Jump to content

Talk:STIR/SHAKEN

Page contents not supported in other languages.
From Wikipedia, the free encyclopedia

Remove extra references at end of paragraphs in STIR section?

[edit]

In the STIR section, every paragraph has a "[7]" at the end because there is a <ref name="Understand" /> reference. It does not seem to me that ALL of these references are needed. Would others agree that they should be removed? --Dyork (talk) 22:58, 6 January 2020 (UTC)[reply]

Encrypting vs. Signing?

[edit]

The article currently says: The provider then attaches an encrypted certificate to the SIP header with the service provider's identity and a trust value. VoIP software on the receiving end can check the authenticity of the message by decrypting STIR using the provider's public key. Typically, a public key is either used to encrypt data or verify a signature, and a private key is used to decrypt the data (or sign it). So is this paragraph actually talking about signing, not encrypting? --Stefan2904 (talk) 13:27, 12 April 2024 (UTC)[reply]

Technically, signing is sort of subclass of encryption, it's just that both the public and private key within the protocol are generated by the same party. 104.229.11.48 (talk) 05:04, 27 July 2024 (UTC)[reply]
STIR/SHAKEN as done by US service providers for a JSON Web Token (JWT) in the form of a SHAKEN Personal Assertion Token (PASSporT) does not attach a certificate. Instead, a URL reference to the location of the certificate file (which should be of type .pem) is included in both the JWT header "x5u" parameter, and also in the "info" parameter of the optional IDENTITY header containing the SHAKEN PASSporT of a SIP INVITE method message. i.e., the provider does not attach a certificate, they reference the certificate location. e.g., info=<https://cert.originating.provider.net/stircert.pem>;alg=ES256;ppt="shaken". 2605:A601:AE1C:4300:E599:EEFC:5D8C:DB4E (talk) 20:21, 27 May 2025 (UTC)[reply]