Systems and methods for encryption in optical transport networks may include generating, at a first transponder, multiple encryption keys, each usable to encrypt a data payload in an OTN frame transmitted from the first transponder to a second transponder and storing the keys locally on the first and second transponders. The first transponder may randomly select one of the keys for encrypting a data payload of a given frame and set overhead encryption bits in a preceding frame indicating that the given frame is encrypted and identifying the randomly selected key. The first transponder may encrypt the data payload of the given frame using the randomly selected key prior to transmission. Based on the overhead bits in the preceding frame, the second transponder may decrypt the data payload of the given frame using the randomly selected key. A new key may be randomly selected for each encrypted frame.