From nobody Wed Mar 2 00:30:23 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DB80E1A8AF4 for ; Wed, 2 Mar 2016 00:30:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.7 X-Spam-Level: X-Spam-Status: No, score=0.7 tagged_above=-999 required=5 tests=[BAYES_50=0.8, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HlFEfEeUusaJ for ; Wed, 2 Mar 2016 00:30:19 -0800 (PST) Received: from forward14p.cmail.yandex.net (forward14p.cmail.yandex.net [IPv6:2a02:6b8:0:1465::be]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D55681A8AF2 for ; Wed, 2 Mar 2016 00:30:18 -0800 (PST) Received: from web26j.yandex.ru (web26j.yandex.ru [IPv6:2a02:6b8:0:1619::326]) by forward14p.cmail.yandex.net (Yandex) with ESMTP id 0512C2186C for ; Wed, 2 Mar 2016 11:30:10 +0300 (MSK) Received: from web26j.yandex.ru (localhost [127.0.0.1]) by web26j.yandex.ru (Yandex) with ESMTP id 5C322558166D; Wed, 2 Mar 2016 11:30:10 +0300 (MSK) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1456907410; bh=y7RtOwKuINZVdCpL277n5MMQetrq7EyEMvw5s6iD4n8=; h=From:To:Subject:Date; b=v6tqhiBYHbYSRlRsFXabxkq3sN+QrZvlojS8bVJMunKDduK13WVaGgxir1JPVWUro EGP0PIMW9xkwDpFYJ3ZQYgSYVc3LvD4XF+u9j4vvDwSgAJ2+qMUeoobH9ZorNEht+l bFFEIlhpOcMULIivdQCHDIBq6Zo7qSp/rcOPfosA= Received: by web26j.yandex.ru with HTTP; Wed, 02 Mar 2016 11:30:09 +0300 From: Anton Tveretin To: "stir@ietf.org" MIME-Version: 1.0 Message-Id: <8330911456907409@web26j.yandex.ru> X-Mailer: Yamail [ http://yandex.ru ] 5.0 Date: Wed, 02 Mar 2016 13:30:09 +0500 Content-Transfer-Encoding: 7bit Content-Type: text/plain Archived-At: Subject: [stir] Few thoughts on rfc4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Mar 2016 08:30:22 -0000 Hello All, Currently, we consider no distinction between "public" and "private" networks. Public network operator is regulated and licensed. UNI (i.e. the interface between a public network and its user, which may be a private network) has asymmetric trust, it is expected that the user trusts the network, but the network doesn't trust its user. (Think not of malicious clients but misconfigured equipment which might put the entire network at risk.) As far as I understand, the public network MUST NOT reject a call just because its source is unidentified. This is inconsistent with current I-D (verifier MUST reject some calls). I suggest some rewording...as According to local policy and regulations, the verifier either: rejects the call (in public networks, this is allowed only when explicitly requested by user), or marks the call by removing Identity header and adding a Warning header (default for public networks), or does nothing. Regards, Anton. From nobody Wed Mar 2 09:09:22 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00C921B2CB0 for ; Wed, 2 Mar 2016 09:09:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.266 X-Spam-Level: X-Spam-Status: No, score=-102.266 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yl-cIfm9h509 for ; Wed, 2 Mar 2016 09:09:19 -0800 (PST) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D4E41B2C9D for ; Wed, 2 Mar 2016 09:09:19 -0800 (PST) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.15.0.59/8.15.0.59) with SMTP id u22H34Zw019388; Wed, 2 Mar 2016 12:09:14 -0500 Received: from stntexhc12.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 21bccukeqq-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 02 Mar 2016 12:09:14 -0500 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.140]) by stntexhc12.cis.neustar.com ([::1]) with mapi id 14.03.0279.002; Wed, 2 Mar 2016 12:09:13 -0500 From: "Peterson, Jon" To: Anton Tveretin , "stir@ietf.org" Thread-Topic: [stir] Few thoughts on rfc4474bis Thread-Index: AQHRdF3GoOdvamTJJU6u4SMqx1mY8p9GMW4A Date: Wed, 2 Mar 2016 17:09:12 +0000 Message-ID: References: <8330911456907409@web26j.yandex.ru> In-Reply-To: <8330911456907409@web26j.yandex.ru> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.7.151005 x-originating-ip: [192.168.128.51] Content-Type: text/plain; charset="us-ascii" Content-ID: <6503842EBDE5CB4F89115208583B03D5@neustar.biz> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-03-02_09:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1601100000 definitions=main-1603020311 Archived-At: Subject: Re: [stir] Few thoughts on rfc4474bis X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 02 Mar 2016 17:09:21 -0000 I don't think I agree with your reading here, in a number ways. The fact that there is a trust relationship between the user and their communication services