Decryption Ingress Per-Port Interface Signal Descriptions - 1.0 English

Versal Adaptive SoC Integrated 400G High Speed Channelized Cryptography Engine Subsystem Product Guide (PG372)
Document ID
PG372
Release Date
2024-01-30
Version
1.0 English
Table 1. Decryption Ingress Per-Port Interface Signal Descriptions
Port Name Clock Domain I/O Description
dec_igr_prtif_crypto_auth_only_p0 dec_igr_axis_clk I PortIF Ingress Decryption Authenticate Only: This is the authentication-only control signal for the non-bypass packet which starts on segment 0 or 1. When it is set to 1, the decryption core only performs authentication on the packet. When this signal is not set, both decryption and authentication are performed. This output is only valid during the start of packet for non-bypass packets and its value should be ignored for bypass packets. This signal is valid for MACsec, IPsec, and BulkCrypto modes. This signal must be set to 0 in BulkECB mode.
dec_igr_prtif_crypto_auth_only_p1 dec_igr_axis_clk I PortIF Ingress Decryption Authenticate Only: This is the authentication-only control signal for the non-bypass packet which starts on segment 2 or 3. See description for enc_igr_prtif_crypto_auth_only_p0 for more details.
dec_igr_prtif_crypto_auth_only_p2 dec_igr_axis_clk I PortIF Ingress Decryption Authenticate Only: This is the authentication-only control signal for the non-bypass packet which starts on segment 4 or 5. See description for enc_igr_prtif_crypto_auth_only_p0 for more details.
dec_igr_prtif_crypto_auth_only_p3 dec_igr_axis_clk I PortIF Ingress Decryption Authenticate Only: This is the authentication-only control signal for the non-bypass packet which starts on segment 6 or 7. See description for enc_igr_prtif_crypto_auth_only_p0 for more details.
dec_igr_prtif_crypto_byp_p0 dec_igr_axis_clk I PortIF Ingress Decryption Bypass Enable:

This is the bypass enable signal for the packet which starts on segment 0 or 1. When this signal is set, the packet bypasses the decryption and authentication functions and passes through the decryption core unchanged. The decryption core only samples this input during the start of packet. This signal is valid for all crypto modes.
dec_igr_prtif_crypto_byp_p1 dec_igr_axis_clk I PortIF Ingress Decryption Bypass Enable:

This is the bypass enable signal for the packet which starts on segment 2 or 3. See description for dec_igr_prtif_crypto_byp_p0 for more details.
dec_igr_prtif_crypto_byp_p2 dec_igr_axis_clk I PortIF Ingress Decryption Bypass Enable: This is the bypass enable signal for the packet which starts on segment 4 or 5. See description for dec_igr_prtif_crypto_byp_p0 for more details.
dec_igr_prtif_crypto_byp_p3 dec_igr_axis_clk I PortIF Ingress Decryption Bypass Enable:

This is the bypass enable signal for the packet which starts on segment 6 or 7. See description for dec_igr_prtif_crypto_byp_p0 for more details.
dec_igr_prtif_crypto_cipher_suite_p0[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Ciphersuite Select:

This signal selects the CipherSuite for the packet which starts on segment 0 or 1. The encoding is as follows:

  • 2'h0: GCM-AES-128 (GCM-AES-ESP-128 in IPsec mode)
  • 2'h1: GCM-AES-256 (GCM-AES-ESP-256 in IPsec mode)
  • 2'h2: GCM-AES-XPN-128 (GCM-AES-ESP-ESN-128 in IPsec mode)
  • 2'h3: GCM-AES-XPN-256 (GCM-AES-ESP-ESN-256 in IPsec mode)
The signal also indicates whether or not the Security Association uses 64-bit packet numbering. The decryption block samples this input only during the start of packet. This signal is valid for MACsec, IPsec, BulkCrypto, and BulkECB modes. For BulkCrypto and BulkECB, only values 0 and 1 are supported.
dec_igr_prtif_crypto_cipher_suite_p1[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Ciphersuite Select:

