[VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea

[Gast, Jim]

Hi, team -

In the early days of Public Key Infrastructure, we had easy ways to solve these trust questions.

The list admin creates a public-key  / private-key pair called the LIST_CERT.  Giving anyone the LIST_CERT gives them both keys in the pair.
The list admin creates a public-key / private-key pair called the VoIPSec Certificate Authority key-pair.  The public-key becomes publicly available, but the private key is NEVER GIVEN OUT to anyone.  The VoIPSec_CA_CERT contains the public-key, but NOT the private-key.

To join the list, each participant must prove (once) that the email address they give us is authentic.  The new participant creates a personal key pair and gives ONLY the public key to the list administrator as a certificate signing request.  The new participant will then be given a CERTificate that signs his personal public key with the VoIPSec_CA key.

Legitimate participants to the mailing list are given the LIST_CERT.  If someone does not have the LIST_CERT, eavesdroppers will be unable to decrypt emails on the list.
All emails to the email list are SIGNED by an personal CERT (that is SIGNED by VoIPSec_CA) and the body of the email is also ENCRYPTED using the LIST_CERT.

Since the signature will match, the email could only have come from that particular sender (and the body could not have been altered).  And the body of every email can be decrypted by any authentic list member.

Does that work well?

Cheers,

/ Jim

-----Original Message-----
From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Jim Dalton
Sent: Friday, February 21, 2014 3:18 PM
To: 'J. Oquendo'; 'Hiers, David'
Cc: voiceops at voiceops.org; 'Mark Collier'; voipsec at voipsa.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea

One option maybe to cooperate with the Communications Fraud Control Association  (www.cfca.org).  They do vet their members, but they do not have a mailing list.  The association also has an annual membership fee.

Jim Dalton

-----Original Message-----
From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of J.
Oquendo
Sent: Friday, February 21, 2014 3:38 PM
To: Hiers, David
Cc: voiceops at voiceops.org; Mark Collier; voipsec at voipsa.org
Subject: Re: [VoiceOps] [VOIPSEC] Tackling VoIP fraud, new idea

On Fri, 21 Feb 2014, Hiers, David wrote:

> The key is vetting the participants.  Even the feds have a hard time 
> with
that...
> 

Indeed which is why I stated:

1) Private mailing list - to prevent talks from being seen

2) NON freemail addresses - easier to establish that this individual works for this company, therefore its highly unlikely he is going to throw himself, and or his company, under the bus passing bogus information.

The "private mailing list" is not to try to start some secret club, VoIP Gestapo. It is merely to be able to share data, methods, etc., with other peers in an effort to keep our networks from piping out 100s of thousands of dollars in toll fraud. PERIOD. ANYONE is open to participate, with the clause that we want to, and NEED to be able to trust data. Otherwise it will never work.

I will re-think this over the weekend and have a take two.
I think it could, and would work. I do also believe that there are likely individuals even on this list, that would not like the idea much, so hosting decisions need be met, etc., in order to keep away DDoS attacks, reputation based attacks, and so forth. That's my train of thought though.

--
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
J. Oquendo
SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT, RWSP, GREM

"Where ignorance is our master, there is no possibility of real peace" - Dalai Lama

42B0 5A53 6505 6638 44BB  3943 2BF7 D83F 210A 95AF http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x2BF7D83F210A95AF
_______________________________________________
VoiceOps mailing list
VoiceOps at voiceops.org
https://puck.nether.net/mailman/listinfo/voiceops



_______________________________________________
VoiceOps mailing list
VoiceOps at voiceops.org
https://puck.nether.net/mailman/listinfo/voiceops