Re: [Modern] Alvaro Retana's No Objection on draft-ietf-modern-problem-framework-03: (with COMMENT)

["Peterson, Jon" <[e-mail]>]

Hi Alvaro,

So, establishing which CSP is responsible for a given number today, in
traditional PSTN operations in the USA at least, is done by consulting
industry databases. Like, a national regulator delegates number blocks
down to registries which maintain databases for the industry, basically,
and CSPs then go to the registry to acquire number blocks, which they in
turn dole out to consumers. So when a CSP places a call to a number, they
query one or more of these industry databases that track how blocks and
individual numbers are delegated in order to figure out how to get to the
destination TN. 

What we intend here is to replicate those delegation structures with a
PKI. In other words, a CSP will have a credential (a la STIR) which shows
that they are the property authority for the number block that contains a
given number. Most of that protocol work is done over in STIR (see
RFC8226, say); MODERN is really just providing a framework that includes
that basic concept. Validation of the assignment chain is really a job for
STIR.

Does that help?

Jon Peterson
Neustar, Inc.

On 2/16/18, 8:59 AM, "Alvaro Retana" <[e-mail]> wrote:

>Alvaro Retana has entered the following ballot position for
>draft-ietf-modern-problem-framework-03: No Objection
>
>When responding, please keep the subject line intact and reply to all
>email addresses included in the To and CC lines. (Feel free to cut this
>introductory paragraph, however.)
>
>
>Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
>for more information about IESG DISCUSS and COMMENT positions.
>
>
>The document, along with other ballot positions, can be found here:
>https://datatracker.ietf.org/doc/draft-ietf-modern-problem-framework/
>
>
>
>----------------------------------------------------------------------
>COMMENT:
>----------------------------------------------------------------------
>
>(0) For the benefit of non-modern readers, changing the title or at least
>making it clear that "modern" refers to an acronym, and later expanding
>and
>explaining would be very nice.
>
>(1)
>
>The document mentions the need for authentication, integrity and
>confidentiality when retrieving information.  However, I didn't see
>anything
>related to verifying that in fact the CSP (for example) is the "proper
>authority" -- IOW, how can the user requesting information verify that
>the CSP
>is in fact the one responsible for the TN?  I'm thinking of the case
>where the
>CSP was assigned a TN from the numbering authority (how is that
>verified?), and
>also the portability case (4.2.3.1) where the "old CSP" is no longer
>responsible for the user's service.
>
>Given that this document is a framework, I obviously don't expect a
>solution. 
>But I think validation of the assignment chain should be included for
>consideration by future solutions.
>
>