This signal selects the CipherSuite for the packet which starts on segment 2 or 3. For more details, see description for dec_igr_prtif_crypto_cipher_suite_p0[1:0].
dec_igr_prtif_crypto_cipher_suite_p2[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Ciphersuite Select:

This signal selects the CipherSuite for the packet which starts on segment 4 or 5. For more details, see description for dec_igr_prtif_crypto_cipher_suite_p0[1:0].
dec_igr_prtif_crypto_cipher_suite_p3[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Ciphersuite Select:

This signal selects the CipherSuite for the packet which starts on segment 6 or 7. For more details, see description for dec_igr_prtif_crypto_cipher_suite_p0[1:0].
dec_igr_prtif_crypto_conf_offset_p0[5:0] dec_igr_axis_clk I PortIF Ingress Decryption Confidentiality Offset:

This is the byte offset at which the encrypted payload starts for the packet which starts on segment 0 or 1. This signal is only valid for MACsec, BulkCrypto, and BulkECB modes. In MACsec, the offset value specifies the number of bytes after the end of the SecTAG that are only integrity protected and not encrypted. The valid offset values for MACsec are 0, 30, and 50; other values are treated as 0. In BulkCrypto and BulkECB the offset value specifies the number of bytes from the beginning of the packet that are only integrity protected and not encrypted. The valid offset values for BulkCrypto and BulkECB are from 0 to 63. The decryption block samples this input only during the start of packet.
dec_igr_prtif_crypto_conf_offset_p1[5:0] dec_igr_axis_clk I PortIF Ingress Decryption Confidentiality Offset:

This is the byte offset at which the encrypted payload starts for the packet which starts on segment 2 or 3. For more details, see description for dec_igr_prtif_crypto_conf_offset_p0[5:0].
dec_igr_prtif_crypto_conf_offset_p2[5:0] dec_igr_axis_clk I PortIF Ingress Decryption Confidentiality Offset:

This is the byte offset at which the encrypted payload starts for the packet which starts on segment 4 or 5. For more details, see description for dec_igr_prtif_crypto_conf_offset_p0[5:0].
dec_igr_prtif_crypto_conf_offset_p3[5:0] dec_igr_axis_clk I PortIF Ingress Decryption Confidentiality Offset:

This is the byte offset at which the encrypted payload starts for the packet which starts on segment 6 or 7. For more details, see description for dec_igr_prtif_crypto_conf_offset_p0[5:0].
dec_igr_prtif_crypto_icv_p0[127:0] dec_igr_axis_clk I PortIF Ingress Decryption ICV:

This signal indicates the ICV for the ingress packet which ends on segment 0 or 1 in BulkCrypto mode. Byte 0 of the ICV is mapped to bits [127:120] and byte 15 is mapped to bits [7:0] of this signal.

In MACsec and IPsec mode, this port is reused for the following signals for the packet which starts on segment 0 or 1:

Bits [31:0]: MACsec SSCI for extended packet numbering.

Bits [63:32]: Upper 32 bits (bits [63:32]) of the packet number for MACsec and IPsec packets associated with external SAs when extended packet numbering is used.

Bits [95:64]: 32-bit replay window size for MACsec and IPsec for internal SAs.
dec_igr_prtif_crypto_icv_p1[127:0] dec_igr_axis_clk I PortIF Ingress Decryption ICV:

This signal indicates the ICV for the ingress packet which ends on segment 2 or 3 in BulkCrypto mode. Byte 0 of the ICV is mapped to bits [127:120] and byte 15 is mapped to bits [7:0] of this signal.

In MACsec and IPsec mode, this port is reused for the following signals for the packet which starts on segment 2 or 3:

Bits [31:0]: MACsec SSCI for extended packet numbering.

Bits [63:32]: Upper 32 bits (bits [63:32]) of the packet number for MACsec and IPsec packets associated with external SAs when extended packet numbering is used.

