Re: [stir] I-D Action: draft-ietf-stir-certificates-13.txt

[Tony Rutkowski <[e-mail]>]

This draft is getting better.  However inquiring minds
would raise some substantive concerns about the construct
of authority over telephone numbers.

Perhaps the most significant one is the failure to cite
E.164 and related international standards as authoritative -
even though the purpose of the ID is "establishing authority
over telephone numbers."   Similarly, the chain of authority
described in section 5 is not accurate.  The identifiers are
those of the ITU and its Members pursuant to treaty
provisions, and then delegated to those Members (or in
a few cases to provider registrants directly) who in turn
delegate the administration to some entity, e.g., the NANPA.

For the U.S., the State Dept delegates the authority to the FCC
which in turn delegates it to NANPA.  Indeed, the U.S. Court of
Appeals decision a few days ago, is especially relevant here,
as it established the authority of the Commission to enable
E.164 numbers being allocated directly to VoIP providers.  See

https://www.cadc.uscourts.gov/internet/opinions.nsf/30E3C0768DB6D78C852580ED004F9935/$file/15-1497-1667619.pdf

See also, https://apps.fcc.gov/edocs_public/attachmatch/FCC-15-70A1_Rcd.pdf

On the other side of the "authority" binding, it is also
ICCs (ITU Carrier Codes) pursuant to M.1400 that are
the identifiers.  Here also in the U.S., the authority is
the U.S. State Dept which allocates it to the FCC which
in turn allocates it to NECA.  NECA is directed by the
FCC to use ATIS-0300251.  (The spec itself is not
authoritative.  It is simply informative for expressing
an identifier applicable for the U.S.)

As presently constructed, this draft seems to create its
own scheme for establishing and expressing authority
for E.164 numbers that is contrary to well established
legal and regulatory requirements domestically, regionally,
and internationally - creating its own Service Provider
Code out of thin air.  It also gives the appearance that
the IETF here is acting unilaterally as some kind of job
shop for a one-off local U.S. implementation rather
than acting as an international body.  Perhaps the ITU's
TSB and Study Group 2 can be helpful here.

--tony


On 27-Mar-17 5:59 PM, [e-mail] wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Secure Telephone Identity Revisited of the IETF.
>
>          Title           : Secure Telephone Identity Credentials: Certificates
>          Authors         : Jon Peterson
>                            Sean Turner
> 	Filename        : draft-ietf-stir-certificates-13.txt
> 	Pages           : 20
> 	Date            : 2017-03-27
>
> Abstract:
>     In order to prevent the impersonation of telephone numbers on the
>     Internet, some kind of credential system needs to exist that
>     cryptographically asserts authority over telephone numbers.  This
>     document describes the use of certificates in establishing authority
>     over telephone numbers, as a component of a broader architecture for
>     managing telephone numbers as identities in protocols like SIP.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-ietf-stir-certificates/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-ietf-stir-certificates-13
> https://datatracker.ietf.org/doc/html/draft-ietf-stir-certificates-13
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-ietf-stir-certificates-13
>
>
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> stir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/stir