STIR is IETF work (Secure Telephone Identity Revisited): RFC 8224, RFC 8225 (PASSporT), and related specs. SHAKEN is the ATIS profile (Signature-based Handling of Asserted information using toKENs), notably ATIS-1000074, that says how U.S. voice service providers use STIR on SIP networks. The FCC required IP-based voice service providers to implement STIR/SHAKEN in the TRACED Act framework, alongside registration in the robocall mitigation database.
The system does not prove that a human is trustworthy. It proves that a provider with a SHAKEN certificate made a signed statement about the caller ID on that call. Analytics, labeling, and blocking still sit on top.
Originating vs terminating service provider
| Role | What it does | What it does not do |
|---|---|---|
| Originating service provider (OSP) | Places the call onto the IP voice network, chooses attestation A/B/C, and inserts a signed PASSporT (typically in the SIP Identity header) | Does not guarantee the far-end device will display the name. CNAM is a separate lookup. |
| Terminating service provider (TSP) | Receives the call for the called party, verifies the PASSporT against the SHAKEN certificate chain, and may use the result in analytics or display policy | Cannot create a valid A-level signature for a call it did not originate. |
| Transit / intermediate | Should pass Identity / PASSporT intact. Some non-IP hops strip it. | TDM / SS7 islands still break end-to-end signing. Gateway attestation exists for that reason. |
Attestation A, B, and C
ATIS-1000074 defines three attestation levels. The OSP picks one character in the PASSporT "attest" claim. Downstream networks read it as a statement about the OSP's relationship to the caller and the number, not as a spam score.
| Level | ATIS name | The OSP is saying |
|---|---|---|
| A | Full attestation | It originated the call onto its IP network, has a direct authenticated relationship with the customer, and has a verified association with the telephone number in caller ID. |
| B | Partial attestation | It originated the call and can identify the customer, but it has not verified the customer's right to use that calling number (classic example: a customer sends a number the OSP did not assign). |
| C | Gateway attestation | It is the entry point into its VoIP network and has no relationship with the initiator (typical for an international or TDM gateway). |
Enterprises that send outbound traffic through resellers often see B or C because the signer is not the party that assigned the DID. That is an attestation fact. It is not, by itself, a finding that the call is a robocall. Terminating providers may still treat unsigned or C-level traffic more harshly in analytics.
Attestation is not a spam score
A-level means the OSP made a full identity assertion. It does not mean the called party wanted the call. C-level means a gateway relationship, which is common on international and TDM-to-IP handoffs. Analytics engines use attestation as one input among volume, invalid numbers, and complaint rates.
PASSporT is a JWT
A PASSporT is a JSON Web Token. SHAKEN uses an extension (RFC 8588) with claims that bind calling and called numbers to the signature. Typical claims include:
- orig
- Calling telephone identity (the number being asserted).
- dest
- Called telephone identity.
- iat
- Issued-at timestamp.
- origid
- Origination identifier (a UUID the signer assigns to help traceback and analytics).
- attest
- A, B, or C as above.
The SIP Identity header carries the compact-serialized PASSporT plus parameters that point at the certificate ("info"). Verification fetches that certificate (with caching) and checks the signature and dates. If a hop tampers with the calling number without a new valid signature, verification fails.
SHAKEN certificates
The U.S. SHAKEN PKI is run under the Secure Telephone Identity Governance Authority (STI-GA). A Policy Administrator (STI-PA) authorizes service providers. Certification Authorities (STI-CAs) issue the certificates used to sign PASSporTs. A provider must be an authorized voice service provider in this ecosystem to sign. End-user businesses do not typically hold SHAKEN certificates themselves. They inherit signing from the originating provider.
- Certificate freshness and revocation matter. Expired or wrong-chain signatures fail verification.
- The certificate identifies the signing service provider, not the enterprise brand on the call.
- Non-IP call paths cannot carry the Identity header. Signing resumes only where SIP is restored, often as C-level at a gateway.
Traceback
When a terminating network or the Industry Traceback Group (ITG) investigates illegal robocalls, traceback walks hop-by-hop toward the origin. STIR/SHAKEN origid and the signing provider give investigators a cryptographic starting point. Traceback still requires provider cooperation and records. A valid A-level signature on illegal traffic is still illegal traffic. Signing authenticates the identity assertion; it does not grant permission to call.
What STIR/SHAKEN does not do
- It does not replace the CNAM name database.
- It does not implement TCPA consent.
- It does not stop lawful caller ID substitution that a provider is willing to attest (for example a company main number on a branch outbound call), subject to the provider's number-use policy.
- It does not, by itself, display "spam likely." Labeling is analytics plus carrier policy.