Fact-checked by Grok 2 weeks ago

IEEE 802.1AE

IEEE 802.1AE, commonly known as MACsec (Media Access Control Security), is an IEEE standard that defines a protocol for providing point-to-point security on Ethernet links within local and metropolitan area networks (LANs and MANs).^[1] It ensures data confidentiality, frame integrity, and data origin authenticity for all traffic over the link using the MAC service, operating transparently to higher-layer protocols without requiring changes to existing network applications.^[2] The standard employs the Galois/Counter Mode (GCM) with Advanced Encryption Standard (AES) cipher suite, specifically GCM-AES-128, to encrypt and authenticate Ethernet frames, supporting line-rate performance on high-speed interfaces from 1 Gbps to 100 Gbps and beyond.^[3] Developed by the IEEE 802.1 working group, IEEE 802.1AE was first published in 2006 to address the need for Layer 2 security in Ethernet networks, particularly for securing communications over publicly accessible media where higher-layer security like IPsec might introduce latency or overhead.^[1] Subsequent revisions and amendments have enhanced its capabilities: the 2011 amendment (IEEE 802.1AEbn-2011) introduced support for GCM-AES-256, the 2013 amendment (IEEE 802.1AEbw-2013) added extended packet numbering for better scalability, while the 2018 revision (IEEE 802.1AE-2018) incorporated these updates, clarified specifications, and improved interoperability.^[4] A 2020 corrigendum (IEEE 802.1AE-2018/Cor 1-2020) addressed minor technical corrections, and a 2023 amendment (IEEE 802.1AEdk-2023) added MAC privacy protection features to enhance user anonymity.^[1] MACsec integrates with the IEEE 802.1X port-based network access control framework through the MACsec Key Agreement (MKA) protocol, which enables secure key distribution and peer authentication among devices on the same LAN segment.^[2] This allows for dynamic key management, where a Key Server is elected to distribute Connectivity Association Keys (CAKs) and Secure Channel Keys (SCKs) for session-based encryption.^[5] The protocol supports both static and dynamic configurations, making it suitable for environments requiring hop-by-hop security, such as data centers, enterprise campus networks, and service provider backbones.^[6] In practice, IEEE 802.1AE is widely deployed to protect against threats like eavesdropping, tampering, and unauthorized access at the physical and data link layers, offering lower latency and higher throughput compared to network-layer alternatives.^[3] Its adoption has grown with the proliferation of high-bandwidth Ethernet, ensuring compliance with regulatory requirements for data protection in sensitive applications like financial services and government networks.^[7]

Overview

Purpose and Scope

IEEE 802.1AE, also known as MACsec, defines a protocol that provides connectionless confidentiality, integrity, and authenticity for user data at the media access control (MAC) layer in IEEE 802 local and metropolitan area networks (LANs and MANs).^[1] This standard specifies mechanisms to secure communications transparently to peer protocol entities that utilize the MAC service, ensuring protection without altering higher-layer operations.^[1] The scope of IEEE 802.1AE is confined to hop-by-hop or point-to-point security within IEEE 802 LANs, applying protections between network points where frames are transmitted and received, while explicitly excluding end-to-end security or safeguards at higher protocol layers.^[8] It operates within the broader IEEE 802.1 security architecture, complementing standards like IEEE 802.1X for port-based access control.^[1] The primary goals of the standard include safeguarding Ethernet frames against eavesdropping by encrypting payload data, preventing tampering through integrity checks, and verifying data origin authenticity to block unauthorized access on shared media environments.^[1] These protections address fundamental vulnerabilities in traditional Ethernet, where frames lack inherent security features.^[3] This development was driven by the rapid expansion of Ethernet networks in the 2000s, as enterprises and service providers increasingly deployed LANs in diverse and potentially untrusted settings, exposing unsecured frames to passive and active threats on shared infrastructures.^[3]

Key Features

IEEE 802.1AE, known as MACsec, employs a hop-by-hop security model that secures Ethernet links between adjacent nodes, enabling per-link encryption and protection while allowing data to traverse multi-hop networks without compromising end-to-end connectivity. This approach ensures that security is applied segmentally, transparent to higher-layer protocols and existing network topologies, such as bridged LANs and VLANs.^[4] At the frame level, MACsec delivers comprehensive protections including confidentiality through encryption of user data, integrity via authentication tags that detect tampering, and origin authenticity enforced by secure associations between communicating entities. These mechanisms safeguard against threats like data modification, spoofing, and unauthorized access, with mandatory integrity checks and optional encryption modes to balance security and performance.^[4] The standard maintains backward compatibility with non-MACsec devices by supporting selective enabling on network ports, utilizing controlled ports for secured traffic and uncontrolled ports for legacy or unsecured flows, thus integrating seamlessly into mixed environments without requiring full network overhauls.^[4] Overhead is minimized through in-line processing at wire speed, adding only a security tag and integrity check value to frames—typically 16 octets for the latter—while preserving bandwidth efficiency across speeds from 1 Mb/s to 100 Gb/s and avoiding significant latency in high-throughput scenarios.^[4] MACsec supports both unicast and multicast traffic within defined secured domains, accommodating diverse flows such as time-sensitive streams and standard data, while upholding quality of service parameters like VLAN priorities. It briefly integrates with key agreement protocols, such as those from IEEE 802.1X, to establish secure associations dynamically.^[4]

