idnits 2.17.00 (12 Aug 2021) /tmp/idnits30953/draft-ietf-stir-messaging-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- -- The document date (21 April 2022) is 23 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'RFCThis' is mentioned on line 315, but not defined == Unused Reference: 'RFC4474' is defined on line 370, but no explicit reference was found in the text == Unused Reference: 'RFC7159' is defined on line 376, but no explicit reference was found in the text == Unused Reference: 'RFC3311' is defined on line 415, but no explicit reference was found in the text == Unused Reference: 'RFC4916' is defined on line 423, but no explicit reference was found in the text ** Obsolete normative reference: RFC 4474 (Obsoleted by RFC 8224) ** Obsolete normative reference: RFC 7159 (Obsoleted by RFC 8259) Summary: 2 errors (**), 0 flaws (~~), 5 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Peterson 3 Internet-Draft Neustar 4 Intended status: Standards Track C. Wendt 5 Expires: 23 October 2022 Somos 6 21 April 2022 8 Messaging Use Cases and Extensions for STIR 9 draft-ietf-stir-messaging-02 11 Abstract 13 Secure Telephone Identity Revisited (STIR) provides a means of 14 attesting the identity of a telephone caller via a signed token in 15 order to prevent impersonation of a calling party number, which is a 16 key enabler for illegal robocalling. Similar impersonation is 17 sometimes leveraged by bad actors in the text messaging space. This 18 document considers the applicability of STIR's Persona Assertion 19 Token (PASSporT) and certificate issuance framework to text and 20 multimedia messaging use cases, both for instant messages carried or 21 negotiated by SIP. 23 Status of This Memo 25 This Internet-Draft is submitted in full conformance with the 26 provisions of BCP 78 and BCP 79. 28 Internet-Drafts are working documents of the Internet Engineering 29 Task Force (IETF). Note that other groups may also distribute 30 working documents as Internet-Drafts. The list of current Internet- 31 Drafts is at https://datatracker.ietf.org/drafts/current/. 33 Internet-Drafts are draft documents valid for a maximum of six months 34 and may be updated, replaced, or obsoleted by other documents at any 35 time. It is inappropriate to use Internet-Drafts as reference 36 material or to cite them other than as "work in progress." 38 This Internet-Draft will expire on 23 October 2022. 40 Copyright Notice 42 Copyright (c) 2022 IETF Trust and the persons identified as the 43 document authors. All rights reserved. 45 This document is subject to BCP 78 and the IETF Trust's Legal 46 Provisions Relating to IETF Documents (https://trustee.ietf.org/ 47 license-info) in effect on the date of publication of this document. 48 Please review these documents carefully, as they describe your rights 49 and restrictions with respect to this document. Code Components 50 extracted from this document must include Revised BSD License text as 51 described in Section 4.e of the Trust Legal Provisions and are 52 provided without warranty as described in the Revised BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 57 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 58 3. Applicability to Messaging Systems . . . . . . . . . . . . . 3 59 3.1. Message Sessions . . . . . . . . . . . . . . . . . . . . 4 60 3.2. PASSporTs and Individiual Messages . . . . . . . . . . . 4 61 3.2.1. PASSporT Conveyance with Messaging . . . . . . . . . 6 62 4. Certificates and Messaging . . . . . . . . . . . . . . . . . 7 63 5. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 7 64 6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 65 6.1. JSON Web Token Claims Registration . . . . . . . . . . . 7 66 6.2. PASSporT Type Registration . . . . . . . . . . . . . . . 7 67 7. Privacy Considerations . . . . . . . . . . . . . . . . . . . 8 68 8. Security Considerations . . . . . . . . . . . . . . . . . . . 8 69 9. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 70 9.1. Normative References . . . . . . . . . . . . . . . . . . 8 71 9.2. Informative References . . . . . . . . . . . . . . . . . 