Re: [E2ee] Thoughts on draft-knodel-e2ee-definition

[Olaf Kolkman <[e-mail]>]

On 19 Oct 2021, at 17:35, Mallory Knodel wrote:

[…]
>> 2. You are, I think, missing the concept of tunnels. Tunnels have 
>> ends.
>> Tunnels are used to carry trusted traffic over untrusted 
>> environments.
>> Tunnels have "users" that are normally processes. Encryption on 
>> tunnels is
>> hugely important to how the Internet works. Now, that may not be what 
>> you
>> want to talk about in your document, and that's OK, but the feel 
>> (partly by
>> you talking about end-to-end, and partly by the long preamble about 
>> BGP in
>> 2.1) is that it is in scope.
>
> Wondering if Fred or Olaf could jump in? I think I would say tunnels 
> are indeed out of scope because it's transport encryption, but you're 
> right that we talk about BGP. It's only in an attempt to elucidate the 
> end point and e2e principle.
>
> Thoughts from my co-authors on squaring this circle?
>

I think you can reference tunnels in section 2.2 as a negative example.

For instance (addition in italic)

These end points may then be considered acceptable sub-identities 
provided that no path between the end identity and sub-identity is 
accessible by any third party.  _For instance, the common VPN business 
model whereby a TLS or an IPsec tunnel terminates at a VPN service 
provider from which the traffic is then forwarded to its destination 
does not qualify_.


—Olaf