Cryptographic protocols, layer by layer

Which cryptographic protocol lives at which layer of the TCP/IP stack, and which of them you are actually likely to meet in a professional role.

Name the cryptographic protocol (or protocols) associated with each of the link, network, transport and application layers.

State which of these protocols the lecture ranks as most likely to be encountered professionally, in order.

Identify the layer a named protocol operates at, given only its name.

10 min read

Intuition

The last few weeks built cryptographic primitives one at a time: hashes, MACs, certificates, key exchange. Real networks deploy these as named protocols, each one bolted onto a specific layer of the TCP/IP stack. Before going into any one of them, it helps to see the whole map.

Mechanism

Reading the stack from the bottom up:

Link layer. WPA3 and WPA2 secure today’s wireless networks. Their predecessors, WPA and WEP, are broken.
Network layer. IPSec, together with its key-exchange protocol IKEv2.
Transport layer. TLS protects connections built on TCP; DTLS is its counterpart for UDP.
Application layer. OpenID, OAuth and DNSSEC, among others.

As of the lecture, the protocols most likely to be met in a professional role are, in order: TLS, WPA2/WPA3, OpenID, OAuth, and IPSec. The lecture works top-down through the standards above the link layer, covering application, transport, and network layer protocols in that order.

Exam detail

A question that names a protocol and asks which layer it protects, or the reverse, is testing this table directly. Keep the pairings exact: TLS secures the transport layer, not the application layer, even though its original purpose was to protect an application-layer protocol (HTTP). PGP protects the application layer. IPSec protects the network layer. Confusing any of these costs the mark outright, since the lecture’s own practice quiz asks exactly this question.

Recall

Link layer: WPA3, WPA2 (WPA and WEP are broken).
Network layer: IPSec and IKEv2.
Transport layer: TLS (TCP), DTLS (UDP).
Application layer: OpenID, OAuth, DNSSEC.
Professional likelihood, most to least: TLS, WPA2/WPA3, OpenID, OAuth, IPSec.