Handling of Identity Header Errors for Secure Telephone Identity Revisited (STIR)
Extracted elements (20)
The "ppi" parameter uses the PASSporT itself (or its compact form) as a unique identifier for correlating a Reason header field error to a specific Identity header field, rather than introducing a separate sequence-number mechanism. This leverages the cryptographic uniqueness of the PASSporT signature to avoid ambiguity when multiple Identity headers are present.
The use of a Reason header field in provisional (1xx) responses allows a verification error to be communicated back to the authentication service without terminating the call. This enables deployments where policy prefers to continue the call despite unverified identity, while still notifying the authentication service for corrective action such as logging or alarming.
The use of multiple Reason header fields with the same protocol value "STIR" is enabled by RFC 9366, which updated RFC 3326 to allow multiple Reason header fields. Implementations must support this to handle scenarios with multiple Identity header field errors.
A Reason header field using the STIR protocol and the "ppi" parameter MUST only identify a single cause code in the context of a call dialog, corresponding only to STIR-related error codes defined in RFC 8224 or future documents.
Any provisional SIP response or final response message, with the exception of a 100 (Trying), MAY contain one or more Reason header fields with a STIR-related cause code defined in RFC 8224 or future specifications.
Compact form of the PASSporT is RECOMMENDED over full form in the "ppi" parameter, as full form may include information that could have privacy or security implications in some call scenarios.
For a SIP INVITE containing multiple Identity header fields, the "ppi" parameter for the Reason header field is RECOMMENDED to associate the error with the specific Identity header field that failed verification.
If there are multiple Identity header field verification errors, the verification service MUST include a corresponding number of Reason header fields, one per error, each with a "ppi" parameter identifying the specific failing Identity header field along with cause and text parameters.
The reason cause in the Reason header field MUST represent the specific error that occurred when verifying the contents of the particular Identity header field in question.
When a SIP message includes multiple Identity header fields and one has an error, the verification service MUST include the error response code and reason phrase in a Reason header field in the next provisional or final response sent to the authentication service.
When an authentication service receives a Reason header field containing a PASSporT it generated, it MUST remove that Reason header field from the response before forwarding upstream, to prevent PASSporT information from reaching a UAC or UAS not authorized to see it.
When local policy dictates that a call should continue despite verification errors (including 4xx errors per RFC 8224 Section 6.2.2), the verification service MUST NOT send the 4xx as a response. Instead, it should include the error response code and reason phrase in a Reason header field in the next provisional or final response sent to the authentication service.
RFC 9410 defines a new Reason header field protocol value "STIR" for use with SIP-based STIR applications. This protocol value enables STIR-specific error cause codes defined in RFC 8224 to be carried in Reason header fields, including in provisional (1xx) and final responses.
The "ppi" parameter is defined for the Reason header field to carry a PASSporT object (either full form or compact form) that identifies which specific Identity header field is associated with a STIR verification error. The compact form consists of only the PASSporT signature prefixed by two periods.
IANA registered a new header field parameter name "ppi" for the Reason header field (with no predefined values) in the "Header Field Parameters and Parameter Values" registry under the SIP parameters registry.
IANA registered the new protocol value "STIR" (with protocol cause "STIR Error code" referencing RFC 8224) in the "Reason Protocols" registry under the SIP parameters registry.
The authentication service MUST remove the Reason header field containing the PASSporT to protect against replay attacks (a still-fresh PASSporT could be reused) and to prevent private call information from being exposed to the call initiator or other upstream entities.
Use of the compact form PASSporT is RECOMMENDED in the "ppi" parameter to avoid potential exposure of call information (such as originating/destination identities and timestamps) contained in the full form of the PASSporT.
When a PASSporT is included in a Reason header field, there is a risk that PASSporT information could be passed upstream beyond the authentication service that originally signed it. For diversion-based call flows, the signer may not be the first-hop initiator, increasing the exposure risk.
The compact form PASSporT included in the "ppi" parameter contains only the signature field of the PASSporT, prefixed with two periods (e.g., "..rq3pjT1..."), as defined in Section 7 of RFC 8225. The full form includes the complete base64url-encoded PASSporT header, payload, and signature.