| (I) An Internet IPsec protocol [R2402] designed to provide
connectionless data integrity service and data origin
authentication service for IP datagrams, and (optionally) to
provide protection against replay attacks.
(C) Replay protection may be selected by the receiver when a
security association is established. AH authenticates upper-layer
protocol data units and as much of the IP header as possible.
However, some IP header fields may change in transit, and the
value of these fields, when the packet arrives at the receiver,
may not be predictable by the sender. Thus, the values of such
fields cannot be protected end-to-end by AH; protection of the IP
header by AH is only partial when such fields are present.
(C) AH may be used alone, or in combination with the IPsec ESP
protocol, or in a nested fashion with tunneling. Security services
can be provided between a pair of communicating hosts, between a
pair of communicating security gateways, or between a host and a
gateway. ESP can provide the same security services as AH, and ESP
can also provide data confidentiality service. The main difference
between authentication services provided by ESP and AH is the
extent of the coverage; ESP does not protect IP header fields
unless they are encapsulated by AH.
|
