Re: [sipcore] Applicability of privacy "header"

[Jörgen Axell <[e-mail]>]

Multiple privacy values are normal. The question is how much and if they overlap. Of course an entity providing privacy acts on the types it understands. P-Asserted-ID is providing information about the user, but it is not added by the UE, it is added by the network. So the argument that the P-Asserted-ID is out of scope of header privacy in RFC3323 is that the RFC 3323 defined privacy service only applies to "privacy functions for SIP messages that cannot be provided by user agents themselves" and since RFC 3325 gives the UE a tool (privacy value "id") to provide privacy then P-Asserted-ID is out of scope for the privacy service defined in RFC 3323.

This is similar to why header privacy does not affect the From header field ("user" privacy is used for this). The UE can take care of this itself by setting the header to an anonymous URI.

Or do you think there is a fundamental difference between including a Privacy "id" from setting the From header field to [e-mail]?

Jörgen

From: sipcore [mailto:[e-mail]] On Behalf Of Drage, Keith (Nokia - GB)
Sent: 21 June 2017 02:13
To: Brett Tate <[e-mail]>; sipcore <[e-mail]>; Jörgen Axell <[e-mail]>
Subject: Re: [sipcore] Applicability of privacy "header"

I have to say that I think the opposite is actually the case.

The various different privacy types may be enacted by multiple different entities within the network, and each of those entities might not know which other entities in the SIP path exist. Additionally the invoking UE may want to cover all bases by including as many protections as possible. Therefore it is certainly reasonable to me that multiple privacy types can appear in the same Privacy header field.

Any entity providing privacy should therefore fulfil the semantics of the privacy type it sees, understands, and provides capability for. Given that the P-Asserted-ID clearly is a header field providing information about the user, the it should be suppressed if header privacy is enacted.

I agree it could be argued that such a header field should not be in a message where header privacy is requested, but that should not stop it being removed if it is present.

Regards

Keith

From: sipcore [mailto:[e-mail]] On Behalf Of Brett Tate
Sent: 09 June 2017 15:47
To: sipcore <[e-mail]<mailto:[e-mail]>>; Jörgen Axell <[e-mail]<mailto:[e-mail]>>
Subject: Re: [sipcore] Applicability of privacy "header"

Hi,

The following snippet from RFC 3325 section 9.3 seems applicable: “Note that a user requesting multiple types of privacy MUST include all of the requested privacy types in its Privacy header field value.”

Concerning "header", RFC 3323 indicates “server SHOULD NOT add any headers to the message that reveal any identity”.  However, my recollection is that it doesn’t prevent intermediaries from adding PAI with/without intermediary also adding privacy "id".

Thus, your interpretation sounds correct.


From: sipcore [mailto:[e-mail]<mailto:[e-mail]>] On Behalf Of Jörgen Axell
Sent: Thursday, June 08, 2017 9:30 AM
To: 'sipcore'
Subject: [sipcore] Applicability of privacy "header"

I have been involved in recent discussions on whether Privacy: "header" applies to P-Asserted-Identity, or rather whether the original meaning of RFC 3323 was that it applies to PAI. The uncertainty introduced in RFC 3323 is imported by 3GPP by explicit references.

The reason this is unclear is that RFC 3323 section 5 states that the document defines the logical role of "privacy service" and states the applicability as: "The function of a privacy service is to supply privacy functions for SIP messages that cannot be provided by user agents themselves." So in my mind the question is whether the inclusion of Privacy: "id" by a UA as specified in RFC 3325 fulfills the "provided by user agents themselves."

It makes logical sense to not cover PAI with "header" as there is a separate privacy value for this.

Anyone having a comment or knows the original intent?

Regards,
Jörgen

Dr. JÖRGEN AXELL
Senior specialist
Business Unit Cloud and IP

Ericsson
Grönlandsgatan 31
164 80 Stockholm, Sweden
Phone [phone]
Mobile [phone]
[e-mail]<mailto:[e-mail]>
www.ericsson.com<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com&d=DwQFAw&c=uiYkEnhlQB0H-gDwErXr4Q&r=8Yr-1qTsPmhitR1Vv92TJ3hY6pQbjzLOi7kQZYxxXJY&m=lop9AQtw4m7WqeALFbxQ2YwvFQ3_iQZPMYOg8m1OuFQ&s=iRz8s-E_kjz4ZfrN3DHn2THWV8TgWZu5A-gqP_qGYhM&e=>

Legal entity: Ericsson AB, registered office in Kista. This Communication is Confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.ericsson.com_email-5Fdisclaimer&d=DwMFAw&c=uiYkEnhlQB0H-gDwErXr4Q&r=8Yr-1qTsPmhitR1Vv92TJ3hY6pQbjzLOi7kQZYxxXJY&m=lop9AQtw4m7WqeALFbxQ2YwvFQ3_iQZPMYOg8m1OuFQ&s=IBineJYihvvkPriK4cufXct5XCb1f1i2SkKTGmIbKwY&e=>