We currently have security protocols for the application layer (e.g. S-HTTP, DNSSec, PGP, etc.), the transport layer (e.g. SSH, TLS, SSL, etc.) and the network layer (e.g. IPSec).

Does it make sense to create a security protocol for the data link layer?

  • How would your get that layer to be secure using a protocol? Network layer makes sense (which is why its used) but don't see data link layer adding anything, even if it was possible. With Layer 1 protection offering protection against denial of service (using physical protection such as cable protection), and layer 3 offering authentication and secrecy already. – ISMSDEV Jun 6 '17 at 8:43
  • 2
    There are actually layer 2 vpn, for example using L2TP. Apart from that don't concentrate on what you would call it but rather what problem it should solve which is not solved by existing solutions. – Steffen Ullrich Jun 6 '17 at 8:54
  • Perhaps there is a closed protocol for those who pay big money without commercial concern (wink wink) . IMHO, this is rather overkill to create a complicate "trust protocol" under data link layer for typical user and business environment. Eavesdropping is not feasible if you already run IPSec. So the application is mean to prevent sophisticated hardware MiTM hijack attack, again, is kinda works like espionage. – mootmoot Jun 6 '17 at 9:41
  • 3
    There already is IEEE802.1AE (MACsec): en.wikipedia.org/wiki/IEEE_802.1AE – Teun Vink Jun 8 '17 at 8:23
  • What threats do you want to counter? ARP spoofing? – schroeder Jun 8 '17 at 9:05

There are good reasons to add security to the lower layers and it has been done in practice (see WLAN protocols). Providing data confidentiality and authentication services at the data link layer is a simple solution. It is attractive because the wireless link is typically the most vulnerable part of the connection and one has to deal with only network technology. Moreover, when a lower layer is secured, all upper layers are also secured. So it protects all protocol information from the higher layers. It also doesn't suffer from the interoperability problems that protection at the network or transport layer bring with them.

It does have the (rather big) disadvantage that the information is not protected in the intermediate network nodes. This makes it impossible to realize end-to-end protection.

For sensitive applications, protection at the data link layer can be combined with protection at a higher layer.

  • Maybe my question is confusing. I wanted to know whether security at the data link layer makes sense and gave Ethernet (and EthernetSec) as an example to clarify what I meant. If you change the DLL in this way, why would it no longer be Ethernet? IPSec is still IP, right? All you do is re-arrange the packet and at IPsec headers (or a new IP header in Tunnel Mode). – Thomas Vanhelden Jun 8 '17 at 8:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.