Paper 2026/2772

STIR/SHAKEN: A Cocktail of Cryptographic Clumsiness

Abstract

Scams and fraudulent robocalls are rampant in the telephone system. Fraudsters often employ call spoofing to impersonate a known caller to the victim, making it difficult to detect and block the fraudster’s calls. In an effort to combat call spoofing, the U.S. government in 2019 mandated the use of a new suite of protocols called STIR/SHAKEN. In STIR/SHAKEN, providers include a cryptographically-signed assertion about the caller’s identity and other metadata in call headers. This serves both to authentically convey this metadata between providers during call routing and to provide reportable, verifiable evidence of bad behavior by providers that originate fraudulent calls. This paper asks whether STIR/SHAKEN achieves its security goals, and at what cost to the telephone system. On security we find serious structural weaknesses: a year of STIR/SHAKEN certificates observed in production call traffic shows a PKI riddled with noncompliance—nearly half of valid certificates violate the specifications—a provider can prevent later verification of a STIR/SHAKEN assertion by taking its certificate offline, and a header-malleability flaw, which we verified in test calls placed with the help of a real telephone provider, causes a spoofed caller ID to be displayed as verified on some phones. The cost, meanwhile, has been steep: STIR/SHAKEN deployment has created systemic new harms to the privacy of all phone users. These new privacy harms take two forms. First, signing call metadata renders it cryptographically non-repudiable: for the first time in the phone system’s 150-year history, there is publicly verifiable proof that a call took place. Second, STIR/SHAKEN’s complexity pushes providers to outsource signing and verification—roughly half of the 29 providers we surveyed do so, most to a handful of dominant vendors—causing widespread new leakage of sensitive call metadata to off-path third parties. (One such off-path third party, Neustar, was acquired in 2021 by TransUnion, one of the three nationwide U.S. credit bureaus. Neustar authenticates over 30 billion calls per month—and TransUnion sells a “Phone Behavior Intelligence” product advertising “insight into billions of call transactions” obtained through its “deep carrier relationships.”) These structural harms sit atop implementation failures: our tests also found implementations that completely break the federally-mandated *67 caller-privacy mechanism. Finally, we propose solutions to the problems we identify. To fix the PKI, STIR/SHAKEN should adopt certificate transparency; a public certificate log also stops providers from taking certificates offline to defeat later verification. Our remaining solutions are cryptographic, and share a prerequisite STIR/SHAKEN cannot currently meet: the origin provider must learn the destination provider’s public key. We thus design a backwards-compatible key discovery mechanism that uses SIP error messages. We then attack the privacy harms directly: replacing STIR/SHAKEN’s signatures with asymmetric message franking (AMF) makes call metadata deniable again, and issuing AMFs blindly keeps it hidden from outsourced signers. We design the first blind signing protocol for the AMF construction of Tyagi et al., along with new security definitions capturing requirements novel to the setting, such as verifier-hiding blindness. To our knowledge, we thereby initiate the formal study of blind signing for designated-verifier signatures; we believe this is of independent interest.