Subject: trust and identity (was RE: [Sipping] new draft-ietf-sipping-isup -05 (Security))

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 16 Aug 2002 17:39:59 -0400

These problems are the subject of the identity work ongoing in the SIP
working group, including the (completed) network asserted identity draft and
my current cryptographic identity work. The approaches recommended in both
of these drafts rely on administrative domains, as controllers of the
namespace of SIP URIs, asserting that a particular user is authorized to
claim an identity.

Your pessimism about validation of electronic keys and so forth below is a
little puzzling to me. There are indeed global PKI enrollment problems, but
once we stage PKI as a function of an administrative domain, rather than an
end user, these problems become much more tractable. Then the issue is just
that a name is only as good as the administrator of the namespace. Maybe (as
you seem to suspect) end users will only trust calls that are signed by
verizon.com and its peers. Or maybe not. In any event, we are already
working towards 'protocol controls' necessary to address this need, and we
certainly invite your commentary/input on that work.

I also think your confidence in identity management within the PSTN may also
be little too unshaken. It is trivial for users to prevent their Caller-ID
from being displayed (and I don't mean by dialing *67), to use payphones and
phone cards for perfect anonymity, and if you are really up to no good it is
not exceptionally difficult to get re-usable phone numbers under false
names/addresses. Cryptography, I hope, will eventually create opportunities
for better end-to-end trust in telephony.

Jon Peterson
NeuStar, Inc.

