Subject: [Sip] Comments on draft-ietf-sip-ua-privacy-02

From: "Elwell, John" <[email-masked]>
Date: Sun, 27 Jul 2008 12:57:42 +0100

1. I think there should be something pointing out the limitations of
GRUU for obtaining an anonymous contact URI. A temporary GRUU will still
reveal the issuing domain, i.e., the domain with which the user
registers. For the From URI we specify sip:[email-masked]
(except where SIP Identity is used), but I don't see the point in this
if Contact reveals the domain.

2. In section 5.3, I think there should be a statement about sending the
SIP request to the relay server.

3. "A user agent generating an anonymous SIP message supporting this
   specification SHOULD conceal host names in any SIP headers, such as
   Call-ID and Warning headers, but it is not always regarded as
   essential privacy-sensitive information."
I don't understand what is mean by "not always regarded as essential
privacy-sensitive information". Either a host name in such a header
field is privacy-sensitive or it is not, so the word "essential" seems
redundant.

4. In the Security Considerations section, should there be mention of
the fact that a STUN relay server can introduce addition security
considerations if the signalling and/or media are not appropriately
secured, e.g., using TLS or SRTP?

5. I have a large number of editorial points, which I will submit
directly to the author.

John
_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Mayumi Munakata <[email-masked]>
Date: Thu, 31 Jul 2008 13:27:48 +0100

John,

Thank you for the comments on ua-privacy draft.

See inline.

 > GRUU for obtaining an anonymous contact URI.

Will add the text to mention it.

 > A temporary GRUU will still

That's true.  There is no point to conceal the user's
domain name in the From header if the same domain name
appears in the Contact header.

However, there is an option to use a third-party GRUU server
to get a temp-gruu that doesn't reveal the use's domain name.

Anyway, the user's domain name is not considered as
critical privacy-sensitive information in this draft.
So it should be concealed only if that doesn't ruin more
important functions such as routing and authentication.

Will fix the text to explain the above clearly.

 > SIP request to the relay server.

Will add such a statement.

 > field is privacy-sensitive or it is not, so the word "essential" seems

I mean that UA should conceal the user's host name
if that doesn't cause a problem.
Will fix the text.

 > secured, e.g., using TLS or SRTP?

Agree.  Will fix the Security Considerations section.

 > 5. I have a large number of editorial points, which I will submit

I got the editorial comments.  Thank you very much!
Will incorporate them to the next version.

Mayumi

---

From: "Elwell, John" <[email-masked]>
Date: Thu, 31 Jul 2008 18:35:05 +0100

Mayumi, 

> -----Original Message-----
> From: Mayumi Munakata [mailto:[email-masked]] 
> Sent: 31 July 2008 13:28
> To: Elwell, John
> Cc: SIP IETF
> Subject: Re: Comments on draft-ietf-sip-ua-privacy-02
> 
> John,
> 
[JRE] As discussed at the meeting, for a small enterprise the domain
name is almost certainly critical. Somebody might guess the particular
caller, or maybe just knowing the name of the enterprise is information
you don't want to disclose. Even for a large enterprise, the caller
might be guessed if the callee only knows one person or a small number
of people from that enterprise. I would say that for an enterprise the
domain name is very likely to be critical privacy-sensitive information.
I agree that for a sizeable service provider it might not be critical.

John

---

From: Shida Schubert <[email-masked]>
Date: Thu, 31 Jul 2008 22:13:33 +0100

Hi John;

  I understand for enterprise or SOHO, domain name itself
may give away who the caller is.

  We can add the text describing the implication of domain
name contained in the request for enterprise and SOHO
etc. And provide a workaround by using 3rd party Registrar
/ Proxy (anonymization service) OR we can suggest that
UA falls back to the use of privacy:header defined in
RFC3323, which doesn't ensure any assurance that you
get the privacy you desire but if there is a privacy service
along the signaling path sufficient privacy will be provided.

  I am content with suggesting the use of anonymization
service, but this will mean that depending on the call, UA
needs to distinguish the set of proxy/registrar to use based
on the user's intent/action (e.g. pushing anonymous button on the  
phone?).

  Any other suggestion for a workaround?

  Regards
   Shida