A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / STIR, PASSporT, and SHAKEN

STIR, PASSporT, and SHAKEN

STIR is RFC 8224, PASSporT is RFC 8225, certificates are RFC 8226, and the SHAKEN extension is RFC 8588. Attestation levels are ATIS.

Learn in 5 minutes

  1. Point at the four RFCs for STIR, PASSporT, certificates, and SHAKEN
  2. Require a verified Identity header before calling a call authenticated
  3. Attribute attestation levels to ATIS and confirm the current document

Visual

No Identity header, no STIR result · study drawing · cyphermonkeylabs.com AliceSBCCarrier INVITE 100 INVITE 180

SVG HTML PNG

PAI is not a layer in this stack. Attestation levels are not invented here.

Worked example

No Identity header Dissect the INVITE. Decide whether it is STIR-authenticated.

  1. Press Dissect.
  2. Search for an Identity header.
  3. State the STIR result.

Fault

A console labels the call verified. The INVITE has P-Asserted-Identity and no Identity header.

STIR is RFC 8224. A missing Identity header is not a successful verification.

Quiz

STIR is


PASSporT is


The SHAKEN PASSporT extension is


Attestation levels A, B, and C are


An INVITE with no Identity header is


PAI can replace a missing STIR signature


Ecosystem

Glossary, sister systems, and the integration seam for this room.

CRM Screen pop uses data the contact center already has: ANI, DNIS, case id. Those values may arrive in SIP headers or in a CTI event after the call is up. The CRM is not a SIP element.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper