Cryptography · Study deck

E1: Link-Layer Encryption

Picture a locked radio message that is opened by a relay before reaching the cloud.

Shield Shelly is your guide for this deck.

link-layer-encryptionhop-by-hopkey-scope
Shield Shelly, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: The deeper layer explains how a protected link frame is built, why a freshness counter is a correctness condition rather than a detail, and why E1 authenticity is weaker than application identity.
  • Explain: E1 is good local access control; it is not end-to-end privacy, it is not proof of a specific application identity, and a shared link key can spread one compromise widely.
  • Explain: If you only need the intuition, this layer is enough: E1 protects the local radio hop against nearby eavesdropping and frame tampering, but the node that terminates it reads the plaintext.
iotclass.org

Major section

Protect One Local Hop, Then Name the Next Reader

A gateway means the device or service that joins systems and may read data when local protection ends.

  • When E1 is enabled, a frame on the air is encrypted and carries an integrity check, so a nearby attacker cannot casually read it and a tampered frame is rejected.
  • The most important thing to understand about E1 is that it is hop-by-hop, not end-to-end.
  • The next node that receives the frame decrypts it, reads the contents, and then forwards the message onward, often re-protecting it on the next hop with a different key.
E1 protects each local hop, but the node that terminates it (here a router) decrypts and forwards the plaintext, so later boundaries need E2 or E3/E4.
E1 protects each local hop, but the node that terminates it (here a router) decrypts and forwards the plaintext, so later boundaries need E2 or E3/E4.
iotclass.org

Major section

Protect One Local Hop, Then Name the Next Reader (continued)

Beginner ExamplesThese examples show the limits of link encryption.

  • That node, a router, border router, bridge, or gateway, sees the plaintext.
  • The road is safe between stops, but every courier at a handover sees the message.
  • Scoped, pairwise, or session keys contain a compromise.
iotclass.org

Major section

Protect One Local Hop, Then Name the Next Reader (continued)

Key scope sets the blast radiusA shared network key lets one extracted device expose the whole group.

  • If you only need the intuition, this layer is enough: E1 protects the local radio hop against nearby eavesdropping and frame tampering, but the node that terminates it reads the plaintext.
  • E1 is good local access control; it is not end-to-end privacy, it is not proof of a specific application identity, and a shared link key can spread one compromise widely.
  • A smart-home device on an encrypted local mesh is safe from a neighbour sniffing the air.
iotclass.org

Major section

Protect One Local Hop, Then Name the Next Reader (continued)

The first radio hop carries an encrypted, integrity-checked frame, but the router terminates that protection, obtains plaintext, and creates protection for the next hop.

  • Naming the first plaintext reader connects E1 to the chapter's running decision: add E2 or E3/E4 whenever the intended trust boundary lies beyond that reader.
  • The One-Minute ViewProtects the local hop An encrypted, integrity-checked frame stops nearby eavesdropping and rejects tampered or injected frames on the radio link.
  • If every sensor in a building shares one network key, one stolen sensor can expose the others' traffic.
iotclass.org

Major section

Review the Hop, Key Scope, and Replay Proof

The most common finding is a shared network key that quietly turns one device's compromise into a group-wide exposure.

  • The receiver must reject before application action if any check fails.
  • Key Scope and Blast RadiusThe central E1 design risk is rarely the cipher; it is key scope.
  • An E1 review should never stop at "encryption is enabled." The job is to map which nodes decrypt, name the key scope and the blast radius it creates, capture frame-level evidence, and prove that tampered and replayed frames are rejected.
  • Keys change after pairing, rejoin, or another authenticated exchange.
A useful E1 trace names the protected frame parts, a visible-but-authenticated header, a freshness counter, hidden ciphertext, and an integrity tag, and shows the receiver's accept-or-reject decision.
A useful E1 trace names the protected frame parts, a visible-but-authenticated header, a freshness counter, hidden ciphertext, and an integrity tag, and shows the receiver's accept-or-reject decision.
iotclass.org

Major section

Review the Hop, Key Scope, and Replay Proof (continued)

A smaller set of nodes shares a key for a role or area.

  • Two peers share or derive a key for one direct relationship.
  • Worked Review: A Warehouse Sensor MeshA warehouse runs a low-power mesh of door, motion, and environmental sensors with E1 enabled, and a gateway forwards events to the cloud.
  • The team says "the mesh is encrypted, so we are covered." The reviewer turns that into findings.
iotclass.org

Major section

Frame Counters Make the Hop Trustworthy

The deeper layer explains how a protected link frame is built, why a freshness counter is a correctness condition rather than a detail, and why E1 authenticity is weaker than application identity.

  • The full nonce must never repeat under the same key.
  • The architecture decision is always layered against the trust boundaries, not a single switch.
  • Confidentiality-only link protection accepts modified frames silently.

