STIRSHAKEN

STIR/SHAKEN is a set of standards and best practices designed to combat caller ID spoofing in IP-based telephone networks. STIR, or Secure Telephone Identity Revisited, specifies how to convey cryptographic identity information for outgoing calls, while SHAKEN, standing for Signature-based Handling of Asserted information using toKENS, provides a policy framework for how carriers should handle and convey that information as calls are originated, forwarded, and terminated. Together, they aim to increase trust in caller ID and reduce robocalls and fraudulent activity.

Technical basis and operation: The core mechanism uses digital certificates and a SIP Identity header to bind a telephone number to a verifiable public key. Carriers obtain certificates from a trusted authority and sign the calling number as the call traverses the network. Attestations indicate the level of verification and are categorized as full (A), partial (P), or in cases where verification is not possible (R). Inbound networks verify the signature and, if valid, may display indicators such as “Verified” or show the attestation level on the receiving device.

Deployment and scope: STIR/SHAKEN was developed in and is heavily promoted in the United States under regulatory guidance, with many major carriers participating. Adoption varies by region and by network, and interoperability depends on both sending and receiving networks supporting the standard. Some calls between non-participating networks may not carry verifiable identity information, limiting complete protection.

Limitations and impact: STIR/SHAKEN improves the ability to detect spoofed calls but does not eliminate spoofing in all scenarios, especially where networks do not support the framework or when non-IP paths are involved. It complements other call-blocking and authentication approaches and continues to evolve with industry deployment.