Subject: [stir] PASSporT question

From: Michael Thomas <[email-masked]>
Date: Tue, 28 Apr 2020 11:44:46 -0700

Reading the introduction and abstract it repeatedly mentions "personal" 
and "persona". Is it actually relevant? I mean, I can be sitting 
together with a dozen other people on camera and this would all still be 
relevant, right? Also: a SIP camera watching my front porch would not 
necessarily have a person involved at all if it decided to call me 
because of porch pirate.

Mike

---

From: Piotr Gregor <[email-masked]>
Date: Tue, 28 Apr 2020 21:45:03 +0100

Hi Michael,

No, "personal" in PASSporT simply comes from the fact that PASSporT is
created to assert identity of the originator, and thus it's got the name of
"personal" identity,
but it simply means asserting some identity, and it is of course the origin
of the call, calling number.

RFC 8225:

> The Personal Assertion Token, PASSporT, is
> cryptographically signed to protect the integrity of the identity of the
> originator (...)

There is ofcourse many ways the call can be originated, it can be made by a
person (and here PASSporT indeed would be "personal assertion token")
but it can be initiated by a software, without any human being involved -
STIR-Shaken could be used just as well in this case with it's PASSporT to
sign the call,
important bit is only that it asserts the origin of the call.

BTW: It is my first post on this list so may I introduce myself. My name is
Piotr Gregor and I am working with SignalWire on STIR-Shaken. Welcome!

cheers,
Piotr

---

From: Mary Barnes <[email-masked]>
Date: Tue, 28 Apr 2020 15:47:52 -0500

It's important for the acronym (only half joking).

On Tue, Apr 28, 2020 at 1:44 PM Michael Thomas <[email-masked]> wrote:

> _______________________________________________
> stir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/stir
>

---

From: Michael Thomas <[email-masked]>
Date: Tue, 28 Apr 2020 15:08:58 -0700

On 4/28/20 1:47 PM, Mary Barnes wrote:
> On Tue, Apr 28, 2020 at 1:44 PM Michael Thomas <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>

I'm all for acronym fun -- I came up with the contorted KINK acronym, 
after all -- but there is actual a concern which I raised in another 
piece of mail here which make me worried about giving the impression 
that the receiver can believe guarantees about the originating user part 
being the owner of that user part. This just adds to my unease.

Mike