ipsec: Authentication Header (AH) and Encapsulating Security Payload (ESP)

The IPsec suite is a framework of open standards. IPsec uses the following protocols to perform various functions:

• Internet key exchange (IKE and IKEv2) to set up a security association (SA) by handling negotiation of protocols and algorithms and to generate the encryption and authentication keys to be used by IPsec.

• Authentication Header (AH) to provide connectionless integrity and data origin authentication for IP datagrams and to provide protection against replay attacks.

• Encapsulating Security Payload (ESP) to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality.

The IPSec headers (AH and ESP) can be used in transport mode or tunnel mode. In transport mode, the original IP header is followed by the AH or ESP header. If ESP is used in transport mode, only the upper-layer (e.g., TCP, UDP, IGMP) is encrypted. The IP header is not encrypted.

Additional Reading:

http://www.networksorcery.com/enp/protocol/esp.htm

http://www.networksorcery.com/enp/protocol/ah.htm

http://docs.hp.com/en/J4255-90011/ch04s03.html

http://en.wikipedia.org/wiki/IPsec