network protocols handbook.pdf

113Protocols GuideSecurity and VPN - Secured Routing ProtocolsProtocol NameIPsec AH: IPsec AuthenticationHeaderProtocol DescriptionIP Authentication Header (AH), a key protocol in the IPsec (InternetSecurity) architecture, is used to provide connectionlessintegrity and data origin authentication for IP datagrams, and toprovide protection against replays. This latter (optional) servicemay be selected, by the receiver, when a Security Associationis established. AH provides authentication for as much of theIP header as possible, as well as for upper level protocol data.However, some IP header fields may change in transit and thevalue of these fields, when the packet arrives at the receiver,may not be predictable by the sender. The values of such fieldscannot be protected by AH. Thus the protection provided to theIP header by AH is somewhat piecemeal.AH may be applied alone, in combination with the IP EncapsulatingSecurity Payload (ESP), or in a nested fashion throughthe use of tunnel mode. Security services can be provided betweena pair of communicating hosts, between a pair of communicatingsecurity gateways, or between a security gateway anda host. ESP may be used to provide the same security services,and it also provides a confidentiality (encryption) service. Theprimary difference between the authentication provided by ESPand by AH is the extent of the coverage. Specifically, ESP doesnot protect any IP header fields unless those fields are encapsulatedby ESP. For more details on how to use AH and ESP invarious network environments, see the reference documents.When used with IPv6, the Authentication Header normally appearsafter the IPv6 Hop-by-Hop Header and before the IPv6Destination Options. When used with IPv4, the AuthenticationHeader normally follows the main IPv4 header.Protocol Structure8 16 32bitNext Header Payload Length ReservedSecurity parameters index (SPI)Sequence Number FieldAuthentication data (variable)• Next header - identifies the type of the next payloadafter the Authentication Header.• Payload Length - specifies the length of AH in 32-bitwords (4-byte units), minus “2”.• SPI - an arbitrary 32-bit value that, in combinationwith the destination IP address and security protocol(AH), uniquely identifies the Security Association forthis datagram.• Sequence Number – contains a monotonically increasingcounter value and is mandatory and is alwayspresent even if the receiver does not elect toenable the anti-replay service for a specific SA.• Authentication Data - a variable-length field containingan Integrity Check Value (ICV) computed over theESP packet minus the Authentication Data.Related protocolsIPsec, ESP, DES, AES, IKE, DOI, HMAC, HMAC-MD5, HMAC-SHA, PKI, IP, IPv6, ICMPSponsor SourceIP AH is defined by IETF (http://www.ietf.org)in RFC 2402.Referencehttp://www.javvin.com/protocol/rfc2402.pdfIP Authentication Header