Re: [dispatch] New I-D - SPIN - on voice/video interop between app providers

[Eric Rescorla <[e-mail]>]

On Sun, Jul 24, 2022 at 7:36 AM Peterson, Jon <[e-mail]>
wrote:

>
>
> I do want to clarify that I'm not suggesting that applications should
> vouch for themselves. Rather, I am suggesting that there be a set of
> certificate authorities which require applications to do proof of
> possession and then issue them a credential which is publicly verifiable.
>
>
>
> Understood – I meant just that it’s then up to the applications themselves
> to conduct their own proof-of-possession, to exercise the routing system to
> reach themselves (at the time etc. of their choosing), versus having the
> peer who wants to communicate with them exercise the routing system. Of
> course the result will be some kind of token/credential that rolls up to a
> trust anchor, maybe a STIR-ish one; my point was more that we could
> profitably focus on who secures that token and what is secured in it, and
> then compare different architectures for distribution/discovery of such
> tokens.
>
>
Maybe a topic for live conversation, but as I understand the SPIN
architecture:

1. The originator conducts the PoP and gets a token as you describe above.
2. It used that token to sign a message that it sends to the responder via
SMS.
3. The  responder responds, proving by the fact that it does so that it
received the message in (2).

Do I have that right?
-Ekr


>



> Jon Peterson
>
> Neustar (a TransUnion company)
>
> dispatch mailing list [e-mail]
> https://www.ietf.org/mailman/listinfo/dispatch
> <https://urldefense.com/v3/__https:/www.ietf.org/mailman/listinfo/dispatch__;!!N14HnBHF!_TYntjGyg5uNCLSI_-nlD2HuOE9K-OLN5D_G2jWixsWT84fvv6ZIsEO4aFCBWl0enMPpdcIFAoY9yafOU56I$>
>
>