Subject: [Rucus] Combatting SPIT using IKEv2

From: Pars Mutaf <[email-masked]>
Date: Fri, 11 Sep 2009 14:22:50 +0300

Dear all,

I submitted a short I-D proposing IKEv2 extensions to combat SPIT.
Basically they are CAPTCHA and human name certificate extensions,
and target user approval.

The draft can be found here:

http://www.freewebs.com/pmutaf/draft-mutaf-spikev2-02.txt

Comments are welcome

Regards,

pars

---

From: "Dan Wing" <[email-masked]>
Date: Thu, 17 Sep 2009 17:14:32 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Pars Mutaf
> Sent: Friday, September 11, 2009 4:23 AM
> To: Rucus BoF
> Subject: [Rucus] Combatting SPIT using IKEv2
> 
> Dear all,
> 

   One solution to SPIT is to require an IPsec SA (Security Association)
   before a correspondent user opens a session with a target SIP URI.
   If later the correspondent user turns bad and sends SPIT, the target
   user can remove the SA.

I don't understand.  So, I would send you an INVITE, and then you
would challange me by doing ... <what>?  

-d

> Regards,
> 
> pars
> _______________________________________________
> Rucus mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rucus

---

From: Pars Mutaf <[email-masked]>
Date: Fri, 18 Sep 2009 20:10:31 +0300

Hello,

> would challange me by doing ... <what>?

You will have to establish an IPsec security association (this is
required) with the
target phone. Using IKE extensions, the target phone will challenge
you by asking
to solve a CAPTCHA. If you want to make commercial calls or send messages to
hundreds of phones, you will have to solve hundreds of CAPTHCAs.

CAPTCHAs cannot be solved by a machine, so you cannot automatically
send spam to many target phones.

In addition to CAPTCHAs, my phone can also require your certified identity
during the IKE negociation. In this case if I don't know you, I can cancel IKE.
Since no IPsec security association is established, you can't call me
nor send IM.

Thanks,
pars

---

From: "Dan Wing" <[email-masked]>
Date: Fri, 18 Sep 2009 10:44:05 -0700

> From: Pars Mutaf [mailto:[email-masked]] 
> Sent: Friday, September 18, 2009 10:11 AM
> To: Dan Wing
> Cc: Rucus BoF
> Subject: Re: [Rucus] Combatting SPIT using IKEv2
> 
> Hello,
> 
> required) with the target phone. 

So I would have to do IKE over the UDP media channel, I guess?  
That's certainly doable; afterall, that's what is described in
draft-saito-mmusic-sdp-ike-05.txt.

-d

> Using IKE extensions, the target phone will challenge
> you by asking