Telecom

STIR/SHAKEN: FCC-Mandated Call Authentication for VoIP Carriers

Articles · 2026 · Ioannis (John) Konstas

How STIR/SHAKEN works, attestation levels A/B/C, PASSporT token structure, STI-CA certificate requirements, and Asterisk implementation.

What Is STIR/SHAKEN

The FCC-mandated framework that digitally signs outbound calls to prevent caller ID spoofing.

STIR/SHAKEN is the call authentication framework all US carriers and CLECs must implement. It digitally signs outbound calls so that receiving carriers can verify the caller ID has not been spoofed — addressing the robocall and caller ID fraud epidemic that has eroded trust in the telephone network.

STIR — Secure Telephone Identity Revisited (IETF RFC 8226, 8588)
SHAKEN — Signature-based Handling of Asserted information using toKENs

Mandatory for all CLECs since September 2025. Carriers without STIR/SHAKEN are required by FCC rules to have their calls blocked by terminating carriers.

How It Works

Originating Carrier                    Receiving Carrier
        │                                    │
        │ 1. Sign the call                   │
        │    Create PASSporT JWT token        │
        │                                    │
        │──── SIP INVITE with Identity: ───►│
        │      header (JWT token)            │ 2. Verify signature
        │                                    │    against originator's cert
        │                                    │    (fetched from STI-CA)
        │                                    │
        │                                    │ 3. Display verification
        │                                    │    result to called party
        │                                    │    (checkmark or "Spam?")

The PASSporT (Personal Assertion Token) is a JSON Web Token (JWT) signed with the carrier's STIR/SHAKEN private key. It contains: originating number, destination number, attestation level, originating carrier ID, and a timestamp. The receiving carrier fetches the public certificate from the STI-CA to verify the signature.

Attestation Levels

Carriers must set the attestation level honestly — it indicates how much the carrier knows about the call's origin.

Level	Name	Meaning	When to Use
A	Full Attestation	The carrier knows the customer and the number is legitimately assigned to them	Retail customers using their assigned DID numbers
B	Partial Attestation	The carrier knows the customer but cannot fully verify the number they are presenting	Business customers using their own numbers ported in
C	Gateway Attestation	The carrier received the call from another carrier and cannot vouch for the origin	Transit / wholesale calls, international gateway

Over-claiming attestation (using A when B or C is correct) is an FCC violation. Under-claiming (using C for all calls) degrades call scoring and may trigger blocking. Set the level accurately.

Implementation in Asterisk

Asterisk 16.15+ includes native STIR/SHAKEN via the res_stir_shaken module.

; /etc/asterisk/stir_shaken.conf

[attestation]
global_disable = no

[certificate]
type = certificate
path = /etc/asterisk/stir_shaken/cert.pem
private_key = /etc/asterisk/stir_shaken/key.pem
attestation = A          ; A, B, or C
origid = your-carrier-id ; Your unique carrier identifier

[verification]
type = verification
failure_action = continue  ; continue | reject | ignore
; Use "continue" during rollout; "reject" once fully deployed

Asterisk adds the Identity: SIP header automatically to all outbound INVITEs when STIR/SHAKEN is configured. The PASSporT token is generated using the private key and embedded as a Base64-encoded JWT.

Certificate Requirements

Obtaining a STIR/SHAKEN Certificate

You must obtain a certificate from an FCC-approved STI-CA (Secure Telephone Identity Certification Authority). Approved STI-CAs include TransNexus, Sansay, Comcast, and iconectiv.

Prerequisite: Active FCC Form 499 filing as a telecommunications carrier
Prerequisite: Registration in the FCC's Robocall Mitigation Database (RMD)
Cost: Approximately $1,000–$3,000 per year depending on the STI-CA
Format: X.509 certificate with telephone number extension

The certificate contains your public key and carrier identity. It is published at a public URL so receiving carriers can fetch it during call verification. Your private key never leaves your server.

Robocall Mitigation Database (RMD)

All carriers must file a Robocall Mitigation Plan with the FCC's RMD at fcc.gov/robocall-mitigation-database. This is a prerequisite for STIR/SHAKEN certificate issuance and for interconnecting with other carriers.

Without an active RMD filing, other US carriers are required by FCC rules to block all calls from your network. This must be completed before any commercial interconnection, not after.

What the Mitigation Plan Must Include

Description of your robocall detection and prevention measures
Process for responding to traceback requests from other carriers
Contact information for robocall complaints
STIR/SHAKEN implementation status and timeline

STIR/SHAKEN vs. Caller ID Spoofing

Without STIR/SHAKEN	With STIR/SHAKEN
Any carrier can claim any caller ID	Caller ID is cryptographically signed
No way for receiving party to verify origin	Receiving carrier verifies signature against STI-CA
Robocallers easily spoof legitimate numbers	Spoofed calls fail verification — marked or blocked
Consumers ignore unknown calls	Verified calls display checkmark on modern phones

← All articles

Research and direction by Ioannis (John) Konstas; compiled and finalized with AI assistance.