Re: [Insipid] I-D Action: draft-ietf-insipid-session-id-23.txt

["Ben Campbell" <[e-mail]>]

On 29 Jun 2016, at 15:10, Paul Giralt (pgiralt) wrote:

>>
>> That text talks about when the UUID MUST NOT change. I'm looking for 
>> text that says a UUID value MUST NOT be reused across multiple 
>> "sessions" (as sessions are defined in this draft.) The point is to 
>> avoid an accidentally persistent identifier that could be used to 
>> track user/UA activity across multiple sessions.
>
> I see where you are coming from now. I hadn’t payed attention to the 
> fact that the text in 4.2 is not normative. Currently the section 
> reads:
>
> 	The SIP User Agent (UA) initiating a new session by transmitting a 
> SIP
>          request ("Alice"), i.e., a User Agent Client (UAC), will 
> create a new,
>          previously unused, UUID and transmit that to the ultimate 
> destination UA
>          ("Bob").  Likewise, the destination UA ("Bob"), i.e., a User 
> Agent Server (UAS),
>          will create a UUID and transmit that to the first UA 
> ("Alice").
>
> If I just change the “will” to MUST and expand on the UAS also 
> having to create a previously-unused UUID like below, does this 
> address the concern?
>
> 	The SIP User Agent (UA) initiating a new session by transmitting a 
> SIP
>          request ("Alice"), i.e., a User Agent Client (UAC), MUST 
> create a new,
>          previously unused, UUID and transmit that to the ultimate 
> destination UA
>          ("Bob").  Likewise, the destination UA ("Bob"), i.e., a User 
> Agent Server (UAS),
>          MUST create a new, previously unused, UUID and transmit that 
> to the
> 	first UA ("Alice").
>
> Alternatively, I could add some normative text in Section 6 for 
> endpoint behavior, but I think just modifying the above should address 
> the concern. Please let me know your thoughts.
>
> -Paul

That, plus a sentence or two in the security considerations section 
talking about how that helps avoid cross-session persistent identifiers, 
would work for me.

Thanks!

Ben.