A student's open lab: learning and sharing, free for everyone.

SIP UniverseFree University

Home / TLS, SRTP, identity, and abuse / Privacy and asserted identity

Privacy and asserted identity

Privacy is RFC 3323. P-Asserted-Identity and P-Preferred-Identity are for trusted networks, not cryptographic identity.

Learn in 5 minutes

  1. Name the Privacy header and the id token
  2. Keep PAI and PPI inside a trust domain
  3. Refuse to treat PAI as a signature

Visual

PAI stops at the edge · study drawing · cyphermonkeylabs.com AliceSBCCarrier INVITE 100 INVITE 180

SVG HTML PNG

PPI is a hint from the UA. PAI is inserted by a trusted element. Both stop at the edge.

Worked example

See PAI on the wrong hop This INVITE is addressed to the carrier and still contains P-Asserted-Identity and Privacy: id.

  1. Press Dissect.
  2. Find Privacy and P-Asserted-Identity.
  3. Decide whether this hop is still inside a trust domain.

Fault

The carrier shows alice@example.com as a verified network identity. The SBC forwarded PAI on a request that also asked for Privacy id.

P-Asserted-Identity is a trusted-network header. It is not cryptographic identity, and Privacy id asks that it be withheld.

Quiz

RFC 3323 defines


P-Asserted-Identity is


P-Preferred-Identity is


At the edge of the trust domain you


Privacy: id means


A screen that says verified because PAI is present is


Ecosystem

Glossary, sister systems, and the integration seam for this room.

Analytics Amazon Connect can attach conversational analytics to an external voice system with a SIPREC connector. The analytics plane is not a second SIP proxy for the customer call.

Glossary · Ecosystem map · Ports · Troubleshooting

Sources and go deeper