Making a high-speed optical transmission unrecordable happens at Layer 1, by reshaping the light carrying the data, referred to as Photonic Layer Security (PLS). An attacker who taps the fiber captures ciphertext rather than a clear-text copy of the traffic. It differs from conventional optical encryption, which scrambles the payload but still involves placing a distinct, recordable waveform on the fiber. PLS is implemented one link at a time, using a matched pair of transmission units at each end of a span running over existing DWDM infrastructure. It does not replace post-quantum cryptography, because it blocks the recording step in an attack chain sequence, rather than the decoding of an encrypted key. CyberRidge's Carmel platform implements this on 100 Gb/s links over standard single-mode fiber.

‍

What is an unrecordable optical transmission?

Unrecordable means there is no intelligible signal on the fiber for an attacker to capture and store. Conventional Layer 1 encryption, such as the AES-256 in-flight encryption on transponders from Ciena, Nokia, and Adtran, protects the contents of the transmission but leaves a well-formed optical signal that a tap can exfiltrate in full. This exfiltrated data still needs to be protected even though the payload is encrypted. An attacker can record the ciphertext now, along with the key exchange, and potentially decrypt both if the encryption key is lost or stollen, if either is implemented incorrectly or cryptoanalytic capabilities advance. This is the Harvest-Now-Decrypt-Later threat, and it is why encryption on its own does not close the exposure window for data that must stay confidential for years or decades. 

‍

Photonic Layer Security targets the earlier harvest step and removes the artifact that would be archived. This matters because fiber taps are cheap and quiet. Physical access to a fiber generally takes one of a few forms: installing hardware at entry and exit points such as street cabinets and manholes, inserting an inline splitter that diverts a portion of the light to a recording device, or bending the fiber itself. Among these, macrobending is the most common stealth technique: bending a fiber past roughly a 6.5–7.5 cm radius causes light to leak from the core through the cladding into a clip-on coupler, without cutting the cable or producing a detectable loss in signal strength.

‍

What Is Harvest Now, Decrypt Later, and How Can Organizations Protect Against It? This article breaks down the threat model this technology is built against.

‍

How the signal is made unrecordable

Before the signal reaches the fiber, Carmel reshapes it in three stages. It spreads the signal across roughly 1.5 THz of the spectral band rather than concentrating it on one narrow wavelength. An optical key then modifies that spread signal, changing every fraction of a second; the key is generated inside the unit by an air-gapped generator and carried within the light itself, so there is nothing stored for an attacker to reach. The signal is then attenuated and buried beneath added spontaneous optical noise, driving down the optical signal-to-noise ratio. A measure of how far a signal stands above the background noise on the fiber, to a level theoretically unrecoverable.

‍

Reconstruction happens through coherent optical detection: the incoming light is mixed with the receiver's synchronized mode-locked laser, and the coherent addition that recovers the data, as opposed to noise, occurs as the signal is down-converted at the photodetector. That recovery only succeeds if the receiver's laser is synchronized to the sender's at the precision coherent detection requires, and if it holds the matching photonic key for that instant. Both requirements, laser synchronization and key matching, exist only inside a paired unit, and not just a software key." 

‍

How to roll it out on a live network

Start by scoping the links, not the network. Inventory which fiber paths carry data with a confidentiality requirement measured in years or decades: classified government records, defense communications, financial records, intellectual property. Federal timelines set the pace. Executive Order 14412, signed June 22, 2026, requires federal high-value assets and high-impact systems to move to post-quantum key establishment by December 31, 2030, and digital signatures by December 31, 2031, with a FAR rule putting contractors on the same 2030 deadline.

‍

Next, confirm the physical path supports it. Carmel runs up to 100 km unamplified and works with EDFA and Raman amplification for even longer spans. No changes are needed to existing DWDM equipment; it works with any vendor's optical transport, and supports up to five alien wavelengths alongside conventional traffic. Then check the client side and the facility: a 100 GbE interface across up to four QSFP-28 ports (OTU4 also supported), 3U of rack space per unit, and dual redundant AC or DC power at each site.

‍

CyberRidge deploys in weeks rather than the multi-year timelines typical of a cryptographic migration. This is because implementation is an overlay: the new hardware goes in alongside the existing infrastructure rather than replacing it. Bring the first pair of Carmel transmission units online by simply replacing the line cards, move non-critical traffic across to validate performance and error rates, then shift to critical traffic once the link has proven itself trustworthy.  Decide how the link is operated: the Trekker network management system adds multi-link visibility and SIEM integration for ease of management.

‍

For more on the cryptographic half of the rollout, see How Do You Implement Post-Quantum Encryption for Data-in-Transit?

‍

What this approach does not do

Photonic Layer Security does not replace post-quantum cryptography. Quantum computers threaten the RSA and elliptic-curve key exchange that protects the asymmetric session key, not the AES-256 encryption itself. Instead, PLS sits underneath and closes a different gap.

‍

The encryption itself is not the weak point. AES-256, the algorithm protecting the data, is expected to hold up against quantum computers, and standards bodies do not require replacing it. The problem is what protects the key that establishes the channel between two destinations. Keys are exchanged using older encryption methods that quantum computers are expected to break, which is what the post-quantum migration is designed to fix. But an attacker who copies your encrypted traffic off the fiber today, can keeps that ciphertext, along with the key exchange that came with it, and wait. When the capability to break that exchange arrives, the stored traffic gets decrypted retroactively, exposing everything. 

‍

Once the attacker already has your data, there is no way to reach back and retrieve it. That is why the recording itself matters more than the strength of the encryption. Photonic Layer Security removes the copy: if there is no intelligible signal to capture off the fiber, there is nothing for an attacker to store and wait on.

‍

Carmel at a glance

‍

What This Means for Network Teams

Carmel is deployed on specific links you choose, not across the whole network at once. Identify the links whose traffic must stay confidential well past 2030, confirm you control both endpoints, and protect those first. Run the post-quantum migration on its own track in parallel, since the two address different failure modes.

‍

Have links carrying data that must stay confidential for decades? Learn more to see how CyberRidge implements unrecordable transmission across existing fiber.

‍