Cryptographic protocols, layer by layer

Which cryptographic protocol lives at which layer of the TCP/IP stack, and which of them you are actually likely to meet in a professional role.

Name the cryptographic protocol (or protocols) associated with each of the link, network, transport and application layers.

State which of these protocols the lecture ranks as most likely to be encountered professionally, in order.

Identify the layer a named protocol operates at, given only its name.

Cryptographic protocols protect different layers of the stack

Networks combine hashes, MACs, certificates and key exchange into protocols at specific layers of the TCP/IP stack. The protected layer determines which protocol applies.

Reading the stack from the bottom up:

Link layer. WPA3 and WPA2 secure today’s wireless networks. Their predecessors, WPA and WEP, are broken.
Network layer. IPSec, together with its key-exchange protocol IKEv2.
Transport layer. TLS protects connections built on TCP; DTLS is its counterpart for UDP.
Application layer. OpenID, OAuth and DNSSEC, among others.

As of the lecture, the protocols most likely to be met in a professional role are, in order: TLS, WPA2/WPA3, OpenID, OAuth, and IPSec. The lecture works top-down through the standards above the link layer, covering application, transport, and network layer protocols in that order.

The protected layer decides the protocol pairing

Exam detail

A question that names a protocol and asks which layer it protects, or the reverse, is testing this table directly. Keep the pairings exact: TLS secures the transport layer, not the application layer, even though its original purpose was to protect an application-layer protocol (HTTP). PGP protects the application layer. IPSec protects the network layer. Confusing any of these costs the mark outright, since the lecture’s own practice quiz asks exactly this question.

Recall

Which cryptographic protocols protect each layer, and which does the lecture rank as most likely professionally?

Link layer: WPA3, WPA2 (WPA and WEP are broken).
Network layer: IPSec and IKEv2.
Transport layer: TLS (TCP), DTLS (UDP).
Application layer: OpenID, OAuth, DNSSEC.
Professional likelihood, most to least: TLS, WPA2/WPA3, OpenID, OAuth, IPSec.

Check yourself