STIR/SHAKEN: definition and a practical example

Short answer: STIR/SHAKEN is the set of standards that digitally signs the calling number of a SIP call, so the terminating network can verify whether the caller ID is legitimate.

In Portuguese: STIR/SHAKEN

What is STIR/SHAKEN?

STIR/SHAKEN is a set of standards for fighting calling-number spoofing on SIP calls. The originating carrier digitally signs the caller’s number, and the terminating network checks that signature before delivering the call. STIR is the IETF part, with the protocols; SHAKEN is the usage framework that defines how carriers apply those protocols.

Four RFCs form the foundation. RFC 8224 defines the Identity header, which carries the signature inside the INVITE message. RFC 8225 defines PASSporT, a signed token with the calling number, the called number and the time. RFC 8226 defines the certificates that prove the signer has rights to the numbers. RFC 8588 adds the SHAKEN extension, with the attestation level and an origination identifier.

During verification, the terminating network downloads the certificate referenced in the header, checks the signature, confirms the time is recent and compares the numbers in the token with those in the call. The result can become a verified badge on the screen, a suspicious-call warning or a block, depending on each carrier’s policy.

In practice

Main fields of a PASSporT with the SHAKEN extension:

Field	Example	Meaning
attest	A	Attestation level: A, B or C
orig	5511345670000	Calling number
dest	5521987650000	Called number
iat	1759838400	Time of signing, in Unix seconds
origid	unique identifier	Point in the network where the call entered

If the token arrives with an old iat or with an orig that differs from the call’s number, verification fails, even with a correct signature. That prevents a valid token from being copied and reused on another call.

How Monitor uses this

Monitor does not sign or authenticate caller ID. Test calls check whether the number answers, what the final SIP response was and whether audio gets through. STIR/SHAKEN signing stays with the carrier that originates the call. See SIP trunk monitoring.

Frequently asked questions

What do attestation levels A, B and C mean?

They are the confidence levels the originating carrier declares, defined in RFC 8588. A (full): the carrier knows the customer and knows they are allowed to use the number. B (partial): it knows the customer but cannot vouch for the number. C (gateway): the call came in from another network, such as an international gateway, and the carrier does not know where it came from.

Does STIR/SHAKEN stop calls with spoofed numbers?

Not on its own. It gives the terminating network verifiable information about the calling number and about the confidence level of the carrier that signed it. What to do with that information, such as showing a verified badge, flagging the call as suspicious or blocking it, is up to each carrier. A call with a spoofed number can still arrive with C attestation.