Re: [Insipid] Pre-WGLC INSIPID Session-ID Review Comments

[Christer Holmberg <[e-mail]>]

Hi Paul,

>>>>>>You need to give people technical reasons why they reasons they
>>>>>>modify Call-ID don't apply to Session-ID. "Because the draft says
>>>>>>so"
>>>>>>is not such reason :)
>>>>>
>>>>>How about we modify the first paragraph of Section 7 to read this
>>>>>way:
>>>>>
>>>>>"In order to ensure the integrity of the end-to-end session
>>>>>identifier, intermediaries, such as proxies >or session border
>>>>>controllers, MUST NOT alter the UUID values found in the Session-ID
>>>>>header, >except as described in this section."
>>>>>
>>>>>Would that help or do you think we need something else?
>>>>
>>>>Unfortunately I don't think it will help.
>>>>
>>>>No matter what the spec says, intermediaries will modify the header
>>>>field if they see a need to do so. You need to describe why such need
>>>>does not occur for the Session-ID header field.
>>>>
>>>
>>>  The reasons the Call-ID or other headers were changed at the SBC was
>>>because they revealed
>>>  specific information about the user, including device information,
>>>user identifiers, etc. The Session > Identifier is defined to be
>>>random (per section 4.1 of the solution spec). This is also spelled
>>>out in
>>>  the referenced requirements document.
>>
>>Nobody is going to read the requirements document - you need to
>>describe it in THIS document.
>
> Oh, I wasted time on a document nobody will read?!?! :-)

In the INSIPID WG we obviously read/used it as input for the Session-ID solution :)


>>>Given that, what more do we really need to say here? I'm happy to
>>>modify that sentence in some >way that helps, but I don't want to make
>>>it so complex that it gets in the way of the procedures. >Maybe we
>>>need something in the security considerations section?
>>>
>>>  I think I understand roughly what you're shooting for, but I'm not
>>>sure what we can add that
>>  doesn't confuse the text, replicate text from the requirements
>>document, etc. Can you suggest
>>  some text and where to put it?
>>
>>I think the text above, about revealing sensitive information, is good :)
>>
>>
>
> How about this?
>
> "In consideration of the fact that the Session Identifier is constructed
> in such a way as to not reveal any personal, device, or domain
> identifying information and in order to ensure the integrity of the
> end-to-end session identifier, intermediaries, such as proxies or
> session border controllers, MUST NOT alter the UUID values found in the
> Session-ID header, except as described in this section."

I would use different wording. Something like:

"The call-id often reveal personal, device, domain or other sensitive information associated
with an end-user, which is why intermediaries, such as proxies and session border
controllers alter the call-id. In order to ensure the integrity of the end-to-end
session identifier, it is constructed in a way which does not reveal such information,
removing the need for intermediaries to alter it (except as described in this section)."

Regards,

Christer