History

Initial Development

The development of IEEE 802.1AE, known as MACsec, originated in the early 2000s within the IEEE 802.1 Working Group to address critical security gaps at Layer 2 of the Ethernet protocol stack. In November 2002, the IEEE 802 Executive Committee approved the formation of the Link Security Executive Committee Study Group (ECSG) to investigate security enhancements for local and metropolitan area networks (LANs/MANs), particularly in response to vulnerabilities in bridged Ethernet environments where unauthorized access could lead to data interception or network disruption.^[9] This initiative was driven by industry demands for robust protection in secure LANs, as cyber threats such as eavesdropping and man-in-the-middle attacks on wired networks escalated amid the growing adoption of Ethernet in enterprise and service provider infrastructures.^[10] The ECSG's charter emphasized developing protocols for data confidentiality and integrity without altering existing MAC services, paving the way for the project's transition to the full IEEE 802.1 Working Group in March 2003.^[9] Key contributors to the standard included members of the IEEE 802.1 Working Group, with Allyn Romanow and Mick Seaman serving as primary editors, guiding the technical specifications through collaborative efforts involving industry stakeholders from networking equipment vendors and service providers.^[11] The motivations for IEEE 802.1AE stemmed from the shortcomings of higher-layer security protocols like IPsec, which operate at Layer 3 and introduce software-based processing overhead that compromises low-latency requirements in high-speed Ethernet networks.^[12] In contrast, MACsec was designed to enable hardware-accelerated encryption at line rates, ensuring minimal impact on performance for mission-critical applications such as financial trading or industrial control systems.^[13] This focus addressed the need for hop-by-hop protection in Ethernet switches and bridges, where IPsec's end-to-end model proved inefficient for intra-domain traffic.^[14] Drafting milestones began with the approval of the Project Authorization Request (PAR) on September 11, 2003, formalizing the scope to develop MAC security protocols for IEEE 802 LANs.^[15] The first draft, IEEE Std 802.1AE/D1, was released on November 10, 2003, and published by ANSI/IEEE on December 9, 2003, outlining initial mechanisms for frame protection.^[10] Subsequent iterations progressed through 2004 and 2005, incorporating feedback from working group meetings and ballot recirculations to refine the protocol's integration with existing Ethernet standards. The initial scope centered on AES-based encryption, specifically using the Galois/Counter Mode (GCM) cipher suite, to secure 802.3 Ethernet frames by providing confidentiality, integrity, and origin authenticity at the MAC layer.^[15] These efforts culminated in the approval of IEEE Std 802.1AE-2006 by the IEEE Standards Board on June 8, 2006, and its publication on August 18, 2006.^[11]

Amendments and Revisions

The IEEE 802.1AE standard has undergone several amendments and revisions to enhance its security capabilities and address evolving network requirements. In 2011, the 802.1AEbn amendment introduced the option for 256-bit keys using the GCM-AES-256 cipher suite, providing stronger encryption for high-security environments beyond the original 128-bit GCM-AES-128 support.^[16] This update improved resistance to brute-force attacks while maintaining compatibility with existing MACsec implementations.^[17] The 2013 802.1AEbw amendment extended packet numbering to 64 bits, introducing cipher suites GCM-AES-XPN-128 and GCM-AES-XPN-256, which allow over 2^64 frames to be protected under a single Secure Association Key without key rotation risks.^[18] This change supported dynamic group key distribution by integrating with the MACsec Key Agreement (MKA) protocol from IEEE 802.1X-2010, enabling scalable secure associations in multi-device networks.^[2] Enhanced replay protection was also incorporated through the extended numbering, preventing frame duplication attacks in high-throughput scenarios. In 2018, IEEE 802.1AE-2018 consolidated the 2006 base standard with amendments 802.1AEbn-2011, 802.1AEbw-2013, and 802.1AEcg-2017 (which added Ethernet Data Encryption devices for provider-edge security), along with minor corrigenda.^[19] This revision standardized extended packet numbering and replay protection across implementations, ensuring consistent confidentiality, integrity, and authenticity for Ethernet frames.^[4] As of November 2025, amendments and maintenance have followed the 2018 revision, including corrigendum IEEE 802.1AE-2018/Cor 1-2020 and the 2023 amendment IEEE 802.1AEdk-2023 adding optional MAC Privacy protection for enhanced anonymity in specific deployments.^[20]^[21] A revision project (P802.1AE-2018-Rev) was approved in September 2025 to update the standard.^[22] These revisions have significantly improved MACsec's scalability for enterprise and data center networks by supporting longer key lifetimes and group communications without frequent rekeying.^[2] Ongoing discussions within IEEE 802.1 working groups explore alignment with quantum-resistant cryptography, such as hybrid key exchanges, to future-proof MACsec against emerging threats, though no such updates are yet standardized.^[23] In 2025, the IEEE 802.1 Working Group approved a project to revise IEEE 802.1AE-2018 (P802.1AE-2018-Rev), with the first draft released in September 2025, aiming to incorporate updates and clarifications.^[24]

Technical Specifications

MACsec Protocol Mechanics

MACsec, defined in IEEE Std 802.1AE, operates at the media access control (MAC) sublayer of the data link layer, providing hop-by-hop security for Ethernet frames by inserting a Security Tag (SecTAG) immediately following the source and destination MAC addresses.^[3]^[5] The SecTAG, which is 8 or 16 bytes in length depending on inclusion of the optional SCI, includes fields such as the EtherType (0x88E5), Tag Control Information (TCI) with Association Number (AN), Short Length (SL), Packet Number (PN), and Secure Channel Identifier (SCI), enabling frame authentication, integrity protection, and optional confidentiality.^[3] This insertion occurs transparently to higher-layer protocols, ensuring that MACsec secures all traffic without altering upper-layer payloads.^[25] Security Associations (SAs) form the core of MACsec's operational framework, established on a per-port basis to define secure channels between communicating stations. Each SA is uniquely identified by a Secure Association Identifier (SAI), which consists of the Secure Channel Identifier (SCI) and Association Number (AN). The SCI comprises the MAC address and port identifier of the transmitting station. Secure channels within the same Connectivity Association (CA) share the same Connectivity Association Key (CAK).^[5]^[25] Up to multiple SAs can be active per port, allowing for load balancing and failover, with each SA maintaining its own cryptographic context for frame processing.^[3] During frame transmission, the MACsec entity on the sending station adds the SecTAG to the Ethernet frame, applies integrity protection across the protected data (including the SecTAG and payload), and optionally encrypts the payload before forwarding the frame to the physical layer for transmission.^[3]^[26] On the receiving station, the process reverses: the MACsec entity validates the frame's integrity using the included Integrity Check Value (ICV), checks for replay, decrypts the payload if encrypted, removes the SecTAG, and passes the validated frame to higher layers if successful.^[5]^[25] This hop-by-hop mechanism ensures that security is applied link-by-link, with unprotected frames (bypassing MACsec) distinguished by the absence of the SecTAG.^[3] The 2023 amendment (IEEE 802.1AEdk-2023) introduces MAC Privacy protection, an encapsulating protocol used with MACsec to obscure source and destination MAC addresses and pad frame sizes, thereby reducing the ability to correlate traffic with user identities.^[27] Replay protection is enforced through the use of a Packet Number (PN) field within the SecTAG, which increments monotonically for each frame transmitted under an SA. The standard supports a 32-bit PN for basic implementations, with an optional 64-bit extended PN (XPN) variant to accommodate high-speed links and prevent PN exhaustion.^[3]^[5] Receivers maintain a window of acceptable PN values per SA, discarding any frame with a PN outside this window to mitigate replay attacks.^[25] In case of integrity validation failure—such as mismatched ICV or invalid SecTAG—the receiving MACsec entity discards the frame silently to avoid information leakage. Implementations may optionally log such events, distinguishing between secured (protected) and unsecured (unprotected or bypassed) traffic for diagnostics and auditing purposes.^[3]^[5] This error handling ensures robust operation while maintaining performance in secured networks.^[26]

Cipher Suites and Encryption

IEEE 802.1AE, also known as MACsec, employs Galois/Counter Mode (GCM) with the Advanced Encryption Standard (AES) as its core cryptographic mechanism for ensuring frame confidentiality and integrity. The default cipher suite is GCM-AES-128, which utilizes a 128-bit AES key to provide 128-bit security for confidentiality and authentication.^[2]^[28] An optional cipher suite, GCM-AES-256, was introduced in the 2011 amendment (IEEE Std 802.1AEbn-2011) to offer enhanced protection against brute-force attacks through a 256-bit AES key.^[16] Extended variants, GCM-AES-128-XPN and GCM-AES-256-XPN, support 64-bit packet numbering for high-speed links (IEEE 802.1AEbw-2013).^[18] This variant maintains compatibility with the default suite's structure while increasing key length for higher security levels in demanding environments. Both cipher suites append a 16-byte (128-bit) Integrity Check Value (ICV) to secured frames, computed over the frame header (as additional authenticated data, AAD) and the encrypted payload to verify integrity and authenticity.^[2] The encryption operates in counter mode using the AES block cipher, while authentication employs Galois field multiplication via the GHASH function. The ICV is derived using the GHASH function over the additional authenticated data (including SecTAG), the ciphertext (encrypted payload), and bit lengths of these fields, XORed with an encryption of the GCM counter block derived from the IV.^[28] To achieve line-rate processing without performance degradation, implementations typically require hardware acceleration for GCM operations, particularly in high-speed Ethernet links exceeding 10 Gbps.^[3]

