Subject: Re: [E2ee] Thoughts on draft-knodel-e2ee-definition

From: "Olaf Kolkman" <[email-masked]>
Date: Thu, 04 Nov 2021 08:52:14 +0100

On 19 Oct 2021, at 17:35, Mallory Knodel wrote:

[…]
>> 2. You are, I think, missing the concept of tunnels. Tunnels have 
>> ends.
>> Tunnels are used to carry trusted traffic over untrusted 
>> environments.
>> Tunnels have "users" that are normally processes. Encryption on 
>> tunnels is
>> hugely important to how the Internet works. Now, that may not be what 
>> you
>> want to talk about in your document, and that's OK, but the feel 
>> (partly by
>> you talking about end-to-end, and partly by the long preamble about 
>> BGP in
>> 2.1) is that it is in scope.
>
> Wondering if Fred or Olaf could jump in? I think I would say tunnels 
> are indeed out of scope because it's transport encryption, but you're 
> right that we talk about BGP. It's only in an attempt to elucidate the 
> end point and e2e principle.
>
> Thoughts from my co-authors on squaring this circle?
>

I think you can reference tunnels in section 2.2 as a negative example.

For instance (addition in italic)

These end points may then be considered acceptable sub-identities 
provided that no path between the end identity and sub-identity is 
accessible by any third party.  _For instance, the common VPN business 
model whereby a TLS or an IPsec tunnel terminates at a VPN service 
provider from which the traffic is then forwarded to its destination 
does not qualify_.

—Olaf

---

From: "Olaf Kolkman" <[email-masked]>
Date: Thu, 04 Nov 2021 09:21:43 +0100

>>> hugely important to how the Internet works. Now, that may not be 
>>> what you
>> right that we talk about BGP. It's only in an attempt to elucidate 
>> the end point and e2e principle.
>>

Maybe add that the path between the VPN termination point and the final 
destination is accessible to third parties - that is the point I want to 
make. There is of course a tension in this example that the VPN service 
itself (or any other partial tunnel) does satisfy the expectations.

—Olaf