A phone call may display a familiar business number but that alone does not prove the caller is authorized to use it. STIR/SHAKEN addresses this challenge by allowing originating voice service providers to digitally authenticate caller identity and communicate how confidently they can associate a call with its calling number.
This is where the three attestation levels—A, B and C—become important. Each level represents a different degree of information and verification available to the originating provider. For telecom operators, understanding these distinctions helps improve call authentication practices and build a more reliable voice network.
What Is Attestation in STIR/SHAKEN?
Understanding the Role of Attestation
Attestation is an assertion made by the originating voice service provider about its relationship with the customer placing a call and the customer's authority to use the displayed telephone number.
When a provider signs an eligible outbound call using STIR/SHAKEN, it creates a digitally signed PASSporT containing call-related information. This information is carried in the SIP Identity header and includes the attestation level assigned to the call.
The receiving provider can retrieve the originating provider's certificate and use its public key to verify the digital signature. This helps determine whether the signed information has been altered and whether the certificate can be trusted.
Why Are There Three Levels?
Not every telecom provider has the same relationship with every caller. A provider may know a customer personally and have issued the customer's telephone number. In another situation, it may know the customer but lack evidence that the customer is authorized to use the displayed number. It may also receive calls from another network without knowing the original caller.
A single authentication label would not communicate these differences. A, B and C attestation provide a structured way to represent the originating provider's level of knowledge.
What Is A Attestation? Full Attestation
The Highest Level of Caller Identity Assurance
A attestation, also known as Full Attestation, represents the strongest level of caller information available within the STIR/SHAKEN framework.
For a provider to assign A attestation, it must satisfy three conditions:
It is responsible for originating the call onto the IP-based service provider voice network.
It has a direct authenticated relationship with the customer and can identify that customer.
It has established a verified association between the customer and the telephone number used for the call.
All three conditions must be satisfied.
Practical Example of A Attestation
Consider a business that purchases telephone numbers directly from a telecom provider. The provider verifies the business identity and maintains an authenticated customer account. It also assigns the business the telephone number being used for outbound calls.
When the business makes a call through that provider's network, the provider has the necessary information to establish the customer relationship and verify the number association. If the other requirements are also met, the provider can assign A attestation.
Why It Matters
A attestation gives the receiving network stronger evidence that the originating provider knows both the customer and the customer's right to use the calling number.
However, A attestation does not guarantee that the call will be answered or displayed with a verified badge on every device. The receiving provider may apply its own verification, analytics and call-treatment policies.
What Is B Attestation? Partial Attestation
When the Provider Knows the Customer but Cannot Verify the Number
B attestation, also known as Partial Attestation, applies when the originating provider can identify the customer and has a direct authenticated relationship with them but cannot establish the customer's verified association with the telephone number used for the call.
The provider must satisfy two conditions:
It is responsible for originating the call onto the IP-based service provider voice network.
It has a direct authenticated relationship with the customer and can identify them.
The missing requirement is verified authorization to use the specific calling number.
Practical Example of B Attestation
Imagine a business that uses a telecom provider's calling platform but brings its own telephone number from another carrier.
The provider may have verified the business identity and authenticated its account. However, it may not have sufficient evidence to confirm that the business has the right to use the externally sourced number.
In this situation, the provider may assign B attestation if the applicable requirements are met.
Why B Attestation Is Still Valuable
B attestation does not automatically mean that a call is fraudulent. It indicates that the originating provider knows the customer but cannot fully verify the customer's right to use the calling number.
For businesses using multiple carriers or external telephone numbers, this distinction is important. Improving number ownership records and authorization procedures may help establish the evidence needed for full attestation.
What Is C Attestation? Gateway Attestation
When the Provider Cannot Verify the Original Caller
C attestation is known as Gateway Attestation. It is generally used when a provider receives a call from another network and does not have a direct relationship with the original caller.
The provider can identify the network entry point through which the call enters its network but does not have the necessary information to authenticate the original caller and verify the caller's right to use the telephone number.
Practical Example of C Attestation
Consider an international call entering a domestic telecom network through an international gateway.
The domestic provider receives the call from an upstream network but may not have a direct customer relationship with the person who originally placed it. It can identify the gateway or network through which the call arrived but cannot independently establish the original caller's identity or telephone number authorization.