Key terms

Modern link security
Modern link security is authenticated encryption: it pairs encryption of the payload with a message integrity check so a modified frame is rejected.
Old frames
Old frames are rejected and nonces never repeat per key.
With a shared link key, one weak device can expose the whole key group; scoped or pairwise keys bound a compromise to one relationship, and renewal shrinks it further.
With a shared link key, one weak device can expose the whole key group; scoped or pairwise keys bound a compromise to one relationship, and renewal shrinks it further.
iotclass.org

Major section

Frame Counters Make the Hop Trustworthy (continued)

The hop is confidential and tampered frames are rejected.

  • The receiver recomputes the tag over the header and ciphertext and rejects the frame if it does not match, before passing anything to the application.
  • Old frames are rejected and nonces never repeat per key.
  • Visible routing metadata cannot be changed without detection.
iotclass.org

Major section

Frame Counters Make the Hop Trustworthy (continued)

A reset counter can reuse nonces under the same key and nonce inputs; missing receiver replay checks can let captured frames through.

  • Freshness, Counters, and the Power-Loss HazardThat freshness field supports replay rejection when the receiver tracks accepted counter values, and it can form part of the per-frame AEAD nonce.
  • An unauthenticated header lets an attacker reroute or relabel a frame.
  • Every plaintext reader on the path is known and intended.
iotclass.org

Major section

Frame Counters Make the Hop Trustworthy (continued)

Safe designs persist the counter across resets in non-volatile storage, or force a rekey on rejoin so a fresh key starts a fresh counter.

  • The comparison connects the power-loss nonce hazard to its consequence: reused state or an extracted broad key can undermine far more than one restarted device.
  • If the receiver needs to know which device or which application sent a command, it needs per-device keys (E2) or an application-layer signature, not just a valid link tag.
  • Assuming a terminating router or gateway is blind hides real exposure.
iotclass.org

Major section

Summary

E1 is link-layer (MAC-layer) encryption that protects one local wireless hop between adjacent nodes against nearby eavesdropping and frame tampering.

  • E1 is hop-by-hop, not end-to-end: the node that terminates the link decrypts and reads the plaintext, which is expected but must be named in the design.
  • A protected frame pairs encryption with an integrity tag (often AES-CCM), authenticates the visible header as associated data, and uses a freshness counter as part of the per-frame nonce.
  • E1 authenticity proves possession of the link key, not a specific application identity; use E2 per-device keys or signatures when the sender must be identified.
iotclass.org

Deck summary

Key takeaways

A gateway means the device or service that joins systems and may read data when local protection ends.

  • Beginner ExamplesThese examples show the limits of link encryption.
  • Key scope sets the blast radiusA shared network key lets one extracted device expose the whole group.
  • The first radio hop carries an encrypted, integrity-checked frame, but the router terminates that protection, obtains plaintext, and creates protection for the next hop.
  • The most common finding is a shared network key that quietly turns one device's compromise into a group-wide exposure.
iotclass.org

Retrieval practice

Recall check 1 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q1A sensor mesh has E1 link-layer encryption enabled and packet captures show encrypted frames, but the gateway logs decrypted temperature and occupancy values before forwarding them. What is the correct conclusion?

AE1 protects local hop; gateway plaintext needs upper-layer protection.
BE1 is broken merely because trusted gateway decrypts the payload.
CNo further encryption is needed, because the captured frames are encrypted
DOnly a longer AES key is needed after gateway plaintext logging.
Show answer

Answer: A E1 protects the adjacent wireless hop, so the gateway that terminates it can read plaintext.

iotclass.org

Retrieval practice

Recall check 2 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q2Across a building, every sensor shares one network-wide E1 key. A single sensor is physically extracted and its key recovered. What is the blast radius?

AOnly the extracted sensor is affected, because the attacker touched just one device
BIt is fine because the link still uses AES; the key value is not important
CThe recovered network key can decrypt and forge traffic for every node that shares it.
DAdding gateway-to-cloud TLS removes the exposure on the local mesh
Show answer

Answer: C A shared link key makes one extraction a group-wide exposure.

iotclass.org

Retrieval practice

Recall check 3 of 3

Shield Shelly says: answer from memory, then check your reasoning.

Q3A constrained node keeps the same link key across reboots but resets its frame counter to a low value after every power loss. Why is this unsafe at the link layer?

AThe tag still checks integrity; a reset counter only changes receiver ordering, not nonce safety.
BThe frame counter feeds the nonce; reset under the same key reuses a nonce and breaks protection.
CCounter reset only raises power use after reboot, without affecting link security.
DA larger link key alone prevents nonce reuse when the same low counter repeats.
Show answer

Answer: B Link AEAD requires a unique full nonce per key.

iotclass.org

Print reference

Answers

Answer key.

  1. A · E1 protects the adjacent wireless hop, so the gateway that terminates it can read plaintext.
  2. C · A shared link key makes one extraction a group-wide exposure.
  3. B · Link AEAD requires a unique full nonce per key.
iotclass.org