Core engineering model
Signing and verification are distinct roles. Each decision must be verified against the deployed Asterisk version, peer requirements and packet evidence rather than copied as a universal setting.
Attestation describes the signer’s relationship and knowledge. Each decision must be verified against the deployed Asterisk version, peer requirements and packet evidence rather than copied as a universal setting.
A text header without a valid signature is not authentication. Each decision must be verified against the deployed Asterisk version, peer requirements and packet evidence rather than copied as a universal setting.
Guides in this cluster
STIR/SHAKEN Identity Header Explained: PASSporT, Attestation and x5u
Understand the signed PASSporT conveyed by a SIP Identity header, attestation claims, x5u certificates and why a fabricated header proves nothing.
GuideSIP 403 Forbidden: How to Find Who Rejected the Call
Locate the hop that generated a 403, correlate the transaction and evaluate identity, authorization and policy evidence without assuming one universal cause.
Operational boundary
STIR/SHAKEN separates signing, certificate authorization, delivery of an Identity header, cryptographic verification, claim binding and call-treatment policy. Attestation communicates the signer’s relationship and knowledge; it is not a universal fraud score or call-quality guarantee.
Field workflow
For an observed INVITE, preserve the hop, UTC time and Identity presence. Decode only for inspection, validate freshness and certificate trust, verify the signature, compare origin/destination claims with normalized SIP identities, then apply the documented policy. Keep full tokens protected.
module show like stir_shaken
stir_shaken show settings
stir_shaken show profilesVerification standard
A valid result requires more than Base64URL decoding or x5u reachability. Record certificate validation, signature result, claim match, freshness and the Asterisk verification outcome. Identify whether an upstream component altered the header before drawing conclusions.
Failure patterns
Missing Identity, unreachable x5u, invalid chain, stale iat, signature failure and claim mismatch are distinct states. Do not claim a local organization owns an SPC token, certificate or signing role without verified governance evidence.
Security and governance
Private signing keys must never enter logs, shell history or public packages. Restrict certificate retrieval and caching, protect PASSporT data as call metadata, and do not enable unsafe x5u relaxation as a default diagnostic shortcut.
Verification result versus call-treatment policy
Cryptographic verification and call treatment are different functions. Verification reports states such as absent identity, certificate retrieval failure, invalid signature, claim mismatch or success. A policy engine decides what to do with that state under applicable obligations, analytics and interconnection agreements. Do not hard-code one SIP response for every non-success state without a reviewed policy and operational exception path.
Attestation A, B or C describes the signer’s asserted relationship and knowledge at origination. It does not tell the terminating user whether the call is wanted, whether the displayed name is accurate, or whether audio is safe. Combine verification with other authorized analytics while avoiding marketing claims stronger than the framework supports.
Operational evidence should retain a bounded verification result and correlation identifier when possible rather than the complete PASSporT. Monitor x5u retrieval failures, trust-store changes, clock drift, cache behavior and signing-key lifecycle. Never claim that ARCAMUSA possesses a particular governance credential unless verified and approved for publication.
Operational assurance
Version and governance awareness are mandatory. Confirm which Asterisk branch implements the current object model, which trust store is authoritative, and how verification failures are exposed to dialplan or downstream logic. Test with authorized fixtures rather than fabricated production claims. Maintain time synchronization because iat freshness depends on it. Certificate cache behavior must not conceal expiry or revocation indefinitely. When sharing an incident, provide verification category and correlation data rather than complete telephone-number claims or tokens unless the recipient is authorized.
Review cadence
Document how verification results are conveyed to authorized operations without exposing complete tokens. Test certificate expiry and unreachable x5u behavior with controlled fixtures. Confirm cache and failure-action behavior after Asterisk upgrades. If local policy changes call treatment, validate expected SIP responses and user experience separately from the cryptographic verification test.
Exit criteria
Close validation with the exact Asterisk version, trust configuration revision, sanitized verification category and call-treatment result. Do not retain full tokens longer than necessary. Record whether signing, verification or policy was actually tested so those capabilities are not conflated.
Readiness check
Train operators to distinguish absent, failed, mismatched and verified outcomes without promising a universal call disposition. Escalation should state the verification stage that failed and the evidence available, while keeping governance credentials, certificate operations and customer call data protected.
Evidence protection
PASSporT payloads and Identity headers are call metadata and may expose numbers, timestamps, certificate locations and origination identifiers. Prefer a bounded verification result in routine records, restrict access to full tokens, and follow approved retention and disclosure procedures.