MACsec

An independent clean-room MACsec (IEEE 802.1AE) link-partner Bus Functional Model verifying the catalog’s macsec_node — a genuinely 4-port endpoint (independent rx_in/rx_out decrypt path and tx_in/tx_out encrypt path, each a full valid/ready/last handshake with real backpressure, unlike some sibling IPs’ passive-tap RX), so this BFM drives/drains all four byte streams under real gapped and backpressured timing rather than a register loopback. The hard part of a MACsec VIP is the cryptography: rather than hand-rolling a new, unverified GCM-AES engine in SystemVerilog (two wrong implementations could simply agree with each other) or reaching for a DPI-C bridge, this VIP uses PRECOMPUTED GCM-AES-128 AND (v1.1, 2026-07-11, task #83) GCM-AES-256 test vectors generated OFFLINE, once, by gen_gcm_vectors.py via the Python cryptography library’s AESGCM — a widely audited independent implementation of NIST SP 800-38D, backed by OpenSSL, sharing no code with either aes.sv (the embedded cipher engine macsec_node itself reuses) or macsec_node.sv‘s own microsequencer. A single shared vector-table package (macsec_gcm_vectors_pkg.sv) feeds both the passive protocol checker and the interop testbench, so there is exactly one copy of the reference data, not two that could silently drift apart. macsec_protocol_checker.sv independently reconstructs every frame’s SecTAG (DA/SA/EtherType/TCI-AN/SL/PN) and cross-checks the DUT’s own generated ciphertext/ICV against the matching precomputed vector byte-exact — a genuine, unconditional DUT-output-correctness check on the tx_out (encrypt) side, and an independent auth-pass/auth-fail PREDICTION on the rx_in (decrypt) side (purely from comparing observed bytes against the known-good vector — no side channel from the testbench), cross-referenced by the interop TB against the DUT’s real STATUS.RX_AUTH_FAIL/RX_REPLAY_FAIL/RX_PROTO_ERR. This second-source effort ran clean against macsec_node: 0 checker violations across a full TX-encrypt round trip (immediately decrypted back via RX, byte-exact against the independent reference), an RX-decrypt of an externally/independently-constructed valid frame, a corrupted-ciphertext RX and a corrupted-ICV RX (both AUTH_FAIL, two genuinely distinct corruption sites through the same GCM tag-compare path), an out-of-window-PN RX (REPLAY_FAIL, distinct from AUTH_FAIL), a malformed-SecTAG RX (PROTO_ERR), RX SA-slot rollover onto BOTH configured RX slots, a TX explicit active-SA-slot switch with independently-tracked PN-per-slot, RX_DROP_ON_FAIL=0 “release anyway, flagged” behavior, and (v1.1, task #83) TWO GCM-AES-256 scenarios (PN12/PN13) reconfiguring both SA slots from GCM-AES-128 to GCM-AES-256 mid-run — a realistic key-rollover/cipher-suite-transition shape, not just a fresh unused slot — with no false ASIL-B self-check trip (err_code 1/2/9) at any point. Building this VIP’s own from-scratch RX-out length/content checks also caught a genuine, previously-untested latent RTL issue in macsec_node.sv (RX_DROP_ON_FAIL=0‘s release-anyway path does not reset its own release-byte-index register the way its auth-pass sibling path does, so it can start from a stale index if it follows a prior successful release — macsec_node‘s own native/interop testbenches never exercise RX_DROP_ON_FAIL=0 at all, so this was never previously hit); disclosed as a macsec_node follow-up item, not fixed here (macsec_node is frozen/out of scope for this VIP session). macsec_node itself separately PASSES its own SPFM/LFM formal and FMEDA targets (91.67%/88.84% post-v1.1) and both bmc/prove formal sign-off; its PMHF (1.67×10⁻⁷/h post-v1.1) currently runs over the <1×10⁻⁷/h ASIL-B target — a macsec_node-side FMEDA item, orthogonal to and unaffected by this VIP (VIPs carry no safety numbers of their own in this catalog).

Key Features

• Independent MACsec link-partner BFM: byte-stream SOURCE for rx_in (encrypted frames from the wire) and tx_in (plaintext from the MAC), byte-stream SINK for tx_out and rx_out under real varying backpressure via the registered-capture pattern (never reads DUT output live off the wire from inside a task) — gapped/idle-inserted timing and deliberate frame corruption (bad EtherType, corrupted ciphertext byte, corrupted ICV byte, out-of-replay-window PN) all exercised, not just back-to-back bursts
• Independent GCM-AES-128 AND GCM-AES-256 reference (v1.1, task #83): precomputed vectors from the Python cryptography library’s AESGCM (audited, OpenSSL-backed, NIST SP 800-38D; a 32-byte key selects AES-256 in the SAME library call, no separate reference method), generated offline once and shared via macsec_gcm_vectors_pkg.sv between the checker and the interop TB — no hand-rolled SV cipher, no dependency on aes.sv or macsec_node.sv’s own logic
• Passive protocol checker: from-scratch SecTAG/AAD byte-position decode off the DUT’s real rx_in/rx_out/tx_in/tx_out pins (no code/instance sharing with the BFM) — unconditionally flags a byte-exact ciphertext/ICV mismatch on the DUT’s own tx_out generation against the independent GCM-AES reference, independently predicts rx_in auth-pass/auth-fail purely from wire-observed bytes, and cross-checks rx_out plaintext content + DA/SA pass-through on frames it independently predicts should decrypt cleanly — cipher-width-agnostic (its byte-compare helpers needed NO changes to pick up the new GCM-AES-256 vector rows)
• Directed scenarios cross-checked against the checker’s independent verdict and the DUT’s real STATUS/err_code state: full TX-encrypt round trip decrypted back via RX (byte-exact), RX-decrypt of an externally-constructed valid frame, corrupted-ciphertext and corrupted-ICV RX (both AUTH_FAIL, distinct sites), out-of-window-PN RX (REPLAY_FAIL), malformed-SecTAG RX (PROTO_ERR), RX SA-slot rollover on both configured slots, TX explicit active-SA-slot switch with independent per-slot PN tracking, RX_DROP_ON_FAIL=0 release-anyway behavior, and (v1.1) two GCM-AES-256 round trips reconfiguring both SA slots mid-run — 0 checker violations, no false err_code 1/2/9
• Honestly scoped: inherited directly from macsec_node’s own v1.1 boundary, not a VIP-specific gap — explicit-SCI SecTAG, XPN (802.1AEbw Extended Packet Number), MKA/802.1X key negotiation, and multi-SC are NOT exercised (the paired DUT doesn’t implement them); this VIP’s own test frames additionally use a fixed 32-byte payload throughout (a VIP-level simplification, not a macsec_node limitation — the DUT itself is variable-length up to MAX_FRAME_BYTES)

Standards & Compliance

IEEE 802.1AE (MACsec)

Pairs With

Built to lean against these catalog IPs during integration:

• macsec_node