IPSec AH and ESP
Definition
Authentication Header provides integrity and origin authentication only. Encapsulating Security Payload provides confidentiality plus optional integrity. Almost all modern IPSec deployments use ESP; AH-only is rare.
- AH provides
- Integrity and origin authentication only
- ESP provides
- Confidentiality plus optional integrity
- Common deployment
- ESP used almost exclusively today
- AH-only use
- Rare in modern networks
Common questions
Why has ESP largely replaced AH in practice?+
ESP can deliver both confidentiality and integrity in a single protocol, and it works more reliably through network address translation, whereas AH's integrity check covers the outer IP header and breaks when NAT rewrites addresses in transit.
What does an investigator lose when a captured VPN stream uses ESP without integrity checking disabled?+
With ESP encryption in place and no visibility into the endpoint keys, packet payloads remain opaque to network capture, so forensic analysis of that traffic has to rely on endpoint logs, metadata such as timing and volume, or lawful key disclosure rather than payload content.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- IDS vs IPS
- An intrusion detection system observes copied traffic and alerts. An intrusion prevention system sits inline on the data path and blocks. Snort...
- Kerberos
- An MIT-designed authentication protocol using a Key Distribution Centre, ticket-granting tickets and service tickets. The backbone of Active Directory authentication. Replay-protected via...
- NGFW
- Next-generation firewall: stateful packet inspection plus application identification, integrated IPS, TLS inspection and user-identity awareness. Palo Alto, Fortinet, Check Point and Cisco...
- Stateful Firewall
- A firewall that tracks the state of TCP connections in a connection table and permits return traffic of an established flow without...