| encrypt | boolean | TRUE | Whether the transmitted traffic must be encrypted. | 
| mka-cak | string |  | The pre-shared CAK (Connectivity Association Key) for MACsec Key Agreement. Must be a string of 32 hexadecimal characters. | 
| mka-cak-flags | NMSettingSecretFlags (uint32) | 0 | Flags indicating how to handle the "mka-cak" property. | 
| mka-ckn | string |  | The pre-shared CKN (Connectivity-association Key Name) for MACsec Key Agreement. Must be a string of hexadecimal characters with a even length between 2 and 64. | 
| mode | int32 | 0 | Specifies how the CAK (Connectivity Association Key) for MKA (MACsec Key Agreement) is obtained. | 
| offload | int32 | -1 | Specifies the MACsec offload mode.
0 (off) disables MACsec offload.
1 (phy) and 2 (mac) request offload respectively to the PHY or to the MAC; if the selected mode is not available, the connection will fail.
-1 (default) uses the global default value specified in NetworkManager configuration; if no global default is defined, the built-in default is 0 (off). | 
| parent | string |  | If given, specifies the parent interface name or parent connection UUID from which this MACSEC interface should be created.  If this property is not specified, the connection must contain an "802-3-ethernet" setting with a "mac-address" property. | 
| port | int32 | 1 | The port component of the SCI (Secure Channel Identifier), between 1 and 65534. | 
| send-sci | boolean | TRUE | Specifies whether the SCI (Secure Channel Identifier) is included in every packet. | 
| validation | int32 | 2 | Specifies the validation mode for incoming frames. |