2-7
Cisco 3200 Series Router Hardware Reference
OL-5816-10
Chapter 2 Cisco 3270 Rugged Router Card
Cisco 3270 Rugged Router Card Encryption Module
The integrated security engine (SEC 2.0) is optimized to handle all the algorithms associated with IP
security (IPSec), Secure Sockets Layer (SSL)/Transport Layer Security (TLS), Secure Real-time
Transport Protocol (SRTP), 802.11i, Internet Small Computer System Interface (iSCSI), and Internet
Key Exchange (IKE) processing. The security engine contains four crypto channels, a controller, and a
set of crypto execution units (EUs). The security engine can act as a master on the internal bus. This
allows the security engine to alleviate the data movement bottleneck normally associated with slave-only
cores.
The host processor accesses the security engine through device drivers, using system memory for data
storage. The security engine resides in the peripheral memory map of the processor; therefore, when an
application requires cryptographic functions, it simply creates descriptors for the security engine that
define the cryptographic function to be performed and the location of the data.
The security engine bus-mastering capability permits the host processor to set up a crypto-channel with
a few short register writes, leaving the security engine to perform reads and writes on system memory.

Security Engine Features

The execution units are:
• Public Key Execution Unit (PKEU) supporting the following:
–
RSA and Diffie-Hellman
–
Programmable field size up to 2048 bits
–
Elliptic curve cryptography
• Data Encryption Standard Execution Unit (DEU)
–
DES, 3DES
–
Two key (K1, K2) or Three Key (K1, K2, K3)
–
Electronic codebook (ECB) and cipher-block chaining (CBC) modes for both DES and 3DES
• Advanced Encryption Standard Unit (AESU)
–
Implements the Rinjdael symmetric key cipher
–
Key lengths of 128, 192, and 256 bits
–
ECB, CBC, Counter with CBC-MAC (CCM), and Counter modes
• ARC Four execution unit (AFEU)
–
Implements a stream cipher compatible with the RC4 algorithm
–
40- to 128-bit programmable key
• Message Digest Execution Unit (MDEU)
–
SHA-1 with 160-bit or 256-bit message digest
–
MD5 with 128-bit message digest
–
Keyed-Hash Message Authentication Code (HMAC) with either SHA or MD5 algorithm
(HMAC-MD5 or HMAC-SHA)
• Random Number Generator (RNG)