At 07:35 19-07-2013, The IESG wrote:
The IESG has received a request from an individual submitter to consider
the following document:
- 'Using the International Mobile station Equipment Identity(IMEI)URN as
an Instance ID'
<draft-allen-dispatch-imei-urn-as-instanceid-10.txt> as Informational
RFC
The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf(_at_)ietf(_dot_)org mailing lists by 2013-08-16. Exceptionally, comments
may be
Section 4 describes the 3GPP use case as:
"The mobile device includes its IMEI in the SIP REGISTER request
so that the registrar can perform a check of the Equipment Identity
Register (EIR) to verify if this mobile device is allowed or barred
from accessing the network for non-emergency services"
The draft then argues that non-REGISTER requests except in case of an
emergency.
In Section 5:
'A UAC MUST NOT include the "sip.instance" media feature tag
containing the GSMA IMEI URN in the Contact header field of non-
REGISTER requests except when the request is related to an emergency
session. Regulatory requirements can require the IMEI to be provided
to the Public Safety Answering Point (PSAP). Any future exceptions
to this prohibition require a RFC that addresses how privacy is not
violated by such a usage.'
My reading of the above is there is a privacy violation but that
violation is considered acceptable in the use case mentioned
above. Any other use case requires a RFC to be published. There is
an additional requirement; the RFC has to address how privacy is not
violated. It is an unusual requirement in a RFC.
From Section 9:
'In particular, the "sip.instance" media feature tag containing the
GSMA IMEI URN MUST NOT be included in requests or responses intended
to convey any level of anonymity.'
The above can be interpreted in various ways. The problem might be
that the draft builds upon RFC 5626 which states that "some other
privacy concern requires that the UA not reveal its identity". It
may be better to state that there is a violation of privacy.
The draft does not discuss about the weakness of the mechanism or how
what it proposes can be used for wiretapping.
Regards,
S. Moonesamy