TX Secure Channels

Create TX SC

../../../../_images/txsc_controls.png

Fig. 5.19 TX SC Controls

Click the button Add to create a new TX SC. The following dialog will appear. You should assign an index value to the TX SC. The index value should be unique and in the range of 0-127. The index value will be used as the Port Identifier in the SCI and XPN SSCI.

../../../../_images/txsc_create_dialog.png

Fig. 5.20 TX SC Index Dialog

Important

Since the last byte of the SCI value consistently matches the SC index, it’s recommended to use SC index 0 and 1 with caution. This is due to the following reasons:

  • 00 is reserved for SCB mode only. It is recommended not to be used when the SCI in MACsec is With SCI.

  • 01 is reserved for End Station mode only. It is recommended not to be used when the SCI in MACsec is With SCI

The last two bytes of SCI will be ignored by the traffic generator when the SCI in MACsec is End Station. It will be hardcoded to 00 01.

Remove TX SC

../../../../_images/txsc_controls.png

Fig. 5.21 TX SC Controls

Click the button Remove to remove the selected TX SC.

Load TX SC

../../../../_images/txsc_controls.png

Fig. 5.22 TX SC Controls

You can import a TX SC configuration from a file by clicking the button Load TX Settings. After the loading, the TX SC configuration will be displayed in the TX SC Configuration Grid.

This is useful when you want to copy the TX SC configuration from one port to another port. You can save the TX SC configuration to a file and then load it to another port.

Save TX SC

../../../../_images/txsc_controls.png

Fig. 5.23 TX SC Controls

You can save the TX SC configuration to a file by clicking the button Save Settings. The TX SC configuration will be saved to a file with the extension .txsc.

This is useful when you want to copy the TX SC configuration from one port to another port. You can save the TX SC configuration to a file and then load it to another port.

TX SC Configuration

../../../../_images/port_txsc_config_grid_1.png

Fig. 5.24 TX Secure Channel Configuration Grid

../../../../_images/port_txsc_config_grid_2.png

Fig. 5.25 TX Secure Channel Configuration Grid (continued)

Each port can have up to 128 TX SCs. They will be listed in the TX SC Configuration Grid. The TX SC Configuration Grid shows the following information for each TX SC:

  • Index: The index of the TX SC

  • Description: The description of the TX SC

  • Cipher Suite: The cipher suite used by the TX SC

    • GCM-AES-128: GCM-AES-128 (IEEE 802.1AE-2018 Clause 14.5) (default)

    • GCM-AES-256: GCM-AES-256 (IEEE 802.1AE-2018 Clause 14.6)

    • GCM-AES-XPN-128: GCM-AES-XPN-128 (IEEE 802.1AE-2018 Clause 14.7)

    • GCM-AES-XPN-256: GCM-AES-XPN-256 (IEEE 802.1AE-2018 Clause 14.8)

  • SCI in MACsec (Mode): The mode of the port’s TX SCI in MACsec.

    • With SCI: With SCI. ES bit is cleared. The SCI value will be present in the packet header. (Default)

    • End Station: End Station mode. ES bit is set. The last two bytes of SCI will be ignored by the traffic generator and it will be hardcoded to 00 01.

  • SCI Value: The SCI of the port’s TX SC. Default value is port MAC address (6 bytes) + the SC index (2 bytes).

    Note

    The last byte of the SCI value is always the same as SC index and is not allowed to be changed. The second last byte of the SCI value is always 0x00 and is not allowed to be changed.

  • XPN SSCI: The XPN Short SCI of the port’s TX SC when XPN cipher suite is in use. the XPN Short SCI of the TX SC, 32 bits. Default value is 00 00 + the SC index (2 bytes) . The SSCI values must be the same for both TX and RX SCs.

  • XPN Salt: the XPN salt of the TX SC, 96 bits. Default value is 00 00 00 00 00 00 00 00 00 00 00 00. The XPN salt values must be the same for both TX and RX SCs.

  • Confidentiality Offset: The confidentiality offset of the port’s TX SC. Default to 0. Allowed values are 0, 30, 50. All the other values will have <NOTVALID> response.

  • Starting PN Value: the starting PN number. Default to 1, maximum 2^64. Allowed to be zero.

  • Starting PN Mode: defining how to continue the TX PN after the start-traffic. Default to Continue.

    • Continue: the TX PN continues with the last transmitted value at each start-traffic.

    • Reset: the TX PN is reset to start at each start-traffic.

  • Rekey Mode: defines when to switch to the next SAK. Default to PN Exhaustion.

    • PN Exhaustion: switch when PN is exhausted.

    • Packet Number: switch when the given Packet Number is transmitted.

  • Rekey Packet Number: defines the packet number. This value will be ignored if the Rekey Mode is set to PN Exhaustion.

  • Encryption Mode: the encryption mode. Default to Encrypt Integrity.

    • Encrypt Integrity: MACsec provides both encryption and integrity.

    • Integrity Only: MACsec only provides integrity.

  • SAK Values: the SAK key values of the TX SC. Default to all-zero.

    • The length of the key value should be:

      • 128 bits for GCM-AES-128 and GCM-AES-XPN-128

      • 256 bits for GCM-AES-256 and GCM-AES-XPN-256.

    • The number of keys allowed is:

      • 4 for GCM-AES-128 and GCM-AES-XPN-128

      • 2 for GCM-AES-256 and GCM-AES-XPN-256.

TX Statistics

The TX statistics are displayed under Port Statistics. Go to MACSec TX Statistics.