TCP/IP Tutorial and Technical Overview - IBM Redbooks

9.2.5 IPv6 security
There are two optional headers defined for security purposes:
► Authentication Header (AH)
► Encapsulated Security Payload (ESP)
AH and ESP in IPv6 support authentication, data integrity, and optionally
confidentiality. AH conveys the authentication information in an IP package,
while ESP carries the encrypted data of the IP package.
Either or both can be implemented alone or combined in order to achieve
different levels of user security requirements. Note that they can also be
combined with other optional header to provision security features. For example,
a routing header can be used to list the intermediate secure nodes for a packet to
visit on the way, thus allowing the packet to travel only through secure routers.
IPv6 requires support for IPSec as a mandatory standard. This mandate
provides a standards-based solution for network security needs and promotes
interoperability.
Authentication header
The authentication header is used to ensure that a received packet has not been
altered in transit and that it really came from the claimed sender (Figure 9-11).
The authentication header is identified by the value 51 in the preceding Next
Header field. The format of the authentication header and further details are
specified in REF 4302.
Figure 9-11 IPV6 security authentication header
Where:
Security Parameters Index (SPI)
Sequence Number (SN) Field
Integrity Check Value-ICV
Security Parameters Index (SPI)
The SPI is an arbitrary 32-bit value that is used by a
Chapter 9. IP version 6 347