Key Management and Agreement

In IEEE 802.1AE, key management relies on the Connectivity Association Key (CAK), a secret root key shared among members of a Connectivity Association (CA) and derived from authentication processes such as those in IEEE 802.1X, which produces a Master Session Key (MSK) from which the CAK is computed. The CAK serves as the foundation for securing the MACsec Key Agreement (MKA) protocol, enabling peer authentication, membership verification, and derivation of operational keys without direct exposure. It is typically 128 or 256 bits long and must be protected, as it authenticates all subsequent key exchanges within the CA.^[29] The MKA protocol, specified in IEEE 802.1X-2010 and refined in subsequent revisions including IEEE 802.1X-2020, operates over EAPOL (Extensible Authentication Protocol over LAN) to facilitate key agreement between MACsec peers. It supports both point-to-point and group connectivity associations, allowing pairwise secure links or multi-device domains where multiple stations share a common security context. In point-to-point mode, MKA establishes a direct association between two peers using a pairwise CAK, suitable for simple link security. Group mode, in contrast, employs a group CAK distributed by an elected key server, enabling shared Secure Associations (SAs) across multiple participants in scenarios like multipoint LANs, with dynamic membership updates handled through the Live Peer List. MKA exchanges use MACsec Key Protocol Data Units (MKPDUs) transmitted at a default interval of 2 seconds, with sessions timing out after 6 seconds of inactivity to ensure liveness and prompt rekeying if needed.^[29] Key derivation in MKA follows NIST SP 800-108, employing a counter mode Key Derivation Function (KDF) based on AES-CMAC as the pseudorandom function to generate session keys from the CAK, ensuring cryptographic strength and resistance to key compromise. The Connectivity Association Key Name (CKN), a 16-octet identifier for the CAK shared across the association, is derived as the first 128 bits of the output from the KDF applied to the MSK:

\text{CKN} = \text{KDF}(\text{MSK}[0\dots15/0\dots31], \text{``IEEE8021 EAP CKN''}, \text{ID} \mid \text{MAC1} \mid \text{MAC2}, 128)

where ID is the EAP Session-ID, and MAC1/MAC2 are peer MAC addresses; for group CAs, the CKN incorporates a random component for uniqueness. From the CAK, additional keys are derived, including the Secure Association Key (SAK) for frame encryption, the Key Encrypting Key (KEK) for protecting MKPDU payloads, and the Integrity Check Key (ICK) for message authentication:

\text{SAK} = \text{KDF}(\text{CAK}, \text{``IEEE8021 SAK''}, \text{KS-nonce} \mid \text{MI-value list} \mid \text{KN}, \text{length})

with similar structures for KEK and ICK using the initial octets of the CKN as context; the key server generates a random nonce and increments the Key Number (KN) per derivation to bind keys to specific sessions. These derivations bind keys to association parameters, preventing reuse across contexts.^[29] To mitigate risks from key exposure or replay attacks, MKA enforces rotation and rekeying of the SAK, triggered primarily by packet number (PN) exhaustion to limit the window for cryptanalysis. Each Secure Association uses a 32-bit PN (or 64-bit in extended modes) that increments per protected frame; rekeying initiates when the PN nears the pending exhaustion threshold (e.g., 0xC0000000 for 32-bit PN, equivalent to approximately 3.2 billion frames), after which a new SAK is derived and distributed via encrypted MKPDUs before the old key is retired (typically after a 3-second delay). Additional triggers include membership changes or expiration of the 6-second MKA lifetime, ensuring on-demand updates; this periodic mechanism bounds exposure to roughly 75% of the PN space per key, supporting high-throughput links without service interruption. In group modes, rekeying synchronizes across all peers via the key server, maintaining shared SAs.^[29]

Connectivity with 802.1X

IEEE 802.1X serves as the foundational authentication mechanism for IEEE 802.1AE by providing port-based network access control through the Extensible Authentication Protocol (EAP), which facilitates mutual authentication between supplicants and authenticators.^[30] Upon successful EAP authentication, 802.1X generates a Master Session Key (MSK), a 64-octet key that is subsequently used to derive the Connectivity Association Key (CAK) via a key derivation function (KDF), typically truncating the MSK to 128 or 256 bits depending on the cipher suite requirements. This CAK establishes the basis for secure key exchange in MACsec, enabling the protocol to bootstrap encrypted and authenticated Layer 2 communications without relying on static configurations.^[31] Following 802.1X authentication success, the MACsec Key Agreement (MKA) protocol, defined within IEEE 802.1X, leverages the derived CAK to form a Connectivity Association (CA) among participating stations.^[30] MKA operates by electing a key server based on priority and transmitting MACsec Key Agreement Protocol Data Units (MKPDUs) every 2 seconds to distribute the Secure Association Key (SAK), which is protected using a Key Encryption Key (KEK) and verified with an Integrity Check Key (ICK) derived from the CAK. This process establishes MACsec Security Associations (SAs) for confidentiality and integrity on point-to-point Ethernet links, with the SAK enabling AES-GCM encryption and authentication.^[32] Re-keying occurs periodically or upon packet number thresholds to maintain security.^[32] In contrast to standalone MACsec deployments that rely on pre-shared static keys for CAK, integration with 802.1X supports dynamic, policy-enforced security associations, enhancing scalability and reducing key management overhead in enterprise environments. Without 802.1X, MACsec can still function using manually configured keys, but this approach is less secure due to the lack of automated authentication and revocation capabilities.^[31] However, 802.1AE itself lacks built-in authentication mechanisms and assumes upstream protocols like 802.1X for key distribution, potentially limiting deployments in environments without an authentication infrastructure.^[4] Enhancements to this integration include support for RADIUS servers to centralize authentication and enforce MACsec policies, such as mandatory encryption (must-secure) or optional (should-secure) modes per port, allowing administrators to apply granular controls via service templates. Local policies can also dictate key server selection and SA establishment, ensuring compliance with network security requirements.

