AES-128 is the encryption algorithm used by GPON for downstream.

GPON (Gigabit Passive Optical Network) does not use AES-128 encryption for downstream traffic. Instead, GPON uses AES-128 encryptiononly for upstream trafficto ensure data security between the Optical Network Unit (ONU) and the Optical Line Terminal (OLT). Downstream traffic in GPON is broadcasted to all ONUs, and encryption is not applied because the data is intended for multiple users. The encryption key is dynamically managed by the OLT and distributed securely to the ONUs.

This behavior is defined in theITU-T G.984 standard, which specifies the GPON architecture and security mechanisms. For downstream traffic, the security relies on higher-layer protocols (e.g., IPsec or application-level encryption).

References:

ITU-T G.984 Standard - GPON Architecture and Security

Huawei GPON Technical Documentation