RFC 3324
Short Term Requirements for Network Asserted Identity
RFC 3324: Short Term Requirements for Network Asserted Identity 🎀
okay bestie, so this one is RFC 3324 💖 and it's called Short Term Requirements for Network Asserted Identity. M. Watson from Nortel Networks wrote it. It's Informational, so it's giving "here's some info" and not an Internet standard 💅. It's dated November 2002, and its header doesn't list anything it obsoletes or updates ✨. This is part 1 of 2 🧚
Status of this Memo 🌸
this memo is just here to provide info for the Internet community 📚. it does NOT specify an Internet standard of any kind, and distribution of it is unlimited 🫶
Copyright Notice 🌈
Copyright (C) The Internet Society (2002). All Rights Reserved. 💜
Abstract 🦋
okay so a Network Asserted Identity is an identity that a Session Initiation Protocol (SIP) network intermediary first derives after an authentication process 🔐. this doc lays out short term requirements for swapping Network Asserted Identities around inside networks of securely interconnected trusted nodes, and out to User Agents that are securely connected to those networks 🧚
and literally the only thing a UA asserts in a SIP message doesn't have to be anything but the user's desired alias 💅
Table of Contents ✨
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Definitions . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1 Identity . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2 Network Asserted Identity . . . . . . . . . . . . . . . . . . 3
2.3 Trust Domains . . . . . . . . . . . . . . . . . . . . . . . . 4
2.4 Spec(T) . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3. Generation of Networks Asserted Identity . . . . . . . . . . . 7
4. Transport of Network Asserted Identity . . . . . . . . . . . . 7
4.1 Sending of Networks Asserted Identity within a Trust Domain . 7
4.2 Receiving of Network Asserted Identity within a Trust Domain . 7
4.3 Sending of Network Asserted Identity to entities outside a
Trust Domain . . . . . . . . . . . . . . . . . . . . . . . . . 7
4.4 Receiving of Network Asserted Identity by a node outside the
Trust Domain . . . . . . . . . . . . . . . . . . . . . . . . . 8
5. Parties with Network Asserted Identities . . . . . . . . . . . 8
6. Types of Network Asserted Identity . . . . . . . . . . . . . . 8
7. Privacy of Network Asserted Identity . . . . . . . . . . . . . 9
8. Security Considerations . . . . . . . . . . . . . . . . . . . 9
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10
10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 10
Normative References . . . . . . . . . . . . . . . . . . . . . 10
Author's Address . . . . . . . . . . . . . . . . . . . . . . . 10
Full Copyright Statement . . . . . . . . . . . . . . . . . . . 111. Introduction 🌸
SIP [1] lets users assert their identity in a bunch of ways, e.g., using the From: header. but there's no requirement for those identities to be anything other than the user's desired alias 🙈
an authenticated identity of a user can be obtained using SIP Digest Authentication (or other means). however, UAs don't always have the necessary key information to authenticate another UA 😭
so a Network Asserted Identity is an identity initially derived by a SIP network intermediary after an authentication process ✨. this may or may not be based on SIP Digest authentication. this doc describes short term requirements for exchanging Network Asserted Identities within networks of securely interconnected trusted nodes, and also to User Agents with secure connections to those networks 🎀
we call that network a Trust Domain here, and we present a strict definition of trust and Trust Domain for the purposes of this document 👑. these short-term requirements only cover exchanging Network Asserted Identity within a Trust Domain and to an entity directly connected to the trust domain 💅
general requirements for transporting Network Asserted Identities on the Internet are out of scope for this document 🫶
2. Definitions 🎀
2.1 Identity 💖
an Identity, for the purposes of this document, is a sip:, sips: or tel: URI, and optionally a Display Name 🌈
the URI MUST be meaningful to the domain identified in the URI (in the case of sip: or sips: URIs) or to the owner of the E.164 number (in the case of tel: URIs). that means that when it's used as a SIP Request-URI in a request sent to that domain or number range owner, it would cause the request to be routed to the user or line associated with the identity, or to be processed by service logic running on that user's behalf 🧚
if the URI is a sip: or sips: URI, then depending on the local policy of the domain in the URI, the URI MAY identify some specific entity, such as a person 🦋
if the URI is a tel: URI, then depending on the local policy of the owner of the number range the telephone number lies in, the number MAY identify some specific entity, such as a telephone line. however, it should be noted that identifying the owner of the number range is a less straightforward process than identifying the domain that owns a sip: or sips: URI 🙈
2.2 Network Asserted Identity 👑
a Network Asserted Identity is an identity derived by a SIP network entity as a result of an authentication process, and it identifies the authenticated entity in the sense defined in Section 2.1 ✨
in the case of a sip: or sips: URI, the domain included in the URI MUST be within the Trust Domain 🔐
in the case of a tel: URI, the owner of the E.164 number in the URI MUST be within the Trust Domain 🔐
the authentication process used, or at least its reliability/strength, is a known feature of the Trust Domain using the Network Asserted Identity mechanism. i.e., in the language of 2.3 below, it's defined in Spec(T) 💅
2.3 Trust Domains 🧚
a Trust Domain for the purposes of Network Asserted Identity is a set of SIP nodes (UAC, UAS, proxies or other network intermediaries) that are trusted to exchange Network Asserted Identity information in the sense described below 💖
a node can be a member of a Trust Domain, T, only if the node is known to be compliant to a certain set of specifications, Spec(T), which characterize how Network Asserted Identity is handled within the Trust Domain, T 🌸
Trust Domains are built by human beings who know the properties of the equipment they're using or deploying. in the simplest case, a Trust Domain is a set of devices with a single owner/operator who can accurately know how those devices behave 🎀
simple Trust Domains can be joined into larger Trust Domains through bi-lateral agreements between the owners/operators of the devices 🌈
we say a node is 'trusted' (with respect to a given Trust Domain) if and only if it is a member of that domain 👑
we say that a node, A, in the domain is 'trusted by' a node, B (or 'B trusts A') if and only if:
- there is a secure connection between the nodes, AND
- B has configuration information indicating that A is a member of the Trust Domain.