Alignment with 802.1AR and Broader 802.1 Framework

IEEE 802.1AE, known as MACsec, aligns closely with IEEE 802.1AR by leveraging the secure device identity framework it defines, particularly through the use of Initial Device Identifiers (IDevID) and Local Device Identifiers (LDevID). These X.509 certificates, provisioned as per 802.1AR, enable certificate-based authentication and key derivation within the MACsec Key Agreement (MKA) protocol specified in IEEE 802.1X. Specifically, IDevID provides a manufacturer-installed, non-revocable identity for initial trust establishment, while LDevID supports locally managed credentials for ongoing re-authentication and key updates in MKA sessions, ensuring robust device-level security without relying solely on pre-shared keys.^[33] Within the broader IEEE 802.1 framework, MACsec complements IEEE 802.1CB by providing cryptographic protection for frame replication and elimination mechanisms, securing redundant paths against eavesdropping and tampering in time-sensitive networking (TSN) environments. This integration allows replicated frames to maintain integrity and confidentiality across multiple disjoint paths, enhancing reliability without introducing latency from higher-layer security. Additionally, MACsec operates seamlessly with IEEE 802.1Q's VLAN-aware bridging, applying security at the MAC layer to protect inter-VLAN traffic and bridged domains while preserving VLAN tagging and priority handling.^[33]^[34] Architecturally, IEEE 802.1AE fits as a dedicated security sublayer within the IEEE 802.1 model, positioned between the MAC Service interface and internal sublayers as defined in IEEE 802.1AC. This placement enables secure bridging in IEEE 802.1Q-compliant networks, where MACsec entities (SecY and SecTAG) encrypt and authenticate frames transparently to higher-layer protocols, requiring no modifications to existing LAN clients or applications. By operating at this level, MACsec supports hop-by-hop protection in bridged topologies, allowing authorized devices to communicate securely across multi-hop paths without altering upper-layer behaviors.^[33]^[1] MACsec addresses a key limitation in the IEEE 802.1X-2004 security model, which focused on port-based access control and authentication but lacked provisions for data confidentiality and integrity at Layer 2. By adding encryption and frame-level protection, 802.1AE fills this gap, extending 802.1X's authentication outcomes—such as derived session keys—to enable ongoing data security post-access authorization.^[8]^[35] Looking ahead, the IEEE 802.1 Security Task Group has initiated discussions on integrating post-quantum cryptography (PQC) into MACsec and MKA protocols, with efforts underway as of 2025 to develop amendments resistant to quantum threats, ensuring long-term viability within the 802.1 ecosystem.^[36]

Applications and Implementations

Deployment Scenarios

In enterprise local area networks (LANs), IEEE 802.1AE (MACsec) is commonly deployed to secure switch-to-switch links within data centers, providing point-to-point encryption that protects sensitive traffic such as financial data or proprietary information from eavesdropping on internal Ethernet segments.^[3] This approach leverages line-rate encryption at speeds from 1 Gbps to 100 Gbps, ensuring minimal latency and transparency to maximum transmission unit (MTU) sizes without requiring higher-layer overlays like IPsec.^[3] Campus networks utilize MACsec for hop-by-hop encryption across wired Ethernet segments, securing communications between access switches and endpoints while integrating seamlessly with IEEE 802.1X for authentication.^[37] This configuration complements Wi-Fi security protocols by extending Layer 2 protection to wired infrastructure, enabling consistent end-to-end safeguards in educational or corporate environments where devices traverse multiple network hops.^[37] In industrial Internet of Things (IoT) settings, MACsec delivers low-latency security within Time-Sensitive Networking (TSN) ecosystems defined by IEEE 802.1 standards, authenticating frames and preventing interference in real-time control systems like factory automation.^[38] By verifying data origin at the media access control (MAC) layer before processing, it maintains deterministic timing guarantees essential for applications such as robotic coordination or sensor networks.^[38] Service providers deploy MACsec at network edges for point-to-point protection in metro Ethernet services, encrypting customer traffic over E-Line or E-LAN connections while preserving provider tags for routing.^[39] This avoids the computational overhead of IPsec, supporting high-speed links up to 10 Gbps with minimal impact on timing protocols like IEEE 1588v2, ideal for interconnecting enterprise sites or cloud access.^[39] A primary challenge in large-scale MACsec deployments is the complexity of key management across distributed devices, which can lead to scalability issues in coordinating connectivity associations and rekeying.^[40] Solutions often involve centralized controllers that automate policy distribution via protocols such as MACsec Key Agreement (MKA), enabling resilient and low-latency control planes in multi-site networks.^[40]^[41]

