MACsec IP Cores Provide Secure Device Communciation for ASICs and FPGAs
Xiphera’s MACsec IP cores secure Ethernet links between two connected devices, safeguarding the confidentiality, integrity and authenticity of transmitted data up to hundreds of gigabits per second. The solutions are implemented in pure hardware logic, with no CPU or software. The same core applies to both ASIC and FPGA designs.
What is MACsec?
MACsec (Medium Access Control Security) encrypts data on the link between two connected Ethernet devices. The connection can be a wired or wireless point-to-point connection, for example between a modem and a concentrator. If someone taps that link and can see every bit crossing it, they still learn nothing as the traffic is encrypted with AES-256-GCM. All they capture is noise.
The protocol name points to where MACsec operates. In the OSI model (Open Systems Interconnection), the lower you go, the more concrete things become: layer 1 is the physical medium (the copper and fibre) and layer 2 is the Ethernet layer itself, the Medium Access Control (MAC) layer. MACsec operates at layer 2, encrypting the Ethernet frames themselves. That makes it a low-level protocol that protects the link directly, beneath the applications and routing above it.
Why MACsec belongs in hardware
Encrypting Ethernet at hundreds of gigabits per second is not something a CPU can do while keeping up with the line speed. Xiphera’s MACsec IP cores are pure register-transfer-level (RTL) logic. No CPU or software running inside the core.
As a result, there is no software attack surface and no firmware to patch, which minimises risk and makes designs easier to certify. The latency is low and deterministic, because the datapath is fixed logic rather than software scheduling. And the same core runs on both ASIC and FPGA. A design can start on an FPGA at low volumes and move to an ASIC for cost at scale, without re-engineering the security. The AES-256-GCM engine at the heart of the core is CAVP-validated.
Product brief
Learn more about the key features and functionalities of the MACsec IP cores.
Resource sheet
Download the resource sheet to learn more about the FPGA and ASIC resource requirements and performance.
Xiphera's MACsec IP cores
Core features:
- Encrypts every frame with AES-256-GCM, compliant with IEEE 802.1AE-2018
- Pure hardware logic — no CPU or software components
- High throughput, up to hundreds of Gbps
- Low, deterministic latency
The same vendor-agnostic core for both FPGA and ASIC - Optimised, efficient resource usage
- Straightforward integration
- Accepts data on every clock cycle
Choosing your MACsec core
Three cores to choose from to match your application:
Balanced
The most compact option, for throughput in the low single-digit Gbps. Best where footprint and cost matter most.
High-speed
For tens of Gbps, with a 128-bit data interface.
Extreme-speed
For hundreds of Gbps, with a wider 256-bit or wider data path.
Faster cores use more chip area, so the right choice is the one that meets your line rate without over-provisioning.
Where MACsec is used
Data-centre interconnect
For example, when a data centre is mirrored to a backup site in another location, the fibre between them carries everything — often a link of hundreds of gigabits per second. MACsec encrypts that traffic so that tapping the fibre reveals nothing, without slowing the link.
Telecommunications infrastructure
Modern mobile networks (5G and 6G) increasingly divide the base station into separate components connected over physical links. Those interfaces are a strong fit for MACsec, which can secure each physical link at line rate.
Robotics and high-volume sensor data
Advanced robots generate enormous streams of sensor data, often tens of gigabits per second flowing into a central processor. That traffic frequently needs its integrity and authenticity protected to guarantee it has not been altered. MACsec provides exactly that assurance on the link, with optimised latency for reliable responses.
Automotive Ethernet
Vehicles move large volumes of data between systems in a similar, sensor-heavy pattern, and in-vehicle Ethernet is a growing application for link-layer encryption.
MACsec and quantum key distribution (QKD)
Because MACsec leaves key distribution to the system around it, the shared key can be provided by a conventional key-exchange protocol or by quantum key distribution (QKD). QKD solves the key-exchange problem using quantum technology, so both ends hold the same key and MACsec then performs the high-speed encryption of the link with that key, in proven semiconductor logic.
Why customers choose Xiphera's MACsec solutions
MACsec is chip-level security and it matters who builds it. Every Xiphera core is designed in-house in Finland to the applicable standards. The engineering team behind the MACsec core works directly with our customers to integrate and optimise the core to their designs.
As the same core runs on both FPGA and ASIC, customers can prototype and ship on FPGA at low volumes and move to ASIC at scale with one security implementation across both.
Whether you are protecting a data-centre interconnect, a telecom fronthaul, or a high-volume sensor link, our cryptography engineers can help you choose and integrate the right core — and you can evaluate it against your own throughput and resource targets before committing.
MACsec, IPsec or TLS — which do you need?
MACsec secures a single point-to-point link between two directly connected devices. IPsec and TLS secure traffic across multiple hops in connections that pass through intermediate nodes, or that fan out to many endpoints.
MACsec is more straightforward to implement and less expensive than the multi-hop protocols, with less complexity in the design. IPsec and TLS also include key exchange as part of their standards; MACsec does not (more on that below). If your requirement is to protect a specific physical link at line rate, MACsec is usually the most efficient choice.
For security needs beyond link-layer encryption, Xiphera provides security components such as AES-GCM, IPsec and TLS 1.3 protocol cores, and post-quantum cryptography for quantum-safe key establishment.
MACsec — frequently asked questions
What is MACsec?
MACsec (IEEE 802.1AE) encrypts data at the Ethernet layer on the link between two connected devices. Anyone tapping the link sees only encrypted traffic. Xiphera implements MACsec in pure hardware with AES-256-GCM.
What is the difference between MACsec, IPsec and TLS?
MACsec secures a single point-to-point link; IPsec and TLS secure traffic across multiple hops or clients. MACsec is simpler, lower-level, and more efficient when the job is to protect one physical link at line rate.
Does Xiphera's MACsec handle key distribution?
No, and that is by design. The core implements the encrypted data path as specified in IEEE 802.1AE; how both ends obtain the shared key is handled by your system.
Does it run on FPGA or ASIC?
Both. The same core runs on either, so you can start on FPGA and move to ASIC at scale, with one security implementation.
How fast is it?
From a few Gbps (Balanced) to hundreds of Gbps (Extreme-speed), with low, deterministic latency. The right core depends on your target line rate.
Is it validated?
MACsec itself is a protocol, so it cannot be validated through the CAVP (Cryptographic Algorithm Validation Program) as that applies to algorithms. The underlying AES-256-GCM algorithm is CAVP-validated.
Can you provide an asymmetric (different upstream/downstream) configuration?
An asymmetric implementation is available. Talk to us about your requirements.