Interesting paragraph that i came across. taken from cipeinfo. Do a info cipe.info
There are several different places where encryption can be built into
an existing network infrastructure, corresponding to the different
protocol layers:
1. On the "network level": Packets travelling between hosts on the
network are encrypted. The encryption engine is placed near the
driver which sends and receives packets. An implementation is
found in CIPE.
2. On the "socket level": A logical connection between programs
running on different hosts (TCP connection; transport or session
layer in OSI) is encrypted. The encryption engine intercepts or
proxies connections. SSH and SSL work this way.
3. On the "application level": Applications contain their own
encryption engine and encrypt data themselves. The best known
example is PGP for encrypting mail.
Low-level encryption as implemented with CIPE has the advantage that it
can be made to work transparently, without any change to application
software. In the case of encrypting IP packets, it can be built into IP
routers which usually act as "black boxes" that only route traffic
between hosts, the hosts themselves don't see at all how the routing
works. So an "encrypting router" looks exactly like a non-encrypting
one, without any difference seen by other hosts and applications. It
can thus be used in places where software changes at higher levels are
not feasible.
Low-level encryption has the disadvantage that it does not guard against
intruders on a higher level, e.g. Trojaned applications, bug exploits
in system software or rogue administrators "sniffing" on terminal
devices.