> -----Original Message-----
> From: Michael Hammer [mailto:[email-masked]]
> Sent: Friday, August 16, 2002 1:36 PM
> To: Henry Sinnreich
> Cc: [email-masked]; [email-masked]; [email-masked]
> Subject: RE: [Sipping] new draft-ietf-sipping-isup-05 (Security)
> 
> 
> Henry,
> 
> I believe that this problem extends to other realms such as 
> in presence or 
> in ENUM.  The fundamental problem is that one is attempting to make a 
> decision about what to do with a request based on the trust 
> that the sender 
> of the request is who they purport to be.  If you are willing to 
> communicate to an anonymous person, then you do not have this problem.
> 
> In the PSTN, we probably would not give out sensitive 
> information to anyone 
> who calls us, that we can't identify by ANI or some other 
> somewhat trusted 
> means.  But, we would expect to give out things like credit 
> card numbers to 
> the store that we called, because we can trust that the call 
> got routed to 
> where we dialed it.
> 
> In the SIP world, absent some additional protocol controls, I 
> don't see how 
> I can trust that the call went to who I sent it to or that a 
> call comes 
> from who it claims to come from.  Saying that we will 
> authenticate, even 
> when using strong crypto is meaningless unless we have a 
> means to validate 
> the keys used to electronically sign the message.  Yes, it may pass 
> integrity checks.  Yes, it may have arrived from somewhere 
> confidentially.  But, who am I communicating with?
> 
> A certificate chain that leads unbroken to some organization 
> that I trust 
> to follow proven procedures for validating users and managing 
> certificate 
> security, or in combination, or substituted with some other 
> processes that 
> can be shown to have some degree of reliability, is needed.  
> The cellular 
> industry (ANSI-41 or GSM) has come up with a means of doing 
> this work to 
> some degree via their VLR/HLR infrastructure.  They are 
> likely planning 
> something for SIP-based systems.  They have been burned 
> before and have 
> learned that lesson.  But, I can't say that I get a warm 
> fuzzy over what is 
> being done elsewhere.  Not that there aren't service 
> providers out there 
> planning such security.  But, I would like to see how all 
> these systems fit 
> together into a coherent whole system.
> 
> This doesn't mean that one can not practice unsafe 
> communications.  But, I 
> hope it will be made clear to the average consumer when one 
> can trust the 
> "phone system" and when one can not.
> 
> Ultimately, this is protocol, even when some protocol is 
> technical and some 
> protocol is human process.
> 
> Mike
> 
> 
> At 11:24 AM 8/16/2002 -0500, Henry Sinnreich wrote:
> >Mike:
> >
> > >Your concern about not being able to call someone who does not know
> > >you (making authentication hard) is exactly the problem I 
> have with the
> >SIP model.
> >
> >I don't think this has to do anything with technology or protocols.
> >Party A should be able to call party B, even if they have no trust
> >association previously established, subject to policy. Except for
> >unlisted numbers. This goes for both PSTN and SIP.
> >
> >If party B is behind a gateway, on the PSTN side, you are raising
> >correctly the interesting issue who  should pay. I believe this is a
> >policy issue depending on the service. If party B is a call 
> center, then
> >party B will pay. Other policies may just not accept SIP calls from
> >unknown sources, as you mention, but this MUST NOT be a 
> protocol design
> >point, I believe.
> >
> >Henry
> >
> >-----Original Message-----
> >From: [email-masked] [mailto:[email-masked]]
> >Sent: Friday, August 16, 2002 10:23 AM
> >To: [email-masked]; [email-masked]; 
> [email-masked]
> >Subject: Re: [Sipping] new draft-ietf-sipping-isup-05 (Security)
> >
> >
> >In a message dated 8/15/02 12:11:04 PM Eastern Daylight Time,
> >[email-masked] writes:
> >
> >
> >
> >Please help me understand:
> >
> > >ISUP interworking absolutely requires authentication of the
> > >originator (SIP device or ingress gateway) by the egress GW.
> >
> >Does this mean that I cannot use my SIP device to call 
> someone who does
> >not know me? I don't tink this is acceptable, tough it would probably
> >block the telemarketers - highly desirable - but still not 
> acceptable.
> >
> >Do we have here the larger issue that IP-PSTN/ISDN 
> interworking exposes
> >PSTN/ISDN to IP-like attacks? If yes, than it should be dealt with
> >outside the SIP-ISUP context. What do y'all think?
> >
> >
> >
> >[MAP] I'm refering to the SIP to ISUP interworking case, so it means
> >that the gateway to the ISUP world needs to authenticate. Since the
> >called party in this case is in the PSTN, they function just 
> like they
> >do today - they trust the PSTN service provider they get the 
> call from.
> >
> >What it means is that you can not use your SIP device if the egress
> >gateway you try to connect through does not know you (or can't
> >authenticate you). You certainly can't expect an egress 
> gateway to use
> >its resources to make a call if it can't bill you for it.
> >
> >I'm speaking of the SIP to ISUP interworking point ("egress 
> gateway").
> >Since it is going to use ISUP on the other side and I must 
> presume that
> >no service provider with an ISUP network would tolerate any 
> one of the
> >secrurity threats described in the draft, they would insist that
> >security procedures MUST be done in that gateway. It seems 
> that the only
> >starting point for such security is to require authentication by the
> >egress gateway. In my view, this can be one of two cases:
> >
> >1. For a call originated by any random SIP user, authentication must
> >occur after the INVITE arrives and before any IAM is sent 
> into the ISUP
> >world
> >2. For a call coming from another gateway, there should already be a
> >security association, so the egress gateway can immediately 
> send an IAM
> >(authentication was already done).
> >
> >Yes, the fact that IP-PSTN interworking exposes the PSTN (ISUP is the
> >real concern) is maybe a larger issue. But I don't see 
> dealing with it
> >outside this context. It is a fundamental part of it.
> >
> >Your concern about not being able to call someone who does 
> not know you
> >(making authentication hard) is exactly the problem I have 
> with the SIP
> >model. I fail to see how this approach (claiming that 
> authentication is
> >the solution to everything) can work in a global network. Has someone
> >described an actual solution?
> >
> >Mike Pierce
> >Artel
> >
> >
> >_______________________________________________
> >Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
> >This list is for NEW development of the application of SIP
> >Use [email-masked] for questions on current sip
> >Use [email-masked] for new developments of core SIP
> 

_______________________________________________
Sipping mailing list  https://www1.ietf.org/mailman/listinfo/sipping
This list is for NEW development of the application of SIP
Use [email-masked] for questions on current sip
Use [email-masked] for new developments of core SIP

---

From: Michael Hammer <[email-masked]>
Date: Fri, 16 Aug 2002 18:29:48 -0400

Jon,

I am not pessimistic, only impatient maybe.  I am confident that we will 
get there because I don't think that a choice not to do it would be 
foolish.  I just get concerned when I get the sense (perhaps unjustly) that 
some folks would just rather that the problem go away because its not 
free.  I only want to encourage getting the infrastructure in place.

Mike