Re: [stir] Definition of STIR

[Richard Shockey <[e-mail]>]

 

Ok Christer I don’t want to sound snarky but when you refer to ATIS you are actually referring to the Joint ATIS SIP Forum Network to Network Task Force that has done most of the SHAKEN framework.

 

The design of this TF was done specifically to permit the widest possible participation by institutions that typically are not ATIS members.  Many of them are other national regulatory authorities that I’m in regular contact with. The latest being COMREG in Ireland.

 

 In no way am I being critical of ATIS.  As a SDO ATIS has their business model the SIP Forum and IETF has their own.  This Joint Venture has proven to be invaluable to both organizations. 

 

I’m very very grateful for this ongoing partnership. 

 

We, the SIP Forum, agreed to use many of  the excellent ATIS secretariat functions in the interest of efficiency.  All of our documentation is publicly available.

 

You are probably aware that the SIP Forum runs the largest conference on Call Authentication anywhere.

 

https://www.sipforum.org/news-events/sipnoc-2022-overview/schedule/

 

 

And as a practical matter the chairs of the ATIS SIP Forum NNI TF  Martin Dolly and Chris Wendt are both members of my Board of Directors. And yes Ericsson is well represented as well. 

 

 

https://www.sipforum.org/about/board-of-directors/

 

 

 

— 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

www.sipnoc.org  (2022)

richard<at>shockey.us

Skype-Linkedin-Facebook –Twitter  rshockey101

PSTN [phone]

 

 

From: Christer Holmberg <[e-mail]>
Date: Thursday, May 12, 2022 at 3:35 PM
To: Richard Shockey <[e-mail]>, Robert Sparks <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: RE: [stir] Definition of STIR

 

Hi,

 

At least in my experience, ”RTCWEB” is normally not used outside of the circles that worked on it. People normally talk about “WebRTC”. Also, as far as I remember, there are no RFCs with “RTCWEB” in the title (they all talk about defining this and that for “WebRTC”), or RFCs using “RTCWEB” to refer to some specific mechanism.

 

Also, I don’t think it is problem when “STIR/SHAKEN” etc is used as an abstract “marketing term”, referring to the work that IETF and ATIS have done.

 

The problem comes when we start using it in technical terms, talking about “STIR mechanism”, “extending STIR”, etc. Then it becomes much more abstract. 

 

I think the sentences suggested by Robert ("The set of mechanisms beginning with RFC8224 and its extensions" or "The set of mechanism defined by the STIR working group.") would clarify a lot, eventhough it may seem obvious to those involved in the IETF/ATIS work.

 

Regards,

 

Christer

 

 

 

 

 

From: stir <[e-mail]> On Behalf Of Richard Shockey
Sent: torstai 12. toukokuuta 2022 3.29
To: Robert Sparks <[e-mail]>; [e-mail]
Subject: Re: [stir] Definition of STIR

 

 

Robert did you really have to bring up RTCWEB?  LOL 

 

+1 plus the implementation of the STIR/SHAKEN framework is a national regulatory specific issue.   US CA now.  France is coming.  UK wants to do it but has very specific problems that take precedence.

 

I’m on the FCC NANC Federal Advisory Committee and we just completed a report on the current state of affairs not only in the US but other countries. Lots of folks on this list participated in this effort.

 

https://access.atis.org/apps/org/workgroup/catawg2/document.php?document_id=65705

 

 

 

 

— 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

www.sipnoc.org  (2022)

richard<at>shockey.us

Skype-Linkedin-Facebook –Twitter  rshockey101

PSTN [phone]

 

 

From: stir <[e-mail]> on behalf of Robert Sparks <[e-mail]>
Date: Wednesday, May 11, 2022 at 7:06 PM
To: <[e-mail]>
Subject: Re: [stir] Definition of STIR

 

Hi Christer -

While I sort of see your concern, I think you may be overthinking the need to have a single document that says what "STIR" is?

The language that you pointed to when you started this thread could be restated as "The set of mechanisms beginning with RFC8224 and its extensions" or "The set of mechanism defined by the STIR working group.", or for _that particular sentence_ we can just point at a particular RFC.

