[stir] Re: Verifiable Voice Protocol (VVP)

["Peterson, Jon" <[e-mail]>]

I took an initial look at this. Broadly, I’d probably embed most of the information in the proposed new PASSporT headers/claims into either subelements of rcd (a lot of this overlaps with what RCD does) or into STIR certs themselves. RCD is supposed to provide externally verifiable data about the calling party, data that you trust because you trust the party signing it - architecturally, it should be a sufficient wrapper for the sort of dossier the draft is linking to STIR.

In most  STIR deployments today, the OP (as the draft calls it) is the entity signing the PASSporT. If we could snap our fingers and make it the TNU (as the draft calls it) that signs PASSporTs today, I imagine the bulk of the problems this draft is trying to address would already be solved without the addition of any new headers. STIR has always strongly favored making the security association here (caller-callee)  as end-to-end as possible.

Also, transmitting this sort of assurance back from the callee to the caller is the problem we call “connected identity,” there is a mature draft describing it (4916-update). I would not recommend using an SDP field to pass such information in the backwards direction.

Jon Peterson
TransUnion

From: Orie <[e-mail]>
Date: Friday, October 10, 2025 at 9:19 AM
To: Russ Housley <[e-mail]>
Cc: Pierce Gorman <[e-mail]>, Chris Wendt <[e-mail]>, Brett Nemeroff <[e-mail]>, Richard Shockey <[e-mail]>, IETF STIR Mail List <[e-mail]>
Subject: [stir] Re: Verifiable Voice Protocol (VVP)

This Message Originated from Outside of the Organization
Do not click links or open attachments unless you can confirm the sender and know the content is safe.
Report Suspicious<https://us-phishalarm-ewt.proofpoint.com/EWT/v1/GX53klZ1TQ0!Y2Oq2O7wX37ubKekr-dBgYAjreGWKEVVDeLxjlKzsFDxWCESADeCsixwdZGWnG05ljc6pG33AO2U8owwJZgxbQXbV9GaVEd_2XRVawHgoC6IXX370JXaPMwhHPbUM9MVKg$>

Hi Daniel ! & STIR,

First time seeing this draft : )

There have been some STIR presentations of applicability of the "Issuer, Holder / Presenter, Verifier" model for verifiable credentials to STIR WG, at previous IETFs.
For folks less familiar with Verifiable Credentials, they are sorta like https://datatracker.ietf.org/doc/html/rfc5755<https://urldefense.com/v3/__https://datatracker.ietf.org/doc/html/rfc5755__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5X6QogRIo$>
They are also worked on in OAUTH and SPICE, with primitives coming from JOSE / COSE (or other security mechanisms like https://www.w3.org/TR/vc-data-integrity/<https://urldefense.com/v3/__https://www.w3.org/TR/vc-data-integrity/__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5Xos8Xu3M$>, or https://trustoverip.github.io/tswg-acdc-specification/<https://urldefense.com/v3/__https://trustoverip.github.io/tswg-acdc-specification/__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5XKCbTM4c$> )

Here are some related drafts to consider:

- https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/<https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-ietf-oauth-sd-jwt-vc/__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5XvE9nRZY$>
- https://datatracker.ietf.org/doc/draft-wendt-stir-vesper/<https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-wendt-stir-vesper/__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5X3AEU4Ec$>

The security technology "ACDCs" have also been proposed in this draft:

- https://datatracker.ietf.org/doc/draft-smith-satp-vlei-binding/<https://urldefense.com/v3/__https://datatracker.ietf.org/doc/draft-smith-satp-vlei-binding/__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5XhyF--Oo$>

I'll leave it to the STIR chairs to handle the agenda discussions, just thought I would share some background on this topic.

Regards,

OS, ART AD





On Wed, Oct 8, 2025 at 12:44 PM Russ Housley <[e-mail]<mailto:[e-mail]>> wrote:
Pierce:

For historical reasons, the tooling fills in “Network Working Group“ if the author does not specify a working group.  The final RFC is approved, will just indicate "IETF"

Russ


On Oct 8, 2025, at 12:14 PM, Pierce Gorman <[e-mail]<mailto:[e-mail]>> wrote:

Is anyone aware of an effort to bring VVP into the STIR working group?

The protocol specification posted in the IETF archive under the “Network Working Group“ (?) defines a new kind of STIR PASSporT using numerous non-STI verifiable credentials.

Verifiable Voice Protocol<https://urldefense.com/v3/__https://www.ietf.org/archive/id/draft-hardman-verifiable-voice-protocol-00.html__;!!GX53klZ1TQ0!1v_DDAI_jfLPL72FRmRJh69uINmJYOn_UrvcBB1jcjoeIJD9EyrHtg3omFjBzF5qZHoF-E5v8w5XDdDnQzc$>

Pierce

_______________________________________________
stir mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>