CPaaS LabFree University

T5 · T5-R14 · STIR and SHAKEN

SHAKEN, PASSporT, and the Identity header

SHAKEN is the transport and handling profile. STIR is the identity work. PASSporT is the token RFC 8225 names. The Identity header is where the Wikipedia article says the token rides. You can draw that path without claiming a vendor has signed your test call.

ExportSVGFlowSheet

Counts on this page

4boxes
4opened sources
2confirm rows
5study lines

Opened sources

Confirm rows, no URL

Learn it in 5 minutes

  • The Wikipedia article says SHAKEN stands for Signature-based Handling of Asserted information using toKENs.
  • It says SHAKEN was developed by the SIP Forum and ATIS to implement STIR, and that STIR is designed for calls routed through VoIP rather than the SS7 telephone network.
  • The article says a STIR system produces a token with the originating number, the called number, and the attestation level, and that this is appended to the SIP request in an Identity field.
  • RFC 8225 defines PASSporT, a Personal Assertion Token that cryptographically verifies an originating identity.
  • RFC 8224 defines authenticated identity management in SIP and says the baseline SIP security mechanisms are inadequate for assuring end-user identity in an interdomain context. The page says it obsoletes RFC 4474.

Visual

SHAKEN, PASSporT, and the Identity header Token. Teaching sketch. Confirm a live system. SHAKEN PASSporT Identity SIP Names come from pages opened in 2026-10. A missing name stays confirm.

Count the boxes: 4. Each label is a name from a page or a study label marked on the drawing.

Flow

SHAKEN, PASSporT, and the Identity header Caller SIP Called session setup session setup RTP, not required to hairpin Teaching sketch from RFC 3261 and RFC 3550. Not a packet capture.

What is going on

SHAKEN is the transport and handling profile. STIR is the identity work. PASSporT is the token RFC 8225 names. The Identity header is where the Wikipedia article says the token rides. You can draw that path without claiming a vendor has signed your test call.

The article also says STIR does not, by itself, tell the network to block a call when the check fails, because during rollout many calls have no STIR information. A platform policy that drops unsigned calls is a local choice. It is not a sentence this lab found in RFC 8224's abstract.

Worked example

Draw SIP, then an Identity header, then the called party. Label the token PASSporT from RFC 8225. Label the profile SHAKEN from the article. If the call is still on SS7 only, write the article's limit: STIR is specified for the VoIP section.

Quiz

1. The article says the token is appended in an Identity field.

2. RFC 8224's title says it obsoletes RFC 3261.

Ecosystem

Sister pieces sit on the ecosystem page: the glossary, the mind map, the integration map, and the bridges.

  • SHAKEN — Signature-based Handling of Asserted information using toKENs, the profile Wikipedia attributes to the SIP Forum and ATIS.
  • PASSporT — The Personal Assertion Token defined in RFC 8225.

Config. When you capture a header, record Identity and the attestation if it is present. Do not log a private key.

Troubleshooting. A verifier failure on the article's terms means the signature did not check with the provider's public key. Look there before you rewrite the dialed number.

Bridge. A SIP trunk into the PSTN is the edge the article describes, where a VoIP call can receive STIR information. The trunk room is the topology. This room is the signature.

Mind map, sister technologies, and future hooks live on the ecosystem page.

Sources and go deeper

Opened 2026-10. A row marked confirm has no link, because that page was not verified.

sources.json Markdown