[stir] Re: [new-work] WG Review: Secure Telephone Identity Revisited (stir)

["Charles Eckel (eckelcu)" <[e-mail]>]

Hi IESG and STIR WG,

I noticed an inconsistency between the scope text and the milestones.

The scope says the WG “will define informational or experimental documents” for (a) certificate transparency mechanisms and (b) extensions to out-of-band discovery mechanisms. However, the milestones for both items specify Proposed Standard. In addition, draft-ietf-stir-certificate-transparency-04 is currently with the IESG as a Proposed Standard, and the existing out-of-band and connected identity work (RFC 9888, RFC 9970) was published as Proposed Standard.

I plan to update the scope text for both items to say standards-track. If “informational or experimental” was intended for either item, we can adjust the corresponding milestone instead.

Cheers,
Charles

> On Oct 16, 2026, at 8:49 AM, The IESG <[e-mail]> wrote:
> 
> The Secure Telephone Identity Revisited (stir) WG in the Applications and
> Real-Time Area of the IETF is undergoing rechartering. The IESG has not made
> any determination yet. The following draft charter was submitted, and is
> provided for informational purposes only. Please send your comments to the
> IESG mailing list ([e-mail]) by 2026-10-26.
> 
> Secure Telephone Identity Revisited (stir)
> -----------------------------------------------------------------------
> Current status: Active WG
> 
> Chairs:
>  Ben Campbell <[e-mail]>
>  Russ Housley <[e-mail]>
> 
> Assigned Area Director:
>  Charles Eckel <[e-mail]>
> 
> Applications and Real-Time Area Directors:
>  Andy Newton <[e-mail]>
>  Charles Eckel <[e-mail]>
> 
> Mailing list:
>  Address: [e-mail]
>  To subscribe: https://www.ietf.org/mailman/listinfo/stir
>  Archive: https://mailarchive.ietf.org/arch/browse/stir/
> 
> Group page: https://datatracker.ietf.org/group/stir/
> 
> Charter: https://datatracker.ietf.org/doc/charter-ietf-stir/
> 
> ## Background and Problem Statement
> 
> The Secure Telephone Identity Revisited (STIR) Working Group specifies
> Internet-based mechanisms that allow verification of the authorization to use
> a particular telephone number through cryptographic authentication. These
> mechanisms are widely deployed in SIP-based telephony networks and are used
> to mitigate impersonation, spoofing, and other forms of unwanted or
> fraudulent communications.
> 
> Operational experience has revealed that while STIR effectively authenticates
> the event of a call and the authorization to use a telephone number, it does
> not provide a means to identify the entity behind that authorization.
> Telephone numbers are assigned to entities that may use them through multiple
> services or providers acting on their behalf, and verifiers have no
> standardized way to determine which entity a delegate certificate represents.
> Additionally, existing mechanisms do not provide transparency into credential
> issuance. This rechartering extends the Working Group's scope to address
> these gaps while preserving compatibility with existing deployments and the
> STIR trust model.
> 
> ## Scope of Work
> 
> The STIR Working Group will continue to specify and maintain the baseline
> protocols for cryptographic authentication of telephone calling party
> information using PASSporT and related mechanisms.
> 
> The Working Group will define standards-track documents to provide a means to
> associate a PASSporT with an identifier representing the entity holding the
> right to use an assigned telephone number, and will document the privacy
> implications of exposing such an association, consistent with the guidance in
> RFC 6973.
> 
> The Working Group will define informational or experimental documents to
> provide certificate transparency mechanisms for telephone identity
> credentials that improve auditability and support detection of misissuance
> within the STIR ecosystem.
> 
> The Working Group will define informational or experimental documents to
> extend existing out-of-band mechanisms for the discovery of STIR credentials
> and services associated with telephone numbers, including the application of
> connected identity in scenarios where SIP signaling is not end-to-end. The
> Working Group will consider extensions that support the use of authenticated
> telephone identity in other communications contexts, including messaging.
> 
> The Working Group will continue to leverage existing Internet security
> mechanisms, including PKI, and will coordinate with other IETF working groups
> as appropriate. It will also continue to coordinate with external standards
> bodies such as the Alliance for Telecommunications Industry Solutions (ATIS)
> and the SIP Forum on the implementation and deployment of STIR mechanisms
> (e.g., SHAKEN).
> 
> ## Out of Scope
> 
> The following items are out of scope for the STIR Working Group:
> 
> - Definition of jurisdictional or legal policy topics, including vetting
> policies, regulatory requirements, governance, or authorization frameworks. -
> Definition of governance requirements for numbering authorities, certificate
> authorities, or transparency services. - Revisiting the trust model for the
> core first-party assertion that binds a telephone number to a call, the
> assurance that the calling number is not spoofed. This assertion relies on
> the existing certificate-based, administratively-governed model, regardless
> of the certificate profile used, and alternative trust anchors or
> non-certificate identifier mechanisms for this core binding are out of scope.
> Changing this dependence on the certificate-based approach would require a
> future recharter. This does not constrain separate signers of auxiliary or
> supplementary information associated with a call, provided such information
> remains bound to and subordinate to a first-party assertion within the
> certificate-based trust model. - Any mechanism requiring changes to
> circuit-switched telephony technologies.
> 
> Milestones:
> 
>   - Submit a document that defines a mechanism for associating a PASSporT
>   with an entity identifier to the IESG for publication as a Proposed
>   Standard.
> 
>   - Submit a document that defines a certificate-transparency mechanism for
>   telephone identity credentials to the IESG for publication as a Proposed
>   Standard.
> 
>   - Submit a document to use or extend existing mechanisms to support
>   out-of-band discovery of STIR credentials and services, including
>   connected identity, to the IESG for publication as a Proposed Standard.
> 
> 
> 
> _______________________________________________
> new-work mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]