Re: Last Call: <draft-atarius-dispatch-meid-urn-as-instanceid-05.txt> (Using the Mobile Equipment Identity (MEID) Uniform Resource Name (URN) as an Instance ID) to Informational RFC

[R Atarius <[e-mail]>]

Hi
Just agreeing with Ben. RFC 5626 highlights that the UA could omit the instance ID for private or anonymous calls. So this is the problem with instance ID and not UUID, MEID, IMEI which have been employed to create the instance ID.
ThanksRoozbeh

      From: Ben Campbell <[e-mail]>
 To: Stephen Farrell <[e-mail]> 
Cc: [e-mail]; [e-mail]; [e-mail]
 Sent: Thursday, November 2, 2017 10:57 PM
 Subject: Re: Last Call: <draft-atarius-dispatch-meid-urn-as-instanceid-05.txt> (Using the Mobile Equipment Identity (MEID) Uniform Resource Name (URN) as an Instance ID) to Informational RFC
   


> On Nov 2, 2017, at 8:17 PM, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Hiya,
> 
> I don't claim to fully understand the usage of this ID,
> but I'm quite sure that I have no clue what this text
> is supposed to mean (as a piece of specification):
> 
>  "In particular, the "sip.instance" media feature tag
>  containing the 3GPP2 MEID URN MUST NOT be included in requests or
>  responses intended to convey any level of anonymity, as this could
>  violate the users privacy."
> 
> I guess this is either an existing problem with whatever
> a "'sip.instance' media feature tag" really is or else this
> draft creates a new problem, but the quoted text seems to
> me to be non-deterministic impossible-to-program-for words
> seemingly about (but not actually helping with) privacy.
> 
> Am I confused?

Possibly, but only because it’s confusing :-)

As S. Moonesamy pointed out separately, this draft borrows quite a bit of language from RFC 7255, which was pretty much the same things for IMEIs.

RFC 3261 (SIP) and a few related RFCs (especially 3323) talk about placing anonymous calls. The point here is that, when a user is trying to place an anonymous call, don’t screw up and stick identifying information somewhere else in the request.  I suspect (but do not know) that the language “any level of anonymity” originally came from the distinction between  “user-provided privacy” vs “network-provided privacy” discussed in RFC 3323.

The “sip.instance” media feature tag is defined in RFC 5626. It carries a URL to persistently identify a specific SIP user agent. That RFC contains guidance to not use the sip.instance tag for anonymous requests or responses, i.e. when you don’t want to the UA to reveal its identity.

Would citations help?

(Authors, feel free to jump in).

Thanks!

Ben.


> 
> Cheers,
> S.
> 
> On 02/11/17 22:43, The IESG wrote:
>> 
>> The IESG has received a request from an individual submitter to consider the
>> following document: - 'Using the Mobile Equipment Identity (MEID) Uniform
>> Resource Name (URN)
>>  as an Instance ID'
>>  <draft-atarius-dispatch-meid-urn-as-instanceid-05.txt> as Informational RFC
>> 
>> The IESG plans to make a decision in the next few weeks, and solicits final
>> comments on this action. Please send substantive comments to the
>> [e-mail] mailing lists by 2017-12-08. Exceptionally, comments may be
>> sent to [e-mail] instead. In either case, please retain the beginning of
>> the Subject line to allow automated sorting.
>> 
>> Abstract
>> 
>> 
>>  This specification specifies how the Uniform Resource Name (URN)
>>  namespace reserved for the Third Generation Partnership Project 2
>>  (3GPP2) identities and its Namespace Specific String (NSS) for the
>>  Mobile Equipment Identity (MEID) can be used as an instance-id.  Its
>>  purpose is to fulfill the requirements for defining how a specific
>>  URN needs to be constructed and used in the "+sip.instance" Contact
>>  header field parameter for outbound behavior.
>> 
>> 
>> 
>> 
>> The file can be obtained via
>> https://datatracker.ietf.org/doc/draft-atarius-dispatch-meid-urn-as-instanceid/
>> 
>> IESG discussion can be tracked via
>> https://datatracker.ietf.org/doc/draft-atarius-dispatch-meid-urn-as-instanceid/ballot/
>> 
>> 
>> No IPR declarations have been submitted directly on this I-D.
>> 
>> 
>> 
>> 
>> 
>