Subject: Re: [stir] Encoding considerations - multiple signatures

From: Richard Shockey <[email-masked]>
Date: Fri, 16 Oct 2015 20:19:33 -0400

+1  

Clarity is useful :-)   

There are two concepts here .. One is what the network does with the call and Two what does the user do with the call and there are multiple elements that have to make assertions about that especially in priority call scenerios.  I still think STIR/SHAKEN is no “silver bullet” its a system of interconnected elements both within the SIP networks and referenced to various user agents.

On 10/16/15, 12:12 PM, "stir on behalf of Cullen Jennings (fluffy)" <[email-masked] on behalf of [email-masked]> wrote:

>
>I think it is important there is a very clear algorithm for what the device receiving multiple signatures does with them. 
>
>I get the idea of one signature that says AT&T claims this is Cullen and another that says Cullen is allowed priority services but those are two pretty much unrelated assertions. 
>
>What I don't want is "here's a boat load of information that may or may not help a human make a decisions about what to do with this call" - we need things that make for a clear algorithm where a machine can execute a policy. 
>
>
>> On Oct 16, 2015, at 9:39 AM, Henning Schulzrinne <[email-masked]> wrote:
>> 
>> 
>> Besides the priority services case, I do believe there's a good case to be made for a dual signature during the interim:
>> 
>> (Signature 1): "Hi, I'm the carrier and attest to having originated this call"
>> 
>> (Signature 2): "Hi, I'm the alerting entity placing calls on behalf of United Airlines and I got a proof-of-possession signature from a third party. I hope you like it."
>> 
>> This allows us to deal with the exception cases without inferring more trust to UAs than Martin is prepared to do, while allowing carriers to do "blanket" signatures, regardless of the number.
>> 
>> The "signed by Bank of America" case is another example, i.e., no number-based cert at all.
>> 
>> We have also talked about separate signatures for CNAM-like pieces of the call, likely added by somebody else (such as the terminating carrier or a third-party validator) downstream of the originating carrier.
>> 
>> I don't know how common this is going to be, but I'd rather have the option now than find out that we're stuck without it, particularly in the initial phase of experimentation, partial deployment and exception cases.
>> 
>> Henning
>> 
>> From: stir <[email-masked]> on behalf of Eric Burger <[email-masked]>
>> Sent: Friday, October 16, 2015 11:27 AM
>> To: [email-masked]
>> Subject: Re: [stir] Encoding considerations
>>  
>> 
>>> (3) Multiple signatures are helpful;
>> 
>> There was talk of this. Can someone, anyone, please write down what the use case is and what it looks like and who would use it?
>> 
>> 
>> _______________________________________________
>> stir mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/stir
>
>_______________________________________________
>stir mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/stir