Hardware and Software Support

IEEE 802.1AE, known as MACsec, has seen significant hardware implementation in Ethernet switches through application-specific integrated circuits (ASICs) that enable line-rate encryption at speeds including 10, 40, and 100 Gbps. Major vendors such as Cisco and Arista have incorporated MACsec support in their switch portfolios since the early 2010s, with Cisco enabling it on downlink ports in routers and switches via hardware cryptographic implementations and Arista integrating it across series like the 7050X3 and 7280R3 for data center and campus environments.^[42]^[43]^[44] Key semiconductor providers like Broadcom and Marvell offer chips with dedicated acceleration for the Galois/Counter Mode-Advanced Encryption Standard (GCM-AES) cipher suite required by MACsec. Broadcom's BCM82391 and BCM54192 transceivers provide integrated GCM-AES-256 encryption on multiple ports, supporting full IEEE 802.1AE compliance in Gigabit and higher Ethernet applications. Similarly, Marvell's Prestera 98DX73xx and Alaska X 88X22xx series switches and PHYs include GCM-AES-128/256 engines, enabling encryption without compromising port density or power efficiency. By 2020, enterprise-grade equipment from these vendors achieved widespread full compliance, facilitating seamless integration in production networks.^[45]^[46]^[47]^[48] On the software side, open-source implementations leverage the Linux kernel, which added native MACsec support in version 4.6 released in 2016, including the drivers/net/macsec.c module for software-based encryption and hardware offload via device drivers. This allows configuration using tools like iproute2 for key agreement and traffic securing, with offloading to compatible NICs reducing CPU load in virtualized setups. Integration with Open vSwitch is achievable through kernel-level offload in environments using hardware-accelerated bridges, as demonstrated in proof-of-concept deployments for network function virtualization.^[49]^[50]^[51] Performance metrics for MACsec implementations highlight minimal impact on network operations, with typical throughput overhead ranging from 1-5% depending on frame size—around 2.6% for 1500-byte packets due to the 32-40 byte encapsulation—and hardware-accelerated latency additions under 1 μs in modern ASICs, as verified in interoperability tests on high-speed links. These figures ensure line-rate operation without significant degradation, making MACsec suitable for latency-sensitive applications.^[52]^[53] Adoption of MACsec has grown rapidly, with increasing deployment in 5G backhaul and fronthaul networks to secure timing-sensitive traffic like PTP and SyncE, as seen in solutions from providers like Comcores and proof-of-concept deployments by operators like Turkcell integrating it with quantum key distribution (QKD) for quantum-safe enhancements as of June 2025.^[54]^[55] In cloud environments, providers such as Google and Oracle integrate MACsec for dedicated interconnects, ensuring encrypted data paths at scale. Certification through IEEE interoperability tests, conducted by organizations like the University of New Hampshire InterOperability Laboratory (UNH-IOL), validates multi-vendor compatibility and performance.^[56]^[57]

