MAC (Layer 2) Security Protocol
MACSec defined by IEEE 802.1AE provides Security at the MAC Layer. This provides a Hop-to-Hop Layer 2 Security and the services provided by MACSec are Confidentiality, Integrity, and Source Authentication. MACSec is used to secure LANs from the attacks of passive wiretapping, Impersonation, and replay attacks. MACsec can also be used to protect non-IP networks. IEEE802.1X defines the key management protocol for MACSec enabled devices.
Benefits or Applications of MACSec include,
• Provides relatively simple to implement security
• Useful to protect non-IP networks where as IPSec allows protection of IP networks only
• Hop-to-Hop Security where as IPSec provides End-to-End Security
IP (Layer 3) Security Protocol
IPSec (IP Security) provides Security at the Network Layer. This uses two protocols Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides proof-of-data origin on received packets, data integrity, and anti-replay protection. ESP provides all that AH provides in addition to data confidentiality. Internet Key Exchange (IKE) is defined as the Cryptographic key management protocol and is used to setup environment for AH and ESP services by negotiating connection parameters.
Benefits or Applications of IPSec include,
• Provides End to End Security
• Mandatory for IPV6 implementations
• Used to implement VPNs
• Transparent to higher layers (above Layer 3) and protects Layer 3 and above layers
Crypto Infrastructure
Our Cryptographic solutions include both Symmetric and Asymmetric Ciphers. Some of the applications that use these include IPSec, SSL/TLS, WLAN WEP WPA, Networking and Storage systems.
Symmetric Ciphers
Symmetric algorithms (also called Private Key) use the same shared secret key for both encrypting and decrypting the data. These engines are available either in flow-through or look-aside architecture.
AES (Advanced Encryption Standard)
• Key sizes of 128, 192, and 256 bits.
• CBC, ECB, CTR, CFB, OFB modes of operation.
• Supports the High performance (Galois/Counter Mode) GCM.
3DES
• FIPS 46-3 standard.
• Optional DES operation support.
• Cipher Block Chaining (CBC), Electronic Codebook (ECB), Counter (CTR), CFB, OFB modes of operation.
RC4
• Rivest Cipher 4 Algorithm
• Widely used stream cipher in Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
• Supports 128b Key
Asymmetric Ciphers
Asymmetric Ciphers (also called Public Key) use two different keys, one for encrypting and one for decrypting. A public key is published to anyone who wants to send a message and a Private/Secret key so that only the intended receiver can decipher the contents.
Our Hardware IP Engines offload computationally intensive portions of the Public Key Ciphers. This reduces the load on the Host and provides significant performance improvements. These are generally used to support public key negotiations and digital signature schemes.
Public Key Accelerator
• Support calculations of complex operations in RSA (Rivest, Shamir, Adelman), DSA (Digital Signature Algorithm), DH (Diffie-Hellman) asymmetric algorithms
• Offload a number of complex mathematical operations such as point multiplication in ECC (Elliptic Curve Cryptography).
Authentication/Hash Engines
Hashing engines are used to provide the Data Integrity and Source Authentication features. The engines take configured length of the data and produce a fixed size Message Digest or Message Authentication Code (MAC).
SHA/MD5 Engine
• Supports MD5, SHA1, SHA256, and SHA 512 Algorithms
• HMAC (Hash Message Authentication Code) for all Authentication Engines.
• HMAC-SHA-1 and HMAC-MD5 are used in IPSec and SSL/TLS protocols.
True Random Number Generator
All the cryptographic algorithms or protocols require random numbers. Random numbers are needed to generate the symmetric keys, public/private key pairs, the Initial Vector (IV), etc. Posedge provides a true random number generator (TRNG) using a non-deterministic source (thermal noise) to enable the complete randomness.