9 72 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11 74 1. Introduction 76 The STIR problem statement [RFC7340] describes widespread problems 77 enabled by impersonation in the telephone network, including illegal 78 robocalling, voicemail hacking, and swatting. As telephone services 79 are increasingly migrating onto the Internet and using Voice over IP 80 (VoIP) protocols such as SIP [RFC3261], it is necessary for these 81 protocols to support stronger identity mechanisms to prevent 82 impersonation. [RFC8224] defines a SIP Identity header field capable 83 of carrying PASSporT [RFC8225] objects in SIP as a means to 84 cryptographically attest that the originator of a telephone call is 85 authorized to use the calling party number (or, for native SIP cases, 86 SIP URI) associated with the originator of the call. 88 The problem of bulk, unsolicited commercial communications is not 89 however limited to telephone calls. Although the problem is not 90 currently widespread, spammers and fraudsters are turning to 91 messaging applications to deliver undesired content to consumers. In 92 some respects, mitigating these unwanted messages resembles the email 93 spam problem: textual analysis of the message contents can be used to 94 fingerprint content that is generated by spammers, for example. 95 However, encrypted messaging is becoming more common, and analysis of 96 message contents may no longer be a reliable way to mitigate 97 messaging spam in the future. And as STIR sees further deployment in 98 the telephone network, the governance structures put in place for 99 securing telephone network resources with STIR could be repurposed to 100 help secure the messaging ecosystem. 102 One of the more sensitive applications for message security is 103 emergency services. As next-generation emergency services 104 increasingly incorporate messaging as a mode of communication with 105 public safety personnel (see [RFC8876]), providing an identity 106 assurance could help to mitigate denial-of-service attacks, as well 107 as ultimately helping to identify the source of emergency 108 communications in general (including swatting attacks, see 109 [RFC7340]). 111 This specification therefore explores how the PASSporT mechanism 112 defined for STIR could be applied to providing protection for textual 113 and multimedia messaging, but focuses particularly on those messages 114 that use telephone numbers as the identity of the sender. It 115 moreover considers the reuse of existing STIR certificates, which are 116 beginning to see widespread deployment, for signing PASSporTs that 117 protect messages. 119 2. Terminology 121 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 122 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 123 "OPTIONAL" in this document are to be interpreted as described in BCP 124 14 [RFC2119] [RFC8174] when, and only when, they appear in all 125 capitals, as shown here. 127 3. Applicability to Messaging Systems 129 At a high level, baseline PASSporT [RFC8225] claims provide similar 130 value to number-based messaging as they do to traditional telephone 131 calls. A signature over the calling and called party numbers, along 132 with a timestamp, could already help to prevent impersonation in the 133 mobile messaging ecosystem. When it comes to protecting message 134 contents, broadly, there are a few ways that the PASSporT mechanism 135 of STIR could apply to messaging: first, a PASSporT could be used to 136 securely negotiate a session over which messages will be exchanged; 137 and second, in sessionless scenarios, a PASSporT could be generated 138 on a per-message basis with its own built-in message security. 140 3.1. Message Sessions 142 For the first case, where SIP negotiates a session where the media 143 will be text messages, as for example with the Message Session Relay 144 Protocol (MSRP) [RFC4975], the usage of STIR would deviate little 145 from [RFC8224]. An INVITE request sent with an Identity header 146 containing a PASSporT with the proper calling and called party 147 numbers would then negotiate an MSRP session the same way that an 148 INVITE for a telephone call would negotiate an audio session. This 149 could be applicable to MSRP sessions negotiated for RCS [RCC.07]. 150 Note that if TLS is used to secure MSRP (per RCS [RCC.15]), 151 fingerprints of those TLS keys could be secured via the "mky" claim 152 of PASSporT using the [RFC8862] framework. Similar practices would 153 apply to sessions that negotiate text over RTP via [RFC4103] or 154 similar mechanisms. Messages can also be sent over a variety of 155 other transports negotiated by SIP (including for example Real-Time 156 Text [RFC5194]; any that can operate over DTLS/SRTP should work with 157 the "mky" PASSporT claim. For the most basic use cases, STIR for 158 messaging should not require any further protocol enhancements. 