@@ -755,7 +755,7 @@ The product shall ensure that when the connection to the VPN server is lost at t
#### 5.7.5.1 Requirement
The VPN traffic shall be encrypted between the VPN client and the designated endpoint with no possibility to decrypt and eavesdrop on traffic on any network device in between these endpoints.
The VPN traffic shall be encrypted using session keys generated and held only by the communicating endpoints; intermediary nodes shall not possess keys capable of decrypting such #transitory traffic.
> NOTE: In consumer or enterprise VPN scenarios which offer multiple VPN servers, remote data processing usually generates the VPN credentials and populates this to the respective VPN client. This allows the remote data processing service to eavesdrop on the VPN connection since it administers the VPN credentials. In a mesh scenario, the credentials have to be generated and maintained by the endpoint itself to ensure no intermediate party can eavesdrop on the connection.
