Re: [sipcore] Updated 4244bis and new call flow document

[Paul Kyzivat <[e-mail]>]

[e-mail] wrote:
> Hi Mary,
> With regard to your question for comments/review, I went thought the draft.
> 
> For http://www.ietf.org/id/draft-ietf-sipcore-rfc4244bis-01.txt 
> 
> I have the following comments: 
> 
> 
> 6.3.2.  Privacy in the History-Info Header
> 
> ...
> If the requestor has indicated a priv-
>    value of "session" or "header" in the request, all History-Info
>    entries MUST be anonymized when the request leaves a domain for which
>    the intermediary is responsible.
> ...
> 
> In this section it is mentioned that the entries must be anonymized when leaving the domain. I thought that if a trust relationship between domains are existing and the following domain secures the "privacy" then the information could be forwarded and will then deleted by the succeeding domain before reaching the terminating user. 
> Some regulators are requesting to pass identities until the last domain where it is possible to execute the privacy regarding RFC3323. So I think this is a MAY based on domain policy. And it is a MUST when the succeeding network cannot guarantee the privacy.
> 
> Or do I misunderstand the meaning of "domain for which the intermediary is responsible"

I'm not an expert on this, but ISTM that in the case you describe the 
request is not leaving the *trust* domain.

But that does point out ambiguity in the text you quote. That kind of 
wording "domain for which the intermediary is responsible" is usually 
talking about *DNS* domains, not *trust* domains. So maybe that should say:

  ...
  If the requestor has indicated a priv-value of "session" or "header"
  in the request, all History-Info entries MUST be anonymized when the
  request leaves a *trust* domain for which the intermediary is
  responsible.
  ...

	Thanks,
	Paul