Re: [stir] current draft charter

[background:] For the "email-style" case what I mean is a source identity of something like 'alice@foo.com', where by definition 'foo.com' is authoritative for usernames within its domain, and the scope of the 'alice' is constrained to the 'foo.com' domain.  What I *don't* mean is an E.164 that just happens to be encoded in a SIP URI like 'sip:+12125551212@foo.com'.  There is no TN for a "email-style" URI, for the term "email-style" I'm using anyway.

So for en email-style URI, the premise I'm assuming is the same as RFC 4474: a certificate identifying 'foo.com' signed by a trusted CA is sufficient to believe it's really a valid From of 'alice@foo.com'.  So all the verifier needs is the certificate of the From's domain, to verify the signer/originator can claim the user name.  In RFC 4474 that certificate is retrieved via an HTTP URL that the originator provides in a SIP header.  I'm just saying it's not absolutely necessary that a URL be provided in a SIP header, but we could instead get it from DNS.

We have can't just look up the DNS domain key of 'foo.com' to get the certificate, though, because 'foo.com' will resolve to stuff used for other things that we don't care about.  So a relatively common tactic people use is to prefix the DNS query key with a pre-defined/standardized/agreed-upon string for a specific node of the domain (creating an artificial name basically).  The '_cid' is just an example of such a prefix string we could standardize using.  So everyone would know to add a '_cid.' to the domain name of the email-stlye domain in the received From to find the cert in DNS for that domain; and that domain would know to put it there for everyone to get.

-hadriel

On Jun 19, 2013, at 9:14 AM, "Lee, Yiu" <Yiu_Lee@Cable.Comcast.com> wrote:

> I am on board using dns for lookup. One question in your example: When you
> receive alice@foo.com, how do you derive it to "_cid.foo.com"? Do you
> suggest _cid is the tn or some other identifier?
> 
> 
> On 6/18/13 1:36 PM, "Hadriel Kaplan" <hadriel.kaplan@oracle.com> wrote:
> 
>> I think that's still possible even for email-style names.  For example,
>> when receiving a request from'alice@foo.com' we could do a DNS lookup for
>> '_cid.foo.com' or some such pre-defined naming scheme, to get the
>> caller-id cert for 'foo.com'; or the RR for that DNS key could redirect
>> us to somewhere else if need be.  Or we could do an HTTP automatically
>> for 'http://foo.com/cid', or even 'http://foo.com/cid/ldkjhlashl' where
>> the last part is a hash of the username.
> _______________________________________________
> stir mailing list
> stir@ietf.org
> https://www.ietf.org/mailman/listinfo/stir

Re: [stir] current draft charter - ENUM and databases