Placement of Encryption Function
1. Where Can Encryption Sit in the Stack?
Stallings's question: at which layer do you encrypt — link, network, transport, or application? Each choice protects different headers and serves different owners (network operator vs end user):
App message → [TLS: encrypt payload+TCP] → TCP → [IPsec transport: encrypt TCP+data]
→ IP → [IPsec tunnel: encrypt whole IP] → link → [Link enc: encrypt whole frame]
Lower layer = more headers hidden but more points decrypt; higher layer = true end-to-end but headers leak for routing.
2. Four Placements Compared
| Placement | What is encrypted | Headers visible? | End-to-end? | Typical use |
|---|---|---|---|---|
| Link (L2) | Whole frame incl. IP header | Nothing on that hop (decrypts per hop) | No — exposed inside each switch/router | Leased lines, Wi-Fi WPA2/3, MPLS |
| Network IPsec tunnel | Whole inner IP packet | Outer IP visible (tunnel endpoints) | Gateway-to-gateway | Site-to-site VPN |
| Network IPsec transport | TCP segment + data | IP header visible (routing needs it) | Host-to-host | Intranet host pairs |
| Transport TLS / App PGP | App data (+TCP in TLS) | IP + TCP visible (metadata: who, when, how much) | Yes — only endpoints hold keys | HTTPS, mail, banking |
Worked scenario: Delhi–Mumbai company VPN: link encryption on each leased hop (operator-owned, fast hardware) + IPsec tunnel between gateways (hides internal topology) + TLS inside for customer data (end-to-end even from gateway admins). Defense in depth = different placements for different threats.
3. Trade-offs Exams Test
- Traffic analysis resistance grows downward: link hides addresses/sizes per hop; TLS leaks destination IP, SNI (pre-ECH), packet sizes/timing — hence Tor/VPN layering for metadata.
- Cost/granularity grows upward: link needs devices per hop (1 key per link, many keys); TLS needs only endpoints (1 key per session) but every app implements it.
- Trust model: link/network encryption trusts intermediate nodes (they decrypt!); only transport/app encryption distrusts the network — BEU's favourite one-liner: "link encryption protects links, end-to-end protects data".
- Performance: link = hardware line-rate, zero per-app work; TLS = handshake latency + per-connection CPU (amortized by session resumption, hardware AES-NI).
4. Selection Rule
Bulk untrusted transit → link encryption; inter-site private routing → IPsec tunnel; host applications over open Internet → TLS/app encryption. Real systems combine: WPA3 (link) + VPN (network) + HTTPS (transport) — each placement covering the gaps above it.
Exam Points
- Four-row placement table with visible-headers column — 5-mark core.
- "Link protects links, E2E protects data" + per-hop decryption diagram — 2 marks.
- VPN scenario combining all three — favourite applied question.
- Metadata leak ordering (TLS leaks most, link least).