The PPP authentication protocols PAP and CHAP can be used to ensure that only authorized devices can establish a PPP connection. Once that is done, PPP normally provides no other security to the data being transmitted. In particular, all data is normally sent “in the clear” (unencrypted), making it easy for someone who intercepts it to read. For important data that must be kept secure, encryption prior to transmission is a good idea. This can be done at higher layers using something like IPSec, but PPP also provides an optional feature that allows data to be encrypted and decrypted at the data link layer itself.

PPP data encryption is implemented using two protocol components:

• PPP Encryption Control Protocol (ECP): This protocol is responsible for negotiating and managing the use of encryption on a PPP link.
  
  
• PPP Encryption Algorithms: A family of encryption algorithms that perform the actual encryption and decryption of data. Several of these are defined in Internet standards (RFCs), and two devices can also negotiate a proprietary encryption method if they want to use one not defined by a public standard.

ECP is usually the only part mentioned when encryption in PPP is discussed. ECP is in fact used only to configure and control the use of encryption; it is the algorithms that do the real work. This technique allows each implementation to choose what type of encryption they wish to use. The original ECP defined only a single encryption method, and a couple of others have since been added.