Bits [95:64]: 32-bit replay window size for MACsec and IPsec for internal SAs.
dec_igr_prtif_crypto_icv_p2[127:0] dec_igr_axis_clk I PortIF Ingress Decryption ICV:

This signal indicates the ICV for the ingress packet which ends on segment 4 or 5 in BulkCrypto mode. Byte 0 of the ICV is mapped to bits [127:120] and byte 15 is mapped to bits [7:0] of this signal.

In MACsec and IPsec mode, this port is reused for the following signals for the packet which starts on segment 4 or 5:

Bits [31:0]: MACsec SSCI for extended packet numbering.

Bits [63:32]: Upper 32 bits (bits [63:32]) of the packet number for MACsec and IPsec packets associated with external SAs when extended packet numbering is used.

Bits [95:64]: 32-bit replay window size for MACsec and IPsec for internal SAs.
dec_igr_prtif_crypto_icv_p3[127:0] dec_igr_axis_clk I PortIF Ingress Decryption ICV:

This signal indicates the ICV for the ingress packet which ends on segment 6 or 7 in BulkCrypto mode. Byte 0 of the ICV is mapped to bits [127:120] and byte 15 is mapped to bits [7:0] of this signal.

In MACsec and IPsec mode, this port is reused for the following signals for the packet which starts on segment 6 or 7:

Bits [31:0]: MACsec SSCI for extended packet numbering.

Bits [63:32]: Upper 32 bits (bits [63:32]) of the packet number for MACsec and IPsec packets associated with external SAs when extended packet numbering is used.

Bits [95:64]: 32-bit replay window size for MACsec and IPsec for internal SAs.
dec_igr_prtif_crypto_iv_salt_p0[95:0] dec_igr_axis_clk I PortIF Ingress Decryption IV / Salt:

This input is used to provide information that is used for GCM-AES algorithm in various crypto modes for packet that starts on segment 0 and 1.

In BulkCrypto, it represents Initialization Vector (nonce) for the GCM-AES. Byte 0 of the IV is mapped to bits [95:88] and byte 11 is mapped to bits [7:0].

In MACsec mode, this signal represents the 96-bit Salt value for GCM-AES when 64-bit packet numbering is used. Byte 0 of the salt is mapped to bits [95:88] and byte 11 is mapped to bits [7:0]. When 32-bit packet numbering is used with 8-byte SecTAG length, you must provide the value of SCI through bits [63:0] of this signal.

In IPsec mode, bits [95:64] of this signal represent the 32-bit Salt value which is used along with the IV (which is extracted from the ESP packet) to form the nonce value for the GCM-AES algorithm. Byte 0 of the salt is mapped to bits [95:88] and byte 3 is mapped to bits [71:64].

The decryption block only samples this input during the start of packet.
dec_igr_prtif_crypto_iv_salt_p1[95:0] dec_igr_axis_clk I

PortIF Ingress Decryption IV / Salt: This input is used to provide information that is used for GCM-AES algorithm in various crypto modes for packet that starts on segment 2 and 3. See description for dec_igr_prtif_crypto_iv_salt_p0 for more details.
dec_igr_prtif_crypto_iv_salt_p2[95:0] dec_igr_axis_clk I

PortIF Ingress Decryption IV / Salt: This input is used to provide information that is used for GCM-AES algorithm in various crypto modes for packet that starts on segment 4 and 5. See description for dec_igr_prtif_crypto_iv_salt_p0 for more details.
dec_igr_prtif_crypto_iv_salt_p3[95:0] dec_igr_axis_clk I

