PRODUCTS

wolfMKA is a portable, zero-allocation C library that brings MACsec Key Agreement to embedded switches and network equipment. Unlike Linux-centric MKA daemons, it integrates directly into bare-metal, RTOS, AUTOSAR, and Linux firmware through an abstract SecY interface. MISRA C:2012 conformance, enforced 100% MC/DC coverage, and wolfCrypt’s FIPS 140-3 support demanding security and assurance requirements.

Your switches already do the hard part in silicon. A modern MACsec-capable ASIC encrypts, authenticates, and replay-protects every frame at line rate on the physical layer – no CPU in the data path. But that hardware doesn’t key itself. Before a single protected frame goes out, something has to discover peers, prove liveness, elect a Key Server, and securely distribute and rotate the Secure Association Keys the ASIC programs into its hardware. That something is the MACsec Key Agreement (MKA) state machine, IEEE Std 802.1X-2010, Clause 9. Read the blog to learn more!

If you’d like to evaluate wolfSSL’s preliminary MKA support for your switch platform, please contact us at facts@wolfssl.com.

• Vendor-independent SecY interface for MACsec ASICs, PHYs, and switch SDKs
• ~17 KB code, no-malloc, sub-200 B stack in the embedded profile.
• Supports bare metal, RTOS, AUTOSAR Classic, and Linux
• Zero dynamic allocation with bounded memory and processing
• FIPS 140-3 backed cryptography via wolfCrypt
• MISRA C:2012 conformance with enforced 100% line, decision, and MC/DC coverage
• OPEN Alliance TC17 Automotive MKA profile and AUTOSAR Classic Mka_Ƥ API
• Control-plane and data-plane interoperability tested with wpa_supplicant

• IEEE 802.1X MKA peer discovery and liveness monitoring
• Automatic Key Server election
• Pre-shared CAK provisioning or CAK and CKN derivation from an EAP Master Session Key
• Secure Association Key generation and distribution using AES Key Wrap
• Make-before-break rekeying to maintain protected traffic
• Cipher-suite negotiation and Extended Packet Numbering for high-speed links
• Multiple Connectivity Associations per port
• Distributed CAK and Key Management Domain support
• Secure Channel and Secure Association creation, key installation, and transmit/receive control
• SecY status, MACsec statistics, and hardware-counter access