According to IEEE 802.1X-2010 the standard for defining MACSec Key agreement protocol Clause 9.6, that's how the key-server decides to use MACSec or no.
Each participant advertises whether it is capable of using MACsec, and whether it requests MACsec protection of any communication through the Controlled Port of a SecY. The Key Server decides whether all, or none, of the participants in the CA should use MACsec to protect transmit frames; thus guarding against partial connectivity within the CA.
To my understanding Each participant advertises its desire to use MACSec and MACSec ability by encoding them in Basic parameter set in EAPoL-MKA frame that sent every 2 seconds.
Q1: It's not clear how a key-server after collecting these info to decide to use or not. Depending on what condition ?
A few scenarios I test
- All participants have the same MACSec capability and MACSec desire set
- All participants have the same MACSec capability and some have MACSec desire cleared
- Few Participants have no or different MACSec capability than majority.
How the key server decide ?
Q2: After decision, how it announces that decisions to other peers in CA ?
Note : If there is any guide or steps that make reading and understanding IEEE 802.1X standard easier, it will be greatly appreciated. :D