PortIF Ingress Decryption IV / Salt: This input is used to provide information that is used for GCM-AES algorithm in various crypto modes for packet that starts on segment 6 and 7. See description for dec_igr_prtif_crypto_iv_salt_p0 for more details.
dec_igr_prtif_crypto_mode_p0[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Mode:
This input identifies the crypto algorithm used for port 0. The encoding is as follows:
  • 2'b00 = MACsec
  • 2'b01 = IPsec
  • 2'b10 = BulkCrypto
  • 2'b11 = BulkECB
In fixed port mode, the crypto mode must be fixed for each port and cannot change per packet. You need to flush the port before changing the crypto mode for a port. In channelized mode, the crypto mode is configurable on a per-channel basis using dec_igr_prtif_crypto_mode_p0 (Port 0) input and it must be valid during all calendar entries for each channel. The crypto mode for a channel cannot change without a channel flush in channelized mode. Unlike other prtif signals, crypto mode is not qualified by enc/dec_igr_axis_tvalid_<3-0>, enc/dec_igr_axis_tuser_ena<7-0>, enc/dec_igr_axis_tuser_sop<7-0>, and so on.
dec_igr_prtif_crypto_mode_p1[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Mode:

This input identifies the crypto algorithm used for Port 1 in 100G Fixed Port mode. For more details, see description for dec_igr_prtif_crypto_mode_p0[1:0].
dec_igr_prtif_crypto_mode_p2[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Mode:

This input identifies the crypto algorithm used for Port 2 in 100G or 200G Fixed Port mode. For more details, see description for dec_igr_prtif_crypto_mode_p0[1:0].
dec_igr_prtif_crypto_mode_p3[1:0] dec_igr_axis_clk I PortIF Ingress Decryption Mode:

This input identifies the crypto algorithm used for Port 3 in 100G Fixed Port mode. For more details, see description for dec_igr_prtif_crypto_mode_p0[1:0].
dec_igr_prtif_crypto_replay_prot_en_p0 dec_igr_axis_clk I PortIF Ingress Decryption Replay Protection Enable: This is the replay protection enable signal for the packet that starts on segment 0 or 1. When asserted, this input enables replay protection in IPsec and MACsec modes The decryption block samples this input only during the start of packet. This input is not used in BulkCrypto or BulkECB modes.
dec_igr_prtif_crypto_replay_prot_en_p1 dec_igr_axis_clk I PortIF Ingress Decryption Replay Protection Enable: This is the replay protection enable signal for the packet which starts on segment 2 or 3. See description for dec_igr_prtif_crypto_replay_prot_en_p0 for more details.
dec_igr_prtif_crypto_replay_prot_en_p2 dec_igr_axis_clk I PortIF Ingress Decryption Replay Protection Enable: This is the replay protection enable signal for the packet which starts on segment 4 or 5. See description for dec_igr_prtif_crypto_replay_prot_en_p0 for more details.
dec_igr_prtif_crypto_replay_prot_en_p3 dec_igr_axis_clk I PortIF Ingress Decryption Replay Protection Enable: This is the replay protection enable signal for the packet which starts on segment 6 or 7. See description for dec_igr_prtif_crypto_replay_prot_en_p0 for more details.
dec_igr_prtif_crypto_sa_index_p0[19:0] dec_igr_axis_clk I PortIF Ingress Decryption SA index:

This signal represents the Security Association (SA) Index for the packet which starts on segment 0 or 1. This is provided by the user after processing the header. The SA index values from 0 to 1023 are allocated to internal SAs. The SA index is used as the index to internal tables storing AES keys and statistics/error counters. When the core is configured to support 4 SAs per SC, bits [19:2] represent the SC number; otherwise, bits [19:1] are used as the SC number when the core is configured to support 2 SAs per SC. The decryption block samples this input only during the start of packet. This signal is valid for all crypto modes.
dec_igr_prtif_crypto_sa_index_p1[19:0] dec_igr_axis_clk I PortIF Ingress Decryption SA index:

This signal represents the Security Association (SA) Index for the packet which starts on segment 2 or 3. For more details, see description for dec_igr_prtif_crypto_sa_index_p0[19:0].
dec_igr_prtif_crypto_sa_index_p2[19:0] dec_igr_axis_clk I PortIF Ingress Decryption SA index:

This signal represents the Security Association (SA) Index for the packet which starts on segment 4 or 5. For more details, see description for dec_igr_prtif_crypto_sa_index_p0[19:0].
dec_igr_prtif_crypto_sa_index_p3[19:0] dec_igr_axis_clk I PortIF Ingress Decryption SA index:

This signal represents the Security Association (SA) Index for the packet which starts on segment 6 or 7. For more details, see description for dec_igr_prtif_crypto_sa_index_p0[19:0].
dec_igr_prtif_crypto_spare_in_p0[31:0] dec_igr_axis_clk I PortIF Ingress Decryption Spare Inputs:

These inputs can be used to propagate sideband signals through the decryption pipeline for the packet which starts on segment 0 or 1. The decryption block samples this input during the start of packet. The data on these inputs is carried through the decryption pipeline and delivered on the corresponding spare_out outputs, during the start of packet. This signal is valid for all crypto modes.
dec_igr_prtif_crypto_spare_in_p1[31:0] dec_igr_axis_clk I PortIF Ingress Decryption Spare Inputs:

These inputs can be used to propagate sideband signals through the decryption pipeline for the packet which starts on segment 2 or 3. For more details, see description for dec_igr_prtif_crypto_spare_in_p0[31:0].
dec_igr_prtif_crypto_spare_in_p2[31:0] dec_igr_axis_clk I PortIF Ingress Decryption Spare Inputs:

These inputs can be used to propagate sideband signals through the decryption pipeline for the packet which starts on segment 4 or 5. For more details, see description for dec_igr_prtif_crypto_spare_in_p0[31:0].
dec_igr_prtif_crypto_spare_in_p3[31:0] dec_igr_axis_clk I PortIF Ingress Decryption Spare Inputs:

These inputs can be used to propagate sideband signals through the decryption pipeline for the packet which starts on segment 6 or 7. For more details, see description for dec_igr_prtif_crypto_spare_in_p0[31:0].
dec_igr_prtif_crypto_zlen_p0 dec_igr_axis_clk I PortIF Ingress Encryption Zero-length payload:

This input must be set to 0.
dec_igr_prtif_crypto_zlen_p1 dec_igr_axis_clk I PortIF Ingress Encryption Zero-length:

This input must be set to 0.
dec_igr_prtif_crypto_zlen_p2 dec_igr_axis_clk I PortIF Ingress Encryption Zero-length:

This input must be set to 0.
dec_igr_prtif_crypto_zlen_p3 dec_igr_axis_clk I PortIF Ingress Encryption Zero-length:

This input must be set to 0.
dec_igr_prtif_ext_key_p0[255:0] dec_igr_axis_clk I PortIF Ingress Decryption External GCM-AES Key:

Specifies the GCM-AES key corresponding to the packet which starts on segment 0 or 1 and associated with external SAs (that is, SA index values greater than or equal to 1024). The decryption block samples this input during the start of packet. This signal is valid for all crypto modes. For 256-bit keys, byte 0 is mapped to bits [255:248] and byte 31 is mapped to bits [7:0]. For 128-bit keys, byte 0 is mapped to bits [127:120] and byte 15 is mapped to bits [7:0].
dec_igr_prtif_ext_key_p1[255:0] dec_igr_axis_clk I PortIF Ingress Decryption External GCM-AES Key:

Specifies the GCM-AES key corresponding to the packet which starts on segment 2 or 3 and associated with external SAs. For more details, see description for dec_igr_prtif_ext_key_p0[255:0].
dec_igr_prtif_ext_key_p2[255:0] dec_igr_axis_clk I PortIF Ingress Decryption External GCM-AES Key:

Specifies the GCM-AES key corresponding to the packet which starts on segment 4 or 5 and associated with external SAs. For more details, see description for dec_igr_prtif_ext_key_p0[255:0].
dec_igr_prtif_ext_key_p3[255:0] dec_igr_axis_clk I PortIF Ingress Decryption External GCM-AES Key:

Specifies the GCM-AES key corresponding to the packet which starts on segment 6 or 7 and associated with external SAs. For more details, see description for dec_igr_prtif_ext_key_p0[255:0].
dec_igr_prtif_macsec_sa_in_use_p0 dec_igr_axis_clk I PortIF Ingress Decryption SA inUse Indication:

This input reflects the setting of the inUse flag for the SA associated with the packet that starts on segment 0 or 1. The decryption block samples this input only during the start of packet. This signal is only valid for MACsec mode.
dec_igr_prtif_macsec_sa_in_use_p1 dec_igr_axis_clk I PortIF Ingress Decryption SA inUse Indication:

This input reflects the setting of the inUse flag for the SA associated with the packet that starts on segment 2 or 3. For more details, see description for dec_igr_prtif_macsec_sa_in_use_p0.
dec_igr_prtif_macsec_sa_in_use_p2 dec_igr_axis_clk I PortIF Ingress Decryption SA inUse Indication:

This input reflects the setting of the inUse flag for the SA associated with the packet that starts on segment 4 or 5. For more details, see description for dec_igr_prtif_macsec_sa_in_use_p0.
dec_igr_prtif_macsec_sa_in_use_p3 dec_igr_axis_clk I PortIF Ingress Decryption SA inUse Indication:

This input reflects the setting of the inUse flag for the SA associated with the packet that starts on segment 6 or 7. For more details, see description for dec_igr_prtif_macsec_sa_in_use_p0.
dec_igr_prtif_macsec_validation_mode_p0[1:0] dec_igr_axis_clk I PortIF Ingress Decryption MACsec Frame Validation Mode:

This indicates the frame validation mode for the SA corresponding to the packet which starts on segment 0 or 1. Frame verification in MACsec is subject to the frame validation mode and the replay protection configurations as described in Section 10.6 of the IEEE 802.1AE-2018 standard. The encoding for the frame validation mode is as follows:

  • 2'h0: Disabled Mode. In this mode the decryption block forwards all untagged packets as well as packets failing the ICV check, without flagging an error. The packets are delivered with SecTAG and ICV removed and payload decrypted (if the E bit in the SecTAG is set).
  • 2'h1: Check Mode. In this mode, packets received without a SecTAG are delivered without flagging an error. All packets received with a SecTAG are checked for integrity and confidentiality protection violations, and a violation causes the error indication to be set. Packets are delivered with SecTAG and ICV removed and payload decrypted (if the E bit in the SecTAG is set).
  • 2'h2: Strict Mode. In this mode, all packets received without a SecTAG are flagged with an error. All packets received with a SecTAG and failing the integrity/confidentiality protection check are also flagged. Packets are delivered with SecTAG and ICV removed and payload decrypted (if the E bit in the SecTAG is set).
  • 2'h3: Reserved.

The decryption block samples this input only during the start of packet. This signal is only valid for MACsec mode.
dec_igr_prtif_macsec_validation_mode_p1[1:0] dec_igr_axis_clk I PortIF Ingress Decryption MACsec Frame Validation Mode:

This indicates the frame validation mode for the SA corresponding to the packet which starts on segment 2 or 3. For more details, see description for dec_igr_prtif_macsec_validation_mode_p0[1:0].
dec_igr_prtif_macsec_validation_mode_p2[1:0] dec_igr_axis_clk I PortIF Ingress Decryption MACsec Frame Validation Mode:

This indicates the frame validation mode for the SA corresponding to the packet which starts on segment 4 or 5. For more details, see description for dec_igr_prtif_macsec_validation_mode_p0[1:0].
dec_igr_prtif_macsec_validation_mode_p3[1:0] dec_igr_axis_clk I PortIF Ingress Decryption MACsec Frame Validation Mode:

This indicates the frame validation mode for the SA corresponding to the packet which starts on segment 6 or 7. For more details, see description for dec_igr_prtif_macsec_validation_mode_p0[1:0].
  1. <N> is the port number 0 to 3 and <M> is the segment number 0 to 7.