Production Specification

07/03/02

B roa dcom Co rpo rat ion

Document

5802-DS03-405-R

associated with a given packet. This implies that for situations where the IPsec explicit IV mode is used, the host CPU must

copy IV material from packet payload to the context structure. If needed, the host may have to perform byte swapping on

the IV to convert between big and little endian.

For IPsec explicit IV packets, cryptoOffset must point to the word following IV material, and the IV must be copied into packet

payload as well as into the context structure. This ensures that the IV is part of the HMAC computation. For IPsec implicit IV

packets, cryptoOffset must point to the first encrypted payload word, and the IV is not part of packet payload, hence is

automatically left out of the HMAC computation.

Key Setup Processing

message. Each entry in the linked list points at a data buffer that contains actual key set up data, a next field that points to

the next descriptor entry in the linked list, and a length field that contains the number of bytes stored in the data buffer.

Unlike IPsec ESP and AH processing, key setup operations do not involve packet fragmentation. The linked list in each set

of key setup is used to access different data needed for key setup computations. For Diffie-Hellman algorithms used in the

IKE protocol, both the public key Y received from a party with whom the secret is shared and its own secret key x are required

to compute the shared secret. In this case, the first entry points to Y data buffer. The second entry in the data buffer points

to a structure that contains the pointer to x data buffer.

Table 7:

Data Buffer Chain Entries

MSB

LSB

31

30

29

28

27

26

25

24

23

22

21

20

19

18

17

16

15

14

13

12

11

10

98765

43210

Data Buffer Address dataAddr

Next entry in linked list of data buffers next

Reserved

Data buffer length dataLen