End-to-end Encryption (e2e)

e2e occurs between the original source and the final destination, that is the encryption is happened in either Application Layer#, Presentation Layer#, Transport Layer# or Network Layer#. This implies that they have the shared keys. e2e only concerns about the encryption of the user data. If user’s privacy and security is desirable, then e2e is preferred. However, due to the translation limit when jumping between different network technology such as IPv4# and IPv6#, the data sent must be decrypted and then be transformed to an understandable form. This could be a huge compromise.

It doesn’t protect the traffic flow as in Link Encryption.

Links to this page
  • TNS3131 Chapter 2: Conventional Encryption and Message Confidentiality
  • IP Security (IPsec)

    There are two protocol modes available in IPsec: transport mode and tunnel mode. Transport mode provides End-to-end security# which only protects the IP packet payload. Tunnel mode provides gateway-to-gateway (usually Router owned by the same corporation) security which protects the entire IP packet. However, the traffic after the gateway will not be protected under tunnel mode, and it can’t be set up by normal user. The authentication and encryption will be done slightly different in each mode. In transport mode, authentication and encryption will only be done on the payload (could be susceptible to Traffic Analysis#) and sometimes include a portion of IP header (if using AH only) and IPv6 extension headers. In tunnel mode, authentication and encryption must be done on the entire packet (in AH only tunnel mode SA, it will authenticate a portion of IP header and IPv6 extension headers too). Both mode could be stacked to each other in order to satisfy four cases of SA.

  • Diameter

    Diameter is a new #Triple A (AAA) protocol standardised by RFC3588 and RFC4005. It is derived from and aim to replace Remote Access Dial-In User Service (RADIUS) (also provides the transition support) with enhancements such as error handling and message delivery reliability. Instead of relying on a central AAA server, it employs a peer-to-peer architecture, which means that every host or node that implements Diameter could act as either a server or client, with additional support of peer discovery via static configuration or dynamic lookup. The protocols in used by Diameter are connection-oriented protocols such as #Transmission Control Protocol (TCP) and Stream Control Transmission Protocol (SCTP) with a maximum attribute data size of 16,777,215 octets (8 bit). It supports both Link Encryption# and End-to-end Encryption (e2e)#.

#p2p #cryptography