References

[1]
IEEE 802.1AE-2018
Dec 26, 2018 · The standard defines a protocol and management elements, suitable for advertising information to stations attached to the same IEEE 802 LAN, for ...
[2]
802.1AE: MAC Security (MACsec) |
The MACsec Key Agreement Protocol (MKA) specified in IEEE Std 802.1X discovers mutually authenticated MACsec peers, and elects one as a Key Server that ...
[3]
[PDF] MACsec) for Securing High Speed (1-100GE) WAN Deployments
Overview of MACsec. In 2006, 802.1AE was standardized by the IEEE 802.1 working group. 802.1AE-2006 defines Media Access. Control Security, or MACsec, which ...
[4]
802.1AE-2018 - IEEE Standard for Local and metropolitan area ...
Dec 26, 2018 · This standard will facilitate secure communication over publicly accessible LAN/MAN media for which security has not already been defined.
[5]
Understanding Media Access Control Security (MACsec) | Junos OS
Media Access Control security (MACsec) provides point-to-point security on Ethernet links. MACsec is defined by IEEE standard 802.1AE. You can use MACsec in ...
[6]
1. Introduction - Intel
MACsec was standardized in 2006 by the IEEE (standard IEEE 802.1AE-2006) as a point-to-point security protocol providing data confidentiality, integrity, ...<|control11|><|separator|>
[7]
What is MACsec? - Comcores
Media Access Control Security (MACsec) is a layer 2 security protocol standardized by the IEEE that operates on Ethernet frames.
[8]
[PDF] Media Access Control (MAC) Security - IEEE 802
Aug 18, 2006 · Abstract: This standard specifies how all or part of a network can be secured transparently to peer protocol entities that use the MAC ...
[9]
IEEE 802.1AE-2006
MAC security (MACsec) provides connectionless user data confidentiality, frame data integrity, and data origin authenticity. Standard Committee: C/LAN/MAN - LAN ...
[10]
https://www.giac.org/paper/gsec/3562/overview-link-security-protocols-standards/105967
[11]
IEEE 802 Link Security ECSG
On November 15, 2002, the IEEE 802 Executive Committee approved the Link Security Executive Committee Study Group with the following scope and charter:.
[12]
[PDF] An Overview of Link Security Protocols and Standards
Feb 18, 2004 · According to the IEEE 802.1AE draft standard released on November 10 ... 8 IEEE 802.1 Link Security Study Group, June 2003 meeting minutes, Ottawa ...Missing: timeline 2005
[13]
802.1AE-2006: MAC Security (MACsec) |
This standard (MACsec) specifies provision of connectionless user data confidentiality, data integrity, and data origin authenticity by media access ...Missing: development history
[14]
MACsec Explained: Securing Data in Motion (What, How, Why)
Dec 16, 2020 · Scalability: MACsec is very scalable and it can be deployed in different ways compared to other cryptographic protocols such as TLS and IPsec.What's Needed In A Network... · The Advantages Of Macsec · Device-Level Use Cases
[15]
Unlocking the MACsec Puzzle - Ciena
Sep 1, 2021 · Compared to TLS/SSL and IPsec, MACsec provides lower latency as it can start at the header, line rate speeds, and better performance using ...
[16]
[PDF] MACsec for Deterministic Ethernet applications | Comcores
This also ensures that. MACsec is more deterministic than IPsec and TLS and can meet tight latency and jitter requirements at lower data rates. In addition, it.
[17]
802.1AEbn-2011: MAC Security (MACsec)–GCM-AES-256 Cipher ...
IEEE Std 802.1AEbn-2011 is an amendment specifying the GCM-AES-256 Cipher Suite for MAC security, and is available free from the IEEE Get Program.
[18]
https://1.ieee802.org/security/802-1aebw/
[19]
802.1AEbw-2013: MAC Security (MACsec)–Extended Packet ...
802.1AEbw-2013 adds optional cipher suites, allowing up to 2^64 frames to be protected with a single Secure Association Key, easing key agreement for high- ...
[20]
802.1AE-2018: MAC Security (MACsec, Revision of 802.1AE-2006) |
Project History. Project, Revision of IEEE Std 802.1AE-2006 and amendments. PAR, PAR approved September 28th, 2017.Missing: development | Show results with:development
[21]
IEEE 802.1AE-2018/Cor 1-2020 - IEEE SA
Jul 21, 2020 · This amendment to IEEE Std 802.1AS™-2020 specifies protocols, processes, procedures, functions, mechanisms, and managed objects to enable fault- ...
[22]
802.1AEdk: MAC Privacy protection |
Project history. PAR approved February 14th, 2020. See filenames beginning “dk-” in the 2019 and 2020 , 2021 and 2022 802.1 public directories. Dates listed ...
[23]
ae-seaman-post-quantum-notes-0322v0.txt - IEEE 802
The intent is to only update the public key components of the suite with quantum-resistant components." See also below. 802.1AE MAC Security uses symmetric ...
[24]
Securing Ethernet with MACsec Technology | Synopsys IP
Jan 17, 2023 · Compliance with the IEEE 802.1AE standard; Per frame security processing, including encapsulation/decapsulation and frame validation; Scalable ...
[25]
tutorial-Automotive-Ethernet-0717-v02.pdf - IEEE 802
– Distributes/refreshes MACsec data protecting keys (SAKs). • MACsec (802.1AE). – Full rate constant delay (TSN friendly) implementations). – Integrity only ...
[26]
https://grouper.ieee.org/groups/802/802_tutorials/2017-07/tutorial-Automotive-Ethernet-0717-v02.pdf
[27]
IEEE 802.1X-2020
Feb 28, 2020 · This amendment to IEEE Std 802.1AS™-2020 specifies protocols, processes, procedures, functions, mechanisms, and managed objects to enable fault ...
[28]
IEEE Standard for Local and Metropolitan Area Networks--Port ...
Feb 28, 2020 · This standard specifies a common architecture, functional elements, and protocols that support mutual authentication between the clients of ports attached to ...
[29]
[PDF] Overview of IEEE 802.1X-REV Dynamic Session Key Agreement
