[stir] draft-ietf-stir-servprovider-oob-03 feedback

[Simon Castle <[e-mail]>]

Hi all,

I have a few comments on the Out-of-Band STIR for Service Providers draft (https://datatracker.ietf.org/doc/draft-ietf-stir-servprovider-oob/<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-stir-servprovider-oob%2F&data=05%7C01%7Csimoncastle%40microsoft.com%7Cc86b8fbfdf514e506ef908dade94657d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638067026224047968%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=7caoXSMmSt3xV7t%2B5Qm663lB4czPBb%2BWI8X1KP4xEpg%3D&reserved=0>), relating to the use of TnAuthLists for the identification of the CPS in the OoB framework (Section 4: "Advertising a CPS").


  *   The AS must select which CPS to send the signed identity to.  The suggestion is that the choice of CPS can be made based on associating the TnAuthList to the CPS URI based on the received advertisements.  However, if the CPS uses SPCs to advertise itself, as opposed to TN Ranges, there is no way proposed for the AS to correlate a call's destination number to the destination.
     *   I wasn't clear if this is what is being referred to in Section 10 (Security Considerations) with the comment "determining whether a given SPC entitles a service provider to access PASSporTs for a given telephone number is not trivial, but is a necessary component of this CPS architecture" or if that was referring to the AS being able to authenticate the CPS; either way, this gap feels like it should be highlighted in Section 4 with the core advertisement proposal (if only to say something like "CPSs must advertise their TN Ranges rather than an SPC value, or else determine another method by which AS recipients can identify the numbers they have authority for").
  *   TNAuthLists provide no method of describing URIs, which can also be the recipient of calls, unless through an (undefined) association with an SPC.  Should this document provide support for OoB calls to destination URIs as well as to TNs?
  *   The example in-line `{ "1234":"https://cps.example.com<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcps.example.com%2F&data=05%7C01%7Csimoncastle%40microsoft.com%7Cc86b8fbfdf514e506ef908dade94657d%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C638067026224047968%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4iT31sZ8mz67C07hmAXj6pvcbDtpVirANuNiKu0e28I%3D&reserved=0>" }` is incomplete; the key should be a TnAuthList but in the example there'd be no way to distinguish "1234" between being an SPC or a TN (although the length suggests it's intended as an SPC).

Thanks,
Simon

Simon Castle (he/him)
Software Engineer
[e-mail]<mailto:[e-mail]>

[Microsoft Logo]