802.1AE

MACsec is an IEEE standard (802.1AE) that provides hardware-based, hop-by-hop encryption and security at the Layer 2.

802.1AE Tagging

802.1AE Frame

<---------------------------- Authenticated ----------------------------->
                                   <----------- Encrypted --------------->
+-------+-------+------------------+-------+-------+-------+-------------+-------+-------+
| D_MAC | S_MAC |  802.1AE Header  | 802.1Q|  CMD  | ETYPE |   Payload   |  ICV  |  CRC  |
+-------+-------+------------------+-------+-------+-------+-------------+-------+-------+

• Frames are encrypted and protected with an integrity check value (ICV)
• No impact to IP MTU/Fragmentation
• L2 Frame MTU Impact*: ~ 40 bytes = less than baby giant frame (~1600 bytes with 1552 bytes MTU)

802.1AE Header

+------------------+--------+--------+---------------+---------------+
| MACsec EtherType | TCI/AN |   SL   | Packet Number | SCI(optional) |
+------------------+--------+--------+---------------+---------------+
       0x88e5

MACsec Ethertype is 0x88e5

MACsec Terminology

Acronym	Definition
MKA	MACsec Key Agreement – defined in IEEE 802.1XREV-2010 is a key agreement protocol for discovering MACsec peers and negotiating keys
MSK	Master Session Key, generated during EAP exchange. Supplicant and authentication server use the MSK to generate the CAK.
CAK	Connectivity Association Key is derived from MSK. CAK is a long-lived master key used to generate all other keys used for MACsec.
CKN	Connectivity Association Key Name – identifies the CAK
SAK	Secure Association Key is derived from the CAK and is the key used by supplicant and switch to encrypt traffic for a given session.
KS	Key Server• responsible for selecting and advertising a cipher suite• responsible for generating the SAK from the CAK.

MACsec Key Agreement

The MACsec Key Agreement (MKA) Protocol provides the required session keys and manages the required encryption keys.

MACsec Key Hierarchy