provider is built into SIP, and into RFC4474bis. It is why the authentication and verification services can be implemented as network services by CSPs, and thus the providers themselves in those architectures choose to deploy private, or preferably cryptographically secured, connections to user agents or to deploy public, unsecured ones. There's no need to formally distinguish those environments in RFC4474bis; this is just a protocol design, it's not prescribing any network architecture. The question of whether a "public network" is required to not reject unidentified calls sounds like some regulatory or policy question that STIR won't take sides on. RFC4474bis says explicitly those questions are matters of policy: see the last paragraph of 4.2, "this specification does not propose any authorization policy... to follow based on the presence of a valid Identity header, the presence of an invalid Identity header, or the absence of an Identity header". There is no need to reword that language to differentiate public or private networks, or to say that calls be blocked if user preferences allow it. It is definitely true that different providers might implement different policies, and that some might take user preferences into account, but that is not in the scope of RFC4474bis, and nothing about the protocol design will change in environments where providers adopt those policies. Npw, the current I-D does say that implementations of the verifier role MUST reject SIP requests under limited circumstances, but explicitly not because the source is unidentified. it's in cases where, for example, there is a signature but the signature is malformed, due to an protocol error or tampering. SIP user agent reject all kinds of requests in cases where there are protocol error: if there was a malformed Contact header, say, a user agent implementation might reject that too, regardless of whether its source was identified or not. "Reject" here also doesn't mean "block," it is a protocol-level error that is potentially a recoverable error; a case where the user agent can resubmit a request if it can be repaired. Call blocking is a policy decision; this is just basic protocol operation.=20 Jon Peterson Neustar, Inc. On 3/2/16, 12:30 AM, "stir on behalf of Anton Tveretin" wrote: >Hello All, >Currently, we consider no distinction between "public" and "private" >networks. Public network operator is regulated and licensed. >UNI (i.e. the interface between a public network and its user, which may >be a private network) has asymmetric trust, it is expected that the user >trusts the network, but the network doesn't trust its user. (Think not of >malicious clients but misconfigured equipment which might put the entire >network at risk.) >As far as I understand, the public network MUST NOT reject a call just >because its source is unidentified. This is inconsistent with current I-D >(verifier MUST reject some calls). I suggest some rewording...as >According to local policy and regulations, the verifier either: rejects >the call (in public networks, this is allowed only when explicitly >requested by user), or marks the call by removing Identity header and >adding a Warning header (default for public networks), or does nothing. >Regards, >Anton. > >_______________________________________________ >stir mailing list >stir@ietf.org >https://www.ietf.org/mailman/listinfo/stir From nobody Thu Mar 10 13:17:54 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 3EDC212DC4C; Thu, 10 Mar 2016 13:17:52 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Meeting Session Request Tool\"" To: X-Test-IDTracker: no X-IETF-IDTracker: 6.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160310211752.27367.24842.idtracker@ietfa.amsl.com> Date: Thu, 10 Mar 2016 13:17:52 -0800 Archived-At: Cc: stir@ietf.org, alissa@cooperw.in, stir-chairs@ietf.org, smccammon@amsl.com Subject: [stir] stir - Update to a Meeting Session Request for IETF 95 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2016 21:17:53 -0000 An update to a meeting session request has just been submitted by Stephanie McCammon, on behalf of the stir working group. --------------------------------------------------------- Working Group Name: Secure Telephone Identity Revisited Area Name: Applications and Real-Time Area Session Requester: Stephanie McCammon Number of Sessions: 2 Length of Session(s): 1.5 Hours, 1 Hour Number of Attendees: 40 Conflicts to Avoid: First Priority: acme tls ecrit avtcore dane siprec p2psip rtcweb mmusic sipcore dispatch appsawg ice modern Second Priority: oauth jose saag ace uta cose tcpinc clue netvc slim perc Special Requests: --------------------------------------------------------- From nobody Fri Mar 11 15:07:00 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E14BA12DE1A; Fri, 11 Mar 2016 15:05:34 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , X-Test-IDTracker: no X-IETF-IDTracker: 6.16.