A STREAMS-based protocol stack is adapted to encrypt and decrypt data flowing through the stack. In a first embodiment, a STREAMS-based module is added to a protocol stack to encrypt and decrypt data flowing through the stack. In a second embodiment, a STREAMS-based encryption multiplexor routes data to and from an encryptor. In a third embodiment, dynamic function registration is used to register cryptographic functions at a stream head. In a fourth embodiment, STREAM-based modules are modified, either by dynamic function replacement or conventional means known in the art, to redirect data flowing between protocol stack layers to an encryptor. Hardware-based and software-based encryptor configurations are disclosed for all embodiments, as well as various methods of identifying cryptographic characteristics, such as cryptographic algorithms, public and private encryption keys, bindings to applications and IP addresses, and the like.