Re: scope of derive
Dean Willis <[email protected]>
| Newsgroups | gmane.ietf.sip |
|---|---|
| Message-ID | <[email protected]> |
On Dec 5, 2008, at 3:27 PM, Hadriel Kaplan wrote: > > >> -----Original Message----- >> From: [email protected] [mailto:[email protected]] On Behalf >> Of Dean >> Willis >> Sent: Friday, December 05, 2008 12:22 PM >> >> In a third attack scenario, presume the attacker's goal is to >> impersonate a caller, such as the infamous "Radio-Show Sarkozy/Palin" >> calls. >> Here the goal is not necessarily to prevent the call, but to give the >> called party some level of comfort as to the authenticity of the >> caller's expression of identity. >> Indirect return routability checks clearly establish that the calling >> party is sufficiently in-control of the expressed identity as to be >> able to receive calls directed toward that identity. This is better >> than nothing; it can't prove identity, but it greatly decreases the >> probability of a random radio DJ being able to make a prank call. > > Actually, I would debate that. Derive and other return-routability > checks have the property of: "if I pass then you know I'm good, if I > fail then you know nothing (neither good nor bad)". I would argue > such a property is only useful in voice communications if it passes > and provides a positive/"good" result *frequently*. Well, if you had previously told me that you should always pass RRC and then fail, I might assume the caller isn't you. > > > For example, if the odds of Derive passing is low in general, then > Palin would have had to assume it *was* Sarkozy even if it failed. > Why? Because she assumes it now, with no such checking, and the > odds of this thing passing are low per the supposition. > > Therefore, if we feel the odds of a return-routability check > succeeding is low in general, it is NOT the case that: "it greatly > decreases the probability of a random radio DJ being able to make a > prank call." But in general, you're confounding the second part of my analysis with the first, so keep reading . . . -- Dean _______________________________________________ Sip mailing list https://www.ietf.org/mailman/listinfo/sip This list is for NEW development of the core SIP Protocol Use [email protected] for questions on current sip Use [email protected] for new developments on the application of sip