Is there a difference between and End to End Encryption solution vs a Peer to Peer Encryption solution?

Posted on 2014-08-12
Last Modified: 2014-08-13
Just a quick question.  My company is currently reviewing solutions for us to accept credit cards and be PCI (credit cards) compliance.  From what I've read I think our best approach is going to be going with a validate P2PE solution.  One of the providers we are looking into describes their solution as an End2End encryption service and reduces our scope for PCI the same as P2PE.  They are very careful as to not state it's P2PE.  I'm just wondering what the difference is, if any.  Thanks for your help.
Question by:GoNats
    LVL 28

    Assisted Solution

    Well, terminology is a tricky business.  If they're being pedantic about it, then you need to ask them why, and what differentiates their solution from a P2PE solution.  I'd hold their feet to the fire about it, since PCI compliance is such a pain in the neck.

    It could be functionally identical, but just not be a validated P2PE solution.  If you require a validated solution, that could be an issue.

    Author Comment

    Thanks Asavner.  I have asked them and waiting to hear back.  PCI compliance is a pain, but from what i've been reading and although it's not cheap, a validated P2PE solution makes compliance life much more bearable and achievable.  Our solution needs to be validated.
    LVL 33

    Accepted Solution

    Classically, an end to end solution encrypts the message, a peer to peer solution encrypts the transmission channel.

    if there are only two actors in the system, there really isn't a distinction. If there are more than two actors though, it gets interesting.

    To give an example, lets look at email.

    An end-to-end solution is PEM (s/mime) or pgp - you encrypt the message, you send the message, the recipient receives the message, the recipient decrypts the message.

    A peer to peer solution would be TLS.
    You send your mail unencrypted... BUT the transmission from you to your ISPs mailserver is TLS (and hence, encrypted by the same mechanism HTTPS websites use)
    Your ISP sends the mail on to THEIR ISP, and *might* use TLS, if it is offered, but probably won't insist on it.
    The recipient may receive from the ISP via SMTP, or pull via IMAP or POP3. That may in fact be TLS also (hence, SMTPS, IMAPS, POP3S) or may not be.

    In this case, there are 3 hops the mail goes though, and at each step past the first, you are reliant on a third party securing the channel (and the recipient is reliant on third parties securing each step prior to the last)

    Does that make sense?

    Author Comment

    It does  Thanks Dave!

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Join & Write a Comment

    Suggested Solutions

    As a financial services provider, your business is impacted by two of the strictest federal regulations on record: the Sarbanes-Oxley Act and the Gramm-Leach-Bliley Act. Correctly implementing faxing into your organization to provide secure, real-ti…
    Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now