: [Sip] REFER security options - removing Referred-By
> > >
> > >
> > > I agree with what Patrick Mourot says. Let's have a basic
> > > refer capability
> > > that provides an unsecured identity of A to C, and then leave
> > > it to C to
> > > decide whether and how to verify the identity of A. This will
> > > depend on
> > > whether it is attended or unattended transfer - with attended
> > > transfer the
> > > call A-C will exist and will be identified by the Replaces
> > > header. This may
> > > be sufficient, but if not, verification can be done in the
> > > context of that
> > > dialog A-C.
> > >
> > >  ---------------------------------------------------------------
> > >  John Elwell ([email-masked])
> > >  Siemens Communications Limited,
> > >  ---------------------------------------------------------------
> > >  Internet communications are not secure and therefore Siemens
> > >  Communications Limited does not accept legal 
> responsibility for the
> > >  contents of this message. Any views or opinions 
> presented are solely
> > >  those of the author and do not necessarily represent 
> those of Siemens
> > >  Communications Limited unless otherwise specifically stated.
> > >
> > >
> > >
> > > -----Original Message-----
> > > From: [email-masked] [mailto:[email-masked]]
> > > Sent: Tuesday, April 09, 2002 5:05 PM
> > > To: [email-masked]; [email-masked]
> > > Subject: RE: [Sip] REFER security options - removing Referred-By
> > >
> > >
> > >
> > > Sirs,
> > >
> > > I think there are plainty of cases where C :
> > > -will not need to know that the call was started by A read in
> > > Referred-By
> > > -or will trust B (i.e: intranet cases).
> > >
> > > Protecting Referred-By also means protecting others headers.
> > >
> > > This means that we should avoid all solutions that are 
> not optional
> > > regarding C
> > > policy.
> > >
> > > A VERIFYing approach starting at C is better suited; It
> > > allows C to decide
> > > to
> > > verify or not A identity.
> > > If C does NOT want to or does NOT support VERIFY the call
> > > flows remains
> > > consistent with current behavior.
> > >
> > > PS: Referred-By is a means for carrying some useful Information.
> > >
> > > That's my 2 cents.
> > >
> > > Best Regards,
> > >
> > > Patrick
> > >
> > >
> > > _______________________________________________
> > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > This list is for NEW development of the core SIP Protocol
> > > Use [email-masked] for questions on current sip
> > > Use [email-masked] for new developments on the 
> application of sip
> > >
> > > _______________________________________________
> > > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > > This list is for NEW development of the core SIP Protocol
> > > Use [email-masked] for questions on current sip
> > > Use [email-masked] for new developments on the 
> application of sip
> > >
> >
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments on the application of sip
> >
> >
> >
> >
> > _______________________________________________
> > Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> > This list is for NEW development of the core SIP Protocol
> > Use [email-masked] for questions on current sip
> > Use [email-masked] for new developments on the application of sip
> 
> 
> _______________________________________________
> Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
> This list is for NEW development of the core SIP Protocol
> Use [email-masked] for questions on current sip
> Use [email-masked] for new developments on the application of sip
> 

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Mon, 22 Apr 2002 08:31:24 -0700 (PDT)

> useful to display to a user.

   So you're saying that it's OK for me to be able
   to just put Kofi Anann's admin's name in the
   Referred-by header, so that I can get through
   his screening so we can chat about my thoughts
   on San Francisco annexing Canada?

   Groovy.

		    Mike

---

From: Alan Johnston <[email-masked]>
Date: Mon, 22 Apr 2002 10:59:18 -0500

I agree completely with Brian.  Many vendors have already implemented
this optional part of REFER - lets just add a sentence in the security
section then begin work on the authenticated Referred-By.

Any sort of call screening must use some other authentication scheme.
For example, in the Service Examples I-D, a proxy digest provides this
authentication - it is NEVER based on From, and should not be based on
Referred-By, either.  

Thanks,
Alan Johnston
WorldCom
sip:[email-masked]

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Rosen, Brian
> Sent: Monday, April 22, 2002 9:21 AM
> To: 'Ben Campbell'; [email-masked]; Adam Roach
> Let's leave it in and define it, like FROM, as informational only.
> 
> > > extra-protocol  of dealing with abusive callers.
> > >
> >

---

From: "Cullen Jennings" <[email-masked]>
Date: Mon, 22 Apr 2002 12:35:04 -0700

I agree with Brian on this, hopefully my phone will interoperate with his. 

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Rosen,
> Brian
> Sent: Monday, April 22, 2002 7:21 AM

---

From: "Cullen Jennings" <[email-masked]>
Date: Mon, 22 Apr 2002 14:43:59 -0700

I seem to have contradicted myself from my first transaction in this thread
to my most recent. Clearly I must be insane.

So lets separate a few issues that got me crossed up.

1) Do we need something like Referred-By at all?

2) What level of authentication security do we needed on it?

3) Do we have to solve the above two items in the REFER draft or can we work
them in a separate draft that comes after REFER.

I think RJS was originally trying to ask about 3 but I got confused and
thought we have moved to discussing 1.

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Cullen
> Jennings
> Sent: Monday, April 22, 2002 12:35 PM
> To: [email-masked]