160 Current usage of baseline [RFC8224] Identity is largely confined to 161 INVITE requests that initiate telephone calls. RCS-style 162 applications would require PASSporTs for all conversation 163 participants, which could become complex in multi-party 164 conversations. Any solution in this space would likely require the 165 implementation of STIR connected identity 166 [I-D.peterson-stir-rfc4916-update], but the specification of 167 PASSporT-signed session conferencing is outside the scope of this 168 document. 170 Also note that the assurance offered by [RFC8862] is "end-to-end" in 171 the sense that it offers assurance between an authentication service 172 and verification service. If those are not implemented by the 173 endpoints themselves, there are still potential opportunities for 174 tampering before messages are signed and after they are verified. 175 For the most part, STIR does not intend to protect against man-in- 176 the-middle attacks so much as spoofed origination, however, so the 177 protection offered may be sufficient to mitigate nuisance messaging. 179 3.2. PASSporTs and Individiual Messages 181 In the second case, SIP also has a method for sending messages in the 182 body of a SIP request: the MESSAGE [RFC3428] method. MESSAGE is used 183 for example in some North American emergency services use cases. The 184 interaction of STIR with MESSAGE is not as straightforward as the 185 potential use case with MSRP. An Identity header could be added to 186 any SIP MESSAGE request, but without some extension to the PASSporT 187 claims, the PASSporT would offer no protection to the message 188 content, and potentially be reusable for cut-and-paste attacks. As 189 the bodies of SIP requests are MIME encoded, S/MIME [RFC8591] has 190 been proposed as a means of providing integrity for MESSAGE (and some 191 MSRP cases as well). The use of CPIM [RFC3862] as a MIME body allows 192 the integrity of messages to withstand interworking with non-SIP 193 protocols. The interaction of [RFC8226] STIR certificates with S/ 194 MIME for messaging applications requires some further explication; 195 and additionally, PASSporT can provide its own integrity check for 196 message contents through a new claim defined to provide a hash over 197 message contents. 199 In order to differentiate a PASSporT for an individual message from a 200 PASSporT used to secure a telephone call or message stream, this 201 document defines a new "msg" PASSporT Type. "msg" PASSporTs may carry 202 a new optional JWT [RFC7519] claim "msgi" which provides a digest 203 over a MIME body that contains a text or multimedia message. "msgi" 204 MUST NOT appear in PASSporTs with a type other than "msg", but they 205 are OPTIONAL in "msg" PASSporTs, as integrity for messages may be 206 provided by some other service (e.g. [RFC8591]). Implementations of 207 "msgi" MUST support the following hash algorithms: "SHA256", 208 "SHA384", or "SHA512", which are defined as part of the SHA-2 set of 209 cryptographic hash functions by the NIST. 211 A "msgi" message digest is computed over the entire MIME body of a 212 SIP message, which per [RFC3428] may any sort of MIME body, including 213 a multipart body in some cases, especially when multimedia content is 214 involved. The digest becomes the value of the JWT "msgi" claim, as 215 per this example: 217 "msgi" : 218 "sha256-H8BRh8j48O9oYatfu5AZzq6A9RINQZngK7T62em8MUt1FLm52t+eX6xO" 220 Note that in some CPIM environments, intermediaries may add or 221 consume CPIM headers used for metadata in messages. MIME-layer 222 integrity protection of "msgi" would be broken by a modification 223 along these lines. Any such environment would require a profile of 224 this specification that reduces the scope of protection only to the 225 CPIM payload, as discussed in [RFC8946] Section 9.1. 227 Finally, note that messages may be subject to store-and-forward 228 treatment that differs from traditional delivery expectations of SIP 229 transactions. In such cases, the expiry timers recommended by 230 [RFC8224] may be too strict, as routine behavior might dictate the 231 delivery of a MESSAGE minutes or hours after it was sent. The 232 potential for replay attacks can, however, be largely mitigated by 233 the timestamp in PASSporTs; duplicate messages are easily detected, 234 and the timestamp can order mesages displayed to the user inbox in a 235 way that precludes showing stale messages as fresh. Relaxing the 236 expiry timer would require support for such features on the receiving 237 side of the message. 239 3.2.1. PASSporT Conveyance with Messaging 241 If the message is being conveyed in SIP, via the MESSAGE method, then 242 the PASSporT could be conveyed in an Identity header field in that 243 request. The authentication and verification service procedures for 244 populating that PASSporT would follow [RFC8224], with the addition of 245 the "msgi" claim defined in Section 3.2. 