AN2492 Freescale Semiconductor / Motorola, AN2492 Datasheet - Page 34

• Manufacturer Part Number: AN2492
• Description: MPC184 Descriptor Programmers Guide--PCI View
• Manufacturer: Freescale Semiconductor / Motorola

SSLv3.1/TLS1.0 Processing
SSLv3.1/TLS1.0 Processing
10 SSLv3.1/TLS1.0 Processing
The MPC184 is capable of assisting in SSL record layer processing, however, for SSL v3.0 and earlier, this
support is limited to acceleration of the encryption only. The MDEU does not calculate the version of
HMAC required by early versions of SSL. SSLv3.1 and TLSv1.0 use the same HMAC version as IPSec
(specified in RFC2104), which the MPC184 MDEU supports, allowing it to off-load both bulk encryption
and authentication from the host processor.
SSLv3.1 and TLSv1.0 (henceforth, referred to as TLS) record layer encryption/decryption is more
complicated for hardware than IPSec, due to the order of operations mandated in the protocol. TLS performs
the HMAC function first, then attaches the HMAC (which is variable size) to the end of the payload data.
The payload data, HMAC, and any padding added after the HMAC are then encrypted. Parallel encryption
and authentication of TLS records cannot be performed using the MPC184 snooping mechanisms which
works for IPSec.
Performing TLS record layer encryption and authentication with the MPC184 requires two descriptors. For
outbound records, one descriptor is used to calculate the HMAC, and a second is used to encrypt the record,
HMAC, and padding. For inbound records, the first descriptor decrypts the record, while the second
descriptor is used to recalculate the HMAC for validation by the host. With some planning, the user may
create the outbound descriptors and launch them as a chain, leaving the MPC194 to complete the full
HMAC/encrypt operation before signaling DONE. Placing the output from descriptor 1 into the MPC184
on-chip gpRAM, then fetching that data is input for descriptor 2 can provide additional bus bandwidth
savings, and improved system performance. It is anticipated that for inbound records, the MPC184 will
signal DONE after decryption, so that the host can determine the location of the HMAC before setting up
the HMAC validation descriptor.
The following sections provide examples and explanations covering TLS outbound and inbound processing
using dynamic assignment.
10.1 Outbound TLS Descriptor 1
The first descriptor performs the HMAC of the record header and the record payload, as shown in Table 28.
In the example shown, the HMAC is generated using the MD-5 algorithm.
34
Header
LEN_1
PTR_1
LEN_2
PTR_2
LEN_3
PTR_3
LEN_4
PTR_4
LEN_5
Field
MPC184 Descriptor Programmer’s Guide— PCI View
Freescale Semiconductor, Inc.
0x31E0_0010
Value/Type
For More Information On This Product,
Pointer
Pointer
Pointer
Pointer
Length
Length
Length
Length
Length
Table 28. Outbound TLS Descriptor 1
Go to: www.freescale.com
DPD_Type 0001_HMAC_MD-5
Null
Null
Null
Null
Number of bytes of HMAC key to be written to MDEU key register
PCI address of HMAC key
Number of bytes of data to be written to MDEU input FIFO
PCI address of data
Null
Description
MOTOROLA