Re: [cnit] CNIT Charter bashing..

Who would assign the confidence value?  If it's assigned by the entity that operates the calling name database, why would it ever be less than the highest possible value?  If it's set by some other entity, on what basis do they determine the value they assign?  It seems like we're going to stumble over business issues.

Tim

-----Original Message-----
From: cnit [mailto:cnit-bounces@ietf.org] On Behalf Of Brian Rosen
Sent: Friday, June 12, 2015 11:28 AM
To: Richard Shockey
Cc: philippe.fouquart@orange.com; Henning Schulzrinne; cnit@ietf.org; Stephen Farrell
Subject: Re: [cnit] CNIT Charter bashing..

One possible extra bit is that we need to know WHO signed.  That could be easy (identity in a cert for the signature), but it’s a requirement.

I still want an optional confidence value, because the source is often not authoritative.

If we’re thinking we’re using the existing display name, and coming up with a way to sign it, then, like stir, the termination side can decide what it wants to do if it gets a display name but no signature.  The sender has the option to provide the name or not, and provide the signature or not.

We COULD consider a new header that would contain the name encrypted for a destination TN (To:).  That would afford privacy to the name to middle boxes that we would not have today with display name.  I would not be opposed to that.  This would work like the offline stir proposal, where the sender obtains the public key of the recipient and encrypts the name for the recipient.

Brian

> On Jun 12, 2015, at 8:49 AM, Richard Shockey <richard@shockey.us> wrote:
> 
> 
> Henning is right. No one is forcing anything. Existing anonymous 
> calling protections still apply.
> 
> 
> Again my point is that is a great many cases Interconnected SIP 
> between NA carriers are covered by other security mechanisms.
> 
> Right now your Facetime session is totally in the clear. My concern is 
> we end up going down the rat hole of trying to create perfect end to 
> end security nothing will get done.
> 
> 
> 
> On 6/12/15, 10:17 AM, "Stephen Farrell" <stephen.farrell@cs.tcd.ie> wrote:
> 
>> 
>> 
>> On 12/06/15 15:13, Henning Schulzrinne wrote:
>>> In almost all cases of interest, the calling party *wants* to 
>>> disclose accurate information to the called party, so the privacy 
>>> issues don't seem to arise. They would only arise if there was 
>>> forced disclosure; I don't think anybody is proposing that.
>> 
>> Privacy issues could also arise if a middlebox could now see 
>> sensitive information that it previously could not see. I think that 
>> is independent of whether disclosure is desired by either of the 
>> endpoints.
>> 
>> S.
>> 
>> _______________________________________________
>> cnit mailing list
>> cnit@ietf.org
>> https://www.ietf.org/mailman/listinfo/cnit
> 
> 
> _______________________________________________
> cnit mailing list
> cnit@ietf.org
> https://www.ietf.org/mailman/listinfo/cnit

_______________________________________________
cnit mailing list
cnit@ietf.org
https://www.ietf.org/mailman/listinfo/cnit