Subject: [Sip] GRUU, Contacts, and privacy

From: Cullen Jennings <[email-masked]>
Date: Fri, 07 Nov 2003 11:28:34 -0800

When making anonymous calls, the contact should change on every call. For
example of if you don't do this ...  Bill makes an anonymous call from
Monika's phone to Hillary. Hillary, takes the call, is suppositious about
the location and makes note of the contact. Now Hillary calls Monika and
notes the contact. If the two contacts are the same, the privacy of the
original call is lost and Hillary knows the original call was from Monika's
phone. 

Unfortunately, it looks like the grid approach still reveals this
information - the grid on the two calls might be different but the core GRUU
is still the same. 

I have a hard time imagining a simple solution that allowed the UA to
generate the GRUUs and still have fast lookup for the proxy. It seems like a
way is needed for the UA to get many GRUU that it can use and that these
need to be anonymous and uncorelatable by third parties.

One possible solution for this is to send another Register after each call
to get a new GRUU that can be used. This would drive the text to change so
that re-registrations must result in a new GRUU - the current encryption
mechanism with salt would meet this. Presumable, the old GRUU's would
continue to work and be good as long as the contact that generated it was
still valid. 

Cullen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: "Sean Olson" <[email-masked]>
Date: Fri, 7 Nov 2003 19:41:44 -0800

I would like to offer the suggestion that while privacy is an interesting
and useful property, it is not a necessity for many applications that might
otherwise use GRUU. I would go even further and state that is runs counter
to some applications that might want to use a globally routable and unique
URI. Part of the complexity of the grid approach is this requirement for
obfuscation/privacy. If you remove that requirement, it is entirely possible
to come up with a simpler solution. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Cullen
Jennings
Sent: Friday, November 07, 2003 11:29 AM
To: [email-masked]; Jonathan Rosenberg
Cc: Paul Kyzivat
Subject: [Sip] GRUU, Contacts, and privacy

Cullen

_______________________________________________
Sip mailing list  https://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol Use
[email-masked] for questions on current sip Use
[email-masked] for new developments on the application of sip

---

From: Jonathan Rosenberg <[email-masked]>
Date: Sat, 08 Nov 2003 01:44:07 -0500

> information - the grid on the two calls might be different but the core GRUU

True.

> need to be anonymous and uncorelatable by third parties.

In my original I-D on this subject, I had postulated the existence of 
a separate LEASE operation that would allow for explicit requests for 
a GRUU. It made sense to use this method for cases where allocation of 
gruus was decoupled from registrations. Here is an example of such a 
case. GRUUs obtained by a lease may very well require extra state in 
proxies, but that would be OK - the lease operation could be used 
under more exceptional circumstances.

> continue to work and be good as long as the contact that generated it was

Actually, if you *really* wanted privacy, this would still not be 
sufficient. The reason is that your domain is still there, for all to 
see. Indeed, so would the IP address in your media stream. You'd need 
a real privacy service (as described in rfc3323) which would 
presumably obscure everything.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                600 Lanidex Plaza
Chief Technology Officer                    Parsippany, NJ 07054-2711
dynamicsoft
[email-masked]                     FAX:   (973) 952-5050
http://www.jdrosen.net                      PHONE: (973) 952-5000
http://www.dynamicsoft.com

---

From: Alan Johnston <[email-masked]>
Date: Mon, 10 Nov 2003 20:19:47 -0600

>to come up with a simpler solution.

I agree 100%.  A private Contact URI is just one small piece of the privacy 
puzzle.  I think this privacy requirement should be removed.

Thanks,
Alan Johnston
MCI
sip:[email-masked]