Re: [stir] "iat" value to use during PASSPorT construction

["Asveren, Tolga" <[e-mail]>]

I didn’t say I disagree. What I said is that none of these are introduced by “sign a call only if it leaves my network when I am the originating network” approach. It is how things are in general.

Thanks,
Tolga

From: stir <[e-mail]> On Behalf Of Gorman, Pierce A [CTO]
Sent: Friday, July 20, 2018 4:32 PM
To: Asveren, Tolga <[e-mail]>; williw <[e-mail]>
Cc: [e-mail]
Subject: Re: [stir] "iat" value to use during PASSPorT construction

________________________________
NOTICE: This email was received from an EXTERNAL sender
________________________________

None of which invalidates the concern Willi asked about.

I’m not saying there aren’t approaches available for dealing with signed and verified but still bad calls.  All I am saying is Willi is correct to be concerned because it happens today without the signatures.  What we’re discussing is constraints and limitations and those are worth identifying and acknowledging.

Pierce


From: Asveren, Tolga [mailto:[e-mail]]
Sent: Friday, July 20, 2018 3:27 PM
To: Gorman, Pierce A [CTO] <[e-mail]<mailto:[e-mail]>>; williw <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: RE: [stir] "iat" value to use during PASSPorT construction

Again, there should be a policy to cover that, e.g. such organizations won’t be trusted anymore or at least not on the same level with others which did a good job on their end  as originating network. And probably some regulatory action can be taken based on complaints.

Thanks,
Tolga

From: Gorman, Pierce A [CTO] <[e-mail]<mailto:[e-mail]>>
Sent: Friday, July 20, 2018 4:24 PM
To: Asveren, Tolga <[e-mail]<mailto:[e-mail]>>; williw <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: RE: [stir] "iat" value to use during PASSPorT construction

________________________________
NOTICE: This email was received from an EXTERNAL sender
________________________________

I think you missed my point.  There will be authoritatively signed calls with legitimate numbers from bad actors placing illegal or unwanted calls with bad intent.  Get enough of them and you can think of it as poisoning the well.

Pierce

From: Asveren, Tolga [mailto:[e-mail]]
Sent: Friday, July 20, 2018 2:54 PM
To: Gorman, Pierce A [CTO] <[e-mail]<mailto:[e-mail]>>; williw <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: RE: [stir] "iat" value to use during PASSPorT construction

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.

Not disagreeing with your points in general but:

I don’t think there is “protocol level” check possible whether a signature generated by an intermediary and verified successfully is created maliciously or not. This has to depend on policy. Depending on attestation level one may check whether signer is authoritative for  origin or whether it can be trusted for the particular attestation level without such a check. Whom to trust for which attestation level is really an operational/administrative decision and doesn’t have anything to do with protocol semantics AFAICS. But eventually, it may be “learned”, based on ratio of valid/spam/malicious/etc… calls signed by a certain organization.

Thanks,
Tolga

From: Gorman, Pierce A [CTO] <[e-mail]<mailto:[e-mail]>>
Sent: Friday, July 20, 2018 3:12 PM
To: Asveren, Tolga <[e-mail]<mailto:[e-mail]>>; williw <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: RE: [stir] "iat" value to use during PASSPorT construction

________________________________
NOTICE: This email was received from an EXTERNAL sender
________________________________

Because of the large volume of porting and ported numbers I assume it is impractical (or at least undesirable) to validate in real-time that a number is “owned” by the originating carrier.  This also won’t work for the scenarios where the call is signed by a transit or gateway carrier (say for automated traceback).

It has been said many times that just as all unwanted and illegal robocalls do not use spoofed calling numbers, it should be assumed that bad actors will originate signed calls with bad intent.  Prepaid phones and ephemeral enterprise SIP trunks will be a good home for these kinds of calls.  And there are other scenarios as well.



From: Asveren, Tolga [mailto:[e-mail]]
Sent: Friday, July 20, 2018 1:18 PM
To: williw <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [stir] "iat" value to use during PASSPorT construction

I don’t think that is an issue as that signature is cryptographically valid doesn’t mean that is “completely fine”. It also should be checked that signing organization is authoritative for the claimed (and verified) origination.

Please consider that the scenario you mention is not related with “originating network signs only if the call leaves the network” policy. It can happen for any case: an intermediary (maybe with malicious intent) just can generate a valid signature for any call by using its own key; but then the above check I mentioned would detect that signer is not authoritative for the origination, i.e. signature is not generated by the originating network.

Thanks,
Tolga

From: stir <[e-mail]<mailto:[e-mail]>> On Behalf Of williw
Sent: Friday, July 20, 2018 11:15 AM
To: Asveren, Tolga <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [stir] "iat" value to use during PASSPorT construction

________________________________
NOTICE: This email was received from an EXTERNAL sender
________________________________

Sorry, I unsuccessfully submitted my concern on jabber list during the meeting.
However, this could be valid in this and applies possibly other areas of stir as well.


My concern that came up while seeing the cat slides in meeting was the following:


Signing outbound / E-gres calls only.
This emulates the old PSTN paradigm and enables impersonation as we have it in SS7.
Without originating signatures this seems to be a big impersonation hole I assume.

In fact, operators will happily sign my robocalls and other malicious stuff.
And this will guarantee that my robocalls have a valid signature that will also be perfect for OOB signalling etc.

Is this concern valid?

Sorry this did not come through the scribe and to the mic.

Thanks

Willi

_______________________________________________
stir mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/stir<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fstir&data=02%7C01%7Cpierce.gorman%40sprint.com%7C7bd5c71eb8c44aaea07308d5ee7a7e60%7C4f8bc0acbd784bf5b55f1b31301d9adf%7C0%7C0%7C636677132235044610&sdata=4xbcc%2BA815i2iwOqQnmym6xX3%2FI1%2Boe%2Fv%2Bj7rRXO%2FAo%3D&reserved=0>

________________________________

This e-mail may contain Sprint proprietary information intended for the sole use of the recipient(s). Any use by others is prohibited. If you are not the intended recipient, please contact the sender and delete all copies of the message.