Re: [stir] current draft charter

[Hadriel Kaplan <[e-mail]>]

On Jun 12, 2013, at 7:46 PM, "Peterson, Jon" <[e-mail]> wrote:

> The proposed STIR charter outlines two ways to secure identity: an in-band
> and an out-of-band approach. Discussion so far on this list has focused
> largely on the in-band. For the out-of-band approach, we need to be able
> to explore credentials whose authority rests on some other means than
> delegation from on high: perhaps, like in ViPR, from probing how numbers
> are routed and using this to prove possession of the number.

If you mean check return routability, Dan Wing had a draft on a return-routability check:
http://tools.ietf.org/html/draft-wing-sip-e164-rrc-01

Unfortunately, legitimate caller-ids are sourced by elements/entities that are not necessarily the same ones used for reaching the same number back.  For example the call-center scenarios, or doctor cellphone scenario, or even Skype-out scenario.

With regard to ViPR, I was under the impression ViPR's entire foundation for trust authority rested on the PSTN, with the original PSTN call and its caller-ids being part of the shared secret for later use in ViPR peer discovery and authentication.  If the caller-id's in the PSTN can be faked, ViPR would have been in very big trouble, because it would have enabled incorrectly finding and authenticating a malicious peer for that spoofed number and making all future calls back to that malicious peer for the number.  No? (maybe ViPR changed after I stopped following it)

-hadriel