Re: [rtcweb] Identity and PSTN gateways

["Olle E. Johansson" <[e-mail]>]

3 apr 2012 kl. 14:58 skrev Harald Alvestrand:

> One thing that has come up repeatedly in the discussion is the claim that "you can't have a verified identity when you talk to someone via a telephone gateway" (and therefore <insert your favourite security mechanism here> is not needed / not an added benefit / other claim).
> 
> I think this is a fallacy.
> 
> Sure, as people have commented numerous times, telephone numbers are identities; they're being used as such every time someone prints them on a business card or a billboard.
> 
> When you're connecting via a gateway to the PSTN, the gateway operator gives you a guarantee that you're being connected to the right person; that's what gateways are for.
> 
> This makes for a fairly simple mapping to the "identity / identity provider" model we've been bandying about for the "full-blown" IdP / endpoint case:
> 
> The identity is the telephone number.
> The identity provider (one of many possible ones for the number) is the gateway operator.
> 
> Thus - if you call a telephone number via a gateway, you would perform a DTLS key exchange with the gateway, and an identity verification exchange with the gateway operator; you would then guarantee that the gateway operator vouches for this being a legitimate gateway function that you can reach for that number.
> 
> That's just about the best guarantee you can get when talking to the telephone system. But if we're using the IdP + DTLS-SRTP version, the exchange guarantees you that:
> a) nobody is listening in between you and the gateway (even if they snooped your signalling)
> b) the gateway operator vouches for the gateway being the right gateway to reach that number
> 
> Seems like a little bit better than what you get with SDES. Only a little.

Now we will have to separate "PSTN-emulating" gateways that accept calls to all phone numbers but play a prompt saying "You gotta be kidding me - calling a phone number?" from REAL gateways that have a connection to the PSTN world. 

Will guys connecting with SS7 have a certificate signed by the ITU as a "TRUE" PSTN provider and the voip guy in the basement next door just have a "Best effort fourth-tier PSTN service" certificate?

I think that any identity of any PSTN gateway just identifies the gateway as a server. Not as a service.

/O