Keychain

With a keychain, up to 64 PSK entries (keys) can be configured. Each PSK creates a new dedicated MKA session, active for the duration of the key lifetime plus the configured tolerance.

The 7705 SAR can use the keychain for MACsec PSK rotation. A new MACsec container holds the keychain’s key entries, where the PSK CAK and CKN values can be configured as hexadecimal characters. A keychain contains multiple key entries. Each entry is activated at its begin time; it remains valid up to the begin time of the next key entry, plus its own tolerance time.

A MACsec keychain supports the same ciphers as an active PSK. The aes-128-cmac and aes-256-cmac ciphers can be configured per keychain key entry for MACsec.

When a keychain is configured with a MACsec key entry, other key entry types, such as bidirectional, received, or send, can no longer be added to the keychain. All MACsec key entries in the keychain must be removed before using it for other key entry types. Conversely, when a keychain is configured with any bidirectional, received, or send key entries, MACsec key entries can no longer be added. All existing key entries in the keychain must be removed before using it for MACsec.

Only a keychain with at least one MACsec key entry can be assigned to a MACsec static CAK. When a keychain is assigned to a MACsec static CAK, deleting the MACsec key entry is rejected.

MACsec requires a unique CKN for each port. Identical CKNs are not allowed for consecutive keychain entries. Identical CKNs can be programmed on multiple keychains that are used for different MACsec ports.

For example, the following CKN configurations are not be permitted:

  • Port 1/1/1, subport 1 is using keychain 1 and has one entry with CKN “1234”

  • Port 1/1/1, subport 2 is using keychain 2 and also has one entry with CKN “1234”

  • Port 1/1/1, subport 3 is using static CAK PSK 1 that has CKN “1234”

Note: Users must avoid configuring multiple keychains and static CAK PSKs with the same CKN on the same port.