Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When we talk about encryption in relation to the OSI Model we usually hear about encryption at Application (Email - PGP), Transport (SSL), Network (IPSec) and even Data Link Layer (WPA). But I have never heard of something in relation to the Physical Layer.

  • Is it possible to encrypt at the physical?
  • Are there any applications that use it?
  • Could there ever be a use-case for encryption at the physical layer?
share|improve this question
You mean like DNSsec? – RoraΖ Aug 2 '15 at 23:00
@raz, I am not sure, but my question is in relation to the Physical layer in the OSI Model - – Yazad Khambata Aug 2 '15 at 23:02
up vote 2 down vote accepted

If you choose to implement encryption at the physical layer, it might be because:

  • Either you need for some reason to support anything which could compose the link layer 2, you want your encryption scheme to be independent and transparent to potentially unsecured upper layers.
  • Some requirement make it unavoidable to work as close to the physical as possible.

The only current use-case I could imagine for such purpose would be radio-communication, and mostly military grade radio-communication. For instance, there are systems obfuscating the communication as to appear as electromagnetic blank noise while being actual communication (trying to avoid detection and localization issues). Such encoding does not process bytes, it directly processes the electromagnetic waves so it needs to be located at the physical layer.

In all case physical layer encryption would bring quite a high complexity, and therefore higher cost, so most chances are that its usage is limited to military & co. As far as I know for civilian usage using a standard physical layer with encryption implemented no lower than layer-2 is usually sufficient.

share|improve this answer
I am accepting this answer since it in some ways answers all questions. Though I would like to mention that @steve-sether answer is most interesting. – Yazad Khambata Aug 3 '15 at 16:55

Sure, Powerline adapters have done this for years.

Powerline adapter

For example the Belkin Surf POWERLINE NETWORKING ADAPTER employs 128-bit AES encryption.

share|improve this answer
Interesting share, thanks! – Yazad Khambata Aug 4 '15 at 13:02

The job of physical layer is to transmit the data over some channel(cable or wireless medium). If encryption was done at the physical layer, then all the data, including the application data, the destination IP address, port number, different headers, etc. will be encrypted as well. When this encrypted data will be transmitted, the next node(router,switch, or some other link) won't be able to determine the destination address(since even the destination address is encrypted), and it won't be able to forward it. Hence, encryption is not done at physical layer.

share|improve this answer
Of course if you use some physical layer encryption system you must use compatible material at both ends. – WhiteWinterWolf Aug 3 '15 at 13:29

You could think of Quantum Cryptography as a form of cryptography at the physical level. Quantum Cryptography uses the properties of quantum mechanics to send messages that can't be intercepted by a 3rd party. It's not cryptography in the strictest sense, but it serves the same purpose of preventing 3rd parties from intercepting data.

Of course, it doesn't follow the OSI model since quantum cryptography is inherently point to point.

share|improve this answer

The data link layer is the lowest layer where actual data is exchanged, the physical layer immediately below that is the mechanism for passing that data.

You could insert an encryption layer in between your physical layer and your data link layer that flips bits on the wire in a manner that a device at the other end would be able to decode, but really all you've done there is added a new data link layer IMO.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.