247 In text messaging today, multimedia message system (MMS) messages are 248 often conveyed with SMTP. There are thus a suite of additional email 249 security tools available in this environment for sender 250 authentication, such as DMARC [RFC7489]. The interaction of these 251 mechanisms with STIR certificates and/or PASSporTs would require 252 further study and is outside the scope of this document. 254 For other cases where messages are conveyed by some protocol other 255 than SIP, that protocol might itself have some way of conveying 256 PASSporTs. But there will surely be cases where legacy transmission 257 of messages will not permit an accompanying PASSporT, in which case 258 something like out-of-band [RFC8816] conveyance would be the only way 259 to deliver the PASSporT. This may be necessary to support cases 260 where legacy SMPP systems cannot be upgraded, for example. 262 A MESSAGE request can be sent to multiple destinations in order to 263 support multiparty messaging. In those cases, the "dest" field of 264 the PASSporT can accommodate the multiple targets of a MESSAGE 265 without the need to generate a PASSporT for each target of the 266 message. If however the request is forked to multiple targets by an 267 intermediary later in the call flow, and the list of targets is not 268 available to the authentication service, then that forking 269 intermediary would need to use diversion [RFC8946] PASSporTs to sign 270 for its target set. 272 4. Certificates and Messaging 274 The [RFC8226] STIR certificate profiles defines a way to issue 275 certificates that sign PASSporTs, which attest through their 276 TNAuthList a Service Provider Code (SPC) and/or a set of one or more 277 telephone numbers. This specification proposes that the semantics of 278 these certificates should suffice for signing for messages from a 279 telephone number without further modification. 281 As the "orig" and "dest" field of PASSporTs may contain URIs 282 containing SIP URIs without telephone numbers, the STIR for messaging 283 mechanism contained in this specification is not inherently 284 restricted to the use of telephone numbers. This specification 285 offers no guidance on certification authorities who are appropriate 286 to sign for non-telephone number "orig" values. 288 5. Acknowledgments 290 We would like to thank Christer Holmberg, Brian Rosen, Ben Campbell, 291 and Alex Bobotek for their contributions to this specification. 293 6. IANA Considerations 295 6.1. JSON Web Token Claims Registration 297 This specification requests that the IANA add one new claim to the 298 JSON Web Token Claims registry as defined in [RFC7519]. 300 Claim Name: "msgi" 302 Claim Description: Message Integrity Information 304 Change Controller: IESG 306 Specification Document(s): [RFCThis] 308 6.2. PASSporT Type Registration 310 This specification defines one new PASSporT type for the PASSport 311 Extensions Registry defined in [RFC8225], which resides at 312 https://www.iana.org/assignments/passport/passport.xhtml#passport- 313 extensions. It is: 315 "msg" as defined in [RFCThis] Section 3.2. 317 7. Privacy Considerations 319 Signing messages or message sessions with STIR has little direct 320 bearing on the privacy of messaging for SIP as described in [RFC3428] 321 or [RFC4975]. An authentication service signing a MESSAGE method may 322 compute the "msgi" hash over the message contents; if the message is 323 in cleartext, that will reveal its contents to the authentication 324 service, which might not otherwise be in the call path. 326 The implications for anonymity of SITR are discussed in [RFC8224], 327 and those considerations would apply equally here for anonymous 328 messaging. 330 8. Security Considerations 332 This specification inherits the security considerations of [RFC8224]. 333 The carriage of messages within SIP per Section 3.2 has a number of 334 security and privacy implications as documented in [RFC3428], which 335 are expanded in [RFC8591]; these considerations apply here well. 337 Note that a variety of non-SIP protocols, both those integrated into 338 the traditional telephone network and those based on over-the-top 339 applications, are responsible for most of the messaging that is sent 340 to and from telephone numbers today. Introducing this capability for 341 SIP-based messaging will help to mitigate spoofing and nuisance 342 messaging for SIP-based platforms only. 344 9. References 346 9.1. Normative References 348 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 349 Requirement Levels", BCP 14, RFC 2119, 350 DOI 10.17487/RFC2119, March 1997, 351 . 