Could someone please tell me why cryptographic algorithms are placed in the data-link layer for wireless networks?


Though the OSI model is more often a source of confusion than enlightenment, it is here reasonably informative. The WiFi encryption occurs in layer 2 ("data link") because it strives to embody a security feature which is inherently related to the data link.

Namely, WiFi was designed to be the over-the-air equivalent of wired Ethernet. In Ethernet networks, there is a physical isolation between systems which are physically connected to one of the wires, and those who are not. This can be viewed from a security point of view: if you can prevent physical access to the wired, e.g. by keeping the wires inside a building and locking the doors, then you can keep out intruders from your local network. Since WiFi is radio-based and radio waves tend to propagate freely (that's their point), something was needed in order to provide something equivalent security-wise, and that something is encryption (whether it was done properly is another question).

Since the security feature (keeping the local network out of reach of attackers) is bound to the local network (hence "layer 2"), it made sense to use encryption in the layer 2 as well. This has the additional benefit of being immediately compatible with whatever protocols are used for layers above it; in plain words, as long as the WiFi card driver is aware of the encryption, nothing else in the host operating system, in particular its TCP/IP stack, needs be modified in any way.

(This is not entirely true because the connection management system has to happen somewhere -- the user must enter the WiFi password at least once -- but this again can be contained. The first WiFi cards and drivers for Windows did all the job without the Windows ever becoming aware that such a thing as WiFi ever existed.)

Putting the crypto at some upper layer would be possible, but that's another model. This basically means forfeiting the link-level security, using it as if it was some hostile playground, and adding crypto algorithm (e.g. IPsec) to the TCP/IP layer in order to restore some sort of security. That's exactly what happens when someone connects to an open WiFi in a restaurant or hotel, and then fires up his VPN to connect to his office network, or simply uses only HTTPS Web sites.

  • That was most enlightening. Thank you for your response. – user43327 Apr 2 '14 at 14:43

There are many methods of attack in the Data Link Layer. Wireless Local Area Networks (WLANs) are no exception. WLANs have many methods of attack, or as I would say, many methods of approach. There are several techniques used to mitigate attacks involving the Data Link Layer. For WLANs, one of these methods is to utilize certain protocols/encryption. Many Wireless Access Points (WAPs) allow for changing of firmware and installing certain software daemons that can allow for things such as hybrid or custom algoriths to be used. So to answer your question, I would say that using cryptographic algorithms (something custom/hybrid, or known) for your WLAN(s), in the DataLink Layer, is just "Business as Usual".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.