[stir] STIR/SHAKEN Privacy Concerns

[Josh Brown <[e-mail]>]

Hello All,

My name is Josh Brown. I am a student at the University of Michigan, working with Paul Grubbs. We are currently researching the STIR/SHAKEN protocol and privacy questions raised by its mandate in the United States. We have identified a few core privacy concerns both with the cryptography and within real world implementations. 

I am reaching out to the working group to ask if these concerns have been considered and whether there are any plans to rectify these issues. Of course, if we have made a mistake in our understanding of the protocol, we would be interested in improving our understanding as well.

Our first concern lies with non-repudiability in the STIR/SHAKEN protocol. In the absence of STIR/SHAKEN, there exists no cryptographic mechanism to definitively prove the occurrence of a call - only someone observing the call as it happens knows it took place. However, with the implementation of STIR/SHAKEN, originating providers sign call metadata during the creation of the PASSporT. This means that a party possessing the signature can now convince anyone a call took place - or, more precisely, convince anyone that the originating provider said the call took place. (For context, a similar non-repudiability property of DKIM signatures for emails is now regarded by many researchers as a serious design flaw.)

Our second concern is with the wide popularity of third-party authentication and verification services. Numerous companies offer these products as a service. Originating providers use the third party authentication service to generate signatures for their call metadata. Terminating providers use the third party verification service to verify said signatures and other information pertaining to the call metadata. Put simply, when using STIR/SHAKEN these third parties have complete access to all call metadata. This is concerning because call metadata is often very sensitive and the working group even has proposals to expand the amount of metadata included.

Our third concern is in the Out-of-Band SHAKEN protocol, which is used for legacy providers that use pre-digital telephony infrastructure. Out-of-Band SHAKEN requires the use of a third party that stores metadata about calls in pre-digital telephone networks. This third party has access, again, to all call metadata. 

We are interested in any and all comments. Please feel free to reply with any questions, clarifications, or corrections.

Best,
Josh