]> Identity for E2E-Secure Communications
rlb@ipv.sx
rohan.ietf@gmail.com
Applications and Real-Time More Instant Messaging Interoperability end to end security identity End-to-end (E2E) security is a critical property for modern user communications systems. E2E security protects users' communications from tampering or inspection by intermediaries that are involved in delivering those communcations from one logical endpoint to another. In addition to the much-discussed E2E encryption systems, true E2E security requires an identity mechanism that prevents the communications provider from impersonating participants in a session, as a way to gain access to the session. This document describes a high-level architecture for E2E identity, identifying the critical mechanisms that need to be specified. About This Document Status information for this document may be found at . Discussion of this document takes place on the More Instant Messaging Interoperability Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .
Introduction End-to-end (E2E) security protects users' communications from tampering or inspection by intermediaries that are involved in delivering those communcations from one logical endpoint to another. Almost all user-to-user communications systems today involve application-level intermediaries, such as message queues or media servers. In this context, "hop-by-hop" security refers to the security properties of the channel between the client and application-level intermediary, despite the fact that this channel may transit a number of network-level intermediaries. "End-to-end" security refers to security properties of the communications between one end client and another. Given the ubiquity of application-level intermediation, E2E security is a critical property for modern user communications systems. E2E security is typically implemented with two separate mechanisms:
  • E2E encryption, which establishes keys among a group of communicating clients, and authenticates them at a cryptographic level, and
  • E2E identity, which associates non-cryptographic attributes to the cryptographic