This is a typical situation in which C attestation may apply.
Does C Attestation Mean a Call Is Fraudulent?
No. C attestation does not automatically indicate spoofing or malicious activity. It communicates that the provider has limited information about the original caller.
A legitimate international call may receive C attestation because the domestic gateway does not have access to the originating customer's identity and number authorization records.
A vs. B vs. C Attestation: Key Differences
The three levels differ primarily in the originating provider's knowledge and verification of the caller and telephone number.
A Attestation — Full Verification
The provider knows the customer through a direct authenticated relationship and has verified the customer's authority to use the calling number. It represents the strongest level of attestation.
B Attestation — Customer Identified
The provider knows and can identify the customer but cannot verify the customer's authority to use the specific calling number. This is particularly relevant when businesses use externally sourced telephone numbers.
C Attestation — Gateway Identification
The provider can identify the network entry point through which the call entered its network but does not have a direct relationship with the original caller.
How Telecom Providers Should Interpret These Levels
A useful way to understand the distinction is to consider three questions:
Who is making the call? Does the provider have an authenticated relationship with the customer?
Who controls the number? Has the provider verified the customer's authority to use the calling number?
Where did the call enter the network? Is the provider originating the call or receiving it from another network?
A attestation satisfies all three relevant requirements for full attestation. B satisfies the customer identification and origination requirements but lacks verified number association. C reflects a gateway situation where the provider lacks a relationship with the original caller.
These levels describe the provider's knowledge rather than a definitive judgment about the caller's intentions.
How PeeringHub Supports STIR/SHAKEN Authentication Infrastructure
Certificate Management Is Essential to Call Authentication
Attestation is only one part of the STIR/SHAKEN process. The originating provider must also sign call information using its private key and an appropriate digital certificate.
The receiving provider uses the corresponding public certificate to verify the signature. If the signature is valid and the certificate is trusted, the receiving provider can establish that the signed information has not been altered.
This is where reliable certificate infrastructure becomes essential.
PeeringHub's STIR/SHAKEN Certificate Authority Services
PeeringHub provides STIR/SHAKEN Certificate Authority services designed to support telecom providers with certificate issuance and management.
Its capabilities include:
Certificate issuance: Enables eligible service providers to obtain STIR/SHAKEN certificates.
Certificate Repository: Provides certificate hosting so receiving systems can retrieve the public certificates required for verification.
STI API: Supports programmatic certificate-related operations through API integration.
Certificate verification: Helps inspect and verify STIR/SHAKEN certificates.
Identity Header analysis: Supports examination of the SIP Identity header and its associated authentication information.
OCN lookup: Provides an additional tool for identifying relevant telecom operator information.
These capabilities help providers manage the certificate infrastructure that supports the wider STIR/SHAKEN authentication process.
Why This Matters for Attestation
PeeringHub's certificate services do not independently decide whether a call should receive A, B or C attestation. That decision belongs to the originating voice service provider based on its relationship with the customer and its evidence of number authorization.
Instead, PeeringHub supports the certificate and API infrastructure required for the digital signing and verification process.
For example, a provider that has verified a business customer and its telephone number can assign the appropriate attestation level when signing outbound calls. Its STIR/SHAKEN certificate then supports the cryptographic authentication of the signed call information.
This separation of responsibilities is important: accurate attestation depends on reliable customer and number verification while successful digital authentication depends on properly managed certificates and cryptographic operations.
Conclusion: Build More Trustworthy Voice Networks With STIR/SHAKEN
A, B and C attestation levels provide telecom providers with a structured way to communicate how much they know about an originating caller and the caller's authority to use a telephone number. A represents full attestation, B represents partial attestation and C represents gateway attestation.
None of these levels should be interpreted as an automatic guarantee that a call is safe or fraudulent. They communicate the evidence available to the originating provider and help receiving networks make more informed verification and call-treatment decisions.
For telecom providers, accurate attestation practices must work alongside secure certificate management and reliable authentication infrastructure. PeeringHub supports this foundation through its STIR/SHAKEN Certificate Authority services, Certificate Repository and developer-focused APIs.
Strengthen your STIR/SHAKEN infrastructure with PeeringHub. Explore its certificate management and authentication capabilities at https://www.peeringhub.io/
Post a Comment