[stir] WG Review: Secure Telephone Identity Revisited (stir)

[The IESG <[e-mail]>]

The Secure Telephone Identity Revisited (stir) WG in the Applications and
Real-Time Area of the IETF is undergoing rechartering. The IESG has not made
any determination yet. The following draft charter was submitted, and is
provided for informational purposes only. Please send your comments to the
IESG mailing list ([e-mail]) by 2026-10-26.

Secure Telephone Identity Revisited (stir)
-----------------------------------------------------------------------
Current status: Active WG

Chairs:
  Ben Campbell <[e-mail]>
  Russ Housley <[e-mail]>

Assigned Area Director:
  Charles Eckel <[e-mail]>

Applications and Real-Time Area Directors:
  Andy Newton <[e-mail]>
  Charles Eckel <[e-mail]>

Mailing list:
  Address: [e-mail]
  To subscribe: https://www.ietf.org/mailman/listinfo/stir
  Archive: https://mailarchive.ietf.org/arch/browse/stir/

Group page: https://datatracker.ietf.org/group/stir/

Charter: https://datatracker.ietf.org/doc/charter-ietf-stir/

## Background and Problem Statement

The Secure Telephone Identity Revisited (STIR) Working Group specifies
Internet-based mechanisms that allow verification of the authorization to use
a particular telephone number through cryptographic authentication. These
mechanisms are widely deployed in SIP-based telephony networks and are used
to mitigate impersonation, spoofing, and other forms of unwanted or
fraudulent communications.

Operational experience has revealed that while STIR effectively authenticates
the event of a call and the authorization to use a telephone number, it does
not provide a means to identify the entity behind that authorization.
Telephone numbers are assigned to entities that may use them through multiple
services or providers acting on their behalf, and verifiers have no
standardized way to determine which entity a delegate certificate represents.
Additionally, existing mechanisms do not provide transparency into credential
issuance. This rechartering extends the Working Group's scope to address
these gaps while preserving compatibility with existing deployments and the
STIR trust model.

## Scope of Work

The STIR Working Group will continue to specify and maintain the baseline
protocols for cryptographic authentication of telephone calling party
information using PASSporT and related mechanisms.

The Working Group will define standards-track documents to provide a means to
associate a PASSporT with an identifier representing the entity holding the
right to use an assigned telephone number, and will document the privacy
implications of exposing such an association, consistent with the guidance in
RFC 6973.

The Working Group will define informational or experimental documents to
provide certificate transparency mechanisms for telephone identity
credentials that improve auditability and support detection of misissuance
within the STIR ecosystem.

The Working Group will define informational or experimental documents to
extend existing out-of-band mechanisms for the discovery of STIR credentials
and services associated with telephone numbers, including the application of
connected identity in scenarios where SIP signaling is not end-to-end. The
Working Group will consider extensions that support the use of authenticated
telephone identity in other communications contexts, including messaging.

The Working Group will continue to leverage existing Internet security
mechanisms, including PKI, and will coordinate with other IETF working groups
as appropriate. It will also continue to coordinate with external standards
bodies such as the Alliance for Telecommunications Industry Solutions (ATIS)
and the SIP Forum on the implementation and deployment of STIR mechanisms
(e.g., SHAKEN).

## Out of Scope

The following items are out of scope for the STIR Working Group:

- Definition of jurisdictional or legal policy topics, including vetting
policies, regulatory requirements, governance, or authorization frameworks. -
Definition of governance requirements for numbering authorities, certificate
authorities, or transparency services. - Revisiting the trust model for the
core first-party assertion that binds a telephone number to a call, the
assurance that the calling number is not spoofed. This assertion relies on
the existing certificate-based, administratively-governed model, regardless
of the certificate profile used, and alternative trust anchors or
non-certificate identifier mechanisms for this core binding are out of scope.
Changing this dependence on the certificate-based approach would require a
future recharter. This does not constrain separate signers of auxiliary or
supplementary information associated with a call, provided such information
remains bound to and subordinate to a first-party assertion within the
certificate-based trust model. - Any mechanism requiring changes to
circuit-switched telephony technologies.

Milestones:

   - Submit a document that defines a mechanism for associating a PASSporT
   with an entity identifier to the IESG for publication as a Proposed
   Standard.

   - Submit a document that defines a certificate-transparency mechanism for
   telephone identity credentials to the IESG for publication as a Proposed
   Standard.

   - Submit a document to use or extend existing mechanisms to support
   out-of-band discovery of STIR credentials and services, including
   connected identity, to the IESG for publication as a Proposed Standard.