3

Wikipedia says:

Unlike Authentication Header (AH), ESP in transport mode does not provide integrity and authentication for the entire IP packet.

I don't understand why this would be true. What is the Integrity Check Value of ESP used for in transport mode if it isn't used for guaranteeing integrity?

Improve this question

2 Answers 2

Reset to default
2

AH adds a cryptographic signature to each packet, which ensures nothing has modified it and it came from the correct source. AH is, obviously, not compatible with NAT.

ESP's ICV is just a checksum to ensure the packet hasn't been damaged. It does not ensure the packet has not been altered, or authenticate who sent it.

Improve this answer
1
  • 1
    This isn't accurate. ESP's ICV is calculated the same way AH's is -- as cryptographic keyed-hash over the content of the packet (i.e., an HMAC). The only difference is AH includes the outer IP header, while ESP does not. ESP absolutely ensures the packet payload has not been altered, but not the outer most IP Header.
    – Eddie
    Dec 12, 2018 at 19:29
2

The important part of that quote is "for the entire IP packet".

That is, the main difference between AH and ESP (without encryption) is what parts of the IP packet are covered by the ICV. AH's ICV covers the complete IP packet, except some parts of the header (like the TOS, TTL and checksum fields). On the other hand, ESP's ICV only covers the payload of the IP packet beginning with the ESP header.

For example, in tunnel mode, it does not cover the source/destination IP of the outer IP header, but the complete tunneled IP packet is covered by the ICV and integrity protected and authenticated.

Improve this answer
7
  • 1
    Is ESP's ICV only an unprotected checksum which an attacker could easily calculate and substitute accordingly after changing the payload, as @RickyBeam said?
    – UTF-8
    Oct 4, 2017 at 18:16
  • 1
    No, absolutely not. His answer is incorrect. ESP's ICV is a cryptographically secure integrity checksum (e.g. an HMAC) that can't be calculated by an attacker (unless he is somehow able to get at the secret key material).
    – ecdsa
    Oct 5, 2017 at 6:38
  • The figures in this section of the ESP RFC don't show the ICV to have guaranteed integrity.
    – UTF-8
    Oct 5, 2017 at 13:06
  • What are you talking about?
    – ecdsa
    Oct 5, 2017 at 15:12
  • Do you realize that "this section of the ESP RFC" is a link?
    – UTF-8
    Oct 5, 2017 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.