Authentication Header and Encapsulating Security Payload

Last Updated on Tue, 02 May 2023 | IPSEC

IPsec defines two security protocols called Authentication Header (AH) (RFC 2402) and Encapsulating Security Payload (ESP) (RFC 2406). Bach protocol defines its own format for the IPsec header that follows the IP header of an IPsec packet (see Figures 7-2 and

7-3). Both protocols use the concept of an SA; therefore, SAs can be either AH SAs or liSP SAs (an SA cannot be both an AH and ESP SA). Additionally, both AH and ESP^upporT transport and tunnel mode.

NOTE A device might send a transform set to its peer that specifies use of both AH and ESP. If the peer agrees, four SAs will be established: two for AH and two for ESP (assuming bidirectional traffic flow).

AH provides integrity and authentication, using shared key hashing algorithms such as MD5 HMAC and SILA-1 HMAC. AH does not provide confidentiality (encryption).

ESP provides confidentiality and, optionally, integrity and authentication. For confidentiality, ESP supports shared key encryption algorithms such as DES and Triple-DES. Like AH, ESP supports shared key hashing algorithms such as MD5 HMAC and SHA-1 HMAC for integrity and authentication.

Because ESP provides everything that AH does (integrity and authentication), you might not have a need for AH at all. However, there is a slight difference between the integrity and authentication provided by AH and the integrity and authentication provided by ESP. This is illustrated in Figure 7-4.

Figure 7-4 Differences Between AH and ESI' Integrity Checking

AH:

IP header

AH

Payload

-Integrity checked

ESP:

IP header ESP

Payload

I <-Integrity checked-H

Encrypted-* I

//ESP does not check the integrity of the entire IP packet—it protects everything but the IP header. AH on the other hand, checks the integrity of the entire IPsec packet, including the IP header (technically, some fields in the IP header are subject to change during transit and AH cannot protect these values).

Is this difference between AH and ESP significant enough to dismiss ESP's integrity and authentication service? Probably not for most implementations; however, if the integrity of the IP header is important, you can use All and ESP together. This comes at the price of having twice as many SAs as when using ESP alone: An SA can support either AH or ESP, but not both.

Continue reading here: VJfternet Key Exchange

Was this article helpful?

+1 0

Recommended Books

  • Network Security: Private Communication in a Public World
  • Cryptography and Network Security: Principles and Practice
  • Applied Cryptography: Protocols, Algorithms, and Source Code in C
  • Network Security Bible
  • Network Security Assessment

Related Posts

Readers' Questions

  • matthias
    What is the difference between authentication header and encapsulated security payload?
    3 months ago
    • An authentication header is a message integrity check that is used to verify that a packet has not been altered in transit. It is an additional layer of security for IP packets and is used in IPSec. An encapsulated security payload is a message used to cryptographically secure a transmitted IP packet. It is used to encrypt the data payload of a packet in order to protect it from being viewed by a third party. Unlike the authentication header which is used to ensure that a packet has not been altered in transit, the encapsulated security payload is used to encrypt the data payload before transmission.