Re: [Insipid] Pre-WGLC INSIPID Session-ID Review Comments

["Paul E. Jones" <[e-mail]>]

Christer,

------ Original Message ------
From: "Christer Holmberg" <[e-mail]>
To: "Paul E. Jones" <[e-mail]>; "Adam Gensler (agensler)" 
<[e-mail]>
Cc: "[e-mail]" <[e-mail]>
Sent: 9/12/2014 5:01:04 PM
Subject: RE: [Insipid] Pre-WGLC INSIPID Session-ID Review Comments

>Hi,
>
>>>>>You need to give people technical reasons why they reasons they
>>>>>modify Call-ID don't apply to Session-ID. "Because the draft says 
>>>>>so"
>>>>>is not such reason :)
>>>>
>>>>How about we modify the first paragraph of Section 7 to read this 
>>>>way:
>>>>
>>>>"In order to ensure the integrity of the end-to-end session
>>>>identifier, intermediaries, such as proxies >or session border
>>>>controllers, MUST NOT alter the UUID values found in the Session-ID
>>>>header, >except as described in this section."
>>>>
>>>>Would that help or do you think we need something else?
>>>
>>>Unfortunately I don't think it will help.
>>>
>>>No matter what the spec says, intermediaries will modify the header
>>>field if they see a need to do so. You need to describe why such need
>>>does not occur for the Session-ID header field.
>>>
>>
>>  The reasons the Call-ID or other headers were changed at the SBC was 
>>because they revealed
>>  specific information about the user, including device information, 
>>user identifiers, etc. The Session > Identifier is defined to be 
>>random (per section 4.1 of the solution spec). This is also spelled 
>>out in
>>  the referenced requirements document.
>
>Nobody is going to read the requirements document - you need to 
>describe it in THIS document.

Oh, I wasted time on a document nobody will read?!?! :-)


>
>>Given that, what more do we really need to say here? I'm happy to 
>>modify that sentence in some >way that helps, but I don't want to make 
>>it so complex that it gets in the way of the procedures. >Maybe we 
>>need something in the security considerations section?
>>
>>  I think I understand roughly what you're shooting for, but I'm not 
>>sure what we can add that
>>  doesn't confuse the text, replicate text from the requirements 
>>document, etc. Can you suggest
>>  some text and where to put it?
>
>I think the text above, about revealing sensitive information, is good 
>:)
>
>

How about this?

"In consideration of the fact that the Session Identifier is constructed 
in such a way as to not reveal any personal, device, or domain 
identifying information and in order to ensure the integrity of the 
end-to-end session identifier, intermediaries, such as proxies or 
session border controllers, MUST NOT alter the UUID values found in the 
Session-ID header, except as described in this section."

Paul