Overview
MACsec encryption with EAP-TLS secures router-to-router communication by using certificate-based mutual authentication to derive cryptographic keys. These keys are then managed by the MACsec Key Agreement (MKA) protocol to ensure data confidentiality and integrity across Ethernet interfaces.
MACsec encryption using EAP-TLS authentication establishes secure communication between routers by leveraging certificate-based mutual authentication to derive keys for MACsec encryption.
Summary
The key components involved in the process are:
-
Routers (authenticator/supplicant): Systems that perform MACsec encryption and participate in 802.1X authentication, acting as either the authenticator (facilitates authentication) or the supplicant (seeks authentication).
-
Authentication server (RADIUS/Cisco ISE/ACS): An entity that provides authentication services to an authenticator, verifying supplicant credentials and facilitating EAP-TLS communication.
-
Certificate Authority (CA) server: Issues and manages digital certificates used for mutual authentication in EAP-TLS.
-
EAP-TLS (Extensible Authentication Protocol-Transport Layer Security): The authentication method used for mutual authentication between the authentication server and the client (supplicant) using certificates.
-
Master Session Key (MSK): A cryptographic key generated upon successful EAP-TLS authentication.
-
Connectivity Association Key (CAK): Derived from the MSK, this key is used by the MACsec Key Agreement (MKA) protocol.
-
Connectivity Association Key Name (CKN): Derived from the EAP session ID, this name identifies the CAK.
Workflow
These stages describe how MACsec encryption using EAP-TLS authentication works:
- Initiation: A supplicant router initiates 802.1X port-based authentication on a physical Ethernet interface with an authenticator router.
- EAP message exchange: The authenticator router forwards EAP messages between the supplicant and the configured external authentication server (e.g., RADIUS) using EAP as the transport.
- Mutual authentication (EAP-TLS): The authentication server and the supplicant router perform mutual authentication using digital certificates via the EAP-TLS method. This requires both devices to have valid certificates issued by a trusted Certificate Authority.
- Master session key generation: Upon successful EAP-TLS authentication, a Master Session Key (MSK) is generated.
- Key derivation: The MSK is then used to derive the Connectivity Association Key (CAK), and the Connectivity Association Key Name (CKN) is derived from the EAP session ID.
- MACsec Key Agreement (MKA): The derived CAK and CKN are utilized by the MKA protocol to establish and maintain secure MACsec encryption between the routers on the interface.
Result
This process enables robust MACsec encryption between two routers, ensuring data confidentiality and integrity on Ethernet interfaces through secure, certificate-based authentication and automated key management.