40G MACsec Encryption in an FPGA

Transcription

1 40G MACsec Encryption in an FPGA Dr Tom Kean, Managing Director, Algotronix Ltd, Calton Road, Edinburgh EH8 8JQ United Kingdom Tel: February

2 MACsec System IEEE 802.1AE Media Access Control Security (MACsec) is a layer 2 security scheme Secures a vulnerable ethernet link transparently to user-level applications Can use IEEE 801.1X-2010 for authentication and key exchange Provides confidentiality and message authentication using AES-GCM algorithm February

3 MACsec Applications MACsec can be applied to any Ethernet network Compatible with encrypted traffic (e.g. IPsec) Applications include EPON routers, enterprise LANs and cloud-based connectivity MAN and defence systems use 256-bit keys (supported by Algotronix) Adds an additional layer of security to military and governmental communications systems Secure data links to embedded systems February

4 Algotronix MACsec History Shipped first AES core in 2004 Shipped AES-GCM for MACSEC at 10G in 2008 Shipped first 1G MACsec version in 2010 Shipped 40G AES-GCM in 2010 Shipped 10G MACsec in 2011 Completing upgrade of MACsec to work at 40G Plan 100G MACsec for late 2012 February

5 MACsec Function Destination Address Source Address Unencrypted payload Encryption Key MACsec Function Destination Address Source Address SecTAG (8 or 16 Bytes) Encrypted payload ICV (16 bytes) February

6 MACsec IP Core Top Level Secure Channel Parameters Controlled Output to System Uncontrolled Output to System Receive Path Input From MAC Controlled Input from System Uncontrolled Input from System Transmit Path Output to MAC Enable Clock Reset Control and Statistics February

7 Secure Channel Unit The Algotronix MACsec core includes on-chip CAMs for fast storage and look-up of keys Keys are 128-bit (standard) or 256-bit (optional) Can support 256 Security Associations (configurable) Key memory is write only from outside the core, to enhance security February

8 AES-GCM Critical part of MACSEC for area and performance Encryption with AES-CTR mode and authentication with GF-HASH Works on 128 bit blocks of data where ethernet works on bytes AES-CTR is iterative, 10 or 14 rounds of processing for each data block. Two overhead encryptions per packet, one overhead GF-HASH operation per packet. February

9 AES-GCM IP Core load_key input_key load_text input text input_text_kind input_text_width input_text_final Pipelined AES 128 bit GF Multiply output_text_valid output text output_text_kind output_text_width output_text_final output_tag_valid load_iv input_iv_and_tag GCM Mode Logic output_tag authentication success start pass_through do_encrypt output_pending advanced_output_valid io_cycle enable clock reset GCM-Control clear February

10 Challenges of AES-GCM at 40Gbit/sec Start with existing AES-GCM 10Gbit design Double clock frequency to 312.5MHz Double number of pipeline stages in AES-CTR Simplify and speed up keyschedule implementation Algebraic manipulation of GF-multiply (feedback loop in GF-Hash makes pipelining difficult) New Karatsuba GF multiplier design to improve speed and area February

11 MACsec Core Area Guidelines 1G 10G 40G Regs Slice LUTs RAM 18ks RAM 36ks Xilinx Virtex bit keys All MACSEC features included Transmit and Receive channel included AES Sboxes implemented in LUTs for 1G and 10G designs Clock frequency is 2x higher for 40G design Guideline only many implementation options are possible February

12 Algotronix MACsec Cores Design scalable from 1G to 10G and 40G Configurable number of Secure Channels Support worst case timing without overrun Portable to all major FPGA families Tier one customers can access our IP through Xilinx VHDL or Verilog source code Comprehensive test bench Cost effective February