Encrypt one or two 128-bit blocks with a 128-bit key using AES in ECB mode. The key is expanded dynamically in the data plane and can be different for every packet.
Calculate the AES-CMAC of one or two separate 128-bit data blocks and compare to an expected CMAC provided in the packet. If the CMACs do not match the expected values the packet is dropped, otherwise it is forwarded to a port read from the packet header. The AES key expansion and subkey derivation for AES-CMAC are handled by the control plane.
- Lars-Christian Schulz, NetSys Lab OvGU Magdeburg