Subject: [Enum] Privacy and Security Draft for discussion in Vienna

From: Richard Shockey <[email-masked]>
Date: Wed, 09 Jul 2003 23:02:58 -0400

The authors sincerely apologize for the lateness of this draft however we 
welcome comments in advance of meeting in Vienna.

http://www.shockey.us/enum/draft-ietf-enum-privacy-security-01.txt

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or <mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

_______________________________________________
enum mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/enum

---

From: "Stastny Richard" <[email-masked]>
Date: Fri, 11 Jul 2003 16:23:01 +0200

Hi,

first I want to congratulate the authors for this document, it is
describing very
consistensly and also neutrally the issues with ENUM regarding security
and privacy.

The question now is how to proceed with the issues raised.

I would propose to split the issues in different parts, as already
started in the document
The reason for this is that we have security and privacy issues.
So the first split is in security and privacy issues.

1. Security Issues:
1a Security issues that are of direct concern to IETF and also can be
solved
by IETF (e.g. all DNS related issues, primarily DNSSEC) - 5.2

1b Security issues related to provisioning - 5.1
Here we have IETF related parts as mentioned, eg EPP

1c Security issues related to the administration and consistency
of the E.164 numbering plan, including validation
Since this is dependant also on national regulations, this is out
of scope of IETF, but maybe some experiences and best practices may be
exchanged

2. Privacy Issues

Privacy isues are a serious problem for all kinds of communication and
the
approach to this problem choosen in the document is in my opinion a good
one
and should be continued.

First, different people have different requirements on privacy
So the privacy concerns or problems should be recognized and hints
should be given how to deal with this concerns.

The protocols (not only ENUM, but also SIP, email, etc.) should be able
to deal with
this problems. 

This means that the issues raised in the document should be analysed in
more details
and result finally in additional requirements for the communications
protocols and
in a document giving guidelines to users how to use these protocol
enhancements
properly.

Example:
The most serious problem raised with ENUM is the spam problem. In my
opinion
the spam problem cannot be solved by not implementing translation or
directory services,
it can only be solved by implementing on one side proper laws against
spam and on the
other side proper tools to enforce this laws. This means in case of
VoIP, email and ENUM that
a proper and trustable way to identify calling parties is necessary.

We should not forget that the purpose of communication is to be able to
communicate and to achieve this, directory services are necessary (I
know,
ENUM is NOT a directory service, but it enables e.g. existing directory
services
for E.164 numbers to be used for other applications also). And we should
also not forget
that directory services are a basic part of the universal service (at
least in some countries).
And a way to be ex-directory, but also in ENUM has already be shown.

And BTW, having no directory services at all will not solve the spam
problem.

regards
Richard Stastny

> -----Original Message-----
> From: Richard Shockey [mailto:[email-masked]] 
> Sent: Thursday, July 10, 2003 5:03 AM
> To: [email-masked]
> Cc: [email-masked]
> Subject: [Enum] Privacy and Security Draft for discussion in Vienna
> 
> 
> 

Richard Shockey, Senior Manager, Strategic Technology Initiatives
NeuStar Inc.
46000 Center Oak Plaza  -   Sterling, VA  20166
Voice +1 571.434.5651 Cell : +1 703.593.2683,  Fax: +1 815.333.1237
<mailto:richard(at)shockey.us> or
<mailto:richard.shockey(at)neustar.biz>
  <http://www.neustar.biz> ; <http://www.enum.org>
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<