# Can P4 encode or encrypt a field in the header?
**URL:** https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732
**Category:** Getting Started with P4
**Created:** [April 11, 2023, 2:44pm UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732 "2023-04-11T14:44:40Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Duang](https://forum.p4.org/u/Duang)
#### Post date: [April 11, 2023, 2:44pm UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/1 "2023-04-11T14:44:40Z")
Can the p4 program encrypt or decrypt one or more fields in the received header?
For example, if I receive an ipv4 message, I would like to encrypt or encode the source address of the message in some way so that a third party cannot access the source address of the message, and then recover the source address by some means when it reaches its destination.
Are there any case studies or materials you can learn from?
---
### Author:  [@Duang](https://forum.p4.org/u/Duang)
#### Post date: [April 12, 2023, 3:04am UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/2 "2023-04-12T03:04:45Z")
Or how to send certain fields in a packet out to a generic cpu, encrypt them and then send them back to that packet. Does the packet waiting to be forwarded stop waiting while the cpu is processing that field?
---
### Author:  [@SteffenLindner](https://forum.p4.org/u/SteffenLindner)
#### Post date: [April 12, 2023, 5:05am UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/3 "2023-04-12T05:05:11Z")
You may have a look at [GitHub - uni-tue-kn/p4-macsec: P4-MACsec](https://github.com/uni-tue-kn/p4-macsec) and [GitHub - uni-tue-kn/p4-ipsec](https://github.com/uni-tue-kn/p4-ipsec) (Papers: [P4-MACsec: Dynamic Topology Monitoring and Data Layer Protection With MACsec in P4-Based SDN | IEEE Journals & Magazine | IEEE Xplore](https://ieeexplore.ieee.org/document/9044731) [P4-IPsec: Site-to-Site and Host-to-Site VPN With IPsec in P4-Based SDN | IEEE Journals & Magazine | IEEE Xplore](https://ieeexplore.ieee.org/document/9151942))
which use a self written extern to send packets to the cpu for encryption / decryption.
I believe there were also attempts to port these externs in the general bmv2 repo.
---
### Author:  [@Duang](https://forum.p4.org/u/Duang)
#### Post date: [April 12, 2023, 8:01am UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/4 "2023-04-12T08:01:54Z")
Thank you very much for the information, I read the source code and the paper of p4-MACsec, the gain is very huge, but still have some doubts and want to ask you for advice。
The external object is called in line 427 of the [basic.p4](https://github.com/uni-tue-kn/p4-macsec/blob/master/p4/p4/basic.p4) file. I can see that the object is declared before ingress, and I can guess that it is implemented in the simple\_switch.cpp file, but I still can’t understand the call relationship, because I found that the beginning of the p4 program contains core.p4 and v1model.p4 two files, but not the cpp file which implements the encryption function
---
### Author:  [@SteffenLindner](https://forum.p4.org/u/SteffenLindner)
#### Post date: [April 13, 2023, 4:57pm UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/5 "2023-04-13T16:57:42Z")
Hi,
the extern is registered in the simple\_switch.cpp via BM\_REGISTER\_EXTERN(ExternCrypt).
You may also have a look at: [extern implementaion · Issue #697 · p4lang/behavioral-model · GitHub](https://github.com/p4lang/behavioral-model/issues/697)
---
### Author:  [@Duang](https://forum.p4.org/u/Duang)
#### Post date: [April 14, 2023, 2:53am UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/6 "2023-04-14T02:53:33Z")
Thank you for your help, it’s very useful.
---
### Author:  [@mc36mc](https://forum.p4.org/u/mc36mc)
#### Post date: [June 6, 2023, 4:21pm UTC](https://forum.p4.org/t/can-p4-encode-or-encrypt-a-field-in-the-header/732/7 "2023-06-06T16:21:47Z")
if only the source ip needs to be encrypted (that is not a full packet encryption that you’re seeking) then imho you’re better off with an out-of-the-p4-band channel where you distribute a 32bits number, that later you’ll use as xor… on sending, it encrypts the source ip, on transmit, it decrypts it…
one thing to note well, isps nowadays are almost forced to check the source ip against the assigned subnets, that is, your packets most probably wont go through a real internet… this is the same that happens when you forget to enable nat and have 2 interfaces on a router connected to a consumer telco line…