Subject: Re: [stir] [sipcore] sipcore-rejected open issue: vCard *VS XCARD*

From: Richard Shockey <[email-masked]>
Date: Mon, 15 Oct 2018 15:28:01 -0400

To echo what Eric mentioned some of us have looked at V/X/J card representation of calling name presentation data aka Advanced CNAM as one of many techniques that could be used as part of a suite of tools to combat robocalls and caller ID spoofing.  Not specifically STIR related but potentially useful especially if it could be signed as another PASSPORT.  I've got lots of pretty pictures on how this could show up on the UA.  There is interest in this. 

There is some resistance to this for obvious reasons.  The size of the INVITE is already out of control and there is a reluctance on the part of some carriers to dip a URI at the terminating end.  

— 
Richard Shockey

Shockey Consulting LLC

Chairman of the Board SIP Forum

www.shockey.us

www.sipforum.org

richard<at>shockey.us

Skype-Linkedin-Facebook –Twitter  rshockey101

PSTN +1 703-593-2683

On 10/15/18, 2:59 PM, "sipcore on behalf of Brian Rosen" <[email-masked] on behalf of [email-masked]> wrote:

    We’re heavily using xCards in NG9-1-1, and converting to jCards as soon as we can for anything NENA controls.  We’ve not had interoperability issues requiring profiles.  We just ignore fields we don’t need and no one has tried sending an xCard without name, address and phone number.  OTOH, all we ever use them for are humans contacting other humans.  
    
    We sign objects we need protection for, but never had to sign just an xCard.  No one wants to deal with vCards if they don’t have to.
    
    I’d have no objection to a signed jCard. 
    
    Brian
    
    > On Oct 15, 2018, at 2:59 AM, James Winterbottom <[email-masked]> wrote:
    > 
    > Ah okay.
    > 
    > Heavy profile of xCard may work then. I profiled it very heavily in TS 103 478 but still had interoperability issues.
    > xCard is used a lot in the Additional Data side of the NG9-1-1 specs, but my experience there has not been good with it. Not sure how well used outside that area it is.
    > 
    > 
    > Cheers
    > James
    > 
    >> On 15 Oct 2018, at 12:54 pm, Eric Burger <[email-masked]> wrote:
    >> 
    >> Not really a civic address but a point of contact, like an email address, telephone (SIP) number, or Web site. I’m sure if someone wanted to be obstructive, a postal mail address would do.
    >> 
    >>> On Oct 14, 2018, at 8:38 PM, James Winterbottom <[email-masked]> wrote:
    >>> 
    >>> If you are only after address data why not look at geopriv civic representation? From experience profiling XCard will be almost as bad doing it for vCard
    >>> 
    >>> Sent from my iPhone
    >>> 
    >>>> On 15 Oct 2018, at 11:10 am, Eric Burger <[email-masked]> wrote:
    >>>> 
    >>>> Any thoughts on vCard vs xCard as a marshaling format for address card information?
    >>>> 
    >>>> The benefit of vCard is it has been around for ages and there are lots of implementations and it is ubiquitous in the enterprise computing world. The drawback of vCard is writing a canonicalization standard will literally be over a hundred pages.
    >>>> 
    >>>> The benefit of xCard is we can use XML Signatures which has standards already available for canonicalizing XML documents, like xCards.
    >>>> 
    >>>> My question: WHAT IS THE UBIQUITY OF xCard?
    >>>> 
    >>>> I have recently seen some SIP-related work (VRS/ITRS) that favors xCard over vCard. Is this a new trend or an outlier?
    >>>> 
    >>>> Thanks,
    >>>> Eric
    >>>> 
    >>>>> On Sep 6, 2018, at 5:12 PM, Eric Burger <[email-masked]> wrote:
    >>>>> 
    >>>>> I realized that vCards have no integrity protection whatsoever, making them a questionable vehicle for something that has a potential for abuse.
    >>>>> 
    >>>>> I checked with the RAI ADs and calext chairs, and one option is to build secure vCards. There is some independent work already begun in that space that we can piggy-back on.
    >>>>> 
    >>>>> Another alternative is to add new headers to SIP to convey whom to contact to remediate blocked calls.
    >>>>> 
    >>>>> My inclination is to fix vCards, as that would be generally useful and there is already some modest demand for it. It would broaden the implementation base which should be a good thing for us.
    >>>>> 
    >>>>> Does anyone on the list *NOT* want to go the vCard route and instead create new SIP headers? Does anyone have a better idea? Note if we go the SIP header route, these new headers would need corresponding JWT’s as they have to be secured with a traceable signature authority chain.
    >>>> 
    >>>> _______________________________________________
    >>>> sipcore mailing list
    >>>> [email-masked]
    >>>> https://www.ietf.org/mailman/listinfo/sipcore
    >> 
    > 
    > _______________________________________________
    > sipcore mailing list
    > [email-masked]
    > https://www.ietf.org/mailman/listinfo/sipcore
    
    _______________________________________________
    sipcore mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/sipcore