Re: [Rucus] Combatting SPIT using IKEv2

[Pars Mutaf <[e-mail]>]

Hello,

On Fri, Sep 18, 2009 at 3:14 AM, Dan Wing <[e-mail]> wrote:
>
>
>
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]]
>> On Behalf Of Pars Mutaf
>> Sent: Friday, September 11, 2009 4:23 AM
>> To: Rucus BoF
>> Subject: [Rucus] Combatting SPIT using IKEv2
>>
>> Dear all,
>>
>> I submitted a short I-D proposing IKEv2 extensions to combat SPIT.
>> Basically they are CAPTCHA and human name certificate extensions,
>> and target user approval.
>>
>> The draft can be found here:
>>
>> http://www.freewebs.com/pmutaf/draft-mutaf-spikev2-02.txt
>>
>> Comments are welcome
>
>   One solution to SPIT is to require an IPsec SA (Security Association)
>   before a correspondent user opens a session with a target SIP URI.
>   If later the correspondent user turns bad and sends SPIT, the target
>   user can remove the SA.
>
> I don't understand.  So, I would send you an INVITE, and then you
> would challange me by doing ... <what>?


You will have to establish an IPsec security association (this is
required) with the
target phone. Using IKE extensions, the target phone will challenge
you by asking
to solve a CAPTCHA. If you want to make commercial calls or send messages to
hundreds of phones, you will have to solve hundreds of CAPTHCAs.

CAPTCHAs cannot be solved by a machine, so you cannot automatically
send spam to many target phones.

In addition to CAPTCHAs, my phone can also require your certified identity
during the IKE negociation. In this case if I don't know you, I can cancel IKE.
Since no IPsec security association is established, you can't call me
nor send IM.

Thanks,
pars

>
> -d
>
>
>
>> Regards,
>>
>> pars
>> _______________________________________________
>> Rucus mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/rucus
>
>