Flexible cryptographic architecture in a network device
A network device includes a hardware pipeline to process a network packet to be encrypted. A portion of the hardware pipeline retrieves information from the network packet and generates a command based on the information. A block cipher circuit is coupled inline within the hardware pipeline. The hardware pipeline includes hardware engines coupled between the portion of the hardware pipeline and the block cipher circuit. The hardware engines parse and execute the command to determine a set of inputs and input the set of inputs and portions of the network packet to the block cipher circuit. The block cipher circuit encrypts a payload data of the network packet based on the set of inputs.
1. A network device comprising:
a hardware pipeline to process a network packet to be encrypted, wherein a portion of the hardware pipeline is to retrieve information from the network packet and generate a command based on the information;
a block cipher circuit coupled inline within the hardware pipeline; and
wherein the hardware pipeline comprises a set of hardware engines coupled between the portion of the hardware pipeline and the block cipher circuit, the set of hardware engines to:
parse and execute the command to determine a set of inputs; and
input the set of inputs and portions of the network packet to the block cipher circuit; and
wherein the block cipher circuit is to encrypt a payload data of the network packet based on the set of inputs.
2. The network device of claim 1 , wherein the set of hardware engines is further to determine an encryption offset to a first byte of the payload data within the network packet, and wherein the set of inputs includes the encryption offset.
3. The network device of claim 2 , wherein the set of hardware engines is to determine the encryption offset from a combination of length fields from the network packet.
4. The network device of claim 1 , further comprising an interface coupled to the hardware pipeline and to the set of hardware engines, wherein, to determine the set of inputs, the set of hardware engines is to access the interface based on strings of the command.
5. The network device of claim 1 , wherein the set of hardware engines is further to:
determine a trailer offset, according to a length of the payload data, to a trailer location of the network packet where an integrity check value is to be located, wherein the set of inputs includes the trailer offset; and
wherein the block cipher circuit is further to:
generate the integrity check value to authenticate the payload data; and
append the integrity check value to the network offset according to the trailer offset.
6. The network device of claim 5 , wherein the set of hardware engines is further to one of add or remove additional bytes of data to or from an end of the payload data to provide space for the integrity check value, wherein the hardware pipeline further comprises a post-processing hardware engine to overwrite a trailer of the network packet with the integrity check value.
7. The network device of claim 1 , wherein the set of hardware engines is further to access a pointer to a register from which to retrieve a payload encryption key, the set of inputs includes the pointer, and wherein the block cipher circuit is to encrypt the payload data using the payload encryption key.
8. The network device of claim 1 , wherein the set of hardware engines is further to determine a pointer to a register from which to retrieve a header encryption key, wherein the hardware pipeline further comprises a post-processing hardware engine to encrypt a header of the network packet using the header encryption key, wherein the encrypted header is to provide integrity for the network packet as a whole.
9. The network device of claim 1 , wherein the set of hardware engines is further to:
construct an initialization vector, which is included in the set of inputs, from a combination of a sequence number of the packet, a salt value, and inputs from a header of the network packet; and
determine additional authenticated data, which is included in the set of inputs, as a concatenated stream of bytes selected from at least one of a header of the network packet, a security context, and a set of most-significant bits of the sequence number of the network packet.
10. The network device of claim 1 , wherein the set of inputs are specific to a cryptographic protocol selected from a set of cryptographic protocols.
11. The network device of claim 1 , further comprising a programmable core integrated with the hardware pipeline, wherein a portion of the command is generated based on processing performed by the programmable core.
12. A network device comprising:
a hardware pipeline to process a network packet that is encrypted, wherein the hardware pipeline comprises:
a first portion to decrypt a header of the network packet; and
a second portion to retrieve information from the decrypted header and generate a command based on the information;
a block cipher circuit coupled inline within the hardware pipeline; and
wherein the hardware pipeline comprises a set of hardware engines coupled between the second portion and the block cipher circuit, the set of hardware engines to:
parse and execute the command to determine a set of inputs; and
input the set of inputs and portions of the network packet to the block cipher circuit; and
wherein the block cipher circuit is to decrypt a payload data of the network packet based on the set of inputs.
13. The network device of claim 12 , wherein the set of hardware engines is further to determine a decryption offset to a first byte of the payload data within the network packet, and wherein the set of inputs includes the decryption offset.
14. The network device of claim 13 , wherein the set of hardware engines is to determine the decryption offset from a combination of length fields from the network packet.
15. The network device of claim 12 , further comprising an interface coupled to the hardware pipeline and to the set of hardware engines, wherein, to determine the set of inputs, the set of hardware engines is to access the interface based on strings of the command.
16. The network device of claim 12 , wherein the set of hardware engines is further to:
determine a trailer offset, according to a length of the payload data, to a trailer location of the network packet where an integrity check value is located, wherein the set of inputs includes the trailer offset; and
wherein the block cipher circuit is further to:
retrieve, using the trailer offset, the integrity check value; and
authenticate the payload data based on the integrity check value.
17. The network device of claim 16 , further comprising a trailer removal engine coupled to the block cipher circuit, the trailer removal engine to remove a trailer of the network packet that contained the integrity check value.
18. The network device of claim 12 , wherein the set of hardware engines is further to determine a pointer to a register from which to retrieve a payload decryption key, the set of inputs includes the pointer, and wherein the block cipher circuit is to decrypt the payload data using the payload decryption key.
19. The network device of claim 12 , wherein the set of hardware engines is further to:
construct an initialization vector, which is included in the set of inputs, from a combination of a sequence number of the packet, a salt value, and inputs from a header of the network packet; and
determine additional authenticated data, which is included in the set of inputs, as a concatenated stream of bytes selected from at least one of a header of the network packet, a security context, and a set of most-significant bits of the sequence number of the network packet.
20. The network device of claim 12 , further comprising a programmable core integrated with the hardware pipeline, wherein a portion of the command is generated based on processing performed by the programmable core.
21. The network device of claim 12 , wherein the set of inputs are specific to a cryptographic protocol selected from a set of cryptographic protocols.
22. A method comprising:
processing a network packet, which is to be encrypted, by a hardware pipeline, wherein processing comprises:
retrieving information from the network packet; and
generating a command based on the information;
parsing, by a set of hardware engines of the hardware pipeline, the command to determine a set of inputs;
inputting the set of inputs and portions of the network packet to a block cipher circuit that is positioned inline within the hardware pipeline; and
encrypting, by the block cipher circuit, a payload data of the network packet based on the set of inputs.
23. The method of claim 22 , further comprising determining an encryption offset to a first byte of the payload data within the network packet, wherein the set of inputs includes the encryption offset.