100G to 800G Layer-2 MACsec Hardware Acceleration

Engineering wire-speed point-to-point and point-to-multipoint Layer-2 Ethernet encryption across optical fiber links.

Why Layer-2 MACsec Outperforms Layer-3 IPsec

While IPsec operates at Layer 3 and introduces packet overhead that can fragment MTU-sensitive payloads, IEEE 802.1AE MACsec encrypts Ethernet frames directly at Layer 2. WanHSM implements dedicated silicon MACsec pipelines that process traffic at line rate (100 Gbps, 400 Gbps, and 800 Gbps) with less than 250 nanoseconds of latency.

Extended Packet Numbering (XPN) for 100G+ Speeds

On a 100 Gbps connection, standard 32-bit packet counters roll over in less than 5 minutes, forcing frequent re-keying. WanHSM implements 64-bit Extended Packet Numbering (XPN) under IEEE 802.1AEbn, allowing continuous, hitless operation for decades without rollover exhaustion.

Zero Frame Expansion: Preserving MTU sizes and eliminating packet fragmentation overhead across WAN links.
Sub-250ns Latency: Dedicated pipelined AES-GCM engines adding imperceptible delay to high-frequency network traffic.
Extended Packet Numbering (XPN): 64-bit sequence counters preventing packet counter exhaustion on multi-gigabit links.
Optical Tap Detection: Continuous monitoring of optical power levels to detect fiber-bending surveillance attempts.

Domains ansehen