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160311230534.15028.96917.idtracker@ietfa.amsl.com> Date: Fri, 11 Mar 2016 15:05:34 -0800 Archived-At: Cc: stir@ietf.org, alissa@cooperw.in Subject: [stir] stir - Requested sessions have been scheduled for IETF 95 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Mar 2016 23:05:35 -0000 Dear Robert Sparks, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. stir Session 1 (1:30:00) Tuesday, Afternoon Session III 1740-1910 Room Name: Quebracho B size: 75 --------------------------------------------- stir Session 2 (1:00:00) Thursday, Afternoon Session II 1620-1720 Room Name: Buen Ayre A size: 125 --------------------------------------------- Request Information: --------------------------------------------------------- Working Group Name: Secure Telephone Identity Revisited Area Name: Applications and Real-Time Area Session Requester: Robert Sparks Number of Sessions: 2 Length of Session(s): 1.5 Hours, 1 Hour Number of Attendees: 40 Conflicts to Avoid: First Priority: acme tls ecrit avtcore dane siprec p2psip rtcweb mmusic sipcore dispatch appsawg ice modern Second Priority: perc slim netvc clue tcpinc cose uta ace saag jose oauth Special Requests: --------------------------------------------------------- From nobody Mon Mar 21 13:16:44 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EDC2112DB1C; Mon, 21 Mar 2016 13:16:40 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160321201640.12195.56862.idtracker@ietfa.amsl.com> Date: Mon, 21 Mar 2016 13:16:40 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-certificates-03.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2016 20:16:41 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Secure Telephone Identity Credentials: Certificates Authors : Jon Peterson Sean Turner Filename : draft-ietf-stir-certificates-03.txt Pages : 18 Date : 2016-03-21 Abstract: In order to prevent the impersonation of telephone numbers on the Internet, some kind of credential system needs to exist that cryptographically proves authority over telephone numbers. This document describes the use of certificates in establishing authority over telephone numbers, as a component of a broader architecture for managing telephone numbers as identities in protocols like SIP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-certificates-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-certificates-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 21 13:54:45 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C8FB12DB54 for ; Mon, 21 Mar 2016 13:54:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yr9xdEOrCMes for ; Mon, 21 Mar 2016 13:54:43 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EA4E412DB61 for ; Mon, 21 Mar 2016 13:54:42 -0700 (PDT) Received: from unnumerable.local (pool-173-57-158-165.dllstx.fios.verizon.net [173.57.158.165]) (authenticated bits=0) by nostrum.com (8.15.2/8.14.9) with ESMTPSA id u2LKsgaj006706 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=OK) for ; Mon, 21 Mar 2016 15:54:42 -0500 (CDT) (envelope-from rjsparks@nostrum.com) X-Authentication-Warning: raven.nostrum.com: Host pool-173-57-158-165.dllstx.fios.verizon.net [173.57.158.165] claimed to be unnumerable.local To: stir@ietf.org From: Robert Sparks Message-ID: <56F05F92.10209@nostrum.com> Date: Mon, 21 Mar 2016 15:54:42 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Archived-At: Subject: [stir] Draft agenda: Stir @ IETF 95 X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2016 20:54:44 -0000 Subject to tweaking: STIR: IETF 95 Tuesday, Afternoon Session III 1740-1910 : Quebracho B 5m Administrivia 10m Overview of changes across the WG documents : Sean Turner 30m draft-ietf-stir-rfc4474bis : Jon Peterson 30m draft-ietf-stir-passport : Chris Wendt 15m Passport extensibility: Jon Peterson Thursday, Afternoon Session II 1620-1720 : Buen Ayre A 5m Administrivia 45m draft-ietf-stir-certificates : Jon Peterson 10m Next steps See also: https://datatracker.ietf.org/meeting/95/materials.html#stir From nobody Mon Mar 21 14:59:42 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AFA912D0B4; Mon, 21 Mar 2016 14:59:41 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160321215941.12227.9499.idtracker@ietfa.amsl.com> Date: Mon, 21 Mar 2016 14:59:41 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-rfc4474bis-08.