Re: [stir] Call For Adoption By STIR WG for draft-peterson-stir-messaging

[Alex Bobotek <[e-mail]>]

A few comments on the draft as well as emergency services use cases:

The best fit for STIR in text messaging is clearly SIP-based  messaging
(e.g., GSMA RCS).  Here there are a number of factors to consider:

* Verification of all RCS conversation participants would likely be
necessary, not just the party that initiates the conversation via SIP.
* In text messaging, spoofing has not been a major issue (especially in
North America) due to the lighter regulation and industry decisions
      to ban spoofing (e.g., even where legitimate in voice)  and
vigorously enforce this ban.  Also, text messaging is generally routed more
directly from originating to destination networks.  The regulatory
differences might also favor different or even no governance, so
self-signed certificates might be the way to go.
* Some features of GSMA's RCS Uniform Profile 2.X (e.g., MaaP's) might be
leveraged alone or in conjunction with STIR to support authenticated
emergency messaging use cases.  IMHO, some exploration of and/or liaison
with GSMA would be appropriate.  The potential for orchestrated emergency
voice, video and messaging is also interesting.

Intercarrier MMS, where MMS authentication may be most beneficial,
typically occurs using MM4 often passing through commercial MTAs.  Most of
this traffic passes deterministically through authenticated paths.  As MM4
is based on SMTP, SMTP sender authentication as well as DMARC might be
leveraged if needed.

In SMPP, sender spoofing is many orders of magnitude below that of voice
spoofing, at least in North America.  Additionally,  it's difficult to
expect that SMPP-based infrastructure (like much of the older voice
infrastructure) would be upgraded, especially given the sparsity of sender
spoofing.  Here also there are already some mechanisms such as sender
registration and message class tags that might be leveraged.

Comments on the Internet Draft:

1.  The introductory paragraph might be updated to reflect the
significantly less-severe spoofing issue in text messaging.  Here's a cut
at such language:
“Similar impersonation is occasionally to infrequently, depending largely
on political boundaries and their regulatory constraints on text messaging,
leveraged by bad actors in the text messaging space.”

2.  The emergency use case might be added.


Regards,

Alex


On Fri, Nov 20, 2020 at 12:47 PM Russ Housley <[e-mail]> wrote:

> At the final session of IETF 109, the STIR WG expressed interest in
> adopting draft-peterson-stir-messaging.  Please indicate by 7 December 2020
> whether you support adoption of this Internet-Draft by the STIR WG.
>
>
> > On Nov 20, 2020, at 3:39 PM, IETF Secretariat <
> [e-mail]> wrote:
> >
> > The STIR WG has placed draft-peterson-stir-messaging in state
> > Call For Adoption By WG Issued (entered by Russ Housley)
> >
> > The document is available at
> > https://datatracker.ietf.org/doc/draft-peterson-stir-messaging/
>
> _______________________________________________
> stir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/stir
>