Requirements Hash Cash & Pay IETF 62 - Sipping WG Cullen Jennings

Requirements Fixed rate or “free” SIP communications are becoming more and more common Oddly, this introduces new problems that used to be solved by traditional billing If I got as many phone calls as I get SPAM messages, I would not have a telephone

Similar Messaging Systems is free, except to my brother Inmarsat calls will never be “free” due to the laws of physics Paper mail is cheap enough it does not seem to be a barrier to Nigerian scammers sending me the occasional letter Paper mail is expensive enough that I get only a few unwanted things a day

Requirement Assumption For people you communicate with regularly, some sort of strong identity assertions plus white lists are by far the best solutions For people that you have some transitive relationship with, there may be a better solution. (like reputations systems) There will still be communications from people with whom we have no prior relation - for these, we need something else These requirements are about the something else

Requirements for Inducing Cost SPAM/SPIM/SPIT is reduced by increasing the cost for the sender. Provide a scheme by where the receiver can verify that the caller has incurred a cost Allow the cost to be set by the receiver

Requirements for Receiving Payment The person being called can receive payment even if the caller’s service provider is not The system is simple and lightweight and does not need to provide the accountability that larger payments would require The system needs to work for very small payments (one cent or less)

Status of Pay & Hash Cash There is a community that wants the Pay approach –A few vendors are starting implementations of Pay –If we have better ideas, we should work on them soon –Document has had significant security review Hash Cash may be a viable way to mitigate the “ring a million phones” problem Hash Cash is a way to reduce the amount of SPIM/SPIT –The zombie argument is the most significant issue in deciding if this is worth doing –Document has not had careful security review