the message is timestamped on reception versus transmission cTE, due to the difference in time to encrypt a message at one end of the link with the time needed to decrypt it at the other end dTE, due to the difference in time to encrypt and/or decrypt successive messages It is possible to mitigate some of these effects with two-step clocks, but a lot depends on the capab- ilities of the physical electronic part that is doing the encryption (commonly the PHY). Figure 11-17 and Figure 11-18 detail the issues with timestamping when combined with MACsec on both one- step and two-step clocks, respectively. PTP event msg. MACsec On transmission, one-step Where the timestamp clocks must timestamp should ideally be done Transmission before encryption What about the variable delay through the encryption and decryption processes? MACsec PTP event msg. Must timestamp at same Where the timestamp point to reduce asymmetry should ideally be done Reception Figure 11-17 PTP Timestamping Combined with MACsec on One-Step Clocks Problems with the implementation in the one-step clock can be somewhat mitigated by using a two- step clock, whereby the T1 timestamp is returned in the Follow Up message that is sent immedi- ately after the Sync message. This saves the PHY from having to write an accurate time estimate for the time of the transmission before the encryption has taken place. Figure 11-18 illustrates how the process works with a two-step clock. PTP event msg. MACsec Follow_Up PHY detects PTP packet and returns timestamp for Transmission the Follow_U message How does the PHY recognize the PTP messages as they are encrypted? Servo MACsec PTP event msg. PHY detects the PTP message and sends timestamp Reception above the MAC layer Figure 11-18 PTP Timestamping Combined with MACsec on Two-Step Clocks In the two-step clock, the PHY must be able to determine which encrypted packets are PTP mes- sages that need timestamping and share that information with the component that is generating the Follow_Up message. Similarly, on reception