But really, for readability even into the future, STIR is a well enough known acronym now that the sentence will not confuse or mislead, and readers will be able to follow it to the necessary documents (via the Normative References) to understand what the document is saying.

Charters do "last forever" fwiw. And replay your question using "RTCWEB" :)

RjS

 

On 5/11/22 3:20 PM, Christer Holmberg wrote:

Hi,

 

>Does it need to be in an RFC?  Maybe update the WG charter instead?

 

I don’t think we normally define terminology in the charter. Also, as the WG/charter may not “last forever”, I don’t know if we can reference it.

 

>I’m not against it being in an RFC, but don’t know if there is a need.

 

The word “STIR” is used in many RFCs, but there is no (AFAIK) definition or reference anywhere.

 

draft-ietf-stir-identity-header-errors-handling references RFC 8224 for the new “STIR” Reason header protocol value.

 

Regards,

 

Christer

 

 

 

From: Christer Holmberg <[e-mail]> 
Sent: Wednesday, May 11, 2022 2:23 PM
To: Richard Shockey <[e-mail]>; Gorman, Pierce <[e-mail]>; [e-mail]
Subject: RE: [stir] Definition of STIR

 

Hi,

 

>Pierce that about covers it…

 

But that is not documented in any RFC, is it?

 

Regards,

 

Christer

 

 

 

 

— 

Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

www.sipnoc.org  (2022)

richard<at>shockey.us

Skype-Linkedin-Facebook –Twitter  rshockey101

PSTN [phone]

 

 

From: stir <[e-mail]> on behalf of "Gorman, Pierce" <[e-mail]>
Date: Wednesday, May 11, 2022 at 2:04 PM
To: Christer Holmberg <christer.holmberg=[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [stir] Definition of STIR

 

I suppose you or others could volunteer attempts at a definition.  Once satisfactorily achieved, what would you do with it?  Not trying to be a smart alec.  I’m seriously curious.

 

I will volunteer that I think of “STIR” as being the collection of work in the IETF that is referenced in “SHAKEN” call authentication specifications in use in the US and Canada (so far).

 

“STIR” is the collection of work that tells you how to create a SIP Identity header of whatever type you need for a particular call type, and how to create an X.509 security certificate (chain) with extensions and constraints needed to verify the contents of a SIP Identity header.

 

“SHAKEN” (a body of work in the ATIS/SIP Forum Joint Task Force on IP-NNI) tells you how to create and use various SIP Identity types defined in “STIR” and about the governance, policy, and certificate authorization framework used to acquire SHAKEN-specific X.509 end-entity certificates.

 

Beyond this, the call authentication governance authorities in the US and Canada have created requirements and selected entities to be Policy Administrators (PAs) and also created Certificate Policies which outline the requirements to be an authorized (within their respective jurisdictions) Certification Authority (CA), thus creating the SHAKEN GA/PA/CA Secure Telephone Identity (STI) Public Key Infrastructures (PKIs).

 

I expect others can volunteer alternative, and potentially better, definitions.

 

Best regards,

 

 

Pierce Gorman

From: stir <[e-mail]> On Behalf Of Christer Holmberg
Sent: Wednesday, May 11, 2022 11:52 AM
To: [e-mail]
Subject: [stir] Definition of STIR

 

[External]

 

Hi,

 

What exactly is ”STIR”, other than the name of an IETF WG?

 

Sometimes “STIR” used in document titles, sometimes there is text saying “STIR”/“the STIR mechanism” does this and that, provides this and that etc. draft-ietf-stir-identity-header-errors-handling talks about “extending STIR”.

 

RFC 7340 is supposed to describe the STIR problem, but 7340 does not even say what STIR stands for (Secure Telephone Identity Revisited), and there is no RFC named “STIR”.

 

The question came up while I was reviewing the messaging draft, which says:

 

“Secure Telephone Identity Revisited (STIR) provides a means of attesting the identity of a telephone caller…”

 

Regards,

 

Christer

 

_______________________________________________ stir mailing list [e-mail] https://www.ietf.org/mailman/listinfo/stir 

 
_______________________________________________
stir mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/stir
_______________________________________________ stir mailing list [e-mail] https://www.ietf.org/mailman/listinfo/stir