SHAKEN and Privacy David Hancock Chris Wendt July

SHAKEN and Privacy David Hancock, Chris Wendt July 10, 2018 1

Privacy procedures • RFC 3323 defines Privacy header • Tells UA how to anonymize various headers; e. g. , From: sip: anonymous@anonymous. invalid • Defines three privacy types supported by privacy service: "header", "session", and "user" Requested by UA to anonymize user identity info that the UA is unable to anonymize ; e. g. , Via header URI Requested by UA to anonymize endpoint’s media address Requested by network on behalf of UA when UA doesn’t support anonymization of From header • RFC 3325 defines privacy type "id” • Requested by UA to remove P-Asserted-Identity header when INVITE sent outside trust boundary • RFC 7044 defines privacy type "history" • Requested by UA to anonymize History-Info header 2

Message flow example for privacy type "id" Trust Domain SP-b SP-a S-CSCF [2] INVITE TN-b To: TN-b; From: sip: anonymous@anonymous. invalid Privacy: id; PAID: TN-a Originating P-CSCF Adds PAID header per RFC 3325 [3] INVITE TN-b To: TN-b; From: sip: anonymous@anonymous. invalid Privacy: id; PAID: TN-a; P-CSCF S-CSCF [4] INVITE TN-b To: TN-b; From: sip: anonymous@anonymous. invalid Privacy: id; PAID: TN-a; P-CSCF Terminating P-CSCF Removes PAID header per RFC 3325 [1] INVITE TN-b [5] INVITE TN-b To: TN-b; From: sip: anonymous@anonymous. invalid Privacy: id Originating UE Adds privacy-type "id" per RFC 3325 Anonymizes From header per RFC 3323 UE-a TN-a UE-b TN-b Display "anonymous" 3

Privacy/SHAKEN Interworking • RFC 8224 defines interactions between privacy and STIR • If From header is used for "orig" claim, then STI-AS cannot authenticate since it is not authoritative for domain anonymous. invalid • If PAID header used for "orig" claim, then STI-AS can perform normal authentcation • Terminating network MUST NOT remove Identity header from INVITE that contains Privacy: id, but should change PASSor. T full form to compact form to hide identity of calling user • TS 24. 229 doesn’t say anything about SHAKEN/privacy interworking, but… • Mandates that Verstat is added to any PAID and From header that contains PASSpor. T "orig" TN • Therefore, Verstat is not sent to called UE when INVITE contains Privacy: id, since PAID header is removed and From header is anonymized 4

Proposal for SHAKEN when INVITE contains Privacy: id • In originating network… • STI-AS performs normal SHAKEN authentication using PAID TN • In terminating network… • No need to perform verification since Verstat cannot be sent to called UE • STI-AS stores Identity information for later trace-back • If local policy dictates that Identity header is to be sent to called UE (e. g. , to support SIP-PBX diversion), then replace full-form PASSpor. T with compact form 5

SHAKEN authentication and verification message flow when INVITE contains Privacy: id Trust Domain SP-b SP-a STI-AS S-CSCF [2] INVITE TN-b From: sip: anonymous@anonymous. invalid; To: TN-b; Privacy: id; PAID: TN-a P-CSCF [1] INVITE TN-b From: sip: anonymous@anonymous. invalid; To: TN-b; Privacy: id UE-a TN-a [3] INVITE TN-b From: sip: anonymous@anonymous. invalid; To: TN-b; Privacy: id; PAID: TN-a; Identity: shaken PASSpor. T {"orig"=TN-a, "dest"=TN-b, "attest"= full} STI-VS S-CSCF STI-VS Due to presence of Privacy: id store Identity header w/o verifying [4] INVITE TN-b From: sip: anonymous@anonymous. invalid; To: TN-b; Privacy: id; PAID: TN-a; Identity: shaken PASSpor. T {"orig"=TN-a, "dest"=TN-b, "attest"= full} P-CSCF Terminating P-CSCF [5] INVITE TN-b Removes PAID header per RFC 3325. Either removes Identity header (per local From: sip: anonymous@anonymous. invalid; policy) or converts Identity PASSpor. T to To: TN-b; compact form (per RFC 8224). UE-b Privacy: id TN-b Display "anonymous" 6