C03-RA: Yes
Rationale
With selected SDU encryption active on every normal-DIF adjacency, RMT protects the serialized PDU before passing it to the lower flow. The default crypto policy encrypts the complete PDU buffer after compression, sequence/MAC addition and block padding. Thus normal-DIF address, CEP, QoS, type and control fields are not available in cleartext to a passive link observer without the keys.
Assessment method
Pinned serialization/protection source trace; passive observation boundary; no runtime capture
Source context
IRATI RMT and default SDU encryption pipeline
Outstanding qualification
Yes for established protected traffic, using the same outer-framing boundary as the Tor and PRP entries. Ethernet/Wi-Fi framing, MAC addresses, EtherType, IV, lengths and timing remain observable; bootstrap and link discovery are excluded. This is not protocol indistinguishability. An enrolled intermediary can decrypt its own adjacency and read forwarding fields, so C06 remains No. No packet capture, independent cryptographic audit or active-probe qualification.
Public sources
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/kernel/sdup-crypto-ps-default.c
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/kernel/rmt.c
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/kernel/sdup.c
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/kernel/pci.c
- https://github.com/IRATI/stack/blob/726b535c908f8a74e8c68dd493cfbb1bd8726546/kernel/ipcps/shim-eth-core.c
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round668.html