.webp){kind=small}
Wireline
End-to-End Security
Line-rate Crypto including MACsec and IPsec, plus post-quantum support on Agilex® FPGAs, from access to core, with security you can update in the field.
Security at Every Hop and Every Layer
Encrypted traffic is now the norm, ports are moving to 400G and 800G, and the first post-quantum cryptography (PQC) standards are final. Wireline equipment shipping today has to secure every link at line rate and still take on new algorithms years after it leaves the factory.
Agilex FPGAs put security where the traffic is. MACsec, IPsec and TLS run in the data path at line rate, with Altera MACsec IP and 200G hard AES-GCM engines on select Agilex 7 devices and production IP for Agilex scaling MACsec to 800G and IPsec to 400G. PQC-enabled secure boot on Agilex 3 and Agilex 5 anchors trust in silicon. A new cipher is a bitstream update, not a board respin.
The Challenges, and Why FPGA
The Challenge
Encryption Has to Keep Pace with 400G
Ports are moving from 100G to 400G and 800G. Software crypto and CPU-bound inspection cannot hold line rate or latency at those speeds.
Why FPGA
Crypto in the Data Path
MACsec and IPsec run in programmable logic next to the MAC, encrypting every frame at wire speed with fixed latency and no CPU in the loop.
The Challenge
Post-Quantum Migration Is Underway
NIST finalized the first PQC standards in 2024. Equipment built to last a decade must adopt new key exchange and signatures in the field.
Why FPGA
Crypto Agility by Design
New algorithm, new bitstream, same board. NIST calls FPGAs the exception to fixed-function crypto because they reconfigure after deployment.
The Challenge
Trust Has to Start at Boot and Last a Decade
Rules such as the EU Cyber Resilience Act (CRA) expect secure updates across a product’s life, and trust must exist before any code runs.
Why FPGA
Hardware Root of Trust
The Secure Device Manager verifies firmware and bitstream before the fabric runs. PQC-enabled secure boot ships on Agilex 3 and Agilex 5.
Why Altera
Hard Crypto Where It Pays Off
Select Agilex 7 F- and I-Series devices add 200G hard AES-GCM engines; Altera MACsec IP ships in Quartus® Prime Pro.
Post-Quantum Ready, Shipping Today
PQC-enabled secure boot on Agilex 3 and Agilex 5, with a Quartus Prime Pro 26.1.1 flow, anchors trust for a decade.
One Portfolio, Access to Core
Agilex 3 for 10GbE control, Agilex 5 for 25G access and edge, Agilex 7 for 400G transport: one tool flow, reusable RTL.
An Open Security IP Ecosystem
Partner IP for Agilex covers MACsec to 800G, IPsec to 400G, TLS and PQC key exchange, all in the Altera partner catalog.
Security Architecture
Where MACsec, IPsec, TLS and PQC trust sit in a wireline network
Agilex 7 I-Series FPGA
Hard 400GbE MAC, 116G transceivers, 200G hard AES-GCM cores and Altera MACsec IP on one device: line-rate link encryption for routers, transport and secure gateways, with PCIe 5.0 and CXL to the host.
Agilex 5 FPGA and SoC
Hard 10G and 25GbE MACs, 28G transceivers and PQC-enabled secure boot for PON OLT, access and edge nodes. Add partner MACsec, IPsec or OTNsec IP and run key management on the Arm hard processor.
Agilex 3 FPGA and SoC
Hard 10GbE, PCIe 3.0 and dual Arm Cortex-A55 cores in a package from 12 x 12 mm, with PQC-enabled secure boot, bitstream encryption and PUF key storage for CPE, ONUs and secure line-card control.
Get Started
More Wireline Applications
NFVi
FPGAs bring hardware acceleration to Network Functions Virtualization Infrastructure.
Gateway
FPGAs implement flexible, reconfigurable hardware acceleration for network gateways.
Routing/Switching Overlay
FPGAs power high-speed routing and switching with integrated crypto and memory.
OTN, B100G OTN, and FlexO
FPGA-based Virtual ASSPs for OTN, Beyond-100G, and FlexO transport up to 800G.
Flex Ethernet (FlexE) and MTN
FPGAs implement FlexE and MTN to turn Ethernet into a flexible multichannel link.
Private Line Emulation (PLE)
FPGAs enable bit-level transparent OTN transport over IP and Ethernet networks.
EPON-GPON / 10G / 25-50G PON
FPGAs implement scalable OLT MAC solutions from GPON to 50G Asymmetric PON.
Common Questions
MACsec (IEEE 802.1AE) encrypts Ethernet frames hop by hop between adjacent ports, protecting links such as backhaul, data center interconnect and provider Ethernet. IPsec protects IP packets end to end or between gateways at Layer 3. Agilex FPGAs run both at line rate, so one platform secures link and network layers.
Yes. Agilex 3 and Agilex 5 ship with PQC-enabled secure boot, supported in Quartus Prime Pro 26.1.1. In the data path, PQC key exchange and signature IP for Agilex is available today. Because the fabric is reprogrammable, you can add new algorithms as the standards adapt.
Altera supports its FPGA families for the full lifecycle of a wireline networking program, with key devices committed for availability through at least 2045, alongside ongoing tool and support updates.
Yes. IPsec, TLS and DTLS run in the Agilex fabric at line rate using production IP from Altera partners, with IPsec AES-256-GCM cores scaling to 400G. On select Agilex 7 devices these cores use the hard AES-GCM engine for bulk encryption, and Altera MACsec IP ships in Quartus Prime Pro.
Start with the Agilex 7 I-Series Transceiver Development Kit and the MACsec IP and hard crypto example designs for 100G to 400G links, or an Agilex 5 or Agilex 3 kit to evaluate PQC-enabled secure boot. Then talk to an Altera security expert about mapping your protocols and rates to a device and IP stack.
Select Agilex 7 F-Series and I-Series devices integrate Symmetric Cryptographic Accelerator hard IP: 200G AES-GCM-128/256, AES-XTS and SM4 engines with MACsec, IPsec, GCM and XTS profiles. Agilex 7 M-Series, Agilex 5 and Agilex 3 run crypto in soft logic using Altera or partner IP.