B may or may not be a member of the Trust Domain 🦋. for example, B may be a UA that trusts a given network intermediary, A (e.g., its home proxy) 🫶
a 'secure connection' in this context means that messages can't be read by third parties, can't be modified by third parties without detection, and that B can be sure the message really did come from A 🔐. the level of security required is a feature of the Trust Domain, i.e., it's defined in Spec(T) ✨
in this context, SIP signaling information received by one node FROM a node that it trusts is known to have been generated and passed through the network according to the procedures of the particular specification set Spec(T). so it can be known to be valid, or at least as valid as specified in the specifications Spec(T) 💅
equally, a node can be sure that signaling information passed TO a node that it trusts will be handled according to the procedures of Spec(T) 🧚
for these capabilities to be useful, Spec(T) must contain requirements for how the Network Asserted Identity is generated, how its privacy is protected, and how its integrity is maintained as it's passed around the network. a reader of Spec(T) can then make an informed judgement about the authenticity and reliability of Network Asserted Information received from the Trust Domain T 🌸
the term 'trusted' (with respect to a given Trust Domain) can be applied to a node in an absolute sense. it's just equivalent to saying the node is a member of the Trust Domain 💖. but the node itself doesn't know whether another arbitrary node is 'trusted', even within the Trust Domain. it only knows about certain nodes it has secure connections with, as described above 🎀
with the definition above, statements like 'A trusted node SHALL ...' are just shorthand for 'A node compliant to this specification SHALL...' 👑
statements like 'When a node receives information from a trusted node...' are NOT valid, because one node doesn't have complete knowledge about all the other nodes in the trust domain 🙈
statements like 'When a node receives information from another node that it trusts...' are ARE valid, and should be interpreted according to criteria (1) and (2) above 🔥
the above relationships are illustrated in the following figure 🦋:
+------+
| |
| F |
| |
+------+
x
..............................x.........
. x .
. +------+ +------+ . +------+
. | | | | . | |
. | A | | B |-----.----| E |
. | | | | . | |
. +------+ +------+ . +------+
. \\ / .
. \\ +------+ // .
. \\ | | // .
. \ | C |/ .
. | | .
. +------+ .
. | Trust Domain.
........................................
|
|
+------+
| |
| D |
| |
+------+
xxxxxx Insecure connection
------ Secure connection
......