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Mar 2016 21:59:41 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Authenticated Identity Management in the Session Initiation Protocol (SIP) Authors : Jon Peterson Cullen Jennings Eric Rescorla Chris Wendt Filename : draft-ietf-stir-rfc4474bis-08.txt Pages : 36 Date : 2016-03-21 Abstract: The baseline security mechanisms in the Session Initiation Protocol (SIP) are inadequate for cryptographically assuring the identity of the end users that originate SIP requests, especially in an interdomain context. This document defines a mechanism for securely identifying originators of SIP requests. It does so by defining a SIP header field for conveying a signature used for validating the identity, and for conveying a reference to the credentials of the signer. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-rfc4474bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-rfc4474bis-08 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-rfc4474bis-08 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Mar 23 13:25:40 2016 Return-Path: X-Original-To: stir@ietf.org Delivered-To: stir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 13D6A12D80E; Wed, 23 Mar 2016 13:25:39 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.17.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20160323202539.5912.11504.idtracker@ietfa.amsl.com> Date: Wed, 23 Mar 2016 13:25:39 -0700 Archived-At: Cc: stir@ietf.org Subject: [stir] I-D Action: draft-ietf-stir-passport-01.txt X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 23 Mar 2016 20:25:39 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Secure Telephone Identity Revisited of the IETF. Title : Persona Assertion Token Authors : Chris Wendt Jon Peterson Filename : draft-ietf-stir-passport-01.txt Pages : 18 Date : 2016-03-23 Abstract: This document defines a token format for verifying with non- repudiation the sender of and authorization to send information related to the originator of personal communications. A cryptographic signature is defined to protect the integrity of the information used to identify the originator of a personal communications session (e.g. the telephone number or URI) and verify the accuracy of this information at the destination. The cryptographic signature is defined with the intention that it can confidently verify the originating persona even when the signature is sent to the destination party over an unsecure channel. The Persona Assertion Token (PASSporT) is particularly useful for many personal communications applications over IP networks and other multi-hop interconnection scenarios where the originating and destination parties may not have a direct trusted relationship. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-stir-passport/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-stir-passport-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-passport-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu Mar 24 10:15:44 2016 Return-Path: X-Original-To: stir@ietfa.amsl.com Delivered-To: stir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBBB312D69C for ; Thu, 24 Mar 2016 10:15:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.6 X-Spam-Level: X-Spam-Status: No, score=-102.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8gA3RFOvWoYJ for ; Thu, 24 Mar 2016 10:15:40 -0700 (PDT) Received: from mx0b-0018ba01.pphosted.com (mx0b-0018ba01.pphosted.com [67.231.157.90]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4458E12D1D8 for ; Thu, 24 Mar 2016 10:15:40 -0700 (PDT) Received: from pps.filterd (m0049401.ppops.net [127.0.0.1]) by m0049401.ppops.net-0018ba01. (8.16.0.11/8.16.0.11) with SMTP id u2OHDN2T006326 for ; Thu, 24 Mar 2016 13:15:35 -0400 Received: from stntexhc10.cis.neustar.com ([156.154.17.216]) by m0049401.ppops.net-0018ba01. with ESMTP id 21vjy0gn8j-7 (version=TLSv1 cipher=AES128-SHA bits=128 verify=NOT) for ; Thu, 24 Mar 2016 13:15:35 -0400 Received: from STNTEXMB10.cis.neustar.com ([169.254.5.230]) by stntexhc10.cis.neustar.com ([169.254.4.143]) with mapi id 14.03.0279.002; Thu, 24 Mar 2016 13:15:31 -0400 From: "Peterson, Jon" To: "stir@ietf.org" Thread-Topic: STIR update Thread-Index: AQHRhfDFE/m+CHVjFkWEf09fp8QOYA== Date: Thu, 24 Mar 2016 17:15:31 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/14.5.7.151005 x-originating-ip: [192.168.128.33] Content-Type: multipart/alternative; boundary="_000_D3196EC1183BC1jonpetersonneustarbiz_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2016-03-24_07:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1601100000 definitions=main-1603240264 Archived-At: Subject: [stir] STIR update X-BeenThere: stir@ietf.