Characterizing the Deployment of the STIR/SHAKEN Telephone Network PKI#

Authors: Hamim Hamid, David Adei, Bradley Reaves (North Carolina State University)

• Why: A rare natural experiment in federated identity infrastructure: a brand-new, industry-wide, federated PKI mandated and deployed in under two years. For anyone designing or operating federated trust frameworks (and thinking about PKI hygiene generally), the failure modes documented here are the canonical ones to design against.
• What: A longitudinal study (Nov 2021–Feb 2026) of STIR/SHAKEN deployment from signaling data on 7.75 million calls collected by telephone honeypots. Rapid adoption, but pervasive standards non-compliance: providers signing calls with root keys, and originating calls with pre-signed attestations copied from unrelated calls. Practices and compliance are improving, but only at a modest pace. (from abstract only)
• How: Longitudinal honeypot signaling-data analysis across standards compliance, CA practices, and provider call signatures/metadata.
• Where applicable: US telephone network, mandate-specific context. The transferable content is the pattern — what a rushed federated PKI rollout actually looks like in practice — which generalizes to any federated trust ecosystem.