Requirements Hash Cash

1
Requirements Hash Cash Pay

• IETF 62 - Sipping WG
• Cullen Jennings

2
Requirements

• Fixed rate or free SIP communications are
  becoming more and more common
• Oddly, this introduces new problems that used to
  be solved by traditional billing
• If I got as many phone calls as I get SPAM
  messages, I would not have a telephone

3
Similar Messaging Systems

• Email is free, except to my brother
• Inmarsat calls will never be free due to the
  laws of physics
• Paper mail is cheap enough it does not seem to be
  a barrier to Nigerian scammers sending me the
  occasional letter
• Paper mail is expensive enough that I get only a
  few unwanted things a day

4
Requirement Assumption

• For people you communicate with regularly, some
  sort of strong identity assertions plus white
  lists are by far the best solutions
• For people that you have some transitive
  relationship with, there may be a better
  solution. (like reputations systems)
• There will still be communications from people
  with whom we have no prior relation - for these,
  we need something else
• These requirements are about the something else

5
Requirements for Inducing Cost

• SPAM/SPIM/SPIT is reduced by increasing the cost
  for the sender.
• Provide a scheme by where the receiver can verify
  that the caller has incurred a cost
• Allow the cost to be set by the receiver

6
Requirements for Receiving Payment

• The person being called can receive payment even
  if the callers service provider is not
• The system is simple and lightweight and does not
  need to provide the accountability that larger
  payments would require
• The system needs to work for very small payments
  (one cent or less)

7
Status of Pay Hash Cash

• There is a community that wants the Pay approach
• A few vendors are starting implementations of Pay
• If we have better ideas, we should work on them
  soon
• Document has had significant security review
• Hash Cash may be a viable way to mitigate the
  ring a million phones problem
• Hash Cash is a way to reduce the amount of
  SPIM/SPIT
• The zombie argument is the most significant issue
  in deciding if this is worth doing
• Document has not had careful security review