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: Secure Telephone Identity Revisited List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Mar 2016 17:15:42 -0000 --_000_D3196EC1183BC1jonpetersonneustarbiz_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable In advance of the Buenos Aires meeting, Chris and I have updated the core S= TIR specifications. rfc4474bis and stir-passport are now in closer alignmen= t, though I'm sure there are still a few remaining places where synchroniza= tion is needed. We tried to make the extensibility model much clearer: what= used to be "spec" or "type" is now "ppt", and front-line extensibility is = largely based on using the "ppt" attribute to signal that you've gone beyon= d the "bare minimum." Also, do note that the new rfc4474bis introduced a sm= all fix in order to handle networks that alter the Date header in transit (= if you do that, your network is bad and you should feel bad, btw). But ther= e shouldn't be any shocking changes in here, this is pretty much just conti= nuing the alignment process that the last revisions started. Sean and I also issued a new version of stir-certs. I think this version do= es a better job of explaining the various ways to use certs with STIR, and = explicitly leaves open doors that people seem to want to use. Finally, to demonstrate how we think the extensibility model is supposed to= work, Chris and I wrote a draft that extends STIR with a "cna" parameter t= hat can secure the display name of a caller. That spec is draft-peterson-st= ir-cnam. Securing display name is specifically out of scope of the STIR wor= king group, a provision we created when there was an active "cnit" effort u= nderway, but we're not necessarily seeking a charter update at this point -= we just want to make sure that we at least understand how extensibility is= supposed to work, and this example seemed like the lowest-hanging fruit. Happy to talk about this here on the list, or in Buenos Aires. Jon Peterson Neustar, Inc. --_000_D3196EC1183BC1jonpetersonneustarbiz_ Content-Type: text/html; charset="us-ascii" Content-ID: <4B1751F78BF8E542A76FA90D16ABE8BF@neustar.biz> Content-Transfer-Encoding: quoted-printable

In advance of the Buenos Aires meeting, Chris and I have updated the c= ore STIR specifications. rfc4474bis and stir-passport are now in closer ali= gnment, though I'm sure there are still a few remaining places where synchr= onization is needed. We tried to make the extensibility model much clearer: what used to be "spec"= ; or "type" is now "ppt", and front-line extensibility = is largely based on using the "ppt" attribute to signal that you'= ve gone beyond the "bare minimum." Also, do note that the new rfc= 4474bis introduced a small fix in order to handle networks that alter the Date hea= der in transit (if you do that, your network is bad and you should feel bad= , btw). But there shouldn't be any shocking changes in here, this is pretty= much just continuing the alignment process that the last revisions started.

Sean and I also issued a new version of stir-certs. I think this versi= on does a better job of explaining the various ways to use certs with STIR,= and explicitly leaves open doors that people seem to want to use.

Finally, to demonstrate how we think the extensibility model is suppos= ed to work, Chris and I wrote a draft that extends STIR with a "cna&qu= ot; parameter that can secure the display name of a caller. That spec is dr= aft-peterson-stir-cnam. Securing display name is specifically out of scope of the STIR working group, a provision we cre= ated when there was an active "cnit" effort underway, but we're n= ot necessarily seeking a charter update at this point - we just want to mak= e sure that we at least understand how extensibility is supposed to work, and this example seemed like the lowest-hanging fruit= .

Happy to talk about this here on the list, or in Buenos Aires.

Jon Peterson
Neustar, Inc.
--_000_D3196EC1183BC1jonpetersonneustarbiz_--