Re: [stir] WGLC: draft-ietf-stir-cert-delegation-02

[Russ Housley <[e-mail]>]

The US FCC released a document earlier this week: https://docs.fcc.gov/public/attachments/DOC-362932A1.pdf <https://docs.fcc.gov/public/attachments/DOC-362932A1.pdf>

This part is relevant to this document (it is arguing that STIR/SHAKEN is ready for mandatory implementation):

    We disagree with those commenters who argue that we should not move
    forward with a STIR/SHAKEN implementation mandate.  First, we
    specifically disagree with the argument that we should delay a
    mandate while industry develops technical solutions to allow the
    STIR/SHAKEN framework to accommodate certain more challenging
    scenarios.  According to some commenters, the standards for
    attestation do not fully account for the situation where an
    enterprise subscriber places outbound calls through a voice service
    provider other than the voice service provider that assigned the
    telephone number.  In such scenarios, commenters claim, it would be
    difficult for an outbound call to receive "full" or "A" attestation
    because the outbound call will not pass through the authentication
    service of the voice service provider that controls the numbering
    resource.  We are optimistic that standards bodies, which remain
    engaged on the impact of STIR/SHAKEN on more challenging use cases
    and business models, will be able to resolve those issues just as
    they have overcome numerous other barriers to caller ID
    authentication so far.  For instance, the Internet Engineering Task
    Force (IETF) has proposed a certificate delegation solution that
    would allow the carrier who controls the numbering resource to
    delegate a credential that could be used to sign calls regardless
    of which  network or administrative domain handles the outbound
    routing for the call.  Further, granting a delay until standards
    bodies address every possible issue would risk creating an
    incentive for some parties to draw out standards-setting processes,
    to the detriment of widespread STIR/SHAKEN implementation.  In any
    event, the TRACED Act requires that voice service providers
    implement the STIR/SHAKEN framework in their IP networks and so
    the point is moot.
    
Russ

> On Mar 11, 2020, at 12:11 PM, Robert Sparks <[e-mail]> wrote:
> 
> This is a Working Group Last Call for draft-ietf-stir-cert-delegation-02
> 
> Please send your comments to the list or the chairs by Wed Apr 1. (This LC is three weeks because of the proximity to the IETF 107 week).
> 
> RjS
>