Some IEEE 802.1X/EAP authentication methods (e.g., EAP-TLS or EAP-FAST) result in a shared key (MSK). ▫ Pair-wise CAK is derived from the MSK. ▫ Group CAK can ...
[30]
https://ieeexplore.ieee.org/document/9018454
[31]
Security Task Group | - IEEE 802.1
It specifies the MACsec Key Agreement (MKA) protocol used by IEEE Std 802.1AE. IEEE Std 802.1AE MAC Security (MACsec) specifies the use of cryptographic ...
[32]
IEEE 802.1CB-2017
Oct 27, 2017 · This standard specifies procedures, managed objects, and protocols for bridges and end systems that provide identification and replication of packets for ...Missing: complements | Show results with:complements
[33]
https://1.ieee802.org/security/
[34]
May 2025 Interim Session in Rennes, France | - IEEE 802.1
5.3 MACsec and Post-Quantum Cryptography. The Security TG Chair led a discussion concerning efforts to start new projects to PQC-protect MACsec and MKA ...
[35]
Securing Enterprise with Catalyst 9000 MACsec Encryption
Jun 27, 2023 · MACsec can be deployed together with 802.1X making it more suitable for campus networks. MACsec can provide secure data transmission on a hop-by ...
[36]
[PDF] TSN – Time Sensitive Networking | IPD
In order to achieve seamless redundancy according to IEEE 802.1CB, the Ethernet frames are replicated at the beginning of a redundant transmission path and then ...
[37]
[PDF] Securing Carrier Ethernet Infrastructure and L2 VPN Services
This white paper describes how Intellisec™, Vitesse's patent-pending implementation of IEEE 802.1AE MACsec encryption, can enhance the security of Carrier ...
[38]
P4sec: Automated Deployment of 802.1X, IPsec, and MACsec Network Protection in P4-Based SDN
Insufficient relevant content. The provided URL (https://ieeexplore.ieee.org/document/10144756) points to a page titled "P4sec: Automated Deployment of 802.1X, IPsec, and MACsec Network Protection in P4-Based SDN," but no full text or detailed content is accessible to extract specific information about key management challenges for MACsec in large-scale deployments or solutions using centralized controllers or automated systems.
[39]
[PDF] MACsec on 400G Links: Hardware Acceleration for Financial Networks
... line-rate stage in the MACsec engine, encryption and decryption of packets can run seamlessly with no impact on forwarding latency. 7.2 Packet processing flow.
[40]
How to Configure WAN MACsec and MKA Support Enhancements
Feb 29, 2016 · The 802.1AE encryption with MACsec Key Agreement (MKA) is supported on downlink ports for encryption between the routers or switches and host ...Missing: hardware ASIC
[41]
Arista 7050X3 Series - Ethernet Switch for Data Center Networks
The 7050X3 MACsec systems utilize proven, standards based encryption technology (IEEE 802.1AE MACsec) to provide secure communication for links between tiers ...Missing: ASIC Cisco
[42]
EOS 4.35.0F - Data Plane Security - Arista
MACsec is based on IEEE 802.1X and IEEE 802.1AE standards. The major benefits of MACsec include the following: MACsec supports packet authentication by ...
[43]
BCM82391 - Broadcom Inc.
The Broadcom BCM82391 is a single-chip low-power, high-density PHY integrating IEEE 802.1AE MACSec GCM-AES-256b encryption, IEEE 1588 and retimer functions.
[44]
BCM54192 - Broadcom Inc.
The Broadcom® BCM54192 is a fully integrated octal Gigabit transceiver with standard compliant IEEE 802.1AE MACsec functionality on all eight ports.
[45]
[PDF] Marvell® Prestera® 98DX73xx Ethernet Switches
• Investment protection to support future use cases. • Media Access Control Security (MACsec) Engine. • IEEE 802.1AE GCM-AES-128/256 and GCM-AES-. XPN-128/256 ...
[46]
[PDF] Marvell® Alaska® X 88X2222M and 88X2242M Product Brief
• Synchronous Ethernet support. • MACSec function – Full 802.1ae compliance supporting default cipher suite GCM-AES-128. • MACSec features include encryption ...
[47]
Linux_4.6 - Linux Kernel Newbies
May 15, 2016 · 802.1AE MAC-level encryption (MACsec). This release adds support for MACsec IEEE 802.1AE, a standard that provides encryption over ethernet.
[48]
Network traffic encryption in Linux using MACsec and hardware ...
Feb 1, 2019 · MACsec offloading devices aren't currently supported in the Linux kernel and no generic infrastructure is available to delegate MACsec ...
[49]
MACsec configuration using iproute2
This is how configure the MACsec IEEE 802.1AE using linux standard toolkit iproute2 . Unlike a RFC, the IEEE 802.1AE is a technical standard. MACsec was ...
[50]
MACsec performance - Cristian Sirbu
The facts: for point-to-point direct links, enabling MACsec adds 1-3 µs of latency and the encapsulation adds about 40 extra bytes. This is done at Layer2 so ...Missing: 1-5% <1us
[51]
[PDF] EANTC-Marketing-Report-ADVA-SecurityPerformanceTest.pdf
The vendor expected to measure an added latency of less than 1 microsecond; the actual results met and exceeded the expectations. Concurrent Secure Flows. The ...
[52]
Turkcell assesses mobile network readiness to resist attacks by ...
Jun 26, 2025 · MACsec is defined by IEEE standard 802.1AE. By implementing AES in silicon, network devices can offload cryptographic tasks from software ...
[53]
MACsec solution for 5G transport network security is available
There is an increasing interest in MACsec protocol as a security solution to protect 5G infrastructure networks such as the O-RAN Fronthaul. To enable customers ...<|control11|><|separator|>
[54]
MACsec for Cloud Interconnect overview
MACsec for Cloud Interconnect helps you secure traffic on Cloud Interconnect connections, specifically between your on-premises router and Google's edge ...
[55]
Our Layer 2 Testing Services | InterOperability Laboratory - UNH-IOL
Our Bridge Functions Testing Service examines interoperability and conformance of Ethernet bridges/switches to IEEE 802.1 protocols.