Repository navigation
MACsec
MACsec is an IEEE standard (802.1AE) that provides hardware-based, hop-by-hop encryption and security at the Layer 2.
802.1AE Frame
<---------------------------- Authenticated ----------------------------->
<----------- Encrypted --------------->
+-------+-------+------------------+-------+-------+-------+-------------+-------+-------+
| D_MAC | S_MAC | 802.1AE Header | 802.1Q| CMD | ETYPE | Payload | ICV | CRC |
+-------+-------+------------------+-------+-------+-------+-------------+-------+-------+
- Frames are encrypted and protected with an integrity check value (ICV)
- No impact to IP MTU/Fragmentation
- L2 Frame MTU Impact*: ~ 40 bytes = less than baby giant frame (~1600 bytes with 1552 bytes MTU)
802.1AE Header
+------------------+--------+--------+---------------+---------------+
| MACsec EtherType | TCI/AN | SL | Packet Number | SCI(optional) |
+------------------+--------+--------+---------------+---------------+
0x88e5
MACsec Ethertype is 0x88e5
| Acronym | Definition |
|---|---|
| MKA | MACsec Key Agreement – defined in IEEE 802.1XREV-2010 is a key agreement protocol for discovering MACsec peers and negotiating keys |
| MSK | Master Session Key, generated during EAP exchange. Supplicant and authentication server use the MSK to generate the CAK. |
| CAK | Connectivity Association Key is derived from MSK. CAK is a long-lived master key used to generate all other keys used for MACsec. |
| CKN | Connectivity Association Key Name – identifies the CAK |
| SAK | Secure Association Key is derived from the CAK and is the key used by supplicant and switch to encrypt traffic for a given session. |
| KS | Key Server • responsible for selecting and advertising a cipher suite • responsible for generating the SAK from the CAK. |
The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys.