353 [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, 354 A., Peterson, J., Sparks, R., Handley, M., and E. 355 Schooler, "SIP: Session Initiation Protocol", RFC 3261, 356 DOI 10.17487/RFC3261, June 2002, 357 . 359 [RFC3428] Campbell, B., Ed., Rosenberg, J., Schulzrinne, H., 360 Huitema, C., and D. Gurle, "Session Initiation Protocol 361 (SIP) Extension for Instant Messaging", RFC 3428, 362 DOI 10.17487/RFC3428, December 2002, 363 . 365 [RFC3862] Klyne, G. and D. Atkins, "Common Presence and Instant 366 Messaging (CPIM): Message Format", RFC 3862, 367 DOI 10.17487/RFC3862, August 2004, 368 . 370 [RFC4474] Peterson, J. and C. Jennings, "Enhancements for 371 Authenticated Identity Management in the Session 372 Initiation Protocol (SIP)", RFC 4474, 373 DOI 10.17487/RFC4474, August 2006, 374 . 376 [RFC7159] Bray, T., Ed., "The JavaScript Object Notation (JSON) Data 377 Interchange Format", RFC 7159, DOI 10.17487/RFC7159, March 378 2014, . 380 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 381 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 382 May 2017, . 384 [RFC8224] Peterson, J., Jennings, C., Rescorla, E., and C. Wendt, 385 "Authenticated Identity Management in the Session 386 Initiation Protocol (SIP)", RFC 8224, 387 DOI 10.17487/RFC8224, February 2018, 388 . 390 [RFC8225] Wendt, C. and J. Peterson, "PASSporT: Personal Assertion 391 Token", RFC 8225, DOI 10.17487/RFC8225, February 2018, 392 . 394 [RFC8226] Peterson, J. and S. Turner, "Secure Telephone Identity 395 Credentials: Certificates", RFC 8226, 396 DOI 10.17487/RFC8226, February 2018, 397 . 399 9.2. Informative References 401 [I-D.peterson-stir-rfc4916-update] 402 Peterson, J. and C. Wendt, "Connected Identity for STIR", 403 Work in Progress, Internet-Draft, draft-peterson-stir- 404 rfc4916-update-04, 12 July 2021, 405 . 408 [RCC.07] GSMA RCC.07 v9.0 | 16 May 2018, "Rich Communication Suite 409 8.0 Advanced Communications Services and Client 410 Specification", 2018. 412 [RCC.15] GSMA PRD-RCC.15 v5.0 | 16 May 2018, "IMS Device 413 Configuration and Supporting Services", 2018. 415 [RFC3311] Rosenberg, J., "The Session Initiation Protocol (SIP) 416 UPDATE Method", RFC 3311, DOI 10.17487/RFC3311, October 417 2002, . 419 [RFC4103] Hellstrom, G. and P. Jones, "RTP Payload for Text 420 Conversation", RFC 4103, DOI 10.17487/RFC4103, June 2005, 421 . 423 [RFC4916] Elwell, J., "Connected Identity in the Session Initiation 424 Protocol (SIP)", RFC 4916, DOI 10.17487/RFC4916, June 425 2007, . 427 [RFC4975] Campbell, B., Ed., Mahy, R., Ed., and C. Jennings, Ed., 428 "The Message Session Relay Protocol (MSRP)", RFC 4975, 429 DOI 10.17487/RFC4975, September 2007, 430 . 432 [RFC5194] van Wijk, A., Ed. and G. Gybels, Ed., "Framework for Real- 433 Time Text over IP Using the Session Initiation Protocol 434 (SIP)", RFC 5194, DOI 10.17487/RFC5194, June 2008, 435 . 437 [RFC7340] Peterson, J., Schulzrinne, H., and H. Tschofenig, "Secure 438 Telephone Identity Problem Statement and Requirements", 439 RFC 7340, DOI 10.17487/RFC7340, September 2014, 440 . 442 [RFC7489] Kucherawy, M., Ed. and E. Zwicky, Ed., "Domain-based 443 Message Authentication, Reporting, and Conformance 444 (DMARC)", RFC 7489, DOI 10.17487/RFC7489, March 2015, 445 . 447 [RFC7519] Jones, M., Bradley, J., and N. Sakimura, "JSON Web Token 448 (JWT)", RFC 7519, DOI 10.17487/RFC7519, May 2015, 449 . 451 [RFC8591] Campbell, B. and R. Housley, "SIP-Based Messaging with S/ 452 MIME", RFC 8591, DOI 10.17487/RFC8591, April 2019, 453 . 455 [RFC8816] Rescorla, E. and J. Peterson, "Secure Telephone Identity 456 Revisited (STIR) Out-of-Band Architecture and Use Cases", 457 RFC 8816, DOI 10.17487/RFC8816, February 2021, 458 . 460 [RFC8862] Peterson, J., Barnes, R., and R. Housley, "Best Practices 461 for Securing RTP Media Signaled with SIP", BCP 228, 462 RFC 8862, DOI 10.17487/RFC8862, January 2021, 463 . 465 [RFC8876] Rosen, B., Schulzrinne, H., Tschofenig, H., and R. 466 Gellens, "Non-interactive Emergency Calls", RFC 8876, 467 DOI 10.17487/RFC8876, September 2020, 468 . 470 [RFC8946] Peterson, J., "Personal Assertion Token (PASSporT) 471 Extension for Diverted Calls", RFC 8946, 472 DOI 10.17487/RFC8946, February 2021, 473 . 475 Authors' Addresses 477 Jon Peterson 478 Neustar, Inc. 479 Email: jon.peterson@team.neustar 481 Chris Wendt 482 Somos 483 Email: chris-ietf@chriswendt.net