library

SIP, the Session Initiation Protocol (RFC 3261) — the signaling protocol underneath nearly every modern voice call, video call, and messaging session. This is the ground floor of the library: you cannot reason about caller authentication, call routing, or the trust framework without understanding how calls are set up in the first place. This page covers the protocol model, the anatomy of a call, where identity lives in the signaling, and the real-world ecosystem of proxies, SBCs, and interconnection built around it.

The cryptographic call-authentication framework deployed across North American telephone networks. STIR is the IETF protocol layer; SHAKEN is the operational profile and governance arrangement that ATIS specified for North American carriers. This page is the overview and history; deeper topics get their own pages.

How telephone numbers actually work as infrastructure — the global E.164 plan, the North American structure, the separate world of toll-free, number portability, and the lifecycle from assignment to reclamation. Most discussions of caller authentication treat numbers as opaque tokens; they are not. A number is a routing identifier with regulatory weight, a jurisdictional structure, and governance bodies that maintain it, and the trust framework only makes sense on top of that grounding.

ENUM, the IETF family of standards for representing telephone numbers in DNS — turning an E.164 number into a domain name under e164.arpa and resolving it to URIs that route or terminate calls. The idea is elegant and the mechanism is clean, but the public version never reached critical mass while private carrier deployments quietly did. This page covers how ENUM works, why the public/private split determined its fate, where it runs today, and how the underlying idea keeps recurring — including the ENUM-plus-encrypted-DNS conversation that connects to the domain-trust and VESPER work.

The trust mechanisms of the internet's name system: DNSSEC for origin authentication of DNS data, DoH and DoT for query confidentiality, the WebPKI certificate ecosystem that binds certificates to domains, and Certificate Transparency for making that ecosystem auditable. This is the substrate much of the rest of the library's trust work borrows from — STIR's certificate model, VESPER's domain bridge, and the ENUM/DoH conversations all reach back to it — and the place where the still-open question of whether DNS anchors agent identity will be worked out.

vCon is the IETF vCon working group's standard for representing a conversation — voice, video, messaging, transcripts, metadata, and consent — as a single signed, machine-readable container. Where STIR gives cryptographic provenance to the call setup, vCon gives it to the conversation itself. This is the topic overview: what a vCon is, its data model, the consent and provenance mechanics, how it relates to STIR and the wider trust framework, and why it matters for AI-mediated conversations. I co-chair the working group with Brian Rosen.

VESPER extends the STIR architecture by defining a delegate-certificate profile that binds three things in a single auditable trust artifact — telephone-number authority (via TNAuthList), the responsible entity's domain (via SubjectAltName), and a Signed Certificate Timestamp from a public transparency log. The certificate itself is the trust artifact; standard PASSporTs (RFC 8225) signed by it carry the assertions on the wire. A separate RTU Token form provides portable proof outside SIP. The framework is active at the IETF as a set of related drafts I'm authoring; it has been the primary motivation for the STIR working group's expanded rechartering scope.

How telephone-number trust frameworks are governed — the participation rules and enforcement mechanisms within each country, and the architectures that coordinate trust across jurisdictions. Bridges STIR/SHAKEN as a technical framework into the larger questions of policy, accountability, and international harmonization.

The parts of US telecom policy that decide how the voice network is paid for, kept universal, kept reachable in an emergency, and kept accessible — the questions that sit underneath the technical identity-and-trust work but rarely get a plain-language explanation. This section covers intercarrier compensation and the move to bill-and-keep; universal service and the high-cost program under section 254; how 911 is funded and the transition to NG911; and the relay-service and real-time-text obligations that keep the network usable by people who are deaf, hard of hearing, or have a speech disability. These are the structural constraints every all-IP-transition debate runs into, and there are surprisingly few readable references for them. Each entry is a lean starting point meant to grow.

The wide-angle view of the library. Trust at internet scale — a call you can verify, an identity you can carry, a provenance signal you can check — is a commons, and a commons is built or enclosed through standards. This page reads digital identity across the industries now converging on the same problem (telecom trust, web and enterprise identity, agentic and workload identity, content provenance, wallets, and supply-chain transparency) through one lens: whether the trustworthy version of each capability ends up open and portable or captured by a single vendor.

A catalog of IETF documents referenced across the library. Published RFCs and active working-group drafts each get their own page; topical pages elsewhere on the site link here as the canonical reference home.

A cross-topic reference for the acronyms and short-form terms that recur across the library — primarily STIR/SHAKEN, number administration, and US telecommunications governance vocabulary. Each entry is a one-or-two-sentence definition; for terms that have their own library page, the entry is a stub that hands off to that page. Alphabetical order is the only structure.