. .All boxes within the dotted line
......are part of the same Trust Domain- A, B and C are part of the same trust domain
- A trusts C, but A does not trust B
- since E knows that B is inside of the trust domain, E
- trusts B, but B does not trust E
- B does not trust F, F does not trust B
2.4 Spec(T) 📜
Okay so every element in a trust domain has to follow a shared set of configs and specs, which people call Spec(T) 🎀. Spec(T) isn't a written doc you can pull up on a website. It's more like an agreed-upon pile of info that every element already knows 💅. Why does it matter? Because processing asserted identities properly means knowing what's actually being asserted, how it got figured out, and what the privacy rules are. Spec(T) holds all of that 🫶
3. Generation of Networks Asserted Identity ✨
A Network Asserted Identity gets made by a network intermediary after an Authentication process checks out the entity (UA) being identified 🔐
The Authentication process(es) used are a signature trait of the Trust Domain, and they MUST be specified in Spec(T) 📋
A UA should be able to give the network intermediary a preferred identity 🧚 That preference MAY be used to shape the Network Asserted Identity, as long as it follows the policies of the Trust Domain 💖
4. Transport of Network Asserted Identity 🦋
4.1 Sending of Networks Asserted Identity within a Trust Domain
It shall be possible for one node in a Trust Domain to securely send a Network Asserted Identity to another node it trusts 🔒
4.2 Receiving of Network Asserted Identity within a Trust Domain
It shall be possible for one node in a Trust Domain to receive a Network Asserted Identity from another node it trusts 📨
4.3 Sending of Network Asserted Identity to entities outside a Trust Domain
Say a node, A, is inside the Trust Domain and a node, B, outside it trusts A 👀 Then it shall be possible for A to securely send a Network Asserted Identity to B, but only if the privacy policies of the identified user allow it, and the trust domain does too 🙅♀️
This is mostly used to hand a Network Asserted Identity straight to a UA 📱
4.4 Receiving of Network Asserted Identity by a node outside the Trust Domain
It shall be possible for a node outside the Trust Domain to receive a Network Asserted Identity from a node that it trusts 🤝
A Network Asserted Identity received this way may be considered valid, and it can be used to display to the user, as input data for services, and so on ✨
Okay but this is the big warning 🚨 If a node gets a Network Asserted Identity from a node it doesn't trust, there's no guarantee it's authentic or intact, because nobody knows whether the Spec(T) procedures were followed to make and send it. That info MUST NOT be used. Like, don't show it to the user, don't pass it to other nodes, don't use it as input data for services, none of that 💀
5. Parties with Network Asserted Identities 👑
A Network Asserted Identity tells you who sent the message it came in 💅
For example,
- a Network Asserted Identity received in an initial INVITE (outside the context of any existing dialog) identifies the calling party 📞
- a Network Asserted Identity received in a 180 Ringing response to such an INVITE identifies the party who is ringing 🔔
- a Network Asserted Identity received in a 200 response to such an INVITE identifies the party who has answered 🙌
6. Types of Network Asserted Identity 🎀
It shall be possible to assert multiple identities for a given party (in a given message), as long as they're of distinct types 🌈
The identity types supported shall be sip:, sips: and tel: URIs, and they all identify the user as described in Section 2.1 💜 You don't have to send both a sip: and a sips: URI, though 🙈
It shall be possible for additional types of identity associated with a single party to be added in the future 🔮
7. Privacy of Network Asserted Identity 🙈
How the privacy requirements for a Network Asserted Identity get decided is outside the scope of this document 🤷♀️
It shall be possible to indicate, within a message containing a Network Asserted Identity, that this identity is under a privacy requirement which stops it being passed to other users. This indication should not carry any semantics as to the reason for the privacy requirement 🫣
It shall be possible to indicate that the user has asked for the Network Asserted Identity not to be passed to other users. This is different from the indication above, because it means the user specifically intends it 💅
The mechanism shall support Trust Domain policies where the two indications above mean the same thing (so the only possible reason for a privacy requirement is a request from the user), and policies where they don't ✨
In that case, the Network Asserted Identity specification shall require that the mechanism of Section 4.3 SHALL NOT be used. In other words, a trusted node shall not pass the identity to a node it doesn't trust 🚫 However, the mechanism of Section 4.3 MAY be used to transfer the identity within the trusted network 🔁
Note that 'anonymity' requests from users or subscribers may well need functionality beyond the handling of Network Asserted Identities described above. That extra functionality is out of the scope of this document 🕵️♀️
8. Security Considerations 😭
Bestie, read this one carefully 🚨🚨
The requirements in this document are NOT intended to make a mechanism that works generally between any arbitrary hosts on the Internet 🙅♀️
What the intention actually is: state requirements for a mechanism used inside a community of devices that are known to obey the mechanism's specification (Spec(T)) and that have secure connections between them. That community is what this doc calls a Trust Domain 🏰
The requirements on the security mechanisms, and on how the Network Asserted Identity is first derived, must be part of the specification Spec(T) 📋
These requirements also support passing information from a node inside the Trust Domain, over a secure connection, to a node outside the Trust Domain 📤
Using this mechanism in any other context has serious security shortcomings. Namely, there is absolutely no guarantee that the information hasn't been modified, or that it was even correct in the first place 💀💀
9. IANA Considerations 🌸
This document doesn't have any implications for IANA 🙌
10. Acknowledgments 🫶
Thanks to Jon Peterson, Cullen Jennings, Allison Mankin and Jonathan Rosenberg for their comments on this document 💜
Normative References
[1] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M. and E. Schooler, "SIP: Session Initiation Protocol", RFC 3261, June 2002. 📚
Author's Address
Mark Watson
Nortel Networks
Maidenhead Office Park
Westacott Way
Maidenhead, BERKS SL6 3QH
UK
EMail: mwatson@nortelnetworks.comFull Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by the Internet Society. 💖
📦 where this page comes from
- ietf: rfc3324 2002-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms