Encryption Ingress Per-Port Interface Signal Descriptions - 1.0 English

This is the authentication-only control signal for the non-bypass packet which starts on segment 0 or 1. When it is set to 1, the encryption core only performs authentication on the packet. When this signal is not set, both encryption and authentication are performed. This input is only valid during the start of packet for non-bypass packets and its value is ignored for bypass packets. This signal is valid for MACsec, IPsec, and BulkCrypto modes. This signal must be set to 0 in BulkECB mode

This signal selects the CipherSuite for the packet that starts on segment 0 or 1. The encoding is as follows:

• 2'h0: GCM-AES-128 (GCM-AES-ESP-128 in IPsec mode)
• 2'h1: GCM-AES-256 (GCM-AES-ESP-256 in IPsec mode)
• 2'h2: GCM-AES-XPN-128 in MACsec mode (GCM-AES-ESP-ESN-128 in IPsec mode)
• 2'h3: GCM-AES-XPN-256 in MACsec mode (GCM-AES-ESP-ESN-256 in IPsec mode)

This signal selects the Cipher Suite for the packet that starts on segment 2 or 3. See description for enc_igr_prtif_crypto_cipher_suite_p0[1:0] for more details.

This signal selects the Cipher Suite for the packet that starts on segment 4 or 5. See decryption for enc_igr_prtif_crypto_cipher_suite_p0[1:0] for more details.

This signal selects the Cipher Suite for the packet that starts on segment 6 or 7. See description for enc_igr_prtif_crypto_cipher_suite_p0[1:0] for more details.

This is the byte offset at which the encrypted payload starts for the packet that starts on segment 0 or 1. This signal is only valid for MACsec, BulkCrypto, and BulkECB modes. In MACsec, the offset value specifies the number of bytes after the end of the SecTAG that are only integrity protected and not encrypted. The valid offset values for MACsec are 0, 30, and 50; other values are treated as 0. In BulkCrypto and BulkECB, the offset value specifies the number of bytes from the beginning of the packet that are only integrity protected and not encrypted. The valid offset values for BulkCrypto and BulkECB are from 0 to 63. The encryption block samples this input only during the start of packet.

PortIF Ingress Encryption Confidentiality Offset:

This is the byte offset at which the encrypted payload starts for the packet that starts on segment 2 or 3. See description for enc_igr_prtif_crypto_conf_offset_p0[5:0] for more details.

This is the byte offset at which the encrypted payload starts for the packet that starts on segment 4 or 5. See description for enc_igr_prtif_crypto_conf_offset_p0[5:0] for more details.

This is the byte offset at which the encrypted payload starts for the packet that starts on segment 6 or 7. See description for enc_igr_prtif_crypto_conf_offset_p0[5:0] for more details.

This is the encryption IV/Salt value for the packet which starts on segment 0 or 1.

In BulkCrypto, the full 96 bits of this signal represent Initialization Vector (nonce) for the GCM-AES algorithm to encrypt the packet. Byte 0 of the IV is mapped to bits [95:88] and byte 11 is mapped to bits [7:0].

In MACsec mode, this signal represents the 96-bit Salt value for GCM-AES when extended packet numbering is used. Byte 0 of the salt is mapped to bits [95:88] and byte 11 is mapped to bits [7:0].

In IPsec mode, bits [63:0] of this signal is the 64-bit IV value which is inserted after the ESP header bytes. Byte 0 of the IV is mapped to bits [63:55] and byte 7 is mapped to bits [7:0]. Further, bits [95:64] of this signal represent the 32-bit Salt value which is used along with the IV to form the nonce value for the GCM-AES algorithm. Byte 0 of the salt is mapped to bits [95:88] and byte 3 is mapped to bits [71:64]. The encryption block only samples this input during the start of packet. This port must be set to 0 in BulkECB mode.

This is the encryption IV/Salt value for the packet which starts on segment 2 or 3. For more details, see description for enc_igr_prtif_crypto_iv_salt_p0[95:0].

This is the encryption IV/Salt value for the packet which starts on segment 4 or 5. For more details, see description for enc_igr_prtif_crypto_iv_salt_p0[95:0].

This is the encryption IV/Salt value for the packet which starts on segment 6 or 7. For more details, see description for enc_igr_prtif_crypto_iv_salt_p0[95:0].

This input identifies the crypto algorithm used for Port 0. The encoding is as follows:

• 2'b00 = MACsec
• 2'b01 = IPsec
• 2'b10 = BulkCrypto
• 2'b11 = BulkECB

This input identifies the crypto algorithm used for Port 1 in 100G Fixed Port mode. For more details, see description for enc_igr_prtif_crypto_mode_p0[1:0].

This input identifies the crypto algorithm used for Port 2 in 100G or 200G Fixed Port mode. For more details, see description for enc_igr_prtif_crypto_mode_p0[1:0].

This input identifies the crypto algorithm used for Port 3 in 100G Fixed Port mode. For more details, see description for enc_igr_prtif_crypto_mode_p0[1:0].

This signal is the packet/sequence number for the packet which starts on segment 0 or 1. In MACsec, this signal represents the Packet Number for the incoming packet. This value is used to compute the Initialization Vector (IV). The lower 32-bit value is also used to form SecTAG. In IPsec, this signal represents the Sequence Number of the packet being transferred which is used to form ESP header. The encryption block only samples this input during the start of packet. In BulkECB mode, bits [31:0] of this input ports are propagated through data path and provided on bits [31:0] of enc_egr_prtif_crypto_icv_p<N> output port during the star of packet cycle. Bits [63:32] must be set to 0 in BulkECB mode. This port must be set to 0 in BulkCrypto mode.

This signal is the packet/sequence number for the packet which starts on segment 2 or 3. For more details, see description for enc_igr_prtif_crypto_pkt_num_p0[63:0].

This signal is the packet/sequence number for the packet which starts on segment 4 or 5. For more details, see description for enc_igr_prtif_crypto_pkt_num_p0[63:0].

This signal is the packet/sequence number for the packet which starts on segment 6 or 7. For more details, see description for enc_igr_prtif_crypto_pkt_num_p0[63:0].

This signal represents the Security Association (SA) Index for the packet which starts on segment 0 or 1. This is provided by the user after processing the header. The SA index values from 0 to 1023 are allocated to internal SAs. The SA index is used as the index to internal tables storing AES keys and statistics/error counters. When the core is configured to support 4 SAs per SC, bits [19:2] represent the SC number; otherwise, bits [19:1] are used as the SC number when the core is configured to support 2 SAs per SC. The encryption block samples this input only during the start of packet. This signal is valid for all crypto modes.

This signal represents the Security Association (SA) Index for the packet which starts on segment 2 or 3. For more details, see description for enc_igr_prtif_crypto_sa_index_p0[19:0].

This signal represents the Security Association (SA) Index for the packet which starts on segment 4 or 5. For more details, see description for enc_igr_prtif_crypto_sa_index_p0[19:0].

This signals represents the Security Association (SA) Index for the packet which starts on segment 6 or 7. For more details, see description for enc_igr_prtif_crypto_sa_index_p0[19:0].

These inputs can be used to propagate sideband signals through the encryption pipeline for the packet which starts on segment 0 or 1. The encryption block samples this input during the start of packet. The data on these inputs is carried through the encryption pipeline and delivered on the corresponding spare_out outputs, during the start of packet. This signal is valid for all crypto modes.

These inputs can be used to propagate sideband signals through the encryption pipeline for the packet which starts on segment 2 or 3. For more details, see description for enc_igr_prtif_crypto_spare_in_p0[31:0].

These inputs can be used to propagate sideband signals through the encryption pipeline for the packet which starts on segment 4 or 5. For more details, see description for enc_igr_prtif_crypto_spare_in_p0[31:0].

These inputs can be used to propagate sideband signals through the encryption pipeline for the packet which starts on segment 6 or 7. For more details, see description for enc_igr_prtif_crypto_spare_in_p0[31:0]

This input is only used in IPsec mode to identify the zero-length payload of an IP packet which starts on segment 0 or 1. You must assert this signal along with SOP, EOP on a single segment to indicate a zero-length IPsec packet. The core then adds the ESP header, ESP trailer, IV, and the ICV to form the ESP packet. This signal should be set to 0 in other crypto modes.

This input is only used in IPsec mode to identify zero-length payload of an IP packet which starts on segment 2 or 3. See description for enc_igr_prtif_crypto_zlen_p0 for more details.

This input is only used in IPsec mode to identify zero-length payload of an IP packet which starts on segment 4 or 5. See description for enc_igr_prtif_crypto_zlen_p0 for more details.

This input is only used in IPsec mode to identify zero-length payload of an IP packet which starts on segment 6 or 7. See description for enc_igr_prtif_crypto_zlen_p0 for more details.

Specifies the GCM-AES key corresponding to the packet which starts on segment 0 or 1 and associated with external SAs (i.e., SA index values greater than or equal to 1024). The encryption block samples this input during the start of packet. This signal is valid for all crypto modes. For 256-bit keys, byte 0 is mapped to bits [255:248] and byte 31 is mapped to bits [7:0]. For 128-bit keys, byte 0 is mapped to bits [127:120] and byte 15 is mapped to bits [7:0].

Specifies the GCM-AES key corresponding to the packet which starts on segment 2 or 3 and associated with external SAs. For more details, see description for enc_igr_prtif_ext_key_p0[255:0].

Key; Specifies the GCM-AES key corresponding to the packet which starts on segment 4 or 5 and associated with external SAs. For more details, see description for enc_igr_prtif_ext_key_p0[255:0].

Key; Specifies the GCM-AES key corresponding to the packet which starts on segment 6 or 7 and associated with external SAs. For more details, see description for enc_igr_prtif_ext_key_p0[255:0].

This input indicates the SA association number within the corresponding SC for the packet which starts on segment 0 or 1. The encryption core only samples this input during the start of packet. This signal is only valid in MACsec mode.

This input indicates the SA association number within the corresponding SC for the packet which starts on segment 2 or 3. See description for enc_igr_prtif_macsec_sectag_an_p0 for more details.

This input indicates the SA association number within the corresponding SC for the packet which starts on segment 4 or 5. See description for enc_igr_prtif_macsec_sectag_an_p0 for more details.

This input indicates the SA association number within the corresponding SC for the packet which starts on segment 6 or 7. See description for enc_igr_prtif_macsec_sectag_an_p0 for more details.

Secure Channel Identifier corresponding to the packet which starts on segment 0 or 1. This value is used by the encryption block to form the SecTAG for the packet. It is also used to compute the Initialization Vector (IV) when the ciphersuite used is GCM-AES-128 or GCM-AES-256. The encryption block samples this input only during the start of packet. This signal is only valid for MACsec mode.

Secure Channel Identifier corresponding to the packet which starts on segment 2 or 3. See description for enc_igr_prtif_macsec_sectag_sci_p0[63:0] for more details.

.

Secure Channel Identifier corresponding to the packet which starts on segment 4 or 5. See description for enc_igr_prtif_macsec_sectag_sci_p0[63:0] for more details.

Secure Channel Identifier corresponding to the packet which starts on segment 6 or 7. See description for enc_igr_prtif_macsec_sectag_sci_p0[63:0] for more details.

The Short Length value used to form SecTAG for the packet which starts on segment 0 or 1. This value specifies the number of bytes between the end of the SecTAG and the start of the ICV, if that number is less than 48. Otherwise, the Short Length value must be set to 0. The encryption block samples this input only during the start of packet.

In IPsec mode, this port is used to pass the value of Next Header field (NextHeader[7:0]) for the ESP trailer.

The Short Length value used to form SecTAG for packet which starts on segment 2 or 3. See description for enc_igr_prtif_macsec_sectag_shortlen_p0[7:0] for more details.

The Short Length value used to form SecTAG for packet which starts on segment 4 or 5. See description for enc_igr_prtif_macsec_sectag_shortlen_p0[7:0] for more details.

The Short Length value used to form SecTAG for packet which starts on segment 6 or 7. See description for enc_igr_prtif_macsec_sectag_shortlen_p0[7:0] for more details.

Short Secure Channel Identifier corresponding to the packet which starts on segment 0 or 1. This 32-bit value is used to construct the Initialization Vector (IV) when the ciphersuite used is GCM-AES-XPN-128 or GCM-AES-XPN-256. The encryption block samples this input during the start of packet. In IPsec mode, this signal specifies the Security Parameters Index (SPI[31:0]) field of the ESP header.

Short Secure Channel Identifier corresponding to the packet which starts on segment 2 or 3. See description for enc_igr_prtif_macsec_sectag_ssci_p0[31:0.] for more details.

Short Secure Channel Identifier corresponding to the packet which starts on segment 4 or 5. See description for enc_igr_prtif_macsec_sectag_ssci_p0[31:0.] for more details.

Short Secure Channel Identifier corresponding to the packet which starts on segment 6 or 7. See description for enc_igr_prtif_macsec_sectag_ssci_p0[31:0.] for more details".

The 6-bit Tag Control Information value used to form the SecTAG for the packet which starts on segment 0 or 1. Bit 0 is the TCI 'C' field and bit 5 is the TCI 'V' field. The core does not check the validity of the TCI fields. The encryption block samples this input only during the start of packet. This signal is only valid for MACsec mode.

The 6-bit Tag Control Information value used to form the SecTAG for the packet which starts on segment 2 or 3. See description for enc_igr_prtif_macsec_sectag_tci_p0[5:0] for more details.

The 6-bit Tag Control Information value used to form the SecTAG for the packet which starts on segment 4 or 5. for more details, see description for enc_igr_prtif_macsec_sectag_tci_p0[5:0].

The 6-bit Tag Control Information value used to form the SecTAG for the packet which starts on segment 6 or 7. See description for enc_igr_prtif_macsec_sectag_tci_p0[5:0] for more details.