Re: [stir] Permitted spoofing

Hadriel's thinking here makes a great deal of sense but we are coming really
close to dealing with issues that are the ultimately the provenance of the
NRA.  

First, it would be very helpful if anyone has any URL's that could point to
other legislation similar to the US Truth in Caller ID act.  It might be
helpful to understand some other views here.  Has the EC done anything
similar especially in relation to their Privacy Directives?

Second if you actually look at the FCC report to Congress Henning provided
you can pretty easily read between the lines here.  IMHO as an amateur
telecom lawyer you can easily see that Truth in Caller ID Act is pretty
useless.  First enforcement requires proof of "intent to defraud" which is
really hard to prove. So what is intent?  Sort of like "absence of malice"
in US Libel laws.  Second it gave the FCC zero "authority to act" in dealing
with third party service providers. 

The better solution would have been to make ALL spoofing of the signaling
data illegal period, except in the cases where the consumer or enterprise
could demonstrate a genuine need based on a strict set of criterion. Then
the consumer or enterprise could present a "certificate of need" to the
service provider that could provision the requirements as Hadriel suggests.
The FCC report clearly saw that Congress understood the legitimate need for
some permitted spoofing but took the wrong path to enforcing the
requirement. 

KISS .. keying off the Full E.164 should be relatively easy to do even in
intranational calling situations.  The To: and From: should always be
converted to + whenever possible at session origination. Describing how
Permitted Spoofing COULD BE achieved is useful to document. 

In any event we certainly have to understand these issues but ultimately the
definition of Permitted Spoofing is a NRA issue since the E.164 namespace is
under the absolute control of the nation state.    None of you wants to hear
any sad tales about ENUM and e164.arpa I'm sure. 

-----Original Message-----
From: stir-bounces@ietf.org [mailto:stir-bounces@ietf.org] On Behalf Of
Hadriel Kaplan
Sent: Saturday, June 08, 2013 2:19 PM
To: Henning Schulzrinne
Cc: Rosen, Brian; stir@ietf.org
Subject: Re: [stir] Permitted spoofing

On Jun 7, 2013, at 10:23 PM, Henning Schulzrinne <hgs@cs.columbia.edu>
wrote:

> That's probably something we might want to flesh out a bit. My very rough
vision in the central database case would be something like the following:
> 
> (1) Owner [doctors' office] says: "Please mint a cert that entitles Doctor
Smith [public key attached] to use our number 555 1234." [signed by
assignee]
> (2) Database returns cert, which is handed to doctor.
> (4) Doctor uses cert just like any other.

If we want such a thing to work in the near-term timeframe, I don't think it
can work that way.  For one thing I don't expect phones to be able to do the
signing themselves, nor their access service providers to believe/trust the
phones.  As far as I know, today the Doctor phone's service provider has to
be in on it, and the provider equipment is provisioned to know the Doctor's
phone can claim another caller-id (e.g., P-Associated-URI).  I think it's a
big jump to expect them to let any subscriber to claim to be any number just
because the supposed holder of that number "authorized" them to.  Even
ignoring the P/S-CSCF type equipment, there're a lot of other systems
involved in this stuff, for billing, CALEA, troubleshooting, etc.

A more likely scenario is:
(1) Doctor's office submits a request form with its service provider to add
Doctor's phone as authorized user for office number caller-id, or with
Doctor phone's service provider as a pull request.

(2) The service providers fax each other authorization forms with legal
signatures.

(2b) If there is some big central database model, then the Doctor phone's
service provider gets added as second source for the Office number.

(3) The Doctor phone's service provider adds into its databases the Office
caller-id as an authorized associated number for the phone to use for
outbound calls, which triggers associated identity handling during next
phone registration.

(4) The Doctor makes an outbound call using the Office number, which the
service provider authorizes and signs using its own cert.

-hadriel

_______________________________________________
stir mailing list
stir@ietf.org
https://www.ietf.org/mailman/listinfo/stir