DDSSEC13 — Specify use of encryption by BuiltinParticipantVolatileMessageSecure and TypeLookupService Writer/Reader

The security spec does not explicitly mention that the secure volatile channel must use encryption.

This probably belongs to chapter 10, as the impacted configuration is the PluginEndpointSecurityAttributes.

The specification should state that, for the BuiltinParticipantVolatileMessageSecureWriter & BuiltinParticipantVolatileMessageSecureReader, the attribute is_submessage_encrypted in the PluginEndpointSecurityAttributes (see 10.4.2.5) shall be set to TRUE .)

The same applies to the endpoints used by the TypeLookupService.

Also. These two channels are not using origin authentication. We should discuss whether this is vulnerability or reasonable for this use-case.