Subject: [Sip] draft-kuthan-sip-derive

From: Henry Sinnreich <[email-masked]>
Date: Sat, 25 Oct 2008 12:02:59 -0500

The ŒDialog Event foR Identity Verification¹ is meeting IMO the real need
for preventing forged ³From² names and has the virtue of simplicity as well.
It is analog to the email verification which is  successfully deployed
throughout the Internet at present.

 http://www3.ietf.org/proceedings/staging/draft-kuthan-sip-derive-00.txt

Thanks, Henry

_______________________________________________
Sip mailing list  https://www.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Jiri Kuthan <[email-masked]>
Date: Sat, 25 Oct 2008 23:55:31 +0200

well, first of all, thank you very much for the positive comments.

secondly -- real is becoming really real :) In Germany, there has been
recently an attack that could have been better absorbed using such
a method, probably at best in combination with others. The attack
is shortly described at http://www.ipcom.at/index.php?id=565. It
was as simple as sending annoying INVITEs around, it is not clear
really what could have been the attack purpose.

In fact, the attack is really trivial: it doesn't try to make
messages appear credible, and any reasonably-configured SIP
server would drop them right away. (none of the domains belongs
to the server, the messages have little variance among them)

The victims' phones would not have been ringing at 3AM if they
tried to verify who is calling them. (even though with so
trivially formed requests a proxy server would drop them even
before reaching the UAS).

-jiri

Henry Sinnreich wrote:
>   The ‘  Dialog Event foR Identity Verification’ is meeting IMO the real 
> need for preventing forged “From” names and has the virtue of simplicity 
> as well.
> ------------------------------------------------------------------------
>

---

From: Henry Sinnreich <[email-masked]>
Date: Sun, 26 Oct 2008 09:40:24 -0500

Reading all those papers about VoIP attacks, including VoIP spam:
Why is nobody addressing the most obvious reason to give up phones, both
VoIP and TDM: Telemarketing and political campaign, polling calls?

Getting annoyed by telemarketers outweighs the benefits of having a landline
phone in the first place. For some reason, the mobile phone seems much safer
and the only worthwhile to keep.

Or just use our personal SIP services, such as the SIP server in my
residential (Intertex) gateway and giving our SIP URI only to friends...

Henry

On 10/25/08 4:55 PM, "Jiri Kuthan" <[email-masked]> wrote:

>>   The Œ  Dialog Event foR Identity Verification¹ is meeting IMO the real
>> need for preventing forged ³From² names and has the virtue of simplicity
>> as well.

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Sun, 26 Oct 2008 20:08:57 +0200

Given that only 2 out of 50 implementations had support for SIP Identity at
SIPit#23 I wonder how urgent the need for anything beyond P-Asserted-ID
actually is: 
https://www.sipit.net/SIPit23_Summary
 
Ciao
Hannes
 
PS: Btw, how is your document different from
http://tools.ietf.org/html/draft-wing-sip-e164-rrc-01

________________________________

	From: [email-masked] [mailto:[email-masked]] On Behalf
Of Henry Sinnreich
	Sent: 25 October, 2008 20:03
	To: [email-masked]; [email-masked];
[email-masked]; [email-masked]; SIP IETF
	Subject: [Sip] draft-kuthan-sip-derive

	The 'Dialog Event foR Identity Verification' is meeting IMO the real
need for preventing forged "From" names and has the virtue of simplicity as
well. 
	It is analog to the email verification which is  successfully
deployed throughout the Internet at present.

	Thanks, Henry

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Sun, 26 Oct 2008 20:45:59 +0200

> In Germany, 
>there has been 
>> recently an attack that could have been better absorbed using such a 
>> method, probably at best in combination with others. The attack is 
>> shortly described at http://www.ipcom.at/index.php?id=565. It was as 
>> simple as sending annoying INVITEs around, it is not clear 
>really what 

I don't see how the attack in Germany (that by some has even been put in the
context of SPIT; I believe wrongly) has anything todo with any of the drafts
discussed in this group on SIP Identity.

---

From: [email-masked] (Juha Heinanen)
Date: Sun, 26 Oct 2008 22:05:07 +0200

> https://www.sipit.net/SIPit23_Summary

pai does not help if you receive a request from anywhere on the
internet.

-- juha

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Sun, 26 Oct 2008 22:09:54 +0200

> > Given that only 2 out of 50 implementations had support for 
>SIP Identity at  > SIPit#23 I wonder how urgent the need for 
>anything beyond P-Asserted-ID  > actually is: 
>pai does not help if you receive a request from anywhere on 
>the internet.

Depends a bit on what you call "YOU receive".

---

From: [email-masked] (Juha Heinanen)
Date: Sun, 26 Oct 2008 23:10:09 +0200

> Depends a bit on what you call "YOU receive". 

if you cannot trust the proxy or ua you receive the request from, pai
header has no value.

-- juha

---

From: "Victor Pascual Ávila" <[email-masked]>
Date: Mon, 27 Oct 2008 00:05:51 +0100

> if you cannot trust the proxy or ua you receive the request from, pai

I consider [1] to give a good description.

[1] http://tools.ietf.org/html/draft-elwell-sip-e2e-identity-important-01#section-2.2

Thanks,
-- 
Victor Pascual Ávila

---

From: Dean Willis <[email-masked]>
Date: Mon, 27 Oct 2008 02:13:17 -0500

> pai does not help if you receive a request from anywhere on the

But in the "real world", nobody uses this stuff on the Internet,  
right? It's always proxy-tied, with no interdomain calls.

So why are we bothering? is it that we THINK interdomain will really  
happen with peering agreegements?

--
Dean

---

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 27 Oct 2008 09:14:57 +0200

Thanks Dean. This was roughly where I wanted to get to in subsequent
questions... 

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On 
>Behalf Of ext Dean Willis
>Sent: 27 October, 2008 09:13
>To: Juha Heinanen
>Cc: [email-masked]; 'SIP IETF'; 
>[email-masked]; 'Henry Sinnreich'; 
>[email-masked]; [email-masked]
>Subject: Re: [Sip] draft-kuthan-sip-derive
>
>
>>> SIPit#23 I wonder how urgent the need for anything beyond P- 
>>> Asserted-ID actually is:
>But in the "real world", nobody uses this stuff on the 
>Internet, right? It's always proxy-tied, with no interdomain calls.
>
>So why are we bothering? is it that we THINK interdomain will 
>really happen with peering agreegements?
>
>--
>Dean
>
>
>This list is for NEW development of the core SIP Protocol Use 
>[email-masked] for questions on current sip

---

From: [email-masked] (Juha Heinanen)
Date: Mon, 27 Oct 2008 10:08:49 +0200

> right? It's always proxy-tied, with no interdomain calls.

you can call me at sip:[email-masked] from anywhere on the internet.  if
you think that sip is not for the internet, then ietf is not the right
forum for you and you can setup your own club.

-- juha

---

From: [email-masked]
Date: Mon, 27 Oct 2008 09:13:46 +0100 (CET)

Generally, multi-domain life seems to exist indeed in a rather
limited way -- mostly regionally using ENUM-like technologies to find
target domain. I'm not 100% sure yet why is that, supposedly
the economy of interconnection via PSTN is favorable.

wrt to security it seems that attackers are apparently not worried
about what we think about multi-domain stuff or not. see the reports
on the recent incidents in Germany I posted before. The interesting
part I find here is we can set up a barrier which does not take
inventing new protocols.

-jiri